drivers/staging/wlan-ng/hfa384x_usb.c

   1 /* src/prism2/driver/hfa384x_usb.c
   2 *
   3 * Functions that talk to the USB variantof the Intersil hfa384x MAC
   4 *
   5 * Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
   6 * --------------------------------------------------------------------
   7 *
   8 * linux-wlan
   9 *
  10 *   The contents of this file are subject to the Mozilla Public
  11 *   License Version 1.1 (the "License"); you may not use this file
  12 *   except in compliance with the License. You may obtain a copy of
  13 *   the License at http://www.mozilla.org/MPL/
  14 *
  15 *   Software distributed under the License is distributed on an "AS
  16 *   IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
  17 *   implied. See the License for the specific language governing
  18 *   rights and limitations under the License.
  19 *
  20 *   Alternatively, the contents of this file may be used under the
  21 *   terms of the GNU Public License version 2 (the "GPL"), in which
  22 *   case the provisions of the GPL are applicable instead of the
  23 *   above.  If you wish to allow the use of your version of this file
  24 *   only under the terms of the GPL and not to allow others to use
  25 *   your version of this file under the MPL, indicate your decision
  26 *   by deleting the provisions above and replace them with the notice
  27 *   and other provisions required by the GPL.  If you do not delete
  28 *   the provisions above, a recipient may use your version of this
  29 *   file under either the MPL or the GPL.
  30 *
  31 * --------------------------------------------------------------------
  32 *
  33 * Inquiries regarding the linux-wlan Open Source project can be
  34 * made directly to:
  35 *
  36 * AbsoluteValue Systems Inc.
  37 * info@linux-wlan.com
  38 * http://www.linux-wlan.com
  39 *
  40 * --------------------------------------------------------------------
  41 *
  42 * Portions of the development of this software were funded by
  43 * Intersil Corporation as part of PRISM(R) chipset product development.
  44 *
  45 * --------------------------------------------------------------------
  46 *
  47 * This file implements functions that correspond to the prism2/hfa384x
  48 * 802.11 MAC hardware and firmware host interface.
  49 *
  50 * The functions can be considered to represent several levels of
  51 * abstraction.  The lowest level functions are simply C-callable wrappers
  52 * around the register accesses.  The next higher level represents C-callable
  53 * prism2 API functions that match the Intersil documentation as closely
  54 * as is reasonable.  The next higher layer implements common sequences
  55 * of invocations of the API layer (e.g. write to bap, followed by cmd).
  56 *
  57 * Common sequences:
  58 * hfa384x_drvr_xxx      Highest level abstractions provided by the
  59 *                       hfa384x code.  They are driver defined wrappers
  60 *                       for common sequences.  These functions generally
  61 *                       use the services of the lower levels.
  62 *
  63 * hfa384x_drvr_xxxconfig  An example of the drvr level abstraction. These
  64 *                       functions are wrappers for the RID get/set
  65 *                       sequence. They call copy_[to|from]_bap() and
  66 *                       cmd_access(). These functions operate on the
  67 *                       RIDs and buffers without validation. The caller
  68 *                       is responsible for that.
  69 *
  70 * API wrapper functions:
  71 * hfa384x_cmd_xxx       functions that provide access to the f/w commands.
  72 *                       The function arguments correspond to each command
  73 *                       argument, even command arguments that get packed
  74 *                       into single registers.  These functions _just_
  75 *                       issue the command by setting the cmd/parm regs
  76 *                       & reading the status/resp regs.  Additional
  77 *                       activities required to fully use a command
  78 *                       (read/write from/to bap, get/set int status etc.)
  79 *                       are implemented separately.  Think of these as
  80 *                       C-callable prism2 commands.
  81 *
  82 * Lowest Layer Functions:
  83 * hfa384x_docmd_xxx     These functions implement the sequence required
  84 *                       to issue any prism2 command.  Primarily used by the
  85 *                       hfa384x_cmd_xxx functions.
  86 *
  87 * hfa384x_bap_xxx       BAP read/write access functions.
  88 *                       Note: we usually use BAP0 for non-interrupt context
  89 *                        and BAP1 for interrupt context.
  90 *
  91 * hfa384x_dl_xxx        download related functions.
  92 *
  93 * Driver State Issues:
  94 * Note that there are two pairs of functions that manage the
  95 * 'initialized' and 'running' states of the hw/MAC combo.  The four
  96 * functions are create(), destroy(), start(), and stop().  create()
  97 * sets up the data structures required to support the hfa384x_*
  98 * functions and destroy() cleans them up.  The start() function gets
  99 * the actual hardware running and enables the interrupts.  The stop()
 100 * function shuts the hardware down.  The sequence should be:
 101 * create()
 102 * start()
 103 *  .
 104 *  .  Do interesting things w/ the hardware
 105 *  .
 106 * stop()
 107 * destroy()
 108 *
 109 * Note that destroy() can be called without calling stop() first.
 110 * --------------------------------------------------------------------
 111 */
 112
 113 #include <linux/module.h>
 114 #include <linux/kernel.h>
 115 #include <linux/sched.h>
 116 #include <linux/types.h>
 117 #include <linux/slab.h>
 118 #include <linux/wireless.h>
 119 #include <linux/netdevice.h>
 120 #include <linux/timer.h>
 121 #include <linux/io.h>
 122 #include <linux/delay.h>
 123 #include <asm/byteorder.h>
 124 #include <linux/bitops.h>
 125 #include <linux/list.h>
 126 #include <linux/usb.h>
 127 #include <linux/byteorder/generic.h>
 128
 129 #include "p80211types.h"
 130 #include "p80211hdr.h"
 131 #include "p80211mgmt.h"
 132 #include "p80211conv.h"
 133 #include "p80211msg.h"
 134 #include "p80211netdev.h"
 135 #include "p80211req.h"
 136 #include "p80211metadef.h"
 137 #include "p80211metastruct.h"
 138 #include "hfa384x.h"
 139 #include "prism2mgmt.h"
 140
 141 enum cmd_mode {
 142         DOWAIT = 0,
 143         DOASYNC
 144 };
 145
 146 #define THROTTLE_JIFFIES        (HZ / 8)
 147 #define URB_ASYNC_UNLINK 0
 148 #define USB_QUEUE_BULK 0
 149
 150 #define ROUNDUP64(a) (((a) + 63) & ~63)
 151
 152 #ifdef DEBUG_USB
 153 static void dbprint_urb(struct urb *urb);
 154 #endif
 155
 156 static void
 157 hfa384x_int_rxmonitor(struct wlandevice *wlandev, struct hfa384x_usb_rxfrm *rxfrm);
 158
 159 static void hfa384x_usb_defer(struct work_struct *data);
 160
 161 static int submit_rx_urb(struct hfa384x *hw, gfp_t flags);
 162
 163 static int submit_tx_urb(struct hfa384x *hw, struct urb *tx_urb, gfp_t flags);
 164
 165 /*---------------------------------------------------*/
 166 /* Callbacks */
 167 static void hfa384x_usbout_callback(struct urb *urb);
 168 static void hfa384x_ctlxout_callback(struct urb *urb);
 169 static void hfa384x_usbin_callback(struct urb *urb);
 170
 171 static void
 172 hfa384x_usbin_txcompl(struct wlandevice *wlandev, union hfa384x_usbin *usbin);
 173
 174 static void hfa384x_usbin_rx(struct wlandevice *wlandev, struct sk_buff *skb);
 175
 176 static void hfa384x_usbin_info(struct wlandevice *wlandev, union hfa384x_usbin *usbin);
 177
 178 static void hfa384x_usbin_ctlx(struct hfa384x *hw, union hfa384x_usbin *usbin,
 179                                int urb_status);
 180
 181 /*---------------------------------------------------*/
 182 /* Functions to support the prism2 usb command queue */
 183
 184 static void hfa384x_usbctlxq_run(struct hfa384x *hw);
 185
 186 static void hfa384x_usbctlx_reqtimerfn(unsigned long data);
 187
 188 static void hfa384x_usbctlx_resptimerfn(unsigned long data);
 189
 190 static void hfa384x_usb_throttlefn(unsigned long data);
 191
 192 static void hfa384x_usbctlx_completion_task(unsigned long data);
 193
 194 static void hfa384x_usbctlx_reaper_task(unsigned long data);
 195
 196 static int hfa384x_usbctlx_submit(struct hfa384x *hw, struct hfa384x_usbctlx *ctlx);
 197
 198 static void unlocked_usbctlx_complete(struct hfa384x *hw, struct hfa384x_usbctlx *ctlx);
 199
 200 struct usbctlx_completor {
 201         int (*complete)(struct usbctlx_completor *);
 202 };
 203
 204 static int
 205 hfa384x_usbctlx_complete_sync(struct hfa384x *hw,
 206                               struct hfa384x_usbctlx *ctlx,
 207                               struct usbctlx_completor *completor);
 208
 209 static int
 210 unlocked_usbctlx_cancel_async(struct hfa384x *hw, struct hfa384x_usbctlx *ctlx);
 211
 212 static void hfa384x_cb_status(struct hfa384x *hw, const struct hfa384x_usbctlx *ctlx);
 213
 214 static int
 215 usbctlx_get_status(const struct hfa384x_usb_statusresp *cmdresp,
 216                    struct hfa384x_cmdresult *result);
 217
 218 static void
 219 usbctlx_get_rridresult(const struct hfa384x_usb_rridresp *rridresp,
 220                        struct hfa384x_rridresult *result);
 221
 222 /*---------------------------------------------------*/
 223 /* Low level req/resp CTLX formatters and submitters */
 224 static int
 225 hfa384x_docmd(struct hfa384x *hw,
 226               enum cmd_mode mode,
 227               struct hfa384x_metacmd *cmd,
 228               ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 229
 230 static int
 231 hfa384x_dorrid(struct hfa384x *hw,
 232                enum cmd_mode mode,
 233                u16 rid,
 234                void *riddata,
 235                unsigned int riddatalen,
 236                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 237
 238 static int
 239 hfa384x_dowrid(struct hfa384x *hw,
 240                enum cmd_mode mode,
 241                u16 rid,
 242                void *riddata,
 243                unsigned int riddatalen,
 244                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 245
 246 static int
 247 hfa384x_dormem(struct hfa384x *hw,
 248                enum cmd_mode mode,
 249                u16 page,
 250                u16 offset,
 251                void *data,
 252                unsigned int len,
 253                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 254
 255 static int
 256 hfa384x_dowmem(struct hfa384x *hw,
 257                enum cmd_mode mode,
 258                u16 page,
 259                u16 offset,
 260                void *data,
 261                unsigned int len,
 262                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 263
 264 static int hfa384x_isgood_pdrcode(u16 pdrcode);
 265
 266 static inline const char *ctlxstr(CTLX_STATE s)
 267 {
 268         static const char * const ctlx_str[] = {
 269                 "Initial state",
 270                 "Complete",
 271                 "Request failed",
 272                 "Request pending",
 273                 "Request packet submitted",
 274                 "Request packet completed",
 275                 "Response packet completed"
 276         };
 277
 278         return ctlx_str[s];
 279 };
 280
 281 static inline struct hfa384x_usbctlx *get_active_ctlx(struct hfa384x *hw)
 282 {
 283         return list_entry(hw->ctlxq.active.next, struct hfa384x_usbctlx, list);
 284 }
 285
 286 #ifdef DEBUG_USB
 287 void dbprint_urb(struct urb *urb)
 288 {
 289         pr_debug("urb->pipe=0x%08x\n", urb->pipe);
 290         pr_debug("urb->status=0x%08x\n", urb->status);
 291         pr_debug("urb->transfer_flags=0x%08x\n", urb->transfer_flags);
 292         pr_debug("urb->transfer_buffer=0x%08x\n",
 293                  (unsigned int)urb->transfer_buffer);
 294         pr_debug("urb->transfer_buffer_length=0x%08x\n",
 295                  urb->transfer_buffer_length);
 296         pr_debug("urb->actual_length=0x%08x\n", urb->actual_length);
 297         pr_debug("urb->bandwidth=0x%08x\n", urb->bandwidth);
 298         pr_debug("urb->setup_packet(ctl)=0x%08x\n",
 299                  (unsigned int)urb->setup_packet);
 300         pr_debug("urb->start_frame(iso/irq)=0x%08x\n", urb->start_frame);
 301         pr_debug("urb->interval(irq)=0x%08x\n", urb->interval);
 302         pr_debug("urb->error_count(iso)=0x%08x\n", urb->error_count);
 303         pr_debug("urb->timeout=0x%08x\n", urb->timeout);
 304         pr_debug("urb->context=0x%08x\n", (unsigned int)urb->context);
 305         pr_debug("urb->complete=0x%08x\n", (unsigned int)urb->complete);
 306 }
 307 #endif
 308
 309 /*----------------------------------------------------------------
 310 * submit_rx_urb
 311 *
 312 * Listen for input data on the BULK-IN pipe. If the pipe has
 313 * stalled then schedule it to be reset.
 314 *
 315 * Arguments:
 316 *       hw              device struct
 317 *       memflags        memory allocation flags
 318 *
 319 * Returns:
 320 *       error code from submission
 321 *
 322 * Call context:
 323 *       Any
 324 ----------------------------------------------------------------*/
 325 static int submit_rx_urb(struct hfa384x *hw, gfp_t memflags)
 326 {
 327         struct sk_buff *skb;
 328         int result;
 329
 330         skb = dev_alloc_skb(sizeof(union hfa384x_usbin));
 331         if (!skb) {
 332                 result = -ENOMEM;
 333                 goto done;
 334         }
 335
 336         /* Post the IN urb */
 337         usb_fill_bulk_urb(&hw->rx_urb, hw->usb,
 338                           hw->endp_in,
 339                           skb->data, sizeof(union hfa384x_usbin),
 340                           hfa384x_usbin_callback, hw->wlandev);
 341
 342         hw->rx_urb_skb = skb;
 343
 344         result = -ENOLINK;
 345         if (!hw->wlandev->hwremoved &&
 346             !test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 347                 result = usb_submit_urb(&hw->rx_urb, memflags);
 348
 349                 /* Check whether we need to reset the RX pipe */
 350                 if (result == -EPIPE) {
 351                         netdev_warn(hw->wlandev->netdev,
 352                                     "%s rx pipe stalled: requesting reset\n",
 353                                     hw->wlandev->netdev->name);
 354                         if (!test_and_set_bit(WORK_RX_HALT, &hw->usb_flags))
 355                                 schedule_work(&hw->usb_work);
 356                 }
 357         }
 358
 359         /* Don't leak memory if anything should go wrong */
 360         if (result != 0) {
 361                 dev_kfree_skb(skb);
 362                 hw->rx_urb_skb = NULL;
 363         }
 364
 365 done:
 366         return result;
 367 }
 368
 369 /*----------------------------------------------------------------
 370 * submit_tx_urb
 371 *
 372 * Prepares and submits the URB of transmitted data. If the
 373 * submission fails then it will schedule the output pipe to
 374 * be reset.
 375 *
 376 * Arguments:
 377 *       hw              device struct
 378 *       tx_urb          URB of data for transmission
 379 *       memflags        memory allocation flags
 380 *
 381 * Returns:
 382 *       error code from submission
 383 *
 384 * Call context:
 385 *       Any
 386 ----------------------------------------------------------------*/
 387 static int submit_tx_urb(struct hfa384x *hw, struct urb *tx_urb, gfp_t memflags)
 388 {
 389         struct net_device *netdev = hw->wlandev->netdev;
 390         int result;
 391
 392         result = -ENOLINK;
 393         if (netif_running(netdev)) {
 394                 if (!hw->wlandev->hwremoved &&
 395                     !test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 396                         result = usb_submit_urb(tx_urb, memflags);
 397
 398                         /* Test whether we need to reset the TX pipe */
 399                         if (result == -EPIPE) {
 400                                 netdev_warn(hw->wlandev->netdev,
 401                                             "%s tx pipe stalled: requesting reset\n",
 402                                             netdev->name);
 403                                 set_bit(WORK_TX_HALT, &hw->usb_flags);
 404                                 schedule_work(&hw->usb_work);
 405                         } else if (result == 0) {
 406                                 netif_stop_queue(netdev);
 407                         }
 408                 }
 409         }
 410
 411         return result;
 412 }
 413
 414 /*----------------------------------------------------------------
 415 * hfa394x_usb_defer
 416 *
 417 * There are some things that the USB stack cannot do while
 418 * in interrupt context, so we arrange this function to run
 419 * in process context.
 420 *
 421 * Arguments:
 422 *       hw      device structure
 423 *
 424 * Returns:
 425 *       nothing
 426 *
 427 * Call context:
 428 *       process (by design)
 429 ----------------------------------------------------------------*/
 430 static void hfa384x_usb_defer(struct work_struct *data)
 431 {
 432         struct hfa384x *hw = container_of(data, struct hfa384x, usb_work);
 433         struct net_device *netdev = hw->wlandev->netdev;
 434
 435         /* Don't bother trying to reset anything if the plug
 436          * has been pulled ...
 437          */
 438         if (hw->wlandev->hwremoved)
 439                 return;
 440
 441         /* Reception has stopped: try to reset the input pipe */
 442         if (test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 443                 int ret;
 444
 445                 usb_kill_urb(&hw->rx_urb); /* Cannot be holding spinlock! */
 446
 447                 ret = usb_clear_halt(hw->usb, hw->endp_in);
 448                 if (ret != 0) {
 449                         netdev_err(hw->wlandev->netdev,
 450                                    "Failed to clear rx pipe for %s: err=%d\n",
 451                                    netdev->name, ret);
 452                 } else {
 453                         netdev_info(hw->wlandev->netdev, "%s rx pipe reset complete.\n",
 454                                     netdev->name);
 455                         clear_bit(WORK_RX_HALT, &hw->usb_flags);
 456                         set_bit(WORK_RX_RESUME, &hw->usb_flags);
 457                 }
 458         }
 459
 460         /* Resume receiving data back from the device. */
 461         if (test_bit(WORK_RX_RESUME, &hw->usb_flags)) {
 462                 int ret;
 463
 464                 ret = submit_rx_urb(hw, GFP_KERNEL);
 465                 if (ret != 0) {
 466                         netdev_err(hw->wlandev->netdev,
 467                                    "Failed to resume %s rx pipe.\n",
 468                                    netdev->name);
 469                 } else {
 470                         clear_bit(WORK_RX_RESUME, &hw->usb_flags);
 471                 }
 472         }
 473
 474         /* Transmission has stopped: try to reset the output pipe */
 475         if (test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 476                 int ret;
 477
 478                 usb_kill_urb(&hw->tx_urb);
 479                 ret = usb_clear_halt(hw->usb, hw->endp_out);
 480                 if (ret != 0) {
 481                         netdev_err(hw->wlandev->netdev,
 482                                    "Failed to clear tx pipe for %s: err=%d\n",
 483                                    netdev->name, ret);
 484                 } else {
 485                         netdev_info(hw->wlandev->netdev, "%s tx pipe reset complete.\n",
 486                                     netdev->name);
 487                         clear_bit(WORK_TX_HALT, &hw->usb_flags);
 488                         set_bit(WORK_TX_RESUME, &hw->usb_flags);
 489
 490                         /* Stopping the BULK-OUT pipe also blocked
 491                          * us from sending any more CTLX URBs, so
 492                          * we need to re-run our queue ...
 493                          */
 494                         hfa384x_usbctlxq_run(hw);
 495                 }
 496         }
 497
 498         /* Resume transmitting. */
 499         if (test_and_clear_bit(WORK_TX_RESUME, &hw->usb_flags))
 500                 netif_wake_queue(hw->wlandev->netdev);
 501 }
 502
 503 /*----------------------------------------------------------------
 504 * hfa384x_create
 505 *
 506 * Sets up the struct hfa384x data structure for use.  Note this
 507 * does _not_ initialize the actual hardware, just the data structures
 508 * we use to keep track of its state.
 509 *
 510 * Arguments:
 511 *       hw              device structure
 512 *       irq             device irq number
 513 *       iobase          i/o base address for register access
 514 *       membase         memory base address for register access
 515 *
 516 * Returns:
 517 *       nothing
 518 *
 519 * Side effects:
 520 *
 521 * Call context:
 522 *       process
 523 ----------------------------------------------------------------*/
 524 void hfa384x_create(struct hfa384x *hw, struct usb_device *usb)
 525 {
 526         hw->usb = usb;
 527
 528         /* Set up the waitq */
 529         init_waitqueue_head(&hw->cmdq);
 530
 531         /* Initialize the command queue */
 532         spin_lock_init(&hw->ctlxq.lock);
 533         INIT_LIST_HEAD(&hw->ctlxq.pending);
 534         INIT_LIST_HEAD(&hw->ctlxq.active);
 535         INIT_LIST_HEAD(&hw->ctlxq.completing);
 536         INIT_LIST_HEAD(&hw->ctlxq.reapable);
 537
 538         /* Initialize the authentication queue */
 539         skb_queue_head_init(&hw->authq);
 540
 541         tasklet_init(&hw->reaper_bh,
 542                      hfa384x_usbctlx_reaper_task, (unsigned long)hw);
 543         tasklet_init(&hw->completion_bh,
 544                      hfa384x_usbctlx_completion_task, (unsigned long)hw);
 545         INIT_WORK(&hw->link_bh, prism2sta_processing_defer);
 546         INIT_WORK(&hw->usb_work, hfa384x_usb_defer);
 547
 548         setup_timer(&hw->throttle, hfa384x_usb_throttlefn, (unsigned long)hw);
 549
 550         setup_timer(&hw->resptimer, hfa384x_usbctlx_resptimerfn,
 551                     (unsigned long)hw);
 552
 553         setup_timer(&hw->reqtimer, hfa384x_usbctlx_reqtimerfn,
 554                     (unsigned long)hw);
 555
 556         usb_init_urb(&hw->rx_urb);
 557         usb_init_urb(&hw->tx_urb);
 558         usb_init_urb(&hw->ctlx_urb);
 559
 560         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 561         hw->state = HFA384x_STATE_INIT;
 562
 563         INIT_WORK(&hw->commsqual_bh, prism2sta_commsqual_defer);
 564         setup_timer(&hw->commsqual_timer, prism2sta_commsqual_timer,
 565                     (unsigned long)hw);
 566 }
 567
 568 /*----------------------------------------------------------------
 569 * hfa384x_destroy
 570 *
 571 * Partner to hfa384x_create().  This function cleans up the hw
 572 * structure so that it can be freed by the caller using a simple
 573 * kfree.  Currently, this function is just a placeholder.  If, at some
 574 * point in the future, an hw in the 'shutdown' state requires a 'deep'
 575 * kfree, this is where it should be done.  Note that if this function
 576 * is called on a _running_ hw structure, the drvr_stop() function is
 577 * called.
 578 *
 579 * Arguments:
 580 *       hw              device structure
 581 *
 582 * Returns:
 583 *       nothing, this function is not allowed to fail.
 584 *
 585 * Side effects:
 586 *
 587 * Call context:
 588 *       process
 589 ----------------------------------------------------------------*/
 590 void hfa384x_destroy(struct hfa384x *hw)
 591 {
 592         struct sk_buff *skb;
 593
 594         if (hw->state == HFA384x_STATE_RUNNING)
 595                 hfa384x_drvr_stop(hw);
 596         hw->state = HFA384x_STATE_PREINIT;
 597
 598         kfree(hw->scanresults);
 599         hw->scanresults = NULL;
 600
 601         /* Now to clean out the auth queue */
 602         while ((skb = skb_dequeue(&hw->authq)))
 603                 dev_kfree_skb(skb);
 604 }
 605
 606 static struct hfa384x_usbctlx *usbctlx_alloc(void)
 607 {
 608         struct hfa384x_usbctlx *ctlx;
 609
 610         ctlx = kzalloc(sizeof(*ctlx),
 611                        in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 612         if (ctlx)
 613                 init_completion(&ctlx->done);
 614
 615         return ctlx;
 616 }
 617
 618 static int
 619 usbctlx_get_status(const struct hfa384x_usb_statusresp *cmdresp,
 620                    struct hfa384x_cmdresult *result)
 621 {
 622         result->status = le16_to_cpu(cmdresp->status);
 623         result->resp0 = le16_to_cpu(cmdresp->resp0);
 624         result->resp1 = le16_to_cpu(cmdresp->resp1);
 625         result->resp2 = le16_to_cpu(cmdresp->resp2);
 626
 627         pr_debug("cmdresult:status=0x%04x resp0=0x%04x resp1=0x%04x resp2=0x%04x\n",
 628                  result->status, result->resp0, result->resp1, result->resp2);
 629
 630         return result->status & HFA384x_STATUS_RESULT;
 631 }
 632
 633 static void
 634 usbctlx_get_rridresult(const struct hfa384x_usb_rridresp *rridresp,
 635                        struct hfa384x_rridresult *result)
 636 {
 637         result->rid = le16_to_cpu(rridresp->rid);
 638         result->riddata = rridresp->data;
 639         result->riddata_len = ((le16_to_cpu(rridresp->frmlen) - 1) * 2);
 640 }
 641
 642 /*----------------------------------------------------------------
 643 * Completor object:
 644 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 645 * when processing a CTLX that returns a struct hfa384x_cmdresult structure.
 646 ----------------------------------------------------------------*/
 647 struct usbctlx_cmd_completor {
 648         struct usbctlx_completor head;
 649
 650         const struct hfa384x_usb_statusresp *cmdresp;
 651         struct hfa384x_cmdresult *result;
 652 };
 653
 654 static inline int usbctlx_cmd_completor_fn(struct usbctlx_completor *head)
 655 {
 656         struct usbctlx_cmd_completor *complete;
 657
 658         complete = (struct usbctlx_cmd_completor *)head;
 659         return usbctlx_get_status(complete->cmdresp, complete->result);
 660 }
 661
 662 static inline struct usbctlx_completor *init_cmd_completor(
 663                                                 struct usbctlx_cmd_completor
 664                                                         *completor,
 665                                                 const struct hfa384x_usb_statusresp
 666                                                         *cmdresp,
 667                                                 struct hfa384x_cmdresult *result)
 668 {
 669         completor->head.complete = usbctlx_cmd_completor_fn;
 670         completor->cmdresp = cmdresp;
 671         completor->result = result;
 672         return &(completor->head);
 673 }
 674
 675 /*----------------------------------------------------------------
 676 * Completor object:
 677 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 678 * when processing a CTLX that reads a RID.
 679 ----------------------------------------------------------------*/
 680 struct usbctlx_rrid_completor {
 681         struct usbctlx_completor head;
 682
 683         const struct hfa384x_usb_rridresp *rridresp;
 684         void *riddata;
 685         unsigned int riddatalen;
 686 };
 687
 688 static int usbctlx_rrid_completor_fn(struct usbctlx_completor *head)
 689 {
 690         struct usbctlx_rrid_completor *complete;
 691         struct hfa384x_rridresult rridresult;
 692
 693         complete = (struct usbctlx_rrid_completor *)head;
 694         usbctlx_get_rridresult(complete->rridresp, &rridresult);
 695
 696         /* Validate the length, note body len calculation in bytes */
 697         if (rridresult.riddata_len != complete->riddatalen) {
 698                 pr_warn("RID len mismatch, rid=0x%04x hlen=%d fwlen=%d\n",
 699                         rridresult.rid,
 700                         complete->riddatalen, rridresult.riddata_len);
 701                 return -ENODATA;
 702         }
 703
 704         memcpy(complete->riddata, rridresult.riddata, complete->riddatalen);
 705         return 0;
 706 }
 707
 708 static inline struct usbctlx_completor *init_rrid_completor(
 709                                                 struct usbctlx_rrid_completor
 710                                                         *completor,
 711                                                 const struct hfa384x_usb_rridresp
 712                                                         *rridresp,
 713                                                 void *riddata,
 714                                                 unsigned int riddatalen)
 715 {
 716         completor->head.complete = usbctlx_rrid_completor_fn;
 717         completor->rridresp = rridresp;
 718         completor->riddata = riddata;
 719         completor->riddatalen = riddatalen;
 720         return &(completor->head);
 721 }
 722
 723 /*----------------------------------------------------------------
 724 * Completor object:
 725 * Interprets the results of a synchronous RID-write
 726 ----------------------------------------------------------------*/
 727 #define init_wrid_completor  init_cmd_completor
 728
 729 /*----------------------------------------------------------------
 730 * Completor object:
 731 * Interprets the results of a synchronous memory-write
 732 ----------------------------------------------------------------*/
 733 #define init_wmem_completor  init_cmd_completor
 734
 735 /*----------------------------------------------------------------
 736 * Completor object:
 737 * Interprets the results of a synchronous memory-read
 738 ----------------------------------------------------------------*/
 739 struct usbctlx_rmem_completor {
 740         struct usbctlx_completor head;
 741
 742         const struct hfa384x_usb_rmemresp *rmemresp;
 743         void *data;
 744         unsigned int len;
 745 };
 746
 747 static int usbctlx_rmem_completor_fn(struct usbctlx_completor *head)
 748 {
 749         struct usbctlx_rmem_completor *complete =
 750                 (struct usbctlx_rmem_completor *)head;
 751
 752         pr_debug("rmemresp:len=%d\n", complete->rmemresp->frmlen);
 753         memcpy(complete->data, complete->rmemresp->data, complete->len);
 754         return 0;
 755 }
 756
 757 static inline struct usbctlx_completor *init_rmem_completor(
 758                                                 struct usbctlx_rmem_completor
 759                                                         *completor,
 760                                                 struct hfa384x_usb_rmemresp
 761                                                         *rmemresp,
 762                                                 void *data,
 763                                                 unsigned int len)
 764 {
 765         completor->head.complete = usbctlx_rmem_completor_fn;
 766         completor->rmemresp = rmemresp;
 767         completor->data = data;
 768         completor->len = len;
 769         return &(completor->head);
 770 }
 771
 772 /*----------------------------------------------------------------
 773 * hfa384x_cb_status
 774 *
 775 * Ctlx_complete handler for async CMD type control exchanges.
 776 * mark the hw struct as such.
 777 *
 778 * Note: If the handling is changed here, it should probably be
 779 *       changed in docmd as well.
 780 *
 781 * Arguments:
 782 *       hw              hw struct
 783 *       ctlx            completed CTLX
 784 *
 785 * Returns:
 786 *       nothing
 787 *
 788 * Side effects:
 789 *
 790 * Call context:
 791 *       interrupt
 792 ----------------------------------------------------------------*/
 793 static void hfa384x_cb_status(struct hfa384x *hw, const struct hfa384x_usbctlx *ctlx)
 794 {
 795         if (ctlx->usercb) {
 796                 struct hfa384x_cmdresult cmdresult;
 797
 798                 if (ctlx->state != CTLX_COMPLETE) {
 799                         memset(&cmdresult, 0, sizeof(cmdresult));
 800                         cmdresult.status =
 801                             HFA384x_STATUS_RESULT_SET(HFA384x_CMD_ERR);
 802                 } else {
 803                         usbctlx_get_status(&ctlx->inbuf.cmdresp, &cmdresult);
 804                 }
 805
 806                 ctlx->usercb(hw, &cmdresult, ctlx->usercb_data);
 807         }
 808 }
 809
 810 static inline int hfa384x_docmd_wait(struct hfa384x *hw, struct hfa384x_metacmd *cmd)
 811 {
 812         return hfa384x_docmd(hw, DOWAIT, cmd, NULL, NULL, NULL);
 813 }
 814
 815 static inline int
 816 hfa384x_docmd_async(struct hfa384x *hw,
 817                     struct hfa384x_metacmd *cmd,
 818                     ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
 819 {
 820         return hfa384x_docmd(hw, DOASYNC, cmd, cmdcb, usercb, usercb_data);
 821 }
 822
 823 static inline int
 824 hfa384x_dorrid_wait(struct hfa384x *hw, u16 rid, void *riddata,
 825                     unsigned int riddatalen)
 826 {
 827         return hfa384x_dorrid(hw, DOWAIT,
 828                               rid, riddata, riddatalen, NULL, NULL, NULL);
 829 }
 830
 831 static inline int
 832 hfa384x_dorrid_async(struct hfa384x *hw,
 833                      u16 rid, void *riddata, unsigned int riddatalen,
 834                      ctlx_cmdcb_t cmdcb,
 835                      ctlx_usercb_t usercb, void *usercb_data)
 836 {
 837         return hfa384x_dorrid(hw, DOASYNC,
 838                               rid, riddata, riddatalen,
 839                               cmdcb, usercb, usercb_data);
 840 }
 841
 842 static inline int
 843 hfa384x_dowrid_wait(struct hfa384x *hw, u16 rid, void *riddata,
 844                     unsigned int riddatalen)
 845 {
 846         return hfa384x_dowrid(hw, DOWAIT,
 847                               rid, riddata, riddatalen, NULL, NULL, NULL);
 848 }
 849
 850 static inline int
 851 hfa384x_dowrid_async(struct hfa384x *hw,
 852                      u16 rid, void *riddata, unsigned int riddatalen,
 853                      ctlx_cmdcb_t cmdcb,
 854                      ctlx_usercb_t usercb, void *usercb_data)
 855 {
 856         return hfa384x_dowrid(hw, DOASYNC,
 857                               rid, riddata, riddatalen,
 858                               cmdcb, usercb, usercb_data);
 859 }
 860
 861 static inline int
 862 hfa384x_dormem_wait(struct hfa384x *hw,
 863                     u16 page, u16 offset, void *data, unsigned int len)
 864 {
 865         return hfa384x_dormem(hw, DOWAIT,
 866                               page, offset, data, len, NULL, NULL, NULL);
 867 }
 868
 869 static inline int
 870 hfa384x_dormem_async(struct hfa384x *hw,
 871                      u16 page, u16 offset, void *data, unsigned int len,
 872                      ctlx_cmdcb_t cmdcb,
 873                      ctlx_usercb_t usercb, void *usercb_data)
 874 {
 875         return hfa384x_dormem(hw, DOASYNC,
 876                               page, offset, data, len,
 877                               cmdcb, usercb, usercb_data);
 878 }
 879
 880 static inline int
 881 hfa384x_dowmem_wait(struct hfa384x *hw,
 882                     u16 page, u16 offset, void *data, unsigned int len)
 883 {
 884         return hfa384x_dowmem(hw, DOWAIT,
 885                               page, offset, data, len, NULL, NULL, NULL);
 886 }
 887
 888 static inline int
 889 hfa384x_dowmem_async(struct hfa384x *hw,
 890                      u16 page,
 891                      u16 offset,
 892                      void *data,
 893                      unsigned int len,
 894                      ctlx_cmdcb_t cmdcb,
 895                      ctlx_usercb_t usercb, void *usercb_data)
 896 {
 897         return hfa384x_dowmem(hw, DOASYNC,
 898                               page, offset, data, len,
 899                               cmdcb, usercb, usercb_data);
 900 }
 901
 902 /*----------------------------------------------------------------
 903 * hfa384x_cmd_initialize
 904 *
 905 * Issues the initialize command and sets the hw->state based
 906 * on the result.
 907 *
 908 * Arguments:
 909 *       hw              device structure
 910 *
 911 * Returns:
 912 *       0               success
 913 *       >0              f/w reported error - f/w status code
 914 *       <0              driver reported error
 915 *
 916 * Side effects:
 917 *
 918 * Call context:
 919 *       process
 920 ----------------------------------------------------------------*/
 921 int hfa384x_cmd_initialize(struct hfa384x *hw)
 922 {
 923         int result = 0;
 924         int i;
 925         struct hfa384x_metacmd cmd;
 926
 927         cmd.cmd = HFA384x_CMDCODE_INIT;
 928         cmd.parm0 = 0;
 929         cmd.parm1 = 0;
 930         cmd.parm2 = 0;
 931
 932         result = hfa384x_docmd_wait(hw, &cmd);
 933
 934         pr_debug("cmdresp.init: status=0x%04x, resp0=0x%04x, resp1=0x%04x, resp2=0x%04x\n",
 935                  cmd.result.status,
 936                  cmd.result.resp0, cmd.result.resp1, cmd.result.resp2);
 937         if (result == 0) {
 938                 for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
 939                         hw->port_enabled[i] = 0;
 940         }
 941
 942         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 943
 944         return result;
 945 }
 946
 947 /*----------------------------------------------------------------
 948 * hfa384x_cmd_disable
 949 *
 950 * Issues the disable command to stop communications on one of
 951 * the MACs 'ports'.
 952 *
 953 * Arguments:
 954 *       hw              device structure
 955 *       macport         MAC port number (host order)
 956 *
 957 * Returns:
 958 *       0               success
 959 *       >0              f/w reported failure - f/w status code
 960 *       <0              driver reported error (timeout|bad arg)
 961 *
 962 * Side effects:
 963 *
 964 * Call context:
 965 *       process
 966 ----------------------------------------------------------------*/
 967 int hfa384x_cmd_disable(struct hfa384x *hw, u16 macport)
 968 {
 969         struct hfa384x_metacmd cmd;
 970
 971         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DISABLE) |
 972             HFA384x_CMD_MACPORT_SET(macport);
 973         cmd.parm0 = 0;
 974         cmd.parm1 = 0;
 975         cmd.parm2 = 0;
 976
 977         return hfa384x_docmd_wait(hw, &cmd);
 978 }
 979
 980 /*----------------------------------------------------------------
 981 * hfa384x_cmd_enable
 982 *
 983 * Issues the enable command to enable communications on one of
 984 * the MACs 'ports'.
 985 *
 986 * Arguments:
 987 *       hw              device structure
 988 *       macport         MAC port number
 989 *
 990 * Returns:
 991 *       0               success
 992 *       >0              f/w reported failure - f/w status code
 993 *       <0              driver reported error (timeout|bad arg)
 994 *
 995 * Side effects:
 996 *
 997 * Call context:
 998 *       process
 999 ----------------------------------------------------------------*/
1000 int hfa384x_cmd_enable(struct hfa384x *hw, u16 macport)
1001 {
1002         struct hfa384x_metacmd cmd;
1003
1004         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_ENABLE) |
1005             HFA384x_CMD_MACPORT_SET(macport);
1006         cmd.parm0 = 0;
1007         cmd.parm1 = 0;
1008         cmd.parm2 = 0;
1009
1010         return hfa384x_docmd_wait(hw, &cmd);
1011 }
1012
1013 /*----------------------------------------------------------------
1014 * hfa384x_cmd_monitor
1015 *
1016 * Enables the 'monitor mode' of the MAC.  Here's the description of
1017 * monitor mode that I've received thus far:
1018 *
1019 *  "The "monitor mode" of operation is that the MAC passes all
1020 *  frames for which the PLCP checks are correct. All received
1021 *  MPDUs are passed to the host with MAC Port = 7, with a
1022 *  receive status of good, FCS error, or undecryptable. Passing
1023 *  certain MPDUs is a violation of the 802.11 standard, but useful
1024 *  for a debugging tool."  Normal communication is not possible
1025 *  while monitor mode is enabled.
1026 *
1027 * Arguments:
1028 *       hw              device structure
1029 *       enable          a code (0x0b|0x0f) that enables/disables
1030 *                       monitor mode. (host order)
1031 *
1032 * Returns:
1033 *       0               success
1034 *       >0              f/w reported failure - f/w status code
1035 *       <0              driver reported error (timeout|bad arg)
1036 *
1037 * Side effects:
1038 *
1039 * Call context:
1040 *       process
1041 ----------------------------------------------------------------*/
1042 int hfa384x_cmd_monitor(struct hfa384x *hw, u16 enable)
1043 {
1044         struct hfa384x_metacmd cmd;
1045
1046         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_MONITOR) |
1047             HFA384x_CMD_AINFO_SET(enable);
1048         cmd.parm0 = 0;
1049         cmd.parm1 = 0;
1050         cmd.parm2 = 0;
1051
1052         return hfa384x_docmd_wait(hw, &cmd);
1053 }
1054
1055 /*----------------------------------------------------------------
1056 * hfa384x_cmd_download
1057 *
1058 * Sets the controls for the MAC controller code/data download
1059 * process.  The arguments set the mode and address associated
1060 * with a download.  Note that the aux registers should be enabled
1061 * prior to setting one of the download enable modes.
1062 *
1063 * Arguments:
1064 *       hw              device structure
1065 *       mode            0 - Disable programming and begin code exec
1066 *                       1 - Enable volatile mem programming
1067 *                       2 - Enable non-volatile mem programming
1068 *                       3 - Program non-volatile section from NV download
1069 *                           buffer.
1070 *                       (host order)
1071 *       lowaddr
1072 *       highaddr        For mode 1, sets the high & low order bits of
1073 *                       the "destination address".  This address will be
1074 *                       the execution start address when download is
1075 *                       subsequently disabled.
1076 *                       For mode 2, sets the high & low order bits of
1077 *                       the destination in NV ram.
1078 *                       For modes 0 & 3, should be zero. (host order)
1079 *                       NOTE: these are CMD format.
1080 *       codelen         Length of the data to write in mode 2,
1081 *                       zero otherwise. (host order)
1082 *
1083 * Returns:
1084 *       0               success
1085 *       >0              f/w reported failure - f/w status code
1086 *       <0              driver reported error (timeout|bad arg)
1087 *
1088 * Side effects:
1089 *
1090 * Call context:
1091 *       process
1092 ----------------------------------------------------------------*/
1093 int hfa384x_cmd_download(struct hfa384x *hw, u16 mode, u16 lowaddr,
1094                          u16 highaddr, u16 codelen)
1095 {
1096         struct hfa384x_metacmd cmd;
1097
1098         pr_debug("mode=%d, lowaddr=0x%04x, highaddr=0x%04x, codelen=%d\n",
1099                  mode, lowaddr, highaddr, codelen);
1100
1101         cmd.cmd = (HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DOWNLD) |
1102                    HFA384x_CMD_PROGMODE_SET(mode));
1103
1104         cmd.parm0 = lowaddr;
1105         cmd.parm1 = highaddr;
1106         cmd.parm2 = codelen;
1107
1108         return hfa384x_docmd_wait(hw, &cmd);
1109 }
1110
1111 /*----------------------------------------------------------------
1112 * hfa384x_corereset
1113 *
1114 * Perform a reset of the hfa38xx MAC core.  We assume that the hw
1115 * structure is in its "created" state.  That is, it is initialized
1116 * with proper values.  Note that if a reset is done after the
1117 * device has been active for awhile, the caller might have to clean
1118 * up some leftover cruft in the hw structure.
1119 *
1120 * Arguments:
1121 *       hw              device structure
1122 *       holdtime        how long (in ms) to hold the reset
1123 *       settletime      how long (in ms) to wait after releasing
1124 *                       the reset
1125 *
1126 * Returns:
1127 *       nothing
1128 *
1129 * Side effects:
1130 *
1131 * Call context:
1132 *       process
1133 ----------------------------------------------------------------*/
1134 int hfa384x_corereset(struct hfa384x *hw, int holdtime, int settletime, int genesis)
1135 {
1136         int result;
1137
1138         result = usb_reset_device(hw->usb);
1139         if (result < 0) {
1140                 netdev_err(hw->wlandev->netdev, "usb_reset_device() failed, result=%d.\n",
1141                            result);
1142         }
1143
1144         return result;
1145 }
1146
1147 /*----------------------------------------------------------------
1148 * hfa384x_usbctlx_complete_sync
1149 *
1150 * Waits for a synchronous CTLX object to complete,
1151 * and then handles the response.
1152 *
1153 * Arguments:
1154 *       hw              device structure
1155 *       ctlx            CTLX ptr
1156 *       completor       functor object to decide what to
1157 *                       do with the CTLX's result.
1158 *
1159 * Returns:
1160 *       0               Success
1161 *       -ERESTARTSYS    Interrupted by a signal
1162 *       -EIO            CTLX failed
1163 *       -ENODEV         Adapter was unplugged
1164 *       ???             Result from completor
1165 *
1166 * Side effects:
1167 *
1168 * Call context:
1169 *       process
1170 ----------------------------------------------------------------*/
1171 static int hfa384x_usbctlx_complete_sync(struct hfa384x *hw,
1172                                          struct hfa384x_usbctlx *ctlx,
1173                                          struct usbctlx_completor *completor)
1174 {
1175         unsigned long flags;
1176         int result;
1177
1178         result = wait_for_completion_interruptible(&ctlx->done);
1179
1180         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1181
1182         /*
1183          * We can only handle the CTLX if the USB disconnect
1184          * function has not run yet ...
1185          */
1186 cleanup:
1187         if (hw->wlandev->hwremoved) {
1188                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1189                 result = -ENODEV;
1190         } else if (result != 0) {
1191                 int runqueue = 0;
1192
1193                 /*
1194                  * We were probably interrupted, so delete
1195                  * this CTLX asynchronously, kill the timers
1196                  * and the URB, and then start the next
1197                  * pending CTLX.
1198                  *
1199                  * NOTE: We can only delete the timers and
1200                  *       the URB if this CTLX is active.
1201                  */
1202                 if (ctlx == get_active_ctlx(hw)) {
1203                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1204
1205                         del_singleshot_timer_sync(&hw->reqtimer);
1206                         del_singleshot_timer_sync(&hw->resptimer);
1207                         hw->req_timer_done = 1;
1208                         hw->resp_timer_done = 1;
1209                         usb_kill_urb(&hw->ctlx_urb);
1210
1211                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1212
1213                         runqueue = 1;
1214
1215                         /*
1216                          * This scenario is so unlikely that I'm
1217                          * happy with a grubby "goto" solution ...
1218                          */
1219                         if (hw->wlandev->hwremoved)
1220                                 goto cleanup;
1221                 }
1222
1223                 /*
1224                  * The completion task will send this CTLX
1225                  * to the reaper the next time it runs. We
1226                  * are no longer in a hurry.
1227                  */
1228                 ctlx->reapable = 1;
1229                 ctlx->state = CTLX_REQ_FAILED;
1230                 list_move_tail(&ctlx->list, &hw->ctlxq.completing);
1231
1232                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1233
1234                 if (runqueue)
1235                         hfa384x_usbctlxq_run(hw);
1236         } else {
1237                 if (ctlx->state == CTLX_COMPLETE) {
1238                         result = completor->complete(completor);
1239                 } else {
1240                         netdev_warn(hw->wlandev->netdev, "CTLX[%d] error: state(%s)\n",
1241                                     le16_to_cpu(ctlx->outbuf.type),
1242                                     ctlxstr(ctlx->state));
1243                         result = -EIO;
1244                 }
1245
1246                 list_del(&ctlx->list);
1247                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1248                 kfree(ctlx);
1249         }
1250
1251         return result;
1252 }
1253
1254 /*----------------------------------------------------------------
1255 * hfa384x_docmd
1256 *
1257 * Constructs a command CTLX and submits it.
1258 *
1259 * NOTE: Any changes to the 'post-submit' code in this function
1260 *       need to be carried over to hfa384x_cbcmd() since the handling
1261 *       is virtually identical.
1262 *
1263 * Arguments:
1264 *       hw              device structure
1265 *       mode            DOWAIT or DOASYNC
1266 *       cmd             cmd structure.  Includes all arguments and result
1267 *                       data points.  All in host order. in host order
1268 *       cmdcb           command-specific callback
1269 *       usercb          user callback for async calls, NULL for DOWAIT calls
1270 *       usercb_data     user supplied data pointer for async calls, NULL
1271 *                       for DOASYNC calls
1272 *
1273 * Returns:
1274 *       0               success
1275 *       -EIO            CTLX failure
1276 *       -ERESTARTSYS    Awakened on signal
1277 *       >0              command indicated error, Status and Resp0-2 are
1278 *                       in hw structure.
1279 *
1280 * Side effects:
1281 *
1282 *
1283 * Call context:
1284 *       process
1285 ----------------------------------------------------------------*/
1286 static int
1287 hfa384x_docmd(struct hfa384x *hw,
1288               enum cmd_mode mode,
1289               struct hfa384x_metacmd *cmd,
1290               ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1291 {
1292         int result;
1293         struct hfa384x_usbctlx *ctlx;
1294
1295         ctlx = usbctlx_alloc();
1296         if (!ctlx) {
1297                 result = -ENOMEM;
1298                 goto done;
1299         }
1300
1301         /* Initialize the command */
1302         ctlx->outbuf.cmdreq.type = cpu_to_le16(HFA384x_USB_CMDREQ);
1303         ctlx->outbuf.cmdreq.cmd = cpu_to_le16(cmd->cmd);
1304         ctlx->outbuf.cmdreq.parm0 = cpu_to_le16(cmd->parm0);
1305         ctlx->outbuf.cmdreq.parm1 = cpu_to_le16(cmd->parm1);
1306         ctlx->outbuf.cmdreq.parm2 = cpu_to_le16(cmd->parm2);
1307
1308         ctlx->outbufsize = sizeof(ctlx->outbuf.cmdreq);
1309
1310         pr_debug("cmdreq: cmd=0x%04x parm0=0x%04x parm1=0x%04x parm2=0x%04x\n",
1311                  cmd->cmd, cmd->parm0, cmd->parm1, cmd->parm2);
1312
1313         ctlx->reapable = mode;
1314         ctlx->cmdcb = cmdcb;
1315         ctlx->usercb = usercb;
1316         ctlx->usercb_data = usercb_data;
1317
1318         result = hfa384x_usbctlx_submit(hw, ctlx);
1319         if (result != 0) {
1320                 kfree(ctlx);
1321         } else if (mode == DOWAIT) {
1322                 struct usbctlx_cmd_completor completor;
1323
1324                 result =
1325                     hfa384x_usbctlx_complete_sync(hw, ctlx,
1326                                                   init_cmd_completor(&completor,
1327                                                                      &ctlx->
1328                                                                      inbuf.
1329                                                                      cmdresp,
1330                                                                      &cmd->
1331                                                                      result));
1332         }
1333
1334 done:
1335         return result;
1336 }
1337
1338 /*----------------------------------------------------------------
1339 * hfa384x_dorrid
1340 *
1341 * Constructs a read rid CTLX and issues it.
1342 *
1343 * NOTE: Any changes to the 'post-submit' code in this function
1344 *       need to be carried over to hfa384x_cbrrid() since the handling
1345 *       is virtually identical.
1346 *
1347 * Arguments:
1348 *       hw              device structure
1349 *       mode            DOWAIT or DOASYNC
1350 *       rid             Read RID number (host order)
1351 *       riddata         Caller supplied buffer that MAC formatted RID.data
1352 *                       record will be written to for DOWAIT calls. Should
1353 *                       be NULL for DOASYNC calls.
1354 *       riddatalen      Buffer length for DOWAIT calls. Zero for DOASYNC calls.
1355 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1356 *       usercb          user callback for async calls, NULL for DOWAIT calls
1357 *       usercb_data     user supplied data pointer for async calls, NULL
1358 *                       for DOWAIT calls
1359 *
1360 * Returns:
1361 *       0               success
1362 *       -EIO            CTLX failure
1363 *       -ERESTARTSYS    Awakened on signal
1364 *       -ENODATA        riddatalen != macdatalen
1365 *       >0              command indicated error, Status and Resp0-2 are
1366 *                       in hw structure.
1367 *
1368 * Side effects:
1369 *
1370 * Call context:
1371 *       interrupt (DOASYNC)
1372 *       process (DOWAIT or DOASYNC)
1373 ----------------------------------------------------------------*/
1374 static int
1375 hfa384x_dorrid(struct hfa384x *hw,
1376                enum cmd_mode mode,
1377                u16 rid,
1378                void *riddata,
1379                unsigned int riddatalen,
1380                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1381 {
1382         int result;
1383         struct hfa384x_usbctlx *ctlx;
1384
1385         ctlx = usbctlx_alloc();
1386         if (!ctlx) {
1387                 result = -ENOMEM;
1388                 goto done;
1389         }
1390
1391         /* Initialize the command */
1392         ctlx->outbuf.rridreq.type = cpu_to_le16(HFA384x_USB_RRIDREQ);
1393         ctlx->outbuf.rridreq.frmlen =
1394             cpu_to_le16(sizeof(ctlx->outbuf.rridreq.rid));
1395         ctlx->outbuf.rridreq.rid = cpu_to_le16(rid);
1396
1397         ctlx->outbufsize = sizeof(ctlx->outbuf.rridreq);
1398
1399         ctlx->reapable = mode;
1400         ctlx->cmdcb = cmdcb;
1401         ctlx->usercb = usercb;
1402         ctlx->usercb_data = usercb_data;
1403
1404         /* Submit the CTLX */
1405         result = hfa384x_usbctlx_submit(hw, ctlx);
1406         if (result != 0) {
1407                 kfree(ctlx);
1408         } else if (mode == DOWAIT) {
1409                 struct usbctlx_rrid_completor completor;
1410
1411                 result =
1412                     hfa384x_usbctlx_complete_sync(hw, ctlx,
1413                                                   init_rrid_completor
1414                                                   (&completor,
1415                                                    &ctlx->inbuf.rridresp,
1416                                                    riddata, riddatalen));
1417         }
1418
1419 done:
1420         return result;
1421 }
1422
1423 /*----------------------------------------------------------------
1424 * hfa384x_dowrid
1425 *
1426 * Constructs a write rid CTLX and issues it.
1427 *
1428 * NOTE: Any changes to the 'post-submit' code in this function
1429 *       need to be carried over to hfa384x_cbwrid() since the handling
1430 *       is virtually identical.
1431 *
1432 * Arguments:
1433 *       hw              device structure
1434 *       enum cmd_mode   DOWAIT or DOASYNC
1435 *       rid             RID code
1436 *       riddata         Data portion of RID formatted for MAC
1437 *       riddatalen      Length of the data portion in bytes
1438 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1439 *       usercb          user callback for async calls, NULL for DOWAIT calls
1440 *       usercb_data     user supplied data pointer for async calls
1441 *
1442 * Returns:
1443 *       0               success
1444 *       -ETIMEDOUT      timed out waiting for register ready or
1445 *                       command completion
1446 *       >0              command indicated error, Status and Resp0-2 are
1447 *                       in hw structure.
1448 *
1449 * Side effects:
1450 *
1451 * Call context:
1452 *       interrupt (DOASYNC)
1453 *       process (DOWAIT or DOASYNC)
1454 ----------------------------------------------------------------*/
1455 static int
1456 hfa384x_dowrid(struct hfa384x *hw,
1457                enum cmd_mode mode,
1458                u16 rid,
1459                void *riddata,
1460                unsigned int riddatalen,
1461                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1462 {
1463         int result;
1464         struct hfa384x_usbctlx *ctlx;
1465
1466         ctlx = usbctlx_alloc();
1467         if (!ctlx) {
1468                 result = -ENOMEM;
1469                 goto done;
1470         }
1471
1472         /* Initialize the command */
1473         ctlx->outbuf.wridreq.type = cpu_to_le16(HFA384x_USB_WRIDREQ);
1474         ctlx->outbuf.wridreq.frmlen = cpu_to_le16((sizeof
1475                                                    (ctlx->outbuf.wridreq.rid) +
1476                                                    riddatalen + 1) / 2);
1477         ctlx->outbuf.wridreq.rid = cpu_to_le16(rid);
1478         memcpy(ctlx->outbuf.wridreq.data, riddata, riddatalen);
1479
1480         ctlx->outbufsize = sizeof(ctlx->outbuf.wridreq.type) +
1481             sizeof(ctlx->outbuf.wridreq.frmlen) +
1482             sizeof(ctlx->outbuf.wridreq.rid) + riddatalen;
1483
1484         ctlx->reapable = mode;
1485         ctlx->cmdcb = cmdcb;
1486         ctlx->usercb = usercb;
1487         ctlx->usercb_data = usercb_data;
1488
1489         /* Submit the CTLX */
1490         result = hfa384x_usbctlx_submit(hw, ctlx);
1491         if (result != 0) {
1492                 kfree(ctlx);
1493         } else if (mode == DOWAIT) {
1494                 struct usbctlx_cmd_completor completor;
1495                 struct hfa384x_cmdresult wridresult;
1496
1497                 result = hfa384x_usbctlx_complete_sync(hw,
1498                                                        ctlx,
1499                                                        init_wrid_completor
1500                                                        (&completor,
1501                                                         &ctlx->inbuf.wridresp,
1502                                                         &wridresult));
1503         }
1504
1505 done:
1506         return result;
1507 }
1508
1509 /*----------------------------------------------------------------
1510 * hfa384x_dormem
1511 *
1512 * Constructs a readmem CTLX and issues it.
1513 *
1514 * NOTE: Any changes to the 'post-submit' code in this function
1515 *       need to be carried over to hfa384x_cbrmem() since the handling
1516 *       is virtually identical.
1517 *
1518 * Arguments:
1519 *       hw              device structure
1520 *       mode            DOWAIT or DOASYNC
1521 *       page            MAC address space page (CMD format)
1522 *       offset          MAC address space offset
1523 *       data            Ptr to data buffer to receive read
1524 *       len             Length of the data to read (max == 2048)
1525 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1526 *       usercb          user callback for async calls, NULL for DOWAIT calls
1527 *       usercb_data     user supplied data pointer for async calls
1528 *
1529 * Returns:
1530 *       0               success
1531 *       -ETIMEDOUT      timed out waiting for register ready or
1532 *                       command completion
1533 *       >0              command indicated error, Status and Resp0-2 are
1534 *                       in hw structure.
1535 *
1536 * Side effects:
1537 *
1538 * Call context:
1539 *       interrupt (DOASYNC)
1540 *       process (DOWAIT or DOASYNC)
1541 ----------------------------------------------------------------*/
1542 static int
1543 hfa384x_dormem(struct hfa384x *hw,
1544                enum cmd_mode mode,
1545                u16 page,
1546                u16 offset,
1547                void *data,
1548                unsigned int len,
1549                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1550 {
1551         int result;
1552         struct hfa384x_usbctlx *ctlx;
1553
1554         ctlx = usbctlx_alloc();
1555         if (!ctlx) {
1556                 result = -ENOMEM;
1557                 goto done;
1558         }
1559
1560         /* Initialize the command */
1561         ctlx->outbuf.rmemreq.type = cpu_to_le16(HFA384x_USB_RMEMREQ);
1562         ctlx->outbuf.rmemreq.frmlen =
1563             cpu_to_le16(sizeof(ctlx->outbuf.rmemreq.offset) +
1564                         sizeof(ctlx->outbuf.rmemreq.page) + len);
1565         ctlx->outbuf.rmemreq.offset = cpu_to_le16(offset);
1566         ctlx->outbuf.rmemreq.page = cpu_to_le16(page);
1567
1568         ctlx->outbufsize = sizeof(ctlx->outbuf.rmemreq);
1569
1570         pr_debug("type=0x%04x frmlen=%d offset=0x%04x page=0x%04x\n",
1571                  ctlx->outbuf.rmemreq.type,
1572                  ctlx->outbuf.rmemreq.frmlen,
1573                  ctlx->outbuf.rmemreq.offset, ctlx->outbuf.rmemreq.page);
1574
1575         pr_debug("pktsize=%zd\n", ROUNDUP64(sizeof(ctlx->outbuf.rmemreq)));
1576
1577         ctlx->reapable = mode;
1578         ctlx->cmdcb = cmdcb;
1579         ctlx->usercb = usercb;
1580         ctlx->usercb_data = usercb_data;
1581
1582         result = hfa384x_usbctlx_submit(hw, ctlx);
1583         if (result != 0) {
1584                 kfree(ctlx);
1585         } else if (mode == DOWAIT) {
1586                 struct usbctlx_rmem_completor completor;
1587
1588                 result =
1589                     hfa384x_usbctlx_complete_sync(hw, ctlx,
1590                                                   init_rmem_completor
1591                                                   (&completor,
1592                                                    &ctlx->inbuf.rmemresp, data,
1593                                                    len));
1594         }
1595
1596 done:
1597         return result;
1598 }
1599
1600 /*----------------------------------------------------------------
1601 * hfa384x_dowmem
1602 *
1603 * Constructs a writemem CTLX and issues it.
1604 *
1605 * NOTE: Any changes to the 'post-submit' code in this function
1606 *       need to be carried over to hfa384x_cbwmem() since the handling
1607 *       is virtually identical.
1608 *
1609 * Arguments:
1610 *       hw              device structure
1611 *       mode            DOWAIT or DOASYNC
1612 *       page            MAC address space page (CMD format)
1613 *       offset          MAC address space offset
1614 *       data            Ptr to data buffer containing write data
1615 *       len             Length of the data to read (max == 2048)
1616 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1617 *       usercb          user callback for async calls, NULL for DOWAIT calls
1618 *       usercb_data     user supplied data pointer for async calls.
1619 *
1620 * Returns:
1621 *       0               success
1622 *       -ETIMEDOUT      timed out waiting for register ready or
1623 *                       command completion
1624 *       >0              command indicated error, Status and Resp0-2 are
1625 *                       in hw structure.
1626 *
1627 * Side effects:
1628 *
1629 * Call context:
1630 *       interrupt (DOWAIT)
1631 *       process (DOWAIT or DOASYNC)
1632 ----------------------------------------------------------------*/
1633 static int
1634 hfa384x_dowmem(struct hfa384x *hw,
1635                enum cmd_mode mode,
1636                u16 page,
1637                u16 offset,
1638                void *data,
1639                unsigned int len,
1640                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1641 {
1642         int result;
1643         struct hfa384x_usbctlx *ctlx;
1644
1645         pr_debug("page=0x%04x offset=0x%04x len=%d\n", page, offset, len);
1646
1647         ctlx = usbctlx_alloc();
1648         if (!ctlx) {
1649                 result = -ENOMEM;
1650                 goto done;
1651         }
1652
1653         /* Initialize the command */
1654         ctlx->outbuf.wmemreq.type = cpu_to_le16(HFA384x_USB_WMEMREQ);
1655         ctlx->outbuf.wmemreq.frmlen =
1656             cpu_to_le16(sizeof(ctlx->outbuf.wmemreq.offset) +
1657                         sizeof(ctlx->outbuf.wmemreq.page) + len);
1658         ctlx->outbuf.wmemreq.offset = cpu_to_le16(offset);
1659         ctlx->outbuf.wmemreq.page = cpu_to_le16(page);
1660         memcpy(ctlx->outbuf.wmemreq.data, data, len);
1661
1662         ctlx->outbufsize = sizeof(ctlx->outbuf.wmemreq.type) +
1663             sizeof(ctlx->outbuf.wmemreq.frmlen) +
1664             sizeof(ctlx->outbuf.wmemreq.offset) +
1665             sizeof(ctlx->outbuf.wmemreq.page) + len;
1666
1667         ctlx->reapable = mode;
1668         ctlx->cmdcb = cmdcb;
1669         ctlx->usercb = usercb;
1670         ctlx->usercb_data = usercb_data;
1671
1672         result = hfa384x_usbctlx_submit(hw, ctlx);
1673         if (result != 0) {
1674                 kfree(ctlx);
1675         } else if (mode == DOWAIT) {
1676                 struct usbctlx_cmd_completor completor;
1677                 struct hfa384x_cmdresult wmemresult;
1678
1679                 result = hfa384x_usbctlx_complete_sync(hw,
1680                                                        ctlx,
1681                                                        init_wmem_completor
1682                                                        (&completor,
1683                                                         &ctlx->inbuf.wmemresp,
1684                                                         &wmemresult));
1685         }
1686
1687 done:
1688         return result;
1689 }
1690
1691 /*----------------------------------------------------------------
1692 * hfa384x_drvr_disable
1693 *
1694 * Issues the disable command to stop communications on one of
1695 * the MACs 'ports'.  Only macport 0 is valid  for stations.
1696 * APs may also disable macports 1-6.  Only ports that have been
1697 * previously enabled may be disabled.
1698 *
1699 * Arguments:
1700 *       hw              device structure
1701 *       macport         MAC port number (host order)
1702 *
1703 * Returns:
1704 *       0               success
1705 *       >0              f/w reported failure - f/w status code
1706 *       <0              driver reported error (timeout|bad arg)
1707 *
1708 * Side effects:
1709 *
1710 * Call context:
1711 *       process
1712 ----------------------------------------------------------------*/
1713 int hfa384x_drvr_disable(struct hfa384x *hw, u16 macport)
1714 {
1715         int result = 0;
1716
1717         if ((!hw->isap && macport != 0) ||
1718             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1719             !(hw->port_enabled[macport])) {
1720                 result = -EINVAL;
1721         } else {
1722                 result = hfa384x_cmd_disable(hw, macport);
1723                 if (result == 0)
1724                         hw->port_enabled[macport] = 0;
1725         }
1726         return result;
1727 }
1728
1729 /*----------------------------------------------------------------
1730 * hfa384x_drvr_enable
1731 *
1732 * Issues the enable command to enable communications on one of
1733 * the MACs 'ports'.  Only macport 0 is valid  for stations.
1734 * APs may also enable macports 1-6.  Only ports that are currently
1735 * disabled may be enabled.
1736 *
1737 * Arguments:
1738 *       hw              device structure
1739 *       macport         MAC port number
1740 *
1741 * Returns:
1742 *       0               success
1743 *       >0              f/w reported failure - f/w status code
1744 *       <0              driver reported error (timeout|bad arg)
1745 *
1746 * Side effects:
1747 *
1748 * Call context:
1749 *       process
1750 ----------------------------------------------------------------*/
1751 int hfa384x_drvr_enable(struct hfa384x *hw, u16 macport)
1752 {
1753         int result = 0;
1754
1755         if ((!hw->isap && macport != 0) ||
1756             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1757             (hw->port_enabled[macport])) {
1758                 result = -EINVAL;
1759         } else {
1760                 result = hfa384x_cmd_enable(hw, macport);
1761                 if (result == 0)
1762                         hw->port_enabled[macport] = 1;
1763         }
1764         return result;
1765 }
1766
1767 /*----------------------------------------------------------------
1768 * hfa384x_drvr_flashdl_enable
1769 *
1770 * Begins the flash download state.  Checks to see that we're not
1771 * already in a download state and that a port isn't enabled.
1772 * Sets the download state and retrieves the flash download
1773 * buffer location, buffer size, and timeout length.
1774 *
1775 * Arguments:
1776 *       hw              device structure
1777 *
1778 * Returns:
1779 *       0               success
1780 *       >0              f/w reported error - f/w status code
1781 *       <0              driver reported error
1782 *
1783 * Side effects:
1784 *
1785 * Call context:
1786 *       process
1787 ----------------------------------------------------------------*/
1788 int hfa384x_drvr_flashdl_enable(struct hfa384x *hw)
1789 {
1790         int result = 0;
1791         int i;
1792
1793         /* Check that a port isn't active */
1794         for (i = 0; i < HFA384x_PORTID_MAX; i++) {
1795                 if (hw->port_enabled[i]) {
1796                         pr_debug("called when port enabled.\n");
1797                         return -EINVAL;
1798                 }
1799         }
1800
1801         /* Check that we're not already in a download state */
1802         if (hw->dlstate != HFA384x_DLSTATE_DISABLED)
1803                 return -EINVAL;
1804
1805         /* Retrieve the buffer loc&size and timeout */
1806         result = hfa384x_drvr_getconfig(hw, HFA384x_RID_DOWNLOADBUFFER,
1807                                         &(hw->bufinfo), sizeof(hw->bufinfo));
1808         if (result)
1809                 return result;
1810
1811         hw->bufinfo.page = le16_to_cpu(hw->bufinfo.page);
1812         hw->bufinfo.offset = le16_to_cpu(hw->bufinfo.offset);
1813         hw->bufinfo.len = le16_to_cpu(hw->bufinfo.len);
1814         result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME,
1815                                           &(hw->dltimeout));
1816         if (result)
1817                 return result;
1818
1819         hw->dltimeout = le16_to_cpu(hw->dltimeout);
1820
1821         pr_debug("flashdl_enable\n");
1822
1823         hw->dlstate = HFA384x_DLSTATE_FLASHENABLED;
1824
1825         return result;
1826 }
1827
1828 /*----------------------------------------------------------------
1829 * hfa384x_drvr_flashdl_disable
1830 *
1831 * Ends the flash download state.  Note that this will cause the MAC
1832 * firmware to restart.
1833 *
1834 * Arguments:
1835 *       hw              device structure
1836 *
1837 * Returns:
1838 *       0               success
1839 *       >0              f/w reported error - f/w status code
1840 *       <0              driver reported error
1841 *
1842 * Side effects:
1843 *
1844 * Call context:
1845 *       process
1846 ----------------------------------------------------------------*/
1847 int hfa384x_drvr_flashdl_disable(struct hfa384x *hw)
1848 {
1849         /* Check that we're already in the download state */
1850         if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
1851                 return -EINVAL;
1852
1853         pr_debug("flashdl_enable\n");
1854
1855         /* There isn't much we can do at this point, so I don't */
1856         /*  bother  w/ the return value */
1857         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0, 0);
1858         hw->dlstate = HFA384x_DLSTATE_DISABLED;
1859
1860         return 0;
1861 }
1862
1863 /*----------------------------------------------------------------
1864 * hfa384x_drvr_flashdl_write
1865 *
1866 * Performs a FLASH download of a chunk of data. First checks to see
1867 * that we're in the FLASH download state, then sets the download
1868 * mode, uses the aux functions to 1) copy the data to the flash
1869 * buffer, 2) sets the download 'write flash' mode, 3) readback and
1870 * compare.  Lather rinse, repeat as many times an necessary to get
1871 * all the given data into flash.
1872 * When all data has been written using this function (possibly
1873 * repeatedly), call drvr_flashdl_disable() to end the download state
1874 * and restart the MAC.
1875 *
1876 * Arguments:
1877 *       hw              device structure
1878 *       daddr           Card address to write to. (host order)
1879 *       buf             Ptr to data to write.
1880 *       len             Length of data (host order).
1881 *
1882 * Returns:
1883 *       0               success
1884 *       >0              f/w reported error - f/w status code
1885 *       <0              driver reported error
1886 *
1887 * Side effects:
1888 *
1889 * Call context:
1890 *       process
1891 ----------------------------------------------------------------*/
1892 int hfa384x_drvr_flashdl_write(struct hfa384x *hw, u32 daddr, void *buf, u32 len)
1893 {
1894         int result = 0;
1895         u32 dlbufaddr;
1896         int nburns;
1897         u32 burnlen;
1898         u32 burndaddr;
1899         u16 burnlo;
1900         u16 burnhi;
1901         int nwrites;
1902         u8 *writebuf;
1903         u16 writepage;
1904         u16 writeoffset;
1905         u32 writelen;
1906         int i;
1907         int j;
1908
1909         pr_debug("daddr=0x%08x len=%d\n", daddr, len);
1910
1911         /* Check that we're in the flash download state */
1912         if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
1913                 return -EINVAL;
1914
1915         netdev_info(hw->wlandev->netdev,
1916                     "Download %d bytes to flash @0x%06x\n", len, daddr);
1917
1918         /* Convert to flat address for arithmetic */
1919         /* NOTE: dlbuffer RID stores the address in AUX format */
1920         dlbufaddr =
1921             HFA384x_ADDR_AUX_MKFLAT(hw->bufinfo.page, hw->bufinfo.offset);
1922         pr_debug("dlbuf.page=0x%04x dlbuf.offset=0x%04x dlbufaddr=0x%08x\n",
1923                  hw->bufinfo.page, hw->bufinfo.offset, dlbufaddr);
1924         /* Calculations to determine how many fills of the dlbuffer to do
1925          * and how many USB wmemreq's to do for each fill.  At this point
1926          * in time, the dlbuffer size and the wmemreq size are the same.
1927          * Therefore, nwrites should always be 1.  The extra complexity
1928          * here is a hedge against future changes.
1929          */
1930
1931         /* Figure out how many times to do the flash programming */
1932         nburns = len / hw->bufinfo.len;
1933         nburns += (len % hw->bufinfo.len) ? 1 : 0;
1934
1935         /* For each flash program cycle, how many USB wmemreq's are needed? */
1936         nwrites = hw->bufinfo.len / HFA384x_USB_RWMEM_MAXLEN;
1937         nwrites += (hw->bufinfo.len % HFA384x_USB_RWMEM_MAXLEN) ? 1 : 0;
1938
1939         /* For each burn */
1940         for (i = 0; i < nburns; i++) {
1941                 /* Get the dest address and len */
1942                 burnlen = (len - (hw->bufinfo.len * i)) > hw->bufinfo.len ?
1943                     hw->bufinfo.len : (len - (hw->bufinfo.len * i));
1944                 burndaddr = daddr + (hw->bufinfo.len * i);
1945                 burnlo = HFA384x_ADDR_CMD_MKOFF(burndaddr);
1946                 burnhi = HFA384x_ADDR_CMD_MKPAGE(burndaddr);
1947
1948                 netdev_info(hw->wlandev->netdev, "Writing %d bytes to flash @0x%06x\n",
1949                             burnlen, burndaddr);
1950
1951                 /* Set the download mode */
1952                 result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_NV,
1953                                               burnlo, burnhi, burnlen);
1954                 if (result) {
1955                         netdev_err(hw->wlandev->netdev,
1956                                    "download(NV,lo=%x,hi=%x,len=%x) cmd failed, result=%d. Aborting d/l\n",
1957                                    burnlo, burnhi, burnlen, result);
1958                         goto exit_proc;
1959                 }
1960
1961                 /* copy the data to the flash download buffer */
1962                 for (j = 0; j < nwrites; j++) {
1963                         writebuf = buf +
1964                             (i * hw->bufinfo.len) +
1965                             (j * HFA384x_USB_RWMEM_MAXLEN);
1966
1967                         writepage = HFA384x_ADDR_CMD_MKPAGE(dlbufaddr +
1968                                                 (j * HFA384x_USB_RWMEM_MAXLEN));
1969                         writeoffset = HFA384x_ADDR_CMD_MKOFF(dlbufaddr +
1970                                                 (j * HFA384x_USB_RWMEM_MAXLEN));
1971
1972                         writelen = burnlen - (j * HFA384x_USB_RWMEM_MAXLEN);
1973                         writelen = writelen > HFA384x_USB_RWMEM_MAXLEN ?
1974                             HFA384x_USB_RWMEM_MAXLEN : writelen;
1975
1976                         result = hfa384x_dowmem_wait(hw,
1977                                                      writepage,
1978                                                      writeoffset,
1979                                                      writebuf, writelen);
1980                 }
1981
1982                 /* set the download 'write flash' mode */
1983                 result = hfa384x_cmd_download(hw,
1984                                               HFA384x_PROGMODE_NVWRITE,
1985                                               0, 0, 0);
1986                 if (result) {
1987                         netdev_err(hw->wlandev->netdev,
1988                                    "download(NVWRITE,lo=%x,hi=%x,len=%x) cmd failed, result=%d. Aborting d/l\n",
1989                                    burnlo, burnhi, burnlen, result);
1990                         goto exit_proc;
1991                 }
1992
1993                 /* TODO: We really should do a readback and compare. */
1994         }
1995
1996 exit_proc:
1997
1998         /* Leave the firmware in the 'post-prog' mode.  flashdl_disable will */
1999         /*  actually disable programming mode.  Remember, that will cause the */
2000         /*  the firmware to effectively reset itself. */
2001
2002         return result;
2003 }
2004
2005 /*----------------------------------------------------------------
2006 * hfa384x_drvr_getconfig
2007 *
2008 * Performs the sequence necessary to read a config/info item.
2009 *
2010 * Arguments:
2011 *       hw              device structure
2012 *       rid             config/info record id (host order)
2013 *       buf             host side record buffer.  Upon return it will
2014 *                       contain the body portion of the record (minus the
2015 *                       RID and len).
2016 *       len             buffer length (in bytes, should match record length)
2017 *
2018 * Returns:
2019 *       0               success
2020 *       >0              f/w reported error - f/w status code
2021 *       <0              driver reported error
2022 *       -ENODATA        length mismatch between argument and retrieved
2023 *                       record.
2024 *
2025 * Side effects:
2026 *
2027 * Call context:
2028 *       process
2029 ----------------------------------------------------------------*/
2030 int hfa384x_drvr_getconfig(struct hfa384x *hw, u16 rid, void *buf, u16 len)
2031 {
2032         return hfa384x_dorrid_wait(hw, rid, buf, len);
2033 }
2034
2035 /*----------------------------------------------------------------
2036  * hfa384x_drvr_setconfig_async
2037  *
2038  * Performs the sequence necessary to write a config/info item.
2039  *
2040  * Arguments:
2041  *       hw              device structure
2042  *       rid             config/info record id (in host order)
2043  *       buf             host side record buffer
2044  *       len             buffer length (in bytes)
2045  *       usercb          completion callback
2046  *       usercb_data     completion callback argument
2047  *
2048  * Returns:
2049  *       0               success
2050  *       >0              f/w reported error - f/w status code
2051  *       <0              driver reported error
2052  *
2053  * Side effects:
2054  *
2055  * Call context:
2056  *       process
2057  ----------------------------------------------------------------*/
2058 int
2059 hfa384x_drvr_setconfig_async(struct hfa384x *hw,
2060                              u16 rid,
2061                              void *buf,
2062                              u16 len, ctlx_usercb_t usercb, void *usercb_data)
2063 {
2064         return hfa384x_dowrid_async(hw, rid, buf, len,
2065                                     hfa384x_cb_status, usercb, usercb_data);
2066 }
2067
2068 /*----------------------------------------------------------------
2069 * hfa384x_drvr_ramdl_disable
2070 *
2071 * Ends the ram download state.
2072 *
2073 * Arguments:
2074 *       hw              device structure
2075 *
2076 * Returns:
2077 *       0               success
2078 *       >0              f/w reported error - f/w status code
2079 *       <0              driver reported error
2080 *
2081 * Side effects:
2082 *
2083 * Call context:
2084 *       process
2085 ----------------------------------------------------------------*/
2086 int hfa384x_drvr_ramdl_disable(struct hfa384x *hw)
2087 {
2088         /* Check that we're already in the download state */
2089         if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
2090                 return -EINVAL;
2091
2092         pr_debug("ramdl_disable()\n");
2093
2094         /* There isn't much we can do at this point, so I don't */
2095         /*  bother  w/ the return value */
2096         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0, 0);
2097         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2098
2099         return 0;
2100 }
2101
2102 /*----------------------------------------------------------------
2103 * hfa384x_drvr_ramdl_enable
2104 *
2105 * Begins the ram download state.  Checks to see that we're not
2106 * already in a download state and that a port isn't enabled.
2107 * Sets the download state and calls cmd_download with the
2108 * ENABLE_VOLATILE subcommand and the exeaddr argument.
2109 *
2110 * Arguments:
2111 *       hw              device structure
2112 *       exeaddr         the card execution address that will be
2113 *                       jumped to when ramdl_disable() is called
2114 *                       (host order).
2115 *
2116 * Returns:
2117 *       0               success
2118 *       >0              f/w reported error - f/w status code
2119 *       <0              driver reported error
2120 *
2121 * Side effects:
2122 *
2123 * Call context:
2124 *       process
2125 ----------------------------------------------------------------*/
2126 int hfa384x_drvr_ramdl_enable(struct hfa384x *hw, u32 exeaddr)
2127 {
2128         int result = 0;
2129         u16 lowaddr;
2130         u16 hiaddr;
2131         int i;
2132
2133         /* Check that a port isn't active */
2134         for (i = 0; i < HFA384x_PORTID_MAX; i++) {
2135                 if (hw->port_enabled[i]) {
2136                         netdev_err(hw->wlandev->netdev,
2137                                    "Can't download with a macport enabled.\n");
2138                         return -EINVAL;
2139                 }
2140         }
2141
2142         /* Check that we're not already in a download state */
2143         if (hw->dlstate != HFA384x_DLSTATE_DISABLED) {
2144                 netdev_err(hw->wlandev->netdev, "Download state not disabled.\n");
2145                 return -EINVAL;
2146         }
2147
2148         pr_debug("ramdl_enable, exeaddr=0x%08x\n", exeaddr);
2149
2150         /* Call the download(1,addr) function */
2151         lowaddr = HFA384x_ADDR_CMD_MKOFF(exeaddr);
2152         hiaddr = HFA384x_ADDR_CMD_MKPAGE(exeaddr);
2153
2154         result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_RAM,
2155                                       lowaddr, hiaddr, 0);
2156
2157         if (result == 0) {
2158                 /* Set the download state */
2159                 hw->dlstate = HFA384x_DLSTATE_RAMENABLED;
2160         } else {
2161                 pr_debug("cmd_download(0x%04x, 0x%04x) failed, result=%d.\n",
2162                          lowaddr, hiaddr, result);
2163         }
2164
2165         return result;
2166 }
2167
2168 /*----------------------------------------------------------------
2169 * hfa384x_drvr_ramdl_write
2170 *
2171 * Performs a RAM download of a chunk of data. First checks to see
2172 * that we're in the RAM download state, then uses the [read|write]mem USB
2173 * commands to 1) copy the data, 2) readback and compare.  The download
2174 * state is unaffected.  When all data has been written using
2175 * this function, call drvr_ramdl_disable() to end the download state
2176 * and restart the MAC.
2177 *
2178 * Arguments:
2179 *       hw              device structure
2180 *       daddr           Card address to write to. (host order)
2181 *       buf             Ptr to data to write.
2182 *       len             Length of data (host order).
2183 *
2184 * Returns:
2185 *       0               success
2186 *       >0              f/w reported error - f/w status code
2187 *       <0              driver reported error
2188 *
2189 * Side effects:
2190 *
2191 * Call context:
2192 *       process
2193 ----------------------------------------------------------------*/
2194 int hfa384x_drvr_ramdl_write(struct hfa384x *hw, u32 daddr, void *buf, u32 len)
2195 {
2196         int result = 0;
2197         int nwrites;
2198         u8 *data = buf;
2199         int i;
2200         u32 curraddr;
2201         u16 currpage;
2202         u16 curroffset;
2203         u16 currlen;
2204
2205         /* Check that we're in the ram download state */
2206         if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
2207                 return -EINVAL;
2208
2209         netdev_info(hw->wlandev->netdev, "Writing %d bytes to ram @0x%06x\n",
2210                     len, daddr);
2211
2212         /* How many dowmem calls?  */
2213         nwrites = len / HFA384x_USB_RWMEM_MAXLEN;
2214         nwrites += len % HFA384x_USB_RWMEM_MAXLEN ? 1 : 0;
2215
2216         /* Do blocking wmem's */
2217         for (i = 0; i < nwrites; i++) {
2218                 /* make address args */
2219                 curraddr = daddr + (i * HFA384x_USB_RWMEM_MAXLEN);
2220                 currpage = HFA384x_ADDR_CMD_MKPAGE(curraddr);
2221                 curroffset = HFA384x_ADDR_CMD_MKOFF(curraddr);
2222                 currlen = len - (i * HFA384x_USB_RWMEM_MAXLEN);
2223                 if (currlen > HFA384x_USB_RWMEM_MAXLEN)
2224                         currlen = HFA384x_USB_RWMEM_MAXLEN;
2225
2226                 /* Do blocking ctlx */
2227                 result = hfa384x_dowmem_wait(hw,
2228                                              currpage,
2229                                              curroffset,
2230                                              data +
2231                                              (i * HFA384x_USB_RWMEM_MAXLEN),
2232                                              currlen);
2233
2234                 if (result)
2235                         break;
2236
2237                 /* TODO: We really should have a readback. */
2238         }
2239
2240         return result;
2241 }
2242
2243 /*----------------------------------------------------------------
2244 * hfa384x_drvr_readpda
2245 *
2246 * Performs the sequence to read the PDA space.  Note there is no
2247 * drvr_writepda() function.  Writing a PDA is
2248 * generally implemented by a calling component via calls to
2249 * cmd_download and writing to the flash download buffer via the
2250 * aux regs.
2251 *
2252 * Arguments:
2253 *       hw              device structure
2254 *       buf             buffer to store PDA in
2255 *       len             buffer length
2256 *
2257 * Returns:
2258 *       0               success
2259 *       >0              f/w reported error - f/w status code
2260 *       <0              driver reported error
2261 *       -ETIMEDOUT      timeout waiting for the cmd regs to become
2262 *                       available, or waiting for the control reg
2263 *                       to indicate the Aux port is enabled.
2264 *       -ENODATA        the buffer does NOT contain a valid PDA.
2265 *                       Either the card PDA is bad, or the auxdata
2266 *                       reads are giving us garbage.
2267
2268 *
2269 * Side effects:
2270 *
2271 * Call context:
2272 *       process or non-card interrupt.
2273 ----------------------------------------------------------------*/
2274 int hfa384x_drvr_readpda(struct hfa384x *hw, void *buf, unsigned int len)
2275 {
2276         int result = 0;
2277         u16 *pda = buf;
2278         int pdaok = 0;
2279         int morepdrs = 1;
2280         int currpdr = 0;        /* word offset of the current pdr */
2281         size_t i;
2282         u16 pdrlen;             /* pdr length in bytes, host order */
2283         u16 pdrcode;            /* pdr code, host order */
2284         u16 currpage;
2285         u16 curroffset;
2286         struct pdaloc {
2287                 u32 cardaddr;
2288                 u16 auxctl;
2289         } pdaloc[] = {
2290                 {
2291                 HFA3842_PDA_BASE, 0}, {
2292                 HFA3841_PDA_BASE, 0}, {
2293                 HFA3841_PDA_BOGUS_BASE, 0}
2294         };
2295
2296         /* Read the pda from each known address.  */
2297         for (i = 0; i < ARRAY_SIZE(pdaloc); i++) {
2298                 /* Make address */
2299                 currpage = HFA384x_ADDR_CMD_MKPAGE(pdaloc[i].cardaddr);
2300                 curroffset = HFA384x_ADDR_CMD_MKOFF(pdaloc[i].cardaddr);
2301
2302                 /* units of bytes */
2303                 result = hfa384x_dormem_wait(hw, currpage, curroffset, buf,
2304                                                 len);
2305
2306                 if (result) {
2307                         netdev_warn(hw->wlandev->netdev,
2308                                     "Read from index %zd failed, continuing\n",
2309                                     i);
2310                         continue;
2311                 }
2312
2313                 /* Test for garbage */
2314                 pdaok = 1;      /* initially assume good */
2315                 morepdrs = 1;
2316                 while (pdaok && morepdrs) {
2317                         pdrlen = le16_to_cpu(pda[currpdr]) * 2;
2318                         pdrcode = le16_to_cpu(pda[currpdr + 1]);
2319                         /* Test the record length */
2320                         if (pdrlen > HFA384x_PDR_LEN_MAX || pdrlen == 0) {
2321                                 netdev_err(hw->wlandev->netdev,
2322                                            "pdrlen invalid=%d\n", pdrlen);
2323                                 pdaok = 0;
2324                                 break;
2325                         }
2326                         /* Test the code */
2327                         if (!hfa384x_isgood_pdrcode(pdrcode)) {
2328                                 netdev_err(hw->wlandev->netdev, "pdrcode invalid=%d\n",
2329                                            pdrcode);
2330                                 pdaok = 0;
2331                                 break;
2332                         }
2333                         /* Test for completion */
2334                         if (pdrcode == HFA384x_PDR_END_OF_PDA)
2335                                 morepdrs = 0;
2336
2337                         /* Move to the next pdr (if necessary) */
2338                         if (morepdrs) {
2339                                 /* note the access to pda[], need words here */
2340                                 currpdr += le16_to_cpu(pda[currpdr]) + 1;
2341                         }
2342                 }
2343                 if (pdaok) {
2344                         netdev_info(hw->wlandev->netdev,
2345                                     "PDA Read from 0x%08x in %s space.\n",
2346                                     pdaloc[i].cardaddr,
2347                                     pdaloc[i].auxctl == 0 ? "EXTDS" :
2348                                     pdaloc[i].auxctl == 1 ? "NV" :
2349                                     pdaloc[i].auxctl == 2 ? "PHY" :
2350                                     pdaloc[i].auxctl == 3 ? "ICSRAM" :
2351                                     "<bogus auxctl>");
2352                         break;
2353                 }
2354         }
2355         result = pdaok ? 0 : -ENODATA;
2356
2357         if (result)
2358                 pr_debug("Failure: pda is not okay\n");
2359
2360         return result;
2361 }
2362
2363 /*----------------------------------------------------------------
2364 * hfa384x_drvr_setconfig
2365 *
2366 * Performs the sequence necessary to write a config/info item.
2367 *
2368 * Arguments:
2369 *       hw              device structure
2370 *       rid             config/info record id (in host order)
2371 *       buf             host side record buffer
2372 *       len             buffer length (in bytes)
2373 *
2374 * Returns:
2375 *       0               success
2376 *       >0              f/w reported error - f/w status code
2377 *       <0              driver reported error
2378 *
2379 * Side effects:
2380 *
2381 * Call context:
2382 *       process
2383 ----------------------------------------------------------------*/
2384 int hfa384x_drvr_setconfig(struct hfa384x *hw, u16 rid, void *buf, u16 len)
2385 {
2386         return hfa384x_dowrid_wait(hw, rid, buf, len);
2387 }
2388
2389 /*----------------------------------------------------------------
2390 * hfa384x_drvr_start
2391 *
2392 * Issues the MAC initialize command, sets up some data structures,
2393 * and enables the interrupts.  After this function completes, the
2394 * low-level stuff should be ready for any/all commands.
2395 *
2396 * Arguments:
2397 *       hw              device structure
2398 * Returns:
2399 *       0               success
2400 *       >0              f/w reported error - f/w status code
2401 *       <0              driver reported error
2402 *
2403 * Side effects:
2404 *
2405 * Call context:
2406 *       process
2407 ----------------------------------------------------------------*/
2408
2409 int hfa384x_drvr_start(struct hfa384x *hw)
2410 {
2411         int result, result1, result2;
2412         u16 status;
2413
2414         might_sleep();
2415
2416         /* Clear endpoint stalls - but only do this if the endpoint
2417          * is showing a stall status. Some prism2 cards seem to behave
2418          * badly if a clear_halt is called when the endpoint is already
2419          * ok
2420          */
2421         result =
2422             usb_get_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_in, &status);
2423         if (result < 0) {
2424                 netdev_err(hw->wlandev->netdev, "Cannot get bulk in endpoint status.\n");
2425                 goto done;
2426         }
2427         if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_in))
2428                 netdev_err(hw->wlandev->netdev, "Failed to reset bulk in endpoint.\n");
2429
2430         result =
2431             usb_get_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_out, &status);
2432         if (result < 0) {
2433                 netdev_err(hw->wlandev->netdev, "Cannot get bulk out endpoint status.\n");
2434                 goto done;
2435         }
2436         if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_out))
2437                 netdev_err(hw->wlandev->netdev, "Failed to reset bulk out endpoint.\n");
2438
2439         /* Synchronous unlink, in case we're trying to restart the driver */
2440         usb_kill_urb(&hw->rx_urb);
2441
2442         /* Post the IN urb */
2443         result = submit_rx_urb(hw, GFP_KERNEL);
2444         if (result != 0) {
2445                 netdev_err(hw->wlandev->netdev,
2446                            "Fatal, failed to submit RX URB, result=%d\n",
2447                            result);
2448                 goto done;
2449         }
2450
2451         /* Call initialize twice, with a 1 second sleep in between.
2452          * This is a nasty work-around since many prism2 cards seem to
2453          * need time to settle after an init from cold. The second
2454          * call to initialize in theory is not necessary - but we call
2455          * it anyway as a double insurance policy:
2456          * 1) If the first init should fail, the second may well succeed
2457          *    and the card can still be used
2458          * 2) It helps ensures all is well with the card after the first
2459          *    init and settle time.
2460          */
2461         result1 = hfa384x_cmd_initialize(hw);
2462         msleep(1000);
2463         result = hfa384x_cmd_initialize(hw);
2464         result2 = result;
2465         if (result1 != 0) {
2466                 if (result2 != 0) {
2467                         netdev_err(hw->wlandev->netdev,
2468                                    "cmd_initialize() failed on two attempts, results %d and %d\n",
2469                                    result1, result2);
2470                         usb_kill_urb(&hw->rx_urb);
2471                         goto done;
2472                 } else {
2473                         pr_debug("First cmd_initialize() failed (result %d),\n",
2474                                  result1);
2475                         pr_debug("but second attempt succeeded. All should be ok\n");
2476                 }
2477         } else if (result2 != 0) {
2478                 netdev_warn(hw->wlandev->netdev, "First cmd_initialize() succeeded, but second attempt failed (result=%d)\n",
2479                             result2);
2480                 netdev_warn(hw->wlandev->netdev,
2481                             "Most likely the card will be functional\n");
2482                 goto done;
2483         }
2484
2485         hw->state = HFA384x_STATE_RUNNING;
2486
2487 done:
2488         return result;
2489 }
2490
2491 /*----------------------------------------------------------------
2492 * hfa384x_drvr_stop
2493 *
2494 * Shuts down the MAC to the point where it is safe to unload the
2495 * driver.  Any subsystem that may be holding a data or function
2496 * ptr into the driver must be cleared/deinitialized.
2497 *
2498 * Arguments:
2499 *       hw              device structure
2500 * Returns:
2501 *       0               success
2502 *       >0              f/w reported error - f/w status code
2503 *       <0              driver reported error
2504 *
2505 * Side effects:
2506 *
2507 * Call context:
2508 *       process
2509 ----------------------------------------------------------------*/
2510 int hfa384x_drvr_stop(struct hfa384x *hw)
2511 {
2512         int i;
2513
2514         might_sleep();
2515
2516         /* There's no need for spinlocks here. The USB "disconnect"
2517          * function sets this "removed" flag and then calls us.
2518          */
2519         if (!hw->wlandev->hwremoved) {
2520                 /* Call initialize to leave the MAC in its 'reset' state */
2521                 hfa384x_cmd_initialize(hw);
2522
2523                 /* Cancel the rxurb */
2524                 usb_kill_urb(&hw->rx_urb);
2525         }
2526
2527         hw->link_status = HFA384x_LINK_NOTCONNECTED;
2528         hw->state = HFA384x_STATE_INIT;
2529
2530         del_timer_sync(&hw->commsqual_timer);
2531
2532         /* Clear all the port status */
2533         for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
2534                 hw->port_enabled[i] = 0;
2535
2536         return 0;
2537 }
2538
2539 /*----------------------------------------------------------------
2540 * hfa384x_drvr_txframe
2541 *
2542 * Takes a frame from prism2sta and queues it for transmission.
2543 *
2544 * Arguments:
2545 *       hw              device structure
2546 *       skb             packet buffer struct.  Contains an 802.11
2547 *                       data frame.
2548 *       p80211_hdr      points to the 802.11 header for the packet.
2549 * Returns:
2550 *       0               Success and more buffs available
2551 *       1               Success but no more buffs
2552 *       2               Allocation failure
2553 *       4               Buffer full or queue busy
2554 *
2555 * Side effects:
2556 *
2557 * Call context:
2558 *       interrupt
2559 ----------------------------------------------------------------*/
2560 int hfa384x_drvr_txframe(struct hfa384x *hw, struct sk_buff *skb,
2561                          union p80211_hdr *p80211_hdr,
2562                          struct p80211_metawep *p80211_wep)
2563 {
2564         int usbpktlen = sizeof(struct hfa384x_tx_frame);
2565         int result;
2566         int ret;
2567         char *ptr;
2568
2569         if (hw->tx_urb.status == -EINPROGRESS) {
2570                 netdev_warn(hw->wlandev->netdev, "TX URB already in use\n");
2571                 result = 3;
2572                 goto exit;
2573         }
2574
2575         /* Build Tx frame structure */
2576         /* Set up the control field */
2577         memset(&hw->txbuff.txfrm.desc, 0, sizeof(hw->txbuff.txfrm.desc));
2578
2579         /* Setup the usb type field */
2580         hw->txbuff.type = cpu_to_le16(HFA384x_USB_TXFRM);
2581
2582         /* Set up the sw_support field to identify this frame */
2583         hw->txbuff.txfrm.desc.sw_support = 0x0123;
2584
2585 /* Tx complete and Tx exception disable per dleach.  Might be causing
2586  * buf depletion
2587  */
2588 /* #define DOEXC  SLP -- doboth breaks horribly under load, doexc less so. */
2589 #if defined(DOBOTH)
2590         hw->txbuff.txfrm.desc.tx_control =
2591             HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2592             HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(1);
2593 #elif defined(DOEXC)
2594         hw->txbuff.txfrm.desc.tx_control =
2595             HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2596             HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(0);
2597 #else
2598         hw->txbuff.txfrm.desc.tx_control =
2599             HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2600             HFA384x_TX_TXEX_SET(0) | HFA384x_TX_TXOK_SET(0);
2601 #endif
2602         hw->txbuff.txfrm.desc.tx_control =
2603             cpu_to_le16(hw->txbuff.txfrm.desc.tx_control);
2604
2605         /* copy the header over to the txdesc */
2606         memcpy(&(hw->txbuff.txfrm.desc.frame_control), p80211_hdr,
2607                sizeof(union p80211_hdr));
2608
2609         /* if we're using host WEP, increase size by IV+ICV */
2610         if (p80211_wep->data) {
2611                 hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len + 8);
2612                 usbpktlen += 8;
2613         } else {
2614                 hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len);
2615         }
2616
2617         usbpktlen += skb->len;
2618
2619         /* copy over the WEP IV if we are using host WEP */
2620         ptr = hw->txbuff.txfrm.data;
2621         if (p80211_wep->data) {
2622                 memcpy(ptr, p80211_wep->iv, sizeof(p80211_wep->iv));
2623                 ptr += sizeof(p80211_wep->iv);
2624                 memcpy(ptr, p80211_wep->data, skb->len);
2625         } else {
2626                 memcpy(ptr, skb->data, skb->len);
2627         }
2628         /* copy over the packet data */
2629         ptr += skb->len;
2630
2631         /* copy over the WEP ICV if we are using host WEP */
2632         if (p80211_wep->data)
2633                 memcpy(ptr, p80211_wep->icv, sizeof(p80211_wep->icv));
2634
2635         /* Send the USB packet */
2636         usb_fill_bulk_urb(&(hw->tx_urb), hw->usb,
2637                           hw->endp_out,
2638                           &(hw->txbuff), ROUNDUP64(usbpktlen),
2639                           hfa384x_usbout_callback, hw->wlandev);
2640         hw->tx_urb.transfer_flags |= USB_QUEUE_BULK;
2641
2642         result = 1;
2643         ret = submit_tx_urb(hw, &hw->tx_urb, GFP_ATOMIC);
2644         if (ret != 0) {
2645                 netdev_err(hw->wlandev->netdev,
2646                            "submit_tx_urb() failed, error=%d\n", ret);
2647                 result = 3;
2648         }
2649
2650 exit:
2651         return result;
2652 }
2653
2654 void hfa384x_tx_timeout(struct wlandevice *wlandev)
2655 {
2656         struct hfa384x *hw = wlandev->priv;
2657         unsigned long flags;
2658
2659         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2660
2661         if (!hw->wlandev->hwremoved) {
2662                 int sched;
2663
2664                 sched = !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags);
2665                 sched |= !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags);
2666                 if (sched)
2667                         schedule_work(&hw->usb_work);
2668         }
2669
2670         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2671 }
2672
2673 /*----------------------------------------------------------------
2674 * hfa384x_usbctlx_reaper_task
2675 *
2676 * Tasklet to delete dead CTLX objects
2677 *
2678 * Arguments:
2679 *       data    ptr to a struct hfa384x
2680 *
2681 * Returns:
2682 *
2683 * Call context:
2684 *       Interrupt
2685 ----------------------------------------------------------------*/
2686 static void hfa384x_usbctlx_reaper_task(unsigned long data)
2687 {
2688         struct hfa384x *hw = (struct hfa384x *)data;
2689         struct hfa384x_usbctlx *ctlx, *temp;
2690         unsigned long flags;
2691
2692         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2693
2694         /* This list is guaranteed to be empty if someone
2695          * has unplugged the adapter.
2696          */
2697         list_for_each_entry_safe(ctlx, temp, &hw->ctlxq.reapable, list) {
2698                 list_del(&ctlx->list);
2699                 kfree(ctlx);
2700         }
2701
2702         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2703 }
2704
2705 /*----------------------------------------------------------------
2706 * hfa384x_usbctlx_completion_task
2707 *
2708 * Tasklet to call completion handlers for returned CTLXs
2709 *
2710 * Arguments:
2711 *       data    ptr to struct hfa384x
2712 *
2713 * Returns:
2714 *       Nothing
2715 *
2716 * Call context:
2717 *       Interrupt
2718 ----------------------------------------------------------------*/
2719 static void hfa384x_usbctlx_completion_task(unsigned long data)
2720 {
2721         struct hfa384x *hw = (struct hfa384x *)data;
2722         struct hfa384x_usbctlx *ctlx, *temp;
2723         unsigned long flags;
2724
2725         int reap = 0;
2726
2727         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2728
2729         /* This list is guaranteed to be empty if someone
2730          * has unplugged the adapter ...
2731          */
2732         list_for_each_entry_safe(ctlx, temp, &hw->ctlxq.completing, list) {
2733                 /* Call the completion function that this
2734                  * command was assigned, assuming it has one.
2735                  */
2736                 if (ctlx->cmdcb) {
2737                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2738                         ctlx->cmdcb(hw, ctlx);
2739                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2740
2741                         /* Make sure we don't try and complete
2742                          * this CTLX more than once!
2743                          */
2744                         ctlx->cmdcb = NULL;
2745
2746                         /* Did someone yank the adapter out
2747                          * while our list was (briefly) unlocked?
2748                          */
2749                         if (hw->wlandev->hwremoved) {
2750                                 reap = 0;
2751                                 break;
2752                         }
2753                 }
2754
2755                 /*
2756                  * "Reapable" CTLXs are ones which don't have any
2757                  * threads waiting for them to die. Hence they must
2758                  * be delivered to The Reaper!
2759                  */
2760                 if (ctlx->reapable) {
2761                         /* Move the CTLX off the "completing" list (hopefully)
2762                          * on to the "reapable" list where the reaper task
2763                          * can find it. And "reapable" means that this CTLX
2764                          * isn't sitting on a wait-queue somewhere.
2765                          */
2766                         list_move_tail(&ctlx->list, &hw->ctlxq.reapable);
2767                         reap = 1;
2768                 }
2769
2770                 complete(&ctlx->done);
2771         }
2772         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2773
2774         if (reap)
2775                 tasklet_schedule(&hw->reaper_bh);
2776 }
2777
2778 /*----------------------------------------------------------------
2779 * unlocked_usbctlx_cancel_async
2780 *
2781 * Mark the CTLX dead asynchronously, and ensure that the
2782 * next command on the queue is run afterwards.
2783 *
2784 * Arguments:
2785 *       hw      ptr to the struct hfa384x structure
2786 *       ctlx    ptr to a CTLX structure
2787 *
2788 * Returns:
2789 *       0       the CTLX's URB is inactive
2790 * -EINPROGRESS  the URB is currently being unlinked
2791 *
2792 * Call context:
2793 *       Either process or interrupt, but presumably interrupt
2794 ----------------------------------------------------------------*/
2795 static int unlocked_usbctlx_cancel_async(struct hfa384x *hw,
2796                                          struct hfa384x_usbctlx *ctlx)
2797 {
2798         int ret;
2799
2800         /*
2801          * Try to delete the URB containing our request packet.
2802          * If we succeed, then its completion handler will be
2803          * called with a status of -ECONNRESET.
2804          */
2805         hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
2806         ret = usb_unlink_urb(&hw->ctlx_urb);
2807
2808         if (ret != -EINPROGRESS) {
2809                 /*
2810                  * The OUT URB had either already completed
2811                  * or was still in the pending queue, so the
2812                  * URB's completion function will not be called.
2813                  * We will have to complete the CTLX ourselves.
2814                  */
2815                 ctlx->state = CTLX_REQ_FAILED;
2816                 unlocked_usbctlx_complete(hw, ctlx);
2817                 ret = 0;
2818         }
2819
2820         return ret;
2821 }
2822
2823 /*----------------------------------------------------------------
2824 * unlocked_usbctlx_complete
2825 *
2826 * A CTLX has completed.  It may have been successful, it may not
2827 * have been. At this point, the CTLX should be quiescent.  The URBs
2828 * aren't active and the timers should have been stopped.
2829 *
2830 * The CTLX is migrated to the "completing" queue, and the completing
2831 * tasklet is scheduled.
2832 *
2833 * Arguments:
2834 *       hw              ptr to a struct hfa384x structure
2835 *       ctlx            ptr to a ctlx structure
2836 *
2837 * Returns:
2838 *       nothing
2839 *
2840 * Side effects:
2841 *
2842 * Call context:
2843 *       Either, assume interrupt
2844 ----------------------------------------------------------------*/
2845 static void unlocked_usbctlx_complete(struct hfa384x *hw, struct hfa384x_usbctlx *ctlx)
2846 {
2847         /* Timers have been stopped, and ctlx should be in
2848          * a terminal state. Retire it from the "active"
2849          * queue.
2850          */
2851         list_move_tail(&ctlx->list, &hw->ctlxq.completing);
2852         tasklet_schedule(&hw->completion_bh);
2853
2854         switch (ctlx->state) {
2855         case CTLX_COMPLETE:
2856         case CTLX_REQ_FAILED:
2857                 /* This are the correct terminating states. */
2858                 break;
2859
2860         default:
2861                 netdev_err(hw->wlandev->netdev, "CTLX[%d] not in a terminating state(%s)\n",
2862                            le16_to_cpu(ctlx->outbuf.type),
2863                            ctlxstr(ctlx->state));
2864                 break;
2865         }                       /* switch */
2866 }
2867
2868 /*----------------------------------------------------------------
2869 * hfa384x_usbctlxq_run
2870 *
2871 * Checks to see if the head item is running.  If not, starts it.
2872 *
2873 * Arguments:
2874 *       hw      ptr to struct hfa384x
2875 *
2876 * Returns:
2877 *       nothing
2878 *
2879 * Side effects:
2880 *
2881 * Call context:
2882 *       any
2883 ----------------------------------------------------------------*/
2884 static void hfa384x_usbctlxq_run(struct hfa384x *hw)
2885 {
2886         unsigned long flags;
2887
2888         /* acquire lock */
2889         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2890
2891         /* Only one active CTLX at any one time, because there's no
2892          * other (reliable) way to match the response URB to the
2893          * correct CTLX.
2894          *
2895          * Don't touch any of these CTLXs if the hardware
2896          * has been removed or the USB subsystem is stalled.
2897          */
2898         if (!list_empty(&hw->ctlxq.active) ||
2899             test_bit(WORK_TX_HALT, &hw->usb_flags) || hw->wlandev->hwremoved)
2900                 goto unlock;
2901
2902         while (!list_empty(&hw->ctlxq.pending)) {
2903                 struct hfa384x_usbctlx *head;
2904                 int result;
2905
2906                 /* This is the first pending command */
2907                 head = list_entry(hw->ctlxq.pending.next,
2908                                   struct hfa384x_usbctlx, list);
2909
2910                 /* We need to split this off to avoid a race condition */
2911                 list_move_tail(&head->list, &hw->ctlxq.active);
2912
2913                 /* Fill the out packet */
2914                 usb_fill_bulk_urb(&(hw->ctlx_urb), hw->usb,
2915                                   hw->endp_out,
2916                                   &(head->outbuf), ROUNDUP64(head->outbufsize),
2917                                   hfa384x_ctlxout_callback, hw);
2918                 hw->ctlx_urb.transfer_flags |= USB_QUEUE_BULK;
2919
2920                 /* Now submit the URB and update the CTLX's state */
2921                 result = usb_submit_urb(&hw->ctlx_urb, GFP_ATOMIC);
2922                 if (result == 0) {
2923                         /* This CTLX is now running on the active queue */
2924                         head->state = CTLX_REQ_SUBMITTED;
2925
2926                         /* Start the OUT wait timer */
2927                         hw->req_timer_done = 0;
2928                         hw->reqtimer.expires = jiffies + HZ;
2929                         add_timer(&hw->reqtimer);
2930
2931                         /* Start the IN wait timer */
2932                         hw->resp_timer_done = 0;
2933                         hw->resptimer.expires = jiffies + 2 * HZ;
2934                         add_timer(&hw->resptimer);
2935
2936                         break;
2937                 }
2938
2939                 if (result == -EPIPE) {
2940                         /* The OUT pipe needs resetting, so put
2941                          * this CTLX back in the "pending" queue
2942                          * and schedule a reset ...
2943                          */
2944                         netdev_warn(hw->wlandev->netdev,
2945                                     "%s tx pipe stalled: requesting reset\n",
2946                                     hw->wlandev->netdev->name);
2947                         list_move(&head->list, &hw->ctlxq.pending);
2948                         set_bit(WORK_TX_HALT, &hw->usb_flags);
2949                         schedule_work(&hw->usb_work);
2950                         break;
2951                 }
2952
2953                 if (result == -ESHUTDOWN) {
2954                         netdev_warn(hw->wlandev->netdev, "%s urb shutdown!\n",
2955                                     hw->wlandev->netdev->name);
2956                         break;
2957                 }
2958
2959                 netdev_err(hw->wlandev->netdev, "Failed to submit CTLX[%d]: error=%d\n",
2960                            le16_to_cpu(head->outbuf.type), result);
2961                 unlocked_usbctlx_complete(hw, head);
2962         }                       /* while */
2963
2964 unlock:
2965         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2966 }
2967
2968 /*----------------------------------------------------------------
2969 * hfa384x_usbin_callback
2970 *
2971 * Callback for URBs on the BULKIN endpoint.
2972 *
2973 * Arguments:
2974 *       urb             ptr to the completed urb
2975 *
2976 * Returns:
2977 *       nothing
2978 *
2979 * Side effects:
2980 *
2981 * Call context:
2982 *       interrupt
2983 ----------------------------------------------------------------*/
2984 static void hfa384x_usbin_callback(struct urb *urb)
2985 {
2986         struct wlandevice *wlandev = urb->context;
2987         struct hfa384x *hw;
2988         union hfa384x_usbin *usbin = (union hfa384x_usbin *)urb->transfer_buffer;
2989         struct sk_buff *skb = NULL;
2990         int result;
2991         int urb_status;
2992         u16 type;
2993
2994         enum USBIN_ACTION {
2995                 HANDLE,
2996                 RESUBMIT,
2997                 ABORT
2998         } action;
2999
3000         if (!wlandev || !wlandev->netdev || wlandev->hwremoved)
3001                 goto exit;
3002
3003         hw = wlandev->priv;
3004         if (!hw)
3005                 goto exit;
3006
3007         skb = hw->rx_urb_skb;
3008         BUG_ON(!skb || (skb->data != urb->transfer_buffer));
3009
3010         hw->rx_urb_skb = NULL;
3011
3012         /* Check for error conditions within the URB */
3013         switch (urb->status) {
3014         case 0:
3015                 action = HANDLE;
3016
3017                 /* Check for short packet */
3018                 if (urb->actual_length == 0) {
3019                         wlandev->netdev->stats.rx_errors++;
3020                         wlandev->netdev->stats.rx_length_errors++;
3021                         action = RESUBMIT;
3022                 }
3023                 break;
3024
3025         case -EPIPE:
3026                 netdev_warn(hw->wlandev->netdev, "%s rx pipe stalled: requesting reset\n",
3027                             wlandev->netdev->name);
3028                 if (!test_and_set_bit(WORK_RX_HALT, &hw->usb_flags))
3029                         schedule_work(&hw->usb_work);
3030                 wlandev->netdev->stats.rx_errors++;
3031                 action = ABORT;
3032                 break;
3033
3034         case -EILSEQ:
3035         case -ETIMEDOUT:
3036         case -EPROTO:
3037                 if (!test_and_set_bit(THROTTLE_RX, &hw->usb_flags) &&
3038                     !timer_pending(&hw->throttle)) {
3039                         mod_timer(&hw->throttle, jiffies + THROTTLE_JIFFIES);
3040                 }
3041                 wlandev->netdev->stats.rx_errors++;
3042                 action = ABORT;
3043                 break;
3044
3045         case -EOVERFLOW:
3046                 wlandev->netdev->stats.rx_over_errors++;
3047                 action = RESUBMIT;
3048                 break;
3049
3050         case -ENODEV:
3051         case -ESHUTDOWN:
3052                 pr_debug("status=%d, device removed.\n", urb->status);
3053                 action = ABORT;
3054                 break;
3055
3056         case -ENOENT:
3057         case -ECONNRESET:
3058                 pr_debug("status=%d, urb explicitly unlinked.\n", urb->status);
3059                 action = ABORT;
3060                 break;
3061
3062         default:
3063                 pr_debug("urb status=%d, transfer flags=0x%x\n",
3064                          urb->status, urb->transfer_flags);
3065                 wlandev->netdev->stats.rx_errors++;
3066                 action = RESUBMIT;
3067                 break;
3068         }
3069
3070         urb_status = urb->status;
3071
3072         if (action != ABORT) {
3073                 /* Repost the RX URB */
3074                 result = submit_rx_urb(hw, GFP_ATOMIC);
3075
3076                 if (result != 0) {
3077                         netdev_err(hw->wlandev->netdev,
3078                                    "Fatal, failed to resubmit rx_urb. error=%d\n",
3079                                    result);
3080                 }
3081         }
3082
3083         /* Handle any USB-IN packet */
3084         /* Note: the check of the sw_support field, the type field doesn't
3085          *       have bit 12 set like the docs suggest.
3086          */
3087         type = le16_to_cpu(usbin->type);
3088         if (HFA384x_USB_ISRXFRM(type)) {
3089                 if (action == HANDLE) {
3090                         if (usbin->txfrm.desc.sw_support == 0x0123) {
3091                                 hfa384x_usbin_txcompl(wlandev, usbin);
3092                         } else {
3093                                 skb_put(skb, sizeof(*usbin));
3094                                 hfa384x_usbin_rx(wlandev, skb);
3095                                 skb = NULL;
3096                         }
3097                 }
3098                 goto exit;
3099         }
3100         if (HFA384x_USB_ISTXFRM(type)) {
3101                 if (action == HANDLE)
3102                         hfa384x_usbin_txcompl(wlandev, usbin);
3103                 goto exit;
3104         }
3105         switch (type) {
3106         case HFA384x_USB_INFOFRM:
3107                 if (action == ABORT)
3108                         goto exit;
3109                 if (action == HANDLE)
3110                         hfa384x_usbin_info(wlandev, usbin);
3111                 break;
3112
3113         case HFA384x_USB_CMDRESP:
3114         case HFA384x_USB_WRIDRESP:
3115         case HFA384x_USB_RRIDRESP:
3116         case HFA384x_USB_WMEMRESP:
3117         case HFA384x_USB_RMEMRESP:
3118                 /* ALWAYS, ALWAYS, ALWAYS handle this CTLX!!!! */
3119                 hfa384x_usbin_ctlx(hw, usbin, urb_status);
3120                 break;
3121
3122         case HFA384x_USB_BUFAVAIL:
3123                 pr_debug("Received BUFAVAIL packet, frmlen=%d\n",
3124                          usbin->bufavail.frmlen);
3125                 break;
3126
3127         case HFA384x_USB_ERROR:
3128                 pr_debug("Received USB_ERROR packet, errortype=%d\n",
3129                          usbin->usberror.errortype);
3130                 break;
3131
3132         default:
3133                 pr_debug("Unrecognized USBIN packet, type=%x, status=%d\n",
3134                          usbin->type, urb_status);
3135                 break;
3136         }                       /* switch */
3137
3138 exit:
3139
3140         if (skb)
3141                 dev_kfree_skb(skb);
3142 }
3143
3144 /*----------------------------------------------------------------
3145 * hfa384x_usbin_ctlx
3146 *
3147 * We've received a URB containing a Prism2 "response" message.
3148 * This message needs to be matched up with a CTLX on the active
3149 * queue and our state updated accordingly.
3150 *
3151 * Arguments:
3152 *       hw              ptr to struct hfa384x
3153 *       usbin           ptr to USB IN packet
3154 *       urb_status      status of this Bulk-In URB
3155 *
3156 * Returns:
3157 *       nothing
3158 *
3159 * Side effects:
3160 *
3161 * Call context:
3162 *       interrupt
3163 ----------------------------------------------------------------*/
3164 static void hfa384x_usbin_ctlx(struct hfa384x *hw, union hfa384x_usbin *usbin,
3165                                int urb_status)
3166 {
3167         struct hfa384x_usbctlx *ctlx;
3168         int run_queue = 0;
3169         unsigned long flags;
3170
3171 retry:
3172         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3173
3174         /* There can be only one CTLX on the active queue
3175          * at any one time, and this is the CTLX that the
3176          * timers are waiting for.
3177          */
3178         if (list_empty(&hw->ctlxq.active))
3179                 goto unlock;
3180
3181         /* Remove the "response timeout". It's possible that
3182          * we are already too late, and that the timeout is
3183          * already running. And that's just too bad for us,
3184          * because we could lose our CTLX from the active
3185          * queue here ...
3186          */
3187         if (del_timer(&hw->resptimer) == 0) {
3188                 if (hw->resp_timer_done == 0) {
3189                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3190                         goto retry;
3191                 }
3192         } else {
3193                 hw->resp_timer_done = 1;
3194         }
3195
3196         ctlx = get_active_ctlx(hw);
3197
3198         if (urb_status != 0) {
3199                 /*
3200                  * Bad CTLX, so get rid of it. But we only
3201                  * remove it from the active queue if we're no
3202                  * longer expecting the OUT URB to complete.
3203                  */
3204                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3205                         run_queue = 1;
3206         } else {
3207                 const __le16 intype = (usbin->type & ~cpu_to_le16(0x8000));
3208
3209                 /*
3210                  * Check that our message is what we're expecting ...
3211                  */
3212                 if (ctlx->outbuf.type != intype) {
3213                         netdev_warn(hw->wlandev->netdev,
3214                                     "Expected IN[%d], received IN[%d] - ignored.\n",
3215                                     le16_to_cpu(ctlx->outbuf.type),
3216                                     le16_to_cpu(intype));
3217                         goto unlock;
3218                 }
3219
3220                 /* This URB has succeeded, so grab the data ... */
3221                 memcpy(&ctlx->inbuf, usbin, sizeof(ctlx->inbuf));
3222
3223                 switch (ctlx->state) {
3224                 case CTLX_REQ_SUBMITTED:
3225                         /*
3226                          * We have received our response URB before
3227                          * our request has been acknowledged. Odd,
3228                          * but our OUT URB is still alive...
3229                          */
3230                         pr_debug("Causality violation: please reboot Universe\n");
3231                         ctlx->state = CTLX_RESP_COMPLETE;
3232                         break;
3233
3234                 case CTLX_REQ_COMPLETE:
3235                         /*
3236                          * This is the usual path: our request
3237                          * has already been acknowledged, and
3238                          * now we have received the reply too.
3239                          */
3240                         ctlx->state = CTLX_COMPLETE;
3241                         unlocked_usbctlx_complete(hw, ctlx);
3242                         run_queue = 1;
3243                         break;
3244
3245                 default:
3246                         /*
3247                          * Throw this CTLX away ...
3248                          */
3249                         netdev_err(hw->wlandev->netdev,
3250                                    "Matched IN URB, CTLX[%d] in invalid state(%s). Discarded.\n",
3251                                    le16_to_cpu(ctlx->outbuf.type),
3252                                    ctlxstr(ctlx->state));
3253                         if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3254                                 run_queue = 1;
3255                         break;
3256                 }               /* switch */
3257         }
3258
3259 unlock:
3260         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3261
3262         if (run_queue)
3263                 hfa384x_usbctlxq_run(hw);
3264 }
3265
3266 /*----------------------------------------------------------------
3267 * hfa384x_usbin_txcompl
3268 *
3269 * At this point we have the results of a previous transmit.
3270 *
3271 * Arguments:
3272 *       wlandev         wlan device
3273 *       usbin           ptr to the usb transfer buffer
3274 *
3275 * Returns:
3276 *       nothing
3277 *
3278 * Side effects:
3279 *
3280 * Call context:
3281 *       interrupt
3282 ----------------------------------------------------------------*/
3283 static void hfa384x_usbin_txcompl(struct wlandevice *wlandev,
3284                                   union hfa384x_usbin *usbin)
3285 {
3286         u16 status;
3287
3288         status = le16_to_cpu(usbin->type); /* yeah I know it says type... */
3289
3290         /* Was there an error? */
3291         if (HFA384x_TXSTATUS_ISERROR(status))
3292                 prism2sta_ev_txexc(wlandev, status);
3293         else
3294                 prism2sta_ev_tx(wlandev, status);
3295 }
3296
3297 /*----------------------------------------------------------------
3298 * hfa384x_usbin_rx
3299 *
3300 * At this point we have a successful received a rx frame packet.
3301 *
3302 * Arguments:
3303 *       wlandev         wlan device
3304 *       usbin           ptr to the usb transfer buffer
3305 *
3306 * Returns:
3307 *       nothing
3308 *
3309 * Side effects:
3310 *
3311 * Call context:
3312 *       interrupt
3313 ----------------------------------------------------------------*/
3314 static void hfa384x_usbin_rx(struct wlandevice *wlandev, struct sk_buff *skb)
3315 {
3316         union hfa384x_usbin *usbin = (union hfa384x_usbin *)skb->data;
3317         struct hfa384x *hw = wlandev->priv;
3318         int hdrlen;
3319         struct p80211_rxmeta *rxmeta;
3320         u16 data_len;
3321         u16 fc;
3322
3323         /* Byte order convert once up front. */
3324         usbin->rxfrm.desc.status = le16_to_cpu(usbin->rxfrm.desc.status);
3325         usbin->rxfrm.desc.time = le32_to_cpu(usbin->rxfrm.desc.time);
3326
3327         /* Now handle frame based on port# */
3328         switch (HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status)) {
3329         case 0:
3330                 fc = le16_to_cpu(usbin->rxfrm.desc.frame_control);
3331
3332                 /* If exclude and we receive an unencrypted, drop it */
3333                 if ((wlandev->hostwep & HOSTWEP_EXCLUDEUNENCRYPTED) &&
3334                     !WLAN_GET_FC_ISWEP(fc)) {
3335                         break;
3336                 }
3337
3338                 data_len = le16_to_cpu(usbin->rxfrm.desc.data_len);
3339
3340                 /* How much header data do we have? */
3341                 hdrlen = p80211_headerlen(fc);
3342
3343                 /* Pull off the descriptor */
3344                 skb_pull(skb, sizeof(struct hfa384x_rx_frame));
3345
3346                 /* Now shunt the header block up against the data block
3347                  * with an "overlapping" copy
3348                  */
3349                 memmove(skb_push(skb, hdrlen),
3350                         &usbin->rxfrm.desc.frame_control, hdrlen);
3351
3352                 skb->dev = wlandev->netdev;
3353                 skb->dev->last_rx = jiffies;
3354
3355                 /* And set the frame length properly */
3356                 skb_trim(skb, data_len + hdrlen);
3357
3358                 /* The prism2 series does not return the CRC */
3359                 memset(skb_put(skb, WLAN_CRC_LEN), 0xff, WLAN_CRC_LEN);
3360
3361                 skb_reset_mac_header(skb);
3362
3363                 /* Attach the rxmeta, set some stuff */
3364                 p80211skb_rxmeta_attach(wlandev, skb);
3365                 rxmeta = P80211SKB_RXMETA(skb);
3366                 rxmeta->mactime = usbin->rxfrm.desc.time;
3367                 rxmeta->rxrate = usbin->rxfrm.desc.rate;
3368                 rxmeta->signal = usbin->rxfrm.desc.signal - hw->dbmadjust;
3369                 rxmeta->noise = usbin->rxfrm.desc.silence - hw->dbmadjust;
3370
3371                 p80211netdev_rx(wlandev, skb);
3372
3373                 break;
3374
3375         case 7:
3376                 if (!HFA384x_RXSTATUS_ISFCSERR(usbin->rxfrm.desc.status)) {
3377                         /* Copy to wlansnif skb */
3378                         hfa384x_int_rxmonitor(wlandev, &usbin->rxfrm);
3379                         dev_kfree_skb(skb);
3380                 } else {
3381                         pr_debug("Received monitor frame: FCSerr set\n");
3382                 }
3383                 break;
3384
3385         default:
3386                 netdev_warn(hw->wlandev->netdev, "Received frame on unsupported port=%d\n",
3387                             HFA384x_RXSTATUS_MACPORT_GET(
3388                                     usbin->rxfrm.desc.status));
3389                 break;
3390         }
3391 }
3392
3393 /*----------------------------------------------------------------
3394 * hfa384x_int_rxmonitor
3395 *
3396 * Helper function for int_rx.  Handles monitor frames.
3397 * Note that this function allocates space for the FCS and sets it
3398 * to 0xffffffff.  The hfa384x doesn't give us the FCS value but the
3399 * higher layers expect it.  0xffffffff is used as a flag to indicate
3400 * the FCS is bogus.
3401 *
3402 * Arguments:
3403 *       wlandev         wlan device structure
3404 *       rxfrm           rx descriptor read from card in int_rx
3405 *
3406 * Returns:
3407 *       nothing
3408 *
3409 * Side effects:
3410 *       Allocates an skb and passes it up via the PF_PACKET interface.
3411 * Call context:
3412 *       interrupt
3413 ----------------------------------------------------------------*/
3414 static void hfa384x_int_rxmonitor(struct wlandevice *wlandev,
3415                                   struct hfa384x_usb_rxfrm *rxfrm)
3416 {
3417         struct hfa384x_rx_frame *rxdesc = &(rxfrm->desc);
3418         unsigned int hdrlen = 0;
3419         unsigned int datalen = 0;
3420         unsigned int skblen = 0;
3421         u8 *datap;
3422         u16 fc;
3423         struct sk_buff *skb;
3424         struct hfa384x *hw = wlandev->priv;
3425
3426         /* Remember the status, time, and data_len fields are in host order */
3427         /* Figure out how big the frame is */
3428         fc = le16_to_cpu(rxdesc->frame_control);
3429         hdrlen = p80211_headerlen(fc);
3430         datalen = le16_to_cpu(rxdesc->data_len);
3431
3432         /* Allocate an ind message+framesize skb */
3433         skblen = sizeof(struct p80211_caphdr) + hdrlen + datalen + WLAN_CRC_LEN;
3434
3435         /* sanity check the length */
3436         if (skblen >
3437             (sizeof(struct p80211_caphdr) +
3438              WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {
3439                 pr_debug("overlen frm: len=%zd\n",
3440                          skblen - sizeof(struct p80211_caphdr));
3441
3442                 return;
3443         }
3444
3445         skb = dev_alloc_skb(skblen);
3446         if (!skb)
3447                 return;
3448
3449         /* only prepend the prism header if in the right mode */
3450         if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
3451             (hw->sniffhdr != 0)) {
3452                 struct p80211_caphdr *caphdr;
3453                 /* The NEW header format! */
3454                 datap = skb_put(skb, sizeof(struct p80211_caphdr));
3455                 caphdr = (struct p80211_caphdr *)datap;
3456
3457                 caphdr->version = htonl(P80211CAPTURE_VERSION);
3458                 caphdr->length = htonl(sizeof(struct p80211_caphdr));
3459                 caphdr->mactime = __cpu_to_be64(rxdesc->time) * 1000;
3460                 caphdr->hosttime = __cpu_to_be64(jiffies);
3461                 caphdr->phytype = htonl(4);     /* dss_dot11_b */
3462                 caphdr->channel = htonl(hw->sniff_channel);
3463                 caphdr->datarate = htonl(rxdesc->rate);
3464                 caphdr->antenna = htonl(0);     /* unknown */
3465                 caphdr->priority = htonl(0);    /* unknown */
3466                 caphdr->ssi_type = htonl(3);    /* rssi_raw */
3467                 caphdr->ssi_signal = htonl(rxdesc->signal);
3468                 caphdr->ssi_noise = htonl(rxdesc->silence);
3469                 caphdr->preamble = htonl(0);    /* unknown */
3470                 caphdr->encoding = htonl(1);    /* cck */
3471         }
3472
3473         /* Copy the 802.11 header to the skb
3474            (ctl frames may be less than a full header) */
3475         datap = skb_put(skb, hdrlen);
3476         memcpy(datap, &(rxdesc->frame_control), hdrlen);
3477
3478         /* If any, copy the data from the card to the skb */
3479         if (datalen > 0) {
3480                 datap = skb_put(skb, datalen);
3481                 memcpy(datap, rxfrm->data, datalen);
3482
3483                 /* check for unencrypted stuff if WEP bit set. */
3484                 if (*(datap - hdrlen + 1) & 0x40)       /* wep set */
3485                         if ((*(datap) == 0xaa) && (*(datap + 1) == 0xaa))
3486                                 /* clear wep; it's the 802.2 header! */
3487                                 *(datap - hdrlen + 1) &= 0xbf;
3488         }
3489
3490         if (hw->sniff_fcs) {
3491                 /* Set the FCS */
3492                 datap = skb_put(skb, WLAN_CRC_LEN);
3493                 memset(datap, 0xff, WLAN_CRC_LEN);
3494         }
3495
3496         /* pass it back up */
3497         p80211netdev_rx(wlandev, skb);
3498 }
3499
3500 /*----------------------------------------------------------------
3501 * hfa384x_usbin_info
3502 *
3503 * At this point we have a successful received a Prism2 info frame.
3504 *
3505 * Arguments:
3506 *       wlandev         wlan device
3507 *       usbin           ptr to the usb transfer buffer
3508 *
3509 * Returns:
3510 *       nothing
3511 *
3512 * Side effects:
3513 *
3514 * Call context:
3515 *       interrupt
3516 ----------------------------------------------------------------*/
3517 static void hfa384x_usbin_info(struct wlandevice *wlandev,
3518                                union hfa384x_usbin *usbin)
3519 {
3520         usbin->infofrm.info.framelen =
3521             le16_to_cpu(usbin->infofrm.info.framelen);
3522         prism2sta_ev_info(wlandev, &usbin->infofrm.info);
3523 }
3524
3525 /*----------------------------------------------------------------
3526 * hfa384x_usbout_callback
3527 *
3528 * Callback for URBs on the BULKOUT endpoint.
3529 *
3530 * Arguments:
3531 *       urb             ptr to the completed urb
3532 *
3533 * Returns:
3534 *       nothing
3535 *
3536 * Side effects:
3537 *
3538 * Call context:
3539 *       interrupt
3540 ----------------------------------------------------------------*/
3541 static void hfa384x_usbout_callback(struct urb *urb)
3542 {
3543         struct wlandevice *wlandev = urb->context;
3544
3545 #ifdef DEBUG_USB
3546         dbprint_urb(urb);
3547 #endif
3548
3549         if (wlandev && wlandev->netdev) {
3550                 switch (urb->status) {
3551                 case 0:
3552                         prism2sta_ev_alloc(wlandev);
3553                         break;
3554
3555                 case -EPIPE:
3556                         {
3557                                 struct hfa384x *hw = wlandev->priv;
3558
3559                                 netdev_warn(hw->wlandev->netdev,
3560                                             "%s tx pipe stalled: requesting reset\n",
3561                                             wlandev->netdev->name);
3562                                 if (!test_and_set_bit
3563                                     (WORK_TX_HALT, &hw->usb_flags))
3564                                         schedule_work(&hw->usb_work);
3565                                 wlandev->netdev->stats.tx_errors++;
3566                                 break;
3567                         }
3568
3569                 case -EPROTO:
3570                 case -ETIMEDOUT:
3571                 case -EILSEQ:
3572                         {
3573                                 struct hfa384x *hw = wlandev->priv;
3574
3575                                 if (!test_and_set_bit
3576                                     (THROTTLE_TX, &hw->usb_flags) &&
3577                                     !timer_pending(&hw->throttle)) {
3578                                         mod_timer(&hw->throttle,
3579                                                   jiffies + THROTTLE_JIFFIES);
3580                                 }
3581                                 wlandev->netdev->stats.tx_errors++;
3582                                 netif_stop_queue(wlandev->netdev);
3583                                 break;
3584                         }
3585
3586                 case -ENOENT:
3587                 case -ESHUTDOWN:
3588                         /* Ignorable errors */
3589                         break;
3590
3591                 default:
3592                         netdev_info(wlandev->netdev, "unknown urb->status=%d\n",
3593                                     urb->status);
3594                         wlandev->netdev->stats.tx_errors++;
3595                         break;
3596                 }               /* switch */
3597         }
3598 }
3599
3600 /*----------------------------------------------------------------
3601 * hfa384x_ctlxout_callback
3602 *
3603 * Callback for control data on the BULKOUT endpoint.
3604 *
3605 * Arguments:
3606 *       urb             ptr to the completed urb
3607 *
3608 * Returns:
3609 * nothing
3610 *
3611 * Side effects:
3612 *
3613 * Call context:
3614 * interrupt
3615 ----------------------------------------------------------------*/
3616 static void hfa384x_ctlxout_callback(struct urb *urb)
3617 {
3618         struct hfa384x *hw = urb->context;
3619         int delete_resptimer = 0;
3620         int timer_ok = 1;
3621         int run_queue = 0;
3622         struct hfa384x_usbctlx *ctlx;
3623         unsigned long flags;
3624
3625         pr_debug("urb->status=%d\n", urb->status);
3626 #ifdef DEBUG_USB
3627         dbprint_urb(urb);
3628 #endif
3629         if ((urb->status == -ESHUTDOWN) ||
3630             (urb->status == -ENODEV) || !hw)
3631                 return;
3632
3633 retry:
3634         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3635
3636         /*
3637          * Only one CTLX at a time on the "active" list, and
3638          * none at all if we are unplugged. However, we can
3639          * rely on the disconnect function to clean everything
3640          * up if someone unplugged the adapter.
3641          */
3642         if (list_empty(&hw->ctlxq.active)) {
3643                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3644                 return;
3645         }
3646
3647         /*
3648          * Having something on the "active" queue means
3649          * that we have timers to worry about ...
3650          */
3651         if (del_timer(&hw->reqtimer) == 0) {
3652                 if (hw->req_timer_done == 0) {
3653                         /*
3654                          * This timer was actually running while we
3655                          * were trying to delete it. Let it terminate
3656                          * gracefully instead.
3657                          */
3658                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3659                         goto retry;
3660                 }
3661         } else {
3662                 hw->req_timer_done = 1;
3663         }
3664
3665         ctlx = get_active_ctlx(hw);
3666
3667         if (urb->status == 0) {
3668                 /* Request portion of a CTLX is successful */
3669                 switch (ctlx->state) {
3670                 case CTLX_REQ_SUBMITTED:
3671                         /* This OUT-ACK received before IN */
3672                         ctlx->state = CTLX_REQ_COMPLETE;
3673                         break;
3674
3675                 case CTLX_RESP_COMPLETE:
3676                         /* IN already received before this OUT-ACK,
3677                          * so this command must now be complete.
3678                          */
3679                         ctlx->state = CTLX_COMPLETE;
3680                         unlocked_usbctlx_complete(hw, ctlx);
3681                         run_queue = 1;
3682                         break;
3683
3684                 default:
3685                         /* This is NOT a valid CTLX "success" state! */
3686                         netdev_err(hw->wlandev->netdev,
3687                                    "Illegal CTLX[%d] success state(%s, %d) in OUT URB\n",
3688                                    le16_to_cpu(ctlx->outbuf.type),
3689                                    ctlxstr(ctlx->state), urb->status);
3690                         break;
3691                 }               /* switch */
3692         } else {
3693                 /* If the pipe has stalled then we need to reset it */
3694                 if ((urb->status == -EPIPE) &&
3695                     !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags)) {
3696                         netdev_warn(hw->wlandev->netdev,
3697                                     "%s tx pipe stalled: requesting reset\n",
3698                                     hw->wlandev->netdev->name);
3699                         schedule_work(&hw->usb_work);
3700                 }
3701
3702                 /* If someone cancels the OUT URB then its status
3703                  * should be either -ECONNRESET or -ENOENT.
3704                  */
3705                 ctlx->state = CTLX_REQ_FAILED;
3706                 unlocked_usbctlx_complete(hw, ctlx);
3707                 delete_resptimer = 1;
3708                 run_queue = 1;
3709         }
3710
3711 delresp:
3712         if (delete_resptimer) {
3713                 timer_ok = del_timer(&hw->resptimer);
3714                 if (timer_ok != 0)
3715                         hw->resp_timer_done = 1;
3716         }
3717
3718         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3719
3720         if (!timer_ok && (hw->resp_timer_done == 0)) {
3721                 spin_lock_irqsave(&hw->ctlxq.lock, flags);
3722                 goto delresp;
3723         }
3724
3725         if (run_queue)
3726                 hfa384x_usbctlxq_run(hw);
3727 }
3728
3729 /*----------------------------------------------------------------
3730 * hfa384x_usbctlx_reqtimerfn
3731 *
3732 * Timer response function for CTLX request timeouts.  If this
3733 * function is called, it means that the callback for the OUT
3734 * URB containing a Prism2.x XXX_Request was never called.
3735 *
3736 * Arguments:
3737 *       data            a ptr to the struct hfa384x
3738 *
3739 * Returns:
3740 *       nothing
3741 *
3742 * Side effects:
3743 *
3744 * Call context:
3745 *       interrupt
3746 ----------------------------------------------------------------*/
3747 static void hfa384x_usbctlx_reqtimerfn(unsigned long data)
3748 {
3749         struct hfa384x *hw = (struct hfa384x *)data;
3750         unsigned long flags;
3751
3752         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3753
3754         hw->req_timer_done = 1;
3755
3756         /* Removing the hardware automatically empties
3757          * the active list ...
3758          */
3759         if (!list_empty(&hw->ctlxq.active)) {
3760                 /*
3761                  * We must ensure that our URB is removed from
3762                  * the system, if it hasn't already expired.
3763                  */
3764                 hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
3765                 if (usb_unlink_urb(&hw->ctlx_urb) == -EINPROGRESS) {
3766                         struct hfa384x_usbctlx *ctlx = get_active_ctlx(hw);
3767
3768                         ctlx->state = CTLX_REQ_FAILED;
3769
3770                         /* This URB was active, but has now been
3771                          * cancelled. It will now have a status of
3772                          * -ECONNRESET in the callback function.
3773                          *
3774                          * We are cancelling this CTLX, so we're
3775                          * not going to need to wait for a response.
3776                          * The URB's callback function will check
3777                          * that this timer is truly dead.
3778                          */
3779                         if (del_timer(&hw->resptimer) != 0)
3780                                 hw->resp_timer_done = 1;
3781                 }
3782         }
3783
3784         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3785 }
3786
3787 /*----------------------------------------------------------------
3788 * hfa384x_usbctlx_resptimerfn
3789 *
3790 * Timer response function for CTLX response timeouts.  If this
3791 * function is called, it means that the callback for the IN
3792 * URB containing a Prism2.x XXX_Response was never called.
3793 *
3794 * Arguments:
3795 *       data            a ptr to the struct hfa384x
3796 *
3797 * Returns:
3798 *       nothing
3799 *
3800 * Side effects:
3801 *
3802 * Call context:
3803 *       interrupt
3804 ----------------------------------------------------------------*/
3805 static void hfa384x_usbctlx_resptimerfn(unsigned long data)
3806 {
3807         struct hfa384x *hw = (struct hfa384x *)data;
3808         unsigned long flags;
3809
3810         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3811
3812         hw->resp_timer_done = 1;
3813
3814         /* The active list will be empty if the
3815          * adapter has been unplugged ...
3816          */
3817         if (!list_empty(&hw->ctlxq.active)) {
3818                 struct hfa384x_usbctlx *ctlx = get_active_ctlx(hw);
3819
3820                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0) {
3821                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3822                         hfa384x_usbctlxq_run(hw);
3823                         return;
3824                 }
3825         }
3826         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3827 }
3828
3829 /*----------------------------------------------------------------
3830 * hfa384x_usb_throttlefn
3831 *
3832 *
3833 * Arguments:
3834 *       data    ptr to hw
3835 *
3836 * Returns:
3837 *       Nothing
3838 *
3839 * Side effects:
3840 *
3841 * Call context:
3842 *       Interrupt
3843 ----------------------------------------------------------------*/
3844 static void hfa384x_usb_throttlefn(unsigned long data)
3845 {
3846         struct hfa384x *hw = (struct hfa384x *)data;
3847         unsigned long flags;
3848
3849         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3850
3851         /*
3852          * We need to check BOTH the RX and the TX throttle controls,
3853          * so we use the bitwise OR instead of the logical OR.
3854          */
3855         pr_debug("flags=0x%lx\n", hw->usb_flags);
3856         if (!hw->wlandev->hwremoved &&
3857             ((test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
3858               !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags)) |
3859              (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
3860               !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags))
3861             )) {
3862                 schedule_work(&hw->usb_work);
3863         }
3864
3865         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3866 }
3867
3868 /*----------------------------------------------------------------
3869 * hfa384x_usbctlx_submit
3870 *
3871 * Called from the doxxx functions to submit a CTLX to the queue
3872 *
3873 * Arguments:
3874 *       hw              ptr to the hw struct
3875 *       ctlx            ctlx structure to enqueue
3876 *
3877 * Returns:
3878 *       -ENODEV if the adapter is unplugged
3879 *       0
3880 *
3881 * Side effects:
3882 *
3883 * Call context:
3884 *       process or interrupt
3885 ----------------------------------------------------------------*/
3886 static int hfa384x_usbctlx_submit(struct hfa384x *hw, struct hfa384x_usbctlx *ctlx)
3887 {
3888         unsigned long flags;
3889
3890         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3891
3892         if (hw->wlandev->hwremoved) {
3893                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3894                 return -ENODEV;
3895         }
3896
3897         ctlx->state = CTLX_PENDING;
3898         list_add_tail(&ctlx->list, &hw->ctlxq.pending);
3899         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3900         hfa384x_usbctlxq_run(hw);
3901
3902         return 0;
3903 }
3904
3905 /*----------------------------------------------------------------
3906 * hfa384x_isgood_pdrcore
3907 *
3908 * Quick check of PDR codes.
3909 *
3910 * Arguments:
3911 *       pdrcode         PDR code number (host order)
3912 *
3913 * Returns:
3914 *       zero            not good.
3915 *       one             is good.
3916 *
3917 * Side effects:
3918 *
3919 * Call context:
3920 ----------------------------------------------------------------*/
3921 static int hfa384x_isgood_pdrcode(u16 pdrcode)
3922 {
3923         switch (pdrcode) {
3924         case HFA384x_PDR_END_OF_PDA:
3925         case HFA384x_PDR_PCB_PARTNUM:
3926         case HFA384x_PDR_PDAVER:
3927         case HFA384x_PDR_NIC_SERIAL:
3928         case HFA384x_PDR_MKK_MEASUREMENTS:
3929         case HFA384x_PDR_NIC_RAMSIZE:
3930         case HFA384x_PDR_MFISUPRANGE:
3931         case HFA384x_PDR_CFISUPRANGE:
3932         case HFA384x_PDR_NICID:
3933         case HFA384x_PDR_MAC_ADDRESS:
3934         case HFA384x_PDR_REGDOMAIN:
3935         case HFA384x_PDR_ALLOWED_CHANNEL:
3936         case HFA384x_PDR_DEFAULT_CHANNEL:
3937         case HFA384x_PDR_TEMPTYPE:
3938         case HFA384x_PDR_IFR_SETTING:
3939         case HFA384x_PDR_RFR_SETTING:
3940         case HFA384x_PDR_HFA3861_BASELINE:
3941         case HFA384x_PDR_HFA3861_SHADOW:
3942         case HFA384x_PDR_HFA3861_IFRF:
3943         case HFA384x_PDR_HFA3861_CHCALSP:
3944         case HFA384x_PDR_HFA3861_CHCALI:
3945         case HFA384x_PDR_3842_NIC_CONFIG:
3946         case HFA384x_PDR_USB_ID:
3947         case HFA384x_PDR_PCI_ID:
3948         case HFA384x_PDR_PCI_IFCONF:
3949         case HFA384x_PDR_PCI_PMCONF:
3950         case HFA384x_PDR_RFENRGY:
3951         case HFA384x_PDR_HFA3861_MANF_TESTSP:
3952         case HFA384x_PDR_HFA3861_MANF_TESTI:
3953                 /* code is OK */
3954                 return 1;
3955         default:
3956                 if (pdrcode < 0x1000) {
3957                         /* code is OK, but we don't know exactly what it is */
3958                         pr_debug("Encountered unknown PDR#=0x%04x, assuming it's ok.\n",
3959                                  pdrcode);
3960                         return 1;
3961                 }
3962                 break;
3963         }
3964         /* bad code */
3965         pr_debug("Encountered unknown PDR#=0x%04x, (>=0x1000), assuming it's bad.\n",
3966                  pdrcode);
3967         return 0;
3968 }