1	// SPDX-License-Identifier: (GPL-2.0 OR MPL-1.1)
2	/*
3	*
4	* Functions that talk to the USB variant of the Intersil hfa384x MAC
5	*
6	* Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved.
7	* --------------------------------------------------------------------
8	*
9	* linux-wlan
10	*
11	* --------------------------------------------------------------------
12	*
13	* Inquiries regarding the linux-wlan Open Source project can be
14	* made directly to:
15	*
16	* AbsoluteValue Systems Inc.
17	* info@linux-wlan.com
18	* http://www.linux-wlan.com
19	*
20	* --------------------------------------------------------------------
21	*
22	* Portions of the development of this software were funded by
23	* Intersil Corporation as part of PRISM(R) chipset product development.
24	*
25	* --------------------------------------------------------------------
26	*
27	* This file implements functions that correspond to the prism2/hfa384x
28	* 802.11 MAC hardware and firmware host interface.
29	*
30	* The functions can be considered to represent several levels of
31	* abstraction. The lowest level functions are simply C-callable wrappers
32	* around the register accesses. The next higher level represents C-callable
33	* prism2 API functions that match the Intersil documentation as closely
34	* as is reasonable. The next higher layer implements common sequences
35	* of invocations of the API layer (e.g. write to bap, followed by cmd).
36	*
37	* Common sequences:
38	* hfa384x_drvr_xxx Highest level abstractions provided by the
39	* hfa384x code. They are driver defined wrappers
40	* for common sequences. These functions generally
41	* use the services of the lower levels.
42	*
43	* hfa384x_drvr_xxxconfig An example of the drvr level abstraction. These
44	* functions are wrappers for the RID get/set
45	* sequence. They call copy_[to|from]_bap() and
46	* cmd_access(). These functions operate on the
47	* RIDs and buffers without validation. The caller
48	* is responsible for that.
49	*
50	* API wrapper functions:
51	* hfa384x_cmd_xxx functions that provide access to the f/w commands.
52	* The function arguments correspond to each command
53	* argument, even command arguments that get packed
54	* into single registers. These functions _just_
55	* issue the command by setting the cmd/parm regs
56	* & reading the status/resp regs. Additional
57	* activities required to fully use a command
58	* (read/write from/to bap, get/set int status etc.)
59	* are implemented separately. Think of these as
60	* C-callable prism2 commands.
61	*
62	* Lowest Layer Functions:
63	* hfa384x_docmd_xxx These functions implement the sequence required
64	* to issue any prism2 command. Primarily used by the
65	* hfa384x_cmd_xxx functions.
66	*
67	* hfa384x_bap_xxx BAP read/write access functions.
68	* Note: we usually use BAP0 for non-interrupt context
69	* and BAP1 for interrupt context.
70	*
71	* hfa384x_dl_xxx download related functions.
72	*
73	* Driver State Issues:
74	* Note that there are two pairs of functions that manage the
75	* 'initialized' and 'running' states of the hw/MAC combo. The four
76	* functions are create(), destroy(), start(), and stop(). create()
77	* sets up the data structures required to support the hfa384x_*
78	* functions and destroy() cleans them up. The start() function gets
79	* the actual hardware running and enables the interrupts. The stop()
80	* function shuts the hardware down. The sequence should be:
81	* create()
82	* start()
83	* .
84	* . Do interesting things w/ the hardware
85	* .
86	* stop()
87	* destroy()
88	*
89	* Note that destroy() can be called without calling stop() first.
90	* --------------------------------------------------------------------
91	*/
92
93	#include <linux/module.h>
94	#include <linux/kernel.h>
95	#include <linux/sched.h>
96	#include <linux/types.h>
97	#include <linux/slab.h>
98	#include <linux/wireless.h>
99	#include <linux/netdevice.h>
100	#include <linux/timer.h>
101	#include <linux/io.h>
102	#include <linux/delay.h>
103	#include <asm/byteorder.h>
104	#include <linux/bitops.h>
105	#include <linux/list.h>
106	#include <linux/usb.h>
107	#include <linux/byteorder/generic.h>
108
109	#include "p80211types.h"
110	#include "p80211hdr.h"
111	#include "p80211mgmt.h"
112	#include "p80211conv.h"
113	#include "p80211msg.h"
114	#include "p80211netdev.h"
115	#include "p80211req.h"
116	#include "p80211metadef.h"
117	#include "p80211metastruct.h"
118	#include "hfa384x.h"
119	#include "prism2mgmt.h"
120
121	enum cmd_mode {
122	DOWAIT = 0,
123	DOASYNC
124	};
125
126	#define THROTTLE_JIFFIES (HZ / 8)
127	#define URB_ASYNC_UNLINK 0
128	#define USB_QUEUE_BULK 0
129
130	#define ROUNDUP64(a) (((a) + 63) & ~63)
131
132	#ifdef DEBUG_USB
133	static void dbprint_urb(struct urb *urb);
134	#endif
135
136	static void hfa384x_int_rxmonitor(struct wlandevice *wlandev,
137	struct hfa384x_usb_rxfrm *rxfrm);
138
139	static void hfa384x_usb_defer(struct work_struct *data);
140
141	static int submit_rx_urb(struct hfa384x *hw, gfp_t flags);
142
143	static int submit_tx_urb(struct hfa384x *hw, struct urb *tx_urb, gfp_t flags);
144
145	/*---------------------------------------------------*/
146	/* Callbacks */
147	static void hfa384x_usbout_callback(struct urb *urb);
148	static void hfa384x_ctlxout_callback(struct urb *urb);
149	static void hfa384x_usbin_callback(struct urb *urb);
150
151	static void
152	hfa384x_usbin_txcompl(struct wlandevice *wlandev, union hfa384x_usbin *usbin);
153
154	static void hfa384x_usbin_rx(struct wlandevice *wlandev, struct sk_buff *skb);
155
156	static void hfa384x_usbin_info(struct wlandevice *wlandev,
157	union hfa384x_usbin *usbin);
158
159	static void hfa384x_usbin_ctlx(struct hfa384x *hw, union hfa384x_usbin *usbin,
160	int urb_status);
161
162	/*---------------------------------------------------*/
163	/* Functions to support the prism2 usb command queue */
164
165	static void hfa384x_usbctlxq_run(struct hfa384x *hw);
166
167	static void hfa384x_usbctlx_reqtimerfn(struct timer_list *t);
168
169	static void hfa384x_usbctlx_resptimerfn(struct timer_list *t);
170
171	static void hfa384x_usb_throttlefn(struct timer_list *t);
172
173	static void hfa384x_usbctlx_completion_task(struct work_struct *work);
174
175	static void hfa384x_usbctlx_reaper_task(struct work_struct *work);
176
177	static int hfa384x_usbctlx_submit(struct hfa384x *hw,
178	struct hfa384x_usbctlx *ctlx);
179
180	static void unlocked_usbctlx_complete(struct hfa384x *hw,
181	struct hfa384x_usbctlx *ctlx);
182
183	struct usbctlx_completor {
184	int (*complete)(struct usbctlx_completor *completor);
185	};
186
187	static int
188	hfa384x_usbctlx_complete_sync(struct hfa384x *hw,
189	struct hfa384x_usbctlx *ctlx,
190	struct usbctlx_completor *completor);
191
192	static int
193	unlocked_usbctlx_cancel_async(struct hfa384x *hw, struct hfa384x_usbctlx *ctlx);
194
195	static void hfa384x_cb_status(struct hfa384x *hw,
196	const struct hfa384x_usbctlx *ctlx);
197
198	static int
199	usbctlx_get_status(const struct hfa384x_usb_statusresp *cmdresp,
200	struct hfa384x_cmdresult *result);
201
202	static void
203	usbctlx_get_rridresult(const struct hfa384x_usb_rridresp *rridresp,
204	struct hfa384x_rridresult *result);
205
206	/*---------------------------------------------------*/
207	/* Low level req/resp CTLX formatters and submitters */
208	static inline int
209	hfa384x_docmd(struct hfa384x *hw,
210	struct hfa384x_metacmd *cmd);
211
212	static int
213	hfa384x_dorrid(struct hfa384x *hw,
214	enum cmd_mode mode,
215	u16 rid,
216	void *riddata,
217	unsigned int riddatalen,
218	ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
219
220	static int
221	hfa384x_dowrid(struct hfa384x *hw,
222	enum cmd_mode mode,
223	u16 rid,
224	void *riddata,
225	unsigned int riddatalen,
226	ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
227
228	static int
229	hfa384x_dormem(struct hfa384x *hw,
230	u16 page,
231	u16 offset,
232	void *data,
233	unsigned int len);
234
235	static int
236	hfa384x_dowmem(struct hfa384x *hw,
237	u16 page,
238	u16 offset,
239	void *data,
240	unsigned int len);
241
242	static int hfa384x_isgood_pdrcode(u16 pdrcode);
243
244	static inline const char *ctlxstr(enum ctlx_state s)
245	{
246	static const char * const ctlx_str[] = {
247	"Initial state",
248	"Complete",
249	"Request failed",
250	"Request pending",
251	"Request packet submitted",
252	"Request packet completed",
253	"Response packet completed"
254	};
255
256	return ctlx_str[s];
257	};
258
259	static inline struct hfa384x_usbctlx *get_active_ctlx(struct hfa384x *hw)
260	{
261	return list_entry(hw->ctlxq.active.next, struct hfa384x_usbctlx, list);
262	}
263
264	#ifdef DEBUG_USB
265	void dbprint_urb(struct urb *urb)
266	{
267	pr_debug("urb->pipe=0x%08x\n", urb->pipe);
268	pr_debug("urb->status=0x%08x\n", urb->status);
269	pr_debug("urb->transfer_flags=0x%08x\n", urb->transfer_flags);
270	pr_debug("urb->transfer_buffer=0x%08x\n",
271	(unsigned int)urb->transfer_buffer);
272	pr_debug("urb->transfer_buffer_length=0x%08x\n",
273	urb->transfer_buffer_length);
274	pr_debug("urb->actual_length=0x%08x\n", urb->actual_length);
275	pr_debug("urb->setup_packet(ctl)=0x%08x\n",
276	(unsigned int)urb->setup_packet);
277	pr_debug("urb->start_frame(iso/irq)=0x%08x\n", urb->start_frame);
278	pr_debug("urb->interval(irq)=0x%08x\n", urb->interval);
279	pr_debug("urb->error_count(iso)=0x%08x\n", urb->error_count);
280	pr_debug("urb->context=0x%08x\n", (unsigned int)urb->context);
281	pr_debug("urb->complete=0x%08x\n", (unsigned int)urb->complete);
282	}
283	#endif
284
285	/*----------------------------------------------------------------
286	* submit_rx_urb
287	*
288	* Listen for input data on the BULK-IN pipe. If the pipe has
289	* stalled then schedule it to be reset.
290	*
291	* Arguments:
292	* hw device struct
293	* memflags memory allocation flags
294	*
295	* Returns:
296	* error code from submission
297	*
298	* Call context:
299	* Any
300	*----------------------------------------------------------------
301	*/
302	static int submit_rx_urb(struct hfa384x *hw, gfp_t memflags)
303	{
304	struct sk_buff *skb;
305	int result;
306
307	skb = dev_alloc_skb(length: sizeof(union hfa384x_usbin));
308	if (!skb) {
309	result = -ENOMEM;
310	goto done;
311	}
312
313	/* Post the IN urb */
314	usb_fill_bulk_urb(urb: &hw->rx_urb, dev: hw->usb,
315	pipe: hw->endp_in,
316	transfer_buffer: skb->data, buffer_length: sizeof(union hfa384x_usbin),
317	complete_fn: hfa384x_usbin_callback, context: hw->wlandev);
318
319	hw->rx_urb_skb = skb;
320
321	result = -ENOLINK;
322	if (!hw->wlandev->hwremoved &&
323	!test_bit(WORK_RX_HALT, &hw->usb_flags)) {
324	result = usb_submit_urb(urb: &hw->rx_urb, mem_flags: memflags);
325
326	/* Check whether we need to reset the RX pipe */
327	if (result == -EPIPE) {
328	netdev_warn(dev: hw->wlandev->netdev,
329	format: "%s rx pipe stalled: requesting reset\n",
330	hw->wlandev->netdev->name);
331	if (!test_and_set_bit(WORK_RX_HALT, addr: &hw->usb_flags))
332	schedule_work(work: &hw->usb_work);
333	}
334	}
335
336	/* Don't leak memory if anything should go wrong */
337	if (result != 0) {
338	dev_kfree_skb(skb);
339	hw->rx_urb_skb = NULL;
340	}
341
342	done:
343	return result;
344	}
345
346	/*----------------------------------------------------------------
347	* submit_tx_urb
348	*
349	* Prepares and submits the URB of transmitted data. If the
350	* submission fails then it will schedule the output pipe to
351	* be reset.
352	*
353	* Arguments:
354	* hw device struct
355	* tx_urb URB of data for transmission
356	* memflags memory allocation flags
357	*
358	* Returns:
359	* error code from submission
360	*
361	* Call context:
362	* Any
363	*----------------------------------------------------------------
364	*/
365	static int submit_tx_urb(struct hfa384x *hw, struct urb *tx_urb, gfp_t memflags)
366	{
367	struct net_device *netdev = hw->wlandev->netdev;
368	int result;
369
370	result = -ENOLINK;
371	if (netif_running(dev: netdev)) {
372	if (!hw->wlandev->hwremoved &&
373	!test_bit(WORK_TX_HALT, &hw->usb_flags)) {
374	result = usb_submit_urb(urb: tx_urb, mem_flags: memflags);
375
376	/* Test whether we need to reset the TX pipe */
377	if (result == -EPIPE) {
378	netdev_warn(dev: hw->wlandev->netdev,
379	format: "%s tx pipe stalled: requesting reset\n",
380	netdev->name);
381	set_bit(WORK_TX_HALT, addr: &hw->usb_flags);
382	schedule_work(work: &hw->usb_work);
383	} else if (result == 0) {
384	netif_stop_queue(dev: netdev);
385	}
386	}
387	}
388
389	return result;
390	}
391
392	/*----------------------------------------------------------------
393	* hfa394x_usb_defer
394	*
395	* There are some things that the USB stack cannot do while
396	* in interrupt context, so we arrange this function to run
397	* in process context.
398	*
399	* Arguments:
400	* hw device structure
401	*
402	* Returns:
403	* nothing
404	*
405	* Call context:
406	* process (by design)
407	*----------------------------------------------------------------
408	*/
409	static void hfa384x_usb_defer(struct work_struct *data)
410	{
411	struct hfa384x *hw = container_of(data, struct hfa384x, usb_work);
412	struct net_device *netdev = hw->wlandev->netdev;
413
414	/* Don't bother trying to reset anything if the plug
415	* has been pulled ...
416	*/
417	if (hw->wlandev->hwremoved)
418	return;
419
420	/* Reception has stopped: try to reset the input pipe */
421	if (test_bit(WORK_RX_HALT, &hw->usb_flags)) {
422	int ret;
423
424	usb_kill_urb(urb: &hw->rx_urb); /* Cannot be holding spinlock! */
425
426	ret = usb_clear_halt(dev: hw->usb, pipe: hw->endp_in);
427	if (ret != 0) {
428	netdev_err(dev: hw->wlandev->netdev,
429	format: "Failed to clear rx pipe for %s: err=%d\n",
430	netdev->name, ret);
431	} else {
432	netdev_info(dev: hw->wlandev->netdev, format: "%s rx pipe reset complete.\n",
433	netdev->name);
434	clear_bit(WORK_RX_HALT, addr: &hw->usb_flags);
435	set_bit(WORK_RX_RESUME, addr: &hw->usb_flags);
436	}
437	}
438
439	/* Resume receiving data back from the device. */
440	if (test_bit(WORK_RX_RESUME, &hw->usb_flags)) {
441	int ret;
442
443	ret = submit_rx_urb(hw, GFP_KERNEL);
444	if (ret != 0) {
445	netdev_err(dev: hw->wlandev->netdev,
446	format: "Failed to resume %s rx pipe.\n",
447	netdev->name);
448	} else {
449	clear_bit(WORK_RX_RESUME, addr: &hw->usb_flags);
450	}
451	}
452
453	/* Transmission has stopped: try to reset the output pipe */
454	if (test_bit(WORK_TX_HALT, &hw->usb_flags)) {
455	int ret;
456
457	usb_kill_urb(urb: &hw->tx_urb);
458	ret = usb_clear_halt(dev: hw->usb, pipe: hw->endp_out);
459	if (ret != 0) {
460	netdev_err(dev: hw->wlandev->netdev,
461	format: "Failed to clear tx pipe for %s: err=%d\n",
462	netdev->name, ret);
463	} else {
464	netdev_info(dev: hw->wlandev->netdev, format: "%s tx pipe reset complete.\n",
465	netdev->name);
466	clear_bit(WORK_TX_HALT, addr: &hw->usb_flags);
467	set_bit(WORK_TX_RESUME, addr: &hw->usb_flags);
468
469	/* Stopping the BULK-OUT pipe also blocked
470	* us from sending any more CTLX URBs, so
471	* we need to re-run our queue ...
472	*/
473	hfa384x_usbctlxq_run(hw);
474	}
475	}
476
477	/* Resume transmitting. */
478	if (test_and_clear_bit(WORK_TX_RESUME, addr: &hw->usb_flags))
479	netif_wake_queue(dev: hw->wlandev->netdev);
480	}
481
482	/*----------------------------------------------------------------
483	* hfa384x_create
484	*
485	* Sets up the struct hfa384x data structure for use. Note this
486	* does _not_ initialize the actual hardware, just the data structures
487	* we use to keep track of its state.
488	*
489	* Arguments:
490	* hw device structure
491	* irq device irq number
492	* iobase i/o base address for register access
493	* membase memory base address for register access
494	*
495	* Returns:
496	* nothing
497	*
498	* Side effects:
499	*
500	* Call context:
501	* process
502	*----------------------------------------------------------------
503	*/
504	void hfa384x_create(struct hfa384x *hw, struct usb_device *usb)
505	{
506	hw->usb = usb;
507
508	/* Set up the waitq */
509	init_waitqueue_head(&hw->cmdq);
510
511	/* Initialize the command queue */
512	spin_lock_init(&hw->ctlxq.lock);
513	INIT_LIST_HEAD(list: &hw->ctlxq.pending);
514	INIT_LIST_HEAD(list: &hw->ctlxq.active);
515	INIT_LIST_HEAD(list: &hw->ctlxq.completing);
516	INIT_LIST_HEAD(list: &hw->ctlxq.reapable);
517
518	/* Initialize the authentication queue */
519	skb_queue_head_init(list: &hw->authq);
520
521	INIT_WORK(&hw->reaper_bh, hfa384x_usbctlx_reaper_task);
522	INIT_WORK(&hw->completion_bh, hfa384x_usbctlx_completion_task);
523	INIT_WORK(&hw->link_bh, prism2sta_processing_defer);
524	INIT_WORK(&hw->usb_work, hfa384x_usb_defer);
525
526	timer_setup(&hw->throttle, hfa384x_usb_throttlefn, 0);
527
528	timer_setup(&hw->resptimer, hfa384x_usbctlx_resptimerfn, 0);
529
530	timer_setup(&hw->reqtimer, hfa384x_usbctlx_reqtimerfn, 0);
531
532	usb_init_urb(urb: &hw->rx_urb);
533	usb_init_urb(urb: &hw->tx_urb);
534	usb_init_urb(urb: &hw->ctlx_urb);
535
536	hw->link_status = HFA384x_LINK_NOTCONNECTED;
537	hw->state = HFA384x_STATE_INIT;
538
539	INIT_WORK(&hw->commsqual_bh, prism2sta_commsqual_defer);
540	timer_setup(&hw->commsqual_timer, prism2sta_commsqual_timer, 0);
541	}
542
543	/*----------------------------------------------------------------
544	* hfa384x_destroy
545	*
546	* Partner to hfa384x_create(). This function cleans up the hw
547	* structure so that it can be freed by the caller using a simple
548	* kfree. Currently, this function is just a placeholder. If, at some
549	* point in the future, an hw in the 'shutdown' state requires a 'deep'
550	* kfree, this is where it should be done. Note that if this function
551	* is called on a _running_ hw structure, the drvr_stop() function is
552	* called.
553	*
554	* Arguments:
555	* hw device structure
556	*
557	* Returns:
558	* nothing, this function is not allowed to fail.
559	*
560	* Side effects:
561	*
562	* Call context:
563	* process
564	*----------------------------------------------------------------
565	*/
566	void hfa384x_destroy(struct hfa384x *hw)
567	{
568	struct sk_buff *skb;
569
570	if (hw->state == HFA384x_STATE_RUNNING)
571	hfa384x_drvr_stop(hw);
572	hw->state = HFA384x_STATE_PREINIT;
573
574	kfree(objp: hw->scanresults);
575	hw->scanresults = NULL;
576
577	/* Now to clean out the auth queue */
578	while ((skb = skb_dequeue(list: &hw->authq)))
579	dev_kfree_skb(skb);
580	}
581
582	static struct hfa384x_usbctlx *usbctlx_alloc(void)
583	{
584	struct hfa384x_usbctlx *ctlx;
585
586	ctlx = kzalloc(size: sizeof(*ctlx),
587	in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
588	if (ctlx)
589	init_completion(x: &ctlx->done);
590
591	return ctlx;
592	}
593
594	static int
595	usbctlx_get_status(const struct hfa384x_usb_statusresp *cmdresp,
596	struct hfa384x_cmdresult *result)
597	{
598	result->status = le16_to_cpu(cmdresp->status);
599	result->resp0 = le16_to_cpu(cmdresp->resp0);
600	result->resp1 = le16_to_cpu(cmdresp->resp1);
601	result->resp2 = le16_to_cpu(cmdresp->resp2);
602
603	pr_debug("cmdresult:status=0x%04x resp0=0x%04x resp1=0x%04x resp2=0x%04x\n",
604	result->status, result->resp0, result->resp1, result->resp2);
605
606	return result->status & HFA384x_STATUS_RESULT;
607	}
608
609	static void
610	usbctlx_get_rridresult(const struct hfa384x_usb_rridresp *rridresp,
611	struct hfa384x_rridresult *result)
612	{
613	result->rid = le16_to_cpu(rridresp->rid);
614	result->riddata = rridresp->data;
615	result->riddata_len = ((le16_to_cpu(rridresp->frmlen) - 1) * 2);
616	}
617
618	/*----------------------------------------------------------------
619	* Completor object:
620	* This completor must be passed to hfa384x_usbctlx_complete_sync()
621	* when processing a CTLX that returns a struct hfa384x_cmdresult structure.
622	*----------------------------------------------------------------
623	*/
624	struct usbctlx_cmd_completor {
625	struct usbctlx_completor head;
626
627	const struct hfa384x_usb_statusresp *cmdresp;
628	struct hfa384x_cmdresult *result;
629	};
630
631	static inline int usbctlx_cmd_completor_fn(struct usbctlx_completor *head)
632	{
633	struct usbctlx_cmd_completor *complete;
634
635	complete = (struct usbctlx_cmd_completor *)head;
636	return usbctlx_get_status(cmdresp: complete->cmdresp, result: complete->result);
637	}
638
639	static inline struct usbctlx_completor *
640	init_cmd_completor(struct usbctlx_cmd_completor *completor,
641	const struct hfa384x_usb_statusresp *cmdresp,
642	struct hfa384x_cmdresult *result)
643	{
644	completor->head.complete = usbctlx_cmd_completor_fn;
645	completor->cmdresp = cmdresp;
646	completor->result = result;
647	return &completor->head;
648	}
649
650	/*----------------------------------------------------------------
651	* Completor object:
652	* This completor must be passed to hfa384x_usbctlx_complete_sync()
653	* when processing a CTLX that reads a RID.
654	*----------------------------------------------------------------
655	*/
656	struct usbctlx_rrid_completor {
657	struct usbctlx_completor head;
658
659	const struct hfa384x_usb_rridresp *rridresp;
660	void *riddata;
661	unsigned int riddatalen;
662	};
663
664	static int usbctlx_rrid_completor_fn(struct usbctlx_completor *head)
665	{
666	struct usbctlx_rrid_completor *complete;
667	struct hfa384x_rridresult rridresult;
668
669	complete = (struct usbctlx_rrid_completor *)head;
670	usbctlx_get_rridresult(rridresp: complete->rridresp, result: &rridresult);
671
672	/* Validate the length, note body len calculation in bytes */
673	if (rridresult.riddata_len != complete->riddatalen) {
674	pr_warn("RID len mismatch, rid=0x%04x hlen=%d fwlen=%d\n",
675	rridresult.rid,
676	complete->riddatalen, rridresult.riddata_len);
677	return -ENODATA;
678	}
679
680	memcpy(complete->riddata, rridresult.riddata, complete->riddatalen);
681	return 0;
682	}
683
684	static inline struct usbctlx_completor *
685	init_rrid_completor(struct usbctlx_rrid_completor *completor,
686	const struct hfa384x_usb_rridresp *rridresp,
687	void *riddata,
688	unsigned int riddatalen)
689	{
690	completor->head.complete = usbctlx_rrid_completor_fn;
691	completor->rridresp = rridresp;
692	completor->riddata = riddata;
693	completor->riddatalen = riddatalen;
694	return &completor->head;
695	}
696
697	/*----------------------------------------------------------------
698	* Completor object:
699	* Interprets the results of a synchronous RID-write
700	*----------------------------------------------------------------
701	*/
702	#define init_wrid_completor init_cmd_completor
703
704	/*----------------------------------------------------------------
705	* Completor object:
706	* Interprets the results of a synchronous memory-write
707	*----------------------------------------------------------------
708	*/
709	#define init_wmem_completor init_cmd_completor
710
711	/*----------------------------------------------------------------
712	* Completor object:
713	* Interprets the results of a synchronous memory-read
714	*----------------------------------------------------------------
715	*/
716	struct usbctlx_rmem_completor {
717	struct usbctlx_completor head;
718
719	const struct hfa384x_usb_rmemresp *rmemresp;
720	void *data;
721	unsigned int len;
722	};
723
724	static int usbctlx_rmem_completor_fn(struct usbctlx_completor *head)
725	{
726	struct usbctlx_rmem_completor *complete =
727	(struct usbctlx_rmem_completor *)head;
728
729	pr_debug("rmemresp:len=%d\n", complete->rmemresp->frmlen);
730	memcpy(complete->data, complete->rmemresp->data, complete->len);
731	return 0;
732	}
733
734	static inline struct usbctlx_completor *
735	init_rmem_completor(struct usbctlx_rmem_completor *completor,
736	struct hfa384x_usb_rmemresp *rmemresp,
737	void *data,
738	unsigned int len)
739	{
740	completor->head.complete = usbctlx_rmem_completor_fn;
741	completor->rmemresp = rmemresp;
742	completor->data = data;
743	completor->len = len;
744	return &completor->head;
745	}
746
747	/*----------------------------------------------------------------
748	* hfa384x_cb_status
749	*
750	* Ctlx_complete handler for async CMD type control exchanges.
751	* mark the hw struct as such.
752	*
753	* Note: If the handling is changed here, it should probably be
754	* changed in docmd as well.
755	*
756	* Arguments:
757	* hw hw struct
758	* ctlx completed CTLX
759	*
760	* Returns:
761	* nothing
762	*
763	* Side effects:
764	*
765	* Call context:
766	* interrupt
767	*----------------------------------------------------------------
768	*/
769	static void hfa384x_cb_status(struct hfa384x *hw,
770	const struct hfa384x_usbctlx *ctlx)
771	{
772	if (ctlx->usercb) {
773	struct hfa384x_cmdresult cmdresult;
774
775	if (ctlx->state != CTLX_COMPLETE) {
776	memset(&cmdresult, 0, sizeof(cmdresult));
777	cmdresult.status =
778	HFA384x_STATUS_RESULT_SET(HFA384x_CMD_ERR);
779	} else {
780	usbctlx_get_status(cmdresp: &ctlx->inbuf.cmdresp, result: &cmdresult);
781	}
782
783	ctlx->usercb(hw, &cmdresult, ctlx->usercb_data);
784	}
785	}
786
787	/*----------------------------------------------------------------
788	* hfa384x_cmd_initialize
789	*
790	* Issues the initialize command and sets the hw->state based
791	* on the result.
792	*
793	* Arguments:
794	* hw device structure
795	*
796	* Returns:
797	* 0 success
798	* >0 f/w reported error - f/w status code
799	* <0 driver reported error
800	*
801	* Side effects:
802	*
803	* Call context:
804	* process
805	*----------------------------------------------------------------
806	*/
807	int hfa384x_cmd_initialize(struct hfa384x *hw)
808	{
809	int result = 0;
810	int i;
811	struct hfa384x_metacmd cmd;
812
813	cmd.cmd = HFA384x_CMDCODE_INIT;
814	cmd.parm0 = 0;
815	cmd.parm1 = 0;
816	cmd.parm2 = 0;
817
818	result = hfa384x_docmd(hw, cmd: &cmd);
819
820	pr_debug("cmdresp.init: status=0x%04x, resp0=0x%04x, resp1=0x%04x, resp2=0x%04x\n",
821	cmd.result.status,
822	cmd.result.resp0, cmd.result.resp1, cmd.result.resp2);
823	if (result == 0) {
824	for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
825	hw->port_enabled[i] = 0;
826	}
827
828	hw->link_status = HFA384x_LINK_NOTCONNECTED;
829
830	return result;
831	}
832
833	/*----------------------------------------------------------------
834	* hfa384x_cmd_disable
835	*
836	* Issues the disable command to stop communications on one of
837	* the MACs 'ports'.
838	*
839	* Arguments:
840	* hw device structure
841	* macport MAC port number (host order)
842	*
843	* Returns:
844	* 0 success
845	* >0 f/w reported failure - f/w status code
846	* <0 driver reported error (timeout|bad arg)
847	*
848	* Side effects:
849	*
850	* Call context:
851	* process
852	*----------------------------------------------------------------
853	*/
854	int hfa384x_cmd_disable(struct hfa384x *hw, u16 macport)
855	{
856	struct hfa384x_metacmd cmd;
857
858	cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DISABLE) |
859	HFA384x_CMD_MACPORT_SET(macport);
860	cmd.parm0 = 0;
861	cmd.parm1 = 0;
862	cmd.parm2 = 0;
863
864	return hfa384x_docmd(hw, cmd: &cmd);
865	}
866
867	/*----------------------------------------------------------------
868	* hfa384x_cmd_enable
869	*
870	* Issues the enable command to enable communications on one of
871	* the MACs 'ports'.
872	*
873	* Arguments:
874	* hw device structure
875	* macport MAC port number
876	*
877	* Returns:
878	* 0 success
879	* >0 f/w reported failure - f/w status code
880	* <0 driver reported error (timeout|bad arg)
881	*
882	* Side effects:
883	*
884	* Call context:
885	* process
886	*----------------------------------------------------------------
887	*/
888	int hfa384x_cmd_enable(struct hfa384x *hw, u16 macport)
889	{
890	struct hfa384x_metacmd cmd;
891
892	cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_ENABLE) |
893	HFA384x_CMD_MACPORT_SET(macport);
894	cmd.parm0 = 0;
895	cmd.parm1 = 0;
896	cmd.parm2 = 0;
897
898	return hfa384x_docmd(hw, cmd: &cmd);
899	}
900
901	/*----------------------------------------------------------------
902	* hfa384x_cmd_monitor
903	*
904	* Enables the 'monitor mode' of the MAC. Here's the description of
905	* monitor mode that I've received thus far:
906	*
907	* "The "monitor mode" of operation is that the MAC passes all
908	* frames for which the PLCP checks are correct. All received
909	* MPDUs are passed to the host with MAC Port = 7, with a
910	* receive status of good, FCS error, or undecryptable. Passing
911	* certain MPDUs is a violation of the 802.11 standard, but useful
912	* for a debugging tool." Normal communication is not possible
913	* while monitor mode is enabled.
914	*
915	* Arguments:
916	* hw device structure
917	* enable a code (0x0b|0x0f) that enables/disables
918	* monitor mode. (host order)
919	*
920	* Returns:
921	* 0 success
922	* >0 f/w reported failure - f/w status code
923	* <0 driver reported error (timeout|bad arg)
924	*
925	* Side effects:
926	*
927	* Call context:
928	* process
929	*----------------------------------------------------------------
930	*/
931	int hfa384x_cmd_monitor(struct hfa384x *hw, u16 enable)
932	{
933	struct hfa384x_metacmd cmd;
934
935	cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_MONITOR) |
936	HFA384x_CMD_AINFO_SET(enable);
937	cmd.parm0 = 0;
938	cmd.parm1 = 0;
939	cmd.parm2 = 0;
940
941	return hfa384x_docmd(hw, cmd: &cmd);
942	}
943
944	/*----------------------------------------------------------------
945	* hfa384x_cmd_download
946	*
947	* Sets the controls for the MAC controller code/data download
948	* process. The arguments set the mode and address associated
949	* with a download. Note that the aux registers should be enabled
950	* prior to setting one of the download enable modes.
951	*
952	* Arguments:
953	* hw device structure
954	* mode 0 - Disable programming and begin code exec
955	* 1 - Enable volatile mem programming
956	* 2 - Enable non-volatile mem programming
957	* 3 - Program non-volatile section from NV download
958	* buffer.
959	* (host order)
960	* lowaddr
961	* highaddr For mode 1, sets the high & low order bits of
962	* the "destination address". This address will be
963	* the execution start address when download is
964	* subsequently disabled.
965	* For mode 2, sets the high & low order bits of
966	* the destination in NV ram.
967	* For modes 0 & 3, should be zero. (host order)
968	* NOTE: these are CMD format.
969	* codelen Length of the data to write in mode 2,
970	* zero otherwise. (host order)
971	*
972	* Returns:
973	* 0 success
974	* >0 f/w reported failure - f/w status code
975	* <0 driver reported error (timeout|bad arg)
976	*
977	* Side effects:
978	*
979	* Call context:
980	* process
981	*----------------------------------------------------------------
982	*/
983	int hfa384x_cmd_download(struct hfa384x *hw, u16 mode, u16 lowaddr,
984	u16 highaddr, u16 codelen)
985	{
986	struct hfa384x_metacmd cmd;
987
988	pr_debug("mode=%d, lowaddr=0x%04x, highaddr=0x%04x, codelen=%d\n",
989	mode, lowaddr, highaddr, codelen);
990
991	cmd.cmd = (HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DOWNLD) |
992	HFA384x_CMD_PROGMODE_SET(mode));
993
994	cmd.parm0 = lowaddr;
995	cmd.parm1 = highaddr;
996	cmd.parm2 = codelen;
997
998	return hfa384x_docmd(hw, cmd: &cmd);
999	}
1000
1001	/*----------------------------------------------------------------
1002	* hfa384x_corereset
1003	*
1004	* Perform a reset of the hfa38xx MAC core. We assume that the hw
1005	* structure is in its "created" state. That is, it is initialized
1006	* with proper values. Note that if a reset is done after the
1007	* device has been active for awhile, the caller might have to clean
1008	* up some leftover cruft in the hw structure.
1009	*
1010	* Arguments:
1011	* hw device structure
1012	* holdtime how long (in ms) to hold the reset
1013	* settletime how long (in ms) to wait after releasing
1014	* the reset
1015	*
1016	* Returns:
1017	* nothing
1018	*
1019	* Side effects:
1020	*
1021	* Call context:
1022	* process
1023	*----------------------------------------------------------------
1024	*/
1025	int hfa384x_corereset(struct hfa384x *hw, int holdtime,
1026	int settletime, int genesis)
1027	{
1028	int result;
1029
1030	result = usb_reset_device(dev: hw->usb);
1031	if (result < 0) {
1032	netdev_err(dev: hw->wlandev->netdev, format: "usb_reset_device() failed, result=%d.\n",
1033	result);
1034	}
1035
1036	return result;
1037	}
1038
1039	/*----------------------------------------------------------------
1040	* hfa384x_usbctlx_complete_sync
1041	*
1042	* Waits for a synchronous CTLX object to complete,
1043	* and then handles the response.
1044	*
1045	* Arguments:
1046	* hw device structure
1047	* ctlx CTLX ptr
1048	* completor functor object to decide what to
1049	* do with the CTLX's result.
1050	*
1051	* Returns:
1052	* 0 Success
1053	* -ERESTARTSYS Interrupted by a signal
1054	* -EIO CTLX failed
1055	* -ENODEV Adapter was unplugged
1056	* ??? Result from completor
1057	*
1058	* Side effects:
1059	*
1060	* Call context:
1061	* process
1062	*----------------------------------------------------------------
1063	*/
1064	static int hfa384x_usbctlx_complete_sync(struct hfa384x *hw,
1065	struct hfa384x_usbctlx *ctlx,
1066	struct usbctlx_completor *completor)
1067	{
1068	unsigned long flags;
1069	int result;
1070
1071	result = wait_for_completion_interruptible(x: &ctlx->done);
1072
1073	spin_lock_irqsave(&hw->ctlxq.lock, flags);
1074
1075	/*
1076	* We can only handle the CTLX if the USB disconnect
1077	* function has not run yet ...
1078	*/
1079	cleanup:
1080	if (hw->wlandev->hwremoved) {
1081	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
1082	result = -ENODEV;
1083	} else if (result != 0) {
1084	int runqueue = 0;
1085
1086	/*
1087	* We were probably interrupted, so delete
1088	* this CTLX asynchronously, kill the timers
1089	* and the URB, and then start the next
1090	* pending CTLX.
1091	*
1092	* NOTE: We can only delete the timers and
1093	* the URB if this CTLX is active.
1094	*/
1095	if (ctlx == get_active_ctlx(hw)) {
1096	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
1097
1098	del_timer_sync(timer: &hw->reqtimer);
1099	del_timer_sync(timer: &hw->resptimer);
1100	hw->req_timer_done = 1;
1101	hw->resp_timer_done = 1;
1102	usb_kill_urb(urb: &hw->ctlx_urb);
1103
1104	spin_lock_irqsave(&hw->ctlxq.lock, flags);
1105
1106	runqueue = 1;
1107
1108	/*
1109	* This scenario is so unlikely that I'm
1110	* happy with a grubby "goto" solution ...
1111	*/
1112	if (hw->wlandev->hwremoved)
1113	goto cleanup;
1114	}
1115
1116	/*
1117	* The completion task will send this CTLX
1118	* to the reaper the next time it runs. We
1119	* are no longer in a hurry.
1120	*/
1121	ctlx->reapable = 1;
1122	ctlx->state = CTLX_REQ_FAILED;
1123	list_move_tail(list: &ctlx->list, head: &hw->ctlxq.completing);
1124
1125	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
1126
1127	if (runqueue)
1128	hfa384x_usbctlxq_run(hw);
1129	} else {
1130	if (ctlx->state == CTLX_COMPLETE) {
1131	result = completor->complete(completor);
1132	} else {
1133	netdev_warn(dev: hw->wlandev->netdev, format: "CTLX[%d] error: state(%s)\n",
1134	le16_to_cpu(ctlx->outbuf.type),
1135	ctlxstr(s: ctlx->state));
1136	result = -EIO;
1137	}
1138
1139	list_del(entry: &ctlx->list);
1140	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
1141	kfree(objp: ctlx);
1142	}
1143
1144	return result;
1145	}
1146
1147	/*----------------------------------------------------------------
1148	* hfa384x_docmd
1149	*
1150	* Constructs a command CTLX and submits it.
1151	*
1152	* NOTE: Any changes to the 'post-submit' code in this function
1153	* need to be carried over to hfa384x_cbcmd() since the handling
1154	* is virtually identical.
1155	*
1156	* Arguments:
1157	* hw device structure
1158	* cmd cmd structure. Includes all arguments and result
1159	* data points. All in host order. in host order
1160	*
1161	* Returns:
1162	* 0 success
1163	* -EIO CTLX failure
1164	* -ERESTARTSYS Awakened on signal
1165	* >0 command indicated error, Status and Resp0-2 are
1166	* in hw structure.
1167	*
1168	* Side effects:
1169	*
1170	*
1171	* Call context:
1172	* process
1173	*----------------------------------------------------------------
1174	*/
1175	static inline int
1176	hfa384x_docmd(struct hfa384x *hw,
1177	struct hfa384x_metacmd *cmd)
1178	{
1179	int result;
1180	struct hfa384x_usbctlx *ctlx;
1181
1182	ctlx = usbctlx_alloc();
1183	if (!ctlx) {
1184	result = -ENOMEM;
1185	goto done;
1186	}
1187
1188	/* Initialize the command */
1189	ctlx->outbuf.cmdreq.type = cpu_to_le16(HFA384x_USB_CMDREQ);
1190	ctlx->outbuf.cmdreq.cmd = cpu_to_le16(cmd->cmd);
1191	ctlx->outbuf.cmdreq.parm0 = cpu_to_le16(cmd->parm0);
1192	ctlx->outbuf.cmdreq.parm1 = cpu_to_le16(cmd->parm1);
1193	ctlx->outbuf.cmdreq.parm2 = cpu_to_le16(cmd->parm2);
1194
1195	ctlx->outbufsize = sizeof(ctlx->outbuf.cmdreq);
1196
1197	pr_debug("cmdreq: cmd=0x%04x parm0=0x%04x parm1=0x%04x parm2=0x%04x\n",
1198	cmd->cmd, cmd->parm0, cmd->parm1, cmd->parm2);
1199
1200	ctlx->reapable = DOWAIT;
1201	ctlx->cmdcb = NULL;
1202	ctlx->usercb = NULL;
1203	ctlx->usercb_data = NULL;
1204
1205	result = hfa384x_usbctlx_submit(hw, ctlx);
1206	if (result != 0) {
1207	kfree(objp: ctlx);
1208	} else {
1209	struct usbctlx_cmd_completor cmd_completor;
1210	struct usbctlx_completor *completor;
1211
1212	completor = init_cmd_completor(completor: &cmd_completor,
1213	cmdresp: &ctlx->inbuf.cmdresp,
1214	result: &cmd->result);
1215
1216	result = hfa384x_usbctlx_complete_sync(hw, ctlx, completor);
1217	}
1218
1219	done:
1220	return result;
1221	}
1222
1223	/*----------------------------------------------------------------
1224	* hfa384x_dorrid
1225	*
1226	* Constructs a read rid CTLX and issues it.
1227	*
1228	* NOTE: Any changes to the 'post-submit' code in this function
1229	* need to be carried over to hfa384x_cbrrid() since the handling
1230	* is virtually identical.
1231	*
1232	* Arguments:
1233	* hw device structure
1234	* mode DOWAIT or DOASYNC
1235	* rid Read RID number (host order)
1236	* riddata Caller supplied buffer that MAC formatted RID.data
1237	* record will be written to for DOWAIT calls. Should
1238	* be NULL for DOASYNC calls.
1239	* riddatalen Buffer length for DOWAIT calls. Zero for DOASYNC calls.
1240	* cmdcb command callback for async calls, NULL for DOWAIT calls
1241	* usercb user callback for async calls, NULL for DOWAIT calls
1242	* usercb_data user supplied data pointer for async calls, NULL
1243	* for DOWAIT calls
1244	*
1245	* Returns:
1246	* 0 success
1247	* -EIO CTLX failure
1248	* -ERESTARTSYS Awakened on signal
1249	* -ENODATA riddatalen != macdatalen
1250	* >0 command indicated error, Status and Resp0-2 are
1251	* in hw structure.
1252	*
1253	* Side effects:
1254	*
1255	* Call context:
1256	* interrupt (DOASYNC)
1257	* process (DOWAIT or DOASYNC)
1258	*----------------------------------------------------------------
1259	*/
1260	static int
1261	hfa384x_dorrid(struct hfa384x *hw,
1262	enum cmd_mode mode,
1263	u16 rid,
1264	void *riddata,
1265	unsigned int riddatalen,
1266	ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1267	{
1268	int result;
1269	struct hfa384x_usbctlx *ctlx;
1270
1271	ctlx = usbctlx_alloc();
1272	if (!ctlx) {
1273	result = -ENOMEM;
1274	goto done;
1275	}
1276
1277	/* Initialize the command */
1278	ctlx->outbuf.rridreq.type = cpu_to_le16(HFA384x_USB_RRIDREQ);
1279	ctlx->outbuf.rridreq.frmlen =
1280	cpu_to_le16(sizeof(ctlx->outbuf.rridreq.rid));
1281	ctlx->outbuf.rridreq.rid = cpu_to_le16(rid);
1282
1283	ctlx->outbufsize = sizeof(ctlx->outbuf.rridreq);
1284
1285	ctlx->reapable = mode;
1286	ctlx->cmdcb = cmdcb;
1287	ctlx->usercb = usercb;
1288	ctlx->usercb_data = usercb_data;
1289
1290	/* Submit the CTLX */
1291	result = hfa384x_usbctlx_submit(hw, ctlx);
1292	if (result != 0) {
1293	kfree(objp: ctlx);
1294	} else if (mode == DOWAIT) {
1295	struct usbctlx_rrid_completor completor;
1296
1297	result =
1298	hfa384x_usbctlx_complete_sync(hw, ctlx,
1299	completor: init_rrid_completor
1300	(completor: &completor,
1301	rridresp: &ctlx->inbuf.rridresp,
1302	riddata, riddatalen));
1303	}
1304
1305	done:
1306	return result;
1307	}
1308
1309	/*----------------------------------------------------------------
1310	* hfa384x_dowrid
1311	*
1312	* Constructs a write rid CTLX and issues it.
1313	*
1314	* NOTE: Any changes to the 'post-submit' code in this function
1315	* need to be carried over to hfa384x_cbwrid() since the handling
1316	* is virtually identical.
1317	*
1318	* Arguments:
1319	* hw device structure
1320	* enum cmd_mode DOWAIT or DOASYNC
1321	* rid RID code
1322	* riddata Data portion of RID formatted for MAC
1323	* riddatalen Length of the data portion in bytes
1324	* cmdcb command callback for async calls, NULL for DOWAIT calls
1325	* usercb user callback for async calls, NULL for DOWAIT calls
1326	* usercb_data user supplied data pointer for async calls
1327	*
1328	* Returns:
1329	* 0 success
1330	* -ETIMEDOUT timed out waiting for register ready or
1331	* command completion
1332	* >0 command indicated error, Status and Resp0-2 are
1333	* in hw structure.
1334	*
1335	* Side effects:
1336	*
1337	* Call context:
1338	* interrupt (DOASYNC)
1339	* process (DOWAIT or DOASYNC)
1340	*----------------------------------------------------------------
1341	*/
1342	static int
1343	hfa384x_dowrid(struct hfa384x *hw,
1344	enum cmd_mode mode,
1345	u16 rid,
1346	void *riddata,
1347	unsigned int riddatalen,
1348	ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1349	{
1350	int result;
1351	struct hfa384x_usbctlx *ctlx;
1352
1353	ctlx = usbctlx_alloc();
1354	if (!ctlx) {
1355	result = -ENOMEM;
1356	goto done;
1357	}
1358
1359	/* Initialize the command */
1360	ctlx->outbuf.wridreq.type = cpu_to_le16(HFA384x_USB_WRIDREQ);
1361	ctlx->outbuf.wridreq.frmlen = cpu_to_le16((sizeof
1362	(ctlx->outbuf.wridreq.rid) +
1363	riddatalen + 1) / 2);
1364	ctlx->outbuf.wridreq.rid = cpu_to_le16(rid);
1365	memcpy(ctlx->outbuf.wridreq.data, riddata, riddatalen);
1366
1367	ctlx->outbufsize = sizeof(ctlx->outbuf.wridreq.type) +
1368	sizeof(ctlx->outbuf.wridreq.frmlen) +
1369	sizeof(ctlx->outbuf.wridreq.rid) + riddatalen;
1370
1371	ctlx->reapable = mode;
1372	ctlx->cmdcb = cmdcb;
1373	ctlx->usercb = usercb;
1374	ctlx->usercb_data = usercb_data;
1375
1376	/* Submit the CTLX */
1377	result = hfa384x_usbctlx_submit(hw, ctlx);
1378	if (result != 0) {
1379	kfree(objp: ctlx);
1380	} else if (mode == DOWAIT) {
1381	struct usbctlx_cmd_completor completor;
1382	struct hfa384x_cmdresult wridresult;
1383
1384	result = hfa384x_usbctlx_complete_sync(hw,
1385	ctlx,
1386	init_wrid_completor
1387	(completor: &completor,
1388	cmdresp: &ctlx->inbuf.wridresp,
1389	result: &wridresult));
1390	}
1391
1392	done:
1393	return result;
1394	}
1395
1396	/*----------------------------------------------------------------
1397	* hfa384x_dormem
1398	*
1399	* Constructs a readmem CTLX and issues it.
1400	*
1401	* NOTE: Any changes to the 'post-submit' code in this function
1402	* need to be carried over to hfa384x_cbrmem() since the handling
1403	* is virtually identical.
1404	*
1405	* Arguments:
1406	* hw device structure
1407	* page MAC address space page (CMD format)
1408	* offset MAC address space offset
1409	* data Ptr to data buffer to receive read
1410	* len Length of the data to read (max == 2048)
1411	*
1412	* Returns:
1413	* 0 success
1414	* -ETIMEDOUT timed out waiting for register ready or
1415	* command completion
1416	* >0 command indicated error, Status and Resp0-2 are
1417	* in hw structure.
1418	*
1419	* Side effects:
1420	*
1421	* Call context:
1422	* process (DOWAIT)
1423	*----------------------------------------------------------------
1424	*/
1425	static int
1426	hfa384x_dormem(struct hfa384x *hw,
1427	u16 page,
1428	u16 offset,
1429	void *data,
1430	unsigned int len)
1431	{
1432	int result;
1433	struct hfa384x_usbctlx *ctlx;
1434
1435	ctlx = usbctlx_alloc();
1436	if (!ctlx) {
1437	result = -ENOMEM;
1438	goto done;
1439	}
1440
1441	/* Initialize the command */
1442	ctlx->outbuf.rmemreq.type = cpu_to_le16(HFA384x_USB_RMEMREQ);
1443	ctlx->outbuf.rmemreq.frmlen =
1444	cpu_to_le16(sizeof(ctlx->outbuf.rmemreq.offset) +
1445	sizeof(ctlx->outbuf.rmemreq.page) + len);
1446	ctlx->outbuf.rmemreq.offset = cpu_to_le16(offset);
1447	ctlx->outbuf.rmemreq.page = cpu_to_le16(page);
1448
1449	ctlx->outbufsize = sizeof(ctlx->outbuf.rmemreq);
1450
1451	pr_debug("type=0x%04x frmlen=%d offset=0x%04x page=0x%04x\n",
1452	ctlx->outbuf.rmemreq.type,
1453	ctlx->outbuf.rmemreq.frmlen,
1454	ctlx->outbuf.rmemreq.offset, ctlx->outbuf.rmemreq.page);
1455
1456	pr_debug("pktsize=%zd\n", ROUNDUP64(sizeof(ctlx->outbuf.rmemreq)));
1457
1458	ctlx->reapable = DOWAIT;
1459	ctlx->cmdcb = NULL;
1460	ctlx->usercb = NULL;
1461	ctlx->usercb_data = NULL;
1462
1463	result = hfa384x_usbctlx_submit(hw, ctlx);
1464	if (result != 0) {
1465	kfree(objp: ctlx);
1466	} else {
1467	struct usbctlx_rmem_completor completor;
1468
1469	result =
1470	hfa384x_usbctlx_complete_sync(hw, ctlx,
1471	completor: init_rmem_completor
1472	(completor: &completor,
1473	rmemresp: &ctlx->inbuf.rmemresp, data,
1474	len));
1475	}
1476
1477	done:
1478	return result;
1479	}
1480
1481	/*----------------------------------------------------------------
1482	* hfa384x_dowmem
1483	*
1484	* Constructs a writemem CTLX and issues it.
1485	*
1486	* NOTE: Any changes to the 'post-submit' code in this function
1487	* need to be carried over to hfa384x_cbwmem() since the handling
1488	* is virtually identical.
1489	*
1490	* Arguments:
1491	* hw device structure
1492	* page MAC address space page (CMD format)
1493	* offset MAC address space offset
1494	* data Ptr to data buffer containing write data
1495	* len Length of the data to read (max == 2048)
1496	*
1497	* Returns:
1498	* 0 success
1499	* -ETIMEDOUT timed out waiting for register ready or
1500	* command completion
1501	* >0 command indicated error, Status and Resp0-2 are
1502	* in hw structure.
1503	*
1504	* Side effects:
1505	*
1506	* Call context:
1507	* interrupt (DOWAIT)
1508	* process (DOWAIT)
1509	*----------------------------------------------------------------
1510	*/
1511	static int
1512	hfa384x_dowmem(struct hfa384x *hw,
1513	u16 page,
1514	u16 offset,
1515	void *data,
1516	unsigned int len)
1517	{
1518	int result;
1519	struct hfa384x_usbctlx *ctlx;
1520
1521	pr_debug("page=0x%04x offset=0x%04x len=%d\n", page, offset, len);
1522
1523	ctlx = usbctlx_alloc();
1524	if (!ctlx) {
1525	result = -ENOMEM;
1526	goto done;
1527	}
1528
1529	/* Initialize the command */
1530	ctlx->outbuf.wmemreq.type = cpu_to_le16(HFA384x_USB_WMEMREQ);
1531	ctlx->outbuf.wmemreq.frmlen =
1532	cpu_to_le16(sizeof(ctlx->outbuf.wmemreq.offset) +
1533	sizeof(ctlx->outbuf.wmemreq.page) + len);
1534	ctlx->outbuf.wmemreq.offset = cpu_to_le16(offset);
1535	ctlx->outbuf.wmemreq.page = cpu_to_le16(page);
1536	memcpy(ctlx->outbuf.wmemreq.data, data, len);
1537
1538	ctlx->outbufsize = sizeof(ctlx->outbuf.wmemreq.type) +
1539	sizeof(ctlx->outbuf.wmemreq.frmlen) +
1540	sizeof(ctlx->outbuf.wmemreq.offset) +
1541	sizeof(ctlx->outbuf.wmemreq.page) + len;
1542
1543	ctlx->reapable = DOWAIT;
1544	ctlx->cmdcb = NULL;
1545	ctlx->usercb = NULL;
1546	ctlx->usercb_data = NULL;
1547
1548	result = hfa384x_usbctlx_submit(hw, ctlx);
1549	if (result != 0) {
1550	kfree(objp: ctlx);
1551	} else {
1552	struct usbctlx_cmd_completor completor;
1553	struct hfa384x_cmdresult wmemresult;
1554
1555	result = hfa384x_usbctlx_complete_sync(hw,
1556	ctlx,
1557	init_wmem_completor
1558	(completor: &completor,
1559	cmdresp: &ctlx->inbuf.wmemresp,
1560	result: &wmemresult));
1561	}
1562
1563	done:
1564	return result;
1565	}
1566
1567	/*----------------------------------------------------------------
1568	* hfa384x_drvr_disable
1569	*
1570	* Issues the disable command to stop communications on one of
1571	* the MACs 'ports'. Only macport 0 is valid for stations.
1572	* APs may also disable macports 1-6. Only ports that have been
1573	* previously enabled may be disabled.
1574	*
1575	* Arguments:
1576	* hw device structure
1577	* macport MAC port number (host order)
1578	*
1579	* Returns:
1580	* 0 success
1581	* >0 f/w reported failure - f/w status code
1582	* <0 driver reported error (timeout|bad arg)
1583	*
1584	* Side effects:
1585	*
1586	* Call context:
1587	* process
1588	*----------------------------------------------------------------
1589	*/
1590	int hfa384x_drvr_disable(struct hfa384x *hw, u16 macport)
1591	{
1592	int result = 0;
1593
1594	if ((!hw->isap && macport != 0) ||
1595	(hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1596	!(hw->port_enabled[macport])) {
1597	result = -EINVAL;
1598	} else {
1599	result = hfa384x_cmd_disable(hw, macport);
1600	if (result == 0)
1601	hw->port_enabled[macport] = 0;
1602	}
1603	return result;
1604	}
1605
1606	/*----------------------------------------------------------------
1607	* hfa384x_drvr_enable
1608	*
1609	* Issues the enable command to enable communications on one of
1610	* the MACs 'ports'. Only macport 0 is valid for stations.
1611	* APs may also enable macports 1-6. Only ports that are currently
1612	* disabled may be enabled.
1613	*
1614	* Arguments:
1615	* hw device structure
1616	* macport MAC port number
1617	*
1618	* Returns:
1619	* 0 success
1620	* >0 f/w reported failure - f/w status code
1621	* <0 driver reported error (timeout|bad arg)
1622	*
1623	* Side effects:
1624	*
1625	* Call context:
1626	* process
1627	*----------------------------------------------------------------
1628	*/
1629	int hfa384x_drvr_enable(struct hfa384x *hw, u16 macport)
1630	{
1631	int result = 0;
1632
1633	if ((!hw->isap && macport != 0) ||
1634	(hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1635	(hw->port_enabled[macport])) {
1636	result = -EINVAL;
1637	} else {
1638	result = hfa384x_cmd_enable(hw, macport);
1639	if (result == 0)
1640	hw->port_enabled[macport] = 1;
1641	}
1642	return result;
1643	}
1644
1645	/*----------------------------------------------------------------
1646	* hfa384x_drvr_flashdl_enable
1647	*
1648	* Begins the flash download state. Checks to see that we're not
1649	* already in a download state and that a port isn't enabled.
1650	* Sets the download state and retrieves the flash download
1651	* buffer location, buffer size, and timeout length.
1652	*
1653	* Arguments:
1654	* hw device structure
1655	*
1656	* Returns:
1657	* 0 success
1658	* >0 f/w reported error - f/w status code
1659	* <0 driver reported error
1660	*
1661	* Side effects:
1662	*
1663	* Call context:
1664	* process
1665	*----------------------------------------------------------------
1666	*/
1667	int hfa384x_drvr_flashdl_enable(struct hfa384x *hw)
1668	{
1669	int result = 0;
1670	int i;
1671
1672	/* Check that a port isn't active */
1673	for (i = 0; i < HFA384x_PORTID_MAX; i++) {
1674	if (hw->port_enabled[i]) {
1675	pr_debug("called when port enabled.\n");
1676	return -EINVAL;
1677	}
1678	}
1679
1680	/* Check that we're not already in a download state */
1681	if (hw->dlstate != HFA384x_DLSTATE_DISABLED)
1682	return -EINVAL;
1683
1684	/* Retrieve the buffer loc&size and timeout */
1685	result = hfa384x_drvr_getconfig(hw, HFA384x_RID_DOWNLOADBUFFER,
1686	buf: &hw->bufinfo, len: sizeof(hw->bufinfo));
1687	if (result)
1688	return result;
1689
1690	le16_to_cpus(&hw->bufinfo.page);
1691	le16_to_cpus(&hw->bufinfo.offset);
1692	le16_to_cpus(&hw->bufinfo.len);
1693	result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME,
1694	val: &hw->dltimeout);
1695	if (result)
1696	return result;
1697
1698	le16_to_cpus(&hw->dltimeout);
1699
1700	pr_debug("flashdl_enable\n");
1701
1702	hw->dlstate = HFA384x_DLSTATE_FLASHENABLED;
1703
1704	return result;
1705	}
1706
1707	/*----------------------------------------------------------------
1708	* hfa384x_drvr_flashdl_disable
1709	*
1710	* Ends the flash download state. Note that this will cause the MAC
1711	* firmware to restart.
1712	*
1713	* Arguments:
1714	* hw device structure
1715	*
1716	* Returns:
1717	* 0 success
1718	* >0 f/w reported error - f/w status code
1719	* <0 driver reported error
1720	*
1721	* Side effects:
1722	*
1723	* Call context:
1724	* process
1725	*----------------------------------------------------------------
1726	*/
1727	int hfa384x_drvr_flashdl_disable(struct hfa384x *hw)
1728	{
1729	/* Check that we're already in the download state */
1730	if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
1731	return -EINVAL;
1732
1733	pr_debug("flashdl_enable\n");
1734
1735	/* There isn't much we can do at this point, so I don't */
1736	/* bother w/ the return value */
1737	hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, lowaddr: 0, highaddr: 0, codelen: 0);
1738	hw->dlstate = HFA384x_DLSTATE_DISABLED;
1739
1740	return 0;
1741	}
1742
1743	/*----------------------------------------------------------------
1744	* hfa384x_drvr_flashdl_write
1745	*
1746	* Performs a FLASH download of a chunk of data. First checks to see
1747	* that we're in the FLASH download state, then sets the download
1748	* mode, uses the aux functions to 1) copy the data to the flash
1749	* buffer, 2) sets the download 'write flash' mode, 3) readback and
1750	* compare. Lather rinse, repeat as many times an necessary to get
1751	* all the given data into flash.
1752	* When all data has been written using this function (possibly
1753	* repeatedly), call drvr_flashdl_disable() to end the download state
1754	* and restart the MAC.
1755	*
1756	* Arguments:
1757	* hw device structure
1758	* daddr Card address to write to. (host order)
1759	* buf Ptr to data to write.
1760	* len Length of data (host order).
1761	*
1762	* Returns:
1763	* 0 success
1764	* >0 f/w reported error - f/w status code
1765	* <0 driver reported error
1766	*
1767	* Side effects:
1768	*
1769	* Call context:
1770	* process
1771	*----------------------------------------------------------------
1772	*/
1773	int hfa384x_drvr_flashdl_write(struct hfa384x *hw, u32 daddr,
1774	void *buf, u32 len)
1775	{
1776	int result = 0;
1777	u32 dlbufaddr;
1778	int nburns;
1779	u32 burnlen;
1780	u32 burndaddr;
1781	u16 burnlo;
1782	u16 burnhi;
1783	int nwrites;
1784	u8 *writebuf;
1785	u16 writepage;
1786	u16 writeoffset;
1787	u32 writelen;
1788	int i;
1789	int j;
1790
1791	pr_debug("daddr=0x%08x len=%d\n", daddr, len);
1792
1793	/* Check that we're in the flash download state */
1794	if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
1795	return -EINVAL;
1796
1797	netdev_info(dev: hw->wlandev->netdev,
1798	format: "Download %d bytes to flash @0x%06x\n", len, daddr);
1799
1800	/* Convert to flat address for arithmetic */
1801	/* NOTE: dlbuffer RID stores the address in AUX format */
1802	dlbufaddr =
1803	HFA384x_ADDR_AUX_MKFLAT(hw->bufinfo.page, hw->bufinfo.offset);
1804	pr_debug("dlbuf.page=0x%04x dlbuf.offset=0x%04x dlbufaddr=0x%08x\n",
1805	hw->bufinfo.page, hw->bufinfo.offset, dlbufaddr);
1806	/* Calculations to determine how many fills of the dlbuffer to do
1807	* and how many USB wmemreq's to do for each fill. At this point
1808	* in time, the dlbuffer size and the wmemreq size are the same.
1809	* Therefore, nwrites should always be 1. The extra complexity
1810	* here is a hedge against future changes.
1811	*/
1812
1813	/* Figure out how many times to do the flash programming */
1814	nburns = len / hw->bufinfo.len;
1815	nburns += (len % hw->bufinfo.len) ? 1 : 0;
1816
1817	/* For each flash program cycle, how many USB wmemreq's are needed? */
1818	nwrites = hw->bufinfo.len / HFA384x_USB_RWMEM_MAXLEN;
1819	nwrites += (hw->bufinfo.len % HFA384x_USB_RWMEM_MAXLEN) ? 1 : 0;
1820
1821	/* For each burn */
1822	for (i = 0; i < nburns; i++) {
1823	/* Get the dest address and len */
1824	burnlen = (len - (hw->bufinfo.len * i)) > hw->bufinfo.len ?
1825	hw->bufinfo.len : (len - (hw->bufinfo.len * i));
1826	burndaddr = daddr + (hw->bufinfo.len * i);
1827	burnlo = HFA384x_ADDR_CMD_MKOFF(burndaddr);
1828	burnhi = HFA384x_ADDR_CMD_MKPAGE(burndaddr);
1829
1830	netdev_info(dev: hw->wlandev->netdev, format: "Writing %d bytes to flash @0x%06x\n",
1831	burnlen, burndaddr);
1832
1833	/* Set the download mode */
1834	result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_NV,
1835	lowaddr: burnlo, highaddr: burnhi, codelen: burnlen);
1836	if (result) {
1837	netdev_err(dev: hw->wlandev->netdev,
1838	format: "download(NV,lo=%x,hi=%x,len=%x) cmd failed, result=%d. Aborting d/l\n",
1839	burnlo, burnhi, burnlen, result);
1840	goto exit_proc;
1841	}
1842
1843	/* copy the data to the flash download buffer */
1844	for (j = 0; j < nwrites; j++) {
1845	writebuf = buf +
1846	(i * hw->bufinfo.len) +
1847	(j * HFA384x_USB_RWMEM_MAXLEN);
1848
1849	writepage = HFA384x_ADDR_CMD_MKPAGE(dlbufaddr +
1850	(j * HFA384x_USB_RWMEM_MAXLEN));
1851	writeoffset = HFA384x_ADDR_CMD_MKOFF(dlbufaddr +
1852	(j * HFA384x_USB_RWMEM_MAXLEN));
1853
1854	writelen = burnlen - (j * HFA384x_USB_RWMEM_MAXLEN);
1855	writelen = writelen > HFA384x_USB_RWMEM_MAXLEN ?
1856	HFA384x_USB_RWMEM_MAXLEN : writelen;
1857
1858	result = hfa384x_dowmem(hw,
1859	page: writepage,
1860	offset: writeoffset,
1861	data: writebuf, len: writelen);
1862	}
1863
1864	/* set the download 'write flash' mode */
1865	result = hfa384x_cmd_download(hw,
1866	HFA384x_PROGMODE_NVWRITE,
1867	lowaddr: 0, highaddr: 0, codelen: 0);
1868	if (result) {
1869	netdev_err(dev: hw->wlandev->netdev,
1870	format: "download(NVWRITE,lo=%x,hi=%x,len=%x) cmd failed, result=%d. Aborting d/l\n",
1871	burnlo, burnhi, burnlen, result);
1872	goto exit_proc;
1873	}
1874
1875	/* TODO: We really should do a readback and compare. */
1876	}
1877
1878	exit_proc:
1879
1880	/* Leave the firmware in the 'post-prog' mode. flashdl_disable will */
1881	/* actually disable programming mode. Remember, that will cause the */
1882	/* the firmware to effectively reset itself. */
1883
1884	return result;
1885	}
1886
1887	/*----------------------------------------------------------------
1888	* hfa384x_drvr_getconfig
1889	*
1890	* Performs the sequence necessary to read a config/info item.
1891	*
1892	* Arguments:
1893	* hw device structure
1894	* rid config/info record id (host order)
1895	* buf host side record buffer. Upon return it will
1896	* contain the body portion of the record (minus the
1897	* RID and len).
1898	* len buffer length (in bytes, should match record length)
1899	*
1900	* Returns:
1901	* 0 success
1902	* >0 f/w reported error - f/w status code
1903	* <0 driver reported error
1904	* -ENODATA length mismatch between argument and retrieved
1905	* record.
1906	*
1907	* Side effects:
1908	*
1909	* Call context:
1910	* process
1911	*----------------------------------------------------------------
1912	*/
1913	int hfa384x_drvr_getconfig(struct hfa384x *hw, u16 rid, void *buf, u16 len)
1914	{
1915	return hfa384x_dorrid(hw, mode: DOWAIT, rid, riddata: buf, riddatalen: len, NULL, NULL, NULL);
1916	}
1917
1918	/*----------------------------------------------------------------
1919	* hfa384x_drvr_setconfig_async
1920	*
1921	* Performs the sequence necessary to write a config/info item.
1922	*
1923	* Arguments:
1924	* hw device structure
1925	* rid config/info record id (in host order)
1926	* buf host side record buffer
1927	* len buffer length (in bytes)
1928	* usercb completion callback
1929	* usercb_data completion callback argument
1930	*
1931	* Returns:
1932	* 0 success
1933	* >0 f/w reported error - f/w status code
1934	* <0 driver reported error
1935	*
1936	* Side effects:
1937	*
1938	* Call context:
1939	* process
1940	*----------------------------------------------------------------
1941	*/
1942	int
1943	hfa384x_drvr_setconfig_async(struct hfa384x *hw,
1944	u16 rid,
1945	void *buf,
1946	u16 len, ctlx_usercb_t usercb, void *usercb_data)
1947	{
1948	return hfa384x_dowrid(hw, mode: DOASYNC, rid, riddata: buf, riddatalen: len, cmdcb: hfa384x_cb_status,
1949	usercb, usercb_data);
1950	}
1951
1952	/*----------------------------------------------------------------
1953	* hfa384x_drvr_ramdl_disable
1954	*
1955	* Ends the ram download state.
1956	*
1957	* Arguments:
1958	* hw device structure
1959	*
1960	* Returns:
1961	* 0 success
1962	* >0 f/w reported error - f/w status code
1963	* <0 driver reported error
1964	*
1965	* Side effects:
1966	*
1967	* Call context:
1968	* process
1969	*----------------------------------------------------------------
1970	*/
1971	int hfa384x_drvr_ramdl_disable(struct hfa384x *hw)
1972	{
1973	/* Check that we're already in the download state */
1974	if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
1975	return -EINVAL;
1976
1977	pr_debug("ramdl_disable()\n");
1978
1979	/* There isn't much we can do at this point, so I don't */
1980	/* bother w/ the return value */
1981	hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, lowaddr: 0, highaddr: 0, codelen: 0);
1982	hw->dlstate = HFA384x_DLSTATE_DISABLED;
1983
1984	return 0;
1985	}
1986
1987	/*----------------------------------------------------------------
1988	* hfa384x_drvr_ramdl_enable
1989	*
1990	* Begins the ram download state. Checks to see that we're not
1991	* already in a download state and that a port isn't enabled.
1992	* Sets the download state and calls cmd_download with the
1993	* ENABLE_VOLATILE subcommand and the exeaddr argument.
1994	*
1995	* Arguments:
1996	* hw device structure
1997	* exeaddr the card execution address that will be
1998	* jumped to when ramdl_disable() is called
1999	* (host order).
2000	*
2001	* Returns:
2002	* 0 success
2003	* >0 f/w reported error - f/w status code
2004	* <0 driver reported error
2005	*
2006	* Side effects:
2007	*
2008	* Call context:
2009	* process
2010	*----------------------------------------------------------------
2011	*/
2012	int hfa384x_drvr_ramdl_enable(struct hfa384x *hw, u32 exeaddr)
2013	{
2014	int result = 0;
2015	u16 lowaddr;
2016	u16 hiaddr;
2017	int i;
2018
2019	/* Check that a port isn't active */
2020	for (i = 0; i < HFA384x_PORTID_MAX; i++) {
2021	if (hw->port_enabled[i]) {
2022	netdev_err(dev: hw->wlandev->netdev,
2023	format: "Can't download with a macport enabled.\n");
2024	return -EINVAL;
2025	}
2026	}
2027
2028	/* Check that we're not already in a download state */
2029	if (hw->dlstate != HFA384x_DLSTATE_DISABLED) {
2030	netdev_err(dev: hw->wlandev->netdev,
2031	format: "Download state not disabled.\n");
2032	return -EINVAL;
2033	}
2034
2035	pr_debug("ramdl_enable, exeaddr=0x%08x\n", exeaddr);
2036
2037	/* Call the download(1,addr) function */
2038	lowaddr = HFA384x_ADDR_CMD_MKOFF(exeaddr);
2039	hiaddr = HFA384x_ADDR_CMD_MKPAGE(exeaddr);
2040
2041	result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_RAM,
2042	lowaddr, highaddr: hiaddr, codelen: 0);
2043
2044	if (result == 0) {
2045	/* Set the download state */
2046	hw->dlstate = HFA384x_DLSTATE_RAMENABLED;
2047	} else {
2048	pr_debug("cmd_download(0x%04x, 0x%04x) failed, result=%d.\n",
2049	lowaddr, hiaddr, result);
2050	}
2051
2052	return result;
2053	}
2054
2055	/*----------------------------------------------------------------
2056	* hfa384x_drvr_ramdl_write
2057	*
2058	* Performs a RAM download of a chunk of data. First checks to see
2059	* that we're in the RAM download state, then uses the [read|write]mem USB
2060	* commands to 1) copy the data, 2) readback and compare. The download
2061	* state is unaffected. When all data has been written using
2062	* this function, call drvr_ramdl_disable() to end the download state
2063	* and restart the MAC.
2064	*
2065	* Arguments:
2066	* hw device structure
2067	* daddr Card address to write to. (host order)
2068	* buf Ptr to data to write.
2069	* len Length of data (host order).
2070	*
2071	* Returns:
2072	* 0 success
2073	* >0 f/w reported error - f/w status code
2074	* <0 driver reported error
2075	*
2076	* Side effects:
2077	*
2078	* Call context:
2079	* process
2080	*----------------------------------------------------------------
2081	*/
2082	int hfa384x_drvr_ramdl_write(struct hfa384x *hw, u32 daddr, void *buf, u32 len)
2083	{
2084	int result = 0;
2085	int nwrites;
2086	u8 *data = buf;
2087	int i;
2088	u32 curraddr;
2089	u16 currpage;
2090	u16 curroffset;
2091	u16 currlen;
2092
2093	/* Check that we're in the ram download state */
2094	if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
2095	return -EINVAL;
2096
2097	netdev_info(dev: hw->wlandev->netdev, format: "Writing %d bytes to ram @0x%06x\n",
2098	len, daddr);
2099
2100	/* How many dowmem calls? */
2101	nwrites = len / HFA384x_USB_RWMEM_MAXLEN;
2102	nwrites += len % HFA384x_USB_RWMEM_MAXLEN ? 1 : 0;
2103
2104	/* Do blocking wmem's */
2105	for (i = 0; i < nwrites; i++) {
2106	/* make address args */
2107	curraddr = daddr + (i * HFA384x_USB_RWMEM_MAXLEN);
2108	currpage = HFA384x_ADDR_CMD_MKPAGE(curraddr);
2109	curroffset = HFA384x_ADDR_CMD_MKOFF(curraddr);
2110	currlen = len - (i * HFA384x_USB_RWMEM_MAXLEN);
2111	if (currlen > HFA384x_USB_RWMEM_MAXLEN)
2112	currlen = HFA384x_USB_RWMEM_MAXLEN;
2113
2114	/* Do blocking ctlx */
2115	result = hfa384x_dowmem(hw,
2116	page: currpage,
2117	offset: curroffset,
2118	data: data + (i * HFA384x_USB_RWMEM_MAXLEN),
2119	len: currlen);
2120
2121	if (result)
2122	break;
2123
2124	/* TODO: We really should have a readback. */
2125	}
2126
2127	return result;
2128	}
2129
2130	/*----------------------------------------------------------------
2131	* hfa384x_drvr_readpda
2132	*
2133	* Performs the sequence to read the PDA space. Note there is no
2134	* drvr_writepda() function. Writing a PDA is
2135	* generally implemented by a calling component via calls to
2136	* cmd_download and writing to the flash download buffer via the
2137	* aux regs.
2138	*
2139	* Arguments:
2140	* hw device structure
2141	* buf buffer to store PDA in
2142	* len buffer length
2143	*
2144	* Returns:
2145	* 0 success
2146	* >0 f/w reported error - f/w status code
2147	* <0 driver reported error
2148	* -ETIMEDOUT timeout waiting for the cmd regs to become
2149	* available, or waiting for the control reg
2150	* to indicate the Aux port is enabled.
2151	* -ENODATA the buffer does NOT contain a valid PDA.
2152	* Either the card PDA is bad, or the auxdata
2153	* reads are giving us garbage.
2154	*
2155	*
2156	* Side effects:
2157	*
2158	* Call context:
2159	* process or non-card interrupt.
2160	*----------------------------------------------------------------
2161	*/
2162	int hfa384x_drvr_readpda(struct hfa384x *hw, void *buf, unsigned int len)
2163	{
2164	int result = 0;
2165	__le16 *pda = buf;
2166	int pdaok = 0;
2167	int morepdrs = 1;
2168	int currpdr = 0; /* word offset of the current pdr */
2169	size_t i;
2170	u16 pdrlen; /* pdr length in bytes, host order */
2171	u16 pdrcode; /* pdr code, host order */
2172	u16 currpage;
2173	u16 curroffset;
2174	struct pdaloc {
2175	u32 cardaddr;
2176	u16 auxctl;
2177	} pdaloc[] = {
2178	{
2179	HFA3842_PDA_BASE, 0}, {
2180	HFA3841_PDA_BASE, 0}, {
2181	HFA3841_PDA_BOGUS_BASE, 0}
2182	};
2183
2184	/* Read the pda from each known address. */
2185	for (i = 0; i < ARRAY_SIZE(pdaloc); i++) {
2186	/* Make address */
2187	currpage = HFA384x_ADDR_CMD_MKPAGE(pdaloc[i].cardaddr);
2188	curroffset = HFA384x_ADDR_CMD_MKOFF(pdaloc[i].cardaddr);
2189
2190	/* units of bytes */
2191	result = hfa384x_dormem(hw, page: currpage, offset: curroffset, data: buf,
2192	len);
2193
2194	if (result) {
2195	netdev_warn(dev: hw->wlandev->netdev,
2196	format: "Read from index %zd failed, continuing\n",
2197	i);
2198	continue;
2199	}
2200
2201	/* Test for garbage */
2202	pdaok = 1; /* initially assume good */
2203	morepdrs = 1;
2204	while (pdaok && morepdrs) {
2205	pdrlen = le16_to_cpu(pda[currpdr]) * 2;
2206	pdrcode = le16_to_cpu(pda[currpdr + 1]);
2207	/* Test the record length */
2208	if (pdrlen > HFA384x_PDR_LEN_MAX || pdrlen == 0) {
2209	netdev_err(dev: hw->wlandev->netdev,
2210	format: "pdrlen invalid=%d\n", pdrlen);
2211	pdaok = 0;
2212	break;
2213	}
2214	/* Test the code */
2215	if (!hfa384x_isgood_pdrcode(pdrcode)) {
2216	netdev_err(dev: hw->wlandev->netdev, format: "pdrcode invalid=%d\n",
2217	pdrcode);
2218	pdaok = 0;
2219	break;
2220	}
2221	/* Test for completion */
2222	if (pdrcode == HFA384x_PDR_END_OF_PDA)
2223	morepdrs = 0;
2224
2225	/* Move to the next pdr (if necessary) */
2226	if (morepdrs) {
2227	/* note the access to pda[], need words here */
2228	currpdr += le16_to_cpu(pda[currpdr]) + 1;
2229	}
2230	}
2231	if (pdaok) {
2232	netdev_info(dev: hw->wlandev->netdev,
2233	format: "PDA Read from 0x%08x in %s space.\n",
2234	pdaloc[i].cardaddr,
2235	pdaloc[i].auxctl == 0 ? "EXTDS" :
2236	pdaloc[i].auxctl == 1 ? "NV" :
2237	pdaloc[i].auxctl == 2 ? "PHY" :
2238	pdaloc[i].auxctl == 3 ? "ICSRAM" :
2239	"<bogus auxctl>");
2240	break;
2241	}
2242	}
2243	result = pdaok ? 0 : -ENODATA;
2244
2245	if (result)
2246	pr_debug("Failure: pda is not okay\n");
2247
2248	return result;
2249	}
2250
2251	/*----------------------------------------------------------------
2252	* hfa384x_drvr_setconfig
2253	*
2254	* Performs the sequence necessary to write a config/info item.
2255	*
2256	* Arguments:
2257	* hw device structure
2258	* rid config/info record id (in host order)
2259	* buf host side record buffer
2260	* len buffer length (in bytes)
2261	*
2262	* Returns:
2263	* 0 success
2264	* >0 f/w reported error - f/w status code
2265	* <0 driver reported error
2266	*
2267	* Side effects:
2268	*
2269	* Call context:
2270	* process
2271	*----------------------------------------------------------------
2272	*/
2273	int hfa384x_drvr_setconfig(struct hfa384x *hw, u16 rid, void *buf, u16 len)
2274	{
2275	return hfa384x_dowrid(hw, mode: DOWAIT, rid, riddata: buf, riddatalen: len, NULL, NULL, NULL);
2276	}
2277
2278	/*----------------------------------------------------------------
2279	* hfa384x_drvr_start
2280	*
2281	* Issues the MAC initialize command, sets up some data structures,
2282	* and enables the interrupts. After this function completes, the
2283	* low-level stuff should be ready for any/all commands.
2284	*
2285	* Arguments:
2286	* hw device structure
2287	* Returns:
2288	* 0 success
2289	* >0 f/w reported error - f/w status code
2290	* <0 driver reported error
2291	*
2292	* Side effects:
2293	*
2294	* Call context:
2295	* process
2296	*----------------------------------------------------------------
2297	*/
2298	int hfa384x_drvr_start(struct hfa384x *hw)
2299	{
2300	int result, result1, result2;
2301	u16 status;
2302
2303	might_sleep();
2304
2305	/* Clear endpoint stalls - but only do this if the endpoint
2306	* is showing a stall status. Some prism2 cards seem to behave
2307	* badly if a clear_halt is called when the endpoint is already
2308	* ok
2309	*/
2310	result =
2311	usb_get_std_status(dev: hw->usb, USB_RECIP_ENDPOINT, target: hw->endp_in,
2312	data: &status);
2313	if (result < 0) {
2314	netdev_err(dev: hw->wlandev->netdev, format: "Cannot get bulk in endpoint status.\n");
2315	goto done;
2316	}
2317	if ((status == 1) && usb_clear_halt(dev: hw->usb, pipe: hw->endp_in))
2318	netdev_err(dev: hw->wlandev->netdev, format: "Failed to reset bulk in endpoint.\n");
2319
2320	result =
2321	usb_get_std_status(dev: hw->usb, USB_RECIP_ENDPOINT, target: hw->endp_out,
2322	data: &status);
2323	if (result < 0) {
2324	netdev_err(dev: hw->wlandev->netdev, format: "Cannot get bulk out endpoint status.\n");
2325	goto done;
2326	}
2327	if ((status == 1) && usb_clear_halt(dev: hw->usb, pipe: hw->endp_out))
2328	netdev_err(dev: hw->wlandev->netdev, format: "Failed to reset bulk out endpoint.\n");
2329
2330	/* Synchronous unlink, in case we're trying to restart the driver */
2331	usb_kill_urb(urb: &hw->rx_urb);
2332
2333	/* Post the IN urb */
2334	result = submit_rx_urb(hw, GFP_KERNEL);
2335	if (result != 0) {
2336	netdev_err(dev: hw->wlandev->netdev,
2337	format: "Fatal, failed to submit RX URB, result=%d\n",
2338	result);
2339	goto done;
2340	}
2341
2342	/* Call initialize twice, with a 1 second sleep in between.
2343	* This is a nasty work-around since many prism2 cards seem to
2344	* need time to settle after an init from cold. The second
2345	* call to initialize in theory is not necessary - but we call
2346	* it anyway as a double insurance policy:
2347	* 1) If the first init should fail, the second may well succeed
2348	* and the card can still be used
2349	* 2) It helps ensures all is well with the card after the first
2350	* init and settle time.
2351	*/
2352	result1 = hfa384x_cmd_initialize(hw);
2353	msleep(msecs: 1000);
2354	result = hfa384x_cmd_initialize(hw);
2355	result2 = result;
2356	if (result1 != 0) {
2357	if (result2 != 0) {
2358	netdev_err(dev: hw->wlandev->netdev,
2359	format: "cmd_initialize() failed on two attempts, results %d and %d\n",
2360	result1, result2);
2361	usb_kill_urb(urb: &hw->rx_urb);
2362	goto done;
2363	} else {
2364	pr_debug("First cmd_initialize() failed (result %d),\n",
2365	result1);
2366	pr_debug("but second attempt succeeded. All should be ok\n");
2367	}
2368	} else if (result2 != 0) {
2369	netdev_warn(dev: hw->wlandev->netdev, format: "First cmd_initialize() succeeded, but second attempt failed (result=%d)\n",
2370	result2);
2371	netdev_warn(dev: hw->wlandev->netdev,
2372	format: "Most likely the card will be functional\n");
2373	goto done;
2374	}
2375
2376	hw->state = HFA384x_STATE_RUNNING;
2377
2378	done:
2379	return result;
2380	}
2381
2382	/*----------------------------------------------------------------
2383	* hfa384x_drvr_stop
2384	*
2385	* Shuts down the MAC to the point where it is safe to unload the
2386	* driver. Any subsystem that may be holding a data or function
2387	* ptr into the driver must be cleared/deinitialized.
2388	*
2389	* Arguments:
2390	* hw device structure
2391	* Returns:
2392	* 0 success
2393	* >0 f/w reported error - f/w status code
2394	* <0 driver reported error
2395	*
2396	* Side effects:
2397	*
2398	* Call context:
2399	* process
2400	*----------------------------------------------------------------
2401	*/
2402	int hfa384x_drvr_stop(struct hfa384x *hw)
2403	{
2404	int i;
2405
2406	might_sleep();
2407
2408	/* There's no need for spinlocks here. The USB "disconnect"
2409	* function sets this "removed" flag and then calls us.
2410	*/
2411	if (!hw->wlandev->hwremoved) {
2412	/* Call initialize to leave the MAC in its 'reset' state */
2413	hfa384x_cmd_initialize(hw);
2414
2415	/* Cancel the rxurb */
2416	usb_kill_urb(urb: &hw->rx_urb);
2417	}
2418
2419	hw->link_status = HFA384x_LINK_NOTCONNECTED;
2420	hw->state = HFA384x_STATE_INIT;
2421
2422	del_timer_sync(timer: &hw->commsqual_timer);
2423
2424	/* Clear all the port status */
2425	for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
2426	hw->port_enabled[i] = 0;
2427
2428	return 0;
2429	}
2430
2431	/*----------------------------------------------------------------
2432	* hfa384x_drvr_txframe
2433	*
2434	* Takes a frame from prism2sta and queues it for transmission.
2435	*
2436	* Arguments:
2437	* hw device structure
2438	* skb packet buffer struct. Contains an 802.11
2439	* data frame.
2440	* p80211_hdr points to the 802.11 header for the packet.
2441	* Returns:
2442	* 0 Success and more buffs available
2443	* 1 Success but no more buffs
2444	* 2 Allocation failure
2445	* 4 Buffer full or queue busy
2446	*
2447	* Side effects:
2448	*
2449	* Call context:
2450	* interrupt
2451	*----------------------------------------------------------------
2452	*/
2453	int hfa384x_drvr_txframe(struct hfa384x *hw, struct sk_buff *skb,
2454	struct p80211_hdr *p80211_hdr,
2455	struct p80211_metawep *p80211_wep)
2456	{
2457	int usbpktlen = sizeof(struct hfa384x_tx_frame);
2458	int result;
2459	int ret;
2460	char *ptr;
2461
2462	if (hw->tx_urb.status == -EINPROGRESS) {
2463	netdev_warn(dev: hw->wlandev->netdev, format: "TX URB already in use\n");
2464	result = 3;
2465	goto exit;
2466	}
2467
2468	/* Build Tx frame structure */
2469	/* Set up the control field */
2470	memset(&hw->txbuff.txfrm.desc, 0, sizeof(hw->txbuff.txfrm.desc));
2471
2472	/* Setup the usb type field */
2473	hw->txbuff.type = cpu_to_le16(HFA384x_USB_TXFRM);
2474
2475	/* Set up the sw_support field to identify this frame */
2476	hw->txbuff.txfrm.desc.sw_support = 0x0123;
2477
2478	/* Tx complete and Tx exception disable per dleach. Might be causing
2479	* buf depletion
2480	*/
2481	/* #define DOEXC SLP -- doboth breaks horribly under load, doexc less so. */
2482	#if defined(DOBOTH)
2483	hw->txbuff.txfrm.desc.tx_control =
2484	HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2485	HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(1);
2486	#elif defined(DOEXC)
2487	hw->txbuff.txfrm.desc.tx_control =
2488	HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2489	HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(0);
2490	#else
2491	hw->txbuff.txfrm.desc.tx_control =
2492	HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2493	HFA384x_TX_TXEX_SET(0) | HFA384x_TX_TXOK_SET(0);
2494	#endif
2495	cpu_to_le16s(&hw->txbuff.txfrm.desc.tx_control);
2496
2497	/* copy the header over to the txdesc */
2498	hw->txbuff.txfrm.desc.hdr = *p80211_hdr;
2499
2500	/* if we're using host WEP, increase size by IV+ICV */
2501	if (p80211_wep->data) {
2502	hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len + 8);
2503	usbpktlen += 8;
2504	} else {
2505	hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len);
2506	}
2507
2508	usbpktlen += skb->len;
2509
2510	/* copy over the WEP IV if we are using host WEP */
2511	ptr = hw->txbuff.txfrm.data;
2512	if (p80211_wep->data) {
2513	memcpy(ptr, p80211_wep->iv, sizeof(p80211_wep->iv));
2514	ptr += sizeof(p80211_wep->iv);
2515	memcpy(ptr, p80211_wep->data, skb->len);
2516	} else {
2517	memcpy(ptr, skb->data, skb->len);
2518	}
2519	/* copy over the packet data */
2520	ptr += skb->len;
2521
2522	/* copy over the WEP ICV if we are using host WEP */
2523	if (p80211_wep->data)
2524	memcpy(ptr, p80211_wep->icv, sizeof(p80211_wep->icv));
2525
2526	/* Send the USB packet */
2527	usb_fill_bulk_urb(urb: &hw->tx_urb, dev: hw->usb,
2528	pipe: hw->endp_out,
2529	transfer_buffer: &hw->txbuff, ROUNDUP64(usbpktlen),
2530	complete_fn: hfa384x_usbout_callback, context: hw->wlandev);
2531	hw->tx_urb.transfer_flags |= USB_QUEUE_BULK;
2532
2533	result = 1;
2534	ret = submit_tx_urb(hw, tx_urb: &hw->tx_urb, GFP_ATOMIC);
2535	if (ret != 0) {
2536	netdev_err(dev: hw->wlandev->netdev,
2537	format: "submit_tx_urb() failed, error=%d\n", ret);
2538	result = 3;
2539	}
2540
2541	exit:
2542	return result;
2543	}
2544
2545	void hfa384x_tx_timeout(struct wlandevice *wlandev)
2546	{
2547	struct hfa384x *hw = wlandev->priv;
2548	unsigned long flags;
2549
2550	spin_lock_irqsave(&hw->ctlxq.lock, flags);
2551
2552	if (!hw->wlandev->hwremoved) {
2553	int sched;
2554
2555	sched = !test_and_set_bit(WORK_TX_HALT, addr: &hw->usb_flags);
2556	sched |= !test_and_set_bit(WORK_RX_HALT, addr: &hw->usb_flags);
2557	if (sched)
2558	schedule_work(work: &hw->usb_work);
2559	}
2560
2561	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
2562	}
2563
2564	/*----------------------------------------------------------------
2565	* hfa384x_usbctlx_reaper_task
2566	*
2567	* Deferred work callback to delete dead CTLX objects
2568	*
2569	* Arguments:
2570	* work contains ptr to a struct hfa384x
2571	*
2572	* Returns:
2573	*
2574	* Call context:
2575	* Task
2576	*----------------------------------------------------------------
2577	*/
2578	static void hfa384x_usbctlx_reaper_task(struct work_struct *work)
2579	{
2580	struct hfa384x *hw = container_of(work, struct hfa384x, reaper_bh);
2581	struct hfa384x_usbctlx *ctlx, *temp;
2582	unsigned long flags;
2583
2584	spin_lock_irqsave(&hw->ctlxq.lock, flags);
2585
2586	/* This list is guaranteed to be empty if someone
2587	* has unplugged the adapter.
2588	*/
2589	list_for_each_entry_safe(ctlx, temp, &hw->ctlxq.reapable, list) {
2590	list_del(entry: &ctlx->list);
2591	kfree(objp: ctlx);
2592	}
2593
2594	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
2595	}
2596
2597	/*----------------------------------------------------------------
2598	* hfa384x_usbctlx_completion_task
2599	*
2600	* Deferred work callback to call completion handlers for returned CTLXs
2601	*
2602	* Arguments:
2603	* work contains ptr to a struct hfa384x
2604	*
2605	* Returns:
2606	* Nothing
2607	*
2608	* Call context:
2609	* Task
2610	*----------------------------------------------------------------
2611	*/
2612	static void hfa384x_usbctlx_completion_task(struct work_struct *work)
2613	{
2614	struct hfa384x *hw = container_of(work, struct hfa384x, completion_bh);
2615	struct hfa384x_usbctlx *ctlx, *temp;
2616	unsigned long flags;
2617
2618	int reap = 0;
2619
2620	spin_lock_irqsave(&hw->ctlxq.lock, flags);
2621
2622	/* This list is guaranteed to be empty if someone
2623	* has unplugged the adapter ...
2624	*/
2625	list_for_each_entry_safe(ctlx, temp, &hw->ctlxq.completing, list) {
2626	/* Call the completion function that this
2627	* command was assigned, assuming it has one.
2628	*/
2629	if (ctlx->cmdcb) {
2630	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
2631	ctlx->cmdcb(hw, ctlx);
2632	spin_lock_irqsave(&hw->ctlxq.lock, flags);
2633
2634	/* Make sure we don't try and complete
2635	* this CTLX more than once!
2636	*/
2637	ctlx->cmdcb = NULL;
2638
2639	/* Did someone yank the adapter out
2640	* while our list was (briefly) unlocked?
2641	*/
2642	if (hw->wlandev->hwremoved) {
2643	reap = 0;
2644	break;
2645	}
2646	}
2647
2648	/*
2649	* "Reapable" CTLXs are ones which don't have any
2650	* threads waiting for them to die. Hence they must
2651	* be delivered to The Reaper!
2652	*/
2653	if (ctlx->reapable) {
2654	/* Move the CTLX off the "completing" list (hopefully)
2655	* on to the "reapable" list where the reaper task
2656	* can find it. And "reapable" means that this CTLX
2657	* isn't sitting on a wait-queue somewhere.
2658	*/
2659	list_move_tail(list: &ctlx->list, head: &hw->ctlxq.reapable);
2660	reap = 1;
2661	}
2662
2663	complete(&ctlx->done);
2664	}
2665	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
2666
2667	if (reap)
2668	schedule_work(work: &hw->reaper_bh);
2669	}
2670
2671	/*----------------------------------------------------------------
2672	* unlocked_usbctlx_cancel_async
2673	*
2674	* Mark the CTLX dead asynchronously, and ensure that the
2675	* next command on the queue is run afterwards.
2676	*
2677	* Arguments:
2678	* hw ptr to the struct hfa384x structure
2679	* ctlx ptr to a CTLX structure
2680	*
2681	* Returns:
2682	* 0 the CTLX's URB is inactive
2683	* -EINPROGRESS the URB is currently being unlinked
2684	*
2685	* Call context:
2686	* Either process or interrupt, but presumably interrupt
2687	*----------------------------------------------------------------
2688	*/
2689	static int unlocked_usbctlx_cancel_async(struct hfa384x *hw,
2690	struct hfa384x_usbctlx *ctlx)
2691	{
2692	int ret;
2693
2694	/*
2695	* Try to delete the URB containing our request packet.
2696	* If we succeed, then its completion handler will be
2697	* called with a status of -ECONNRESET.
2698	*/
2699	hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
2700	ret = usb_unlink_urb(urb: &hw->ctlx_urb);
2701
2702	if (ret != -EINPROGRESS) {
2703	/*
2704	* The OUT URB had either already completed
2705	* or was still in the pending queue, so the
2706	* URB's completion function will not be called.
2707	* We will have to complete the CTLX ourselves.
2708	*/
2709	ctlx->state = CTLX_REQ_FAILED;
2710	unlocked_usbctlx_complete(hw, ctlx);
2711	ret = 0;
2712	}
2713
2714	return ret;
2715	}
2716
2717	/*----------------------------------------------------------------
2718	* unlocked_usbctlx_complete
2719	*
2720	* A CTLX has completed. It may have been successful, it may not
2721	* have been. At this point, the CTLX should be quiescent. The URBs
2722	* aren't active and the timers should have been stopped.
2723	*
2724	* The CTLX is migrated to the "completing" queue, and the completing
2725	* work is scheduled.
2726	*
2727	* Arguments:
2728	* hw ptr to a struct hfa384x structure
2729	* ctlx ptr to a ctlx structure
2730	*
2731	* Returns:
2732	* nothing
2733	*
2734	* Side effects:
2735	*
2736	* Call context:
2737	* Either, assume interrupt
2738	*----------------------------------------------------------------
2739	*/
2740	static void unlocked_usbctlx_complete(struct hfa384x *hw,
2741	struct hfa384x_usbctlx *ctlx)
2742	{
2743	/* Timers have been stopped, and ctlx should be in
2744	* a terminal state. Retire it from the "active"
2745	* queue.
2746	*/
2747	list_move_tail(list: &ctlx->list, head: &hw->ctlxq.completing);
2748	schedule_work(work: &hw->completion_bh);
2749
2750	switch (ctlx->state) {
2751	case CTLX_COMPLETE:
2752	case CTLX_REQ_FAILED:
2753	/* This are the correct terminating states. */
2754	break;
2755
2756	default:
2757	netdev_err(dev: hw->wlandev->netdev, format: "CTLX[%d] not in a terminating state(%s)\n",
2758	le16_to_cpu(ctlx->outbuf.type),
2759	ctlxstr(s: ctlx->state));
2760	break;
2761	} /* switch */
2762	}
2763
2764	/*----------------------------------------------------------------
2765	* hfa384x_usbctlxq_run
2766	*
2767	* Checks to see if the head item is running. If not, starts it.
2768	*
2769	* Arguments:
2770	* hw ptr to struct hfa384x
2771	*
2772	* Returns:
2773	* nothing
2774	*
2775	* Side effects:
2776	*
2777	* Call context:
2778	* any
2779	*----------------------------------------------------------------
2780	*/
2781	static void hfa384x_usbctlxq_run(struct hfa384x *hw)
2782	{
2783	unsigned long flags;
2784
2785	/* acquire lock */
2786	spin_lock_irqsave(&hw->ctlxq.lock, flags);
2787
2788	/* Only one active CTLX at any one time, because there's no
2789	* other (reliable) way to match the response URB to the
2790	* correct CTLX.
2791	*
2792	* Don't touch any of these CTLXs if the hardware
2793	* has been removed or the USB subsystem is stalled.
2794	*/
2795	if (!list_empty(head: &hw->ctlxq.active) ||
2796	test_bit(WORK_TX_HALT, &hw->usb_flags) || hw->wlandev->hwremoved)
2797	goto unlock;
2798
2799	while (!list_empty(head: &hw->ctlxq.pending)) {
2800	struct hfa384x_usbctlx *head;
2801	int result;
2802
2803	/* This is the first pending command */
2804	head = list_entry(hw->ctlxq.pending.next,
2805	struct hfa384x_usbctlx, list);
2806
2807	/* We need to split this off to avoid a race condition */
2808	list_move_tail(list: &head->list, head: &hw->ctlxq.active);
2809
2810	/* Fill the out packet */
2811	usb_fill_bulk_urb(urb: &hw->ctlx_urb, dev: hw->usb,
2812	pipe: hw->endp_out,
2813	transfer_buffer: &head->outbuf, ROUNDUP64(head->outbufsize),
2814	complete_fn: hfa384x_ctlxout_callback, context: hw);
2815	hw->ctlx_urb.transfer_flags |= USB_QUEUE_BULK;
2816
2817	/* Now submit the URB and update the CTLX's state */
2818	result = usb_submit_urb(urb: &hw->ctlx_urb, GFP_ATOMIC);
2819	if (result == 0) {
2820	/* This CTLX is now running on the active queue */
2821	head->state = CTLX_REQ_SUBMITTED;
2822
2823	/* Start the OUT wait timer */
2824	hw->req_timer_done = 0;
2825	hw->reqtimer.expires = jiffies + HZ;
2826	add_timer(timer: &hw->reqtimer);
2827
2828	/* Start the IN wait timer */
2829	hw->resp_timer_done = 0;
2830	hw->resptimer.expires = jiffies + 2 * HZ;
2831	add_timer(timer: &hw->resptimer);
2832
2833	break;
2834	}
2835
2836	if (result == -EPIPE) {
2837	/* The OUT pipe needs resetting, so put
2838	* this CTLX back in the "pending" queue
2839	* and schedule a reset ...
2840	*/
2841	netdev_warn(dev: hw->wlandev->netdev,
2842	format: "%s tx pipe stalled: requesting reset\n",
2843	hw->wlandev->netdev->name);
2844	list_move(list: &head->list, head: &hw->ctlxq.pending);
2845	set_bit(WORK_TX_HALT, addr: &hw->usb_flags);
2846	schedule_work(work: &hw->usb_work);
2847	break;
2848	}
2849
2850	if (result == -ESHUTDOWN) {
2851	netdev_warn(dev: hw->wlandev->netdev, format: "%s urb shutdown!\n",
2852	hw->wlandev->netdev->name);
2853	break;
2854	}
2855
2856	netdev_err(dev: hw->wlandev->netdev, format: "Failed to submit CTLX[%d]: error=%d\n",
2857	le16_to_cpu(head->outbuf.type), result);
2858	unlocked_usbctlx_complete(hw, ctlx: head);
2859	} /* while */
2860
2861	unlock:
2862	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
2863	}
2864
2865	/*----------------------------------------------------------------
2866	* hfa384x_usbin_callback
2867	*
2868	* Callback for URBs on the BULKIN endpoint.
2869	*
2870	* Arguments:
2871	* urb ptr to the completed urb
2872	*
2873	* Returns:
2874	* nothing
2875	*
2876	* Side effects:
2877	*
2878	* Call context:
2879	* interrupt
2880	*----------------------------------------------------------------
2881	*/
2882	static void hfa384x_usbin_callback(struct urb *urb)
2883	{
2884	struct wlandevice *wlandev = urb->context;
2885	struct hfa384x *hw;
2886	union hfa384x_usbin *usbin;
2887	struct sk_buff *skb = NULL;
2888	int result;
2889	int urb_status;
2890	u16 type;
2891
2892	enum USBIN_ACTION {
2893	HANDLE,
2894	RESUBMIT,
2895	ABORT
2896	} action;
2897
2898	if (!wlandev || !wlandev->netdev || wlandev->hwremoved)
2899	goto exit;
2900
2901	hw = wlandev->priv;
2902	if (!hw)
2903	goto exit;
2904
2905	skb = hw->rx_urb_skb;
2906	if (!skb || (skb->data != urb->transfer_buffer)) {
2907	WARN_ON(1);
2908	return;
2909	}
2910
2911	hw->rx_urb_skb = NULL;
2912
2913	/* Check for error conditions within the URB */
2914	switch (urb->status) {
2915	case 0:
2916	action = HANDLE;
2917
2918	/* Check for short packet */
2919	if (urb->actual_length == 0) {
2920	wlandev->netdev->stats.rx_errors++;
2921	wlandev->netdev->stats.rx_length_errors++;
2922	action = RESUBMIT;
2923	}
2924	break;
2925
2926	case -EPIPE:
2927	netdev_warn(dev: hw->wlandev->netdev, format: "%s rx pipe stalled: requesting reset\n",
2928	wlandev->netdev->name);
2929	if (!test_and_set_bit(WORK_RX_HALT, addr: &hw->usb_flags))
2930	schedule_work(work: &hw->usb_work);
2931	wlandev->netdev->stats.rx_errors++;
2932	action = ABORT;
2933	break;
2934
2935	case -EILSEQ:
2936	case -ETIMEDOUT:
2937	case -EPROTO:
2938	if (!test_and_set_bit(THROTTLE_RX, addr: &hw->usb_flags) &&
2939	!timer_pending(timer: &hw->throttle)) {
2940	mod_timer(timer: &hw->throttle, expires: jiffies + THROTTLE_JIFFIES);
2941	}
2942	wlandev->netdev->stats.rx_errors++;
2943	action = ABORT;
2944	break;
2945
2946	case -EOVERFLOW:
2947	wlandev->netdev->stats.rx_over_errors++;
2948	action = RESUBMIT;
2949	break;
2950
2951	case -ENODEV:
2952	case -ESHUTDOWN:
2953	pr_debug("status=%d, device removed.\n", urb->status);
2954	action = ABORT;
2955	break;
2956
2957	case -ENOENT:
2958	case -ECONNRESET:
2959	pr_debug("status=%d, urb explicitly unlinked.\n", urb->status);
2960	action = ABORT;
2961	break;
2962
2963	default:
2964	pr_debug("urb status=%d, transfer flags=0x%x\n",
2965	urb->status, urb->transfer_flags);
2966	wlandev->netdev->stats.rx_errors++;
2967	action = RESUBMIT;
2968	break;
2969	}
2970
2971	/* Save values from the RX URB before reposting overwrites it. */
2972	urb_status = urb->status;
2973	usbin = (union hfa384x_usbin *)urb->transfer_buffer;
2974
2975	if (action != ABORT) {
2976	/* Repost the RX URB */
2977	result = submit_rx_urb(hw, GFP_ATOMIC);
2978
2979	if (result != 0) {
2980	netdev_err(dev: hw->wlandev->netdev,
2981	format: "Fatal, failed to resubmit rx_urb. error=%d\n",
2982	result);
2983	}
2984	}
2985
2986	/* Handle any USB-IN packet */
2987	/* Note: the check of the sw_support field, the type field doesn't
2988	* have bit 12 set like the docs suggest.
2989	*/
2990	type = le16_to_cpu(usbin->type);
2991	if (HFA384x_USB_ISRXFRM(type)) {
2992	if (action == HANDLE) {
2993	if (usbin->txfrm.desc.sw_support == 0x0123) {
2994	hfa384x_usbin_txcompl(wlandev, usbin);
2995	} else {
2996	skb_put(skb, len: sizeof(*usbin));
2997	hfa384x_usbin_rx(wlandev, skb);
2998	skb = NULL;
2999	}
3000	}
3001	goto exit;
3002	}
3003	if (HFA384x_USB_ISTXFRM(type)) {
3004	if (action == HANDLE)
3005	hfa384x_usbin_txcompl(wlandev, usbin);
3006	goto exit;
3007	}
3008	switch (type) {
3009	case HFA384x_USB_INFOFRM:
3010	if (action == ABORT)
3011	goto exit;
3012	if (action == HANDLE)
3013	hfa384x_usbin_info(wlandev, usbin);
3014	break;
3015
3016	case HFA384x_USB_CMDRESP:
3017	case HFA384x_USB_WRIDRESP:
3018	case HFA384x_USB_RRIDRESP:
3019	case HFA384x_USB_WMEMRESP:
3020	case HFA384x_USB_RMEMRESP:
3021	/* ALWAYS, ALWAYS, ALWAYS handle this CTLX!!!! */
3022	hfa384x_usbin_ctlx(hw, usbin, urb_status);
3023	break;
3024
3025	case HFA384x_USB_BUFAVAIL:
3026	pr_debug("Received BUFAVAIL packet, frmlen=%d\n",
3027	usbin->bufavail.frmlen);
3028	break;
3029
3030	case HFA384x_USB_ERROR:
3031	pr_debug("Received USB_ERROR packet, errortype=%d\n",
3032	usbin->usberror.errortype);
3033	break;
3034
3035	default:
3036	pr_debug("Unrecognized USBIN packet, type=%x, status=%d\n",
3037	usbin->type, urb_status);
3038	break;
3039	} /* switch */
3040
3041	exit:
3042
3043	if (skb)
3044	dev_kfree_skb(skb);
3045	}
3046
3047	/*----------------------------------------------------------------
3048	* hfa384x_usbin_ctlx
3049	*
3050	* We've received a URB containing a Prism2 "response" message.
3051	* This message needs to be matched up with a CTLX on the active
3052	* queue and our state updated accordingly.
3053	*
3054	* Arguments:
3055	* hw ptr to struct hfa384x
3056	* usbin ptr to USB IN packet
3057	* urb_status status of this Bulk-In URB
3058	*
3059	* Returns:
3060	* nothing
3061	*
3062	* Side effects:
3063	*
3064	* Call context:
3065	* interrupt
3066	*----------------------------------------------------------------
3067	*/
3068	static void hfa384x_usbin_ctlx(struct hfa384x *hw, union hfa384x_usbin *usbin,
3069	int urb_status)
3070	{
3071	struct hfa384x_usbctlx *ctlx;
3072	int run_queue = 0;
3073	unsigned long flags;
3074
3075	retry:
3076	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3077
3078	/* There can be only one CTLX on the active queue
3079	* at any one time, and this is the CTLX that the
3080	* timers are waiting for.
3081	*/
3082	if (list_empty(head: &hw->ctlxq.active))
3083	goto unlock;
3084
3085	/* Remove the "response timeout". It's possible that
3086	* we are already too late, and that the timeout is
3087	* already running. And that's just too bad for us,
3088	* because we could lose our CTLX from the active
3089	* queue here ...
3090	*/
3091	if (del_timer(timer: &hw->resptimer) == 0) {
3092	if (hw->resp_timer_done == 0) {
3093	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
3094	goto retry;
3095	}
3096	} else {
3097	hw->resp_timer_done = 1;
3098	}
3099
3100	ctlx = get_active_ctlx(hw);
3101
3102	if (urb_status != 0) {
3103	/*
3104	* Bad CTLX, so get rid of it. But we only
3105	* remove it from the active queue if we're no
3106	* longer expecting the OUT URB to complete.
3107	*/
3108	if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3109	run_queue = 1;
3110	} else {
3111	const __le16 intype = (usbin->type & ~cpu_to_le16(0x8000));
3112
3113	/*
3114	* Check that our message is what we're expecting ...
3115	*/
3116	if (ctlx->outbuf.type != intype) {
3117	netdev_warn(dev: hw->wlandev->netdev,
3118	format: "Expected IN[%d], received IN[%d] - ignored.\n",
3119	le16_to_cpu(ctlx->outbuf.type),
3120	le16_to_cpu(intype));
3121	goto unlock;
3122	}
3123
3124	/* This URB has succeeded, so grab the data ... */
3125	memcpy(&ctlx->inbuf, usbin, sizeof(ctlx->inbuf));
3126
3127	switch (ctlx->state) {
3128	case CTLX_REQ_SUBMITTED:
3129	/*
3130	* We have received our response URB before
3131	* our request has been acknowledged. Odd,
3132	* but our OUT URB is still alive...
3133	*/
3134	pr_debug("Causality violation: please reboot Universe\n");
3135	ctlx->state = CTLX_RESP_COMPLETE;
3136	break;
3137
3138	case CTLX_REQ_COMPLETE:
3139	/*
3140	* This is the usual path: our request
3141	* has already been acknowledged, and
3142	* now we have received the reply too.
3143	*/
3144	ctlx->state = CTLX_COMPLETE;
3145	unlocked_usbctlx_complete(hw, ctlx);
3146	run_queue = 1;
3147	break;
3148
3149	default:
3150	/*
3151	* Throw this CTLX away ...
3152	*/
3153	netdev_err(dev: hw->wlandev->netdev,
3154	format: "Matched IN URB, CTLX[%d] in invalid state(%s). Discarded.\n",
3155	le16_to_cpu(ctlx->outbuf.type),
3156	ctlxstr(s: ctlx->state));
3157	if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3158	run_queue = 1;
3159	break;
3160	} /* switch */
3161	}
3162
3163	unlock:
3164	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
3165
3166	if (run_queue)
3167	hfa384x_usbctlxq_run(hw);
3168	}
3169
3170	/*----------------------------------------------------------------
3171	* hfa384x_usbin_txcompl
3172	*
3173	* At this point we have the results of a previous transmit.
3174	*
3175	* Arguments:
3176	* wlandev wlan device
3177	* usbin ptr to the usb transfer buffer
3178	*
3179	* Returns:
3180	* nothing
3181	*
3182	* Side effects:
3183	*
3184	* Call context:
3185	* interrupt
3186	*----------------------------------------------------------------
3187	*/
3188	static void hfa384x_usbin_txcompl(struct wlandevice *wlandev,
3189	union hfa384x_usbin *usbin)
3190	{
3191	u16 status;
3192
3193	status = le16_to_cpu(usbin->type); /* yeah I know it says type... */
3194
3195	/* Was there an error? */
3196	if (HFA384x_TXSTATUS_ISERROR(status))
3197	netdev_dbg(wlandev->netdev, "TxExc status=0x%x.\n", status);
3198	else
3199	prism2sta_ev_tx(wlandev, status);
3200	}
3201
3202	/*----------------------------------------------------------------
3203	* hfa384x_usbin_rx
3204	*
3205	* At this point we have a successful received a rx frame packet.
3206	*
3207	* Arguments:
3208	* wlandev wlan device
3209	* usbin ptr to the usb transfer buffer
3210	*
3211	* Returns:
3212	* nothing
3213	*
3214	* Side effects:
3215	*
3216	* Call context:
3217	* interrupt
3218	*----------------------------------------------------------------
3219	*/
3220	static void hfa384x_usbin_rx(struct wlandevice *wlandev, struct sk_buff *skb)
3221	{
3222	union hfa384x_usbin *usbin = (union hfa384x_usbin *)skb->data;
3223	struct hfa384x *hw = wlandev->priv;
3224	int hdrlen;
3225	struct p80211_rxmeta *rxmeta;
3226	u16 data_len;
3227	u16 fc;
3228	u16 status;
3229
3230	/* Byte order convert once up front. */
3231	le16_to_cpus(&usbin->rxfrm.desc.status);
3232	le32_to_cpus(&usbin->rxfrm.desc.time);
3233
3234	/* Now handle frame based on port# */
3235	status = HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status);
3236
3237	switch (status) {
3238	case 0:
3239	fc = le16_to_cpu(usbin->rxfrm.desc.hdr.frame_control);
3240
3241	/* If exclude and we receive an unencrypted, drop it */
3242	if ((wlandev->hostwep & HOSTWEP_EXCLUDEUNENCRYPTED) &&
3243	!WLAN_GET_FC_ISWEP(fc)) {
3244	break;
3245	}
3246
3247	data_len = le16_to_cpu(usbin->rxfrm.desc.data_len);
3248
3249	/* How much header data do we have? */
3250	hdrlen = p80211_headerlen(fctl: fc);
3251
3252	/* Pull off the descriptor */
3253	skb_pull(skb, len: sizeof(struct hfa384x_rx_frame));
3254
3255	/* Now shunt the header block up against the data block
3256	* with an "overlapping" copy
3257	*/
3258	memmove(skb_push(skb, hdrlen),
3259	&usbin->rxfrm.desc.hdr, hdrlen);
3260
3261	skb->dev = wlandev->netdev;
3262
3263	/* And set the frame length properly */
3264	skb_trim(skb, len: data_len + hdrlen);
3265
3266	/* The prism2 series does not return the CRC */
3267	memset(skb_put(skb, WLAN_CRC_LEN), 0xff, WLAN_CRC_LEN);
3268
3269	skb_reset_mac_header(skb);
3270
3271	/* Attach the rxmeta, set some stuff */
3272	p80211skb_rxmeta_attach(wlandev, skb);
3273	rxmeta = p80211skb_rxmeta(skb);
3274	rxmeta->mactime = usbin->rxfrm.desc.time;
3275	rxmeta->rxrate = usbin->rxfrm.desc.rate;
3276	rxmeta->signal = usbin->rxfrm.desc.signal - hw->dbmadjust;
3277	rxmeta->noise = usbin->rxfrm.desc.silence - hw->dbmadjust;
3278
3279	p80211netdev_rx(wlandev, skb);
3280
3281	break;
3282
3283	case 7:
3284	if (!HFA384x_RXSTATUS_ISFCSERR(usbin->rxfrm.desc.status)) {
3285	/* Copy to wlansnif skb */
3286	hfa384x_int_rxmonitor(wlandev, rxfrm: &usbin->rxfrm);
3287	dev_kfree_skb(skb);
3288	} else {
3289	pr_debug("Received monitor frame: FCSerr set\n");
3290	}
3291	break;
3292
3293	default:
3294	netdev_warn(dev: hw->wlandev->netdev,
3295	format: "Received frame on unsupported port=%d\n",
3296	status);
3297	break;
3298	}
3299	}
3300
3301	/*----------------------------------------------------------------
3302	* hfa384x_int_rxmonitor
3303	*
3304	* Helper function for int_rx. Handles monitor frames.
3305	* Note that this function allocates space for the FCS and sets it
3306	* to 0xffffffff. The hfa384x doesn't give us the FCS value but the
3307	* higher layers expect it. 0xffffffff is used as a flag to indicate
3308	* the FCS is bogus.
3309	*
3310	* Arguments:
3311	* wlandev wlan device structure
3312	* rxfrm rx descriptor read from card in int_rx
3313	*
3314	* Returns:
3315	* nothing
3316	*
3317	* Side effects:
3318	* Allocates an skb and passes it up via the PF_PACKET interface.
3319	* Call context:
3320	* interrupt
3321	*----------------------------------------------------------------
3322	*/
3323	static void hfa384x_int_rxmonitor(struct wlandevice *wlandev,
3324	struct hfa384x_usb_rxfrm *rxfrm)
3325	{
3326	struct hfa384x_rx_frame *rxdesc = &rxfrm->desc;
3327	unsigned int hdrlen = 0;
3328	unsigned int datalen = 0;
3329	unsigned int skblen = 0;
3330	u8 *datap;
3331	u16 fc;
3332	struct sk_buff *skb;
3333	struct hfa384x *hw = wlandev->priv;
3334
3335	/* Remember the status, time, and data_len fields are in host order */
3336	/* Figure out how big the frame is */
3337	fc = le16_to_cpu(rxdesc->hdr.frame_control);
3338	hdrlen = p80211_headerlen(fctl: fc);
3339	datalen = le16_to_cpu(rxdesc->data_len);
3340
3341	/* Allocate an ind message+framesize skb */
3342	skblen = sizeof(struct p80211_caphdr) + hdrlen + datalen + WLAN_CRC_LEN;
3343
3344	/* sanity check the length */
3345	if (skblen >
3346	(sizeof(struct p80211_caphdr) +
3347	WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {
3348	pr_debug("overlen frm: len=%zd\n",
3349	skblen - sizeof(struct p80211_caphdr));
3350
3351	return;
3352	}
3353
3354	skb = dev_alloc_skb(length: skblen);
3355	if (!skb)
3356	return;
3357
3358	/* only prepend the prism header if in the right mode */
3359	if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
3360	(hw->sniffhdr != 0)) {
3361	struct p80211_caphdr *caphdr;
3362	/* The NEW header format! */
3363	datap = skb_put(skb, len: sizeof(struct p80211_caphdr));
3364	caphdr = (struct p80211_caphdr *)datap;
3365
3366	caphdr->version = htonl(P80211CAPTURE_VERSION);
3367	caphdr->length = htonl(sizeof(struct p80211_caphdr));
3368	caphdr->mactime = __cpu_to_be64(rxdesc->time * 1000);
3369	caphdr->hosttime = __cpu_to_be64(jiffies);
3370	caphdr->phytype = htonl(4); /* dss_dot11_b */
3371	caphdr->channel = htonl(hw->sniff_channel);
3372	caphdr->datarate = htonl(rxdesc->rate);
3373	caphdr->antenna = htonl(0); /* unknown */
3374	caphdr->priority = htonl(0); /* unknown */
3375	caphdr->ssi_type = htonl(3); /* rssi_raw */
3376	caphdr->ssi_signal = htonl(rxdesc->signal);
3377	caphdr->ssi_noise = htonl(rxdesc->silence);
3378	caphdr->preamble = htonl(0); /* unknown */
3379	caphdr->encoding = htonl(1); /* cck */
3380	}
3381
3382	/* Copy the 802.11 header to the skb
3383	* (ctl frames may be less than a full header)
3384	*/
3385	skb_put_data(skb, data: &rxdesc->hdr.frame_control, len: hdrlen);
3386
3387	/* If any, copy the data from the card to the skb */
3388	if (datalen > 0) {
3389	datap = skb_put_data(skb, data: rxfrm->data, len: datalen);
3390
3391	/* check for unencrypted stuff if WEP bit set. */
3392	if (*(datap - hdrlen + 1) & 0x40) /* wep set */
3393	if ((*(datap) == 0xaa) && (*(datap + 1) == 0xaa))
3394	/* clear wep; it's the 802.2 header! */
3395	*(datap - hdrlen + 1) &= 0xbf;
3396	}
3397
3398	if (hw->sniff_fcs) {
3399	/* Set the FCS */
3400	datap = skb_put(skb, WLAN_CRC_LEN);
3401	memset(datap, 0xff, WLAN_CRC_LEN);
3402	}
3403
3404	/* pass it back up */
3405	p80211netdev_rx(wlandev, skb);
3406	}
3407
3408	/*----------------------------------------------------------------
3409	* hfa384x_usbin_info
3410	*
3411	* At this point we have a successful received a Prism2 info frame.
3412	*
3413	* Arguments:
3414	* wlandev wlan device
3415	* usbin ptr to the usb transfer buffer
3416	*
3417	* Returns:
3418	* nothing
3419	*
3420	* Side effects:
3421	*
3422	* Call context:
3423	* interrupt
3424	*----------------------------------------------------------------
3425	*/
3426	static void hfa384x_usbin_info(struct wlandevice *wlandev,
3427	union hfa384x_usbin *usbin)
3428	{
3429	le16_to_cpus(&usbin->infofrm.info.framelen);
3430	prism2sta_ev_info(wlandev, inf: &usbin->infofrm.info);
3431	}
3432
3433	/*----------------------------------------------------------------
3434	* hfa384x_usbout_callback
3435	*
3436	* Callback for URBs on the BULKOUT endpoint.
3437	*
3438	* Arguments:
3439	* urb ptr to the completed urb
3440	*
3441	* Returns:
3442	* nothing
3443	*
3444	* Side effects:
3445	*
3446	* Call context:
3447	* interrupt
3448	*----------------------------------------------------------------
3449	*/
3450	static void hfa384x_usbout_callback(struct urb *urb)
3451	{
3452	struct wlandevice *wlandev = urb->context;
3453
3454	#ifdef DEBUG_USB
3455	dbprint_urb(urb);
3456	#endif
3457
3458	if (wlandev && wlandev->netdev) {
3459	switch (urb->status) {
3460	case 0:
3461	prism2sta_ev_alloc(wlandev);
3462	break;
3463
3464	case -EPIPE: {
3465	struct hfa384x *hw = wlandev->priv;
3466
3467	netdev_warn(dev: hw->wlandev->netdev,
3468	format: "%s tx pipe stalled: requesting reset\n",
3469	wlandev->netdev->name);
3470	if (!test_and_set_bit(WORK_TX_HALT, addr: &hw->usb_flags))
3471	schedule_work(work: &hw->usb_work);
3472	wlandev->netdev->stats.tx_errors++;
3473	break;
3474	}
3475
3476	case -EPROTO:
3477	case -ETIMEDOUT:
3478	case -EILSEQ: {
3479	struct hfa384x *hw = wlandev->priv;
3480
3481	if (!test_and_set_bit(THROTTLE_TX, addr: &hw->usb_flags) &&
3482	!timer_pending(timer: &hw->throttle)) {
3483	mod_timer(timer: &hw->throttle,
3484	expires: jiffies + THROTTLE_JIFFIES);
3485	}
3486	wlandev->netdev->stats.tx_errors++;
3487	netif_stop_queue(dev: wlandev->netdev);
3488	break;
3489	}
3490
3491	case -ENOENT:
3492	case -ESHUTDOWN:
3493	/* Ignorable errors */
3494	break;
3495
3496	default:
3497	netdev_info(dev: wlandev->netdev, format: "unknown urb->status=%d\n",
3498	urb->status);
3499	wlandev->netdev->stats.tx_errors++;
3500	break;
3501	} /* switch */
3502	}
3503	}
3504
3505	/*----------------------------------------------------------------
3506	* hfa384x_ctlxout_callback
3507	*
3508	* Callback for control data on the BULKOUT endpoint.
3509	*
3510	* Arguments:
3511	* urb ptr to the completed urb
3512	*
3513	* Returns:
3514	* nothing
3515	*
3516	* Side effects:
3517	*
3518	* Call context:
3519	* interrupt
3520	*----------------------------------------------------------------
3521	*/
3522	static void hfa384x_ctlxout_callback(struct urb *urb)
3523	{
3524	struct hfa384x *hw = urb->context;
3525	int delete_resptimer = 0;
3526	int timer_ok = 1;
3527	int run_queue = 0;
3528	struct hfa384x_usbctlx *ctlx;
3529	unsigned long flags;
3530
3531	pr_debug("urb->status=%d\n", urb->status);
3532	#ifdef DEBUG_USB
3533	dbprint_urb(urb);
3534	#endif
3535	if ((urb->status == -ESHUTDOWN) ||
3536	(urb->status == -ENODEV) || !hw)
3537	return;
3538
3539	retry:
3540	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3541
3542	/*
3543	* Only one CTLX at a time on the "active" list, and
3544	* none at all if we are unplugged. However, we can
3545	* rely on the disconnect function to clean everything
3546	* up if someone unplugged the adapter.
3547	*/
3548	if (list_empty(head: &hw->ctlxq.active)) {
3549	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
3550	return;
3551	}
3552
3553	/*
3554	* Having something on the "active" queue means
3555	* that we have timers to worry about ...
3556	*/
3557	if (del_timer(timer: &hw->reqtimer) == 0) {
3558	if (hw->req_timer_done == 0) {
3559	/*
3560	* This timer was actually running while we
3561	* were trying to delete it. Let it terminate
3562	* gracefully instead.
3563	*/
3564	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
3565	goto retry;
3566	}
3567	} else {
3568	hw->req_timer_done = 1;
3569	}
3570
3571	ctlx = get_active_ctlx(hw);
3572
3573	if (urb->status == 0) {
3574	/* Request portion of a CTLX is successful */
3575	switch (ctlx->state) {
3576	case CTLX_REQ_SUBMITTED:
3577	/* This OUT-ACK received before IN */
3578	ctlx->state = CTLX_REQ_COMPLETE;
3579	break;
3580
3581	case CTLX_RESP_COMPLETE:
3582	/* IN already received before this OUT-ACK,
3583	* so this command must now be complete.
3584	*/
3585	ctlx->state = CTLX_COMPLETE;
3586	unlocked_usbctlx_complete(hw, ctlx);
3587	run_queue = 1;
3588	break;
3589
3590	default:
3591	/* This is NOT a valid CTLX "success" state! */
3592	netdev_err(dev: hw->wlandev->netdev,
3593	format: "Illegal CTLX[%d] success state(%s, %d) in OUT URB\n",
3594	le16_to_cpu(ctlx->outbuf.type),
3595	ctlxstr(s: ctlx->state), urb->status);
3596	break;
3597	} /* switch */
3598	} else {
3599	/* If the pipe has stalled then we need to reset it */
3600	if ((urb->status == -EPIPE) &&
3601	!test_and_set_bit(WORK_TX_HALT, addr: &hw->usb_flags)) {
3602	netdev_warn(dev: hw->wlandev->netdev,
3603	format: "%s tx pipe stalled: requesting reset\n",
3604	hw->wlandev->netdev->name);
3605	schedule_work(work: &hw->usb_work);
3606	}
3607
3608	/* If someone cancels the OUT URB then its status
3609	* should be either -ECONNRESET or -ENOENT.
3610	*/
3611	ctlx->state = CTLX_REQ_FAILED;
3612	unlocked_usbctlx_complete(hw, ctlx);
3613	delete_resptimer = 1;
3614	run_queue = 1;
3615	}
3616
3617	delresp:
3618	if (delete_resptimer) {
3619	timer_ok = del_timer(timer: &hw->resptimer);
3620	if (timer_ok != 0)
3621	hw->resp_timer_done = 1;
3622	}
3623
3624	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
3625
3626	if (!timer_ok && (hw->resp_timer_done == 0)) {
3627	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3628	goto delresp;
3629	}
3630
3631	if (run_queue)
3632	hfa384x_usbctlxq_run(hw);
3633	}
3634
3635	/*----------------------------------------------------------------
3636	* hfa384x_usbctlx_reqtimerfn
3637	*
3638	* Timer response function for CTLX request timeouts. If this
3639	* function is called, it means that the callback for the OUT
3640	* URB containing a Prism2.x XXX_Request was never called.
3641	*
3642	* Arguments:
3643	* data a ptr to the struct hfa384x
3644	*
3645	* Returns:
3646	* nothing
3647	*
3648	* Side effects:
3649	*
3650	* Call context:
3651	* interrupt
3652	*----------------------------------------------------------------
3653	*/
3654	static void hfa384x_usbctlx_reqtimerfn(struct timer_list *t)
3655	{
3656	struct hfa384x *hw = from_timer(hw, t, reqtimer);
3657	unsigned long flags;
3658
3659	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3660
3661	hw->req_timer_done = 1;
3662
3663	/* Removing the hardware automatically empties
3664	* the active list ...
3665	*/
3666	if (!list_empty(head: &hw->ctlxq.active)) {
3667	/*
3668	* We must ensure that our URB is removed from
3669	* the system, if it hasn't already expired.
3670	*/
3671	hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
3672	if (usb_unlink_urb(urb: &hw->ctlx_urb) == -EINPROGRESS) {
3673	struct hfa384x_usbctlx *ctlx = get_active_ctlx(hw);
3674
3675	ctlx->state = CTLX_REQ_FAILED;
3676
3677	/* This URB was active, but has now been
3678	* cancelled. It will now have a status of
3679	* -ECONNRESET in the callback function.
3680	*
3681	* We are cancelling this CTLX, so we're
3682	* not going to need to wait for a response.
3683	* The URB's callback function will check
3684	* that this timer is truly dead.
3685	*/
3686	if (del_timer(timer: &hw->resptimer) != 0)
3687	hw->resp_timer_done = 1;
3688	}
3689	}
3690
3691	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
3692	}
3693
3694	/*----------------------------------------------------------------
3695	* hfa384x_usbctlx_resptimerfn
3696	*
3697	* Timer response function for CTLX response timeouts. If this
3698	* function is called, it means that the callback for the IN
3699	* URB containing a Prism2.x XXX_Response was never called.
3700	*
3701	* Arguments:
3702	* data a ptr to the struct hfa384x
3703	*
3704	* Returns:
3705	* nothing
3706	*
3707	* Side effects:
3708	*
3709	* Call context:
3710	* interrupt
3711	*----------------------------------------------------------------
3712	*/
3713	static void hfa384x_usbctlx_resptimerfn(struct timer_list *t)
3714	{
3715	struct hfa384x *hw = from_timer(hw, t, resptimer);
3716	unsigned long flags;
3717
3718	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3719
3720	hw->resp_timer_done = 1;
3721
3722	/* The active list will be empty if the
3723	* adapter has been unplugged ...
3724	*/
3725	if (!list_empty(head: &hw->ctlxq.active)) {
3726	struct hfa384x_usbctlx *ctlx = get_active_ctlx(hw);
3727
3728	if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0) {
3729	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
3730	hfa384x_usbctlxq_run(hw);
3731	return;
3732	}
3733	}
3734	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
3735	}
3736
3737	/*----------------------------------------------------------------
3738	* hfa384x_usb_throttlefn
3739	*
3740	*
3741	* Arguments:
3742	* data ptr to hw
3743	*
3744	* Returns:
3745	* Nothing
3746	*
3747	* Side effects:
3748	*
3749	* Call context:
3750	* Interrupt
3751	*----------------------------------------------------------------
3752	*/
3753	static void hfa384x_usb_throttlefn(struct timer_list *t)
3754	{
3755	struct hfa384x *hw = from_timer(hw, t, throttle);
3756	unsigned long flags;
3757
3758	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3759
3760	pr_debug("flags=0x%lx\n", hw->usb_flags);
3761	if (!hw->wlandev->hwremoved) {
3762	bool rx_throttle = test_and_clear_bit(THROTTLE_RX, addr: &hw->usb_flags) &&
3763	!test_and_set_bit(WORK_RX_RESUME, addr: &hw->usb_flags);
3764	bool tx_throttle = test_and_clear_bit(THROTTLE_TX, addr: &hw->usb_flags) &&
3765	!test_and_set_bit(WORK_TX_RESUME, addr: &hw->usb_flags);
3766	/*
3767	* We need to check BOTH the RX and the TX throttle controls,
3768	* so we use the bitwise OR instead of the logical OR.
3769	*/
3770	if (rx_throttle | tx_throttle)
3771	schedule_work(work: &hw->usb_work);
3772	}
3773
3774	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
3775	}
3776
3777	/*----------------------------------------------------------------
3778	* hfa384x_usbctlx_submit
3779	*
3780	* Called from the doxxx functions to submit a CTLX to the queue
3781	*
3782	* Arguments:
3783	* hw ptr to the hw struct
3784	* ctlx ctlx structure to enqueue
3785	*
3786	* Returns:
3787	* -ENODEV if the adapter is unplugged
3788	* 0
3789	*
3790	* Side effects:
3791	*
3792	* Call context:
3793	* process or interrupt
3794	*----------------------------------------------------------------
3795	*/
3796	static int hfa384x_usbctlx_submit(struct hfa384x *hw,
3797	struct hfa384x_usbctlx *ctlx)
3798	{
3799	unsigned long flags;
3800
3801	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3802
3803	if (hw->wlandev->hwremoved) {
3804	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
3805	return -ENODEV;
3806	}
3807
3808	ctlx->state = CTLX_PENDING;
3809	list_add_tail(new: &ctlx->list, head: &hw->ctlxq.pending);
3810	spin_unlock_irqrestore(lock: &hw->ctlxq.lock, flags);
3811	hfa384x_usbctlxq_run(hw);
3812
3813	return 0;
3814	}
3815
3816	/*----------------------------------------------------------------
3817	* hfa384x_isgood_pdrcore
3818	*
3819	* Quick check of PDR codes.
3820	*
3821	* Arguments:
3822	* pdrcode PDR code number (host order)
3823	*
3824	* Returns:
3825	* zero not good.
3826	* one is good.
3827	*
3828	* Side effects:
3829	*
3830	* Call context:
3831	*----------------------------------------------------------------
3832	*/
3833	static int hfa384x_isgood_pdrcode(u16 pdrcode)
3834	{
3835	switch (pdrcode) {
3836	case HFA384x_PDR_END_OF_PDA:
3837	case HFA384x_PDR_PCB_PARTNUM:
3838	case HFA384x_PDR_PDAVER:
3839	case HFA384x_PDR_NIC_SERIAL:
3840	case HFA384x_PDR_MKK_MEASUREMENTS:
3841	case HFA384x_PDR_NIC_RAMSIZE:
3842	case HFA384x_PDR_MFISUPRANGE:
3843	case HFA384x_PDR_CFISUPRANGE:
3844	case HFA384x_PDR_NICID:
3845	case HFA384x_PDR_MAC_ADDRESS:
3846	case HFA384x_PDR_REGDOMAIN:
3847	case HFA384x_PDR_ALLOWED_CHANNEL:
3848	case HFA384x_PDR_DEFAULT_CHANNEL:
3849	case HFA384x_PDR_TEMPTYPE:
3850	case HFA384x_PDR_IFR_SETTING:
3851	case HFA384x_PDR_RFR_SETTING:
3852	case HFA384x_PDR_HFA3861_BASELINE:
3853	case HFA384x_PDR_HFA3861_SHADOW:
3854	case HFA384x_PDR_HFA3861_IFRF:
3855	case HFA384x_PDR_HFA3861_CHCALSP:
3856	case HFA384x_PDR_HFA3861_CHCALI:
3857	case HFA384x_PDR_3842_NIC_CONFIG:
3858	case HFA384x_PDR_USB_ID:
3859	case HFA384x_PDR_PCI_ID:
3860	case HFA384x_PDR_PCI_IFCONF:
3861	case HFA384x_PDR_PCI_PMCONF:
3862	case HFA384x_PDR_RFENRGY:
3863	case HFA384x_PDR_HFA3861_MANF_TESTSP:
3864	case HFA384x_PDR_HFA3861_MANF_TESTI:
3865	/* code is OK */
3866	return 1;
3867	default:
3868	if (pdrcode < 0x1000) {
3869	/* code is OK, but we don't know exactly what it is */
3870	pr_debug("Encountered unknown PDR#=0x%04x, assuming it's ok.\n",
3871	pdrcode);
3872	return 1;
3873	}
3874	break;
3875	}
3876	/* bad code */
3877	pr_debug("Encountered unknown PDR#=0x%04x, (>=0x1000), assuming it's bad.\n",
3878	pdrcode);
3879	return 0;
3880	}
3881