1 // SPDX-License-Identifier: (GPL-2.0 OR MPL-1.1)
2 /*
3  *
4  * Functions that talk to the USB variant of the Intersil hfa384x MAC
5  *
6  * Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
7  * --------------------------------------------------------------------
8  *
9  * linux-wlan
10  *
11  * --------------------------------------------------------------------
12  *
13  * Inquiries regarding the linux-wlan Open Source project can be
14  * made directly to:
15  *
16  * AbsoluteValue Systems Inc.
17  * info@linux-wlan.com
18  * http://www.linux-wlan.com
19  *
20  * --------------------------------------------------------------------
21  *
22  * Portions of the development of this software were funded by
23  * Intersil Corporation as part of PRISM(R) chipset product development.
24  *
25  * --------------------------------------------------------------------
26  *
27  * This file implements functions that correspond to the prism2/hfa384x
28  * 802.11 MAC hardware and firmware host interface.
29  *
30  * The functions can be considered to represent several levels of
31  * abstraction.  The lowest level functions are simply C-callable wrappers
32  * around the register accesses.  The next higher level represents C-callable
33  * prism2 API functions that match the Intersil documentation as closely
34  * as is reasonable.  The next higher layer implements common sequences
35  * of invocations of the API layer (e.g. write to bap, followed by cmd).
36  *
37  * Common sequences:
38  * hfa384x_drvr_xxx	Highest level abstractions provided by the
39  *			hfa384x code.  They are driver defined wrappers
40  *			for common sequences.  These functions generally
41  *			use the services of the lower levels.
42  *
43  * hfa384x_drvr_xxxconfig  An example of the drvr level abstraction. These
44  *			functions are wrappers for the RID get/set
45  *			sequence. They call copy_[to|from]_bap() and
46  *			cmd_access(). These functions operate on the
47  *			RIDs and buffers without validation. The caller
48  *			is responsible for that.
49  *
50  * API wrapper functions:
51  * hfa384x_cmd_xxx	functions that provide access to the f/w commands.
52  *			The function arguments correspond to each command
53  *			argument, even command arguments that get packed
54  *			into single registers.  These functions _just_
55  *			issue the command by setting the cmd/parm regs
56  *			& reading the status/resp regs.  Additional
57  *			activities required to fully use a command
58  *			(read/write from/to bap, get/set int status etc.)
59  *			are implemented separately.  Think of these as
60  *			C-callable prism2 commands.
61  *
62  * Lowest Layer Functions:
63  * hfa384x_docmd_xxx	These functions implement the sequence required
64  *			to issue any prism2 command.  Primarily used by the
65  *			hfa384x_cmd_xxx functions.
66  *
67  * hfa384x_bap_xxx	BAP read/write access functions.
68  *			Note: we usually use BAP0 for non-interrupt context
69  *			 and BAP1 for interrupt context.
70  *
71  * hfa384x_dl_xxx	download related functions.
72  *
73  * Driver State Issues:
74  * Note that there are two pairs of functions that manage the
75  * 'initialized' and 'running' states of the hw/MAC combo.  The four
76  * functions are create(), destroy(), start(), and stop().  create()
77  * sets up the data structures required to support the hfa384x_*
78  * functions and destroy() cleans them up.  The start() function gets
79  * the actual hardware running and enables the interrupts.  The stop()
80  * function shuts the hardware down.  The sequence should be:
81  * create()
82  * start()
83  *  .
84  *  .  Do interesting things w/ the hardware
85  *  .
86  * stop()
87  * destroy()
88  *
89  * Note that destroy() can be called without calling stop() first.
90  * --------------------------------------------------------------------
91  */
92 
93 #include <linux/module.h>
94 #include <linux/kernel.h>
95 #include <linux/sched.h>
96 #include <linux/types.h>
97 #include <linux/slab.h>
98 #include <linux/wireless.h>
99 #include <linux/netdevice.h>
100 #include <linux/timer.h>
101 #include <linux/io.h>
102 #include <linux/delay.h>
103 #include <asm/byteorder.h>
104 #include <linux/bitops.h>
105 #include <linux/list.h>
106 #include <linux/usb.h>
107 #include <linux/byteorder/generic.h>
108 
109 #include "p80211types.h"
110 #include "p80211hdr.h"
111 #include "p80211mgmt.h"
112 #include "p80211conv.h"
113 #include "p80211msg.h"
114 #include "p80211netdev.h"
115 #include "p80211req.h"
116 #include "p80211metadef.h"
117 #include "p80211metastruct.h"
118 #include "hfa384x.h"
119 #include "prism2mgmt.h"
120 
121 enum cmd_mode {
122 	DOWAIT = 0,
123 	DOASYNC
124 };
125 
126 #define THROTTLE_JIFFIES	(HZ / 8)
127 #define URB_ASYNC_UNLINK 0
128 #define USB_QUEUE_BULK 0
129 
130 #define ROUNDUP64(a) (((a) + 63) & ~63)
131 
132 #ifdef DEBUG_USB
133 static void dbprint_urb(struct urb *urb);
134 #endif
135 
136 static void hfa384x_int_rxmonitor(struct wlandevice *wlandev,
137 				  struct hfa384x_usb_rxfrm *rxfrm);
138 
139 static void hfa384x_usb_defer(struct work_struct *data);
140 
141 static int submit_rx_urb(struct hfa384x *hw, gfp_t flags);
142 
143 static int submit_tx_urb(struct hfa384x *hw, struct urb *tx_urb, gfp_t flags);
144 
145 /*---------------------------------------------------*/
146 /* Callbacks */
147 static void hfa384x_usbout_callback(struct urb *urb);
148 static void hfa384x_ctlxout_callback(struct urb *urb);
149 static void hfa384x_usbin_callback(struct urb *urb);
150 
151 static void
152 hfa384x_usbin_txcompl(struct wlandevice *wlandev, union hfa384x_usbin *usbin);
153 
154 static void hfa384x_usbin_rx(struct wlandevice *wlandev, struct sk_buff *skb);
155 
156 static void hfa384x_usbin_info(struct wlandevice *wlandev,
157 			       union hfa384x_usbin *usbin);
158 
159 static void hfa384x_usbin_ctlx(struct hfa384x *hw, union hfa384x_usbin *usbin,
160 			       int urb_status);
161 
162 /*---------------------------------------------------*/
163 /* Functions to support the prism2 usb command queue */
164 
165 static void hfa384x_usbctlxq_run(struct hfa384x *hw);
166 
167 static void hfa384x_usbctlx_reqtimerfn(struct timer_list *t);
168 
169 static void hfa384x_usbctlx_resptimerfn(struct timer_list *t);
170 
171 static void hfa384x_usb_throttlefn(struct timer_list *t);
172 
173 static void hfa384x_usbctlx_completion_task(struct work_struct *work);
174 
175 static void hfa384x_usbctlx_reaper_task(struct work_struct *work);
176 
177 static int hfa384x_usbctlx_submit(struct hfa384x *hw,
178 				  struct hfa384x_usbctlx *ctlx);
179 
180 static void unlocked_usbctlx_complete(struct hfa384x *hw,
181 				      struct hfa384x_usbctlx *ctlx);
182 
183 struct usbctlx_completor {
184 	int (*complete)(struct usbctlx_completor *completor);
185 };
186 
187 static int
188 hfa384x_usbctlx_complete_sync(struct hfa384x *hw,
189 			      struct hfa384x_usbctlx *ctlx,
190 			      struct usbctlx_completor *completor);
191 
192 static int
193 unlocked_usbctlx_cancel_async(struct hfa384x *hw, struct hfa384x_usbctlx *ctlx);
194 
195 static void hfa384x_cb_status(struct hfa384x *hw,
196 			      const struct hfa384x_usbctlx *ctlx);
197 
198 static int
199 usbctlx_get_status(const struct hfa384x_usb_statusresp *cmdresp,
200 		   struct hfa384x_cmdresult *result);
201 
202 static void
203 usbctlx_get_rridresult(const struct hfa384x_usb_rridresp *rridresp,
204 		       struct hfa384x_rridresult *result);
205 
206 /*---------------------------------------------------*/
207 /* Low level req/resp CTLX formatters and submitters */
208 static inline int
209 hfa384x_docmd(struct hfa384x *hw,
210 	      struct hfa384x_metacmd *cmd);
211 
212 static int
213 hfa384x_dorrid(struct hfa384x *hw,
214 	       enum cmd_mode mode,
215 	       u16 rid,
216 	       void *riddata,
217 	       unsigned int riddatalen,
218 	       ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
219 
220 static int
221 hfa384x_dowrid(struct hfa384x *hw,
222 	       enum cmd_mode mode,
223 	       u16 rid,
224 	       void *riddata,
225 	       unsigned int riddatalen,
226 	       ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
227 
228 static int
229 hfa384x_dormem(struct hfa384x *hw,
230 	       u16 page,
231 	       u16 offset,
232 	       void *data,
233 	       unsigned int len);
234 
235 static int
236 hfa384x_dowmem(struct hfa384x *hw,
237 	       u16 page,
238 	       u16 offset,
239 	       void *data,
240 	       unsigned int len);
241 
242 static int hfa384x_isgood_pdrcode(u16 pdrcode);
243 
ctlxstr(enum ctlx_state s)244 static inline const char *ctlxstr(enum ctlx_state s)
245 {
246 	static const char * const ctlx_str[] = {
247 		"Initial state",
248 		"Complete",
249 		"Request failed",
250 		"Request pending",
251 		"Request packet submitted",
252 		"Request packet completed",
253 		"Response packet completed"
254 	};
255 
256 	return ctlx_str[s];
257 };
258 
get_active_ctlx(struct hfa384x * hw)259 static inline struct hfa384x_usbctlx *get_active_ctlx(struct hfa384x *hw)
260 {
261 	return list_entry(hw->ctlxq.active.next, struct hfa384x_usbctlx, list);
262 }
263 
264 #ifdef DEBUG_USB
dbprint_urb(struct urb * urb)265 void dbprint_urb(struct urb *urb)
266 {
267 	pr_debug("urb->pipe=0x%08x\n", urb->pipe);
268 	pr_debug("urb->status=0x%08x\n", urb->status);
269 	pr_debug("urb->transfer_flags=0x%08x\n", urb->transfer_flags);
270 	pr_debug("urb->transfer_buffer=0x%08x\n",
271 		 (unsigned int)urb->transfer_buffer);
272 	pr_debug("urb->transfer_buffer_length=0x%08x\n",
273 		 urb->transfer_buffer_length);
274 	pr_debug("urb->actual_length=0x%08x\n", urb->actual_length);
275 	pr_debug("urb->setup_packet(ctl)=0x%08x\n",
276 		 (unsigned int)urb->setup_packet);
277 	pr_debug("urb->start_frame(iso/irq)=0x%08x\n", urb->start_frame);
278 	pr_debug("urb->interval(irq)=0x%08x\n", urb->interval);
279 	pr_debug("urb->error_count(iso)=0x%08x\n", urb->error_count);
280 	pr_debug("urb->context=0x%08x\n", (unsigned int)urb->context);
281 	pr_debug("urb->complete=0x%08x\n", (unsigned int)urb->complete);
282 }
283 #endif
284 
285 /*----------------------------------------------------------------
286  * submit_rx_urb
287  *
288  * Listen for input data on the BULK-IN pipe. If the pipe has
289  * stalled then schedule it to be reset.
290  *
291  * Arguments:
292  *	hw		device struct
293  *	memflags	memory allocation flags
294  *
295  * Returns:
296  *	error code from submission
297  *
298  * Call context:
299  *	Any
300  *----------------------------------------------------------------
301  */
submit_rx_urb(struct hfa384x * hw,gfp_t memflags)302 static int submit_rx_urb(struct hfa384x *hw, gfp_t memflags)
303 {
304 	struct sk_buff *skb;
305 	int result;
306 
307 	skb = dev_alloc_skb(sizeof(union hfa384x_usbin));
308 	if (!skb) {
309 		result = -ENOMEM;
310 		goto done;
311 	}
312 
313 	/* Post the IN urb */
314 	usb_fill_bulk_urb(&hw->rx_urb, hw->usb,
315 			  hw->endp_in,
316 			  skb->data, sizeof(union hfa384x_usbin),
317 			  hfa384x_usbin_callback, hw->wlandev);
318 
319 	hw->rx_urb_skb = skb;
320 
321 	result = -ENOLINK;
322 	if (!hw->wlandev->hwremoved &&
323 	    !test_bit(WORK_RX_HALT, &hw->usb_flags)) {
324 		result = usb_submit_urb(&hw->rx_urb, memflags);
325 
326 		/* Check whether we need to reset the RX pipe */
327 		if (result == -EPIPE) {
328 			netdev_warn(hw->wlandev->netdev,
329 				    "%s rx pipe stalled: requesting reset\n",
330 				    hw->wlandev->netdev->name);
331 			if (!test_and_set_bit(WORK_RX_HALT, &hw->usb_flags))
332 				schedule_work(&hw->usb_work);
333 		}
334 	}
335 
336 	/* Don't leak memory if anything should go wrong */
337 	if (result != 0) {
338 		dev_kfree_skb(skb);
339 		hw->rx_urb_skb = NULL;
340 	}
341 
342 done:
343 	return result;
344 }
345 
346 /*----------------------------------------------------------------
347  * submit_tx_urb
348  *
349  * Prepares and submits the URB of transmitted data. If the
350  * submission fails then it will schedule the output pipe to
351  * be reset.
352  *
353  * Arguments:
354  *	hw		device struct
355  *	tx_urb		URB of data for transmission
356  *	memflags	memory allocation flags
357  *
358  * Returns:
359  *	error code from submission
360  *
361  * Call context:
362  *	Any
363  *----------------------------------------------------------------
364  */
submit_tx_urb(struct hfa384x * hw,struct urb * tx_urb,gfp_t memflags)365 static int submit_tx_urb(struct hfa384x *hw, struct urb *tx_urb, gfp_t memflags)
366 {
367 	struct net_device *netdev = hw->wlandev->netdev;
368 	int result;
369 
370 	result = -ENOLINK;
371 	if (netif_running(netdev)) {
372 		if (!hw->wlandev->hwremoved &&
373 		    !test_bit(WORK_TX_HALT, &hw->usb_flags)) {
374 			result = usb_submit_urb(tx_urb, memflags);
375 
376 			/* Test whether we need to reset the TX pipe */
377 			if (result == -EPIPE) {
378 				netdev_warn(hw->wlandev->netdev,
379 					    "%s tx pipe stalled: requesting reset\n",
380 					    netdev->name);
381 				set_bit(WORK_TX_HALT, &hw->usb_flags);
382 				schedule_work(&hw->usb_work);
383 			} else if (result == 0) {
384 				netif_stop_queue(netdev);
385 			}
386 		}
387 	}
388 
389 	return result;
390 }
391 
392 /*----------------------------------------------------------------
393  * hfa394x_usb_defer
394  *
395  * There are some things that the USB stack cannot do while
396  * in interrupt context, so we arrange this function to run
397  * in process context.
398  *
399  * Arguments:
400  *	hw	device structure
401  *
402  * Returns:
403  *	nothing
404  *
405  * Call context:
406  *	process (by design)
407  *----------------------------------------------------------------
408  */
hfa384x_usb_defer(struct work_struct * data)409 static void hfa384x_usb_defer(struct work_struct *data)
410 {
411 	struct hfa384x *hw = container_of(data, struct hfa384x, usb_work);
412 	struct net_device *netdev = hw->wlandev->netdev;
413 
414 	/* Don't bother trying to reset anything if the plug
415 	 * has been pulled ...
416 	 */
417 	if (hw->wlandev->hwremoved)
418 		return;
419 
420 	/* Reception has stopped: try to reset the input pipe */
421 	if (test_bit(WORK_RX_HALT, &hw->usb_flags)) {
422 		int ret;
423 
424 		usb_kill_urb(&hw->rx_urb); /* Cannot be holding spinlock! */
425 
426 		ret = usb_clear_halt(hw->usb, hw->endp_in);
427 		if (ret != 0) {
428 			netdev_err(hw->wlandev->netdev,
429 				   "Failed to clear rx pipe for %s: err=%d\n",
430 				   netdev->name, ret);
431 		} else {
432 			netdev_info(hw->wlandev->netdev, "%s rx pipe reset complete.\n",
433 				    netdev->name);
434 			clear_bit(WORK_RX_HALT, &hw->usb_flags);
435 			set_bit(WORK_RX_RESUME, &hw->usb_flags);
436 		}
437 	}
438 
439 	/* Resume receiving data back from the device. */
440 	if (test_bit(WORK_RX_RESUME, &hw->usb_flags)) {
441 		int ret;
442 
443 		ret = submit_rx_urb(hw, GFP_KERNEL);
444 		if (ret != 0) {
445 			netdev_err(hw->wlandev->netdev,
446 				   "Failed to resume %s rx pipe.\n",
447 				   netdev->name);
448 		} else {
449 			clear_bit(WORK_RX_RESUME, &hw->usb_flags);
450 		}
451 	}
452 
453 	/* Transmission has stopped: try to reset the output pipe */
454 	if (test_bit(WORK_TX_HALT, &hw->usb_flags)) {
455 		int ret;
456 
457 		usb_kill_urb(&hw->tx_urb);
458 		ret = usb_clear_halt(hw->usb, hw->endp_out);
459 		if (ret != 0) {
460 			netdev_err(hw->wlandev->netdev,
461 				   "Failed to clear tx pipe for %s: err=%d\n",
462 				   netdev->name, ret);
463 		} else {
464 			netdev_info(hw->wlandev->netdev, "%s tx pipe reset complete.\n",
465 				    netdev->name);
466 			clear_bit(WORK_TX_HALT, &hw->usb_flags);
467 			set_bit(WORK_TX_RESUME, &hw->usb_flags);
468 
469 			/* Stopping the BULK-OUT pipe also blocked
470 			 * us from sending any more CTLX URBs, so
471 			 * we need to re-run our queue ...
472 			 */
473 			hfa384x_usbctlxq_run(hw);
474 		}
475 	}
476 
477 	/* Resume transmitting. */
478 	if (test_and_clear_bit(WORK_TX_RESUME, &hw->usb_flags))
479 		netif_wake_queue(hw->wlandev->netdev);
480 }
481 
482 /*----------------------------------------------------------------
483  * hfa384x_create
484  *
485  * Sets up the struct hfa384x data structure for use.  Note this
486  * does _not_ initialize the actual hardware, just the data structures
487  * we use to keep track of its state.
488  *
489  * Arguments:
490  *	hw		device structure
491  *	irq		device irq number
492  *	iobase		i/o base address for register access
493  *	membase		memory base address for register access
494  *
495  * Returns:
496  *	nothing
497  *
498  * Side effects:
499  *
500  * Call context:
501  *	process
502  *----------------------------------------------------------------
503  */
hfa384x_create(struct hfa384x * hw,struct usb_device * usb)504 void hfa384x_create(struct hfa384x *hw, struct usb_device *usb)
505 {
506 	hw->usb = usb;
507 
508 	/* Set up the waitq */
509 	init_waitqueue_head(&hw->cmdq);
510 
511 	/* Initialize the command queue */
512 	spin_lock_init(&hw->ctlxq.lock);
513 	INIT_LIST_HEAD(&hw->ctlxq.pending);
514 	INIT_LIST_HEAD(&hw->ctlxq.active);
515 	INIT_LIST_HEAD(&hw->ctlxq.completing);
516 	INIT_LIST_HEAD(&hw->ctlxq.reapable);
517 
518 	/* Initialize the authentication queue */
519 	skb_queue_head_init(&hw->authq);
520 
521 	INIT_WORK(&hw->reaper_bh, hfa384x_usbctlx_reaper_task);
522 	INIT_WORK(&hw->completion_bh, hfa384x_usbctlx_completion_task);
523 	INIT_WORK(&hw->link_bh, prism2sta_processing_defer);
524 	INIT_WORK(&hw->usb_work, hfa384x_usb_defer);
525 
526 	timer_setup(&hw->throttle, hfa384x_usb_throttlefn, 0);
527 
528 	timer_setup(&hw->resptimer, hfa384x_usbctlx_resptimerfn, 0);
529 
530 	timer_setup(&hw->reqtimer, hfa384x_usbctlx_reqtimerfn, 0);
531 
532 	usb_init_urb(&hw->rx_urb);
533 	usb_init_urb(&hw->tx_urb);
534 	usb_init_urb(&hw->ctlx_urb);
535 
536 	hw->link_status = HFA384x_LINK_NOTCONNECTED;
537 	hw->state = HFA384x_STATE_INIT;
538 
539 	INIT_WORK(&hw->commsqual_bh, prism2sta_commsqual_defer);
540 	timer_setup(&hw->commsqual_timer, prism2sta_commsqual_timer, 0);
541 }
542 
543 /*----------------------------------------------------------------
544  * hfa384x_destroy
545  *
546  * Partner to hfa384x_create().  This function cleans up the hw
547  * structure so that it can be freed by the caller using a simple
548  * kfree.  Currently, this function is just a placeholder.  If, at some
549  * point in the future, an hw in the 'shutdown' state requires a 'deep'
550  * kfree, this is where it should be done.  Note that if this function
551  * is called on a _running_ hw structure, the drvr_stop() function is
552  * called.
553  *
554  * Arguments:
555  *	hw		device structure
556  *
557  * Returns:
558  *	nothing, this function is not allowed to fail.
559  *
560  * Side effects:
561  *
562  * Call context:
563  *	process
564  *----------------------------------------------------------------
565  */
hfa384x_destroy(struct hfa384x * hw)566 void hfa384x_destroy(struct hfa384x *hw)
567 {
568 	struct sk_buff *skb;
569 
570 	if (hw->state == HFA384x_STATE_RUNNING)
571 		hfa384x_drvr_stop(hw);
572 	hw->state = HFA384x_STATE_PREINIT;
573 
574 	kfree(hw->scanresults);
575 	hw->scanresults = NULL;
576 
577 	/* Now to clean out the auth queue */
578 	while ((skb = skb_dequeue(&hw->authq)))
579 		dev_kfree_skb(skb);
580 }
581 
usbctlx_alloc(void)582 static struct hfa384x_usbctlx *usbctlx_alloc(void)
583 {
584 	struct hfa384x_usbctlx *ctlx;
585 
586 	ctlx = kzalloc(sizeof(*ctlx),
587 		       in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
588 	if (ctlx)
589 		init_completion(&ctlx->done);
590 
591 	return ctlx;
592 }
593 
594 static int
usbctlx_get_status(const struct hfa384x_usb_statusresp * cmdresp,struct hfa384x_cmdresult * result)595 usbctlx_get_status(const struct hfa384x_usb_statusresp *cmdresp,
596 		   struct hfa384x_cmdresult *result)
597 {
598 	result->status = le16_to_cpu(cmdresp->status);
599 	result->resp0 = le16_to_cpu(cmdresp->resp0);
600 	result->resp1 = le16_to_cpu(cmdresp->resp1);
601 	result->resp2 = le16_to_cpu(cmdresp->resp2);
602 
603 	pr_debug("cmdresult:status=0x%04x resp0=0x%04x resp1=0x%04x resp2=0x%04x\n",
604 		 result->status, result->resp0, result->resp1, result->resp2);
605 
606 	return result->status & HFA384x_STATUS_RESULT;
607 }
608 
609 static void
usbctlx_get_rridresult(const struct hfa384x_usb_rridresp * rridresp,struct hfa384x_rridresult * result)610 usbctlx_get_rridresult(const struct hfa384x_usb_rridresp *rridresp,
611 		       struct hfa384x_rridresult *result)
612 {
613 	result->rid = le16_to_cpu(rridresp->rid);
614 	result->riddata = rridresp->data;
615 	result->riddata_len = ((le16_to_cpu(rridresp->frmlen) - 1) * 2);
616 }
617 
618 /*----------------------------------------------------------------
619  * Completor object:
620  * This completor must be passed to hfa384x_usbctlx_complete_sync()
621  * when processing a CTLX that returns a struct hfa384x_cmdresult structure.
622  *----------------------------------------------------------------
623  */
624 struct usbctlx_cmd_completor {
625 	struct usbctlx_completor head;
626 
627 	const struct hfa384x_usb_statusresp *cmdresp;
628 	struct hfa384x_cmdresult *result;
629 };
630 
usbctlx_cmd_completor_fn(struct usbctlx_completor * head)631 static inline int usbctlx_cmd_completor_fn(struct usbctlx_completor *head)
632 {
633 	struct usbctlx_cmd_completor *complete;
634 
635 	complete = (struct usbctlx_cmd_completor *)head;
636 	return usbctlx_get_status(complete->cmdresp, complete->result);
637 }
638 
639 static inline struct usbctlx_completor *
init_cmd_completor(struct usbctlx_cmd_completor * completor,const struct hfa384x_usb_statusresp * cmdresp,struct hfa384x_cmdresult * result)640 init_cmd_completor(struct usbctlx_cmd_completor *completor,
641 		   const struct hfa384x_usb_statusresp *cmdresp,
642 		   struct hfa384x_cmdresult *result)
643 {
644 	completor->head.complete = usbctlx_cmd_completor_fn;
645 	completor->cmdresp = cmdresp;
646 	completor->result = result;
647 	return &completor->head;
648 }
649 
650 /*----------------------------------------------------------------
651  * Completor object:
652  * This completor must be passed to hfa384x_usbctlx_complete_sync()
653  * when processing a CTLX that reads a RID.
654  *----------------------------------------------------------------
655  */
656 struct usbctlx_rrid_completor {
657 	struct usbctlx_completor head;
658 
659 	const struct hfa384x_usb_rridresp *rridresp;
660 	void *riddata;
661 	unsigned int riddatalen;
662 };
663 
usbctlx_rrid_completor_fn(struct usbctlx_completor * head)664 static int usbctlx_rrid_completor_fn(struct usbctlx_completor *head)
665 {
666 	struct usbctlx_rrid_completor *complete;
667 	struct hfa384x_rridresult rridresult;
668 
669 	complete = (struct usbctlx_rrid_completor *)head;
670 	usbctlx_get_rridresult(complete->rridresp, &rridresult);
671 
672 	/* Validate the length, note body len calculation in bytes */
673 	if (rridresult.riddata_len != complete->riddatalen) {
674 		pr_warn("RID len mismatch, rid=0x%04x hlen=%d fwlen=%d\n",
675 			rridresult.rid,
676 			complete->riddatalen, rridresult.riddata_len);
677 		return -ENODATA;
678 	}
679 
680 	memcpy(complete->riddata, rridresult.riddata, complete->riddatalen);
681 	return 0;
682 }
683 
684 static inline struct usbctlx_completor *
init_rrid_completor(struct usbctlx_rrid_completor * completor,const struct hfa384x_usb_rridresp * rridresp,void * riddata,unsigned int riddatalen)685 init_rrid_completor(struct usbctlx_rrid_completor *completor,
686 		    const struct hfa384x_usb_rridresp *rridresp,
687 		    void *riddata,
688 		    unsigned int riddatalen)
689 {
690 	completor->head.complete = usbctlx_rrid_completor_fn;
691 	completor->rridresp = rridresp;
692 	completor->riddata = riddata;
693 	completor->riddatalen = riddatalen;
694 	return &completor->head;
695 }
696 
697 /*----------------------------------------------------------------
698  * Completor object:
699  * Interprets the results of a synchronous RID-write
700  *----------------------------------------------------------------
701  */
702 #define init_wrid_completor  init_cmd_completor
703 
704 /*----------------------------------------------------------------
705  * Completor object:
706  * Interprets the results of a synchronous memory-write
707  *----------------------------------------------------------------
708  */
709 #define init_wmem_completor  init_cmd_completor
710 
711 /*----------------------------------------------------------------
712  * Completor object:
713  * Interprets the results of a synchronous memory-read
714  *----------------------------------------------------------------
715  */
716 struct usbctlx_rmem_completor {
717 	struct usbctlx_completor head;
718 
719 	const struct hfa384x_usb_rmemresp *rmemresp;
720 	void *data;
721 	unsigned int len;
722 };
723 
usbctlx_rmem_completor_fn(struct usbctlx_completor * head)724 static int usbctlx_rmem_completor_fn(struct usbctlx_completor *head)
725 {
726 	struct usbctlx_rmem_completor *complete =
727 		(struct usbctlx_rmem_completor *)head;
728 
729 	pr_debug("rmemresp:len=%d\n", complete->rmemresp->frmlen);
730 	memcpy(complete->data, complete->rmemresp->data, complete->len);
731 	return 0;
732 }
733 
734 static inline struct usbctlx_completor *
init_rmem_completor(struct usbctlx_rmem_completor * completor,struct hfa384x_usb_rmemresp * rmemresp,void * data,unsigned int len)735 init_rmem_completor(struct usbctlx_rmem_completor *completor,
736 		    struct hfa384x_usb_rmemresp *rmemresp,
737 		    void *data,
738 		    unsigned int len)
739 {
740 	completor->head.complete = usbctlx_rmem_completor_fn;
741 	completor->rmemresp = rmemresp;
742 	completor->data = data;
743 	completor->len = len;
744 	return &completor->head;
745 }
746 
747 /*----------------------------------------------------------------
748  * hfa384x_cb_status
749  *
750  * Ctlx_complete handler for async CMD type control exchanges.
751  * mark the hw struct as such.
752  *
753  * Note: If the handling is changed here, it should probably be
754  *       changed in docmd as well.
755  *
756  * Arguments:
757  *	hw		hw struct
758  *	ctlx		completed CTLX
759  *
760  * Returns:
761  *	nothing
762  *
763  * Side effects:
764  *
765  * Call context:
766  *	interrupt
767  *----------------------------------------------------------------
768  */
hfa384x_cb_status(struct hfa384x * hw,const struct hfa384x_usbctlx * ctlx)769 static void hfa384x_cb_status(struct hfa384x *hw,
770 			      const struct hfa384x_usbctlx *ctlx)
771 {
772 	if (ctlx->usercb) {
773 		struct hfa384x_cmdresult cmdresult;
774 
775 		if (ctlx->state != CTLX_COMPLETE) {
776 			memset(&cmdresult, 0, sizeof(cmdresult));
777 			cmdresult.status =
778 			    HFA384x_STATUS_RESULT_SET(HFA384x_CMD_ERR);
779 		} else {
780 			usbctlx_get_status(&ctlx->inbuf.cmdresp, &cmdresult);
781 		}
782 
783 		ctlx->usercb(hw, &cmdresult, ctlx->usercb_data);
784 	}
785 }
786 
787 /*----------------------------------------------------------------
788  * hfa384x_cmd_initialize
789  *
790  * Issues the initialize command and sets the hw->state based
791  * on the result.
792  *
793  * Arguments:
794  *	hw		device structure
795  *
796  * Returns:
797  *	0		success
798  *	>0		f/w reported error - f/w status code
799  *	<0		driver reported error
800  *
801  * Side effects:
802  *
803  * Call context:
804  *	process
805  *----------------------------------------------------------------
806  */
hfa384x_cmd_initialize(struct hfa384x * hw)807 int hfa384x_cmd_initialize(struct hfa384x *hw)
808 {
809 	int result = 0;
810 	int i;
811 	struct hfa384x_metacmd cmd;
812 
813 	cmd.cmd = HFA384x_CMDCODE_INIT;
814 	cmd.parm0 = 0;
815 	cmd.parm1 = 0;
816 	cmd.parm2 = 0;
817 
818 	result = hfa384x_docmd(hw, &cmd);
819 
820 	pr_debug("cmdresp.init: status=0x%04x, resp0=0x%04x, resp1=0x%04x, resp2=0x%04x\n",
821 		 cmd.result.status,
822 		 cmd.result.resp0, cmd.result.resp1, cmd.result.resp2);
823 	if (result == 0) {
824 		for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
825 			hw->port_enabled[i] = 0;
826 	}
827 
828 	hw->link_status = HFA384x_LINK_NOTCONNECTED;
829 
830 	return result;
831 }
832 
833 /*----------------------------------------------------------------
834  * hfa384x_cmd_disable
835  *
836  * Issues the disable command to stop communications on one of
837  * the MACs 'ports'.
838  *
839  * Arguments:
840  *	hw		device structure
841  *	macport		MAC port number (host order)
842  *
843  * Returns:
844  *	0		success
845  *	>0		f/w reported failure - f/w status code
846  *	<0		driver reported error (timeout|bad arg)
847  *
848  * Side effects:
849  *
850  * Call context:
851  *	process
852  *----------------------------------------------------------------
853  */
hfa384x_cmd_disable(struct hfa384x * hw,u16 macport)854 int hfa384x_cmd_disable(struct hfa384x *hw, u16 macport)
855 {
856 	struct hfa384x_metacmd cmd;
857 
858 	cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DISABLE) |
859 	    HFA384x_CMD_MACPORT_SET(macport);
860 	cmd.parm0 = 0;
861 	cmd.parm1 = 0;
862 	cmd.parm2 = 0;
863 
864 	return hfa384x_docmd(hw, &cmd);
865 }
866 
867 /*----------------------------------------------------------------
868  * hfa384x_cmd_enable
869  *
870  * Issues the enable command to enable communications on one of
871  * the MACs 'ports'.
872  *
873  * Arguments:
874  *	hw		device structure
875  *	macport		MAC port number
876  *
877  * Returns:
878  *	0		success
879  *	>0		f/w reported failure - f/w status code
880  *	<0		driver reported error (timeout|bad arg)
881  *
882  * Side effects:
883  *
884  * Call context:
885  *	process
886  *----------------------------------------------------------------
887  */
hfa384x_cmd_enable(struct hfa384x * hw,u16 macport)888 int hfa384x_cmd_enable(struct hfa384x *hw, u16 macport)
889 {
890 	struct hfa384x_metacmd cmd;
891 
892 	cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_ENABLE) |
893 	    HFA384x_CMD_MACPORT_SET(macport);
894 	cmd.parm0 = 0;
895 	cmd.parm1 = 0;
896 	cmd.parm2 = 0;
897 
898 	return hfa384x_docmd(hw, &cmd);
899 }
900 
901 /*----------------------------------------------------------------
902  * hfa384x_cmd_monitor
903  *
904  * Enables the 'monitor mode' of the MAC.  Here's the description of
905  * monitor mode that I've received thus far:
906  *
907  *  "The "monitor mode" of operation is that the MAC passes all
908  *  frames for which the PLCP checks are correct. All received
909  *  MPDUs are passed to the host with MAC Port = 7, with a
910  *  receive status of good, FCS error, or undecryptable. Passing
911  *  certain MPDUs is a violation of the 802.11 standard, but useful
912  *  for a debugging tool."  Normal communication is not possible
913  *  while monitor mode is enabled.
914  *
915  * Arguments:
916  *	hw		device structure
917  *	enable		a code (0x0b|0x0f) that enables/disables
918  *			monitor mode. (host order)
919  *
920  * Returns:
921  *	0		success
922  *	>0		f/w reported failure - f/w status code
923  *	<0		driver reported error (timeout|bad arg)
924  *
925  * Side effects:
926  *
927  * Call context:
928  *	process
929  *----------------------------------------------------------------
930  */
hfa384x_cmd_monitor(struct hfa384x * hw,u16 enable)931 int hfa384x_cmd_monitor(struct hfa384x *hw, u16 enable)
932 {
933 	struct hfa384x_metacmd cmd;
934 
935 	cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_MONITOR) |
936 	    HFA384x_CMD_AINFO_SET(enable);
937 	cmd.parm0 = 0;
938 	cmd.parm1 = 0;
939 	cmd.parm2 = 0;
940 
941 	return hfa384x_docmd(hw, &cmd);
942 }
943 
944 /*----------------------------------------------------------------
945  * hfa384x_cmd_download
946  *
947  * Sets the controls for the MAC controller code/data download
948  * process.  The arguments set the mode and address associated
949  * with a download.  Note that the aux registers should be enabled
950  * prior to setting one of the download enable modes.
951  *
952  * Arguments:
953  *	hw		device structure
954  *	mode		0 - Disable programming and begin code exec
955  *			1 - Enable volatile mem programming
956  *			2 - Enable non-volatile mem programming
957  *			3 - Program non-volatile section from NV download
958  *			    buffer.
959  *			(host order)
960  *	lowaddr
961  *	highaddr	For mode 1, sets the high & low order bits of
962  *			the "destination address".  This address will be
963  *			the execution start address when download is
964  *			subsequently disabled.
965  *			For mode 2, sets the high & low order bits of
966  *			the destination in NV ram.
967  *			For modes 0 & 3, should be zero. (host order)
968  *			NOTE: these are CMD format.
969  *	codelen		Length of the data to write in mode 2,
970  *			zero otherwise. (host order)
971  *
972  * Returns:
973  *	0		success
974  *	>0		f/w reported failure - f/w status code
975  *	<0		driver reported error (timeout|bad arg)
976  *
977  * Side effects:
978  *
979  * Call context:
980  *	process
981  *----------------------------------------------------------------
982  */
hfa384x_cmd_download(struct hfa384x * hw,u16 mode,u16 lowaddr,u16 highaddr,u16 codelen)983 int hfa384x_cmd_download(struct hfa384x *hw, u16 mode, u16 lowaddr,
984 			 u16 highaddr, u16 codelen)
985 {
986 	struct hfa384x_metacmd cmd;
987 
988 	pr_debug("mode=%d, lowaddr=0x%04x, highaddr=0x%04x, codelen=%d\n",
989 		 mode, lowaddr, highaddr, codelen);
990 
991 	cmd.cmd = (HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DOWNLD) |
992 		   HFA384x_CMD_PROGMODE_SET(mode));
993 
994 	cmd.parm0 = lowaddr;
995 	cmd.parm1 = highaddr;
996 	cmd.parm2 = codelen;
997 
998 	return hfa384x_docmd(hw, &cmd);
999 }
1000 
1001 /*----------------------------------------------------------------
1002  * hfa384x_corereset
1003  *
1004  * Perform a reset of the hfa38xx MAC core.  We assume that the hw
1005  * structure is in its "created" state.  That is, it is initialized
1006  * with proper values.  Note that if a reset is done after the
1007  * device has been active for awhile, the caller might have to clean
1008  * up some leftover cruft in the hw structure.
1009  *
1010  * Arguments:
1011  *	hw		device structure
1012  *	holdtime	how long (in ms) to hold the reset
1013  *	settletime	how long (in ms) to wait after releasing
1014  *			the reset
1015  *
1016  * Returns:
1017  *	nothing
1018  *
1019  * Side effects:
1020  *
1021  * Call context:
1022  *	process
1023  *----------------------------------------------------------------
1024  */
hfa384x_corereset(struct hfa384x * hw,int holdtime,int settletime,int genesis)1025 int hfa384x_corereset(struct hfa384x *hw, int holdtime,
1026 		      int settletime, int genesis)
1027 {
1028 	int result;
1029 
1030 	result = usb_reset_device(hw->usb);
1031 	if (result < 0) {
1032 		netdev_err(hw->wlandev->netdev, "usb_reset_device() failed, result=%d.\n",
1033 			   result);
1034 	}
1035 
1036 	return result;
1037 }
1038 
1039 /*----------------------------------------------------------------
1040  * hfa384x_usbctlx_complete_sync
1041  *
1042  * Waits for a synchronous CTLX object to complete,
1043  * and then handles the response.
1044  *
1045  * Arguments:
1046  *	hw		device structure
1047  *	ctlx		CTLX ptr
1048  *	completor	functor object to decide what to
1049  *			do with the CTLX's result.
1050  *
1051  * Returns:
1052  *	0		Success
1053  *	-ERESTARTSYS	Interrupted by a signal
1054  *	-EIO		CTLX failed
1055  *	-ENODEV		Adapter was unplugged
1056  *	???		Result from completor
1057  *
1058  * Side effects:
1059  *
1060  * Call context:
1061  *	process
1062  *----------------------------------------------------------------
1063  */
hfa384x_usbctlx_complete_sync(struct hfa384x * hw,struct hfa384x_usbctlx * ctlx,struct usbctlx_completor * completor)1064 static int hfa384x_usbctlx_complete_sync(struct hfa384x *hw,
1065 					 struct hfa384x_usbctlx *ctlx,
1066 					 struct usbctlx_completor *completor)
1067 {
1068 	unsigned long flags;
1069 	int result;
1070 
1071 	result = wait_for_completion_interruptible(&ctlx->done);
1072 
1073 	spin_lock_irqsave(&hw->ctlxq.lock, flags);
1074 
1075 	/*
1076 	 * We can only handle the CTLX if the USB disconnect
1077 	 * function has not run yet ...
1078 	 */
1079 cleanup:
1080 	if (hw->wlandev->hwremoved) {
1081 		spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1082 		result = -ENODEV;
1083 	} else if (result != 0) {
1084 		int runqueue = 0;
1085 
1086 		/*
1087 		 * We were probably interrupted, so delete
1088 		 * this CTLX asynchronously, kill the timers
1089 		 * and the URB, and then start the next
1090 		 * pending CTLX.
1091 		 *
1092 		 * NOTE: We can only delete the timers and
1093 		 *       the URB if this CTLX is active.
1094 		 */
1095 		if (ctlx == get_active_ctlx(hw)) {
1096 			spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1097 
1098 			del_timer_sync(&hw->reqtimer);
1099 			del_timer_sync(&hw->resptimer);
1100 			hw->req_timer_done = 1;
1101 			hw->resp_timer_done = 1;
1102 			usb_kill_urb(&hw->ctlx_urb);
1103 
1104 			spin_lock_irqsave(&hw->ctlxq.lock, flags);
1105 
1106 			runqueue = 1;
1107 
1108 			/*
1109 			 * This scenario is so unlikely that I'm
1110 			 * happy with a grubby "goto" solution ...
1111 			 */
1112 			if (hw->wlandev->hwremoved)
1113 				goto cleanup;
1114 		}
1115 
1116 		/*
1117 		 * The completion task will send this CTLX
1118 		 * to the reaper the next time it runs. We
1119 		 * are no longer in a hurry.
1120 		 */
1121 		ctlx->reapable = 1;
1122 		ctlx->state = CTLX_REQ_FAILED;
1123 		list_move_tail(&ctlx->list, &hw->ctlxq.completing);
1124 
1125 		spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1126 
1127 		if (runqueue)
1128 			hfa384x_usbctlxq_run(hw);
1129 	} else {
1130 		if (ctlx->state == CTLX_COMPLETE) {
1131 			result = completor->complete(completor);
1132 		} else {
1133 			netdev_warn(hw->wlandev->netdev, "CTLX[%d] error: state(%s)\n",
1134 				    le16_to_cpu(ctlx->outbuf.type),
1135 				    ctlxstr(ctlx->state));
1136 			result = -EIO;
1137 		}
1138 
1139 		list_del(&ctlx->list);
1140 		spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1141 		kfree(ctlx);
1142 	}
1143 
1144 	return result;
1145 }
1146 
1147 /*----------------------------------------------------------------
1148  * hfa384x_docmd
1149  *
1150  * Constructs a command CTLX and submits it.
1151  *
1152  * NOTE: Any changes to the 'post-submit' code in this function
1153  *       need to be carried over to hfa384x_cbcmd() since the handling
1154  *       is virtually identical.
1155  *
1156  * Arguments:
1157  *	hw		device structure
1158  *       cmd             cmd structure.  Includes all arguments and result
1159  *                       data points.  All in host order. in host order
1160  *
1161  * Returns:
1162  *	0		success
1163  *	-EIO		CTLX failure
1164  *	-ERESTARTSYS	Awakened on signal
1165  *	>0		command indicated error, Status and Resp0-2 are
1166  *			in hw structure.
1167  *
1168  * Side effects:
1169  *
1170  *
1171  * Call context:
1172  *	process
1173  *----------------------------------------------------------------
1174  */
1175 static inline int
hfa384x_docmd(struct hfa384x * hw,struct hfa384x_metacmd * cmd)1176 hfa384x_docmd(struct hfa384x *hw,
1177 	      struct hfa384x_metacmd *cmd)
1178 {
1179 	int result;
1180 	struct hfa384x_usbctlx *ctlx;
1181 
1182 	ctlx = usbctlx_alloc();
1183 	if (!ctlx) {
1184 		result = -ENOMEM;
1185 		goto done;
1186 	}
1187 
1188 	/* Initialize the command */
1189 	ctlx->outbuf.cmdreq.type = cpu_to_le16(HFA384x_USB_CMDREQ);
1190 	ctlx->outbuf.cmdreq.cmd = cpu_to_le16(cmd->cmd);
1191 	ctlx->outbuf.cmdreq.parm0 = cpu_to_le16(cmd->parm0);
1192 	ctlx->outbuf.cmdreq.parm1 = cpu_to_le16(cmd->parm1);
1193 	ctlx->outbuf.cmdreq.parm2 = cpu_to_le16(cmd->parm2);
1194 
1195 	ctlx->outbufsize = sizeof(ctlx->outbuf.cmdreq);
1196 
1197 	pr_debug("cmdreq: cmd=0x%04x parm0=0x%04x parm1=0x%04x parm2=0x%04x\n",
1198 		 cmd->cmd, cmd->parm0, cmd->parm1, cmd->parm2);
1199 
1200 	ctlx->reapable = DOWAIT;
1201 	ctlx->cmdcb = NULL;
1202 	ctlx->usercb = NULL;
1203 	ctlx->usercb_data = NULL;
1204 
1205 	result = hfa384x_usbctlx_submit(hw, ctlx);
1206 	if (result != 0) {
1207 		kfree(ctlx);
1208 	} else {
1209 		struct usbctlx_cmd_completor cmd_completor;
1210 		struct usbctlx_completor *completor;
1211 
1212 		completor = init_cmd_completor(&cmd_completor,
1213 					       &ctlx->inbuf.cmdresp,
1214 					       &cmd->result);
1215 
1216 		result = hfa384x_usbctlx_complete_sync(hw, ctlx, completor);
1217 	}
1218 
1219 done:
1220 	return result;
1221 }
1222 
1223 /*----------------------------------------------------------------
1224  * hfa384x_dorrid
1225  *
1226  * Constructs a read rid CTLX and issues it.
1227  *
1228  * NOTE: Any changes to the 'post-submit' code in this function
1229  *       need to be carried over to hfa384x_cbrrid() since the handling
1230  *       is virtually identical.
1231  *
1232  * Arguments:
1233  *	hw		device structure
1234  *	mode		DOWAIT or DOASYNC
1235  *	rid		Read RID number (host order)
1236  *	riddata		Caller supplied buffer that MAC formatted RID.data
1237  *			record will be written to for DOWAIT calls. Should
1238  *			be NULL for DOASYNC calls.
1239  *	riddatalen	Buffer length for DOWAIT calls. Zero for DOASYNC calls.
1240  *	cmdcb		command callback for async calls, NULL for DOWAIT calls
1241  *	usercb		user callback for async calls, NULL for DOWAIT calls
1242  *	usercb_data	user supplied data pointer for async calls, NULL
1243  *			for DOWAIT calls
1244  *
1245  * Returns:
1246  *	0		success
1247  *	-EIO		CTLX failure
1248  *	-ERESTARTSYS	Awakened on signal
1249  *	-ENODATA	riddatalen != macdatalen
1250  *	>0		command indicated error, Status and Resp0-2 are
1251  *			in hw structure.
1252  *
1253  * Side effects:
1254  *
1255  * Call context:
1256  *	interrupt (DOASYNC)
1257  *	process (DOWAIT or DOASYNC)
1258  *----------------------------------------------------------------
1259  */
1260 static int
hfa384x_dorrid(struct hfa384x * hw,enum cmd_mode mode,u16 rid,void * riddata,unsigned int riddatalen,ctlx_cmdcb_t cmdcb,ctlx_usercb_t usercb,void * usercb_data)1261 hfa384x_dorrid(struct hfa384x *hw,
1262 	       enum cmd_mode mode,
1263 	       u16 rid,
1264 	       void *riddata,
1265 	       unsigned int riddatalen,
1266 	       ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1267 {
1268 	int result;
1269 	struct hfa384x_usbctlx *ctlx;
1270 
1271 	ctlx = usbctlx_alloc();
1272 	if (!ctlx) {
1273 		result = -ENOMEM;
1274 		goto done;
1275 	}
1276 
1277 	/* Initialize the command */
1278 	ctlx->outbuf.rridreq.type = cpu_to_le16(HFA384x_USB_RRIDREQ);
1279 	ctlx->outbuf.rridreq.frmlen =
1280 	    cpu_to_le16(sizeof(ctlx->outbuf.rridreq.rid));
1281 	ctlx->outbuf.rridreq.rid = cpu_to_le16(rid);
1282 
1283 	ctlx->outbufsize = sizeof(ctlx->outbuf.rridreq);
1284 
1285 	ctlx->reapable = mode;
1286 	ctlx->cmdcb = cmdcb;
1287 	ctlx->usercb = usercb;
1288 	ctlx->usercb_data = usercb_data;
1289 
1290 	/* Submit the CTLX */
1291 	result = hfa384x_usbctlx_submit(hw, ctlx);
1292 	if (result != 0) {
1293 		kfree(ctlx);
1294 	} else if (mode == DOWAIT) {
1295 		struct usbctlx_rrid_completor completor;
1296 
1297 		result =
1298 		    hfa384x_usbctlx_complete_sync(hw, ctlx,
1299 						  init_rrid_completor
1300 						  (&completor,
1301 						   &ctlx->inbuf.rridresp,
1302 						   riddata, riddatalen));
1303 	}
1304 
1305 done:
1306 	return result;
1307 }
1308 
1309 /*----------------------------------------------------------------
1310  * hfa384x_dowrid
1311  *
1312  * Constructs a write rid CTLX and issues it.
1313  *
1314  * NOTE: Any changes to the 'post-submit' code in this function
1315  *       need to be carried over to hfa384x_cbwrid() since the handling
1316  *       is virtually identical.
1317  *
1318  * Arguments:
1319  *	hw		device structure
1320  *	enum cmd_mode	DOWAIT or DOASYNC
1321  *	rid		RID code
1322  *	riddata		Data portion of RID formatted for MAC
1323  *	riddatalen	Length of the data portion in bytes
1324  *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1325  *	usercb		user callback for async calls, NULL for DOWAIT calls
1326  *	usercb_data	user supplied data pointer for async calls
1327  *
1328  * Returns:
1329  *	0		success
1330  *	-ETIMEDOUT	timed out waiting for register ready or
1331  *			command completion
1332  *	>0		command indicated error, Status and Resp0-2 are
1333  *			in hw structure.
1334  *
1335  * Side effects:
1336  *
1337  * Call context:
1338  *	interrupt (DOASYNC)
1339  *	process (DOWAIT or DOASYNC)
1340  *----------------------------------------------------------------
1341  */
1342 static int
hfa384x_dowrid(struct hfa384x * hw,enum cmd_mode mode,u16 rid,void * riddata,unsigned int riddatalen,ctlx_cmdcb_t cmdcb,ctlx_usercb_t usercb,void * usercb_data)1343 hfa384x_dowrid(struct hfa384x *hw,
1344 	       enum cmd_mode mode,
1345 	       u16 rid,
1346 	       void *riddata,
1347 	       unsigned int riddatalen,
1348 	       ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1349 {
1350 	int result;
1351 	struct hfa384x_usbctlx *ctlx;
1352 
1353 	ctlx = usbctlx_alloc();
1354 	if (!ctlx) {
1355 		result = -ENOMEM;
1356 		goto done;
1357 	}
1358 
1359 	/* Initialize the command */
1360 	ctlx->outbuf.wridreq.type = cpu_to_le16(HFA384x_USB_WRIDREQ);
1361 	ctlx->outbuf.wridreq.frmlen = cpu_to_le16((sizeof
1362 						   (ctlx->outbuf.wridreq.rid) +
1363 						   riddatalen + 1) / 2);
1364 	ctlx->outbuf.wridreq.rid = cpu_to_le16(rid);
1365 	memcpy(ctlx->outbuf.wridreq.data, riddata, riddatalen);
1366 
1367 	ctlx->outbufsize = sizeof(ctlx->outbuf.wridreq.type) +
1368 	    sizeof(ctlx->outbuf.wridreq.frmlen) +
1369 	    sizeof(ctlx->outbuf.wridreq.rid) + riddatalen;
1370 
1371 	ctlx->reapable = mode;
1372 	ctlx->cmdcb = cmdcb;
1373 	ctlx->usercb = usercb;
1374 	ctlx->usercb_data = usercb_data;
1375 
1376 	/* Submit the CTLX */
1377 	result = hfa384x_usbctlx_submit(hw, ctlx);
1378 	if (result != 0) {
1379 		kfree(ctlx);
1380 	} else if (mode == DOWAIT) {
1381 		struct usbctlx_cmd_completor completor;
1382 		struct hfa384x_cmdresult wridresult;
1383 
1384 		result = hfa384x_usbctlx_complete_sync(hw,
1385 						       ctlx,
1386 						       init_wrid_completor
1387 						       (&completor,
1388 							&ctlx->inbuf.wridresp,
1389 							&wridresult));
1390 	}
1391 
1392 done:
1393 	return result;
1394 }
1395 
1396 /*----------------------------------------------------------------
1397  * hfa384x_dormem
1398  *
1399  * Constructs a readmem CTLX and issues it.
1400  *
1401  * NOTE: Any changes to the 'post-submit' code in this function
1402  *       need to be carried over to hfa384x_cbrmem() since the handling
1403  *       is virtually identical.
1404  *
1405  * Arguments:
1406  *	hw		device structure
1407  *	page		MAC address space page (CMD format)
1408  *	offset		MAC address space offset
1409  *	data		Ptr to data buffer to receive read
1410  *	len		Length of the data to read (max == 2048)
1411  *
1412  * Returns:
1413  *	0		success
1414  *	-ETIMEDOUT	timed out waiting for register ready or
1415  *			command completion
1416  *	>0		command indicated error, Status and Resp0-2 are
1417  *			in hw structure.
1418  *
1419  * Side effects:
1420  *
1421  * Call context:
1422  *	process (DOWAIT)
1423  *----------------------------------------------------------------
1424  */
1425 static int
hfa384x_dormem(struct hfa384x * hw,u16 page,u16 offset,void * data,unsigned int len)1426 hfa384x_dormem(struct hfa384x *hw,
1427 	       u16 page,
1428 	       u16 offset,
1429 	       void *data,
1430 	       unsigned int len)
1431 {
1432 	int result;
1433 	struct hfa384x_usbctlx *ctlx;
1434 
1435 	ctlx = usbctlx_alloc();
1436 	if (!ctlx) {
1437 		result = -ENOMEM;
1438 		goto done;
1439 	}
1440 
1441 	/* Initialize the command */
1442 	ctlx->outbuf.rmemreq.type = cpu_to_le16(HFA384x_USB_RMEMREQ);
1443 	ctlx->outbuf.rmemreq.frmlen =
1444 	    cpu_to_le16(sizeof(ctlx->outbuf.rmemreq.offset) +
1445 			sizeof(ctlx->outbuf.rmemreq.page) + len);
1446 	ctlx->outbuf.rmemreq.offset = cpu_to_le16(offset);
1447 	ctlx->outbuf.rmemreq.page = cpu_to_le16(page);
1448 
1449 	ctlx->outbufsize = sizeof(ctlx->outbuf.rmemreq);
1450 
1451 	pr_debug("type=0x%04x frmlen=%d offset=0x%04x page=0x%04x\n",
1452 		 ctlx->outbuf.rmemreq.type,
1453 		 ctlx->outbuf.rmemreq.frmlen,
1454 		 ctlx->outbuf.rmemreq.offset, ctlx->outbuf.rmemreq.page);
1455 
1456 	pr_debug("pktsize=%zd\n", ROUNDUP64(sizeof(ctlx->outbuf.rmemreq)));
1457 
1458 	ctlx->reapable = DOWAIT;
1459 	ctlx->cmdcb = NULL;
1460 	ctlx->usercb = NULL;
1461 	ctlx->usercb_data = NULL;
1462 
1463 	result = hfa384x_usbctlx_submit(hw, ctlx);
1464 	if (result != 0) {
1465 		kfree(ctlx);
1466 	} else {
1467 		struct usbctlx_rmem_completor completor;
1468 
1469 		result =
1470 		    hfa384x_usbctlx_complete_sync(hw, ctlx,
1471 						  init_rmem_completor
1472 						  (&completor,
1473 						   &ctlx->inbuf.rmemresp, data,
1474 						   len));
1475 	}
1476 
1477 done:
1478 	return result;
1479 }
1480 
1481 /*----------------------------------------------------------------
1482  * hfa384x_dowmem
1483  *
1484  * Constructs a writemem CTLX and issues it.
1485  *
1486  * NOTE: Any changes to the 'post-submit' code in this function
1487  *       need to be carried over to hfa384x_cbwmem() since the handling
1488  *       is virtually identical.
1489  *
1490  * Arguments:
1491  *	hw		device structure
1492  *	page		MAC address space page (CMD format)
1493  *	offset		MAC address space offset
1494  *	data		Ptr to data buffer containing write data
1495  *	len		Length of the data to read (max == 2048)
1496  *
1497  * Returns:
1498  *	0		success
1499  *	-ETIMEDOUT	timed out waiting for register ready or
1500  *			command completion
1501  *	>0		command indicated error, Status and Resp0-2 are
1502  *			in hw structure.
1503  *
1504  * Side effects:
1505  *
1506  * Call context:
1507  *	interrupt (DOWAIT)
1508  *	process (DOWAIT)
1509  *----------------------------------------------------------------
1510  */
1511 static int
hfa384x_dowmem(struct hfa384x * hw,u16 page,u16 offset,void * data,unsigned int len)1512 hfa384x_dowmem(struct hfa384x *hw,
1513 	       u16 page,
1514 	       u16 offset,
1515 	       void *data,
1516 	       unsigned int len)
1517 {
1518 	int result;
1519 	struct hfa384x_usbctlx *ctlx;
1520 
1521 	pr_debug("page=0x%04x offset=0x%04x len=%d\n", page, offset, len);
1522 
1523 	ctlx = usbctlx_alloc();
1524 	if (!ctlx) {
1525 		result = -ENOMEM;
1526 		goto done;
1527 	}
1528 
1529 	/* Initialize the command */
1530 	ctlx->outbuf.wmemreq.type = cpu_to_le16(HFA384x_USB_WMEMREQ);
1531 	ctlx->outbuf.wmemreq.frmlen =
1532 	    cpu_to_le16(sizeof(ctlx->outbuf.wmemreq.offset) +
1533 			sizeof(ctlx->outbuf.wmemreq.page) + len);
1534 	ctlx->outbuf.wmemreq.offset = cpu_to_le16(offset);
1535 	ctlx->outbuf.wmemreq.page = cpu_to_le16(page);
1536 	memcpy(ctlx->outbuf.wmemreq.data, data, len);
1537 
1538 	ctlx->outbufsize = sizeof(ctlx->outbuf.wmemreq.type) +
1539 	    sizeof(ctlx->outbuf.wmemreq.frmlen) +
1540 	    sizeof(ctlx->outbuf.wmemreq.offset) +
1541 	    sizeof(ctlx->outbuf.wmemreq.page) + len;
1542 
1543 	ctlx->reapable = DOWAIT;
1544 	ctlx->cmdcb = NULL;
1545 	ctlx->usercb = NULL;
1546 	ctlx->usercb_data = NULL;
1547 
1548 	result = hfa384x_usbctlx_submit(hw, ctlx);
1549 	if (result != 0) {
1550 		kfree(ctlx);
1551 	} else {
1552 		struct usbctlx_cmd_completor completor;
1553 		struct hfa384x_cmdresult wmemresult;
1554 
1555 		result = hfa384x_usbctlx_complete_sync(hw,
1556 						       ctlx,
1557 						       init_wmem_completor
1558 						       (&completor,
1559 							&ctlx->inbuf.wmemresp,
1560 							&wmemresult));
1561 	}
1562 
1563 done:
1564 	return result;
1565 }
1566 
1567 /*----------------------------------------------------------------
1568  * hfa384x_drvr_disable
1569  *
1570  * Issues the disable command to stop communications on one of
1571  * the MACs 'ports'.  Only macport 0 is valid  for stations.
1572  * APs may also disable macports 1-6.  Only ports that have been
1573  * previously enabled may be disabled.
1574  *
1575  * Arguments:
1576  *	hw		device structure
1577  *	macport		MAC port number (host order)
1578  *
1579  * Returns:
1580  *	0		success
1581  *	>0		f/w reported failure - f/w status code
1582  *	<0		driver reported error (timeout|bad arg)
1583  *
1584  * Side effects:
1585  *
1586  * Call context:
1587  *	process
1588  *----------------------------------------------------------------
1589  */
hfa384x_drvr_disable(struct hfa384x * hw,u16 macport)1590 int hfa384x_drvr_disable(struct hfa384x *hw, u16 macport)
1591 {
1592 	int result = 0;
1593 
1594 	if ((!hw->isap && macport != 0) ||
1595 	    (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1596 	    !(hw->port_enabled[macport])) {
1597 		result = -EINVAL;
1598 	} else {
1599 		result = hfa384x_cmd_disable(hw, macport);
1600 		if (result == 0)
1601 			hw->port_enabled[macport] = 0;
1602 	}
1603 	return result;
1604 }
1605 
1606 /*----------------------------------------------------------------
1607  * hfa384x_drvr_enable
1608  *
1609  * Issues the enable command to enable communications on one of
1610  * the MACs 'ports'.  Only macport 0 is valid  for stations.
1611  * APs may also enable macports 1-6.  Only ports that are currently
1612  * disabled may be enabled.
1613  *
1614  * Arguments:
1615  *	hw		device structure
1616  *	macport		MAC port number
1617  *
1618  * Returns:
1619  *	0		success
1620  *	>0		f/w reported failure - f/w status code
1621  *	<0		driver reported error (timeout|bad arg)
1622  *
1623  * Side effects:
1624  *
1625  * Call context:
1626  *	process
1627  *----------------------------------------------------------------
1628  */
hfa384x_drvr_enable(struct hfa384x * hw,u16 macport)1629 int hfa384x_drvr_enable(struct hfa384x *hw, u16 macport)
1630 {
1631 	int result = 0;
1632 
1633 	if ((!hw->isap && macport != 0) ||
1634 	    (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1635 	    (hw->port_enabled[macport])) {
1636 		result = -EINVAL;
1637 	} else {
1638 		result = hfa384x_cmd_enable(hw, macport);
1639 		if (result == 0)
1640 			hw->port_enabled[macport] = 1;
1641 	}
1642 	return result;
1643 }
1644 
1645 /*----------------------------------------------------------------
1646  * hfa384x_drvr_flashdl_enable
1647  *
1648  * Begins the flash download state.  Checks to see that we're not
1649  * already in a download state and that a port isn't enabled.
1650  * Sets the download state and retrieves the flash download
1651  * buffer location, buffer size, and timeout length.
1652  *
1653  * Arguments:
1654  *	hw		device structure
1655  *
1656  * Returns:
1657  *	0		success
1658  *	>0		f/w reported error - f/w status code
1659  *	<0		driver reported error
1660  *
1661  * Side effects:
1662  *
1663  * Call context:
1664  *	process
1665  *----------------------------------------------------------------
1666  */
hfa384x_drvr_flashdl_enable(struct hfa384x * hw)1667 int hfa384x_drvr_flashdl_enable(struct hfa384x *hw)
1668 {
1669 	int result = 0;
1670 	int i;
1671 
1672 	/* Check that a port isn't active */
1673 	for (i = 0; i < HFA384x_PORTID_MAX; i++) {
1674 		if (hw->port_enabled[i]) {
1675 			pr_debug("called when port enabled.\n");
1676 			return -EINVAL;
1677 		}
1678 	}
1679 
1680 	/* Check that we're not already in a download state */
1681 	if (hw->dlstate != HFA384x_DLSTATE_DISABLED)
1682 		return -EINVAL;
1683 
1684 	/* Retrieve the buffer loc&size and timeout */
1685 	result = hfa384x_drvr_getconfig(hw, HFA384x_RID_DOWNLOADBUFFER,
1686 					&hw->bufinfo, sizeof(hw->bufinfo));
1687 	if (result)
1688 		return result;
1689 
1690 	le16_to_cpus(&hw->bufinfo.page);
1691 	le16_to_cpus(&hw->bufinfo.offset);
1692 	le16_to_cpus(&hw->bufinfo.len);
1693 	result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME,
1694 					  &hw->dltimeout);
1695 	if (result)
1696 		return result;
1697 
1698 	le16_to_cpus(&hw->dltimeout);
1699 
1700 	pr_debug("flashdl_enable\n");
1701 
1702 	hw->dlstate = HFA384x_DLSTATE_FLASHENABLED;
1703 
1704 	return result;
1705 }
1706 
1707 /*----------------------------------------------------------------
1708  * hfa384x_drvr_flashdl_disable
1709  *
1710  * Ends the flash download state.  Note that this will cause the MAC
1711  * firmware to restart.
1712  *
1713  * Arguments:
1714  *	hw		device structure
1715  *
1716  * Returns:
1717  *	0		success
1718  *	>0		f/w reported error - f/w status code
1719  *	<0		driver reported error
1720  *
1721  * Side effects:
1722  *
1723  * Call context:
1724  *	process
1725  *----------------------------------------------------------------
1726  */
hfa384x_drvr_flashdl_disable(struct hfa384x * hw)1727 int hfa384x_drvr_flashdl_disable(struct hfa384x *hw)
1728 {
1729 	/* Check that we're already in the download state */
1730 	if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
1731 		return -EINVAL;
1732 
1733 	pr_debug("flashdl_enable\n");
1734 
1735 	/* There isn't much we can do at this point, so I don't */
1736 	/*  bother  w/ the return value */
1737 	hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0, 0);
1738 	hw->dlstate = HFA384x_DLSTATE_DISABLED;
1739 
1740 	return 0;
1741 }
1742 
1743 /*----------------------------------------------------------------
1744  * hfa384x_drvr_flashdl_write
1745  *
1746  * Performs a FLASH download of a chunk of data. First checks to see
1747  * that we're in the FLASH download state, then sets the download
1748  * mode, uses the aux functions to 1) copy the data to the flash
1749  * buffer, 2) sets the download 'write flash' mode, 3) readback and
1750  * compare.  Lather rinse, repeat as many times an necessary to get
1751  * all the given data into flash.
1752  * When all data has been written using this function (possibly
1753  * repeatedly), call drvr_flashdl_disable() to end the download state
1754  * and restart the MAC.
1755  *
1756  * Arguments:
1757  *	hw		device structure
1758  *	daddr		Card address to write to. (host order)
1759  *	buf		Ptr to data to write.
1760  *	len		Length of data (host order).
1761  *
1762  * Returns:
1763  *	0		success
1764  *	>0		f/w reported error - f/w status code
1765  *	<0		driver reported error
1766  *
1767  * Side effects:
1768  *
1769  * Call context:
1770  *	process
1771  *----------------------------------------------------------------
1772  */
hfa384x_drvr_flashdl_write(struct hfa384x * hw,u32 daddr,void * buf,u32 len)1773 int hfa384x_drvr_flashdl_write(struct hfa384x *hw, u32 daddr,
1774 			       void *buf, u32 len)
1775 {
1776 	int result = 0;
1777 	u32 dlbufaddr;
1778 	int nburns;
1779 	u32 burnlen;
1780 	u32 burndaddr;
1781 	u16 burnlo;
1782 	u16 burnhi;
1783 	int nwrites;
1784 	u8 *writebuf;
1785 	u16 writepage;
1786 	u16 writeoffset;
1787 	u32 writelen;
1788 	int i;
1789 	int j;
1790 
1791 	pr_debug("daddr=0x%08x len=%d\n", daddr, len);
1792 
1793 	/* Check that we're in the flash download state */
1794 	if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
1795 		return -EINVAL;
1796 
1797 	netdev_info(hw->wlandev->netdev,
1798 		    "Download %d bytes to flash @0x%06x\n", len, daddr);
1799 
1800 	/* Convert to flat address for arithmetic */
1801 	/* NOTE: dlbuffer RID stores the address in AUX format */
1802 	dlbufaddr =
1803 	    HFA384x_ADDR_AUX_MKFLAT(hw->bufinfo.page, hw->bufinfo.offset);
1804 	pr_debug("dlbuf.page=0x%04x dlbuf.offset=0x%04x dlbufaddr=0x%08x\n",
1805 		 hw->bufinfo.page, hw->bufinfo.offset, dlbufaddr);
1806 	/* Calculations to determine how many fills of the dlbuffer to do
1807 	 * and how many USB wmemreq's to do for each fill.  At this point
1808 	 * in time, the dlbuffer size and the wmemreq size are the same.
1809 	 * Therefore, nwrites should always be 1.  The extra complexity
1810 	 * here is a hedge against future changes.
1811 	 */
1812 
1813 	/* Figure out how many times to do the flash programming */
1814 	nburns = len / hw->bufinfo.len;
1815 	nburns += (len % hw->bufinfo.len) ? 1 : 0;
1816 
1817 	/* For each flash program cycle, how many USB wmemreq's are needed? */
1818 	nwrites = hw->bufinfo.len / HFA384x_USB_RWMEM_MAXLEN;
1819 	nwrites += (hw->bufinfo.len % HFA384x_USB_RWMEM_MAXLEN) ? 1 : 0;
1820 
1821 	/* For each burn */
1822 	for (i = 0; i < nburns; i++) {
1823 		/* Get the dest address and len */
1824 		burnlen = (len - (hw->bufinfo.len * i)) > hw->bufinfo.len ?
1825 		    hw->bufinfo.len : (len - (hw->bufinfo.len * i));
1826 		burndaddr = daddr + (hw->bufinfo.len * i);
1827 		burnlo = HFA384x_ADDR_CMD_MKOFF(burndaddr);
1828 		burnhi = HFA384x_ADDR_CMD_MKPAGE(burndaddr);
1829 
1830 		netdev_info(hw->wlandev->netdev, "Writing %d bytes to flash @0x%06x\n",
1831 			    burnlen, burndaddr);
1832 
1833 		/* Set the download mode */
1834 		result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_NV,
1835 					      burnlo, burnhi, burnlen);
1836 		if (result) {
1837 			netdev_err(hw->wlandev->netdev,
1838 				   "download(NV,lo=%x,hi=%x,len=%x) cmd failed, result=%d. Aborting d/l\n",
1839 				   burnlo, burnhi, burnlen, result);
1840 			goto exit_proc;
1841 		}
1842 
1843 		/* copy the data to the flash download buffer */
1844 		for (j = 0; j < nwrites; j++) {
1845 			writebuf = buf +
1846 			    (i * hw->bufinfo.len) +
1847 			    (j * HFA384x_USB_RWMEM_MAXLEN);
1848 
1849 			writepage = HFA384x_ADDR_CMD_MKPAGE(dlbufaddr +
1850 						(j * HFA384x_USB_RWMEM_MAXLEN));
1851 			writeoffset = HFA384x_ADDR_CMD_MKOFF(dlbufaddr +
1852 						(j * HFA384x_USB_RWMEM_MAXLEN));
1853 
1854 			writelen = burnlen - (j * HFA384x_USB_RWMEM_MAXLEN);
1855 			writelen = writelen > HFA384x_USB_RWMEM_MAXLEN ?
1856 			    HFA384x_USB_RWMEM_MAXLEN : writelen;
1857 
1858 			result = hfa384x_dowmem(hw,
1859 						writepage,
1860 						writeoffset,
1861 						writebuf, writelen);
1862 		}
1863 
1864 		/* set the download 'write flash' mode */
1865 		result = hfa384x_cmd_download(hw,
1866 					      HFA384x_PROGMODE_NVWRITE,
1867 					      0, 0, 0);
1868 		if (result) {
1869 			netdev_err(hw->wlandev->netdev,
1870 				   "download(NVWRITE,lo=%x,hi=%x,len=%x) cmd failed, result=%d. Aborting d/l\n",
1871 				   burnlo, burnhi, burnlen, result);
1872 			goto exit_proc;
1873 		}
1874 
1875 		/* TODO: We really should do a readback and compare. */
1876 	}
1877 
1878 exit_proc:
1879 
1880 	/* Leave the firmware in the 'post-prog' mode.  flashdl_disable will */
1881 	/*  actually disable programming mode.  Remember, that will cause the */
1882 	/*  the firmware to effectively reset itself. */
1883 
1884 	return result;
1885 }
1886 
1887 /*----------------------------------------------------------------
1888  * hfa384x_drvr_getconfig
1889  *
1890  * Performs the sequence necessary to read a config/info item.
1891  *
1892  * Arguments:
1893  *	hw		device structure
1894  *	rid		config/info record id (host order)
1895  *	buf		host side record buffer.  Upon return it will
1896  *			contain the body portion of the record (minus the
1897  *			RID and len).
1898  *	len		buffer length (in bytes, should match record length)
1899  *
1900  * Returns:
1901  *	0		success
1902  *	>0		f/w reported error - f/w status code
1903  *	<0		driver reported error
1904  *	-ENODATA	length mismatch between argument and retrieved
1905  *			record.
1906  *
1907  * Side effects:
1908  *
1909  * Call context:
1910  *	process
1911  *----------------------------------------------------------------
1912  */
hfa384x_drvr_getconfig(struct hfa384x * hw,u16 rid,void * buf,u16 len)1913 int hfa384x_drvr_getconfig(struct hfa384x *hw, u16 rid, void *buf, u16 len)
1914 {
1915 	return hfa384x_dorrid(hw, DOWAIT, rid, buf, len, NULL, NULL, NULL);
1916 }
1917 
1918 /*----------------------------------------------------------------
1919  * hfa384x_drvr_setconfig_async
1920  *
1921  * Performs the sequence necessary to write a config/info item.
1922  *
1923  * Arguments:
1924  *       hw              device structure
1925  *       rid             config/info record id (in host order)
1926  *       buf             host side record buffer
1927  *       len             buffer length (in bytes)
1928  *       usercb          completion callback
1929  *       usercb_data     completion callback argument
1930  *
1931  * Returns:
1932  *       0               success
1933  *       >0              f/w reported error - f/w status code
1934  *       <0              driver reported error
1935  *
1936  * Side effects:
1937  *
1938  * Call context:
1939  *       process
1940  *----------------------------------------------------------------
1941  */
1942 int
hfa384x_drvr_setconfig_async(struct hfa384x * hw,u16 rid,void * buf,u16 len,ctlx_usercb_t usercb,void * usercb_data)1943 hfa384x_drvr_setconfig_async(struct hfa384x *hw,
1944 			     u16 rid,
1945 			     void *buf,
1946 			     u16 len, ctlx_usercb_t usercb, void *usercb_data)
1947 {
1948 	return hfa384x_dowrid(hw, DOASYNC, rid, buf, len, hfa384x_cb_status,
1949 			      usercb, usercb_data);
1950 }
1951 
1952 /*----------------------------------------------------------------
1953  * hfa384x_drvr_ramdl_disable
1954  *
1955  * Ends the ram download state.
1956  *
1957  * Arguments:
1958  *	hw		device structure
1959  *
1960  * Returns:
1961  *	0		success
1962  *	>0		f/w reported error - f/w status code
1963  *	<0		driver reported error
1964  *
1965  * Side effects:
1966  *
1967  * Call context:
1968  *	process
1969  *----------------------------------------------------------------
1970  */
hfa384x_drvr_ramdl_disable(struct hfa384x * hw)1971 int hfa384x_drvr_ramdl_disable(struct hfa384x *hw)
1972 {
1973 	/* Check that we're already in the download state */
1974 	if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
1975 		return -EINVAL;
1976 
1977 	pr_debug("ramdl_disable()\n");
1978 
1979 	/* There isn't much we can do at this point, so I don't */
1980 	/*  bother  w/ the return value */
1981 	hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0, 0);
1982 	hw->dlstate = HFA384x_DLSTATE_DISABLED;
1983 
1984 	return 0;
1985 }
1986 
1987 /*----------------------------------------------------------------
1988  * hfa384x_drvr_ramdl_enable
1989  *
1990  * Begins the ram download state.  Checks to see that we're not
1991  * already in a download state and that a port isn't enabled.
1992  * Sets the download state and calls cmd_download with the
1993  * ENABLE_VOLATILE subcommand and the exeaddr argument.
1994  *
1995  * Arguments:
1996  *	hw		device structure
1997  *	exeaddr		the card execution address that will be
1998  *                       jumped to when ramdl_disable() is called
1999  *			(host order).
2000  *
2001  * Returns:
2002  *	0		success
2003  *	>0		f/w reported error - f/w status code
2004  *	<0		driver reported error
2005  *
2006  * Side effects:
2007  *
2008  * Call context:
2009  *	process
2010  *----------------------------------------------------------------
2011  */
hfa384x_drvr_ramdl_enable(struct hfa384x * hw,u32 exeaddr)2012 int hfa384x_drvr_ramdl_enable(struct hfa384x *hw, u32 exeaddr)
2013 {
2014 	int result = 0;
2015 	u16 lowaddr;
2016 	u16 hiaddr;
2017 	int i;
2018 
2019 	/* Check that a port isn't active */
2020 	for (i = 0; i < HFA384x_PORTID_MAX; i++) {
2021 		if (hw->port_enabled[i]) {
2022 			netdev_err(hw->wlandev->netdev,
2023 				   "Can't download with a macport enabled.\n");
2024 			return -EINVAL;
2025 		}
2026 	}
2027 
2028 	/* Check that we're not already in a download state */
2029 	if (hw->dlstate != HFA384x_DLSTATE_DISABLED) {
2030 		netdev_err(hw->wlandev->netdev,
2031 			   "Download state not disabled.\n");
2032 		return -EINVAL;
2033 	}
2034 
2035 	pr_debug("ramdl_enable, exeaddr=0x%08x\n", exeaddr);
2036 
2037 	/* Call the download(1,addr) function */
2038 	lowaddr = HFA384x_ADDR_CMD_MKOFF(exeaddr);
2039 	hiaddr = HFA384x_ADDR_CMD_MKPAGE(exeaddr);
2040 
2041 	result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_RAM,
2042 				      lowaddr, hiaddr, 0);
2043 
2044 	if (result == 0) {
2045 		/* Set the download state */
2046 		hw->dlstate = HFA384x_DLSTATE_RAMENABLED;
2047 	} else {
2048 		pr_debug("cmd_download(0x%04x, 0x%04x) failed, result=%d.\n",
2049 			 lowaddr, hiaddr, result);
2050 	}
2051 
2052 	return result;
2053 }
2054 
2055 /*----------------------------------------------------------------
2056  * hfa384x_drvr_ramdl_write
2057  *
2058  * Performs a RAM download of a chunk of data. First checks to see
2059  * that we're in the RAM download state, then uses the [read|write]mem USB
2060  * commands to 1) copy the data, 2) readback and compare.  The download
2061  * state is unaffected.  When all data has been written using
2062  * this function, call drvr_ramdl_disable() to end the download state
2063  * and restart the MAC.
2064  *
2065  * Arguments:
2066  *	hw		device structure
2067  *	daddr		Card address to write to. (host order)
2068  *	buf		Ptr to data to write.
2069  *	len		Length of data (host order).
2070  *
2071  * Returns:
2072  *	0		success
2073  *	>0		f/w reported error - f/w status code
2074  *	<0		driver reported error
2075  *
2076  * Side effects:
2077  *
2078  * Call context:
2079  *	process
2080  *----------------------------------------------------------------
2081  */
hfa384x_drvr_ramdl_write(struct hfa384x * hw,u32 daddr,void * buf,u32 len)2082 int hfa384x_drvr_ramdl_write(struct hfa384x *hw, u32 daddr, void *buf, u32 len)
2083 {
2084 	int result = 0;
2085 	int nwrites;
2086 	u8 *data = buf;
2087 	int i;
2088 	u32 curraddr;
2089 	u16 currpage;
2090 	u16 curroffset;
2091 	u16 currlen;
2092 
2093 	/* Check that we're in the ram download state */
2094 	if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
2095 		return -EINVAL;
2096 
2097 	netdev_info(hw->wlandev->netdev, "Writing %d bytes to ram @0x%06x\n",
2098 		    len, daddr);
2099 
2100 	/* How many dowmem calls?  */
2101 	nwrites = len / HFA384x_USB_RWMEM_MAXLEN;
2102 	nwrites += len % HFA384x_USB_RWMEM_MAXLEN ? 1 : 0;
2103 
2104 	/* Do blocking wmem's */
2105 	for (i = 0; i < nwrites; i++) {
2106 		/* make address args */
2107 		curraddr = daddr + (i * HFA384x_USB_RWMEM_MAXLEN);
2108 		currpage = HFA384x_ADDR_CMD_MKPAGE(curraddr);
2109 		curroffset = HFA384x_ADDR_CMD_MKOFF(curraddr);
2110 		currlen = len - (i * HFA384x_USB_RWMEM_MAXLEN);
2111 		if (currlen > HFA384x_USB_RWMEM_MAXLEN)
2112 			currlen = HFA384x_USB_RWMEM_MAXLEN;
2113 
2114 		/* Do blocking ctlx */
2115 		result = hfa384x_dowmem(hw,
2116 					currpage,
2117 					curroffset,
2118 					data + (i * HFA384x_USB_RWMEM_MAXLEN),
2119 					currlen);
2120 
2121 		if (result)
2122 			break;
2123 
2124 		/* TODO: We really should have a readback. */
2125 	}
2126 
2127 	return result;
2128 }
2129 
2130 /*----------------------------------------------------------------
2131  * hfa384x_drvr_readpda
2132  *
2133  * Performs the sequence to read the PDA space.  Note there is no
2134  * drvr_writepda() function.  Writing a PDA is
2135  * generally implemented by a calling component via calls to
2136  * cmd_download and writing to the flash download buffer via the
2137  * aux regs.
2138  *
2139  * Arguments:
2140  *	hw		device structure
2141  *	buf		buffer to store PDA in
2142  *	len		buffer length
2143  *
2144  * Returns:
2145  *	0		success
2146  *	>0		f/w reported error - f/w status code
2147  *	<0		driver reported error
2148  *	-ETIMEDOUT	timeout waiting for the cmd regs to become
2149  *			available, or waiting for the control reg
2150  *			to indicate the Aux port is enabled.
2151  *	-ENODATA	the buffer does NOT contain a valid PDA.
2152  *			Either the card PDA is bad, or the auxdata
2153  *			reads are giving us garbage.
2154  *
2155  *
2156  * Side effects:
2157  *
2158  * Call context:
2159  *	process or non-card interrupt.
2160  *----------------------------------------------------------------
2161  */
hfa384x_drvr_readpda(struct hfa384x * hw,void * buf,unsigned int len)2162 int hfa384x_drvr_readpda(struct hfa384x *hw, void *buf, unsigned int len)
2163 {
2164 	int result = 0;
2165 	__le16 *pda = buf;
2166 	int pdaok = 0;
2167 	int morepdrs = 1;
2168 	int currpdr = 0;	/* word offset of the current pdr */
2169 	size_t i;
2170 	u16 pdrlen;		/* pdr length in bytes, host order */
2171 	u16 pdrcode;		/* pdr code, host order */
2172 	u16 currpage;
2173 	u16 curroffset;
2174 	struct pdaloc {
2175 		u32 cardaddr;
2176 		u16 auxctl;
2177 	} pdaloc[] = {
2178 		{
2179 		HFA3842_PDA_BASE, 0}, {
2180 		HFA3841_PDA_BASE, 0}, {
2181 		HFA3841_PDA_BOGUS_BASE, 0}
2182 	};
2183 
2184 	/* Read the pda from each known address.  */
2185 	for (i = 0; i < ARRAY_SIZE(pdaloc); i++) {
2186 		/* Make address */
2187 		currpage = HFA384x_ADDR_CMD_MKPAGE(pdaloc[i].cardaddr);
2188 		curroffset = HFA384x_ADDR_CMD_MKOFF(pdaloc[i].cardaddr);
2189 
2190 		/* units of bytes */
2191 		result = hfa384x_dormem(hw, currpage, curroffset, buf,
2192 					len);
2193 
2194 		if (result) {
2195 			netdev_warn(hw->wlandev->netdev,
2196 				    "Read from index %zd failed, continuing\n",
2197 				    i);
2198 			continue;
2199 		}
2200 
2201 		/* Test for garbage */
2202 		pdaok = 1;	/* initially assume good */
2203 		morepdrs = 1;
2204 		while (pdaok && morepdrs) {
2205 			pdrlen = le16_to_cpu(pda[currpdr]) * 2;
2206 			pdrcode = le16_to_cpu(pda[currpdr + 1]);
2207 			/* Test the record length */
2208 			if (pdrlen > HFA384x_PDR_LEN_MAX || pdrlen == 0) {
2209 				netdev_err(hw->wlandev->netdev,
2210 					   "pdrlen invalid=%d\n", pdrlen);
2211 				pdaok = 0;
2212 				break;
2213 			}
2214 			/* Test the code */
2215 			if (!hfa384x_isgood_pdrcode(pdrcode)) {
2216 				netdev_err(hw->wlandev->netdev, "pdrcode invalid=%d\n",
2217 					   pdrcode);
2218 				pdaok = 0;
2219 				break;
2220 			}
2221 			/* Test for completion */
2222 			if (pdrcode == HFA384x_PDR_END_OF_PDA)
2223 				morepdrs = 0;
2224 
2225 			/* Move to the next pdr (if necessary) */
2226 			if (morepdrs) {
2227 				/* note the access to pda[], need words here */
2228 				currpdr += le16_to_cpu(pda[currpdr]) + 1;
2229 			}
2230 		}
2231 		if (pdaok) {
2232 			netdev_info(hw->wlandev->netdev,
2233 				    "PDA Read from 0x%08x in %s space.\n",
2234 				    pdaloc[i].cardaddr,
2235 				    pdaloc[i].auxctl == 0 ? "EXTDS" :
2236 				    pdaloc[i].auxctl == 1 ? "NV" :
2237 				    pdaloc[i].auxctl == 2 ? "PHY" :
2238 				    pdaloc[i].auxctl == 3 ? "ICSRAM" :
2239 				    "<bogus auxctl>");
2240 			break;
2241 		}
2242 	}
2243 	result = pdaok ? 0 : -ENODATA;
2244 
2245 	if (result)
2246 		pr_debug("Failure: pda is not okay\n");
2247 
2248 	return result;
2249 }
2250 
2251 /*----------------------------------------------------------------
2252  * hfa384x_drvr_setconfig
2253  *
2254  * Performs the sequence necessary to write a config/info item.
2255  *
2256  * Arguments:
2257  *	hw		device structure
2258  *	rid		config/info record id (in host order)
2259  *	buf		host side record buffer
2260  *	len		buffer length (in bytes)
2261  *
2262  * Returns:
2263  *	0		success
2264  *	>0		f/w reported error - f/w status code
2265  *	<0		driver reported error
2266  *
2267  * Side effects:
2268  *
2269  * Call context:
2270  *	process
2271  *----------------------------------------------------------------
2272  */
hfa384x_drvr_setconfig(struct hfa384x * hw,u16 rid,void * buf,u16 len)2273 int hfa384x_drvr_setconfig(struct hfa384x *hw, u16 rid, void *buf, u16 len)
2274 {
2275 	return hfa384x_dowrid(hw, DOWAIT, rid, buf, len, NULL, NULL, NULL);
2276 }
2277 
2278 /*----------------------------------------------------------------
2279  * hfa384x_drvr_start
2280  *
2281  * Issues the MAC initialize command, sets up some data structures,
2282  * and enables the interrupts.  After this function completes, the
2283  * low-level stuff should be ready for any/all commands.
2284  *
2285  * Arguments:
2286  *	hw		device structure
2287  * Returns:
2288  *	0		success
2289  *	>0		f/w reported error - f/w status code
2290  *	<0		driver reported error
2291  *
2292  * Side effects:
2293  *
2294  * Call context:
2295  *	process
2296  *----------------------------------------------------------------
2297  */
hfa384x_drvr_start(struct hfa384x * hw)2298 int hfa384x_drvr_start(struct hfa384x *hw)
2299 {
2300 	int result, result1, result2;
2301 	u16 status;
2302 
2303 	might_sleep();
2304 
2305 	/* Clear endpoint stalls - but only do this if the endpoint
2306 	 * is showing a stall status. Some prism2 cards seem to behave
2307 	 * badly if a clear_halt is called when the endpoint is already
2308 	 * ok
2309 	 */
2310 	result =
2311 	    usb_get_std_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_in,
2312 			       &status);
2313 	if (result < 0) {
2314 		netdev_err(hw->wlandev->netdev, "Cannot get bulk in endpoint status.\n");
2315 		goto done;
2316 	}
2317 	if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_in))
2318 		netdev_err(hw->wlandev->netdev, "Failed to reset bulk in endpoint.\n");
2319 
2320 	result =
2321 	    usb_get_std_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_out,
2322 			       &status);
2323 	if (result < 0) {
2324 		netdev_err(hw->wlandev->netdev, "Cannot get bulk out endpoint status.\n");
2325 		goto done;
2326 	}
2327 	if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_out))
2328 		netdev_err(hw->wlandev->netdev, "Failed to reset bulk out endpoint.\n");
2329 
2330 	/* Synchronous unlink, in case we're trying to restart the driver */
2331 	usb_kill_urb(&hw->rx_urb);
2332 
2333 	/* Post the IN urb */
2334 	result = submit_rx_urb(hw, GFP_KERNEL);
2335 	if (result != 0) {
2336 		netdev_err(hw->wlandev->netdev,
2337 			   "Fatal, failed to submit RX URB, result=%d\n",
2338 			   result);
2339 		goto done;
2340 	}
2341 
2342 	/* Call initialize twice, with a 1 second sleep in between.
2343 	 * This is a nasty work-around since many prism2 cards seem to
2344 	 * need time to settle after an init from cold. The second
2345 	 * call to initialize in theory is not necessary - but we call
2346 	 * it anyway as a double insurance policy:
2347 	 * 1) If the first init should fail, the second may well succeed
2348 	 *    and the card can still be used
2349 	 * 2) It helps ensures all is well with the card after the first
2350 	 *    init and settle time.
2351 	 */
2352 	result1 = hfa384x_cmd_initialize(hw);
2353 	msleep(1000);
2354 	result = hfa384x_cmd_initialize(hw);
2355 	result2 = result;
2356 	if (result1 != 0) {
2357 		if (result2 != 0) {
2358 			netdev_err(hw->wlandev->netdev,
2359 				   "cmd_initialize() failed on two attempts, results %d and %d\n",
2360 				   result1, result2);
2361 			usb_kill_urb(&hw->rx_urb);
2362 			goto done;
2363 		} else {
2364 			pr_debug("First cmd_initialize() failed (result %d),\n",
2365 				 result1);
2366 			pr_debug("but second attempt succeeded. All should be ok\n");
2367 		}
2368 	} else if (result2 != 0) {
2369 		netdev_warn(hw->wlandev->netdev, "First cmd_initialize() succeeded, but second attempt failed (result=%d)\n",
2370 			    result2);
2371 		netdev_warn(hw->wlandev->netdev,
2372 			    "Most likely the card will be functional\n");
2373 		goto done;
2374 	}
2375 
2376 	hw->state = HFA384x_STATE_RUNNING;
2377 
2378 done:
2379 	return result;
2380 }
2381 
2382 /*----------------------------------------------------------------
2383  * hfa384x_drvr_stop
2384  *
2385  * Shuts down the MAC to the point where it is safe to unload the
2386  * driver.  Any subsystem that may be holding a data or function
2387  * ptr into the driver must be cleared/deinitialized.
2388  *
2389  * Arguments:
2390  *	hw		device structure
2391  * Returns:
2392  *	0		success
2393  *	>0		f/w reported error - f/w status code
2394  *	<0		driver reported error
2395  *
2396  * Side effects:
2397  *
2398  * Call context:
2399  *	process
2400  *----------------------------------------------------------------
2401  */
hfa384x_drvr_stop(struct hfa384x * hw)2402 int hfa384x_drvr_stop(struct hfa384x *hw)
2403 {
2404 	int i;
2405 
2406 	might_sleep();
2407 
2408 	/* There's no need for spinlocks here. The USB "disconnect"
2409 	 * function sets this "removed" flag and then calls us.
2410 	 */
2411 	if (!hw->wlandev->hwremoved) {
2412 		/* Call initialize to leave the MAC in its 'reset' state */
2413 		hfa384x_cmd_initialize(hw);
2414 
2415 		/* Cancel the rxurb */
2416 		usb_kill_urb(&hw->rx_urb);
2417 	}
2418 
2419 	hw->link_status = HFA384x_LINK_NOTCONNECTED;
2420 	hw->state = HFA384x_STATE_INIT;
2421 
2422 	del_timer_sync(&hw->commsqual_timer);
2423 
2424 	/* Clear all the port status */
2425 	for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
2426 		hw->port_enabled[i] = 0;
2427 
2428 	return 0;
2429 }
2430 
2431 /*----------------------------------------------------------------
2432  * hfa384x_drvr_txframe
2433  *
2434  * Takes a frame from prism2sta and queues it for transmission.
2435  *
2436  * Arguments:
2437  *	hw		device structure
2438  *	skb		packet buffer struct.  Contains an 802.11
2439  *			data frame.
2440  *       p80211_hdr      points to the 802.11 header for the packet.
2441  * Returns:
2442  *	0		Success and more buffs available
2443  *	1		Success but no more buffs
2444  *	2		Allocation failure
2445  *	4		Buffer full or queue busy
2446  *
2447  * Side effects:
2448  *
2449  * Call context:
2450  *	interrupt
2451  *----------------------------------------------------------------
2452  */
hfa384x_drvr_txframe(struct hfa384x * hw,struct sk_buff * skb,struct p80211_hdr * p80211_hdr,struct p80211_metawep * p80211_wep)2453 int hfa384x_drvr_txframe(struct hfa384x *hw, struct sk_buff *skb,
2454 			 struct p80211_hdr *p80211_hdr,
2455 			 struct p80211_metawep *p80211_wep)
2456 {
2457 	int usbpktlen = sizeof(struct hfa384x_tx_frame);
2458 	int result;
2459 	int ret;
2460 	char *ptr;
2461 
2462 	if (hw->tx_urb.status == -EINPROGRESS) {
2463 		netdev_warn(hw->wlandev->netdev, "TX URB already in use\n");
2464 		result = 3;
2465 		goto exit;
2466 	}
2467 
2468 	/* Build Tx frame structure */
2469 	/* Set up the control field */
2470 	memset(&hw->txbuff.txfrm.desc, 0, sizeof(hw->txbuff.txfrm.desc));
2471 
2472 	/* Setup the usb type field */
2473 	hw->txbuff.type = cpu_to_le16(HFA384x_USB_TXFRM);
2474 
2475 	/* Set up the sw_support field to identify this frame */
2476 	hw->txbuff.txfrm.desc.sw_support = 0x0123;
2477 
2478 /* Tx complete and Tx exception disable per dleach.  Might be causing
2479  * buf depletion
2480  */
2481 /* #define DOEXC  SLP -- doboth breaks horribly under load, doexc less so. */
2482 #if defined(DOBOTH)
2483 	hw->txbuff.txfrm.desc.tx_control =
2484 	    HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2485 	    HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(1);
2486 #elif defined(DOEXC)
2487 	hw->txbuff.txfrm.desc.tx_control =
2488 	    HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2489 	    HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(0);
2490 #else
2491 	hw->txbuff.txfrm.desc.tx_control =
2492 	    HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2493 	    HFA384x_TX_TXEX_SET(0) | HFA384x_TX_TXOK_SET(0);
2494 #endif
2495 	cpu_to_le16s(&hw->txbuff.txfrm.desc.tx_control);
2496 
2497 	/* copy the header over to the txdesc */
2498 	hw->txbuff.txfrm.desc.hdr = *p80211_hdr;
2499 
2500 	/* if we're using host WEP, increase size by IV+ICV */
2501 	if (p80211_wep->data) {
2502 		hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len + 8);
2503 		usbpktlen += 8;
2504 	} else {
2505 		hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len);
2506 	}
2507 
2508 	usbpktlen += skb->len;
2509 
2510 	/* copy over the WEP IV if we are using host WEP */
2511 	ptr = hw->txbuff.txfrm.data;
2512 	if (p80211_wep->data) {
2513 		memcpy(ptr, p80211_wep->iv, sizeof(p80211_wep->iv));
2514 		ptr += sizeof(p80211_wep->iv);
2515 		memcpy(ptr, p80211_wep->data, skb->len);
2516 	} else {
2517 		memcpy(ptr, skb->data, skb->len);
2518 	}
2519 	/* copy over the packet data */
2520 	ptr += skb->len;
2521 
2522 	/* copy over the WEP ICV if we are using host WEP */
2523 	if (p80211_wep->data)
2524 		memcpy(ptr, p80211_wep->icv, sizeof(p80211_wep->icv));
2525 
2526 	/* Send the USB packet */
2527 	usb_fill_bulk_urb(&hw->tx_urb, hw->usb,
2528 			  hw->endp_out,
2529 			  &hw->txbuff, ROUNDUP64(usbpktlen),
2530 			  hfa384x_usbout_callback, hw->wlandev);
2531 	hw->tx_urb.transfer_flags |= USB_QUEUE_BULK;
2532 
2533 	result = 1;
2534 	ret = submit_tx_urb(hw, &hw->tx_urb, GFP_ATOMIC);
2535 	if (ret != 0) {
2536 		netdev_err(hw->wlandev->netdev,
2537 			   "submit_tx_urb() failed, error=%d\n", ret);
2538 		result = 3;
2539 	}
2540 
2541 exit:
2542 	return result;
2543 }
2544 
hfa384x_tx_timeout(struct wlandevice * wlandev)2545 void hfa384x_tx_timeout(struct wlandevice *wlandev)
2546 {
2547 	struct hfa384x *hw = wlandev->priv;
2548 	unsigned long flags;
2549 
2550 	spin_lock_irqsave(&hw->ctlxq.lock, flags);
2551 
2552 	if (!hw->wlandev->hwremoved) {
2553 		int sched;
2554 
2555 		sched = !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags);
2556 		sched |= !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags);
2557 		if (sched)
2558 			schedule_work(&hw->usb_work);
2559 	}
2560 
2561 	spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2562 }
2563 
2564 /*----------------------------------------------------------------
2565  * hfa384x_usbctlx_reaper_task
2566  *
2567  * Deferred work callback to delete dead CTLX objects
2568  *
2569  * Arguments:
2570  *	work	contains ptr to a struct hfa384x
2571  *
2572  * Returns:
2573  *
2574  * Call context:
2575  *      Task
2576  *----------------------------------------------------------------
2577  */
hfa384x_usbctlx_reaper_task(struct work_struct * work)2578 static void hfa384x_usbctlx_reaper_task(struct work_struct *work)
2579 {
2580 	struct hfa384x *hw = container_of(work, struct hfa384x, reaper_bh);
2581 	struct hfa384x_usbctlx *ctlx, *temp;
2582 	unsigned long flags;
2583 
2584 	spin_lock_irqsave(&hw->ctlxq.lock, flags);
2585 
2586 	/* This list is guaranteed to be empty if someone
2587 	 * has unplugged the adapter.
2588 	 */
2589 	list_for_each_entry_safe(ctlx, temp, &hw->ctlxq.reapable, list) {
2590 		list_del(&ctlx->list);
2591 		kfree(ctlx);
2592 	}
2593 
2594 	spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2595 }
2596 
2597 /*----------------------------------------------------------------
2598  * hfa384x_usbctlx_completion_task
2599  *
2600  * Deferred work callback to call completion handlers for returned CTLXs
2601  *
2602  * Arguments:
2603  *	work	contains ptr to a struct hfa384x
2604  *
2605  * Returns:
2606  *	Nothing
2607  *
2608  * Call context:
2609  *      Task
2610  *----------------------------------------------------------------
2611  */
hfa384x_usbctlx_completion_task(struct work_struct * work)2612 static void hfa384x_usbctlx_completion_task(struct work_struct *work)
2613 {
2614 	struct hfa384x *hw = container_of(work, struct hfa384x, completion_bh);
2615 	struct hfa384x_usbctlx *ctlx, *temp;
2616 	unsigned long flags;
2617 
2618 	int reap = 0;
2619 
2620 	spin_lock_irqsave(&hw->ctlxq.lock, flags);
2621 
2622 	/* This list is guaranteed to be empty if someone
2623 	 * has unplugged the adapter ...
2624 	 */
2625 	list_for_each_entry_safe(ctlx, temp, &hw->ctlxq.completing, list) {
2626 		/* Call the completion function that this
2627 		 * command was assigned, assuming it has one.
2628 		 */
2629 		if (ctlx->cmdcb) {
2630 			spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2631 			ctlx->cmdcb(hw, ctlx);
2632 			spin_lock_irqsave(&hw->ctlxq.lock, flags);
2633 
2634 			/* Make sure we don't try and complete
2635 			 * this CTLX more than once!
2636 			 */
2637 			ctlx->cmdcb = NULL;
2638 
2639 			/* Did someone yank the adapter out
2640 			 * while our list was (briefly) unlocked?
2641 			 */
2642 			if (hw->wlandev->hwremoved) {
2643 				reap = 0;
2644 				break;
2645 			}
2646 		}
2647 
2648 		/*
2649 		 * "Reapable" CTLXs are ones which don't have any
2650 		 * threads waiting for them to die. Hence they must
2651 		 * be delivered to The Reaper!
2652 		 */
2653 		if (ctlx->reapable) {
2654 			/* Move the CTLX off the "completing" list (hopefully)
2655 			 * on to the "reapable" list where the reaper task
2656 			 * can find it. And "reapable" means that this CTLX
2657 			 * isn't sitting on a wait-queue somewhere.
2658 			 */
2659 			list_move_tail(&ctlx->list, &hw->ctlxq.reapable);
2660 			reap = 1;
2661 		}
2662 
2663 		complete(&ctlx->done);
2664 	}
2665 	spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2666 
2667 	if (reap)
2668 		schedule_work(&hw->reaper_bh);
2669 }
2670 
2671 /*----------------------------------------------------------------
2672  * unlocked_usbctlx_cancel_async
2673  *
2674  * Mark the CTLX dead asynchronously, and ensure that the
2675  * next command on the queue is run afterwards.
2676  *
2677  * Arguments:
2678  *	hw	ptr to the struct hfa384x structure
2679  *	ctlx	ptr to a CTLX structure
2680  *
2681  * Returns:
2682  *	0	the CTLX's URB is inactive
2683  * -EINPROGRESS	the URB is currently being unlinked
2684  *
2685  * Call context:
2686  *	Either process or interrupt, but presumably interrupt
2687  *----------------------------------------------------------------
2688  */
unlocked_usbctlx_cancel_async(struct hfa384x * hw,struct hfa384x_usbctlx * ctlx)2689 static int unlocked_usbctlx_cancel_async(struct hfa384x *hw,
2690 					 struct hfa384x_usbctlx *ctlx)
2691 {
2692 	int ret;
2693 
2694 	/*
2695 	 * Try to delete the URB containing our request packet.
2696 	 * If we succeed, then its completion handler will be
2697 	 * called with a status of -ECONNRESET.
2698 	 */
2699 	hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
2700 	ret = usb_unlink_urb(&hw->ctlx_urb);
2701 
2702 	if (ret != -EINPROGRESS) {
2703 		/*
2704 		 * The OUT URB had either already completed
2705 		 * or was still in the pending queue, so the
2706 		 * URB's completion function will not be called.
2707 		 * We will have to complete the CTLX ourselves.
2708 		 */
2709 		ctlx->state = CTLX_REQ_FAILED;
2710 		unlocked_usbctlx_complete(hw, ctlx);
2711 		ret = 0;
2712 	}
2713 
2714 	return ret;
2715 }
2716 
2717 /*----------------------------------------------------------------
2718  * unlocked_usbctlx_complete
2719  *
2720  * A CTLX has completed.  It may have been successful, it may not
2721  * have been. At this point, the CTLX should be quiescent.  The URBs
2722  * aren't active and the timers should have been stopped.
2723  *
2724  * The CTLX is migrated to the "completing" queue, and the completing
2725  * work is scheduled.
2726  *
2727  * Arguments:
2728  *	hw		ptr to a struct hfa384x structure
2729  *	ctlx		ptr to a ctlx structure
2730  *
2731  * Returns:
2732  *	nothing
2733  *
2734  * Side effects:
2735  *
2736  * Call context:
2737  *	Either, assume interrupt
2738  *----------------------------------------------------------------
2739  */
unlocked_usbctlx_complete(struct hfa384x * hw,struct hfa384x_usbctlx * ctlx)2740 static void unlocked_usbctlx_complete(struct hfa384x *hw,
2741 				      struct hfa384x_usbctlx *ctlx)
2742 {
2743 	/* Timers have been stopped, and ctlx should be in
2744 	 * a terminal state. Retire it from the "active"
2745 	 * queue.
2746 	 */
2747 	list_move_tail(&ctlx->list, &hw->ctlxq.completing);
2748 	schedule_work(&hw->completion_bh);
2749 
2750 	switch (ctlx->state) {
2751 	case CTLX_COMPLETE:
2752 	case CTLX_REQ_FAILED:
2753 		/* This are the correct terminating states. */
2754 		break;
2755 
2756 	default:
2757 		netdev_err(hw->wlandev->netdev, "CTLX[%d] not in a terminating state(%s)\n",
2758 			   le16_to_cpu(ctlx->outbuf.type),
2759 			   ctlxstr(ctlx->state));
2760 		break;
2761 	}			/* switch */
2762 }
2763 
2764 /*----------------------------------------------------------------
2765  * hfa384x_usbctlxq_run
2766  *
2767  * Checks to see if the head item is running.  If not, starts it.
2768  *
2769  * Arguments:
2770  *	hw	ptr to struct hfa384x
2771  *
2772  * Returns:
2773  *	nothing
2774  *
2775  * Side effects:
2776  *
2777  * Call context:
2778  *	any
2779  *----------------------------------------------------------------
2780  */
hfa384x_usbctlxq_run(struct hfa384x * hw)2781 static void hfa384x_usbctlxq_run(struct hfa384x *hw)
2782 {
2783 	unsigned long flags;
2784 
2785 	/* acquire lock */
2786 	spin_lock_irqsave(&hw->ctlxq.lock, flags);
2787 
2788 	/* Only one active CTLX at any one time, because there's no
2789 	 * other (reliable) way to match the response URB to the
2790 	 * correct CTLX.
2791 	 *
2792 	 * Don't touch any of these CTLXs if the hardware
2793 	 * has been removed or the USB subsystem is stalled.
2794 	 */
2795 	if (!list_empty(&hw->ctlxq.active) ||
2796 	    test_bit(WORK_TX_HALT, &hw->usb_flags) || hw->wlandev->hwremoved)
2797 		goto unlock;
2798 
2799 	while (!list_empty(&hw->ctlxq.pending)) {
2800 		struct hfa384x_usbctlx *head;
2801 		int result;
2802 
2803 		/* This is the first pending command */
2804 		head = list_entry(hw->ctlxq.pending.next,
2805 				  struct hfa384x_usbctlx, list);
2806 
2807 		/* We need to split this off to avoid a race condition */
2808 		list_move_tail(&head->list, &hw->ctlxq.active);
2809 
2810 		/* Fill the out packet */
2811 		usb_fill_bulk_urb(&hw->ctlx_urb, hw->usb,
2812 				  hw->endp_out,
2813 				  &head->outbuf, ROUNDUP64(head->outbufsize),
2814 				  hfa384x_ctlxout_callback, hw);
2815 		hw->ctlx_urb.transfer_flags |= USB_QUEUE_BULK;
2816 
2817 		/* Now submit the URB and update the CTLX's state */
2818 		result = usb_submit_urb(&hw->ctlx_urb, GFP_ATOMIC);
2819 		if (result == 0) {
2820 			/* This CTLX is now running on the active queue */
2821 			head->state = CTLX_REQ_SUBMITTED;
2822 
2823 			/* Start the OUT wait timer */
2824 			hw->req_timer_done = 0;
2825 			hw->reqtimer.expires = jiffies + HZ;
2826 			add_timer(&hw->reqtimer);
2827 
2828 			/* Start the IN wait timer */
2829 			hw->resp_timer_done = 0;
2830 			hw->resptimer.expires = jiffies + 2 * HZ;
2831 			add_timer(&hw->resptimer);
2832 
2833 			break;
2834 		}
2835 
2836 		if (result == -EPIPE) {
2837 			/* The OUT pipe needs resetting, so put
2838 			 * this CTLX back in the "pending" queue
2839 			 * and schedule a reset ...
2840 			 */
2841 			netdev_warn(hw->wlandev->netdev,
2842 				    "%s tx pipe stalled: requesting reset\n",
2843 				    hw->wlandev->netdev->name);
2844 			list_move(&head->list, &hw->ctlxq.pending);
2845 			set_bit(WORK_TX_HALT, &hw->usb_flags);
2846 			schedule_work(&hw->usb_work);
2847 			break;
2848 		}
2849 
2850 		if (result == -ESHUTDOWN) {
2851 			netdev_warn(hw->wlandev->netdev, "%s urb shutdown!\n",
2852 				    hw->wlandev->netdev->name);
2853 			break;
2854 		}
2855 
2856 		netdev_err(hw->wlandev->netdev, "Failed to submit CTLX[%d]: error=%d\n",
2857 			   le16_to_cpu(head->outbuf.type), result);
2858 		unlocked_usbctlx_complete(hw, head);
2859 	}			/* while */
2860 
2861 unlock:
2862 	spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2863 }
2864 
2865 /*----------------------------------------------------------------
2866  * hfa384x_usbin_callback
2867  *
2868  * Callback for URBs on the BULKIN endpoint.
2869  *
2870  * Arguments:
2871  *	urb		ptr to the completed urb
2872  *
2873  * Returns:
2874  *	nothing
2875  *
2876  * Side effects:
2877  *
2878  * Call context:
2879  *	interrupt
2880  *----------------------------------------------------------------
2881  */
hfa384x_usbin_callback(struct urb * urb)2882 static void hfa384x_usbin_callback(struct urb *urb)
2883 {
2884 	struct wlandevice *wlandev = urb->context;
2885 	struct hfa384x *hw;
2886 	union hfa384x_usbin *usbin;
2887 	struct sk_buff *skb = NULL;
2888 	int result;
2889 	int urb_status;
2890 	u16 type;
2891 
2892 	enum USBIN_ACTION {
2893 		HANDLE,
2894 		RESUBMIT,
2895 		ABORT
2896 	} action;
2897 
2898 	if (!wlandev || !wlandev->netdev || wlandev->hwremoved)
2899 		goto exit;
2900 
2901 	hw = wlandev->priv;
2902 	if (!hw)
2903 		goto exit;
2904 
2905 	skb = hw->rx_urb_skb;
2906 	if (!skb || (skb->data != urb->transfer_buffer)) {
2907 		WARN_ON(1);
2908 		return;
2909 	}
2910 
2911 	hw->rx_urb_skb = NULL;
2912 
2913 	/* Check for error conditions within the URB */
2914 	switch (urb->status) {
2915 	case 0:
2916 		action = HANDLE;
2917 
2918 		/* Check for short packet */
2919 		if (urb->actual_length == 0) {
2920 			wlandev->netdev->stats.rx_errors++;
2921 			wlandev->netdev->stats.rx_length_errors++;
2922 			action = RESUBMIT;
2923 		}
2924 		break;
2925 
2926 	case -EPIPE:
2927 		netdev_warn(hw->wlandev->netdev, "%s rx pipe stalled: requesting reset\n",
2928 			    wlandev->netdev->name);
2929 		if (!test_and_set_bit(WORK_RX_HALT, &hw->usb_flags))
2930 			schedule_work(&hw->usb_work);
2931 		wlandev->netdev->stats.rx_errors++;
2932 		action = ABORT;
2933 		break;
2934 
2935 	case -EILSEQ:
2936 	case -ETIMEDOUT:
2937 	case -EPROTO:
2938 		if (!test_and_set_bit(THROTTLE_RX, &hw->usb_flags) &&
2939 		    !timer_pending(&hw->throttle)) {
2940 			mod_timer(&hw->throttle, jiffies + THROTTLE_JIFFIES);
2941 		}
2942 		wlandev->netdev->stats.rx_errors++;
2943 		action = ABORT;
2944 		break;
2945 
2946 	case -EOVERFLOW:
2947 		wlandev->netdev->stats.rx_over_errors++;
2948 		action = RESUBMIT;
2949 		break;
2950 
2951 	case -ENODEV:
2952 	case -ESHUTDOWN:
2953 		pr_debug("status=%d, device removed.\n", urb->status);
2954 		action = ABORT;
2955 		break;
2956 
2957 	case -ENOENT:
2958 	case -ECONNRESET:
2959 		pr_debug("status=%d, urb explicitly unlinked.\n", urb->status);
2960 		action = ABORT;
2961 		break;
2962 
2963 	default:
2964 		pr_debug("urb status=%d, transfer flags=0x%x\n",
2965 			 urb->status, urb->transfer_flags);
2966 		wlandev->netdev->stats.rx_errors++;
2967 		action = RESUBMIT;
2968 		break;
2969 	}
2970 
2971 	/* Save values from the RX URB before reposting overwrites it. */
2972 	urb_status = urb->status;
2973 	usbin = (union hfa384x_usbin *)urb->transfer_buffer;
2974 
2975 	if (action != ABORT) {
2976 		/* Repost the RX URB */
2977 		result = submit_rx_urb(hw, GFP_ATOMIC);
2978 
2979 		if (result != 0) {
2980 			netdev_err(hw->wlandev->netdev,
2981 				   "Fatal, failed to resubmit rx_urb. error=%d\n",
2982 				   result);
2983 		}
2984 	}
2985 
2986 	/* Handle any USB-IN packet */
2987 	/* Note: the check of the sw_support field, the type field doesn't
2988 	 *       have bit 12 set like the docs suggest.
2989 	 */
2990 	type = le16_to_cpu(usbin->type);
2991 	if (HFA384x_USB_ISRXFRM(type)) {
2992 		if (action == HANDLE) {
2993 			if (usbin->txfrm.desc.sw_support == 0x0123) {
2994 				hfa384x_usbin_txcompl(wlandev, usbin);
2995 			} else {
2996 				skb_put(skb, sizeof(*usbin));
2997 				hfa384x_usbin_rx(wlandev, skb);
2998 				skb = NULL;
2999 			}
3000 		}
3001 		goto exit;
3002 	}
3003 	if (HFA384x_USB_ISTXFRM(type)) {
3004 		if (action == HANDLE)
3005 			hfa384x_usbin_txcompl(wlandev, usbin);
3006 		goto exit;
3007 	}
3008 	switch (type) {
3009 	case HFA384x_USB_INFOFRM:
3010 		if (action == ABORT)
3011 			goto exit;
3012 		if (action == HANDLE)
3013 			hfa384x_usbin_info(wlandev, usbin);
3014 		break;
3015 
3016 	case HFA384x_USB_CMDRESP:
3017 	case HFA384x_USB_WRIDRESP:
3018 	case HFA384x_USB_RRIDRESP:
3019 	case HFA384x_USB_WMEMRESP:
3020 	case HFA384x_USB_RMEMRESP:
3021 		/* ALWAYS, ALWAYS, ALWAYS handle this CTLX!!!! */
3022 		hfa384x_usbin_ctlx(hw, usbin, urb_status);
3023 		break;
3024 
3025 	case HFA384x_USB_BUFAVAIL:
3026 		pr_debug("Received BUFAVAIL packet, frmlen=%d\n",
3027 			 usbin->bufavail.frmlen);
3028 		break;
3029 
3030 	case HFA384x_USB_ERROR:
3031 		pr_debug("Received USB_ERROR packet, errortype=%d\n",
3032 			 usbin->usberror.errortype);
3033 		break;
3034 
3035 	default:
3036 		pr_debug("Unrecognized USBIN packet, type=%x, status=%d\n",
3037 			 usbin->type, urb_status);
3038 		break;
3039 	}			/* switch */
3040 
3041 exit:
3042 
3043 	if (skb)
3044 		dev_kfree_skb(skb);
3045 }
3046 
3047 /*----------------------------------------------------------------
3048  * hfa384x_usbin_ctlx
3049  *
3050  * We've received a URB containing a Prism2 "response" message.
3051  * This message needs to be matched up with a CTLX on the active
3052  * queue and our state updated accordingly.
3053  *
3054  * Arguments:
3055  *	hw		ptr to struct hfa384x
3056  *	usbin		ptr to USB IN packet
3057  *	urb_status	status of this Bulk-In URB
3058  *
3059  * Returns:
3060  *	nothing
3061  *
3062  * Side effects:
3063  *
3064  * Call context:
3065  *	interrupt
3066  *----------------------------------------------------------------
3067  */
hfa384x_usbin_ctlx(struct hfa384x * hw,union hfa384x_usbin * usbin,int urb_status)3068 static void hfa384x_usbin_ctlx(struct hfa384x *hw, union hfa384x_usbin *usbin,
3069 			       int urb_status)
3070 {
3071 	struct hfa384x_usbctlx *ctlx;
3072 	int run_queue = 0;
3073 	unsigned long flags;
3074 
3075 retry:
3076 	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3077 
3078 	/* There can be only one CTLX on the active queue
3079 	 * at any one time, and this is the CTLX that the
3080 	 * timers are waiting for.
3081 	 */
3082 	if (list_empty(&hw->ctlxq.active))
3083 		goto unlock;
3084 
3085 	/* Remove the "response timeout". It's possible that
3086 	 * we are already too late, and that the timeout is
3087 	 * already running. And that's just too bad for us,
3088 	 * because we could lose our CTLX from the active
3089 	 * queue here ...
3090 	 */
3091 	if (del_timer(&hw->resptimer) == 0) {
3092 		if (hw->resp_timer_done == 0) {
3093 			spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3094 			goto retry;
3095 		}
3096 	} else {
3097 		hw->resp_timer_done = 1;
3098 	}
3099 
3100 	ctlx = get_active_ctlx(hw);
3101 
3102 	if (urb_status != 0) {
3103 		/*
3104 		 * Bad CTLX, so get rid of it. But we only
3105 		 * remove it from the active queue if we're no
3106 		 * longer expecting the OUT URB to complete.
3107 		 */
3108 		if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3109 			run_queue = 1;
3110 	} else {
3111 		const __le16 intype = (usbin->type & ~cpu_to_le16(0x8000));
3112 
3113 		/*
3114 		 * Check that our message is what we're expecting ...
3115 		 */
3116 		if (ctlx->outbuf.type != intype) {
3117 			netdev_warn(hw->wlandev->netdev,
3118 				    "Expected IN[%d], received IN[%d] - ignored.\n",
3119 				    le16_to_cpu(ctlx->outbuf.type),
3120 				    le16_to_cpu(intype));
3121 			goto unlock;
3122 		}
3123 
3124 		/* This URB has succeeded, so grab the data ... */
3125 		memcpy(&ctlx->inbuf, usbin, sizeof(ctlx->inbuf));
3126 
3127 		switch (ctlx->state) {
3128 		case CTLX_REQ_SUBMITTED:
3129 			/*
3130 			 * We have received our response URB before
3131 			 * our request has been acknowledged. Odd,
3132 			 * but our OUT URB is still alive...
3133 			 */
3134 			pr_debug("Causality violation: please reboot Universe\n");
3135 			ctlx->state = CTLX_RESP_COMPLETE;
3136 			break;
3137 
3138 		case CTLX_REQ_COMPLETE:
3139 			/*
3140 			 * This is the usual path: our request
3141 			 * has already been acknowledged, and
3142 			 * now we have received the reply too.
3143 			 */
3144 			ctlx->state = CTLX_COMPLETE;
3145 			unlocked_usbctlx_complete(hw, ctlx);
3146 			run_queue = 1;
3147 			break;
3148 
3149 		default:
3150 			/*
3151 			 * Throw this CTLX away ...
3152 			 */
3153 			netdev_err(hw->wlandev->netdev,
3154 				   "Matched IN URB, CTLX[%d] in invalid state(%s). Discarded.\n",
3155 				   le16_to_cpu(ctlx->outbuf.type),
3156 				   ctlxstr(ctlx->state));
3157 			if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3158 				run_queue = 1;
3159 			break;
3160 		}		/* switch */
3161 	}
3162 
3163 unlock:
3164 	spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3165 
3166 	if (run_queue)
3167 		hfa384x_usbctlxq_run(hw);
3168 }
3169 
3170 /*----------------------------------------------------------------
3171  * hfa384x_usbin_txcompl
3172  *
3173  * At this point we have the results of a previous transmit.
3174  *
3175  * Arguments:
3176  *	wlandev		wlan device
3177  *	usbin		ptr to the usb transfer buffer
3178  *
3179  * Returns:
3180  *	nothing
3181  *
3182  * Side effects:
3183  *
3184  * Call context:
3185  *	interrupt
3186  *----------------------------------------------------------------
3187  */
hfa384x_usbin_txcompl(struct wlandevice * wlandev,union hfa384x_usbin * usbin)3188 static void hfa384x_usbin_txcompl(struct wlandevice *wlandev,
3189 				  union hfa384x_usbin *usbin)
3190 {
3191 	u16 status;
3192 
3193 	status = le16_to_cpu(usbin->type); /* yeah I know it says type... */
3194 
3195 	/* Was there an error? */
3196 	if (HFA384x_TXSTATUS_ISERROR(status))
3197 		prism2sta_ev_txexc(wlandev, status);
3198 	else
3199 		prism2sta_ev_tx(wlandev, status);
3200 }
3201 
3202 /*----------------------------------------------------------------
3203  * hfa384x_usbin_rx
3204  *
3205  * At this point we have a successful received a rx frame packet.
3206  *
3207  * Arguments:
3208  *	wlandev		wlan device
3209  *	usbin		ptr to the usb transfer buffer
3210  *
3211  * Returns:
3212  *	nothing
3213  *
3214  * Side effects:
3215  *
3216  * Call context:
3217  *	interrupt
3218  *----------------------------------------------------------------
3219  */
hfa384x_usbin_rx(struct wlandevice * wlandev,struct sk_buff * skb)3220 static void hfa384x_usbin_rx(struct wlandevice *wlandev, struct sk_buff *skb)
3221 {
3222 	union hfa384x_usbin *usbin = (union hfa384x_usbin *)skb->data;
3223 	struct hfa384x *hw = wlandev->priv;
3224 	int hdrlen;
3225 	struct p80211_rxmeta *rxmeta;
3226 	u16 data_len;
3227 	u16 fc;
3228 	u16 status;
3229 
3230 	/* Byte order convert once up front. */
3231 	le16_to_cpus(&usbin->rxfrm.desc.status);
3232 	le32_to_cpus(&usbin->rxfrm.desc.time);
3233 
3234 	/* Now handle frame based on port# */
3235 	status = HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status);
3236 
3237 	switch (status) {
3238 	case 0:
3239 		fc = le16_to_cpu(usbin->rxfrm.desc.hdr.frame_control);
3240 
3241 		/* If exclude and we receive an unencrypted, drop it */
3242 		if ((wlandev->hostwep & HOSTWEP_EXCLUDEUNENCRYPTED) &&
3243 		    !WLAN_GET_FC_ISWEP(fc)) {
3244 			break;
3245 		}
3246 
3247 		data_len = le16_to_cpu(usbin->rxfrm.desc.data_len);
3248 
3249 		/* How much header data do we have? */
3250 		hdrlen = p80211_headerlen(fc);
3251 
3252 		/* Pull off the descriptor */
3253 		skb_pull(skb, sizeof(struct hfa384x_rx_frame));
3254 
3255 		/* Now shunt the header block up against the data block
3256 		 * with an "overlapping" copy
3257 		 */
3258 		memmove(skb_push(skb, hdrlen),
3259 			&usbin->rxfrm.desc.hdr, hdrlen);
3260 
3261 		skb->dev = wlandev->netdev;
3262 
3263 		/* And set the frame length properly */
3264 		skb_trim(skb, data_len + hdrlen);
3265 
3266 		/* The prism2 series does not return the CRC */
3267 		memset(skb_put(skb, WLAN_CRC_LEN), 0xff, WLAN_CRC_LEN);
3268 
3269 		skb_reset_mac_header(skb);
3270 
3271 		/* Attach the rxmeta, set some stuff */
3272 		p80211skb_rxmeta_attach(wlandev, skb);
3273 		rxmeta = p80211skb_rxmeta(skb);
3274 		rxmeta->mactime = usbin->rxfrm.desc.time;
3275 		rxmeta->rxrate = usbin->rxfrm.desc.rate;
3276 		rxmeta->signal = usbin->rxfrm.desc.signal - hw->dbmadjust;
3277 		rxmeta->noise = usbin->rxfrm.desc.silence - hw->dbmadjust;
3278 
3279 		p80211netdev_rx(wlandev, skb);
3280 
3281 		break;
3282 
3283 	case 7:
3284 		if (!HFA384x_RXSTATUS_ISFCSERR(usbin->rxfrm.desc.status)) {
3285 			/* Copy to wlansnif skb */
3286 			hfa384x_int_rxmonitor(wlandev, &usbin->rxfrm);
3287 			dev_kfree_skb(skb);
3288 		} else {
3289 			pr_debug("Received monitor frame: FCSerr set\n");
3290 		}
3291 		break;
3292 
3293 	default:
3294 		netdev_warn(hw->wlandev->netdev,
3295 			    "Received frame on unsupported port=%d\n",
3296 			    status);
3297 		break;
3298 	}
3299 }
3300 
3301 /*----------------------------------------------------------------
3302  * hfa384x_int_rxmonitor
3303  *
3304  * Helper function for int_rx.  Handles monitor frames.
3305  * Note that this function allocates space for the FCS and sets it
3306  * to 0xffffffff.  The hfa384x doesn't give us the FCS value but the
3307  * higher layers expect it.  0xffffffff is used as a flag to indicate
3308  * the FCS is bogus.
3309  *
3310  * Arguments:
3311  *	wlandev		wlan device structure
3312  *	rxfrm		rx descriptor read from card in int_rx
3313  *
3314  * Returns:
3315  *	nothing
3316  *
3317  * Side effects:
3318  *	Allocates an skb and passes it up via the PF_PACKET interface.
3319  * Call context:
3320  *	interrupt
3321  *----------------------------------------------------------------
3322  */
hfa384x_int_rxmonitor(struct wlandevice * wlandev,struct hfa384x_usb_rxfrm * rxfrm)3323 static void hfa384x_int_rxmonitor(struct wlandevice *wlandev,
3324 				  struct hfa384x_usb_rxfrm *rxfrm)
3325 {
3326 	struct hfa384x_rx_frame *rxdesc = &rxfrm->desc;
3327 	unsigned int hdrlen = 0;
3328 	unsigned int datalen = 0;
3329 	unsigned int skblen = 0;
3330 	u8 *datap;
3331 	u16 fc;
3332 	struct sk_buff *skb;
3333 	struct hfa384x *hw = wlandev->priv;
3334 
3335 	/* Remember the status, time, and data_len fields are in host order */
3336 	/* Figure out how big the frame is */
3337 	fc = le16_to_cpu(rxdesc->hdr.frame_control);
3338 	hdrlen = p80211_headerlen(fc);
3339 	datalen = le16_to_cpu(rxdesc->data_len);
3340 
3341 	/* Allocate an ind message+framesize skb */
3342 	skblen = sizeof(struct p80211_caphdr) + hdrlen + datalen + WLAN_CRC_LEN;
3343 
3344 	/* sanity check the length */
3345 	if (skblen >
3346 	    (sizeof(struct p80211_caphdr) +
3347 	     WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {
3348 		pr_debug("overlen frm: len=%zd\n",
3349 			 skblen - sizeof(struct p80211_caphdr));
3350 
3351 		return;
3352 	}
3353 
3354 	skb = dev_alloc_skb(skblen);
3355 	if (!skb)
3356 		return;
3357 
3358 	/* only prepend the prism header if in the right mode */
3359 	if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
3360 	    (hw->sniffhdr != 0)) {
3361 		struct p80211_caphdr *caphdr;
3362 		/* The NEW header format! */
3363 		datap = skb_put(skb, sizeof(struct p80211_caphdr));
3364 		caphdr = (struct p80211_caphdr *)datap;
3365 
3366 		caphdr->version = htonl(P80211CAPTURE_VERSION);
3367 		caphdr->length = htonl(sizeof(struct p80211_caphdr));
3368 		caphdr->mactime = __cpu_to_be64(rxdesc->time * 1000);
3369 		caphdr->hosttime = __cpu_to_be64(jiffies);
3370 		caphdr->phytype = htonl(4);	/* dss_dot11_b */
3371 		caphdr->channel = htonl(hw->sniff_channel);
3372 		caphdr->datarate = htonl(rxdesc->rate);
3373 		caphdr->antenna = htonl(0);	/* unknown */
3374 		caphdr->priority = htonl(0);	/* unknown */
3375 		caphdr->ssi_type = htonl(3);	/* rssi_raw */
3376 		caphdr->ssi_signal = htonl(rxdesc->signal);
3377 		caphdr->ssi_noise = htonl(rxdesc->silence);
3378 		caphdr->preamble = htonl(0);	/* unknown */
3379 		caphdr->encoding = htonl(1);	/* cck */
3380 	}
3381 
3382 	/* Copy the 802.11 header to the skb
3383 	 * (ctl frames may be less than a full header)
3384 	 */
3385 	skb_put_data(skb, &rxdesc->hdr.frame_control, hdrlen);
3386 
3387 	/* If any, copy the data from the card to the skb */
3388 	if (datalen > 0) {
3389 		datap = skb_put_data(skb, rxfrm->data, datalen);
3390 
3391 		/* check for unencrypted stuff if WEP bit set. */
3392 		if (*(datap - hdrlen + 1) & 0x40)	/* wep set */
3393 			if ((*(datap) == 0xaa) && (*(datap + 1) == 0xaa))
3394 				/* clear wep; it's the 802.2 header! */
3395 				*(datap - hdrlen + 1) &= 0xbf;
3396 	}
3397 
3398 	if (hw->sniff_fcs) {
3399 		/* Set the FCS */
3400 		datap = skb_put(skb, WLAN_CRC_LEN);
3401 		memset(datap, 0xff, WLAN_CRC_LEN);
3402 	}
3403 
3404 	/* pass it back up */
3405 	p80211netdev_rx(wlandev, skb);
3406 }
3407 
3408 /*----------------------------------------------------------------
3409  * hfa384x_usbin_info
3410  *
3411  * At this point we have a successful received a Prism2 info frame.
3412  *
3413  * Arguments:
3414  *	wlandev		wlan device
3415  *	usbin		ptr to the usb transfer buffer
3416  *
3417  * Returns:
3418  *	nothing
3419  *
3420  * Side effects:
3421  *
3422  * Call context:
3423  *	interrupt
3424  *----------------------------------------------------------------
3425  */
hfa384x_usbin_info(struct wlandevice * wlandev,union hfa384x_usbin * usbin)3426 static void hfa384x_usbin_info(struct wlandevice *wlandev,
3427 			       union hfa384x_usbin *usbin)
3428 {
3429 	le16_to_cpus(&usbin->infofrm.info.framelen);
3430 	prism2sta_ev_info(wlandev, &usbin->infofrm.info);
3431 }
3432 
3433 /*----------------------------------------------------------------
3434  * hfa384x_usbout_callback
3435  *
3436  * Callback for URBs on the BULKOUT endpoint.
3437  *
3438  * Arguments:
3439  *	urb		ptr to the completed urb
3440  *
3441  * Returns:
3442  *	nothing
3443  *
3444  * Side effects:
3445  *
3446  * Call context:
3447  *	interrupt
3448  *----------------------------------------------------------------
3449  */
hfa384x_usbout_callback(struct urb * urb)3450 static void hfa384x_usbout_callback(struct urb *urb)
3451 {
3452 	struct wlandevice *wlandev = urb->context;
3453 
3454 #ifdef DEBUG_USB
3455 	dbprint_urb(urb);
3456 #endif
3457 
3458 	if (wlandev && wlandev->netdev) {
3459 		switch (urb->status) {
3460 		case 0:
3461 			prism2sta_ev_alloc(wlandev);
3462 			break;
3463 
3464 		case -EPIPE: {
3465 			struct hfa384x *hw = wlandev->priv;
3466 
3467 			netdev_warn(hw->wlandev->netdev,
3468 				    "%s tx pipe stalled: requesting reset\n",
3469 				    wlandev->netdev->name);
3470 			if (!test_and_set_bit(WORK_TX_HALT, &hw->usb_flags))
3471 				schedule_work(&hw->usb_work);
3472 			wlandev->netdev->stats.tx_errors++;
3473 			break;
3474 		}
3475 
3476 		case -EPROTO:
3477 		case -ETIMEDOUT:
3478 		case -EILSEQ: {
3479 			struct hfa384x *hw = wlandev->priv;
3480 
3481 			if (!test_and_set_bit(THROTTLE_TX, &hw->usb_flags) &&
3482 			    !timer_pending(&hw->throttle)) {
3483 				mod_timer(&hw->throttle,
3484 					  jiffies + THROTTLE_JIFFIES);
3485 			}
3486 			wlandev->netdev->stats.tx_errors++;
3487 			netif_stop_queue(wlandev->netdev);
3488 			break;
3489 		}
3490 
3491 		case -ENOENT:
3492 		case -ESHUTDOWN:
3493 			/* Ignorable errors */
3494 			break;
3495 
3496 		default:
3497 			netdev_info(wlandev->netdev, "unknown urb->status=%d\n",
3498 				    urb->status);
3499 			wlandev->netdev->stats.tx_errors++;
3500 			break;
3501 		}		/* switch */
3502 	}
3503 }
3504 
3505 /*----------------------------------------------------------------
3506  * hfa384x_ctlxout_callback
3507  *
3508  * Callback for control data on the BULKOUT endpoint.
3509  *
3510  * Arguments:
3511  *	urb		ptr to the completed urb
3512  *
3513  * Returns:
3514  * nothing
3515  *
3516  * Side effects:
3517  *
3518  * Call context:
3519  * interrupt
3520  *----------------------------------------------------------------
3521  */
hfa384x_ctlxout_callback(struct urb * urb)3522 static void hfa384x_ctlxout_callback(struct urb *urb)
3523 {
3524 	struct hfa384x *hw = urb->context;
3525 	int delete_resptimer = 0;
3526 	int timer_ok = 1;
3527 	int run_queue = 0;
3528 	struct hfa384x_usbctlx *ctlx;
3529 	unsigned long flags;
3530 
3531 	pr_debug("urb->status=%d\n", urb->status);
3532 #ifdef DEBUG_USB
3533 	dbprint_urb(urb);
3534 #endif
3535 	if ((urb->status == -ESHUTDOWN) ||
3536 	    (urb->status == -ENODEV) || !hw)
3537 		return;
3538 
3539 retry:
3540 	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3541 
3542 	/*
3543 	 * Only one CTLX at a time on the "active" list, and
3544 	 * none at all if we are unplugged. However, we can
3545 	 * rely on the disconnect function to clean everything
3546 	 * up if someone unplugged the adapter.
3547 	 */
3548 	if (list_empty(&hw->ctlxq.active)) {
3549 		spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3550 		return;
3551 	}
3552 
3553 	/*
3554 	 * Having something on the "active" queue means
3555 	 * that we have timers to worry about ...
3556 	 */
3557 	if (del_timer(&hw->reqtimer) == 0) {
3558 		if (hw->req_timer_done == 0) {
3559 			/*
3560 			 * This timer was actually running while we
3561 			 * were trying to delete it. Let it terminate
3562 			 * gracefully instead.
3563 			 */
3564 			spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3565 			goto retry;
3566 		}
3567 	} else {
3568 		hw->req_timer_done = 1;
3569 	}
3570 
3571 	ctlx = get_active_ctlx(hw);
3572 
3573 	if (urb->status == 0) {
3574 		/* Request portion of a CTLX is successful */
3575 		switch (ctlx->state) {
3576 		case CTLX_REQ_SUBMITTED:
3577 			/* This OUT-ACK received before IN */
3578 			ctlx->state = CTLX_REQ_COMPLETE;
3579 			break;
3580 
3581 		case CTLX_RESP_COMPLETE:
3582 			/* IN already received before this OUT-ACK,
3583 			 * so this command must now be complete.
3584 			 */
3585 			ctlx->state = CTLX_COMPLETE;
3586 			unlocked_usbctlx_complete(hw, ctlx);
3587 			run_queue = 1;
3588 			break;
3589 
3590 		default:
3591 			/* This is NOT a valid CTLX "success" state! */
3592 			netdev_err(hw->wlandev->netdev,
3593 				   "Illegal CTLX[%d] success state(%s, %d) in OUT URB\n",
3594 				   le16_to_cpu(ctlx->outbuf.type),
3595 				   ctlxstr(ctlx->state), urb->status);
3596 			break;
3597 		}		/* switch */
3598 	} else {
3599 		/* If the pipe has stalled then we need to reset it */
3600 		if ((urb->status == -EPIPE) &&
3601 		    !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags)) {
3602 			netdev_warn(hw->wlandev->netdev,
3603 				    "%s tx pipe stalled: requesting reset\n",
3604 				    hw->wlandev->netdev->name);
3605 			schedule_work(&hw->usb_work);
3606 		}
3607 
3608 		/* If someone cancels the OUT URB then its status
3609 		 * should be either -ECONNRESET or -ENOENT.
3610 		 */
3611 		ctlx->state = CTLX_REQ_FAILED;
3612 		unlocked_usbctlx_complete(hw, ctlx);
3613 		delete_resptimer = 1;
3614 		run_queue = 1;
3615 	}
3616 
3617 delresp:
3618 	if (delete_resptimer) {
3619 		timer_ok = del_timer(&hw->resptimer);
3620 		if (timer_ok != 0)
3621 			hw->resp_timer_done = 1;
3622 	}
3623 
3624 	spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3625 
3626 	if (!timer_ok && (hw->resp_timer_done == 0)) {
3627 		spin_lock_irqsave(&hw->ctlxq.lock, flags);
3628 		goto delresp;
3629 	}
3630 
3631 	if (run_queue)
3632 		hfa384x_usbctlxq_run(hw);
3633 }
3634 
3635 /*----------------------------------------------------------------
3636  * hfa384x_usbctlx_reqtimerfn
3637  *
3638  * Timer response function for CTLX request timeouts.  If this
3639  * function is called, it means that the callback for the OUT
3640  * URB containing a Prism2.x XXX_Request was never called.
3641  *
3642  * Arguments:
3643  *	data		a ptr to the struct hfa384x
3644  *
3645  * Returns:
3646  *	nothing
3647  *
3648  * Side effects:
3649  *
3650  * Call context:
3651  *	interrupt
3652  *----------------------------------------------------------------
3653  */
hfa384x_usbctlx_reqtimerfn(struct timer_list * t)3654 static void hfa384x_usbctlx_reqtimerfn(struct timer_list *t)
3655 {
3656 	struct hfa384x *hw = from_timer(hw, t, reqtimer);
3657 	unsigned long flags;
3658 
3659 	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3660 
3661 	hw->req_timer_done = 1;
3662 
3663 	/* Removing the hardware automatically empties
3664 	 * the active list ...
3665 	 */
3666 	if (!list_empty(&hw->ctlxq.active)) {
3667 		/*
3668 		 * We must ensure that our URB is removed from
3669 		 * the system, if it hasn't already expired.
3670 		 */
3671 		hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
3672 		if (usb_unlink_urb(&hw->ctlx_urb) == -EINPROGRESS) {
3673 			struct hfa384x_usbctlx *ctlx = get_active_ctlx(hw);
3674 
3675 			ctlx->state = CTLX_REQ_FAILED;
3676 
3677 			/* This URB was active, but has now been
3678 			 * cancelled. It will now have a status of
3679 			 * -ECONNRESET in the callback function.
3680 			 *
3681 			 * We are cancelling this CTLX, so we're
3682 			 * not going to need to wait for a response.
3683 			 * The URB's callback function will check
3684 			 * that this timer is truly dead.
3685 			 */
3686 			if (del_timer(&hw->resptimer) != 0)
3687 				hw->resp_timer_done = 1;
3688 		}
3689 	}
3690 
3691 	spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3692 }
3693 
3694 /*----------------------------------------------------------------
3695  * hfa384x_usbctlx_resptimerfn
3696  *
3697  * Timer response function for CTLX response timeouts.  If this
3698  * function is called, it means that the callback for the IN
3699  * URB containing a Prism2.x XXX_Response was never called.
3700  *
3701  * Arguments:
3702  *	data		a ptr to the struct hfa384x
3703  *
3704  * Returns:
3705  *	nothing
3706  *
3707  * Side effects:
3708  *
3709  * Call context:
3710  *	interrupt
3711  *----------------------------------------------------------------
3712  */
hfa384x_usbctlx_resptimerfn(struct timer_list * t)3713 static void hfa384x_usbctlx_resptimerfn(struct timer_list *t)
3714 {
3715 	struct hfa384x *hw = from_timer(hw, t, resptimer);
3716 	unsigned long flags;
3717 
3718 	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3719 
3720 	hw->resp_timer_done = 1;
3721 
3722 	/* The active list will be empty if the
3723 	 * adapter has been unplugged ...
3724 	 */
3725 	if (!list_empty(&hw->ctlxq.active)) {
3726 		struct hfa384x_usbctlx *ctlx = get_active_ctlx(hw);
3727 
3728 		if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0) {
3729 			spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3730 			hfa384x_usbctlxq_run(hw);
3731 			return;
3732 		}
3733 	}
3734 	spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3735 }
3736 
3737 /*----------------------------------------------------------------
3738  * hfa384x_usb_throttlefn
3739  *
3740  *
3741  * Arguments:
3742  *	data	ptr to hw
3743  *
3744  * Returns:
3745  *	Nothing
3746  *
3747  * Side effects:
3748  *
3749  * Call context:
3750  *	Interrupt
3751  *----------------------------------------------------------------
3752  */
hfa384x_usb_throttlefn(struct timer_list * t)3753 static void hfa384x_usb_throttlefn(struct timer_list *t)
3754 {
3755 	struct hfa384x *hw = from_timer(hw, t, throttle);
3756 	unsigned long flags;
3757 
3758 	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3759 
3760 	pr_debug("flags=0x%lx\n", hw->usb_flags);
3761 	if (!hw->wlandev->hwremoved) {
3762 		bool rx_throttle = test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
3763 				   !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags);
3764 		bool tx_throttle = test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
3765 				   !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags);
3766 		/*
3767 		 * We need to check BOTH the RX and the TX throttle controls,
3768 		 * so we use the bitwise OR instead of the logical OR.
3769 		 */
3770 		if (rx_throttle | tx_throttle)
3771 			schedule_work(&hw->usb_work);
3772 	}
3773 
3774 	spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3775 }
3776 
3777 /*----------------------------------------------------------------
3778  * hfa384x_usbctlx_submit
3779  *
3780  * Called from the doxxx functions to submit a CTLX to the queue
3781  *
3782  * Arguments:
3783  *	hw		ptr to the hw struct
3784  *	ctlx		ctlx structure to enqueue
3785  *
3786  * Returns:
3787  *	-ENODEV if the adapter is unplugged
3788  *	0
3789  *
3790  * Side effects:
3791  *
3792  * Call context:
3793  *	process or interrupt
3794  *----------------------------------------------------------------
3795  */
hfa384x_usbctlx_submit(struct hfa384x * hw,struct hfa384x_usbctlx * ctlx)3796 static int hfa384x_usbctlx_submit(struct hfa384x *hw,
3797 				  struct hfa384x_usbctlx *ctlx)
3798 {
3799 	unsigned long flags;
3800 
3801 	spin_lock_irqsave(&hw->ctlxq.lock, flags);
3802 
3803 	if (hw->wlandev->hwremoved) {
3804 		spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3805 		return -ENODEV;
3806 	}
3807 
3808 	ctlx->state = CTLX_PENDING;
3809 	list_add_tail(&ctlx->list, &hw->ctlxq.pending);
3810 	spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3811 	hfa384x_usbctlxq_run(hw);
3812 
3813 	return 0;
3814 }
3815 
3816 /*----------------------------------------------------------------
3817  * hfa384x_isgood_pdrcore
3818  *
3819  * Quick check of PDR codes.
3820  *
3821  * Arguments:
3822  *	pdrcode		PDR code number (host order)
3823  *
3824  * Returns:
3825  *	zero		not good.
3826  *	one		is good.
3827  *
3828  * Side effects:
3829  *
3830  * Call context:
3831  *----------------------------------------------------------------
3832  */
hfa384x_isgood_pdrcode(u16 pdrcode)3833 static int hfa384x_isgood_pdrcode(u16 pdrcode)
3834 {
3835 	switch (pdrcode) {
3836 	case HFA384x_PDR_END_OF_PDA:
3837 	case HFA384x_PDR_PCB_PARTNUM:
3838 	case HFA384x_PDR_PDAVER:
3839 	case HFA384x_PDR_NIC_SERIAL:
3840 	case HFA384x_PDR_MKK_MEASUREMENTS:
3841 	case HFA384x_PDR_NIC_RAMSIZE:
3842 	case HFA384x_PDR_MFISUPRANGE:
3843 	case HFA384x_PDR_CFISUPRANGE:
3844 	case HFA384x_PDR_NICID:
3845 	case HFA384x_PDR_MAC_ADDRESS:
3846 	case HFA384x_PDR_REGDOMAIN:
3847 	case HFA384x_PDR_ALLOWED_CHANNEL:
3848 	case HFA384x_PDR_DEFAULT_CHANNEL:
3849 	case HFA384x_PDR_TEMPTYPE:
3850 	case HFA384x_PDR_IFR_SETTING:
3851 	case HFA384x_PDR_RFR_SETTING:
3852 	case HFA384x_PDR_HFA3861_BASELINE:
3853 	case HFA384x_PDR_HFA3861_SHADOW:
3854 	case HFA384x_PDR_HFA3861_IFRF:
3855 	case HFA384x_PDR_HFA3861_CHCALSP:
3856 	case HFA384x_PDR_HFA3861_CHCALI:
3857 	case HFA384x_PDR_3842_NIC_CONFIG:
3858 	case HFA384x_PDR_USB_ID:
3859 	case HFA384x_PDR_PCI_ID:
3860 	case HFA384x_PDR_PCI_IFCONF:
3861 	case HFA384x_PDR_PCI_PMCONF:
3862 	case HFA384x_PDR_RFENRGY:
3863 	case HFA384x_PDR_HFA3861_MANF_TESTSP:
3864 	case HFA384x_PDR_HFA3861_MANF_TESTI:
3865 		/* code is OK */
3866 		return 1;
3867 	default:
3868 		if (pdrcode < 0x1000) {
3869 			/* code is OK, but we don't know exactly what it is */
3870 			pr_debug("Encountered unknown PDR#=0x%04x, assuming it's ok.\n",
3871 				 pdrcode);
3872 			return 1;
3873 		}
3874 		break;
3875 	}
3876 	/* bad code */
3877 	pr_debug("Encountered unknown PDR#=0x%04x, (>=0x1000), assuming it's bad.\n",
3878 		 pdrcode);
3879 	return 0;
3880 }
3881