916b24c544e2ec662521ca45bbb8386408f9b4d6
[linux-2.6.git] / drivers / net / wireless / ipw2200.c
1 /******************************************************************************
2
3   Copyright(c) 2003 - 2005 Intel Corporation. All rights reserved.
4
5   802.11 status code portion of this file from ethereal-0.10.6:
6     Copyright 2000, Axis Communications AB
7     Ethereal - Network traffic analyzer
8     By Gerald Combs <gerald@ethereal.com>
9     Copyright 1998 Gerald Combs
10
11   This program is free software; you can redistribute it and/or modify it
12   under the terms of version 2 of the GNU General Public License as
13   published by the Free Software Foundation.
14
15   This program is distributed in the hope that it will be useful, but WITHOUT
16   ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
17   FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
18   more details.
19
20   You should have received a copy of the GNU General Public License along with
21   this program; if not, write to the Free Software Foundation, Inc., 59
22   Temple Place - Suite 330, Boston, MA  02111-1307, USA.
23
24   The full GNU General Public License is included in this distribution in the
25   file called LICENSE.
26
27   Contact Information:
28   James P. Ketrenos <ipw2100-admin@linux.intel.com>
29   Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
30
31 ******************************************************************************/
32
33 #include "ipw2200.h"
34 #include <linux/version.h>
35
36 #define IPW2200_VERSION "git-1.0.8"
37 #define DRV_DESCRIPTION "Intel(R) PRO/Wireless 2200/2915 Network Driver"
38 #define DRV_COPYRIGHT   "Copyright(c) 2003-2005 Intel Corporation"
39 #define DRV_VERSION     IPW2200_VERSION
40
41 #define ETH_P_80211_STATS (ETH_P_80211_RAW + 1)
42
43 MODULE_DESCRIPTION(DRV_DESCRIPTION);
44 MODULE_VERSION(DRV_VERSION);
45 MODULE_AUTHOR(DRV_COPYRIGHT);
46 MODULE_LICENSE("GPL");
47
48 static int cmdlog = 0;
49 static int debug = 0;
50 static int channel = 0;
51 static int mode = 0;
52
53 static u32 ipw_debug_level;
54 static int associate = 1;
55 static int auto_create = 1;
56 static int led = 0;
57 static int disable = 0;
58 static int hwcrypto = 1;
59 static const char ipw_modes[] = {
60         'a', 'b', 'g', '?'
61 };
62
63 #ifdef CONFIG_IPW_QOS
64 static int qos_enable = 0;
65 static int qos_burst_enable = 0;
66 static int qos_no_ack_mask = 0;
67 static int burst_duration_CCK = 0;
68 static int burst_duration_OFDM = 0;
69
70 static struct ieee80211_qos_parameters def_qos_parameters_OFDM = {
71         {QOS_TX0_CW_MIN_OFDM, QOS_TX1_CW_MIN_OFDM, QOS_TX2_CW_MIN_OFDM,
72          QOS_TX3_CW_MIN_OFDM},
73         {QOS_TX0_CW_MAX_OFDM, QOS_TX1_CW_MAX_OFDM, QOS_TX2_CW_MAX_OFDM,
74          QOS_TX3_CW_MAX_OFDM},
75         {QOS_TX0_AIFS, QOS_TX1_AIFS, QOS_TX2_AIFS, QOS_TX3_AIFS},
76         {QOS_TX0_ACM, QOS_TX1_ACM, QOS_TX2_ACM, QOS_TX3_ACM},
77         {QOS_TX0_TXOP_LIMIT_OFDM, QOS_TX1_TXOP_LIMIT_OFDM,
78          QOS_TX2_TXOP_LIMIT_OFDM, QOS_TX3_TXOP_LIMIT_OFDM}
79 };
80
81 static struct ieee80211_qos_parameters def_qos_parameters_CCK = {
82         {QOS_TX0_CW_MIN_CCK, QOS_TX1_CW_MIN_CCK, QOS_TX2_CW_MIN_CCK,
83          QOS_TX3_CW_MIN_CCK},
84         {QOS_TX0_CW_MAX_CCK, QOS_TX1_CW_MAX_CCK, QOS_TX2_CW_MAX_CCK,
85          QOS_TX3_CW_MAX_CCK},
86         {QOS_TX0_AIFS, QOS_TX1_AIFS, QOS_TX2_AIFS, QOS_TX3_AIFS},
87         {QOS_TX0_ACM, QOS_TX1_ACM, QOS_TX2_ACM, QOS_TX3_ACM},
88         {QOS_TX0_TXOP_LIMIT_CCK, QOS_TX1_TXOP_LIMIT_CCK, QOS_TX2_TXOP_LIMIT_CCK,
89          QOS_TX3_TXOP_LIMIT_CCK}
90 };
91
92 static struct ieee80211_qos_parameters def_parameters_OFDM = {
93         {DEF_TX0_CW_MIN_OFDM, DEF_TX1_CW_MIN_OFDM, DEF_TX2_CW_MIN_OFDM,
94          DEF_TX3_CW_MIN_OFDM},
95         {DEF_TX0_CW_MAX_OFDM, DEF_TX1_CW_MAX_OFDM, DEF_TX2_CW_MAX_OFDM,
96          DEF_TX3_CW_MAX_OFDM},
97         {DEF_TX0_AIFS, DEF_TX1_AIFS, DEF_TX2_AIFS, DEF_TX3_AIFS},
98         {DEF_TX0_ACM, DEF_TX1_ACM, DEF_TX2_ACM, DEF_TX3_ACM},
99         {DEF_TX0_TXOP_LIMIT_OFDM, DEF_TX1_TXOP_LIMIT_OFDM,
100          DEF_TX2_TXOP_LIMIT_OFDM, DEF_TX3_TXOP_LIMIT_OFDM}
101 };
102
103 static struct ieee80211_qos_parameters def_parameters_CCK = {
104         {DEF_TX0_CW_MIN_CCK, DEF_TX1_CW_MIN_CCK, DEF_TX2_CW_MIN_CCK,
105          DEF_TX3_CW_MIN_CCK},
106         {DEF_TX0_CW_MAX_CCK, DEF_TX1_CW_MAX_CCK, DEF_TX2_CW_MAX_CCK,
107          DEF_TX3_CW_MAX_CCK},
108         {DEF_TX0_AIFS, DEF_TX1_AIFS, DEF_TX2_AIFS, DEF_TX3_AIFS},
109         {DEF_TX0_ACM, DEF_TX1_ACM, DEF_TX2_ACM, DEF_TX3_ACM},
110         {DEF_TX0_TXOP_LIMIT_CCK, DEF_TX1_TXOP_LIMIT_CCK, DEF_TX2_TXOP_LIMIT_CCK,
111          DEF_TX3_TXOP_LIMIT_CCK}
112 };
113
114 static u8 qos_oui[QOS_OUI_LEN] = { 0x00, 0x50, 0xF2 };
115
116 static int from_priority_to_tx_queue[] = {
117         IPW_TX_QUEUE_1, IPW_TX_QUEUE_2, IPW_TX_QUEUE_2, IPW_TX_QUEUE_1,
118         IPW_TX_QUEUE_3, IPW_TX_QUEUE_3, IPW_TX_QUEUE_4, IPW_TX_QUEUE_4
119 };
120
121 static u32 ipw_qos_get_burst_duration(struct ipw_priv *priv);
122
123 static int ipw_send_qos_params_command(struct ipw_priv *priv, struct ieee80211_qos_parameters
124                                        *qos_param);
125 static int ipw_send_qos_info_command(struct ipw_priv *priv, struct ieee80211_qos_information_element
126                                      *qos_param);
127 #endif                          /* CONFIG_IPW_QOS */
128
129 static struct iw_statistics *ipw_get_wireless_stats(struct net_device *dev);
130 static void ipw_remove_current_network(struct ipw_priv *priv);
131 static void ipw_rx(struct ipw_priv *priv);
132 static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
133                                 struct clx2_tx_queue *txq, int qindex);
134 static int ipw_queue_reset(struct ipw_priv *priv);
135
136 static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
137                              int len, int sync);
138
139 static void ipw_tx_queue_free(struct ipw_priv *);
140
141 static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *);
142 static void ipw_rx_queue_free(struct ipw_priv *, struct ipw_rx_queue *);
143 static void ipw_rx_queue_replenish(void *);
144 static int ipw_up(struct ipw_priv *);
145 static void ipw_bg_up(void *);
146 static void ipw_down(struct ipw_priv *);
147 static void ipw_bg_down(void *);
148 static int ipw_config(struct ipw_priv *);
149 static int init_supported_rates(struct ipw_priv *priv,
150                                 struct ipw_supported_rates *prates);
151 static void ipw_set_hwcrypto_keys(struct ipw_priv *);
152 static void ipw_send_wep_keys(struct ipw_priv *, int);
153
154 static int ipw_is_valid_channel(struct ieee80211_device *, u8);
155 static int ipw_channel_to_index(struct ieee80211_device *, u8);
156 static u8 ipw_freq_to_channel(struct ieee80211_device *, u32);
157 static int ipw_set_geo(struct ieee80211_device *, const struct ieee80211_geo *);
158 static const struct ieee80211_geo *ipw_get_geo(struct ieee80211_device *);
159
160 static int snprint_line(char *buf, size_t count,
161                         const u8 * data, u32 len, u32 ofs)
162 {
163         int out, i, j, l;
164         char c;
165
166         out = snprintf(buf, count, "%08X", ofs);
167
168         for (l = 0, i = 0; i < 2; i++) {
169                 out += snprintf(buf + out, count - out, " ");
170                 for (j = 0; j < 8 && l < len; j++, l++)
171                         out += snprintf(buf + out, count - out, "%02X ",
172                                         data[(i * 8 + j)]);
173                 for (; j < 8; j++)
174                         out += snprintf(buf + out, count - out, "   ");
175         }
176
177         out += snprintf(buf + out, count - out, " ");
178         for (l = 0, i = 0; i < 2; i++) {
179                 out += snprintf(buf + out, count - out, " ");
180                 for (j = 0; j < 8 && l < len; j++, l++) {
181                         c = data[(i * 8 + j)];
182                         if (!isascii(c) || !isprint(c))
183                                 c = '.';
184
185                         out += snprintf(buf + out, count - out, "%c", c);
186                 }
187
188                 for (; j < 8; j++)
189                         out += snprintf(buf + out, count - out, " ");
190         }
191
192         return out;
193 }
194
195 static void printk_buf(int level, const u8 * data, u32 len)
196 {
197         char line[81];
198         u32 ofs = 0;
199         if (!(ipw_debug_level & level))
200                 return;
201
202         while (len) {
203                 snprint_line(line, sizeof(line), &data[ofs],
204                              min(len, 16U), ofs);
205                 printk(KERN_DEBUG "%s\n", line);
206                 ofs += 16;
207                 len -= min(len, 16U);
208         }
209 }
210
211 static int snprintk_buf(u8 * output, size_t size, const u8 * data, size_t len)
212 {
213         size_t out = size;
214         u32 ofs = 0;
215         int total = 0;
216
217         while (size && len) {
218                 out = snprint_line(output, size, &data[ofs],
219                                    min_t(size_t, len, 16U), ofs);
220
221                 ofs += 16;
222                 output += out;
223                 size -= out;
224                 len -= min_t(size_t, len, 16U);
225                 total += out;
226         }
227         return total;
228 }
229
230 static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg);
231 #define ipw_read_reg32(a, b) _ipw_read_reg32(a, b)
232
233 static u8 _ipw_read_reg8(struct ipw_priv *ipw, u32 reg);
234 #define ipw_read_reg8(a, b) _ipw_read_reg8(a, b)
235
236 static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value);
237 static inline void ipw_write_reg8(struct ipw_priv *a, u32 b, u8 c)
238 {
239         IPW_DEBUG_IO("%s %d: write_indirect8(0x%08X, 0x%08X)\n", __FILE__,
240                      __LINE__, (u32) (b), (u32) (c));
241         _ipw_write_reg8(a, b, c);
242 }
243
244 static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value);
245 static inline void ipw_write_reg16(struct ipw_priv *a, u32 b, u16 c)
246 {
247         IPW_DEBUG_IO("%s %d: write_indirect16(0x%08X, 0x%08X)\n", __FILE__,
248                      __LINE__, (u32) (b), (u32) (c));
249         _ipw_write_reg16(a, b, c);
250 }
251
252 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value);
253 static inline void ipw_write_reg32(struct ipw_priv *a, u32 b, u32 c)
254 {
255         IPW_DEBUG_IO("%s %d: write_indirect32(0x%08X, 0x%08X)\n", __FILE__,
256                      __LINE__, (u32) (b), (u32) (c));
257         _ipw_write_reg32(a, b, c);
258 }
259
260 #define _ipw_write8(ipw, ofs, val) writeb((val), (ipw)->hw_base + (ofs))
261 #define ipw_write8(ipw, ofs, val) \
262  IPW_DEBUG_IO("%s %d: write_direct8(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
263  _ipw_write8(ipw, ofs, val)
264
265 #define _ipw_write16(ipw, ofs, val) writew((val), (ipw)->hw_base + (ofs))
266 #define ipw_write16(ipw, ofs, val) \
267  IPW_DEBUG_IO("%s %d: write_direct16(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
268  _ipw_write16(ipw, ofs, val)
269
270 #define _ipw_write32(ipw, ofs, val) writel((val), (ipw)->hw_base + (ofs))
271 #define ipw_write32(ipw, ofs, val) \
272  IPW_DEBUG_IO("%s %d: write_direct32(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
273  _ipw_write32(ipw, ofs, val)
274
275 #define _ipw_read8(ipw, ofs) readb((ipw)->hw_base + (ofs))
276 static inline u8 __ipw_read8(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
277 {
278         IPW_DEBUG_IO("%s %d: read_direct8(0x%08X)\n", f, l, (u32) (ofs));
279         return _ipw_read8(ipw, ofs);
280 }
281
282 #define ipw_read8(ipw, ofs) __ipw_read8(__FILE__, __LINE__, ipw, ofs)
283
284 #define _ipw_read16(ipw, ofs) readw((ipw)->hw_base + (ofs))
285 static inline u16 __ipw_read16(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
286 {
287         IPW_DEBUG_IO("%s %d: read_direct16(0x%08X)\n", f, l, (u32) (ofs));
288         return _ipw_read16(ipw, ofs);
289 }
290
291 #define ipw_read16(ipw, ofs) __ipw_read16(__FILE__, __LINE__, ipw, ofs)
292
293 #define _ipw_read32(ipw, ofs) readl((ipw)->hw_base + (ofs))
294 static inline u32 __ipw_read32(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
295 {
296         IPW_DEBUG_IO("%s %d: read_direct32(0x%08X)\n", f, l, (u32) (ofs));
297         return _ipw_read32(ipw, ofs);
298 }
299
300 #define ipw_read32(ipw, ofs) __ipw_read32(__FILE__, __LINE__, ipw, ofs)
301
302 static void _ipw_read_indirect(struct ipw_priv *, u32, u8 *, int);
303 static inline void __ipw_read_indirect(const char *f, int l,
304                                        struct ipw_priv *a, u32 b, u8 * c, int d)
305 {
306         IPW_DEBUG_IO("%s %d: read_indirect(0x%08X) %d bytes\n", f, l, (u32) (b),
307                      d);
308         _ipw_read_indirect(a, b, c, d);
309 }
310
311 #define ipw_read_indirect(a, b, c, d) __ipw_read_indirect(__FILE__, __LINE__, a, b, c, d)
312
313 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * data,
314                                 int num);
315 #define ipw_write_indirect(a, b, c, d) \
316         IPW_DEBUG_IO("%s %d: write_indirect(0x%08X) %d bytes\n", __FILE__, __LINE__, (u32)(b), d); \
317         _ipw_write_indirect(a, b, c, d)
318
319 /* indirect write s */
320 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value)
321 {
322         IPW_DEBUG_IO(" %p : reg = 0x%8X : value = 0x%8X\n", priv, reg, value);
323         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
324         _ipw_write32(priv, IPW_INDIRECT_DATA, value);
325 }
326
327 static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value)
328 {
329         IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
330         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg & IPW_INDIRECT_ADDR_MASK);
331         _ipw_write8(priv, IPW_INDIRECT_DATA, value);
332 }
333
334 static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value)
335 {
336         IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
337         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg & IPW_INDIRECT_ADDR_MASK);
338         _ipw_write16(priv, IPW_INDIRECT_DATA, value);
339 }
340
341 /* indirect read s */
342
343 static u8 _ipw_read_reg8(struct ipw_priv *priv, u32 reg)
344 {
345         u32 word;
346         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg & IPW_INDIRECT_ADDR_MASK);
347         IPW_DEBUG_IO(" reg = 0x%8X : \n", reg);
348         word = _ipw_read32(priv, IPW_INDIRECT_DATA);
349         return (word >> ((reg & 0x3) * 8)) & 0xff;
350 }
351
352 static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg)
353 {
354         u32 value;
355
356         IPW_DEBUG_IO("%p : reg = 0x%08x\n", priv, reg);
357
358         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
359         value = _ipw_read32(priv, IPW_INDIRECT_DATA);
360         IPW_DEBUG_IO(" reg = 0x%4X : value = 0x%4x \n", reg, value);
361         return value;
362 }
363
364 /* iterative/auto-increment 32 bit reads and writes */
365 static void _ipw_read_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
366                                int num)
367 {
368         u32 aligned_addr = addr & IPW_INDIRECT_ADDR_MASK;
369         u32 dif_len = addr - aligned_addr;
370         u32 i;
371
372         IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
373
374         if (num <= 0) {
375                 return;
376         }
377
378         /* Read the first nibble byte by byte */
379         if (unlikely(dif_len)) {
380                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
381                 /* Start reading at aligned_addr + dif_len */
382                 for (i = dif_len; ((i < 4) && (num > 0)); i++, num--)
383                         *buf++ = _ipw_read8(priv, IPW_INDIRECT_DATA + i);
384                 aligned_addr += 4;
385         }
386
387         _ipw_write32(priv, IPW_AUTOINC_ADDR, aligned_addr);
388         for (; num >= 4; buf += 4, aligned_addr += 4, num -= 4)
389                 *(u32 *) buf = _ipw_read32(priv, IPW_AUTOINC_DATA);
390
391         /* Copy the last nibble */
392         if (unlikely(num)) {
393                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
394                 for (i = 0; num > 0; i++, num--)
395                         *buf++ = ipw_read8(priv, IPW_INDIRECT_DATA + i);
396         }
397 }
398
399 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
400                                 int num)
401 {
402         u32 aligned_addr = addr & IPW_INDIRECT_ADDR_MASK;
403         u32 dif_len = addr - aligned_addr;
404         u32 i;
405
406         IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
407
408         if (num <= 0) {
409                 return;
410         }
411
412         /* Write the first nibble byte by byte */
413         if (unlikely(dif_len)) {
414                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
415                 /* Start reading at aligned_addr + dif_len */
416                 for (i = dif_len; ((i < 4) && (num > 0)); i++, num--, buf++)
417                         _ipw_write8(priv, IPW_INDIRECT_DATA + i, *buf);
418                 aligned_addr += 4;
419         }
420
421         _ipw_write32(priv, IPW_AUTOINC_ADDR, aligned_addr);
422         for (; num >= 4; buf += 4, aligned_addr += 4, num -= 4)
423                 _ipw_write32(priv, IPW_AUTOINC_DATA, *(u32 *) buf);
424
425         /* Copy the last nibble */
426         if (unlikely(num)) {
427                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
428                 for (i = 0; num > 0; i++, num--, buf++)
429                         _ipw_write8(priv, IPW_INDIRECT_DATA + i, *buf);
430         }
431 }
432
433 static void ipw_write_direct(struct ipw_priv *priv, u32 addr, void *buf,
434                              int num)
435 {
436         memcpy_toio((priv->hw_base + addr), buf, num);
437 }
438
439 static inline void ipw_set_bit(struct ipw_priv *priv, u32 reg, u32 mask)
440 {
441         ipw_write32(priv, reg, ipw_read32(priv, reg) | mask);
442 }
443
444 static inline void ipw_clear_bit(struct ipw_priv *priv, u32 reg, u32 mask)
445 {
446         ipw_write32(priv, reg, ipw_read32(priv, reg) & ~mask);
447 }
448
449 static inline void ipw_enable_interrupts(struct ipw_priv *priv)
450 {
451         if (priv->status & STATUS_INT_ENABLED)
452                 return;
453         priv->status |= STATUS_INT_ENABLED;
454         ipw_write32(priv, IPW_INTA_MASK_R, IPW_INTA_MASK_ALL);
455 }
456
457 static inline void ipw_disable_interrupts(struct ipw_priv *priv)
458 {
459         if (!(priv->status & STATUS_INT_ENABLED))
460                 return;
461         priv->status &= ~STATUS_INT_ENABLED;
462         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
463 }
464
465 #ifdef CONFIG_IPW2200_DEBUG
466 static char *ipw_error_desc(u32 val)
467 {
468         switch (val) {
469         case IPW_FW_ERROR_OK:
470                 return "ERROR_OK";
471         case IPW_FW_ERROR_FAIL:
472                 return "ERROR_FAIL";
473         case IPW_FW_ERROR_MEMORY_UNDERFLOW:
474                 return "MEMORY_UNDERFLOW";
475         case IPW_FW_ERROR_MEMORY_OVERFLOW:
476                 return "MEMORY_OVERFLOW";
477         case IPW_FW_ERROR_BAD_PARAM:
478                 return "BAD_PARAM";
479         case IPW_FW_ERROR_BAD_CHECKSUM:
480                 return "BAD_CHECKSUM";
481         case IPW_FW_ERROR_NMI_INTERRUPT:
482                 return "NMI_INTERRUPT";
483         case IPW_FW_ERROR_BAD_DATABASE:
484                 return "BAD_DATABASE";
485         case IPW_FW_ERROR_ALLOC_FAIL:
486                 return "ALLOC_FAIL";
487         case IPW_FW_ERROR_DMA_UNDERRUN:
488                 return "DMA_UNDERRUN";
489         case IPW_FW_ERROR_DMA_STATUS:
490                 return "DMA_STATUS";
491         case IPW_FW_ERROR_DINO_ERROR:
492                 return "DINO_ERROR";
493         case IPW_FW_ERROR_EEPROM_ERROR:
494                 return "EEPROM_ERROR";
495         case IPW_FW_ERROR_SYSASSERT:
496                 return "SYSASSERT";
497         case IPW_FW_ERROR_FATAL_ERROR:
498                 return "FATAL_ERROR";
499         default:
500                 return "UNKNOWN_ERROR";
501         }
502 }
503
504 static void ipw_dump_error_log(struct ipw_priv *priv,
505                                struct ipw_fw_error *error)
506 {
507         u32 i;
508
509         if (!error) {
510                 IPW_ERROR("Error allocating and capturing error log.  "
511                           "Nothing to dump.\n");
512                 return;
513         }
514
515         IPW_ERROR("Start IPW Error Log Dump:\n");
516         IPW_ERROR("Status: 0x%08X, Config: %08X\n",
517                   error->status, error->config);
518
519         for (i = 0; i < error->elem_len; i++)
520                 IPW_ERROR("%s %i 0x%08x  0x%08x  0x%08x  0x%08x  0x%08x\n",
521                           ipw_error_desc(error->elem[i].desc),
522                           error->elem[i].time,
523                           error->elem[i].blink1,
524                           error->elem[i].blink2,
525                           error->elem[i].link1,
526                           error->elem[i].link2, error->elem[i].data);
527         for (i = 0; i < error->log_len; i++)
528                 IPW_ERROR("%i\t0x%08x\t%i\n",
529                           error->log[i].time,
530                           error->log[i].data, error->log[i].event);
531 }
532 #endif
533
534 static inline int ipw_is_init(struct ipw_priv *priv)
535 {
536         return (priv->status & STATUS_INIT) ? 1 : 0;
537 }
538
539 static int ipw_get_ordinal(struct ipw_priv *priv, u32 ord, void *val, u32 * len)
540 {
541         u32 addr, field_info, field_len, field_count, total_len;
542
543         IPW_DEBUG_ORD("ordinal = %i\n", ord);
544
545         if (!priv || !val || !len) {
546                 IPW_DEBUG_ORD("Invalid argument\n");
547                 return -EINVAL;
548         }
549
550         /* verify device ordinal tables have been initialized */
551         if (!priv->table0_addr || !priv->table1_addr || !priv->table2_addr) {
552                 IPW_DEBUG_ORD("Access ordinals before initialization\n");
553                 return -EINVAL;
554         }
555
556         switch (IPW_ORD_TABLE_ID_MASK & ord) {
557         case IPW_ORD_TABLE_0_MASK:
558                 /*
559                  * TABLE 0: Direct access to a table of 32 bit values
560                  *
561                  * This is a very simple table with the data directly
562                  * read from the table
563                  */
564
565                 /* remove the table id from the ordinal */
566                 ord &= IPW_ORD_TABLE_VALUE_MASK;
567
568                 /* boundary check */
569                 if (ord > priv->table0_len) {
570                         IPW_DEBUG_ORD("ordinal value (%i) longer then "
571                                       "max (%i)\n", ord, priv->table0_len);
572                         return -EINVAL;
573                 }
574
575                 /* verify we have enough room to store the value */
576                 if (*len < sizeof(u32)) {
577                         IPW_DEBUG_ORD("ordinal buffer length too small, "
578                                       "need %zd\n", sizeof(u32));
579                         return -EINVAL;
580                 }
581
582                 IPW_DEBUG_ORD("Reading TABLE0[%i] from offset 0x%08x\n",
583                               ord, priv->table0_addr + (ord << 2));
584
585                 *len = sizeof(u32);
586                 ord <<= 2;
587                 *((u32 *) val) = ipw_read32(priv, priv->table0_addr + ord);
588                 break;
589
590         case IPW_ORD_TABLE_1_MASK:
591                 /*
592                  * TABLE 1: Indirect access to a table of 32 bit values
593                  *
594                  * This is a fairly large table of u32 values each
595                  * representing starting addr for the data (which is
596                  * also a u32)
597                  */
598
599                 /* remove the table id from the ordinal */
600                 ord &= IPW_ORD_TABLE_VALUE_MASK;
601
602                 /* boundary check */
603                 if (ord > priv->table1_len) {
604                         IPW_DEBUG_ORD("ordinal value too long\n");
605                         return -EINVAL;
606                 }
607
608                 /* verify we have enough room to store the value */
609                 if (*len < sizeof(u32)) {
610                         IPW_DEBUG_ORD("ordinal buffer length too small, "
611                                       "need %zd\n", sizeof(u32));
612                         return -EINVAL;
613                 }
614
615                 *((u32 *) val) =
616                     ipw_read_reg32(priv, (priv->table1_addr + (ord << 2)));
617                 *len = sizeof(u32);
618                 break;
619
620         case IPW_ORD_TABLE_2_MASK:
621                 /*
622                  * TABLE 2: Indirect access to a table of variable sized values
623                  *
624                  * This table consist of six values, each containing
625                  *     - dword containing the starting offset of the data
626                  *     - dword containing the lengh in the first 16bits
627                  *       and the count in the second 16bits
628                  */
629
630                 /* remove the table id from the ordinal */
631                 ord &= IPW_ORD_TABLE_VALUE_MASK;
632
633                 /* boundary check */
634                 if (ord > priv->table2_len) {
635                         IPW_DEBUG_ORD("ordinal value too long\n");
636                         return -EINVAL;
637                 }
638
639                 /* get the address of statistic */
640                 addr = ipw_read_reg32(priv, priv->table2_addr + (ord << 3));
641
642                 /* get the second DW of statistics ;
643                  * two 16-bit words - first is length, second is count */
644                 field_info =
645                     ipw_read_reg32(priv,
646                                    priv->table2_addr + (ord << 3) +
647                                    sizeof(u32));
648
649                 /* get each entry length */
650                 field_len = *((u16 *) & field_info);
651
652                 /* get number of entries */
653                 field_count = *(((u16 *) & field_info) + 1);
654
655                 /* abort if not enought memory */
656                 total_len = field_len * field_count;
657                 if (total_len > *len) {
658                         *len = total_len;
659                         return -EINVAL;
660                 }
661
662                 *len = total_len;
663                 if (!total_len)
664                         return 0;
665
666                 IPW_DEBUG_ORD("addr = 0x%08x, total_len = %i, "
667                               "field_info = 0x%08x\n",
668                               addr, total_len, field_info);
669                 ipw_read_indirect(priv, addr, val, total_len);
670                 break;
671
672         default:
673                 IPW_DEBUG_ORD("Invalid ordinal!\n");
674                 return -EINVAL;
675
676         }
677
678         return 0;
679 }
680
681 static void ipw_init_ordinals(struct ipw_priv *priv)
682 {
683         priv->table0_addr = IPW_ORDINALS_TABLE_LOWER;
684         priv->table0_len = ipw_read32(priv, priv->table0_addr);
685
686         IPW_DEBUG_ORD("table 0 offset at 0x%08x, len = %i\n",
687                       priv->table0_addr, priv->table0_len);
688
689         priv->table1_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_1);
690         priv->table1_len = ipw_read_reg32(priv, priv->table1_addr);
691
692         IPW_DEBUG_ORD("table 1 offset at 0x%08x, len = %i\n",
693                       priv->table1_addr, priv->table1_len);
694
695         priv->table2_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_2);
696         priv->table2_len = ipw_read_reg32(priv, priv->table2_addr);
697         priv->table2_len &= 0x0000ffff; /* use first two bytes */
698
699         IPW_DEBUG_ORD("table 2 offset at 0x%08x, len = %i\n",
700                       priv->table2_addr, priv->table2_len);
701
702 }
703
704 u32 ipw_register_toggle(u32 reg)
705 {
706         reg &= ~IPW_START_STANDBY;
707         if (reg & IPW_GATE_ODMA)
708                 reg &= ~IPW_GATE_ODMA;
709         if (reg & IPW_GATE_IDMA)
710                 reg &= ~IPW_GATE_IDMA;
711         if (reg & IPW_GATE_ADMA)
712                 reg &= ~IPW_GATE_ADMA;
713         return reg;
714 }
715
716 /*
717  * LED behavior:
718  * - On radio ON, turn on any LEDs that require to be on during start
719  * - On initialization, start unassociated blink
720  * - On association, disable unassociated blink
721  * - On disassociation, start unassociated blink
722  * - On radio OFF, turn off any LEDs started during radio on
723  *
724  */
725 #define LD_TIME_LINK_ON 300
726 #define LD_TIME_LINK_OFF 2700
727 #define LD_TIME_ACT_ON 250
728
729 void ipw_led_link_on(struct ipw_priv *priv)
730 {
731         unsigned long flags;
732         u32 led;
733
734         /* If configured to not use LEDs, or nic_type is 1,
735          * then we don't toggle a LINK led */
736         if (priv->config & CFG_NO_LED || priv->nic_type == EEPROM_NIC_TYPE_1)
737                 return;
738
739         spin_lock_irqsave(&priv->lock, flags);
740
741         if (!(priv->status & STATUS_RF_KILL_MASK) &&
742             !(priv->status & STATUS_LED_LINK_ON)) {
743                 IPW_DEBUG_LED("Link LED On\n");
744                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
745                 led |= priv->led_association_on;
746
747                 led = ipw_register_toggle(led);
748
749                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
750                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
751
752                 priv->status |= STATUS_LED_LINK_ON;
753
754                 /* If we aren't associated, schedule turning the LED off */
755                 if (!(priv->status & STATUS_ASSOCIATED))
756                         queue_delayed_work(priv->workqueue,
757                                            &priv->led_link_off,
758                                            LD_TIME_LINK_ON);
759         }
760
761         spin_unlock_irqrestore(&priv->lock, flags);
762 }
763
764 static void ipw_bg_led_link_on(void *data)
765 {
766         struct ipw_priv *priv = data;
767         down(&priv->sem);
768         ipw_led_link_on(data);
769         up(&priv->sem);
770 }
771
772 void ipw_led_link_off(struct ipw_priv *priv)
773 {
774         unsigned long flags;
775         u32 led;
776
777         /* If configured not to use LEDs, or nic type is 1,
778          * then we don't goggle the LINK led. */
779         if (priv->config & CFG_NO_LED || priv->nic_type == EEPROM_NIC_TYPE_1)
780                 return;
781
782         spin_lock_irqsave(&priv->lock, flags);
783
784         if (priv->status & STATUS_LED_LINK_ON) {
785                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
786                 led &= priv->led_association_off;
787                 led = ipw_register_toggle(led);
788
789                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
790                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
791
792                 IPW_DEBUG_LED("Link LED Off\n");
793
794                 priv->status &= ~STATUS_LED_LINK_ON;
795
796                 /* If we aren't associated and the radio is on, schedule
797                  * turning the LED on (blink while unassociated) */
798                 if (!(priv->status & STATUS_RF_KILL_MASK) &&
799                     !(priv->status & STATUS_ASSOCIATED))
800                         queue_delayed_work(priv->workqueue, &priv->led_link_on,
801                                            LD_TIME_LINK_OFF);
802
803         }
804
805         spin_unlock_irqrestore(&priv->lock, flags);
806 }
807
808 static void ipw_bg_led_link_off(void *data)
809 {
810         struct ipw_priv *priv = data;
811         down(&priv->sem);
812         ipw_led_link_off(data);
813         up(&priv->sem);
814 }
815
816 static void __ipw_led_activity_on(struct ipw_priv *priv)
817 {
818         u32 led;
819
820         if (priv->config & CFG_NO_LED)
821                 return;
822
823         if (priv->status & STATUS_RF_KILL_MASK)
824                 return;
825
826         if (!(priv->status & STATUS_LED_ACT_ON)) {
827                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
828                 led |= priv->led_activity_on;
829
830                 led = ipw_register_toggle(led);
831
832                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
833                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
834
835                 IPW_DEBUG_LED("Activity LED On\n");
836
837                 priv->status |= STATUS_LED_ACT_ON;
838
839                 cancel_delayed_work(&priv->led_act_off);
840                 queue_delayed_work(priv->workqueue, &priv->led_act_off,
841                                    LD_TIME_ACT_ON);
842         } else {
843                 /* Reschedule LED off for full time period */
844                 cancel_delayed_work(&priv->led_act_off);
845                 queue_delayed_work(priv->workqueue, &priv->led_act_off,
846                                    LD_TIME_ACT_ON);
847         }
848 }
849
850 void ipw_led_activity_on(struct ipw_priv *priv)
851 {
852         unsigned long flags;
853         spin_lock_irqsave(&priv->lock, flags);
854         __ipw_led_activity_on(priv);
855         spin_unlock_irqrestore(&priv->lock, flags);
856 }
857
858 void ipw_led_activity_off(struct ipw_priv *priv)
859 {
860         unsigned long flags;
861         u32 led;
862
863         if (priv->config & CFG_NO_LED)
864                 return;
865
866         spin_lock_irqsave(&priv->lock, flags);
867
868         if (priv->status & STATUS_LED_ACT_ON) {
869                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
870                 led &= priv->led_activity_off;
871
872                 led = ipw_register_toggle(led);
873
874                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
875                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
876
877                 IPW_DEBUG_LED("Activity LED Off\n");
878
879                 priv->status &= ~STATUS_LED_ACT_ON;
880         }
881
882         spin_unlock_irqrestore(&priv->lock, flags);
883 }
884
885 static void ipw_bg_led_activity_off(void *data)
886 {
887         struct ipw_priv *priv = data;
888         down(&priv->sem);
889         ipw_led_activity_off(data);
890         up(&priv->sem);
891 }
892
893 void ipw_led_band_on(struct ipw_priv *priv)
894 {
895         unsigned long flags;
896         u32 led;
897
898         /* Only nic type 1 supports mode LEDs */
899         if (priv->config & CFG_NO_LED ||
900             priv->nic_type != EEPROM_NIC_TYPE_1 || !priv->assoc_network)
901                 return;
902
903         spin_lock_irqsave(&priv->lock, flags);
904
905         led = ipw_read_reg32(priv, IPW_EVENT_REG);
906         if (priv->assoc_network->mode == IEEE_A) {
907                 led |= priv->led_ofdm_on;
908                 led &= priv->led_association_off;
909                 IPW_DEBUG_LED("Mode LED On: 802.11a\n");
910         } else if (priv->assoc_network->mode == IEEE_G) {
911                 led |= priv->led_ofdm_on;
912                 led |= priv->led_association_on;
913                 IPW_DEBUG_LED("Mode LED On: 802.11g\n");
914         } else {
915                 led &= priv->led_ofdm_off;
916                 led |= priv->led_association_on;
917                 IPW_DEBUG_LED("Mode LED On: 802.11b\n");
918         }
919
920         led = ipw_register_toggle(led);
921
922         IPW_DEBUG_LED("Reg: 0x%08X\n", led);
923         ipw_write_reg32(priv, IPW_EVENT_REG, led);
924
925         spin_unlock_irqrestore(&priv->lock, flags);
926 }
927
928 void ipw_led_band_off(struct ipw_priv *priv)
929 {
930         unsigned long flags;
931         u32 led;
932
933         /* Only nic type 1 supports mode LEDs */
934         if (priv->config & CFG_NO_LED || priv->nic_type != EEPROM_NIC_TYPE_1)
935                 return;
936
937         spin_lock_irqsave(&priv->lock, flags);
938
939         led = ipw_read_reg32(priv, IPW_EVENT_REG);
940         led &= priv->led_ofdm_off;
941         led &= priv->led_association_off;
942
943         led = ipw_register_toggle(led);
944
945         IPW_DEBUG_LED("Reg: 0x%08X\n", led);
946         ipw_write_reg32(priv, IPW_EVENT_REG, led);
947
948         spin_unlock_irqrestore(&priv->lock, flags);
949 }
950
951 void ipw_led_radio_on(struct ipw_priv *priv)
952 {
953         ipw_led_link_on(priv);
954 }
955
956 void ipw_led_radio_off(struct ipw_priv *priv)
957 {
958         ipw_led_activity_off(priv);
959         ipw_led_link_off(priv);
960 }
961
962 void ipw_led_link_up(struct ipw_priv *priv)
963 {
964         /* Set the Link Led on for all nic types */
965         ipw_led_link_on(priv);
966 }
967
968 void ipw_led_link_down(struct ipw_priv *priv)
969 {
970         ipw_led_activity_off(priv);
971         ipw_led_link_off(priv);
972
973         if (priv->status & STATUS_RF_KILL_MASK)
974                 ipw_led_radio_off(priv);
975 }
976
977 void ipw_led_init(struct ipw_priv *priv)
978 {
979         priv->nic_type = priv->eeprom[EEPROM_NIC_TYPE];
980
981         /* Set the default PINs for the link and activity leds */
982         priv->led_activity_on = IPW_ACTIVITY_LED;
983         priv->led_activity_off = ~(IPW_ACTIVITY_LED);
984
985         priv->led_association_on = IPW_ASSOCIATED_LED;
986         priv->led_association_off = ~(IPW_ASSOCIATED_LED);
987
988         /* Set the default PINs for the OFDM leds */
989         priv->led_ofdm_on = IPW_OFDM_LED;
990         priv->led_ofdm_off = ~(IPW_OFDM_LED);
991
992         switch (priv->nic_type) {
993         case EEPROM_NIC_TYPE_1:
994                 /* In this NIC type, the LEDs are reversed.... */
995                 priv->led_activity_on = IPW_ASSOCIATED_LED;
996                 priv->led_activity_off = ~(IPW_ASSOCIATED_LED);
997                 priv->led_association_on = IPW_ACTIVITY_LED;
998                 priv->led_association_off = ~(IPW_ACTIVITY_LED);
999
1000                 if (!(priv->config & CFG_NO_LED))
1001                         ipw_led_band_on(priv);
1002
1003                 /* And we don't blink link LEDs for this nic, so
1004                  * just return here */
1005                 return;
1006
1007         case EEPROM_NIC_TYPE_3:
1008         case EEPROM_NIC_TYPE_2:
1009         case EEPROM_NIC_TYPE_4:
1010         case EEPROM_NIC_TYPE_0:
1011                 break;
1012
1013         default:
1014                 IPW_DEBUG_INFO("Unknown NIC type from EEPROM: %d\n",
1015                                priv->nic_type);
1016                 priv->nic_type = EEPROM_NIC_TYPE_0;
1017                 break;
1018         }
1019
1020         if (!(priv->config & CFG_NO_LED)) {
1021                 if (priv->status & STATUS_ASSOCIATED)
1022                         ipw_led_link_on(priv);
1023                 else
1024                         ipw_led_link_off(priv);
1025         }
1026 }
1027
1028 void ipw_led_shutdown(struct ipw_priv *priv)
1029 {
1030         ipw_led_activity_off(priv);
1031         ipw_led_link_off(priv);
1032         ipw_led_band_off(priv);
1033         cancel_delayed_work(&priv->led_link_on);
1034         cancel_delayed_work(&priv->led_link_off);
1035         cancel_delayed_work(&priv->led_act_off);
1036 }
1037
1038 /*
1039  * The following adds a new attribute to the sysfs representation
1040  * of this device driver (i.e. a new file in /sys/bus/pci/drivers/ipw/)
1041  * used for controling the debug level.
1042  *
1043  * See the level definitions in ipw for details.
1044  */
1045 static ssize_t show_debug_level(struct device_driver *d, char *buf)
1046 {
1047         return sprintf(buf, "0x%08X\n", ipw_debug_level);
1048 }
1049
1050 static ssize_t store_debug_level(struct device_driver *d, const char *buf,
1051                                  size_t count)
1052 {
1053         char *p = (char *)buf;
1054         u32 val;
1055
1056         if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
1057                 p++;
1058                 if (p[0] == 'x' || p[0] == 'X')
1059                         p++;
1060                 val = simple_strtoul(p, &p, 16);
1061         } else
1062                 val = simple_strtoul(p, &p, 10);
1063         if (p == buf)
1064                 printk(KERN_INFO DRV_NAME
1065                        ": %s is not in hex or decimal form.\n", buf);
1066         else
1067                 ipw_debug_level = val;
1068
1069         return strnlen(buf, count);
1070 }
1071
1072 static DRIVER_ATTR(debug_level, S_IWUSR | S_IRUGO,
1073                    show_debug_level, store_debug_level);
1074
1075 static inline u32 ipw_get_event_log_len(struct ipw_priv *priv)
1076 {
1077         return ipw_read_reg32(priv, ipw_read32(priv, IPW_EVENT_LOG));
1078 }
1079
1080 static void ipw_capture_event_log(struct ipw_priv *priv,
1081                                   u32 log_len, struct ipw_event *log)
1082 {
1083         u32 base;
1084
1085         if (log_len) {
1086                 base = ipw_read32(priv, IPW_EVENT_LOG);
1087                 ipw_read_indirect(priv, base + sizeof(base) + sizeof(u32),
1088                                   (u8 *) log, sizeof(*log) * log_len);
1089         }
1090 }
1091
1092 static struct ipw_fw_error *ipw_alloc_error_log(struct ipw_priv *priv)
1093 {
1094         struct ipw_fw_error *error;
1095         u32 log_len = ipw_get_event_log_len(priv);
1096         u32 base = ipw_read32(priv, IPW_ERROR_LOG);
1097         u32 elem_len = ipw_read_reg32(priv, base);
1098
1099         error = kmalloc(sizeof(*error) +
1100                         sizeof(*error->elem) * elem_len +
1101                         sizeof(*error->log) * log_len, GFP_ATOMIC);
1102         if (!error) {
1103                 IPW_ERROR("Memory allocation for firmware error log "
1104                           "failed.\n");
1105                 return NULL;
1106         }
1107         error->jiffies = jiffies;
1108         error->status = priv->status;
1109         error->config = priv->config;
1110         error->elem_len = elem_len;
1111         error->log_len = log_len;
1112         error->elem = (struct ipw_error_elem *)error->payload;
1113         error->log = (struct ipw_event *)(error->elem + elem_len);
1114
1115         ipw_capture_event_log(priv, log_len, error->log);
1116
1117         if (elem_len)
1118                 ipw_read_indirect(priv, base + sizeof(base), (u8 *) error->elem,
1119                                   sizeof(*error->elem) * elem_len);
1120
1121         return error;
1122 }
1123
1124 static void ipw_free_error_log(struct ipw_fw_error *error)
1125 {
1126         if (error)
1127                 kfree(error);
1128 }
1129
1130 static ssize_t show_event_log(struct device *d,
1131                               struct device_attribute *attr, char *buf)
1132 {
1133         struct ipw_priv *priv = dev_get_drvdata(d);
1134         u32 log_len = ipw_get_event_log_len(priv);
1135         struct ipw_event log[log_len];
1136         u32 len = 0, i;
1137
1138         ipw_capture_event_log(priv, log_len, log);
1139
1140         len += snprintf(buf + len, PAGE_SIZE - len, "%08X", log_len);
1141         for (i = 0; i < log_len; i++)
1142                 len += snprintf(buf + len, PAGE_SIZE - len,
1143                                 "\n%08X%08X%08X",
1144                                 log[i].time, log[i].event, log[i].data);
1145         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1146         return len;
1147 }
1148
1149 static DEVICE_ATTR(event_log, S_IRUGO, show_event_log, NULL);
1150
1151 static ssize_t show_error(struct device *d,
1152                           struct device_attribute *attr, char *buf)
1153 {
1154         struct ipw_priv *priv = dev_get_drvdata(d);
1155         u32 len = 0, i;
1156         if (!priv->error)
1157                 return 0;
1158         len += snprintf(buf + len, PAGE_SIZE - len,
1159                         "%08lX%08X%08X%08X",
1160                         priv->error->jiffies,
1161                         priv->error->status,
1162                         priv->error->config, priv->error->elem_len);
1163         for (i = 0; i < priv->error->elem_len; i++)
1164                 len += snprintf(buf + len, PAGE_SIZE - len,
1165                                 "\n%08X%08X%08X%08X%08X%08X%08X",
1166                                 priv->error->elem[i].time,
1167                                 priv->error->elem[i].desc,
1168                                 priv->error->elem[i].blink1,
1169                                 priv->error->elem[i].blink2,
1170                                 priv->error->elem[i].link1,
1171                                 priv->error->elem[i].link2,
1172                                 priv->error->elem[i].data);
1173
1174         len += snprintf(buf + len, PAGE_SIZE - len,
1175                         "\n%08X", priv->error->log_len);
1176         for (i = 0; i < priv->error->log_len; i++)
1177                 len += snprintf(buf + len, PAGE_SIZE - len,
1178                                 "\n%08X%08X%08X",
1179                                 priv->error->log[i].time,
1180                                 priv->error->log[i].event,
1181                                 priv->error->log[i].data);
1182         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1183         return len;
1184 }
1185
1186 static ssize_t clear_error(struct device *d,
1187                            struct device_attribute *attr,
1188                            const char *buf, size_t count)
1189 {
1190         struct ipw_priv *priv = dev_get_drvdata(d);
1191         if (priv->error) {
1192                 ipw_free_error_log(priv->error);
1193                 priv->error = NULL;
1194         }
1195         return count;
1196 }
1197
1198 static DEVICE_ATTR(error, S_IRUGO | S_IWUSR, show_error, clear_error);
1199
1200 static ssize_t show_cmd_log(struct device *d,
1201                             struct device_attribute *attr, char *buf)
1202 {
1203         struct ipw_priv *priv = dev_get_drvdata(d);
1204         u32 len = 0, i;
1205         if (!priv->cmdlog)
1206                 return 0;
1207         for (i = (priv->cmdlog_pos + 1) % priv->cmdlog_len;
1208              (i != priv->cmdlog_pos) && (PAGE_SIZE - len);
1209              i = (i + 1) % priv->cmdlog_len) {
1210                 len +=
1211                     snprintf(buf + len, PAGE_SIZE - len,
1212                              "\n%08lX%08X%08X%08X\n", priv->cmdlog[i].jiffies,
1213                              priv->cmdlog[i].retcode, priv->cmdlog[i].cmd.cmd,
1214                              priv->cmdlog[i].cmd.len);
1215                 len +=
1216                     snprintk_buf(buf + len, PAGE_SIZE - len,
1217                                  (u8 *) priv->cmdlog[i].cmd.param,
1218                                  priv->cmdlog[i].cmd.len);
1219                 len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1220         }
1221         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1222         return len;
1223 }
1224
1225 static DEVICE_ATTR(cmd_log, S_IRUGO, show_cmd_log, NULL);
1226
1227 static ssize_t show_scan_age(struct device *d, struct device_attribute *attr,
1228                              char *buf)
1229 {
1230         struct ipw_priv *priv = dev_get_drvdata(d);
1231         return sprintf(buf, "%d\n", priv->ieee->scan_age);
1232 }
1233
1234 static ssize_t store_scan_age(struct device *d, struct device_attribute *attr,
1235                               const char *buf, size_t count)
1236 {
1237         struct ipw_priv *priv = dev_get_drvdata(d);
1238 #ifdef CONFIG_IPW2200_DEBUG
1239         struct net_device *dev = priv->net_dev;
1240 #endif
1241         char buffer[] = "00000000";
1242         unsigned long len =
1243             (sizeof(buffer) - 1) > count ? count : sizeof(buffer) - 1;
1244         unsigned long val;
1245         char *p = buffer;
1246
1247         IPW_DEBUG_INFO("enter\n");
1248
1249         strncpy(buffer, buf, len);
1250         buffer[len] = 0;
1251
1252         if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
1253                 p++;
1254                 if (p[0] == 'x' || p[0] == 'X')
1255                         p++;
1256                 val = simple_strtoul(p, &p, 16);
1257         } else
1258                 val = simple_strtoul(p, &p, 10);
1259         if (p == buffer) {
1260                 IPW_DEBUG_INFO("%s: user supplied invalid value.\n", dev->name);
1261         } else {
1262                 priv->ieee->scan_age = val;
1263                 IPW_DEBUG_INFO("set scan_age = %u\n", priv->ieee->scan_age);
1264         }
1265
1266         IPW_DEBUG_INFO("exit\n");
1267         return len;
1268 }
1269
1270 static DEVICE_ATTR(scan_age, S_IWUSR | S_IRUGO, show_scan_age, store_scan_age);
1271
1272 static ssize_t show_led(struct device *d, struct device_attribute *attr,
1273                         char *buf)
1274 {
1275         struct ipw_priv *priv = dev_get_drvdata(d);
1276         return sprintf(buf, "%d\n", (priv->config & CFG_NO_LED) ? 0 : 1);
1277 }
1278
1279 static ssize_t store_led(struct device *d, struct device_attribute *attr,
1280                          const char *buf, size_t count)
1281 {
1282         struct ipw_priv *priv = dev_get_drvdata(d);
1283
1284         IPW_DEBUG_INFO("enter\n");
1285
1286         if (count == 0)
1287                 return 0;
1288
1289         if (*buf == 0) {
1290                 IPW_DEBUG_LED("Disabling LED control.\n");
1291                 priv->config |= CFG_NO_LED;
1292                 ipw_led_shutdown(priv);
1293         } else {
1294                 IPW_DEBUG_LED("Enabling LED control.\n");
1295                 priv->config &= ~CFG_NO_LED;
1296                 ipw_led_init(priv);
1297         }
1298
1299         IPW_DEBUG_INFO("exit\n");
1300         return count;
1301 }
1302
1303 static DEVICE_ATTR(led, S_IWUSR | S_IRUGO, show_led, store_led);
1304
1305 static ssize_t show_status(struct device *d,
1306                            struct device_attribute *attr, char *buf)
1307 {
1308         struct ipw_priv *p = d->driver_data;
1309         return sprintf(buf, "0x%08x\n", (int)p->status);
1310 }
1311
1312 static DEVICE_ATTR(status, S_IRUGO, show_status, NULL);
1313
1314 static ssize_t show_cfg(struct device *d, struct device_attribute *attr,
1315                         char *buf)
1316 {
1317         struct ipw_priv *p = d->driver_data;
1318         return sprintf(buf, "0x%08x\n", (int)p->config);
1319 }
1320
1321 static DEVICE_ATTR(cfg, S_IRUGO, show_cfg, NULL);
1322
1323 static ssize_t show_nic_type(struct device *d,
1324                              struct device_attribute *attr, char *buf)
1325 {
1326         struct ipw_priv *priv = d->driver_data;
1327         return sprintf(buf, "TYPE: %d\n", priv->nic_type);
1328 }
1329
1330 static DEVICE_ATTR(nic_type, S_IRUGO, show_nic_type, NULL);
1331
1332 static ssize_t show_ucode_version(struct device *d,
1333                                   struct device_attribute *attr, char *buf)
1334 {
1335         u32 len = sizeof(u32), tmp = 0;
1336         struct ipw_priv *p = d->driver_data;
1337
1338         if (ipw_get_ordinal(p, IPW_ORD_STAT_UCODE_VERSION, &tmp, &len))
1339                 return 0;
1340
1341         return sprintf(buf, "0x%08x\n", tmp);
1342 }
1343
1344 static DEVICE_ATTR(ucode_version, S_IWUSR | S_IRUGO, show_ucode_version, NULL);
1345
1346 static ssize_t show_rtc(struct device *d, struct device_attribute *attr,
1347                         char *buf)
1348 {
1349         u32 len = sizeof(u32), tmp = 0;
1350         struct ipw_priv *p = d->driver_data;
1351
1352         if (ipw_get_ordinal(p, IPW_ORD_STAT_RTC, &tmp, &len))
1353                 return 0;
1354
1355         return sprintf(buf, "0x%08x\n", tmp);
1356 }
1357
1358 static DEVICE_ATTR(rtc, S_IWUSR | S_IRUGO, show_rtc, NULL);
1359
1360 /*
1361  * Add a device attribute to view/control the delay between eeprom
1362  * operations.
1363  */
1364 static ssize_t show_eeprom_delay(struct device *d,
1365                                  struct device_attribute *attr, char *buf)
1366 {
1367         int n = ((struct ipw_priv *)d->driver_data)->eeprom_delay;
1368         return sprintf(buf, "%i\n", n);
1369 }
1370 static ssize_t store_eeprom_delay(struct device *d,
1371                                   struct device_attribute *attr,
1372                                   const char *buf, size_t count)
1373 {
1374         struct ipw_priv *p = d->driver_data;
1375         sscanf(buf, "%i", &p->eeprom_delay);
1376         return strnlen(buf, count);
1377 }
1378
1379 static DEVICE_ATTR(eeprom_delay, S_IWUSR | S_IRUGO,
1380                    show_eeprom_delay, store_eeprom_delay);
1381
1382 static ssize_t show_command_event_reg(struct device *d,
1383                                       struct device_attribute *attr, char *buf)
1384 {
1385         u32 reg = 0;
1386         struct ipw_priv *p = d->driver_data;
1387
1388         reg = ipw_read_reg32(p, IPW_INTERNAL_CMD_EVENT);
1389         return sprintf(buf, "0x%08x\n", reg);
1390 }
1391 static ssize_t store_command_event_reg(struct device *d,
1392                                        struct device_attribute *attr,
1393                                        const char *buf, size_t count)
1394 {
1395         u32 reg;
1396         struct ipw_priv *p = d->driver_data;
1397
1398         sscanf(buf, "%x", &reg);
1399         ipw_write_reg32(p, IPW_INTERNAL_CMD_EVENT, reg);
1400         return strnlen(buf, count);
1401 }
1402
1403 static DEVICE_ATTR(command_event_reg, S_IWUSR | S_IRUGO,
1404                    show_command_event_reg, store_command_event_reg);
1405
1406 static ssize_t show_mem_gpio_reg(struct device *d,
1407                                  struct device_attribute *attr, char *buf)
1408 {
1409         u32 reg = 0;
1410         struct ipw_priv *p = d->driver_data;
1411
1412         reg = ipw_read_reg32(p, 0x301100);
1413         return sprintf(buf, "0x%08x\n", reg);
1414 }
1415 static ssize_t store_mem_gpio_reg(struct device *d,
1416                                   struct device_attribute *attr,
1417                                   const char *buf, size_t count)
1418 {
1419         u32 reg;
1420         struct ipw_priv *p = d->driver_data;
1421
1422         sscanf(buf, "%x", &reg);
1423         ipw_write_reg32(p, 0x301100, reg);
1424         return strnlen(buf, count);
1425 }
1426
1427 static DEVICE_ATTR(mem_gpio_reg, S_IWUSR | S_IRUGO,
1428                    show_mem_gpio_reg, store_mem_gpio_reg);
1429
1430 static ssize_t show_indirect_dword(struct device *d,
1431                                    struct device_attribute *attr, char *buf)
1432 {
1433         u32 reg = 0;
1434         struct ipw_priv *priv = d->driver_data;
1435
1436         if (priv->status & STATUS_INDIRECT_DWORD)
1437                 reg = ipw_read_reg32(priv, priv->indirect_dword);
1438         else
1439                 reg = 0;
1440
1441         return sprintf(buf, "0x%08x\n", reg);
1442 }
1443 static ssize_t store_indirect_dword(struct device *d,
1444                                     struct device_attribute *attr,
1445                                     const char *buf, size_t count)
1446 {
1447         struct ipw_priv *priv = d->driver_data;
1448
1449         sscanf(buf, "%x", &priv->indirect_dword);
1450         priv->status |= STATUS_INDIRECT_DWORD;
1451         return strnlen(buf, count);
1452 }
1453
1454 static DEVICE_ATTR(indirect_dword, S_IWUSR | S_IRUGO,
1455                    show_indirect_dword, store_indirect_dword);
1456
1457 static ssize_t show_indirect_byte(struct device *d,
1458                                   struct device_attribute *attr, char *buf)
1459 {
1460         u8 reg = 0;
1461         struct ipw_priv *priv = d->driver_data;
1462
1463         if (priv->status & STATUS_INDIRECT_BYTE)
1464                 reg = ipw_read_reg8(priv, priv->indirect_byte);
1465         else
1466                 reg = 0;
1467
1468         return sprintf(buf, "0x%02x\n", reg);
1469 }
1470 static ssize_t store_indirect_byte(struct device *d,
1471                                    struct device_attribute *attr,
1472                                    const char *buf, size_t count)
1473 {
1474         struct ipw_priv *priv = d->driver_data;
1475
1476         sscanf(buf, "%x", &priv->indirect_byte);
1477         priv->status |= STATUS_INDIRECT_BYTE;
1478         return strnlen(buf, count);
1479 }
1480
1481 static DEVICE_ATTR(indirect_byte, S_IWUSR | S_IRUGO,
1482                    show_indirect_byte, store_indirect_byte);
1483
1484 static ssize_t show_direct_dword(struct device *d,
1485                                  struct device_attribute *attr, char *buf)
1486 {
1487         u32 reg = 0;
1488         struct ipw_priv *priv = d->driver_data;
1489
1490         if (priv->status & STATUS_DIRECT_DWORD)
1491                 reg = ipw_read32(priv, priv->direct_dword);
1492         else
1493                 reg = 0;
1494
1495         return sprintf(buf, "0x%08x\n", reg);
1496 }
1497 static ssize_t store_direct_dword(struct device *d,
1498                                   struct device_attribute *attr,
1499                                   const char *buf, size_t count)
1500 {
1501         struct ipw_priv *priv = d->driver_data;
1502
1503         sscanf(buf, "%x", &priv->direct_dword);
1504         priv->status |= STATUS_DIRECT_DWORD;
1505         return strnlen(buf, count);
1506 }
1507
1508 static DEVICE_ATTR(direct_dword, S_IWUSR | S_IRUGO,
1509                    show_direct_dword, store_direct_dword);
1510
1511 static int rf_kill_active(struct ipw_priv *priv)
1512 {
1513         if (0 == (ipw_read32(priv, 0x30) & 0x10000))
1514                 priv->status |= STATUS_RF_KILL_HW;
1515         else
1516                 priv->status &= ~STATUS_RF_KILL_HW;
1517
1518         return (priv->status & STATUS_RF_KILL_HW) ? 1 : 0;
1519 }
1520
1521 static ssize_t show_rf_kill(struct device *d, struct device_attribute *attr,
1522                             char *buf)
1523 {
1524         /* 0 - RF kill not enabled
1525            1 - SW based RF kill active (sysfs)
1526            2 - HW based RF kill active
1527            3 - Both HW and SW baed RF kill active */
1528         struct ipw_priv *priv = d->driver_data;
1529         int val = ((priv->status & STATUS_RF_KILL_SW) ? 0x1 : 0x0) |
1530             (rf_kill_active(priv) ? 0x2 : 0x0);
1531         return sprintf(buf, "%i\n", val);
1532 }
1533
1534 static int ipw_radio_kill_sw(struct ipw_priv *priv, int disable_radio)
1535 {
1536         if ((disable_radio ? 1 : 0) ==
1537             ((priv->status & STATUS_RF_KILL_SW) ? 1 : 0))
1538                 return 0;
1539
1540         IPW_DEBUG_RF_KILL("Manual SW RF Kill set to: RADIO  %s\n",
1541                           disable_radio ? "OFF" : "ON");
1542
1543         if (disable_radio) {
1544                 priv->status |= STATUS_RF_KILL_SW;
1545
1546                 if (priv->workqueue)
1547                         cancel_delayed_work(&priv->request_scan);
1548                 queue_work(priv->workqueue, &priv->down);
1549         } else {
1550                 priv->status &= ~STATUS_RF_KILL_SW;
1551                 if (rf_kill_active(priv)) {
1552                         IPW_DEBUG_RF_KILL("Can not turn radio back on - "
1553                                           "disabled by HW switch\n");
1554                         /* Make sure the RF_KILL check timer is running */
1555                         cancel_delayed_work(&priv->rf_kill);
1556                         queue_delayed_work(priv->workqueue, &priv->rf_kill,
1557                                            2 * HZ);
1558                 } else
1559                         queue_work(priv->workqueue, &priv->up);
1560         }
1561
1562         return 1;
1563 }
1564
1565 static ssize_t store_rf_kill(struct device *d, struct device_attribute *attr,
1566                              const char *buf, size_t count)
1567 {
1568         struct ipw_priv *priv = d->driver_data;
1569
1570         ipw_radio_kill_sw(priv, buf[0] == '1');
1571
1572         return count;
1573 }
1574
1575 static DEVICE_ATTR(rf_kill, S_IWUSR | S_IRUGO, show_rf_kill, store_rf_kill);
1576
1577 static ssize_t show_speed_scan(struct device *d, struct device_attribute *attr,
1578                                char *buf)
1579 {
1580         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1581         int pos = 0, len = 0;
1582         if (priv->config & CFG_SPEED_SCAN) {
1583                 while (priv->speed_scan[pos] != 0)
1584                         len += sprintf(&buf[len], "%d ",
1585                                        priv->speed_scan[pos++]);
1586                 return len + sprintf(&buf[len], "\n");
1587         }
1588
1589         return sprintf(buf, "0\n");
1590 }
1591
1592 static ssize_t store_speed_scan(struct device *d, struct device_attribute *attr,
1593                                 const char *buf, size_t count)
1594 {
1595         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1596         int channel, pos = 0;
1597         const char *p = buf;
1598
1599         /* list of space separated channels to scan, optionally ending with 0 */
1600         while ((channel = simple_strtol(p, NULL, 0))) {
1601                 if (pos == MAX_SPEED_SCAN - 1) {
1602                         priv->speed_scan[pos] = 0;
1603                         break;
1604                 }
1605
1606                 if (ipw_is_valid_channel(priv->ieee, channel))
1607                         priv->speed_scan[pos++] = channel;
1608                 else
1609                         IPW_WARNING("Skipping invalid channel request: %d\n",
1610                                     channel);
1611                 p = strchr(p, ' ');
1612                 if (!p)
1613                         break;
1614                 while (*p == ' ' || *p == '\t')
1615                         p++;
1616         }
1617
1618         if (pos == 0)
1619                 priv->config &= ~CFG_SPEED_SCAN;
1620         else {
1621                 priv->speed_scan_pos = 0;
1622                 priv->config |= CFG_SPEED_SCAN;
1623         }
1624
1625         return count;
1626 }
1627
1628 static DEVICE_ATTR(speed_scan, S_IWUSR | S_IRUGO, show_speed_scan,
1629                    store_speed_scan);
1630
1631 static ssize_t show_net_stats(struct device *d, struct device_attribute *attr,
1632                               char *buf)
1633 {
1634         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1635         return sprintf(buf, "%c\n", (priv->config & CFG_NET_STATS) ? '1' : '0');
1636 }
1637
1638 static ssize_t store_net_stats(struct device *d, struct device_attribute *attr,
1639                                const char *buf, size_t count)
1640 {
1641         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1642         if (buf[0] == '1')
1643                 priv->config |= CFG_NET_STATS;
1644         else
1645                 priv->config &= ~CFG_NET_STATS;
1646
1647         return count;
1648 }
1649
1650 static DEVICE_ATTR(net_stats, S_IWUSR | S_IRUGO,
1651                    show_net_stats, store_net_stats);
1652
1653 static void notify_wx_assoc_event(struct ipw_priv *priv)
1654 {
1655         union iwreq_data wrqu;
1656         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1657         if (priv->status & STATUS_ASSOCIATED)
1658                 memcpy(wrqu.ap_addr.sa_data, priv->bssid, ETH_ALEN);
1659         else
1660                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
1661         wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
1662 }
1663
1664 static void ipw_irq_tasklet(struct ipw_priv *priv)
1665 {
1666         u32 inta, inta_mask, handled = 0;
1667         unsigned long flags;
1668         int rc = 0;
1669
1670         spin_lock_irqsave(&priv->lock, flags);
1671
1672         inta = ipw_read32(priv, IPW_INTA_RW);
1673         inta_mask = ipw_read32(priv, IPW_INTA_MASK_R);
1674         inta &= (IPW_INTA_MASK_ALL & inta_mask);
1675
1676         /* Add any cached INTA values that need to be handled */
1677         inta |= priv->isr_inta;
1678
1679         /* handle all the justifications for the interrupt */
1680         if (inta & IPW_INTA_BIT_RX_TRANSFER) {
1681                 ipw_rx(priv);
1682                 handled |= IPW_INTA_BIT_RX_TRANSFER;
1683         }
1684
1685         if (inta & IPW_INTA_BIT_TX_CMD_QUEUE) {
1686                 IPW_DEBUG_HC("Command completed.\n");
1687                 rc = ipw_queue_tx_reclaim(priv, &priv->txq_cmd, -1);
1688                 priv->status &= ~STATUS_HCMD_ACTIVE;
1689                 wake_up_interruptible(&priv->wait_command_queue);
1690                 handled |= IPW_INTA_BIT_TX_CMD_QUEUE;
1691         }
1692
1693         if (inta & IPW_INTA_BIT_TX_QUEUE_1) {
1694                 IPW_DEBUG_TX("TX_QUEUE_1\n");
1695                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[0], 0);
1696                 handled |= IPW_INTA_BIT_TX_QUEUE_1;
1697         }
1698
1699         if (inta & IPW_INTA_BIT_TX_QUEUE_2) {
1700                 IPW_DEBUG_TX("TX_QUEUE_2\n");
1701                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[1], 1);
1702                 handled |= IPW_INTA_BIT_TX_QUEUE_2;
1703         }
1704
1705         if (inta & IPW_INTA_BIT_TX_QUEUE_3) {
1706                 IPW_DEBUG_TX("TX_QUEUE_3\n");
1707                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[2], 2);
1708                 handled |= IPW_INTA_BIT_TX_QUEUE_3;
1709         }
1710
1711         if (inta & IPW_INTA_BIT_TX_QUEUE_4) {
1712                 IPW_DEBUG_TX("TX_QUEUE_4\n");
1713                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[3], 3);
1714                 handled |= IPW_INTA_BIT_TX_QUEUE_4;
1715         }
1716
1717         if (inta & IPW_INTA_BIT_STATUS_CHANGE) {
1718                 IPW_WARNING("STATUS_CHANGE\n");
1719                 handled |= IPW_INTA_BIT_STATUS_CHANGE;
1720         }
1721
1722         if (inta & IPW_INTA_BIT_BEACON_PERIOD_EXPIRED) {
1723                 IPW_WARNING("TX_PERIOD_EXPIRED\n");
1724                 handled |= IPW_INTA_BIT_BEACON_PERIOD_EXPIRED;
1725         }
1726
1727         if (inta & IPW_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE) {
1728                 IPW_WARNING("HOST_CMD_DONE\n");
1729                 handled |= IPW_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE;
1730         }
1731
1732         if (inta & IPW_INTA_BIT_FW_INITIALIZATION_DONE) {
1733                 IPW_WARNING("FW_INITIALIZATION_DONE\n");
1734                 handled |= IPW_INTA_BIT_FW_INITIALIZATION_DONE;
1735         }
1736
1737         if (inta & IPW_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE) {
1738                 IPW_WARNING("PHY_OFF_DONE\n");
1739                 handled |= IPW_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE;
1740         }
1741
1742         if (inta & IPW_INTA_BIT_RF_KILL_DONE) {
1743                 IPW_DEBUG_RF_KILL("RF_KILL_DONE\n");
1744                 priv->status |= STATUS_RF_KILL_HW;
1745                 wake_up_interruptible(&priv->wait_command_queue);
1746                 priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
1747                 cancel_delayed_work(&priv->request_scan);
1748                 schedule_work(&priv->link_down);
1749                 queue_delayed_work(priv->workqueue, &priv->rf_kill, 2 * HZ);
1750                 handled |= IPW_INTA_BIT_RF_KILL_DONE;
1751         }
1752
1753         if (inta & IPW_INTA_BIT_FATAL_ERROR) {
1754                 IPW_ERROR("Firmware error detected.  Restarting.\n");
1755                 if (priv->error) {
1756                         IPW_ERROR("Sysfs 'error' log already exists.\n");
1757 #ifdef CONFIG_IPW2200_DEBUG
1758                         if (ipw_debug_level & IPW_DL_FW_ERRORS) {
1759                                 struct ipw_fw_error *error =
1760                                     ipw_alloc_error_log(priv);
1761                                 ipw_dump_error_log(priv, error);
1762                                 if (error)
1763                                         ipw_free_error_log(error);
1764                         }
1765 #endif
1766                 } else {
1767                         priv->error = ipw_alloc_error_log(priv);
1768                         if (priv->error)
1769                                 IPW_ERROR("Sysfs 'error' log captured.\n");
1770                         else
1771                                 IPW_ERROR("Error allocating sysfs 'error' "
1772                                           "log.\n");
1773 #ifdef CONFIG_IPW2200_DEBUG
1774                         if (ipw_debug_level & IPW_DL_FW_ERRORS)
1775                                 ipw_dump_error_log(priv, priv->error);
1776 #endif
1777                 }
1778
1779                 /* XXX: If hardware encryption is for WPA/WPA2,
1780                  * we have to notify the supplicant. */
1781                 if (priv->ieee->sec.encrypt) {
1782                         priv->status &= ~STATUS_ASSOCIATED;
1783                         notify_wx_assoc_event(priv);
1784                 }
1785
1786                 /* Keep the restart process from trying to send host
1787                  * commands by clearing the INIT status bit */
1788                 priv->status &= ~STATUS_INIT;
1789
1790                 /* Cancel currently queued command. */
1791                 priv->status &= ~STATUS_HCMD_ACTIVE;
1792                 wake_up_interruptible(&priv->wait_command_queue);
1793
1794                 queue_work(priv->workqueue, &priv->adapter_restart);
1795                 handled |= IPW_INTA_BIT_FATAL_ERROR;
1796         }
1797
1798         if (inta & IPW_INTA_BIT_PARITY_ERROR) {
1799                 IPW_ERROR("Parity error\n");
1800                 handled |= IPW_INTA_BIT_PARITY_ERROR;
1801         }
1802
1803         if (handled != inta) {
1804                 IPW_ERROR("Unhandled INTA bits 0x%08x\n", inta & ~handled);
1805         }
1806
1807         /* enable all interrupts */
1808         ipw_enable_interrupts(priv);
1809
1810         spin_unlock_irqrestore(&priv->lock, flags);
1811 }
1812
1813 #define IPW_CMD(x) case IPW_CMD_ ## x : return #x
1814 static char *get_cmd_string(u8 cmd)
1815 {
1816         switch (cmd) {
1817                 IPW_CMD(HOST_COMPLETE);
1818                 IPW_CMD(POWER_DOWN);
1819                 IPW_CMD(SYSTEM_CONFIG);
1820                 IPW_CMD(MULTICAST_ADDRESS);
1821                 IPW_CMD(SSID);
1822                 IPW_CMD(ADAPTER_ADDRESS);
1823                 IPW_CMD(PORT_TYPE);
1824                 IPW_CMD(RTS_THRESHOLD);
1825                 IPW_CMD(FRAG_THRESHOLD);
1826                 IPW_CMD(POWER_MODE);
1827                 IPW_CMD(WEP_KEY);
1828                 IPW_CMD(TGI_TX_KEY);
1829                 IPW_CMD(SCAN_REQUEST);
1830                 IPW_CMD(SCAN_REQUEST_EXT);
1831                 IPW_CMD(ASSOCIATE);
1832                 IPW_CMD(SUPPORTED_RATES);
1833                 IPW_CMD(SCAN_ABORT);
1834                 IPW_CMD(TX_FLUSH);
1835                 IPW_CMD(QOS_PARAMETERS);
1836                 IPW_CMD(DINO_CONFIG);
1837                 IPW_CMD(RSN_CAPABILITIES);
1838                 IPW_CMD(RX_KEY);
1839                 IPW_CMD(CARD_DISABLE);
1840                 IPW_CMD(SEED_NUMBER);
1841                 IPW_CMD(TX_POWER);
1842                 IPW_CMD(COUNTRY_INFO);
1843                 IPW_CMD(AIRONET_INFO);
1844                 IPW_CMD(AP_TX_POWER);
1845                 IPW_CMD(CCKM_INFO);
1846                 IPW_CMD(CCX_VER_INFO);
1847                 IPW_CMD(SET_CALIBRATION);
1848                 IPW_CMD(SENSITIVITY_CALIB);
1849                 IPW_CMD(RETRY_LIMIT);
1850                 IPW_CMD(IPW_PRE_POWER_DOWN);
1851                 IPW_CMD(VAP_BEACON_TEMPLATE);
1852                 IPW_CMD(VAP_DTIM_PERIOD);
1853                 IPW_CMD(EXT_SUPPORTED_RATES);
1854                 IPW_CMD(VAP_LOCAL_TX_PWR_CONSTRAINT);
1855                 IPW_CMD(VAP_QUIET_INTERVALS);
1856                 IPW_CMD(VAP_CHANNEL_SWITCH);
1857                 IPW_CMD(VAP_MANDATORY_CHANNELS);
1858                 IPW_CMD(VAP_CELL_PWR_LIMIT);
1859                 IPW_CMD(VAP_CF_PARAM_SET);
1860                 IPW_CMD(VAP_SET_BEACONING_STATE);
1861                 IPW_CMD(MEASUREMENT);
1862                 IPW_CMD(POWER_CAPABILITY);
1863                 IPW_CMD(SUPPORTED_CHANNELS);
1864                 IPW_CMD(TPC_REPORT);
1865                 IPW_CMD(WME_INFO);
1866                 IPW_CMD(PRODUCTION_COMMAND);
1867         default:
1868                 return "UNKNOWN";
1869         }
1870 }
1871
1872 #define HOST_COMPLETE_TIMEOUT HZ
1873 static int ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
1874 {
1875         int rc = 0;
1876         unsigned long flags;
1877
1878         spin_lock_irqsave(&priv->lock, flags);
1879         if (priv->status & STATUS_HCMD_ACTIVE) {
1880                 IPW_ERROR("Failed to send %s: Already sending a command.\n",
1881                           get_cmd_string(cmd->cmd));
1882                 spin_unlock_irqrestore(&priv->lock, flags);
1883                 return -EAGAIN;
1884         }
1885
1886         priv->status |= STATUS_HCMD_ACTIVE;
1887
1888         if (priv->cmdlog) {
1889                 priv->cmdlog[priv->cmdlog_pos].jiffies = jiffies;
1890                 priv->cmdlog[priv->cmdlog_pos].cmd.cmd = cmd->cmd;
1891                 priv->cmdlog[priv->cmdlog_pos].cmd.len = cmd->len;
1892                 memcpy(priv->cmdlog[priv->cmdlog_pos].cmd.param, cmd->param,
1893                        cmd->len);
1894                 priv->cmdlog[priv->cmdlog_pos].retcode = -1;
1895         }
1896
1897         IPW_DEBUG_HC("%s command (#%d) %d bytes: 0x%08X\n",
1898                      get_cmd_string(cmd->cmd), cmd->cmd, cmd->len,
1899                      priv->status);
1900         printk_buf(IPW_DL_HOST_COMMAND, (u8 *) cmd->param, cmd->len);
1901
1902         rc = ipw_queue_tx_hcmd(priv, cmd->cmd, &cmd->param, cmd->len, 0);
1903         if (rc) {
1904                 priv->status &= ~STATUS_HCMD_ACTIVE;
1905                 IPW_ERROR("Failed to send %s: Reason %d\n",
1906                           get_cmd_string(cmd->cmd), rc);
1907                 spin_unlock_irqrestore(&priv->lock, flags);
1908                 goto exit;
1909         }
1910         spin_unlock_irqrestore(&priv->lock, flags);
1911
1912         rc = wait_event_interruptible_timeout(priv->wait_command_queue,
1913                                               !(priv->
1914                                                 status & STATUS_HCMD_ACTIVE),
1915                                               HOST_COMPLETE_TIMEOUT);
1916         if (rc == 0) {
1917                 spin_lock_irqsave(&priv->lock, flags);
1918                 if (priv->status & STATUS_HCMD_ACTIVE) {
1919                         IPW_ERROR("Failed to send %s: Command timed out.\n",
1920                                   get_cmd_string(cmd->cmd));
1921                         priv->status &= ~STATUS_HCMD_ACTIVE;
1922                         spin_unlock_irqrestore(&priv->lock, flags);
1923                         rc = -EIO;
1924                         goto exit;
1925                 }
1926                 spin_unlock_irqrestore(&priv->lock, flags);
1927         } else
1928                 rc = 0;
1929
1930         if (priv->status & STATUS_RF_KILL_HW) {
1931                 IPW_ERROR("Failed to send %s: Aborted due to RF kill switch.\n",
1932                           get_cmd_string(cmd->cmd));
1933                 rc = -EIO;
1934                 goto exit;
1935         }
1936
1937       exit:
1938         if (priv->cmdlog) {
1939                 priv->cmdlog[priv->cmdlog_pos++].retcode = rc;
1940                 priv->cmdlog_pos %= priv->cmdlog_len;
1941         }
1942         return rc;
1943 }
1944
1945 static int ipw_send_host_complete(struct ipw_priv *priv)
1946 {
1947         struct host_cmd cmd = {
1948                 .cmd = IPW_CMD_HOST_COMPLETE,
1949                 .len = 0
1950         };
1951
1952         if (!priv) {
1953                 IPW_ERROR("Invalid args\n");
1954                 return -1;
1955         }
1956
1957         return ipw_send_cmd(priv, &cmd);
1958 }
1959
1960 static int ipw_send_system_config(struct ipw_priv *priv,
1961                                   struct ipw_sys_config *config)
1962 {
1963         struct host_cmd cmd = {
1964                 .cmd = IPW_CMD_SYSTEM_CONFIG,
1965                 .len = sizeof(*config)
1966         };
1967
1968         if (!priv || !config) {
1969                 IPW_ERROR("Invalid args\n");
1970                 return -1;
1971         }
1972
1973         memcpy(cmd.param, config, sizeof(*config));
1974         return ipw_send_cmd(priv, &cmd);
1975 }
1976
1977 static int ipw_send_ssid(struct ipw_priv *priv, u8 * ssid, int len)
1978 {
1979         struct host_cmd cmd = {
1980                 .cmd = IPW_CMD_SSID,
1981                 .len = min(len, IW_ESSID_MAX_SIZE)
1982         };
1983
1984         if (!priv || !ssid) {
1985                 IPW_ERROR("Invalid args\n");
1986                 return -1;
1987         }
1988
1989         memcpy(cmd.param, ssid, cmd.len);
1990         return ipw_send_cmd(priv, &cmd);
1991 }
1992
1993 static int ipw_send_adapter_address(struct ipw_priv *priv, u8 * mac)
1994 {
1995         struct host_cmd cmd = {
1996                 .cmd = IPW_CMD_ADAPTER_ADDRESS,
1997                 .len = ETH_ALEN
1998         };
1999
2000         if (!priv || !mac) {
2001                 IPW_ERROR("Invalid args\n");
2002                 return -1;
2003         }
2004
2005         IPW_DEBUG_INFO("%s: Setting MAC to " MAC_FMT "\n",
2006                        priv->net_dev->name, MAC_ARG(mac));
2007
2008         memcpy(cmd.param, mac, ETH_ALEN);
2009         return ipw_send_cmd(priv, &cmd);
2010 }
2011
2012 /*
2013  * NOTE: This must be executed from our workqueue as it results in udelay
2014  * being called which may corrupt the keyboard if executed on default
2015  * workqueue
2016  */
2017 static void ipw_adapter_restart(void *adapter)
2018 {
2019         struct ipw_priv *priv = adapter;
2020
2021         if (priv->status & STATUS_RF_KILL_MASK)
2022                 return;
2023
2024         ipw_down(priv);
2025
2026         if (priv->assoc_network &&
2027             (priv->assoc_network->capability & WLAN_CAPABILITY_IBSS))
2028                 ipw_remove_current_network(priv);
2029
2030         if (ipw_up(priv)) {
2031                 IPW_ERROR("Failed to up device\n");
2032                 return;
2033         }
2034 }
2035
2036 static void ipw_bg_adapter_restart(void *data)
2037 {
2038         struct ipw_priv *priv = data;
2039         down(&priv->sem);
2040         ipw_adapter_restart(data);
2041         up(&priv->sem);
2042 }
2043
2044 #define IPW_SCAN_CHECK_WATCHDOG (5 * HZ)
2045
2046 static void ipw_scan_check(void *data)
2047 {
2048         struct ipw_priv *priv = data;
2049         if (priv->status & (STATUS_SCANNING | STATUS_SCAN_ABORTING)) {
2050                 IPW_DEBUG_SCAN("Scan completion watchdog resetting "
2051                                "adapter (%dms).\n",
2052                                IPW_SCAN_CHECK_WATCHDOG / 100);
2053                 queue_work(priv->workqueue, &priv->adapter_restart);
2054         }
2055 }
2056
2057 static void ipw_bg_scan_check(void *data)
2058 {
2059         struct ipw_priv *priv = data;
2060         down(&priv->sem);
2061         ipw_scan_check(data);
2062         up(&priv->sem);
2063 }
2064
2065 static int ipw_send_scan_request_ext(struct ipw_priv *priv,
2066                                      struct ipw_scan_request_ext *request)
2067 {
2068         struct host_cmd cmd = {
2069                 .cmd = IPW_CMD_SCAN_REQUEST_EXT,
2070                 .len = sizeof(*request)
2071         };
2072
2073         memcpy(cmd.param, request, sizeof(*request));
2074         return ipw_send_cmd(priv, &cmd);
2075 }
2076
2077 static int ipw_send_scan_abort(struct ipw_priv *priv)
2078 {
2079         struct host_cmd cmd = {
2080                 .cmd = IPW_CMD_SCAN_ABORT,
2081                 .len = 0
2082         };
2083
2084         if (!priv) {
2085                 IPW_ERROR("Invalid args\n");
2086                 return -1;
2087         }
2088
2089         return ipw_send_cmd(priv, &cmd);
2090 }
2091
2092 static int ipw_set_sensitivity(struct ipw_priv *priv, u16 sens)
2093 {
2094         struct host_cmd cmd = {
2095                 .cmd = IPW_CMD_SENSITIVITY_CALIB,
2096                 .len = sizeof(struct ipw_sensitivity_calib)
2097         };
2098         struct ipw_sensitivity_calib *calib = (struct ipw_sensitivity_calib *)
2099             &cmd.param;
2100         calib->beacon_rssi_raw = sens;
2101         return ipw_send_cmd(priv, &cmd);
2102 }
2103
2104 static int ipw_send_associate(struct ipw_priv *priv,
2105                               struct ipw_associate *associate)
2106 {
2107         struct host_cmd cmd = {
2108                 .cmd = IPW_CMD_ASSOCIATE,
2109                 .len = sizeof(*associate)
2110         };
2111
2112         struct ipw_associate tmp_associate;
2113         memcpy(&tmp_associate, associate, sizeof(*associate));
2114         tmp_associate.policy_support =
2115             cpu_to_le16(tmp_associate.policy_support);
2116         tmp_associate.assoc_tsf_msw = cpu_to_le32(tmp_associate.assoc_tsf_msw);
2117         tmp_associate.assoc_tsf_lsw = cpu_to_le32(tmp_associate.assoc_tsf_lsw);
2118         tmp_associate.capability = cpu_to_le16(tmp_associate.capability);
2119         tmp_associate.listen_interval =
2120             cpu_to_le16(tmp_associate.listen_interval);
2121         tmp_associate.beacon_interval =
2122             cpu_to_le16(tmp_associate.beacon_interval);
2123         tmp_associate.atim_window = cpu_to_le16(tmp_associate.atim_window);
2124
2125         if (!priv || !associate) {
2126                 IPW_ERROR("Invalid args\n");
2127                 return -1;
2128         }
2129
2130         memcpy(cmd.param, &tmp_associate, sizeof(*associate));
2131         return ipw_send_cmd(priv, &cmd);
2132 }
2133
2134 static int ipw_send_supported_rates(struct ipw_priv *priv,
2135                                     struct ipw_supported_rates *rates)
2136 {
2137         struct host_cmd cmd = {
2138                 .cmd = IPW_CMD_SUPPORTED_RATES,
2139                 .len = sizeof(*rates)
2140         };
2141
2142         if (!priv || !rates) {
2143                 IPW_ERROR("Invalid args\n");
2144                 return -1;
2145         }
2146
2147         memcpy(cmd.param, rates, sizeof(*rates));
2148         return ipw_send_cmd(priv, &cmd);
2149 }
2150
2151 static int ipw_set_random_seed(struct ipw_priv *priv)
2152 {
2153         struct host_cmd cmd = {
2154                 .cmd = IPW_CMD_SEED_NUMBER,
2155                 .len = sizeof(u32)
2156         };
2157
2158         if (!priv) {
2159                 IPW_ERROR("Invalid args\n");
2160                 return -1;
2161         }
2162
2163         get_random_bytes(&cmd.param, sizeof(u32));
2164
2165         return ipw_send_cmd(priv, &cmd);
2166 }
2167
2168 static int ipw_send_card_disable(struct ipw_priv *priv, u32 phy_off)
2169 {
2170         struct host_cmd cmd = {
2171                 .cmd = IPW_CMD_CARD_DISABLE,
2172                 .len = sizeof(u32)
2173         };
2174
2175         if (!priv) {
2176                 IPW_ERROR("Invalid args\n");
2177                 return -1;
2178         }
2179
2180         *((u32 *) & cmd.param) = phy_off;
2181
2182         return ipw_send_cmd(priv, &cmd);
2183 }
2184
2185 static int ipw_send_tx_power(struct ipw_priv *priv, struct ipw_tx_power *power)
2186 {
2187         struct host_cmd cmd = {
2188                 .cmd = IPW_CMD_TX_POWER,
2189                 .len = sizeof(*power)
2190         };
2191
2192         if (!priv || !power) {
2193                 IPW_ERROR("Invalid args\n");
2194                 return -1;
2195         }
2196
2197         memcpy(cmd.param, power, sizeof(*power));
2198         return ipw_send_cmd(priv, &cmd);
2199 }
2200
2201 static int ipw_set_tx_power(struct ipw_priv *priv)
2202 {
2203         const struct ieee80211_geo *geo = ipw_get_geo(priv->ieee);
2204         struct ipw_tx_power tx_power;
2205         s8 max_power;
2206         int i;
2207
2208         memset(&tx_power, 0, sizeof(tx_power));
2209
2210         /* configure device for 'G' band */
2211         tx_power.ieee_mode = IPW_G_MODE;
2212         tx_power.num_channels = geo->bg_channels;
2213         for (i = 0; i < geo->bg_channels; i++) {
2214                 max_power = geo->bg[i].max_power;
2215                 tx_power.channels_tx_power[i].channel_number =
2216                     geo->bg[i].channel;
2217                 tx_power.channels_tx_power[i].tx_power = max_power ?
2218                     min(max_power, priv->tx_power) : priv->tx_power;
2219         }
2220         if (ipw_send_tx_power(priv, &tx_power))
2221                 return -EIO;
2222
2223         /* configure device to also handle 'B' band */
2224         tx_power.ieee_mode = IPW_B_MODE;
2225         if (ipw_send_tx_power(priv, &tx_power))
2226                 return -EIO;
2227
2228         /* configure device to also handle 'A' band */
2229         if (priv->ieee->abg_true) {
2230                 tx_power.ieee_mode = IPW_A_MODE;
2231                 tx_power.num_channels = geo->a_channels;
2232                 for (i = 0; i < tx_power.num_channels; i++) {
2233                         max_power = geo->a[i].max_power;
2234                         tx_power.channels_tx_power[i].channel_number =
2235                             geo->a[i].channel;
2236                         tx_power.channels_tx_power[i].tx_power = max_power ?
2237                             min(max_power, priv->tx_power) : priv->tx_power;
2238                 }
2239                 if (ipw_send_tx_power(priv, &tx_power))
2240                         return -EIO;
2241         }
2242         return 0;
2243 }
2244
2245 static int ipw_send_rts_threshold(struct ipw_priv *priv, u16 rts)
2246 {
2247         struct ipw_rts_threshold rts_threshold = {
2248                 .rts_threshold = rts,
2249         };
2250         struct host_cmd cmd = {
2251                 .cmd = IPW_CMD_RTS_THRESHOLD,
2252                 .len = sizeof(rts_threshold)
2253         };
2254
2255         if (!priv) {
2256                 IPW_ERROR("Invalid args\n");
2257                 return -1;
2258         }
2259
2260         memcpy(cmd.param, &rts_threshold, sizeof(rts_threshold));
2261         return ipw_send_cmd(priv, &cmd);
2262 }
2263
2264 static int ipw_send_frag_threshold(struct ipw_priv *priv, u16 frag)
2265 {
2266         struct ipw_frag_threshold frag_threshold = {
2267                 .frag_threshold = frag,
2268         };
2269         struct host_cmd cmd = {
2270                 .cmd = IPW_CMD_FRAG_THRESHOLD,
2271                 .len = sizeof(frag_threshold)
2272         };
2273
2274         if (!priv) {
2275                 IPW_ERROR("Invalid args\n");
2276                 return -1;
2277         }
2278
2279         memcpy(cmd.param, &frag_threshold, sizeof(frag_threshold));
2280         return ipw_send_cmd(priv, &cmd);
2281 }
2282
2283 static int ipw_send_power_mode(struct ipw_priv *priv, u32 mode)
2284 {
2285         struct host_cmd cmd = {
2286                 .cmd = IPW_CMD_POWER_MODE,
2287                 .len = sizeof(u32)
2288         };
2289         u32 *param = (u32 *) (&cmd.param);
2290
2291         if (!priv) {
2292                 IPW_ERROR("Invalid args\n");
2293                 return -1;
2294         }
2295
2296         /* If on battery, set to 3, if AC set to CAM, else user
2297          * level */
2298         switch (mode) {
2299         case IPW_POWER_BATTERY:
2300                 *param = IPW_POWER_INDEX_3;
2301                 break;
2302         case IPW_POWER_AC:
2303                 *param = IPW_POWER_MODE_CAM;
2304                 break;
2305         default:
2306                 *param = mode;
2307                 break;
2308         }
2309
2310         return ipw_send_cmd(priv, &cmd);
2311 }
2312
2313 static int ipw_send_retry_limit(struct ipw_priv *priv, u8 slimit, u8 llimit)
2314 {
2315         struct ipw_retry_limit retry_limit = {
2316                 .short_retry_limit = slimit,
2317                 .long_retry_limit = llimit
2318         };
2319         struct host_cmd cmd = {
2320                 .cmd = IPW_CMD_RETRY_LIMIT,
2321                 .len = sizeof(retry_limit)
2322         };
2323
2324         if (!priv) {
2325                 IPW_ERROR("Invalid args\n");
2326                 return -1;
2327         }
2328
2329         memcpy(cmd.param, &retry_limit, sizeof(retry_limit));
2330         return ipw_send_cmd(priv, &cmd);
2331 }
2332
2333 /*
2334  * The IPW device contains a Microwire compatible EEPROM that stores
2335  * various data like the MAC address.  Usually the firmware has exclusive
2336  * access to the eeprom, but during device initialization (before the
2337  * device driver has sent the HostComplete command to the firmware) the
2338  * device driver has read access to the EEPROM by way of indirect addressing
2339  * through a couple of memory mapped registers.
2340  *
2341  * The following is a simplified implementation for pulling data out of the
2342  * the eeprom, along with some helper functions to find information in
2343  * the per device private data's copy of the eeprom.
2344  *
2345  * NOTE: To better understand how these functions work (i.e what is a chip
2346  *       select and why do have to keep driving the eeprom clock?), read
2347  *       just about any data sheet for a Microwire compatible EEPROM.
2348  */
2349
2350 /* write a 32 bit value into the indirect accessor register */
2351 static inline void eeprom_write_reg(struct ipw_priv *p, u32 data)
2352 {
2353         ipw_write_reg32(p, FW_MEM_REG_EEPROM_ACCESS, data);
2354
2355         /* the eeprom requires some time to complete the operation */
2356         udelay(p->eeprom_delay);
2357
2358         return;
2359 }
2360
2361 /* perform a chip select operation */
2362 static void eeprom_cs(struct ipw_priv *priv)
2363 {
2364         eeprom_write_reg(priv, 0);
2365         eeprom_write_reg(priv, EEPROM_BIT_CS);
2366         eeprom_write_reg(priv, EEPROM_BIT_CS | EEPROM_BIT_SK);
2367         eeprom_write_reg(priv, EEPROM_BIT_CS);
2368 }
2369
2370 /* perform a chip select operation */
2371 static void eeprom_disable_cs(struct ipw_priv *priv)
2372 {
2373         eeprom_write_reg(priv, EEPROM_BIT_CS);
2374         eeprom_write_reg(priv, 0);
2375         eeprom_write_reg(priv, EEPROM_BIT_SK);
2376 }
2377
2378 /* push a single bit down to the eeprom */
2379 static inline void eeprom_write_bit(struct ipw_priv *p, u8 bit)
2380 {
2381         int d = (bit ? EEPROM_BIT_DI : 0);
2382         eeprom_write_reg(p, EEPROM_BIT_CS | d);
2383         eeprom_write_reg(p, EEPROM_BIT_CS | d | EEPROM_BIT_SK);
2384 }
2385
2386 /* push an opcode followed by an address down to the eeprom */
2387 static void eeprom_op(struct ipw_priv *priv, u8 op, u8 addr)
2388 {
2389         int i;
2390
2391         eeprom_cs(priv);
2392         eeprom_write_bit(priv, 1);
2393         eeprom_write_bit(priv, op & 2);
2394         eeprom_write_bit(priv, op & 1);
2395         for (i = 7; i >= 0; i--) {
2396                 eeprom_write_bit(priv, addr & (1 << i));
2397         }
2398 }
2399
2400 /* pull 16 bits off the eeprom, one bit at a time */
2401 static u16 eeprom_read_u16(struct ipw_priv *priv, u8 addr)
2402 {
2403         int i;
2404         u16 r = 0;
2405
2406         /* Send READ Opcode */
2407         eeprom_op(priv, EEPROM_CMD_READ, addr);
2408
2409         /* Send dummy bit */
2410         eeprom_write_reg(priv, EEPROM_BIT_CS);
2411
2412         /* Read the byte off the eeprom one bit at a time */
2413         for (i = 0; i < 16; i++) {
2414                 u32 data = 0;
2415                 eeprom_write_reg(priv, EEPROM_BIT_CS | EEPROM_BIT_SK);
2416                 eeprom_write_reg(priv, EEPROM_BIT_CS);
2417                 data = ipw_read_reg32(priv, FW_MEM_REG_EEPROM_ACCESS);
2418                 r = (r << 1) | ((data & EEPROM_BIT_DO) ? 1 : 0);
2419         }
2420
2421         /* Send another dummy bit */
2422         eeprom_write_reg(priv, 0);
2423         eeprom_disable_cs(priv);
2424
2425         return r;
2426 }
2427
2428 /* helper function for pulling the mac address out of the private */
2429 /* data's copy of the eeprom data                                 */
2430 static void eeprom_parse_mac(struct ipw_priv *priv, u8 * mac)
2431 {
2432         memcpy(mac, &priv->eeprom[EEPROM_MAC_ADDRESS], 6);
2433 }
2434
2435 /*
2436  * Either the device driver (i.e. the host) or the firmware can
2437  * load eeprom data into the designated region in SRAM.  If neither
2438  * happens then the FW will shutdown with a fatal error.
2439  *
2440  * In order to signal the FW to load the EEPROM, the EEPROM_LOAD_DISABLE
2441  * bit needs region of shared SRAM needs to be non-zero.
2442  */
2443 static void ipw_eeprom_init_sram(struct ipw_priv *priv)
2444 {
2445         int i;
2446         u16 *eeprom = (u16 *) priv->eeprom;
2447
2448         IPW_DEBUG_TRACE(">>\n");
2449
2450         /* read entire contents of eeprom into private buffer */
2451         for (i = 0; i < 128; i++)
2452                 eeprom[i] = le16_to_cpu(eeprom_read_u16(priv, (u8) i));
2453
2454         /*
2455            If the data looks correct, then copy it to our private
2456            copy.  Otherwise let the firmware know to perform the operation
2457            on it's own
2458          */
2459         if ((priv->eeprom + EEPROM_VERSION) != 0) {
2460                 IPW_DEBUG_INFO("Writing EEPROM data into SRAM\n");
2461
2462                 /* write the eeprom data to sram */
2463                 for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
2464                         ipw_write8(priv, IPW_EEPROM_DATA + i, priv->eeprom[i]);
2465
2466                 /* Do not load eeprom data on fatal error or suspend */
2467                 ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
2468         } else {
2469                 IPW_DEBUG_INFO("Enabling FW initializationg of SRAM\n");
2470
2471                 /* Load eeprom data on fatal error or suspend */
2472                 ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 1);
2473         }
2474
2475         IPW_DEBUG_TRACE("<<\n");
2476 }
2477
2478 static void ipw_zero_memory(struct ipw_priv *priv, u32 start, u32 count)
2479 {
2480         count >>= 2;
2481         if (!count)
2482                 return;
2483         _ipw_write32(priv, IPW_AUTOINC_ADDR, start);
2484         while (count--)
2485                 _ipw_write32(priv, IPW_AUTOINC_DATA, 0);
2486 }
2487
2488 static inline void ipw_fw_dma_reset_command_blocks(struct ipw_priv *priv)
2489 {
2490         ipw_zero_memory(priv, IPW_SHARED_SRAM_DMA_CONTROL,
2491                         CB_NUMBER_OF_ELEMENTS_SMALL *
2492                         sizeof(struct command_block));
2493 }
2494
2495 static int ipw_fw_dma_enable(struct ipw_priv *priv)
2496 {                               /* start dma engine but no transfers yet */
2497
2498         IPW_DEBUG_FW(">> : \n");
2499
2500         /* Start the dma */
2501         ipw_fw_dma_reset_command_blocks(priv);
2502
2503         /* Write CB base address */
2504         ipw_write_reg32(priv, IPW_DMA_I_CB_BASE, IPW_SHARED_SRAM_DMA_CONTROL);
2505
2506         IPW_DEBUG_FW("<< : \n");
2507         return 0;
2508 }
2509
2510 static void ipw_fw_dma_abort(struct ipw_priv *priv)
2511 {
2512         u32 control = 0;
2513
2514         IPW_DEBUG_FW(">> :\n");
2515
2516         //set the Stop and Abort bit
2517         control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_STOP_AND_ABORT;
2518         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
2519         priv->sram_desc.last_cb_index = 0;
2520
2521         IPW_DEBUG_FW("<< \n");
2522 }
2523
2524 static int ipw_fw_dma_write_command_block(struct ipw_priv *priv, int index,
2525                                           struct command_block *cb)
2526 {
2527         u32 address =
2528             IPW_SHARED_SRAM_DMA_CONTROL +
2529             (sizeof(struct command_block) * index);
2530         IPW_DEBUG_FW(">> :\n");
2531
2532         ipw_write_indirect(priv, address, (u8 *) cb,
2533                            (int)sizeof(struct command_block));
2534
2535         IPW_DEBUG_FW("<< :\n");
2536         return 0;
2537
2538 }
2539
2540 static int ipw_fw_dma_kick(struct ipw_priv *priv)
2541 {
2542         u32 control = 0;
2543         u32 index = 0;
2544
2545         IPW_DEBUG_FW(">> :\n");
2546
2547         for (index = 0; index < priv->sram_desc.last_cb_index; index++)
2548                 ipw_fw_dma_write_command_block(priv, index,
2549                                                &priv->sram_desc.cb_list[index]);
2550
2551         /* Enable the DMA in the CSR register */
2552         ipw_clear_bit(priv, IPW_RESET_REG,
2553                       IPW_RESET_REG_MASTER_DISABLED |
2554                       IPW_RESET_REG_STOP_MASTER);
2555
2556         /* Set the Start bit. */
2557         control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_START;
2558         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
2559
2560         IPW_DEBUG_FW("<< :\n");
2561         return 0;
2562 }
2563
2564 static void ipw_fw_dma_dump_command_block(struct ipw_priv *priv)
2565 {
2566         u32 address;
2567         u32 register_value = 0;
2568         u32 cb_fields_address = 0;
2569
2570         IPW_DEBUG_FW(">> :\n");
2571         address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
2572         IPW_DEBUG_FW_INFO("Current CB is 0x%x \n", address);
2573
2574         /* Read the DMA Controlor register */
2575         register_value = ipw_read_reg32(priv, IPW_DMA_I_DMA_CONTROL);
2576         IPW_DEBUG_FW_INFO("IPW_DMA_I_DMA_CONTROL is 0x%x \n", register_value);
2577
2578         /* Print the CB values */
2579         cb_fields_address = address;
2580         register_value = ipw_read_reg32(priv, cb_fields_address);
2581         IPW_DEBUG_FW_INFO("Current CB ControlField is 0x%x \n", register_value);
2582
2583         cb_fields_address += sizeof(u32);
2584         register_value = ipw_read_reg32(priv, cb_fields_address);
2585         IPW_DEBUG_FW_INFO("Current CB Source Field is 0x%x \n", register_value);
2586
2587         cb_fields_address += sizeof(u32);
2588         register_value = ipw_read_reg32(priv, cb_fields_address);
2589         IPW_DEBUG_FW_INFO("Current CB Destination Field is 0x%x \n",
2590                           register_value);
2591
2592         cb_fields_address += sizeof(u32);
2593         register_value = ipw_read_reg32(priv, cb_fields_address);
2594         IPW_DEBUG_FW_INFO("Current CB Status Field is 0x%x \n", register_value);
2595
2596         IPW_DEBUG_FW(">> :\n");
2597 }
2598
2599 static int ipw_fw_dma_command_block_index(struct ipw_priv *priv)
2600 {
2601         u32 current_cb_address = 0;
2602         u32 current_cb_index = 0;
2603
2604         IPW_DEBUG_FW("<< :\n");
2605         current_cb_address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
2606
2607         current_cb_index = (current_cb_address - IPW_SHARED_SRAM_DMA_CONTROL) /
2608             sizeof(struct command_block);
2609
2610         IPW_DEBUG_FW_INFO("Current CB index 0x%x address = 0x%X \n",
2611                           current_cb_index, current_cb_address);
2612
2613         IPW_DEBUG_FW(">> :\n");
2614         return current_cb_index;
2615
2616 }
2617
2618 static int ipw_fw_dma_add_command_block(struct ipw_priv *priv,
2619                                         u32 src_address,
2620                                         u32 dest_address,
2621                                         u32 length,
2622                                         int interrupt_enabled, int is_last)
2623 {
2624
2625         u32 control = CB_VALID | CB_SRC_LE | CB_DEST_LE | CB_SRC_AUTOINC |
2626             CB_SRC_IO_GATED | CB_DEST_AUTOINC | CB_SRC_SIZE_LONG |
2627             CB_DEST_SIZE_LONG;
2628         struct command_block *cb;
2629         u32 last_cb_element = 0;
2630
2631         IPW_DEBUG_FW_INFO("src_address=0x%x dest_address=0x%x length=0x%x\n",
2632                           src_address, dest_address, length);
2633
2634         if (priv->sram_desc.last_cb_index >= CB_NUMBER_OF_ELEMENTS_SMALL)
2635                 return -1;
2636
2637         last_cb_element = priv->sram_desc.last_cb_index;
2638         cb = &priv->sram_desc.cb_list[last_cb_element];
2639         priv->sram_desc.last_cb_index++;
2640
2641         /* Calculate the new CB control word */
2642         if (interrupt_enabled)
2643                 control |= CB_INT_ENABLED;
2644
2645         if (is_last)
2646                 control |= CB_LAST_VALID;
2647
2648         control |= length;
2649
2650         /* Calculate the CB Element's checksum value */
2651         cb->status = control ^ src_address ^ dest_address;
2652
2653         /* Copy the Source and Destination addresses */
2654         cb->dest_addr = dest_address;
2655         cb->source_addr = src_address;
2656
2657         /* Copy the Control Word last */
2658         cb->control = control;
2659
2660         return 0;
2661 }
2662
2663 static int ipw_fw_dma_add_buffer(struct ipw_priv *priv,
2664                                  u32 src_phys, u32 dest_address, u32 length)
2665 {
2666         u32 bytes_left = length;
2667         u32 src_offset = 0;
2668         u32 dest_offset = 0;
2669         int status = 0;
2670         IPW_DEBUG_FW(">> \n");
2671         IPW_DEBUG_FW_INFO("src_phys=0x%x dest_address=0x%x length=0x%x\n",
2672                           src_phys, dest_address, length);
2673         while (bytes_left > CB_MAX_LENGTH) {
2674                 status = ipw_fw_dma_add_command_block(priv,
2675                                                       src_phys + src_offset,
2676                                                       dest_address +
2677                                                       dest_offset,
2678                                                       CB_MAX_LENGTH, 0, 0);
2679                 if (status) {
2680                         IPW_DEBUG_FW_INFO(": Failed\n");
2681                         return -1;
2682                 } else
2683                         IPW_DEBUG_FW_INFO(": Added new cb\n");
2684
2685                 src_offset += CB_MAX_LENGTH;
2686                 dest_offset += CB_MAX_LENGTH;
2687                 bytes_left -= CB_MAX_LENGTH;
2688         }
2689
2690         /* add the buffer tail */
2691         if (bytes_left > 0) {
2692                 status =
2693                     ipw_fw_dma_add_command_block(priv, src_phys + src_offset,
2694                                                  dest_address + dest_offset,
2695                                                  bytes_left, 0, 0);
2696                 if (status) {
2697                         IPW_DEBUG_FW_INFO(": Failed on the buffer tail\n");
2698                         return -1;
2699                 } else
2700                         IPW_DEBUG_FW_INFO
2701                             (": Adding new cb - the buffer tail\n");
2702         }
2703
2704         IPW_DEBUG_FW("<< \n");
2705         return 0;
2706 }
2707
2708 static int ipw_fw_dma_wait(struct ipw_priv *priv)
2709 {
2710         u32 current_index = 0;
2711         u32 watchdog = 0;
2712
2713         IPW_DEBUG_FW(">> : \n");
2714
2715         current_index = ipw_fw_dma_command_block_index(priv);
2716         IPW_DEBUG_FW_INFO("sram_desc.last_cb_index:0x%8X\n",
2717                           (int)priv->sram_desc.last_cb_index);
2718
2719         while (current_index < priv->sram_desc.last_cb_index) {
2720                 udelay(50);
2721                 current_index = ipw_fw_dma_command_block_index(priv);
2722
2723                 watchdog++;
2724
2725                 if (watchdog > 400) {
2726                         IPW_DEBUG_FW_INFO("Timeout\n");
2727                         ipw_fw_dma_dump_command_block(priv);
2728                         ipw_fw_dma_abort(priv);
2729                         return -1;
2730                 }
2731         }
2732
2733         ipw_fw_dma_abort(priv);
2734
2735         /*Disable the DMA in the CSR register */
2736         ipw_set_bit(priv, IPW_RESET_REG,
2737                     IPW_RESET_REG_MASTER_DISABLED | IPW_RESET_REG_STOP_MASTER);
2738
2739         IPW_DEBUG_FW("<< dmaWaitSync \n");
2740         return 0;
2741 }
2742
2743 static void ipw_remove_current_network(struct ipw_priv *priv)
2744 {
2745         struct list_head *element, *safe;
2746         struct ieee80211_network *network = NULL;
2747         unsigned long flags;
2748
2749         spin_lock_irqsave(&priv->ieee->lock, flags);
2750         list_for_each_safe(element, safe, &priv->ieee->network_list) {
2751                 network = list_entry(element, struct ieee80211_network, list);
2752                 if (!memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
2753                         list_del(element);
2754                         list_add_tail(&network->list,
2755                                       &priv->ieee->network_free_list);
2756                 }
2757         }
2758         spin_unlock_irqrestore(&priv->ieee->lock, flags);
2759 }
2760
2761 /**
2762  * Check that card is still alive.
2763  * Reads debug register from domain0.
2764  * If card is present, pre-defined value should
2765  * be found there.
2766  *
2767  * @param priv
2768  * @return 1 if card is present, 0 otherwise
2769  */
2770 static inline int ipw_alive(struct ipw_priv *priv)
2771 {
2772         return ipw_read32(priv, 0x90) == 0xd55555d5;
2773 }
2774
2775 static int ipw_poll_bit(struct ipw_priv *priv, u32 addr, u32 mask,
2776                                int timeout)
2777 {
2778         int i = 0;
2779
2780         do {
2781                 if ((ipw_read32(priv, addr) & mask) == mask)
2782                         return i;
2783                 mdelay(10);
2784                 i += 10;
2785         } while (i < timeout);
2786
2787         return -ETIME;
2788 }
2789
2790 /* These functions load the firmware and micro code for the operation of
2791  * the ipw hardware.  It assumes the buffer has all the bits for the
2792  * image and the caller is handling the memory allocation and clean up.
2793  */
2794
2795 static int ipw_stop_master(struct ipw_priv *priv)
2796 {
2797         int rc;
2798
2799         IPW_DEBUG_TRACE(">> \n");
2800         /* stop master. typical delay - 0 */
2801         ipw_set_bit(priv, IPW_RESET_REG, IPW_RESET_REG_STOP_MASTER);
2802
2803         rc = ipw_poll_bit(priv, IPW_RESET_REG,
2804                           IPW_RESET_REG_MASTER_DISABLED, 100);
2805         if (rc < 0) {
2806                 IPW_ERROR("stop master failed in 10ms\n");
2807                 return -1;
2808         }
2809
2810         IPW_DEBUG_INFO("stop master %dms\n", rc);
2811
2812         return rc;
2813 }
2814
2815 static void ipw_arc_release(struct ipw_priv *priv)
2816 {
2817         IPW_DEBUG_TRACE(">> \n");
2818         mdelay(5);
2819
2820         ipw_clear_bit(priv, IPW_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
2821
2822         /* no one knows timing, for safety add some delay */
2823         mdelay(5);
2824 }
2825
2826 struct fw_header {
2827         u32 version;
2828         u32 mode;
2829 };
2830
2831 struct fw_chunk {
2832         u32 address;
2833         u32 length;
2834 };
2835
2836 #define IPW_FW_MAJOR_VERSION 2
2837 #define IPW_FW_MINOR_VERSION 4
2838
2839 #define IPW_FW_MINOR(x) ((x & 0xff) >> 8)
2840 #define IPW_FW_MAJOR(x) (x & 0xff)
2841
2842 #define IPW_FW_VERSION ((IPW_FW_MINOR_VERSION << 8) | IPW_FW_MAJOR_VERSION)
2843
2844 #define IPW_FW_PREFIX "ipw-" __stringify(IPW_FW_MAJOR_VERSION) \
2845 "." __stringify(IPW_FW_MINOR_VERSION) "-"
2846
2847 #if IPW_FW_MAJOR_VERSION >= 2 && IPW_FW_MINOR_VERSION > 0
2848 #define IPW_FW_NAME(x) IPW_FW_PREFIX "" x ".fw"
2849 #else
2850 #define IPW_FW_NAME(x) "ipw2200_" x ".fw"
2851 #endif
2852
2853 static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
2854 {
2855         int rc = 0, i, addr;
2856         u8 cr = 0;
2857         u16 *image;
2858
2859         image = (u16 *) data;
2860
2861         IPW_DEBUG_TRACE(">> \n");
2862
2863         rc = ipw_stop_master(priv);
2864
2865         if (rc < 0)
2866                 return rc;
2867
2868 //      spin_lock_irqsave(&priv->lock, flags);
2869
2870         for (addr = IPW_SHARED_LOWER_BOUND;
2871              addr < IPW_REGISTER_DOMAIN1_END; addr += 4) {
2872                 ipw_write32(priv, addr, 0);
2873         }
2874
2875         /* no ucode (yet) */
2876         memset(&priv->dino_alive, 0, sizeof(priv->dino_alive));
2877         /* destroy DMA queues */
2878         /* reset sequence */
2879
2880         ipw_write_reg32(priv, IPW_MEM_HALT_AND_RESET, IPW_BIT_HALT_RESET_ON);
2881         ipw_arc_release(priv);
2882         ipw_write_reg32(priv, IPW_MEM_HALT_AND_RESET, IPW_BIT_HALT_RESET_OFF);
2883         mdelay(1);
2884
2885         /* reset PHY */
2886         ipw_write_reg32(priv, IPW_INTERNAL_CMD_EVENT, IPW_BASEBAND_POWER_DOWN);
2887         mdelay(1);
2888
2889         ipw_write_reg32(priv, IPW_INTERNAL_CMD_EVENT, 0);
2890         mdelay(1);
2891
2892         /* enable ucode store */
2893         ipw_write_reg8(priv, DINO_CONTROL_REG, 0x0);
2894         ipw_write_reg8(priv, DINO_CONTROL_REG, DINO_ENABLE_CS);
2895         mdelay(1);
2896
2897         /* write ucode */
2898         /**
2899          * @bug
2900          * Do NOT set indirect address register once and then
2901          * store data to indirect data register in the loop.
2902          * It seems very reasonable, but in this case DINO do not
2903          * accept ucode. It is essential to set address each time.
2904          */
2905         /* load new ipw uCode */
2906         for (i = 0; i < len / 2; i++)
2907                 ipw_write_reg16(priv, IPW_BASEBAND_CONTROL_STORE,
2908                                 cpu_to_le16(image[i]));
2909
2910         /* enable DINO */
2911         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0);
2912         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, DINO_ENABLE_SYSTEM);
2913
2914         /* this is where the igx / win driver deveates from the VAP driver. */
2915
2916         /* wait for alive response */
2917         for (i = 0; i < 100; i++) {
2918                 /* poll for incoming data */
2919                 cr = ipw_read_reg8(priv, IPW_BASEBAND_CONTROL_STATUS);
2920                 if (cr & DINO_RXFIFO_DATA)
2921                         break;
2922                 mdelay(1);
2923         }
2924
2925         if (cr & DINO_RXFIFO_DATA) {
2926                 /* alive_command_responce size is NOT multiple of 4 */
2927                 u32 response_buffer[(sizeof(priv->dino_alive) + 3) / 4];
2928
2929                 for (i = 0; i < ARRAY_SIZE(response_buffer); i++)
2930                         response_buffer[i] =
2931                             le32_to_cpu(ipw_read_reg32(priv,
2932                                                        IPW_BASEBAND_RX_FIFO_READ));
2933                 memcpy(&priv->dino_alive, response_buffer,
2934                        sizeof(priv->dino_alive));
2935                 if (priv->dino_alive.alive_command == 1
2936                     && priv->dino_alive.ucode_valid == 1) {
2937                         rc = 0;
2938                         IPW_DEBUG_INFO
2939                             ("Microcode OK, rev. %d (0x%x) dev. %d (0x%x) "
2940                              "of %02d/%02d/%02d %02d:%02d\n",
2941                              priv->dino_alive.software_revision,
2942                              priv->dino_alive.software_revision,
2943                              priv->dino_alive.device_identifier,
2944                              priv->dino_alive.device_identifier,
2945                              priv->dino_alive.time_stamp[0],
2946                              priv->dino_alive.time_stamp[1],
2947                              priv->dino_alive.time_stamp[2],
2948                              priv->dino_alive.time_stamp[3],
2949                              priv->dino_alive.time_stamp[4]);
2950                 } else {
2951                         IPW_DEBUG_INFO("Microcode is not alive\n");
2952                         rc = -EINVAL;
2953                 }
2954         } else {
2955                 IPW_DEBUG_INFO("No alive response from DINO\n");
2956                 rc = -ETIME;
2957         }
2958
2959         /* disable DINO, otherwise for some reason
2960            firmware have problem getting alive resp. */
2961         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0);
2962
2963 //      spin_unlock_irqrestore(&priv->lock, flags);
2964
2965         return rc;
2966 }
2967
2968 static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
2969 {
2970         int rc = -1;
2971         int offset = 0;
2972         struct fw_chunk *chunk;
2973         dma_addr_t shared_phys;
2974         u8 *shared_virt;
2975
2976         IPW_DEBUG_TRACE("<< : \n");
2977         shared_virt = pci_alloc_consistent(priv->pci_dev, len, &shared_phys);
2978
2979         if (!shared_virt)
2980                 return -ENOMEM;
2981
2982         memmove(shared_virt, data, len);
2983
2984         /* Start the Dma */
2985         rc = ipw_fw_dma_enable(priv);
2986
2987         if (priv->sram_desc.last_cb_index > 0) {
2988                 /* the DMA is already ready this would be a bug. */
2989                 BUG();
2990                 goto out;
2991         }
2992
2993         do {
2994                 chunk = (struct fw_chunk *)(data + offset);
2995                 offset += sizeof(struct fw_chunk);
2996                 /* build DMA packet and queue up for sending */
2997                 /* dma to chunk->address, the chunk->length bytes from data +
2998                  * offeset*/
2999                 /* Dma loading */
3000                 rc = ipw_fw_dma_add_buffer(priv, shared_phys + offset,
3001                                            le32_to_cpu(chunk->address),
3002                                            le32_to_cpu(chunk->length));
3003                 if (rc) {
3004                         IPW_DEBUG_INFO("dmaAddBuffer Failed\n");
3005                         goto out;
3006                 }
3007
3008                 offset += le32_to_cpu(chunk->length);
3009         } while (offset < len);
3010
3011         /* Run the DMA and wait for the answer */
3012         rc = ipw_fw_dma_kick(priv);
3013         if (rc) {
3014                 IPW_ERROR("dmaKick Failed\n");
3015                 goto out;
3016         }
3017
3018         rc = ipw_fw_dma_wait(priv);
3019         if (rc) {
3020                 IPW_ERROR("dmaWaitSync Failed\n");
3021                 goto out;
3022         }
3023       out:
3024         pci_free_consistent(priv->pci_dev, len, shared_virt, shared_phys);
3025         return rc;
3026 }
3027
3028 /* stop nic */
3029 static int ipw_stop_nic(struct ipw_priv *priv)
3030 {
3031         int rc = 0;
3032
3033         /* stop */
3034         ipw_write32(priv, IPW_RESET_REG, IPW_RESET_REG_STOP_MASTER);
3035
3036         rc = ipw_poll_bit(priv, IPW_RESET_REG,
3037                           IPW_RESET_REG_MASTER_DISABLED, 500);
3038         if (rc < 0) {
3039                 IPW_ERROR("wait for reg master disabled failed\n");
3040                 return rc;
3041         }
3042
3043         ipw_set_bit(priv, IPW_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
3044
3045         return rc;
3046 }
3047
3048 static void ipw_start_nic(struct ipw_priv *priv)
3049 {
3050         IPW_DEBUG_TRACE(">>\n");
3051
3052         /* prvHwStartNic  release ARC */
3053         ipw_clear_bit(priv, IPW_RESET_REG,
3054                       IPW_RESET_REG_MASTER_DISABLED |
3055                       IPW_RESET_REG_STOP_MASTER |
3056                       CBD_RESET_REG_PRINCETON_RESET);
3057
3058         /* enable power management */
3059         ipw_set_bit(priv, IPW_GP_CNTRL_RW,
3060                     IPW_GP_CNTRL_BIT_HOST_ALLOWS_STANDBY);
3061
3062         IPW_DEBUG_TRACE("<<\n");
3063 }
3064
3065 static int ipw_init_nic(struct ipw_priv *priv)
3066 {
3067         int rc;
3068
3069         IPW_DEBUG_TRACE(">>\n");
3070         /* reset */
3071         /*prvHwInitNic */
3072         /* set "initialization complete" bit to move adapter to D0 state */
3073         ipw_set_bit(priv, IPW_GP_CNTRL_RW, IPW_GP_CNTRL_BIT_INIT_DONE);
3074
3075         /* low-level PLL activation */
3076         ipw_write32(priv, IPW_READ_INT_REGISTER,
3077                     IPW_BIT_INT_HOST_SRAM_READ_INT_REGISTER);
3078
3079         /* wait for clock stabilization */
3080         rc = ipw_poll_bit(priv, IPW_GP_CNTRL_RW,
3081                           IPW_GP_CNTRL_BIT_CLOCK_READY, 250);
3082         if (rc < 0)
3083                 IPW_DEBUG_INFO("FAILED wait for clock stablization\n");
3084
3085         /* assert SW reset */
3086         ipw_set_bit(priv, IPW_RESET_REG, IPW_RESET_REG_SW_RESET);
3087
3088         udelay(10);
3089
3090         /* set "initialization complete" bit to move adapter to D0 state */
3091         ipw_set_bit(priv, IPW_GP_CNTRL_RW, IPW_GP_CNTRL_BIT_INIT_DONE);
3092
3093         IPW_DEBUG_TRACE(">>\n");
3094         return 0;
3095 }
3096
3097 /* Call this function from process context, it will sleep in request_firmware.
3098  * Probe is an ok place to call this from.
3099  */
3100 static int ipw_reset_nic(struct ipw_priv *priv)
3101 {
3102         int rc = 0;
3103         unsigned long flags;
3104
3105         IPW_DEBUG_TRACE(">>\n");
3106
3107         rc = ipw_init_nic(priv);
3108
3109         spin_lock_irqsave(&priv->lock, flags);
3110         /* Clear the 'host command active' bit... */
3111         priv->status &= ~STATUS_HCMD_ACTIVE;
3112         wake_up_interruptible(&priv->wait_command_queue);
3113         priv->status &= ~(STATUS_SCANNING | STATUS_SCAN_ABORTING);
3114         wake_up_interruptible(&priv->wait_state);
3115         spin_unlock_irqrestore(&priv->lock, flags);
3116
3117         IPW_DEBUG_TRACE("<<\n");
3118         return rc;
3119 }
3120
3121 static int ipw_get_fw(struct ipw_priv *priv,
3122                       const struct firmware **fw, const char *name)
3123 {
3124         struct fw_header *header;
3125         int rc;
3126
3127         /* ask firmware_class module to get the boot firmware off disk */
3128         rc = request_firmware(fw, name, &priv->pci_dev->dev);
3129         if (rc < 0) {
3130                 IPW_ERROR("%s load failed: Reason %d\n", name, rc);
3131                 return rc;
3132         }
3133
3134         header = (struct fw_header *)(*fw)->data;
3135         if (IPW_FW_MAJOR(le32_to_cpu(header->version)) != IPW_FW_MAJOR_VERSION) {
3136                 IPW_ERROR("'%s' firmware version not compatible (%d != %d)\n",
3137                           name,
3138                           IPW_FW_MAJOR(le32_to_cpu(header->version)),
3139                           IPW_FW_MAJOR_VERSION);
3140                 return -EINVAL;
3141         }
3142
3143         IPW_DEBUG_INFO("Loading firmware '%s' file v%d.%d (%zd bytes)\n",
3144                        name,
3145                        IPW_FW_MAJOR(le32_to_cpu(header->version)),
3146                        IPW_FW_MINOR(le32_to_cpu(header->version)),
3147                        (*fw)->size - sizeof(struct fw_header));
3148         return 0;
3149 }
3150
3151 #define IPW_RX_BUF_SIZE (3000)
3152
3153 static void ipw_rx_queue_reset(struct ipw_priv *priv,
3154                                       struct ipw_rx_queue *rxq)
3155 {
3156         unsigned long flags;
3157         int i;
3158
3159         spin_lock_irqsave(&rxq->lock, flags);
3160
3161         INIT_LIST_HEAD(&rxq->rx_free);
3162         INIT_LIST_HEAD(&rxq->rx_used);
3163
3164         /* Fill the rx_used queue with _all_ of the Rx buffers */
3165         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
3166                 /* In the reset function, these buffers may have been allocated
3167                  * to an SKB, so we need to unmap and free potential storage */
3168                 if (rxq->pool[i].skb != NULL) {
3169                         pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
3170                                          IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
3171                         dev_kfree_skb(rxq->pool[i].skb);
3172                         rxq->pool[i].skb = NULL;
3173                 }
3174                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
3175         }
3176
3177         /* Set us so that we have processed and used all buffers, but have
3178          * not restocked the Rx queue with fresh buffers */
3179         rxq->read = rxq->write = 0;
3180         rxq->processed = RX_QUEUE_SIZE - 1;
3181         rxq->free_count = 0;
3182         spin_unlock_irqrestore(&rxq->lock, flags);
3183 }
3184
3185 #ifdef CONFIG_PM
3186 static int fw_loaded = 0;
3187 static const struct firmware *bootfw = NULL;
3188 static const struct firmware *firmware = NULL;
3189 static const struct firmware *ucode = NULL;
3190
3191 static void free_firmware(void)
3192 {
3193         if (fw_loaded) {
3194                 release_firmware(bootfw);
3195                 release_firmware(ucode);
3196                 release_firmware(firmware);
3197                 bootfw = ucode = firmware = NULL;
3198                 fw_loaded = 0;
3199         }
3200 }
3201 #else
3202 #define free_firmware() do {} while (0)
3203 #endif
3204
3205 static int ipw_load(struct ipw_priv *priv)
3206 {
3207 #ifndef CONFIG_PM
3208         const struct firmware *bootfw = NULL;
3209         const struct firmware *firmware = NULL;
3210         const struct firmware *ucode = NULL;
3211 #endif
3212         int rc = 0, retries = 3;
3213
3214 #ifdef CONFIG_PM
3215         if (!fw_loaded) {
3216 #endif
3217                 rc = ipw_get_fw(priv, &bootfw, IPW_FW_NAME("boot"));
3218                 if (rc)
3219                         goto error;
3220
3221                 switch (priv->ieee->iw_mode) {
3222                 case IW_MODE_ADHOC:
3223                         rc = ipw_get_fw(priv, &ucode,
3224                                         IPW_FW_NAME("ibss_ucode"));
3225                         if (rc)
3226                                 goto error;
3227
3228                         rc = ipw_get_fw(priv, &firmware, IPW_FW_NAME("ibss"));
3229                         break;
3230
3231 #ifdef CONFIG_IPW2200_MONITOR
3232                 case IW_MODE_MONITOR:
3233                         rc = ipw_get_fw(priv, &ucode,
3234                                         IPW_FW_NAME("sniffer_ucode"));
3235                         if (rc)
3236                                 goto error;
3237
3238                         rc = ipw_get_fw(priv, &firmware,
3239                                         IPW_FW_NAME("sniffer"));
3240                         break;
3241 #endif
3242                 case IW_MODE_INFRA:
3243                         rc = ipw_get_fw(priv, &ucode, IPW_FW_NAME("bss_ucode"));
3244                         if (rc)
3245                                 goto error;
3246
3247                         rc = ipw_get_fw(priv, &firmware, IPW_FW_NAME("bss"));
3248                         break;
3249
3250                 default:
3251                         rc = -EINVAL;
3252                 }
3253
3254                 if (rc)
3255                         goto error;
3256
3257 #ifdef CONFIG_PM
3258                 fw_loaded = 1;
3259         }
3260 #endif
3261
3262         if (!priv->rxq)
3263                 priv->rxq = ipw_rx_queue_alloc(priv);
3264         else
3265                 ipw_rx_queue_reset(priv, priv->rxq);
3266         if (!priv->rxq) {
3267                 IPW_ERROR("Unable to initialize Rx queue\n");
3268                 goto error;
3269         }
3270
3271       retry:
3272         /* Ensure interrupts are disabled */
3273         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
3274         priv->status &= ~STATUS_INT_ENABLED;
3275
3276         /* ack pending interrupts */
3277         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3278
3279         ipw_stop_nic(priv);
3280
3281         rc = ipw_reset_nic(priv);
3282         if (rc) {
3283                 IPW_ERROR("Unable to reset NIC\n");
3284                 goto error;
3285         }
3286
3287         ipw_zero_memory(priv, IPW_NIC_SRAM_LOWER_BOUND,
3288                         IPW_NIC_SRAM_UPPER_BOUND - IPW_NIC_SRAM_LOWER_BOUND);
3289
3290         /* DMA the initial boot firmware into the device */
3291         rc = ipw_load_firmware(priv, bootfw->data + sizeof(struct fw_header),
3292                                bootfw->size - sizeof(struct fw_header));
3293         if (rc < 0) {
3294                 IPW_ERROR("Unable to load boot firmware: %d\n", rc);
3295                 goto error;
3296         }
3297
3298         /* kick start the device */
3299         ipw_start_nic(priv);
3300
3301         /* wait for the device to finish it's initial startup sequence */
3302         rc = ipw_poll_bit(priv, IPW_INTA_RW,
3303                           IPW_INTA_BIT_FW_INITIALIZATION_DONE, 500);
3304         if (rc < 0) {
3305                 IPW_ERROR("device failed to boot initial fw image\n");
3306                 goto error;
3307         }
3308         IPW_DEBUG_INFO("initial device response after %dms\n", rc);
3309
3310         /* ack fw init done interrupt */
3311         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
3312
3313         /* DMA the ucode into the device */
3314         rc = ipw_load_ucode(priv, ucode->data + sizeof(struct fw_header),
3315                             ucode->size - sizeof(struct fw_header));
3316         if (rc < 0) {
3317                 IPW_ERROR("Unable to load ucode: %d\n", rc);
3318                 goto error;
3319         }
3320
3321         /* stop nic */
3322         ipw_stop_nic(priv);
3323
3324         /* DMA bss firmware into the device */
3325         rc = ipw_load_firmware(priv, firmware->data +
3326                                sizeof(struct fw_header),
3327                                firmware->size - sizeof(struct fw_header));
3328         if (rc < 0) {
3329                 IPW_ERROR("Unable to load firmware: %d\n", rc);
3330                 goto error;
3331         }
3332
3333         ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
3334
3335         rc = ipw_queue_reset(priv);
3336         if (rc) {
3337                 IPW_ERROR("Unable to initialize queues\n");
3338                 goto error;
3339         }
3340
3341         /* Ensure interrupts are disabled */
3342         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
3343         /* ack pending interrupts */
3344         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3345
3346         /* kick start the device */
3347         ipw_start_nic(priv);
3348
3349         if (ipw_read32(priv, IPW_INTA_RW) & IPW_INTA_BIT_PARITY_ERROR) {
3350                 if (retries > 0) {
3351                         IPW_WARNING("Parity error.  Retrying init.\n");
3352                         retries--;
3353                         goto retry;
3354                 }
3355
3356                 IPW_ERROR("TODO: Handle parity error -- schedule restart?\n");
3357                 rc = -EIO;
3358                 goto error;
3359         }
3360
3361         /* wait for the device */
3362         rc = ipw_poll_bit(priv, IPW_INTA_RW,
3363                           IPW_INTA_BIT_FW_INITIALIZATION_DONE, 500);
3364         if (rc < 0) {
3365                 IPW_ERROR("device failed to start after 500ms\n");
3366                 goto error;
3367         }
3368         IPW_DEBUG_INFO("device response after %dms\n", rc);
3369
3370         /* ack fw init done interrupt */
3371         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
3372
3373         /* read eeprom data and initialize the eeprom region of sram */
3374         priv->eeprom_delay = 1;
3375         ipw_eeprom_init_sram(priv);
3376
3377         /* enable interrupts */
3378         ipw_enable_interrupts(priv);
3379
3380         /* Ensure our queue has valid packets */
3381         ipw_rx_queue_replenish(priv);
3382
3383         ipw_write32(priv, IPW_RX_READ_INDEX, priv->rxq->read);
3384
3385         /* ack pending interrupts */
3386         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3387
3388 #ifndef CONFIG_PM
3389         release_firmware(bootfw);
3390         release_firmware(ucode);
3391         release_firmware(firmware);
3392 #endif
3393         return 0;
3394
3395       error:
3396         if (priv->rxq) {
3397                 ipw_rx_queue_free(priv, priv->rxq);
3398                 priv->rxq = NULL;
3399         }
3400         ipw_tx_queue_free(priv);
3401         if (bootfw)
3402                 release_firmware(bootfw);
3403         if (ucode)
3404                 release_firmware(ucode);
3405         if (firmware)
3406                 release_firmware(firmware);
3407 #ifdef CONFIG_PM
3408         fw_loaded = 0;
3409         bootfw = ucode = firmware = NULL;
3410 #endif
3411
3412         return rc;
3413 }
3414
3415 /**
3416  * DMA services
3417  *
3418  * Theory of operation
3419  *
3420  * A queue is a circular buffers with 'Read' and 'Write' pointers.
3421  * 2 empty entries always kept in the buffer to protect from overflow.
3422  *
3423  * For Tx queue, there are low mark and high mark limits. If, after queuing
3424  * the packet for Tx, free space become < low mark, Tx queue stopped. When
3425  * reclaiming packets (on 'tx done IRQ), if free space become > high mark,
3426  * Tx queue resumed.
3427  *
3428  * The IPW operates with six queues, one receive queue in the device's
3429  * sram, one transmit queue for sending commands to the device firmware,
3430  * and four transmit queues for data.
3431  *
3432  * The four transmit queues allow for performing quality of service (qos)
3433  * transmissions as per the 802.11 protocol.  Currently Linux does not
3434  * provide a mechanism to the user for utilizing prioritized queues, so
3435  * we only utilize the first data transmit queue (queue1).
3436  */
3437
3438 /**
3439  * Driver allocates buffers of this size for Rx
3440  */
3441
3442 static inline int ipw_queue_space(const struct clx2_queue *q)
3443 {
3444         int s = q->last_used - q->first_empty;
3445         if (s <= 0)
3446                 s += q->n_bd;
3447         s -= 2;                 /* keep some reserve to not confuse empty and full situations */
3448         if (s < 0)
3449                 s = 0;
3450         return s;
3451 }
3452
3453 static inline int ipw_queue_inc_wrap(int index, int n_bd)
3454 {
3455         return (++index == n_bd) ? 0 : index;
3456 }
3457
3458 /**
3459  * Initialize common DMA queue structure
3460  *
3461  * @param q                queue to init
3462  * @param count            Number of BD's to allocate. Should be power of 2
3463  * @param read_register    Address for 'read' register
3464  *                         (not offset within BAR, full address)
3465  * @param write_register   Address for 'write' register
3466  *                         (not offset within BAR, full address)
3467  * @param base_register    Address for 'base' register
3468  *                         (not offset within BAR, full address)
3469  * @param size             Address for 'size' register
3470  *                         (not offset within BAR, full address)
3471  */
3472 static void ipw_queue_init(struct ipw_priv *priv, struct clx2_queue *q,
3473                            int count, u32 read, u32 write, u32 base, u32 size)
3474 {
3475         q->n_bd = count;
3476
3477         q->low_mark = q->n_bd / 4;
3478         if (q->low_mark < 4)
3479                 q->low_mark = 4;
3480
3481         q->high_mark = q->n_bd / 8;
3482         if (q->high_mark < 2)
3483                 q->high_mark = 2;
3484
3485         q->first_empty = q->last_used = 0;
3486         q->reg_r = read;
3487         q->reg_w = write;
3488
3489         ipw_write32(priv, base, q->dma_addr);
3490         ipw_write32(priv, size, count);
3491         ipw_write32(priv, read, 0);
3492         ipw_write32(priv, write, 0);
3493
3494         _ipw_read32(priv, 0x90);
3495 }
3496
3497 static int ipw_queue_tx_init(struct ipw_priv *priv,
3498                              struct clx2_tx_queue *q,
3499                              int count, u32 read, u32 write, u32 base, u32 size)
3500 {
3501         struct pci_dev *dev = priv->pci_dev;
3502
3503         q->txb = kmalloc(sizeof(q->txb[0]) * count, GFP_KERNEL);
3504         if (!q->txb) {
3505                 IPW_ERROR("vmalloc for auxilary BD structures failed\n");
3506                 return -ENOMEM;
3507         }
3508
3509         q->bd =
3510             pci_alloc_consistent(dev, sizeof(q->bd[0]) * count, &q->q.dma_addr);
3511         if (!q->bd) {
3512                 IPW_ERROR("pci_alloc_consistent(%zd) failed\n",
3513                           sizeof(q->bd[0]) * count);
3514                 kfree(q->txb);
3515                 q->txb = NULL;
3516                 return -ENOMEM;
3517         }
3518
3519         ipw_queue_init(priv, &q->q, count, read, write, base, size);
3520         return 0;
3521 }
3522
3523 /**
3524  * Free one TFD, those at index [txq->q.last_used].
3525  * Do NOT advance any indexes
3526  *
3527  * @param dev
3528  * @param txq
3529  */
3530 static void ipw_queue_tx_free_tfd(struct ipw_priv *priv,
3531                                   struct clx2_tx_queue *txq)
3532 {
3533         struct tfd_frame *bd = &txq->bd[txq->q.last_used];
3534         struct pci_dev *dev = priv->pci_dev;
3535         int i;
3536
3537         /* classify bd */
3538         if (bd->control_flags.message_type == TX_HOST_COMMAND_TYPE)
3539                 /* nothing to cleanup after for host commands */
3540                 return;
3541
3542         /* sanity check */
3543         if (le32_to_cpu(bd->u.data.num_chunks) > NUM_TFD_CHUNKS) {
3544                 IPW_ERROR("Too many chunks: %i\n",
3545                           le32_to_cpu(bd->u.data.num_chunks));
3546                 /** @todo issue fatal error, it is quite serious situation */
3547                 return;
3548         }
3549
3550         /* unmap chunks if any */
3551         for (i = 0; i < le32_to_cpu(bd->u.data.num_chunks); i++) {
3552                 pci_unmap_single(dev, le32_to_cpu(bd->u.data.chunk_ptr[i]),
3553                                  le16_to_cpu(bd->u.data.chunk_len[i]),
3554                                  PCI_DMA_TODEVICE);
3555                 if (txq->txb[txq->q.last_used]) {
3556                         ieee80211_txb_free(txq->txb[txq->q.last_used]);
3557                         txq->txb[txq->q.last_used] = NULL;
3558                 }
3559         }
3560 }
3561
3562 /**
3563  * Deallocate DMA queue.
3564  *
3565  * Empty queue by removing and destroying all BD's.
3566  * Free all buffers.
3567  *
3568  * @param dev
3569  * @param q
3570  */
3571 static void ipw_queue_tx_free(struct ipw_priv *priv, struct clx2_tx_queue *txq)
3572 {
3573         struct clx2_queue *q = &txq->q;
3574         struct pci_dev *dev = priv->pci_dev;
3575
3576         if (q->n_bd == 0)
3577                 return;
3578
3579         /* first, empty all BD's */
3580         for (; q->first_empty != q->last_used;
3581              q->last_used = ipw_queue_inc_wrap(q->last_used, q->n_bd)) {
3582                 ipw_queue_tx_free_tfd(priv, txq);
3583         }
3584
3585         /* free buffers belonging to queue itself */
3586         pci_free_consistent(dev, sizeof(txq->bd[0]) * q->n_bd, txq->bd,
3587                             q->dma_addr);
3588         kfree(txq->txb);
3589
3590         /* 0 fill whole structure */
3591         memset(txq, 0, sizeof(*txq));
3592 }
3593
3594 /**
3595  * Destroy all DMA queues and structures
3596  *
3597  * @param priv
3598  */
3599 static void ipw_tx_queue_free(struct ipw_priv *priv)
3600 {
3601         /* Tx CMD queue */
3602         ipw_queue_tx_free(priv, &priv->txq_cmd);
3603
3604         /* Tx queues */
3605         ipw_queue_tx_free(priv, &priv->txq[0]);
3606         ipw_queue_tx_free(priv, &priv->txq[1]);
3607         ipw_queue_tx_free(priv, &priv->txq[2]);
3608         ipw_queue_tx_free(priv, &priv->txq[3]);
3609 }
3610
3611 static void ipw_create_bssid(struct ipw_priv *priv, u8 * bssid)
3612 {
3613         /* First 3 bytes are manufacturer */
3614         bssid[0] = priv->mac_addr[0];
3615         bssid[1] = priv->mac_addr[1];
3616         bssid[2] = priv->mac_addr[2];
3617
3618         /* Last bytes are random */
3619         get_random_bytes(&bssid[3], ETH_ALEN - 3);
3620
3621         bssid[0] &= 0xfe;       /* clear multicast bit */
3622         bssid[0] |= 0x02;       /* set local assignment bit (IEEE802) */
3623 }
3624
3625 static u8 ipw_add_station(struct ipw_priv *priv, u8 * bssid)
3626 {
3627         struct ipw_station_entry entry;
3628         int i;
3629
3630         for (i = 0; i < priv->num_stations; i++) {
3631                 if (!memcmp(priv->stations[i], bssid, ETH_ALEN)) {
3632                         /* Another node is active in network */
3633                         priv->missed_adhoc_beacons = 0;
3634                         if (!(priv->config & CFG_STATIC_CHANNEL))
3635                                 /* when other nodes drop out, we drop out */
3636                                 priv->config &= ~CFG_ADHOC_PERSIST;
3637
3638                         return i;
3639                 }
3640         }
3641
3642         if (i == MAX_STATIONS)
3643                 return IPW_INVALID_STATION;
3644
3645         IPW_DEBUG_SCAN("Adding AdHoc station: " MAC_FMT "\n", MAC_ARG(bssid));
3646
3647         entry.reserved = 0;
3648         entry.support_mode = 0;
3649         memcpy(entry.mac_addr, bssid, ETH_ALEN);
3650         memcpy(priv->stations[i], bssid, ETH_ALEN);
3651         ipw_write_direct(priv, IPW_STATION_TABLE_LOWER + i * sizeof(entry),
3652                          &entry, sizeof(entry));
3653         priv->num_stations++;
3654
3655         return i;
3656 }
3657
3658 static u8 ipw_find_station(struct ipw_priv *priv, u8 * bssid)
3659 {
3660         int i;
3661
3662         for (i = 0; i < priv->num_stations; i++)
3663                 if (!memcmp(priv->stations[i], bssid, ETH_ALEN))
3664                         return i;
3665
3666         return IPW_INVALID_STATION;
3667 }
3668
3669 static void ipw_send_disassociate(struct ipw_priv *priv, int quiet)
3670 {
3671         int err;
3672
3673         if (priv->status & STATUS_ASSOCIATING) {
3674                 IPW_DEBUG_ASSOC("Disassociating while associating.\n");
3675                 queue_work(priv->workqueue, &priv->disassociate);
3676                 return;
3677         }
3678
3679         if (!(priv->status & STATUS_ASSOCIATED)) {
3680                 IPW_DEBUG_ASSOC("Disassociating while not associated.\n");
3681                 return;
3682         }
3683
3684         IPW_DEBUG_ASSOC("Disassocation attempt from " MAC_FMT " "
3685                         "on channel %d.\n",
3686                         MAC_ARG(priv->assoc_request.bssid),
3687                         priv->assoc_request.channel);
3688
3689         priv->status &= ~(STATUS_ASSOCIATING | STATUS_ASSOCIATED);
3690         priv->status |= STATUS_DISASSOCIATING;
3691
3692         if (quiet)
3693                 priv->assoc_request.assoc_type = HC_DISASSOC_QUIET;
3694         else
3695                 priv->assoc_request.assoc_type = HC_DISASSOCIATE;
3696
3697         err = ipw_send_associate(priv, &priv->assoc_request);
3698         if (err) {
3699                 IPW_DEBUG_HC("Attempt to send [dis]associate command "
3700                              "failed.\n");
3701                 return;
3702         }
3703
3704 }
3705
3706 static int ipw_disassociate(void *data)
3707 {
3708         struct ipw_priv *priv = data;
3709         if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)))
3710                 return 0;
3711         ipw_send_disassociate(data, 0);
3712         return 1;
3713 }
3714
3715 static void ipw_bg_disassociate(void *data)
3716 {
3717         struct ipw_priv *priv = data;
3718         down(&priv->sem);
3719         ipw_disassociate(data);
3720         up(&priv->sem);
3721 }
3722
3723 static void ipw_system_config(void *data)
3724 {
3725         struct ipw_priv *priv = data;
3726         ipw_send_system_config(priv, &priv->sys_config);
3727 }
3728
3729 struct ipw_status_code {
3730         u16 status;
3731         const char *reason;
3732 };
3733
3734 static const struct ipw_status_code ipw_status_codes[] = {
3735         {0x00, "Successful"},
3736         {0x01, "Unspecified failure"},
3737         {0x0A, "Cannot support all requested capabilities in the "
3738          "Capability information field"},
3739         {0x0B, "Reassociation denied due to inability to confirm that "
3740          "association exists"},
3741         {0x0C, "Association denied due to reason outside the scope of this "
3742          "standard"},
3743         {0x0D,
3744          "Responding station does not support the specified authentication "
3745          "algorithm"},
3746         {0x0E,
3747          "Received an Authentication frame with authentication sequence "
3748          "transaction sequence number out of expected sequence"},
3749         {0x0F, "Authentication rejected because of challenge failure"},
3750         {0x10, "Authentication rejected due to timeout waiting for next "
3751          "frame in sequence"},
3752         {0x11, "Association denied because AP is unable to handle additional "
3753          "associated stations"},
3754         {0x12,
3755          "Association denied due to requesting station not supporting all "
3756          "of the datarates in the BSSBasicServiceSet Parameter"},
3757         {0x13,
3758          "Association denied due to requesting station not supporting "
3759          "short preamble operation"},
3760         {0x14,
3761          "Association denied due to requesting station not supporting "
3762          "PBCC encoding"},
3763         {0x15,
3764          "Association denied due to requesting station not supporting "
3765          "channel agility"},
3766         {0x19,
3767          "Association denied due to requesting station not supporting "
3768          "short slot operation"},
3769         {0x1A,
3770          "Association denied due to requesting station not supporting "
3771          "DSSS-OFDM operation"},
3772         {0x28, "Invalid Information Element"},
3773         {0x29, "Group Cipher is not valid"},
3774         {0x2A, "Pairwise Cipher is not valid"},
3775         {0x2B, "AKMP is not valid"},
3776         {0x2C, "Unsupported RSN IE version"},
3777         {0x2D, "Invalid RSN IE Capabilities"},
3778         {0x2E, "Cipher suite is rejected per security policy"},
3779 };
3780
3781 #ifdef CONFIG_IPW2200_DEBUG
3782 static const char *ipw_get_status_code(u16 status)
3783 {
3784         int i;
3785         for (i = 0; i < ARRAY_SIZE(ipw_status_codes); i++)
3786                 if (ipw_status_codes[i].status == (status & 0xff))
3787                         return ipw_status_codes[i].reason;
3788         return "Unknown status value.";
3789 }
3790 #endif
3791
3792 static void inline average_init(struct average *avg)
3793 {
3794         memset(avg, 0, sizeof(*avg));
3795 }
3796
3797 static void average_add(struct average *avg, s16 val)
3798 {
3799         avg->sum -= avg->entries[avg->pos];
3800         avg->sum += val;
3801         avg->entries[avg->pos++] = val;
3802         if (unlikely(avg->pos == AVG_ENTRIES)) {
3803                 avg->init = 1;
3804                 avg->pos = 0;
3805         }
3806 }
3807
3808 static s16 average_value(struct average *avg)
3809 {
3810         if (!unlikely(avg->init)) {
3811                 if (avg->pos)
3812                         return avg->sum / avg->pos;
3813                 return 0;
3814         }
3815
3816         return avg->sum / AVG_ENTRIES;
3817 }
3818
3819 static void ipw_reset_stats(struct ipw_priv *priv)
3820 {
3821         u32 len = sizeof(u32);
3822
3823         priv->quality = 0;
3824
3825         average_init(&priv->average_missed_beacons);
3826         average_init(&priv->average_rssi);
3827         average_init(&priv->average_noise);
3828
3829         priv->last_rate = 0;
3830         priv->last_missed_beacons = 0;
3831         priv->last_rx_packets = 0;
3832         priv->last_tx_packets = 0;
3833         priv->last_tx_failures = 0;
3834
3835         /* Firmware managed, reset only when NIC is restarted, so we have to
3836          * normalize on the current value */
3837         ipw_get_ordinal(priv, IPW_ORD_STAT_RX_ERR_CRC,
3838                         &priv->last_rx_err, &len);
3839         ipw_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURE,
3840                         &priv->last_tx_failures, &len);
3841
3842         /* Driver managed, reset with each association */
3843         priv->missed_adhoc_beacons = 0;
3844         priv->missed_beacons = 0;
3845         priv->tx_packets = 0;
3846         priv->rx_packets = 0;
3847
3848 }
3849
3850 static u32 ipw_get_max_rate(struct ipw_priv *priv)
3851 {
3852         u32 i = 0x80000000;
3853         u32 mask = priv->rates_mask;
3854         /* If currently associated in B mode, restrict the maximum
3855          * rate match to B rates */
3856         if (priv->assoc_request.ieee_mode == IPW_B_MODE)
3857                 mask &= IEEE80211_CCK_RATES_MASK;
3858
3859         /* TODO: Verify that the rate is supported by the current rates
3860          * list. */
3861
3862         while (i && !(mask & i))
3863                 i >>= 1;
3864         switch (i) {
3865         case IEEE80211_CCK_RATE_1MB_MASK:
3866                 return 1000000;
3867         case IEEE80211_CCK_RATE_2MB_MASK:
3868                 return 2000000;
3869         case IEEE80211_CCK_RATE_5MB_MASK:
3870                 return 5500000;
3871         case IEEE80211_OFDM_RATE_6MB_MASK:
3872                 return 6000000;
3873         case IEEE80211_OFDM_RATE_9MB_MASK:
3874                 return 9000000;
3875         case IEEE80211_CCK_RATE_11MB_MASK:
3876                 return 11000000;
3877         case IEEE80211_OFDM_RATE_12MB_MASK:
3878                 return 12000000;
3879         case IEEE80211_OFDM_RATE_18MB_MASK:
3880                 return 18000000;
3881         case IEEE80211_OFDM_RATE_24MB_MASK:
3882                 return 24000000;
3883         case IEEE80211_OFDM_RATE_36MB_MASK:
3884                 return 36000000;
3885         case IEEE80211_OFDM_RATE_48MB_MASK:
3886                 return 48000000;
3887         case IEEE80211_OFDM_RATE_54MB_MASK:
3888                 return 54000000;
3889         }
3890
3891         if (priv->ieee->mode == IEEE_B)
3892                 return 11000000;
3893         else
3894                 return 54000000;
3895 }
3896
3897 static u32 ipw_get_current_rate(struct ipw_priv *priv)
3898 {
3899         u32 rate, len = sizeof(rate);
3900         int err;
3901
3902         if (!(priv->status & STATUS_ASSOCIATED))
3903                 return 0;
3904
3905         if (priv->tx_packets > IPW_REAL_RATE_RX_PACKET_THRESHOLD) {
3906                 err = ipw_get_ordinal(priv, IPW_ORD_STAT_TX_CURR_RATE, &rate,
3907                                       &len);
3908                 if (err) {
3909                         IPW_DEBUG_INFO("failed querying ordinals.\n");
3910                         return 0;
3911                 }
3912         } else
3913                 return ipw_get_max_rate(priv);
3914
3915         switch (rate) {
3916         case IPW_TX_RATE_1MB:
3917                 return 1000000;
3918         case IPW_TX_RATE_2MB:
3919                 return 2000000;
3920         case IPW_TX_RATE_5MB:
3921                 return 5500000;
3922         case IPW_TX_RATE_6MB:
3923                 return 6000000;
3924         case IPW_TX_RATE_9MB:
3925                 return 9000000;
3926         case IPW_TX_RATE_11MB:
3927                 return 11000000;
3928         case IPW_TX_RATE_12MB:
3929                 return 12000000;
3930         case IPW_TX_RATE_18MB:
3931                 return 18000000;
3932         case IPW_TX_RATE_24MB:
3933                 return 24000000;
3934         case IPW_TX_RATE_36MB:
3935                 return 36000000;
3936         case IPW_TX_RATE_48MB:
3937                 return 48000000;
3938         case IPW_TX_RATE_54MB:
3939                 return 54000000;
3940         }
3941
3942         return 0;
3943 }
3944
3945 #define IPW_STATS_INTERVAL (2 * HZ)
3946 static void ipw_gather_stats(struct ipw_priv *priv)
3947 {
3948         u32 rx_err, rx_err_delta, rx_packets_delta;
3949         u32 tx_failures, tx_failures_delta, tx_packets_delta;
3950         u32 missed_beacons_percent, missed_beacons_delta;
3951         u32 quality = 0;
3952         u32 len = sizeof(u32);
3953         s16 rssi;
3954         u32 beacon_quality, signal_quality, tx_quality, rx_quality,
3955             rate_quality;
3956         u32 max_rate;
3957
3958         if (!(priv->status & STATUS_ASSOCIATED)) {
3959                 priv->quality = 0;
3960                 return;
3961         }
3962
3963         /* Update the statistics */
3964         ipw_get_ordinal(priv, IPW_ORD_STAT_MISSED_BEACONS,
3965                         &priv->missed_beacons, &len);
3966         missed_beacons_delta = priv->missed_beacons - priv->last_missed_beacons;
3967         priv->last_missed_beacons = priv->missed_beacons;
3968         if (priv->assoc_request.beacon_interval) {
3969                 missed_beacons_percent = missed_beacons_delta *
3970                     (HZ * priv->assoc_request.beacon_interval) /
3971                     (IPW_STATS_INTERVAL * 10);
3972         } else {
3973                 missed_beacons_percent = 0;
3974         }
3975         average_add(&priv->average_missed_beacons, missed_beacons_percent);
3976
3977         ipw_get_ordinal(priv, IPW_ORD_STAT_RX_ERR_CRC, &rx_err, &len);
3978         rx_err_delta = rx_err - priv->last_rx_err;
3979         priv->last_rx_err = rx_err;
3980
3981         ipw_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURE, &tx_failures, &len);
3982         tx_failures_delta = tx_failures - priv->last_tx_failures;
3983         priv->last_tx_failures = tx_failures;
3984
3985         rx_packets_delta = priv->rx_packets - priv->last_rx_packets;
3986         priv->last_rx_packets = priv->rx_packets;
3987
3988         tx_packets_delta = priv->tx_packets - priv->last_tx_packets;
3989         priv->last_tx_packets = priv->tx_packets;
3990
3991         /* Calculate quality based on the following:
3992          *
3993          * Missed beacon: 100% = 0, 0% = 70% missed
3994          * Rate: 60% = 1Mbs, 100% = Max
3995          * Rx and Tx errors represent a straight % of total Rx/Tx
3996          * RSSI: 100% = > -50,  0% = < -80
3997          * Rx errors: 100% = 0, 0% = 50% missed
3998          *
3999          * The lowest computed quality is used.
4000          *
4001          */
4002 #define BEACON_THRESHOLD 5
4003         beacon_quality = 100 - missed_beacons_percent;
4004         if (beacon_quality < BEACON_THRESHOLD)
4005                 beacon_quality = 0;
4006         else
4007                 beacon_quality = (beacon_quality - BEACON_THRESHOLD) * 100 /
4008                     (100 - BEACON_THRESHOLD);
4009         IPW_DEBUG_STATS("Missed beacon: %3d%% (%d%%)\n",
4010                         beacon_quality, missed_beacons_percent);
4011
4012         priv->last_rate = ipw_get_current_rate(priv);
4013         max_rate = ipw_get_max_rate(priv);
4014         rate_quality = priv->last_rate * 40 / max_rate + 60;
4015         IPW_DEBUG_STATS("Rate quality : %3d%% (%dMbs)\n",
4016                         rate_quality, priv->last_rate / 1000000);
4017
4018         if (rx_packets_delta > 100 && rx_packets_delta + rx_err_delta)
4019                 rx_quality = 100 - (rx_err_delta * 100) /
4020                     (rx_packets_delta + rx_err_delta);
4021         else
4022                 rx_quality = 100;
4023         IPW_DEBUG_STATS("Rx quality   : %3d%% (%u errors, %u packets)\n",
4024                         rx_quality, rx_err_delta, rx_packets_delta);
4025
4026         if (tx_packets_delta > 100 && tx_packets_delta + tx_failures_delta)
4027                 tx_quality = 100 - (tx_failures_delta * 100) /
4028                     (tx_packets_delta + tx_failures_delta);
4029         else
4030                 tx_quality = 100;
4031         IPW_DEBUG_STATS("Tx quality   : %3d%% (%u errors, %u packets)\n",
4032                         tx_quality, tx_failures_delta, tx_packets_delta);
4033
4034         rssi = average_value(&priv->average_rssi);
4035         signal_quality =
4036             (100 *
4037              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) *
4038              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) -
4039              (priv->ieee->perfect_rssi - rssi) *
4040              (15 * (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) +
4041               62 * (priv->ieee->perfect_rssi - rssi))) /
4042             ((priv->ieee->perfect_rssi - priv->ieee->worst_rssi) *
4043              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi));
4044         if (signal_quality > 100)
4045                 signal_quality = 100;
4046         else if (signal_quality < 1)
4047                 signal_quality = 0;
4048
4049         IPW_DEBUG_STATS("Signal level : %3d%% (%d dBm)\n",
4050                         signal_quality, rssi);
4051
4052         quality = min(beacon_quality,
4053                       min(rate_quality,
4054                           min(tx_quality, min(rx_quality, signal_quality))));
4055         if (quality == beacon_quality)
4056                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to missed beacons.\n",
4057                                 quality);
4058         if (quality == rate_quality)
4059                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to rate quality.\n",
4060                                 quality);
4061         if (quality == tx_quality)
4062                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to Tx quality.\n",
4063                                 quality);
4064         if (quality == rx_quality)
4065                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to Rx quality.\n",
4066                                 quality);
4067         if (quality == signal_quality)
4068                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to signal quality.\n",
4069                                 quality);
4070
4071         priv->quality = quality;
4072
4073         queue_delayed_work(priv->workqueue, &priv->gather_stats,
4074                            IPW_STATS_INTERVAL);
4075 }
4076
4077 static void ipw_bg_gather_stats(void *data)
4078 {
4079         struct ipw_priv *priv = data;
4080         down(&priv->sem);
4081         ipw_gather_stats(data);
4082         up(&priv->sem);
4083 }
4084
4085 /* Missed beacon behavior:
4086  * 1st missed -> roaming_threshold, just wait, don't do any scan/roam.
4087  * roaming_threshold -> disassociate_threshold, scan and roam for better signal.
4088  * Above disassociate threshold, give up and stop scanning.
4089  * Roaming is disabled if disassociate_threshold <= roaming_threshold  */
4090 static void ipw_handle_missed_beacon(struct ipw_priv *priv,
4091                                             int missed_count)
4092 {
4093         priv->notif_missed_beacons = missed_count;
4094
4095         if (missed_count > priv->disassociate_threshold &&
4096             priv->status & STATUS_ASSOCIATED) {
4097                 /* If associated and we've hit the missed
4098                  * beacon threshold, disassociate, turn
4099                  * off roaming, and abort any active scans */
4100                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
4101                           IPW_DL_STATE | IPW_DL_ASSOC,
4102                           "Missed beacon: %d - disassociate\n", missed_count);
4103                 priv->status &= ~STATUS_ROAMING;
4104                 if (priv->status & STATUS_SCANNING) {
4105                         IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
4106                                   IPW_DL_STATE,
4107                                   "Aborting scan with missed beacon.\n");
4108                         queue_work(priv->workqueue, &priv->abort_scan);
4109                 }
4110
4111                 queue_work(priv->workqueue, &priv->disassociate);
4112                 return;
4113         }
4114
4115         if (priv->status & STATUS_ROAMING) {
4116                 /* If we are currently roaming, then just
4117                  * print a debug statement... */
4118                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4119                           "Missed beacon: %d - roam in progress\n",
4120                           missed_count);
4121                 return;
4122         }
4123
4124         if (missed_count > priv->roaming_threshold &&
4125             missed_count <= priv->disassociate_threshold) {
4126                 /* If we are not already roaming, set the ROAM
4127                  * bit in the status and kick off a scan.
4128                  * This can happen several times before we reach
4129                  * disassociate_threshold. */
4130                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4131                           "Missed beacon: %d - initiate "
4132                           "roaming\n", missed_count);
4133                 if (!(priv->status & STATUS_ROAMING)) {
4134                         priv->status |= STATUS_ROAMING;
4135                         if (!(priv->status & STATUS_SCANNING))
4136                                 queue_work(priv->workqueue,
4137                                            &priv->request_scan);
4138                 }
4139                 return;
4140         }
4141
4142         if (priv->status & STATUS_SCANNING) {
4143                 /* Stop scan to keep fw from getting
4144                  * stuck (only if we aren't roaming --
4145                  * otherwise we'll never scan more than 2 or 3
4146                  * channels..) */
4147                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF | IPW_DL_STATE,
4148                           "Aborting scan with missed beacon.\n");
4149                 queue_work(priv->workqueue, &priv->abort_scan);
4150         }
4151
4152         IPW_DEBUG_NOTIF("Missed beacon: %d\n", missed_count);
4153
4154 }
4155
4156 /**
4157  * Handle host notification packet.
4158  * Called from interrupt routine
4159  */
4160 static void ipw_rx_notification(struct ipw_priv *priv,
4161                                        struct ipw_rx_notification *notif)
4162 {
4163         notif->size = le16_to_cpu(notif->size);
4164
4165         IPW_DEBUG_NOTIF("type = %i (%d bytes)\n", notif->subtype, notif->size);
4166
4167         switch (notif->subtype) {
4168         case HOST_NOTIFICATION_STATUS_ASSOCIATED:{
4169                         struct notif_association *assoc = &notif->u.assoc;
4170
4171                         switch (assoc->state) {
4172                         case CMAS_ASSOCIATED:{
4173                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4174                                                   IPW_DL_ASSOC,
4175                                                   "associated: '%s' " MAC_FMT
4176                                                   " \n",
4177                                                   escape_essid(priv->essid,
4178                                                                priv->essid_len),
4179                                                   MAC_ARG(priv->bssid));
4180
4181                                         switch (priv->ieee->iw_mode) {
4182                                         case IW_MODE_INFRA:
4183                                                 memcpy(priv->ieee->bssid,
4184                                                        priv->bssid, ETH_ALEN);
4185                                                 break;
4186
4187                                         case IW_MODE_ADHOC:
4188                                                 memcpy(priv->ieee->bssid,
4189                                                        priv->bssid, ETH_ALEN);
4190
4191                                                 /* clear out the station table */
4192                                                 priv->num_stations = 0;
4193
4194                                                 IPW_DEBUG_ASSOC
4195                                                     ("queueing adhoc check\n");
4196                                                 queue_delayed_work(priv->
4197                                                                    workqueue,
4198                                                                    &priv->
4199                                                                    adhoc_check,
4200                                                                    priv->
4201                                                                    assoc_request.
4202                                                                    beacon_interval);
4203                                                 break;
4204                                         }
4205
4206                                         priv->status &= ~STATUS_ASSOCIATING;
4207                                         priv->status |= STATUS_ASSOCIATED;
4208                                         queue_work(priv->workqueue,
4209                                                    &priv->system_config);
4210
4211 #ifdef CONFIG_IPW_QOS
4212 #define IPW_GET_PACKET_STYPE(x) WLAN_FC_GET_STYPE( \
4213                          le16_to_cpu(((struct ieee80211_hdr *)(x))->frame_ctl))
4214                                         if ((priv->status & STATUS_AUTH) &&
4215                                             (IPW_GET_PACKET_STYPE(&notif->u.raw)
4216                                              == IEEE80211_STYPE_ASSOC_RESP)) {
4217                                                 if ((sizeof
4218                                                      (struct
4219                                                       ieee80211_assoc_response)
4220                                                      <= notif->size)
4221                                                     && (notif->size <= 2314)) {
4222                                                         struct
4223                                                         ieee80211_rx_stats
4224                                                             stats = {
4225                                                                 .len =
4226                                                                     notif->
4227                                                                     size - 1,
4228                                                         };
4229
4230                                                         IPW_DEBUG_QOS
4231                                                             ("QoS Associate "
4232                                                              "size %d\n",
4233                                                              notif->size);
4234                                                         ieee80211_rx_mgt(priv->
4235                                                                          ieee,
4236                                                                          (struct
4237                                                                           ieee80211_hdr_4addr
4238                                                                           *)
4239                                                                          &notif->u.raw, &stats);
4240                                                 }
4241                                         }
4242 #endif
4243
4244                                         schedule_work(&priv->link_up);
4245
4246                                         break;
4247                                 }
4248
4249                         case CMAS_AUTHENTICATED:{
4250                                         if (priv->
4251                                             status & (STATUS_ASSOCIATED |
4252                                                       STATUS_AUTH)) {
4253 #ifdef CONFIG_IPW2200_DEBUG
4254                                                 struct notif_authenticate *auth
4255                                                     = &notif->u.auth;
4256                                                 IPW_DEBUG(IPW_DL_NOTIF |
4257                                                           IPW_DL_STATE |
4258                                                           IPW_DL_ASSOC,
4259                                                           "deauthenticated: '%s' "
4260                                                           MAC_FMT
4261                                                           ": (0x%04X) - %s \n",
4262                                                           escape_essid(priv->
4263                                                                        essid,
4264                                                                        priv->
4265                                                                        essid_len),
4266                                                           MAC_ARG(priv->bssid),
4267                                                           ntohs(auth->status),
4268                                                           ipw_get_status_code
4269                                                           (ntohs
4270                                                            (auth->status)));
4271 #endif
4272
4273                                                 priv->status &=
4274                                                     ~(STATUS_ASSOCIATING |
4275                                                       STATUS_AUTH |
4276                                                       STATUS_ASSOCIATED);
4277
4278                                                 schedule_work(&priv->link_down);
4279                                                 break;
4280                                         }
4281
4282                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4283                                                   IPW_DL_ASSOC,
4284                                                   "authenticated: '%s' " MAC_FMT
4285                                                   "\n",
4286                                                   escape_essid(priv->essid,
4287                                                                priv->essid_len),
4288                                                   MAC_ARG(priv->bssid));
4289                                         break;
4290                                 }
4291
4292                         case CMAS_INIT:{
4293                                         if (priv->status & STATUS_AUTH) {
4294                                                 struct
4295                                                     ieee80211_assoc_response
4296                                                 *resp;
4297                                                 resp =
4298                                                     (struct
4299                                                      ieee80211_assoc_response
4300                                                      *)&notif->u.raw;
4301                                                 IPW_DEBUG(IPW_DL_NOTIF |
4302                                                           IPW_DL_STATE |
4303                                                           IPW_DL_ASSOC,
4304                                                           "association failed (0x%04X): %s\n",
4305                                                           ntohs(resp->status),
4306                                                           ipw_get_status_code
4307                                                           (ntohs
4308                                                            (resp->status)));
4309                                         }
4310
4311                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4312                                                   IPW_DL_ASSOC,
4313                                                   "disassociated: '%s' " MAC_FMT
4314                                                   " \n",
4315                                                   escape_essid(priv->essid,
4316                                                                priv->essid_len),
4317                                                   MAC_ARG(priv->bssid));
4318
4319                                         priv->status &=
4320                                             ~(STATUS_DISASSOCIATING |
4321                                               STATUS_ASSOCIATING |
4322                                               STATUS_ASSOCIATED | STATUS_AUTH);
4323                                         if (priv->assoc_network
4324                                             && (priv->assoc_network->
4325                                                 capability &
4326                                                 WLAN_CAPABILITY_IBSS))
4327                                                 ipw_remove_current_network
4328                                                     (priv);
4329
4330                                         schedule_work(&priv->link_down);
4331
4332                                         break;
4333                                 }
4334
4335                         case CMAS_RX_ASSOC_RESP:
4336                                 break;
4337
4338                         default:
4339                                 IPW_ERROR("assoc: unknown (%d)\n",
4340                                           assoc->state);
4341                                 break;
4342                         }
4343
4344                         break;
4345                 }
4346
4347         case HOST_NOTIFICATION_STATUS_AUTHENTICATE:{
4348                         struct notif_authenticate *auth = &notif->u.auth;
4349                         switch (auth->state) {
4350                         case CMAS_AUTHENTICATED:
4351                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4352                                           "authenticated: '%s' " MAC_FMT " \n",
4353                                           escape_essid(priv->essid,
4354                                                        priv->essid_len),
4355                                           MAC_ARG(priv->bssid));
4356                                 priv->status |= STATUS_AUTH;
4357                                 break;
4358
4359                         case CMAS_INIT:
4360                                 if (priv->status & STATUS_AUTH) {
4361                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4362                                                   IPW_DL_ASSOC,
4363                                                   "authentication failed (0x%04X): %s\n",
4364                                                   ntohs(auth->status),
4365                                                   ipw_get_status_code(ntohs
4366                                                                       (auth->
4367                                                                        status)));
4368                                 }
4369                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4370                                           IPW_DL_ASSOC,
4371                                           "deauthenticated: '%s' " MAC_FMT "\n",
4372                                           escape_essid(priv->essid,
4373                                                        priv->essid_len),
4374                                           MAC_ARG(priv->bssid));
4375
4376                                 priv->status &= ~(STATUS_ASSOCIATING |
4377                                                   STATUS_AUTH |
4378                                                   STATUS_ASSOCIATED);
4379
4380                                 schedule_work(&priv->link_down);
4381                                 break;
4382
4383                         case CMAS_TX_AUTH_SEQ_1:
4384                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4385                                           IPW_DL_ASSOC, "AUTH_SEQ_1\n");
4386                                 break;
4387                         case CMAS_RX_AUTH_SEQ_2:
4388                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4389                                           IPW_DL_ASSOC, "AUTH_SEQ_2\n");
4390                                 break;
4391                         case CMAS_AUTH_SEQ_1_PASS:
4392                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4393                                           IPW_DL_ASSOC, "AUTH_SEQ_1_PASS\n");
4394                                 break;
4395                         case CMAS_AUTH_SEQ_1_FAIL:
4396                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4397                                           IPW_DL_ASSOC, "AUTH_SEQ_1_FAIL\n");
4398                                 break;
4399                         case CMAS_TX_AUTH_SEQ_3:
4400                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4401                                           IPW_DL_ASSOC, "AUTH_SEQ_3\n");
4402                                 break;
4403                         case CMAS_RX_AUTH_SEQ_4:
4404                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4405                                           IPW_DL_ASSOC, "RX_AUTH_SEQ_4\n");
4406                                 break;
4407                         case CMAS_AUTH_SEQ_2_PASS:
4408                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4409                                           IPW_DL_ASSOC, "AUTH_SEQ_2_PASS\n");
4410                                 break;
4411                         case CMAS_AUTH_SEQ_2_FAIL:
4412                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4413                                           IPW_DL_ASSOC, "AUT_SEQ_2_FAIL\n");
4414                                 break;
4415                         case CMAS_TX_ASSOC:
4416                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4417                                           IPW_DL_ASSOC, "TX_ASSOC\n");
4418                                 break;
4419                         case CMAS_RX_ASSOC_RESP:
4420                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4421                                           IPW_DL_ASSOC, "RX_ASSOC_RESP\n");
4422
4423                                 break;
4424                         case CMAS_ASSOCIATED:
4425                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4426                                           IPW_DL_ASSOC, "ASSOCIATED\n");
4427                                 break;
4428                         default:
4429                                 IPW_DEBUG_NOTIF("auth: failure - %d\n",
4430                                                 auth->state);
4431                                 break;
4432                         }
4433                         break;
4434                 }
4435
4436         case HOST_NOTIFICATION_STATUS_SCAN_CHANNEL_RESULT:{
4437                         struct notif_channel_result *x =
4438                             &notif->u.channel_result;
4439
4440                         if (notif->size == sizeof(*x)) {
4441                                 IPW_DEBUG_SCAN("Scan result for channel %d\n",
4442                                                x->channel_num);
4443                         } else {
4444                                 IPW_DEBUG_SCAN("Scan result of wrong size %d "
4445                                                "(should be %zd)\n",
4446                                                notif->size, sizeof(*x));
4447                         }
4448                         break;
4449                 }
4450
4451         case HOST_NOTIFICATION_STATUS_SCAN_COMPLETED:{
4452                         struct notif_scan_complete *x = &notif->u.scan_complete;
4453                         if (notif->size == sizeof(*x)) {
4454                                 IPW_DEBUG_SCAN
4455                                     ("Scan completed: type %d, %d channels, "
4456                                      "%d status\n", x->scan_type,
4457                                      x->num_channels, x->status);
4458                         } else {
4459                                 IPW_ERROR("Scan completed of wrong size %d "
4460                                           "(should be %zd)\n",
4461                                           notif->size, sizeof(*x));
4462                         }
4463
4464                         priv->status &=
4465                             ~(STATUS_SCANNING | STATUS_SCAN_ABORTING);
4466
4467                         wake_up_interruptible(&priv->wait_state);
4468                         cancel_delayed_work(&priv->scan_check);
4469
4470                         if (priv->status & STATUS_EXIT_PENDING)
4471                                 break;
4472
4473                         priv->ieee->scans++;
4474
4475 #ifdef CONFIG_IPW2200_MONITOR
4476                         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
4477                                 priv->status |= STATUS_SCAN_FORCED;
4478                                 queue_work(priv->workqueue,
4479                                            &priv->request_scan);
4480                                 break;
4481                         }
4482                         priv->status &= ~STATUS_SCAN_FORCED;
4483 #endif                          /* CONFIG_IPW2200_MONITOR */
4484
4485                         if (!(priv->status & (STATUS_ASSOCIATED |
4486                                               STATUS_ASSOCIATING |
4487                                               STATUS_ROAMING |
4488                                               STATUS_DISASSOCIATING)))
4489                                 queue_work(priv->workqueue, &priv->associate);
4490                         else if (priv->status & STATUS_ROAMING) {
4491                                 if (x->status == SCAN_COMPLETED_STATUS_COMPLETE)
4492                                         /* If a scan completed and we are in roam mode, then
4493                                          * the scan that completed was the one requested as a
4494                                          * result of entering roam... so, schedule the
4495                                          * roam work */
4496                                         queue_work(priv->workqueue,
4497                                                    &priv->roam);
4498                                 else
4499                                         /* Don't schedule if we aborted the scan */
4500                                         priv->status &= ~STATUS_ROAMING;
4501                         } else if (priv->status & STATUS_SCAN_PENDING)
4502                                 queue_work(priv->workqueue,
4503                                            &priv->request_scan);
4504                         else if (priv->config & CFG_BACKGROUND_SCAN
4505                                  && priv->status & STATUS_ASSOCIATED)
4506                                 queue_delayed_work(priv->workqueue,
4507                                                    &priv->request_scan, HZ);
4508                         break;
4509                 }
4510
4511         case HOST_NOTIFICATION_STATUS_FRAG_LENGTH:{
4512                         struct notif_frag_length *x = &notif->u.frag_len;
4513
4514                         if (notif->size == sizeof(*x))
4515                                 IPW_ERROR("Frag length: %d\n",
4516                                           le16_to_cpu(x->frag_length));
4517                         else
4518                                 IPW_ERROR("Frag length of wrong size %d "
4519                                           "(should be %zd)\n",
4520                                           notif->size, sizeof(*x));
4521                         break;
4522                 }
4523
4524         case HOST_NOTIFICATION_STATUS_LINK_DETERIORATION:{
4525                         struct notif_link_deterioration *x =
4526                             &notif->u.link_deterioration;
4527
4528                         if (notif->size == sizeof(*x)) {
4529                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4530                                           "link deterioration: '%s' " MAC_FMT
4531                                           " \n", escape_essid(priv->essid,
4532                                                               priv->essid_len),
4533                                           MAC_ARG(priv->bssid));
4534                                 memcpy(&priv->last_link_deterioration, x,
4535                                        sizeof(*x));
4536                         } else {
4537                                 IPW_ERROR("Link Deterioration of wrong size %d "
4538                                           "(should be %zd)\n",
4539                                           notif->size, sizeof(*x));
4540                         }
4541                         break;
4542                 }
4543
4544         case HOST_NOTIFICATION_DINO_CONFIG_RESPONSE:{
4545                         IPW_ERROR("Dino config\n");
4546                         if (priv->hcmd
4547                             && priv->hcmd->cmd != HOST_CMD_DINO_CONFIG)
4548                                 IPW_ERROR("Unexpected DINO_CONFIG_RESPONSE\n");
4549
4550                         break;
4551                 }
4552
4553         case HOST_NOTIFICATION_STATUS_BEACON_STATE:{
4554                         struct notif_beacon_state *x = &notif->u.beacon_state;
4555                         if (notif->size != sizeof(*x)) {
4556                                 IPW_ERROR
4557                                     ("Beacon state of wrong size %d (should "
4558                                      "be %zd)\n", notif->size, sizeof(*x));
4559                                 break;
4560                         }
4561
4562                         if (le32_to_cpu(x->state) ==
4563                             HOST_NOTIFICATION_STATUS_BEACON_MISSING)
4564                                 ipw_handle_missed_beacon(priv,
4565                                                          le32_to_cpu(x->
4566                                                                      number));
4567
4568                         break;
4569                 }
4570
4571         case HOST_NOTIFICATION_STATUS_TGI_TX_KEY:{
4572                         struct notif_tgi_tx_key *x = &notif->u.tgi_tx_key;
4573                         if (notif->size == sizeof(*x)) {
4574                                 IPW_ERROR("TGi Tx Key: state 0x%02x sec type "
4575                                           "0x%02x station %d\n",
4576                                           x->key_state, x->security_type,
4577                                           x->station_index);
4578                                 break;
4579                         }
4580
4581                         IPW_ERROR
4582                             ("TGi Tx Key of wrong size %d (should be %zd)\n",
4583                              notif->size, sizeof(*x));
4584                         break;
4585                 }
4586
4587         case HOST_NOTIFICATION_CALIB_KEEP_RESULTS:{
4588                         struct notif_calibration *x = &notif->u.calibration;
4589
4590                         if (notif->size == sizeof(*x)) {
4591                                 memcpy(&priv->calib, x, sizeof(*x));
4592                                 IPW_DEBUG_INFO("TODO: Calibration\n");
4593                                 break;
4594                         }
4595
4596                         IPW_ERROR
4597                             ("Calibration of wrong size %d (should be %zd)\n",
4598                              notif->size, sizeof(*x));
4599                         break;
4600                 }
4601
4602         case HOST_NOTIFICATION_NOISE_STATS:{
4603                         if (notif->size == sizeof(u32)) {
4604                                 priv->last_noise =
4605                                     (u8) (le32_to_cpu(notif->u.noise.value) &
4606                                           0xff);
4607                                 average_add(&priv->average_noise,
4608                                             priv->last_noise);
4609                                 break;
4610                         }
4611
4612                         IPW_ERROR
4613                             ("Noise stat is wrong size %d (should be %zd)\n",
4614                              notif->size, sizeof(u32));
4615                         break;
4616                 }
4617
4618         default:
4619                 IPW_ERROR("Unknown notification: "
4620                           "subtype=%d,flags=0x%2x,size=%d\n",
4621                           notif->subtype, notif->flags, notif->size);
4622         }
4623 }
4624
4625 /**
4626  * Destroys all DMA structures and initialise them again
4627  *
4628  * @param priv
4629  * @return error code
4630  */
4631 static int ipw_queue_reset(struct ipw_priv *priv)
4632 {
4633         int rc = 0;
4634         /** @todo customize queue sizes */
4635         int nTx = 64, nTxCmd = 8;
4636         ipw_tx_queue_free(priv);
4637         /* Tx CMD queue */
4638         rc = ipw_queue_tx_init(priv, &priv->txq_cmd, nTxCmd,
4639                                IPW_TX_CMD_QUEUE_READ_INDEX,
4640                                IPW_TX_CMD_QUEUE_WRITE_INDEX,
4641                                IPW_TX_CMD_QUEUE_BD_BASE,
4642                                IPW_TX_CMD_QUEUE_BD_SIZE);
4643         if (rc) {
4644                 IPW_ERROR("Tx Cmd queue init failed\n");
4645                 goto error;
4646         }
4647         /* Tx queue(s) */
4648         rc = ipw_queue_tx_init(priv, &priv->txq[0], nTx,
4649                                IPW_TX_QUEUE_0_READ_INDEX,
4650                                IPW_TX_QUEUE_0_WRITE_INDEX,
4651                                IPW_TX_QUEUE_0_BD_BASE, IPW_TX_QUEUE_0_BD_SIZE);
4652         if (rc) {
4653                 IPW_ERROR("Tx 0 queue init failed\n");
4654                 goto error;
4655         }
4656         rc = ipw_queue_tx_init(priv, &priv->txq[1], nTx,
4657                                IPW_TX_QUEUE_1_READ_INDEX,
4658                                IPW_TX_QUEUE_1_WRITE_INDEX,
4659                                IPW_TX_QUEUE_1_BD_BASE, IPW_TX_QUEUE_1_BD_SIZE);
4660         if (rc) {
4661                 IPW_ERROR("Tx 1 queue init failed\n");
4662                 goto error;
4663         }
4664         rc = ipw_queue_tx_init(priv, &priv->txq[2], nTx,
4665                                IPW_TX_QUEUE_2_READ_INDEX,
4666                                IPW_TX_QUEUE_2_WRITE_INDEX,
4667                                IPW_TX_QUEUE_2_BD_BASE, IPW_TX_QUEUE_2_BD_SIZE);
4668         if (rc) {
4669                 IPW_ERROR("Tx 2 queue init failed\n");
4670                 goto error;
4671         }
4672         rc = ipw_queue_tx_init(priv, &priv->txq[3], nTx,
4673                                IPW_TX_QUEUE_3_READ_INDEX,
4674                                IPW_TX_QUEUE_3_WRITE_INDEX,
4675                                IPW_TX_QUEUE_3_BD_BASE, IPW_TX_QUEUE_3_BD_SIZE);
4676         if (rc) {
4677                 IPW_ERROR("Tx 3 queue init failed\n");
4678                 goto error;
4679         }
4680         /* statistics */
4681         priv->rx_bufs_min = 0;
4682         priv->rx_pend_max = 0;
4683         return rc;
4684
4685       error:
4686         ipw_tx_queue_free(priv);
4687         return rc;
4688 }
4689
4690 /**
4691  * Reclaim Tx queue entries no more used by NIC.
4692  *
4693  * When FW adwances 'R' index, all entries between old and
4694  * new 'R' index need to be reclaimed. As result, some free space
4695  * forms. If there is enough free space (> low mark), wake Tx queue.
4696  *
4697  * @note Need to protect against garbage in 'R' index
4698  * @param priv
4699  * @param txq
4700  * @param qindex
4701  * @return Number of used entries remains in the queue
4702  */
4703 static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
4704                                 struct clx2_tx_queue *txq, int qindex)
4705 {
4706         u32 hw_tail;
4707         int used;
4708         struct clx2_queue *q = &txq->q;
4709
4710         hw_tail = ipw_read32(priv, q->reg_r);
4711         if (hw_tail >= q->n_bd) {
4712                 IPW_ERROR
4713                     ("Read index for DMA queue (%d) is out of range [0-%d)\n",
4714                      hw_tail, q->n_bd);
4715                 goto done;
4716         }
4717         for (; q->last_used != hw_tail;
4718              q->last_used = ipw_queue_inc_wrap(q->last_used, q->n_bd)) {
4719                 ipw_queue_tx_free_tfd(priv, txq);
4720                 priv->tx_packets++;
4721         }
4722       done:
4723         if ((ipw_queue_space(q) > q->low_mark) &&
4724             (qindex >= 0) &&
4725             (priv->status & STATUS_ASSOCIATED) && netif_running(priv->net_dev))
4726                 netif_wake_queue(priv->net_dev);
4727         used = q->first_empty - q->last_used;
4728         if (used < 0)
4729                 used += q->n_bd;
4730
4731         return used;
4732 }
4733
4734 static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
4735                              int len, int sync)
4736 {
4737         struct clx2_tx_queue *txq = &priv->txq_cmd;
4738         struct clx2_queue *q = &txq->q;
4739         struct tfd_frame *tfd;
4740
4741         if (ipw_queue_space(q) < (sync ? 1 : 2)) {
4742                 IPW_ERROR("No space for Tx\n");
4743                 return -EBUSY;
4744         }
4745
4746         tfd = &txq->bd[q->first_empty];
4747         txq->txb[q->first_empty] = NULL;
4748
4749         memset(tfd, 0, sizeof(*tfd));
4750         tfd->control_flags.message_type = TX_HOST_COMMAND_TYPE;
4751         tfd->control_flags.control_bits = TFD_NEED_IRQ_MASK;
4752         priv->hcmd_seq++;
4753         tfd->u.cmd.index = hcmd;
4754         tfd->u.cmd.length = len;
4755         memcpy(tfd->u.cmd.payload, buf, len);
4756         q->first_empty = ipw_queue_inc_wrap(q->first_empty, q->n_bd);
4757         ipw_write32(priv, q->reg_w, q->first_empty);
4758         _ipw_read32(priv, 0x90);
4759
4760         return 0;
4761 }
4762
4763 /*
4764  * Rx theory of operation
4765  *
4766  * The host allocates 32 DMA target addresses and passes the host address
4767  * to the firmware at register IPW_RFDS_TABLE_LOWER + N * RFD_SIZE where N is
4768  * 0 to 31
4769  *
4770  * Rx Queue Indexes
4771  * The host/firmware share two index registers for managing the Rx buffers.
4772  *
4773  * The READ index maps to the first position that the firmware may be writing
4774  * to -- the driver can read up to (but not including) this position and get
4775  * good data.
4776  * The READ index is managed by the firmware once the card is enabled.
4777  *
4778  * The WRITE index maps to the last position the driver has read from -- the
4779  * position preceding WRITE is the last slot the firmware can place a packet.
4780  *
4781  * The queue is empty (no good data) if WRITE = READ - 1, and is full if
4782  * WRITE = READ.
4783  *
4784  * During initialization the host sets up the READ queue position to the first
4785  * INDEX position, and WRITE to the last (READ - 1 wrapped)
4786  *
4787  * When the firmware places a packet in a buffer it will advance the READ index
4788  * and fire the RX interrupt.  The driver can then query the READ index and
4789  * process as many packets as possible, moving the WRITE index forward as it
4790  * resets the Rx queue buffers with new memory.
4791  *
4792  * The management in the driver is as follows:
4793  * + A list of pre-allocated SKBs is stored in ipw->rxq->rx_free.  When
4794  *   ipw->rxq->free_count drops to or below RX_LOW_WATERMARK, work is scheduled
4795  *   to replensish the ipw->rxq->rx_free.
4796  * + In ipw_rx_queue_replenish (scheduled) if 'processed' != 'read' then the
4797  *   ipw->rxq is replenished and the READ INDEX is updated (updating the
4798  *   'processed' and 'read' driver indexes as well)
4799  * + A received packet is processed and handed to the kernel network stack,
4800  *   detached from the ipw->rxq.  The driver 'processed' index is updated.
4801  * + The Host/Firmware ipw->rxq is replenished at tasklet time from the rx_free
4802  *   list. If there are no allocated buffers in ipw->rxq->rx_free, the READ
4803  *   INDEX is not incremented and ipw->status(RX_STALLED) is set.  If there
4804  *   were enough free buffers and RX_STALLED is set it is cleared.
4805  *
4806  *
4807  * Driver sequence:
4808  *
4809  * ipw_rx_queue_alloc()       Allocates rx_free
4810  * ipw_rx_queue_replenish()   Replenishes rx_free list from rx_used, and calls
4811  *                            ipw_rx_queue_restock
4812  * ipw_rx_queue_restock()     Moves available buffers from rx_free into Rx
4813  *                            queue, updates firmware pointers, and updates
4814  *                            the WRITE index.  If insufficient rx_free buffers
4815  *                            are available, schedules ipw_rx_queue_replenish
4816  *
4817  * -- enable interrupts --
4818  * ISR - ipw_rx()             Detach ipw_rx_mem_buffers from pool up to the
4819  *                            READ INDEX, detaching the SKB from the pool.
4820  *                            Moves the packet buffer from queue to rx_used.
4821  *                            Calls ipw_rx_queue_restock to refill any empty
4822  *                            slots.
4823  * ...
4824  *
4825  */
4826
4827 /*
4828  * If there are slots in the RX queue that  need to be restocked,
4829  * and we have free pre-allocated buffers, fill the ranks as much
4830  * as we can pulling from rx_free.
4831  *
4832  * This moves the 'write' index forward to catch up with 'processed', and
4833  * also updates the memory address in the firmware to reference the new
4834  * target buffer.
4835  */
4836 static void ipw_rx_queue_restock(struct ipw_priv *priv)
4837 {
4838         struct ipw_rx_queue *rxq = priv->rxq;
4839         struct list_head *element;
4840         struct ipw_rx_mem_buffer *rxb;
4841         unsigned long flags;
4842         int write;
4843
4844         spin_lock_irqsave(&rxq->lock, flags);
4845         write = rxq->write;
4846         while ((rxq->write != rxq->processed) && (rxq->free_count)) {
4847                 element = rxq->rx_free.next;
4848                 rxb = list_entry(element, struct ipw_rx_mem_buffer, list);
4849                 list_del(element);
4850
4851                 ipw_write32(priv, IPW_RFDS_TABLE_LOWER + rxq->write * RFD_SIZE,
4852                             rxb->dma_addr);
4853                 rxq->queue[rxq->write] = rxb;
4854                 rxq->write = (rxq->write + 1) % RX_QUEUE_SIZE;
4855                 rxq->free_count--;
4856         }
4857         spin_unlock_irqrestore(&rxq->lock, flags);
4858
4859         /* If the pre-allocated buffer pool is dropping low, schedule to
4860          * refill it */
4861         if (rxq->free_count <= RX_LOW_WATERMARK)
4862                 queue_work(priv->workqueue, &priv->rx_replenish);
4863
4864         /* If we've added more space for the firmware to place data, tell it */
4865         if (write != rxq->write)
4866                 ipw_write32(priv, IPW_RX_WRITE_INDEX, rxq->write);
4867 }
4868
4869 /*
4870  * Move all used packet from rx_used to rx_free, allocating a new SKB for each.
4871  * Also restock the Rx queue via ipw_rx_queue_restock.
4872  *
4873  * This is called as a scheduled work item (except for during intialization)
4874  */
4875 static void ipw_rx_queue_replenish(void *data)
4876 {
4877         struct ipw_priv *priv = data;
4878         struct ipw_rx_queue *rxq = priv->rxq;
4879         struct list_head *element;
4880         struct ipw_rx_mem_buffer *rxb;
4881         unsigned long flags;
4882
4883         spin_lock_irqsave(&rxq->lock, flags);
4884         while (!list_empty(&rxq->rx_used)) {
4885                 element = rxq->rx_used.next;
4886                 rxb = list_entry(element, struct ipw_rx_mem_buffer, list);
4887                 rxb->skb = alloc_skb(IPW_RX_BUF_SIZE, GFP_ATOMIC);
4888                 if (!rxb->skb) {
4889                         printk(KERN_CRIT "%s: Can not allocate SKB buffers.\n",
4890                                priv->net_dev->name);
4891                         /* We don't reschedule replenish work here -- we will
4892                          * call the restock method and if it still needs
4893                          * more buffers it will schedule replenish */
4894                         break;
4895                 }
4896                 list_del(element);
4897
4898                 rxb->rxb = (struct ipw_rx_buffer *)rxb->skb->data;
4899                 rxb->dma_addr =
4900                     pci_map_single(priv->pci_dev, rxb->skb->data,
4901                                    IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
4902
4903                 list_add_tail(&rxb->list, &rxq->rx_free);
4904                 rxq->free_count++;
4905         }
4906         spin_unlock_irqrestore(&rxq->lock, flags);
4907
4908         ipw_rx_queue_restock(priv);
4909 }
4910
4911 static void ipw_bg_rx_queue_replenish(void *data)
4912 {
4913         struct ipw_priv *priv = data;
4914         down(&priv->sem);
4915         ipw_rx_queue_replenish(data);
4916         up(&priv->sem);
4917 }
4918
4919 /* Assumes that the skb field of the buffers in 'pool' is kept accurate.
4920  * If an SKB has been detached, the POOL needs to have it's SKB set to NULL
4921  * This free routine walks the list of POOL entries and if SKB is set to
4922  * non NULL it is unmapped and freed
4923  */
4924 static void ipw_rx_queue_free(struct ipw_priv *priv, struct ipw_rx_queue *rxq)
4925 {
4926         int i;
4927
4928         if (!rxq)
4929                 return;
4930
4931         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
4932                 if (rxq->pool[i].skb != NULL) {
4933                         pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
4934                                          IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
4935                         dev_kfree_skb(rxq->pool[i].skb);
4936                 }
4937         }
4938
4939         kfree(rxq);
4940 }
4941
4942 static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *priv)
4943 {
4944         struct ipw_rx_queue *rxq;
4945         int i;
4946
4947         rxq = kzalloc(sizeof(*rxq), GFP_KERNEL);
4948         if (unlikely(!rxq)) {
4949                 IPW_ERROR("memory allocation failed\n");
4950                 return NULL;
4951         }
4952         spin_lock_init(&rxq->lock);
4953         INIT_LIST_HEAD(&rxq->rx_free);
4954         INIT_LIST_HEAD(&rxq->rx_used);
4955
4956         /* Fill the rx_used queue with _all_ of the Rx buffers */
4957         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++)
4958                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
4959
4960         /* Set us so that we have processed and used all buffers, but have
4961          * not restocked the Rx queue with fresh buffers */
4962         rxq->read = rxq->write = 0;
4963         rxq->processed = RX_QUEUE_SIZE - 1;
4964         rxq->free_count = 0;
4965
4966         return rxq;
4967 }
4968
4969 static int ipw_is_rate_in_mask(struct ipw_priv *priv, int ieee_mode, u8 rate)
4970 {
4971         rate &= ~IEEE80211_BASIC_RATE_MASK;
4972         if (ieee_mode == IEEE_A) {
4973                 switch (rate) {
4974                 case IEEE80211_OFDM_RATE_6MB:
4975                         return priv->rates_mask & IEEE80211_OFDM_RATE_6MB_MASK ?
4976                             1 : 0;
4977                 case IEEE80211_OFDM_RATE_9MB:
4978                         return priv->rates_mask & IEEE80211_OFDM_RATE_9MB_MASK ?
4979                             1 : 0;
4980                 case IEEE80211_OFDM_RATE_12MB:
4981                         return priv->
4982                             rates_mask & IEEE80211_OFDM_RATE_12MB_MASK ? 1 : 0;
4983                 case IEEE80211_OFDM_RATE_18MB:
4984                         return priv->
4985                             rates_mask & IEEE80211_OFDM_RATE_18MB_MASK ? 1 : 0;
4986                 case IEEE80211_OFDM_RATE_24MB:
4987                         return priv->
4988                             rates_mask & IEEE80211_OFDM_RATE_24MB_MASK ? 1 : 0;
4989                 case IEEE80211_OFDM_RATE_36MB:
4990                         return priv->
4991                             rates_mask & IEEE80211_OFDM_RATE_36MB_MASK ? 1 : 0;
4992                 case IEEE80211_OFDM_RATE_48MB:
4993                         return priv->
4994                             rates_mask & IEEE80211_OFDM_RATE_48MB_MASK ? 1 : 0;
4995                 case IEEE80211_OFDM_RATE_54MB:
4996                         return priv->
4997                             rates_mask & IEEE80211_OFDM_RATE_54MB_MASK ? 1 : 0;
4998                 default:
4999                         return 0;
5000                 }
5001         }
5002
5003         /* B and G mixed */
5004         switch (rate) {
5005         case IEEE80211_CCK_RATE_1MB:
5006                 return priv->rates_mask & IEEE80211_CCK_RATE_1MB_MASK ? 1 : 0;
5007         case IEEE80211_CCK_RATE_2MB:
5008                 return priv->rates_mask & IEEE80211_CCK_RATE_2MB_MASK ? 1 : 0;
5009         case IEEE80211_CCK_RATE_5MB:
5010                 return priv->rates_mask & IEEE80211_CCK_RATE_5MB_MASK ? 1 : 0;
5011         case IEEE80211_CCK_RATE_11MB:
5012                 return priv->rates_mask & IEEE80211_CCK_RATE_11MB_MASK ? 1 : 0;
5013         }
5014
5015         /* If we are limited to B modulations, bail at this point */
5016         if (ieee_mode == IEEE_B)
5017                 return 0;
5018
5019         /* G */
5020         switch (rate) {
5021         case IEEE80211_OFDM_RATE_6MB:
5022                 return priv->rates_mask & IEEE80211_OFDM_RATE_6MB_MASK ? 1 : 0;
5023         case IEEE80211_OFDM_RATE_9MB:
5024                 return priv->rates_mask & IEEE80211_OFDM_RATE_9MB_MASK ? 1 : 0;
5025         case IEEE80211_OFDM_RATE_12MB:
5026                 return priv->rates_mask & IEEE80211_OFDM_RATE_12MB_MASK ? 1 : 0;
5027         case IEEE80211_OFDM_RATE_18MB:
5028                 return priv->rates_mask & IEEE80211_OFDM_RATE_18MB_MASK ? 1 : 0;
5029         case IEEE80211_OFDM_RATE_24MB:
5030                 return priv->rates_mask & IEEE80211_OFDM_RATE_24MB_MASK ? 1 : 0;
5031         case IEEE80211_OFDM_RATE_36MB:
5032                 return priv->rates_mask & IEEE80211_OFDM_RATE_36MB_MASK ? 1 : 0;
5033         case IEEE80211_OFDM_RATE_48MB:
5034                 return priv->rates_mask & IEEE80211_OFDM_RATE_48MB_MASK ? 1 : 0;
5035         case IEEE80211_OFDM_RATE_54MB:
5036                 return priv->rates_mask & IEEE80211_OFDM_RATE_54MB_MASK ? 1 : 0;
5037         }
5038
5039         return 0;
5040 }
5041
5042 static int ipw_compatible_rates(struct ipw_priv *priv,
5043                                 const struct ieee80211_network *network,
5044                                 struct ipw_supported_rates *rates)
5045 {
5046         int num_rates, i;
5047
5048         memset(rates, 0, sizeof(*rates));
5049         num_rates = min(network->rates_len, (u8) IPW_MAX_RATES);
5050         rates->num_rates = 0;
5051         for (i = 0; i < num_rates; i++) {
5052                 if (!ipw_is_rate_in_mask(priv, network->mode,
5053                                          network->rates[i])) {
5054
5055                         if (network->rates[i] & IEEE80211_BASIC_RATE_MASK) {
5056                                 IPW_DEBUG_SCAN("Adding masked mandatory "
5057                                                "rate %02X\n",
5058                                                network->rates[i]);
5059                                 rates->supported_rates[rates->num_rates++] =
5060                                     network->rates[i];
5061                                 continue;
5062                         }
5063
5064                         IPW_DEBUG_SCAN("Rate %02X masked : 0x%08X\n",
5065                                        network->rates[i], priv->rates_mask);
5066                         continue;
5067                 }
5068
5069                 rates->supported_rates[rates->num_rates++] = network->rates[i];
5070         }
5071
5072         num_rates = min(network->rates_ex_len,
5073                         (u8) (IPW_MAX_RATES - num_rates));
5074         for (i = 0; i < num_rates; i++) {
5075                 if (!ipw_is_rate_in_mask(priv, network->mode,
5076                                          network->rates_ex[i])) {
5077                         if (network->rates_ex[i] & IEEE80211_BASIC_RATE_MASK) {
5078                                 IPW_DEBUG_SCAN("Adding masked mandatory "
5079                                                "rate %02X\n",
5080                                                network->rates_ex[i]);
5081                                 rates->supported_rates[rates->num_rates++] =
5082                                     network->rates[i];
5083                                 continue;
5084                         }
5085
5086                         IPW_DEBUG_SCAN("Rate %02X masked : 0x%08X\n",
5087                                        network->rates_ex[i], priv->rates_mask);
5088                         continue;
5089                 }
5090
5091                 rates->supported_rates[rates->num_rates++] =
5092                     network->rates_ex[i];
5093         }
5094
5095         return 1;
5096 }
5097
5098 static void ipw_copy_rates(struct ipw_supported_rates *dest,
5099                                   const struct ipw_supported_rates *src)
5100 {
5101         u8 i;
5102         for (i = 0; i < src->num_rates; i++)
5103                 dest->supported_rates[i] = src->supported_rates[i];
5104         dest->num_rates = src->num_rates;
5105 }
5106
5107 /* TODO: Look at sniffed packets in the air to determine if the basic rate
5108  * mask should ever be used -- right now all callers to add the scan rates are
5109  * set with the modulation = CCK, so BASIC_RATE_MASK is never set... */
5110 static void ipw_add_cck_scan_rates(struct ipw_supported_rates *rates,
5111                                    u8 modulation, u32 rate_mask)
5112 {
5113         u8 basic_mask = (IEEE80211_OFDM_MODULATION == modulation) ?
5114             IEEE80211_BASIC_RATE_MASK : 0;
5115
5116         if (rate_mask & IEEE80211_CCK_RATE_1MB_MASK)
5117                 rates->supported_rates[rates->num_rates++] =
5118                     IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
5119
5120         if (rate_mask & IEEE80211_CCK_RATE_2MB_MASK)
5121                 rates->supported_rates[rates->num_rates++] =
5122                     IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
5123
5124         if (rate_mask & IEEE80211_CCK_RATE_5MB_MASK)
5125                 rates->supported_rates[rates->num_rates++] = basic_mask |
5126                     IEEE80211_CCK_RATE_5MB;
5127
5128         if (rate_mask & IEEE80211_CCK_RATE_11MB_MASK)
5129                 rates->supported_rates[rates->num_rates++] = basic_mask |
5130                     IEEE80211_CCK_RATE_11MB;
5131 }
5132
5133 static void ipw_add_ofdm_scan_rates(struct ipw_supported_rates *rates,
5134                                     u8 modulation, u32 rate_mask)
5135 {
5136         u8 basic_mask = (IEEE80211_OFDM_MODULATION == modulation) ?
5137             IEEE80211_BASIC_RATE_MASK : 0;
5138
5139         if (rate_mask & IEEE80211_OFDM_RATE_6MB_MASK)
5140                 rates->supported_rates[rates->num_rates++] = basic_mask |
5141                     IEEE80211_OFDM_RATE_6MB;
5142
5143         if (rate_mask & IEEE80211_OFDM_RATE_9MB_MASK)
5144                 rates->supported_rates[rates->num_rates++] =
5145                     IEEE80211_OFDM_RATE_9MB;
5146
5147         if (rate_mask & IEEE80211_OFDM_RATE_12MB_MASK)
5148                 rates->supported_rates[rates->num_rates++] = basic_mask |
5149                     IEEE80211_OFDM_RATE_12MB;
5150
5151         if (rate_mask & IEEE80211_OFDM_RATE_18MB_MASK)
5152                 rates->supported_rates[rates->num_rates++] =
5153                     IEEE80211_OFDM_RATE_18MB;
5154
5155         if (rate_mask & IEEE80211_OFDM_RATE_24MB_MASK)
5156                 rates->supported_rates[rates->num_rates++] = basic_mask |
5157                     IEEE80211_OFDM_RATE_24MB;
5158
5159         if (rate_mask & IEEE80211_OFDM_RATE_36MB_MASK)
5160                 rates->supported_rates[rates->num_rates++] =
5161                     IEEE80211_OFDM_RATE_36MB;
5162
5163         if (rate_mask & IEEE80211_OFDM_RATE_48MB_MASK)
5164                 rates->supported_rates[rates->num_rates++] =
5165                     IEEE80211_OFDM_RATE_48MB;
5166
5167         if (rate_mask & IEEE80211_OFDM_RATE_54MB_MASK)
5168                 rates->supported_rates[rates->num_rates++] =
5169                     IEEE80211_OFDM_RATE_54MB;
5170 }
5171
5172 struct ipw_network_match {
5173         struct ieee80211_network *network;
5174         struct ipw_supported_rates rates;
5175 };
5176
5177 static int ipw_find_adhoc_network(struct ipw_priv *priv,
5178                                   struct ipw_network_match *match,
5179                                   struct ieee80211_network *network,
5180                                   int roaming)
5181 {
5182         struct ipw_supported_rates rates;
5183
5184         /* Verify that this network's capability is compatible with the
5185          * current mode (AdHoc or Infrastructure) */
5186         if ((priv->ieee->iw_mode == IW_MODE_ADHOC &&
5187              !(network->capability & WLAN_CAPABILITY_IBSS))) {
5188                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded due to "
5189                                 "capability mismatch.\n",
5190                                 escape_essid(network->ssid, network->ssid_len),
5191                                 MAC_ARG(network->bssid));
5192                 return 0;
5193         }
5194
5195         /* If we do not have an ESSID for this AP, we can not associate with
5196          * it */
5197         if (network->flags & NETWORK_EMPTY_ESSID) {
5198                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5199                                 "because of hidden ESSID.\n",
5200                                 escape_essid(network->ssid, network->ssid_len),
5201                                 MAC_ARG(network->bssid));
5202                 return 0;
5203         }
5204
5205         if (unlikely(roaming)) {
5206                 /* If we are roaming, then ensure check if this is a valid
5207                  * network to try and roam to */
5208                 if ((network->ssid_len != match->network->ssid_len) ||
5209                     memcmp(network->ssid, match->network->ssid,
5210                            network->ssid_len)) {
5211                         IPW_DEBUG_MERGE("Netowrk '%s (" MAC_FMT ")' excluded "
5212                                         "because of non-network ESSID.\n",
5213                                         escape_essid(network->ssid,
5214                                                      network->ssid_len),
5215                                         MAC_ARG(network->bssid));
5216                         return 0;
5217                 }
5218         } else {
5219                 /* If an ESSID has been configured then compare the broadcast
5220                  * ESSID to ours */
5221                 if ((priv->config & CFG_STATIC_ESSID) &&
5222                     ((network->ssid_len != priv->essid_len) ||
5223                      memcmp(network->ssid, priv->essid,
5224                             min(network->ssid_len, priv->essid_len)))) {
5225                         char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
5226
5227                         strncpy(escaped,
5228                                 escape_essid(network->ssid, network->ssid_len),
5229                                 sizeof(escaped));
5230                         IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5231                                         "because of ESSID mismatch: '%s'.\n",
5232                                         escaped, MAC_ARG(network->bssid),
5233                                         escape_essid(priv->essid,
5234                                                      priv->essid_len));
5235                         return 0;
5236                 }
5237         }
5238
5239         /* If the old network rate is better than this one, don't bother
5240          * testing everything else. */
5241
5242         if (network->time_stamp[0] < match->network->time_stamp[0]) {
5243                 IPW_DEBUG_MERGE("Network '%s excluded because newer than "
5244                                 "current network.\n",
5245                                 escape_essid(match->network->ssid,
5246                                              match->network->ssid_len));
5247                 return 0;
5248         } else if (network->time_stamp[1] < match->network->time_stamp[1]) {
5249                 IPW_DEBUG_MERGE("Network '%s excluded because newer than "
5250                                 "current network.\n",
5251                                 escape_essid(match->network->ssid,
5252                                              match->network->ssid_len));
5253                 return 0;
5254         }
5255
5256         /* Now go through and see if the requested network is valid... */
5257         if (priv->ieee->scan_age != 0 &&
5258             time_after(jiffies, network->last_scanned + priv->ieee->scan_age)) {
5259                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5260                                 "because of age: %lums.\n",
5261                                 escape_essid(network->ssid, network->ssid_len),
5262                                 MAC_ARG(network->bssid),
5263                                 1000 * (jiffies - network->last_scanned) / HZ);
5264                 return 0;
5265         }
5266
5267         if ((priv->config & CFG_STATIC_CHANNEL) &&
5268             (network->channel != priv->channel)) {
5269                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5270                                 "because of channel mismatch: %d != %d.\n",
5271                                 escape_essid(network->ssid, network->ssid_len),
5272                                 MAC_ARG(network->bssid),
5273                                 network->channel, priv->channel);
5274                 return 0;
5275         }
5276
5277         /* Verify privacy compatability */
5278         if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
5279             ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
5280                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5281                                 "because of privacy mismatch: %s != %s.\n",
5282                                 escape_essid(network->ssid, network->ssid_len),
5283                                 MAC_ARG(network->bssid),
5284                                 priv->
5285                                 capability & CAP_PRIVACY_ON ? "on" : "off",
5286                                 network->
5287                                 capability & WLAN_CAPABILITY_PRIVACY ? "on" :
5288                                 "off");
5289                 return 0;
5290         }
5291
5292         if (!memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
5293                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5294                                 "because of the same BSSID match: " MAC_FMT
5295                                 ".\n", escape_essid(network->ssid,
5296                                                     network->ssid_len),
5297                                 MAC_ARG(network->bssid), MAC_ARG(priv->bssid));
5298                 return 0;
5299         }
5300
5301         /* Filter out any incompatible freq / mode combinations */
5302         if (!ieee80211_is_valid_mode(priv->ieee, network->mode)) {
5303                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5304                                 "because of invalid frequency/mode "
5305                                 "combination.\n",
5306                                 escape_essid(network->ssid, network->ssid_len),
5307                                 MAC_ARG(network->bssid));
5308                 return 0;
5309         }
5310
5311         /* Ensure that the rates supported by the driver are compatible with
5312          * this AP, including verification of basic rates (mandatory) */
5313         if (!ipw_compatible_rates(priv, network, &rates)) {
5314                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5315                                 "because configured rate mask excludes "
5316                                 "AP mandatory rate.\n",
5317                                 escape_essid(network->ssid, network->ssid_len),
5318                                 MAC_ARG(network->bssid));
5319                 return 0;
5320         }
5321
5322         if (rates.num_rates == 0) {
5323                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5324                                 "because of no compatible rates.\n",
5325                                 escape_essid(network->ssid, network->ssid_len),
5326                                 MAC_ARG(network->bssid));
5327                 return 0;
5328         }
5329
5330         /* TODO: Perform any further minimal comparititive tests.  We do not
5331          * want to put too much policy logic here; intelligent scan selection
5332          * should occur within a generic IEEE 802.11 user space tool.  */
5333
5334         /* Set up 'new' AP to this network */
5335         ipw_copy_rates(&match->rates, &rates);
5336         match->network = network;
5337         IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' is a viable match.\n",
5338                         escape_essid(network->ssid, network->ssid_len),
5339                         MAC_ARG(network->bssid));
5340
5341         return 1;
5342 }
5343
5344 static void ipw_merge_adhoc_network(void *data)
5345 {
5346         struct ipw_priv *priv = data;
5347         struct ieee80211_network *network = NULL;
5348         struct ipw_network_match match = {
5349                 .network = priv->assoc_network
5350         };
5351
5352         if ((priv->status & STATUS_ASSOCIATED) &&
5353             (priv->ieee->iw_mode == IW_MODE_ADHOC)) {
5354                 /* First pass through ROAM process -- look for a better
5355                  * network */
5356                 unsigned long flags;
5357
5358                 spin_lock_irqsave(&priv->ieee->lock, flags);
5359                 list_for_each_entry(network, &priv->ieee->network_list, list) {
5360                         if (network != priv->assoc_network)
5361                                 ipw_find_adhoc_network(priv, &match, network,
5362                                                        1);
5363                 }
5364                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
5365
5366                 if (match.network == priv->assoc_network) {
5367                         IPW_DEBUG_MERGE("No better ADHOC in this network to "
5368                                         "merge to.\n");
5369                         return;
5370                 }
5371
5372                 down(&priv->sem);
5373                 if ((priv->ieee->iw_mode == IW_MODE_ADHOC)) {
5374                         IPW_DEBUG_MERGE("remove network %s\n",
5375                                         escape_essid(priv->essid,
5376                                                      priv->essid_len));
5377                         ipw_remove_current_network(priv);
5378                 }
5379
5380                 ipw_disassociate(priv);
5381                 priv->assoc_network = match.network;
5382                 up(&priv->sem);
5383                 return;
5384         }
5385 }
5386
5387 static int ipw_best_network(struct ipw_priv *priv,
5388                             struct ipw_network_match *match,
5389                             struct ieee80211_network *network, int roaming)
5390 {
5391         struct ipw_supported_rates rates;
5392
5393         /* Verify that this network's capability is compatible with the
5394          * current mode (AdHoc or Infrastructure) */
5395         if ((priv->ieee->iw_mode == IW_MODE_INFRA &&
5396              !(network->capability & WLAN_CAPABILITY_ESS)) ||
5397             (priv->ieee->iw_mode == IW_MODE_ADHOC &&
5398              !(network->capability & WLAN_CAPABILITY_IBSS))) {
5399                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded due to "
5400                                 "capability mismatch.\n",
5401                                 escape_essid(network->ssid, network->ssid_len),
5402                                 MAC_ARG(network->bssid));
5403                 return 0;
5404         }
5405
5406         /* If we do not have an ESSID for this AP, we can not associate with
5407          * it */
5408         if (network->flags & NETWORK_EMPTY_ESSID) {
5409                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5410                                 "because of hidden ESSID.\n",
5411                                 escape_essid(network->ssid, network->ssid_len),
5412                                 MAC_ARG(network->bssid));
5413                 return 0;
5414         }
5415
5416         if (unlikely(roaming)) {
5417                 /* If we are roaming, then ensure check if this is a valid
5418                  * network to try and roam to */
5419                 if ((network->ssid_len != match->network->ssid_len) ||
5420                     memcmp(network->ssid, match->network->ssid,
5421                            network->ssid_len)) {
5422                         IPW_DEBUG_ASSOC("Netowrk '%s (" MAC_FMT ")' excluded "
5423                                         "because of non-network ESSID.\n",
5424                                         escape_essid(network->ssid,
5425                                                      network->ssid_len),
5426                                         MAC_ARG(network->bssid));
5427                         return 0;
5428                 }
5429         } else {
5430                 /* If an ESSID has been configured then compare the broadcast
5431                  * ESSID to ours */
5432                 if ((priv->config & CFG_STATIC_ESSID) &&
5433                     ((network->ssid_len != priv->essid_len) ||
5434                      memcmp(network->ssid, priv->essid,
5435                             min(network->ssid_len, priv->essid_len)))) {
5436                         char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
5437                         strncpy(escaped,
5438                                 escape_essid(network->ssid, network->ssid_len),
5439                                 sizeof(escaped));
5440                         IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5441                                         "because of ESSID mismatch: '%s'.\n",
5442                                         escaped, MAC_ARG(network->bssid),
5443                                         escape_essid(priv->essid,
5444                                                      priv->essid_len));
5445                         return 0;
5446                 }
5447         }
5448
5449         /* If the old network rate is better than this one, don't bother
5450          * testing everything else. */
5451         if (match->network && match->network->stats.rssi > network->stats.rssi) {
5452                 char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
5453                 strncpy(escaped,
5454                         escape_essid(network->ssid, network->ssid_len),
5455                         sizeof(escaped));
5456                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded because "
5457                                 "'%s (" MAC_FMT ")' has a stronger signal.\n",
5458                                 escaped, MAC_ARG(network->bssid),
5459                                 escape_essid(match->network->ssid,
5460                                              match->network->ssid_len),
5461                                 MAC_ARG(match->network->bssid));
5462                 return 0;
5463         }
5464
5465         /* If this network has already had an association attempt within the
5466          * last 3 seconds, do not try and associate again... */
5467         if (network->last_associate &&
5468             time_after(network->last_associate + (HZ * 3UL), jiffies)) {
5469                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5470                                 "because of storming (%lus since last "
5471                                 "assoc attempt).\n",
5472                                 escape_essid(network->ssid, network->ssid_len),
5473                                 MAC_ARG(network->bssid),
5474                                 (jiffies - network->last_associate) / HZ);
5475                 return 0;
5476         }
5477
5478         /* Now go through and see if the requested network is valid... */
5479         if (priv->ieee->scan_age != 0 &&
5480             time_after(jiffies, network->last_scanned + priv->ieee->scan_age)) {
5481                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5482                                 "because of age: %lums.\n",
5483                                 escape_essid(network->ssid, network->ssid_len),
5484                                 MAC_ARG(network->bssid),
5485                                 1000 * (jiffies - network->last_scanned) / HZ);
5486                 return 0;
5487         }
5488
5489         if ((priv->config & CFG_STATIC_CHANNEL) &&
5490             (network->channel != priv->channel)) {
5491                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5492                                 "because of channel mismatch: %d != %d.\n",
5493                                 escape_essid(network->ssid, network->ssid_len),
5494                                 MAC_ARG(network->bssid),
5495                                 network->channel, priv->channel);
5496                 return 0;
5497         }
5498
5499         /* Verify privacy compatability */
5500         if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
5501             ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
5502                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5503                                 "because of privacy mismatch: %s != %s.\n",
5504                                 escape_essid(network->ssid, network->ssid_len),
5505                                 MAC_ARG(network->bssid),
5506                                 priv->capability & CAP_PRIVACY_ON ? "on" :
5507                                 "off",
5508                                 network->capability &
5509                                 WLAN_CAPABILITY_PRIVACY ? "on" : "off");
5510                 return 0;
5511         }
5512
5513         if (!priv->ieee->wpa_enabled && (network->wpa_ie_len > 0 ||
5514                                          network->rsn_ie_len > 0)) {
5515                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5516                                 "because of WPA capability mismatch.\n",
5517                                 escape_essid(network->ssid, network->ssid_len),
5518                                 MAC_ARG(network->bssid));
5519                 return 0;
5520         }
5521
5522         if ((priv->config & CFG_STATIC_BSSID) &&
5523             memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
5524                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5525                                 "because of BSSID mismatch: " MAC_FMT ".\n",
5526                                 escape_essid(network->ssid, network->ssid_len),
5527                                 MAC_ARG(network->bssid), MAC_ARG(priv->bssid));
5528                 return 0;
5529         }
5530
5531         /* Filter out any incompatible freq / mode combinations */
5532         if (!ieee80211_is_valid_mode(priv->ieee, network->mode)) {
5533                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5534                                 "because of invalid frequency/mode "
5535                                 "combination.\n",
5536                                 escape_essid(network->ssid, network->ssid_len),
5537                                 MAC_ARG(network->bssid));
5538                 return 0;
5539         }
5540
5541         /* Filter out invalid channel in current GEO */
5542         if (!ipw_is_valid_channel(priv->ieee, network->channel)) {
5543                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5544                                 "because of invalid channel in current GEO\n",
5545                                 escape_essid(network->ssid, network->ssid_len),
5546                                 MAC_ARG(network->bssid));
5547                 return 0;
5548         }
5549
5550         /* Ensure that the rates supported by the driver are compatible with
5551          * this AP, including verification of basic rates (mandatory) */
5552         if (!ipw_compatible_rates(priv, network, &rates)) {
5553                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5554                                 "because configured rate mask excludes "
5555                                 "AP mandatory rate.\n",
5556                                 escape_essid(network->ssid, network->ssid_len),
5557                                 MAC_ARG(network->bssid));
5558                 return 0;
5559         }
5560
5561         if (rates.num_rates == 0) {
5562                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5563                                 "because of no compatible rates.\n",
5564                                 escape_essid(network->ssid, network->ssid_len),
5565                                 MAC_ARG(network->bssid));
5566                 return 0;
5567         }
5568
5569         /* TODO: Perform any further minimal comparititive tests.  We do not
5570          * want to put too much policy logic here; intelligent scan selection
5571          * should occur within a generic IEEE 802.11 user space tool.  */
5572
5573         /* Set up 'new' AP to this network */
5574         ipw_copy_rates(&match->rates, &rates);
5575         match->network = network;
5576
5577         IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' is a viable match.\n",
5578                         escape_essid(network->ssid, network->ssid_len),
5579                         MAC_ARG(network->bssid));
5580
5581         return 1;
5582 }
5583
5584 static void ipw_adhoc_create(struct ipw_priv *priv,
5585                              struct ieee80211_network *network)
5586 {
5587         const struct ieee80211_geo *geo = ipw_get_geo(priv->ieee);
5588         int i;
5589
5590         /*
5591          * For the purposes of scanning, we can set our wireless mode
5592          * to trigger scans across combinations of bands, but when it
5593          * comes to creating a new ad-hoc network, we have tell the FW
5594          * exactly which band to use.
5595          *
5596          * We also have the possibility of an invalid channel for the
5597          * chossen band.  Attempting to create a new ad-hoc network
5598          * with an invalid channel for wireless mode will trigger a
5599          * FW fatal error.
5600          *
5601          */
5602         switch (ipw_is_valid_channel(priv->ieee, priv->channel)) {
5603         case IEEE80211_52GHZ_BAND:
5604                 network->mode = IEEE_A;
5605                 i = ipw_channel_to_index(priv->ieee, priv->channel);
5606                 if (i == -1)
5607                         BUG();
5608                 if (geo->a[i].flags & IEEE80211_CH_PASSIVE_ONLY) {
5609                         IPW_WARNING("Overriding invalid channel\n");
5610                         priv->channel = geo->a[0].channel;
5611                 }
5612                 break;
5613
5614         case IEEE80211_24GHZ_BAND:
5615                 if (priv->ieee->mode & IEEE_G)
5616                         network->mode = IEEE_G;
5617                 else
5618                         network->mode = IEEE_B;
5619                 i = ipw_channel_to_index(priv->ieee, priv->channel);
5620                 if (i == -1)
5621                         BUG();
5622                 if (geo->bg[i].flags & IEEE80211_CH_PASSIVE_ONLY) {
5623                         IPW_WARNING("Overriding invalid channel\n");
5624                         priv->channel = geo->bg[0].channel;
5625                 }
5626                 break;
5627
5628         default:
5629                 IPW_WARNING("Overriding invalid channel\n");
5630                 if (priv->ieee->mode & IEEE_A) {
5631                         network->mode = IEEE_A;
5632                         priv->channel = geo->a[0].channel;
5633                 } else if (priv->ieee->mode & IEEE_G) {
5634                         network->mode = IEEE_G;
5635                         priv->channel = geo->bg[0].channel;
5636                 } else {
5637                         network->mode = IEEE_B;
5638                         priv->channel = geo->bg[0].channel;
5639                 }
5640                 break;
5641         }
5642
5643         network->channel = priv->channel;
5644         priv->config |= CFG_ADHOC_PERSIST;
5645         ipw_create_bssid(priv, network->bssid);
5646         network->ssid_len = priv->essid_len;
5647         memcpy(network->ssid, priv->essid, priv->essid_len);
5648         memset(&network->stats, 0, sizeof(network->stats));
5649         network->capability = WLAN_CAPABILITY_IBSS;
5650         if (!(priv->config & CFG_PREAMBLE_LONG))
5651                 network->capability |= WLAN_CAPABILITY_SHORT_PREAMBLE;
5652         if (priv->capability & CAP_PRIVACY_ON)
5653                 network->capability |= WLAN_CAPABILITY_PRIVACY;
5654         network->rates_len = min(priv->rates.num_rates, MAX_RATES_LENGTH);
5655         memcpy(network->rates, priv->rates.supported_rates, network->rates_len);
5656         network->rates_ex_len = priv->rates.num_rates - network->rates_len;
5657         memcpy(network->rates_ex,
5658                &priv->rates.supported_rates[network->rates_len],
5659                network->rates_ex_len);
5660         network->last_scanned = 0;
5661         network->flags = 0;
5662         network->last_associate = 0;
5663         network->time_stamp[0] = 0;
5664         network->time_stamp[1] = 0;
5665         network->beacon_interval = 100; /* Default */
5666         network->listen_interval = 10;  /* Default */
5667         network->atim_window = 0;       /* Default */
5668         network->wpa_ie_len = 0;
5669         network->rsn_ie_len = 0;
5670 }
5671
5672 static void ipw_send_tgi_tx_key(struct ipw_priv *priv, int type, int index)
5673 {
5674         struct ipw_tgi_tx_key *key;
5675         struct host_cmd cmd = {
5676                 .cmd = IPW_CMD_TGI_TX_KEY,
5677                 .len = sizeof(*key)
5678         };
5679
5680         if (!(priv->ieee->sec.flags & (1 << index)))
5681                 return;
5682
5683         key = (struct ipw_tgi_tx_key *)&cmd.param;
5684         key->key_id = index;
5685         memcpy(key->key, priv->ieee->sec.keys[index], SCM_TEMPORAL_KEY_LENGTH);
5686         key->security_type = type;
5687         key->station_index = 0; /* always 0 for BSS */
5688         key->flags = 0;
5689         /* 0 for new key; previous value of counter (after fatal error) */
5690         key->tx_counter[0] = 0;
5691         key->tx_counter[1] = 0;
5692
5693         ipw_send_cmd(priv, &cmd);
5694 }
5695
5696 static void ipw_send_wep_keys(struct ipw_priv *priv, int type)
5697 {
5698         struct ipw_wep_key *key;
5699         int i;
5700         struct host_cmd cmd = {
5701                 .cmd = IPW_CMD_WEP_KEY,
5702                 .len = sizeof(*key)
5703         };
5704
5705         key = (struct ipw_wep_key *)&cmd.param;
5706         key->cmd_id = DINO_CMD_WEP_KEY;
5707         key->seq_num = 0;
5708
5709         /* Note: AES keys cannot be set for multiple times.
5710          * Only set it at the first time. */
5711         for (i = 0; i < 4; i++) {
5712                 key->key_index = i | type;
5713                 if (!(priv->ieee->sec.flags & (1 << i))) {
5714                         key->key_size = 0;
5715                         continue;
5716                 }
5717
5718                 key->key_size = priv->ieee->sec.key_sizes[i];
5719                 memcpy(key->key, priv->ieee->sec.keys[i], key->key_size);
5720
5721                 ipw_send_cmd(priv, &cmd);
5722         }
5723 }
5724
5725 static void ipw_set_hw_decrypt_unicast(struct ipw_priv *priv, int level)
5726 {
5727         if (priv->ieee->host_encrypt)
5728                 return;
5729
5730         switch (level) {
5731         case SEC_LEVEL_3:
5732                 priv->sys_config.disable_unicast_decryption = 0;
5733                 priv->ieee->host_decrypt = 0;
5734                 break;
5735         case SEC_LEVEL_2:
5736                 priv->sys_config.disable_unicast_decryption = 1;
5737                 priv->ieee->host_decrypt = 1;
5738                 break;
5739         case SEC_LEVEL_1:
5740                 priv->sys_config.disable_unicast_decryption = 0;
5741                 priv->ieee->host_decrypt = 0;
5742                 break;
5743         case SEC_LEVEL_0:
5744                 priv->sys_config.disable_unicast_decryption = 1;