drivers/net/wireless/ipw2100.c

   1 /******************************************************************************
   2
   3   Copyright(c) 2003 - 2005 Intel Corporation. All rights reserved.
   4
   5   This program is free software; you can redistribute it and/or modify it
   6   under the terms of version 2 of the GNU General Public License as
   7   published by the Free Software Foundation.
   8
   9   This program is distributed in the hope that it will be useful, but WITHOUT
  10   ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11   FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  12   more details.
  13
  14   You should have received a copy of the GNU General Public License along with
  15   this program; if not, write to the Free Software Foundation, Inc., 59
  16   Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  17
  18   The full GNU General Public License is included in this distribution in the
  19   file called LICENSE.
  20
  21   Contact Information:
  22   James P. Ketrenos <ipw2100-admin@linux.intel.com>
  23   Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  24
  25   Portions of this file are based on the sample_* files provided by Wireless
  26   Extensions 0.26 package and copyright (c) 1997-2003 Jean Tourrilhes
  27   <jt@hpl.hp.com>
  28
  29   Portions of this file are based on the Host AP project,
  30   Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
  31     <jkmaline@cc.hut.fi>
  32   Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
  33
  34   Portions of ipw2100_mod_firmware_load, ipw2100_do_mod_firmware_load, and
  35   ipw2100_fw_load are loosely based on drivers/sound/sound_firmware.c
  36   available in the 2.4.25 kernel sources, and are copyright (c) Alan Cox
  37
  38 ******************************************************************************/
  39 /*
  40
  41  Initial driver on which this is based was developed by Janusz Gorycki,
  42  Maciej Urbaniak, and Maciej Sosnowski.
  43
  44  Promiscuous mode support added by Jacek Wysoczynski and Maciej Urbaniak.
  45
  46 Theory of Operation
  47
  48 Tx - Commands and Data
  49
  50 Firmware and host share a circular queue of Transmit Buffer Descriptors (TBDs)
  51 Each TBD contains a pointer to the physical (dma_addr_t) address of data being
  52 sent to the firmware as well as the length of the data.
  53
  54 The host writes to the TBD queue at the WRITE index.  The WRITE index points
  55 to the _next_ packet to be written and is advanced when after the TBD has been
  56 filled.
  57
  58 The firmware pulls from the TBD queue at the READ index.  The READ index points
  59 to the currently being read entry, and is advanced once the firmware is
  60 done with a packet.
  61
  62 When data is sent to the firmware, the first TBD is used to indicate to the
  63 firmware if a Command or Data is being sent.  If it is Command, all of the
  64 command information is contained within the physical address referred to by the
  65 TBD.  If it is Data, the first TBD indicates the type of data packet, number
  66 of fragments, etc.  The next TBD then referrs to the actual packet location.
  67
  68 The Tx flow cycle is as follows:
  69
  70 1) ipw2100_tx() is called by kernel with SKB to transmit
  71 2) Packet is move from the tx_free_list and appended to the transmit pending
  72    list (tx_pend_list)
  73 3) work is scheduled to move pending packets into the shared circular queue.
  74 4) when placing packet in the circular queue, the incoming SKB is DMA mapped
  75    to a physical address.  That address is entered into a TBD.  Two TBDs are
  76    filled out.  The first indicating a data packet, the second referring to the
  77    actual payload data.
  78 5) the packet is removed from tx_pend_list and placed on the end of the
  79    firmware pending list (fw_pend_list)
  80 6) firmware is notified that the WRITE index has
  81 7) Once the firmware has processed the TBD, INTA is triggered.
  82 8) For each Tx interrupt received from the firmware, the READ index is checked
  83    to see which TBDs are done being processed.
  84 9) For each TBD that has been processed, the ISR pulls the oldest packet
  85    from the fw_pend_list.
  86 10)The packet structure contained in the fw_pend_list is then used
  87    to unmap the DMA address and to free the SKB originally passed to the driver
  88    from the kernel.
  89 11)The packet structure is placed onto the tx_free_list
  90
  91 The above steps are the same for commands, only the msg_free_list/msg_pend_list
  92 are used instead of tx_free_list/tx_pend_list
  93
  94 ...
  95
  96 Critical Sections / Locking :
  97
  98 There are two locks utilized.  The first is the low level lock (priv->low_lock)
  99 that protects the following:
 100
 101 - Access to the Tx/Rx queue lists via priv->low_lock. The lists are as follows:
 102
 103   tx_free_list : Holds pre-allocated Tx buffers.
 104     TAIL modified in __ipw2100_tx_process()
 105     HEAD modified in ipw2100_tx()
 106
 107   tx_pend_list : Holds used Tx buffers waiting to go into the TBD ring
 108     TAIL modified ipw2100_tx()
 109     HEAD modified by ipw2100_tx_send_data()
 110
 111   msg_free_list : Holds pre-allocated Msg (Command) buffers
 112     TAIL modified in __ipw2100_tx_process()
 113     HEAD modified in ipw2100_hw_send_command()
 114
 115   msg_pend_list : Holds used Msg buffers waiting to go into the TBD ring
 116     TAIL modified in ipw2100_hw_send_command()
 117     HEAD modified in ipw2100_tx_send_commands()
 118
 119   The flow of data on the TX side is as follows:
 120
 121   MSG_FREE_LIST + COMMAND => MSG_PEND_LIST => TBD => MSG_FREE_LIST
 122   TX_FREE_LIST + DATA => TX_PEND_LIST => TBD => TX_FREE_LIST
 123
 124   The methods that work on the TBD ring are protected via priv->low_lock.
 125
 126 - The internal data state of the device itself
 127 - Access to the firmware read/write indexes for the BD queues
 128   and associated logic
 129
 130 All external entry functions are locked with the priv->action_lock to ensure
 131 that only one external action is invoked at a time.
 132
 133
 134 */
 135
 136 #include <linux/compiler.h>
 137 #include <linux/config.h>
 138 #include <linux/errno.h>
 139 #include <linux/if_arp.h>
 140 #include <linux/in6.h>
 141 #include <linux/in.h>
 142 #include <linux/ip.h>
 143 #include <linux/kernel.h>
 144 #include <linux/kmod.h>
 145 #include <linux/module.h>
 146 #include <linux/netdevice.h>
 147 #include <linux/ethtool.h>
 148 #include <linux/pci.h>
 149 #include <linux/dma-mapping.h>
 150 #include <linux/proc_fs.h>
 151 #include <linux/skbuff.h>
 152 #include <asm/uaccess.h>
 153 #include <asm/io.h>
 154 #define __KERNEL_SYSCALLS__
 155 #include <linux/fs.h>
 156 #include <linux/mm.h>
 157 #include <linux/slab.h>
 158 #include <linux/unistd.h>
 159 #include <linux/stringify.h>
 160 #include <linux/tcp.h>
 161 #include <linux/types.h>
 162 #include <linux/version.h>
 163 #include <linux/time.h>
 164 #include <linux/firmware.h>
 165 #include <linux/acpi.h>
 166 #include <linux/ctype.h>
 167
 168 #include "ipw2100.h"
 169
 170 #define IPW2100_VERSION "1.1.0"
 171
 172 #define DRV_NAME        "ipw2100"
 173 #define DRV_VERSION     IPW2100_VERSION
 174 #define DRV_DESCRIPTION "Intel(R) PRO/Wireless 2100 Network Driver"
 175 #define DRV_COPYRIGHT   "Copyright(c) 2003-2004 Intel Corporation"
 176
 177
 178 /* Debugging stuff */
 179 #ifdef CONFIG_IPW_DEBUG
 180 #define CONFIG_IPW2100_RX_DEBUG   /* Reception debugging */
 181 #endif
 182
 183 MODULE_DESCRIPTION(DRV_DESCRIPTION);
 184 MODULE_VERSION(DRV_VERSION);
 185 MODULE_AUTHOR(DRV_COPYRIGHT);
 186 MODULE_LICENSE("GPL");
 187
 188 static int debug = 0;
 189 static int mode = 0;
 190 static int channel = 0;
 191 static int associate = 1;
 192 static int disable = 0;
 193 #ifdef CONFIG_PM
 194 static struct ipw2100_fw ipw2100_firmware;
 195 #endif
 196
 197 #include <linux/moduleparam.h>
 198 module_param(debug, int, 0444);
 199 module_param(mode, int, 0444);
 200 module_param(channel, int, 0444);
 201 module_param(associate, int, 0444);
 202 module_param(disable, int, 0444);
 203
 204 MODULE_PARM_DESC(debug, "debug level");
 205 MODULE_PARM_DESC(mode, "network mode (0=BSS,1=IBSS,2=Monitor)");
 206 MODULE_PARM_DESC(channel, "channel");
 207 MODULE_PARM_DESC(associate, "auto associate when scanning (default on)");
 208 MODULE_PARM_DESC(disable, "manually disable the radio (default 0 [radio on])");
 209
 210 static u32 ipw2100_debug_level = IPW_DL_NONE;
 211
 212 #ifdef CONFIG_IPW_DEBUG
 213 #define IPW_DEBUG(level, message...) \
 214 do { \
 215         if (ipw2100_debug_level & (level)) { \
 216                 printk(KERN_DEBUG "ipw2100: %c %s ", \
 217                        in_interrupt() ? 'I' : 'U',  __FUNCTION__); \
 218                 printk(message); \
 219         } \
 220 } while (0)
 221 #else
 222 #define IPW_DEBUG(level, message...) do {} while (0)
 223 #endif /* CONFIG_IPW_DEBUG */
 224
 225 #ifdef CONFIG_IPW_DEBUG
 226 static const char *command_types[] = {
 227         "undefined",
 228         "unused", /* HOST_ATTENTION */
 229         "HOST_COMPLETE",
 230         "unused", /* SLEEP */
 231         "unused", /* HOST_POWER_DOWN */
 232         "unused",
 233         "SYSTEM_CONFIG",
 234         "unused", /* SET_IMR */
 235         "SSID",
 236         "MANDATORY_BSSID",
 237         "AUTHENTICATION_TYPE",
 238         "ADAPTER_ADDRESS",
 239         "PORT_TYPE",
 240         "INTERNATIONAL_MODE",
 241         "CHANNEL",
 242         "RTS_THRESHOLD",
 243         "FRAG_THRESHOLD",
 244         "POWER_MODE",
 245         "TX_RATES",
 246         "BASIC_TX_RATES",
 247         "WEP_KEY_INFO",
 248         "unused",
 249         "unused",
 250         "unused",
 251         "unused",
 252         "WEP_KEY_INDEX",
 253         "WEP_FLAGS",
 254         "ADD_MULTICAST",
 255         "CLEAR_ALL_MULTICAST",
 256         "BEACON_INTERVAL",
 257         "ATIM_WINDOW",
 258         "CLEAR_STATISTICS",
 259         "undefined",
 260         "undefined",
 261         "undefined",
 262         "undefined",
 263         "TX_POWER_INDEX",
 264         "undefined",
 265         "undefined",
 266         "undefined",
 267         "undefined",
 268         "undefined",
 269         "undefined",
 270         "BROADCAST_SCAN",
 271         "CARD_DISABLE",
 272         "PREFERRED_BSSID",
 273         "SET_SCAN_OPTIONS",
 274         "SCAN_DWELL_TIME",
 275         "SWEEP_TABLE",
 276         "AP_OR_STATION_TABLE",
 277         "GROUP_ORDINALS",
 278         "SHORT_RETRY_LIMIT",
 279         "LONG_RETRY_LIMIT",
 280         "unused", /* SAVE_CALIBRATION */
 281         "unused", /* RESTORE_CALIBRATION */
 282         "undefined",
 283         "undefined",
 284         "undefined",
 285         "HOST_PRE_POWER_DOWN",
 286         "unused", /* HOST_INTERRUPT_COALESCING */
 287         "undefined",
 288         "CARD_DISABLE_PHY_OFF",
 289         "MSDU_TX_RATES"
 290         "undefined",
 291         "undefined",
 292         "SET_STATION_STAT_BITS",
 293         "CLEAR_STATIONS_STAT_BITS",
 294         "LEAP_ROGUE_MODE",
 295         "SET_SECURITY_INFORMATION",
 296         "DISASSOCIATION_BSSID",
 297         "SET_WPA_ASS_IE"
 298 };
 299 #endif
 300
 301
 302 /* Pre-decl until we get the code solid and then we can clean it up */
 303 static void ipw2100_tx_send_commands(struct ipw2100_priv *priv);
 304 static void ipw2100_tx_send_data(struct ipw2100_priv *priv);
 305 static int ipw2100_adapter_setup(struct ipw2100_priv *priv);
 306
 307 static void ipw2100_queues_initialize(struct ipw2100_priv *priv);
 308 static void ipw2100_queues_free(struct ipw2100_priv *priv);
 309 static int ipw2100_queues_allocate(struct ipw2100_priv *priv);
 310
 311 static int ipw2100_fw_download(struct ipw2100_priv *priv,
 312                                struct ipw2100_fw *fw);
 313 static int ipw2100_get_firmware(struct ipw2100_priv *priv,
 314                                 struct ipw2100_fw *fw);
 315 static int ipw2100_get_fwversion(struct ipw2100_priv *priv, char *buf,
 316                                  size_t max);
 317 static int ipw2100_get_ucodeversion(struct ipw2100_priv *priv, char *buf,
 318                                     size_t max);
 319 static void ipw2100_release_firmware(struct ipw2100_priv *priv,
 320                                      struct ipw2100_fw *fw);
 321 static int ipw2100_ucode_download(struct ipw2100_priv *priv,
 322                                   struct ipw2100_fw *fw);
 323 static void ipw2100_wx_event_work(struct ipw2100_priv *priv);
 324 static struct iw_statistics *ipw2100_wx_wireless_stats(struct net_device * dev);
 325 static struct iw_handler_def ipw2100_wx_handler_def;
 326
 327
 328 static inline void read_register(struct net_device *dev, u32 reg, u32 *val)
 329 {
 330         *val = readl((void *)(dev->base_addr + reg));
 331         IPW_DEBUG_IO("r: 0x%08X => 0x%08X\n", reg, *val);
 332 }
 333
 334 static inline void write_register(struct net_device *dev, u32 reg, u32 val)
 335 {
 336         writel(val, (void *)(dev->base_addr + reg));
 337         IPW_DEBUG_IO("w: 0x%08X <= 0x%08X\n", reg, val);
 338 }
 339
 340 static inline void read_register_word(struct net_device *dev, u32 reg, u16 *val)
 341 {
 342         *val = readw((void *)(dev->base_addr + reg));
 343         IPW_DEBUG_IO("r: 0x%08X => %04X\n", reg, *val);
 344 }
 345
 346 static inline void read_register_byte(struct net_device *dev, u32 reg, u8 *val)
 347 {
 348         *val = readb((void *)(dev->base_addr + reg));
 349         IPW_DEBUG_IO("r: 0x%08X => %02X\n", reg, *val);
 350 }
 351
 352 static inline void write_register_word(struct net_device *dev, u32 reg, u16 val)
 353 {
 354         writew(val, (void *)(dev->base_addr + reg));
 355         IPW_DEBUG_IO("w: 0x%08X <= %04X\n", reg, val);
 356 }
 357
 358
 359 static inline void write_register_byte(struct net_device *dev, u32 reg, u8 val)
 360 {
 361         writeb(val, (void *)(dev->base_addr + reg));
 362         IPW_DEBUG_IO("w: 0x%08X =< %02X\n", reg, val);
 363 }
 364
 365 static inline void read_nic_dword(struct net_device *dev, u32 addr, u32 *val)
 366 {
 367         write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
 368                        addr & IPW_REG_INDIRECT_ADDR_MASK);
 369         read_register(dev, IPW_REG_INDIRECT_ACCESS_DATA, val);
 370 }
 371
 372 static inline void write_nic_dword(struct net_device *dev, u32 addr, u32 val)
 373 {
 374         write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
 375                        addr & IPW_REG_INDIRECT_ADDR_MASK);
 376         write_register(dev, IPW_REG_INDIRECT_ACCESS_DATA, val);
 377 }
 378
 379 static inline void read_nic_word(struct net_device *dev, u32 addr, u16 *val)
 380 {
 381         write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
 382                        addr & IPW_REG_INDIRECT_ADDR_MASK);
 383         read_register_word(dev, IPW_REG_INDIRECT_ACCESS_DATA, val);
 384 }
 385
 386 static inline void write_nic_word(struct net_device *dev, u32 addr, u16 val)
 387 {
 388         write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
 389                        addr & IPW_REG_INDIRECT_ADDR_MASK);
 390         write_register_word(dev, IPW_REG_INDIRECT_ACCESS_DATA, val);
 391 }
 392
 393 static inline void read_nic_byte(struct net_device *dev, u32 addr, u8 *val)
 394 {
 395         write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
 396                        addr & IPW_REG_INDIRECT_ADDR_MASK);
 397         read_register_byte(dev, IPW_REG_INDIRECT_ACCESS_DATA, val);
 398 }
 399
 400 static inline void write_nic_byte(struct net_device *dev, u32 addr, u8 val)
 401 {
 402         write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
 403                        addr & IPW_REG_INDIRECT_ADDR_MASK);
 404         write_register_byte(dev, IPW_REG_INDIRECT_ACCESS_DATA, val);
 405 }
 406
 407 static inline void write_nic_auto_inc_address(struct net_device *dev, u32 addr)
 408 {
 409         write_register(dev, IPW_REG_AUTOINCREMENT_ADDRESS,
 410                        addr & IPW_REG_INDIRECT_ADDR_MASK);
 411 }
 412
 413 static inline void write_nic_dword_auto_inc(struct net_device *dev, u32 val)
 414 {
 415         write_register(dev, IPW_REG_AUTOINCREMENT_DATA, val);
 416 }
 417
 418 static inline void write_nic_memory(struct net_device *dev, u32 addr, u32 len,
 419                                     const u8 *buf)
 420 {
 421         u32 aligned_addr;
 422         u32 aligned_len;
 423         u32 dif_len;
 424         u32 i;
 425
 426         /* read first nibble byte by byte */
 427         aligned_addr = addr & (~0x3);
 428         dif_len = addr - aligned_addr;
 429         if (dif_len) {
 430                 /* Start reading at aligned_addr + dif_len */
 431                 write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
 432                                aligned_addr);
 433                 for (i = dif_len; i < 4; i++, buf++)
 434                         write_register_byte(
 435                                 dev, IPW_REG_INDIRECT_ACCESS_DATA + i,
 436                                 *buf);
 437
 438                 len -= dif_len;
 439                 aligned_addr += 4;
 440         }
 441
 442         /* read DWs through autoincrement registers */
 443         write_register(dev, IPW_REG_AUTOINCREMENT_ADDRESS,
 444                        aligned_addr);
 445         aligned_len = len & (~0x3);
 446         for (i = 0; i < aligned_len; i += 4, buf += 4, aligned_addr += 4)
 447                 write_register(
 448                         dev, IPW_REG_AUTOINCREMENT_DATA, *(u32 *)buf);
 449
 450         /* copy the last nibble */
 451         dif_len = len - aligned_len;
 452         write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS, aligned_addr);
 453         for (i = 0; i < dif_len; i++, buf++)
 454                 write_register_byte(
 455                         dev, IPW_REG_INDIRECT_ACCESS_DATA + i, *buf);
 456 }
 457
 458 static inline void read_nic_memory(struct net_device *dev, u32 addr, u32 len,
 459                                    u8 *buf)
 460 {
 461         u32 aligned_addr;
 462         u32 aligned_len;
 463         u32 dif_len;
 464         u32 i;
 465
 466         /* read first nibble byte by byte */
 467         aligned_addr = addr & (~0x3);
 468         dif_len = addr - aligned_addr;
 469         if (dif_len) {
 470                 /* Start reading at aligned_addr + dif_len */
 471                 write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
 472                                aligned_addr);
 473                 for (i = dif_len; i < 4; i++, buf++)
 474                         read_register_byte(
 475                                 dev, IPW_REG_INDIRECT_ACCESS_DATA + i, buf);
 476
 477                 len -= dif_len;
 478                 aligned_addr += 4;
 479         }
 480
 481         /* read DWs through autoincrement registers */
 482         write_register(dev, IPW_REG_AUTOINCREMENT_ADDRESS,
 483                        aligned_addr);
 484         aligned_len = len & (~0x3);
 485         for (i = 0; i < aligned_len; i += 4, buf += 4, aligned_addr += 4)
 486                 read_register(dev, IPW_REG_AUTOINCREMENT_DATA,
 487                               (u32 *)buf);
 488
 489         /* copy the last nibble */
 490         dif_len = len - aligned_len;
 491         write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
 492                        aligned_addr);
 493         for (i = 0; i < dif_len; i++, buf++)
 494                 read_register_byte(dev, IPW_REG_INDIRECT_ACCESS_DATA +
 495                                    i, buf);
 496 }
 497
 498 static inline int ipw2100_hw_is_adapter_in_system(struct net_device *dev)
 499 {
 500         return (dev->base_addr &&
 501                 (readl((void *)(dev->base_addr + IPW_REG_DOA_DEBUG_AREA_START))
 502                  == IPW_DATA_DOA_DEBUG_VALUE));
 503 }
 504
 505 static int ipw2100_get_ordinal(struct ipw2100_priv *priv, u32 ord,
 506                                void *val, u32 *len)
 507 {
 508         struct ipw2100_ordinals *ordinals = &priv->ordinals;
 509         u32 addr;
 510         u32 field_info;
 511         u16 field_len;
 512         u16 field_count;
 513         u32 total_length;
 514
 515         if (ordinals->table1_addr == 0) {
 516                 printk(KERN_WARNING DRV_NAME ": attempt to use fw ordinals "
 517                        "before they have been loaded.\n");
 518                 return -EINVAL;
 519         }
 520
 521         if (IS_ORDINAL_TABLE_ONE(ordinals, ord)) {
 522                 if (*len < IPW_ORD_TAB_1_ENTRY_SIZE) {
 523                         *len = IPW_ORD_TAB_1_ENTRY_SIZE;
 524
 525                         printk(KERN_WARNING DRV_NAME
 526                                ": ordinal buffer length too small, need %zd\n",
 527                                IPW_ORD_TAB_1_ENTRY_SIZE);
 528
 529                         return -EINVAL;
 530                 }
 531
 532                 read_nic_dword(priv->net_dev, ordinals->table1_addr + (ord << 2),
 533                                &addr);
 534                 read_nic_dword(priv->net_dev, addr, val);
 535
 536                 *len = IPW_ORD_TAB_1_ENTRY_SIZE;
 537
 538                 return 0;
 539         }
 540
 541         if (IS_ORDINAL_TABLE_TWO(ordinals, ord)) {
 542
 543                 ord -= IPW_START_ORD_TAB_2;
 544
 545                 /* get the address of statistic */
 546                 read_nic_dword(priv->net_dev, ordinals->table2_addr + (ord << 3),
 547                                &addr);
 548
 549                 /* get the second DW of statistics ;
 550                  * two 16-bit words - first is length, second is count */
 551                 read_nic_dword(priv->net_dev,
 552                                ordinals->table2_addr + (ord << 3) + sizeof(u32),
 553                                &field_info);
 554
 555                 /* get each entry length */
 556                 field_len = *((u16 *)&field_info);
 557
 558                 /* get number of entries */
 559                 field_count = *(((u16 *)&field_info) + 1);
 560
 561                 /* abort if no enought memory */
 562                 total_length = field_len * field_count;
 563                 if (total_length > *len) {
 564                         *len = total_length;
 565                         return -EINVAL;
 566                 }
 567
 568                 *len = total_length;
 569                 if (!total_length)
 570                         return 0;
 571
 572                 /* read the ordinal data from the SRAM */
 573                 read_nic_memory(priv->net_dev, addr, total_length, val);
 574
 575                 return 0;
 576         }
 577
 578         printk(KERN_WARNING DRV_NAME ": ordinal %d neither in table 1 nor "
 579                "in table 2\n", ord);
 580
 581         return -EINVAL;
 582 }
 583
 584 static int ipw2100_set_ordinal(struct ipw2100_priv *priv, u32 ord, u32 *val,
 585                                u32 *len)
 586 {
 587         struct ipw2100_ordinals *ordinals = &priv->ordinals;
 588         u32 addr;
 589
 590         if (IS_ORDINAL_TABLE_ONE(ordinals, ord)) {
 591                 if (*len != IPW_ORD_TAB_1_ENTRY_SIZE) {
 592                         *len = IPW_ORD_TAB_1_ENTRY_SIZE;
 593                         IPW_DEBUG_INFO("wrong size\n");
 594                         return -EINVAL;
 595                 }
 596
 597                 read_nic_dword(priv->net_dev, ordinals->table1_addr + (ord << 2),
 598                                &addr);
 599
 600                 write_nic_dword(priv->net_dev, addr, *val);
 601
 602                 *len = IPW_ORD_TAB_1_ENTRY_SIZE;
 603
 604                 return 0;
 605         }
 606
 607         IPW_DEBUG_INFO("wrong table\n");
 608         if (IS_ORDINAL_TABLE_TWO(ordinals, ord))
 609                 return -EINVAL;
 610
 611         return -EINVAL;
 612 }
 613
 614 static char *snprint_line(char *buf, size_t count,
 615                           const u8 *data, u32 len, u32 ofs)
 616 {
 617         int out, i, j, l;
 618         char c;
 619
 620         out = snprintf(buf, count, "%08X", ofs);
 621
 622         for (l = 0, i = 0; i < 2; i++) {
 623                 out += snprintf(buf + out, count - out, " ");
 624                 for (j = 0; j < 8 && l < len; j++, l++)
 625                         out += snprintf(buf + out, count - out, "%02X ",
 626                                         data[(i * 8 + j)]);
 627                 for (; j < 8; j++)
 628                         out += snprintf(buf + out, count - out, "   ");
 629         }
 630
 631         out += snprintf(buf + out, count - out, " ");
 632         for (l = 0, i = 0; i < 2; i++) {
 633                 out += snprintf(buf + out, count - out, " ");
 634                 for (j = 0; j < 8 && l < len; j++, l++) {
 635                         c = data[(i * 8 + j)];
 636                         if (!isascii(c) || !isprint(c))
 637                                 c = '.';
 638
 639                         out += snprintf(buf + out, count - out, "%c", c);
 640                 }
 641
 642                 for (; j < 8; j++)
 643                         out += snprintf(buf + out, count - out, " ");
 644         }
 645
 646         return buf;
 647 }
 648
 649 static void printk_buf(int level, const u8 *data, u32 len)
 650 {
 651         char line[81];
 652         u32 ofs = 0;
 653         if (!(ipw2100_debug_level & level))
 654                 return;
 655
 656         while (len) {
 657                 printk(KERN_DEBUG "%s\n",
 658                        snprint_line(line, sizeof(line), &data[ofs],
 659                                     min(len, 16U), ofs));
 660                 ofs += 16;
 661                 len -= min(len, 16U);
 662         }
 663 }
 664
 665
 666
 667 #define MAX_RESET_BACKOFF 10
 668
 669 static inline void schedule_reset(struct ipw2100_priv *priv)
 670 {
 671         unsigned long now = get_seconds();
 672
 673         /* If we haven't received a reset request within the backoff period,
 674          * then we can reset the backoff interval so this reset occurs
 675          * immediately */
 676         if (priv->reset_backoff &&
 677             (now - priv->last_reset > priv->reset_backoff))
 678                 priv->reset_backoff = 0;
 679
 680         priv->last_reset = get_seconds();
 681
 682         if (!(priv->status & STATUS_RESET_PENDING)) {
 683                 IPW_DEBUG_INFO("%s: Scheduling firmware restart (%ds).\n",
 684                                priv->net_dev->name, priv->reset_backoff);
 685                 netif_carrier_off(priv->net_dev);
 686                 netif_stop_queue(priv->net_dev);
 687                 priv->status |= STATUS_RESET_PENDING;
 688                 if (priv->reset_backoff)
 689                         queue_delayed_work(priv->workqueue, &priv->reset_work,
 690                                            priv->reset_backoff * HZ);
 691                 else
 692                         queue_work(priv->workqueue, &priv->reset_work);
 693
 694                 if (priv->reset_backoff < MAX_RESET_BACKOFF)
 695                         priv->reset_backoff++;
 696
 697                 wake_up_interruptible(&priv->wait_command_queue);
 698         } else
 699                 IPW_DEBUG_INFO("%s: Firmware restart already in progress.\n",
 700                                priv->net_dev->name);
 701
 702 }
 703
 704 #define HOST_COMPLETE_TIMEOUT (2 * HZ)
 705 static int ipw2100_hw_send_command(struct ipw2100_priv *priv,
 706                                    struct host_command * cmd)
 707 {
 708         struct list_head *element;
 709         struct ipw2100_tx_packet *packet;
 710         unsigned long flags;
 711         int err = 0;
 712
 713         IPW_DEBUG_HC("Sending %s command (#%d), %d bytes\n",
 714                      command_types[cmd->host_command], cmd->host_command,
 715                      cmd->host_command_length);
 716         printk_buf(IPW_DL_HC, (u8*)cmd->host_command_parameters,
 717                    cmd->host_command_length);
 718
 719         spin_lock_irqsave(&priv->low_lock, flags);
 720
 721         if (priv->fatal_error) {
 722                 IPW_DEBUG_INFO("Attempt to send command while hardware in fatal error condition.\n");
 723                 err = -EIO;
 724                 goto fail_unlock;
 725         }
 726
 727         if (!(priv->status & STATUS_RUNNING)) {
 728                 IPW_DEBUG_INFO("Attempt to send command while hardware is not running.\n");
 729                 err = -EIO;
 730                 goto fail_unlock;
 731         }
 732
 733         if (priv->status & STATUS_CMD_ACTIVE) {
 734                 IPW_DEBUG_INFO("Attempt to send command while another command is pending.\n");
 735                 err = -EBUSY;
 736                 goto fail_unlock;
 737         }
 738
 739         if (list_empty(&priv->msg_free_list)) {
 740                 IPW_DEBUG_INFO("no available msg buffers\n");
 741                 goto fail_unlock;
 742         }
 743
 744         priv->status |= STATUS_CMD_ACTIVE;
 745         priv->messages_sent++;
 746
 747         element = priv->msg_free_list.next;
 748
 749         packet = list_entry(element, struct ipw2100_tx_packet, list);
 750         packet->jiffy_start = jiffies;
 751
 752         /* initialize the firmware command packet */
 753         packet->info.c_struct.cmd->host_command_reg = cmd->host_command;
 754         packet->info.c_struct.cmd->host_command_reg1 = cmd->host_command1;
 755         packet->info.c_struct.cmd->host_command_len_reg = cmd->host_command_length;
 756         packet->info.c_struct.cmd->sequence = cmd->host_command_sequence;
 757
 758         memcpy(packet->info.c_struct.cmd->host_command_params_reg,
 759                cmd->host_command_parameters,
 760                sizeof(packet->info.c_struct.cmd->host_command_params_reg));
 761
 762         list_del(element);
 763         DEC_STAT(&priv->msg_free_stat);
 764
 765         list_add_tail(element, &priv->msg_pend_list);
 766         INC_STAT(&priv->msg_pend_stat);
 767
 768         ipw2100_tx_send_commands(priv);
 769         ipw2100_tx_send_data(priv);
 770
 771         spin_unlock_irqrestore(&priv->low_lock, flags);
 772
 773         /*
 774          * We must wait for this command to complete before another
 775          * command can be sent...  but if we wait more than 3 seconds
 776          * then there is a problem.
 777          */
 778
 779         err = wait_event_interruptible_timeout(
 780                 priv->wait_command_queue, !(priv->status & STATUS_CMD_ACTIVE),
 781                 HOST_COMPLETE_TIMEOUT);
 782
 783         if (err == 0) {
 784                 IPW_DEBUG_INFO("Command completion failed out after %dms.\n",
 785                                HOST_COMPLETE_TIMEOUT / (HZ / 100));
 786                 priv->fatal_error = IPW2100_ERR_MSG_TIMEOUT;
 787                 priv->status &= ~STATUS_CMD_ACTIVE;
 788                 schedule_reset(priv);
 789                 return -EIO;
 790         }
 791
 792         if (priv->fatal_error) {
 793                 printk(KERN_WARNING DRV_NAME ": %s: firmware fatal error\n",
 794                        priv->net_dev->name);
 795                 return -EIO;
 796         }
 797
 798         /* !!!!! HACK TEST !!!!!
 799          * When lots of debug trace statements are enabled, the driver
 800          * doesn't seem to have as many firmware restart cycles...
 801          *
 802          * As a test, we're sticking in a 1/100s delay here */
 803         set_current_state(TASK_UNINTERRUPTIBLE);
 804         schedule_timeout(HZ / 100);
 805
 806         return 0;
 807
 808  fail_unlock:
 809         spin_unlock_irqrestore(&priv->low_lock, flags);
 810
 811         return err;
 812 }
 813
 814
 815 /*
 816  * Verify the values and data access of the hardware
 817  * No locks needed or used.  No functions called.
 818  */
 819 static int ipw2100_verify(struct ipw2100_priv *priv)
 820 {
 821         u32 data1, data2;
 822         u32 address;
 823
 824         u32 val1 = 0x76543210;
 825         u32 val2 = 0xFEDCBA98;
 826
 827         /* Domain 0 check - all values should be DOA_DEBUG */
 828         for (address = IPW_REG_DOA_DEBUG_AREA_START;
 829              address < IPW_REG_DOA_DEBUG_AREA_END;
 830              address += sizeof(u32)) {
 831                 read_register(priv->net_dev, address, &data1);
 832                 if (data1 != IPW_DATA_DOA_DEBUG_VALUE)
 833                         return -EIO;
 834         }
 835
 836         /* Domain 1 check - use arbitrary read/write compare  */
 837         for (address = 0; address < 5; address++) {
 838                 /* The memory area is not used now */
 839                 write_register(priv->net_dev, IPW_REG_DOMAIN_1_OFFSET + 0x32,
 840                                val1);
 841                 write_register(priv->net_dev, IPW_REG_DOMAIN_1_OFFSET + 0x36,
 842                                val2);
 843                 read_register(priv->net_dev, IPW_REG_DOMAIN_1_OFFSET + 0x32,
 844                               &data1);
 845                 read_register(priv->net_dev, IPW_REG_DOMAIN_1_OFFSET + 0x36,
 846                               &data2);
 847                 if (val1 == data1 && val2 == data2)
 848                         return 0;
 849         }
 850
 851         return -EIO;
 852 }
 853
 854 /*
 855  *
 856  * Loop until the CARD_DISABLED bit is the same value as the
 857  * supplied parameter
 858  *
 859  * TODO: See if it would be more efficient to do a wait/wake
 860  *       cycle and have the completion event trigger the wakeup
 861  *
 862  */
 863 #define IPW_CARD_DISABLE_COMPLETE_WAIT              100 // 100 milli
 864 static int ipw2100_wait_for_card_state(struct ipw2100_priv *priv, int state)
 865 {
 866         int i;
 867         u32 card_state;
 868         u32 len = sizeof(card_state);
 869         int err;
 870
 871         for (i = 0; i <= IPW_CARD_DISABLE_COMPLETE_WAIT * 1000; i += 50) {
 872                 err = ipw2100_get_ordinal(priv, IPW_ORD_CARD_DISABLED,
 873                                           &card_state, &len);
 874                 if (err) {
 875                         IPW_DEBUG_INFO("Query of CARD_DISABLED ordinal "
 876                                        "failed.\n");
 877                         return 0;
 878                 }
 879
 880                 /* We'll break out if either the HW state says it is
 881                  * in the state we want, or if HOST_COMPLETE command
 882                  * finishes */
 883                 if ((card_state == state) ||
 884                     ((priv->status & STATUS_ENABLED) ?
 885                      IPW_HW_STATE_ENABLED : IPW_HW_STATE_DISABLED) == state) {
 886                         if (state == IPW_HW_STATE_ENABLED)
 887                                 priv->status |= STATUS_ENABLED;
 888                         else
 889                                 priv->status &= ~STATUS_ENABLED;
 890
 891                         return 0;
 892                 }
 893
 894                 udelay(50);
 895         }
 896
 897         IPW_DEBUG_INFO("ipw2100_wait_for_card_state to %s state timed out\n",
 898                        state ? "DISABLED" : "ENABLED");
 899         return -EIO;
 900 }
 901
 902
 903 /*********************************************************************
 904     Procedure   :   sw_reset_and_clock
 905     Purpose     :   Asserts s/w reset, asserts clock initialization
 906                     and waits for clock stabilization
 907  ********************************************************************/
 908 static int sw_reset_and_clock(struct ipw2100_priv *priv)
 909 {
 910         int i;
 911         u32 r;
 912
 913         // assert s/w reset
 914         write_register(priv->net_dev, IPW_REG_RESET_REG,
 915                        IPW_AUX_HOST_RESET_REG_SW_RESET);
 916
 917         // wait for clock stabilization
 918         for (i = 0; i < 1000; i++) {
 919                 udelay(IPW_WAIT_RESET_ARC_COMPLETE_DELAY);
 920
 921                 // check clock ready bit
 922                 read_register(priv->net_dev, IPW_REG_RESET_REG, &r);
 923                 if (r & IPW_AUX_HOST_RESET_REG_PRINCETON_RESET)
 924                         break;
 925         }
 926
 927         if (i == 1000)
 928                 return -EIO;    // TODO: better error value
 929
 930         /* set "initialization complete" bit to move adapter to
 931          * D0 state */
 932         write_register(priv->net_dev, IPW_REG_GP_CNTRL,
 933                        IPW_AUX_HOST_GP_CNTRL_BIT_INIT_DONE);
 934
 935         /* wait for clock stabilization */
 936         for (i = 0; i < 10000; i++) {
 937                 udelay(IPW_WAIT_CLOCK_STABILIZATION_DELAY * 4);
 938
 939                 /* check clock ready bit */
 940                 read_register(priv->net_dev, IPW_REG_GP_CNTRL, &r);
 941                 if (r & IPW_AUX_HOST_GP_CNTRL_BIT_CLOCK_READY)
 942                         break;
 943         }
 944
 945         if (i == 10000)
 946                 return -EIO;    /* TODO: better error value */
 947
 948         /* set D0 standby bit */
 949         read_register(priv->net_dev, IPW_REG_GP_CNTRL, &r);
 950         write_register(priv->net_dev, IPW_REG_GP_CNTRL,
 951                        r | IPW_AUX_HOST_GP_CNTRL_BIT_HOST_ALLOWS_STANDBY);
 952
 953         return 0;
 954 }
 955
 956 /*********************************************************************
 957     Procedure   :   ipw2100_download_firmware
 958     Purpose     :   Initiaze adapter after power on.
 959                     The sequence is:
 960                     1. assert s/w reset first!
 961                     2. awake clocks & wait for clock stabilization
 962                     3. hold ARC (don't ask me why...)
 963                     4. load Dino ucode and reset/clock init again
 964                     5. zero-out shared mem
 965                     6. download f/w
 966  *******************************************************************/
 967 static int ipw2100_download_firmware(struct ipw2100_priv *priv)
 968 {
 969         u32 address;
 970         int err;
 971
 972 #ifndef CONFIG_PM
 973         /* Fetch the firmware and microcode */
 974         struct ipw2100_fw ipw2100_firmware;
 975 #endif
 976
 977         if (priv->fatal_error) {
 978                 IPW_DEBUG_ERROR("%s: ipw2100_download_firmware called after "
 979                        "fatal error %d.  Interface must be brought down.\n",
 980                        priv->net_dev->name, priv->fatal_error);
 981                 return -EINVAL;
 982         }
 983
 984 #ifdef CONFIG_PM
 985         if (!ipw2100_firmware.version) {
 986                 err = ipw2100_get_firmware(priv, &ipw2100_firmware);
 987                 if (err) {
 988                         IPW_DEBUG_ERROR("%s: ipw2100_get_firmware failed: %d\n",
 989                                priv->net_dev->name, err);
 990                         priv->fatal_error = IPW2100_ERR_FW_LOAD;
 991                         goto fail;
 992                 }
 993         }
 994 #else
 995         err = ipw2100_get_firmware(priv, &ipw2100_firmware);
 996         if (err) {
 997                 IPW_DEBUG_ERROR("%s: ipw2100_get_firmware failed: %d\n",
 998                        priv->net_dev->name, err);
 999                 priv->fatal_error = IPW2100_ERR_FW_LOAD;
1000                 goto fail;
1001         }
1002 #endif
1003         priv->firmware_version = ipw2100_firmware.version;
1004
1005         /* s/w reset and clock stabilization */
1006         err = sw_reset_and_clock(priv);
1007         if (err) {
1008                 IPW_DEBUG_ERROR("%s: sw_reset_and_clock failed: %d\n",
1009                        priv->net_dev->name, err);
1010                 goto fail;
1011         }
1012
1013         err = ipw2100_verify(priv);
1014         if (err) {
1015                 IPW_DEBUG_ERROR("%s: ipw2100_verify failed: %d\n",
1016                        priv->net_dev->name, err);
1017                 goto fail;
1018         }
1019
1020         /* Hold ARC */
1021         write_nic_dword(priv->net_dev,
1022                         IPW_INTERNAL_REGISTER_HALT_AND_RESET,
1023                         0x80000000);
1024
1025         /* allow ARC to run */
1026         write_register(priv->net_dev, IPW_REG_RESET_REG, 0);
1027
1028         /* load microcode */
1029         err = ipw2100_ucode_download(priv, &ipw2100_firmware);
1030         if (err) {
1031                 printk(KERN_ERR DRV_NAME ": %s: Error loading microcode: %d\n",
1032                        priv->net_dev->name, err);
1033                 goto fail;
1034         }
1035
1036         /* release ARC */
1037         write_nic_dword(priv->net_dev,
1038                         IPW_INTERNAL_REGISTER_HALT_AND_RESET,
1039                         0x00000000);
1040
1041         /* s/w reset and clock stabilization (again!!!) */
1042         err = sw_reset_and_clock(priv);
1043         if (err) {
1044                 printk(KERN_ERR DRV_NAME ": %s: sw_reset_and_clock failed: %d\n",
1045                        priv->net_dev->name, err);
1046                 goto fail;
1047         }
1048
1049         /* load f/w */
1050         err = ipw2100_fw_download(priv, &ipw2100_firmware);
1051         if (err) {
1052                 IPW_DEBUG_ERROR("%s: Error loading firmware: %d\n",
1053                        priv->net_dev->name, err);
1054                 goto fail;
1055         }
1056
1057 #ifndef CONFIG_PM
1058         /*
1059          * When the .resume method of the driver is called, the other
1060          * part of the system, i.e. the ide driver could still stay in
1061          * the suspend stage. This prevents us from loading the firmware
1062          * from the disk.  --YZ
1063          */
1064
1065         /* free any storage allocated for firmware image */
1066         ipw2100_release_firmware(priv, &ipw2100_firmware);
1067 #endif
1068
1069         /* zero out Domain 1 area indirectly (Si requirement) */
1070         for (address = IPW_HOST_FW_SHARED_AREA0;
1071              address < IPW_HOST_FW_SHARED_AREA0_END; address += 4)
1072                 write_nic_dword(priv->net_dev, address, 0);
1073         for (address = IPW_HOST_FW_SHARED_AREA1;
1074              address < IPW_HOST_FW_SHARED_AREA1_END; address += 4)
1075                 write_nic_dword(priv->net_dev, address, 0);
1076         for (address = IPW_HOST_FW_SHARED_AREA2;
1077              address < IPW_HOST_FW_SHARED_AREA2_END; address += 4)
1078                 write_nic_dword(priv->net_dev, address, 0);
1079         for (address = IPW_HOST_FW_SHARED_AREA3;
1080              address < IPW_HOST_FW_SHARED_AREA3_END; address += 4)
1081                 write_nic_dword(priv->net_dev, address, 0);
1082         for (address = IPW_HOST_FW_INTERRUPT_AREA;
1083              address < IPW_HOST_FW_INTERRUPT_AREA_END; address += 4)
1084                 write_nic_dword(priv->net_dev, address, 0);
1085
1086         return 0;
1087
1088  fail:
1089         ipw2100_release_firmware(priv, &ipw2100_firmware);
1090         return err;
1091 }
1092
1093 static inline void ipw2100_enable_interrupts(struct ipw2100_priv *priv)
1094 {
1095         if (priv->status & STATUS_INT_ENABLED)
1096                 return;
1097         priv->status |= STATUS_INT_ENABLED;
1098         write_register(priv->net_dev, IPW_REG_INTA_MASK, IPW_INTERRUPT_MASK);
1099 }
1100
1101 static inline void ipw2100_disable_interrupts(struct ipw2100_priv *priv)
1102 {
1103         if (!(priv->status & STATUS_INT_ENABLED))
1104                 return;
1105         priv->status &= ~STATUS_INT_ENABLED;
1106         write_register(priv->net_dev, IPW_REG_INTA_MASK, 0x0);
1107 }
1108
1109
1110 static void ipw2100_initialize_ordinals(struct ipw2100_priv *priv)
1111 {
1112         struct ipw2100_ordinals *ord = &priv->ordinals;
1113
1114         IPW_DEBUG_INFO("enter\n");
1115
1116         read_register(priv->net_dev, IPW_MEM_HOST_SHARED_ORDINALS_TABLE_1,
1117                       &ord->table1_addr);
1118
1119         read_register(priv->net_dev, IPW_MEM_HOST_SHARED_ORDINALS_TABLE_2,
1120                       &ord->table2_addr);
1121
1122         read_nic_dword(priv->net_dev, ord->table1_addr, &ord->table1_size);
1123         read_nic_dword(priv->net_dev, ord->table2_addr, &ord->table2_size);
1124
1125         ord->table2_size &= 0x0000FFFF;
1126
1127         IPW_DEBUG_INFO("table 1 size: %d\n", ord->table1_size);
1128         IPW_DEBUG_INFO("table 2 size: %d\n", ord->table2_size);
1129         IPW_DEBUG_INFO("exit\n");
1130 }
1131
1132 static inline void ipw2100_hw_set_gpio(struct ipw2100_priv *priv)
1133 {
1134         u32 reg = 0;
1135         /*
1136          * Set GPIO 3 writable by FW; GPIO 1 writable
1137          * by driver and enable clock
1138          */
1139         reg = (IPW_BIT_GPIO_GPIO3_MASK | IPW_BIT_GPIO_GPIO1_ENABLE |
1140                IPW_BIT_GPIO_LED_OFF);
1141         write_register(priv->net_dev, IPW_REG_GPIO, reg);
1142 }
1143
1144 static inline int rf_kill_active(struct ipw2100_priv *priv)
1145 {
1146 #define MAX_RF_KILL_CHECKS 5
1147 #define RF_KILL_CHECK_DELAY 40
1148
1149         unsigned short value = 0;
1150         u32 reg = 0;
1151         int i;
1152
1153         if (!(priv->hw_features & HW_FEATURE_RFKILL)) {
1154                 priv->status &= ~STATUS_RF_KILL_HW;
1155                 return 0;
1156         }
1157
1158         for (i = 0; i < MAX_RF_KILL_CHECKS; i++) {
1159                 udelay(RF_KILL_CHECK_DELAY);
1160                 read_register(priv->net_dev, IPW_REG_GPIO, &reg);
1161                 value = (value << 1) | ((reg & IPW_BIT_GPIO_RF_KILL) ? 0 : 1);
1162         }
1163
1164         if (value == 0)
1165                 priv->status |= STATUS_RF_KILL_HW;
1166         else
1167                 priv->status &= ~STATUS_RF_KILL_HW;
1168
1169         return (value == 0);
1170 }
1171
1172 static int ipw2100_get_hw_features(struct ipw2100_priv *priv)
1173 {
1174         u32 addr, len;
1175         u32 val;
1176
1177         /*
1178          * EEPROM_SRAM_DB_START_ADDRESS using ordinal in ordinal table 1
1179          */
1180         len = sizeof(addr);
1181         if (ipw2100_get_ordinal(
1182                     priv, IPW_ORD_EEPROM_SRAM_DB_BLOCK_START_ADDRESS,
1183                     &addr, &len)) {
1184                 IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
1185                        __LINE__);
1186                 return -EIO;
1187         }
1188
1189         IPW_DEBUG_INFO("EEPROM address: %08X\n", addr);
1190
1191         /*
1192          * EEPROM version is the byte at offset 0xfd in firmware
1193          * We read 4 bytes, then shift out the byte we actually want */
1194         read_nic_dword(priv->net_dev, addr + 0xFC, &val);
1195         priv->eeprom_version = (val >> 24) & 0xFF;
1196         IPW_DEBUG_INFO("EEPROM version: %d\n", priv->eeprom_version);
1197
1198         /*
1199          *  HW RF Kill enable is bit 0 in byte at offset 0x21 in firmware
1200          *
1201          *  notice that the EEPROM bit is reverse polarity, i.e.
1202          *     bit = 0  signifies HW RF kill switch is supported
1203          *     bit = 1  signifies HW RF kill switch is NOT supported
1204          */
1205         read_nic_dword(priv->net_dev, addr + 0x20, &val);
1206         if (!((val >> 24) & 0x01))
1207                 priv->hw_features |= HW_FEATURE_RFKILL;
1208
1209         IPW_DEBUG_INFO("HW RF Kill: %ssupported.\n",
1210                            (priv->hw_features & HW_FEATURE_RFKILL) ?
1211                            "" : "not ");
1212
1213         return 0;
1214 }
1215
1216 /*
1217  * Start firmware execution after power on and intialization
1218  * The sequence is:
1219  *  1. Release ARC
1220  *  2. Wait for f/w initialization completes;
1221  */
1222 static int ipw2100_start_adapter(struct ipw2100_priv *priv)
1223 {
1224         int i;
1225         u32 inta, inta_mask, gpio;
1226
1227         IPW_DEBUG_INFO("enter\n");
1228
1229         if (priv->status & STATUS_RUNNING)
1230                 return 0;
1231
1232         /*
1233          * Initialize the hw - drive adapter to DO state by setting
1234          * init_done bit. Wait for clk_ready bit and Download
1235          * fw & dino ucode
1236          */
1237         if (ipw2100_download_firmware(priv)) {
1238                 printk(KERN_ERR DRV_NAME ": %s: Failed to power on the adapter.\n",
1239                        priv->net_dev->name);
1240                 return -EIO;
1241         }
1242
1243         /* Clear the Tx, Rx and Msg queues and the r/w indexes
1244          * in the firmware RBD and TBD ring queue */
1245         ipw2100_queues_initialize(priv);
1246
1247         ipw2100_hw_set_gpio(priv);
1248
1249         /* TODO -- Look at disabling interrupts here to make sure none
1250          * get fired during FW initialization */
1251
1252         /* Release ARC - clear reset bit */
1253         write_register(priv->net_dev, IPW_REG_RESET_REG, 0);
1254
1255         /* wait for f/w intialization complete */
1256         IPW_DEBUG_FW("Waiting for f/w initialization to complete...\n");
1257         i = 5000;
1258         do {
1259                 set_current_state(TASK_UNINTERRUPTIBLE);
1260                 schedule_timeout(40 * HZ / 1000);
1261                 /* Todo... wait for sync command ... */
1262
1263                 read_register(priv->net_dev, IPW_REG_INTA, &inta);
1264
1265                 /* check "init done" bit */
1266                 if (inta & IPW2100_INTA_FW_INIT_DONE) {
1267                         /* reset "init done" bit */
1268                         write_register(priv->net_dev, IPW_REG_INTA,
1269                                        IPW2100_INTA_FW_INIT_DONE);
1270                         break;
1271                 }
1272
1273                 /* check error conditions : we check these after the firmware
1274                  * check so that if there is an error, the interrupt handler
1275                  * will see it and the adapter will be reset */
1276                 if (inta &
1277                     (IPW2100_INTA_FATAL_ERROR | IPW2100_INTA_PARITY_ERROR)) {
1278                         /* clear error conditions */
1279                         write_register(priv->net_dev, IPW_REG_INTA,
1280                                        IPW2100_INTA_FATAL_ERROR |
1281                                        IPW2100_INTA_PARITY_ERROR);
1282                 }
1283         } while (i--);
1284
1285         /* Clear out any pending INTAs since we aren't supposed to have
1286          * interrupts enabled at this point... */
1287         read_register(priv->net_dev, IPW_REG_INTA, &inta);
1288         read_register(priv->net_dev, IPW_REG_INTA_MASK, &inta_mask);
1289         inta &= IPW_INTERRUPT_MASK;
1290         /* Clear out any pending interrupts */
1291         if (inta & inta_mask)
1292                 write_register(priv->net_dev, IPW_REG_INTA, inta);
1293
1294         IPW_DEBUG_FW("f/w initialization complete: %s\n",
1295                      i ? "SUCCESS" : "FAILED");
1296
1297         if (!i) {
1298                 printk(KERN_WARNING DRV_NAME ": %s: Firmware did not initialize.\n",
1299                        priv->net_dev->name);
1300                 return -EIO;
1301         }
1302
1303         /* allow firmware to write to GPIO1 & GPIO3 */
1304         read_register(priv->net_dev, IPW_REG_GPIO, &gpio);
1305
1306         gpio |= (IPW_BIT_GPIO_GPIO1_MASK | IPW_BIT_GPIO_GPIO3_MASK);
1307
1308         write_register(priv->net_dev, IPW_REG_GPIO, gpio);
1309
1310         /* Ready to receive commands */
1311         priv->status |= STATUS_RUNNING;
1312
1313         /* The adapter has been reset; we are not associated */
1314         priv->status &= ~(STATUS_ASSOCIATING | STATUS_ASSOCIATED);
1315
1316         IPW_DEBUG_INFO("exit\n");
1317
1318         return 0;
1319 }
1320
1321 static inline void ipw2100_reset_fatalerror(struct ipw2100_priv *priv)
1322 {
1323         if (!priv->fatal_error)
1324                 return;
1325
1326         priv->fatal_errors[priv->fatal_index++] = priv->fatal_error;
1327         priv->fatal_index %= IPW2100_ERROR_QUEUE;
1328         priv->fatal_error = 0;
1329 }
1330
1331
1332 /* NOTE: Our interrupt is disabled when this method is called */
1333 static int ipw2100_power_cycle_adapter(struct ipw2100_priv *priv)
1334 {
1335         u32 reg;
1336         int i;
1337
1338         IPW_DEBUG_INFO("Power cycling the hardware.\n");
1339
1340         ipw2100_hw_set_gpio(priv);
1341
1342         /* Step 1. Stop Master Assert */
1343         write_register(priv->net_dev, IPW_REG_RESET_REG,
1344                        IPW_AUX_HOST_RESET_REG_STOP_MASTER);
1345
1346         /* Step 2. Wait for stop Master Assert
1347          *         (not more then 50us, otherwise ret error */
1348         i = 5;
1349         do {
1350                 udelay(IPW_WAIT_RESET_MASTER_ASSERT_COMPLETE_DELAY);
1351                 read_register(priv->net_dev, IPW_REG_RESET_REG, &reg);
1352
1353                 if (reg & IPW_AUX_HOST_RESET_REG_MASTER_DISABLED)
1354                         break;
1355         }  while(i--);
1356
1357         priv->status &= ~STATUS_RESET_PENDING;
1358
1359         if (!i) {
1360                 IPW_DEBUG_INFO("exit - waited too long for master assert stop\n");
1361                 return -EIO;
1362         }
1363
1364         write_register(priv->net_dev, IPW_REG_RESET_REG,
1365                        IPW_AUX_HOST_RESET_REG_SW_RESET);
1366
1367
1368         /* Reset any fatal_error conditions */
1369         ipw2100_reset_fatalerror(priv);
1370
1371         /* At this point, the adapter is now stopped and disabled */
1372         priv->status &= ~(STATUS_RUNNING | STATUS_ASSOCIATING |
1373                           STATUS_ASSOCIATED | STATUS_ENABLED);
1374
1375         return 0;
1376 }
1377
1378 /*
1379  * Send the CARD_DISABLE_PHY_OFF comamnd to the card to disable it
1380  *
1381  * After disabling, if the card was associated, a STATUS_ASSN_LOST will be sent.
1382  *
1383  * STATUS_CARD_DISABLE_NOTIFICATION will be sent regardless of
1384  * if STATUS_ASSN_LOST is sent.
1385  */
1386 static int ipw2100_hw_phy_off(struct ipw2100_priv *priv)
1387 {
1388
1389 #define HW_PHY_OFF_LOOP_DELAY (HZ / 5000)
1390
1391         struct host_command cmd = {
1392                 .host_command = CARD_DISABLE_PHY_OFF,
1393                 .host_command_sequence = 0,
1394                 .host_command_length = 0,
1395         };
1396         int err, i;
1397         u32 val1, val2;
1398
1399         IPW_DEBUG_HC("CARD_DISABLE_PHY_OFF\n");
1400
1401         /* Turn off the radio */
1402         err = ipw2100_hw_send_command(priv, &cmd);
1403         if (err)
1404                 return err;
1405
1406         for (i = 0; i < 2500; i++) {
1407                 read_nic_dword(priv->net_dev, IPW2100_CONTROL_REG, &val1);
1408                 read_nic_dword(priv->net_dev, IPW2100_COMMAND, &val2);
1409
1410                 if ((val1 & IPW2100_CONTROL_PHY_OFF) &&
1411                     (val2 & IPW2100_COMMAND_PHY_OFF))
1412                         return 0;
1413
1414                 set_current_state(TASK_UNINTERRUPTIBLE);
1415                 schedule_timeout(HW_PHY_OFF_LOOP_DELAY);
1416         }
1417
1418         return -EIO;
1419 }
1420
1421
1422 static int ipw2100_enable_adapter(struct ipw2100_priv *priv)
1423 {
1424         struct host_command cmd = {
1425                 .host_command = HOST_COMPLETE,
1426                 .host_command_sequence = 0,
1427                 .host_command_length = 0
1428         };
1429         int err = 0;
1430
1431         IPW_DEBUG_HC("HOST_COMPLETE\n");
1432
1433         if (priv->status & STATUS_ENABLED)
1434                 return 0;
1435
1436         down(&priv->adapter_sem);
1437
1438         if (rf_kill_active(priv)) {
1439                 IPW_DEBUG_HC("Command aborted due to RF kill active.\n");
1440                 goto fail_up;
1441         }
1442
1443         err = ipw2100_hw_send_command(priv, &cmd);
1444         if (err) {
1445                 IPW_DEBUG_INFO("Failed to send HOST_COMPLETE command\n");
1446                 goto fail_up;
1447         }
1448
1449         err = ipw2100_wait_for_card_state(priv, IPW_HW_STATE_ENABLED);
1450         if (err) {
1451                 IPW_DEBUG_INFO(
1452                        "%s: card not responding to init command.\n",
1453                        priv->net_dev->name);
1454                 goto fail_up;
1455         }
1456
1457         if (priv->stop_hang_check) {
1458                 priv->stop_hang_check = 0;
1459                 queue_delayed_work(priv->workqueue, &priv->hang_check, HZ / 2);
1460         }
1461
1462 fail_up:
1463         up(&priv->adapter_sem);
1464         return err;
1465 }
1466
1467 static int ipw2100_hw_stop_adapter(struct ipw2100_priv *priv)
1468 {
1469 #define HW_POWER_DOWN_DELAY (HZ / 10)
1470
1471         struct host_command cmd = {
1472                 .host_command = HOST_PRE_POWER_DOWN,
1473                 .host_command_sequence = 0,
1474                 .host_command_length = 0,
1475         };
1476         int err, i;
1477         u32 reg;
1478
1479         if (!(priv->status & STATUS_RUNNING))
1480                 return 0;
1481
1482         priv->status |= STATUS_STOPPING;
1483
1484         /* We can only shut down the card if the firmware is operational.  So,
1485          * if we haven't reset since a fatal_error, then we can not send the
1486          * shutdown commands. */
1487         if (!priv->fatal_error) {
1488                 /* First, make sure the adapter is enabled so that the PHY_OFF
1489                  * command can shut it down */
1490                 ipw2100_enable_adapter(priv);
1491
1492                 err = ipw2100_hw_phy_off(priv);
1493                 if (err)
1494                         printk(KERN_WARNING DRV_NAME ": Error disabling radio %d\n", err);
1495
1496                 /*
1497                  * If in D0-standby mode going directly to D3 may cause a
1498                  * PCI bus violation.  Therefore we must change out of the D0
1499                  * state.
1500                  *
1501                  * Sending the PREPARE_FOR_POWER_DOWN will restrict the
1502                  * hardware from going into standby mode and will transition
1503                  * out of D0-standy if it is already in that state.
1504                  *
1505                  * STATUS_PREPARE_POWER_DOWN_COMPLETE will be sent by the
1506                  * driver upon completion.  Once received, the driver can
1507                  * proceed to the D3 state.
1508                  *
1509                  * Prepare for power down command to fw.  This command would
1510                  * take HW out of D0-standby and prepare it for D3 state.
1511                  *
1512                  * Currently FW does not support event notification for this
1513                  * event. Therefore, skip waiting for it.  Just wait a fixed
1514                  * 100ms
1515                  */
1516                 IPW_DEBUG_HC("HOST_PRE_POWER_DOWN\n");
1517
1518                 err = ipw2100_hw_send_command(priv, &cmd);
1519                 if (err)
1520                         printk(KERN_WARNING DRV_NAME ": "
1521                                "%s: Power down command failed: Error %d\n",
1522                                priv->net_dev->name, err);
1523                 else {
1524                         set_current_state(TASK_UNINTERRUPTIBLE);
1525                         schedule_timeout(HW_POWER_DOWN_DELAY);
1526                 }
1527         }
1528
1529         priv->status &= ~STATUS_ENABLED;
1530
1531         /*
1532          * Set GPIO 3 writable by FW; GPIO 1 writable
1533          * by driver and enable clock
1534          */
1535         ipw2100_hw_set_gpio(priv);
1536
1537         /*
1538          * Power down adapter.  Sequence:
1539          * 1. Stop master assert (RESET_REG[9]=1)
1540          * 2. Wait for stop master (RESET_REG[8]==1)
1541          * 3. S/w reset assert (RESET_REG[7] = 1)
1542          */
1543
1544         /* Stop master assert */
1545         write_register(priv->net_dev, IPW_REG_RESET_REG,
1546                        IPW_AUX_HOST_RESET_REG_STOP_MASTER);
1547
1548         /* wait stop master not more than 50 usec.
1549          * Otherwise return error. */
1550         for (i = 5; i > 0; i--) {
1551                 udelay(10);
1552
1553                 /* Check master stop bit */
1554                 read_register(priv->net_dev, IPW_REG_RESET_REG, &reg);
1555
1556                 if (reg & IPW_AUX_HOST_RESET_REG_MASTER_DISABLED)
1557                         break;
1558         }
1559
1560         if (i == 0)
1561                 printk(KERN_WARNING DRV_NAME
1562                        ": %s: Could now power down adapter.\n",
1563                        priv->net_dev->name);
1564
1565         /* assert s/w reset */
1566         write_register(priv->net_dev, IPW_REG_RESET_REG,
1567                        IPW_AUX_HOST_RESET_REG_SW_RESET);
1568
1569         priv->status &= ~(STATUS_RUNNING | STATUS_STOPPING);
1570
1571         return 0;
1572 }
1573
1574
1575 static int ipw2100_disable_adapter(struct ipw2100_priv *priv)
1576 {
1577         struct host_command cmd = {
1578                 .host_command = CARD_DISABLE,
1579                 .host_command_sequence = 0,
1580                 .host_command_length = 0
1581         };
1582         int err = 0;
1583
1584         IPW_DEBUG_HC("CARD_DISABLE\n");
1585
1586         if (!(priv->status & STATUS_ENABLED))
1587                 return 0;
1588
1589         /* Make sure we clear the associated state */
1590         priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
1591
1592         if (!priv->stop_hang_check) {
1593                 priv->stop_hang_check = 1;
1594                 cancel_delayed_work(&priv->hang_check);
1595         }
1596
1597         down(&priv->adapter_sem);
1598
1599         err = ipw2100_hw_send_command(priv, &cmd);
1600         if (err) {
1601                 printk(KERN_WARNING DRV_NAME ": exit - failed to send CARD_DISABLE command\n");
1602                 goto fail_up;
1603         }
1604
1605         err = ipw2100_wait_for_card_state(priv, IPW_HW_STATE_DISABLED);
1606         if (err) {
1607                 printk(KERN_WARNING DRV_NAME ": exit - card failed to change to DISABLED\n");
1608                 goto fail_up;
1609         }
1610
1611         IPW_DEBUG_INFO("TODO: implement scan state machine\n");
1612
1613 fail_up:
1614         up(&priv->adapter_sem);
1615         return err;
1616 }
1617
1618 static int ipw2100_set_scan_options(struct ipw2100_priv *priv)
1619 {
1620         struct host_command cmd = {
1621                 .host_command = SET_SCAN_OPTIONS,
1622                 .host_command_sequence = 0,
1623                 .host_command_length = 8
1624         };
1625         int err;
1626
1627         IPW_DEBUG_INFO("enter\n");
1628
1629         IPW_DEBUG_SCAN("setting scan options\n");
1630
1631         cmd.host_command_parameters[0] = 0;
1632
1633         if (!(priv->config & CFG_ASSOCIATE))
1634                 cmd.host_command_parameters[0] |= IPW_SCAN_NOASSOCIATE;
1635         if ((priv->sec.flags & SEC_ENABLED) && priv->sec.enabled)
1636                 cmd.host_command_parameters[0] |= IPW_SCAN_MIXED_CELL;
1637         if (priv->config & CFG_PASSIVE_SCAN)
1638                 cmd.host_command_parameters[0] |= IPW_SCAN_PASSIVE;
1639
1640         cmd.host_command_parameters[1] = priv->channel_mask;
1641
1642         err = ipw2100_hw_send_command(priv, &cmd);
1643
1644         IPW_DEBUG_HC("SET_SCAN_OPTIONS 0x%04X\n",
1645                      cmd.host_command_parameters[0]);
1646
1647         return err;
1648 }
1649
1650 static int ipw2100_start_scan(struct ipw2100_priv *priv)
1651 {
1652         struct host_command cmd = {
1653                 .host_command = BROADCAST_SCAN,
1654                 .host_command_sequence = 0,
1655                 .host_command_length = 4
1656         };
1657         int err;
1658
1659         IPW_DEBUG_HC("START_SCAN\n");
1660
1661         cmd.host_command_parameters[0] = 0;
1662
1663         /* No scanning if in monitor mode */
1664         if (priv->ieee->iw_mode == IW_MODE_MONITOR)
1665                 return 1;
1666
1667         if (priv->status & STATUS_SCANNING) {
1668                 IPW_DEBUG_SCAN("Scan requested while already in scan...\n");
1669                 return 0;
1670         }
1671
1672         IPW_DEBUG_INFO("enter\n");
1673
1674         /* Not clearing here; doing so makes iwlist always return nothing...
1675          *
1676          * We should modify the table logic to use aging tables vs. clearing
1677          * the table on each scan start.
1678          */
1679         IPW_DEBUG_SCAN("starting scan\n");
1680
1681         priv->status |= STATUS_SCANNING;
1682         err = ipw2100_hw_send_command(priv, &cmd);
1683         if (err)
1684                 priv->status &= ~STATUS_SCANNING;
1685
1686         IPW_DEBUG_INFO("exit\n");
1687
1688         return err;
1689 }
1690
1691 static int ipw2100_up(struct ipw2100_priv *priv, int deferred)
1692 {
1693         unsigned long flags;
1694         int rc = 0;
1695         u32 lock;
1696         u32 ord_len = sizeof(lock);
1697
1698         /* Quite if manually disabled. */
1699         if (priv->status & STATUS_RF_KILL_SW) {
1700                 IPW_DEBUG_INFO("%s: Radio is disabled by Manual Disable "
1701                                "switch\n", priv->net_dev->name);
1702                 return 0;
1703         }
1704
1705         /* If the interrupt is enabled, turn it off... */
1706         spin_lock_irqsave(&priv->low_lock, flags);
1707         ipw2100_disable_interrupts(priv);
1708
1709         /* Reset any fatal_error conditions */
1710         ipw2100_reset_fatalerror(priv);
1711         spin_unlock_irqrestore(&priv->low_lock, flags);
1712
1713         if (priv->status & STATUS_POWERED ||
1714             (priv->status & STATUS_RESET_PENDING)) {
1715                 /* Power cycle the card ... */
1716                 if (ipw2100_power_cycle_adapter(priv)) {
1717                         printk(KERN_WARNING DRV_NAME ": %s: Could not cycle adapter.\n",
1718                                           priv->net_dev->name);
1719                         rc = 1;
1720                         goto exit;
1721                 }
1722         } else
1723                 priv->status |= STATUS_POWERED;
1724
1725         /* Load the firmware, start the clocks, etc. */
1726         if (ipw2100_start_adapter(priv)) {
1727                 printk(KERN_ERR DRV_NAME ": %s: Failed to start the firmware.\n",
1728                                 priv->net_dev->name);
1729                 rc = 1;
1730                 goto exit;
1731         }
1732
1733         ipw2100_initialize_ordinals(priv);
1734
1735         /* Determine capabilities of this particular HW configuration */
1736         if (ipw2100_get_hw_features(priv)) {
1737                 printk(KERN_ERR DRV_NAME ": %s: Failed to determine HW features.\n",
1738                                 priv->net_dev->name);
1739                 rc = 1;
1740                 goto exit;
1741         }
1742
1743         lock = LOCK_NONE;
1744         if (ipw2100_set_ordinal(priv, IPW_ORD_PERS_DB_LOCK, &lock, &ord_len)) {
1745                 printk(KERN_ERR DRV_NAME ": %s: Failed to clear ordinal lock.\n",
1746                                 priv->net_dev->name);
1747                 rc = 1;
1748                 goto exit;
1749         }
1750
1751         priv->status &= ~STATUS_SCANNING;
1752
1753         if (rf_kill_active(priv)) {
1754                 printk(KERN_INFO "%s: Radio is disabled by RF switch.\n",
1755                        priv->net_dev->name);
1756
1757                 if (priv->stop_rf_kill) {
1758                         priv->stop_rf_kill = 0;
1759                         queue_delayed_work(priv->workqueue, &priv->rf_kill, HZ);
1760                 }
1761
1762                 deferred = 1;
1763         }
1764
1765         /* Turn on the interrupt so that commands can be processed */
1766         ipw2100_enable_interrupts(priv);
1767
1768         /* Send all of the commands that must be sent prior to
1769          * HOST_COMPLETE */
1770         if (ipw2100_adapter_setup(priv)) {
1771                 printk(KERN_ERR DRV_NAME ": %s: Failed to start the card.\n",
1772                                 priv->net_dev->name);
1773                 rc = 1;
1774                 goto exit;
1775         }
1776
1777         if (!deferred) {
1778                 /* Enable the adapter - sends HOST_COMPLETE */
1779                 if (ipw2100_enable_adapter(priv)) {
1780                         printk(KERN_ERR DRV_NAME ": "
1781                                 "%s: failed in call to enable adapter.\n",
1782                                 priv->net_dev->name);
1783                         ipw2100_hw_stop_adapter(priv);
1784                         rc = 1;
1785                         goto exit;
1786                 }
1787
1788
1789                 /* Start a scan . . . */
1790                 ipw2100_set_scan_options(priv);
1791                 ipw2100_start_scan(priv);
1792         }
1793
1794  exit:
1795         return rc;
1796 }
1797
1798 /* Called by register_netdev() */
1799 static int ipw2100_net_init(struct net_device *dev)
1800 {
1801         struct ipw2100_priv *priv = ieee80211_priv(dev);
1802         return ipw2100_up(priv, 1);
1803 }
1804
1805 static void ipw2100_down(struct ipw2100_priv *priv)
1806 {
1807         unsigned long flags;
1808         union iwreq_data wrqu = {
1809                 .ap_addr = {
1810                         .sa_family = ARPHRD_ETHER
1811                 }
1812         };
1813         int associated = priv->status & STATUS_ASSOCIATED;
1814
1815         /* Kill the RF switch timer */
1816         if (!priv->stop_rf_kill) {
1817                 priv->stop_rf_kill = 1;
1818                 cancel_delayed_work(&priv->rf_kill);
1819         }
1820
1821         /* Kill the firmare hang check timer */
1822         if (!priv->stop_hang_check) {
1823                 priv->stop_hang_check = 1;
1824                 cancel_delayed_work(&priv->hang_check);
1825         }
1826
1827         /* Kill any pending resets */
1828         if (priv->status & STATUS_RESET_PENDING)
1829                 cancel_delayed_work(&priv->reset_work);
1830
1831         /* Make sure the interrupt is on so that FW commands will be
1832          * processed correctly */
1833         spin_lock_irqsave(&priv->low_lock, flags);
1834         ipw2100_enable_interrupts(priv);
1835         spin_unlock_irqrestore(&priv->low_lock, flags);
1836
1837         if (ipw2100_hw_stop_adapter(priv))
1838                 printk(KERN_ERR DRV_NAME ": %s: Error stopping adapter.\n",
1839                        priv->net_dev->name);
1840
1841         /* Do not disable the interrupt until _after_ we disable
1842          * the adaptor.  Otherwise the CARD_DISABLE command will never
1843          * be ack'd by the firmware */
1844         spin_lock_irqsave(&priv->low_lock, flags);
1845         ipw2100_disable_interrupts(priv);
1846         spin_unlock_irqrestore(&priv->low_lock, flags);
1847
1848 #ifdef ACPI_CSTATE_LIMIT_DEFINED
1849         if (priv->config & CFG_C3_DISABLED) {
1850                 IPW_DEBUG_INFO(DRV_NAME ": Resetting C3 transitions.\n");
1851                 acpi_set_cstate_limit(priv->cstate_limit);
1852                 priv->config &= ~CFG_C3_DISABLED;
1853         }
1854 #endif
1855
1856         /* We have to signal any supplicant if we are disassociating */
1857         if (associated)
1858                 wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
1859
1860         priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
1861         netif_carrier_off(priv->net_dev);
1862         netif_stop_queue(priv->net_dev);
1863 }
1864
1865 static void ipw2100_reset_adapter(struct ipw2100_priv *priv)
1866 {
1867         unsigned long flags;
1868         union iwreq_data wrqu = {
1869                 .ap_addr = {
1870                         .sa_family = ARPHRD_ETHER
1871                 }
1872         };
1873         int associated = priv->status & STATUS_ASSOCIATED;
1874
1875         spin_lock_irqsave(&priv->low_lock, flags);
1876         IPW_DEBUG_INFO(DRV_NAME ": %s: Restarting adapter.\n",
1877                        priv->net_dev->name);
1878         priv->resets++;
1879         priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
1880         priv->status |= STATUS_SECURITY_UPDATED;
1881
1882         /* Force a power cycle even if interface hasn't been opened
1883          * yet */
1884         cancel_delayed_work(&priv->reset_work);
1885         priv->status |= STATUS_RESET_PENDING;
1886         spin_unlock_irqrestore(&priv->low_lock, flags);
1887
1888         down(&priv->action_sem);
1889         /* stop timed checks so that they don't interfere with reset */
1890         priv->stop_hang_check = 1;
1891         cancel_delayed_work(&priv->hang_check);
1892
1893         /* We have to signal any supplicant if we are disassociating */
1894         if (associated)
1895                 wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
1896
1897         ipw2100_up(priv, 0);
1898         up(&priv->action_sem);
1899
1900 }
1901
1902
1903 static void isr_indicate_associated(struct ipw2100_priv *priv, u32 status)
1904 {
1905
1906 #define MAC_ASSOCIATION_READ_DELAY (HZ)
1907         int ret, len, essid_len;
1908         char essid[IW_ESSID_MAX_SIZE];
1909         u32 txrate;
1910         u32 chan;
1911         char *txratename;
1912         u8 bssid[ETH_ALEN];
1913
1914         /*
1915          * TBD: BSSID is usually 00:00:00:00:00:00 here and not
1916          *      an actual MAC of the AP. Seems like FW sets this
1917          *      address too late. Read it later and expose through
1918          *      /proc or schedule a later task to query and update
1919          */
1920
1921         essid_len = IW_ESSID_MAX_SIZE;
1922         ret = ipw2100_get_ordinal(priv, IPW_ORD_STAT_ASSN_SSID,
1923                                   essid, &essid_len);
1924         if (ret) {
1925                 IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
1926                                    __LINE__);
1927                 return;
1928         }
1929
1930         len = sizeof(u32);
1931         ret = ipw2100_get_ordinal(priv, IPW_ORD_CURRENT_TX_RATE,
1932                                   &txrate, &len);
1933         if (ret) {
1934                 IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
1935                                    __LINE__);
1936                 return;
1937         }
1938
1939         len = sizeof(u32);
1940         ret = ipw2100_get_ordinal(priv, IPW_ORD_OUR_FREQ, &chan, &len);
1941         if (ret) {
1942                 IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
1943                                    __LINE__);
1944                 return;
1945         }
1946         len = ETH_ALEN;
1947         ipw2100_get_ordinal(priv, IPW_ORD_STAT_ASSN_AP_BSSID, &bssid,  &len);
1948         if (ret) {
1949                 IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
1950                                    __LINE__);
1951                 return;
1952         }
1953         memcpy(priv->ieee->bssid, bssid, ETH_ALEN);
1954
1955
1956         switch (txrate) {
1957         case TX_RATE_1_MBIT:
1958                 txratename = "1Mbps";
1959                 break;
1960         case TX_RATE_2_MBIT:
1961                 txratename = "2Mbsp";
1962                 break;
1963         case TX_RATE_5_5_MBIT:
1964                 txratename = "5.5Mbps";
1965                 break;
1966         case TX_RATE_11_MBIT:
1967                 txratename = "11Mbps";
1968                 break;
1969         default:
1970                 IPW_DEBUG_INFO("Unknown rate: %d\n", txrate);
1971                 txratename = "unknown rate";
1972                 break;
1973         }
1974
1975         IPW_DEBUG_INFO("%s: Associated with '%s' at %s, channel %d (BSSID="
1976                        MAC_FMT ")\n",
1977                        priv->net_dev->name, escape_essid(essid, essid_len),
1978                        txratename, chan, MAC_ARG(bssid));
1979
1980         /* now we copy read ssid into dev */
1981         if (!(priv->config & CFG_STATIC_ESSID)) {
1982                 priv->essid_len = min((u8)essid_len, (u8)IW_ESSID_MAX_SIZE);
1983                 memcpy(priv->essid, essid, priv->essid_len);
1984         }
1985         priv->channel = chan;
1986         memcpy(priv->bssid, bssid, ETH_ALEN);
1987
1988         priv->status |= STATUS_ASSOCIATING;
1989         priv->connect_start = get_seconds();
1990
1991         queue_delayed_work(priv->workqueue, &priv->wx_event_work, HZ / 10);
1992 }
1993
1994
1995 static int ipw2100_set_essid(struct ipw2100_priv *priv, char *essid,
1996                              int length, int batch_mode)
1997 {
1998         int ssid_len = min(length, IW_ESSID_MAX_SIZE);
1999         struct host_command cmd = {
2000                 .host_command = SSID,
2001                 .host_command_sequence = 0,
2002                 .host_command_length = ssid_len
2003         };
2004         int err;
2005
2006         IPW_DEBUG_HC("SSID: '%s'\n", escape_essid(essid, ssid_len));
2007
2008         if (ssid_len)
2009                 memcpy((char*)cmd.host_command_parameters,
2010                        essid, ssid_len);
2011
2012         if (!batch_mode) {
2013                 err = ipw2100_disable_adapter(priv);
2014                 if (err)
2015                         return err;
2016         }
2017
2018         /* Bug in FW currently doesn't honor bit 0 in SET_SCAN_OPTIONS to
2019          * disable auto association -- so we cheat by setting a bogus SSID */
2020         if (!ssid_len && !(priv->config & CFG_ASSOCIATE)) {
2021                 int i;
2022                 u8 *bogus = (u8*)cmd.host_command_parameters;
2023                 for (i = 0; i < IW_ESSID_MAX_SIZE; i++)
2024                         bogus[i] = 0x18 + i;
2025                 cmd.host_command_length = IW_ESSID_MAX_SIZE;
2026         }
2027
2028         /* NOTE:  We always send the SSID command even if the provided ESSID is
2029          * the same as what we currently think is set. */
2030
2031         err = ipw2100_hw_send_command(priv, &cmd);
2032         if (!err) {
2033                 memset(priv->essid + ssid_len, 0,
2034                        IW_ESSID_MAX_SIZE - ssid_len);
2035                 memcpy(priv->essid, essid, ssid_len);
2036                 priv->essid_len = ssid_len;
2037         }
2038
2039         if (!batch_mode) {
2040                 if (ipw2100_enable_adapter(priv))
2041                         err = -EIO;
2042         }
2043
2044         return err;
2045 }
2046
2047 static void isr_indicate_association_lost(struct ipw2100_priv *priv, u32 status)
2048 {
2049         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
2050                   "disassociated: '%s' " MAC_FMT " \n",
2051                   escape_essid(priv->essid, priv->essid_len),
2052                   MAC_ARG(priv->bssid));
2053
2054         priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
2055
2056         if (priv->status & STATUS_STOPPING) {
2057                 IPW_DEBUG_INFO("Card is stopping itself, discard ASSN_LOST.\n");
2058                 return;
2059         }
2060
2061         memset(priv->bssid, 0, ETH_ALEN);
2062         memset(priv->ieee->bssid, 0, ETH_ALEN);
2063
2064         netif_carrier_off(priv->net_dev);
2065         netif_stop_queue(priv->net_dev);
2066
2067         if (!(priv->status & STATUS_RUNNING))
2068                 return;
2069
2070         if (priv->status & STATUS_SECURITY_UPDATED)
2071                 queue_work(priv->workqueue, &priv->security_work);
2072
2073         queue_work(priv->workqueue, &priv->wx_event_work);
2074 }
2075
2076 static void isr_indicate_rf_kill(struct ipw2100_priv *priv, u32 status)
2077 {
2078         IPW_DEBUG_INFO("%s: RF Kill state changed to radio OFF.\n",
2079                priv->net_dev->name);
2080
2081         /* RF_KILL is now enabled (else we wouldn't be here) */
2082         priv->status |= STATUS_RF_KILL_HW;
2083
2084 #ifdef ACPI_CSTATE_LIMIT_DEFINED
2085         if (priv->config & CFG_C3_DISABLED) {
2086                 IPW_DEBUG_INFO(DRV_NAME ": Resetting C3 transitions.\n");
2087                 acpi_set_cstate_limit(priv->cstate_limit);
2088                 priv->config &= ~CFG_C3_DISABLED;
2089         }
2090 #endif
2091
2092         /* Make sure the RF Kill check timer is running */
2093         priv->stop_rf_kill = 0;
2094         cancel_delayed_work(&priv->rf_kill);
2095         queue_delayed_work(priv->workqueue, &priv->rf_kill, HZ);
2096 }
2097
2098 static void isr_scan_complete(struct ipw2100_priv *priv, u32 status)
2099 {
2100         IPW_DEBUG_SCAN("scan complete\n");
2101         /* Age the scan results... */
2102         priv->ieee->scans++;
2103         priv->status &= ~STATUS_SCANNING;
2104 }
2105
2106 #ifdef CONFIG_IPW_DEBUG
2107 #define IPW2100_HANDLER(v, f) { v, f, # v }
2108 struct ipw2100_status_indicator {
2109         int status;
2110         void (*cb)(struct ipw2100_priv *priv, u32 status);
2111         char *name;
2112 };
2113 #else
2114 #define IPW2100_HANDLER(v, f) { v, f }
2115 struct ipw2100_status_indicator {
2116         int status;
2117         void (*cb)(struct ipw2100_priv *priv, u32 status);
2118 };
2119 #endif /* CONFIG_IPW_DEBUG */
2120
2121 static void isr_indicate_scanning(struct ipw2100_priv *priv, u32 status)
2122 {
2123         IPW_DEBUG_SCAN("Scanning...\n");
2124         priv->status |= STATUS_SCANNING;
2125 }
2126
2127 static const struct ipw2100_status_indicator status_handlers[] = {
2128         IPW2100_HANDLER(IPW_STATE_INITIALIZED, 0),
2129         IPW2100_HANDLER(IPW_STATE_COUNTRY_FOUND, 0),
2130         IPW2100_HANDLER(IPW_STATE_ASSOCIATED, isr_indicate_associated),
2131         IPW2100_HANDLER(IPW_STATE_ASSN_LOST, isr_indicate_association_lost),
2132         IPW2100_HANDLER(IPW_STATE_ASSN_CHANGED, 0),
2133         IPW2100_HANDLER(IPW_STATE_SCAN_COMPLETE, isr_scan_complete),
2134         IPW2100_HANDLER(IPW_STATE_ENTERED_PSP, 0),
2135         IPW2100_HANDLER(IPW_STATE_LEFT_PSP, 0),
2136         IPW2100_HANDLER(IPW_STATE_RF_KILL, isr_indicate_rf_kill),
2137         IPW2100_HANDLER(IPW_STATE_DISABLED, 0),
2138         IPW2100_HANDLER(IPW_STATE_POWER_DOWN, 0),
2139         IPW2100_HANDLER(IPW_STATE_SCANNING, isr_indicate_scanning),
2140         IPW2100_HANDLER(-1, 0)
2141 };
2142
2143
2144 static void isr_status_change(struct ipw2100_priv *priv, int status)
2145 {
2146         int i;
2147
2148         if (status == IPW_STATE_SCANNING &&
2149             priv->status & STATUS_ASSOCIATED &&
2150             !(priv->status & STATUS_SCANNING)) {
2151                 IPW_DEBUG_INFO("Scan detected while associated, with "
2152                                "no scan request.  Restarting firmware.\n");
2153
2154                 /* Wake up any sleeping jobs */
2155                 schedule_reset(priv);
2156         }
2157
2158         for (i = 0; status_handlers[i].status != -1; i++) {
2159                 if (status == status_handlers[i].status) {
2160                         IPW_DEBUG_NOTIF("Status change: %s\n",
2161                                          status_handlers[i].name);
2162                         if (status_handlers[i].cb)
2163                                 status_handlers[i].cb(priv, status);
2164                         priv->wstats.status = status;
2165                         return;
2166                 }
2167         }
2168
2169         IPW_DEBUG_NOTIF("unknown status received: %04x\n", status);
2170 }
2171
2172 static void isr_rx_complete_command(
2173         struct ipw2100_priv *priv,
2174         struct ipw2100_cmd_header *cmd)
2175 {
2176 #ifdef CONFIG_IPW_DEBUG
2177         if (cmd->host_command_reg < ARRAY_SIZE(command_types)) {
2178                 IPW_DEBUG_HC("Command completed '%s (%d)'\n",
2179                              command_types[cmd->host_command_reg],
2180                              cmd->host_command_reg);
2181         }
2182 #endif
2183         if (cmd->host_command_reg == HOST_COMPLETE)
2184                 priv->status |= STATUS_ENABLED;
2185
2186         if (cmd->host_command_reg == CARD_DISABLE)
2187                 priv->status &= ~STATUS_ENABLED;
2188
2189         priv->status &= ~STATUS_CMD_ACTIVE;
2190
2191         wake_up_interruptible(&priv->wait_command_queue);
2192 }
2193
2194 #ifdef CONFIG_IPW_DEBUG
2195 static const char *frame_types[] = {
2196         "COMMAND_STATUS_VAL",
2197         "STATUS_CHANGE_VAL",
2198         "P80211_DATA_VAL",
2199         "P8023_DATA_VAL",
2200         "HOST_NOTIFICATION_VAL"
2201 };
2202 #endif
2203
2204
2205 static inline int ipw2100_alloc_skb(
2206         struct ipw2100_priv *priv,
2207         struct ipw2100_rx_packet *packet)
2208 {
2209         packet->skb = dev_alloc_skb(sizeof(struct ipw2100_rx));
2210         if (!packet->skb)
2211                 return -ENOMEM;
2212
2213         packet->rxp = (struct ipw2100_rx *)packet->skb->data;
2214         packet->dma_addr = pci_map_single(priv->pci_dev, packet->skb->data,
2215                                           sizeof(struct ipw2100_rx),
2216                                           PCI_DMA_FROMDEVICE);
2217         /* NOTE: pci_map_single does not return an error code, and 0 is a valid
2218          *       dma_addr */
2219
2220         return 0;
2221 }
2222
2223
2224 #define SEARCH_ERROR   0xffffffff
2225 #define SEARCH_FAIL    0xfffffffe
2226 #define SEARCH_SUCCESS 0xfffffff0
2227 #define SEARCH_DISCARD 0
2228 #define SEARCH_SNAPSHOT 1
2229
2230 #define SNAPSHOT_ADDR(ofs) (priv->snapshot[((ofs) >> 12) & 0xff] + ((ofs) & 0xfff))
2231 static inline int ipw2100_snapshot_alloc(struct ipw2100_priv *priv)
2232 {
2233         int i;
2234         if (priv->snapshot[0])
2235                 return 1;
2236         for (i = 0; i < 0x30; i++) {
2237                 priv->snapshot[i] = (u8*)kmalloc(0x1000, GFP_ATOMIC);
2238                 if (!priv->snapshot[i]) {
2239                         IPW_DEBUG_INFO("%s: Error allocating snapshot "
2240                                "buffer %d\n", priv->net_dev->name, i);
2241                         while (i > 0)
2242                                 kfree(priv->snapshot[--i]);
2243                         priv->snapshot[0] = NULL;
2244                         return 0;
2245                 }
2246         }
2247
2248         return 1;
2249 }
2250
2251 static inline void ipw2100_snapshot_free(struct ipw2100_priv *priv)
2252 {
2253         int i;
2254         if (!priv->snapshot[0])
2255                 return;
2256         for (i = 0; i < 0x30; i++)
2257                 kfree(priv->snapshot[i]);
2258         priv->snapshot[0] = NULL;
2259 }
2260
2261 static inline u32 ipw2100_match_buf(struct ipw2100_priv *priv, u8 *in_buf,
2262                                     size_t len, int mode)
2263 {
2264         u32 i, j;
2265         u32 tmp;
2266         u8 *s, *d;
2267         u32 ret;
2268
2269         s = in_buf;
2270         if (mode == SEARCH_SNAPSHOT) {
2271                 if (!ipw2100_snapshot_alloc(priv))
2272                         mode = SEARCH_DISCARD;
2273         }
2274
2275         for (ret = SEARCH_FAIL, i = 0; i < 0x30000; i += 4) {
2276                 read_nic_dword(priv->net_dev, i, &tmp);
2277                 if (mode == SEARCH_SNAPSHOT)
2278                         *(u32 *)SNAPSHOT_ADDR(i) = tmp;
2279                 if (ret == SEARCH_FAIL) {
2280                         d = (u8*)&tmp;
2281                         for (j = 0; j < 4; j++) {
2282                                 if (*s != *d) {
2283                                         s = in_buf;
2284                                         continue;
2285                                 }
2286
2287                                 s++;
2288                                 d++;
2289
2290                                 if ((s - in_buf) == len)
2291                                         ret = (i + j) - len + 1;
2292                         }
2293                 } else if (mode == SEARCH_DISCARD)
2294                         return ret;
2295         }
2296
2297         return ret;
2298 }
2299
2300 /*
2301  *
2302  * 0) Disconnect the SKB from the firmware (just unmap)
2303  * 1) Pack the ETH header into the SKB
2304  * 2) Pass the SKB to the network stack
2305  *
2306  * When packet is provided by the firmware, it contains the following:
2307  *
2308  * .  ieee80211_hdr
2309  * .  ieee80211_snap_hdr
2310  *
2311  * The size of the constructed ethernet
2312  *
2313  */
2314 #ifdef CONFIG_IPW2100_RX_DEBUG
2315 static u8 packet_data[IPW_RX_NIC_BUFFER_LENGTH];
2316 #endif
2317
2318 static inline void ipw2100_corruption_detected(struct ipw2100_priv *priv,
2319                                                int i)
2320 {
2321 #ifdef CONFIG_IPW_DEBUG_C3
2322         struct ipw2100_status *status = &priv->status_queue.drv[i];
2323         u32 match, reg;
2324         int j;
2325 #endif
2326 #ifdef ACPI_CSTATE_LIMIT_DEFINED
2327         int limit;
2328 #endif
2329
2330         IPW_DEBUG_INFO(DRV_NAME ": PCI latency error detected at "
2331                        "0x%04zX.\n", i * sizeof(struct ipw2100_status));
2332
2333 #ifdef ACPI_CSTATE_LIMIT_DEFINED
2334         IPW_DEBUG_INFO(DRV_NAME ": Disabling C3 transitions.\n");
2335         limit = acpi_get_cstate_limit();
2336         if (limit > 2) {
2337                 priv->cstate_limit = limit;
2338                 acpi_set_cstate_limit(2);
2339                 priv->config |= CFG_C3_DISABLED;
2340         }
2341 #endif
2342
2343 #ifdef CONFIG_IPW_DEBUG_C3
2344         /* Halt the fimrware so we can get a good image */
2345         write_register(priv->net_dev, IPW_REG_RESET_REG,
2346                        IPW_AUX_HOST_RESET_REG_STOP_MASTER);
2347         j = 5;
2348         do {
2349                 udelay(IPW_WAIT_RESET_MASTER_ASSERT_COMPLETE_DELAY);
2350                 read_register(priv->net_dev, IPW_REG_RESET_REG, &reg);
2351
2352                 if (reg & IPW_AUX_HOST_RESET_REG_MASTER_DISABLED)
2353                         break;
2354         }  while (j--);
2355
2356         match = ipw2100_match_buf(priv, (u8*)status,
2357                                   sizeof(struct ipw2100_status),
2358                                   SEARCH_SNAPSHOT);
2359         if (match < SEARCH_SUCCESS)
2360                 IPW_DEBUG_INFO("%s: DMA status match in Firmware at "
2361                                "offset 0x%06X, length %d:\n",
2362                                priv->net_dev->name, match,
2363                                sizeof(struct ipw2100_status));
2364         else
2365                 IPW_DEBUG_INFO("%s: No DMA status match in "
2366                                "Firmware.\n", priv->net_dev->name);
2367
2368         printk_buf((u8*)priv->status_queue.drv,
2369                    sizeof(struct ipw2100_status) * RX_QUEUE_LENGTH);
2370 #endif
2371
2372         priv->fatal_error = IPW2100_ERR_C3_CORRUPTION;
2373         priv->ieee->stats.rx_errors++;
2374         schedule_reset(priv);
2375 }
2376
2377 static inline void isr_rx(struct ipw2100_priv *priv, int i,
2378                           struct ieee80211_rx_stats *stats)
2379 {
2380         struct ipw2100_status *status = &priv->status_queue.drv[i];
2381         struct ipw2100_rx_packet *packet = &priv->rx_buffers[i];
2382
2383         IPW_DEBUG_RX("Handler...\n");
2384
2385         if (unlikely(status->frame_size > skb_tailroom(packet->skb))) {
2386                 IPW_DEBUG_INFO("%s: frame_size (%u) > skb_tailroom (%u)!"
2387                                "  Dropping.\n",
2388                                priv->net_dev->name,
2389                                status->frame_size, skb_tailroom(packet->skb));
2390                 priv->ieee->stats.rx_errors++;
2391                 return;
2392         }
2393
2394         if (unlikely(!netif_running(priv->net_dev))) {
2395                 priv->ieee->stats.rx_errors++;
2396                 priv->wstats.discard.misc++;
2397                 IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
2398                 return;
2399         }
2400
2401         if (unlikely(priv->ieee->iw_mode == IW_MODE_MONITOR &&
2402                      status->flags & IPW_STATUS_FLAG_CRC_ERROR)) {
2403                 IPW_DEBUG_RX("CRC error in packet.  Dropping.\n");
2404                 priv->ieee->stats.rx_errors++;
2405                 return;
2406         }
2407
2408         if (unlikely(priv->ieee->iw_mode != IW_MODE_MONITOR &&
2409                 !(priv->status & STATUS_ASSOCIATED))) {
2410                 IPW_DEBUG_DROP("Dropping packet while not associated.\n");
2411                 priv->wstats.discard.misc++;
2412                 return;
2413         }
2414
2415
2416         pci_unmap_single(priv->pci_dev,
2417                          packet->dma_addr,
2418                          sizeof(struct ipw2100_rx),
2419                          PCI_DMA_FROMDEVICE);
2420
2421         skb_put(packet->skb, status->frame_size);
2422
2423 #ifdef CONFIG_IPW2100_RX_DEBUG
2424         /* Make a copy of the frame so we can dump it to the logs if
2425          * ieee80211_rx fails */
2426         memcpy(packet_data, packet->skb->data,
2427                min_t(u32, status->frame_size, IPW_RX_NIC_BUFFER_LENGTH));
2428 #endif
2429
2430         if (!ieee80211_rx(priv->ieee, packet->skb, stats)) {
2431 #ifdef CONFIG_IPW2100_RX_DEBUG
2432                 IPW_DEBUG_DROP("%s: Non consumed packet:\n",
2433                                priv->net_dev->name);
2434                 printk_buf(IPW_DL_DROP, packet_data, status->frame_size);
2435 #endif
2436                 priv->ieee->stats.rx_errors++;
2437
2438                 /* ieee80211_rx failed, so it didn't free the SKB */
2439                 dev_kfree_skb_any(packet->skb);
2440                 packet->skb = NULL;
2441         }
2442
2443         /* We need to allocate a new SKB and attach it to the RDB. */
2444         if (unlikely(ipw2100_alloc_skb(priv, packet))) {
2445                 printk(KERN_WARNING DRV_NAME ": "
2446                         "%s: Unable to allocate SKB onto RBD ring - disabling "
2447                         "adapter.\n", priv->net_dev->name);
2448                 /* TODO: schedule adapter shutdown */
2449                 IPW_DEBUG_INFO("TODO: Shutdown adapter...\n");
2450         }
2451
2452         /* Update the RDB entry */
2453         priv->rx_queue.drv[i].host_addr = packet->dma_addr;
2454 }
2455
2456 static inline int ipw2100_corruption_check(struct ipw2100_priv *priv, int i)
2457 {
2458         struct ipw2100_status *status = &priv->status_queue.drv[i];
2459         struct ipw2100_rx *u = priv->rx_buffers[i].rxp;
2460         u16 frame_type = status->status_fields & STATUS_TYPE_MASK;
2461
2462         switch (frame_type) {
2463         case COMMAND_STATUS_VAL:
2464                 return (status->frame_size != sizeof(u->rx_data.command));
2465         case STATUS_CHANGE_VAL:
2466                 return (status->frame_size != sizeof(u->rx_data.status));
2467         case HOST_NOTIFICATION_VAL:
2468                 return (status->frame_size < sizeof(u->rx_data.notification));
2469         case P80211_DATA_VAL:
2470         case P8023_DATA_VAL:
2471 #ifdef CONFIG_IPW2100_MONITOR
2472                 return 0;
2473 #else
2474                 switch (WLAN_FC_GET_TYPE(u->rx_data.header.frame_ctl)) {
2475                 case IEEE80211_FTYPE_MGMT:
2476                 case IEEE80211_FTYPE_CTL:
2477                         return 0;
2478                 case IEEE80211_FTYPE_DATA:
2479                         return (status->frame_size >
2480                                 IPW_MAX_802_11_PAYLOAD_LENGTH);
2481                 }
2482 #endif
2483         }
2484
2485         return 1;
2486 }
2487
2488 /*
2489  * ipw2100 interrupts are disabled at this point, and the ISR
2490  * is the only code that calls this method.  So, we do not need
2491  * to play with any locks.
2492  *
2493  * RX Queue works as follows:
2494  *
2495  * Read index - firmware places packet in entry identified by the
2496  *              Read index and advances Read index.  In this manner,
2497  *              Read index will always point to the next packet to
2498  *              be filled--but not yet valid.
2499  *
2500  * Write index - driver fills this entry with an unused RBD entry.
2501  *               This entry has not filled by the firmware yet.
2502  *
2503  * In between the W and R indexes are the RBDs that have been received
2504  * but not yet processed.
2505  *
2506  * The process of handling packets will start at WRITE + 1 and advance
2507  * until it reaches the READ index.
2508  *
2509  * The WRITE index is cached in the variable 'priv->rx_queue.next'.
2510  *
2511  */
2512 static inline void __ipw2100_rx_process(struct ipw2100_priv *priv)
2513 {
2514         struct ipw2100_bd_queue *rxq = &priv->rx_queue;
2515         struct ipw2100_status_queue *sq = &priv->status_queue;
2516         struct ipw2100_rx_packet *packet;
2517         u16 frame_type;
2518         u32 r, w, i, s;
2519         struct ipw2100_rx *u;
2520         struct ieee80211_rx_stats stats = {
2521                 .mac_time = jiffies,
2522         };
2523
2524         read_register(priv->net_dev, IPW_MEM_HOST_SHARED_RX_READ_INDEX, &r);
2525         read_register(priv->net_dev, IPW_MEM_HOST_SHARED_RX_WRITE_INDEX, &w);
2526
2527         if (r >= rxq->entries) {
2528                 IPW_DEBUG_RX("exit - bad read index\n");
2529                 return;
2530         }
2531
2532         i = (rxq->next + 1) % rxq->entries;
2533         s = i;
2534         while (i != r) {
2535                 /* IPW_DEBUG_RX("r = %d : w = %d : processing = %d\n",
2536                    r, rxq->next, i); */
2537
2538                 packet = &priv->rx_buffers[i];
2539
2540                 /* Sync the DMA for the STATUS buffer so CPU is sure to get
2541                  * the correct values */
2542                 pci_dma_sync_single_for_cpu(
2543                         priv->pci_dev,
2544                         sq->nic + sizeof(struct ipw2100_status) * i,
2545                         sizeof(struct ipw2100_status),
2546                         PCI_DMA_FROMDEVICE);
2547
2548                 /* Sync the DMA for the RX buffer so CPU is sure to get
2549                  * the correct values */
2550                 pci_dma_sync_single_for_cpu(priv->pci_dev, packet->dma_addr,
2551                                             sizeof(struct ipw2100_rx),
2552                                             PCI_DMA_FROMDEVICE);
2553
2554                 if (unlikely(ipw2100_corruption_check(priv, i))) {
2555                         ipw2100_corruption_detected(priv, i);
2556                         goto increment;
2557                 }
2558
2559                 u = packet->rxp;
2560                 frame_type = sq->drv[i].status_fields &
2561                         STATUS_TYPE_MASK;
2562                 stats.rssi = sq->drv[i].rssi + IPW2100_RSSI_TO_DBM;
2563                 stats.len = sq->drv[i].frame_size;
2564
2565                 stats.mask = 0;
2566                 if (stats.rssi != 0)
2567                         stats.mask |= IEEE80211_STATMASK_RSSI;
2568                 stats.freq = IEEE80211_24GHZ_BAND;
2569
2570                 IPW_DEBUG_RX(
2571                         "%s: '%s' frame type received (%d).\n",
2572                         priv->net_dev->name, frame_types[frame_type],
2573                         stats.len);
2574
2575                 switch (frame_type) {
2576                 case COMMAND_STATUS_VAL:
2577                         /* Reset Rx watchdog */
2578                         isr_rx_complete_command(
2579                                 priv, &u->rx_data.command);
2580                         break;
2581
2582                 case STATUS_CHANGE_VAL:
2583                         isr_status_change(priv, u->rx_data.status);
2584                         break;
2585
2586                 case P80211_DATA_VAL:
2587                 case P8023_DATA_VAL:
2588 #ifdef CONFIG_IPW2100_MONITOR
2589                         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
2590                                 isr_rx(priv, i, &stats);
2591                                 break;
2592                         }
2593 #endif
2594                         if (stats.len < sizeof(u->rx_data.header))
2595                                 break;
2596                         switch (WLAN_FC_GET_TYPE(u->rx_data.header.
2597                                                  frame_ctl)) {
2598                         case IEEE80211_FTYPE_MGMT:
2599                                 ieee80211_rx_mgt(priv->ieee,
2600                                                  &u->rx_data.header,
2601                                                  &stats);
2602                                 break;
2603
2604                         case IEEE80211_FTYPE_CTL:
2605                                 break;
2606
2607                         case IEEE80211_FTYPE_DATA:
2608                                 isr_rx(priv, i, &stats);
2609                                 break;
2610
2611                         }
2612                         break;
2613                 }
2614
2615         increment:
2616                 /* clear status field associated with this RBD */
2617                 rxq->drv[i].status.info.field = 0;
2618
2619                 i = (i + 1) % rxq->entries;
2620         }
2621
2622         if (i != s) {
2623                 /* backtrack one entry, wrapping to end if at 0 */
2624                 rxq->next = (i ? i : rxq->entries) - 1;
2625
2626                 write_register(priv->net_dev,
2627                                IPW_MEM_HOST_SHARED_RX_WRITE_INDEX,
2628                                rxq->next);
2629         }
2630 }
2631
2632
2633 /*
2634  * __ipw2100_tx_process
2635  *
2636  * This routine will determine whether the next packet on
2637  * the fw_pend_list has been processed by the firmware yet.
2638  *
2639  * If not, then it does nothing and returns.
2640  *
2641  * If so, then it removes the item from the fw_pend_list, frees
2642  * any associated storage, and places the item back on the
2643  * free list of its source (either msg_free_list or tx_free_list)
2644  *
2645  * TX Queue works as follows:
2646  *
2647  * Read index - points to the next TBD that the firmware will
2648  *              process.  The firmware will read the data, and once
2649  *              done processing, it will advance the Read index.
2650  *
2651  * Write index - driver fills this entry with an constructed TBD
2652  *               entry.  The Write index is not advanced until the
2653  *               packet has been configured.
2654  *
2655  * In between the W and R indexes are the TBDs that have NOT been
2656  * processed.  Lagging behind the R index are packets that have
2657  * been processed but have not been freed by the driver.
2658  *
2659  * In order to free old storage, an internal index will be maintained
2660  * that points to the next packet to be freed.  When all used
2661  * packets have been freed, the oldest index will be the same as the
2662  * firmware's read index.
2663  *
2664  * The OLDEST index is cached in the variable 'priv->tx_queue.oldest'
2665  *
2666  * Because the TBD structure can not contain arbitrary data, the
2667  * driver must keep an internal queue of cached allocations such that
2668  * it can put that data back into the tx_free_list and msg_free_list
2669  * for use by future command and data packets.
2670  *
2671  */
2672 static inline int __ipw2100_tx_process(struct ipw2100_priv *priv)
2673 {
2674         struct ipw2100_bd_queue *txq = &priv->tx_queue;
2675         struct ipw2100_bd *tbd;
2676         struct list_head *element;
2677         struct ipw2100_tx_packet *packet;
2678         int descriptors_used;
2679         int e, i;
2680         u32 r, w, frag_num = 0;
2681
2682         if (list_empty(&priv->fw_pend_list))
2683                 return 0;
2684
2685         element = priv->fw_pend_list.next;
2686
2687         packet = list_entry(element, struct ipw2100_tx_packet, list);
2688         tbd = &txq->drv[packet->index];
2689
2690         /* Determine how many TBD entries must be finished... */
2691         switch (packet->type) {
2692         case COMMAND:
2693                 /* COMMAND uses only one slot; don't advance */
2694                 descriptors_used = 1;
2695                 e = txq->oldest;
2696                 break;
2697
2698         case DATA:
2699                 /* DATA uses two slots; advance and loop position. */
2700                 descriptors_used = tbd->num_fragments;
2701                 frag_num = tbd->num_fragments - 1;
2702                 e = txq->oldest + frag_num;
2703                 e %= txq->entries;
2704                 break;
2705
2706         default:
2707                 printk(KERN_WARNING DRV_NAME ": %s: Bad fw_pend_list entry!\n",
2708                                    priv->net_dev->name);
2709                 return 0;
2710         }
2711
2712         /* if the last TBD is not done by NIC yet, then packet is
2713          * not ready to be released.
2714          *
2715          */
2716         read_register(priv->net_dev, IPW_MEM_HOST_SHARED_TX_QUEUE_READ_INDEX,
2717                       &r);
2718         read_register(priv->net_dev, IPW_MEM_HOST_SHARED_TX_QUEUE_WRITE_INDEX,
2719                       &w);
2720         if (w != txq->next)
2721                 printk(KERN_WARNING DRV_NAME ": %s: write index mismatch\n",
2722                        priv->net_dev->name);
2723
2724         /*
2725          * txq->next is the index of the last packet written txq->oldest is
2726          * the index of the r is the index of the next packet to be read by
2727          * firmware
2728          */
2729
2730
2731         /*
2732          * Quick graphic to help you visualize the following
2733          * if / else statement
2734          *
2735          * ===>|                     s---->|===============
2736          *                               e>|
2737          * | a | b | c | d | e | f | g | h | i | j | k | l
2738          *       r---->|
2739          *               w
2740          *
2741          * w - updated by driver
2742          * r - updated by firmware
2743          * s - start of oldest BD entry (txq->oldest)
2744          * e - end of oldest BD entry
2745          *
2746          */
2747         if (!((r <= w && (e < r || e >= w)) || (e < r && e >= w))) {
2748                 IPW_DEBUG_TX("exit - no processed packets ready to release.\n");
2749                 return 0;
2750         }
2751
2752         list_del(element);
2753         DEC_STAT(&priv->fw_pend_stat);
2754
2755 #ifdef CONFIG_IPW_DEBUG
2756         {
2757                 int i = txq->oldest;
2758                 IPW_DEBUG_TX(
2759                         "TX%d V=%p P=%04X T=%04X L=%d\n", i,
2760                         &txq->drv[i],
2761                         (u32)(txq->nic + i * sizeof(struct ipw2100_bd)),
2762                         txq->drv[i].host_addr,
2763                         txq->drv[i].buf_length);
2764
2765                 if (packet->type == DATA) {
2766                         i = (i + 1) % txq->entries;
2767
2768                         IPW_DEBUG_TX(
2769                                 "TX%d V=%p P=%04X T=%04X L=%d\n", i,
2770                                 &txq->drv[i],
2771                                 (u32)(txq->nic + i *
2772                                 sizeof(struct ipw2100_bd)),
2773                                 (u32)txq->drv[i].host_addr,
2774                                 txq->drv[i].buf_length);
2775                 }
2776         }
2777 #endif
2778
2779         switch (packet->type) {
2780         case DATA:
2781                 if (txq->drv[txq->oldest].status.info.fields.txType != 0)
2782                         printk(KERN_WARNING DRV_NAME ": %s: Queue mismatch.  "
2783                                "Expecting DATA TBD but pulled "
2784                                "something else: ids %d=%d.\n",
2785                                priv->net_dev->name, txq->oldest, packet->index);
2786
2787                 /* DATA packet; we have to unmap and free the SKB */
2788                 priv->ieee->stats.tx_packets++;
2789                 for (i = 0; i < frag_num; i++) {
2790                         tbd = &txq->drv[(packet->index + 1 + i) %
2791                                         txq->entries];
2792
2793                         IPW_DEBUG_TX(
2794                                 "TX%d P=%08x L=%d\n",
2795                                 (packet->index + 1 + i) % txq->entries,
2796                                 tbd->host_addr, tbd->buf_length);
2797
2798                         pci_unmap_single(priv->pci_dev,
2799                                          tbd->host_addr,
2800                                          tbd->buf_length,
2801                                          PCI_DMA_TODEVICE);
2802                 }
2803
2804                 priv->ieee->stats.tx_bytes += packet->info.d_struct.txb->payload_size;
2805                 ieee80211_txb_free(packet->info.d_struct.txb);
2806                 packet->info.d_struct.txb = NULL;
2807
2808                 list_add_tail(element, &priv->tx_free_list);
2809                 INC_STAT(&priv->tx_free_stat);
2810
2811                 /* We have a free slot in the Tx queue, so wake up the
2812                  * transmit layer if it is stopped. */
2813                 if (priv->status & STATUS_ASSOCIATED &&
2814                     netif_queue_stopped(priv->net_dev)) {
2815                         IPW_DEBUG_INFO(KERN_INFO
2816                                            "%s: Waking net queue.\n",
2817                                            priv->net_dev->name);
2818                         netif_wake_queue(priv->net_dev);
2819                 }
2820
2821                 /* A packet was processed by the hardware, so update the
2822                  * watchdog */
2823                 priv->net_dev->trans_start = jiffies;
2824
2825                 break;
2826
2827         case COMMAND:
2828                 if (txq->drv[txq->oldest].status.info.fields.txType != 1)
2829                         printk(KERN_WARNING DRV_NAME ": %s: Queue mismatch.  "
2830                                "Expecting COMMAND TBD but pulled "
2831                                "something else: ids %d=%d.\n",
2832                                priv->net_dev->name, txq->oldest, packet->index);
2833
2834 #ifdef CONFIG_IPW_DEBUG
2835                 if (packet->info.c_struct.cmd->host_command_reg <
2836                     sizeof(command_types) / sizeof(*command_types))
2837                         IPW_DEBUG_TX(
2838                                 "Command '%s (%d)' processed: %d.\n",
2839                                 command_types[packet->info.c_struct.cmd->host_command_reg],
2840                                 packet->info.c_struct.cmd->host_command_reg,
2841                                 packet->info.c_struct.cmd->cmd_status_reg);
2842 #endif
2843
2844                 list_add_tail(element, &priv->msg_free_list);
2845                 INC_STAT(&priv->msg_free_stat);
2846                 break;
2847         }
2848
2849         /* advance oldest used TBD pointer to start of next entry */
2850         txq->oldest = (e + 1) % txq->entries;
2851         /* increase available TBDs number */
2852         txq->available += descriptors_used;
2853         SET_STAT(&priv->txq_stat, txq->available);
2854
2855         IPW_DEBUG_TX("packet latency (send to process)  %ld jiffies\n",
2856                          jiffies - packet->jiffy_start);
2857
2858         return (!list_empty(&priv->fw_pend_list));
2859 }
2860
2861
2862 static inline void __ipw2100_tx_complete(struct ipw2100_priv *priv)
2863 {
2864         int i = 0;
2865
2866         while (__ipw2100_tx_process(priv) && i < 200) i++;
2867
2868         if (i == 200) {
2869                 printk(KERN_WARNING DRV_NAME ": "
2870                        "%s: Driver is running slow (%d iters).\n",
2871                        priv->net_dev->name, i);
2872         }
2873 }
2874
2875
2876 static void ipw2100_tx_send_commands(struct ipw2100_priv *priv)
2877 {
2878         struct list_head *element;
2879         struct ipw2100_tx_packet *packet;
2880         struct ipw2100_bd_queue *txq = &priv->tx_queue;
2881         struct ipw2100_bd *tbd;
2882         int next = txq->next;
2883
2884         while (!list_empty(&priv->msg_pend_list)) {
2885                 /* if there isn't enough space in TBD queue, then
2886                  * don't stuff a new one in.
2887                  * NOTE: 3 are needed as a command will take one,
2888                  *       and there is a minimum of 2 that must be
2889                  *       maintained between the r and w indexes
2890                  */
2891                 if (txq->available <= 3) {
2892                         IPW_DEBUG_TX("no room in tx_queue\n");
2893                         break;
2894                 }
2895
2896                 element = priv->msg_pend_list.next;
2897                 list_del(element);
2898                 DEC_STAT(&priv->msg_pend_stat);
2899
2900                 packet = list_entry(element,
2901                                     struct ipw2100_tx_packet, list);
2902
2903                 IPW_DEBUG_TX("using TBD at virt=%p, phys=%p\n",
2904                                  &txq->drv[txq->next],
2905                                  (void*)(txq->nic + txq->next *
2906                                          sizeof(struct ipw2100_bd)));
2907
2908                 packet->index = txq->next;
2909
2910                 tbd = &txq->drv[txq->next];
2911
2912                 /* initialize TBD */
2913                 tbd->host_addr = packet->info.c_struct.cmd_phys;
2914                 tbd->buf_length = sizeof(struct ipw2100_cmd_header);
2915                 /* not marking number of fragments causes problems
2916                  * with f/w debug version */
2917                 tbd->num_fragments = 1;
2918                 tbd->status.info.field =
2919                         IPW_BD_STATUS_TX_FRAME_COMMAND |
2920                         IPW_BD_STATUS_TX_INTERRUPT_ENABLE;
2921
2922                 /* update TBD queue counters */
2923                 txq->next++;
2924                 txq->next %= txq->entries;
2925                 txq->available--;
2926                 DEC_STAT(&priv->txq_stat);
2927
2928                 list_add_tail(element, &priv->fw_pend_list);
2929                 INC_STAT(&priv->fw_pend_stat);
2930         }
2931
2932         if (txq->next != next) {
2933                 /* kick off the DMA by notifying firmware the
2934                  * write index has moved; make sure TBD stores are sync'd */
2935                 wmb();
2936                 write_register(priv->net_dev,
2937                                IPW_MEM_HOST_SHARED_TX_QUEUE_WRITE_INDEX,
2938                                txq->next);
2939         }
2940 }
2941
2942
2943 /*
2944  * ipw2100_tx_send_data
2945  *
2946  */
2947 static void ipw2100_tx_send_data(struct ipw2100_priv *priv)
2948 {
2949         struct list_head *element;
2950         struct ipw2100_tx_packet *packet;
2951         struct ipw2100_bd_queue *txq = &priv->tx_queue;
2952         struct ipw2100_bd *tbd;
2953         int next = txq->next;
2954         int i = 0;
2955         struct ipw2100_data_header *ipw_hdr;
2956         struct ieee80211_hdr *hdr;
2957
2958         while (!list_empty(&priv->tx_pend_list)) {
2959                 /* if there isn't enough space in TBD queue, then
2960                  * don't stuff a new one in.
2961                  * NOTE: 4 are needed as a data will take two,
2962                  *       and there is a minimum of 2 that must be
2963                  *       maintained between the r and w indexes
2964                  */
2965                 element = priv->tx_pend_list.next;
2966                 packet = list_entry(element, struct ipw2100_tx_packet, list);
2967
2968                 if (unlikely(1 + packet->info.d_struct.txb->nr_frags >
2969                              IPW_MAX_BDS)) {
2970                         /* TODO: Support merging buffers if more than
2971                          * IPW_MAX_BDS are used */
2972                         IPW_DEBUG_INFO(
2973                                "%s: Maximum BD theshold exceeded.  "
2974                                "Increase fragmentation level.\n",
2975                                priv->net_dev->name);
2976                 }
2977
2978                 if (txq->available <= 3 +
2979                     packet->info.d_struct.txb->nr_frags) {
2980                         IPW_DEBUG_TX("no room in tx_queue\n");
2981                         break;
2982                 }
2983
2984                 list_del(element);
2985                 DEC_STAT(&priv->tx_pend_stat);
2986
2987                 tbd = &txq->drv[txq->next];
2988
2989                 packet->index = txq->next;
2990
2991                 ipw_hdr = packet->info.d_struct.data;
2992                 hdr = (struct ieee80211_hdr *)packet->info.d_struct.txb->
2993                         fragments[0]->data;
2994
2995                 if (priv->ieee->iw_mode == IW_MODE_INFRA) {
2996                         /* To DS: Addr1 = BSSID, Addr2 = SA,
2997                            Addr3 = DA */
2998                         memcpy(ipw_hdr->src_addr, hdr->addr2, ETH_ALEN);
2999                         memcpy(ipw_hdr->dst_addr, hdr->addr3, ETH_ALEN);
3000                 } else if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
3001                         /* not From/To DS: Addr1 = DA, Addr2 = SA,
3002                            Addr3 = BSSID */
3003                         memcpy(ipw_hdr->src_addr, hdr->addr2, ETH_ALEN);
3004                         memcpy(ipw_hdr->dst_addr, hdr->addr1, ETH_ALEN);
3005                 }
3006
3007                 ipw_hdr->host_command_reg = SEND;
3008                 ipw_hdr->host_command_reg1 = 0;
3009
3010                 /* For now we only support host based encryption */
3011                 ipw_hdr->needs_encryption = 0;
3012                 ipw_hdr->encrypted = packet->info.d_struct.txb->encrypted;
3013                 if (packet->info.d_struct.txb->nr_frags > 1)
3014                         ipw_hdr->fragment_size =
3015                                 packet->info.d_struct.txb->frag_size - IEEE80211_3ADDR_LEN;
3016                 else
3017                         ipw_hdr->fragment_size = 0;
3018
3019                 tbd->host_addr = packet->info.d_struct.data_phys;
3020                 tbd->buf_length = sizeof(struct ipw2100_data_header);
3021                 tbd->num_fragments = 1 + packet->info.d_struct.txb->nr_frags;
3022                 tbd->status.info.field =
3023                         IPW_BD_STATUS_TX_FRAME_802_3 |
3024                         IPW_BD_STATUS_TX_FRAME_NOT_LAST_FRAGMENT;
3025                 txq->next++;
3026                 txq->next %= txq->entries;
3027
3028                 IPW_DEBUG_TX(
3029                         "data header tbd TX%d P=%08x L=%d\n",
3030                         packet->index, tbd->host_addr,
3031                         tbd->buf_length);
3032 #ifdef CONFIG_IPW_DEBUG
3033                 if (packet->info.d_struct.txb->nr_frags > 1)
3034                         IPW_DEBUG_FRAG("fragment Tx: %d frames\n",
3035                                        packet->info.d_struct.txb->nr_frags);
3036 #endif
3037
3038                 for (i = 0; i < packet->info.d_struct.txb->nr_frags; i++) {
3039                         tbd = &txq->drv[txq->next];
3040                         if (i == packet->info.d_struct.txb->nr_frags - 1)
3041                                 tbd->status.info.field =
3042                                         IPW_BD_STATUS_TX_FRAME_802_3 |
3043                                         IPW_BD_STATUS_TX_INTERRUPT_ENABLE;
3044                         else
3045                                 tbd->status.info.field =
3046                                         IPW_BD_STATUS_TX_FRAME_802_3 |
3047                                         IPW_BD_STATUS_TX_FRAME_NOT_LAST_FRAGMENT;
3048
3049                         tbd->buf_length = packet->info.d_struct.txb->
3050                                 fragments[i]->len - IEEE80211_3ADDR_LEN;
3051
3052                         tbd->host_addr = pci_map_single(
3053                                 priv->pci_dev,
3054                                 packet->info.d_struct.txb->fragments[i]->data +
3055                                 IEEE80211_3ADDR_LEN,
3056                                 tbd->buf_length,
3057                                 PCI_DMA_TODEVICE);
3058
3059                         IPW_DEBUG_TX(
3060                                 "data frag tbd TX%d P=%08x L=%d\n",
3061                                 txq->next, tbd->host_addr, tbd->buf_length);
3062
3063                         pci_dma_sync_single_for_device(
3064                                 priv->pci_dev, tbd->host_addr,
3065                                 tbd->buf_length,
3066                                 PCI_DMA_TODEVICE);
3067
3068                         txq->next++;
3069                         txq->next %= txq->entries;
3070                 }
3071
3072                 txq->available -= 1 + packet->info.d_struct.txb->nr_frags;
3073                 SET_STAT(&priv->txq_stat, txq->available);
3074
3075                 list_add_tail(element, &priv->fw_pend_list);
3076                 INC_STAT(&priv->fw_pend_stat);
3077         }
3078
3079         if (txq->next != next) {
3080                 /* kick off the DMA by notifying firmware the
3081                  * write index has moved; make sure TBD stores are sync'd */
3082                 write_register(priv->net_dev,
3083                                IPW_MEM_HOST_SHARED_TX_QUEUE_WRITE_INDEX,
3084                                txq->next);
3085         }
3086         return;
3087 }
3088
3089 static void ipw2100_irq_tasklet(struct ipw2100_priv *priv)
3090 {
3091         struct net_device *dev = priv->net_dev;
3092         unsigned long flags;
3093         u32 inta, tmp;
3094
3095         spin_lock_irqsave(&priv->low_lock, flags);
3096         ipw2100_disable_interrupts(priv);
3097
3098         read_register(dev, IPW_REG_INTA, &inta);
3099
3100         IPW_DEBUG_ISR("enter - INTA: 0x%08lX\n",
3101                       (unsigned long)inta & IPW_INTERRUPT_MASK);
3102
3103         priv->in_isr++;
3104         priv->interrupts++;
3105
3106         /* We do not loop and keep polling for more interrupts as this
3107          * is frowned upon and doesn't play nicely with other potentially
3108          * chained IRQs */
3109         IPW_DEBUG_ISR("INTA: 0x%08lX\n",
3110                       (unsigned long)inta & IPW_INTERRUPT_MASK);
3111
3112         if (inta & IPW2100_INTA_FATAL_ERROR) {
3113                 printk(KERN_WARNING DRV_NAME
3114                                   ": Fatal interrupt. Scheduling firmware restart.\n");
3115                 priv->inta_other++;
3116                 write_register(
3117                         dev, IPW_REG_INTA,
3118                         IPW2100_INTA_FATAL_ERROR);
3119
3120                 read_nic_dword(dev, IPW_NIC_FATAL_ERROR, &priv->fatal_error);
3121                 IPW_DEBUG_INFO("%s: Fatal error value: 0x%08X\n",
3122                                priv->net_dev->name, priv->fatal_error);
3123
3124                 read_nic_dword(dev, IPW_ERROR_ADDR(priv->fatal_error), &tmp);
3125                 IPW_DEBUG_INFO("%s: Fatal error address value: 0x%08X\n",
3126                                priv->net_dev->name, tmp);
3127
3128                 /* Wake up any sleeping jobs */
3129                 schedule_reset(priv);
3130         }
3131
3132         if (inta & IPW2100_INTA_PARITY_ERROR) {
3133                 printk(KERN_ERR DRV_NAME ": ***** PARITY ERROR INTERRUPT !!!! \n");
3134                 priv->inta_other++;
3135                 write_register(
3136                         dev, IPW_REG_INTA,
3137                         IPW2100_INTA_PARITY_ERROR);
3138         }
3139
3140         if (inta & IPW2100_INTA_RX_TRANSFER) {
3141                 IPW_DEBUG_ISR("RX interrupt\n");
3142
3143                 priv->rx_interrupts++;
3144
3145                 write_register(
3146                         dev, IPW_REG_INTA,
3147                         IPW2100_INTA_RX_TRANSFER);
3148
3149                 __ipw2100_rx_process(priv);
3150                 __ipw2100_tx_complete(priv);
3151         }
3152
3153         if (inta & IPW2100_INTA_TX_TRANSFER) {
3154                 IPW_DEBUG_ISR("TX interrupt\n");
3155
3156                 priv->tx_interrupts++;
3157
3158                 write_register(dev, IPW_REG_INTA,
3159                                IPW2100_INTA_TX_TRANSFER);
3160
3161                 __ipw2100_tx_complete(priv);
3162                 ipw2100_tx_send_commands(priv);
3163                 ipw2100_tx_send_data(priv);
3164         }
3165
3166         if (inta & IPW2100_INTA_TX_COMPLETE) {
3167                 IPW_DEBUG_ISR("TX complete\n");
3168                 priv->inta_other++;
3169                 write_register(
3170                         dev, IPW_REG_INTA,
3171                         IPW2100_INTA_TX_COMPLETE);
3172
3173                 __ipw2100_tx_complete(priv);
3174         }
3175
3176         if (inta & IPW2100_INTA_EVENT_INTERRUPT) {
3177                 /* ipw2100_handle_event(dev); */
3178                 priv->inta_other++;
3179                 write_register(
3180                         dev, IPW_REG_INTA,
3181                         IPW2100_INTA_EVENT_INTERRUPT);
3182         }
3183
3184         if (inta & IPW2100_INTA_FW_INIT_DONE) {
3185                 IPW_DEBUG_ISR("FW init done interrupt\n");
3186                 priv->inta_other++;
3187
3188                 read_register(dev, IPW_REG_INTA, &tmp);
3189                 if (tmp & (IPW2100_INTA_FATAL_ERROR |
3190                            IPW2100_INTA_PARITY_ERROR)) {
3191                         write_register(
3192                                 dev, IPW_REG_INTA,
3193                                 IPW2100_INTA_FATAL_ERROR |
3194                                 IPW2100_INTA_PARITY_ERROR);
3195                 }
3196
3197                 write_register(dev, IPW_REG_INTA,
3198                                IPW2100_INTA_FW_INIT_DONE);
3199         }
3200
3201         if (inta & IPW2100_INTA_STATUS_CHANGE) {
3202                 IPW_DEBUG_ISR("Status change interrupt\n");
3203                 priv->inta_other++;
3204                 write_register(
3205                         dev, IPW_REG_INTA,
3206                         IPW2100_INTA_STATUS_CHANGE);
3207         }
3208
3209         if (inta & IPW2100_INTA_SLAVE_MODE_HOST_COMMAND_DONE) {
3210                 IPW_DEBUG_ISR("slave host mode interrupt\n");
3211                 priv->inta_other++;
3212                 write_register(
3213                         dev, IPW_REG_INTA,
3214                         IPW2100_INTA_SLAVE_MODE_HOST_COMMAND_DONE);
3215         }
3216
3217         priv->in_isr--;
3218         ipw2100_enable_interrupts(priv);
3219
3220         spin_unlock_irqrestore(&priv->low_lock, flags);
3221
3222         IPW_DEBUG_ISR("exit\n");
3223 }
3224
3225
3226 static irqreturn_t ipw2100_interrupt(int irq, void *data,
3227                                      struct pt_regs *regs)
3228 {
3229         struct ipw2100_priv *priv = data;
3230         u32 inta, inta_mask;
3231
3232         if (!data)
3233                 return IRQ_NONE;
3234
3235         spin_lock(&priv->low_lock);
3236
3237         /* We check to see if we should be ignoring interrupts before
3238          * we touch the hardware.  During ucode load if we try and handle
3239          * an interrupt we can cause keyboard problems as well as cause
3240          * the ucode t