ipw2x00: relocate ipw2100/ipw2200 to common directory
[linux-3.10.git] / drivers / net / wireless / ipw2x00 / ipw2200.c
1 /******************************************************************************
2
3   Copyright(c) 2003 - 2006 Intel Corporation. All rights reserved.
4
5   802.11 status code portion of this file from ethereal-0.10.6:
6     Copyright 2000, Axis Communications AB
7     Ethereal - Network traffic analyzer
8     By Gerald Combs <gerald@ethereal.com>
9     Copyright 1998 Gerald Combs
10
11   This program is free software; you can redistribute it and/or modify it
12   under the terms of version 2 of the GNU General Public License as
13   published by the Free Software Foundation.
14
15   This program is distributed in the hope that it will be useful, but WITHOUT
16   ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
17   FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
18   more details.
19
20   You should have received a copy of the GNU General Public License along with
21   this program; if not, write to the Free Software Foundation, Inc., 59
22   Temple Place - Suite 330, Boston, MA  02111-1307, USA.
23
24   The full GNU General Public License is included in this distribution in the
25   file called LICENSE.
26
27   Contact Information:
28   James P. Ketrenos <ipw2100-admin@linux.intel.com>
29   Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
30
31 ******************************************************************************/
32
33 #include "ipw2200.h"
34
35
36 #ifndef KBUILD_EXTMOD
37 #define VK "k"
38 #else
39 #define VK
40 #endif
41
42 #ifdef CONFIG_IPW2200_DEBUG
43 #define VD "d"
44 #else
45 #define VD
46 #endif
47
48 #ifdef CONFIG_IPW2200_MONITOR
49 #define VM "m"
50 #else
51 #define VM
52 #endif
53
54 #ifdef CONFIG_IPW2200_PROMISCUOUS
55 #define VP "p"
56 #else
57 #define VP
58 #endif
59
60 #ifdef CONFIG_IPW2200_RADIOTAP
61 #define VR "r"
62 #else
63 #define VR
64 #endif
65
66 #ifdef CONFIG_IPW2200_QOS
67 #define VQ "q"
68 #else
69 #define VQ
70 #endif
71
72 #define IPW2200_VERSION "1.2.2" VK VD VM VP VR VQ
73 #define DRV_DESCRIPTION "Intel(R) PRO/Wireless 2200/2915 Network Driver"
74 #define DRV_COPYRIGHT   "Copyright(c) 2003-2006 Intel Corporation"
75 #define DRV_VERSION     IPW2200_VERSION
76
77 #define ETH_P_80211_STATS (ETH_P_80211_RAW + 1)
78
79 MODULE_DESCRIPTION(DRV_DESCRIPTION);
80 MODULE_VERSION(DRV_VERSION);
81 MODULE_AUTHOR(DRV_COPYRIGHT);
82 MODULE_LICENSE("GPL");
83
84 static int cmdlog = 0;
85 static int debug = 0;
86 static int channel = 0;
87 static int mode = 0;
88
89 static u32 ipw_debug_level;
90 static int associate;
91 static int auto_create = 1;
92 static int led = 0;
93 static int disable = 0;
94 static int bt_coexist = 0;
95 static int hwcrypto = 0;
96 static int roaming = 1;
97 static const char ipw_modes[] = {
98         'a', 'b', 'g', '?'
99 };
100 static int antenna = CFG_SYS_ANTENNA_BOTH;
101
102 #ifdef CONFIG_IPW2200_PROMISCUOUS
103 static int rtap_iface = 0;     /* def: 0 -- do not create rtap interface */
104 #endif
105
106
107 #ifdef CONFIG_IPW2200_QOS
108 static int qos_enable = 0;
109 static int qos_burst_enable = 0;
110 static int qos_no_ack_mask = 0;
111 static int burst_duration_CCK = 0;
112 static int burst_duration_OFDM = 0;
113
114 static struct ieee80211_qos_parameters def_qos_parameters_OFDM = {
115         {QOS_TX0_CW_MIN_OFDM, QOS_TX1_CW_MIN_OFDM, QOS_TX2_CW_MIN_OFDM,
116          QOS_TX3_CW_MIN_OFDM},
117         {QOS_TX0_CW_MAX_OFDM, QOS_TX1_CW_MAX_OFDM, QOS_TX2_CW_MAX_OFDM,
118          QOS_TX3_CW_MAX_OFDM},
119         {QOS_TX0_AIFS, QOS_TX1_AIFS, QOS_TX2_AIFS, QOS_TX3_AIFS},
120         {QOS_TX0_ACM, QOS_TX1_ACM, QOS_TX2_ACM, QOS_TX3_ACM},
121         {QOS_TX0_TXOP_LIMIT_OFDM, QOS_TX1_TXOP_LIMIT_OFDM,
122          QOS_TX2_TXOP_LIMIT_OFDM, QOS_TX3_TXOP_LIMIT_OFDM}
123 };
124
125 static struct ieee80211_qos_parameters def_qos_parameters_CCK = {
126         {QOS_TX0_CW_MIN_CCK, QOS_TX1_CW_MIN_CCK, QOS_TX2_CW_MIN_CCK,
127          QOS_TX3_CW_MIN_CCK},
128         {QOS_TX0_CW_MAX_CCK, QOS_TX1_CW_MAX_CCK, QOS_TX2_CW_MAX_CCK,
129          QOS_TX3_CW_MAX_CCK},
130         {QOS_TX0_AIFS, QOS_TX1_AIFS, QOS_TX2_AIFS, QOS_TX3_AIFS},
131         {QOS_TX0_ACM, QOS_TX1_ACM, QOS_TX2_ACM, QOS_TX3_ACM},
132         {QOS_TX0_TXOP_LIMIT_CCK, QOS_TX1_TXOP_LIMIT_CCK, QOS_TX2_TXOP_LIMIT_CCK,
133          QOS_TX3_TXOP_LIMIT_CCK}
134 };
135
136 static struct ieee80211_qos_parameters def_parameters_OFDM = {
137         {DEF_TX0_CW_MIN_OFDM, DEF_TX1_CW_MIN_OFDM, DEF_TX2_CW_MIN_OFDM,
138          DEF_TX3_CW_MIN_OFDM},
139         {DEF_TX0_CW_MAX_OFDM, DEF_TX1_CW_MAX_OFDM, DEF_TX2_CW_MAX_OFDM,
140          DEF_TX3_CW_MAX_OFDM},
141         {DEF_TX0_AIFS, DEF_TX1_AIFS, DEF_TX2_AIFS, DEF_TX3_AIFS},
142         {DEF_TX0_ACM, DEF_TX1_ACM, DEF_TX2_ACM, DEF_TX3_ACM},
143         {DEF_TX0_TXOP_LIMIT_OFDM, DEF_TX1_TXOP_LIMIT_OFDM,
144          DEF_TX2_TXOP_LIMIT_OFDM, DEF_TX3_TXOP_LIMIT_OFDM}
145 };
146
147 static struct ieee80211_qos_parameters def_parameters_CCK = {
148         {DEF_TX0_CW_MIN_CCK, DEF_TX1_CW_MIN_CCK, DEF_TX2_CW_MIN_CCK,
149          DEF_TX3_CW_MIN_CCK},
150         {DEF_TX0_CW_MAX_CCK, DEF_TX1_CW_MAX_CCK, DEF_TX2_CW_MAX_CCK,
151          DEF_TX3_CW_MAX_CCK},
152         {DEF_TX0_AIFS, DEF_TX1_AIFS, DEF_TX2_AIFS, DEF_TX3_AIFS},
153         {DEF_TX0_ACM, DEF_TX1_ACM, DEF_TX2_ACM, DEF_TX3_ACM},
154         {DEF_TX0_TXOP_LIMIT_CCK, DEF_TX1_TXOP_LIMIT_CCK, DEF_TX2_TXOP_LIMIT_CCK,
155          DEF_TX3_TXOP_LIMIT_CCK}
156 };
157
158 static u8 qos_oui[QOS_OUI_LEN] = { 0x00, 0x50, 0xF2 };
159
160 static int from_priority_to_tx_queue[] = {
161         IPW_TX_QUEUE_1, IPW_TX_QUEUE_2, IPW_TX_QUEUE_2, IPW_TX_QUEUE_1,
162         IPW_TX_QUEUE_3, IPW_TX_QUEUE_3, IPW_TX_QUEUE_4, IPW_TX_QUEUE_4
163 };
164
165 static u32 ipw_qos_get_burst_duration(struct ipw_priv *priv);
166
167 static int ipw_send_qos_params_command(struct ipw_priv *priv, struct ieee80211_qos_parameters
168                                        *qos_param);
169 static int ipw_send_qos_info_command(struct ipw_priv *priv, struct ieee80211_qos_information_element
170                                      *qos_param);
171 #endif                          /* CONFIG_IPW2200_QOS */
172
173 static struct iw_statistics *ipw_get_wireless_stats(struct net_device *dev);
174 static void ipw_remove_current_network(struct ipw_priv *priv);
175 static void ipw_rx(struct ipw_priv *priv);
176 static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
177                                 struct clx2_tx_queue *txq, int qindex);
178 static int ipw_queue_reset(struct ipw_priv *priv);
179
180 static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
181                              int len, int sync);
182
183 static void ipw_tx_queue_free(struct ipw_priv *);
184
185 static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *);
186 static void ipw_rx_queue_free(struct ipw_priv *, struct ipw_rx_queue *);
187 static void ipw_rx_queue_replenish(void *);
188 static int ipw_up(struct ipw_priv *);
189 static void ipw_bg_up(struct work_struct *work);
190 static void ipw_down(struct ipw_priv *);
191 static void ipw_bg_down(struct work_struct *work);
192 static int ipw_config(struct ipw_priv *);
193 static int init_supported_rates(struct ipw_priv *priv,
194                                 struct ipw_supported_rates *prates);
195 static void ipw_set_hwcrypto_keys(struct ipw_priv *);
196 static void ipw_send_wep_keys(struct ipw_priv *, int);
197
198 static int snprint_line(char *buf, size_t count,
199                         const u8 * data, u32 len, u32 ofs)
200 {
201         int out, i, j, l;
202         char c;
203
204         out = snprintf(buf, count, "%08X", ofs);
205
206         for (l = 0, i = 0; i < 2; i++) {
207                 out += snprintf(buf + out, count - out, " ");
208                 for (j = 0; j < 8 && l < len; j++, l++)
209                         out += snprintf(buf + out, count - out, "%02X ",
210                                         data[(i * 8 + j)]);
211                 for (; j < 8; j++)
212                         out += snprintf(buf + out, count - out, "   ");
213         }
214
215         out += snprintf(buf + out, count - out, " ");
216         for (l = 0, i = 0; i < 2; i++) {
217                 out += snprintf(buf + out, count - out, " ");
218                 for (j = 0; j < 8 && l < len; j++, l++) {
219                         c = data[(i * 8 + j)];
220                         if (!isascii(c) || !isprint(c))
221                                 c = '.';
222
223                         out += snprintf(buf + out, count - out, "%c", c);
224                 }
225
226                 for (; j < 8; j++)
227                         out += snprintf(buf + out, count - out, " ");
228         }
229
230         return out;
231 }
232
233 static void printk_buf(int level, const u8 * data, u32 len)
234 {
235         char line[81];
236         u32 ofs = 0;
237         if (!(ipw_debug_level & level))
238                 return;
239
240         while (len) {
241                 snprint_line(line, sizeof(line), &data[ofs],
242                              min(len, 16U), ofs);
243                 printk(KERN_DEBUG "%s\n", line);
244                 ofs += 16;
245                 len -= min(len, 16U);
246         }
247 }
248
249 static int snprintk_buf(u8 * output, size_t size, const u8 * data, size_t len)
250 {
251         size_t out = size;
252         u32 ofs = 0;
253         int total = 0;
254
255         while (size && len) {
256                 out = snprint_line(output, size, &data[ofs],
257                                    min_t(size_t, len, 16U), ofs);
258
259                 ofs += 16;
260                 output += out;
261                 size -= out;
262                 len -= min_t(size_t, len, 16U);
263                 total += out;
264         }
265         return total;
266 }
267
268 /* alias for 32-bit indirect read (for SRAM/reg above 4K), with debug wrapper */
269 static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg);
270 #define ipw_read_reg32(a, b) _ipw_read_reg32(a, b)
271
272 /* alias for 8-bit indirect read (for SRAM/reg above 4K), with debug wrapper */
273 static u8 _ipw_read_reg8(struct ipw_priv *ipw, u32 reg);
274 #define ipw_read_reg8(a, b) _ipw_read_reg8(a, b)
275
276 /* 8-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
277 static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value);
278 static inline void ipw_write_reg8(struct ipw_priv *a, u32 b, u8 c)
279 {
280         IPW_DEBUG_IO("%s %d: write_indirect8(0x%08X, 0x%08X)\n", __FILE__,
281                      __LINE__, (u32) (b), (u32) (c));
282         _ipw_write_reg8(a, b, c);
283 }
284
285 /* 16-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
286 static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value);
287 static inline void ipw_write_reg16(struct ipw_priv *a, u32 b, u16 c)
288 {
289         IPW_DEBUG_IO("%s %d: write_indirect16(0x%08X, 0x%08X)\n", __FILE__,
290                      __LINE__, (u32) (b), (u32) (c));
291         _ipw_write_reg16(a, b, c);
292 }
293
294 /* 32-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
295 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value);
296 static inline void ipw_write_reg32(struct ipw_priv *a, u32 b, u32 c)
297 {
298         IPW_DEBUG_IO("%s %d: write_indirect32(0x%08X, 0x%08X)\n", __FILE__,
299                      __LINE__, (u32) (b), (u32) (c));
300         _ipw_write_reg32(a, b, c);
301 }
302
303 /* 8-bit direct write (low 4K) */
304 #define _ipw_write8(ipw, ofs, val) writeb((val), (ipw)->hw_base + (ofs))
305
306 /* 8-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
307 #define ipw_write8(ipw, ofs, val) do { \
308  IPW_DEBUG_IO("%s %d: write_direct8(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
309  _ipw_write8(ipw, ofs, val); \
310  } while (0)
311
312 /* 16-bit direct write (low 4K) */
313 #define _ipw_write16(ipw, ofs, val) writew((val), (ipw)->hw_base + (ofs))
314
315 /* 16-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
316 #define ipw_write16(ipw, ofs, val) \
317  IPW_DEBUG_IO("%s %d: write_direct16(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
318  _ipw_write16(ipw, ofs, val)
319
320 /* 32-bit direct write (low 4K) */
321 #define _ipw_write32(ipw, ofs, val) writel((val), (ipw)->hw_base + (ofs))
322
323 /* 32-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
324 #define ipw_write32(ipw, ofs, val) \
325  IPW_DEBUG_IO("%s %d: write_direct32(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
326  _ipw_write32(ipw, ofs, val)
327
328 /* 8-bit direct read (low 4K) */
329 #define _ipw_read8(ipw, ofs) readb((ipw)->hw_base + (ofs))
330
331 /* 8-bit direct read (low 4K), with debug wrapper */
332 static inline u8 __ipw_read8(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
333 {
334         IPW_DEBUG_IO("%s %d: read_direct8(0x%08X)\n", f, l, (u32) (ofs));
335         return _ipw_read8(ipw, ofs);
336 }
337
338 /* alias to 8-bit direct read (low 4K of SRAM/regs), with debug wrapper */
339 #define ipw_read8(ipw, ofs) __ipw_read8(__FILE__, __LINE__, ipw, ofs)
340
341 /* 16-bit direct read (low 4K) */
342 #define _ipw_read16(ipw, ofs) readw((ipw)->hw_base + (ofs))
343
344 /* 16-bit direct read (low 4K), with debug wrapper */
345 static inline u16 __ipw_read16(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
346 {
347         IPW_DEBUG_IO("%s %d: read_direct16(0x%08X)\n", f, l, (u32) (ofs));
348         return _ipw_read16(ipw, ofs);
349 }
350
351 /* alias to 16-bit direct read (low 4K of SRAM/regs), with debug wrapper */
352 #define ipw_read16(ipw, ofs) __ipw_read16(__FILE__, __LINE__, ipw, ofs)
353
354 /* 32-bit direct read (low 4K) */
355 #define _ipw_read32(ipw, ofs) readl((ipw)->hw_base + (ofs))
356
357 /* 32-bit direct read (low 4K), with debug wrapper */
358 static inline u32 __ipw_read32(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
359 {
360         IPW_DEBUG_IO("%s %d: read_direct32(0x%08X)\n", f, l, (u32) (ofs));
361         return _ipw_read32(ipw, ofs);
362 }
363
364 /* alias to 32-bit direct read (low 4K of SRAM/regs), with debug wrapper */
365 #define ipw_read32(ipw, ofs) __ipw_read32(__FILE__, __LINE__, ipw, ofs)
366
367 /* multi-byte read (above 4K), with debug wrapper */
368 static void _ipw_read_indirect(struct ipw_priv *, u32, u8 *, int);
369 static inline void __ipw_read_indirect(const char *f, int l,
370                                        struct ipw_priv *a, u32 b, u8 * c, int d)
371 {
372         IPW_DEBUG_IO("%s %d: read_indirect(0x%08X) %d bytes\n", f, l, (u32) (b),
373                      d);
374         _ipw_read_indirect(a, b, c, d);
375 }
376
377 /* alias to multi-byte read (SRAM/regs above 4K), with debug wrapper */
378 #define ipw_read_indirect(a, b, c, d) __ipw_read_indirect(__FILE__, __LINE__, a, b, c, d)
379
380 /* alias to multi-byte read (SRAM/regs above 4K), with debug wrapper */
381 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * data,
382                                 int num);
383 #define ipw_write_indirect(a, b, c, d) \
384         IPW_DEBUG_IO("%s %d: write_indirect(0x%08X) %d bytes\n", __FILE__, __LINE__, (u32)(b), d); \
385         _ipw_write_indirect(a, b, c, d)
386
387 /* 32-bit indirect write (above 4K) */
388 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value)
389 {
390         IPW_DEBUG_IO(" %p : reg = 0x%8X : value = 0x%8X\n", priv, reg, value);
391         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
392         _ipw_write32(priv, IPW_INDIRECT_DATA, value);
393 }
394
395 /* 8-bit indirect write (above 4K) */
396 static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value)
397 {
398         u32 aligned_addr = reg & IPW_INDIRECT_ADDR_MASK;        /* dword align */
399         u32 dif_len = reg - aligned_addr;
400
401         IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
402         _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
403         _ipw_write8(priv, IPW_INDIRECT_DATA + dif_len, value);
404 }
405
406 /* 16-bit indirect write (above 4K) */
407 static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value)
408 {
409         u32 aligned_addr = reg & IPW_INDIRECT_ADDR_MASK;        /* dword align */
410         u32 dif_len = (reg - aligned_addr) & (~0x1ul);
411
412         IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
413         _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
414         _ipw_write16(priv, IPW_INDIRECT_DATA + dif_len, value);
415 }
416
417 /* 8-bit indirect read (above 4K) */
418 static u8 _ipw_read_reg8(struct ipw_priv *priv, u32 reg)
419 {
420         u32 word;
421         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg & IPW_INDIRECT_ADDR_MASK);
422         IPW_DEBUG_IO(" reg = 0x%8X : \n", reg);
423         word = _ipw_read32(priv, IPW_INDIRECT_DATA);
424         return (word >> ((reg & 0x3) * 8)) & 0xff;
425 }
426
427 /* 32-bit indirect read (above 4K) */
428 static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg)
429 {
430         u32 value;
431
432         IPW_DEBUG_IO("%p : reg = 0x%08x\n", priv, reg);
433
434         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
435         value = _ipw_read32(priv, IPW_INDIRECT_DATA);
436         IPW_DEBUG_IO(" reg = 0x%4X : value = 0x%4x \n", reg, value);
437         return value;
438 }
439
440 /* General purpose, no alignment requirement, iterative (multi-byte) read, */
441 /*    for area above 1st 4K of SRAM/reg space */
442 static void _ipw_read_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
443                                int num)
444 {
445         u32 aligned_addr = addr & IPW_INDIRECT_ADDR_MASK;       /* dword align */
446         u32 dif_len = addr - aligned_addr;
447         u32 i;
448
449         IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
450
451         if (num <= 0) {
452                 return;
453         }
454
455         /* Read the first dword (or portion) byte by byte */
456         if (unlikely(dif_len)) {
457                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
458                 /* Start reading at aligned_addr + dif_len */
459                 for (i = dif_len; ((i < 4) && (num > 0)); i++, num--)
460                         *buf++ = _ipw_read8(priv, IPW_INDIRECT_DATA + i);
461                 aligned_addr += 4;
462         }
463
464         /* Read all of the middle dwords as dwords, with auto-increment */
465         _ipw_write32(priv, IPW_AUTOINC_ADDR, aligned_addr);
466         for (; num >= 4; buf += 4, aligned_addr += 4, num -= 4)
467                 *(u32 *) buf = _ipw_read32(priv, IPW_AUTOINC_DATA);
468
469         /* Read the last dword (or portion) byte by byte */
470         if (unlikely(num)) {
471                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
472                 for (i = 0; num > 0; i++, num--)
473                         *buf++ = ipw_read8(priv, IPW_INDIRECT_DATA + i);
474         }
475 }
476
477 /* General purpose, no alignment requirement, iterative (multi-byte) write, */
478 /*    for area above 1st 4K of SRAM/reg space */
479 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
480                                 int num)
481 {
482         u32 aligned_addr = addr & IPW_INDIRECT_ADDR_MASK;       /* dword align */
483         u32 dif_len = addr - aligned_addr;
484         u32 i;
485
486         IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
487
488         if (num <= 0) {
489                 return;
490         }
491
492         /* Write the first dword (or portion) byte by byte */
493         if (unlikely(dif_len)) {
494                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
495                 /* Start writing at aligned_addr + dif_len */
496                 for (i = dif_len; ((i < 4) && (num > 0)); i++, num--, buf++)
497                         _ipw_write8(priv, IPW_INDIRECT_DATA + i, *buf);
498                 aligned_addr += 4;
499         }
500
501         /* Write all of the middle dwords as dwords, with auto-increment */
502         _ipw_write32(priv, IPW_AUTOINC_ADDR, aligned_addr);
503         for (; num >= 4; buf += 4, aligned_addr += 4, num -= 4)
504                 _ipw_write32(priv, IPW_AUTOINC_DATA, *(u32 *) buf);
505
506         /* Write the last dword (or portion) byte by byte */
507         if (unlikely(num)) {
508                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
509                 for (i = 0; num > 0; i++, num--, buf++)
510                         _ipw_write8(priv, IPW_INDIRECT_DATA + i, *buf);
511         }
512 }
513
514 /* General purpose, no alignment requirement, iterative (multi-byte) write, */
515 /*    for 1st 4K of SRAM/regs space */
516 static void ipw_write_direct(struct ipw_priv *priv, u32 addr, void *buf,
517                              int num)
518 {
519         memcpy_toio((priv->hw_base + addr), buf, num);
520 }
521
522 /* Set bit(s) in low 4K of SRAM/regs */
523 static inline void ipw_set_bit(struct ipw_priv *priv, u32 reg, u32 mask)
524 {
525         ipw_write32(priv, reg, ipw_read32(priv, reg) | mask);
526 }
527
528 /* Clear bit(s) in low 4K of SRAM/regs */
529 static inline void ipw_clear_bit(struct ipw_priv *priv, u32 reg, u32 mask)
530 {
531         ipw_write32(priv, reg, ipw_read32(priv, reg) & ~mask);
532 }
533
534 static inline void __ipw_enable_interrupts(struct ipw_priv *priv)
535 {
536         if (priv->status & STATUS_INT_ENABLED)
537                 return;
538         priv->status |= STATUS_INT_ENABLED;
539         ipw_write32(priv, IPW_INTA_MASK_R, IPW_INTA_MASK_ALL);
540 }
541
542 static inline void __ipw_disable_interrupts(struct ipw_priv *priv)
543 {
544         if (!(priv->status & STATUS_INT_ENABLED))
545                 return;
546         priv->status &= ~STATUS_INT_ENABLED;
547         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
548 }
549
550 static inline void ipw_enable_interrupts(struct ipw_priv *priv)
551 {
552         unsigned long flags;
553
554         spin_lock_irqsave(&priv->irq_lock, flags);
555         __ipw_enable_interrupts(priv);
556         spin_unlock_irqrestore(&priv->irq_lock, flags);
557 }
558
559 static inline void ipw_disable_interrupts(struct ipw_priv *priv)
560 {
561         unsigned long flags;
562
563         spin_lock_irqsave(&priv->irq_lock, flags);
564         __ipw_disable_interrupts(priv);
565         spin_unlock_irqrestore(&priv->irq_lock, flags);
566 }
567
568 static char *ipw_error_desc(u32 val)
569 {
570         switch (val) {
571         case IPW_FW_ERROR_OK:
572                 return "ERROR_OK";
573         case IPW_FW_ERROR_FAIL:
574                 return "ERROR_FAIL";
575         case IPW_FW_ERROR_MEMORY_UNDERFLOW:
576                 return "MEMORY_UNDERFLOW";
577         case IPW_FW_ERROR_MEMORY_OVERFLOW:
578                 return "MEMORY_OVERFLOW";
579         case IPW_FW_ERROR_BAD_PARAM:
580                 return "BAD_PARAM";
581         case IPW_FW_ERROR_BAD_CHECKSUM:
582                 return "BAD_CHECKSUM";
583         case IPW_FW_ERROR_NMI_INTERRUPT:
584                 return "NMI_INTERRUPT";
585         case IPW_FW_ERROR_BAD_DATABASE:
586                 return "BAD_DATABASE";
587         case IPW_FW_ERROR_ALLOC_FAIL:
588                 return "ALLOC_FAIL";
589         case IPW_FW_ERROR_DMA_UNDERRUN:
590                 return "DMA_UNDERRUN";
591         case IPW_FW_ERROR_DMA_STATUS:
592                 return "DMA_STATUS";
593         case IPW_FW_ERROR_DINO_ERROR:
594                 return "DINO_ERROR";
595         case IPW_FW_ERROR_EEPROM_ERROR:
596                 return "EEPROM_ERROR";
597         case IPW_FW_ERROR_SYSASSERT:
598                 return "SYSASSERT";
599         case IPW_FW_ERROR_FATAL_ERROR:
600                 return "FATAL_ERROR";
601         default:
602                 return "UNKNOWN_ERROR";
603         }
604 }
605
606 static void ipw_dump_error_log(struct ipw_priv *priv,
607                                struct ipw_fw_error *error)
608 {
609         u32 i;
610
611         if (!error) {
612                 IPW_ERROR("Error allocating and capturing error log.  "
613                           "Nothing to dump.\n");
614                 return;
615         }
616
617         IPW_ERROR("Start IPW Error Log Dump:\n");
618         IPW_ERROR("Status: 0x%08X, Config: %08X\n",
619                   error->status, error->config);
620
621         for (i = 0; i < error->elem_len; i++)
622                 IPW_ERROR("%s %i 0x%08x  0x%08x  0x%08x  0x%08x  0x%08x\n",
623                           ipw_error_desc(error->elem[i].desc),
624                           error->elem[i].time,
625                           error->elem[i].blink1,
626                           error->elem[i].blink2,
627                           error->elem[i].link1,
628                           error->elem[i].link2, error->elem[i].data);
629         for (i = 0; i < error->log_len; i++)
630                 IPW_ERROR("%i\t0x%08x\t%i\n",
631                           error->log[i].time,
632                           error->log[i].data, error->log[i].event);
633 }
634
635 static inline int ipw_is_init(struct ipw_priv *priv)
636 {
637         return (priv->status & STATUS_INIT) ? 1 : 0;
638 }
639
640 static int ipw_get_ordinal(struct ipw_priv *priv, u32 ord, void *val, u32 * len)
641 {
642         u32 addr, field_info, field_len, field_count, total_len;
643
644         IPW_DEBUG_ORD("ordinal = %i\n", ord);
645
646         if (!priv || !val || !len) {
647                 IPW_DEBUG_ORD("Invalid argument\n");
648                 return -EINVAL;
649         }
650
651         /* verify device ordinal tables have been initialized */
652         if (!priv->table0_addr || !priv->table1_addr || !priv->table2_addr) {
653                 IPW_DEBUG_ORD("Access ordinals before initialization\n");
654                 return -EINVAL;
655         }
656
657         switch (IPW_ORD_TABLE_ID_MASK & ord) {
658         case IPW_ORD_TABLE_0_MASK:
659                 /*
660                  * TABLE 0: Direct access to a table of 32 bit values
661                  *
662                  * This is a very simple table with the data directly
663                  * read from the table
664                  */
665
666                 /* remove the table id from the ordinal */
667                 ord &= IPW_ORD_TABLE_VALUE_MASK;
668
669                 /* boundary check */
670                 if (ord > priv->table0_len) {
671                         IPW_DEBUG_ORD("ordinal value (%i) longer then "
672                                       "max (%i)\n", ord, priv->table0_len);
673                         return -EINVAL;
674                 }
675
676                 /* verify we have enough room to store the value */
677                 if (*len < sizeof(u32)) {
678                         IPW_DEBUG_ORD("ordinal buffer length too small, "
679                                       "need %zd\n", sizeof(u32));
680                         return -EINVAL;
681                 }
682
683                 IPW_DEBUG_ORD("Reading TABLE0[%i] from offset 0x%08x\n",
684                               ord, priv->table0_addr + (ord << 2));
685
686                 *len = sizeof(u32);
687                 ord <<= 2;
688                 *((u32 *) val) = ipw_read32(priv, priv->table0_addr + ord);
689                 break;
690
691         case IPW_ORD_TABLE_1_MASK:
692                 /*
693                  * TABLE 1: Indirect access to a table of 32 bit values
694                  *
695                  * This is a fairly large table of u32 values each
696                  * representing starting addr for the data (which is
697                  * also a u32)
698                  */
699
700                 /* remove the table id from the ordinal */
701                 ord &= IPW_ORD_TABLE_VALUE_MASK;
702
703                 /* boundary check */
704                 if (ord > priv->table1_len) {
705                         IPW_DEBUG_ORD("ordinal value too long\n");
706                         return -EINVAL;
707                 }
708
709                 /* verify we have enough room to store the value */
710                 if (*len < sizeof(u32)) {
711                         IPW_DEBUG_ORD("ordinal buffer length too small, "
712                                       "need %zd\n", sizeof(u32));
713                         return -EINVAL;
714                 }
715
716                 *((u32 *) val) =
717                     ipw_read_reg32(priv, (priv->table1_addr + (ord << 2)));
718                 *len = sizeof(u32);
719                 break;
720
721         case IPW_ORD_TABLE_2_MASK:
722                 /*
723                  * TABLE 2: Indirect access to a table of variable sized values
724                  *
725                  * This table consist of six values, each containing
726                  *     - dword containing the starting offset of the data
727                  *     - dword containing the lengh in the first 16bits
728                  *       and the count in the second 16bits
729                  */
730
731                 /* remove the table id from the ordinal */
732                 ord &= IPW_ORD_TABLE_VALUE_MASK;
733
734                 /* boundary check */
735                 if (ord > priv->table2_len) {
736                         IPW_DEBUG_ORD("ordinal value too long\n");
737                         return -EINVAL;
738                 }
739
740                 /* get the address of statistic */
741                 addr = ipw_read_reg32(priv, priv->table2_addr + (ord << 3));
742
743                 /* get the second DW of statistics ;
744                  * two 16-bit words - first is length, second is count */
745                 field_info =
746                     ipw_read_reg32(priv,
747                                    priv->table2_addr + (ord << 3) +
748                                    sizeof(u32));
749
750                 /* get each entry length */
751                 field_len = *((u16 *) & field_info);
752
753                 /* get number of entries */
754                 field_count = *(((u16 *) & field_info) + 1);
755
756                 /* abort if not enought memory */
757                 total_len = field_len * field_count;
758                 if (total_len > *len) {
759                         *len = total_len;
760                         return -EINVAL;
761                 }
762
763                 *len = total_len;
764                 if (!total_len)
765                         return 0;
766
767                 IPW_DEBUG_ORD("addr = 0x%08x, total_len = %i, "
768                               "field_info = 0x%08x\n",
769                               addr, total_len, field_info);
770                 ipw_read_indirect(priv, addr, val, total_len);
771                 break;
772
773         default:
774                 IPW_DEBUG_ORD("Invalid ordinal!\n");
775                 return -EINVAL;
776
777         }
778
779         return 0;
780 }
781
782 static void ipw_init_ordinals(struct ipw_priv *priv)
783 {
784         priv->table0_addr = IPW_ORDINALS_TABLE_LOWER;
785         priv->table0_len = ipw_read32(priv, priv->table0_addr);
786
787         IPW_DEBUG_ORD("table 0 offset at 0x%08x, len = %i\n",
788                       priv->table0_addr, priv->table0_len);
789
790         priv->table1_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_1);
791         priv->table1_len = ipw_read_reg32(priv, priv->table1_addr);
792
793         IPW_DEBUG_ORD("table 1 offset at 0x%08x, len = %i\n",
794                       priv->table1_addr, priv->table1_len);
795
796         priv->table2_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_2);
797         priv->table2_len = ipw_read_reg32(priv, priv->table2_addr);
798         priv->table2_len &= 0x0000ffff; /* use first two bytes */
799
800         IPW_DEBUG_ORD("table 2 offset at 0x%08x, len = %i\n",
801                       priv->table2_addr, priv->table2_len);
802
803 }
804
805 static u32 ipw_register_toggle(u32 reg)
806 {
807         reg &= ~IPW_START_STANDBY;
808         if (reg & IPW_GATE_ODMA)
809                 reg &= ~IPW_GATE_ODMA;
810         if (reg & IPW_GATE_IDMA)
811                 reg &= ~IPW_GATE_IDMA;
812         if (reg & IPW_GATE_ADMA)
813                 reg &= ~IPW_GATE_ADMA;
814         return reg;
815 }
816
817 /*
818  * LED behavior:
819  * - On radio ON, turn on any LEDs that require to be on during start
820  * - On initialization, start unassociated blink
821  * - On association, disable unassociated blink
822  * - On disassociation, start unassociated blink
823  * - On radio OFF, turn off any LEDs started during radio on
824  *
825  */
826 #define LD_TIME_LINK_ON msecs_to_jiffies(300)
827 #define LD_TIME_LINK_OFF msecs_to_jiffies(2700)
828 #define LD_TIME_ACT_ON msecs_to_jiffies(250)
829
830 static void ipw_led_link_on(struct ipw_priv *priv)
831 {
832         unsigned long flags;
833         u32 led;
834
835         /* If configured to not use LEDs, or nic_type is 1,
836          * then we don't toggle a LINK led */
837         if (priv->config & CFG_NO_LED || priv->nic_type == EEPROM_NIC_TYPE_1)
838                 return;
839
840         spin_lock_irqsave(&priv->lock, flags);
841
842         if (!(priv->status & STATUS_RF_KILL_MASK) &&
843             !(priv->status & STATUS_LED_LINK_ON)) {
844                 IPW_DEBUG_LED("Link LED On\n");
845                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
846                 led |= priv->led_association_on;
847
848                 led = ipw_register_toggle(led);
849
850                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
851                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
852
853                 priv->status |= STATUS_LED_LINK_ON;
854
855                 /* If we aren't associated, schedule turning the LED off */
856                 if (!(priv->status & STATUS_ASSOCIATED))
857                         queue_delayed_work(priv->workqueue,
858                                            &priv->led_link_off,
859                                            LD_TIME_LINK_ON);
860         }
861
862         spin_unlock_irqrestore(&priv->lock, flags);
863 }
864
865 static void ipw_bg_led_link_on(struct work_struct *work)
866 {
867         struct ipw_priv *priv =
868                 container_of(work, struct ipw_priv, led_link_on.work);
869         mutex_lock(&priv->mutex);
870         ipw_led_link_on(priv);
871         mutex_unlock(&priv->mutex);
872 }
873
874 static void ipw_led_link_off(struct ipw_priv *priv)
875 {
876         unsigned long flags;
877         u32 led;
878
879         /* If configured not to use LEDs, or nic type is 1,
880          * then we don't goggle the LINK led. */
881         if (priv->config & CFG_NO_LED || priv->nic_type == EEPROM_NIC_TYPE_1)
882                 return;
883
884         spin_lock_irqsave(&priv->lock, flags);
885
886         if (priv->status & STATUS_LED_LINK_ON) {
887                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
888                 led &= priv->led_association_off;
889                 led = ipw_register_toggle(led);
890
891                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
892                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
893
894                 IPW_DEBUG_LED("Link LED Off\n");
895
896                 priv->status &= ~STATUS_LED_LINK_ON;
897
898                 /* If we aren't associated and the radio is on, schedule
899                  * turning the LED on (blink while unassociated) */
900                 if (!(priv->status & STATUS_RF_KILL_MASK) &&
901                     !(priv->status & STATUS_ASSOCIATED))
902                         queue_delayed_work(priv->workqueue, &priv->led_link_on,
903                                            LD_TIME_LINK_OFF);
904
905         }
906
907         spin_unlock_irqrestore(&priv->lock, flags);
908 }
909
910 static void ipw_bg_led_link_off(struct work_struct *work)
911 {
912         struct ipw_priv *priv =
913                 container_of(work, struct ipw_priv, led_link_off.work);
914         mutex_lock(&priv->mutex);
915         ipw_led_link_off(priv);
916         mutex_unlock(&priv->mutex);
917 }
918
919 static void __ipw_led_activity_on(struct ipw_priv *priv)
920 {
921         u32 led;
922
923         if (priv->config & CFG_NO_LED)
924                 return;
925
926         if (priv->status & STATUS_RF_KILL_MASK)
927                 return;
928
929         if (!(priv->status & STATUS_LED_ACT_ON)) {
930                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
931                 led |= priv->led_activity_on;
932
933                 led = ipw_register_toggle(led);
934
935                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
936                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
937
938                 IPW_DEBUG_LED("Activity LED On\n");
939
940                 priv->status |= STATUS_LED_ACT_ON;
941
942                 cancel_delayed_work(&priv->led_act_off);
943                 queue_delayed_work(priv->workqueue, &priv->led_act_off,
944                                    LD_TIME_ACT_ON);
945         } else {
946                 /* Reschedule LED off for full time period */
947                 cancel_delayed_work(&priv->led_act_off);
948                 queue_delayed_work(priv->workqueue, &priv->led_act_off,
949                                    LD_TIME_ACT_ON);
950         }
951 }
952
953 #if 0
954 void ipw_led_activity_on(struct ipw_priv *priv)
955 {
956         unsigned long flags;
957         spin_lock_irqsave(&priv->lock, flags);
958         __ipw_led_activity_on(priv);
959         spin_unlock_irqrestore(&priv->lock, flags);
960 }
961 #endif  /*  0  */
962
963 static void ipw_led_activity_off(struct ipw_priv *priv)
964 {
965         unsigned long flags;
966         u32 led;
967
968         if (priv->config & CFG_NO_LED)
969                 return;
970
971         spin_lock_irqsave(&priv->lock, flags);
972
973         if (priv->status & STATUS_LED_ACT_ON) {
974                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
975                 led &= priv->led_activity_off;
976
977                 led = ipw_register_toggle(led);
978
979                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
980                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
981
982                 IPW_DEBUG_LED("Activity LED Off\n");
983
984                 priv->status &= ~STATUS_LED_ACT_ON;
985         }
986
987         spin_unlock_irqrestore(&priv->lock, flags);
988 }
989
990 static void ipw_bg_led_activity_off(struct work_struct *work)
991 {
992         struct ipw_priv *priv =
993                 container_of(work, struct ipw_priv, led_act_off.work);
994         mutex_lock(&priv->mutex);
995         ipw_led_activity_off(priv);
996         mutex_unlock(&priv->mutex);
997 }
998
999 static void ipw_led_band_on(struct ipw_priv *priv)
1000 {
1001         unsigned long flags;
1002         u32 led;
1003
1004         /* Only nic type 1 supports mode LEDs */
1005         if (priv->config & CFG_NO_LED ||
1006             priv->nic_type != EEPROM_NIC_TYPE_1 || !priv->assoc_network)
1007                 return;
1008
1009         spin_lock_irqsave(&priv->lock, flags);
1010
1011         led = ipw_read_reg32(priv, IPW_EVENT_REG);
1012         if (priv->assoc_network->mode == IEEE_A) {
1013                 led |= priv->led_ofdm_on;
1014                 led &= priv->led_association_off;
1015                 IPW_DEBUG_LED("Mode LED On: 802.11a\n");
1016         } else if (priv->assoc_network->mode == IEEE_G) {
1017                 led |= priv->led_ofdm_on;
1018                 led |= priv->led_association_on;
1019                 IPW_DEBUG_LED("Mode LED On: 802.11g\n");
1020         } else {
1021                 led &= priv->led_ofdm_off;
1022                 led |= priv->led_association_on;
1023                 IPW_DEBUG_LED("Mode LED On: 802.11b\n");
1024         }
1025
1026         led = ipw_register_toggle(led);
1027
1028         IPW_DEBUG_LED("Reg: 0x%08X\n", led);
1029         ipw_write_reg32(priv, IPW_EVENT_REG, led);
1030
1031         spin_unlock_irqrestore(&priv->lock, flags);
1032 }
1033
1034 static void ipw_led_band_off(struct ipw_priv *priv)
1035 {
1036         unsigned long flags;
1037         u32 led;
1038
1039         /* Only nic type 1 supports mode LEDs */
1040         if (priv->config & CFG_NO_LED || priv->nic_type != EEPROM_NIC_TYPE_1)
1041                 return;
1042
1043         spin_lock_irqsave(&priv->lock, flags);
1044
1045         led = ipw_read_reg32(priv, IPW_EVENT_REG);
1046         led &= priv->led_ofdm_off;
1047         led &= priv->led_association_off;
1048
1049         led = ipw_register_toggle(led);
1050
1051         IPW_DEBUG_LED("Reg: 0x%08X\n", led);
1052         ipw_write_reg32(priv, IPW_EVENT_REG, led);
1053
1054         spin_unlock_irqrestore(&priv->lock, flags);
1055 }
1056
1057 static void ipw_led_radio_on(struct ipw_priv *priv)
1058 {
1059         ipw_led_link_on(priv);
1060 }
1061
1062 static void ipw_led_radio_off(struct ipw_priv *priv)
1063 {
1064         ipw_led_activity_off(priv);
1065         ipw_led_link_off(priv);
1066 }
1067
1068 static void ipw_led_link_up(struct ipw_priv *priv)
1069 {
1070         /* Set the Link Led on for all nic types */
1071         ipw_led_link_on(priv);
1072 }
1073
1074 static void ipw_led_link_down(struct ipw_priv *priv)
1075 {
1076         ipw_led_activity_off(priv);
1077         ipw_led_link_off(priv);
1078
1079         if (priv->status & STATUS_RF_KILL_MASK)
1080                 ipw_led_radio_off(priv);
1081 }
1082
1083 static void ipw_led_init(struct ipw_priv *priv)
1084 {
1085         priv->nic_type = priv->eeprom[EEPROM_NIC_TYPE];
1086
1087         /* Set the default PINs for the link and activity leds */
1088         priv->led_activity_on = IPW_ACTIVITY_LED;
1089         priv->led_activity_off = ~(IPW_ACTIVITY_LED);
1090
1091         priv->led_association_on = IPW_ASSOCIATED_LED;
1092         priv->led_association_off = ~(IPW_ASSOCIATED_LED);
1093
1094         /* Set the default PINs for the OFDM leds */
1095         priv->led_ofdm_on = IPW_OFDM_LED;
1096         priv->led_ofdm_off = ~(IPW_OFDM_LED);
1097
1098         switch (priv->nic_type) {
1099         case EEPROM_NIC_TYPE_1:
1100                 /* In this NIC type, the LEDs are reversed.... */
1101                 priv->led_activity_on = IPW_ASSOCIATED_LED;
1102                 priv->led_activity_off = ~(IPW_ASSOCIATED_LED);
1103                 priv->led_association_on = IPW_ACTIVITY_LED;
1104                 priv->led_association_off = ~(IPW_ACTIVITY_LED);
1105
1106                 if (!(priv->config & CFG_NO_LED))
1107                         ipw_led_band_on(priv);
1108
1109                 /* And we don't blink link LEDs for this nic, so
1110                  * just return here */
1111                 return;
1112
1113         case EEPROM_NIC_TYPE_3:
1114         case EEPROM_NIC_TYPE_2:
1115         case EEPROM_NIC_TYPE_4:
1116         case EEPROM_NIC_TYPE_0:
1117                 break;
1118
1119         default:
1120                 IPW_DEBUG_INFO("Unknown NIC type from EEPROM: %d\n",
1121                                priv->nic_type);
1122                 priv->nic_type = EEPROM_NIC_TYPE_0;
1123                 break;
1124         }
1125
1126         if (!(priv->config & CFG_NO_LED)) {
1127                 if (priv->status & STATUS_ASSOCIATED)
1128                         ipw_led_link_on(priv);
1129                 else
1130                         ipw_led_link_off(priv);
1131         }
1132 }
1133
1134 static void ipw_led_shutdown(struct ipw_priv *priv)
1135 {
1136         ipw_led_activity_off(priv);
1137         ipw_led_link_off(priv);
1138         ipw_led_band_off(priv);
1139         cancel_delayed_work(&priv->led_link_on);
1140         cancel_delayed_work(&priv->led_link_off);
1141         cancel_delayed_work(&priv->led_act_off);
1142 }
1143
1144 /*
1145  * The following adds a new attribute to the sysfs representation
1146  * of this device driver (i.e. a new file in /sys/bus/pci/drivers/ipw/)
1147  * used for controling the debug level.
1148  *
1149  * See the level definitions in ipw for details.
1150  */
1151 static ssize_t show_debug_level(struct device_driver *d, char *buf)
1152 {
1153         return sprintf(buf, "0x%08X\n", ipw_debug_level);
1154 }
1155
1156 static ssize_t store_debug_level(struct device_driver *d, const char *buf,
1157                                  size_t count)
1158 {
1159         char *p = (char *)buf;
1160         u32 val;
1161
1162         if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
1163                 p++;
1164                 if (p[0] == 'x' || p[0] == 'X')
1165                         p++;
1166                 val = simple_strtoul(p, &p, 16);
1167         } else
1168                 val = simple_strtoul(p, &p, 10);
1169         if (p == buf)
1170                 printk(KERN_INFO DRV_NAME
1171                        ": %s is not in hex or decimal form.\n", buf);
1172         else
1173                 ipw_debug_level = val;
1174
1175         return strnlen(buf, count);
1176 }
1177
1178 static DRIVER_ATTR(debug_level, S_IWUSR | S_IRUGO,
1179                    show_debug_level, store_debug_level);
1180
1181 static inline u32 ipw_get_event_log_len(struct ipw_priv *priv)
1182 {
1183         /* length = 1st dword in log */
1184         return ipw_read_reg32(priv, ipw_read32(priv, IPW_EVENT_LOG));
1185 }
1186
1187 static void ipw_capture_event_log(struct ipw_priv *priv,
1188                                   u32 log_len, struct ipw_event *log)
1189 {
1190         u32 base;
1191
1192         if (log_len) {
1193                 base = ipw_read32(priv, IPW_EVENT_LOG);
1194                 ipw_read_indirect(priv, base + sizeof(base) + sizeof(u32),
1195                                   (u8 *) log, sizeof(*log) * log_len);
1196         }
1197 }
1198
1199 static struct ipw_fw_error *ipw_alloc_error_log(struct ipw_priv *priv)
1200 {
1201         struct ipw_fw_error *error;
1202         u32 log_len = ipw_get_event_log_len(priv);
1203         u32 base = ipw_read32(priv, IPW_ERROR_LOG);
1204         u32 elem_len = ipw_read_reg32(priv, base);
1205
1206         error = kmalloc(sizeof(*error) +
1207                         sizeof(*error->elem) * elem_len +
1208                         sizeof(*error->log) * log_len, GFP_ATOMIC);
1209         if (!error) {
1210                 IPW_ERROR("Memory allocation for firmware error log "
1211                           "failed.\n");
1212                 return NULL;
1213         }
1214         error->jiffies = jiffies;
1215         error->status = priv->status;
1216         error->config = priv->config;
1217         error->elem_len = elem_len;
1218         error->log_len = log_len;
1219         error->elem = (struct ipw_error_elem *)error->payload;
1220         error->log = (struct ipw_event *)(error->elem + elem_len);
1221
1222         ipw_capture_event_log(priv, log_len, error->log);
1223
1224         if (elem_len)
1225                 ipw_read_indirect(priv, base + sizeof(base), (u8 *) error->elem,
1226                                   sizeof(*error->elem) * elem_len);
1227
1228         return error;
1229 }
1230
1231 static ssize_t show_event_log(struct device *d,
1232                               struct device_attribute *attr, char *buf)
1233 {
1234         struct ipw_priv *priv = dev_get_drvdata(d);
1235         u32 log_len = ipw_get_event_log_len(priv);
1236         u32 log_size;
1237         struct ipw_event *log;
1238         u32 len = 0, i;
1239
1240         /* not using min() because of its strict type checking */
1241         log_size = PAGE_SIZE / sizeof(*log) > log_len ?
1242                         sizeof(*log) * log_len : PAGE_SIZE;
1243         log = kzalloc(log_size, GFP_KERNEL);
1244         if (!log) {
1245                 IPW_ERROR("Unable to allocate memory for log\n");
1246                 return 0;
1247         }
1248         log_len = log_size / sizeof(*log);
1249         ipw_capture_event_log(priv, log_len, log);
1250
1251         len += snprintf(buf + len, PAGE_SIZE - len, "%08X", log_len);
1252         for (i = 0; i < log_len; i++)
1253                 len += snprintf(buf + len, PAGE_SIZE - len,
1254                                 "\n%08X%08X%08X",
1255                                 log[i].time, log[i].event, log[i].data);
1256         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1257         kfree(log);
1258         return len;
1259 }
1260
1261 static DEVICE_ATTR(event_log, S_IRUGO, show_event_log, NULL);
1262
1263 static ssize_t show_error(struct device *d,
1264                           struct device_attribute *attr, char *buf)
1265 {
1266         struct ipw_priv *priv = dev_get_drvdata(d);
1267         u32 len = 0, i;
1268         if (!priv->error)
1269                 return 0;
1270         len += snprintf(buf + len, PAGE_SIZE - len,
1271                         "%08lX%08X%08X%08X",
1272                         priv->error->jiffies,
1273                         priv->error->status,
1274                         priv->error->config, priv->error->elem_len);
1275         for (i = 0; i < priv->error->elem_len; i++)
1276                 len += snprintf(buf + len, PAGE_SIZE - len,
1277                                 "\n%08X%08X%08X%08X%08X%08X%08X",
1278                                 priv->error->elem[i].time,
1279                                 priv->error->elem[i].desc,
1280                                 priv->error->elem[i].blink1,
1281                                 priv->error->elem[i].blink2,
1282                                 priv->error->elem[i].link1,
1283                                 priv->error->elem[i].link2,
1284                                 priv->error->elem[i].data);
1285
1286         len += snprintf(buf + len, PAGE_SIZE - len,
1287                         "\n%08X", priv->error->log_len);
1288         for (i = 0; i < priv->error->log_len; i++)
1289                 len += snprintf(buf + len, PAGE_SIZE - len,
1290                                 "\n%08X%08X%08X",
1291                                 priv->error->log[i].time,
1292                                 priv->error->log[i].event,
1293                                 priv->error->log[i].data);
1294         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1295         return len;
1296 }
1297
1298 static ssize_t clear_error(struct device *d,
1299                            struct device_attribute *attr,
1300                            const char *buf, size_t count)
1301 {
1302         struct ipw_priv *priv = dev_get_drvdata(d);
1303
1304         kfree(priv->error);
1305         priv->error = NULL;
1306         return count;
1307 }
1308
1309 static DEVICE_ATTR(error, S_IRUGO | S_IWUSR, show_error, clear_error);
1310
1311 static ssize_t show_cmd_log(struct device *d,
1312                             struct device_attribute *attr, char *buf)
1313 {
1314         struct ipw_priv *priv = dev_get_drvdata(d);
1315         u32 len = 0, i;
1316         if (!priv->cmdlog)
1317                 return 0;
1318         for (i = (priv->cmdlog_pos + 1) % priv->cmdlog_len;
1319              (i != priv->cmdlog_pos) && (PAGE_SIZE - len);
1320              i = (i + 1) % priv->cmdlog_len) {
1321                 len +=
1322                     snprintf(buf + len, PAGE_SIZE - len,
1323                              "\n%08lX%08X%08X%08X\n", priv->cmdlog[i].jiffies,
1324                              priv->cmdlog[i].retcode, priv->cmdlog[i].cmd.cmd,
1325                              priv->cmdlog[i].cmd.len);
1326                 len +=
1327                     snprintk_buf(buf + len, PAGE_SIZE - len,
1328                                  (u8 *) priv->cmdlog[i].cmd.param,
1329                                  priv->cmdlog[i].cmd.len);
1330                 len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1331         }
1332         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1333         return len;
1334 }
1335
1336 static DEVICE_ATTR(cmd_log, S_IRUGO, show_cmd_log, NULL);
1337
1338 #ifdef CONFIG_IPW2200_PROMISCUOUS
1339 static void ipw_prom_free(struct ipw_priv *priv);
1340 static int ipw_prom_alloc(struct ipw_priv *priv);
1341 static ssize_t store_rtap_iface(struct device *d,
1342                          struct device_attribute *attr,
1343                          const char *buf, size_t count)
1344 {
1345         struct ipw_priv *priv = dev_get_drvdata(d);
1346         int rc = 0;
1347
1348         if (count < 1)
1349                 return -EINVAL;
1350
1351         switch (buf[0]) {
1352         case '0':
1353                 if (!rtap_iface)
1354                         return count;
1355
1356                 if (netif_running(priv->prom_net_dev)) {
1357                         IPW_WARNING("Interface is up.  Cannot unregister.\n");
1358                         return count;
1359                 }
1360
1361                 ipw_prom_free(priv);
1362                 rtap_iface = 0;
1363                 break;
1364
1365         case '1':
1366                 if (rtap_iface)
1367                         return count;
1368
1369                 rc = ipw_prom_alloc(priv);
1370                 if (!rc)
1371                         rtap_iface = 1;
1372                 break;
1373
1374         default:
1375                 return -EINVAL;
1376         }
1377
1378         if (rc) {
1379                 IPW_ERROR("Failed to register promiscuous network "
1380                           "device (error %d).\n", rc);
1381         }
1382
1383         return count;
1384 }
1385
1386 static ssize_t show_rtap_iface(struct device *d,
1387                         struct device_attribute *attr,
1388                         char *buf)
1389 {
1390         struct ipw_priv *priv = dev_get_drvdata(d);
1391         if (rtap_iface)
1392                 return sprintf(buf, "%s", priv->prom_net_dev->name);
1393         else {
1394                 buf[0] = '-';
1395                 buf[1] = '1';
1396                 buf[2] = '\0';
1397                 return 3;
1398         }
1399 }
1400
1401 static DEVICE_ATTR(rtap_iface, S_IWUSR | S_IRUSR, show_rtap_iface,
1402                    store_rtap_iface);
1403
1404 static ssize_t store_rtap_filter(struct device *d,
1405                          struct device_attribute *attr,
1406                          const char *buf, size_t count)
1407 {
1408         struct ipw_priv *priv = dev_get_drvdata(d);
1409
1410         if (!priv->prom_priv) {
1411                 IPW_ERROR("Attempting to set filter without "
1412                           "rtap_iface enabled.\n");
1413                 return -EPERM;
1414         }
1415
1416         priv->prom_priv->filter = simple_strtol(buf, NULL, 0);
1417
1418         IPW_DEBUG_INFO("Setting rtap filter to " BIT_FMT16 "\n",
1419                        BIT_ARG16(priv->prom_priv->filter));
1420
1421         return count;
1422 }
1423
1424 static ssize_t show_rtap_filter(struct device *d,
1425                         struct device_attribute *attr,
1426                         char *buf)
1427 {
1428         struct ipw_priv *priv = dev_get_drvdata(d);
1429         return sprintf(buf, "0x%04X",
1430                        priv->prom_priv ? priv->prom_priv->filter : 0);
1431 }
1432
1433 static DEVICE_ATTR(rtap_filter, S_IWUSR | S_IRUSR, show_rtap_filter,
1434                    store_rtap_filter);
1435 #endif
1436
1437 static ssize_t show_scan_age(struct device *d, struct device_attribute *attr,
1438                              char *buf)
1439 {
1440         struct ipw_priv *priv = dev_get_drvdata(d);
1441         return sprintf(buf, "%d\n", priv->ieee->scan_age);
1442 }
1443
1444 static ssize_t store_scan_age(struct device *d, struct device_attribute *attr,
1445                               const char *buf, size_t count)
1446 {
1447         struct ipw_priv *priv = dev_get_drvdata(d);
1448         struct net_device *dev = priv->net_dev;
1449         char buffer[] = "00000000";
1450         unsigned long len =
1451             (sizeof(buffer) - 1) > count ? count : sizeof(buffer) - 1;
1452         unsigned long val;
1453         char *p = buffer;
1454
1455         IPW_DEBUG_INFO("enter\n");
1456
1457         strncpy(buffer, buf, len);
1458         buffer[len] = 0;
1459
1460         if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
1461                 p++;
1462                 if (p[0] == 'x' || p[0] == 'X')
1463                         p++;
1464                 val = simple_strtoul(p, &p, 16);
1465         } else
1466                 val = simple_strtoul(p, &p, 10);
1467         if (p == buffer) {
1468                 IPW_DEBUG_INFO("%s: user supplied invalid value.\n", dev->name);
1469         } else {
1470                 priv->ieee->scan_age = val;
1471                 IPW_DEBUG_INFO("set scan_age = %u\n", priv->ieee->scan_age);
1472         }
1473
1474         IPW_DEBUG_INFO("exit\n");
1475         return len;
1476 }
1477
1478 static DEVICE_ATTR(scan_age, S_IWUSR | S_IRUGO, show_scan_age, store_scan_age);
1479
1480 static ssize_t show_led(struct device *d, struct device_attribute *attr,
1481                         char *buf)
1482 {
1483         struct ipw_priv *priv = dev_get_drvdata(d);
1484         return sprintf(buf, "%d\n", (priv->config & CFG_NO_LED) ? 0 : 1);
1485 }
1486
1487 static ssize_t store_led(struct device *d, struct device_attribute *attr,
1488                          const char *buf, size_t count)
1489 {
1490         struct ipw_priv *priv = dev_get_drvdata(d);
1491
1492         IPW_DEBUG_INFO("enter\n");
1493
1494         if (count == 0)
1495                 return 0;
1496
1497         if (*buf == 0) {
1498                 IPW_DEBUG_LED("Disabling LED control.\n");
1499                 priv->config |= CFG_NO_LED;
1500                 ipw_led_shutdown(priv);
1501         } else {
1502                 IPW_DEBUG_LED("Enabling LED control.\n");
1503                 priv->config &= ~CFG_NO_LED;
1504                 ipw_led_init(priv);
1505         }
1506
1507         IPW_DEBUG_INFO("exit\n");
1508         return count;
1509 }
1510
1511 static DEVICE_ATTR(led, S_IWUSR | S_IRUGO, show_led, store_led);
1512
1513 static ssize_t show_status(struct device *d,
1514                            struct device_attribute *attr, char *buf)
1515 {
1516         struct ipw_priv *p = d->driver_data;
1517         return sprintf(buf, "0x%08x\n", (int)p->status);
1518 }
1519
1520 static DEVICE_ATTR(status, S_IRUGO, show_status, NULL);
1521
1522 static ssize_t show_cfg(struct device *d, struct device_attribute *attr,
1523                         char *buf)
1524 {
1525         struct ipw_priv *p = d->driver_data;
1526         return sprintf(buf, "0x%08x\n", (int)p->config);
1527 }
1528
1529 static DEVICE_ATTR(cfg, S_IRUGO, show_cfg, NULL);
1530
1531 static ssize_t show_nic_type(struct device *d,
1532                              struct device_attribute *attr, char *buf)
1533 {
1534         struct ipw_priv *priv = d->driver_data;
1535         return sprintf(buf, "TYPE: %d\n", priv->nic_type);
1536 }
1537
1538 static DEVICE_ATTR(nic_type, S_IRUGO, show_nic_type, NULL);
1539
1540 static ssize_t show_ucode_version(struct device *d,
1541                                   struct device_attribute *attr, char *buf)
1542 {
1543         u32 len = sizeof(u32), tmp = 0;
1544         struct ipw_priv *p = d->driver_data;
1545
1546         if (ipw_get_ordinal(p, IPW_ORD_STAT_UCODE_VERSION, &tmp, &len))
1547                 return 0;
1548
1549         return sprintf(buf, "0x%08x\n", tmp);
1550 }
1551
1552 static DEVICE_ATTR(ucode_version, S_IWUSR | S_IRUGO, show_ucode_version, NULL);
1553
1554 static ssize_t show_rtc(struct device *d, struct device_attribute *attr,
1555                         char *buf)
1556 {
1557         u32 len = sizeof(u32), tmp = 0;
1558         struct ipw_priv *p = d->driver_data;
1559
1560         if (ipw_get_ordinal(p, IPW_ORD_STAT_RTC, &tmp, &len))
1561                 return 0;
1562
1563         return sprintf(buf, "0x%08x\n", tmp);
1564 }
1565
1566 static DEVICE_ATTR(rtc, S_IWUSR | S_IRUGO, show_rtc, NULL);
1567
1568 /*
1569  * Add a device attribute to view/control the delay between eeprom
1570  * operations.
1571  */
1572 static ssize_t show_eeprom_delay(struct device *d,
1573                                  struct device_attribute *attr, char *buf)
1574 {
1575         int n = ((struct ipw_priv *)d->driver_data)->eeprom_delay;
1576         return sprintf(buf, "%i\n", n);
1577 }
1578 static ssize_t store_eeprom_delay(struct device *d,
1579                                   struct device_attribute *attr,
1580                                   const char *buf, size_t count)
1581 {
1582         struct ipw_priv *p = d->driver_data;
1583         sscanf(buf, "%i", &p->eeprom_delay);
1584         return strnlen(buf, count);
1585 }
1586
1587 static DEVICE_ATTR(eeprom_delay, S_IWUSR | S_IRUGO,
1588                    show_eeprom_delay, store_eeprom_delay);
1589
1590 static ssize_t show_command_event_reg(struct device *d,
1591                                       struct device_attribute *attr, char *buf)
1592 {
1593         u32 reg = 0;
1594         struct ipw_priv *p = d->driver_data;
1595
1596         reg = ipw_read_reg32(p, IPW_INTERNAL_CMD_EVENT);
1597         return sprintf(buf, "0x%08x\n", reg);
1598 }
1599 static ssize_t store_command_event_reg(struct device *d,
1600                                        struct device_attribute *attr,
1601                                        const char *buf, size_t count)
1602 {
1603         u32 reg;
1604         struct ipw_priv *p = d->driver_data;
1605
1606         sscanf(buf, "%x", &reg);
1607         ipw_write_reg32(p, IPW_INTERNAL_CMD_EVENT, reg);
1608         return strnlen(buf, count);
1609 }
1610
1611 static DEVICE_ATTR(command_event_reg, S_IWUSR | S_IRUGO,
1612                    show_command_event_reg, store_command_event_reg);
1613
1614 static ssize_t show_mem_gpio_reg(struct device *d,
1615                                  struct device_attribute *attr, char *buf)
1616 {
1617         u32 reg = 0;
1618         struct ipw_priv *p = d->driver_data;
1619
1620         reg = ipw_read_reg32(p, 0x301100);
1621         return sprintf(buf, "0x%08x\n", reg);
1622 }
1623 static ssize_t store_mem_gpio_reg(struct device *d,
1624                                   struct device_attribute *attr,
1625                                   const char *buf, size_t count)
1626 {
1627         u32 reg;
1628         struct ipw_priv *p = d->driver_data;
1629
1630         sscanf(buf, "%x", &reg);
1631         ipw_write_reg32(p, 0x301100, reg);
1632         return strnlen(buf, count);
1633 }
1634
1635 static DEVICE_ATTR(mem_gpio_reg, S_IWUSR | S_IRUGO,
1636                    show_mem_gpio_reg, store_mem_gpio_reg);
1637
1638 static ssize_t show_indirect_dword(struct device *d,
1639                                    struct device_attribute *attr, char *buf)
1640 {
1641         u32 reg = 0;
1642         struct ipw_priv *priv = d->driver_data;
1643
1644         if (priv->status & STATUS_INDIRECT_DWORD)
1645                 reg = ipw_read_reg32(priv, priv->indirect_dword);
1646         else
1647                 reg = 0;
1648
1649         return sprintf(buf, "0x%08x\n", reg);
1650 }
1651 static ssize_t store_indirect_dword(struct device *d,
1652                                     struct device_attribute *attr,
1653                                     const char *buf, size_t count)
1654 {
1655         struct ipw_priv *priv = d->driver_data;
1656
1657         sscanf(buf, "%x", &priv->indirect_dword);
1658         priv->status |= STATUS_INDIRECT_DWORD;
1659         return strnlen(buf, count);
1660 }
1661
1662 static DEVICE_ATTR(indirect_dword, S_IWUSR | S_IRUGO,
1663                    show_indirect_dword, store_indirect_dword);
1664
1665 static ssize_t show_indirect_byte(struct device *d,
1666                                   struct device_attribute *attr, char *buf)
1667 {
1668         u8 reg = 0;
1669         struct ipw_priv *priv = d->driver_data;
1670
1671         if (priv->status & STATUS_INDIRECT_BYTE)
1672                 reg = ipw_read_reg8(priv, priv->indirect_byte);
1673         else
1674                 reg = 0;
1675
1676         return sprintf(buf, "0x%02x\n", reg);
1677 }
1678 static ssize_t store_indirect_byte(struct device *d,
1679                                    struct device_attribute *attr,
1680                                    const char *buf, size_t count)
1681 {
1682         struct ipw_priv *priv = d->driver_data;
1683
1684         sscanf(buf, "%x", &priv->indirect_byte);
1685         priv->status |= STATUS_INDIRECT_BYTE;
1686         return strnlen(buf, count);
1687 }
1688
1689 static DEVICE_ATTR(indirect_byte, S_IWUSR | S_IRUGO,
1690                    show_indirect_byte, store_indirect_byte);
1691
1692 static ssize_t show_direct_dword(struct device *d,
1693                                  struct device_attribute *attr, char *buf)
1694 {
1695         u32 reg = 0;
1696         struct ipw_priv *priv = d->driver_data;
1697
1698         if (priv->status & STATUS_DIRECT_DWORD)
1699                 reg = ipw_read32(priv, priv->direct_dword);
1700         else
1701                 reg = 0;
1702
1703         return sprintf(buf, "0x%08x\n", reg);
1704 }
1705 static ssize_t store_direct_dword(struct device *d,
1706                                   struct device_attribute *attr,
1707                                   const char *buf, size_t count)
1708 {
1709         struct ipw_priv *priv = d->driver_data;
1710
1711         sscanf(buf, "%x", &priv->direct_dword);
1712         priv->status |= STATUS_DIRECT_DWORD;
1713         return strnlen(buf, count);
1714 }
1715
1716 static DEVICE_ATTR(direct_dword, S_IWUSR | S_IRUGO,
1717                    show_direct_dword, store_direct_dword);
1718
1719 static int rf_kill_active(struct ipw_priv *priv)
1720 {
1721         if (0 == (ipw_read32(priv, 0x30) & 0x10000))
1722                 priv->status |= STATUS_RF_KILL_HW;
1723         else
1724                 priv->status &= ~STATUS_RF_KILL_HW;
1725
1726         return (priv->status & STATUS_RF_KILL_HW) ? 1 : 0;
1727 }
1728
1729 static ssize_t show_rf_kill(struct device *d, struct device_attribute *attr,
1730                             char *buf)
1731 {
1732         /* 0 - RF kill not enabled
1733            1 - SW based RF kill active (sysfs)
1734            2 - HW based RF kill active
1735            3 - Both HW and SW baed RF kill active */
1736         struct ipw_priv *priv = d->driver_data;
1737         int val = ((priv->status & STATUS_RF_KILL_SW) ? 0x1 : 0x0) |
1738             (rf_kill_active(priv) ? 0x2 : 0x0);
1739         return sprintf(buf, "%i\n", val);
1740 }
1741
1742 static int ipw_radio_kill_sw(struct ipw_priv *priv, int disable_radio)
1743 {
1744         if ((disable_radio ? 1 : 0) ==
1745             ((priv->status & STATUS_RF_KILL_SW) ? 1 : 0))
1746                 return 0;
1747
1748         IPW_DEBUG_RF_KILL("Manual SW RF Kill set to: RADIO  %s\n",
1749                           disable_radio ? "OFF" : "ON");
1750
1751         if (disable_radio) {
1752                 priv->status |= STATUS_RF_KILL_SW;
1753
1754                 if (priv->workqueue) {
1755                         cancel_delayed_work(&priv->request_scan);
1756                         cancel_delayed_work(&priv->request_direct_scan);
1757                         cancel_delayed_work(&priv->request_passive_scan);
1758                         cancel_delayed_work(&priv->scan_event);
1759                 }
1760                 queue_work(priv->workqueue, &priv->down);
1761         } else {
1762                 priv->status &= ~STATUS_RF_KILL_SW;
1763                 if (rf_kill_active(priv)) {
1764                         IPW_DEBUG_RF_KILL("Can not turn radio back on - "
1765                                           "disabled by HW switch\n");
1766                         /* Make sure the RF_KILL check timer is running */
1767                         cancel_delayed_work(&priv->rf_kill);
1768                         queue_delayed_work(priv->workqueue, &priv->rf_kill,
1769                                            round_jiffies_relative(2 * HZ));
1770                 } else
1771                         queue_work(priv->workqueue, &priv->up);
1772         }
1773
1774         return 1;
1775 }
1776
1777 static ssize_t store_rf_kill(struct device *d, struct device_attribute *attr,
1778                              const char *buf, size_t count)
1779 {
1780         struct ipw_priv *priv = d->driver_data;
1781
1782         ipw_radio_kill_sw(priv, buf[0] == '1');
1783
1784         return count;
1785 }
1786
1787 static DEVICE_ATTR(rf_kill, S_IWUSR | S_IRUGO, show_rf_kill, store_rf_kill);
1788
1789 static ssize_t show_speed_scan(struct device *d, struct device_attribute *attr,
1790                                char *buf)
1791 {
1792         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1793         int pos = 0, len = 0;
1794         if (priv->config & CFG_SPEED_SCAN) {
1795                 while (priv->speed_scan[pos] != 0)
1796                         len += sprintf(&buf[len], "%d ",
1797                                        priv->speed_scan[pos++]);
1798                 return len + sprintf(&buf[len], "\n");
1799         }
1800
1801         return sprintf(buf, "0\n");
1802 }
1803
1804 static ssize_t store_speed_scan(struct device *d, struct device_attribute *attr,
1805                                 const char *buf, size_t count)
1806 {
1807         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1808         int channel, pos = 0;
1809         const char *p = buf;
1810
1811         /* list of space separated channels to scan, optionally ending with 0 */
1812         while ((channel = simple_strtol(p, NULL, 0))) {
1813                 if (pos == MAX_SPEED_SCAN - 1) {
1814                         priv->speed_scan[pos] = 0;
1815                         break;
1816                 }
1817
1818                 if (ieee80211_is_valid_channel(priv->ieee, channel))
1819                         priv->speed_scan[pos++] = channel;
1820                 else
1821                         IPW_WARNING("Skipping invalid channel request: %d\n",
1822                                     channel);
1823                 p = strchr(p, ' ');
1824                 if (!p)
1825                         break;
1826                 while (*p == ' ' || *p == '\t')
1827                         p++;
1828         }
1829
1830         if (pos == 0)
1831                 priv->config &= ~CFG_SPEED_SCAN;
1832         else {
1833                 priv->speed_scan_pos = 0;
1834                 priv->config |= CFG_SPEED_SCAN;
1835         }
1836
1837         return count;
1838 }
1839
1840 static DEVICE_ATTR(speed_scan, S_IWUSR | S_IRUGO, show_speed_scan,
1841                    store_speed_scan);
1842
1843 static ssize_t show_net_stats(struct device *d, struct device_attribute *attr,
1844                               char *buf)
1845 {
1846         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1847         return sprintf(buf, "%c\n", (priv->config & CFG_NET_STATS) ? '1' : '0');
1848 }
1849
1850 static ssize_t store_net_stats(struct device *d, struct device_attribute *attr,
1851                                const char *buf, size_t count)
1852 {
1853         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1854         if (buf[0] == '1')
1855                 priv->config |= CFG_NET_STATS;
1856         else
1857                 priv->config &= ~CFG_NET_STATS;
1858
1859         return count;
1860 }
1861
1862 static DEVICE_ATTR(net_stats, S_IWUSR | S_IRUGO,
1863                    show_net_stats, store_net_stats);
1864
1865 static ssize_t show_channels(struct device *d,
1866                              struct device_attribute *attr,
1867                              char *buf)
1868 {
1869         struct ipw_priv *priv = dev_get_drvdata(d);
1870         const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
1871         int len = 0, i;
1872
1873         len = sprintf(&buf[len],
1874                       "Displaying %d channels in 2.4Ghz band "
1875                       "(802.11bg):\n", geo->bg_channels);
1876
1877         for (i = 0; i < geo->bg_channels; i++) {
1878                 len += sprintf(&buf[len], "%d: BSS%s%s, %s, Band %s.\n",
1879                                geo->bg[i].channel,
1880                                geo->bg[i].flags & IEEE80211_CH_RADAR_DETECT ?
1881                                " (radar spectrum)" : "",
1882                                ((geo->bg[i].flags & IEEE80211_CH_NO_IBSS) ||
1883                                 (geo->bg[i].flags & IEEE80211_CH_RADAR_DETECT))
1884                                ? "" : ", IBSS",
1885                                geo->bg[i].flags & IEEE80211_CH_PASSIVE_ONLY ?
1886                                "passive only" : "active/passive",
1887                                geo->bg[i].flags & IEEE80211_CH_B_ONLY ?
1888                                "B" : "B/G");
1889         }
1890
1891         len += sprintf(&buf[len],
1892                        "Displaying %d channels in 5.2Ghz band "
1893                        "(802.11a):\n", geo->a_channels);
1894         for (i = 0; i < geo->a_channels; i++) {
1895                 len += sprintf(&buf[len], "%d: BSS%s%s, %s.\n",
1896                                geo->a[i].channel,
1897                                geo->a[i].flags & IEEE80211_CH_RADAR_DETECT ?
1898                                " (radar spectrum)" : "",
1899                                ((geo->a[i].flags & IEEE80211_CH_NO_IBSS) ||
1900                                 (geo->a[i].flags & IEEE80211_CH_RADAR_DETECT))
1901                                ? "" : ", IBSS",
1902                                geo->a[i].flags & IEEE80211_CH_PASSIVE_ONLY ?
1903                                "passive only" : "active/passive");
1904         }
1905
1906         return len;
1907 }
1908
1909 static DEVICE_ATTR(channels, S_IRUSR, show_channels, NULL);
1910
1911 static void notify_wx_assoc_event(struct ipw_priv *priv)
1912 {
1913         union iwreq_data wrqu;
1914         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1915         if (priv->status & STATUS_ASSOCIATED)
1916                 memcpy(wrqu.ap_addr.sa_data, priv->bssid, ETH_ALEN);
1917         else
1918                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
1919         wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
1920 }
1921
1922 static void ipw_irq_tasklet(struct ipw_priv *priv)
1923 {
1924         u32 inta, inta_mask, handled = 0;
1925         unsigned long flags;
1926         int rc = 0;
1927
1928         spin_lock_irqsave(&priv->irq_lock, flags);
1929
1930         inta = ipw_read32(priv, IPW_INTA_RW);
1931         inta_mask = ipw_read32(priv, IPW_INTA_MASK_R);
1932         inta &= (IPW_INTA_MASK_ALL & inta_mask);
1933
1934         /* Add any cached INTA values that need to be handled */
1935         inta |= priv->isr_inta;
1936
1937         spin_unlock_irqrestore(&priv->irq_lock, flags);
1938
1939         spin_lock_irqsave(&priv->lock, flags);
1940
1941         /* handle all the justifications for the interrupt */
1942         if (inta & IPW_INTA_BIT_RX_TRANSFER) {
1943                 ipw_rx(priv);
1944                 handled |= IPW_INTA_BIT_RX_TRANSFER;
1945         }
1946
1947         if (inta & IPW_INTA_BIT_TX_CMD_QUEUE) {
1948                 IPW_DEBUG_HC("Command completed.\n");
1949                 rc = ipw_queue_tx_reclaim(priv, &priv->txq_cmd, -1);
1950                 priv->status &= ~STATUS_HCMD_ACTIVE;
1951                 wake_up_interruptible(&priv->wait_command_queue);
1952                 handled |= IPW_INTA_BIT_TX_CMD_QUEUE;
1953         }
1954
1955         if (inta & IPW_INTA_BIT_TX_QUEUE_1) {
1956                 IPW_DEBUG_TX("TX_QUEUE_1\n");
1957                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[0], 0);
1958                 handled |= IPW_INTA_BIT_TX_QUEUE_1;
1959         }
1960
1961         if (inta & IPW_INTA_BIT_TX_QUEUE_2) {
1962                 IPW_DEBUG_TX("TX_QUEUE_2\n");
1963                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[1], 1);
1964                 handled |= IPW_INTA_BIT_TX_QUEUE_2;
1965         }
1966
1967         if (inta & IPW_INTA_BIT_TX_QUEUE_3) {
1968                 IPW_DEBUG_TX("TX_QUEUE_3\n");
1969                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[2], 2);
1970                 handled |= IPW_INTA_BIT_TX_QUEUE_3;
1971         }
1972
1973         if (inta & IPW_INTA_BIT_TX_QUEUE_4) {
1974                 IPW_DEBUG_TX("TX_QUEUE_4\n");
1975                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[3], 3);
1976                 handled |= IPW_INTA_BIT_TX_QUEUE_4;
1977         }
1978
1979         if (inta & IPW_INTA_BIT_STATUS_CHANGE) {
1980                 IPW_WARNING("STATUS_CHANGE\n");
1981                 handled |= IPW_INTA_BIT_STATUS_CHANGE;
1982         }
1983
1984         if (inta & IPW_INTA_BIT_BEACON_PERIOD_EXPIRED) {
1985                 IPW_WARNING("TX_PERIOD_EXPIRED\n");
1986                 handled |= IPW_INTA_BIT_BEACON_PERIOD_EXPIRED;
1987         }
1988
1989         if (inta & IPW_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE) {
1990                 IPW_WARNING("HOST_CMD_DONE\n");
1991                 handled |= IPW_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE;
1992         }
1993
1994         if (inta & IPW_INTA_BIT_FW_INITIALIZATION_DONE) {
1995                 IPW_WARNING("FW_INITIALIZATION_DONE\n");
1996                 handled |= IPW_INTA_BIT_FW_INITIALIZATION_DONE;
1997         }
1998
1999         if (inta & IPW_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE) {
2000                 IPW_WARNING("PHY_OFF_DONE\n");
2001                 handled |= IPW_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE;
2002         }
2003
2004         if (inta & IPW_INTA_BIT_RF_KILL_DONE) {
2005                 IPW_DEBUG_RF_KILL("RF_KILL_DONE\n");
2006                 priv->status |= STATUS_RF_KILL_HW;
2007                 wake_up_interruptible(&priv->wait_command_queue);
2008                 priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
2009                 cancel_delayed_work(&priv->request_scan);
2010                 cancel_delayed_work(&priv->request_direct_scan);
2011                 cancel_delayed_work(&priv->request_passive_scan);
2012                 cancel_delayed_work(&priv->scan_event);
2013                 schedule_work(&priv->link_down);
2014                 queue_delayed_work(priv->workqueue, &priv->rf_kill, 2 * HZ);
2015                 handled |= IPW_INTA_BIT_RF_KILL_DONE;
2016         }
2017
2018         if (inta & IPW_INTA_BIT_FATAL_ERROR) {
2019                 IPW_WARNING("Firmware error detected.  Restarting.\n");
2020                 if (priv->error) {
2021                         IPW_DEBUG_FW("Sysfs 'error' log already exists.\n");
2022                         if (ipw_debug_level & IPW_DL_FW_ERRORS) {
2023                                 struct ipw_fw_error *error =
2024                                     ipw_alloc_error_log(priv);
2025                                 ipw_dump_error_log(priv, error);
2026                                 kfree(error);
2027                         }
2028                 } else {
2029                         priv->error = ipw_alloc_error_log(priv);
2030                         if (priv->error)
2031                                 IPW_DEBUG_FW("Sysfs 'error' log captured.\n");
2032                         else
2033                                 IPW_DEBUG_FW("Error allocating sysfs 'error' "
2034                                              "log.\n");
2035                         if (ipw_debug_level & IPW_DL_FW_ERRORS)
2036                                 ipw_dump_error_log(priv, priv->error);
2037                 }
2038
2039                 /* XXX: If hardware encryption is for WPA/WPA2,
2040                  * we have to notify the supplicant. */
2041                 if (priv->ieee->sec.encrypt) {
2042                         priv->status &= ~STATUS_ASSOCIATED;
2043                         notify_wx_assoc_event(priv);
2044                 }
2045
2046                 /* Keep the restart process from trying to send host
2047                  * commands by clearing the INIT status bit */
2048                 priv->status &= ~STATUS_INIT;
2049
2050                 /* Cancel currently queued command. */
2051                 priv->status &= ~STATUS_HCMD_ACTIVE;
2052                 wake_up_interruptible(&priv->wait_command_queue);
2053
2054                 queue_work(priv->workqueue, &priv->adapter_restart);
2055                 handled |= IPW_INTA_BIT_FATAL_ERROR;
2056         }
2057
2058         if (inta & IPW_INTA_BIT_PARITY_ERROR) {
2059                 IPW_ERROR("Parity error\n");
2060                 handled |= IPW_INTA_BIT_PARITY_ERROR;
2061         }
2062
2063         if (handled != inta) {
2064                 IPW_ERROR("Unhandled INTA bits 0x%08x\n", inta & ~handled);
2065         }
2066
2067         spin_unlock_irqrestore(&priv->lock, flags);
2068
2069         /* enable all interrupts */
2070         ipw_enable_interrupts(priv);
2071 }
2072
2073 #define IPW_CMD(x) case IPW_CMD_ ## x : return #x
2074 static char *get_cmd_string(u8 cmd)
2075 {
2076         switch (cmd) {
2077                 IPW_CMD(HOST_COMPLETE);
2078                 IPW_CMD(POWER_DOWN);
2079                 IPW_CMD(SYSTEM_CONFIG);
2080                 IPW_CMD(MULTICAST_ADDRESS);
2081                 IPW_CMD(SSID);
2082                 IPW_CMD(ADAPTER_ADDRESS);
2083                 IPW_CMD(PORT_TYPE);
2084                 IPW_CMD(RTS_THRESHOLD);
2085                 IPW_CMD(FRAG_THRESHOLD);
2086                 IPW_CMD(POWER_MODE);
2087                 IPW_CMD(WEP_KEY);
2088                 IPW_CMD(TGI_TX_KEY);
2089                 IPW_CMD(SCAN_REQUEST);
2090                 IPW_CMD(SCAN_REQUEST_EXT);
2091                 IPW_CMD(ASSOCIATE);
2092                 IPW_CMD(SUPPORTED_RATES);
2093                 IPW_CMD(SCAN_ABORT);
2094                 IPW_CMD(TX_FLUSH);
2095                 IPW_CMD(QOS_PARAMETERS);
2096                 IPW_CMD(DINO_CONFIG);
2097                 IPW_CMD(RSN_CAPABILITIES);
2098                 IPW_CMD(RX_KEY);
2099                 IPW_CMD(CARD_DISABLE);
2100                 IPW_CMD(SEED_NUMBER);
2101                 IPW_CMD(TX_POWER);
2102                 IPW_CMD(COUNTRY_INFO);
2103                 IPW_CMD(AIRONET_INFO);
2104                 IPW_CMD(AP_TX_POWER);
2105                 IPW_CMD(CCKM_INFO);
2106                 IPW_CMD(CCX_VER_INFO);
2107                 IPW_CMD(SET_CALIBRATION);
2108                 IPW_CMD(SENSITIVITY_CALIB);
2109                 IPW_CMD(RETRY_LIMIT);
2110                 IPW_CMD(IPW_PRE_POWER_DOWN);
2111                 IPW_CMD(VAP_BEACON_TEMPLATE);
2112                 IPW_CMD(VAP_DTIM_PERIOD);
2113                 IPW_CMD(EXT_SUPPORTED_RATES);
2114                 IPW_CMD(VAP_LOCAL_TX_PWR_CONSTRAINT);
2115                 IPW_CMD(VAP_QUIET_INTERVALS);
2116                 IPW_CMD(VAP_CHANNEL_SWITCH);
2117                 IPW_CMD(VAP_MANDATORY_CHANNELS);
2118                 IPW_CMD(VAP_CELL_PWR_LIMIT);
2119                 IPW_CMD(VAP_CF_PARAM_SET);
2120                 IPW_CMD(VAP_SET_BEACONING_STATE);
2121                 IPW_CMD(MEASUREMENT);
2122                 IPW_CMD(POWER_CAPABILITY);
2123                 IPW_CMD(SUPPORTED_CHANNELS);
2124                 IPW_CMD(TPC_REPORT);
2125                 IPW_CMD(WME_INFO);
2126                 IPW_CMD(PRODUCTION_COMMAND);
2127         default:
2128                 return "UNKNOWN";
2129         }
2130 }
2131
2132 #define HOST_COMPLETE_TIMEOUT HZ
2133
2134 static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
2135 {
2136         int rc = 0;
2137         unsigned long flags;
2138
2139         spin_lock_irqsave(&priv->lock, flags);
2140         if (priv->status & STATUS_HCMD_ACTIVE) {
2141                 IPW_ERROR("Failed to send %s: Already sending a command.\n",
2142                           get_cmd_string(cmd->cmd));
2143                 spin_unlock_irqrestore(&priv->lock, flags);
2144                 return -EAGAIN;
2145         }
2146
2147         priv->status |= STATUS_HCMD_ACTIVE;
2148
2149         if (priv->cmdlog) {
2150                 priv->cmdlog[priv->cmdlog_pos].jiffies = jiffies;
2151                 priv->cmdlog[priv->cmdlog_pos].cmd.cmd = cmd->cmd;
2152                 priv->cmdlog[priv->cmdlog_pos].cmd.len = cmd->len;
2153                 memcpy(priv->cmdlog[priv->cmdlog_pos].cmd.param, cmd->param,
2154                        cmd->len);
2155                 priv->cmdlog[priv->cmdlog_pos].retcode = -1;
2156         }
2157
2158         IPW_DEBUG_HC("%s command (#%d) %d bytes: 0x%08X\n",
2159                      get_cmd_string(cmd->cmd), cmd->cmd, cmd->len,
2160                      priv->status);
2161
2162 #ifndef DEBUG_CMD_WEP_KEY
2163         if (cmd->cmd == IPW_CMD_WEP_KEY)
2164                 IPW_DEBUG_HC("WEP_KEY command masked out for secure.\n");
2165         else
2166 #endif
2167                 printk_buf(IPW_DL_HOST_COMMAND, (u8 *) cmd->param, cmd->len);
2168
2169         rc = ipw_queue_tx_hcmd(priv, cmd->cmd, cmd->param, cmd->len, 0);
2170         if (rc) {
2171                 priv->status &= ~STATUS_HCMD_ACTIVE;
2172                 IPW_ERROR("Failed to send %s: Reason %d\n",
2173                           get_cmd_string(cmd->cmd), rc);
2174                 spin_unlock_irqrestore(&priv->lock, flags);
2175                 goto exit;
2176         }
2177         spin_unlock_irqrestore(&priv->lock, flags);
2178
2179         rc = wait_event_interruptible_timeout(priv->wait_command_queue,
2180                                               !(priv->
2181                                                 status & STATUS_HCMD_ACTIVE),
2182                                               HOST_COMPLETE_TIMEOUT);
2183         if (rc == 0) {
2184                 spin_lock_irqsave(&priv->lock, flags);
2185                 if (priv->status & STATUS_HCMD_ACTIVE) {
2186                         IPW_ERROR("Failed to send %s: Command timed out.\n",
2187                                   get_cmd_string(cmd->cmd));
2188                         priv->status &= ~STATUS_HCMD_ACTIVE;
2189                         spin_unlock_irqrestore(&priv->lock, flags);
2190                         rc = -EIO;
2191                         goto exit;
2192                 }
2193                 spin_unlock_irqrestore(&priv->lock, flags);
2194         } else
2195                 rc = 0;
2196
2197         if (priv->status & STATUS_RF_KILL_HW) {
2198                 IPW_ERROR("Failed to send %s: Aborted due to RF kill switch.\n",
2199                           get_cmd_string(cmd->cmd));
2200                 rc = -EIO;
2201                 goto exit;
2202         }
2203
2204       exit:
2205         if (priv->cmdlog) {
2206                 priv->cmdlog[priv->cmdlog_pos++].retcode = rc;
2207                 priv->cmdlog_pos %= priv->cmdlog_len;
2208         }
2209         return rc;
2210 }
2211
2212 static int ipw_send_cmd_simple(struct ipw_priv *priv, u8 command)
2213 {
2214         struct host_cmd cmd = {
2215                 .cmd = command,
2216         };
2217
2218         return __ipw_send_cmd(priv, &cmd);
2219 }
2220
2221 static int ipw_send_cmd_pdu(struct ipw_priv *priv, u8 command, u8 len,
2222                             void *data)
2223 {
2224         struct host_cmd cmd = {
2225                 .cmd = command,
2226                 .len = len,
2227                 .param = data,
2228         };
2229
2230         return __ipw_send_cmd(priv, &cmd);
2231 }
2232
2233 static int ipw_send_host_complete(struct ipw_priv *priv)
2234 {
2235         if (!priv) {
2236                 IPW_ERROR("Invalid args\n");
2237                 return -1;
2238         }
2239
2240         return ipw_send_cmd_simple(priv, IPW_CMD_HOST_COMPLETE);
2241 }
2242
2243 static int ipw_send_system_config(struct ipw_priv *priv)
2244 {
2245         return ipw_send_cmd_pdu(priv, IPW_CMD_SYSTEM_CONFIG,
2246                                 sizeof(priv->sys_config),
2247                                 &priv->sys_config);
2248 }
2249
2250 static int ipw_send_ssid(struct ipw_priv *priv, u8 * ssid, int len)
2251 {
2252         if (!priv || !ssid) {
2253                 IPW_ERROR("Invalid args\n");
2254                 return -1;
2255         }
2256
2257         return ipw_send_cmd_pdu(priv, IPW_CMD_SSID, min(len, IW_ESSID_MAX_SIZE),
2258                                 ssid);
2259 }
2260
2261 static int ipw_send_adapter_address(struct ipw_priv *priv, u8 * mac)
2262 {
2263         if (!priv || !mac) {
2264                 IPW_ERROR("Invalid args\n");
2265                 return -1;
2266         }
2267
2268         IPW_DEBUG_INFO("%s: Setting MAC to %pM\n",
2269                        priv->net_dev->name, mac);
2270
2271         return ipw_send_cmd_pdu(priv, IPW_CMD_ADAPTER_ADDRESS, ETH_ALEN, mac);
2272 }
2273
2274 /*
2275  * NOTE: This must be executed from our workqueue as it results in udelay
2276  * being called which may corrupt the keyboard if executed on default
2277  * workqueue
2278  */
2279 static void ipw_adapter_restart(void *adapter)
2280 {
2281         struct ipw_priv *priv = adapter;
2282
2283         if (priv->status & STATUS_RF_KILL_MASK)
2284                 return;
2285
2286         ipw_down(priv);
2287
2288         if (priv->assoc_network &&
2289             (priv->assoc_network->capability & WLAN_CAPABILITY_IBSS))
2290                 ipw_remove_current_network(priv);
2291
2292         if (ipw_up(priv)) {
2293                 IPW_ERROR("Failed to up device\n");
2294                 return;
2295         }
2296 }
2297
2298 static void ipw_bg_adapter_restart(struct work_struct *work)
2299 {
2300         struct ipw_priv *priv =
2301                 container_of(work, struct ipw_priv, adapter_restart);
2302         mutex_lock(&priv->mutex);
2303         ipw_adapter_restart(priv);
2304         mutex_unlock(&priv->mutex);
2305 }
2306
2307 #define IPW_SCAN_CHECK_WATCHDOG (5 * HZ)
2308
2309 static void ipw_scan_check(void *data)
2310 {
2311         struct ipw_priv *priv = data;
2312         if (priv->status & (STATUS_SCANNING | STATUS_SCAN_ABORTING)) {
2313                 IPW_DEBUG_SCAN("Scan completion watchdog resetting "
2314                                "adapter after (%dms).\n",
2315                                jiffies_to_msecs(IPW_SCAN_CHECK_WATCHDOG));
2316                 queue_work(priv->workqueue, &priv->adapter_restart);
2317         }
2318 }
2319
2320 static void ipw_bg_scan_check(struct work_struct *work)
2321 {
2322         struct ipw_priv *priv =
2323                 container_of(work, struct ipw_priv, scan_check.work);
2324         mutex_lock(&priv->mutex);
2325         ipw_scan_check(priv);
2326         mutex_unlock(&priv->mutex);
2327 }
2328
2329 static int ipw_send_scan_request_ext(struct ipw_priv *priv,
2330                                      struct ipw_scan_request_ext *request)
2331 {
2332         return ipw_send_cmd_pdu(priv, IPW_CMD_SCAN_REQUEST_EXT,
2333                                 sizeof(*request), request);
2334 }
2335
2336 static int ipw_send_scan_abort(struct ipw_priv *priv)
2337 {
2338         if (!priv) {
2339                 IPW_ERROR("Invalid args\n");
2340                 return -1;
2341         }
2342
2343         return ipw_send_cmd_simple(priv, IPW_CMD_SCAN_ABORT);
2344 }
2345
2346 static int ipw_set_sensitivity(struct ipw_priv *priv, u16 sens)
2347 {
2348         struct ipw_sensitivity_calib calib = {
2349                 .beacon_rssi_raw = cpu_to_le16(sens),
2350         };
2351
2352         return ipw_send_cmd_pdu(priv, IPW_CMD_SENSITIVITY_CALIB, sizeof(calib),
2353                                 &calib);
2354 }
2355
2356 static int ipw_send_associate(struct ipw_priv *priv,
2357                               struct ipw_associate *associate)
2358 {
2359         if (!priv || !associate) {
2360                 IPW_ERROR("Invalid args\n");
2361                 return -1;
2362         }
2363
2364         return ipw_send_cmd_pdu(priv, IPW_CMD_ASSOCIATE, sizeof(*associate),
2365                                 associate);
2366 }
2367
2368 static int ipw_send_supported_rates(struct ipw_priv *priv,
2369                                     struct ipw_supported_rates *rates)
2370 {
2371         if (!priv || !rates) {
2372                 IPW_ERROR("Invalid args\n");
2373                 return -1;
2374         }
2375
2376         return ipw_send_cmd_pdu(priv, IPW_CMD_SUPPORTED_RATES, sizeof(*rates),
2377                                 rates);
2378 }
2379
2380 static int ipw_set_random_seed(struct ipw_priv *priv)
2381 {
2382         u32 val;
2383
2384         if (!priv) {
2385                 IPW_ERROR("Invalid args\n");
2386                 return -1;
2387         }
2388
2389         get_random_bytes(&val, sizeof(val));
2390
2391         return ipw_send_cmd_pdu(priv, IPW_CMD_SEED_NUMBER, sizeof(val), &val);
2392 }
2393
2394 static int ipw_send_card_disable(struct ipw_priv *priv, u32 phy_off)
2395 {
2396         __le32 v = cpu_to_le32(phy_off);
2397         if (!priv) {
2398                 IPW_ERROR("Invalid args\n");
2399                 return -1;
2400         }
2401
2402         return ipw_send_cmd_pdu(priv, IPW_CMD_CARD_DISABLE, sizeof(v), &v);
2403 }
2404
2405 static int ipw_send_tx_power(struct ipw_priv *priv, struct ipw_tx_power *power)
2406 {
2407         if (!priv || !power) {
2408                 IPW_ERROR("Invalid args\n");
2409                 return -1;
2410         }
2411
2412         return ipw_send_cmd_pdu(priv, IPW_CMD_TX_POWER, sizeof(*power), power);
2413 }
2414
2415 static int ipw_set_tx_power(struct ipw_priv *priv)
2416 {
2417         const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
2418         struct ipw_tx_power tx_power;
2419         s8 max_power;
2420         int i;
2421
2422         memset(&tx_power, 0, sizeof(tx_power));
2423
2424         /* configure device for 'G' band */
2425         tx_power.ieee_mode = IPW_G_MODE;
2426         tx_power.num_channels = geo->bg_channels;
2427         for (i = 0; i < geo->bg_channels; i++) {
2428                 max_power = geo->bg[i].max_power;
2429                 tx_power.channels_tx_power[i].channel_number =
2430                     geo->bg[i].channel;
2431                 tx_power.channels_tx_power[i].tx_power = max_power ?
2432                     min(max_power, priv->tx_power) : priv->tx_power;
2433         }
2434         if (ipw_send_tx_power(priv, &tx_power))
2435                 return -EIO;
2436
2437         /* configure device to also handle 'B' band */
2438         tx_power.ieee_mode = IPW_B_MODE;
2439         if (ipw_send_tx_power(priv, &tx_power))
2440                 return -EIO;
2441
2442         /* configure device to also handle 'A' band */
2443         if (priv->ieee->abg_true) {
2444                 tx_power.ieee_mode = IPW_A_MODE;
2445                 tx_power.num_channels = geo->a_channels;
2446                 for (i = 0; i < tx_power.num_channels; i++) {
2447                         max_power = geo->a[i].max_power;
2448                         tx_power.channels_tx_power[i].channel_number =
2449                             geo->a[i].channel;
2450                         tx_power.channels_tx_power[i].tx_power = max_power ?
2451                             min(max_power, priv->tx_power) : priv->tx_power;
2452                 }
2453                 if (ipw_send_tx_power(priv, &tx_power))
2454                         return -EIO;
2455         }
2456         return 0;
2457 }
2458
2459 static int ipw_send_rts_threshold(struct ipw_priv *priv, u16 rts)
2460 {
2461         struct ipw_rts_threshold rts_threshold = {
2462                 .rts_threshold = cpu_to_le16(rts),
2463         };
2464
2465         if (!priv) {
2466                 IPW_ERROR("Invalid args\n");
2467                 return -1;
2468         }
2469
2470         return ipw_send_cmd_pdu(priv, IPW_CMD_RTS_THRESHOLD,
2471                                 sizeof(rts_threshold), &rts_threshold);
2472 }
2473
2474 static int ipw_send_frag_threshold(struct ipw_priv *priv, u16 frag)
2475 {
2476         struct ipw_frag_threshold frag_threshold = {
2477                 .frag_threshold = cpu_to_le16(frag),
2478         };
2479
2480         if (!priv) {
2481                 IPW_ERROR("Invalid args\n");
2482                 return -1;
2483         }
2484
2485         return ipw_send_cmd_pdu(priv, IPW_CMD_FRAG_THRESHOLD,
2486                                 sizeof(frag_threshold), &frag_threshold);
2487 }
2488
2489 static int ipw_send_power_mode(struct ipw_priv *priv, u32 mode)
2490 {
2491         __le32 param;
2492
2493         if (!priv) {
2494                 IPW_ERROR("Invalid args\n");
2495                 return -1;
2496         }
2497
2498         /* If on battery, set to 3, if AC set to CAM, else user
2499          * level */
2500         switch (mode) {
2501         case IPW_POWER_BATTERY:
2502                 param = cpu_to_le32(IPW_POWER_INDEX_3);
2503                 break;
2504         case IPW_POWER_AC:
2505                 param = cpu_to_le32(IPW_POWER_MODE_CAM);
2506                 break;
2507         default:
2508                 param = cpu_to_le32(mode);
2509                 break;
2510         }
2511
2512         return ipw_send_cmd_pdu(priv, IPW_CMD_POWER_MODE, sizeof(param),
2513                                 &param);
2514 }
2515
2516 static int ipw_send_retry_limit(struct ipw_priv *priv, u8 slimit, u8 llimit)
2517 {
2518         struct ipw_retry_limit retry_limit = {
2519                 .short_retry_limit = slimit,
2520                 .long_retry_limit = llimit
2521         };
2522
2523         if (!priv) {
2524                 IPW_ERROR("Invalid args\n");
2525                 return -1;
2526         }
2527
2528         return ipw_send_cmd_pdu(priv, IPW_CMD_RETRY_LIMIT, sizeof(retry_limit),
2529                                 &retry_limit);
2530 }
2531
2532 /*
2533  * The IPW device contains a Microwire compatible EEPROM that stores
2534  * various data like the MAC address.  Usually the firmware has exclusive
2535  * access to the eeprom, but during device initialization (before the
2536  * device driver has sent the HostComplete command to the firmware) the
2537  * device driver has read access to the EEPROM by way of indirect addressing
2538  * through a couple of memory mapped registers.
2539  *
2540  * The following is a simplified implementation for pulling data out of the
2541  * the eeprom, along with some helper functions to find information in
2542  * the per device private data's copy of the eeprom.
2543  *
2544  * NOTE: To better understand how these functions work (i.e what is a chip
2545  *       select and why do have to keep driving the eeprom clock?), read
2546  *       just about any data sheet for a Microwire compatible EEPROM.
2547  */
2548
2549 /* write a 32 bit value into the indirect accessor register */
2550 static inline void eeprom_write_reg(struct ipw_priv *p, u32 data)
2551 {
2552         ipw_write_reg32(p, FW_MEM_REG_EEPROM_ACCESS, data);
2553
2554         /* the eeprom requires some time to complete the operation */
2555         udelay(p->eeprom_delay);
2556
2557         return;
2558 }
2559
2560 /* perform a chip select operation */
2561 static void eeprom_cs(struct ipw_priv *priv)
2562 {
2563         eeprom_write_reg(priv, 0);
2564         eeprom_write_reg(priv, EEPROM_BIT_CS);
2565         eeprom_write_reg(priv, EEPROM_BIT_CS | EEPROM_BIT_SK);
2566         eeprom_write_reg(priv, EEPROM_BIT_CS);
2567 }
2568
2569 /* perform a chip select operation */
2570 static void eeprom_disable_cs(struct ipw_priv *priv)
2571 {
2572         eeprom_write_reg(priv, EEPROM_BIT_CS);
2573         eeprom_write_reg(priv, 0);
2574         eeprom_write_reg(priv, EEPROM_BIT_SK);
2575 }
2576
2577 /* push a single bit down to the eeprom */
2578 static inline void eeprom_write_bit(struct ipw_priv *p, u8 bit)
2579 {
2580         int d = (bit ? EEPROM_BIT_DI : 0);
2581         eeprom_write_reg(p, EEPROM_BIT_CS | d);
2582         eeprom_write_reg(p, EEPROM_BIT_CS | d | EEPROM_BIT_SK);
2583 }
2584
2585 /* push an opcode followed by an address down to the eeprom */
2586 static void eeprom_op(struct ipw_priv *priv, u8 op, u8 addr)
2587 {
2588         int i;
2589
2590         eeprom_cs(priv);
2591         eeprom_write_bit(priv, 1);
2592         eeprom_write_bit(priv, op & 2);
2593         eeprom_write_bit(priv, op & 1);
2594         for (i = 7; i >= 0; i--) {
2595                 eeprom_write_bit(priv, addr & (1 << i));
2596         }
2597 }
2598
2599 /* pull 16 bits off the eeprom, one bit at a time */
2600 static u16 eeprom_read_u16(struct ipw_priv *priv, u8 addr)
2601 {
2602         int i;
2603         u16 r = 0;
2604
2605         /* Send READ Opcode */
2606         eeprom_op(priv, EEPROM_CMD_READ, addr);
2607
2608         /* Send dummy bit */
2609         eeprom_write_reg(priv, EEPROM_BIT_CS);
2610
2611         /* Read the byte off the eeprom one bit at a time */
2612         for (i = 0; i < 16; i++) {
2613                 u32 data = 0;
2614                 eeprom_write_reg(priv, EEPROM_BIT_CS | EEPROM_BIT_SK);
2615                 eeprom_write_reg(priv, EEPROM_BIT_CS);
2616                 data = ipw_read_reg32(priv, FW_MEM_REG_EEPROM_ACCESS);
2617                 r = (r << 1) | ((data & EEPROM_BIT_DO) ? 1 : 0);
2618         }
2619
2620         /* Send another dummy bit */
2621         eeprom_write_reg(priv, 0);
2622         eeprom_disable_cs(priv);
2623
2624         return r;
2625 }
2626
2627 /* helper function for pulling the mac address out of the private */
2628 /* data's copy of the eeprom data                                 */
2629 static void eeprom_parse_mac(struct ipw_priv *priv, u8 * mac)
2630 {
2631         memcpy(mac, &priv->eeprom[EEPROM_MAC_ADDRESS], 6);
2632 }
2633
2634 /*
2635  * Either the device driver (i.e. the host) or the firmware can
2636  * load eeprom data into the designated region in SRAM.  If neither
2637  * happens then the FW will shutdown with a fatal error.
2638  *
2639  * In order to signal the FW to load the EEPROM, the EEPROM_LOAD_DISABLE
2640  * bit needs region of shared SRAM needs to be non-zero.
2641  */
2642 static void ipw_eeprom_init_sram(struct ipw_priv *priv)
2643 {
2644         int i;
2645         __le16 *eeprom = (__le16 *) priv->eeprom;
2646
2647         IPW_DEBUG_TRACE(">>\n");
2648
2649         /* read entire contents of eeprom into private buffer */
2650         for (i = 0; i < 128; i++)
2651                 eeprom[i] = cpu_to_le16(eeprom_read_u16(priv, (u8) i));
2652
2653         /*
2654            If the data looks correct, then copy it to our private
2655            copy.  Otherwise let the firmware know to perform the operation
2656            on its own.
2657          */
2658         if (priv->eeprom[EEPROM_VERSION] != 0) {
2659                 IPW_DEBUG_INFO("Writing EEPROM data into SRAM\n");
2660
2661                 /* write the eeprom data to sram */
2662                 for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
2663                         ipw_write8(priv, IPW_EEPROM_DATA + i, priv->eeprom[i]);
2664
2665                 /* Do not load eeprom data on fatal error or suspend */
2666                 ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
2667         } else {
2668                 IPW_DEBUG_INFO("Enabling FW initializationg of SRAM\n");
2669
2670                 /* Load eeprom data on fatal error or suspend */
2671                 ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 1);
2672         }
2673
2674         IPW_DEBUG_TRACE("<<\n");
2675 }
2676
2677 static void ipw_zero_memory(struct ipw_priv *priv, u32 start, u32 count)
2678 {
2679         count >>= 2;
2680         if (!count)
2681                 return;
2682         _ipw_write32(priv, IPW_AUTOINC_ADDR, start);
2683         while (count--)
2684                 _ipw_write32(priv, IPW_AUTOINC_DATA, 0);
2685 }
2686
2687 static inline void ipw_fw_dma_reset_command_blocks(struct ipw_priv *priv)
2688 {
2689         ipw_zero_memory(priv, IPW_SHARED_SRAM_DMA_CONTROL,
2690                         CB_NUMBER_OF_ELEMENTS_SMALL *
2691                         sizeof(struct command_block));
2692 }
2693
2694 static int ipw_fw_dma_enable(struct ipw_priv *priv)
2695 {                               /* start dma engine but no transfers yet */
2696
2697         IPW_DEBUG_FW(">> : \n");
2698
2699         /* Start the dma */
2700         ipw_fw_dma_reset_command_blocks(priv);
2701
2702         /* Write CB base address */
2703         ipw_write_reg32(priv, IPW_DMA_I_CB_BASE, IPW_SHARED_SRAM_DMA_CONTROL);
2704
2705         IPW_DEBUG_FW("<< : \n");
2706         return 0;
2707 }
2708
2709 static void ipw_fw_dma_abort(struct ipw_priv *priv)
2710 {
2711         u32 control = 0;
2712
2713         IPW_DEBUG_FW(">> :\n");
2714
2715         /* set the Stop and Abort bit */
2716         control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_STOP_AND_ABORT;
2717         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
2718         priv->sram_desc.last_cb_index = 0;
2719
2720         IPW_DEBUG_FW("<< \n");
2721 }
2722
2723 static int ipw_fw_dma_write_command_block(struct ipw_priv *priv, int index,
2724                                           struct command_block *cb)
2725 {
2726         u32 address =
2727             IPW_SHARED_SRAM_DMA_CONTROL +
2728             (sizeof(struct command_block) * index);
2729         IPW_DEBUG_FW(">> :\n");
2730
2731         ipw_write_indirect(priv, address, (u8 *) cb,
2732                            (int)sizeof(struct command_block));
2733
2734         IPW_DEBUG_FW("<< :\n");
2735         return 0;
2736
2737 }
2738
2739 static int ipw_fw_dma_kick(struct ipw_priv *priv)
2740 {
2741         u32 control = 0;
2742         u32 index = 0;
2743
2744         IPW_DEBUG_FW(">> :\n");
2745
2746         for (index = 0; index < priv->sram_desc.last_cb_index; index++)
2747                 ipw_fw_dma_write_command_block(priv, index,
2748                                                &priv->sram_desc.cb_list[index]);
2749
2750         /* Enable the DMA in the CSR register */
2751         ipw_clear_bit(priv, IPW_RESET_REG,
2752                       IPW_RESET_REG_MASTER_DISABLED |
2753                       IPW_RESET_REG_STOP_MASTER);
2754
2755         /* Set the Start bit. */
2756         control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_START;
2757         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
2758
2759         IPW_DEBUG_FW("<< :\n");
2760         return 0;
2761 }
2762
2763 static void ipw_fw_dma_dump_command_block(struct ipw_priv *priv)
2764 {
2765         u32 address;
2766         u32 register_value = 0;
2767         u32 cb_fields_address = 0;
2768
2769         IPW_DEBUG_FW(">> :\n");
2770         address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
2771         IPW_DEBUG_FW_INFO("Current CB is 0x%x \n", address);
2772
2773         /* Read the DMA Controlor register */
2774         register_value = ipw_read_reg32(priv, IPW_DMA_I_DMA_CONTROL);
2775         IPW_DEBUG_FW_INFO("IPW_DMA_I_DMA_CONTROL is 0x%x \n", register_value);
2776
2777         /* Print the CB values */
2778         cb_fields_address = address;
2779         register_value = ipw_read_reg32(priv, cb_fields_address);
2780         IPW_DEBUG_FW_INFO("Current CB ControlField is 0x%x \n", register_value);
2781
2782         cb_fields_address += sizeof(u32);
2783         register_value = ipw_read_reg32(priv, cb_fields_address);
2784         IPW_DEBUG_FW_INFO("Current CB Source Field is 0x%x \n", register_value);
2785
2786         cb_fields_address += sizeof(u32);
2787         register_value = ipw_read_reg32(priv, cb_fields_address);
2788         IPW_DEBUG_FW_INFO("Current CB Destination Field is 0x%x \n",
2789                           register_value);
2790
2791         cb_fields_address += sizeof(u32);
2792         register_value = ipw_read_reg32(priv, cb_fields_address);
2793         IPW_DEBUG_FW_INFO("Current CB Status Field is 0x%x \n", register_value);
2794
2795         IPW_DEBUG_FW(">> :\n");
2796 }
2797
2798 static int ipw_fw_dma_command_block_index(struct ipw_priv *priv)
2799 {
2800         u32 current_cb_address = 0;
2801         u32 current_cb_index = 0;
2802
2803         IPW_DEBUG_FW("<< :\n");
2804         current_cb_address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
2805
2806         current_cb_index = (current_cb_address - IPW_SHARED_SRAM_DMA_CONTROL) /
2807             sizeof(struct command_block);
2808
2809         IPW_DEBUG_FW_INFO("Current CB index 0x%x address = 0x%X \n",
2810                           current_cb_index, current_cb_address);
2811
2812         IPW_DEBUG_FW(">> :\n");
2813         return current_cb_index;
2814
2815 }
2816
2817 static int ipw_fw_dma_add_command_block(struct ipw_priv *priv,
2818                                         u32 src_address,
2819                                         u32 dest_address,
2820                                         u32 length,
2821                                         int interrupt_enabled, int is_last)
2822 {
2823
2824         u32 control = CB_VALID | CB_SRC_LE | CB_DEST_LE | CB_SRC_AUTOINC |
2825             CB_SRC_IO_GATED | CB_DEST_AUTOINC | CB_SRC_SIZE_LONG |
2826             CB_DEST_SIZE_LONG;
2827         struct command_block *cb;
2828         u32 last_cb_element = 0;
2829
2830         IPW_DEBUG_FW_INFO("src_address=0x%x dest_address=0x%x length=0x%x\n",
2831                           src_address, dest_address, length);
2832
2833         if (priv->sram_desc.last_cb_index >= CB_NUMBER_OF_ELEMENTS_SMALL)
2834                 return -1;
2835
2836         last_cb_element = priv->sram_desc.last_cb_index;
2837         cb = &priv->sram_desc.cb_list[last_cb_element];
2838         priv->sram_desc.last_cb_index++;
2839
2840         /* Calculate the new CB control word */
2841         if (interrupt_enabled)
2842                 control |= CB_INT_ENABLED;
2843
2844         if (is_last)
2845                 control |= CB_LAST_VALID;
2846
2847         control |= length;
2848
2849         /* Calculate the CB Element's checksum value */
2850         cb->status = control ^ src_address ^ dest_address;
2851
2852         /* Copy the Source and Destination addresses */
2853         cb->dest_addr = dest_address;
2854         cb->source_addr = src_address;
2855
2856         /* Copy the Control Word last */
2857         cb->control = control;
2858
2859         return 0;
2860 }
2861
2862 static int ipw_fw_dma_add_buffer(struct ipw_priv *priv,
2863                                  u32 src_phys, u32 dest_address, u32 length)
2864 {
2865         u32 bytes_left = length;
2866         u32 src_offset = 0;
2867         u32 dest_offset = 0;
2868         int status = 0;
2869         IPW_DEBUG_FW(">> \n");
2870         IPW_DEBUG_FW_INFO("src_phys=0x%x dest_address=0x%x length=0x%x\n",
2871                           src_phys, dest_address, length);
2872         while (bytes_left > CB_MAX_LENGTH) {
2873                 status = ipw_fw_dma_add_command_block(priv,
2874                                                       src_phys + src_offset,
2875                                                       dest_address +
2876                                                       dest_offset,
2877                                                       CB_MAX_LENGTH, 0, 0);
2878                 if (status) {
2879                         IPW_DEBUG_FW_INFO(": Failed\n");
2880                         return -1;
2881                 } else
2882                         IPW_DEBUG_FW_INFO(": Added new cb\n");
2883
2884                 src_offset += CB_MAX_LENGTH;
2885                 dest_offset += CB_MAX_LENGTH;
2886                 bytes_left -= CB_MAX_LENGTH;
2887         }
2888
2889         /* add the buffer tail */
2890         if (bytes_left > 0) {
2891                 status =
2892                     ipw_fw_dma_add_command_block(priv, src_phys + src_offset,
2893                                                  dest_address + dest_offset,
2894                                                  bytes_left, 0, 0);
2895                 if (status) {
2896                         IPW_DEBUG_FW_INFO(": Failed on the buffer tail\n");
2897                         return -1;
2898                 } else
2899                         IPW_DEBUG_FW_INFO
2900                             (": Adding new cb - the buffer tail\n");
2901         }
2902
2903         IPW_DEBUG_FW("<< \n");
2904         return 0;
2905 }
2906
2907 static int ipw_fw_dma_wait(struct ipw_priv *priv)
2908 {
2909         u32 current_index = 0, previous_index;
2910         u32 watchdog = 0;
2911
2912         IPW_DEBUG_FW(">> : \n");
2913
2914         current_index = ipw_fw_dma_command_block_index(priv);
2915         IPW_DEBUG_FW_INFO("sram_desc.last_cb_index:0x%08X\n",
2916                           (int)priv->sram_desc.last_cb_index);
2917
2918         while (current_index < priv->sram_desc.last_cb_index) {
2919                 udelay(50);
2920                 previous_index = current_index;
2921                 current_index = ipw_fw_dma_command_block_index(priv);
2922
2923                 if (previous_index < current_index) {
2924                         watchdog = 0;
2925                         continue;
2926                 }
2927                 if (++watchdog > 400) {
2928                         IPW_DEBUG_FW_INFO("Timeout\n");
2929                         ipw_fw_dma_dump_command_block(priv);
2930                         ipw_fw_dma_abort(priv);
2931                         return -1;
2932                 }
2933         }
2934
2935         ipw_fw_dma_abort(priv);
2936
2937         /*Disable the DMA in the CSR register */
2938         ipw_set_bit(priv, IPW_RESET_REG,
2939                     IPW_RESET_REG_MASTER_DISABLED | IPW_RESET_REG_STOP_MASTER);
2940
2941         IPW_DEBUG_FW("<< dmaWaitSync \n");
2942         return 0;
2943 }
2944
2945 static void ipw_remove_current_network(struct ipw_priv *priv)
2946 {
2947         struct list_head *element, *safe;
2948         struct ieee80211_network *network = NULL;
2949         unsigned long flags;
2950
2951         spin_lock_irqsave(&priv->ieee->lock, flags);
2952         list_for_each_safe(element, safe, &priv->ieee->network_list) {
2953                 network = list_entry(element, struct ieee80211_network, list);
2954                 if (!memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
2955                         list_del(element);
2956                         list_add_tail(&network->list,
2957                                       &priv->ieee->network_free_list);
2958                 }
2959         }
2960         spin_unlock_irqrestore(&priv->ieee->lock, flags);
2961 }
2962
2963 /**
2964  * Check that card is still alive.
2965  * Reads debug register from domain0.
2966  * If card is present, pre-defined value should
2967  * be found there.
2968  *
2969  * @param priv
2970  * @return 1 if card is present, 0 otherwise
2971  */
2972 static inline int ipw_alive(struct ipw_priv *priv)
2973 {
2974         return ipw_read32(priv, 0x90) == 0xd55555d5;
2975 }
2976
2977 /* timeout in msec, attempted in 10-msec quanta */
2978 static int ipw_poll_bit(struct ipw_priv *priv, u32 addr, u32 mask,
2979                                int timeout)
2980 {
2981         int i = 0;
2982
2983         do {
2984                 if ((ipw_read32(priv, addr) & mask) == mask)
2985                         return i;
2986                 mdelay(10);
2987                 i += 10;
2988         } while (i < timeout);
2989
2990         return -ETIME;
2991 }
2992
2993 /* These functions load the firmware and micro code for the operation of
2994  * the ipw hardware.  It assumes the buffer has all the bits for the
2995  * image and the caller is handling the memory allocation and clean up.
2996  */
2997
2998 static int ipw_stop_master(struct ipw_priv *priv)
2999 {
3000         int rc;
3001
3002         IPW_DEBUG_TRACE(">> \n");
3003         /* stop master. typical delay - 0 */
3004         ipw_set_bit(priv, IPW_RESET_REG, IPW_RESET_REG_STOP_MASTER);
3005
3006         /* timeout is in msec, polled in 10-msec quanta */
3007         rc = ipw_poll_bit(priv, IPW_RESET_REG,
3008                           IPW_RESET_REG_MASTER_DISABLED, 100);
3009         if (rc < 0) {
3010                 IPW_ERROR("wait for stop master failed after 100ms\n");
3011                 return -1;
3012         }
3013
3014         IPW_DEBUG_INFO("stop master %dms\n", rc);
3015
3016         return rc;
3017 }
3018
3019 static void ipw_arc_release(struct ipw_priv *priv)
3020 {
3021         IPW_DEBUG_TRACE(">> \n");
3022         mdelay(5);
3023
3024         ipw_clear_bit(priv, IPW_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
3025
3026         /* no one knows timing, for safety add some delay */
3027         mdelay(5);
3028 }
3029
3030 struct fw_chunk {
3031         __le32 address;
3032         __le32 length;
3033 };
3034
3035 static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
3036 {
3037         int rc = 0, i, addr;
3038         u8 cr = 0;
3039         __le16 *image;
3040
3041         image = (__le16 *) data;
3042
3043         IPW_DEBUG_TRACE(">> \n");
3044
3045         rc = ipw_stop_master(priv);
3046
3047         if (rc < 0)
3048                 return rc;
3049
3050         for (addr = IPW_SHARED_LOWER_BOUND;
3051              addr < IPW_REGISTER_DOMAIN1_END; addr += 4) {
3052                 ipw_write32(priv, addr, 0);
3053         }
3054
3055         /* no ucode (yet) */
3056         memset(&priv->dino_alive, 0, sizeof(priv->dino_alive));
3057         /* destroy DMA queues */
3058         /* reset sequence */
3059
3060         ipw_write_reg32(priv, IPW_MEM_HALT_AND_RESET, IPW_BIT_HALT_RESET_ON);
3061         ipw_arc_release(priv);
3062         ipw_write_reg32(priv, IPW_MEM_HALT_AND_RESET, IPW_BIT_HALT_RESET_OFF);
3063         mdelay(1);
3064
3065         /* reset PHY */
3066         ipw_write_reg32(priv, IPW_INTERNAL_CMD_EVENT, IPW_BASEBAND_POWER_DOWN);
3067         mdelay(1);
3068
3069         ipw_write_reg32(priv, IPW_INTERNAL_CMD_EVENT, 0);
3070         mdelay(1);
3071
3072         /* enable ucode store */
3073         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0x0);
3074         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, DINO_ENABLE_CS);
3075         mdelay(1);
3076
3077         /* write ucode */
3078         /**
3079          * @bug
3080          * Do NOT set indirect address register once and then
3081          * store data to indirect data register in the loop.
3082          * It seems very reasonable, but in this case DINO do not
3083          * accept ucode. It is essential to set address each time.
3084          */
3085         /* load new ipw uCode */
3086         for (i = 0; i < len / 2; i++)
3087                 ipw_write_reg16(priv, IPW_BASEBAND_CONTROL_STORE,
3088                                 le16_to_cpu(image[i]));
3089
3090         /* enable DINO */
3091         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0);
3092         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, DINO_ENABLE_SYSTEM);
3093
3094         /* this is where the igx / win driver deveates from the VAP driver. */
3095
3096         /* wait for alive response */
3097         for (i = 0; i < 100; i++) {
3098                 /* poll for incoming data */
3099                 cr = ipw_read_reg8(priv, IPW_BASEBAND_CONTROL_STATUS);
3100                 if (cr & DINO_RXFIFO_DATA)
3101                         break;
3102                 mdelay(1);
3103         }
3104
3105         if (cr & DINO_RXFIFO_DATA) {
3106                 /* alive_command_responce size is NOT multiple of 4 */
3107                 __le32 response_buffer[(sizeof(priv->dino_alive) + 3) / 4];
3108
3109                 for (i = 0; i < ARRAY_SIZE(response_buffer); i++)
3110                         response_buffer[i] =
3111                             cpu_to_le32(ipw_read_reg32(priv,
3112                                                        IPW_BASEBAND_RX_FIFO_READ));
3113                 memcpy(&priv->dino_alive, response_buffer,
3114                        sizeof(priv->dino_alive));
3115                 if (priv->dino_alive.alive_command == 1
3116                     && priv->dino_alive.ucode_valid == 1) {
3117                         rc = 0;
3118                         IPW_DEBUG_INFO
3119                             ("Microcode OK, rev. %d (0x%x) dev. %d (0x%x) "
3120                              "of %02d/%02d/%02d %02d:%02d\n",
3121                              priv->dino_alive.software_revision,
3122                              priv->dino_alive.software_revision,
3123                              priv->dino_alive.device_identifier,
3124                              priv->dino_alive.device_identifier,
3125                              priv->dino_alive.time_stamp[0],
3126                              priv->dino_alive.time_stamp[1],
3127                              priv->dino_alive.time_stamp[2],
3128                              priv->dino_alive.time_stamp[3],
3129                              priv->dino_alive.time_stamp[4]);
3130                 } else {
3131                         IPW_DEBUG_INFO("Microcode is not alive\n");
3132                         rc = -EINVAL;
3133                 }
3134         } else {
3135                 IPW_DEBUG_INFO("No alive response from DINO\n");
3136                 rc = -ETIME;
3137         }
3138
3139         /* disable DINO, otherwise for some reason
3140            firmware have problem getting alive resp. */
3141         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0);
3142
3143         return rc;
3144 }
3145
3146 static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
3147 {
3148         int rc = -1;
3149         int offset = 0;
3150         struct fw_chunk *chunk;
3151         dma_addr_t shared_phys;
3152         u8 *shared_virt;
3153
3154         IPW_DEBUG_TRACE("<< : \n");
3155         shared_virt = pci_alloc_consistent(priv->pci_dev, len, &shared_phys);
3156
3157         if (!shared_virt)
3158                 return -ENOMEM;
3159
3160         memmove(shared_virt, data, len);
3161
3162         /* Start the Dma */
3163         rc = ipw_fw_dma_enable(priv);
3164
3165         if (priv->sram_desc.last_cb_index > 0) {
3166                 /* the DMA is already ready this would be a bug. */
3167                 BUG();
3168                 goto out;
3169         }
3170
3171         do {
3172                 chunk = (struct fw_chunk *)(data + offset);
3173                 offset += sizeof(struct fw_chunk);
3174                 /* build DMA packet and queue up for sending */
3175                 /* dma to chunk->address, the chunk->length bytes from data +
3176                  * offeset*/
3177                 /* Dma loading */
3178                 rc = ipw_fw_dma_add_buffer(priv, shared_phys + offset,
3179                                            le32_to_cpu(chunk->address),
3180                                            le32_to_cpu(chunk->length));
3181                 if (rc) {
3182                         IPW_DEBUG_INFO("dmaAddBuffer Failed\n");
3183                         goto out;
3184                 }
3185
3186                 offset += le32_to_cpu(chunk->length);
3187         } while (offset < len);
3188
3189         /* Run the DMA and wait for the answer */
3190         rc = ipw_fw_dma_kick(priv);
3191         if (rc) {
3192                 IPW_ERROR("dmaKick Failed\n");
3193                 goto out;
3194         }
3195
3196         rc = ipw_fw_dma_wait(priv);
3197         if (rc) {
3198                 IPW_ERROR("dmaWaitSync Failed\n");
3199                 goto out;
3200         }
3201       out:
3202         pci_free_consistent(priv->pci_dev, len, shared_virt, shared_phys);
3203         return rc;
3204 }
3205