drivers/net/wireless/ipw2200.c

   1 /******************************************************************************
   2
   3   Copyright(c) 2003 - 2005 Intel Corporation. All rights reserved.
   4
   5   802.11 status code portion of this file from ethereal-0.10.6:
   6     Copyright 2000, Axis Communications AB
   7     Ethereal - Network traffic analyzer
   8     By Gerald Combs <gerald@ethereal.com>
   9     Copyright 1998 Gerald Combs
  10
  11   This program is free software; you can redistribute it and/or modify it
  12   under the terms of version 2 of the GNU General Public License as
  13   published by the Free Software Foundation.
  14
  15   This program is distributed in the hope that it will be useful, but WITHOUT
  16   ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  17   FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  18   more details.
  19
  20   You should have received a copy of the GNU General Public License along with
  21   this program; if not, write to the Free Software Foundation, Inc., 59
  22   Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  23
  24   The full GNU General Public License is included in this distribution in the
  25   file called LICENSE.
  26
  27   Contact Information:
  28   James P. Ketrenos <ipw2100-admin@linux.intel.com>
  29   Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  30
  31 ******************************************************************************/
  32
  33 #include "ipw2200.h"
  34 #include <linux/version.h>
  35
  36 #define IPW2200_VERSION "git-1.0.8"
  37 #define DRV_DESCRIPTION "Intel(R) PRO/Wireless 2200/2915 Network Driver"
  38 #define DRV_COPYRIGHT   "Copyright(c) 2003-2005 Intel Corporation"
  39 #define DRV_VERSION     IPW2200_VERSION
  40
  41 #define ETH_P_80211_STATS (ETH_P_80211_RAW + 1)
  42
  43 MODULE_DESCRIPTION(DRV_DESCRIPTION);
  44 MODULE_VERSION(DRV_VERSION);
  45 MODULE_AUTHOR(DRV_COPYRIGHT);
  46 MODULE_LICENSE("GPL");
  47
  48 static int cmdlog = 0;
  49 static int debug = 0;
  50 static int channel = 0;
  51 static int mode = 0;
  52
  53 static u32 ipw_debug_level;
  54 static int associate = 1;
  55 static int auto_create = 1;
  56 static int led = 0;
  57 static int disable = 0;
  58 static int bt_coexist = 0;
  59 static int hwcrypto = 1;
  60 static const char ipw_modes[] = {
  61         'a', 'b', 'g', '?'
  62 };
  63
  64 #ifdef CONFIG_IPW_QOS
  65 static int qos_enable = 0;
  66 static int qos_burst_enable = 0;
  67 static int qos_no_ack_mask = 0;
  68 static int burst_duration_CCK = 0;
  69 static int burst_duration_OFDM = 0;
  70
  71 static struct ieee80211_qos_parameters def_qos_parameters_OFDM = {
  72         {QOS_TX0_CW_MIN_OFDM, QOS_TX1_CW_MIN_OFDM, QOS_TX2_CW_MIN_OFDM,
  73          QOS_TX3_CW_MIN_OFDM},
  74         {QOS_TX0_CW_MAX_OFDM, QOS_TX1_CW_MAX_OFDM, QOS_TX2_CW_MAX_OFDM,
  75          QOS_TX3_CW_MAX_OFDM},
  76         {QOS_TX0_AIFS, QOS_TX1_AIFS, QOS_TX2_AIFS, QOS_TX3_AIFS},
  77         {QOS_TX0_ACM, QOS_TX1_ACM, QOS_TX2_ACM, QOS_TX3_ACM},
  78         {QOS_TX0_TXOP_LIMIT_OFDM, QOS_TX1_TXOP_LIMIT_OFDM,
  79          QOS_TX2_TXOP_LIMIT_OFDM, QOS_TX3_TXOP_LIMIT_OFDM}
  80 };
  81
  82 static struct ieee80211_qos_parameters def_qos_parameters_CCK = {
  83         {QOS_TX0_CW_MIN_CCK, QOS_TX1_CW_MIN_CCK, QOS_TX2_CW_MIN_CCK,
  84          QOS_TX3_CW_MIN_CCK},
  85         {QOS_TX0_CW_MAX_CCK, QOS_TX1_CW_MAX_CCK, QOS_TX2_CW_MAX_CCK,
  86          QOS_TX3_CW_MAX_CCK},
  87         {QOS_TX0_AIFS, QOS_TX1_AIFS, QOS_TX2_AIFS, QOS_TX3_AIFS},
  88         {QOS_TX0_ACM, QOS_TX1_ACM, QOS_TX2_ACM, QOS_TX3_ACM},
  89         {QOS_TX0_TXOP_LIMIT_CCK, QOS_TX1_TXOP_LIMIT_CCK, QOS_TX2_TXOP_LIMIT_CCK,
  90          QOS_TX3_TXOP_LIMIT_CCK}
  91 };
  92
  93 static struct ieee80211_qos_parameters def_parameters_OFDM = {
  94         {DEF_TX0_CW_MIN_OFDM, DEF_TX1_CW_MIN_OFDM, DEF_TX2_CW_MIN_OFDM,
  95          DEF_TX3_CW_MIN_OFDM},
  96         {DEF_TX0_CW_MAX_OFDM, DEF_TX1_CW_MAX_OFDM, DEF_TX2_CW_MAX_OFDM,
  97          DEF_TX3_CW_MAX_OFDM},
  98         {DEF_TX0_AIFS, DEF_TX1_AIFS, DEF_TX2_AIFS, DEF_TX3_AIFS},
  99         {DEF_TX0_ACM, DEF_TX1_ACM, DEF_TX2_ACM, DEF_TX3_ACM},
 100         {DEF_TX0_TXOP_LIMIT_OFDM, DEF_TX1_TXOP_LIMIT_OFDM,
 101          DEF_TX2_TXOP_LIMIT_OFDM, DEF_TX3_TXOP_LIMIT_OFDM}
 102 };
 103
 104 static struct ieee80211_qos_parameters def_parameters_CCK = {
 105         {DEF_TX0_CW_MIN_CCK, DEF_TX1_CW_MIN_CCK, DEF_TX2_CW_MIN_CCK,
 106          DEF_TX3_CW_MIN_CCK},
 107         {DEF_TX0_CW_MAX_CCK, DEF_TX1_CW_MAX_CCK, DEF_TX2_CW_MAX_CCK,
 108          DEF_TX3_CW_MAX_CCK},
 109         {DEF_TX0_AIFS, DEF_TX1_AIFS, DEF_TX2_AIFS, DEF_TX3_AIFS},
 110         {DEF_TX0_ACM, DEF_TX1_ACM, DEF_TX2_ACM, DEF_TX3_ACM},
 111         {DEF_TX0_TXOP_LIMIT_CCK, DEF_TX1_TXOP_LIMIT_CCK, DEF_TX2_TXOP_LIMIT_CCK,
 112          DEF_TX3_TXOP_LIMIT_CCK}
 113 };
 114
 115 static u8 qos_oui[QOS_OUI_LEN] = { 0x00, 0x50, 0xF2 };
 116
 117 static int from_priority_to_tx_queue[] = {
 118         IPW_TX_QUEUE_1, IPW_TX_QUEUE_2, IPW_TX_QUEUE_2, IPW_TX_QUEUE_1,
 119         IPW_TX_QUEUE_3, IPW_TX_QUEUE_3, IPW_TX_QUEUE_4, IPW_TX_QUEUE_4
 120 };
 121
 122 static u32 ipw_qos_get_burst_duration(struct ipw_priv *priv);
 123
 124 static int ipw_send_qos_params_command(struct ipw_priv *priv, struct ieee80211_qos_parameters
 125                                        *qos_param);
 126 static int ipw_send_qos_info_command(struct ipw_priv *priv, struct ieee80211_qos_information_element
 127                                      *qos_param);
 128 #endif                          /* CONFIG_IPW_QOS */
 129
 130 static struct iw_statistics *ipw_get_wireless_stats(struct net_device *dev);
 131 static void ipw_remove_current_network(struct ipw_priv *priv);
 132 static void ipw_rx(struct ipw_priv *priv);
 133 static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
 134                                 struct clx2_tx_queue *txq, int qindex);
 135 static int ipw_queue_reset(struct ipw_priv *priv);
 136
 137 static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
 138                              int len, int sync);
 139
 140 static void ipw_tx_queue_free(struct ipw_priv *);
 141
 142 static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *);
 143 static void ipw_rx_queue_free(struct ipw_priv *, struct ipw_rx_queue *);
 144 static void ipw_rx_queue_replenish(void *);
 145 static int ipw_up(struct ipw_priv *);
 146 static void ipw_bg_up(void *);
 147 static void ipw_down(struct ipw_priv *);
 148 static void ipw_bg_down(void *);
 149 static int ipw_config(struct ipw_priv *);
 150 static int init_supported_rates(struct ipw_priv *priv,
 151                                 struct ipw_supported_rates *prates);
 152 static void ipw_set_hwcrypto_keys(struct ipw_priv *);
 153 static void ipw_send_wep_keys(struct ipw_priv *, int);
 154
 155 static int ipw_is_valid_channel(struct ieee80211_device *, u8);
 156 static int ipw_channel_to_index(struct ieee80211_device *, u8);
 157 static u8 ipw_freq_to_channel(struct ieee80211_device *, u32);
 158 static int ipw_set_geo(struct ieee80211_device *, const struct ieee80211_geo *);
 159 static const struct ieee80211_geo *ipw_get_geo(struct ieee80211_device *);
 160
 161 static int snprint_line(char *buf, size_t count,
 162                         const u8 * data, u32 len, u32 ofs)
 163 {
 164         int out, i, j, l;
 165         char c;
 166
 167         out = snprintf(buf, count, "%08X", ofs);
 168
 169         for (l = 0, i = 0; i < 2; i++) {
 170                 out += snprintf(buf + out, count - out, " ");
 171                 for (j = 0; j < 8 && l < len; j++, l++)
 172                         out += snprintf(buf + out, count - out, "%02X ",
 173                                         data[(i * 8 + j)]);
 174                 for (; j < 8; j++)
 175                         out += snprintf(buf + out, count - out, "   ");
 176         }
 177
 178         out += snprintf(buf + out, count - out, " ");
 179         for (l = 0, i = 0; i < 2; i++) {
 180                 out += snprintf(buf + out, count - out, " ");
 181                 for (j = 0; j < 8 && l < len; j++, l++) {
 182                         c = data[(i * 8 + j)];
 183                         if (!isascii(c) || !isprint(c))
 184                                 c = '.';
 185
 186                         out += snprintf(buf + out, count - out, "%c", c);
 187                 }
 188
 189                 for (; j < 8; j++)
 190                         out += snprintf(buf + out, count - out, " ");
 191         }
 192
 193         return out;
 194 }
 195
 196 static void printk_buf(int level, const u8 * data, u32 len)
 197 {
 198         char line[81];
 199         u32 ofs = 0;
 200         if (!(ipw_debug_level & level))
 201                 return;
 202
 203         while (len) {
 204                 snprint_line(line, sizeof(line), &data[ofs],
 205                              min(len, 16U), ofs);
 206                 printk(KERN_DEBUG "%s\n", line);
 207                 ofs += 16;
 208                 len -= min(len, 16U);
 209         }
 210 }
 211
 212 static int snprintk_buf(u8 * output, size_t size, const u8 * data, size_t len)
 213 {
 214         size_t out = size;
 215         u32 ofs = 0;
 216         int total = 0;
 217
 218         while (size && len) {
 219                 out = snprint_line(output, size, &data[ofs],
 220                                    min_t(size_t, len, 16U), ofs);
 221
 222                 ofs += 16;
 223                 output += out;
 224                 size -= out;
 225                 len -= min_t(size_t, len, 16U);
 226                 total += out;
 227         }
 228         return total;
 229 }
 230
 231 /* alias for 32-bit indirect read (for SRAM/reg above 4K), with debug wrapper */
 232 static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg);
 233 #define ipw_read_reg32(a, b) _ipw_read_reg32(a, b)
 234
 235 /* alias for 8-bit indirect read (for SRAM/reg above 4K), with debug wrapper */
 236 static u8 _ipw_read_reg8(struct ipw_priv *ipw, u32 reg);
 237 #define ipw_read_reg8(a, b) _ipw_read_reg8(a, b)
 238
 239 /* 8-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
 240 static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value);
 241 static inline void ipw_write_reg8(struct ipw_priv *a, u32 b, u8 c)
 242 {
 243         IPW_DEBUG_IO("%s %d: write_indirect8(0x%08X, 0x%08X)\n", __FILE__,
 244                      __LINE__, (u32) (b), (u32) (c));
 245         _ipw_write_reg8(a, b, c);
 246 }
 247
 248 /* 16-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
 249 static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value);
 250 static inline void ipw_write_reg16(struct ipw_priv *a, u32 b, u16 c)
 251 {
 252         IPW_DEBUG_IO("%s %d: write_indirect16(0x%08X, 0x%08X)\n", __FILE__,
 253                      __LINE__, (u32) (b), (u32) (c));
 254         _ipw_write_reg16(a, b, c);
 255 }
 256
 257 /* 32-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
 258 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value);
 259 static inline void ipw_write_reg32(struct ipw_priv *a, u32 b, u32 c)
 260 {
 261         IPW_DEBUG_IO("%s %d: write_indirect32(0x%08X, 0x%08X)\n", __FILE__,
 262                      __LINE__, (u32) (b), (u32) (c));
 263         _ipw_write_reg32(a, b, c);
 264 }
 265
 266 /* 8-bit direct write (low 4K) */
 267 #define _ipw_write8(ipw, ofs, val) writeb((val), (ipw)->hw_base + (ofs))
 268
 269 /* 8-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 270 #define ipw_write8(ipw, ofs, val) \
 271  IPW_DEBUG_IO("%s %d: write_direct8(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
 272  _ipw_write8(ipw, ofs, val)
 273
 274
 275 /* 16-bit direct write (low 4K) */
 276 #define _ipw_write16(ipw, ofs, val) writew((val), (ipw)->hw_base + (ofs))
 277
 278 /* 16-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 279 #define ipw_write16(ipw, ofs, val) \
 280  IPW_DEBUG_IO("%s %d: write_direct16(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
 281  _ipw_write16(ipw, ofs, val)
 282
 283
 284 /* 32-bit direct write (low 4K) */
 285 #define _ipw_write32(ipw, ofs, val) writel((val), (ipw)->hw_base + (ofs))
 286
 287 /* 32-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 288 #define ipw_write32(ipw, ofs, val) \
 289  IPW_DEBUG_IO("%s %d: write_direct32(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
 290  _ipw_write32(ipw, ofs, val)
 291
 292
 293 /* 8-bit direct read (low 4K) */
 294 #define _ipw_read8(ipw, ofs) readb((ipw)->hw_base + (ofs))
 295
 296 /* 8-bit direct read (low 4K), with debug wrapper */
 297 static inline u8 __ipw_read8(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
 298 {
 299         IPW_DEBUG_IO("%s %d: read_direct8(0x%08X)\n", f, l, (u32) (ofs));
 300         return _ipw_read8(ipw, ofs);
 301 }
 302
 303 /* alias to 8-bit direct read (low 4K of SRAM/regs), with debug wrapper */
 304 #define ipw_read8(ipw, ofs) __ipw_read8(__FILE__, __LINE__, ipw, ofs)
 305
 306
 307 /* 16-bit direct read (low 4K) */
 308 #define _ipw_read16(ipw, ofs) readw((ipw)->hw_base + (ofs))
 309
 310 /* 16-bit direct read (low 4K), with debug wrapper */
 311 static inline u16 __ipw_read16(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
 312 {
 313         IPW_DEBUG_IO("%s %d: read_direct16(0x%08X)\n", f, l, (u32) (ofs));
 314         return _ipw_read16(ipw, ofs);
 315 }
 316
 317 /* alias to 16-bit direct read (low 4K of SRAM/regs), with debug wrapper */
 318 #define ipw_read16(ipw, ofs) __ipw_read16(__FILE__, __LINE__, ipw, ofs)
 319
 320
 321 /* 32-bit direct read (low 4K) */
 322 #define _ipw_read32(ipw, ofs) readl((ipw)->hw_base + (ofs))
 323
 324 /* 32-bit direct read (low 4K), with debug wrapper */
 325 static inline u32 __ipw_read32(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
 326 {
 327         IPW_DEBUG_IO("%s %d: read_direct32(0x%08X)\n", f, l, (u32) (ofs));
 328         return _ipw_read32(ipw, ofs);
 329 }
 330
 331 /* alias to 32-bit direct read (low 4K of SRAM/regs), with debug wrapper */
 332 #define ipw_read32(ipw, ofs) __ipw_read32(__FILE__, __LINE__, ipw, ofs)
 333
 334
 335 /* multi-byte read (above 4K), with debug wrapper */
 336 static void _ipw_read_indirect(struct ipw_priv *, u32, u8 *, int);
 337 static inline void __ipw_read_indirect(const char *f, int l,
 338                                        struct ipw_priv *a, u32 b, u8 * c, int d)
 339 {
 340         IPW_DEBUG_IO("%s %d: read_indirect(0x%08X) %d bytes\n", f, l, (u32) (b),
 341                      d);
 342         _ipw_read_indirect(a, b, c, d);
 343 }
 344
 345 /* alias to multi-byte read (SRAM/regs above 4K), with debug wrapper */
 346 #define ipw_read_indirect(a, b, c, d) __ipw_read_indirect(__FILE__, __LINE__, a, b, c, d)
 347
 348 /* alias to multi-byte read (SRAM/regs above 4K), with debug wrapper */
 349 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * data,
 350                                 int num);
 351 #define ipw_write_indirect(a, b, c, d) \
 352         IPW_DEBUG_IO("%s %d: write_indirect(0x%08X) %d bytes\n", __FILE__, __LINE__, (u32)(b), d); \
 353         _ipw_write_indirect(a, b, c, d)
 354
 355 /* 32-bit indirect write (above 4K) */
 356 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value)
 357 {
 358         IPW_DEBUG_IO(" %p : reg = 0x%8X : value = 0x%8X\n", priv, reg, value);
 359         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
 360         _ipw_write32(priv, IPW_INDIRECT_DATA, value);
 361 }
 362
 363 /* 8-bit indirect write (above 4K) */
 364 static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value)
 365 {
 366         u32 aligned_addr = reg & IPW_INDIRECT_ADDR_MASK; /* dword align */
 367         u32 dif_len = reg - aligned_addr;
 368
 369         IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
 370         _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 371         _ipw_write8(priv, IPW_INDIRECT_DATA + dif_len, value);
 372 }
 373
 374 /* 16-bit indirect write (above 4K) */
 375 static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value)
 376 {
 377         u32 aligned_addr = reg & IPW_INDIRECT_ADDR_MASK; /* dword align */
 378         u32 dif_len = (reg - aligned_addr) & (~0x1ul);
 379
 380         IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
 381         _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 382         _ipw_write16(priv, IPW_INDIRECT_DATA + dif_len, value);
 383 }
 384
 385
 386 /* 8-bit indirect read (above 4K) */
 387 static u8 _ipw_read_reg8(struct ipw_priv *priv, u32 reg)
 388 {
 389         u32 word;
 390         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg & IPW_INDIRECT_ADDR_MASK);
 391         IPW_DEBUG_IO(" reg = 0x%8X : \n", reg);
 392         word = _ipw_read32(priv, IPW_INDIRECT_DATA);
 393         return (word >> ((reg & 0x3) * 8)) & 0xff;
 394 }
 395
 396 /* 32-bit indirect read (above 4K) */
 397 static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg)
 398 {
 399         u32 value;
 400
 401         IPW_DEBUG_IO("%p : reg = 0x%08x\n", priv, reg);
 402
 403         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
 404         value = _ipw_read32(priv, IPW_INDIRECT_DATA);
 405         IPW_DEBUG_IO(" reg = 0x%4X : value = 0x%4x \n", reg, value);
 406         return value;
 407 }
 408
 409 /* General purpose, no alignment requirement, iterative (multi-byte) read, */
 410 /*    for area above 1st 4K of SRAM/reg space */
 411 static void _ipw_read_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
 412                                int num)
 413 {
 414         u32 aligned_addr = addr & IPW_INDIRECT_ADDR_MASK; /* dword align */
 415         u32 dif_len = addr - aligned_addr;
 416         u32 i;
 417
 418         IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
 419
 420         if (num <= 0) {
 421                 return;
 422         }
 423
 424         /* Read the first dword (or portion) byte by byte */
 425         if (unlikely(dif_len)) {
 426                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 427                 /* Start reading at aligned_addr + dif_len */
 428                 for (i = dif_len; ((i < 4) && (num > 0)); i++, num--)
 429                         *buf++ = _ipw_read8(priv, IPW_INDIRECT_DATA + i);
 430                 aligned_addr += 4;
 431         }
 432
 433         /* Read all of the middle dwords as dwords, with auto-increment */
 434         _ipw_write32(priv, IPW_AUTOINC_ADDR, aligned_addr);
 435         for (; num >= 4; buf += 4, aligned_addr += 4, num -= 4)
 436                 *(u32 *) buf = _ipw_read32(priv, IPW_AUTOINC_DATA);
 437
 438         /* Read the last dword (or portion) byte by byte */
 439         if (unlikely(num)) {
 440                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 441                 for (i = 0; num > 0; i++, num--)
 442                         *buf++ = ipw_read8(priv, IPW_INDIRECT_DATA + i);
 443         }
 444 }
 445
 446 /* General purpose, no alignment requirement, iterative (multi-byte) write, */
 447 /*    for area above 1st 4K of SRAM/reg space */
 448 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
 449                                 int num)
 450 {
 451         u32 aligned_addr = addr & IPW_INDIRECT_ADDR_MASK; /* dword align */
 452         u32 dif_len = addr - aligned_addr;
 453         u32 i;
 454
 455         IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
 456
 457         if (num <= 0) {
 458                 return;
 459         }
 460
 461         /* Write the first dword (or portion) byte by byte */
 462         if (unlikely(dif_len)) {
 463                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 464                 /* Start writing at aligned_addr + dif_len */
 465                 for (i = dif_len; ((i < 4) && (num > 0)); i++, num--, buf++)
 466                         _ipw_write8(priv, IPW_INDIRECT_DATA + i, *buf);
 467                 aligned_addr += 4;
 468         }
 469
 470         /* Write all of the middle dwords as dwords, with auto-increment */
 471         _ipw_write32(priv, IPW_AUTOINC_ADDR, aligned_addr);
 472         for (; num >= 4; buf += 4, aligned_addr += 4, num -= 4)
 473                 _ipw_write32(priv, IPW_AUTOINC_DATA, *(u32 *) buf);
 474
 475         /* Write the last dword (or portion) byte by byte */
 476         if (unlikely(num)) {
 477                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 478                 for (i = 0; num > 0; i++, num--, buf++)
 479                         _ipw_write8(priv, IPW_INDIRECT_DATA + i, *buf);
 480         }
 481 }
 482
 483 /* General purpose, no alignment requirement, iterative (multi-byte) write, */
 484 /*    for 1st 4K of SRAM/regs space */
 485 static void ipw_write_direct(struct ipw_priv *priv, u32 addr, void *buf,
 486                              int num)
 487 {
 488         memcpy_toio((priv->hw_base + addr), buf, num);
 489 }
 490
 491 /* Set bit(s) in low 4K of SRAM/regs */
 492 static inline void ipw_set_bit(struct ipw_priv *priv, u32 reg, u32 mask)
 493 {
 494         ipw_write32(priv, reg, ipw_read32(priv, reg) | mask);
 495 }
 496
 497 /* Clear bit(s) in low 4K of SRAM/regs */
 498 static inline void ipw_clear_bit(struct ipw_priv *priv, u32 reg, u32 mask)
 499 {
 500         ipw_write32(priv, reg, ipw_read32(priv, reg) & ~mask);
 501 }
 502
 503 static inline void ipw_enable_interrupts(struct ipw_priv *priv)
 504 {
 505         if (priv->status & STATUS_INT_ENABLED)
 506                 return;
 507         priv->status |= STATUS_INT_ENABLED;
 508         ipw_write32(priv, IPW_INTA_MASK_R, IPW_INTA_MASK_ALL);
 509 }
 510
 511 static inline void ipw_disable_interrupts(struct ipw_priv *priv)
 512 {
 513         if (!(priv->status & STATUS_INT_ENABLED))
 514                 return;
 515         priv->status &= ~STATUS_INT_ENABLED;
 516         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
 517 }
 518
 519 #ifdef CONFIG_IPW2200_DEBUG
 520 static char *ipw_error_desc(u32 val)
 521 {
 522         switch (val) {
 523         case IPW_FW_ERROR_OK:
 524                 return "ERROR_OK";
 525         case IPW_FW_ERROR_FAIL:
 526                 return "ERROR_FAIL";
 527         case IPW_FW_ERROR_MEMORY_UNDERFLOW:
 528                 return "MEMORY_UNDERFLOW";
 529         case IPW_FW_ERROR_MEMORY_OVERFLOW:
 530                 return "MEMORY_OVERFLOW";
 531         case IPW_FW_ERROR_BAD_PARAM:
 532                 return "BAD_PARAM";
 533         case IPW_FW_ERROR_BAD_CHECKSUM:
 534                 return "BAD_CHECKSUM";
 535         case IPW_FW_ERROR_NMI_INTERRUPT:
 536                 return "NMI_INTERRUPT";
 537         case IPW_FW_ERROR_BAD_DATABASE:
 538                 return "BAD_DATABASE";
 539         case IPW_FW_ERROR_ALLOC_FAIL:
 540                 return "ALLOC_FAIL";
 541         case IPW_FW_ERROR_DMA_UNDERRUN:
 542                 return "DMA_UNDERRUN";
 543         case IPW_FW_ERROR_DMA_STATUS:
 544                 return "DMA_STATUS";
 545         case IPW_FW_ERROR_DINO_ERROR:
 546                 return "DINO_ERROR";
 547         case IPW_FW_ERROR_EEPROM_ERROR:
 548                 return "EEPROM_ERROR";
 549         case IPW_FW_ERROR_SYSASSERT:
 550                 return "SYSASSERT";
 551         case IPW_FW_ERROR_FATAL_ERROR:
 552                 return "FATAL_ERROR";
 553         default:
 554                 return "UNKNOWN_ERROR";
 555         }
 556 }
 557
 558 static void ipw_dump_error_log(struct ipw_priv *priv,
 559                                struct ipw_fw_error *error)
 560 {
 561         u32 i;
 562
 563         if (!error) {
 564                 IPW_ERROR("Error allocating and capturing error log.  "
 565                           "Nothing to dump.\n");
 566                 return;
 567         }
 568
 569         IPW_ERROR("Start IPW Error Log Dump:\n");
 570         IPW_ERROR("Status: 0x%08X, Config: %08X\n",
 571                   error->status, error->config);
 572
 573         for (i = 0; i < error->elem_len; i++)
 574                 IPW_ERROR("%s %i 0x%08x  0x%08x  0x%08x  0x%08x  0x%08x\n",
 575                           ipw_error_desc(error->elem[i].desc),
 576                           error->elem[i].time,
 577                           error->elem[i].blink1,
 578                           error->elem[i].blink2,
 579                           error->elem[i].link1,
 580                           error->elem[i].link2, error->elem[i].data);
 581         for (i = 0; i < error->log_len; i++)
 582                 IPW_ERROR("%i\t0x%08x\t%i\n",
 583                           error->log[i].time,
 584                           error->log[i].data, error->log[i].event);
 585 }
 586 #endif
 587
 588 static inline int ipw_is_init(struct ipw_priv *priv)
 589 {
 590         return (priv->status & STATUS_INIT) ? 1 : 0;
 591 }
 592
 593 static int ipw_get_ordinal(struct ipw_priv *priv, u32 ord, void *val, u32 * len)
 594 {
 595         u32 addr, field_info, field_len, field_count, total_len;
 596
 597         IPW_DEBUG_ORD("ordinal = %i\n", ord);
 598
 599         if (!priv || !val || !len) {
 600                 IPW_DEBUG_ORD("Invalid argument\n");
 601                 return -EINVAL;
 602         }
 603
 604         /* verify device ordinal tables have been initialized */
 605         if (!priv->table0_addr || !priv->table1_addr || !priv->table2_addr) {
 606                 IPW_DEBUG_ORD("Access ordinals before initialization\n");
 607                 return -EINVAL;
 608         }
 609
 610         switch (IPW_ORD_TABLE_ID_MASK & ord) {
 611         case IPW_ORD_TABLE_0_MASK:
 612                 /*
 613                  * TABLE 0: Direct access to a table of 32 bit values
 614                  *
 615                  * This is a very simple table with the data directly
 616                  * read from the table
 617                  */
 618
 619                 /* remove the table id from the ordinal */
 620                 ord &= IPW_ORD_TABLE_VALUE_MASK;
 621
 622                 /* boundary check */
 623                 if (ord > priv->table0_len) {
 624                         IPW_DEBUG_ORD("ordinal value (%i) longer then "
 625                                       "max (%i)\n", ord, priv->table0_len);
 626                         return -EINVAL;
 627                 }
 628
 629                 /* verify we have enough room to store the value */
 630                 if (*len < sizeof(u32)) {
 631                         IPW_DEBUG_ORD("ordinal buffer length too small, "
 632                                       "need %zd\n", sizeof(u32));
 633                         return -EINVAL;
 634                 }
 635
 636                 IPW_DEBUG_ORD("Reading TABLE0[%i] from offset 0x%08x\n",
 637                               ord, priv->table0_addr + (ord << 2));
 638
 639                 *len = sizeof(u32);
 640                 ord <<= 2;
 641                 *((u32 *) val) = ipw_read32(priv, priv->table0_addr + ord);
 642                 break;
 643
 644         case IPW_ORD_TABLE_1_MASK:
 645                 /*
 646                  * TABLE 1: Indirect access to a table of 32 bit values
 647                  *
 648                  * This is a fairly large table of u32 values each
 649                  * representing starting addr for the data (which is
 650                  * also a u32)
 651                  */
 652
 653                 /* remove the table id from the ordinal */
 654                 ord &= IPW_ORD_TABLE_VALUE_MASK;
 655
 656                 /* boundary check */
 657                 if (ord > priv->table1_len) {
 658                         IPW_DEBUG_ORD("ordinal value too long\n");
 659                         return -EINVAL;
 660                 }
 661
 662                 /* verify we have enough room to store the value */
 663                 if (*len < sizeof(u32)) {
 664                         IPW_DEBUG_ORD("ordinal buffer length too small, "
 665                                       "need %zd\n", sizeof(u32));
 666                         return -EINVAL;
 667                 }
 668
 669                 *((u32 *) val) =
 670                     ipw_read_reg32(priv, (priv->table1_addr + (ord << 2)));
 671                 *len = sizeof(u32);
 672                 break;
 673
 674         case IPW_ORD_TABLE_2_MASK:
 675                 /*
 676                  * TABLE 2: Indirect access to a table of variable sized values
 677                  *
 678                  * This table consist of six values, each containing
 679                  *     - dword containing the starting offset of the data
 680                  *     - dword containing the lengh in the first 16bits
 681                  *       and the count in the second 16bits
 682                  */
 683
 684                 /* remove the table id from the ordinal */
 685                 ord &= IPW_ORD_TABLE_VALUE_MASK;
 686
 687                 /* boundary check */
 688                 if (ord > priv->table2_len) {
 689                         IPW_DEBUG_ORD("ordinal value too long\n");
 690                         return -EINVAL;
 691                 }
 692
 693                 /* get the address of statistic */
 694                 addr = ipw_read_reg32(priv, priv->table2_addr + (ord << 3));
 695
 696                 /* get the second DW of statistics ;
 697                  * two 16-bit words - first is length, second is count */
 698                 field_info =
 699                     ipw_read_reg32(priv,
 700                                    priv->table2_addr + (ord << 3) +
 701                                    sizeof(u32));
 702
 703                 /* get each entry length */
 704                 field_len = *((u16 *) & field_info);
 705
 706                 /* get number of entries */
 707                 field_count = *(((u16 *) & field_info) + 1);
 708
 709                 /* abort if not enought memory */
 710                 total_len = field_len * field_count;
 711                 if (total_len > *len) {
 712                         *len = total_len;
 713                         return -EINVAL;
 714                 }
 715
 716                 *len = total_len;
 717                 if (!total_len)
 718                         return 0;
 719
 720                 IPW_DEBUG_ORD("addr = 0x%08x, total_len = %i, "
 721                               "field_info = 0x%08x\n",
 722                               addr, total_len, field_info);
 723                 ipw_read_indirect(priv, addr, val, total_len);
 724                 break;
 725
 726         default:
 727                 IPW_DEBUG_ORD("Invalid ordinal!\n");
 728                 return -EINVAL;
 729
 730         }
 731
 732         return 0;
 733 }
 734
 735 static void ipw_init_ordinals(struct ipw_priv *priv)
 736 {
 737         priv->table0_addr = IPW_ORDINALS_TABLE_LOWER;
 738         priv->table0_len = ipw_read32(priv, priv->table0_addr);
 739
 740         IPW_DEBUG_ORD("table 0 offset at 0x%08x, len = %i\n",
 741                       priv->table0_addr, priv->table0_len);
 742
 743         priv->table1_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_1);
 744         priv->table1_len = ipw_read_reg32(priv, priv->table1_addr);
 745
 746         IPW_DEBUG_ORD("table 1 offset at 0x%08x, len = %i\n",
 747                       priv->table1_addr, priv->table1_len);
 748
 749         priv->table2_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_2);
 750         priv->table2_len = ipw_read_reg32(priv, priv->table2_addr);
 751         priv->table2_len &= 0x0000ffff; /* use first two bytes */
 752
 753         IPW_DEBUG_ORD("table 2 offset at 0x%08x, len = %i\n",
 754                       priv->table2_addr, priv->table2_len);
 755
 756 }
 757
 758 static u32 ipw_register_toggle(u32 reg)
 759 {
 760         reg &= ~IPW_START_STANDBY;
 761         if (reg & IPW_GATE_ODMA)
 762                 reg &= ~IPW_GATE_ODMA;
 763         if (reg & IPW_GATE_IDMA)
 764                 reg &= ~IPW_GATE_IDMA;
 765         if (reg & IPW_GATE_ADMA)
 766                 reg &= ~IPW_GATE_ADMA;
 767         return reg;
 768 }
 769
 770 /*
 771  * LED behavior:
 772  * - On radio ON, turn on any LEDs that require to be on during start
 773  * - On initialization, start unassociated blink
 774  * - On association, disable unassociated blink
 775  * - On disassociation, start unassociated blink
 776  * - On radio OFF, turn off any LEDs started during radio on
 777  *
 778  */
 779 #define LD_TIME_LINK_ON msecs_to_jiffies(300)
 780 #define LD_TIME_LINK_OFF msecs_to_jiffies(2700)
 781 #define LD_TIME_ACT_ON msecs_to_jiffies(250)
 782
 783 static void ipw_led_link_on(struct ipw_priv *priv)
 784 {
 785         unsigned long flags;
 786         u32 led;
 787
 788         /* If configured to not use LEDs, or nic_type is 1,
 789          * then we don't toggle a LINK led */
 790         if (priv->config & CFG_NO_LED || priv->nic_type == EEPROM_NIC_TYPE_1)
 791                 return;
 792
 793         spin_lock_irqsave(&priv->lock, flags);
 794
 795         if (!(priv->status & STATUS_RF_KILL_MASK) &&
 796             !(priv->status & STATUS_LED_LINK_ON)) {
 797                 IPW_DEBUG_LED("Link LED On\n");
 798                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 799                 led |= priv->led_association_on;
 800
 801                 led = ipw_register_toggle(led);
 802
 803                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 804                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 805
 806                 priv->status |= STATUS_LED_LINK_ON;
 807
 808                 /* If we aren't associated, schedule turning the LED off */
 809                 if (!(priv->status & STATUS_ASSOCIATED))
 810                         queue_delayed_work(priv->workqueue,
 811                                            &priv->led_link_off,
 812                                            LD_TIME_LINK_ON);
 813         }
 814
 815         spin_unlock_irqrestore(&priv->lock, flags);
 816 }
 817
 818 static void ipw_bg_led_link_on(void *data)
 819 {
 820         struct ipw_priv *priv = data;
 821         down(&priv->sem);
 822         ipw_led_link_on(data);
 823         up(&priv->sem);
 824 }
 825
 826 static void ipw_led_link_off(struct ipw_priv *priv)
 827 {
 828         unsigned long flags;
 829         u32 led;
 830
 831         /* If configured not to use LEDs, or nic type is 1,
 832          * then we don't goggle the LINK led. */
 833         if (priv->config & CFG_NO_LED || priv->nic_type == EEPROM_NIC_TYPE_1)
 834                 return;
 835
 836         spin_lock_irqsave(&priv->lock, flags);
 837
 838         if (priv->status & STATUS_LED_LINK_ON) {
 839                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 840                 led &= priv->led_association_off;
 841                 led = ipw_register_toggle(led);
 842
 843                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 844                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 845
 846                 IPW_DEBUG_LED("Link LED Off\n");
 847
 848                 priv->status &= ~STATUS_LED_LINK_ON;
 849
 850                 /* If we aren't associated and the radio is on, schedule
 851                  * turning the LED on (blink while unassociated) */
 852                 if (!(priv->status & STATUS_RF_KILL_MASK) &&
 853                     !(priv->status & STATUS_ASSOCIATED))
 854                         queue_delayed_work(priv->workqueue, &priv->led_link_on,
 855                                            LD_TIME_LINK_OFF);
 856
 857         }
 858
 859         spin_unlock_irqrestore(&priv->lock, flags);
 860 }
 861
 862 static void ipw_bg_led_link_off(void *data)
 863 {
 864         struct ipw_priv *priv = data;
 865         down(&priv->sem);
 866         ipw_led_link_off(data);
 867         up(&priv->sem);
 868 }
 869
 870 static void __ipw_led_activity_on(struct ipw_priv *priv)
 871 {
 872         u32 led;
 873
 874         if (priv->config & CFG_NO_LED)
 875                 return;
 876
 877         if (priv->status & STATUS_RF_KILL_MASK)
 878                 return;
 879
 880         if (!(priv->status & STATUS_LED_ACT_ON)) {
 881                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 882                 led |= priv->led_activity_on;
 883
 884                 led = ipw_register_toggle(led);
 885
 886                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 887                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 888
 889                 IPW_DEBUG_LED("Activity LED On\n");
 890
 891                 priv->status |= STATUS_LED_ACT_ON;
 892
 893                 cancel_delayed_work(&priv->led_act_off);
 894                 queue_delayed_work(priv->workqueue, &priv->led_act_off,
 895                                    LD_TIME_ACT_ON);
 896         } else {
 897                 /* Reschedule LED off for full time period */
 898                 cancel_delayed_work(&priv->led_act_off);
 899                 queue_delayed_work(priv->workqueue, &priv->led_act_off,
 900                                    LD_TIME_ACT_ON);
 901         }
 902 }
 903
 904 #if 0
 905 void ipw_led_activity_on(struct ipw_priv *priv)
 906 {
 907         unsigned long flags;
 908         spin_lock_irqsave(&priv->lock, flags);
 909         __ipw_led_activity_on(priv);
 910         spin_unlock_irqrestore(&priv->lock, flags);
 911 }
 912 #endif  /*  0  */
 913
 914 static void ipw_led_activity_off(struct ipw_priv *priv)
 915 {
 916         unsigned long flags;
 917         u32 led;
 918
 919         if (priv->config & CFG_NO_LED)
 920                 return;
 921
 922         spin_lock_irqsave(&priv->lock, flags);
 923
 924         if (priv->status & STATUS_LED_ACT_ON) {
 925                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 926                 led &= priv->led_activity_off;
 927
 928                 led = ipw_register_toggle(led);
 929
 930                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 931                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 932
 933                 IPW_DEBUG_LED("Activity LED Off\n");
 934
 935                 priv->status &= ~STATUS_LED_ACT_ON;
 936         }
 937
 938         spin_unlock_irqrestore(&priv->lock, flags);
 939 }
 940
 941 static void ipw_bg_led_activity_off(void *data)
 942 {
 943         struct ipw_priv *priv = data;
 944         down(&priv->sem);
 945         ipw_led_activity_off(data);
 946         up(&priv->sem);
 947 }
 948
 949 static void ipw_led_band_on(struct ipw_priv *priv)
 950 {
 951         unsigned long flags;
 952         u32 led;
 953
 954         /* Only nic type 1 supports mode LEDs */
 955         if (priv->config & CFG_NO_LED ||
 956             priv->nic_type != EEPROM_NIC_TYPE_1 || !priv->assoc_network)
 957                 return;
 958
 959         spin_lock_irqsave(&priv->lock, flags);
 960
 961         led = ipw_read_reg32(priv, IPW_EVENT_REG);
 962         if (priv->assoc_network->mode == IEEE_A) {
 963                 led |= priv->led_ofdm_on;
 964                 led &= priv->led_association_off;
 965                 IPW_DEBUG_LED("Mode LED On: 802.11a\n");
 966         } else if (priv->assoc_network->mode == IEEE_G) {
 967                 led |= priv->led_ofdm_on;
 968                 led |= priv->led_association_on;
 969                 IPW_DEBUG_LED("Mode LED On: 802.11g\n");
 970         } else {
 971                 led &= priv->led_ofdm_off;
 972                 led |= priv->led_association_on;
 973                 IPW_DEBUG_LED("Mode LED On: 802.11b\n");
 974         }
 975
 976         led = ipw_register_toggle(led);
 977
 978         IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 979         ipw_write_reg32(priv, IPW_EVENT_REG, led);
 980
 981         spin_unlock_irqrestore(&priv->lock, flags);
 982 }
 983
 984 static void ipw_led_band_off(struct ipw_priv *priv)
 985 {
 986         unsigned long flags;
 987         u32 led;
 988
 989         /* Only nic type 1 supports mode LEDs */
 990         if (priv->config & CFG_NO_LED || priv->nic_type != EEPROM_NIC_TYPE_1)
 991                 return;
 992
 993         spin_lock_irqsave(&priv->lock, flags);
 994
 995         led = ipw_read_reg32(priv, IPW_EVENT_REG);
 996         led &= priv->led_ofdm_off;
 997         led &= priv->led_association_off;
 998
 999         led = ipw_register_toggle(led);
1000
1001         IPW_DEBUG_LED("Reg: 0x%08X\n", led);
1002         ipw_write_reg32(priv, IPW_EVENT_REG, led);
1003
1004         spin_unlock_irqrestore(&priv->lock, flags);
1005 }
1006
1007 static void ipw_led_radio_on(struct ipw_priv *priv)
1008 {
1009         ipw_led_link_on(priv);
1010 }
1011
1012 static void ipw_led_radio_off(struct ipw_priv *priv)
1013 {
1014         ipw_led_activity_off(priv);
1015         ipw_led_link_off(priv);
1016 }
1017
1018 static void ipw_led_link_up(struct ipw_priv *priv)
1019 {
1020         /* Set the Link Led on for all nic types */
1021         ipw_led_link_on(priv);
1022 }
1023
1024 static void ipw_led_link_down(struct ipw_priv *priv)
1025 {
1026         ipw_led_activity_off(priv);
1027         ipw_led_link_off(priv);
1028
1029         if (priv->status & STATUS_RF_KILL_MASK)
1030                 ipw_led_radio_off(priv);
1031 }
1032
1033 static void ipw_led_init(struct ipw_priv *priv)
1034 {
1035         priv->nic_type = priv->eeprom[EEPROM_NIC_TYPE];
1036
1037         /* Set the default PINs for the link and activity leds */
1038         priv->led_activity_on = IPW_ACTIVITY_LED;
1039         priv->led_activity_off = ~(IPW_ACTIVITY_LED);
1040
1041         priv->led_association_on = IPW_ASSOCIATED_LED;
1042         priv->led_association_off = ~(IPW_ASSOCIATED_LED);
1043
1044         /* Set the default PINs for the OFDM leds */
1045         priv->led_ofdm_on = IPW_OFDM_LED;
1046         priv->led_ofdm_off = ~(IPW_OFDM_LED);
1047
1048         switch (priv->nic_type) {
1049         case EEPROM_NIC_TYPE_1:
1050                 /* In this NIC type, the LEDs are reversed.... */
1051                 priv->led_activity_on = IPW_ASSOCIATED_LED;
1052                 priv->led_activity_off = ~(IPW_ASSOCIATED_LED);
1053                 priv->led_association_on = IPW_ACTIVITY_LED;
1054                 priv->led_association_off = ~(IPW_ACTIVITY_LED);
1055
1056                 if (!(priv->config & CFG_NO_LED))
1057                         ipw_led_band_on(priv);
1058
1059                 /* And we don't blink link LEDs for this nic, so
1060                  * just return here */
1061                 return;
1062
1063         case EEPROM_NIC_TYPE_3:
1064         case EEPROM_NIC_TYPE_2:
1065         case EEPROM_NIC_TYPE_4:
1066         case EEPROM_NIC_TYPE_0:
1067                 break;
1068
1069         default:
1070                 IPW_DEBUG_INFO("Unknown NIC type from EEPROM: %d\n",
1071                                priv->nic_type);
1072                 priv->nic_type = EEPROM_NIC_TYPE_0;
1073                 break;
1074         }
1075
1076         if (!(priv->config & CFG_NO_LED)) {
1077                 if (priv->status & STATUS_ASSOCIATED)
1078                         ipw_led_link_on(priv);
1079                 else
1080                         ipw_led_link_off(priv);
1081         }
1082 }
1083
1084 static void ipw_led_shutdown(struct ipw_priv *priv)
1085 {
1086         ipw_led_activity_off(priv);
1087         ipw_led_link_off(priv);
1088         ipw_led_band_off(priv);
1089         cancel_delayed_work(&priv->led_link_on);
1090         cancel_delayed_work(&priv->led_link_off);
1091         cancel_delayed_work(&priv->led_act_off);
1092 }
1093
1094 /*
1095  * The following adds a new attribute to the sysfs representation
1096  * of this device driver (i.e. a new file in /sys/bus/pci/drivers/ipw/)
1097  * used for controling the debug level.
1098  *
1099  * See the level definitions in ipw for details.
1100  */
1101 static ssize_t show_debug_level(struct device_driver *d, char *buf)
1102 {
1103         return sprintf(buf, "0x%08X\n", ipw_debug_level);
1104 }
1105
1106 static ssize_t store_debug_level(struct device_driver *d, const char *buf,
1107                                  size_t count)
1108 {
1109         char *p = (char *)buf;
1110         u32 val;
1111
1112         if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
1113                 p++;
1114                 if (p[0] == 'x' || p[0] == 'X')
1115                         p++;
1116                 val = simple_strtoul(p, &p, 16);
1117         } else
1118                 val = simple_strtoul(p, &p, 10);
1119         if (p == buf)
1120                 printk(KERN_INFO DRV_NAME
1121                        ": %s is not in hex or decimal form.\n", buf);
1122         else
1123                 ipw_debug_level = val;
1124
1125         return strnlen(buf, count);
1126 }
1127
1128 static DRIVER_ATTR(debug_level, S_IWUSR | S_IRUGO,
1129                    show_debug_level, store_debug_level);
1130
1131 static inline u32 ipw_get_event_log_len(struct ipw_priv *priv)
1132 {
1133         /* length = 1st dword in log */
1134         return ipw_read_reg32(priv, ipw_read32(priv, IPW_EVENT_LOG));
1135 }
1136
1137 static void ipw_capture_event_log(struct ipw_priv *priv,
1138                                   u32 log_len, struct ipw_event *log)
1139 {
1140         u32 base;
1141
1142         if (log_len) {
1143                 base = ipw_read32(priv, IPW_EVENT_LOG);
1144                 ipw_read_indirect(priv, base + sizeof(base) + sizeof(u32),
1145                                   (u8 *) log, sizeof(*log) * log_len);
1146         }
1147 }
1148
1149 static struct ipw_fw_error *ipw_alloc_error_log(struct ipw_priv *priv)
1150 {
1151         struct ipw_fw_error *error;
1152         u32 log_len = ipw_get_event_log_len(priv);
1153         u32 base = ipw_read32(priv, IPW_ERROR_LOG);
1154         u32 elem_len = ipw_read_reg32(priv, base);
1155
1156         error = kmalloc(sizeof(*error) +
1157                         sizeof(*error->elem) * elem_len +
1158                         sizeof(*error->log) * log_len, GFP_ATOMIC);
1159         if (!error) {
1160                 IPW_ERROR("Memory allocation for firmware error log "
1161                           "failed.\n");
1162                 return NULL;
1163         }
1164         error->jiffies = jiffies;
1165         error->status = priv->status;
1166         error->config = priv->config;
1167         error->elem_len = elem_len;
1168         error->log_len = log_len;
1169         error->elem = (struct ipw_error_elem *)error->payload;
1170         error->log = (struct ipw_event *)(error->elem + elem_len);
1171
1172         ipw_capture_event_log(priv, log_len, error->log);
1173
1174         if (elem_len)
1175                 ipw_read_indirect(priv, base + sizeof(base), (u8 *) error->elem,
1176                                   sizeof(*error->elem) * elem_len);
1177
1178         return error;
1179 }
1180
1181 static void ipw_free_error_log(struct ipw_fw_error *error)
1182 {
1183         if (error)
1184                 kfree(error);
1185 }
1186
1187 static ssize_t show_event_log(struct device *d,
1188                               struct device_attribute *attr, char *buf)
1189 {
1190         struct ipw_priv *priv = dev_get_drvdata(d);
1191         u32 log_len = ipw_get_event_log_len(priv);
1192         struct ipw_event log[log_len];
1193         u32 len = 0, i;
1194
1195         ipw_capture_event_log(priv, log_len, log);
1196
1197         len += snprintf(buf + len, PAGE_SIZE - len, "%08X", log_len);
1198         for (i = 0; i < log_len; i++)
1199                 len += snprintf(buf + len, PAGE_SIZE - len,
1200                                 "\n%08X%08X%08X",
1201                                 log[i].time, log[i].event, log[i].data);
1202         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1203         return len;
1204 }
1205
1206 static DEVICE_ATTR(event_log, S_IRUGO, show_event_log, NULL);
1207
1208 static ssize_t show_error(struct device *d,
1209                           struct device_attribute *attr, char *buf)
1210 {
1211         struct ipw_priv *priv = dev_get_drvdata(d);
1212         u32 len = 0, i;
1213         if (!priv->error)
1214                 return 0;
1215         len += snprintf(buf + len, PAGE_SIZE - len,
1216                         "%08lX%08X%08X%08X",
1217                         priv->error->jiffies,
1218                         priv->error->status,
1219                         priv->error->config, priv->error->elem_len);
1220         for (i = 0; i < priv->error->elem_len; i++)
1221                 len += snprintf(buf + len, PAGE_SIZE - len,
1222                                 "\n%08X%08X%08X%08X%08X%08X%08X",
1223                                 priv->error->elem[i].time,
1224                                 priv->error->elem[i].desc,
1225                                 priv->error->elem[i].blink1,
1226                                 priv->error->elem[i].blink2,
1227                                 priv->error->elem[i].link1,
1228                                 priv->error->elem[i].link2,
1229                                 priv->error->elem[i].data);
1230
1231         len += snprintf(buf + len, PAGE_SIZE - len,
1232                         "\n%08X", priv->error->log_len);
1233         for (i = 0; i < priv->error->log_len; i++)
1234                 len += snprintf(buf + len, PAGE_SIZE - len,
1235                                 "\n%08X%08X%08X",
1236                                 priv->error->log[i].time,
1237                                 priv->error->log[i].event,
1238                                 priv->error->log[i].data);
1239         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1240         return len;
1241 }
1242
1243 static ssize_t clear_error(struct device *d,
1244                            struct device_attribute *attr,
1245                            const char *buf, size_t count)
1246 {
1247         struct ipw_priv *priv = dev_get_drvdata(d);
1248         if (priv->error) {
1249                 ipw_free_error_log(priv->error);
1250                 priv->error = NULL;
1251         }
1252         return count;
1253 }
1254
1255 static DEVICE_ATTR(error, S_IRUGO | S_IWUSR, show_error, clear_error);
1256
1257 static ssize_t show_cmd_log(struct device *d,
1258                             struct device_attribute *attr, char *buf)
1259 {
1260         struct ipw_priv *priv = dev_get_drvdata(d);
1261         u32 len = 0, i;
1262         if (!priv->cmdlog)
1263                 return 0;
1264         for (i = (priv->cmdlog_pos + 1) % priv->cmdlog_len;
1265              (i != priv->cmdlog_pos) && (PAGE_SIZE - len);
1266              i = (i + 1) % priv->cmdlog_len) {
1267                 len +=
1268                     snprintf(buf + len, PAGE_SIZE - len,
1269                              "\n%08lX%08X%08X%08X\n", priv->cmdlog[i].jiffies,
1270                              priv->cmdlog[i].retcode, priv->cmdlog[i].cmd.cmd,
1271                              priv->cmdlog[i].cmd.len);
1272                 len +=
1273                     snprintk_buf(buf + len, PAGE_SIZE - len,
1274                                  (u8 *) priv->cmdlog[i].cmd.param,
1275                                  priv->cmdlog[i].cmd.len);
1276                 len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1277         }
1278         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1279         return len;
1280 }
1281
1282 static DEVICE_ATTR(cmd_log, S_IRUGO, show_cmd_log, NULL);
1283
1284 static ssize_t show_scan_age(struct device *d, struct device_attribute *attr,
1285                              char *buf)
1286 {
1287         struct ipw_priv *priv = dev_get_drvdata(d);
1288         return sprintf(buf, "%d\n", priv->ieee->scan_age);
1289 }
1290
1291 static ssize_t store_scan_age(struct device *d, struct device_attribute *attr,
1292                               const char *buf, size_t count)
1293 {
1294         struct ipw_priv *priv = dev_get_drvdata(d);
1295 #ifdef CONFIG_IPW2200_DEBUG
1296         struct net_device *dev = priv->net_dev;
1297 #endif
1298         char buffer[] = "00000000";
1299         unsigned long len =
1300             (sizeof(buffer) - 1) > count ? count : sizeof(buffer) - 1;
1301         unsigned long val;
1302         char *p = buffer;
1303
1304         IPW_DEBUG_INFO("enter\n");
1305
1306         strncpy(buffer, buf, len);
1307         buffer[len] = 0;
1308
1309         if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
1310                 p++;
1311                 if (p[0] == 'x' || p[0] == 'X')
1312                         p++;
1313                 val = simple_strtoul(p, &p, 16);
1314         } else
1315                 val = simple_strtoul(p, &p, 10);
1316         if (p == buffer) {
1317                 IPW_DEBUG_INFO("%s: user supplied invalid value.\n", dev->name);
1318         } else {
1319                 priv->ieee->scan_age = val;
1320                 IPW_DEBUG_INFO("set scan_age = %u\n", priv->ieee->scan_age);
1321         }
1322
1323         IPW_DEBUG_INFO("exit\n");
1324         return len;
1325 }
1326
1327 static DEVICE_ATTR(scan_age, S_IWUSR | S_IRUGO, show_scan_age, store_scan_age);
1328
1329 static ssize_t show_led(struct device *d, struct device_attribute *attr,
1330                         char *buf)
1331 {
1332         struct ipw_priv *priv = dev_get_drvdata(d);
1333         return sprintf(buf, "%d\n", (priv->config & CFG_NO_LED) ? 0 : 1);
1334 }
1335
1336 static ssize_t store_led(struct device *d, struct device_attribute *attr,
1337                          const char *buf, size_t count)
1338 {
1339         struct ipw_priv *priv = dev_get_drvdata(d);
1340
1341         IPW_DEBUG_INFO("enter\n");
1342
1343         if (count == 0)
1344                 return 0;
1345
1346         if (*buf == 0) {
1347                 IPW_DEBUG_LED("Disabling LED control.\n");
1348                 priv->config |= CFG_NO_LED;
1349                 ipw_led_shutdown(priv);
1350         } else {
1351                 IPW_DEBUG_LED("Enabling LED control.\n");
1352                 priv->config &= ~CFG_NO_LED;
1353                 ipw_led_init(priv);
1354         }
1355
1356         IPW_DEBUG_INFO("exit\n");
1357         return count;
1358 }
1359
1360 static DEVICE_ATTR(led, S_IWUSR | S_IRUGO, show_led, store_led);
1361
1362 static ssize_t show_status(struct device *d,
1363                            struct device_attribute *attr, char *buf)
1364 {
1365         struct ipw_priv *p = d->driver_data;
1366         return sprintf(buf, "0x%08x\n", (int)p->status);
1367 }
1368
1369 static DEVICE_ATTR(status, S_IRUGO, show_status, NULL);
1370
1371 static ssize_t show_cfg(struct device *d, struct device_attribute *attr,
1372                         char *buf)
1373 {
1374         struct ipw_priv *p = d->driver_data;
1375         return sprintf(buf, "0x%08x\n", (int)p->config);
1376 }
1377
1378 static DEVICE_ATTR(cfg, S_IRUGO, show_cfg, NULL);
1379
1380 static ssize_t show_nic_type(struct device *d,
1381                              struct device_attribute *attr, char *buf)
1382 {
1383         struct ipw_priv *priv = d->driver_data;
1384         return sprintf(buf, "TYPE: %d\n", priv->nic_type);
1385 }
1386
1387 static DEVICE_ATTR(nic_type, S_IRUGO, show_nic_type, NULL);
1388
1389 static ssize_t show_ucode_version(struct device *d,
1390                                   struct device_attribute *attr, char *buf)
1391 {
1392         u32 len = sizeof(u32), tmp = 0;
1393         struct ipw_priv *p = d->driver_data;
1394
1395         if (ipw_get_ordinal(p, IPW_ORD_STAT_UCODE_VERSION, &tmp, &len))
1396                 return 0;
1397
1398         return sprintf(buf, "0x%08x\n", tmp);
1399 }
1400
1401 static DEVICE_ATTR(ucode_version, S_IWUSR | S_IRUGO, show_ucode_version, NULL);
1402
1403 static ssize_t show_rtc(struct device *d, struct device_attribute *attr,
1404                         char *buf)
1405 {
1406         u32 len = sizeof(u32), tmp = 0;
1407         struct ipw_priv *p = d->driver_data;
1408
1409         if (ipw_get_ordinal(p, IPW_ORD_STAT_RTC, &tmp, &len))
1410                 return 0;
1411
1412         return sprintf(buf, "0x%08x\n", tmp);
1413 }
1414
1415 static DEVICE_ATTR(rtc, S_IWUSR | S_IRUGO, show_rtc, NULL);
1416
1417 /*
1418  * Add a device attribute to view/control the delay between eeprom
1419  * operations.
1420  */
1421 static ssize_t show_eeprom_delay(struct device *d,
1422                                  struct device_attribute *attr, char *buf)
1423 {
1424         int n = ((struct ipw_priv *)d->driver_data)->eeprom_delay;
1425         return sprintf(buf, "%i\n", n);
1426 }
1427 static ssize_t store_eeprom_delay(struct device *d,
1428                                   struct device_attribute *attr,
1429                                   const char *buf, size_t count)
1430 {
1431         struct ipw_priv *p = d->driver_data;
1432         sscanf(buf, "%i", &p->eeprom_delay);
1433         return strnlen(buf, count);
1434 }
1435
1436 static DEVICE_ATTR(eeprom_delay, S_IWUSR | S_IRUGO,
1437                    show_eeprom_delay, store_eeprom_delay);
1438
1439 static ssize_t show_command_event_reg(struct device *d,
1440                                       struct device_attribute *attr, char *buf)
1441 {
1442         u32 reg = 0;
1443         struct ipw_priv *p = d->driver_data;
1444
1445         reg = ipw_read_reg32(p, IPW_INTERNAL_CMD_EVENT);
1446         return sprintf(buf, "0x%08x\n", reg);
1447 }
1448 static ssize_t store_command_event_reg(struct device *d,
1449                                        struct device_attribute *attr,
1450                                        const char *buf, size_t count)
1451 {
1452         u32 reg;
1453         struct ipw_priv *p = d->driver_data;
1454
1455         sscanf(buf, "%x", &reg);
1456         ipw_write_reg32(p, IPW_INTERNAL_CMD_EVENT, reg);
1457         return strnlen(buf, count);
1458 }
1459
1460 static DEVICE_ATTR(command_event_reg, S_IWUSR | S_IRUGO,
1461                    show_command_event_reg, store_command_event_reg);
1462
1463 static ssize_t show_mem_gpio_reg(struct device *d,
1464                                  struct device_attribute *attr, char *buf)
1465 {
1466         u32 reg = 0;
1467         struct ipw_priv *p = d->driver_data;
1468
1469         reg = ipw_read_reg32(p, 0x301100);
1470         return sprintf(buf, "0x%08x\n", reg);
1471 }
1472 static ssize_t store_mem_gpio_reg(struct device *d,
1473                                   struct device_attribute *attr,
1474                                   const char *buf, size_t count)
1475 {
1476         u32 reg;
1477         struct ipw_priv *p = d->driver_data;
1478
1479         sscanf(buf, "%x", &reg);
1480         ipw_write_reg32(p, 0x301100, reg);
1481         return strnlen(buf, count);
1482 }
1483
1484 static DEVICE_ATTR(mem_gpio_reg, S_IWUSR | S_IRUGO,
1485                    show_mem_gpio_reg, store_mem_gpio_reg);
1486
1487 static ssize_t show_indirect_dword(struct device *d,
1488                                    struct device_attribute *attr, char *buf)
1489 {
1490         u32 reg = 0;
1491         struct ipw_priv *priv = d->driver_data;
1492
1493         if (priv->status & STATUS_INDIRECT_DWORD)
1494                 reg = ipw_read_reg32(priv, priv->indirect_dword);
1495         else
1496                 reg = 0;
1497
1498         return sprintf(buf, "0x%08x\n", reg);
1499 }
1500 static ssize_t store_indirect_dword(struct device *d,
1501                                     struct device_attribute *attr,
1502                                     const char *buf, size_t count)
1503 {
1504         struct ipw_priv *priv = d->driver_data;
1505
1506         sscanf(buf, "%x", &priv->indirect_dword);
1507         priv->status |= STATUS_INDIRECT_DWORD;
1508         return strnlen(buf, count);
1509 }
1510
1511 static DEVICE_ATTR(indirect_dword, S_IWUSR | S_IRUGO,
1512                    show_indirect_dword, store_indirect_dword);
1513
1514 static ssize_t show_indirect_byte(struct device *d,
1515                                   struct device_attribute *attr, char *buf)
1516 {
1517         u8 reg = 0;
1518         struct ipw_priv *priv = d->driver_data;
1519
1520         if (priv->status & STATUS_INDIRECT_BYTE)
1521                 reg = ipw_read_reg8(priv, priv->indirect_byte);
1522         else
1523                 reg = 0;
1524
1525         return sprintf(buf, "0x%02x\n", reg);
1526 }
1527 static ssize_t store_indirect_byte(struct device *d,
1528                                    struct device_attribute *attr,
1529                                    const char *buf, size_t count)
1530 {
1531         struct ipw_priv *priv = d->driver_data;
1532
1533         sscanf(buf, "%x", &priv->indirect_byte);
1534         priv->status |= STATUS_INDIRECT_BYTE;
1535         return strnlen(buf, count);
1536 }
1537
1538 static DEVICE_ATTR(indirect_byte, S_IWUSR | S_IRUGO,
1539                    show_indirect_byte, store_indirect_byte);
1540
1541 static ssize_t show_direct_dword(struct device *d,
1542                                  struct device_attribute *attr, char *buf)
1543 {
1544         u32 reg = 0;
1545         struct ipw_priv *priv = d->driver_data;
1546
1547         if (priv->status & STATUS_DIRECT_DWORD)
1548                 reg = ipw_read32(priv, priv->direct_dword);
1549         else
1550                 reg = 0;
1551
1552         return sprintf(buf, "0x%08x\n", reg);
1553 }
1554 static ssize_t store_direct_dword(struct device *d,
1555                                   struct device_attribute *attr,
1556                                   const char *buf, size_t count)
1557 {
1558         struct ipw_priv *priv = d->driver_data;
1559
1560         sscanf(buf, "%x", &priv->direct_dword);
1561         priv->status |= STATUS_DIRECT_DWORD;
1562         return strnlen(buf, count);
1563 }
1564
1565 static DEVICE_ATTR(direct_dword, S_IWUSR | S_IRUGO,
1566                    show_direct_dword, store_direct_dword);
1567
1568 static int rf_kill_active(struct ipw_priv *priv)
1569 {
1570         if (0 == (ipw_read32(priv, 0x30) & 0x10000))
1571                 priv->status |= STATUS_RF_KILL_HW;
1572         else
1573                 priv->status &= ~STATUS_RF_KILL_HW;
1574
1575         return (priv->status & STATUS_RF_KILL_HW) ? 1 : 0;
1576 }
1577
1578 static ssize_t show_rf_kill(struct device *d, struct device_attribute *attr,
1579                             char *buf)
1580 {
1581         /* 0 - RF kill not enabled
1582            1 - SW based RF kill active (sysfs)
1583            2 - HW based RF kill active
1584            3 - Both HW and SW baed RF kill active */
1585         struct ipw_priv *priv = d->driver_data;
1586         int val = ((priv->status & STATUS_RF_KILL_SW) ? 0x1 : 0x0) |
1587             (rf_kill_active(priv) ? 0x2 : 0x0);
1588         return sprintf(buf, "%i\n", val);
1589 }
1590
1591 static int ipw_radio_kill_sw(struct ipw_priv *priv, int disable_radio)
1592 {
1593         if ((disable_radio ? 1 : 0) ==
1594             ((priv->status & STATUS_RF_KILL_SW) ? 1 : 0))
1595                 return 0;
1596
1597         IPW_DEBUG_RF_KILL("Manual SW RF Kill set to: RADIO  %s\n",
1598                           disable_radio ? "OFF" : "ON");
1599
1600         if (disable_radio) {
1601                 priv->status |= STATUS_RF_KILL_SW;
1602
1603                 if (priv->workqueue)
1604                         cancel_delayed_work(&priv->request_scan);
1605                 queue_work(priv->workqueue, &priv->down);
1606         } else {
1607                 priv->status &= ~STATUS_RF_KILL_SW;
1608                 if (rf_kill_active(priv)) {
1609                         IPW_DEBUG_RF_KILL("Can not turn radio back on - "
1610                                           "disabled by HW switch\n");
1611                         /* Make sure the RF_KILL check timer is running */
1612                         cancel_delayed_work(&priv->rf_kill);
1613                         queue_delayed_work(priv->workqueue, &priv->rf_kill,
1614                                            2 * HZ);
1615                 } else
1616                         queue_work(priv->workqueue, &priv->up);
1617         }
1618
1619         return 1;
1620 }
1621
1622 static ssize_t store_rf_kill(struct device *d, struct device_attribute *attr,
1623                              const char *buf, size_t count)
1624 {
1625         struct ipw_priv *priv = d->driver_data;
1626
1627         ipw_radio_kill_sw(priv, buf[0] == '1');
1628
1629         return count;
1630 }
1631
1632 static DEVICE_ATTR(rf_kill, S_IWUSR | S_IRUGO, show_rf_kill, store_rf_kill);
1633
1634 static ssize_t show_speed_scan(struct device *d, struct device_attribute *attr,
1635                                char *buf)
1636 {
1637         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1638         int pos = 0, len = 0;
1639         if (priv->config & CFG_SPEED_SCAN) {
1640                 while (priv->speed_scan[pos] != 0)
1641                         len += sprintf(&buf[len], "%d ",
1642                                        priv->speed_scan[pos++]);
1643                 return len + sprintf(&buf[len], "\n");
1644         }
1645
1646         return sprintf(buf, "0\n");
1647 }
1648
1649 static ssize_t store_speed_scan(struct device *d, struct device_attribute *attr,
1650                                 const char *buf, size_t count)
1651 {
1652         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1653         int channel, pos = 0;
1654         const char *p = buf;
1655
1656         /* list of space separated channels to scan, optionally ending with 0 */
1657         while ((channel = simple_strtol(p, NULL, 0))) {
1658                 if (pos == MAX_SPEED_SCAN - 1) {
1659                         priv->speed_scan[pos] = 0;
1660                         break;
1661                 }
1662
1663                 if (ipw_is_valid_channel(priv->ieee, channel))
1664                         priv->speed_scan[pos++] = channel;
1665                 else
1666                         IPW_WARNING("Skipping invalid channel request: %d\n",
1667                                     channel);
1668                 p = strchr(p, ' ');
1669                 if (!p)
1670                         break;
1671                 while (*p == ' ' || *p == '\t')
1672                         p++;
1673         }
1674
1675         if (pos == 0)
1676                 priv->config &= ~CFG_SPEED_SCAN;
1677         else {
1678                 priv->speed_scan_pos = 0;
1679                 priv->config |= CFG_SPEED_SCAN;
1680         }
1681
1682         return count;
1683 }
1684
1685 static DEVICE_ATTR(speed_scan, S_IWUSR | S_IRUGO, show_speed_scan,
1686                    store_speed_scan);
1687
1688 static ssize_t show_net_stats(struct device *d, struct device_attribute *attr,
1689                               char *buf)
1690 {
1691         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1692         return sprintf(buf, "%c\n", (priv->config & CFG_NET_STATS) ? '1' : '0');
1693 }
1694
1695 static ssize_t store_net_stats(struct device *d, struct device_attribute *attr,
1696                                const char *buf, size_t count)
1697 {
1698         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1699         if (buf[0] == '1')
1700                 priv->config |= CFG_NET_STATS;
1701         else
1702                 priv->config &= ~CFG_NET_STATS;
1703
1704         return count;
1705 }
1706
1707 static DEVICE_ATTR(net_stats, S_IWUSR | S_IRUGO,
1708                    show_net_stats, store_net_stats);
1709
1710 static void notify_wx_assoc_event(struct ipw_priv *priv)
1711 {
1712         union iwreq_data wrqu;
1713         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1714         if (priv->status & STATUS_ASSOCIATED)
1715                 memcpy(wrqu.ap_addr.sa_data, priv->bssid, ETH_ALEN);
1716         else
1717                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
1718         wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
1719 }
1720
1721 static void ipw_irq_tasklet(struct ipw_priv *priv)
1722 {
1723         u32 inta, inta_mask, handled = 0;
1724         unsigned long flags;
1725         int rc = 0;
1726
1727         spin_lock_irqsave(&priv->lock, flags);
1728
1729         inta = ipw_read32(priv, IPW_INTA_RW);
1730         inta_mask = ipw_read32(priv, IPW_INTA_MASK_R);
1731         inta &= (IPW_INTA_MASK_ALL & inta_mask);
1732
1733         /* Add any cached INTA values that need to be handled */
1734         inta |= priv->isr_inta;
1735
1736         /* handle all the justifications for the interrupt */
1737         if (inta & IPW_INTA_BIT_RX_TRANSFER) {
1738                 ipw_rx(priv);
1739                 handled |= IPW_INTA_BIT_RX_TRANSFER;
1740         }
1741
1742         if (inta & IPW_INTA_BIT_TX_CMD_QUEUE) {
1743                 IPW_DEBUG_HC("Command completed.\n");
1744                 rc = ipw_queue_tx_reclaim(priv, &priv->txq_cmd, -1);
1745                 priv->status &= ~STATUS_HCMD_ACTIVE;
1746                 wake_up_interruptible(&priv->wait_command_queue);
1747                 handled |= IPW_INTA_BIT_TX_CMD_QUEUE;
1748         }
1749
1750         if (inta & IPW_INTA_BIT_TX_QUEUE_1) {
1751                 IPW_DEBUG_TX("TX_QUEUE_1\n");
1752                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[0], 0);
1753                 handled |= IPW_INTA_BIT_TX_QUEUE_1;
1754         }
1755
1756         if (inta & IPW_INTA_BIT_TX_QUEUE_2) {
1757                 IPW_DEBUG_TX("TX_QUEUE_2\n");
1758                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[1], 1);
1759                 handled |= IPW_INTA_BIT_TX_QUEUE_2;
1760         }
1761
1762         if (inta & IPW_INTA_BIT_TX_QUEUE_3) {
1763                 IPW_DEBUG_TX("TX_QUEUE_3\n");
1764                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[2], 2);
1765                 handled |= IPW_INTA_BIT_TX_QUEUE_3;
1766         }
1767
1768         if (inta & IPW_INTA_BIT_TX_QUEUE_4) {
1769                 IPW_DEBUG_TX("TX_QUEUE_4\n");
1770                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[3], 3);
1771                 handled |= IPW_INTA_BIT_TX_QUEUE_4;
1772         }
1773
1774         if (inta & IPW_INTA_BIT_STATUS_CHANGE) {
1775                 IPW_WARNING("STATUS_CHANGE\n");
1776                 handled |= IPW_INTA_BIT_STATUS_CHANGE;
1777         }
1778
1779         if (inta & IPW_INTA_BIT_BEACON_PERIOD_EXPIRED) {
1780                 IPW_WARNING("TX_PERIOD_EXPIRED\n");
1781                 handled |= IPW_INTA_BIT_BEACON_PERIOD_EXPIRED;
1782         }
1783
1784         if (inta & IPW_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE) {
1785                 IPW_WARNING("HOST_CMD_DONE\n");
1786                 handled |= IPW_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE;
1787         }
1788
1789         if (inta & IPW_INTA_BIT_FW_INITIALIZATION_DONE) {
1790                 IPW_WARNING("FW_INITIALIZATION_DONE\n");
1791                 handled |= IPW_INTA_BIT_FW_INITIALIZATION_DONE;
1792         }
1793
1794         if (inta & IPW_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE) {
1795                 IPW_WARNING("PHY_OFF_DONE\n");
1796                 handled |= IPW_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE;
1797         }
1798
1799         if (inta & IPW_INTA_BIT_RF_KILL_DONE) {
1800                 IPW_DEBUG_RF_KILL("RF_KILL_DONE\n");
1801                 priv->status |= STATUS_RF_KILL_HW;
1802                 wake_up_interruptible(&priv->wait_command_queue);
1803                 priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
1804                 cancel_delayed_work(&priv->request_scan);
1805                 schedule_work(&priv->link_down);
1806                 queue_delayed_work(priv->workqueue, &priv->rf_kill, 2 * HZ);
1807                 handled |= IPW_INTA_BIT_RF_KILL_DONE;
1808         }
1809
1810         if (inta & IPW_INTA_BIT_FATAL_ERROR) {
1811                 IPW_ERROR("Firmware error detected.  Restarting.\n");
1812                 if (priv->error) {
1813                         IPW_ERROR("Sysfs 'error' log already exists.\n");
1814 #ifdef CONFIG_IPW2200_DEBUG
1815                         if (ipw_debug_level & IPW_DL_FW_ERRORS) {
1816                                 struct ipw_fw_error *error =
1817                                     ipw_alloc_error_log(priv);
1818                                 ipw_dump_error_log(priv, error);
1819                                 if (error)
1820                                         ipw_free_error_log(error);
1821                         }
1822 #endif
1823                 } else {
1824                         priv->error = ipw_alloc_error_log(priv);
1825                         if (priv->error)
1826                                 IPW_ERROR("Sysfs 'error' log captured.\n");
1827                         else
1828                                 IPW_ERROR("Error allocating sysfs 'error' "
1829                                           "log.\n");
1830 #ifdef CONFIG_IPW2200_DEBUG
1831                         if (ipw_debug_level & IPW_DL_FW_ERRORS)
1832                                 ipw_dump_error_log(priv, priv->error);
1833 #endif
1834                 }
1835
1836                 /* XXX: If hardware encryption is for WPA/WPA2,
1837                  * we have to notify the supplicant. */
1838                 if (priv->ieee->sec.encrypt) {
1839                         priv->status &= ~STATUS_ASSOCIATED;
1840                         notify_wx_assoc_event(priv);
1841                 }
1842
1843                 /* Keep the restart process from trying to send host
1844                  * commands by clearing the INIT status bit */
1845                 priv->status &= ~STATUS_INIT;
1846
1847                 /* Cancel currently queued command. */
1848                 priv->status &= ~STATUS_HCMD_ACTIVE;
1849                 wake_up_interruptible(&priv->wait_command_queue);
1850
1851                 queue_work(priv->workqueue, &priv->adapter_restart);
1852                 handled |= IPW_INTA_BIT_FATAL_ERROR;
1853         }
1854
1855         if (inta & IPW_INTA_BIT_PARITY_ERROR) {
1856                 IPW_ERROR("Parity error\n");
1857                 handled |= IPW_INTA_BIT_PARITY_ERROR;
1858         }
1859
1860         if (handled != inta) {
1861                 IPW_ERROR("Unhandled INTA bits 0x%08x\n", inta & ~handled);
1862         }
1863
1864         /* enable all interrupts */
1865         ipw_enable_interrupts(priv);
1866
1867         spin_unlock_irqrestore(&priv->lock, flags);
1868 }
1869
1870 #define IPW_CMD(x) case IPW_CMD_ ## x : return #x
1871 static char *get_cmd_string(u8 cmd)
1872 {
1873         switch (cmd) {
1874                 IPW_CMD(HOST_COMPLETE);
1875                 IPW_CMD(POWER_DOWN);
1876                 IPW_CMD(SYSTEM_CONFIG);
1877                 IPW_CMD(MULTICAST_ADDRESS);
1878                 IPW_CMD(SSID);
1879                 IPW_CMD(ADAPTER_ADDRESS);
1880                 IPW_CMD(PORT_TYPE);
1881                 IPW_CMD(RTS_THRESHOLD);
1882                 IPW_CMD(FRAG_THRESHOLD);
1883                 IPW_CMD(POWER_MODE);
1884                 IPW_CMD(WEP_KEY);
1885                 IPW_CMD(TGI_TX_KEY);
1886                 IPW_CMD(SCAN_REQUEST);
1887                 IPW_CMD(SCAN_REQUEST_EXT);
1888                 IPW_CMD(ASSOCIATE);
1889                 IPW_CMD(SUPPORTED_RATES);
1890                 IPW_CMD(SCAN_ABORT);
1891                 IPW_CMD(TX_FLUSH);
1892                 IPW_CMD(QOS_PARAMETERS);
1893                 IPW_CMD(DINO_CONFIG);
1894                 IPW_CMD(RSN_CAPABILITIES);
1895                 IPW_CMD(RX_KEY);
1896                 IPW_CMD(CARD_DISABLE);
1897                 IPW_CMD(SEED_NUMBER);
1898                 IPW_CMD(TX_POWER);
1899                 IPW_CMD(COUNTRY_INFO);
1900                 IPW_CMD(AIRONET_INFO);
1901                 IPW_CMD(AP_TX_POWER);
1902                 IPW_CMD(CCKM_INFO);
1903                 IPW_CMD(CCX_VER_INFO);
1904                 IPW_CMD(SET_CALIBRATION);
1905                 IPW_CMD(SENSITIVITY_CALIB);
1906                 IPW_CMD(RETRY_LIMIT);
1907                 IPW_CMD(IPW_PRE_POWER_DOWN);
1908                 IPW_CMD(VAP_BEACON_TEMPLATE);
1909                 IPW_CMD(VAP_DTIM_PERIOD);
1910                 IPW_CMD(EXT_SUPPORTED_RATES);
1911                 IPW_CMD(VAP_LOCAL_TX_PWR_CONSTRAINT);
1912                 IPW_CMD(VAP_QUIET_INTERVALS);
1913                 IPW_CMD(VAP_CHANNEL_SWITCH);
1914                 IPW_CMD(VAP_MANDATORY_CHANNELS);
1915                 IPW_CMD(VAP_CELL_PWR_LIMIT);
1916                 IPW_CMD(VAP_CF_PARAM_SET);
1917                 IPW_CMD(VAP_SET_BEACONING_STATE);
1918                 IPW_CMD(MEASUREMENT);
1919                 IPW_CMD(POWER_CAPABILITY);
1920                 IPW_CMD(SUPPORTED_CHANNELS);
1921                 IPW_CMD(TPC_REPORT);
1922                 IPW_CMD(WME_INFO);
1923                 IPW_CMD(PRODUCTION_COMMAND);
1924         default:
1925                 return "UNKNOWN";
1926         }
1927 }
1928
1929 #define HOST_COMPLETE_TIMEOUT HZ
1930 static int ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
1931 {
1932         int rc = 0;
1933         unsigned long flags;
1934
1935         spin_lock_irqsave(&priv->lock, flags);
1936         if (priv->status & STATUS_HCMD_ACTIVE) {
1937                 IPW_ERROR("Failed to send %s: Already sending a command.\n",
1938                           get_cmd_string(cmd->cmd));
1939                 spin_unlock_irqrestore(&priv->lock, flags);
1940                 return -EAGAIN;
1941         }
1942
1943         priv->status |= STATUS_HCMD_ACTIVE;
1944
1945         if (priv->cmdlog) {
1946                 priv->cmdlog[priv->cmdlog_pos].jiffies = jiffies;
1947                 priv->cmdlog[priv->cmdlog_pos].cmd.cmd = cmd->cmd;
1948                 priv->cmdlog[priv->cmdlog_pos].cmd.len = cmd->len;
1949                 memcpy(priv->cmdlog[priv->cmdlog_pos].cmd.param, cmd->param,
1950                        cmd->len);
1951                 priv->cmdlog[priv->cmdlog_pos].retcode = -1;
1952         }
1953
1954         IPW_DEBUG_HC("%s command (#%d) %d bytes: 0x%08X\n",
1955                      get_cmd_string(cmd->cmd), cmd->cmd, cmd->len,
1956                      priv->status);
1957
1958 #ifndef DEBUG_CMD_WEP_KEY
1959         if (cmd->cmd == IPW_CMD_WEP_KEY)
1960                 IPW_DEBUG_HC("WEP_KEY command masked out for secure.\n");
1961         else
1962 #endif
1963                 printk_buf(IPW_DL_HOST_COMMAND, (u8 *) cmd->param, cmd->len);
1964
1965
1966         rc = ipw_queue_tx_hcmd(priv, cmd->cmd, &cmd->param, cmd->len, 0);
1967         if (rc) {
1968                 priv->status &= ~STATUS_HCMD_ACTIVE;
1969                 IPW_ERROR("Failed to send %s: Reason %d\n",
1970                           get_cmd_string(cmd->cmd), rc);
1971                 spin_unlock_irqrestore(&priv->lock, flags);
1972                 goto exit;
1973         }
1974         spin_unlock_irqrestore(&priv->lock, flags);
1975
1976         rc = wait_event_interruptible_timeout(priv->wait_command_queue,
1977                                               !(priv->
1978                                                 status & STATUS_HCMD_ACTIVE),
1979                                               HOST_COMPLETE_TIMEOUT);
1980         if (rc == 0) {
1981                 spin_lock_irqsave(&priv->lock, flags);
1982                 if (priv->status & STATUS_HCMD_ACTIVE) {
1983                         IPW_ERROR("Failed to send %s: Command timed out.\n",
1984                                   get_cmd_string(cmd->cmd));
1985                         priv->status &= ~STATUS_HCMD_ACTIVE;
1986                         spin_unlock_irqrestore(&priv->lock, flags);
1987                         rc = -EIO;
1988                         goto exit;
1989                 }
1990                 spin_unlock_irqrestore(&priv->lock, flags);
1991         } else
1992                 rc = 0;
1993
1994         if (priv->status & STATUS_RF_KILL_HW) {
1995                 IPW_ERROR("Failed to send %s: Aborted due to RF kill switch.\n",
1996                           get_cmd_string(cmd->cmd));
1997                 rc = -EIO;
1998                 goto exit;
1999         }
2000
2001       exit:
2002         if (priv->cmdlog) {
2003                 priv->cmdlog[priv->cmdlog_pos++].retcode = rc;
2004                 priv->cmdlog_pos %= priv->cmdlog_len;
2005         }
2006         return rc;
2007 }
2008
2009 static int ipw_send_host_complete(struct ipw_priv *priv)
2010 {
2011         struct host_cmd cmd = {
2012                 .cmd = IPW_CMD_HOST_COMPLETE,
2013                 .len = 0
2014         };
2015
2016         if (!priv) {
2017                 IPW_ERROR("Invalid args\n");
2018                 return -1;
2019         }
2020
2021         return ipw_send_cmd(priv, &cmd);
2022 }
2023
2024 static int ipw_send_system_config(struct ipw_priv *priv,
2025                                   struct ipw_sys_config *config)
2026 {
2027         struct host_cmd cmd = {
2028                 .cmd = IPW_CMD_SYSTEM_CONFIG,
2029                 .len = sizeof(*config)
2030         };
2031
2032         if (!priv || !config) {
2033                 IPW_ERROR("Invalid args\n");
2034                 return -1;
2035         }
2036
2037         memcpy(cmd.param, config, sizeof(*config));
2038         return ipw_send_cmd(priv, &cmd);
2039 }
2040
2041 static int ipw_send_ssid(struct ipw_priv *priv, u8 * ssid, int len)
2042 {
2043         struct host_cmd cmd = {
2044                 .cmd = IPW_CMD_SSID,
2045                 .len = min(len, IW_ESSID_MAX_SIZE)
2046         };
2047
2048         if (!priv || !ssid) {
2049                 IPW_ERROR("Invalid args\n");
2050                 return -1;
2051         }
2052
2053         memcpy(cmd.param, ssid, cmd.len);
2054         return ipw_send_cmd(priv, &cmd);
2055 }
2056
2057 static int ipw_send_adapter_address(struct ipw_priv *priv, u8 * mac)
2058 {
2059         struct host_cmd cmd = {
2060                 .cmd = IPW_CMD_ADAPTER_ADDRESS,
2061                 .len = ETH_ALEN
2062         };
2063
2064         if (!priv || !mac) {
2065                 IPW_ERROR("Invalid args\n");
2066                 return -1;
2067         }
2068
2069         IPW_DEBUG_INFO("%s: Setting MAC to " MAC_FMT "\n",
2070                        priv->net_dev->name, MAC_ARG(mac));
2071
2072         memcpy(cmd.param, mac, ETH_ALEN);
2073         return ipw_send_cmd(priv, &cmd);
2074 }
2075
2076 /*
2077  * NOTE: This must be executed from our workqueue as it results in udelay
2078  * being called which may corrupt the keyboard if executed on default
2079  * workqueue
2080  */
2081 static void ipw_adapter_restart(void *adapter)
2082 {
2083         struct ipw_priv *priv = adapter;
2084
2085         if (priv->status & STATUS_RF_KILL_MASK)
2086                 return;
2087
2088         ipw_down(priv);
2089
2090         if (priv->assoc_network &&
2091             (priv->assoc_network->capability & WLAN_CAPABILITY_IBSS))
2092                 ipw_remove_current_network(priv);
2093
2094         if (ipw_up(priv)) {
2095                 IPW_ERROR("Failed to up device\n");
2096                 return;
2097         }
2098 }
2099
2100 static void ipw_bg_adapter_restart(void *data)
2101 {
2102         struct ipw_priv *priv = data;
2103         down(&priv->sem);
2104         ipw_adapter_restart(data);
2105         up(&priv->sem);
2106 }
2107
2108 #define IPW_SCAN_CHECK_WATCHDOG (5 * HZ)
2109
2110 static void ipw_scan_check(void *data)
2111 {
2112         struct ipw_priv *priv = data;
2113         if (priv->status & (STATUS_SCANNING | STATUS_SCAN_ABORTING)) {
2114                 IPW_DEBUG_SCAN("Scan completion watchdog resetting "
2115                                "adapter after (%dms).\n",
2116                                jiffies_to_msecs(IPW_SCAN_CHECK_WATCHDOG));
2117                 queue_work(priv->workqueue, &priv->adapter_restart);
2118         }
2119 }
2120
2121 static void ipw_bg_scan_check(void *data)
2122 {
2123         struct ipw_priv *priv = data;
2124         down(&priv->sem);
2125         ipw_scan_check(data);
2126         up(&priv->sem);
2127 }
2128
2129 static int ipw_send_scan_request_ext(struct ipw_priv *priv,
2130                                      struct ipw_scan_request_ext *request)
2131 {
2132         struct host_cmd cmd = {
2133                 .cmd = IPW_CMD_SCAN_REQUEST_EXT,
2134                 .len = sizeof(*request)
2135         };
2136
2137         memcpy(cmd.param, request, sizeof(*request));
2138         return ipw_send_cmd(priv, &cmd);
2139 }
2140
2141 static int ipw_send_scan_abort(struct ipw_priv *priv)
2142 {
2143         struct host_cmd cmd = {
2144                 .cmd = IPW_CMD_SCAN_ABORT,
2145                 .len = 0
2146         };
2147
2148         if (!priv) {
2149                 IPW_ERROR("Invalid args\n");
2150                 return -1;
2151         }
2152
2153         return ipw_send_cmd(priv, &cmd);
2154 }
2155
2156 static int ipw_set_sensitivity(struct ipw_priv *priv, u16 sens)
2157 {
2158         struct host_cmd cmd = {
2159                 .cmd = IPW_CMD_SENSITIVITY_CALIB,
2160                 .len = sizeof(struct ipw_sensitivity_calib)
2161         };
2162         struct ipw_sensitivity_calib *calib = (struct ipw_sensitivity_calib *)
2163             &cmd.param;
2164         calib->beacon_rssi_raw = sens;
2165         return ipw_send_cmd(priv, &cmd);
2166 }
2167
2168 static int ipw_send_associate(struct ipw_priv *priv,
2169                               struct ipw_associate *associate)
2170 {
2171         struct host_cmd cmd = {
2172                 .cmd = IPW_CMD_ASSOCIATE,
2173                 .len = sizeof(*associate)
2174         };
2175
2176         struct ipw_associate tmp_associate;
2177         memcpy(&tmp_associate, associate, sizeof(*associate));
2178         tmp_associate.policy_support =
2179             cpu_to_le16(tmp_associate.policy_support);
2180         tmp_associate.assoc_tsf_msw = cpu_to_le32(tmp_associate.assoc_tsf_msw);
2181         tmp_associate.assoc_tsf_lsw = cpu_to_le32(tmp_associate.assoc_tsf_lsw);
2182         tmp_associate.capability = cpu_to_le16(tmp_associate.capability);
2183         tmp_associate.listen_interval =
2184             cpu_to_le16(tmp_associate.listen_interval);
2185         tmp_associate.beacon_interval =
2186             cpu_to_le16(tmp_associate.beacon_interval);
2187         tmp_associate.atim_window = cpu_to_le16(tmp_associate.atim_window);
2188
2189         if (!priv || !associate) {
2190                 IPW_ERROR("Invalid args\n");
2191                 return -1;
2192         }
2193
2194         memcpy(cmd.param, &tmp_associate, sizeof(*associate));
2195         return ipw_send_cmd(priv, &cmd);
2196 }
2197
2198 static int ipw_send_supported_rates(struct ipw_priv *priv,
2199                                     struct ipw_supported_rates *rates)
2200 {
2201         struct host_cmd cmd = {
2202                 .cmd = IPW_CMD_SUPPORTED_RATES,
2203                 .len = sizeof(*rates)
2204         };
2205
2206         if (!priv || !rates) {
2207                 IPW_ERROR("Invalid args\n");
2208                 return -1;
2209         }
2210
2211         memcpy(cmd.param, rates, sizeof(*rates));
2212         return ipw_send_cmd(priv, &cmd);
2213 }
2214
2215 static int ipw_set_random_seed(struct ipw_priv *priv)
2216 {
2217         struct host_cmd cmd = {
2218                 .cmd = IPW_CMD_SEED_NUMBER,
2219                 .len = sizeof(u32)
2220         };
2221
2222         if (!priv) {
2223                 IPW_ERROR("Invalid args\n");
2224                 return -1;
2225         }
2226
2227         get_random_bytes(&cmd.param, sizeof(u32));
2228
2229         return ipw_send_cmd(priv, &cmd);
2230 }
2231
2232 static int ipw_send_card_disable(struct ipw_priv *priv, u32 phy_off)
2233 {
2234         struct host_cmd cmd = {
2235                 .cmd = IPW_CMD_CARD_DISABLE,
2236                 .len = sizeof(u32)
2237         };
2238
2239         if (!priv) {
2240                 IPW_ERROR("Invalid args\n");
2241                 return -1;
2242         }
2243
2244         *((u32 *) & cmd.param) = phy_off;
2245
2246         return ipw_send_cmd(priv, &cmd);
2247 }
2248
2249 static int ipw_send_tx_power(struct ipw_priv *priv, struct ipw_tx_power *power)
2250 {
2251         struct host_cmd cmd = {
2252                 .cmd = IPW_CMD_TX_POWER,
2253                 .len = sizeof(*power)
2254         };
2255
2256         if (!priv || !power) {
2257                 IPW_ERROR("Invalid args\n");
2258                 return -1;
2259         }
2260
2261         memcpy(cmd.param, power, sizeof(*power));
2262         return ipw_send_cmd(priv, &cmd);
2263 }
2264
2265 static int ipw_set_tx_power(struct ipw_priv *priv)
2266 {
2267         const struct ieee80211_geo *geo = ipw_get_geo(priv->ieee);
2268         struct ipw_tx_power tx_power;
2269         s8 max_power;
2270         int i;
2271
2272         memset(&tx_power, 0, sizeof(tx_power));
2273
2274         /* configure device for 'G' band */
2275         tx_power.ieee_mode = IPW_G_MODE;
2276         tx_power.num_channels = geo->bg_channels;
2277         for (i = 0; i < geo->bg_channels; i++) {
2278                 max_power = geo->bg[i].max_power;
2279                 tx_power.channels_tx_power[i].channel_number =
2280                     geo->bg[i].channel;
2281                 tx_power.channels_tx_power[i].tx_power = max_power ?
2282                     min(max_power, priv->tx_power) : priv->tx_power;
2283         }
2284         if (ipw_send_tx_power(priv, &tx_power))
2285                 return -EIO;
2286
2287         /* configure device to also handle 'B' band */
2288         tx_power.ieee_mode = IPW_B_MODE;
2289         if (ipw_send_tx_power(priv, &tx_power))
2290                 return -EIO;
2291
2292         /* configure device to also handle 'A' band */
2293         if (priv->ieee->abg_true) {
2294                 tx_power.ieee_mode = IPW_A_MODE;
2295                 tx_power.num_channels = geo->a_channels;
2296                 for (i = 0; i < tx_power.num_channels; i++) {
2297                         max_power = geo->a[i].max_power;
2298                         tx_power.channels_tx_power[i].channel_number =
2299                             geo->a[i].channel;
2300                         tx_power.channels_tx_power[i].tx_power = max_power ?
2301                             min(max_power, priv->tx_power) : priv->tx_power;
2302                 }
2303                 if (ipw_send_tx_power(priv, &tx_power))
2304                         return -EIO;
2305         }
2306         return 0;
2307 }
2308
2309 static int ipw_send_rts_threshold(struct ipw_priv *priv, u16 rts)
2310 {
2311         struct ipw_rts_threshold rts_threshold = {
2312                 .rts_threshold = rts,
2313         };
2314         struct host_cmd cmd = {
2315                 .cmd = IPW_CMD_RTS_THRESHOLD,
2316                 .len = sizeof(rts_threshold)
2317         };
2318
2319         if (!priv) {
2320                 IPW_ERROR("Invalid args\n");
2321                 return -1;
2322         }
2323
2324         memcpy(cmd.param, &rts_threshold, sizeof(rts_threshold));
2325         return ipw_send_cmd(priv, &cmd);
2326 }
2327
2328 static int ipw_send_frag_threshold(struct ipw_priv *priv, u16 frag)
2329 {
2330         struct ipw_frag_threshold frag_threshold = {
2331                 .frag_threshold = frag,
2332         };
2333         struct host_cmd cmd = {
2334                 .cmd = IPW_CMD_FRAG_THRESHOLD,
2335                 .len = sizeof(frag_threshold)
2336         };
2337
2338         if (!priv) {
2339                 IPW_ERROR("Invalid args\n");
2340                 return -1;
2341         }
2342
2343         memcpy(cmd.param, &frag_threshold, sizeof(frag_threshold));
2344         return ipw_send_cmd(priv, &cmd);
2345 }
2346
2347 static int ipw_send_power_mode(struct ipw_priv *priv, u32 mode)
2348 {
2349         struct host_cmd cmd = {
2350                 .cmd = IPW_CMD_POWER_MODE,
2351                 .len = sizeof(u32)
2352         };
2353         u32 *param = (u32 *) (&cmd.param);
2354
2355         if (!priv) {
2356                 IPW_ERROR("Invalid args\n");
2357                 return -1;
2358         }
2359
2360         /* If on battery, set to 3, if AC set to CAM, else user
2361          * level */
2362         switch (mode) {
2363         case IPW_POWER_BATTERY:
2364                 *param = IPW_POWER_INDEX_3;
2365                 break;
2366         case IPW_POWER_AC:
2367                 *param = IPW_POWER_MODE_CAM;
2368                 break;
2369         default:
2370                 *param = mode;
2371                 break;
2372         }
2373
2374         return ipw_send_cmd(priv, &cmd);
2375 }
2376
2377 static int ipw_send_retry_limit(struct ipw_priv *priv, u8 slimit, u8 llimit)
2378 {
2379         struct ipw_retry_limit retry_limit = {
2380                 .short_retry_limit = slimit,
2381                 .long_retry_limit = llimit
2382         };
2383         struct host_cmd cmd = {
2384                 .cmd = IPW_CMD_RETRY_LIMIT,
2385                 .len = sizeof(retry_limit)
2386         };
2387
2388         if (!priv) {
2389                 IPW_ERROR("Invalid args\n");
2390                 return -1;
2391         }
2392
2393         memcpy(cmd.param, &retry_limit, sizeof(retry_limit));
2394         return ipw_send_cmd(priv, &cmd);
2395 }
2396
2397 /*
2398  * The IPW device contains a Microwire compatible EEPROM that stores
2399  * various data like the MAC address.  Usually the firmware has exclusive
2400  * access to the eeprom, but during device initialization (before the
2401  * device driver has sent the HostComplete command to the firmware) the
2402  * device driver has read access to the EEPROM by way of indirect addressing
2403  * through a couple of memory mapped registers.
2404  *
2405  * The following is a simplified implementation for pulling data out of the
2406  * the eeprom, along with some helper functions to find information in
2407  * the per device private data's copy of the eeprom.
2408  *
2409  * NOTE: To better understand how these functions work (i.e what is a chip
2410  *       select and why do have to keep driving the eeprom clock?), read
2411  *       just about any data sheet for a Microwire compatible EEPROM.
2412  */
2413
2414 /* write a 32 bit value into the indirect accessor register */
2415 static inline void eeprom_write_reg(struct ipw_priv *p, u32 data)
2416 {
2417         ipw_write_reg32(p, FW_MEM_REG_EEPROM_ACCESS, data);
2418
2419         /* the eeprom requires some time to complete the operation */
2420         udelay(p->eeprom_delay);
2421
2422         return;
2423 }
2424
2425 /* perform a chip select operation */
2426 static void eeprom_cs(struct ipw_priv *priv)
2427 {
2428         eeprom_write_reg(priv, 0);
2429         eeprom_write_reg(priv, EEPROM_BIT_CS);
2430         eeprom_write_reg(priv, EEPROM_BIT_CS | EEPROM_BIT_SK);
2431         eeprom_write_reg(priv, EEPROM_BIT_CS);
2432 }
2433
2434 /* perform a chip select operation */
2435 static void eeprom_disable_cs(struct ipw_priv *priv)
2436 {
2437         eeprom_write_reg(priv, EEPROM_BIT_CS);
2438         eeprom_write_reg(priv, 0);
2439         eeprom_write_reg(priv, EEPROM_BIT_SK);
2440 }
2441
2442 /* push a single bit down to the eeprom */
2443 static inline void eeprom_write_bit(struct ipw_priv *p, u8 bit)
2444 {
2445         int d = (bit ? EEPROM_BIT_DI : 0);
2446         eeprom_write_reg(p, EEPROM_BIT_CS | d);
2447         eeprom_write_reg(p, EEPROM_BIT_CS | d | EEPROM_BIT_SK);
2448 }
2449
2450 /* push an opcode followed by an address down to the eeprom */
2451 static void eeprom_op(struct ipw_priv *priv, u8 op, u8 addr)
2452 {
2453         int i;
2454
2455         eeprom_cs(priv);
2456         eeprom_write_bit(priv, 1);
2457         eeprom_write_bit(priv, op & 2);
2458         eeprom_write_bit(priv, op & 1);
2459         for (i = 7; i >= 0; i--) {
2460                 eeprom_write_bit(priv, addr & (1 << i));
2461         }
2462 }
2463
2464 /* pull 16 bits off the eeprom, one bit at a time */
2465 static u16 eeprom_read_u16(struct ipw_priv *priv, u8 addr)
2466 {
2467         int i;
2468         u16 r = 0;
2469
2470         /* Send READ Opcode */
2471         eeprom_op(priv, EEPROM_CMD_READ, addr);
2472
2473         /* Send dummy bit */
2474         eeprom_write_reg(priv, EEPROM_BIT_CS);
2475
2476         /* Read the byte off the eeprom one bit at a time */
2477         for (i = 0; i < 16; i++) {
2478                 u32 data = 0;
2479                 eeprom_write_reg(priv, EEPROM_BIT_CS | EEPROM_BIT_SK);
2480                 eeprom_write_reg(priv, EEPROM_BIT_CS);
2481                 data = ipw_read_reg32(priv, FW_MEM_REG_EEPROM_ACCESS);
2482                 r = (r << 1) | ((data & EEPROM_BIT_DO) ? 1 : 0);
2483         }
2484
2485         /* Send another dummy bit */
2486         eeprom_write_reg(priv, 0);
2487         eeprom_disable_cs(priv);
2488
2489         return r;
2490 }
2491
2492 /* helper function for pulling the mac address out of the private */
2493 /* data's copy of the eeprom data                                 */
2494 static void eeprom_parse_mac(struct ipw_priv *priv, u8 * mac)
2495 {
2496         memcpy(mac, &priv->eeprom[EEPROM_MAC_ADDRESS], 6);
2497 }
2498
2499 /*
2500  * Either the device driver (i.e. the host) or the firmware can
2501  * load eeprom data into the designated region in SRAM.  If neither
2502  * happens then the FW will shutdown with a fatal error.
2503  *
2504  * In order to signal the FW to load the EEPROM, the EEPROM_LOAD_DISABLE
2505  * bit needs region of shared SRAM needs to be non-zero.
2506  */
2507 static void ipw_eeprom_init_sram(struct ipw_priv *priv)
2508 {
2509         int i;
2510         u16 *eeprom = (u16 *) priv->eeprom;
2511
2512         IPW_DEBUG_TRACE(">>\n");
2513
2514         /* read entire contents of eeprom into private buffer */
2515         for (i = 0; i < 128; i++)
2516                 eeprom[i] = le16_to_cpu(eeprom_read_u16(priv, (u8) i));
2517
2518         /*
2519            If the data looks correct, then copy it to our private
2520            copy.  Otherwise let the firmware know to perform the operation
2521            on its own.
2522          */
2523         if ((priv->eeprom + EEPROM_VERSION) != 0) {
2524                 IPW_DEBUG_INFO("Writing EEPROM data into SRAM\n");
2525
2526                 /* write the eeprom data to sram */
2527                 for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
2528                         ipw_write8(priv, IPW_EEPROM_DATA + i, priv->eeprom[i]);
2529
2530                 /* Do not load eeprom data on fatal error or suspend */
2531                 ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
2532         } else {
2533                 IPW_DEBUG_INFO("Enabling FW initializationg of SRAM\n");
2534
2535                 /* Load eeprom data on fatal error or suspend */
2536                 ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 1);
2537         }
2538
2539         IPW_DEBUG_TRACE("<<\n");
2540 }
2541
2542 static void ipw_zero_memory(struct ipw_priv *priv, u32 start, u32 count)
2543 {
2544         count >>= 2;
2545         if (!count)
2546                 return;
2547         _ipw_write32(priv, IPW_AUTOINC_ADDR, start);
2548         while (count--)
2549                 _ipw_write32(priv, IPW_AUTOINC_DATA, 0);
2550 }
2551
2552 static inline void ipw_fw_dma_reset_command_blocks(struct ipw_priv *priv)
2553 {
2554         ipw_zero_memory(priv, IPW_SHARED_SRAM_DMA_CONTROL,
2555                         CB_NUMBER_OF_ELEMENTS_SMALL *
2556                         sizeof(struct command_block));
2557 }
2558
2559 static int ipw_fw_dma_enable(struct ipw_priv *priv)
2560 {                               /* start dma engine but no transfers yet */
2561
2562         IPW_DEBUG_FW(">> : \n");
2563
2564         /* Start the dma */
2565         ipw_fw_dma_reset_command_blocks(priv);
2566
2567         /* Write CB base address */
2568         ipw_write_reg32(priv, IPW_DMA_I_CB_BASE, IPW_SHARED_SRAM_DMA_CONTROL);
2569
2570         IPW_DEBUG_FW("<< : \n");
2571         return 0;
2572 }
2573
2574 static void ipw_fw_dma_abort(struct ipw_priv *priv)
2575 {
2576         u32 control = 0;
2577
2578         IPW_DEBUG_FW(">> :\n");
2579
2580         //set the Stop and Abort bit
2581         control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_STOP_AND_ABORT;
2582         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
2583         priv->sram_desc.last_cb_index = 0;
2584
2585         IPW_DEBUG_FW("<< \n");
2586 }
2587
2588 static int ipw_fw_dma_write_command_block(struct ipw_priv *priv, int index,
2589                                           struct command_block *cb)
2590 {
2591         u32 address =
2592             IPW_SHARED_SRAM_DMA_CONTROL +
2593             (sizeof(struct command_block) * index);
2594         IPW_DEBUG_FW(">> :\n");
2595
2596         ipw_write_indirect(priv, address, (u8 *) cb,
2597                            (int)sizeof(struct command_block));
2598
2599         IPW_DEBUG_FW("<< :\n");
2600         return 0;
2601
2602 }
2603
2604 static int ipw_fw_dma_kick(struct ipw_priv *priv)
2605 {
2606         u32 control = 0;
2607         u32 index = 0;
2608
2609         IPW_DEBUG_FW(">> :\n");
2610
2611         for (index = 0; index < priv->sram_desc.last_cb_index; index++)
2612                 ipw_fw_dma_write_command_block(priv, index,
2613                                                &priv->sram_desc.cb_list[index]);
2614
2615         /* Enable the DMA in the CSR register */
2616         ipw_clear_bit(priv, IPW_RESET_REG,
2617                       IPW_RESET_REG_MASTER_DISABLED |
2618                       IPW_RESET_REG_STOP_MASTER);
2619
2620         /* Set the Start bit. */
2621         control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_START;
2622         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
2623
2624         IPW_DEBUG_FW("<< :\n");
2625         return 0;
2626 }
2627
2628 static void ipw_fw_dma_dump_command_block(struct ipw_priv *priv)
2629 {
2630         u32 address;
2631         u32 register_value = 0;
2632         u32 cb_fields_address = 0;
2633
2634         IPW_DEBUG_FW(">> :\n");
2635         address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
2636         IPW_DEBUG_FW_INFO("Current CB is 0x%x \n", address);
2637
2638         /* Read the DMA Controlor register */
2639         register_value = ipw_read_reg32(priv, IPW_DMA_I_DMA_CONTROL);
2640         IPW_DEBUG_FW_INFO("IPW_DMA_I_DMA_CONTROL is 0x%x \n", register_value);
2641
2642         /* Print the CB values */
2643         cb_fields_address = address;
2644         register_value = ipw_read_reg32(priv, cb_fields_address);
2645         IPW_DEBUG_FW_INFO("Current CB ControlField is 0x%x \n", register_value);
2646
2647         cb_fields_address += sizeof(u32);
2648         register_value = ipw_read_reg32(priv, cb_fields_address);
2649         IPW_DEBUG_FW_INFO("Current CB Source Field is 0x%x \n", register_value);
2650
2651         cb_fields_address += sizeof(u32);
2652         register_value = ipw_read_reg32(priv, cb_fields_address);
2653         IPW_DEBUG_FW_INFO("Current CB Destination Field is 0x%x \n",
2654                           register_value);
2655
2656         cb_fields_address += sizeof(u32);
2657         register_value = ipw_read_reg32(priv, cb_fields_address);
2658         IPW_DEBUG_FW_INFO("Current CB Status Field is 0x%x \n", register_value);
2659
2660         IPW_DEBUG_FW(">> :\n");
2661 }
2662
2663 static int ipw_fw_dma_command_block_index(struct ipw_priv *priv)
2664 {
2665         u32 current_cb_address = 0;
2666         u32 current_cb_index = 0;
2667
2668         IPW_DEBUG_FW("<< :\n");
2669         current_cb_address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
2670
2671         current_cb_index = (current_cb_address - IPW_SHARED_SRAM_DMA_CONTROL) /
2672             sizeof(struct command_block);
2673
2674         IPW_DEBUG_FW_INFO("Current CB index 0x%x address = 0x%X \n",
2675                           current_cb_index, current_cb_address);
2676
2677         IPW_DEBUG_FW(">> :\n");
2678         return current_cb_index;
2679
2680 }
2681
2682 static int ipw_fw_dma_add_command_block(struct ipw_priv *priv,
2683                                         u32 src_address,
2684                                         u32 dest_address,
2685                                         u32 length,
2686                                         int interrupt_enabled, int is_last)
2687 {
2688
2689         u32 control = CB_VALID | CB_SRC_LE | CB_DEST_LE | CB_SRC_AUTOINC |
2690             CB_SRC_IO_GATED | CB_DEST_AUTOINC | CB_SRC_SIZE_LONG |
2691             CB_DEST_SIZE_LONG;
2692         struct command_block *cb;
2693         u32 last_cb_element = 0;
2694
2695         IPW_DEBUG_FW_INFO("src_address=0x%x dest_address=0x%x length=0x%x\n",
2696                           src_address, dest_address, length);
2697
2698         if (priv->sram_desc.last_cb_index >= CB_NUMBER_OF_ELEMENTS_SMALL)
2699                 return -1;
2700
2701         last_cb_element = priv->sram_desc.last_cb_index;
2702         cb = &priv->sram_desc.cb_list[last_cb_element];
2703         priv->sram_desc.last_cb_index++;
2704
2705         /* Calculate the new CB control word */
2706         if (interrupt_enabled)
2707                 control |= CB_INT_ENABLED;
2708
2709         if (is_last)
2710                 control |= CB_LAST_VALID;
2711
2712         control |= length;
2713
2714         /* Calculate the CB Element's checksum value */
2715         cb->status = control ^ src_address ^ dest_address;
2716
2717         /* Copy the Source and Destination addresses */
2718         cb->dest_addr = dest_address;
2719         cb->source_addr = src_address;
2720
2721         /* Copy the Control Word last */
2722         cb->control = control;
2723
2724         return 0;
2725 }
2726
2727 static int ipw_fw_dma_add_buffer(struct ipw_priv *priv,
2728                                  u32 src_phys, u32 dest_address, u32 length)
2729 {
2730         u32 bytes_left = length;
2731         u32 src_offset = 0;
2732         u32 dest_offset = 0;
2733         int status = 0;
2734         IPW_DEBUG_FW(">> \n");
2735         IPW_DEBUG_FW_INFO("src_phys=0x%x dest_address=0x%x length=0x%x\n",
2736                           src_phys, dest_address, length);
2737         while (bytes_left > CB_MAX_LENGTH) {
2738                 status = ipw_fw_dma_add_command_block(priv,
2739                                                       src_phys + src_offset,
2740                                                       dest_address +
2741                                                       dest_offset,
2742                                                       CB_MAX_LENGTH, 0, 0);
2743                 if (status) {
2744                         IPW_DEBUG_FW_INFO(": Failed\n");
2745                         return -1;
2746                 } else
2747                         IPW_DEBUG_FW_INFO(": Added new cb\n");
2748
2749                 src_offset += CB_MAX_LENGTH;
2750                 dest_offset += CB_MAX_LENGTH;
2751                 bytes_left -= CB_MAX_LENGTH;
2752         }
2753
2754         /* add the buffer tail */
2755         if (bytes_left > 0) {
2756                 status =
2757                     ipw_fw_dma_add_command_block(priv, src_phys + src_offset,
2758                                                  dest_address + dest_offset,
2759                                                  bytes_left, 0, 0);
2760                 if (status) {
2761                         IPW_DEBUG_FW_INFO(": Failed on the buffer tail\n");
2762                         return -1;
2763                 } else
2764                         IPW_DEBUG_FW_INFO
2765                             (": Adding new cb - the buffer tail\n");
2766         }
2767
2768         IPW_DEBUG_FW("<< \n");
2769         return 0;
2770 }
2771
2772 static int ipw_fw_dma_wait(struct ipw_priv *priv)
2773 {
2774         u32 current_index = 0;
2775         u32 watchdog = 0;
2776
2777         IPW_DEBUG_FW(">> : \n");
2778
2779         current_index = ipw_fw_dma_command_block_index(priv);
2780         IPW_DEBUG_FW_INFO("sram_desc.last_cb_index:0x%8X\n",
2781                           (int)priv->sram_desc.last_cb_index);
2782
2783         while (current_index < priv->sram_desc.last_cb_index) {
2784                 udelay(50);
2785                 current_index = ipw_fw_dma_command_block_index(priv);
2786
2787                 watchdog++;
2788
2789                 if (watchdog > 400) {
2790                         IPW_DEBUG_FW_INFO("Timeout\n");
2791                         ipw_fw_dma_dump_command_block(priv);
2792                         ipw_fw_dma_abort(priv);
2793                         return -1;
2794                 }
2795         }
2796
2797         ipw_fw_dma_abort(priv);
2798
2799         /*Disable the DMA in the CSR register */
2800         ipw_set_bit(priv, IPW_RESET_REG,
2801                     IPW_RESET_REG_MASTER_DISABLED | IPW_RESET_REG_STOP_MASTER);
2802
2803         IPW_DEBUG_FW("<< dmaWaitSync \n");
2804         return 0;
2805 }
2806
2807 static void ipw_remove_current_network(struct ipw_priv *priv)
2808 {
2809         struct list_head *element, *safe;
2810         struct ieee80211_network *network = NULL;
2811         unsigned long flags;
2812
2813         spin_lock_irqsave(&priv->ieee->lock, flags);
2814         list_for_each_safe(element, safe, &priv->ieee->network_list) {
2815                 network = list_entry(element, struct ieee80211_network, list);
2816                 if (!memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
2817                         list_del(element);
2818                         list_add_tail(&network->list,
2819                                       &priv->ieee->network_free_list);
2820                 }
2821         }
2822         spin_unlock_irqrestore(&priv->ieee->lock, flags);
2823 }
2824
2825 /**
2826  * Check that card is still alive.
2827  * Reads debug register from domain0.
2828  * If card is present, pre-defined value should
2829  * be found there.
2830  *
2831  * @param priv
2832  * @return 1 if card is present, 0 otherwise
2833  */
2834 static inline int ipw_alive(struct ipw_priv *priv)
2835 {
2836         return ipw_read32(priv, 0x90) == 0xd55555d5;
2837 }
2838
2839 /* timeout in msec, attempted in 10-msec quanta */
2840 static int ipw_poll_bit(struct ipw_priv *priv, u32 addr, u32 mask,
2841                                int timeout)
2842 {
2843         int i = 0;
2844
2845         do {
2846                 if ((ipw_read32(priv, addr) & mask) == mask)
2847                         return i;
2848                 mdelay(10);
2849                 i += 10;
2850         } while (i < timeout);
2851
2852         return -ETIME;
2853 }
2854
2855 /* These functions load the firmware and micro code for the operation of
2856  * the ipw hardware.  It assumes the buffer has all the bits for the
2857  * image and the caller is handling the memory allocation and clean up.
2858  */
2859
2860 static int ipw_stop_master(struct ipw_priv *priv)
2861 {
2862         int rc;
2863
2864         IPW_DEBUG_TRACE(">> \n");
2865         /* stop master. typical delay - 0 */
2866         ipw_set_bit(priv, IPW_RESET_REG, IPW_RESET_REG_STOP_MASTER);
2867
2868         /* timeout is in msec, polled in 10-msec quanta */
2869         rc = ipw_poll_bit(priv, IPW_RESET_REG,
2870                           IPW_RESET_REG_MASTER_DISABLED, 100);
2871         if (rc < 0) {
2872                 IPW_ERROR("wait for stop master failed after 100ms\n");
2873                 return -1;
2874         }
2875
2876         IPW_DEBUG_INFO("stop master %dms\n", rc);
2877
2878         return rc;
2879 }
2880
2881 static void ipw_arc_release(struct ipw_priv *priv)
2882 {
2883         IPW_DEBUG_TRACE(">> \n");
2884         mdelay(5);
2885
2886         ipw_clear_bit(priv, IPW_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
2887
2888         /* no one knows timing, for safety add some delay */
2889         mdelay(5);
2890 }
2891
2892 struct fw_header {
2893         u32 version;
2894         u32 mode;
2895 };
2896
2897 struct fw_chunk {
2898         u32 address;
2899         u32 length;
2900 };
2901
2902 #define IPW_FW_MAJOR_VERSION 2
2903 #define IPW_FW_MINOR_VERSION 4
2904
2905 #define IPW_FW_MINOR(x) ((x & 0xff) >> 8)
2906 #define IPW_FW_MAJOR(x) (x & 0xff)
2907
2908 #define IPW_FW_VERSION ((IPW_FW_MINOR_VERSION << 8) | IPW_FW_MAJOR_VERSION)
2909
2910 #define IPW_FW_PREFIX "ipw-" __stringify(IPW_FW_MAJOR_VERSION) \
2911 "." __stringify(IPW_FW_MINOR_VERSION) "-"
2912
2913 #if IPW_FW_MAJOR_VERSION >= 2 && IPW_FW_MINOR_VERSION > 0
2914 #define IPW_FW_NAME(x) IPW_FW_PREFIX "" x ".fw"
2915 #else
2916 #define IPW_FW_NAME(x) "ipw2200_" x ".fw"
2917 #endif
2918
2919 static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
2920 {
2921         int rc = 0, i, addr;
2922         u8 cr = 0;
2923         u16 *image;
2924
2925         image = (u16 *) data;
2926
2927         IPW_DEBUG_TRACE(">> \n");
2928
2929         rc = ipw_stop_master(priv);
2930
2931         if (rc < 0)
2932                 return rc;
2933
2934 //      spin_lock_irqsave(&priv->lock, flags);
2935
2936         for (addr = IPW_SHARED_LOWER_BOUND;
2937              addr < IPW_REGISTER_DOMAIN1_END; addr += 4) {
2938                 ipw_write32(priv, addr, 0);
2939         }
2940
2941         /* no ucode (yet) */
2942         memset(&priv->dino_alive, 0, sizeof(priv->dino_alive));
2943         /* destroy DMA queues */
2944         /* reset sequence */
2945
2946         ipw_write_reg32(priv, IPW_MEM_HALT_AND_RESET, IPW_BIT_HALT_RESET_ON);
2947         ipw_arc_release(priv);
2948         ipw_write_reg32(priv, IPW_MEM_HALT_AND_RESET, IPW_BIT_HALT_RESET_OFF);
2949         mdelay(1);
2950
2951         /* reset PHY */
2952         ipw_write_reg32(priv, IPW_INTERNAL_CMD_EVENT, IPW_BASEBAND_POWER_DOWN);
2953         mdelay(1);
2954
2955         ipw_write_reg32(priv, IPW_INTERNAL_CMD_EVENT, 0);
2956         mdelay(1);
2957
2958         /* enable ucode store */
2959         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0x0);
2960         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, DINO_ENABLE_CS);
2961         mdelay(1);
2962
2963         /* write ucode */
2964         /**
2965          * @bug
2966          * Do NOT set indirect address register once and then
2967          * store data to indirect data register in the loop.
2968          * It seems very reasonable, but in this case DINO do not
2969          * accept ucode. It is essential to set address each time.
2970          */
2971         /* load new ipw uCode */
2972         for (i = 0; i < len / 2; i++)
2973                 ipw_write_reg16(priv, IPW_BASEBAND_CONTROL_STORE,
2974                                 cpu_to_le16(image[i]));
2975
2976         /* enable DINO */
2977         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0);
2978         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, DINO_ENABLE_SYSTEM);
2979
2980         /* this is where the igx / win driver deveates from the VAP driver. */
2981
2982         /* wait for alive response */
2983         for (i = 0; i < 100; i++) {
2984                 /* poll for incoming data */
2985                 cr = ipw_read_reg8(priv, IPW_BASEBAND_CONTROL_STATUS);
2986                 if (cr & DINO_RXFIFO_DATA)
2987                         break;
2988                 mdelay(1);
2989         }
2990
2991         if (cr & DINO_RXFIFO_DATA) {
2992                 /* alive_command_responce size is NOT multiple of 4 */
2993                 u32 response_buffer[(sizeof(priv->dino_alive) + 3) / 4];
2994
2995                 for (i = 0; i < ARRAY_SIZE(response_buffer); i++)
2996                         response_buffer[i] =
2997                             le32_to_cpu(ipw_read_reg32(priv,
2998                                                        IPW_BASEBAND_RX_FIFO_READ));
2999                 memcpy(&priv->dino_alive, response_buffer,
3000                        sizeof(priv->dino_alive));
3001                 if (priv->dino_alive.alive_command == 1
3002                     && priv->dino_alive.ucode_valid == 1) {
3003                         rc = 0;
3004                         IPW_DEBUG_INFO
3005                             ("Microcode OK, rev. %d (0x%x) dev. %d (0x%x) "
3006                              "of %02d/%02d/%02d %02d:%02d\n",
3007                              priv->dino_alive.software_revision,
3008                              priv->dino_alive.software_revision,
3009                              priv->dino_alive.device_identifier,
3010                              priv->dino_alive.device_identifier,
3011                              priv->dino_alive.time_stamp[0],
3012                              priv->dino_alive.time_stamp[1],
3013                              priv->dino_alive.time_stamp[2],
3014                              priv->dino_alive.time_stamp[3],
3015                              priv->dino_alive.time_stamp[4]);
3016                 } else {
3017                         IPW_DEBUG_INFO("Microcode is not alive\n");
3018                         rc = -EINVAL;
3019                 }
3020         } else {
3021                 IPW_DEBUG_INFO("No alive response from DINO\n");
3022                 rc = -ETIME;
3023         }
3024
3025         /* disable DINO, otherwise for some reason
3026            firmware have problem getting alive resp. */
3027         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0);
3028
3029 //      spin_unlock_irqrestore(&priv->lock, flags);
3030
3031         return rc;
3032 }
3033
3034 static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
3035 {
3036         int rc = -1;
3037         int offset = 0;
3038         struct fw_chunk *chunk;
3039         dma_addr_t shared_phys;
3040         u8 *shared_virt;
3041
3042         IPW_DEBUG_TRACE("<< : \n");
3043         shared_virt = pci_alloc_consistent(priv->pci_dev, len, &shared_phys);
3044
3045         if (!shared_virt)
3046                 return -ENOMEM;
3047
3048         memmove(shared_virt, data, len);
3049
3050         /* Start the Dma */
3051         rc = ipw_fw_dma_enable(priv);
3052
3053         if (priv->sram_desc.last_cb_index > 0) {
3054                 /* the DMA is already ready this would be a bug. */
3055                 BUG();
3056                 goto out;
3057         }
3058
3059         do {
3060                 chunk = (struct fw_chunk *)(data + offset);
3061                 offset += sizeof(struct fw_chunk);
3062                 /* build DMA packet and queue up for sending */
3063                 /* dma to chunk->address, the chunk->length bytes from data +
3064                  * offeset*/
3065                 /* Dma loading */
3066                 rc = ipw_fw_dma_add_buffer(priv, shared_phys + offset,
3067                                            le32_to_cpu(chunk->address),
3068                                            le32_to_cpu(chunk->length));
3069                 if (rc) {
3070                         IPW_DEBUG_INFO("dmaAddBuffer Failed\n");
3071                         goto out;
3072                 }
3073
3074                 offset += le32_to_cpu(chunk->length);
3075         } while (offset < len);
3076
3077         /* Run the DMA and wait for the answer */
3078         rc = ipw_fw_dma_kick(priv);
3079         if (rc) {
3080                 IPW_ERROR("dmaKick Failed\n");
3081                 goto out;
3082         }
3083
3084         rc = ipw_fw_dma_wait(priv);
3085         if (rc) {
3086                 IPW_ERROR("dmaWaitSync Failed\n");
3087                 goto out;
3088         }
3089       out:
3090         pci_free_consistent(priv->pci_dev, len, shared_virt, shared_phys);
3091         return rc;
3092 }
3093
3094 /* stop nic */
3095 static int ipw_stop_nic(struct ipw_priv *priv)
3096 {
3097         int rc = 0;
3098
3099         /* stop */
3100         ipw_write32(priv, IPW_RESET_REG, IPW_RESET_REG_STOP_MASTER);
3101
3102         rc = ipw_poll_bit(priv, IPW_RESET_REG,
3103                           IPW_RESET_REG_MASTER_DISABLED, 500);
3104         if (rc < 0) {
3105                 IPW_ERROR("wait for reg master disabled failed after 500ms\n");
3106                 return rc;
3107         }
3108
3109         ipw_set_bit(priv, IPW_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
3110
3111         return rc;
3112 }
3113
3114 static void ipw_start_nic(struct ipw_priv *priv)
3115 {
3116         IPW_DEBUG_TRACE(">>\n");
3117
3118         /* prvHwStartNic  release ARC */
3119         ipw_clear_bit(priv, IPW_RESET_REG,
3120                       IPW_RESET_REG_MASTER_DISABLED |
3121                       IPW_RESET_REG_STOP_MASTER |
3122                       CBD_RESET_REG_PRINCETON_RESET);
3123
3124         /* enable power management */
3125         ipw_set_bit(priv, IPW_GP_CNTRL_RW,
3126                     IPW_GP_CNTRL_BIT_HOST_ALLOWS_STANDBY);
3127
3128         IPW_DEBUG_TRACE("<<\n");
3129 }
3130
3131 static int ipw_init_nic(struct ipw_priv *priv)
3132 {
3133         int rc;
3134
3135         IPW_DEBUG_TRACE(">>\n");
3136         /* reset */
3137         /*prvHwInitNic */
3138         /* set "initialization complete" bit to move adapter to D0 state */
3139         ipw_set_bit(priv, IPW_GP_CNTRL_RW, IPW_GP_CNTRL_BIT_INIT_DONE);
3140
3141         /* low-level PLL activation */
3142         ipw_write32(priv, IPW_READ_INT_REGISTER,
3143                     IPW_BIT_INT_HOST_SRAM_READ_INT_REGISTER);
3144
3145         /* wait for clock stabilization */
3146         rc = ipw_poll_bit(priv, IPW_GP_CNTRL_RW,
3147                           IPW_GP_CNTRL_BIT_CLOCK_READY, 250);
3148         if (rc < 0)
3149                 IPW_DEBUG_INFO("FAILED wait for clock stablization\n");
3150
3151         /* assert SW reset */
3152         ipw_set_bit(priv, IPW_RESET_REG, IPW_RESET_REG_SW_RESET);
3153
3154         udelay(10);
3155
3156         /* set "initialization complete" bit to move adapter to D0 state */
3157         ipw_set_bit(priv, IPW_GP_CNTRL_RW, IPW_GP_CNTRL_BIT_INIT_DONE);
3158
3159         IPW_DEBUG_TRACE(">>\n");
3160         return 0;
3161 }
3162
3163 /* Call this function from process context, it will sleep in request_firmware.
3164  * Probe is an ok place to call this from.
3165  */
3166 static int ipw_reset_nic(struct ipw_priv *priv)
3167 {
3168         int rc = 0;
3169         unsigned long flags;
3170
3171         IPW_DEBUG_TRACE(">>\n");
3172
3173         rc = ipw_init_nic(priv);
3174
3175         spin_lock_irqsave(&priv->lock, flags);
3176         /* Clear the 'host command active' bit... */
3177         priv->status &= ~STATUS_HCMD_ACTIVE;
3178         wake_up_interruptible(&priv->wait_command_queue);
3179         priv->status &= ~(STATUS_SCANNING | STATUS_SCAN_ABORTING);
3180         wake_up_interruptible(&priv->wait_state);
3181         spin_unlock_irqrestore(&priv->lock, flags);
3182
3183         IPW_DEBUG_TRACE("<<\n");
3184         return rc;
3185 }
3186
3187 static int ipw_get_fw(struct ipw_priv *priv,
3188                       const struct firmware **fw, const char *name)
3189 {
3190         struct fw_header *header;
3191         int rc;
3192
3193         /* ask firmware_class module to get the boot firmware off disk */
3194         rc = request_firmware(fw, name, &priv->pci_dev->dev);
3195         if (rc < 0) {
3196                 IPW_ERROR("%s load failed: Reason %d\n", name, rc);
3197                 return rc;
3198         }
3199
3200         header = (struct fw_header *)(*fw)->data;
3201         if (IPW_FW_MAJOR(le32_to_cpu(header->version)) != IPW_FW_MAJOR_VERSION) {
3202                 IPW_ERROR("'%s' firmware version not compatible (%d != %d)\n",
3203                           name,
3204                           IPW_FW_MAJOR(le32_to_cpu(header->version)),
3205                           IPW_FW_MAJOR_VERSION);
3206                 return -EINVAL;
3207         }
3208
3209         IPW_DEBUG_INFO("Loading firmware '%s' file v%d.%d (%zd bytes)\n",
3210                        name,
3211                        IPW_FW_MAJOR(le32_to_cpu(header->version)),
3212                        IPW_FW_MINOR(le32_to_cpu(header->version)),
3213                        (*fw)->size - sizeof(struct fw_header));
3214         return 0;
3215 }
3216
3217 #define IPW_RX_BUF_SIZE (3000)
3218
3219 static void ipw_rx_queue_reset(struct ipw_priv *priv,
3220                                       struct ipw_rx_queue *rxq)
3221 {
3222         unsigned long flags;
3223         int i;
3224
3225         spin_lock_irqsave(&rxq->lock, flags);
3226
3227         INIT_LIST_HEAD(&rxq->rx_free);
3228         INIT_LIST_HEAD(&rxq->rx_used);
3229
3230         /* Fill the rx_used queue with _all_ of the Rx buffers */
3231         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
3232                 /* In the reset function, these buffers may have been allocated
3233                  * to an SKB, so we need to unmap and free potential storage */
3234                 if (rxq->pool[i].skb != NULL) {
3235                         pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
3236                                          IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
3237                         dev_kfree_skb(rxq->pool[i].skb);
3238                         rxq->pool[i].skb = NULL;
3239                 }
3240                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
3241         }
3242
3243         /* Set us so that we have processed and used all buffers, but have
3244          * not restocked the Rx queue with fresh buffers */
3245         rxq->read = rxq->write = 0;
3246         rxq->processed = RX_QUEUE_SIZE - 1;
3247         rxq->free_count = 0;
3248         spin_unlock_irqrestore(&rxq->lock, flags);
3249 }
3250
3251 #ifdef CONFIG_PM
3252 static int fw_loaded = 0;
3253 static const struct firmware *bootfw = NULL;
3254 static const struct firmware *firmware = NULL;
3255 static const struct firmware *ucode = NULL;
3256
3257 static void free_firmware(void)
3258 {
3259         if (fw_loaded) {
3260                 release_firmware(bootfw);
3261                 release_firmware(ucode);
3262                 release_firmware(firmware);
3263                 bootfw = ucode = firmware = NULL;
3264                 fw_loaded = 0;
3265         }
3266 }
3267 #else
3268 #define free_firmware() do {} while (0)
3269 #endif
3270
3271 static int ipw_load(struct ipw_priv *priv)
3272 {
3273 #ifndef CONFIG_PM
3274         const struct firmware *bootfw = NULL;
3275         const struct firmware *firmware = NULL;
3276         const struct firmware *ucode = NULL;
3277 #endif
3278         int rc = 0, retries = 3;
3279
3280 #ifdef CONFIG_PM
3281         if (!fw_loaded) {
3282 #endif
3283                 rc = ipw_get_fw(priv, &bootfw, IPW_FW_NAME("boot"));
3284                 if (rc)
3285                         goto error;
3286
3287                 switch (priv->ieee->iw_mode) {
3288                 case IW_MODE_ADHOC:
3289                         rc = ipw_get_fw(priv, &ucode,
3290                                         IPW_FW_NAME("ibss_ucode"));
3291                         if (rc)
3292                                 goto error;
3293
3294                         rc = ipw_get_fw(priv, &firmware, IPW_FW_NAME("ibss"));
3295                         break;
3296
3297 #ifdef CONFIG_IPW2200_MONITOR
3298                 case IW_MODE_MONITOR:
3299                         rc = ipw_get_fw(priv, &ucode,
3300                                         IPW_FW_NAME("sniffer_ucode"));
3301                         if (rc)
3302                                 goto error;
3303
3304                         rc = ipw_get_fw(priv, &firmware,
3305                                         IPW_FW_NAME("sniffer"));
3306                         break;
3307 #endif
3308                 case IW_MODE_INFRA:
3309                         rc = ipw_get_fw(priv, &ucode, IPW_FW_NAME("bss_ucode"));
3310                         if (rc)
3311                                 goto error;
3312
3313                         rc = ipw_get_fw(priv, &firmware, IPW_FW_NAME("bss"));
3314                         break;
3315
3316                 default:
3317                         rc = -EINVAL;
3318                 }
3319
3320                 if (rc)
3321                         goto error;
3322
3323 #ifdef CONFIG_PM
3324                 fw_loaded = 1;
3325         }
3326 #endif
3327
3328         if (!priv->rxq)
3329                 priv->rxq = ipw_rx_queue_alloc(priv);
3330         else
3331                 ipw_rx_queue_reset(priv, priv->rxq);
3332         if (!priv->rxq) {
3333                 IPW_ERROR("Unable to initialize Rx queue\n");
3334                 goto error;
3335         }
3336
3337       retry:
3338         /* Ensure interrupts are disabled */
3339         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
3340         priv->status &= ~STATUS_INT_ENABLED;
3341
3342         /* ack pending interrupts */
3343         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3344
3345         ipw_stop_nic(priv);
3346
3347         rc = ipw_reset_nic(priv);
3348         if (rc) {
3349                 IPW_ERROR("Unable to reset NIC\n");
3350                 goto error;
3351         }
3352
3353         ipw_zero_memory(priv, IPW_NIC_SRAM_LOWER_BOUND,
3354                         IPW_NIC_SRAM_UPPER_BOUND - IPW_NIC_SRAM_LOWER_BOUND);
3355
3356         /* DMA the initial boot firmware into the device */
3357         rc = ipw_load_firmware(priv, bootfw->data + sizeof(struct fw_header),
3358                                bootfw->size - sizeof(struct fw_header));
3359         if (rc < 0) {
3360                 IPW_ERROR("Unable to load boot firmware: %d\n", rc);
3361                 goto error;
3362         }
3363
3364         /* kick start the device */
3365         ipw_start_nic(priv);
3366
3367         /* wait for the device to finish its initial startup sequence */
3368         rc = ipw_poll_bit(priv, IPW_INTA_RW,
3369                           IPW_INTA_BIT_FW_INITIALIZATION_DONE, 500);
3370         if (rc < 0) {
3371                 IPW_ERROR("device failed to boot initial fw image\n");
3372                 goto error;
3373         }
3374         IPW_DEBUG_INFO("initial device response after %dms\n", rc);
3375
3376         /* ack fw init done interrupt */
3377         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
3378
3379         /* DMA the ucode into the device */
3380         rc = ipw_load_ucode(priv, ucode->data + sizeof(struct fw_header),
3381                             ucode->size - sizeof(struct fw_header));
3382         if (rc < 0) {
3383                 IPW_ERROR("Unable to load ucode: %d\n", rc);
3384                 goto error;
3385         }
3386
3387         /* stop nic */
3388         ipw_stop_nic(priv);
3389
3390         /* DMA bss firmware into the device */
3391         rc = ipw_load_firmware(priv, firmware->data +
3392                                sizeof(struct fw_header),
3393                                firmware->size - sizeof(struct fw_header));
3394         if (rc < 0) {
3395                 IPW_ERROR("Unable to load firmware: %d\n", rc);
3396                 goto error;
3397         }
3398
3399         ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
3400
3401         rc = ipw_queue_reset(priv);
3402         if (rc) {
3403                 IPW_ERROR("Unable to initialize queues\n");
3404                 goto error;
3405         }
3406
3407         /* Ensure interrupts are disabled */
3408         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
3409         /* ack pending interrupts */
3410         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3411
3412         /* kick start the device */
3413         ipw_start_nic(priv);
3414
3415         if (ipw_read32(priv, IPW_INTA_RW) & IPW_INTA_BIT_PARITY_ERROR) {
3416                 if (retries > 0) {
3417                         IPW_WARNING("Parity error.  Retrying init.\n");
3418                         retries--;
3419                         goto retry;
3420                 }
3421
3422                 IPW_ERROR("TODO: Handle parity error -- schedule restart?\n");
3423                 rc = -EIO;
3424                 goto error;
3425         }
3426
3427         /* wait for the device */
3428         rc = ipw_poll_bit(priv, IPW_INTA_RW,
3429                           IPW_INTA_BIT_FW_INITIALIZATION_DONE, 500);
3430         if (rc < 0) {
3431                 IPW_ERROR("device failed to start within 500ms\n");
3432                 goto error;
3433         }
3434         IPW_DEBUG_INFO("device response after %dms\n", rc);
3435
3436         /* ack fw init done interrupt */
3437         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
3438
3439         /* read eeprom data and initialize the eeprom region of sram */
3440         priv->eeprom_delay = 1;
3441         ipw_eeprom_init_sram(priv);
3442
3443         /* enable interrupts */
3444         ipw_enable_interrupts(priv);
3445
3446         /* Ensure our queue has valid packets */
3447         ipw_rx_queue_replenish(priv);
3448
3449         ipw_write32(priv, IPW_RX_READ_INDEX, priv->rxq->read);
3450
3451         /* ack pending interrupts */
3452         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3453
3454 #ifndef CONFIG_PM
3455         release_firmware(bootfw);
3456         release_firmware(ucode);
3457         release_firmware(firmware);
3458 #endif
3459         return 0;
3460
3461       error:
3462         if (priv->rxq) {
3463                 ipw_rx_queue_free(priv, priv->rxq);
3464                 priv->rxq = NULL;
3465         }
3466         ipw_tx_queue_free(priv);
3467         if (bootfw)
3468                 release_firmware(bootfw);
3469         if (ucode)
3470                 release_firmware(ucode);
3471         if (firmware)
3472                 release_firmware(firmware);
3473 #ifdef CONFIG_PM
3474         fw_loaded = 0;
3475         bootfw = ucode = firmware = NULL;
3476 #endif
3477
3478         return rc;
3479 }
3480
3481 /**
3482  * DMA services
3483  *
3484  * Theory of operation
3485  *
3486  * A queue is a circular buffers with 'Read' and 'Write' pointers.
3487  * 2 empty entries always kept in the buffer to protect from overflow.
3488  *
3489  * For Tx queue, there are low mark and high mark limits. If, after queuing
3490  * the packet for Tx, free space become < low mark, Tx queue stopped. When
3491  * reclaiming packets (on 'tx done IRQ), if free space become > high mark,
3492  * Tx queue resumed.
3493  *
3494  * The IPW operates with six queues, one receive queue in the device's
3495  * sram, one transmit queue for sending commands to the device firmware,
3496  * and four transmit queues for data.
3497  *
3498  * The four transmit queues allow for performing quality of service (qos)
3499  * transmissions as per the 802.11 protocol.  Currently Linux does not
3500  * provide a mechanism to the user for utilizing prioritized queues, so
3501  * we only utilize the first data transmit queue (queue1).
3502  */
3503
3504 /**
3505  * Driver allocates buffers of this size for Rx
3506  */
3507
3508 static inline int ipw_queue_space(const struct clx2_queue *q)
3509 {
3510         int s = q->last_used - q->first_empty;
3511         if (s <= 0)
3512                 s += q->n_bd;
3513         s -= 2;                 /* keep some reserve to not confuse empty and full situations */
3514         if (s < 0)
3515                 s = 0;
3516         return s;
3517 }
3518
3519 static inline int ipw_queue_inc_wrap(int index, int n_bd)
3520 {
3521         return (++index == n_bd) ? 0 : index;
3522 }
3523
3524 /**
3525  * Initialize common DMA queue structure
3526  *
3527  * @param q                queue to init
3528  * @param count            Number of BD's to allocate. Should be power of 2
3529  * @param read_register    Address for 'read' register
3530  *                         (not offset within BAR, full address)
3531  * @param write_register   Address for 'write' register
3532  *                         (not offset within BAR, full address)
3533  * @param base_register    Address for 'base' register
3534  *                         (not offset within BAR, full address)
3535  * @param size             Address for 'size' register
3536  *                         (not offset within BAR, full address)
3537  */
3538 static void ipw_queue_init(struct ipw_priv *priv, struct clx2_queue *q,
3539                            int count, u32 read, u32 write, u32 base, u32 size)
3540 {
3541         q->n_bd = count;
3542
3543         q->low_mark = q->n_bd / 4;
3544         if (q->low_mark < 4)
3545                 q->low_mark = 4;
3546
3547         q->high_mark = q->n_bd / 8;
3548         if (q->high_mark < 2)
3549                 q->high_mark = 2;
3550
3551         q->first_empty = q->last_used = 0;
3552         q->reg_r = read;
3553         q->reg_w = write;
3554
3555         ipw_write32(priv, base, q->dma_addr);
3556         ipw_write32(priv, size, count);
3557         ipw_write32(priv, read, 0);
3558         ipw_write32(priv, write, 0);
3559
3560         _ipw_read32(priv, 0x90);
3561 }
3562
3563 static int ipw_queue_tx_init(struct ipw_priv *priv,
3564                              struct clx2_tx_queue *q,
3565                              int count, u32 read, u32 write, u32 base, u32 size)
3566 {
3567         struct pci_dev *dev = priv->pci_dev;
3568
3569         q->txb = kmalloc(sizeof(q->txb[0]) * count, GFP_KERNEL);
3570         if (!q->txb) {
3571                 IPW_ERROR("vmalloc for auxilary BD structures failed\n");
3572                 return -ENOMEM;
3573         }
3574
3575         q->bd =
3576             pci_alloc_consistent(dev, sizeof(q->bd[0]) * count, &q->q.dma_addr);
3577         if (!q->bd) {
3578                 IPW_ERROR("pci_alloc_consistent(%zd) failed\n",
3579                           sizeof(q->bd[0]) * count);
3580                 kfree(q->txb);
3581                 q->txb = NULL;
3582                 return -ENOMEM;
3583         }
3584
3585         ipw_queue_init(priv, &q->q, count, read, write, base, size);
3586         return 0;
3587 }
3588
3589 /**
3590  * Free one TFD, those at index [txq->q.last_used].
3591  * Do NOT advance any indexes
3592  *
3593  * @param dev
3594  * @param txq
3595  */
3596 static void ipw_queue_tx_free_tfd(struct ipw_priv *priv,
3597                                   struct clx2_tx_queue *txq)
3598 {
3599         struct tfd_frame *bd = &txq->bd[txq->q.last_used];
3600         struct pci_dev *dev = priv->pci_dev;
3601         int i;
3602
3603         /* classify bd */
3604         if (bd->control_flags.message_type == TX_HOST_COMMAND_TYPE)
3605                 /* nothing to cleanup after for host commands */
3606                 return;
3607
3608         /* sanity check */
3609         if (le32_to_cpu(bd->u.data.num_chunks) > NUM_TFD_CHUNKS) {
3610                 IPW_ERROR("Too many chunks: %i\n",
3611                           le32_to_cpu(bd->u.data.num_chunks));
3612                 /** @todo issue fatal error, it is quite serious situation */
3613                 return;
3614         }
3615
3616         /* unmap chunks if any */
3617         for (i = 0; i < le32_to_cpu(bd->u.data.num_chunks); i++) {
3618                 pci_unmap_single(dev, le32_to_cpu(bd->u.data.chunk_ptr[i]),
3619                                  le16_to_cpu(bd->u.data.chunk_len[i]),
3620                                  PCI_DMA_TODEVICE);
3621                 if (txq->txb[txq->q.last_used]) {
3622                         ieee80211_txb_free(txq->txb[txq->q.last_used]);
3623                         txq->txb[txq->q.last_used] = NULL;
3624                 }
3625         }
3626 }
3627
3628 /**
3629  * Deallocate DMA queue.
3630  *
3631  * Empty queue by removing and destroying all BD's.
3632  * Free all buffers.
3633  *
3634  * @param dev
3635  * @param q
3636  */
3637 static void ipw_queue_tx_free(struct ipw_priv *priv, struct clx2_tx_queue *txq)
3638 {
3639         struct clx2_queue *q = &txq->q;
3640         struct pci_dev *dev = priv->pci_dev;
3641
3642         if (q->n_bd == 0)
3643                 return;
3644
3645         /* first, empty all BD's */
3646         for (; q->first_empty != q->last_used;
3647              q->last_used = ipw_queue_inc_wrap(q->last_used, q->n_bd)) {
3648                 ipw_queue_tx_free_tfd(priv, txq);
3649         }
3650
3651         /* free buffers belonging to queue itself */
3652         pci_free_consistent(dev, sizeof(txq->bd[0]) * q->n_bd, txq->bd,
3653                             q->dma_addr);
3654         kfree(txq->txb);
3655
3656         /* 0 fill whole structure */
3657         memset(txq, 0, sizeof(*txq));
3658 }
3659
3660 /**
3661  * Destroy all DMA queues and structures
3662  *
3663  * @param priv
3664  */
3665 static void ipw_tx_queue_free(struct ipw_priv *priv)
3666 {
3667         /* Tx CMD queue */
3668         ipw_queue_tx_free(priv, &priv->txq_cmd);
3669
3670         /* Tx queues */
3671         ipw_queue_tx_free(priv, &priv->txq[0]);
3672         ipw_queue_tx_free(priv, &priv->txq[1]);
3673         ipw_queue_tx_free(priv, &priv->txq[2]);
3674         ipw_queue_tx_free(priv, &priv->txq[3]);
3675 }
3676
3677 static void ipw_create_bssid(struct ipw_priv *priv, u8 * bssid)
3678 {
3679         /* First 3 bytes are manufacturer */
3680         bssid[0] = priv->mac_addr[0];
3681         bssid[1] = priv->mac_addr[1];
3682         bssid[2] = priv->mac_addr[2];
3683
3684         /* Last bytes are random */
3685         get_random_bytes(&bssid[3], ETH_ALEN - 3);
3686
3687         bssid[0] &= 0xfe;       /* clear multicast bit */
3688         bssid[0] |= 0x02;       /* set local assignment bit (IEEE802) */
3689 }
3690
3691 static u8 ipw_add_station(struct ipw_priv *priv, u8 * bssid)
3692 {
3693         struct ipw_station_entry entry;
3694         int i;
3695
3696         for (i = 0; i < priv->num_stations; i++) {
3697                 if (!memcmp(priv->stations[i], bssid, ETH_ALEN)) {
3698                         /* Another node is active in network */
3699                         priv->missed_adhoc_beacons = 0;
3700                         if (!(priv->config & CFG_STATIC_CHANNEL))
3701                                 /* when other nodes drop out, we drop out */
3702                                 priv->config &= ~CFG_ADHOC_PERSIST;
3703
3704                         return i;
3705                 }
3706         }
3707
3708         if (i == MAX_STATIONS)
3709                 return IPW_INVALID_STATION;
3710
3711         IPW_DEBUG_SCAN("Adding AdHoc station: " MAC_FMT "\n", MAC_ARG(bssid));
3712
3713         entry.reserved = 0;
3714         entry.support_mode = 0;
3715         memcpy(entry.mac_addr, bssid, ETH_ALEN);
3716         memcpy(priv->stations[i], bssid, ETH_ALEN);
3717         ipw_write_direct(priv, IPW_STATION_TABLE_LOWER + i * sizeof(entry),
3718                          &entry, sizeof(entry));
3719         priv->num_stations++;
3720
3721         return i;
3722 }
3723
3724 static u8 ipw_find_station(struct ipw_priv *priv, u8 * bssid)
3725 {
3726         int i;
3727
3728         for (i = 0; i < priv->num_stations; i++)
3729                 if (!memcmp(priv->stations[i], bssid, ETH_ALEN))
3730                         return i;
3731
3732         return IPW_INVALID_STATION;
3733 }
3734
3735 static void ipw_send_disassociate(struct ipw_priv *priv, int quiet)
3736 {
3737         int err;
3738
3739         if (priv->status & STATUS_ASSOCIATING) {
3740                 IPW_DEBUG_ASSOC("Disassociating while associating.\n");
3741                 queue_work(priv->workqueue, &priv->disassociate);
3742                 return;
3743         }
3744
3745         if (!(priv->status & STATUS_ASSOCIATED)) {
3746                 IPW_DEBUG_ASSOC("Disassociating while not associated.\n");
3747                 return;
3748         }
3749
3750         IPW_DEBUG_ASSOC("Disassocation attempt from " MAC_FMT " "
3751                         "on channel %d.\n",
3752                         MAC_ARG(priv->assoc_request.bssid),
3753                         priv->assoc_request.channel);
3754
3755         priv->status &= ~(STATUS_ASSOCIATING | STATUS_ASSOCIATED);
3756         priv->status |= STATUS_DISASSOCIATING;
3757
3758         if (quiet)
3759                 priv->assoc_request.assoc_type = HC_DISASSOC_QUIET;
3760         else
3761                 priv->assoc_request.assoc_type = HC_DISASSOCIATE;
3762
3763         err = ipw_send_associate(priv, &priv->assoc_request);
3764         if (err) {
3765                 IPW_DEBUG_HC("Attempt to send [dis]associate command "
3766                              "failed.\n");
3767                 return;
3768         }
3769
3770 }
3771
3772 static int ipw_disassociate(void *data)
3773 {
3774         struct ipw_priv *priv = data;
3775         if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)))
3776                 return 0;
3777         ipw_send_disassociate(data, 0);
3778         return 1;
3779 }
3780
3781 static void ipw_bg_disassociate(void *data)
3782 {
3783         struct ipw_priv *priv = data;
3784         down(&priv->sem);
3785         ipw_disassociate(data);
3786         up(&priv->sem);
3787 }
3788
3789 static void ipw_system_config(void *data)
3790 {
3791         struct ipw_priv *priv = data;
3792         ipw_send_system_config(priv, &priv->sys_config);
3793 }
3794
3795 struct ipw_status_code {
3796         u16 status;
3797         const char *reason;
3798 };
3799
3800 static const struct ipw_status_code ipw_status_codes[] = {
3801         {0x00, "Successful"},
3802         {0x01, "Unspecified failure"},
3803         {0x0A, "Cannot support all requested capabilities in the "
3804          "Capability information field"},
3805         {0x0B, "Reassociation denied due to inability to confirm that "
3806          "association exists"},
3807         {0x0C, "Association denied due to reason outside the scope of this "
3808          "standard"},
3809         {0x0D,
3810          "Responding station does not support the specified authentication "
3811          "algorithm"},
3812         {0x0E,
3813          "Received an Authentication frame with authentication sequence "
3814          "transaction sequence number out of expected sequence"},
3815         {0x0F, "Authentication rejected because of challenge failure"},
3816         {0x10, "Authentication rejected due to timeout waiting for next "
3817          "frame in sequence"},
3818         {0x11, "Association denied because AP is unable to handle additional "
3819          "associated stations"},
3820         {0x12,
3821          "Association denied due to requesting station not supporting all "
3822          "of the datarates in the BSSBasicServiceSet Parameter"},
3823         {0x13,
3824          "Association denied due to requesting station not supporting "
3825          "short preamble operation"},
3826         {0x14,
3827          "Association denied due to requesting station not supporting "
3828          "PBCC encoding"},
3829         {0x15,
3830          "Association denied due to requesting station not supporting "
3831          "channel agility"},
3832         {0x19,
3833          "Association denied due to requesting station not supporting "
3834          "short slot operation"},
3835         {0x1A,
3836          "Association denied due to requesting station not supporting "
3837          "DSSS-OFDM operation"},
3838         {0x28, "Invalid Information Element"},
3839         {0x29, "Group Cipher is not valid"},
3840         {0x2A, "Pairwise Cipher is not valid"},
3841         {0x2B, "AKMP is not valid"},
3842         {0x2C, "Unsupported RSN IE version"},
3843         {0x2D, "Invalid RSN IE Capabilities"},
3844         {0x2E, "Cipher suite is rejected per security policy"},
3845 };
3846
3847 #ifdef CONFIG_IPW2200_DEBUG
3848 static const char *ipw_get_status_code(u16 status)
3849 {
3850         int i;
3851         for (i = 0; i < ARRAY_SIZE(ipw_status_codes); i++)
3852                 if (ipw_status_codes[i].status == (status & 0xff))
3853                         return ipw_status_codes[i].reason;
3854         return "Unknown status value.";
3855 }
3856 #endif
3857
3858 static void inline average_init(struct average *avg)
3859 {
3860         memset(avg, 0, sizeof(*avg));
3861 }
3862
3863 static void average_add(struct average *avg, s16 val)
3864 {
3865         avg->sum -= avg->entries[avg->pos];
3866         avg->sum += val;
3867         avg->entries[avg->pos++] = val;
3868         if (unlikely(avg->pos == AVG_ENTRIES)) {
3869                 avg->init = 1;
3870                 avg->pos = 0;
3871         }
3872 }
3873
3874 static s16 average_value(struct average *avg)
3875 {
3876         if (!unlikely(avg->init)) {
3877                 if (avg->pos)
3878                         return avg->sum / avg->pos;
3879                 return 0;
3880         }
3881
3882         return avg->sum / AVG_ENTRIES;
3883 }
3884
3885 static void ipw_reset_stats(struct ipw_priv *priv)
3886 {
3887         u32 len = sizeof(u32);
3888
3889         priv->quality = 0;
3890
3891         average_init(&priv->average_missed_beacons);
3892         average_init(&priv->average_rssi);
3893         average_init(&priv->average_noise);
3894
3895         priv->last_rate = 0;
3896         priv->last_missed_beacons = 0;
3897         priv->last_rx_packets = 0;
3898         priv->last_tx_packets = 0;
3899         priv->last_tx_failures = 0;
3900
3901         /* Firmware managed, reset only when NIC is restarted, so we have to
3902          * normalize on the current value */
3903         ipw_get_ordinal(priv, IPW_ORD_STAT_RX_ERR_CRC,
3904                         &priv->last_rx_err, &len);
3905         ipw_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURE,
3906                         &priv->last_tx_failures, &len);
3907
3908         /* Driver managed, reset with each association */
3909         priv->missed_adhoc_beacons = 0;
3910         priv->missed_beacons = 0;
3911         priv->tx_packets = 0;
3912         priv->rx_packets = 0;
3913
3914 }
3915
3916 static u32 ipw_get_max_rate(struct ipw_priv *priv)
3917 {
3918         u32 i = 0x80000000;
3919         u32 mask = priv->rates_mask;
3920         /* If currently associated in B mode, restrict the maximum
3921          * rate match to B rates */
3922         if (priv->assoc_request.ieee_mode == IPW_B_MODE)
3923                 mask &= IEEE80211_CCK_RATES_MASK;
3924
3925         /* TODO: Verify that the rate is supported by the current rates
3926          * list. */
3927
3928         while (i && !(mask & i))
3929                 i >>= 1;
3930         switch (i) {
3931         case IEEE80211_CCK_RATE_1MB_MASK:
3932                 return 1000000;
3933         case IEEE80211_CCK_RATE_2MB_MASK:
3934                 return 2000000;
3935         case IEEE80211_CCK_RATE_5MB_MASK:
3936                 return 5500000;
3937         case IEEE80211_OFDM_RATE_6MB_MASK:
3938                 return 6000000;
3939         case IEEE80211_OFDM_RATE_9MB_MASK:
3940                 return 9000000;
3941         case IEEE80211_CCK_RATE_11MB_MASK:
3942                 return 11000000;
3943         case IEEE80211_OFDM_RATE_12MB_MASK:
3944                 return 12000000;
3945         case IEEE80211_OFDM_RATE_18MB_MASK:
3946                 return 18000000;
3947         case IEEE80211_OFDM_RATE_24MB_MASK:
3948                 return 24000000;
3949         case IEEE80211_OFDM_RATE_36MB_MASK:
3950                 return 36000000;
3951         case IEEE80211_OFDM_RATE_48MB_MASK:
3952                 return 48000000;
3953         case IEEE80211_OFDM_RATE_54MB_MASK:
3954                 return 54000000;
3955         }
3956
3957         if (priv->ieee->mode == IEEE_B)
3958                 return 11000000;
3959         else
3960                 return 54000000;
3961 }
3962
3963 static u32 ipw_get_current_rate(struct ipw_priv *priv)
3964 {
3965         u32 rate, len = sizeof(rate);
3966         int err;
3967
3968         if (!(priv->status & STATUS_ASSOCIATED))
3969                 return 0;
3970
3971         if (priv->tx_packets > IPW_REAL_RATE_RX_PACKET_THRESHOLD) {
3972                 err = ipw_get_ordinal(priv, IPW_ORD_STAT_TX_CURR_RATE, &rate,
3973                                       &len);
3974                 if (err) {
3975                         IPW_DEBUG_INFO("failed querying ordinals.\n");
3976                         return 0;
3977                 }
3978         } else
3979                 return ipw_get_max_rate(priv);
3980
3981         switch (rate) {
3982         case IPW_TX_RATE_1MB:
3983                 return 1000000;
3984         case IPW_TX_RATE_2MB:
3985                 return 2000000;
3986         case IPW_TX_RATE_5MB:
3987                 return 5500000;
3988         case IPW_TX_RATE_6MB:
3989                 return 6000000;
3990         case IPW_TX_RATE_9MB:
3991                 return 9000000;
3992         case IPW_TX_RATE_11MB:
3993                 return 11000000;
3994         case IPW_TX_RATE_12MB:
3995                 return 12000000;
3996         case IPW_TX_RATE_18MB:
3997                 return 18000000;
3998         case IPW_TX_RATE_24MB:
3999                 return 24000000;
4000         case IPW_TX_RATE_36MB:
4001                 return 36000000;
4002         case IPW_TX_RATE_48MB:
4003                 return 48000000;
4004         case IPW_TX_RATE_54MB:
4005                 return 54000000;
4006         }
4007
4008         return 0;
4009 }
4010
4011 #define IPW_STATS_INTERVAL (2 * HZ)
4012 static void ipw_gather_stats(struct ipw_priv *priv)
4013 {
4014         u32 rx_err, rx_err_delta, rx_packets_delta;
4015         u32 tx_failures, tx_failures_delta, tx_packets_delta;
4016         u32 missed_beacons_percent, missed_beacons_delta;
4017         u32 quality = 0;
4018         u32 len = sizeof(u32);
4019         s16 rssi;
4020         u32 beacon_quality, signal_quality, tx_quality, rx_quality,
4021             rate_quality;
4022         u32 max_rate;
4023
4024         if (!(priv->status & STATUS_ASSOCIATED)) {
4025                 priv->quality = 0;
4026                 return;
4027         }
4028
4029         /* Update the statistics */
4030         ipw_get_ordinal(priv, IPW_ORD_STAT_MISSED_BEACONS,
4031                         &priv->missed_beacons, &len);
4032         missed_beacons_delta = priv->missed_beacons - priv->last_missed_beacons;
4033         priv->last_missed_beacons = priv->missed_beacons;
4034         if (priv->assoc_request.beacon_interval) {
4035                 missed_beacons_percent = missed_beacons_delta *
4036                     (HZ * priv->assoc_request.beacon_interval) /
4037                     (IPW_STATS_INTERVAL * 10);
4038         } else {
4039                 missed_beacons_percent = 0;
4040         }
4041         average_add(&priv->average_missed_beacons, missed_beacons_percent);
4042
4043         ipw_get_ordinal(priv, IPW_ORD_STAT_RX_ERR_CRC, &rx_err, &len);
4044         rx_err_delta = rx_err - priv->last_rx_err;
4045         priv->last_rx_err = rx_err;
4046
4047         ipw_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURE, &tx_failures, &len);
4048         tx_failures_delta = tx_failures - priv->last_tx_failures;
4049         priv->last_tx_failures = tx_failures;
4050
4051         rx_packets_delta = priv->rx_packets - priv->last_rx_packets;
4052         priv->last_rx_packets = priv->rx_packets;
4053
4054         tx_packets_delta = priv->tx_packets - priv->last_tx_packets;
4055         priv->last_tx_packets = priv->tx_packets;
4056
4057         /* Calculate quality based on the following:
4058          *
4059          * Missed beacon: 100% = 0, 0% = 70% missed
4060          * Rate: 60% = 1Mbs, 100% = Max
4061          * Rx and Tx errors represent a straight % of total Rx/Tx
4062          * RSSI: 100% = > -50,  0% = < -80
4063          * Rx errors: 100% = 0, 0% = 50% missed
4064          *
4065          * The lowest computed quality is used.
4066          *
4067          */
4068 #define BEACON_THRESHOLD 5
4069         beacon_quality = 100 - missed_beacons_percent;
4070         if (beacon_quality < BEACON_THRESHOLD)
4071                 beacon_quality = 0;
4072         else
4073                 beacon_quality = (beacon_quality - BEACON_THRESHOLD) * 100 /
4074                     (100 - BEACON_THRESHOLD);
4075         IPW_DEBUG_STATS("Missed beacon: %3d%% (%d%%)\n",
4076                         beacon_quality, missed_beacons_percent);
4077
4078         priv->last_rate = ipw_get_current_rate(priv);
4079         max_rate = ipw_get_max_rate(priv);
4080         rate_quality = priv->last_rate * 40 / max_rate + 60;
4081         IPW_DEBUG_STATS("Rate quality : %3d%% (%dMbs)\n",
4082                         rate_quality, priv->last_rate / 1000000);
4083
4084         if (rx_packets_delta > 100 && rx_packets_delta + rx_err_delta)
4085                 rx_quality = 100 - (rx_err_delta * 100) /
4086                     (rx_packets_delta + rx_err_delta);
4087         else
4088                 rx_quality = 100;
4089         IPW_DEBUG_STATS("Rx quality   : %3d%% (%u errors, %u packets)\n",
4090                         rx_quality, rx_err_delta, rx_packets_delta);
4091
4092         if (tx_packets_delta > 100 && tx_packets_delta + tx_failures_delta)
4093                 tx_quality = 100 - (tx_failures_delta * 100) /
4094                     (tx_packets_delta + tx_failures_delta);
4095         else
4096                 tx_quality = 100;
4097         IPW_DEBUG_STATS("Tx quality   : %3d%% (%u errors, %u packets)\n",
4098                         tx_quality, tx_failures_delta, tx_packets_delta);
4099
4100         rssi = average_value(&priv->average_rssi);
4101         signal_quality =
4102             (100 *
4103              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) *
4104              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) -
4105              (priv->ieee->perfect_rssi - rssi) *
4106              (15 * (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) +
4107               62 * (priv->ieee->perfect_rssi - rssi))) /
4108             ((priv->ieee->perfect_rssi - priv->ieee->worst_rssi) *
4109              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi));
4110         if (signal_quality > 100)
4111                 signal_quality = 100;
4112         else if (signal_quality < 1)
4113                 signal_quality = 0;
4114
4115         IPW_DEBUG_STATS("Signal level : %3d%% (%d dBm)\n",
4116                         signal_quality, rssi);
4117
4118         quality = min(beacon_quality,
4119                       min(rate_quality,
4120                           min(tx_quality, min(rx_quality, signal_quality))));
4121         if (quality == beacon_quality)
4122                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to missed beacons.\n",
4123                                 quality);
4124         if (quality == rate_quality)
4125                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to rate quality.\n",
4126                                 quality);
4127         if (quality == tx_quality)
4128                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to Tx quality.\n",
4129                                 quality);
4130         if (quality == rx_quality)
4131                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to Rx quality.\n",
4132                                 quality);
4133         if (quality == signal_quality)
4134                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to signal quality.\n",
4135                                 quality);
4136
4137         priv->quality = quality;
4138
4139         queue_delayed_work(priv->workqueue, &priv->gather_stats,
4140                            IPW_STATS_INTERVAL);
4141 }
4142
4143 static void ipw_bg_gather_stats(void *data)
4144 {
4145         struct ipw_priv *priv = data;
4146         down(&priv->sem);
4147         ipw_gather_stats(data);
4148         up(&priv->sem);
4149 }
4150
4151 /* Missed beacon behavior:
4152  * 1st missed -> roaming_threshold, just wait, don't do any scan/roam.
4153  * roaming_threshold -> disassociate_threshold, scan and roam for better signal.
4154  * Above disassociate threshold, give up and stop scanning.
4155  * Roaming is disabled if disassociate_threshold <= roaming_threshold  */
4156 static void ipw_handle_missed_beacon(struct ipw_priv *priv,
4157                                             int missed_count)
4158 {
4159         priv->notif_missed_beacons = missed_count;
4160
4161         if (missed_count > priv->disassociate_threshold &&
4162             priv->status & STATUS_ASSOCIATED) {
4163                 /* If associated and we've hit the missed
4164                  * beacon threshold, disassociate, turn
4165                  * off roaming, and abort any active scans */
4166                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
4167                           IPW_DL_STATE | IPW_DL_ASSOC,
4168                           "Missed beacon: %d - disassociate\n", missed_count);
4169                 priv->status &= ~STATUS_ROAMING;
4170                 if (priv->status & STATUS_SCANNING) {
4171                         IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
4172                                   IPW_DL_STATE,
4173                                   "Aborting scan with missed beacon.\n");
4174                         queue_work(priv->workqueue, &priv->abort_scan);
4175                 }
4176
4177                 queue_work(priv->workqueue, &priv->disassociate);
4178                 return;
4179         }
4180
4181         if (priv->status & STATUS_ROAMING) {
4182                 /* If we are currently roaming, then just
4183                  * print a debug statement... */
4184                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4185                           "Missed beacon: %d - roam in progress\n",
4186                           missed_count);
4187                 return;
4188         }
4189
4190         if (missed_count > priv->roaming_threshold &&
4191             missed_count <= priv->disassociate_threshold) {
4192                 /* If we are not already roaming, set the ROAM
4193                  * bit in the status and kick off a scan.
4194                  * This can happen several times before we reach
4195                  * disassociate_threshold. */
4196                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4197                           "Missed beacon: %d - initiate "
4198                           "roaming\n", missed_count);
4199                 if (!(priv->status & STATUS_ROAMING)) {
4200                         priv->status |= STATUS_ROAMING;
4201                         if (!(priv->status & STATUS_SCANNING))
4202                                 queue_work(priv->workqueue,
4203                                            &priv->request_scan);
4204                 }
4205                 return;
4206         }
4207
4208         if (priv->status & STATUS_SCANNING) {
4209                 /* Stop scan to keep fw from getting
4210                  * stuck (only if we aren't roaming --
4211                  * otherwise we'll never scan more than 2 or 3
4212                  * channels..) */
4213                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF | IPW_DL_STATE,
4214                           "Aborting scan with missed beacon.\n");
4215                 queue_work(priv->workqueue, &priv->abort_scan);
4216         }
4217
4218         IPW_DEBUG_NOTIF("Missed beacon: %d\n", missed_count);
4219
4220 }
4221
4222 /**
4223  * Handle host notification packet.
4224  * Called from interrupt routine
4225  */
4226 static void ipw_rx_notification(struct ipw_priv *priv,
4227                                        struct ipw_rx_notification *notif)
4228 {
4229         notif->size = le16_to_cpu(notif->size);
4230
4231         IPW_DEBUG_NOTIF("type = %i (%d bytes)\n", notif->subtype, notif->size);
4232
4233         switch (notif->subtype) {
4234         case HOST_NOTIFICATION_STATUS_ASSOCIATED:{
4235                         struct notif_association *assoc = &notif->u.assoc;
4236
4237                         switch (assoc->state) {
4238                         case CMAS_ASSOCIATED:{
4239                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4240                                                   IPW_DL_ASSOC,
4241                                                   "associated: '%s' " MAC_FMT
4242                                                   " \n",
4243                                                   escape_essid(priv->essid,
4244                                                                priv->essid_len),
4245                                                   MAC_ARG(priv->bssid));
4246
4247                                         switch (priv->ieee->iw_mode) {
4248                                         case IW_MODE_INFRA:
4249                                                 memcpy(priv->ieee->bssid,
4250                                                        priv->bssid, ETH_ALEN);
4251                                                 break;
4252
4253                                         case IW_MODE_ADHOC:
4254                                                 memcpy(priv->ieee->bssid,
4255                                                        priv->bssid, ETH_ALEN);
4256
4257                                                 /* clear out the station table */
4258                                                 priv->num_stations = 0;
4259
4260                                                 IPW_DEBUG_ASSOC
4261                                                     ("queueing adhoc check\n");
4262                                                 queue_delayed_work(priv->
4263                                                                    workqueue,
4264                                                                    &priv->
4265                                                                    adhoc_check,
4266                                                                    priv->
4267                                                                    assoc_request.
4268                                                                    beacon_interval);
4269                                                 break;
4270                                         }
4271
4272                                         priv->status &= ~STATUS_ASSOCIATING;
4273                                         priv->status |= STATUS_ASSOCIATED;
4274                                         queue_work(priv->workqueue,
4275                                                    &priv->system_config);
4276
4277 #ifdef CONFIG_IPW_QOS
4278 #define IPW_GET_PACKET_STYPE(x) WLAN_FC_GET_STYPE( \
4279                          le16_to_cpu(((struct ieee80211_hdr *)(x))->frame_ctl))
4280                                         if ((priv->status & STATUS_AUTH) &&
4281                                             (IPW_GET_PACKET_STYPE(&notif->u.raw)
4282                                              == IEEE80211_STYPE_ASSOC_RESP)) {
4283                                                 if ((sizeof
4284                                                      (struct
4285                                                       ieee80211_assoc_response)
4286                                                      <= notif->size)
4287                                                     && (notif->size <= 2314)) {
4288                                                         struct
4289                                                         ieee80211_rx_stats
4290                                                             stats = {
4291                                                                 .len =
4292                                                                     notif->
4293                                                                     size - 1,
4294                                                         };
4295
4296                                                         IPW_DEBUG_QOS
4297                                                             ("QoS Associate "
4298                                                              "size %d\n",
4299                                                              notif->size);
4300                                                         ieee80211_rx_mgt(priv->
4301                                                                          ieee,
4302                                                                          (struct
4303                                                                           ieee80211_hdr_4addr
4304                                                                           *)
4305                                                                          &notif->u.raw, &stats);
4306                                                 }
4307                                         }
4308 #endif
4309
4310                                         schedule_work(&priv->link_up);
4311
4312                                         break;
4313                                 }
4314
4315                         case CMAS_AUTHENTICATED:{
4316                                         if (priv->
4317                                             status & (STATUS_ASSOCIATED |
4318                                                       STATUS_AUTH)) {
4319 #ifdef CONFIG_IPW2200_DEBUG
4320                                                 struct notif_authenticate *auth
4321                                                     = &notif->u.auth;
4322                                                 IPW_DEBUG(IPW_DL_NOTIF |
4323                                                           IPW_DL_STATE |
4324                                                           IPW_DL_ASSOC,
4325                                                           "deauthenticated: '%s' "
4326                                                           MAC_FMT
4327                                                           ": (0x%04X) - %s \n",
4328                                                           escape_essid(priv->
4329                                                                        essid,
4330                                                                        priv->
4331                                                                        essid_len),
4332                                                           MAC_ARG(priv->bssid),
4333                                                           ntohs(auth->status),
4334                                                           ipw_get_status_code
4335                                                           (ntohs
4336                                                            (auth->status)));
4337 #endif
4338
4339                                                 priv->status &=
4340                                                     ~(STATUS_ASSOCIATING |
4341                                                       STATUS_AUTH |
4342                                                       STATUS_ASSOCIATED);
4343
4344                                                 schedule_work(&priv->link_down);
4345                                                 break;
4346                                         }
4347
4348                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4349                                                   IPW_DL_ASSOC,
4350                                                   "authenticated: '%s' " MAC_FMT
4351                                                   "\n",
4352                                                   escape_essid(priv->essid,
4353                                                                priv->essid_len),
4354                                                   MAC_ARG(priv->bssid));
4355                                         break;
4356                                 }
4357
4358                         case CMAS_INIT:{
4359                                         if (priv->status & STATUS_AUTH) {
4360                                                 struct
4361                                                     ieee80211_assoc_response
4362                                                 *resp;
4363                                                 resp =
4364                                                     (struct
4365                                                      ieee80211_assoc_response
4366                                                      *)&notif->u.raw;
4367                                                 IPW_DEBUG(IPW_DL_NOTIF |
4368                                                           IPW_DL_STATE |
4369                                                           IPW_DL_ASSOC,
4370                                                           "association failed (0x%04X): %s\n",
4371                                                           ntohs(resp->status),
4372                                                           ipw_get_status_code
4373                                                           (ntohs
4374                                                            (resp->status)));
4375                                         }
4376
4377                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4378                                                   IPW_DL_ASSOC,
4379                                                   "disassociated: '%s' " MAC_FMT
4380                                                   " \n",
4381                                                   escape_essid(priv->essid,
4382                                                                priv->essid_len),
4383                                                   MAC_ARG(priv->bssid));
4384
4385                                         priv->status &=
4386                                             ~(STATUS_DISASSOCIATING |
4387                                               STATUS_ASSOCIATING |
4388                                               STATUS_ASSOCIATED | STATUS_AUTH);
4389                                         if (priv->assoc_network
4390                                             && (priv->assoc_network->
4391                                                 capability &
4392                                                 WLAN_CAPABILITY_IBSS))
4393                                                 ipw_remove_current_network
4394                                                     (priv);
4395
4396                                         schedule_work(&priv->link_down);
4397
4398                                         break;
4399                                 }
4400
4401                         case CMAS_RX_ASSOC_RESP:
4402                                 break;
4403
4404                         default:
4405                                 IPW_ERROR("assoc: unknown (%d)\n",
4406                                           assoc->state);
4407                                 break;
4408                         }
4409
4410                         break;
4411                 }
4412
4413         case HOST_NOTIFICATION_STATUS_AUTHENTICATE:{
4414                         struct notif_authenticate *auth = &notif->u.auth;
4415                         switch (auth->state) {
4416                         case CMAS_AUTHENTICATED:
4417                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4418                                           "authenticated: '%s' " MAC_FMT " \n",
4419                                           escape_essid(priv->essid,
4420                                                        priv->essid_len),
4421                                           MAC_ARG(priv->bssid));
4422                                 priv->status |= STATUS_AUTH;
4423                                 break;
4424
4425                         case CMAS_INIT:
4426                                 if (priv->status & STATUS_AUTH) {
4427                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4428                                                   IPW_DL_ASSOC,
4429                                                   "authentication failed (0x%04X): %s\n",
4430                                                   ntohs(auth->status),
4431                                                   ipw_get_status_code(ntohs
4432                                                                       (auth->
4433                                                                        status)));
4434                                 }
4435                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4436                                           IPW_DL_ASSOC,
4437                                           "deauthenticated: '%s' " MAC_FMT "\n",
4438                                           escape_essid(priv->essid,
4439                                                        priv->essid_len),
4440                                           MAC_ARG(priv->bssid));
4441
4442                                 priv->status &= ~(STATUS_ASSOCIATING |
4443                                                   STATUS_AUTH |
4444                                                   STATUS_ASSOCIATED);
4445
4446                                 schedule_work(&priv->link_down);
4447                                 break;
4448
4449                         case CMAS_TX_AUTH_SEQ_1:
4450                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4451                                           IPW_DL_ASSOC, "AUTH_SEQ_1\n");
4452                                 break;
4453                         case CMAS_RX_AUTH_SEQ_2:
4454                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4455                                           IPW_DL_ASSOC, "AUTH_SEQ_2\n");
4456                                 break;
4457                         case CMAS_AUTH_SEQ_1_PASS:
4458                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4459                                           IPW_DL_ASSOC, "AUTH_SEQ_1_PASS\n");
4460                                 break;
4461                         case CMAS_AUTH_SEQ_1_FAIL:
4462                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4463                                           IPW_DL_ASSOC, "AUTH_SEQ_1_FAIL\n");
4464                                 break;
4465                         case CMAS_TX_AUTH_SEQ_3:
4466                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4467                                           IPW_DL_ASSOC, "AUTH_SEQ_3\n");
4468                                 break;
4469                         case CMAS_RX_AUTH_SEQ_4:
4470                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4471                                           IPW_DL_ASSOC, "RX_AUTH_SEQ_4\n");
4472                                 break;
4473                         case CMAS_AUTH_SEQ_2_PASS:
4474                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4475                                           IPW_DL_ASSOC, "AUTH_SEQ_2_PASS\n");
4476                                 break;
4477                         case CMAS_AUTH_SEQ_2_FAIL:
4478                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4479                                           IPW_DL_ASSOC, "AUT_SEQ_2_FAIL\n");
4480                                 break;
4481                         case CMAS_TX_ASSOC:
4482                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4483                                           IPW_DL_ASSOC, "TX_ASSOC\n");
4484                                 break;
4485                         case CMAS_RX_ASSOC_RESP:
4486                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4487                                           IPW_DL_ASSOC, "RX_ASSOC_RESP\n");
4488
4489                                 break;
4490                         case CMAS_ASSOCIATED:
4491                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4492                                           IPW_DL_ASSOC, "ASSOCIATED\n");
4493                                 break;
4494                         default:
4495                                 IPW_DEBUG_NOTIF("auth: failure - %d\n",
4496                                                 auth->state);
4497                                 break;
4498                         }
4499                         break;
4500                 }
4501
4502         case HOST_NOTIFICATION_STATUS_SCAN_CHANNEL_RESULT:{
4503                         struct notif_channel_result *x =
4504                             &notif->u.channel_result;
4505
4506                         if (notif->size == sizeof(*x)) {
4507                                 IPW_DEBUG_SCAN("Scan result for channel %d\n",
4508                                                x->channel_num);
4509                         } else {
4510                                 IPW_DEBUG_SCAN("Scan result of wrong size %d "
4511                                                "(should be %zd)\n",
4512                                                notif->size, sizeof(*x));
4513                         }
4514                         break;
4515                 }
4516
4517         case HOST_NOTIFICATION_STATUS_SCAN_COMPLETED:{
4518                         struct notif_scan_complete *x = &notif->u.scan_complete;
4519                         if (notif->size == sizeof(*x)) {
4520                                 IPW_DEBUG_SCAN
4521                                     ("Scan completed: type %d, %d channels, "
4522                                      "%d status\n", x->scan_type,
4523                                      x->num_channels, x->status);
4524                         } else {
4525                                 IPW_ERROR("Scan completed of wrong size %d "
4526                                           "(should be %zd)\n",
4527                                           notif->size, sizeof(*x));
4528                         }
4529
4530                         priv->status &=
4531                             ~(STATUS_SCANNING | STATUS_SCAN_ABORTING);
4532
4533                         wake_up_interruptible(&priv->wait_state);
4534                         cancel_delayed_work(&priv->scan_check);
4535
4536                         if (priv->status & STATUS_EXIT_PENDING)
4537                                 break;
4538
4539                         priv->ieee->scans++;
4540
4541 #ifdef CONFIG_IPW2200_MONITOR
4542                         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
4543                                 priv->status |= STATUS_SCAN_FORCED;
4544                                 queue_work(priv->workqueue,
4545                                            &priv->request_scan);
4546                                 break;
4547                         }
4548                         priv->status &= ~STATUS_SCAN_FORCED;
4549 #endif                          /* CONFIG_IPW2200_MONITOR */
4550
4551                         if (!(priv->status & (STATUS_ASSOCIATED |
4552                                               STATUS_ASSOCIATING |
4553                                               STATUS_ROAMING |
4554                                               STATUS_DISASSOCIATING)))
4555                                 queue_work(priv->workqueue, &priv->associate);
4556                         else if (priv->status & STATUS_ROAMING) {
4557                                 if (x->status == SCAN_COMPLETED_STATUS_COMPLETE)
4558                                         /* If a scan completed and we are in roam mode, then
4559                                          * the scan that completed was the one requested as a
4560                                          * result of entering roam... so, schedule the
4561                                          * roam work */
4562                                         queue_work(priv->workqueue,
4563                                                    &priv->roam);
4564                                 else
4565                                         /* Don't schedule if we aborted the scan */
4566                                         priv->status &= ~STATUS_ROAMING;
4567                         } else if (priv->status & STATUS_SCAN_PENDING)
4568                                 queue_work(priv->workqueue,
4569                                            &priv->request_scan);
4570                         else if (priv->config & CFG_BACKGROUND_SCAN
4571                                  && priv->status & STATUS_ASSOCIATED)
4572                                 queue_delayed_work(priv->workqueue,
4573                                                    &priv->request_scan, HZ);
4574                         break;
4575                 }
4576
4577         case HOST_NOTIFICATION_STATUS_FRAG_LENGTH:{
4578                         struct notif_frag_length *x = &notif->u.frag_len;
4579
4580                         if (notif->size == sizeof(*x))
4581                                 IPW_ERROR("Frag length: %d\n",
4582                                           le16_to_cpu(x->frag_length));
4583                         else
4584                                 IPW_ERROR("Frag length of wrong size %d "
4585                                           "(should be %zd)\n",
4586                                           notif->size, sizeof(*x));
4587                         break;
4588                 }
4589
4590         case HOST_NOTIFICATION_STATUS_LINK_DETERIORATION:{
4591                         struct notif_link_deterioration *x =
4592                             &notif->u.link_deterioration;
4593
4594                         if (notif->size == sizeof(*x)) {
4595                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4596                                           "link deterioration: '%s' " MAC_FMT
4597                                           " \n", escape_essid(priv->essid,
4598                                                               priv->essid_len),
4599                                           MAC_ARG(priv->bssid));
4600                                 memcpy(&priv->last_link_deterioration, x,
4601                                        sizeof(*x));
4602                         } else {
4603                                 IPW_ERROR("Link Deterioration of wrong size %d "
4604                                           "(should be %zd)\n",
4605                                           notif->size, sizeof(*x));
4606                         }
4607                         break;
4608                 }
4609
4610         case HOST_NOTIFICATION_DINO_CONFIG_RESPONSE:{
4611                         IPW_ERROR("Dino config\n");
4612                         if (priv->hcmd
4613                             && priv->hcmd->cmd != HOST_CMD_DINO_CONFIG)
4614                                 IPW_ERROR("Unexpected DINO_CONFIG_RESPONSE\n");
4615
4616                         break;
4617                 }
4618
4619         case HOST_NOTIFICATION_STATUS_BEACON_STATE:{
4620                         struct notif_beacon_state *x = &notif->u.beacon_state;
4621                         if (notif->size != sizeof(*x)) {
4622                                 IPW_ERROR
4623                                     ("Beacon state of wrong size %d (should "
4624                                      "be %zd)\n", notif->size, sizeof(*x));
4625                                 break;
4626                         }
4627
4628                         if (le32_to_cpu(x->state) ==
4629                             HOST_NOTIFICATION_STATUS_BEACON_MISSING)
4630                                 ipw_handle_missed_beacon(priv,
4631                                                          le32_to_cpu(x->
4632                                                                      number));
4633
4634                         break;
4635                 }
4636
4637         case HOST_NOTIFICATION_STATUS_TGI_TX_KEY:{
4638                         struct notif_tgi_tx_key *x = &notif->u.tgi_tx_key;
4639                         if (notif->size == sizeof(*x)) {
4640                                 IPW_ERROR("TGi Tx Key: state 0x%02x sec type "
4641                                           "0x%02x station %d\n",
4642                                           x->key_state, x->security_type,
4643                                           x->station_index);
4644                                 break;
4645                         }
4646
4647                         IPW_ERROR
4648                             ("TGi Tx Key of wrong size %d (should be %zd)\n",
4649                              notif->size, sizeof(*x));
4650                         break;
4651                 }
4652
4653         case HOST_NOTIFICATION_CALIB_KEEP_RESULTS:{
4654                         struct notif_calibration *x = &notif->u.calibration;
4655
4656                         if (notif->size == sizeof(*x)) {
4657                                 memcpy(&priv->calib, x, sizeof(*x));
4658                                 IPW_DEBUG_INFO("TODO: Calibration\n");
4659                                 break;
4660                         }
4661
4662                         IPW_ERROR
4663                             ("Calibration of wrong size %d (should be %zd)\n",
4664                              notif->size, sizeof(*x));
4665                         break;
4666                 }
4667
4668         case HOST_NOTIFICATION_NOISE_STATS:{
4669                         if (notif->size == sizeof(u32)) {
4670                                 priv->last_noise =
4671                                     (u8) (le32_to_cpu(notif->u.noise.value) &
4672                                           0xff);
4673                                 average_add(&priv->average_noise,
4674                                             priv->last_noise);
4675                                 break;
4676                         }
4677
4678                         IPW_ERROR
4679                             ("Noise stat is wrong size %d (should be %zd)\n",
4680                              notif->size, sizeof(u32));
4681                         break;
4682                 }
4683
4684         default:
4685                 IPW_ERROR("Unknown notification: "
4686                           "subtype=%d,flags=0x%2x,size=%d\n",
4687                           notif->subtype, notif->flags, notif->size);
4688         }
4689 }
4690
4691 /**
4692  * Destroys all DMA structures and initialise them again
4693  *
4694  * @param priv
4695  * @return error code
4696  */
4697 static int ipw_queue_reset(struct ipw_priv *priv)
4698 {
4699         int rc = 0;
4700         /** @todo customize queue sizes */
4701         int nTx = 64, nTxCmd = 8;
4702         ipw_tx_queue_free(priv);
4703         /* Tx CMD queue */
4704         rc = ipw_queue_tx_init(priv, &priv->txq_cmd, nTxCmd,
4705                                IPW_TX_CMD_QUEUE_READ_INDEX,
4706                                IPW_TX_CMD_QUEUE_WRITE_INDEX,
4707                                IPW_TX_CMD_QUEUE_BD_BASE,
4708                                IPW_TX_CMD_QUEUE_BD_SIZE);
4709         if (rc) {
4710                 IPW_ERROR("Tx Cmd queue init failed\n");
4711                 goto error;
4712         }
4713         /* Tx queue(s) */
4714         rc = ipw_queue_tx_init(priv, &priv->txq[0], nTx,
4715                                IPW_TX_QUEUE_0_READ_INDEX,
4716                                IPW_TX_QUEUE_0_WRITE_INDEX,
4717                                IPW_TX_QUEUE_0_BD_BASE, IPW_TX_QUEUE_0_BD_SIZE);
4718         if (rc) {
4719                 IPW_ERROR("Tx 0 queue init failed\n");
4720                 goto error;
4721         }
4722         rc = ipw_queue_tx_init(priv, &priv->txq[1], nTx,
4723                                IPW_TX_QUEUE_1_READ_INDEX,
4724                                IPW_TX_QUEUE_1_WRITE_INDEX,
4725                                IPW_TX_QUEUE_1_BD_BASE, IPW_TX_QUEUE_1_BD_SIZE);
4726         if (rc) {
4727                 IPW_ERROR("Tx 1 queue init failed\n");
4728                 goto error;
4729         }
4730         rc = ipw_queue_tx_init(priv, &priv->txq[2], nTx,
4731                                IPW_TX_QUEUE_2_READ_INDEX,
4732                                IPW_TX_QUEUE_2_WRITE_INDEX,
4733                                IPW_TX_QUEUE_2_BD_BASE, IPW_TX_QUEUE_2_BD_SIZE);
4734         if (rc) {
4735                 IPW_ERROR("Tx 2 queue init failed\n");
4736                 goto error;
4737         }
4738         rc = ipw_queue_tx_init(priv, &priv->txq[3], nTx,
4739                                IPW_TX_QUEUE_3_READ_INDEX,
4740                                IPW_TX_QUEUE_3_WRITE_INDEX,
4741                                IPW_TX_QUEUE_3_BD_BASE, IPW_TX_QUEUE_3_BD_SIZE);
4742         if (rc) {
4743                 IPW_ERROR("Tx 3 queue init failed\n");
4744                 goto error;
4745         }
4746         /* statistics */
4747         priv->rx_bufs_min = 0;
4748         priv->rx_pend_max = 0;
4749         return rc;
4750
4751       error:
4752         ipw_tx_queue_free(priv);
4753         return rc;
4754 }
4755
4756 /**
4757  * Reclaim Tx queue entries no more used by NIC.
4758  *
4759  * When FW adwances 'R' index, all entries between old and
4760  * new 'R' index need to be reclaimed. As result, some free space
4761  * forms. If there is enough free space (> low mark), wake Tx queue.
4762  *
4763  * @note Need to protect against garbage in 'R' index
4764  * @param priv
4765  * @param txq
4766  * @param qindex
4767  * @return Number of used entries remains in the queue
4768  */
4769 static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
4770                                 struct clx2_tx_queue *txq, int qindex)
4771 {
4772         u32 hw_tail;
4773         int used;
4774         struct clx2_queue *q = &txq->q;
4775
4776         hw_tail = ipw_read32(priv, q->reg_r);
4777         if (hw_tail >= q->n_bd) {
4778                 IPW_ERROR
4779                     ("Read index for DMA queue (%d) is out of range [0-%d)\n",
4780                      hw_tail, q->n_bd);
4781                 goto done;
4782         }
4783         for (; q->last_used != hw_tail;
4784              q->last_used = ipw_queue_inc_wrap(q->last_used, q->n_bd)) {
4785                 ipw_queue_tx_free_tfd(priv, txq);
4786                 priv->tx_packets++;
4787         }
4788       done:
4789         if ((ipw_queue_space(q) > q->low_mark) &&
4790             (qindex >= 0) &&
4791             (priv->status & STATUS_ASSOCIATED) && netif_running(priv->net_dev))
4792                 netif_wake_queue(priv->net_dev);
4793         used = q->first_empty - q->last_used;
4794         if (used < 0)
4795                 used += q->n_bd;
4796
4797         return used;
4798 }
4799
4800 static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
4801                              int len, int sync)
4802 {
4803         struct clx2_tx_queue *txq = &priv->txq_cmd;
4804         struct clx2_queue *q = &txq->q;
4805         struct tfd_frame *tfd;
4806
4807         if (ipw_queue_space(q) < (sync ? 1 : 2)) {
4808                 IPW_ERROR("No space for Tx\n");
4809                 return -EBUSY;
4810         }
4811
4812         tfd = &txq->bd[q->first_empty];
4813         txq->txb[q->first_empty] = NULL;
4814
4815         memset(tfd, 0, sizeof(*tfd));
4816         tfd->control_flags.message_type = TX_HOST_COMMAND_TYPE;
4817         tfd->control_flags.control_bits = TFD_NEED_IRQ_MASK;
4818         priv->hcmd_seq++;
4819         tfd->u.cmd.index = hcmd;
4820         tfd->u.cmd.length = len;
4821         memcpy(tfd->u.cmd.payload, buf, len);
4822         q->first_empty = ipw_queue_inc_wrap(q->first_empty, q->n_bd);
4823         ipw_write32(priv, q->reg_w, q->first_empty);
4824         _ipw_read32(priv, 0x90);
4825
4826         return 0;
4827 }
4828
4829 /*
4830  * Rx theory of operation
4831  *
4832  * The host allocates 32 DMA target addresses and passes the host address
4833  * to the firmware at register IPW_RFDS_TABLE_LOWER + N * RFD_SIZE where N is
4834  * 0 to 31
4835  *
4836  * Rx Queue Indexes
4837  * The host/firmware share two index registers for managing the Rx buffers.
4838  *
4839  * The READ index maps to the first position that the firmware may be writing
4840  * to -- the driver can read up to (but not including) this position and get
4841  * good data.
4842  * The READ index is managed by the firmware once the card is enabled.
4843  *
4844  * The WRITE index maps to the last position the driver has read from -- the
4845  * position preceding WRITE is the last slot the firmware can place a packet.
4846  *
4847  * The queue is empty (no good data) if WRITE = READ - 1, and is full if
4848  * WRITE = READ.
4849  *
4850  * During initialization the host sets up the READ queue position to the first
4851  * INDEX position, and WRITE to the last (READ - 1 wrapped)
4852  *
4853  * When the firmware places a packet in a buffer it will advance the READ index
4854  * and fire the RX interrupt.  The driver can then query the READ index and
4855  * process as many packets as possible, moving the WRITE index forward as it
4856  * resets the Rx queue buffers with new memory.
4857  *
4858  * The management in the driver is as follows:
4859  * + A list of pre-allocated SKBs is stored in ipw->rxq->rx_free.  When
4860  *   ipw->rxq->free_count drops to or below RX_LOW_WATERMARK, work is scheduled
4861  *   to replensish the ipw->rxq->rx_free.
4862  * + In ipw_rx_queue_replenish (scheduled) if 'processed' != 'read' then the
4863  *   ipw->rxq is replenished and the READ INDEX is updated (updating the
4864  *   'processed' and 'read' driver indexes as well)
4865  * + A received packet is processed and handed to the kernel network stack,
4866  *   detached from the ipw->rxq.  The driver 'processed' index is updated.
4867  * + The Host/Firmware ipw->rxq is replenished at tasklet time from the rx_free
4868  *   list. If there are no allocated buffers in ipw->rxq->rx_free, the READ
4869  *   INDEX is not incremented and ipw->status(RX_STALLED) is set.  If there
4870  *   were enough free buffers and RX_STALLED is set it is cleared.
4871  *
4872  *
4873  * Driver sequence:
4874  *
4875  * ipw_rx_queue_alloc()       Allocates rx_free
4876  * ipw_rx_queue_replenish()   Replenishes rx_free list from rx_used, and calls
4877  *                            ipw_rx_queue_restock
4878  * ipw_rx_queue_restock()     Moves available buffers from rx_free into Rx
4879  *                            queue, updates firmware pointers, and updates
4880  *                            the WRITE index.  If insufficient rx_free buffers
4881  *                            are available, schedules ipw_rx_queue_replenish
4882  *
4883  * -- enable interrupts --
4884  * ISR - ipw_rx()             Detach ipw_rx_mem_buffers from pool up to the
4885  *                            READ INDEX, detaching the SKB from the pool.
4886  *                            Moves the packet buffer from queue to rx_used.
4887  *                            Calls ipw_rx_queue_restock to refill any empty
4888  *                            slots.
4889  * ...
4890  *
4891  */
4892
4893 /*
4894  * If there are slots in the RX queue that  need to be restocked,
4895  * and we have free pre-allocated buffers, fill the ranks as much
4896  * as we can pulling from rx_free.
4897  *
4898  * This moves the 'write' index forward to catch up with 'processed', and
4899  * also updates the memory address in the firmware to reference the new
4900  * target buffer.
4901  */
4902 static void ipw_rx_queue_restock(struct ipw_priv *priv)
4903 {
4904         struct ipw_rx_queue *rxq = priv->rxq;
4905         struct list_head *element;
4906         struct ipw_rx_mem_buffer *rxb;
4907         unsigned long flags;
4908         int write;
4909
4910         spin_lock_irqsave(&rxq->lock, flags);
4911         write = rxq->write;
4912         while ((rxq->write != rxq->processed) && (rxq->free_count)) {
4913                 element = rxq->rx_free.next;
4914                 rxb = list_entry(element, struct ipw_rx_mem_buffer, list);
4915                 list_del(element);
4916
4917                 ipw_write32(priv, IPW_RFDS_TABLE_LOWER + rxq->write * RFD_SIZE,
4918                             rxb->dma_addr);
4919                 rxq->queue[rxq->write] = rxb;
4920                 rxq->write = (rxq->write + 1) % RX_QUEUE_SIZE;
4921                 rxq->free_count--;
4922         }
4923         spin_unlock_irqrestore(&rxq->lock, flags);
4924
4925         /* If the pre-allocated buffer pool is dropping low, schedule to
4926          * refill it */
4927         if (rxq->free_count <= RX_LOW_WATERMARK)
4928                 queue_work(priv->workqueue, &priv->rx_replenish);
4929
4930         /* If we've added more space for the firmware to place data, tell it */
4931         if (write != rxq->write)
4932                 ipw_write32(priv, IPW_RX_WRITE_INDEX, rxq->write);
4933 }
4934
4935 /*
4936  * Move all used packet from rx_used to rx_free, allocating a new SKB for each.
4937  * Also restock the Rx queue via ipw_rx_queue_restock.
4938  *
4939  * This is called as a scheduled work item (except for during intialization)
4940  */
4941 static void ipw_rx_queue_replenish(void *data)
4942 {
4943         struct ipw_priv *priv = data;
4944         struct ipw_rx_queue *rxq = priv->rxq;
4945         struct list_head *element;
4946         struct ipw_rx_mem_buffer *rxb;
4947         unsigned long flags;
4948
4949         spin_lock_irqsave(&rxq->lock, flags);
4950         while (!list_empty(&rxq->rx_used)) {
4951                 element = rxq->rx_used.next;
4952                 rxb = list_entry(element, struct ipw_rx_mem_buffer, list);
4953                 rxb->skb = alloc_skb(IPW_RX_BUF_SIZE, GFP_ATOMIC);
4954                 if (!rxb->skb) {
4955                         printk(KERN_CRIT "%s: Can not allocate SKB buffers.\n",
4956                                priv->net_dev->name);
4957                         /* We don't reschedule replenish work here -- we will
4958                          * call the restock method and if it still needs
4959                          * more buffers it will schedule replenish */
4960                         break;
4961                 }
4962                 list_del(element);
4963
4964                 rxb->rxb = (struct ipw_rx_buffer *)rxb->skb->data;
4965                 rxb->dma_addr =
4966                     pci_map_single(priv->pci_dev, rxb->skb->data,
4967                                    IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
4968
4969                 list_add_tail(&rxb->list, &rxq->rx_free);
4970                 rxq->free_count++;
4971         }
4972         spin_unlock_irqrestore(&rxq->lock, flags);
4973
4974         ipw_rx_queue_restock(priv);
4975 }
4976
4977 static void ipw_bg_rx_queue_replenish(void *data)
4978 {
4979         struct ipw_priv *priv = data;
4980         down(&priv->sem);
4981         ipw_rx_queue_replenish(data);
4982         up(&priv->sem);
4983 }
4984
4985 /* Assumes that the skb field of the buffers in 'pool' is kept accurate.
4986  * If an SKB has been detached, the POOL needs to have its SKB set to NULL
4987  * This free routine walks the list of POOL entries and if SKB is set to
4988  * non NULL it is unmapped and freed
4989  */
4990 static void ipw_rx_queue_free(struct ipw_priv *priv, struct ipw_rx_queue *rxq)
4991 {
4992         int i;
4993
4994         if (!rxq)
4995                 return;
4996
4997         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
4998                 if (rxq->pool[i].skb != NULL) {
4999                         pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
5000                                          IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
5001                         dev_kfree_skb(rxq->pool[i].skb);
5002                 }
5003         }
5004
5005         kfree(rxq);
5006 }
5007
5008 static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *priv)
5009 {
5010         struct ipw_rx_queue *rxq;
5011         int i;
5012
5013         rxq = kzalloc(sizeof(*rxq), GFP_KERNEL);
5014         if (unlikely(!rxq)) {
5015                 IPW_ERROR("memory allocation failed\n");
5016                 return NULL;
5017         }
5018         spin_lock_init(&rxq->lock);
5019         INIT_LIST_HEAD(&rxq->rx_free);
5020         INIT_LIST_HEAD(&rxq->rx_used);
5021
5022         /* Fill the rx_used queue with _all_ of the Rx buffers */
5023         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++)
5024                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
5025
5026         /* Set us so that we have processed and used all buffers, but have
5027          * not restocked the Rx queue with fresh buffers */
5028         rxq->read = rxq->write = 0;
5029         rxq->processed = RX_QUEUE_SIZE - 1;
5030         rxq->free_count = 0;
5031
5032         return rxq;
5033 }
5034
5035 static int ipw_is_rate_in_mask(struct ipw_priv *priv, int ieee_mode, u8 rate)
5036 {
5037         rate &= ~IEEE80211_BASIC_RATE_MASK;
5038         if (ieee_mode == IEEE_A) {
5039                 switch (rate) {
5040                 case IEEE80211_OFDM_RATE_6MB:
5041                         return priv->rates_mask & IEEE80211_OFDM_RATE_6MB_MASK ?
5042                             1 : 0;
5043                 case IEEE80211_OFDM_RATE_9MB:
5044                         return priv->rates_mask & IEEE80211_OFDM_RATE_9MB_MASK ?
5045                             1 : 0;
5046                 case IEEE80211_OFDM_RATE_12MB:
5047                         return priv->
5048                             rates_mask & IEEE80211_OFDM_RATE_12MB_MASK ? 1 : 0;
5049                 case IEEE80211_OFDM_RATE_18MB:
5050                         return priv->
5051                             rates_mask & IEEE80211_OFDM_RATE_18MB_MASK ? 1 : 0;
5052                 case IEEE80211_OFDM_RATE_24MB:
5053                         return priv->
5054                             rates_mask & IEEE80211_OFDM_RATE_24MB_MASK ? 1 : 0;
5055                 case IEEE80211_OFDM_RATE_36MB:
5056                         return priv->
5057                             rates_mask & IEEE80211_OFDM_RATE_36MB_MASK ? 1 : 0;
5058                 case IEEE80211_OFDM_RATE_48MB:
5059                         return priv->
5060                             rates_mask & IEEE80211_OFDM_RATE_48MB_MASK ? 1 : 0;
5061                 case IEEE80211_OFDM_RATE_54MB:
5062                         return priv->
5063                             rates_mask & IEEE80211_OFDM_RATE_54MB_MASK ? 1 : 0;
5064                 default:
5065                         return 0;
5066                 }
5067         }
5068
5069         /* B and G mixed */
5070         switch (rate) {
5071         case IEEE80211_CCK_RATE_1MB:
5072                 return priv->rates_mask & IEEE80211_CCK_RATE_1MB_MASK ? 1 : 0;
5073         case IEEE80211_CCK_RATE_2MB:
5074                 return priv->rates_mask & IEEE80211_CCK_RATE_2MB_MASK ? 1 : 0;
5075         case IEEE80211_CCK_RATE_5MB:
5076                 return priv->rates_mask & IEEE80211_CCK_RATE_5MB_MASK ? 1 : 0;
5077         case IEEE80211_CCK_RATE_11MB:
5078                 return priv->rates_mask & IEEE80211_CCK_RATE_11MB_MASK ? 1 : 0;
5079         }
5080
5081         /* If we are limited to B modulations, bail at this point */
5082         if (ieee_mode == IEEE_B)
5083                 return 0;
5084
5085         /* G */
5086         switch (rate) {
5087         case IEEE80211_OFDM_RATE_6MB:
5088                 return priv->rates_mask & IEEE80211_OFDM_RATE_6MB_MASK ? 1 : 0;
5089         case IEEE80211_OFDM_RATE_9MB:
5090                 return priv->rates_mask & IEEE80211_OFDM_RATE_9MB_MASK ? 1 : 0;
5091         case IEEE80211_OFDM_RATE_12MB:
5092                 return priv->rates_mask & IEEE80211_OFDM_RATE_12MB_MASK ? 1 : 0;
5093         case IEEE80211_OFDM_RATE_18MB:
5094                 return priv->rates_mask & IEEE80211_OFDM_RATE_18MB_MASK ? 1 : 0;
5095         case IEEE80211_OFDM_RATE_24MB:
5096                 return priv->rates_mask & IEEE80211_OFDM_RATE_24MB_MASK ? 1 : 0;
5097         case IEEE80211_OFDM_RATE_36MB:
5098                 return priv->rates_mask & IEEE80211_OFDM_RATE_36MB_MASK ? 1 : 0;
5099         case IEEE80211_OFDM_RATE_48MB:
5100                 return priv->rates_mask & IEEE80211_OFDM_RATE_48MB_MASK ? 1 : 0;
5101         case IEEE80211_OFDM_RATE_54MB:
5102                 return priv->rates_mask & IEEE80211_OFDM_RATE_54MB_MASK ? 1 : 0;
5103         }
5104
5105         return 0;
5106 }
5107
5108 static int ipw_compatible_rates(struct ipw_priv *priv,
5109                                 const struct ieee80211_network *network,
5110                                 struct ipw_supported_rates *rates)
5111 {
5112         int num_rates, i;
5113
5114         memset(rates, 0, sizeof(*rates));
5115         num_rates = min(network->rates_len, (u8) IPW_MAX_RATES);
5116         rates->num_rates = 0;
5117         for (i = 0; i < num_rates; i++) {
5118                 if (!ipw_is_rate_in_mask(priv, network->mode,
5119                                          network->rates[i])) {
5120
5121                         if (network->rates[i] & IEEE80211_BASIC_RATE_MASK) {
5122                                 IPW_DEBUG_SCAN("Adding masked mandatory "
5123                                                "rate %02X\n",
5124                                                network->rates[i]);
5125                                 rates->supported_rates[rates->num_rates++] =
5126                                     network->rates[i];
5127                                 continue;
5128                         }
5129
5130                         IPW_DEBUG_SCAN("Rate %02X masked : 0x%08X\n",
5131                                        network->rates[i], priv->rates_mask);
5132                         continue;
5133                 }
5134
5135                 rates->supported_rates[rates->num_rates++] = network->rates[i];
5136         }
5137
5138         num_rates = min(network->rates_ex_len,
5139                         (u8) (IPW_MAX_RATES - num_rates));
5140         for (i = 0; i < num_rates; i++) {
5141                 if (!ipw_is_rate_in_mask(priv, network->mode,
5142                                          network->rates_ex[i])) {
5143                         if (network->rates_ex[i] & IEEE80211_BASIC_RATE_MASK) {
5144                                 IPW_DEBUG_SCAN("Adding masked mandatory "
5145                                                "rate %02X\n",
5146                                                network->rates_ex[i]);
5147                                 rates->supported_rates[rates->num_rates++] =
5148                                     network->rates[i];
5149                                 continue;
5150                         }
5151
5152                         IPW_DEBUG_SCAN("Rate %02X masked : 0x%08X\n",
5153                                        network->rates_ex[i], priv->rates_mask);
5154                         continue;
5155                 }
5156
5157                 rates->supported_rates[rates->num_rates++] =
5158                     network->rates_ex[i];
5159         }
5160
5161         return 1;
5162 }
5163
5164 static void ipw_copy_rates(struct ipw_supported_rates *dest,
5165                                   const struct ipw_supported_rates *src)
5166 {
5167         u8 i;
5168         for (i = 0; i < src->num_rates; i++)
5169                 dest->supported_rates[i] = src->supported_rates[i];
5170         dest->num_rates = src->num_rates;
5171 }
5172
5173 /* TODO: Look at sniffed packets in the air to determine if the basic rate
5174  * mask should ever be used -- right now all callers to add the scan rates are
5175  * set with the modulation = CCK, so BASIC_RATE_MASK is never set... */
5176 static void ipw_add_cck_scan_rates(struct ipw_supported_rates *rates,
5177                                    u8 modulation, u32 rate_mask)
5178 {
5179         u8 basic_mask = (IEEE80211_OFDM_MODULATION == modulation) ?
5180             IEEE80211_BASIC_RATE_MASK : 0;
5181
5182         if (rate_mask & IEEE80211_CCK_RATE_1MB_MASK)
5183                 rates->supported_rates[rates->num_rates++] =
5184                     IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
5185
5186         if (rate_mask & IEEE80211_CCK_RATE_2MB_MASK)
5187                 rates->supported_rates[rates->num_rates++] =
5188                     IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
5189
5190         if (rate_mask & IEEE80211_CCK_RATE_5MB_MASK)
5191                 rates->supported_rates[rates->num_rates++] = basic_mask |
5192                     IEEE80211_CCK_RATE_5MB;
5193
5194         if (rate_mask & IEEE80211_CCK_RATE_11MB_MASK)
5195                 rates->supported_rates[rates->num_rates++] = basic_mask |
5196                     IEEE80211_CCK_RATE_11MB;
5197 }
5198
5199 static void ipw_add_ofdm_scan_rates(struct ipw_supported_rates *rates,
5200                                     u8 modulation, u32 rate_mask)
5201 {
5202         u8 basic_mask = (IEEE80211_OFDM_MODULATION == modulation) ?
5203             IEEE80211_BASIC_RATE_MASK : 0;
5204
5205         if (rate_mask & IEEE80211_OFDM_RATE_6MB_MASK)
5206                 rates->supported_rates[rates->num_rates++] = basic_mask |
5207                     IEEE80211_OFDM_RATE_6MB;
5208
5209         if (rate_mask & IEEE80211_OFDM_RATE_9MB_MASK)
5210                 rates->supported_rates[rates->num_rates++] =
5211                     IEEE80211_OFDM_RATE_9MB;
5212
5213         if (rate_mask & IEEE80211_OFDM_RATE_12MB_MASK)
5214                 rates->supported_rates[rates->num_rates++] = basic_mask |
5215                     IEEE80211_OFDM_RATE_12MB;
5216
5217         if (rate_mask & IEEE80211_OFDM_RATE_18MB_MASK)
5218                 rates->supported_rates[rates->num_rates++] =
5219                     IEEE80211_OFDM_RATE_18MB;
5220
5221         if (rate_mask & IEEE80211_OFDM_RATE_24MB_MASK)
5222                 rates->supported_rates[rates->num_rates++] = basic_mask |
5223                     IEEE80211_OFDM_RATE_24MB;
5224
5225         if (rate_mask & IEEE80211_OFDM_RATE_36MB_MASK)
5226                 rates->supported_rates[rates->num_rates++] =
5227                     IEEE80211_OFDM_RATE_36MB;
5228
5229         if (rate_mask & IEEE80211_OFDM_RATE_48MB_MASK)
5230                 rates->supported_rates[rates->num_rates++] =
5231                     IEEE80211_OFDM_RATE_48MB;
5232
5233         if (rate_mask & IEEE80211_OFDM_RATE_54MB_MASK)
5234                 rates->supported_rates[rates->num_rates++] =
5235                     IEEE80211_OFDM_RATE_54MB;
5236 }
5237
5238 struct ipw_network_match {
5239         struct ieee80211_network *network;
5240         struct ipw_supported_rates rates;
5241 };
5242
5243 static int ipw_find_adhoc_network(struct ipw_priv *priv,
5244                                   struct ipw_network_match *match,
5245                                   struct ieee80211_network *network,
5246                                   int roaming)
5247 {
5248         struct ipw_supported_rates rates;
5249
5250         /* Verify that this network's capability is compatible with the
5251          * current mode (AdHoc or Infrastructure) */
5252         if ((priv->ieee->iw_mode == IW_MODE_ADHOC &&
5253              !(network->capability & WLAN_CAPABILITY_IBSS))) {
5254                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded due to "
5255                                 "capability mismatch.\n",
5256                                 escape_essid(network->ssid, network->ssid_len),
5257                                 MAC_ARG(network->bssid));
5258                 return 0;
5259         }
5260
5261         /* If we do not have an ESSID for this AP, we can not associate with
5262          * it */
5263         if (network->flags & NETWORK_EMPTY_ESSID) {
5264                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5265                                 "because of hidden ESSID.\n",
5266                                 escape_essid(network->ssid, network->ssid_len),
5267                                 MAC_ARG(network->bssid));
5268                 return 0;
5269         }
5270
5271         if (unlikely(roaming)) {
5272                 /* If we are roaming, then ensure check if this is a valid
5273                  * network to try and roam to */
5274                 if ((network->ssid_len != match->network->ssid_len) ||
5275                     memcmp(network->ssid, match->network->ssid,
5276                            network->ssid_len)) {
5277                         IPW_DEBUG_MERGE("Netowrk '%s (" MAC_FMT ")' excluded "
5278                                         "because of non-network ESSID.\n",
5279                                         escape_essid(network->ssid,
5280                                                      network->ssid_len),
5281                                         MAC_ARG(network->bssid));
5282                         return 0;
5283                 }
5284         } else {
5285                 /* If an ESSID has been configured then compare the broadcast
5286                  * ESSID to ours */
5287                 if ((priv->config & CFG_STATIC_ESSID) &&
5288                     ((network->ssid_len != priv->essid_len) ||
5289                      memcmp(network->ssid, priv->essid,
5290                             min(network->ssid_len, priv->essid_len)))) {
5291                         char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
5292
5293                         strncpy(escaped,
5294                                 escape_essid(network->ssid, network->ssid_len),
5295                                 sizeof(escaped));
5296                         IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5297                                         "because of ESSID mismatch: '%s'.\n",
5298                                         escaped, MAC_ARG(network->bssid),
5299                                         escape_essid(priv->essid,
5300                                                      priv->essid_len));
5301                         return 0;
5302                 }
5303         }
5304
5305         /* If the old network rate is better than this one, don't bother
5306          * testing everything else. */
5307
5308         if (network->time_stamp[0] < match->network->time_stamp[0]) {
5309                 IPW_DEBUG_MERGE("Network '%s excluded because newer than "
5310                                 "current network.\n",
5311                                 escape_essid(match->network->ssid,
5312                                              match->network->ssid_len));
5313                 return 0;
5314         } else if (network->time_stamp[1] < match->network->time_stamp[1]) {
5315                 IPW_DEBUG_MERGE("Network '%s excluded because newer than "
5316                                 "current network.\n",
5317                                 escape_essid(match->network->ssid,
5318                                              match->network->ssid_len));
5319                 return 0;
5320         }
5321
5322         /* Now go through and see if the requested network is valid... */
5323         if (priv->ieee->scan_age != 0 &&
5324             time_after(jiffies, network->last_scanned + priv->ieee->scan_age)) {
5325                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5326                                 "because of age: %ums.\n",
5327                                 escape_essid(network->ssid, network->ssid_len),
5328                                 MAC_ARG(network->bssid),
5329                                 jiffies_to_msecs(jiffies - network->last_scanned));
5330                 return 0;
5331         }
5332
5333         if ((priv->config & CFG_STATIC_CHANNEL) &&
5334             (network->channel != priv->channel)) {
5335                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5336                                 "because of channel mismatch: %d != %d.\n",
5337                                 escape_essid(network->ssid, network->ssid_len),
5338                                 MAC_ARG(network->bssid),
5339                                 network->channel, priv->channel);
5340                 return 0;
5341         }
5342
5343         /* Verify privacy compatability */
5344         if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
5345             ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
5346                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5347                                 "because of privacy mismatch: %s != %s.\n",
5348                                 escape_essid(network->ssid, network->ssid_len),
5349                                 MAC_ARG(network->bssid),
5350                                 priv->
5351                                 capability & CAP_PRIVACY_ON ? "on" : "off",
5352                                 network->
5353                                 capability & WLAN_CAPABILITY_PRIVACY ? "on" :
5354                                 "off");
5355                 return 0;
5356         }
5357
5358         if (!memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
5359                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5360                                 "because of the same BSSID match: " MAC_FMT
5361                                 ".\n", escape_essid(network->ssid,
5362                                                     network->ssid_len),
5363                                 MAC_ARG(network->bssid), MAC_ARG(priv->bssid));
5364                 return 0;
5365         }
5366
5367         /* Filter out any incompatible freq / mode combinations */
5368         if (!ieee80211_is_valid_mode(priv->ieee, network->mode)) {
5369                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5370                                 "because of invalid frequency/mode "
5371                                 "combination.\n",
5372                                 escape_essid(network->ssid, network->ssid_len),
5373                                 MAC_ARG(network->bssid));
5374                 return 0;
5375         }
5376
5377         /* Ensure that the rates supported by the driver are compatible with
5378          * this AP, including verification of basic rates (mandatory) */
5379         if (!ipw_compatible_rates(priv, network, &rates)) {
5380                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5381                                 "because configured rate mask excludes "
5382                                 "AP mandatory rate.\n",
5383                                 escape_essid(network->ssid, network->ssid_len),
5384                                 MAC_ARG(network->bssid));
5385                 return 0;
5386         }
5387
5388         if (rates.num_rates == 0) {
5389                 IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' excluded "
5390                                 "because of no compatible rates.\n",
5391                                 escape_essid(network->ssid, network->ssid_len),
5392                                 MAC_ARG(network->bssid));
5393                 return 0;
5394         }
5395
5396         /* TODO: Perform any further minimal comparititive tests.  We do not
5397          * want to put too much policy logic here; intelligent scan selection
5398          * should occur within a generic IEEE 802.11 user space tool.  */
5399
5400         /* Set up 'new' AP to this network */
5401         ipw_copy_rates(&match->rates, &rates);
5402         match->network = network;
5403         IPW_DEBUG_MERGE("Network '%s (" MAC_FMT ")' is a viable match.\n",
5404                         escape_essid(network->ssid, network->ssid_len),
5405                         MAC_ARG(network->bssid));
5406
5407         return 1;
5408 }
5409
5410 static void ipw_merge_adhoc_network(void *data)
5411 {
5412         struct ipw_priv *priv = data;
5413         struct ieee80211_network *network = NULL;
5414         struct ipw_network_match match = {
5415                 .network = priv->assoc_network
5416         };
5417
5418         if ((priv->status & STATUS_ASSOCIATED) &&
5419             (priv->ieee->iw_mode == IW_MODE_ADHOC)) {
5420                 /* First pass through ROAM process -- look for a better
5421                  * network */
5422                 unsigned long flags;
5423
5424                 spin_lock_irqsave(&priv->ieee->lock, flags);
5425                 list_for_each_entry(network, &priv->ieee->network_list, list) {
5426                         if (network != priv->assoc_network)
5427                                 ipw_find_adhoc_network(priv, &match, network,
5428                                                        1);
5429                 }
5430                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
5431
5432                 if (match.network == priv->assoc_network) {
5433                         IPW_DEBUG_MERGE("No better ADHOC in this network to "
5434                                         "merge to.\n");
5435                         return;
5436                 }
5437
5438                 down(&priv->sem);
5439                 if ((priv->ieee->iw_mode == IW_MODE_ADHOC)) {
5440                         IPW_DEBUG_MERGE("remove network %s\n",
5441                                         escape_essid(priv->essid,
5442                                                      priv->essid_len));
5443                         ipw_remove_current_network(priv);
5444                 }
5445
5446                 ipw_disassociate(priv);
5447                 priv->assoc_network = match.network;
5448                 up(&priv->sem);
5449                 return;
5450         }
5451 }
5452
5453 static int ipw_best_network(struct ipw_priv *priv,
5454                             struct ipw_network_match *match,
5455                             struct ieee80211_network *network, int roaming)
5456 {
5457         struct ipw_supported_rates rates;
5458
5459         /* Verify that this network's capability is compatible with the
5460          * current mode (AdHoc or Infrastructure) */
5461         if ((priv->ieee->iw_mode == IW_MODE_INFRA &&
5462              !(network->capability & WLAN_CAPABILITY_ESS)) ||
5463             (priv->ieee->iw_mode == IW_MODE_ADHOC &&
5464              !(network->capability & WLAN_CAPABILITY_IBSS))) {
5465                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded due to "
5466                                 "capability mismatch.\n",
5467                                 escape_essid(network->ssid, network->ssid_len),
5468                                 MAC_ARG(network->bssid));
5469                 return 0;
5470         }
5471
5472         /* If we do not have an ESSID for this AP, we can not associate with
5473          * it */
5474         if (network->flags & NETWORK_EMPTY_ESSID) {
5475                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5476                                 "because of hidden ESSID.\n",
5477                                 escape_essid(network->ssid, network->ssid_len),
5478                                 MAC_ARG(network->bssid));
5479                 return 0;
5480         }
5481
5482         if (unlikely(roaming)) {
5483                 /* If we are roaming, then ensure check if this is a valid
5484                  * network to try and roam to */
5485                 if ((network->ssid_len != match->network->ssid_len) ||
5486                     memcmp(network->ssid, match->network->ssid,
5487                            network->ssid_len)) {
5488                         IPW_DEBUG_ASSOC("Netowrk '%s (" MAC_FMT ")' excluded "
5489                                         "because of non-network ESSID.\n",
5490                                         escape_essid(network->ssid,
5491                                                      network->ssid_len),
5492                                         MAC_ARG(network->bssid));
5493                         return 0;
5494                 }
5495         } else {
5496                 /* If an ESSID has been configured then compare the broadcast
5497                  * ESSID to ours */
5498                 if ((priv->config & CFG_STATIC_ESSID) &&
5499                     ((network->ssid_len != priv->essid_len) ||
5500                      memcmp(network->ssid, priv->essid,
5501                             min(network->ssid_len, priv->essid_len)))) {
5502                         char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
5503                         strncpy(escaped,
5504                                 escape_essid(network->ssid, network->ssid_len),
5505                                 sizeof(escaped));
5506                         IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5507                                         "because of ESSID mismatch: '%s'.\n",
5508                                         escaped, MAC_ARG(network->bssid),
5509                                         escape_essid(priv->essid,
5510                                                      priv->essid_len));
5511                         return 0;
5512                 }
5513         }
5514
5515         /* If the old network rate is better than this one, don't bother
5516          * testing everything else. */
5517         if (match->network && match->network->stats.rssi > network->stats.rssi) {
5518                 char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
5519                 strncpy(escaped,
5520                         escape_essid(network->ssid, network->ssid_len),
5521                         sizeof(escaped));
5522                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded because "
5523                                 "'%s (" MAC_FMT ")' has a stronger signal.\n",
5524                                 escaped, MAC_ARG(network->bssid),
5525                                 escape_essid(match->network->ssid,
5526                                              match->network->ssid_len),
5527                                 MAC_ARG(match->network->bssid));
5528                 return 0;
5529         }
5530
5531         /* If this network has already had an association attempt within the
5532          * last 3 seconds, do not try and associate again... */
5533         if (network->last_associate &&
5534             time_after(network->last_associate + (HZ * 3UL), jiffies)) {
5535                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5536                                 "because of storming (%ums since last "
5537                                 "assoc attempt).\n",
5538                                 escape_essid(network->ssid, network->ssid_len),
5539                                 MAC_ARG(network->bssid),
5540                                 jiffies_to_msecs(jiffies - network->last_associate));
5541                 return 0;
5542         }
5543
5544         /* Now go through and see if the requested network is valid... */
5545         if (priv->ieee->scan_age != 0 &&
5546             time_after(jiffies, network->last_scanned + priv->ieee->scan_age)) {
5547                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5548                                 "because of age: %ums.\n",
5549                                 escape_essid(network->ssid, network->ssid_len),
5550                                 MAC_ARG(network->bssid),
5551                                 jiffies_to_msecs(jiffies - network->last_scanned));
5552                 return 0;
5553         }
5554
5555         if ((priv->config & CFG_STATIC_CHANNEL) &&
5556             (network->channel != priv->channel)) {
5557                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5558                                 "because of channel mismatch: %d != %d.\n",
5559                                 escape_essid(network->ssid, network->ssid_len),
5560                                 MAC_ARG(network->bssid),
5561                                 network->channel, priv->channel);
5562                 return 0;
5563         }
5564
5565         /* Verify privacy compatability */
5566         if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
5567             ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
5568                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5569                                 "because of privacy mismatch: %s != %s.\n",
5570                                 escape_essid(network->ssid, network->ssid_len),
5571                                 MAC_ARG(network->bssid),
5572                                 priv->capability & CAP_PRIVACY_ON ? "on" :
5573                                 "off",
5574                                 network->capability &
5575                                 WLAN_CAPABILITY_PRIVACY ? "on" : "off");
5576                 return 0;
5577         }
5578
5579         if (!priv->ieee->wpa_enabled && (network->wpa_ie_len > 0 ||
5580                                          network->rsn_ie_len > 0)) {
5581                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5582                                 "because of WPA capability mismatch.\n",
5583                                 escape_essid(network->ssid, network->ssid_len),
5584                                 MAC_ARG(network->bssid));
5585                 return 0;
5586         }
5587
5588         if ((priv->config & CFG_STATIC_BSSID) &&
5589             memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
5590                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5591                                 "because of BSSID mismatch: " MAC_FMT ".\n",
5592                                 escape_essid(network->ssid, network->ssid_len),
5593                                 MAC_ARG(network->bssid), MAC_ARG(priv->bssid));
5594                 return 0;
5595         }
5596
5597         /* Filter out any incompatible freq / mode combinations */
5598         if (!ieee80211_is_valid_mode(priv->ieee, network->mode)) {
5599                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5600                                 "because of invalid frequency/mode "
5601                                 "combination.\n",
5602                                 escape_essid(network->ssid, network->ssid_len),
5603                                 MAC_ARG(network->bssid));
5604                 return 0;
5605         }
5606
5607         /* Filter out invalid channel in current GEO */
5608         if (!ipw_is_valid_channel(priv->ieee, network->channel)) {
5609                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5610                                 "because of invalid channel in current GEO\n",
5611                                 escape_essid(network->ssid, network->ssid_len),
5612                                 MAC_ARG(network->bssid));
5613                 return 0;
5614         }
5615
5616         /* Ensure that the rates supported by the driver are compatible with
5617          * this AP, including verification of basic rates (mandatory) */
5618         if (!ipw_compatible_rates(priv, network, &rates)) {
5619                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5620                                 "because configured rate mask excludes "
5621                                 "AP mandatory rate.\n",
5622                                 escape_essid(network->ssid, network->ssid_len),
5623                                 MAC_ARG(network->bssid));
5624                 return 0;
5625         }
5626
5627         if (rates.num_rates == 0) {
5628                 IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
5629                                 "because of no compatible rates.\n",
5630                                 escape_essid(network->ssid, network->ssid_len),
5631                                 MAC_ARG(network->bssid));
5632                 return 0;
5633         }
5634
5635         /* TODO: Perform any further minimal comparititive tests.  We do not
5636          * want to put too much policy logic here; intelligent scan selection
5637          * should occur within a generic IEEE 802.11 user space tool.  */
5638
5639         /* Set up 'new' AP to this network */
5640         ipw_copy_rates(&match->rates, &rates);
5641         match->network = network;
5642
5643         IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' is a viable match.\n",
5644                         escape_essid(network->ssid, network->ssid_len),
5645                         MAC_ARG(network->bssid));
5646
5647         return 1;
5648 }
5649
5650 static void ipw_adhoc_create(struct ipw_priv *priv,
5651                              struct ieee80211_network *network)
5652 {
5653         const struct ieee80211_geo *geo = ipw_get_geo(priv->ieee);
5654         int i;
5655
5656         /*
5657          * For the purposes of scanning, we can set our wireless mode
5658          * to trigger scans across combinations of bands, but when it
5659          * comes to creating a new ad-hoc network, we have tell the FW
5660          * exactly which band to use.
5661          *
5662          * We also have the possibility of an invalid channel for the
5663          * chossen band.  Attempting to create a new ad-hoc network
5664          * with an invalid channel for wireless mode will trigger a
5665          * FW fatal error.
5666          *
5667          */
5668         switch (ipw_is_valid_channel(priv->ieee, priv->channel)) {
5669         case IEEE80211_52GHZ_BAND:
5670                 network->mode = IEEE_A;
5671                 i = ipw_channel_to_index(priv->ieee, priv->channel);
5672                 if (i == -1)
5673                         BUG();
5674                 if (geo->a[i].flags & IEEE80211_CH_PASSIVE_ONLY) {
5675                         IPW_WARNING("Overriding invalid channel\n");
5676                         priv->channel = geo->a[0].channel;
5677                 }
5678                 break;
5679
5680         case IEEE80211_24GHZ_BAND:
5681                 if (priv->ieee->mode & IEEE_G)
5682                         network->mode = IEEE_G;
5683                 else
5684                         network->mode = IEEE_B;
5685                 i = ipw_channel_to_index(priv->ieee, priv->channel);
5686                 if (i == -1)
5687                         BUG();
5688                 if (geo->bg[i].flags & IEEE80211_CH_PASSIVE_ONLY) {
5689                         IPW_WARNING("Overriding invalid channel\n");
5690                         priv->channel = geo->bg[0].channel;
5691                 }
5692                 break;
5693
5694         default:
5695                 IPW_WARNING("Overriding invalid channel\n");
5696                 if (priv->ieee->mode & IEEE_A) {
5697                         network->mode = IEEE_A;
5698                         priv->channel = geo->a[0].channel;
5699                 } else if (priv->ieee->mode & IEEE_G) {
5700                         network->mode = IEEE_G;
5701                         priv->channel = geo->bg[0].channel;
5702                 } else {
5703                         network->mode = IEEE_B;
5704                         priv->channel = geo->bg[0].channel;
5705                 }
5706                 break;
5707         }
5708
5709         network->channel = priv->channel;
5710         priv->config |= CFG_ADHOC_PERSIST;
5711         ipw_create_bssid(priv, network->bssid);
5712         network->ssid_len = priv->essid_len;
5713         memcpy(network->ssid, priv->essid, priv->essid_len);
5714         memset(&network->stats, 0, sizeof(network->stats));
5715         network->capability = WLAN_CAPABILITY_IBSS;
5716         if (!(priv->config & CFG_PREAMBLE_LONG))
5717                 network->capability |= WLAN_CAPABILITY_SHORT_PREAMBLE;
5718         if (priv->capability & CAP_PRIVACY_ON)
5719                 network->capability |= WLAN_CAPABILITY_PRIVACY;
5720         network->rates_len = min(priv->rates.num_rates, MAX_RATES_LENGTH);
5721         memcpy(network->rates, priv->rates.supported_rates, network->rates_len);
5722         network->rates_ex_len = priv->rates.num_rates - network->rates_len;
5723         memcpy(network->rates_ex,
5724                &priv->rates.supported_rates[network->rates_len],
5725                network->rates_ex_len);
5726         network->last_scanned = 0;
5727         network->flags = 0;
5728         network->last_associate = 0;
5729         network->time_stamp[0] = 0;
5730         network->time_stamp[1] = 0;
5731         network->beacon_interval = 100; /* Default */
5732         network->listen_interval = 10;  /* Default */
5733         network->atim_window = 0;       /* Default */
5734         network->wpa_ie_len = 0;
5735         network->rsn_ie_len = 0;
5736 }
5737
5738 static void ipw_send_tgi_tx_key(struct ipw_priv *priv, int type, int index)
5739 {
5740         struct ipw_tgi_tx_key *key;
5741         struct host_cmd cmd = {
5742                 .cmd = IPW_CMD_TGI_TX_KEY,
5743                 .len = sizeof(*key)
5744         };
5745
5746         if (!(priv->ieee->sec.flags & (1 << index)))
5747                 return;
5748
5749         key = (struct ipw_tgi_tx_key *)&cmd.param;
5750         key->key_id = index;
5751         memcpy(key->key, priv->ieee->sec.keys[index], SCM_TEMPORAL_KEY_LENGTH);
5752         key->security_type = type;
5753         key->station_index = 0; /* always 0 for BSS */
5754         key->flags = 0;
5755         /* 0 for new key; previous value of counter (after fatal error) */
5756         key->tx_counter[0] = 0;
5757         key->tx_counter[1] = 0;
5758
5759         ipw_send_cmd(priv, &cmd);
5760 }
5761
5762 static void ipw_send_wep_keys(struct ipw_priv *priv, int type)
5763 {
5764         struct ipw_wep_key *key;
5765         int i;
5766         struct host_cmd cmd = {
5767                 .cmd = IPW_CMD_WEP_KEY,
5768                 .len = sizeof(*key)
5769         };
5770
5771         key = (struct ipw_wep_key *)&cmd.param;
5772         key->cmd_id = DINO_CMD_WEP_KEY;
5773         key->seq_num = 0;
5774
5775         /* Note: AES keys cannot be set for multiple times.
5776          * Only set it at the first time. */
5777         for (i = 0; i < 4; i++) {
5778                 key->key_index = i | type;
5779                 if (!(priv->ieee->sec.flags & (1 << i))) {
5780                         key->key_size = 0;
5781                         continue;
5782                 }
5783
5784                 key->key_size = priv->ieee->sec.key_sizes[i];
5785                 memcpy(key->key, priv->ieee->sec.keys[i], key->key_size);
5786
5787                 ipw_send_cmd(priv, &cmd);
5788         }
5789 }
5790
5791 static void ipw_set_hw_decrypt_unicast(struct ipw_priv *priv, int level)
5792 {
5793         if (priv->ieee->host_encrypt)
5794                 return;
5795
5796         switch (level) {
5797         case SEC_LEVEL_3:
5798                 priv->sys_config.disable_unicast_decryption = 0;
5799                 priv->ieee->host_decrypt = 0;
5800                 break;
5801         case SEC_LEVEL_2:
5802                 priv->sys_config.disable_unicast_decryption = 1;
5803                 priv->ieee->host_decrypt = 1;
5804                 break;
5805         case SEC_LEVEL_1:
5806                 priv->sys_config.disable_unicast_decryption = 0;
5807                 priv->ieee->host_decrypt = 0;
5808                 break;
5809         case SEC_LEVEL_0:
5810                 priv->sys_config.disable_unicast_decryption = 1;
5811                 break;
5812         default:
5813                 break;
5814         }
5815 }
5816
5817 static void ipw_set_hw_decrypt_multicast(struct ipw_priv *priv, int level)
5818 {
5819         if (priv->ieee->host_encrypt)
5820                 return;
5821
5822         switch (level) {
5823         case SEC_LEVEL_3:
5824                 priv->sys_config.disable_multicast_decryption = 0;
5825                 break;
5826         case SEC_LEVEL_2:
5827                 priv->sys_config.disable_multicast_decryption = 1;
5828                 break;
5829         case SEC_LEVEL_1:
5830                 priv->sys_config.disable_multicast_decryption = 0;
5831                 break;
5832         case SEC_LEVEL_0:
5833                 priv->sys_config.disable_multicast_decryption = 1;
5834                 break;
5835         default:
5836                 break;
5837         }
5838 }
5839
5840 static void ipw_set_hwcrypto_keys(struct ipw_priv *priv)
5841 {
5842         switch (priv->ieee->sec.level) {
5843         case SEC_LEVEL_3:
5844                 if (priv->ieee->sec.flags & SEC_ACTIVE_KEY)
5845                         ipw_send_tgi_tx_key(priv,
5846                                             DCT_FLAG_EXT_SECURITY_CCM,
5847                                             priv->ieee->sec.active_key);
5848
5849                 if (!priv->ieee->host_mc_decrypt)
5850                         ipw_send_wep_keys(priv, DCW_WEP_KEY_SEC_TYPE_CCM);
5851                 break;
5852         case SEC_LEVEL_2:
5853                 if (priv->ieee->sec.flags & SEC_ACTIVE_KEY)
5854                         ipw_send_tgi_tx_key(priv,
5855                                             DCT_FLAG_EXT_SECURITY_TKIP,
5856                                             priv->ieee->sec.active_key);
5857                 break;
5858         case SEC_LEVEL_1:
5859                 ipw_send_wep_keys(priv, DCW_WEP_KEY_SEC_TYPE_WEP);
5860                 ipw_set_hw_decrypt_unicast(priv, priv->ieee->sec.level);
5861                 ipw_set_hw_decrypt_multicast(priv, priv->ieee->sec.level);
5862                 break;
5863         case SEC_LEVEL_0:
5864         default:
5865                 break;
5866         }
5867 }
5868
5869 static void ipw_adhoc_check(void *data)
5870 {
5871         struct ipw_priv *priv = data;
5872
5873         if (priv->missed_adhoc_beacons++ > priv->disassociate_threshold &&
5874             !(priv->config & CFG_ADHOC_PERSIST)) {
5875                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
5876                           IPW_DL_STATE | IPW_DL_ASSOC,
5877                           "Missed beacon: %d - disassociate\n",
5878                           priv->missed_adhoc_beacons);
5879                 ipw_remove_current_network(priv);
5880                 ipw_disassociate(priv);
5881                 return;
5882         }
5883
5884         queue_delayed_work(priv->workqueue, &priv->adhoc_check,
5885                            priv->assoc_request.beacon_interval);
5886 }
5887
5888 static void ipw_bg_adhoc_check(void *data)
5889 {
5890         struct ipw_priv *priv = data;
5891         down(&priv->sem);
5892         ipw_adhoc_check(data);
5893         up(&priv->sem);
5894 }
5895
5896 #ifdef CONFIG_IPW2200_DEBUG
5897 static void ipw_debug_config(struct ipw_priv *priv)
5898 {
5899         IPW_DEBUG_INFO("Scan completed, no valid APs matched "
5900                        "[CFG 0x%08X]\n", priv->config);
5901         if (priv->config & CFG_STATIC_CHANNEL)
5902                 IPW_DEBUG_INFO("Channel locked to %d\n", priv->channel);
5903         else
5904                 IPW_DEBUG_INFO("Channel unlocked.\n");
5905         if (priv->config & CFG_STATIC_ESSID)
5906                 IPW_DEBUG_INFO("ESSID locked to '%s'\n",
5907                                escape_essid(priv->essid, priv->essid_len));
5908         else
5909                 IPW_DEBUG_INFO("ESSID unlocked.\n");
5910         if (priv->config & CFG_STATIC_BSSID)
5911                 IPW_DEBUG_INFO("BSSID locked to " MAC_FMT "\n",
5912                                MAC_ARG(priv->bssid));
5913         else
5914                 IPW_DEBUG_INFO("BSSID unlocked.\n");
5915         if (priv->capability & CAP_PRIVACY_ON)
5916                 IPW_DEBUG_INFO("PRIVACY on\n");
5917         else
5918                 IPW_DEBUG_INFO("PRIVACY off\n");
5919         IPW_DEBUG_INFO("RATE MASK: 0x%08X\n", priv->rates_mask);
5920 }
5921 #else
5922 #define ipw_debug_config(x) do {} while (0)
5923 #endif
5924
5925 static void ipw_set_fixed_rate(struct ipw_priv *priv, int mode)
5926 {
5927         /* TODO: Verify that this works... */
5928         struct ipw_fixed_rate fr = {
5929                 .tx_rates = priv->rates_mask
5930         };
5931         u32 reg;
5932         u16 mask = 0;
5933
5934         /* Identify 'current FW band' and match it with the fixed
5935          * Tx rates */
5936
5937         switch (priv->ieee->freq_band) {
5938         case IEEE80211_52GHZ_BAND:      /* A only */
5939                 /* IEEE_A */
5940                 if (priv->rates_mask & ~IEEE80211_OFDM_RATES_MASK) {
5941                         /* Invalid fixed rate mask */
5942                         IPW_DEBUG_WX
5943                             ("invalid fixed rate mask in ipw_set_fixed_rate\n");
5944                         fr.tx_rates = 0;
5945                         break;
5946                 }
5947
5948                 fr.tx_rates >>= IEEE80211_OFDM_SHIFT_MASK_A;
5949                 break;
5950
5951         default:                /* 2.4Ghz or Mixed */
5952                 /* IEEE_B */
5953                 if (mode == IEEE_B) {
5954                         if (fr.tx_rates & ~IEEE80211_CCK_RATES_MASK) {
5955                                 /* Invalid fixed rate mask */
5956                                 IPW_DEBUG_WX
5957                                     ("invalid fixed rate mask in ipw_set_fixed_rate\n");
5958                                 fr.tx_rates = 0;
5959                         }
5960                         break;
5961                 }
5962
5963                 /* IEEE_G */
5964                 if (fr.tx_rates & ~(IEEE80211_CCK_RATES_MASK |
5965                                     IEEE80211_OFDM_RATES_MASK)) {
5966                         /* Invalid fixed rate mask */
5967                         IPW_DEBUG_WX
5968                             ("invalid fixed rate mask in ipw_set_fixed_rate\n");
5969                         fr.tx_rates = 0;
5970                         break;
5971                 }
5972
5973                 if (IEEE80211_OFDM_RATE_6MB_MASK & fr.tx_rates) {
5974                         mask |= (IEEE80211_OFDM_RATE_6MB_MASK >> 1);
5975                         fr.tx_rates &= ~IEEE80211_OFDM_RATE_6MB_MASK;
5976                 }
5977
5978                 if (IEEE80211_OFDM_RATE_9MB_MASK & fr.tx_rates) {
5979                         mask |= (IEEE80211_OFDM_RATE_9MB_MASK >> 1);
5980                         fr.tx_rates &= ~IEEE80211_OFDM_RATE_9MB_MASK;
5981                 }
5982
5983                 if (IEEE80211_OFDM_RATE_12MB_MASK & fr.tx_rates) {
5984                         mask |= (IEEE80211_OFDM_RATE_12MB_MASK >> 1);
5985                         fr.tx_rates &= ~IEEE80211_OFDM_RATE_12MB_MASK;
5986                 }
5987
5988                 fr.tx_rates |= mask;
5989                 break;
5990         }
5991
5992         reg = ipw_read32(priv, IPW_MEM_FIXED_OVERRIDE);
5993         ipw_write_reg32(priv, reg, *(u32 *) & fr);
5994 }
5995
5996 static void ipw_abort_scan(struct ipw_priv *priv)
5997 {
5998         int err;
5999
6000         if (priv->status & STATUS_SCAN_ABORTING) {
6001                 IPW_DEBUG_HC("Ignoring concurrent scan abort request.\n");
6002                 return;
6003         }
6004         priv->status |= STATUS_SCAN_ABORTING;
6005
6006         err = ipw_send_scan_abort(priv);
6007         if (err)
6008                 IPW_DEBUG_HC("Request to abort scan failed.\n");
6009 }
6010
6011 static void ipw_add_scan_channels(struct ipw_priv *priv,
6012                                   struct ipw_scan_request_ext *scan,
6013                                   int scan_type)
6014 {
6015         int channel_index = 0;
6016         const struct ieee80211_geo *geo;
6017         int i;
6018
6019         geo = ipw_get_geo(priv->ieee);
6020
6021         if (priv->ieee->freq_band & IEEE80211_52GHZ_BAND) {
6022                 int start = channel_index;
6023                 for (i = 0; i < geo->a_channels; i++) {
6024                         if ((priv->status & STATUS_ASSOCIATED) &&
6025                             geo->a[i].channel == priv->channel)
6026                                 continue;
6027                         channel_index++;
6028                         scan->channels_list[channel_index] = geo->a[i].channel;
6029                         ipw_set_scan_type(scan, channel_index,
6030                                           geo->a[i].
6031                                           flags & IEEE80211_CH_PASSIVE_ONLY ?
6032                                           IPW_SCAN_PASSIVE_FULL_DWELL_SCAN :
6033                                           scan_type);
6034                 }
6035
6036                 if (start != channel_index) {
6037                         scan->channels_list[start] = (u8) (IPW_A_MODE << 6) |
6038                             (channel_index - start);
6039                         channel_index++;
6040                 }
6041         }
6042
6043         if (priv->ieee->freq_band & IEEE80211_24GHZ_BAND) {
6044                 int start = channel_index;
6045                 if (priv->config & CFG_SPEED_SCAN) {
6046                         int index;
6047                         u8 channels[IEEE80211_24GHZ_CHANNELS] = {
6048                                 /* nop out the list */
6049                                 [0] = 0
6050                         };
6051
6052                         u8 channel;
6053                         while (channel_index < IPW_SCAN_CHANNELS) {
6054                                 channel =
6055                                     priv->speed_scan[priv->speed_scan_pos];
6056                                 if (channel == 0) {
6057                                         priv->speed_scan_pos = 0;
6058                                         channel = priv->speed_scan[0];
6059                                 }
6060                                 if ((priv->status & STATUS_ASSOCIATED) &&
6061                                     channel == priv->channel) {
6062                                         priv->speed_scan_pos++;
6063                                         continue;
6064                                 }
6065
6066                                 /* If this channel has already been
6067                                  * added in scan, break from loop
6068                                  * and this will be the first channel
6069                                  * in the next scan.
6070                                  */
6071                                 if (channels[channel - 1] != 0)
6072                                         break;
6073
6074                                 channels[channel - 1] = 1;
6075                                 priv->speed_scan_pos++;
6076                                 channel_index++;
6077                                 scan->channels_list[channel_index] = channel;
6078                                 index =
6079                                     ipw_channel_to_index(priv->ieee, channel);
6080                                 ipw_set_scan_type(scan, channel_index,
6081                                                   geo->bg[index].
6082                                                   flags &
6083                                                   IEEE80211_CH_PASSIVE_ONLY ?
6084                                                   IPW_SCAN_PASSIVE_FULL_DWELL_SCAN
6085                                                   : scan_type);
6086                         }
6087                 } else {
6088                         for (i = 0; i < geo->bg_channels; i++) {
6089                                 if ((priv->status & STATUS_ASSOCIATED) &&
6090                                     geo->bg[i].channel == priv->channel)
6091                                         continue;
6092                                 channel_index++;
6093                                 scan->channels_list[channel_index] =
6094                                     geo->bg[i].channel;
6095                                 ipw_set_scan_type(scan, channel_index,
6096                                                   geo->bg[i].
6097                                                   flags &
6098                                                   IEEE80211_CH_PASSIVE_ONLY ?
6099                                                   IPW_SCAN_PASSIVE_FULL_DWELL_SCAN
6100                                                   : scan_type);
6101                         }
6102                 }
6103
6104                 if (start != channel_index) {
6105                         scan->channels_list[start] = (u8) (IPW_B_MODE << 6) |
6106                             (channel_index - start);
6107                 }
6108         }
6109 }
6110
6111 static int ipw_request_scan(struct ipw_priv *priv)
6112 {
6113         struct ipw_scan_request_ext scan;
6114         int err = 0, scan_type;
6115
6116         if (!(priv->status & STATUS_INIT) ||
6117             (priv->status & STATUS_EXIT_PENDING))
6118                 return 0;
6119
6120         down(&priv->sem);
6121
6122         if (priv->status & STATUS_SCANNING) {
6123                 IPW_DEBUG_HC("Concurrent scan requested.  Ignoring.\n");
6124                 priv->status |= STATUS_SCAN_PENDING;
6125                 goto done;
6126         }
6127
6128         if (!(priv->status & STATUS_SCAN_FORCED) &&
6129             priv->status & STATUS_SCAN_ABORTING) {
6130                 IPW_DEBUG_HC("Scan request while abort pending.  Queuing.\n");
6131                 priv->status |= STATUS_SCAN_PENDING;
6132                 goto done;
6133         }
6134
6135         if (priv->status & STATUS_RF_KILL_MASK) {
6136                 IPW_DEBUG_HC("Aborting scan due to RF Kill activation\n");
6137                 priv->status |= STATUS_SCAN_PENDING;
6138                 goto done;
6139         }
6140
6141         memset(&scan, 0, sizeof(scan));
6142
6143         if (priv->config & CFG_SPEED_SCAN)
6144                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
6145                     cpu_to_le16(30);
6146         else
6147                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
6148                     cpu_to_le16(20);
6149
6150         scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN] =
6151             cpu_to_le16(20);
6152         scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = cpu_to_le16(120);
6153
6154         scan.full_scan_index = cpu_to_le32(ieee80211_get_scans(priv->ieee));
6155
6156 #ifdef CONFIG_IPW2200_MONITOR
6157         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
6158                 u8 channel;
6159                 u8 band = 0;
6160
6161                 switch (ipw_is_valid_channel(priv->ieee, priv->channel)) {
6162                 case IEEE80211_52GHZ_BAND:
6163                         band = (u8) (IPW_A_MODE << 6) | 1;
6164                         channel = priv->channel;
6165                         break;
6166
6167                 case IEEE80211_24GHZ_BAND:
6168                         band = (u8) (IPW_B_MODE << 6) | 1;
6169                         channel = priv->channel;
6170                         break;
6171
6172                 default:
6173                         band = (u8) (IPW_B_MODE << 6) | 1;
6174                         channel = 9;
6175                         break;
6176                 }
6177
6178                 scan.channels_list[0] = band;
6179                 scan.channels_list[1] = channel;
6180                 ipw_set_scan_type(&scan, 1, IPW_SCAN_PASSIVE_FULL_DWELL_SCAN);
6181
6182                 /* NOTE:  The card will sit on this channel for this time
6183                  * period.  Scan aborts are timing sensitive and frequently
6184                  * result in firmware restarts.  As such, it is best to
6185                  * set a small dwell_time here and just keep re-issuing
6186                  * scans.  Otherwise fast channel hopping will not actually
6187                  * hop channels.
6188                  *
6189                  * TODO: Move SPEED SCAN support to all modes and bands */
6190                 scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] =
6191                     cpu_to_le16(2000);
6192         } else {
6193 #endif                          /* CONFIG_IPW2200_MONITOR */
6194                 /* If we are roaming, then make this a directed scan for the
6195                  * current network.  Otherwise, ensure that every other scan
6196                  * is a fast channel hop scan */
6197                 if ((priv->status & STATUS_ROAMING)
6198                     || (!(priv->status & STATUS_ASSOCIATED)
6199                         && (priv->config & CFG_STATIC_ESSID)
6200                         && (le32_to_cpu(scan.full_scan_index) % 2))) {
6201                         err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
6202                         if (err) {
6203                                 IPW_DEBUG_HC("Attempt to send SSID command "
6204                                              "failed.\n");
6205                                 goto done;
6206                         }
6207
6208                         scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
6209                 } else
6210                         scan_type = IPW_SCAN_ACTIVE_BROADCAST_SCAN;
6211
6212                 ipw_add_scan_channels(priv, &scan, scan_type);
6213 #ifdef CONFIG_IPW2200_MONITOR
6214         }
6215 #endif
6216
6217         err = ipw_send_scan_request_ext(priv, &scan);
6218         if (err) {
6219                 IPW_DEBUG_HC("Sending scan command failed: %08X\n", err);
6220                 goto done;
6221         }
6222
6223         priv->status |= STATUS_SCANNING;
6224         priv->status &= ~STATUS_SCAN_PENDING;
6225         queue_delayed_work(priv->workqueue, &priv->scan_check,
6226                            IPW_SCAN_CHECK_WATCHDOG);
6227       done:
6228         up(&priv->sem);
6229         return err;
6230 }
6231
6232 static void ipw_bg_abort_scan(void *data)
6233 {
6234         struct ipw_priv *priv = data;
6235         down(&priv->sem);
6236         ipw_abort_scan(data);
6237         up(&priv->sem);
6238 }
6239
6240 static int ipw_wpa_enable(struct ipw_priv *priv, int value)
6241 {
6242         /* This is called when wpa_supplicant loads and closes the driver
6243          * interface. */
6244         priv->ieee->wpa_enabled = value;
6245         return 0;
6246 }
6247
6248 static int ipw_wpa_set_auth_algs(struct ipw_priv *priv, int value)
6249 {
6250         struct ieee80211_device *ieee = priv->ieee;
6251         struct ieee80211_security sec = {
6252                 .flags = SEC_AUTH_MODE,
6253         };
6254         int ret = 0;
6255
6256         if (value & IW_AUTH_ALG_SHARED_KEY) {
6257                 sec.auth_mode = WLAN_AUTH_SHARED_KEY;
6258                 ieee->open_wep = 0;
6259         } else if (value & IW_AUTH_ALG_OPEN_SYSTEM) {
6260                 sec.auth_mode = WLAN_AUTH_OPEN;
6261                 ieee->open_wep = 1;
6262         } else if (value & IW_AUTH_ALG_LEAP) {
6263                 sec.auth_mode = WLAN_AUTH_LEAP;
6264                 ieee->open_wep = 1;
6265         } else
6266                 return -EINVAL;
6267
6268         if (ieee->set_security)
6269                 ieee->set_security(ieee->dev, &sec);
6270         else
6271                 ret = -EOPNOTSUPP;
6272
6273         return ret;
6274 }
6275
6276 static void ipw_wpa_assoc_frame(struct ipw_priv *priv, char *wpa_ie,
6277                                 int wpa_ie_len)
6278 {
6279         /* make sure WPA is enabled */
6280         ipw_wpa_enable(priv, 1);
6281
6282         ipw_disassociate(priv);
6283 }
6284
6285 static int ipw_set_rsn_capa(struct ipw_priv *priv,
6286                             char *capabilities, int length)
6287 {
6288         struct host_cmd cmd = {
6289                 .cmd = IPW_CMD_RSN_CAPABILITIES,
6290                 .len = length,
6291         };
6292
6293         IPW_DEBUG_HC("HOST_CMD_RSN_CAPABILITIES\n");
6294
6295         memcpy(cmd.param, capabilities, length);
6296         return ipw_send_cmd(priv, &cmd);
6297 }
6298
6299 /*
6300  * WE-18 support
6301  */
6302
6303 /* SIOCSIWGENIE */
6304 static int ipw_wx_set_genie(struct net_device *dev,
6305                             struct iw_request_info *info,
6306                             union iwreq_data *wrqu, char *extra)
6307 {
6308         struct ipw_priv *priv = ieee80211_priv(dev);
6309         struct ieee80211_device *ieee = priv->ieee;
6310         u8 *buf;
6311         int err = 0;
6312
6313         if (wrqu->data.length > MAX_WPA_IE_LEN ||
6314             (wrqu->data.length && extra == NULL))
6315                 return -EINVAL;
6316
6317         //down(&priv->sem);
6318
6319         //if (!ieee->wpa_enabled) {
6320         //      err = -EOPNOTSUPP;
6321         //      goto out;
6322         //}
6323
6324         if (wrqu->data.length) {
6325                 buf = kmalloc(wrqu->data.length, GFP_KERNEL);
6326                 if (buf == NULL) {
6327                         err = -ENOMEM;
6328                         goto out;
6329                 }
6330
6331                 memcpy(buf, extra, wrqu->data.length);
6332                 kfree(ieee->wpa_ie);
6333                 ieee->wpa_ie = buf;
6334                 ieee->wpa_ie_len = wrqu->data.length;
6335         } else {
6336                 kfree(ieee->wpa_ie);
6337                 ieee->wpa_ie = NULL;
6338                 ieee->wpa_ie_len = 0;
6339         }
6340
6341         ipw_wpa_assoc_frame(priv, ieee->wpa_ie, ieee->wpa_ie_len);
6342       out:
6343         //up(&priv->sem);
6344         return err;
6345 }
6346
6347 /* SIOCGIWGENIE */
6348 static int ipw_wx_get_genie(struct net_device *dev,
6349                             struct iw_request_info *info,
6350                             union iwreq_data *wrqu, char *extra)
6351 {
6352         struct ipw_priv *priv = ieee80211_priv(dev);
6353         struct ieee80211_device *ieee = priv->ieee;
6354         int err = 0;
6355
6356         //down(&priv->sem);
6357
6358         //if (!ieee->wpa_enabled) {
6359         //      err = -EOPNOTSUPP;
6360         //      goto out;
6361         //}
6362
6363         if (ieee->wpa_ie_len == 0 || ieee->wpa_ie == NULL) {
6364                 wrqu->data.length = 0;
6365                 goto out;
6366         }
6367
6368         if (wrqu->data.length < ieee->wpa_ie_len) {
6369                 err = -E2BIG;
6370                 goto out;
6371         }
6372
6373         wrqu->data.length = ieee->wpa_ie_len;
6374         memcpy(extra, ieee->wpa_ie, ieee->wpa_ie_len);
6375
6376       out:
6377         //up(&priv->sem);
6378         return err;
6379 }
6380
6381 static int wext_cipher2level(int cipher)
6382 {
6383         switch (cipher) {
6384         case IW_AUTH_CIPHER_NONE:
6385                 return SEC_LEVEL_0;
6386         case IW_AUTH_CIPHER_WEP40:
6387         case IW_AUTH_CIPHER_WEP104:
6388                 return SEC_LEVEL_1;
6389         case IW_AUTH_CIPHER_TKIP:
6390                 return SEC_LEVEL_2;
6391         case IW_AUTH_CIPHER_CCMP:
6392                 return SEC_LEVEL_3;
6393         default:
6394                 return -1;
6395         }
6396 }
6397
6398 /* SIOCSIWAUTH */
6399 static int ipw_wx_set_auth(struct net_device *dev,
6400                            struct iw_request_info *info,
6401                            union iwreq_data *wrqu, char *extra)
6402 {
6403         struct ipw_priv *priv = ieee80211_priv(dev);
6404         struct ieee80211_device *ieee = priv->ieee;
6405         struct iw_param *param = &wrqu->param;
6406         struct ieee80211_crypt_data *crypt;
6407         unsigned long flags;
6408         int ret = 0;
6409
6410         switch (param->flags & IW_AUTH_INDEX) {
6411         case IW_AUTH_WPA_VERSION:
6412                 break;
6413         case IW_AUTH_CIPHER_PAIRWISE:
6414                 ipw_set_hw_decrypt_unicast(priv,
6415                                            wext_cipher2level(param->value));
6416                 break;
6417         case IW_AUTH_CIPHER_GROUP:
6418                 ipw_set_hw_decrypt_multicast(priv,
6419                                              wext_cipher2level(param->value));
6420                 break;
6421         case IW_AUTH_KEY_MGMT:
6422                 /*
6423                  * ipw2200 does not use these parameters
6424                  */
6425                 break;
6426
6427         case IW_AUTH_TKIP_COUNTERMEASURES:
6428                 crypt = priv->ieee->crypt[priv->ieee->tx_keyidx];
6429                 if (!crypt || !crypt->ops->set_flags || !crypt->ops->get_flags)
6430                         break;
6431
6432                 flags = crypt->ops->get_flags(crypt->priv);
6433
6434                 if (param->value)
6435                         flags |= IEEE80211_CRYPTO_TKIP_COUNTERMEASURES;
6436                 else
6437                         flags &= ~IEEE80211_CRYPTO_TKIP_COUNTERMEASURES;
6438
6439                 crypt->ops->set_flags(flags, crypt->priv);
6440
6441                 break;
6442
6443         case IW_AUTH_DROP_UNENCRYPTED:{
6444                         /* HACK:
6445                          *
6446                          * wpa_supplicant calls set_wpa_enabled when the driver
6447                          * is loaded and unloaded, regardless of if WPA is being
6448                          * used.  No other calls are made which can be used to
6449                          * determine if encryption will be used or not prior to
6450                          * association being expected.  If encryption is not being
6451                          * used, drop_unencrypted is set to false, else true -- we
6452                          * can use this to determine if the CAP_PRIVACY_ON bit should
6453                          * be set.
6454                          */
6455                         struct ieee80211_security sec = {
6456                                 .flags = SEC_ENABLED,
6457                                 .enabled = param->value,
6458                         };
6459                         priv->ieee->drop_unencrypted = param->value;
6460                         /* We only change SEC_LEVEL for open mode. Others
6461                          * are set by ipw_wpa_set_encryption.
6462                          */
6463                         if (!param->value) {
6464                                 sec.flags |= SEC_LEVEL;
6465                                 sec.level = SEC_LEVEL_0;
6466                         } else {
6467                                 sec.flags |= SEC_LEVEL;
6468                                 sec.level = SEC_LEVEL_1;
6469                         }
6470                         if (priv->ieee->set_security)
6471                                 priv->ieee->set_security(priv->ieee->dev, &sec);
6472                         break;
6473                 }
6474
6475         case IW_AUTH_80211_AUTH_ALG:
6476                 ret = ipw_wpa_set_auth_algs(priv, param->value);
6477                 break;
6478
6479         case IW_AUTH_WPA_ENABLED:
6480                 ret = ipw_wpa_enable(priv, param->value);
6481                 break;
6482
6483         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
6484                 ieee->ieee802_1x = param->value;
6485                 break;
6486
6487                 //case IW_AUTH_ROAMING_CONTROL:
6488         case IW_AUTH_PRIVACY_INVOKED:
6489                 ieee->privacy_invoked = param->value;
6490                 break;
6491
6492         default:
6493                 return -EOPNOTSUPP;
6494         }
6495         return ret;
6496 }
6497
6498 /* SIOCGIWAUTH */
6499 static int ipw_wx_get_auth(struct net_device *dev,
6500                            struct iw_request_info *info,
6501                            union iwreq_data *wrqu, char *extra)
6502 {
6503         struct ipw_priv *priv = ieee80211_priv(dev);
6504         struct ieee80211_device *ieee = priv->ieee;
6505         struct ieee80211_crypt_data *crypt;
6506         struct iw_param *param = &wrqu->param;
6507         int ret = 0;
6508
6509         switch (param->flags & IW_AUTH_INDEX) {
6510         case IW_AUTH_WPA_VERSION:
6511         case IW_AUTH_CIPHER_PAIRWISE:
6512         case IW_AUTH_CIPHER_GROUP:
6513         case IW_AUTH_KEY_MGMT:
6514                 /*
6515                  * wpa_supplicant will control these internally
6516                  */
6517                 ret = -EOPNOTSUPP;
6518                 break;
6519
6520         case IW_AUTH_TKIP_COUNTERMEASURES:
6521                 crypt = priv->ieee->crypt[priv->ieee->tx_keyidx];
6522                 if (!crypt || !crypt->ops->get_flags)
6523                         break;
6524
6525                 param->value = (crypt->ops->get_flags(crypt->priv) &
6526                                 IEEE80211_CRYPTO_TKIP_COUNTERMEASURES) ? 1 : 0;
6527
6528                 break;
6529
6530         case IW_AUTH_DROP_UNENCRYPTED:
6531                 param->value = ieee->drop_unencrypted;
6532                 break;
6533
6534         case IW_AUTH_80211_AUTH_ALG:
6535                 param->value = ieee->sec.auth_mode;
6536                 break;
6537
6538         case IW_AUTH_WPA_ENABLED:
6539                 param->value = ieee->wpa_enabled;
6540                 break;
6541
6542         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
6543                 param->value = ieee->ieee802_1x;
6544                 break;
6545
6546         case IW_AUTH_ROAMING_CONTROL:
6547         case IW_AUTH_PRIVACY_INVOKED:
6548                 param->value = ieee->privacy_invoked;
6549                 break;
6550
6551         default:
6552                 return -EOPNOTSUPP;
6553         }
6554         return 0;
6555 }
6556
6557 /* SIOCSIWENCODEEXT */
6558 static int ipw_wx_set_encodeext(struct net_device *dev,
6559                                 struct iw_request_info *info,
6560                                 union iwreq_data *wrqu, char *extra)
6561 {
6562         struct ipw_priv *priv = ieee80211_priv(dev);
6563         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
6564
6565         if (hwcrypto) {
6566                 if (ext->alg == IW_ENCODE_ALG_TKIP) {
6567                         /* IPW HW can't build TKIP MIC,
6568                            host decryption still needed */
6569                         if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY)
6570                                 priv->ieee->host_mc_decrypt = 1;
6571                         else {
6572                                 priv->ieee->host_encrypt = 0;
6573                                 priv->ieee->host_encrypt_msdu = 1;
6574                                 priv->ieee->host_decrypt = 1;
6575                         }
6576                 } else {
6577                         priv->ieee->host_encrypt = 0;
6578                         priv->ieee->host_encrypt_msdu = 0;
6579                         priv->ieee->host_decrypt = 0;
6580                         priv->ieee->host_mc_decrypt = 0;
6581                 }
6582         }
6583
6584         return ieee80211_wx_set_encodeext(priv->ieee, info, wrqu, extra);
6585 }
6586
6587 /* SIOCGIWENCODEEXT */
6588 static int ipw_wx_get_encodeext(struct net_device *dev,
6589                                 struct iw_request_info *info,
6590                                 union iwreq_data *wrqu, char *extra)
6591 {
6592         struct ipw_priv *priv = ieee80211_priv(dev);
6593         return ieee80211_wx_get_encodeext(priv->ieee, info, wrqu, extra);
6594 }
6595
6596 /* SIOCSIWMLME */
6597 static int ipw_wx_set_mlme(struct net_device *dev,
6598                            struct iw_request_info *info,
6599                            union iwreq_data *wrqu, char *extra)
6600 {
6601         struct ipw_priv *priv = ieee80211_priv(dev);
6602         struct iw_mlme *mlme = (struct iw_mlme *)extra;
6603         u16 reason;
6604
6605         reason = cpu_to_le16(mlme->reason_code);
6606
6607         switch (mlme->cmd) {
6608         case IW_MLME_DEAUTH:
6609                 // silently ignore
6610                 break;
6611
6612         case IW_MLME_DISASSOC:
6613                 ipw_disassociate(priv);
6614                 break;
6615
6616         default:
6617                 return -EOPNOTSUPP;
6618         }
6619         return 0;
6620 }
6621
6622 #ifdef CONFIG_IPW_QOS
6623
6624 /* QoS */
6625 /*
6626 * get the modulation type of the current network or
6627 * the card current mode
6628 */
6629 u8 ipw_qos_current_mode(struct ipw_priv * priv)
6630 {
6631         u8 mode = 0;
6632
6633         if (priv->status & STATUS_ASSOCIATED) {
6634                 unsigned long flags;
6635
6636                 spin_lock_irqsave(&priv->ieee->lock, flags);
6637                 mode = priv->assoc_network->mode;
6638                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
6639         } else {
6640                 mode = priv->ieee->mode;
6641         }
6642         IPW_DEBUG_QOS("QoS network/card mode %d \n", mode);
6643         return mode;
6644 }
6645
6646 /*
6647 * Handle management frame beacon and probe response
6648 */
6649 static int ipw_qos_handle_probe_response(struct ipw_priv *priv,
6650                                          int active_network,
6651                                          struct ieee80211_network *network)
6652 {
6653         u32 size = sizeof(struct ieee80211_qos_parameters);
6654
6655         if (network->capability & WLAN_CAPABILITY_IBSS)
6656                 network->qos_data.active = network->qos_data.supported;
6657
6658         if (network->flags & NETWORK_HAS_QOS_MASK) {
6659                 if (active_network &&
6660                     (network->flags & NETWORK_HAS_QOS_PARAMETERS))
6661                         network->qos_data.active = network->qos_data.supported;
6662
6663                 if ((network->qos_data.active == 1) && (active_network == 1) &&
6664                     (network->flags & NETWORK_HAS_QOS_PARAMETERS) &&
6665                     (network->qos_data.old_param_count !=
6666                      network->qos_data.param_count)) {
6667                         network->qos_data.old_param_count =
6668                             network->qos_data.param_count;
6669                         schedule_work(&priv->qos_activate);
6670                         IPW_DEBUG_QOS("QoS parameters change call "
6671                                       "qos_activate\n");
6672                 }
6673         } else {
6674                 if ((priv->ieee->mode == IEEE_B) || (network->mode == IEEE_B))
6675                         memcpy(&network->qos_data.parameters,
6676                                &def_parameters_CCK, size);
6677                 else
6678                         memcpy(&network->qos_data.parameters,
6679                                &def_parameters_OFDM, size);
6680
6681                 if ((network->qos_data.active == 1) && (active_network == 1)) {
6682                         IPW_DEBUG_QOS("QoS was disabled call qos_activate \n");
6683                         schedule_work(&priv->qos_activate);
6684                 }
6685
6686                 network->qos_data.active = 0;
6687                 network->qos_data.supported = 0;
6688         }
6689         if ((priv->status & STATUS_ASSOCIATED) &&
6690             (priv->ieee->iw_mode == IW_MODE_ADHOC) && (active_network == 0)) {
6691                 if (memcmp(network->bssid, priv->bssid, ETH_ALEN))
6692                         if ((network->capability & WLAN_CAPABILITY_IBSS) &&
6693                             !(network->flags & NETWORK_EMPTY_ESSID))
6694                                 if ((network->ssid_len ==
6695                                      priv->assoc_network->ssid_len) &&
6696                                     !memcmp(network->ssid,
6697                                             priv->assoc_network->ssid,
6698                                             network->ssid_len)) {
6699                                         queue_work(priv->workqueue,
6700                                                    &priv->merge_networks);
6701                                 }
6702         }
6703
6704         return 0;
6705 }
6706
6707 /*
6708 * This function set up the firmware to support QoS. It sends
6709 * IPW_CMD_QOS_PARAMETERS and IPW_CMD_WME_INFO
6710 */
6711 static int ipw_qos_activate(struct ipw_priv *priv,
6712                             struct ieee80211_qos_data *qos_network_data)
6713 {
6714         int err;
6715         struct ieee80211_qos_parameters qos_parameters[QOS_QOS_SETS];
6716         struct ieee80211_qos_parameters *active_one = NULL;
6717         u32 size = sizeof(struct ieee80211_qos_parameters);
6718         u32 burst_duration;
6719         int i;
6720         u8 type;
6721
6722         type = ipw_qos_current_mode(priv);
6723
6724         active_one = &(qos_parameters[QOS_PARAM_SET_DEF_CCK]);
6725         memcpy(active_one, priv->qos_data.def_qos_parm_CCK, size);
6726         active_one = &(qos_parameters[QOS_PARAM_SET_DEF_OFDM]);
6727         memcpy(active_one, priv->qos_data.def_qos_parm_OFDM, size);
6728
6729         if (qos_network_data == NULL) {
6730                 if (type == IEEE_B) {
6731                         IPW_DEBUG_QOS("QoS activate network mode %d\n", type);
6732                         active_one = &def_parameters_CCK;
6733                 } else
6734                         active_one = &def_parameters_OFDM;
6735
6736                 memcpy(&qos_parameters[QOS_PARAM_SET_ACTIVE], active_one, size);
6737                 burst_duration = ipw_qos_get_burst_duration(priv);
6738                 for (i = 0; i < QOS_QUEUE_NUM; i++)
6739                         qos_parameters[QOS_PARAM_SET_ACTIVE].tx_op_limit[i] =
6740                             (u16) burst_duration;
6741         } else if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
6742                 if (type == IEEE_B) {
6743                         IPW_DEBUG_QOS("QoS activate IBSS nework mode %d\n",
6744                                       type);
6745                         if (priv->qos_data.qos_enable == 0)
6746                                 active_one = &def_parameters_CCK;
6747                         else
6748                                 active_one = priv->qos_data.def_qos_parm_CCK;
6749                 } else {
6750                         if (priv->qos_data.qos_enable == 0)
6751                                 active_one = &def_parameters_OFDM;
6752                         else
6753                                 active_one = priv->qos_data.def_qos_parm_OFDM;
6754                 }
6755                 memcpy(&qos_parameters[QOS_PARAM_SET_ACTIVE], active_one, size);
6756         } else {
6757                 unsigned long flags;
6758                 int active;
6759
6760                 spin_lock_irqsave(&priv->ieee->lock, flags);
6761                 active_one = &(qos_network_data->parameters);
6762                 qos_network_data->old_param_count =
6763                     qos_network_data->param_count;
6764                 memcpy(&qos_parameters[QOS_PARAM_SET_ACTIVE], active_one, size);
6765                 active = qos_network_data->supported;
6766                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
6767
6768                 if (active == 0) {
6769                         burst_duration = ipw_qos_get_burst_duration(priv);
6770                         for (i = 0; i < QOS_QUEUE_NUM; i++)
6771                                 qos_parameters[QOS_PARAM_SET_ACTIVE].
6772                                     tx_op_limit[i] = (u16) burst_duration;
6773                 }
6774         }
6775
6776         IPW_DEBUG_QOS("QoS sending IPW_CMD_QOS_PARAMETERS\n");
6777         err = ipw_send_qos_params_command(priv,
6778                                           (struct ieee80211_qos_parameters *)
6779                                           &(qos_parameters[0]));
6780         if (err)
6781                 IPW_DEBUG_QOS("QoS IPW_CMD_QOS_PARAMETERS failed\n");
6782
6783         return err;
6784 }
6785
6786 /*
6787 * send IPW_CMD_WME_INFO to the firmware
6788 */
6789 static int ipw_qos_set_info_element(struct ipw_priv *priv)
6790 {
6791         int ret = 0;
6792         struct ieee80211_qos_information_element qos_info;
6793
6794         if (priv == NULL)
6795                 return -1;
6796
6797         qos_info.elementID = QOS_ELEMENT_ID;
6798         qos_info.length = sizeof(struct ieee80211_qos_information_element) - 2;
6799
6800         qos_info.version = QOS_VERSION_1;
6801         qos_info.ac_info = 0;
6802
6803         memcpy(qos_info.qui, qos_oui, QOS_OUI_LEN);
6804         qos_info.qui_type = QOS_OUI_TYPE;
6805         qos_info.qui_subtype = QOS_OUI_INFO_SUB_TYPE;
6806
6807         ret = ipw_send_qos_info_command(priv, &qos_info);
6808         if (ret != 0) {
6809                 IPW_DEBUG_QOS("QoS error calling ipw_send_qos_info_command\n");
6810         }
6811         return ret;
6812 }
6813
6814 /*
6815 * Set the QoS parameter with the association request structure
6816 */
6817 static int ipw_qos_association(struct ipw_priv *priv,
6818                                struct ieee80211_network *network)
6819 {
6820         int err = 0;
6821         struct ieee80211_qos_data *qos_data = NULL;
6822         struct ieee80211_qos_data ibss_data = {
6823                 .supported = 1,
6824                 .active = 1,
6825         };
6826
6827         switch (priv->ieee->iw_mode) {
6828         case IW_MODE_ADHOC:
6829                 if (!(network->capability & WLAN_CAPABILITY_IBSS))
6830                         BUG();
6831
6832                 qos_data = &ibss_data;
6833                 break;
6834
6835         case IW_MODE_INFRA:
6836                 qos_data = &network->qos_data;
6837                 break;
6838
6839         default:
6840                 BUG();
6841                 break;
6842         }
6843
6844         err = ipw_qos_activate(priv, qos_data);
6845         if (err) {
6846                 priv->assoc_request.policy_support &= ~HC_QOS_SUPPORT_ASSOC;
6847                 return err;
6848         }
6849
6850         if (priv->qos_data.qos_enable && qos_data->supported) {
6851                 IPW_DEBUG_QOS("QoS will be enabled for this association\n");
6852                 priv->assoc_request.policy_support |= HC_QOS_SUPPORT_ASSOC;
6853                 return ipw_qos_set_info_element(priv);
6854         }
6855
6856         return 0;
6857 }
6858
6859 /*
6860 * handling the beaconing responces. if we get different QoS setting
6861 * of the network from the the associated setting adjust the QoS
6862 * setting
6863 */
6864 static int ipw_qos_association_resp(struct ipw_priv *priv,
6865                                     struct ieee80211_network *network)
6866 {
6867         int ret = 0;
6868         unsigned long flags;
6869         u32 size = sizeof(struct ieee80211_qos_parameters);
6870         int set_qos_param = 0;
6871
6872         if ((priv == NULL) || (network == NULL) ||
6873             (priv->assoc_network == NULL))
6874                 return ret;
6875
6876         if (!(priv->status & STATUS_ASSOCIATED))
6877                 return ret;
6878
6879         if ((priv->ieee->iw_mode != IW_MODE_INFRA))
6880                 return ret;
6881
6882         spin_lock_irqsave(&priv->ieee->lock, flags);
6883         if (network->flags & NETWORK_HAS_QOS_PARAMETERS) {
6884                 memcpy(&priv->assoc_network->qos_data, &network->qos_data,
6885                        sizeof(struct ieee80211_qos_data));
6886                 priv->assoc_network->qos_data.active = 1;
6887                 if ((network->qos_data.old_param_count !=
6888                      network->qos_data.param_count)) {
6889                         set_qos_param = 1;
6890                         network->qos_data.old_param_count =
6891                             network->qos_data.param_count;
6892                 }
6893
6894         } else {
6895                 if ((network->mode == IEEE_B) || (priv->ieee->mode == IEEE_B))
6896                         memcpy(&priv->assoc_network->qos_data.parameters,
6897                                &def_parameters_CCK, size);
6898                 else
6899                         memcpy(&priv->assoc_network->qos_data.parameters,
6900                                &def_parameters_OFDM, size);
6901                 priv->assoc_network->qos_data.active = 0;
6902                 priv->assoc_network->qos_data.supported = 0;
6903                 set_qos_param = 1;
6904         }
6905
6906         spin_unlock_irqrestore(&priv->ieee->lock, flags);
6907
6908         if (set_qos_param == 1)
6909                 schedule_work(&priv->qos_activate);
6910
6911         return ret;
6912 }
6913
6914 static u32 ipw_qos_get_burst_duration(struct ipw_priv *priv)
6915 {
6916         u32 ret = 0;
6917
6918         if ((priv == NULL))
6919                 return 0;
6920
6921         if (!(priv->ieee->modulation & IEEE80211_OFDM_MODULATION))
6922                 ret = priv->qos_data.burst_duration_CCK;
6923         else
6924                 ret = priv->qos_data.burst_duration_OFDM;
6925
6926         return ret;
6927 }
6928
6929 /*
6930 * Initialize the setting of QoS global
6931 */
6932 static void ipw_qos_init(struct ipw_priv *priv, int enable,
6933                          int burst_enable, u32 burst_duration_CCK,
6934                          u32 burst_duration_OFDM)
6935 {
6936         priv->qos_data.qos_enable = enable;
6937
6938         if (priv->qos_data.qos_enable) {
6939                 priv->qos_data.def_qos_parm_CCK = &def_qos_parameters_CCK;
6940                 priv->qos_data.def_qos_parm_OFDM = &def_qos_parameters_OFDM;
6941                 IPW_DEBUG_QOS("QoS is enabled\n");
6942         } else {
6943                 priv->qos_data.def_qos_parm_CCK = &def_parameters_CCK;
6944                 priv->qos_data.def_qos_parm_OFDM = &def_parameters_OFDM;
6945                 IPW_DEBUG_QOS("QoS is not enabled\n");
6946         }
6947
6948         priv->qos_data.burst_enable = burst_enable;
6949
6950         if (burst_enable) {
6951                 priv->qos_data.burst_duration_CCK = burst_duration_CCK;
6952                 priv->qos_data.burst_duration_OFDM = burst_duration_OFDM;
6953         } else {
6954                 priv->qos_data.burst_duration_CCK = 0;
6955                 priv->qos_data.burst_duration_OFDM = 0;
6956         }
6957 }
6958
6959 /*
6960 * map the packet priority to the right TX Queue
6961 */
6962 static int ipw_get_tx_queue_number(struct ipw_priv *priv, u16 priority)
6963 {
6964         if (priority > 7 || !priv->qos_data.qos_enable)
6965                 priority = 0;
6966
6967         return from_priority_to_tx_queue[priority] - 1;
6968 }
6969
6970 /*
6971 * add QoS parameter to the TX command
6972 */
6973 static int ipw_qos_set_tx_queue_command(struct ipw_priv *priv,
6974                                         u16 priority,
6975                                         struct tfd_data *tfd, u8 unicast)
6976 {
6977         int ret = 0;
6978         int tx_queue_id = 0;
6979         struct ieee80211_qos_data *qos_data = NULL;
6980         int active, supported;
6981         unsigned long flags;
6982
6983         if (!(priv->status & STATUS_ASSOCIATED))
6984                 return 0;
6985
6986         qos_data = &priv->assoc_network->qos_data;
6987
6988         spin_lock_irqsave(&priv->ieee->lock, flags);
6989
6990         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
6991                 if (unicast == 0)
6992                         qos_data->active = 0;
6993                 else
6994                         qos_data->active = qos_data->supported;
6995         }
6996
6997         active = qos_data->active;
6998         supported = qos_data->supported;
6999
7000         spin_unlock_irqrestore(&priv->ieee->lock, flags);
7001
7002         IPW_DEBUG_QOS("QoS  %d network is QoS active %d  supported %d  "
7003                       "unicast %d\n",
7004                       priv->qos_data.qos_enable, active, supported, unicast);
7005         if (active && priv->qos_data.qos_enable) {
7006                 ret = from_priority_to_tx_queue[priority];
7007                 tx_queue_id = ret - 1;
7008                 IPW_DEBUG_QOS("QoS packet priority is %d \n", priority);
7009                 if (priority <= 7) {
7010                         tfd->tx_flags_ext |= DCT_FLAG_EXT_QOS_ENABLED;
7011                         tfd->tfd.tfd_26.mchdr.qos_ctrl = priority;
7012                         tfd->tfd.tfd_26.mchdr.frame_ctl |=
7013                             IEEE80211_STYPE_QOS_DATA;
7014
7015                         if (priv->qos_data.qos_no_ack_mask &
7016                             (1UL << tx_queue_id)) {
7017                                 tfd->tx_flags &= ~DCT_FLAG_ACK_REQD;
7018                                 tfd->tfd.tfd_26.mchdr.qos_ctrl |=
7019                                     CTRL_QOS_NO_ACK;
7020                         }
7021                 }
7022         }
7023
7024         return ret;
7025 }
7026
7027 /*
7028 * background support to run QoS activate functionality
7029 */
7030 static void ipw_bg_qos_activate(void *data)
7031 {
7032         struct ipw_priv *priv = data;
7033
7034         if (priv == NULL)
7035                 return;
7036
7037         down(&priv->sem);
7038
7039         if (priv->status & STATUS_ASSOCIATED)
7040                 ipw_qos_activate(priv, &(priv->assoc_network->qos_data));
7041
7042         up(&priv->sem);
7043 }
7044
7045 static int ipw_handle_probe_response(struct net_device *dev,
7046                                      struct ieee80211_probe_response *resp,
7047                                      struct ieee80211_network *network)
7048 {
7049         struct ipw_priv *priv = ieee80211_priv(dev);
7050         int active_network = ((priv->status & STATUS_ASSOCIATED) &&
7051                               (network == priv->assoc_network));
7052
7053         ipw_qos_handle_probe_response(priv, active_network, network);
7054
7055         return 0;
7056 }
7057
7058 static int ipw_handle_beacon(struct net_device *dev,
7059                              struct ieee80211_beacon *resp,
7060                              struct ieee80211_network *network)
7061 {
7062         struct ipw_priv *priv = ieee80211_priv(dev);
7063         int active_network = ((priv->status & STATUS_ASSOCIATED) &&
7064                               (network == priv->assoc_network));
7065
7066         ipw_qos_handle_probe_response(priv, active_network, network);
7067
7068         return 0;
7069 }
7070
7071 static int ipw_handle_assoc_response(struct net_device *dev,
7072                                      struct ieee80211_assoc_response *resp,
7073                                      struct ieee80211_network *network)
7074 {
7075         struct ipw_priv *priv = ieee80211_priv(dev);
7076         ipw_qos_association_resp(priv, network);
7077         return 0;
7078 }
7079
7080 static int ipw_send_qos_params_command(struct ipw_priv *priv, struct ieee80211_qos_parameters
7081                                        *qos_param)
7082 {
7083         struct host_cmd cmd = {
7084                 .cmd = IPW_CMD_QOS_PARAMETERS,
7085                 .len = (sizeof(struct ieee80211_qos_parameters) * 3)
7086         };
7087
7088         memcpy(cmd.param, qos_param, sizeof(*qos_param) * 3);
7089         return ipw_send_cmd(priv, &cmd);
7090 }
7091
7092 static int ipw_send_qos_info_command(struct ipw_priv *priv, struct ieee80211_qos_information_element
7093                                      *qos_param)
7094 {
7095         struct host_cmd cmd = {
7096                 .cmd = IPW_CMD_WME_INFO,
7097                 .len = sizeof(*qos_param)
7098         };
7099
7100         memcpy(cmd.param, qos_param, sizeof(*qos_param));
7101         return ipw_send_cmd(priv, &cmd);
7102 }
7103
7104 #endif                          /* CONFIG_IPW_QOS */
7105
7106 static int ipw_associate_network(struct ipw_priv *priv,
7107                                  struct ieee80211_network *network,
7108                                  struct ipw_supported_rates *rates, int roaming)
7109 {
7110         int err;
7111
7112         if (priv->config & CFG_FIXED_RATE)
7113                 ipw_set_fixed_rate(priv, network->mode);
7114
7115         if (!(priv->config & CFG_STATIC_ESSID)) {
7116                 priv->essid_len = min(network->ssid_len,
7117                                       (u8) IW_ESSID_MAX_SIZE);
7118                 memcpy(priv->essid, network->ssid, priv->essid_len);
7119         }
7120
7121         network->last_associate = jiffies;
7122
7123         memset(&priv->assoc_request, 0, sizeof(priv->assoc_request));
7124         priv->assoc_request.channel = network->channel;
7125         priv->assoc_request.auth_key = 0;
7126
7127         if ((priv->capability & CAP_PRIVACY_ON) &&
7128             (priv->ieee->sec.auth_mode == WLAN_AUTH_SHARED_KEY)) {
7129                 priv->assoc_request.auth_type = AUTH_SHARED_KEY;
7130                 priv->assoc_request.auth_key = priv->ieee->sec.active_key;
7131
7132                 if ((priv->ieee->sec.level == SEC_LEVEL_1) &&
7133                     !(priv->ieee->host_encrypt || priv->ieee->host_decrypt))
7134                         ipw_send_wep_keys(priv, DCW_WEP_KEY_SEC_TYPE_WEP);
7135
7136         } else if ((priv->capability & CAP_PRIVACY_ON) &&
7137                    (priv->ieee->sec.auth_mode == WLAN_AUTH_LEAP))
7138                 priv->assoc_request.auth_type = AUTH_LEAP;
7139         else
7140                 priv->assoc_request.auth_type = AUTH_OPEN;
7141
7142         if (priv->ieee->wpa_ie_len) {
7143                 priv->assoc_request.policy_support = 0x02;      /* RSN active */
7144                 ipw_set_rsn_capa(priv, priv->ieee->wpa_ie,
7145                                  priv->ieee->wpa_ie_len);
7146         }
7147
7148         /*
7149          * It is valid for our ieee device to support multiple modes, but
7150          * when it comes to associating to a given network we have to choose
7151          * just one mode.
7152          */
7153         if (network->mode & priv->ieee->mode & IEEE_A)
7154                 priv->assoc_request.ieee_mode = IPW_A_MODE;
7155         else if (network->mode & priv->ieee->mode & IEEE_G)
7156                 priv->assoc_request.ieee_mode = IPW_G_MODE;
7157         else if (network->mode & priv->ieee->mode & IEEE_B)
7158                 priv->assoc_request.ieee_mode = IPW_B_MODE;
7159
7160         priv->assoc_request.capability = network->capability;
7161         if ((network->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
7162             && !(priv->config & CFG_PREAMBLE_LONG)) {
7163                 priv->assoc_request.preamble_length = DCT_FLAG_SHORT_PREAMBLE;
7164         } else {
7165                 priv->assoc_request.preamble_length = DCT_FLAG_LONG_PREAMBLE;
7166
7167                 /* Clear the short preamble if we won't be supporting it */
7168                 priv->assoc_request.capability &=
7169                     ~WLAN_CAPABILITY_SHORT_PREAMBLE;
7170         }
7171
7172         /* Clear capability bits that aren't used in Ad Hoc */
7173         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
7174                 priv->assoc_request.capability &=
7175                     ~WLAN_CAPABILITY_SHORT_SLOT_TIME;
7176
7177         IPW_DEBUG_ASSOC("%sssocation attempt: '%s', channel %d, "
7178                         "802.11%c [%d], %s[:%s], enc=%s%s%s%c%c\n",
7179                         roaming ? "Rea" : "A",
7180                         escape_essid(priv->essid, priv->essid_len),
7181                         network->channel,
7182                         ipw_modes[priv->assoc_request.ieee_mode],
7183                         rates->num_rates,
7184                         (priv->assoc_request.preamble_length ==
7185                          DCT_FLAG_LONG_PREAMBLE) ? "long" : "short",
7186                         network->capability &
7187                         WLAN_CAPABILITY_SHORT_PREAMBLE ? "short" : "long",
7188                         priv->capability & CAP_PRIVACY_ON ? "on " : "off",
7189                         priv->capability & CAP_PRIVACY_ON ?
7190                         (priv->capability & CAP_SHARED_KEY ? "(shared)" :
7191                          "(open)") : "",
7192                         priv->capability & CAP_PRIVACY_ON ? " key=" : "",
7193                         priv->capability & CAP_PRIVACY_ON ?
7194                         '1' + priv->ieee->sec.active_key : '.',
7195                         priv->capability & CAP_PRIVACY_ON ? '.' : ' ');
7196
7197         priv->assoc_request.beacon_interval = network->beacon_interval;
7198         if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
7199             (network->time_stamp[0] == 0) && (network->time_stamp[1] == 0)) {
7200                 priv->assoc_request.assoc_type = HC_IBSS_START;
7201                 priv->assoc_request.assoc_tsf_msw = 0;
7202                 priv->assoc_request.assoc_tsf_lsw = 0;
7203         } else {
7204                 if (unlikely(roaming))
7205                         priv->assoc_request.assoc_type = HC_REASSOCIATE;
7206                 else
7207                         priv->assoc_request.assoc_type = HC_ASSOCIATE;
7208                 priv->assoc_request.assoc_tsf_msw = network->time_stamp[1];
7209                 priv->assoc_request.assoc_tsf_lsw = network->time_stamp[0];
7210         }
7211
7212         memcpy(priv->assoc_request.bssid, network->bssid, ETH_ALEN);
7213
7214         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
7215                 memset(&priv->assoc_request.dest, 0xFF, ETH_ALEN);
7216                 priv->assoc_request.atim_window = network->atim_window;
7217         } else {
7218                 memcpy(priv->assoc_request.dest, network->bssid, ETH_ALEN);
7219                 priv->assoc_request.atim_window = 0;
7220         }
7221
7222         priv->assoc_request.listen_interval = network->listen_interval;
7223
7224         err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
7225         if (err) {
7226                 IPW_DEBUG_HC("Attempt to send SSID command failed.\n");
7227                 return err;
7228         }
7229
7230         rates->ieee_mode = priv->assoc_request.ieee_mode;
7231         rates->purpose = IPW_RATE_CONNECT;
7232         ipw_send_supported_rates(priv, rates);
7233
7234         if (priv->assoc_request.ieee_mode == IPW_G_MODE)
7235                 priv->sys_config.dot11g_auto_detection = 1;
7236         else
7237                 priv->sys_config.dot11g_auto_detection = 0;
7238
7239         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
7240                 priv->sys_config.answer_broadcast_ssid_probe = 1;
7241         else
7242                 priv->sys_config.answer_broadcast_ssid_probe = 0;
7243
7244         err = ipw_send_system_config(priv, &priv->sys_config);
7245         if (err) {
7246                 IPW_DEBUG_HC("Attempt to send sys config command failed.\n");
7247                 return err;
7248         }
7249
7250         IPW_DEBUG_ASSOC("Association sensitivity: %d\n", network->stats.rssi);
7251         err = ipw_set_sensitivity(priv, network->stats.rssi + IPW_RSSI_TO_DBM);
7252         if (err) {
7253                 IPW_DEBUG_HC("Attempt to send associate command failed.\n");
7254                 return err;
7255         }
7256
7257         /*
7258          * If preemption is enabled, it is possible for the association
7259          * to complete before we return from ipw_send_associate.  Therefore
7260          * we have to be sure and update our priviate data first.
7261          */
7262         priv->channel = network->channel;
7263         memcpy(priv->bssid, network->bssid, ETH_ALEN);
7264         priv->status |= STATUS_ASSOCIATING;
7265         priv->status &= ~STATUS_SECURITY_UPDATED;
7266
7267         priv->assoc_network = network;
7268
7269 #ifdef CONFIG_IPW_QOS
7270         ipw_qos_association(priv, network);
7271 #endif
7272
7273         err = ipw_send_associate(priv, &priv->assoc_request);
7274         if (err) {
7275                 IPW_DEBUG_HC("Attempt to send associate command failed.\n");
7276                 return err;
7277         }
7278
7279         IPW_DEBUG(IPW_DL_STATE, "associating: '%s' " MAC_FMT " \n",
7280                   escape_essid(priv->essid, priv->essid_len),
7281                   MAC_ARG(priv->bssid));
7282
7283         return 0;
7284 }
7285
7286 static void ipw_roam(void *data)
7287 {
7288         struct ipw_priv *priv = data;
7289         struct ieee80211_network *network = NULL;
7290         struct ipw_network_match match = {
7291                 .network = priv->assoc_network
7292         };
7293
7294         /* The roaming process is as follows:
7295          *
7296          * 1.  Missed beacon threshold triggers the roaming process by
7297          *     setting the status ROAM bit and requesting a scan.
7298          * 2.  When the scan completes, it schedules the ROAM work
7299          * 3.  The ROAM work looks at all of the known networks for one that
7300          *     is a better network than the currently associated.  If none
7301          *     found, the ROAM process is over (ROAM bit cleared)
7302          * 4.  If a better network is found, a disassociation request is
7303          *     sent.
7304          * 5.  When the disassociation completes, the roam work is again
7305          *     scheduled.  The second time through, the driver is no longer
7306          *     associated, and the newly selected network is sent an
7307          *     association request.
7308          * 6.  At this point ,the roaming process is complete and the ROAM
7309          *     status bit is cleared.
7310          */
7311
7312         /* If we are no longer associated, and the roaming bit is no longer
7313          * set, then we are not actively roaming, so just return */
7314         if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ROAMING)))
7315                 return;
7316
7317         if (priv->status & STATUS_ASSOCIATED) {
7318                 /* First pass through ROAM process -- look for a better
7319                  * network */
7320                 unsigned long flags;
7321                 u8 rssi = priv->assoc_network->stats.rssi;
7322                 priv->assoc_network->stats.rssi = -128;
7323                 spin_lock_irqsave(&priv->ieee->lock, flags);
7324                 list_for_each_entry(network, &priv->ieee->network_list, list) {
7325                         if (network != priv->assoc_network)
7326                                 ipw_best_network(priv, &match, network, 1);
7327                 }
7328                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
7329                 priv->assoc_network->stats.rssi = rssi;
7330
7331                 if (match.network == priv->assoc_network) {
7332                         IPW_DEBUG_ASSOC("No better APs in this network to "
7333                                         "roam to.\n");
7334                         priv->status &= ~STATUS_ROAMING;
7335                         ipw_debug_config(priv);
7336                         return;
7337                 }
7338
7339                 ipw_send_disassociate(priv, 1);
7340                 priv->assoc_network = match.network;
7341
7342                 return;
7343         }
7344
7345         /* Second pass through ROAM process -- request association */
7346         ipw_compatible_rates(priv, priv->assoc_network, &match.rates);
7347         ipw_associate_network(priv, priv->assoc_network, &match.rates, 1);
7348         priv->status &= ~STATUS_ROAMING;
7349 }
7350
7351 static void ipw_bg_roam(void *data)
7352 {
7353         struct ipw_priv *priv = data;
7354         down(&priv->sem);
7355         ipw_roam(data);
7356         up(&priv->sem);
7357 }
7358
7359 static int ipw_associate(void *data)
7360 {
7361         struct ipw_priv *priv = data;
7362
7363         struct ieee80211_network *network = NULL;
7364         struct ipw_network_match match = {
7365                 .network = NULL
7366         };
7367         struct ipw_supported_rates *rates;
7368         struct list_head *element;
7369         unsigned long flags;
7370
7371         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
7372                 IPW_DEBUG_ASSOC("Not attempting association (monitor mode)\n");
7373                 return 0;
7374         }
7375
7376         if (priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
7377                 IPW_DEBUG_ASSOC("Not attempting association (already in "
7378                                 "progress)\n");
7379                 return 0;
7380         }
7381
7382         if (priv->status & STATUS_DISASSOCIATING) {
7383                 IPW_DEBUG_ASSOC("Not attempting association (in "
7384                                 "disassociating)\n ");
7385                 queue_work(priv->workqueue, &priv->associate);
7386                 return 0;
7387         }
7388
7389         if (!ipw_is_init(priv) || (priv->status & STATUS_SCANNING)) {
7390                 IPW_DEBUG_ASSOC("Not attempting association (scanning or not "
7391                                 "initialized)\n");
7392                 return 0;
7393         }
7394
7395         if (!(priv->config & CFG_ASSOCIATE) &&
7396             !(priv->config & (CFG_STATIC_ESSID |
7397                               CFG_STATIC_CHANNEL | CFG_STATIC_BSSID))) {
7398                 IPW_DEBUG_ASSOC("Not attempting association (associate=0)\n");
7399                 return 0;
7400         }
7401
7402         /* Protect our use of the network_list */
7403         spin_lock_irqsave(&priv->ieee->lock, flags);
7404         list_for_each_entry(network, &priv->ieee->network_list, list)
7405             ipw_best_network(priv, &match, network, 0);
7406
7407         network = match.network;
7408         rates = &match.rates;
7409
7410         if (network == NULL &&
7411             priv->ieee->iw_mode == IW_MODE_ADHOC &&
7412             priv->config & CFG_ADHOC_CREATE &&
7413             priv->config & CFG_STATIC_ESSID &&
7414             priv->config & CFG_STATIC_CHANNEL &&
7415             !list_empty(&priv->ieee->network_free_list)) {
7416                 element = priv->ieee->network_free_list.next;
7417                 network = list_entry(element, struct ieee80211_network, list);
7418                 ipw_adhoc_create(priv, network);
7419                 rates = &priv->rates;
7420                 list_del(element);
7421                 list_add_tail(&network->list, &priv->ieee->network_list);
7422         }
7423         spin_unlock_irqrestore(&priv->ieee->lock, flags);
7424
7425         /* If we reached the end of the list, then we don't have any valid
7426          * matching APs */
7427         if (!network) {
7428                 ipw_debug_config(priv);
7429
7430                 if (!(priv->status & STATUS_SCANNING)) {
7431                         if (!(priv->config & CFG_SPEED_SCAN))
7432                                 queue_delayed_work(priv->workqueue,
7433                                                    &priv->request_scan,
7434                                                    SCAN_INTERVAL);
7435                         else
7436                                 queue_work(priv->workqueue,
7437                                            &priv->request_scan);
7438                 }
7439
7440                 return 0;
7441         }
7442
7443         ipw_associate_network(priv, network, rates, 0);
7444
7445         return 1;
7446 }
7447
7448 static void ipw_bg_associate(void *data)
7449 {
7450         struct ipw_priv *priv = data;
7451         down(&priv->sem);
7452         ipw_associate(data);
7453         up(&priv->sem);
7454 }
7455
7456 static void ipw_rebuild_decrypted_skb(struct ipw_priv *priv,
7457                                       struct sk_buff *skb)
7458 {
7459         struct ieee80211_hdr *hdr;
7460         u16 fc;
7461
7462         hdr = (struct ieee80211_hdr *)skb->data;
7463         fc = le16_to_cpu(hdr->frame_ctl);
7464         if (!(fc & IEEE80211_FCTL_PROTECTED))
7465                 return;
7466
7467         fc &= ~IEEE80211_FCTL_PROTECTED;
7468         hdr->frame_ctl = cpu_to_le16(fc);
7469         switch (priv->ieee->sec.level) {
7470         case SEC_LEVEL_3:
7471                 /* Remove CCMP HDR */
7472                 memmove(skb->data + IEEE80211_3ADDR_LEN,
7473                         skb->data + IEEE80211_3ADDR_LEN + 8,
7474                         skb->len - IEEE80211_3ADDR_LEN - 8);
7475                 skb_trim(skb, skb->len - 16);   /* CCMP_HDR_LEN + CCMP_MIC_LEN */
7476                 break;
7477         case SEC_LEVEL_2:
7478                 break;
7479         case SEC_LEVEL_1:
7480                 /* Remove IV */
7481                 memmove(skb->data + IEEE80211_3ADDR_LEN,
7482                         skb->data + IEEE80211_3ADDR_LEN + 4,
7483                         skb->len - IEEE80211_3ADDR_LEN - 4);
7484                 skb_trim(skb, skb->len - 8);    /* IV + ICV */
7485                 break;
7486         case SEC_LEVEL_0:
7487                 break;
7488         default:
7489                 printk(KERN_ERR "Unknow security level %d\n",
7490                        priv->ieee->sec.level);
7491                 break;
7492         }
7493 }
7494
7495 static void ipw_handle_data_packet(struct ipw_priv *priv,
7496                                    struct ipw_rx_mem_buffer *rxb,
7497                                    struct ieee80211_rx_stats *stats)
7498 {
7499         struct ieee80211_hdr_4addr *hdr;
7500         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
7501
7502         /* We received data from the HW, so stop the watchdog */
7503         priv->net_dev->trans_start = jiffies;
7504
7505         /* We only process data packets if the
7506          * interface is open */
7507         if (unlikely((le16_to_cpu(pkt->u.frame.length) + IPW_RX_FRAME_SIZE) >
7508                      skb_tailroom(rxb->skb))) {
7509                 priv->ieee->stats.rx_errors++;
7510                 priv->wstats.discard.misc++;
7511                 IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
7512                 return;
7513         } else if (unlikely(!netif_running(priv->net_dev))) {
7514                 priv->ieee->stats.rx_dropped++;
7515                 priv->wstats.discard.misc++;
7516                 IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
7517                 return;
7518         }
7519
7520         /* Advance skb->data to the start of the actual payload */
7521         skb_reserve(rxb->skb, offsetof(struct ipw_rx_packet, u.frame.data));
7522
7523         /* Set the size of the skb to the size of the frame */
7524         skb_put(rxb->skb, le16_to_cpu(pkt->u.frame.length));
7525
7526         IPW_DEBUG_RX("Rx packet of %d bytes.\n", rxb->skb->len);
7527
7528         /* HW decrypt will not clear the WEP bit, MIC, PN, etc. */
7529         hdr = (struct ieee80211_hdr_4addr *)rxb->skb->data;
7530         if (priv->ieee->iw_mode != IW_MODE_MONITOR &&
7531             (is_multicast_ether_addr(hdr->addr1) ?
7532              !priv->ieee->host_mc_decrypt : !priv->ieee->host_decrypt))
7533                 ipw_rebuild_decrypted_skb(priv, rxb->skb);
7534
7535         if (!ieee80211_rx(priv->ieee, rxb->skb, stats))
7536                 priv->ieee->stats.rx_errors++;
7537         else {                  /* ieee80211_rx succeeded, so it now owns the SKB */
7538                 rxb->skb = NULL;
7539                 __ipw_led_activity_on(priv);
7540         }
7541 }
7542
7543 #ifdef CONFIG_IEEE80211_RADIOTAP
7544 static void ipw_handle_data_packet_monitor(struct ipw_priv *priv,
7545                                            struct ipw_rx_mem_buffer *rxb,
7546                                            struct ieee80211_rx_stats *stats)
7547 {
7548         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
7549         struct ipw_rx_frame *frame = &pkt->u.frame;
7550
7551         /* initial pull of some data */
7552         u16 received_channel = frame->received_channel;
7553         u8 antennaAndPhy = frame->antennaAndPhy;
7554         s8 antsignal = frame->rssi_dbm - IPW_RSSI_TO_DBM;       /* call it signed anyhow */
7555         u16 pktrate = frame->rate;
7556
7557         /* Magic struct that slots into the radiotap header -- no reason
7558          * to build this manually element by element, we can write it much
7559          * more efficiently than we can parse it. ORDER MATTERS HERE */
7560         struct ipw_rt_hdr {
7561                 struct ieee80211_radiotap_header rt_hdr;
7562                 u8 rt_flags;    /* radiotap packet flags */
7563                 u8 rt_rate;     /* rate in 500kb/s */
7564                 u16 rt_channel; /* channel in mhz */
7565                 u16 rt_chbitmask;       /* channel bitfield */
7566                 s8 rt_dbmsignal;        /* signal in dbM, kluged to signed */
7567                 u8 rt_antenna;  /* antenna number */
7568         } *ipw_rt;
7569
7570         short len = le16_to_cpu(pkt->u.frame.length);
7571
7572         /* We received data from the HW, so stop the watchdog */
7573         priv->net_dev->trans_start = jiffies;
7574
7575         /* We only process data packets if the
7576          * interface is open */
7577         if (unlikely((le16_to_cpu(pkt->u.frame.length) + IPW_RX_FRAME_SIZE) >
7578                      skb_tailroom(rxb->skb))) {
7579                 priv->ieee->stats.rx_errors++;
7580                 priv->wstats.discard.misc++;
7581                 IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
7582                 return;
7583         } else if (unlikely(!netif_running(priv->net_dev))) {
7584                 priv->ieee->stats.rx_dropped++;
7585                 priv->wstats.discard.misc++;
7586                 IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
7587                 return;
7588         }
7589
7590         /* Libpcap 0.9.3+ can handle variable length radiotap, so we'll use
7591          * that now */
7592         if (len > IPW_RX_BUF_SIZE - sizeof(struct ipw_rt_hdr)) {
7593                 /* FIXME: Should alloc bigger skb instead */
7594                 priv->ieee->stats.rx_dropped++;
7595                 priv->wstats.discard.misc++;
7596                 IPW_DEBUG_DROP("Dropping too large packet in monitor\n");
7597                 return;
7598         }
7599
7600         /* copy the frame itself */
7601         memmove(rxb->skb->data + sizeof(struct ipw_rt_hdr),
7602                 rxb->skb->data + IPW_RX_FRAME_SIZE, len);
7603
7604         /* Zero the radiotap static buffer  ...  We only need to zero the bytes NOT
7605          * part of our real header, saves a little time.
7606          *
7607          * No longer necessary since we fill in all our data.  Purge before merging
7608          * patch officially.
7609          * memset(rxb->skb->data + sizeof(struct ipw_rt_hdr), 0,
7610          *        IEEE80211_RADIOTAP_HDRLEN - sizeof(struct ipw_rt_hdr));
7611          */
7612
7613         ipw_rt = (struct ipw_rt_hdr *)rxb->skb->data;
7614
7615         ipw_rt->rt_hdr.it_version = PKTHDR_RADIOTAP_VERSION;
7616         ipw_rt->rt_hdr.it_pad = 0;      /* always good to zero */
7617         ipw_rt->rt_hdr.it_len = sizeof(struct ipw_rt_hdr);      /* total header+data */
7618
7619         /* Big bitfield of all the fields we provide in radiotap */
7620         ipw_rt->rt_hdr.it_present =
7621             ((1 << IEEE80211_RADIOTAP_FLAGS) |
7622              (1 << IEEE80211_RADIOTAP_RATE) |
7623              (1 << IEEE80211_RADIOTAP_CHANNEL) |
7624              (1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL) |
7625              (1 << IEEE80211_RADIOTAP_ANTENNA));
7626
7627         /* Zero the flags, we'll add to them as we go */
7628         ipw_rt->rt_flags = 0;
7629
7630         /* Convert signal to DBM */
7631         ipw_rt->rt_dbmsignal = antsignal;
7632
7633         /* Convert the channel data and set the flags */
7634         ipw_rt->rt_channel = cpu_to_le16(ieee80211chan2mhz(received_channel));
7635         if (received_channel > 14) {    /* 802.11a */
7636                 ipw_rt->rt_chbitmask =
7637                     cpu_to_le16((IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ));
7638         } else if (antennaAndPhy & 32) {        /* 802.11b */
7639                 ipw_rt->rt_chbitmask =
7640                     cpu_to_le16((IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ));
7641         } else {                /* 802.11g */
7642                 ipw_rt->rt_chbitmask =
7643                     (IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ);
7644         }
7645
7646         /* set the rate in multiples of 500k/s */
7647         switch (pktrate) {
7648         case IPW_TX_RATE_1MB:
7649                 ipw_rt->rt_rate = 2;
7650                 break;
7651         case IPW_TX_RATE_2MB:
7652                 ipw_rt->rt_rate = 4;
7653                 break;
7654         case IPW_TX_RATE_5MB:
7655                 ipw_rt->rt_rate = 10;
7656                 break;
7657         case IPW_TX_RATE_6MB:
7658                 ipw_rt->rt_rate = 12;
7659                 break;
7660         case IPW_TX_RATE_9MB:
7661                 ipw_rt->rt_rate = 18;
7662                 break;
7663         case IPW_TX_RATE_11MB:
7664                 ipw_rt->rt_rate = 22;
7665                 break;
7666         case IPW_TX_RATE_12MB:
7667                 ipw_rt->rt_rate = 24;
7668                 break;
7669         case IPW_TX_RATE_18MB:
7670                 ipw_rt->rt_rate = 36;
7671                 break;
7672         case IPW_TX_RATE_24MB:
7673                 ipw_rt->rt_rate = 48;
7674                 break;
7675         case IPW_TX_RATE_36MB:
7676                 ipw_rt->rt_rate = 72;
7677                 break;
7678         case IPW_TX_RATE_48MB:
7679                 ipw_rt->rt_rate = 96;
7680                 break;
7681         case IPW_TX_RATE_54MB:
7682                 ipw_rt->rt_rate = 108;
7683                 break;
7684         default:
7685                 ipw_rt->rt_rate = 0;
7686                 break;
7687         }
7688
7689         /* antenna number */
7690         ipw_rt->rt_antenna = (antennaAndPhy & 3);       /* Is this right? */
7691
7692         /* set the preamble flag if we have it */
7693         if ((antennaAndPhy & 64))
7694                 ipw_rt->rt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
7695
7696         /* Set the size of the skb to the size of the frame */
7697         skb_put(rxb->skb, len + sizeof(struct ipw_rt_hdr));
7698
7699         IPW_DEBUG_RX("Rx packet of %d bytes.\n", rxb->skb->len);
7700
7701         if (!ieee80211_rx(priv->ieee, rxb->skb, stats))
7702                 priv->ieee->stats.rx_errors++;
7703         else {                  /* ieee80211_rx succeeded, so it now owns the SKB */
7704                 rxb->skb = NULL;
7705                 /* no LED during capture */
7706         }
7707 }
7708 #endif
7709
7710 static int is_network_packet(struct ipw_priv *priv,
7711                                     struct ieee80211_hdr_4addr *header)
7712 {
7713         /* Filter incoming packets to determine if they are targetted toward
7714          * this network, discarding packets coming from ourselves */
7715         switch (priv->ieee->iw_mode) {
7716         case IW_MODE_ADHOC:     /* Header: Dest. | Source    | BSSID */
7717                 /* packets from our adapter are dropped (echo) */
7718                 if (!memcmp(header->addr2, priv->net_dev->dev_addr, ETH_ALEN))
7719                         return 0;
7720
7721                 /* {broad,multi}cast packets to our BSSID go through */
7722                 if (is_multicast_ether_addr(header->addr1))
7723                         return !memcmp(header->addr3, priv->bssid, ETH_ALEN);
7724
7725                 /* packets to our adapter go through */
7726                 return !memcmp(header->addr1, priv->net_dev->dev_addr,
7727                                ETH_ALEN);
7728
7729         case IW_MODE_INFRA:     /* Header: Dest. | BSSID | Source */
7730                 /* packets from our adapter are dropped (echo) */
7731                 if (!memcmp(header->addr3, priv->net_dev->dev_addr, ETH_ALEN))
7732                         return 0;
7733
7734                 /* {broad,multi}cast packets to our BSS go through */
7735                 if (is_multicast_ether_addr(header->addr1))
7736                         return !memcmp(header->addr2, priv->bssid, ETH_ALEN);
7737
7738                 /* packets to our adapter go through */
7739                 return !memcmp(header->addr1, priv->net_dev->dev_addr,
7740                                ETH_ALEN);
7741         }
7742
7743         return 1;
7744 }
7745
7746 #define IPW_PACKET_RETRY_TIME HZ
7747
7748 static  int is_duplicate_packet(struct ipw_priv *priv,
7749                                       struct ieee80211_hdr_4addr *header)
7750 {
7751         u16 sc = le16_to_cpu(header->seq_ctl);
7752         u16 seq = WLAN_GET_SEQ_SEQ(sc);
7753         u16 frag = WLAN_GET_SEQ_FRAG(sc);
7754         u16 *last_seq, *last_frag;
7755         unsigned long *last_time;
7756
7757         switch (priv->ieee->iw_mode) {
7758         case IW_MODE_ADHOC:
7759                 {
7760                         struct list_head *p;
7761                         struct ipw_ibss_seq *entry = NULL;
7762                         u8 *mac = header->addr2;
7763                         int index = mac[5] % IPW_IBSS_MAC_HASH_SIZE;
7764
7765                         __list_for_each(p, &priv->ibss_mac_hash[index]) {
7766                                 entry =
7767                                     list_entry(p, struct ipw_ibss_seq, list);
7768                                 if (!memcmp(entry->mac, mac, ETH_ALEN))
7769                                         break;
7770                         }
7771                         if (p == &priv->ibss_mac_hash[index]) {
7772                                 entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
7773                                 if (!entry) {
7774                                         IPW_ERROR
7775                                             ("Cannot malloc new mac entry\n");
7776                                         return 0;
7777                                 }
7778                                 memcpy(entry->mac, mac, ETH_ALEN);
7779                                 entry->seq_num = seq;
7780                                 entry->frag_num = frag;
7781                                 entry->packet_time = jiffies;
7782                                 list_add(&entry->list,
7783                                          &priv->ibss_mac_hash[index]);
7784                                 return 0;
7785                         }
7786                         last_seq = &entry->seq_num;
7787                         last_frag = &entry->frag_num;
7788                         last_time = &entry->packet_time;
7789                         break;
7790                 }
7791         case IW_MODE_INFRA:
7792                 last_seq = &priv->last_seq_num;
7793                 last_frag = &priv->last_frag_num;
7794                 last_time = &priv->last_packet_time;
7795                 break;
7796         default:
7797                 return 0;
7798         }
7799         if ((*last_seq == seq) &&
7800             time_after(*last_time + IPW_PACKET_RETRY_TIME, jiffies)) {
7801                 if (*last_frag == frag)
7802                         goto drop;
7803                 if (*last_frag + 1 != frag)
7804                         /* out-of-order fragment */
7805                         goto drop;
7806         } else
7807                 *last_seq = seq;
7808
7809         *last_frag = frag;
7810         *last_time = jiffies;
7811         return 0;
7812
7813       drop:
7814         /* Comment this line now since we observed the card receives
7815          * duplicate packets but the FCTL_RETRY bit is not set in the
7816          * IBSS mode with fragmentation enabled.
7817          BUG_ON(!(le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_RETRY)); */
7818         return 1;
7819 }
7820
7821 static void ipw_handle_mgmt_packet(struct ipw_priv *priv,
7822                                    struct ipw_rx_mem_buffer *rxb,
7823                                    struct ieee80211_rx_stats *stats)
7824 {
7825         struct sk_buff *skb = rxb->skb;
7826         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)skb->data;
7827         struct ieee80211_hdr_4addr *header = (struct ieee80211_hdr_4addr *)
7828             (skb->data + IPW_RX_FRAME_SIZE);
7829
7830         ieee80211_rx_mgt(priv->ieee, header, stats);
7831
7832         if (priv->ieee->iw_mode == IW_MODE_ADHOC &&
7833             ((WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) ==
7834               IEEE80211_STYPE_PROBE_RESP) ||
7835              (WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) ==
7836               IEEE80211_STYPE_BEACON))) {
7837                 if (!memcmp(header->addr3, priv->bssid, ETH_ALEN))
7838                         ipw_add_station(priv, header->addr2);
7839         }
7840
7841         if (priv->config & CFG_NET_STATS) {
7842                 IPW_DEBUG_HC("sending stat packet\n");
7843
7844                 /* Set the size of the skb to the size of the full
7845                  * ipw header and 802.11 frame */
7846                 skb_put(skb, le16_to_cpu(pkt->u.frame.length) +
7847                         IPW_RX_FRAME_SIZE);
7848
7849                 /* Advance past the ipw packet header to the 802.11 frame */
7850                 skb_pull(skb, IPW_RX_FRAME_SIZE);
7851
7852                 /* Push the ieee80211_rx_stats before the 802.11 frame */
7853                 memcpy(skb_push(skb, sizeof(*stats)), stats, sizeof(*stats));
7854
7855                 skb->dev = priv->ieee->dev;
7856
7857                 /* Point raw at the ieee80211_stats */
7858                 skb->mac.raw = skb->data;
7859
7860                 skb->pkt_type = PACKET_OTHERHOST;
7861                 skb->protocol = __constant_htons(ETH_P_80211_STATS);
7862                 memset(skb->cb, 0, sizeof(rxb->skb->cb));
7863                 netif_rx(skb);
7864                 rxb->skb = NULL;
7865         }
7866 }
7867
7868 /*
7869  * Main entry function for recieving a packet with 80211 headers.  This
7870  * should be called when ever the FW has notified us that there is a new
7871  * skb in the recieve queue.
7872  */
7873 static void ipw_rx(struct ipw_priv *priv)
7874 {
7875         struct ipw_rx_mem_buffer *rxb;
7876         struct ipw_rx_packet *pkt;
7877         struct ieee80211_hdr_4addr *header;
7878         u32 r, w, i;
7879         u8 network_packet;
7880
7881         r = ipw_read32(priv, IPW_RX_READ_INDEX);
7882         w = ipw_read32(priv, IPW_RX_WRITE_INDEX);
7883         i = (priv->rxq->processed + 1) % RX_QUEUE_SIZE;
7884
7885         while (i != r) {
7886                 rxb = priv->rxq->queue[i];
7887 #ifdef CONFIG_IPW2200_DEBUG
7888                 if (unlikely(rxb == NULL)) {
7889                         printk(KERN_CRIT "Queue not allocated!\n");
7890                         break;
7891                 }
7892 #endif
7893                 priv->rxq->queue[i] = NULL;
7894
7895                 pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->dma_addr,
7896                                             IPW_RX_BUF_SIZE,
7897                                             PCI_DMA_FROMDEVICE);
7898
7899                 pkt = (struct ipw_rx_packet *)rxb->skb->data;
7900                 IPW_DEBUG_RX("Packet: type=%02X seq=%02X bits=%02X\n",
7901                              pkt->header.message_type,
7902                              pkt->header.rx_seq_num, pkt->header.control_bits);
7903
7904                 switch (pkt->header.message_type) {
7905                 case RX_FRAME_TYPE:     /* 802.11 frame */  {
7906                                 struct ieee80211_rx_stats stats = {
7907                                         .rssi =
7908                                             le16_to_cpu(pkt->u.frame.rssi_dbm) -
7909                                             IPW_RSSI_TO_DBM,
7910                                         .signal =
7911                                             le16_to_cpu(pkt->u.frame.signal),
7912                                         .noise =
7913                                             le16_to_cpu(pkt->u.frame.noise),
7914                                         .rate = pkt->u.frame.rate,
7915                                         .mac_time = jiffies,
7916                                         .received_channel =
7917                                             pkt->u.frame.received_channel,
7918                                         .freq =
7919                                             (pkt->u.frame.
7920                                              control & (1 << 0)) ?
7921                                             IEEE80211_24GHZ_BAND :
7922                                             IEEE80211_52GHZ_BAND,
7923                                         .len = le16_to_cpu(pkt->u.frame.length),
7924                                 };
7925
7926                                 if (stats.rssi != 0)
7927                                         stats.mask |= IEEE80211_STATMASK_RSSI;
7928                                 if (stats.signal != 0)
7929                                         stats.mask |= IEEE80211_STATMASK_SIGNAL;
7930                                 if (stats.noise != 0)
7931                                         stats.mask |= IEEE80211_STATMASK_NOISE;
7932                                 if (stats.rate != 0)
7933                                         stats.mask |= IEEE80211_STATMASK_RATE;
7934
7935                                 priv->rx_packets++;
7936
7937 #ifdef CONFIG_IPW2200_MONITOR
7938                                 if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
7939 #ifdef CONFIG_IEEE80211_RADIOTAP
7940                                         ipw_handle_data_packet_monitor(priv,
7941                                                                        rxb,
7942                                                                        &stats);
7943 #else
7944                                         ipw_handle_data_packet(priv, rxb,
7945                                                                &stats);
7946 #endif
7947                                         break;
7948                                 }
7949 #endif
7950
7951                                 header =
7952                                     (struct ieee80211_hdr_4addr *)(rxb->skb->
7953                                                                    data +
7954                                                                    IPW_RX_FRAME_SIZE);
7955                                 /* TODO: Check Ad-Hoc dest/source and make sure
7956                                  * that we are actually parsing these packets
7957                                  * correctly -- we should probably use the
7958                                  * frame control of the packet and disregard
7959                                  * the current iw_mode */
7960
7961                                 network_packet =
7962                                     is_network_packet(priv, header);
7963                                 if (network_packet && priv->assoc_network) {
7964                                         priv->assoc_network->stats.rssi =
7965                                             stats.rssi;
7966                                         average_add(&priv->average_rssi,
7967                                                     stats.rssi);
7968                                         priv->last_rx_rssi = stats.rssi;
7969                                 }
7970
7971                                 IPW_DEBUG_RX("Frame: len=%u\n",
7972                                              le16_to_cpu(pkt->u.frame.length));
7973
7974                                 if (le16_to_cpu(pkt->u.frame.length) <
7975                                     frame_hdr_len(header)) {
7976                                         IPW_DEBUG_DROP
7977                                             ("Received packet is too small. "
7978                                              "Dropping.\n");
7979                                         priv->ieee->stats.rx_errors++;
7980                                         priv->wstats.discard.misc++;
7981                                         break;
7982                                 }
7983
7984                                 switch (WLAN_FC_GET_TYPE
7985                                         (le16_to_cpu(header->frame_ctl))) {
7986
7987                                 case IEEE80211_FTYPE_MGMT:
7988                                         ipw_handle_mgmt_packet(priv, rxb,
7989                                                                &stats);
7990                                         break;
7991
7992                                 case IEEE80211_FTYPE_CTL:
7993                                         break;
7994
7995                                 case IEEE80211_FTYPE_DATA:
7996                                         if (unlikely(!network_packet ||
7997                                                      is_duplicate_packet(priv,
7998                                                                          header)))
7999                                         {
8000                                                 IPW_DEBUG_DROP("Dropping: "
8001                                                                MAC_FMT ", "
8002                                                                MAC_FMT ", "
8003                                                                MAC_FMT "\n",
8004                                                                MAC_ARG(header->
8005                                                                        addr1),
8006                                                                MAC_ARG(header->
8007                                                                        addr2),
8008                                                                MAC_ARG(header->
8009                                                                        addr3));
8010                                                 break;
8011                                         }
8012
8013                                         ipw_handle_data_packet(priv, rxb,
8014                                                                &stats);
8015
8016                                         break;
8017                                 }
8018                                 break;
8019                         }
8020
8021                 case RX_HOST_NOTIFICATION_TYPE:{
8022                                 IPW_DEBUG_RX
8023                                     ("Notification: subtype=%02X flags=%02X size=%d\n",
8024                                      pkt->u.notification.subtype,
8025                                      pkt->u.notification.flags,
8026                                      pkt->u.notification.size);
8027                                 ipw_rx_notification(priv, &pkt->u.notification);
8028                                 break;
8029                         }
8030
8031                 default:
8032                         IPW_DEBUG_RX("Bad Rx packet of type %d\n",
8033                                      pkt->header.message_type);
8034                         break;
8035                 }
8036
8037                 /* For now we just don't re-use anything.  We can tweak this
8038                  * later to try and re-use notification packets and SKBs that
8039                  * fail to Rx correctly */
8040                 if (rxb->skb != NULL) {
8041                         dev_kfree_skb_any(rxb->skb);
8042                         rxb->skb = NULL;
8043                 }
8044
8045                 pci_unmap_single(priv->pci_dev, rxb->dma_addr,
8046                                  IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
8047                 list_add_tail(&rxb->list, &priv->rxq->rx_used);
8048
8049                 i = (i + 1) % RX_QUEUE_SIZE;
8050         }
8051
8052         /* Backtrack one entry */
8053         priv->rxq->processed = (i ? i : RX_QUEUE_SIZE) - 1;
8054
8055         ipw_rx_queue_restock(priv);
8056 }
8057
8058 #define DEFAULT_RTS_THRESHOLD     2304U
8059 #define MIN_RTS_THRESHOLD         1U
8060 #define MAX_RTS_THRESHOLD         2304U
8061 #define DEFAULT_BEACON_INTERVAL   100U
8062 #define DEFAULT_SHORT_RETRY_LIMIT 7U
8063 #define DEFAULT_LONG_RETRY_LIMIT  4U
8064
8065 static int ipw_sw_reset(struct ipw_priv *priv, int init)
8066 {
8067         int band, modulation;
8068         int old_mode = priv->ieee->iw_mode;
8069
8070         /* Initialize module parameter values here */
8071         priv->config = 0;
8072
8073         /* We default to disabling the LED code as right now it causes
8074          * too many systems to lock up... */
8075         if (!led)
8076                 priv->config |= CFG_NO_LED;
8077
8078         if (associate)
8079                 priv->config |= CFG_ASSOCIATE;
8080         else
8081                 IPW_DEBUG_INFO("Auto associate disabled.\n");
8082
8083         if (auto_create)
8084                 priv->config |= CFG_ADHOC_CREATE;
8085         else
8086                 IPW_DEBUG_INFO("Auto adhoc creation disabled.\n");
8087
8088         priv->config &= ~CFG_STATIC_ESSID;
8089         priv->essid_len = 0;
8090         memset(priv->essid, 0, IW_ESSID_MAX_SIZE);
8091
8092         if (disable) {
8093                 priv->status |= STATUS_RF_KILL_SW;
8094                 IPW_DEBUG_INFO("Radio disabled.\n");
8095         }
8096
8097         if (channel != 0) {
8098                 priv->config |= CFG_STATIC_CHANNEL;
8099                 priv->channel = channel;
8100                 IPW_DEBUG_INFO("Bind to static channel %d\n", channel);
8101                 /* TODO: Validate that provided channel is in range */
8102         }
8103 #ifdef CONFIG_IPW_QOS
8104         ipw_qos_init(priv, qos_enable, qos_burst_enable,
8105                      burst_duration_CCK, burst_duration_OFDM);
8106 #endif                          /* CONFIG_IPW_QOS */
8107
8108         switch (mode) {
8109         case 1:
8110                 priv->ieee->iw_mode = IW_MODE_ADHOC;
8111                 priv->net_dev->type = ARPHRD_ETHER;
8112
8113                 break;
8114 #ifdef CONFIG_IPW2200_MONITOR
8115         case 2:
8116                 priv->ieee->iw_mode = IW_MODE_MONITOR;
8117 #ifdef CONFIG_IEEE80211_RADIOTAP
8118                 priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
8119 #else
8120                 priv->net_dev->type = ARPHRD_IEEE80211;
8121 #endif
8122                 break;
8123 #endif
8124         default:
8125         case 0:
8126                 priv->net_dev->type = ARPHRD_ETHER;
8127                 priv->ieee->iw_mode = IW_MODE_INFRA;
8128                 break;
8129         }
8130
8131         if (hwcrypto) {
8132                 priv->ieee->host_encrypt = 0;
8133                 priv->ieee->host_encrypt_msdu = 0;
8134                 priv->ieee->host_decrypt = 0;
8135                 priv->ieee->host_mc_decrypt = 0;
8136         }
8137         IPW_DEBUG_INFO("Hardware crypto [%s]\n", hwcrypto ? "on" : "off");
8138
8139         /* IPW2200/2915 is abled to do hardware fragmentation. */
8140         priv->ieee->host_open_frag = 0;
8141
8142         if ((priv->pci_dev->device == 0x4223) ||
8143             (priv->pci_dev->device == 0x4224)) {
8144                 if (init)
8145                         printk(KERN_INFO DRV_NAME
8146                                ": Detected Intel PRO/Wireless 2915ABG Network "
8147                                "Connection\n");
8148                 priv->ieee->abg_true = 1;
8149                 band = IEEE80211_52GHZ_BAND | IEEE80211_24GHZ_BAND;
8150                 modulation = IEEE80211_OFDM_MODULATION |
8151                     IEEE80211_CCK_MODULATION;
8152                 priv->adapter = IPW_2915ABG;
8153                 priv->ieee->mode = IEEE_A | IEEE_G | IEEE_B;
8154         } else {
8155                 if (init)
8156                         printk(KERN_INFO DRV_NAME
8157                                ": Detected Intel PRO/Wireless 2200BG Network "
8158                                "Connection\n");
8159
8160                 priv->ieee->abg_true = 0;
8161                 band = IEEE80211_24GHZ_BAND;
8162                 modulation = IEEE80211_OFDM_MODULATION |
8163                     IEEE80211_CCK_MODULATION;
8164                 priv->adapter = IPW_2200BG;
8165                 priv->ieee->mode = IEEE_G | IEEE_B;
8166         }
8167
8168         priv->ieee->freq_band = band;
8169         priv->ieee->modulation = modulation;
8170
8171         priv->rates_mask = IEEE80211_DEFAULT_RATES_MASK;
8172
8173         priv->disassociate_threshold = IPW_MB_DISASSOCIATE_THRESHOLD_DEFAULT;
8174         priv->roaming_threshold = IPW_MB_ROAMING_THRESHOLD_DEFAULT;
8175
8176         priv->rts_threshold = DEFAULT_RTS_THRESHOLD;
8177         priv->short_retry_limit = DEFAULT_SHORT_RETRY_LIMIT;
8178         priv->long_retry_limit = DEFAULT_LONG_RETRY_LIMIT;
8179
8180         /* If power management is turned on, default to AC mode */
8181         priv->power_mode = IPW_POWER_AC;
8182         priv->tx_power = IPW_TX_POWER_DEFAULT;
8183
8184         return old_mode == priv->ieee->iw_mode;
8185 }
8186
8187 /*
8188  * This file defines the Wireless Extension handlers.  It does not
8189  * define any methods of hardware manipulation and relies on the
8190  * functions defined in ipw_main to provide the HW interaction.
8191  *
8192  * The exception to this is the use of the ipw_get_ordinal()
8193  * function used to poll the hardware vs. making unecessary calls.
8194  *
8195  */
8196
8197 static int ipw_wx_get_name(struct net_device *dev,
8198                            struct iw_request_info *info,
8199                            union iwreq_data *wrqu, char *extra)
8200 {
8201         struct ipw_priv *priv = ieee80211_priv(dev);
8202         down(&priv->sem);
8203         if (priv->status & STATUS_RF_KILL_MASK)
8204                 strcpy(wrqu->name, "radio off");
8205         else if (!(priv->status & STATUS_ASSOCIATED))
8206                 strcpy(wrqu->name, "unassociated");
8207         else
8208                 snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11%c",
8209                          ipw_modes[priv->assoc_request.ieee_mode]);
8210         IPW_DEBUG_WX("Name: %s\n", wrqu->name);
8211         up(&priv->sem);
8212         return 0;
8213 }
8214
8215 static int ipw_set_channel(struct ipw_priv *priv, u8 channel)
8216 {
8217         if (channel == 0) {
8218                 IPW_DEBUG_INFO("Setting channel to ANY (0)\n");
8219                 priv->config &= ~CFG_STATIC_CHANNEL;
8220                 IPW_DEBUG_ASSOC("Attempting to associate with new "
8221                                 "parameters.\n");
8222                 ipw_associate(priv);
8223                 return 0;
8224         }
8225
8226         priv->config |= CFG_STATIC_CHANNEL;
8227
8228         if (priv->channel == channel) {
8229                 IPW_DEBUG_INFO("Request to set channel to current value (%d)\n",
8230                                channel);
8231                 return 0;
8232         }
8233
8234         IPW_DEBUG_INFO("Setting channel to %i\n", (int)channel);
8235         priv->channel = channel;
8236
8237 #ifdef CONFIG_IPW2200_MONITOR
8238         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
8239                 int i;
8240                 if (priv->status & STATUS_SCANNING) {
8241                         IPW_DEBUG_SCAN("Scan abort triggered due to "
8242                                        "channel change.\n");
8243                         ipw_abort_scan(priv);
8244                 }
8245
8246                 for (i = 1000; i && (priv->status & STATUS_SCANNING); i--)
8247                         udelay(10);
8248
8249                 if (priv->status & STATUS_SCANNING)
8250                         IPW_DEBUG_SCAN("Still scanning...\n");
8251                 else
8252                         IPW_DEBUG_SCAN("Took %dms to abort current scan\n",
8253                                        1000 - i);
8254
8255                 return 0;
8256         }
8257 #endif                          /* CONFIG_IPW2200_MONITOR */
8258
8259         /* Network configuration changed -- force [re]association */
8260         IPW_DEBUG_ASSOC("[re]association triggered due to channel change.\n");
8261         if (!ipw_disassociate(priv))
8262                 ipw_associate(priv);
8263
8264         return 0;
8265 }
8266
8267 static int ipw_wx_set_freq(struct net_device *dev,
8268                            struct iw_request_info *info,
8269                            union iwreq_data *wrqu, char *extra)
8270 {
8271         struct ipw_priv *priv = ieee80211_priv(dev);
8272         const struct ieee80211_geo *geo = ipw_get_geo(priv->ieee);
8273         struct iw_freq *fwrq = &wrqu->freq;
8274         int ret = 0, i;
8275         u8 channel, flags;
8276         int band;
8277
8278         if (fwrq->m == 0) {
8279                 IPW_DEBUG_WX("SET Freq/Channel -> any\n");
8280                 down(&priv->sem);
8281                 ret = ipw_set_channel(priv, 0);
8282                 up(&priv->sem);
8283                 return ret;
8284         }
8285         /* if setting by freq convert to channel */
8286         if (fwrq->e == 1) {
8287                 channel = ipw_freq_to_channel(priv->ieee, fwrq->m);
8288                 if (channel == 0)
8289                         return -EINVAL;
8290         } else
8291                 channel = fwrq->m;
8292
8293         if (!(band = ipw_is_valid_channel(priv->ieee, channel)))
8294                 return -EINVAL;
8295
8296         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
8297                 i = ipw_channel_to_index(priv->ieee, channel);
8298                 if (i == -1)
8299                         return -EINVAL;
8300
8301                 flags = (band == IEEE80211_24GHZ_BAND) ?
8302                     geo->bg[i].flags : geo->a[i].flags;
8303                 if (flags & IEEE80211_CH_PASSIVE_ONLY) {
8304                         IPW_DEBUG_WX("Invalid Ad-Hoc channel for 802.11a\n");
8305                         return -EINVAL;
8306                 }
8307         }
8308
8309         IPW_DEBUG_WX("SET Freq/Channel -> %d \n", fwrq->m);
8310         down(&priv->sem);
8311         ret = ipw_set_channel(priv, channel);
8312         up(&priv->sem);
8313         return ret;
8314 }
8315
8316 static int ipw_wx_get_freq(struct net_device *dev,
8317                            struct iw_request_info *info,
8318                            union iwreq_data *wrqu, char *extra)
8319 {
8320         struct ipw_priv *priv = ieee80211_priv(dev);
8321
8322         wrqu->freq.e = 0;
8323
8324         /* If we are associated, trying to associate, or have a statically
8325          * configured CHANNEL then return that; otherwise return ANY */
8326         down(&priv->sem);
8327         if (priv->config & CFG_STATIC_CHANNEL ||
8328             priv->status & (STATUS_ASSOCIATING | STATUS_ASSOCIATED))
8329                 wrqu->freq.m = priv->channel;
8330         else
8331                 wrqu->freq.m = 0;
8332
8333         up(&priv->sem);
8334         IPW_DEBUG_WX("GET Freq/Channel -> %d \n", priv->channel);
8335         return 0;
8336 }
8337
8338 static int ipw_wx_set_mode(struct net_device *dev,
8339                            struct iw_request_info *info,
8340                            union iwreq_data *wrqu, char *extra)
8341 {
8342         struct ipw_priv *priv = ieee80211_priv(dev);
8343         int err = 0;
8344
8345         IPW_DEBUG_WX("Set MODE: %d\n", wrqu->mode);
8346
8347         switch (wrqu->mode) {
8348 #ifdef CONFIG_IPW2200_MONITOR
8349         case IW_MODE_MONITOR:
8350 #endif
8351         case IW_MODE_ADHOC:
8352         case IW_MODE_INFRA:
8353                 break;
8354         case IW_MODE_AUTO:
8355                 wrqu->mode = IW_MODE_INFRA;
8356                 break;
8357         default:
8358                 return -EINVAL;
8359         }
8360         if (wrqu->mode == priv->ieee->iw_mode)
8361                 return 0;
8362
8363         down(&priv->sem);
8364
8365         ipw_sw_reset(priv, 0);
8366
8367 #ifdef CONFIG_IPW2200_MONITOR
8368         if (priv->ieee->iw_mode == IW_MODE_MONITOR)
8369                 priv->net_dev->type = ARPHRD_ETHER;
8370
8371         if (wrqu->mode == IW_MODE_MONITOR)
8372 #ifdef CONFIG_IEEE80211_RADIOTAP
8373                 priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
8374 #else
8375                 priv->net_dev->type = ARPHRD_IEEE80211;
8376 #endif
8377 #endif                          /* CONFIG_IPW2200_MONITOR */
8378
8379         /* Free the existing firmware and reset the fw_loaded
8380          * flag so ipw_load() will bring in the new firmawre */
8381         free_firmware();
8382
8383         priv->ieee->iw_mode = wrqu->mode;
8384
8385         queue_work(priv->workqueue, &priv->adapter_restart);
8386         up(&priv->sem);
8387         return err;
8388 }
8389
8390 static int ipw_wx_get_mode(struct net_device *dev,
8391                            struct iw_request_info *info,
8392                            union iwreq_data *wrqu, char *extra)
8393 {
8394         struct ipw_priv *priv = ieee80211_priv(dev);
8395         down(&priv->sem);
8396         wrqu->mode = priv->ieee->iw_mode;
8397         IPW_DEBUG_WX("Get MODE -> %d\n", wrqu->mode);
8398         up(&priv->sem);
8399         return 0;
8400 }
8401
8402 /* Values are in microsecond */
8403 static const s32 timeout_duration[] = {
8404         350000,
8405         250000,
8406         75000,
8407         37000,
8408         25000,
8409 };
8410
8411 static const s32 period_duration[] = {
8412         400000,
8413         700000,
8414         1000000,
8415         1000000,
8416         1000000
8417 };
8418
8419 static int ipw_wx_get_range(struct net_device *dev,
8420                             struct iw_request_info *info,
8421                             union iwreq_data *wrqu, char *extra)
8422 {
8423         struct ipw_priv *priv = ieee80211_priv(dev);
8424         struct iw_range *range = (struct iw_range *)extra;
8425         const struct ieee80211_geo *geo = ipw_get_geo(priv->ieee);
8426         int i = 0, j;
8427
8428         wrqu->data.length = sizeof(*range);
8429         memset(range, 0, sizeof(*range));
8430
8431         /* 54Mbs == ~27 Mb/s real (802.11g) */
8432         range->throughput = 27 * 1000 * 1000;
8433
8434         range->max_qual.qual = 100;
8435         /* TODO: Find real max RSSI and stick here */
8436         range->max_qual.level = 0;
8437         range->max_qual.noise = priv->ieee->worst_rssi + 0x100;
8438         range->max_qual.updated = 7;    /* Updated all three */
8439
8440         range->avg_qual.qual = 70;
8441         /* TODO: Find real 'good' to 'bad' threshol value for RSSI */
8442         range->avg_qual.level = 0;      /* FIXME to real average level */
8443         range->avg_qual.noise = 0;
8444         range->avg_qual.updated = 7;    /* Updated all three */
8445         down(&priv->sem);
8446         range->num_bitrates = min(priv->rates.num_rates, (u8) IW_MAX_BITRATES);
8447
8448         for (i = 0; i < range->num_bitrates; i++)
8449                 range->bitrate[i] = (priv->rates.supported_rates[i] & 0x7F) *
8450                     500000;
8451
8452         range->max_rts = DEFAULT_RTS_THRESHOLD;
8453         range->min_frag = MIN_FRAG_THRESHOLD;
8454         range->max_frag = MAX_FRAG_THRESHOLD;
8455
8456         range->encoding_size[0] = 5;
8457         range->encoding_size[1] = 13;
8458         range->num_encoding_sizes = 2;
8459         range->max_encoding_tokens = WEP_KEYS;
8460
8461         /* Set the Wireless Extension versions */
8462         range->we_version_compiled = WIRELESS_EXT;
8463         range->we_version_source = 16;
8464
8465         i = 0;
8466         if (priv->ieee->mode & (IEEE_B | IEEE_G)) {
8467                 for (j = 0; j < geo->bg_channels && i < IW_MAX_FREQUENCIES;
8468                      i++, j++) {
8469                         range->freq[i].i = geo->bg[j].channel;
8470                         range->freq[i].m = geo->bg[j].freq * 100000;
8471                         range->freq[i].e = 1;
8472                 }
8473         }
8474
8475         if (priv->ieee->mode & IEEE_A) {
8476                 for (j = 0; j < geo->a_channels && i < IW_MAX_FREQUENCIES;
8477                      i++, j++) {
8478                         range->freq[i].i = geo->a[j].channel;
8479                         range->freq[i].m = geo->a[j].freq * 100000;
8480                         range->freq[i].e = 1;
8481                 }
8482         }
8483
8484         range->num_channels = i;
8485         range->num_frequency = i;
8486
8487         up(&priv->sem);
8488
8489         /* Event capability (kernel + driver) */
8490         range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
8491                                 IW_EVENT_CAPA_MASK(SIOCGIWTHRSPY) |
8492                                 IW_EVENT_CAPA_MASK(SIOCGIWAP));
8493         range->event_capa[1] = IW_EVENT_CAPA_K_1;
8494
8495         IPW_DEBUG_WX("GET Range\n");
8496         return 0;
8497 }
8498
8499 static int ipw_wx_set_wap(struct net_device *dev,
8500                           struct iw_request_info *info,
8501                           union iwreq_data *wrqu, char *extra)
8502 {
8503         struct ipw_priv *priv = ieee80211_priv(dev);
8504
8505         static const unsigned char any[] = {
8506                 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
8507         };
8508         static const unsigned char off[] = {
8509                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
8510         };
8511
8512         if (wrqu->ap_addr.sa_family != ARPHRD_ETHER)
8513                 return -EINVAL;
8514         down(&priv->sem);
8515         if (!memcmp(any, wrqu->ap_addr.sa_data, ETH_ALEN) ||
8516             !memcmp(off, wrqu->ap_addr.sa_data, ETH_ALEN)) {
8517                 /* we disable mandatory BSSID association */
8518                 IPW_DEBUG_WX("Setting AP BSSID to ANY\n");
8519                 priv->config &= ~CFG_STATIC_BSSID;
8520                 IPW_DEBUG_ASSOC("Attempting to associate with new "
8521                                 "parameters.\n");
8522                 ipw_associate(priv);
8523                 up(&priv->sem);
8524                 return 0;
8525         }
8526
8527         priv->config |= CFG_STATIC_BSSID;
8528         if (!memcmp(priv->bssid, wrqu->ap_addr.sa_data, ETH_ALEN)) {
8529                 IPW_DEBUG_WX("BSSID set to current BSSID.\n");
8530                 up(&priv->sem);
8531                 return 0;
8532         }
8533
8534         IPW_DEBUG_WX("Setting mandatory BSSID to " MAC_FMT "\n",
8535                      MAC_ARG(wrqu->ap_addr.sa_data));
8536
8537         memcpy(priv->bssid, wrqu->ap_addr.sa_data, ETH_ALEN);
8538
8539         /* Network configuration changed -- force [re]association */
8540         IPW_DEBUG_ASSOC("[re]association triggered due to BSSID change.\n");
8541         if (!ipw_disassociate(priv))
8542                 ipw_associate(priv);
8543
8544         up(&priv->sem);
8545         return 0;
8546 }
8547
8548 static int ipw_wx_get_wap(struct net_device *dev,
8549                           struct iw_request_info *info,
8550                           union iwreq_data *wrqu, char *extra)
8551 {
8552         struct ipw_priv *priv = ieee80211_priv(dev);
8553         /* If we are associated, trying to associate, or have a statically
8554          * configured BSSID then return that; otherwise return ANY */
8555         down(&priv->sem);
8556         if (priv->config & CFG_STATIC_BSSID ||
8557             priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
8558                 wrqu->ap_addr.sa_family = ARPHRD_ETHER;
8559                 memcpy(wrqu->ap_addr.sa_data, priv->bssid, ETH_ALEN);
8560         } else
8561                 memset(wrqu->ap_addr.sa_data, 0, ETH_ALEN);
8562
8563         IPW_DEBUG_WX("Getting WAP BSSID: " MAC_FMT "\n",
8564                      MAC_ARG(wrqu->ap_addr.sa_data));
8565         up(&priv->sem);
8566         return 0;
8567 }
8568
8569 static int ipw_wx_set_essid(struct net_device *dev,
8570                             struct iw_request_info *info,
8571                             union iwreq_data *wrqu, char *extra)
8572 {
8573         struct ipw_priv *priv = ieee80211_priv(dev);
8574         char *essid = "";       /* ANY */
8575         int length = 0;
8576         down(&priv->sem);
8577         if (wrqu->essid.flags && wrqu->essid.length) {
8578                 length = wrqu->essid.length - 1;
8579                 essid = extra;
8580         }
8581         if (length == 0) {
8582                 IPW_DEBUG_WX("Setting ESSID to ANY\n");
8583                 if ((priv->config & CFG_STATIC_ESSID) &&
8584                     !(priv->status & (STATUS_ASSOCIATED |
8585                                       STATUS_ASSOCIATING))) {
8586                         IPW_DEBUG_ASSOC("Attempting to associate with new "
8587                                         "parameters.\n");
8588                         priv->config &= ~CFG_STATIC_ESSID;
8589                         ipw_associate(priv);
8590                 }
8591                 up(&priv->sem);
8592                 return 0;
8593         }
8594
8595         length = min(length, IW_ESSID_MAX_SIZE);
8596
8597         priv->config |= CFG_STATIC_ESSID;
8598
8599         if (priv->essid_len == length && !memcmp(priv->essid, extra, length)) {
8600                 IPW_DEBUG_WX("ESSID set to current ESSID.\n");
8601                 up(&priv->sem);
8602                 return 0;
8603         }
8604
8605         IPW_DEBUG_WX("Setting ESSID: '%s' (%d)\n", escape_essid(essid, length),
8606                      length);
8607
8608         priv->essid_len = length;
8609         memcpy(priv->essid, essid, priv->essid_len);
8610
8611         /* Network configuration changed -- force [re]association */
8612         IPW_DEBUG_ASSOC("[re]association triggered due to ESSID change.\n");
8613         if (!ipw_disassociate(priv))
8614                 ipw_associate(priv);
8615
8616         up(&priv->sem);
8617         return 0;
8618 }
8619
8620 static int ipw_wx_get_essid(struct net_device *dev,
8621                             struct iw_request_info *info,
8622                             union iwreq_data *wrqu, char *extra)
8623 {
8624         struct ipw_priv *priv = ieee80211_priv(dev);
8625
8626         /* If we are associated, trying to associate, or have a statically
8627          * configured ESSID then return that; otherwise return ANY */
8628         down(&priv->sem);
8629         if (priv->config & CFG_STATIC_ESSID ||
8630             priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
8631                 IPW_DEBUG_WX("Getting essid: '%s'\n",
8632                              escape_essid(priv->essid, priv->essid_len));
8633                 memcpy(extra, priv->essid, priv->essid_len);
8634                 wrqu->essid.length = priv->essid_len;
8635                 wrqu->essid.flags = 1;  /* active */
8636         } else {
8637                 IPW_DEBUG_WX("Getting essid: ANY\n");
8638                 wrqu->essid.length = 0;
8639                 wrqu->essid.flags = 0;  /* active */
8640         }
8641         up(&priv->sem);
8642         return 0;
8643 }
8644
8645 static int ipw_wx_set_nick(struct net_device *dev,
8646                            struct iw_request_info *info,
8647                            union iwreq_data *wrqu, char *extra)
8648 {
8649         struct ipw_priv *priv = ieee80211_priv(dev);
8650
8651         IPW_DEBUG_WX("Setting nick to '%s'\n", extra);
8652         if (wrqu->data.length > IW_ESSID_MAX_SIZE)
8653                 return -E2BIG;
8654         down(&priv->sem);
8655         wrqu->data.length = min((size_t) wrqu->data.length, sizeof(priv->nick));
8656         memset(priv->nick, 0, sizeof(priv->nick));
8657         memcpy(priv->nick, extra, wrqu->data.length);
8658         IPW_DEBUG_TRACE("<<\n");
8659         up(&priv->sem);
8660         return 0;
8661
8662 }
8663
8664 static int ipw_wx_get_nick(struct net_device *dev,
8665                            struct iw_request_info *info,
8666                            union iwreq_data *wrqu, char *extra)
8667 {
8668         struct ipw_priv *priv = ieee80211_priv(dev);
8669         IPW_DEBUG_WX("Getting nick\n");
8670         down(&priv->sem);
8671         wrqu->data.length = strlen(priv->nick) + 1;
8672         memcpy(extra, priv->nick, wrqu->data.length);
8673         wrqu->data.flags = 1;   /* active */
8674         up(&priv->sem);
8675         return 0;
8676 }
8677
8678 static int ipw_wx_set_rate(struct net_device *dev,
8679                            struct iw_request_info *info,
8680                            union iwreq_data *wrqu, char *extra)
8681 {
8682         /* TODO: We should use semaphores or locks for access to priv */
8683         struct ipw_priv *priv = ieee80211_priv(dev);
8684         u32 target_rate = wrqu->bitrate.value;
8685         u32 fixed, mask;
8686
8687         /* value = -1, fixed = 0 means auto only, so we should use all rates offered by AP */
8688         /* value = X, fixed = 1 means only rate X */
8689         /* value = X, fixed = 0 means all rates lower equal X */
8690
8691         if (target_rate == -1) {
8692                 fixed = 0;
8693                 mask = IEEE80211_DEFAULT_RATES_MASK;
8694                 /* Now we should reassociate */
8695                 goto apply;
8696         }
8697
8698         mask = 0;
8699         fixed = wrqu->bitrate.fixed;
8700
8701         if (target_rate == 1000000 || !fixed)
8702                 mask |= IEEE80211_CCK_RATE_1MB_MASK;
8703         if (target_rate == 1000000)
8704                 goto apply;
8705
8706         if (target_rate == 2000000 || !fixed)
8707                 mask |= IEEE80211_CCK_RATE_2MB_MASK;
8708         if (target_rate == 2000000)
8709                 goto apply;
8710
8711         if (target_rate == 5500000 || !fixed)
8712                 mask |= IEEE80211_CCK_RATE_5MB_MASK;
8713         if (target_rate == 5500000)
8714                 goto apply;
8715
8716         if (target_rate == 6000000 || !fixed)
8717                 mask |= IEEE80211_OFDM_RATE_6MB_MASK;
8718         if (target_rate == 6000000)
8719                 goto apply;
8720
8721         if (target_rate == 9000000 || !fixed)
8722                 mask |= IEEE80211_OFDM_RATE_9MB_MASK;
8723         if (target_rate == 9000000)
8724                 goto apply;
8725
8726         if (target_rate == 11000000 || !fixed)
8727                 mask |= IEEE80211_CCK_RATE_11MB_MASK;
8728         if (target_rate == 11000000)
8729                 goto apply;
8730
8731         if (target_rate == 12000000 || !fixed)
8732                 mask |= IEEE80211_OFDM_RATE_12MB_MASK;
8733         if (target_rate == 12000000)
8734                 goto apply;
8735
8736         if (target_rate == 18000000 || !fixed)
8737                 mask |= IEEE80211_OFDM_RATE_18MB_MASK;
8738         if (target_rate == 18000000)
8739                 goto apply;
8740
8741         if (target_rate == 24000000 || !fixed)
8742                 mask |= IEEE80211_OFDM_RATE_24MB_MASK;
8743         if (target_rate == 24000000)
8744                 goto apply;
8745
8746         if (target_rate == 36000000 || !fixed)
8747                 mask |= IEEE80211_OFDM_RATE_36MB_MASK;
8748         if (target_rate == 36000000)
8749                 goto apply;
8750
8751         if (target_rate == 48000000 || !fixed)
8752                 mask |= IEEE80211_OFDM_RATE_48MB_MASK;
8753         if (target_rate == 48000000)
8754                 goto apply;
8755
8756         if (target_rate == 54000000 || !fixed)
8757                 mask |= IEEE80211_OFDM_RATE_54MB_MASK;
8758         if (target_rate == 54000000)
8759                 goto apply;
8760
8761         IPW_DEBUG_WX("invalid rate specified, returning error\n");
8762         return -EINVAL;
8763
8764       apply:
8765         IPW_DEBUG_WX("Setting rate mask to 0x%08X [%s]\n",
8766                      mask, fixed ? "fixed" : "sub-rates");
8767         down(&priv->sem);
8768         if (mask == IEEE80211_DEFAULT_RATES_MASK) {
8769                 priv->config &= ~CFG_FIXED_RATE;
8770                 ipw_set_fixed_rate(priv, priv->ieee->mode);
8771         } else
8772                 priv->config |= CFG_FIXED_RATE;
8773
8774         if (priv->rates_mask == mask) {
8775                 IPW_DEBUG_WX("Mask set to current mask.\n");
8776                 up(&priv->sem);
8777                 return 0;
8778         }
8779
8780         priv->rates_mask = mask;
8781
8782         /* Network configuration changed -- force [re]association */
8783         IPW_DEBUG_ASSOC("[re]association triggered due to rates change.\n");
8784         if (!ipw_disassociate(priv))
8785                 ipw_associate(priv);
8786
8787         up(&priv->sem);
8788         return 0;
8789 }
8790
8791 static int ipw_wx_get_rate(struct net_device *dev,
8792                            struct iw_request_info *info,
8793                            union iwreq_data *wrqu, char *extra)
8794 {
8795         struct ipw_priv *priv = ieee80211_priv(dev);
8796         down(&priv->sem);
8797         wrqu->bitrate.value = priv->last_rate;
8798         up(&priv->sem);
8799         IPW_DEBUG_WX("GET Rate -> %d \n", wrqu->bitrate.value);
8800         return 0;
8801 }
8802
8803 static int ipw_wx_set_rts(struct net_device *dev,
8804                           struct iw_request_info *info,
8805                           union iwreq_data *wrqu, char *extra)
8806 {
8807         struct ipw_priv *priv = ieee80211_priv(dev);
8808         down(&priv->sem);
8809         if (wrqu->rts.disabled)
8810                 priv->rts_threshold = DEFAULT_RTS_THRESHOLD;
8811         else {
8812                 if (wrqu->rts.value < MIN_RTS_THRESHOLD ||
8813                     wrqu->rts.value > MAX_RTS_THRESHOLD) {
8814                         up(&priv->sem);
8815                         return -EINVAL;
8816                 }
8817                 priv->rts_threshold = wrqu->rts.value;
8818         }
8819
8820         ipw_send_rts_threshold(priv, priv->rts_threshold);
8821         up(&priv->sem);
8822         IPW_DEBUG_WX("SET RTS Threshold -> %d \n", priv->rts_threshold);
8823         return 0;
8824 }
8825
8826 static int ipw_wx_get_rts(struct net_device *dev,
8827                           struct iw_request_info *info,
8828                           union iwreq_data *wrqu, char *extra)
8829 {
8830         struct ipw_priv *priv = ieee80211_priv(dev);
8831         down(&priv->sem);
8832         wrqu->rts.value = priv->rts_threshold;
8833         wrqu->rts.fixed = 0;    /* no auto select */
8834         wrqu->rts.disabled = (wrqu->rts.value == DEFAULT_RTS_THRESHOLD);
8835         up(&priv->sem);
8836         IPW_DEBUG_WX("GET RTS Threshold -> %d \n", wrqu->rts.value);
8837         return 0;
8838 }
8839
8840 static int ipw_wx_set_txpow(struct net_device *dev,
8841                             struct iw_request_info *info,
8842                             union iwreq_data *wrqu, char *extra)
8843 {
8844         struct ipw_priv *priv = ieee80211_priv(dev);
8845         int err = 0;
8846
8847         down(&priv->sem);
8848         if (ipw_radio_kill_sw(priv, wrqu->power.disabled)) {
8849                 err = -EINPROGRESS;
8850                 goto out;
8851         }
8852
8853         if (!wrqu->power.fixed)
8854                 wrqu->power.value = IPW_TX_POWER_DEFAULT;
8855
8856         if (wrqu->power.flags != IW_TXPOW_DBM) {
8857                 err = -EINVAL;
8858                 goto out;
8859         }
8860
8861         if ((wrqu->power.value > IPW_TX_POWER_MAX) ||
8862             (wrqu->power.value < IPW_TX_POWER_MIN)) {
8863                 err = -EINVAL;
8864                 goto out;
8865         }
8866
8867         priv->tx_power = wrqu->power.value;
8868         err = ipw_set_tx_power(priv);
8869       out:
8870         up(&priv->sem);
8871         return err;
8872 }
8873
8874 static int ipw_wx_get_txpow(struct net_device *dev,
8875                             struct iw_request_info *info,
8876                             union iwreq_data *wrqu, char *extra)
8877 {
8878         struct ipw_priv *priv = ieee80211_priv(dev);
8879         down(&priv->sem);
8880         wrqu->power.value = priv->tx_power;
8881         wrqu->power.fixed = 1;
8882         wrqu->power.flags = IW_TXPOW_DBM;
8883         wrqu->power.disabled = (priv->status & STATUS_RF_KILL_MASK) ? 1 : 0;
8884         up(&priv->sem);
8885
8886         IPW_DEBUG_WX("GET TX Power -> %s %d \n",
8887                      wrqu->power.disabled ? "OFF" : "ON", wrqu->power.value);
8888
8889         return 0;
8890 }
8891
8892 static int ipw_wx_set_frag(struct net_device *dev,
8893                            struct iw_request_info *info,
8894                            union iwreq_data *wrqu, char *extra)
8895 {
8896         struct ipw_priv *priv = ieee80211_priv(dev);
8897         down(&priv->sem);
8898         if (wrqu->frag.disabled)
8899                 priv->ieee->fts = DEFAULT_FTS;
8900         else {
8901                 if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
8902                     wrqu->frag.value > MAX_FRAG_THRESHOLD) {
8903                         up(&priv->sem);
8904                         return -EINVAL;
8905                 }
8906
8907                 priv->ieee->fts = wrqu->frag.value & ~0x1;
8908         }
8909
8910         ipw_send_frag_threshold(priv, wrqu->frag.value);
8911         up(&priv->sem);
8912         IPW_DEBUG_WX("SET Frag Threshold -> %d \n", wrqu->frag.value);
8913         return 0;
8914 }
8915
8916 static int ipw_wx_get_frag(struct net_device *dev,
8917                            struct iw_request_info *info,
8918                            union iwreq_data *wrqu, char *extra)
8919 {
8920         struct ipw_priv *priv = ieee80211_priv(dev);
8921         down(&priv->sem);
8922         wrqu->frag.value = priv->ieee->fts;
8923         wrqu->frag.fixed = 0;   /* no auto select */
8924         wrqu->frag.disabled = (wrqu->frag.value == DEFAULT_FTS);
8925         up(&priv->sem);
8926         IPW_DEBUG_WX("GET Frag Threshold -> %d \n", wrqu->frag.value);
8927
8928         return 0;
8929 }
8930
8931 static int ipw_wx_set_retry(struct net_device *dev,
8932                             struct iw_request_info *info,
8933                             union iwreq_data *wrqu, char *extra)
8934 {
8935         struct ipw_priv *priv = ieee80211_priv(dev);
8936
8937         if (wrqu->retry.flags & IW_RETRY_LIFETIME || wrqu->retry.disabled)
8938                 return -EINVAL;
8939
8940         if (!(wrqu->retry.flags & IW_RETRY_LIMIT))
8941                 return 0;
8942
8943         if (wrqu->retry.value < 0 || wrqu->retry.value > 255)
8944                 return -EINVAL;
8945
8946         down(&priv->sem);
8947         if (wrqu->retry.flags & IW_RETRY_MIN)
8948                 priv->short_retry_limit = (u8) wrqu->retry.value;
8949         else if (wrqu->retry.flags & IW_RETRY_MAX)
8950                 priv->long_retry_limit = (u8) wrqu->retry.value;
8951         else {
8952                 priv->short_retry_limit = (u8) wrqu->retry.value;
8953                 priv->long_retry_limit = (u8) wrqu->retry.value;
8954         }
8955
8956         ipw_send_retry_limit(priv, priv->short_retry_limit,
8957                              priv->long_retry_limit);
8958         up(&priv->sem);
8959         IPW_DEBUG_WX("SET retry limit -> short:%d long:%d\n",
8960                      priv->short_retry_limit, priv->long_retry_limit);
8961         return 0;
8962 }
8963
8964 static int ipw_wx_get_retry(struct net_device *dev,
8965                             struct iw_request_info *info,
8966                             union iwreq_data *wrqu, char *extra)
8967 {
8968         struct ipw_priv *priv = ieee80211_priv(dev);
8969
8970         down(&priv->sem);
8971         wrqu->retry.disabled = 0;
8972
8973         if ((wrqu->retry.flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME) {
8974                 up(&priv->sem);
8975                 return -EINVAL;
8976         }
8977
8978         if (wrqu->retry.flags & IW_RETRY_MAX) {
8979                 wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
8980                 wrqu->retry.value = priv->long_retry_limit;
8981         } else if (wrqu->retry.flags & IW_RETRY_MIN) {
8982                 wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_MIN;
8983                 wrqu->retry.value = priv->short_retry_limit;
8984         } else {
8985                 wrqu->retry.flags = IW_RETRY_LIMIT;
8986                 wrqu->retry.value = priv->short_retry_limit;
8987         }
8988         up(&priv->sem);
8989
8990         IPW_DEBUG_WX("GET retry -> %d \n", wrqu->retry.value);
8991
8992         return 0;
8993 }
8994
8995 static int ipw_request_direct_scan(struct ipw_priv *priv, char *essid,
8996                                    int essid_len)
8997 {
8998         struct ipw_scan_request_ext scan;
8999         int err = 0, scan_type;
9000
9001         if (!(priv->status & STATUS_INIT) ||
9002             (priv->status & STATUS_EXIT_PENDING))
9003                 return 0;
9004
9005         down(&priv->sem);
9006
9007         if (priv->status & STATUS_RF_KILL_MASK) {
9008                 IPW_DEBUG_HC("Aborting scan due to RF kill activation\n");
9009                 priv->status |= STATUS_SCAN_PENDING;
9010                 goto done;
9011         }
9012
9013         IPW_DEBUG_HC("starting request direct scan!\n");
9014
9015         if (priv->status & (STATUS_SCANNING | STATUS_SCAN_ABORTING)) {
9016                 /* We should not sleep here; otherwise we will block most
9017                  * of the system (for instance, we hold rtnl_lock when we
9018                  * get here).
9019                  */
9020                 err = -EAGAIN;
9021                 goto done;
9022         }
9023         memset(&scan, 0, sizeof(scan));
9024
9025         if (priv->config & CFG_SPEED_SCAN)
9026                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
9027                     cpu_to_le16(30);
9028         else
9029                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
9030                     cpu_to_le16(20);
9031
9032         scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN] =
9033             cpu_to_le16(20);
9034         scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = cpu_to_le16(120);
9035         scan.dwell_time[IPW_SCAN_ACTIVE_DIRECT_SCAN] = cpu_to_le16(20);
9036
9037         scan.full_scan_index = cpu_to_le32(ieee80211_get_scans(priv->ieee));
9038
9039         err = ipw_send_ssid(priv, essid, essid_len);
9040         if (err) {
9041                 IPW_DEBUG_HC("Attempt to send SSID command failed\n");
9042                 goto done;
9043         }
9044         scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
9045
9046         ipw_add_scan_channels(priv, &scan, scan_type);
9047
9048         err = ipw_send_scan_request_ext(priv, &scan);
9049         if (err) {
9050                 IPW_DEBUG_HC("Sending scan command failed: %08X\n", err);
9051                 goto done;
9052         }
9053
9054         priv->status |= STATUS_SCANNING;
9055
9056       done:
9057         up(&priv->sem);
9058         return err;
9059 }
9060
9061 static int ipw_wx_set_scan(struct net_device *dev,
9062                            struct iw_request_info *info,
9063                            union iwreq_data *wrqu, char *extra)
9064 {
9065         struct ipw_priv *priv = ieee80211_priv(dev);
9066         struct iw_scan_req *req = NULL;
9067         if (wrqu->data.length
9068             && wrqu->data.length == sizeof(struct iw_scan_req)) {
9069                 req = (struct iw_scan_req *)extra;
9070                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
9071                         ipw_request_direct_scan(priv, req->essid,
9072                                                 req->essid_len);
9073                         return 0;
9074                 }
9075         }
9076
9077         IPW_DEBUG_WX("Start scan\n");
9078
9079         queue_work(priv->workqueue, &priv->request_scan);
9080
9081         return 0;
9082 }
9083
9084 static int ipw_wx_get_scan(struct net_device *dev,
9085                            struct iw_request_info *info,
9086                            union iwreq_data *wrqu, char *extra)
9087 {
9088         struct ipw_priv *priv = ieee80211_priv(dev);
9089         return ieee80211_wx_get_scan(priv->ieee, info, wrqu, extra);
9090 }
9091
9092 static int ipw_wx_set_encode(struct net_device *dev,
9093                              struct iw_request_info *info,
9094                              union iwreq_data *wrqu, char *key)
9095 {
9096         struct ipw_priv *priv = ieee80211_priv(dev);
9097         int ret;
9098         u32 cap = priv->capability;
9099
9100         down(&priv->sem);
9101         ret = ieee80211_wx_set_encode(priv->ieee, info, wrqu, key);
9102
9103         /* In IBSS mode, we need to notify the firmware to update
9104          * the beacon info after we changed the capability. */
9105         if (cap != priv->capability &&
9106             priv->ieee->iw_mode == IW_MODE_ADHOC &&
9107             priv->status & STATUS_ASSOCIATED)
9108                 ipw_disassociate(priv);
9109
9110         up(&priv->sem);
9111         return ret;
9112 }
9113
9114 static int ipw_wx_get_encode(struct net_device *dev,
9115                              struct iw_request_info *info,
9116                              union iwreq_data *wrqu, char *key)
9117 {
9118         struct ipw_priv *priv = ieee80211_priv(dev);
9119         return ieee80211_wx_get_encode(priv->ieee, info, wrqu, key);
9120 }
9121
9122 static int ipw_wx_set_power(struct net_device *dev,
9123                             struct iw_request_info *info,
9124                             union iwreq_data *wrqu, char *extra)
9125 {
9126         struct ipw_priv *priv = ieee80211_priv(dev);
9127         int err;
9128         down(&priv->sem);
9129         if (wrqu->power.disabled) {
9130                 priv->power_mode = IPW_POWER_LEVEL(priv->power_mode);
9131                 err = ipw_send_power_mode(priv, IPW_POWER_MODE_CAM);
9132                 if (err) {
9133                         IPW_DEBUG_WX("failed setting power mode.\n");
9134                         up(&priv->sem);
9135                         return err;
9136                 }
9137                 IPW_DEBUG_WX("SET Power Management Mode -> off\n");
9138                 up(&priv->sem);
9139                 return 0;
9140         }
9141
9142         switch (wrqu->power.flags & IW_POWER_MODE) {
9143         case IW_POWER_ON:       /* If not specified */
9144         case IW_POWER_MODE:     /* If set all mask */
9145         case IW_POWER_ALL_R:    /* If explicitely state all */
9146                 break;
9147         default:                /* Otherwise we don't support it */
9148                 IPW_DEBUG_WX("SET PM Mode: %X not supported.\n",
9149                              wrqu->power.flags);
9150                 up(&priv->sem);
9151                 return -EOPNOTSUPP;
9152         }
9153
9154         /* If the user hasn't specified a power management mode yet, default
9155          * to BATTERY */
9156         if (IPW_POWER_LEVEL(priv->power_mode) == IPW_POWER_AC)
9157                 priv->power_mode = IPW_POWER_ENABLED | IPW_POWER_BATTERY;
9158         else
9159                 priv->power_mode = IPW_POWER_ENABLED | priv->power_mode;
9160         err = ipw_send_power_mode(priv, IPW_POWER_LEVEL(priv->power_mode));
9161         if (err) {
9162                 IPW_DEBUG_WX("failed setting power mode.\n");
9163                 up(&priv->sem);
9164                 return err;
9165         }
9166
9167         IPW_DEBUG_WX("SET Power Management Mode -> 0x%02X\n", priv->power_mode);
9168         up(&priv->sem);
9169         return 0;
9170 }
9171
9172 static int ipw_wx_get_power(struct net_device *dev,
9173                             struct iw_request_info *info,
9174                             union iwreq_data *wrqu, char *extra)
9175 {
9176         struct ipw_priv *priv = ieee80211_priv(dev);
9177         down(&priv->sem);
9178         if (!(priv->power_mode & IPW_POWER_ENABLED))
9179                 wrqu->power.disabled = 1;
9180         else
9181                 wrqu->power.disabled = 0;
9182
9183         up(&priv->sem);
9184         IPW_DEBUG_WX("GET Power Management Mode -> %02X\n", priv->power_mode);
9185
9186         return 0;
9187 }
9188
9189 static int ipw_wx_set_powermode(struct net_device *dev,
9190                                 struct iw_request_info *info,
9191                                 union iwreq_data *wrqu, char *extra)
9192 {
9193         struct ipw_priv *priv = ieee80211_priv(dev);
9194         int mode = *(int *)extra;
9195         int err;
9196         down(&priv->sem);
9197         if ((mode < 1) || (mode > IPW_POWER_LIMIT)) {
9198                 mode = IPW_POWER_AC;
9199                 priv->power_mode = mode;
9200         } else {
9201                 priv->power_mode = IPW_POWER_ENABLED | mode;
9202         }
9203
9204         if (priv->power_mode != mode) {
9205                 err = ipw_send_power_mode(priv, mode);
9206
9207                 if (err) {
9208                         IPW_DEBUG_WX("failed setting power mode.\n");
9209                         up(&priv->sem);
9210                         return err;
9211                 }
9212         }
9213         up(&priv->sem);
9214         return 0;
9215 }
9216
9217 #define MAX_WX_STRING 80
9218 static int ipw_wx_get_powermode(struct net_device *dev,
9219                                 struct iw_request_info *info,
9220                                 union iwreq_data *wrqu, char *extra)
9221 {
9222         struct ipw_priv *priv = ieee80211_priv(dev);
9223         int level = IPW_POWER_LEVEL(priv->power_mode);
9224         char *p = extra;
9225
9226         p += snprintf(p, MAX_WX_STRING, "Power save level: %d ", level);
9227
9228         switch (level) {
9229         case IPW_POWER_AC:
9230                 p += snprintf(p, MAX_WX_STRING - (p - extra), "(AC)");
9231                 break;
9232         case IPW_POWER_BATTERY:
9233                 p += snprintf(p, MAX_WX_STRING - (p - extra), "(BATTERY)");
9234                 break;
9235         default:
9236                 p += snprintf(p, MAX_WX_STRING - (p - extra),
9237                               "(Timeout %dms, Period %dms)",
9238                               timeout_duration[level - 1] / 1000,
9239                               period_duration[level - 1] / 1000);
9240         }
9241
9242         if (!(priv->power_mode & IPW_POWER_ENABLED))
9243                 p += snprintf(p, MAX_WX_STRING - (p - extra), " OFF");
9244
9245         wrqu->data.length = p - extra + 1;
9246
9247         return 0;
9248 }
9249
9250 static int ipw_wx_set_wireless_mode(struct net_device *dev,
9251                                     struct iw_request_info *info,
9252                                     union iwreq_data *wrqu, char *extra)
9253 {
9254         struct ipw_priv *priv = ieee80211_priv(dev);
9255         int mode = *(int *)extra;
9256         u8 band = 0, modulation = 0;
9257
9258         if (mode == 0 || mode & ~IEEE_MODE_MASK) {
9259                 IPW_WARNING("Attempt to set invalid wireless mode: %d\n", mode);
9260                 return -EINVAL;
9261         }
9262         down(&priv->sem);
9263         if (priv->adapter == IPW_2915ABG) {
9264                 priv->ieee->abg_true = 1;
9265                 if (mode & IEEE_A) {
9266                         band |= IEEE80211_52GHZ_BAND;
9267                         modulation |= IEEE80211_OFDM_MODULATION;
9268                 } else
9269                         priv->ieee->abg_true = 0;
9270         } else {
9271                 if (mode & IEEE_A) {
9272                         IPW_WARNING("Attempt to set 2200BG into "
9273                                     "802.11a mode\n");
9274                         up(&priv->sem);
9275                         return -EINVAL;
9276                 }
9277
9278                 priv->ieee->abg_true = 0;
9279         }
9280
9281         if (mode & IEEE_B) {
9282                 band |= IEEE80211_24GHZ_BAND;
9283                 modulation |= IEEE80211_CCK_MODULATION;
9284         } else
9285                 priv->ieee->abg_true = 0;
9286
9287         if (mode & IEEE_G) {
9288                 band |= IEEE80211_24GHZ_BAND;
9289                 modulation |= IEEE80211_OFDM_MODULATION;
9290         } else
9291                 priv->ieee->abg_true = 0;
9292
9293         priv->ieee->mode = mode;
9294         priv->ieee->freq_band = band;
9295         priv->ieee->modulation = modulation;
9296         init_supported_rates(priv, &priv->rates);
9297
9298         /* Network configuration changed -- force [re]association */
9299         IPW_DEBUG_ASSOC("[re]association triggered due to mode change.\n");
9300         if (!ipw_disassociate(priv)) {
9301                 ipw_send_supported_rates(priv, &priv->rates);
9302                 ipw_associate(priv);
9303         }
9304
9305         /* Update the band LEDs */
9306         ipw_led_band_on(priv);
9307
9308         IPW_DEBUG_WX("PRIV SET MODE: %c%c%c\n",
9309                      mode & IEEE_A ? 'a' : '.',
9310                      mode & IEEE_B ? 'b' : '.', mode & IEEE_G ? 'g' : '.');
9311         up(&priv->sem);
9312         return 0;
9313 }
9314
9315 static int ipw_wx_get_wireless_mode(struct net_device *dev,
9316                                     struct iw_request_info *info,
9317                                     union iwreq_data *wrqu, char *extra)
9318 {
9319         struct ipw_priv *priv = ieee80211_priv(dev);
9320         down(&priv->sem);
9321         switch (priv->ieee->mode) {
9322         case IEEE_A:
9323                 strncpy(extra, "802.11a (1)", MAX_WX_STRING);
9324                 break;
9325         case IEEE_B:
9326                 strncpy(extra, "802.11b (2)", MAX_WX_STRING);
9327                 break;
9328         case IEEE_A | IEEE_B:
9329                 strncpy(extra, "802.11ab (3)", MAX_WX_STRING);
9330                 break;
9331         case IEEE_G:
9332                 strncpy(extra, "802.11g (4)", MAX_WX_STRING);
9333                 break;
9334         case IEEE_A | IEEE_G:
9335                 strncpy(extra, "802.11ag (5)", MAX_WX_STRING);
9336                 break;
9337         case IEEE_B | IEEE_G:
9338                 strncpy(extra, "802.11bg (6)", MAX_WX_STRING);
9339                 break;
9340         case IEEE_A | IEEE_B | IEEE_G:
9341                 strncpy(extra, "802.11abg (7)", MAX_WX_STRING);
9342                 break;
9343         default:
9344                 strncpy(extra, "unknown", MAX_WX_STRING);
9345                 break;
9346         }
9347
9348         IPW_DEBUG_WX("PRIV GET MODE: %s\n", extra);
9349
9350         wrqu->data.length = strlen(extra) + 1;
9351         up(&priv->sem);
9352
9353         return 0;
9354 }
9355
9356 static int ipw_wx_set_preamble(struct net_device *dev,
9357                                struct iw_request_info *info,
9358                                union iwreq_data *wrqu, char *extra)
9359 {
9360         struct ipw_priv *priv = ieee80211_priv(dev);
9361         int mode = *(int *)extra;
9362         down(&priv->sem);
9363         /* Switching from SHORT -> LONG requires a disassociation */
9364         if (mode == 1) {
9365                 if (!(priv->config & CFG_PREAMBLE_LONG)) {
9366                         priv->config |= CFG_PREAMBLE_LONG;
9367
9368                         /* Network configuration changed -- force [re]association */
9369                         IPW_DEBUG_ASSOC
9370                             ("[re]association triggered due to preamble change.\n");
9371                         if (!ipw_disassociate(priv))
9372                                 ipw_associate(priv);
9373                 }
9374                 goto done;
9375         }
9376
9377         if (mode == 0) {
9378                 priv->config &= ~CFG_PREAMBLE_LONG;
9379                 goto done;
9380         }
9381         up(&priv->sem);
9382         return -EINVAL;
9383
9384       done:
9385         up(&priv->sem);
9386         return 0;
9387 }
9388
9389 static int ipw_wx_get_preamble(struct net_device *dev,
9390                                struct iw_request_info *info,
9391                                union iwreq_data *wrqu, char *extra)
9392 {
9393         struct ipw_priv *priv = ieee80211_priv(dev);
9394         down(&priv->sem);
9395         if (priv->config & CFG_PREAMBLE_LONG)
9396                 snprintf(wrqu->name, IFNAMSIZ, "long (1)");
9397         else
9398                 snprintf(wrqu->name, IFNAMSIZ, "auto (0)");
9399         up(&priv->sem);
9400         return 0;
9401 }
9402
9403 #ifdef CONFIG_IPW2200_MONITOR
9404 static int ipw_wx_set_monitor(struct net_device *dev,
9405                               struct iw_request_info *info,
9406                               union iwreq_data *wrqu, char *extra)
9407 {
9408         struct ipw_priv *priv = ieee80211_priv(dev);
9409         int *parms = (int *)extra;
9410         int enable = (parms[0] > 0);
9411         down(&priv->sem);
9412         IPW_DEBUG_WX("SET MONITOR: %d %d\n", enable, parms[1]);
9413         if (enable) {
9414                 if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
9415 #ifdef CONFIG_IEEE80211_RADIOTAP
9416                         priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
9417 #else
9418                         priv->net_dev->type = ARPHRD_IEEE80211;
9419 #endif
9420                         queue_work(priv->workqueue, &priv->adapter_restart);
9421                 }
9422
9423                 ipw_set_channel(priv, parms[1]);
9424         } else {
9425                 if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
9426                         up(&priv->sem);
9427                         return 0;
9428                 }
9429                 priv->net_dev->type = ARPHRD_ETHER;
9430                 queue_work(priv->workqueue, &priv->adapter_restart);
9431         }
9432         up(&priv->sem);
9433         return 0;
9434 }
9435
9436 #endif                          // CONFIG_IPW2200_MONITOR
9437
9438 static int ipw_wx_reset(struct net_device *dev,
9439                         struct iw_request_info *info,
9440                         union iwreq_data *wrqu, char *extra)
9441 {
9442         struct ipw_priv *priv = ieee80211_priv(dev);
9443         IPW_DEBUG_WX("RESET\n");
9444         queue_work(priv->workqueue, &priv->adapter_restart);
9445         return 0;
9446 }
9447
9448 static int ipw_wx_sw_reset(struct net_device *dev,
9449                            struct iw_request_info *info,
9450                            union iwreq_data *wrqu, char *extra)
9451 {
9452         struct ipw_priv *priv = ieee80211_priv(dev);
9453         union iwreq_data wrqu_sec = {
9454                 .encoding = {
9455                              .flags = IW_ENCODE_DISABLED,
9456                              },
9457         };
9458         int ret;
9459
9460         IPW_DEBUG_WX("SW_RESET\n");
9461
9462         down(&priv->sem);
9463
9464         ret = ipw_sw_reset(priv, 0);
9465         if (!ret) {
9466                 free_firmware();
9467                 ipw_adapter_restart(priv);
9468         }
9469
9470         /* The SW reset bit might have been toggled on by the 'disable'
9471          * module parameter, so take appropriate action */
9472         ipw_radio_kill_sw(priv, priv->status & STATUS_RF_KILL_SW);
9473
9474         up(&priv->sem);
9475         ieee80211_wx_set_encode(priv->ieee, info, &wrqu_sec, NULL);
9476         down(&priv->sem);
9477
9478         if (!(priv->status & STATUS_RF_KILL_MASK)) {
9479                 /* Configuration likely changed -- force [re]association */
9480                 IPW_DEBUG_ASSOC("[re]association triggered due to sw "
9481                                 "reset.\n");
9482                 if (!ipw_disassociate(priv))
9483                         ipw_associate(priv);
9484         }
9485
9486         up(&priv->sem);
9487
9488         return 0;
9489 }
9490
9491 /* Rebase the WE IOCTLs to zero for the handler array */
9492 #define IW_IOCTL(x) [(x)-SIOCSIWCOMMIT]
9493 static iw_handler ipw_wx_handlers[] = {
9494         IW_IOCTL(SIOCGIWNAME) = ipw_wx_get_name,
9495         IW_IOCTL(SIOCSIWFREQ) = ipw_wx_set_freq,
9496         IW_IOCTL(SIOCGIWFREQ) = ipw_wx_get_freq,
9497         IW_IOCTL(SIOCSIWMODE) = ipw_wx_set_mode,
9498         IW_IOCTL(SIOCGIWMODE) = ipw_wx_get_mode,
9499         IW_IOCTL(SIOCGIWRANGE) = ipw_wx_get_range,
9500         IW_IOCTL(SIOCSIWAP) = ipw_wx_set_wap,
9501         IW_IOCTL(SIOCGIWAP) = ipw_wx_get_wap,
9502         IW_IOCTL(SIOCSIWSCAN) = ipw_wx_set_scan,
9503         IW_IOCTL(SIOCGIWSCAN) = ipw_wx_get_scan,
9504         IW_IOCTL(SIOCSIWESSID) = ipw_wx_set_essid,
9505         IW_IOCTL(SIOCGIWESSID) = ipw_wx_get_essid,
9506         IW_IOCTL(SIOCSIWNICKN) = ipw_wx_set_nick,
9507         IW_IOCTL(SIOCGIWNICKN) = ipw_wx_get_nick,
9508         IW_IOCTL(SIOCSIWRATE) = ipw_wx_set_rate,
9509         IW_IOCTL(SIOCGIWRATE) = ipw_wx_get_rate,
9510         IW_IOCTL(SIOCSIWRTS) = ipw_wx_set_rts,
9511         IW_IOCTL(SIOCGIWRTS) = ipw_wx_get_rts,
9512         IW_IOCTL(SIOCSIWFRAG) = ipw_wx_set_frag,
9513         IW_IOCTL(SIOCGIWFRAG) = ipw_wx_get_frag,
9514         IW_IOCTL(SIOCSIWTXPOW) = ipw_wx_set_txpow,
9515         IW_IOCTL(SIOCGIWTXPOW) = ipw_wx_get_txpow,
9516         IW_IOCTL(SIOCSIWRETRY) = ipw_wx_set_retry,
9517         IW_IOCTL(SIOCGIWRETRY) = ipw_wx_get_retry,
9518         IW_IOCTL(SIOCSIWENCODE) = ipw_wx_set_encode,
9519         IW_IOCTL(SIOCGIWENCODE) = ipw_wx_get_encode,
9520         IW_IOCTL(SIOCSIWPOWER) = ipw_wx_set_power,
9521         IW_IOCTL(SIOCGIWPOWER) = ipw_wx_get_power,
9522         IW_IOCTL(SIOCSIWSPY) = iw_handler_set_spy,
9523         IW_IOCTL(SIOCGIWSPY) = iw_handler_get_spy,
9524         IW_IOCTL(SIOCSIWTHRSPY) = iw_handler_set_thrspy,
9525         IW_IOCTL(SIOCGIWTHRSPY) = iw_handler_get_thrspy,
9526         IW_IOCTL(SIOCSIWGENIE) = ipw_wx_set_genie,
9527         IW_IOCTL(SIOCGIWGENIE) = ipw_wx_get_genie,
9528         IW_IOCTL(SIOCSIWMLME) = ipw_wx_set_mlme,
9529         IW_IOCTL(SIOCSIWAUTH) = ipw_wx_set_auth,
9530         IW_IOCTL(SIOCGIWAUTH) = ipw_wx_get_auth,
9531         IW_IOCTL(SIOCSIWENCODEEXT) = ipw_wx_set_encodeext,
9532         IW_IOCTL(SIOCGIWENCODEEXT) = ipw_wx_get_encodeext,
9533 };
9534
9535 enum {
9536         IPW_PRIV_SET_POWER = SIOCIWFIRSTPRIV,
9537         IPW_PRIV_GET_POWER,
9538         IPW_PRIV_SET_MODE,
9539         IPW_PRIV_GET_MODE,
9540         IPW_PRIV_SET_PREAMBLE,
9541         IPW_PRIV_GET_PREAMBLE,
9542         IPW_PRIV_RESET,
9543         IPW_PRIV_SW_RESET,
9544 #ifdef CONFIG_IPW2200_MONITOR
9545         IPW_PRIV_SET_MONITOR,
9546 #endif
9547 };
9548
9549 static struct iw_priv_args ipw_priv_args[] = {
9550         {
9551          .cmd = IPW_PRIV_SET_POWER,
9552          .set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
9553          .name = "set_power"},
9554         {
9555          .cmd = IPW_PRIV_GET_POWER,
9556          .get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
9557          .name = "get_power"},
9558         {
9559          .cmd = IPW_PRIV_SET_MODE,
9560          .set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
9561          .name = "set_mode"},
9562         {
9563          .cmd = IPW_PRIV_GET_MODE,
9564          .get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
9565          .name = "get_mode"},
9566         {
9567          .cmd = IPW_PRIV_SET_PREAMBLE,
9568          .set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
9569          .name = "set_preamble"},
9570         {
9571          .cmd = IPW_PRIV_GET_PREAMBLE,
9572          .get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | IFNAMSIZ,
9573          .name = "get_preamble"},
9574         {
9575          IPW_PRIV_RESET,
9576          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 0, 0, "reset"},
9577         {
9578          IPW_PRIV_SW_RESET,
9579          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 0, 0, "sw_reset"},
9580 #ifdef CONFIG_IPW2200_MONITOR
9581         {
9582          IPW_PRIV_SET_MONITOR,
9583          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "monitor"},
9584 #endif                          /* CONFIG_IPW2200_MONITOR */
9585 };
9586
9587 static iw_handler ipw_priv_handler[] = {
9588         ipw_wx_set_powermode,
9589         ipw_wx_get_powermode,
9590         ipw_wx_set_wireless_mode,
9591         ipw_wx_get_wireless_mode,
9592         ipw_wx_set_preamble,
9593         ipw_wx_get_preamble,
9594         ipw_wx_reset,
9595         ipw_wx_sw_reset,
9596 #ifdef CONFIG_IPW2200_MONITOR
9597         ipw_wx_set_monitor,
9598 #endif
9599 };
9600
9601 static struct iw_handler_def ipw_wx_handler_def = {
9602         .standard = ipw_wx_handlers,
9603         .num_standard = ARRAY_SIZE(ipw_wx_handlers),
9604         .num_private = ARRAY_SIZE(ipw_priv_handler),
9605         .num_private_args = ARRAY_SIZE(ipw_priv_args),
9606         .private = ipw_priv_handler,
9607         .private_args = ipw_priv_args,
9608         .get_wireless_stats = ipw_get_wireless_stats,
9609 };
9610
9611 /*
9612  * Get wireless statistics.
9613  * Called by /proc/net/wireless
9614  * Also called by SIOCGIWSTATS
9615  */
9616 static struct iw_statistics *ipw_get_wireless_stats(struct net_device *dev)
9617 {
9618         struct ipw_priv *priv = ieee80211_priv(dev);
9619         struct iw_statistics *wstats;
9620
9621         wstats = &priv->wstats;
9622
9623         /* if hw is disabled, then ipw_get_ordinal() can't be called.
9624          * netdev->get_wireless_stats seems to be called before fw is
9625          * initialized.  STATUS_ASSOCIATED will only be set if the hw is up
9626          * and associated; if not associcated, the values are all meaningless
9627          * anyway, so set them all to NULL and INVALID */
9628         if (!(priv->status & STATUS_ASSOCIATED)) {
9629                 wstats->miss.beacon = 0;
9630                 wstats->discard.retries = 0;
9631                 wstats->qual.qual = 0;
9632                 wstats->qual.level = 0;
9633                 wstats->qual.noise = 0;
9634                 wstats->qual.updated = 7;
9635                 wstats->qual.updated |= IW_QUAL_NOISE_INVALID |
9636                     IW_QUAL_QUAL_INVALID | IW_QUAL_LEVEL_INVALID;
9637                 return wstats;
9638         }
9639
9640         wstats->qual.qual = priv->quality;
9641         wstats->qual.level = average_value(&priv->average_rssi);
9642         wstats->qual.noise = average_value(&priv->average_noise);
9643         wstats->qual.updated = IW_QUAL_QUAL_UPDATED | IW_QUAL_LEVEL_UPDATED |
9644             IW_QUAL_NOISE_UPDATED;
9645
9646         wstats->miss.beacon = average_value(&priv->average_missed_beacons);
9647         wstats->discard.retries = priv->last_tx_failures;
9648         wstats->discard.code = priv->ieee->ieee_stats.rx_discards_undecryptable;
9649
9650 /*      if (ipw_get_ordinal(priv, IPW_ORD_STAT_TX_RETRY, &tx_retry, &len))
9651         goto fail_get_ordinal;
9652         wstats->discard.retries += tx_retry; */
9653
9654         return wstats;
9655 }
9656
9657 /* net device stuff */
9658
9659 static  void init_sys_config(struct ipw_sys_config *sys_config)
9660 {
9661         memset(sys_config, 0, sizeof(struct ipw_sys_config));
9662         sys_config->bt_coexistence = 0;
9663         sys_config->answer_broadcast_ssid_probe = 0;
9664         sys_config->accept_all_data_frames = 0;
9665         sys_config->accept_non_directed_frames = 1;
9666         sys_config->exclude_unicast_unencrypted = 0;
9667         sys_config->disable_unicast_decryption = 1;
9668         sys_config->exclude_multicast_unencrypted = 0;
9669         sys_config->disable_multicast_decryption = 1;
9670         sys_config->antenna_diversity = CFG_SYS_ANTENNA_BOTH;
9671         sys_config->pass_crc_to_host = 0;       /* TODO: See if 1 gives us FCS */
9672         sys_config->dot11g_auto_detection = 0;
9673         sys_config->enable_cts_to_self = 0;
9674         sys_config->bt_coexist_collision_thr = 0;
9675         sys_config->pass_noise_stats_to_host = 1;       //1 -- fix for 256
9676 }
9677
9678 static int ipw_net_open(struct net_device *dev)
9679 {
9680         struct ipw_priv *priv = ieee80211_priv(dev);
9681         IPW_DEBUG_INFO("dev->open\n");
9682         /* we should be verifying the device is ready to be opened */
9683         down(&priv->sem);
9684         if (!(priv->status & STATUS_RF_KILL_MASK) &&
9685             (priv->status & STATUS_ASSOCIATED))
9686                 netif_start_queue(dev);
9687         up(&priv->sem);
9688         return 0;
9689 }
9690
9691 static int ipw_net_stop(struct net_device *dev)
9692 {
9693         IPW_DEBUG_INFO("dev->close\n");
9694         netif_stop_queue(dev);
9695         return 0;
9696 }
9697
9698 /*
9699 todo:
9700
9701 modify to send one tfd per fragment instead of using chunking.  otherwise
9702 we need to heavily modify the ieee80211_skb_to_txb.
9703 */
9704
9705 static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
9706                              int pri)
9707 {
9708         struct ieee80211_hdr_3addr *hdr = (struct ieee80211_hdr_3addr *)
9709             txb->fragments[0]->data;
9710         int i = 0;
9711         struct tfd_frame *tfd;
9712 #ifdef CONFIG_IPW_QOS
9713         int tx_id = ipw_get_tx_queue_number(priv, pri);
9714         struct clx2_tx_queue *txq = &priv->txq[tx_id];
9715 #else
9716         struct clx2_tx_queue *txq = &priv->txq[0];
9717 #endif
9718         struct clx2_queue *q = &txq->q;
9719         u8 id, hdr_len, unicast;
9720         u16 remaining_bytes;
9721         int fc;
9722
9723         /* If there isn't room in the queue, we return busy and let the
9724          * network stack requeue the packet for us */
9725         if (ipw_queue_space(q) < q->high_mark)
9726                 return NETDEV_TX_BUSY;
9727
9728         switch (priv->ieee->iw_mode) {
9729         case IW_MODE_ADHOC:
9730                 hdr_len = IEEE80211_3ADDR_LEN;
9731                 unicast = !is_multicast_ether_addr(hdr->addr1);
9732                 id = ipw_find_station(priv, hdr->addr1);
9733                 if (id == IPW_INVALID_STATION) {
9734                         id = ipw_add_station(priv, hdr->addr1);
9735                         if (id == IPW_INVALID_STATION) {
9736                                 IPW_WARNING("Attempt to send data to "
9737                                             "invalid cell: " MAC_FMT "\n",
9738                                             MAC_ARG(hdr->addr1));
9739                                 goto drop;
9740                         }
9741                 }
9742                 break;
9743
9744         case IW_MODE_INFRA:
9745         default:
9746                 unicast = !is_multicast_ether_addr(hdr->addr3);
9747                 hdr_len = IEEE80211_3ADDR_LEN;
9748                 id = 0;
9749                 break;
9750         }
9751
9752         tfd = &txq->bd[q->first_empty];
9753         txq->txb[q->first_empty] = txb;
9754         memset(tfd, 0, sizeof(*tfd));
9755         tfd->u.data.station_number = id;
9756
9757         tfd->control_flags.message_type = TX_FRAME_TYPE;
9758         tfd->control_flags.control_bits = TFD_NEED_IRQ_MASK;
9759
9760         tfd->u.data.cmd_id = DINO_CMD_TX;
9761         tfd->u.data.len = cpu_to_le16(txb->payload_size);
9762         remaining_bytes = txb->payload_size;
9763
9764         if (priv->assoc_request.ieee_mode == IPW_B_MODE)
9765                 tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_MODE_CCK;
9766         else
9767                 tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_MODE_OFDM;
9768
9769         if (priv->assoc_request.preamble_length == DCT_FLAG_SHORT_PREAMBLE)
9770                 tfd->u.data.tx_flags |= DCT_FLAG_SHORT_PREAMBLE;
9771
9772         fc = le16_to_cpu(hdr->frame_ctl);
9773         hdr->frame_ctl = cpu_to_le16(fc & ~IEEE80211_FCTL_MOREFRAGS);
9774
9775         memcpy(&tfd->u.data.tfd.tfd_24.mchdr, hdr, hdr_len);
9776
9777         if (likely(unicast))
9778                 tfd->u.data.tx_flags |= DCT_FLAG_ACK_REQD;
9779
9780         if (txb->encrypted && !priv->ieee->host_encrypt) {
9781                 switch (priv->ieee->sec.level) {
9782                 case SEC_LEVEL_3:
9783                         tfd->u.data.tfd.tfd_24.mchdr.frame_ctl |=
9784                             IEEE80211_FCTL_PROTECTED;
9785                         /* XXX: ACK flag must be set for CCMP even if it
9786                          * is a multicast/broadcast packet, because CCMP
9787                          * group communication encrypted by GTK is
9788                          * actually done by the AP. */
9789                         if (!unicast)
9790                                 tfd->u.data.tx_flags |= DCT_FLAG_ACK_REQD;
9791
9792                         tfd->u.data.tx_flags &= ~DCT_FLAG_NO_WEP;
9793                         tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_SECURITY_CCM;
9794                         tfd->u.data.key_index = 0;
9795                         tfd->u.data.key_index |= DCT_WEP_INDEX_USE_IMMEDIATE;
9796                         break;
9797                 case SEC_LEVEL_2:
9798                         tfd->u.data.tfd.tfd_24.mchdr.frame_ctl |=
9799                             IEEE80211_FCTL_PROTECTED;
9800                         tfd->u.data.tx_flags &= ~DCT_FLAG_NO_WEP;
9801                         tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_SECURITY_TKIP;
9802                         tfd->u.data.key_index = DCT_WEP_INDEX_USE_IMMEDIATE;
9803                         break;
9804                 case SEC_LEVEL_1:
9805                         tfd->u.data.tfd.tfd_24.mchdr.frame_ctl |=
9806                             IEEE80211_FCTL_PROTECTED;
9807                         tfd->u.data.key_index = priv->ieee->tx_keyidx;
9808                         if (priv->ieee->sec.key_sizes[priv->ieee->tx_keyidx] <=
9809                             40)
9810                                 tfd->u.data.key_index |= DCT_WEP_KEY_64Bit;
9811                         else
9812                                 tfd->u.data.key_index |= DCT_WEP_KEY_128Bit;
9813                         break;
9814                 case SEC_LEVEL_0:
9815                         break;
9816                 default:
9817                         printk(KERN_ERR "Unknow security level %d\n",
9818                                priv->ieee->sec.level);
9819                         break;
9820                 }
9821         } else
9822                 /* No hardware encryption */
9823                 tfd->u.data.tx_flags |= DCT_FLAG_NO_WEP;
9824
9825 #ifdef CONFIG_IPW_QOS
9826         ipw_qos_set_tx_queue_command(priv, pri, &(tfd->u.data), unicast);
9827 #endif                          /* CONFIG_IPW_QOS */
9828
9829         /* payload */
9830         tfd->u.data.num_chunks = cpu_to_le32(min((u8) (NUM_TFD_CHUNKS - 2),
9831                                                  txb->nr_frags));
9832         IPW_DEBUG_FRAG("%i fragments being sent as %i chunks.\n",
9833                        txb->nr_frags, le32_to_cpu(tfd->u.data.num_chunks));
9834         for (i = 0; i < le32_to_cpu(tfd->u.data.num_chunks); i++) {
9835                 IPW_DEBUG_FRAG("Adding fragment %i of %i (%d bytes).\n",
9836                                i, le32_to_cpu(tfd->u.data.num_chunks),
9837                                txb->fragments[i]->len - hdr_len);
9838                 IPW_DEBUG_TX("Dumping TX packet frag %i of %i (%d bytes):\n",
9839                              i, tfd->u.data.num_chunks,
9840                              txb->fragments[i]->len - hdr_len);
9841                 printk_buf(IPW_DL_TX, txb->fragments[i]->data + hdr_len,
9842                            txb->fragments[i]->len - hdr_len);
9843
9844                 tfd->u.data.chunk_ptr[i] =
9845                     cpu_to_le32(pci_map_single
9846                                 (priv->pci_dev,
9847                                  txb->fragments[i]->data + hdr_len,
9848                                  txb->fragments[i]->len - hdr_len,
9849                                  PCI_DMA_TODEVICE));
9850                 tfd->u.data.chunk_len[i] =
9851                     cpu_to_le16(txb->fragments[i]->len - hdr_len);
9852         }
9853
9854         if (i != txb->nr_frags) {
9855                 struct sk_buff *skb;
9856                 u16 remaining_bytes = 0;
9857                 int j;
9858
9859                 for (j = i; j < txb->nr_frags; j++)
9860                         remaining_bytes += txb->fragments[j]->len - hdr_len;
9861
9862                 printk(KERN_INFO "Trying to reallocate for %d bytes\n",
9863                        remaining_bytes);
9864                 skb = alloc_skb(remaining_bytes, GFP_ATOMIC);
9865                 if (skb != NULL) {
9866                         tfd->u.data.chunk_len[i] = cpu_to_le16(remaining_bytes);
9867                         for (j = i; j < txb->nr_frags; j++) {
9868                                 int size = txb->fragments[j]->len - hdr_len;
9869
9870                                 printk(KERN_INFO "Adding frag %d %d...\n",
9871                                        j, size);
9872                                 memcpy(skb_put(skb, size),
9873                                        txb->fragments[j]->data + hdr_len, size);
9874                         }
9875                         dev_kfree_skb_any(txb->fragments[i]);
9876                         txb->fragments[i] = skb;
9877                         tfd->u.data.chunk_ptr[i] =
9878                             cpu_to_le32(pci_map_single
9879                                         (priv->pci_dev, skb->data,
9880                                          tfd->u.data.chunk_len[i],
9881                                          PCI_DMA_TODEVICE));
9882
9883                         tfd->u.data.num_chunks =
9884                             cpu_to_le32(le32_to_cpu(tfd->u.data.num_chunks) +
9885                                         1);
9886                 }
9887         }
9888
9889         /* kick DMA */
9890         q->first_empty = ipw_queue_inc_wrap(q->first_empty, q->n_bd);
9891         ipw_write32(priv, q->reg_w, q->first_empty);
9892
9893         return NETDEV_TX_OK;
9894
9895       drop:
9896         IPW_DEBUG_DROP("Silently dropping Tx packet.\n");
9897         ieee80211_txb_free(txb);
9898         return NETDEV_TX_OK;
9899 }
9900
9901 static int ipw_net_is_queue_full(struct net_device *dev, int pri)
9902 {
9903         struct ipw_priv *priv = ieee80211_priv(dev);
9904 #ifdef CONFIG_IPW_QOS
9905         int tx_id = ipw_get_tx_queue_number(priv, pri);
9906         struct clx2_tx_queue *txq = &priv->txq[tx_id];
9907 #else
9908         struct clx2_tx_queue *txq = &priv->txq[0];
9909 #endif                          /* CONFIG_IPW_QOS */
9910
9911         if (ipw_queue_space(&txq->q) < txq->q.high_mark)
9912                 return 1;
9913
9914         return 0;
9915 }
9916
9917 static int ipw_net_hard_start_xmit(struct ieee80211_txb *txb,
9918                                    struct net_device *dev, int pri)
9919 {
9920         struct ipw_priv *priv = ieee80211_priv(dev);
9921         unsigned long flags;
9922         int ret;
9923
9924         IPW_DEBUG_TX("dev->xmit(%d bytes)\n", txb->payload_size);
9925         spin_lock_irqsave(&priv->lock, flags);
9926
9927         if (!(priv->status & STATUS_ASSOCIATED)) {
9928                 IPW_DEBUG_INFO("Tx attempt while not associated.\n");
9929                 priv->ieee->stats.tx_carrier_errors++;
9930                 netif_stop_queue(dev);
9931                 goto fail_unlock;
9932         }
9933
9934         ret = ipw_tx_skb(priv, txb, pri);
9935         if (ret == NETDEV_TX_OK)
9936                 __ipw_led_activity_on(priv);
9937         spin_unlock_irqrestore(&priv->lock, flags);
9938
9939         return ret;
9940
9941       fail_unlock:
9942         spin_unlock_irqrestore(&priv->lock, flags);
9943         return 1;
9944 }
9945
9946 static struct net_device_stats *ipw_net_get_stats(struct net_device *dev)
9947 {
9948         struct ipw_priv *priv = ieee80211_priv(dev);
9949
9950         priv->ieee->stats.tx_packets = priv->tx_packets;
9951         priv->ieee->stats.rx_packets = priv->rx_packets;
9952         return &priv->ieee->stats;
9953 }
9954
9955 static void ipw_net_set_multicast_list(struct net_device *dev)
9956 {
9957
9958 }
9959
9960 static int ipw_net_set_mac_address(struct net_device *dev, void *p)
9961 {
9962         struct ipw_priv *priv = ieee80211_priv(dev);
9963         struct sockaddr *addr = p;
9964         if (!is_valid_ether_addr(addr->sa_data))
9965                 return -EADDRNOTAVAIL;
9966         down(&priv->sem);
9967         priv->config |= CFG_CUSTOM_MAC;
9968         memcpy(priv->mac_addr, addr->sa_data, ETH_ALEN);
9969         printk(KERN_INFO "%s: Setting MAC to " MAC_FMT "\n",
9970                priv->net_dev->name, MAC_ARG(priv->mac_addr));
9971         queue_work(priv->workqueue, &priv->adapter_restart);
9972         up(&priv->sem);
9973         return 0;
9974 }
9975
9976 static void ipw_ethtool_get_drvinfo(struct net_device *dev,
9977                                     struct ethtool_drvinfo *info)
9978 {
9979         struct ipw_priv *p = ieee80211_priv(dev);
9980         char vers[64];
9981         char date[32];
9982         u32 len;
9983
9984         strcpy(info->driver, DRV_NAME);
9985         strcpy(info->version, DRV_VERSION);
9986
9987         len = sizeof(vers);
9988         ipw_get_ordinal(p, IPW_ORD_STAT_FW_VERSION, vers, &len);
9989         len = sizeof(date);
9990         ipw_get_ordinal(p, IPW_ORD_STAT_FW_DATE, date, &len);
9991
9992         snprintf(info->fw_version, sizeof(info->fw_version), "%s (%s)",
9993                  vers, date);
9994         strcpy(info->bus_info, pci_name(p->pci_dev));
9995         info->eedump_len = IPW_EEPROM_IMAGE_SIZE;
9996 }
9997
9998 static u32 ipw_ethtool_get_link(struct net_device *dev)
9999 {
10000         struct ipw_priv *priv = ieee80211_priv(dev);
10001         return (priv->status & STATUS_ASSOCIATED) != 0;
10002 }
10003
10004 static int ipw_ethtool_get_eeprom_len(struct net_device *dev)
10005 {
10006         return IPW_EEPROM_IMAGE_SIZE;
10007 }
10008
10009 static int ipw_ethtool_get_eeprom(struct net_device *dev,
10010                                   struct ethtool_eeprom *eeprom, u8 * bytes)
10011 {
10012         struct ipw_priv *p = ieee80211_priv(dev);
10013
10014         if (eeprom->offset + eeprom->len > IPW_EEPROM_IMAGE_SIZE)
10015                 return -EINVAL;
10016         down(&p->sem);
10017         memcpy(bytes, &p->eeprom[eeprom->offset], eeprom->len);
10018         up(&p->sem);
10019         return 0;
10020 }
10021
10022 static int ipw_ethtool_set_eeprom(struct net_device *dev,
10023                                   struct ethtool_eeprom *eeprom, u8 * bytes)
10024 {
10025         struct ipw_priv *p = ieee80211_priv(dev);
10026         int i;
10027
10028         if (eeprom->offset + eeprom->len > IPW_EEPROM_IMAGE_SIZE)
10029                 return -EINVAL;
10030         down(&p->sem);
10031         memcpy(&p->eeprom[eeprom->offset], bytes, eeprom->len);
10032         for (i = IPW_EEPROM_DATA;
10033              i < IPW_EEPROM_DATA + IPW_EEPROM_IMAGE_SIZE; i++)
10034                 ipw_write8(p, i, p->eeprom[i]);
10035         up(&p->sem);
10036         return 0;
10037 }
10038
10039 static struct ethtool_ops ipw_ethtool_ops = {
10040         .get_link = ipw_ethtool_get_link,
10041         .get_drvinfo = ipw_ethtool_get_drvinfo,
10042         .get_eeprom_len = ipw_ethtool_get_eeprom_len,
10043         .get_eeprom = ipw_ethtool_get_eeprom,
10044         .set_eeprom = ipw_ethtool_set_eeprom,
10045 };
10046
10047 static irqreturn_t ipw_isr(int irq, void *data, struct pt_regs *regs)
10048 {
10049         struct ipw_priv *priv = data;
10050         u32 inta, inta_mask;
10051
10052         if (!priv)
10053                 return IRQ_NONE;
10054
10055         spin_lock(&priv->lock);
10056
10057         if (!(priv->status & STATUS_INT_ENABLED)) {
10058                 /* Shared IRQ */
10059                 goto none;
10060         }
10061
10062         inta = ipw_read32(priv, IPW_INTA_RW);
10063         inta_mask = ipw_read32(priv, IPW_INTA_MASK_R);
10064
10065         if (inta == 0xFFFFFFFF) {
10066                 /* Hardware disappeared */
10067                 IPW_WARNING("IRQ INTA == 0xFFFFFFFF\n");
10068                 goto none;
10069         }
10070
10071         if (!(inta & (IPW_INTA_MASK_ALL & inta_mask))) {
10072                 /* Shared interrupt */
10073                 goto none;
10074         }
10075
10076         /* tell the device to stop sending interrupts */
10077         ipw_disable_interrupts(priv);
10078
10079         /* ack current interrupts */
10080         inta &= (IPW_INTA_MASK_ALL & inta_mask);
10081         ipw_write32(priv, IPW_INTA_RW, inta);
10082
10083         /* Cache INTA value for our tasklet */
10084         priv->isr_inta = inta;
10085
10086         tasklet_schedule(&priv->irq_tasklet);
10087
10088         spin_unlock(&priv->lock);
10089
10090         return IRQ_HANDLED;
10091       none:
10092         spin_unlock(&priv->lock);
10093         return IRQ_NONE;
10094 }
10095
10096 static void ipw_rf_kill(void *adapter)
10097 {
10098         struct ipw_priv *priv = adapter;
10099         unsigned long flags;
10100
10101         spin_lock_irqsave(&priv->lock, flags);
10102
10103         if (rf_kill_active(priv)) {
10104                 IPW_DEBUG_RF_KILL("RF Kill active, rescheduling GPIO check\n");
10105                 if (priv->workqueue)
10106                         queue_delayed_work(priv->workqueue,
10107                                            &priv->rf_kill, 2 * HZ);
10108                 goto exit_unlock;
10109         }
10110
10111         /* RF Kill is now disabled, so bring the device back up */
10112
10113         if (!(priv->status & STATUS_RF_KILL_MASK)) {
10114                 IPW_DEBUG_RF_KILL("HW RF Kill no longer active, restarting "
10115                                   "device\n");
10116
10117                 /* we can not do an adapter restart while inside an irq lock */
10118                 queue_work(priv->workqueue, &priv->adapter_restart);
10119         } else
10120                 IPW_DEBUG_RF_KILL("HW RF Kill deactivated.  SW RF Kill still "
10121                                   "enabled\n");
10122
10123       exit_unlock:
10124         spin_unlock_irqrestore(&priv->lock, flags);
10125 }
10126
10127 static void ipw_bg_rf_kill(void *data)
10128 {
10129         struct ipw_priv *priv = data;
10130         down(&priv->sem);
10131         ipw_rf_kill(data);
10132         up(&priv->sem);
10133 }
10134
10135 static void ipw_link_up(struct ipw_priv *priv)
10136 {
10137         priv->last_seq_num = -1;
10138         priv->last_frag_num = -1;
10139         priv->last_packet_time = 0;
10140
10141         netif_carrier_on(priv->net_dev);
10142         if (netif_queue_stopped(priv->net_dev)) {
10143                 IPW_DEBUG_NOTIF("waking queue\n");
10144                 netif_wake_queue(priv->net_dev);
10145         } else {
10146                 IPW_DEBUG_NOTIF("starting queue\n");
10147                 netif_start_queue(priv->net_dev);
10148         }
10149
10150         cancel_delayed_work(&priv->request_scan);
10151         ipw_reset_stats(priv);
10152         /* Ensure the rate is updated immediately */
10153         priv->last_rate = ipw_get_current_rate(priv);
10154         ipw_gather_stats(priv);
10155         ipw_led_link_up(priv);
10156         notify_wx_assoc_event(priv);
10157
10158         if (priv->config & CFG_BACKGROUND_SCAN)
10159                 queue_delayed_work(priv->workqueue, &priv->request_scan, HZ);
10160 }
10161
10162 static void ipw_bg_link_up(void *data)
10163 {
10164         struct ipw_priv *priv = data;
10165         down(&priv->sem);
10166         ipw_link_up(data);
10167         up(&priv->sem);
10168 }
10169
10170 static void ipw_link_down(struct ipw_priv *priv)
10171 {
10172         ipw_led_link_down(priv);
10173         netif_carrier_off(priv->net_dev);
10174         netif_stop_queue(priv->net_dev);
10175         notify_wx_assoc_event(priv);
10176
10177         /* Cancel any queued work ... */
10178         cancel_delayed_work(&priv->request_scan);
10179         cancel_delayed_work(&priv->adhoc_check);
10180         cancel_delayed_work(&priv->gather_stats);
10181
10182         ipw_reset_stats(priv);
10183
10184         if (!(priv->status & STATUS_EXIT_PENDING)) {
10185                 /* Queue up another scan... */
10186                 queue_work(priv->workqueue, &priv->request_scan);
10187         }
10188 }
10189
10190 static void ipw_bg_link_down(void *data)
10191 {
10192         struct ipw_priv *priv = data;
10193         down(&priv->sem);
10194         ipw_link_down(data);
10195         up(&priv->sem);
10196 }
10197
10198 static int ipw_setup_deferred_work(struct ipw_priv *priv)
10199 {
10200         int ret = 0;
10201
10202         priv->workqueue = create_workqueue(DRV_NAME);
10203         init_waitqueue_head(&priv->wait_command_queue);
10204         init_waitqueue_head(&priv->wait_state);
10205
10206         INIT_WORK(&priv->adhoc_check, ipw_bg_adhoc_check, priv);
10207         INIT_WORK(&priv->associate, ipw_bg_associate, priv);
10208         INIT_WORK(&priv->disassociate, ipw_bg_disassociate, priv);
10209         INIT_WORK(&priv->system_config, ipw_system_config, priv);
10210         INIT_WORK(&priv->rx_replenish, ipw_bg_rx_queue_replenish, priv);
10211         INIT_WORK(&priv->adapter_restart, ipw_bg_adapter_restart, priv);
10212         INIT_WORK(&priv->rf_kill, ipw_bg_rf_kill, priv);
10213         INIT_WORK(&priv->up, (void (*)(void *))ipw_bg_up, priv);
10214         INIT_WORK(&priv->down, (void (*)(void *))ipw_bg_down, priv);
10215         INIT_WORK(&priv->request_scan,
10216                   (void (*)(void *))ipw_request_scan, priv);
10217         INIT_WORK(&priv->gather_stats,
10218                   (void (*)(void *))ipw_bg_gather_stats, priv);
10219         INIT_WORK(&priv->abort_scan, (void (*)(void *))ipw_bg_abort_scan, priv);
10220         INIT_WORK(&priv->roam, ipw_bg_roam, priv);
10221         INIT_WORK(&priv->scan_check, ipw_bg_scan_check, priv);
10222         INIT_WORK(&priv->link_up, (void (*)(void *))ipw_bg_link_up, priv);
10223         INIT_WORK(&priv->link_down, (void (*)(void *))ipw_bg_link_down, priv);
10224         INIT_WORK(&priv->led_link_on, (void (*)(void *))ipw_bg_led_link_on,
10225                   priv);
10226         INIT_WORK(&priv->led_link_off, (void (*)(void *))ipw_bg_led_link_off,
10227                   priv);
10228         INIT_WORK(&priv->led_act_off, (void (*)(void *))ipw_bg_led_activity_off,
10229                   priv);
10230         INIT_WORK(&priv->merge_networks,
10231                   (void (*)(void *))ipw_merge_adhoc_network, priv);
10232
10233 #ifdef CONFIG_IPW_QOS
10234         INIT_WORK(&priv->qos_activate, (void (*)(void *))ipw_bg_qos_activate,
10235                   priv);
10236 #endif                          /* CONFIG_IPW_QOS */
10237
10238         tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
10239                      ipw_irq_tasklet, (unsigned long)priv);
10240
10241         return ret;
10242 }
10243
10244 static void shim__set_security(struct net_device *dev,
10245                                struct ieee80211_security *sec)
10246 {
10247         struct ipw_priv *priv = ieee80211_priv(dev);
10248         int i;
10249         for (i = 0; i < 4; i++) {
10250                 if (sec->flags & (1 << i)) {
10251                         priv->ieee->sec.encode_alg[i] = sec->encode_alg[i];
10252                         priv->ieee->sec.key_sizes[i] = sec->key_sizes[i];
10253                         if (sec->key_sizes[i] == 0)
10254                                 priv->ieee->sec.flags &= ~(1 << i);
10255                         else {
10256                                 memcpy(priv->ieee->sec.keys[i], sec->keys[i],
10257                                        sec->key_sizes[i]);
10258                                 priv->ieee->sec.flags |= (1 << i);
10259                         }
10260                         priv->status |= STATUS_SECURITY_UPDATED;
10261                 } else if (sec->level != SEC_LEVEL_1)
10262                         priv->ieee->sec.flags &= ~(1 << i);
10263         }
10264
10265         if (sec->flags & SEC_ACTIVE_KEY) {
10266                 if (sec->active_key <= 3) {
10267                         priv->ieee->sec.active_key = sec->active_key;
10268                         priv->ieee->sec.flags |= SEC_ACTIVE_KEY;
10269                 } else
10270                         priv->ieee->sec.flags &= ~SEC_ACTIVE_KEY;
10271                 priv->status |= STATUS_SECURITY_UPDATED;
10272         } else
10273                 priv->ieee->sec.flags &= ~SEC_ACTIVE_KEY;
10274
10275         if ((sec->flags & SEC_AUTH_MODE) &&
10276             (priv->ieee->sec.auth_mode != sec->auth_mode)) {
10277                 priv->ieee->sec.auth_mode = sec->auth_mode;
10278                 priv->ieee->sec.flags |= SEC_AUTH_MODE;
10279                 if (sec->auth_mode == WLAN_AUTH_SHARED_KEY)
10280                         priv->capability |= CAP_SHARED_KEY;
10281                 else
10282                         priv->capability &= ~CAP_SHARED_KEY;
10283                 priv->status |= STATUS_SECURITY_UPDATED;
10284         }
10285
10286         if (sec->flags & SEC_ENABLED && priv->ieee->sec.enabled != sec->enabled) {
10287                 priv->ieee->sec.flags |= SEC_ENABLED;
10288                 priv->ieee->sec.enabled = sec->enabled;
10289                 priv->status |= STATUS_SECURITY_UPDATED;
10290                 if (sec->enabled)
10291                         priv->capability |= CAP_PRIVACY_ON;
10292                 else
10293                         priv->capability &= ~CAP_PRIVACY_ON;
10294         }
10295
10296         if (sec->flags & SEC_ENCRYPT)
10297                 priv->ieee->sec.encrypt = sec->encrypt;
10298
10299         if (sec->flags & SEC_LEVEL && priv->ieee->sec.level != sec->level) {
10300                 priv->ieee->sec.level = sec->level;
10301                 priv->ieee->sec.flags |= SEC_LEVEL;
10302                 priv->status |= STATUS_SECURITY_UPDATED;
10303         }
10304
10305         if (!priv->ieee->host_encrypt && (sec->flags & SEC_ENCRYPT))
10306                 ipw_set_hwcrypto_keys(priv);
10307
10308         /* To match current functionality of ipw2100 (which works well w/
10309          * various supplicants, we don't force a disassociate if the
10310          * privacy capability changes ... */
10311 #if 0
10312         if ((priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) &&
10313             (((priv->assoc_request.capability &
10314                WLAN_CAPABILITY_PRIVACY) && !sec->enabled) ||
10315              (!(priv->assoc_request.capability &
10316                 WLAN_CAPABILITY_PRIVACY) && sec->enabled))) {
10317                 IPW_DEBUG_ASSOC("Disassociating due to capability "
10318                                 "change.\n");
10319                 ipw_disassociate(priv);
10320         }
10321 #endif
10322 }
10323
10324 static int init_supported_rates(struct ipw_priv *priv,
10325                                 struct ipw_supported_rates *rates)
10326 {
10327         /* TODO: Mask out rates based on priv->rates_mask */
10328
10329         memset(rates, 0, sizeof(*rates));
10330         /* configure supported rates */
10331         switch (priv->ieee->freq_band) {
10332         case IEEE80211_52GHZ_BAND:
10333                 rates->ieee_mode = IPW_A_MODE;
10334                 rates->purpose = IPW_RATE_CAPABILITIES;
10335                 ipw_add_ofdm_scan_rates(rates, IEEE80211_CCK_MODULATION,
10336                                         IEEE80211_OFDM_DEFAULT_RATES_MASK);
10337                 break;
10338
10339         default:                /* Mixed or 2.4Ghz */
10340                 rates->ieee_mode = IPW_G_MODE;
10341                 rates->purpose = IPW_RATE_CAPABILITIES;
10342                 ipw_add_cck_scan_rates(rates, IEEE80211_CCK_MODULATION,
10343                                        IEEE80211_CCK_DEFAULT_RATES_MASK);
10344                 if (priv->ieee->modulation & IEEE80211_OFDM_MODULATION) {
10345                         ipw_add_ofdm_scan_rates(rates, IEEE80211_CCK_MODULATION,
10346                                                 IEEE80211_OFDM_DEFAULT_RATES_MASK);
10347                 }
10348                 break;
10349         }
10350
10351         return 0;
10352 }
10353
10354 static int ipw_config(struct ipw_priv *priv)
10355 {
10356         /* This is only called from ipw_up, which resets/reloads the firmware
10357            so, we don't need to first disable the card before we configure
10358            it */
10359         if (ipw_set_tx_power(priv))
10360                 goto error;
10361
10362         /* initialize adapter address */
10363         if (ipw_send_adapter_address(priv, priv->net_dev->dev_addr))
10364                 goto error;
10365
10366         /* set basic system config settings */
10367         init_sys_config(&priv->sys_config);
10368
10369         /* Support Bluetooth if we have BT h/w on board, and user wants to.
10370          * Does not support BT priority yet (don't abort or defer our Tx) */
10371         if (bt_coexist) {
10372                 unsigned char bt_caps = priv->eeprom[EEPROM_SKU_CAPABILITY];
10373
10374                 if (bt_caps & EEPROM_SKU_CAP_BT_CHANNEL_SIG)
10375                         priv->sys_config.bt_coexistence
10376                                 |= CFG_BT_COEXISTENCE_SIGNAL_CHNL;
10377                 if (bt_caps & EEPROM_SKU_CAP_BT_OOB)
10378                         priv->sys_config.bt_coexistence
10379                                 |= CFG_BT_COEXISTENCE_OOB;
10380         }
10381
10382         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
10383                 priv->sys_config.answer_broadcast_ssid_probe = 1;
10384         else
10385                 priv->sys_config.answer_broadcast_ssid_probe = 0;
10386
10387         if (ipw_send_system_config(priv, &priv->sys_config))
10388                 goto error;
10389
10390         init_supported_rates(priv, &priv->rates);
10391         if (ipw_send_supported_rates(priv, &priv->rates))
10392                 goto error;
10393
10394         /* Set request-to-send threshold */
10395         if (priv->rts_threshold) {
10396                 if (ipw_send_rts_threshold(priv, priv->rts_threshold))
10397                         goto error;
10398         }
10399 #ifdef CONFIG_IPW_QOS
10400         IPW_DEBUG_QOS("QoS: call ipw_qos_activate\n");
10401         ipw_qos_activate(priv, NULL);
10402 #endif                          /* CONFIG_IPW_QOS */
10403
10404         if (ipw_set_random_seed(priv))
10405                 goto error;
10406
10407         /* final state transition to the RUN state */
10408         if (ipw_send_host_complete(priv))
10409                 goto error;
10410
10411         priv->status |= STATUS_INIT;
10412
10413         ipw_led_init(priv);
10414         ipw_led_radio_on(priv);
10415         priv->notif_missed_beacons = 0;
10416
10417         /* Set hardware WEP key if it is configured. */
10418         if ((priv->capability & CAP_PRIVACY_ON) &&
10419             (priv->ieee->sec.level == SEC_LEVEL_1) &&
10420             !(priv->ieee->host_encrypt || priv->ieee->host_decrypt))
10421                 ipw_set_hwcrypto_keys(priv);
10422
10423         return 0;
10424
10425       error:
10426         return -EIO;
10427 }
10428
10429 /*
10430  * NOTE:
10431  *
10432  * These tables have been tested in conjunction with the
10433  * Intel PRO/Wireless 2200BG and 2915ABG Network Connection Adapters.
10434  *
10435  * Altering this values, using it on other hardware, or in geographies
10436  * not intended for resale of the above mentioned Intel adapters has
10437  * not been tested.
10438  *
10439  */
10440 static const struct ieee80211_geo ipw_geos[] = {
10441         {                       /* Restricted */
10442          "---",
10443          .bg_channels = 11,
10444          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10445                 {2427, 4}, {2432, 5}, {2437, 6},
10446                 {2442, 7}, {2447, 8}, {2452, 9},
10447                 {2457, 10}, {2462, 11}},
10448          },
10449
10450         {                       /* Custom US/Canada */
10451          "ZZF",
10452          .bg_channels = 11,
10453          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10454                 {2427, 4}, {2432, 5}, {2437, 6},
10455                 {2442, 7}, {2447, 8}, {2452, 9},
10456                 {2457, 10}, {2462, 11}},
10457          .a_channels = 8,
10458          .a = {{5180, 36},
10459                {5200, 40},
10460                {5220, 44},
10461                {5240, 48},
10462                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
10463                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
10464                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
10465                {5320, 64, IEEE80211_CH_PASSIVE_ONLY}},
10466          },
10467
10468         {                       /* Rest of World */
10469          "ZZD",
10470          .bg_channels = 13,
10471          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10472                 {2427, 4}, {2432, 5}, {2437, 6},
10473                 {2442, 7}, {2447, 8}, {2452, 9},
10474                 {2457, 10}, {2462, 11}, {2467, 12},
10475                 {2472, 13}},
10476          },
10477
10478         {                       /* Custom USA & Europe & High */
10479          "ZZA",
10480          .bg_channels = 11,
10481          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10482                 {2427, 4}, {2432, 5}, {2437, 6},
10483                 {2442, 7}, {2447, 8}, {2452, 9},
10484                 {2457, 10}, {2462, 11}},
10485          .a_channels = 13,
10486          .a = {{5180, 36},
10487                {5200, 40},
10488                {5220, 44},
10489                {5240, 48},
10490                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
10491                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
10492                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
10493                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
10494                {5745, 149},
10495                {5765, 153},
10496                {5785, 157},
10497                {5805, 161},
10498                {5825, 165}},
10499          },
10500
10501         {                       /* Custom NA & Europe */
10502          "ZZB",
10503          .bg_channels = 11,
10504          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10505                 {2427, 4}, {2432, 5}, {2437, 6},
10506                 {2442, 7}, {2447, 8}, {2452, 9},
10507                 {2457, 10}, {2462, 11}},
10508          .a_channels = 13,
10509          .a = {{5180, 36},
10510                {5200, 40},
10511                {5220, 44},
10512                {5240, 48},
10513                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
10514                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
10515                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
10516                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
10517                {5745, 149, IEEE80211_CH_PASSIVE_ONLY},
10518                {5765, 153, IEEE80211_CH_PASSIVE_ONLY},
10519                {5785, 157, IEEE80211_CH_PASSIVE_ONLY},
10520                {5805, 161, IEEE80211_CH_PASSIVE_ONLY},
10521                {5825, 165, IEEE80211_CH_PASSIVE_ONLY}},
10522          },
10523
10524         {                       /* Custom Japan */
10525          "ZZC",
10526          .bg_channels = 11,
10527          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10528                 {2427, 4}, {2432, 5}, {2437, 6},
10529                 {2442, 7}, {2447, 8}, {2452, 9},
10530                 {2457, 10}, {2462, 11}},
10531          .a_channels = 4,
10532          .a = {{5170, 34}, {5190, 38},
10533                {5210, 42}, {5230, 46}},
10534          },
10535
10536         {                       /* Custom */
10537          "ZZM",
10538          .bg_channels = 11,
10539          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10540                 {2427, 4}, {2432, 5}, {2437, 6},
10541                 {2442, 7}, {2447, 8}, {2452, 9},
10542                 {2457, 10}, {2462, 11}},
10543          },
10544
10545         {                       /* Europe */
10546          "ZZE",
10547          .bg_channels = 13,
10548          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10549                 {2427, 4}, {2432, 5}, {2437, 6},
10550                 {2442, 7}, {2447, 8}, {2452, 9},
10551                 {2457, 10}, {2462, 11}, {2467, 12},
10552                 {2472, 13}},
10553          .a_channels = 19,
10554          .a = {{5180, 36},
10555                {5200, 40},
10556                {5220, 44},
10557                {5240, 48},
10558                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
10559                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
10560                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
10561                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
10562                {5500, 100, IEEE80211_CH_PASSIVE_ONLY},
10563                {5520, 104, IEEE80211_CH_PASSIVE_ONLY},
10564                {5540, 108, IEEE80211_CH_PASSIVE_ONLY},
10565                {5560, 112, IEEE80211_CH_PASSIVE_ONLY},
10566                {5580, 116, IEEE80211_CH_PASSIVE_ONLY},
10567                {5600, 120, IEEE80211_CH_PASSIVE_ONLY},
10568                {5620, 124, IEEE80211_CH_PASSIVE_ONLY},
10569                {5640, 128, IEEE80211_CH_PASSIVE_ONLY},
10570                {5660, 132, IEEE80211_CH_PASSIVE_ONLY},
10571                {5680, 136, IEEE80211_CH_PASSIVE_ONLY},
10572                {5700, 140, IEEE80211_CH_PASSIVE_ONLY}},
10573          },
10574
10575         {                       /* Custom Japan */
10576          "ZZJ",
10577          .bg_channels = 14,
10578          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10579                 {2427, 4}, {2432, 5}, {2437, 6},
10580                 {2442, 7}, {2447, 8}, {2452, 9},
10581                 {2457, 10}, {2462, 11}, {2467, 12},
10582                 {2472, 13}, {2484, 14, IEEE80211_CH_B_ONLY}},
10583          .a_channels = 4,
10584          .a = {{5170, 34}, {5190, 38},
10585                {5210, 42}, {5230, 46}},
10586          },
10587
10588         {                       /* Rest of World */
10589          "ZZR",
10590          .bg_channels = 14,
10591          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10592                 {2427, 4}, {2432, 5}, {2437, 6},
10593                 {2442, 7}, {2447, 8}, {2452, 9},
10594                 {2457, 10}, {2462, 11}, {2467, 12},
10595                 {2472, 13}, {2484, 14, IEEE80211_CH_B_ONLY |
10596                              IEEE80211_CH_PASSIVE_ONLY}},
10597          },
10598
10599         {                       /* High Band */
10600          "ZZH",
10601          .bg_channels = 13,
10602          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10603                 {2427, 4}, {2432, 5}, {2437, 6},
10604                 {2442, 7}, {2447, 8}, {2452, 9},
10605                 {2457, 10}, {2462, 11},
10606                 {2467, 12, IEEE80211_CH_PASSIVE_ONLY},
10607                 {2472, 13, IEEE80211_CH_PASSIVE_ONLY}},
10608          .a_channels = 4,
10609          .a = {{5745, 149}, {5765, 153},
10610                {5785, 157}, {5805, 161}},
10611          },
10612
10613         {                       /* Custom Europe */
10614          "ZZG",
10615          .bg_channels = 13,
10616          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10617                 {2427, 4}, {2432, 5}, {2437, 6},
10618                 {2442, 7}, {2447, 8}, {2452, 9},
10619                 {2457, 10}, {2462, 11},
10620                 {2467, 12}, {2472, 13}},
10621          .a_channels = 4,
10622          .a = {{5180, 36}, {5200, 40},
10623                {5220, 44}, {5240, 48}},
10624          },
10625
10626         {                       /* Europe */
10627          "ZZK",
10628          .bg_channels = 13,
10629          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10630                 {2427, 4}, {2432, 5}, {2437, 6},
10631                 {2442, 7}, {2447, 8}, {2452, 9},
10632                 {2457, 10}, {2462, 11},
10633                 {2467, 12, IEEE80211_CH_PASSIVE_ONLY},
10634                 {2472, 13, IEEE80211_CH_PASSIVE_ONLY}},
10635          .a_channels = 24,
10636          .a = {{5180, 36, IEEE80211_CH_PASSIVE_ONLY},
10637                {5200, 40, IEEE80211_CH_PASSIVE_ONLY},
10638                {5220, 44, IEEE80211_CH_PASSIVE_ONLY},
10639                {5240, 48, IEEE80211_CH_PASSIVE_ONLY},
10640                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
10641                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
10642                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
10643                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
10644                {5500, 100, IEEE80211_CH_PASSIVE_ONLY},
10645                {5520, 104, IEEE80211_CH_PASSIVE_ONLY},
10646                {5540, 108, IEEE80211_CH_PASSIVE_ONLY},
10647                {5560, 112, IEEE80211_CH_PASSIVE_ONLY},
10648                {5580, 116, IEEE80211_CH_PASSIVE_ONLY},
10649                {5600, 120, IEEE80211_CH_PASSIVE_ONLY},
10650                {5620, 124, IEEE80211_CH_PASSIVE_ONLY},
10651                {5640, 128, IEEE80211_CH_PASSIVE_ONLY},
10652                {5660, 132, IEEE80211_CH_PASSIVE_ONLY},
10653                {5680, 136, IEEE80211_CH_PASSIVE_ONLY},
10654                {5700, 140, IEEE80211_CH_PASSIVE_ONLY},
10655                {5745, 149, IEEE80211_CH_PASSIVE_ONLY},
10656                {5765, 153, IEEE80211_CH_PASSIVE_ONLY},
10657                {5785, 157, IEEE80211_CH_PASSIVE_ONLY},
10658                {5805, 161, IEEE80211_CH_PASSIVE_ONLY},
10659                {5825, 165, IEEE80211_CH_PASSIVE_ONLY}},
10660          },
10661
10662         {                       /* Europe */
10663          "ZZL",
10664          .bg_channels = 11,
10665          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10666                 {2427, 4}, {2432, 5}, {2437, 6},
10667                 {2442, 7}, {2447, 8}, {2452, 9},
10668                 {2457, 10}, {2462, 11}},
10669          .a_channels = 13,
10670          .a = {{5180, 36, IEEE80211_CH_PASSIVE_ONLY},
10671                {5200, 40, IEEE80211_CH_PASSIVE_ONLY},
10672                {5220, 44, IEEE80211_CH_PASSIVE_ONLY},
10673                {5240, 48, IEEE80211_CH_PASSIVE_ONLY},
10674                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
10675                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
10676                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
10677                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
10678                {5745, 149, IEEE80211_CH_PASSIVE_ONLY},
10679                {5765, 153, IEEE80211_CH_PASSIVE_ONLY},
10680                {5785, 157, IEEE80211_CH_PASSIVE_ONLY},
10681                {5805, 161, IEEE80211_CH_PASSIVE_ONLY},
10682                {5825, 165, IEEE80211_CH_PASSIVE_ONLY}},
10683          }
10684 };
10685
10686 /* GEO code borrowed from ieee80211_geo.c */
10687 static int ipw_is_valid_channel(struct ieee80211_device *ieee, u8 channel)
10688 {
10689         int i;
10690
10691         /* Driver needs to initialize the geography map before using
10692          * these helper functions */
10693         BUG_ON(ieee->geo.bg_channels == 0 && ieee->geo.a_channels == 0);
10694
10695         if (ieee->freq_band & IEEE80211_24GHZ_BAND)
10696                 for (i = 0; i < ieee->geo.bg_channels; i++)
10697                         /* NOTE: If G mode is currently supported but
10698                          * this is a B only channel, we don't see it
10699                          * as valid. */
10700                         if ((ieee->geo.bg[i].channel == channel) &&
10701                             (!(ieee->mode & IEEE_G) ||
10702                              !(ieee->geo.bg[i].flags & IEEE80211_CH_B_ONLY)))
10703                                 return IEEE80211_24GHZ_BAND;
10704
10705         if (ieee->freq_band & IEEE80211_52GHZ_BAND)
10706                 for (i = 0; i < ieee->geo.a_channels; i++)
10707                         if (ieee->geo.a[i].channel == channel)
10708                                 return IEEE80211_52GHZ_BAND;
10709
10710         return 0;
10711 }
10712
10713 static int ipw_channel_to_index(struct ieee80211_device *ieee, u8 channel)
10714 {
10715         int i;
10716
10717         /* Driver needs to initialize the geography map before using
10718          * these helper functions */
10719         BUG_ON(ieee->geo.bg_channels == 0 && ieee->geo.a_channels == 0);
10720
10721         if (ieee->freq_band & IEEE80211_24GHZ_BAND)
10722                 for (i = 0; i < ieee->geo.bg_channels; i++)
10723                         if (ieee->geo.bg[i].channel == channel)
10724                                 return i;
10725
10726         if (ieee->freq_band & IEEE80211_52GHZ_BAND)
10727                 for (i = 0; i < ieee->geo.a_channels; i++)
10728                         if (ieee->geo.a[i].channel == channel)
10729                                 return i;
10730
10731         return -1;
10732 }
10733
10734 static u8 ipw_freq_to_channel(struct ieee80211_device *ieee, u32 freq)
10735 {
10736         int i;
10737
10738         /* Driver needs to initialize the geography map before using
10739          * these helper functions */
10740         BUG_ON(ieee->geo.bg_channels == 0 && ieee->geo.a_channels == 0);
10741
10742         freq /= 100000;
10743
10744         if (ieee->freq_band & IEEE80211_24GHZ_BAND)
10745                 for (i = 0; i < ieee->geo.bg_channels; i++)
10746                         if (ieee->geo.bg[i].freq == freq)
10747                                 return ieee->geo.bg[i].channel;
10748
10749         if (ieee->freq_band & IEEE80211_52GHZ_BAND)
10750                 for (i = 0; i < ieee->geo.a_channels; i++)
10751                         if (ieee->geo.a[i].freq == freq)
10752                                 return ieee->geo.a[i].channel;
10753
10754         return 0;
10755 }
10756
10757 static int ipw_set_geo(struct ieee80211_device *ieee,
10758                        const struct ieee80211_geo *geo)
10759 {
10760         memcpy(ieee->geo.name, geo->name, 3);
10761         ieee->geo.name[3] = '\0';
10762         ieee->geo.bg_channels = geo->bg_channels;
10763         ieee->geo.a_channels = geo->a_channels;
10764         memcpy(ieee->geo.bg, geo->bg, geo->bg_channels *
10765                sizeof(struct ieee80211_channel));
10766         memcpy(ieee->geo.a, geo->a, ieee->geo.a_channels *
10767                sizeof(struct ieee80211_channel));
10768         return 0;
10769 }
10770
10771 static const struct ieee80211_geo *ipw_get_geo(struct ieee80211_device *ieee)
10772 {
10773         return &ieee->geo;
10774 }
10775
10776 #define MAX_HW_RESTARTS 5
10777 static int ipw_up(struct ipw_priv *priv)
10778 {
10779         int rc, i, j;
10780
10781         if (priv->status & STATUS_EXIT_PENDING)
10782                 return -EIO;
10783
10784         if (cmdlog && !priv->cmdlog) {
10785                 priv->cmdlog = kmalloc(sizeof(*priv->cmdlog) * cmdlog,
10786                                        GFP_KERNEL);
10787                 if (priv->cmdlog == NULL) {
10788                         IPW_ERROR("Error allocating %d command log entries.\n",
10789                                   cmdlog);
10790                 } else {
10791                         memset(priv->cmdlog, 0, sizeof(*priv->cmdlog) * cmdlog);
10792                         priv->cmdlog_len = cmdlog;
10793                 }
10794         }
10795
10796         for (i = 0; i < MAX_HW_RESTARTS; i++) {
10797                 /* Load the microcode, firmware, and eeprom.
10798                  * Also start the clocks. */
10799                 rc = ipw_load(priv);
10800                 if (rc) {
10801                         IPW_ERROR("Unable to load firmware: %d\n", rc);
10802                         return rc;
10803                 }
10804
10805                 ipw_init_ordinals(priv);
10806                 if (!(priv->config & CFG_CUSTOM_MAC))
10807                         eeprom_parse_mac(priv, priv->mac_addr);
10808                 memcpy(priv->net_dev->dev_addr, priv->mac_addr, ETH_ALEN);
10809
10810                 for (j = 0; j < ARRAY_SIZE(ipw_geos); j++) {
10811                         if (!memcmp(&priv->eeprom[EEPROM_COUNTRY_CODE],
10812                                     ipw_geos[j].name, 3))
10813                                 break;
10814                 }
10815                 if (j == ARRAY_SIZE(ipw_geos)) {
10816                         IPW_WARNING("SKU [%c%c%c] not recognized.\n",
10817                                     priv->eeprom[EEPROM_COUNTRY_CODE + 0],
10818                                     priv->eeprom[EEPROM_COUNTRY_CODE + 1],
10819                                     priv->eeprom[EEPROM_COUNTRY_CODE + 2]);
10820                         j = 0;
10821                 }
10822                 if (ipw_set_geo(priv->ieee, &ipw_geos[j])) {
10823                         IPW_WARNING("Could not set geography.");
10824                         return 0;
10825                 }
10826
10827                 IPW_DEBUG_INFO("Geography %03d [%s] detected.\n",
10828                                j, priv->ieee->geo.name);
10829
10830                 if (priv->status & STATUS_RF_KILL_SW) {
10831                         IPW_WARNING("Radio disabled by module parameter.\n");
10832                         return 0;
10833                 } else if (rf_kill_active(priv)) {
10834                         IPW_WARNING("Radio Frequency Kill Switch is On:\n"
10835                                     "Kill switch must be turned off for "
10836                                     "wireless networking to work.\n");
10837                         queue_delayed_work(priv->workqueue, &priv->rf_kill,
10838                                            2 * HZ);
10839                         return 0;
10840                 }
10841
10842                 rc = ipw_config(priv);
10843                 if (!rc) {
10844                         IPW_DEBUG_INFO("Configured device on count %i\n", i);
10845
10846                         /* If configure to try and auto-associate, kick
10847                          * off a scan. */
10848                         queue_work(priv->workqueue, &priv->request_scan);
10849
10850                         return 0;
10851                 }
10852
10853                 IPW_DEBUG_INFO("Device configuration failed: 0x%08X\n", rc);
10854                 IPW_DEBUG_INFO("Failed to config device on retry %d of %d\n",
10855                                i, MAX_HW_RESTARTS);
10856
10857                 /* We had an error bringing up the hardware, so take it
10858                  * all the way back down so we can try again */
10859                 ipw_down(priv);
10860         }
10861
10862         /* tried to restart and config the device for as long as our
10863          * patience could withstand */
10864         IPW_ERROR("Unable to initialize device after %d attempts.\n", i);
10865
10866         return -EIO;
10867 }
10868
10869 static void ipw_bg_up(void *data)
10870 {
10871         struct ipw_priv *priv = data;
10872         down(&priv->sem);
10873         ipw_up(data);
10874         up(&priv->sem);
10875 }
10876
10877 static void ipw_deinit(struct ipw_priv *priv)
10878 {
10879         int i;
10880
10881         if (priv->status & STATUS_SCANNING) {
10882                 IPW_DEBUG_INFO("Aborting scan during shutdown.\n");
10883                 ipw_abort_scan(priv);
10884         }
10885
10886         if (priv->status & STATUS_ASSOCIATED) {
10887                 IPW_DEBUG_INFO("Disassociating during shutdown.\n");
10888                 ipw_disassociate(priv);
10889         }
10890
10891         ipw_led_shutdown(priv);
10892
10893         /* Wait up to 1s for status to change to not scanning and not
10894          * associated (disassociation can take a while for a ful 802.11
10895          * exchange */
10896         for (i = 1000; i && (priv->status &
10897                              (STATUS_DISASSOCIATING |
10898                               STATUS_ASSOCIATED | STATUS_SCANNING)); i--)
10899                 udelay(10);
10900
10901         if (priv->status & (STATUS_DISASSOCIATING |
10902                             STATUS_ASSOCIATED | STATUS_SCANNING))
10903                 IPW_DEBUG_INFO("Still associated or scanning...\n");
10904         else
10905                 IPW_DEBUG_INFO("Took %dms to de-init\n", 1000 - i);
10906
10907         /* Attempt to disable the card */
10908         ipw_send_card_disable(priv, 0);
10909
10910         priv->status &= ~STATUS_INIT;
10911 }
10912
10913 static void ipw_down(struct ipw_priv *priv)
10914 {
10915         int exit_pending = priv->status & STATUS_EXIT_PENDING;
10916
10917         priv->status |= STATUS_EXIT_PENDING;
10918
10919         if (ipw_is_init(priv))
10920                 ipw_deinit(priv);
10921
10922         /* Wipe out the EXIT_PENDING status bit if we are not actually
10923          * exiting the module */
10924         if (!exit_pending)
10925                 priv->status &= ~STATUS_EXIT_PENDING;
10926
10927         /* tell the device to stop sending interrupts */
10928         ipw_disable_interrupts(priv);
10929
10930         /* Clear all bits but the RF Kill */
10931         priv->status &= STATUS_RF_KILL_MASK | STATUS_EXIT_PENDING;
10932         netif_carrier_off(priv->net_dev);
10933         netif_stop_queue(priv->net_dev);
10934
10935         ipw_stop_nic(priv);
10936
10937         ipw_led_radio_off(priv);
10938 }
10939
10940 static void ipw_bg_down(void *data)
10941 {
10942         struct ipw_priv *priv = data;
10943         down(&priv->sem);
10944         ipw_down(data);
10945         up(&priv->sem);
10946 }
10947
10948 /* Called by register_netdev() */
10949 static int ipw_net_init(struct net_device *dev)
10950 {
10951         struct ipw_priv *priv = ieee80211_priv(dev);
10952         down(&priv->sem);
10953
10954         if (ipw_up(priv)) {
10955                 up(&priv->sem);
10956                 return -EIO;
10957         }
10958
10959         up(&priv->sem);
10960         return 0;
10961 }
10962
10963 /* PCI driver stuff */
10964 static struct pci_device_id card_ids[] = {
10965         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2701, 0, 0, 0},
10966         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2702, 0, 0, 0},
10967         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2711, 0, 0, 0},
10968         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2712, 0, 0, 0},
10969         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2721, 0, 0, 0},
10970         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2722, 0, 0, 0},
10971         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2731, 0, 0, 0},
10972         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2732, 0, 0, 0},
10973         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2741, 0, 0, 0},
10974         {PCI_VENDOR_ID_INTEL, 0x1043, 0x103c, 0x2741, 0, 0, 0},
10975         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2742, 0, 0, 0},
10976         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2751, 0, 0, 0},
10977         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2752, 0, 0, 0},
10978         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2753, 0, 0, 0},
10979         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2754, 0, 0, 0},
10980         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2761, 0, 0, 0},
10981         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2762, 0, 0, 0},
10982         {PCI_VENDOR_ID_INTEL, 0x104f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
10983         {PCI_VENDOR_ID_INTEL, 0x4220, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* BG */
10984         {PCI_VENDOR_ID_INTEL, 0x4221, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* BG */
10985         {PCI_VENDOR_ID_INTEL, 0x4223, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* ABG */
10986         {PCI_VENDOR_ID_INTEL, 0x4224, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* ABG */
10987
10988         /* required last entry */
10989         {0,}
10990 };
10991
10992 MODULE_DEVICE_TABLE(pci, card_ids);
10993
10994 static struct attribute *ipw_sysfs_entries[] = {
10995         &dev_attr_rf_kill.attr,
10996         &dev_attr_direct_dword.attr,
10997         &dev_attr_indirect_byte.attr,
10998         &dev_attr_indirect_dword.attr,
10999         &dev_attr_mem_gpio_reg.attr,
11000         &dev_attr_command_event_reg.attr,
11001         &dev_attr_nic_type.attr,
11002         &dev_attr_status.attr,
11003         &dev_attr_cfg.attr,
11004         &dev_attr_error.attr,
11005         &dev_attr_event_log.attr,
11006         &dev_attr_cmd_log.attr,
11007         &dev_attr_eeprom_delay.attr,
11008         &dev_attr_ucode_version.attr,
11009         &dev_attr_rtc.attr,
11010         &dev_attr_scan_age.attr,
11011         &dev_attr_led.attr,
11012         &dev_attr_speed_scan.attr,
11013         &dev_attr_net_stats.attr,
11014         NULL
11015 };
11016
11017 static struct attribute_group ipw_attribute_group = {
11018         .name = NULL,           /* put in device directory */
11019         .attrs = ipw_sysfs_entries,
11020 };
11021
11022 static int ipw_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
11023 {
11024         int err = 0;
11025         struct net_device *net_dev;
11026         void __iomem *base;
11027         u32 length, val;
11028         struct ipw_priv *priv;
11029         int i;
11030
11031         net_dev = alloc_ieee80211(sizeof(struct ipw_priv));
11032         if (net_dev == NULL) {
11033                 err = -ENOMEM;
11034                 goto out;
11035         }
11036
11037         priv = ieee80211_priv(net_dev);
11038         priv->ieee = netdev_priv(net_dev);
11039
11040         priv->net_dev = net_dev;
11041         priv->pci_dev = pdev;
11042 #ifdef CONFIG_IPW2200_DEBUG
11043         ipw_debug_level = debug;
11044 #endif
11045         spin_lock_init(&priv->lock);
11046         for (i = 0; i < IPW_IBSS_MAC_HASH_SIZE; i++)
11047                 INIT_LIST_HEAD(&priv->ibss_mac_hash[i]);
11048
11049         init_MUTEX(&priv->sem);
11050         if (pci_enable_device(pdev)) {
11051                 err = -ENODEV;
11052                 goto out_free_ieee80211;
11053         }
11054
11055         pci_set_master(pdev);
11056
11057         err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
11058         if (!err)
11059                 err = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
11060         if (err) {
11061                 printk(KERN_WARNING DRV_NAME ": No suitable DMA available.\n");
11062                 goto out_pci_disable_device;
11063         }
11064
11065         pci_set_drvdata(pdev, priv);
11066
11067         err = pci_request_regions(pdev, DRV_NAME);
11068         if (err)
11069                 goto out_pci_disable_device;
11070
11071         /* We disable the RETRY_TIMEOUT register (0x41) to keep
11072          * PCI Tx retries from interfering with C3 CPU state */
11073         pci_read_config_dword(pdev, 0x40, &val);
11074         if ((val & 0x0000ff00) != 0)
11075                 pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
11076
11077         length = pci_resource_len(pdev, 0);
11078         priv->hw_len = length;
11079
11080         base = ioremap_nocache(pci_resource_start(pdev, 0), length);
11081         if (!base) {
11082                 err = -ENODEV;
11083                 goto out_pci_release_regions;
11084         }
11085
11086         priv->hw_base = base;
11087         IPW_DEBUG_INFO("pci_resource_len = 0x%08x\n", length);
11088         IPW_DEBUG_INFO("pci_resource_base = %p\n", base);
11089
11090         err = ipw_setup_deferred_work(priv);
11091         if (err) {
11092                 IPW_ERROR("Unable to setup deferred work\n");
11093                 goto out_iounmap;
11094         }
11095
11096         ipw_sw_reset(priv, 1);
11097
11098         err = request_irq(pdev->irq, ipw_isr, SA_SHIRQ, DRV_NAME, priv);
11099         if (err) {
11100                 IPW_ERROR("Error allocating IRQ %d\n", pdev->irq);
11101                 goto out_destroy_workqueue;
11102         }
11103
11104         SET_MODULE_OWNER(net_dev);
11105         SET_NETDEV_DEV(net_dev, &pdev->dev);
11106
11107         down(&priv->sem);
11108
11109         priv->ieee->hard_start_xmit = ipw_net_hard_start_xmit;
11110         priv->ieee->set_security = shim__set_security;
11111         priv->ieee->is_queue_full = ipw_net_is_queue_full;
11112
11113 #ifdef CONFIG_IPW_QOS
11114         priv->ieee->handle_probe_response = ipw_handle_beacon;
11115         priv->ieee->handle_beacon = ipw_handle_probe_response;
11116         priv->ieee->handle_assoc_response = ipw_handle_assoc_response;
11117 #endif                          /* CONFIG_IPW_QOS */
11118
11119         priv->ieee->perfect_rssi = -20;
11120         priv->ieee->worst_rssi = -85;
11121
11122         net_dev->open = ipw_net_open;
11123         net_dev->stop = ipw_net_stop;
11124         net_dev->init = ipw_net_init;
11125         net_dev->get_stats = ipw_net_get_stats;
11126         net_dev->set_multicast_list = ipw_net_set_multicast_list;
11127         net_dev->set_mac_address = ipw_net_set_mac_address;
11128         priv->wireless_data.spy_data = &priv->ieee->spy_data;
11129         net_dev->wireless_data = &priv->wireless_data;
11130         net_dev->wireless_handlers = &ipw_wx_handler_def;
11131         net_dev->ethtool_ops = &ipw_ethtool_ops;
11132         net_dev->irq = pdev->irq;
11133         net_dev->base_addr = (unsigned long)priv->hw_base;
11134         net_dev->mem_start = pci_resource_start(pdev, 0);
11135         net_dev->mem_end = net_dev->mem_start + pci_resource_len(pdev, 0) - 1;
11136
11137         err = sysfs_create_group(&pdev->dev.kobj, &ipw_attribute_group);
11138         if (err) {
11139                 IPW_ERROR("failed to create sysfs device attributes\n");
11140                 up(&priv->sem);
11141                 goto out_release_irq;
11142         }
11143
11144         up(&priv->sem);
11145         err = register_netdev(net_dev);
11146         if (err) {
11147                 IPW_ERROR("failed to register network device\n");
11148                 goto out_remove_sysfs;
11149         }
11150         return 0;
11151
11152       out_remove_sysfs:
11153         sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
11154       out_release_irq:
11155         free_irq(pdev->irq, priv);
11156       out_destroy_workqueue:
11157         destroy_workqueue(priv->workqueue);
11158         priv->workqueue = NULL;
11159       out_iounmap:
11160         iounmap(priv->hw_base);
11161       out_pci_release_regions:
11162         pci_release_regions(pdev);
11163       out_pci_disable_device:
11164         pci_disable_device(pdev);
11165         pci_set_drvdata(pdev, NULL);
11166       out_free_ieee80211:
11167         free_ieee80211(priv->net_dev);
11168       out:
11169         return err;
11170 }
11171
11172 static void ipw_pci_remove(struct pci_dev *pdev)
11173 {
11174         struct ipw_priv *priv = pci_get_drvdata(pdev);
11175         struct list_head *p, *q;
11176         int i;
11177
11178         if (!priv)
11179                 return;
11180
11181         down(&priv->sem);
11182
11183         priv->status |= STATUS_EXIT_PENDING;
11184         ipw_down(priv);
11185         sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
11186
11187         up(&priv->sem);
11188
11189         unregister_netdev(priv->net_dev);
11190
11191         if (priv->rxq) {
11192                 ipw_rx_queue_free(priv, priv->rxq);
11193                 priv->rxq = NULL;
11194         }
11195         ipw_tx_queue_free(priv);
11196
11197         if (priv->cmdlog) {
11198                 kfree(priv->cmdlog);
11199                 priv->cmdlog = NULL;
11200         }
11201         /* ipw_down will ensure that there is no more pending work
11202          * in the workqueue's, so we can safely remove them now. */
11203         cancel_delayed_work(&priv->adhoc_check);
11204         cancel_delayed_work(&priv->gather_stats);
11205         cancel_delayed_work(&priv->request_scan);
11206         cancel_delayed_work(&priv->rf_kill);
11207         cancel_delayed_work(&priv->scan_check);
11208         destroy_workqueue(priv->workqueue);
11209         priv->workqueue = NULL;
11210
11211         /* Free MAC hash list for ADHOC */
11212         for (i = 0; i < IPW_IBSS_MAC_HASH_SIZE; i++) {
11213                 list_for_each_safe(p, q, &priv->ibss_mac_hash[i]) {
11214                         list_del(p);
11215                         kfree(list_entry(p, struct ipw_ibss_seq, list));
11216                 }
11217         }
11218
11219         if (priv->error) {
11220                 ipw_free_error_log(priv->error);
11221                 priv->error = NULL;
11222         }
11223
11224         free_irq(pdev->irq, priv);
11225         iounmap(priv->hw_base);
11226         pci_release_regions(pdev);
11227         pci_disable_device(pdev);
11228         pci_set_drvdata(pdev, NULL);
11229         free_ieee80211(priv->net_dev);
11230         free_firmware();
11231 }
11232
11233 #ifdef CONFIG_PM
11234 static int ipw_pci_suspend(struct pci_dev *pdev, pm_message_t state)
11235 {
11236         struct ipw_priv *priv = pci_get_drvdata(pdev);
11237         struct net_device *dev = priv->net_dev;
11238
11239         printk(KERN_INFO "%s: Going into suspend...\n", dev->name);
11240
11241         /* Take down the device; powers it off, etc. */
11242         ipw_down(priv);
11243
11244         /* Remove the PRESENT state of the device */
11245         netif_device_detach(dev);
11246
11247         pci_save_state(pdev);
11248         pci_disable_device(pdev);
11249         pci_set_power_state(pdev, pci_choose_state(pdev, state));
11250
11251         return 0;
11252 }
11253
11254 static int ipw_pci_resume(struct pci_dev *pdev)
11255 {
11256         struct ipw_priv *priv = pci_get_drvdata(pdev);
11257         struct net_device *dev = priv->net_dev;
11258         u32 val;
11259
11260         printk(KERN_INFO "%s: Coming out of suspend...\n", dev->name);
11261
11262         pci_set_power_state(pdev, PCI_D0);
11263         pci_enable_device(pdev);
11264         pci_restore_state(pdev);
11265
11266         /*
11267          * Suspend/Resume resets the PCI configuration space, so we have to
11268          * re-disable the RETRY_TIMEOUT register (0x41) to keep PCI Tx retries
11269          * from interfering with C3 CPU state. pci_restore_state won't help
11270          * here since it only restores the first 64 bytes pci config header.
11271          */
11272         pci_read_config_dword(pdev, 0x40, &val);
11273         if ((val & 0x0000ff00) != 0)
11274                 pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
11275
11276         /* Set the device back into the PRESENT state; this will also wake
11277          * the queue of needed */
11278         netif_device_attach(dev);
11279
11280         /* Bring the device back up */
11281         queue_work(priv->workqueue, &priv->up);
11282
11283         return 0;
11284 }
11285 #endif
11286
11287 /* driver initialization stuff */
11288 static struct pci_driver ipw_driver = {
11289         .name = DRV_NAME,
11290         .id_table = card_ids,
11291         .probe = ipw_pci_probe,
11292         .remove = __devexit_p(ipw_pci_remove),
11293 #ifdef CONFIG_PM
11294         .suspend = ipw_pci_suspend,
11295         .resume = ipw_pci_resume,
11296 #endif
11297 };
11298
11299 static int __init ipw_init(void)
11300 {
11301         int ret;
11302
11303         printk(KERN_INFO DRV_NAME ": " DRV_DESCRIPTION ", " DRV_VERSION "\n");
11304         printk(KERN_INFO DRV_NAME ": " DRV_COPYRIGHT "\n");
11305
11306         ret = pci_module_init(&ipw_driver);
11307         if (ret) {
11308                 IPW_ERROR("Unable to initialize PCI module\n");
11309                 return ret;
11310         }
11311
11312         ret = driver_create_file(&ipw_driver.driver, &driver_attr_debug_level);
11313         if (ret) {
11314                 IPW_ERROR("Unable to create driver sysfs file\n");
11315                 pci_unregister_driver(&ipw_driver);
11316                 return ret;
11317         }
11318
11319         return ret;
11320 }
11321
11322 static void __exit ipw_exit(void)
11323 {
11324         driver_remove_file(&ipw_driver.driver, &driver_attr_debug_level);
11325         pci_unregister_driver(&ipw_driver);
11326 }
11327
11328 module_param(disable, int, 0444);
11329 MODULE_PARM_DESC(disable, "manually disable the radio (default 0 [radio on])");
11330
11331 module_param(associate, int, 0444);
11332 MODULE_PARM_DESC(associate, "auto associate when scanning (default on)");
11333
11334 module_param(auto_create, int, 0444);
11335 MODULE_PARM_DESC(auto_create, "auto create adhoc network (default on)");
11336
11337 module_param(led, int, 0444);
11338 MODULE_PARM_DESC(led, "enable led control on some systems (default 0 off)\n");
11339
11340 module_param(debug, int, 0444);
11341 MODULE_PARM_DESC(debug, "debug output mask");
11342
11343 module_param(channel, int, 0444);
11344 MODULE_PARM_DESC(channel, "channel to limit associate to (default 0 [ANY])");
11345
11346 #ifdef CONFIG_IPW_QOS
11347 module_param(qos_enable, int, 0444);
11348 MODULE_PARM_DESC(qos_enable, "enable all QoS functionalitis");
11349
11350 module_param(qos_burst_enable, int, 0444);
11351 MODULE_PARM_DESC(qos_burst_enable, "enable QoS burst mode");
11352
11353 module_param(qos_no_ack_mask, int, 0444);
11354 MODULE_PARM_DESC(qos_no_ack_mask, "mask Tx_Queue to no ack");
11355
11356 module_param(burst_duration_CCK, int, 0444);
11357 MODULE_PARM_DESC(burst_duration_CCK, "set CCK burst value");
11358
11359 module_param(burst_duration_OFDM, int, 0444);
11360 MODULE_PARM_DESC(burst_duration_OFDM, "set OFDM burst value");
11361 #endif                          /* CONFIG_IPW_QOS */
11362
11363 #ifdef CONFIG_IPW2200_MONITOR
11364 module_param(mode, int, 0444);
11365 MODULE_PARM_DESC(mode, "network mode (0=BSS,1=IBSS,2=Monitor)");
11366 #else
11367 module_param(mode, int, 0444);
11368 MODULE_PARM_DESC(mode, "network mode (0=BSS,1=IBSS)");
11369 #endif
11370
11371 module_param(bt_coexist, int, 0444);
11372 MODULE_PARM_DESC(bt_coexist, "enable bluetooth coexistence (default off)");
11373
11374 module_param(hwcrypto, int, 0444);
11375 MODULE_PARM_DESC(hwcrypto, "enable hardware crypto (default on)");
11376
11377 module_param(cmdlog, int, 0444);
11378 MODULE_PARM_DESC(cmdlog,
11379                  "allocate a ring buffer for logging firmware commands");
11380
11381 module_exit(ipw_exit);
11382 module_init(ipw_init);