iwmc3200wifi: protect rx_tickets and rx_packets[] lists
[pandora-kernel.git] / drivers / net / wireless / iwmc3200wifi / main.c
1 /*
2  * Intel Wireless Multicomm 3200 WiFi driver
3  *
4  * Copyright (C) 2009 Intel Corporation. All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  *   * Redistributions of source code must retain the above copyright
11  *     notice, this list of conditions and the following disclaimer.
12  *   * Redistributions in binary form must reproduce the above copyright
13  *     notice, this list of conditions and the following disclaimer in
14  *     the documentation and/or other materials provided with the
15  *     distribution.
16  *   * Neither the name of Intel Corporation nor the names of its
17  *     contributors may be used to endorse or promote products derived
18  *     from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
23  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
24  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
26  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  *
32  *
33  * Intel Corporation <ilw@linux.intel.com>
34  * Samuel Ortiz <samuel.ortiz@intel.com>
35  * Zhu Yi <yi.zhu@intel.com>
36  *
37  */
38
39 #include <linux/kernel.h>
40 #include <linux/netdevice.h>
41 #include <linux/sched.h>
42 #include <linux/ieee80211.h>
43 #include <linux/wireless.h>
44
45 #include "iwm.h"
46 #include "debug.h"
47 #include "bus.h"
48 #include "umac.h"
49 #include "commands.h"
50 #include "hal.h"
51 #include "fw.h"
52 #include "rx.h"
53
54 static struct iwm_conf def_iwm_conf = {
55
56         .sdio_ior_timeout       = 5000,
57         .calib_map              = BIT(CALIB_CFG_DC_IDX) |
58                                   BIT(CALIB_CFG_LO_IDX) |
59                                   BIT(CALIB_CFG_TX_IQ_IDX)      |
60                                   BIT(CALIB_CFG_RX_IQ_IDX)      |
61                                   BIT(SHILOH_PHY_CALIBRATE_BASE_BAND_CMD),
62         .expected_calib_map     = BIT(PHY_CALIBRATE_DC_CMD)     |
63                                   BIT(PHY_CALIBRATE_LO_CMD)     |
64                                   BIT(PHY_CALIBRATE_TX_IQ_CMD)  |
65                                   BIT(PHY_CALIBRATE_RX_IQ_CMD)  |
66                                   BIT(SHILOH_PHY_CALIBRATE_BASE_BAND_CMD),
67         .ct_kill_entry          = 110,
68         .ct_kill_exit           = 110,
69         .reset_on_fatal_err     = 1,
70         .auto_connect           = 1,
71         .enable_qos             = 1,
72         .mode                   = UMAC_MODE_BSS,
73
74         /* UMAC configuration */
75         .power_index            = 0,
76         .frag_threshold         = IEEE80211_MAX_FRAG_THRESHOLD,
77         .rts_threshold          = IEEE80211_MAX_RTS_THRESHOLD,
78         .cts_to_self            = 0,
79
80         .assoc_timeout          = 2,
81         .roam_timeout           = 10,
82         .wireless_mode          = WIRELESS_MODE_11A | WIRELESS_MODE_11G |
83                                   WIRELESS_MODE_11N,
84
85         /* IBSS */
86         .ibss_band              = UMAC_BAND_2GHZ,
87         .ibss_channel           = 1,
88
89         .mac_addr               = {0x00, 0x02, 0xb3, 0x01, 0x02, 0x03},
90 };
91
92 static int modparam_reset;
93 module_param_named(reset, modparam_reset, bool, 0644);
94 MODULE_PARM_DESC(reset, "reset on firmware errors (default 0 [not reset])");
95
96 static int modparam_wimax_enable = 1;
97 module_param_named(wimax_enable, modparam_wimax_enable, bool, 0644);
98 MODULE_PARM_DESC(wimax_enable, "Enable wimax core (default 1 [wimax enabled])");
99
100 int iwm_mode_to_nl80211_iftype(int mode)
101 {
102         switch (mode) {
103         case UMAC_MODE_BSS:
104                 return NL80211_IFTYPE_STATION;
105         case UMAC_MODE_IBSS:
106                 return NL80211_IFTYPE_ADHOC;
107         default:
108                 return NL80211_IFTYPE_UNSPECIFIED;
109         }
110
111         return 0;
112 }
113
114 static void iwm_statistics_request(struct work_struct *work)
115 {
116         struct iwm_priv *iwm =
117                 container_of(work, struct iwm_priv, stats_request.work);
118
119         iwm_send_umac_stats_req(iwm, 0);
120 }
121
122 static void iwm_disconnect_work(struct work_struct *work)
123 {
124         struct iwm_priv *iwm =
125                 container_of(work, struct iwm_priv, disconnect.work);
126
127         if (iwm->umac_profile_active)
128                 iwm_invalidate_mlme_profile(iwm);
129
130         clear_bit(IWM_STATUS_ASSOCIATED, &iwm->status);
131         iwm->umac_profile_active = 0;
132         memset(iwm->bssid, 0, ETH_ALEN);
133         iwm->channel = 0;
134
135         iwm_link_off(iwm);
136
137         wake_up_interruptible(&iwm->mlme_queue);
138
139         cfg80211_disconnected(iwm_to_ndev(iwm), 0, NULL, 0, GFP_KERNEL);
140 }
141
142 static void iwm_ct_kill_work(struct work_struct *work)
143 {
144         struct iwm_priv *iwm =
145                 container_of(work, struct iwm_priv, ct_kill_delay.work);
146         struct wiphy *wiphy = iwm_to_wiphy(iwm);
147
148         IWM_INFO(iwm, "CT kill delay timeout\n");
149
150         wiphy_rfkill_set_hw_state(wiphy, false);
151 }
152
153 static int __iwm_up(struct iwm_priv *iwm);
154 static int __iwm_down(struct iwm_priv *iwm);
155
156 static void iwm_reset_worker(struct work_struct *work)
157 {
158         struct iwm_priv *iwm;
159         struct iwm_umac_profile *profile = NULL;
160         int uninitialized_var(ret), retry = 0;
161
162         iwm = container_of(work, struct iwm_priv, reset_worker);
163
164         /*
165          * XXX: The iwm->mutex is introduced purely for this reset work,
166          * because the other users for iwm_up and iwm_down are only netdev
167          * ndo_open and ndo_stop which are already protected by rtnl.
168          * Please remove iwm->mutex together if iwm_reset_worker() is not
169          * required in the future.
170          */
171         if (!mutex_trylock(&iwm->mutex)) {
172                 IWM_WARN(iwm, "We are in the middle of interface bringing "
173                          "UP/DOWN. Skip driver resetting.\n");
174                 return;
175         }
176
177         if (iwm->umac_profile_active) {
178                 profile = kmalloc(sizeof(struct iwm_umac_profile), GFP_KERNEL);
179                 if (profile)
180                         memcpy(profile, iwm->umac_profile, sizeof(*profile));
181                 else
182                         IWM_ERR(iwm, "Couldn't alloc memory for profile\n");
183         }
184
185         __iwm_down(iwm);
186
187         while (retry++ < 3) {
188                 ret = __iwm_up(iwm);
189                 if (!ret)
190                         break;
191
192                 schedule_timeout_uninterruptible(10 * HZ);
193         }
194
195         if (ret) {
196                 IWM_WARN(iwm, "iwm_up() failed: %d\n", ret);
197
198                 kfree(profile);
199                 goto out;
200         }
201
202         if (profile) {
203                 IWM_DBG_MLME(iwm, DBG, "Resend UMAC profile\n");
204                 memcpy(iwm->umac_profile, profile, sizeof(*profile));
205                 iwm_send_mlme_profile(iwm);
206                 kfree(profile);
207         } else
208                 clear_bit(IWM_STATUS_RESETTING, &iwm->status);
209
210  out:
211         mutex_unlock(&iwm->mutex);
212 }
213
214 static void iwm_auth_retry_worker(struct work_struct *work)
215 {
216         struct iwm_priv *iwm;
217         int i, ret;
218
219         iwm = container_of(work, struct iwm_priv, auth_retry_worker);
220         if (iwm->umac_profile_active) {
221                 ret = iwm_invalidate_mlme_profile(iwm);
222                 if (ret < 0)
223                         return;
224         }
225
226         iwm->umac_profile->sec.auth_type = UMAC_AUTH_TYPE_LEGACY_PSK;
227
228         ret = iwm_send_mlme_profile(iwm);
229         if (ret < 0)
230                 return;
231
232         for (i = 0; i < IWM_NUM_KEYS; i++)
233                 if (iwm->keys[i].key_len)
234                         iwm_set_key(iwm, 0, &iwm->keys[i]);
235
236         iwm_set_tx_key(iwm, iwm->default_key);
237 }
238
239
240
241 static void iwm_watchdog(unsigned long data)
242 {
243         struct iwm_priv *iwm = (struct iwm_priv *)data;
244
245         IWM_WARN(iwm, "Watchdog expired: UMAC stalls!\n");
246
247         if (modparam_reset)
248                 iwm_resetting(iwm);
249 }
250
251 int iwm_priv_init(struct iwm_priv *iwm)
252 {
253         int i, j;
254         char name[32];
255
256         iwm->status = 0;
257         INIT_LIST_HEAD(&iwm->pending_notif);
258         init_waitqueue_head(&iwm->notif_queue);
259         init_waitqueue_head(&iwm->nonwifi_queue);
260         init_waitqueue_head(&iwm->wifi_ntfy_queue);
261         init_waitqueue_head(&iwm->mlme_queue);
262         memcpy(&iwm->conf, &def_iwm_conf, sizeof(struct iwm_conf));
263         spin_lock_init(&iwm->tx_credit.lock);
264         INIT_LIST_HEAD(&iwm->wifi_pending_cmd);
265         INIT_LIST_HEAD(&iwm->nonwifi_pending_cmd);
266         iwm->wifi_seq_num = UMAC_WIFI_SEQ_NUM_BASE;
267         iwm->nonwifi_seq_num = UMAC_NONWIFI_SEQ_NUM_BASE;
268         spin_lock_init(&iwm->cmd_lock);
269         iwm->scan_id = 1;
270         INIT_DELAYED_WORK(&iwm->stats_request, iwm_statistics_request);
271         INIT_DELAYED_WORK(&iwm->disconnect, iwm_disconnect_work);
272         INIT_DELAYED_WORK(&iwm->ct_kill_delay, iwm_ct_kill_work);
273         INIT_WORK(&iwm->reset_worker, iwm_reset_worker);
274         INIT_WORK(&iwm->auth_retry_worker, iwm_auth_retry_worker);
275         INIT_LIST_HEAD(&iwm->bss_list);
276
277         skb_queue_head_init(&iwm->rx_list);
278         INIT_LIST_HEAD(&iwm->rx_tickets);
279         spin_lock_init(&iwm->ticket_lock);
280         for (i = 0; i < IWM_RX_ID_HASH; i++) {
281                 INIT_LIST_HEAD(&iwm->rx_packets[i]);
282                 spin_lock_init(&iwm->packet_lock[i]);
283         }
284
285         INIT_WORK(&iwm->rx_worker, iwm_rx_worker);
286
287         iwm->rx_wq = create_singlethread_workqueue(KBUILD_MODNAME "_rx");
288         if (!iwm->rx_wq)
289                 return -EAGAIN;
290
291         for (i = 0; i < IWM_TX_QUEUES; i++) {
292                 INIT_WORK(&iwm->txq[i].worker, iwm_tx_worker);
293                 snprintf(name, 32, KBUILD_MODNAME "_tx_%d", i);
294                 iwm->txq[i].id = i;
295                 iwm->txq[i].wq = create_singlethread_workqueue(name);
296                 if (!iwm->txq[i].wq)
297                         return -EAGAIN;
298
299                 skb_queue_head_init(&iwm->txq[i].queue);
300                 skb_queue_head_init(&iwm->txq[i].stopped_queue);
301                 spin_lock_init(&iwm->txq[i].lock);
302         }
303
304         for (i = 0; i < IWM_NUM_KEYS; i++)
305                 memset(&iwm->keys[i], 0, sizeof(struct iwm_key));
306
307         iwm->default_key = -1;
308
309         for (i = 0; i < IWM_STA_TABLE_NUM; i++)
310                 for (j = 0; j < IWM_UMAC_TID_NR; j++) {
311                         mutex_init(&iwm->sta_table[i].tid_info[j].mutex);
312                         iwm->sta_table[i].tid_info[j].stopped = false;
313                 }
314
315         init_timer(&iwm->watchdog);
316         iwm->watchdog.function = iwm_watchdog;
317         iwm->watchdog.data = (unsigned long)iwm;
318         mutex_init(&iwm->mutex);
319
320         iwm->last_fw_err = kzalloc(sizeof(struct iwm_fw_error_hdr),
321                                    GFP_KERNEL);
322         if (iwm->last_fw_err == NULL)
323                 return -ENOMEM;
324
325         return 0;
326 }
327
328 void iwm_priv_deinit(struct iwm_priv *iwm)
329 {
330         int i;
331
332         for (i = 0; i < IWM_TX_QUEUES; i++)
333                 destroy_workqueue(iwm->txq[i].wq);
334
335         destroy_workqueue(iwm->rx_wq);
336         kfree(iwm->last_fw_err);
337 }
338
339 /*
340  * We reset all the structures, and we reset the UMAC.
341  * After calling this routine, you're expected to reload
342  * the firmware.
343  */
344 void iwm_reset(struct iwm_priv *iwm)
345 {
346         struct iwm_notif *notif, *next;
347
348         if (test_bit(IWM_STATUS_READY, &iwm->status))
349                 iwm_target_reset(iwm);
350
351         if (test_bit(IWM_STATUS_RESETTING, &iwm->status)) {
352                 iwm->status = 0;
353                 set_bit(IWM_STATUS_RESETTING, &iwm->status);
354         } else
355                 iwm->status = 0;
356         iwm->scan_id = 1;
357
358         list_for_each_entry_safe(notif, next, &iwm->pending_notif, pending) {
359                 list_del(&notif->pending);
360                 kfree(notif->buf);
361                 kfree(notif);
362         }
363
364         iwm_cmd_flush(iwm);
365
366         flush_workqueue(iwm->rx_wq);
367
368         iwm_link_off(iwm);
369 }
370
371 void iwm_resetting(struct iwm_priv *iwm)
372 {
373         set_bit(IWM_STATUS_RESETTING, &iwm->status);
374
375         schedule_work(&iwm->reset_worker);
376 }
377
378 /*
379  * Notification code:
380  *
381  * We're faced with the following issue: Any host command can
382  * have an answer or not, and if there's an answer to expect,
383  * it can be treated synchronously or asynchronously.
384  * To work around the synchronous answer case, we implemented
385  * our notification mechanism.
386  * When a code path needs to wait for a command response
387  * synchronously, it calls notif_handle(), which waits for the
388  * right notification to show up, and then process it. Before
389  * starting to wait, it registered as a waiter for this specific
390  * answer (by toggling a bit in on of the handler_map), so that
391  * the rx code knows that it needs to send a notification to the
392  * waiting processes. It does so by calling iwm_notif_send(),
393  * which adds the notification to the pending notifications list,
394  * and then wakes the waiting processes up.
395  */
396 int iwm_notif_send(struct iwm_priv *iwm, struct iwm_wifi_cmd *cmd,
397                    u8 cmd_id, u8 source, u8 *buf, unsigned long buf_size)
398 {
399         struct iwm_notif *notif;
400
401         notif = kzalloc(sizeof(struct iwm_notif), GFP_KERNEL);
402         if (!notif) {
403                 IWM_ERR(iwm, "Couldn't alloc memory for notification\n");
404                 return -ENOMEM;
405         }
406
407         INIT_LIST_HEAD(&notif->pending);
408         notif->cmd = cmd;
409         notif->cmd_id = cmd_id;
410         notif->src = source;
411         notif->buf = kzalloc(buf_size, GFP_KERNEL);
412         if (!notif->buf) {
413                 IWM_ERR(iwm, "Couldn't alloc notification buffer\n");
414                 kfree(notif);
415                 return -ENOMEM;
416         }
417         notif->buf_size = buf_size;
418         memcpy(notif->buf, buf, buf_size);
419         list_add_tail(&notif->pending, &iwm->pending_notif);
420
421         wake_up_interruptible(&iwm->notif_queue);
422
423         return 0;
424 }
425
426 static struct iwm_notif *iwm_notif_find(struct iwm_priv *iwm, u32 cmd,
427                                         u8 source)
428 {
429         struct iwm_notif *notif;
430
431         list_for_each_entry(notif, &iwm->pending_notif, pending) {
432                 if ((notif->cmd_id == cmd) && (notif->src == source)) {
433                         list_del(&notif->pending);
434                         return notif;
435                 }
436         }
437
438         return NULL;
439 }
440
441 static struct iwm_notif *iwm_notif_wait(struct iwm_priv *iwm, u32 cmd,
442                                         u8 source, long timeout)
443 {
444         int ret;
445         struct iwm_notif *notif;
446         unsigned long *map = NULL;
447
448         switch (source) {
449         case IWM_SRC_LMAC:
450                 map = &iwm->lmac_handler_map[0];
451                 break;
452         case IWM_SRC_UMAC:
453                 map = &iwm->umac_handler_map[0];
454                 break;
455         case IWM_SRC_UDMA:
456                 map = &iwm->udma_handler_map[0];
457                 break;
458         }
459
460         set_bit(cmd, map);
461
462         ret = wait_event_interruptible_timeout(iwm->notif_queue,
463                          ((notif = iwm_notif_find(iwm, cmd, source)) != NULL),
464                                                timeout);
465         clear_bit(cmd, map);
466
467         if (!ret)
468                 return NULL;
469
470         return notif;
471 }
472
473 int iwm_notif_handle(struct iwm_priv *iwm, u32 cmd, u8 source, long timeout)
474 {
475         int ret;
476         struct iwm_notif *notif;
477
478         notif = iwm_notif_wait(iwm, cmd, source, timeout);
479         if (!notif)
480                 return -ETIME;
481
482         ret = iwm_rx_handle_resp(iwm, notif->buf, notif->buf_size, notif->cmd);
483         kfree(notif->buf);
484         kfree(notif);
485
486         return ret;
487 }
488
489 static int iwm_config_boot_params(struct iwm_priv *iwm)
490 {
491         struct iwm_udma_nonwifi_cmd target_cmd;
492         int ret;
493
494         /* check Wimax is off and config debug monitor */
495         if (!modparam_wimax_enable) {
496                 u32 data1 = 0x1f;
497                 u32 addr1 = 0x606BE258;
498
499                 u32 data2_set = 0x0;
500                 u32 data2_clr = 0x1;
501                 u32 addr2 = 0x606BE100;
502
503                 u32 data3 = 0x1;
504                 u32 addr3 = 0x606BEC00;
505
506                 target_cmd.resp = 0;
507                 target_cmd.handle_by_hw = 0;
508                 target_cmd.eop = 1;
509
510                 target_cmd.opcode = UMAC_HDI_OUT_OPCODE_WRITE;
511                 target_cmd.addr = cpu_to_le32(addr1);
512                 target_cmd.op1_sz = cpu_to_le32(sizeof(u32));
513                 target_cmd.op2 = 0;
514
515                 ret = iwm_hal_send_target_cmd(iwm, &target_cmd, &data1);
516                 if (ret < 0) {
517                         IWM_ERR(iwm, "iwm_hal_send_target_cmd failed\n");
518                         return ret;
519                 }
520
521                 target_cmd.opcode = UMAC_HDI_OUT_OPCODE_READ_MODIFY_WRITE;
522                 target_cmd.addr = cpu_to_le32(addr2);
523                 target_cmd.op1_sz = cpu_to_le32(data2_set);
524                 target_cmd.op2 = cpu_to_le32(data2_clr);
525
526                 ret = iwm_hal_send_target_cmd(iwm, &target_cmd, &data1);
527                 if (ret < 0) {
528                         IWM_ERR(iwm, "iwm_hal_send_target_cmd failed\n");
529                         return ret;
530                 }
531
532                 target_cmd.opcode = UMAC_HDI_OUT_OPCODE_WRITE;
533                 target_cmd.addr = cpu_to_le32(addr3);
534                 target_cmd.op1_sz = cpu_to_le32(sizeof(u32));
535                 target_cmd.op2 = 0;
536
537                 ret = iwm_hal_send_target_cmd(iwm, &target_cmd, &data3);
538                 if (ret < 0) {
539                         IWM_ERR(iwm, "iwm_hal_send_target_cmd failed\n");
540                         return ret;
541                 }
542         }
543
544         return 0;
545 }
546
547 void iwm_init_default_profile(struct iwm_priv *iwm,
548                               struct iwm_umac_profile *profile)
549 {
550         memset(profile, 0, sizeof(struct iwm_umac_profile));
551
552         profile->sec.auth_type = UMAC_AUTH_TYPE_OPEN;
553         profile->sec.flags = UMAC_SEC_FLG_LEGACY_PROFILE;
554         profile->sec.ucast_cipher = UMAC_CIPHER_TYPE_NONE;
555         profile->sec.mcast_cipher = UMAC_CIPHER_TYPE_NONE;
556
557         if (iwm->conf.enable_qos)
558                 profile->flags |= cpu_to_le16(UMAC_PROFILE_QOS_ALLOWED);
559
560         profile->wireless_mode = iwm->conf.wireless_mode;
561         profile->mode = cpu_to_le32(iwm->conf.mode);
562
563         profile->ibss.atim = 0;
564         profile->ibss.beacon_interval = 100;
565         profile->ibss.join_only = 0;
566         profile->ibss.band = iwm->conf.ibss_band;
567         profile->ibss.channel = iwm->conf.ibss_channel;
568 }
569
570 void iwm_link_on(struct iwm_priv *iwm)
571 {
572         netif_carrier_on(iwm_to_ndev(iwm));
573         netif_tx_wake_all_queues(iwm_to_ndev(iwm));
574
575         iwm_send_umac_stats_req(iwm, 0);
576 }
577
578 void iwm_link_off(struct iwm_priv *iwm)
579 {
580         struct iw_statistics *wstats = &iwm->wstats;
581         int i;
582
583         netif_tx_stop_all_queues(iwm_to_ndev(iwm));
584         netif_carrier_off(iwm_to_ndev(iwm));
585
586         for (i = 0; i < IWM_TX_QUEUES; i++) {
587                 skb_queue_purge(&iwm->txq[i].queue);
588                 skb_queue_purge(&iwm->txq[i].stopped_queue);
589
590                 iwm->txq[i].concat_count = 0;
591                 iwm->txq[i].concat_ptr = iwm->txq[i].concat_buf;
592
593                 flush_workqueue(iwm->txq[i].wq);
594         }
595
596         iwm_rx_free(iwm);
597
598         cancel_delayed_work_sync(&iwm->stats_request);
599         memset(wstats, 0, sizeof(struct iw_statistics));
600         wstats->qual.updated = IW_QUAL_ALL_INVALID;
601
602         kfree(iwm->req_ie);
603         iwm->req_ie = NULL;
604         iwm->req_ie_len = 0;
605         kfree(iwm->resp_ie);
606         iwm->resp_ie = NULL;
607         iwm->resp_ie_len = 0;
608
609         del_timer_sync(&iwm->watchdog);
610 }
611
612 static void iwm_bss_list_clean(struct iwm_priv *iwm)
613 {
614         struct iwm_bss_info *bss, *next;
615
616         list_for_each_entry_safe(bss, next, &iwm->bss_list, node) {
617                 list_del(&bss->node);
618                 kfree(bss->bss);
619                 kfree(bss);
620         }
621 }
622
623 static int iwm_channels_init(struct iwm_priv *iwm)
624 {
625         int ret;
626
627         ret = iwm_send_umac_channel_list(iwm);
628         if (ret) {
629                 IWM_ERR(iwm, "Send channel list failed\n");
630                 return ret;
631         }
632
633         ret = iwm_notif_handle(iwm, UMAC_CMD_OPCODE_GET_CHAN_INFO_LIST,
634                                IWM_SRC_UMAC, WAIT_NOTIF_TIMEOUT);
635         if (ret) {
636                 IWM_ERR(iwm, "Didn't get a channel list notification\n");
637                 return ret;
638         }
639
640         return 0;
641 }
642
643 static int __iwm_up(struct iwm_priv *iwm)
644 {
645         int ret;
646         struct iwm_notif *notif_reboot, *notif_ack = NULL;
647         struct wiphy *wiphy = iwm_to_wiphy(iwm);
648         u32 wireless_mode;
649
650         ret = iwm_bus_enable(iwm);
651         if (ret) {
652                 IWM_ERR(iwm, "Couldn't enable function\n");
653                 return ret;
654         }
655
656         iwm_rx_setup_handlers(iwm);
657
658         /* Wait for initial BARKER_REBOOT from hardware */
659         notif_reboot = iwm_notif_wait(iwm, IWM_BARKER_REBOOT_NOTIFICATION,
660                                       IWM_SRC_UDMA, 2 * HZ);
661         if (!notif_reboot) {
662                 IWM_ERR(iwm, "Wait for REBOOT_BARKER timeout\n");
663                 goto err_disable;
664         }
665
666         /* We send the barker back */
667         ret = iwm_bus_send_chunk(iwm, notif_reboot->buf, 16);
668         if (ret) {
669                 IWM_ERR(iwm, "REBOOT barker response failed\n");
670                 kfree(notif_reboot);
671                 goto err_disable;
672         }
673
674         kfree(notif_reboot->buf);
675         kfree(notif_reboot);
676
677         /* Wait for ACK_BARKER from hardware */
678         notif_ack = iwm_notif_wait(iwm, IWM_ACK_BARKER_NOTIFICATION,
679                                    IWM_SRC_UDMA, 2 * HZ);
680         if (!notif_ack) {
681                 IWM_ERR(iwm, "Wait for ACK_BARKER timeout\n");
682                 goto err_disable;
683         }
684
685         kfree(notif_ack->buf);
686         kfree(notif_ack);
687
688         /* We start to config static boot parameters */
689         ret = iwm_config_boot_params(iwm);
690         if (ret) {
691                 IWM_ERR(iwm, "Config boot parameters failed\n");
692                 goto err_disable;
693         }
694
695         ret = iwm_read_mac(iwm, iwm_to_ndev(iwm)->dev_addr);
696         if (ret) {
697                 IWM_ERR(iwm, "MAC reading failed\n");
698                 goto err_disable;
699         }
700         memcpy(iwm_to_ndev(iwm)->perm_addr, iwm_to_ndev(iwm)->dev_addr,
701                 ETH_ALEN);
702
703         /* We can load the FWs */
704         ret = iwm_load_fw(iwm);
705         if (ret) {
706                 IWM_ERR(iwm, "FW loading failed\n");
707                 goto err_disable;
708         }
709
710         ret = iwm_eeprom_fat_channels(iwm);
711         if (ret) {
712                 IWM_ERR(iwm, "Couldnt read HT channels EEPROM entries\n");
713                 goto err_fw;
714         }
715
716         /*
717          * Read our SKU capabilities.
718          * If it's valid, we AND the configured wireless mode with the
719          * device EEPROM value as the current profile wireless mode.
720          */
721         wireless_mode = iwm_eeprom_wireless_mode(iwm);
722         if (wireless_mode) {
723                 iwm->conf.wireless_mode &= wireless_mode;
724                 if (iwm->umac_profile)
725                         iwm->umac_profile->wireless_mode =
726                                         iwm->conf.wireless_mode;
727         } else
728                 IWM_ERR(iwm, "Wrong SKU capabilities: 0x%x\n",
729                         *((u16 *)iwm_eeprom_access(iwm, IWM_EEPROM_SKU_CAP)));
730
731         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "L%s_U%s",
732                  iwm->lmac_version, iwm->umac_version);
733
734         /* We configure the UMAC and enable the wifi module */
735         ret = iwm_send_umac_config(iwm,
736                         cpu_to_le32(UMAC_RST_CTRL_FLG_WIFI_CORE_EN) |
737                         cpu_to_le32(UMAC_RST_CTRL_FLG_WIFI_LINK_EN) |
738                         cpu_to_le32(UMAC_RST_CTRL_FLG_WIFI_MLME_EN));
739         if (ret) {
740                 IWM_ERR(iwm, "UMAC config failed\n");
741                 goto err_fw;
742         }
743
744         ret = iwm_notif_handle(iwm, UMAC_NOTIFY_OPCODE_WIFI_CORE_STATUS,
745                                IWM_SRC_UMAC, WAIT_NOTIF_TIMEOUT);
746         if (ret) {
747                 IWM_ERR(iwm, "Didn't get a wifi core status notification\n");
748                 goto err_fw;
749         }
750
751         if (iwm->core_enabled != (UMAC_NTFY_WIFI_CORE_STATUS_LINK_EN |
752                                   UMAC_NTFY_WIFI_CORE_STATUS_MLME_EN)) {
753                 IWM_DBG_BOOT(iwm, DBG, "Not all cores enabled:0x%x\n",
754                              iwm->core_enabled);
755                 ret = iwm_notif_handle(iwm, UMAC_NOTIFY_OPCODE_WIFI_CORE_STATUS,
756                                IWM_SRC_UMAC, WAIT_NOTIF_TIMEOUT);
757                 if (ret) {
758                         IWM_ERR(iwm, "Didn't get a core status notification\n");
759                         goto err_fw;
760                 }
761
762                 if (iwm->core_enabled != (UMAC_NTFY_WIFI_CORE_STATUS_LINK_EN |
763                                           UMAC_NTFY_WIFI_CORE_STATUS_MLME_EN)) {
764                         IWM_ERR(iwm, "Not all cores enabled: 0x%x\n",
765                                 iwm->core_enabled);
766                         goto err_fw;
767                 } else {
768                         IWM_INFO(iwm, "All cores enabled\n");
769                 }
770         }
771
772         ret = iwm_channels_init(iwm);
773         if (ret < 0) {
774                 IWM_ERR(iwm, "Couldn't init channels\n");
775                 goto err_fw;
776         }
777
778         /* Set the READY bit to indicate interface is brought up successfully */
779         set_bit(IWM_STATUS_READY, &iwm->status);
780
781         return 0;
782
783  err_fw:
784         iwm_eeprom_exit(iwm);
785
786  err_disable:
787         ret = iwm_bus_disable(iwm);
788         if (ret < 0)
789                 IWM_ERR(iwm, "Couldn't disable function\n");
790
791         return -EIO;
792 }
793
794 int iwm_up(struct iwm_priv *iwm)
795 {
796         int ret;
797
798         mutex_lock(&iwm->mutex);
799         ret = __iwm_up(iwm);
800         mutex_unlock(&iwm->mutex);
801
802         return ret;
803 }
804
805 static int __iwm_down(struct iwm_priv *iwm)
806 {
807         int ret;
808
809         /* The interface is already down */
810         if (!test_bit(IWM_STATUS_READY, &iwm->status))
811                 return 0;
812
813         if (iwm->scan_request) {
814                 cfg80211_scan_done(iwm->scan_request, true);
815                 iwm->scan_request = NULL;
816         }
817
818         clear_bit(IWM_STATUS_READY, &iwm->status);
819
820         iwm_eeprom_exit(iwm);
821         iwm_bss_list_clean(iwm);
822         iwm_init_default_profile(iwm, iwm->umac_profile);
823         iwm->umac_profile_active = false;
824         iwm->default_key = -1;
825         iwm->core_enabled = 0;
826
827         ret = iwm_bus_disable(iwm);
828         if (ret < 0) {
829                 IWM_ERR(iwm, "Couldn't disable function\n");
830                 return ret;
831         }
832
833         return 0;
834 }
835
836 int iwm_down(struct iwm_priv *iwm)
837 {
838         int ret;
839
840         mutex_lock(&iwm->mutex);
841         ret = __iwm_down(iwm);
842         mutex_unlock(&iwm->mutex);
843
844         return ret;
845 }