drivers/net/wireless/ipw2200.c

   1 /******************************************************************************
   2
   3   Copyright(c) 2003 - 2006 Intel Corporation. All rights reserved.
   4
   5   802.11 status code portion of this file from ethereal-0.10.6:
   6     Copyright 2000, Axis Communications AB
   7     Ethereal - Network traffic analyzer
   8     By Gerald Combs <gerald@ethereal.com>
   9     Copyright 1998 Gerald Combs
  10
  11   This program is free software; you can redistribute it and/or modify it
  12   under the terms of version 2 of the GNU General Public License as
  13   published by the Free Software Foundation.
  14
  15   This program is distributed in the hope that it will be useful, but WITHOUT
  16   ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  17   FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  18   more details.
  19
  20   You should have received a copy of the GNU General Public License along with
  21   this program; if not, write to the Free Software Foundation, Inc., 59
  22   Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  23
  24   The full GNU General Public License is included in this distribution in the
  25   file called LICENSE.
  26
  27   Contact Information:
  28   James P. Ketrenos <ipw2100-admin@linux.intel.com>
  29   Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  30
  31 ******************************************************************************/
  32
  33 #include "ipw2200.h"
  34
  35
  36 #ifndef KBUILD_EXTMOD
  37 #define VK "k"
  38 #else
  39 #define VK
  40 #endif
  41
  42 #ifdef CONFIG_IPW2200_DEBUG
  43 #define VD "d"
  44 #else
  45 #define VD
  46 #endif
  47
  48 #ifdef CONFIG_IPW2200_MONITOR
  49 #define VM "m"
  50 #else
  51 #define VM
  52 #endif
  53
  54 #ifdef CONFIG_IPW2200_PROMISCUOUS
  55 #define VP "p"
  56 #else
  57 #define VP
  58 #endif
  59
  60 #ifdef CONFIG_IPW2200_RADIOTAP
  61 #define VR "r"
  62 #else
  63 #define VR
  64 #endif
  65
  66 #ifdef CONFIG_IPW2200_QOS
  67 #define VQ "q"
  68 #else
  69 #define VQ
  70 #endif
  71
  72 #define IPW2200_VERSION "1.2.2" VK VD VM VP VR VQ
  73 #define DRV_DESCRIPTION "Intel(R) PRO/Wireless 2200/2915 Network Driver"
  74 #define DRV_COPYRIGHT   "Copyright(c) 2003-2006 Intel Corporation"
  75 #define DRV_VERSION     IPW2200_VERSION
  76
  77 #define ETH_P_80211_STATS (ETH_P_80211_RAW + 1)
  78
  79 MODULE_DESCRIPTION(DRV_DESCRIPTION);
  80 MODULE_VERSION(DRV_VERSION);
  81 MODULE_AUTHOR(DRV_COPYRIGHT);
  82 MODULE_LICENSE("GPL");
  83
  84 static int cmdlog = 0;
  85 static int debug = 0;
  86 static int channel = 0;
  87 static int mode = 0;
  88
  89 static u32 ipw_debug_level;
  90 static int associate;
  91 static int auto_create = 1;
  92 static int led = 0;
  93 static int disable = 0;
  94 static int bt_coexist = 0;
  95 static int hwcrypto = 0;
  96 static int roaming = 1;
  97 static const char ipw_modes[] = {
  98         'a', 'b', 'g', '?'
  99 };
 100 static int antenna = CFG_SYS_ANTENNA_BOTH;
 101
 102 #ifdef CONFIG_IPW2200_PROMISCUOUS
 103 static int rtap_iface = 0;     /* def: 0 -- do not create rtap interface */
 104 #endif
 105
 106
 107 #ifdef CONFIG_IPW2200_QOS
 108 static int qos_enable = 0;
 109 static int qos_burst_enable = 0;
 110 static int qos_no_ack_mask = 0;
 111 static int burst_duration_CCK = 0;
 112 static int burst_duration_OFDM = 0;
 113
 114 static struct ieee80211_qos_parameters def_qos_parameters_OFDM = {
 115         {QOS_TX0_CW_MIN_OFDM, QOS_TX1_CW_MIN_OFDM, QOS_TX2_CW_MIN_OFDM,
 116          QOS_TX3_CW_MIN_OFDM},
 117         {QOS_TX0_CW_MAX_OFDM, QOS_TX1_CW_MAX_OFDM, QOS_TX2_CW_MAX_OFDM,
 118          QOS_TX3_CW_MAX_OFDM},
 119         {QOS_TX0_AIFS, QOS_TX1_AIFS, QOS_TX2_AIFS, QOS_TX3_AIFS},
 120         {QOS_TX0_ACM, QOS_TX1_ACM, QOS_TX2_ACM, QOS_TX3_ACM},
 121         {QOS_TX0_TXOP_LIMIT_OFDM, QOS_TX1_TXOP_LIMIT_OFDM,
 122          QOS_TX2_TXOP_LIMIT_OFDM, QOS_TX3_TXOP_LIMIT_OFDM}
 123 };
 124
 125 static struct ieee80211_qos_parameters def_qos_parameters_CCK = {
 126         {QOS_TX0_CW_MIN_CCK, QOS_TX1_CW_MIN_CCK, QOS_TX2_CW_MIN_CCK,
 127          QOS_TX3_CW_MIN_CCK},
 128         {QOS_TX0_CW_MAX_CCK, QOS_TX1_CW_MAX_CCK, QOS_TX2_CW_MAX_CCK,
 129          QOS_TX3_CW_MAX_CCK},
 130         {QOS_TX0_AIFS, QOS_TX1_AIFS, QOS_TX2_AIFS, QOS_TX3_AIFS},
 131         {QOS_TX0_ACM, QOS_TX1_ACM, QOS_TX2_ACM, QOS_TX3_ACM},
 132         {QOS_TX0_TXOP_LIMIT_CCK, QOS_TX1_TXOP_LIMIT_CCK, QOS_TX2_TXOP_LIMIT_CCK,
 133          QOS_TX3_TXOP_LIMIT_CCK}
 134 };
 135
 136 static struct ieee80211_qos_parameters def_parameters_OFDM = {
 137         {DEF_TX0_CW_MIN_OFDM, DEF_TX1_CW_MIN_OFDM, DEF_TX2_CW_MIN_OFDM,
 138          DEF_TX3_CW_MIN_OFDM},
 139         {DEF_TX0_CW_MAX_OFDM, DEF_TX1_CW_MAX_OFDM, DEF_TX2_CW_MAX_OFDM,
 140          DEF_TX3_CW_MAX_OFDM},
 141         {DEF_TX0_AIFS, DEF_TX1_AIFS, DEF_TX2_AIFS, DEF_TX3_AIFS},
 142         {DEF_TX0_ACM, DEF_TX1_ACM, DEF_TX2_ACM, DEF_TX3_ACM},
 143         {DEF_TX0_TXOP_LIMIT_OFDM, DEF_TX1_TXOP_LIMIT_OFDM,
 144          DEF_TX2_TXOP_LIMIT_OFDM, DEF_TX3_TXOP_LIMIT_OFDM}
 145 };
 146
 147 static struct ieee80211_qos_parameters def_parameters_CCK = {
 148         {DEF_TX0_CW_MIN_CCK, DEF_TX1_CW_MIN_CCK, DEF_TX2_CW_MIN_CCK,
 149          DEF_TX3_CW_MIN_CCK},
 150         {DEF_TX0_CW_MAX_CCK, DEF_TX1_CW_MAX_CCK, DEF_TX2_CW_MAX_CCK,
 151          DEF_TX3_CW_MAX_CCK},
 152         {DEF_TX0_AIFS, DEF_TX1_AIFS, DEF_TX2_AIFS, DEF_TX3_AIFS},
 153         {DEF_TX0_ACM, DEF_TX1_ACM, DEF_TX2_ACM, DEF_TX3_ACM},
 154         {DEF_TX0_TXOP_LIMIT_CCK, DEF_TX1_TXOP_LIMIT_CCK, DEF_TX2_TXOP_LIMIT_CCK,
 155          DEF_TX3_TXOP_LIMIT_CCK}
 156 };
 157
 158 static u8 qos_oui[QOS_OUI_LEN] = { 0x00, 0x50, 0xF2 };
 159
 160 static int from_priority_to_tx_queue[] = {
 161         IPW_TX_QUEUE_1, IPW_TX_QUEUE_2, IPW_TX_QUEUE_2, IPW_TX_QUEUE_1,
 162         IPW_TX_QUEUE_3, IPW_TX_QUEUE_3, IPW_TX_QUEUE_4, IPW_TX_QUEUE_4
 163 };
 164
 165 static u32 ipw_qos_get_burst_duration(struct ipw_priv *priv);
 166
 167 static int ipw_send_qos_params_command(struct ipw_priv *priv, struct ieee80211_qos_parameters
 168                                        *qos_param);
 169 static int ipw_send_qos_info_command(struct ipw_priv *priv, struct ieee80211_qos_information_element
 170                                      *qos_param);
 171 #endif                          /* CONFIG_IPW2200_QOS */
 172
 173 static struct iw_statistics *ipw_get_wireless_stats(struct net_device *dev);
 174 static void ipw_remove_current_network(struct ipw_priv *priv);
 175 static void ipw_rx(struct ipw_priv *priv);
 176 static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
 177                                 struct clx2_tx_queue *txq, int qindex);
 178 static int ipw_queue_reset(struct ipw_priv *priv);
 179
 180 static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
 181                              int len, int sync);
 182
 183 static void ipw_tx_queue_free(struct ipw_priv *);
 184
 185 static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *);
 186 static void ipw_rx_queue_free(struct ipw_priv *, struct ipw_rx_queue *);
 187 static void ipw_rx_queue_replenish(void *);
 188 static int ipw_up(struct ipw_priv *);
 189 static void ipw_bg_up(struct work_struct *work);
 190 static void ipw_down(struct ipw_priv *);
 191 static void ipw_bg_down(struct work_struct *work);
 192 static int ipw_config(struct ipw_priv *);
 193 static int init_supported_rates(struct ipw_priv *priv,
 194                                 struct ipw_supported_rates *prates);
 195 static void ipw_set_hwcrypto_keys(struct ipw_priv *);
 196 static void ipw_send_wep_keys(struct ipw_priv *, int);
 197
 198 static int snprint_line(char *buf, size_t count,
 199                         const u8 * data, u32 len, u32 ofs)
 200 {
 201         int out, i, j, l;
 202         char c;
 203
 204         out = snprintf(buf, count, "%08X", ofs);
 205
 206         for (l = 0, i = 0; i < 2; i++) {
 207                 out += snprintf(buf + out, count - out, " ");
 208                 for (j = 0; j < 8 && l < len; j++, l++)
 209                         out += snprintf(buf + out, count - out, "%02X ",
 210                                         data[(i * 8 + j)]);
 211                 for (; j < 8; j++)
 212                         out += snprintf(buf + out, count - out, "   ");
 213         }
 214
 215         out += snprintf(buf + out, count - out, " ");
 216         for (l = 0, i = 0; i < 2; i++) {
 217                 out += snprintf(buf + out, count - out, " ");
 218                 for (j = 0; j < 8 && l < len; j++, l++) {
 219                         c = data[(i * 8 + j)];
 220                         if (!isascii(c) || !isprint(c))
 221                                 c = '.';
 222
 223                         out += snprintf(buf + out, count - out, "%c", c);
 224                 }
 225
 226                 for (; j < 8; j++)
 227                         out += snprintf(buf + out, count - out, " ");
 228         }
 229
 230         return out;
 231 }
 232
 233 static void printk_buf(int level, const u8 * data, u32 len)
 234 {
 235         char line[81];
 236         u32 ofs = 0;
 237         if (!(ipw_debug_level & level))
 238                 return;
 239
 240         while (len) {
 241                 snprint_line(line, sizeof(line), &data[ofs],
 242                              min(len, 16U), ofs);
 243                 printk(KERN_DEBUG "%s\n", line);
 244                 ofs += 16;
 245                 len -= min(len, 16U);
 246         }
 247 }
 248
 249 static int snprintk_buf(u8 * output, size_t size, const u8 * data, size_t len)
 250 {
 251         size_t out = size;
 252         u32 ofs = 0;
 253         int total = 0;
 254
 255         while (size && len) {
 256                 out = snprint_line(output, size, &data[ofs],
 257                                    min_t(size_t, len, 16U), ofs);
 258
 259                 ofs += 16;
 260                 output += out;
 261                 size -= out;
 262                 len -= min_t(size_t, len, 16U);
 263                 total += out;
 264         }
 265         return total;
 266 }
 267
 268 /* alias for 32-bit indirect read (for SRAM/reg above 4K), with debug wrapper */
 269 static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg);
 270 #define ipw_read_reg32(a, b) _ipw_read_reg32(a, b)
 271
 272 /* alias for 8-bit indirect read (for SRAM/reg above 4K), with debug wrapper */
 273 static u8 _ipw_read_reg8(struct ipw_priv *ipw, u32 reg);
 274 #define ipw_read_reg8(a, b) _ipw_read_reg8(a, b)
 275
 276 /* 8-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
 277 static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value);
 278 static inline void ipw_write_reg8(struct ipw_priv *a, u32 b, u8 c)
 279 {
 280         IPW_DEBUG_IO("%s %d: write_indirect8(0x%08X, 0x%08X)\n", __FILE__,
 281                      __LINE__, (u32) (b), (u32) (c));
 282         _ipw_write_reg8(a, b, c);
 283 }
 284
 285 /* 16-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
 286 static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value);
 287 static inline void ipw_write_reg16(struct ipw_priv *a, u32 b, u16 c)
 288 {
 289         IPW_DEBUG_IO("%s %d: write_indirect16(0x%08X, 0x%08X)\n", __FILE__,
 290                      __LINE__, (u32) (b), (u32) (c));
 291         _ipw_write_reg16(a, b, c);
 292 }
 293
 294 /* 32-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
 295 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value);
 296 static inline void ipw_write_reg32(struct ipw_priv *a, u32 b, u32 c)
 297 {
 298         IPW_DEBUG_IO("%s %d: write_indirect32(0x%08X, 0x%08X)\n", __FILE__,
 299                      __LINE__, (u32) (b), (u32) (c));
 300         _ipw_write_reg32(a, b, c);
 301 }
 302
 303 /* 8-bit direct write (low 4K) */
 304 #define _ipw_write8(ipw, ofs, val) writeb((val), (ipw)->hw_base + (ofs))
 305
 306 /* 8-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 307 #define ipw_write8(ipw, ofs, val) do { \
 308  IPW_DEBUG_IO("%s %d: write_direct8(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
 309  _ipw_write8(ipw, ofs, val); \
 310  } while (0)
 311
 312 /* 16-bit direct write (low 4K) */
 313 #define _ipw_write16(ipw, ofs, val) writew((val), (ipw)->hw_base + (ofs))
 314
 315 /* 16-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 316 #define ipw_write16(ipw, ofs, val) \
 317  IPW_DEBUG_IO("%s %d: write_direct16(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
 318  _ipw_write16(ipw, ofs, val)
 319
 320 /* 32-bit direct write (low 4K) */
 321 #define _ipw_write32(ipw, ofs, val) writel((val), (ipw)->hw_base + (ofs))
 322
 323 /* 32-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 324 #define ipw_write32(ipw, ofs, val) \
 325  IPW_DEBUG_IO("%s %d: write_direct32(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
 326  _ipw_write32(ipw, ofs, val)
 327
 328 /* 8-bit direct read (low 4K) */
 329 #define _ipw_read8(ipw, ofs) readb((ipw)->hw_base + (ofs))
 330
 331 /* 8-bit direct read (low 4K), with debug wrapper */
 332 static inline u8 __ipw_read8(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
 333 {
 334         IPW_DEBUG_IO("%s %d: read_direct8(0x%08X)\n", f, l, (u32) (ofs));
 335         return _ipw_read8(ipw, ofs);
 336 }
 337
 338 /* alias to 8-bit direct read (low 4K of SRAM/regs), with debug wrapper */
 339 #define ipw_read8(ipw, ofs) __ipw_read8(__FILE__, __LINE__, ipw, ofs)
 340
 341 /* 16-bit direct read (low 4K) */
 342 #define _ipw_read16(ipw, ofs) readw((ipw)->hw_base + (ofs))
 343
 344 /* 16-bit direct read (low 4K), with debug wrapper */
 345 static inline u16 __ipw_read16(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
 346 {
 347         IPW_DEBUG_IO("%s %d: read_direct16(0x%08X)\n", f, l, (u32) (ofs));
 348         return _ipw_read16(ipw, ofs);
 349 }
 350
 351 /* alias to 16-bit direct read (low 4K of SRAM/regs), with debug wrapper */
 352 #define ipw_read16(ipw, ofs) __ipw_read16(__FILE__, __LINE__, ipw, ofs)
 353
 354 /* 32-bit direct read (low 4K) */
 355 #define _ipw_read32(ipw, ofs) readl((ipw)->hw_base + (ofs))
 356
 357 /* 32-bit direct read (low 4K), with debug wrapper */
 358 static inline u32 __ipw_read32(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
 359 {
 360         IPW_DEBUG_IO("%s %d: read_direct32(0x%08X)\n", f, l, (u32) (ofs));
 361         return _ipw_read32(ipw, ofs);
 362 }
 363
 364 /* alias to 32-bit direct read (low 4K of SRAM/regs), with debug wrapper */
 365 #define ipw_read32(ipw, ofs) __ipw_read32(__FILE__, __LINE__, ipw, ofs)
 366
 367 /* multi-byte read (above 4K), with debug wrapper */
 368 static void _ipw_read_indirect(struct ipw_priv *, u32, u8 *, int);
 369 static inline void __ipw_read_indirect(const char *f, int l,
 370                                        struct ipw_priv *a, u32 b, u8 * c, int d)
 371 {
 372         IPW_DEBUG_IO("%s %d: read_indirect(0x%08X) %d bytes\n", f, l, (u32) (b),
 373                      d);
 374         _ipw_read_indirect(a, b, c, d);
 375 }
 376
 377 /* alias to multi-byte read (SRAM/regs above 4K), with debug wrapper */
 378 #define ipw_read_indirect(a, b, c, d) __ipw_read_indirect(__FILE__, __LINE__, a, b, c, d)
 379
 380 /* alias to multi-byte read (SRAM/regs above 4K), with debug wrapper */
 381 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * data,
 382                                 int num);
 383 #define ipw_write_indirect(a, b, c, d) \
 384         IPW_DEBUG_IO("%s %d: write_indirect(0x%08X) %d bytes\n", __FILE__, __LINE__, (u32)(b), d); \
 385         _ipw_write_indirect(a, b, c, d)
 386
 387 /* 32-bit indirect write (above 4K) */
 388 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value)
 389 {
 390         IPW_DEBUG_IO(" %p : reg = 0x%8X : value = 0x%8X\n", priv, reg, value);
 391         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
 392         _ipw_write32(priv, IPW_INDIRECT_DATA, value);
 393 }
 394
 395 /* 8-bit indirect write (above 4K) */
 396 static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value)
 397 {
 398         u32 aligned_addr = reg & IPW_INDIRECT_ADDR_MASK;        /* dword align */
 399         u32 dif_len = reg - aligned_addr;
 400
 401         IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
 402         _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 403         _ipw_write8(priv, IPW_INDIRECT_DATA + dif_len, value);
 404 }
 405
 406 /* 16-bit indirect write (above 4K) */
 407 static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value)
 408 {
 409         u32 aligned_addr = reg & IPW_INDIRECT_ADDR_MASK;        /* dword align */
 410         u32 dif_len = (reg - aligned_addr) & (~0x1ul);
 411
 412         IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
 413         _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 414         _ipw_write16(priv, IPW_INDIRECT_DATA + dif_len, value);
 415 }
 416
 417 /* 8-bit indirect read (above 4K) */
 418 static u8 _ipw_read_reg8(struct ipw_priv *priv, u32 reg)
 419 {
 420         u32 word;
 421         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg & IPW_INDIRECT_ADDR_MASK);
 422         IPW_DEBUG_IO(" reg = 0x%8X : \n", reg);
 423         word = _ipw_read32(priv, IPW_INDIRECT_DATA);
 424         return (word >> ((reg & 0x3) * 8)) & 0xff;
 425 }
 426
 427 /* 32-bit indirect read (above 4K) */
 428 static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg)
 429 {
 430         u32 value;
 431
 432         IPW_DEBUG_IO("%p : reg = 0x%08x\n", priv, reg);
 433
 434         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
 435         value = _ipw_read32(priv, IPW_INDIRECT_DATA);
 436         IPW_DEBUG_IO(" reg = 0x%4X : value = 0x%4x \n", reg, value);
 437         return value;
 438 }
 439
 440 /* General purpose, no alignment requirement, iterative (multi-byte) read, */
 441 /*    for area above 1st 4K of SRAM/reg space */
 442 static void _ipw_read_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
 443                                int num)
 444 {
 445         u32 aligned_addr = addr & IPW_INDIRECT_ADDR_MASK;       /* dword align */
 446         u32 dif_len = addr - aligned_addr;
 447         u32 i;
 448
 449         IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
 450
 451         if (num <= 0) {
 452                 return;
 453         }
 454
 455         /* Read the first dword (or portion) byte by byte */
 456         if (unlikely(dif_len)) {
 457                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 458                 /* Start reading at aligned_addr + dif_len */
 459                 for (i = dif_len; ((i < 4) && (num > 0)); i++, num--)
 460                         *buf++ = _ipw_read8(priv, IPW_INDIRECT_DATA + i);
 461                 aligned_addr += 4;
 462         }
 463
 464         /* Read all of the middle dwords as dwords, with auto-increment */
 465         _ipw_write32(priv, IPW_AUTOINC_ADDR, aligned_addr);
 466         for (; num >= 4; buf += 4, aligned_addr += 4, num -= 4)
 467                 *(u32 *) buf = _ipw_read32(priv, IPW_AUTOINC_DATA);
 468
 469         /* Read the last dword (or portion) byte by byte */
 470         if (unlikely(num)) {
 471                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 472                 for (i = 0; num > 0; i++, num--)
 473                         *buf++ = ipw_read8(priv, IPW_INDIRECT_DATA + i);
 474         }
 475 }
 476
 477 /* General purpose, no alignment requirement, iterative (multi-byte) write, */
 478 /*    for area above 1st 4K of SRAM/reg space */
 479 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
 480                                 int num)
 481 {
 482         u32 aligned_addr = addr & IPW_INDIRECT_ADDR_MASK;       /* dword align */
 483         u32 dif_len = addr - aligned_addr;
 484         u32 i;
 485
 486         IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
 487
 488         if (num <= 0) {
 489                 return;
 490         }
 491
 492         /* Write the first dword (or portion) byte by byte */
 493         if (unlikely(dif_len)) {
 494                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 495                 /* Start writing at aligned_addr + dif_len */
 496                 for (i = dif_len; ((i < 4) && (num > 0)); i++, num--, buf++)
 497                         _ipw_write8(priv, IPW_INDIRECT_DATA + i, *buf);
 498                 aligned_addr += 4;
 499         }
 500
 501         /* Write all of the middle dwords as dwords, with auto-increment */
 502         _ipw_write32(priv, IPW_AUTOINC_ADDR, aligned_addr);
 503         for (; num >= 4; buf += 4, aligned_addr += 4, num -= 4)
 504                 _ipw_write32(priv, IPW_AUTOINC_DATA, *(u32 *) buf);
 505
 506         /* Write the last dword (or portion) byte by byte */
 507         if (unlikely(num)) {
 508                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 509                 for (i = 0; num > 0; i++, num--, buf++)
 510                         _ipw_write8(priv, IPW_INDIRECT_DATA + i, *buf);
 511         }
 512 }
 513
 514 /* General purpose, no alignment requirement, iterative (multi-byte) write, */
 515 /*    for 1st 4K of SRAM/regs space */
 516 static void ipw_write_direct(struct ipw_priv *priv, u32 addr, void *buf,
 517                              int num)
 518 {
 519         memcpy_toio((priv->hw_base + addr), buf, num);
 520 }
 521
 522 /* Set bit(s) in low 4K of SRAM/regs */
 523 static inline void ipw_set_bit(struct ipw_priv *priv, u32 reg, u32 mask)
 524 {
 525         ipw_write32(priv, reg, ipw_read32(priv, reg) | mask);
 526 }
 527
 528 /* Clear bit(s) in low 4K of SRAM/regs */
 529 static inline void ipw_clear_bit(struct ipw_priv *priv, u32 reg, u32 mask)
 530 {
 531         ipw_write32(priv, reg, ipw_read32(priv, reg) & ~mask);
 532 }
 533
 534 static inline void __ipw_enable_interrupts(struct ipw_priv *priv)
 535 {
 536         if (priv->status & STATUS_INT_ENABLED)
 537                 return;
 538         priv->status |= STATUS_INT_ENABLED;
 539         ipw_write32(priv, IPW_INTA_MASK_R, IPW_INTA_MASK_ALL);
 540 }
 541
 542 static inline void __ipw_disable_interrupts(struct ipw_priv *priv)
 543 {
 544         if (!(priv->status & STATUS_INT_ENABLED))
 545                 return;
 546         priv->status &= ~STATUS_INT_ENABLED;
 547         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
 548 }
 549
 550 static inline void ipw_enable_interrupts(struct ipw_priv *priv)
 551 {
 552         unsigned long flags;
 553
 554         spin_lock_irqsave(&priv->irq_lock, flags);
 555         __ipw_enable_interrupts(priv);
 556         spin_unlock_irqrestore(&priv->irq_lock, flags);
 557 }
 558
 559 static inline void ipw_disable_interrupts(struct ipw_priv *priv)
 560 {
 561         unsigned long flags;
 562
 563         spin_lock_irqsave(&priv->irq_lock, flags);
 564         __ipw_disable_interrupts(priv);
 565         spin_unlock_irqrestore(&priv->irq_lock, flags);
 566 }
 567
 568 static char *ipw_error_desc(u32 val)
 569 {
 570         switch (val) {
 571         case IPW_FW_ERROR_OK:
 572                 return "ERROR_OK";
 573         case IPW_FW_ERROR_FAIL:
 574                 return "ERROR_FAIL";
 575         case IPW_FW_ERROR_MEMORY_UNDERFLOW:
 576                 return "MEMORY_UNDERFLOW";
 577         case IPW_FW_ERROR_MEMORY_OVERFLOW:
 578                 return "MEMORY_OVERFLOW";
 579         case IPW_FW_ERROR_BAD_PARAM:
 580                 return "BAD_PARAM";
 581         case IPW_FW_ERROR_BAD_CHECKSUM:
 582                 return "BAD_CHECKSUM";
 583         case IPW_FW_ERROR_NMI_INTERRUPT:
 584                 return "NMI_INTERRUPT";
 585         case IPW_FW_ERROR_BAD_DATABASE:
 586                 return "BAD_DATABASE";
 587         case IPW_FW_ERROR_ALLOC_FAIL:
 588                 return "ALLOC_FAIL";
 589         case IPW_FW_ERROR_DMA_UNDERRUN:
 590                 return "DMA_UNDERRUN";
 591         case IPW_FW_ERROR_DMA_STATUS:
 592                 return "DMA_STATUS";
 593         case IPW_FW_ERROR_DINO_ERROR:
 594                 return "DINO_ERROR";
 595         case IPW_FW_ERROR_EEPROM_ERROR:
 596                 return "EEPROM_ERROR";
 597         case IPW_FW_ERROR_SYSASSERT:
 598                 return "SYSASSERT";
 599         case IPW_FW_ERROR_FATAL_ERROR:
 600                 return "FATAL_ERROR";
 601         default:
 602                 return "UNKNOWN_ERROR";
 603         }
 604 }
 605
 606 static void ipw_dump_error_log(struct ipw_priv *priv,
 607                                struct ipw_fw_error *error)
 608 {
 609         u32 i;
 610
 611         if (!error) {
 612                 IPW_ERROR("Error allocating and capturing error log.  "
 613                           "Nothing to dump.\n");
 614                 return;
 615         }
 616
 617         IPW_ERROR("Start IPW Error Log Dump:\n");
 618         IPW_ERROR("Status: 0x%08X, Config: %08X\n",
 619                   error->status, error->config);
 620
 621         for (i = 0; i < error->elem_len; i++)
 622                 IPW_ERROR("%s %i 0x%08x  0x%08x  0x%08x  0x%08x  0x%08x\n",
 623                           ipw_error_desc(error->elem[i].desc),
 624                           error->elem[i].time,
 625                           error->elem[i].blink1,
 626                           error->elem[i].blink2,
 627                           error->elem[i].link1,
 628                           error->elem[i].link2, error->elem[i].data);
 629         for (i = 0; i < error->log_len; i++)
 630                 IPW_ERROR("%i\t0x%08x\t%i\n",
 631                           error->log[i].time,
 632                           error->log[i].data, error->log[i].event);
 633 }
 634
 635 static inline int ipw_is_init(struct ipw_priv *priv)
 636 {
 637         return (priv->status & STATUS_INIT) ? 1 : 0;
 638 }
 639
 640 static int ipw_get_ordinal(struct ipw_priv *priv, u32 ord, void *val, u32 * len)
 641 {
 642         u32 addr, field_info, field_len, field_count, total_len;
 643
 644         IPW_DEBUG_ORD("ordinal = %i\n", ord);
 645
 646         if (!priv || !val || !len) {
 647                 IPW_DEBUG_ORD("Invalid argument\n");
 648                 return -EINVAL;
 649         }
 650
 651         /* verify device ordinal tables have been initialized */
 652         if (!priv->table0_addr || !priv->table1_addr || !priv->table2_addr) {
 653                 IPW_DEBUG_ORD("Access ordinals before initialization\n");
 654                 return -EINVAL;
 655         }
 656
 657         switch (IPW_ORD_TABLE_ID_MASK & ord) {
 658         case IPW_ORD_TABLE_0_MASK:
 659                 /*
 660                  * TABLE 0: Direct access to a table of 32 bit values
 661                  *
 662                  * This is a very simple table with the data directly
 663                  * read from the table
 664                  */
 665
 666                 /* remove the table id from the ordinal */
 667                 ord &= IPW_ORD_TABLE_VALUE_MASK;
 668
 669                 /* boundary check */
 670                 if (ord > priv->table0_len) {
 671                         IPW_DEBUG_ORD("ordinal value (%i) longer then "
 672                                       "max (%i)\n", ord, priv->table0_len);
 673                         return -EINVAL;
 674                 }
 675
 676                 /* verify we have enough room to store the value */
 677                 if (*len < sizeof(u32)) {
 678                         IPW_DEBUG_ORD("ordinal buffer length too small, "
 679                                       "need %zd\n", sizeof(u32));
 680                         return -EINVAL;
 681                 }
 682
 683                 IPW_DEBUG_ORD("Reading TABLE0[%i] from offset 0x%08x\n",
 684                               ord, priv->table0_addr + (ord << 2));
 685
 686                 *len = sizeof(u32);
 687                 ord <<= 2;
 688                 *((u32 *) val) = ipw_read32(priv, priv->table0_addr + ord);
 689                 break;
 690
 691         case IPW_ORD_TABLE_1_MASK:
 692                 /*
 693                  * TABLE 1: Indirect access to a table of 32 bit values
 694                  *
 695                  * This is a fairly large table of u32 values each
 696                  * representing starting addr for the data (which is
 697                  * also a u32)
 698                  */
 699
 700                 /* remove the table id from the ordinal */
 701                 ord &= IPW_ORD_TABLE_VALUE_MASK;
 702
 703                 /* boundary check */
 704                 if (ord > priv->table1_len) {
 705                         IPW_DEBUG_ORD("ordinal value too long\n");
 706                         return -EINVAL;
 707                 }
 708
 709                 /* verify we have enough room to store the value */
 710                 if (*len < sizeof(u32)) {
 711                         IPW_DEBUG_ORD("ordinal buffer length too small, "
 712                                       "need %zd\n", sizeof(u32));
 713                         return -EINVAL;
 714                 }
 715
 716                 *((u32 *) val) =
 717                     ipw_read_reg32(priv, (priv->table1_addr + (ord << 2)));
 718                 *len = sizeof(u32);
 719                 break;
 720
 721         case IPW_ORD_TABLE_2_MASK:
 722                 /*
 723                  * TABLE 2: Indirect access to a table of variable sized values
 724                  *
 725                  * This table consist of six values, each containing
 726                  *     - dword containing the starting offset of the data
 727                  *     - dword containing the lengh in the first 16bits
 728                  *       and the count in the second 16bits
 729                  */
 730
 731                 /* remove the table id from the ordinal */
 732                 ord &= IPW_ORD_TABLE_VALUE_MASK;
 733
 734                 /* boundary check */
 735                 if (ord > priv->table2_len) {
 736                         IPW_DEBUG_ORD("ordinal value too long\n");
 737                         return -EINVAL;
 738                 }
 739
 740                 /* get the address of statistic */
 741                 addr = ipw_read_reg32(priv, priv->table2_addr + (ord << 3));
 742
 743                 /* get the second DW of statistics ;
 744                  * two 16-bit words - first is length, second is count */
 745                 field_info =
 746                     ipw_read_reg32(priv,
 747                                    priv->table2_addr + (ord << 3) +
 748                                    sizeof(u32));
 749
 750                 /* get each entry length */
 751                 field_len = *((u16 *) & field_info);
 752
 753                 /* get number of entries */
 754                 field_count = *(((u16 *) & field_info) + 1);
 755
 756                 /* abort if not enought memory */
 757                 total_len = field_len * field_count;
 758                 if (total_len > *len) {
 759                         *len = total_len;
 760                         return -EINVAL;
 761                 }
 762
 763                 *len = total_len;
 764                 if (!total_len)
 765                         return 0;
 766
 767                 IPW_DEBUG_ORD("addr = 0x%08x, total_len = %i, "
 768                               "field_info = 0x%08x\n",
 769                               addr, total_len, field_info);
 770                 ipw_read_indirect(priv, addr, val, total_len);
 771                 break;
 772
 773         default:
 774                 IPW_DEBUG_ORD("Invalid ordinal!\n");
 775                 return -EINVAL;
 776
 777         }
 778
 779         return 0;
 780 }
 781
 782 static void ipw_init_ordinals(struct ipw_priv *priv)
 783 {
 784         priv->table0_addr = IPW_ORDINALS_TABLE_LOWER;
 785         priv->table0_len = ipw_read32(priv, priv->table0_addr);
 786
 787         IPW_DEBUG_ORD("table 0 offset at 0x%08x, len = %i\n",
 788                       priv->table0_addr, priv->table0_len);
 789
 790         priv->table1_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_1);
 791         priv->table1_len = ipw_read_reg32(priv, priv->table1_addr);
 792
 793         IPW_DEBUG_ORD("table 1 offset at 0x%08x, len = %i\n",
 794                       priv->table1_addr, priv->table1_len);
 795
 796         priv->table2_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_2);
 797         priv->table2_len = ipw_read_reg32(priv, priv->table2_addr);
 798         priv->table2_len &= 0x0000ffff; /* use first two bytes */
 799
 800         IPW_DEBUG_ORD("table 2 offset at 0x%08x, len = %i\n",
 801                       priv->table2_addr, priv->table2_len);
 802
 803 }
 804
 805 static u32 ipw_register_toggle(u32 reg)
 806 {
 807         reg &= ~IPW_START_STANDBY;
 808         if (reg & IPW_GATE_ODMA)
 809                 reg &= ~IPW_GATE_ODMA;
 810         if (reg & IPW_GATE_IDMA)
 811                 reg &= ~IPW_GATE_IDMA;
 812         if (reg & IPW_GATE_ADMA)
 813                 reg &= ~IPW_GATE_ADMA;
 814         return reg;
 815 }
 816
 817 /*
 818  * LED behavior:
 819  * - On radio ON, turn on any LEDs that require to be on during start
 820  * - On initialization, start unassociated blink
 821  * - On association, disable unassociated blink
 822  * - On disassociation, start unassociated blink
 823  * - On radio OFF, turn off any LEDs started during radio on
 824  *
 825  */
 826 #define LD_TIME_LINK_ON msecs_to_jiffies(300)
 827 #define LD_TIME_LINK_OFF msecs_to_jiffies(2700)
 828 #define LD_TIME_ACT_ON msecs_to_jiffies(250)
 829
 830 static void ipw_led_link_on(struct ipw_priv *priv)
 831 {
 832         unsigned long flags;
 833         u32 led;
 834
 835         /* If configured to not use LEDs, or nic_type is 1,
 836          * then we don't toggle a LINK led */
 837         if (priv->config & CFG_NO_LED || priv->nic_type == EEPROM_NIC_TYPE_1)
 838                 return;
 839
 840         spin_lock_irqsave(&priv->lock, flags);
 841
 842         if (!(priv->status & STATUS_RF_KILL_MASK) &&
 843             !(priv->status & STATUS_LED_LINK_ON)) {
 844                 IPW_DEBUG_LED("Link LED On\n");
 845                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 846                 led |= priv->led_association_on;
 847
 848                 led = ipw_register_toggle(led);
 849
 850                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 851                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 852
 853                 priv->status |= STATUS_LED_LINK_ON;
 854
 855                 /* If we aren't associated, schedule turning the LED off */
 856                 if (!(priv->status & STATUS_ASSOCIATED))
 857                         queue_delayed_work(priv->workqueue,
 858                                            &priv->led_link_off,
 859                                            LD_TIME_LINK_ON);
 860         }
 861
 862         spin_unlock_irqrestore(&priv->lock, flags);
 863 }
 864
 865 static void ipw_bg_led_link_on(struct work_struct *work)
 866 {
 867         struct ipw_priv *priv =
 868                 container_of(work, struct ipw_priv, led_link_on.work);
 869         mutex_lock(&priv->mutex);
 870         ipw_led_link_on(priv);
 871         mutex_unlock(&priv->mutex);
 872 }
 873
 874 static void ipw_led_link_off(struct ipw_priv *priv)
 875 {
 876         unsigned long flags;
 877         u32 led;
 878
 879         /* If configured not to use LEDs, or nic type is 1,
 880          * then we don't goggle the LINK led. */
 881         if (priv->config & CFG_NO_LED || priv->nic_type == EEPROM_NIC_TYPE_1)
 882                 return;
 883
 884         spin_lock_irqsave(&priv->lock, flags);
 885
 886         if (priv->status & STATUS_LED_LINK_ON) {
 887                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 888                 led &= priv->led_association_off;
 889                 led = ipw_register_toggle(led);
 890
 891                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 892                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 893
 894                 IPW_DEBUG_LED("Link LED Off\n");
 895
 896                 priv->status &= ~STATUS_LED_LINK_ON;
 897
 898                 /* If we aren't associated and the radio is on, schedule
 899                  * turning the LED on (blink while unassociated) */
 900                 if (!(priv->status & STATUS_RF_KILL_MASK) &&
 901                     !(priv->status & STATUS_ASSOCIATED))
 902                         queue_delayed_work(priv->workqueue, &priv->led_link_on,
 903                                            LD_TIME_LINK_OFF);
 904
 905         }
 906
 907         spin_unlock_irqrestore(&priv->lock, flags);
 908 }
 909
 910 static void ipw_bg_led_link_off(struct work_struct *work)
 911 {
 912         struct ipw_priv *priv =
 913                 container_of(work, struct ipw_priv, led_link_off.work);
 914         mutex_lock(&priv->mutex);
 915         ipw_led_link_off(priv);
 916         mutex_unlock(&priv->mutex);
 917 }
 918
 919 static void __ipw_led_activity_on(struct ipw_priv *priv)
 920 {
 921         u32 led;
 922
 923         if (priv->config & CFG_NO_LED)
 924                 return;
 925
 926         if (priv->status & STATUS_RF_KILL_MASK)
 927                 return;
 928
 929         if (!(priv->status & STATUS_LED_ACT_ON)) {
 930                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 931                 led |= priv->led_activity_on;
 932
 933                 led = ipw_register_toggle(led);
 934
 935                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 936                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 937
 938                 IPW_DEBUG_LED("Activity LED On\n");
 939
 940                 priv->status |= STATUS_LED_ACT_ON;
 941
 942                 cancel_delayed_work(&priv->led_act_off);
 943                 queue_delayed_work(priv->workqueue, &priv->led_act_off,
 944                                    LD_TIME_ACT_ON);
 945         } else {
 946                 /* Reschedule LED off for full time period */
 947                 cancel_delayed_work(&priv->led_act_off);
 948                 queue_delayed_work(priv->workqueue, &priv->led_act_off,
 949                                    LD_TIME_ACT_ON);
 950         }
 951 }
 952
 953 #if 0
 954 void ipw_led_activity_on(struct ipw_priv *priv)
 955 {
 956         unsigned long flags;
 957         spin_lock_irqsave(&priv->lock, flags);
 958         __ipw_led_activity_on(priv);
 959         spin_unlock_irqrestore(&priv->lock, flags);
 960 }
 961 #endif  /*  0  */
 962
 963 static void ipw_led_activity_off(struct ipw_priv *priv)
 964 {
 965         unsigned long flags;
 966         u32 led;
 967
 968         if (priv->config & CFG_NO_LED)
 969                 return;
 970
 971         spin_lock_irqsave(&priv->lock, flags);
 972
 973         if (priv->status & STATUS_LED_ACT_ON) {
 974                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 975                 led &= priv->led_activity_off;
 976
 977                 led = ipw_register_toggle(led);
 978
 979                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 980                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 981
 982                 IPW_DEBUG_LED("Activity LED Off\n");
 983
 984                 priv->status &= ~STATUS_LED_ACT_ON;
 985         }
 986
 987         spin_unlock_irqrestore(&priv->lock, flags);
 988 }
 989
 990 static void ipw_bg_led_activity_off(struct work_struct *work)
 991 {
 992         struct ipw_priv *priv =
 993                 container_of(work, struct ipw_priv, led_act_off.work);
 994         mutex_lock(&priv->mutex);
 995         ipw_led_activity_off(priv);
 996         mutex_unlock(&priv->mutex);
 997 }
 998
 999 static void ipw_led_band_on(struct ipw_priv *priv)
1000 {
1001         unsigned long flags;
1002         u32 led;
1003
1004         /* Only nic type 1 supports mode LEDs */
1005         if (priv->config & CFG_NO_LED ||
1006             priv->nic_type != EEPROM_NIC_TYPE_1 || !priv->assoc_network)
1007                 return;
1008
1009         spin_lock_irqsave(&priv->lock, flags);
1010
1011         led = ipw_read_reg32(priv, IPW_EVENT_REG);
1012         if (priv->assoc_network->mode == IEEE_A) {
1013                 led |= priv->led_ofdm_on;
1014                 led &= priv->led_association_off;
1015                 IPW_DEBUG_LED("Mode LED On: 802.11a\n");
1016         } else if (priv->assoc_network->mode == IEEE_G) {
1017                 led |= priv->led_ofdm_on;
1018                 led |= priv->led_association_on;
1019                 IPW_DEBUG_LED("Mode LED On: 802.11g\n");
1020         } else {
1021                 led &= priv->led_ofdm_off;
1022                 led |= priv->led_association_on;
1023                 IPW_DEBUG_LED("Mode LED On: 802.11b\n");
1024         }
1025
1026         led = ipw_register_toggle(led);
1027
1028         IPW_DEBUG_LED("Reg: 0x%08X\n", led);
1029         ipw_write_reg32(priv, IPW_EVENT_REG, led);
1030
1031         spin_unlock_irqrestore(&priv->lock, flags);
1032 }
1033
1034 static void ipw_led_band_off(struct ipw_priv *priv)
1035 {
1036         unsigned long flags;
1037         u32 led;
1038
1039         /* Only nic type 1 supports mode LEDs */
1040         if (priv->config & CFG_NO_LED || priv->nic_type != EEPROM_NIC_TYPE_1)
1041                 return;
1042
1043         spin_lock_irqsave(&priv->lock, flags);
1044
1045         led = ipw_read_reg32(priv, IPW_EVENT_REG);
1046         led &= priv->led_ofdm_off;
1047         led &= priv->led_association_off;
1048
1049         led = ipw_register_toggle(led);
1050
1051         IPW_DEBUG_LED("Reg: 0x%08X\n", led);
1052         ipw_write_reg32(priv, IPW_EVENT_REG, led);
1053
1054         spin_unlock_irqrestore(&priv->lock, flags);
1055 }
1056
1057 static void ipw_led_radio_on(struct ipw_priv *priv)
1058 {
1059         ipw_led_link_on(priv);
1060 }
1061
1062 static void ipw_led_radio_off(struct ipw_priv *priv)
1063 {
1064         ipw_led_activity_off(priv);
1065         ipw_led_link_off(priv);
1066 }
1067
1068 static void ipw_led_link_up(struct ipw_priv *priv)
1069 {
1070         /* Set the Link Led on for all nic types */
1071         ipw_led_link_on(priv);
1072 }
1073
1074 static void ipw_led_link_down(struct ipw_priv *priv)
1075 {
1076         ipw_led_activity_off(priv);
1077         ipw_led_link_off(priv);
1078
1079         if (priv->status & STATUS_RF_KILL_MASK)
1080                 ipw_led_radio_off(priv);
1081 }
1082
1083 static void ipw_led_init(struct ipw_priv *priv)
1084 {
1085         priv->nic_type = priv->eeprom[EEPROM_NIC_TYPE];
1086
1087         /* Set the default PINs for the link and activity leds */
1088         priv->led_activity_on = IPW_ACTIVITY_LED;
1089         priv->led_activity_off = ~(IPW_ACTIVITY_LED);
1090
1091         priv->led_association_on = IPW_ASSOCIATED_LED;
1092         priv->led_association_off = ~(IPW_ASSOCIATED_LED);
1093
1094         /* Set the default PINs for the OFDM leds */
1095         priv->led_ofdm_on = IPW_OFDM_LED;
1096         priv->led_ofdm_off = ~(IPW_OFDM_LED);
1097
1098         switch (priv->nic_type) {
1099         case EEPROM_NIC_TYPE_1:
1100                 /* In this NIC type, the LEDs are reversed.... */
1101                 priv->led_activity_on = IPW_ASSOCIATED_LED;
1102                 priv->led_activity_off = ~(IPW_ASSOCIATED_LED);
1103                 priv->led_association_on = IPW_ACTIVITY_LED;
1104                 priv->led_association_off = ~(IPW_ACTIVITY_LED);
1105
1106                 if (!(priv->config & CFG_NO_LED))
1107                         ipw_led_band_on(priv);
1108
1109                 /* And we don't blink link LEDs for this nic, so
1110                  * just return here */
1111                 return;
1112
1113         case EEPROM_NIC_TYPE_3:
1114         case EEPROM_NIC_TYPE_2:
1115         case EEPROM_NIC_TYPE_4:
1116         case EEPROM_NIC_TYPE_0:
1117                 break;
1118
1119         default:
1120                 IPW_DEBUG_INFO("Unknown NIC type from EEPROM: %d\n",
1121                                priv->nic_type);
1122                 priv->nic_type = EEPROM_NIC_TYPE_0;
1123                 break;
1124         }
1125
1126         if (!(priv->config & CFG_NO_LED)) {
1127                 if (priv->status & STATUS_ASSOCIATED)
1128                         ipw_led_link_on(priv);
1129                 else
1130                         ipw_led_link_off(priv);
1131         }
1132 }
1133
1134 static void ipw_led_shutdown(struct ipw_priv *priv)
1135 {
1136         ipw_led_activity_off(priv);
1137         ipw_led_link_off(priv);
1138         ipw_led_band_off(priv);
1139         cancel_delayed_work(&priv->led_link_on);
1140         cancel_delayed_work(&priv->led_link_off);
1141         cancel_delayed_work(&priv->led_act_off);
1142 }
1143
1144 /*
1145  * The following adds a new attribute to the sysfs representation
1146  * of this device driver (i.e. a new file in /sys/bus/pci/drivers/ipw/)
1147  * used for controling the debug level.
1148  *
1149  * See the level definitions in ipw for details.
1150  */
1151 static ssize_t show_debug_level(struct device_driver *d, char *buf)
1152 {
1153         return sprintf(buf, "0x%08X\n", ipw_debug_level);
1154 }
1155
1156 static ssize_t store_debug_level(struct device_driver *d, const char *buf,
1157                                  size_t count)
1158 {
1159         char *p = (char *)buf;
1160         u32 val;
1161
1162         if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
1163                 p++;
1164                 if (p[0] == 'x' || p[0] == 'X')
1165                         p++;
1166                 val = simple_strtoul(p, &p, 16);
1167         } else
1168                 val = simple_strtoul(p, &p, 10);
1169         if (p == buf)
1170                 printk(KERN_INFO DRV_NAME
1171                        ": %s is not in hex or decimal form.\n", buf);
1172         else
1173                 ipw_debug_level = val;
1174
1175         return strnlen(buf, count);
1176 }
1177
1178 static DRIVER_ATTR(debug_level, S_IWUSR | S_IRUGO,
1179                    show_debug_level, store_debug_level);
1180
1181 static inline u32 ipw_get_event_log_len(struct ipw_priv *priv)
1182 {
1183         /* length = 1st dword in log */
1184         return ipw_read_reg32(priv, ipw_read32(priv, IPW_EVENT_LOG));
1185 }
1186
1187 static void ipw_capture_event_log(struct ipw_priv *priv,
1188                                   u32 log_len, struct ipw_event *log)
1189 {
1190         u32 base;
1191
1192         if (log_len) {
1193                 base = ipw_read32(priv, IPW_EVENT_LOG);
1194                 ipw_read_indirect(priv, base + sizeof(base) + sizeof(u32),
1195                                   (u8 *) log, sizeof(*log) * log_len);
1196         }
1197 }
1198
1199 static struct ipw_fw_error *ipw_alloc_error_log(struct ipw_priv *priv)
1200 {
1201         struct ipw_fw_error *error;
1202         u32 log_len = ipw_get_event_log_len(priv);
1203         u32 base = ipw_read32(priv, IPW_ERROR_LOG);
1204         u32 elem_len = ipw_read_reg32(priv, base);
1205
1206         error = kmalloc(sizeof(*error) +
1207                         sizeof(*error->elem) * elem_len +
1208                         sizeof(*error->log) * log_len, GFP_ATOMIC);
1209         if (!error) {
1210                 IPW_ERROR("Memory allocation for firmware error log "
1211                           "failed.\n");
1212                 return NULL;
1213         }
1214         error->jiffies = jiffies;
1215         error->status = priv->status;
1216         error->config = priv->config;
1217         error->elem_len = elem_len;
1218         error->log_len = log_len;
1219         error->elem = (struct ipw_error_elem *)error->payload;
1220         error->log = (struct ipw_event *)(error->elem + elem_len);
1221
1222         ipw_capture_event_log(priv, log_len, error->log);
1223
1224         if (elem_len)
1225                 ipw_read_indirect(priv, base + sizeof(base), (u8 *) error->elem,
1226                                   sizeof(*error->elem) * elem_len);
1227
1228         return error;
1229 }
1230
1231 static ssize_t show_event_log(struct device *d,
1232                               struct device_attribute *attr, char *buf)
1233 {
1234         struct ipw_priv *priv = dev_get_drvdata(d);
1235         u32 log_len = ipw_get_event_log_len(priv);
1236         u32 log_size;
1237         struct ipw_event *log;
1238         u32 len = 0, i;
1239
1240         /* not using min() because of its strict type checking */
1241         log_size = PAGE_SIZE / sizeof(*log) > log_len ?
1242                         sizeof(*log) * log_len : PAGE_SIZE;
1243         log = kzalloc(log_size, GFP_KERNEL);
1244         if (!log) {
1245                 IPW_ERROR("Unable to allocate memory for log\n");
1246                 return 0;
1247         }
1248         log_len = log_size / sizeof(*log);
1249         ipw_capture_event_log(priv, log_len, log);
1250
1251         len += snprintf(buf + len, PAGE_SIZE - len, "%08X", log_len);
1252         for (i = 0; i < log_len; i++)
1253                 len += snprintf(buf + len, PAGE_SIZE - len,
1254                                 "\n%08X%08X%08X",
1255                                 log[i].time, log[i].event, log[i].data);
1256         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1257         kfree(log);
1258         return len;
1259 }
1260
1261 static DEVICE_ATTR(event_log, S_IRUGO, show_event_log, NULL);
1262
1263 static ssize_t show_error(struct device *d,
1264                           struct device_attribute *attr, char *buf)
1265 {
1266         struct ipw_priv *priv = dev_get_drvdata(d);
1267         u32 len = 0, i;
1268         if (!priv->error)
1269                 return 0;
1270         len += snprintf(buf + len, PAGE_SIZE - len,
1271                         "%08lX%08X%08X%08X",
1272                         priv->error->jiffies,
1273                         priv->error->status,
1274                         priv->error->config, priv->error->elem_len);
1275         for (i = 0; i < priv->error->elem_len; i++)
1276                 len += snprintf(buf + len, PAGE_SIZE - len,
1277                                 "\n%08X%08X%08X%08X%08X%08X%08X",
1278                                 priv->error->elem[i].time,
1279                                 priv->error->elem[i].desc,
1280                                 priv->error->elem[i].blink1,
1281                                 priv->error->elem[i].blink2,
1282                                 priv->error->elem[i].link1,
1283                                 priv->error->elem[i].link2,
1284                                 priv->error->elem[i].data);
1285
1286         len += snprintf(buf + len, PAGE_SIZE - len,
1287                         "\n%08X", priv->error->log_len);
1288         for (i = 0; i < priv->error->log_len; i++)
1289                 len += snprintf(buf + len, PAGE_SIZE - len,
1290                                 "\n%08X%08X%08X",
1291                                 priv->error->log[i].time,
1292                                 priv->error->log[i].event,
1293                                 priv->error->log[i].data);
1294         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1295         return len;
1296 }
1297
1298 static ssize_t clear_error(struct device *d,
1299                            struct device_attribute *attr,
1300                            const char *buf, size_t count)
1301 {
1302         struct ipw_priv *priv = dev_get_drvdata(d);
1303
1304         kfree(priv->error);
1305         priv->error = NULL;
1306         return count;
1307 }
1308
1309 static DEVICE_ATTR(error, S_IRUGO | S_IWUSR, show_error, clear_error);
1310
1311 static ssize_t show_cmd_log(struct device *d,
1312                             struct device_attribute *attr, char *buf)
1313 {
1314         struct ipw_priv *priv = dev_get_drvdata(d);
1315         u32 len = 0, i;
1316         if (!priv->cmdlog)
1317                 return 0;
1318         for (i = (priv->cmdlog_pos + 1) % priv->cmdlog_len;
1319              (i != priv->cmdlog_pos) && (PAGE_SIZE - len);
1320              i = (i + 1) % priv->cmdlog_len) {
1321                 len +=
1322                     snprintf(buf + len, PAGE_SIZE - len,
1323                              "\n%08lX%08X%08X%08X\n", priv->cmdlog[i].jiffies,
1324                              priv->cmdlog[i].retcode, priv->cmdlog[i].cmd.cmd,
1325                              priv->cmdlog[i].cmd.len);
1326                 len +=
1327                     snprintk_buf(buf + len, PAGE_SIZE - len,
1328                                  (u8 *) priv->cmdlog[i].cmd.param,
1329                                  priv->cmdlog[i].cmd.len);
1330                 len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1331         }
1332         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1333         return len;
1334 }
1335
1336 static DEVICE_ATTR(cmd_log, S_IRUGO, show_cmd_log, NULL);
1337
1338 #ifdef CONFIG_IPW2200_PROMISCUOUS
1339 static void ipw_prom_free(struct ipw_priv *priv);
1340 static int ipw_prom_alloc(struct ipw_priv *priv);
1341 static ssize_t store_rtap_iface(struct device *d,
1342                          struct device_attribute *attr,
1343                          const char *buf, size_t count)
1344 {
1345         struct ipw_priv *priv = dev_get_drvdata(d);
1346         int rc = 0;
1347
1348         if (count < 1)
1349                 return -EINVAL;
1350
1351         switch (buf[0]) {
1352         case '0':
1353                 if (!rtap_iface)
1354                         return count;
1355
1356                 if (netif_running(priv->prom_net_dev)) {
1357                         IPW_WARNING("Interface is up.  Cannot unregister.\n");
1358                         return count;
1359                 }
1360
1361                 ipw_prom_free(priv);
1362                 rtap_iface = 0;
1363                 break;
1364
1365         case '1':
1366                 if (rtap_iface)
1367                         return count;
1368
1369                 rc = ipw_prom_alloc(priv);
1370                 if (!rc)
1371                         rtap_iface = 1;
1372                 break;
1373
1374         default:
1375                 return -EINVAL;
1376         }
1377
1378         if (rc) {
1379                 IPW_ERROR("Failed to register promiscuous network "
1380                           "device (error %d).\n", rc);
1381         }
1382
1383         return count;
1384 }
1385
1386 static ssize_t show_rtap_iface(struct device *d,
1387                         struct device_attribute *attr,
1388                         char *buf)
1389 {
1390         struct ipw_priv *priv = dev_get_drvdata(d);
1391         if (rtap_iface)
1392                 return sprintf(buf, "%s", priv->prom_net_dev->name);
1393         else {
1394                 buf[0] = '-';
1395                 buf[1] = '1';
1396                 buf[2] = '\0';
1397                 return 3;
1398         }
1399 }
1400
1401 static DEVICE_ATTR(rtap_iface, S_IWUSR | S_IRUSR, show_rtap_iface,
1402                    store_rtap_iface);
1403
1404 static ssize_t store_rtap_filter(struct device *d,
1405                          struct device_attribute *attr,
1406                          const char *buf, size_t count)
1407 {
1408         struct ipw_priv *priv = dev_get_drvdata(d);
1409
1410         if (!priv->prom_priv) {
1411                 IPW_ERROR("Attempting to set filter without "
1412                           "rtap_iface enabled.\n");
1413                 return -EPERM;
1414         }
1415
1416         priv->prom_priv->filter = simple_strtol(buf, NULL, 0);
1417
1418         IPW_DEBUG_INFO("Setting rtap filter to " BIT_FMT16 "\n",
1419                        BIT_ARG16(priv->prom_priv->filter));
1420
1421         return count;
1422 }
1423
1424 static ssize_t show_rtap_filter(struct device *d,
1425                         struct device_attribute *attr,
1426                         char *buf)
1427 {
1428         struct ipw_priv *priv = dev_get_drvdata(d);
1429         return sprintf(buf, "0x%04X",
1430                        priv->prom_priv ? priv->prom_priv->filter : 0);
1431 }
1432
1433 static DEVICE_ATTR(rtap_filter, S_IWUSR | S_IRUSR, show_rtap_filter,
1434                    store_rtap_filter);
1435 #endif
1436
1437 static ssize_t show_scan_age(struct device *d, struct device_attribute *attr,
1438                              char *buf)
1439 {
1440         struct ipw_priv *priv = dev_get_drvdata(d);
1441         return sprintf(buf, "%d\n", priv->ieee->scan_age);
1442 }
1443
1444 static ssize_t store_scan_age(struct device *d, struct device_attribute *attr,
1445                               const char *buf, size_t count)
1446 {
1447         struct ipw_priv *priv = dev_get_drvdata(d);
1448         struct net_device *dev = priv->net_dev;
1449         char buffer[] = "00000000";
1450         unsigned long len =
1451             (sizeof(buffer) - 1) > count ? count : sizeof(buffer) - 1;
1452         unsigned long val;
1453         char *p = buffer;
1454
1455         IPW_DEBUG_INFO("enter\n");
1456
1457         strncpy(buffer, buf, len);
1458         buffer[len] = 0;
1459
1460         if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
1461                 p++;
1462                 if (p[0] == 'x' || p[0] == 'X')
1463                         p++;
1464                 val = simple_strtoul(p, &p, 16);
1465         } else
1466                 val = simple_strtoul(p, &p, 10);
1467         if (p == buffer) {
1468                 IPW_DEBUG_INFO("%s: user supplied invalid value.\n", dev->name);
1469         } else {
1470                 priv->ieee->scan_age = val;
1471                 IPW_DEBUG_INFO("set scan_age = %u\n", priv->ieee->scan_age);
1472         }
1473
1474         IPW_DEBUG_INFO("exit\n");
1475         return len;
1476 }
1477
1478 static DEVICE_ATTR(scan_age, S_IWUSR | S_IRUGO, show_scan_age, store_scan_age);
1479
1480 static ssize_t show_led(struct device *d, struct device_attribute *attr,
1481                         char *buf)
1482 {
1483         struct ipw_priv *priv = dev_get_drvdata(d);
1484         return sprintf(buf, "%d\n", (priv->config & CFG_NO_LED) ? 0 : 1);
1485 }
1486
1487 static ssize_t store_led(struct device *d, struct device_attribute *attr,
1488                          const char *buf, size_t count)
1489 {
1490         struct ipw_priv *priv = dev_get_drvdata(d);
1491
1492         IPW_DEBUG_INFO("enter\n");
1493
1494         if (count == 0)
1495                 return 0;
1496
1497         if (*buf == 0) {
1498                 IPW_DEBUG_LED("Disabling LED control.\n");
1499                 priv->config |= CFG_NO_LED;
1500                 ipw_led_shutdown(priv);
1501         } else {
1502                 IPW_DEBUG_LED("Enabling LED control.\n");
1503                 priv->config &= ~CFG_NO_LED;
1504                 ipw_led_init(priv);
1505         }
1506
1507         IPW_DEBUG_INFO("exit\n");
1508         return count;
1509 }
1510
1511 static DEVICE_ATTR(led, S_IWUSR | S_IRUGO, show_led, store_led);
1512
1513 static ssize_t show_status(struct device *d,
1514                            struct device_attribute *attr, char *buf)
1515 {
1516         struct ipw_priv *p = d->driver_data;
1517         return sprintf(buf, "0x%08x\n", (int)p->status);
1518 }
1519
1520 static DEVICE_ATTR(status, S_IRUGO, show_status, NULL);
1521
1522 static ssize_t show_cfg(struct device *d, struct device_attribute *attr,
1523                         char *buf)
1524 {
1525         struct ipw_priv *p = d->driver_data;
1526         return sprintf(buf, "0x%08x\n", (int)p->config);
1527 }
1528
1529 static DEVICE_ATTR(cfg, S_IRUGO, show_cfg, NULL);
1530
1531 static ssize_t show_nic_type(struct device *d,
1532                              struct device_attribute *attr, char *buf)
1533 {
1534         struct ipw_priv *priv = d->driver_data;
1535         return sprintf(buf, "TYPE: %d\n", priv->nic_type);
1536 }
1537
1538 static DEVICE_ATTR(nic_type, S_IRUGO, show_nic_type, NULL);
1539
1540 static ssize_t show_ucode_version(struct device *d,
1541                                   struct device_attribute *attr, char *buf)
1542 {
1543         u32 len = sizeof(u32), tmp = 0;
1544         struct ipw_priv *p = d->driver_data;
1545
1546         if (ipw_get_ordinal(p, IPW_ORD_STAT_UCODE_VERSION, &tmp, &len))
1547                 return 0;
1548
1549         return sprintf(buf, "0x%08x\n", tmp);
1550 }
1551
1552 static DEVICE_ATTR(ucode_version, S_IWUSR | S_IRUGO, show_ucode_version, NULL);
1553
1554 static ssize_t show_rtc(struct device *d, struct device_attribute *attr,
1555                         char *buf)
1556 {
1557         u32 len = sizeof(u32), tmp = 0;
1558         struct ipw_priv *p = d->driver_data;
1559
1560         if (ipw_get_ordinal(p, IPW_ORD_STAT_RTC, &tmp, &len))
1561                 return 0;
1562
1563         return sprintf(buf, "0x%08x\n", tmp);
1564 }
1565
1566 static DEVICE_ATTR(rtc, S_IWUSR | S_IRUGO, show_rtc, NULL);
1567
1568 /*
1569  * Add a device attribute to view/control the delay between eeprom
1570  * operations.
1571  */
1572 static ssize_t show_eeprom_delay(struct device *d,
1573                                  struct device_attribute *attr, char *buf)
1574 {
1575         int n = ((struct ipw_priv *)d->driver_data)->eeprom_delay;
1576         return sprintf(buf, "%i\n", n);
1577 }
1578 static ssize_t store_eeprom_delay(struct device *d,
1579                                   struct device_attribute *attr,
1580                                   const char *buf, size_t count)
1581 {
1582         struct ipw_priv *p = d->driver_data;
1583         sscanf(buf, "%i", &p->eeprom_delay);
1584         return strnlen(buf, count);
1585 }
1586
1587 static DEVICE_ATTR(eeprom_delay, S_IWUSR | S_IRUGO,
1588                    show_eeprom_delay, store_eeprom_delay);
1589
1590 static ssize_t show_command_event_reg(struct device *d,
1591                                       struct device_attribute *attr, char *buf)
1592 {
1593         u32 reg = 0;
1594         struct ipw_priv *p = d->driver_data;
1595
1596         reg = ipw_read_reg32(p, IPW_INTERNAL_CMD_EVENT);
1597         return sprintf(buf, "0x%08x\n", reg);
1598 }
1599 static ssize_t store_command_event_reg(struct device *d,
1600                                        struct device_attribute *attr,
1601                                        const char *buf, size_t count)
1602 {
1603         u32 reg;
1604         struct ipw_priv *p = d->driver_data;
1605
1606         sscanf(buf, "%x", &reg);
1607         ipw_write_reg32(p, IPW_INTERNAL_CMD_EVENT, reg);
1608         return strnlen(buf, count);
1609 }
1610
1611 static DEVICE_ATTR(command_event_reg, S_IWUSR | S_IRUGO,
1612                    show_command_event_reg, store_command_event_reg);
1613
1614 static ssize_t show_mem_gpio_reg(struct device *d,
1615                                  struct device_attribute *attr, char *buf)
1616 {
1617         u32 reg = 0;
1618         struct ipw_priv *p = d->driver_data;
1619
1620         reg = ipw_read_reg32(p, 0x301100);
1621         return sprintf(buf, "0x%08x\n", reg);
1622 }
1623 static ssize_t store_mem_gpio_reg(struct device *d,
1624                                   struct device_attribute *attr,
1625                                   const char *buf, size_t count)
1626 {
1627         u32 reg;
1628         struct ipw_priv *p = d->driver_data;
1629
1630         sscanf(buf, "%x", &reg);
1631         ipw_write_reg32(p, 0x301100, reg);
1632         return strnlen(buf, count);
1633 }
1634
1635 static DEVICE_ATTR(mem_gpio_reg, S_IWUSR | S_IRUGO,
1636                    show_mem_gpio_reg, store_mem_gpio_reg);
1637
1638 static ssize_t show_indirect_dword(struct device *d,
1639                                    struct device_attribute *attr, char *buf)
1640 {
1641         u32 reg = 0;
1642         struct ipw_priv *priv = d->driver_data;
1643
1644         if (priv->status & STATUS_INDIRECT_DWORD)
1645                 reg = ipw_read_reg32(priv, priv->indirect_dword);
1646         else
1647                 reg = 0;
1648
1649         return sprintf(buf, "0x%08x\n", reg);
1650 }
1651 static ssize_t store_indirect_dword(struct device *d,
1652                                     struct device_attribute *attr,
1653                                     const char *buf, size_t count)
1654 {
1655         struct ipw_priv *priv = d->driver_data;
1656
1657         sscanf(buf, "%x", &priv->indirect_dword);
1658         priv->status |= STATUS_INDIRECT_DWORD;
1659         return strnlen(buf, count);
1660 }
1661
1662 static DEVICE_ATTR(indirect_dword, S_IWUSR | S_IRUGO,
1663                    show_indirect_dword, store_indirect_dword);
1664
1665 static ssize_t show_indirect_byte(struct device *d,
1666                                   struct device_attribute *attr, char *buf)
1667 {
1668         u8 reg = 0;
1669         struct ipw_priv *priv = d->driver_data;
1670
1671         if (priv->status & STATUS_INDIRECT_BYTE)
1672                 reg = ipw_read_reg8(priv, priv->indirect_byte);
1673         else
1674                 reg = 0;
1675
1676         return sprintf(buf, "0x%02x\n", reg);
1677 }
1678 static ssize_t store_indirect_byte(struct device *d,
1679                                    struct device_attribute *attr,
1680                                    const char *buf, size_t count)
1681 {
1682         struct ipw_priv *priv = d->driver_data;
1683
1684         sscanf(buf, "%x", &priv->indirect_byte);
1685         priv->status |= STATUS_INDIRECT_BYTE;
1686         return strnlen(buf, count);
1687 }
1688
1689 static DEVICE_ATTR(indirect_byte, S_IWUSR | S_IRUGO,
1690                    show_indirect_byte, store_indirect_byte);
1691
1692 static ssize_t show_direct_dword(struct device *d,
1693                                  struct device_attribute *attr, char *buf)
1694 {
1695         u32 reg = 0;
1696         struct ipw_priv *priv = d->driver_data;
1697
1698         if (priv->status & STATUS_DIRECT_DWORD)
1699                 reg = ipw_read32(priv, priv->direct_dword);
1700         else
1701                 reg = 0;
1702
1703         return sprintf(buf, "0x%08x\n", reg);
1704 }
1705 static ssize_t store_direct_dword(struct device *d,
1706                                   struct device_attribute *attr,
1707                                   const char *buf, size_t count)
1708 {
1709         struct ipw_priv *priv = d->driver_data;
1710
1711         sscanf(buf, "%x", &priv->direct_dword);
1712         priv->status |= STATUS_DIRECT_DWORD;
1713         return strnlen(buf, count);
1714 }
1715
1716 static DEVICE_ATTR(direct_dword, S_IWUSR | S_IRUGO,
1717                    show_direct_dword, store_direct_dword);
1718
1719 static int rf_kill_active(struct ipw_priv *priv)
1720 {
1721         if (0 == (ipw_read32(priv, 0x30) & 0x10000))
1722                 priv->status |= STATUS_RF_KILL_HW;
1723         else
1724                 priv->status &= ~STATUS_RF_KILL_HW;
1725
1726         return (priv->status & STATUS_RF_KILL_HW) ? 1 : 0;
1727 }
1728
1729 static ssize_t show_rf_kill(struct device *d, struct device_attribute *attr,
1730                             char *buf)
1731 {
1732         /* 0 - RF kill not enabled
1733            1 - SW based RF kill active (sysfs)
1734            2 - HW based RF kill active
1735            3 - Both HW and SW baed RF kill active */
1736         struct ipw_priv *priv = d->driver_data;
1737         int val = ((priv->status & STATUS_RF_KILL_SW) ? 0x1 : 0x0) |
1738             (rf_kill_active(priv) ? 0x2 : 0x0);
1739         return sprintf(buf, "%i\n", val);
1740 }
1741
1742 static int ipw_radio_kill_sw(struct ipw_priv *priv, int disable_radio)
1743 {
1744         if ((disable_radio ? 1 : 0) ==
1745             ((priv->status & STATUS_RF_KILL_SW) ? 1 : 0))
1746                 return 0;
1747
1748         IPW_DEBUG_RF_KILL("Manual SW RF Kill set to: RADIO  %s\n",
1749                           disable_radio ? "OFF" : "ON");
1750
1751         if (disable_radio) {
1752                 priv->status |= STATUS_RF_KILL_SW;
1753
1754                 if (priv->workqueue) {
1755                         cancel_delayed_work(&priv->request_scan);
1756                         cancel_delayed_work(&priv->request_direct_scan);
1757                         cancel_delayed_work(&priv->request_passive_scan);
1758                         cancel_delayed_work(&priv->scan_event);
1759                 }
1760                 queue_work(priv->workqueue, &priv->down);
1761         } else {
1762                 priv->status &= ~STATUS_RF_KILL_SW;
1763                 if (rf_kill_active(priv)) {
1764                         IPW_DEBUG_RF_KILL("Can not turn radio back on - "
1765                                           "disabled by HW switch\n");
1766                         /* Make sure the RF_KILL check timer is running */
1767                         cancel_delayed_work(&priv->rf_kill);
1768                         queue_delayed_work(priv->workqueue, &priv->rf_kill,
1769                                            round_jiffies_relative(2 * HZ));
1770                 } else
1771                         queue_work(priv->workqueue, &priv->up);
1772         }
1773
1774         return 1;
1775 }
1776
1777 static ssize_t store_rf_kill(struct device *d, struct device_attribute *attr,
1778                              const char *buf, size_t count)
1779 {
1780         struct ipw_priv *priv = d->driver_data;
1781
1782         ipw_radio_kill_sw(priv, buf[0] == '1');
1783
1784         return count;
1785 }
1786
1787 static DEVICE_ATTR(rf_kill, S_IWUSR | S_IRUGO, show_rf_kill, store_rf_kill);
1788
1789 static ssize_t show_speed_scan(struct device *d, struct device_attribute *attr,
1790                                char *buf)
1791 {
1792         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1793         int pos = 0, len = 0;
1794         if (priv->config & CFG_SPEED_SCAN) {
1795                 while (priv->speed_scan[pos] != 0)
1796                         len += sprintf(&buf[len], "%d ",
1797                                        priv->speed_scan[pos++]);
1798                 return len + sprintf(&buf[len], "\n");
1799         }
1800
1801         return sprintf(buf, "0\n");
1802 }
1803
1804 static ssize_t store_speed_scan(struct device *d, struct device_attribute *attr,
1805                                 const char *buf, size_t count)
1806 {
1807         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1808         int channel, pos = 0;
1809         const char *p = buf;
1810
1811         /* list of space separated channels to scan, optionally ending with 0 */
1812         while ((channel = simple_strtol(p, NULL, 0))) {
1813                 if (pos == MAX_SPEED_SCAN - 1) {
1814                         priv->speed_scan[pos] = 0;
1815                         break;
1816                 }
1817
1818                 if (ieee80211_is_valid_channel(priv->ieee, channel))
1819                         priv->speed_scan[pos++] = channel;
1820                 else
1821                         IPW_WARNING("Skipping invalid channel request: %d\n",
1822                                     channel);
1823                 p = strchr(p, ' ');
1824                 if (!p)
1825                         break;
1826                 while (*p == ' ' || *p == '\t')
1827                         p++;
1828         }
1829
1830         if (pos == 0)
1831                 priv->config &= ~CFG_SPEED_SCAN;
1832         else {
1833                 priv->speed_scan_pos = 0;
1834                 priv->config |= CFG_SPEED_SCAN;
1835         }
1836
1837         return count;
1838 }
1839
1840 static DEVICE_ATTR(speed_scan, S_IWUSR | S_IRUGO, show_speed_scan,
1841                    store_speed_scan);
1842
1843 static ssize_t show_net_stats(struct device *d, struct device_attribute *attr,
1844                               char *buf)
1845 {
1846         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1847         return sprintf(buf, "%c\n", (priv->config & CFG_NET_STATS) ? '1' : '0');
1848 }
1849
1850 static ssize_t store_net_stats(struct device *d, struct device_attribute *attr,
1851                                const char *buf, size_t count)
1852 {
1853         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1854         if (buf[0] == '1')
1855                 priv->config |= CFG_NET_STATS;
1856         else
1857                 priv->config &= ~CFG_NET_STATS;
1858
1859         return count;
1860 }
1861
1862 static DEVICE_ATTR(net_stats, S_IWUSR | S_IRUGO,
1863                    show_net_stats, store_net_stats);
1864
1865 static ssize_t show_channels(struct device *d,
1866                              struct device_attribute *attr,
1867                              char *buf)
1868 {
1869         struct ipw_priv *priv = dev_get_drvdata(d);
1870         const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
1871         int len = 0, i;
1872
1873         len = sprintf(&buf[len],
1874                       "Displaying %d channels in 2.4Ghz band "
1875                       "(802.11bg):\n", geo->bg_channels);
1876
1877         for (i = 0; i < geo->bg_channels; i++) {
1878                 len += sprintf(&buf[len], "%d: BSS%s%s, %s, Band %s.\n",
1879                                geo->bg[i].channel,
1880                                geo->bg[i].flags & IEEE80211_CH_RADAR_DETECT ?
1881                                " (radar spectrum)" : "",
1882                                ((geo->bg[i].flags & IEEE80211_CH_NO_IBSS) ||
1883                                 (geo->bg[i].flags & IEEE80211_CH_RADAR_DETECT))
1884                                ? "" : ", IBSS",
1885                                geo->bg[i].flags & IEEE80211_CH_PASSIVE_ONLY ?
1886                                "passive only" : "active/passive",
1887                                geo->bg[i].flags & IEEE80211_CH_B_ONLY ?
1888                                "B" : "B/G");
1889         }
1890
1891         len += sprintf(&buf[len],
1892                        "Displaying %d channels in 5.2Ghz band "
1893                        "(802.11a):\n", geo->a_channels);
1894         for (i = 0; i < geo->a_channels; i++) {
1895                 len += sprintf(&buf[len], "%d: BSS%s%s, %s.\n",
1896                                geo->a[i].channel,
1897                                geo->a[i].flags & IEEE80211_CH_RADAR_DETECT ?
1898                                " (radar spectrum)" : "",
1899                                ((geo->a[i].flags & IEEE80211_CH_NO_IBSS) ||
1900                                 (geo->a[i].flags & IEEE80211_CH_RADAR_DETECT))
1901                                ? "" : ", IBSS",
1902                                geo->a[i].flags & IEEE80211_CH_PASSIVE_ONLY ?
1903                                "passive only" : "active/passive");
1904         }
1905
1906         return len;
1907 }
1908
1909 static DEVICE_ATTR(channels, S_IRUSR, show_channels, NULL);
1910
1911 static void notify_wx_assoc_event(struct ipw_priv *priv)
1912 {
1913         union iwreq_data wrqu;
1914         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1915         if (priv->status & STATUS_ASSOCIATED)
1916                 memcpy(wrqu.ap_addr.sa_data, priv->bssid, ETH_ALEN);
1917         else
1918                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
1919         wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
1920 }
1921
1922 static void ipw_irq_tasklet(struct ipw_priv *priv)
1923 {
1924         u32 inta, inta_mask, handled = 0;
1925         unsigned long flags;
1926         int rc = 0;
1927
1928         spin_lock_irqsave(&priv->irq_lock, flags);
1929
1930         inta = ipw_read32(priv, IPW_INTA_RW);
1931         inta_mask = ipw_read32(priv, IPW_INTA_MASK_R);
1932         inta &= (IPW_INTA_MASK_ALL & inta_mask);
1933
1934         /* Add any cached INTA values that need to be handled */
1935         inta |= priv->isr_inta;
1936
1937         spin_unlock_irqrestore(&priv->irq_lock, flags);
1938
1939         spin_lock_irqsave(&priv->lock, flags);
1940
1941         /* handle all the justifications for the interrupt */
1942         if (inta & IPW_INTA_BIT_RX_TRANSFER) {
1943                 ipw_rx(priv);
1944                 handled |= IPW_INTA_BIT_RX_TRANSFER;
1945         }
1946
1947         if (inta & IPW_INTA_BIT_TX_CMD_QUEUE) {
1948                 IPW_DEBUG_HC("Command completed.\n");
1949                 rc = ipw_queue_tx_reclaim(priv, &priv->txq_cmd, -1);
1950                 priv->status &= ~STATUS_HCMD_ACTIVE;
1951                 wake_up_interruptible(&priv->wait_command_queue);
1952                 handled |= IPW_INTA_BIT_TX_CMD_QUEUE;
1953         }
1954
1955         if (inta & IPW_INTA_BIT_TX_QUEUE_1) {
1956                 IPW_DEBUG_TX("TX_QUEUE_1\n");
1957                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[0], 0);
1958                 handled |= IPW_INTA_BIT_TX_QUEUE_1;
1959         }
1960
1961         if (inta & IPW_INTA_BIT_TX_QUEUE_2) {
1962                 IPW_DEBUG_TX("TX_QUEUE_2\n");
1963                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[1], 1);
1964                 handled |= IPW_INTA_BIT_TX_QUEUE_2;
1965         }
1966
1967         if (inta & IPW_INTA_BIT_TX_QUEUE_3) {
1968                 IPW_DEBUG_TX("TX_QUEUE_3\n");
1969                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[2], 2);
1970                 handled |= IPW_INTA_BIT_TX_QUEUE_3;
1971         }
1972
1973         if (inta & IPW_INTA_BIT_TX_QUEUE_4) {
1974                 IPW_DEBUG_TX("TX_QUEUE_4\n");
1975                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[3], 3);
1976                 handled |= IPW_INTA_BIT_TX_QUEUE_4;
1977         }
1978
1979         if (inta & IPW_INTA_BIT_STATUS_CHANGE) {
1980                 IPW_WARNING("STATUS_CHANGE\n");
1981                 handled |= IPW_INTA_BIT_STATUS_CHANGE;
1982         }
1983
1984         if (inta & IPW_INTA_BIT_BEACON_PERIOD_EXPIRED) {
1985                 IPW_WARNING("TX_PERIOD_EXPIRED\n");
1986                 handled |= IPW_INTA_BIT_BEACON_PERIOD_EXPIRED;
1987         }
1988
1989         if (inta & IPW_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE) {
1990                 IPW_WARNING("HOST_CMD_DONE\n");
1991                 handled |= IPW_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE;
1992         }
1993
1994         if (inta & IPW_INTA_BIT_FW_INITIALIZATION_DONE) {
1995                 IPW_WARNING("FW_INITIALIZATION_DONE\n");
1996                 handled |= IPW_INTA_BIT_FW_INITIALIZATION_DONE;
1997         }
1998
1999         if (inta & IPW_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE) {
2000                 IPW_WARNING("PHY_OFF_DONE\n");
2001                 handled |= IPW_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE;
2002         }
2003
2004         if (inta & IPW_INTA_BIT_RF_KILL_DONE) {
2005                 IPW_DEBUG_RF_KILL("RF_KILL_DONE\n");
2006                 priv->status |= STATUS_RF_KILL_HW;
2007                 wake_up_interruptible(&priv->wait_command_queue);
2008                 priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
2009                 cancel_delayed_work(&priv->request_scan);
2010                 cancel_delayed_work(&priv->request_direct_scan);
2011                 cancel_delayed_work(&priv->request_passive_scan);
2012                 cancel_delayed_work(&priv->scan_event);
2013                 schedule_work(&priv->link_down);
2014                 queue_delayed_work(priv->workqueue, &priv->rf_kill, 2 * HZ);
2015                 handled |= IPW_INTA_BIT_RF_KILL_DONE;
2016         }
2017
2018         if (inta & IPW_INTA_BIT_FATAL_ERROR) {
2019                 IPW_WARNING("Firmware error detected.  Restarting.\n");
2020                 if (priv->error) {
2021                         IPW_DEBUG_FW("Sysfs 'error' log already exists.\n");
2022                         if (ipw_debug_level & IPW_DL_FW_ERRORS) {
2023                                 struct ipw_fw_error *error =
2024                                     ipw_alloc_error_log(priv);
2025                                 ipw_dump_error_log(priv, error);
2026                                 kfree(error);
2027                         }
2028                 } else {
2029                         priv->error = ipw_alloc_error_log(priv);
2030                         if (priv->error)
2031                                 IPW_DEBUG_FW("Sysfs 'error' log captured.\n");
2032                         else
2033                                 IPW_DEBUG_FW("Error allocating sysfs 'error' "
2034                                              "log.\n");
2035                         if (ipw_debug_level & IPW_DL_FW_ERRORS)
2036                                 ipw_dump_error_log(priv, priv->error);
2037                 }
2038
2039                 /* XXX: If hardware encryption is for WPA/WPA2,
2040                  * we have to notify the supplicant. */
2041                 if (priv->ieee->sec.encrypt) {
2042                         priv->status &= ~STATUS_ASSOCIATED;
2043                         notify_wx_assoc_event(priv);
2044                 }
2045
2046                 /* Keep the restart process from trying to send host
2047                  * commands by clearing the INIT status bit */
2048                 priv->status &= ~STATUS_INIT;
2049
2050                 /* Cancel currently queued command. */
2051                 priv->status &= ~STATUS_HCMD_ACTIVE;
2052                 wake_up_interruptible(&priv->wait_command_queue);
2053
2054                 queue_work(priv->workqueue, &priv->adapter_restart);
2055                 handled |= IPW_INTA_BIT_FATAL_ERROR;
2056         }
2057
2058         if (inta & IPW_INTA_BIT_PARITY_ERROR) {
2059                 IPW_ERROR("Parity error\n");
2060                 handled |= IPW_INTA_BIT_PARITY_ERROR;
2061         }
2062
2063         if (handled != inta) {
2064                 IPW_ERROR("Unhandled INTA bits 0x%08x\n", inta & ~handled);
2065         }
2066
2067         spin_unlock_irqrestore(&priv->lock, flags);
2068
2069         /* enable all interrupts */
2070         ipw_enable_interrupts(priv);
2071 }
2072
2073 #define IPW_CMD(x) case IPW_CMD_ ## x : return #x
2074 static char *get_cmd_string(u8 cmd)
2075 {
2076         switch (cmd) {
2077                 IPW_CMD(HOST_COMPLETE);
2078                 IPW_CMD(POWER_DOWN);
2079                 IPW_CMD(SYSTEM_CONFIG);
2080                 IPW_CMD(MULTICAST_ADDRESS);
2081                 IPW_CMD(SSID);
2082                 IPW_CMD(ADAPTER_ADDRESS);
2083                 IPW_CMD(PORT_TYPE);
2084                 IPW_CMD(RTS_THRESHOLD);
2085                 IPW_CMD(FRAG_THRESHOLD);
2086                 IPW_CMD(POWER_MODE);
2087                 IPW_CMD(WEP_KEY);
2088                 IPW_CMD(TGI_TX_KEY);
2089                 IPW_CMD(SCAN_REQUEST);
2090                 IPW_CMD(SCAN_REQUEST_EXT);
2091                 IPW_CMD(ASSOCIATE);
2092                 IPW_CMD(SUPPORTED_RATES);
2093                 IPW_CMD(SCAN_ABORT);
2094                 IPW_CMD(TX_FLUSH);
2095                 IPW_CMD(QOS_PARAMETERS);
2096                 IPW_CMD(DINO_CONFIG);
2097                 IPW_CMD(RSN_CAPABILITIES);
2098                 IPW_CMD(RX_KEY);
2099                 IPW_CMD(CARD_DISABLE);
2100                 IPW_CMD(SEED_NUMBER);
2101                 IPW_CMD(TX_POWER);
2102                 IPW_CMD(COUNTRY_INFO);
2103                 IPW_CMD(AIRONET_INFO);
2104                 IPW_CMD(AP_TX_POWER);
2105                 IPW_CMD(CCKM_INFO);
2106                 IPW_CMD(CCX_VER_INFO);
2107                 IPW_CMD(SET_CALIBRATION);
2108                 IPW_CMD(SENSITIVITY_CALIB);
2109                 IPW_CMD(RETRY_LIMIT);
2110                 IPW_CMD(IPW_PRE_POWER_DOWN);
2111                 IPW_CMD(VAP_BEACON_TEMPLATE);
2112                 IPW_CMD(VAP_DTIM_PERIOD);
2113                 IPW_CMD(EXT_SUPPORTED_RATES);
2114                 IPW_CMD(VAP_LOCAL_TX_PWR_CONSTRAINT);
2115                 IPW_CMD(VAP_QUIET_INTERVALS);
2116                 IPW_CMD(VAP_CHANNEL_SWITCH);
2117                 IPW_CMD(VAP_MANDATORY_CHANNELS);
2118                 IPW_CMD(VAP_CELL_PWR_LIMIT);
2119                 IPW_CMD(VAP_CF_PARAM_SET);
2120                 IPW_CMD(VAP_SET_BEACONING_STATE);
2121                 IPW_CMD(MEASUREMENT);
2122                 IPW_CMD(POWER_CAPABILITY);
2123                 IPW_CMD(SUPPORTED_CHANNELS);
2124                 IPW_CMD(TPC_REPORT);
2125                 IPW_CMD(WME_INFO);
2126                 IPW_CMD(PRODUCTION_COMMAND);
2127         default:
2128                 return "UNKNOWN";
2129         }
2130 }
2131
2132 #define HOST_COMPLETE_TIMEOUT HZ
2133
2134 static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
2135 {
2136         int rc = 0;
2137         unsigned long flags;
2138
2139         spin_lock_irqsave(&priv->lock, flags);
2140         if (priv->status & STATUS_HCMD_ACTIVE) {
2141                 IPW_ERROR("Failed to send %s: Already sending a command.\n",
2142                           get_cmd_string(cmd->cmd));
2143                 spin_unlock_irqrestore(&priv->lock, flags);
2144                 return -EAGAIN;
2145         }
2146
2147         priv->status |= STATUS_HCMD_ACTIVE;
2148
2149         if (priv->cmdlog) {
2150                 priv->cmdlog[priv->cmdlog_pos].jiffies = jiffies;
2151                 priv->cmdlog[priv->cmdlog_pos].cmd.cmd = cmd->cmd;
2152                 priv->cmdlog[priv->cmdlog_pos].cmd.len = cmd->len;
2153                 memcpy(priv->cmdlog[priv->cmdlog_pos].cmd.param, cmd->param,
2154                        cmd->len);
2155                 priv->cmdlog[priv->cmdlog_pos].retcode = -1;
2156         }
2157
2158         IPW_DEBUG_HC("%s command (#%d) %d bytes: 0x%08X\n",
2159                      get_cmd_string(cmd->cmd), cmd->cmd, cmd->len,
2160                      priv->status);
2161
2162 #ifndef DEBUG_CMD_WEP_KEY
2163         if (cmd->cmd == IPW_CMD_WEP_KEY)
2164                 IPW_DEBUG_HC("WEP_KEY command masked out for secure.\n");
2165         else
2166 #endif
2167                 printk_buf(IPW_DL_HOST_COMMAND, (u8 *) cmd->param, cmd->len);
2168
2169         rc = ipw_queue_tx_hcmd(priv, cmd->cmd, cmd->param, cmd->len, 0);
2170         if (rc) {
2171                 priv->status &= ~STATUS_HCMD_ACTIVE;
2172                 IPW_ERROR("Failed to send %s: Reason %d\n",
2173                           get_cmd_string(cmd->cmd), rc);
2174                 spin_unlock_irqrestore(&priv->lock, flags);
2175                 goto exit;
2176         }
2177         spin_unlock_irqrestore(&priv->lock, flags);
2178
2179         rc = wait_event_interruptible_timeout(priv->wait_command_queue,
2180                                               !(priv->
2181                                                 status & STATUS_HCMD_ACTIVE),
2182                                               HOST_COMPLETE_TIMEOUT);
2183         if (rc == 0) {
2184                 spin_lock_irqsave(&priv->lock, flags);
2185                 if (priv->status & STATUS_HCMD_ACTIVE) {
2186                         IPW_ERROR("Failed to send %s: Command timed out.\n",
2187                                   get_cmd_string(cmd->cmd));
2188                         priv->status &= ~STATUS_HCMD_ACTIVE;
2189                         spin_unlock_irqrestore(&priv->lock, flags);
2190                         rc = -EIO;
2191                         goto exit;
2192                 }
2193                 spin_unlock_irqrestore(&priv->lock, flags);
2194         } else
2195                 rc = 0;
2196
2197         if (priv->status & STATUS_RF_KILL_HW) {
2198                 IPW_ERROR("Failed to send %s: Aborted due to RF kill switch.\n",
2199                           get_cmd_string(cmd->cmd));
2200                 rc = -EIO;
2201                 goto exit;
2202         }
2203
2204       exit:
2205         if (priv->cmdlog) {
2206                 priv->cmdlog[priv->cmdlog_pos++].retcode = rc;
2207                 priv->cmdlog_pos %= priv->cmdlog_len;
2208         }
2209         return rc;
2210 }
2211
2212 static int ipw_send_cmd_simple(struct ipw_priv *priv, u8 command)
2213 {
2214         struct host_cmd cmd = {
2215                 .cmd = command,
2216         };
2217
2218         return __ipw_send_cmd(priv, &cmd);
2219 }
2220
2221 static int ipw_send_cmd_pdu(struct ipw_priv *priv, u8 command, u8 len,
2222                             void *data)
2223 {
2224         struct host_cmd cmd = {
2225                 .cmd = command,
2226                 .len = len,
2227                 .param = data,
2228         };
2229
2230         return __ipw_send_cmd(priv, &cmd);
2231 }
2232
2233 static int ipw_send_host_complete(struct ipw_priv *priv)
2234 {
2235         if (!priv) {
2236                 IPW_ERROR("Invalid args\n");
2237                 return -1;
2238         }
2239
2240         return ipw_send_cmd_simple(priv, IPW_CMD_HOST_COMPLETE);
2241 }
2242
2243 static int ipw_send_system_config(struct ipw_priv *priv)
2244 {
2245         return ipw_send_cmd_pdu(priv, IPW_CMD_SYSTEM_CONFIG,
2246                                 sizeof(priv->sys_config),
2247                                 &priv->sys_config);
2248 }
2249
2250 static int ipw_send_ssid(struct ipw_priv *priv, u8 * ssid, int len)
2251 {
2252         if (!priv || !ssid) {
2253                 IPW_ERROR("Invalid args\n");
2254                 return -1;
2255         }
2256
2257         return ipw_send_cmd_pdu(priv, IPW_CMD_SSID, min(len, IW_ESSID_MAX_SIZE),
2258                                 ssid);
2259 }
2260
2261 static int ipw_send_adapter_address(struct ipw_priv *priv, u8 * mac)
2262 {
2263         if (!priv || !mac) {
2264                 IPW_ERROR("Invalid args\n");
2265                 return -1;
2266         }
2267
2268         IPW_DEBUG_INFO("%s: Setting MAC to %pM\n",
2269                        priv->net_dev->name, mac);
2270
2271         return ipw_send_cmd_pdu(priv, IPW_CMD_ADAPTER_ADDRESS, ETH_ALEN, mac);
2272 }
2273
2274 /*
2275  * NOTE: This must be executed from our workqueue as it results in udelay
2276  * being called which may corrupt the keyboard if executed on default
2277  * workqueue
2278  */
2279 static void ipw_adapter_restart(void *adapter)
2280 {
2281         struct ipw_priv *priv = adapter;
2282
2283         if (priv->status & STATUS_RF_KILL_MASK)
2284                 return;
2285
2286         ipw_down(priv);
2287
2288         if (priv->assoc_network &&
2289             (priv->assoc_network->capability & WLAN_CAPABILITY_IBSS))
2290                 ipw_remove_current_network(priv);
2291
2292         if (ipw_up(priv)) {
2293                 IPW_ERROR("Failed to up device\n");
2294                 return;
2295         }
2296 }
2297
2298 static void ipw_bg_adapter_restart(struct work_struct *work)
2299 {
2300         struct ipw_priv *priv =
2301                 container_of(work, struct ipw_priv, adapter_restart);
2302         mutex_lock(&priv->mutex);
2303         ipw_adapter_restart(priv);
2304         mutex_unlock(&priv->mutex);
2305 }
2306
2307 #define IPW_SCAN_CHECK_WATCHDOG (5 * HZ)
2308
2309 static void ipw_scan_check(void *data)
2310 {
2311         struct ipw_priv *priv = data;
2312         if (priv->status & (STATUS_SCANNING | STATUS_SCAN_ABORTING)) {
2313                 IPW_DEBUG_SCAN("Scan completion watchdog resetting "
2314                                "adapter after (%dms).\n",
2315                                jiffies_to_msecs(IPW_SCAN_CHECK_WATCHDOG));
2316                 queue_work(priv->workqueue, &priv->adapter_restart);
2317         }
2318 }
2319
2320 static void ipw_bg_scan_check(struct work_struct *work)
2321 {
2322         struct ipw_priv *priv =
2323                 container_of(work, struct ipw_priv, scan_check.work);
2324         mutex_lock(&priv->mutex);
2325         ipw_scan_check(priv);
2326         mutex_unlock(&priv->mutex);
2327 }
2328
2329 static int ipw_send_scan_request_ext(struct ipw_priv *priv,
2330                                      struct ipw_scan_request_ext *request)
2331 {
2332         return ipw_send_cmd_pdu(priv, IPW_CMD_SCAN_REQUEST_EXT,
2333                                 sizeof(*request), request);
2334 }
2335
2336 static int ipw_send_scan_abort(struct ipw_priv *priv)
2337 {
2338         if (!priv) {
2339                 IPW_ERROR("Invalid args\n");
2340                 return -1;
2341         }
2342
2343         return ipw_send_cmd_simple(priv, IPW_CMD_SCAN_ABORT);
2344 }
2345
2346 static int ipw_set_sensitivity(struct ipw_priv *priv, u16 sens)
2347 {
2348         struct ipw_sensitivity_calib calib = {
2349                 .beacon_rssi_raw = cpu_to_le16(sens),
2350         };
2351
2352         return ipw_send_cmd_pdu(priv, IPW_CMD_SENSITIVITY_CALIB, sizeof(calib),
2353                                 &calib);
2354 }
2355
2356 static int ipw_send_associate(struct ipw_priv *priv,
2357                               struct ipw_associate *associate)
2358 {
2359         if (!priv || !associate) {
2360                 IPW_ERROR("Invalid args\n");
2361                 return -1;
2362         }
2363
2364         return ipw_send_cmd_pdu(priv, IPW_CMD_ASSOCIATE, sizeof(*associate),
2365                                 associate);
2366 }
2367
2368 static int ipw_send_supported_rates(struct ipw_priv *priv,
2369                                     struct ipw_supported_rates *rates)
2370 {
2371         if (!priv || !rates) {
2372                 IPW_ERROR("Invalid args\n");
2373                 return -1;
2374         }
2375
2376         return ipw_send_cmd_pdu(priv, IPW_CMD_SUPPORTED_RATES, sizeof(*rates),
2377                                 rates);
2378 }
2379
2380 static int ipw_set_random_seed(struct ipw_priv *priv)
2381 {
2382         u32 val;
2383
2384         if (!priv) {
2385                 IPW_ERROR("Invalid args\n");
2386                 return -1;
2387         }
2388
2389         get_random_bytes(&val, sizeof(val));
2390
2391         return ipw_send_cmd_pdu(priv, IPW_CMD_SEED_NUMBER, sizeof(val), &val);
2392 }
2393
2394 static int ipw_send_card_disable(struct ipw_priv *priv, u32 phy_off)
2395 {
2396         __le32 v = cpu_to_le32(phy_off);
2397         if (!priv) {
2398                 IPW_ERROR("Invalid args\n");
2399                 return -1;
2400         }
2401
2402         return ipw_send_cmd_pdu(priv, IPW_CMD_CARD_DISABLE, sizeof(v), &v);
2403 }
2404
2405 static int ipw_send_tx_power(struct ipw_priv *priv, struct ipw_tx_power *power)
2406 {
2407         if (!priv || !power) {
2408                 IPW_ERROR("Invalid args\n");
2409                 return -1;
2410         }
2411
2412         return ipw_send_cmd_pdu(priv, IPW_CMD_TX_POWER, sizeof(*power), power);
2413 }
2414
2415 static int ipw_set_tx_power(struct ipw_priv *priv)
2416 {
2417         const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
2418         struct ipw_tx_power tx_power;
2419         s8 max_power;
2420         int i;
2421
2422         memset(&tx_power, 0, sizeof(tx_power));
2423
2424         /* configure device for 'G' band */
2425         tx_power.ieee_mode = IPW_G_MODE;
2426         tx_power.num_channels = geo->bg_channels;
2427         for (i = 0; i < geo->bg_channels; i++) {
2428                 max_power = geo->bg[i].max_power;
2429                 tx_power.channels_tx_power[i].channel_number =
2430                     geo->bg[i].channel;
2431                 tx_power.channels_tx_power[i].tx_power = max_power ?
2432                     min(max_power, priv->tx_power) : priv->tx_power;
2433         }
2434         if (ipw_send_tx_power(priv, &tx_power))
2435                 return -EIO;
2436
2437         /* configure device to also handle 'B' band */
2438         tx_power.ieee_mode = IPW_B_MODE;
2439         if (ipw_send_tx_power(priv, &tx_power))
2440                 return -EIO;
2441
2442         /* configure device to also handle 'A' band */
2443         if (priv->ieee->abg_true) {
2444                 tx_power.ieee_mode = IPW_A_MODE;
2445                 tx_power.num_channels = geo->a_channels;
2446                 for (i = 0; i < tx_power.num_channels; i++) {
2447                         max_power = geo->a[i].max_power;
2448                         tx_power.channels_tx_power[i].channel_number =
2449                             geo->a[i].channel;
2450                         tx_power.channels_tx_power[i].tx_power = max_power ?
2451                             min(max_power, priv->tx_power) : priv->tx_power;
2452                 }
2453                 if (ipw_send_tx_power(priv, &tx_power))
2454                         return -EIO;
2455         }
2456         return 0;
2457 }
2458
2459 static int ipw_send_rts_threshold(struct ipw_priv *priv, u16 rts)
2460 {
2461         struct ipw_rts_threshold rts_threshold = {
2462                 .rts_threshold = cpu_to_le16(rts),
2463         };
2464
2465         if (!priv) {
2466                 IPW_ERROR("Invalid args\n");
2467                 return -1;
2468         }
2469
2470         return ipw_send_cmd_pdu(priv, IPW_CMD_RTS_THRESHOLD,
2471                                 sizeof(rts_threshold), &rts_threshold);
2472 }
2473
2474 static int ipw_send_frag_threshold(struct ipw_priv *priv, u16 frag)
2475 {
2476         struct ipw_frag_threshold frag_threshold = {
2477                 .frag_threshold = cpu_to_le16(frag),
2478         };
2479
2480         if (!priv) {
2481                 IPW_ERROR("Invalid args\n");
2482                 return -1;
2483         }
2484
2485         return ipw_send_cmd_pdu(priv, IPW_CMD_FRAG_THRESHOLD,
2486                                 sizeof(frag_threshold), &frag_threshold);
2487 }
2488
2489 static int ipw_send_power_mode(struct ipw_priv *priv, u32 mode)
2490 {
2491         __le32 param;
2492
2493         if (!priv) {
2494                 IPW_ERROR("Invalid args\n");
2495                 return -1;
2496         }
2497
2498         /* If on battery, set to 3, if AC set to CAM, else user
2499          * level */
2500         switch (mode) {
2501         case IPW_POWER_BATTERY:
2502                 param = cpu_to_le32(IPW_POWER_INDEX_3);
2503                 break;
2504         case IPW_POWER_AC:
2505                 param = cpu_to_le32(IPW_POWER_MODE_CAM);
2506                 break;
2507         default:
2508                 param = cpu_to_le32(mode);
2509                 break;
2510         }
2511
2512         return ipw_send_cmd_pdu(priv, IPW_CMD_POWER_MODE, sizeof(param),
2513                                 &param);
2514 }
2515
2516 static int ipw_send_retry_limit(struct ipw_priv *priv, u8 slimit, u8 llimit)
2517 {
2518         struct ipw_retry_limit retry_limit = {
2519                 .short_retry_limit = slimit,
2520                 .long_retry_limit = llimit
2521         };
2522
2523         if (!priv) {
2524                 IPW_ERROR("Invalid args\n");
2525                 return -1;
2526         }
2527
2528         return ipw_send_cmd_pdu(priv, IPW_CMD_RETRY_LIMIT, sizeof(retry_limit),
2529                                 &retry_limit);
2530 }
2531
2532 /*
2533  * The IPW device contains a Microwire compatible EEPROM that stores
2534  * various data like the MAC address.  Usually the firmware has exclusive
2535  * access to the eeprom, but during device initialization (before the
2536  * device driver has sent the HostComplete command to the firmware) the
2537  * device driver has read access to the EEPROM by way of indirect addressing
2538  * through a couple of memory mapped registers.
2539  *
2540  * The following is a simplified implementation for pulling data out of the
2541  * the eeprom, along with some helper functions to find information in
2542  * the per device private data's copy of the eeprom.
2543  *
2544  * NOTE: To better understand how these functions work (i.e what is a chip
2545  *       select and why do have to keep driving the eeprom clock?), read
2546  *       just about any data sheet for a Microwire compatible EEPROM.
2547  */
2548
2549 /* write a 32 bit value into the indirect accessor register */
2550 static inline void eeprom_write_reg(struct ipw_priv *p, u32 data)
2551 {
2552         ipw_write_reg32(p, FW_MEM_REG_EEPROM_ACCESS, data);
2553
2554         /* the eeprom requires some time to complete the operation */
2555         udelay(p->eeprom_delay);
2556
2557         return;
2558 }
2559
2560 /* perform a chip select operation */
2561 static void eeprom_cs(struct ipw_priv *priv)
2562 {
2563         eeprom_write_reg(priv, 0);
2564         eeprom_write_reg(priv, EEPROM_BIT_CS);
2565         eeprom_write_reg(priv, EEPROM_BIT_CS | EEPROM_BIT_SK);
2566         eeprom_write_reg(priv, EEPROM_BIT_CS);
2567 }
2568
2569 /* perform a chip select operation */
2570 static void eeprom_disable_cs(struct ipw_priv *priv)
2571 {
2572         eeprom_write_reg(priv, EEPROM_BIT_CS);
2573         eeprom_write_reg(priv, 0);
2574         eeprom_write_reg(priv, EEPROM_BIT_SK);
2575 }
2576
2577 /* push a single bit down to the eeprom */
2578 static inline void eeprom_write_bit(struct ipw_priv *p, u8 bit)
2579 {
2580         int d = (bit ? EEPROM_BIT_DI : 0);
2581         eeprom_write_reg(p, EEPROM_BIT_CS | d);
2582         eeprom_write_reg(p, EEPROM_BIT_CS | d | EEPROM_BIT_SK);
2583 }
2584
2585 /* push an opcode followed by an address down to the eeprom */
2586 static void eeprom_op(struct ipw_priv *priv, u8 op, u8 addr)
2587 {
2588         int i;
2589
2590         eeprom_cs(priv);
2591         eeprom_write_bit(priv, 1);
2592         eeprom_write_bit(priv, op & 2);
2593         eeprom_write_bit(priv, op & 1);
2594         for (i = 7; i >= 0; i--) {
2595                 eeprom_write_bit(priv, addr & (1 << i));
2596         }
2597 }
2598
2599 /* pull 16 bits off the eeprom, one bit at a time */
2600 static u16 eeprom_read_u16(struct ipw_priv *priv, u8 addr)
2601 {
2602         int i;
2603         u16 r = 0;
2604
2605         /* Send READ Opcode */
2606         eeprom_op(priv, EEPROM_CMD_READ, addr);
2607
2608         /* Send dummy bit */
2609         eeprom_write_reg(priv, EEPROM_BIT_CS);
2610
2611         /* Read the byte off the eeprom one bit at a time */
2612         for (i = 0; i < 16; i++) {
2613                 u32 data = 0;
2614                 eeprom_write_reg(priv, EEPROM_BIT_CS | EEPROM_BIT_SK);
2615                 eeprom_write_reg(priv, EEPROM_BIT_CS);
2616                 data = ipw_read_reg32(priv, FW_MEM_REG_EEPROM_ACCESS);
2617                 r = (r << 1) | ((data & EEPROM_BIT_DO) ? 1 : 0);
2618         }
2619
2620         /* Send another dummy bit */
2621         eeprom_write_reg(priv, 0);
2622         eeprom_disable_cs(priv);
2623
2624         return r;
2625 }
2626
2627 /* helper function for pulling the mac address out of the private */
2628 /* data's copy of the eeprom data                                 */
2629 static void eeprom_parse_mac(struct ipw_priv *priv, u8 * mac)
2630 {
2631         memcpy(mac, &priv->eeprom[EEPROM_MAC_ADDRESS], 6);
2632 }
2633
2634 /*
2635  * Either the device driver (i.e. the host) or the firmware can
2636  * load eeprom data into the designated region in SRAM.  If neither
2637  * happens then the FW will shutdown with a fatal error.
2638  *
2639  * In order to signal the FW to load the EEPROM, the EEPROM_LOAD_DISABLE
2640  * bit needs region of shared SRAM needs to be non-zero.
2641  */
2642 static void ipw_eeprom_init_sram(struct ipw_priv *priv)
2643 {
2644         int i;
2645         __le16 *eeprom = (__le16 *) priv->eeprom;
2646
2647         IPW_DEBUG_TRACE(">>\n");
2648
2649         /* read entire contents of eeprom into private buffer */
2650         for (i = 0; i < 128; i++)
2651                 eeprom[i] = cpu_to_le16(eeprom_read_u16(priv, (u8) i));
2652
2653         /*
2654            If the data looks correct, then copy it to our private
2655            copy.  Otherwise let the firmware know to perform the operation
2656            on its own.
2657          */
2658         if (priv->eeprom[EEPROM_VERSION] != 0) {
2659                 IPW_DEBUG_INFO("Writing EEPROM data into SRAM\n");
2660
2661                 /* write the eeprom data to sram */
2662                 for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
2663                         ipw_write8(priv, IPW_EEPROM_DATA + i, priv->eeprom[i]);
2664
2665                 /* Do not load eeprom data on fatal error or suspend */
2666                 ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
2667         } else {
2668                 IPW_DEBUG_INFO("Enabling FW initializationg of SRAM\n");
2669
2670                 /* Load eeprom data on fatal error or suspend */
2671                 ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 1);
2672         }
2673
2674         IPW_DEBUG_TRACE("<<\n");
2675 }
2676
2677 static void ipw_zero_memory(struct ipw_priv *priv, u32 start, u32 count)
2678 {
2679         count >>= 2;
2680         if (!count)
2681                 return;
2682         _ipw_write32(priv, IPW_AUTOINC_ADDR, start);
2683         while (count--)
2684                 _ipw_write32(priv, IPW_AUTOINC_DATA, 0);
2685 }
2686
2687 static inline void ipw_fw_dma_reset_command_blocks(struct ipw_priv *priv)
2688 {
2689         ipw_zero_memory(priv, IPW_SHARED_SRAM_DMA_CONTROL,
2690                         CB_NUMBER_OF_ELEMENTS_SMALL *
2691                         sizeof(struct command_block));
2692 }
2693
2694 static int ipw_fw_dma_enable(struct ipw_priv *priv)
2695 {                               /* start dma engine but no transfers yet */
2696
2697         IPW_DEBUG_FW(">> : \n");
2698
2699         /* Start the dma */
2700         ipw_fw_dma_reset_command_blocks(priv);
2701
2702         /* Write CB base address */
2703         ipw_write_reg32(priv, IPW_DMA_I_CB_BASE, IPW_SHARED_SRAM_DMA_CONTROL);
2704
2705         IPW_DEBUG_FW("<< : \n");
2706         return 0;
2707 }
2708
2709 static void ipw_fw_dma_abort(struct ipw_priv *priv)
2710 {
2711         u32 control = 0;
2712
2713         IPW_DEBUG_FW(">> :\n");
2714
2715         /* set the Stop and Abort bit */
2716         control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_STOP_AND_ABORT;
2717         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
2718         priv->sram_desc.last_cb_index = 0;
2719
2720         IPW_DEBUG_FW("<< \n");
2721 }
2722
2723 static int ipw_fw_dma_write_command_block(struct ipw_priv *priv, int index,
2724                                           struct command_block *cb)
2725 {
2726         u32 address =
2727             IPW_SHARED_SRAM_DMA_CONTROL +
2728             (sizeof(struct command_block) * index);
2729         IPW_DEBUG_FW(">> :\n");
2730
2731         ipw_write_indirect(priv, address, (u8 *) cb,
2732                            (int)sizeof(struct command_block));
2733
2734         IPW_DEBUG_FW("<< :\n");
2735         return 0;
2736
2737 }
2738
2739 static int ipw_fw_dma_kick(struct ipw_priv *priv)
2740 {
2741         u32 control = 0;
2742         u32 index = 0;
2743
2744         IPW_DEBUG_FW(">> :\n");
2745
2746         for (index = 0; index < priv->sram_desc.last_cb_index; index++)
2747                 ipw_fw_dma_write_command_block(priv, index,
2748                                                &priv->sram_desc.cb_list[index]);
2749
2750         /* Enable the DMA in the CSR register */
2751         ipw_clear_bit(priv, IPW_RESET_REG,
2752                       IPW_RESET_REG_MASTER_DISABLED |
2753                       IPW_RESET_REG_STOP_MASTER);
2754
2755         /* Set the Start bit. */
2756         control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_START;
2757         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
2758
2759         IPW_DEBUG_FW("<< :\n");
2760         return 0;
2761 }
2762
2763 static void ipw_fw_dma_dump_command_block(struct ipw_priv *priv)
2764 {
2765         u32 address;
2766         u32 register_value = 0;
2767         u32 cb_fields_address = 0;
2768
2769         IPW_DEBUG_FW(">> :\n");
2770         address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
2771         IPW_DEBUG_FW_INFO("Current CB is 0x%x \n", address);
2772
2773         /* Read the DMA Controlor register */
2774         register_value = ipw_read_reg32(priv, IPW_DMA_I_DMA_CONTROL);
2775         IPW_DEBUG_FW_INFO("IPW_DMA_I_DMA_CONTROL is 0x%x \n", register_value);
2776
2777         /* Print the CB values */
2778         cb_fields_address = address;
2779         register_value = ipw_read_reg32(priv, cb_fields_address);
2780         IPW_DEBUG_FW_INFO("Current CB ControlField is 0x%x \n", register_value);
2781
2782         cb_fields_address += sizeof(u32);
2783         register_value = ipw_read_reg32(priv, cb_fields_address);
2784         IPW_DEBUG_FW_INFO("Current CB Source Field is 0x%x \n", register_value);
2785
2786         cb_fields_address += sizeof(u32);
2787         register_value = ipw_read_reg32(priv, cb_fields_address);
2788         IPW_DEBUG_FW_INFO("Current CB Destination Field is 0x%x \n",
2789                           register_value);
2790
2791         cb_fields_address += sizeof(u32);
2792         register_value = ipw_read_reg32(priv, cb_fields_address);
2793         IPW_DEBUG_FW_INFO("Current CB Status Field is 0x%x \n", register_value);
2794
2795         IPW_DEBUG_FW(">> :\n");
2796 }
2797
2798 static int ipw_fw_dma_command_block_index(struct ipw_priv *priv)
2799 {
2800         u32 current_cb_address = 0;
2801         u32 current_cb_index = 0;
2802
2803         IPW_DEBUG_FW("<< :\n");
2804         current_cb_address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
2805
2806         current_cb_index = (current_cb_address - IPW_SHARED_SRAM_DMA_CONTROL) /
2807             sizeof(struct command_block);
2808
2809         IPW_DEBUG_FW_INFO("Current CB index 0x%x address = 0x%X \n",
2810                           current_cb_index, current_cb_address);
2811
2812         IPW_DEBUG_FW(">> :\n");
2813         return current_cb_index;
2814
2815 }
2816
2817 static int ipw_fw_dma_add_command_block(struct ipw_priv *priv,
2818                                         u32 src_address,
2819                                         u32 dest_address,
2820                                         u32 length,
2821                                         int interrupt_enabled, int is_last)
2822 {
2823
2824         u32 control = CB_VALID | CB_SRC_LE | CB_DEST_LE | CB_SRC_AUTOINC |
2825             CB_SRC_IO_GATED | CB_DEST_AUTOINC | CB_SRC_SIZE_LONG |
2826             CB_DEST_SIZE_LONG;
2827         struct command_block *cb;
2828         u32 last_cb_element = 0;
2829
2830         IPW_DEBUG_FW_INFO("src_address=0x%x dest_address=0x%x length=0x%x\n",
2831                           src_address, dest_address, length);
2832
2833         if (priv->sram_desc.last_cb_index >= CB_NUMBER_OF_ELEMENTS_SMALL)
2834                 return -1;
2835
2836         last_cb_element = priv->sram_desc.last_cb_index;
2837         cb = &priv->sram_desc.cb_list[last_cb_element];
2838         priv->sram_desc.last_cb_index++;
2839
2840         /* Calculate the new CB control word */
2841         if (interrupt_enabled)
2842                 control |= CB_INT_ENABLED;
2843
2844         if (is_last)
2845                 control |= CB_LAST_VALID;
2846
2847         control |= length;
2848
2849         /* Calculate the CB Element's checksum value */
2850         cb->status = control ^ src_address ^ dest_address;
2851
2852         /* Copy the Source and Destination addresses */
2853         cb->dest_addr = dest_address;
2854         cb->source_addr = src_address;
2855
2856         /* Copy the Control Word last */
2857         cb->control = control;
2858
2859         return 0;
2860 }
2861
2862 static int ipw_fw_dma_add_buffer(struct ipw_priv *priv,
2863                                  u32 src_phys, u32 dest_address, u32 length)
2864 {
2865         u32 bytes_left = length;
2866         u32 src_offset = 0;
2867         u32 dest_offset = 0;
2868         int status = 0;
2869         IPW_DEBUG_FW(">> \n");
2870         IPW_DEBUG_FW_INFO("src_phys=0x%x dest_address=0x%x length=0x%x\n",
2871                           src_phys, dest_address, length);
2872         while (bytes_left > CB_MAX_LENGTH) {
2873                 status = ipw_fw_dma_add_command_block(priv,
2874                                                       src_phys + src_offset,
2875                                                       dest_address +
2876                                                       dest_offset,
2877                                                       CB_MAX_LENGTH, 0, 0);
2878                 if (status) {
2879                         IPW_DEBUG_FW_INFO(": Failed\n");
2880                         return -1;
2881                 } else
2882                         IPW_DEBUG_FW_INFO(": Added new cb\n");
2883
2884                 src_offset += CB_MAX_LENGTH;
2885                 dest_offset += CB_MAX_LENGTH;
2886                 bytes_left -= CB_MAX_LENGTH;
2887         }
2888
2889         /* add the buffer tail */
2890         if (bytes_left > 0) {
2891                 status =
2892                     ipw_fw_dma_add_command_block(priv, src_phys + src_offset,
2893                                                  dest_address + dest_offset,
2894                                                  bytes_left, 0, 0);
2895                 if (status) {
2896                         IPW_DEBUG_FW_INFO(": Failed on the buffer tail\n");
2897                         return -1;
2898                 } else
2899                         IPW_DEBUG_FW_INFO
2900                             (": Adding new cb - the buffer tail\n");
2901         }
2902
2903         IPW_DEBUG_FW("<< \n");
2904         return 0;
2905 }
2906
2907 static int ipw_fw_dma_wait(struct ipw_priv *priv)
2908 {
2909         u32 current_index = 0, previous_index;
2910         u32 watchdog = 0;
2911
2912         IPW_DEBUG_FW(">> : \n");
2913
2914         current_index = ipw_fw_dma_command_block_index(priv);
2915         IPW_DEBUG_FW_INFO("sram_desc.last_cb_index:0x%08X\n",
2916                           (int)priv->sram_desc.last_cb_index);
2917
2918         while (current_index < priv->sram_desc.last_cb_index) {
2919                 udelay(50);
2920                 previous_index = current_index;
2921                 current_index = ipw_fw_dma_command_block_index(priv);
2922
2923                 if (previous_index < current_index) {
2924                         watchdog = 0;
2925                         continue;
2926                 }
2927                 if (++watchdog > 400) {
2928                         IPW_DEBUG_FW_INFO("Timeout\n");
2929                         ipw_fw_dma_dump_command_block(priv);
2930                         ipw_fw_dma_abort(priv);
2931                         return -1;
2932                 }
2933         }
2934
2935         ipw_fw_dma_abort(priv);
2936
2937         /*Disable the DMA in the CSR register */
2938         ipw_set_bit(priv, IPW_RESET_REG,
2939                     IPW_RESET_REG_MASTER_DISABLED | IPW_RESET_REG_STOP_MASTER);
2940
2941         IPW_DEBUG_FW("<< dmaWaitSync \n");
2942         return 0;
2943 }
2944
2945 static void ipw_remove_current_network(struct ipw_priv *priv)
2946 {
2947         struct list_head *element, *safe;
2948         struct ieee80211_network *network = NULL;
2949         unsigned long flags;
2950
2951         spin_lock_irqsave(&priv->ieee->lock, flags);
2952         list_for_each_safe(element, safe, &priv->ieee->network_list) {
2953                 network = list_entry(element, struct ieee80211_network, list);
2954                 if (!memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
2955                         list_del(element);
2956                         list_add_tail(&network->list,
2957                                       &priv->ieee->network_free_list);
2958                 }
2959         }
2960         spin_unlock_irqrestore(&priv->ieee->lock, flags);
2961 }
2962
2963 /**
2964  * Check that card is still alive.
2965  * Reads debug register from domain0.
2966  * If card is present, pre-defined value should
2967  * be found there.
2968  *
2969  * @param priv
2970  * @return 1 if card is present, 0 otherwise
2971  */
2972 static inline int ipw_alive(struct ipw_priv *priv)
2973 {
2974         return ipw_read32(priv, 0x90) == 0xd55555d5;
2975 }
2976
2977 /* timeout in msec, attempted in 10-msec quanta */
2978 static int ipw_poll_bit(struct ipw_priv *priv, u32 addr, u32 mask,
2979                                int timeout)
2980 {
2981         int i = 0;
2982
2983         do {
2984                 if ((ipw_read32(priv, addr) & mask) == mask)
2985                         return i;
2986                 mdelay(10);
2987                 i += 10;
2988         } while (i < timeout);
2989
2990         return -ETIME;
2991 }
2992
2993 /* These functions load the firmware and micro code for the operation of
2994  * the ipw hardware.  It assumes the buffer has all the bits for the
2995  * image and the caller is handling the memory allocation and clean up.
2996  */
2997
2998 static int ipw_stop_master(struct ipw_priv *priv)
2999 {
3000         int rc;
3001
3002         IPW_DEBUG_TRACE(">> \n");
3003         /* stop master. typical delay - 0 */
3004         ipw_set_bit(priv, IPW_RESET_REG, IPW_RESET_REG_STOP_MASTER);
3005
3006         /* timeout is in msec, polled in 10-msec quanta */
3007         rc = ipw_poll_bit(priv, IPW_RESET_REG,
3008                           IPW_RESET_REG_MASTER_DISABLED, 100);
3009         if (rc < 0) {
3010                 IPW_ERROR("wait for stop master failed after 100ms\n");
3011                 return -1;
3012         }
3013
3014         IPW_DEBUG_INFO("stop master %dms\n", rc);
3015
3016         return rc;
3017 }
3018
3019 static void ipw_arc_release(struct ipw_priv *priv)
3020 {
3021         IPW_DEBUG_TRACE(">> \n");
3022         mdelay(5);
3023
3024         ipw_clear_bit(priv, IPW_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
3025
3026         /* no one knows timing, for safety add some delay */
3027         mdelay(5);
3028 }
3029
3030 struct fw_chunk {
3031         __le32 address;
3032         __le32 length;
3033 };
3034
3035 static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
3036 {
3037         int rc = 0, i, addr;
3038         u8 cr = 0;
3039         __le16 *image;
3040
3041         image = (__le16 *) data;
3042
3043         IPW_DEBUG_TRACE(">> \n");
3044
3045         rc = ipw_stop_master(priv);
3046
3047         if (rc < 0)
3048                 return rc;
3049
3050         for (addr = IPW_SHARED_LOWER_BOUND;
3051              addr < IPW_REGISTER_DOMAIN1_END; addr += 4) {
3052                 ipw_write32(priv, addr, 0);
3053         }
3054
3055         /* no ucode (yet) */
3056         memset(&priv->dino_alive, 0, sizeof(priv->dino_alive));
3057         /* destroy DMA queues */
3058         /* reset sequence */
3059
3060         ipw_write_reg32(priv, IPW_MEM_HALT_AND_RESET, IPW_BIT_HALT_RESET_ON);
3061         ipw_arc_release(priv);
3062         ipw_write_reg32(priv, IPW_MEM_HALT_AND_RESET, IPW_BIT_HALT_RESET_OFF);
3063         mdelay(1);
3064
3065         /* reset PHY */
3066         ipw_write_reg32(priv, IPW_INTERNAL_CMD_EVENT, IPW_BASEBAND_POWER_DOWN);
3067         mdelay(1);
3068
3069         ipw_write_reg32(priv, IPW_INTERNAL_CMD_EVENT, 0);
3070         mdelay(1);
3071
3072         /* enable ucode store */
3073         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0x0);
3074         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, DINO_ENABLE_CS);
3075         mdelay(1);
3076
3077         /* write ucode */
3078         /**
3079          * @bug
3080          * Do NOT set indirect address register once and then
3081          * store data to indirect data register in the loop.
3082          * It seems very reasonable, but in this case DINO do not
3083          * accept ucode. It is essential to set address each time.
3084          */
3085         /* load new ipw uCode */
3086         for (i = 0; i < len / 2; i++)
3087                 ipw_write_reg16(priv, IPW_BASEBAND_CONTROL_STORE,
3088                                 le16_to_cpu(image[i]));
3089
3090         /* enable DINO */
3091         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0);
3092         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, DINO_ENABLE_SYSTEM);
3093
3094         /* this is where the igx / win driver deveates from the VAP driver. */
3095
3096         /* wait for alive response */
3097         for (i = 0; i < 100; i++) {
3098                 /* poll for incoming data */
3099                 cr = ipw_read_reg8(priv, IPW_BASEBAND_CONTROL_STATUS);
3100                 if (cr & DINO_RXFIFO_DATA)
3101                         break;
3102                 mdelay(1);
3103         }
3104
3105         if (cr & DINO_RXFIFO_DATA) {
3106                 /* alive_command_responce size is NOT multiple of 4 */
3107                 __le32 response_buffer[(sizeof(priv->dino_alive) + 3) / 4];
3108
3109                 for (i = 0; i < ARRAY_SIZE(response_buffer); i++)
3110                         response_buffer[i] =
3111                             cpu_to_le32(ipw_read_reg32(priv,
3112                                                        IPW_BASEBAND_RX_FIFO_READ));
3113                 memcpy(&priv->dino_alive, response_buffer,
3114                        sizeof(priv->dino_alive));
3115                 if (priv->dino_alive.alive_command == 1
3116                     && priv->dino_alive.ucode_valid == 1) {
3117                         rc = 0;
3118                         IPW_DEBUG_INFO
3119                             ("Microcode OK, rev. %d (0x%x) dev. %d (0x%x) "
3120                              "of %02d/%02d/%02d %02d:%02d\n",
3121                              priv->dino_alive.software_revision,
3122                              priv->dino_alive.software_revision,
3123                              priv->dino_alive.device_identifier,
3124                              priv->dino_alive.device_identifier,
3125                              priv->dino_alive.time_stamp[0],
3126                              priv->dino_alive.time_stamp[1],
3127                              priv->dino_alive.time_stamp[2],
3128                              priv->dino_alive.time_stamp[3],
3129                              priv->dino_alive.time_stamp[4]);
3130                 } else {
3131                         IPW_DEBUG_INFO("Microcode is not alive\n");
3132                         rc = -EINVAL;
3133                 }
3134         } else {
3135                 IPW_DEBUG_INFO("No alive response from DINO\n");
3136                 rc = -ETIME;
3137         }
3138
3139         /* disable DINO, otherwise for some reason
3140            firmware have problem getting alive resp. */
3141         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0);
3142
3143         return rc;
3144 }
3145
3146 static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
3147 {
3148         int rc = -1;
3149         int offset = 0;
3150         struct fw_chunk *chunk;
3151         dma_addr_t shared_phys;
3152         u8 *shared_virt;
3153
3154         IPW_DEBUG_TRACE("<< : \n");
3155         shared_virt = pci_alloc_consistent(priv->pci_dev, len, &shared_phys);
3156
3157         if (!shared_virt)
3158                 return -ENOMEM;
3159
3160         memmove(shared_virt, data, len);
3161
3162         /* Start the Dma */
3163         rc = ipw_fw_dma_enable(priv);
3164
3165         if (priv->sram_desc.last_cb_index > 0) {
3166                 /* the DMA is already ready this would be a bug. */
3167                 BUG();
3168                 goto out;
3169         }
3170
3171         do {
3172                 chunk = (struct fw_chunk *)(data + offset);
3173                 offset += sizeof(struct fw_chunk);
3174                 /* build DMA packet and queue up for sending */
3175                 /* dma to chunk->address, the chunk->length bytes from data +
3176                  * offeset*/
3177                 /* Dma loading */
3178                 rc = ipw_fw_dma_add_buffer(priv, shared_phys + offset,
3179                                            le32_to_cpu(chunk->address),
3180                                            le32_to_cpu(chunk->length));
3181                 if (rc) {
3182                         IPW_DEBUG_INFO("dmaAddBuffer Failed\n");
3183                         goto out;
3184                 }
3185
3186                 offset += le32_to_cpu(chunk->length);
3187         } while (offset < len);
3188
3189         /* Run the DMA and wait for the answer */
3190         rc = ipw_fw_dma_kick(priv);
3191         if (rc) {
3192                 IPW_ERROR("dmaKick Failed\n");
3193                 goto out;
3194         }
3195
3196         rc = ipw_fw_dma_wait(priv);
3197         if (rc) {
3198                 IPW_ERROR("dmaWaitSync Failed\n");
3199                 goto out;
3200         }
3201       out:
3202         pci_free_consistent(priv->pci_dev, len, shared_virt, shared_phys);
3203         return rc;
3204 }
3205
3206 /* stop nic */
3207 static int ipw_stop_nic(struct ipw_priv *priv)
3208 {
3209         int rc = 0;
3210
3211         /* stop */
3212         ipw_write32(priv, IPW_RESET_REG, IPW_RESET_REG_STOP_MASTER);
3213
3214         rc = ipw_poll_bit(priv, IPW_RESET_REG,
3215                           IPW_RESET_REG_MASTER_DISABLED, 500);
3216         if (rc < 0) {
3217                 IPW_ERROR("wait for reg master disabled failed after 500ms\n");
3218                 return rc;
3219         }
3220
3221         ipw_set_bit(priv, IPW_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
3222
3223         return rc;
3224 }
3225
3226 static void ipw_start_nic(struct ipw_priv *priv)
3227 {
3228         IPW_DEBUG_TRACE(">>\n");
3229
3230         /* prvHwStartNic  release ARC */
3231         ipw_clear_bit(priv, IPW_RESET_REG,
3232                       IPW_RESET_REG_MASTER_DISABLED |
3233                       IPW_RESET_REG_STOP_MASTER |
3234                       CBD_RESET_REG_PRINCETON_RESET);
3235
3236         /* enable power management */
3237         ipw_set_bit(priv, IPW_GP_CNTRL_RW,
3238                     IPW_GP_CNTRL_BIT_HOST_ALLOWS_STANDBY);
3239
3240         IPW_DEBUG_TRACE("<<\n");
3241 }
3242
3243 static int ipw_init_nic(struct ipw_priv *priv)
3244 {
3245         int rc;
3246
3247         IPW_DEBUG_TRACE(">>\n");
3248         /* reset */
3249         /*prvHwInitNic */
3250         /* set "initialization complete" bit to move adapter to D0 state */
3251         ipw_set_bit(priv, IPW_GP_CNTRL_RW, IPW_GP_CNTRL_BIT_INIT_DONE);
3252
3253         /* low-level PLL activation */
3254         ipw_write32(priv, IPW_READ_INT_REGISTER,
3255                     IPW_BIT_INT_HOST_SRAM_READ_INT_REGISTER);
3256
3257         /* wait for clock stabilization */
3258         rc = ipw_poll_bit(priv, IPW_GP_CNTRL_RW,
3259                           IPW_GP_CNTRL_BIT_CLOCK_READY, 250);
3260         if (rc < 0)
3261                 IPW_DEBUG_INFO("FAILED wait for clock stablization\n");
3262
3263         /* assert SW reset */
3264         ipw_set_bit(priv, IPW_RESET_REG, IPW_RESET_REG_SW_RESET);
3265
3266         udelay(10);
3267
3268         /* set "initialization complete" bit to move adapter to D0 state */
3269         ipw_set_bit(priv, IPW_GP_CNTRL_RW, IPW_GP_CNTRL_BIT_INIT_DONE);
3270
3271         IPW_DEBUG_TRACE(">>\n");
3272         return 0;
3273 }
3274
3275 /* Call this function from process context, it will sleep in request_firmware.
3276  * Probe is an ok place to call this from.
3277  */
3278 static int ipw_reset_nic(struct ipw_priv *priv)
3279 {
3280         int rc = 0;
3281         unsigned long flags;
3282
3283         IPW_DEBUG_TRACE(">>\n");
3284
3285         rc = ipw_init_nic(priv);
3286
3287         spin_lock_irqsave(&priv->lock, flags);
3288         /* Clear the 'host command active' bit... */
3289         priv->status &= ~STATUS_HCMD_ACTIVE;
3290         wake_up_interruptible(&priv->wait_command_queue);
3291         priv->status &= ~(STATUS_SCANNING | STATUS_SCAN_ABORTING);
3292         wake_up_interruptible(&priv->wait_state);
3293         spin_unlock_irqrestore(&priv->lock, flags);
3294
3295         IPW_DEBUG_TRACE("<<\n");
3296         return rc;
3297 }
3298
3299
3300 struct ipw_fw {
3301         __le32 ver;
3302         __le32 boot_size;
3303         __le32 ucode_size;
3304         __le32 fw_size;
3305         u8 data[0];
3306 };
3307
3308 static int ipw_get_fw(struct ipw_priv *priv,
3309                       const struct firmware **raw, const char *name)
3310 {
3311         struct ipw_fw *fw;
3312         int rc;
3313
3314         /* ask firmware_class module to get the boot firmware off disk */
3315         rc = request_firmware(raw, name, &priv->pci_dev->dev);
3316         if (rc < 0) {
3317                 IPW_ERROR("%s request_firmware failed: Reason %d\n", name, rc);
3318                 return rc;
3319         }
3320
3321         if ((*raw)->size < sizeof(*fw)) {
3322                 IPW_ERROR("%s is too small (%zd)\n", name, (*raw)->size);
3323                 return -EINVAL;
3324         }
3325
3326         fw = (void *)(*raw)->data;
3327
3328         if ((*raw)->size < sizeof(*fw) + le32_to_cpu(fw->boot_size) +
3329             le32_to_cpu(fw->ucode_size) + le32_to_cpu(fw->fw_size)) {
3330                 IPW_ERROR("%s is too small or corrupt (%zd)\n",
3331                           name, (*raw)->size);
3332                 return -EINVAL;
3333         }
3334
3335         IPW_DEBUG_INFO("Read firmware '%s' image v%d.%d (%zd bytes)\n",
3336                        name,
3337                        le32_to_cpu(fw->ver) >> 16,
3338                        le32_to_cpu(fw->ver) & 0xff,
3339                        (*raw)->size - sizeof(*fw));
3340         return 0;
3341 }
3342
3343 #define IPW_RX_BUF_SIZE (3000)
3344
3345 static void ipw_rx_queue_reset(struct ipw_priv *priv,
3346                                       struct ipw_rx_queue *rxq)
3347 {
3348         unsigned long flags;
3349         int i;
3350
3351         spin_lock_irqsave(&rxq->lock, flags);
3352
3353         INIT_LIST_HEAD(&rxq->rx_free);
3354         INIT_LIST_HEAD(&rxq->rx_used);
3355
3356         /* Fill the rx_used queue with _all_ of the Rx buffers */
3357         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
3358                 /* In the reset function, these buffers may have been allocated
3359                  * to an SKB, so we need to unmap and free potential storage */
3360                 if (rxq->pool[i].skb != NULL) {
3361                         pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
3362                                          IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
3363                         dev_kfree_skb(rxq->pool[i].skb);
3364                         rxq->pool[i].skb = NULL;
3365                 }
3366                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
3367         }
3368
3369         /* Set us so that we have processed and used all buffers, but have
3370          * not restocked the Rx queue with fresh buffers */
3371         rxq->read = rxq->write = 0;
3372         rxq->free_count = 0;
3373         spin_unlock_irqrestore(&rxq->lock, flags);
3374 }
3375
3376 #ifdef CONFIG_PM
3377 static int fw_loaded = 0;
3378 static const struct firmware *raw = NULL;
3379
3380 static void free_firmware(void)
3381 {
3382         if (fw_loaded) {
3383                 release_firmware(raw);
3384                 raw = NULL;
3385                 fw_loaded = 0;
3386         }
3387 }
3388 #else
3389 #define free_firmware() do {} while (0)
3390 #endif
3391
3392 static int ipw_load(struct ipw_priv *priv)
3393 {
3394 #ifndef CONFIG_PM
3395         const struct firmware *raw = NULL;
3396 #endif
3397         struct ipw_fw *fw;
3398         u8 *boot_img, *ucode_img, *fw_img;
3399         u8 *name = NULL;
3400         int rc = 0, retries = 3;
3401
3402         switch (priv->ieee->iw_mode) {
3403         case IW_MODE_ADHOC:
3404                 name = "ipw2200-ibss.fw";
3405                 break;
3406 #ifdef CONFIG_IPW2200_MONITOR
3407         case IW_MODE_MONITOR:
3408                 name = "ipw2200-sniffer.fw";
3409                 break;
3410 #endif
3411         case IW_MODE_INFRA:
3412                 name = "ipw2200-bss.fw";
3413                 break;
3414         }
3415
3416         if (!name) {
3417                 rc = -EINVAL;
3418                 goto error;
3419         }
3420
3421 #ifdef CONFIG_PM
3422         if (!fw_loaded) {
3423 #endif
3424                 rc = ipw_get_fw(priv, &raw, name);
3425                 if (rc < 0)
3426                         goto error;
3427 #ifdef CONFIG_PM
3428         }
3429 #endif
3430
3431         fw = (void *)raw->data;
3432         boot_img = &fw->data[0];
3433         ucode_img = &fw->data[le32_to_cpu(fw->boot_size)];
3434         fw_img = &fw->data[le32_to_cpu(fw->boot_size) +
3435                            le32_to_cpu(fw->ucode_size)];
3436
3437         if (rc < 0)
3438                 goto error;
3439
3440         if (!priv->rxq)
3441                 priv->rxq = ipw_rx_queue_alloc(priv);
3442         else
3443                 ipw_rx_queue_reset(priv, priv->rxq);
3444         if (!priv->rxq) {
3445                 IPW_ERROR("Unable to initialize Rx queue\n");
3446                 goto error;
3447         }
3448
3449       retry:
3450         /* Ensure interrupts are disabled */
3451         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
3452         priv->status &= ~STATUS_INT_ENABLED;
3453
3454         /* ack pending interrupts */
3455         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3456
3457         ipw_stop_nic(priv);
3458
3459         rc = ipw_reset_nic(priv);
3460         if (rc < 0) {
3461                 IPW_ERROR("Unable to reset NIC\n");
3462                 goto error;
3463         }
3464
3465         ipw_zero_memory(priv, IPW_NIC_SRAM_LOWER_BOUND,
3466                         IPW_NIC_SRAM_UPPER_BOUND - IPW_NIC_SRAM_LOWER_BOUND);
3467
3468         /* DMA the initial boot firmware into the device */
3469         rc = ipw_load_firmware(priv, boot_img, le32_to_cpu(fw->boot_size));
3470         if (rc < 0) {
3471                 IPW_ERROR("Unable to load boot firmware: %d\n", rc);
3472                 goto error;
3473         }
3474
3475         /* kick start the device */
3476         ipw_start_nic(priv);
3477
3478         /* wait for the device to finish its initial startup sequence */
3479         rc = ipw_poll_bit(priv, IPW_INTA_RW,
3480                           IPW_INTA_BIT_FW_INITIALIZATION_DONE, 500);
3481         if (rc < 0) {
3482                 IPW_ERROR("device failed to boot initial fw image\n");
3483                 goto error;
3484         }
3485         IPW_DEBUG_INFO("initial device response after %dms\n", rc);
3486
3487         /* ack fw init done interrupt */
3488         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
3489
3490         /* DMA the ucode into the device */
3491         rc = ipw_load_ucode(priv, ucode_img, le32_to_cpu(fw->ucode_size));
3492         if (rc < 0) {
3493                 IPW_ERROR("Unable to load ucode: %d\n", rc);
3494                 goto error;
3495         }
3496
3497         /* stop nic */
3498         ipw_stop_nic(priv);
3499
3500         /* DMA bss firmware into the device */
3501         rc = ipw_load_firmware(priv, fw_img, le32_to_cpu(fw->fw_size));
3502         if (rc < 0) {
3503                 IPW_ERROR("Unable to load firmware: %d\n", rc);
3504                 goto error;
3505         }
3506 #ifdef CONFIG_PM
3507         fw_loaded = 1;
3508 #endif
3509
3510         ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
3511
3512         rc = ipw_queue_reset(priv);
3513         if (rc < 0) {
3514                 IPW_ERROR("Unable to initialize queues\n");
3515                 goto error;
3516         }
3517
3518         /* Ensure interrupts are disabled */
3519         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
3520         /* ack pending interrupts */
3521         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3522
3523         /* kick start the device */
3524         ipw_start_nic(priv);
3525
3526         if (ipw_read32(priv, IPW_INTA_RW) & IPW_INTA_BIT_PARITY_ERROR) {
3527                 if (retries > 0) {
3528                         IPW_WARNING("Parity error.  Retrying init.\n");
3529                         retries--;
3530                         goto retry;
3531                 }
3532
3533                 IPW_ERROR("TODO: Handle parity error -- schedule restart?\n");
3534                 rc = -EIO;
3535                 goto error;
3536         }
3537
3538         /* wait for the device */
3539         rc = ipw_poll_bit(priv, IPW_INTA_RW,
3540                           IPW_INTA_BIT_FW_INITIALIZATION_DONE, 500);
3541         if (rc < 0) {
3542                 IPW_ERROR("device failed to start within 500ms\n");
3543                 goto error;
3544         }
3545         IPW_DEBUG_INFO("device response after %dms\n", rc);
3546
3547         /* ack fw init done interrupt */
3548         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
3549
3550         /* read eeprom data and initialize the eeprom region of sram */
3551         priv->eeprom_delay = 1;
3552         ipw_eeprom_init_sram(priv);
3553
3554         /* enable interrupts */
3555         ipw_enable_interrupts(priv);
3556
3557         /* Ensure our queue has valid packets */
3558         ipw_rx_queue_replenish(priv);
3559
3560         ipw_write32(priv, IPW_RX_READ_INDEX, priv->rxq->read);
3561
3562         /* ack pending interrupts */
3563         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3564
3565 #ifndef CONFIG_PM
3566         release_firmware(raw);
3567 #endif
3568         return 0;
3569
3570       error:
3571         if (priv->rxq) {
3572                 ipw_rx_queue_free(priv, priv->rxq);
3573                 priv->rxq = NULL;
3574         }
3575         ipw_tx_queue_free(priv);
3576         if (raw)
3577                 release_firmware(raw);
3578 #ifdef CONFIG_PM
3579         fw_loaded = 0;
3580         raw = NULL;
3581 #endif
3582
3583         return rc;
3584 }
3585
3586 /**
3587  * DMA services
3588  *
3589  * Theory of operation
3590  *
3591  * A queue is a circular buffers with 'Read' and 'Write' pointers.
3592  * 2 empty entries always kept in the buffer to protect from overflow.
3593  *
3594  * For Tx queue, there are low mark and high mark limits. If, after queuing
3595  * the packet for Tx, free space become < low mark, Tx queue stopped. When
3596  * reclaiming packets (on 'tx done IRQ), if free space become > high mark,
3597  * Tx queue resumed.
3598  *
3599  * The IPW operates with six queues, one receive queue in the device's
3600  * sram, one transmit queue for sending commands to the device firmware,
3601  * and four transmit queues for data.
3602  *
3603  * The four transmit queues allow for performing quality of service (qos)
3604  * transmissions as per the 802.11 protocol.  Currently Linux does not
3605  * provide a mechanism to the user for utilizing prioritized queues, so
3606  * we only utilize the first data transmit queue (queue1).
3607  */
3608
3609 /**
3610  * Driver allocates buffers of this size for Rx
3611  */
3612
3613 /**
3614  * ipw_rx_queue_space - Return number of free slots available in queue.
3615  */
3616 static int ipw_rx_queue_space(const struct ipw_rx_queue *q)
3617 {
3618         int s = q->read - q->write;
3619         if (s <= 0)
3620                 s += RX_QUEUE_SIZE;
3621         /* keep some buffer to not confuse full and empty queue */
3622         s -= 2;
3623         if (s < 0)
3624                 s = 0;
3625         return s;
3626 }
3627
3628 static inline int ipw_tx_queue_space(const struct clx2_queue *q)
3629 {
3630         int s = q->last_used - q->first_empty;
3631         if (s <= 0)
3632                 s += q->n_bd;
3633         s -= 2;                 /* keep some reserve to not confuse empty and full situations */
3634         if (s < 0)
3635                 s = 0;
3636         return s;
3637 }
3638
3639 static inline int ipw_queue_inc_wrap(int index, int n_bd)
3640 {
3641         return (++index == n_bd) ? 0 : index;
3642 }
3643
3644 /**
3645  * Initialize common DMA queue structure
3646  *
3647  * @param q                queue to init
3648  * @param count            Number of BD's to allocate. Should be power of 2
3649  * @param read_register    Address for 'read' register
3650  *                         (not offset within BAR, full address)
3651  * @param write_register   Address for 'write' register
3652  *                         (not offset within BAR, full address)
3653  * @param base_register    Address for 'base' register
3654  *                         (not offset within BAR, full address)
3655  * @param size             Address for 'size' register
3656  *                         (not offset within BAR, full address)
3657  */
3658 static void ipw_queue_init(struct ipw_priv *priv, struct clx2_queue *q,
3659                            int count, u32 read, u32 write, u32 base, u32 size)
3660 {
3661         q->n_bd = count;
3662
3663         q->low_mark = q->n_bd / 4;
3664         if (q->low_mark < 4)
3665                 q->low_mark = 4;
3666
3667         q->high_mark = q->n_bd / 8;
3668         if (q->high_mark < 2)
3669                 q->high_mark = 2;
3670
3671         q->first_empty = q->last_used = 0;
3672         q->reg_r = read;
3673         q->reg_w = write;
3674
3675         ipw_write32(priv, base, q->dma_addr);
3676         ipw_write32(priv, size, count);
3677         ipw_write32(priv, read, 0);
3678         ipw_write32(priv, write, 0);
3679
3680         _ipw_read32(priv, 0x90);
3681 }
3682
3683 static int ipw_queue_tx_init(struct ipw_priv *priv,
3684                              struct clx2_tx_queue *q,
3685                              int count, u32 read, u32 write, u32 base, u32 size)
3686 {
3687         struct pci_dev *dev = priv->pci_dev;
3688
3689         q->txb = kmalloc(sizeof(q->txb[0]) * count, GFP_KERNEL);
3690         if (!q->txb) {
3691                 IPW_ERROR("vmalloc for auxilary BD structures failed\n");
3692                 return -ENOMEM;
3693         }
3694
3695         q->bd =
3696             pci_alloc_consistent(dev, sizeof(q->bd[0]) * count, &q->q.dma_addr);
3697         if (!q->bd) {
3698                 IPW_ERROR("pci_alloc_consistent(%zd) failed\n",
3699                           sizeof(q->bd[0]) * count);
3700                 kfree(q->txb);
3701                 q->txb = NULL;
3702                 return -ENOMEM;
3703         }
3704
3705         ipw_queue_init(priv, &q->q, count, read, write, base, size);
3706         return 0;
3707 }
3708
3709 /**
3710  * Free one TFD, those at index [txq->q.last_used].
3711  * Do NOT advance any indexes
3712  *
3713  * @param dev
3714  * @param txq
3715  */
3716 static void ipw_queue_tx_free_tfd(struct ipw_priv *priv,
3717                                   struct clx2_tx_queue *txq)
3718 {
3719         struct tfd_frame *bd = &txq->bd[txq->q.last_used];
3720         struct pci_dev *dev = priv->pci_dev;
3721         int i;
3722
3723         /* classify bd */
3724         if (bd->control_flags.message_type == TX_HOST_COMMAND_TYPE)
3725                 /* nothing to cleanup after for host commands */
3726                 return;
3727
3728         /* sanity check */
3729         if (le32_to_cpu(bd->u.data.num_chunks) > NUM_TFD_CHUNKS) {
3730                 IPW_ERROR("Too many chunks: %i\n",
3731                           le32_to_cpu(bd->u.data.num_chunks));
3732                 /** @todo issue fatal error, it is quite serious situation */
3733                 return;
3734         }
3735
3736         /* unmap chunks if any */
3737         for (i = 0; i < le32_to_cpu(bd->u.data.num_chunks); i++) {
3738                 pci_unmap_single(dev, le32_to_cpu(bd->u.data.chunk_ptr[i]),
3739                                  le16_to_cpu(bd->u.data.chunk_len[i]),
3740                                  PCI_DMA_TODEVICE);
3741                 if (txq->txb[txq->q.last_used]) {
3742                         ieee80211_txb_free(txq->txb[txq->q.last_used]);
3743                         txq->txb[txq->q.last_used] = NULL;
3744                 }
3745         }
3746 }
3747
3748 /**
3749  * Deallocate DMA queue.
3750  *
3751  * Empty queue by removing and destroying all BD's.
3752  * Free all buffers.
3753  *
3754  * @param dev
3755  * @param q
3756  */
3757 static void ipw_queue_tx_free(struct ipw_priv *priv, struct clx2_tx_queue *txq)
3758 {
3759         struct clx2_queue *q = &txq->q;
3760         struct pci_dev *dev = priv->pci_dev;
3761
3762         if (q->n_bd == 0)
3763                 return;
3764
3765         /* first, empty all BD's */
3766         for (; q->first_empty != q->last_used;
3767              q->last_used = ipw_queue_inc_wrap(q->last_used, q->n_bd)) {
3768                 ipw_queue_tx_free_tfd(priv, txq);
3769         }
3770
3771         /* free buffers belonging to queue itself */
3772         pci_free_consistent(dev, sizeof(txq->bd[0]) * q->n_bd, txq->bd,
3773                             q->dma_addr);
3774         kfree(txq->txb);
3775
3776         /* 0 fill whole structure */
3777         memset(txq, 0, sizeof(*txq));
3778 }
3779
3780 /**
3781  * Destroy all DMA queues and structures
3782  *
3783  * @param priv
3784  */
3785 static void ipw_tx_queue_free(struct ipw_priv *priv)
3786 {
3787         /* Tx CMD queue */
3788         ipw_queue_tx_free(priv, &priv->txq_cmd);
3789
3790         /* Tx queues */
3791         ipw_queue_tx_free(priv, &priv->txq[0]);
3792         ipw_queue_tx_free(priv, &priv->txq[1]);
3793         ipw_queue_tx_free(priv, &priv->txq[2]);
3794         ipw_queue_tx_free(priv, &priv->txq[3]);
3795 }
3796
3797 static void ipw_create_bssid(struct ipw_priv *priv, u8 * bssid)
3798 {
3799         /* First 3 bytes are manufacturer */
3800         bssid[0] = priv->mac_addr[0];
3801         bssid[1] = priv->mac_addr[1];
3802         bssid[2] = priv->mac_addr[2];
3803
3804         /* Last bytes are random */
3805         get_random_bytes(&bssid[3], ETH_ALEN - 3);
3806
3807         bssid[0] &= 0xfe;       /* clear multicast bit */
3808         bssid[0] |= 0x02;       /* set local assignment bit (IEEE802) */
3809 }
3810
3811 static u8 ipw_add_station(struct ipw_priv *priv, u8 * bssid)
3812 {
3813         struct ipw_station_entry entry;
3814         int i;
3815
3816         for (i = 0; i < priv->num_stations; i++) {
3817                 if (!memcmp(priv->stations[i], bssid, ETH_ALEN)) {
3818                         /* Another node is active in network */
3819                         priv->missed_adhoc_beacons = 0;
3820                         if (!(priv->config & CFG_STATIC_CHANNEL))
3821                                 /* when other nodes drop out, we drop out */
3822                                 priv->config &= ~CFG_ADHOC_PERSIST;
3823
3824                         return i;
3825                 }
3826         }
3827
3828         if (i == MAX_STATIONS)
3829                 return IPW_INVALID_STATION;
3830
3831         IPW_DEBUG_SCAN("Adding AdHoc station: %pM\n", bssid);
3832
3833         entry.reserved = 0;
3834         entry.support_mode = 0;
3835         memcpy(entry.mac_addr, bssid, ETH_ALEN);
3836         memcpy(priv->stations[i], bssid, ETH_ALEN);
3837         ipw_write_direct(priv, IPW_STATION_TABLE_LOWER + i * sizeof(entry),
3838                          &entry, sizeof(entry));
3839         priv->num_stations++;
3840
3841         return i;
3842 }
3843
3844 static u8 ipw_find_station(struct ipw_priv *priv, u8 * bssid)
3845 {
3846         int i;
3847
3848         for (i = 0; i < priv->num_stations; i++)
3849                 if (!memcmp(priv->stations[i], bssid, ETH_ALEN))
3850                         return i;
3851
3852         return IPW_INVALID_STATION;
3853 }
3854
3855 static void ipw_send_disassociate(struct ipw_priv *priv, int quiet)
3856 {
3857         int err;
3858
3859         if (priv->status & STATUS_ASSOCIATING) {
3860                 IPW_DEBUG_ASSOC("Disassociating while associating.\n");
3861                 queue_work(priv->workqueue, &priv->disassociate);
3862                 return;
3863         }
3864
3865         if (!(priv->status & STATUS_ASSOCIATED)) {
3866                 IPW_DEBUG_ASSOC("Disassociating while not associated.\n");
3867                 return;
3868         }
3869
3870         IPW_DEBUG_ASSOC("Disassocation attempt from %pM "
3871                         "on channel %d.\n",
3872                         priv->assoc_request.bssid,
3873                         priv->assoc_request.channel);
3874
3875         priv->status &= ~(STATUS_ASSOCIATING | STATUS_ASSOCIATED);
3876         priv->status |= STATUS_DISASSOCIATING;
3877
3878         if (quiet)
3879                 priv->assoc_request.assoc_type = HC_DISASSOC_QUIET;
3880         else
3881                 priv->assoc_request.assoc_type = HC_DISASSOCIATE;
3882
3883         err = ipw_send_associate(priv, &priv->assoc_request);
3884         if (err) {
3885                 IPW_DEBUG_HC("Attempt to send [dis]associate command "
3886                              "failed.\n");
3887                 return;
3888         }
3889
3890 }
3891
3892 static int ipw_disassociate(void *data)
3893 {
3894         struct ipw_priv *priv = data;
3895         if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)))
3896                 return 0;
3897         ipw_send_disassociate(data, 0);
3898         return 1;
3899 }
3900
3901 static void ipw_bg_disassociate(struct work_struct *work)
3902 {
3903         struct ipw_priv *priv =
3904                 container_of(work, struct ipw_priv, disassociate);
3905         mutex_lock(&priv->mutex);
3906         ipw_disassociate(priv);
3907         mutex_unlock(&priv->mutex);
3908 }
3909
3910 static void ipw_system_config(struct work_struct *work)
3911 {
3912         struct ipw_priv *priv =
3913                 container_of(work, struct ipw_priv, system_config);
3914
3915 #ifdef CONFIG_IPW2200_PROMISCUOUS
3916         if (priv->prom_net_dev && netif_running(priv->prom_net_dev)) {
3917                 priv->sys_config.accept_all_data_frames = 1;
3918                 priv->sys_config.accept_non_directed_frames = 1;
3919                 priv->sys_config.accept_all_mgmt_bcpr = 1;
3920                 priv->sys_config.accept_all_mgmt_frames = 1;
3921         }
3922 #endif
3923
3924         ipw_send_system_config(priv);
3925 }
3926
3927 struct ipw_status_code {
3928         u16 status;
3929         const char *reason;
3930 };
3931
3932 static const struct ipw_status_code ipw_status_codes[] = {
3933         {0x00, "Successful"},
3934         {0x01, "Unspecified failure"},
3935         {0x0A, "Cannot support all requested capabilities in the "
3936          "Capability information field"},
3937         {0x0B, "Reassociation denied due to inability to confirm that "
3938          "association exists"},
3939         {0x0C, "Association denied due to reason outside the scope of this "
3940          "standard"},
3941         {0x0D,
3942          "Responding station does not support the specified authentication "
3943          "algorithm"},
3944         {0x0E,
3945          "Received an Authentication frame with authentication sequence "
3946          "transaction sequence number out of expected sequence"},
3947         {0x0F, "Authentication rejected because of challenge failure"},
3948         {0x10, "Authentication rejected due to timeout waiting for next "
3949          "frame in sequence"},
3950         {0x11, "Association denied because AP is unable to handle additional "
3951          "associated stations"},
3952         {0x12,
3953          "Association denied due to requesting station not supporting all "
3954          "of the datarates in the BSSBasicServiceSet Parameter"},
3955         {0x13,
3956          "Association denied due to requesting station not supporting "
3957          "short preamble operation"},
3958         {0x14,
3959          "Association denied due to requesting station not supporting "
3960          "PBCC encoding"},
3961         {0x15,
3962          "Association denied due to requesting station not supporting "
3963          "channel agility"},
3964         {0x19,
3965          "Association denied due to requesting station not supporting "
3966          "short slot operation"},
3967         {0x1A,
3968          "Association denied due to requesting station not supporting "
3969          "DSSS-OFDM operation"},
3970         {0x28, "Invalid Information Element"},
3971         {0x29, "Group Cipher is not valid"},
3972         {0x2A, "Pairwise Cipher is not valid"},
3973         {0x2B, "AKMP is not valid"},
3974         {0x2C, "Unsupported RSN IE version"},
3975         {0x2D, "Invalid RSN IE Capabilities"},
3976         {0x2E, "Cipher suite is rejected per security policy"},
3977 };
3978
3979 static const char *ipw_get_status_code(u16 status)
3980 {
3981         int i;
3982         for (i = 0; i < ARRAY_SIZE(ipw_status_codes); i++)
3983                 if (ipw_status_codes[i].status == (status & 0xff))
3984                         return ipw_status_codes[i].reason;
3985         return "Unknown status value.";
3986 }
3987
3988 static void inline average_init(struct average *avg)
3989 {
3990         memset(avg, 0, sizeof(*avg));
3991 }
3992
3993 #define DEPTH_RSSI 8
3994 #define DEPTH_NOISE 16
3995 static s16 exponential_average(s16 prev_avg, s16 val, u8 depth)
3996 {
3997         return ((depth-1)*prev_avg +  val)/depth;
3998 }
3999
4000 static void average_add(struct average *avg, s16 val)
4001 {
4002         avg->sum -= avg->entries[avg->pos];
4003         avg->sum += val;
4004         avg->entries[avg->pos++] = val;
4005         if (unlikely(avg->pos == AVG_ENTRIES)) {
4006                 avg->init = 1;
4007                 avg->pos = 0;
4008         }
4009 }
4010
4011 static s16 average_value(struct average *avg)
4012 {
4013         if (!unlikely(avg->init)) {
4014                 if (avg->pos)
4015                         return avg->sum / avg->pos;
4016                 return 0;
4017         }
4018
4019         return avg->sum / AVG_ENTRIES;
4020 }
4021
4022 static void ipw_reset_stats(struct ipw_priv *priv)
4023 {
4024         u32 len = sizeof(u32);
4025
4026         priv->quality = 0;
4027
4028         average_init(&priv->average_missed_beacons);
4029         priv->exp_avg_rssi = -60;
4030         priv->exp_avg_noise = -85 + 0x100;
4031
4032         priv->last_rate = 0;
4033         priv->last_missed_beacons = 0;
4034         priv->last_rx_packets = 0;
4035         priv->last_tx_packets = 0;
4036         priv->last_tx_failures = 0;
4037
4038         /* Firmware managed, reset only when NIC is restarted, so we have to
4039          * normalize on the current value */
4040         ipw_get_ordinal(priv, IPW_ORD_STAT_RX_ERR_CRC,
4041                         &priv->last_rx_err, &len);
4042         ipw_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURE,
4043                         &priv->last_tx_failures, &len);
4044
4045         /* Driver managed, reset with each association */
4046         priv->missed_adhoc_beacons = 0;
4047         priv->missed_beacons = 0;
4048         priv->tx_packets = 0;
4049         priv->rx_packets = 0;
4050
4051 }
4052
4053 static u32 ipw_get_max_rate(struct ipw_priv *priv)
4054 {
4055         u32 i = 0x80000000;
4056         u32 mask = priv->rates_mask;
4057         /* If currently associated in B mode, restrict the maximum
4058          * rate match to B rates */
4059         if (priv->assoc_request.ieee_mode == IPW_B_MODE)
4060                 mask &= IEEE80211_CCK_RATES_MASK;
4061
4062         /* TODO: Verify that the rate is supported by the current rates
4063          * list. */
4064
4065         while (i && !(mask & i))
4066                 i >>= 1;
4067         switch (i) {
4068         case IEEE80211_CCK_RATE_1MB_MASK:
4069                 return 1000000;
4070         case IEEE80211_CCK_RATE_2MB_MASK:
4071                 return 2000000;
4072         case IEEE80211_CCK_RATE_5MB_MASK:
4073                 return 5500000;
4074         case IEEE80211_OFDM_RATE_6MB_MASK:
4075                 return 6000000;
4076         case IEEE80211_OFDM_RATE_9MB_MASK:
4077                 return 9000000;
4078         case IEEE80211_CCK_RATE_11MB_MASK:
4079                 return 11000000;
4080         case IEEE80211_OFDM_RATE_12MB_MASK:
4081                 return 12000000;
4082         case IEEE80211_OFDM_RATE_18MB_MASK:
4083                 return 18000000;
4084         case IEEE80211_OFDM_RATE_24MB_MASK:
4085                 return 24000000;
4086         case IEEE80211_OFDM_RATE_36MB_MASK:
4087                 return 36000000;
4088         case IEEE80211_OFDM_RATE_48MB_MASK:
4089                 return 48000000;
4090         case IEEE80211_OFDM_RATE_54MB_MASK:
4091                 return 54000000;
4092         }
4093
4094         if (priv->ieee->mode == IEEE_B)
4095                 return 11000000;
4096         else
4097                 return 54000000;
4098 }
4099
4100 static u32 ipw_get_current_rate(struct ipw_priv *priv)
4101 {
4102         u32 rate, len = sizeof(rate);
4103         int err;
4104
4105         if (!(priv->status & STATUS_ASSOCIATED))
4106                 return 0;
4107
4108         if (priv->tx_packets > IPW_REAL_RATE_RX_PACKET_THRESHOLD) {
4109                 err = ipw_get_ordinal(priv, IPW_ORD_STAT_TX_CURR_RATE, &rate,
4110                                       &len);
4111                 if (err) {
4112                         IPW_DEBUG_INFO("failed querying ordinals.\n");
4113                         return 0;
4114                 }
4115         } else
4116                 return ipw_get_max_rate(priv);
4117
4118         switch (rate) {
4119         case IPW_TX_RATE_1MB:
4120                 return 1000000;
4121         case IPW_TX_RATE_2MB:
4122                 return 2000000;
4123         case IPW_TX_RATE_5MB:
4124                 return 5500000;
4125         case IPW_TX_RATE_6MB:
4126                 return 6000000;
4127         case IPW_TX_RATE_9MB:
4128                 return 9000000;
4129         case IPW_TX_RATE_11MB:
4130                 return 11000000;
4131         case IPW_TX_RATE_12MB:
4132                 return 12000000;
4133         case IPW_TX_RATE_18MB:
4134                 return 18000000;
4135         case IPW_TX_RATE_24MB:
4136                 return 24000000;
4137         case IPW_TX_RATE_36MB:
4138                 return 36000000;
4139         case IPW_TX_RATE_48MB:
4140                 return 48000000;
4141         case IPW_TX_RATE_54MB:
4142                 return 54000000;
4143         }
4144
4145         return 0;
4146 }
4147
4148 #define IPW_STATS_INTERVAL (2 * HZ)
4149 static void ipw_gather_stats(struct ipw_priv *priv)
4150 {
4151         u32 rx_err, rx_err_delta, rx_packets_delta;
4152         u32 tx_failures, tx_failures_delta, tx_packets_delta;
4153         u32 missed_beacons_percent, missed_beacons_delta;
4154         u32 quality = 0;
4155         u32 len = sizeof(u32);
4156         s16 rssi;
4157         u32 beacon_quality, signal_quality, tx_quality, rx_quality,
4158             rate_quality;
4159         u32 max_rate;
4160
4161         if (!(priv->status & STATUS_ASSOCIATED)) {
4162                 priv->quality = 0;
4163                 return;
4164         }
4165
4166         /* Update the statistics */
4167         ipw_get_ordinal(priv, IPW_ORD_STAT_MISSED_BEACONS,
4168                         &priv->missed_beacons, &len);
4169         missed_beacons_delta = priv->missed_beacons - priv->last_missed_beacons;
4170         priv->last_missed_beacons = priv->missed_beacons;
4171         if (priv->assoc_request.beacon_interval) {
4172                 missed_beacons_percent = missed_beacons_delta *
4173                     (HZ * le16_to_cpu(priv->assoc_request.beacon_interval)) /
4174                     (IPW_STATS_INTERVAL * 10);
4175         } else {
4176                 missed_beacons_percent = 0;
4177         }
4178         average_add(&priv->average_missed_beacons, missed_beacons_percent);
4179
4180         ipw_get_ordinal(priv, IPW_ORD_STAT_RX_ERR_CRC, &rx_err, &len);
4181         rx_err_delta = rx_err - priv->last_rx_err;
4182         priv->last_rx_err = rx_err;
4183
4184         ipw_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURE, &tx_failures, &len);
4185         tx_failures_delta = tx_failures - priv->last_tx_failures;
4186         priv->last_tx_failures = tx_failures;
4187
4188         rx_packets_delta = priv->rx_packets - priv->last_rx_packets;
4189         priv->last_rx_packets = priv->rx_packets;
4190
4191         tx_packets_delta = priv->tx_packets - priv->last_tx_packets;
4192         priv->last_tx_packets = priv->tx_packets;
4193
4194         /* Calculate quality based on the following:
4195          *
4196          * Missed beacon: 100% = 0, 0% = 70% missed
4197          * Rate: 60% = 1Mbs, 100% = Max
4198          * Rx and Tx errors represent a straight % of total Rx/Tx
4199          * RSSI: 100% = > -50,  0% = < -80
4200          * Rx errors: 100% = 0, 0% = 50% missed
4201          *
4202          * The lowest computed quality is used.
4203          *
4204          */
4205 #define BEACON_THRESHOLD 5
4206         beacon_quality = 100 - missed_beacons_percent;
4207         if (beacon_quality < BEACON_THRESHOLD)
4208                 beacon_quality = 0;
4209         else
4210                 beacon_quality = (beacon_quality - BEACON_THRESHOLD) * 100 /
4211                     (100 - BEACON_THRESHOLD);
4212         IPW_DEBUG_STATS("Missed beacon: %3d%% (%d%%)\n",
4213                         beacon_quality, missed_beacons_percent);
4214
4215         priv->last_rate = ipw_get_current_rate(priv);
4216         max_rate = ipw_get_max_rate(priv);
4217         rate_quality = priv->last_rate * 40 / max_rate + 60;
4218         IPW_DEBUG_STATS("Rate quality : %3d%% (%dMbs)\n",
4219                         rate_quality, priv->last_rate / 1000000);
4220
4221         if (rx_packets_delta > 100 && rx_packets_delta + rx_err_delta)
4222                 rx_quality = 100 - (rx_err_delta * 100) /
4223                     (rx_packets_delta + rx_err_delta);
4224         else
4225                 rx_quality = 100;
4226         IPW_DEBUG_STATS("Rx quality   : %3d%% (%u errors, %u packets)\n",
4227                         rx_quality, rx_err_delta, rx_packets_delta);
4228
4229         if (tx_packets_delta > 100 && tx_packets_delta + tx_failures_delta)
4230                 tx_quality = 100 - (tx_failures_delta * 100) /
4231                     (tx_packets_delta + tx_failures_delta);
4232         else
4233                 tx_quality = 100;
4234         IPW_DEBUG_STATS("Tx quality   : %3d%% (%u errors, %u packets)\n",
4235                         tx_quality, tx_failures_delta, tx_packets_delta);
4236
4237         rssi = priv->exp_avg_rssi;
4238         signal_quality =
4239             (100 *
4240              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) *
4241              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) -
4242              (priv->ieee->perfect_rssi - rssi) *
4243              (15 * (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) +
4244               62 * (priv->ieee->perfect_rssi - rssi))) /
4245             ((priv->ieee->perfect_rssi - priv->ieee->worst_rssi) *
4246              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi));
4247         if (signal_quality > 100)
4248                 signal_quality = 100;
4249         else if (signal_quality < 1)
4250                 signal_quality = 0;
4251
4252         IPW_DEBUG_STATS("Signal level : %3d%% (%d dBm)\n",
4253                         signal_quality, rssi);
4254
4255         quality = min(beacon_quality,
4256                       min(rate_quality,
4257                           min(tx_quality, min(rx_quality, signal_quality))));
4258         if (quality == beacon_quality)
4259                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to missed beacons.\n",
4260                                 quality);
4261         if (quality == rate_quality)
4262                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to rate quality.\n",
4263                                 quality);
4264         if (quality == tx_quality)
4265                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to Tx quality.\n",
4266                                 quality);
4267         if (quality == rx_quality)
4268                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to Rx quality.\n",
4269                                 quality);
4270         if (quality == signal_quality)
4271                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to signal quality.\n",
4272                                 quality);
4273
4274         priv->quality = quality;
4275
4276         queue_delayed_work(priv->workqueue, &priv->gather_stats,
4277                            IPW_STATS_INTERVAL);
4278 }
4279
4280 static void ipw_bg_gather_stats(struct work_struct *work)
4281 {
4282         struct ipw_priv *priv =
4283                 container_of(work, struct ipw_priv, gather_stats.work);
4284         mutex_lock(&priv->mutex);
4285         ipw_gather_stats(priv);
4286         mutex_unlock(&priv->mutex);
4287 }
4288
4289 /* Missed beacon behavior:
4290  * 1st missed -> roaming_threshold, just wait, don't do any scan/roam.
4291  * roaming_threshold -> disassociate_threshold, scan and roam for better signal.
4292  * Above disassociate threshold, give up and stop scanning.
4293  * Roaming is disabled if disassociate_threshold <= roaming_threshold  */
4294 static void ipw_handle_missed_beacon(struct ipw_priv *priv,
4295                                             int missed_count)
4296 {
4297         priv->notif_missed_beacons = missed_count;
4298
4299         if (missed_count > priv->disassociate_threshold &&
4300             priv->status & STATUS_ASSOCIATED) {
4301                 /* If associated and we've hit the missed
4302                  * beacon threshold, disassociate, turn
4303                  * off roaming, and abort any active scans */
4304                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
4305                           IPW_DL_STATE | IPW_DL_ASSOC,
4306                           "Missed beacon: %d - disassociate\n", missed_count);
4307                 priv->status &= ~STATUS_ROAMING;
4308                 if (priv->status & STATUS_SCANNING) {
4309                         IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
4310                                   IPW_DL_STATE,
4311                                   "Aborting scan with missed beacon.\n");
4312                         queue_work(priv->workqueue, &priv->abort_scan);
4313                 }
4314
4315                 queue_work(priv->workqueue, &priv->disassociate);
4316                 return;
4317         }
4318
4319         if (priv->status & STATUS_ROAMING) {
4320                 /* If we are currently roaming, then just
4321                  * print a debug statement... */
4322                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4323                           "Missed beacon: %d - roam in progress\n",
4324                           missed_count);
4325                 return;
4326         }
4327
4328         if (roaming &&
4329             (missed_count > priv->roaming_threshold &&
4330              missed_count <= priv->disassociate_threshold)) {
4331                 /* If we are not already roaming, set the ROAM
4332                  * bit in the status and kick off a scan.
4333                  * This can happen several times before we reach
4334                  * disassociate_threshold. */
4335                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4336                           "Missed beacon: %d - initiate "
4337                           "roaming\n", missed_count);
4338                 if (!(priv->status & STATUS_ROAMING)) {
4339                         priv->status |= STATUS_ROAMING;
4340                         if (!(priv->status & STATUS_SCANNING))
4341                                 queue_delayed_work(priv->workqueue,
4342                                                    &priv->request_scan, 0);
4343                 }
4344                 return;
4345         }
4346
4347         if (priv->status & STATUS_SCANNING) {
4348                 /* Stop scan to keep fw from getting
4349                  * stuck (only if we aren't roaming --
4350                  * otherwise we'll never scan more than 2 or 3
4351                  * channels..) */
4352                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF | IPW_DL_STATE,
4353                           "Aborting scan with missed beacon.\n");
4354                 queue_work(priv->workqueue, &priv->abort_scan);
4355         }
4356
4357         IPW_DEBUG_NOTIF("Missed beacon: %d\n", missed_count);
4358 }
4359
4360 static void ipw_scan_event(struct work_struct *work)
4361 {
4362         union iwreq_data wrqu;
4363
4364         struct ipw_priv *priv =
4365                 container_of(work, struct ipw_priv, scan_event.work);
4366
4367         wrqu.data.length = 0;
4368         wrqu.data.flags = 0;
4369         wireless_send_event(priv->net_dev, SIOCGIWSCAN, &wrqu, NULL);
4370 }
4371
4372 static void handle_scan_event(struct ipw_priv *priv)
4373 {
4374         /* Only userspace-requested scan completion events go out immediately */
4375         if (!priv->user_requested_scan) {
4376                 if (!delayed_work_pending(&priv->scan_event))
4377                         queue_delayed_work(priv->workqueue, &priv->scan_event,
4378                                          round_jiffies_relative(msecs_to_jiffies(4000)));
4379         } else {
4380                 union iwreq_data wrqu;
4381
4382                 priv->user_requested_scan = 0;
4383                 cancel_delayed_work(&priv->scan_event);
4384
4385                 wrqu.data.length = 0;
4386                 wrqu.data.flags = 0;
4387                 wireless_send_event(priv->net_dev, SIOCGIWSCAN, &wrqu, NULL);
4388         }
4389 }
4390
4391 /**
4392  * Handle host notification packet.
4393  * Called from interrupt routine
4394  */
4395 static void ipw_rx_notification(struct ipw_priv *priv,
4396                                        struct ipw_rx_notification *notif)
4397 {
4398         u16 size = le16_to_cpu(notif->size);
4399         notif->size = le16_to_cpu(notif->size);
4400
4401         IPW_DEBUG_NOTIF("type = %i (%d bytes)\n", notif->subtype, size);
4402
4403         switch (notif->subtype) {
4404         case HOST_NOTIFICATION_STATUS_ASSOCIATED:{
4405                         struct notif_association *assoc = &notif->u.assoc;
4406
4407                         switch (assoc->state) {
4408                         case CMAS_ASSOCIATED:{
4409                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4410                                                   IPW_DL_ASSOC,
4411                                                   "associated: '%s' %pM \n",
4412                                                   escape_essid(priv->essid,
4413                                                                priv->essid_len),
4414                                                   priv->bssid);
4415
4416                                         switch (priv->ieee->iw_mode) {
4417                                         case IW_MODE_INFRA:
4418                                                 memcpy(priv->ieee->bssid,
4419                                                        priv->bssid, ETH_ALEN);
4420                                                 break;
4421
4422                                         case IW_MODE_ADHOC:
4423                                                 memcpy(priv->ieee->bssid,
4424                                                        priv->bssid, ETH_ALEN);
4425
4426                                                 /* clear out the station table */
4427                                                 priv->num_stations = 0;
4428
4429                                                 IPW_DEBUG_ASSOC
4430                                                     ("queueing adhoc check\n");
4431                                                 queue_delayed_work(priv->
4432                                                                    workqueue,
4433                                                                    &priv->
4434                                                                    adhoc_check,
4435                                                                    le16_to_cpu(priv->
4436                                                                    assoc_request.
4437                                                                    beacon_interval));
4438                                                 break;
4439                                         }
4440
4441                                         priv->status &= ~STATUS_ASSOCIATING;
4442                                         priv->status |= STATUS_ASSOCIATED;
4443                                         queue_work(priv->workqueue,
4444                                                    &priv->system_config);
4445
4446 #ifdef CONFIG_IPW2200_QOS
4447 #define IPW_GET_PACKET_STYPE(x) WLAN_FC_GET_STYPE( \
4448                          le16_to_cpu(((struct ieee80211_hdr *)(x))->frame_ctl))
4449                                         if ((priv->status & STATUS_AUTH) &&
4450                                             (IPW_GET_PACKET_STYPE(&notif->u.raw)
4451                                              == IEEE80211_STYPE_ASSOC_RESP)) {
4452                                                 if ((sizeof
4453                                                      (struct
4454                                                       ieee80211_assoc_response)
4455                                                      <= size)
4456                                                     && (size <= 2314)) {
4457                                                         struct
4458                                                         ieee80211_rx_stats
4459                                                             stats = {
4460                                                                 .len = size - 1,
4461                                                         };
4462
4463                                                         IPW_DEBUG_QOS
4464                                                             ("QoS Associate "
4465                                                              "size %d\n", size);
4466                                                         ieee80211_rx_mgt(priv->
4467                                                                          ieee,
4468                                                                          (struct
4469                                                                           ieee80211_hdr_4addr
4470                                                                           *)
4471                                                                          &notif->u.raw, &stats);
4472                                                 }
4473                                         }
4474 #endif
4475
4476                                         schedule_work(&priv->link_up);
4477
4478                                         break;
4479                                 }
4480
4481                         case CMAS_AUTHENTICATED:{
4482                                         if (priv->
4483                                             status & (STATUS_ASSOCIATED |
4484                                                       STATUS_AUTH)) {
4485                                                 struct notif_authenticate *auth
4486                                                     = &notif->u.auth;
4487                                                 IPW_DEBUG(IPW_DL_NOTIF |
4488                                                           IPW_DL_STATE |
4489                                                           IPW_DL_ASSOC,
4490                                                           "deauthenticated: '%s' "
4491                                                           "%pM"
4492                                                           ": (0x%04X) - %s \n",
4493                                                           escape_essid(priv->
4494                                                                        essid,
4495                                                                        priv->
4496                                                                        essid_len),
4497                                                           priv->bssid,
4498                                                           le16_to_cpu(auth->status),
4499                                                           ipw_get_status_code
4500                                                           (le16_to_cpu
4501                                                            (auth->status)));
4502
4503                                                 priv->status &=
4504                                                     ~(STATUS_ASSOCIATING |
4505                                                       STATUS_AUTH |
4506                                                       STATUS_ASSOCIATED);
4507
4508                                                 schedule_work(&priv->link_down);
4509                                                 break;
4510                                         }
4511
4512                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4513                                                   IPW_DL_ASSOC,
4514                                                   "authenticated: '%s' %pM\n",
4515                                                   escape_essid(priv->essid,
4516                                                                priv->essid_len),
4517                                                   priv->bssid);
4518                                         break;
4519                                 }
4520
4521                         case CMAS_INIT:{
4522                                         if (priv->status & STATUS_AUTH) {
4523                                                 struct
4524                                                     ieee80211_assoc_response
4525                                                 *resp;
4526                                                 resp =
4527                                                     (struct
4528                                                      ieee80211_assoc_response
4529                                                      *)&notif->u.raw;
4530                                                 IPW_DEBUG(IPW_DL_NOTIF |
4531                                                           IPW_DL_STATE |
4532                                                           IPW_DL_ASSOC,
4533                                                           "association failed (0x%04X): %s\n",
4534                                                           le16_to_cpu(resp->status),
4535                                                           ipw_get_status_code
4536                                                           (le16_to_cpu
4537                                                            (resp->status)));
4538                                         }
4539
4540                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4541                                                   IPW_DL_ASSOC,
4542                                                   "disassociated: '%s' %pM \n",
4543                                                   escape_essid(priv->essid,
4544                                                                priv->essid_len),
4545                                                   priv->bssid);
4546
4547                                         priv->status &=
4548                                             ~(STATUS_DISASSOCIATING |
4549                                               STATUS_ASSOCIATING |
4550                                               STATUS_ASSOCIATED | STATUS_AUTH);
4551                                         if (priv->assoc_network
4552                                             && (priv->assoc_network->
4553                                                 capability &
4554                                                 WLAN_CAPABILITY_IBSS))
4555                                                 ipw_remove_current_network
4556                                                     (priv);
4557
4558                                         schedule_work(&priv->link_down);
4559
4560                                         break;
4561                                 }
4562
4563                         case CMAS_RX_ASSOC_RESP:
4564                                 break;
4565
4566                         default:
4567                                 IPW_ERROR("assoc: unknown (%d)\n",
4568                                           assoc->state);
4569                                 break;
4570                         }
4571
4572                         break;
4573                 }
4574
4575         case HOST_NOTIFICATION_STATUS_AUTHENTICATE:{
4576                         struct notif_authenticate *auth = &notif->u.auth;
4577                         switch (auth->state) {
4578                         case CMAS_AUTHENTICATED:
4579                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4580                                           "authenticated: '%s' %pM \n",
4581                                           escape_essid(priv->essid,
4582                                                        priv->essid_len),
4583                                           priv->bssid);
4584                                 priv->status |= STATUS_AUTH;
4585                                 break;
4586
4587                         case CMAS_INIT:
4588                                 if (priv->status & STATUS_AUTH) {
4589                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4590                                                   IPW_DL_ASSOC,
4591                                                   "authentication failed (0x%04X): %s\n",
4592                                                   le16_to_cpu(auth->status),
4593                                                   ipw_get_status_code(le16_to_cpu
4594                                                                       (auth->
4595                                                                        status)));
4596                                 }
4597                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4598                                           IPW_DL_ASSOC,
4599                                           "deauthenticated: '%s' %pM\n",
4600                                           escape_essid(priv->essid,
4601                                                        priv->essid_len),
4602                                           priv->bssid);
4603
4604                                 priv->status &= ~(STATUS_ASSOCIATING |
4605                                                   STATUS_AUTH |
4606                                                   STATUS_ASSOCIATED);
4607
4608                                 schedule_work(&priv->link_down);
4609                                 break;
4610
4611                         case CMAS_TX_AUTH_SEQ_1:
4612                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4613                                           IPW_DL_ASSOC, "AUTH_SEQ_1\n");
4614                                 break;
4615                         case CMAS_RX_AUTH_SEQ_2:
4616                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4617                                           IPW_DL_ASSOC, "AUTH_SEQ_2\n");
4618                                 break;
4619                         case CMAS_AUTH_SEQ_1_PASS:
4620                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4621                                           IPW_DL_ASSOC, "AUTH_SEQ_1_PASS\n");
4622                                 break;
4623                         case CMAS_AUTH_SEQ_1_FAIL:
4624                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4625                                           IPW_DL_ASSOC, "AUTH_SEQ_1_FAIL\n");
4626                                 break;
4627                         case CMAS_TX_AUTH_SEQ_3:
4628                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4629                                           IPW_DL_ASSOC, "AUTH_SEQ_3\n");
4630                                 break;
4631                         case CMAS_RX_AUTH_SEQ_4:
4632                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4633                                           IPW_DL_ASSOC, "RX_AUTH_SEQ_4\n");
4634                                 break;
4635                         case CMAS_AUTH_SEQ_2_PASS:
4636                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4637                                           IPW_DL_ASSOC, "AUTH_SEQ_2_PASS\n");
4638                                 break;
4639                         case CMAS_AUTH_SEQ_2_FAIL:
4640                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4641                                           IPW_DL_ASSOC, "AUT_SEQ_2_FAIL\n");
4642                                 break;
4643                         case CMAS_TX_ASSOC:
4644                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4645                                           IPW_DL_ASSOC, "TX_ASSOC\n");
4646                                 break;
4647                         case CMAS_RX_ASSOC_RESP:
4648                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4649                                           IPW_DL_ASSOC, "RX_ASSOC_RESP\n");
4650
4651                                 break;
4652                         case CMAS_ASSOCIATED:
4653                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4654                                           IPW_DL_ASSOC, "ASSOCIATED\n");
4655                                 break;
4656                         default:
4657                                 IPW_DEBUG_NOTIF("auth: failure - %d\n",
4658                                                 auth->state);
4659                                 break;
4660                         }
4661                         break;
4662                 }
4663
4664         case HOST_NOTIFICATION_STATUS_SCAN_CHANNEL_RESULT:{
4665                         struct notif_channel_result *x =
4666                             &notif->u.channel_result;
4667
4668                         if (size == sizeof(*x)) {
4669                                 IPW_DEBUG_SCAN("Scan result for channel %d\n",
4670                                                x->channel_num);
4671                         } else {
4672                                 IPW_DEBUG_SCAN("Scan result of wrong size %d "
4673                                                "(should be %zd)\n",
4674                                                size, sizeof(*x));
4675                         }
4676                         break;
4677                 }
4678
4679         case HOST_NOTIFICATION_STATUS_SCAN_COMPLETED:{
4680                         struct notif_scan_complete *x = &notif->u.scan_complete;
4681                         if (size == sizeof(*x)) {
4682                                 IPW_DEBUG_SCAN
4683                                     ("Scan completed: type %d, %d channels, "
4684                                      "%d status\n", x->scan_type,
4685                                      x->num_channels, x->status);
4686                         } else {
4687                                 IPW_ERROR("Scan completed of wrong size %d "
4688                                           "(should be %zd)\n",
4689                                           size, sizeof(*x));
4690                         }
4691
4692                         priv->status &=
4693                             ~(STATUS_SCANNING | STATUS_SCAN_ABORTING);
4694
4695                         wake_up_interruptible(&priv->wait_state);
4696                         cancel_delayed_work(&priv->scan_check);
4697
4698                         if (priv->status & STATUS_EXIT_PENDING)
4699                                 break;
4700
4701                         priv->ieee->scans++;
4702
4703 #ifdef CONFIG_IPW2200_MONITOR
4704                         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
4705                                 priv->status |= STATUS_SCAN_FORCED;
4706                                 queue_delayed_work(priv->workqueue,
4707                                                    &priv->request_scan, 0);
4708                                 break;
4709                         }
4710                         priv->status &= ~STATUS_SCAN_FORCED;
4711 #endif                          /* CONFIG_IPW2200_MONITOR */
4712
4713                         /* Do queued direct scans first */
4714                         if (priv->status & STATUS_DIRECT_SCAN_PENDING) {
4715                                 queue_delayed_work(priv->workqueue,
4716                                                    &priv->request_direct_scan, 0);
4717                         }
4718
4719                         if (!(priv->status & (STATUS_ASSOCIATED |
4720                                               STATUS_ASSOCIATING |
4721                                               STATUS_ROAMING |
4722                                               STATUS_DISASSOCIATING)))
4723                                 queue_work(priv->workqueue, &priv->associate);
4724                         else if (priv->status & STATUS_ROAMING) {
4725                                 if (x->status == SCAN_COMPLETED_STATUS_COMPLETE)
4726                                         /* If a scan completed and we are in roam mode, then
4727                                          * the scan that completed was the one requested as a
4728                                          * result of entering roam... so, schedule the
4729                                          * roam work */
4730                                         queue_work(priv->workqueue,
4731                                                    &priv->roam);
4732                                 else
4733                                         /* Don't schedule if we aborted the scan */
4734                                         priv->status &= ~STATUS_ROAMING;
4735                         } else if (priv->status & STATUS_SCAN_PENDING)
4736                                 queue_delayed_work(priv->workqueue,
4737                                                    &priv->request_scan, 0);
4738                         else if (priv->config & CFG_BACKGROUND_SCAN
4739                                  && priv->status & STATUS_ASSOCIATED)
4740                                 queue_delayed_work(priv->workqueue,
4741                                                    &priv->request_scan,
4742                                                    round_jiffies_relative(HZ));
4743
4744                         /* Send an empty event to user space.
4745                          * We don't send the received data on the event because
4746                          * it would require us to do complex transcoding, and
4747                          * we want to minimise the work done in the irq handler
4748                          * Use a request to extract the data.
4749                          * Also, we generate this even for any scan, regardless
4750                          * on how the scan was initiated. User space can just
4751                          * sync on periodic scan to get fresh data...
4752                          * Jean II */
4753                         if (x->status == SCAN_COMPLETED_STATUS_COMPLETE)
4754                                 handle_scan_event(priv);
4755                         break;
4756                 }
4757
4758         case HOST_NOTIFICATION_STATUS_FRAG_LENGTH:{
4759                         struct notif_frag_length *x = &notif->u.frag_len;
4760
4761                         if (size == sizeof(*x))
4762                                 IPW_ERROR("Frag length: %d\n",
4763                                           le16_to_cpu(x->frag_length));
4764                         else
4765                                 IPW_ERROR("Frag length of wrong size %d "
4766                                           "(should be %zd)\n",
4767                                           size, sizeof(*x));
4768                         break;
4769                 }
4770
4771         case HOST_NOTIFICATION_STATUS_LINK_DETERIORATION:{
4772                         struct notif_link_deterioration *x =
4773                             &notif->u.link_deterioration;
4774
4775                         if (size == sizeof(*x)) {
4776                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4777                                         "link deterioration: type %d, cnt %d\n",
4778                                         x->silence_notification_type,
4779                                         x->silence_count);
4780                                 memcpy(&priv->last_link_deterioration, x,
4781                                        sizeof(*x));
4782                         } else {
4783                                 IPW_ERROR("Link Deterioration of wrong size %d "
4784                                           "(should be %zd)\n",
4785                                           size, sizeof(*x));
4786                         }
4787                         break;
4788                 }
4789
4790         case HOST_NOTIFICATION_DINO_CONFIG_RESPONSE:{
4791                         IPW_ERROR("Dino config\n");
4792                         if (priv->hcmd
4793                             && priv->hcmd->cmd != HOST_CMD_DINO_CONFIG)
4794                                 IPW_ERROR("Unexpected DINO_CONFIG_RESPONSE\n");
4795
4796                         break;
4797                 }
4798
4799         case HOST_NOTIFICATION_STATUS_BEACON_STATE:{
4800                         struct notif_beacon_state *x = &notif->u.beacon_state;
4801                         if (size != sizeof(*x)) {
4802                                 IPW_ERROR
4803                                     ("Beacon state of wrong size %d (should "
4804                                      "be %zd)\n", size, sizeof(*x));
4805                                 break;
4806                         }
4807
4808                         if (le32_to_cpu(x->state) ==
4809                             HOST_NOTIFICATION_STATUS_BEACON_MISSING)
4810                                 ipw_handle_missed_beacon(priv,
4811                                                          le32_to_cpu(x->
4812                                                                      number));
4813
4814                         break;
4815                 }
4816
4817         case HOST_NOTIFICATION_STATUS_TGI_TX_KEY:{
4818                         struct notif_tgi_tx_key *x = &notif->u.tgi_tx_key;
4819                         if (size == sizeof(*x)) {
4820                                 IPW_ERROR("TGi Tx Key: state 0x%02x sec type "
4821                                           "0x%02x station %d\n",
4822                                           x->key_state, x->security_type,
4823                                           x->station_index);
4824                                 break;
4825                         }
4826
4827                         IPW_ERROR
4828                             ("TGi Tx Key of wrong size %d (should be %zd)\n",
4829                              size, sizeof(*x));
4830                         break;
4831                 }
4832
4833         case HOST_NOTIFICATION_CALIB_KEEP_RESULTS:{
4834                         struct notif_calibration *x = &notif->u.calibration;
4835
4836                         if (size == sizeof(*x)) {
4837                                 memcpy(&priv->calib, x, sizeof(*x));
4838                                 IPW_DEBUG_INFO("TODO: Calibration\n");
4839                                 break;
4840                         }
4841
4842                         IPW_ERROR
4843                             ("Calibration of wrong size %d (should be %zd)\n",
4844                              size, sizeof(*x));
4845                         break;
4846                 }
4847
4848         case HOST_NOTIFICATION_NOISE_STATS:{
4849                         if (size == sizeof(u32)) {
4850                                 priv->exp_avg_noise =
4851                                     exponential_average(priv->exp_avg_noise,
4852                                     (u8) (le32_to_cpu(notif->u.noise.value) & 0xff),
4853                                     DEPTH_NOISE);
4854                                 break;
4855                         }
4856
4857                         IPW_ERROR
4858                             ("Noise stat is wrong size %d (should be %zd)\n",
4859                              size, sizeof(u32));
4860                         break;
4861                 }
4862
4863         default:
4864                 IPW_DEBUG_NOTIF("Unknown notification: "
4865                                 "subtype=%d,flags=0x%2x,size=%d\n",
4866                                 notif->subtype, notif->flags, size);
4867         }
4868 }
4869
4870 /**
4871  * Destroys all DMA structures and initialise them again
4872  *
4873  * @param priv
4874  * @return error code
4875  */
4876 static int ipw_queue_reset(struct ipw_priv *priv)
4877 {
4878         int rc = 0;
4879         /** @todo customize queue sizes */
4880         int nTx = 64, nTxCmd = 8;
4881         ipw_tx_queue_free(priv);
4882         /* Tx CMD queue */
4883         rc = ipw_queue_tx_init(priv, &priv->txq_cmd, nTxCmd,
4884                                IPW_TX_CMD_QUEUE_READ_INDEX,
4885                                IPW_TX_CMD_QUEUE_WRITE_INDEX,
4886                                IPW_TX_CMD_QUEUE_BD_BASE,
4887                                IPW_TX_CMD_QUEUE_BD_SIZE);
4888         if (rc) {
4889                 IPW_ERROR("Tx Cmd queue init failed\n");
4890                 goto error;
4891         }
4892         /* Tx queue(s) */
4893         rc = ipw_queue_tx_init(priv, &priv->txq[0], nTx,
4894                                IPW_TX_QUEUE_0_READ_INDEX,
4895                                IPW_TX_QUEUE_0_WRITE_INDEX,
4896                                IPW_TX_QUEUE_0_BD_BASE, IPW_TX_QUEUE_0_BD_SIZE);
4897         if (rc) {
4898                 IPW_ERROR("Tx 0 queue init failed\n");
4899                 goto error;
4900         }
4901         rc = ipw_queue_tx_init(priv, &priv->txq[1], nTx,
4902                                IPW_TX_QUEUE_1_READ_INDEX,
4903                                IPW_TX_QUEUE_1_WRITE_INDEX,
4904                                IPW_TX_QUEUE_1_BD_BASE, IPW_TX_QUEUE_1_BD_SIZE);
4905         if (rc) {
4906                 IPW_ERROR("Tx 1 queue init failed\n");
4907                 goto error;
4908         }
4909         rc = ipw_queue_tx_init(priv, &priv->txq[2], nTx,
4910                                IPW_TX_QUEUE_2_READ_INDEX,
4911                                IPW_TX_QUEUE_2_WRITE_INDEX,
4912                                IPW_TX_QUEUE_2_BD_BASE, IPW_TX_QUEUE_2_BD_SIZE);
4913         if (rc) {
4914                 IPW_ERROR("Tx 2 queue init failed\n");
4915                 goto error;
4916         }
4917         rc = ipw_queue_tx_init(priv, &priv->txq[3], nTx,
4918                                IPW_TX_QUEUE_3_READ_INDEX,
4919                                IPW_TX_QUEUE_3_WRITE_INDEX,
4920                                IPW_TX_QUEUE_3_BD_BASE, IPW_TX_QUEUE_3_BD_SIZE);
4921         if (rc) {
4922                 IPW_ERROR("Tx 3 queue init failed\n");
4923                 goto error;
4924         }
4925         /* statistics */
4926         priv->rx_bufs_min = 0;
4927         priv->rx_pend_max = 0;
4928         return rc;
4929
4930       error:
4931         ipw_tx_queue_free(priv);
4932         return rc;
4933 }
4934
4935 /**
4936  * Reclaim Tx queue entries no more used by NIC.
4937  *
4938  * When FW advances 'R' index, all entries between old and
4939  * new 'R' index need to be reclaimed. As result, some free space
4940  * forms. If there is enough free space (> low mark), wake Tx queue.
4941  *
4942  * @note Need to protect against garbage in 'R' index
4943  * @param priv
4944  * @param txq
4945  * @param qindex
4946  * @return Number of used entries remains in the queue
4947  */
4948 static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
4949                                 struct clx2_tx_queue *txq, int qindex)
4950 {
4951         u32 hw_tail;
4952         int used;
4953         struct clx2_queue *q = &txq->q;
4954
4955         hw_tail = ipw_read32(priv, q->reg_r);
4956         if (hw_tail >= q->n_bd) {
4957                 IPW_ERROR
4958                     ("Read index for DMA queue (%d) is out of range [0-%d)\n",
4959                      hw_tail, q->n_bd);
4960                 goto done;
4961         }
4962         for (; q->last_used != hw_tail;
4963              q->last_used = ipw_queue_inc_wrap(q->last_used, q->n_bd)) {
4964                 ipw_queue_tx_free_tfd(priv, txq);
4965                 priv->tx_packets++;
4966         }
4967       done:
4968         if ((ipw_tx_queue_space(q) > q->low_mark) &&
4969             (qindex >= 0))
4970                 netif_wake_queue(priv->net_dev);
4971         used = q->first_empty - q->last_used;
4972         if (used < 0)
4973                 used += q->n_bd;
4974
4975         return used;
4976 }
4977
4978 static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
4979                              int len, int sync)
4980 {
4981         struct clx2_tx_queue *txq = &priv->txq_cmd;
4982         struct clx2_queue *q = &txq->q;
4983         struct tfd_frame *tfd;
4984
4985         if (ipw_tx_queue_space(q) < (sync ? 1 : 2)) {
4986                 IPW_ERROR("No space for Tx\n");
4987                 return -EBUSY;
4988         }
4989
4990         tfd = &txq->bd[q->first_empty];
4991         txq->txb[q->first_empty] = NULL;
4992
4993         memset(tfd, 0, sizeof(*tfd));
4994         tfd->control_flags.message_type = TX_HOST_COMMAND_TYPE;
4995         tfd->control_flags.control_bits = TFD_NEED_IRQ_MASK;
4996         priv->hcmd_seq++;
4997         tfd->u.cmd.index = hcmd;
4998         tfd->u.cmd.length = len;
4999         memcpy(tfd->u.cmd.payload, buf, len);
5000         q->first_empty = ipw_queue_inc_wrap(q->first_empty, q->n_bd);
5001         ipw_write32(priv, q->reg_w, q->first_empty);
5002         _ipw_read32(priv, 0x90);
5003
5004         return 0;
5005 }
5006
5007 /*
5008  * Rx theory of operation
5009  *
5010  * The host allocates 32 DMA target addresses and passes the host address
5011  * to the firmware at register IPW_RFDS_TABLE_LOWER + N * RFD_SIZE where N is
5012  * 0 to 31
5013  *
5014  * Rx Queue Indexes
5015  * The host/firmware share two index registers for managing the Rx buffers.
5016  *
5017  * The READ index maps to the first position that the firmware may be writing
5018  * to -- the driver can read up to (but not including) this position and get
5019  * good data.
5020  * The READ index is managed by the firmware once the card is enabled.
5021  *
5022  * The WRITE index maps to the last position the driver has read from -- the
5023  * position preceding WRITE is the last slot the firmware can place a packet.
5024  *
5025  * The queue is empty (no good data) if WRITE = READ - 1, and is full if
5026  * WRITE = READ.
5027  *
5028  * During initialization the host sets up the READ queue position to the first
5029  * INDEX position, and WRITE to the last (READ - 1 wrapped)
5030  *
5031  * When the firmware places a packet in a buffer it will advance the READ index
5032  * and fire the RX interrupt.  The driver can then query the READ index and
5033  * process as many packets as possible, moving the WRITE index forward as it
5034  * resets the Rx queue buffers with new memory.
5035  *
5036  * The management in the driver is as follows:
5037  * + A list of pre-allocated SKBs is stored in ipw->rxq->rx_free.  When
5038  *   ipw->rxq->free_count drops to or below RX_LOW_WATERMARK, work is scheduled
5039  *   to replensish the ipw->rxq->rx_free.
5040  * + In ipw_rx_queue_replenish (scheduled) if 'processed' != 'read' then the
5041  *   ipw->rxq is replenished and the READ INDEX is updated (updating the
5042  *   'processed' and 'read' driver indexes as well)
5043  * + A received packet is processed and handed to the kernel network stack,
5044  *   detached from the ipw->rxq.  The driver 'processed' index is updated.
5045  * + The Host/Firmware ipw->rxq is replenished at tasklet time from the rx_free
5046  *   list. If there are no allocated buffers in ipw->rxq->rx_free, the READ
5047  *   INDEX is not incremented and ipw->status(RX_STALLED) is set.  If there
5048  *   were enough free buffers and RX_STALLED is set it is cleared.
5049  *
5050  *
5051  * Driver sequence:
5052  *
5053  * ipw_rx_queue_alloc()       Allocates rx_free
5054  * ipw_rx_queue_replenish()   Replenishes rx_free list from rx_used, and calls
5055  *                            ipw_rx_queue_restock
5056  * ipw_rx_queue_restock()     Moves available buffers from rx_free into Rx
5057  *                            queue, updates firmware pointers, and updates
5058  *                            the WRITE index.  If insufficient rx_free buffers
5059  *                            are available, schedules ipw_rx_queue_replenish
5060  *
5061  * -- enable interrupts --
5062  * ISR - ipw_rx()             Detach ipw_rx_mem_buffers from pool up to the
5063  *                            READ INDEX, detaching the SKB from the pool.
5064  *                            Moves the packet buffer from queue to rx_used.
5065  *                            Calls ipw_rx_queue_restock to refill any empty
5066  *                            slots.
5067  * ...
5068  *
5069  */
5070
5071 /*
5072  * If there are slots in the RX queue that  need to be restocked,
5073  * and we have free pre-allocated buffers, fill the ranks as much
5074  * as we can pulling from rx_free.
5075  *
5076  * This moves the 'write' index forward to catch up with 'processed', and
5077  * also updates the memory address in the firmware to reference the new
5078  * target buffer.
5079  */
5080 static void ipw_rx_queue_restock(struct ipw_priv *priv)
5081 {
5082         struct ipw_rx_queue *rxq = priv->rxq;
5083         struct list_head *element;
5084         struct ipw_rx_mem_buffer *rxb;
5085         unsigned long flags;
5086         int write;
5087
5088         spin_lock_irqsave(&rxq->lock, flags);
5089         write = rxq->write;
5090         while ((ipw_rx_queue_space(rxq) > 0) && (rxq->free_count)) {
5091                 element = rxq->rx_free.next;
5092                 rxb = list_entry(element, struct ipw_rx_mem_buffer, list);
5093                 list_del(element);
5094
5095                 ipw_write32(priv, IPW_RFDS_TABLE_LOWER + rxq->write * RFD_SIZE,
5096                             rxb->dma_addr);
5097                 rxq->queue[rxq->write] = rxb;
5098                 rxq->write = (rxq->write + 1) % RX_QUEUE_SIZE;
5099                 rxq->free_count--;
5100         }
5101         spin_unlock_irqrestore(&rxq->lock, flags);
5102
5103         /* If the pre-allocated buffer pool is dropping low, schedule to
5104          * refill it */
5105         if (rxq->free_count <= RX_LOW_WATERMARK)
5106                 queue_work(priv->workqueue, &priv->rx_replenish);
5107
5108         /* If we've added more space for the firmware to place data, tell it */
5109         if (write != rxq->write)
5110                 ipw_write32(priv, IPW_RX_WRITE_INDEX, rxq->write);
5111 }
5112
5113 /*
5114  * Move all used packet from rx_used to rx_free, allocating a new SKB for each.
5115  * Also restock the Rx queue via ipw_rx_queue_restock.
5116  *
5117  * This is called as a scheduled work item (except for during intialization)
5118  */
5119 static void ipw_rx_queue_replenish(void *data)
5120 {
5121         struct ipw_priv *priv = data;
5122         struct ipw_rx_queue *rxq = priv->rxq;
5123         struct list_head *element;
5124         struct ipw_rx_mem_buffer *rxb;
5125         unsigned long flags;
5126
5127         spin_lock_irqsave(&rxq->lock, flags);
5128         while (!list_empty(&rxq->rx_used)) {
5129                 element = rxq->rx_used.next;
5130                 rxb = list_entry(element, struct ipw_rx_mem_buffer, list);
5131                 rxb->skb = alloc_skb(IPW_RX_BUF_SIZE, GFP_ATOMIC);
5132                 if (!rxb->skb) {
5133                         printk(KERN_CRIT "%s: Can not allocate SKB buffers.\n",
5134                                priv->net_dev->name);
5135                         /* We don't reschedule replenish work here -- we will
5136                          * call the restock method and if it still needs
5137                          * more buffers it will schedule replenish */
5138                         break;
5139                 }
5140                 list_del(element);
5141
5142                 rxb->dma_addr =
5143                     pci_map_single(priv->pci_dev, rxb->skb->data,
5144                                    IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
5145
5146                 list_add_tail(&rxb->list, &rxq->rx_free);
5147                 rxq->free_count++;
5148         }
5149         spin_unlock_irqrestore(&rxq->lock, flags);
5150
5151         ipw_rx_queue_restock(priv);
5152 }
5153
5154 static void ipw_bg_rx_queue_replenish(struct work_struct *work)
5155 {
5156         struct ipw_priv *priv =
5157                 container_of(work, struct ipw_priv, rx_replenish);
5158         mutex_lock(&priv->mutex);
5159         ipw_rx_queue_replenish(priv);
5160         mutex_unlock(&priv->mutex);
5161 }
5162
5163 /* Assumes that the skb field of the buffers in 'pool' is kept accurate.
5164  * If an SKB has been detached, the POOL needs to have its SKB set to NULL
5165  * This free routine walks the list of POOL entries and if SKB is set to
5166  * non NULL it is unmapped and freed
5167  */
5168 static void ipw_rx_queue_free(struct ipw_priv *priv, struct ipw_rx_queue *rxq)
5169 {
5170         int i;
5171
5172         if (!rxq)
5173                 return;
5174
5175         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
5176                 if (rxq->pool[i].skb != NULL) {
5177                         pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
5178                                          IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
5179                         dev_kfree_skb(rxq->pool[i].skb);
5180                 }
5181         }
5182
5183         kfree(rxq);
5184 }
5185
5186 static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *priv)
5187 {
5188         struct ipw_rx_queue *rxq;
5189         int i;
5190
5191         rxq = kzalloc(sizeof(*rxq), GFP_KERNEL);
5192         if (unlikely(!rxq)) {
5193                 IPW_ERROR("memory allocation failed\n");
5194                 return NULL;
5195         }
5196         spin_lock_init(&rxq->lock);
5197         INIT_LIST_HEAD(&rxq->rx_free);
5198         INIT_LIST_HEAD(&rxq->rx_used);
5199
5200         /* Fill the rx_used queue with _all_ of the Rx buffers */
5201         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++)
5202                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
5203
5204         /* Set us so that we have processed and used all buffers, but have
5205          * not restocked the Rx queue with fresh buffers */
5206         rxq->read = rxq->write = 0;
5207         rxq->free_count = 0;
5208
5209         return rxq;
5210 }
5211
5212 static int ipw_is_rate_in_mask(struct ipw_priv *priv, int ieee_mode, u8 rate)
5213 {
5214         rate &= ~IEEE80211_BASIC_RATE_MASK;
5215         if (ieee_mode == IEEE_A) {
5216                 switch (rate) {
5217                 case IEEE80211_OFDM_RATE_6MB:
5218                         return priv->rates_mask & IEEE80211_OFDM_RATE_6MB_MASK ?
5219                             1 : 0;
5220                 case IEEE80211_OFDM_RATE_9MB:
5221                         return priv->rates_mask & IEEE80211_OFDM_RATE_9MB_MASK ?
5222                             1 : 0;
5223                 case IEEE80211_OFDM_RATE_12MB:
5224                         return priv->
5225                             rates_mask & IEEE80211_OFDM_RATE_12MB_MASK ? 1 : 0;
5226                 case IEEE80211_OFDM_RATE_18MB:
5227                         return priv->
5228                             rates_mask & IEEE80211_OFDM_RATE_18MB_MASK ? 1 : 0;
5229                 case IEEE80211_OFDM_RATE_24MB:
5230                         return priv->
5231                             rates_mask & IEEE80211_OFDM_RATE_24MB_MASK ? 1 : 0;
5232                 case IEEE80211_OFDM_RATE_36MB:
5233                         return priv->
5234                             rates_mask & IEEE80211_OFDM_RATE_36MB_MASK ? 1 : 0;
5235                 case IEEE80211_OFDM_RATE_48MB:
5236                         return priv->
5237                             rates_mask & IEEE80211_OFDM_RATE_48MB_MASK ? 1 : 0;
5238                 case IEEE80211_OFDM_RATE_54MB:
5239                         return priv->
5240                             rates_mask & IEEE80211_OFDM_RATE_54MB_MASK ? 1 : 0;
5241                 default:
5242                         return 0;
5243                 }
5244         }
5245
5246         /* B and G mixed */
5247         switch (rate) {
5248         case IEEE80211_CCK_RATE_1MB:
5249                 return priv->rates_mask & IEEE80211_CCK_RATE_1MB_MASK ? 1 : 0;
5250         case IEEE80211_CCK_RATE_2MB:
5251                 return priv->rates_mask & IEEE80211_CCK_RATE_2MB_MASK ? 1 : 0;
5252         case IEEE80211_CCK_RATE_5MB:
5253                 return priv->rates_mask & IEEE80211_CCK_RATE_5MB_MASK ? 1 : 0;
5254         case IEEE80211_CCK_RATE_11MB:
5255                 return priv->rates_mask & IEEE80211_CCK_RATE_11MB_MASK ? 1 : 0;
5256         }
5257
5258         /* If we are limited to B modulations, bail at this point */
5259         if (ieee_mode == IEEE_B)
5260                 return 0;
5261
5262         /* G */
5263         switch (rate) {
5264         case IEEE80211_OFDM_RATE_6MB:
5265                 return priv->rates_mask & IEEE80211_OFDM_RATE_6MB_MASK ? 1 : 0;
5266         case IEEE80211_OFDM_RATE_9MB:
5267                 return priv->rates_mask & IEEE80211_OFDM_RATE_9MB_MASK ? 1 : 0;
5268         case IEEE80211_OFDM_RATE_12MB:
5269                 return priv->rates_mask & IEEE80211_OFDM_RATE_12MB_MASK ? 1 : 0;
5270         case IEEE80211_OFDM_RATE_18MB:
5271                 return priv->rates_mask & IEEE80211_OFDM_RATE_18MB_MASK ? 1 : 0;
5272         case IEEE80211_OFDM_RATE_24MB:
5273                 return priv->rates_mask & IEEE80211_OFDM_RATE_24MB_MASK ? 1 : 0;
5274         case IEEE80211_OFDM_RATE_36MB:
5275                 return priv->rates_mask & IEEE80211_OFDM_RATE_36MB_MASK ? 1 : 0;
5276         case IEEE80211_OFDM_RATE_48MB:
5277                 return priv->rates_mask & IEEE80211_OFDM_RATE_48MB_MASK ? 1 : 0;
5278         case IEEE80211_OFDM_RATE_54MB:
5279                 return priv->rates_mask & IEEE80211_OFDM_RATE_54MB_MASK ? 1 : 0;
5280         }
5281
5282         return 0;
5283 }
5284
5285 static int ipw_compatible_rates(struct ipw_priv *priv,
5286                                 const struct ieee80211_network *network,
5287                                 struct ipw_supported_rates *rates)
5288 {
5289         int num_rates, i;
5290
5291         memset(rates, 0, sizeof(*rates));
5292         num_rates = min(network->rates_len, (u8) IPW_MAX_RATES);
5293         rates->num_rates = 0;
5294         for (i = 0; i < num_rates; i++) {
5295                 if (!ipw_is_rate_in_mask(priv, network->mode,
5296                                          network->rates[i])) {
5297
5298                         if (network->rates[i] & IEEE80211_BASIC_RATE_MASK) {
5299                                 IPW_DEBUG_SCAN("Adding masked mandatory "
5300                                                "rate %02X\n",
5301                                                network->rates[i]);
5302                                 rates->supported_rates[rates->num_rates++] =
5303                                     network->rates[i];
5304                                 continue;
5305                         }
5306
5307                         IPW_DEBUG_SCAN("Rate %02X masked : 0x%08X\n",
5308                                        network->rates[i], priv->rates_mask);
5309                         continue;
5310                 }
5311
5312                 rates->supported_rates[rates->num_rates++] = network->rates[i];
5313         }
5314
5315         num_rates = min(network->rates_ex_len,
5316                         (u8) (IPW_MAX_RATES - num_rates));
5317         for (i = 0; i < num_rates; i++) {
5318                 if (!ipw_is_rate_in_mask(priv, network->mode,
5319                                          network->rates_ex[i])) {
5320                         if (network->rates_ex[i] & IEEE80211_BASIC_RATE_MASK) {
5321                                 IPW_DEBUG_SCAN("Adding masked mandatory "
5322                                                "rate %02X\n",
5323                                                network->rates_ex[i]);
5324                                 rates->supported_rates[rates->num_rates++] =
5325                                     network->rates[i];
5326                                 continue;
5327                         }
5328
5329                         IPW_DEBUG_SCAN("Rate %02X masked : 0x%08X\n",
5330                                        network->rates_ex[i], priv->rates_mask);
5331                         continue;
5332                 }
5333
5334                 rates->supported_rates[rates->num_rates++] =
5335                     network->rates_ex[i];
5336         }
5337
5338         return 1;
5339 }
5340
5341 static void ipw_copy_rates(struct ipw_supported_rates *dest,
5342                                   const struct ipw_supported_rates *src)
5343 {
5344         u8 i;
5345         for (i = 0; i < src->num_rates; i++)
5346                 dest->supported_rates[i] = src->supported_rates[i];
5347         dest->num_rates = src->num_rates;
5348 }
5349
5350 /* TODO: Look at sniffed packets in the air to determine if the basic rate
5351  * mask should ever be used -- right now all callers to add the scan rates are
5352  * set with the modulation = CCK, so BASIC_RATE_MASK is never set... */
5353 static void ipw_add_cck_scan_rates(struct ipw_supported_rates *rates,
5354                                    u8 modulation, u32 rate_mask)
5355 {
5356         u8 basic_mask = (IEEE80211_OFDM_MODULATION == modulation) ?
5357             IEEE80211_BASIC_RATE_MASK : 0;
5358
5359         if (rate_mask & IEEE80211_CCK_RATE_1MB_MASK)
5360                 rates->supported_rates[rates->num_rates++] =
5361                     IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
5362
5363         if (rate_mask & IEEE80211_CCK_RATE_2MB_MASK)
5364                 rates->supported_rates[rates->num_rates++] =
5365                     IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
5366
5367         if (rate_mask & IEEE80211_CCK_RATE_5MB_MASK)
5368                 rates->supported_rates[rates->num_rates++] = basic_mask |
5369                     IEEE80211_CCK_RATE_5MB;
5370
5371         if (rate_mask & IEEE80211_CCK_RATE_11MB_MASK)
5372                 rates->supported_rates[rates->num_rates++] = basic_mask |
5373                     IEEE80211_CCK_RATE_11MB;
5374 }
5375
5376 static void ipw_add_ofdm_scan_rates(struct ipw_supported_rates *rates,
5377                                     u8 modulation, u32 rate_mask)
5378 {
5379         u8 basic_mask = (IEEE80211_OFDM_MODULATION == modulation) ?
5380             IEEE80211_BASIC_RATE_MASK : 0;
5381
5382         if (rate_mask & IEEE80211_OFDM_RATE_6MB_MASK)
5383                 rates->supported_rates[rates->num_rates++] = basic_mask |
5384                     IEEE80211_OFDM_RATE_6MB;
5385
5386         if (rate_mask & IEEE80211_OFDM_RATE_9MB_MASK)
5387                 rates->supported_rates[rates->num_rates++] =
5388                     IEEE80211_OFDM_RATE_9MB;
5389
5390         if (rate_mask & IEEE80211_OFDM_RATE_12MB_MASK)
5391                 rates->supported_rates[rates->num_rates++] = basic_mask |
5392                     IEEE80211_OFDM_RATE_12MB;
5393
5394         if (rate_mask & IEEE80211_OFDM_RATE_18MB_MASK)
5395                 rates->supported_rates[rates->num_rates++] =
5396                     IEEE80211_OFDM_RATE_18MB;
5397
5398         if (rate_mask & IEEE80211_OFDM_RATE_24MB_MASK)
5399                 rates->supported_rates[rates->num_rates++] = basic_mask |
5400                     IEEE80211_OFDM_RATE_24MB;
5401
5402         if (rate_mask & IEEE80211_OFDM_RATE_36MB_MASK)
5403                 rates->supported_rates[rates->num_rates++] =
5404                     IEEE80211_OFDM_RATE_36MB;
5405
5406         if (rate_mask & IEEE80211_OFDM_RATE_48MB_MASK)
5407                 rates->supported_rates[rates->num_rates++] =
5408                     IEEE80211_OFDM_RATE_48MB;
5409
5410         if (rate_mask & IEEE80211_OFDM_RATE_54MB_MASK)
5411                 rates->supported_rates[rates->num_rates++] =
5412                     IEEE80211_OFDM_RATE_54MB;
5413 }
5414
5415 struct ipw_network_match {
5416         struct ieee80211_network *network;
5417         struct ipw_supported_rates rates;
5418 };
5419
5420 static int ipw_find_adhoc_network(struct ipw_priv *priv,
5421                                   struct ipw_network_match *match,
5422                                   struct ieee80211_network *network,
5423                                   int roaming)
5424 {
5425         struct ipw_supported_rates rates;
5426
5427         /* Verify that this network's capability is compatible with the
5428          * current mode (AdHoc or Infrastructure) */
5429         if ((priv->ieee->iw_mode == IW_MODE_ADHOC &&
5430              !(network->capability & WLAN_CAPABILITY_IBSS))) {
5431                 IPW_DEBUG_MERGE("Network '%s (%pM)' excluded due to "
5432                                 "capability mismatch.\n",
5433                                 escape_essid(network->ssid, network->ssid_len),
5434                                 network->bssid);
5435                 return 0;
5436         }
5437
5438         /* If we do not have an ESSID for this AP, we can not associate with
5439          * it */
5440         if (network->flags & NETWORK_EMPTY_ESSID) {
5441                 IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
5442                                 "because of hidden ESSID.\n",
5443                                 escape_essid(network->ssid, network->ssid_len),
5444                                 network->bssid);
5445                 return 0;
5446         }
5447
5448         if (unlikely(roaming)) {
5449                 /* If we are roaming, then ensure check if this is a valid
5450                  * network to try and roam to */
5451                 if ((network->ssid_len != match->network->ssid_len) ||
5452                     memcmp(network->ssid, match->network->ssid,
5453                            network->ssid_len)) {
5454                         IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
5455                                         "because of non-network ESSID.\n",
5456                                         escape_essid(network->ssid,
5457                                                      network->ssid_len),
5458                                         network->bssid);
5459                         return 0;
5460                 }
5461         } else {
5462                 /* If an ESSID has been configured then compare the broadcast
5463                  * ESSID to ours */
5464                 if ((priv->config & CFG_STATIC_ESSID) &&
5465                     ((network->ssid_len != priv->essid_len) ||
5466                      memcmp(network->ssid, priv->essid,
5467                             min(network->ssid_len, priv->essid_len)))) {
5468                         char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
5469
5470                         strncpy(escaped,
5471                                 escape_essid(network->ssid, network->ssid_len),
5472                                 sizeof(escaped));
5473                         IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
5474                                         "because of ESSID mismatch: '%s'.\n",
5475                                         escaped, network->bssid,
5476                                         escape_essid(priv->essid,
5477                                                      priv->essid_len));
5478                         return 0;
5479                 }
5480         }
5481
5482         /* If the old network rate is better than this one, don't bother
5483          * testing everything else. */
5484
5485         if (network->time_stamp[0] < match->network->time_stamp[0]) {
5486                 IPW_DEBUG_MERGE("Network '%s excluded because newer than "
5487                                 "current network.\n",
5488                                 escape_essid(match->network->ssid,
5489                                              match->network->ssid_len));
5490                 return 0;
5491         } else if (network->time_stamp[1] < match->network->time_stamp[1]) {
5492                 IPW_DEBUG_MERGE("Network '%s excluded because newer than "
5493                                 "current network.\n",
5494                                 escape_essid(match->network->ssid,
5495                                              match->network->ssid_len));
5496                 return 0;
5497         }
5498
5499         /* Now go through and see if the requested network is valid... */
5500         if (priv->ieee->scan_age != 0 &&
5501             time_after(jiffies, network->last_scanned + priv->ieee->scan_age)) {
5502                 IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
5503                                 "because of age: %ums.\n",
5504                                 escape_essid(network->ssid, network->ssid_len),
5505                                 network->bssid,
5506                                 jiffies_to_msecs(jiffies -
5507                                                  network->last_scanned));
5508                 return 0;
5509         }
5510
5511         if ((priv->config & CFG_STATIC_CHANNEL) &&
5512             (network->channel != priv->channel)) {
5513                 IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
5514                                 "because of channel mismatch: %d != %d.\n",
5515                                 escape_essid(network->ssid, network->ssid_len),
5516                                 network->bssid,
5517                                 network->channel, priv->channel);
5518                 return 0;
5519         }
5520
5521         /* Verify privacy compatability */
5522         if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
5523             ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
5524                 IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
5525                                 "because of privacy mismatch: %s != %s.\n",
5526                                 escape_essid(network->ssid, network->ssid_len),
5527                                 network->bssid,
5528                                 priv->
5529                                 capability & CAP_PRIVACY_ON ? "on" : "off",
5530                                 network->
5531                                 capability & WLAN_CAPABILITY_PRIVACY ? "on" :
5532                                 "off");
5533                 return 0;
5534         }
5535
5536         if (!memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
5537                 IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
5538                                 "because of the same BSSID match: %pM"
5539                                 ".\n", escape_essid(network->ssid,
5540                                                     network->ssid_len),
5541                                 network->bssid,
5542                                 priv->bssid);
5543                 return 0;
5544         }
5545
5546         /* Filter out any incompatible freq / mode combinations */
5547         if (!ieee80211_is_valid_mode(priv->ieee, network->mode)) {
5548                 IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
5549                                 "because of invalid frequency/mode "
5550                                 "combination.\n",
5551                                 escape_essid(network->ssid, network->ssid_len),
5552                                 network->bssid);
5553                 return 0;
5554         }
5555
5556         /* Ensure that the rates supported by the driver are compatible with
5557          * this AP, including verification of basic rates (mandatory) */
5558         if (!ipw_compatible_rates(priv, network, &rates)) {
5559                 IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
5560                                 "because configured rate mask excludes "
5561                                 "AP mandatory rate.\n",
5562                                 escape_essid(network->ssid, network->ssid_len),
5563                                 network->bssid);
5564                 return 0;
5565         }
5566
5567         if (rates.num_rates == 0) {
5568                 IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
5569                                 "because of no compatible rates.\n",
5570                                 escape_essid(network->ssid, network->ssid_len),
5571                                 network->bssid);
5572                 return 0;
5573         }
5574
5575         /* TODO: Perform any further minimal comparititive tests.  We do not
5576          * want to put too much policy logic here; intelligent scan selection
5577          * should occur within a generic IEEE 802.11 user space tool.  */
5578
5579         /* Set up 'new' AP to this network */
5580         ipw_copy_rates(&match->rates, &rates);
5581         match->network = network;
5582         IPW_DEBUG_MERGE("Network '%s (%pM)' is a viable match.\n",
5583                         escape_essid(network->ssid, network->ssid_len),
5584                         network->bssid);
5585
5586         return 1;
5587 }
5588
5589 static void ipw_merge_adhoc_network(struct work_struct *work)
5590 {
5591         struct ipw_priv *priv =
5592                 container_of(work, struct ipw_priv, merge_networks);
5593         struct ieee80211_network *network = NULL;
5594         struct ipw_network_match match = {
5595                 .network = priv->assoc_network
5596         };
5597
5598         if ((priv->status & STATUS_ASSOCIATED) &&
5599             (priv->ieee->iw_mode == IW_MODE_ADHOC)) {
5600                 /* First pass through ROAM process -- look for a better
5601                  * network */
5602                 unsigned long flags;
5603
5604                 spin_lock_irqsave(&priv->ieee->lock, flags);
5605                 list_for_each_entry(network, &priv->ieee->network_list, list) {
5606                         if (network != priv->assoc_network)
5607                                 ipw_find_adhoc_network(priv, &match, network,
5608                                                        1);
5609                 }
5610                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
5611
5612                 if (match.network == priv->assoc_network) {
5613                         IPW_DEBUG_MERGE("No better ADHOC in this network to "
5614                                         "merge to.\n");
5615                         return;
5616                 }
5617
5618                 mutex_lock(&priv->mutex);
5619                 if ((priv->ieee->iw_mode == IW_MODE_ADHOC)) {
5620                         IPW_DEBUG_MERGE("remove network %s\n",
5621                                         escape_essid(priv->essid,
5622                                                      priv->essid_len));
5623                         ipw_remove_current_network(priv);
5624                 }
5625
5626                 ipw_disassociate(priv);
5627                 priv->assoc_network = match.network;
5628                 mutex_unlock(&priv->mutex);
5629                 return;
5630         }
5631 }
5632
5633 static int ipw_best_network(struct ipw_priv *priv,
5634                             struct ipw_network_match *match,
5635                             struct ieee80211_network *network, int roaming)
5636 {
5637         struct ipw_supported_rates rates;
5638
5639         /* Verify that this network's capability is compatible with the
5640          * current mode (AdHoc or Infrastructure) */
5641         if ((priv->ieee->iw_mode == IW_MODE_INFRA &&
5642              !(network->capability & WLAN_CAPABILITY_ESS)) ||
5643             (priv->ieee->iw_mode == IW_MODE_ADHOC &&
5644              !(network->capability & WLAN_CAPABILITY_IBSS))) {
5645                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded due to "
5646                                 "capability mismatch.\n",
5647                                 escape_essid(network->ssid, network->ssid_len),
5648                                 network->bssid);
5649                 return 0;
5650         }
5651
5652         /* If we do not have an ESSID for this AP, we can not associate with
5653          * it */
5654         if (network->flags & NETWORK_EMPTY_ESSID) {
5655                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
5656                                 "because of hidden ESSID.\n",
5657                                 escape_essid(network->ssid, network->ssid_len),
5658                                 network->bssid);
5659                 return 0;
5660         }
5661
5662         if (unlikely(roaming)) {
5663                 /* If we are roaming, then ensure check if this is a valid
5664                  * network to try and roam to */
5665                 if ((network->ssid_len != match->network->ssid_len) ||
5666                     memcmp(network->ssid, match->network->ssid,
5667                            network->ssid_len)) {
5668                         IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
5669                                         "because of non-network ESSID.\n",
5670                                         escape_essid(network->ssid,
5671                                                      network->ssid_len),
5672                                         network->bssid);
5673                         return 0;
5674                 }
5675         } else {
5676                 /* If an ESSID has been configured then compare the broadcast
5677                  * ESSID to ours */
5678                 if ((priv->config & CFG_STATIC_ESSID) &&
5679                     ((network->ssid_len != priv->essid_len) ||
5680                      memcmp(network->ssid, priv->essid,
5681                             min(network->ssid_len, priv->essid_len)))) {
5682                         char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
5683                         strncpy(escaped,
5684                                 escape_essid(network->ssid, network->ssid_len),
5685                                 sizeof(escaped));
5686                         IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
5687                                         "because of ESSID mismatch: '%s'.\n",
5688                                         escaped, network->bssid,
5689                                         escape_essid(priv->essid,
5690                                                      priv->essid_len));
5691                         return 0;
5692                 }
5693         }
5694
5695         /* If the old network rate is better than this one, don't bother
5696          * testing everything else. */
5697         if (match->network && match->network->stats.rssi > network->stats.rssi) {
5698                 char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
5699                 strncpy(escaped,
5700                         escape_essid(network->ssid, network->ssid_len),
5701                         sizeof(escaped));
5702                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded because "
5703                                 "'%s (%pM)' has a stronger signal.\n",
5704                                 escaped, network->bssid,
5705                                 escape_essid(match->network->ssid,
5706                                              match->network->ssid_len),
5707                                 match->network->bssid);
5708                 return 0;
5709         }
5710
5711         /* If this network has already had an association attempt within the
5712          * last 3 seconds, do not try and associate again... */
5713         if (network->last_associate &&
5714             time_after(network->last_associate + (HZ * 3UL), jiffies)) {
5715                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
5716                                 "because of storming (%ums since last "
5717                                 "assoc attempt).\n",
5718                                 escape_essid(network->ssid, network->ssid_len),
5719                                 network->bssid,
5720                                 jiffies_to_msecs(jiffies -
5721                                                  network->last_associate));
5722                 return 0;
5723         }
5724
5725         /* Now go through and see if the requested network is valid... */
5726         if (priv->ieee->scan_age != 0 &&
5727             time_after(jiffies, network->last_scanned + priv->ieee->scan_age)) {
5728                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
5729                                 "because of age: %ums.\n",
5730                                 escape_essid(network->ssid, network->ssid_len),
5731                                 network->bssid,
5732                                 jiffies_to_msecs(jiffies -
5733                                                  network->last_scanned));
5734                 return 0;
5735         }
5736
5737         if ((priv->config & CFG_STATIC_CHANNEL) &&
5738             (network->channel != priv->channel)) {
5739                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
5740                                 "because of channel mismatch: %d != %d.\n",
5741                                 escape_essid(network->ssid, network->ssid_len),
5742                                 network->bssid,
5743                                 network->channel, priv->channel);
5744                 return 0;
5745         }
5746
5747         /* Verify privacy compatability */
5748         if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
5749             ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
5750                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
5751                                 "because of privacy mismatch: %s != %s.\n",
5752                                 escape_essid(network->ssid, network->ssid_len),
5753                                 network->bssid,
5754                                 priv->capability & CAP_PRIVACY_ON ? "on" :
5755                                 "off",
5756                                 network->capability &
5757                                 WLAN_CAPABILITY_PRIVACY ? "on" : "off");
5758                 return 0;
5759         }
5760
5761         if ((priv->config & CFG_STATIC_BSSID) &&
5762             memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
5763                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
5764                                 "because of BSSID mismatch: %pM.\n",
5765                                 escape_essid(network->ssid, network->ssid_len),
5766                                 network->bssid, priv->bssid);
5767                 return 0;
5768         }
5769
5770         /* Filter out any incompatible freq / mode combinations */
5771         if (!ieee80211_is_valid_mode(priv->ieee, network->mode)) {
5772                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
5773                                 "because of invalid frequency/mode "
5774                                 "combination.\n",
5775                                 escape_essid(network->ssid, network->ssid_len),
5776                                 network->bssid);
5777                 return 0;
5778         }
5779
5780         /* Filter out invalid channel in current GEO */
5781         if (!ieee80211_is_valid_channel(priv->ieee, network->channel)) {
5782                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
5783                                 "because of invalid channel in current GEO\n",
5784                                 escape_essid(network->ssid, network->ssid_len),
5785                                 network->bssid);
5786                 return 0;
5787         }
5788
5789         /* Ensure that the rates supported by the driver are compatible with
5790          * this AP, including verification of basic rates (mandatory) */
5791         if (!ipw_compatible_rates(priv, network, &rates)) {
5792                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
5793                                 "because configured rate mask excludes "
5794                                 "AP mandatory rate.\n",
5795                                 escape_essid(network->ssid, network->ssid_len),
5796                                 network->bssid);
5797                 return 0;
5798         }
5799
5800         if (rates.num_rates == 0) {
5801                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
5802                                 "because of no compatible rates.\n",
5803                                 escape_essid(network->ssid, network->ssid_len),
5804                                 network->bssid);
5805                 return 0;
5806         }
5807
5808         /* TODO: Perform any further minimal comparititive tests.  We do not
5809          * want to put too much policy logic here; intelligent scan selection
5810          * should occur within a generic IEEE 802.11 user space tool.  */
5811
5812         /* Set up 'new' AP to this network */
5813         ipw_copy_rates(&match->rates, &rates);
5814         match->network = network;
5815
5816         IPW_DEBUG_ASSOC("Network '%s (%pM)' is a viable match.\n",
5817                         escape_essid(network->ssid, network->ssid_len),
5818                         network->bssid);
5819
5820         return 1;
5821 }
5822
5823 static void ipw_adhoc_create(struct ipw_priv *priv,
5824                              struct ieee80211_network *network)
5825 {
5826         const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
5827         int i;
5828
5829         /*
5830          * For the purposes of scanning, we can set our wireless mode
5831          * to trigger scans across combinations of bands, but when it
5832          * comes to creating a new ad-hoc network, we have tell the FW
5833          * exactly which band to use.
5834          *
5835          * We also have the possibility of an invalid channel for the
5836          * chossen band.  Attempting to create a new ad-hoc network
5837          * with an invalid channel for wireless mode will trigger a
5838          * FW fatal error.
5839          *
5840          */
5841         switch (ieee80211_is_valid_channel(priv->ieee, priv->channel)) {
5842         case IEEE80211_52GHZ_BAND:
5843                 network->mode = IEEE_A;
5844                 i = ieee80211_channel_to_index(priv->ieee, priv->channel);
5845                 BUG_ON(i == -1);
5846                 if (geo->a[i].flags & IEEE80211_CH_PASSIVE_ONLY) {
5847                         IPW_WARNING("Overriding invalid channel\n");
5848                         priv->channel = geo->a[0].channel;
5849                 }
5850                 break;
5851
5852         case IEEE80211_24GHZ_BAND:
5853                 if (priv->ieee->mode & IEEE_G)
5854                         network->mode = IEEE_G;
5855                 else
5856                         network->mode = IEEE_B;
5857                 i = ieee80211_channel_to_index(priv->ieee, priv->channel);
5858                 BUG_ON(i == -1);
5859                 if (geo->bg[i].flags & IEEE80211_CH_PASSIVE_ONLY) {
5860                         IPW_WARNING("Overriding invalid channel\n");
5861                         priv->channel = geo->bg[0].channel;
5862                 }
5863                 break;
5864
5865         default:
5866                 IPW_WARNING("Overriding invalid channel\n");
5867                 if (priv->ieee->mode & IEEE_A) {
5868                         network->mode = IEEE_A;
5869                         priv->channel = geo->a[0].channel;
5870                 } else if (priv->ieee->mode & IEEE_G) {
5871                         network->mode = IEEE_G;
5872                         priv->channel = geo->bg[0].channel;
5873                 } else {
5874                         network->mode = IEEE_B;
5875                         priv->channel = geo->bg[0].channel;
5876                 }
5877                 break;
5878         }
5879
5880         network->channel = priv->channel;
5881         priv->config |= CFG_ADHOC_PERSIST;
5882         ipw_create_bssid(priv, network->bssid);
5883         network->ssid_len = priv->essid_len;
5884         memcpy(network->ssid, priv->essid, priv->essid_len);
5885         memset(&network->stats, 0, sizeof(network->stats));
5886         network->capability = WLAN_CAPABILITY_IBSS;
5887         if (!(priv->config & CFG_PREAMBLE_LONG))
5888                 network->capability |= WLAN_CAPABILITY_SHORT_PREAMBLE;
5889         if (priv->capability & CAP_PRIVACY_ON)
5890                 network->capability |= WLAN_CAPABILITY_PRIVACY;
5891         network->rates_len = min(priv->rates.num_rates, MAX_RATES_LENGTH);
5892         memcpy(network->rates, priv->rates.supported_rates, network->rates_len);
5893         network->rates_ex_len = priv->rates.num_rates - network->rates_len;
5894         memcpy(network->rates_ex,
5895                &priv->rates.supported_rates[network->rates_len],
5896                network->rates_ex_len);
5897         network->last_scanned = 0;
5898         network->flags = 0;
5899         network->last_associate = 0;
5900         network->time_stamp[0] = 0;
5901         network->time_stamp[1] = 0;
5902         network->beacon_interval = 100; /* Default */
5903         network->listen_interval = 10;  /* Default */
5904         network->atim_window = 0;       /* Default */
5905         network->wpa_ie_len = 0;
5906         network->rsn_ie_len = 0;
5907 }
5908
5909 static void ipw_send_tgi_tx_key(struct ipw_priv *priv, int type, int index)
5910 {
5911         struct ipw_tgi_tx_key key;
5912
5913         if (!(priv->ieee->sec.flags & (1 << index)))
5914                 return;
5915
5916         key.key_id = index;
5917         memcpy(key.key, priv->ieee->sec.keys[index], SCM_TEMPORAL_KEY_LENGTH);
5918         key.security_type = type;
5919         key.station_index = 0;  /* always 0 for BSS */
5920         key.flags = 0;
5921         /* 0 for new key; previous value of counter (after fatal error) */
5922         key.tx_counter[0] = cpu_to_le32(0);
5923         key.tx_counter[1] = cpu_to_le32(0);
5924
5925         ipw_send_cmd_pdu(priv, IPW_CMD_TGI_TX_KEY, sizeof(key), &key);
5926 }
5927
5928 static void ipw_send_wep_keys(struct ipw_priv *priv, int type)
5929 {
5930         struct ipw_wep_key key;
5931         int i;
5932
5933         key.cmd_id = DINO_CMD_WEP_KEY;
5934         key.seq_num = 0;
5935
5936         /* Note: AES keys cannot be set for multiple times.
5937          * Only set it at the first time. */
5938         for (i = 0; i < 4; i++) {
5939                 key.key_index = i | type;
5940                 if (!(priv->ieee->sec.flags & (1 << i))) {
5941                         key.key_size = 0;
5942                         continue;
5943                 }
5944
5945                 key.key_size = priv->ieee->sec.key_sizes[i];
5946                 memcpy(key.key, priv->ieee->sec.keys[i], key.key_size);
5947
5948                 ipw_send_cmd_pdu(priv, IPW_CMD_WEP_KEY, sizeof(key), &key);
5949         }
5950 }
5951
5952 static void ipw_set_hw_decrypt_unicast(struct ipw_priv *priv, int level)
5953 {
5954         if (priv->ieee->host_encrypt)
5955                 return;
5956
5957         switch (level) {
5958         case SEC_LEVEL_3:
5959                 priv->sys_config.disable_unicast_decryption = 0;
5960                 priv->ieee->host_decrypt = 0;
5961                 break;
5962         case SEC_LEVEL_2:
5963                 priv->sys_config.disable_unicast_decryption = 1;
5964                 priv->ieee->host_decrypt = 1;
5965                 break;
5966         case SEC_LEVEL_1:
5967                 priv->sys_config.disable_unicast_decryption = 0;
5968                 priv->ieee->host_decrypt = 0;
5969                 break;
5970         case SEC_LEVEL_0:
5971                 priv->sys_config.disable_unicast_decryption = 1;
5972                 break;
5973         default:
5974                 break;
5975         }
5976 }
5977
5978 static void ipw_set_hw_decrypt_multicast(struct ipw_priv *priv, int level)
5979 {
5980         if (priv->ieee->host_encrypt)
5981                 return;
5982
5983         switch (level) {
5984         case SEC_LEVEL_3:
5985                 priv->sys_config.disable_multicast_decryption = 0;
5986                 break;
5987         case SEC_LEVEL_2:
5988                 priv->sys_config.disable_multicast_decryption = 1;
5989                 break;
5990         case SEC_LEVEL_1:
5991                 priv->sys_config.disable_multicast_decryption = 0;
5992                 break;
5993         case SEC_LEVEL_0:
5994                 priv->sys_config.disable_multicast_decryption = 1;
5995                 break;
5996         default:
5997                 break;
5998         }
5999 }
6000
6001 static void ipw_set_hwcrypto_keys(struct ipw_priv *priv)
6002 {
6003         switch (priv->ieee->sec.level) {
6004         case SEC_LEVEL_3:
6005                 if (priv->ieee->sec.flags & SEC_ACTIVE_KEY)
6006                         ipw_send_tgi_tx_key(priv,
6007                                             DCT_FLAG_EXT_SECURITY_CCM,
6008                                             priv->ieee->sec.active_key);
6009
6010                 if (!priv->ieee->host_mc_decrypt)
6011                         ipw_send_wep_keys(priv, DCW_WEP_KEY_SEC_TYPE_CCM);
6012                 break;
6013         case SEC_LEVEL_2:
6014                 if (priv->ieee->sec.flags & SEC_ACTIVE_KEY)
6015                         ipw_send_tgi_tx_key(priv,
6016                                             DCT_FLAG_EXT_SECURITY_TKIP,
6017                                             priv->ieee->sec.active_key);
6018                 break;
6019         case SEC_LEVEL_1:
6020                 ipw_send_wep_keys(priv, DCW_WEP_KEY_SEC_TYPE_WEP);
6021                 ipw_set_hw_decrypt_unicast(priv, priv->ieee->sec.level);
6022                 ipw_set_hw_decrypt_multicast(priv, priv->ieee->sec.level);
6023                 break;
6024         case SEC_LEVEL_0:
6025         default:
6026                 break;
6027         }
6028 }
6029
6030 static void ipw_adhoc_check(void *data)
6031 {
6032         struct ipw_priv *priv = data;
6033
6034         if (priv->missed_adhoc_beacons++ > priv->disassociate_threshold &&
6035             !(priv->config & CFG_ADHOC_PERSIST)) {
6036                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
6037                           IPW_DL_STATE | IPW_DL_ASSOC,
6038                           "Missed beacon: %d - disassociate\n",
6039                           priv->missed_adhoc_beacons);
6040                 ipw_remove_current_network(priv);
6041                 ipw_disassociate(priv);
6042                 return;
6043         }
6044
6045         queue_delayed_work(priv->workqueue, &priv->adhoc_check,
6046                            le16_to_cpu(priv->assoc_request.beacon_interval));
6047 }
6048
6049 static void ipw_bg_adhoc_check(struct work_struct *work)
6050 {
6051         struct ipw_priv *priv =
6052                 container_of(work, struct ipw_priv, adhoc_check.work);
6053         mutex_lock(&priv->mutex);
6054         ipw_adhoc_check(priv);
6055         mutex_unlock(&priv->mutex);
6056 }
6057
6058 static void ipw_debug_config(struct ipw_priv *priv)
6059 {
6060         IPW_DEBUG_INFO("Scan completed, no valid APs matched "
6061                        "[CFG 0x%08X]\n", priv->config);
6062         if (priv->config & CFG_STATIC_CHANNEL)
6063                 IPW_DEBUG_INFO("Channel locked to %d\n", priv->channel);
6064         else
6065                 IPW_DEBUG_INFO("Channel unlocked.\n");
6066         if (priv->config & CFG_STATIC_ESSID)
6067                 IPW_DEBUG_INFO("ESSID locked to '%s'\n",
6068                                escape_essid(priv->essid, priv->essid_len));
6069         else
6070                 IPW_DEBUG_INFO("ESSID unlocked.\n");
6071         if (priv->config & CFG_STATIC_BSSID)
6072                 IPW_DEBUG_INFO("BSSID locked to %pM\n", priv->bssid);
6073         else
6074                 IPW_DEBUG_INFO("BSSID unlocked.\n");
6075         if (priv->capability & CAP_PRIVACY_ON)
6076                 IPW_DEBUG_INFO("PRIVACY on\n");
6077         else
6078                 IPW_DEBUG_INFO("PRIVACY off\n");
6079         IPW_DEBUG_INFO("RATE MASK: 0x%08X\n", priv->rates_mask);
6080 }
6081
6082 static void ipw_set_fixed_rate(struct ipw_priv *priv, int mode)
6083 {
6084         /* TODO: Verify that this works... */
6085         struct ipw_fixed_rate fr = {
6086                 .tx_rates = priv->rates_mask
6087         };
6088         u32 reg;
6089         u16 mask = 0;
6090
6091         /* Identify 'current FW band' and match it with the fixed
6092          * Tx rates */
6093
6094         switch (priv->ieee->freq_band) {
6095         case IEEE80211_52GHZ_BAND:      /* A only */
6096                 /* IEEE_A */
6097                 if (priv->rates_mask & ~IEEE80211_OFDM_RATES_MASK) {
6098                         /* Invalid fixed rate mask */
6099                         IPW_DEBUG_WX
6100                             ("invalid fixed rate mask in ipw_set_fixed_rate\n");
6101                         fr.tx_rates = 0;
6102                         break;
6103                 }
6104
6105                 fr.tx_rates >>= IEEE80211_OFDM_SHIFT_MASK_A;
6106                 break;
6107
6108         default:                /* 2.4Ghz or Mixed */
6109                 /* IEEE_B */
6110                 if (mode == IEEE_B) {
6111                         if (fr.tx_rates & ~IEEE80211_CCK_RATES_MASK) {
6112                                 /* Invalid fixed rate mask */
6113                                 IPW_DEBUG_WX
6114                                     ("invalid fixed rate mask in ipw_set_fixed_rate\n");
6115                                 fr.tx_rates = 0;
6116                         }
6117                         break;
6118                 }
6119
6120                 /* IEEE_G */
6121                 if (fr.tx_rates & ~(IEEE80211_CCK_RATES_MASK |
6122                                     IEEE80211_OFDM_RATES_MASK)) {
6123                         /* Invalid fixed rate mask */
6124                         IPW_DEBUG_WX
6125                             ("invalid fixed rate mask in ipw_set_fixed_rate\n");
6126                         fr.tx_rates = 0;
6127                         break;
6128                 }
6129
6130                 if (IEEE80211_OFDM_RATE_6MB_MASK & fr.tx_rates) {
6131                         mask |= (IEEE80211_OFDM_RATE_6MB_MASK >> 1);
6132                         fr.tx_rates &= ~IEEE80211_OFDM_RATE_6MB_MASK;
6133                 }
6134
6135                 if (IEEE80211_OFDM_RATE_9MB_MASK & fr.tx_rates) {
6136                         mask |= (IEEE80211_OFDM_RATE_9MB_MASK >> 1);
6137                         fr.tx_rates &= ~IEEE80211_OFDM_RATE_9MB_MASK;
6138                 }
6139
6140                 if (IEEE80211_OFDM_RATE_12MB_MASK & fr.tx_rates) {
6141                         mask |= (IEEE80211_OFDM_RATE_12MB_MASK >> 1);
6142                         fr.tx_rates &= ~IEEE80211_OFDM_RATE_12MB_MASK;
6143                 }
6144
6145                 fr.tx_rates |= mask;
6146                 break;
6147         }
6148
6149         reg = ipw_read32(priv, IPW_MEM_FIXED_OVERRIDE);
6150         ipw_write_reg32(priv, reg, *(u32 *) & fr);
6151 }
6152
6153 static void ipw_abort_scan(struct ipw_priv *priv)
6154 {
6155         int err;
6156
6157         if (priv->status & STATUS_SCAN_ABORTING) {
6158                 IPW_DEBUG_HC("Ignoring concurrent scan abort request.\n");
6159                 return;
6160         }
6161         priv->status |= STATUS_SCAN_ABORTING;
6162
6163         err = ipw_send_scan_abort(priv);
6164         if (err)
6165                 IPW_DEBUG_HC("Request to abort scan failed.\n");
6166 }
6167
6168 static void ipw_add_scan_channels(struct ipw_priv *priv,
6169                                   struct ipw_scan_request_ext *scan,
6170                                   int scan_type)
6171 {
6172         int channel_index = 0;
6173         const struct ieee80211_geo *geo;
6174         int i;
6175
6176         geo = ieee80211_get_geo(priv->ieee);
6177
6178         if (priv->ieee->freq_band & IEEE80211_52GHZ_BAND) {
6179                 int start = channel_index;
6180                 for (i = 0; i < geo->a_channels; i++) {
6181                         if ((priv->status & STATUS_ASSOCIATED) &&
6182                             geo->a[i].channel == priv->channel)
6183                                 continue;
6184                         channel_index++;
6185                         scan->channels_list[channel_index] = geo->a[i].channel;
6186                         ipw_set_scan_type(scan, channel_index,
6187                                           geo->a[i].
6188                                           flags & IEEE80211_CH_PASSIVE_ONLY ?
6189                                           IPW_SCAN_PASSIVE_FULL_DWELL_SCAN :
6190                                           scan_type);
6191                 }
6192
6193                 if (start != channel_index) {
6194                         scan->channels_list[start] = (u8) (IPW_A_MODE << 6) |
6195                             (channel_index - start);
6196                         channel_index++;
6197                 }
6198         }
6199
6200         if (priv->ieee->freq_band & IEEE80211_24GHZ_BAND) {
6201                 int start = channel_index;
6202                 if (priv->config & CFG_SPEED_SCAN) {
6203                         int index;
6204                         u8 channels[IEEE80211_24GHZ_CHANNELS] = {
6205                                 /* nop out the list */
6206                                 [0] = 0
6207                         };
6208
6209                         u8 channel;
6210                         while (channel_index < IPW_SCAN_CHANNELS) {
6211                                 channel =
6212                                     priv->speed_scan[priv->speed_scan_pos];
6213                                 if (channel == 0) {
6214                                         priv->speed_scan_pos = 0;
6215                                         channel = priv->speed_scan[0];
6216                                 }
6217                                 if ((priv->status & STATUS_ASSOCIATED) &&
6218                                     channel == priv->channel) {
6219                                         priv->speed_scan_pos++;
6220                                         continue;
6221                                 }
6222
6223                                 /* If this channel has already been
6224                                  * added in scan, break from loop
6225                                  * and this will be the first channel
6226                                  * in the next scan.
6227                                  */
6228                                 if (channels[channel - 1] != 0)
6229                                         break;
6230
6231                                 channels[channel - 1] = 1;
6232                                 priv->speed_scan_pos++;
6233                                 channel_index++;
6234                                 scan->channels_list[channel_index] = channel;
6235                                 index =
6236                                     ieee80211_channel_to_index(priv->ieee, channel);
6237                                 ipw_set_scan_type(scan, channel_index,
6238                                                   geo->bg[index].
6239                                                   flags &
6240                                                   IEEE80211_CH_PASSIVE_ONLY ?
6241                                                   IPW_SCAN_PASSIVE_FULL_DWELL_SCAN
6242                                                   : scan_type);
6243                         }
6244                 } else {
6245                         for (i = 0; i < geo->bg_channels; i++) {
6246                                 if ((priv->status & STATUS_ASSOCIATED) &&
6247                                     geo->bg[i].channel == priv->channel)
6248                                         continue;
6249                                 channel_index++;
6250                                 scan->channels_list[channel_index] =
6251                                     geo->bg[i].channel;
6252                                 ipw_set_scan_type(scan, channel_index,
6253                                                   geo->bg[i].
6254                                                   flags &
6255                                                   IEEE80211_CH_PASSIVE_ONLY ?
6256                                                   IPW_SCAN_PASSIVE_FULL_DWELL_SCAN
6257                                                   : scan_type);
6258                         }
6259                 }
6260
6261                 if (start != channel_index) {
6262                         scan->channels_list[start] = (u8) (IPW_B_MODE << 6) |
6263                             (channel_index - start);
6264                 }
6265         }
6266 }
6267
6268 static int ipw_request_scan_helper(struct ipw_priv *priv, int type, int direct)
6269 {
6270         struct ipw_scan_request_ext scan;
6271         int err = 0, scan_type;
6272
6273         if (!(priv->status & STATUS_INIT) ||
6274             (priv->status & STATUS_EXIT_PENDING))
6275                 return 0;
6276
6277         mutex_lock(&priv->mutex);
6278
6279         if (direct && (priv->direct_scan_ssid_len == 0)) {
6280                 IPW_DEBUG_HC("Direct scan requested but no SSID to scan for\n");
6281                 priv->status &= ~STATUS_DIRECT_SCAN_PENDING;
6282                 goto done;
6283         }
6284
6285         if (priv->status & STATUS_SCANNING) {
6286                 IPW_DEBUG_HC("Concurrent scan requested.  Queuing.\n");
6287                 priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
6288                                         STATUS_SCAN_PENDING;
6289                 goto done;
6290         }
6291
6292         if (!(priv->status & STATUS_SCAN_FORCED) &&
6293             priv->status & STATUS_SCAN_ABORTING) {
6294                 IPW_DEBUG_HC("Scan request while abort pending.  Queuing.\n");
6295                 priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
6296                                         STATUS_SCAN_PENDING;
6297                 goto done;
6298         }
6299
6300         if (priv->status & STATUS_RF_KILL_MASK) {
6301                 IPW_DEBUG_HC("Queuing scan due to RF Kill activation\n");
6302                 priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
6303                                         STATUS_SCAN_PENDING;
6304                 goto done;
6305         }
6306
6307         memset(&scan, 0, sizeof(scan));
6308         scan.full_scan_index = cpu_to_le32(ieee80211_get_scans(priv->ieee));
6309
6310         if (type == IW_SCAN_TYPE_PASSIVE) {
6311                 IPW_DEBUG_WX("use passive scanning\n");
6312                 scan_type = IPW_SCAN_PASSIVE_FULL_DWELL_SCAN;
6313                 scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] =
6314                         cpu_to_le16(120);
6315                 ipw_add_scan_channels(priv, &scan, scan_type);
6316                 goto send_request;
6317         }
6318
6319         /* Use active scan by default. */
6320         if (priv->config & CFG_SPEED_SCAN)
6321                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
6322                         cpu_to_le16(30);
6323         else
6324                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
6325                         cpu_to_le16(20);
6326
6327         scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN] =
6328                 cpu_to_le16(20);
6329
6330         scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = cpu_to_le16(120);
6331         scan.dwell_time[IPW_SCAN_ACTIVE_DIRECT_SCAN] = cpu_to_le16(20);
6332
6333 #ifdef CONFIG_IPW2200_MONITOR
6334         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
6335                 u8 channel;
6336                 u8 band = 0;
6337
6338                 switch (ieee80211_is_valid_channel(priv->ieee, priv->channel)) {
6339                 case IEEE80211_52GHZ_BAND:
6340                         band = (u8) (IPW_A_MODE << 6) | 1;
6341                         channel = priv->channel;
6342                         break;
6343
6344                 case IEEE80211_24GHZ_BAND:
6345                         band = (u8) (IPW_B_MODE << 6) | 1;
6346                         channel = priv->channel;
6347                         break;
6348
6349                 default:
6350                         band = (u8) (IPW_B_MODE << 6) | 1;
6351                         channel = 9;
6352                         break;
6353                 }
6354
6355                 scan.channels_list[0] = band;
6356                 scan.channels_list[1] = channel;
6357                 ipw_set_scan_type(&scan, 1, IPW_SCAN_PASSIVE_FULL_DWELL_SCAN);
6358
6359                 /* NOTE:  The card will sit on this channel for this time
6360                  * period.  Scan aborts are timing sensitive and frequently
6361                  * result in firmware restarts.  As such, it is best to
6362                  * set a small dwell_time here and just keep re-issuing
6363                  * scans.  Otherwise fast channel hopping will not actually
6364                  * hop channels.
6365                  *
6366                  * TODO: Move SPEED SCAN support to all modes and bands */
6367                 scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] =
6368                         cpu_to_le16(2000);
6369         } else {
6370 #endif                          /* CONFIG_IPW2200_MONITOR */
6371                 /* Honor direct scans first, otherwise if we are roaming make
6372                  * this a direct scan for the current network.  Finally,
6373                  * ensure that every other scan is a fast channel hop scan */
6374                 if (direct) {
6375                         err = ipw_send_ssid(priv, priv->direct_scan_ssid,
6376                                             priv->direct_scan_ssid_len);
6377                         if (err) {
6378                                 IPW_DEBUG_HC("Attempt to send SSID command  "
6379                                              "failed\n");
6380                                 goto done;
6381                         }
6382
6383                         scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
6384                 } else if ((priv->status & STATUS_ROAMING)
6385                            || (!(priv->status & STATUS_ASSOCIATED)
6386                                && (priv->config & CFG_STATIC_ESSID)
6387                                && (le32_to_cpu(scan.full_scan_index) % 2))) {
6388                         err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
6389                         if (err) {
6390                                 IPW_DEBUG_HC("Attempt to send SSID command "
6391                                              "failed.\n");
6392                                 goto done;
6393                         }
6394
6395                         scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
6396                 } else
6397                         scan_type = IPW_SCAN_ACTIVE_BROADCAST_SCAN;
6398
6399                 ipw_add_scan_channels(priv, &scan, scan_type);
6400 #ifdef CONFIG_IPW2200_MONITOR
6401         }
6402 #endif
6403
6404 send_request:
6405         err = ipw_send_scan_request_ext(priv, &scan);
6406         if (err) {
6407                 IPW_DEBUG_HC("Sending scan command failed: %08X\n", err);
6408                 goto done;
6409         }
6410
6411         priv->status |= STATUS_SCANNING;
6412         if (direct) {
6413                 priv->status &= ~STATUS_DIRECT_SCAN_PENDING;
6414                 priv->direct_scan_ssid_len = 0;
6415         } else
6416                 priv->status &= ~STATUS_SCAN_PENDING;
6417
6418         queue_delayed_work(priv->workqueue, &priv->scan_check,
6419                            IPW_SCAN_CHECK_WATCHDOG);
6420 done:
6421         mutex_unlock(&priv->mutex);
6422         return err;
6423 }
6424
6425 static void ipw_request_passive_scan(struct work_struct *work)
6426 {
6427         struct ipw_priv *priv =
6428                 container_of(work, struct ipw_priv, request_passive_scan.work);
6429         ipw_request_scan_helper(priv, IW_SCAN_TYPE_PASSIVE, 0);
6430 }
6431
6432 static void ipw_request_scan(struct work_struct *work)
6433 {
6434         struct ipw_priv *priv =
6435                 container_of(work, struct ipw_priv, request_scan.work);
6436         ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE, 0);
6437 }
6438
6439 static void ipw_request_direct_scan(struct work_struct *work)
6440 {
6441         struct ipw_priv *priv =
6442                 container_of(work, struct ipw_priv, request_direct_scan.work);
6443         ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE, 1);
6444 }
6445
6446 static void ipw_bg_abort_scan(struct work_struct *work)
6447 {
6448         struct ipw_priv *priv =
6449                 container_of(work, struct ipw_priv, abort_scan);
6450         mutex_lock(&priv->mutex);
6451         ipw_abort_scan(priv);
6452         mutex_unlock(&priv->mutex);
6453 }
6454
6455 static int ipw_wpa_enable(struct ipw_priv *priv, int value)
6456 {
6457         /* This is called when wpa_supplicant loads and closes the driver
6458          * interface. */
6459         priv->ieee->wpa_enabled = value;
6460         return 0;
6461 }
6462
6463 static int ipw_wpa_set_auth_algs(struct ipw_priv *priv, int value)
6464 {
6465         struct ieee80211_device *ieee = priv->ieee;
6466         struct ieee80211_security sec = {
6467                 .flags = SEC_AUTH_MODE,
6468         };
6469         int ret = 0;
6470
6471         if (value & IW_AUTH_ALG_SHARED_KEY) {
6472                 sec.auth_mode = WLAN_AUTH_SHARED_KEY;
6473                 ieee->open_wep = 0;
6474         } else if (value & IW_AUTH_ALG_OPEN_SYSTEM) {
6475                 sec.auth_mode = WLAN_AUTH_OPEN;
6476                 ieee->open_wep = 1;
6477         } else if (value & IW_AUTH_ALG_LEAP) {
6478                 sec.auth_mode = WLAN_AUTH_LEAP;
6479                 ieee->open_wep = 1;
6480         } else
6481                 return -EINVAL;
6482
6483         if (ieee->set_security)
6484                 ieee->set_security(ieee->dev, &sec);
6485         else
6486                 ret = -EOPNOTSUPP;
6487
6488         return ret;
6489 }
6490
6491 static void ipw_wpa_assoc_frame(struct ipw_priv *priv, char *wpa_ie,
6492                                 int wpa_ie_len)
6493 {
6494         /* make sure WPA is enabled */
6495         ipw_wpa_enable(priv, 1);
6496 }
6497
6498 static int ipw_set_rsn_capa(struct ipw_priv *priv,
6499                             char *capabilities, int length)
6500 {
6501         IPW_DEBUG_HC("HOST_CMD_RSN_CAPABILITIES\n");
6502
6503         return ipw_send_cmd_pdu(priv, IPW_CMD_RSN_CAPABILITIES, length,
6504                                 capabilities);
6505 }
6506
6507 /*
6508  * WE-18 support
6509  */
6510
6511 /* SIOCSIWGENIE */
6512 static int ipw_wx_set_genie(struct net_device *dev,
6513                             struct iw_request_info *info,
6514                             union iwreq_data *wrqu, char *extra)
6515 {
6516         struct ipw_priv *priv = ieee80211_priv(dev);
6517         struct ieee80211_device *ieee = priv->ieee;
6518         u8 *buf;
6519         int err = 0;
6520
6521         if (wrqu->data.length > MAX_WPA_IE_LEN ||
6522             (wrqu->data.length && extra == NULL))
6523                 return -EINVAL;
6524
6525         if (wrqu->data.length) {
6526                 buf = kmalloc(wrqu->data.length, GFP_KERNEL);
6527                 if (buf == NULL) {
6528                         err = -ENOMEM;
6529                         goto out;
6530                 }
6531
6532                 memcpy(buf, extra, wrqu->data.length);
6533                 kfree(ieee->wpa_ie);
6534                 ieee->wpa_ie = buf;
6535                 ieee->wpa_ie_len = wrqu->data.length;
6536         } else {
6537                 kfree(ieee->wpa_ie);
6538                 ieee->wpa_ie = NULL;
6539                 ieee->wpa_ie_len = 0;
6540         }
6541
6542         ipw_wpa_assoc_frame(priv, ieee->wpa_ie, ieee->wpa_ie_len);
6543       out:
6544         return err;
6545 }
6546
6547 /* SIOCGIWGENIE */
6548 static int ipw_wx_get_genie(struct net_device *dev,
6549                             struct iw_request_info *info,
6550                             union iwreq_data *wrqu, char *extra)
6551 {
6552         struct ipw_priv *priv = ieee80211_priv(dev);
6553         struct ieee80211_device *ieee = priv->ieee;
6554         int err = 0;
6555
6556         if (ieee->wpa_ie_len == 0 || ieee->wpa_ie == NULL) {
6557                 wrqu->data.length = 0;
6558                 goto out;
6559         }
6560
6561         if (wrqu->data.length < ieee->wpa_ie_len) {
6562                 err = -E2BIG;
6563                 goto out;
6564         }
6565
6566         wrqu->data.length = ieee->wpa_ie_len;
6567         memcpy(extra, ieee->wpa_ie, ieee->wpa_ie_len);
6568
6569       out:
6570         return err;
6571 }
6572
6573 static int wext_cipher2level(int cipher)
6574 {
6575         switch (cipher) {
6576         case IW_AUTH_CIPHER_NONE:
6577                 return SEC_LEVEL_0;
6578         case IW_AUTH_CIPHER_WEP40:
6579         case IW_AUTH_CIPHER_WEP104:
6580                 return SEC_LEVEL_1;
6581         case IW_AUTH_CIPHER_TKIP:
6582                 return SEC_LEVEL_2;
6583         case IW_AUTH_CIPHER_CCMP:
6584                 return SEC_LEVEL_3;
6585         default:
6586                 return -1;
6587         }
6588 }
6589
6590 /* SIOCSIWAUTH */
6591 static int ipw_wx_set_auth(struct net_device *dev,
6592                            struct iw_request_info *info,
6593                            union iwreq_data *wrqu, char *extra)
6594 {
6595         struct ipw_priv *priv = ieee80211_priv(dev);
6596         struct ieee80211_device *ieee = priv->ieee;
6597         struct iw_param *param = &wrqu->param;
6598         struct ieee80211_crypt_data *crypt;
6599         unsigned long flags;
6600         int ret = 0;
6601
6602         switch (param->flags & IW_AUTH_INDEX) {
6603         case IW_AUTH_WPA_VERSION:
6604                 break;
6605         case IW_AUTH_CIPHER_PAIRWISE:
6606                 ipw_set_hw_decrypt_unicast(priv,
6607                                            wext_cipher2level(param->value));
6608                 break;
6609         case IW_AUTH_CIPHER_GROUP:
6610                 ipw_set_hw_decrypt_multicast(priv,
6611                                              wext_cipher2level(param->value));
6612                 break;
6613         case IW_AUTH_KEY_MGMT:
6614                 /*
6615                  * ipw2200 does not use these parameters
6616                  */
6617                 break;
6618
6619         case IW_AUTH_TKIP_COUNTERMEASURES:
6620                 crypt = priv->ieee->crypt[priv->ieee->tx_keyidx];
6621                 if (!crypt || !crypt->ops->set_flags || !crypt->ops->get_flags)
6622                         break;
6623
6624                 flags = crypt->ops->get_flags(crypt->priv);
6625
6626                 if (param->value)
6627                         flags |= IEEE80211_CRYPTO_TKIP_COUNTERMEASURES;
6628                 else
6629                         flags &= ~IEEE80211_CRYPTO_TKIP_COUNTERMEASURES;
6630
6631                 crypt->ops->set_flags(flags, crypt->priv);
6632
6633                 break;
6634
6635         case IW_AUTH_DROP_UNENCRYPTED:{
6636                         /* HACK:
6637                          *
6638                          * wpa_supplicant calls set_wpa_enabled when the driver
6639                          * is loaded and unloaded, regardless of if WPA is being
6640                          * used.  No other calls are made which can be used to
6641                          * determine if encryption will be used or not prior to
6642                          * association being expected.  If encryption is not being
6643                          * used, drop_unencrypted is set to false, else true -- we
6644                          * can use this to determine if the CAP_PRIVACY_ON bit should
6645                          * be set.
6646                          */
6647                         struct ieee80211_security sec = {
6648                                 .flags = SEC_ENABLED,
6649                                 .enabled = param->value,
6650                         };
6651                         priv->ieee->drop_unencrypted = param->value;
6652                         /* We only change SEC_LEVEL for open mode. Others
6653                          * are set by ipw_wpa_set_encryption.
6654                          */
6655                         if (!param->value) {
6656                                 sec.flags |= SEC_LEVEL;
6657                                 sec.level = SEC_LEVEL_0;
6658                         } else {
6659                                 sec.flags |= SEC_LEVEL;
6660                                 sec.level = SEC_LEVEL_1;
6661                         }
6662                         if (priv->ieee->set_security)
6663                                 priv->ieee->set_security(priv->ieee->dev, &sec);
6664                         break;
6665                 }
6666
6667         case IW_AUTH_80211_AUTH_ALG:
6668                 ret = ipw_wpa_set_auth_algs(priv, param->value);
6669                 break;
6670
6671         case IW_AUTH_WPA_ENABLED:
6672                 ret = ipw_wpa_enable(priv, param->value);
6673                 ipw_disassociate(priv);
6674                 break;
6675
6676         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
6677                 ieee->ieee802_1x = param->value;
6678                 break;
6679
6680         case IW_AUTH_PRIVACY_INVOKED:
6681                 ieee->privacy_invoked = param->value;
6682                 break;
6683
6684         default:
6685                 return -EOPNOTSUPP;
6686         }
6687         return ret;
6688 }
6689
6690 /* SIOCGIWAUTH */
6691 static int ipw_wx_get_auth(struct net_device *dev,
6692                            struct iw_request_info *info,
6693                            union iwreq_data *wrqu, char *extra)
6694 {
6695         struct ipw_priv *priv = ieee80211_priv(dev);
6696         struct ieee80211_device *ieee = priv->ieee;
6697         struct ieee80211_crypt_data *crypt;
6698         struct iw_param *param = &wrqu->param;
6699         int ret = 0;
6700
6701         switch (param->flags & IW_AUTH_INDEX) {
6702         case IW_AUTH_WPA_VERSION:
6703         case IW_AUTH_CIPHER_PAIRWISE:
6704         case IW_AUTH_CIPHER_GROUP:
6705         case IW_AUTH_KEY_MGMT:
6706                 /*
6707                  * wpa_supplicant will control these internally
6708                  */
6709                 ret = -EOPNOTSUPP;
6710                 break;
6711
6712         case IW_AUTH_TKIP_COUNTERMEASURES:
6713                 crypt = priv->ieee->crypt[priv->ieee->tx_keyidx];
6714                 if (!crypt || !crypt->ops->get_flags)
6715                         break;
6716
6717                 param->value = (crypt->ops->get_flags(crypt->priv) &
6718                                 IEEE80211_CRYPTO_TKIP_COUNTERMEASURES) ? 1 : 0;
6719
6720                 break;
6721
6722         case IW_AUTH_DROP_UNENCRYPTED:
6723                 param->value = ieee->drop_unencrypted;
6724                 break;
6725
6726         case IW_AUTH_80211_AUTH_ALG:
6727                 param->value = ieee->sec.auth_mode;
6728                 break;
6729
6730         case IW_AUTH_WPA_ENABLED:
6731                 param->value = ieee->wpa_enabled;
6732                 break;
6733
6734         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
6735                 param->value = ieee->ieee802_1x;
6736                 break;
6737
6738         case IW_AUTH_ROAMING_CONTROL:
6739         case IW_AUTH_PRIVACY_INVOKED:
6740                 param->value = ieee->privacy_invoked;
6741                 break;
6742
6743         default:
6744                 return -EOPNOTSUPP;
6745         }
6746         return 0;
6747 }
6748
6749 /* SIOCSIWENCODEEXT */
6750 static int ipw_wx_set_encodeext(struct net_device *dev,
6751                                 struct iw_request_info *info,
6752                                 union iwreq_data *wrqu, char *extra)
6753 {
6754         struct ipw_priv *priv = ieee80211_priv(dev);
6755         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
6756
6757         if (hwcrypto) {
6758                 if (ext->alg == IW_ENCODE_ALG_TKIP) {
6759                         /* IPW HW can't build TKIP MIC,
6760                            host decryption still needed */
6761                         if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY)
6762                                 priv->ieee->host_mc_decrypt = 1;
6763                         else {
6764                                 priv->ieee->host_encrypt = 0;
6765                                 priv->ieee->host_encrypt_msdu = 1;
6766                                 priv->ieee->host_decrypt = 1;
6767                         }
6768                 } else {
6769                         priv->ieee->host_encrypt = 0;
6770                         priv->ieee->host_encrypt_msdu = 0;
6771                         priv->ieee->host_decrypt = 0;
6772                         priv->ieee->host_mc_decrypt = 0;
6773                 }
6774         }
6775
6776         return ieee80211_wx_set_encodeext(priv->ieee, info, wrqu, extra);
6777 }
6778
6779 /* SIOCGIWENCODEEXT */
6780 static int ipw_wx_get_encodeext(struct net_device *dev,
6781                                 struct iw_request_info *info,
6782                                 union iwreq_data *wrqu, char *extra)
6783 {
6784         struct ipw_priv *priv = ieee80211_priv(dev);
6785         return ieee80211_wx_get_encodeext(priv->ieee, info, wrqu, extra);
6786 }
6787
6788 /* SIOCSIWMLME */
6789 static int ipw_wx_set_mlme(struct net_device *dev,
6790                            struct iw_request_info *info,
6791                            union iwreq_data *wrqu, char *extra)
6792 {
6793         struct ipw_priv *priv = ieee80211_priv(dev);
6794         struct iw_mlme *mlme = (struct iw_mlme *)extra;
6795         __le16 reason;
6796
6797         reason = cpu_to_le16(mlme->reason_code);
6798
6799         switch (mlme->cmd) {
6800         case IW_MLME_DEAUTH:
6801                 /* silently ignore */
6802                 break;
6803
6804         case IW_MLME_DISASSOC:
6805                 ipw_disassociate(priv);
6806                 break;
6807
6808         default:
6809                 return -EOPNOTSUPP;
6810         }
6811         return 0;
6812 }
6813
6814 #ifdef CONFIG_IPW2200_QOS
6815
6816 /* QoS */
6817 /*
6818 * get the modulation type of the current network or
6819 * the card current mode
6820 */
6821 static u8 ipw_qos_current_mode(struct ipw_priv * priv)
6822 {
6823         u8 mode = 0;
6824
6825         if (priv->status & STATUS_ASSOCIATED) {
6826                 unsigned long flags;
6827
6828                 spin_lock_irqsave(&priv->ieee->lock, flags);
6829                 mode = priv->assoc_network->mode;
6830                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
6831         } else {
6832                 mode = priv->ieee->mode;
6833         }
6834         IPW_DEBUG_QOS("QoS network/card mode %d \n", mode);
6835         return mode;
6836 }
6837
6838 /*
6839 * Handle management frame beacon and probe response
6840 */
6841 static int ipw_qos_handle_probe_response(struct ipw_priv *priv,
6842                                          int active_network,
6843                                          struct ieee80211_network *network)
6844 {
6845         u32 size = sizeof(struct ieee80211_qos_parameters);
6846
6847         if (network->capability & WLAN_CAPABILITY_IBSS)
6848                 network->qos_data.active = network->qos_data.supported;
6849
6850         if (network->flags & NETWORK_HAS_QOS_MASK) {
6851                 if (active_network &&
6852                     (network->flags & NETWORK_HAS_QOS_PARAMETERS))
6853                         network->qos_data.active = network->qos_data.supported;
6854
6855                 if ((network->qos_data.active == 1) && (active_network == 1) &&
6856                     (network->flags & NETWORK_HAS_QOS_PARAMETERS) &&
6857                     (network->qos_data.old_param_count !=
6858                      network->qos_data.param_count)) {
6859                         network->qos_data.old_param_count =
6860                             network->qos_data.param_count;
6861                         schedule_work(&priv->qos_activate);
6862                         IPW_DEBUG_QOS("QoS parameters change call "
6863                                       "qos_activate\n");
6864                 }
6865         } else {
6866                 if ((priv->ieee->mode == IEEE_B) || (network->mode == IEEE_B))
6867                         memcpy(&network->qos_data.parameters,
6868                                &def_parameters_CCK, size);
6869                 else
6870                         memcpy(&network->qos_data.parameters,
6871                                &def_parameters_OFDM, size);
6872
6873                 if ((network->qos_data.active == 1) && (active_network == 1)) {
6874                         IPW_DEBUG_QOS("QoS was disabled call qos_activate \n");
6875                         schedule_work(&priv->qos_activate);
6876                 }
6877
6878                 network->qos_data.active = 0;
6879                 network->qos_data.supported = 0;
6880         }
6881         if ((priv->status & STATUS_ASSOCIATED) &&
6882             (priv->ieee->iw_mode == IW_MODE_ADHOC) && (active_network == 0)) {
6883                 if (memcmp(network->bssid, priv->bssid, ETH_ALEN))
6884                         if ((network->capability & WLAN_CAPABILITY_IBSS) &&
6885                             !(network->flags & NETWORK_EMPTY_ESSID))
6886                                 if ((network->ssid_len ==
6887                                      priv->assoc_network->ssid_len) &&
6888                                     !memcmp(network->ssid,
6889                                             priv->assoc_network->ssid,
6890                                             network->ssid_len)) {
6891                                         queue_work(priv->workqueue,
6892                                                    &priv->merge_networks);
6893                                 }
6894         }
6895
6896         return 0;
6897 }
6898
6899 /*
6900 * This function set up the firmware to support QoS. It sends
6901 * IPW_CMD_QOS_PARAMETERS and IPW_CMD_WME_INFO
6902 */
6903 static int ipw_qos_activate(struct ipw_priv *priv,
6904                             struct ieee80211_qos_data *qos_network_data)
6905 {
6906         int err;
6907         struct ieee80211_qos_parameters qos_parameters[QOS_QOS_SETS];
6908         struct ieee80211_qos_parameters *active_one = NULL;
6909         u32 size = sizeof(struct ieee80211_qos_parameters);
6910         u32 burst_duration;
6911         int i;
6912         u8 type;
6913
6914         type = ipw_qos_current_mode(priv);
6915
6916         active_one = &(qos_parameters[QOS_PARAM_SET_DEF_CCK]);
6917         memcpy(active_one, priv->qos_data.def_qos_parm_CCK, size);
6918         active_one = &(qos_parameters[QOS_PARAM_SET_DEF_OFDM]);
6919         memcpy(active_one, priv->qos_data.def_qos_parm_OFDM, size);
6920
6921         if (qos_network_data == NULL) {
6922                 if (type == IEEE_B) {
6923                         IPW_DEBUG_QOS("QoS activate network mode %d\n", type);
6924                         active_one = &def_parameters_CCK;
6925                 } else
6926                         active_one = &def_parameters_OFDM;
6927
6928                 memcpy(&qos_parameters[QOS_PARAM_SET_ACTIVE], active_one, size);
6929                 burst_duration = ipw_qos_get_burst_duration(priv);
6930                 for (i = 0; i < QOS_QUEUE_NUM; i++)
6931                         qos_parameters[QOS_PARAM_SET_ACTIVE].tx_op_limit[i] =
6932                             cpu_to_le16(burst_duration);
6933         } else if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
6934                 if (type == IEEE_B) {
6935                         IPW_DEBUG_QOS("QoS activate IBSS nework mode %d\n",
6936                                       type);
6937                         if (priv->qos_data.qos_enable == 0)
6938                                 active_one = &def_parameters_CCK;
6939                         else
6940                                 active_one = priv->qos_data.def_qos_parm_CCK;
6941                 } else {
6942                         if (priv->qos_data.qos_enable == 0)
6943                                 active_one = &def_parameters_OFDM;
6944                         else
6945                                 active_one = priv->qos_data.def_qos_parm_OFDM;
6946                 }
6947                 memcpy(&qos_parameters[QOS_PARAM_SET_ACTIVE], active_one, size);
6948         } else {
6949                 unsigned long flags;
6950                 int active;
6951
6952                 spin_lock_irqsave(&priv->ieee->lock, flags);
6953                 active_one = &(qos_network_data->parameters);
6954                 qos_network_data->old_param_count =
6955                     qos_network_data->param_count;
6956                 memcpy(&qos_parameters[QOS_PARAM_SET_ACTIVE], active_one, size);
6957                 active = qos_network_data->supported;
6958                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
6959
6960                 if (active == 0) {
6961                         burst_duration = ipw_qos_get_burst_duration(priv);
6962                         for (i = 0; i < QOS_QUEUE_NUM; i++)
6963                                 qos_parameters[QOS_PARAM_SET_ACTIVE].
6964                                     tx_op_limit[i] = cpu_to_le16(burst_duration);
6965                 }
6966         }
6967
6968         IPW_DEBUG_QOS("QoS sending IPW_CMD_QOS_PARAMETERS\n");
6969         err = ipw_send_qos_params_command(priv,
6970                                           (struct ieee80211_qos_parameters *)
6971                                           &(qos_parameters[0]));
6972         if (err)
6973                 IPW_DEBUG_QOS("QoS IPW_CMD_QOS_PARAMETERS failed\n");
6974
6975         return err;
6976 }
6977
6978 /*
6979 * send IPW_CMD_WME_INFO to the firmware
6980 */
6981 static int ipw_qos_set_info_element(struct ipw_priv *priv)
6982 {
6983         int ret = 0;
6984         struct ieee80211_qos_information_element qos_info;
6985
6986         if (priv == NULL)
6987                 return -1;
6988
6989         qos_info.elementID = QOS_ELEMENT_ID;
6990         qos_info.length = sizeof(struct ieee80211_qos_information_element) - 2;
6991
6992         qos_info.version = QOS_VERSION_1;
6993         qos_info.ac_info = 0;
6994
6995         memcpy(qos_info.qui, qos_oui, QOS_OUI_LEN);
6996         qos_info.qui_type = QOS_OUI_TYPE;
6997         qos_info.qui_subtype = QOS_OUI_INFO_SUB_TYPE;
6998
6999         ret = ipw_send_qos_info_command(priv, &qos_info);
7000         if (ret != 0) {
7001                 IPW_DEBUG_QOS("QoS error calling ipw_send_qos_info_command\n");
7002         }
7003         return ret;
7004 }
7005
7006 /*
7007 * Set the QoS parameter with the association request structure
7008 */
7009 static int ipw_qos_association(struct ipw_priv *priv,
7010                                struct ieee80211_network *network)
7011 {
7012         int err = 0;
7013         struct ieee80211_qos_data *qos_data = NULL;
7014         struct ieee80211_qos_data ibss_data = {
7015                 .supported = 1,
7016                 .active = 1,
7017         };
7018
7019         switch (priv->ieee->iw_mode) {
7020         case IW_MODE_ADHOC:
7021                 BUG_ON(!(network->capability & WLAN_CAPABILITY_IBSS));
7022
7023                 qos_data = &ibss_data;
7024                 break;
7025
7026         case IW_MODE_INFRA:
7027                 qos_data = &network->qos_data;
7028                 break;
7029
7030         default:
7031                 BUG();
7032                 break;
7033         }
7034
7035         err = ipw_qos_activate(priv, qos_data);
7036         if (err) {
7037                 priv->assoc_request.policy_support &= ~HC_QOS_SUPPORT_ASSOC;
7038                 return err;
7039         }
7040
7041         if (priv->qos_data.qos_enable && qos_data->supported) {
7042                 IPW_DEBUG_QOS("QoS will be enabled for this association\n");
7043                 priv->assoc_request.policy_support |= HC_QOS_SUPPORT_ASSOC;
7044                 return ipw_qos_set_info_element(priv);
7045         }
7046
7047         return 0;
7048 }
7049
7050 /*
7051 * handling the beaconing responses. if we get different QoS setting
7052 * off the network from the associated setting, adjust the QoS
7053 * setting
7054 */
7055 static int ipw_qos_association_resp(struct ipw_priv *priv,
7056                                     struct ieee80211_network *network)
7057 {
7058         int ret = 0;
7059         unsigned long flags;
7060         u32 size = sizeof(struct ieee80211_qos_parameters);
7061         int set_qos_param = 0;
7062
7063         if ((priv == NULL) || (network == NULL) ||
7064             (priv->assoc_network == NULL))
7065                 return ret;
7066
7067         if (!(priv->status & STATUS_ASSOCIATED))
7068                 return ret;
7069
7070         if ((priv->ieee->iw_mode != IW_MODE_INFRA))
7071                 return ret;
7072
7073         spin_lock_irqsave(&priv->ieee->lock, flags);
7074         if (network->flags & NETWORK_HAS_QOS_PARAMETERS) {
7075                 memcpy(&priv->assoc_network->qos_data, &network->qos_data,
7076                        sizeof(struct ieee80211_qos_data));
7077                 priv->assoc_network->qos_data.active = 1;
7078                 if ((network->qos_data.old_param_count !=
7079                      network->qos_data.param_count)) {
7080                         set_qos_param = 1;
7081                         network->qos_data.old_param_count =
7082                             network->qos_data.param_count;
7083                 }
7084
7085         } else {
7086                 if ((network->mode == IEEE_B) || (priv->ieee->mode == IEEE_B))
7087                         memcpy(&priv->assoc_network->qos_data.parameters,
7088                                &def_parameters_CCK, size);
7089                 else
7090                         memcpy(&priv->assoc_network->qos_data.parameters,
7091                                &def_parameters_OFDM, size);
7092                 priv->assoc_network->qos_data.active = 0;
7093                 priv->assoc_network->qos_data.supported = 0;
7094                 set_qos_param = 1;
7095         }
7096
7097         spin_unlock_irqrestore(&priv->ieee->lock, flags);
7098
7099         if (set_qos_param == 1)
7100                 schedule_work(&priv->qos_activate);
7101
7102         return ret;
7103 }
7104
7105 static u32 ipw_qos_get_burst_duration(struct ipw_priv *priv)
7106 {
7107         u32 ret = 0;
7108
7109         if ((priv == NULL))
7110                 return 0;
7111
7112         if (!(priv->ieee->modulation & IEEE80211_OFDM_MODULATION))
7113                 ret = priv->qos_data.burst_duration_CCK;
7114         else
7115                 ret = priv->qos_data.burst_duration_OFDM;
7116
7117         return ret;
7118 }
7119
7120 /*
7121 * Initialize the setting of QoS global
7122 */
7123 static void ipw_qos_init(struct ipw_priv *priv, int enable,
7124                          int burst_enable, u32 burst_duration_CCK,
7125                          u32 burst_duration_OFDM)
7126 {
7127         priv->qos_data.qos_enable = enable;
7128
7129         if (priv->qos_data.qos_enable) {
7130                 priv->qos_data.def_qos_parm_CCK = &def_qos_parameters_CCK;
7131                 priv->qos_data.def_qos_parm_OFDM = &def_qos_parameters_OFDM;
7132                 IPW_DEBUG_QOS("QoS is enabled\n");
7133         } else {
7134                 priv->qos_data.def_qos_parm_CCK = &def_parameters_CCK;
7135                 priv->qos_data.def_qos_parm_OFDM = &def_parameters_OFDM;
7136                 IPW_DEBUG_QOS("QoS is not enabled\n");
7137         }
7138
7139         priv->qos_data.burst_enable = burst_enable;
7140
7141         if (burst_enable) {
7142                 priv->qos_data.burst_duration_CCK = burst_duration_CCK;
7143                 priv->qos_data.burst_duration_OFDM = burst_duration_OFDM;
7144         } else {
7145                 priv->qos_data.burst_duration_CCK = 0;
7146                 priv->qos_data.burst_duration_OFDM = 0;
7147         }
7148 }
7149
7150 /*
7151 * map the packet priority to the right TX Queue
7152 */
7153 static int ipw_get_tx_queue_number(struct ipw_priv *priv, u16 priority)
7154 {
7155         if (priority > 7 || !priv->qos_data.qos_enable)
7156                 priority = 0;
7157
7158         return from_priority_to_tx_queue[priority] - 1;
7159 }
7160
7161 static int ipw_is_qos_active(struct net_device *dev,
7162                              struct sk_buff *skb)
7163 {
7164         struct ipw_priv *priv = ieee80211_priv(dev);
7165         struct ieee80211_qos_data *qos_data = NULL;
7166         int active, supported;
7167         u8 *daddr = skb->data + ETH_ALEN;
7168         int unicast = !is_multicast_ether_addr(daddr);
7169
7170         if (!(priv->status & STATUS_ASSOCIATED))
7171                 return 0;
7172
7173         qos_data = &priv->assoc_network->qos_data;
7174
7175         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
7176                 if (unicast == 0)
7177                         qos_data->active = 0;
7178                 else
7179                         qos_data->active = qos_data->supported;
7180         }
7181         active = qos_data->active;
7182         supported = qos_data->supported;
7183         IPW_DEBUG_QOS("QoS  %d network is QoS active %d  supported %d  "
7184                       "unicast %d\n",
7185                       priv->qos_data.qos_enable, active, supported, unicast);
7186         if (active && priv->qos_data.qos_enable)
7187                 return 1;
7188
7189         return 0;
7190
7191 }
7192 /*
7193 * add QoS parameter to the TX command
7194 */
7195 static int ipw_qos_set_tx_queue_command(struct ipw_priv *priv,
7196                                         u16 priority,
7197                                         struct tfd_data *tfd)
7198 {
7199         int tx_queue_id = 0;
7200
7201
7202         tx_queue_id = from_priority_to_tx_queue[priority] - 1;
7203         tfd->tx_flags_ext |= DCT_FLAG_EXT_QOS_ENABLED;
7204
7205         if (priv->qos_data.qos_no_ack_mask & (1UL << tx_queue_id)) {
7206                 tfd->tx_flags &= ~DCT_FLAG_ACK_REQD;
7207                 tfd->tfd.tfd_26.mchdr.qos_ctrl |= cpu_to_le16(CTRL_QOS_NO_ACK);
7208         }
7209         return 0;
7210 }
7211
7212 /*
7213 * background support to run QoS activate functionality
7214 */
7215 static void ipw_bg_qos_activate(struct work_struct *work)
7216 {
7217         struct ipw_priv *priv =
7218                 container_of(work, struct ipw_priv, qos_activate);
7219
7220         if (priv == NULL)
7221                 return;
7222
7223         mutex_lock(&priv->mutex);
7224
7225         if (priv->status & STATUS_ASSOCIATED)
7226                 ipw_qos_activate(priv, &(priv->assoc_network->qos_data));
7227
7228         mutex_unlock(&priv->mutex);
7229 }
7230
7231 static int ipw_handle_probe_response(struct net_device *dev,
7232                                      struct ieee80211_probe_response *resp,
7233                                      struct ieee80211_network *network)
7234 {
7235         struct ipw_priv *priv = ieee80211_priv(dev);
7236         int active_network = ((priv->status & STATUS_ASSOCIATED) &&
7237                               (network == priv->assoc_network));
7238
7239         ipw_qos_handle_probe_response(priv, active_network, network);
7240
7241         return 0;
7242 }
7243
7244 static int ipw_handle_beacon(struct net_device *dev,
7245                              struct ieee80211_beacon *resp,
7246                              struct ieee80211_network *network)
7247 {
7248         struct ipw_priv *priv = ieee80211_priv(dev);
7249         int active_network = ((priv->status & STATUS_ASSOCIATED) &&
7250                               (network == priv->assoc_network));
7251
7252         ipw_qos_handle_probe_response(priv, active_network, network);
7253
7254         return 0;
7255 }
7256
7257 static int ipw_handle_assoc_response(struct net_device *dev,
7258                                      struct ieee80211_assoc_response *resp,
7259                                      struct ieee80211_network *network)
7260 {
7261         struct ipw_priv *priv = ieee80211_priv(dev);
7262         ipw_qos_association_resp(priv, network);
7263         return 0;
7264 }
7265
7266 static int ipw_send_qos_params_command(struct ipw_priv *priv, struct ieee80211_qos_parameters
7267                                        *qos_param)
7268 {
7269         return ipw_send_cmd_pdu(priv, IPW_CMD_QOS_PARAMETERS,
7270                                 sizeof(*qos_param) * 3, qos_param);
7271 }
7272
7273 static int ipw_send_qos_info_command(struct ipw_priv *priv, struct ieee80211_qos_information_element
7274                                      *qos_param)
7275 {
7276         return ipw_send_cmd_pdu(priv, IPW_CMD_WME_INFO, sizeof(*qos_param),
7277                                 qos_param);
7278 }
7279
7280 #endif                          /* CONFIG_IPW2200_QOS */
7281
7282 static int ipw_associate_network(struct ipw_priv *priv,
7283                                  struct ieee80211_network *network,
7284                                  struct ipw_supported_rates *rates, int roaming)
7285 {
7286         int err;
7287
7288         if (priv->config & CFG_FIXED_RATE)
7289                 ipw_set_fixed_rate(priv, network->mode);
7290
7291         if (!(priv->config & CFG_STATIC_ESSID)) {
7292                 priv->essid_len = min(network->ssid_len,
7293                                       (u8) IW_ESSID_MAX_SIZE);
7294                 memcpy(priv->essid, network->ssid, priv->essid_len);
7295         }
7296
7297         network->last_associate = jiffies;
7298
7299         memset(&priv->assoc_request, 0, sizeof(priv->assoc_request));
7300         priv->assoc_request.channel = network->channel;
7301         priv->assoc_request.auth_key = 0;
7302
7303         if ((priv->capability & CAP_PRIVACY_ON) &&
7304             (priv->ieee->sec.auth_mode == WLAN_AUTH_SHARED_KEY)) {
7305                 priv->assoc_request.auth_type = AUTH_SHARED_KEY;
7306                 priv->assoc_request.auth_key = priv->ieee->sec.active_key;
7307
7308                 if (priv->ieee->sec.level == SEC_LEVEL_1)
7309                         ipw_send_wep_keys(priv, DCW_WEP_KEY_SEC_TYPE_WEP);
7310
7311         } else if ((priv->capability & CAP_PRIVACY_ON) &&
7312                    (priv->ieee->sec.auth_mode == WLAN_AUTH_LEAP))
7313                 priv->assoc_request.auth_type = AUTH_LEAP;
7314         else
7315                 priv->assoc_request.auth_type = AUTH_OPEN;
7316
7317         if (priv->ieee->wpa_ie_len) {
7318                 priv->assoc_request.policy_support = cpu_to_le16(0x02); /* RSN active */
7319                 ipw_set_rsn_capa(priv, priv->ieee->wpa_ie,
7320                                  priv->ieee->wpa_ie_len);
7321         }
7322
7323         /*
7324          * It is valid for our ieee device to support multiple modes, but
7325          * when it comes to associating to a given network we have to choose
7326          * just one mode.
7327          */
7328         if (network->mode & priv->ieee->mode & IEEE_A)
7329                 priv->assoc_request.ieee_mode = IPW_A_MODE;
7330         else if (network->mode & priv->ieee->mode & IEEE_G)
7331                 priv->assoc_request.ieee_mode = IPW_G_MODE;
7332         else if (network->mode & priv->ieee->mode & IEEE_B)
7333                 priv->assoc_request.ieee_mode = IPW_B_MODE;
7334
7335         priv->assoc_request.capability = cpu_to_le16(network->capability);
7336         if ((network->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
7337             && !(priv->config & CFG_PREAMBLE_LONG)) {
7338                 priv->assoc_request.preamble_length = DCT_FLAG_SHORT_PREAMBLE;
7339         } else {
7340                 priv->assoc_request.preamble_length = DCT_FLAG_LONG_PREAMBLE;
7341
7342                 /* Clear the short preamble if we won't be supporting it */
7343                 priv->assoc_request.capability &=
7344                     ~cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE);
7345         }
7346
7347         /* Clear capability bits that aren't used in Ad Hoc */
7348         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
7349                 priv->assoc_request.capability &=
7350                     ~cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME);
7351
7352         IPW_DEBUG_ASSOC("%sssocation attempt: '%s', channel %d, "
7353                         "802.11%c [%d], %s[:%s], enc=%s%s%s%c%c\n",
7354                         roaming ? "Rea" : "A",
7355                         escape_essid(priv->essid, priv->essid_len),
7356                         network->channel,
7357                         ipw_modes[priv->assoc_request.ieee_mode],
7358                         rates->num_rates,
7359                         (priv->assoc_request.preamble_length ==
7360                          DCT_FLAG_LONG_PREAMBLE) ? "long" : "short",
7361                         network->capability &
7362                         WLAN_CAPABILITY_SHORT_PREAMBLE ? "short" : "long",
7363                         priv->capability & CAP_PRIVACY_ON ? "on " : "off",
7364                         priv->capability & CAP_PRIVACY_ON ?
7365                         (priv->capability & CAP_SHARED_KEY ? "(shared)" :
7366                          "(open)") : "",
7367                         priv->capability & CAP_PRIVACY_ON ? " key=" : "",
7368                         priv->capability & CAP_PRIVACY_ON ?
7369                         '1' + priv->ieee->sec.active_key : '.',
7370                         priv->capability & CAP_PRIVACY_ON ? '.' : ' ');
7371
7372         priv->assoc_request.beacon_interval = cpu_to_le16(network->beacon_interval);
7373         if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
7374             (network->time_stamp[0] == 0) && (network->time_stamp[1] == 0)) {
7375                 priv->assoc_request.assoc_type = HC_IBSS_START;
7376                 priv->assoc_request.assoc_tsf_msw = 0;
7377                 priv->assoc_request.assoc_tsf_lsw = 0;
7378         } else {
7379                 if (unlikely(roaming))
7380                         priv->assoc_request.assoc_type = HC_REASSOCIATE;
7381                 else
7382                         priv->assoc_request.assoc_type = HC_ASSOCIATE;
7383                 priv->assoc_request.assoc_tsf_msw = cpu_to_le32(network->time_stamp[1]);
7384                 priv->assoc_request.assoc_tsf_lsw = cpu_to_le32(network->time_stamp[0]);
7385         }
7386
7387         memcpy(priv->assoc_request.bssid, network->bssid, ETH_ALEN);
7388
7389         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
7390                 memset(&priv->assoc_request.dest, 0xFF, ETH_ALEN);
7391                 priv->assoc_request.atim_window = cpu_to_le16(network->atim_window);
7392         } else {
7393                 memcpy(priv->assoc_request.dest, network->bssid, ETH_ALEN);
7394                 priv->assoc_request.atim_window = 0;
7395         }
7396
7397         priv->assoc_request.listen_interval = cpu_to_le16(network->listen_interval);
7398
7399         err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
7400         if (err) {
7401                 IPW_DEBUG_HC("Attempt to send SSID command failed.\n");
7402                 return err;
7403         }
7404
7405         rates->ieee_mode = priv->assoc_request.ieee_mode;
7406         rates->purpose = IPW_RATE_CONNECT;
7407         ipw_send_supported_rates(priv, rates);
7408
7409         if (priv->assoc_request.ieee_mode == IPW_G_MODE)
7410                 priv->sys_config.dot11g_auto_detection = 1;
7411         else
7412                 priv->sys_config.dot11g_auto_detection = 0;
7413
7414         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
7415                 priv->sys_config.answer_broadcast_ssid_probe = 1;
7416         else
7417                 priv->sys_config.answer_broadcast_ssid_probe = 0;
7418
7419         err = ipw_send_system_config(priv);
7420         if (err) {
7421                 IPW_DEBUG_HC("Attempt to send sys config command failed.\n");
7422                 return err;
7423         }
7424
7425         IPW_DEBUG_ASSOC("Association sensitivity: %d\n", network->stats.rssi);
7426         err = ipw_set_sensitivity(priv, network->stats.rssi + IPW_RSSI_TO_DBM);
7427         if (err) {
7428                 IPW_DEBUG_HC("Attempt to send associate command failed.\n");
7429                 return err;
7430         }
7431
7432         /*
7433          * If preemption is enabled, it is possible for the association
7434          * to complete before we return from ipw_send_associate.  Therefore
7435          * we have to be sure and update our priviate data first.
7436          */
7437         priv->channel = network->channel;
7438         memcpy(priv->bssid, network->bssid, ETH_ALEN);
7439         priv->status |= STATUS_ASSOCIATING;
7440         priv->status &= ~STATUS_SECURITY_UPDATED;
7441
7442         priv->assoc_network = network;
7443
7444 #ifdef CONFIG_IPW2200_QOS
7445         ipw_qos_association(priv, network);
7446 #endif
7447
7448         err = ipw_send_associate(priv, &priv->assoc_request);
7449         if (err) {
7450                 IPW_DEBUG_HC("Attempt to send associate command failed.\n");
7451                 return err;
7452         }
7453
7454         IPW_DEBUG(IPW_DL_STATE, "associating: '%s' %pM \n",
7455                   escape_essid(priv->essid, priv->essid_len),
7456                   priv->bssid);
7457
7458         return 0;
7459 }
7460
7461 static void ipw_roam(void *data)
7462 {
7463         struct ipw_priv *priv = data;
7464         struct ieee80211_network *network = NULL;
7465         struct ipw_network_match match = {
7466                 .network = priv->assoc_network
7467         };
7468
7469         /* The roaming process is as follows:
7470          *
7471          * 1.  Missed beacon threshold triggers the roaming process by
7472          *     setting the status ROAM bit and requesting a scan.
7473          * 2.  When the scan completes, it schedules the ROAM work
7474          * 3.  The ROAM work looks at all of the known networks for one that
7475          *     is a better network than the currently associated.  If none
7476          *     found, the ROAM process is over (ROAM bit cleared)
7477          * 4.  If a better network is found, a disassociation request is
7478          *     sent.
7479          * 5.  When the disassociation completes, the roam work is again
7480          *     scheduled.  The second time through, the driver is no longer
7481          *     associated, and the newly selected network is sent an
7482          *     association request.
7483          * 6.  At this point ,the roaming process is complete and the ROAM
7484          *     status bit is cleared.
7485          */
7486
7487         /* If we are no longer associated, and the roaming bit is no longer
7488          * set, then we are not actively roaming, so just return */
7489         if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ROAMING)))
7490                 return;
7491
7492         if (priv->status & STATUS_ASSOCIATED) {
7493                 /* First pass through ROAM process -- look for a better
7494                  * network */
7495                 unsigned long flags;
7496                 u8 rssi = priv->assoc_network->stats.rssi;
7497                 priv->assoc_network->stats.rssi = -128;
7498                 spin_lock_irqsave(&priv->ieee->lock, flags);
7499                 list_for_each_entry(network, &priv->ieee->network_list, list) {
7500                         if (network != priv->assoc_network)
7501                                 ipw_best_network(priv, &match, network, 1);
7502                 }
7503                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
7504                 priv->assoc_network->stats.rssi = rssi;
7505
7506                 if (match.network == priv->assoc_network) {
7507                         IPW_DEBUG_ASSOC("No better APs in this network to "
7508                                         "roam to.\n");
7509                         priv->status &= ~STATUS_ROAMING;
7510                         ipw_debug_config(priv);
7511                         return;
7512                 }
7513
7514                 ipw_send_disassociate(priv, 1);
7515                 priv->assoc_network = match.network;
7516
7517                 return;
7518         }
7519
7520         /* Second pass through ROAM process -- request association */
7521         ipw_compatible_rates(priv, priv->assoc_network, &match.rates);
7522         ipw_associate_network(priv, priv->assoc_network, &match.rates, 1);
7523         priv->status &= ~STATUS_ROAMING;
7524 }
7525
7526 static void ipw_bg_roam(struct work_struct *work)
7527 {
7528         struct ipw_priv *priv =
7529                 container_of(work, struct ipw_priv, roam);
7530         mutex_lock(&priv->mutex);
7531         ipw_roam(priv);
7532         mutex_unlock(&priv->mutex);
7533 }
7534
7535 static int ipw_associate(void *data)
7536 {
7537         struct ipw_priv *priv = data;
7538
7539         struct ieee80211_network *network = NULL;
7540         struct ipw_network_match match = {
7541                 .network = NULL
7542         };
7543         struct ipw_supported_rates *rates;
7544         struct list_head *element;
7545         unsigned long flags;
7546
7547         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
7548                 IPW_DEBUG_ASSOC("Not attempting association (monitor mode)\n");
7549                 return 0;
7550         }
7551
7552         if (priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
7553                 IPW_DEBUG_ASSOC("Not attempting association (already in "
7554                                 "progress)\n");
7555                 return 0;
7556         }
7557
7558         if (priv->status & STATUS_DISASSOCIATING) {
7559                 IPW_DEBUG_ASSOC("Not attempting association (in "
7560                                 "disassociating)\n ");
7561                 queue_work(priv->workqueue, &priv->associate);
7562                 return 0;
7563         }
7564
7565         if (!ipw_is_init(priv) || (priv->status & STATUS_SCANNING)) {
7566                 IPW_DEBUG_ASSOC("Not attempting association (scanning or not "
7567                                 "initialized)\n");
7568                 return 0;
7569         }
7570
7571         if (!(priv->config & CFG_ASSOCIATE) &&
7572             !(priv->config & (CFG_STATIC_ESSID |
7573                               CFG_STATIC_CHANNEL | CFG_STATIC_BSSID))) {
7574                 IPW_DEBUG_ASSOC("Not attempting association (associate=0)\n");
7575                 return 0;
7576         }
7577
7578         /* Protect our use of the network_list */
7579         spin_lock_irqsave(&priv->ieee->lock, flags);
7580         list_for_each_entry(network, &priv->ieee->network_list, list)
7581             ipw_best_network(priv, &match, network, 0);
7582
7583         network = match.network;
7584         rates = &match.rates;
7585
7586         if (network == NULL &&
7587             priv->ieee->iw_mode == IW_MODE_ADHOC &&
7588             priv->config & CFG_ADHOC_CREATE &&
7589             priv->config & CFG_STATIC_ESSID &&
7590             priv->config & CFG_STATIC_CHANNEL) {
7591                 /* Use oldest network if the free list is empty */
7592                 if (list_empty(&priv->ieee->network_free_list)) {
7593                         struct ieee80211_network *oldest = NULL;
7594                         struct ieee80211_network *target;
7595
7596                         list_for_each_entry(target, &priv->ieee->network_list, list) {
7597                                 if ((oldest == NULL) ||
7598                                     (target->last_scanned < oldest->last_scanned))
7599                                         oldest = target;
7600                         }
7601
7602                         /* If there are no more slots, expire the oldest */
7603                         list_del(&oldest->list);
7604                         target = oldest;
7605                         IPW_DEBUG_ASSOC("Expired '%s' (%pM) from "
7606                                         "network list.\n",
7607                                         escape_essid(target->ssid,
7608                                                      target->ssid_len),
7609                                         target->bssid);
7610                         list_add_tail(&target->list,
7611                                       &priv->ieee->network_free_list);
7612                 }
7613
7614                 element = priv->ieee->network_free_list.next;
7615                 network = list_entry(element, struct ieee80211_network, list);
7616                 ipw_adhoc_create(priv, network);
7617                 rates = &priv->rates;
7618                 list_del(element);
7619                 list_add_tail(&network->list, &priv->ieee->network_list);
7620         }
7621         spin_unlock_irqrestore(&priv->ieee->lock, flags);
7622
7623         /* If we reached the end of the list, then we don't have any valid
7624          * matching APs */
7625         if (!network) {
7626                 ipw_debug_config(priv);
7627
7628                 if (!(priv->status & STATUS_SCANNING)) {
7629                         if (!(priv->config & CFG_SPEED_SCAN))
7630                                 queue_delayed_work(priv->workqueue,
7631                                                    &priv->request_scan,
7632                                                    SCAN_INTERVAL);
7633                         else
7634                                 queue_delayed_work(priv->workqueue,
7635                                                    &priv->request_scan, 0);
7636                 }
7637
7638                 return 0;
7639         }
7640
7641         ipw_associate_network(priv, network, rates, 0);
7642
7643         return 1;
7644 }
7645
7646 static void ipw_bg_associate(struct work_struct *work)
7647 {
7648         struct ipw_priv *priv =
7649                 container_of(work, struct ipw_priv, associate);
7650         mutex_lock(&priv->mutex);
7651         ipw_associate(priv);
7652         mutex_unlock(&priv->mutex);
7653 }
7654
7655 static void ipw_rebuild_decrypted_skb(struct ipw_priv *priv,
7656                                       struct sk_buff *skb)
7657 {
7658         struct ieee80211_hdr *hdr;
7659         u16 fc;
7660
7661         hdr = (struct ieee80211_hdr *)skb->data;
7662         fc = le16_to_cpu(hdr->frame_ctl);
7663         if (!(fc & IEEE80211_FCTL_PROTECTED))
7664                 return;
7665
7666         fc &= ~IEEE80211_FCTL_PROTECTED;
7667         hdr->frame_ctl = cpu_to_le16(fc);
7668         switch (priv->ieee->sec.level) {
7669         case SEC_LEVEL_3:
7670                 /* Remove CCMP HDR */
7671                 memmove(skb->data + IEEE80211_3ADDR_LEN,
7672                         skb->data + IEEE80211_3ADDR_LEN + 8,
7673                         skb->len - IEEE80211_3ADDR_LEN - 8);
7674                 skb_trim(skb, skb->len - 16);   /* CCMP_HDR_LEN + CCMP_MIC_LEN */
7675                 break;
7676         case SEC_LEVEL_2:
7677                 break;
7678         case SEC_LEVEL_1:
7679                 /* Remove IV */
7680                 memmove(skb->data + IEEE80211_3ADDR_LEN,
7681                         skb->data + IEEE80211_3ADDR_LEN + 4,
7682                         skb->len - IEEE80211_3ADDR_LEN - 4);
7683                 skb_trim(skb, skb->len - 8);    /* IV + ICV */
7684                 break;
7685         case SEC_LEVEL_0:
7686                 break;
7687         default:
7688                 printk(KERN_ERR "Unknow security level %d\n",
7689                        priv->ieee->sec.level);
7690                 break;
7691         }
7692 }
7693
7694 static void ipw_handle_data_packet(struct ipw_priv *priv,
7695                                    struct ipw_rx_mem_buffer *rxb,
7696                                    struct ieee80211_rx_stats *stats)
7697 {
7698         struct ieee80211_hdr_4addr *hdr;
7699         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
7700
7701         /* We received data from the HW, so stop the watchdog */
7702         priv->net_dev->trans_start = jiffies;
7703
7704         /* We only process data packets if the
7705          * interface is open */
7706         if (unlikely((le16_to_cpu(pkt->u.frame.length) + IPW_RX_FRAME_SIZE) >
7707                      skb_tailroom(rxb->skb))) {
7708                 priv->ieee->stats.rx_errors++;
7709                 priv->wstats.discard.misc++;
7710                 IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
7711                 return;
7712         } else if (unlikely(!netif_running(priv->net_dev))) {
7713                 priv->ieee->stats.rx_dropped++;
7714                 priv->wstats.discard.misc++;
7715                 IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
7716                 return;
7717         }
7718
7719         /* Advance skb->data to the start of the actual payload */
7720         skb_reserve(rxb->skb, offsetof(struct ipw_rx_packet, u.frame.data));
7721
7722         /* Set the size of the skb to the size of the frame */
7723         skb_put(rxb->skb, le16_to_cpu(pkt->u.frame.length));
7724
7725         IPW_DEBUG_RX("Rx packet of %d bytes.\n", rxb->skb->len);
7726
7727         /* HW decrypt will not clear the WEP bit, MIC, PN, etc. */
7728         hdr = (struct ieee80211_hdr_4addr *)rxb->skb->data;
7729         if (priv->ieee->iw_mode != IW_MODE_MONITOR &&
7730             (is_multicast_ether_addr(hdr->addr1) ?
7731              !priv->ieee->host_mc_decrypt : !priv->ieee->host_decrypt))
7732                 ipw_rebuild_decrypted_skb(priv, rxb->skb);
7733
7734         if (!ieee80211_rx(priv->ieee, rxb->skb, stats))
7735                 priv->ieee->stats.rx_errors++;
7736         else {                  /* ieee80211_rx succeeded, so it now owns the SKB */
7737                 rxb->skb = NULL;
7738                 __ipw_led_activity_on(priv);
7739         }
7740 }
7741
7742 #ifdef CONFIG_IPW2200_RADIOTAP
7743 static void ipw_handle_data_packet_monitor(struct ipw_priv *priv,
7744                                            struct ipw_rx_mem_buffer *rxb,
7745                                            struct ieee80211_rx_stats *stats)
7746 {
7747         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
7748         struct ipw_rx_frame *frame = &pkt->u.frame;
7749
7750         /* initial pull of some data */
7751         u16 received_channel = frame->received_channel;
7752         u8 antennaAndPhy = frame->antennaAndPhy;
7753         s8 antsignal = frame->rssi_dbm - IPW_RSSI_TO_DBM;       /* call it signed anyhow */
7754         u16 pktrate = frame->rate;
7755
7756         /* Magic struct that slots into the radiotap header -- no reason
7757          * to build this manually element by element, we can write it much
7758          * more efficiently than we can parse it. ORDER MATTERS HERE */
7759         struct ipw_rt_hdr *ipw_rt;
7760
7761         short len = le16_to_cpu(pkt->u.frame.length);
7762
7763         /* We received data from the HW, so stop the watchdog */
7764         priv->net_dev->trans_start = jiffies;
7765
7766         /* We only process data packets if the
7767          * interface is open */
7768         if (unlikely((le16_to_cpu(pkt->u.frame.length) + IPW_RX_FRAME_SIZE) >
7769                      skb_tailroom(rxb->skb))) {
7770                 priv->ieee->stats.rx_errors++;
7771                 priv->wstats.discard.misc++;
7772                 IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
7773                 return;
7774         } else if (unlikely(!netif_running(priv->net_dev))) {
7775                 priv->ieee->stats.rx_dropped++;
7776                 priv->wstats.discard.misc++;
7777                 IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
7778                 return;
7779         }
7780
7781         /* Libpcap 0.9.3+ can handle variable length radiotap, so we'll use
7782          * that now */
7783         if (len > IPW_RX_BUF_SIZE - sizeof(struct ipw_rt_hdr)) {
7784                 /* FIXME: Should alloc bigger skb instead */
7785                 priv->ieee->stats.rx_dropped++;
7786                 priv->wstats.discard.misc++;
7787                 IPW_DEBUG_DROP("Dropping too large packet in monitor\n");
7788                 return;
7789         }
7790
7791         /* copy the frame itself */
7792         memmove(rxb->skb->data + sizeof(struct ipw_rt_hdr),
7793                 rxb->skb->data + IPW_RX_FRAME_SIZE, len);
7794
7795         /* Zero the radiotap static buffer  ...  We only need to zero the bytes NOT
7796          * part of our real header, saves a little time.
7797          *
7798          * No longer necessary since we fill in all our data.  Purge before merging
7799          * patch officially.
7800          * memset(rxb->skb->data + sizeof(struct ipw_rt_hdr), 0,
7801          *        IEEE80211_RADIOTAP_HDRLEN - sizeof(struct ipw_rt_hdr));
7802          */
7803
7804         ipw_rt = (struct ipw_rt_hdr *)rxb->skb->data;
7805
7806         ipw_rt->rt_hdr.it_version = PKTHDR_RADIOTAP_VERSION;
7807         ipw_rt->rt_hdr.it_pad = 0;      /* always good to zero */
7808         ipw_rt->rt_hdr.it_len = cpu_to_le16(sizeof(struct ipw_rt_hdr)); /* total header+data */
7809
7810         /* Big bitfield of all the fields we provide in radiotap */
7811         ipw_rt->rt_hdr.it_present = cpu_to_le32(
7812              (1 << IEEE80211_RADIOTAP_TSFT) |
7813              (1 << IEEE80211_RADIOTAP_FLAGS) |
7814              (1 << IEEE80211_RADIOTAP_RATE) |
7815              (1 << IEEE80211_RADIOTAP_CHANNEL) |
7816              (1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL) |
7817              (1 << IEEE80211_RADIOTAP_DBM_ANTNOISE) |
7818              (1 << IEEE80211_RADIOTAP_ANTENNA));
7819
7820         /* Zero the flags, we'll add to them as we go */
7821         ipw_rt->rt_flags = 0;
7822         ipw_rt->rt_tsf = (u64)(frame->parent_tsf[3] << 24 |
7823                                frame->parent_tsf[2] << 16 |
7824                                frame->parent_tsf[1] << 8  |
7825                                frame->parent_tsf[0]);
7826
7827         /* Convert signal to DBM */
7828         ipw_rt->rt_dbmsignal = antsignal;
7829         ipw_rt->rt_dbmnoise = frame->noise;
7830
7831         /* Convert the channel data and set the flags */
7832         ipw_rt->rt_channel = cpu_to_le16(ieee80211chan2mhz(received_channel));
7833         if (received_channel > 14) {    /* 802.11a */
7834                 ipw_rt->rt_chbitmask =
7835                     cpu_to_le16((IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ));
7836         } else if (antennaAndPhy & 32) {        /* 802.11b */
7837                 ipw_rt->rt_chbitmask =
7838                     cpu_to_le16((IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ));
7839         } else {                /* 802.11g */
7840                 ipw_rt->rt_chbitmask =
7841                     cpu_to_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ);
7842         }
7843
7844         /* set the rate in multiples of 500k/s */
7845         switch (pktrate) {
7846         case IPW_TX_RATE_1MB:
7847                 ipw_rt->rt_rate = 2;
7848                 break;
7849         case IPW_TX_RATE_2MB:
7850                 ipw_rt->rt_rate = 4;
7851                 break;
7852         case IPW_TX_RATE_5MB:
7853                 ipw_rt->rt_rate = 10;
7854                 break;
7855         case IPW_TX_RATE_6MB:
7856                 ipw_rt->rt_rate = 12;
7857                 break;
7858         case IPW_TX_RATE_9MB:
7859                 ipw_rt->rt_rate = 18;
7860                 break;
7861         case IPW_TX_RATE_11MB:
7862                 ipw_rt->rt_rate = 22;
7863                 break;
7864         case IPW_TX_RATE_12MB:
7865                 ipw_rt->rt_rate = 24;
7866                 break;
7867         case IPW_TX_RATE_18MB:
7868                 ipw_rt->rt_rate = 36;
7869                 break;
7870         case IPW_TX_RATE_24MB:
7871                 ipw_rt->rt_rate = 48;
7872                 break;
7873         case IPW_TX_RATE_36MB:
7874                 ipw_rt->rt_rate = 72;
7875                 break;
7876         case IPW_TX_RATE_48MB:
7877                 ipw_rt->rt_rate = 96;
7878                 break;
7879         case IPW_TX_RATE_54MB:
7880                 ipw_rt->rt_rate = 108;
7881                 break;
7882         default:
7883                 ipw_rt->rt_rate = 0;
7884                 break;
7885         }
7886
7887         /* antenna number */
7888         ipw_rt->rt_antenna = (antennaAndPhy & 3);       /* Is this right? */
7889
7890         /* set the preamble flag if we have it */
7891         if ((antennaAndPhy & 64))
7892                 ipw_rt->rt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
7893
7894         /* Set the size of the skb to the size of the frame */
7895         skb_put(rxb->skb, len + sizeof(struct ipw_rt_hdr));
7896
7897         IPW_DEBUG_RX("Rx packet of %d bytes.\n", rxb->skb->len);
7898
7899         if (!ieee80211_rx(priv->ieee, rxb->skb, stats))
7900                 priv->ieee->stats.rx_errors++;
7901         else {                  /* ieee80211_rx succeeded, so it now owns the SKB */
7902                 rxb->skb = NULL;
7903                 /* no LED during capture */
7904         }
7905 }
7906 #endif
7907
7908 #ifdef CONFIG_IPW2200_PROMISCUOUS
7909 #define ieee80211_is_probe_response(fc) \
7910    ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT && \
7911     (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP )
7912
7913 #define ieee80211_is_management(fc) \
7914    ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)
7915
7916 #define ieee80211_is_control(fc) \
7917    ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL)
7918
7919 #define ieee80211_is_data(fc) \
7920    ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
7921
7922 #define ieee80211_is_assoc_request(fc) \
7923    ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_ASSOC_REQ)
7924
7925 #define ieee80211_is_reassoc_request(fc) \
7926    ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_REASSOC_REQ)
7927
7928 static void ipw_handle_promiscuous_rx(struct ipw_priv *priv,
7929                                       struct ipw_rx_mem_buffer *rxb,
7930                                       struct ieee80211_rx_stats *stats)
7931 {
7932         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
7933         struct ipw_rx_frame *frame = &pkt->u.frame;
7934         struct ipw_rt_hdr *ipw_rt;
7935
7936         /* First cache any information we need before we overwrite
7937          * the information provided in the skb from the hardware */
7938         struct ieee80211_hdr *hdr;
7939         u16 channel = frame->received_channel;
7940         u8 phy_flags = frame->antennaAndPhy;
7941         s8 signal = frame->rssi_dbm - IPW_RSSI_TO_DBM;
7942         s8 noise = frame->noise;
7943         u8 rate = frame->rate;
7944         short len = le16_to_cpu(pkt->u.frame.length);
7945         struct sk_buff *skb;
7946         int hdr_only = 0;
7947         u16 filter = priv->prom_priv->filter;
7948
7949         /* If the filter is set to not include Rx frames then return */
7950         if (filter & IPW_PROM_NO_RX)
7951                 return;
7952
7953         /* We received data from the HW, so stop the watchdog */
7954         priv->prom_net_dev->trans_start = jiffies;
7955
7956         if (unlikely((len + IPW_RX_FRAME_SIZE) > skb_tailroom(rxb->skb))) {
7957                 priv->prom_priv->ieee->stats.rx_errors++;
7958                 IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
7959                 return;
7960         }
7961
7962         /* We only process data packets if the interface is open */
7963         if (unlikely(!netif_running(priv->prom_net_dev))) {
7964                 priv->prom_priv->ieee->stats.rx_dropped++;
7965                 IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
7966                 return;
7967         }
7968
7969         /* Libpcap 0.9.3+ can handle variable length radiotap, so we'll use
7970          * that now */
7971         if (len > IPW_RX_BUF_SIZE - sizeof(struct ipw_rt_hdr)) {
7972                 /* FIXME: Should alloc bigger skb instead */
7973                 priv->prom_priv->ieee->stats.rx_dropped++;
7974                 IPW_DEBUG_DROP("Dropping too large packet in monitor\n");
7975                 return;
7976         }
7977
7978         hdr = (void *)rxb->skb->data + IPW_RX_FRAME_SIZE;
7979         if (ieee80211_is_management(le16_to_cpu(hdr->frame_ctl))) {
7980                 if (filter & IPW_PROM_NO_MGMT)
7981                         return;
7982                 if (filter & IPW_PROM_MGMT_HEADER_ONLY)
7983                         hdr_only = 1;
7984         } else if (ieee80211_is_control(le16_to_cpu(hdr->frame_ctl))) {
7985                 if (filter & IPW_PROM_NO_CTL)
7986                         return;
7987                 if (filter & IPW_PROM_CTL_HEADER_ONLY)
7988                         hdr_only = 1;
7989         } else if (ieee80211_is_data(le16_to_cpu(hdr->frame_ctl))) {
7990                 if (filter & IPW_PROM_NO_DATA)
7991                         return;
7992                 if (filter & IPW_PROM_DATA_HEADER_ONLY)
7993                         hdr_only = 1;
7994         }
7995
7996         /* Copy the SKB since this is for the promiscuous side */
7997         skb = skb_copy(rxb->skb, GFP_ATOMIC);
7998         if (skb == NULL) {
7999                 IPW_ERROR("skb_clone failed for promiscuous copy.\n");
8000                 return;
8001         }
8002
8003         /* copy the frame data to write after where the radiotap header goes */
8004         ipw_rt = (void *)skb->data;
8005
8006         if (hdr_only)
8007                 len = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
8008
8009         memcpy(ipw_rt->payload, hdr, len);
8010
8011         /* Zero the radiotap static buffer  ...  We only need to zero the bytes
8012          * NOT part of our real header, saves a little time.
8013          *
8014          * No longer necessary since we fill in all our data.  Purge before
8015          * merging patch officially.
8016          * memset(rxb->skb->data + sizeof(struct ipw_rt_hdr), 0,
8017          *        IEEE80211_RADIOTAP_HDRLEN - sizeof(struct ipw_rt_hdr));
8018          */
8019
8020         ipw_rt->rt_hdr.it_version = PKTHDR_RADIOTAP_VERSION;
8021         ipw_rt->rt_hdr.it_pad = 0;      /* always good to zero */
8022         ipw_rt->rt_hdr.it_len = cpu_to_le16(sizeof(*ipw_rt));   /* total header+data */
8023
8024         /* Set the size of the skb to the size of the frame */
8025         skb_put(skb, sizeof(*ipw_rt) + len);
8026
8027         /* Big bitfield of all the fields we provide in radiotap */
8028         ipw_rt->rt_hdr.it_present = cpu_to_le32(
8029              (1 << IEEE80211_RADIOTAP_TSFT) |
8030              (1 << IEEE80211_RADIOTAP_FLAGS) |
8031              (1 << IEEE80211_RADIOTAP_RATE) |
8032              (1 << IEEE80211_RADIOTAP_CHANNEL) |
8033              (1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL) |
8034              (1 << IEEE80211_RADIOTAP_DBM_ANTNOISE) |
8035              (1 << IEEE80211_RADIOTAP_ANTENNA));
8036
8037         /* Zero the flags, we'll add to them as we go */
8038         ipw_rt->rt_flags = 0;
8039         ipw_rt->rt_tsf = (u64)(frame->parent_tsf[3] << 24 |
8040                                frame->parent_tsf[2] << 16 |
8041                                frame->parent_tsf[1] << 8  |
8042                                frame->parent_tsf[0]);
8043
8044         /* Convert to DBM */
8045         ipw_rt->rt_dbmsignal = signal;
8046         ipw_rt->rt_dbmnoise = noise;
8047
8048         /* Convert the channel data and set the flags */
8049         ipw_rt->rt_channel = cpu_to_le16(ieee80211chan2mhz(channel));
8050         if (channel > 14) {     /* 802.11a */
8051                 ipw_rt->rt_chbitmask =
8052                     cpu_to_le16((IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ));
8053         } else if (phy_flags & (1 << 5)) {      /* 802.11b */
8054                 ipw_rt->rt_chbitmask =
8055                     cpu_to_le16((IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ));
8056         } else {                /* 802.11g */
8057                 ipw_rt->rt_chbitmask =
8058                     cpu_to_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ);
8059         }
8060
8061         /* set the rate in multiples of 500k/s */
8062         switch (rate) {
8063         case IPW_TX_RATE_1MB:
8064                 ipw_rt->rt_rate = 2;
8065                 break;
8066         case IPW_TX_RATE_2MB:
8067                 ipw_rt->rt_rate = 4;
8068                 break;
8069         case IPW_TX_RATE_5MB:
8070                 ipw_rt->rt_rate = 10;
8071                 break;
8072         case IPW_TX_RATE_6MB:
8073                 ipw_rt->rt_rate = 12;
8074                 break;
8075         case IPW_TX_RATE_9MB:
8076                 ipw_rt->rt_rate = 18;
8077                 break;
8078         case IPW_TX_RATE_11MB:
8079                 ipw_rt->rt_rate = 22;
8080                 break;
8081         case IPW_TX_RATE_12MB:
8082                 ipw_rt->rt_rate = 24;
8083                 break;
8084         case IPW_TX_RATE_18MB:
8085                 ipw_rt->rt_rate = 36;
8086                 break;
8087         case IPW_TX_RATE_24MB:
8088                 ipw_rt->rt_rate = 48;
8089                 break;
8090         case IPW_TX_RATE_36MB:
8091                 ipw_rt->rt_rate = 72;
8092                 break;
8093         case IPW_TX_RATE_48MB:
8094                 ipw_rt->rt_rate = 96;
8095                 break;
8096         case IPW_TX_RATE_54MB:
8097                 ipw_rt->rt_rate = 108;
8098                 break;
8099         default:
8100                 ipw_rt->rt_rate = 0;
8101                 break;
8102         }
8103
8104         /* antenna number */
8105         ipw_rt->rt_antenna = (phy_flags & 3);
8106
8107         /* set the preamble flag if we have it */
8108         if (phy_flags & (1 << 6))
8109                 ipw_rt->rt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
8110
8111         IPW_DEBUG_RX("Rx packet of %d bytes.\n", skb->len);
8112
8113         if (!ieee80211_rx(priv->prom_priv->ieee, skb, stats)) {
8114                 priv->prom_priv->ieee->stats.rx_errors++;
8115                 dev_kfree_skb_any(skb);
8116         }
8117 }
8118 #endif
8119
8120 static int is_network_packet(struct ipw_priv *priv,
8121                                     struct ieee80211_hdr_4addr *header)
8122 {
8123         /* Filter incoming packets to determine if they are targetted toward
8124          * this network, discarding packets coming from ourselves */
8125         switch (priv->ieee->iw_mode) {
8126         case IW_MODE_ADHOC:     /* Header: Dest. | Source    | BSSID */
8127                 /* packets from our adapter are dropped (echo) */
8128                 if (!memcmp(header->addr2, priv->net_dev->dev_addr, ETH_ALEN))
8129                         return 0;
8130
8131                 /* {broad,multi}cast packets to our BSSID go through */
8132                 if (is_multicast_ether_addr(header->addr1))
8133                         return !memcmp(header->addr3, priv->bssid, ETH_ALEN);
8134
8135                 /* packets to our adapter go through */
8136                 return !memcmp(header->addr1, priv->net_dev->dev_addr,
8137                                ETH_ALEN);
8138
8139         case IW_MODE_INFRA:     /* Header: Dest. | BSSID | Source */
8140                 /* packets from our adapter are dropped (echo) */
8141                 if (!memcmp(header->addr3, priv->net_dev->dev_addr, ETH_ALEN))
8142                         return 0;
8143
8144                 /* {broad,multi}cast packets to our BSS go through */
8145                 if (is_multicast_ether_addr(header->addr1))
8146                         return !memcmp(header->addr2, priv->bssid, ETH_ALEN);
8147
8148                 /* packets to our adapter go through */
8149                 return !memcmp(header->addr1, priv->net_dev->dev_addr,
8150                                ETH_ALEN);
8151         }
8152
8153         return 1;
8154 }
8155
8156 #define IPW_PACKET_RETRY_TIME HZ
8157
8158 static  int is_duplicate_packet(struct ipw_priv *priv,
8159                                       struct ieee80211_hdr_4addr *header)
8160 {
8161         u16 sc = le16_to_cpu(header->seq_ctl);
8162         u16 seq = WLAN_GET_SEQ_SEQ(sc);
8163         u16 frag = WLAN_GET_SEQ_FRAG(sc);
8164         u16 *last_seq, *last_frag;
8165         unsigned long *last_time;
8166
8167         switch (priv->ieee->iw_mode) {
8168         case IW_MODE_ADHOC:
8169                 {
8170                         struct list_head *p;
8171                         struct ipw_ibss_seq *entry = NULL;
8172                         u8 *mac = header->addr2;
8173                         int index = mac[5] % IPW_IBSS_MAC_HASH_SIZE;
8174
8175                         __list_for_each(p, &priv->ibss_mac_hash[index]) {
8176                                 entry =
8177                                     list_entry(p, struct ipw_ibss_seq, list);
8178                                 if (!memcmp(entry->mac, mac, ETH_ALEN))
8179                                         break;
8180                         }
8181                         if (p == &priv->ibss_mac_hash[index]) {
8182                                 entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
8183                                 if (!entry) {
8184                                         IPW_ERROR
8185                                             ("Cannot malloc new mac entry\n");
8186                                         return 0;
8187                                 }
8188                                 memcpy(entry->mac, mac, ETH_ALEN);
8189                                 entry->seq_num = seq;
8190                                 entry->frag_num = frag;
8191                                 entry->packet_time = jiffies;
8192                                 list_add(&entry->list,
8193                                          &priv->ibss_mac_hash[index]);
8194                                 return 0;
8195                         }
8196                         last_seq = &entry->seq_num;
8197                         last_frag = &entry->frag_num;
8198                         last_time = &entry->packet_time;
8199                         break;
8200                 }
8201         case IW_MODE_INFRA:
8202                 last_seq = &priv->last_seq_num;
8203                 last_frag = &priv->last_frag_num;
8204                 last_time = &priv->last_packet_time;
8205                 break;
8206         default:
8207                 return 0;
8208         }
8209         if ((*last_seq == seq) &&
8210             time_after(*last_time + IPW_PACKET_RETRY_TIME, jiffies)) {
8211                 if (*last_frag == frag)
8212                         goto drop;
8213                 if (*last_frag + 1 != frag)
8214                         /* out-of-order fragment */
8215                         goto drop;
8216         } else
8217                 *last_seq = seq;
8218
8219         *last_frag = frag;
8220         *last_time = jiffies;
8221         return 0;
8222
8223       drop:
8224         /* Comment this line now since we observed the card receives
8225          * duplicate packets but the FCTL_RETRY bit is not set in the
8226          * IBSS mode with fragmentation enabled.
8227          BUG_ON(!(le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_RETRY)); */
8228         return 1;
8229 }
8230
8231 static void ipw_handle_mgmt_packet(struct ipw_priv *priv,
8232                                    struct ipw_rx_mem_buffer *rxb,
8233                                    struct ieee80211_rx_stats *stats)
8234 {
8235         struct sk_buff *skb = rxb->skb;
8236         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)skb->data;
8237         struct ieee80211_hdr_4addr *header = (struct ieee80211_hdr_4addr *)
8238             (skb->data + IPW_RX_FRAME_SIZE);
8239
8240         ieee80211_rx_mgt(priv->ieee, header, stats);
8241
8242         if (priv->ieee->iw_mode == IW_MODE_ADHOC &&
8243             ((WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) ==
8244               IEEE80211_STYPE_PROBE_RESP) ||
8245              (WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) ==
8246               IEEE80211_STYPE_BEACON))) {
8247                 if (!memcmp(header->addr3, priv->bssid, ETH_ALEN))
8248                         ipw_add_station(priv, header->addr2);
8249         }
8250
8251         if (priv->config & CFG_NET_STATS) {
8252                 IPW_DEBUG_HC("sending stat packet\n");
8253
8254                 /* Set the size of the skb to the size of the full
8255                  * ipw header and 802.11 frame */
8256                 skb_put(skb, le16_to_cpu(pkt->u.frame.length) +
8257                         IPW_RX_FRAME_SIZE);
8258
8259                 /* Advance past the ipw packet header to the 802.11 frame */
8260                 skb_pull(skb, IPW_RX_FRAME_SIZE);
8261
8262                 /* Push the ieee80211_rx_stats before the 802.11 frame */
8263                 memcpy(skb_push(skb, sizeof(*stats)), stats, sizeof(*stats));
8264
8265                 skb->dev = priv->ieee->dev;
8266
8267                 /* Point raw at the ieee80211_stats */
8268                 skb_reset_mac_header(skb);
8269
8270                 skb->pkt_type = PACKET_OTHERHOST;
8271                 skb->protocol = __constant_htons(ETH_P_80211_STATS);
8272                 memset(skb->cb, 0, sizeof(rxb->skb->cb));
8273                 netif_rx(skb);
8274                 rxb->skb = NULL;
8275         }
8276 }
8277
8278 /*
8279  * Main entry function for recieving a packet with 80211 headers.  This
8280  * should be called when ever the FW has notified us that there is a new
8281  * skb in the recieve queue.
8282  */
8283 static void ipw_rx(struct ipw_priv *priv)
8284 {
8285         struct ipw_rx_mem_buffer *rxb;
8286         struct ipw_rx_packet *pkt;
8287         struct ieee80211_hdr_4addr *header;
8288         u32 r, w, i;
8289         u8 network_packet;
8290         u8 fill_rx = 0;
8291
8292         r = ipw_read32(priv, IPW_RX_READ_INDEX);
8293         w = ipw_read32(priv, IPW_RX_WRITE_INDEX);
8294         i = priv->rxq->read;
8295
8296         if (ipw_rx_queue_space (priv->rxq) > (RX_QUEUE_SIZE / 2))
8297                 fill_rx = 1;
8298
8299         while (i != r) {
8300                 rxb = priv->rxq->queue[i];
8301                 if (unlikely(rxb == NULL)) {
8302                         printk(KERN_CRIT "Queue not allocated!\n");
8303                         break;
8304                 }
8305                 priv->rxq->queue[i] = NULL;
8306
8307                 pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->dma_addr,
8308                                             IPW_RX_BUF_SIZE,
8309                                             PCI_DMA_FROMDEVICE);
8310
8311                 pkt = (struct ipw_rx_packet *)rxb->skb->data;
8312                 IPW_DEBUG_RX("Packet: type=%02X seq=%02X bits=%02X\n",
8313                              pkt->header.message_type,
8314                              pkt->header.rx_seq_num, pkt->header.control_bits);
8315
8316                 switch (pkt->header.message_type) {
8317                 case RX_FRAME_TYPE:     /* 802.11 frame */  {
8318                                 struct ieee80211_rx_stats stats = {
8319                                         .rssi = pkt->u.frame.rssi_dbm -
8320                                             IPW_RSSI_TO_DBM,
8321                                         .signal =
8322                                             le16_to_cpu(pkt->u.frame.rssi_dbm) -
8323                                             IPW_RSSI_TO_DBM + 0x100,
8324                                         .noise =
8325                                             le16_to_cpu(pkt->u.frame.noise),
8326                                         .rate = pkt->u.frame.rate,
8327                                         .mac_time = jiffies,
8328                                         .received_channel =
8329                                             pkt->u.frame.received_channel,
8330                                         .freq =
8331                                             (pkt->u.frame.
8332                                              control & (1 << 0)) ?
8333                                             IEEE80211_24GHZ_BAND :
8334                                             IEEE80211_52GHZ_BAND,
8335                                         .len = le16_to_cpu(pkt->u.frame.length),
8336                                 };
8337
8338                                 if (stats.rssi != 0)
8339                                         stats.mask |= IEEE80211_STATMASK_RSSI;
8340                                 if (stats.signal != 0)
8341                                         stats.mask |= IEEE80211_STATMASK_SIGNAL;
8342                                 if (stats.noise != 0)
8343                                         stats.mask |= IEEE80211_STATMASK_NOISE;
8344                                 if (stats.rate != 0)
8345                                         stats.mask |= IEEE80211_STATMASK_RATE;
8346
8347                                 priv->rx_packets++;
8348
8349 #ifdef CONFIG_IPW2200_PROMISCUOUS
8350         if (priv->prom_net_dev && netif_running(priv->prom_net_dev))
8351                 ipw_handle_promiscuous_rx(priv, rxb, &stats);
8352 #endif
8353
8354 #ifdef CONFIG_IPW2200_MONITOR
8355                                 if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
8356 #ifdef CONFIG_IPW2200_RADIOTAP
8357
8358                 ipw_handle_data_packet_monitor(priv,
8359                                                rxb,
8360                                                &stats);
8361 #else
8362                 ipw_handle_data_packet(priv, rxb,
8363                                        &stats);
8364 #endif
8365                                         break;
8366                                 }
8367 #endif
8368
8369                                 header =
8370                                     (struct ieee80211_hdr_4addr *)(rxb->skb->
8371                                                                    data +
8372                                                                    IPW_RX_FRAME_SIZE);
8373                                 /* TODO: Check Ad-Hoc dest/source and make sure
8374                                  * that we are actually parsing these packets
8375                                  * correctly -- we should probably use the
8376                                  * frame control of the packet and disregard
8377                                  * the current iw_mode */
8378
8379                                 network_packet =
8380                                     is_network_packet(priv, header);
8381                                 if (network_packet && priv->assoc_network) {
8382                                         priv->assoc_network->stats.rssi =
8383                                             stats.rssi;
8384                                         priv->exp_avg_rssi =
8385                                             exponential_average(priv->exp_avg_rssi,
8386                                             stats.rssi, DEPTH_RSSI);
8387                                 }
8388
8389                                 IPW_DEBUG_RX("Frame: len=%u\n",
8390                                              le16_to_cpu(pkt->u.frame.length));
8391
8392                                 if (le16_to_cpu(pkt->u.frame.length) <
8393                                     ieee80211_get_hdrlen(le16_to_cpu(
8394                                                     header->frame_ctl))) {
8395                                         IPW_DEBUG_DROP
8396                                             ("Received packet is too small. "
8397                                              "Dropping.\n");
8398                                         priv->ieee->stats.rx_errors++;
8399                                         priv->wstats.discard.misc++;
8400                                         break;
8401                                 }
8402
8403                                 switch (WLAN_FC_GET_TYPE
8404                                         (le16_to_cpu(header->frame_ctl))) {
8405
8406                                 case IEEE80211_FTYPE_MGMT:
8407                                         ipw_handle_mgmt_packet(priv, rxb,
8408                                                                &stats);
8409                                         break;
8410
8411                                 case IEEE80211_FTYPE_CTL:
8412                                         break;
8413
8414                                 case IEEE80211_FTYPE_DATA:
8415                                         if (unlikely(!network_packet ||
8416                                                      is_duplicate_packet(priv,
8417                                                                          header)))
8418                                         {
8419                                                 IPW_DEBUG_DROP("Dropping: "
8420                                                                "%pM, "
8421                                                                "%pM, "
8422                                                                "%pM\n",
8423                                                                header->addr1,
8424                                                                header->addr2,
8425                                                                header->addr3);
8426                                                 break;
8427                                         }
8428
8429                                         ipw_handle_data_packet(priv, rxb,
8430                                                                &stats);
8431
8432                                         break;
8433                                 }
8434                                 break;
8435                         }
8436
8437                 case RX_HOST_NOTIFICATION_TYPE:{
8438                                 IPW_DEBUG_RX
8439                                     ("Notification: subtype=%02X flags=%02X size=%d\n",
8440                                      pkt->u.notification.subtype,
8441                                      pkt->u.notification.flags,
8442                                      le16_to_cpu(pkt->u.notification.size));
8443                                 ipw_rx_notification(priv, &pkt->u.notification);
8444                                 break;
8445                         }
8446
8447                 default:
8448                         IPW_DEBUG_RX("Bad Rx packet of type %d\n",
8449                                      pkt->header.message_type);
8450                         break;
8451                 }
8452
8453                 /* For now we just don't re-use anything.  We can tweak this
8454                  * later to try and re-use notification packets and SKBs that
8455                  * fail to Rx correctly */
8456                 if (rxb->skb != NULL) {
8457                         dev_kfree_skb_any(rxb->skb);
8458                         rxb->skb = NULL;
8459                 }
8460
8461                 pci_unmap_single(priv->pci_dev, rxb->dma_addr,
8462                                  IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
8463                 list_add_tail(&rxb->list, &priv->rxq->rx_used);
8464
8465                 i = (i + 1) % RX_QUEUE_SIZE;
8466
8467                 /* If there are a lot of unsued frames, restock the Rx queue
8468                  * so the ucode won't assert */
8469                 if (fill_rx) {
8470                         priv->rxq->read = i;
8471                         ipw_rx_queue_replenish(priv);
8472                 }
8473         }
8474
8475         /* Backtrack one entry */
8476         priv->rxq->read = i;
8477         ipw_rx_queue_restock(priv);
8478 }
8479
8480 #define DEFAULT_RTS_THRESHOLD     2304U
8481 #define MIN_RTS_THRESHOLD         1U
8482 #define MAX_RTS_THRESHOLD         2304U
8483 #define DEFAULT_BEACON_INTERVAL   100U
8484 #define DEFAULT_SHORT_RETRY_LIMIT 7U
8485 #define DEFAULT_LONG_RETRY_LIMIT  4U
8486
8487 /**
8488  * ipw_sw_reset
8489  * @option: options to control different reset behaviour
8490  *          0 = reset everything except the 'disable' module_param
8491  *          1 = reset everything and print out driver info (for probe only)
8492  *          2 = reset everything
8493  */
8494 static int ipw_sw_reset(struct ipw_priv *priv, int option)
8495 {
8496         int band, modulation;
8497         int old_mode = priv->ieee->iw_mode;
8498
8499         /* Initialize module parameter values here */
8500         priv->config = 0;
8501
8502         /* We default to disabling the LED code as right now it causes
8503          * too many systems to lock up... */
8504         if (!led)
8505                 priv->config |= CFG_NO_LED;
8506
8507         if (associate)
8508                 priv->config |= CFG_ASSOCIATE;
8509         else
8510                 IPW_DEBUG_INFO("Auto associate disabled.\n");
8511
8512         if (auto_create)
8513                 priv->config |= CFG_ADHOC_CREATE;
8514         else
8515                 IPW_DEBUG_INFO("Auto adhoc creation disabled.\n");
8516
8517         priv->config &= ~CFG_STATIC_ESSID;
8518         priv->essid_len = 0;
8519         memset(priv->essid, 0, IW_ESSID_MAX_SIZE);
8520
8521         if (disable && option) {
8522                 priv->status |= STATUS_RF_KILL_SW;
8523                 IPW_DEBUG_INFO("Radio disabled.\n");
8524         }
8525
8526         if (channel != 0) {
8527                 priv->config |= CFG_STATIC_CHANNEL;
8528                 priv->channel = channel;
8529                 IPW_DEBUG_INFO("Bind to static channel %d\n", channel);
8530                 /* TODO: Validate that provided channel is in range */
8531         }
8532 #ifdef CONFIG_IPW2200_QOS
8533         ipw_qos_init(priv, qos_enable, qos_burst_enable,
8534                      burst_duration_CCK, burst_duration_OFDM);
8535 #endif                          /* CONFIG_IPW2200_QOS */
8536
8537         switch (mode) {
8538         case 1:
8539                 priv->ieee->iw_mode = IW_MODE_ADHOC;
8540                 priv->net_dev->type = ARPHRD_ETHER;
8541
8542                 break;
8543 #ifdef CONFIG_IPW2200_MONITOR
8544         case 2:
8545                 priv->ieee->iw_mode = IW_MODE_MONITOR;
8546 #ifdef CONFIG_IPW2200_RADIOTAP
8547                 priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
8548 #else
8549                 priv->net_dev->type = ARPHRD_IEEE80211;
8550 #endif
8551                 break;
8552 #endif
8553         default:
8554         case 0:
8555                 priv->net_dev->type = ARPHRD_ETHER;
8556                 priv->ieee->iw_mode = IW_MODE_INFRA;
8557                 break;
8558         }
8559
8560         if (hwcrypto) {
8561                 priv->ieee->host_encrypt = 0;
8562                 priv->ieee->host_encrypt_msdu = 0;
8563                 priv->ieee->host_decrypt = 0;
8564                 priv->ieee->host_mc_decrypt = 0;
8565         }
8566         IPW_DEBUG_INFO("Hardware crypto [%s]\n", hwcrypto ? "on" : "off");
8567
8568         /* IPW2200/2915 is abled to do hardware fragmentation. */
8569         priv->ieee->host_open_frag = 0;
8570
8571         if ((priv->pci_dev->device == 0x4223) ||
8572             (priv->pci_dev->device == 0x4224)) {
8573                 if (option == 1)
8574                         printk(KERN_INFO DRV_NAME
8575                                ": Detected Intel PRO/Wireless 2915ABG Network "
8576                                "Connection\n");
8577                 priv->ieee->abg_true = 1;
8578                 band = IEEE80211_52GHZ_BAND | IEEE80211_24GHZ_BAND;
8579                 modulation = IEEE80211_OFDM_MODULATION |
8580                     IEEE80211_CCK_MODULATION;
8581                 priv->adapter = IPW_2915ABG;
8582                 priv->ieee->mode = IEEE_A | IEEE_G | IEEE_B;
8583         } else {
8584                 if (option == 1)
8585                         printk(KERN_INFO DRV_NAME
8586                                ": Detected Intel PRO/Wireless 2200BG Network "
8587                                "Connection\n");
8588
8589                 priv->ieee->abg_true = 0;
8590                 band = IEEE80211_24GHZ_BAND;
8591                 modulation = IEEE80211_OFDM_MODULATION |
8592                     IEEE80211_CCK_MODULATION;
8593                 priv->adapter = IPW_2200BG;
8594                 priv->ieee->mode = IEEE_G | IEEE_B;
8595         }
8596
8597         priv->ieee->freq_band = band;
8598         priv->ieee->modulation = modulation;
8599
8600         priv->rates_mask = IEEE80211_DEFAULT_RATES_MASK;
8601
8602         priv->disassociate_threshold = IPW_MB_DISASSOCIATE_THRESHOLD_DEFAULT;
8603         priv->roaming_threshold = IPW_MB_ROAMING_THRESHOLD_DEFAULT;
8604
8605         priv->rts_threshold = DEFAULT_RTS_THRESHOLD;
8606         priv->short_retry_limit = DEFAULT_SHORT_RETRY_LIMIT;
8607         priv->long_retry_limit = DEFAULT_LONG_RETRY_LIMIT;
8608
8609         /* If power management is turned on, default to AC mode */
8610         priv->power_mode = IPW_POWER_AC;
8611         priv->tx_power = IPW_TX_POWER_DEFAULT;
8612
8613         return old_mode == priv->ieee->iw_mode;
8614 }
8615
8616 /*
8617  * This file defines the Wireless Extension handlers.  It does not
8618  * define any methods of hardware manipulation and relies on the
8619  * functions defined in ipw_main to provide the HW interaction.
8620  *
8621  * The exception to this is the use of the ipw_get_ordinal()
8622  * function used to poll the hardware vs. making unecessary calls.
8623  *
8624  */
8625
8626 static int ipw_wx_get_name(struct net_device *dev,
8627                            struct iw_request_info *info,
8628                            union iwreq_data *wrqu, char *extra)
8629 {
8630         struct ipw_priv *priv = ieee80211_priv(dev);
8631         mutex_lock(&priv->mutex);
8632         if (priv->status & STATUS_RF_KILL_MASK)
8633                 strcpy(wrqu->name, "radio off");
8634         else if (!(priv->status & STATUS_ASSOCIATED))
8635                 strcpy(wrqu->name, "unassociated");
8636         else
8637                 snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11%c",
8638                          ipw_modes[priv->assoc_request.ieee_mode]);
8639         IPW_DEBUG_WX("Name: %s\n", wrqu->name);
8640         mutex_unlock(&priv->mutex);
8641         return 0;
8642 }
8643
8644 static int ipw_set_channel(struct ipw_priv *priv, u8 channel)
8645 {
8646         if (channel == 0) {
8647                 IPW_DEBUG_INFO("Setting channel to ANY (0)\n");
8648                 priv->config &= ~CFG_STATIC_CHANNEL;
8649                 IPW_DEBUG_ASSOC("Attempting to associate with new "
8650                                 "parameters.\n");
8651                 ipw_associate(priv);
8652                 return 0;
8653         }
8654
8655         priv->config |= CFG_STATIC_CHANNEL;
8656
8657         if (priv->channel == channel) {
8658                 IPW_DEBUG_INFO("Request to set channel to current value (%d)\n",
8659                                channel);
8660                 return 0;
8661         }
8662
8663         IPW_DEBUG_INFO("Setting channel to %i\n", (int)channel);
8664         priv->channel = channel;
8665
8666 #ifdef CONFIG_IPW2200_MONITOR
8667         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
8668                 int i;
8669                 if (priv->status & STATUS_SCANNING) {
8670                         IPW_DEBUG_SCAN("Scan abort triggered due to "
8671                                        "channel change.\n");
8672                         ipw_abort_scan(priv);
8673                 }
8674
8675                 for (i = 1000; i && (priv->status & STATUS_SCANNING); i--)
8676                         udelay(10);
8677
8678                 if (priv->status & STATUS_SCANNING)
8679                         IPW_DEBUG_SCAN("Still scanning...\n");
8680                 else
8681                         IPW_DEBUG_SCAN("Took %dms to abort current scan\n",
8682                                        1000 - i);
8683
8684                 return 0;
8685         }
8686 #endif                          /* CONFIG_IPW2200_MONITOR */
8687
8688         /* Network configuration changed -- force [re]association */
8689         IPW_DEBUG_ASSOC("[re]association triggered due to channel change.\n");
8690         if (!ipw_disassociate(priv))
8691                 ipw_associate(priv);
8692
8693         return 0;
8694 }
8695
8696 static int ipw_wx_set_freq(struct net_device *dev,
8697                            struct iw_request_info *info,
8698                            union iwreq_data *wrqu, char *extra)
8699 {
8700         struct ipw_priv *priv = ieee80211_priv(dev);
8701         const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
8702         struct iw_freq *fwrq = &wrqu->freq;
8703         int ret = 0, i;
8704         u8 channel, flags;
8705         int band;
8706
8707         if (fwrq->m == 0) {
8708                 IPW_DEBUG_WX("SET Freq/Channel -> any\n");
8709                 mutex_lock(&priv->mutex);
8710                 ret = ipw_set_channel(priv, 0);
8711                 mutex_unlock(&priv->mutex);
8712                 return ret;
8713         }
8714         /* if setting by freq convert to channel */
8715         if (fwrq->e == 1) {
8716                 channel = ieee80211_freq_to_channel(priv->ieee, fwrq->m);
8717                 if (channel == 0)
8718                         return -EINVAL;
8719         } else
8720                 channel = fwrq->m;
8721
8722         if (!(band = ieee80211_is_valid_channel(priv->ieee, channel)))
8723                 return -EINVAL;
8724
8725         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
8726                 i = ieee80211_channel_to_index(priv->ieee, channel);
8727                 if (i == -1)
8728                         return -EINVAL;
8729
8730                 flags = (band == IEEE80211_24GHZ_BAND) ?
8731                     geo->bg[i].flags : geo->a[i].flags;
8732                 if (flags & IEEE80211_CH_PASSIVE_ONLY) {
8733                         IPW_DEBUG_WX("Invalid Ad-Hoc channel for 802.11a\n");
8734                         return -EINVAL;
8735                 }
8736         }
8737
8738         IPW_DEBUG_WX("SET Freq/Channel -> %d \n", fwrq->m);
8739         mutex_lock(&priv->mutex);
8740         ret = ipw_set_channel(priv, channel);
8741         mutex_unlock(&priv->mutex);
8742         return ret;
8743 }
8744
8745 static int ipw_wx_get_freq(struct net_device *dev,
8746                            struct iw_request_info *info,
8747                            union iwreq_data *wrqu, char *extra)
8748 {
8749         struct ipw_priv *priv = ieee80211_priv(dev);
8750
8751         wrqu->freq.e = 0;
8752
8753         /* If we are associated, trying to associate, or have a statically
8754          * configured CHANNEL then return that; otherwise return ANY */
8755         mutex_lock(&priv->mutex);
8756         if (priv->config & CFG_STATIC_CHANNEL ||
8757             priv->status & (STATUS_ASSOCIATING | STATUS_ASSOCIATED)) {
8758                 int i;
8759
8760                 i = ieee80211_channel_to_index(priv->ieee, priv->channel);
8761                 BUG_ON(i == -1);
8762                 wrqu->freq.e = 1;
8763
8764                 switch (ieee80211_is_valid_channel(priv->ieee, priv->channel)) {
8765                 case IEEE80211_52GHZ_BAND:
8766                         wrqu->freq.m = priv->ieee->geo.a[i].freq * 100000;
8767                         break;
8768
8769                 case IEEE80211_24GHZ_BAND:
8770                         wrqu->freq.m = priv->ieee->geo.bg[i].freq * 100000;
8771                         break;
8772
8773                 default:
8774                         BUG();
8775                 }
8776         } else
8777                 wrqu->freq.m = 0;
8778
8779         mutex_unlock(&priv->mutex);
8780         IPW_DEBUG_WX("GET Freq/Channel -> %d \n", priv->channel);
8781         return 0;
8782 }
8783
8784 static int ipw_wx_set_mode(struct net_device *dev,
8785                            struct iw_request_info *info,
8786                            union iwreq_data *wrqu, char *extra)
8787 {
8788         struct ipw_priv *priv = ieee80211_priv(dev);
8789         int err = 0;
8790
8791         IPW_DEBUG_WX("Set MODE: %d\n", wrqu->mode);
8792
8793         switch (wrqu->mode) {
8794 #ifdef CONFIG_IPW2200_MONITOR
8795         case IW_MODE_MONITOR:
8796 #endif
8797         case IW_MODE_ADHOC:
8798         case IW_MODE_INFRA:
8799                 break;
8800         case IW_MODE_AUTO:
8801                 wrqu->mode = IW_MODE_INFRA;
8802                 break;
8803         default:
8804                 return -EINVAL;
8805         }
8806         if (wrqu->mode == priv->ieee->iw_mode)
8807                 return 0;
8808
8809         mutex_lock(&priv->mutex);
8810
8811         ipw_sw_reset(priv, 0);
8812
8813 #ifdef CONFIG_IPW2200_MONITOR
8814         if (priv->ieee->iw_mode == IW_MODE_MONITOR)
8815                 priv->net_dev->type = ARPHRD_ETHER;
8816
8817         if (wrqu->mode == IW_MODE_MONITOR)
8818 #ifdef CONFIG_IPW2200_RADIOTAP
8819                 priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
8820 #else
8821                 priv->net_dev->type = ARPHRD_IEEE80211;
8822 #endif
8823 #endif                          /* CONFIG_IPW2200_MONITOR */
8824
8825         /* Free the existing firmware and reset the fw_loaded
8826          * flag so ipw_load() will bring in the new firmawre */
8827         free_firmware();
8828
8829         priv->ieee->iw_mode = wrqu->mode;
8830
8831         queue_work(priv->workqueue, &priv->adapter_restart);
8832         mutex_unlock(&priv->mutex);
8833         return err;
8834 }
8835
8836 static int ipw_wx_get_mode(struct net_device *dev,
8837                            struct iw_request_info *info,
8838                            union iwreq_data *wrqu, char *extra)
8839 {
8840         struct ipw_priv *priv = ieee80211_priv(dev);
8841         mutex_lock(&priv->mutex);
8842         wrqu->mode = priv->ieee->iw_mode;
8843         IPW_DEBUG_WX("Get MODE -> %d\n", wrqu->mode);
8844         mutex_unlock(&priv->mutex);
8845         return 0;
8846 }
8847
8848 /* Values are in microsecond */
8849 static const s32 timeout_duration[] = {
8850         350000,
8851         250000,
8852         75000,
8853         37000,
8854         25000,
8855 };
8856
8857 static const s32 period_duration[] = {
8858         400000,
8859         700000,
8860         1000000,
8861         1000000,
8862         1000000
8863 };
8864
8865 static int ipw_wx_get_range(struct net_device *dev,
8866                             struct iw_request_info *info,
8867                             union iwreq_data *wrqu, char *extra)
8868 {
8869         struct ipw_priv *priv = ieee80211_priv(dev);
8870         struct iw_range *range = (struct iw_range *)extra;
8871         const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
8872         int i = 0, j;
8873
8874         wrqu->data.length = sizeof(*range);
8875         memset(range, 0, sizeof(*range));
8876
8877         /* 54Mbs == ~27 Mb/s real (802.11g) */
8878         range->throughput = 27 * 1000 * 1000;
8879
8880         range->max_qual.qual = 100;
8881         /* TODO: Find real max RSSI and stick here */
8882         range->max_qual.level = 0;
8883         range->max_qual.noise = 0;
8884         range->max_qual.updated = 7;    /* Updated all three */
8885
8886         range->avg_qual.qual = 70;
8887         /* TODO: Find real 'good' to 'bad' threshol value for RSSI */
8888         range->avg_qual.level = 0;      /* FIXME to real average level */
8889         range->avg_qual.noise = 0;
8890         range->avg_qual.updated = 7;    /* Updated all three */
8891         mutex_lock(&priv->mutex);
8892         range->num_bitrates = min(priv->rates.num_rates, (u8) IW_MAX_BITRATES);
8893
8894         for (i = 0; i < range->num_bitrates; i++)
8895                 range->bitrate[i] = (priv->rates.supported_rates[i] & 0x7F) *
8896                     500000;
8897
8898         range->max_rts = DEFAULT_RTS_THRESHOLD;
8899         range->min_frag = MIN_FRAG_THRESHOLD;
8900         range->max_frag = MAX_FRAG_THRESHOLD;
8901
8902         range->encoding_size[0] = 5;
8903         range->encoding_size[1] = 13;
8904         range->num_encoding_sizes = 2;
8905         range->max_encoding_tokens = WEP_KEYS;
8906
8907         /* Set the Wireless Extension versions */
8908         range->we_version_compiled = WIRELESS_EXT;
8909         range->we_version_source = 18;
8910
8911         i = 0;
8912         if (priv->ieee->mode & (IEEE_B | IEEE_G)) {
8913                 for (j = 0; j < geo->bg_channels && i < IW_MAX_FREQUENCIES; j++) {
8914                         if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
8915                             (geo->bg[j].flags & IEEE80211_CH_PASSIVE_ONLY))
8916                                 continue;
8917
8918                         range->freq[i].i = geo->bg[j].channel;
8919                         range->freq[i].m = geo->bg[j].freq * 100000;
8920                         range->freq[i].e = 1;
8921                         i++;
8922                 }
8923         }
8924
8925         if (priv->ieee->mode & IEEE_A) {
8926                 for (j = 0; j < geo->a_channels && i < IW_MAX_FREQUENCIES; j++) {
8927                         if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
8928                             (geo->a[j].flags & IEEE80211_CH_PASSIVE_ONLY))
8929                                 continue;
8930
8931                         range->freq[i].i = geo->a[j].channel;
8932                         range->freq[i].m = geo->a[j].freq * 100000;
8933                         range->freq[i].e = 1;
8934                         i++;
8935                 }
8936         }
8937
8938         range->num_channels = i;
8939         range->num_frequency = i;
8940
8941         mutex_unlock(&priv->mutex);
8942
8943         /* Event capability (kernel + driver) */
8944         range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
8945                                 IW_EVENT_CAPA_MASK(SIOCGIWTHRSPY) |
8946                                 IW_EVENT_CAPA_MASK(SIOCGIWAP) |
8947                                 IW_EVENT_CAPA_MASK(SIOCGIWSCAN));
8948         range->event_capa[1] = IW_EVENT_CAPA_K_1;
8949
8950         range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
8951                 IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
8952
8953         range->scan_capa = IW_SCAN_CAPA_ESSID | IW_SCAN_CAPA_TYPE;
8954
8955         IPW_DEBUG_WX("GET Range\n");
8956         return 0;
8957 }
8958
8959 static int ipw_wx_set_wap(struct net_device *dev,
8960                           struct iw_request_info *info,
8961                           union iwreq_data *wrqu, char *extra)
8962 {
8963         struct ipw_priv *priv = ieee80211_priv(dev);
8964
8965         static const unsigned char any[] = {
8966                 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
8967         };
8968         static const unsigned char off[] = {
8969                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
8970         };
8971
8972         if (wrqu->ap_addr.sa_family != ARPHRD_ETHER)
8973                 return -EINVAL;
8974         mutex_lock(&priv->mutex);
8975         if (!memcmp(any, wrqu->ap_addr.sa_data, ETH_ALEN) ||
8976             !memcmp(off, wrqu->ap_addr.sa_data, ETH_ALEN)) {
8977                 /* we disable mandatory BSSID association */
8978                 IPW_DEBUG_WX("Setting AP BSSID to ANY\n");
8979                 priv->config &= ~CFG_STATIC_BSSID;
8980                 IPW_DEBUG_ASSOC("Attempting to associate with new "
8981                                 "parameters.\n");
8982                 ipw_associate(priv);
8983                 mutex_unlock(&priv->mutex);
8984                 return 0;
8985         }
8986
8987         priv->config |= CFG_STATIC_BSSID;
8988         if (!memcmp(priv->bssid, wrqu->ap_addr.sa_data, ETH_ALEN)) {
8989                 IPW_DEBUG_WX("BSSID set to current BSSID.\n");
8990                 mutex_unlock(&priv->mutex);
8991                 return 0;
8992         }
8993
8994         IPW_DEBUG_WX("Setting mandatory BSSID to %pM\n",
8995                      wrqu->ap_addr.sa_data);
8996
8997         memcpy(priv->bssid, wrqu->ap_addr.sa_data, ETH_ALEN);
8998
8999         /* Network configuration changed -- force [re]association */
9000         IPW_DEBUG_ASSOC("[re]association triggered due to BSSID change.\n");
9001         if (!ipw_disassociate(priv))
9002                 ipw_associate(priv);
9003
9004         mutex_unlock(&priv->mutex);
9005         return 0;
9006 }
9007
9008 static int ipw_wx_get_wap(struct net_device *dev,
9009                           struct iw_request_info *info,
9010                           union iwreq_data *wrqu, char *extra)
9011 {
9012         struct ipw_priv *priv = ieee80211_priv(dev);
9013
9014         /* If we are associated, trying to associate, or have a statically
9015          * configured BSSID then return that; otherwise return ANY */
9016         mutex_lock(&priv->mutex);
9017         if (priv->config & CFG_STATIC_BSSID ||
9018             priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
9019                 wrqu->ap_addr.sa_family = ARPHRD_ETHER;
9020                 memcpy(wrqu->ap_addr.sa_data, priv->bssid, ETH_ALEN);
9021         } else
9022                 memset(wrqu->ap_addr.sa_data, 0, ETH_ALEN);
9023
9024         IPW_DEBUG_WX("Getting WAP BSSID: %pM\n",
9025                      wrqu->ap_addr.sa_data);
9026         mutex_unlock(&priv->mutex);
9027         return 0;
9028 }
9029
9030 static int ipw_wx_set_essid(struct net_device *dev,
9031                             struct iw_request_info *info,
9032                             union iwreq_data *wrqu, char *extra)
9033 {
9034         struct ipw_priv *priv = ieee80211_priv(dev);
9035         int length;
9036
9037         mutex_lock(&priv->mutex);
9038
9039         if (!wrqu->essid.flags)
9040         {
9041                 IPW_DEBUG_WX("Setting ESSID to ANY\n");
9042                 ipw_disassociate(priv);
9043                 priv->config &= ~CFG_STATIC_ESSID;
9044                 ipw_associate(priv);
9045                 mutex_unlock(&priv->mutex);
9046                 return 0;
9047         }
9048
9049         length = min((int)wrqu->essid.length, IW_ESSID_MAX_SIZE);
9050
9051         priv->config |= CFG_STATIC_ESSID;
9052
9053         if (priv->essid_len == length && !memcmp(priv->essid, extra, length)
9054             && (priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING))) {
9055                 IPW_DEBUG_WX("ESSID set to current ESSID.\n");
9056                 mutex_unlock(&priv->mutex);
9057                 return 0;
9058         }
9059
9060         IPW_DEBUG_WX("Setting ESSID: '%s' (%d)\n", escape_essid(extra, length),
9061                      length);
9062
9063         priv->essid_len = length;
9064         memcpy(priv->essid, extra, priv->essid_len);
9065
9066         /* Network configuration changed -- force [re]association */
9067         IPW_DEBUG_ASSOC("[re]association triggered due to ESSID change.\n");
9068         if (!ipw_disassociate(priv))
9069                 ipw_associate(priv);
9070
9071         mutex_unlock(&priv->mutex);
9072         return 0;
9073 }
9074
9075 static int ipw_wx_get_essid(struct net_device *dev,
9076                             struct iw_request_info *info,
9077                             union iwreq_data *wrqu, char *extra)
9078 {
9079         struct ipw_priv *priv = ieee80211_priv(dev);
9080
9081         /* If we are associated, trying to associate, or have a statically
9082          * configured ESSID then return that; otherwise return ANY */
9083         mutex_lock(&priv->mutex);
9084         if (priv->config & CFG_STATIC_ESSID ||
9085             priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
9086                 IPW_DEBUG_WX("Getting essid: '%s'\n",
9087                              escape_essid(priv->essid, priv->essid_len));
9088                 memcpy(extra, priv->essid, priv->essid_len);
9089                 wrqu->essid.length = priv->essid_len;
9090                 wrqu->essid.flags = 1;  /* active */
9091         } else {
9092                 IPW_DEBUG_WX("Getting essid: ANY\n");
9093                 wrqu->essid.length = 0;
9094                 wrqu->essid.flags = 0;  /* active */
9095         }
9096         mutex_unlock(&priv->mutex);
9097         return 0;
9098 }
9099
9100 static int ipw_wx_set_nick(struct net_device *dev,
9101                            struct iw_request_info *info,
9102                            union iwreq_data *wrqu, char *extra)
9103 {
9104         struct ipw_priv *priv = ieee80211_priv(dev);
9105
9106         IPW_DEBUG_WX("Setting nick to '%s'\n", extra);
9107         if (wrqu->data.length > IW_ESSID_MAX_SIZE)
9108                 return -E2BIG;
9109         mutex_lock(&priv->mutex);
9110         wrqu->data.length = min((size_t) wrqu->data.length, sizeof(priv->nick));
9111         memset(priv->nick, 0, sizeof(priv->nick));
9112         memcpy(priv->nick, extra, wrqu->data.length);
9113         IPW_DEBUG_TRACE("<<\n");
9114         mutex_unlock(&priv->mutex);
9115         return 0;
9116
9117 }
9118
9119 static int ipw_wx_get_nick(struct net_device *dev,
9120                            struct iw_request_info *info,
9121                            union iwreq_data *wrqu, char *extra)
9122 {
9123         struct ipw_priv *priv = ieee80211_priv(dev);
9124         IPW_DEBUG_WX("Getting nick\n");
9125         mutex_lock(&priv->mutex);
9126         wrqu->data.length = strlen(priv->nick);
9127         memcpy(extra, priv->nick, wrqu->data.length);
9128         wrqu->data.flags = 1;   /* active */
9129         mutex_unlock(&priv->mutex);
9130         return 0;
9131 }
9132
9133 static int ipw_wx_set_sens(struct net_device *dev,
9134                             struct iw_request_info *info,
9135                             union iwreq_data *wrqu, char *extra)
9136 {
9137         struct ipw_priv *priv = ieee80211_priv(dev);
9138         int err = 0;
9139
9140         IPW_DEBUG_WX("Setting roaming threshold to %d\n", wrqu->sens.value);
9141         IPW_DEBUG_WX("Setting disassociate threshold to %d\n", 3*wrqu->sens.value);
9142         mutex_lock(&priv->mutex);
9143
9144         if (wrqu->sens.fixed == 0)
9145         {
9146                 priv->roaming_threshold = IPW_MB_ROAMING_THRESHOLD_DEFAULT;
9147                 priv->disassociate_threshold = IPW_MB_DISASSOCIATE_THRESHOLD_DEFAULT;
9148                 goto out;
9149         }
9150         if ((wrqu->sens.value > IPW_MB_ROAMING_THRESHOLD_MAX) ||
9151             (wrqu->sens.value < IPW_MB_ROAMING_THRESHOLD_MIN)) {
9152                 err = -EINVAL;
9153                 goto out;
9154         }
9155
9156         priv->roaming_threshold = wrqu->sens.value;
9157         priv->disassociate_threshold = 3*wrqu->sens.value;
9158       out:
9159         mutex_unlock(&priv->mutex);
9160         return err;
9161 }
9162
9163 static int ipw_wx_get_sens(struct net_device *dev,
9164                             struct iw_request_info *info,
9165                             union iwreq_data *wrqu, char *extra)
9166 {
9167         struct ipw_priv *priv = ieee80211_priv(dev);
9168         mutex_lock(&priv->mutex);
9169         wrqu->sens.fixed = 1;
9170         wrqu->sens.value = priv->roaming_threshold;
9171         mutex_unlock(&priv->mutex);
9172
9173         IPW_DEBUG_WX("GET roaming threshold -> %s %d \n",
9174                      wrqu->power.disabled ? "OFF" : "ON", wrqu->power.value);
9175
9176         return 0;
9177 }
9178
9179 static int ipw_wx_set_rate(struct net_device *dev,
9180                            struct iw_request_info *info,
9181                            union iwreq_data *wrqu, char *extra)
9182 {
9183         /* TODO: We should use semaphores or locks for access to priv */
9184         struct ipw_priv *priv = ieee80211_priv(dev);
9185         u32 target_rate = wrqu->bitrate.value;
9186         u32 fixed, mask;
9187
9188         /* value = -1, fixed = 0 means auto only, so we should use all rates offered by AP */
9189         /* value = X, fixed = 1 means only rate X */
9190         /* value = X, fixed = 0 means all rates lower equal X */
9191
9192         if (target_rate == -1) {
9193                 fixed = 0;
9194                 mask = IEEE80211_DEFAULT_RATES_MASK;
9195                 /* Now we should reassociate */
9196                 goto apply;
9197         }
9198
9199         mask = 0;
9200         fixed = wrqu->bitrate.fixed;
9201
9202         if (target_rate == 1000000 || !fixed)
9203                 mask |= IEEE80211_CCK_RATE_1MB_MASK;
9204         if (target_rate == 1000000)
9205                 goto apply;
9206
9207         if (target_rate == 2000000 || !fixed)
9208                 mask |= IEEE80211_CCK_RATE_2MB_MASK;
9209         if (target_rate == 2000000)
9210                 goto apply;
9211
9212         if (target_rate == 5500000 || !fixed)
9213                 mask |= IEEE80211_CCK_RATE_5MB_MASK;
9214         if (target_rate == 5500000)
9215                 goto apply;
9216
9217         if (target_rate == 6000000 || !fixed)
9218                 mask |= IEEE80211_OFDM_RATE_6MB_MASK;
9219         if (target_rate == 6000000)
9220                 goto apply;
9221
9222         if (target_rate == 9000000 || !fixed)
9223                 mask |= IEEE80211_OFDM_RATE_9MB_MASK;
9224         if (target_rate == 9000000)
9225                 goto apply;
9226
9227         if (target_rate == 11000000 || !fixed)
9228                 mask |= IEEE80211_CCK_RATE_11MB_MASK;
9229         if (target_rate == 11000000)
9230                 goto apply;
9231
9232         if (target_rate == 12000000 || !fixed)
9233                 mask |= IEEE80211_OFDM_RATE_12MB_MASK;
9234         if (target_rate == 12000000)
9235                 goto apply;
9236
9237         if (target_rate == 18000000 || !fixed)
9238                 mask |= IEEE80211_OFDM_RATE_18MB_MASK;
9239         if (target_rate == 18000000)
9240                 goto apply;
9241
9242         if (target_rate == 24000000 || !fixed)
9243                 mask |= IEEE80211_OFDM_RATE_24MB_MASK;
9244         if (target_rate == 24000000)
9245                 goto apply;
9246
9247         if (target_rate == 36000000 || !fixed)
9248                 mask |= IEEE80211_OFDM_RATE_36MB_MASK;
9249         if (target_rate == 36000000)
9250                 goto apply;
9251
9252         if (target_rate == 48000000 || !fixed)
9253                 mask |= IEEE80211_OFDM_RATE_48MB_MASK;
9254         if (target_rate == 48000000)
9255                 goto apply;
9256
9257         if (target_rate == 54000000 || !fixed)
9258                 mask |= IEEE80211_OFDM_RATE_54MB_MASK;
9259         if (target_rate == 54000000)
9260                 goto apply;
9261
9262         IPW_DEBUG_WX("invalid rate specified, returning error\n");
9263         return -EINVAL;
9264
9265       apply:
9266         IPW_DEBUG_WX("Setting rate mask to 0x%08X [%s]\n",
9267                      mask, fixed ? "fixed" : "sub-rates");
9268         mutex_lock(&priv->mutex);
9269         if (mask == IEEE80211_DEFAULT_RATES_MASK) {
9270                 priv->config &= ~CFG_FIXED_RATE;
9271                 ipw_set_fixed_rate(priv, priv->ieee->mode);
9272         } else
9273                 priv->config |= CFG_FIXED_RATE;
9274
9275         if (priv->rates_mask == mask) {
9276                 IPW_DEBUG_WX("Mask set to current mask.\n");
9277                 mutex_unlock(&priv->mutex);
9278                 return 0;
9279         }
9280
9281         priv->rates_mask = mask;
9282
9283         /* Network configuration changed -- force [re]association */
9284         IPW_DEBUG_ASSOC("[re]association triggered due to rates change.\n");
9285         if (!ipw_disassociate(priv))
9286                 ipw_associate(priv);
9287
9288         mutex_unlock(&priv->mutex);
9289         return 0;
9290 }
9291
9292 static int ipw_wx_get_rate(struct net_device *dev,
9293                            struct iw_request_info *info,
9294                            union iwreq_data *wrqu, char *extra)
9295 {
9296         struct ipw_priv *priv = ieee80211_priv(dev);
9297         mutex_lock(&priv->mutex);
9298         wrqu->bitrate.value = priv->last_rate;
9299         wrqu->bitrate.fixed = (priv->config & CFG_FIXED_RATE) ? 1 : 0;
9300         mutex_unlock(&priv->mutex);
9301         IPW_DEBUG_WX("GET Rate -> %d \n", wrqu->bitrate.value);
9302         return 0;
9303 }
9304
9305 static int ipw_wx_set_rts(struct net_device *dev,
9306                           struct iw_request_info *info,
9307                           union iwreq_data *wrqu, char *extra)
9308 {
9309         struct ipw_priv *priv = ieee80211_priv(dev);
9310         mutex_lock(&priv->mutex);
9311         if (wrqu->rts.disabled || !wrqu->rts.fixed)
9312                 priv->rts_threshold = DEFAULT_RTS_THRESHOLD;
9313         else {
9314                 if (wrqu->rts.value < MIN_RTS_THRESHOLD ||
9315                     wrqu->rts.value > MAX_RTS_THRESHOLD) {
9316                         mutex_unlock(&priv->mutex);
9317                         return -EINVAL;
9318                 }
9319                 priv->rts_threshold = wrqu->rts.value;
9320         }
9321
9322         ipw_send_rts_threshold(priv, priv->rts_threshold);
9323         mutex_unlock(&priv->mutex);
9324         IPW_DEBUG_WX("SET RTS Threshold -> %d \n", priv->rts_threshold);
9325         return 0;
9326 }
9327
9328 static int ipw_wx_get_rts(struct net_device *dev,
9329                           struct iw_request_info *info,
9330                           union iwreq_data *wrqu, char *extra)
9331 {
9332         struct ipw_priv *priv = ieee80211_priv(dev);
9333         mutex_lock(&priv->mutex);
9334         wrqu->rts.value = priv->rts_threshold;
9335         wrqu->rts.fixed = 0;    /* no auto select */
9336         wrqu->rts.disabled = (wrqu->rts.value == DEFAULT_RTS_THRESHOLD);
9337         mutex_unlock(&priv->mutex);
9338         IPW_DEBUG_WX("GET RTS Threshold -> %d \n", wrqu->rts.value);
9339         return 0;
9340 }
9341
9342 static int ipw_wx_set_txpow(struct net_device *dev,
9343                             struct iw_request_info *info,
9344                             union iwreq_data *wrqu, char *extra)
9345 {
9346         struct ipw_priv *priv = ieee80211_priv(dev);
9347         int err = 0;
9348
9349         mutex_lock(&priv->mutex);
9350         if (ipw_radio_kill_sw(priv, wrqu->power.disabled)) {
9351                 err = -EINPROGRESS;
9352                 goto out;
9353         }
9354
9355         if (!wrqu->power.fixed)
9356                 wrqu->power.value = IPW_TX_POWER_DEFAULT;
9357
9358         if (wrqu->power.flags != IW_TXPOW_DBM) {
9359                 err = -EINVAL;
9360                 goto out;
9361         }
9362
9363         if ((wrqu->power.value > IPW_TX_POWER_MAX) ||
9364             (wrqu->power.value < IPW_TX_POWER_MIN)) {
9365                 err = -EINVAL;
9366                 goto out;
9367         }
9368
9369         priv->tx_power = wrqu->power.value;
9370         err = ipw_set_tx_power(priv);
9371       out:
9372         mutex_unlock(&priv->mutex);
9373         return err;
9374 }
9375
9376 static int ipw_wx_get_txpow(struct net_device *dev,
9377                             struct iw_request_info *info,
9378                             union iwreq_data *wrqu, char *extra)
9379 {
9380         struct ipw_priv *priv = ieee80211_priv(dev);
9381         mutex_lock(&priv->mutex);
9382         wrqu->power.value = priv->tx_power;
9383         wrqu->power.fixed = 1;
9384         wrqu->power.flags = IW_TXPOW_DBM;
9385         wrqu->power.disabled = (priv->status & STATUS_RF_KILL_MASK) ? 1 : 0;
9386         mutex_unlock(&priv->mutex);
9387
9388         IPW_DEBUG_WX("GET TX Power -> %s %d \n",
9389                      wrqu->power.disabled ? "OFF" : "ON", wrqu->power.value);
9390
9391         return 0;
9392 }
9393
9394 static int ipw_wx_set_frag(struct net_device *dev,
9395                            struct iw_request_info *info,
9396                            union iwreq_data *wrqu, char *extra)
9397 {
9398         struct ipw_priv *priv = ieee80211_priv(dev);
9399         mutex_lock(&priv->mutex);
9400         if (wrqu->frag.disabled || !wrqu->frag.fixed)
9401                 priv->ieee->fts = DEFAULT_FTS;
9402         else {
9403                 if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
9404                     wrqu->frag.value > MAX_FRAG_THRESHOLD) {
9405                         mutex_unlock(&priv->mutex);
9406                         return -EINVAL;
9407                 }
9408
9409                 priv->ieee->fts = wrqu->frag.value & ~0x1;
9410         }
9411
9412         ipw_send_frag_threshold(priv, wrqu->frag.value);
9413         mutex_unlock(&priv->mutex);
9414         IPW_DEBUG_WX("SET Frag Threshold -> %d \n", wrqu->frag.value);
9415         return 0;
9416 }
9417
9418 static int ipw_wx_get_frag(struct net_device *dev,
9419                            struct iw_request_info *info,
9420                            union iwreq_data *wrqu, char *extra)
9421 {
9422         struct ipw_priv *priv = ieee80211_priv(dev);
9423         mutex_lock(&priv->mutex);
9424         wrqu->frag.value = priv->ieee->fts;
9425         wrqu->frag.fixed = 0;   /* no auto select */
9426         wrqu->frag.disabled = (wrqu->frag.value == DEFAULT_FTS);
9427         mutex_unlock(&priv->mutex);
9428         IPW_DEBUG_WX("GET Frag Threshold -> %d \n", wrqu->frag.value);
9429
9430         return 0;
9431 }
9432
9433 static int ipw_wx_set_retry(struct net_device *dev,
9434                             struct iw_request_info *info,
9435                             union iwreq_data *wrqu, char *extra)
9436 {
9437         struct ipw_priv *priv = ieee80211_priv(dev);
9438
9439         if (wrqu->retry.flags & IW_RETRY_LIFETIME || wrqu->retry.disabled)
9440                 return -EINVAL;
9441
9442         if (!(wrqu->retry.flags & IW_RETRY_LIMIT))
9443                 return 0;
9444
9445         if (wrqu->retry.value < 0 || wrqu->retry.value >= 255)
9446                 return -EINVAL;
9447
9448         mutex_lock(&priv->mutex);
9449         if (wrqu->retry.flags & IW_RETRY_SHORT)
9450                 priv->short_retry_limit = (u8) wrqu->retry.value;
9451         else if (wrqu->retry.flags & IW_RETRY_LONG)
9452                 priv->long_retry_limit = (u8) wrqu->retry.value;
9453         else {
9454                 priv->short_retry_limit = (u8) wrqu->retry.value;
9455                 priv->long_retry_limit = (u8) wrqu->retry.value;
9456         }
9457
9458         ipw_send_retry_limit(priv, priv->short_retry_limit,
9459                              priv->long_retry_limit);
9460         mutex_unlock(&priv->mutex);
9461         IPW_DEBUG_WX("SET retry limit -> short:%d long:%d\n",
9462                      priv->short_retry_limit, priv->long_retry_limit);
9463         return 0;
9464 }
9465
9466 static int ipw_wx_get_retry(struct net_device *dev,
9467                             struct iw_request_info *info,
9468                             union iwreq_data *wrqu, char *extra)
9469 {
9470         struct ipw_priv *priv = ieee80211_priv(dev);
9471
9472         mutex_lock(&priv->mutex);
9473         wrqu->retry.disabled = 0;
9474
9475         if ((wrqu->retry.flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME) {
9476                 mutex_unlock(&priv->mutex);
9477                 return -EINVAL;
9478         }
9479
9480         if (wrqu->retry.flags & IW_RETRY_LONG) {
9481                 wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
9482                 wrqu->retry.value = priv->long_retry_limit;
9483         } else if (wrqu->retry.flags & IW_RETRY_SHORT) {
9484                 wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_SHORT;
9485                 wrqu->retry.value = priv->short_retry_limit;
9486         } else {
9487                 wrqu->retry.flags = IW_RETRY_LIMIT;
9488                 wrqu->retry.value = priv->short_retry_limit;
9489         }
9490         mutex_unlock(&priv->mutex);
9491
9492         IPW_DEBUG_WX("GET retry -> %d \n", wrqu->retry.value);
9493
9494         return 0;
9495 }
9496
9497 static int ipw_wx_set_scan(struct net_device *dev,
9498                            struct iw_request_info *info,
9499                            union iwreq_data *wrqu, char *extra)
9500 {
9501         struct ipw_priv *priv = ieee80211_priv(dev);
9502         struct iw_scan_req *req = (struct iw_scan_req *)extra;
9503         struct delayed_work *work = NULL;
9504
9505         mutex_lock(&priv->mutex);
9506
9507         priv->user_requested_scan = 1;
9508
9509         if (wrqu->data.length == sizeof(struct iw_scan_req)) {
9510                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
9511                         int len = min((int)req->essid_len,
9512                                       (int)sizeof(priv->direct_scan_ssid));
9513                         memcpy(priv->direct_scan_ssid, req->essid, len);
9514                         priv->direct_scan_ssid_len = len;
9515                         work = &priv->request_direct_scan;
9516                 } else if (req->scan_type == IW_SCAN_TYPE_PASSIVE) {
9517                         work = &priv->request_passive_scan;
9518                 }
9519         } else {
9520                 /* Normal active broadcast scan */
9521                 work = &priv->request_scan;
9522         }
9523
9524         mutex_unlock(&priv->mutex);
9525
9526         IPW_DEBUG_WX("Start scan\n");
9527
9528         queue_delayed_work(priv->workqueue, work, 0);
9529
9530         return 0;
9531 }
9532
9533 static int ipw_wx_get_scan(struct net_device *dev,
9534                            struct iw_request_info *info,
9535                            union iwreq_data *wrqu, char *extra)
9536 {
9537         struct ipw_priv *priv = ieee80211_priv(dev);
9538         return ieee80211_wx_get_scan(priv->ieee, info, wrqu, extra);
9539 }
9540
9541 static int ipw_wx_set_encode(struct net_device *dev,
9542                              struct iw_request_info *info,
9543                              union iwreq_data *wrqu, char *key)
9544 {
9545         struct ipw_priv *priv = ieee80211_priv(dev);
9546         int ret;
9547         u32 cap = priv->capability;
9548
9549         mutex_lock(&priv->mutex);
9550         ret = ieee80211_wx_set_encode(priv->ieee, info, wrqu, key);
9551
9552         /* In IBSS mode, we need to notify the firmware to update
9553          * the beacon info after we changed the capability. */
9554         if (cap != priv->capability &&
9555             priv->ieee->iw_mode == IW_MODE_ADHOC &&
9556             priv->status & STATUS_ASSOCIATED)
9557                 ipw_disassociate(priv);
9558
9559         mutex_unlock(&priv->mutex);
9560         return ret;
9561 }
9562
9563 static int ipw_wx_get_encode(struct net_device *dev,
9564                              struct iw_request_info *info,
9565                              union iwreq_data *wrqu, char *key)
9566 {
9567         struct ipw_priv *priv = ieee80211_priv(dev);
9568         return ieee80211_wx_get_encode(priv->ieee, info, wrqu, key);
9569 }
9570
9571 static int ipw_wx_set_power(struct net_device *dev,
9572                             struct iw_request_info *info,
9573                             union iwreq_data *wrqu, char *extra)
9574 {
9575         struct ipw_priv *priv = ieee80211_priv(dev);
9576         int err;
9577         mutex_lock(&priv->mutex);
9578         if (wrqu->power.disabled) {
9579                 priv->power_mode = IPW_POWER_LEVEL(priv->power_mode);
9580                 err = ipw_send_power_mode(priv, IPW_POWER_MODE_CAM);
9581                 if (err) {
9582                         IPW_DEBUG_WX("failed setting power mode.\n");
9583                         mutex_unlock(&priv->mutex);
9584                         return err;
9585                 }
9586                 IPW_DEBUG_WX("SET Power Management Mode -> off\n");
9587                 mutex_unlock(&priv->mutex);
9588                 return 0;
9589         }
9590
9591         switch (wrqu->power.flags & IW_POWER_MODE) {
9592         case IW_POWER_ON:       /* If not specified */
9593         case IW_POWER_MODE:     /* If set all mask */
9594         case IW_POWER_ALL_R:    /* If explicitly state all */
9595                 break;
9596         default:                /* Otherwise we don't support it */
9597                 IPW_DEBUG_WX("SET PM Mode: %X not supported.\n",
9598                              wrqu->power.flags);
9599                 mutex_unlock(&priv->mutex);
9600                 return -EOPNOTSUPP;
9601         }
9602
9603         /* If the user hasn't specified a power management mode yet, default
9604          * to BATTERY */
9605         if (IPW_POWER_LEVEL(priv->power_mode) == IPW_POWER_AC)
9606                 priv->power_mode = IPW_POWER_ENABLED | IPW_POWER_BATTERY;
9607         else
9608                 priv->power_mode = IPW_POWER_ENABLED | priv->power_mode;
9609
9610         err = ipw_send_power_mode(priv, IPW_POWER_LEVEL(priv->power_mode));
9611         if (err) {
9612                 IPW_DEBUG_WX("failed setting power mode.\n");
9613                 mutex_unlock(&priv->mutex);
9614                 return err;
9615         }
9616
9617         IPW_DEBUG_WX("SET Power Management Mode -> 0x%02X\n", priv->power_mode);
9618         mutex_unlock(&priv->mutex);
9619         return 0;
9620 }
9621
9622 static int ipw_wx_get_power(struct net_device *dev,
9623                             struct iw_request_info *info,
9624                             union iwreq_data *wrqu, char *extra)
9625 {
9626         struct ipw_priv *priv = ieee80211_priv(dev);
9627         mutex_lock(&priv->mutex);
9628         if (!(priv->power_mode & IPW_POWER_ENABLED))
9629                 wrqu->power.disabled = 1;
9630         else
9631                 wrqu->power.disabled = 0;
9632
9633         mutex_unlock(&priv->mutex);
9634         IPW_DEBUG_WX("GET Power Management Mode -> %02X\n", priv->power_mode);
9635
9636         return 0;
9637 }
9638
9639 static int ipw_wx_set_powermode(struct net_device *dev,
9640                                 struct iw_request_info *info,
9641                                 union iwreq_data *wrqu, char *extra)
9642 {
9643         struct ipw_priv *priv = ieee80211_priv(dev);
9644         int mode = *(int *)extra;
9645         int err;
9646
9647         mutex_lock(&priv->mutex);
9648         if ((mode < 1) || (mode > IPW_POWER_LIMIT))
9649                 mode = IPW_POWER_AC;
9650
9651         if (IPW_POWER_LEVEL(priv->power_mode) != mode) {
9652                 err = ipw_send_power_mode(priv, mode);
9653                 if (err) {
9654                         IPW_DEBUG_WX("failed setting power mode.\n");
9655                         mutex_unlock(&priv->mutex);
9656                         return err;
9657                 }
9658                 priv->power_mode = IPW_POWER_ENABLED | mode;
9659         }
9660         mutex_unlock(&priv->mutex);
9661         return 0;
9662 }
9663
9664 #define MAX_WX_STRING 80
9665 static int ipw_wx_get_powermode(struct net_device *dev,
9666                                 struct iw_request_info *info,
9667                                 union iwreq_data *wrqu, char *extra)
9668 {
9669         struct ipw_priv *priv = ieee80211_priv(dev);
9670         int level = IPW_POWER_LEVEL(priv->power_mode);
9671         char *p = extra;
9672
9673         p += snprintf(p, MAX_WX_STRING, "Power save level: %d ", level);
9674
9675         switch (level) {
9676         case IPW_POWER_AC:
9677                 p += snprintf(p, MAX_WX_STRING - (p - extra), "(AC)");
9678                 break;
9679         case IPW_POWER_BATTERY:
9680                 p += snprintf(p, MAX_WX_STRING - (p - extra), "(BATTERY)");
9681                 break;
9682         default:
9683                 p += snprintf(p, MAX_WX_STRING - (p - extra),
9684                               "(Timeout %dms, Period %dms)",
9685                               timeout_duration[level - 1] / 1000,
9686                               period_duration[level - 1] / 1000);
9687         }
9688
9689         if (!(priv->power_mode & IPW_POWER_ENABLED))
9690                 p += snprintf(p, MAX_WX_STRING - (p - extra), " OFF");
9691
9692         wrqu->data.length = p - extra + 1;
9693
9694         return 0;
9695 }
9696
9697 static int ipw_wx_set_wireless_mode(struct net_device *dev,
9698                                     struct iw_request_info *info,
9699                                     union iwreq_data *wrqu, char *extra)
9700 {
9701         struct ipw_priv *priv = ieee80211_priv(dev);
9702         int mode = *(int *)extra;
9703         u8 band = 0, modulation = 0;
9704
9705         if (mode == 0 || mode & ~IEEE_MODE_MASK) {
9706                 IPW_WARNING("Attempt to set invalid wireless mode: %d\n", mode);
9707                 return -EINVAL;
9708         }
9709         mutex_lock(&priv->mutex);
9710         if (priv->adapter == IPW_2915ABG) {
9711                 priv->ieee->abg_true = 1;
9712                 if (mode & IEEE_A) {
9713                         band |= IEEE80211_52GHZ_BAND;
9714                         modulation |= IEEE80211_OFDM_MODULATION;
9715                 } else
9716                         priv->ieee->abg_true = 0;
9717         } else {
9718                 if (mode & IEEE_A) {
9719                         IPW_WARNING("Attempt to set 2200BG into "
9720                                     "802.11a mode\n");
9721                         mutex_unlock(&priv->mutex);
9722                         return -EINVAL;
9723                 }
9724
9725                 priv->ieee->abg_true = 0;
9726         }
9727
9728         if (mode & IEEE_B) {
9729                 band |= IEEE80211_24GHZ_BAND;
9730                 modulation |= IEEE80211_CCK_MODULATION;
9731         } else
9732                 priv->ieee->abg_true = 0;
9733
9734         if (mode & IEEE_G) {
9735                 band |= IEEE80211_24GHZ_BAND;
9736                 modulation |= IEEE80211_OFDM_MODULATION;
9737         } else
9738                 priv->ieee->abg_true = 0;
9739
9740         priv->ieee->mode = mode;
9741         priv->ieee->freq_band = band;
9742         priv->ieee->modulation = modulation;
9743         init_supported_rates(priv, &priv->rates);
9744
9745         /* Network configuration changed -- force [re]association */
9746         IPW_DEBUG_ASSOC("[re]association triggered due to mode change.\n");
9747         if (!ipw_disassociate(priv)) {
9748                 ipw_send_supported_rates(priv, &priv->rates);
9749                 ipw_associate(priv);
9750         }
9751
9752         /* Update the band LEDs */
9753         ipw_led_band_on(priv);
9754
9755         IPW_DEBUG_WX("PRIV SET MODE: %c%c%c\n",
9756                      mode & IEEE_A ? 'a' : '.',
9757                      mode & IEEE_B ? 'b' : '.', mode & IEEE_G ? 'g' : '.');
9758         mutex_unlock(&priv->mutex);
9759         return 0;
9760 }
9761
9762 static int ipw_wx_get_wireless_mode(struct net_device *dev,
9763                                     struct iw_request_info *info,
9764                                     union iwreq_data *wrqu, char *extra)
9765 {
9766         struct ipw_priv *priv = ieee80211_priv(dev);
9767         mutex_lock(&priv->mutex);
9768         switch (priv->ieee->mode) {
9769         case IEEE_A:
9770                 strncpy(extra, "802.11a (1)", MAX_WX_STRING);
9771                 break;
9772         case IEEE_B:
9773                 strncpy(extra, "802.11b (2)", MAX_WX_STRING);
9774                 break;
9775         case IEEE_A | IEEE_B:
9776                 strncpy(extra, "802.11ab (3)", MAX_WX_STRING);
9777                 break;
9778         case IEEE_G:
9779                 strncpy(extra, "802.11g (4)", MAX_WX_STRING);
9780                 break;
9781         case IEEE_A | IEEE_G:
9782                 strncpy(extra, "802.11ag (5)", MAX_WX_STRING);
9783                 break;
9784         case IEEE_B | IEEE_G:
9785                 strncpy(extra, "802.11bg (6)", MAX_WX_STRING);
9786                 break;
9787         case IEEE_A | IEEE_B | IEEE_G:
9788                 strncpy(extra, "802.11abg (7)", MAX_WX_STRING);
9789                 break;
9790         default:
9791                 strncpy(extra, "unknown", MAX_WX_STRING);
9792                 break;
9793         }
9794
9795         IPW_DEBUG_WX("PRIV GET MODE: %s\n", extra);
9796
9797         wrqu->data.length = strlen(extra) + 1;
9798         mutex_unlock(&priv->mutex);
9799
9800         return 0;
9801 }
9802
9803 static int ipw_wx_set_preamble(struct net_device *dev,
9804                                struct iw_request_info *info,
9805                                union iwreq_data *wrqu, char *extra)
9806 {
9807         struct ipw_priv *priv = ieee80211_priv(dev);
9808         int mode = *(int *)extra;
9809         mutex_lock(&priv->mutex);
9810         /* Switching from SHORT -> LONG requires a disassociation */
9811         if (mode == 1) {
9812                 if (!(priv->config & CFG_PREAMBLE_LONG)) {
9813                         priv->config |= CFG_PREAMBLE_LONG;
9814
9815                         /* Network configuration changed -- force [re]association */
9816                         IPW_DEBUG_ASSOC
9817                             ("[re]association triggered due to preamble change.\n");
9818                         if (!ipw_disassociate(priv))
9819                                 ipw_associate(priv);
9820                 }
9821                 goto done;
9822         }
9823
9824         if (mode == 0) {
9825                 priv->config &= ~CFG_PREAMBLE_LONG;
9826                 goto done;
9827         }
9828         mutex_unlock(&priv->mutex);
9829         return -EINVAL;
9830
9831       done:
9832         mutex_unlock(&priv->mutex);
9833         return 0;
9834 }
9835
9836 static int ipw_wx_get_preamble(struct net_device *dev,
9837                                struct iw_request_info *info,
9838                                union iwreq_data *wrqu, char *extra)
9839 {
9840         struct ipw_priv *priv = ieee80211_priv(dev);
9841         mutex_lock(&priv->mutex);
9842         if (priv->config & CFG_PREAMBLE_LONG)
9843                 snprintf(wrqu->name, IFNAMSIZ, "long (1)");
9844         else
9845                 snprintf(wrqu->name, IFNAMSIZ, "auto (0)");
9846         mutex_unlock(&priv->mutex);
9847         return 0;
9848 }
9849
9850 #ifdef CONFIG_IPW2200_MONITOR
9851 static int ipw_wx_set_monitor(struct net_device *dev,
9852                               struct iw_request_info *info,
9853                               union iwreq_data *wrqu, char *extra)
9854 {
9855         struct ipw_priv *priv = ieee80211_priv(dev);
9856         int *parms = (int *)extra;
9857         int enable = (parms[0] > 0);
9858         mutex_lock(&priv->mutex);
9859         IPW_DEBUG_WX("SET MONITOR: %d %d\n", enable, parms[1]);
9860         if (enable) {
9861                 if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
9862 #ifdef CONFIG_IPW2200_RADIOTAP
9863                         priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
9864 #else
9865                         priv->net_dev->type = ARPHRD_IEEE80211;
9866 #endif
9867                         queue_work(priv->workqueue, &priv->adapter_restart);
9868                 }
9869
9870                 ipw_set_channel(priv, parms[1]);
9871         } else {
9872                 if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
9873                         mutex_unlock(&priv->mutex);
9874                         return 0;
9875                 }
9876                 priv->net_dev->type = ARPHRD_ETHER;
9877                 queue_work(priv->workqueue, &priv->adapter_restart);
9878         }
9879         mutex_unlock(&priv->mutex);
9880         return 0;
9881 }
9882
9883 #endif                          /* CONFIG_IPW2200_MONITOR */
9884
9885 static int ipw_wx_reset(struct net_device *dev,
9886                         struct iw_request_info *info,
9887                         union iwreq_data *wrqu, char *extra)
9888 {
9889         struct ipw_priv *priv = ieee80211_priv(dev);
9890         IPW_DEBUG_WX("RESET\n");
9891         queue_work(priv->workqueue, &priv->adapter_restart);
9892         return 0;
9893 }
9894
9895 static int ipw_wx_sw_reset(struct net_device *dev,
9896                            struct iw_request_info *info,
9897                            union iwreq_data *wrqu, char *extra)
9898 {
9899         struct ipw_priv *priv = ieee80211_priv(dev);
9900         union iwreq_data wrqu_sec = {
9901                 .encoding = {
9902                              .flags = IW_ENCODE_DISABLED,
9903                              },
9904         };
9905         int ret;
9906
9907         IPW_DEBUG_WX("SW_RESET\n");
9908
9909         mutex_lock(&priv->mutex);
9910
9911         ret = ipw_sw_reset(priv, 2);
9912         if (!ret) {
9913                 free_firmware();
9914                 ipw_adapter_restart(priv);
9915         }
9916
9917         /* The SW reset bit might have been toggled on by the 'disable'
9918          * module parameter, so take appropriate action */
9919         ipw_radio_kill_sw(priv, priv->status & STATUS_RF_KILL_SW);
9920
9921         mutex_unlock(&priv->mutex);
9922         ieee80211_wx_set_encode(priv->ieee, info, &wrqu_sec, NULL);
9923         mutex_lock(&priv->mutex);
9924
9925         if (!(priv->status & STATUS_RF_KILL_MASK)) {
9926                 /* Configuration likely changed -- force [re]association */
9927                 IPW_DEBUG_ASSOC("[re]association triggered due to sw "
9928                                 "reset.\n");
9929                 if (!ipw_disassociate(priv))
9930                         ipw_associate(priv);
9931         }
9932
9933         mutex_unlock(&priv->mutex);
9934
9935         return 0;
9936 }
9937
9938 /* Rebase the WE IOCTLs to zero for the handler array */
9939 #define IW_IOCTL(x) [(x)-SIOCSIWCOMMIT]
9940 static iw_handler ipw_wx_handlers[] = {
9941         IW_IOCTL(SIOCGIWNAME) = ipw_wx_get_name,
9942         IW_IOCTL(SIOCSIWFREQ) = ipw_wx_set_freq,
9943         IW_IOCTL(SIOCGIWFREQ) = ipw_wx_get_freq,
9944         IW_IOCTL(SIOCSIWMODE) = ipw_wx_set_mode,
9945         IW_IOCTL(SIOCGIWMODE) = ipw_wx_get_mode,
9946         IW_IOCTL(SIOCSIWSENS) = ipw_wx_set_sens,
9947         IW_IOCTL(SIOCGIWSENS) = ipw_wx_get_sens,
9948         IW_IOCTL(SIOCGIWRANGE) = ipw_wx_get_range,
9949         IW_IOCTL(SIOCSIWAP) = ipw_wx_set_wap,
9950         IW_IOCTL(SIOCGIWAP) = ipw_wx_get_wap,
9951         IW_IOCTL(SIOCSIWSCAN) = ipw_wx_set_scan,
9952         IW_IOCTL(SIOCGIWSCAN) = ipw_wx_get_scan,
9953         IW_IOCTL(SIOCSIWESSID) = ipw_wx_set_essid,
9954         IW_IOCTL(SIOCGIWESSID) = ipw_wx_get_essid,
9955         IW_IOCTL(SIOCSIWNICKN) = ipw_wx_set_nick,
9956         IW_IOCTL(SIOCGIWNICKN) = ipw_wx_get_nick,
9957         IW_IOCTL(SIOCSIWRATE) = ipw_wx_set_rate,
9958         IW_IOCTL(SIOCGIWRATE) = ipw_wx_get_rate,
9959         IW_IOCTL(SIOCSIWRTS) = ipw_wx_set_rts,
9960         IW_IOCTL(SIOCGIWRTS) = ipw_wx_get_rts,
9961         IW_IOCTL(SIOCSIWFRAG) = ipw_wx_set_frag,
9962         IW_IOCTL(SIOCGIWFRAG) = ipw_wx_get_frag,
9963         IW_IOCTL(SIOCSIWTXPOW) = ipw_wx_set_txpow,
9964         IW_IOCTL(SIOCGIWTXPOW) = ipw_wx_get_txpow,
9965         IW_IOCTL(SIOCSIWRETRY) = ipw_wx_set_retry,
9966         IW_IOCTL(SIOCGIWRETRY) = ipw_wx_get_retry,
9967         IW_IOCTL(SIOCSIWENCODE) = ipw_wx_set_encode,
9968         IW_IOCTL(SIOCGIWENCODE) = ipw_wx_get_encode,
9969         IW_IOCTL(SIOCSIWPOWER) = ipw_wx_set_power,
9970         IW_IOCTL(SIOCGIWPOWER) = ipw_wx_get_power,
9971         IW_IOCTL(SIOCSIWSPY) = iw_handler_set_spy,
9972         IW_IOCTL(SIOCGIWSPY) = iw_handler_get_spy,
9973         IW_IOCTL(SIOCSIWTHRSPY) = iw_handler_set_thrspy,
9974         IW_IOCTL(SIOCGIWTHRSPY) = iw_handler_get_thrspy,
9975         IW_IOCTL(SIOCSIWGENIE) = ipw_wx_set_genie,
9976         IW_IOCTL(SIOCGIWGENIE) = ipw_wx_get_genie,
9977         IW_IOCTL(SIOCSIWMLME) = ipw_wx_set_mlme,
9978         IW_IOCTL(SIOCSIWAUTH) = ipw_wx_set_auth,
9979         IW_IOCTL(SIOCGIWAUTH) = ipw_wx_get_auth,
9980         IW_IOCTL(SIOCSIWENCODEEXT) = ipw_wx_set_encodeext,
9981         IW_IOCTL(SIOCGIWENCODEEXT) = ipw_wx_get_encodeext,
9982 };
9983
9984 enum {
9985         IPW_PRIV_SET_POWER = SIOCIWFIRSTPRIV,
9986         IPW_PRIV_GET_POWER,
9987         IPW_PRIV_SET_MODE,
9988         IPW_PRIV_GET_MODE,
9989         IPW_PRIV_SET_PREAMBLE,
9990         IPW_PRIV_GET_PREAMBLE,
9991         IPW_PRIV_RESET,
9992         IPW_PRIV_SW_RESET,
9993 #ifdef CONFIG_IPW2200_MONITOR
9994         IPW_PRIV_SET_MONITOR,
9995 #endif
9996 };
9997
9998 static struct iw_priv_args ipw_priv_args[] = {
9999         {
10000          .cmd = IPW_PRIV_SET_POWER,
10001          .set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
10002          .name = "set_power"},
10003         {
10004          .cmd = IPW_PRIV_GET_POWER,
10005          .get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
10006          .name = "get_power"},
10007         {
10008          .cmd = IPW_PRIV_SET_MODE,
10009          .set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
10010          .name = "set_mode"},
10011         {
10012          .cmd = IPW_PRIV_GET_MODE,
10013          .get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
10014          .name = "get_mode"},
10015         {
10016          .cmd = IPW_PRIV_SET_PREAMBLE,
10017          .set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
10018          .name = "set_preamble"},
10019         {
10020          .cmd = IPW_PRIV_GET_PREAMBLE,
10021          .get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | IFNAMSIZ,
10022          .name = "get_preamble"},
10023         {
10024          IPW_PRIV_RESET,
10025          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 0, 0, "reset"},
10026         {
10027          IPW_PRIV_SW_RESET,
10028          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 0, 0, "sw_reset"},
10029 #ifdef CONFIG_IPW2200_MONITOR
10030         {
10031          IPW_PRIV_SET_MONITOR,
10032          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "monitor"},
10033 #endif                          /* CONFIG_IPW2200_MONITOR */
10034 };
10035
10036 static iw_handler ipw_priv_handler[] = {
10037         ipw_wx_set_powermode,
10038         ipw_wx_get_powermode,
10039         ipw_wx_set_wireless_mode,
10040         ipw_wx_get_wireless_mode,
10041         ipw_wx_set_preamble,
10042         ipw_wx_get_preamble,
10043         ipw_wx_reset,
10044         ipw_wx_sw_reset,
10045 #ifdef CONFIG_IPW2200_MONITOR
10046         ipw_wx_set_monitor,
10047 #endif
10048 };
10049
10050 static struct iw_handler_def ipw_wx_handler_def = {
10051         .standard = ipw_wx_handlers,
10052         .num_standard = ARRAY_SIZE(ipw_wx_handlers),
10053         .num_private = ARRAY_SIZE(ipw_priv_handler),
10054         .num_private_args = ARRAY_SIZE(ipw_priv_args),
10055         .private = ipw_priv_handler,
10056         .private_args = ipw_priv_args,
10057         .get_wireless_stats = ipw_get_wireless_stats,
10058 };
10059
10060 /*
10061  * Get wireless statistics.
10062  * Called by /proc/net/wireless
10063  * Also called by SIOCGIWSTATS
10064  */
10065 static struct iw_statistics *ipw_get_wireless_stats(struct net_device *dev)
10066 {
10067         struct ipw_priv *priv = ieee80211_priv(dev);
10068         struct iw_statistics *wstats;
10069
10070         wstats = &priv->wstats;
10071
10072         /* if hw is disabled, then ipw_get_ordinal() can't be called.
10073          * netdev->get_wireless_stats seems to be called before fw is
10074          * initialized.  STATUS_ASSOCIATED will only be set if the hw is up
10075          * and associated; if not associcated, the values are all meaningless
10076          * anyway, so set them all to NULL and INVALID */
10077         if (!(priv->status & STATUS_ASSOCIATED)) {
10078                 wstats->miss.beacon = 0;
10079                 wstats->discard.retries = 0;
10080                 wstats->qual.qual = 0;
10081                 wstats->qual.level = 0;
10082                 wstats->qual.noise = 0;
10083                 wstats->qual.updated = 7;
10084                 wstats->qual.updated |= IW_QUAL_NOISE_INVALID |
10085                     IW_QUAL_QUAL_INVALID | IW_QUAL_LEVEL_INVALID;
10086                 return wstats;
10087         }
10088
10089         wstats->qual.qual = priv->quality;
10090         wstats->qual.level = priv->exp_avg_rssi;
10091         wstats->qual.noise = priv->exp_avg_noise;
10092         wstats->qual.updated = IW_QUAL_QUAL_UPDATED | IW_QUAL_LEVEL_UPDATED |
10093             IW_QUAL_NOISE_UPDATED | IW_QUAL_DBM;
10094
10095         wstats->miss.beacon = average_value(&priv->average_missed_beacons);
10096         wstats->discard.retries = priv->last_tx_failures;
10097         wstats->discard.code = priv->ieee->ieee_stats.rx_discards_undecryptable;
10098
10099 /*      if (ipw_get_ordinal(priv, IPW_ORD_STAT_TX_RETRY, &tx_retry, &len))
10100         goto fail_get_ordinal;
10101         wstats->discard.retries += tx_retry; */
10102
10103         return wstats;
10104 }
10105
10106 /* net device stuff */
10107
10108 static  void init_sys_config(struct ipw_sys_config *sys_config)
10109 {
10110         memset(sys_config, 0, sizeof(struct ipw_sys_config));
10111         sys_config->bt_coexistence = 0;
10112         sys_config->answer_broadcast_ssid_probe = 0;
10113         sys_config->accept_all_data_frames = 0;
10114         sys_config->accept_non_directed_frames = 1;
10115         sys_config->exclude_unicast_unencrypted = 0;
10116         sys_config->disable_unicast_decryption = 1;
10117         sys_config->exclude_multicast_unencrypted = 0;
10118         sys_config->disable_multicast_decryption = 1;
10119         if (antenna < CFG_SYS_ANTENNA_BOTH || antenna > CFG_SYS_ANTENNA_B)
10120                 antenna = CFG_SYS_ANTENNA_BOTH;
10121         sys_config->antenna_diversity = antenna;
10122         sys_config->pass_crc_to_host = 0;       /* TODO: See if 1 gives us FCS */
10123         sys_config->dot11g_auto_detection = 0;
10124         sys_config->enable_cts_to_self = 0;
10125         sys_config->bt_coexist_collision_thr = 0;
10126         sys_config->pass_noise_stats_to_host = 1;       /* 1 -- fix for 256 */
10127         sys_config->silence_threshold = 0x1e;
10128 }
10129
10130 static int ipw_net_open(struct net_device *dev)
10131 {
10132         IPW_DEBUG_INFO("dev->open\n");
10133         netif_start_queue(dev);
10134         return 0;
10135 }
10136
10137 static int ipw_net_stop(struct net_device *dev)
10138 {
10139         IPW_DEBUG_INFO("dev->close\n");
10140         netif_stop_queue(dev);
10141         return 0;
10142 }
10143
10144 /*
10145 todo:
10146
10147 modify to send one tfd per fragment instead of using chunking.  otherwise
10148 we need to heavily modify the ieee80211_skb_to_txb.
10149 */
10150
10151 static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
10152                              int pri)
10153 {
10154         struct ieee80211_hdr_3addrqos *hdr = (struct ieee80211_hdr_3addrqos *)
10155             txb->fragments[0]->data;
10156         int i = 0;
10157         struct tfd_frame *tfd;
10158 #ifdef CONFIG_IPW2200_QOS
10159         int tx_id = ipw_get_tx_queue_number(priv, pri);
10160         struct clx2_tx_queue *txq = &priv->txq[tx_id];
10161 #else
10162         struct clx2_tx_queue *txq = &priv->txq[0];
10163 #endif
10164         struct clx2_queue *q = &txq->q;
10165         u8 id, hdr_len, unicast;
10166         u16 remaining_bytes;
10167         int fc;
10168
10169         hdr_len = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
10170         switch (priv->ieee->iw_mode) {
10171         case IW_MODE_ADHOC:
10172                 unicast = !is_multicast_ether_addr(hdr->addr1);
10173                 id = ipw_find_station(priv, hdr->addr1);
10174                 if (id == IPW_INVALID_STATION) {
10175                         id = ipw_add_station(priv, hdr->addr1);
10176                         if (id == IPW_INVALID_STATION) {
10177                                 IPW_WARNING("Attempt to send data to "
10178                                             "invalid cell: %pM\n",
10179                                             hdr->addr1);
10180                                 goto drop;
10181                         }
10182                 }
10183                 break;
10184
10185         case IW_MODE_INFRA:
10186         default:
10187                 unicast = !is_multicast_ether_addr(hdr->addr3);
10188                 id = 0;
10189                 break;
10190         }
10191
10192         tfd = &txq->bd[q->first_empty];
10193         txq->txb[q->first_empty] = txb;
10194         memset(tfd, 0, sizeof(*tfd));
10195         tfd->u.data.station_number = id;
10196
10197         tfd->control_flags.message_type = TX_FRAME_TYPE;
10198         tfd->control_flags.control_bits = TFD_NEED_IRQ_MASK;
10199
10200         tfd->u.data.cmd_id = DINO_CMD_TX;
10201         tfd->u.data.len = cpu_to_le16(txb->payload_size);
10202         remaining_bytes = txb->payload_size;
10203
10204         if (priv->assoc_request.ieee_mode == IPW_B_MODE)
10205                 tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_MODE_CCK;
10206         else
10207                 tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_MODE_OFDM;
10208
10209         if (priv->assoc_request.preamble_length == DCT_FLAG_SHORT_PREAMBLE)
10210                 tfd->u.data.tx_flags |= DCT_FLAG_SHORT_PREAMBLE;
10211
10212         fc = le16_to_cpu(hdr->frame_ctl);
10213         hdr->frame_ctl = cpu_to_le16(fc & ~IEEE80211_FCTL_MOREFRAGS);
10214
10215         memcpy(&tfd->u.data.tfd.tfd_24.mchdr, hdr, hdr_len);
10216
10217         if (likely(unicast))
10218                 tfd->u.data.tx_flags |= DCT_FLAG_ACK_REQD;
10219
10220         if (txb->encrypted && !priv->ieee->host_encrypt) {
10221                 switch (priv->ieee->sec.level) {
10222                 case SEC_LEVEL_3:
10223                         tfd->u.data.tfd.tfd_24.mchdr.frame_ctl |=
10224                             cpu_to_le16(IEEE80211_FCTL_PROTECTED);
10225                         /* XXX: ACK flag must be set for CCMP even if it
10226                          * is a multicast/broadcast packet, because CCMP
10227                          * group communication encrypted by GTK is
10228                          * actually done by the AP. */
10229                         if (!unicast)
10230                                 tfd->u.data.tx_flags |= DCT_FLAG_ACK_REQD;
10231
10232                         tfd->u.data.tx_flags &= ~DCT_FLAG_NO_WEP;
10233                         tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_SECURITY_CCM;
10234                         tfd->u.data.key_index = 0;
10235                         tfd->u.data.key_index |= DCT_WEP_INDEX_USE_IMMEDIATE;
10236                         break;
10237                 case SEC_LEVEL_2:
10238                         tfd->u.data.tfd.tfd_24.mchdr.frame_ctl |=
10239                             cpu_to_le16(IEEE80211_FCTL_PROTECTED);
10240                         tfd->u.data.tx_flags &= ~DCT_FLAG_NO_WEP;
10241                         tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_SECURITY_TKIP;
10242                         tfd->u.data.key_index = DCT_WEP_INDEX_USE_IMMEDIATE;
10243                         break;
10244                 case SEC_LEVEL_1:
10245                         tfd->u.data.tfd.tfd_24.mchdr.frame_ctl |=
10246                             cpu_to_le16(IEEE80211_FCTL_PROTECTED);
10247                         tfd->u.data.key_index = priv->ieee->tx_keyidx;
10248                         if (priv->ieee->sec.key_sizes[priv->ieee->tx_keyidx] <=
10249                             40)
10250                                 tfd->u.data.key_index |= DCT_WEP_KEY_64Bit;
10251                         else
10252                                 tfd->u.data.key_index |= DCT_WEP_KEY_128Bit;
10253                         break;
10254                 case SEC_LEVEL_0:
10255                         break;
10256                 default:
10257                         printk(KERN_ERR "Unknow security level %d\n",
10258                                priv->ieee->sec.level);
10259                         break;
10260                 }
10261         } else
10262                 /* No hardware encryption */
10263                 tfd->u.data.tx_flags |= DCT_FLAG_NO_WEP;
10264
10265 #ifdef CONFIG_IPW2200_QOS
10266         if (fc & IEEE80211_STYPE_QOS_DATA)
10267                 ipw_qos_set_tx_queue_command(priv, pri, &(tfd->u.data));
10268 #endif                          /* CONFIG_IPW2200_QOS */
10269
10270         /* payload */
10271         tfd->u.data.num_chunks = cpu_to_le32(min((u8) (NUM_TFD_CHUNKS - 2),
10272                                                  txb->nr_frags));
10273         IPW_DEBUG_FRAG("%i fragments being sent as %i chunks.\n",
10274                        txb->nr_frags, le32_to_cpu(tfd->u.data.num_chunks));
10275         for (i = 0; i < le32_to_cpu(tfd->u.data.num_chunks); i++) {
10276                 IPW_DEBUG_FRAG("Adding fragment %i of %i (%d bytes).\n",
10277                                i, le32_to_cpu(tfd->u.data.num_chunks),
10278                                txb->fragments[i]->len - hdr_len);
10279                 IPW_DEBUG_TX("Dumping TX packet frag %i of %i (%d bytes):\n",
10280                              i, tfd->u.data.num_chunks,
10281                              txb->fragments[i]->len - hdr_len);
10282                 printk_buf(IPW_DL_TX, txb->fragments[i]->data + hdr_len,
10283                            txb->fragments[i]->len - hdr_len);
10284
10285                 tfd->u.data.chunk_ptr[i] =
10286                     cpu_to_le32(pci_map_single
10287                                 (priv->pci_dev,
10288                                  txb->fragments[i]->data + hdr_len,
10289                                  txb->fragments[i]->len - hdr_len,
10290                                  PCI_DMA_TODEVICE));
10291                 tfd->u.data.chunk_len[i] =
10292                     cpu_to_le16(txb->fragments[i]->len - hdr_len);
10293         }
10294
10295         if (i != txb->nr_frags) {
10296                 struct sk_buff *skb;
10297                 u16 remaining_bytes = 0;
10298                 int j;
10299
10300                 for (j = i; j < txb->nr_frags; j++)
10301                         remaining_bytes += txb->fragments[j]->len - hdr_len;
10302
10303                 printk(KERN_INFO "Trying to reallocate for %d bytes\n",
10304                        remaining_bytes);
10305                 skb = alloc_skb(remaining_bytes, GFP_ATOMIC);
10306                 if (skb != NULL) {
10307                         tfd->u.data.chunk_len[i] = cpu_to_le16(remaining_bytes);
10308                         for (j = i; j < txb->nr_frags; j++) {
10309                                 int size = txb->fragments[j]->len - hdr_len;
10310
10311                                 printk(KERN_INFO "Adding frag %d %d...\n",
10312                                        j, size);
10313                                 memcpy(skb_put(skb, size),
10314                                        txb->fragments[j]->data + hdr_len, size);
10315                         }
10316                         dev_kfree_skb_any(txb->fragments[i]);
10317                         txb->fragments[i] = skb;
10318                         tfd->u.data.chunk_ptr[i] =
10319                             cpu_to_le32(pci_map_single
10320                                         (priv->pci_dev, skb->data,
10321                                          remaining_bytes,
10322                                          PCI_DMA_TODEVICE));
10323
10324                         le32_add_cpu(&tfd->u.data.num_chunks, 1);
10325                 }
10326         }
10327
10328         /* kick DMA */
10329         q->first_empty = ipw_queue_inc_wrap(q->first_empty, q->n_bd);
10330         ipw_write32(priv, q->reg_w, q->first_empty);
10331
10332         if (ipw_tx_queue_space(q) < q->high_mark)
10333                 netif_stop_queue(priv->net_dev);
10334
10335         return NETDEV_TX_OK;
10336
10337       drop:
10338         IPW_DEBUG_DROP("Silently dropping Tx packet.\n");
10339         ieee80211_txb_free(txb);
10340         return NETDEV_TX_OK;
10341 }
10342
10343 static int ipw_net_is_queue_full(struct net_device *dev, int pri)
10344 {
10345         struct ipw_priv *priv = ieee80211_priv(dev);
10346 #ifdef CONFIG_IPW2200_QOS
10347         int tx_id = ipw_get_tx_queue_number(priv, pri);
10348         struct clx2_tx_queue *txq = &priv->txq[tx_id];
10349 #else
10350         struct clx2_tx_queue *txq = &priv->txq[0];
10351 #endif                          /* CONFIG_IPW2200_QOS */
10352
10353         if (ipw_tx_queue_space(&txq->q) < txq->q.high_mark)
10354                 return 1;
10355
10356         return 0;
10357 }
10358
10359 #ifdef CONFIG_IPW2200_PROMISCUOUS
10360 static void ipw_handle_promiscuous_tx(struct ipw_priv *priv,
10361                                       struct ieee80211_txb *txb)
10362 {
10363         struct ieee80211_rx_stats dummystats;
10364         struct ieee80211_hdr *hdr;
10365         u8 n;
10366         u16 filter = priv->prom_priv->filter;
10367         int hdr_only = 0;
10368
10369         if (filter & IPW_PROM_NO_TX)
10370                 return;
10371
10372         memset(&dummystats, 0, sizeof(dummystats));
10373
10374         /* Filtering of fragment chains is done agains the first fragment */
10375         hdr = (void *)txb->fragments[0]->data;
10376         if (ieee80211_is_management(le16_to_cpu(hdr->frame_ctl))) {
10377                 if (filter & IPW_PROM_NO_MGMT)
10378                         return;
10379                 if (filter & IPW_PROM_MGMT_HEADER_ONLY)
10380                         hdr_only = 1;
10381         } else if (ieee80211_is_control(le16_to_cpu(hdr->frame_ctl))) {
10382                 if (filter & IPW_PROM_NO_CTL)
10383                         return;
10384                 if (filter & IPW_PROM_CTL_HEADER_ONLY)
10385                         hdr_only = 1;
10386         } else if (ieee80211_is_data(le16_to_cpu(hdr->frame_ctl))) {
10387                 if (filter & IPW_PROM_NO_DATA)
10388                         return;
10389                 if (filter & IPW_PROM_DATA_HEADER_ONLY)
10390                         hdr_only = 1;
10391         }
10392
10393         for(n=0; n<txb->nr_frags; ++n) {
10394                 struct sk_buff *src = txb->fragments[n];
10395                 struct sk_buff *dst;
10396                 struct ieee80211_radiotap_header *rt_hdr;
10397                 int len;
10398
10399                 if (hdr_only) {
10400                         hdr = (void *)src->data;
10401                         len = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
10402                 } else
10403                         len = src->len;
10404
10405                 dst = alloc_skb(
10406                         len + IEEE80211_RADIOTAP_HDRLEN, GFP_ATOMIC);
10407                 if (!dst) continue;
10408
10409                 rt_hdr = (void *)skb_put(dst, sizeof(*rt_hdr));
10410
10411                 rt_hdr->it_version = PKTHDR_RADIOTAP_VERSION;
10412                 rt_hdr->it_pad = 0;
10413                 rt_hdr->it_present = 0; /* after all, it's just an idea */
10414                 rt_hdr->it_present |=  cpu_to_le32(1 << IEEE80211_RADIOTAP_CHANNEL);
10415
10416                 *(__le16*)skb_put(dst, sizeof(u16)) = cpu_to_le16(
10417                         ieee80211chan2mhz(priv->channel));
10418                 if (priv->channel > 14)         /* 802.11a */
10419                         *(__le16*)skb_put(dst, sizeof(u16)) =
10420                                 cpu_to_le16(IEEE80211_CHAN_OFDM |
10421                                              IEEE80211_CHAN_5GHZ);
10422                 else if (priv->ieee->mode == IEEE_B) /* 802.11b */
10423                         *(__le16*)skb_put(dst, sizeof(u16)) =
10424                                 cpu_to_le16(IEEE80211_CHAN_CCK |
10425                                              IEEE80211_CHAN_2GHZ);
10426                 else            /* 802.11g */
10427                         *(__le16*)skb_put(dst, sizeof(u16)) =
10428                                 cpu_to_le16(IEEE80211_CHAN_OFDM |
10429                                  IEEE80211_CHAN_2GHZ);
10430
10431                 rt_hdr->it_len = cpu_to_le16(dst->len);
10432
10433                 skb_copy_from_linear_data(src, skb_put(dst, len), len);
10434
10435                 if (!ieee80211_rx(priv->prom_priv->ieee, dst, &dummystats))
10436                         dev_kfree_skb_any(dst);
10437         }
10438 }
10439 #endif
10440
10441 static int ipw_net_hard_start_xmit(struct ieee80211_txb *txb,
10442                                    struct net_device *dev, int pri)
10443 {
10444         struct ipw_priv *priv = ieee80211_priv(dev);
10445         unsigned long flags;
10446         int ret;
10447
10448         IPW_DEBUG_TX("dev->xmit(%d bytes)\n", txb->payload_size);
10449         spin_lock_irqsave(&priv->lock, flags);
10450
10451 #ifdef CONFIG_IPW2200_PROMISCUOUS
10452         if (rtap_iface && netif_running(priv->prom_net_dev))
10453                 ipw_handle_promiscuous_tx(priv, txb);
10454 #endif
10455
10456         ret = ipw_tx_skb(priv, txb, pri);
10457         if (ret == NETDEV_TX_OK)
10458                 __ipw_led_activity_on(priv);
10459         spin_unlock_irqrestore(&priv->lock, flags);
10460
10461         return ret;
10462 }
10463
10464 static struct net_device_stats *ipw_net_get_stats(struct net_device *dev)
10465 {
10466         struct ipw_priv *priv = ieee80211_priv(dev);
10467
10468         priv->ieee->stats.tx_packets = priv->tx_packets;
10469         priv->ieee->stats.rx_packets = priv->rx_packets;
10470         return &priv->ieee->stats;
10471 }
10472
10473 static void ipw_net_set_multicast_list(struct net_device *dev)
10474 {
10475
10476 }
10477
10478 static int ipw_net_set_mac_address(struct net_device *dev, void *p)
10479 {
10480         struct ipw_priv *priv = ieee80211_priv(dev);
10481         struct sockaddr *addr = p;
10482
10483         if (!is_valid_ether_addr(addr->sa_data))
10484                 return -EADDRNOTAVAIL;
10485         mutex_lock(&priv->mutex);
10486         priv->config |= CFG_CUSTOM_MAC;
10487         memcpy(priv->mac_addr, addr->sa_data, ETH_ALEN);
10488         printk(KERN_INFO "%s: Setting MAC to %pM\n",
10489                priv->net_dev->name, priv->mac_addr);
10490         queue_work(priv->workqueue, &priv->adapter_restart);
10491         mutex_unlock(&priv->mutex);
10492         return 0;
10493 }
10494
10495 static void ipw_ethtool_get_drvinfo(struct net_device *dev,
10496                                     struct ethtool_drvinfo *info)
10497 {
10498         struct ipw_priv *p = ieee80211_priv(dev);
10499         char vers[64];
10500         char date[32];
10501         u32 len;
10502
10503         strcpy(info->driver, DRV_NAME);
10504         strcpy(info->version, DRV_VERSION);
10505
10506         len = sizeof(vers);
10507         ipw_get_ordinal(p, IPW_ORD_STAT_FW_VERSION, vers, &len);
10508         len = sizeof(date);
10509         ipw_get_ordinal(p, IPW_ORD_STAT_FW_DATE, date, &len);
10510
10511         snprintf(info->fw_version, sizeof(info->fw_version), "%s (%s)",
10512                  vers, date);
10513         strcpy(info->bus_info, pci_name(p->pci_dev));
10514         info->eedump_len = IPW_EEPROM_IMAGE_SIZE;
10515 }
10516
10517 static u32 ipw_ethtool_get_link(struct net_device *dev)
10518 {
10519         struct ipw_priv *priv = ieee80211_priv(dev);
10520         return (priv->status & STATUS_ASSOCIATED) != 0;
10521 }
10522
10523 static int ipw_ethtool_get_eeprom_len(struct net_device *dev)
10524 {
10525         return IPW_EEPROM_IMAGE_SIZE;
10526 }
10527
10528 static int ipw_ethtool_get_eeprom(struct net_device *dev,
10529                                   struct ethtool_eeprom *eeprom, u8 * bytes)
10530 {
10531         struct ipw_priv *p = ieee80211_priv(dev);
10532
10533         if (eeprom->offset + eeprom->len > IPW_EEPROM_IMAGE_SIZE)
10534                 return -EINVAL;
10535         mutex_lock(&p->mutex);
10536         memcpy(bytes, &p->eeprom[eeprom->offset], eeprom->len);
10537         mutex_unlock(&p->mutex);
10538         return 0;
10539 }
10540
10541 static int ipw_ethtool_set_eeprom(struct net_device *dev,
10542                                   struct ethtool_eeprom *eeprom, u8 * bytes)
10543 {
10544         struct ipw_priv *p = ieee80211_priv(dev);
10545         int i;
10546
10547         if (eeprom->offset + eeprom->len > IPW_EEPROM_IMAGE_SIZE)
10548                 return -EINVAL;
10549         mutex_lock(&p->mutex);
10550         memcpy(&p->eeprom[eeprom->offset], bytes, eeprom->len);
10551         for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
10552                 ipw_write8(p, i + IPW_EEPROM_DATA, p->eeprom[i]);
10553         mutex_unlock(&p->mutex);
10554         return 0;
10555 }
10556
10557 static const struct ethtool_ops ipw_ethtool_ops = {
10558         .get_link = ipw_ethtool_get_link,
10559         .get_drvinfo = ipw_ethtool_get_drvinfo,
10560         .get_eeprom_len = ipw_ethtool_get_eeprom_len,
10561         .get_eeprom = ipw_ethtool_get_eeprom,
10562         .set_eeprom = ipw_ethtool_set_eeprom,
10563 };
10564
10565 static irqreturn_t ipw_isr(int irq, void *data)
10566 {
10567         struct ipw_priv *priv = data;
10568         u32 inta, inta_mask;
10569
10570         if (!priv)
10571                 return IRQ_NONE;
10572
10573         spin_lock(&priv->irq_lock);
10574
10575         if (!(priv->status & STATUS_INT_ENABLED)) {
10576                 /* IRQ is disabled */
10577                 goto none;
10578         }
10579
10580         inta = ipw_read32(priv, IPW_INTA_RW);
10581         inta_mask = ipw_read32(priv, IPW_INTA_MASK_R);
10582
10583         if (inta == 0xFFFFFFFF) {
10584                 /* Hardware disappeared */
10585                 IPW_WARNING("IRQ INTA == 0xFFFFFFFF\n");
10586                 goto none;
10587         }
10588
10589         if (!(inta & (IPW_INTA_MASK_ALL & inta_mask))) {
10590                 /* Shared interrupt */
10591                 goto none;
10592         }
10593
10594         /* tell the device to stop sending interrupts */
10595         __ipw_disable_interrupts(priv);
10596
10597         /* ack current interrupts */
10598         inta &= (IPW_INTA_MASK_ALL & inta_mask);
10599         ipw_write32(priv, IPW_INTA_RW, inta);
10600
10601         /* Cache INTA value for our tasklet */
10602         priv->isr_inta = inta;
10603
10604         tasklet_schedule(&priv->irq_tasklet);
10605
10606         spin_unlock(&priv->irq_lock);
10607
10608         return IRQ_HANDLED;
10609       none:
10610         spin_unlock(&priv->irq_lock);
10611         return IRQ_NONE;
10612 }
10613
10614 static void ipw_rf_kill(void *adapter)
10615 {
10616         struct ipw_priv *priv = adapter;
10617         unsigned long flags;
10618
10619         spin_lock_irqsave(&priv->lock, flags);
10620
10621         if (rf_kill_active(priv)) {
10622                 IPW_DEBUG_RF_KILL("RF Kill active, rescheduling GPIO check\n");
10623                 if (priv->workqueue)
10624                         queue_delayed_work(priv->workqueue,
10625                                            &priv->rf_kill, 2 * HZ);
10626                 goto exit_unlock;
10627         }
10628
10629         /* RF Kill is now disabled, so bring the device back up */
10630
10631         if (!(priv->status & STATUS_RF_KILL_MASK)) {
10632                 IPW_DEBUG_RF_KILL("HW RF Kill no longer active, restarting "
10633                                   "device\n");
10634
10635                 /* we can not do an adapter restart while inside an irq lock */
10636                 queue_work(priv->workqueue, &priv->adapter_restart);
10637         } else
10638                 IPW_DEBUG_RF_KILL("HW RF Kill deactivated.  SW RF Kill still "
10639                                   "enabled\n");
10640
10641       exit_unlock:
10642         spin_unlock_irqrestore(&priv->lock, flags);
10643 }
10644
10645 static void ipw_bg_rf_kill(struct work_struct *work)
10646 {
10647         struct ipw_priv *priv =
10648                 container_of(work, struct ipw_priv, rf_kill.work);
10649         mutex_lock(&priv->mutex);
10650         ipw_rf_kill(priv);
10651         mutex_unlock(&priv->mutex);
10652 }
10653
10654 static void ipw_link_up(struct ipw_priv *priv)
10655 {
10656         priv->last_seq_num = -1;
10657         priv->last_frag_num = -1;
10658         priv->last_packet_time = 0;
10659
10660         netif_carrier_on(priv->net_dev);
10661
10662         cancel_delayed_work(&priv->request_scan);
10663         cancel_delayed_work(&priv->request_direct_scan);
10664         cancel_delayed_work(&priv->request_passive_scan);
10665         cancel_delayed_work(&priv->scan_event);
10666         ipw_reset_stats(priv);
10667         /* Ensure the rate is updated immediately */
10668         priv->last_rate = ipw_get_current_rate(priv);
10669         ipw_gather_stats(priv);
10670         ipw_led_link_up(priv);
10671         notify_wx_assoc_event(priv);
10672
10673         if (priv->config & CFG_BACKGROUND_SCAN)
10674                 queue_delayed_work(priv->workqueue, &priv->request_scan, HZ);
10675 }
10676
10677 static void ipw_bg_link_up(struct work_struct *work)
10678 {
10679         struct ipw_priv *priv =
10680                 container_of(work, struct ipw_priv, link_up);
10681         mutex_lock(&priv->mutex);
10682         ipw_link_up(priv);
10683         mutex_unlock(&priv->mutex);
10684 }
10685
10686 static void ipw_link_down(struct ipw_priv *priv)
10687 {
10688         ipw_led_link_down(priv);
10689         netif_carrier_off(priv->net_dev);
10690         notify_wx_assoc_event(priv);
10691
10692         /* Cancel any queued work ... */
10693         cancel_delayed_work(&priv->request_scan);
10694         cancel_delayed_work(&priv->request_direct_scan);
10695         cancel_delayed_work(&priv->request_passive_scan);
10696         cancel_delayed_work(&priv->adhoc_check);
10697         cancel_delayed_work(&priv->gather_stats);
10698
10699         ipw_reset_stats(priv);
10700
10701         if (!(priv->status & STATUS_EXIT_PENDING)) {
10702                 /* Queue up another scan... */
10703                 queue_delayed_work(priv->workqueue, &priv->request_scan, 0);
10704         } else
10705                 cancel_delayed_work(&priv->scan_event);
10706 }
10707
10708 static void ipw_bg_link_down(struct work_struct *work)
10709 {
10710         struct ipw_priv *priv =
10711                 container_of(work, struct ipw_priv, link_down);
10712         mutex_lock(&priv->mutex);
10713         ipw_link_down(priv);
10714         mutex_unlock(&priv->mutex);
10715 }
10716
10717 static int __devinit ipw_setup_deferred_work(struct ipw_priv *priv)
10718 {
10719         int ret = 0;
10720
10721         priv->workqueue = create_workqueue(DRV_NAME);
10722         init_waitqueue_head(&priv->wait_command_queue);
10723         init_waitqueue_head(&priv->wait_state);
10724
10725         INIT_DELAYED_WORK(&priv->adhoc_check, ipw_bg_adhoc_check);
10726         INIT_WORK(&priv->associate, ipw_bg_associate);
10727         INIT_WORK(&priv->disassociate, ipw_bg_disassociate);
10728         INIT_WORK(&priv->system_config, ipw_system_config);
10729         INIT_WORK(&priv->rx_replenish, ipw_bg_rx_queue_replenish);
10730         INIT_WORK(&priv->adapter_restart, ipw_bg_adapter_restart);
10731         INIT_DELAYED_WORK(&priv->rf_kill, ipw_bg_rf_kill);
10732         INIT_WORK(&priv->up, ipw_bg_up);
10733         INIT_WORK(&priv->down, ipw_bg_down);
10734         INIT_DELAYED_WORK(&priv->request_scan, ipw_request_scan);
10735         INIT_DELAYED_WORK(&priv->request_direct_scan, ipw_request_direct_scan);
10736         INIT_DELAYED_WORK(&priv->request_passive_scan, ipw_request_passive_scan);
10737         INIT_DELAYED_WORK(&priv->scan_event, ipw_scan_event);
10738         INIT_DELAYED_WORK(&priv->gather_stats, ipw_bg_gather_stats);
10739         INIT_WORK(&priv->abort_scan, ipw_bg_abort_scan);
10740         INIT_WORK(&priv->roam, ipw_bg_roam);
10741         INIT_DELAYED_WORK(&priv->scan_check, ipw_bg_scan_check);
10742         INIT_WORK(&priv->link_up, ipw_bg_link_up);
10743         INIT_WORK(&priv->link_down, ipw_bg_link_down);
10744         INIT_DELAYED_WORK(&priv->led_link_on, ipw_bg_led_link_on);
10745         INIT_DELAYED_WORK(&priv->led_link_off, ipw_bg_led_link_off);
10746         INIT_DELAYED_WORK(&priv->led_act_off, ipw_bg_led_activity_off);
10747         INIT_WORK(&priv->merge_networks, ipw_merge_adhoc_network);
10748
10749 #ifdef CONFIG_IPW2200_QOS
10750         INIT_WORK(&priv->qos_activate, ipw_bg_qos_activate);
10751 #endif                          /* CONFIG_IPW2200_QOS */
10752
10753         tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
10754                      ipw_irq_tasklet, (unsigned long)priv);
10755
10756         return ret;
10757 }
10758
10759 static void shim__set_security(struct net_device *dev,
10760                                struct ieee80211_security *sec)
10761 {
10762         struct ipw_priv *priv = ieee80211_priv(dev);
10763         int i;
10764         for (i = 0; i < 4; i++) {
10765                 if (sec->flags & (1 << i)) {
10766                         priv->ieee->sec.encode_alg[i] = sec->encode_alg[i];
10767                         priv->ieee->sec.key_sizes[i] = sec->key_sizes[i];
10768                         if (sec->key_sizes[i] == 0)
10769                                 priv->ieee->sec.flags &= ~(1 << i);
10770                         else {
10771                                 memcpy(priv->ieee->sec.keys[i], sec->keys[i],
10772                                        sec->key_sizes[i]);
10773                                 priv->ieee->sec.flags |= (1 << i);
10774                         }
10775                         priv->status |= STATUS_SECURITY_UPDATED;
10776                 } else if (sec->level != SEC_LEVEL_1)
10777                         priv->ieee->sec.flags &= ~(1 << i);
10778         }
10779
10780         if (sec->flags & SEC_ACTIVE_KEY) {
10781                 if (sec->active_key <= 3) {
10782                         priv->ieee->sec.active_key = sec->active_key;
10783                         priv->ieee->sec.flags |= SEC_ACTIVE_KEY;
10784                 } else
10785                         priv->ieee->sec.flags &= ~SEC_ACTIVE_KEY;
10786                 priv->status |= STATUS_SECURITY_UPDATED;
10787         } else
10788                 priv->ieee->sec.flags &= ~SEC_ACTIVE_KEY;
10789
10790         if ((sec->flags & SEC_AUTH_MODE) &&
10791             (priv->ieee->sec.auth_mode != sec->auth_mode)) {
10792                 priv->ieee->sec.auth_mode = sec->auth_mode;
10793                 priv->ieee->sec.flags |= SEC_AUTH_MODE;
10794                 if (sec->auth_mode == WLAN_AUTH_SHARED_KEY)
10795                         priv->capability |= CAP_SHARED_KEY;
10796                 else
10797                         priv->capability &= ~CAP_SHARED_KEY;
10798                 priv->status |= STATUS_SECURITY_UPDATED;
10799         }
10800
10801         if (sec->flags & SEC_ENABLED && priv->ieee->sec.enabled != sec->enabled) {
10802                 priv->ieee->sec.flags |= SEC_ENABLED;
10803                 priv->ieee->sec.enabled = sec->enabled;
10804                 priv->status |= STATUS_SECURITY_UPDATED;
10805                 if (sec->enabled)
10806                         priv->capability |= CAP_PRIVACY_ON;
10807                 else
10808                         priv->capability &= ~CAP_PRIVACY_ON;
10809         }
10810
10811         if (sec->flags & SEC_ENCRYPT)
10812                 priv->ieee->sec.encrypt = sec->encrypt;
10813
10814         if (sec->flags & SEC_LEVEL && priv->ieee->sec.level != sec->level) {
10815                 priv->ieee->sec.level = sec->level;
10816                 priv->ieee->sec.flags |= SEC_LEVEL;
10817                 priv->status |= STATUS_SECURITY_UPDATED;
10818         }
10819
10820         if (!priv->ieee->host_encrypt && (sec->flags & SEC_ENCRYPT))
10821                 ipw_set_hwcrypto_keys(priv);
10822
10823         /* To match current functionality of ipw2100 (which works well w/
10824          * various supplicants, we don't force a disassociate if the
10825          * privacy capability changes ... */
10826 #if 0
10827         if ((priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) &&
10828             (((priv->assoc_request.capability &
10829                cpu_to_le16(WLAN_CAPABILITY_PRIVACY)) && !sec->enabled) ||
10830              (!(priv->assoc_request.capability &
10831                 cpu_to_le16(WLAN_CAPABILITY_PRIVACY)) && sec->enabled))) {
10832                 IPW_DEBUG_ASSOC("Disassociating due to capability "
10833                                 "change.\n");
10834                 ipw_disassociate(priv);
10835         }
10836 #endif
10837 }
10838
10839 static int init_supported_rates(struct ipw_priv *priv,
10840                                 struct ipw_supported_rates *rates)
10841 {
10842         /* TODO: Mask out rates based on priv->rates_mask */
10843
10844         memset(rates, 0, sizeof(*rates));
10845         /* configure supported rates */
10846         switch (priv->ieee->freq_band) {
10847         case IEEE80211_52GHZ_BAND:
10848                 rates->ieee_mode = IPW_A_MODE;
10849                 rates->purpose = IPW_RATE_CAPABILITIES;
10850                 ipw_add_ofdm_scan_rates(rates, IEEE80211_CCK_MODULATION,
10851                                         IEEE80211_OFDM_DEFAULT_RATES_MASK);
10852                 break;
10853
10854         default:                /* Mixed or 2.4Ghz */
10855                 rates->ieee_mode = IPW_G_MODE;
10856                 rates->purpose = IPW_RATE_CAPABILITIES;
10857                 ipw_add_cck_scan_rates(rates, IEEE80211_CCK_MODULATION,
10858                                        IEEE80211_CCK_DEFAULT_RATES_MASK);
10859                 if (priv->ieee->modulation & IEEE80211_OFDM_MODULATION) {
10860                         ipw_add_ofdm_scan_rates(rates, IEEE80211_CCK_MODULATION,
10861                                                 IEEE80211_OFDM_DEFAULT_RATES_MASK);
10862                 }
10863                 break;
10864         }
10865
10866         return 0;
10867 }
10868
10869 static int ipw_config(struct ipw_priv *priv)
10870 {
10871         /* This is only called from ipw_up, which resets/reloads the firmware
10872            so, we don't need to first disable the card before we configure
10873            it */
10874         if (ipw_set_tx_power(priv))
10875                 goto error;
10876
10877         /* initialize adapter address */
10878         if (ipw_send_adapter_address(priv, priv->net_dev->dev_addr))
10879                 goto error;
10880
10881         /* set basic system config settings */
10882         init_sys_config(&priv->sys_config);
10883
10884         /* Support Bluetooth if we have BT h/w on board, and user wants to.
10885          * Does not support BT priority yet (don't abort or defer our Tx) */
10886         if (bt_coexist) {
10887                 unsigned char bt_caps = priv->eeprom[EEPROM_SKU_CAPABILITY];
10888
10889                 if (bt_caps & EEPROM_SKU_CAP_BT_CHANNEL_SIG)
10890                         priv->sys_config.bt_coexistence
10891                             |= CFG_BT_COEXISTENCE_SIGNAL_CHNL;
10892                 if (bt_caps & EEPROM_SKU_CAP_BT_OOB)
10893                         priv->sys_config.bt_coexistence
10894                             |= CFG_BT_COEXISTENCE_OOB;
10895         }
10896
10897 #ifdef CONFIG_IPW2200_PROMISCUOUS
10898         if (priv->prom_net_dev && netif_running(priv->prom_net_dev)) {
10899                 priv->sys_config.accept_all_data_frames = 1;
10900                 priv->sys_config.accept_non_directed_frames = 1;
10901                 priv->sys_config.accept_all_mgmt_bcpr = 1;
10902                 priv->sys_config.accept_all_mgmt_frames = 1;
10903         }
10904 #endif
10905
10906         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
10907                 priv->sys_config.answer_broadcast_ssid_probe = 1;
10908         else
10909                 priv->sys_config.answer_broadcast_ssid_probe = 0;
10910
10911         if (ipw_send_system_config(priv))
10912                 goto error;
10913
10914         init_supported_rates(priv, &priv->rates);
10915         if (ipw_send_supported_rates(priv, &priv->rates))
10916                 goto error;
10917
10918         /* Set request-to-send threshold */
10919         if (priv->rts_threshold) {
10920                 if (ipw_send_rts_threshold(priv, priv->rts_threshold))
10921                         goto error;
10922         }
10923 #ifdef CONFIG_IPW2200_QOS
10924         IPW_DEBUG_QOS("QoS: call ipw_qos_activate\n");
10925         ipw_qos_activate(priv, NULL);
10926 #endif                          /* CONFIG_IPW2200_QOS */
10927
10928         if (ipw_set_random_seed(priv))
10929                 goto error;
10930
10931         /* final state transition to the RUN state */
10932         if (ipw_send_host_complete(priv))
10933                 goto error;
10934
10935         priv->status |= STATUS_INIT;
10936
10937         ipw_led_init(priv);
10938         ipw_led_radio_on(priv);
10939         priv->notif_missed_beacons = 0;
10940
10941         /* Set hardware WEP key if it is configured. */
10942         if ((priv->capability & CAP_PRIVACY_ON) &&
10943             (priv->ieee->sec.level == SEC_LEVEL_1) &&
10944             !(priv->ieee->host_encrypt || priv->ieee->host_decrypt))
10945                 ipw_set_hwcrypto_keys(priv);
10946
10947         return 0;
10948
10949       error:
10950         return -EIO;
10951 }
10952
10953 /*
10954  * NOTE:
10955  *
10956  * These tables have been tested in conjunction with the
10957  * Intel PRO/Wireless 2200BG and 2915ABG Network Connection Adapters.
10958  *
10959  * Altering this values, using it on other hardware, or in geographies
10960  * not intended for resale of the above mentioned Intel adapters has
10961  * not been tested.
10962  *
10963  * Remember to update the table in README.ipw2200 when changing this
10964  * table.
10965  *
10966  */
10967 static const struct ieee80211_geo ipw_geos[] = {
10968         {                       /* Restricted */
10969          "---",
10970          .bg_channels = 11,
10971          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10972                 {2427, 4}, {2432, 5}, {2437, 6},
10973                 {2442, 7}, {2447, 8}, {2452, 9},
10974                 {2457, 10}, {2462, 11}},
10975          },
10976
10977         {                       /* Custom US/Canada */
10978          "ZZF",
10979          .bg_channels = 11,
10980          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10981                 {2427, 4}, {2432, 5}, {2437, 6},
10982                 {2442, 7}, {2447, 8}, {2452, 9},
10983                 {2457, 10}, {2462, 11}},
10984          .a_channels = 8,
10985          .a = {{5180, 36},
10986                {5200, 40},
10987                {5220, 44},
10988                {5240, 48},
10989                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
10990                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
10991                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
10992                {5320, 64, IEEE80211_CH_PASSIVE_ONLY}},
10993          },
10994
10995         {                       /* Rest of World */
10996          "ZZD",
10997          .bg_channels = 13,
10998          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10999                 {2427, 4}, {2432, 5}, {2437, 6},
11000                 {2442, 7}, {2447, 8}, {2452, 9},
11001                 {2457, 10}, {2462, 11}, {2467, 12},
11002                 {2472, 13}},
11003          },
11004
11005         {                       /* Custom USA & Europe & High */
11006          "ZZA",
11007          .bg_channels = 11,
11008          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11009                 {2427, 4}, {2432, 5}, {2437, 6},
11010                 {2442, 7}, {2447, 8}, {2452, 9},
11011                 {2457, 10}, {2462, 11}},
11012          .a_channels = 13,
11013          .a = {{5180, 36},
11014                {5200, 40},
11015                {5220, 44},
11016                {5240, 48},
11017                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
11018                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
11019                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
11020                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
11021                {5745, 149},
11022                {5765, 153},
11023                {5785, 157},
11024                {5805, 161},
11025                {5825, 165}},
11026          },
11027
11028         {                       /* Custom NA & Europe */
11029          "ZZB",
11030          .bg_channels = 11,
11031          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11032                 {2427, 4}, {2432, 5}, {2437, 6},
11033                 {2442, 7}, {2447, 8}, {2452, 9},
11034                 {2457, 10}, {2462, 11}},
11035          .a_channels = 13,
11036          .a = {{5180, 36},
11037                {5200, 40},
11038                {5220, 44},
11039                {5240, 48},
11040                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
11041                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
11042                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
11043                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
11044                {5745, 149, IEEE80211_CH_PASSIVE_ONLY},
11045                {5765, 153, IEEE80211_CH_PASSIVE_ONLY},
11046                {5785, 157, IEEE80211_CH_PASSIVE_ONLY},
11047                {5805, 161, IEEE80211_CH_PASSIVE_ONLY},
11048                {5825, 165, IEEE80211_CH_PASSIVE_ONLY}},
11049          },
11050
11051         {                       /* Custom Japan */
11052          "ZZC",
11053          .bg_channels = 11,
11054          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11055                 {2427, 4}, {2432, 5}, {2437, 6},
11056                 {2442, 7}, {2447, 8}, {2452, 9},
11057                 {2457, 10}, {2462, 11}},
11058          .a_channels = 4,
11059          .a = {{5170, 34}, {5190, 38},
11060                {5210, 42}, {5230, 46}},
11061          },
11062
11063         {                       /* Custom */
11064          "ZZM",
11065          .bg_channels = 11,
11066          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11067                 {2427, 4}, {2432, 5}, {2437, 6},
11068                 {2442, 7}, {2447, 8}, {2452, 9},
11069                 {2457, 10}, {2462, 11}},
11070          },
11071
11072         {                       /* Europe */
11073          "ZZE",
11074          .bg_channels = 13,
11075          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11076                 {2427, 4}, {2432, 5}, {2437, 6},
11077                 {2442, 7}, {2447, 8}, {2452, 9},
11078                 {2457, 10}, {2462, 11}, {2467, 12},
11079                 {2472, 13}},
11080          .a_channels = 19,
11081          .a = {{5180, 36},
11082                {5200, 40},
11083                {5220, 44},
11084                {5240, 48},
11085                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
11086                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
11087                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
11088                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
11089                {5500, 100, IEEE80211_CH_PASSIVE_ONLY},
11090                {5520, 104, IEEE80211_CH_PASSIVE_ONLY},
11091                {5540, 108, IEEE80211_CH_PASSIVE_ONLY},
11092                {5560, 112, IEEE80211_CH_PASSIVE_ONLY},
11093                {5580, 116, IEEE80211_CH_PASSIVE_ONLY},
11094                {5600, 120, IEEE80211_CH_PASSIVE_ONLY},
11095                {5620, 124, IEEE80211_CH_PASSIVE_ONLY},
11096                {5640, 128, IEEE80211_CH_PASSIVE_ONLY},
11097                {5660, 132, IEEE80211_CH_PASSIVE_ONLY},
11098                {5680, 136, IEEE80211_CH_PASSIVE_ONLY},
11099                {5700, 140, IEEE80211_CH_PASSIVE_ONLY}},
11100          },
11101
11102         {                       /* Custom Japan */
11103          "ZZJ",
11104          .bg_channels = 14,
11105          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11106                 {2427, 4}, {2432, 5}, {2437, 6},
11107                 {2442, 7}, {2447, 8}, {2452, 9},
11108                 {2457, 10}, {2462, 11}, {2467, 12},
11109                 {2472, 13}, {2484, 14, IEEE80211_CH_B_ONLY}},
11110          .a_channels = 4,
11111          .a = {{5170, 34}, {5190, 38},
11112                {5210, 42}, {5230, 46}},
11113          },
11114
11115         {                       /* Rest of World */
11116          "ZZR",
11117          .bg_channels = 14,
11118          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11119                 {2427, 4}, {2432, 5}, {2437, 6},
11120                 {2442, 7}, {2447, 8}, {2452, 9},
11121                 {2457, 10}, {2462, 11}, {2467, 12},
11122                 {2472, 13}, {2484, 14, IEEE80211_CH_B_ONLY |
11123                              IEEE80211_CH_PASSIVE_ONLY}},
11124          },
11125
11126         {                       /* High Band */
11127          "ZZH",
11128          .bg_channels = 13,
11129          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11130                 {2427, 4}, {2432, 5}, {2437, 6},
11131                 {2442, 7}, {2447, 8}, {2452, 9},
11132                 {2457, 10}, {2462, 11},
11133                 {2467, 12, IEEE80211_CH_PASSIVE_ONLY},
11134                 {2472, 13, IEEE80211_CH_PASSIVE_ONLY}},
11135          .a_channels = 4,
11136          .a = {{5745, 149}, {5765, 153},
11137                {5785, 157}, {5805, 161}},
11138          },
11139
11140         {                       /* Custom Europe */
11141          "ZZG",
11142          .bg_channels = 13,
11143          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11144                 {2427, 4}, {2432, 5}, {2437, 6},
11145                 {2442, 7}, {2447, 8}, {2452, 9},
11146                 {2457, 10}, {2462, 11},
11147                 {2467, 12}, {2472, 13}},
11148          .a_channels = 4,
11149          .a = {{5180, 36}, {5200, 40},
11150                {5220, 44}, {5240, 48}},
11151          },
11152
11153         {                       /* Europe */
11154          "ZZK",
11155          .bg_channels = 13,
11156          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11157                 {2427, 4}, {2432, 5}, {2437, 6},
11158                 {2442, 7}, {2447, 8}, {2452, 9},
11159                 {2457, 10}, {2462, 11},
11160                 {2467, 12, IEEE80211_CH_PASSIVE_ONLY},
11161                 {2472, 13, IEEE80211_CH_PASSIVE_ONLY}},
11162          .a_channels = 24,
11163          .a = {{5180, 36, IEEE80211_CH_PASSIVE_ONLY},
11164                {5200, 40, IEEE80211_CH_PASSIVE_ONLY},
11165                {5220, 44, IEEE80211_CH_PASSIVE_ONLY},
11166                {5240, 48, IEEE80211_CH_PASSIVE_ONLY},
11167                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
11168                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
11169                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
11170                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
11171                {5500, 100, IEEE80211_CH_PASSIVE_ONLY},
11172                {5520, 104, IEEE80211_CH_PASSIVE_ONLY},
11173                {5540, 108, IEEE80211_CH_PASSIVE_ONLY},
11174                {5560, 112, IEEE80211_CH_PASSIVE_ONLY},
11175                {5580, 116, IEEE80211_CH_PASSIVE_ONLY},
11176                {5600, 120, IEEE80211_CH_PASSIVE_ONLY},
11177                {5620, 124, IEEE80211_CH_PASSIVE_ONLY},
11178                {5640, 128, IEEE80211_CH_PASSIVE_ONLY},
11179                {5660, 132, IEEE80211_CH_PASSIVE_ONLY},
11180                {5680, 136, IEEE80211_CH_PASSIVE_ONLY},
11181                {5700, 140, IEEE80211_CH_PASSIVE_ONLY},
11182                {5745, 149, IEEE80211_CH_PASSIVE_ONLY},
11183                {5765, 153, IEEE80211_CH_PASSIVE_ONLY},
11184                {5785, 157, IEEE80211_CH_PASSIVE_ONLY},
11185                {5805, 161, IEEE80211_CH_PASSIVE_ONLY},
11186                {5825, 165, IEEE80211_CH_PASSIVE_ONLY}},
11187          },
11188
11189         {                       /* Europe */
11190          "ZZL",
11191          .bg_channels = 11,
11192          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11193                 {2427, 4}, {2432, 5}, {2437, 6},
11194                 {2442, 7}, {2447, 8}, {2452, 9},
11195                 {2457, 10}, {2462, 11}},
11196          .a_channels = 13,
11197          .a = {{5180, 36, IEEE80211_CH_PASSIVE_ONLY},
11198                {5200, 40, IEEE80211_CH_PASSIVE_ONLY},
11199                {5220, 44, IEEE80211_CH_PASSIVE_ONLY},
11200                {5240, 48, IEEE80211_CH_PASSIVE_ONLY},
11201                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
11202                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
11203                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
11204                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
11205                {5745, 149, IEEE80211_CH_PASSIVE_ONLY},
11206                {5765, 153, IEEE80211_CH_PASSIVE_ONLY},
11207                {5785, 157, IEEE80211_CH_PASSIVE_ONLY},
11208                {5805, 161, IEEE80211_CH_PASSIVE_ONLY},
11209                {5825, 165, IEEE80211_CH_PASSIVE_ONLY}},
11210          }
11211 };
11212
11213 #define MAX_HW_RESTARTS 5
11214 static int ipw_up(struct ipw_priv *priv)
11215 {
11216         int rc, i, j;
11217
11218         if (priv->status & STATUS_EXIT_PENDING)
11219                 return -EIO;
11220
11221         if (cmdlog && !priv->cmdlog) {
11222                 priv->cmdlog = kcalloc(cmdlog, sizeof(*priv->cmdlog),
11223                                        GFP_KERNEL);
11224                 if (priv->cmdlog == NULL) {
11225                         IPW_ERROR("Error allocating %d command log entries.\n",
11226                                   cmdlog);
11227                         return -ENOMEM;
11228                 } else {
11229                         priv->cmdlog_len = cmdlog;
11230                 }
11231         }
11232
11233         for (i = 0; i < MAX_HW_RESTARTS; i++) {
11234                 /* Load the microcode, firmware, and eeprom.
11235                  * Also start the clocks. */
11236                 rc = ipw_load(priv);
11237                 if (rc) {
11238                         IPW_ERROR("Unable to load firmware: %d\n", rc);
11239                         return rc;
11240                 }
11241
11242                 ipw_init_ordinals(priv);
11243                 if (!(priv->config & CFG_CUSTOM_MAC))
11244                         eeprom_parse_mac(priv, priv->mac_addr);
11245                 memcpy(priv->net_dev->dev_addr, priv->mac_addr, ETH_ALEN);
11246
11247                 for (j = 0; j < ARRAY_SIZE(ipw_geos); j++) {
11248                         if (!memcmp(&priv->eeprom[EEPROM_COUNTRY_CODE],
11249                                     ipw_geos[j].name, 3))
11250                                 break;
11251                 }
11252                 if (j == ARRAY_SIZE(ipw_geos)) {
11253                         IPW_WARNING("SKU [%c%c%c] not recognized.\n",
11254                                     priv->eeprom[EEPROM_COUNTRY_CODE + 0],
11255                                     priv->eeprom[EEPROM_COUNTRY_CODE + 1],
11256                                     priv->eeprom[EEPROM_COUNTRY_CODE + 2]);
11257                         j = 0;
11258                 }
11259                 if (ieee80211_set_geo(priv->ieee, &ipw_geos[j])) {
11260                         IPW_WARNING("Could not set geography.");
11261                         return 0;
11262                 }
11263
11264                 if (priv->status & STATUS_RF_KILL_SW) {
11265                         IPW_WARNING("Radio disabled by module parameter.\n");
11266                         return 0;
11267                 } else if (rf_kill_active(priv)) {
11268                         IPW_WARNING("Radio Frequency Kill Switch is On:\n"
11269                                     "Kill switch must be turned off for "
11270                                     "wireless networking to work.\n");
11271                         queue_delayed_work(priv->workqueue, &priv->rf_kill,
11272                                            2 * HZ);
11273                         return 0;
11274                 }
11275
11276                 rc = ipw_config(priv);
11277                 if (!rc) {
11278                         IPW_DEBUG_INFO("Configured device on count %i\n", i);
11279
11280                         /* If configure to try and auto-associate, kick
11281                          * off a scan. */
11282                         queue_delayed_work(priv->workqueue,
11283                                            &priv->request_scan, 0);
11284
11285                         return 0;
11286                 }
11287
11288                 IPW_DEBUG_INFO("Device configuration failed: 0x%08X\n", rc);
11289                 IPW_DEBUG_INFO("Failed to config device on retry %d of %d\n",
11290                                i, MAX_HW_RESTARTS);
11291
11292                 /* We had an error bringing up the hardware, so take it
11293                  * all the way back down so we can try again */
11294                 ipw_down(priv);
11295         }
11296
11297         /* tried to restart and config the device for as long as our
11298          * patience could withstand */
11299         IPW_ERROR("Unable to initialize device after %d attempts.\n", i);
11300
11301         return -EIO;
11302 }
11303
11304 static void ipw_bg_up(struct work_struct *work)
11305 {
11306         struct ipw_priv *priv =
11307                 container_of(work, struct ipw_priv, up);
11308         mutex_lock(&priv->mutex);
11309         ipw_up(priv);
11310         mutex_unlock(&priv->mutex);
11311 }
11312
11313 static void ipw_deinit(struct ipw_priv *priv)
11314 {
11315         int i;
11316
11317         if (priv->status & STATUS_SCANNING) {
11318                 IPW_DEBUG_INFO("Aborting scan during shutdown.\n");
11319                 ipw_abort_scan(priv);
11320         }
11321
11322         if (priv->status & STATUS_ASSOCIATED) {
11323                 IPW_DEBUG_INFO("Disassociating during shutdown.\n");
11324                 ipw_disassociate(priv);
11325         }
11326
11327         ipw_led_shutdown(priv);
11328
11329         /* Wait up to 1s for status to change to not scanning and not
11330          * associated (disassociation can take a while for a ful 802.11
11331          * exchange */
11332         for (i = 1000; i && (priv->status &
11333                              (STATUS_DISASSOCIATING |
11334                               STATUS_ASSOCIATED | STATUS_SCANNING)); i--)
11335                 udelay(10);
11336
11337         if (priv->status & (STATUS_DISASSOCIATING |
11338                             STATUS_ASSOCIATED | STATUS_SCANNING))
11339                 IPW_DEBUG_INFO("Still associated or scanning...\n");
11340         else
11341                 IPW_DEBUG_INFO("Took %dms to de-init\n", 1000 - i);
11342
11343         /* Attempt to disable the card */
11344         ipw_send_card_disable(priv, 0);
11345
11346         priv->status &= ~STATUS_INIT;
11347 }
11348
11349 static void ipw_down(struct ipw_priv *priv)
11350 {
11351         int exit_pending = priv->status & STATUS_EXIT_PENDING;
11352
11353         priv->status |= STATUS_EXIT_PENDING;
11354
11355         if (ipw_is_init(priv))
11356                 ipw_deinit(priv);
11357
11358         /* Wipe out the EXIT_PENDING status bit if we are not actually
11359          * exiting the module */
11360         if (!exit_pending)
11361                 priv->status &= ~STATUS_EXIT_PENDING;
11362
11363         /* tell the device to stop sending interrupts */
11364         ipw_disable_interrupts(priv);
11365
11366         /* Clear all bits but the RF Kill */
11367         priv->status &= STATUS_RF_KILL_MASK | STATUS_EXIT_PENDING;
11368         netif_carrier_off(priv->net_dev);
11369
11370         ipw_stop_nic(priv);
11371
11372         ipw_led_radio_off(priv);
11373 }
11374
11375 static void ipw_bg_down(struct work_struct *work)
11376 {
11377         struct ipw_priv *priv =
11378                 container_of(work, struct ipw_priv, down);
11379         mutex_lock(&priv->mutex);
11380         ipw_down(priv);
11381         mutex_unlock(&priv->mutex);
11382 }
11383
11384 /* Called by register_netdev() */
11385 static int ipw_net_init(struct net_device *dev)
11386 {
11387         struct ipw_priv *priv = ieee80211_priv(dev);
11388         mutex_lock(&priv->mutex);
11389
11390         if (ipw_up(priv)) {
11391                 mutex_unlock(&priv->mutex);
11392                 return -EIO;
11393         }
11394
11395         mutex_unlock(&priv->mutex);
11396         return 0;
11397 }
11398
11399 /* PCI driver stuff */
11400 static struct pci_device_id card_ids[] = {
11401         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2701, 0, 0, 0},
11402         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2702, 0, 0, 0},
11403         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2711, 0, 0, 0},
11404         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2712, 0, 0, 0},
11405         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2721, 0, 0, 0},
11406         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2722, 0, 0, 0},
11407         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2731, 0, 0, 0},
11408         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2732, 0, 0, 0},
11409         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2741, 0, 0, 0},
11410         {PCI_VENDOR_ID_INTEL, 0x1043, 0x103c, 0x2741, 0, 0, 0},
11411         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2742, 0, 0, 0},
11412         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2751, 0, 0, 0},
11413         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2752, 0, 0, 0},
11414         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2753, 0, 0, 0},
11415         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2754, 0, 0, 0},
11416         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2761, 0, 0, 0},
11417         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2762, 0, 0, 0},
11418         {PCI_VENDOR_ID_INTEL, 0x104f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
11419         {PCI_VENDOR_ID_INTEL, 0x4220, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* BG */
11420         {PCI_VENDOR_ID_INTEL, 0x4221, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* BG */
11421         {PCI_VENDOR_ID_INTEL, 0x4223, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* ABG */
11422         {PCI_VENDOR_ID_INTEL, 0x4224, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* ABG */
11423
11424         /* required last entry */
11425         {0,}
11426 };
11427
11428 MODULE_DEVICE_TABLE(pci, card_ids);
11429
11430 static struct attribute *ipw_sysfs_entries[] = {
11431         &dev_attr_rf_kill.attr,
11432         &dev_attr_direct_dword.attr,
11433         &dev_attr_indirect_byte.attr,
11434         &dev_attr_indirect_dword.attr,
11435         &dev_attr_mem_gpio_reg.attr,
11436         &dev_attr_command_event_reg.attr,
11437         &dev_attr_nic_type.attr,
11438         &dev_attr_status.attr,
11439         &dev_attr_cfg.attr,
11440         &dev_attr_error.attr,
11441         &dev_attr_event_log.attr,
11442         &dev_attr_cmd_log.attr,
11443         &dev_attr_eeprom_delay.attr,
11444         &dev_attr_ucode_version.attr,
11445         &dev_attr_rtc.attr,
11446         &dev_attr_scan_age.attr,
11447         &dev_attr_led.attr,
11448         &dev_attr_speed_scan.attr,
11449         &dev_attr_net_stats.attr,
11450         &dev_attr_channels.attr,
11451 #ifdef CONFIG_IPW2200_PROMISCUOUS
11452         &dev_attr_rtap_iface.attr,
11453         &dev_attr_rtap_filter.attr,
11454 #endif
11455         NULL
11456 };
11457
11458 static struct attribute_group ipw_attribute_group = {
11459         .name = NULL,           /* put in device directory */
11460         .attrs = ipw_sysfs_entries,
11461 };
11462
11463 #ifdef CONFIG_IPW2200_PROMISCUOUS
11464 static int ipw_prom_open(struct net_device *dev)
11465 {
11466         struct ipw_prom_priv *prom_priv = ieee80211_priv(dev);
11467         struct ipw_priv *priv = prom_priv->priv;
11468
11469         IPW_DEBUG_INFO("prom dev->open\n");
11470         netif_carrier_off(dev);
11471
11472         if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
11473                 priv->sys_config.accept_all_data_frames = 1;
11474                 priv->sys_config.accept_non_directed_frames = 1;
11475                 priv->sys_config.accept_all_mgmt_bcpr = 1;
11476                 priv->sys_config.accept_all_mgmt_frames = 1;
11477
11478                 ipw_send_system_config(priv);
11479         }
11480
11481         return 0;
11482 }
11483
11484 static int ipw_prom_stop(struct net_device *dev)
11485 {
11486         struct ipw_prom_priv *prom_priv = ieee80211_priv(dev);
11487         struct ipw_priv *priv = prom_priv->priv;
11488
11489         IPW_DEBUG_INFO("prom dev->stop\n");
11490
11491         if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
11492                 priv->sys_config.accept_all_data_frames = 0;
11493                 priv->sys_config.accept_non_directed_frames = 0;
11494                 priv->sys_config.accept_all_mgmt_bcpr = 0;
11495                 priv->sys_config.accept_all_mgmt_frames = 0;
11496
11497                 ipw_send_system_config(priv);
11498         }
11499
11500         return 0;
11501 }
11502
11503 static int ipw_prom_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
11504 {
11505         IPW_DEBUG_INFO("prom dev->xmit\n");
11506         return -EOPNOTSUPP;
11507 }
11508
11509 static struct net_device_stats *ipw_prom_get_stats(struct net_device *dev)
11510 {
11511         struct ipw_prom_priv *prom_priv = ieee80211_priv(dev);
11512         return &prom_priv->ieee->stats;
11513 }
11514
11515 static int ipw_prom_alloc(struct ipw_priv *priv)
11516 {
11517         int rc = 0;
11518
11519         if (priv->prom_net_dev)
11520                 return -EPERM;
11521
11522         priv->prom_net_dev = alloc_ieee80211(sizeof(struct ipw_prom_priv));
11523         if (priv->prom_net_dev == NULL)
11524                 return -ENOMEM;
11525
11526         priv->prom_priv = ieee80211_priv(priv->prom_net_dev);
11527         priv->prom_priv->ieee = netdev_priv(priv->prom_net_dev);
11528         priv->prom_priv->priv = priv;
11529
11530         strcpy(priv->prom_net_dev->name, "rtap%d");
11531         memcpy(priv->prom_net_dev->dev_addr, priv->mac_addr, ETH_ALEN);
11532
11533         priv->prom_net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
11534         priv->prom_net_dev->open = ipw_prom_open;
11535         priv->prom_net_dev->stop = ipw_prom_stop;
11536         priv->prom_net_dev->get_stats = ipw_prom_get_stats;
11537         priv->prom_net_dev->hard_start_xmit = ipw_prom_hard_start_xmit;
11538
11539         priv->prom_priv->ieee->iw_mode = IW_MODE_MONITOR;
11540         SET_NETDEV_DEV(priv->prom_net_dev, &priv->pci_dev->dev);
11541
11542         rc = register_netdev(priv->prom_net_dev);
11543         if (rc) {
11544                 free_ieee80211(priv->prom_net_dev);
11545                 priv->prom_net_dev = NULL;
11546                 return rc;
11547         }
11548
11549         return 0;
11550 }
11551
11552 static void ipw_prom_free(struct ipw_priv *priv)
11553 {
11554         if (!priv->prom_net_dev)
11555                 return;
11556
11557         unregister_netdev(priv->prom_net_dev);
11558         free_ieee80211(priv->prom_net_dev);
11559
11560         priv->prom_net_dev = NULL;
11561 }
11562
11563 #endif
11564
11565
11566 static int __devinit ipw_pci_probe(struct pci_dev *pdev,
11567                                    const struct pci_device_id *ent)
11568 {
11569         int err = 0;
11570         struct net_device *net_dev;
11571         void __iomem *base;
11572         u32 length, val;
11573         struct ipw_priv *priv;
11574         int i;
11575
11576         net_dev = alloc_ieee80211(sizeof(struct ipw_priv));
11577         if (net_dev == NULL) {
11578                 err = -ENOMEM;
11579                 goto out;
11580         }
11581
11582         priv = ieee80211_priv(net_dev);
11583         priv->ieee = netdev_priv(net_dev);
11584
11585         priv->net_dev = net_dev;
11586         priv->pci_dev = pdev;
11587         ipw_debug_level = debug;
11588         spin_lock_init(&priv->irq_lock);
11589         spin_lock_init(&priv->lock);
11590         for (i = 0; i < IPW_IBSS_MAC_HASH_SIZE; i++)
11591                 INIT_LIST_HEAD(&priv->ibss_mac_hash[i]);
11592
11593         mutex_init(&priv->mutex);
11594         if (pci_enable_device(pdev)) {
11595                 err = -ENODEV;
11596                 goto out_free_ieee80211;
11597         }
11598
11599         pci_set_master(pdev);
11600
11601         err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
11602         if (!err)
11603                 err = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
11604         if (err) {
11605                 printk(KERN_WARNING DRV_NAME ": No suitable DMA available.\n");
11606                 goto out_pci_disable_device;
11607         }
11608
11609         pci_set_drvdata(pdev, priv);
11610
11611         err = pci_request_regions(pdev, DRV_NAME);
11612         if (err)
11613                 goto out_pci_disable_device;
11614
11615         /* We disable the RETRY_TIMEOUT register (0x41) to keep
11616          * PCI Tx retries from interfering with C3 CPU state */
11617         pci_read_config_dword(pdev, 0x40, &val);
11618         if ((val & 0x0000ff00) != 0)
11619                 pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
11620
11621         length = pci_resource_len(pdev, 0);
11622         priv->hw_len = length;
11623
11624         base = pci_ioremap_bar(pdev, 0);
11625         if (!base) {
11626                 err = -ENODEV;
11627                 goto out_pci_release_regions;
11628         }
11629
11630         priv->hw_base = base;
11631         IPW_DEBUG_INFO("pci_resource_len = 0x%08x\n", length);
11632         IPW_DEBUG_INFO("pci_resource_base = %p\n", base);
11633
11634         err = ipw_setup_deferred_work(priv);
11635         if (err) {
11636                 IPW_ERROR("Unable to setup deferred work\n");
11637                 goto out_iounmap;
11638         }
11639
11640         ipw_sw_reset(priv, 1);
11641
11642         err = request_irq(pdev->irq, ipw_isr, IRQF_SHARED, DRV_NAME, priv);
11643         if (err) {
11644                 IPW_ERROR("Error allocating IRQ %d\n", pdev->irq);
11645                 goto out_destroy_workqueue;
11646         }
11647
11648         SET_NETDEV_DEV(net_dev, &pdev->dev);
11649
11650         mutex_lock(&priv->mutex);
11651
11652         priv->ieee->hard_start_xmit = ipw_net_hard_start_xmit;
11653         priv->ieee->set_security = shim__set_security;
11654         priv->ieee->is_queue_full = ipw_net_is_queue_full;
11655
11656 #ifdef CONFIG_IPW2200_QOS
11657         priv->ieee->is_qos_active = ipw_is_qos_active;
11658         priv->ieee->handle_probe_response = ipw_handle_beacon;
11659         priv->ieee->handle_beacon = ipw_handle_probe_response;
11660         priv->ieee->handle_assoc_response = ipw_handle_assoc_response;
11661 #endif                          /* CONFIG_IPW2200_QOS */
11662
11663         priv->ieee->perfect_rssi = -20;
11664         priv->ieee->worst_rssi = -85;
11665
11666         net_dev->open = ipw_net_open;
11667         net_dev->stop = ipw_net_stop;
11668         net_dev->init = ipw_net_init;
11669         net_dev->get_stats = ipw_net_get_stats;
11670         net_dev->set_multicast_list = ipw_net_set_multicast_list;
11671         net_dev->set_mac_address = ipw_net_set_mac_address;
11672         priv->wireless_data.spy_data = &priv->ieee->spy_data;
11673         net_dev->wireless_data = &priv->wireless_data;
11674         net_dev->wireless_handlers = &ipw_wx_handler_def;
11675         net_dev->ethtool_ops = &ipw_ethtool_ops;
11676         net_dev->irq = pdev->irq;
11677         net_dev->base_addr = (unsigned long)priv->hw_base;
11678         net_dev->mem_start = pci_resource_start(pdev, 0);
11679         net_dev->mem_end = net_dev->mem_start + pci_resource_len(pdev, 0) - 1;
11680
11681         err = sysfs_create_group(&pdev->dev.kobj, &ipw_attribute_group);
11682         if (err) {
11683                 IPW_ERROR("failed to create sysfs device attributes\n");
11684                 mutex_unlock(&priv->mutex);
11685                 goto out_release_irq;
11686         }
11687
11688         mutex_unlock(&priv->mutex);
11689         err = register_netdev(net_dev);
11690         if (err) {
11691                 IPW_ERROR("failed to register network device\n");
11692                 goto out_remove_sysfs;
11693         }
11694
11695 #ifdef CONFIG_IPW2200_PROMISCUOUS
11696         if (rtap_iface) {
11697                 err = ipw_prom_alloc(priv);
11698                 if (err) {
11699                         IPW_ERROR("Failed to register promiscuous network "
11700                                   "device (error %d).\n", err);
11701                         unregister_netdev(priv->net_dev);
11702                         goto out_remove_sysfs;
11703                 }
11704         }
11705 #endif
11706
11707         printk(KERN_INFO DRV_NAME ": Detected geography %s (%d 802.11bg "
11708                "channels, %d 802.11a channels)\n",
11709                priv->ieee->geo.name, priv->ieee->geo.bg_channels,
11710                priv->ieee->geo.a_channels);
11711
11712         return 0;
11713
11714       out_remove_sysfs:
11715         sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
11716       out_release_irq:
11717         free_irq(pdev->irq, priv);
11718       out_destroy_workqueue:
11719         destroy_workqueue(priv->workqueue);
11720         priv->workqueue = NULL;
11721       out_iounmap:
11722         iounmap(priv->hw_base);
11723       out_pci_release_regions:
11724         pci_release_regions(pdev);
11725       out_pci_disable_device:
11726         pci_disable_device(pdev);
11727         pci_set_drvdata(pdev, NULL);
11728       out_free_ieee80211:
11729         free_ieee80211(priv->net_dev);
11730       out:
11731         return err;
11732 }
11733
11734 static void __devexit ipw_pci_remove(struct pci_dev *pdev)
11735 {
11736         struct ipw_priv *priv = pci_get_drvdata(pdev);
11737         struct list_head *p, *q;
11738         int i;
11739
11740         if (!priv)
11741                 return;
11742
11743         mutex_lock(&priv->mutex);
11744
11745         priv->status |= STATUS_EXIT_PENDING;
11746         ipw_down(priv);
11747         sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
11748
11749         mutex_unlock(&priv->mutex);
11750
11751         unregister_netdev(priv->net_dev);
11752
11753         if (priv->rxq) {
11754                 ipw_rx_queue_free(priv, priv->rxq);
11755                 priv->rxq = NULL;
11756         }
11757         ipw_tx_queue_free(priv);
11758
11759         if (priv->cmdlog) {
11760                 kfree(priv->cmdlog);
11761                 priv->cmdlog = NULL;
11762         }
11763         /* ipw_down will ensure that there is no more pending work
11764          * in the workqueue's, so we can safely remove them now. */
11765         cancel_delayed_work(&priv->adhoc_check);
11766         cancel_delayed_work(&priv->gather_stats);
11767         cancel_delayed_work(&priv->request_scan);
11768         cancel_delayed_work(&priv->request_direct_scan);
11769         cancel_delayed_work(&priv->request_passive_scan);
11770         cancel_delayed_work(&priv->scan_event);
11771         cancel_delayed_work(&priv->rf_kill);
11772         cancel_delayed_work(&priv->scan_check);
11773         destroy_workqueue(priv->workqueue);
11774         priv->workqueue = NULL;
11775
11776         /* Free MAC hash list for ADHOC */
11777         for (i = 0; i < IPW_IBSS_MAC_HASH_SIZE; i++) {
11778                 list_for_each_safe(p, q, &priv->ibss_mac_hash[i]) {
11779                         list_del(p);
11780                         kfree(list_entry(p, struct ipw_ibss_seq, list));
11781                 }
11782         }
11783
11784         kfree(priv->error);
11785         priv->error = NULL;
11786
11787 #ifdef CONFIG_IPW2200_PROMISCUOUS
11788         ipw_prom_free(priv);
11789 #endif
11790
11791         free_irq(pdev->irq, priv);
11792         iounmap(priv->hw_base);
11793         pci_release_regions(pdev);
11794         pci_disable_device(pdev);
11795         pci_set_drvdata(pdev, NULL);
11796         free_ieee80211(priv->net_dev);
11797         free_firmware();
11798 }
11799
11800 #ifdef CONFIG_PM
11801 static int ipw_pci_suspend(struct pci_dev *pdev, pm_message_t state)
11802 {
11803         struct ipw_priv *priv = pci_get_drvdata(pdev);
11804         struct net_device *dev = priv->net_dev;
11805
11806         printk(KERN_INFO "%s: Going into suspend...\n", dev->name);
11807
11808         /* Take down the device; powers it off, etc. */
11809         ipw_down(priv);
11810
11811         /* Remove the PRESENT state of the device */
11812         netif_device_detach(dev);
11813
11814         pci_save_state(pdev);
11815         pci_disable_device(pdev);
11816         pci_set_power_state(pdev, pci_choose_state(pdev, state));
11817
11818         return 0;
11819 }
11820
11821 static int ipw_pci_resume(struct pci_dev *pdev)
11822 {
11823         struct ipw_priv *priv = pci_get_drvdata(pdev);
11824         struct net_device *dev = priv->net_dev;
11825         int err;
11826         u32 val;
11827
11828         printk(KERN_INFO "%s: Coming out of suspend...\n", dev->name);
11829
11830         pci_set_power_state(pdev, PCI_D0);
11831         err = pci_enable_device(pdev);
11832         if (err) {
11833                 printk(KERN_ERR "%s: pci_enable_device failed on resume\n",
11834                        dev->name);
11835                 return err;
11836         }
11837         pci_restore_state(pdev);
11838
11839         /*
11840          * Suspend/Resume resets the PCI configuration space, so we have to
11841          * re-disable the RETRY_TIMEOUT register (0x41) to keep PCI Tx retries
11842          * from interfering with C3 CPU state. pci_restore_state won't help
11843          * here since it only restores the first 64 bytes pci config header.
11844          */
11845         pci_read_config_dword(pdev, 0x40, &val);
11846         if ((val & 0x0000ff00) != 0)
11847                 pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
11848
11849         /* Set the device back into the PRESENT state; this will also wake
11850          * the queue of needed */
11851         netif_device_attach(dev);
11852
11853         /* Bring the device back up */
11854         queue_work(priv->workqueue, &priv->up);
11855
11856         return 0;
11857 }
11858 #endif
11859
11860 static void ipw_pci_shutdown(struct pci_dev *pdev)
11861 {
11862         struct ipw_priv *priv = pci_get_drvdata(pdev);
11863
11864         /* Take down the device; powers it off, etc. */
11865         ipw_down(priv);
11866
11867         pci_disable_device(pdev);
11868 }
11869
11870 /* driver initialization stuff */
11871 static struct pci_driver ipw_driver = {
11872         .name = DRV_NAME,
11873         .id_table = card_ids,
11874         .probe = ipw_pci_probe,
11875         .remove = __devexit_p(ipw_pci_remove),
11876 #ifdef CONFIG_PM
11877         .suspend = ipw_pci_suspend,
11878         .resume = ipw_pci_resume,
11879 #endif
11880         .shutdown = ipw_pci_shutdown,
11881 };
11882
11883 static int __init ipw_init(void)
11884 {
11885         int ret;
11886
11887         printk(KERN_INFO DRV_NAME ": " DRV_DESCRIPTION ", " DRV_VERSION "\n");
11888         printk(KERN_INFO DRV_NAME ": " DRV_COPYRIGHT "\n");
11889
11890         ret = pci_register_driver(&ipw_driver);
11891         if (ret) {
11892                 IPW_ERROR("Unable to initialize PCI module\n");
11893                 return ret;
11894         }
11895
11896         ret = driver_create_file(&ipw_driver.driver, &driver_attr_debug_level);
11897         if (ret) {
11898                 IPW_ERROR("Unable to create driver sysfs file\n");
11899                 pci_unregister_driver(&ipw_driver);
11900                 return ret;
11901         }
11902
11903         return ret;
11904 }
11905
11906 static void __exit ipw_exit(void)
11907 {
11908         driver_remove_file(&ipw_driver.driver, &driver_attr_debug_level);
11909         pci_unregister_driver(&ipw_driver);
11910 }
11911
11912 module_param(disable, int, 0444);
11913 MODULE_PARM_DESC(disable, "manually disable the radio (default 0 [radio on])");
11914
11915 module_param(associate, int, 0444);
11916 MODULE_PARM_DESC(associate, "auto associate when scanning (default off)");
11917
11918 module_param(auto_create, int, 0444);
11919 MODULE_PARM_DESC(auto_create, "auto create adhoc network (default on)");
11920
11921 module_param(led, int, 0444);
11922 MODULE_PARM_DESC(led, "enable led control on some systems (default 0 off)");
11923
11924 module_param(debug, int, 0444);
11925 MODULE_PARM_DESC(debug, "debug output mask");
11926
11927 module_param(channel, int, 0444);
11928 MODULE_PARM_DESC(channel, "channel to limit associate to (default 0 [ANY])");
11929
11930 #ifdef CONFIG_IPW2200_PROMISCUOUS
11931 module_param(rtap_iface, int, 0444);
11932 MODULE_PARM_DESC(rtap_iface, "create the rtap interface (1 - create, default 0)");
11933 #endif
11934
11935 #ifdef CONFIG_IPW2200_QOS
11936 module_param(qos_enable, int, 0444);
11937 MODULE_PARM_DESC(qos_enable, "enable all QoS functionalitis");
11938
11939 module_param(qos_burst_enable, int, 0444);
11940 MODULE_PARM_DESC(qos_burst_enable, "enable QoS burst mode");
11941
11942 module_param(qos_no_ack_mask, int, 0444);
11943 MODULE_PARM_DESC(qos_no_ack_mask, "mask Tx_Queue to no ack");
11944
11945 module_param(burst_duration_CCK, int, 0444);
11946 MODULE_PARM_DESC(burst_duration_CCK, "set CCK burst value");
11947
11948 module_param(burst_duration_OFDM, int, 0444);
11949 MODULE_PARM_DESC(burst_duration_OFDM, "set OFDM burst value");
11950 #endif                          /* CONFIG_IPW2200_QOS */
11951
11952 #ifdef CONFIG_IPW2200_MONITOR
11953 module_param(mode, int, 0444);
11954 MODULE_PARM_DESC(mode, "network mode (0=BSS,1=IBSS,2=Monitor)");
11955 #else
11956 module_param(mode, int, 0444);
11957 MODULE_PARM_DESC(mode, "network mode (0=BSS,1=IBSS)");
11958 #endif
11959
11960 module_param(bt_coexist, int, 0444);
11961 MODULE_PARM_DESC(bt_coexist, "enable bluetooth coexistence (default off)");
11962
11963 module_param(hwcrypto, int, 0444);
11964 MODULE_PARM_DESC(hwcrypto, "enable hardware crypto (default off)");
11965
11966 module_param(cmdlog, int, 0444);
11967 MODULE_PARM_DESC(cmdlog,
11968                  "allocate a ring buffer for logging firmware commands");
11969
11970 module_param(roaming, int, 0444);
11971 MODULE_PARM_DESC(roaming, "enable roaming support (default on)");
11972
11973 module_param(antenna, int, 0444);
11974 MODULE_PARM_DESC(antenna, "select antenna 1=Main, 3=Aux, default 0 [both], 2=slow_diversity (choose the one with lower background noise)");
11975
11976 module_exit(ipw_exit);
11977 module_init(ipw_init);