drivers/net/wireless/intel/ipw2x00/ipw2200.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /******************************************************************************
   3
   4   Copyright(c) 2003 - 2006 Intel Corporation. All rights reserved.
   5
   6   802.11 status code portion of this file from ethereal-0.10.6:
   7     Copyright 2000, Axis Communications AB
   8     Ethereal - Network traffic analyzer
   9     By Gerald Combs <gerald@ethereal.com>
  10     Copyright 1998 Gerald Combs
  11
  12
  13   Contact Information:
  14   Intel Linux Wireless <ilw@linux.intel.com>
  15   Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  16
  17 ******************************************************************************/
  18
  19 #include <linux/sched.h>
  20 #include <linux/slab.h>
  21 #include <net/cfg80211-wext.h>
  22 #include "ipw2200.h"
  23 #include "ipw.h"
  24
  25
  26 #ifndef KBUILD_EXTMOD
  27 #define VK "k"
  28 #else
  29 #define VK
  30 #endif
  31
  32 #ifdef CONFIG_IPW2200_DEBUG
  33 #define VD "d"
  34 #else
  35 #define VD
  36 #endif
  37
  38 #ifdef CONFIG_IPW2200_MONITOR
  39 #define VM "m"
  40 #else
  41 #define VM
  42 #endif
  43
  44 #ifdef CONFIG_IPW2200_PROMISCUOUS
  45 #define VP "p"
  46 #else
  47 #define VP
  48 #endif
  49
  50 #ifdef CONFIG_IPW2200_RADIOTAP
  51 #define VR "r"
  52 #else
  53 #define VR
  54 #endif
  55
  56 #ifdef CONFIG_IPW2200_QOS
  57 #define VQ "q"
  58 #else
  59 #define VQ
  60 #endif
  61
  62 #define IPW2200_VERSION "1.2.2" VK VD VM VP VR VQ
  63 #define DRV_DESCRIPTION "Intel(R) PRO/Wireless 2200/2915 Network Driver"
  64 #define DRV_COPYRIGHT   "Copyright(c) 2003-2006 Intel Corporation"
  65 #define DRV_VERSION     IPW2200_VERSION
  66
  67 #define ETH_P_80211_STATS (ETH_P_80211_RAW + 1)
  68
  69 MODULE_DESCRIPTION(DRV_DESCRIPTION);
  70 MODULE_VERSION(DRV_VERSION);
  71 MODULE_AUTHOR(DRV_COPYRIGHT);
  72 MODULE_LICENSE("GPL");
  73 MODULE_FIRMWARE("ipw2200-ibss.fw");
  74 #ifdef CONFIG_IPW2200_MONITOR
  75 MODULE_FIRMWARE("ipw2200-sniffer.fw");
  76 #endif
  77 MODULE_FIRMWARE("ipw2200-bss.fw");
  78
  79 static int cmdlog = 0;
  80 static int debug = 0;
  81 static int default_channel = 0;
  82 static int network_mode = 0;
  83
  84 static u32 ipw_debug_level;
  85 static int associate;
  86 static int auto_create = 1;
  87 static int led_support = 1;
  88 static int disable = 0;
  89 static int bt_coexist = 0;
  90 static int hwcrypto = 0;
  91 static int roaming = 1;
  92 static const char ipw_modes[] = {
  93         'a', 'b', 'g', '?'
  94 };
  95 static int antenna = CFG_SYS_ANTENNA_BOTH;
  96
  97 #ifdef CONFIG_IPW2200_PROMISCUOUS
  98 static int rtap_iface = 0;     /* def: 0 -- do not create rtap interface */
  99 #endif
 100
 101 static struct ieee80211_rate ipw2200_rates[] = {
 102         { .bitrate = 10 },
 103         { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 104         { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 105         { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 106         { .bitrate = 60 },
 107         { .bitrate = 90 },
 108         { .bitrate = 120 },
 109         { .bitrate = 180 },
 110         { .bitrate = 240 },
 111         { .bitrate = 360 },
 112         { .bitrate = 480 },
 113         { .bitrate = 540 }
 114 };
 115
 116 #define ipw2200_a_rates         (ipw2200_rates + 4)
 117 #define ipw2200_num_a_rates     8
 118 #define ipw2200_bg_rates        (ipw2200_rates + 0)
 119 #define ipw2200_num_bg_rates    12
 120
 121 /* Ugly macro to convert literal channel numbers into their mhz equivalents
 122  * There are certianly some conditions that will break this (like feeding it '30')
 123  * but they shouldn't arise since nothing talks on channel 30. */
 124 #define ieee80211chan2mhz(x) \
 125         (((x) <= 14) ? \
 126         (((x) == 14) ? 2484 : ((x) * 5) + 2407) : \
 127         ((x) + 1000) * 5)
 128
 129 #ifdef CONFIG_IPW2200_QOS
 130 static int qos_enable = 0;
 131 static int qos_burst_enable = 0;
 132 static int qos_no_ack_mask = 0;
 133 static int burst_duration_CCK = 0;
 134 static int burst_duration_OFDM = 0;
 135
 136 static struct libipw_qos_parameters def_qos_parameters_OFDM = {
 137         {QOS_TX0_CW_MIN_OFDM, QOS_TX1_CW_MIN_OFDM, QOS_TX2_CW_MIN_OFDM,
 138          QOS_TX3_CW_MIN_OFDM},
 139         {QOS_TX0_CW_MAX_OFDM, QOS_TX1_CW_MAX_OFDM, QOS_TX2_CW_MAX_OFDM,
 140          QOS_TX3_CW_MAX_OFDM},
 141         {QOS_TX0_AIFS, QOS_TX1_AIFS, QOS_TX2_AIFS, QOS_TX3_AIFS},
 142         {QOS_TX0_ACM, QOS_TX1_ACM, QOS_TX2_ACM, QOS_TX3_ACM},
 143         {QOS_TX0_TXOP_LIMIT_OFDM, QOS_TX1_TXOP_LIMIT_OFDM,
 144          QOS_TX2_TXOP_LIMIT_OFDM, QOS_TX3_TXOP_LIMIT_OFDM}
 145 };
 146
 147 static struct libipw_qos_parameters def_qos_parameters_CCK = {
 148         {QOS_TX0_CW_MIN_CCK, QOS_TX1_CW_MIN_CCK, QOS_TX2_CW_MIN_CCK,
 149          QOS_TX3_CW_MIN_CCK},
 150         {QOS_TX0_CW_MAX_CCK, QOS_TX1_CW_MAX_CCK, QOS_TX2_CW_MAX_CCK,
 151          QOS_TX3_CW_MAX_CCK},
 152         {QOS_TX0_AIFS, QOS_TX1_AIFS, QOS_TX2_AIFS, QOS_TX3_AIFS},
 153         {QOS_TX0_ACM, QOS_TX1_ACM, QOS_TX2_ACM, QOS_TX3_ACM},
 154         {QOS_TX0_TXOP_LIMIT_CCK, QOS_TX1_TXOP_LIMIT_CCK, QOS_TX2_TXOP_LIMIT_CCK,
 155          QOS_TX3_TXOP_LIMIT_CCK}
 156 };
 157
 158 static struct libipw_qos_parameters def_parameters_OFDM = {
 159         {DEF_TX0_CW_MIN_OFDM, DEF_TX1_CW_MIN_OFDM, DEF_TX2_CW_MIN_OFDM,
 160          DEF_TX3_CW_MIN_OFDM},
 161         {DEF_TX0_CW_MAX_OFDM, DEF_TX1_CW_MAX_OFDM, DEF_TX2_CW_MAX_OFDM,
 162          DEF_TX3_CW_MAX_OFDM},
 163         {DEF_TX0_AIFS, DEF_TX1_AIFS, DEF_TX2_AIFS, DEF_TX3_AIFS},
 164         {DEF_TX0_ACM, DEF_TX1_ACM, DEF_TX2_ACM, DEF_TX3_ACM},
 165         {DEF_TX0_TXOP_LIMIT_OFDM, DEF_TX1_TXOP_LIMIT_OFDM,
 166          DEF_TX2_TXOP_LIMIT_OFDM, DEF_TX3_TXOP_LIMIT_OFDM}
 167 };
 168
 169 static struct libipw_qos_parameters def_parameters_CCK = {
 170         {DEF_TX0_CW_MIN_CCK, DEF_TX1_CW_MIN_CCK, DEF_TX2_CW_MIN_CCK,
 171          DEF_TX3_CW_MIN_CCK},
 172         {DEF_TX0_CW_MAX_CCK, DEF_TX1_CW_MAX_CCK, DEF_TX2_CW_MAX_CCK,
 173          DEF_TX3_CW_MAX_CCK},
 174         {DEF_TX0_AIFS, DEF_TX1_AIFS, DEF_TX2_AIFS, DEF_TX3_AIFS},
 175         {DEF_TX0_ACM, DEF_TX1_ACM, DEF_TX2_ACM, DEF_TX3_ACM},
 176         {DEF_TX0_TXOP_LIMIT_CCK, DEF_TX1_TXOP_LIMIT_CCK, DEF_TX2_TXOP_LIMIT_CCK,
 177          DEF_TX3_TXOP_LIMIT_CCK}
 178 };
 179
 180 static u8 qos_oui[QOS_OUI_LEN] = { 0x00, 0x50, 0xF2 };
 181
 182 static int from_priority_to_tx_queue[] = {
 183         IPW_TX_QUEUE_1, IPW_TX_QUEUE_2, IPW_TX_QUEUE_2, IPW_TX_QUEUE_1,
 184         IPW_TX_QUEUE_3, IPW_TX_QUEUE_3, IPW_TX_QUEUE_4, IPW_TX_QUEUE_4
 185 };
 186
 187 static u32 ipw_qos_get_burst_duration(struct ipw_priv *priv);
 188
 189 static int ipw_send_qos_params_command(struct ipw_priv *priv, struct libipw_qos_parameters
 190                                        *qos_param);
 191 static int ipw_send_qos_info_command(struct ipw_priv *priv, struct libipw_qos_information_element
 192                                      *qos_param);
 193 #endif                          /* CONFIG_IPW2200_QOS */
 194
 195 static struct iw_statistics *ipw_get_wireless_stats(struct net_device *dev);
 196 static void ipw_remove_current_network(struct ipw_priv *priv);
 197 static void ipw_rx(struct ipw_priv *priv);
 198 static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
 199                                 struct clx2_tx_queue *txq, int qindex);
 200 static int ipw_queue_reset(struct ipw_priv *priv);
 201
 202 static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
 203                              int len, int sync);
 204
 205 static void ipw_tx_queue_free(struct ipw_priv *);
 206
 207 static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *);
 208 static void ipw_rx_queue_free(struct ipw_priv *, struct ipw_rx_queue *);
 209 static void ipw_rx_queue_replenish(void *);
 210 static int ipw_up(struct ipw_priv *);
 211 static void ipw_bg_up(struct work_struct *work);
 212 static void ipw_down(struct ipw_priv *);
 213 static void ipw_bg_down(struct work_struct *work);
 214 static int ipw_config(struct ipw_priv *);
 215 static int init_supported_rates(struct ipw_priv *priv,
 216                                 struct ipw_supported_rates *prates);
 217 static void ipw_set_hwcrypto_keys(struct ipw_priv *);
 218 static void ipw_send_wep_keys(struct ipw_priv *, int);
 219
 220 static int snprint_line(char *buf, size_t count,
 221                         const u8 * data, u32 len, u32 ofs)
 222 {
 223         int out, i, j, l;
 224         char c;
 225
 226         out = snprintf(buf, count, "%08X", ofs);
 227
 228         for (l = 0, i = 0; i < 2; i++) {
 229                 out += snprintf(buf + out, count - out, " ");
 230                 for (j = 0; j < 8 && l < len; j++, l++)
 231                         out += snprintf(buf + out, count - out, "%02X ",
 232                                         data[(i * 8 + j)]);
 233                 for (; j < 8; j++)
 234                         out += snprintf(buf + out, count - out, "   ");
 235         }
 236
 237         out += snprintf(buf + out, count - out, " ");
 238         for (l = 0, i = 0; i < 2; i++) {
 239                 out += snprintf(buf + out, count - out, " ");
 240                 for (j = 0; j < 8 && l < len; j++, l++) {
 241                         c = data[(i * 8 + j)];
 242                         if (!isascii(c) || !isprint(c))
 243                                 c = '.';
 244
 245                         out += snprintf(buf + out, count - out, "%c", c);
 246                 }
 247
 248                 for (; j < 8; j++)
 249                         out += snprintf(buf + out, count - out, " ");
 250         }
 251
 252         return out;
 253 }
 254
 255 static void printk_buf(int level, const u8 * data, u32 len)
 256 {
 257         char line[81];
 258         u32 ofs = 0;
 259         if (!(ipw_debug_level & level))
 260                 return;
 261
 262         while (len) {
 263                 snprint_line(line, sizeof(line), &data[ofs],
 264                              min(len, 16U), ofs);
 265                 printk(KERN_DEBUG "%s\n", line);
 266                 ofs += 16;
 267                 len -= min(len, 16U);
 268         }
 269 }
 270
 271 static int snprintk_buf(u8 * output, size_t size, const u8 * data, size_t len)
 272 {
 273         size_t out = size;
 274         u32 ofs = 0;
 275         int total = 0;
 276
 277         while (size && len) {
 278                 out = snprint_line(output, size, &data[ofs],
 279                                    min_t(size_t, len, 16U), ofs);
 280
 281                 ofs += 16;
 282                 output += out;
 283                 size -= out;
 284                 len -= min_t(size_t, len, 16U);
 285                 total += out;
 286         }
 287         return total;
 288 }
 289
 290 /* alias for 32-bit indirect read (for SRAM/reg above 4K), with debug wrapper */
 291 static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg);
 292 #define ipw_read_reg32(a, b) _ipw_read_reg32(a, b)
 293
 294 /* alias for 8-bit indirect read (for SRAM/reg above 4K), with debug wrapper */
 295 static u8 _ipw_read_reg8(struct ipw_priv *ipw, u32 reg);
 296 #define ipw_read_reg8(a, b) _ipw_read_reg8(a, b)
 297
 298 /* 8-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
 299 static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value);
 300 static inline void ipw_write_reg8(struct ipw_priv *a, u32 b, u8 c)
 301 {
 302         IPW_DEBUG_IO("%s %d: write_indirect8(0x%08X, 0x%08X)\n", __FILE__,
 303                      __LINE__, (u32) (b), (u32) (c));
 304         _ipw_write_reg8(a, b, c);
 305 }
 306
 307 /* 16-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
 308 static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value);
 309 static inline void ipw_write_reg16(struct ipw_priv *a, u32 b, u16 c)
 310 {
 311         IPW_DEBUG_IO("%s %d: write_indirect16(0x%08X, 0x%08X)\n", __FILE__,
 312                      __LINE__, (u32) (b), (u32) (c));
 313         _ipw_write_reg16(a, b, c);
 314 }
 315
 316 /* 32-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
 317 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value);
 318 static inline void ipw_write_reg32(struct ipw_priv *a, u32 b, u32 c)
 319 {
 320         IPW_DEBUG_IO("%s %d: write_indirect32(0x%08X, 0x%08X)\n", __FILE__,
 321                      __LINE__, (u32) (b), (u32) (c));
 322         _ipw_write_reg32(a, b, c);
 323 }
 324
 325 /* 8-bit direct write (low 4K) */
 326 static inline void _ipw_write8(struct ipw_priv *ipw, unsigned long ofs,
 327                 u8 val)
 328 {
 329         writeb(val, ipw->hw_base + ofs);
 330 }
 331
 332 /* 8-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 333 #define ipw_write8(ipw, ofs, val) do { \
 334         IPW_DEBUG_IO("%s %d: write_direct8(0x%08X, 0x%08X)\n", __FILE__, \
 335                         __LINE__, (u32)(ofs), (u32)(val)); \
 336         _ipw_write8(ipw, ofs, val); \
 337 } while (0)
 338
 339 /* 16-bit direct write (low 4K) */
 340 static inline void _ipw_write16(struct ipw_priv *ipw, unsigned long ofs,
 341                 u16 val)
 342 {
 343         writew(val, ipw->hw_base + ofs);
 344 }
 345
 346 /* 16-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 347 #define ipw_write16(ipw, ofs, val) do { \
 348         IPW_DEBUG_IO("%s %d: write_direct16(0x%08X, 0x%08X)\n", __FILE__, \
 349                         __LINE__, (u32)(ofs), (u32)(val)); \
 350         _ipw_write16(ipw, ofs, val); \
 351 } while (0)
 352
 353 /* 32-bit direct write (low 4K) */
 354 static inline void _ipw_write32(struct ipw_priv *ipw, unsigned long ofs,
 355                 u32 val)
 356 {
 357         writel(val, ipw->hw_base + ofs);
 358 }
 359
 360 /* 32-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 361 #define ipw_write32(ipw, ofs, val) do { \
 362         IPW_DEBUG_IO("%s %d: write_direct32(0x%08X, 0x%08X)\n", __FILE__, \
 363                         __LINE__, (u32)(ofs), (u32)(val)); \
 364         _ipw_write32(ipw, ofs, val); \
 365 } while (0)
 366
 367 /* 8-bit direct read (low 4K) */
 368 static inline u8 _ipw_read8(struct ipw_priv *ipw, unsigned long ofs)
 369 {
 370         return readb(ipw->hw_base + ofs);
 371 }
 372
 373 /* alias to 8-bit direct read (low 4K of SRAM/regs), with debug wrapper */
 374 #define ipw_read8(ipw, ofs) ({ \
 375         IPW_DEBUG_IO("%s %d: read_direct8(0x%08X)\n", __FILE__, __LINE__, \
 376                         (u32)(ofs)); \
 377         _ipw_read8(ipw, ofs); \
 378 })
 379
 380 /* 16-bit direct read (low 4K) */
 381 static inline u16 _ipw_read16(struct ipw_priv *ipw, unsigned long ofs)
 382 {
 383         return readw(ipw->hw_base + ofs);
 384 }
 385
 386 /* alias to 16-bit direct read (low 4K of SRAM/regs), with debug wrapper */
 387 #define ipw_read16(ipw, ofs) ({ \
 388         IPW_DEBUG_IO("%s %d: read_direct16(0x%08X)\n", __FILE__, __LINE__, \
 389                         (u32)(ofs)); \
 390         _ipw_read16(ipw, ofs); \
 391 })
 392
 393 /* 32-bit direct read (low 4K) */
 394 static inline u32 _ipw_read32(struct ipw_priv *ipw, unsigned long ofs)
 395 {
 396         return readl(ipw->hw_base + ofs);
 397 }
 398
 399 /* alias to 32-bit direct read (low 4K of SRAM/regs), with debug wrapper */
 400 #define ipw_read32(ipw, ofs) ({ \
 401         IPW_DEBUG_IO("%s %d: read_direct32(0x%08X)\n", __FILE__, __LINE__, \
 402                         (u32)(ofs)); \
 403         _ipw_read32(ipw, ofs); \
 404 })
 405
 406 static void _ipw_read_indirect(struct ipw_priv *, u32, u8 *, int);
 407 /* alias to multi-byte read (SRAM/regs above 4K), with debug wrapper */
 408 #define ipw_read_indirect(a, b, c, d) ({ \
 409         IPW_DEBUG_IO("%s %d: read_indirect(0x%08X) %u bytes\n", __FILE__, \
 410                         __LINE__, (u32)(b), (u32)(d)); \
 411         _ipw_read_indirect(a, b, c, d); \
 412 })
 413
 414 /* alias to multi-byte read (SRAM/regs above 4K), with debug wrapper */
 415 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * data,
 416                                 int num);
 417 #define ipw_write_indirect(a, b, c, d) do { \
 418         IPW_DEBUG_IO("%s %d: write_indirect(0x%08X) %u bytes\n", __FILE__, \
 419                         __LINE__, (u32)(b), (u32)(d)); \
 420         _ipw_write_indirect(a, b, c, d); \
 421 } while (0)
 422
 423 /* 32-bit indirect write (above 4K) */
 424 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value)
 425 {
 426         IPW_DEBUG_IO(" %p : reg = 0x%8X : value = 0x%8X\n", priv, reg, value);
 427         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
 428         _ipw_write32(priv, IPW_INDIRECT_DATA, value);
 429 }
 430
 431 /* 8-bit indirect write (above 4K) */
 432 static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value)
 433 {
 434         u32 aligned_addr = reg & IPW_INDIRECT_ADDR_MASK;        /* dword align */
 435         u32 dif_len = reg - aligned_addr;
 436
 437         IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
 438         _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 439         _ipw_write8(priv, IPW_INDIRECT_DATA + dif_len, value);
 440 }
 441
 442 /* 16-bit indirect write (above 4K) */
 443 static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value)
 444 {
 445         u32 aligned_addr = reg & IPW_INDIRECT_ADDR_MASK;        /* dword align */
 446         u32 dif_len = (reg - aligned_addr) & (~0x1ul);
 447
 448         IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
 449         _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 450         _ipw_write16(priv, IPW_INDIRECT_DATA + dif_len, value);
 451 }
 452
 453 /* 8-bit indirect read (above 4K) */
 454 static u8 _ipw_read_reg8(struct ipw_priv *priv, u32 reg)
 455 {
 456         u32 word;
 457         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg & IPW_INDIRECT_ADDR_MASK);
 458         IPW_DEBUG_IO(" reg = 0x%8X :\n", reg);
 459         word = _ipw_read32(priv, IPW_INDIRECT_DATA);
 460         return (word >> ((reg & 0x3) * 8)) & 0xff;
 461 }
 462
 463 /* 32-bit indirect read (above 4K) */
 464 static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg)
 465 {
 466         u32 value;
 467
 468         IPW_DEBUG_IO("%p : reg = 0x%08x\n", priv, reg);
 469
 470         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
 471         value = _ipw_read32(priv, IPW_INDIRECT_DATA);
 472         IPW_DEBUG_IO(" reg = 0x%4X : value = 0x%4x\n", reg, value);
 473         return value;
 474 }
 475
 476 /* General purpose, no alignment requirement, iterative (multi-byte) read, */
 477 /*    for area above 1st 4K of SRAM/reg space */
 478 static void _ipw_read_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
 479                                int num)
 480 {
 481         u32 aligned_addr = addr & IPW_INDIRECT_ADDR_MASK;       /* dword align */
 482         u32 dif_len = addr - aligned_addr;
 483         u32 i;
 484
 485         IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
 486
 487         if (num <= 0) {
 488                 return;
 489         }
 490
 491         /* Read the first dword (or portion) byte by byte */
 492         if (unlikely(dif_len)) {
 493                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 494                 /* Start reading at aligned_addr + dif_len */
 495                 for (i = dif_len; ((i < 4) && (num > 0)); i++, num--)
 496                         *buf++ = _ipw_read8(priv, IPW_INDIRECT_DATA + i);
 497                 aligned_addr += 4;
 498         }
 499
 500         /* Read all of the middle dwords as dwords, with auto-increment */
 501         _ipw_write32(priv, IPW_AUTOINC_ADDR, aligned_addr);
 502         for (; num >= 4; buf += 4, aligned_addr += 4, num -= 4)
 503                 *(u32 *) buf = _ipw_read32(priv, IPW_AUTOINC_DATA);
 504
 505         /* Read the last dword (or portion) byte by byte */
 506         if (unlikely(num)) {
 507                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 508                 for (i = 0; num > 0; i++, num--)
 509                         *buf++ = ipw_read8(priv, IPW_INDIRECT_DATA + i);
 510         }
 511 }
 512
 513 /* General purpose, no alignment requirement, iterative (multi-byte) write, */
 514 /*    for area above 1st 4K of SRAM/reg space */
 515 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
 516                                 int num)
 517 {
 518         u32 aligned_addr = addr & IPW_INDIRECT_ADDR_MASK;       /* dword align */
 519         u32 dif_len = addr - aligned_addr;
 520         u32 i;
 521
 522         IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
 523
 524         if (num <= 0) {
 525                 return;
 526         }
 527
 528         /* Write the first dword (or portion) byte by byte */
 529         if (unlikely(dif_len)) {
 530                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 531                 /* Start writing at aligned_addr + dif_len */
 532                 for (i = dif_len; ((i < 4) && (num > 0)); i++, num--, buf++)
 533                         _ipw_write8(priv, IPW_INDIRECT_DATA + i, *buf);
 534                 aligned_addr += 4;
 535         }
 536
 537         /* Write all of the middle dwords as dwords, with auto-increment */
 538         _ipw_write32(priv, IPW_AUTOINC_ADDR, aligned_addr);
 539         for (; num >= 4; buf += 4, aligned_addr += 4, num -= 4)
 540                 _ipw_write32(priv, IPW_AUTOINC_DATA, *(u32 *) buf);
 541
 542         /* Write the last dword (or portion) byte by byte */
 543         if (unlikely(num)) {
 544                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 545                 for (i = 0; num > 0; i++, num--, buf++)
 546                         _ipw_write8(priv, IPW_INDIRECT_DATA + i, *buf);
 547         }
 548 }
 549
 550 /* General purpose, no alignment requirement, iterative (multi-byte) write, */
 551 /*    for 1st 4K of SRAM/regs space */
 552 static void ipw_write_direct(struct ipw_priv *priv, u32 addr, void *buf,
 553                              int num)
 554 {
 555         memcpy_toio((priv->hw_base + addr), buf, num);
 556 }
 557
 558 /* Set bit(s) in low 4K of SRAM/regs */
 559 static inline void ipw_set_bit(struct ipw_priv *priv, u32 reg, u32 mask)
 560 {
 561         ipw_write32(priv, reg, ipw_read32(priv, reg) | mask);
 562 }
 563
 564 /* Clear bit(s) in low 4K of SRAM/regs */
 565 static inline void ipw_clear_bit(struct ipw_priv *priv, u32 reg, u32 mask)
 566 {
 567         ipw_write32(priv, reg, ipw_read32(priv, reg) & ~mask);
 568 }
 569
 570 static inline void __ipw_enable_interrupts(struct ipw_priv *priv)
 571 {
 572         if (priv->status & STATUS_INT_ENABLED)
 573                 return;
 574         priv->status |= STATUS_INT_ENABLED;
 575         ipw_write32(priv, IPW_INTA_MASK_R, IPW_INTA_MASK_ALL);
 576 }
 577
 578 static inline void __ipw_disable_interrupts(struct ipw_priv *priv)
 579 {
 580         if (!(priv->status & STATUS_INT_ENABLED))
 581                 return;
 582         priv->status &= ~STATUS_INT_ENABLED;
 583         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
 584 }
 585
 586 static inline void ipw_enable_interrupts(struct ipw_priv *priv)
 587 {
 588         unsigned long flags;
 589
 590         spin_lock_irqsave(&priv->irq_lock, flags);
 591         __ipw_enable_interrupts(priv);
 592         spin_unlock_irqrestore(&priv->irq_lock, flags);
 593 }
 594
 595 static inline void ipw_disable_interrupts(struct ipw_priv *priv)
 596 {
 597         unsigned long flags;
 598
 599         spin_lock_irqsave(&priv->irq_lock, flags);
 600         __ipw_disable_interrupts(priv);
 601         spin_unlock_irqrestore(&priv->irq_lock, flags);
 602 }
 603
 604 static char *ipw_error_desc(u32 val)
 605 {
 606         switch (val) {
 607         case IPW_FW_ERROR_OK:
 608                 return "ERROR_OK";
 609         case IPW_FW_ERROR_FAIL:
 610                 return "ERROR_FAIL";
 611         case IPW_FW_ERROR_MEMORY_UNDERFLOW:
 612                 return "MEMORY_UNDERFLOW";
 613         case IPW_FW_ERROR_MEMORY_OVERFLOW:
 614                 return "MEMORY_OVERFLOW";
 615         case IPW_FW_ERROR_BAD_PARAM:
 616                 return "BAD_PARAM";
 617         case IPW_FW_ERROR_BAD_CHECKSUM:
 618                 return "BAD_CHECKSUM";
 619         case IPW_FW_ERROR_NMI_INTERRUPT:
 620                 return "NMI_INTERRUPT";
 621         case IPW_FW_ERROR_BAD_DATABASE:
 622                 return "BAD_DATABASE";
 623         case IPW_FW_ERROR_ALLOC_FAIL:
 624                 return "ALLOC_FAIL";
 625         case IPW_FW_ERROR_DMA_UNDERRUN:
 626                 return "DMA_UNDERRUN";
 627         case IPW_FW_ERROR_DMA_STATUS:
 628                 return "DMA_STATUS";
 629         case IPW_FW_ERROR_DINO_ERROR:
 630                 return "DINO_ERROR";
 631         case IPW_FW_ERROR_EEPROM_ERROR:
 632                 return "EEPROM_ERROR";
 633         case IPW_FW_ERROR_SYSASSERT:
 634                 return "SYSASSERT";
 635         case IPW_FW_ERROR_FATAL_ERROR:
 636                 return "FATAL_ERROR";
 637         default:
 638                 return "UNKNOWN_ERROR";
 639         }
 640 }
 641
 642 static void ipw_dump_error_log(struct ipw_priv *priv,
 643                                struct ipw_fw_error *error)
 644 {
 645         u32 i;
 646
 647         if (!error) {
 648                 IPW_ERROR("Error allocating and capturing error log.  "
 649                           "Nothing to dump.\n");
 650                 return;
 651         }
 652
 653         IPW_ERROR("Start IPW Error Log Dump:\n");
 654         IPW_ERROR("Status: 0x%08X, Config: %08X\n",
 655                   error->status, error->config);
 656
 657         for (i = 0; i < error->elem_len; i++)
 658                 IPW_ERROR("%s %i 0x%08x  0x%08x  0x%08x  0x%08x  0x%08x\n",
 659                           ipw_error_desc(error->elem[i].desc),
 660                           error->elem[i].time,
 661                           error->elem[i].blink1,
 662                           error->elem[i].blink2,
 663                           error->elem[i].link1,
 664                           error->elem[i].link2, error->elem[i].data);
 665         for (i = 0; i < error->log_len; i++)
 666                 IPW_ERROR("%i\t0x%08x\t%i\n",
 667                           error->log[i].time,
 668                           error->log[i].data, error->log[i].event);
 669 }
 670
 671 static inline int ipw_is_init(struct ipw_priv *priv)
 672 {
 673         return (priv->status & STATUS_INIT) ? 1 : 0;
 674 }
 675
 676 static int ipw_get_ordinal(struct ipw_priv *priv, u32 ord, void *val, u32 * len)
 677 {
 678         u32 addr, field_info, field_len, field_count, total_len;
 679
 680         IPW_DEBUG_ORD("ordinal = %i\n", ord);
 681
 682         if (!priv || !val || !len) {
 683                 IPW_DEBUG_ORD("Invalid argument\n");
 684                 return -EINVAL;
 685         }
 686
 687         /* verify device ordinal tables have been initialized */
 688         if (!priv->table0_addr || !priv->table1_addr || !priv->table2_addr) {
 689                 IPW_DEBUG_ORD("Access ordinals before initialization\n");
 690                 return -EINVAL;
 691         }
 692
 693         switch (IPW_ORD_TABLE_ID_MASK & ord) {
 694         case IPW_ORD_TABLE_0_MASK:
 695                 /*
 696                  * TABLE 0: Direct access to a table of 32 bit values
 697                  *
 698                  * This is a very simple table with the data directly
 699                  * read from the table
 700                  */
 701
 702                 /* remove the table id from the ordinal */
 703                 ord &= IPW_ORD_TABLE_VALUE_MASK;
 704
 705                 /* boundary check */
 706                 if (ord > priv->table0_len) {
 707                         IPW_DEBUG_ORD("ordinal value (%i) longer then "
 708                                       "max (%i)\n", ord, priv->table0_len);
 709                         return -EINVAL;
 710                 }
 711
 712                 /* verify we have enough room to store the value */
 713                 if (*len < sizeof(u32)) {
 714                         IPW_DEBUG_ORD("ordinal buffer length too small, "
 715                                       "need %zd\n", sizeof(u32));
 716                         return -EINVAL;
 717                 }
 718
 719                 IPW_DEBUG_ORD("Reading TABLE0[%i] from offset 0x%08x\n",
 720                               ord, priv->table0_addr + (ord << 2));
 721
 722                 *len = sizeof(u32);
 723                 ord <<= 2;
 724                 *((u32 *) val) = ipw_read32(priv, priv->table0_addr + ord);
 725                 break;
 726
 727         case IPW_ORD_TABLE_1_MASK:
 728                 /*
 729                  * TABLE 1: Indirect access to a table of 32 bit values
 730                  *
 731                  * This is a fairly large table of u32 values each
 732                  * representing starting addr for the data (which is
 733                  * also a u32)
 734                  */
 735
 736                 /* remove the table id from the ordinal */
 737                 ord &= IPW_ORD_TABLE_VALUE_MASK;
 738
 739                 /* boundary check */
 740                 if (ord > priv->table1_len) {
 741                         IPW_DEBUG_ORD("ordinal value too long\n");
 742                         return -EINVAL;
 743                 }
 744
 745                 /* verify we have enough room to store the value */
 746                 if (*len < sizeof(u32)) {
 747                         IPW_DEBUG_ORD("ordinal buffer length too small, "
 748                                       "need %zd\n", sizeof(u32));
 749                         return -EINVAL;
 750                 }
 751
 752                 *((u32 *) val) =
 753                     ipw_read_reg32(priv, (priv->table1_addr + (ord << 2)));
 754                 *len = sizeof(u32);
 755                 break;
 756
 757         case IPW_ORD_TABLE_2_MASK:
 758                 /*
 759                  * TABLE 2: Indirect access to a table of variable sized values
 760                  *
 761                  * This table consist of six values, each containing
 762                  *     - dword containing the starting offset of the data
 763                  *     - dword containing the lengh in the first 16bits
 764                  *       and the count in the second 16bits
 765                  */
 766
 767                 /* remove the table id from the ordinal */
 768                 ord &= IPW_ORD_TABLE_VALUE_MASK;
 769
 770                 /* boundary check */
 771                 if (ord > priv->table2_len) {
 772                         IPW_DEBUG_ORD("ordinal value too long\n");
 773                         return -EINVAL;
 774                 }
 775
 776                 /* get the address of statistic */
 777                 addr = ipw_read_reg32(priv, priv->table2_addr + (ord << 3));
 778
 779                 /* get the second DW of statistics ;
 780                  * two 16-bit words - first is length, second is count */
 781                 field_info =
 782                     ipw_read_reg32(priv,
 783                                    priv->table2_addr + (ord << 3) +
 784                                    sizeof(u32));
 785
 786                 /* get each entry length */
 787                 field_len = *((u16 *) & field_info);
 788
 789                 /* get number of entries */
 790                 field_count = *(((u16 *) & field_info) + 1);
 791
 792                 /* abort if not enough memory */
 793                 total_len = field_len * field_count;
 794                 if (total_len > *len) {
 795                         *len = total_len;
 796                         return -EINVAL;
 797                 }
 798
 799                 *len = total_len;
 800                 if (!total_len)
 801                         return 0;
 802
 803                 IPW_DEBUG_ORD("addr = 0x%08x, total_len = %i, "
 804                               "field_info = 0x%08x\n",
 805                               addr, total_len, field_info);
 806                 ipw_read_indirect(priv, addr, val, total_len);
 807                 break;
 808
 809         default:
 810                 IPW_DEBUG_ORD("Invalid ordinal!\n");
 811                 return -EINVAL;
 812
 813         }
 814
 815         return 0;
 816 }
 817
 818 static void ipw_init_ordinals(struct ipw_priv *priv)
 819 {
 820         priv->table0_addr = IPW_ORDINALS_TABLE_LOWER;
 821         priv->table0_len = ipw_read32(priv, priv->table0_addr);
 822
 823         IPW_DEBUG_ORD("table 0 offset at 0x%08x, len = %i\n",
 824                       priv->table0_addr, priv->table0_len);
 825
 826         priv->table1_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_1);
 827         priv->table1_len = ipw_read_reg32(priv, priv->table1_addr);
 828
 829         IPW_DEBUG_ORD("table 1 offset at 0x%08x, len = %i\n",
 830                       priv->table1_addr, priv->table1_len);
 831
 832         priv->table2_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_2);
 833         priv->table2_len = ipw_read_reg32(priv, priv->table2_addr);
 834         priv->table2_len &= 0x0000ffff; /* use first two bytes */
 835
 836         IPW_DEBUG_ORD("table 2 offset at 0x%08x, len = %i\n",
 837                       priv->table2_addr, priv->table2_len);
 838
 839 }
 840
 841 static u32 ipw_register_toggle(u32 reg)
 842 {
 843         reg &= ~IPW_START_STANDBY;
 844         if (reg & IPW_GATE_ODMA)
 845                 reg &= ~IPW_GATE_ODMA;
 846         if (reg & IPW_GATE_IDMA)
 847                 reg &= ~IPW_GATE_IDMA;
 848         if (reg & IPW_GATE_ADMA)
 849                 reg &= ~IPW_GATE_ADMA;
 850         return reg;
 851 }
 852
 853 /*
 854  * LED behavior:
 855  * - On radio ON, turn on any LEDs that require to be on during start
 856  * - On initialization, start unassociated blink
 857  * - On association, disable unassociated blink
 858  * - On disassociation, start unassociated blink
 859  * - On radio OFF, turn off any LEDs started during radio on
 860  *
 861  */
 862 #define LD_TIME_LINK_ON msecs_to_jiffies(300)
 863 #define LD_TIME_LINK_OFF msecs_to_jiffies(2700)
 864 #define LD_TIME_ACT_ON msecs_to_jiffies(250)
 865
 866 static void ipw_led_link_on(struct ipw_priv *priv)
 867 {
 868         unsigned long flags;
 869         u32 led;
 870
 871         /* If configured to not use LEDs, or nic_type is 1,
 872          * then we don't toggle a LINK led */
 873         if (priv->config & CFG_NO_LED || priv->nic_type == EEPROM_NIC_TYPE_1)
 874                 return;
 875
 876         spin_lock_irqsave(&priv->lock, flags);
 877
 878         if (!(priv->status & STATUS_RF_KILL_MASK) &&
 879             !(priv->status & STATUS_LED_LINK_ON)) {
 880                 IPW_DEBUG_LED("Link LED On\n");
 881                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 882                 led |= priv->led_association_on;
 883
 884                 led = ipw_register_toggle(led);
 885
 886                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 887                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 888
 889                 priv->status |= STATUS_LED_LINK_ON;
 890
 891                 /* If we aren't associated, schedule turning the LED off */
 892                 if (!(priv->status & STATUS_ASSOCIATED))
 893                         schedule_delayed_work(&priv->led_link_off,
 894                                               LD_TIME_LINK_ON);
 895         }
 896
 897         spin_unlock_irqrestore(&priv->lock, flags);
 898 }
 899
 900 static void ipw_bg_led_link_on(struct work_struct *work)
 901 {
 902         struct ipw_priv *priv =
 903                 container_of(work, struct ipw_priv, led_link_on.work);
 904         mutex_lock(&priv->mutex);
 905         ipw_led_link_on(priv);
 906         mutex_unlock(&priv->mutex);
 907 }
 908
 909 static void ipw_led_link_off(struct ipw_priv *priv)
 910 {
 911         unsigned long flags;
 912         u32 led;
 913
 914         /* If configured not to use LEDs, or nic type is 1,
 915          * then we don't goggle the LINK led. */
 916         if (priv->config & CFG_NO_LED || priv->nic_type == EEPROM_NIC_TYPE_1)
 917                 return;
 918
 919         spin_lock_irqsave(&priv->lock, flags);
 920
 921         if (priv->status & STATUS_LED_LINK_ON) {
 922                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 923                 led &= priv->led_association_off;
 924                 led = ipw_register_toggle(led);
 925
 926                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 927                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 928
 929                 IPW_DEBUG_LED("Link LED Off\n");
 930
 931                 priv->status &= ~STATUS_LED_LINK_ON;
 932
 933                 /* If we aren't associated and the radio is on, schedule
 934                  * turning the LED on (blink while unassociated) */
 935                 if (!(priv->status & STATUS_RF_KILL_MASK) &&
 936                     !(priv->status & STATUS_ASSOCIATED))
 937                         schedule_delayed_work(&priv->led_link_on,
 938                                               LD_TIME_LINK_OFF);
 939
 940         }
 941
 942         spin_unlock_irqrestore(&priv->lock, flags);
 943 }
 944
 945 static void ipw_bg_led_link_off(struct work_struct *work)
 946 {
 947         struct ipw_priv *priv =
 948                 container_of(work, struct ipw_priv, led_link_off.work);
 949         mutex_lock(&priv->mutex);
 950         ipw_led_link_off(priv);
 951         mutex_unlock(&priv->mutex);
 952 }
 953
 954 static void __ipw_led_activity_on(struct ipw_priv *priv)
 955 {
 956         u32 led;
 957
 958         if (priv->config & CFG_NO_LED)
 959                 return;
 960
 961         if (priv->status & STATUS_RF_KILL_MASK)
 962                 return;
 963
 964         if (!(priv->status & STATUS_LED_ACT_ON)) {
 965                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 966                 led |= priv->led_activity_on;
 967
 968                 led = ipw_register_toggle(led);
 969
 970                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 971                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 972
 973                 IPW_DEBUG_LED("Activity LED On\n");
 974
 975                 priv->status |= STATUS_LED_ACT_ON;
 976
 977                 cancel_delayed_work(&priv->led_act_off);
 978                 schedule_delayed_work(&priv->led_act_off, LD_TIME_ACT_ON);
 979         } else {
 980                 /* Reschedule LED off for full time period */
 981                 cancel_delayed_work(&priv->led_act_off);
 982                 schedule_delayed_work(&priv->led_act_off, LD_TIME_ACT_ON);
 983         }
 984 }
 985
 986 #if 0
 987 void ipw_led_activity_on(struct ipw_priv *priv)
 988 {
 989         unsigned long flags;
 990         spin_lock_irqsave(&priv->lock, flags);
 991         __ipw_led_activity_on(priv);
 992         spin_unlock_irqrestore(&priv->lock, flags);
 993 }
 994 #endif  /*  0  */
 995
 996 static void ipw_led_activity_off(struct ipw_priv *priv)
 997 {
 998         unsigned long flags;
 999         u32 led;
1000
1001         if (priv->config & CFG_NO_LED)
1002                 return;
1003
1004         spin_lock_irqsave(&priv->lock, flags);
1005
1006         if (priv->status & STATUS_LED_ACT_ON) {
1007                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
1008                 led &= priv->led_activity_off;
1009
1010                 led = ipw_register_toggle(led);
1011
1012                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
1013                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
1014
1015                 IPW_DEBUG_LED("Activity LED Off\n");
1016
1017                 priv->status &= ~STATUS_LED_ACT_ON;
1018         }
1019
1020         spin_unlock_irqrestore(&priv->lock, flags);
1021 }
1022
1023 static void ipw_bg_led_activity_off(struct work_struct *work)
1024 {
1025         struct ipw_priv *priv =
1026                 container_of(work, struct ipw_priv, led_act_off.work);
1027         mutex_lock(&priv->mutex);
1028         ipw_led_activity_off(priv);
1029         mutex_unlock(&priv->mutex);
1030 }
1031
1032 static void ipw_led_band_on(struct ipw_priv *priv)
1033 {
1034         unsigned long flags;
1035         u32 led;
1036
1037         /* Only nic type 1 supports mode LEDs */
1038         if (priv->config & CFG_NO_LED ||
1039             priv->nic_type != EEPROM_NIC_TYPE_1 || !priv->assoc_network)
1040                 return;
1041
1042         spin_lock_irqsave(&priv->lock, flags);
1043
1044         led = ipw_read_reg32(priv, IPW_EVENT_REG);
1045         if (priv->assoc_network->mode == IEEE_A) {
1046                 led |= priv->led_ofdm_on;
1047                 led &= priv->led_association_off;
1048                 IPW_DEBUG_LED("Mode LED On: 802.11a\n");
1049         } else if (priv->assoc_network->mode == IEEE_G) {
1050                 led |= priv->led_ofdm_on;
1051                 led |= priv->led_association_on;
1052                 IPW_DEBUG_LED("Mode LED On: 802.11g\n");
1053         } else {
1054                 led &= priv->led_ofdm_off;
1055                 led |= priv->led_association_on;
1056                 IPW_DEBUG_LED("Mode LED On: 802.11b\n");
1057         }
1058
1059         led = ipw_register_toggle(led);
1060
1061         IPW_DEBUG_LED("Reg: 0x%08X\n", led);
1062         ipw_write_reg32(priv, IPW_EVENT_REG, led);
1063
1064         spin_unlock_irqrestore(&priv->lock, flags);
1065 }
1066
1067 static void ipw_led_band_off(struct ipw_priv *priv)
1068 {
1069         unsigned long flags;
1070         u32 led;
1071
1072         /* Only nic type 1 supports mode LEDs */
1073         if (priv->config & CFG_NO_LED || priv->nic_type != EEPROM_NIC_TYPE_1)
1074                 return;
1075
1076         spin_lock_irqsave(&priv->lock, flags);
1077
1078         led = ipw_read_reg32(priv, IPW_EVENT_REG);
1079         led &= priv->led_ofdm_off;
1080         led &= priv->led_association_off;
1081
1082         led = ipw_register_toggle(led);
1083
1084         IPW_DEBUG_LED("Reg: 0x%08X\n", led);
1085         ipw_write_reg32(priv, IPW_EVENT_REG, led);
1086
1087         spin_unlock_irqrestore(&priv->lock, flags);
1088 }
1089
1090 static void ipw_led_radio_on(struct ipw_priv *priv)
1091 {
1092         ipw_led_link_on(priv);
1093 }
1094
1095 static void ipw_led_radio_off(struct ipw_priv *priv)
1096 {
1097         ipw_led_activity_off(priv);
1098         ipw_led_link_off(priv);
1099 }
1100
1101 static void ipw_led_link_up(struct ipw_priv *priv)
1102 {
1103         /* Set the Link Led on for all nic types */
1104         ipw_led_link_on(priv);
1105 }
1106
1107 static void ipw_led_link_down(struct ipw_priv *priv)
1108 {
1109         ipw_led_activity_off(priv);
1110         ipw_led_link_off(priv);
1111
1112         if (priv->status & STATUS_RF_KILL_MASK)
1113                 ipw_led_radio_off(priv);
1114 }
1115
1116 static void ipw_led_init(struct ipw_priv *priv)
1117 {
1118         priv->nic_type = priv->eeprom[EEPROM_NIC_TYPE];
1119
1120         /* Set the default PINs for the link and activity leds */
1121         priv->led_activity_on = IPW_ACTIVITY_LED;
1122         priv->led_activity_off = ~(IPW_ACTIVITY_LED);
1123
1124         priv->led_association_on = IPW_ASSOCIATED_LED;
1125         priv->led_association_off = ~(IPW_ASSOCIATED_LED);
1126
1127         /* Set the default PINs for the OFDM leds */
1128         priv->led_ofdm_on = IPW_OFDM_LED;
1129         priv->led_ofdm_off = ~(IPW_OFDM_LED);
1130
1131         switch (priv->nic_type) {
1132         case EEPROM_NIC_TYPE_1:
1133                 /* In this NIC type, the LEDs are reversed.... */
1134                 priv->led_activity_on = IPW_ASSOCIATED_LED;
1135                 priv->led_activity_off = ~(IPW_ASSOCIATED_LED);
1136                 priv->led_association_on = IPW_ACTIVITY_LED;
1137                 priv->led_association_off = ~(IPW_ACTIVITY_LED);
1138
1139                 if (!(priv->config & CFG_NO_LED))
1140                         ipw_led_band_on(priv);
1141
1142                 /* And we don't blink link LEDs for this nic, so
1143                  * just return here */
1144                 return;
1145
1146         case EEPROM_NIC_TYPE_3:
1147         case EEPROM_NIC_TYPE_2:
1148         case EEPROM_NIC_TYPE_4:
1149         case EEPROM_NIC_TYPE_0:
1150                 break;
1151
1152         default:
1153                 IPW_DEBUG_INFO("Unknown NIC type from EEPROM: %d\n",
1154                                priv->nic_type);
1155                 priv->nic_type = EEPROM_NIC_TYPE_0;
1156                 break;
1157         }
1158
1159         if (!(priv->config & CFG_NO_LED)) {
1160                 if (priv->status & STATUS_ASSOCIATED)
1161                         ipw_led_link_on(priv);
1162                 else
1163                         ipw_led_link_off(priv);
1164         }
1165 }
1166
1167 static void ipw_led_shutdown(struct ipw_priv *priv)
1168 {
1169         ipw_led_activity_off(priv);
1170         ipw_led_link_off(priv);
1171         ipw_led_band_off(priv);
1172         cancel_delayed_work(&priv->led_link_on);
1173         cancel_delayed_work(&priv->led_link_off);
1174         cancel_delayed_work(&priv->led_act_off);
1175 }
1176
1177 /*
1178  * The following adds a new attribute to the sysfs representation
1179  * of this device driver (i.e. a new file in /sys/bus/pci/drivers/ipw/)
1180  * used for controlling the debug level.
1181  *
1182  * See the level definitions in ipw for details.
1183  */
1184 static ssize_t debug_level_show(struct device_driver *d, char *buf)
1185 {
1186         return sprintf(buf, "0x%08X\n", ipw_debug_level);
1187 }
1188
1189 static ssize_t debug_level_store(struct device_driver *d, const char *buf,
1190                                  size_t count)
1191 {
1192         char *p = (char *)buf;
1193         u32 val;
1194
1195         if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
1196                 p++;
1197                 if (p[0] == 'x' || p[0] == 'X')
1198                         p++;
1199                 val = simple_strtoul(p, &p, 16);
1200         } else
1201                 val = simple_strtoul(p, &p, 10);
1202         if (p == buf)
1203                 printk(KERN_INFO DRV_NAME
1204                        ": %s is not in hex or decimal form.\n", buf);
1205         else
1206                 ipw_debug_level = val;
1207
1208         return strnlen(buf, count);
1209 }
1210 static DRIVER_ATTR_RW(debug_level);
1211
1212 static inline u32 ipw_get_event_log_len(struct ipw_priv *priv)
1213 {
1214         /* length = 1st dword in log */
1215         return ipw_read_reg32(priv, ipw_read32(priv, IPW_EVENT_LOG));
1216 }
1217
1218 static void ipw_capture_event_log(struct ipw_priv *priv,
1219                                   u32 log_len, struct ipw_event *log)
1220 {
1221         u32 base;
1222
1223         if (log_len) {
1224                 base = ipw_read32(priv, IPW_EVENT_LOG);
1225                 ipw_read_indirect(priv, base + sizeof(base) + sizeof(u32),
1226                                   (u8 *) log, sizeof(*log) * log_len);
1227         }
1228 }
1229
1230 static struct ipw_fw_error *ipw_alloc_error_log(struct ipw_priv *priv)
1231 {
1232         struct ipw_fw_error *error;
1233         u32 log_len = ipw_get_event_log_len(priv);
1234         u32 base = ipw_read32(priv, IPW_ERROR_LOG);
1235         u32 elem_len = ipw_read_reg32(priv, base);
1236
1237         error = kmalloc(sizeof(*error) +
1238                         sizeof(*error->elem) * elem_len +
1239                         sizeof(*error->log) * log_len, GFP_ATOMIC);
1240         if (!error) {
1241                 IPW_ERROR("Memory allocation for firmware error log "
1242                           "failed.\n");
1243                 return NULL;
1244         }
1245         error->jiffies = jiffies;
1246         error->status = priv->status;
1247         error->config = priv->config;
1248         error->elem_len = elem_len;
1249         error->log_len = log_len;
1250         error->elem = (struct ipw_error_elem *)error->payload;
1251         error->log = (struct ipw_event *)(error->elem + elem_len);
1252
1253         ipw_capture_event_log(priv, log_len, error->log);
1254
1255         if (elem_len)
1256                 ipw_read_indirect(priv, base + sizeof(base), (u8 *) error->elem,
1257                                   sizeof(*error->elem) * elem_len);
1258
1259         return error;
1260 }
1261
1262 static ssize_t show_event_log(struct device *d,
1263                               struct device_attribute *attr, char *buf)
1264 {
1265         struct ipw_priv *priv = dev_get_drvdata(d);
1266         u32 log_len = ipw_get_event_log_len(priv);
1267         u32 log_size;
1268         struct ipw_event *log;
1269         u32 len = 0, i;
1270
1271         /* not using min() because of its strict type checking */
1272         log_size = PAGE_SIZE / sizeof(*log) > log_len ?
1273                         sizeof(*log) * log_len : PAGE_SIZE;
1274         log = kzalloc(log_size, GFP_KERNEL);
1275         if (!log) {
1276                 IPW_ERROR("Unable to allocate memory for log\n");
1277                 return 0;
1278         }
1279         log_len = log_size / sizeof(*log);
1280         ipw_capture_event_log(priv, log_len, log);
1281
1282         len += snprintf(buf + len, PAGE_SIZE - len, "%08X", log_len);
1283         for (i = 0; i < log_len; i++)
1284                 len += snprintf(buf + len, PAGE_SIZE - len,
1285                                 "\n%08X%08X%08X",
1286                                 log[i].time, log[i].event, log[i].data);
1287         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1288         kfree(log);
1289         return len;
1290 }
1291
1292 static DEVICE_ATTR(event_log, 0444, show_event_log, NULL);
1293
1294 static ssize_t show_error(struct device *d,
1295                           struct device_attribute *attr, char *buf)
1296 {
1297         struct ipw_priv *priv = dev_get_drvdata(d);
1298         u32 len = 0, i;
1299         if (!priv->error)
1300                 return 0;
1301         len += snprintf(buf + len, PAGE_SIZE - len,
1302                         "%08lX%08X%08X%08X",
1303                         priv->error->jiffies,
1304                         priv->error->status,
1305                         priv->error->config, priv->error->elem_len);
1306         for (i = 0; i < priv->error->elem_len; i++)
1307                 len += snprintf(buf + len, PAGE_SIZE - len,
1308                                 "\n%08X%08X%08X%08X%08X%08X%08X",
1309                                 priv->error->elem[i].time,
1310                                 priv->error->elem[i].desc,
1311                                 priv->error->elem[i].blink1,
1312                                 priv->error->elem[i].blink2,
1313                                 priv->error->elem[i].link1,
1314                                 priv->error->elem[i].link2,
1315                                 priv->error->elem[i].data);
1316
1317         len += snprintf(buf + len, PAGE_SIZE - len,
1318                         "\n%08X", priv->error->log_len);
1319         for (i = 0; i < priv->error->log_len; i++)
1320                 len += snprintf(buf + len, PAGE_SIZE - len,
1321                                 "\n%08X%08X%08X",
1322                                 priv->error->log[i].time,
1323                                 priv->error->log[i].event,
1324                                 priv->error->log[i].data);
1325         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1326         return len;
1327 }
1328
1329 static ssize_t clear_error(struct device *d,
1330                            struct device_attribute *attr,
1331                            const char *buf, size_t count)
1332 {
1333         struct ipw_priv *priv = dev_get_drvdata(d);
1334
1335         kfree(priv->error);
1336         priv->error = NULL;
1337         return count;
1338 }
1339
1340 static DEVICE_ATTR(error, 0644, show_error, clear_error);
1341
1342 static ssize_t show_cmd_log(struct device *d,
1343                             struct device_attribute *attr, char *buf)
1344 {
1345         struct ipw_priv *priv = dev_get_drvdata(d);
1346         u32 len = 0, i;
1347         if (!priv->cmdlog)
1348                 return 0;
1349         for (i = (priv->cmdlog_pos + 1) % priv->cmdlog_len;
1350              (i != priv->cmdlog_pos) && (len < PAGE_SIZE);
1351              i = (i + 1) % priv->cmdlog_len) {
1352                 len +=
1353                     snprintf(buf + len, PAGE_SIZE - len,
1354                              "\n%08lX%08X%08X%08X\n", priv->cmdlog[i].jiffies,
1355                              priv->cmdlog[i].retcode, priv->cmdlog[i].cmd.cmd,
1356                              priv->cmdlog[i].cmd.len);
1357                 len +=
1358                     snprintk_buf(buf + len, PAGE_SIZE - len,
1359                                  (u8 *) priv->cmdlog[i].cmd.param,
1360                                  priv->cmdlog[i].cmd.len);
1361                 len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1362         }
1363         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1364         return len;
1365 }
1366
1367 static DEVICE_ATTR(cmd_log, 0444, show_cmd_log, NULL);
1368
1369 #ifdef CONFIG_IPW2200_PROMISCUOUS
1370 static void ipw_prom_free(struct ipw_priv *priv);
1371 static int ipw_prom_alloc(struct ipw_priv *priv);
1372 static ssize_t store_rtap_iface(struct device *d,
1373                          struct device_attribute *attr,
1374                          const char *buf, size_t count)
1375 {
1376         struct ipw_priv *priv = dev_get_drvdata(d);
1377         int rc = 0;
1378
1379         if (count < 1)
1380                 return -EINVAL;
1381
1382         switch (buf[0]) {
1383         case '0':
1384                 if (!rtap_iface)
1385                         return count;
1386
1387                 if (netif_running(priv->prom_net_dev)) {
1388                         IPW_WARNING("Interface is up.  Cannot unregister.\n");
1389                         return count;
1390                 }
1391
1392                 ipw_prom_free(priv);
1393                 rtap_iface = 0;
1394                 break;
1395
1396         case '1':
1397                 if (rtap_iface)
1398                         return count;
1399
1400                 rc = ipw_prom_alloc(priv);
1401                 if (!rc)
1402                         rtap_iface = 1;
1403                 break;
1404
1405         default:
1406                 return -EINVAL;
1407         }
1408
1409         if (rc) {
1410                 IPW_ERROR("Failed to register promiscuous network "
1411                           "device (error %d).\n", rc);
1412         }
1413
1414         return count;
1415 }
1416
1417 static ssize_t show_rtap_iface(struct device *d,
1418                         struct device_attribute *attr,
1419                         char *buf)
1420 {
1421         struct ipw_priv *priv = dev_get_drvdata(d);
1422         if (rtap_iface)
1423                 return sprintf(buf, "%s", priv->prom_net_dev->name);
1424         else {
1425                 buf[0] = '-';
1426                 buf[1] = '1';
1427                 buf[2] = '\0';
1428                 return 3;
1429         }
1430 }
1431
1432 static DEVICE_ATTR(rtap_iface, 0600, show_rtap_iface, store_rtap_iface);
1433
1434 static ssize_t store_rtap_filter(struct device *d,
1435                          struct device_attribute *attr,
1436                          const char *buf, size_t count)
1437 {
1438         struct ipw_priv *priv = dev_get_drvdata(d);
1439
1440         if (!priv->prom_priv) {
1441                 IPW_ERROR("Attempting to set filter without "
1442                           "rtap_iface enabled.\n");
1443                 return -EPERM;
1444         }
1445
1446         priv->prom_priv->filter = simple_strtol(buf, NULL, 0);
1447
1448         IPW_DEBUG_INFO("Setting rtap filter to " BIT_FMT16 "\n",
1449                        BIT_ARG16(priv->prom_priv->filter));
1450
1451         return count;
1452 }
1453
1454 static ssize_t show_rtap_filter(struct device *d,
1455                         struct device_attribute *attr,
1456                         char *buf)
1457 {
1458         struct ipw_priv *priv = dev_get_drvdata(d);
1459         return sprintf(buf, "0x%04X",
1460                        priv->prom_priv ? priv->prom_priv->filter : 0);
1461 }
1462
1463 static DEVICE_ATTR(rtap_filter, 0600, show_rtap_filter, store_rtap_filter);
1464 #endif
1465
1466 static ssize_t show_scan_age(struct device *d, struct device_attribute *attr,
1467                              char *buf)
1468 {
1469         struct ipw_priv *priv = dev_get_drvdata(d);
1470         return sprintf(buf, "%d\n", priv->ieee->scan_age);
1471 }
1472
1473 static ssize_t store_scan_age(struct device *d, struct device_attribute *attr,
1474                               const char *buf, size_t count)
1475 {
1476         struct ipw_priv *priv = dev_get_drvdata(d);
1477         struct net_device *dev = priv->net_dev;
1478         char buffer[] = "00000000";
1479         unsigned long len =
1480             (sizeof(buffer) - 1) > count ? count : sizeof(buffer) - 1;
1481         unsigned long val;
1482         char *p = buffer;
1483
1484         IPW_DEBUG_INFO("enter\n");
1485
1486         strncpy(buffer, buf, len);
1487         buffer[len] = 0;
1488
1489         if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
1490                 p++;
1491                 if (p[0] == 'x' || p[0] == 'X')
1492                         p++;
1493                 val = simple_strtoul(p, &p, 16);
1494         } else
1495                 val = simple_strtoul(p, &p, 10);
1496         if (p == buffer) {
1497                 IPW_DEBUG_INFO("%s: user supplied invalid value.\n", dev->name);
1498         } else {
1499                 priv->ieee->scan_age = val;
1500                 IPW_DEBUG_INFO("set scan_age = %u\n", priv->ieee->scan_age);
1501         }
1502
1503         IPW_DEBUG_INFO("exit\n");
1504         return len;
1505 }
1506
1507 static DEVICE_ATTR(scan_age, 0644, show_scan_age, store_scan_age);
1508
1509 static ssize_t show_led(struct device *d, struct device_attribute *attr,
1510                         char *buf)
1511 {
1512         struct ipw_priv *priv = dev_get_drvdata(d);
1513         return sprintf(buf, "%d\n", (priv->config & CFG_NO_LED) ? 0 : 1);
1514 }
1515
1516 static ssize_t store_led(struct device *d, struct device_attribute *attr,
1517                          const char *buf, size_t count)
1518 {
1519         struct ipw_priv *priv = dev_get_drvdata(d);
1520
1521         IPW_DEBUG_INFO("enter\n");
1522
1523         if (count == 0)
1524                 return 0;
1525
1526         if (*buf == 0) {
1527                 IPW_DEBUG_LED("Disabling LED control.\n");
1528                 priv->config |= CFG_NO_LED;
1529                 ipw_led_shutdown(priv);
1530         } else {
1531                 IPW_DEBUG_LED("Enabling LED control.\n");
1532                 priv->config &= ~CFG_NO_LED;
1533                 ipw_led_init(priv);
1534         }
1535
1536         IPW_DEBUG_INFO("exit\n");
1537         return count;
1538 }
1539
1540 static DEVICE_ATTR(led, 0644, show_led, store_led);
1541
1542 static ssize_t show_status(struct device *d,
1543                            struct device_attribute *attr, char *buf)
1544 {
1545         struct ipw_priv *p = dev_get_drvdata(d);
1546         return sprintf(buf, "0x%08x\n", (int)p->status);
1547 }
1548
1549 static DEVICE_ATTR(status, 0444, show_status, NULL);
1550
1551 static ssize_t show_cfg(struct device *d, struct device_attribute *attr,
1552                         char *buf)
1553 {
1554         struct ipw_priv *p = dev_get_drvdata(d);
1555         return sprintf(buf, "0x%08x\n", (int)p->config);
1556 }
1557
1558 static DEVICE_ATTR(cfg, 0444, show_cfg, NULL);
1559
1560 static ssize_t show_nic_type(struct device *d,
1561                              struct device_attribute *attr, char *buf)
1562 {
1563         struct ipw_priv *priv = dev_get_drvdata(d);
1564         return sprintf(buf, "TYPE: %d\n", priv->nic_type);
1565 }
1566
1567 static DEVICE_ATTR(nic_type, 0444, show_nic_type, NULL);
1568
1569 static ssize_t show_ucode_version(struct device *d,
1570                                   struct device_attribute *attr, char *buf)
1571 {
1572         u32 len = sizeof(u32), tmp = 0;
1573         struct ipw_priv *p = dev_get_drvdata(d);
1574
1575         if (ipw_get_ordinal(p, IPW_ORD_STAT_UCODE_VERSION, &tmp, &len))
1576                 return 0;
1577
1578         return sprintf(buf, "0x%08x\n", tmp);
1579 }
1580
1581 static DEVICE_ATTR(ucode_version, 0644, show_ucode_version, NULL);
1582
1583 static ssize_t show_rtc(struct device *d, struct device_attribute *attr,
1584                         char *buf)
1585 {
1586         u32 len = sizeof(u32), tmp = 0;
1587         struct ipw_priv *p = dev_get_drvdata(d);
1588
1589         if (ipw_get_ordinal(p, IPW_ORD_STAT_RTC, &tmp, &len))
1590                 return 0;
1591
1592         return sprintf(buf, "0x%08x\n", tmp);
1593 }
1594
1595 static DEVICE_ATTR(rtc, 0644, show_rtc, NULL);
1596
1597 /*
1598  * Add a device attribute to view/control the delay between eeprom
1599  * operations.
1600  */
1601 static ssize_t show_eeprom_delay(struct device *d,
1602                                  struct device_attribute *attr, char *buf)
1603 {
1604         struct ipw_priv *p = dev_get_drvdata(d);
1605         int n = p->eeprom_delay;
1606         return sprintf(buf, "%i\n", n);
1607 }
1608 static ssize_t store_eeprom_delay(struct device *d,
1609                                   struct device_attribute *attr,
1610                                   const char *buf, size_t count)
1611 {
1612         struct ipw_priv *p = dev_get_drvdata(d);
1613         sscanf(buf, "%i", &p->eeprom_delay);
1614         return strnlen(buf, count);
1615 }
1616
1617 static DEVICE_ATTR(eeprom_delay, 0644, show_eeprom_delay, store_eeprom_delay);
1618
1619 static ssize_t show_command_event_reg(struct device *d,
1620                                       struct device_attribute *attr, char *buf)
1621 {
1622         u32 reg = 0;
1623         struct ipw_priv *p = dev_get_drvdata(d);
1624
1625         reg = ipw_read_reg32(p, IPW_INTERNAL_CMD_EVENT);
1626         return sprintf(buf, "0x%08x\n", reg);
1627 }
1628 static ssize_t store_command_event_reg(struct device *d,
1629                                        struct device_attribute *attr,
1630                                        const char *buf, size_t count)
1631 {
1632         u32 reg;
1633         struct ipw_priv *p = dev_get_drvdata(d);
1634
1635         sscanf(buf, "%x", &reg);
1636         ipw_write_reg32(p, IPW_INTERNAL_CMD_EVENT, reg);
1637         return strnlen(buf, count);
1638 }
1639
1640 static DEVICE_ATTR(command_event_reg, 0644,
1641                    show_command_event_reg, store_command_event_reg);
1642
1643 static ssize_t show_mem_gpio_reg(struct device *d,
1644                                  struct device_attribute *attr, char *buf)
1645 {
1646         u32 reg = 0;
1647         struct ipw_priv *p = dev_get_drvdata(d);
1648
1649         reg = ipw_read_reg32(p, 0x301100);
1650         return sprintf(buf, "0x%08x\n", reg);
1651 }
1652 static ssize_t store_mem_gpio_reg(struct device *d,
1653                                   struct device_attribute *attr,
1654                                   const char *buf, size_t count)
1655 {
1656         u32 reg;
1657         struct ipw_priv *p = dev_get_drvdata(d);
1658
1659         sscanf(buf, "%x", &reg);
1660         ipw_write_reg32(p, 0x301100, reg);
1661         return strnlen(buf, count);
1662 }
1663
1664 static DEVICE_ATTR(mem_gpio_reg, 0644, show_mem_gpio_reg, store_mem_gpio_reg);
1665
1666 static ssize_t show_indirect_dword(struct device *d,
1667                                    struct device_attribute *attr, char *buf)
1668 {
1669         u32 reg = 0;
1670         struct ipw_priv *priv = dev_get_drvdata(d);
1671
1672         if (priv->status & STATUS_INDIRECT_DWORD)
1673                 reg = ipw_read_reg32(priv, priv->indirect_dword);
1674         else
1675                 reg = 0;
1676
1677         return sprintf(buf, "0x%08x\n", reg);
1678 }
1679 static ssize_t store_indirect_dword(struct device *d,
1680                                     struct device_attribute *attr,
1681                                     const char *buf, size_t count)
1682 {
1683         struct ipw_priv *priv = dev_get_drvdata(d);
1684
1685         sscanf(buf, "%x", &priv->indirect_dword);
1686         priv->status |= STATUS_INDIRECT_DWORD;
1687         return strnlen(buf, count);
1688 }
1689
1690 static DEVICE_ATTR(indirect_dword, 0644,
1691                    show_indirect_dword, store_indirect_dword);
1692
1693 static ssize_t show_indirect_byte(struct device *d,
1694                                   struct device_attribute *attr, char *buf)
1695 {
1696         u8 reg = 0;
1697         struct ipw_priv *priv = dev_get_drvdata(d);
1698
1699         if (priv->status & STATUS_INDIRECT_BYTE)
1700                 reg = ipw_read_reg8(priv, priv->indirect_byte);
1701         else
1702                 reg = 0;
1703
1704         return sprintf(buf, "0x%02x\n", reg);
1705 }
1706 static ssize_t store_indirect_byte(struct device *d,
1707                                    struct device_attribute *attr,
1708                                    const char *buf, size_t count)
1709 {
1710         struct ipw_priv *priv = dev_get_drvdata(d);
1711
1712         sscanf(buf, "%x", &priv->indirect_byte);
1713         priv->status |= STATUS_INDIRECT_BYTE;
1714         return strnlen(buf, count);
1715 }
1716
1717 static DEVICE_ATTR(indirect_byte, 0644,
1718                    show_indirect_byte, store_indirect_byte);
1719
1720 static ssize_t show_direct_dword(struct device *d,
1721                                  struct device_attribute *attr, char *buf)
1722 {
1723         u32 reg = 0;
1724         struct ipw_priv *priv = dev_get_drvdata(d);
1725
1726         if (priv->status & STATUS_DIRECT_DWORD)
1727                 reg = ipw_read32(priv, priv->direct_dword);
1728         else
1729                 reg = 0;
1730
1731         return sprintf(buf, "0x%08x\n", reg);
1732 }
1733 static ssize_t store_direct_dword(struct device *d,
1734                                   struct device_attribute *attr,
1735                                   const char *buf, size_t count)
1736 {
1737         struct ipw_priv *priv = dev_get_drvdata(d);
1738
1739         sscanf(buf, "%x", &priv->direct_dword);
1740         priv->status |= STATUS_DIRECT_DWORD;
1741         return strnlen(buf, count);
1742 }
1743
1744 static DEVICE_ATTR(direct_dword, 0644, show_direct_dword, store_direct_dword);
1745
1746 static int rf_kill_active(struct ipw_priv *priv)
1747 {
1748         if (0 == (ipw_read32(priv, 0x30) & 0x10000)) {
1749                 priv->status |= STATUS_RF_KILL_HW;
1750                 wiphy_rfkill_set_hw_state(priv->ieee->wdev.wiphy, true);
1751         } else {
1752                 priv->status &= ~STATUS_RF_KILL_HW;
1753                 wiphy_rfkill_set_hw_state(priv->ieee->wdev.wiphy, false);
1754         }
1755
1756         return (priv->status & STATUS_RF_KILL_HW) ? 1 : 0;
1757 }
1758
1759 static ssize_t show_rf_kill(struct device *d, struct device_attribute *attr,
1760                             char *buf)
1761 {
1762         /* 0 - RF kill not enabled
1763            1 - SW based RF kill active (sysfs)
1764            2 - HW based RF kill active
1765            3 - Both HW and SW baed RF kill active */
1766         struct ipw_priv *priv = dev_get_drvdata(d);
1767         int val = ((priv->status & STATUS_RF_KILL_SW) ? 0x1 : 0x0) |
1768             (rf_kill_active(priv) ? 0x2 : 0x0);
1769         return sprintf(buf, "%i\n", val);
1770 }
1771
1772 static int ipw_radio_kill_sw(struct ipw_priv *priv, int disable_radio)
1773 {
1774         if ((disable_radio ? 1 : 0) ==
1775             ((priv->status & STATUS_RF_KILL_SW) ? 1 : 0))
1776                 return 0;
1777
1778         IPW_DEBUG_RF_KILL("Manual SW RF Kill set to: RADIO  %s\n",
1779                           disable_radio ? "OFF" : "ON");
1780
1781         if (disable_radio) {
1782                 priv->status |= STATUS_RF_KILL_SW;
1783
1784                 cancel_delayed_work(&priv->request_scan);
1785                 cancel_delayed_work(&priv->request_direct_scan);
1786                 cancel_delayed_work(&priv->request_passive_scan);
1787                 cancel_delayed_work(&priv->scan_event);
1788                 schedule_work(&priv->down);
1789         } else {
1790                 priv->status &= ~STATUS_RF_KILL_SW;
1791                 if (rf_kill_active(priv)) {
1792                         IPW_DEBUG_RF_KILL("Can not turn radio back on - "
1793                                           "disabled by HW switch\n");
1794                         /* Make sure the RF_KILL check timer is running */
1795                         cancel_delayed_work(&priv->rf_kill);
1796                         schedule_delayed_work(&priv->rf_kill,
1797                                               round_jiffies_relative(2 * HZ));
1798                 } else
1799                         schedule_work(&priv->up);
1800         }
1801
1802         return 1;
1803 }
1804
1805 static ssize_t store_rf_kill(struct device *d, struct device_attribute *attr,
1806                              const char *buf, size_t count)
1807 {
1808         struct ipw_priv *priv = dev_get_drvdata(d);
1809
1810         ipw_radio_kill_sw(priv, buf[0] == '1');
1811
1812         return count;
1813 }
1814
1815 static DEVICE_ATTR(rf_kill, 0644, show_rf_kill, store_rf_kill);
1816
1817 static ssize_t show_speed_scan(struct device *d, struct device_attribute *attr,
1818                                char *buf)
1819 {
1820         struct ipw_priv *priv = dev_get_drvdata(d);
1821         int pos = 0, len = 0;
1822         if (priv->config & CFG_SPEED_SCAN) {
1823                 while (priv->speed_scan[pos] != 0)
1824                         len += sprintf(&buf[len], "%d ",
1825                                        priv->speed_scan[pos++]);
1826                 return len + sprintf(&buf[len], "\n");
1827         }
1828
1829         return sprintf(buf, "0\n");
1830 }
1831
1832 static ssize_t store_speed_scan(struct device *d, struct device_attribute *attr,
1833                                 const char *buf, size_t count)
1834 {
1835         struct ipw_priv *priv = dev_get_drvdata(d);
1836         int channel, pos = 0;
1837         const char *p = buf;
1838
1839         /* list of space separated channels to scan, optionally ending with 0 */
1840         while ((channel = simple_strtol(p, NULL, 0))) {
1841                 if (pos == MAX_SPEED_SCAN - 1) {
1842                         priv->speed_scan[pos] = 0;
1843                         break;
1844                 }
1845
1846                 if (libipw_is_valid_channel(priv->ieee, channel))
1847                         priv->speed_scan[pos++] = channel;
1848                 else
1849                         IPW_WARNING("Skipping invalid channel request: %d\n",
1850                                     channel);
1851                 p = strchr(p, ' ');
1852                 if (!p)
1853                         break;
1854                 while (*p == ' ' || *p == '\t')
1855                         p++;
1856         }
1857
1858         if (pos == 0)
1859                 priv->config &= ~CFG_SPEED_SCAN;
1860         else {
1861                 priv->speed_scan_pos = 0;
1862                 priv->config |= CFG_SPEED_SCAN;
1863         }
1864
1865         return count;
1866 }
1867
1868 static DEVICE_ATTR(speed_scan, 0644, show_speed_scan, store_speed_scan);
1869
1870 static ssize_t show_net_stats(struct device *d, struct device_attribute *attr,
1871                               char *buf)
1872 {
1873         struct ipw_priv *priv = dev_get_drvdata(d);
1874         return sprintf(buf, "%c\n", (priv->config & CFG_NET_STATS) ? '1' : '0');
1875 }
1876
1877 static ssize_t store_net_stats(struct device *d, struct device_attribute *attr,
1878                                const char *buf, size_t count)
1879 {
1880         struct ipw_priv *priv = dev_get_drvdata(d);
1881         if (buf[0] == '1')
1882                 priv->config |= CFG_NET_STATS;
1883         else
1884                 priv->config &= ~CFG_NET_STATS;
1885
1886         return count;
1887 }
1888
1889 static DEVICE_ATTR(net_stats, 0644, show_net_stats, store_net_stats);
1890
1891 static ssize_t show_channels(struct device *d,
1892                              struct device_attribute *attr,
1893                              char *buf)
1894 {
1895         struct ipw_priv *priv = dev_get_drvdata(d);
1896         const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
1897         int len = 0, i;
1898
1899         len = sprintf(&buf[len],
1900                       "Displaying %d channels in 2.4Ghz band "
1901                       "(802.11bg):\n", geo->bg_channels);
1902
1903         for (i = 0; i < geo->bg_channels; i++) {
1904                 len += sprintf(&buf[len], "%d: BSS%s%s, %s, Band %s.\n",
1905                                geo->bg[i].channel,
1906                                geo->bg[i].flags & LIBIPW_CH_RADAR_DETECT ?
1907                                " (radar spectrum)" : "",
1908                                ((geo->bg[i].flags & LIBIPW_CH_NO_IBSS) ||
1909                                 (geo->bg[i].flags & LIBIPW_CH_RADAR_DETECT))
1910                                ? "" : ", IBSS",
1911                                geo->bg[i].flags & LIBIPW_CH_PASSIVE_ONLY ?
1912                                "passive only" : "active/passive",
1913                                geo->bg[i].flags & LIBIPW_CH_B_ONLY ?
1914                                "B" : "B/G");
1915         }
1916
1917         len += sprintf(&buf[len],
1918                        "Displaying %d channels in 5.2Ghz band "
1919                        "(802.11a):\n", geo->a_channels);
1920         for (i = 0; i < geo->a_channels; i++) {
1921                 len += sprintf(&buf[len], "%d: BSS%s%s, %s.\n",
1922                                geo->a[i].channel,
1923                                geo->a[i].flags & LIBIPW_CH_RADAR_DETECT ?
1924                                " (radar spectrum)" : "",
1925                                ((geo->a[i].flags & LIBIPW_CH_NO_IBSS) ||
1926                                 (geo->a[i].flags & LIBIPW_CH_RADAR_DETECT))
1927                                ? "" : ", IBSS",
1928                                geo->a[i].flags & LIBIPW_CH_PASSIVE_ONLY ?
1929                                "passive only" : "active/passive");
1930         }
1931
1932         return len;
1933 }
1934
1935 static DEVICE_ATTR(channels, 0400, show_channels, NULL);
1936
1937 static void notify_wx_assoc_event(struct ipw_priv *priv)
1938 {
1939         union iwreq_data wrqu;
1940         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1941         if (priv->status & STATUS_ASSOCIATED)
1942                 memcpy(wrqu.ap_addr.sa_data, priv->bssid, ETH_ALEN);
1943         else
1944                 eth_zero_addr(wrqu.ap_addr.sa_data);
1945         wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
1946 }
1947
1948 static void ipw_irq_tasklet(struct ipw_priv *priv)
1949 {
1950         u32 inta, inta_mask, handled = 0;
1951         unsigned long flags;
1952         int rc = 0;
1953
1954         spin_lock_irqsave(&priv->irq_lock, flags);
1955
1956         inta = ipw_read32(priv, IPW_INTA_RW);
1957         inta_mask = ipw_read32(priv, IPW_INTA_MASK_R);
1958
1959         if (inta == 0xFFFFFFFF) {
1960                 /* Hardware disappeared */
1961                 IPW_WARNING("TASKLET INTA == 0xFFFFFFFF\n");
1962                 /* Only handle the cached INTA values */
1963                 inta = 0;
1964         }
1965         inta &= (IPW_INTA_MASK_ALL & inta_mask);
1966
1967         /* Add any cached INTA values that need to be handled */
1968         inta |= priv->isr_inta;
1969
1970         spin_unlock_irqrestore(&priv->irq_lock, flags);
1971
1972         spin_lock_irqsave(&priv->lock, flags);
1973
1974         /* handle all the justifications for the interrupt */
1975         if (inta & IPW_INTA_BIT_RX_TRANSFER) {
1976                 ipw_rx(priv);
1977                 handled |= IPW_INTA_BIT_RX_TRANSFER;
1978         }
1979
1980         if (inta & IPW_INTA_BIT_TX_CMD_QUEUE) {
1981                 IPW_DEBUG_HC("Command completed.\n");
1982                 rc = ipw_queue_tx_reclaim(priv, &priv->txq_cmd, -1);
1983                 priv->status &= ~STATUS_HCMD_ACTIVE;
1984                 wake_up_interruptible(&priv->wait_command_queue);
1985                 handled |= IPW_INTA_BIT_TX_CMD_QUEUE;
1986         }
1987
1988         if (inta & IPW_INTA_BIT_TX_QUEUE_1) {
1989                 IPW_DEBUG_TX("TX_QUEUE_1\n");
1990                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[0], 0);
1991                 handled |= IPW_INTA_BIT_TX_QUEUE_1;
1992         }
1993
1994         if (inta & IPW_INTA_BIT_TX_QUEUE_2) {
1995                 IPW_DEBUG_TX("TX_QUEUE_2\n");
1996                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[1], 1);
1997                 handled |= IPW_INTA_BIT_TX_QUEUE_2;
1998         }
1999
2000         if (inta & IPW_INTA_BIT_TX_QUEUE_3) {
2001                 IPW_DEBUG_TX("TX_QUEUE_3\n");
2002                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[2], 2);
2003                 handled |= IPW_INTA_BIT_TX_QUEUE_3;
2004         }
2005
2006         if (inta & IPW_INTA_BIT_TX_QUEUE_4) {
2007                 IPW_DEBUG_TX("TX_QUEUE_4\n");
2008                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[3], 3);
2009                 handled |= IPW_INTA_BIT_TX_QUEUE_4;
2010         }
2011
2012         if (inta & IPW_INTA_BIT_STATUS_CHANGE) {
2013                 IPW_WARNING("STATUS_CHANGE\n");
2014                 handled |= IPW_INTA_BIT_STATUS_CHANGE;
2015         }
2016
2017         if (inta & IPW_INTA_BIT_BEACON_PERIOD_EXPIRED) {
2018                 IPW_WARNING("TX_PERIOD_EXPIRED\n");
2019                 handled |= IPW_INTA_BIT_BEACON_PERIOD_EXPIRED;
2020         }
2021
2022         if (inta & IPW_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE) {
2023                 IPW_WARNING("HOST_CMD_DONE\n");
2024                 handled |= IPW_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE;
2025         }
2026
2027         if (inta & IPW_INTA_BIT_FW_INITIALIZATION_DONE) {
2028                 IPW_WARNING("FW_INITIALIZATION_DONE\n");
2029                 handled |= IPW_INTA_BIT_FW_INITIALIZATION_DONE;
2030         }
2031
2032         if (inta & IPW_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE) {
2033                 IPW_WARNING("PHY_OFF_DONE\n");
2034                 handled |= IPW_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE;
2035         }
2036
2037         if (inta & IPW_INTA_BIT_RF_KILL_DONE) {
2038                 IPW_DEBUG_RF_KILL("RF_KILL_DONE\n");
2039                 priv->status |= STATUS_RF_KILL_HW;
2040                 wiphy_rfkill_set_hw_state(priv->ieee->wdev.wiphy, true);
2041                 wake_up_interruptible(&priv->wait_command_queue);
2042                 priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
2043                 cancel_delayed_work(&priv->request_scan);
2044                 cancel_delayed_work(&priv->request_direct_scan);
2045                 cancel_delayed_work(&priv->request_passive_scan);
2046                 cancel_delayed_work(&priv->scan_event);
2047                 schedule_work(&priv->link_down);
2048                 schedule_delayed_work(&priv->rf_kill, 2 * HZ);
2049                 handled |= IPW_INTA_BIT_RF_KILL_DONE;
2050         }
2051
2052         if (inta & IPW_INTA_BIT_FATAL_ERROR) {
2053                 IPW_WARNING("Firmware error detected.  Restarting.\n");
2054                 if (priv->error) {
2055                         IPW_DEBUG_FW("Sysfs 'error' log already exists.\n");
2056                         if (ipw_debug_level & IPW_DL_FW_ERRORS) {
2057                                 struct ipw_fw_error *error =
2058                                     ipw_alloc_error_log(priv);
2059                                 ipw_dump_error_log(priv, error);
2060                                 kfree(error);
2061                         }
2062                 } else {
2063                         priv->error = ipw_alloc_error_log(priv);
2064                         if (priv->error)
2065                                 IPW_DEBUG_FW("Sysfs 'error' log captured.\n");
2066                         else
2067                                 IPW_DEBUG_FW("Error allocating sysfs 'error' "
2068                                              "log.\n");
2069                         if (ipw_debug_level & IPW_DL_FW_ERRORS)
2070                                 ipw_dump_error_log(priv, priv->error);
2071                 }
2072
2073                 /* XXX: If hardware encryption is for WPA/WPA2,
2074                  * we have to notify the supplicant. */
2075                 if (priv->ieee->sec.encrypt) {
2076                         priv->status &= ~STATUS_ASSOCIATED;
2077                         notify_wx_assoc_event(priv);
2078                 }
2079
2080                 /* Keep the restart process from trying to send host
2081                  * commands by clearing the INIT status bit */
2082                 priv->status &= ~STATUS_INIT;
2083
2084                 /* Cancel currently queued command. */
2085                 priv->status &= ~STATUS_HCMD_ACTIVE;
2086                 wake_up_interruptible(&priv->wait_command_queue);
2087
2088                 schedule_work(&priv->adapter_restart);
2089                 handled |= IPW_INTA_BIT_FATAL_ERROR;
2090         }
2091
2092         if (inta & IPW_INTA_BIT_PARITY_ERROR) {
2093                 IPW_ERROR("Parity error\n");
2094                 handled |= IPW_INTA_BIT_PARITY_ERROR;
2095         }
2096
2097         if (handled != inta) {
2098                 IPW_ERROR("Unhandled INTA bits 0x%08x\n", inta & ~handled);
2099         }
2100
2101         spin_unlock_irqrestore(&priv->lock, flags);
2102
2103         /* enable all interrupts */
2104         ipw_enable_interrupts(priv);
2105 }
2106
2107 #define IPW_CMD(x) case IPW_CMD_ ## x : return #x
2108 static char *get_cmd_string(u8 cmd)
2109 {
2110         switch (cmd) {
2111                 IPW_CMD(HOST_COMPLETE);
2112                 IPW_CMD(POWER_DOWN);
2113                 IPW_CMD(SYSTEM_CONFIG);
2114                 IPW_CMD(MULTICAST_ADDRESS);
2115                 IPW_CMD(SSID);
2116                 IPW_CMD(ADAPTER_ADDRESS);
2117                 IPW_CMD(PORT_TYPE);
2118                 IPW_CMD(RTS_THRESHOLD);
2119                 IPW_CMD(FRAG_THRESHOLD);
2120                 IPW_CMD(POWER_MODE);
2121                 IPW_CMD(WEP_KEY);
2122                 IPW_CMD(TGI_TX_KEY);
2123                 IPW_CMD(SCAN_REQUEST);
2124                 IPW_CMD(SCAN_REQUEST_EXT);
2125                 IPW_CMD(ASSOCIATE);
2126                 IPW_CMD(SUPPORTED_RATES);
2127                 IPW_CMD(SCAN_ABORT);
2128                 IPW_CMD(TX_FLUSH);
2129                 IPW_CMD(QOS_PARAMETERS);
2130                 IPW_CMD(DINO_CONFIG);
2131                 IPW_CMD(RSN_CAPABILITIES);
2132                 IPW_CMD(RX_KEY);
2133                 IPW_CMD(CARD_DISABLE);
2134                 IPW_CMD(SEED_NUMBER);
2135                 IPW_CMD(TX_POWER);
2136                 IPW_CMD(COUNTRY_INFO);
2137                 IPW_CMD(AIRONET_INFO);
2138                 IPW_CMD(AP_TX_POWER);
2139                 IPW_CMD(CCKM_INFO);
2140                 IPW_CMD(CCX_VER_INFO);
2141                 IPW_CMD(SET_CALIBRATION);
2142                 IPW_CMD(SENSITIVITY_CALIB);
2143                 IPW_CMD(RETRY_LIMIT);
2144                 IPW_CMD(IPW_PRE_POWER_DOWN);
2145                 IPW_CMD(VAP_BEACON_TEMPLATE);
2146                 IPW_CMD(VAP_DTIM_PERIOD);
2147                 IPW_CMD(EXT_SUPPORTED_RATES);
2148                 IPW_CMD(VAP_LOCAL_TX_PWR_CONSTRAINT);
2149                 IPW_CMD(VAP_QUIET_INTERVALS);
2150                 IPW_CMD(VAP_CHANNEL_SWITCH);
2151                 IPW_CMD(VAP_MANDATORY_CHANNELS);
2152                 IPW_CMD(VAP_CELL_PWR_LIMIT);
2153                 IPW_CMD(VAP_CF_PARAM_SET);
2154                 IPW_CMD(VAP_SET_BEACONING_STATE);
2155                 IPW_CMD(MEASUREMENT);
2156                 IPW_CMD(POWER_CAPABILITY);
2157                 IPW_CMD(SUPPORTED_CHANNELS);
2158                 IPW_CMD(TPC_REPORT);
2159                 IPW_CMD(WME_INFO);
2160                 IPW_CMD(PRODUCTION_COMMAND);
2161         default:
2162                 return "UNKNOWN";
2163         }
2164 }
2165
2166 #define HOST_COMPLETE_TIMEOUT HZ
2167
2168 static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
2169 {
2170         int rc = 0;
2171         unsigned long flags;
2172         unsigned long now, end;
2173
2174         spin_lock_irqsave(&priv->lock, flags);
2175         if (priv->status & STATUS_HCMD_ACTIVE) {
2176                 IPW_ERROR("Failed to send %s: Already sending a command.\n",
2177                           get_cmd_string(cmd->cmd));
2178                 spin_unlock_irqrestore(&priv->lock, flags);
2179                 return -EAGAIN;
2180         }
2181
2182         priv->status |= STATUS_HCMD_ACTIVE;
2183
2184         if (priv->cmdlog) {
2185                 priv->cmdlog[priv->cmdlog_pos].jiffies = jiffies;
2186                 priv->cmdlog[priv->cmdlog_pos].cmd.cmd = cmd->cmd;
2187                 priv->cmdlog[priv->cmdlog_pos].cmd.len = cmd->len;
2188                 memcpy(priv->cmdlog[priv->cmdlog_pos].cmd.param, cmd->param,
2189                        cmd->len);
2190                 priv->cmdlog[priv->cmdlog_pos].retcode = -1;
2191         }
2192
2193         IPW_DEBUG_HC("%s command (#%d) %d bytes: 0x%08X\n",
2194                      get_cmd_string(cmd->cmd), cmd->cmd, cmd->len,
2195                      priv->status);
2196
2197 #ifndef DEBUG_CMD_WEP_KEY
2198         if (cmd->cmd == IPW_CMD_WEP_KEY)
2199                 IPW_DEBUG_HC("WEP_KEY command masked out for secure.\n");
2200         else
2201 #endif
2202                 printk_buf(IPW_DL_HOST_COMMAND, (u8 *) cmd->param, cmd->len);
2203
2204         rc = ipw_queue_tx_hcmd(priv, cmd->cmd, cmd->param, cmd->len, 0);
2205         if (rc) {
2206                 priv->status &= ~STATUS_HCMD_ACTIVE;
2207                 IPW_ERROR("Failed to send %s: Reason %d\n",
2208                           get_cmd_string(cmd->cmd), rc);
2209                 spin_unlock_irqrestore(&priv->lock, flags);
2210                 goto exit;
2211         }
2212         spin_unlock_irqrestore(&priv->lock, flags);
2213
2214         now = jiffies;
2215         end = now + HOST_COMPLETE_TIMEOUT;
2216 again:
2217         rc = wait_event_interruptible_timeout(priv->wait_command_queue,
2218                                               !(priv->
2219                                                 status & STATUS_HCMD_ACTIVE),
2220                                               end - now);
2221         if (rc < 0) {
2222                 now = jiffies;
2223                 if (time_before(now, end))
2224                         goto again;
2225                 rc = 0;
2226         }
2227
2228         if (rc == 0) {
2229                 spin_lock_irqsave(&priv->lock, flags);
2230                 if (priv->status & STATUS_HCMD_ACTIVE) {
2231                         IPW_ERROR("Failed to send %s: Command timed out.\n",
2232                                   get_cmd_string(cmd->cmd));
2233                         priv->status &= ~STATUS_HCMD_ACTIVE;
2234                         spin_unlock_irqrestore(&priv->lock, flags);
2235                         rc = -EIO;
2236                         goto exit;
2237                 }
2238                 spin_unlock_irqrestore(&priv->lock, flags);
2239         } else
2240                 rc = 0;
2241
2242         if (priv->status & STATUS_RF_KILL_HW) {
2243                 IPW_ERROR("Failed to send %s: Aborted due to RF kill switch.\n",
2244                           get_cmd_string(cmd->cmd));
2245                 rc = -EIO;
2246                 goto exit;
2247         }
2248
2249       exit:
2250         if (priv->cmdlog) {
2251                 priv->cmdlog[priv->cmdlog_pos++].retcode = rc;
2252                 priv->cmdlog_pos %= priv->cmdlog_len;
2253         }
2254         return rc;
2255 }
2256
2257 static int ipw_send_cmd_simple(struct ipw_priv *priv, u8 command)
2258 {
2259         struct host_cmd cmd = {
2260                 .cmd = command,
2261         };
2262
2263         return __ipw_send_cmd(priv, &cmd);
2264 }
2265
2266 static int ipw_send_cmd_pdu(struct ipw_priv *priv, u8 command, u8 len,
2267                             void *data)
2268 {
2269         struct host_cmd cmd = {
2270                 .cmd = command,
2271                 .len = len,
2272                 .param = data,
2273         };
2274
2275         return __ipw_send_cmd(priv, &cmd);
2276 }
2277
2278 static int ipw_send_host_complete(struct ipw_priv *priv)
2279 {
2280         if (!priv) {
2281                 IPW_ERROR("Invalid args\n");
2282                 return -1;
2283         }
2284
2285         return ipw_send_cmd_simple(priv, IPW_CMD_HOST_COMPLETE);
2286 }
2287
2288 static int ipw_send_system_config(struct ipw_priv *priv)
2289 {
2290         return ipw_send_cmd_pdu(priv, IPW_CMD_SYSTEM_CONFIG,
2291                                 sizeof(priv->sys_config),
2292                                 &priv->sys_config);
2293 }
2294
2295 static int ipw_send_ssid(struct ipw_priv *priv, u8 * ssid, int len)
2296 {
2297         if (!priv || !ssid) {
2298                 IPW_ERROR("Invalid args\n");
2299                 return -1;
2300         }
2301
2302         return ipw_send_cmd_pdu(priv, IPW_CMD_SSID, min(len, IW_ESSID_MAX_SIZE),
2303                                 ssid);
2304 }
2305
2306 static int ipw_send_adapter_address(struct ipw_priv *priv, u8 * mac)
2307 {
2308         if (!priv || !mac) {
2309                 IPW_ERROR("Invalid args\n");
2310                 return -1;
2311         }
2312
2313         IPW_DEBUG_INFO("%s: Setting MAC to %pM\n",
2314                        priv->net_dev->name, mac);
2315
2316         return ipw_send_cmd_pdu(priv, IPW_CMD_ADAPTER_ADDRESS, ETH_ALEN, mac);
2317 }
2318
2319 static void ipw_adapter_restart(void *adapter)
2320 {
2321         struct ipw_priv *priv = adapter;
2322
2323         if (priv->status & STATUS_RF_KILL_MASK)
2324                 return;
2325
2326         ipw_down(priv);
2327
2328         if (priv->assoc_network &&
2329             (priv->assoc_network->capability & WLAN_CAPABILITY_IBSS))
2330                 ipw_remove_current_network(priv);
2331
2332         if (ipw_up(priv)) {
2333                 IPW_ERROR("Failed to up device\n");
2334                 return;
2335         }
2336 }
2337
2338 static void ipw_bg_adapter_restart(struct work_struct *work)
2339 {
2340         struct ipw_priv *priv =
2341                 container_of(work, struct ipw_priv, adapter_restart);
2342         mutex_lock(&priv->mutex);
2343         ipw_adapter_restart(priv);
2344         mutex_unlock(&priv->mutex);
2345 }
2346
2347 static void ipw_abort_scan(struct ipw_priv *priv);
2348
2349 #define IPW_SCAN_CHECK_WATCHDOG (5 * HZ)
2350
2351 static void ipw_scan_check(void *data)
2352 {
2353         struct ipw_priv *priv = data;
2354
2355         if (priv->status & STATUS_SCAN_ABORTING) {
2356                 IPW_DEBUG_SCAN("Scan completion watchdog resetting "
2357                                "adapter after (%dms).\n",
2358                                jiffies_to_msecs(IPW_SCAN_CHECK_WATCHDOG));
2359                 schedule_work(&priv->adapter_restart);
2360         } else if (priv->status & STATUS_SCANNING) {
2361                 IPW_DEBUG_SCAN("Scan completion watchdog aborting scan "
2362                                "after (%dms).\n",
2363                                jiffies_to_msecs(IPW_SCAN_CHECK_WATCHDOG));
2364                 ipw_abort_scan(priv);
2365                 schedule_delayed_work(&priv->scan_check, HZ);
2366         }
2367 }
2368
2369 static void ipw_bg_scan_check(struct work_struct *work)
2370 {
2371         struct ipw_priv *priv =
2372                 container_of(work, struct ipw_priv, scan_check.work);
2373         mutex_lock(&priv->mutex);
2374         ipw_scan_check(priv);
2375         mutex_unlock(&priv->mutex);
2376 }
2377
2378 static int ipw_send_scan_request_ext(struct ipw_priv *priv,
2379                                      struct ipw_scan_request_ext *request)
2380 {
2381         return ipw_send_cmd_pdu(priv, IPW_CMD_SCAN_REQUEST_EXT,
2382                                 sizeof(*request), request);
2383 }
2384
2385 static int ipw_send_scan_abort(struct ipw_priv *priv)
2386 {
2387         if (!priv) {
2388                 IPW_ERROR("Invalid args\n");
2389                 return -1;
2390         }
2391
2392         return ipw_send_cmd_simple(priv, IPW_CMD_SCAN_ABORT);
2393 }
2394
2395 static int ipw_set_sensitivity(struct ipw_priv *priv, u16 sens)
2396 {
2397         struct ipw_sensitivity_calib calib = {
2398                 .beacon_rssi_raw = cpu_to_le16(sens),
2399         };
2400
2401         return ipw_send_cmd_pdu(priv, IPW_CMD_SENSITIVITY_CALIB, sizeof(calib),
2402                                 &calib);
2403 }
2404
2405 static int ipw_send_associate(struct ipw_priv *priv,
2406                               struct ipw_associate *associate)
2407 {
2408         if (!priv || !associate) {
2409                 IPW_ERROR("Invalid args\n");
2410                 return -1;
2411         }
2412
2413         return ipw_send_cmd_pdu(priv, IPW_CMD_ASSOCIATE, sizeof(*associate),
2414                                 associate);
2415 }
2416
2417 static int ipw_send_supported_rates(struct ipw_priv *priv,
2418                                     struct ipw_supported_rates *rates)
2419 {
2420         if (!priv || !rates) {
2421                 IPW_ERROR("Invalid args\n");
2422                 return -1;
2423         }
2424
2425         return ipw_send_cmd_pdu(priv, IPW_CMD_SUPPORTED_RATES, sizeof(*rates),
2426                                 rates);
2427 }
2428
2429 static int ipw_set_random_seed(struct ipw_priv *priv)
2430 {
2431         u32 val;
2432
2433         if (!priv) {
2434                 IPW_ERROR("Invalid args\n");
2435                 return -1;
2436         }
2437
2438         get_random_bytes(&val, sizeof(val));
2439
2440         return ipw_send_cmd_pdu(priv, IPW_CMD_SEED_NUMBER, sizeof(val), &val);
2441 }
2442
2443 static int ipw_send_card_disable(struct ipw_priv *priv, u32 phy_off)
2444 {
2445         __le32 v = cpu_to_le32(phy_off);
2446         if (!priv) {
2447                 IPW_ERROR("Invalid args\n");
2448                 return -1;
2449         }
2450
2451         return ipw_send_cmd_pdu(priv, IPW_CMD_CARD_DISABLE, sizeof(v), &v);
2452 }
2453
2454 static int ipw_send_tx_power(struct ipw_priv *priv, struct ipw_tx_power *power)
2455 {
2456         if (!priv || !power) {
2457                 IPW_ERROR("Invalid args\n");
2458                 return -1;
2459         }
2460
2461         return ipw_send_cmd_pdu(priv, IPW_CMD_TX_POWER, sizeof(*power), power);
2462 }
2463
2464 static int ipw_set_tx_power(struct ipw_priv *priv)
2465 {
2466         const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
2467         struct ipw_tx_power tx_power;
2468         s8 max_power;
2469         int i;
2470
2471         memset(&tx_power, 0, sizeof(tx_power));
2472
2473         /* configure device for 'G' band */
2474         tx_power.ieee_mode = IPW_G_MODE;
2475         tx_power.num_channels = geo->bg_channels;
2476         for (i = 0; i < geo->bg_channels; i++) {
2477                 max_power = geo->bg[i].max_power;
2478                 tx_power.channels_tx_power[i].channel_number =
2479                     geo->bg[i].channel;
2480                 tx_power.channels_tx_power[i].tx_power = max_power ?
2481                     min(max_power, priv->tx_power) : priv->tx_power;
2482         }
2483         if (ipw_send_tx_power(priv, &tx_power))
2484                 return -EIO;
2485
2486         /* configure device to also handle 'B' band */
2487         tx_power.ieee_mode = IPW_B_MODE;
2488         if (ipw_send_tx_power(priv, &tx_power))
2489                 return -EIO;
2490
2491         /* configure device to also handle 'A' band */
2492         if (priv->ieee->abg_true) {
2493                 tx_power.ieee_mode = IPW_A_MODE;
2494                 tx_power.num_channels = geo->a_channels;
2495                 for (i = 0; i < tx_power.num_channels; i++) {
2496                         max_power = geo->a[i].max_power;
2497                         tx_power.channels_tx_power[i].channel_number =
2498                             geo->a[i].channel;
2499                         tx_power.channels_tx_power[i].tx_power = max_power ?
2500                             min(max_power, priv->tx_power) : priv->tx_power;
2501                 }
2502                 if (ipw_send_tx_power(priv, &tx_power))
2503                         return -EIO;
2504         }
2505         return 0;
2506 }
2507
2508 static int ipw_send_rts_threshold(struct ipw_priv *priv, u16 rts)
2509 {
2510         struct ipw_rts_threshold rts_threshold = {
2511                 .rts_threshold = cpu_to_le16(rts),
2512         };
2513
2514         if (!priv) {
2515                 IPW_ERROR("Invalid args\n");
2516                 return -1;
2517         }
2518
2519         return ipw_send_cmd_pdu(priv, IPW_CMD_RTS_THRESHOLD,
2520                                 sizeof(rts_threshold), &rts_threshold);
2521 }
2522
2523 static int ipw_send_frag_threshold(struct ipw_priv *priv, u16 frag)
2524 {
2525         struct ipw_frag_threshold frag_threshold = {
2526                 .frag_threshold = cpu_to_le16(frag),
2527         };
2528
2529         if (!priv) {
2530                 IPW_ERROR("Invalid args\n");
2531                 return -1;
2532         }
2533
2534         return ipw_send_cmd_pdu(priv, IPW_CMD_FRAG_THRESHOLD,
2535                                 sizeof(frag_threshold), &frag_threshold);
2536 }
2537
2538 static int ipw_send_power_mode(struct ipw_priv *priv, u32 mode)
2539 {
2540         __le32 param;
2541
2542         if (!priv) {
2543                 IPW_ERROR("Invalid args\n");
2544                 return -1;
2545         }
2546
2547         /* If on battery, set to 3, if AC set to CAM, else user
2548          * level */
2549         switch (mode) {
2550         case IPW_POWER_BATTERY:
2551                 param = cpu_to_le32(IPW_POWER_INDEX_3);
2552                 break;
2553         case IPW_POWER_AC:
2554                 param = cpu_to_le32(IPW_POWER_MODE_CAM);
2555                 break;
2556         default:
2557                 param = cpu_to_le32(mode);
2558                 break;
2559         }
2560
2561         return ipw_send_cmd_pdu(priv, IPW_CMD_POWER_MODE, sizeof(param),
2562                                 &param);
2563 }
2564
2565 static int ipw_send_retry_limit(struct ipw_priv *priv, u8 slimit, u8 llimit)
2566 {
2567         struct ipw_retry_limit retry_limit = {
2568                 .short_retry_limit = slimit,
2569                 .long_retry_limit = llimit
2570         };
2571
2572         if (!priv) {
2573                 IPW_ERROR("Invalid args\n");
2574                 return -1;
2575         }
2576
2577         return ipw_send_cmd_pdu(priv, IPW_CMD_RETRY_LIMIT, sizeof(retry_limit),
2578                                 &retry_limit);
2579 }
2580
2581 /*
2582  * The IPW device contains a Microwire compatible EEPROM that stores
2583  * various data like the MAC address.  Usually the firmware has exclusive
2584  * access to the eeprom, but during device initialization (before the
2585  * device driver has sent the HostComplete command to the firmware) the
2586  * device driver has read access to the EEPROM by way of indirect addressing
2587  * through a couple of memory mapped registers.
2588  *
2589  * The following is a simplified implementation for pulling data out of the
2590  * the eeprom, along with some helper functions to find information in
2591  * the per device private data's copy of the eeprom.
2592  *
2593  * NOTE: To better understand how these functions work (i.e what is a chip
2594  *       select and why do have to keep driving the eeprom clock?), read
2595  *       just about any data sheet for a Microwire compatible EEPROM.
2596  */
2597
2598 /* write a 32 bit value into the indirect accessor register */
2599 static inline void eeprom_write_reg(struct ipw_priv *p, u32 data)
2600 {
2601         ipw_write_reg32(p, FW_MEM_REG_EEPROM_ACCESS, data);
2602
2603         /* the eeprom requires some time to complete the operation */
2604         udelay(p->eeprom_delay);
2605 }
2606
2607 /* perform a chip select operation */
2608 static void eeprom_cs(struct ipw_priv *priv)
2609 {
2610         eeprom_write_reg(priv, 0);
2611         eeprom_write_reg(priv, EEPROM_BIT_CS);
2612         eeprom_write_reg(priv, EEPROM_BIT_CS | EEPROM_BIT_SK);
2613         eeprom_write_reg(priv, EEPROM_BIT_CS);
2614 }
2615
2616 /* perform a chip select operation */
2617 static void eeprom_disable_cs(struct ipw_priv *priv)
2618 {
2619         eeprom_write_reg(priv, EEPROM_BIT_CS);
2620         eeprom_write_reg(priv, 0);
2621         eeprom_write_reg(priv, EEPROM_BIT_SK);
2622 }
2623
2624 /* push a single bit down to the eeprom */
2625 static inline void eeprom_write_bit(struct ipw_priv *p, u8 bit)
2626 {
2627         int d = (bit ? EEPROM_BIT_DI : 0);
2628         eeprom_write_reg(p, EEPROM_BIT_CS | d);
2629         eeprom_write_reg(p, EEPROM_BIT_CS | d | EEPROM_BIT_SK);
2630 }
2631
2632 /* push an opcode followed by an address down to the eeprom */
2633 static void eeprom_op(struct ipw_priv *priv, u8 op, u8 addr)
2634 {
2635         int i;
2636
2637         eeprom_cs(priv);
2638         eeprom_write_bit(priv, 1);
2639         eeprom_write_bit(priv, op & 2);
2640         eeprom_write_bit(priv, op & 1);
2641         for (i = 7; i >= 0; i--) {
2642                 eeprom_write_bit(priv, addr & (1 << i));
2643         }
2644 }
2645
2646 /* pull 16 bits off the eeprom, one bit at a time */
2647 static u16 eeprom_read_u16(struct ipw_priv *priv, u8 addr)
2648 {
2649         int i;
2650         u16 r = 0;
2651
2652         /* Send READ Opcode */
2653         eeprom_op(priv, EEPROM_CMD_READ, addr);
2654
2655         /* Send dummy bit */
2656         eeprom_write_reg(priv, EEPROM_BIT_CS);
2657
2658         /* Read the byte off the eeprom one bit at a time */
2659         for (i = 0; i < 16; i++) {
2660                 u32 data = 0;
2661                 eeprom_write_reg(priv, EEPROM_BIT_CS | EEPROM_BIT_SK);
2662                 eeprom_write_reg(priv, EEPROM_BIT_CS);
2663                 data = ipw_read_reg32(priv, FW_MEM_REG_EEPROM_ACCESS);
2664                 r = (r << 1) | ((data & EEPROM_BIT_DO) ? 1 : 0);
2665         }
2666
2667         /* Send another dummy bit */
2668         eeprom_write_reg(priv, 0);
2669         eeprom_disable_cs(priv);
2670
2671         return r;
2672 }
2673
2674 /* helper function for pulling the mac address out of the private */
2675 /* data's copy of the eeprom data                                 */
2676 static void eeprom_parse_mac(struct ipw_priv *priv, u8 * mac)
2677 {
2678         memcpy(mac, &priv->eeprom[EEPROM_MAC_ADDRESS], ETH_ALEN);
2679 }
2680
2681 static void ipw_read_eeprom(struct ipw_priv *priv)
2682 {
2683         int i;
2684         __le16 *eeprom = (__le16 *) priv->eeprom;
2685
2686         IPW_DEBUG_TRACE(">>\n");
2687
2688         /* read entire contents of eeprom into private buffer */
2689         for (i = 0; i < 128; i++)
2690                 eeprom[i] = cpu_to_le16(eeprom_read_u16(priv, (u8) i));
2691
2692         IPW_DEBUG_TRACE("<<\n");
2693 }
2694
2695 /*
2696  * Either the device driver (i.e. the host) or the firmware can
2697  * load eeprom data into the designated region in SRAM.  If neither
2698  * happens then the FW will shutdown with a fatal error.
2699  *
2700  * In order to signal the FW to load the EEPROM, the EEPROM_LOAD_DISABLE
2701  * bit needs region of shared SRAM needs to be non-zero.
2702  */
2703 static void ipw_eeprom_init_sram(struct ipw_priv *priv)
2704 {
2705         int i;
2706
2707         IPW_DEBUG_TRACE(">>\n");
2708
2709         /*
2710            If the data looks correct, then copy it to our private
2711            copy.  Otherwise let the firmware know to perform the operation
2712            on its own.
2713          */
2714         if (priv->eeprom[EEPROM_VERSION] != 0) {
2715                 IPW_DEBUG_INFO("Writing EEPROM data into SRAM\n");
2716
2717                 /* write the eeprom data to sram */
2718                 for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
2719                         ipw_write8(priv, IPW_EEPROM_DATA + i, priv->eeprom[i]);
2720
2721                 /* Do not load eeprom data on fatal error or suspend */
2722                 ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
2723         } else {
2724                 IPW_DEBUG_INFO("Enabling FW initializationg of SRAM\n");
2725
2726                 /* Load eeprom data on fatal error or suspend */
2727                 ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 1);
2728         }
2729
2730         IPW_DEBUG_TRACE("<<\n");
2731 }
2732
2733 static void ipw_zero_memory(struct ipw_priv *priv, u32 start, u32 count)
2734 {
2735         count >>= 2;
2736         if (!count)
2737                 return;
2738         _ipw_write32(priv, IPW_AUTOINC_ADDR, start);
2739         while (count--)
2740                 _ipw_write32(priv, IPW_AUTOINC_DATA, 0);
2741 }
2742
2743 static inline void ipw_fw_dma_reset_command_blocks(struct ipw_priv *priv)
2744 {
2745         ipw_zero_memory(priv, IPW_SHARED_SRAM_DMA_CONTROL,
2746                         CB_NUMBER_OF_ELEMENTS_SMALL *
2747                         sizeof(struct command_block));
2748 }
2749
2750 static int ipw_fw_dma_enable(struct ipw_priv *priv)
2751 {                               /* start dma engine but no transfers yet */
2752
2753         IPW_DEBUG_FW(">> :\n");
2754
2755         /* Start the dma */
2756         ipw_fw_dma_reset_command_blocks(priv);
2757
2758         /* Write CB base address */
2759         ipw_write_reg32(priv, IPW_DMA_I_CB_BASE, IPW_SHARED_SRAM_DMA_CONTROL);
2760
2761         IPW_DEBUG_FW("<< :\n");
2762         return 0;
2763 }
2764
2765 static void ipw_fw_dma_abort(struct ipw_priv *priv)
2766 {
2767         u32 control = 0;
2768
2769         IPW_DEBUG_FW(">> :\n");
2770
2771         /* set the Stop and Abort bit */
2772         control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_STOP_AND_ABORT;
2773         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
2774         priv->sram_desc.last_cb_index = 0;
2775
2776         IPW_DEBUG_FW("<<\n");
2777 }
2778
2779 static int ipw_fw_dma_write_command_block(struct ipw_priv *priv, int index,
2780                                           struct command_block *cb)
2781 {
2782         u32 address =
2783             IPW_SHARED_SRAM_DMA_CONTROL +
2784             (sizeof(struct command_block) * index);
2785         IPW_DEBUG_FW(">> :\n");
2786
2787         ipw_write_indirect(priv, address, (u8 *) cb,
2788                            (int)sizeof(struct command_block));
2789
2790         IPW_DEBUG_FW("<< :\n");
2791         return 0;
2792
2793 }
2794
2795 static int ipw_fw_dma_kick(struct ipw_priv *priv)
2796 {
2797         u32 control = 0;
2798         u32 index = 0;
2799
2800         IPW_DEBUG_FW(">> :\n");
2801
2802         for (index = 0; index < priv->sram_desc.last_cb_index; index++)
2803                 ipw_fw_dma_write_command_block(priv, index,
2804                                                &priv->sram_desc.cb_list[index]);
2805
2806         /* Enable the DMA in the CSR register */
2807         ipw_clear_bit(priv, IPW_RESET_REG,
2808                       IPW_RESET_REG_MASTER_DISABLED |
2809                       IPW_RESET_REG_STOP_MASTER);
2810
2811         /* Set the Start bit. */
2812         control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_START;
2813         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
2814
2815         IPW_DEBUG_FW("<< :\n");
2816         return 0;
2817 }
2818
2819 static void ipw_fw_dma_dump_command_block(struct ipw_priv *priv)
2820 {
2821         u32 address;
2822         u32 register_value = 0;
2823         u32 cb_fields_address = 0;
2824
2825         IPW_DEBUG_FW(">> :\n");
2826         address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
2827         IPW_DEBUG_FW_INFO("Current CB is 0x%x\n", address);
2828
2829         /* Read the DMA Controlor register */
2830         register_value = ipw_read_reg32(priv, IPW_DMA_I_DMA_CONTROL);
2831         IPW_DEBUG_FW_INFO("IPW_DMA_I_DMA_CONTROL is 0x%x\n", register_value);
2832
2833         /* Print the CB values */
2834         cb_fields_address = address;
2835         register_value = ipw_read_reg32(priv, cb_fields_address);
2836         IPW_DEBUG_FW_INFO("Current CB Control Field is 0x%x\n", register_value);
2837
2838         cb_fields_address += sizeof(u32);
2839         register_value = ipw_read_reg32(priv, cb_fields_address);
2840         IPW_DEBUG_FW_INFO("Current CB Source Field is 0x%x\n", register_value);
2841
2842         cb_fields_address += sizeof(u32);
2843         register_value = ipw_read_reg32(priv, cb_fields_address);
2844         IPW_DEBUG_FW_INFO("Current CB Destination Field is 0x%x\n",
2845                           register_value);
2846
2847         cb_fields_address += sizeof(u32);
2848         register_value = ipw_read_reg32(priv, cb_fields_address);
2849         IPW_DEBUG_FW_INFO("Current CB Status Field is 0x%x\n", register_value);
2850
2851         IPW_DEBUG_FW(">> :\n");
2852 }
2853
2854 static int ipw_fw_dma_command_block_index(struct ipw_priv *priv)
2855 {
2856         u32 current_cb_address = 0;
2857         u32 current_cb_index = 0;
2858
2859         IPW_DEBUG_FW("<< :\n");
2860         current_cb_address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
2861
2862         current_cb_index = (current_cb_address - IPW_SHARED_SRAM_DMA_CONTROL) /
2863             sizeof(struct command_block);
2864
2865         IPW_DEBUG_FW_INFO("Current CB index 0x%x address = 0x%X\n",
2866                           current_cb_index, current_cb_address);
2867
2868         IPW_DEBUG_FW(">> :\n");
2869         return current_cb_index;
2870
2871 }
2872
2873 static int ipw_fw_dma_add_command_block(struct ipw_priv *priv,
2874                                         u32 src_address,
2875                                         u32 dest_address,
2876                                         u32 length,
2877                                         int interrupt_enabled, int is_last)
2878 {
2879
2880         u32 control = CB_VALID | CB_SRC_LE | CB_DEST_LE | CB_SRC_AUTOINC |
2881             CB_SRC_IO_GATED | CB_DEST_AUTOINC | CB_SRC_SIZE_LONG |
2882             CB_DEST_SIZE_LONG;
2883         struct command_block *cb;
2884         u32 last_cb_element = 0;
2885
2886         IPW_DEBUG_FW_INFO("src_address=0x%x dest_address=0x%x length=0x%x\n",
2887                           src_address, dest_address, length);
2888
2889         if (priv->sram_desc.last_cb_index >= CB_NUMBER_OF_ELEMENTS_SMALL)
2890                 return -1;
2891
2892         last_cb_element = priv->sram_desc.last_cb_index;
2893         cb = &priv->sram_desc.cb_list[last_cb_element];
2894         priv->sram_desc.last_cb_index++;
2895
2896         /* Calculate the new CB control word */
2897         if (interrupt_enabled)
2898                 control |= CB_INT_ENABLED;
2899
2900         if (is_last)
2901                 control |= CB_LAST_VALID;
2902
2903         control |= length;
2904
2905         /* Calculate the CB Element's checksum value */
2906         cb->status = control ^ src_address ^ dest_address;
2907
2908         /* Copy the Source and Destination addresses */
2909         cb->dest_addr = dest_address;
2910         cb->source_addr = src_address;
2911
2912         /* Copy the Control Word last */
2913         cb->control = control;
2914
2915         return 0;
2916 }
2917
2918 static int ipw_fw_dma_add_buffer(struct ipw_priv *priv, dma_addr_t *src_address,
2919                                  int nr, u32 dest_address, u32 len)
2920 {
2921         int ret, i;
2922         u32 size;
2923
2924         IPW_DEBUG_FW(">>\n");
2925         IPW_DEBUG_FW_INFO("nr=%d dest_address=0x%x len=0x%x\n",
2926                           nr, dest_address, len);
2927
2928         for (i = 0; i < nr; i++) {
2929                 size = min_t(u32, len - i * CB_MAX_LENGTH, CB_MAX_LENGTH);
2930                 ret = ipw_fw_dma_add_command_block(priv, src_address[i],
2931                                                    dest_address +
2932                                                    i * CB_MAX_LENGTH, size,
2933                                                    0, 0);
2934                 if (ret) {
2935                         IPW_DEBUG_FW_INFO(": Failed\n");
2936                         return -1;
2937                 } else
2938                         IPW_DEBUG_FW_INFO(": Added new cb\n");
2939         }
2940
2941         IPW_DEBUG_FW("<<\n");
2942         return 0;
2943 }
2944
2945 static int ipw_fw_dma_wait(struct ipw_priv *priv)
2946 {
2947         u32 current_index = 0, previous_index;
2948         u32 watchdog = 0;
2949
2950         IPW_DEBUG_FW(">> :\n");
2951
2952         current_index = ipw_fw_dma_command_block_index(priv);
2953         IPW_DEBUG_FW_INFO("sram_desc.last_cb_index:0x%08X\n",
2954                           (int)priv->sram_desc.last_cb_index);
2955
2956         while (current_index < priv->sram_desc.last_cb_index) {
2957                 udelay(50);
2958                 previous_index = current_index;
2959                 current_index = ipw_fw_dma_command_block_index(priv);
2960
2961                 if (previous_index < current_index) {
2962                         watchdog = 0;
2963                         continue;
2964                 }
2965                 if (++watchdog > 400) {
2966                         IPW_DEBUG_FW_INFO("Timeout\n");
2967                         ipw_fw_dma_dump_command_block(priv);
2968                         ipw_fw_dma_abort(priv);
2969                         return -1;
2970                 }
2971         }
2972
2973         ipw_fw_dma_abort(priv);
2974
2975         /*Disable the DMA in the CSR register */
2976         ipw_set_bit(priv, IPW_RESET_REG,
2977                     IPW_RESET_REG_MASTER_DISABLED | IPW_RESET_REG_STOP_MASTER);
2978
2979         IPW_DEBUG_FW("<< dmaWaitSync\n");
2980         return 0;
2981 }
2982
2983 static void ipw_remove_current_network(struct ipw_priv *priv)
2984 {
2985         struct list_head *element, *safe;
2986         struct libipw_network *network = NULL;
2987         unsigned long flags;
2988
2989         spin_lock_irqsave(&priv->ieee->lock, flags);
2990         list_for_each_safe(element, safe, &priv->ieee->network_list) {
2991                 network = list_entry(element, struct libipw_network, list);
2992                 if (ether_addr_equal(network->bssid, priv->bssid)) {
2993                         list_del(element);
2994                         list_add_tail(&network->list,
2995                                       &priv->ieee->network_free_list);
2996                 }
2997         }
2998         spin_unlock_irqrestore(&priv->ieee->lock, flags);
2999 }
3000
3001 /**
3002  * Check that card is still alive.
3003  * Reads debug register from domain0.
3004  * If card is present, pre-defined value should
3005  * be found there.
3006  *
3007  * @param priv
3008  * @return 1 if card is present, 0 otherwise
3009  */
3010 static inline int ipw_alive(struct ipw_priv *priv)
3011 {
3012         return ipw_read32(priv, 0x90) == 0xd55555d5;
3013 }
3014
3015 /* timeout in msec, attempted in 10-msec quanta */
3016 static int ipw_poll_bit(struct ipw_priv *priv, u32 addr, u32 mask,
3017                                int timeout)
3018 {
3019         int i = 0;
3020
3021         do {
3022                 if ((ipw_read32(priv, addr) & mask) == mask)
3023                         return i;
3024                 mdelay(10);
3025                 i += 10;
3026         } while (i < timeout);
3027
3028         return -ETIME;
3029 }
3030
3031 /* These functions load the firmware and micro code for the operation of
3032  * the ipw hardware.  It assumes the buffer has all the bits for the
3033  * image and the caller is handling the memory allocation and clean up.
3034  */
3035
3036 static int ipw_stop_master(struct ipw_priv *priv)
3037 {
3038         int rc;
3039
3040         IPW_DEBUG_TRACE(">>\n");
3041         /* stop master. typical delay - 0 */
3042         ipw_set_bit(priv, IPW_RESET_REG, IPW_RESET_REG_STOP_MASTER);
3043
3044         /* timeout is in msec, polled in 10-msec quanta */
3045         rc = ipw_poll_bit(priv, IPW_RESET_REG,
3046                           IPW_RESET_REG_MASTER_DISABLED, 100);
3047         if (rc < 0) {
3048                 IPW_ERROR("wait for stop master failed after 100ms\n");
3049                 return -1;
3050         }
3051
3052         IPW_DEBUG_INFO("stop master %dms\n", rc);
3053
3054         return rc;
3055 }
3056
3057 static void ipw_arc_release(struct ipw_priv *priv)
3058 {
3059         IPW_DEBUG_TRACE(">>\n");
3060         mdelay(5);
3061
3062         ipw_clear_bit(priv, IPW_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
3063
3064         /* no one knows timing, for safety add some delay */
3065         mdelay(5);
3066 }
3067
3068 struct fw_chunk {
3069         __le32 address;
3070         __le32 length;
3071 };
3072
3073 static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
3074 {
3075         int rc = 0, i, addr;
3076         u8 cr = 0;
3077         __le16 *image;
3078
3079         image = (__le16 *) data;
3080
3081         IPW_DEBUG_TRACE(">>\n");
3082
3083         rc = ipw_stop_master(priv);
3084
3085         if (rc < 0)
3086                 return rc;
3087
3088         for (addr = IPW_SHARED_LOWER_BOUND;
3089              addr < IPW_REGISTER_DOMAIN1_END; addr += 4) {
3090                 ipw_write32(priv, addr, 0);
3091         }
3092
3093         /* no ucode (yet) */
3094         memset(&priv->dino_alive, 0, sizeof(priv->dino_alive));
3095         /* destroy DMA queues */
3096         /* reset sequence */
3097
3098         ipw_write_reg32(priv, IPW_MEM_HALT_AND_RESET, IPW_BIT_HALT_RESET_ON);
3099         ipw_arc_release(priv);
3100         ipw_write_reg32(priv, IPW_MEM_HALT_AND_RESET, IPW_BIT_HALT_RESET_OFF);
3101         mdelay(1);
3102
3103         /* reset PHY */
3104         ipw_write_reg32(priv, IPW_INTERNAL_CMD_EVENT, IPW_BASEBAND_POWER_DOWN);
3105         mdelay(1);
3106
3107         ipw_write_reg32(priv, IPW_INTERNAL_CMD_EVENT, 0);
3108         mdelay(1);
3109
3110         /* enable ucode store */
3111         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0x0);
3112         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, DINO_ENABLE_CS);
3113         mdelay(1);
3114
3115         /* write ucode */
3116         /**
3117          * @bug
3118          * Do NOT set indirect address register once and then
3119          * store data to indirect data register in the loop.
3120          * It seems very reasonable, but in this case DINO do not
3121          * accept ucode. It is essential to set address each time.
3122          */
3123         /* load new ipw uCode */
3124         for (i = 0; i < len / 2; i++)
3125                 ipw_write_reg16(priv, IPW_BASEBAND_CONTROL_STORE,
3126                                 le16_to_cpu(image[i]));
3127
3128         /* enable DINO */
3129         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0);
3130         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, DINO_ENABLE_SYSTEM);
3131
3132         /* this is where the igx / win driver deveates from the VAP driver. */
3133
3134         /* wait for alive response */
3135         for (i = 0; i < 100; i++) {
3136                 /* poll for incoming data */
3137                 cr = ipw_read_reg8(priv, IPW_BASEBAND_CONTROL_STATUS);
3138                 if (cr & DINO_RXFIFO_DATA)
3139                         break;
3140                 mdelay(1);
3141         }
3142
3143         if (cr & DINO_RXFIFO_DATA) {
3144                 /* alive_command_responce size is NOT multiple of 4 */
3145                 __le32 response_buffer[(sizeof(priv->dino_alive) + 3) / 4];
3146
3147                 for (i = 0; i < ARRAY_SIZE(response_buffer); i++)
3148                         response_buffer[i] =
3149                             cpu_to_le32(ipw_read_reg32(priv,
3150                                                        IPW_BASEBAND_RX_FIFO_READ));
3151                 memcpy(&priv->dino_alive, response_buffer,
3152                        sizeof(priv->dino_alive));
3153                 if (priv->dino_alive.alive_command == 1
3154                     && priv->dino_alive.ucode_valid == 1) {
3155                         rc = 0;
3156                         IPW_DEBUG_INFO
3157                             ("Microcode OK, rev. %d (0x%x) dev. %d (0x%x) "
3158                              "of %02d/%02d/%02d %02d:%02d\n",
3159                              priv->dino_alive.software_revision,
3160                              priv->dino_alive.software_revision,
3161                              priv->dino_alive.device_identifier,
3162                              priv->dino_alive.device_identifier,
3163                              priv->dino_alive.time_stamp[0],
3164                              priv->dino_alive.time_stamp[1],
3165                              priv->dino_alive.time_stamp[2],
3166                              priv->dino_alive.time_stamp[3],
3167                              priv->dino_alive.time_stamp[4]);
3168                 } else {
3169                         IPW_DEBUG_INFO("Microcode is not alive\n");
3170                         rc = -EINVAL;
3171                 }
3172         } else {
3173                 IPW_DEBUG_INFO("No alive response from DINO\n");
3174                 rc = -ETIME;
3175         }
3176
3177         /* disable DINO, otherwise for some reason
3178            firmware have problem getting alive resp. */
3179         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0);
3180
3181         return rc;
3182 }
3183
3184 static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
3185 {
3186         int ret = -1;
3187         int offset = 0;
3188         struct fw_chunk *chunk;
3189         int total_nr = 0;
3190         int i;
3191         struct dma_pool *pool;
3192         void **virts;
3193         dma_addr_t *phys;
3194
3195         IPW_DEBUG_TRACE("<< :\n");
3196
3197         virts = kmalloc_array(CB_NUMBER_OF_ELEMENTS_SMALL, sizeof(void *),
3198                               GFP_KERNEL);
3199         if (!virts)
3200                 return -ENOMEM;
3201
3202         phys = kmalloc_array(CB_NUMBER_OF_ELEMENTS_SMALL, sizeof(dma_addr_t),
3203                              GFP_KERNEL);
3204         if (!phys) {
3205                 kfree(virts);
3206                 return -ENOMEM;
3207         }
3208         pool = dma_pool_create("ipw2200", &priv->pci_dev->dev, CB_MAX_LENGTH, 0,
3209                                0);
3210         if (!pool) {
3211                 IPW_ERROR("dma_pool_create failed\n");
3212                 kfree(phys);
3213                 kfree(virts);
3214                 return -ENOMEM;
3215         }
3216
3217         /* Start the Dma */
3218         ret = ipw_fw_dma_enable(priv);
3219
3220         /* the DMA is already ready this would be a bug. */
3221         BUG_ON(priv->sram_desc.last_cb_index > 0);
3222
3223         do {
3224                 u32 chunk_len;
3225                 u8 *start;
3226                 int size;
3227                 int nr = 0;
3228
3229                 chunk = (struct fw_chunk *)(data + offset);
3230                 offset += sizeof(struct fw_chunk);
3231                 chunk_len = le32_to_cpu(chunk->length);
3232                 start = data + offset;
3233
3234                 nr = (chunk_len + CB_MAX_LENGTH - 1) / CB_MAX_LENGTH;
3235                 for (i = 0; i < nr; i++) {
3236                         virts[total_nr] = dma_pool_alloc(pool, GFP_KERNEL,
3237                                                          &phys[total_nr]);
3238                         if (!virts[total_nr]) {
3239                                 ret = -ENOMEM;
3240                                 goto out;
3241                         }
3242                         size = min_t(u32, chunk_len - i * CB_MAX_LENGTH,
3243                                      CB_MAX_LENGTH);
3244                         memcpy(virts[total_nr], start, size);
3245                         start += size;
3246                         total_nr++;
3247                         /* We don't support fw chunk larger than 64*8K */
3248                         BUG_ON(total_nr > CB_NUMBER_OF_ELEMENTS_SMALL);
3249                 }
3250
3251                 /* build DMA packet and queue up for sending */
3252                 /* dma to chunk->address, the chunk->length bytes from data +
3253                  * offeset*/
3254                 /* Dma loading */
3255                 ret = ipw_fw_dma_add_buffer(priv, &phys[total_nr - nr],
3256                                             nr, le32_to_cpu(chunk->address),
3257                                             chunk_len);
3258                 if (ret) {
3259                         IPW_DEBUG_INFO("dmaAddBuffer Failed\n");
3260                         goto out;
3261                 }
3262
3263                 offset += chunk_len;
3264         } while (offset < len);
3265
3266         /* Run the DMA and wait for the answer */
3267         ret = ipw_fw_dma_kick(priv);
3268         if (ret) {
3269                 IPW_ERROR("dmaKick Failed\n");
3270                 goto out;
3271         }
3272
3273         ret = ipw_fw_dma_wait(priv);
3274         if (ret) {
3275                 IPW_ERROR("dmaWaitSync Failed\n");
3276                 goto out;
3277         }
3278  out:
3279         for (i = 0; i < total_nr; i++)
3280                 dma_pool_free(pool, virts[i], phys[i]);
3281
3282         dma_pool_destroy(pool);
3283         kfree(phys);
3284         kfree(virts);
3285
3286         return ret;
3287 }
3288
3289 /* stop nic */
3290 static int ipw_stop_nic(struct ipw_priv *priv)
3291 {
3292         int rc = 0;
3293
3294         /* stop */
3295         ipw_write32(priv, IPW_RESET_REG, IPW_RESET_REG_STOP_MASTER);
3296
3297         rc = ipw_poll_bit(priv, IPW_RESET_REG,
3298                           IPW_RESET_REG_MASTER_DISABLED, 500);
3299         if (rc < 0) {
3300                 IPW_ERROR("wait for reg master disabled failed after 500ms\n");
3301                 return rc;
3302         }
3303
3304         ipw_set_bit(priv, IPW_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
3305
3306         return rc;
3307 }
3308
3309 static void ipw_start_nic(struct ipw_priv *priv)
3310 {
3311         IPW_DEBUG_TRACE(">>\n");
3312
3313         /* prvHwStartNic  release ARC */
3314         ipw_clear_bit(priv, IPW_RESET_REG,
3315                       IPW_RESET_REG_MASTER_DISABLED |
3316                       IPW_RESET_REG_STOP_MASTER |
3317                       CBD_RESET_REG_PRINCETON_RESET);
3318
3319         /* enable power management */
3320         ipw_set_bit(priv, IPW_GP_CNTRL_RW,
3321                     IPW_GP_CNTRL_BIT_HOST_ALLOWS_STANDBY);
3322
3323         IPW_DEBUG_TRACE("<<\n");
3324 }
3325
3326 static int ipw_init_nic(struct ipw_priv *priv)
3327 {
3328         int rc;
3329
3330         IPW_DEBUG_TRACE(">>\n");
3331         /* reset */
3332         /*prvHwInitNic */
3333         /* set "initialization complete" bit to move adapter to D0 state */
3334         ipw_set_bit(priv, IPW_GP_CNTRL_RW, IPW_GP_CNTRL_BIT_INIT_DONE);
3335
3336         /* low-level PLL activation */
3337         ipw_write32(priv, IPW_READ_INT_REGISTER,
3338                     IPW_BIT_INT_HOST_SRAM_READ_INT_REGISTER);
3339
3340         /* wait for clock stabilization */
3341         rc = ipw_poll_bit(priv, IPW_GP_CNTRL_RW,
3342                           IPW_GP_CNTRL_BIT_CLOCK_READY, 250);
3343         if (rc < 0)
3344                 IPW_DEBUG_INFO("FAILED wait for clock stablization\n");
3345
3346         /* assert SW reset */
3347         ipw_set_bit(priv, IPW_RESET_REG, IPW_RESET_REG_SW_RESET);
3348
3349         udelay(10);
3350
3351         /* set "initialization complete" bit to move adapter to D0 state */
3352         ipw_set_bit(priv, IPW_GP_CNTRL_RW, IPW_GP_CNTRL_BIT_INIT_DONE);
3353
3354         IPW_DEBUG_TRACE(">>\n");
3355         return 0;
3356 }
3357
3358 /* Call this function from process context, it will sleep in request_firmware.
3359  * Probe is an ok place to call this from.
3360  */
3361 static int ipw_reset_nic(struct ipw_priv *priv)
3362 {
3363         int rc = 0;
3364         unsigned long flags;
3365
3366         IPW_DEBUG_TRACE(">>\n");
3367
3368         rc = ipw_init_nic(priv);
3369
3370         spin_lock_irqsave(&priv->lock, flags);
3371         /* Clear the 'host command active' bit... */
3372         priv->status &= ~STATUS_HCMD_ACTIVE;
3373         wake_up_interruptible(&priv->wait_command_queue);
3374         priv->status &= ~(STATUS_SCANNING | STATUS_SCAN_ABORTING);
3375         wake_up_interruptible(&priv->wait_state);
3376         spin_unlock_irqrestore(&priv->lock, flags);
3377
3378         IPW_DEBUG_TRACE("<<\n");
3379         return rc;
3380 }
3381
3382
3383 struct ipw_fw {
3384         __le32 ver;
3385         __le32 boot_size;
3386         __le32 ucode_size;
3387         __le32 fw_size;
3388         u8 data[0];
3389 };
3390
3391 static int ipw_get_fw(struct ipw_priv *priv,
3392                       const struct firmware **raw, const char *name)
3393 {
3394         struct ipw_fw *fw;
3395         int rc;
3396
3397         /* ask firmware_class module to get the boot firmware off disk */
3398         rc = request_firmware(raw, name, &priv->pci_dev->dev);
3399         if (rc < 0) {
3400                 IPW_ERROR("%s request_firmware failed: Reason %d\n", name, rc);
3401                 return rc;
3402         }
3403
3404         if ((*raw)->size < sizeof(*fw)) {
3405                 IPW_ERROR("%s is too small (%zd)\n", name, (*raw)->size);
3406                 return -EINVAL;
3407         }
3408
3409         fw = (void *)(*raw)->data;
3410
3411         if ((*raw)->size < sizeof(*fw) + le32_to_cpu(fw->boot_size) +
3412             le32_to_cpu(fw->ucode_size) + le32_to_cpu(fw->fw_size)) {
3413                 IPW_ERROR("%s is too small or corrupt (%zd)\n",
3414                           name, (*raw)->size);
3415                 return -EINVAL;
3416         }
3417
3418         IPW_DEBUG_INFO("Read firmware '%s' image v%d.%d (%zd bytes)\n",
3419                        name,
3420                        le32_to_cpu(fw->ver) >> 16,
3421                        le32_to_cpu(fw->ver) & 0xff,
3422                        (*raw)->size - sizeof(*fw));
3423         return 0;
3424 }
3425
3426 #define IPW_RX_BUF_SIZE (3000)
3427
3428 static void ipw_rx_queue_reset(struct ipw_priv *priv,
3429                                       struct ipw_rx_queue *rxq)
3430 {
3431         unsigned long flags;
3432         int i;
3433
3434         spin_lock_irqsave(&rxq->lock, flags);
3435
3436         INIT_LIST_HEAD(&rxq->rx_free);
3437         INIT_LIST_HEAD(&rxq->rx_used);
3438
3439         /* Fill the rx_used queue with _all_ of the Rx buffers */
3440         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
3441                 /* In the reset function, these buffers may have been allocated
3442                  * to an SKB, so we need to unmap and free potential storage */
3443                 if (rxq->pool[i].skb != NULL) {
3444                         pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
3445                                          IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
3446                         dev_kfree_skb(rxq->pool[i].skb);
3447                         rxq->pool[i].skb = NULL;
3448                 }
3449                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
3450         }
3451
3452         /* Set us so that we have processed and used all buffers, but have
3453          * not restocked the Rx queue with fresh buffers */
3454         rxq->read = rxq->write = 0;
3455         rxq->free_count = 0;
3456         spin_unlock_irqrestore(&rxq->lock, flags);
3457 }
3458
3459 #ifdef CONFIG_PM
3460 static int fw_loaded = 0;
3461 static const struct firmware *raw = NULL;
3462
3463 static void free_firmware(void)
3464 {
3465         if (fw_loaded) {
3466                 release_firmware(raw);
3467                 raw = NULL;
3468                 fw_loaded = 0;
3469         }
3470 }
3471 #else
3472 #define free_firmware() do {} while (0)
3473 #endif
3474
3475 static int ipw_load(struct ipw_priv *priv)
3476 {
3477 #ifndef CONFIG_PM
3478         const struct firmware *raw = NULL;
3479 #endif
3480         struct ipw_fw *fw;
3481         u8 *boot_img, *ucode_img, *fw_img;
3482         u8 *name = NULL;
3483         int rc = 0, retries = 3;
3484
3485         switch (priv->ieee->iw_mode) {
3486         case IW_MODE_ADHOC:
3487                 name = "ipw2200-ibss.fw";
3488                 break;
3489 #ifdef CONFIG_IPW2200_MONITOR
3490         case IW_MODE_MONITOR:
3491                 name = "ipw2200-sniffer.fw";
3492                 break;
3493 #endif
3494         case IW_MODE_INFRA:
3495                 name = "ipw2200-bss.fw";
3496                 break;
3497         }
3498
3499         if (!name) {
3500                 rc = -EINVAL;
3501                 goto error;
3502         }
3503
3504 #ifdef CONFIG_PM
3505         if (!fw_loaded) {
3506 #endif
3507                 rc = ipw_get_fw(priv, &raw, name);
3508                 if (rc < 0)
3509                         goto error;
3510 #ifdef CONFIG_PM
3511         }
3512 #endif
3513
3514         fw = (void *)raw->data;
3515         boot_img = &fw->data[0];
3516         ucode_img = &fw->data[le32_to_cpu(fw->boot_size)];
3517         fw_img = &fw->data[le32_to_cpu(fw->boot_size) +
3518                            le32_to_cpu(fw->ucode_size)];
3519
3520         if (!priv->rxq)
3521                 priv->rxq = ipw_rx_queue_alloc(priv);
3522         else
3523                 ipw_rx_queue_reset(priv, priv->rxq);
3524         if (!priv->rxq) {
3525                 IPW_ERROR("Unable to initialize Rx queue\n");
3526                 rc = -ENOMEM;
3527                 goto error;
3528         }
3529
3530       retry:
3531         /* Ensure interrupts are disabled */
3532         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
3533         priv->status &= ~STATUS_INT_ENABLED;
3534
3535         /* ack pending interrupts */
3536         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3537
3538         ipw_stop_nic(priv);
3539
3540         rc = ipw_reset_nic(priv);
3541         if (rc < 0) {
3542                 IPW_ERROR("Unable to reset NIC\n");
3543                 goto error;
3544         }
3545
3546         ipw_zero_memory(priv, IPW_NIC_SRAM_LOWER_BOUND,
3547                         IPW_NIC_SRAM_UPPER_BOUND - IPW_NIC_SRAM_LOWER_BOUND);
3548
3549         /* DMA the initial boot firmware into the device */
3550         rc = ipw_load_firmware(priv, boot_img, le32_to_cpu(fw->boot_size));
3551         if (rc < 0) {
3552                 IPW_ERROR("Unable to load boot firmware: %d\n", rc);
3553                 goto error;
3554         }
3555
3556         /* kick start the device */
3557         ipw_start_nic(priv);
3558
3559         /* wait for the device to finish its initial startup sequence */
3560         rc = ipw_poll_bit(priv, IPW_INTA_RW,
3561                           IPW_INTA_BIT_FW_INITIALIZATION_DONE, 500);
3562         if (rc < 0) {
3563                 IPW_ERROR("device failed to boot initial fw image\n");
3564                 goto error;
3565         }
3566         IPW_DEBUG_INFO("initial device response after %dms\n", rc);
3567
3568         /* ack fw init done interrupt */
3569         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
3570
3571         /* DMA the ucode into the device */
3572         rc = ipw_load_ucode(priv, ucode_img, le32_to_cpu(fw->ucode_size));
3573         if (rc < 0) {
3574                 IPW_ERROR("Unable to load ucode: %d\n", rc);
3575                 goto error;
3576         }
3577
3578         /* stop nic */
3579         ipw_stop_nic(priv);
3580
3581         /* DMA bss firmware into the device */
3582         rc = ipw_load_firmware(priv, fw_img, le32_to_cpu(fw->fw_size));
3583         if (rc < 0) {
3584                 IPW_ERROR("Unable to load firmware: %d\n", rc);
3585                 goto error;
3586         }
3587 #ifdef CONFIG_PM
3588         fw_loaded = 1;
3589 #endif
3590
3591         ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
3592
3593         rc = ipw_queue_reset(priv);
3594         if (rc < 0) {
3595                 IPW_ERROR("Unable to initialize queues\n");
3596                 goto error;
3597         }
3598
3599         /* Ensure interrupts are disabled */
3600         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
3601         /* ack pending interrupts */
3602         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3603
3604         /* kick start the device */
3605         ipw_start_nic(priv);
3606
3607         if (ipw_read32(priv, IPW_INTA_RW) & IPW_INTA_BIT_PARITY_ERROR) {
3608                 if (retries > 0) {
3609                         IPW_WARNING("Parity error.  Retrying init.\n");
3610                         retries--;
3611                         goto retry;
3612                 }
3613
3614                 IPW_ERROR("TODO: Handle parity error -- schedule restart?\n");
3615                 rc = -EIO;
3616                 goto error;
3617         }
3618
3619         /* wait for the device */
3620         rc = ipw_poll_bit(priv, IPW_INTA_RW,
3621                           IPW_INTA_BIT_FW_INITIALIZATION_DONE, 500);
3622         if (rc < 0) {
3623                 IPW_ERROR("device failed to start within 500ms\n");
3624                 goto error;
3625         }
3626         IPW_DEBUG_INFO("device response after %dms\n", rc);
3627
3628         /* ack fw init done interrupt */
3629         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
3630
3631         /* read eeprom data */
3632         priv->eeprom_delay = 1;
3633         ipw_read_eeprom(priv);
3634         /* initialize the eeprom region of sram */
3635         ipw_eeprom_init_sram(priv);
3636
3637         /* enable interrupts */
3638         ipw_enable_interrupts(priv);
3639
3640         /* Ensure our queue has valid packets */
3641         ipw_rx_queue_replenish(priv);
3642
3643         ipw_write32(priv, IPW_RX_READ_INDEX, priv->rxq->read);
3644
3645         /* ack pending interrupts */
3646         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3647
3648 #ifndef CONFIG_PM
3649         release_firmware(raw);
3650 #endif
3651         return 0;
3652
3653       error:
3654         if (priv->rxq) {
3655                 ipw_rx_queue_free(priv, priv->rxq);
3656                 priv->rxq = NULL;
3657         }
3658         ipw_tx_queue_free(priv);
3659         release_firmware(raw);
3660 #ifdef CONFIG_PM
3661         fw_loaded = 0;
3662         raw = NULL;
3663 #endif
3664
3665         return rc;
3666 }
3667
3668 /**
3669  * DMA services
3670  *
3671  * Theory of operation
3672  *
3673  * A queue is a circular buffers with 'Read' and 'Write' pointers.
3674  * 2 empty entries always kept in the buffer to protect from overflow.
3675  *
3676  * For Tx queue, there are low mark and high mark limits. If, after queuing
3677  * the packet for Tx, free space become < low mark, Tx queue stopped. When
3678  * reclaiming packets (on 'tx done IRQ), if free space become > high mark,
3679  * Tx queue resumed.
3680  *
3681  * The IPW operates with six queues, one receive queue in the device's
3682  * sram, one transmit queue for sending commands to the device firmware,
3683  * and four transmit queues for data.
3684  *
3685  * The four transmit queues allow for performing quality of service (qos)
3686  * transmissions as per the 802.11 protocol.  Currently Linux does not
3687  * provide a mechanism to the user for utilizing prioritized queues, so
3688  * we only utilize the first data transmit queue (queue1).
3689  */
3690
3691 /**
3692  * Driver allocates buffers of this size for Rx
3693  */
3694
3695 /**
3696  * ipw_rx_queue_space - Return number of free slots available in queue.
3697  */
3698 static int ipw_rx_queue_space(const struct ipw_rx_queue *q)
3699 {
3700         int s = q->read - q->write;
3701         if (s <= 0)
3702                 s += RX_QUEUE_SIZE;
3703         /* keep some buffer to not confuse full and empty queue */
3704         s -= 2;
3705         if (s < 0)
3706                 s = 0;
3707         return s;
3708 }
3709
3710 static inline int ipw_tx_queue_space(const struct clx2_queue *q)
3711 {
3712         int s = q->last_used - q->first_empty;
3713         if (s <= 0)
3714                 s += q->n_bd;
3715         s -= 2;                 /* keep some reserve to not confuse empty and full situations */
3716         if (s < 0)
3717                 s = 0;
3718         return s;
3719 }
3720
3721 static inline int ipw_queue_inc_wrap(int index, int n_bd)
3722 {
3723         return (++index == n_bd) ? 0 : index;
3724 }
3725
3726 /**
3727  * Initialize common DMA queue structure
3728  *
3729  * @param q                queue to init
3730  * @param count            Number of BD's to allocate. Should be power of 2
3731  * @param read_register    Address for 'read' register
3732  *                         (not offset within BAR, full address)
3733  * @param write_register   Address for 'write' register
3734  *                         (not offset within BAR, full address)
3735  * @param base_register    Address for 'base' register
3736  *                         (not offset within BAR, full address)
3737  * @param size             Address for 'size' register
3738  *                         (not offset within BAR, full address)
3739  */
3740 static void ipw_queue_init(struct ipw_priv *priv, struct clx2_queue *q,
3741                            int count, u32 read, u32 write, u32 base, u32 size)
3742 {
3743         q->n_bd = count;
3744
3745         q->low_mark = q->n_bd / 4;
3746         if (q->low_mark < 4)
3747                 q->low_mark = 4;
3748
3749         q->high_mark = q->n_bd / 8;
3750         if (q->high_mark < 2)
3751                 q->high_mark = 2;
3752
3753         q->first_empty = q->last_used = 0;
3754         q->reg_r = read;
3755         q->reg_w = write;
3756
3757         ipw_write32(priv, base, q->dma_addr);
3758         ipw_write32(priv, size, count);
3759         ipw_write32(priv, read, 0);
3760         ipw_write32(priv, write, 0);
3761
3762         _ipw_read32(priv, 0x90);
3763 }
3764
3765 static int ipw_queue_tx_init(struct ipw_priv *priv,
3766                              struct clx2_tx_queue *q,
3767                              int count, u32 read, u32 write, u32 base, u32 size)
3768 {
3769         struct pci_dev *dev = priv->pci_dev;
3770
3771         q->txb = kmalloc_array(count, sizeof(q->txb[0]), GFP_KERNEL);
3772         if (!q->txb) {
3773                 IPW_ERROR("vmalloc for auxiliary BD structures failed\n");
3774                 return -ENOMEM;
3775         }
3776
3777         q->bd =
3778             pci_alloc_consistent(dev, sizeof(q->bd[0]) * count, &q->q.dma_addr);
3779         if (!q->bd) {
3780                 IPW_ERROR("pci_alloc_consistent(%zd) failed\n",
3781                           sizeof(q->bd[0]) * count);
3782                 kfree(q->txb);
3783                 q->txb = NULL;
3784                 return -ENOMEM;
3785         }
3786
3787         ipw_queue_init(priv, &q->q, count, read, write, base, size);
3788         return 0;
3789 }
3790
3791 /**
3792  * Free one TFD, those at index [txq->q.last_used].
3793  * Do NOT advance any indexes
3794  *
3795  * @param dev
3796  * @param txq
3797  */
3798 static void ipw_queue_tx_free_tfd(struct ipw_priv *priv,
3799                                   struct clx2_tx_queue *txq)
3800 {
3801         struct tfd_frame *bd = &txq->bd[txq->q.last_used];
3802         struct pci_dev *dev = priv->pci_dev;
3803         int i;
3804
3805         /* classify bd */
3806         if (bd->control_flags.message_type == TX_HOST_COMMAND_TYPE)
3807                 /* nothing to cleanup after for host commands */
3808                 return;
3809
3810         /* sanity check */
3811         if (le32_to_cpu(bd->u.data.num_chunks) > NUM_TFD_CHUNKS) {
3812                 IPW_ERROR("Too many chunks: %i\n",
3813                           le32_to_cpu(bd->u.data.num_chunks));
3814                 /** @todo issue fatal error, it is quite serious situation */
3815                 return;
3816         }
3817
3818         /* unmap chunks if any */
3819         for (i = 0; i < le32_to_cpu(bd->u.data.num_chunks); i++) {
3820                 pci_unmap_single(dev, le32_to_cpu(bd->u.data.chunk_ptr[i]),
3821                                  le16_to_cpu(bd->u.data.chunk_len[i]),
3822                                  PCI_DMA_TODEVICE);
3823                 if (txq->txb[txq->q.last_used]) {
3824                         libipw_txb_free(txq->txb[txq->q.last_used]);
3825                         txq->txb[txq->q.last_used] = NULL;
3826                 }
3827         }
3828 }
3829
3830 /**
3831  * Deallocate DMA queue.
3832  *
3833  * Empty queue by removing and destroying all BD's.
3834  * Free all buffers.
3835  *
3836  * @param dev
3837  * @param q
3838  */
3839 static void ipw_queue_tx_free(struct ipw_priv *priv, struct clx2_tx_queue *txq)
3840 {
3841         struct clx2_queue *q = &txq->q;
3842         struct pci_dev *dev = priv->pci_dev;
3843
3844         if (q->n_bd == 0)
3845                 return;
3846
3847         /* first, empty all BD's */
3848         for (; q->first_empty != q->last_used;
3849              q->last_used = ipw_queue_inc_wrap(q->last_used, q->n_bd)) {
3850                 ipw_queue_tx_free_tfd(priv, txq);
3851         }
3852
3853         /* free buffers belonging to queue itself */
3854         pci_free_consistent(dev, sizeof(txq->bd[0]) * q->n_bd, txq->bd,
3855                             q->dma_addr);
3856         kfree(txq->txb);
3857
3858         /* 0 fill whole structure */
3859         memset(txq, 0, sizeof(*txq));
3860 }
3861
3862 /**
3863  * Destroy all DMA queues and structures
3864  *
3865  * @param priv
3866  */
3867 static void ipw_tx_queue_free(struct ipw_priv *priv)
3868 {
3869         /* Tx CMD queue */
3870         ipw_queue_tx_free(priv, &priv->txq_cmd);
3871
3872         /* Tx queues */
3873         ipw_queue_tx_free(priv, &priv->txq[0]);
3874         ipw_queue_tx_free(priv, &priv->txq[1]);
3875         ipw_queue_tx_free(priv, &priv->txq[2]);
3876         ipw_queue_tx_free(priv, &priv->txq[3]);
3877 }
3878
3879 static void ipw_create_bssid(struct ipw_priv *priv, u8 * bssid)
3880 {
3881         /* First 3 bytes are manufacturer */
3882         bssid[0] = priv->mac_addr[0];
3883         bssid[1] = priv->mac_addr[1];
3884         bssid[2] = priv->mac_addr[2];
3885
3886         /* Last bytes are random */
3887         get_random_bytes(&bssid[3], ETH_ALEN - 3);
3888
3889         bssid[0] &= 0xfe;       /* clear multicast bit */
3890         bssid[0] |= 0x02;       /* set local assignment bit (IEEE802) */
3891 }
3892
3893 static u8 ipw_add_station(struct ipw_priv *priv, u8 * bssid)
3894 {
3895         struct ipw_station_entry entry;
3896         int i;
3897
3898         for (i = 0; i < priv->num_stations; i++) {
3899                 if (ether_addr_equal(priv->stations[i], bssid)) {
3900                         /* Another node is active in network */
3901                         priv->missed_adhoc_beacons = 0;
3902                         if (!(priv->config & CFG_STATIC_CHANNEL))
3903                                 /* when other nodes drop out, we drop out */
3904                                 priv->config &= ~CFG_ADHOC_PERSIST;
3905
3906                         return i;
3907                 }
3908         }
3909
3910         if (i == MAX_STATIONS)
3911                 return IPW_INVALID_STATION;
3912
3913         IPW_DEBUG_SCAN("Adding AdHoc station: %pM\n", bssid);
3914
3915         entry.reserved = 0;
3916         entry.support_mode = 0;
3917         memcpy(entry.mac_addr, bssid, ETH_ALEN);
3918         memcpy(priv->stations[i], bssid, ETH_ALEN);
3919         ipw_write_direct(priv, IPW_STATION_TABLE_LOWER + i * sizeof(entry),
3920                          &entry, sizeof(entry));
3921         priv->num_stations++;
3922
3923         return i;
3924 }
3925
3926 static u8 ipw_find_station(struct ipw_priv *priv, u8 * bssid)
3927 {
3928         int i;
3929
3930         for (i = 0; i < priv->num_stations; i++)
3931                 if (ether_addr_equal(priv->stations[i], bssid))
3932                         return i;
3933
3934         return IPW_INVALID_STATION;
3935 }
3936
3937 static void ipw_send_disassociate(struct ipw_priv *priv, int quiet)
3938 {
3939         int err;
3940
3941         if (priv->status & STATUS_ASSOCIATING) {
3942                 IPW_DEBUG_ASSOC("Disassociating while associating.\n");
3943                 schedule_work(&priv->disassociate);
3944                 return;
3945         }
3946
3947         if (!(priv->status & STATUS_ASSOCIATED)) {
3948                 IPW_DEBUG_ASSOC("Disassociating while not associated.\n");
3949                 return;
3950         }
3951
3952         IPW_DEBUG_ASSOC("Disassociation attempt from %pM "
3953                         "on channel %d.\n",
3954                         priv->assoc_request.bssid,
3955                         priv->assoc_request.channel);
3956
3957         priv->status &= ~(STATUS_ASSOCIATING | STATUS_ASSOCIATED);
3958         priv->status |= STATUS_DISASSOCIATING;
3959
3960         if (quiet)
3961                 priv->assoc_request.assoc_type = HC_DISASSOC_QUIET;
3962         else
3963                 priv->assoc_request.assoc_type = HC_DISASSOCIATE;
3964
3965         err = ipw_send_associate(priv, &priv->assoc_request);
3966         if (err) {
3967                 IPW_DEBUG_HC("Attempt to send [dis]associate command "
3968                              "failed.\n");
3969                 return;
3970         }
3971
3972 }
3973
3974 static int ipw_disassociate(void *data)
3975 {
3976         struct ipw_priv *priv = data;
3977         if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)))
3978                 return 0;
3979         ipw_send_disassociate(data, 0);
3980         netif_carrier_off(priv->net_dev);
3981         return 1;
3982 }
3983
3984 static void ipw_bg_disassociate(struct work_struct *work)
3985 {
3986         struct ipw_priv *priv =
3987                 container_of(work, struct ipw_priv, disassociate);
3988         mutex_lock(&priv->mutex);
3989         ipw_disassociate(priv);
3990         mutex_unlock(&priv->mutex);
3991 }
3992
3993 static void ipw_system_config(struct work_struct *work)
3994 {
3995         struct ipw_priv *priv =
3996                 container_of(work, struct ipw_priv, system_config);
3997
3998 #ifdef CONFIG_IPW2200_PROMISCUOUS
3999         if (priv->prom_net_dev && netif_running(priv->prom_net_dev)) {
4000                 priv->sys_config.accept_all_data_frames = 1;
4001                 priv->sys_config.accept_non_directed_frames = 1;
4002                 priv->sys_config.accept_all_mgmt_bcpr = 1;
4003                 priv->sys_config.accept_all_mgmt_frames = 1;
4004         }
4005 #endif
4006
4007         ipw_send_system_config(priv);
4008 }
4009
4010 struct ipw_status_code {
4011         u16 status;
4012         const char *reason;
4013 };
4014
4015 static const struct ipw_status_code ipw_status_codes[] = {
4016         {0x00, "Successful"},
4017         {0x01, "Unspecified failure"},
4018         {0x0A, "Cannot support all requested capabilities in the "
4019          "Capability information field"},
4020         {0x0B, "Reassociation denied due to inability to confirm that "
4021          "association exists"},
4022         {0x0C, "Association denied due to reason outside the scope of this "
4023          "standard"},
4024         {0x0D,
4025          "Responding station does not support the specified authentication "
4026          "algorithm"},
4027         {0x0E,
4028          "Received an Authentication frame with authentication sequence "
4029          "transaction sequence number out of expected sequence"},
4030         {0x0F, "Authentication rejected because of challenge failure"},
4031         {0x10, "Authentication rejected due to timeout waiting for next "
4032          "frame in sequence"},
4033         {0x11, "Association denied because AP is unable to handle additional "
4034          "associated stations"},
4035         {0x12,
4036          "Association denied due to requesting station not supporting all "
4037          "of the datarates in the BSSBasicServiceSet Parameter"},
4038         {0x13,
4039          "Association denied due to requesting station not supporting "
4040          "short preamble operation"},
4041         {0x14,
4042          "Association denied due to requesting station not supporting "
4043          "PBCC encoding"},
4044         {0x15,
4045          "Association denied due to requesting station not supporting "
4046          "channel agility"},
4047         {0x19,
4048          "Association denied due to requesting station not supporting "
4049          "short slot operation"},
4050         {0x1A,
4051          "Association denied due to requesting station not supporting "
4052          "DSSS-OFDM operation"},
4053         {0x28, "Invalid Information Element"},
4054         {0x29, "Group Cipher is not valid"},
4055         {0x2A, "Pairwise Cipher is not valid"},
4056         {0x2B, "AKMP is not valid"},
4057         {0x2C, "Unsupported RSN IE version"},
4058         {0x2D, "Invalid RSN IE Capabilities"},
4059         {0x2E, "Cipher suite is rejected per security policy"},
4060 };
4061
4062 static const char *ipw_get_status_code(u16 status)
4063 {
4064         int i;
4065         for (i = 0; i < ARRAY_SIZE(ipw_status_codes); i++)
4066                 if (ipw_status_codes[i].status == (status & 0xff))
4067                         return ipw_status_codes[i].reason;
4068         return "Unknown status value.";
4069 }
4070
4071 static inline void average_init(struct average *avg)
4072 {
4073         memset(avg, 0, sizeof(*avg));
4074 }
4075
4076 #define DEPTH_RSSI 8
4077 #define DEPTH_NOISE 16
4078 static s16 exponential_average(s16 prev_avg, s16 val, u8 depth)
4079 {
4080         return ((depth-1)*prev_avg +  val)/depth;
4081 }
4082
4083 static void average_add(struct average *avg, s16 val)
4084 {
4085         avg->sum -= avg->entries[avg->pos];
4086         avg->sum += val;
4087         avg->entries[avg->pos++] = val;
4088         if (unlikely(avg->pos == AVG_ENTRIES)) {
4089                 avg->init = 1;
4090                 avg->pos = 0;
4091         }
4092 }
4093
4094 static s16 average_value(struct average *avg)
4095 {
4096         if (!unlikely(avg->init)) {
4097                 if (avg->pos)
4098                         return avg->sum / avg->pos;
4099                 return 0;
4100         }
4101
4102         return avg->sum / AVG_ENTRIES;
4103 }
4104
4105 static void ipw_reset_stats(struct ipw_priv *priv)
4106 {
4107         u32 len = sizeof(u32);
4108
4109         priv->quality = 0;
4110
4111         average_init(&priv->average_missed_beacons);
4112         priv->exp_avg_rssi = -60;
4113         priv->exp_avg_noise = -85 + 0x100;
4114
4115         priv->last_rate = 0;
4116         priv->last_missed_beacons = 0;
4117         priv->last_rx_packets = 0;
4118         priv->last_tx_packets = 0;
4119         priv->last_tx_failures = 0;
4120
4121         /* Firmware managed, reset only when NIC is restarted, so we have to
4122          * normalize on the current value */
4123         ipw_get_ordinal(priv, IPW_ORD_STAT_RX_ERR_CRC,
4124                         &priv->last_rx_err, &len);
4125         ipw_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURE,
4126                         &priv->last_tx_failures, &len);
4127
4128         /* Driver managed, reset with each association */
4129         priv->missed_adhoc_beacons = 0;
4130         priv->missed_beacons = 0;
4131         priv->tx_packets = 0;
4132         priv->rx_packets = 0;
4133
4134 }
4135
4136 static u32 ipw_get_max_rate(struct ipw_priv *priv)
4137 {
4138         u32 i = 0x80000000;
4139         u32 mask = priv->rates_mask;
4140         /* If currently associated in B mode, restrict the maximum
4141          * rate match to B rates */
4142         if (priv->assoc_request.ieee_mode == IPW_B_MODE)
4143                 mask &= LIBIPW_CCK_RATES_MASK;
4144
4145         /* TODO: Verify that the rate is supported by the current rates
4146          * list. */
4147
4148         while (i && !(mask & i))
4149                 i >>= 1;
4150         switch (i) {
4151         case LIBIPW_CCK_RATE_1MB_MASK:
4152                 return 1000000;
4153         case LIBIPW_CCK_RATE_2MB_MASK:
4154                 return 2000000;
4155         case LIBIPW_CCK_RATE_5MB_MASK:
4156                 return 5500000;
4157         case LIBIPW_OFDM_RATE_6MB_MASK:
4158                 return 6000000;
4159         case LIBIPW_OFDM_RATE_9MB_MASK:
4160                 return 9000000;
4161         case LIBIPW_CCK_RATE_11MB_MASK:
4162                 return 11000000;
4163         case LIBIPW_OFDM_RATE_12MB_MASK:
4164                 return 12000000;
4165         case LIBIPW_OFDM_RATE_18MB_MASK:
4166                 return 18000000;
4167         case LIBIPW_OFDM_RATE_24MB_MASK:
4168                 return 24000000;
4169         case LIBIPW_OFDM_RATE_36MB_MASK:
4170                 return 36000000;
4171         case LIBIPW_OFDM_RATE_48MB_MASK:
4172                 return 48000000;
4173         case LIBIPW_OFDM_RATE_54MB_MASK:
4174                 return 54000000;
4175         }
4176
4177         if (priv->ieee->mode == IEEE_B)
4178                 return 11000000;
4179         else
4180                 return 54000000;
4181 }
4182
4183 static u32 ipw_get_current_rate(struct ipw_priv *priv)
4184 {
4185         u32 rate, len = sizeof(rate);
4186         int err;
4187
4188         if (!(priv->status & STATUS_ASSOCIATED))
4189                 return 0;
4190
4191         if (priv->tx_packets > IPW_REAL_RATE_RX_PACKET_THRESHOLD) {
4192                 err = ipw_get_ordinal(priv, IPW_ORD_STAT_TX_CURR_RATE, &rate,
4193                                       &len);
4194                 if (err) {
4195                         IPW_DEBUG_INFO("failed querying ordinals.\n");
4196                         return 0;
4197                 }
4198         } else
4199                 return ipw_get_max_rate(priv);
4200
4201         switch (rate) {
4202         case IPW_TX_RATE_1MB:
4203                 return 1000000;
4204         case IPW_TX_RATE_2MB:
4205                 return 2000000;
4206         case IPW_TX_RATE_5MB:
4207                 return 5500000;
4208         case IPW_TX_RATE_6MB:
4209                 return 6000000;
4210         case IPW_TX_RATE_9MB:
4211                 return 9000000;
4212         case IPW_TX_RATE_11MB:
4213                 return 11000000;
4214         case IPW_TX_RATE_12MB:
4215                 return 12000000;
4216         case IPW_TX_RATE_18MB:
4217                 return 18000000;
4218         case IPW_TX_RATE_24MB:
4219                 return 24000000;
4220         case IPW_TX_RATE_36MB:
4221                 return 36000000;
4222         case IPW_TX_RATE_48MB:
4223                 return 48000000;
4224         case IPW_TX_RATE_54MB:
4225                 return 54000000;
4226         }
4227
4228         return 0;
4229 }
4230
4231 #define IPW_STATS_INTERVAL (2 * HZ)
4232 static void ipw_gather_stats(struct ipw_priv *priv)
4233 {
4234         u32 rx_err, rx_err_delta, rx_packets_delta;
4235         u32 tx_failures, tx_failures_delta, tx_packets_delta;
4236         u32 missed_beacons_percent, missed_beacons_delta;
4237         u32 quality = 0;
4238         u32 len = sizeof(u32);
4239         s16 rssi;
4240         u32 beacon_quality, signal_quality, tx_quality, rx_quality,
4241             rate_quality;
4242         u32 max_rate;
4243
4244         if (!(priv->status & STATUS_ASSOCIATED)) {
4245                 priv->quality = 0;
4246                 return;
4247         }
4248
4249         /* Update the statistics */
4250         ipw_get_ordinal(priv, IPW_ORD_STAT_MISSED_BEACONS,
4251                         &priv->missed_beacons, &len);
4252         missed_beacons_delta = priv->missed_beacons - priv->last_missed_beacons;
4253         priv->last_missed_beacons = priv->missed_beacons;
4254         if (priv->assoc_request.beacon_interval) {
4255                 missed_beacons_percent = missed_beacons_delta *
4256                     (HZ * le16_to_cpu(priv->assoc_request.beacon_interval)) /
4257                     (IPW_STATS_INTERVAL * 10);
4258         } else {
4259                 missed_beacons_percent = 0;
4260         }
4261         average_add(&priv->average_missed_beacons, missed_beacons_percent);
4262
4263         ipw_get_ordinal(priv, IPW_ORD_STAT_RX_ERR_CRC, &rx_err, &len);
4264         rx_err_delta = rx_err - priv->last_rx_err;
4265         priv->last_rx_err = rx_err;
4266
4267         ipw_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURE, &tx_failures, &len);
4268         tx_failures_delta = tx_failures - priv->last_tx_failures;
4269         priv->last_tx_failures = tx_failures;
4270
4271         rx_packets_delta = priv->rx_packets - priv->last_rx_packets;
4272         priv->last_rx_packets = priv->rx_packets;
4273
4274         tx_packets_delta = priv->tx_packets - priv->last_tx_packets;
4275         priv->last_tx_packets = priv->tx_packets;
4276
4277         /* Calculate quality based on the following:
4278          *
4279          * Missed beacon: 100% = 0, 0% = 70% missed
4280          * Rate: 60% = 1Mbs, 100% = Max
4281          * Rx and Tx errors represent a straight % of total Rx/Tx
4282          * RSSI: 100% = > -50,  0% = < -80
4283          * Rx errors: 100% = 0, 0% = 50% missed
4284          *
4285          * The lowest computed quality is used.
4286          *
4287          */
4288 #define BEACON_THRESHOLD 5
4289         beacon_quality = 100 - missed_beacons_percent;
4290         if (beacon_quality < BEACON_THRESHOLD)
4291                 beacon_quality = 0;
4292         else
4293                 beacon_quality = (beacon_quality - BEACON_THRESHOLD) * 100 /
4294                     (100 - BEACON_THRESHOLD);
4295         IPW_DEBUG_STATS("Missed beacon: %3d%% (%d%%)\n",
4296                         beacon_quality, missed_beacons_percent);
4297
4298         priv->last_rate = ipw_get_current_rate(priv);
4299         max_rate = ipw_get_max_rate(priv);
4300         rate_quality = priv->last_rate * 40 / max_rate + 60;
4301         IPW_DEBUG_STATS("Rate quality : %3d%% (%dMbs)\n",
4302                         rate_quality, priv->last_rate / 1000000);
4303
4304         if (rx_packets_delta > 100 && rx_packets_delta + rx_err_delta)
4305                 rx_quality = 100 - (rx_err_delta * 100) /
4306                     (rx_packets_delta + rx_err_delta);
4307         else
4308                 rx_quality = 100;
4309         IPW_DEBUG_STATS("Rx quality   : %3d%% (%u errors, %u packets)\n",
4310                         rx_quality, rx_err_delta, rx_packets_delta);
4311
4312         if (tx_packets_delta > 100 && tx_packets_delta + tx_failures_delta)
4313                 tx_quality = 100 - (tx_failures_delta * 100) /
4314                     (tx_packets_delta + tx_failures_delta);
4315         else
4316                 tx_quality = 100;
4317         IPW_DEBUG_STATS("Tx quality   : %3d%% (%u errors, %u packets)\n",
4318                         tx_quality, tx_failures_delta, tx_packets_delta);
4319
4320         rssi = priv->exp_avg_rssi;
4321         signal_quality =
4322             (100 *
4323              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) *
4324              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) -
4325              (priv->ieee->perfect_rssi - rssi) *
4326              (15 * (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) +
4327               62 * (priv->ieee->perfect_rssi - rssi))) /
4328             ((priv->ieee->perfect_rssi - priv->ieee->worst_rssi) *
4329              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi));
4330         if (signal_quality > 100)
4331                 signal_quality = 100;
4332         else if (signal_quality < 1)
4333                 signal_quality = 0;
4334
4335         IPW_DEBUG_STATS("Signal level : %3d%% (%d dBm)\n",
4336                         signal_quality, rssi);
4337
4338         quality = min(rx_quality, signal_quality);
4339         quality = min(tx_quality, quality);
4340         quality = min(rate_quality, quality);
4341         quality = min(beacon_quality, quality);
4342         if (quality == beacon_quality)
4343                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to missed beacons.\n",
4344                                 quality);
4345         if (quality == rate_quality)
4346                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to rate quality.\n",
4347                                 quality);
4348         if (quality == tx_quality)
4349                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to Tx quality.\n",
4350                                 quality);
4351         if (quality == rx_quality)
4352                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to Rx quality.\n",
4353                                 quality);
4354         if (quality == signal_quality)
4355                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to signal quality.\n",
4356                                 quality);
4357
4358         priv->quality = quality;
4359
4360         schedule_delayed_work(&priv->gather_stats, IPW_STATS_INTERVAL);
4361 }
4362
4363 static void ipw_bg_gather_stats(struct work_struct *work)
4364 {
4365         struct ipw_priv *priv =
4366                 container_of(work, struct ipw_priv, gather_stats.work);
4367         mutex_lock(&priv->mutex);
4368         ipw_gather_stats(priv);
4369         mutex_unlock(&priv->mutex);
4370 }
4371
4372 /* Missed beacon behavior:
4373  * 1st missed -> roaming_threshold, just wait, don't do any scan/roam.
4374  * roaming_threshold -> disassociate_threshold, scan and roam for better signal.
4375  * Above disassociate threshold, give up and stop scanning.
4376  * Roaming is disabled if disassociate_threshold <= roaming_threshold  */
4377 static void ipw_handle_missed_beacon(struct ipw_priv *priv,
4378                                             int missed_count)
4379 {
4380         priv->notif_missed_beacons = missed_count;
4381
4382         if (missed_count > priv->disassociate_threshold &&
4383             priv->status & STATUS_ASSOCIATED) {
4384                 /* If associated and we've hit the missed
4385                  * beacon threshold, disassociate, turn
4386                  * off roaming, and abort any active scans */
4387                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
4388                           IPW_DL_STATE | IPW_DL_ASSOC,
4389                           "Missed beacon: %d - disassociate\n", missed_count);
4390                 priv->status &= ~STATUS_ROAMING;
4391                 if (priv->status & STATUS_SCANNING) {
4392                         IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
4393                                   IPW_DL_STATE,
4394                                   "Aborting scan with missed beacon.\n");
4395                         schedule_work(&priv->abort_scan);
4396                 }
4397
4398                 schedule_work(&priv->disassociate);
4399                 return;
4400         }
4401
4402         if (priv->status & STATUS_ROAMING) {
4403                 /* If we are currently roaming, then just
4404                  * print a debug statement... */
4405                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4406                           "Missed beacon: %d - roam in progress\n",
4407                           missed_count);
4408                 return;
4409         }
4410
4411         if (roaming &&
4412             (missed_count > priv->roaming_threshold &&
4413              missed_count <= priv->disassociate_threshold)) {
4414                 /* If we are not already roaming, set the ROAM
4415                  * bit in the status and kick off a scan.
4416                  * This can happen several times before we reach
4417                  * disassociate_threshold. */
4418                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4419                           "Missed beacon: %d - initiate "
4420                           "roaming\n", missed_count);
4421                 if (!(priv->status & STATUS_ROAMING)) {
4422                         priv->status |= STATUS_ROAMING;
4423                         if (!(priv->status & STATUS_SCANNING))
4424                                 schedule_delayed_work(&priv->request_scan, 0);
4425                 }
4426                 return;
4427         }
4428
4429         if (priv->status & STATUS_SCANNING &&
4430             missed_count > IPW_MB_SCAN_CANCEL_THRESHOLD) {
4431                 /* Stop scan to keep fw from getting
4432                  * stuck (only if we aren't roaming --
4433                  * otherwise we'll never scan more than 2 or 3
4434                  * channels..) */
4435                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF | IPW_DL_STATE,
4436                           "Aborting scan with missed beacon.\n");
4437                 schedule_work(&priv->abort_scan);
4438         }
4439
4440         IPW_DEBUG_NOTIF("Missed beacon: %d\n", missed_count);
4441 }
4442
4443 static void ipw_scan_event(struct work_struct *work)
4444 {
4445         union iwreq_data wrqu;
4446
4447         struct ipw_priv *priv =
4448                 container_of(work, struct ipw_priv, scan_event.work);
4449
4450         wrqu.data.length = 0;
4451         wrqu.data.flags = 0;
4452         wireless_send_event(priv->net_dev, SIOCGIWSCAN, &wrqu, NULL);
4453 }
4454
4455 static void handle_scan_event(struct ipw_priv *priv)
4456 {
4457         /* Only userspace-requested scan completion events go out immediately */
4458         if (!priv->user_requested_scan) {
4459                 schedule_delayed_work(&priv->scan_event,
4460                                       round_jiffies_relative(msecs_to_jiffies(4000)));
4461         } else {
4462                 priv->user_requested_scan = 0;
4463                 mod_delayed_work(system_wq, &priv->scan_event, 0);
4464         }
4465 }
4466
4467 /**
4468  * Handle host notification packet.
4469  * Called from interrupt routine
4470  */
4471 static void ipw_rx_notification(struct ipw_priv *priv,
4472                                        struct ipw_rx_notification *notif)
4473 {
4474         u16 size = le16_to_cpu(notif->size);
4475
4476         IPW_DEBUG_NOTIF("type = %i (%d bytes)\n", notif->subtype, size);
4477
4478         switch (notif->subtype) {
4479         case HOST_NOTIFICATION_STATUS_ASSOCIATED:{
4480                         struct notif_association *assoc = &notif->u.assoc;
4481
4482                         switch (assoc->state) {
4483                         case CMAS_ASSOCIATED:{
4484                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4485                                                   IPW_DL_ASSOC,
4486                                                   "associated: '%*pE' %pM\n",
4487                                                   priv->essid_len, priv->essid,
4488                                                   priv->bssid);
4489
4490                                         switch (priv->ieee->iw_mode) {
4491                                         case IW_MODE_INFRA:
4492                                                 memcpy(priv->ieee->bssid,
4493                                                        priv->bssid, ETH_ALEN);
4494                                                 break;
4495
4496                                         case IW_MODE_ADHOC:
4497                                                 memcpy(priv->ieee->bssid,
4498                                                        priv->bssid, ETH_ALEN);
4499
4500                                                 /* clear out the station table */
4501                                                 priv->num_stations = 0;
4502
4503                                                 IPW_DEBUG_ASSOC
4504                                                     ("queueing adhoc check\n");
4505                                                 schedule_delayed_work(
4506                                                         &priv->adhoc_check,
4507                                                         le16_to_cpu(priv->
4508                                                         assoc_request.
4509                                                         beacon_interval));
4510                                                 break;
4511                                         }
4512
4513                                         priv->status &= ~STATUS_ASSOCIATING;
4514                                         priv->status |= STATUS_ASSOCIATED;
4515                                         schedule_work(&priv->system_config);
4516
4517 #ifdef CONFIG_IPW2200_QOS
4518 #define IPW_GET_PACKET_STYPE(x) WLAN_FC_GET_STYPE( \
4519                          le16_to_cpu(((struct ieee80211_hdr *)(x))->frame_control))
4520                                         if ((priv->status & STATUS_AUTH) &&
4521                                             (IPW_GET_PACKET_STYPE(&notif->u.raw)
4522                                              == IEEE80211_STYPE_ASSOC_RESP)) {
4523                                                 if ((sizeof
4524                                                      (struct
4525                                                       libipw_assoc_response)
4526                                                      <= size)
4527                                                     && (size <= 2314)) {
4528                                                         struct
4529                                                         libipw_rx_stats
4530                                                             stats = {
4531                                                                 .len = size - 1,
4532                                                         };
4533
4534                                                         IPW_DEBUG_QOS
4535                                                             ("QoS Associate "
4536                                                              "size %d\n", size);
4537                                                         libipw_rx_mgt(priv->
4538                                                                          ieee,
4539                                                                          (struct
4540                                                                           libipw_hdr_4addr
4541                                                                           *)
4542                                                                          &notif->u.raw, &stats);
4543                                                 }
4544                                         }
4545 #endif
4546
4547                                         schedule_work(&priv->link_up);
4548
4549                                         break;
4550                                 }
4551
4552                         case CMAS_AUTHENTICATED:{
4553                                         if (priv->
4554                                             status & (STATUS_ASSOCIATED |
4555                                                       STATUS_AUTH)) {
4556                                                 struct notif_authenticate *auth
4557                                                     = &notif->u.auth;
4558                                                 IPW_DEBUG(IPW_DL_NOTIF |
4559                                                           IPW_DL_STATE |
4560                                                           IPW_DL_ASSOC,
4561                                                           "deauthenticated: '%*pE' %pM: (0x%04X) - %s\n",
4562                                                           priv->essid_len,
4563                                                           priv->essid,
4564                                                           priv->bssid,
4565                                                           le16_to_cpu(auth->status),
4566                                                           ipw_get_status_code
4567                                                           (le16_to_cpu
4568                                                            (auth->status)));
4569
4570                                                 priv->status &=
4571                                                     ~(STATUS_ASSOCIATING |
4572                                                       STATUS_AUTH |
4573                                                       STATUS_ASSOCIATED);
4574
4575                                                 schedule_work(&priv->link_down);
4576                                                 break;
4577                                         }
4578
4579                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4580                                                   IPW_DL_ASSOC,
4581                                                   "authenticated: '%*pE' %pM\n",
4582                                                   priv->essid_len, priv->essid,
4583                                                   priv->bssid);
4584                                         break;
4585                                 }
4586
4587                         case CMAS_INIT:{
4588                                         if (priv->status & STATUS_AUTH) {
4589                                                 struct
4590                                                     libipw_assoc_response
4591                                                 *resp;
4592                                                 resp =
4593                                                     (struct
4594                                                      libipw_assoc_response
4595                                                      *)&notif->u.raw;
4596                                                 IPW_DEBUG(IPW_DL_NOTIF |
4597                                                           IPW_DL_STATE |
4598                                                           IPW_DL_ASSOC,
4599                                                           "association failed (0x%04X): %s\n",
4600                                                           le16_to_cpu(resp->status),
4601                                                           ipw_get_status_code
4602                                                           (le16_to_cpu
4603                                                            (resp->status)));
4604                                         }
4605
4606                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4607                                                   IPW_DL_ASSOC,
4608                                                   "disassociated: '%*pE' %pM\n",
4609                                                   priv->essid_len, priv->essid,
4610                                                   priv->bssid);
4611
4612                                         priv->status &=
4613                                             ~(STATUS_DISASSOCIATING |
4614                                               STATUS_ASSOCIATING |
4615                                               STATUS_ASSOCIATED | STATUS_AUTH);
4616                                         if (priv->assoc_network
4617                                             && (priv->assoc_network->
4618                                                 capability &
4619                                                 WLAN_CAPABILITY_IBSS))
4620                                                 ipw_remove_current_network
4621                                                     (priv);
4622
4623                                         schedule_work(&priv->link_down);
4624
4625                                         break;
4626                                 }
4627
4628                         case CMAS_RX_ASSOC_RESP:
4629                                 break;
4630
4631                         default:
4632                                 IPW_ERROR("assoc: unknown (%d)\n",
4633                                           assoc->state);
4634                                 break;
4635                         }
4636
4637                         break;
4638                 }
4639
4640         case HOST_NOTIFICATION_STATUS_AUTHENTICATE:{
4641                         struct notif_authenticate *auth = &notif->u.auth;
4642                         switch (auth->state) {
4643                         case CMAS_AUTHENTICATED:
4644                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4645                                           "authenticated: '%*pE' %pM\n",
4646                                           priv->essid_len, priv->essid,
4647                                           priv->bssid);
4648                                 priv->status |= STATUS_AUTH;
4649                                 break;
4650
4651                         case CMAS_INIT:
4652                                 if (priv->status & STATUS_AUTH) {
4653                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4654                                                   IPW_DL_ASSOC,
4655                                                   "authentication failed (0x%04X): %s\n",
4656                                                   le16_to_cpu(auth->status),
4657                                                   ipw_get_status_code(le16_to_cpu
4658                                                                       (auth->
4659                                                                        status)));
4660                                 }
4661                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4662                                           IPW_DL_ASSOC,
4663                                           "deauthenticated: '%*pE' %pM\n",
4664                                           priv->essid_len, priv->essid,
4665                                           priv->bssid);
4666
4667                                 priv->status &= ~(STATUS_ASSOCIATING |
4668                                                   STATUS_AUTH |
4669                                                   STATUS_ASSOCIATED);
4670
4671                                 schedule_work(&priv->link_down);
4672                                 break;
4673
4674                         case CMAS_TX_AUTH_SEQ_1:
4675                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4676                                           IPW_DL_ASSOC, "AUTH_SEQ_1\n");
4677                                 break;
4678                         case CMAS_RX_AUTH_SEQ_2:
4679                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4680                                           IPW_DL_ASSOC, "AUTH_SEQ_2\n");
4681                                 break;
4682                         case CMAS_AUTH_SEQ_1_PASS:
4683                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4684                                           IPW_DL_ASSOC, "AUTH_SEQ_1_PASS\n");
4685                                 break;
4686                         case CMAS_AUTH_SEQ_1_FAIL:
4687                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4688                                           IPW_DL_ASSOC, "AUTH_SEQ_1_FAIL\n");
4689                                 break;
4690                         case CMAS_TX_AUTH_SEQ_3:
4691                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4692                                           IPW_DL_ASSOC, "AUTH_SEQ_3\n");
4693                                 break;
4694                         case CMAS_RX_AUTH_SEQ_4:
4695                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4696                                           IPW_DL_ASSOC, "RX_AUTH_SEQ_4\n");
4697                                 break;
4698                         case CMAS_AUTH_SEQ_2_PASS:
4699                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4700                                           IPW_DL_ASSOC, "AUTH_SEQ_2_PASS\n");
4701                                 break;
4702                         case CMAS_AUTH_SEQ_2_FAIL:
4703                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4704                                           IPW_DL_ASSOC, "AUT_SEQ_2_FAIL\n");
4705                                 break;
4706                         case CMAS_TX_ASSOC:
4707                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4708                                           IPW_DL_ASSOC, "TX_ASSOC\n");
4709                                 break;
4710                         case CMAS_RX_ASSOC_RESP:
4711                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4712                                           IPW_DL_ASSOC, "RX_ASSOC_RESP\n");
4713
4714                                 break;
4715                         case CMAS_ASSOCIATED:
4716                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4717                                           IPW_DL_ASSOC, "ASSOCIATED\n");
4718                                 break;
4719                         default:
4720                                 IPW_DEBUG_NOTIF("auth: failure - %d\n",
4721                                                 auth->state);
4722                                 break;
4723                         }
4724                         break;
4725                 }
4726
4727         case HOST_NOTIFICATION_STATUS_SCAN_CHANNEL_RESULT:{
4728                         struct notif_channel_result *x =
4729                             &notif->u.channel_result;
4730
4731                         if (size == sizeof(*x)) {
4732                                 IPW_DEBUG_SCAN("Scan result for channel %d\n",
4733                                                x->channel_num);
4734                         } else {
4735                                 IPW_DEBUG_SCAN("Scan result of wrong size %d "
4736                                                "(should be %zd)\n",
4737                                                size, sizeof(*x));
4738                         }
4739                         break;
4740                 }
4741
4742         case HOST_NOTIFICATION_STATUS_SCAN_COMPLETED:{
4743                         struct notif_scan_complete *x = &notif->u.scan_complete;
4744                         if (size == sizeof(*x)) {
4745                                 IPW_DEBUG_SCAN
4746                                     ("Scan completed: type %d, %d channels, "
4747                                      "%d status\n", x->scan_type,
4748                                      x->num_channels, x->status);
4749                         } else {
4750                                 IPW_ERROR("Scan completed of wrong size %d "
4751                                           "(should be %zd)\n",
4752                                           size, sizeof(*x));
4753                         }
4754
4755                         priv->status &=
4756                             ~(STATUS_SCANNING | STATUS_SCAN_ABORTING);
4757
4758                         wake_up_interruptible(&priv->wait_state);
4759                         cancel_delayed_work(&priv->scan_check);
4760
4761                         if (priv->status & STATUS_EXIT_PENDING)
4762                                 break;
4763
4764                         priv->ieee->scans++;
4765
4766 #ifdef CONFIG_IPW2200_MONITOR
4767                         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
4768                                 priv->status |= STATUS_SCAN_FORCED;
4769                                 schedule_delayed_work(&priv->request_scan, 0);
4770                                 break;
4771                         }
4772                         priv->status &= ~STATUS_SCAN_FORCED;
4773 #endif                          /* CONFIG_IPW2200_MONITOR */
4774
4775                         /* Do queued direct scans first */
4776                         if (priv->status & STATUS_DIRECT_SCAN_PENDING)
4777                                 schedule_delayed_work(&priv->request_direct_scan, 0);
4778
4779                         if (!(priv->status & (STATUS_ASSOCIATED |
4780                                               STATUS_ASSOCIATING |
4781                                               STATUS_ROAMING |
4782                                               STATUS_DISASSOCIATING)))
4783                                 schedule_work(&priv->associate);
4784                         else if (priv->status & STATUS_ROAMING) {
4785                                 if (x->status == SCAN_COMPLETED_STATUS_COMPLETE)
4786                                         /* If a scan completed and we are in roam mode, then
4787                                          * the scan that completed was the one requested as a
4788                                          * result of entering roam... so, schedule the
4789                                          * roam work */
4790                                         schedule_work(&priv->roam);
4791                                 else
4792                                         /* Don't schedule if we aborted the scan */
4793                                         priv->status &= ~STATUS_ROAMING;
4794                         } else if (priv->status & STATUS_SCAN_PENDING)
4795                                 schedule_delayed_work(&priv->request_scan, 0);
4796                         else if (priv->config & CFG_BACKGROUND_SCAN
4797                                  && priv->status & STATUS_ASSOCIATED)
4798                                 schedule_delayed_work(&priv->request_scan,
4799                                                       round_jiffies_relative(HZ));
4800
4801                         /* Send an empty event to user space.
4802                          * We don't send the received data on the event because
4803                          * it would require us to do complex transcoding, and
4804                          * we want to minimise the work done in the irq handler
4805                          * Use a request to extract the data.
4806                          * Also, we generate this even for any scan, regardless
4807                          * on how the scan was initiated. User space can just
4808                          * sync on periodic scan to get fresh data...
4809                          * Jean II */
4810                         if (x->status == SCAN_COMPLETED_STATUS_COMPLETE)
4811                                 handle_scan_event(priv);
4812                         break;
4813                 }
4814
4815         case HOST_NOTIFICATION_STATUS_FRAG_LENGTH:{
4816                         struct notif_frag_length *x = &notif->u.frag_len;
4817
4818                         if (size == sizeof(*x))
4819                                 IPW_ERROR("Frag length: %d\n",
4820                                           le16_to_cpu(x->frag_length));
4821                         else
4822                                 IPW_ERROR("Frag length of wrong size %d "
4823                                           "(should be %zd)\n",
4824                                           size, sizeof(*x));
4825                         break;
4826                 }
4827
4828         case HOST_NOTIFICATION_STATUS_LINK_DETERIORATION:{
4829                         struct notif_link_deterioration *x =
4830                             &notif->u.link_deterioration;
4831
4832                         if (size == sizeof(*x)) {
4833                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4834                                         "link deterioration: type %d, cnt %d\n",
4835                                         x->silence_notification_type,
4836                                         x->silence_count);
4837                                 memcpy(&priv->last_link_deterioration, x,
4838                                        sizeof(*x));
4839                         } else {
4840                                 IPW_ERROR("Link Deterioration of wrong size %d "
4841                                           "(should be %zd)\n",
4842                                           size, sizeof(*x));
4843                         }
4844                         break;
4845                 }
4846
4847         case HOST_NOTIFICATION_DINO_CONFIG_RESPONSE:{
4848                         IPW_ERROR("Dino config\n");
4849                         if (priv->hcmd
4850                             && priv->hcmd->cmd != HOST_CMD_DINO_CONFIG)
4851                                 IPW_ERROR("Unexpected DINO_CONFIG_RESPONSE\n");
4852
4853                         break;
4854                 }
4855
4856         case HOST_NOTIFICATION_STATUS_BEACON_STATE:{
4857                         struct notif_beacon_state *x = &notif->u.beacon_state;
4858                         if (size != sizeof(*x)) {
4859                                 IPW_ERROR
4860                                     ("Beacon state of wrong size %d (should "
4861                                      "be %zd)\n", size, sizeof(*x));
4862                                 break;
4863                         }
4864
4865                         if (le32_to_cpu(x->state) ==
4866                             HOST_NOTIFICATION_STATUS_BEACON_MISSING)
4867                                 ipw_handle_missed_beacon(priv,
4868                                                          le32_to_cpu(x->
4869                                                                      number));
4870
4871                         break;
4872                 }
4873
4874         case HOST_NOTIFICATION_STATUS_TGI_TX_KEY:{
4875                         struct notif_tgi_tx_key *x = &notif->u.tgi_tx_key;
4876                         if (size == sizeof(*x)) {
4877                                 IPW_ERROR("TGi Tx Key: state 0x%02x sec type "
4878                                           "0x%02x station %d\n",
4879                                           x->key_state, x->security_type,
4880                                           x->station_index);
4881                                 break;
4882                         }
4883
4884                         IPW_ERROR
4885                             ("TGi Tx Key of wrong size %d (should be %zd)\n",
4886                              size, sizeof(*x));
4887                         break;
4888                 }
4889
4890         case HOST_NOTIFICATION_CALIB_KEEP_RESULTS:{
4891                         struct notif_calibration *x = &notif->u.calibration;
4892
4893                         if (size == sizeof(*x)) {
4894                                 memcpy(&priv->calib, x, sizeof(*x));
4895                                 IPW_DEBUG_INFO("TODO: Calibration\n");
4896                                 break;
4897                         }
4898
4899                         IPW_ERROR
4900                             ("Calibration of wrong size %d (should be %zd)\n",
4901                              size, sizeof(*x));
4902                         break;
4903                 }
4904
4905         case HOST_NOTIFICATION_NOISE_STATS:{
4906                         if (size == sizeof(u32)) {
4907                                 priv->exp_avg_noise =
4908                                     exponential_average(priv->exp_avg_noise,
4909                                     (u8) (le32_to_cpu(notif->u.noise.value) & 0xff),
4910                                     DEPTH_NOISE);
4911                                 break;
4912                         }
4913
4914                         IPW_ERROR
4915                             ("Noise stat is wrong size %d (should be %zd)\n",
4916                              size, sizeof(u32));
4917                         break;
4918                 }
4919
4920         default:
4921                 IPW_DEBUG_NOTIF("Unknown notification: "
4922                                 "subtype=%d,flags=0x%2x,size=%d\n",
4923                                 notif->subtype, notif->flags, size);
4924         }
4925 }
4926
4927 /**
4928  * Destroys all DMA structures and initialise them again
4929  *
4930  * @param priv
4931  * @return error code
4932  */
4933 static int ipw_queue_reset(struct ipw_priv *priv)
4934 {
4935         int rc = 0;
4936         /** @todo customize queue sizes */
4937         int nTx = 64, nTxCmd = 8;
4938         ipw_tx_queue_free(priv);
4939         /* Tx CMD queue */
4940         rc = ipw_queue_tx_init(priv, &priv->txq_cmd, nTxCmd,
4941                                IPW_TX_CMD_QUEUE_READ_INDEX,
4942                                IPW_TX_CMD_QUEUE_WRITE_INDEX,
4943                                IPW_TX_CMD_QUEUE_BD_BASE,
4944                                IPW_TX_CMD_QUEUE_BD_SIZE);
4945         if (rc) {
4946                 IPW_ERROR("Tx Cmd queue init failed\n");
4947                 goto error;
4948         }
4949         /* Tx queue(s) */
4950         rc = ipw_queue_tx_init(priv, &priv->txq[0], nTx,
4951                                IPW_TX_QUEUE_0_READ_INDEX,
4952                                IPW_TX_QUEUE_0_WRITE_INDEX,
4953                                IPW_TX_QUEUE_0_BD_BASE, IPW_TX_QUEUE_0_BD_SIZE);
4954         if (rc) {
4955                 IPW_ERROR("Tx 0 queue init failed\n");
4956                 goto error;
4957         }
4958         rc = ipw_queue_tx_init(priv, &priv->txq[1], nTx,
4959                                IPW_TX_QUEUE_1_READ_INDEX,
4960                                IPW_TX_QUEUE_1_WRITE_INDEX,
4961                                IPW_TX_QUEUE_1_BD_BASE, IPW_TX_QUEUE_1_BD_SIZE);
4962         if (rc) {
4963                 IPW_ERROR("Tx 1 queue init failed\n");
4964                 goto error;
4965         }
4966         rc = ipw_queue_tx_init(priv, &priv->txq[2], nTx,
4967                                IPW_TX_QUEUE_2_READ_INDEX,
4968                                IPW_TX_QUEUE_2_WRITE_INDEX,
4969                                IPW_TX_QUEUE_2_BD_BASE, IPW_TX_QUEUE_2_BD_SIZE);
4970         if (rc) {
4971                 IPW_ERROR("Tx 2 queue init failed\n");
4972                 goto error;
4973         }
4974         rc = ipw_queue_tx_init(priv, &priv->txq[3], nTx,
4975                                IPW_TX_QUEUE_3_READ_INDEX,
4976                                IPW_TX_QUEUE_3_WRITE_INDEX,
4977                                IPW_TX_QUEUE_3_BD_BASE, IPW_TX_QUEUE_3_BD_SIZE);
4978         if (rc) {
4979                 IPW_ERROR("Tx 3 queue init failed\n");
4980                 goto error;
4981         }
4982         /* statistics */
4983         priv->rx_bufs_min = 0;
4984         priv->rx_pend_max = 0;
4985         return rc;
4986
4987       error:
4988         ipw_tx_queue_free(priv);
4989         return rc;
4990 }
4991
4992 /**
4993  * Reclaim Tx queue entries no more used by NIC.
4994  *
4995  * When FW advances 'R' index, all entries between old and
4996  * new 'R' index need to be reclaimed. As result, some free space
4997  * forms. If there is enough free space (> low mark), wake Tx queue.
4998  *
4999  * @note Need to protect against garbage in 'R' index
5000  * @param priv
5001  * @param txq
5002  * @param qindex
5003  * @return Number of used entries remains in the queue
5004  */
5005 static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
5006                                 struct clx2_tx_queue *txq, int qindex)
5007 {
5008         u32 hw_tail;
5009         int used;
5010         struct clx2_queue *q = &txq->q;
5011
5012         hw_tail = ipw_read32(priv, q->reg_r);
5013         if (hw_tail >= q->n_bd) {
5014                 IPW_ERROR
5015                     ("Read index for DMA queue (%d) is out of range [0-%d)\n",
5016                      hw_tail, q->n_bd);
5017                 goto done;
5018         }
5019         for (; q->last_used != hw_tail;
5020              q->last_used = ipw_queue_inc_wrap(q->last_used, q->n_bd)) {
5021                 ipw_queue_tx_free_tfd(priv, txq);
5022                 priv->tx_packets++;
5023         }
5024       done:
5025         if ((ipw_tx_queue_space(q) > q->low_mark) &&
5026             (qindex >= 0))
5027                 netif_wake_queue(priv->net_dev);
5028         used = q->first_empty - q->last_used;
5029         if (used < 0)
5030                 used += q->n_bd;
5031
5032         return used;
5033 }
5034
5035 static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
5036                              int len, int sync)
5037 {
5038         struct clx2_tx_queue *txq = &priv->txq_cmd;
5039         struct clx2_queue *q = &txq->q;
5040         struct tfd_frame *tfd;
5041
5042         if (ipw_tx_queue_space(q) < (sync ? 1 : 2)) {
5043                 IPW_ERROR("No space for Tx\n");
5044                 return -EBUSY;
5045         }
5046
5047         tfd = &txq->bd[q->first_empty];
5048         txq->txb[q->first_empty] = NULL;
5049
5050         memset(tfd, 0, sizeof(*tfd));
5051         tfd->control_flags.message_type = TX_HOST_COMMAND_TYPE;
5052         tfd->control_flags.control_bits = TFD_NEED_IRQ_MASK;
5053         priv->hcmd_seq++;
5054         tfd->u.cmd.index = hcmd;
5055         tfd->u.cmd.length = len;
5056         memcpy(tfd->u.cmd.payload, buf, len);
5057         q->first_empty = ipw_queue_inc_wrap(q->first_empty, q->n_bd);
5058         ipw_write32(priv, q->reg_w, q->first_empty);
5059         _ipw_read32(priv, 0x90);
5060
5061         return 0;
5062 }
5063
5064 /*
5065  * Rx theory of operation
5066  *
5067  * The host allocates 32 DMA target addresses and passes the host address
5068  * to the firmware at register IPW_RFDS_TABLE_LOWER + N * RFD_SIZE where N is
5069  * 0 to 31
5070  *
5071  * Rx Queue Indexes
5072  * The host/firmware share two index registers for managing the Rx buffers.
5073  *
5074  * The READ index maps to the first position that the firmware may be writing
5075  * to -- the driver can read up to (but not including) this position and get
5076  * good data.
5077  * The READ index is managed by the firmware once the card is enabled.
5078  *
5079  * The WRITE index maps to the last position the driver has read from -- the
5080  * position preceding WRITE is the last slot the firmware can place a packet.
5081  *
5082  * The queue is empty (no good data) if WRITE = READ - 1, and is full if
5083  * WRITE = READ.
5084  *
5085  * During initialization the host sets up the READ queue position to the first
5086  * INDEX position, and WRITE to the last (READ - 1 wrapped)
5087  *
5088  * When the firmware places a packet in a buffer it will advance the READ index
5089  * and fire the RX interrupt.  The driver can then query the READ index and
5090  * process as many packets as possible, moving the WRITE index forward as it
5091  * resets the Rx queue buffers with new memory.
5092  *
5093  * The management in the driver is as follows:
5094  * + A list of pre-allocated SKBs is stored in ipw->rxq->rx_free.  When
5095  *   ipw->rxq->free_count drops to or below RX_LOW_WATERMARK, work is scheduled
5096  *   to replensish the ipw->rxq->rx_free.
5097  * + In ipw_rx_queue_replenish (scheduled) if 'processed' != 'read' then the
5098  *   ipw->rxq is replenished and the READ INDEX is updated (updating the
5099  *   'processed' and 'read' driver indexes as well)
5100  * + A received packet is processed and handed to the kernel network stack,
5101  *   detached from the ipw->rxq.  The driver 'processed' index is updated.
5102  * + The Host/Firmware ipw->rxq is replenished at tasklet time from the rx_free
5103  *   list. If there are no allocated buffers in ipw->rxq->rx_free, the READ
5104  *   INDEX is not incremented and ipw->status(RX_STALLED) is set.  If there
5105  *   were enough free buffers and RX_STALLED is set it is cleared.
5106  *
5107  *
5108  * Driver sequence:
5109  *
5110  * ipw_rx_queue_alloc()       Allocates rx_free
5111  * ipw_rx_queue_replenish()   Replenishes rx_free list from rx_used, and calls
5112  *                            ipw_rx_queue_restock
5113  * ipw_rx_queue_restock()     Moves available buffers from rx_free into Rx
5114  *                            queue, updates firmware pointers, and updates
5115  *                            the WRITE index.  If insufficient rx_free buffers
5116  *                            are available, schedules ipw_rx_queue_replenish
5117  *
5118  * -- enable interrupts --
5119  * ISR - ipw_rx()             Detach ipw_rx_mem_buffers from pool up to the
5120  *                            READ INDEX, detaching the SKB from the pool.
5121  *                            Moves the packet buffer from queue to rx_used.
5122  *                            Calls ipw_rx_queue_restock to refill any empty
5123  *                            slots.
5124  * ...
5125  *
5126  */
5127
5128 /*
5129  * If there are slots in the RX queue that  need to be restocked,
5130  * and we have free pre-allocated buffers, fill the ranks as much
5131  * as we can pulling from rx_free.
5132  *
5133  * This moves the 'write' index forward to catch up with 'processed', and
5134  * also updates the memory address in the firmware to reference the new
5135  * target buffer.
5136  */
5137 static void ipw_rx_queue_restock(struct ipw_priv *priv)
5138 {
5139         struct ipw_rx_queue *rxq = priv->rxq;
5140         struct list_head *element;
5141         struct ipw_rx_mem_buffer *rxb;
5142         unsigned long flags;
5143         int write;
5144
5145         spin_lock_irqsave(&rxq->lock, flags);
5146         write = rxq->write;
5147         while ((ipw_rx_queue_space(rxq) > 0) && (rxq->free_count)) {
5148                 element = rxq->rx_free.next;
5149                 rxb = list_entry(element, struct ipw_rx_mem_buffer, list);
5150                 list_del(element);
5151
5152                 ipw_write32(priv, IPW_RFDS_TABLE_LOWER + rxq->write * RFD_SIZE,
5153                             rxb->dma_addr);
5154                 rxq->queue[rxq->write] = rxb;
5155                 rxq->write = (rxq->write + 1) % RX_QUEUE_SIZE;
5156                 rxq->free_count--;
5157         }
5158         spin_unlock_irqrestore(&rxq->lock, flags);
5159
5160         /* If the pre-allocated buffer pool is dropping low, schedule to
5161          * refill it */
5162         if (rxq->free_count <= RX_LOW_WATERMARK)
5163                 schedule_work(&priv->rx_replenish);
5164
5165         /* If we've added more space for the firmware to place data, tell it */
5166         if (write != rxq->write)
5167                 ipw_write32(priv, IPW_RX_WRITE_INDEX, rxq->write);
5168 }
5169
5170 /*
5171  * Move all used packet from rx_used to rx_free, allocating a new SKB for each.
5172  * Also restock the Rx queue via ipw_rx_queue_restock.
5173  *
5174  * This is called as a scheduled work item (except for during initialization)
5175  */
5176 static void ipw_rx_queue_replenish(void *data)
5177 {
5178         struct ipw_priv *priv = data;
5179         struct ipw_rx_queue *rxq = priv->rxq;
5180         struct list_head *element;
5181         struct ipw_rx_mem_buffer *rxb;
5182         unsigned long flags;
5183
5184         spin_lock_irqsave(&rxq->lock, flags);
5185         while (!list_empty(&rxq->rx_used)) {
5186                 element = rxq->rx_used.next;
5187                 rxb = list_entry(element, struct ipw_rx_mem_buffer, list);
5188                 rxb->skb = alloc_skb(IPW_RX_BUF_SIZE, GFP_ATOMIC);
5189                 if (!rxb->skb) {
5190                         printk(KERN_CRIT "%s: Can not allocate SKB buffers.\n",
5191                                priv->net_dev->name);
5192                         /* We don't reschedule replenish work here -- we will
5193                          * call the restock method and if it still needs
5194                          * more buffers it will schedule replenish */
5195                         break;
5196                 }
5197                 list_del(element);
5198
5199                 rxb->dma_addr =
5200                     pci_map_single(priv->pci_dev, rxb->skb->data,
5201                                    IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
5202
5203                 list_add_tail(&rxb->list, &rxq->rx_free);
5204                 rxq->free_count++;
5205         }
5206         spin_unlock_irqrestore(&rxq->lock, flags);
5207
5208         ipw_rx_queue_restock(priv);
5209 }
5210
5211 static void ipw_bg_rx_queue_replenish(struct work_struct *work)
5212 {
5213         struct ipw_priv *priv =
5214                 container_of(work, struct ipw_priv, rx_replenish);
5215         mutex_lock(&priv->mutex);
5216         ipw_rx_queue_replenish(priv);
5217         mutex_unlock(&priv->mutex);
5218 }
5219
5220 /* Assumes that the skb field of the buffers in 'pool' is kept accurate.
5221  * If an SKB has been detached, the POOL needs to have its SKB set to NULL
5222  * This free routine walks the list of POOL entries and if SKB is set to
5223  * non NULL it is unmapped and freed
5224  */
5225 static void ipw_rx_queue_free(struct ipw_priv *priv, struct ipw_rx_queue *rxq)
5226 {
5227         int i;
5228
5229         if (!rxq)
5230                 return;
5231
5232         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
5233                 if (rxq->pool[i].skb != NULL) {
5234                         pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
5235                                          IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
5236                         dev_kfree_skb(rxq->pool[i].skb);
5237                 }
5238         }
5239
5240         kfree(rxq);
5241 }
5242
5243 static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *priv)
5244 {
5245         struct ipw_rx_queue *rxq;
5246         int i;
5247
5248         rxq = kzalloc(sizeof(*rxq), GFP_KERNEL);
5249         if (unlikely(!rxq)) {
5250                 IPW_ERROR("memory allocation failed\n");
5251                 return NULL;
5252         }
5253         spin_lock_init(&rxq->lock);
5254         INIT_LIST_HEAD(&rxq->rx_free);
5255         INIT_LIST_HEAD(&rxq->rx_used);
5256
5257         /* Fill the rx_used queue with _all_ of the Rx buffers */
5258         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++)
5259                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
5260
5261         /* Set us so that we have processed and used all buffers, but have
5262          * not restocked the Rx queue with fresh buffers */
5263         rxq->read = rxq->write = 0;
5264         rxq->free_count = 0;
5265
5266         return rxq;
5267 }
5268
5269 static int ipw_is_rate_in_mask(struct ipw_priv *priv, int ieee_mode, u8 rate)
5270 {
5271         rate &= ~LIBIPW_BASIC_RATE_MASK;
5272         if (ieee_mode == IEEE_A) {
5273                 switch (rate) {
5274                 case LIBIPW_OFDM_RATE_6MB:
5275                         return priv->rates_mask & LIBIPW_OFDM_RATE_6MB_MASK ?
5276                             1 : 0;
5277                 case LIBIPW_OFDM_RATE_9MB:
5278                         return priv->rates_mask & LIBIPW_OFDM_RATE_9MB_MASK ?
5279                             1 : 0;
5280                 case LIBIPW_OFDM_RATE_12MB:
5281                         return priv->
5282                             rates_mask & LIBIPW_OFDM_RATE_12MB_MASK ? 1 : 0;
5283                 case LIBIPW_OFDM_RATE_18MB:
5284                         return priv->
5285                             rates_mask & LIBIPW_OFDM_RATE_18MB_MASK ? 1 : 0;
5286                 case LIBIPW_OFDM_RATE_24MB:
5287                         return priv->
5288                             rates_mask & LIBIPW_OFDM_RATE_24MB_MASK ? 1 : 0;
5289                 case LIBIPW_OFDM_RATE_36MB:
5290                         return priv->
5291                             rates_mask & LIBIPW_OFDM_RATE_36MB_MASK ? 1 : 0;
5292                 case LIBIPW_OFDM_RATE_48MB:
5293                         return priv->
5294                             rates_mask & LIBIPW_OFDM_RATE_48MB_MASK ? 1 : 0;
5295                 case LIBIPW_OFDM_RATE_54MB:
5296                         return priv->
5297                             rates_mask & LIBIPW_OFDM_RATE_54MB_MASK ? 1 : 0;
5298                 default:
5299                         return 0;
5300                 }
5301         }
5302
5303         /* B and G mixed */
5304         switch (rate) {
5305         case LIBIPW_CCK_RATE_1MB:
5306                 return priv->rates_mask & LIBIPW_CCK_RATE_1MB_MASK ? 1 : 0;
5307         case LIBIPW_CCK_RATE_2MB:
5308                 return priv->rates_mask & LIBIPW_CCK_RATE_2MB_MASK ? 1 : 0;
5309         case LIBIPW_CCK_RATE_5MB:
5310                 return priv->rates_mask & LIBIPW_CCK_RATE_5MB_MASK ? 1 : 0;
5311         case LIBIPW_CCK_RATE_11MB:
5312                 return priv->rates_mask & LIBIPW_CCK_RATE_11MB_MASK ? 1 : 0;
5313         }
5314
5315         /* If we are limited to B modulations, bail at this point */
5316         if (ieee_mode == IEEE_B)
5317                 return 0;
5318
5319         /* G */
5320         switch (rate) {
5321         case LIBIPW_OFDM_RATE_6MB:
5322                 return priv->rates_mask & LIBIPW_OFDM_RATE_6MB_MASK ? 1 : 0;
5323         case LIBIPW_OFDM_RATE_9MB:
5324                 return priv->rates_mask & LIBIPW_OFDM_RATE_9MB_MASK ? 1 : 0;
5325         case LIBIPW_OFDM_RATE_12MB:
5326                 return priv->rates_mask & LIBIPW_OFDM_RATE_12MB_MASK ? 1 : 0;
5327         case LIBIPW_OFDM_RATE_18MB:
5328                 return priv->rates_mask & LIBIPW_OFDM_RATE_18MB_MASK ? 1 : 0;
5329         case LIBIPW_OFDM_RATE_24MB:
5330                 return priv->rates_mask & LIBIPW_OFDM_RATE_24MB_MASK ? 1 : 0;
5331         case LIBIPW_OFDM_RATE_36MB:
5332                 return priv->rates_mask & LIBIPW_OFDM_RATE_36MB_MASK ? 1 : 0;
5333         case LIBIPW_OFDM_RATE_48MB:
5334                 return priv->rates_mask & LIBIPW_OFDM_RATE_48MB_MASK ? 1 : 0;
5335         case LIBIPW_OFDM_RATE_54MB:
5336                 return priv->rates_mask & LIBIPW_OFDM_RATE_54MB_MASK ? 1 : 0;
5337         }
5338
5339         return 0;
5340 }
5341
5342 static int ipw_compatible_rates(struct ipw_priv *priv,
5343                                 const struct libipw_network *network,
5344                                 struct ipw_supported_rates *rates)
5345 {
5346         int num_rates, i;
5347
5348         memset(rates, 0, sizeof(*rates));
5349         num_rates = min(network->rates_len, (u8) IPW_MAX_RATES);
5350         rates->num_rates = 0;
5351         for (i = 0; i < num_rates; i++) {
5352                 if (!ipw_is_rate_in_mask(priv, network->mode,
5353                                          network->rates[i])) {
5354
5355                         if (network->rates[i] & LIBIPW_BASIC_RATE_MASK) {
5356                                 IPW_DEBUG_SCAN("Adding masked mandatory "
5357                                                "rate %02X\n",
5358                                                network->rates[i]);
5359                                 rates->supported_rates[rates->num_rates++] =
5360                                     network->rates[i];
5361                                 continue;
5362                         }
5363
5364                         IPW_DEBUG_SCAN("Rate %02X masked : 0x%08X\n",
5365                                        network->rates[i], priv->rates_mask);
5366                         continue;
5367                 }
5368
5369                 rates->supported_rates[rates->num_rates++] = network->rates[i];
5370         }
5371
5372         num_rates = min(network->rates_ex_len,
5373                         (u8) (IPW_MAX_RATES - num_rates));
5374         for (i = 0; i < num_rates; i++) {
5375                 if (!ipw_is_rate_in_mask(priv, network->mode,
5376                                          network->rates_ex[i])) {
5377                         if (network->rates_ex[i] & LIBIPW_BASIC_RATE_MASK) {
5378                                 IPW_DEBUG_SCAN("Adding masked mandatory "
5379                                                "rate %02X\n",
5380                                                network->rates_ex[i]);
5381                                 rates->supported_rates[rates->num_rates++] =
5382                                     network->rates[i];
5383                                 continue;
5384                         }
5385
5386                         IPW_DEBUG_SCAN("Rate %02X masked : 0x%08X\n",
5387                                        network->rates_ex[i], priv->rates_mask);
5388                         continue;
5389                 }
5390
5391                 rates->supported_rates[rates->num_rates++] =
5392                     network->rates_ex[i];
5393         }
5394
5395         return 1;
5396 }
5397
5398 static void ipw_copy_rates(struct ipw_supported_rates *dest,
5399                                   const struct ipw_supported_rates *src)
5400 {
5401         u8 i;
5402         for (i = 0; i < src->num_rates; i++)
5403                 dest->supported_rates[i] = src->supported_rates[i];
5404         dest->num_rates = src->num_rates;
5405 }
5406
5407 /* TODO: Look at sniffed packets in the air to determine if the basic rate
5408  * mask should ever be used -- right now all callers to add the scan rates are
5409  * set with the modulation = CCK, so BASIC_RATE_MASK is never set... */
5410 static void ipw_add_cck_scan_rates(struct ipw_supported_rates *rates,
5411                                    u8 modulation, u32 rate_mask)
5412 {
5413         u8 basic_mask = (LIBIPW_OFDM_MODULATION == modulation) ?
5414             LIBIPW_BASIC_RATE_MASK : 0;
5415
5416         if (rate_mask & LIBIPW_CCK_RATE_1MB_MASK)
5417                 rates->supported_rates[rates->num_rates++] =
5418                     LIBIPW_BASIC_RATE_MASK | LIBIPW_CCK_RATE_1MB;
5419
5420         if (rate_mask & LIBIPW_CCK_RATE_2MB_MASK)
5421                 rates->supported_rates[rates->num_rates++] =
5422                     LIBIPW_BASIC_RATE_MASK | LIBIPW_CCK_RATE_2MB;
5423
5424         if (rate_mask & LIBIPW_CCK_RATE_5MB_MASK)
5425                 rates->supported_rates[rates->num_rates++] = basic_mask |
5426                     LIBIPW_CCK_RATE_5MB;
5427
5428         if (rate_mask & LIBIPW_CCK_RATE_11MB_MASK)
5429                 rates->supported_rates[rates->num_rates++] = basic_mask |
5430                     LIBIPW_CCK_RATE_11MB;
5431 }
5432
5433 static void ipw_add_ofdm_scan_rates(struct ipw_supported_rates *rates,
5434                                     u8 modulation, u32 rate_mask)
5435 {
5436         u8 basic_mask = (LIBIPW_OFDM_MODULATION == modulation) ?
5437             LIBIPW_BASIC_RATE_MASK : 0;
5438
5439         if (rate_mask & LIBIPW_OFDM_RATE_6MB_MASK)
5440                 rates->supported_rates[rates->num_rates++] = basic_mask |
5441                     LIBIPW_OFDM_RATE_6MB;
5442
5443         if (rate_mask & LIBIPW_OFDM_RATE_9MB_MASK)
5444                 rates->supported_rates[rates->num_rates++] =
5445                     LIBIPW_OFDM_RATE_9MB;
5446
5447         if (rate_mask & LIBIPW_OFDM_RATE_12MB_MASK)
5448                 rates->supported_rates[rates->num_rates++] = basic_mask |
5449                     LIBIPW_OFDM_RATE_12MB;
5450
5451         if (rate_mask & LIBIPW_OFDM_RATE_18MB_MASK)
5452                 rates->supported_rates[rates->num_rates++] =
5453                     LIBIPW_OFDM_RATE_18MB;
5454
5455         if (rate_mask & LIBIPW_OFDM_RATE_24MB_MASK)
5456                 rates->supported_rates[rates->num_rates++] = basic_mask |
5457                     LIBIPW_OFDM_RATE_24MB;
5458
5459         if (rate_mask & LIBIPW_OFDM_RATE_36MB_MASK)
5460                 rates->supported_rates[rates->num_rates++] =
5461                     LIBIPW_OFDM_RATE_36MB;
5462
5463         if (rate_mask & LIBIPW_OFDM_RATE_48MB_MASK)
5464                 rates->supported_rates[rates->num_rates++] =
5465                     LIBIPW_OFDM_RATE_48MB;
5466
5467         if (rate_mask & LIBIPW_OFDM_RATE_54MB_MASK)
5468                 rates->supported_rates[rates->num_rates++] =
5469                     LIBIPW_OFDM_RATE_54MB;
5470 }
5471
5472 struct ipw_network_match {
5473         struct libipw_network *network;
5474         struct ipw_supported_rates rates;
5475 };
5476
5477 static int ipw_find_adhoc_network(struct ipw_priv *priv,
5478                                   struct ipw_network_match *match,
5479                                   struct libipw_network *network,
5480                                   int roaming)
5481 {
5482         struct ipw_supported_rates rates;
5483
5484         /* Verify that this network's capability is compatible with the
5485          * current mode (AdHoc or Infrastructure) */
5486         if ((priv->ieee->iw_mode == IW_MODE_ADHOC &&
5487              !(network->capability & WLAN_CAPABILITY_IBSS))) {
5488                 IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded due to capability mismatch.\n",
5489                                 network->ssid_len, network->ssid,
5490                                 network->bssid);
5491                 return 0;
5492         }
5493
5494         if (unlikely(roaming)) {
5495                 /* If we are roaming, then ensure check if this is a valid
5496                  * network to try and roam to */
5497                 if ((network->ssid_len != match->network->ssid_len) ||
5498                     memcmp(network->ssid, match->network->ssid,
5499                            network->ssid_len)) {
5500                         IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of non-network ESSID.\n",
5501                                         network->ssid_len, network->ssid,
5502                                         network->bssid);
5503                         return 0;
5504                 }
5505         } else {
5506                 /* If an ESSID has been configured then compare the broadcast
5507                  * ESSID to ours */
5508                 if ((priv->config & CFG_STATIC_ESSID) &&
5509                     ((network->ssid_len != priv->essid_len) ||
5510                      memcmp(network->ssid, priv->essid,
5511                             min(network->ssid_len, priv->essid_len)))) {
5512                         IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of ESSID mismatch: '%*pE'.\n",
5513                                         network->ssid_len, network->ssid,
5514                                         network->bssid, priv->essid_len,
5515                                         priv->essid);
5516                         return 0;
5517                 }
5518         }
5519
5520         /* If the old network rate is better than this one, don't bother
5521          * testing everything else. */
5522
5523         if (network->time_stamp[0] < match->network->time_stamp[0]) {
5524                 IPW_DEBUG_MERGE("Network '%*pE excluded because newer than current network.\n",
5525                                 match->network->ssid_len, match->network->ssid);
5526                 return 0;
5527         } else if (network->time_stamp[1] < match->network->time_stamp[1]) {
5528                 IPW_DEBUG_MERGE("Network '%*pE excluded because newer than current network.\n",
5529                                 match->network->ssid_len, match->network->ssid);
5530                 return 0;
5531         }
5532
5533         /* Now go through and see if the requested network is valid... */
5534         if (priv->ieee->scan_age != 0 &&
5535             time_after(jiffies, network->last_scanned + priv->ieee->scan_age)) {
5536                 IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of age: %ums.\n",
5537                                 network->ssid_len, network->ssid,
5538                                 network->bssid,
5539                                 jiffies_to_msecs(jiffies -
5540                                                  network->last_scanned));
5541                 return 0;
5542         }
5543
5544         if ((priv->config & CFG_STATIC_CHANNEL) &&
5545             (network->channel != priv->channel)) {
5546                 IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of channel mismatch: %d != %d.\n",
5547                                 network->ssid_len, network->ssid,
5548                                 network->bssid,
5549                                 network->channel, priv->channel);
5550                 return 0;
5551         }
5552
5553         /* Verify privacy compatibility */
5554         if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
5555             ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
5556                 IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of privacy mismatch: %s != %s.\n",
5557                                 network->ssid_len, network->ssid,
5558                                 network->bssid,
5559                                 priv->
5560                                 capability & CAP_PRIVACY_ON ? "on" : "off",
5561                                 network->
5562                                 capability & WLAN_CAPABILITY_PRIVACY ? "on" :
5563                                 "off");
5564                 return 0;
5565         }
5566
5567         if (ether_addr_equal(network->bssid, priv->bssid)) {
5568                 IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of the same BSSID match: %pM.\n",
5569                                 network->ssid_len, network->ssid,
5570                                 network->bssid, priv->bssid);
5571                 return 0;
5572         }
5573
5574         /* Filter out any incompatible freq / mode combinations */
5575         if (!libipw_is_valid_mode(priv->ieee, network->mode)) {
5576                 IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of invalid frequency/mode combination.\n",
5577                                 network->ssid_len, network->ssid,
5578                                 network->bssid);
5579                 return 0;
5580         }
5581
5582         /* Ensure that the rates supported by the driver are compatible with
5583          * this AP, including verification of basic rates (mandatory) */
5584         if (!ipw_compatible_rates(priv, network, &rates)) {
5585                 IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because configured rate mask excludes AP mandatory rate.\n",
5586                                 network->ssid_len, network->ssid,
5587                                 network->bssid);
5588                 return 0;
5589         }
5590
5591         if (rates.num_rates == 0) {
5592                 IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of no compatible rates.\n",
5593                                 network->ssid_len, network->ssid,
5594                                 network->bssid);
5595                 return 0;
5596         }
5597
5598         /* TODO: Perform any further minimal comparititive tests.  We do not
5599          * want to put too much policy logic here; intelligent scan selection
5600          * should occur within a generic IEEE 802.11 user space tool.  */
5601
5602         /* Set up 'new' AP to this network */
5603         ipw_copy_rates(&match->rates, &rates);
5604         match->network = network;
5605         IPW_DEBUG_MERGE("Network '%*pE (%pM)' is a viable match.\n",
5606                         network->ssid_len, network->ssid, network->bssid);
5607
5608         return 1;
5609 }
5610
5611 static void ipw_merge_adhoc_network(struct work_struct *work)
5612 {
5613         struct ipw_priv *priv =
5614                 container_of(work, struct ipw_priv, merge_networks);
5615         struct libipw_network *network = NULL;
5616         struct ipw_network_match match = {
5617                 .network = priv->assoc_network
5618         };
5619
5620         if ((priv->status & STATUS_ASSOCIATED) &&
5621             (priv->ieee->iw_mode == IW_MODE_ADHOC)) {
5622                 /* First pass through ROAM process -- look for a better
5623                  * network */
5624                 unsigned long flags;
5625
5626                 spin_lock_irqsave(&priv->ieee->lock, flags);
5627                 list_for_each_entry(network, &priv->ieee->network_list, list) {
5628                         if (network != priv->assoc_network)
5629                                 ipw_find_adhoc_network(priv, &match, network,
5630                                                        1);
5631                 }
5632                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
5633
5634                 if (match.network == priv->assoc_network) {
5635                         IPW_DEBUG_MERGE("No better ADHOC in this network to "
5636                                         "merge to.\n");
5637                         return;
5638                 }
5639
5640                 mutex_lock(&priv->mutex);
5641                 if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
5642                         IPW_DEBUG_MERGE("remove network %*pE\n",
5643                                         priv->essid_len, priv->essid);
5644                         ipw_remove_current_network(priv);
5645                 }
5646
5647                 ipw_disassociate(priv);
5648                 priv->assoc_network = match.network;
5649                 mutex_unlock(&priv->mutex);
5650                 return;
5651         }
5652 }
5653
5654 static int ipw_best_network(struct ipw_priv *priv,
5655                             struct ipw_network_match *match,
5656                             struct libipw_network *network, int roaming)
5657 {
5658         struct ipw_supported_rates rates;
5659
5660         /* Verify that this network's capability is compatible with the
5661          * current mode (AdHoc or Infrastructure) */
5662         if ((priv->ieee->iw_mode == IW_MODE_INFRA &&
5663              !(network->capability & WLAN_CAPABILITY_ESS)) ||
5664             (priv->ieee->iw_mode == IW_MODE_ADHOC &&
5665              !(network->capability & WLAN_CAPABILITY_IBSS))) {
5666                 IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded due to capability mismatch.\n",
5667                                 network->ssid_len, network->ssid,
5668                                 network->bssid);
5669                 return 0;
5670         }
5671
5672         if (unlikely(roaming)) {
5673                 /* If we are roaming, then ensure check if this is a valid
5674                  * network to try and roam to */
5675                 if ((network->ssid_len != match->network->ssid_len) ||
5676                     memcmp(network->ssid, match->network->ssid,
5677                            network->ssid_len)) {
5678                         IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of non-network ESSID.\n",
5679                                         network->ssid_len, network->ssid,
5680                                         network->bssid);
5681                         return 0;
5682                 }
5683         } else {
5684                 /* If an ESSID has been configured then compare the broadcast
5685                  * ESSID to ours */
5686                 if ((priv->config & CFG_STATIC_ESSID) &&
5687                     ((network->ssid_len != priv->essid_len) ||
5688                      memcmp(network->ssid, priv->essid,
5689                             min(network->ssid_len, priv->essid_len)))) {
5690                         IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of ESSID mismatch: '%*pE'.\n",
5691                                         network->ssid_len, network->ssid,
5692                                         network->bssid, priv->essid_len,
5693                                         priv->essid);
5694                         return 0;
5695                 }
5696         }
5697
5698         /* If the old network rate is better than this one, don't bother
5699          * testing everything else. */
5700         if (match->network && match->network->stats.rssi > network->stats.rssi) {
5701                 IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because '%*pE (%pM)' has a stronger signal.\n",
5702                                 network->ssid_len, network->ssid,
5703                                 network->bssid, match->network->ssid_len,
5704                                 match->network->ssid, match->network->bssid);
5705                 return 0;
5706         }
5707
5708         /* If this network has already had an association attempt within the
5709          * last 3 seconds, do not try and associate again... */
5710         if (network->last_associate &&
5711             time_after(network->last_associate + (HZ * 3UL), jiffies)) {
5712                 IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of storming (%ums since last assoc attempt).\n",
5713                                 network->ssid_len, network->ssid,
5714                                 network->bssid,
5715                                 jiffies_to_msecs(jiffies -
5716                                                  network->last_associate));
5717                 return 0;
5718         }
5719
5720         /* Now go through and see if the requested network is valid... */
5721         if (priv->ieee->scan_age != 0 &&
5722             time_after(jiffies, network->last_scanned + priv->ieee->scan_age)) {
5723                 IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of age: %ums.\n",
5724                                 network->ssid_len, network->ssid,
5725                                 network->bssid,
5726                                 jiffies_to_msecs(jiffies -
5727                                                  network->last_scanned));
5728                 return 0;
5729         }
5730
5731         if ((priv->config & CFG_STATIC_CHANNEL) &&
5732             (network->channel != priv->channel)) {
5733                 IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of channel mismatch: %d != %d.\n",
5734                                 network->ssid_len, network->ssid,
5735                                 network->bssid,
5736                                 network->channel, priv->channel);
5737                 return 0;
5738         }
5739
5740         /* Verify privacy compatibility */
5741         if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
5742             ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
5743                 IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of privacy mismatch: %s != %s.\n",
5744                                 network->ssid_len, network->ssid,
5745                                 network->bssid,
5746                                 priv->capability & CAP_PRIVACY_ON ? "on" :
5747                                 "off",
5748                                 network->capability &
5749                                 WLAN_CAPABILITY_PRIVACY ? "on" : "off");
5750                 return 0;
5751         }
5752
5753         if ((priv->config & CFG_STATIC_BSSID) &&
5754             !ether_addr_equal(network->bssid, priv->bssid)) {
5755                 IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of BSSID mismatch: %pM.\n",
5756                                 network->ssid_len, network->ssid,
5757                                 network->bssid, priv->bssid);
5758                 return 0;
5759         }
5760
5761         /* Filter out any incompatible freq / mode combinations */
5762         if (!libipw_is_valid_mode(priv->ieee, network->mode)) {
5763                 IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of invalid frequency/mode combination.\n",
5764                                 network->ssid_len, network->ssid,
5765                                 network->bssid);
5766                 return 0;
5767         }
5768
5769         /* Filter out invalid channel in current GEO */
5770         if (!libipw_is_valid_channel(priv->ieee, network->channel)) {
5771                 IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of invalid channel in current GEO\n",
5772                                 network->ssid_len, network->ssid,
5773                                 network->bssid);
5774                 return 0;
5775         }
5776
5777         /* Ensure that the rates supported by the driver are compatible with
5778          * this AP, including verification of basic rates (mandatory) */
5779         if (!ipw_compatible_rates(priv, network, &rates)) {
5780                 IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because configured rate mask excludes AP mandatory rate.\n",
5781                                 network->ssid_len, network->ssid,
5782                                 network->bssid);
5783                 return 0;
5784         }
5785
5786         if (rates.num_rates == 0) {
5787                 IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of no compatible rates.\n",
5788                                 network->ssid_len, network->ssid,
5789                                 network->bssid);
5790                 return 0;
5791         }
5792
5793         /* TODO: Perform any further minimal comparititive tests.  We do not
5794          * want to put too much policy logic here; intelligent scan selection
5795          * should occur within a generic IEEE 802.11 user space tool.  */
5796
5797         /* Set up 'new' AP to this network */
5798         ipw_copy_rates(&match->rates, &rates);
5799         match->network = network;
5800
5801         IPW_DEBUG_ASSOC("Network '%*pE (%pM)' is a viable match.\n",
5802                         network->ssid_len, network->ssid, network->bssid);
5803
5804         return 1;
5805 }
5806
5807 static void ipw_adhoc_create(struct ipw_priv *priv,
5808                              struct libipw_network *network)
5809 {
5810         const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
5811         int i;
5812
5813         /*
5814          * For the purposes of scanning, we can set our wireless mode
5815          * to trigger scans across combinations of bands, but when it
5816          * comes to creating a new ad-hoc network, we have tell the FW
5817          * exactly which band to use.
5818          *
5819          * We also have the possibility of an invalid channel for the
5820          * chossen band.  Attempting to create a new ad-hoc network
5821          * with an invalid channel for wireless mode will trigger a
5822          * FW fatal error.
5823          *
5824          */
5825         switch (libipw_is_valid_channel(priv->ieee, priv->channel)) {
5826         case LIBIPW_52GHZ_BAND:
5827                 network->mode = IEEE_A;
5828                 i = libipw_channel_to_index(priv->ieee, priv->channel);
5829                 BUG_ON(i == -1);
5830                 if (geo->a[i].flags & LIBIPW_CH_PASSIVE_ONLY) {
5831                         IPW_WARNING("Overriding invalid channel\n");
5832                         priv->channel = geo->a[0].channel;
5833                 }
5834                 break;
5835
5836         case LIBIPW_24GHZ_BAND:
5837                 if (priv->ieee->mode & IEEE_G)
5838                         network->mode = IEEE_G;
5839                 else
5840                         network->mode = IEEE_B;
5841                 i = libipw_channel_to_index(priv->ieee, priv->channel);
5842                 BUG_ON(i == -1);
5843                 if (geo->bg[i].flags & LIBIPW_CH_PASSIVE_ONLY) {
5844                         IPW_WARNING("Overriding invalid channel\n");
5845                         priv->channel = geo->bg[0].channel;
5846                 }
5847                 break;
5848
5849         default:
5850                 IPW_WARNING("Overriding invalid channel\n");
5851                 if (priv->ieee->mode & IEEE_A) {
5852                         network->mode = IEEE_A;
5853                         priv->channel = geo->a[0].channel;
5854                 } else if (priv->ieee->mode & IEEE_G) {
5855                         network->mode = IEEE_G;
5856                         priv->channel = geo->bg[0].channel;
5857                 } else {
5858                         network->mode = IEEE_B;
5859                         priv->channel = geo->bg[0].channel;
5860                 }
5861                 break;
5862         }
5863
5864         network->channel = priv->channel;
5865         priv->config |= CFG_ADHOC_PERSIST;
5866         ipw_create_bssid(priv, network->bssid);
5867         network->ssid_len = priv->essid_len;
5868         memcpy(network->ssid, priv->essid, priv->essid_len);
5869         memset(&network->stats, 0, sizeof(network->stats));
5870         network->capability = WLAN_CAPABILITY_IBSS;
5871         if (!(priv->config & CFG_PREAMBLE_LONG))
5872                 network->capability |= WLAN_CAPABILITY_SHORT_PREAMBLE;
5873         if (priv->capability & CAP_PRIVACY_ON)
5874                 network->capability |= WLAN_CAPABILITY_PRIVACY;
5875         network->rates_len = min(priv->rates.num_rates, MAX_RATES_LENGTH);
5876         memcpy(network->rates, priv->rates.supported_rates, network->rates_len);
5877         network->rates_ex_len = priv->rates.num_rates - network->rates_len;
5878         memcpy(network->rates_ex,
5879                &priv->rates.supported_rates[network->rates_len],
5880                network->rates_ex_len);
5881         network->last_scanned = 0;
5882         network->flags = 0;
5883         network->last_associate = 0;
5884         network->time_stamp[0] = 0;
5885         network->time_stamp[1] = 0;
5886         network->beacon_interval = 100; /* Default */
5887         network->listen_interval = 10;  /* Default */
5888         network->atim_window = 0;       /* Default */
5889         network->wpa_ie_len = 0;
5890         network->rsn_ie_len = 0;
5891 }
5892
5893 static void ipw_send_tgi_tx_key(struct ipw_priv *priv, int type, int index)
5894 {
5895         struct ipw_tgi_tx_key key;
5896
5897         if (!(priv->ieee->sec.flags & (1 << index)))
5898                 return;
5899
5900         key.key_id = index;
5901         memcpy(key.key, priv->ieee->sec.keys[index], SCM_TEMPORAL_KEY_LENGTH);
5902         key.security_type = type;
5903         key.station_index = 0;  /* always 0 for BSS */
5904         key.flags = 0;
5905         /* 0 for new key; previous value of counter (after fatal error) */
5906         key.tx_counter[0] = cpu_to_le32(0);
5907         key.tx_counter[1] = cpu_to_le32(0);
5908
5909         ipw_send_cmd_pdu(priv, IPW_CMD_TGI_TX_KEY, sizeof(key), &key);
5910 }
5911
5912 static void ipw_send_wep_keys(struct ipw_priv *priv, int type)
5913 {
5914         struct ipw_wep_key key;
5915         int i;
5916
5917         key.cmd_id = DINO_CMD_WEP_KEY;
5918         key.seq_num = 0;
5919
5920         /* Note: AES keys cannot be set for multiple times.
5921          * Only set it at the first time. */
5922         for (i = 0; i < 4; i++) {
5923                 key.key_index = i | type;
5924                 if (!(priv->ieee->sec.flags & (1 << i))) {
5925                         key.key_size = 0;
5926                         continue;
5927                 }
5928
5929                 key.key_size = priv->ieee->sec.key_sizes[i];
5930                 memcpy(key.key, priv->ieee->sec.keys[i], key.key_size);
5931
5932                 ipw_send_cmd_pdu(priv, IPW_CMD_WEP_KEY, sizeof(key), &key);
5933         }
5934 }
5935
5936 static void ipw_set_hw_decrypt_unicast(struct ipw_priv *priv, int level)
5937 {
5938         if (priv->ieee->host_encrypt)
5939                 return;
5940
5941         switch (level) {
5942         case SEC_LEVEL_3:
5943                 priv->sys_config.disable_unicast_decryption = 0;
5944                 priv->ieee->host_decrypt = 0;
5945                 break;
5946         case SEC_LEVEL_2:
5947                 priv->sys_config.disable_unicast_decryption = 1;
5948                 priv->ieee->host_decrypt = 1;
5949                 break;
5950         case SEC_LEVEL_1:
5951                 priv->sys_config.disable_unicast_decryption = 0;
5952                 priv->ieee->host_decrypt = 0;
5953                 break;
5954         case SEC_LEVEL_0:
5955                 priv->sys_config.disable_unicast_decryption = 1;
5956                 break;
5957         default:
5958                 break;
5959         }
5960 }
5961
5962 static void ipw_set_hw_decrypt_multicast(struct ipw_priv *priv, int level)
5963 {
5964         if (priv->ieee->host_encrypt)
5965                 return;
5966
5967         switch (level) {
5968         case SEC_LEVEL_3:
5969                 priv->sys_config.disable_multicast_decryption = 0;
5970                 break;
5971         case SEC_LEVEL_2:
5972                 priv->sys_config.disable_multicast_decryption = 1;
5973                 break;
5974         case SEC_LEVEL_1:
5975                 priv->sys_config.disable_multicast_decryption = 0;
5976                 break;
5977         case SEC_LEVEL_0:
5978                 priv->sys_config.disable_multicast_decryption = 1;
5979                 break;
5980         default:
5981                 break;
5982         }
5983 }
5984
5985 static void ipw_set_hwcrypto_keys(struct ipw_priv *priv)
5986 {
5987         switch (priv->ieee->sec.level) {
5988         case SEC_LEVEL_3:
5989                 if (priv->ieee->sec.flags & SEC_ACTIVE_KEY)
5990                         ipw_send_tgi_tx_key(priv,
5991                                             DCT_FLAG_EXT_SECURITY_CCM,
5992                                             priv->ieee->sec.active_key);
5993
5994                 if (!priv->ieee->host_mc_decrypt)
5995                         ipw_send_wep_keys(priv, DCW_WEP_KEY_SEC_TYPE_CCM);
5996                 break;
5997         case SEC_LEVEL_2:
5998                 if (priv->ieee->sec.flags & SEC_ACTIVE_KEY)
5999                         ipw_send_tgi_tx_key(priv,
6000                                             DCT_FLAG_EXT_SECURITY_TKIP,
6001                                             priv->ieee->sec.active_key);
6002                 break;
6003         case SEC_LEVEL_1:
6004                 ipw_send_wep_keys(priv, DCW_WEP_KEY_SEC_TYPE_WEP);
6005                 ipw_set_hw_decrypt_unicast(priv, priv->ieee->sec.level);
6006                 ipw_set_hw_decrypt_multicast(priv, priv->ieee->sec.level);
6007                 break;
6008         case SEC_LEVEL_0:
6009         default:
6010                 break;
6011         }
6012 }
6013
6014 static void ipw_adhoc_check(void *data)
6015 {
6016         struct ipw_priv *priv = data;
6017
6018         if (priv->missed_adhoc_beacons++ > priv->disassociate_threshold &&
6019             !(priv->config & CFG_ADHOC_PERSIST)) {
6020                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
6021                           IPW_DL_STATE | IPW_DL_ASSOC,
6022                           "Missed beacon: %d - disassociate\n",
6023                           priv->missed_adhoc_beacons);
6024                 ipw_remove_current_network(priv);
6025                 ipw_disassociate(priv);
6026                 return;
6027         }
6028
6029         schedule_delayed_work(&priv->adhoc_check,
6030                               le16_to_cpu(priv->assoc_request.beacon_interval));
6031 }
6032
6033 static void ipw_bg_adhoc_check(struct work_struct *work)
6034 {
6035         struct ipw_priv *priv =
6036                 container_of(work, struct ipw_priv, adhoc_check.work);
6037         mutex_lock(&priv->mutex);
6038         ipw_adhoc_check(priv);
6039         mutex_unlock(&priv->mutex);
6040 }
6041
6042 static void ipw_debug_config(struct ipw_priv *priv)
6043 {
6044         IPW_DEBUG_INFO("Scan completed, no valid APs matched "
6045                        "[CFG 0x%08X]\n", priv->config);
6046         if (priv->config & CFG_STATIC_CHANNEL)
6047                 IPW_DEBUG_INFO("Channel locked to %d\n", priv->channel);
6048         else
6049                 IPW_DEBUG_INFO("Channel unlocked.\n");
6050         if (priv->config & CFG_STATIC_ESSID)
6051                 IPW_DEBUG_INFO("ESSID locked to '%*pE'\n",
6052                                priv->essid_len, priv->essid);
6053         else
6054                 IPW_DEBUG_INFO("ESSID unlocked.\n");
6055         if (priv->config & CFG_STATIC_BSSID)
6056                 IPW_DEBUG_INFO("BSSID locked to %pM\n", priv->bssid);
6057         else
6058                 IPW_DEBUG_INFO("BSSID unlocked.\n");
6059         if (priv->capability & CAP_PRIVACY_ON)
6060                 IPW_DEBUG_INFO("PRIVACY on\n");
6061         else
6062                 IPW_DEBUG_INFO("PRIVACY off\n");
6063         IPW_DEBUG_INFO("RATE MASK: 0x%08X\n", priv->rates_mask);
6064 }
6065
6066 static void ipw_set_fixed_rate(struct ipw_priv *priv, int mode)
6067 {
6068         /* TODO: Verify that this works... */
6069         struct ipw_fixed_rate fr;
6070         u32 reg;
6071         u16 mask = 0;
6072         u16 new_tx_rates = priv->rates_mask;
6073
6074         /* Identify 'current FW band' and match it with the fixed
6075          * Tx rates */
6076
6077         switch (priv->ieee->freq_band) {
6078         case LIBIPW_52GHZ_BAND: /* A only */
6079                 /* IEEE_A */
6080                 if (priv->rates_mask & ~LIBIPW_OFDM_RATES_MASK) {
6081                         /* Invalid fixed rate mask */
6082                         IPW_DEBUG_WX
6083                             ("invalid fixed rate mask in ipw_set_fixed_rate\n");
6084                         new_tx_rates = 0;
6085                         break;
6086                 }
6087
6088                 new_tx_rates >>= LIBIPW_OFDM_SHIFT_MASK_A;
6089                 break;
6090
6091         default:                /* 2.4Ghz or Mixed */
6092                 /* IEEE_B */
6093                 if (mode == IEEE_B) {
6094                         if (new_tx_rates & ~LIBIPW_CCK_RATES_MASK) {
6095                                 /* Invalid fixed rate mask */
6096                                 IPW_DEBUG_WX
6097                                     ("invalid fixed rate mask in ipw_set_fixed_rate\n");
6098                                 new_tx_rates = 0;
6099                         }
6100                         break;
6101                 }
6102
6103                 /* IEEE_G */
6104                 if (new_tx_rates & ~(LIBIPW_CCK_RATES_MASK |
6105                                     LIBIPW_OFDM_RATES_MASK)) {
6106                         /* Invalid fixed rate mask */
6107                         IPW_DEBUG_WX
6108                             ("invalid fixed rate mask in ipw_set_fixed_rate\n");
6109                         new_tx_rates = 0;
6110                         break;
6111                 }
6112
6113                 if (LIBIPW_OFDM_RATE_6MB_MASK & new_tx_rates) {
6114                         mask |= (LIBIPW_OFDM_RATE_6MB_MASK >> 1);
6115                         new_tx_rates &= ~LIBIPW_OFDM_RATE_6MB_MASK;
6116                 }
6117
6118                 if (LIBIPW_OFDM_RATE_9MB_MASK & new_tx_rates) {
6119                         mask |= (LIBIPW_OFDM_RATE_9MB_MASK >> 1);
6120                         new_tx_rates &= ~LIBIPW_OFDM_RATE_9MB_MASK;
6121                 }
6122
6123                 if (LIBIPW_OFDM_RATE_12MB_MASK & new_tx_rates) {
6124                         mask |= (LIBIPW_OFDM_RATE_12MB_MASK >> 1);
6125                         new_tx_rates &= ~LIBIPW_OFDM_RATE_12MB_MASK;
6126                 }
6127
6128                 new_tx_rates |= mask;
6129                 break;
6130         }
6131
6132         fr.tx_rates = cpu_to_le16(new_tx_rates);
6133
6134         reg = ipw_read32(priv, IPW_MEM_FIXED_OVERRIDE);
6135         ipw_write_reg32(priv, reg, *(u32 *) & fr);
6136 }
6137
6138 static void ipw_abort_scan(struct ipw_priv *priv)
6139 {
6140         int err;
6141
6142         if (priv->status & STATUS_SCAN_ABORTING) {
6143                 IPW_DEBUG_HC("Ignoring concurrent scan abort request.\n");
6144                 return;
6145         }
6146         priv->status |= STATUS_SCAN_ABORTING;
6147
6148         err = ipw_send_scan_abort(priv);
6149         if (err)
6150                 IPW_DEBUG_HC("Request to abort scan failed.\n");
6151 }
6152
6153 static void ipw_add_scan_channels(struct ipw_priv *priv,
6154                                   struct ipw_scan_request_ext *scan,
6155                                   int scan_type)
6156 {
6157         int channel_index = 0;
6158         const struct libipw_geo *geo;
6159         int i;
6160
6161         geo = libipw_get_geo(priv->ieee);
6162
6163         if (priv->ieee->freq_band & LIBIPW_52GHZ_BAND) {
6164                 int start = channel_index;
6165                 for (i = 0; i < geo->a_channels; i++) {
6166                         if ((priv->status & STATUS_ASSOCIATED) &&
6167                             geo->a[i].channel == priv->channel)
6168                                 continue;
6169                         channel_index++;
6170                         scan->channels_list[channel_index] = geo->a[i].channel;
6171                         ipw_set_scan_type(scan, channel_index,
6172                                           geo->a[i].
6173                                           flags & LIBIPW_CH_PASSIVE_ONLY ?
6174                                           IPW_SCAN_PASSIVE_FULL_DWELL_SCAN :
6175                                           scan_type);
6176                 }
6177
6178                 if (start != channel_index) {
6179                         scan->channels_list[start] = (u8) (IPW_A_MODE << 6) |
6180                             (channel_index - start);
6181                         channel_index++;
6182                 }
6183         }
6184
6185         if (priv->ieee->freq_band & LIBIPW_24GHZ_BAND) {
6186                 int start = channel_index;
6187                 if (priv->config & CFG_SPEED_SCAN) {
6188                         int index;
6189                         u8 channels[LIBIPW_24GHZ_CHANNELS] = {
6190                                 /* nop out the list */
6191                                 [0] = 0
6192                         };
6193
6194                         u8 channel;
6195                         while (channel_index < IPW_SCAN_CHANNELS - 1) {
6196                                 channel =
6197                                     priv->speed_scan[priv->speed_scan_pos];
6198                                 if (channel == 0) {
6199                                         priv->speed_scan_pos = 0;
6200                                         channel = priv->speed_scan[0];
6201                                 }
6202                                 if ((priv->status & STATUS_ASSOCIATED) &&
6203                                     channel == priv->channel) {
6204                                         priv->speed_scan_pos++;
6205                                         continue;
6206                                 }
6207
6208                                 /* If this channel has already been
6209                                  * added in scan, break from loop
6210                                  * and this will be the first channel
6211                                  * in the next scan.
6212                                  */
6213                                 if (channels[channel - 1] != 0)
6214                                         break;
6215
6216                                 channels[channel - 1] = 1;
6217                                 priv->speed_scan_pos++;
6218                                 channel_index++;
6219                                 scan->channels_list[channel_index] = channel;
6220                                 index =
6221                                     libipw_channel_to_index(priv->ieee, channel);
6222                                 ipw_set_scan_type(scan, channel_index,
6223                                                   geo->bg[index].
6224                                                   flags &
6225                                                   LIBIPW_CH_PASSIVE_ONLY ?
6226                                                   IPW_SCAN_PASSIVE_FULL_DWELL_SCAN
6227                                                   : scan_type);
6228                         }
6229                 } else {
6230                         for (i = 0; i < geo->bg_channels; i++) {
6231                                 if ((priv->status & STATUS_ASSOCIATED) &&
6232                                     geo->bg[i].channel == priv->channel)
6233                                         continue;
6234                                 channel_index++;
6235                                 scan->channels_list[channel_index] =
6236                                     geo->bg[i].channel;
6237                                 ipw_set_scan_type(scan, channel_index,
6238                                                   geo->bg[i].
6239                                                   flags &
6240                                                   LIBIPW_CH_PASSIVE_ONLY ?
6241                                                   IPW_SCAN_PASSIVE_FULL_DWELL_SCAN
6242                                                   : scan_type);
6243                         }
6244                 }
6245
6246                 if (start != channel_index) {
6247                         scan->channels_list[start] = (u8) (IPW_B_MODE << 6) |
6248                             (channel_index - start);
6249                 }
6250         }
6251 }
6252
6253 static int ipw_passive_dwell_time(struct ipw_priv *priv)
6254 {
6255         /* staying on passive channels longer than the DTIM interval during a
6256          * scan, while associated, causes the firmware to cancel the scan
6257          * without notification. Hence, don't stay on passive channels longer
6258          * than the beacon interval.
6259          */
6260         if (priv->status & STATUS_ASSOCIATED
6261             && priv->assoc_network->beacon_interval > 10)
6262                 return priv->assoc_network->beacon_interval - 10;
6263         else
6264                 return 120;
6265 }
6266
6267 static int ipw_request_scan_helper(struct ipw_priv *priv, int type, int direct)
6268 {
6269         struct ipw_scan_request_ext scan;
6270         int err = 0, scan_type;
6271
6272         if (!(priv->status & STATUS_INIT) ||
6273             (priv->status & STATUS_EXIT_PENDING))
6274                 return 0;
6275
6276         mutex_lock(&priv->mutex);
6277
6278         if (direct && (priv->direct_scan_ssid_len == 0)) {
6279                 IPW_DEBUG_HC("Direct scan requested but no SSID to scan for\n");
6280                 priv->status &= ~STATUS_DIRECT_SCAN_PENDING;
6281                 goto done;
6282         }
6283
6284         if (priv->status & STATUS_SCANNING) {
6285                 IPW_DEBUG_HC("Concurrent scan requested.  Queuing.\n");
6286                 priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
6287                                         STATUS_SCAN_PENDING;
6288                 goto done;
6289         }
6290
6291         if (!(priv->status & STATUS_SCAN_FORCED) &&
6292             priv->status & STATUS_SCAN_ABORTING) {
6293                 IPW_DEBUG_HC("Scan request while abort pending.  Queuing.\n");
6294                 priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
6295                                         STATUS_SCAN_PENDING;
6296                 goto done;
6297         }
6298
6299         if (priv->status & STATUS_RF_KILL_MASK) {
6300                 IPW_DEBUG_HC("Queuing scan due to RF Kill activation\n");
6301                 priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
6302                                         STATUS_SCAN_PENDING;
6303                 goto done;
6304         }
6305
6306         memset(&scan, 0, sizeof(scan));
6307         scan.full_scan_index = cpu_to_le32(libipw_get_scans(priv->ieee));
6308
6309         if (type == IW_SCAN_TYPE_PASSIVE) {
6310                 IPW_DEBUG_WX("use passive scanning\n");
6311                 scan_type = IPW_SCAN_PASSIVE_FULL_DWELL_SCAN;
6312                 scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] =
6313                         cpu_to_le16(ipw_passive_dwell_time(priv));
6314                 ipw_add_scan_channels(priv, &scan, scan_type);
6315                 goto send_request;
6316         }
6317
6318         /* Use active scan by default. */
6319         if (priv->config & CFG_SPEED_SCAN)
6320                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
6321                         cpu_to_le16(30);
6322         else
6323                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
6324                         cpu_to_le16(20);
6325
6326         scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN] =
6327                 cpu_to_le16(20);
6328
6329         scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] =
6330                 cpu_to_le16(ipw_passive_dwell_time(priv));
6331         scan.dwell_time[IPW_SCAN_ACTIVE_DIRECT_SCAN] = cpu_to_le16(20);
6332
6333 #ifdef CONFIG_IPW2200_MONITOR
6334         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
6335                 u8 channel;
6336                 u8 band = 0;
6337
6338                 switch (libipw_is_valid_channel(priv->ieee, priv->channel)) {
6339                 case LIBIPW_52GHZ_BAND:
6340                         band = (u8) (IPW_A_MODE << 6) | 1;
6341                         channel = priv->channel;
6342                         break;
6343
6344                 case LIBIPW_24GHZ_BAND:
6345                         band = (u8) (IPW_B_MODE << 6) | 1;
6346                         channel = priv->channel;
6347                         break;
6348
6349                 default:
6350                         band = (u8) (IPW_B_MODE << 6) | 1;
6351                         channel = 9;
6352                         break;
6353                 }
6354
6355                 scan.channels_list[0] = band;
6356                 scan.channels_list[1] = channel;
6357                 ipw_set_scan_type(&scan, 1, IPW_SCAN_PASSIVE_FULL_DWELL_SCAN);
6358
6359                 /* NOTE:  The card will sit on this channel for this time
6360                  * period.  Scan aborts are timing sensitive and frequently
6361                  * result in firmware restarts.  As such, it is best to
6362                  * set a small dwell_time here and just keep re-issuing
6363                  * scans.  Otherwise fast channel hopping will not actually
6364                  * hop channels.
6365                  *
6366                  * TODO: Move SPEED SCAN support to all modes and bands */
6367                 scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] =
6368                         cpu_to_le16(2000);
6369         } else {
6370 #endif                          /* CONFIG_IPW2200_MONITOR */
6371                 /* Honor direct scans first, otherwise if we are roaming make
6372                  * this a direct scan for the current network.  Finally,
6373                  * ensure that every other scan is a fast channel hop scan */
6374                 if (direct) {
6375                         err = ipw_send_ssid(priv, priv->direct_scan_ssid,
6376                                             priv->direct_scan_ssid_len);
6377                         if (err) {
6378                                 IPW_DEBUG_HC("Attempt to send SSID command  "
6379                                              "failed\n");
6380                                 goto done;
6381                         }
6382
6383                         scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
6384                 } else if ((priv->status & STATUS_ROAMING)
6385                            || (!(priv->status & STATUS_ASSOCIATED)
6386                                && (priv->config & CFG_STATIC_ESSID)
6387                                && (le32_to_cpu(scan.full_scan_index) % 2))) {
6388                         err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
6389                         if (err) {
6390                                 IPW_DEBUG_HC("Attempt to send SSID command "
6391                                              "failed.\n");
6392                                 goto done;
6393                         }
6394
6395                         scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
6396                 } else
6397                         scan_type = IPW_SCAN_ACTIVE_BROADCAST_SCAN;
6398
6399                 ipw_add_scan_channels(priv, &scan, scan_type);
6400 #ifdef CONFIG_IPW2200_MONITOR
6401         }
6402 #endif
6403
6404 send_request:
6405         err = ipw_send_scan_request_ext(priv, &scan);
6406         if (err) {
6407                 IPW_DEBUG_HC("Sending scan command failed: %08X\n", err);
6408                 goto done;
6409         }
6410
6411         priv->status |= STATUS_SCANNING;
6412         if (direct) {
6413                 priv->status &= ~STATUS_DIRECT_SCAN_PENDING;
6414                 priv->direct_scan_ssid_len = 0;
6415         } else
6416                 priv->status &= ~STATUS_SCAN_PENDING;
6417
6418         schedule_delayed_work(&priv->scan_check, IPW_SCAN_CHECK_WATCHDOG);
6419 done:
6420         mutex_unlock(&priv->mutex);
6421         return err;
6422 }
6423
6424 static void ipw_request_passive_scan(struct work_struct *work)
6425 {
6426         struct ipw_priv *priv =
6427                 container_of(work, struct ipw_priv, request_passive_scan.work);
6428         ipw_request_scan_helper(priv, IW_SCAN_TYPE_PASSIVE, 0);
6429 }
6430
6431 static void ipw_request_scan(struct work_struct *work)
6432 {
6433         struct ipw_priv *priv =
6434                 container_of(work, struct ipw_priv, request_scan.work);
6435         ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE, 0);
6436 }
6437
6438 static void ipw_request_direct_scan(struct work_struct *work)
6439 {
6440         struct ipw_priv *priv =
6441                 container_of(work, struct ipw_priv, request_direct_scan.work);
6442         ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE, 1);
6443 }
6444
6445 static void ipw_bg_abort_scan(struct work_struct *work)
6446 {
6447         struct ipw_priv *priv =
6448                 container_of(work, struct ipw_priv, abort_scan);
6449         mutex_lock(&priv->mutex);
6450         ipw_abort_scan(priv);
6451         mutex_unlock(&priv->mutex);
6452 }
6453
6454 static int ipw_wpa_enable(struct ipw_priv *priv, int value)
6455 {
6456         /* This is called when wpa_supplicant loads and closes the driver
6457          * interface. */
6458         priv->ieee->wpa_enabled = value;
6459         return 0;
6460 }
6461
6462 static int ipw_wpa_set_auth_algs(struct ipw_priv *priv, int value)
6463 {
6464         struct libipw_device *ieee = priv->ieee;
6465         struct libipw_security sec = {
6466                 .flags = SEC_AUTH_MODE,
6467         };
6468         int ret = 0;
6469
6470         if (value & IW_AUTH_ALG_SHARED_KEY) {
6471                 sec.auth_mode = WLAN_AUTH_SHARED_KEY;
6472                 ieee->open_wep = 0;
6473         } else if (value & IW_AUTH_ALG_OPEN_SYSTEM) {
6474                 sec.auth_mode = WLAN_AUTH_OPEN;
6475                 ieee->open_wep = 1;
6476         } else if (value & IW_AUTH_ALG_LEAP) {
6477                 sec.auth_mode = WLAN_AUTH_LEAP;
6478                 ieee->open_wep = 1;
6479         } else
6480                 return -EINVAL;
6481
6482         if (ieee->set_security)
6483                 ieee->set_security(ieee->dev, &sec);
6484         else
6485                 ret = -EOPNOTSUPP;
6486
6487         return ret;
6488 }
6489
6490 static void ipw_wpa_assoc_frame(struct ipw_priv *priv, char *wpa_ie,
6491                                 int wpa_ie_len)
6492 {
6493         /* make sure WPA is enabled */
6494         ipw_wpa_enable(priv, 1);
6495 }
6496
6497 static int ipw_set_rsn_capa(struct ipw_priv *priv,
6498                             char *capabilities, int length)
6499 {
6500         IPW_DEBUG_HC("HOST_CMD_RSN_CAPABILITIES\n");
6501
6502         return ipw_send_cmd_pdu(priv, IPW_CMD_RSN_CAPABILITIES, length,
6503                                 capabilities);
6504 }
6505
6506 /*
6507  * WE-18 support
6508  */
6509
6510 /* SIOCSIWGENIE */
6511 static int ipw_wx_set_genie(struct net_device *dev,
6512                             struct iw_request_info *info,
6513                             union iwreq_data *wrqu, char *extra)
6514 {
6515         struct ipw_priv *priv = libipw_priv(dev);
6516         struct libipw_device *ieee = priv->ieee;
6517         u8 *buf;
6518         int err = 0;
6519
6520         if (wrqu->data.length > MAX_WPA_IE_LEN ||
6521             (wrqu->data.length && extra == NULL))
6522                 return -EINVAL;
6523
6524         if (wrqu->data.length) {
6525                 buf = kmemdup(extra, wrqu->data.length, GFP_KERNEL);
6526                 if (buf == NULL) {
6527                         err = -ENOMEM;
6528                         goto out;
6529                 }
6530
6531                 kfree(ieee->wpa_ie);
6532                 ieee->wpa_ie = buf;
6533                 ieee->wpa_ie_len = wrqu->data.length;
6534         } else {
6535                 kfree(ieee->wpa_ie);
6536                 ieee->wpa_ie = NULL;
6537                 ieee->wpa_ie_len = 0;
6538         }
6539
6540         ipw_wpa_assoc_frame(priv, ieee->wpa_ie, ieee->wpa_ie_len);
6541       out:
6542         return err;
6543 }
6544
6545 /* SIOCGIWGENIE */
6546 static int ipw_wx_get_genie(struct net_device *dev,
6547                             struct iw_request_info *info,
6548                             union iwreq_data *wrqu, char *extra)
6549 {
6550         struct ipw_priv *priv = libipw_priv(dev);
6551         struct libipw_device *ieee = priv->ieee;
6552         int err = 0;
6553
6554         if (ieee->wpa_ie_len == 0 || ieee->wpa_ie == NULL) {
6555                 wrqu->data.length = 0;
6556                 goto out;
6557         }
6558
6559         if (wrqu->data.length < ieee->wpa_ie_len) {
6560                 err = -E2BIG;
6561                 goto out;
6562         }
6563
6564         wrqu->data.length = ieee->wpa_ie_len;
6565         memcpy(extra, ieee->wpa_ie, ieee->wpa_ie_len);
6566
6567       out:
6568         return err;
6569 }
6570
6571 static int wext_cipher2level(int cipher)
6572 {
6573         switch (cipher) {
6574         case IW_AUTH_CIPHER_NONE:
6575                 return SEC_LEVEL_0;
6576         case IW_AUTH_CIPHER_WEP40:
6577         case IW_AUTH_CIPHER_WEP104:
6578                 return SEC_LEVEL_1;
6579         case IW_AUTH_CIPHER_TKIP:
6580                 return SEC_LEVEL_2;
6581         case IW_AUTH_CIPHER_CCMP:
6582                 return SEC_LEVEL_3;
6583         default:
6584                 return -1;
6585         }
6586 }
6587
6588 /* SIOCSIWAUTH */
6589 static int ipw_wx_set_auth(struct net_device *dev,
6590                            struct iw_request_info *info,
6591                            union iwreq_data *wrqu, char *extra)
6592 {
6593         struct ipw_priv *priv = libipw_priv(dev);
6594         struct libipw_device *ieee = priv->ieee;
6595         struct iw_param *param = &wrqu->param;
6596         struct lib80211_crypt_data *crypt;
6597         unsigned long flags;
6598         int ret = 0;
6599
6600         switch (param->flags & IW_AUTH_INDEX) {
6601         case IW_AUTH_WPA_VERSION:
6602                 break;
6603         case IW_AUTH_CIPHER_PAIRWISE:
6604                 ipw_set_hw_decrypt_unicast(priv,
6605                                            wext_cipher2level(param->value));
6606                 break;
6607         case IW_AUTH_CIPHER_GROUP:
6608                 ipw_set_hw_decrypt_multicast(priv,
6609                                              wext_cipher2level(param->value));
6610                 break;
6611         case IW_AUTH_KEY_MGMT:
6612                 /*
6613                  * ipw2200 does not use these parameters
6614                  */
6615                 break;
6616
6617         case IW_AUTH_TKIP_COUNTERMEASURES:
6618                 crypt = priv->ieee->crypt_info.crypt[priv->ieee->crypt_info.tx_keyidx];
6619                 if (!crypt || !crypt->ops->set_flags || !crypt->ops->get_flags)
6620                         break;
6621
6622                 flags = crypt->ops->get_flags(crypt->priv);
6623
6624                 if (param->value)
6625                         flags |= IEEE80211_CRYPTO_TKIP_COUNTERMEASURES;
6626                 else
6627                         flags &= ~IEEE80211_CRYPTO_TKIP_COUNTERMEASURES;
6628
6629                 crypt->ops->set_flags(flags, crypt->priv);
6630
6631                 break;
6632
6633         case IW_AUTH_DROP_UNENCRYPTED:{
6634                         /* HACK:
6635                          *
6636                          * wpa_supplicant calls set_wpa_enabled when the driver
6637                          * is loaded and unloaded, regardless of if WPA is being
6638                          * used.  No other calls are made which can be used to
6639                          * determine if encryption will be used or not prior to
6640                          * association being expected.  If encryption is not being
6641                          * used, drop_unencrypted is set to false, else true -- we
6642                          * can use this to determine if the CAP_PRIVACY_ON bit should
6643                          * be set.
6644                          */
6645                         struct libipw_security sec = {
6646                                 .flags = SEC_ENABLED,
6647                                 .enabled = param->value,
6648                         };
6649                         priv->ieee->drop_unencrypted = param->value;
6650                         /* We only change SEC_LEVEL for open mode. Others
6651                          * are set by ipw_wpa_set_encryption.
6652                          */
6653                         if (!param->value) {
6654                                 sec.flags |= SEC_LEVEL;
6655                                 sec.level = SEC_LEVEL_0;
6656                         } else {
6657                                 sec.flags |= SEC_LEVEL;
6658                                 sec.level = SEC_LEVEL_1;
6659                         }
6660                         if (priv->ieee->set_security)
6661                                 priv->ieee->set_security(priv->ieee->dev, &sec);
6662                         break;
6663                 }
6664
6665         case IW_AUTH_80211_AUTH_ALG:
6666                 ret = ipw_wpa_set_auth_algs(priv, param->value);
6667                 break;
6668
6669         case IW_AUTH_WPA_ENABLED:
6670                 ret = ipw_wpa_enable(priv, param->value);
6671                 ipw_disassociate(priv);
6672                 break;
6673
6674         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
6675                 ieee->ieee802_1x = param->value;
6676                 break;
6677
6678         case IW_AUTH_PRIVACY_INVOKED:
6679                 ieee->privacy_invoked = param->value;
6680                 break;
6681
6682         default:
6683                 return -EOPNOTSUPP;
6684         }
6685         return ret;
6686 }
6687
6688 /* SIOCGIWAUTH */
6689 static int ipw_wx_get_auth(struct net_device *dev,
6690                            struct iw_request_info *info,
6691                            union iwreq_data *wrqu, char *extra)
6692 {
6693         struct ipw_priv *priv = libipw_priv(dev);
6694         struct libipw_device *ieee = priv->ieee;
6695         struct lib80211_crypt_data *crypt;
6696         struct iw_param *param = &wrqu->param;
6697
6698         switch (param->flags & IW_AUTH_INDEX) {
6699         case IW_AUTH_WPA_VERSION:
6700         case IW_AUTH_CIPHER_PAIRWISE:
6701         case IW_AUTH_CIPHER_GROUP:
6702         case IW_AUTH_KEY_MGMT:
6703                 /*
6704                  * wpa_supplicant will control these internally
6705                  */
6706                 return -EOPNOTSUPP;
6707
6708         case IW_AUTH_TKIP_COUNTERMEASURES:
6709                 crypt = priv->ieee->crypt_info.crypt[priv->ieee->crypt_info.tx_keyidx];
6710                 if (!crypt || !crypt->ops->get_flags)
6711                         break;
6712
6713                 param->value = (crypt->ops->get_flags(crypt->priv) &
6714                                 IEEE80211_CRYPTO_TKIP_COUNTERMEASURES) ? 1 : 0;
6715
6716                 break;
6717
6718         case IW_AUTH_DROP_UNENCRYPTED:
6719                 param->value = ieee->drop_unencrypted;
6720                 break;
6721
6722         case IW_AUTH_80211_AUTH_ALG:
6723                 param->value = ieee->sec.auth_mode;
6724                 break;
6725
6726         case IW_AUTH_WPA_ENABLED:
6727                 param->value = ieee->wpa_enabled;
6728                 break;
6729
6730         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
6731                 param->value = ieee->ieee802_1x;
6732                 break;
6733
6734         case IW_AUTH_ROAMING_CONTROL:
6735         case IW_AUTH_PRIVACY_INVOKED:
6736                 param->value = ieee->privacy_invoked;
6737                 break;
6738
6739         default:
6740                 return -EOPNOTSUPP;
6741         }
6742         return 0;
6743 }
6744
6745 /* SIOCSIWENCODEEXT */
6746 static int ipw_wx_set_encodeext(struct net_device *dev,
6747                                 struct iw_request_info *info,
6748                                 union iwreq_data *wrqu, char *extra)
6749 {
6750         struct ipw_priv *priv = libipw_priv(dev);
6751         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
6752
6753         if (hwcrypto) {
6754                 if (ext->alg == IW_ENCODE_ALG_TKIP) {
6755                         /* IPW HW can't build TKIP MIC,
6756                            host decryption still needed */
6757                         if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY)
6758                                 priv->ieee->host_mc_decrypt = 1;
6759                         else {
6760                                 priv->ieee->host_encrypt = 0;
6761                                 priv->ieee->host_encrypt_msdu = 1;
6762                                 priv->ieee->host_decrypt = 1;
6763                         }
6764                 } else {
6765                         priv->ieee->host_encrypt = 0;
6766                         priv->ieee->host_encrypt_msdu = 0;
6767                         priv->ieee->host_decrypt = 0;
6768                         priv->ieee->host_mc_decrypt = 0;
6769                 }
6770         }
6771
6772         return libipw_wx_set_encodeext(priv->ieee, info, wrqu, extra);
6773 }
6774
6775 /* SIOCGIWENCODEEXT */
6776 static int ipw_wx_get_encodeext(struct net_device *dev,
6777                                 struct iw_request_info *info,
6778                                 union iwreq_data *wrqu, char *extra)
6779 {
6780         struct ipw_priv *priv = libipw_priv(dev);
6781         return libipw_wx_get_encodeext(priv->ieee, info, wrqu, extra);
6782 }
6783
6784 /* SIOCSIWMLME */
6785 static int ipw_wx_set_mlme(struct net_device *dev,
6786                            struct iw_request_info *info,
6787                            union iwreq_data *wrqu, char *extra)
6788 {
6789         struct ipw_priv *priv = libipw_priv(dev);
6790         struct iw_mlme *mlme = (struct iw_mlme *)extra;
6791         __le16 reason;
6792
6793         reason = cpu_to_le16(mlme->reason_code);
6794
6795         switch (mlme->cmd) {
6796         case IW_MLME_DEAUTH:
6797                 /* silently ignore */
6798                 break;
6799
6800         case IW_MLME_DISASSOC:
6801                 ipw_disassociate(priv);
6802                 break;
6803
6804         default:
6805                 return -EOPNOTSUPP;
6806         }
6807         return 0;
6808 }
6809
6810 #ifdef CONFIG_IPW2200_QOS
6811
6812 /* QoS */
6813 /*
6814 * get the modulation type of the current network or
6815 * the card current mode
6816 */
6817 static u8 ipw_qos_current_mode(struct ipw_priv * priv)
6818 {
6819         u8 mode = 0;
6820
6821         if (priv->status & STATUS_ASSOCIATED) {
6822                 unsigned long flags;
6823
6824                 spin_lock_irqsave(&priv->ieee->lock, flags);
6825                 mode = priv->assoc_network->mode;
6826                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
6827         } else {
6828                 mode = priv->ieee->mode;
6829         }
6830         IPW_DEBUG_QOS("QoS network/card mode %d\n", mode);
6831         return mode;
6832 }
6833
6834 /*
6835 * Handle management frame beacon and probe response
6836 */
6837 static int ipw_qos_handle_probe_response(struct ipw_priv *priv,
6838                                          int active_network,
6839                                          struct libipw_network *network)
6840 {
6841         u32 size = sizeof(struct libipw_qos_parameters);
6842
6843         if (network->capability & WLAN_CAPABILITY_IBSS)
6844                 network->qos_data.active = network->qos_data.supported;
6845
6846         if (network->flags & NETWORK_HAS_QOS_MASK) {
6847                 if (active_network &&
6848                     (network->flags & NETWORK_HAS_QOS_PARAMETERS))
6849                         network->qos_data.active = network->qos_data.supported;
6850
6851                 if ((network->qos_data.active == 1) && (active_network == 1) &&
6852                     (network->flags & NETWORK_HAS_QOS_PARAMETERS) &&
6853                     (network->qos_data.old_param_count !=
6854                      network->qos_data.param_count)) {
6855                         network->qos_data.old_param_count =
6856                             network->qos_data.param_count;
6857                         schedule_work(&priv->qos_activate);
6858                         IPW_DEBUG_QOS("QoS parameters change call "
6859                                       "qos_activate\n");
6860                 }
6861         } else {
6862                 if ((priv->ieee->mode == IEEE_B) || (network->mode == IEEE_B))
6863                         memcpy(&network->qos_data.parameters,
6864                                &def_parameters_CCK, size);
6865                 else
6866                         memcpy(&network->qos_data.parameters,
6867                                &def_parameters_OFDM, size);
6868
6869                 if ((network->qos_data.active == 1) && (active_network == 1)) {
6870                         IPW_DEBUG_QOS("QoS was disabled call qos_activate\n");
6871                         schedule_work(&priv->qos_activate);
6872                 }
6873
6874                 network->qos_data.active = 0;
6875                 network->qos_data.supported = 0;
6876         }
6877         if ((priv->status & STATUS_ASSOCIATED) &&
6878             (priv->ieee->iw_mode == IW_MODE_ADHOC) && (active_network == 0)) {
6879                 if (!ether_addr_equal(network->bssid, priv->bssid))
6880                         if (network->capability & WLAN_CAPABILITY_IBSS)
6881                                 if ((network->ssid_len ==
6882                                      priv->assoc_network->ssid_len) &&
6883                                     !memcmp(network->ssid,
6884                                             priv->assoc_network->ssid,
6885                                             network->ssid_len)) {
6886                                         schedule_work(&priv->merge_networks);
6887                                 }
6888         }
6889
6890         return 0;
6891 }
6892
6893 /*
6894 * This function set up the firmware to support QoS. It sends
6895 * IPW_CMD_QOS_PARAMETERS and IPW_CMD_WME_INFO
6896 */
6897 static int ipw_qos_activate(struct ipw_priv *priv,
6898                             struct libipw_qos_data *qos_network_data)
6899 {
6900         int err;
6901         struct libipw_qos_parameters qos_parameters[QOS_QOS_SETS];
6902         struct libipw_qos_parameters *active_one = NULL;
6903         u32 size = sizeof(struct libipw_qos_parameters);
6904         u32 burst_duration;
6905         int i;
6906         u8 type;
6907
6908         type = ipw_qos_current_mode(priv);
6909
6910         active_one = &(qos_parameters[QOS_PARAM_SET_DEF_CCK]);
6911         memcpy(active_one, priv->qos_data.def_qos_parm_CCK, size);
6912         active_one = &(qos_parameters[QOS_PARAM_SET_DEF_OFDM]);
6913         memcpy(active_one, priv->qos_data.def_qos_parm_OFDM, size);
6914
6915         if (qos_network_data == NULL) {
6916                 if (type == IEEE_B) {
6917                         IPW_DEBUG_QOS("QoS activate network mode %d\n", type);
6918                         active_one = &def_parameters_CCK;
6919                 } else
6920                         active_one = &def_parameters_OFDM;
6921
6922                 memcpy(&qos_parameters[QOS_PARAM_SET_ACTIVE], active_one, size);
6923                 burst_duration = ipw_qos_get_burst_duration(priv);
6924                 for (i = 0; i < QOS_QUEUE_NUM; i++)
6925                         qos_parameters[QOS_PARAM_SET_ACTIVE].tx_op_limit[i] =
6926                             cpu_to_le16(burst_duration);
6927         } else if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
6928                 if (type == IEEE_B) {
6929                         IPW_DEBUG_QOS("QoS activate IBSS network mode %d\n",
6930                                       type);
6931                         if (priv->qos_data.qos_enable == 0)
6932                                 active_one = &def_parameters_CCK;
6933                         else
6934                                 active_one = priv->qos_data.def_qos_parm_CCK;
6935                 } else {
6936                         if (priv->qos_data.qos_enable == 0)
6937                                 active_one = &def_parameters_OFDM;
6938                         else
6939                                 active_one = priv->qos_data.def_qos_parm_OFDM;
6940                 }
6941                 memcpy(&qos_parameters[QOS_PARAM_SET_ACTIVE], active_one, size);
6942         } else {
6943                 unsigned long flags;
6944                 int active;
6945
6946                 spin_lock_irqsave(&priv->ieee->lock, flags);
6947                 active_one = &(qos_network_data->parameters);
6948                 qos_network_data->old_param_count =
6949                     qos_network_data->param_count;
6950                 memcpy(&qos_parameters[QOS_PARAM_SET_ACTIVE], active_one, size);
6951                 active = qos_network_data->supported;
6952                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
6953
6954                 if (active == 0) {
6955                         burst_duration = ipw_qos_get_burst_duration(priv);
6956                         for (i = 0; i < QOS_QUEUE_NUM; i++)
6957                                 qos_parameters[QOS_PARAM_SET_ACTIVE].
6958                                     tx_op_limit[i] = cpu_to_le16(burst_duration);
6959                 }
6960         }
6961
6962         IPW_DEBUG_QOS("QoS sending IPW_CMD_QOS_PARAMETERS\n");
6963         err = ipw_send_qos_params_command(priv, &qos_parameters[0]);
6964         if (err)
6965                 IPW_DEBUG_QOS("QoS IPW_CMD_QOS_PARAMETERS failed\n");
6966
6967         return err;
6968 }
6969
6970 /*
6971 * send IPW_CMD_WME_INFO to the firmware
6972 */
6973 static int ipw_qos_set_info_element(struct ipw_priv *priv)
6974 {
6975         int ret = 0;
6976         struct libipw_qos_information_element qos_info;
6977
6978         if (priv == NULL)
6979                 return -1;
6980
6981         qos_info.elementID = QOS_ELEMENT_ID;
6982         qos_info.length = sizeof(struct libipw_qos_information_element) - 2;
6983
6984         qos_info.version = QOS_VERSION_1;
6985         qos_info.ac_info = 0;
6986
6987         memcpy(qos_info.qui, qos_oui, QOS_OUI_LEN);
6988         qos_info.qui_type = QOS_OUI_TYPE;
6989         qos_info.qui_subtype = QOS_OUI_INFO_SUB_TYPE;
6990
6991         ret = ipw_send_qos_info_command(priv, &qos_info);
6992         if (ret != 0) {
6993                 IPW_DEBUG_QOS("QoS error calling ipw_send_qos_info_command\n");
6994         }
6995         return ret;
6996 }
6997
6998 /*
6999 * Set the QoS parameter with the association request structure
7000 */
7001 static int ipw_qos_association(struct ipw_priv *priv,
7002                                struct libipw_network *network)
7003 {
7004         int err = 0;
7005         struct libipw_qos_data *qos_data = NULL;
7006         struct libipw_qos_data ibss_data = {
7007                 .supported = 1,
7008                 .active = 1,
7009         };
7010
7011         switch (priv->ieee->iw_mode) {
7012         case IW_MODE_ADHOC:
7013                 BUG_ON(!(network->capability & WLAN_CAPABILITY_IBSS));
7014
7015                 qos_data = &ibss_data;
7016                 break;
7017
7018         case IW_MODE_INFRA:
7019                 qos_data = &network->qos_data;
7020                 break;
7021
7022         default:
7023                 BUG();
7024                 break;
7025         }
7026
7027         err = ipw_qos_activate(priv, qos_data);
7028         if (err) {
7029                 priv->assoc_request.policy_support &= ~HC_QOS_SUPPORT_ASSOC;
7030                 return err;
7031         }
7032
7033         if (priv->qos_data.qos_enable && qos_data->supported) {
7034                 IPW_DEBUG_QOS("QoS will be enabled for this association\n");
7035                 priv->assoc_request.policy_support |= HC_QOS_SUPPORT_ASSOC;
7036                 return ipw_qos_set_info_element(priv);
7037         }
7038
7039         return 0;
7040 }
7041
7042 /*
7043 * handling the beaconing responses. if we get different QoS setting
7044 * off the network from the associated setting, adjust the QoS
7045 * setting
7046 */
7047 static int ipw_qos_association_resp(struct ipw_priv *priv,
7048                                     struct libipw_network *network)
7049 {
7050         int ret = 0;
7051         unsigned long flags;
7052         u32 size = sizeof(struct libipw_qos_parameters);
7053         int set_qos_param = 0;
7054
7055         if ((priv == NULL) || (network == NULL) ||
7056             (priv->assoc_network == NULL))
7057                 return ret;
7058
7059         if (!(priv->status & STATUS_ASSOCIATED))
7060                 return ret;
7061
7062         if ((priv->ieee->iw_mode != IW_MODE_INFRA))
7063                 return ret;
7064
7065         spin_lock_irqsave(&priv->ieee->lock, flags);
7066         if (network->flags & NETWORK_HAS_QOS_PARAMETERS) {
7067                 memcpy(&priv->assoc_network->qos_data, &network->qos_data,
7068                        sizeof(struct libipw_qos_data));
7069                 priv->assoc_network->qos_data.active = 1;
7070                 if ((network->qos_data.old_param_count !=
7071                      network->qos_data.param_count)) {
7072                         set_qos_param = 1;
7073                         network->qos_data.old_param_count =
7074                             network->qos_data.param_count;
7075                 }
7076
7077         } else {
7078                 if ((network->mode == IEEE_B) || (priv->ieee->mode == IEEE_B))
7079                         memcpy(&priv->assoc_network->qos_data.parameters,
7080                                &def_parameters_CCK, size);
7081                 else
7082                         memcpy(&priv->assoc_network->qos_data.parameters,
7083                                &def_parameters_OFDM, size);
7084                 priv->assoc_network->qos_data.active = 0;
7085                 priv->assoc_network->qos_data.supported = 0;
7086                 set_qos_param = 1;
7087         }
7088
7089         spin_unlock_irqrestore(&priv->ieee->lock, flags);
7090
7091         if (set_qos_param == 1)
7092                 schedule_work(&priv->qos_activate);
7093
7094         return ret;
7095 }
7096
7097 static u32 ipw_qos_get_burst_duration(struct ipw_priv *priv)
7098 {
7099         u32 ret = 0;
7100
7101         if (!priv)
7102                 return 0;
7103
7104         if (!(priv->ieee->modulation & LIBIPW_OFDM_MODULATION))
7105                 ret = priv->qos_data.burst_duration_CCK;
7106         else
7107                 ret = priv->qos_data.burst_duration_OFDM;
7108
7109         return ret;
7110 }
7111
7112 /*
7113 * Initialize the setting of QoS global
7114 */
7115 static void ipw_qos_init(struct ipw_priv *priv, int enable,
7116                          int burst_enable, u32 burst_duration_CCK,
7117                          u32 burst_duration_OFDM)
7118 {
7119         priv->qos_data.qos_enable = enable;
7120
7121         if (priv->qos_data.qos_enable) {
7122                 priv->qos_data.def_qos_parm_CCK = &def_qos_parameters_CCK;
7123                 priv->qos_data.def_qos_parm_OFDM = &def_qos_parameters_OFDM;
7124                 IPW_DEBUG_QOS("QoS is enabled\n");
7125         } else {
7126                 priv->qos_data.def_qos_parm_CCK = &def_parameters_CCK;
7127                 priv->qos_data.def_qos_parm_OFDM = &def_parameters_OFDM;
7128                 IPW_DEBUG_QOS("QoS is not enabled\n");
7129         }
7130
7131         priv->qos_data.burst_enable = burst_enable;
7132
7133         if (burst_enable) {
7134                 priv->qos_data.burst_duration_CCK = burst_duration_CCK;
7135                 priv->qos_data.burst_duration_OFDM = burst_duration_OFDM;
7136         } else {
7137                 priv->qos_data.burst_duration_CCK = 0;
7138                 priv->qos_data.burst_duration_OFDM = 0;
7139         }
7140 }
7141
7142 /*
7143 * map the packet priority to the right TX Queue
7144 */
7145 static int ipw_get_tx_queue_number(struct ipw_priv *priv, u16 priority)
7146 {
7147         if (priority > 7 || !priv->qos_data.qos_enable)
7148                 priority = 0;
7149
7150         return from_priority_to_tx_queue[priority] - 1;
7151 }
7152
7153 static int ipw_is_qos_active(struct net_device *dev,
7154                              struct sk_buff *skb)
7155 {
7156         struct ipw_priv *priv = libipw_priv(dev);
7157         struct libipw_qos_data *qos_data = NULL;
7158         int active, supported;
7159         u8 *daddr = skb->data + ETH_ALEN;
7160         int unicast = !is_multicast_ether_addr(daddr);
7161
7162         if (!(priv->status & STATUS_ASSOCIATED))
7163                 return 0;
7164
7165         qos_data = &priv->assoc_network->qos_data;
7166
7167         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
7168                 if (unicast == 0)
7169                         qos_data->active = 0;
7170                 else
7171                         qos_data->active = qos_data->supported;
7172         }
7173         active = qos_data->active;
7174         supported = qos_data->supported;
7175         IPW_DEBUG_QOS("QoS  %d network is QoS active %d  supported %d  "
7176                       "unicast %d\n",
7177                       priv->qos_data.qos_enable, active, supported, unicast);
7178         if (active && priv->qos_data.qos_enable)
7179                 return 1;
7180
7181         return 0;
7182
7183 }
7184 /*
7185 * add QoS parameter to the TX command
7186 */
7187 static int ipw_qos_set_tx_queue_command(struct ipw_priv *priv,
7188                                         u16 priority,
7189                                         struct tfd_data *tfd)
7190 {
7191         int tx_queue_id = 0;
7192
7193
7194         tx_queue_id = from_priority_to_tx_queue[priority] - 1;
7195         tfd->tx_flags_ext |= DCT_FLAG_EXT_QOS_ENABLED;
7196
7197         if (priv->qos_data.qos_no_ack_mask & (1UL << tx_queue_id)) {
7198                 tfd->tx_flags &= ~DCT_FLAG_ACK_REQD;
7199                 tfd->tfd.tfd_26.mchdr.qos_ctrl |= cpu_to_le16(CTRL_QOS_NO_ACK);
7200         }
7201         return 0;
7202 }
7203
7204 /*
7205 * background support to run QoS activate functionality
7206 */
7207 static void ipw_bg_qos_activate(struct work_struct *work)
7208 {
7209         struct ipw_priv *priv =
7210                 container_of(work, struct ipw_priv, qos_activate);
7211
7212         mutex_lock(&priv->mutex);
7213
7214         if (priv->status & STATUS_ASSOCIATED)
7215                 ipw_qos_activate(priv, &(priv->assoc_network->qos_data));
7216
7217         mutex_unlock(&priv->mutex);
7218 }
7219
7220 static int ipw_handle_probe_response(struct net_device *dev,
7221                                      struct libipw_probe_response *resp,
7222                                      struct libipw_network *network)
7223 {
7224         struct ipw_priv *priv = libipw_priv(dev);
7225         int active_network = ((priv->status & STATUS_ASSOCIATED) &&
7226                               (network == priv->assoc_network));
7227
7228         ipw_qos_handle_probe_response(priv, active_network, network);
7229
7230         return 0;
7231 }
7232
7233 static int ipw_handle_beacon(struct net_device *dev,
7234                              struct libipw_beacon *resp,
7235                              struct libipw_network *network)
7236 {
7237         struct ipw_priv *priv = libipw_priv(dev);
7238         int active_network = ((priv->status & STATUS_ASSOCIATED) &&
7239                               (network == priv->assoc_network));
7240
7241         ipw_qos_handle_probe_response(priv, active_network, network);
7242
7243         return 0;
7244 }
7245
7246 static int ipw_handle_assoc_response(struct net_device *dev,
7247                                      struct libipw_assoc_response *resp,
7248                                      struct libipw_network *network)
7249 {
7250         struct ipw_priv *priv = libipw_priv(dev);
7251         ipw_qos_association_resp(priv, network);
7252         return 0;
7253 }
7254
7255 static int ipw_send_qos_params_command(struct ipw_priv *priv, struct libipw_qos_parameters
7256                                        *qos_param)
7257 {
7258         return ipw_send_cmd_pdu(priv, IPW_CMD_QOS_PARAMETERS,
7259                                 sizeof(*qos_param) * 3, qos_param);
7260 }
7261
7262 static int ipw_send_qos_info_command(struct ipw_priv *priv, struct libipw_qos_information_element
7263                                      *qos_param)
7264 {
7265         return ipw_send_cmd_pdu(priv, IPW_CMD_WME_INFO, sizeof(*qos_param),
7266                                 qos_param);
7267 }
7268
7269 #endif                          /* CONFIG_IPW2200_QOS */
7270
7271 static int ipw_associate_network(struct ipw_priv *priv,
7272                                  struct libipw_network *network,
7273                                  struct ipw_supported_rates *rates, int roaming)
7274 {
7275         int err;
7276
7277         if (priv->config & CFG_FIXED_RATE)
7278                 ipw_set_fixed_rate(priv, network->mode);
7279
7280         if (!(priv->config & CFG_STATIC_ESSID)) {
7281                 priv->essid_len = min(network->ssid_len,
7282                                       (u8) IW_ESSID_MAX_SIZE);
7283                 memcpy(priv->essid, network->ssid, priv->essid_len);
7284         }
7285
7286         network->last_associate = jiffies;
7287
7288         memset(&priv->assoc_request, 0, sizeof(priv->assoc_request));
7289         priv->assoc_request.channel = network->channel;
7290         priv->assoc_request.auth_key = 0;
7291
7292         if ((priv->capability & CAP_PRIVACY_ON) &&
7293             (priv->ieee->sec.auth_mode == WLAN_AUTH_SHARED_KEY)) {
7294                 priv->assoc_request.auth_type = AUTH_SHARED_KEY;
7295                 priv->assoc_request.auth_key = priv->ieee->sec.active_key;
7296
7297                 if (priv->ieee->sec.level == SEC_LEVEL_1)
7298                         ipw_send_wep_keys(priv, DCW_WEP_KEY_SEC_TYPE_WEP);
7299
7300         } else if ((priv->capability & CAP_PRIVACY_ON) &&
7301                    (priv->ieee->sec.auth_mode == WLAN_AUTH_LEAP))
7302                 priv->assoc_request.auth_type = AUTH_LEAP;
7303         else
7304                 priv->assoc_request.auth_type = AUTH_OPEN;
7305
7306         if (priv->ieee->wpa_ie_len) {
7307                 priv->assoc_request.policy_support = cpu_to_le16(0x02); /* RSN active */
7308                 ipw_set_rsn_capa(priv, priv->ieee->wpa_ie,
7309                                  priv->ieee->wpa_ie_len);
7310         }
7311
7312         /*
7313          * It is valid for our ieee device to support multiple modes, but
7314          * when it comes to associating to a given network we have to choose
7315          * just one mode.
7316          */
7317         if (network->mode & priv->ieee->mode & IEEE_A)
7318                 priv->assoc_request.ieee_mode = IPW_A_MODE;
7319         else if (network->mode & priv->ieee->mode & IEEE_G)
7320                 priv->assoc_request.ieee_mode = IPW_G_MODE;
7321         else if (network->mode & priv->ieee->mode & IEEE_B)
7322                 priv->assoc_request.ieee_mode = IPW_B_MODE;
7323
7324         priv->assoc_request.capability = cpu_to_le16(network->capability);
7325         if ((network->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
7326             && !(priv->config & CFG_PREAMBLE_LONG)) {
7327                 priv->assoc_request.preamble_length = DCT_FLAG_SHORT_PREAMBLE;
7328         } else {
7329                 priv->assoc_request.preamble_length = DCT_FLAG_LONG_PREAMBLE;
7330
7331                 /* Clear the short preamble if we won't be supporting it */
7332                 priv->assoc_request.capability &=
7333                     ~cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE);
7334         }
7335
7336         /* Clear capability bits that aren't used in Ad Hoc */
7337         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
7338                 priv->assoc_request.capability &=
7339                     ~cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME);
7340
7341         IPW_DEBUG_ASSOC("%ssociation attempt: '%*pE', channel %d, 802.11%c [%d], %s[:%s], enc=%s%s%s%c%c\n",
7342                         roaming ? "Rea" : "A",
7343                         priv->essid_len, priv->essid,
7344                         network->channel,
7345                         ipw_modes[priv->assoc_request.ieee_mode],
7346                         rates->num_rates,
7347                         (priv->assoc_request.preamble_length ==
7348                          DCT_FLAG_LONG_PREAMBLE) ? "long" : "short",
7349                         network->capability &
7350                         WLAN_CAPABILITY_SHORT_PREAMBLE ? "short" : "long",
7351                         priv->capability & CAP_PRIVACY_ON ? "on " : "off",
7352                         priv->capability & CAP_PRIVACY_ON ?
7353                         (priv->capability & CAP_SHARED_KEY ? "(shared)" :
7354                          "(open)") : "",
7355                         priv->capability & CAP_PRIVACY_ON ? " key=" : "",
7356                         priv->capability & CAP_PRIVACY_ON ?
7357                         '1' + priv->ieee->sec.active_key : '.',
7358                         priv->capability & CAP_PRIVACY_ON ? '.' : ' ');
7359
7360         priv->assoc_request.beacon_interval = cpu_to_le16(network->beacon_interval);
7361         if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
7362             (network->time_stamp[0] == 0) && (network->time_stamp[1] == 0)) {
7363                 priv->assoc_request.assoc_type = HC_IBSS_START;
7364                 priv->assoc_request.assoc_tsf_msw = 0;
7365                 priv->assoc_request.assoc_tsf_lsw = 0;
7366         } else {
7367                 if (unlikely(roaming))
7368                         priv->assoc_request.assoc_type = HC_REASSOCIATE;
7369                 else
7370                         priv->assoc_request.assoc_type = HC_ASSOCIATE;
7371                 priv->assoc_request.assoc_tsf_msw = cpu_to_le32(network->time_stamp[1]);
7372                 priv->assoc_request.assoc_tsf_lsw = cpu_to_le32(network->time_stamp[0]);
7373         }
7374
7375         memcpy(priv->assoc_request.bssid, network->bssid, ETH_ALEN);
7376
7377         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
7378                 eth_broadcast_addr(priv->assoc_request.dest);
7379                 priv->assoc_request.atim_window = cpu_to_le16(network->atim_window);
7380         } else {
7381                 memcpy(priv->assoc_request.dest, network->bssid, ETH_ALEN);
7382                 priv->assoc_request.atim_window = 0;
7383         }
7384
7385         priv->assoc_request.listen_interval = cpu_to_le16(network->listen_interval);
7386
7387         err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
7388         if (err) {
7389                 IPW_DEBUG_HC("Attempt to send SSID command failed.\n");
7390                 return err;
7391         }
7392
7393         rates->ieee_mode = priv->assoc_request.ieee_mode;
7394         rates->purpose = IPW_RATE_CONNECT;
7395         ipw_send_supported_rates(priv, rates);
7396
7397         if (priv->assoc_request.ieee_mode == IPW_G_MODE)
7398                 priv->sys_config.dot11g_auto_detection = 1;
7399         else
7400                 priv->sys_config.dot11g_auto_detection = 0;
7401
7402         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
7403                 priv->sys_config.answer_broadcast_ssid_probe = 1;
7404         else
7405                 priv->sys_config.answer_broadcast_ssid_probe = 0;
7406
7407         err = ipw_send_system_config(priv);
7408         if (err) {
7409                 IPW_DEBUG_HC("Attempt to send sys config command failed.\n");
7410                 return err;
7411         }
7412
7413         IPW_DEBUG_ASSOC("Association sensitivity: %d\n", network->stats.rssi);
7414         err = ipw_set_sensitivity(priv, network->stats.rssi + IPW_RSSI_TO_DBM);
7415         if (err) {
7416                 IPW_DEBUG_HC("Attempt to send associate command failed.\n");
7417                 return err;
7418         }
7419
7420         /*
7421          * If preemption is enabled, it is possible for the association
7422          * to complete before we return from ipw_send_associate.  Therefore
7423          * we have to be sure and update our priviate data first.
7424          */
7425         priv->channel = network->channel;
7426         memcpy(priv->bssid, network->bssid, ETH_ALEN);
7427         priv->status |= STATUS_ASSOCIATING;
7428         priv->status &= ~STATUS_SECURITY_UPDATED;
7429
7430         priv->assoc_network = network;
7431
7432 #ifdef CONFIG_IPW2200_QOS
7433         ipw_qos_association(priv, network);
7434 #endif
7435
7436         err = ipw_send_associate(priv, &priv->assoc_request);
7437         if (err) {
7438                 IPW_DEBUG_HC("Attempt to send associate command failed.\n");
7439                 return err;
7440         }
7441
7442         IPW_DEBUG(IPW_DL_STATE, "associating: '%*pE' %pM\n",
7443                   priv->essid_len, priv->essid, priv->bssid);
7444
7445         return 0;
7446 }
7447
7448 static void ipw_roam(void *data)
7449 {
7450         struct ipw_priv *priv = data;
7451         struct libipw_network *network = NULL;
7452         struct ipw_network_match match = {
7453                 .network = priv->assoc_network
7454         };
7455
7456         /* The roaming process is as follows:
7457          *
7458          * 1.  Missed beacon threshold triggers the roaming process by
7459          *     setting the status ROAM bit and requesting a scan.
7460          * 2.  When the scan completes, it schedules the ROAM work
7461          * 3.  The ROAM work looks at all of the known networks for one that
7462          *     is a better network than the currently associated.  If none
7463          *     found, the ROAM process is over (ROAM bit cleared)
7464          * 4.  If a better network is found, a disassociation request is
7465          *     sent.
7466          * 5.  When the disassociation completes, the roam work is again
7467          *     scheduled.  The second time through, the driver is no longer
7468          *     associated, and the newly selected network is sent an
7469          *     association request.
7470          * 6.  At this point ,the roaming process is complete and the ROAM
7471          *     status bit is cleared.
7472          */
7473
7474         /* If we are no longer associated, and the roaming bit is no longer
7475          * set, then we are not actively roaming, so just return */
7476         if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ROAMING)))
7477                 return;
7478
7479         if (priv->status & STATUS_ASSOCIATED) {
7480                 /* First pass through ROAM process -- look for a better
7481                  * network */
7482                 unsigned long flags;
7483                 u8 rssi = priv->assoc_network->stats.rssi;
7484                 priv->assoc_network->stats.rssi = -128;
7485                 spin_lock_irqsave(&priv->ieee->lock, flags);
7486                 list_for_each_entry(network, &priv->ieee->network_list, list) {
7487                         if (network != priv->assoc_network)
7488                                 ipw_best_network(priv, &match, network, 1);
7489                 }
7490                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
7491                 priv->assoc_network->stats.rssi = rssi;
7492
7493                 if (match.network == priv->assoc_network) {
7494                         IPW_DEBUG_ASSOC("No better APs in this network to "
7495                                         "roam to.\n");
7496                         priv->status &= ~STATUS_ROAMING;
7497                         ipw_debug_config(priv);
7498                         return;
7499                 }
7500
7501                 ipw_send_disassociate(priv, 1);
7502                 priv->assoc_network = match.network;
7503
7504                 return;
7505         }
7506
7507         /* Second pass through ROAM process -- request association */
7508         ipw_compatible_rates(priv, priv->assoc_network, &match.rates);
7509         ipw_associate_network(priv, priv->assoc_network, &match.rates, 1);
7510         priv->status &= ~STATUS_ROAMING;
7511 }
7512
7513 static void ipw_bg_roam(struct work_struct *work)
7514 {
7515         struct ipw_priv *priv =
7516                 container_of(work, struct ipw_priv, roam);
7517         mutex_lock(&priv->mutex);
7518         ipw_roam(priv);
7519         mutex_unlock(&priv->mutex);
7520 }
7521
7522 static int ipw_associate(void *data)
7523 {
7524         struct ipw_priv *priv = data;
7525
7526         struct libipw_network *network = NULL;
7527         struct ipw_network_match match = {
7528                 .network = NULL
7529         };
7530         struct ipw_supported_rates *rates;
7531         struct list_head *element;
7532         unsigned long flags;
7533
7534         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
7535                 IPW_DEBUG_ASSOC("Not attempting association (monitor mode)\n");
7536                 return 0;
7537         }
7538
7539         if (priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
7540                 IPW_DEBUG_ASSOC("Not attempting association (already in "
7541                                 "progress)\n");
7542                 return 0;
7543         }
7544
7545         if (priv->status & STATUS_DISASSOCIATING) {
7546                 IPW_DEBUG_ASSOC("Not attempting association (in disassociating)\n");
7547                 schedule_work(&priv->associate);
7548                 return 0;
7549         }
7550
7551         if (!ipw_is_init(priv) || (priv->status & STATUS_SCANNING)) {
7552                 IPW_DEBUG_ASSOC("Not attempting association (scanning or not "
7553                                 "initialized)\n");
7554                 return 0;
7555         }
7556
7557         if (!(priv->config & CFG_ASSOCIATE) &&
7558             !(priv->config & (CFG_STATIC_ESSID | CFG_STATIC_BSSID))) {
7559                 IPW_DEBUG_ASSOC("Not attempting association (associate=0)\n");
7560                 return 0;
7561         }
7562
7563         /* Protect our use of the network_list */
7564         spin_lock_irqsave(&priv->ieee->lock, flags);
7565         list_for_each_entry(network, &priv->ieee->network_list, list)
7566             ipw_best_network(priv, &match, network, 0);
7567
7568         network = match.network;
7569         rates = &match.rates;
7570
7571         if (network == NULL &&
7572             priv->ieee->iw_mode == IW_MODE_ADHOC &&
7573             priv->config & CFG_ADHOC_CREATE &&
7574             priv->config & CFG_STATIC_ESSID &&
7575             priv->config & CFG_STATIC_CHANNEL) {
7576                 /* Use oldest network if the free list is empty */
7577                 if (list_empty(&priv->ieee->network_free_list)) {
7578                         struct libipw_network *oldest = NULL;
7579                         struct libipw_network *target;
7580
7581                         list_for_each_entry(target, &priv->ieee->network_list, list) {
7582                                 if ((oldest == NULL) ||
7583                                     (target->last_scanned < oldest->last_scanned))
7584                                         oldest = target;
7585                         }
7586
7587                         /* If there are no more slots, expire the oldest */
7588                         list_del(&oldest->list);
7589                         target = oldest;
7590                         IPW_DEBUG_ASSOC("Expired '%*pE' (%pM) from network list.\n",
7591                                         target->ssid_len, target->ssid,
7592                                         target->bssid);
7593                         list_add_tail(&target->list,
7594                                       &priv->ieee->network_free_list);
7595                 }
7596
7597                 element = priv->ieee->network_free_list.next;
7598                 network = list_entry(element, struct libipw_network, list);
7599                 ipw_adhoc_create(priv, network);
7600                 rates = &priv->rates;
7601                 list_del(element);
7602                 list_add_tail(&network->list, &priv->ieee->network_list);
7603         }
7604         spin_unlock_irqrestore(&priv->ieee->lock, flags);
7605
7606         /* If we reached the end of the list, then we don't have any valid
7607          * matching APs */
7608         if (!network) {
7609                 ipw_debug_config(priv);
7610
7611                 if (!(priv->status & STATUS_SCANNING)) {
7612                         if (!(priv->config & CFG_SPEED_SCAN))
7613                                 schedule_delayed_work(&priv->request_scan,
7614                                                       SCAN_INTERVAL);
7615                         else
7616                                 schedule_delayed_work(&priv->request_scan, 0);
7617                 }
7618
7619                 return 0;
7620         }
7621
7622         ipw_associate_network(priv, network, rates, 0);
7623
7624         return 1;
7625 }
7626
7627 static void ipw_bg_associate(struct work_struct *work)
7628 {
7629         struct ipw_priv *priv =
7630                 container_of(work, struct ipw_priv, associate);
7631         mutex_lock(&priv->mutex);
7632         ipw_associate(priv);
7633         mutex_unlock(&priv->mutex);
7634 }
7635
7636 static void ipw_rebuild_decrypted_skb(struct ipw_priv *priv,
7637                                       struct sk_buff *skb)
7638 {
7639         struct ieee80211_hdr *hdr;
7640         u16 fc;
7641
7642         hdr = (struct ieee80211_hdr *)skb->data;
7643         fc = le16_to_cpu(hdr->frame_control);
7644         if (!(fc & IEEE80211_FCTL_PROTECTED))
7645                 return;
7646
7647         fc &= ~IEEE80211_FCTL_PROTECTED;
7648         hdr->frame_control = cpu_to_le16(fc);
7649         switch (priv->ieee->sec.level) {
7650         case SEC_LEVEL_3:
7651                 /* Remove CCMP HDR */
7652                 memmove(skb->data + LIBIPW_3ADDR_LEN,
7653                         skb->data + LIBIPW_3ADDR_LEN + 8,
7654                         skb->len - LIBIPW_3ADDR_LEN - 8);
7655                 skb_trim(skb, skb->len - 16);   /* CCMP_HDR_LEN + CCMP_MIC_LEN */
7656                 break;
7657         case SEC_LEVEL_2:
7658                 break;
7659         case SEC_LEVEL_1:
7660                 /* Remove IV */
7661                 memmove(skb->data + LIBIPW_3ADDR_LEN,
7662                         skb->data + LIBIPW_3ADDR_LEN + 4,
7663                         skb->len - LIBIPW_3ADDR_LEN - 4);
7664                 skb_trim(skb, skb->len - 8);    /* IV + ICV */
7665                 break;
7666         case SEC_LEVEL_0:
7667                 break;
7668         default:
7669                 printk(KERN_ERR "Unknown security level %d\n",
7670                        priv->ieee->sec.level);
7671                 break;
7672         }
7673 }
7674
7675 static void ipw_handle_data_packet(struct ipw_priv *priv,
7676                                    struct ipw_rx_mem_buffer *rxb,
7677                                    struct libipw_rx_stats *stats)
7678 {
7679         struct net_device *dev = priv->net_dev;
7680         struct libipw_hdr_4addr *hdr;
7681         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
7682
7683         /* We received data from the HW, so stop the watchdog */
7684         netif_trans_update(dev);
7685
7686         /* We only process data packets if the
7687          * interface is open */
7688         if (unlikely((le16_to_cpu(pkt->u.frame.length) + IPW_RX_FRAME_SIZE) >
7689                      skb_tailroom(rxb->skb))) {
7690                 dev->stats.rx_errors++;
7691                 priv->wstats.discard.misc++;
7692                 IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
7693                 return;
7694         } else if (unlikely(!netif_running(priv->net_dev))) {
7695                 dev->stats.rx_dropped++;
7696                 priv->wstats.discard.misc++;
7697                 IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
7698                 return;
7699         }
7700
7701         /* Advance skb->data to the start of the actual payload */
7702         skb_reserve(rxb->skb, offsetof(struct ipw_rx_packet, u.frame.data));
7703
7704         /* Set the size of the skb to the size of the frame */
7705         skb_put(rxb->skb, le16_to_cpu(pkt->u.frame.length));
7706
7707         IPW_DEBUG_RX("Rx packet of %d bytes.\n", rxb->skb->len);
7708
7709         /* HW decrypt will not clear the WEP bit, MIC, PN, etc. */
7710         hdr = (struct libipw_hdr_4addr *)rxb->skb->data;
7711         if (priv->ieee->iw_mode != IW_MODE_MONITOR &&
7712             (is_multicast_ether_addr(hdr->addr1) ?
7713              !priv->ieee->host_mc_decrypt : !priv->ieee->host_decrypt))
7714                 ipw_rebuild_decrypted_skb(priv, rxb->skb);
7715
7716         if (!libipw_rx(priv->ieee, rxb->skb, stats))
7717                 dev->stats.rx_errors++;
7718         else {                  /* libipw_rx succeeded, so it now owns the SKB */
7719                 rxb->skb = NULL;
7720                 __ipw_led_activity_on(priv);
7721         }
7722 }
7723
7724 #ifdef CONFIG_IPW2200_RADIOTAP
7725 static void ipw_handle_data_packet_monitor(struct ipw_priv *priv,
7726                                            struct ipw_rx_mem_buffer *rxb,
7727                                            struct libipw_rx_stats *stats)
7728 {
7729         struct net_device *dev = priv->net_dev;
7730         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
7731         struct ipw_rx_frame *frame = &pkt->u.frame;
7732
7733         /* initial pull of some data */
7734         u16 received_channel = frame->received_channel;
7735         u8 antennaAndPhy = frame->antennaAndPhy;
7736         s8 antsignal = frame->rssi_dbm - IPW_RSSI_TO_DBM;       /* call it signed anyhow */
7737         u16 pktrate = frame->rate;
7738
7739         /* Magic struct that slots into the radiotap header -- no reason
7740          * to build this manually element by element, we can write it much
7741          * more efficiently than we can parse it. ORDER MATTERS HERE */
7742         struct ipw_rt_hdr *ipw_rt;
7743
7744         unsigned short len = le16_to_cpu(pkt->u.frame.length);
7745
7746         /* We received data from the HW, so stop the watchdog */
7747         netif_trans_update(dev);
7748
7749         /* We only process data packets if the
7750          * interface is open */
7751         if (unlikely((le16_to_cpu(pkt->u.frame.length) + IPW_RX_FRAME_SIZE) >
7752                      skb_tailroom(rxb->skb))) {
7753                 dev->stats.rx_errors++;
7754                 priv->wstats.discard.misc++;
7755                 IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
7756                 return;
7757         } else if (unlikely(!netif_running(priv->net_dev))) {
7758                 dev->stats.rx_dropped++;
7759                 priv->wstats.discard.misc++;
7760                 IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
7761                 return;
7762         }
7763
7764         /* Libpcap 0.9.3+ can handle variable length radiotap, so we'll use
7765          * that now */
7766         if (len > IPW_RX_BUF_SIZE - sizeof(struct ipw_rt_hdr)) {
7767                 /* FIXME: Should alloc bigger skb instead */
7768                 dev->stats.rx_dropped++;
7769                 priv->wstats.discard.misc++;
7770                 IPW_DEBUG_DROP("Dropping too large packet in monitor\n");
7771                 return;
7772         }
7773
7774         /* copy the frame itself */
7775         memmove(rxb->skb->data + sizeof(struct ipw_rt_hdr),
7776                 rxb->skb->data + IPW_RX_FRAME_SIZE, len);
7777
7778         ipw_rt = (struct ipw_rt_hdr *)rxb->skb->data;
7779
7780         ipw_rt->rt_hdr.it_version = PKTHDR_RADIOTAP_VERSION;
7781         ipw_rt->rt_hdr.it_pad = 0;      /* always good to zero */
7782         ipw_rt->rt_hdr.it_len = cpu_to_le16(sizeof(struct ipw_rt_hdr)); /* total header+data */
7783
7784         /* Big bitfield of all the fields we provide in radiotap */
7785         ipw_rt->rt_hdr.it_present = cpu_to_le32(
7786              (1 << IEEE80211_RADIOTAP_TSFT) |
7787              (1 << IEEE80211_RADIOTAP_FLAGS) |
7788              (1 << IEEE80211_RADIOTAP_RATE) |
7789              (1 << IEEE80211_RADIOTAP_CHANNEL) |
7790              (1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL) |
7791              (1 << IEEE80211_RADIOTAP_DBM_ANTNOISE) |
7792              (1 << IEEE80211_RADIOTAP_ANTENNA));
7793
7794         /* Zero the flags, we'll add to them as we go */
7795         ipw_rt->rt_flags = 0;
7796         ipw_rt->rt_tsf = (u64)(frame->parent_tsf[3] << 24 |
7797                                frame->parent_tsf[2] << 16 |
7798                                frame->parent_tsf[1] << 8  |
7799                                frame->parent_tsf[0]);
7800
7801         /* Convert signal to DBM */
7802         ipw_rt->rt_dbmsignal = antsignal;
7803         ipw_rt->rt_dbmnoise = (s8) le16_to_cpu(frame->noise);
7804
7805         /* Convert the channel data and set the flags */
7806         ipw_rt->rt_channel = cpu_to_le16(ieee80211chan2mhz(received_channel));
7807         if (received_channel > 14) {    /* 802.11a */
7808                 ipw_rt->rt_chbitmask =
7809                     cpu_to_le16((IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ));
7810         } else if (antennaAndPhy & 32) {        /* 802.11b */
7811                 ipw_rt->rt_chbitmask =
7812                     cpu_to_le16((IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ));
7813         } else {                /* 802.11g */
7814                 ipw_rt->rt_chbitmask =
7815                     cpu_to_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ);
7816         }
7817
7818         /* set the rate in multiples of 500k/s */
7819         switch (pktrate) {
7820         case IPW_TX_RATE_1MB:
7821                 ipw_rt->rt_rate = 2;
7822                 break;
7823         case IPW_TX_RATE_2MB:
7824                 ipw_rt->rt_rate = 4;
7825                 break;
7826         case IPW_TX_RATE_5MB:
7827                 ipw_rt->rt_rate = 10;
7828                 break;
7829         case IPW_TX_RATE_6MB:
7830                 ipw_rt->rt_rate = 12;
7831                 break;
7832         case IPW_TX_RATE_9MB:
7833                 ipw_rt->rt_rate = 18;
7834                 break;
7835         case IPW_TX_RATE_11MB:
7836                 ipw_rt->rt_rate = 22;
7837                 break;
7838         case IPW_TX_RATE_12MB:
7839                 ipw_rt->rt_rate = 24;
7840                 break;
7841         case IPW_TX_RATE_18MB:
7842                 ipw_rt->rt_rate = 36;
7843                 break;
7844         case IPW_TX_RATE_24MB:
7845                 ipw_rt->rt_rate = 48;
7846                 break;
7847         case IPW_TX_RATE_36MB:
7848                 ipw_rt->rt_rate = 72;
7849                 break;
7850         case IPW_TX_RATE_48MB:
7851                 ipw_rt->rt_rate = 96;
7852                 break;
7853         case IPW_TX_RATE_54MB:
7854                 ipw_rt->rt_rate = 108;
7855                 break;
7856         default:
7857                 ipw_rt->rt_rate = 0;
7858                 break;
7859         }
7860
7861         /* antenna number */
7862         ipw_rt->rt_antenna = (antennaAndPhy & 3);       /* Is this right? */
7863
7864         /* set the preamble flag if we have it */
7865         if ((antennaAndPhy & 64))
7866                 ipw_rt->rt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
7867
7868         /* Set the size of the skb to the size of the frame */
7869         skb_put(rxb->skb, len + sizeof(struct ipw_rt_hdr));
7870
7871         IPW_DEBUG_RX("Rx packet of %d bytes.\n", rxb->skb->len);
7872
7873         if (!libipw_rx(priv->ieee, rxb->skb, stats))
7874                 dev->stats.rx_errors++;
7875         else {                  /* libipw_rx succeeded, so it now owns the SKB */
7876                 rxb->skb = NULL;
7877                 /* no LED during capture */
7878         }
7879 }
7880 #endif
7881
7882 #ifdef CONFIG_IPW2200_PROMISCUOUS
7883 #define libipw_is_probe_response(fc) \
7884    ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT && \
7885     (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP )
7886
7887 #define libipw_is_management(fc) \
7888    ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)
7889
7890 #define libipw_is_control(fc) \
7891    ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL)
7892
7893 #define libipw_is_data(fc) \
7894    ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
7895
7896 #define libipw_is_assoc_request(fc) \
7897    ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_ASSOC_REQ)
7898
7899 #define libipw_is_reassoc_request(fc) \
7900    ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_REASSOC_REQ)
7901
7902 static void ipw_handle_promiscuous_rx(struct ipw_priv *priv,
7903                                       struct ipw_rx_mem_buffer *rxb,
7904                                       struct libipw_rx_stats *stats)
7905 {
7906         struct net_device *dev = priv->prom_net_dev;
7907         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
7908         struct ipw_rx_frame *frame = &pkt->u.frame;
7909         struct ipw_rt_hdr *ipw_rt;
7910
7911         /* First cache any information we need before we overwrite
7912          * the information provided in the skb from the hardware */
7913         struct ieee80211_hdr *hdr;
7914         u16 channel = frame->received_channel;
7915         u8 phy_flags = frame->antennaAndPhy;
7916         s8 signal = frame->rssi_dbm - IPW_RSSI_TO_DBM;
7917         s8 noise = (s8) le16_to_cpu(frame->noise);
7918         u8 rate = frame->rate;
7919         unsigned short len = le16_to_cpu(pkt->u.frame.length);
7920         struct sk_buff *skb;
7921         int hdr_only = 0;
7922         u16 filter = priv->prom_priv->filter;
7923
7924         /* If the filter is set to not include Rx frames then return */
7925         if (filter & IPW_PROM_NO_RX)
7926                 return;
7927
7928         /* We received data from the HW, so stop the watchdog */
7929         netif_trans_update(dev);
7930
7931         if (unlikely((len + IPW_RX_FRAME_SIZE) > skb_tailroom(rxb->skb))) {
7932                 dev->stats.rx_errors++;
7933                 IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
7934                 return;
7935         }
7936
7937         /* We only process data packets if the interface is open */
7938         if (unlikely(!netif_running(dev))) {
7939                 dev->stats.rx_dropped++;
7940                 IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
7941                 return;
7942         }
7943
7944         /* Libpcap 0.9.3+ can handle variable length radiotap, so we'll use
7945          * that now */
7946         if (len > IPW_RX_BUF_SIZE - sizeof(struct ipw_rt_hdr)) {
7947                 /* FIXME: Should alloc bigger skb instead */
7948                 dev->stats.rx_dropped++;
7949                 IPW_DEBUG_DROP("Dropping too large packet in monitor\n");
7950                 return;
7951         }
7952
7953         hdr = (void *)rxb->skb->data + IPW_RX_FRAME_SIZE;
7954         if (libipw_is_management(le16_to_cpu(hdr->frame_control))) {
7955                 if (filter & IPW_PROM_NO_MGMT)
7956                         return;
7957                 if (filter & IPW_PROM_MGMT_HEADER_ONLY)
7958                         hdr_only = 1;
7959         } else if (libipw_is_control(le16_to_cpu(hdr->frame_control))) {
7960                 if (filter & IPW_PROM_NO_CTL)
7961                         return;
7962                 if (filter & IPW_PROM_CTL_HEADER_ONLY)
7963                         hdr_only = 1;
7964         } else if (libipw_is_data(le16_to_cpu(hdr->frame_control))) {
7965                 if (filter & IPW_PROM_NO_DATA)
7966                         return;
7967                 if (filter & IPW_PROM_DATA_HEADER_ONLY)
7968                         hdr_only = 1;
7969         }
7970
7971         /* Copy the SKB since this is for the promiscuous side */
7972         skb = skb_copy(rxb->skb, GFP_ATOMIC);
7973         if (skb == NULL) {
7974                 IPW_ERROR("skb_clone failed for promiscuous copy.\n");
7975                 return;
7976         }
7977
7978         /* copy the frame data to write after where the radiotap header goes */
7979         ipw_rt = (void *)skb->data;
7980
7981         if (hdr_only)
7982                 len = libipw_get_hdrlen(le16_to_cpu(hdr->frame_control));
7983
7984         memcpy(ipw_rt->payload, hdr, len);
7985
7986         ipw_rt->rt_hdr.it_version = PKTHDR_RADIOTAP_VERSION;
7987         ipw_rt->rt_hdr.it_pad = 0;      /* always good to zero */
7988         ipw_rt->rt_hdr.it_len = cpu_to_le16(sizeof(*ipw_rt));   /* total header+data */
7989
7990         /* Set the size of the skb to the size of the frame */
7991         skb_put(skb, sizeof(*ipw_rt) + len);
7992
7993         /* Big bitfield of all the fields we provide in radiotap */
7994         ipw_rt->rt_hdr.it_present = cpu_to_le32(
7995              (1 << IEEE80211_RADIOTAP_TSFT) |
7996              (1 << IEEE80211_RADIOTAP_FLAGS) |
7997              (1 << IEEE80211_RADIOTAP_RATE) |
7998              (1 << IEEE80211_RADIOTAP_CHANNEL) |
7999              (1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL) |
8000              (1 << IEEE80211_RADIOTAP_DBM_ANTNOISE) |
8001              (1 << IEEE80211_RADIOTAP_ANTENNA));
8002
8003         /* Zero the flags, we'll add to them as we go */
8004         ipw_rt->rt_flags = 0;
8005         ipw_rt->rt_tsf = (u64)(frame->parent_tsf[3] << 24 |
8006                                frame->parent_tsf[2] << 16 |
8007                                frame->parent_tsf[1] << 8  |
8008                                frame->parent_tsf[0]);
8009
8010         /* Convert to DBM */
8011         ipw_rt->rt_dbmsignal = signal;
8012         ipw_rt->rt_dbmnoise = noise;
8013
8014         /* Convert the channel data and set the flags */
8015         ipw_rt->rt_channel = cpu_to_le16(ieee80211chan2mhz(channel));
8016         if (channel > 14) {     /* 802.11a */
8017                 ipw_rt->rt_chbitmask =
8018                     cpu_to_le16((IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ));
8019         } else if (phy_flags & (1 << 5)) {      /* 802.11b */
8020                 ipw_rt->rt_chbitmask =
8021                     cpu_to_le16((IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ));
8022         } else {                /* 802.11g */
8023                 ipw_rt->rt_chbitmask =
8024                     cpu_to_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ);
8025         }
8026
8027         /* set the rate in multiples of 500k/s */
8028         switch (rate) {
8029         case IPW_TX_RATE_1MB:
8030                 ipw_rt->rt_rate = 2;
8031                 break;
8032         case IPW_TX_RATE_2MB:
8033                 ipw_rt->rt_rate = 4;
8034                 break;
8035         case IPW_TX_RATE_5MB:
8036                 ipw_rt->rt_rate = 10;
8037                 break;
8038         case IPW_TX_RATE_6MB:
8039                 ipw_rt->rt_rate = 12;
8040                 break;
8041         case IPW_TX_RATE_9MB:
8042                 ipw_rt->rt_rate = 18;
8043                 break;
8044         case IPW_TX_RATE_11MB:
8045                 ipw_rt->rt_rate = 22;
8046                 break;
8047         case IPW_TX_RATE_12MB:
8048                 ipw_rt->rt_rate = 24;
8049                 break;
8050         case IPW_TX_RATE_18MB:
8051                 ipw_rt->rt_rate = 36;
8052                 break;
8053         case IPW_TX_RATE_24MB:
8054                 ipw_rt->rt_rate = 48;
8055                 break;
8056         case IPW_TX_RATE_36MB:
8057                 ipw_rt->rt_rate = 72;
8058                 break;
8059         case IPW_TX_RATE_48MB:
8060                 ipw_rt->rt_rate = 96;
8061                 break;
8062         case IPW_TX_RATE_54MB:
8063                 ipw_rt->rt_rate = 108;
8064                 break;
8065         default:
8066                 ipw_rt->rt_rate = 0;
8067                 break;
8068         }
8069
8070         /* antenna number */
8071         ipw_rt->rt_antenna = (phy_flags & 3);
8072
8073         /* set the preamble flag if we have it */
8074         if (phy_flags & (1 << 6))
8075                 ipw_rt->rt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
8076
8077         IPW_DEBUG_RX("Rx packet of %d bytes.\n", skb->len);
8078
8079         if (!libipw_rx(priv->prom_priv->ieee, skb, stats)) {
8080                 dev->stats.rx_errors++;
8081                 dev_kfree_skb_any(skb);
8082         }
8083 }
8084 #endif
8085
8086 static int is_network_packet(struct ipw_priv *priv,
8087                                     struct libipw_hdr_4addr *header)
8088 {
8089         /* Filter incoming packets to determine if they are targeted toward
8090          * this network, discarding packets coming from ourselves */
8091         switch (priv->ieee->iw_mode) {
8092         case IW_MODE_ADHOC:     /* Header: Dest. | Source    | BSSID */
8093                 /* packets from our adapter are dropped (echo) */
8094                 if (ether_addr_equal(header->addr2, priv->net_dev->dev_addr))
8095                         return 0;
8096
8097                 /* {broad,multi}cast packets to our BSSID go through */
8098                 if (is_multicast_ether_addr(header->addr1))
8099                         return ether_addr_equal(header->addr3, priv->bssid);
8100
8101                 /* packets to our adapter go through */
8102                 return ether_addr_equal(header->addr1,
8103                                         priv->net_dev->dev_addr);
8104
8105         case IW_MODE_INFRA:     /* Header: Dest. | BSSID | Source */
8106                 /* packets from our adapter are dropped (echo) */
8107                 if (ether_addr_equal(header->addr3, priv->net_dev->dev_addr))
8108                         return 0;
8109
8110                 /* {broad,multi}cast packets to our BSS go through */
8111                 if (is_multicast_ether_addr(header->addr1))
8112                         return ether_addr_equal(header->addr2, priv->bssid);
8113
8114                 /* packets to our adapter go through */
8115                 return ether_addr_equal(header->addr1,
8116                                         priv->net_dev->dev_addr);
8117         }
8118
8119         return 1;
8120 }
8121
8122 #define IPW_PACKET_RETRY_TIME HZ
8123
8124 static  int is_duplicate_packet(struct ipw_priv *priv,
8125                                       struct libipw_hdr_4addr *header)
8126 {
8127         u16 sc = le16_to_cpu(header->seq_ctl);
8128         u16 seq = WLAN_GET_SEQ_SEQ(sc);
8129         u16 frag = WLAN_GET_SEQ_FRAG(sc);
8130         u16 *last_seq, *last_frag;
8131         unsigned long *last_time;
8132
8133         switch (priv->ieee->iw_mode) {
8134         case IW_MODE_ADHOC:
8135                 {
8136                         struct list_head *p;
8137                         struct ipw_ibss_seq *entry = NULL;
8138                         u8 *mac = header->addr2;
8139                         int index = mac[5] % IPW_IBSS_MAC_HASH_SIZE;
8140
8141                         list_for_each(p, &priv->ibss_mac_hash[index]) {
8142                                 entry =
8143                                     list_entry(p, struct ipw_ibss_seq, list);
8144                                 if (ether_addr_equal(entry->mac, mac))
8145                                         break;
8146                         }
8147                         if (p == &priv->ibss_mac_hash[index]) {
8148                                 entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
8149                                 if (!entry) {
8150                                         IPW_ERROR
8151                                             ("Cannot malloc new mac entry\n");
8152                                         return 0;
8153                                 }
8154                                 memcpy(entry->mac, mac, ETH_ALEN);
8155                                 entry->seq_num = seq;
8156                                 entry->frag_num = frag;
8157                                 entry->packet_time = jiffies;
8158                                 list_add(&entry->list,
8159                                          &priv->ibss_mac_hash[index]);
8160                                 return 0;
8161                         }
8162                         last_seq = &entry->seq_num;
8163                         last_frag = &entry->frag_num;
8164                         last_time = &entry->packet_time;
8165                         break;
8166                 }
8167         case IW_MODE_INFRA:
8168                 last_seq = &priv->last_seq_num;
8169                 last_frag = &priv->last_frag_num;
8170                 last_time = &priv->last_packet_time;
8171                 break;
8172         default:
8173                 return 0;
8174         }
8175         if ((*last_seq == seq) &&
8176             time_after(*last_time + IPW_PACKET_RETRY_TIME, jiffies)) {
8177                 if (*last_frag == frag)
8178                         goto drop;
8179                 if (*last_frag + 1 != frag)
8180                         /* out-of-order fragment */
8181                         goto drop;
8182         } else
8183                 *last_seq = seq;
8184
8185         *last_frag = frag;
8186         *last_time = jiffies;
8187         return 0;
8188
8189       drop:
8190         /* Comment this line now since we observed the card receives
8191          * duplicate packets but the FCTL_RETRY bit is not set in the
8192          * IBSS mode with fragmentation enabled.
8193          BUG_ON(!(le16_to_cpu(header->frame_control) & IEEE80211_FCTL_RETRY)); */
8194         return 1;
8195 }
8196
8197 static void ipw_handle_mgmt_packet(struct ipw_priv *priv,
8198                                    struct ipw_rx_mem_buffer *rxb,
8199                                    struct libipw_rx_stats *stats)
8200 {
8201         struct sk_buff *skb = rxb->skb;
8202         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)skb->data;
8203         struct libipw_hdr_4addr *header = (struct libipw_hdr_4addr *)
8204             (skb->data + IPW_RX_FRAME_SIZE);
8205
8206         libipw_rx_mgt(priv->ieee, header, stats);
8207
8208         if (priv->ieee->iw_mode == IW_MODE_ADHOC &&
8209             ((WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) ==
8210               IEEE80211_STYPE_PROBE_RESP) ||
8211              (WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) ==
8212               IEEE80211_STYPE_BEACON))) {
8213                 if (ether_addr_equal(header->addr3, priv->bssid))
8214                         ipw_add_station(priv, header->addr2);
8215         }
8216
8217         if (priv->config & CFG_NET_STATS) {
8218                 IPW_DEBUG_HC("sending stat packet\n");
8219
8220                 /* Set the size of the skb to the size of the full
8221                  * ipw header and 802.11 frame */
8222                 skb_put(skb, le16_to_cpu(pkt->u.frame.length) +
8223                         IPW_RX_FRAME_SIZE);
8224
8225                 /* Advance past the ipw packet header to the 802.11 frame */
8226                 skb_pull(skb, IPW_RX_FRAME_SIZE);
8227
8228                 /* Push the libipw_rx_stats before the 802.11 frame */
8229                 memcpy(skb_push(skb, sizeof(*stats)), stats, sizeof(*stats));
8230
8231                 skb->dev = priv->ieee->dev;
8232
8233                 /* Point raw at the libipw_stats */
8234                 skb_reset_mac_header(skb);
8235
8236                 skb->pkt_type = PACKET_OTHERHOST;
8237                 skb->protocol = cpu_to_be16(ETH_P_80211_STATS);
8238                 memset(skb->cb, 0, sizeof(rxb->skb->cb));
8239                 netif_rx(skb);
8240                 rxb->skb = NULL;
8241         }
8242 }
8243
8244 /*
8245  * Main entry function for receiving a packet with 80211 headers.  This
8246  * should be called when ever the FW has notified us that there is a new
8247  * skb in the receive queue.
8248  */
8249 static void ipw_rx(struct ipw_priv *priv)
8250 {
8251         struct ipw_rx_mem_buffer *rxb;
8252         struct ipw_rx_packet *pkt;
8253         struct libipw_hdr_4addr *header;
8254         u32 r, w, i;
8255         u8 network_packet;
8256         u8 fill_rx = 0;
8257
8258         r = ipw_read32(priv, IPW_RX_READ_INDEX);
8259         w = ipw_read32(priv, IPW_RX_WRITE_INDEX);
8260         i = priv->rxq->read;
8261
8262         if (ipw_rx_queue_space (priv->rxq) > (RX_QUEUE_SIZE / 2))
8263                 fill_rx = 1;
8264
8265         while (i != r) {
8266                 rxb = priv->rxq->queue[i];
8267                 if (unlikely(rxb == NULL)) {
8268                         printk(KERN_CRIT "Queue not allocated!\n");
8269                         break;
8270                 }
8271                 priv->rxq->queue[i] = NULL;
8272
8273                 pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->dma_addr,
8274                                             IPW_RX_BUF_SIZE,
8275                                             PCI_DMA_FROMDEVICE);
8276
8277                 pkt = (struct ipw_rx_packet *)rxb->skb->data;
8278                 IPW_DEBUG_RX("Packet: type=%02X seq=%02X bits=%02X\n",
8279                              pkt->header.message_type,
8280                              pkt->header.rx_seq_num, pkt->header.control_bits);
8281
8282                 switch (pkt->header.message_type) {
8283                 case RX_FRAME_TYPE:     /* 802.11 frame */  {
8284                                 struct libipw_rx_stats stats = {
8285                                         .rssi = pkt->u.frame.rssi_dbm -
8286                                             IPW_RSSI_TO_DBM,
8287                                         .signal =
8288                                             pkt->u.frame.rssi_dbm -
8289                                             IPW_RSSI_TO_DBM + 0x100,
8290                                         .noise =
8291                                             le16_to_cpu(pkt->u.frame.noise),
8292                                         .rate = pkt->u.frame.rate,
8293                                         .mac_time = jiffies,
8294                                         .received_channel =
8295                                             pkt->u.frame.received_channel,
8296                                         .freq =
8297                                             (pkt->u.frame.
8298                                              control & (1 << 0)) ?
8299                                             LIBIPW_24GHZ_BAND :
8300                                             LIBIPW_52GHZ_BAND,
8301                                         .len = le16_to_cpu(pkt->u.frame.length),
8302                                 };
8303
8304                                 if (stats.rssi != 0)
8305                                         stats.mask |= LIBIPW_STATMASK_RSSI;
8306                                 if (stats.signal != 0)
8307                                         stats.mask |= LIBIPW_STATMASK_SIGNAL;
8308                                 if (stats.noise != 0)
8309                                         stats.mask |= LIBIPW_STATMASK_NOISE;
8310                                 if (stats.rate != 0)
8311                                         stats.mask |= LIBIPW_STATMASK_RATE;
8312
8313                                 priv->rx_packets++;
8314
8315 #ifdef CONFIG_IPW2200_PROMISCUOUS
8316         if (priv->prom_net_dev && netif_running(priv->prom_net_dev))
8317                 ipw_handle_promiscuous_rx(priv, rxb, &stats);
8318 #endif
8319
8320 #ifdef CONFIG_IPW2200_MONITOR
8321                                 if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
8322 #ifdef CONFIG_IPW2200_RADIOTAP
8323
8324                 ipw_handle_data_packet_monitor(priv,
8325                                                rxb,
8326                                                &stats);
8327 #else
8328                 ipw_handle_data_packet(priv, rxb,
8329                                        &stats);
8330 #endif
8331                                         break;
8332                                 }
8333 #endif
8334
8335                                 header =
8336                                     (struct libipw_hdr_4addr *)(rxb->skb->
8337                                                                    data +
8338                                                                    IPW_RX_FRAME_SIZE);
8339                                 /* TODO: Check Ad-Hoc dest/source and make sure
8340                                  * that we are actually parsing these packets
8341                                  * correctly -- we should probably use the
8342                                  * frame control of the packet and disregard
8343                                  * the current iw_mode */
8344
8345                                 network_packet =
8346                                     is_network_packet(priv, header);
8347                                 if (network_packet && priv->assoc_network) {
8348                                         priv->assoc_network->stats.rssi =
8349                                             stats.rssi;
8350                                         priv->exp_avg_rssi =
8351                                             exponential_average(priv->exp_avg_rssi,
8352                                             stats.rssi, DEPTH_RSSI);
8353                                 }
8354
8355                                 IPW_DEBUG_RX("Frame: len=%u\n",
8356                                              le16_to_cpu(pkt->u.frame.length));
8357
8358                                 if (le16_to_cpu(pkt->u.frame.length) <
8359                                     libipw_get_hdrlen(le16_to_cpu(
8360                                                     header->frame_ctl))) {
8361                                         IPW_DEBUG_DROP
8362                                             ("Received packet is too small. "
8363                                              "Dropping.\n");
8364                                         priv->net_dev->stats.rx_errors++;
8365                                         priv->wstats.discard.misc++;
8366                                         break;
8367                                 }
8368
8369                                 switch (WLAN_FC_GET_TYPE
8370                                         (le16_to_cpu(header->frame_ctl))) {
8371
8372                                 case IEEE80211_FTYPE_MGMT:
8373                                         ipw_handle_mgmt_packet(priv, rxb,
8374                                                                &stats);
8375                                         break;
8376
8377                                 case IEEE80211_FTYPE_CTL:
8378                                         break;
8379
8380                                 case IEEE80211_FTYPE_DATA:
8381                                         if (unlikely(!network_packet ||
8382                                                      is_duplicate_packet(priv,
8383                                                                          header)))
8384                                         {
8385                                                 IPW_DEBUG_DROP("Dropping: "
8386                                                                "%pM, "
8387                                                                "%pM, "
8388                                                                "%pM\n",
8389                                                                header->addr1,
8390                                                                header->addr2,
8391                                                                header->addr3);
8392                                                 break;
8393                                         }
8394
8395                                         ipw_handle_data_packet(priv, rxb,
8396                                                                &stats);
8397
8398                                         break;
8399                                 }
8400                                 break;
8401                         }
8402
8403                 case RX_HOST_NOTIFICATION_TYPE:{
8404                                 IPW_DEBUG_RX
8405                                     ("Notification: subtype=%02X flags=%02X size=%d\n",
8406                                      pkt->u.notification.subtype,
8407                                      pkt->u.notification.flags,
8408                                      le16_to_cpu(pkt->u.notification.size));
8409                                 ipw_rx_notification(priv, &pkt->u.notification);
8410                                 break;
8411                         }
8412
8413                 default:
8414                         IPW_DEBUG_RX("Bad Rx packet of type %d\n",
8415                                      pkt->header.message_type);
8416                         break;
8417                 }
8418
8419                 /* For now we just don't re-use anything.  We can tweak this
8420                  * later to try and re-use notification packets and SKBs that
8421                  * fail to Rx correctly */
8422                 if (rxb->skb != NULL) {
8423                         dev_kfree_skb_any(rxb->skb);
8424                         rxb->skb = NULL;
8425                 }
8426
8427                 pci_unmap_single(priv->pci_dev, rxb->dma_addr,
8428                                  IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
8429                 list_add_tail(&rxb->list, &priv->rxq->rx_used);
8430
8431                 i = (i + 1) % RX_QUEUE_SIZE;
8432
8433                 /* If there are a lot of unsued frames, restock the Rx queue
8434                  * so the ucode won't assert */
8435                 if (fill_rx) {
8436                         priv->rxq->read = i;
8437                         ipw_rx_queue_replenish(priv);
8438                 }
8439         }
8440
8441         /* Backtrack one entry */
8442         priv->rxq->read = i;
8443         ipw_rx_queue_restock(priv);
8444 }
8445
8446 #define DEFAULT_RTS_THRESHOLD     2304U
8447 #define MIN_RTS_THRESHOLD         1U
8448 #define MAX_RTS_THRESHOLD         2304U
8449 #define DEFAULT_BEACON_INTERVAL   100U
8450 #define DEFAULT_SHORT_RETRY_LIMIT 7U
8451 #define DEFAULT_LONG_RETRY_LIMIT  4U
8452
8453 /**
8454  * ipw_sw_reset
8455  * @option: options to control different reset behaviour
8456  *          0 = reset everything except the 'disable' module_param
8457  *          1 = reset everything and print out driver info (for probe only)
8458  *          2 = reset everything
8459  */
8460 static int ipw_sw_reset(struct ipw_priv *priv, int option)
8461 {
8462         int band, modulation;
8463         int old_mode = priv->ieee->iw_mode;
8464
8465         /* Initialize module parameter values here */
8466         priv->config = 0;
8467
8468         /* We default to disabling the LED code as right now it causes
8469          * too many systems to lock up... */
8470         if (!led_support)
8471                 priv->config |= CFG_NO_LED;
8472
8473         if (associate)
8474                 priv->config |= CFG_ASSOCIATE;
8475         else
8476                 IPW_DEBUG_INFO("Auto associate disabled.\n");
8477
8478         if (auto_create)
8479                 priv->config |= CFG_ADHOC_CREATE;
8480         else
8481                 IPW_DEBUG_INFO("Auto adhoc creation disabled.\n");
8482
8483         priv->config &= ~CFG_STATIC_ESSID;
8484         priv->essid_len = 0;
8485         memset(priv->essid, 0, IW_ESSID_MAX_SIZE);
8486
8487         if (disable && option) {
8488                 priv->status |= STATUS_RF_KILL_SW;
8489                 IPW_DEBUG_INFO("Radio disabled.\n");
8490         }
8491
8492         if (default_channel != 0) {
8493                 priv->config |= CFG_STATIC_CHANNEL;
8494                 priv->channel = default_channel;
8495                 IPW_DEBUG_INFO("Bind to static channel %d\n", default_channel);
8496                 /* TODO: Validate that provided channel is in range */
8497         }
8498 #ifdef CONFIG_IPW2200_QOS
8499         ipw_qos_init(priv, qos_enable, qos_burst_enable,
8500                      burst_duration_CCK, burst_duration_OFDM);
8501 #endif                          /* CONFIG_IPW2200_QOS */
8502
8503         switch (network_mode) {
8504         case 1:
8505                 priv->ieee->iw_mode = IW_MODE_ADHOC;
8506                 priv->net_dev->type = ARPHRD_ETHER;
8507
8508                 break;
8509 #ifdef CONFIG_IPW2200_MONITOR
8510         case 2:
8511                 priv->ieee->iw_mode = IW_MODE_MONITOR;
8512 #ifdef CONFIG_IPW2200_RADIOTAP
8513                 priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
8514 #else
8515                 priv->net_dev->type = ARPHRD_IEEE80211;
8516 #endif
8517                 break;
8518 #endif
8519         default:
8520         case 0:
8521                 priv->net_dev->type = ARPHRD_ETHER;
8522                 priv->ieee->iw_mode = IW_MODE_INFRA;
8523                 break;
8524         }
8525
8526         if (hwcrypto) {
8527                 priv->ieee->host_encrypt = 0;
8528                 priv->ieee->host_encrypt_msdu = 0;
8529                 priv->ieee->host_decrypt = 0;
8530                 priv->ieee->host_mc_decrypt = 0;
8531         }
8532         IPW_DEBUG_INFO("Hardware crypto [%s]\n", hwcrypto ? "on" : "off");
8533
8534         /* IPW2200/2915 is abled to do hardware fragmentation. */
8535         priv->ieee->host_open_frag = 0;
8536
8537         if ((priv->pci_dev->device == 0x4223) ||
8538             (priv->pci_dev->device == 0x4224)) {
8539                 if (option == 1)
8540                         printk(KERN_INFO DRV_NAME
8541                                ": Detected Intel PRO/Wireless 2915ABG Network "
8542                                "Connection\n");
8543                 priv->ieee->abg_true = 1;
8544                 band = LIBIPW_52GHZ_BAND | LIBIPW_24GHZ_BAND;
8545                 modulation = LIBIPW_OFDM_MODULATION |
8546                     LIBIPW_CCK_MODULATION;
8547                 priv->adapter = IPW_2915ABG;
8548                 priv->ieee->mode = IEEE_A | IEEE_G | IEEE_B;
8549         } else {
8550                 if (option == 1)
8551                         printk(KERN_INFO DRV_NAME
8552                                ": Detected Intel PRO/Wireless 2200BG Network "
8553                                "Connection\n");
8554
8555                 priv->ieee->abg_true = 0;
8556                 band = LIBIPW_24GHZ_BAND;
8557                 modulation = LIBIPW_OFDM_MODULATION |
8558                     LIBIPW_CCK_MODULATION;
8559                 priv->adapter = IPW_2200BG;
8560                 priv->ieee->mode = IEEE_G | IEEE_B;
8561         }
8562
8563         priv->ieee->freq_band = band;
8564         priv->ieee->modulation = modulation;
8565
8566         priv->rates_mask = LIBIPW_DEFAULT_RATES_MASK;
8567
8568         priv->disassociate_threshold = IPW_MB_DISASSOCIATE_THRESHOLD_DEFAULT;
8569         priv->roaming_threshold = IPW_MB_ROAMING_THRESHOLD_DEFAULT;
8570
8571         priv->rts_threshold = DEFAULT_RTS_THRESHOLD;
8572         priv->short_retry_limit = DEFAULT_SHORT_RETRY_LIMIT;
8573         priv->long_retry_limit = DEFAULT_LONG_RETRY_LIMIT;
8574
8575         /* If power management is turned on, default to AC mode */
8576         priv->power_mode = IPW_POWER_AC;
8577         priv->tx_power = IPW_TX_POWER_DEFAULT;
8578
8579         return old_mode == priv->ieee->iw_mode;
8580 }
8581
8582 /*
8583  * This file defines the Wireless Extension handlers.  It does not
8584  * define any methods of hardware manipulation and relies on the
8585  * functions defined in ipw_main to provide the HW interaction.
8586  *
8587  * The exception to this is the use of the ipw_get_ordinal()
8588  * function used to poll the hardware vs. making unnecessary calls.
8589  *
8590  */
8591
8592 static int ipw_set_channel(struct ipw_priv *priv, u8 channel)
8593 {
8594         if (channel == 0) {
8595                 IPW_DEBUG_INFO("Setting channel to ANY (0)\n");
8596                 priv->config &= ~CFG_STATIC_CHANNEL;
8597                 IPW_DEBUG_ASSOC("Attempting to associate with new "
8598                                 "parameters.\n");
8599                 ipw_associate(priv);
8600                 return 0;
8601         }
8602
8603         priv->config |= CFG_STATIC_CHANNEL;
8604
8605         if (priv->channel == channel) {
8606                 IPW_DEBUG_INFO("Request to set channel to current value (%d)\n",
8607                                channel);
8608                 return 0;
8609         }
8610
8611         IPW_DEBUG_INFO("Setting channel to %i\n", (int)channel);
8612         priv->channel = channel;
8613
8614 #ifdef CONFIG_IPW2200_MONITOR
8615         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
8616                 int i;
8617                 if (priv->status & STATUS_SCANNING) {
8618                         IPW_DEBUG_SCAN("Scan abort triggered due to "
8619                                        "channel change.\n");
8620                         ipw_abort_scan(priv);
8621                 }
8622
8623                 for (i = 1000; i && (priv->status & STATUS_SCANNING); i--)
8624                         udelay(10);
8625
8626                 if (priv->status & STATUS_SCANNING)
8627                         IPW_DEBUG_SCAN("Still scanning...\n");
8628                 else
8629                         IPW_DEBUG_SCAN("Took %dms to abort current scan\n",
8630                                        1000 - i);
8631
8632                 return 0;
8633         }
8634 #endif                          /* CONFIG_IPW2200_MONITOR */
8635
8636         /* Network configuration changed -- force [re]association */
8637         IPW_DEBUG_ASSOC("[re]association triggered due to channel change.\n");
8638         if (!ipw_disassociate(priv))
8639                 ipw_associate(priv);
8640
8641         return 0;
8642 }
8643
8644 static int ipw_wx_set_freq(struct net_device *dev,
8645                            struct iw_request_info *info,
8646                            union iwreq_data *wrqu, char *extra)
8647 {
8648         struct ipw_priv *priv = libipw_priv(dev);
8649         const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
8650         struct iw_freq *fwrq = &wrqu->freq;
8651         int ret = 0, i;
8652         u8 channel, flags;
8653         int band;
8654
8655         if (fwrq->m == 0) {
8656                 IPW_DEBUG_WX("SET Freq/Channel -> any\n");
8657                 mutex_lock(&priv->mutex);
8658                 ret = ipw_set_channel(priv, 0);
8659                 mutex_unlock(&priv->mutex);
8660                 return ret;
8661         }
8662         /* if setting by freq convert to channel */
8663         if (fwrq->e == 1) {
8664                 channel = libipw_freq_to_channel(priv->ieee, fwrq->m);
8665                 if (channel == 0)
8666                         return -EINVAL;
8667         } else
8668                 channel = fwrq->m;
8669
8670         if (!(band = libipw_is_valid_channel(priv->ieee, channel)))
8671                 return -EINVAL;
8672
8673         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
8674                 i = libipw_channel_to_index(priv->ieee, channel);
8675                 if (i == -1)
8676                         return -EINVAL;
8677
8678                 flags = (band == LIBIPW_24GHZ_BAND) ?
8679                     geo->bg[i].flags : geo->a[i].flags;
8680                 if (flags & LIBIPW_CH_PASSIVE_ONLY) {
8681                         IPW_DEBUG_WX("Invalid Ad-Hoc channel for 802.11a\n");
8682                         return -EINVAL;
8683                 }
8684         }
8685
8686         IPW_DEBUG_WX("SET Freq/Channel -> %d\n", fwrq->m);
8687         mutex_lock(&priv->mutex);
8688         ret = ipw_set_channel(priv, channel);
8689         mutex_unlock(&priv->mutex);
8690         return ret;
8691 }
8692
8693 static int ipw_wx_get_freq(struct net_device *dev,
8694                            struct iw_request_info *info,
8695                            union iwreq_data *wrqu, char *extra)
8696 {
8697         struct ipw_priv *priv = libipw_priv(dev);
8698
8699         wrqu->freq.e = 0;
8700
8701         /* If we are associated, trying to associate, or have a statically
8702          * configured CHANNEL then return that; otherwise return ANY */
8703         mutex_lock(&priv->mutex);
8704         if (priv->config & CFG_STATIC_CHANNEL ||
8705             priv->status & (STATUS_ASSOCIATING | STATUS_ASSOCIATED)) {
8706                 int i;
8707
8708                 i = libipw_channel_to_index(priv->ieee, priv->channel);
8709                 BUG_ON(i == -1);
8710                 wrqu->freq.e = 1;
8711
8712                 switch (libipw_is_valid_channel(priv->ieee, priv->channel)) {
8713                 case LIBIPW_52GHZ_BAND:
8714                         wrqu->freq.m = priv->ieee->geo.a[i].freq * 100000;
8715                         break;
8716
8717                 case LIBIPW_24GHZ_BAND:
8718                         wrqu->freq.m = priv->ieee->geo.bg[i].freq * 100000;
8719                         break;
8720
8721                 default:
8722                         BUG();
8723                 }
8724         } else
8725                 wrqu->freq.m = 0;
8726
8727         mutex_unlock(&priv->mutex);
8728         IPW_DEBUG_WX("GET Freq/Channel -> %d\n", priv->channel);
8729         return 0;
8730 }
8731
8732 static int ipw_wx_set_mode(struct net_device *dev,
8733                            struct iw_request_info *info,
8734                            union iwreq_data *wrqu, char *extra)
8735 {
8736         struct ipw_priv *priv = libipw_priv(dev);
8737         int err = 0;
8738
8739         IPW_DEBUG_WX("Set MODE: %d\n", wrqu->mode);
8740
8741         switch (wrqu->mode) {
8742 #ifdef CONFIG_IPW2200_MONITOR
8743         case IW_MODE_MONITOR:
8744 #endif
8745         case IW_MODE_ADHOC:
8746         case IW_MODE_INFRA:
8747                 break;
8748         case IW_MODE_AUTO:
8749                 wrqu->mode = IW_MODE_INFRA;
8750                 break;
8751         default:
8752                 return -EINVAL;
8753         }
8754         if (wrqu->mode == priv->ieee->iw_mode)
8755                 return 0;
8756
8757         mutex_lock(&priv->mutex);
8758
8759         ipw_sw_reset(priv, 0);
8760
8761 #ifdef CONFIG_IPW2200_MONITOR
8762         if (priv->ieee->iw_mode == IW_MODE_MONITOR)
8763                 priv->net_dev->type = ARPHRD_ETHER;
8764
8765         if (wrqu->mode == IW_MODE_MONITOR)
8766 #ifdef CONFIG_IPW2200_RADIOTAP
8767                 priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
8768 #else
8769                 priv->net_dev->type = ARPHRD_IEEE80211;
8770 #endif
8771 #endif                          /* CONFIG_IPW2200_MONITOR */
8772
8773         /* Free the existing firmware and reset the fw_loaded
8774          * flag so ipw_load() will bring in the new firmware */
8775         free_firmware();
8776
8777         priv->ieee->iw_mode = wrqu->mode;
8778
8779         schedule_work(&priv->adapter_restart);
8780         mutex_unlock(&priv->mutex);
8781         return err;
8782 }
8783
8784 static int ipw_wx_get_mode(struct net_device *dev,
8785                            struct iw_request_info *info,
8786                            union iwreq_data *wrqu, char *extra)
8787 {
8788         struct ipw_priv *priv = libipw_priv(dev);
8789         mutex_lock(&priv->mutex);
8790         wrqu->mode = priv->ieee->iw_mode;
8791         IPW_DEBUG_WX("Get MODE -> %d\n", wrqu->mode);
8792         mutex_unlock(&priv->mutex);
8793         return 0;
8794 }
8795
8796 /* Values are in microsecond */
8797 static const s32 timeout_duration[] = {
8798         350000,
8799         250000,
8800         75000,
8801         37000,
8802         25000,
8803 };
8804
8805 static const s32 period_duration[] = {
8806         400000,
8807         700000,
8808         1000000,
8809         1000000,
8810         1000000
8811 };
8812
8813 static int ipw_wx_get_range(struct net_device *dev,
8814                             struct iw_request_info *info,
8815                             union iwreq_data *wrqu, char *extra)
8816 {
8817         struct ipw_priv *priv = libipw_priv(dev);
8818         struct iw_range *range = (struct iw_range *)extra;
8819         const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
8820         int i = 0, j;
8821
8822         wrqu->data.length = sizeof(*range);
8823         memset(range, 0, sizeof(*range));
8824
8825         /* 54Mbs == ~27 Mb/s real (802.11g) */
8826         range->throughput = 27 * 1000 * 1000;
8827
8828         range->max_qual.qual = 100;
8829         /* TODO: Find real max RSSI and stick here */
8830         range->max_qual.level = 0;
8831         range->max_qual.noise = 0;
8832         range->max_qual.updated = 7;    /* Updated all three */
8833
8834         range->avg_qual.qual = 70;
8835         /* TODO: Find real 'good' to 'bad' threshold value for RSSI */
8836         range->avg_qual.level = 0;      /* FIXME to real average level */
8837         range->avg_qual.noise = 0;
8838         range->avg_qual.updated = 7;    /* Updated all three */
8839         mutex_lock(&priv->mutex);
8840         range->num_bitrates = min(priv->rates.num_rates, (u8) IW_MAX_BITRATES);
8841
8842         for (i = 0; i < range->num_bitrates; i++)
8843                 range->bitrate[i] = (priv->rates.supported_rates[i] & 0x7F) *
8844                     500000;
8845
8846         range->max_rts = DEFAULT_RTS_THRESHOLD;
8847         range->min_frag = MIN_FRAG_THRESHOLD;
8848         range->max_frag = MAX_FRAG_THRESHOLD;
8849
8850         range->encoding_size[0] = 5;
8851         range->encoding_size[1] = 13;
8852         range->num_encoding_sizes = 2;
8853         range->max_encoding_tokens = WEP_KEYS;
8854
8855         /* Set the Wireless Extension versions */
8856         range->we_version_compiled = WIRELESS_EXT;
8857         range->we_version_source = 18;
8858
8859         i = 0;
8860         if (priv->ieee->mode & (IEEE_B | IEEE_G)) {
8861                 for (j = 0; j < geo->bg_channels && i < IW_MAX_FREQUENCIES; j++) {
8862                         if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
8863                             (geo->bg[j].flags & LIBIPW_CH_PASSIVE_ONLY))
8864                                 continue;
8865
8866                         range->freq[i].i = geo->bg[j].channel;
8867                         range->freq[i].m = geo->bg[j].freq * 100000;
8868                         range->freq[i].e = 1;
8869                         i++;
8870                 }
8871         }
8872
8873         if (priv->ieee->mode & IEEE_A) {
8874                 for (j = 0; j < geo->a_channels && i < IW_MAX_FREQUENCIES; j++) {
8875                         if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
8876                             (geo->a[j].flags & LIBIPW_CH_PASSIVE_ONLY))
8877                                 continue;
8878
8879                         range->freq[i].i = geo->a[j].channel;
8880                         range->freq[i].m = geo->a[j].freq * 100000;
8881                         range->freq[i].e = 1;
8882                         i++;
8883                 }
8884         }
8885
8886         range->num_channels = i;
8887         range->num_frequency = i;
8888
8889         mutex_unlock(&priv->mutex);
8890
8891         /* Event capability (kernel + driver) */
8892         range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
8893                                 IW_EVENT_CAPA_MASK(SIOCGIWTHRSPY) |
8894                                 IW_EVENT_CAPA_MASK(SIOCGIWAP) |
8895                                 IW_EVENT_CAPA_MASK(SIOCGIWSCAN));
8896         range->event_capa[1] = IW_EVENT_CAPA_K_1;
8897
8898         range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
8899                 IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
8900
8901         range->scan_capa = IW_SCAN_CAPA_ESSID | IW_SCAN_CAPA_TYPE;
8902
8903         IPW_DEBUG_WX("GET Range\n");
8904         return 0;
8905 }
8906
8907 static int ipw_wx_set_wap(struct net_device *dev,
8908                           struct iw_request_info *info,
8909                           union iwreq_data *wrqu, char *extra)
8910 {
8911         struct ipw_priv *priv = libipw_priv(dev);
8912
8913         if (wrqu->ap_addr.sa_family != ARPHRD_ETHER)
8914                 return -EINVAL;
8915         mutex_lock(&priv->mutex);
8916         if (is_broadcast_ether_addr(wrqu->ap_addr.sa_data) ||
8917             is_zero_ether_addr(wrqu->ap_addr.sa_data)) {
8918                 /* we disable mandatory BSSID association */
8919                 IPW_DEBUG_WX("Setting AP BSSID to ANY\n");
8920                 priv->config &= ~CFG_STATIC_BSSID;
8921                 IPW_DEBUG_ASSOC("Attempting to associate with new "
8922                                 "parameters.\n");
8923                 ipw_associate(priv);
8924                 mutex_unlock(&priv->mutex);
8925                 return 0;
8926         }
8927
8928         priv->config |= CFG_STATIC_BSSID;
8929         if (ether_addr_equal(priv->bssid, wrqu->ap_addr.sa_data)) {
8930                 IPW_DEBUG_WX("BSSID set to current BSSID.\n");
8931                 mutex_unlock(&priv->mutex);
8932                 return 0;
8933         }
8934
8935         IPW_DEBUG_WX("Setting mandatory BSSID to %pM\n",
8936                      wrqu->ap_addr.sa_data);
8937
8938         memcpy(priv->bssid, wrqu->ap_addr.sa_data, ETH_ALEN);
8939
8940         /* Network configuration changed -- force [re]association */
8941         IPW_DEBUG_ASSOC("[re]association triggered due to BSSID change.\n");
8942         if (!ipw_disassociate(priv))
8943                 ipw_associate(priv);
8944
8945         mutex_unlock(&priv->mutex);
8946         return 0;
8947 }
8948
8949 static int ipw_wx_get_wap(struct net_device *dev,
8950                           struct iw_request_info *info,
8951                           union iwreq_data *wrqu, char *extra)
8952 {
8953         struct ipw_priv *priv = libipw_priv(dev);
8954
8955         /* If we are associated, trying to associate, or have a statically
8956          * configured BSSID then return that; otherwise return ANY */
8957         mutex_lock(&priv->mutex);
8958         if (priv->config & CFG_STATIC_BSSID ||
8959             priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
8960                 wrqu->ap_addr.sa_family = ARPHRD_ETHER;
8961                 memcpy(wrqu->ap_addr.sa_data, priv->bssid, ETH_ALEN);
8962         } else
8963                 eth_zero_addr(wrqu->ap_addr.sa_data);
8964
8965         IPW_DEBUG_WX("Getting WAP BSSID: %pM\n",
8966                      wrqu->ap_addr.sa_data);
8967         mutex_unlock(&priv->mutex);
8968         return 0;
8969 }
8970
8971 static int ipw_wx_set_essid(struct net_device *dev,
8972                             struct iw_request_info *info,
8973                             union iwreq_data *wrqu, char *extra)
8974 {
8975         struct ipw_priv *priv = libipw_priv(dev);
8976         int length;
8977
8978         mutex_lock(&priv->mutex);
8979
8980         if (!wrqu->essid.flags)
8981         {
8982                 IPW_DEBUG_WX("Setting ESSID to ANY\n");
8983                 ipw_disassociate(priv);
8984                 priv->config &= ~CFG_STATIC_ESSID;
8985                 ipw_associate(priv);
8986                 mutex_unlock(&priv->mutex);
8987                 return 0;
8988         }
8989
8990         length = min((int)wrqu->essid.length, IW_ESSID_MAX_SIZE);
8991
8992         priv->config |= CFG_STATIC_ESSID;
8993
8994         if (priv->essid_len == length && !memcmp(priv->essid, extra, length)
8995             && (priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING))) {
8996                 IPW_DEBUG_WX("ESSID set to current ESSID.\n");
8997                 mutex_unlock(&priv->mutex);
8998                 return 0;
8999         }
9000
9001         IPW_DEBUG_WX("Setting ESSID: '%*pE' (%d)\n", length, extra, length);
9002
9003         priv->essid_len = length;
9004         memcpy(priv->essid, extra, priv->essid_len);
9005
9006         /* Network configuration changed -- force [re]association */
9007         IPW_DEBUG_ASSOC("[re]association triggered due to ESSID change.\n");
9008         if (!ipw_disassociate(priv))
9009                 ipw_associate(priv);
9010
9011         mutex_unlock(&priv->mutex);
9012         return 0;
9013 }
9014
9015 static int ipw_wx_get_essid(struct net_device *dev,
9016                             struct iw_request_info *info,
9017                             union iwreq_data *wrqu, char *extra)
9018 {
9019         struct ipw_priv *priv = libipw_priv(dev);
9020
9021         /* If we are associated, trying to associate, or have a statically
9022          * configured ESSID then return that; otherwise return ANY */
9023         mutex_lock(&priv->mutex);
9024         if (priv->config & CFG_STATIC_ESSID ||
9025             priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
9026                 IPW_DEBUG_WX("Getting essid: '%*pE'\n",
9027                              priv->essid_len, priv->essid);
9028                 memcpy(extra, priv->essid, priv->essid_len);
9029                 wrqu->essid.length = priv->essid_len;
9030                 wrqu->essid.flags = 1;  /* active */
9031         } else {
9032                 IPW_DEBUG_WX("Getting essid: ANY\n");
9033                 wrqu->essid.length = 0;
9034                 wrqu->essid.flags = 0;  /* active */
9035         }
9036         mutex_unlock(&priv->mutex);
9037         return 0;
9038 }
9039
9040 static int ipw_wx_set_nick(struct net_device *dev,
9041                            struct iw_request_info *info,
9042                            union iwreq_data *wrqu, char *extra)
9043 {
9044         struct ipw_priv *priv = libipw_priv(dev);
9045
9046         IPW_DEBUG_WX("Setting nick to '%s'\n", extra);
9047         if (wrqu->data.length > IW_ESSID_MAX_SIZE)
9048                 return -E2BIG;
9049         mutex_lock(&priv->mutex);
9050         wrqu->data.length = min_t(size_t, wrqu->data.length, sizeof(priv->nick));
9051         memset(priv->nick, 0, sizeof(priv->nick));
9052         memcpy(priv->nick, extra, wrqu->data.length);
9053         IPW_DEBUG_TRACE("<<\n");
9054         mutex_unlock(&priv->mutex);
9055         return 0;
9056
9057 }
9058
9059 static int ipw_wx_get_nick(struct net_device *dev,
9060                            struct iw_request_info *info,
9061                            union iwreq_data *wrqu, char *extra)
9062 {
9063         struct ipw_priv *priv = libipw_priv(dev);
9064         IPW_DEBUG_WX("Getting nick\n");
9065         mutex_lock(&priv->mutex);
9066         wrqu->data.length = strlen(priv->nick);
9067         memcpy(extra, priv->nick, wrqu->data.length);
9068         wrqu->data.flags = 1;   /* active */
9069         mutex_unlock(&priv->mutex);
9070         return 0;
9071 }
9072
9073 static int ipw_wx_set_sens(struct net_device *dev,
9074                             struct iw_request_info *info,
9075                             union iwreq_data *wrqu, char *extra)
9076 {
9077         struct ipw_priv *priv = libipw_priv(dev);
9078         int err = 0;
9079
9080         IPW_DEBUG_WX("Setting roaming threshold to %d\n", wrqu->sens.value);
9081         IPW_DEBUG_WX("Setting disassociate threshold to %d\n", 3*wrqu->sens.value);
9082         mutex_lock(&priv->mutex);
9083
9084         if (wrqu->sens.fixed == 0)
9085         {
9086                 priv->roaming_threshold = IPW_MB_ROAMING_THRESHOLD_DEFAULT;
9087                 priv->disassociate_threshold = IPW_MB_DISASSOCIATE_THRESHOLD_DEFAULT;
9088                 goto out;
9089         }
9090         if ((wrqu->sens.value > IPW_MB_ROAMING_THRESHOLD_MAX) ||
9091             (wrqu->sens.value < IPW_MB_ROAMING_THRESHOLD_MIN)) {
9092                 err = -EINVAL;
9093                 goto out;
9094         }
9095
9096         priv->roaming_threshold = wrqu->sens.value;
9097         priv->disassociate_threshold = 3*wrqu->sens.value;
9098       out:
9099         mutex_unlock(&priv->mutex);
9100         return err;
9101 }
9102
9103 static int ipw_wx_get_sens(struct net_device *dev,
9104                             struct iw_request_info *info,
9105                             union iwreq_data *wrqu, char *extra)
9106 {
9107         struct ipw_priv *priv = libipw_priv(dev);
9108         mutex_lock(&priv->mutex);
9109         wrqu->sens.fixed = 1;
9110         wrqu->sens.value = priv->roaming_threshold;
9111         mutex_unlock(&priv->mutex);
9112
9113         IPW_DEBUG_WX("GET roaming threshold -> %s %d\n",
9114                      wrqu->power.disabled ? "OFF" : "ON", wrqu->power.value);
9115
9116         return 0;
9117 }
9118
9119 static int ipw_wx_set_rate(struct net_device *dev,
9120                            struct iw_request_info *info,
9121                            union iwreq_data *wrqu, char *extra)
9122 {
9123         /* TODO: We should use semaphores or locks for access to priv */
9124         struct ipw_priv *priv = libipw_priv(dev);
9125         u32 target_rate = wrqu->bitrate.value;
9126         u32 fixed, mask;
9127
9128         /* value = -1, fixed = 0 means auto only, so we should use all rates offered by AP */
9129         /* value = X, fixed = 1 means only rate X */
9130         /* value = X, fixed = 0 means all rates lower equal X */
9131
9132         if (target_rate == -1) {
9133                 fixed = 0;
9134                 mask = LIBIPW_DEFAULT_RATES_MASK;
9135                 /* Now we should reassociate */
9136                 goto apply;
9137         }
9138
9139         mask = 0;
9140         fixed = wrqu->bitrate.fixed;
9141
9142         if (target_rate == 1000000 || !fixed)
9143                 mask |= LIBIPW_CCK_RATE_1MB_MASK;
9144         if (target_rate == 1000000)
9145                 goto apply;
9146
9147         if (target_rate == 2000000 || !fixed)
9148                 mask |= LIBIPW_CCK_RATE_2MB_MASK;
9149         if (target_rate == 2000000)
9150                 goto apply;
9151
9152         if (target_rate == 5500000 || !fixed)
9153                 mask |= LIBIPW_CCK_RATE_5MB_MASK;
9154         if (target_rate == 5500000)
9155                 goto apply;
9156
9157         if (target_rate == 6000000 || !fixed)
9158                 mask |= LIBIPW_OFDM_RATE_6MB_MASK;
9159         if (target_rate == 6000000)
9160                 goto apply;
9161
9162         if (target_rate == 9000000 || !fixed)
9163                 mask |= LIBIPW_OFDM_RATE_9MB_MASK;
9164         if (target_rate == 9000000)
9165                 goto apply;
9166
9167         if (target_rate == 11000000 || !fixed)
9168                 mask |= LIBIPW_CCK_RATE_11MB_MASK;
9169         if (target_rate == 11000000)
9170                 goto apply;
9171
9172         if (target_rate == 12000000 || !fixed)
9173                 mask |= LIBIPW_OFDM_RATE_12MB_MASK;
9174         if (target_rate == 12000000)
9175                 goto apply;
9176
9177         if (target_rate == 18000000 || !fixed)
9178                 mask |= LIBIPW_OFDM_RATE_18MB_MASK;
9179         if (target_rate == 18000000)
9180                 goto apply;
9181
9182         if (target_rate == 24000000 || !fixed)
9183                 mask |= LIBIPW_OFDM_RATE_24MB_MASK;
9184         if (target_rate == 24000000)
9185                 goto apply;
9186
9187         if (target_rate == 36000000 || !fixed)
9188                 mask |= LIBIPW_OFDM_RATE_36MB_MASK;
9189         if (target_rate == 36000000)
9190                 goto apply;
9191
9192         if (target_rate == 48000000 || !fixed)
9193                 mask |= LIBIPW_OFDM_RATE_48MB_MASK;
9194         if (target_rate == 48000000)
9195                 goto apply;
9196
9197         if (target_rate == 54000000 || !fixed)
9198                 mask |= LIBIPW_OFDM_RATE_54MB_MASK;
9199         if (target_rate == 54000000)
9200                 goto apply;
9201
9202         IPW_DEBUG_WX("invalid rate specified, returning error\n");
9203         return -EINVAL;
9204
9205       apply:
9206         IPW_DEBUG_WX("Setting rate mask to 0x%08X [%s]\n",
9207                      mask, fixed ? "fixed" : "sub-rates");
9208         mutex_lock(&priv->mutex);
9209         if (mask == LIBIPW_DEFAULT_RATES_MASK) {
9210                 priv->config &= ~CFG_FIXED_RATE;
9211                 ipw_set_fixed_rate(priv, priv->ieee->mode);
9212         } else
9213                 priv->config |= CFG_FIXED_RATE;
9214
9215         if (priv->rates_mask == mask) {
9216                 IPW_DEBUG_WX("Mask set to current mask.\n");
9217                 mutex_unlock(&priv->mutex);
9218                 return 0;
9219         }
9220
9221         priv->rates_mask = mask;
9222
9223         /* Network configuration changed -- force [re]association */
9224         IPW_DEBUG_ASSOC("[re]association triggered due to rates change.\n");
9225         if (!ipw_disassociate(priv))
9226                 ipw_associate(priv);
9227
9228         mutex_unlock(&priv->mutex);
9229         return 0;
9230 }
9231
9232 static int ipw_wx_get_rate(struct net_device *dev,
9233                            struct iw_request_info *info,
9234                            union iwreq_data *wrqu, char *extra)
9235 {
9236         struct ipw_priv *priv = libipw_priv(dev);
9237         mutex_lock(&priv->mutex);
9238         wrqu->bitrate.value = priv->last_rate;
9239         wrqu->bitrate.fixed = (priv->config & CFG_FIXED_RATE) ? 1 : 0;
9240         mutex_unlock(&priv->mutex);
9241         IPW_DEBUG_WX("GET Rate -> %d\n", wrqu->bitrate.value);
9242         return 0;
9243 }
9244
9245 static int ipw_wx_set_rts(struct net_device *dev,
9246                           struct iw_request_info *info,
9247                           union iwreq_data *wrqu, char *extra)
9248 {
9249         struct ipw_priv *priv = libipw_priv(dev);
9250         mutex_lock(&priv->mutex);
9251         if (wrqu->rts.disabled || !wrqu->rts.fixed)
9252                 priv->rts_threshold = DEFAULT_RTS_THRESHOLD;
9253         else {
9254                 if (wrqu->rts.value < MIN_RTS_THRESHOLD ||
9255                     wrqu->rts.value > MAX_RTS_THRESHOLD) {
9256                         mutex_unlock(&priv->mutex);
9257                         return -EINVAL;
9258                 }
9259                 priv->rts_threshold = wrqu->rts.value;
9260         }
9261
9262         ipw_send_rts_threshold(priv, priv->rts_threshold);
9263         mutex_unlock(&priv->mutex);
9264         IPW_DEBUG_WX("SET RTS Threshold -> %d\n", priv->rts_threshold);
9265         return 0;
9266 }
9267
9268 static int ipw_wx_get_rts(struct net_device *dev,
9269                           struct iw_request_info *info,
9270                           union iwreq_data *wrqu, char *extra)
9271 {
9272         struct ipw_priv *priv = libipw_priv(dev);
9273         mutex_lock(&priv->mutex);
9274         wrqu->rts.value = priv->rts_threshold;
9275         wrqu->rts.fixed = 0;    /* no auto select */
9276         wrqu->rts.disabled = (wrqu->rts.value == DEFAULT_RTS_THRESHOLD);
9277         mutex_unlock(&priv->mutex);
9278         IPW_DEBUG_WX("GET RTS Threshold -> %d\n", wrqu->rts.value);
9279         return 0;
9280 }
9281
9282 static int ipw_wx_set_txpow(struct net_device *dev,
9283                             struct iw_request_info *info,
9284                             union iwreq_data *wrqu, char *extra)
9285 {
9286         struct ipw_priv *priv = libipw_priv(dev);
9287         int err = 0;
9288
9289         mutex_lock(&priv->mutex);
9290         if (ipw_radio_kill_sw(priv, wrqu->power.disabled)) {
9291                 err = -EINPROGRESS;
9292                 goto out;
9293         }
9294
9295         if (!wrqu->power.fixed)
9296                 wrqu->power.value = IPW_TX_POWER_DEFAULT;
9297
9298         if (wrqu->power.flags != IW_TXPOW_DBM) {
9299                 err = -EINVAL;
9300                 goto out;
9301         }
9302
9303         if ((wrqu->power.value > IPW_TX_POWER_MAX) ||
9304             (wrqu->power.value < IPW_TX_POWER_MIN)) {
9305                 err = -EINVAL;
9306                 goto out;
9307         }
9308
9309         priv->tx_power = wrqu->power.value;
9310         err = ipw_set_tx_power(priv);
9311       out:
9312         mutex_unlock(&priv->mutex);
9313         return err;
9314 }
9315
9316 static int ipw_wx_get_txpow(struct net_device *dev,
9317                             struct iw_request_info *info,
9318                             union iwreq_data *wrqu, char *extra)
9319 {
9320         struct ipw_priv *priv = libipw_priv(dev);
9321         mutex_lock(&priv->mutex);
9322         wrqu->power.value = priv->tx_power;
9323         wrqu->power.fixed = 1;
9324         wrqu->power.flags = IW_TXPOW_DBM;
9325         wrqu->power.disabled = (priv->status & STATUS_RF_KILL_MASK) ? 1 : 0;
9326         mutex_unlock(&priv->mutex);
9327
9328         IPW_DEBUG_WX("GET TX Power -> %s %d\n",
9329                      wrqu->power.disabled ? "OFF" : "ON", wrqu->power.value);
9330
9331         return 0;
9332 }
9333
9334 static int ipw_wx_set_frag(struct net_device *dev,
9335                            struct iw_request_info *info,
9336                            union iwreq_data *wrqu, char *extra)
9337 {
9338         struct ipw_priv *priv = libipw_priv(dev);
9339         mutex_lock(&priv->mutex);
9340         if (wrqu->frag.disabled || !wrqu->frag.fixed)
9341                 priv->ieee->fts = DEFAULT_FTS;
9342         else {
9343                 if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
9344                     wrqu->frag.value > MAX_FRAG_THRESHOLD) {
9345                         mutex_unlock(&priv->mutex);
9346                         return -EINVAL;
9347                 }
9348
9349                 priv->ieee->fts = wrqu->frag.value & ~0x1;
9350         }
9351
9352         ipw_send_frag_threshold(priv, wrqu->frag.value);
9353         mutex_unlock(&priv->mutex);
9354         IPW_DEBUG_WX("SET Frag Threshold -> %d\n", wrqu->frag.value);
9355         return 0;
9356 }
9357
9358 static int ipw_wx_get_frag(struct net_device *dev,
9359                            struct iw_request_info *info,
9360                            union iwreq_data *wrqu, char *extra)
9361 {
9362         struct ipw_priv *priv = libipw_priv(dev);
9363         mutex_lock(&priv->mutex);
9364         wrqu->frag.value = priv->ieee->fts;
9365         wrqu->frag.fixed = 0;   /* no auto select */
9366         wrqu->frag.disabled = (wrqu->frag.value == DEFAULT_FTS);
9367         mutex_unlock(&priv->mutex);
9368         IPW_DEBUG_WX("GET Frag Threshold -> %d\n", wrqu->frag.value);
9369
9370         return 0;
9371 }
9372
9373 static int ipw_wx_set_retry(struct net_device *dev,
9374                             struct iw_request_info *info,
9375                             union iwreq_data *wrqu, char *extra)
9376 {
9377         struct ipw_priv *priv = libipw_priv(dev);
9378
9379         if (wrqu->retry.flags & IW_RETRY_LIFETIME || wrqu->retry.disabled)
9380                 return -EINVAL;
9381
9382         if (!(wrqu->retry.flags & IW_RETRY_LIMIT))
9383                 return 0;
9384
9385         if (wrqu->retry.value < 0 || wrqu->retry.value >= 255)
9386                 return -EINVAL;
9387
9388         mutex_lock(&priv->mutex);
9389         if (wrqu->retry.flags & IW_RETRY_SHORT)
9390                 priv->short_retry_limit = (u8) wrqu->retry.value;
9391         else if (wrqu->retry.flags & IW_RETRY_LONG)
9392                 priv->long_retry_limit = (u8) wrqu->retry.value;
9393         else {
9394                 priv->short_retry_limit = (u8) wrqu->retry.value;
9395                 priv->long_retry_limit = (u8) wrqu->retry.value;
9396         }
9397
9398         ipw_send_retry_limit(priv, priv->short_retry_limit,
9399                              priv->long_retry_limit);
9400         mutex_unlock(&priv->mutex);
9401         IPW_DEBUG_WX("SET retry limit -> short:%d long:%d\n",
9402                      priv->short_retry_limit, priv->long_retry_limit);
9403         return 0;
9404 }
9405
9406 static int ipw_wx_get_retry(struct net_device *dev,
9407                             struct iw_request_info *info,
9408                             union iwreq_data *wrqu, char *extra)
9409 {
9410         struct ipw_priv *priv = libipw_priv(dev);
9411
9412         mutex_lock(&priv->mutex);
9413         wrqu->retry.disabled = 0;
9414
9415         if ((wrqu->retry.flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME) {
9416                 mutex_unlock(&priv->mutex);
9417                 return -EINVAL;
9418         }
9419
9420         if (wrqu->retry.flags & IW_RETRY_LONG) {
9421                 wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
9422                 wrqu->retry.value = priv->long_retry_limit;
9423         } else if (wrqu->retry.flags & IW_RETRY_SHORT) {
9424                 wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_SHORT;
9425                 wrqu->retry.value = priv->short_retry_limit;
9426         } else {
9427                 wrqu->retry.flags = IW_RETRY_LIMIT;
9428                 wrqu->retry.value = priv->short_retry_limit;
9429         }
9430         mutex_unlock(&priv->mutex);
9431
9432         IPW_DEBUG_WX("GET retry -> %d\n", wrqu->retry.value);
9433
9434         return 0;
9435 }
9436
9437 static int ipw_wx_set_scan(struct net_device *dev,
9438                            struct iw_request_info *info,
9439                            union iwreq_data *wrqu, char *extra)
9440 {
9441         struct ipw_priv *priv = libipw_priv(dev);
9442         struct iw_scan_req *req = (struct iw_scan_req *)extra;
9443         struct delayed_work *work = NULL;
9444
9445         mutex_lock(&priv->mutex);
9446
9447         priv->user_requested_scan = 1;
9448
9449         if (wrqu->data.length == sizeof(struct iw_scan_req)) {
9450                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
9451                         int len = min((int)req->essid_len,
9452                                       (int)sizeof(priv->direct_scan_ssid));
9453                         memcpy(priv->direct_scan_ssid, req->essid, len);
9454                         priv->direct_scan_ssid_len = len;
9455                         work = &priv->request_direct_scan;
9456                 } else if (req->scan_type == IW_SCAN_TYPE_PASSIVE) {
9457                         work = &priv->request_passive_scan;
9458                 }
9459         } else {
9460                 /* Normal active broadcast scan */
9461                 work = &priv->request_scan;
9462         }
9463
9464         mutex_unlock(&priv->mutex);
9465
9466         IPW_DEBUG_WX("Start scan\n");
9467
9468         schedule_delayed_work(work, 0);
9469
9470         return 0;
9471 }
9472
9473 static int ipw_wx_get_scan(struct net_device *dev,
9474                            struct iw_request_info *info,
9475                            union iwreq_data *wrqu, char *extra)
9476 {
9477         struct ipw_priv *priv = libipw_priv(dev);
9478         return libipw_wx_get_scan(priv->ieee, info, wrqu, extra);
9479 }
9480
9481 static int ipw_wx_set_encode(struct net_device *dev,
9482                              struct iw_request_info *info,
9483                              union iwreq_data *wrqu, char *key)
9484 {
9485         struct ipw_priv *priv = libipw_priv(dev);
9486         int ret;
9487         u32 cap = priv->capability;
9488
9489         mutex_lock(&priv->mutex);
9490         ret = libipw_wx_set_encode(priv->ieee, info, wrqu, key);
9491
9492         /* In IBSS mode, we need to notify the firmware to update
9493          * the beacon info after we changed the capability. */
9494         if (cap != priv->capability &&
9495             priv->ieee->iw_mode == IW_MODE_ADHOC &&
9496             priv->status & STATUS_ASSOCIATED)
9497                 ipw_disassociate(priv);
9498
9499         mutex_unlock(&priv->mutex);
9500         return ret;
9501 }
9502
9503 static int ipw_wx_get_encode(struct net_device *dev,
9504                              struct iw_request_info *info,
9505                              union iwreq_data *wrqu, char *key)
9506 {
9507         struct ipw_priv *priv = libipw_priv(dev);
9508         return libipw_wx_get_encode(priv->ieee, info, wrqu, key);
9509 }
9510
9511 static int ipw_wx_set_power(struct net_device *dev,
9512                             struct iw_request_info *info,
9513                             union iwreq_data *wrqu, char *extra)
9514 {
9515         struct ipw_priv *priv = libipw_priv(dev);
9516         int err;
9517         mutex_lock(&priv->mutex);
9518         if (wrqu->power.disabled) {
9519                 priv->power_mode = IPW_POWER_LEVEL(priv->power_mode);
9520                 err = ipw_send_power_mode(priv, IPW_POWER_MODE_CAM);
9521                 if (err) {
9522                         IPW_DEBUG_WX("failed setting power mode.\n");
9523                         mutex_unlock(&priv->mutex);
9524                         return err;
9525                 }
9526                 IPW_DEBUG_WX("SET Power Management Mode -> off\n");
9527                 mutex_unlock(&priv->mutex);
9528                 return 0;
9529         }
9530
9531         switch (wrqu->power.flags & IW_POWER_MODE) {
9532         case IW_POWER_ON:       /* If not specified */
9533         case IW_POWER_MODE:     /* If set all mask */
9534         case IW_POWER_ALL_R:    /* If explicitly state all */
9535                 break;
9536         default:                /* Otherwise we don't support it */
9537                 IPW_DEBUG_WX("SET PM Mode: %X not supported.\n",
9538                              wrqu->power.flags);
9539                 mutex_unlock(&priv->mutex);
9540                 return -EOPNOTSUPP;
9541         }
9542
9543         /* If the user hasn't specified a power management mode yet, default
9544          * to BATTERY */
9545         if (IPW_POWER_LEVEL(priv->power_mode) == IPW_POWER_AC)
9546                 priv->power_mode = IPW_POWER_ENABLED | IPW_POWER_BATTERY;
9547         else
9548                 priv->power_mode = IPW_POWER_ENABLED | priv->power_mode;
9549
9550         err = ipw_send_power_mode(priv, IPW_POWER_LEVEL(priv->power_mode));
9551         if (err) {
9552                 IPW_DEBUG_WX("failed setting power mode.\n");
9553                 mutex_unlock(&priv->mutex);
9554                 return err;
9555         }
9556
9557         IPW_DEBUG_WX("SET Power Management Mode -> 0x%02X\n", priv->power_mode);
9558         mutex_unlock(&priv->mutex);
9559         return 0;
9560 }
9561
9562 static int ipw_wx_get_power(struct net_device *dev,
9563                             struct iw_request_info *info,
9564                             union iwreq_data *wrqu, char *extra)
9565 {
9566         struct ipw_priv *priv = libipw_priv(dev);
9567         mutex_lock(&priv->mutex);
9568         if (!(priv->power_mode & IPW_POWER_ENABLED))
9569                 wrqu->power.disabled = 1;
9570         else
9571                 wrqu->power.disabled = 0;
9572
9573         mutex_unlock(&priv->mutex);
9574         IPW_DEBUG_WX("GET Power Management Mode -> %02X\n", priv->power_mode);
9575
9576         return 0;
9577 }
9578
9579 static int ipw_wx_set_powermode(struct net_device *dev,
9580                                 struct iw_request_info *info,
9581                                 union iwreq_data *wrqu, char *extra)
9582 {
9583         struct ipw_priv *priv = libipw_priv(dev);
9584         int mode = *(int *)extra;
9585         int err;
9586
9587         mutex_lock(&priv->mutex);
9588         if ((mode < 1) || (mode > IPW_POWER_LIMIT))
9589                 mode = IPW_POWER_AC;
9590
9591         if (IPW_POWER_LEVEL(priv->power_mode) != mode) {
9592                 err = ipw_send_power_mode(priv, mode);
9593                 if (err) {
9594                         IPW_DEBUG_WX("failed setting power mode.\n");
9595                         mutex_unlock(&priv->mutex);
9596                         return err;
9597                 }
9598                 priv->power_mode = IPW_POWER_ENABLED | mode;
9599         }
9600         mutex_unlock(&priv->mutex);
9601         return 0;
9602 }
9603
9604 #define MAX_WX_STRING 80
9605 static int ipw_wx_get_powermode(struct net_device *dev,
9606                                 struct iw_request_info *info,
9607                                 union iwreq_data *wrqu, char *extra)
9608 {
9609         struct ipw_priv *priv = libipw_priv(dev);
9610         int level = IPW_POWER_LEVEL(priv->power_mode);
9611         char *p = extra;
9612
9613         p += snprintf(p, MAX_WX_STRING, "Power save level: %d ", level);
9614
9615         switch (level) {
9616         case IPW_POWER_AC:
9617                 p += snprintf(p, MAX_WX_STRING - (p - extra), "(AC)");
9618                 break;
9619         case IPW_POWER_BATTERY:
9620                 p += snprintf(p, MAX_WX_STRING - (p - extra), "(BATTERY)");
9621                 break;
9622         default:
9623                 p += snprintf(p, MAX_WX_STRING - (p - extra),
9624                               "(Timeout %dms, Period %dms)",
9625                               timeout_duration[level - 1] / 1000,
9626                               period_duration[level - 1] / 1000);
9627         }
9628
9629         if (!(priv->power_mode & IPW_POWER_ENABLED))
9630                 p += snprintf(p, MAX_WX_STRING - (p - extra), " OFF");
9631
9632         wrqu->data.length = p - extra + 1;
9633
9634         return 0;
9635 }
9636
9637 static int ipw_wx_set_wireless_mode(struct net_device *dev,
9638                                     struct iw_request_info *info,
9639                                     union iwreq_data *wrqu, char *extra)
9640 {
9641         struct ipw_priv *priv = libipw_priv(dev);
9642         int mode = *(int *)extra;
9643         u8 band = 0, modulation = 0;
9644
9645         if (mode == 0 || mode & ~IEEE_MODE_MASK) {
9646                 IPW_WARNING("Attempt to set invalid wireless mode: %d\n", mode);
9647                 return -EINVAL;
9648         }
9649         mutex_lock(&priv->mutex);
9650         if (priv->adapter == IPW_2915ABG) {
9651                 priv->ieee->abg_true = 1;
9652                 if (mode & IEEE_A) {
9653                         band |= LIBIPW_52GHZ_BAND;
9654                         modulation |= LIBIPW_OFDM_MODULATION;
9655                 } else
9656                         priv->ieee->abg_true = 0;
9657         } else {
9658                 if (mode & IEEE_A) {
9659                         IPW_WARNING("Attempt to set 2200BG into "
9660                                     "802.11a mode\n");
9661                         mutex_unlock(&priv->mutex);
9662                         return -EINVAL;
9663                 }
9664
9665                 priv->ieee->abg_true = 0;
9666         }
9667
9668         if (mode & IEEE_B) {
9669                 band |= LIBIPW_24GHZ_BAND;
9670                 modulation |= LIBIPW_CCK_MODULATION;
9671         } else
9672                 priv->ieee->abg_true = 0;
9673
9674         if (mode & IEEE_G) {
9675                 band |= LIBIPW_24GHZ_BAND;
9676                 modulation |= LIBIPW_OFDM_MODULATION;
9677         } else
9678                 priv->ieee->abg_true = 0;
9679
9680         priv->ieee->mode = mode;
9681         priv->ieee->freq_band = band;
9682         priv->ieee->modulation = modulation;
9683         init_supported_rates(priv, &priv->rates);
9684
9685         /* Network configuration changed -- force [re]association */
9686         IPW_DEBUG_ASSOC("[re]association triggered due to mode change.\n");
9687         if (!ipw_disassociate(priv)) {
9688                 ipw_send_supported_rates(priv, &priv->rates);
9689                 ipw_associate(priv);
9690         }
9691
9692         /* Update the band LEDs */
9693         ipw_led_band_on(priv);
9694
9695         IPW_DEBUG_WX("PRIV SET MODE: %c%c%c\n",
9696                      mode & IEEE_A ? 'a' : '.',
9697                      mode & IEEE_B ? 'b' : '.', mode & IEEE_G ? 'g' : '.');
9698         mutex_unlock(&priv->mutex);
9699         return 0;
9700 }
9701
9702 static int ipw_wx_get_wireless_mode(struct net_device *dev,
9703                                     struct iw_request_info *info,
9704                                     union iwreq_data *wrqu, char *extra)
9705 {
9706         struct ipw_priv *priv = libipw_priv(dev);
9707         mutex_lock(&priv->mutex);
9708         switch (priv->ieee->mode) {
9709         case IEEE_A:
9710                 strncpy(extra, "802.11a (1)", MAX_WX_STRING);
9711                 break;
9712         case IEEE_B:
9713                 strncpy(extra, "802.11b (2)", MAX_WX_STRING);
9714                 break;
9715         case IEEE_A | IEEE_B:
9716                 strncpy(extra, "802.11ab (3)", MAX_WX_STRING);
9717                 break;
9718         case IEEE_G:
9719                 strncpy(extra, "802.11g (4)", MAX_WX_STRING);
9720                 break;
9721         case IEEE_A | IEEE_G:
9722                 strncpy(extra, "802.11ag (5)", MAX_WX_STRING);
9723                 break;
9724         case IEEE_B | IEEE_G:
9725                 strncpy(extra, "802.11bg (6)", MAX_WX_STRING);
9726                 break;
9727         case IEEE_A | IEEE_B | IEEE_G:
9728                 strncpy(extra, "802.11abg (7)", MAX_WX_STRING);
9729                 break;
9730         default:
9731                 strncpy(extra, "unknown", MAX_WX_STRING);
9732                 break;
9733         }
9734         extra[MAX_WX_STRING - 1] = '\0';
9735
9736         IPW_DEBUG_WX("PRIV GET MODE: %s\n", extra);
9737
9738         wrqu->data.length = strlen(extra) + 1;
9739         mutex_unlock(&priv->mutex);
9740
9741         return 0;
9742 }
9743
9744 static int ipw_wx_set_preamble(struct net_device *dev,
9745                                struct iw_request_info *info,
9746                                union iwreq_data *wrqu, char *extra)
9747 {
9748         struct ipw_priv *priv = libipw_priv(dev);
9749         int mode = *(int *)extra;
9750         mutex_lock(&priv->mutex);
9751         /* Switching from SHORT -> LONG requires a disassociation */
9752         if (mode == 1) {
9753                 if (!(priv->config & CFG_PREAMBLE_LONG)) {
9754                         priv->config |= CFG_PREAMBLE_LONG;
9755
9756                         /* Network configuration changed -- force [re]association */
9757                         IPW_DEBUG_ASSOC
9758                             ("[re]association triggered due to preamble change.\n");
9759                         if (!ipw_disassociate(priv))
9760                                 ipw_associate(priv);
9761                 }
9762                 goto done;
9763         }
9764
9765         if (mode == 0) {
9766                 priv->config &= ~CFG_PREAMBLE_LONG;
9767                 goto done;
9768         }
9769         mutex_unlock(&priv->mutex);
9770         return -EINVAL;
9771
9772       done:
9773         mutex_unlock(&priv->mutex);
9774         return 0;
9775 }
9776
9777 static int ipw_wx_get_preamble(struct net_device *dev,
9778                                struct iw_request_info *info,
9779                                union iwreq_data *wrqu, char *extra)
9780 {
9781         struct ipw_priv *priv = libipw_priv(dev);
9782         mutex_lock(&priv->mutex);
9783         if (priv->config & CFG_PREAMBLE_LONG)
9784                 snprintf(wrqu->name, IFNAMSIZ, "long (1)");
9785         else
9786                 snprintf(wrqu->name, IFNAMSIZ, "auto (0)");
9787         mutex_unlock(&priv->mutex);
9788         return 0;
9789 }
9790
9791 #ifdef CONFIG_IPW2200_MONITOR
9792 static int ipw_wx_set_monitor(struct net_device *dev,
9793                               struct iw_request_info *info,
9794                               union iwreq_data *wrqu, char *extra)
9795 {
9796         struct ipw_priv *priv = libipw_priv(dev);
9797         int *parms = (int *)extra;
9798         int enable = (parms[0] > 0);
9799         mutex_lock(&priv->mutex);
9800         IPW_DEBUG_WX("SET MONITOR: %d %d\n", enable, parms[1]);
9801         if (enable) {
9802                 if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
9803 #ifdef CONFIG_IPW2200_RADIOTAP
9804                         priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
9805 #else
9806                         priv->net_dev->type = ARPHRD_IEEE80211;
9807 #endif
9808                         schedule_work(&priv->adapter_restart);
9809                 }
9810
9811                 ipw_set_channel(priv, parms[1]);
9812         } else {
9813                 if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
9814                         mutex_unlock(&priv->mutex);
9815                         return 0;
9816                 }
9817                 priv->net_dev->type = ARPHRD_ETHER;
9818                 schedule_work(&priv->adapter_restart);
9819         }
9820         mutex_unlock(&priv->mutex);
9821         return 0;
9822 }
9823
9824 #endif                          /* CONFIG_IPW2200_MONITOR */
9825
9826 static int ipw_wx_reset(struct net_device *dev,
9827                         struct iw_request_info *info,
9828                         union iwreq_data *wrqu, char *extra)
9829 {
9830         struct ipw_priv *priv = libipw_priv(dev);
9831         IPW_DEBUG_WX("RESET\n");
9832         schedule_work(&priv->adapter_restart);
9833         return 0;
9834 }
9835
9836 static int ipw_wx_sw_reset(struct net_device *dev,
9837                            struct iw_request_info *info,
9838                            union iwreq_data *wrqu, char *extra)
9839 {
9840         struct ipw_priv *priv = libipw_priv(dev);
9841         union iwreq_data wrqu_sec = {
9842                 .encoding = {
9843                              .flags = IW_ENCODE_DISABLED,
9844                              },
9845         };
9846         int ret;
9847
9848         IPW_DEBUG_WX("SW_RESET\n");
9849
9850         mutex_lock(&priv->mutex);
9851
9852         ret = ipw_sw_reset(priv, 2);
9853         if (!ret) {
9854                 free_firmware();
9855                 ipw_adapter_restart(priv);
9856         }
9857
9858         /* The SW reset bit might have been toggled on by the 'disable'
9859          * module parameter, so take appropriate action */
9860         ipw_radio_kill_sw(priv, priv->status & STATUS_RF_KILL_SW);
9861
9862         mutex_unlock(&priv->mutex);
9863         libipw_wx_set_encode(priv->ieee, info, &wrqu_sec, NULL);
9864         mutex_lock(&priv->mutex);
9865
9866         if (!(priv->status & STATUS_RF_KILL_MASK)) {
9867                 /* Configuration likely changed -- force [re]association */
9868                 IPW_DEBUG_ASSOC("[re]association triggered due to sw "
9869                                 "reset.\n");
9870                 if (!ipw_disassociate(priv))
9871                         ipw_associate(priv);
9872         }
9873
9874         mutex_unlock(&priv->mutex);
9875
9876         return 0;
9877 }
9878
9879 /* Rebase the WE IOCTLs to zero for the handler array */
9880 static iw_handler ipw_wx_handlers[] = {
9881         IW_HANDLER(SIOCGIWNAME, (iw_handler)cfg80211_wext_giwname),
9882         IW_HANDLER(SIOCSIWFREQ, ipw_wx_set_freq),
9883         IW_HANDLER(SIOCGIWFREQ, ipw_wx_get_freq),
9884         IW_HANDLER(SIOCSIWMODE, ipw_wx_set_mode),
9885         IW_HANDLER(SIOCGIWMODE, ipw_wx_get_mode),
9886         IW_HANDLER(SIOCSIWSENS, ipw_wx_set_sens),
9887         IW_HANDLER(SIOCGIWSENS, ipw_wx_get_sens),
9888         IW_HANDLER(SIOCGIWRANGE, ipw_wx_get_range),
9889         IW_HANDLER(SIOCSIWAP, ipw_wx_set_wap),
9890         IW_HANDLER(SIOCGIWAP, ipw_wx_get_wap),
9891         IW_HANDLER(SIOCSIWSCAN, ipw_wx_set_scan),
9892         IW_HANDLER(SIOCGIWSCAN, ipw_wx_get_scan),
9893         IW_HANDLER(SIOCSIWESSID, ipw_wx_set_essid),
9894         IW_HANDLER(SIOCGIWESSID, ipw_wx_get_essid),
9895         IW_HANDLER(SIOCSIWNICKN, ipw_wx_set_nick),
9896         IW_HANDLER(SIOCGIWNICKN, ipw_wx_get_nick),
9897         IW_HANDLER(SIOCSIWRATE, ipw_wx_set_rate),
9898         IW_HANDLER(SIOCGIWRATE, ipw_wx_get_rate),
9899         IW_HANDLER(SIOCSIWRTS, ipw_wx_set_rts),
9900         IW_HANDLER(SIOCGIWRTS, ipw_wx_get_rts),
9901         IW_HANDLER(SIOCSIWFRAG, ipw_wx_set_frag),
9902         IW_HANDLER(SIOCGIWFRAG, ipw_wx_get_frag),
9903         IW_HANDLER(SIOCSIWTXPOW, ipw_wx_set_txpow),
9904         IW_HANDLER(SIOCGIWTXPOW, ipw_wx_get_txpow),
9905         IW_HANDLER(SIOCSIWRETRY, ipw_wx_set_retry),
9906         IW_HANDLER(SIOCGIWRETRY, ipw_wx_get_retry),
9907         IW_HANDLER(SIOCSIWENCODE, ipw_wx_set_encode),
9908         IW_HANDLER(SIOCGIWENCODE, ipw_wx_get_encode),
9909         IW_HANDLER(SIOCSIWPOWER, ipw_wx_set_power),
9910         IW_HANDLER(SIOCGIWPOWER, ipw_wx_get_power),
9911         IW_HANDLER(SIOCSIWSPY, iw_handler_set_spy),
9912         IW_HANDLER(SIOCGIWSPY, iw_handler_get_spy),
9913         IW_HANDLER(SIOCSIWTHRSPY, iw_handler_set_thrspy),
9914         IW_HANDLER(SIOCGIWTHRSPY, iw_handler_get_thrspy),
9915         IW_HANDLER(SIOCSIWGENIE, ipw_wx_set_genie),
9916         IW_HANDLER(SIOCGIWGENIE, ipw_wx_get_genie),
9917         IW_HANDLER(SIOCSIWMLME, ipw_wx_set_mlme),
9918         IW_HANDLER(SIOCSIWAUTH, ipw_wx_set_auth),
9919         IW_HANDLER(SIOCGIWAUTH, ipw_wx_get_auth),
9920         IW_HANDLER(SIOCSIWENCODEEXT, ipw_wx_set_encodeext),
9921         IW_HANDLER(SIOCGIWENCODEEXT, ipw_wx_get_encodeext),
9922 };
9923
9924 enum {
9925         IPW_PRIV_SET_POWER = SIOCIWFIRSTPRIV,
9926         IPW_PRIV_GET_POWER,
9927         IPW_PRIV_SET_MODE,
9928         IPW_PRIV_GET_MODE,
9929         IPW_PRIV_SET_PREAMBLE,
9930         IPW_PRIV_GET_PREAMBLE,
9931         IPW_PRIV_RESET,
9932         IPW_PRIV_SW_RESET,
9933 #ifdef CONFIG_IPW2200_MONITOR
9934         IPW_PRIV_SET_MONITOR,
9935 #endif
9936 };
9937
9938 static struct iw_priv_args ipw_priv_args[] = {
9939         {
9940          .cmd = IPW_PRIV_SET_POWER,
9941          .set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
9942          .name = "set_power"},
9943         {
9944          .cmd = IPW_PRIV_GET_POWER,
9945          .get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
9946          .name = "get_power"},
9947         {
9948          .cmd = IPW_PRIV_SET_MODE,
9949          .set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
9950          .name = "set_mode"},
9951         {
9952          .cmd = IPW_PRIV_GET_MODE,
9953          .get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
9954          .name = "get_mode"},
9955         {
9956          .cmd = IPW_PRIV_SET_PREAMBLE,
9957          .set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
9958          .name = "set_preamble"},
9959         {
9960          .cmd = IPW_PRIV_GET_PREAMBLE,
9961          .get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | IFNAMSIZ,
9962          .name = "get_preamble"},
9963         {
9964          IPW_PRIV_RESET,
9965          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 0, 0, "reset"},
9966         {
9967          IPW_PRIV_SW_RESET,
9968          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 0, 0, "sw_reset"},
9969 #ifdef CONFIG_IPW2200_MONITOR
9970         {
9971          IPW_PRIV_SET_MONITOR,
9972          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "monitor"},
9973 #endif                          /* CONFIG_IPW2200_MONITOR */
9974 };
9975
9976 static iw_handler ipw_priv_handler[] = {
9977         ipw_wx_set_powermode,
9978         ipw_wx_get_powermode,
9979         ipw_wx_set_wireless_mode,
9980         ipw_wx_get_wireless_mode,
9981         ipw_wx_set_preamble,
9982         ipw_wx_get_preamble,
9983         ipw_wx_reset,
9984         ipw_wx_sw_reset,
9985 #ifdef CONFIG_IPW2200_MONITOR
9986         ipw_wx_set_monitor,
9987 #endif
9988 };
9989
9990 static const struct iw_handler_def ipw_wx_handler_def = {
9991         .standard = ipw_wx_handlers,
9992         .num_standard = ARRAY_SIZE(ipw_wx_handlers),
9993         .num_private = ARRAY_SIZE(ipw_priv_handler),
9994         .num_private_args = ARRAY_SIZE(ipw_priv_args),
9995         .private = ipw_priv_handler,
9996         .private_args = ipw_priv_args,
9997         .get_wireless_stats = ipw_get_wireless_stats,
9998 };
9999
10000 /*
10001  * Get wireless statistics.
10002  * Called by /proc/net/wireless
10003  * Also called by SIOCGIWSTATS
10004  */
10005 static struct iw_statistics *ipw_get_wireless_stats(struct net_device *dev)
10006 {
10007         struct ipw_priv *priv = libipw_priv(dev);
10008         struct iw_statistics *wstats;
10009
10010         wstats = &priv->wstats;
10011
10012         /* if hw is disabled, then ipw_get_ordinal() can't be called.
10013          * netdev->get_wireless_stats seems to be called before fw is
10014          * initialized.  STATUS_ASSOCIATED will only be set if the hw is up
10015          * and associated; if not associcated, the values are all meaningless
10016          * anyway, so set them all to NULL and INVALID */
10017         if (!(priv->status & STATUS_ASSOCIATED)) {
10018                 wstats->miss.beacon = 0;
10019                 wstats->discard.retries = 0;
10020                 wstats->qual.qual = 0;
10021                 wstats->qual.level = 0;
10022                 wstats->qual.noise = 0;
10023                 wstats->qual.updated = 7;
10024                 wstats->qual.updated |= IW_QUAL_NOISE_INVALID |
10025                     IW_QUAL_QUAL_INVALID | IW_QUAL_LEVEL_INVALID;
10026                 return wstats;
10027         }
10028
10029         wstats->qual.qual = priv->quality;
10030         wstats->qual.level = priv->exp_avg_rssi;
10031         wstats->qual.noise = priv->exp_avg_noise;
10032         wstats->qual.updated = IW_QUAL_QUAL_UPDATED | IW_QUAL_LEVEL_UPDATED |
10033             IW_QUAL_NOISE_UPDATED | IW_QUAL_DBM;
10034
10035         wstats->miss.beacon = average_value(&priv->average_missed_beacons);
10036         wstats->discard.retries = priv->last_tx_failures;
10037         wstats->discard.code = priv->ieee->ieee_stats.rx_discards_undecryptable;
10038
10039 /*      if (ipw_get_ordinal(priv, IPW_ORD_STAT_TX_RETRY, &tx_retry, &len))
10040         goto fail_get_ordinal;
10041         wstats->discard.retries += tx_retry; */
10042
10043         return wstats;
10044 }
10045
10046 /* net device stuff */
10047
10048 static  void init_sys_config(struct ipw_sys_config *sys_config)
10049 {
10050         memset(sys_config, 0, sizeof(struct ipw_sys_config));
10051         sys_config->bt_coexistence = 0;
10052         sys_config->answer_broadcast_ssid_probe = 0;
10053         sys_config->accept_all_data_frames = 0;
10054         sys_config->accept_non_directed_frames = 1;
10055         sys_config->exclude_unicast_unencrypted = 0;
10056         sys_config->disable_unicast_decryption = 1;
10057         sys_config->exclude_multicast_unencrypted = 0;
10058         sys_config->disable_multicast_decryption = 1;
10059         if (antenna < CFG_SYS_ANTENNA_BOTH || antenna > CFG_SYS_ANTENNA_B)
10060                 antenna = CFG_SYS_ANTENNA_BOTH;
10061         sys_config->antenna_diversity = antenna;
10062         sys_config->pass_crc_to_host = 0;       /* TODO: See if 1 gives us FCS */
10063         sys_config->dot11g_auto_detection = 0;
10064         sys_config->enable_cts_to_self = 0;
10065         sys_config->bt_coexist_collision_thr = 0;
10066         sys_config->pass_noise_stats_to_host = 1;       /* 1 -- fix for 256 */
10067         sys_config->silence_threshold = 0x1e;
10068 }
10069
10070 static int ipw_net_open(struct net_device *dev)
10071 {
10072         IPW_DEBUG_INFO("dev->open\n");
10073         netif_start_queue(dev);
10074         return 0;
10075 }
10076
10077 static int ipw_net_stop(struct net_device *dev)
10078 {
10079         IPW_DEBUG_INFO("dev->close\n");
10080         netif_stop_queue(dev);
10081         return 0;
10082 }
10083
10084 /*
10085 todo:
10086
10087 modify to send one tfd per fragment instead of using chunking.  otherwise
10088 we need to heavily modify the libipw_skb_to_txb.
10089 */
10090
10091 static int ipw_tx_skb(struct ipw_priv *priv, struct libipw_txb *txb,
10092                              int pri)
10093 {
10094         struct libipw_hdr_3addrqos *hdr = (struct libipw_hdr_3addrqos *)
10095             txb->fragments[0]->data;
10096         int i = 0;
10097         struct tfd_frame *tfd;
10098 #ifdef CONFIG_IPW2200_QOS
10099         int tx_id = ipw_get_tx_queue_number(priv, pri);
10100         struct clx2_tx_queue *txq = &priv->txq[tx_id];
10101 #else
10102         struct clx2_tx_queue *txq = &priv->txq[0];
10103 #endif
10104         struct clx2_queue *q = &txq->q;
10105         u8 id, hdr_len, unicast;
10106         int fc;
10107
10108         if (!(priv->status & STATUS_ASSOCIATED))
10109                 goto drop;
10110
10111         hdr_len = libipw_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
10112         switch (priv->ieee->iw_mode) {
10113         case IW_MODE_ADHOC:
10114                 unicast = !is_multicast_ether_addr(hdr->addr1);
10115                 id = ipw_find_station(priv, hdr->addr1);
10116                 if (id == IPW_INVALID_STATION) {
10117                         id = ipw_add_station(priv, hdr->addr1);
10118                         if (id == IPW_INVALID_STATION) {
10119                                 IPW_WARNING("Attempt to send data to "
10120                                             "invalid cell: %pM\n",
10121                                             hdr->addr1);
10122                                 goto drop;
10123                         }
10124                 }
10125                 break;
10126
10127         case IW_MODE_INFRA:
10128         default:
10129                 unicast = !is_multicast_ether_addr(hdr->addr3);
10130                 id = 0;
10131                 break;
10132         }
10133
10134         tfd = &txq->bd[q->first_empty];
10135         txq->txb[q->first_empty] = txb;
10136         memset(tfd, 0, sizeof(*tfd));
10137         tfd->u.data.station_number = id;
10138
10139         tfd->control_flags.message_type = TX_FRAME_TYPE;
10140         tfd->control_flags.control_bits = TFD_NEED_IRQ_MASK;
10141
10142         tfd->u.data.cmd_id = DINO_CMD_TX;
10143         tfd->u.data.len = cpu_to_le16(txb->payload_size);
10144
10145         if (priv->assoc_request.ieee_mode == IPW_B_MODE)
10146                 tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_MODE_CCK;
10147         else
10148                 tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_MODE_OFDM;
10149
10150         if (priv->assoc_request.preamble_length == DCT_FLAG_SHORT_PREAMBLE)
10151                 tfd->u.data.tx_flags |= DCT_FLAG_SHORT_PREAMBLE;
10152
10153         fc = le16_to_cpu(hdr->frame_ctl);
10154         hdr->frame_ctl = cpu_to_le16(fc & ~IEEE80211_FCTL_MOREFRAGS);
10155
10156         memcpy(&tfd->u.data.tfd.tfd_24.mchdr, hdr, hdr_len);
10157
10158         if (likely(unicast))
10159                 tfd->u.data.tx_flags |= DCT_FLAG_ACK_REQD;
10160
10161         if (txb->encrypted && !priv->ieee->host_encrypt) {
10162                 switch (priv->ieee->sec.level) {
10163                 case SEC_LEVEL_3:
10164                         tfd->u.data.tfd.tfd_24.mchdr.frame_ctl |=
10165                             cpu_to_le16(IEEE80211_FCTL_PROTECTED);
10166                         /* XXX: ACK flag must be set for CCMP even if it
10167                          * is a multicast/broadcast packet, because CCMP
10168                          * group communication encrypted by GTK is
10169                          * actually done by the AP. */
10170                         if (!unicast)
10171                                 tfd->u.data.tx_flags |= DCT_FLAG_ACK_REQD;
10172
10173                         tfd->u.data.tx_flags &= ~DCT_FLAG_NO_WEP;
10174                         tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_SECURITY_CCM;
10175                         tfd->u.data.key_index = 0;
10176                         tfd->u.data.key_index |= DCT_WEP_INDEX_USE_IMMEDIATE;
10177                         break;
10178                 case SEC_LEVEL_2:
10179                         tfd->u.data.tfd.tfd_24.mchdr.frame_ctl |=
10180                             cpu_to_le16(IEEE80211_FCTL_PROTECTED);
10181                         tfd->u.data.tx_flags &= ~DCT_FLAG_NO_WEP;
10182                         tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_SECURITY_TKIP;
10183                         tfd->u.data.key_index = DCT_WEP_INDEX_USE_IMMEDIATE;
10184                         break;
10185                 case SEC_LEVEL_1:
10186                         tfd->u.data.tfd.tfd_24.mchdr.frame_ctl |=
10187                             cpu_to_le16(IEEE80211_FCTL_PROTECTED);
10188                         tfd->u.data.key_index = priv->ieee->crypt_info.tx_keyidx;
10189                         if (priv->ieee->sec.key_sizes[priv->ieee->crypt_info.tx_keyidx] <=
10190                             40)
10191                                 tfd->u.data.key_index |= DCT_WEP_KEY_64Bit;
10192                         else
10193                                 tfd->u.data.key_index |= DCT_WEP_KEY_128Bit;
10194                         break;
10195                 case SEC_LEVEL_0:
10196                         break;
10197                 default:
10198                         printk(KERN_ERR "Unknown security level %d\n",
10199                                priv->ieee->sec.level);
10200                         break;
10201                 }
10202         } else
10203                 /* No hardware encryption */
10204                 tfd->u.data.tx_flags |= DCT_FLAG_NO_WEP;
10205
10206 #ifdef CONFIG_IPW2200_QOS
10207         if (fc & IEEE80211_STYPE_QOS_DATA)
10208                 ipw_qos_set_tx_queue_command(priv, pri, &(tfd->u.data));
10209 #endif                          /* CONFIG_IPW2200_QOS */
10210
10211         /* payload */
10212         tfd->u.data.num_chunks = cpu_to_le32(min((u8) (NUM_TFD_CHUNKS - 2),
10213                                                  txb->nr_frags));
10214         IPW_DEBUG_FRAG("%i fragments being sent as %i chunks.\n",
10215                        txb->nr_frags, le32_to_cpu(tfd->u.data.num_chunks));
10216         for (i = 0; i < le32_to_cpu(tfd->u.data.num_chunks); i++) {
10217                 IPW_DEBUG_FRAG("Adding fragment %i of %i (%d bytes).\n",
10218                                i, le32_to_cpu(tfd->u.data.num_chunks),
10219                                txb->fragments[i]->len - hdr_len);
10220                 IPW_DEBUG_TX("Dumping TX packet frag %i of %i (%d bytes):\n",
10221                              i, tfd->u.data.num_chunks,
10222                              txb->fragments[i]->len - hdr_len);
10223                 printk_buf(IPW_DL_TX, txb->fragments[i]->data + hdr_len,
10224                            txb->fragments[i]->len - hdr_len);
10225
10226                 tfd->u.data.chunk_ptr[i] =
10227                     cpu_to_le32(pci_map_single
10228                                 (priv->pci_dev,
10229                                  txb->fragments[i]->data + hdr_len,
10230                                  txb->fragments[i]->len - hdr_len,
10231                                  PCI_DMA_TODEVICE));
10232                 tfd->u.data.chunk_len[i] =
10233                     cpu_to_le16(txb->fragments[i]->len - hdr_len);
10234         }
10235
10236         if (i != txb->nr_frags) {
10237                 struct sk_buff *skb;
10238                 u16 remaining_bytes = 0;
10239                 int j;
10240
10241                 for (j = i; j < txb->nr_frags; j++)
10242                         remaining_bytes += txb->fragments[j]->len - hdr_len;
10243
10244                 printk(KERN_INFO "Trying to reallocate for %d bytes\n",
10245                        remaining_bytes);
10246                 skb = alloc_skb(remaining_bytes, GFP_ATOMIC);
10247                 if (skb != NULL) {
10248                         tfd->u.data.chunk_len[i] = cpu_to_le16(remaining_bytes);
10249                         for (j = i; j < txb->nr_frags; j++) {
10250                                 int size = txb->fragments[j]->len - hdr_len;
10251
10252                                 printk(KERN_INFO "Adding frag %d %d...\n",
10253                                        j, size);
10254                                 skb_put_data(skb,
10255                                              txb->fragments[j]->data + hdr_len,
10256                                              size);
10257                         }
10258                         dev_kfree_skb_any(txb->fragments[i]);
10259                         txb->fragments[i] = skb;
10260                         tfd->u.data.chunk_ptr[i] =
10261                             cpu_to_le32(pci_map_single
10262                                         (priv->pci_dev, skb->data,
10263                                          remaining_bytes,
10264                                          PCI_DMA_TODEVICE));
10265
10266                         le32_add_cpu(&tfd->u.data.num_chunks, 1);
10267                 }
10268         }
10269
10270         /* kick DMA */
10271         q->first_empty = ipw_queue_inc_wrap(q->first_empty, q->n_bd);
10272         ipw_write32(priv, q->reg_w, q->first_empty);
10273
10274         if (ipw_tx_queue_space(q) < q->high_mark)
10275                 netif_stop_queue(priv->net_dev);
10276
10277         return NETDEV_TX_OK;
10278
10279       drop:
10280         IPW_DEBUG_DROP("Silently dropping Tx packet.\n");
10281         libipw_txb_free(txb);
10282         return NETDEV_TX_OK;
10283 }
10284
10285 static int ipw_net_is_queue_full(struct net_device *dev, int pri)
10286 {
10287         struct ipw_priv *priv = libipw_priv(dev);
10288 #ifdef CONFIG_IPW2200_QOS
10289         int tx_id = ipw_get_tx_queue_number(priv, pri);
10290         struct clx2_tx_queue *txq = &priv->txq[tx_id];
10291 #else
10292         struct clx2_tx_queue *txq = &priv->txq[0];
10293 #endif                          /* CONFIG_IPW2200_QOS */
10294
10295         if (ipw_tx_queue_space(&txq->q) < txq->q.high_mark)
10296                 return 1;
10297
10298         return 0;
10299 }
10300
10301 #ifdef CONFIG_IPW2200_PROMISCUOUS
10302 static void ipw_handle_promiscuous_tx(struct ipw_priv *priv,
10303                                       struct libipw_txb *txb)
10304 {
10305         struct libipw_rx_stats dummystats;
10306         struct ieee80211_hdr *hdr;
10307         u8 n;
10308         u16 filter = priv->prom_priv->filter;
10309         int hdr_only = 0;
10310
10311         if (filter & IPW_PROM_NO_TX)
10312                 return;
10313
10314         memset(&dummystats, 0, sizeof(dummystats));
10315
10316         /* Filtering of fragment chains is done against the first fragment */
10317         hdr = (void *)txb->fragments[0]->data;
10318         if (libipw_is_management(le16_to_cpu(hdr->frame_control))) {
10319                 if (filter & IPW_PROM_NO_MGMT)
10320                         return;
10321                 if (filter & IPW_PROM_MGMT_HEADER_ONLY)
10322                         hdr_only = 1;
10323         } else if (libipw_is_control(le16_to_cpu(hdr->frame_control))) {
10324                 if (filter & IPW_PROM_NO_CTL)
10325                         return;
10326                 if (filter & IPW_PROM_CTL_HEADER_ONLY)
10327                         hdr_only = 1;
10328         } else if (libipw_is_data(le16_to_cpu(hdr->frame_control))) {
10329                 if (filter & IPW_PROM_NO_DATA)
10330                         return;
10331                 if (filter & IPW_PROM_DATA_HEADER_ONLY)
10332                         hdr_only = 1;
10333         }
10334
10335         for(n=0; n<txb->nr_frags; ++n) {
10336                 struct sk_buff *src = txb->fragments[n];
10337                 struct sk_buff *dst;
10338                 struct ieee80211_radiotap_header *rt_hdr;
10339                 int len;
10340
10341                 if (hdr_only) {
10342                         hdr = (void *)src->data;
10343                         len = libipw_get_hdrlen(le16_to_cpu(hdr->frame_control));
10344                 } else
10345                         len = src->len;
10346
10347                 dst = alloc_skb(len + sizeof(*rt_hdr) + sizeof(u16)*2, GFP_ATOMIC);
10348                 if (!dst)
10349                         continue;
10350
10351                 rt_hdr = skb_put(dst, sizeof(*rt_hdr));
10352
10353                 rt_hdr->it_version = PKTHDR_RADIOTAP_VERSION;
10354                 rt_hdr->it_pad = 0;
10355                 rt_hdr->it_present = 0; /* after all, it's just an idea */
10356                 rt_hdr->it_present |=  cpu_to_le32(1 << IEEE80211_RADIOTAP_CHANNEL);
10357
10358                 *(__le16*)skb_put(dst, sizeof(u16)) = cpu_to_le16(
10359                         ieee80211chan2mhz(priv->channel));
10360                 if (priv->channel > 14)         /* 802.11a */
10361                         *(__le16*)skb_put(dst, sizeof(u16)) =
10362                                 cpu_to_le16(IEEE80211_CHAN_OFDM |
10363                                              IEEE80211_CHAN_5GHZ);
10364                 else if (priv->ieee->mode == IEEE_B) /* 802.11b */
10365                         *(__le16*)skb_put(dst, sizeof(u16)) =
10366                                 cpu_to_le16(IEEE80211_CHAN_CCK |
10367                                              IEEE80211_CHAN_2GHZ);
10368                 else            /* 802.11g */
10369                         *(__le16*)skb_put(dst, sizeof(u16)) =
10370                                 cpu_to_le16(IEEE80211_CHAN_OFDM |
10371                                  IEEE80211_CHAN_2GHZ);
10372
10373                 rt_hdr->it_len = cpu_to_le16(dst->len);
10374
10375                 skb_copy_from_linear_data(src, skb_put(dst, len), len);
10376
10377                 if (!libipw_rx(priv->prom_priv->ieee, dst, &dummystats))
10378                         dev_kfree_skb_any(dst);
10379         }
10380 }
10381 #endif
10382
10383 static netdev_tx_t ipw_net_hard_start_xmit(struct libipw_txb *txb,
10384                                            struct net_device *dev, int pri)
10385 {
10386         struct ipw_priv *priv = libipw_priv(dev);
10387         unsigned long flags;
10388         netdev_tx_t ret;
10389
10390         IPW_DEBUG_TX("dev->xmit(%d bytes)\n", txb->payload_size);
10391         spin_lock_irqsave(&priv->lock, flags);
10392
10393 #ifdef CONFIG_IPW2200_PROMISCUOUS
10394         if (rtap_iface && netif_running(priv->prom_net_dev))
10395                 ipw_handle_promiscuous_tx(priv, txb);
10396 #endif
10397
10398         ret = ipw_tx_skb(priv, txb, pri);
10399         if (ret == NETDEV_TX_OK)
10400                 __ipw_led_activity_on(priv);
10401         spin_unlock_irqrestore(&priv->lock, flags);
10402
10403         return ret;
10404 }
10405
10406 static void ipw_net_set_multicast_list(struct net_device *dev)
10407 {
10408
10409 }
10410
10411 static int ipw_net_set_mac_address(struct net_device *dev, void *p)
10412 {
10413         struct ipw_priv *priv = libipw_priv(dev);
10414         struct sockaddr *addr = p;
10415
10416         if (!is_valid_ether_addr(addr->sa_data))
10417                 return -EADDRNOTAVAIL;
10418         mutex_lock(&priv->mutex);
10419         priv->config |= CFG_CUSTOM_MAC;
10420         memcpy(priv->mac_addr, addr->sa_data, ETH_ALEN);
10421         printk(KERN_INFO "%s: Setting MAC to %pM\n",
10422                priv->net_dev->name, priv->mac_addr);
10423         schedule_work(&priv->adapter_restart);
10424         mutex_unlock(&priv->mutex);
10425         return 0;
10426 }
10427
10428 static void ipw_ethtool_get_drvinfo(struct net_device *dev,
10429                                     struct ethtool_drvinfo *info)
10430 {
10431         struct ipw_priv *p = libipw_priv(dev);
10432         char vers[64];
10433         char date[32];
10434         u32 len;
10435
10436         strlcpy(info->driver, DRV_NAME, sizeof(info->driver));
10437         strlcpy(info->version, DRV_VERSION, sizeof(info->version));
10438
10439         len = sizeof(vers);
10440         ipw_get_ordinal(p, IPW_ORD_STAT_FW_VERSION, vers, &len);
10441         len = sizeof(date);
10442         ipw_get_ordinal(p, IPW_ORD_STAT_FW_DATE, date, &len);
10443
10444         snprintf(info->fw_version, sizeof(info->fw_version), "%s (%s)",
10445                  vers, date);
10446         strlcpy(info->bus_info, pci_name(p->pci_dev),
10447                 sizeof(info->bus_info));
10448 }
10449
10450 static u32 ipw_ethtool_get_link(struct net_device *dev)
10451 {
10452         struct ipw_priv *priv = libipw_priv(dev);
10453         return (priv->status & STATUS_ASSOCIATED) != 0;
10454 }
10455
10456 static int ipw_ethtool_get_eeprom_len(struct net_device *dev)
10457 {
10458         return IPW_EEPROM_IMAGE_SIZE;
10459 }
10460
10461 static int ipw_ethtool_get_eeprom(struct net_device *dev,
10462                                   struct ethtool_eeprom *eeprom, u8 * bytes)
10463 {
10464         struct ipw_priv *p = libipw_priv(dev);
10465
10466         if (eeprom->offset + eeprom->len > IPW_EEPROM_IMAGE_SIZE)
10467                 return -EINVAL;
10468         mutex_lock(&p->mutex);
10469         memcpy(bytes, &p->eeprom[eeprom->offset], eeprom->len);
10470         mutex_unlock(&p->mutex);
10471         return 0;
10472 }
10473
10474 static int ipw_ethtool_set_eeprom(struct net_device *dev,
10475                                   struct ethtool_eeprom *eeprom, u8 * bytes)
10476 {
10477         struct ipw_priv *p = libipw_priv(dev);
10478         int i;
10479
10480         if (eeprom->offset + eeprom->len > IPW_EEPROM_IMAGE_SIZE)
10481                 return -EINVAL;
10482         mutex_lock(&p->mutex);
10483         memcpy(&p->eeprom[eeprom->offset], bytes, eeprom->len);
10484         for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
10485                 ipw_write8(p, i + IPW_EEPROM_DATA, p->eeprom[i]);
10486         mutex_unlock(&p->mutex);
10487         return 0;
10488 }
10489
10490 static const struct ethtool_ops ipw_ethtool_ops = {
10491         .get_link = ipw_ethtool_get_link,
10492         .get_drvinfo = ipw_ethtool_get_drvinfo,
10493         .get_eeprom_len = ipw_ethtool_get_eeprom_len,
10494         .get_eeprom = ipw_ethtool_get_eeprom,
10495         .set_eeprom = ipw_ethtool_set_eeprom,
10496 };
10497
10498 static irqreturn_t ipw_isr(int irq, void *data)
10499 {
10500         struct ipw_priv *priv = data;
10501         u32 inta, inta_mask;
10502
10503         if (!priv)
10504                 return IRQ_NONE;
10505
10506         spin_lock(&priv->irq_lock);
10507
10508         if (!(priv->status & STATUS_INT_ENABLED)) {
10509                 /* IRQ is disabled */
10510                 goto none;
10511         }
10512
10513         inta = ipw_read32(priv, IPW_INTA_RW);
10514         inta_mask = ipw_read32(priv, IPW_INTA_MASK_R);
10515
10516         if (inta == 0xFFFFFFFF) {
10517                 /* Hardware disappeared */
10518                 IPW_WARNING("IRQ INTA == 0xFFFFFFFF\n");
10519                 goto none;
10520         }
10521
10522         if (!(inta & (IPW_INTA_MASK_ALL & inta_mask))) {
10523                 /* Shared interrupt */
10524                 goto none;
10525         }
10526
10527         /* tell the device to stop sending interrupts */
10528         __ipw_disable_interrupts(priv);
10529
10530         /* ack current interrupts */
10531         inta &= (IPW_INTA_MASK_ALL & inta_mask);
10532         ipw_write32(priv, IPW_INTA_RW, inta);
10533
10534         /* Cache INTA value for our tasklet */
10535         priv->isr_inta = inta;
10536
10537         tasklet_schedule(&priv->irq_tasklet);
10538
10539         spin_unlock(&priv->irq_lock);
10540
10541         return IRQ_HANDLED;
10542       none:
10543         spin_unlock(&priv->irq_lock);
10544         return IRQ_NONE;
10545 }
10546
10547 static void ipw_rf_kill(void *adapter)
10548 {
10549         struct ipw_priv *priv = adapter;
10550         unsigned long flags;
10551
10552         spin_lock_irqsave(&priv->lock, flags);
10553
10554         if (rf_kill_active(priv)) {
10555                 IPW_DEBUG_RF_KILL("RF Kill active, rescheduling GPIO check\n");
10556                 schedule_delayed_work(&priv->rf_kill, 2 * HZ);
10557                 goto exit_unlock;
10558         }
10559
10560         /* RF Kill is now disabled, so bring the device back up */
10561
10562         if (!(priv->status & STATUS_RF_KILL_MASK)) {
10563                 IPW_DEBUG_RF_KILL("HW RF Kill no longer active, restarting "
10564                                   "device\n");
10565
10566                 /* we can not do an adapter restart while inside an irq lock */
10567                 schedule_work(&priv->adapter_restart);
10568         } else
10569                 IPW_DEBUG_RF_KILL("HW RF Kill deactivated.  SW RF Kill still "
10570                                   "enabled\n");
10571
10572       exit_unlock:
10573         spin_unlock_irqrestore(&priv->lock, flags);
10574 }
10575
10576 static void ipw_bg_rf_kill(struct work_struct *work)
10577 {
10578         struct ipw_priv *priv =
10579                 container_of(work, struct ipw_priv, rf_kill.work);
10580         mutex_lock(&priv->mutex);
10581         ipw_rf_kill(priv);
10582         mutex_unlock(&priv->mutex);
10583 }
10584
10585 static void ipw_link_up(struct ipw_priv *priv)
10586 {
10587         priv->last_seq_num = -1;
10588         priv->last_frag_num = -1;
10589         priv->last_packet_time = 0;
10590
10591         netif_carrier_on(priv->net_dev);
10592
10593         cancel_delayed_work(&priv->request_scan);
10594         cancel_delayed_work(&priv->request_direct_scan);
10595         cancel_delayed_work(&priv->request_passive_scan);
10596         cancel_delayed_work(&priv->scan_event);
10597         ipw_reset_stats(priv);
10598         /* Ensure the rate is updated immediately */
10599         priv->last_rate = ipw_get_current_rate(priv);
10600         ipw_gather_stats(priv);
10601         ipw_led_link_up(priv);
10602         notify_wx_assoc_event(priv);
10603
10604         if (priv->config & CFG_BACKGROUND_SCAN)
10605                 schedule_delayed_work(&priv->request_scan, HZ);
10606 }
10607
10608 static void ipw_bg_link_up(struct work_struct *work)
10609 {
10610         struct ipw_priv *priv =
10611                 container_of(work, struct ipw_priv, link_up);
10612         mutex_lock(&priv->mutex);
10613         ipw_link_up(priv);
10614         mutex_unlock(&priv->mutex);
10615 }
10616
10617 static void ipw_link_down(struct ipw_priv *priv)
10618 {
10619         ipw_led_link_down(priv);
10620         netif_carrier_off(priv->net_dev);
10621         notify_wx_assoc_event(priv);
10622
10623         /* Cancel any queued work ... */
10624         cancel_delayed_work(&priv->request_scan);
10625         cancel_delayed_work(&priv->request_direct_scan);
10626         cancel_delayed_work(&priv->request_passive_scan);
10627         cancel_delayed_work(&priv->adhoc_check);
10628         cancel_delayed_work(&priv->gather_stats);
10629
10630         ipw_reset_stats(priv);
10631
10632         if (!(priv->status & STATUS_EXIT_PENDING)) {
10633                 /* Queue up another scan... */
10634                 schedule_delayed_work(&priv->request_scan, 0);
10635         } else
10636                 cancel_delayed_work(&priv->scan_event);
10637 }
10638
10639 static void ipw_bg_link_down(struct work_struct *work)
10640 {
10641         struct ipw_priv *priv =
10642                 container_of(work, struct ipw_priv, link_down);
10643         mutex_lock(&priv->mutex);
10644         ipw_link_down(priv);
10645         mutex_unlock(&priv->mutex);
10646 }
10647
10648 static int ipw_setup_deferred_work(struct ipw_priv *priv)
10649 {
10650         int ret = 0;
10651
10652         init_waitqueue_head(&priv->wait_command_queue);
10653         init_waitqueue_head(&priv->wait_state);
10654
10655         INIT_DELAYED_WORK(&priv->adhoc_check, ipw_bg_adhoc_check);
10656         INIT_WORK(&priv->associate, ipw_bg_associate);
10657         INIT_WORK(&priv->disassociate, ipw_bg_disassociate);
10658         INIT_WORK(&priv->system_config, ipw_system_config);
10659         INIT_WORK(&priv->rx_replenish, ipw_bg_rx_queue_replenish);
10660         INIT_WORK(&priv->adapter_restart, ipw_bg_adapter_restart);
10661         INIT_DELAYED_WORK(&priv->rf_kill, ipw_bg_rf_kill);
10662         INIT_WORK(&priv->up, ipw_bg_up);
10663         INIT_WORK(&priv->down, ipw_bg_down);
10664         INIT_DELAYED_WORK(&priv->request_scan, ipw_request_scan);
10665         INIT_DELAYED_WORK(&priv->request_direct_scan, ipw_request_direct_scan);
10666         INIT_DELAYED_WORK(&priv->request_passive_scan, ipw_request_passive_scan);
10667         INIT_DELAYED_WORK(&priv->scan_event, ipw_scan_event);
10668         INIT_DELAYED_WORK(&priv->gather_stats, ipw_bg_gather_stats);
10669         INIT_WORK(&priv->abort_scan, ipw_bg_abort_scan);
10670         INIT_WORK(&priv->roam, ipw_bg_roam);
10671         INIT_DELAYED_WORK(&priv->scan_check, ipw_bg_scan_check);
10672         INIT_WORK(&priv->link_up, ipw_bg_link_up);
10673         INIT_WORK(&priv->link_down, ipw_bg_link_down);
10674         INIT_DELAYED_WORK(&priv->led_link_on, ipw_bg_led_link_on);
10675         INIT_DELAYED_WORK(&priv->led_link_off, ipw_bg_led_link_off);
10676         INIT_DELAYED_WORK(&priv->led_act_off, ipw_bg_led_activity_off);
10677         INIT_WORK(&priv->merge_networks, ipw_merge_adhoc_network);
10678
10679 #ifdef CONFIG_IPW2200_QOS
10680         INIT_WORK(&priv->qos_activate, ipw_bg_qos_activate);
10681 #endif                          /* CONFIG_IPW2200_QOS */
10682
10683         tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
10684                      ipw_irq_tasklet, (unsigned long)priv);
10685
10686         return ret;
10687 }
10688
10689 static void shim__set_security(struct net_device *dev,
10690                                struct libipw_security *sec)
10691 {
10692         struct ipw_priv *priv = libipw_priv(dev);
10693         int i;
10694         for (i = 0; i < 4; i++) {
10695                 if (sec->flags & (1 << i)) {
10696                         priv->ieee->sec.encode_alg[i] = sec->encode_alg[i];
10697                         priv->ieee->sec.key_sizes[i] = sec->key_sizes[i];
10698                         if (sec->key_sizes[i] == 0)
10699                                 priv->ieee->sec.flags &= ~(1 << i);
10700                         else {
10701                                 memcpy(priv->ieee->sec.keys[i], sec->keys[i],
10702                                        sec->key_sizes[i]);
10703                                 priv->ieee->sec.flags |= (1 << i);
10704                         }
10705                         priv->status |= STATUS_SECURITY_UPDATED;
10706                 } else if (sec->level != SEC_LEVEL_1)
10707                         priv->ieee->sec.flags &= ~(1 << i);
10708         }
10709
10710         if (sec->flags & SEC_ACTIVE_KEY) {
10711                 priv->ieee->sec.active_key = sec->active_key;
10712                 priv->ieee->sec.flags |= SEC_ACTIVE_KEY;
10713                 priv->status |= STATUS_SECURITY_UPDATED;
10714         } else
10715                 priv->ieee->sec.flags &= ~SEC_ACTIVE_KEY;
10716
10717         if ((sec->flags & SEC_AUTH_MODE) &&
10718             (priv->ieee->sec.auth_mode != sec->auth_mode)) {
10719                 priv->ieee->sec.auth_mode = sec->auth_mode;
10720                 priv->ieee->sec.flags |= SEC_AUTH_MODE;
10721                 if (sec->auth_mode == WLAN_AUTH_SHARED_KEY)
10722                         priv->capability |= CAP_SHARED_KEY;
10723                 else
10724                         priv->capability &= ~CAP_SHARED_KEY;
10725                 priv->status |= STATUS_SECURITY_UPDATED;
10726         }
10727
10728         if (sec->flags & SEC_ENABLED && priv->ieee->sec.enabled != sec->enabled) {
10729                 priv->ieee->sec.flags |= SEC_ENABLED;
10730                 priv->ieee->sec.enabled = sec->enabled;
10731                 priv->status |= STATUS_SECURITY_UPDATED;
10732                 if (sec->enabled)
10733                         priv->capability |= CAP_PRIVACY_ON;
10734                 else
10735                         priv->capability &= ~CAP_PRIVACY_ON;
10736         }
10737
10738         if (sec->flags & SEC_ENCRYPT)
10739                 priv->ieee->sec.encrypt = sec->encrypt;
10740
10741         if (sec->flags & SEC_LEVEL && priv->ieee->sec.level != sec->level) {
10742                 priv->ieee->sec.level = sec->level;
10743                 priv->ieee->sec.flags |= SEC_LEVEL;
10744                 priv->status |= STATUS_SECURITY_UPDATED;
10745         }
10746
10747         if (!priv->ieee->host_encrypt && (sec->flags & SEC_ENCRYPT))
10748                 ipw_set_hwcrypto_keys(priv);
10749
10750         /* To match current functionality of ipw2100 (which works well w/
10751          * various supplicants, we don't force a disassociate if the
10752          * privacy capability changes ... */
10753 #if 0
10754         if ((priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) &&
10755             (((priv->assoc_request.capability &
10756                cpu_to_le16(WLAN_CAPABILITY_PRIVACY)) && !sec->enabled) ||
10757              (!(priv->assoc_request.capability &
10758                 cpu_to_le16(WLAN_CAPABILITY_PRIVACY)) && sec->enabled))) {
10759                 IPW_DEBUG_ASSOC("Disassociating due to capability "
10760                                 "change.\n");
10761                 ipw_disassociate(priv);
10762         }
10763 #endif
10764 }
10765
10766 static int init_supported_rates(struct ipw_priv *priv,
10767                                 struct ipw_supported_rates *rates)
10768 {
10769         /* TODO: Mask out rates based on priv->rates_mask */
10770
10771         memset(rates, 0, sizeof(*rates));
10772         /* configure supported rates */
10773         switch (priv->ieee->freq_band) {
10774         case LIBIPW_52GHZ_BAND:
10775                 rates->ieee_mode = IPW_A_MODE;
10776                 rates->purpose = IPW_RATE_CAPABILITIES;
10777                 ipw_add_ofdm_scan_rates(rates, LIBIPW_CCK_MODULATION,
10778                                         LIBIPW_OFDM_DEFAULT_RATES_MASK);
10779                 break;
10780
10781         default:                /* Mixed or 2.4Ghz */
10782                 rates->ieee_mode = IPW_G_MODE;
10783                 rates->purpose = IPW_RATE_CAPABILITIES;
10784                 ipw_add_cck_scan_rates(rates, LIBIPW_CCK_MODULATION,
10785                                        LIBIPW_CCK_DEFAULT_RATES_MASK);
10786                 if (priv->ieee->modulation & LIBIPW_OFDM_MODULATION) {
10787                         ipw_add_ofdm_scan_rates(rates, LIBIPW_CCK_MODULATION,
10788                                                 LIBIPW_OFDM_DEFAULT_RATES_MASK);
10789                 }
10790                 break;
10791         }
10792
10793         return 0;
10794 }
10795
10796 static int ipw_config(struct ipw_priv *priv)
10797 {
10798         /* This is only called from ipw_up, which resets/reloads the firmware
10799            so, we don't need to first disable the card before we configure
10800            it */
10801         if (ipw_set_tx_power(priv))
10802                 goto error;
10803
10804         /* initialize adapter address */
10805         if (ipw_send_adapter_address(priv, priv->net_dev->dev_addr))
10806                 goto error;
10807
10808         /* set basic system config settings */
10809         init_sys_config(&priv->sys_config);
10810
10811         /* Support Bluetooth if we have BT h/w on board, and user wants to.
10812          * Does not support BT priority yet (don't abort or defer our Tx) */
10813         if (bt_coexist) {
10814                 unsigned char bt_caps = priv->eeprom[EEPROM_SKU_CAPABILITY];
10815
10816                 if (bt_caps & EEPROM_SKU_CAP_BT_CHANNEL_SIG)
10817                         priv->sys_config.bt_coexistence
10818                             |= CFG_BT_COEXISTENCE_SIGNAL_CHNL;
10819                 if (bt_caps & EEPROM_SKU_CAP_BT_OOB)
10820                         priv->sys_config.bt_coexistence
10821                             |= CFG_BT_COEXISTENCE_OOB;
10822         }
10823
10824 #ifdef CONFIG_IPW2200_PROMISCUOUS
10825         if (priv->prom_net_dev && netif_running(priv->prom_net_dev)) {
10826                 priv->sys_config.accept_all_data_frames = 1;
10827                 priv->sys_config.accept_non_directed_frames = 1;
10828                 priv->sys_config.accept_all_mgmt_bcpr = 1;
10829                 priv->sys_config.accept_all_mgmt_frames = 1;
10830         }
10831 #endif
10832
10833         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
10834                 priv->sys_config.answer_broadcast_ssid_probe = 1;
10835         else
10836                 priv->sys_config.answer_broadcast_ssid_probe = 0;
10837
10838         if (ipw_send_system_config(priv))
10839                 goto error;
10840
10841         init_supported_rates(priv, &priv->rates);
10842         if (ipw_send_supported_rates(priv, &priv->rates))
10843                 goto error;
10844
10845         /* Set request-to-send threshold */
10846         if (priv->rts_threshold) {
10847                 if (ipw_send_rts_threshold(priv, priv->rts_threshold))
10848                         goto error;
10849         }
10850 #ifdef CONFIG_IPW2200_QOS
10851         IPW_DEBUG_QOS("QoS: call ipw_qos_activate\n");
10852         ipw_qos_activate(priv, NULL);
10853 #endif                          /* CONFIG_IPW2200_QOS */
10854
10855         if (ipw_set_random_seed(priv))
10856                 goto error;
10857
10858         /* final state transition to the RUN state */
10859         if (ipw_send_host_complete(priv))
10860                 goto error;
10861
10862         priv->status |= STATUS_INIT;
10863
10864         ipw_led_init(priv);
10865         ipw_led_radio_on(priv);
10866         priv->notif_missed_beacons = 0;
10867
10868         /* Set hardware WEP key if it is configured. */
10869         if ((priv->capability & CAP_PRIVACY_ON) &&
10870             (priv->ieee->sec.level == SEC_LEVEL_1) &&
10871             !(priv->ieee->host_encrypt || priv->ieee->host_decrypt))
10872                 ipw_set_hwcrypto_keys(priv);
10873
10874         return 0;
10875
10876       error:
10877         return -EIO;
10878 }
10879
10880 /*
10881  * NOTE:
10882  *
10883  * These tables have been tested in conjunction with the
10884  * Intel PRO/Wireless 2200BG and 2915ABG Network Connection Adapters.
10885  *
10886  * Altering this values, using it on other hardware, or in geographies
10887  * not intended for resale of the above mentioned Intel adapters has
10888  * not been tested.
10889  *
10890  * Remember to update the table in README.ipw2200 when changing this
10891  * table.
10892  *
10893  */
10894 static const struct libipw_geo ipw_geos[] = {
10895         {                       /* Restricted */
10896          "---",
10897          .bg_channels = 11,
10898          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10899                 {2427, 4}, {2432, 5}, {2437, 6},
10900                 {2442, 7}, {2447, 8}, {2452, 9},
10901                 {2457, 10}, {2462, 11}},
10902          },
10903
10904         {                       /* Custom US/Canada */
10905          "ZZF",
10906          .bg_channels = 11,
10907          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10908                 {2427, 4}, {2432, 5}, {2437, 6},
10909                 {2442, 7}, {2447, 8}, {2452, 9},
10910                 {2457, 10}, {2462, 11}},
10911          .a_channels = 8,
10912          .a = {{5180, 36},
10913                {5200, 40},
10914                {5220, 44},
10915                {5240, 48},
10916                {5260, 52, LIBIPW_CH_PASSIVE_ONLY},
10917                {5280, 56, LIBIPW_CH_PASSIVE_ONLY},
10918                {5300, 60, LIBIPW_CH_PASSIVE_ONLY},
10919                {5320, 64, LIBIPW_CH_PASSIVE_ONLY}},
10920          },
10921
10922         {                       /* Rest of World */
10923          "ZZD",
10924          .bg_channels = 13,
10925          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10926                 {2427, 4}, {2432, 5}, {2437, 6},
10927                 {2442, 7}, {2447, 8}, {2452, 9},
10928                 {2457, 10}, {2462, 11}, {2467, 12},
10929                 {2472, 13}},
10930          },
10931
10932         {                       /* Custom USA & Europe & High */
10933          "ZZA",
10934          .bg_channels = 11,
10935          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10936                 {2427, 4}, {2432, 5}, {2437, 6},
10937                 {2442, 7}, {2447, 8}, {2452, 9},
10938                 {2457, 10}, {2462, 11}},
10939          .a_channels = 13,
10940          .a = {{5180, 36},
10941                {5200, 40},
10942                {5220, 44},
10943                {5240, 48},
10944                {5260, 52, LIBIPW_CH_PASSIVE_ONLY},
10945                {5280, 56, LIBIPW_CH_PASSIVE_ONLY},
10946                {5300, 60, LIBIPW_CH_PASSIVE_ONLY},
10947                {5320, 64, LIBIPW_CH_PASSIVE_ONLY},
10948                {5745, 149},
10949                {5765, 153},
10950                {5785, 157},
10951                {5805, 161},
10952                {5825, 165}},
10953          },
10954
10955         {                       /* Custom NA & Europe */
10956          "ZZB",
10957          .bg_channels = 11,
10958          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10959                 {2427, 4}, {2432, 5}, {2437, 6},
10960                 {2442, 7}, {2447, 8}, {2452, 9},
10961                 {2457, 10}, {2462, 11}},
10962          .a_channels = 13,
10963          .a = {{5180, 36},
10964                {5200, 40},
10965                {5220, 44},
10966                {5240, 48},
10967                {5260, 52, LIBIPW_CH_PASSIVE_ONLY},
10968                {5280, 56, LIBIPW_CH_PASSIVE_ONLY},
10969                {5300, 60, LIBIPW_CH_PASSIVE_ONLY},
10970                {5320, 64, LIBIPW_CH_PASSIVE_ONLY},
10971                {5745, 149, LIBIPW_CH_PASSIVE_ONLY},
10972                {5765, 153, LIBIPW_CH_PASSIVE_ONLY},
10973                {5785, 157, LIBIPW_CH_PASSIVE_ONLY},
10974                {5805, 161, LIBIPW_CH_PASSIVE_ONLY},
10975                {5825, 165, LIBIPW_CH_PASSIVE_ONLY}},
10976          },
10977
10978         {                       /* Custom Japan */
10979          "ZZC",
10980          .bg_channels = 11,
10981          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10982                 {2427, 4}, {2432, 5}, {2437, 6},
10983                 {2442, 7}, {2447, 8}, {2452, 9},
10984                 {2457, 10}, {2462, 11}},
10985          .a_channels = 4,
10986          .a = {{5170, 34}, {5190, 38},
10987                {5210, 42}, {5230, 46}},
10988          },
10989
10990         {                       /* Custom */
10991          "ZZM",
10992          .bg_channels = 11,
10993          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
10994                 {2427, 4}, {2432, 5}, {2437, 6},
10995                 {2442, 7}, {2447, 8}, {2452, 9},
10996                 {2457, 10}, {2462, 11}},
10997          },
10998
10999         {                       /* Europe */
11000          "ZZE",
11001          .bg_channels = 13,
11002          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11003                 {2427, 4}, {2432, 5}, {2437, 6},
11004                 {2442, 7}, {2447, 8}, {2452, 9},
11005                 {2457, 10}, {2462, 11}, {2467, 12},
11006                 {2472, 13}},
11007          .a_channels = 19,
11008          .a = {{5180, 36},
11009                {5200, 40},
11010                {5220, 44},
11011                {5240, 48},
11012                {5260, 52, LIBIPW_CH_PASSIVE_ONLY},
11013                {5280, 56, LIBIPW_CH_PASSIVE_ONLY},
11014                {5300, 60, LIBIPW_CH_PASSIVE_ONLY},
11015                {5320, 64, LIBIPW_CH_PASSIVE_ONLY},
11016                {5500, 100, LIBIPW_CH_PASSIVE_ONLY},
11017                {5520, 104, LIBIPW_CH_PASSIVE_ONLY},
11018                {5540, 108, LIBIPW_CH_PASSIVE_ONLY},
11019                {5560, 112, LIBIPW_CH_PASSIVE_ONLY},
11020                {5580, 116, LIBIPW_CH_PASSIVE_ONLY},
11021                {5600, 120, LIBIPW_CH_PASSIVE_ONLY},
11022                {5620, 124, LIBIPW_CH_PASSIVE_ONLY},
11023                {5640, 128, LIBIPW_CH_PASSIVE_ONLY},
11024                {5660, 132, LIBIPW_CH_PASSIVE_ONLY},
11025                {5680, 136, LIBIPW_CH_PASSIVE_ONLY},
11026                {5700, 140, LIBIPW_CH_PASSIVE_ONLY}},
11027          },
11028
11029         {                       /* Custom Japan */
11030          "ZZJ",
11031          .bg_channels = 14,
11032          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11033                 {2427, 4}, {2432, 5}, {2437, 6},
11034                 {2442, 7}, {2447, 8}, {2452, 9},
11035                 {2457, 10}, {2462, 11}, {2467, 12},
11036                 {2472, 13}, {2484, 14, LIBIPW_CH_B_ONLY}},
11037          .a_channels = 4,
11038          .a = {{5170, 34}, {5190, 38},
11039                {5210, 42}, {5230, 46}},
11040          },
11041
11042         {                       /* Rest of World */
11043          "ZZR",
11044          .bg_channels = 14,
11045          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11046                 {2427, 4}, {2432, 5}, {2437, 6},
11047                 {2442, 7}, {2447, 8}, {2452, 9},
11048                 {2457, 10}, {2462, 11}, {2467, 12},
11049                 {2472, 13}, {2484, 14, LIBIPW_CH_B_ONLY |
11050                              LIBIPW_CH_PASSIVE_ONLY}},
11051          },
11052
11053         {                       /* High Band */
11054          "ZZH",
11055          .bg_channels = 13,
11056          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11057                 {2427, 4}, {2432, 5}, {2437, 6},
11058                 {2442, 7}, {2447, 8}, {2452, 9},
11059                 {2457, 10}, {2462, 11},
11060                 {2467, 12, LIBIPW_CH_PASSIVE_ONLY},
11061                 {2472, 13, LIBIPW_CH_PASSIVE_ONLY}},
11062          .a_channels = 4,
11063          .a = {{5745, 149}, {5765, 153},
11064                {5785, 157}, {5805, 161}},
11065          },
11066
11067         {                       /* Custom Europe */
11068          "ZZG",
11069          .bg_channels = 13,
11070          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11071                 {2427, 4}, {2432, 5}, {2437, 6},
11072                 {2442, 7}, {2447, 8}, {2452, 9},
11073                 {2457, 10}, {2462, 11},
11074                 {2467, 12}, {2472, 13}},
11075          .a_channels = 4,
11076          .a = {{5180, 36}, {5200, 40},
11077                {5220, 44}, {5240, 48}},
11078          },
11079
11080         {                       /* Europe */
11081          "ZZK",
11082          .bg_channels = 13,
11083          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11084                 {2427, 4}, {2432, 5}, {2437, 6},
11085                 {2442, 7}, {2447, 8}, {2452, 9},
11086                 {2457, 10}, {2462, 11},
11087                 {2467, 12, LIBIPW_CH_PASSIVE_ONLY},
11088                 {2472, 13, LIBIPW_CH_PASSIVE_ONLY}},
11089          .a_channels = 24,
11090          .a = {{5180, 36, LIBIPW_CH_PASSIVE_ONLY},
11091                {5200, 40, LIBIPW_CH_PASSIVE_ONLY},
11092                {5220, 44, LIBIPW_CH_PASSIVE_ONLY},
11093                {5240, 48, LIBIPW_CH_PASSIVE_ONLY},
11094                {5260, 52, LIBIPW_CH_PASSIVE_ONLY},
11095                {5280, 56, LIBIPW_CH_PASSIVE_ONLY},
11096                {5300, 60, LIBIPW_CH_PASSIVE_ONLY},
11097                {5320, 64, LIBIPW_CH_PASSIVE_ONLY},
11098                {5500, 100, LIBIPW_CH_PASSIVE_ONLY},
11099                {5520, 104, LIBIPW_CH_PASSIVE_ONLY},
11100                {5540, 108, LIBIPW_CH_PASSIVE_ONLY},
11101                {5560, 112, LIBIPW_CH_PASSIVE_ONLY},
11102                {5580, 116, LIBIPW_CH_PASSIVE_ONLY},
11103                {5600, 120, LIBIPW_CH_PASSIVE_ONLY},
11104                {5620, 124, LIBIPW_CH_PASSIVE_ONLY},
11105                {5640, 128, LIBIPW_CH_PASSIVE_ONLY},
11106                {5660, 132, LIBIPW_CH_PASSIVE_ONLY},
11107                {5680, 136, LIBIPW_CH_PASSIVE_ONLY},
11108                {5700, 140, LIBIPW_CH_PASSIVE_ONLY},
11109                {5745, 149, LIBIPW_CH_PASSIVE_ONLY},
11110                {5765, 153, LIBIPW_CH_PASSIVE_ONLY},
11111                {5785, 157, LIBIPW_CH_PASSIVE_ONLY},
11112                {5805, 161, LIBIPW_CH_PASSIVE_ONLY},
11113                {5825, 165, LIBIPW_CH_PASSIVE_ONLY}},
11114          },
11115
11116         {                       /* Europe */
11117          "ZZL",
11118          .bg_channels = 11,
11119          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11120                 {2427, 4}, {2432, 5}, {2437, 6},
11121                 {2442, 7}, {2447, 8}, {2452, 9},
11122                 {2457, 10}, {2462, 11}},
11123          .a_channels = 13,
11124          .a = {{5180, 36, LIBIPW_CH_PASSIVE_ONLY},
11125                {5200, 40, LIBIPW_CH_PASSIVE_ONLY},
11126                {5220, 44, LIBIPW_CH_PASSIVE_ONLY},
11127                {5240, 48, LIBIPW_CH_PASSIVE_ONLY},
11128                {5260, 52, LIBIPW_CH_PASSIVE_ONLY},
11129                {5280, 56, LIBIPW_CH_PASSIVE_ONLY},
11130                {5300, 60, LIBIPW_CH_PASSIVE_ONLY},
11131                {5320, 64, LIBIPW_CH_PASSIVE_ONLY},
11132                {5745, 149, LIBIPW_CH_PASSIVE_ONLY},
11133                {5765, 153, LIBIPW_CH_PASSIVE_ONLY},
11134                {5785, 157, LIBIPW_CH_PASSIVE_ONLY},
11135                {5805, 161, LIBIPW_CH_PASSIVE_ONLY},
11136                {5825, 165, LIBIPW_CH_PASSIVE_ONLY}},
11137          }
11138 };
11139
11140 static void ipw_set_geo(struct ipw_priv *priv)
11141 {
11142         int j;
11143
11144         for (j = 0; j < ARRAY_SIZE(ipw_geos); j++) {
11145                 if (!memcmp(&priv->eeprom[EEPROM_COUNTRY_CODE],
11146                             ipw_geos[j].name, 3))
11147                         break;
11148         }
11149
11150         if (j == ARRAY_SIZE(ipw_geos)) {
11151                 IPW_WARNING("SKU [%c%c%c] not recognized.\n",
11152                             priv->eeprom[EEPROM_COUNTRY_CODE + 0],
11153                             priv->eeprom[EEPROM_COUNTRY_CODE + 1],
11154                             priv->eeprom[EEPROM_COUNTRY_CODE + 2]);
11155                 j = 0;
11156         }
11157
11158         libipw_set_geo(priv->ieee, &ipw_geos[j]);
11159 }
11160
11161 #define MAX_HW_RESTARTS 5
11162 static int ipw_up(struct ipw_priv *priv)
11163 {
11164         int rc, i;
11165
11166         /* Age scan list entries found before suspend */
11167         if (priv->suspend_time) {
11168                 libipw_networks_age(priv->ieee, priv->suspend_time);
11169                 priv->suspend_time = 0;
11170         }
11171
11172         if (priv->status & STATUS_EXIT_PENDING)
11173                 return -EIO;
11174
11175         if (cmdlog && !priv->cmdlog) {
11176                 priv->cmdlog = kcalloc(cmdlog, sizeof(*priv->cmdlog),
11177                                        GFP_KERNEL);
11178                 if (priv->cmdlog == NULL) {
11179                         IPW_ERROR("Error allocating %d command log entries.\n",
11180                                   cmdlog);
11181                         return -ENOMEM;
11182                 } else {
11183                         priv->cmdlog_len = cmdlog;
11184                 }
11185         }
11186
11187         for (i = 0; i < MAX_HW_RESTARTS; i++) {
11188                 /* Load the microcode, firmware, and eeprom.
11189                  * Also start the clocks. */
11190                 rc = ipw_load(priv);
11191                 if (rc) {
11192                         IPW_ERROR("Unable to load firmware: %d\n", rc);
11193                         return rc;
11194                 }
11195
11196                 ipw_init_ordinals(priv);
11197                 if (!(priv->config & CFG_CUSTOM_MAC))
11198                         eeprom_parse_mac(priv, priv->mac_addr);
11199                 memcpy(priv->net_dev->dev_addr, priv->mac_addr, ETH_ALEN);
11200
11201                 ipw_set_geo(priv);
11202
11203                 if (priv->status & STATUS_RF_KILL_SW) {
11204                         IPW_WARNING("Radio disabled by module parameter.\n");
11205                         return 0;
11206                 } else if (rf_kill_active(priv)) {
11207                         IPW_WARNING("Radio Frequency Kill Switch is On:\n"
11208                                     "Kill switch must be turned off for "
11209                                     "wireless networking to work.\n");
11210                         schedule_delayed_work(&priv->rf_kill, 2 * HZ);
11211                         return 0;
11212                 }
11213
11214                 rc = ipw_config(priv);
11215                 if (!rc) {
11216                         IPW_DEBUG_INFO("Configured device on count %i\n", i);
11217
11218                         /* If configure to try and auto-associate, kick
11219                          * off a scan. */
11220                         schedule_delayed_work(&priv->request_scan, 0);
11221
11222                         return 0;
11223                 }
11224
11225                 IPW_DEBUG_INFO("Device configuration failed: 0x%08X\n", rc);
11226                 IPW_DEBUG_INFO("Failed to config device on retry %d of %d\n",
11227                                i, MAX_HW_RESTARTS);
11228
11229                 /* We had an error bringing up the hardware, so take it
11230                  * all the way back down so we can try again */
11231                 ipw_down(priv);
11232         }
11233
11234         /* tried to restart and config the device for as long as our
11235          * patience could withstand */
11236         IPW_ERROR("Unable to initialize device after %d attempts.\n", i);
11237
11238         return -EIO;
11239 }
11240
11241 static void ipw_bg_up(struct work_struct *work)
11242 {
11243         struct ipw_priv *priv =
11244                 container_of(work, struct ipw_priv, up);
11245         mutex_lock(&priv->mutex);
11246         ipw_up(priv);
11247         mutex_unlock(&priv->mutex);
11248 }
11249
11250 static void ipw_deinit(struct ipw_priv *priv)
11251 {
11252         int i;
11253
11254         if (priv->status & STATUS_SCANNING) {
11255                 IPW_DEBUG_INFO("Aborting scan during shutdown.\n");
11256                 ipw_abort_scan(priv);
11257         }
11258
11259         if (priv->status & STATUS_ASSOCIATED) {
11260                 IPW_DEBUG_INFO("Disassociating during shutdown.\n");
11261                 ipw_disassociate(priv);
11262         }
11263
11264         ipw_led_shutdown(priv);
11265
11266         /* Wait up to 1s for status to change to not scanning and not
11267          * associated (disassociation can take a while for a ful 802.11
11268          * exchange */
11269         for (i = 1000; i && (priv->status &
11270                              (STATUS_DISASSOCIATING |
11271                               STATUS_ASSOCIATED | STATUS_SCANNING)); i--)
11272                 udelay(10);
11273
11274         if (priv->status & (STATUS_DISASSOCIATING |
11275                             STATUS_ASSOCIATED | STATUS_SCANNING))
11276                 IPW_DEBUG_INFO("Still associated or scanning...\n");
11277         else
11278                 IPW_DEBUG_INFO("Took %dms to de-init\n", 1000 - i);
11279
11280         /* Attempt to disable the card */
11281         ipw_send_card_disable(priv, 0);
11282
11283         priv->status &= ~STATUS_INIT;
11284 }
11285
11286 static void ipw_down(struct ipw_priv *priv)
11287 {
11288         int exit_pending = priv->status & STATUS_EXIT_PENDING;
11289
11290         priv->status |= STATUS_EXIT_PENDING;
11291
11292         if (ipw_is_init(priv))
11293                 ipw_deinit(priv);
11294
11295         /* Wipe out the EXIT_PENDING status bit if we are not actually
11296          * exiting the module */
11297         if (!exit_pending)
11298                 priv->status &= ~STATUS_EXIT_PENDING;
11299
11300         /* tell the device to stop sending interrupts */
11301         ipw_disable_interrupts(priv);
11302
11303         /* Clear all bits but the RF Kill */
11304         priv->status &= STATUS_RF_KILL_MASK | STATUS_EXIT_PENDING;
11305         netif_carrier_off(priv->net_dev);
11306
11307         ipw_stop_nic(priv);
11308
11309         ipw_led_radio_off(priv);
11310 }
11311
11312 static void ipw_bg_down(struct work_struct *work)
11313 {
11314         struct ipw_priv *priv =
11315                 container_of(work, struct ipw_priv, down);
11316         mutex_lock(&priv->mutex);
11317         ipw_down(priv);
11318         mutex_unlock(&priv->mutex);
11319 }
11320
11321 static int ipw_wdev_init(struct net_device *dev)
11322 {
11323         int i, rc = 0;
11324         struct ipw_priv *priv = libipw_priv(dev);
11325         const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
11326         struct wireless_dev *wdev = &priv->ieee->wdev;
11327
11328         memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
11329
11330         /* fill-out priv->ieee->bg_band */
11331         if (geo->bg_channels) {
11332                 struct ieee80211_supported_band *bg_band = &priv->ieee->bg_band;
11333
11334                 bg_band->band = NL80211_BAND_2GHZ;
11335                 bg_band->n_channels = geo->bg_channels;
11336                 bg_band->channels = kcalloc(geo->bg_channels,
11337                                             sizeof(struct ieee80211_channel),
11338                                             GFP_KERNEL);
11339                 if (!bg_band->channels) {
11340                         rc = -ENOMEM;
11341                         goto out;
11342                 }
11343                 /* translate geo->bg to bg_band.channels */
11344                 for (i = 0; i < geo->bg_channels; i++) {
11345                         bg_band->channels[i].band = NL80211_BAND_2GHZ;
11346                         bg_band->channels[i].center_freq = geo->bg[i].freq;
11347                         bg_band->channels[i].hw_value = geo->bg[i].channel;
11348                         bg_band->channels[i].max_power = geo->bg[i].max_power;
11349                         if (geo->bg[i].flags & LIBIPW_CH_PASSIVE_ONLY)
11350                                 bg_band->channels[i].flags |=
11351                                         IEEE80211_CHAN_NO_IR;
11352                         if (geo->bg[i].flags & LIBIPW_CH_NO_IBSS)
11353                                 bg_band->channels[i].flags |=
11354                                         IEEE80211_CHAN_NO_IR;
11355                         if (geo->bg[i].flags & LIBIPW_CH_RADAR_DETECT)
11356                                 bg_band->channels[i].flags |=
11357                                         IEEE80211_CHAN_RADAR;
11358                         /* No equivalent for LIBIPW_CH_80211H_RULES,
11359                            LIBIPW_CH_UNIFORM_SPREADING, or
11360                            LIBIPW_CH_B_ONLY... */
11361                 }
11362                 /* point at bitrate info */
11363                 bg_band->bitrates = ipw2200_bg_rates;
11364                 bg_band->n_bitrates = ipw2200_num_bg_rates;
11365
11366                 wdev->wiphy->bands[NL80211_BAND_2GHZ] = bg_band;
11367         }
11368
11369         /* fill-out priv->ieee->a_band */
11370         if (geo->a_channels) {
11371                 struct ieee80211_supported_band *a_band = &priv->ieee->a_band;
11372
11373                 a_band->band = NL80211_BAND_5GHZ;
11374                 a_band->n_channels = geo->a_channels;
11375                 a_band->channels = kcalloc(geo->a_channels,
11376                                            sizeof(struct ieee80211_channel),
11377                                            GFP_KERNEL);
11378                 if (!a_band->channels) {
11379                         rc = -ENOMEM;
11380                         goto out;
11381                 }
11382                 /* translate geo->a to a_band.channels */
11383                 for (i = 0; i < geo->a_channels; i++) {
11384                         a_band->channels[i].band = NL80211_BAND_5GHZ;
11385                         a_band->channels[i].center_freq = geo->a[i].freq;
11386                         a_band->channels[i].hw_value = geo->a[i].channel;
11387                         a_band->channels[i].max_power = geo->a[i].max_power;
11388                         if (geo->a[i].flags & LIBIPW_CH_PASSIVE_ONLY)
11389                                 a_band->channels[i].flags |=
11390                                         IEEE80211_CHAN_NO_IR;
11391                         if (geo->a[i].flags & LIBIPW_CH_NO_IBSS)
11392                                 a_band->channels[i].flags |=
11393                                         IEEE80211_CHAN_NO_IR;
11394                         if (geo->a[i].flags & LIBIPW_CH_RADAR_DETECT)
11395                                 a_band->channels[i].flags |=
11396                                         IEEE80211_CHAN_RADAR;
11397                         /* No equivalent for LIBIPW_CH_80211H_RULES,
11398                            LIBIPW_CH_UNIFORM_SPREADING, or
11399                            LIBIPW_CH_B_ONLY... */
11400                 }
11401                 /* point at bitrate info */
11402                 a_band->bitrates = ipw2200_a_rates;
11403                 a_band->n_bitrates = ipw2200_num_a_rates;
11404
11405                 wdev->wiphy->bands[NL80211_BAND_5GHZ] = a_band;
11406         }
11407
11408         wdev->wiphy->cipher_suites = ipw_cipher_suites;
11409         wdev->wiphy->n_cipher_suites = ARRAY_SIZE(ipw_cipher_suites);
11410
11411         set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
11412
11413         /* With that information in place, we can now register the wiphy... */
11414         if (wiphy_register(wdev->wiphy))
11415                 rc = -EIO;
11416 out:
11417         return rc;
11418 }
11419
11420 /* PCI driver stuff */
11421 static const struct pci_device_id card_ids[] = {
11422         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2701, 0, 0, 0},
11423         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2702, 0, 0, 0},
11424         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2711, 0, 0, 0},
11425         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2712, 0, 0, 0},
11426         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2721, 0, 0, 0},
11427         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2722, 0, 0, 0},
11428         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2731, 0, 0, 0},
11429         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2732, 0, 0, 0},
11430         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2741, 0, 0, 0},
11431         {PCI_VENDOR_ID_INTEL, 0x1043, 0x103c, 0x2741, 0, 0, 0},
11432         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2742, 0, 0, 0},
11433         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2751, 0, 0, 0},
11434         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2752, 0, 0, 0},
11435         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2753, 0, 0, 0},
11436         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2754, 0, 0, 0},
11437         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2761, 0, 0, 0},
11438         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2762, 0, 0, 0},
11439         {PCI_VDEVICE(INTEL, 0x104f), 0},
11440         {PCI_VDEVICE(INTEL, 0x4220), 0},        /* BG */
11441         {PCI_VDEVICE(INTEL, 0x4221), 0},        /* BG */
11442         {PCI_VDEVICE(INTEL, 0x4223), 0},        /* ABG */
11443         {PCI_VDEVICE(INTEL, 0x4224), 0},        /* ABG */
11444
11445         /* required last entry */
11446         {0,}
11447 };
11448
11449 MODULE_DEVICE_TABLE(pci, card_ids);
11450
11451 static struct attribute *ipw_sysfs_entries[] = {
11452         &dev_attr_rf_kill.attr,
11453         &dev_attr_direct_dword.attr,
11454         &dev_attr_indirect_byte.attr,
11455         &dev_attr_indirect_dword.attr,
11456         &dev_attr_mem_gpio_reg.attr,
11457         &dev_attr_command_event_reg.attr,
11458         &dev_attr_nic_type.attr,
11459         &dev_attr_status.attr,
11460         &dev_attr_cfg.attr,
11461         &dev_attr_error.attr,
11462         &dev_attr_event_log.attr,
11463         &dev_attr_cmd_log.attr,
11464         &dev_attr_eeprom_delay.attr,
11465         &dev_attr_ucode_version.attr,
11466         &dev_attr_rtc.attr,
11467         &dev_attr_scan_age.attr,
11468         &dev_attr_led.attr,
11469         &dev_attr_speed_scan.attr,
11470         &dev_attr_net_stats.attr,
11471         &dev_attr_channels.attr,
11472 #ifdef CONFIG_IPW2200_PROMISCUOUS
11473         &dev_attr_rtap_iface.attr,
11474         &dev_attr_rtap_filter.attr,
11475 #endif
11476         NULL
11477 };
11478
11479 static const struct attribute_group ipw_attribute_group = {
11480         .name = NULL,           /* put in device directory */
11481         .attrs = ipw_sysfs_entries,
11482 };
11483
11484 #ifdef CONFIG_IPW2200_PROMISCUOUS
11485 static int ipw_prom_open(struct net_device *dev)
11486 {
11487         struct ipw_prom_priv *prom_priv = libipw_priv(dev);
11488         struct ipw_priv *priv = prom_priv->priv;
11489
11490         IPW_DEBUG_INFO("prom dev->open\n");
11491         netif_carrier_off(dev);
11492
11493         if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
11494                 priv->sys_config.accept_all_data_frames = 1;
11495                 priv->sys_config.accept_non_directed_frames = 1;
11496                 priv->sys_config.accept_all_mgmt_bcpr = 1;
11497                 priv->sys_config.accept_all_mgmt_frames = 1;
11498
11499                 ipw_send_system_config(priv);
11500         }
11501
11502         return 0;
11503 }
11504
11505 static int ipw_prom_stop(struct net_device *dev)
11506 {
11507         struct ipw_prom_priv *prom_priv = libipw_priv(dev);
11508         struct ipw_priv *priv = prom_priv->priv;
11509
11510         IPW_DEBUG_INFO("prom dev->stop\n");
11511
11512         if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
11513                 priv->sys_config.accept_all_data_frames = 0;
11514                 priv->sys_config.accept_non_directed_frames = 0;
11515                 priv->sys_config.accept_all_mgmt_bcpr = 0;
11516                 priv->sys_config.accept_all_mgmt_frames = 0;
11517
11518                 ipw_send_system_config(priv);
11519         }
11520
11521         return 0;
11522 }
11523
11524 static netdev_tx_t ipw_prom_hard_start_xmit(struct sk_buff *skb,
11525                                             struct net_device *dev)
11526 {
11527         IPW_DEBUG_INFO("prom dev->xmit\n");
11528         dev_kfree_skb(skb);
11529         return NETDEV_TX_OK;
11530 }
11531
11532 static const struct net_device_ops ipw_prom_netdev_ops = {
11533         .ndo_open               = ipw_prom_open,
11534         .ndo_stop               = ipw_prom_stop,
11535         .ndo_start_xmit         = ipw_prom_hard_start_xmit,
11536         .ndo_set_mac_address    = eth_mac_addr,
11537         .ndo_validate_addr      = eth_validate_addr,
11538 };
11539
11540 static int ipw_prom_alloc(struct ipw_priv *priv)
11541 {
11542         int rc = 0;
11543
11544         if (priv->prom_net_dev)
11545                 return -EPERM;
11546
11547         priv->prom_net_dev = alloc_libipw(sizeof(struct ipw_prom_priv), 1);
11548         if (priv->prom_net_dev == NULL)
11549                 return -ENOMEM;
11550
11551         priv->prom_priv = libipw_priv(priv->prom_net_dev);
11552         priv->prom_priv->ieee = netdev_priv(priv->prom_net_dev);
11553         priv->prom_priv->priv = priv;
11554
11555         strcpy(priv->prom_net_dev->name, "rtap%d");
11556         memcpy(priv->prom_net_dev->dev_addr, priv->mac_addr, ETH_ALEN);
11557
11558         priv->prom_net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
11559         priv->prom_net_dev->netdev_ops = &ipw_prom_netdev_ops;
11560
11561         priv->prom_net_dev->min_mtu = 68;
11562         priv->prom_net_dev->max_mtu = LIBIPW_DATA_LEN;
11563
11564         priv->prom_priv->ieee->iw_mode = IW_MODE_MONITOR;
11565         SET_NETDEV_DEV(priv->prom_net_dev, &priv->pci_dev->dev);
11566
11567         rc = register_netdev(priv->prom_net_dev);
11568         if (rc) {
11569                 free_libipw(priv->prom_net_dev, 1);
11570                 priv->prom_net_dev = NULL;
11571                 return rc;
11572         }
11573
11574         return 0;
11575 }
11576
11577 static void ipw_prom_free(struct ipw_priv *priv)
11578 {
11579         if (!priv->prom_net_dev)
11580                 return;
11581
11582         unregister_netdev(priv->prom_net_dev);
11583         free_libipw(priv->prom_net_dev, 1);
11584
11585         priv->prom_net_dev = NULL;
11586 }
11587
11588 #endif
11589
11590 static const struct net_device_ops ipw_netdev_ops = {
11591         .ndo_open               = ipw_net_open,
11592         .ndo_stop               = ipw_net_stop,
11593         .ndo_set_rx_mode        = ipw_net_set_multicast_list,
11594         .ndo_set_mac_address    = ipw_net_set_mac_address,
11595         .ndo_start_xmit         = libipw_xmit,
11596         .ndo_validate_addr      = eth_validate_addr,
11597 };
11598
11599 static int ipw_pci_probe(struct pci_dev *pdev,
11600                                    const struct pci_device_id *ent)
11601 {
11602         int err = 0;
11603         struct net_device *net_dev;
11604         void __iomem *base;
11605         u32 length, val;
11606         struct ipw_priv *priv;
11607         int i;
11608
11609         net_dev = alloc_libipw(sizeof(struct ipw_priv), 0);
11610         if (net_dev == NULL) {
11611                 err = -ENOMEM;
11612                 goto out;
11613         }
11614
11615         priv = libipw_priv(net_dev);
11616         priv->ieee = netdev_priv(net_dev);
11617
11618         priv->net_dev = net_dev;
11619         priv->pci_dev = pdev;
11620         ipw_debug_level = debug;
11621         spin_lock_init(&priv->irq_lock);
11622         spin_lock_init(&priv->lock);
11623         for (i = 0; i < IPW_IBSS_MAC_HASH_SIZE; i++)
11624                 INIT_LIST_HEAD(&priv->ibss_mac_hash[i]);
11625
11626         mutex_init(&priv->mutex);
11627         if (pci_enable_device(pdev)) {
11628                 err = -ENODEV;
11629                 goto out_free_libipw;
11630         }
11631
11632         pci_set_master(pdev);
11633
11634         err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
11635         if (!err)
11636                 err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
11637         if (err) {
11638                 printk(KERN_WARNING DRV_NAME ": No suitable DMA available.\n");
11639                 goto out_pci_disable_device;
11640         }
11641
11642         pci_set_drvdata(pdev, priv);
11643
11644         err = pci_request_regions(pdev, DRV_NAME);
11645         if (err)
11646                 goto out_pci_disable_device;
11647
11648         /* We disable the RETRY_TIMEOUT register (0x41) to keep
11649          * PCI Tx retries from interfering with C3 CPU state */
11650         pci_read_config_dword(pdev, 0x40, &val);
11651         if ((val & 0x0000ff00) != 0)
11652                 pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
11653
11654         length = pci_resource_len(pdev, 0);
11655         priv->hw_len = length;
11656
11657         base = pci_ioremap_bar(pdev, 0);
11658         if (!base) {
11659                 err = -ENODEV;
11660                 goto out_pci_release_regions;
11661         }
11662
11663         priv->hw_base = base;
11664         IPW_DEBUG_INFO("pci_resource_len = 0x%08x\n", length);
11665         IPW_DEBUG_INFO("pci_resource_base = %p\n", base);
11666
11667         err = ipw_setup_deferred_work(priv);
11668         if (err) {
11669                 IPW_ERROR("Unable to setup deferred work\n");
11670                 goto out_iounmap;
11671         }
11672
11673         ipw_sw_reset(priv, 1);
11674
11675         err = request_irq(pdev->irq, ipw_isr, IRQF_SHARED, DRV_NAME, priv);
11676         if (err) {
11677                 IPW_ERROR("Error allocating IRQ %d\n", pdev->irq);
11678                 goto out_iounmap;
11679         }
11680
11681         SET_NETDEV_DEV(net_dev, &pdev->dev);
11682
11683         mutex_lock(&priv->mutex);
11684
11685         priv->ieee->hard_start_xmit = ipw_net_hard_start_xmit;
11686         priv->ieee->set_security = shim__set_security;
11687         priv->ieee->is_queue_full = ipw_net_is_queue_full;
11688
11689 #ifdef CONFIG_IPW2200_QOS
11690         priv->ieee->is_qos_active = ipw_is_qos_active;
11691         priv->ieee->handle_probe_response = ipw_handle_beacon;
11692         priv->ieee->handle_beacon = ipw_handle_probe_response;
11693         priv->ieee->handle_assoc_response = ipw_handle_assoc_response;
11694 #endif                          /* CONFIG_IPW2200_QOS */
11695
11696         priv->ieee->perfect_rssi = -20;
11697         priv->ieee->worst_rssi = -85;
11698
11699         net_dev->netdev_ops = &ipw_netdev_ops;
11700         priv->wireless_data.spy_data = &priv->ieee->spy_data;
11701         net_dev->wireless_data = &priv->wireless_data;
11702         net_dev->wireless_handlers = &ipw_wx_handler_def;
11703         net_dev->ethtool_ops = &ipw_ethtool_ops;
11704
11705         net_dev->min_mtu = 68;
11706         net_dev->max_mtu = LIBIPW_DATA_LEN;
11707
11708         err = sysfs_create_group(&pdev->dev.kobj, &ipw_attribute_group);
11709         if (err) {
11710                 IPW_ERROR("failed to create sysfs device attributes\n");
11711                 mutex_unlock(&priv->mutex);
11712                 goto out_release_irq;
11713         }
11714
11715         if (ipw_up(priv)) {
11716                 mutex_unlock(&priv->mutex);
11717                 err = -EIO;
11718                 goto out_remove_sysfs;
11719         }
11720
11721         mutex_unlock(&priv->mutex);
11722
11723         err = ipw_wdev_init(net_dev);
11724         if (err) {
11725                 IPW_ERROR("failed to register wireless device\n");
11726                 goto out_remove_sysfs;
11727         }
11728
11729         err = register_netdev(net_dev);
11730         if (err) {
11731                 IPW_ERROR("failed to register network device\n");
11732                 goto out_unregister_wiphy;
11733         }
11734
11735 #ifdef CONFIG_IPW2200_PROMISCUOUS
11736         if (rtap_iface) {
11737                 err = ipw_prom_alloc(priv);
11738                 if (err) {
11739                         IPW_ERROR("Failed to register promiscuous network "
11740                                   "device (error %d).\n", err);
11741                         unregister_netdev(priv->net_dev);
11742                         goto out_unregister_wiphy;
11743                 }
11744         }
11745 #endif
11746
11747         printk(KERN_INFO DRV_NAME ": Detected geography %s (%d 802.11bg "
11748                "channels, %d 802.11a channels)\n",
11749                priv->ieee->geo.name, priv->ieee->geo.bg_channels,
11750                priv->ieee->geo.a_channels);
11751
11752         return 0;
11753
11754       out_unregister_wiphy:
11755         wiphy_unregister(priv->ieee->wdev.wiphy);
11756         kfree(priv->ieee->a_band.channels);
11757         kfree(priv->ieee->bg_band.channels);
11758       out_remove_sysfs:
11759         sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
11760       out_release_irq:
11761         free_irq(pdev->irq, priv);
11762       out_iounmap:
11763         iounmap(priv->hw_base);
11764       out_pci_release_regions:
11765         pci_release_regions(pdev);
11766       out_pci_disable_device:
11767         pci_disable_device(pdev);
11768       out_free_libipw:
11769         free_libipw(priv->net_dev, 0);
11770       out:
11771         return err;
11772 }
11773
11774 static void ipw_pci_remove(struct pci_dev *pdev)
11775 {
11776         struct ipw_priv *priv = pci_get_drvdata(pdev);
11777         struct list_head *p, *q;
11778         int i;
11779
11780         if (!priv)
11781                 return;
11782
11783         mutex_lock(&priv->mutex);
11784
11785         priv->status |= STATUS_EXIT_PENDING;
11786         ipw_down(priv);
11787         sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
11788
11789         mutex_unlock(&priv->mutex);
11790
11791         unregister_netdev(priv->net_dev);
11792
11793         if (priv->rxq) {
11794                 ipw_rx_queue_free(priv, priv->rxq);
11795                 priv->rxq = NULL;
11796         }
11797         ipw_tx_queue_free(priv);
11798
11799         if (priv->cmdlog) {
11800                 kfree(priv->cmdlog);
11801                 priv->cmdlog = NULL;
11802         }
11803
11804         /* make sure all works are inactive */
11805         cancel_delayed_work_sync(&priv->adhoc_check);
11806         cancel_work_sync(&priv->associate);
11807         cancel_work_sync(&priv->disassociate);
11808         cancel_work_sync(&priv->system_config);
11809         cancel_work_sync(&priv->rx_replenish);
11810         cancel_work_sync(&priv->adapter_restart);
11811         cancel_delayed_work_sync(&priv->rf_kill);
11812         cancel_work_sync(&priv->up);
11813         cancel_work_sync(&priv->down);
11814         cancel_delayed_work_sync(&priv->request_scan);
11815         cancel_delayed_work_sync(&priv->request_direct_scan);
11816         cancel_delayed_work_sync(&priv->request_passive_scan);
11817         cancel_delayed_work_sync(&priv->scan_event);
11818         cancel_delayed_work_sync(&priv->gather_stats);
11819         cancel_work_sync(&priv->abort_scan);
11820         cancel_work_sync(&priv->roam);
11821         cancel_delayed_work_sync(&priv->scan_check);
11822         cancel_work_sync(&priv->link_up);
11823         cancel_work_sync(&priv->link_down);
11824         cancel_delayed_work_sync(&priv->led_link_on);
11825         cancel_delayed_work_sync(&priv->led_link_off);
11826         cancel_delayed_work_sync(&priv->led_act_off);
11827         cancel_work_sync(&priv->merge_networks);
11828
11829         /* Free MAC hash list for ADHOC */
11830         for (i = 0; i < IPW_IBSS_MAC_HASH_SIZE; i++) {
11831                 list_for_each_safe(p, q, &priv->ibss_mac_hash[i]) {
11832                         list_del(p);
11833                         kfree(list_entry(p, struct ipw_ibss_seq, list));
11834                 }
11835         }
11836
11837         kfree(priv->error);
11838         priv->error = NULL;
11839
11840 #ifdef CONFIG_IPW2200_PROMISCUOUS
11841         ipw_prom_free(priv);
11842 #endif
11843
11844         free_irq(pdev->irq, priv);
11845         iounmap(priv->hw_base);
11846         pci_release_regions(pdev);
11847         pci_disable_device(pdev);
11848         /* wiphy_unregister needs to be here, before free_libipw */
11849         wiphy_unregister(priv->ieee->wdev.wiphy);
11850         kfree(priv->ieee->a_band.channels);
11851         kfree(priv->ieee->bg_band.channels);
11852         free_libipw(priv->net_dev, 0);
11853         free_firmware();
11854 }
11855
11856 #ifdef CONFIG_PM
11857 static int ipw_pci_suspend(struct pci_dev *pdev, pm_message_t state)
11858 {
11859         struct ipw_priv *priv = pci_get_drvdata(pdev);
11860         struct net_device *dev = priv->net_dev;
11861
11862         printk(KERN_INFO "%s: Going into suspend...\n", dev->name);
11863
11864         /* Take down the device; powers it off, etc. */
11865         ipw_down(priv);
11866
11867         /* Remove the PRESENT state of the device */
11868         netif_device_detach(dev);
11869
11870         pci_save_state(pdev);
11871         pci_disable_device(pdev);
11872         pci_set_power_state(pdev, pci_choose_state(pdev, state));
11873
11874         priv->suspend_at = ktime_get_boottime_seconds();
11875
11876         return 0;
11877 }
11878
11879 static int ipw_pci_resume(struct pci_dev *pdev)
11880 {
11881         struct ipw_priv *priv = pci_get_drvdata(pdev);
11882         struct net_device *dev = priv->net_dev;
11883         int err;
11884         u32 val;
11885
11886         printk(KERN_INFO "%s: Coming out of suspend...\n", dev->name);
11887
11888         pci_set_power_state(pdev, PCI_D0);
11889         err = pci_enable_device(pdev);
11890         if (err) {
11891                 printk(KERN_ERR "%s: pci_enable_device failed on resume\n",
11892                        dev->name);
11893                 return err;
11894         }
11895         pci_restore_state(pdev);
11896
11897         /*
11898          * Suspend/Resume resets the PCI configuration space, so we have to
11899          * re-disable the RETRY_TIMEOUT register (0x41) to keep PCI Tx retries
11900          * from interfering with C3 CPU state. pci_restore_state won't help
11901          * here since it only restores the first 64 bytes pci config header.
11902          */
11903         pci_read_config_dword(pdev, 0x40, &val);
11904         if ((val & 0x0000ff00) != 0)
11905                 pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
11906
11907         /* Set the device back into the PRESENT state; this will also wake
11908          * the queue of needed */
11909         netif_device_attach(dev);
11910
11911         priv->suspend_time = ktime_get_boottime_seconds() - priv->suspend_at;
11912
11913         /* Bring the device back up */
11914         schedule_work(&priv->up);
11915
11916         return 0;
11917 }
11918 #endif
11919
11920 static void ipw_pci_shutdown(struct pci_dev *pdev)
11921 {
11922         struct ipw_priv *priv = pci_get_drvdata(pdev);
11923
11924         /* Take down the device; powers it off, etc. */
11925         ipw_down(priv);
11926
11927         pci_disable_device(pdev);
11928 }
11929
11930 /* driver initialization stuff */
11931 static struct pci_driver ipw_driver = {
11932         .name = DRV_NAME,
11933         .id_table = card_ids,
11934         .probe = ipw_pci_probe,
11935         .remove = ipw_pci_remove,
11936 #ifdef CONFIG_PM
11937         .suspend = ipw_pci_suspend,
11938         .resume = ipw_pci_resume,
11939 #endif
11940         .shutdown = ipw_pci_shutdown,
11941 };
11942
11943 static int __init ipw_init(void)
11944 {
11945         int ret;
11946
11947         printk(KERN_INFO DRV_NAME ": " DRV_DESCRIPTION ", " DRV_VERSION "\n");
11948         printk(KERN_INFO DRV_NAME ": " DRV_COPYRIGHT "\n");
11949
11950         ret = pci_register_driver(&ipw_driver);
11951         if (ret) {
11952                 IPW_ERROR("Unable to initialize PCI module\n");
11953                 return ret;
11954         }
11955
11956         ret = driver_create_file(&ipw_driver.driver, &driver_attr_debug_level);
11957         if (ret) {
11958                 IPW_ERROR("Unable to create driver sysfs file\n");
11959                 pci_unregister_driver(&ipw_driver);
11960                 return ret;
11961         }
11962
11963         return ret;
11964 }
11965
11966 static void __exit ipw_exit(void)
11967 {
11968         driver_remove_file(&ipw_driver.driver, &driver_attr_debug_level);
11969         pci_unregister_driver(&ipw_driver);
11970 }
11971
11972 module_param(disable, int, 0444);
11973 MODULE_PARM_DESC(disable, "manually disable the radio (default 0 [radio on])");
11974
11975 module_param(associate, int, 0444);
11976 MODULE_PARM_DESC(associate, "auto associate when scanning (default off)");
11977
11978 module_param(auto_create, int, 0444);
11979 MODULE_PARM_DESC(auto_create, "auto create adhoc network (default on)");
11980
11981 module_param_named(led, led_support, int, 0444);
11982 MODULE_PARM_DESC(led, "enable led control on some systems (default 1 on)");
11983
11984 module_param(debug, int, 0444);
11985 MODULE_PARM_DESC(debug, "debug output mask");
11986
11987 module_param_named(channel, default_channel, int, 0444);
11988 MODULE_PARM_DESC(channel, "channel to limit associate to (default 0 [ANY])");
11989
11990 #ifdef CONFIG_IPW2200_PROMISCUOUS
11991 module_param(rtap_iface, int, 0444);
11992 MODULE_PARM_DESC(rtap_iface, "create the rtap interface (1 - create, default 0)");
11993 #endif
11994
11995 #ifdef CONFIG_IPW2200_QOS
11996 module_param(qos_enable, int, 0444);
11997 MODULE_PARM_DESC(qos_enable, "enable all QoS functionalities");
11998
11999 module_param(qos_burst_enable, int, 0444);
12000 MODULE_PARM_DESC(qos_burst_enable, "enable QoS burst mode");
12001
12002 module_param(qos_no_ack_mask, int, 0444);
12003 MODULE_PARM_DESC(qos_no_ack_mask, "mask Tx_Queue to no ack");
12004
12005 module_param(burst_duration_CCK, int, 0444);
12006 MODULE_PARM_DESC(burst_duration_CCK, "set CCK burst value");
12007
12008 module_param(burst_duration_OFDM, int, 0444);
12009 MODULE_PARM_DESC(burst_duration_OFDM, "set OFDM burst value");
12010 #endif                          /* CONFIG_IPW2200_QOS */
12011
12012 #ifdef CONFIG_IPW2200_MONITOR
12013 module_param_named(mode, network_mode, int, 0444);
12014 MODULE_PARM_DESC(mode, "network mode (0=BSS,1=IBSS,2=Monitor)");
12015 #else
12016 module_param_named(mode, network_mode, int, 0444);
12017 MODULE_PARM_DESC(mode, "network mode (0=BSS,1=IBSS)");
12018 #endif
12019
12020 module_param(bt_coexist, int, 0444);
12021 MODULE_PARM_DESC(bt_coexist, "enable bluetooth coexistence (default off)");
12022
12023 module_param(hwcrypto, int, 0444);
12024 MODULE_PARM_DESC(hwcrypto, "enable hardware crypto (default off)");
12025
12026 module_param(cmdlog, int, 0444);
12027 MODULE_PARM_DESC(cmdlog,
12028                  "allocate a ring buffer for logging firmware commands");
12029
12030 module_param(roaming, int, 0444);
12031 MODULE_PARM_DESC(roaming, "enable roaming support (default on)");
12032
12033 module_param(antenna, int, 0444);
12034 MODULE_PARM_DESC(antenna, "select antenna 1=Main, 3=Aux, default 0 [both], 2=slow_diversity (choose the one with lower background noise)");
12035
12036 module_exit(ipw_exit);
12037 module_init(ipw_init);