diff options
| author |   Richard Purdie <rpurdie@linux.intel.com> | 2010-08-27 15:14:24 +0100 |
|---|---|---|
| committer | Richard Purdie <rpurdie@linux.intel.com> | 2010-08-27 15:29:45 +0100 |
| commit | 29d6678fd546377459ef75cf54abeef5b969b5cf (patch) | |
| tree | 8edd65790e37a00d01c3f203f773fe4b5012db18 /meta/recipes-kernel/linux/linux-rp-2.6.23/htcuni-acx.patch | |
| parent | da49de6885ee1bc424e70bc02f21f6ab920efb55 (diff) | |
| download | openembedded-core-contrib-29d6678fd546377459ef75cf54abeef5b969b5cf.tar.gz | |
Major layout change to the packages directory
Having one monolithic packages directory makes it hard to find things
and is generally overwhelming. This commit splits it into several
logical sections roughly based on function, recipes.txt gives more
information about the classifications used.
The opportunity is also used to switch from "packages" to "recipes"
as used in OpenEmbedded as the term "packages" can be confusing to
people and has many different meanings.
Not all recipes have been classified yet, this is just a first pass
at separating things out. Some packages are moved to meta-extras as
they're no longer actively used or maintained.
Signed-off-by: Richard Purdie <rpurdie@linux.intel.com>
Diffstat (limited to 'meta/recipes-kernel/linux/linux-rp-2.6.23/htcuni-acx.patch')
| -rw-r--r-- | meta/recipes-kernel/linux/linux-rp-2.6.23/htcuni-acx.patch | 33526 |
1 files changed, 33526 insertions, 0 deletions
diff --git a/meta/recipes-kernel/linux/linux-rp-2.6.23/htcuni-acx.patch b/meta/recipes-kernel/linux/linux-rp-2.6.23/htcuni-acx.patch new file mode 100644 index 0000000000..769674c935 --- /dev/null +++ b/meta/recipes-kernel/linux/linux-rp-2.6.23/htcuni-acx.patch @@ -0,0 +1,33526 @@ +--- + drivers/net/wireless/Kconfig | 31 + drivers/net/wireless/Makefile | 2 + drivers/net/wireless/acx/Kconfig | 113 + drivers/net/wireless/acx/Makefile | 21 + drivers/net/wireless/acx/acx.h | 14 + drivers/net/wireless/acx/acx_config.h | 50 + drivers/net/wireless/acx/acx_func.h | 710 ++ + drivers/net/wireless/acx/acx_hw.h | 18 + drivers/net/wireless/acx/acx_struct.h | 2114 ++++++++ + drivers/net/wireless/acx/common.c | 7388 ++++++++++++++++++++++++++++ + drivers/net/wireless/acx/conv.c | 504 + + drivers/net/wireless/acx/cs.c | 5703 +++++++++++++++++++++ + drivers/net/wireless/acx/htcsable_acx.c | 118 + drivers/net/wireless/acx/htcuniversal_acx.c | 108 + drivers/net/wireless/acx/hx4700_acx.c | 108 + drivers/net/wireless/acx/ioctl.c | 2748 ++++++++++ + drivers/net/wireless/acx/mem.c | 5363 ++++++++++++++++++++ + drivers/net/wireless/acx/pci.c | 4234 ++++++++++++++++ + drivers/net/wireless/acx/rx3000_acx.c | 110 + drivers/net/wireless/acx/setrate.c | 213 + drivers/net/wireless/acx/usb.c | 1922 +++++++ + drivers/net/wireless/acx/wlan.c | 424 + + drivers/net/wireless/acx/wlan_compat.h | 260 + drivers/net/wireless/acx/wlan_hdr.h | 497 + + drivers/net/wireless/acx/wlan_mgmt.h | 582 ++ + 25 files changed, 33355 insertions(+) + +Index: linux-2.6.22/drivers/net/wireless/acx/acx_config.h +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/acx_config.h 2007-08-23 18:46:40.000000000 +0200 +@@ -0,0 +1,50 @@ ++#define ACX_RELEASE "v0.3.36" ++ ++/* ++ * Test out all the channels in reg domain 0x10 ++ */ ++#define ACX_ALLOW_ALLCHANNELS ++ ++/* set to 0 if you don't want any debugging code to be compiled in */ ++/* set to 1 if you want some debugging */ ++/* set to 2 if you want extensive debug log */ ++#define ACX_DEBUG 0 ++ ++/* ++ * Since we'll be changing channels a lot ++#define ACX_DEFAULT_MSG (L_ASSOC|L_INIT) ++*/ ++#define ACX_DEFAULT_MSG (L_ASSOC|L_INIT) ++ ++/* assume 32bit I/O width ++ * (16bit is also compatible with Compact Flash) */ ++#define ACX_IO_WIDTH 32 ++ ++/* Set this to 1 if you want monitor mode to use ++ * phy header. Currently it is not useful anyway since we ++ * don't know what useful info (if any) is in phy header. ++ * If you want faster/smaller code, say 0 here */ ++#define WANT_PHY_HDR 0 ++ ++/* whether to do Tx descriptor cleanup in softirq (i.e. not in IRQ ++ * handler) or not. Note that doing it later does slightly increase ++ * system load, so still do that stuff in the IRQ handler for now, ++ * even if that probably means worse latency */ ++#define TX_CLEANUP_IN_SOFTIRQ 0 ++ ++/* if you want very experimental 802.11 power save mode features */ ++#define POWER_SAVE_80211 0 ++ ++/* if you want very early packet fragmentation bits and pieces */ ++#define ACX_FRAGMENTATION 0 ++ ++/* Locking: */ ++/* very talkative */ ++/* #define PARANOID_LOCKING 1 */ ++/* normal (use when bug-free) */ ++#define DO_LOCKING 1 ++/* else locking is disabled! */ ++ ++/* 0 - normal mode */ ++/* 1 - development/debug: probe for IEs on modprobe */ ++#define CMD_DISCOVERY 0 +Index: linux-2.6.22/drivers/net/wireless/acx/acx_func.h +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/acx_func.h 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,710 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++*/ ++ ++ ++/*********************************************************************** ++** LOGGING ++** ++** - Avoid SHOUTING needlessly. Avoid excessive verbosity. ++** Gradually remove messages which are old debugging aids. ++** ++** - Use printk() for messages which are to be always logged. ++** Supply either 'acx:' or '<devname>:' prefix so that user ++** can figure out who's speaking among other kernel chatter. ++** acx: is for general issues (e.g. "acx: no firmware image!") ++** while <devname>: is related to a particular device ++** (think about multi-card setup). Double check that message ++** is not confusing to the average user. ++** ++** - use printk KERN_xxx level only if message is not a WARNING ++** but is INFO, ERR etc. ++** ++** - Use printk_ratelimited() for messages which may flood ++** (e.g. "rx DUP pkt!"). ++** ++** - Use log() for messages which may be omitted (and they ++** _will_ be omitted in non-debug builds). Note that ++** message levels may be disabled at compile-time selectively, ++** thus select them wisely. Example: L_DEBUG is the lowest ++** (most likely to be compiled out) -> use for less important stuff. ++** ++** - Do not print important stuff with log(), or else people ++** will never build non-debug driver. ++** ++** Style: ++** hex: capital letters, zero filled (e.g. 0x02AC) ++** str: dont start from capitals, no trailing periods ("tx: queue is stopped") ++*/ ++#if ACX_DEBUG > 1 ++ ++void log_fn_enter(const char *funcname); ++void log_fn_exit(const char *funcname); ++void log_fn_exit_v(const char *funcname, int v); ++ ++#define FN_ENTER \ ++ do { \ ++ if (unlikely(acx_debug & L_FUNC)) { \ ++ log_fn_enter(__func__); \ ++ } \ ++ } while (0) ++ ++#define FN_EXIT1(v) \ ++ do { \ ++ if (unlikely(acx_debug & L_FUNC)) { \ ++ log_fn_exit_v(__func__, v); \ ++ } \ ++ } while (0) ++#define FN_EXIT0 \ ++ do { \ ++ if (unlikely(acx_debug & L_FUNC)) { \ ++ log_fn_exit(__func__); \ ++ } \ ++ } while (0) ++ ++#else ++ ++#define FN_ENTER ++#define FN_EXIT1(v) ++#define FN_EXIT0 ++ ++#endif /* ACX_DEBUG > 1 */ ++ ++ ++#if ACX_DEBUG ++ ++#define log(chan, args...) \ ++ do { \ ++ if (acx_debug & (chan)) \ ++ printk(KERN_DEBUG args); \ ++ } while (0) ++#define printk_ratelimited(args...) printk(args) ++ ++#else /* Non-debug build: */ ++ ++#define log(chan, args...) ++/* Standard way of log flood prevention */ ++#define printk_ratelimited(args...) \ ++do { \ ++ if (printk_ratelimit()) \ ++ printk(args); \ ++} while (0) ++ ++#endif /* ACX_DEBUG */ ++ ++void acx_print_mac(const char *head, const u8 *mac, const char *tail); ++ ++/* Optimized out to nothing in non-debug build */ ++static inline void ++acxlog_mac(int level, const char *head, const u8 *mac, const char *tail) ++{ ++ if (acx_debug & level) { ++ acx_print_mac(head, mac, tail); ++ } ++} ++ ++ ++/*********************************************************************** ++** MAC address helpers ++*/ ++static inline void ++MAC_COPY(u8 *mac, const u8 *src) ++{ ++ *(u32*)mac = *(u32*)src; ++ ((u16*)mac)[2] = ((u16*)src)[2]; ++ /* kernel's memcpy will do the same: memcpy(dst, src, ETH_ALEN); */ ++} ++ ++static inline void ++MAC_FILL(u8 *mac, u8 val) ++{ ++ memset(mac, val, ETH_ALEN); ++} ++ ++static inline void ++MAC_BCAST(u8 *mac) ++{ ++ ((u16*)mac)[2] = *(u32*)mac = -1; ++} ++ ++static inline void ++MAC_ZERO(u8 *mac) ++{ ++ ((u16*)mac)[2] = *(u32*)mac = 0; ++} ++ ++static inline int ++mac_is_equal(const u8 *a, const u8 *b) ++{ ++ /* can't beat this */ ++ return memcmp(a, b, ETH_ALEN) == 0; ++} ++ ++static inline int ++mac_is_bcast(const u8 *mac) ++{ ++ /* AND together 4 first bytes with sign-extended 2 last bytes ++ ** Only bcast address gives 0xffffffff. +1 gives 0 */ ++ return ( *(s32*)mac & ((s16*)mac)[2] ) + 1 == 0; ++} ++ ++static inline int ++mac_is_zero(const u8 *mac) ++{ ++ return ( *(u32*)mac | ((u16*)mac)[2] ) == 0; ++} ++ ++static inline int ++mac_is_directed(const u8 *mac) ++{ ++ return (mac[0] & 1)==0; ++} ++ ++static inline int ++mac_is_mcast(const u8 *mac) ++{ ++ return (mac[0] & 1) && !mac_is_bcast(mac); ++} ++ ++#define MACSTR "%02X:%02X:%02X:%02X:%02X:%02X" ++#define MAC(bytevector) \ ++ ((unsigned char *)bytevector)[0], \ ++ ((unsigned char *)bytevector)[1], \ ++ ((unsigned char *)bytevector)[2], \ ++ ((unsigned char *)bytevector)[3], \ ++ ((unsigned char *)bytevector)[4], \ ++ ((unsigned char *)bytevector)[5] ++ ++ ++/*********************************************************************** ++** Random helpers ++*/ ++#define TO_STRING(x) #x ++#define STRING(x) TO_STRING(x) ++ ++#define CLEAR_BIT(val, mask) ((val) &= ~(mask)) ++#define SET_BIT(val, mask) ((val) |= (mask)) ++ ++/* undefined if v==0 */ ++static inline unsigned int ++lowest_bit(u16 v) ++{ ++ unsigned int n = 0; ++ while (!(v & 0xf)) { v>>=4; n+=4; } ++ while (!(v & 1)) { v>>=1; n++; } ++ return n; ++} ++ ++/* undefined if v==0 */ ++static inline unsigned int ++highest_bit(u16 v) ++{ ++ unsigned int n = 0; ++ while (v>0xf) { v>>=4; n+=4; } ++ while (v>1) { v>>=1; n++; } ++ return n; ++} ++ ++/* undefined if v==0 */ ++static inline int ++has_only_one_bit(u16 v) ++{ ++ return ((v-1) ^ v) >= v; ++} ++ ++ ++static inline int ++is_hidden_essid(char *essid) ++{ ++ return (('\0' == essid[0]) || ++ ((' ' == essid[0]) && ('\0' == essid[1]))); ++} ++ ++/*********************************************************************** ++** LOCKING ++** We have adev->sem and adev->lock. ++** ++** We employ following naming convention in order to get locking right: ++** ++** acx_e_xxxx - external entry points called from process context. ++** It is okay to sleep. adev->sem is to be taken on entry. ++** acx_i_xxxx - external entry points possibly called from atomic context. ++** Sleeping is not allowed (and thus down(sem) is not legal!) ++** acx_s_xxxx - potentially sleeping functions. Do not ever call under lock! ++** acx_l_xxxx - functions which expect lock to be already taken. ++** rest - non-sleeping functions which do not require locking ++** but may be run under lock ++** ++** A small number of local helpers do not have acx_[eisl]_ prefix. ++** They are always close to caller and are to be reviewed locally. ++** ++** Theory of operation: ++** ++** All process-context entry points (_e_ functions) take sem ++** immediately. IRQ handler and other 'atomic-context' entry points ++** (_i_ functions) take lock immediately on entry, but dont take sem ++** because that might sleep. ++** ++** Thus *all* code is either protected by sem or lock, or both. ++** ++** Code which must not run concurrently with IRQ takes lock. ++** Such code is marked with _l_. ++** ++** This results in the following rules of thumb useful in code review: ++** ++** + If a function calls _s_ fn, it must be an _s_ itself. ++** + You can call _l_ fn only (a) from another _l_ fn ++** or (b) from _s_, _e_ or _i_ fn by taking lock, calling _l_, ++** and dropping lock. ++** + All IRQ code runs under lock. ++** + Any _s_ fn is running under sem. ++** + Code under sem can race only with IRQ code. ++** + Code under sem+lock cannot race with anything. ++*/ ++ ++/* These functions *must* be inline or they will break horribly on SPARC, due ++ * to its weird semantics for save/restore flags */ ++ ++#if defined(PARANOID_LOCKING) /* Lock debugging */ ++ ++void acx_lock_debug(acx_device_t *adev, const char* where); ++void acx_unlock_debug(acx_device_t *adev, const char* where); ++void acx_down_debug(acx_device_t *adev, const char* where); ++void acx_up_debug(acx_device_t *adev, const char* where); ++void acx_lock_unhold(void); ++void acx_sem_unhold(void); ++ ++static inline void ++acx_lock_helper(acx_device_t *adev, unsigned long *fp, const char* where) ++{ ++ acx_lock_debug(adev, where); ++ spin_lock_irqsave(&adev->lock, *fp); ++} ++static inline void ++acx_unlock_helper(acx_device_t *adev, unsigned long *fp, const char* where) ++{ ++ acx_unlock_debug(adev, where); ++ spin_unlock_irqrestore(&adev->lock, *fp); ++} ++static inline void ++acx_down_helper(acx_device_t *adev, const char* where) ++{ ++ acx_down_debug(adev, where); ++} ++static inline void ++acx_up_helper(acx_device_t *adev, const char* where) ++{ ++ acx_up_debug(adev, where); ++} ++#define acx_lock(adev, flags) acx_lock_helper(adev, &(flags), __FILE__ ":" STRING(__LINE__)) ++#define acx_unlock(adev, flags) acx_unlock_helper(adev, &(flags), __FILE__ ":" STRING(__LINE__)) ++#define acx_sem_lock(adev) acx_down_helper(adev, __FILE__ ":" STRING(__LINE__)) ++#define acx_sem_unlock(adev) acx_up_helper(adev, __FILE__ ":" STRING(__LINE__)) ++ ++#elif defined(DO_LOCKING) ++ ++#define acx_lock(adev, flags) spin_lock_irqsave(&adev->lock, flags) ++#define acx_unlock(adev, flags) spin_unlock_irqrestore(&adev->lock, flags) ++#define acx_sem_lock(adev) down(&adev->sem) ++#define acx_sem_unlock(adev) up(&adev->sem) ++#define acx_lock_unhold() ((void)0) ++#define acx_sem_unhold() ((void)0) ++ ++#else /* no locking! :( */ ++ ++#define acx_lock(adev, flags) ((void)0) ++#define acx_unlock(adev, flags) ((void)0) ++#define acx_sem_lock(adev) ((void)0) ++#define acx_sem_unlock(adev) ((void)0) ++#define acx_lock_unhold() ((void)0) ++#define acx_sem_unhold() ((void)0) ++ ++#endif ++ ++ ++/*********************************************************************** ++*/ ++ ++/* Can race with rx path (which is not protected by sem): ++** rx -> process_[re]assocresp() -> set_status(ASSOCIATED) -> wake_queue() ++** Can race with tx_complete IRQ: ++** IRQ -> acxpci_l_clean_txdesc -> acx_wake_queue ++** Review carefully all callsites */ ++static inline void ++acx_stop_queue(struct net_device *ndev, const char *msg) ++{ ++ if (netif_queue_stopped(ndev)) ++ return; ++ ++ netif_stop_queue(ndev); ++ if (msg) ++ log(L_BUFT, "tx: stop queue %s\n", msg); ++} ++ ++static inline int ++acx_queue_stopped(struct net_device *ndev) ++{ ++ return netif_queue_stopped(ndev); ++} ++ ++/* ++static inline void ++acx_start_queue(struct net_device *ndev, const char *msg) ++{ ++ netif_start_queue(ndev); ++ if (msg) ++ log(L_BUFT, "tx: start queue %s\n", msg); ++} ++*/ ++ ++static inline void ++acx_wake_queue(struct net_device *ndev, const char *msg) ++{ ++ netif_wake_queue(ndev); ++ if (msg) ++ log(L_BUFT, "tx: wake queue %s\n", msg); ++} ++ ++static inline void ++acx_carrier_off(struct net_device *ndev, const char *msg) ++{ ++ netif_carrier_off(ndev); ++ if (msg) ++ log(L_BUFT, "tx: carrier off %s\n", msg); ++} ++ ++static inline void ++acx_carrier_on(struct net_device *ndev, const char *msg) ++{ ++ netif_carrier_on(ndev); ++ if (msg) ++ log(L_BUFT, "tx: carrier on %s\n", msg); ++} ++ ++/* This function does not need locking UNLESS you call it ++** as acx_set_status(ACX_STATUS_4_ASSOCIATED), bacause this can ++** wake queue. This can race with stop_queue elsewhere. */ ++void acx_set_status(acx_device_t *adev, u16 status); ++ ++ ++/*********************************************************************** ++** Communication with firmware ++*/ ++#define CMD_TIMEOUT_MS(n) (n) ++#define ACX_CMD_TIMEOUT_DEFAULT CMD_TIMEOUT_MS(50) ++ ++#if ACX_DEBUG ++ ++/* We want to log cmd names */ ++int acxpci_s_issue_cmd_timeo_debug(acx_device_t *adev, unsigned cmd, void *param, unsigned len, unsigned timeout, const char* cmdstr); ++int acxmem_s_issue_cmd_timeo_debug(acx_device_t *adev, unsigned cmd, void *param, unsigned len, unsigned timeout, const char* cmdstr); ++int acxusb_s_issue_cmd_timeo_debug(acx_device_t *adev, unsigned cmd, void *param, unsigned len, unsigned timeout, const char* cmdstr); ++static inline int ++acx_s_issue_cmd_timeo_debug(acx_device_t *adev, unsigned cmd, void *param, unsigned len, unsigned timeout, const char* cmdstr) ++{ ++ if (IS_MEM(adev)) ++ return acxmem_s_issue_cmd_timeo_debug(adev, cmd, param, len, timeout, cmdstr); ++ if (IS_PCI(adev)) ++ return acxpci_s_issue_cmd_timeo_debug(adev, cmd, param, len, timeout, cmdstr); ++ return acxusb_s_issue_cmd_timeo_debug(adev, cmd, param, len, timeout, cmdstr); ++} ++#define acx_s_issue_cmd(adev,cmd,param,len) \ ++ acx_s_issue_cmd_timeo_debug(adev,cmd,param,len,ACX_CMD_TIMEOUT_DEFAULT,#cmd) ++#define acx_s_issue_cmd_timeo(adev,cmd,param,len,timeo) \ ++ acx_s_issue_cmd_timeo_debug(adev,cmd,param,len,timeo,#cmd) ++int acx_s_configure_debug(acx_device_t *adev, void *pdr, int type, const char* str); ++#define acx_s_configure(adev,pdr,type) \ ++ acx_s_configure_debug(adev,pdr,type,#type) ++int acx_s_interrogate_debug(acx_device_t *adev, void *pdr, int type, const char* str); ++#define acx_s_interrogate(adev,pdr,type) \ ++ acx_s_interrogate_debug(adev,pdr,type,#type) ++ ++#else ++ ++int acxpci_s_issue_cmd_timeo(acx_device_t *adev, unsigned cmd, void *param, unsigned len, unsigned timeout); ++int acxmem_s_issue_cmd_timeo(acx_device_t *adev, unsigned cmd, void *param, unsigned len, unsigned timeout); ++int acxusb_s_issue_cmd_timeo(acx_device_t *adev, unsigned cmd, void *param, unsigned len, unsigned timeout); ++static inline int ++acx_s_issue_cmd_timeo(acx_device_t *adev, unsigned cmd, void *param, unsigned len, unsigned timeout) ++{ ++ if (IS_MEM(adev)) ++ return acxmem_s_issue_cmd_timeo(adev, cmd, param, len, timeout); ++ if (IS_PCI(adev)) ++ return acxpci_s_issue_cmd_timeo(adev, cmd, param, len, timeout); ++ return acxusb_s_issue_cmd_timeo(adev, cmd, param, len, timeout); ++} ++static inline int ++acx_s_issue_cmd(acx_device_t *adev, unsigned cmd, void *param, unsigned len) ++{ ++ if (IS_MEM(adev)) ++ return acxmem_s_issue_cmd_timeo(adev, cmd, param, len, ACX_CMD_TIMEOUT_DEFAULT); ++ if (IS_PCI(adev)) ++ return acxpci_s_issue_cmd_timeo(adev, cmd, param, len, ACX_CMD_TIMEOUT_DEFAULT); ++ return acxusb_s_issue_cmd_timeo(adev, cmd, param, len, ACX_CMD_TIMEOUT_DEFAULT); ++} ++int acx_s_configure(acx_device_t *adev, void *pdr, int type); ++int acx_s_interrogate(acx_device_t *adev, void *pdr, int type); ++ ++#endif ++ ++void acx_s_cmd_start_scan(acx_device_t *adev); ++ ++ ++/*********************************************************************** ++** Ioctls ++*/ ++int ++acx111pci_ioctl_info( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ struct iw_param *vwrq, ++ char *extra); ++int ++acx100pci_ioctl_set_phy_amp_bias( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ struct iw_param *vwrq, ++ char *extra); ++int ++acx100mem_ioctl_set_phy_amp_bias( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ struct iw_param *vwrq, ++ char *extra); ++ ++ ++/*********************************************************************** ++** /proc ++*/ ++#ifdef CONFIG_PROC_FS ++int acx_proc_register_entries(const struct net_device *ndev); ++int acx_proc_unregister_entries(const struct net_device *ndev); ++#else ++static inline int ++acx_proc_register_entries(const struct net_device *ndev) { return OK; } ++static inline int ++acx_proc_unregister_entries(const struct net_device *ndev) { return OK; } ++#endif ++ ++ ++/*********************************************************************** ++*/ ++firmware_image_t *acx_s_read_fw(struct device *dev, const char *file, u32 *size); ++int acxpci_s_upload_radio(acx_device_t *adev); ++int acxmem_s_upload_radio(acx_device_t *adev); ++ ++ ++/*********************************************************************** ++** Unsorted yet :) ++*/ ++int acxpci_s_read_phy_reg(acx_device_t *adev, u32 reg, u8 *charbuf); ++int acxmem_s_read_phy_reg(acx_device_t *adev, u32 reg, u8 *charbuf); ++int acxusb_s_read_phy_reg(acx_device_t *adev, u32 reg, u8 *charbuf); ++static inline int ++acx_s_read_phy_reg(acx_device_t *adev, u32 reg, u8 *charbuf) ++{ ++ if (IS_MEM(adev)) ++ return acxmem_s_read_phy_reg(adev, reg, charbuf); ++ if (IS_PCI(adev)) ++ return acxpci_s_read_phy_reg(adev, reg, charbuf); ++ return acxusb_s_read_phy_reg(adev, reg, charbuf); ++} ++ ++int acxpci_s_write_phy_reg(acx_device_t *adev, u32 reg, u8 value); ++int acxmem_s_write_phy_reg(acx_device_t *adev, u32 reg, u8 value); ++int acxusb_s_write_phy_reg(acx_device_t *adev, u32 reg, u8 value); ++static inline int ++acx_s_write_phy_reg(acx_device_t *adev, u32 reg, u8 value) ++{ ++ if (IS_MEM(adev)) ++ return acxmem_s_write_phy_reg(adev, reg, value); ++ if (IS_PCI(adev)) ++ return acxpci_s_write_phy_reg(adev, reg, value); ++ return acxusb_s_write_phy_reg(adev, reg, value); ++} ++ ++tx_t* acxpci_l_alloc_tx(acx_device_t *adev); ++tx_t* acxmem_l_alloc_tx(acx_device_t *adev); ++tx_t* acxusb_l_alloc_tx(acx_device_t *adev); ++static inline tx_t* ++acx_l_alloc_tx(acx_device_t *adev) ++{ ++ if (IS_MEM(adev)) ++ return acxmem_l_alloc_tx(adev); ++ if (IS_PCI(adev)) ++ return acxpci_l_alloc_tx(adev); ++ return acxusb_l_alloc_tx(adev); ++} ++ ++void acxusb_l_dealloc_tx(tx_t *tx_opaque); ++void acxmem_l_dealloc_tx(acx_device_t *adev, tx_t *tx_opaque); ++static inline void ++acx_l_dealloc_tx(acx_device_t *adev, tx_t *tx_opaque) ++{ ++#ifdef ACX_MEM ++ acxmem_l_dealloc_tx (adev, tx_opaque); ++#else ++ if (IS_USB(adev)) ++ acxusb_l_dealloc_tx(tx_opaque); ++#endif ++} ++ ++void* acxpci_l_get_txbuf(acx_device_t *adev, tx_t *tx_opaque); ++void* acxmem_l_get_txbuf(acx_device_t *adev, tx_t *tx_opaque); ++void* acxusb_l_get_txbuf(acx_device_t *adev, tx_t *tx_opaque); ++static inline void* ++acx_l_get_txbuf(acx_device_t *adev, tx_t *tx_opaque) ++{ ++#if defined (ACX_MEM) ++ return acxmem_l_get_txbuf(adev, tx_opaque); ++#else ++ if (IS_PCI(adev)) ++ return acxpci_l_get_txbuf(adev, tx_opaque); ++ return acxusb_l_get_txbuf(adev, tx_opaque); ++#endif ++} ++ ++void acxpci_l_tx_data(acx_device_t *adev, tx_t *tx_opaque, int len); ++void acxmem_l_tx_data(acx_device_t *adev, tx_t *tx_opaque, int len); ++void acxusb_l_tx_data(acx_device_t *adev, tx_t *tx_opaque, int len); ++static inline void ++acx_l_tx_data(acx_device_t *adev, tx_t *tx_opaque, int len) ++{ ++#if defined (ACX_MEM) ++ acxmem_l_tx_data(adev, tx_opaque, len); ++#else ++ if (IS_PCI(adev)) ++ acxpci_l_tx_data(adev, tx_opaque, len); ++ else ++ acxusb_l_tx_data(adev, tx_opaque, len); ++#endif ++} ++ ++static inline wlan_hdr_t* ++acx_get_wlan_hdr(acx_device_t *adev, const rxbuffer_t *rxbuf) ++{ ++ return (wlan_hdr_t*)((u8*)&rxbuf->hdr_a3 + adev->phy_header_len); ++} ++ ++void acxpci_l_power_led(acx_device_t *adev, int enable); ++int acxpci_read_eeprom_byte(acx_device_t *adev, u32 addr, u8 *charbuf); ++unsigned int acxpci_l_clean_txdesc(acx_device_t *adev); ++void acxpci_l_clean_txdesc_emergency(acx_device_t *adev); ++int acxpci_s_create_hostdesc_queues(acx_device_t *adev); ++void acxpci_create_desc_queues(acx_device_t *adev, u32 tx_queue_start, u32 rx_queue_start); ++void acxpci_free_desc_queues(acx_device_t *adev); ++char* acxpci_s_proc_diag_output(char *p, acx_device_t *adev); ++int acxpci_proc_eeprom_output(char *p, acx_device_t *adev); ++void acxpci_set_interrupt_mask(acx_device_t *adev); ++int acx100pci_s_set_tx_level(acx_device_t *adev, u8 level_dbm); ++ ++void acxmem_l_power_led(acx_device_t *adev, int enable); ++int acxmem_read_eeprom_byte(acx_device_t *adev, u32 addr, u8 *charbuf); ++unsigned int acxmem_l_clean_txdesc(acx_device_t *adev); ++void acxmem_l_clean_txdesc_emergency(acx_device_t *adev); ++int acxmem_s_create_hostdesc_queues(acx_device_t *adev); ++void acxmem_create_desc_queues(acx_device_t *adev, u32 tx_queue_start, u32 rx_queue_start); ++void acxmem_free_desc_queues(acx_device_t *adev); ++char* acxmem_s_proc_diag_output(char *p, acx_device_t *adev); ++int acxmem_proc_eeprom_output(char *p, acx_device_t *adev); ++void acxmem_set_interrupt_mask(acx_device_t *adev); ++int acx100mem_s_set_tx_level(acx_device_t *adev, u8 level_dbm); ++ ++void acx_s_msleep(int ms); ++int acx_s_init_mac(acx_device_t *adev); ++void acx_set_reg_domain(acx_device_t *adev, unsigned char reg_dom_id); ++void acx_set_timer(acx_device_t *adev, int timeout_us); ++void acx_update_capabilities(acx_device_t *adev); ++void acx_s_start(acx_device_t *adev); ++ ++void acx_s_update_card_settings(acx_device_t *adev); ++void acx_s_parse_configoption(acx_device_t *adev, const acx111_ie_configoption_t *pcfg); ++void acx_l_update_ratevector(acx_device_t *adev); ++ ++void acx_init_task_scheduler(acx_device_t *adev); ++void acx_schedule_task(acx_device_t *adev, unsigned int set_flag); ++ ++int acx_e_ioctl_old(struct net_device *ndev, struct ifreq *ifr, int cmd); ++ ++client_t *acx_l_sta_list_get(acx_device_t *adev, const u8 *address); ++void acx_l_sta_list_del(acx_device_t *adev, client_t *clt); ++ ++int acx_l_transmit_disassoc(acx_device_t *adev, client_t *clt); ++void acx_i_timer(unsigned long a); ++int acx_s_complete_scan(acx_device_t *adev); ++ ++struct sk_buff *acx_rxbuf_to_ether(acx_device_t *adev, rxbuffer_t *rxbuf); ++int acx_ether_to_txbuf(acx_device_t *adev, void *txbuf, const struct sk_buff *skb); ++ ++u8 acx_signal_determine_quality(u8 signal, u8 noise); ++ ++void acx_l_process_rxbuf(acx_device_t *adev, rxbuffer_t *rxbuf); ++void acx_l_handle_txrate_auto(acx_device_t *adev, struct client *txc, ++ u16 intended_rate, u8 rate100, u16 rate111, u8 error, ++ int pkts_to_ignore); ++ ++void acx_dump_bytes(const void *, int); ++void acx_log_bad_eid(wlan_hdr_t* hdr, int len, wlan_ie_t* ie_ptr); ++ ++u8 acx_rate111to100(u16); ++ ++void acx_s_set_defaults(acx_device_t *adev); ++ ++#if !ACX_DEBUG ++static inline const char* acx_get_packet_type_string(u16 fc) { return ""; } ++#else ++const char* acx_get_packet_type_string(u16 fc); ++#endif ++const char* acx_cmd_status_str(unsigned int state); ++ ++int acx_i_start_xmit(struct sk_buff *skb, struct net_device *ndev); ++ ++void great_inquisitor(acx_device_t *adev); ++ ++void acx_s_get_firmware_version(acx_device_t *adev); ++void acx_display_hardware_details(acx_device_t *adev); ++ ++int acx_e_change_mtu(struct net_device *ndev, int mtu); ++struct net_device_stats* acx_e_get_stats(struct net_device *ndev); ++struct iw_statistics* acx_e_get_wireless_stats(struct net_device *ndev); ++ ++#ifdef ACX_MEM ++int __init acxmem_e_init_module(void); ++void __exit acxmem_e_cleanup_module(void); ++void acxmem_e_release(struct device *dev); ++#else ++int __init acxpci_e_init_module(void); ++int __init acxusb_e_init_module(void); ++void __exit acxpci_e_cleanup_module(void); ++void __exit acxusb_e_cleanup_module(void); ++#endif ++int __init acx_cs_init(void); ++void __exit acx_cs_cleanup(void); +Index: linux-2.6.22/drivers/net/wireless/acx/acx.h +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/acx.h 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,14 @@ ++#if defined(CONFIG_ACX_MEM) && !defined(ACX_MEM) ++#define ACX_MEM ++#endif ++ ++#if defined(CONFIG_ACX_CS) && !defined(ACX_MEM) ++#define ACX_MEM ++#endif ++ ++#include "acx_config.h" ++#include "wlan_compat.h" ++#include "wlan_hdr.h" ++#include "wlan_mgmt.h" ++#include "acx_struct.h" ++#include "acx_func.h" +Index: linux-2.6.22/drivers/net/wireless/acx/acx_hw.h +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/acx_hw.h 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,18 @@ ++/* ++ * Interface for ACX slave memory driver ++ * ++ * Copyright (c) 2006 SDG Systems, LLC ++ * ++ * GPL ++ * ++ */ ++ ++#ifndef _ACX_HW_H ++#define _ACX_HW_H ++ ++struct acx_hardware_data { ++ int (*start_hw)( void ); ++ int (*stop_hw)( void ); ++}; ++ ++#endif /* _ACX_HW_H */ +Index: linux-2.6.22/drivers/net/wireless/acx/acx_struct.h +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/acx_struct.h 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,2114 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++*/ ++ ++/*********************************************************************** ++** Forward declarations of types ++*/ ++typedef struct tx tx_t; ++typedef struct acx_device acx_device_t; ++typedef struct client client_t; ++typedef struct rxdesc rxdesc_t; ++typedef struct txdesc txdesc_t; ++typedef struct rxhostdesc rxhostdesc_t; ++typedef struct txhostdesc txhostdesc_t; ++ ++ ++/*********************************************************************** ++** Debug / log functionality ++*/ ++enum { ++ L_LOCK = (ACX_DEBUG>1)*0x0001, /* locking debug log */ ++ L_INIT = (ACX_DEBUG>0)*0x0002, /* special card initialization logging */ ++ L_IRQ = (ACX_DEBUG>0)*0x0004, /* interrupt stuff */ ++ L_ASSOC = (ACX_DEBUG>0)*0x0008, /* assocation (network join) and station log */ ++ L_FUNC = (ACX_DEBUG>1)*0x0020, /* logging of function enter / leave */ ++ L_XFER = (ACX_DEBUG>1)*0x0080, /* logging of transfers and mgmt */ ++ L_DATA = (ACX_DEBUG>1)*0x0100, /* logging of transfer data */ ++ L_DEBUG = (ACX_DEBUG>1)*0x0200, /* log of debug info */ ++ L_IOCTL = (ACX_DEBUG>0)*0x0400, /* log ioctl calls */ ++ L_CTL = (ACX_DEBUG>1)*0x0800, /* log of low-level ctl commands */ ++ L_BUFR = (ACX_DEBUG>1)*0x1000, /* debug rx buffer mgmt (ring buffer etc.) */ ++ L_XFER_BEACON = (ACX_DEBUG>1)*0x2000, /* also log beacon packets */ ++ L_BUFT = (ACX_DEBUG>1)*0x4000, /* debug tx buffer mgmt (ring buffer etc.) */ ++ L_USBRXTX = (ACX_DEBUG>0)*0x8000, /* debug USB rx/tx operations */ ++ L_BUF = L_BUFR + L_BUFT, ++ L_ANY = 0xffff ++}; ++ ++#if ACX_DEBUG ++extern unsigned int acx_debug; ++#else ++enum { acx_debug = 0 }; ++#endif ++ ++ ++/*********************************************************************** ++** Random helpers ++*/ ++#define ACX_PACKED __attribute__ ((packed)) ++ ++#define VEC_SIZE(a) (sizeof(a)/sizeof(a[0])) ++ ++/* Use worker_queues for 2.5/2.6 kernels and queue tasks for 2.4 kernels ++ (used for the 'bottom half' of the interrupt routine) */ ++ ++#include <linux/workqueue.h> ++#define USE_WORKER_TASKS ++#define WORK_STRUCT struct work_struct ++#define SCHEDULE_WORK schedule_work ++#define FLUSH_SCHEDULED_WORK flush_scheduled_work ++ ++ ++/*********************************************************************** ++** Constants ++*/ ++#define OK 0 ++#define NOT_OK 1 ++ ++/* The supported chip models */ ++#define CHIPTYPE_ACX100 1 ++#define CHIPTYPE_ACX111 2 ++ ++#define IS_ACX100(adev) ((adev)->chip_type == CHIPTYPE_ACX100) ++#define IS_ACX111(adev) ((adev)->chip_type == CHIPTYPE_ACX111) ++ ++/* Supported interfaces */ ++#define DEVTYPE_PCI 0 ++#define DEVTYPE_USB 1 ++#define DEVTYPE_MEM 2 ++ ++#if !defined(CONFIG_ACX_PCI) && !defined(CONFIG_ACX_USB) && !defined(CONFIG_ACX_MEM) && !defined(CONFIG_ACX_CS) ++#error Driver must include PCI, USB, PCMCIA or memory mapped interface support. You selected none of them. ++#endif ++ ++#if defined(CONFIG_ACX_PCI) ++ #if !defined(CONFIG_ACX_USB) ++ #define IS_PCI(adev) 1 ++ #else ++ #define IS_PCI(adev) ((adev)->dev_type == DEVTYPE_PCI) ++ #endif ++#else ++ #define IS_PCI(adev) 0 ++#endif ++ ++#if defined(CONFIG_ACX_USB) ++ #if !defined(CONFIG_ACX_PCI) ++ #define IS_USB(adev) 1 ++ #else ++ #define IS_USB(adev) ((adev)->dev_type == DEVTYPE_USB) ++ #endif ++#else ++ #define IS_USB(adev) 0 ++#endif ++ ++#if defined(CONFIG_ACX_MEM) || defined(CONFIG_ACX_CS) ++ #define IS_MEM(adev) 1 ++#else ++ #define IS_MEM(adev) 0 ++#endif ++ ++/* Driver defaults */ ++#define DEFAULT_DTIM_INTERVAL 10 ++/* used to be 2048, but FreeBSD driver changed it to 4096 to work properly ++** in noisy wlans */ ++#define DEFAULT_MSDU_LIFETIME 4096 ++#define DEFAULT_RTS_THRESHOLD 2312 /* max. size: disable RTS mechanism */ ++#define DEFAULT_BEACON_INTERVAL 100 ++ ++#define ACX100_BAP_DATALEN_MAX 4096 ++#define ACX100_RID_GUESSING_MAXLEN 2048 /* I'm not really sure */ ++#define ACX100_RIDDATA_MAXLEN ACX100_RID_GUESSING_MAXLEN ++ ++/* Support Constants */ ++/* Radio type names, found in Win98 driver's TIACXLN.INF */ ++#define RADIO_MAXIM_0D 0x0d ++#define RADIO_RFMD_11 0x11 ++#define RADIO_RALINK_15 0x15 ++/* used in ACX111 cards (WG311v2, WL-121, ...): */ ++#define RADIO_RADIA_16 0x16 ++/* most likely *sometimes* used in ACX111 cards: */ ++#define RADIO_UNKNOWN_17 0x17 ++/* FwRad19.bin was found in a Safecom driver; must be an ACX111 radio: */ ++#define RADIO_UNKNOWN_19 0x19 ++#define RADIO_UNKNOWN_1B 0x1b /* radio in SafeCom SWLUT-54125 USB adapter; entirely unknown!! */ ++ ++/* Controller Commands */ ++/* can be found in table cmdTable in firmware "Rev. 1.5.0" (FW150) */ ++#define ACX1xx_CMD_RESET 0x00 ++#define ACX1xx_CMD_INTERROGATE 0x01 ++#define ACX1xx_CMD_CONFIGURE 0x02 ++#define ACX1xx_CMD_ENABLE_RX 0x03 ++#define ACX1xx_CMD_ENABLE_TX 0x04 ++#define ACX1xx_CMD_DISABLE_RX 0x05 ++#define ACX1xx_CMD_DISABLE_TX 0x06 ++#define ACX1xx_CMD_FLUSH_QUEUE 0x07 ++#define ACX1xx_CMD_SCAN 0x08 ++#define ACX1xx_CMD_STOP_SCAN 0x09 ++#define ACX1xx_CMD_CONFIG_TIM 0x0a ++#define ACX1xx_CMD_JOIN 0x0b ++#define ACX1xx_CMD_WEP_MGMT 0x0c ++#ifdef OLD_FIRMWARE_VERSIONS ++#define ACX100_CMD_HALT 0x0e /* mapped to unknownCMD in FW150 */ ++#else ++#define ACX1xx_CMD_MEM_READ 0x0d ++#define ACX1xx_CMD_MEM_WRITE 0x0e ++#endif ++#define ACX1xx_CMD_SLEEP 0x0f ++#define ACX1xx_CMD_WAKE 0x10 ++#define ACX1xx_CMD_UNKNOWN_11 0x11 /* mapped to unknownCMD in FW150 */ ++#define ACX100_CMD_INIT_MEMORY 0x12 ++#define ACX1FF_CMD_DISABLE_RADIO 0x12 /* new firmware? TNETW1450? */ ++#define ACX1xx_CMD_CONFIG_BEACON 0x13 ++#define ACX1xx_CMD_CONFIG_PROBE_RESPONSE 0x14 ++#define ACX1xx_CMD_CONFIG_NULL_DATA 0x15 ++#define ACX1xx_CMD_CONFIG_PROBE_REQUEST 0x16 ++#define ACX1xx_CMD_FCC_TEST 0x17 ++#define ACX1xx_CMD_RADIOINIT 0x18 ++#define ACX111_CMD_RADIOCALIB 0x19 ++#define ACX1FF_CMD_NOISE_HISTOGRAM 0x1c /* new firmware? TNETW1450? */ ++#define ACX1FF_CMD_RX_RESET 0x1d /* new firmware? TNETW1450? */ ++#define ACX1FF_CMD_LNA_CONTROL 0x20 /* new firmware? TNETW1450? */ ++#define ACX1FF_CMD_CONTROL_DBG_TRACE 0x21 /* new firmware? TNETW1450? */ ++ ++/* 'After Interrupt' Commands */ ++#define ACX_AFTER_IRQ_CMD_STOP_SCAN 0x01 ++#define ACX_AFTER_IRQ_CMD_ASSOCIATE 0x02 ++#define ACX_AFTER_IRQ_CMD_RADIO_RECALIB 0x04 ++#define ACX_AFTER_IRQ_UPDATE_CARD_CFG 0x08 ++#define ACX_AFTER_IRQ_TX_CLEANUP 0x10 ++#define ACX_AFTER_IRQ_COMPLETE_SCAN 0x20 ++#define ACX_AFTER_IRQ_RESTART_SCAN 0x40 ++ ++/*********************************************************************** ++** Tx/Rx buffer sizes and watermarks ++** ++** This will alloc and use DMAable buffers of ++** WLAN_A4FR_MAXLEN_WEP_FCS * (RX_CNT + TX_CNT) bytes ++** RX/TX_CNT=32 -> ~150k DMA buffers ++** RX/TX_CNT=16 -> ~75k DMA buffers ++** ++** 2005-10-10: reduced memory usage by lowering both to 16 ++*/ ++#define RX_CNT 16 ++#define TX_CNT 16 ++ ++/* we clean up txdescs when we have N free txdesc: */ ++#define TX_CLEAN_BACKLOG (TX_CNT/4) ++#define TX_START_CLEAN (TX_CNT - TX_CLEAN_BACKLOG) ++#define TX_EMERG_CLEAN 2 ++/* we stop queue if we have < N free txbufs: */ ++#define TX_STOP_QUEUE 3 ++/* we start queue if we have >= N free txbufs: */ ++#define TX_START_QUEUE 5 ++ ++/*********************************************************************** ++** Interrogate/Configure cmd constants ++** ++** NB: length includes JUST the data part of the IE ++** (does not include size of the (type,len) pair) ++** ++** TODO: seems that acx100, acx100usb, acx111 have some differences, ++** fix code with regard to this! ++*/ ++ ++#define DEF_IE(name, val, len) enum { ACX##name=val, ACX##name##_LEN=len } ++ ++/* Information Elements: Network Parameters, Static Configuration Entities */ ++/* these are handled by real_cfgtable in firmware "Rev 1.5.0" (FW150) */ ++DEF_IE(1xx_IE_UNKNOWN_00 ,0x0000, -1); /* mapped to cfgInvalid in FW150 */ ++DEF_IE(100_IE_ACX_TIMER ,0x0001, 0x10); ++DEF_IE(1xx_IE_POWER_MGMT ,0x0002, 0x06); /* TNETW1450: length 0x18!! */ ++DEF_IE(1xx_IE_QUEUE_CONFIG ,0x0003, 0x1c); ++DEF_IE(100_IE_BLOCK_SIZE ,0x0004, 0x02); ++DEF_IE(1FF_IE_SLOT_TIME ,0x0004, 0x08); /* later firmware versions only? */ ++DEF_IE(1xx_IE_MEMORY_CONFIG_OPTIONS ,0x0005, 0x14); ++DEF_IE(1FF_IE_QUEUE_HEAD ,0x0005, 0x14 /* FIXME: length? */); ++DEF_IE(1xx_IE_RATE_FALLBACK ,0x0006, 0x01); /* TNETW1450: length 2 */ ++DEF_IE(100_IE_WEP_OPTIONS ,0x0007, 0x03); ++DEF_IE(111_IE_RADIO_BAND ,0x0007, -1); ++DEF_IE(1FF_IE_TIMING_CFG ,0x0007, -1); /* later firmware versions; TNETW1450 only? */ ++DEF_IE(100_IE_SSID ,0x0008, 0x20); /* huh? */ ++DEF_IE(1xx_IE_MEMORY_MAP ,0x0008, 0x28); /* huh? TNETW1450 has length 0x40!! */ ++DEF_IE(1xx_IE_SCAN_STATUS ,0x0009, 0x04); /* mapped to cfgInvalid in FW150 */ ++DEF_IE(1xx_IE_ASSOC_ID ,0x000a, 0x02); ++DEF_IE(1xx_IE_UNKNOWN_0B ,0x000b, -1); /* mapped to cfgInvalid in FW150 */ ++DEF_IE(1FF_IE_TX_POWER_LEVEL_TABLE ,0x000b, 0x18); /* later firmware versions; TNETW1450 only? */ ++DEF_IE(100_IE_UNKNOWN_0C ,0x000c, -1); /* very small implementation in FW150! */ ++/* ACX100 has an equivalent struct in the cmd mailbox directly after reset. ++ * 0x14c seems extremely large, will trash stack on failure (memset!) ++ * in case of small input struct --> OOPS! */ ++DEF_IE(111_IE_CONFIG_OPTIONS ,0x000c, 0x14c); ++DEF_IE(1xx_IE_FWREV ,0x000d, 0x18); ++DEF_IE(1xx_IE_FCS_ERROR_COUNT ,0x000e, 0x04); ++DEF_IE(1xx_IE_MEDIUM_USAGE ,0x000f, 0x08); ++DEF_IE(1xx_IE_RXCONFIG ,0x0010, 0x04); ++DEF_IE(100_IE_UNKNOWN_11 ,0x0011, -1); /* NONBINARY: large implementation in FW150! link quality readings or so? */ ++DEF_IE(111_IE_QUEUE_THRESH ,0x0011, -1); ++DEF_IE(100_IE_UNKNOWN_12 ,0x0012, -1); /* NONBINARY: VERY large implementation in FW150!! */ ++DEF_IE(111_IE_BSS_POWER_SAVE ,0x0012, /* -1 */ 2); ++DEF_IE(1xx_IE_FIRMWARE_STATISTICS ,0x0013, 0x9c); /* TNETW1450: length 0x134!! */ ++DEF_IE(1FF_IE_RX_INTR_CONFIG ,0x0014, 0x14); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1xx_IE_FEATURE_CONFIG ,0x0015, 0x08); ++DEF_IE(111_IE_KEY_CHOOSE ,0x0016, 0x04); /* for rekeying. really len=4?? */ ++DEF_IE(1FF_IE_MISC_CONFIG_TABLE ,0x0017, 0x04); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1FF_IE_WONE_CONFIG ,0x0018, -1); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1FF_IE_TID_CONFIG ,0x001a, 0x2c); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1FF_IE_CALIB_ASSESSMENT ,0x001e, 0x04); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1FF_IE_BEACON_FILTER_OPTIONS ,0x001f, 0x02); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1FF_IE_LOW_RSSI_THRESH_OPT ,0x0020, 0x04); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1FF_IE_NOISE_HISTOGRAM_RESULTS ,0x0021, 0x30); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1FF_IE_PACKET_DETECT_THRESH ,0x0023, 0x04); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1FF_IE_TX_CONFIG_OPTIONS ,0x0024, 0x04); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1FF_IE_CCA_THRESHOLD ,0x0025, 0x02); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1FF_IE_EVENT_MASK ,0x0026, 0x08); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1FF_IE_DTIM_PERIOD ,0x0027, 0x02); /* later firmware versions, TNETW1450 only? */ ++DEF_IE(1FF_IE_ACI_CONFIG_SET ,0x0029, 0x06); /* later firmware versions; maybe TNETW1450 only? */ ++DEF_IE(1FF_IE_EEPROM_VER ,0x0030, 0x04); /* later firmware versions; maybe TNETW1450 only? */ ++DEF_IE(1xx_IE_DOT11_STATION_ID ,0x1001, 0x06); ++DEF_IE(100_IE_DOT11_UNKNOWN_1002 ,0x1002, -1); /* mapped to cfgInvalid in FW150 */ ++DEF_IE(111_IE_DOT11_FRAG_THRESH ,0x1002, -1); /* mapped to cfgInvalid in FW150; TNETW1450 has length 2!! */ ++DEF_IE(100_IE_DOT11_BEACON_PERIOD ,0x1003, 0x02); /* mapped to cfgInvalid in FW150 */ ++DEF_IE(1xx_IE_DOT11_DTIM_PERIOD ,0x1004, -1); /* mapped to cfgInvalid in FW150 */ ++DEF_IE(1FF_IE_DOT11_MAX_RX_LIFETIME ,0x1004, -1); /* later firmware versions; maybe TNETW1450 only? */ ++DEF_IE(1xx_IE_DOT11_SHORT_RETRY_LIMIT ,0x1005, 0x01); /* TNETW1450: length 2 */ ++DEF_IE(1xx_IE_DOT11_LONG_RETRY_LIMIT ,0x1006, 0x01); /* TNETW1450: length 2 */ ++DEF_IE(100_IE_DOT11_WEP_DEFAULT_KEY_WRITE ,0x1007, 0x20); /* configure default keys; TNETW1450 has length 0x24!! */ ++DEF_IE(1xx_IE_DOT11_MAX_XMIT_MSDU_LIFETIME ,0x1008, 0x04); ++DEF_IE(1xx_IE_DOT11_GROUP_ADDR ,0x1009, -1); ++DEF_IE(1xx_IE_DOT11_CURRENT_REG_DOMAIN ,0x100a, 0x02); ++/* It's harmless to have larger struct. Use USB case always. */ ++DEF_IE(1xx_IE_DOT11_CURRENT_ANTENNA ,0x100b, 0x02); /* in fact len=1 for PCI */ ++DEF_IE(1xx_IE_DOT11_UNKNOWN_100C ,0x100c, -1); /* mapped to cfgInvalid in FW150 */ ++DEF_IE(1xx_IE_DOT11_TX_POWER_LEVEL ,0x100d, 0x01); /* TNETW1450 has length 2!! */ ++DEF_IE(1xx_IE_DOT11_CURRENT_CCA_MODE ,0x100e, 0x02); /* in fact len=1 for PCI */ ++/* USB doesn't return anything - len==0?! */ ++DEF_IE(100_IE_DOT11_ED_THRESHOLD ,0x100f, 0x04); ++DEF_IE(1xx_IE_DOT11_WEP_DEFAULT_KEY_SET ,0x1010, 0x01); /* set default key ID; TNETW1450: length 2 */ ++DEF_IE(100_IE_DOT11_UNKNOWN_1011 ,0x1011, -1); /* mapped to cfgInvalid in FW150 */ ++DEF_IE(1FF_IE_DOT11_CURR_5GHZ_REGDOM ,0x1011, -1); /* later firmware versions; maybe TNETW1450 only? */ ++DEF_IE(100_IE_DOT11_UNKNOWN_1012 ,0x1012, -1); /* mapped to cfgInvalid in FW150 */ ++DEF_IE(100_IE_DOT11_UNKNOWN_1013 ,0x1013, -1); /* mapped to cfgInvalid in FW150 */ ++ ++#if 0 ++/* Experimentally obtained on acx100, fw 1.9.8.b ++** -1 means that fw returned 'invalid IE' ++** 0200 FC00 nnnn... are test read contents: u16 type, u16 len, data ++** (AA are poison bytes marking bytes not written by fw) ++** ++** Looks like acx100 fw does not update len field (thus len=256-4=FC here) ++** A number of IEs seem to trash type,len fields ++** IEs marked 'huge' return gobs of data (no poison bytes remain) ++*/ ++DEF_IE(100_IE_INVAL_00, 0x0000, -1); ++DEF_IE(100_IE_INVAL_01, 0x0001, -1); /* IE_ACX_TIMER, len=16 on older fw */ ++DEF_IE(100_IE_POWER_MGMT, 0x0002, 4); /* 0200FC00 00040000 AAAAAAAA */ ++DEF_IE(100_IE_QUEUE_CONFIG, 0x0003, 28); /* 0300FC00 48060000 9CAD0000 0101AAAA DCB00000 E4B00000 9CAA0000 00AAAAAA */ ++DEF_IE(100_IE_BLOCK_SIZE, 0x0004, 2); /* 0400FC00 0001AAAA AAAAAAAA AAAAAAAA */ ++/* write only: */ ++DEF_IE(100_IE_MEMORY_CONFIG_OPTIONS, 0x0005, 20); ++DEF_IE(100_IE_RATE_FALLBACK, 0x0006, 1); /* 0600FC00 00AAAAAA AAAAAAAA AAAAAAAA */ ++/* write only: */ ++DEF_IE(100_IE_WEP_OPTIONS, 0x0007, 3); ++DEF_IE(100_IE_MEMORY_MAP, 0x0008, 40); /* huge: 0800FC00 30000000 6CA20000 70A20000... */ ++/* gives INVAL on read: */ ++DEF_IE(100_IE_SCAN_STATUS, 0x0009, -1); ++DEF_IE(100_IE_ASSOC_ID, 0x000a, 2); /* huge: 0A00FC00 00000000 01040800 00000000... */ ++DEF_IE(100_IE_INVAL_0B, 0x000b, -1); ++/* 'command rejected': */ ++DEF_IE(100_IE_CONFIG_OPTIONS, 0x000c, -3); ++DEF_IE(100_IE_FWREV, 0x000d, 24); /* 0D00FC00 52657620 312E392E 382E6200 AAAAAAAA AAAAAAAA 05050201 AAAAAAAA */ ++DEF_IE(100_IE_FCS_ERROR_COUNT, 0x000e, 4); ++DEF_IE(100_IE_MEDIUM_USAGE, 0x000f, 8); /* E41F0000 2D780300 FCC91300 AAAAAAAA */ ++DEF_IE(100_IE_RXCONFIG, 0x0010, 4); /* 1000FC00 00280000 AAAAAAAA AAAAAAAA */ ++DEF_IE(100_IE_QUEUE_THRESH, 0x0011, 12); /* 1100FC00 AAAAAAAA 00000000 00000000 */ ++DEF_IE(100_IE_BSS_POWER_SAVE, 0x0012, 1); /* 1200FC00 00AAAAAA AAAAAAAA AAAAAAAA */ ++/* read only, variable len */ ++DEF_IE(100_IE_FIRMWARE_STATISTICS, 0x0013, 256); /* 0000AC00 00000000 ... */ ++DEF_IE(100_IE_INT_CONFIG, 0x0014, 20); /* 00000000 00000000 00000000 00000000 5D74D105 00000000 AAAAAAAA AAAAAAAA */ ++DEF_IE(100_IE_FEATURE_CONFIG, 0x0015, 8); /* 1500FC00 16000000 AAAAAAAA AAAAAAAA */ ++/* returns 'invalid MAC': */ ++DEF_IE(100_IE_KEY_CHOOSE, 0x0016, -4); ++DEF_IE(100_IE_INVAL_17, 0x0017, -1); ++DEF_IE(100_IE_UNKNOWN_18, 0x0018, 0); /* null len?! 1800FC00 AAAAAAAA AAAAAAAA AAAAAAAA */ ++DEF_IE(100_IE_UNKNOWN_19, 0x0019, 256); /* huge: 1900FC00 9C1F00EA FEFFFFEA FEFFFFEA... */ ++DEF_IE(100_IE_INVAL_1A, 0x001A, -1); ++ ++DEF_IE(100_IE_DOT11_INVAL_1000, 0x1000, -1); ++DEF_IE(100_IE_DOT11_STATION_ID, 0x1001, 6); /* huge: 0110FC00 58B10E2F 03000000 00000000... */ ++DEF_IE(100_IE_DOT11_INVAL_1002, 0x1002, -1); ++DEF_IE(100_IE_DOT11_INVAL_1003, 0x1003, -1); ++DEF_IE(100_IE_DOT11_INVAL_1004, 0x1004, -1); ++DEF_IE(100_IE_DOT11_SHORT_RETRY_LIMIT, 0x1005, 1); ++DEF_IE(100_IE_DOT11_LONG_RETRY_LIMIT, 0x1006, 1); ++/* write only: */ ++DEF_IE(100_IE_DOT11_WEP_DEFAULT_KEY_WRITE, 0x1007, 32); ++DEF_IE(100_IE_DOT11_MAX_XMIT_MSDU_LIFETIME, 0x1008, 4); /* huge: 0810FC00 00020000 F4010000 00000000... */ ++/* undoc but returns something */ ++DEF_IE(100_IE_DOT11_GROUP_ADDR, 0x1009, 12); /* huge: 0910FC00 00000000 00000000 00000000... */ ++DEF_IE(100_IE_DOT11_CURRENT_REG_DOMAIN, 0x100a, 1); /* 0A10FC00 30AAAAAA AAAAAAAA AAAAAAAA */ ++DEF_IE(100_IE_DOT11_CURRENT_ANTENNA, 0x100b, 1); /* 0B10FC00 8FAAAAAA AAAAAAAA AAAAAAAA */ ++DEF_IE(100_IE_DOT11_INVAL_100C, 0x100c, -1); ++DEF_IE(100_IE_DOT11_TX_POWER_LEVEL, 0x100d, 2); /* 00000000 0100AAAA AAAAAAAA AAAAAAAA */ ++DEF_IE(100_IE_DOT11_CURRENT_CCA_MODE, 0x100e, 1); /* 0E10FC00 0DAAAAAA AAAAAAAA AAAAAAAA */ ++DEF_IE(100_IE_DOT11_ED_THRESHOLD, 0x100f, 4); /* 0F10FC00 70000000 AAAAAAAA AAAAAAAA */ ++/* set default key ID */ ++DEF_IE(100_IE_DOT11_WEP_DEFAULT_KEY_SET, 0x1010, 1); /* 1010FC00 00AAAAAA AAAAAAAA AAAAAAAA */ ++DEF_IE(100_IE_DOT11_INVAL_1011, 0x1011, -1); ++DEF_IE(100_IE_DOT11_INVAL_1012, 0x1012, -1); ++DEF_IE(100_IE_DOT11_INVAL_1013, 0x1013, -1); ++DEF_IE(100_IE_DOT11_UNKNOWN_1014, 0x1014, 256); /* huge */ ++DEF_IE(100_IE_DOT11_UNKNOWN_1015, 0x1015, 256); /* huge */ ++DEF_IE(100_IE_DOT11_UNKNOWN_1016, 0x1016, 256); /* huge */ ++DEF_IE(100_IE_DOT11_UNKNOWN_1017, 0x1017, 256); /* huge */ ++DEF_IE(100_IE_DOT11_UNKNOWN_1018, 0x1018, 256); /* huge */ ++DEF_IE(100_IE_DOT11_UNKNOWN_1019, 0x1019, 256); /* huge */ ++#endif ++ ++#if 0 ++/* Experimentally obtained on PCI acx111 Xterasys XN-2522g, fw 1.2.1.34 ++** -1 means that fw returned 'invalid IE' ++** 0400 0800 nnnn... are test read contents: u16 type, u16 len, data ++** (AA are poison bytes marking bytes not written by fw) ++** ++** Looks like acx111 fw reports real len! ++*/ ++DEF_IE(111_IE_INVAL_00, 0x0000, -1); ++DEF_IE(111_IE_INVAL_01, 0x0001, -1); ++DEF_IE(111_IE_POWER_MGMT, 0x0002, 12); ++/* write only, variable len: 12 + rxqueue_cnt*8 + txqueue_cnt*4: */ ++DEF_IE(111_IE_MEMORY_CONFIG, 0x0003, 24); ++DEF_IE(111_IE_BLOCK_SIZE, 0x0004, 8); /* 04000800 AA00AAAA AAAAAAAA */ ++/* variable len: 8 + rxqueue_cnt*8 + txqueue_cnt*8: */ ++DEF_IE(111_IE_QUEUE_HEAD, 0x0005, 24); ++DEF_IE(111_IE_RATE_FALLBACK, 0x0006, 1); ++/* acx100 name:WEP_OPTIONS */ ++/* said to have len:1 (not true, actually returns 12 bytes): */ ++DEF_IE(111_IE_RADIO_BAND, 0x0007, 12); /* 07000C00 AAAA1F00 FF03AAAA AAAAAAAA */ ++DEF_IE(111_IE_MEMORY_MAP, 0x0008, 48); ++/* said to have len:4, but gives INVAL on read: */ ++DEF_IE(111_IE_SCAN_STATUS, 0x0009, -1); ++DEF_IE(111_IE_ASSOC_ID, 0x000a, 2); ++/* write only, len is not known: */ ++DEF_IE(111_IE_UNKNOWN_0B, 0x000b, 0); ++/* read only, variable len. I see 67 byte reads: */ ++DEF_IE(111_IE_CONFIG_OPTIONS, 0x000c, 67); /* 0C004300 01160500 ... */ ++DEF_IE(111_IE_FWREV, 0x000d, 24); ++DEF_IE(111_IE_FCS_ERROR_COUNT, 0x000e, 4); ++DEF_IE(111_IE_MEDIUM_USAGE, 0x000f, 8); ++DEF_IE(111_IE_RXCONFIG, 0x0010, 4); ++DEF_IE(111_IE_QUEUE_THRESH, 0x0011, 12); ++DEF_IE(111_IE_BSS_POWER_SAVE, 0x0012, 1); ++/* read only, variable len. I see 240 byte reads: */ ++DEF_IE(111_IE_FIRMWARE_STATISTICS, 0x0013, 240); /* 1300F000 00000000 ... */ ++/* said to have len=17. looks like fw pads it to 20: */ ++DEF_IE(111_IE_INT_CONFIG, 0x0014, 20); /* 14001400 00000000 00000000 00000000 00000000 00000000 */ ++DEF_IE(111_IE_FEATURE_CONFIG, 0x0015, 8); ++/* said to be name:KEY_INDICATOR, len:4, but gives INVAL on read: */ ++DEF_IE(111_IE_KEY_CHOOSE, 0x0016, -1); ++/* said to have len:4, but in fact returns 8: */ ++DEF_IE(111_IE_MAX_USB_XFR, 0x0017, 8); /* 17000800 00014000 00000000 */ ++DEF_IE(111_IE_INVAL_18, 0x0018, -1); ++DEF_IE(111_IE_INVAL_19, 0x0019, -1); ++/* undoc but returns something: */ ++/* huh, fw indicates len=20 but uses 4 more bytes in buffer??? */ ++DEF_IE(111_IE_UNKNOWN_1A, 0x001A, 20); /* 1A001400 AA00AAAA 0000020F FF030000 00020000 00000007 04000000 */ ++ ++DEF_IE(111_IE_DOT11_INVAL_1000, 0x1000, -1); ++DEF_IE(111_IE_DOT11_STATION_ID, 0x1001, 6); ++DEF_IE(111_IE_DOT11_FRAG_THRESH, 0x1002, 2); ++/* acx100 only? gives INVAL on read: */ ++DEF_IE(111_IE_DOT11_BEACON_PERIOD, 0x1003, -1); ++/* said to be MAX_RECV_MSDU_LIFETIME: */ ++DEF_IE(111_IE_DOT11_DTIM_PERIOD, 0x1004, 4); ++DEF_IE(111_IE_DOT11_SHORT_RETRY_LIMIT, 0x1005, 1); ++DEF_IE(111_IE_DOT11_LONG_RETRY_LIMIT, 0x1006, 1); ++/* acx100 only? gives INVAL on read: */ ++DEF_IE(111_IE_DOT11_WEP_DEFAULT_KEY_WRITE, 0x1007, -1); ++DEF_IE(111_IE_DOT11_MAX_XMIT_MSDU_LIFETIME, 0x1008, 4); ++/* undoc but returns something. maybe it's 2 multicast MACs to listen to? */ ++DEF_IE(111_IE_DOT11_GROUP_ADDR, 0x1009, 12); /* 09100C00 00000000 00000000 00000000 */ ++DEF_IE(111_IE_DOT11_CURRENT_REG_DOMAIN, 0x100a, 1); ++DEF_IE(111_IE_DOT11_CURRENT_ANTENNA, 0x100b, 2); ++DEF_IE(111_IE_DOT11_INVAL_100C, 0x100c, -1); ++DEF_IE(111_IE_DOT11_TX_POWER_LEVEL, 0x100d, 1); ++/* said to have len=1 but gives INVAL on read: */ ++DEF_IE(111_IE_DOT11_CURRENT_CCA_MODE, 0x100e, -1); ++/* said to have len=4 but gives INVAL on read: */ ++DEF_IE(111_IE_DOT11_ED_THRESHOLD, 0x100f, -1); ++/* set default key ID. write only: */ ++DEF_IE(111_IE_DOT11_WEP_DEFAULT_KEY_SET, 0x1010, 1); ++/* undoc but returns something: */ ++DEF_IE(111_IE_DOT11_UNKNOWN_1011, 0x1011, 1); /* 11100100 20 */ ++DEF_IE(111_IE_DOT11_INVAL_1012, 0x1012, -1); ++DEF_IE(111_IE_DOT11_INVAL_1013, 0x1013, -1); ++#endif ++ ++ ++/*********************************************************************** ++**Information Frames Structures ++*/ ++ ++/* Used in beacon frames and the like */ ++#define DOT11RATEBYTE_1 (1*2) ++#define DOT11RATEBYTE_2 (2*2) ++#define DOT11RATEBYTE_5_5 (5*2+1) ++#define DOT11RATEBYTE_11 (11*2) ++#define DOT11RATEBYTE_22 (22*2) ++#define DOT11RATEBYTE_6_G (6*2) ++#define DOT11RATEBYTE_9_G (9*2) ++#define DOT11RATEBYTE_12_G (12*2) ++#define DOT11RATEBYTE_18_G (18*2) ++#define DOT11RATEBYTE_24_G (24*2) ++#define DOT11RATEBYTE_36_G (36*2) ++#define DOT11RATEBYTE_48_G (48*2) ++#define DOT11RATEBYTE_54_G (54*2) ++#define DOT11RATEBYTE_BASIC 0x80 /* flags rates included in basic rate set */ ++ ++ ++/*********************************************************************** ++** rxbuffer_t ++** ++** This is the format of rx data returned by acx ++*/ ++ ++/* I've hoped it's a 802.11 PHY header, but no... ++ * so far, I've seen on acx111: ++ * 0000 3a00 0000 0000 IBSS Beacons ++ * 0000 3c00 0000 0000 ESS Beacons ++ * 0000 2700 0000 0000 Probe requests ++ * --vda ++ */ ++typedef struct phy_hdr { ++ u8 unknown[4]; ++ u8 acx111_unknown[4]; ++} ACX_PACKED phy_hdr_t; ++ ++/* seems to be a bit similar to hfa384x_rx_frame. ++ * These fields are still not quite obvious, though. ++ * Some seem to have different meanings... */ ++ ++#define RXBUF_HDRSIZE 12 ++#define RXBUF_BYTES_RCVD(adev, rxbuf) \ ++ ((le16_to_cpu((rxbuf)->mac_cnt_rcvd) & 0xfff) - (adev)->phy_header_len) ++#define RXBUF_BYTES_USED(rxbuf) \ ++ ((le16_to_cpu((rxbuf)->mac_cnt_rcvd) & 0xfff) + RXBUF_HDRSIZE) ++/* USBism */ ++#define RXBUF_IS_TXSTAT(rxbuf) (le16_to_cpu((rxbuf)->mac_cnt_rcvd) & 0x8000) ++/* ++mac_cnt_rcvd: ++ 12 bits: length of frame from control field to first byte of FCS ++ 3 bits: reserved ++ 1 bit: 1 = it's a tx status info, not a rx packet (USB only) ++ ++mac_cnt_mblks: ++ 6 bits: number of memory block used to store frame in adapter memory ++ 1 bit: Traffic Indicator bit in TIM of received Beacon was set ++ ++mac_status: 1 byte (bitmap): ++ 7 Matching BSSID ++ 6 Matching SSID ++ 5 BDCST Address 1 field is a broadcast ++ 4 VBM received beacon frame has more than one set bit (?!) ++ 3 TIM Set bit representing this station is set in TIM of received beacon ++ 2 GROUP Address 1 is a multicast ++ 1 ADDR1 Address 1 matches our MAC ++ 0 FCSGD FSC is good ++ ++phy_stat_baseband: 1 byte (bitmap): ++ 7 Preamble frame had a long preamble ++ 6 PLCP Error CRC16 error in PLCP header ++ 5 Unsup_Mod unsupported modulation ++ 4 Selected Antenna antenna 1 was used to receive this frame ++ 3 PBCC/CCK frame used: 1=PBCC, 0=CCK modulation ++ 2 OFDM frame used OFDM modulation ++ 1 TI Protection protection frame was detected ++ 0 Reserved ++ ++phy_plcp_signal: 1 byte: ++ Receive PLCP Signal field from the Baseband Processor ++ ++phy_level: 1 byte: ++ receive AGC gain level (can be used to measure receive signal strength) ++ ++phy_snr: 1 byte: ++ estimated noise power of equalized receive signal ++ at input of FEC decoder (can be used to measure receive signal quality) ++ ++time: 4 bytes: ++ timestamp sampled from either the Access Manager TSF counter ++ or free-running microsecond counter when the MAC receives ++ first byte of PLCP header. ++*/ ++ ++typedef struct rxbuffer { ++ u16 mac_cnt_rcvd; /* only 12 bits are len! (0xfff) */ ++ u8 mac_cnt_mblks; ++ u8 mac_status; ++ u8 phy_stat_baseband; /* bit 0x80: used LNA (Low-Noise Amplifier) */ ++ u8 phy_plcp_signal; ++ u8 phy_level; /* PHY stat */ ++ u8 phy_snr; /* PHY stat */ ++ u32 time; /* timestamp upon MAC rcv first byte */ ++/* 4-byte (acx100) or 8-byte (acx111) phy header will be here ++** if RX_CFG1_INCLUDE_PHY_HDR is in effect: ++** phy_hdr_t phy */ ++ wlan_hdr_a3_t hdr_a3; ++ /* maximally sized data part of wlan packet */ ++ u8 data_a3[WLAN_A4FR_MAXLEN_WEP_FCS - WLAN_HDR_A3_LEN]; ++ /* can add hdr/data_a4 if needed */ ++} ACX_PACKED rxbuffer_t; ++ ++ ++/*--- Firmware statistics ----------------------------------------------------*/ ++ ++/* define a random 100 bytes more to catch firmware versions which ++ * provide a bigger struct */ ++#define FW_STATS_FUTURE_EXTENSION 100 ++ ++typedef struct fw_stats_tx { ++ u32 tx_desc_of; ++} ACX_PACKED fw_stats_tx_t; ++ ++typedef struct fw_stats_rx { ++ u32 rx_oom; ++ u32 rx_hdr_of; ++ u32 rx_hw_stuck; /* old: u32 rx_hdr_use_next */ ++ u32 rx_dropped_frame; ++ u32 rx_frame_ptr_err; ++ u32 rx_xfr_hint_trig; ++ u32 rx_aci_events; /* later versions only */ ++ u32 rx_aci_resets; /* later versions only */ ++} ACX_PACKED fw_stats_rx_t; ++ ++typedef struct fw_stats_dma { ++ u32 rx_dma_req; ++ u32 rx_dma_err; ++ u32 tx_dma_req; ++ u32 tx_dma_err; ++} ACX_PACKED fw_stats_dma_t; ++ ++typedef struct fw_stats_irq { ++ u32 cmd_cplt; ++ u32 fiq; ++ u32 rx_hdrs; ++ u32 rx_cmplt; ++ u32 rx_mem_of; ++ u32 rx_rdys; ++ u32 irqs; ++ u32 tx_procs; ++ u32 decrypt_done; ++ u32 dma_0_done; ++ u32 dma_1_done; ++ u32 tx_exch_complet; ++ u32 commands; ++ u32 rx_procs; ++ u32 hw_pm_mode_changes; ++ u32 host_acks; ++ u32 pci_pm; ++ u32 acm_wakeups; ++} ACX_PACKED fw_stats_irq_t; ++ ++typedef struct fw_stats_wep { ++ u32 wep_key_count; ++ u32 wep_default_key_count; ++ u32 dot11_def_key_mib; ++ u32 wep_key_not_found; ++ u32 wep_decrypt_fail; ++ u32 wep_pkt_decrypt; ++ u32 wep_decrypt_irqs; ++} ACX_PACKED fw_stats_wep_t; ++ ++typedef struct fw_stats_pwr { ++ u32 tx_start_ctr; ++ u32 no_ps_tx_too_short; ++ u32 rx_start_ctr; ++ u32 no_ps_rx_too_short; ++ u32 lppd_started; ++ u32 no_lppd_too_noisy; ++ u32 no_lppd_too_short; ++ u32 no_lppd_matching_frame; ++} ACX_PACKED fw_stats_pwr_t; ++ ++typedef struct fw_stats_mic { ++ u32 mic_rx_pkts; ++ u32 mic_calc_fail; ++} ACX_PACKED fw_stats_mic_t; ++ ++typedef struct fw_stats_aes { ++ u32 aes_enc_fail; ++ u32 aes_dec_fail; ++ u32 aes_enc_pkts; ++ u32 aes_dec_pkts; ++ u32 aes_enc_irq; ++ u32 aes_dec_irq; ++} ACX_PACKED fw_stats_aes_t; ++ ++typedef struct fw_stats_event { ++ u32 heartbeat; ++ u32 calibration; ++ u32 rx_mismatch; ++ u32 rx_mem_empty; ++ u32 rx_pool; ++ u32 oom_late; ++ u32 phy_tx_err; ++ u32 tx_stuck; ++} ACX_PACKED fw_stats_event_t; ++ ++/* mainly for size calculation only */ ++typedef struct fw_stats { ++ u16 type; ++ u16 len; ++ fw_stats_tx_t tx; ++ fw_stats_rx_t rx; ++ fw_stats_dma_t dma; ++ fw_stats_irq_t irq; ++ fw_stats_wep_t wep; ++ fw_stats_pwr_t pwr; ++ fw_stats_mic_t mic; ++ fw_stats_aes_t aes; ++ fw_stats_event_t evt; ++ u8 _padding[FW_STATS_FUTURE_EXTENSION]; ++} fw_stats_t; ++ ++/* Firmware version struct */ ++ ++typedef struct fw_ver { ++ u16 cmd; ++ u16 size; ++ char fw_id[20]; ++ u32 hw_id; ++} ACX_PACKED fw_ver_t; ++ ++#define FW_ID_SIZE 20 ++ ++typedef struct shared_queueindicator { ++ u32 indicator; ++ u16 host_lock; ++ u16 fw_lock; ++} ACX_PACKED queueindicator_t; ++ ++/*--- WEP stuff --------------------------------------------------------------*/ ++#define DOT11_MAX_DEFAULT_WEP_KEYS 4 ++ ++/* non-firmware struct, no packing necessary */ ++typedef struct wep_key { ++ size_t size; /* most often used member first */ ++ u8 index; ++ u8 key[29]; ++ u16 strange_filler; ++} wep_key_t; /* size = 264 bytes (33*8) */ ++/* FIXME: We don't have size 264! Or is there 2 bytes beyond the key ++ * (strange_filler)? */ ++ ++/* non-firmware struct, no packing necessary */ ++typedef struct key_struct { ++ u8 addr[ETH_ALEN]; /* 0x00 */ ++ u16 filler1; /* 0x06 */ ++ u32 filler2; /* 0x08 */ ++ u32 index; /* 0x0c */ ++ u16 len; /* 0x10 */ ++ u8 key[29]; /* 0x12; is this long enough??? */ ++} key_struct_t; /* size = 276. FIXME: where is the remaining space?? */ ++ ++ ++/*--- Client (peer) info -----------------------------------------------------*/ ++/* adev->sta_list[] is used for: ++** accumulating and processing of scan results ++** keeping client info in AP mode ++** keeping AP info in STA mode (AP is the only one 'client') ++** keeping peer info in ad-hoc mode ++** non-firmware struct --> no packing necessary */ ++enum { ++ CLIENT_EMPTY_SLOT_0 = 0, ++ CLIENT_EXIST_1 = 1, ++ CLIENT_AUTHENTICATED_2 = 2, ++ CLIENT_ASSOCIATED_3 = 3, ++ CLIENT_JOIN_CANDIDATE = 4 ++}; ++struct client { ++ /* most frequent access first */ ++ u8 used; /* misnamed, more like 'status' */ ++ struct client* next; ++ unsigned long mtime; /* last time we heard it, in jiffies */ ++ size_t essid_len; /* length of ESSID (without '\0') */ ++ u32 sir; /* Standard IR */ ++ u32 snr; /* Signal to Noise Ratio */ ++ u16 aid; /* association ID */ ++ u16 seq; /* from client's auth req */ ++ u16 auth_alg; /* from client's auth req */ ++ u16 cap_info; /* from client's assoc req */ ++ u16 rate_cap; /* what client supports (all rates) */ ++ u16 rate_bas; /* what client supports (basic rates) */ ++ u16 rate_cfg; /* what is allowed (by iwconfig etc) */ ++ u16 rate_cur; /* currently used rate mask */ ++ u8 rate_100; /* currently used rate byte (acx100 only) */ ++ u8 address[ETH_ALEN]; ++ u8 bssid[ETH_ALEN]; /* ad-hoc hosts can have bssid != mac */ ++ u8 channel; ++ u8 auth_step; ++ u8 ignore_count; ++ u8 fallback_count; ++ u8 stepup_count; ++ char essid[IW_ESSID_MAX_SIZE + 1]; /* ESSID and trailing '\0' */ ++/* FIXME: this one is too damn big */ ++ char challenge_text[WLAN_CHALLENGE_LEN]; ++}; ++ ++ ++/*********************************************************************** ++** Hardware structures ++*/ ++ ++/* An opaque typesafe helper type ++ * ++ * Some hardware fields are actually pointers, ++ * but they have to remain u32, since using ptr instead ++ * (8 bytes on 64bit systems!) would disrupt the fixed descriptor ++ * format the acx firmware expects in the non-user area. ++ * Since we cannot cram an 8 byte ptr into 4 bytes, we need to ++ * enforce that pointed to data remains in low memory ++ * (address value needs to fit in 4 bytes) on 64bit systems. ++ * ++ * This is easy to get wrong, thus we are using a small struct ++ * and special macros to access it. Macros will check for ++ * attempts to overflow an acx_ptr with value > 0xffffffff. ++ * ++ * Attempts to use acx_ptr without macros result in compile-time errors */ ++ ++typedef struct { ++ u32 v; ++} ACX_PACKED acx_ptr; ++ ++#if ACX_DEBUG ++#define CHECK32(n) BUG_ON(sizeof(n)>4 && (long)(n)>0xffffff00) ++#else ++#define CHECK32(n) ((void)0) ++#endif ++ ++/* acx_ptr <-> integer conversion */ ++#define cpu2acx(n) ({ CHECK32(n); ((acx_ptr){ .v = cpu_to_le32(n) }); }) ++#define acx2cpu(a) (le32_to_cpu(a.v)) ++ ++/* acx_ptr <-> pointer conversion */ ++#define ptr2acx(p) ({ CHECK32(p); ((acx_ptr){ .v = cpu_to_le32((u32)(long)(p)) }); }) ++#define acx2ptr(a) ((void*)le32_to_cpu(a.v)) ++ ++/* Values for rate field (acx100 only) */ ++#define RATE100_1 10 ++#define RATE100_2 20 ++#define RATE100_5 55 ++#define RATE100_11 110 ++#define RATE100_22 220 ++/* This bit denotes use of PBCC: ++** (PBCC encoding is usable with 11 and 22 Mbps speeds only) */ ++#define RATE100_PBCC511 0x80 ++ ++/* Bit values for rate111 field */ ++#define RATE111_1 0x0001 /* DBPSK */ ++#define RATE111_2 0x0002 /* DQPSK */ ++#define RATE111_5 0x0004 /* CCK or PBCC */ ++#define RATE111_6 0x0008 /* CCK-OFDM or OFDM */ ++#define RATE111_9 0x0010 /* CCK-OFDM or OFDM */ ++#define RATE111_11 0x0020 /* CCK or PBCC */ ++#define RATE111_12 0x0040 /* CCK-OFDM or OFDM */ ++#define RATE111_18 0x0080 /* CCK-OFDM or OFDM */ ++#define RATE111_22 0x0100 /* PBCC */ ++#define RATE111_24 0x0200 /* CCK-OFDM or OFDM */ ++#define RATE111_36 0x0400 /* CCK-OFDM or OFDM */ ++#define RATE111_48 0x0800 /* CCK-OFDM or OFDM */ ++#define RATE111_54 0x1000 /* CCK-OFDM or OFDM */ ++#define RATE111_RESERVED 0x2000 ++#define RATE111_PBCC511 0x4000 /* PBCC mod at 5.5 or 11Mbit (else CCK) */ ++#define RATE111_SHORTPRE 0x8000 /* short preamble */ ++/* Special 'try everything' value */ ++#define RATE111_ALL 0x1fff ++/* These bits denote acx100 compatible settings */ ++#define RATE111_ACX100_COMPAT 0x0127 ++/* These bits denote 802.11b compatible settings */ ++#define RATE111_80211B_COMPAT 0x0027 ++ ++/* Descriptor Ctl field bits ++ * init value is 0x8e, "idle" value is 0x82 (in idle tx descs) ++ */ ++#define DESC_CTL_SHORT_PREAMBLE 0x01 /* preamble type: 0 = long; 1 = short */ ++#define DESC_CTL_FIRSTFRAG 0x02 /* this is the 1st frag of the frame */ ++#define DESC_CTL_AUTODMA 0x04 ++#define DESC_CTL_RECLAIM 0x08 /* ready to reuse */ ++#define DESC_CTL_HOSTDONE 0x20 /* host has finished processing */ ++#define DESC_CTL_ACXDONE 0x40 /* acx has finished processing */ ++/* host owns the desc [has to be released last, AFTER modifying all other desc fields!] */ ++#define DESC_CTL_HOSTOWN 0x80 ++#define DESC_CTL_ACXDONE_HOSTOWN (DESC_CTL_ACXDONE | DESC_CTL_HOSTOWN) ++ ++/* Descriptor Status field ++ */ ++#define DESC_STATUS_FULL (1 << 31) ++ ++/* NB: some bits may be interesting for Monitor mode tx (aka Raw tx): */ ++#define DESC_CTL2_SEQ 0x01 /* don't increase sequence field */ ++#define DESC_CTL2_FCS 0x02 /* don't add the FCS */ ++#define DESC_CTL2_MORE_FRAG 0x04 ++#define DESC_CTL2_RETRY 0x08 /* don't increase retry field */ ++#define DESC_CTL2_POWER 0x10 /* don't increase power mgmt. field */ ++#define DESC_CTL2_RTS 0x20 /* do RTS/CTS magic before sending */ ++#define DESC_CTL2_WEP 0x40 /* encrypt this frame */ ++#define DESC_CTL2_DUR 0x80 /* don't increase duration field */ ++ ++/*********************************************************************** ++** PCI structures ++*/ ++/* IRQ Constants ++** (outside of "#ifdef PCI" because USB (mis)uses HOST_INT_SCAN_COMPLETE) */ ++#define HOST_INT_RX_DATA 0x0001 ++#define HOST_INT_TX_COMPLETE 0x0002 ++#define HOST_INT_TX_XFER 0x0004 ++#define HOST_INT_RX_COMPLETE 0x0008 ++#define HOST_INT_DTIM 0x0010 ++#define HOST_INT_BEACON 0x0020 ++#define HOST_INT_TIMER 0x0040 ++#define HOST_INT_KEY_NOT_FOUND 0x0080 ++#define HOST_INT_IV_ICV_FAILURE 0x0100 ++#define HOST_INT_CMD_COMPLETE 0x0200 ++#define HOST_INT_INFO 0x0400 ++#define HOST_INT_OVERFLOW 0x0800 ++#define HOST_INT_PROCESS_ERROR 0x1000 ++#define HOST_INT_SCAN_COMPLETE 0x2000 ++#define HOST_INT_FCS_THRESHOLD 0x4000 ++#define HOST_INT_UNKNOWN 0x8000 ++ ++/* Outside of "#ifdef PCI" because USB needs to know sizeof() ++** of txdesc and rxdesc: */ ++struct txdesc { ++ acx_ptr pNextDesc; /* pointer to next txdesc */ ++ acx_ptr HostMemPtr; /* 0x04 */ ++ acx_ptr AcxMemPtr; /* 0x08 */ ++ u32 tx_time; /* 0x0c */ ++ u16 total_length; /* 0x10 */ ++ u16 Reserved; /* 0x12 */ ++ ++/* The following 16 bytes do not change when acx100 owns the descriptor */ ++/* BUG: fw clears last byte of this area which is supposedly reserved ++** for driver use. amd64 blew up. We dare not use it now */ ++ u32 dummy[4]; ++ ++ u8 Ctl_8; /* 0x24, 8bit value */ ++ u8 Ctl2_8; /* 0x25, 8bit value */ ++ u8 error; /* 0x26 */ ++ u8 ack_failures; /* 0x27 */ ++ ++ union { ++ /* ++ * Packing doesn't work correctly on ARM unless unions are on ++ * 4 byte boundaries. ++ */ ++ struct { ++ u8 rts_failures; /* 0x28 */ ++ u8 rts_ok; /* 0x29 */ ++ u16 d1; ++ } ACX_PACKED rts; ++ struct { ++ u16 d1; ++ u8 rate; /* 0x2a */ ++ u8 queue_ctrl; /* 0x2b */ ++ } ACX_PACKED r1; ++ struct { ++ u16 d1; ++ u16 rate111; /* 0x2a */ ++ } ACX_PACKED r2; ++ } ACX_PACKED u; ++ u32 queue_info; /* 0x2c (acx100, reserved on acx111) */ ++} ACX_PACKED; /* size : 48 = 0x30 */ ++/* NB: acx111 txdesc structure is 4 byte larger */ ++/* All these 4 extra bytes are reserved. tx alloc code takes them into account */ ++ ++struct rxdesc { ++ acx_ptr pNextDesc; /* 0x00 */ ++ acx_ptr HostMemPtr; /* 0x04 */ ++ acx_ptr ACXMemPtr; /* 0x08 */ ++ u32 rx_time; /* 0x0c */ ++ u16 total_length; /* 0x10 */ ++ u16 WEP_length; /* 0x12 */ ++ u32 WEP_ofs; /* 0x14 */ ++ ++/* the following 16 bytes do not change when acx100 owns the descriptor */ ++ u8 driverWorkspace[16]; /* 0x18 */ ++ ++ u8 Ctl_8; ++ u8 rate; ++ u8 error; ++ u8 SNR; /* Signal-to-Noise Ratio */ ++ u8 RxLevel; ++ u8 queue_ctrl; ++ u16 unknown; ++ u32 unknown2; ++} ACX_PACKED; /* size 52 = 0x34 */ ++ ++#if defined(ACX_PCI) || defined(ACX_MEM) ++ ++/* Register I/O offsets */ ++#define ACX100_EEPROM_ID_OFFSET 0x380 ++ ++/* please add further ACX hardware register definitions only when ++ it turns out you need them in the driver, and please try to use ++ firmware functionality instead, since using direct I/O access instead ++ of letting the firmware do it might confuse the firmware's state ++ machine */ ++ ++/* ***** ABSOLUTELY ALWAYS KEEP OFFSETS IN SYNC WITH THE INITIALIZATION ++** OF THE I/O ARRAYS!!!! (grep for '^IO_ACX') ***** */ ++enum { ++ IO_ACX_SOFT_RESET = 0, ++ ++ IO_ACX_SLV_MEM_ADDR, ++ IO_ACX_SLV_MEM_DATA, ++ IO_ACX_SLV_MEM_CTL, ++ IO_ACX_SLV_END_CTL, ++ ++ IO_ACX_FEMR, /* Function Event Mask */ ++ ++ IO_ACX_INT_TRIG, ++ IO_ACX_IRQ_MASK, ++ IO_ACX_IRQ_STATUS_NON_DES, ++ IO_ACX_IRQ_STATUS_CLEAR, /* CLEAR = clear on read */ ++ IO_ACX_IRQ_ACK, ++ IO_ACX_HINT_TRIG, ++ ++ IO_ACX_ENABLE, ++ ++ IO_ACX_EEPROM_CTL, ++ IO_ACX_EEPROM_ADDR, ++ IO_ACX_EEPROM_DATA, ++ IO_ACX_EEPROM_CFG, ++ ++ IO_ACX_PHY_ADDR, ++ IO_ACX_PHY_DATA, ++ IO_ACX_PHY_CTL, ++ ++ IO_ACX_GPIO_OE, ++ ++ IO_ACX_GPIO_OUT, ++ ++ IO_ACX_CMD_MAILBOX_OFFS, ++ IO_ACX_INFO_MAILBOX_OFFS, ++ IO_ACX_EEPROM_INFORMATION, ++ ++ IO_ACX_EE_START, ++ IO_ACX_SOR_CFG, ++ IO_ACX_ECPU_CTRL ++}; ++/* ***** ABSOLUTELY ALWAYS KEEP OFFSETS IN SYNC WITH THE INITIALIZATION ++** OF THE I/O ARRAYS!!!! (grep for '^IO_ACX') ***** */ ++ ++/* Values for IO_ACX_INT_TRIG register: */ ++/* inform hw that rxdesc in queue needs processing */ ++#define INT_TRIG_RXPRC 0x08 ++/* inform hw that txdesc in queue needs processing */ ++#define INT_TRIG_TXPRC 0x04 ++/* ack that we received info from info mailbox */ ++#define INT_TRIG_INFOACK 0x02 ++/* inform hw that we have filled command mailbox */ ++#define INT_TRIG_CMD 0x01 ++ ++struct txhostdesc { ++ acx_ptr data_phy; /* 0x00 [u8 *] */ ++ u16 data_offset; /* 0x04 */ ++ u16 reserved; /* 0x06 */ ++ u16 Ctl_16; /* 16bit value, endianness!! */ ++ u16 length; /* 0x0a */ ++ acx_ptr desc_phy_next; /* 0x0c [txhostdesc *] */ ++ acx_ptr pNext; /* 0x10 [txhostdesc *] */ ++ u32 Status; /* 0x14, unused on Tx */ ++/* From here on you can use this area as you want (variable length, too!) */ ++ u8 *data; ++} ACX_PACKED; ++ ++struct rxhostdesc { ++ acx_ptr data_phy; /* 0x00 [rxbuffer_t *] */ ++ u16 data_offset; /* 0x04 */ ++ u16 reserved; /* 0x06 */ ++ u16 Ctl_16; /* 0x08; 16bit value, endianness!! */ ++ u16 length; /* 0x0a */ ++ acx_ptr desc_phy_next; /* 0x0c [rxhostdesc_t *] */ ++ acx_ptr pNext; /* 0x10 [rxhostdesc_t *] */ ++ u32 Status; /* 0x14 */ ++/* From here on you can use this area as you want (variable length, too!) */ ++ rxbuffer_t *data; ++} ACX_PACKED; ++ ++#endif /* ACX_PCI */ ++ ++/*********************************************************************** ++** USB structures and constants ++*/ ++#ifdef ACX_USB ++ ++/* Used for usb_txbuffer.desc field */ ++#define USB_TXBUF_TXDESC 0xA ++/* Size of header (everything up to data[]) */ ++#define USB_TXBUF_HDRSIZE 14 ++typedef struct usb_txbuffer { ++ u16 desc; ++ u16 mpdu_len; ++ u8 queue_index; ++ u8 rate; ++ u32 hostdata; ++ u8 ctrl1; ++ u8 ctrl2; ++ u16 data_len; ++ /* wlan packet content is placed here: */ ++ u8 data[WLAN_A4FR_MAXLEN_WEP_FCS]; ++} ACX_PACKED usb_txbuffer_t; ++ ++/* USB returns either rx packets (see rxbuffer) or ++** these "tx status" structs: */ ++typedef struct usb_txstatus { ++ u16 mac_cnt_rcvd; /* only 12 bits are len! (0xfff) */ ++ u8 queue_index; ++ u8 mac_status; /* seen 0x20 on tx failure */ ++ u32 hostdata; ++ u8 rate; ++ u8 ack_failures; ++ u8 rts_failures; ++ u8 rts_ok; ++} ACX_PACKED usb_txstatus_t; ++ ++typedef struct usb_tx { ++ unsigned busy:1; ++ struct urb *urb; ++ acx_device_t *adev; ++ /* actual USB bulk output data block is here: */ ++ usb_txbuffer_t bulkout; ++} usb_tx_t; ++ ++struct usb_rx_plain { ++ unsigned busy:1; ++ struct urb *urb; ++ acx_device_t *adev; ++ rxbuffer_t bulkin; ++}; ++ ++typedef struct usb_rx { ++ unsigned busy:1; ++ struct urb *urb; ++ acx_device_t *adev; ++ rxbuffer_t bulkin; ++ /* Make entire structure 4k. Report if it breaks something. */ ++ u8 padding[4*1024 - sizeof(struct usb_rx_plain)]; ++} usb_rx_t; ++#endif /* ACX_USB */ ++ ++ ++/* Config Option structs */ ++ ++typedef struct co_antennas { ++ u8 type; ++ u8 len; ++ u8 list[2]; ++} ACX_PACKED co_antennas_t; ++ ++typedef struct co_powerlevels { ++ u8 type; ++ u8 len; ++ u16 list[8]; ++} ACX_PACKED co_powerlevels_t; ++ ++typedef struct co_datarates { ++ u8 type; ++ u8 len; ++ u8 list[8]; ++} ACX_PACKED co_datarates_t; ++ ++typedef struct co_domains { ++ u8 type; ++ u8 len; ++ u8 list[6]; ++} ACX_PACKED co_domains_t; ++ ++typedef struct co_product_id { ++ u8 type; ++ u8 len; ++ u8 list[128]; ++} ACX_PACKED co_product_id_t; ++ ++typedef struct co_manuf_id { ++ u8 type; ++ u8 len; ++ u8 list[128]; ++} ACX_PACKED co_manuf_t; ++ ++typedef struct co_fixed { ++ char NVSv[8]; ++/* u16 NVS_vendor_offs; ACX111-only */ ++/* u16 unknown; ACX111-only */ ++ u8 MAC[6]; /* ACX100-only */ ++ u16 probe_delay; /* ACX100-only */ ++ u32 eof_memory; ++ u8 dot11CCAModes; ++ u8 dot11Diversity; ++ u8 dot11ShortPreambleOption; ++ u8 dot11PBCCOption; ++ u8 dot11ChannelAgility; ++ u8 dot11PhyType; /* FIXME: does 802.11 call it "dot11PHYType"? */ ++ u8 dot11TempType; ++ u8 table_count; ++} ACX_PACKED co_fixed_t; ++ ++typedef struct acx111_ie_configoption { ++ u16 type; ++ u16 len; ++/* Do not access below members directly, they are in fact variable length */ ++ co_fixed_t fixed; ++ co_antennas_t antennas; ++ co_powerlevels_t power_levels; ++ co_datarates_t data_rates; ++ co_domains_t domains; ++ co_product_id_t product_id; ++ co_manuf_t manufacturer; ++ u8 _padding[4]; ++} ACX_PACKED acx111_ie_configoption_t; ++ ++ ++/*********************************************************************** ++** Main acx per-device data structure ++*/ ++#define ACX_STATE_FW_LOADED 0x01 ++#define ACX_STATE_IFACE_UP 0x02 ++ ++/* MAC mode (BSS type) defines ++ * Note that they shouldn't be redefined, since they are also used ++ * during communication with firmware */ ++#define ACX_MODE_0_ADHOC 0 ++#define ACX_MODE_1_UNUSED 1 ++#define ACX_MODE_2_STA 2 ++#define ACX_MODE_3_AP 3 ++/* These are our own inventions. Sending these to firmware ++** makes it stop emitting beacons, which is exactly what we want ++** for these modes */ ++#define ACX_MODE_MONITOR 0xfe ++#define ACX_MODE_OFF 0xff ++/* 'Submode': identifies exact status of ADHOC/STA host */ ++#define ACX_STATUS_0_STOPPED 0 ++#define ACX_STATUS_1_SCANNING 1 ++#define ACX_STATUS_2_WAIT_AUTH 2 ++#define ACX_STATUS_3_AUTHENTICATED 3 ++#define ACX_STATUS_4_ASSOCIATED 4 ++ ++/* FIXME: this should be named something like struct acx_priv (typedef'd to ++ * acx_priv_t) */ ++ ++/* non-firmware struct, no packing necessary */ ++struct acx_device { ++ /* most frequent accesses first (dereferencing and cache line!) */ ++ ++ /*** Locking ***/ ++ /* FIXME: try to convert semaphore to more efficient mutex according ++ to Ingo Molnar's docs (but not before driver is in mainline or ++ pre-mutex Linux 2.6.10 is very outdated). */ ++ struct semaphore sem; ++ spinlock_t lock; ++#if defined(PARANOID_LOCKING) /* Lock debugging */ ++ const char *last_sem; ++ const char *last_lock; ++ unsigned long sem_time; ++ unsigned long lock_time; ++#endif ++#ifdef ACX_MEM ++ spinlock_t txbuf_lock; ++#endif ++ ++ /*** Linux network device ***/ ++ struct net_device *ndev; /* pointer to linux netdevice */ ++ ++ /*** Device statistics ***/ ++ struct net_device_stats stats; /* net device statistics */ ++#ifdef WIRELESS_EXT ++ struct iw_statistics wstats; /* wireless statistics */ ++#endif ++ /*** Power managment ***/ ++ struct pm_dev *pm; /* PM crap */ ++ ++ /*** Management timer ***/ ++ struct timer_list mgmt_timer; ++ ++ /*** Hardware identification ***/ ++ const char *chip_name; ++ u8 dev_type; ++ u8 chip_type; ++ u8 form_factor; ++ u8 radio_type; ++ u8 eeprom_version; ++ ++ /*** Config retrieved from EEPROM ***/ ++ char cfgopt_NVSv[8]; ++ u16 cfgopt_NVS_vendor_offs; ++ u8 cfgopt_MAC[6]; ++ u16 cfgopt_probe_delay; ++ u32 cfgopt_eof_memory; ++ u8 cfgopt_dot11CCAModes; ++ u8 cfgopt_dot11Diversity; ++ u8 cfgopt_dot11ShortPreambleOption; ++ u8 cfgopt_dot11PBCCOption; ++ u8 cfgopt_dot11ChannelAgility; ++ u8 cfgopt_dot11PhyType; ++ u8 cfgopt_dot11TempType; ++ co_antennas_t cfgopt_antennas; ++ co_powerlevels_t cfgopt_power_levels; ++ co_datarates_t cfgopt_data_rates; ++ co_domains_t cfgopt_domains; ++ co_product_id_t cfgopt_product_id; ++ co_manuf_t cfgopt_manufacturer; ++ ++ /*** Firmware identification ***/ ++ char firmware_version[FW_ID_SIZE+1]; ++ u32 firmware_numver; ++ u32 firmware_id; ++ const u16 *ie_len; ++ const u16 *ie_len_dot11; ++ ++ /*** Device state ***/ ++ u16 dev_state_mask; ++ u8 led_power; /* power LED status */ ++ u32 get_mask; /* mask of settings to fetch from the card */ ++ u32 set_mask; /* mask of settings to write to the card */ ++ ++ /* Barely used in USB case */ ++ u16 irq_status; ++ ++ u8 after_interrupt_jobs; /* mini job list for doing actions after an interrupt occurred */ ++ WORK_STRUCT after_interrupt_task; /* our task for after interrupt actions */ ++ ++ /*** scanning ***/ ++ u16 scan_count; /* number of times to do channel scan */ ++ u8 scan_mode; /* 0 == active, 1 == passive, 2 == background */ ++ u8 scan_rate; ++ u16 scan_duration; ++ u16 scan_probe_delay; ++#if WIRELESS_EXT > 15 ++ struct iw_spy_data spy_data; /* FIXME: needs to be implemented! */ ++#endif ++ ++ /*** Wireless network settings ***/ ++ /* copy of the device address (ifconfig hw ether) that we actually use ++ ** for 802.11; copied over from the network device's MAC address ++ ** (ifconfig) when it makes sense only */ ++ u8 dev_addr[MAX_ADDR_LEN]; ++ u8 bssid[ETH_ALEN]; /* the BSSID after having joined */ ++ u8 ap[ETH_ALEN]; /* The AP we want, FF:FF:FF:FF:FF:FF is any */ ++ u16 aid; /* The Association ID sent from the AP / last used AID if we're an AP */ ++ u16 mode; /* mode from iwconfig */ ++ int monitor_type; /* ARPHRD_IEEE80211 or ARPHRD_IEEE80211_PRISM */ ++ u16 status; /* 802.11 association status */ ++ u8 essid_active; /* specific ESSID active, or select any? */ ++ u8 essid_len; /* to avoid dozens of strlen() */ ++ /* INCLUDES \0 termination for easy printf - but many places ++ ** simply want the string data memcpy'd plus a length indicator! ++ ** Keep that in mind... */ ++ char essid[IW_ESSID_MAX_SIZE+1]; ++ /* essid we are going to use for association, in case of "essid 'any'" ++ ** and in case of hidden ESSID (use configured ESSID then) */ ++ char essid_for_assoc[IW_ESSID_MAX_SIZE+1]; ++ char nick[IW_ESSID_MAX_SIZE+1]; /* see essid! */ ++ u8 channel; ++ u8 reg_dom_id; /* reg domain setting */ ++ u16 reg_dom_chanmask; ++ u16 auth_or_assoc_retries; ++ u16 scan_retries; ++ unsigned long scan_start; /* YES, jiffies is defined as "unsigned long" */ ++ ++ /* stations known to us (if we're an ap) */ ++ client_t sta_list[32]; /* tab is larger than list, so that */ ++ client_t *sta_hash_tab[64]; /* hash collisions are not likely */ ++ client_t *ap_client; /* this one is our AP (STA mode only) */ ++ ++ int dup_count; ++ int nondup_count; ++ unsigned long dup_msg_expiry; ++ u16 last_seq_ctrl; /* duplicate packet detection */ ++ ++ /* 802.11 power save mode */ ++ u8 ps_wakeup_cfg; ++ u8 ps_listen_interval; ++ u8 ps_options; ++ u8 ps_hangover_period; ++ u32 ps_enhanced_transition_time; ++ u32 ps_beacon_rx_time; ++ ++ /*** PHY settings ***/ ++ u8 fallback_threshold; ++ u8 stepup_threshold; ++ u16 rate_basic; ++ u16 rate_oper; ++ u16 rate_bcast; ++ u16 rate_bcast100; ++ u8 rate_auto; /* false if "iwconfig rate N" (WITHOUT 'auto'!) */ ++ u8 preamble_mode; /* 0 == Long Preamble, 1 == Short, 2 == Auto */ ++ u8 preamble_cur; ++ ++ u8 tx_disabled; ++ u8 tx_level_dbm; ++ /* u8 tx_level_val; */ ++ /* u8 tx_level_auto; whether to do automatic power adjustment */ ++ ++ unsigned long recalib_time_last_success; ++ unsigned long recalib_time_last_attempt; ++ int recalib_failure_count; ++ int recalib_msg_ratelimit; ++ int retry_errors_msg_ratelimit; ++ ++ unsigned long brange_time_last_state_change; /* time the power LED was last changed */ ++ u8 brange_last_state; /* last state of the LED */ ++ u8 brange_max_quality; /* maximum quality that equates to full speed */ ++ ++ u8 sensitivity; ++ u8 antenna; /* antenna settings */ ++ u8 ed_threshold; /* energy detect threshold */ ++ u8 cca; /* clear channel assessment */ ++ ++ u16 rts_threshold; ++ u16 frag_threshold; ++ u32 short_retry; ++ u32 long_retry; ++ u16 msdu_lifetime; ++ u16 listen_interval; /* given in units of beacon interval */ ++ u32 beacon_interval; ++ ++ u16 capabilities; ++ u8 rate_supported_len; ++ u8 rate_supported[13]; ++ ++ /*** Encryption settings (WEP) ***/ ++ u32 auth_alg; /* used in transmit_authen1 */ ++ u8 wep_enabled; ++ u8 wep_restricted; ++ u8 wep_current_index; ++ wep_key_t wep_keys[DOT11_MAX_DEFAULT_WEP_KEYS]; /* the default WEP keys */ ++ key_struct_t wep_key_struct[10]; ++ ++ /*** Unknown ***/ ++ u8 dtim_interval; ++ ++#ifdef ACX_MEM ++ u32 acx_txbuf_start; ++ int acx_txbuf_numblocks; ++ u32 acx_txbuf_free; /* addr of head of free list */ ++ int acx_txbuf_blocks_free; /* how many are still open */ ++ queueindicator_t *acx_queue_indicator; ++#endif ++ ++ /*** Card Rx/Tx management ***/ ++ u16 rx_config_1; ++ u16 rx_config_2; ++ u16 memblocksize; ++ unsigned int tx_free; ++ unsigned int tx_head; /* keep as close as possible to Tx stuff below (cache line) */ ++ u16 phy_header_len; ++ ++/************************************************************************* ++ *** PCI/USB/... must be last or else hw agnostic code breaks horribly *** ++ *************************************************************************/ ++ ++ /* hack to let common code compile. FIXME */ ++ dma_addr_t rxhostdesc_startphy; ++ ++ /*** PCI stuff ***/ ++#if defined(ACX_PCI) || defined(ACX_MEM) ++ /* pointers to tx buffers, tx host descriptors (in host memory) ++ ** and tx descs in device memory */ ++ unsigned int tx_tail; ++ u8 *txbuf_start; ++ txhostdesc_t *txhostdesc_start; ++ txdesc_t *txdesc_start; /* points to PCI-mapped memory */ ++ dma_addr_t txbuf_startphy; ++ dma_addr_t txhostdesc_startphy; ++ /* sizes of above host memory areas */ ++ unsigned int txbuf_area_size; ++ unsigned int txhostdesc_area_size; ++ ++ unsigned int txdesc_size; /* size of txdesc; ACX111 = ACX100 + 4 */ ++ client_t *txc[TX_CNT]; ++ u16 txr[TX_CNT]; ++ ++ /* same for rx */ ++ unsigned int rx_tail; ++ rxbuffer_t *rxbuf_start; ++ rxhostdesc_t *rxhostdesc_start; ++ rxdesc_t *rxdesc_start; ++ /* physical addresses of above host memory areas */ ++ dma_addr_t rxbuf_startphy; ++ /* dma_addr_t rxhostdesc_startphy; */ ++ unsigned int rxbuf_area_size; ++ unsigned int rxhostdesc_area_size; ++ ++ u8 need_radio_fw; ++ u8 irqs_active; /* whether irq sending is activated */ ++ ++ const u16 *io; /* points to ACX100 or ACX111 PCI I/O register address set */ ++ ++#ifdef ACX_PCI ++ struct pci_dev *pdev; ++#endif ++#ifdef ACX_MEM ++ struct device *dev; ++#endif ++ ++#ifdef ACX_PCI ++ unsigned long membase; ++#endif ++#ifdef ACX_MEM ++ volatile u32 *membase; ++#endif ++ unsigned long membase2; ++#ifdef ACX_PCI ++ void __iomem *iobase; ++#endif ++#ifdef ACX_MEM ++ volatile u32 *iobase; ++#endif ++ void __iomem *iobase2; ++ /* command interface */ ++ u8 __iomem *cmd_area; ++ u8 __iomem *info_area; ++ ++ u16 irq_mask; /* interrupt types to mask out (not wanted) with many IRQs activated */ ++ u16 irq_mask_off; /* interrupt types to mask out (not wanted) with IRQs off */ ++ unsigned int irq_loops_this_jiffy; ++ unsigned long irq_last_jiffies; ++#endif ++ ++ /*** USB stuff ***/ ++#ifdef ACX_USB ++ struct usb_device *usbdev; ++ ++ rxbuffer_t rxtruncbuf; ++ ++ usb_tx_t *usb_tx; ++ usb_rx_t *usb_rx; ++ ++ int bulkinep; /* bulk-in endpoint */ ++ int bulkoutep; /* bulk-out endpoint */ ++ int rxtruncsize; ++#endif ++ ++}; ++ ++static inline acx_device_t* ++ndev2adev(struct net_device *ndev) ++{ ++ return netdev_priv(ndev); ++} ++ ++ ++/* For use with ACX1xx_IE_RXCONFIG */ ++/* bit description ++ * 13 include additional header (length etc.) *required* ++ * struct is defined in 'struct rxbuffer' ++ * is this bit acx100 only? does acx111 always put the header, ++ * and bit setting is irrelevant? --vda ++ * 10 receive frames only with SSID used in last join cmd ++ * 9 discard broadcast ++ * 8 receive packets for multicast address 1 ++ * 7 receive packets for multicast address 0 ++ * 6 discard all multicast packets ++ * 5 discard frames from foreign BSSID ++ * 4 discard frames with foreign destination MAC address ++ * 3 promiscuous mode (receive ALL frames, disable filter) ++ * 2 include FCS ++ * 1 include phy header ++ * 0 ??? ++ */ ++#define RX_CFG1_INCLUDE_RXBUF_HDR 0x2000 /* ACX100 only */ ++#define RX_CFG1_FILTER_SSID 0x0400 ++#define RX_CFG1_FILTER_BCAST 0x0200 ++#define RX_CFG1_RCV_MC_ADDR1 0x0100 ++#define RX_CFG1_RCV_MC_ADDR0 0x0080 ++#define RX_CFG1_FILTER_ALL_MULTI 0x0040 ++#define RX_CFG1_FILTER_BSSID 0x0020 ++#define RX_CFG1_FILTER_MAC 0x0010 ++#define RX_CFG1_RCV_PROMISCUOUS 0x0008 ++#define RX_CFG1_INCLUDE_FCS 0x0004 ++#define RX_CFG1_INCLUDE_PHY_HDR (WANT_PHY_HDR ? 0x0002 : 0) ++/* bit description ++ * 11 receive association requests etc. ++ * 10 receive authentication frames ++ * 9 receive beacon frames ++ * 8 receive contention free packets ++ * 7 receive control frames ++ * 6 receive data frames ++ * 5 receive broken frames ++ * 4 receive management frames ++ * 3 receive probe requests ++ * 2 receive probe responses ++ * 1 receive RTS/CTS/ACK frames ++ * 0 receive other ++ */ ++#define RX_CFG2_RCV_ASSOC_REQ 0x0800 ++#define RX_CFG2_RCV_AUTH_FRAMES 0x0400 ++#define RX_CFG2_RCV_BEACON_FRAMES 0x0200 ++#define RX_CFG2_RCV_CONTENTION_FREE 0x0100 ++#define RX_CFG2_RCV_CTRL_FRAMES 0x0080 ++#define RX_CFG2_RCV_DATA_FRAMES 0x0040 ++#define RX_CFG2_RCV_BROKEN_FRAMES 0x0020 ++#define RX_CFG2_RCV_MGMT_FRAMES 0x0010 ++#define RX_CFG2_RCV_PROBE_REQ 0x0008 ++#define RX_CFG2_RCV_PROBE_RESP 0x0004 ++#define RX_CFG2_RCV_ACK_FRAMES 0x0002 ++#define RX_CFG2_RCV_OTHER 0x0001 ++ ++/* For use with ACX1xx_IE_FEATURE_CONFIG */ ++#define FEATURE1_80MHZ_CLOCK 0x00000040L ++#define FEATURE1_4X 0x00000020L ++#define FEATURE1_LOW_RX 0x00000008L ++#define FEATURE1_EXTRA_LOW_RX 0x00000001L ++ ++#define FEATURE2_SNIFFER 0x00000080L ++#define FEATURE2_NO_TXCRYPT 0x00000001L ++ ++/*-- get and set mask values --*/ ++#define GETSET_LED_POWER 0x00000001L ++#define GETSET_STATION_ID 0x00000002L ++#define SET_TEMPLATES 0x00000004L ++#define SET_STA_LIST 0x00000008L ++#define GETSET_TX 0x00000010L ++#define GETSET_RX 0x00000020L ++#define SET_RXCONFIG 0x00000040L ++#define GETSET_ANTENNA 0x00000080L ++#define GETSET_SENSITIVITY 0x00000100L ++#define GETSET_TXPOWER 0x00000200L ++#define GETSET_ED_THRESH 0x00000400L ++#define GETSET_CCA 0x00000800L ++#define GETSET_POWER_80211 0x00001000L ++#define GETSET_RETRY 0x00002000L ++#define GETSET_REG_DOMAIN 0x00004000L ++#define GETSET_CHANNEL 0x00008000L ++/* Used when ESSID changes etc and we need to scan for AP anew */ ++#define GETSET_RESCAN 0x00010000L ++#define GETSET_MODE 0x00020000L ++#define GETSET_WEP 0x00040000L ++#define SET_WEP_OPTIONS 0x00080000L ++#define SET_MSDU_LIFETIME 0x00100000L ++#define SET_RATE_FALLBACK 0x00200000L ++ ++/* keep in sync with the above */ ++#define GETSET_ALL (0 \ ++/* GETSET_LED_POWER */ | 0x00000001L \ ++/* GETSET_STATION_ID */ | 0x00000002L \ ++/* SET_TEMPLATES */ | 0x00000004L \ ++/* SET_STA_LIST */ | 0x00000008L \ ++/* GETSET_TX */ | 0x00000010L \ ++/* GETSET_RX */ | 0x00000020L \ ++/* SET_RXCONFIG */ | 0x00000040L \ ++/* GETSET_ANTENNA */ | 0x00000080L \ ++/* GETSET_SENSITIVITY */| 0x00000100L \ ++/* GETSET_TXPOWER */ | 0x00000200L \ ++/* GETSET_ED_THRESH */ | 0x00000400L \ ++/* GETSET_CCA */ | 0x00000800L \ ++/* GETSET_POWER_80211 */| 0x00001000L \ ++/* GETSET_RETRY */ | 0x00002000L \ ++/* GETSET_REG_DOMAIN */ | 0x00004000L \ ++/* GETSET_CHANNEL */ | 0x00008000L \ ++/* GETSET_RESCAN */ | 0x00010000L \ ++/* GETSET_MODE */ | 0x00020000L \ ++/* GETSET_WEP */ | 0x00040000L \ ++/* SET_WEP_OPTIONS */ | 0x00080000L \ ++/* SET_MSDU_LIFETIME */ | 0x00100000L \ ++/* SET_RATE_FALLBACK */ | 0x00200000L \ ++ ) ++ ++ ++/*********************************************************************** ++** Firmware loading ++*/ ++#include <linux/firmware.h> /* request_firmware() */ ++#include <linux/pci.h> /* struct pci_device */ ++ ++ ++/*********************************************************************** ++*/ ++typedef struct acx100_ie_memblocksize { ++ u16 type; ++ u16 len; ++ u16 size; ++} ACX_PACKED acx100_ie_memblocksize_t; ++ ++typedef struct acx100_ie_queueconfig { ++ u16 type; ++ u16 len; ++ u32 AreaSize; ++ u32 RxQueueStart; ++ u8 QueueOptions; ++ u8 NumTxQueues; ++ u8 NumRxDesc; /* for USB only */ ++ u8 pad1; ++ u32 QueueEnd; ++ u32 HostQueueEnd; /* QueueEnd2 */ ++ u32 TxQueueStart; ++ u8 TxQueuePri; ++ u8 NumTxDesc; ++ u16 pad2; ++} ACX_PACKED acx100_ie_queueconfig_t; ++ ++typedef struct acx111_ie_queueconfig { ++ u16 type; ++ u16 len; ++ u32 tx_memory_block_address; ++ u32 rx_memory_block_address; ++ u32 rx1_queue_address; ++ u32 reserved1; ++ u32 tx1_queue_address; ++ u8 tx1_attributes; ++ u16 reserved2; ++ u8 reserved3; ++} ACX_PACKED acx111_ie_queueconfig_t; ++ ++typedef struct acx100_ie_memconfigoption { ++ u16 type; ++ u16 len; ++ u32 DMA_config; ++ acx_ptr pRxHostDesc; ++ u32 rx_mem; ++ u32 tx_mem; ++ u16 RxBlockNum; ++ u16 TxBlockNum; ++} ACX_PACKED acx100_ie_memconfigoption_t; ++ ++typedef struct acx111_ie_memoryconfig { ++ u16 type; ++ u16 len; ++ u16 no_of_stations; ++ u16 memory_block_size; ++ u8 tx_rx_memory_block_allocation; ++ u8 count_rx_queues; ++ u8 count_tx_queues; ++ u8 options; ++ u8 fragmentation; ++ u16 reserved1; ++ u8 reserved2; ++ ++ /* start of rx1 block */ ++ u8 rx_queue1_count_descs; ++ u8 rx_queue1_reserved1; ++ u8 rx_queue1_type; /* must be set to 7 */ ++ u8 rx_queue1_prio; /* must be set to 0 */ ++ acx_ptr rx_queue1_host_rx_start; ++ /* end of rx1 block */ ++ ++ /* start of tx1 block */ ++ u8 tx_queue1_count_descs; ++ u8 tx_queue1_reserved1; ++ u8 tx_queue1_reserved2; ++ u8 tx_queue1_attributes; ++ /* end of tx1 block */ ++} ACX_PACKED acx111_ie_memoryconfig_t; ++ ++typedef struct acx_ie_memmap { ++ u16 type; ++ u16 len; ++ u32 CodeStart; ++ u32 CodeEnd; ++ u32 WEPCacheStart; ++ u32 WEPCacheEnd; ++ u32 PacketTemplateStart; ++ u32 PacketTemplateEnd; ++ u32 QueueStart; ++ u32 QueueEnd; ++ u32 PoolStart; ++ u32 PoolEnd; ++} ACX_PACKED acx_ie_memmap_t; ++ ++typedef struct acx111_ie_feature_config { ++ u16 type; ++ u16 len; ++ u32 feature_options; ++ u32 data_flow_options; ++} ACX_PACKED acx111_ie_feature_config_t; ++ ++typedef struct acx111_ie_tx_level { ++ u16 type; ++ u16 len; ++ u8 level; ++} ACX_PACKED acx111_ie_tx_level_t; ++ ++#define PS_CFG_ENABLE 0x80 ++#define PS_CFG_PENDING 0x40 /* status flag when entering PS */ ++#define PS_CFG_WAKEUP_MODE_MASK 0x07 ++#define PS_CFG_WAKEUP_BY_HOST 0x03 ++#define PS_CFG_WAKEUP_EACH_ITVL 0x02 ++#define PS_CFG_WAKEUP_ON_DTIM 0x01 ++#define PS_CFG_WAKEUP_ALL_BEAC 0x00 ++ ++/* Enhanced PS mode: sleep until Rx Beacon w/ the STA's AID bit set ++** in the TIM; newer firmwares only(?) */ ++#define PS_OPT_ENA_ENHANCED_PS 0x04 ++#define PS_OPT_TX_PSPOLL 0x02 /* send PSPoll frame to fetch waiting frames from AP (on frame with matching AID) */ ++#define PS_OPT_STILL_RCV_BCASTS 0x01 ++ ++typedef struct acx100_ie_powersave { ++ u16 type; ++ u16 len; ++ u8 wakeup_cfg; ++ u8 listen_interval; /* for EACH_ITVL: wake up every "beacon units" interval */ ++ u8 options; ++ u8 hangover_period; /* remaining wake time after Tx MPDU w/ PS bit, in values of 1/1024 seconds */ ++ u16 enhanced_ps_transition_time; /* rem. wake time for Enh. PS */ ++} ACX_PACKED acx100_ie_powersave_t; ++ ++typedef struct acx111_ie_powersave { ++ u16 type; ++ u16 len; ++ u8 wakeup_cfg; ++ u8 listen_interval; /* for EACH_ITVL: wake up every "beacon units" interval */ ++ u8 options; ++ u8 hangover_period; /* remaining wake time after Tx MPDU w/ PS bit, in values of 1/1024 seconds */ ++ u32 beacon_rx_time; ++ u32 enhanced_ps_transition_time; /* rem. wake time for Enh. PS */ ++} ACX_PACKED acx111_ie_powersave_t; ++ ++ ++/*********************************************************************** ++** Commands and template structures ++*/ ++ ++/* ++** SCAN command structure ++** ++** even though acx100 scan rates match RATE100 constants, ++** acx111 ones do not match! Therefore we do not use RATE100 #defines */ ++#define ACX_SCAN_RATE_1 10 ++#define ACX_SCAN_RATE_2 20 ++#define ACX_SCAN_RATE_5 55 ++#define ACX_SCAN_RATE_11 110 ++#define ACX_SCAN_RATE_22 220 ++#define ACX_SCAN_RATE_PBCC 0x80 /* OR with this if needed */ ++#define ACX_SCAN_OPT_ACTIVE 0x00 /* a bit mask */ ++#define ACX_SCAN_OPT_PASSIVE 0x01 ++/* Background scan: we go into Power Save mode (by transmitting ++** NULL data frame to AP with the power mgmt bit set), do the scan, ++** and then exit Power Save mode. A plus is that AP buffers frames ++** for us while we do background scan. Thus we avoid frame losses. ++** Background scan can be active or passive, just like normal one */ ++#define ACX_SCAN_OPT_BACKGROUND 0x02 ++typedef struct acx100_scan { ++ u16 count; /* number of scans to do, 0xffff == continuous */ ++ u16 start_chan; ++ u16 flags; /* channel list mask; 0x8000 == all channels? */ ++ u8 max_rate; /* max. probe rate */ ++ u8 options; /* bit mask, see defines above */ ++ u16 chan_duration; ++ u16 max_probe_delay; ++} ACX_PACKED acx100_scan_t; /* length 0xc */ ++ ++#define ACX111_SCAN_RATE_6 0x0B ++#define ACX111_SCAN_RATE_9 0x0F ++#define ACX111_SCAN_RATE_12 0x0A ++#define ACX111_SCAN_RATE_18 0x0E ++#define ACX111_SCAN_RATE_24 0x09 ++#define ACX111_SCAN_RATE_36 0x0D ++#define ACX111_SCAN_RATE_48 0x08 ++#define ACX111_SCAN_RATE_54 0x0C ++#define ACX111_SCAN_OPT_5GHZ 0x04 /* else 2.4GHZ */ ++#define ACX111_SCAN_MOD_SHORTPRE 0x01 /* you can combine SHORTPRE and PBCC */ ++#define ACX111_SCAN_MOD_PBCC 0x80 ++#define ACX111_SCAN_MOD_OFDM 0x40 ++typedef struct acx111_scan { ++ u16 count; /* number of scans to do */ ++ u8 channel_list_select; /* 0: scan all channels, 1: from chan_list only */ ++ u16 reserved1; ++ u8 reserved2; ++ u8 rate; /* rate for probe requests (if active scan) */ ++ u8 options; /* bit mask, see defines above */ ++ u16 chan_duration; /* min time to wait for reply on one channel (in TU) */ ++ /* (active scan only) (802.11 section 11.1.3.2.2) */ ++ u16 max_probe_delay; /* max time to wait for reply on one channel (active scan) */ ++ /* time to listen on a channel (passive scan) */ ++ u8 modulation; ++ u8 channel_list[26]; /* bits 7:0 first byte: channels 8:1 */ ++ /* bits 7:0 second byte: channels 16:9 */ ++ /* 26 bytes is enough to cover 802.11a */ ++} ACX_PACKED acx111_scan_t; ++ ++ ++/* ++** Radio calibration command structure ++*/ ++typedef struct acx111_cmd_radiocalib { ++/* 0x80000000 == automatic calibration by firmware, according to interval; ++ * bits 0..3: select calibration methods to go through: ++ * calib based on DC, AfeDC, Tx mismatch, Tx equilization */ ++ u32 methods; ++ u32 interval; ++} ACX_PACKED acx111_cmd_radiocalib_t; ++ ++ ++/* ++** Packet template structures ++** ++** Packet templates store contents of Beacon, Probe response, Probe request, ++** Null data frame, and TIM data frame. Firmware automatically transmits ++** contents of template at appropriate time: ++** - Beacon: when configured as AP or Ad-hoc ++** - Probe response: when configured as AP or Ad-hoc, whenever ++** a Probe request frame is received ++** - Probe request: when host issues SCAN command (active) ++** - Null data frame: when entering 802.11 power save mode ++** - TIM data: at the end of Beacon frames (if no TIM template ++** is configured, then transmits default TIM) ++** NB: ++** - size field must be set to size of actual template ++** (NOT sizeof(struct) - templates are variable in length), ++** size field is not itself counted. ++** - members flagged with an asterisk must be initialized with host, ++** rest must be zero filled. ++** - variable length fields shown only in comments */ ++typedef struct acx_template_tim { ++ u16 size; ++ u8 tim_eid; /* 00 1 TIM IE ID * */ ++ u8 len; /* 01 1 Length * */ ++ u8 dtim_cnt; /* 02 1 DTIM Count */ ++ u8 dtim_period; /* 03 1 DTIM Period */ ++ u8 bitmap_ctrl; /* 04 1 Bitmap Control * (except bit0) */ ++ /* 05 n Partial Virtual Bitmap * */ ++ u8 variable[0x100 - 1-1-1-1-1]; ++} ACX_PACKED acx_template_tim_t; ++ ++typedef struct acx_template_probereq { ++ u16 size; ++ u16 fc; /* 00 2 fc * */ ++ u16 dur; /* 02 2 Duration */ ++ u8 da[6]; /* 04 6 Destination Address * */ ++ u8 sa[6]; /* 0A 6 Source Address * */ ++ u8 bssid[6]; /* 10 6 BSSID * */ ++ u16 seq; /* 16 2 Sequence Control */ ++ /* 18 n SSID * */ ++ /* nn n Supported Rates * */ ++ u8 variable[0x44 - 2-2-6-6-6-2]; ++} ACX_PACKED acx_template_probereq_t; ++ ++typedef struct acx_template_proberesp { ++ u16 size; ++ u16 fc; /* 00 2 fc * (bits [15:12] and [10:8] per 802.11 section 7.1.3.1) */ ++ u16 dur; /* 02 2 Duration */ ++ u8 da[6]; /* 04 6 Destination Address */ ++ u8 sa[6]; /* 0A 6 Source Address */ ++ u8 bssid[6]; /* 10 6 BSSID */ ++ u16 seq; /* 16 2 Sequence Control */ ++ u8 timestamp[8];/* 18 8 Timestamp */ ++ u16 beacon_interval; /* 20 2 Beacon Interval * */ ++ u16 cap; /* 22 2 Capability Information * */ ++ /* 24 n SSID * */ ++ /* nn n Supported Rates * */ ++ /* nn 1 DS Parameter Set * */ ++ u8 variable[0x54 - 2-2-6-6-6-2-8-2-2]; ++} ACX_PACKED acx_template_proberesp_t; ++#define acx_template_beacon_t acx_template_proberesp_t ++#define acx_template_beacon acx_template_proberesp ++ ++typedef struct acx_template_nullframe { ++ u16 size; ++ struct wlan_hdr_a3 hdr; ++} ACX_PACKED acx_template_nullframe_t; ++ ++ ++/* ++** JOIN command structure ++** ++** as opposed to acx100, acx111 dtim interval is AFTER rates_basic111. ++** NOTE: took me about an hour to get !@#$%^& packing right --> struct packing is eeeeevil... */ ++typedef struct acx_joinbss { ++ u8 bssid[ETH_ALEN]; ++ u16 beacon_interval; ++ union { ++ struct { ++ u8 dtim_interval; ++ u8 rates_basic; ++ u8 rates_supported; ++ /* ++ * ARM compiler doesn't pack correctly unless unions ++ * inside structures are multiples of 4 bytes. Ugh. ++ */ ++ u8 genfrm_txrate; /* generated frame (bcn, proberesp, RTS, PSpoll) tx rate */ ++ } ACX_PACKED acx100; ++ struct { ++ u16 rates_basic; ++ u8 dtim_interval; ++ u8 genfrm_txrate; /* generated frame (bcn, proberesp, RTS, PSpoll) tx rate */ ++ } ACX_PACKED acx111; ++ /* ++ * ARM compiler doesn't pack correctly unles unions are aligned on ++ * 4 byte boundaries and are multiples of 4 bytes. ++ */ ++ struct { ++ u8 d1; ++ u8 d2; ++ u8 d3; ++ u8 genfrm_txrate; ++ } ACX_PACKED txrate; ++ } ACX_PACKED u; ++ u8 genfrm_mod_pre; /* generated frame modulation/preamble: ++ ** bit7: PBCC, bit6: OFDM (else CCK/DQPSK/DBPSK) ++ ** bit5: short pre */ ++ u8 macmode; /* BSS Type, must be one of ACX_MODE_xxx */ ++ u8 channel; ++ u8 essid_len; ++ char essid[IW_ESSID_MAX_SIZE]; ++} ACX_PACKED acx_joinbss_t; ++ ++#define JOINBSS_RATES_1 0x01 ++#define JOINBSS_RATES_2 0x02 ++#define JOINBSS_RATES_5 0x04 ++#define JOINBSS_RATES_11 0x08 ++#define JOINBSS_RATES_22 0x10 ++ ++/* Looks like missing bits are used to indicate 11g rates! ++** (it follows from the fact that constants below match 1:1 to RATE111_nn) ++** This was actually seen! Look at that Assoc Request sent by acx111, ++** it _does_ contain 11g rates in basic set: ++01:30:20.070772 Beacon (xxx) [1.0* 2.0* 5.5* 11.0* 6.0* 9.0* 12.0* 18.0* 24.0* 36.0* 48.0* 54.0* Mbit] ESS CH: 1 ++01:30:20.074425 Authentication (Open System)-1: Succesful ++01:30:20.076539 Authentication (Open System)-2: ++01:30:20.076620 Acknowledgment ++01:30:20.088546 Assoc Request (xxx) [1.0* 2.0* 5.5* 6.0* 9.0* 11.0* 12.0* 18.0* 24.0* 36.0* 48.0* 54.0* Mbit] ++01:30:20.122413 Assoc Response AID(1) :: Succesful ++01:30:20.122679 Acknowledgment ++01:30:20.173204 Beacon (xxx) [1.0* 2.0* 5.5* 11.0* 6.0* 9.0* 12.0* 18.0* 24.0* 36.0* 48.0* 54.0* Mbit] ESS CH: 1 ++*/ ++#define JOINBSS_RATES_BASIC111_1 0x0001 ++#define JOINBSS_RATES_BASIC111_2 0x0002 ++#define JOINBSS_RATES_BASIC111_5 0x0004 ++#define JOINBSS_RATES_BASIC111_11 0x0020 ++#define JOINBSS_RATES_BASIC111_22 0x0100 ++ ++ ++/*********************************************************************** ++*/ ++typedef struct mem_read_write { ++ u16 addr; ++ u16 type; /* 0x0 int. RAM / 0xffff MAC reg. / 0x81 PHY RAM / 0x82 PHY reg.; or maybe it's actually 0x30 for MAC? Better verify it by writing and reading back and checking whether the value holds! */ ++ u32 len; ++ u32 data; ++} ACX_PACKED mem_read_write_t; ++ ++typedef struct firmware_image { ++ u32 chksum; ++ u32 size; ++ u8 data[1]; /* the byte array of the actual firmware... */ ++} ACX_PACKED firmware_image_t; ++ ++typedef struct acx_cmd_radioinit { ++ u32 offset; ++ u32 len; ++} ACX_PACKED acx_cmd_radioinit_t; ++ ++typedef struct acx100_ie_wep_options { ++ u16 type; ++ u16 len; ++ u16 NumKeys; /* max # of keys */ ++ u8 WEPOption; /* 0 == decrypt default key only, 1 == override decrypt */ ++ u8 Pad; /* used only for acx111 */ ++} ACX_PACKED acx100_ie_wep_options_t; ++ ++typedef struct ie_dot11WEPDefaultKey { ++ u16 type; ++ u16 len; ++ u8 action; ++ u8 keySize; ++ u8 defaultKeyNum; ++ u8 key[29]; /* check this! was Key[19] */ ++} ACX_PACKED ie_dot11WEPDefaultKey_t; ++ ++typedef struct acx111WEPDefaultKey { ++ u8 MacAddr[ETH_ALEN]; ++ u16 action; /* NOTE: this is a u16, NOT a u8!! */ ++ u16 reserved; ++ u8 keySize; ++ u8 type; ++ u8 index; ++ u8 defaultKeyNum; ++ u8 counter[6]; ++ u8 key[32]; /* up to 32 bytes (for TKIP!) */ ++} ACX_PACKED acx111WEPDefaultKey_t; ++ ++typedef struct ie_dot11WEPDefaultKeyID { ++ u16 type; ++ u16 len; ++ u8 KeyID; ++} ACX_PACKED ie_dot11WEPDefaultKeyID_t; ++ ++typedef struct acx100_cmd_wep_mgmt { ++ u8 MacAddr[ETH_ALEN]; ++ u16 Action; ++ u16 KeySize; ++ u8 Key[29]; /* 29*8 == 232bits == WEP256 */ ++} ACX_PACKED acx100_cmd_wep_mgmt_t; ++ ++typedef struct acx_ie_generic { ++ u16 type; ++ u16 len; ++ union { ++ /* Association ID IE: just a 16bit value: */ ++ u16 aid; ++ /* generic member for quick implementation of commands */ ++ u8 bytes[32]; ++ } ACX_PACKED m; ++} ACX_PACKED acx_ie_generic_t; ++ ++/*********************************************************************** ++*/ ++#define CHECK_SIZEOF(type,size) { \ ++ extern void BUG_bad_size_for_##type(void); \ ++ if (sizeof(type)!=(size)) BUG_bad_size_for_##type(); \ ++} ++ ++static inline void ++acx_struct_size_check(void) ++{ ++ CHECK_SIZEOF(txdesc_t, 0x30); ++ CHECK_SIZEOF(acx100_ie_memconfigoption_t, 24); ++ CHECK_SIZEOF(acx100_ie_queueconfig_t, 0x20); ++ CHECK_SIZEOF(acx_joinbss_t, 0x30); ++ /* IEs need 4 bytes for (type,len) tuple */ ++ CHECK_SIZEOF(acx111_ie_configoption_t, ACX111_IE_CONFIG_OPTIONS_LEN + 4); ++} ++ ++ ++/*********************************************************************** ++** Global data ++*/ ++extern const u8 acx_bitpos2ratebyte[]; ++extern const u8 acx_bitpos2rate100[]; ++ ++extern const u8 acx_reg_domain_ids[]; ++extern const char * const acx_reg_domain_strings[]; ++enum { ++ acx_reg_domain_ids_len = 8 ++}; ++ ++extern const struct iw_handler_def acx_ioctl_handler_def; +Index: linux-2.6.22/drivers/net/wireless/acx/common.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/common.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,7388 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++*/ ++ ++#include <linux/version.h> ++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) ++#include <linux/config.h> ++#endif ++#include <linux/module.h> ++#include <linux/kernel.h> ++#include <linux/sched.h> ++#include <linux/types.h> ++#include <linux/slab.h> ++#include <linux/delay.h> ++#include <linux/proc_fs.h> ++#include <linux/if_arp.h> ++#include <linux/rtnetlink.h> ++#include <linux/netdevice.h> ++#include <linux/etherdevice.h> ++#include <linux/wireless.h> ++#include <linux/pm.h> ++#include <linux/vmalloc.h> ++#include <net/iw_handler.h> ++ ++#include "acx_hw.h" ++#include "acx.h" ++ ++ ++/*********************************************************************** ++*/ ++static client_t *acx_l_sta_list_alloc(acx_device_t *adev); ++static client_t *acx_l_sta_list_get_from_hash(acx_device_t *adev, const u8 *address); ++ ++static int acx_l_process_data_frame_master(acx_device_t *adev, rxbuffer_t *rxbuf); ++static int acx_l_process_data_frame_client(acx_device_t *adev, rxbuffer_t *rxbuf); ++/* static int acx_l_process_NULL_frame(acx_device_t *adev, rxbuffer_t *rxbuf, int vala); */ ++static int acx_l_process_mgmt_frame(acx_device_t *adev, rxbuffer_t *rxbuf); ++static void acx_l_process_disassoc_from_sta(acx_device_t *adev, const wlan_fr_disassoc_t *req); ++static void acx_l_process_disassoc_from_ap(acx_device_t *adev, const wlan_fr_disassoc_t *req); ++static void acx_l_process_deauth_from_sta(acx_device_t *adev, const wlan_fr_deauthen_t *req); ++static void acx_l_process_deauth_from_ap(acx_device_t *adev, const wlan_fr_deauthen_t *req); ++static int acx_l_process_probe_response(acx_device_t *adev, wlan_fr_proberesp_t *req, const rxbuffer_t *rxbuf); ++static int acx_l_process_assocresp(acx_device_t *adev, const wlan_fr_assocresp_t *req); ++static int acx_l_process_reassocresp(acx_device_t *adev, const wlan_fr_reassocresp_t *req); ++static int acx_l_process_authen(acx_device_t *adev, const wlan_fr_authen_t *req); ++static int acx_l_transmit_assocresp(acx_device_t *adev, const wlan_fr_assocreq_t *req); ++static int acx_l_transmit_reassocresp(acx_device_t *adev, const wlan_fr_reassocreq_t *req); ++static int acx_l_transmit_deauthen(acx_device_t *adev, const u8 *addr, u16 reason); ++static int acx_l_transmit_authen1(acx_device_t *adev); ++static int acx_l_transmit_authen2(acx_device_t *adev, const wlan_fr_authen_t *req, client_t *clt); ++static int acx_l_transmit_authen3(acx_device_t *adev, const wlan_fr_authen_t *req); ++static int acx_l_transmit_authen4(acx_device_t *adev, const wlan_fr_authen_t *req); ++static int acx_l_transmit_assoc_req(acx_device_t *adev); ++ ++ ++/*********************************************************************** ++*/ ++#if ACX_DEBUG ++unsigned int acx_debug /* will add __read_mostly later */ = ACX_DEFAULT_MSG; ++/* parameter is 'debug', corresponding var is acx_debug */ ++module_param_named(debug, acx_debug, uint, 0); ++MODULE_PARM_DESC(debug, "Debug level mask (see L_xxx constants)"); ++#endif ++ ++#ifdef MODULE_LICENSE ++MODULE_LICENSE("Dual MPL/GPL"); ++#endif ++/* USB had this: MODULE_AUTHOR("Martin Wawro <martin.wawro AT uni-dortmund.de>"); */ ++MODULE_AUTHOR("ACX100 Open Source Driver development team"); ++MODULE_DESCRIPTION("Driver for TI ACX1xx based wireless cards (CardBus/PCI/USB)"); ++ ++ ++/*********************************************************************** ++*/ ++/* Probably a number of acx's intermediate buffers for USB transfers, ++** not to be confused with number of descriptors in tx/rx rings ++** (which are not directly accessible to host in USB devices) */ ++#define USB_RX_CNT 10 ++#define USB_TX_CNT 10 ++ ++ ++/*********************************************************************** ++*/ ++ ++/* minutes to wait until next radio recalibration: */ ++#define RECALIB_PAUSE 5 ++ ++/* Please keep acx_reg_domain_ids_len in sync... */ ++const u8 acx_reg_domain_ids[acx_reg_domain_ids_len] = ++ { 0x10, 0x20, 0x30, 0x31, 0x32, 0x40, 0x41, 0x51 }; ++static const u16 reg_domain_channel_masks[acx_reg_domain_ids_len] = ++#ifdef ACX_ALLOW_ALLCHANNELS ++ { 0x3fff, 0x07ff, 0x1fff, 0x0600, 0x1e00, 0x2000, 0x3fff, 0x01fc }; ++#else ++ { 0x07ff, 0x07ff, 0x1fff, 0x0600, 0x1e00, 0x2000, 0x3fff, 0x01fc }; ++#endif ++const char * const ++acx_reg_domain_strings[] = { ++ /* 0 */ " 1-11 FCC (USA)", ++ /* 1 */ " 1-11 DOC/IC (Canada)", ++/* BTW: WLAN use in ETSI is regulated by ETSI standard EN 300 328-2 V1.1.2 */ ++ /* 2 */ " 1-13 ETSI (Europe)", ++ /* 3 */ "10-11 Spain", ++ /* 4 */ "10-13 France", ++ /* 5 */ " 14 MKK (Japan)", ++ /* 6 */ " 1-14 MKK1", ++ /* 7 */ " 3-9 Israel (not all firmware versions)", ++ NULL /* needs to remain as last entry */ ++}; ++ ++ ++ ++/*********************************************************************** ++** Debugging support ++*/ ++#ifdef PARANOID_LOCKING ++static unsigned max_lock_time; ++static unsigned max_sem_time; ++ ++void ++acx_lock_unhold() { max_lock_time = 0; } ++void ++acx_sem_unhold() { max_sem_time = 0; } ++ ++static inline const char* ++sanitize_str(const char *s) ++{ ++ const char* t = strrchr(s, '/'); ++ if (t) return t + 1; ++ return s; ++} ++ ++void ++acx_lock_debug(acx_device_t *adev, const char* where) ++{ ++ unsigned int count = 100*1000*1000; ++ where = sanitize_str(where); ++ while (--count) { ++ if (!spin_is_locked(&adev->lock)) break; ++ cpu_relax(); ++ } ++ if (!count) { ++ printk(KERN_EMERG "LOCKUP: already taken at %s!\n", adev->last_lock); ++ BUG(); ++ } ++ adev->last_lock = where; ++ rdtscl(adev->lock_time); ++} ++void ++acx_unlock_debug(acx_device_t *adev, const char* where) ++{ ++#ifdef SMP ++ if (!spin_is_locked(&adev->lock)) { ++ where = sanitize_str(where); ++ printk(KERN_EMERG "STRAY UNLOCK at %s!\n", where); ++ BUG(); ++ } ++#endif ++ if (acx_debug & L_LOCK) { ++ unsigned long diff; ++ rdtscl(diff); ++ diff -= adev->lock_time; ++ if (diff > max_lock_time) { ++ where = sanitize_str(where); ++ printk("max lock hold time %ld CPU ticks from %s " ++ "to %s\n", diff, adev->last_lock, where); ++ max_lock_time = diff; ++ } ++ } ++} ++void ++acx_down_debug(acx_device_t *adev, const char* where) ++{ ++ int sem_count; ++ unsigned long timeout = jiffies + 5*HZ; ++ ++ where = sanitize_str(where); ++ ++ for (;;) { ++ sem_count = atomic_read(&adev->sem.count); ++ if (sem_count) break; ++ if (time_after(jiffies, timeout)) ++ break; ++ msleep(5); ++ } ++ if (!sem_count) { ++ printk(KERN_EMERG "D STATE at %s! last sem at %s\n", ++ where, adev->last_sem); ++ dump_stack(); ++ } ++ adev->last_sem = where; ++ adev->sem_time = jiffies; ++ down(&adev->sem); ++ if (acx_debug & L_LOCK) { ++ printk("%s: sem_down %d -> %d\n", ++ where, sem_count, atomic_read(&adev->sem.count)); ++ } ++} ++void ++acx_up_debug(acx_device_t *adev, const char* where) ++{ ++ int sem_count = atomic_read(&adev->sem.count); ++ if (sem_count) { ++ where = sanitize_str(where); ++ printk(KERN_EMERG "STRAY UP at %s! sem.count=%d\n", where, sem_count); ++ dump_stack(); ++ } ++ if (acx_debug & L_LOCK) { ++ unsigned long diff = jiffies - adev->sem_time; ++ if (diff > max_sem_time) { ++ where = sanitize_str(where); ++ printk("max sem hold time %ld jiffies from %s " ++ "to %s\n", diff, adev->last_sem, where); ++ max_sem_time = diff; ++ } ++ } ++ up(&adev->sem); ++ if (acx_debug & L_LOCK) { ++ where = sanitize_str(where); ++ printk("%s: sem_up %d -> %d\n", ++ where, sem_count, atomic_read(&adev->sem.count)); ++ } ++} ++#endif /* PARANOID_LOCKING */ ++ ++ ++/*********************************************************************** ++*/ ++#if ACX_DEBUG > 1 ++ ++static int acx_debug_func_indent; ++#define DEBUG_TSC 0 ++#define FUNC_INDENT_INCREMENT 2 ++ ++#if DEBUG_TSC ++#define TIMESTAMP(d) unsigned long d; rdtscl(d) ++#else ++#define TIMESTAMP(d) unsigned long d = jiffies ++#endif ++ ++static const char ++spaces[] = " " " "; /* Nx10 spaces */ ++ ++void ++log_fn_enter(const char *funcname) ++{ ++ int indent; ++ TIMESTAMP(d); ++ ++ indent = acx_debug_func_indent; ++ if (indent >= sizeof(spaces)) ++ indent = sizeof(spaces)-1; ++ ++ printk("%08ld %s==> %s\n", ++ d % 100000000, ++ spaces + (sizeof(spaces)-1) - indent, ++ funcname ++ ); ++ ++ acx_debug_func_indent += FUNC_INDENT_INCREMENT; ++} ++void ++log_fn_exit(const char *funcname) ++{ ++ int indent; ++ TIMESTAMP(d); ++ ++ acx_debug_func_indent -= FUNC_INDENT_INCREMENT; ++ ++ indent = acx_debug_func_indent; ++ if (indent >= sizeof(spaces)) ++ indent = sizeof(spaces)-1; ++ ++ printk("%08ld %s<== %s\n", ++ d % 100000000, ++ spaces + (sizeof(spaces)-1) - indent, ++ funcname ++ ); ++} ++void ++log_fn_exit_v(const char *funcname, int v) ++{ ++ int indent; ++ TIMESTAMP(d); ++ ++ acx_debug_func_indent -= FUNC_INDENT_INCREMENT; ++ ++ indent = acx_debug_func_indent; ++ if (indent >= sizeof(spaces)) ++ indent = sizeof(spaces)-1; ++ ++ printk("%08ld %s<== %s: %08X\n", ++ d % 100000000, ++ spaces + (sizeof(spaces)-1) - indent, ++ funcname, ++ v ++ ); ++} ++#endif /* ACX_DEBUG > 1 */ ++ ++ ++/*********************************************************************** ++** Basically a msleep with logging ++*/ ++void ++acx_s_msleep(int ms) ++{ ++ FN_ENTER; ++ msleep(ms); ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** Not inlined: it's larger than it seems ++*/ ++void ++acx_print_mac(const char *head, const u8 *mac, const char *tail) ++{ ++ printk("%s"MACSTR"%s", head, MAC(mac), tail); ++} ++ ++ ++/*********************************************************************** ++** acx_get_status_name ++*/ ++static const char* ++acx_get_status_name(u16 status) ++{ ++ static const char * const str[] = { ++ "STOPPED", "SCANNING", "WAIT_AUTH", ++ "AUTHENTICATED", "ASSOCIATED", "INVALID??" ++ }; ++ if (status > VEC_SIZE(str)-1) ++ status = VEC_SIZE(str)-1; ++ ++ return str[status]; ++} ++ ++ ++/*********************************************************************** ++** acx_get_packet_type_string ++*/ ++#if ACX_DEBUG ++const char* ++acx_get_packet_type_string(u16 fc) ++{ ++ static const char * const mgmt_arr[] = { ++ "MGMT/AssocReq", "MGMT/AssocResp", "MGMT/ReassocReq", ++ "MGMT/ReassocResp", "MGMT/ProbeReq", "MGMT/ProbeResp", ++ "MGMT/UNKNOWN", "MGMT/UNKNOWN", "MGMT/Beacon", "MGMT/ATIM", ++ "MGMT/Disassoc", "MGMT/Authen", "MGMT/Deauthen" ++ }; ++ static const char * const ctl_arr[] = { ++ "CTL/PSPoll", "CTL/RTS", "CTL/CTS", "CTL/Ack", "CTL/CFEnd", ++ "CTL/CFEndCFAck" ++ }; ++ static const char * const data_arr[] = { ++ "DATA/DataOnly", "DATA/Data CFAck", "DATA/Data CFPoll", ++ "DATA/Data CFAck/CFPoll", "DATA/Null", "DATA/CFAck", ++ "DATA/CFPoll", "DATA/CFAck/CFPoll" ++ }; ++ const char *str; ++ u8 fstype = (WF_FC_FSTYPE & fc) >> 4; ++ u8 ctl; ++ ++ switch (WF_FC_FTYPE & fc) { ++ case WF_FTYPE_MGMT: ++ if (fstype < VEC_SIZE(mgmt_arr)) ++ str = mgmt_arr[fstype]; ++ else ++ str = "MGMT/UNKNOWN"; ++ break; ++ case WF_FTYPE_CTL: ++ ctl = fstype - 0x0a; ++ if (ctl < VEC_SIZE(ctl_arr)) ++ str = ctl_arr[ctl]; ++ else ++ str = "CTL/UNKNOWN"; ++ break; ++ case WF_FTYPE_DATA: ++ if (fstype < VEC_SIZE(data_arr)) ++ str = data_arr[fstype]; ++ else ++ str = "DATA/UNKNOWN"; ++ break; ++ default: ++ str = "UNKNOWN"; ++ break; ++ } ++ return str; ++} ++#endif ++ ++ ++/*********************************************************************** ++** acx_wlan_reason_str ++*/ ++static inline const char* ++acx_wlan_reason_str(u16 reason) ++{ ++ static const char* const reason_str[] = { ++ /* 0 */ "?", ++ /* 1 */ "unspecified", ++ /* 2 */ "prev auth is not valid", ++ /* 3 */ "leaving BBS", ++ /* 4 */ "due to inactivity", ++ /* 5 */ "AP is busy", ++ /* 6 */ "got class 2 frame from non-auth'ed STA", ++ /* 7 */ "got class 3 frame from non-assoc'ed STA", ++ /* 8 */ "STA has left BSS", ++ /* 9 */ "assoc without auth is not allowed", ++ /* 10 */ "bad power setting (802.11h)", ++ /* 11 */ "bad channel (802.11i)", ++ /* 12 */ "?", ++ /* 13 */ "invalid IE", ++ /* 14 */ "MIC failure", ++ /* 15 */ "four-way handshake timeout", ++ /* 16 */ "group key handshake timeout", ++ /* 17 */ "IE is different", ++ /* 18 */ "invalid group cipher", ++ /* 19 */ "invalid pairwise cipher", ++ /* 20 */ "invalid AKMP", ++ /* 21 */ "unsupported RSN version", ++ /* 22 */ "invalid RSN IE cap", ++ /* 23 */ "802.1x failed", ++ /* 24 */ "cipher suite rejected" ++ }; ++ return reason < VEC_SIZE(reason_str) ? reason_str[reason] : "?"; ++} ++ ++ ++/*********************************************************************** ++** acx_cmd_status_str ++*/ ++const char* ++acx_cmd_status_str(unsigned int state) ++{ ++ static const char * const cmd_error_strings[] = { ++ "Idle", ++ "Success", ++ "Unknown Command", ++ "Invalid Information Element", ++ "Channel rejected", ++ "Channel invalid in current regulatory domain", ++ "MAC invalid", ++ "Command rejected (read-only information element)", ++ "Command rejected", ++ "Already asleep", ++ "TX in progress", ++ "Already awake", ++ "Write only", ++ "RX in progress", ++ "Invalid parameter", ++ "Scan in progress", ++ "Failed" ++ }; ++ return state < VEC_SIZE(cmd_error_strings) ? ++ cmd_error_strings[state] : "?"; ++} ++ ++ ++/*********************************************************************** ++** get_status_string ++*/ ++static inline const char* ++get_status_string(unsigned int status) ++{ ++ /* A bit shortened, but hopefully still understandable */ ++ static const char * const status_str[] = { ++ /* 0 */ "Successful", ++ /* 1 */ "Unspecified failure", ++ /* 2 */ "reserved", ++ /* 3 */ "reserved", ++ /* 4 */ "reserved", ++ /* 5 */ "reserved", ++ /* 6 */ "reserved", ++ /* 7 */ "reserved", ++ /* 8 */ "reserved", ++ /* 9 */ "reserved", ++ /*10 */ "Cannot support all requested capabilities in Capability Information field", ++ /*11 */ "Reassoc denied (reason outside of 802.11b scope)", ++ /*12 */ "Assoc denied (reason outside of 802.11b scope) -- maybe MAC filtering by peer?", ++ /*13 */ "Responding station doesnt support specified auth algorithm -- maybe WEP auth Open vs. Restricted?", ++ /*14 */ "Auth rejected: wrong transaction sequence number", ++ /*15 */ "Auth rejected: challenge failure", ++ /*16 */ "Auth rejected: timeout for next frame in sequence", ++ /*17 */ "Assoc denied: too many STAs on this AP", ++ /*18 */ "Assoc denied: requesting STA doesnt support all data rates in basic set", ++ /*19 */ "Assoc denied: requesting STA doesnt support Short Preamble", ++ /*20 */ "Assoc denied: requesting STA doesnt support PBCC Modulation", ++ /*21 */ "Assoc denied: requesting STA doesnt support Channel Agility" ++ /*22 */ "reserved", ++ /*23 */ "reserved", ++ /*24 */ "reserved", ++ /*25 */ "Assoc denied: requesting STA doesnt support Short Slot Time", ++ /*26 */ "Assoc denied: requesting STA doesnt support DSSS-OFDM" ++ }; ++ ++ return status_str[status < VEC_SIZE(status_str) ? status : 2]; ++} ++ ++ ++/*********************************************************************** ++*/ ++void ++acx_log_bad_eid(wlan_hdr_t* hdr, int len, wlan_ie_t* ie_ptr) ++{ ++ if (acx_debug & L_ASSOC) { ++ int offset = (u8*)ie_ptr - (u8*)hdr; ++ printk("acx: unknown EID %d in mgmt frame at offset %d. IE: ", ++ ie_ptr->eid, offset); ++ /* IE len can be bogus, IE can extend past packet end. Oh well... */ ++ acx_dump_bytes(ie_ptr, ie_ptr->len + 2); ++ if (acx_debug & L_DATA) { ++ printk("frame (%s): ", ++ acx_get_packet_type_string(le16_to_cpu(hdr->fc))); ++ acx_dump_bytes(hdr, len); ++ } ++ } ++} ++ ++ ++/*********************************************************************** ++*/ ++#if ACX_DEBUG ++void ++acx_dump_bytes(const void *data, int num) ++{ ++ const u8* ptr = (const u8*)data; ++ ++ if (num <= 0) { ++ printk("\n"); ++ return; ++ } ++ ++ while (num >= 16) { ++ printk( "%02X %02X %02X %02X %02X %02X %02X %02X " ++ "%02X %02X %02X %02X %02X %02X %02X %02X\n", ++ ptr[0], ptr[1], ptr[2], ptr[3], ++ ptr[4], ptr[5], ptr[6], ptr[7], ++ ptr[8], ptr[9], ptr[10], ptr[11], ++ ptr[12], ptr[13], ptr[14], ptr[15]); ++ num -= 16; ++ ptr += 16; ++ } ++ if (num > 0) { ++ while (--num > 0) ++ printk("%02X ", *ptr++); ++ printk("%02X\n", *ptr); ++ } ++} ++#endif ++ ++ ++/*********************************************************************** ++** acx_s_get_firmware_version ++*/ ++void ++acx_s_get_firmware_version(acx_device_t *adev) ++{ ++ fw_ver_t fw; ++ u8 hexarr[4] = { 0, 0, 0, 0 }; ++ int hexidx = 0, val = 0; ++ const char *num; ++ char c; ++ ++ FN_ENTER; ++ ++ memset(fw.fw_id, 'E', FW_ID_SIZE); ++ acx_s_interrogate(adev, &fw, ACX1xx_IE_FWREV); ++ memcpy(adev->firmware_version, fw.fw_id, FW_ID_SIZE); ++ adev->firmware_version[FW_ID_SIZE] = '\0'; ++ ++ log(L_DEBUG, "fw_ver: fw_id='%s' hw_id=%08X\n", ++ adev->firmware_version, fw.hw_id); ++ ++ if (strncmp(fw.fw_id, "Rev ", 4) != 0) { ++ printk("acx: strange firmware version string " ++ "'%s', please report\n", adev->firmware_version); ++ adev->firmware_numver = 0x01090407; /* assume 1.9.4.7 */ ++ } else { ++ num = &fw.fw_id[4]; ++ while (1) { ++ c = *num++; ++ if ((c == '.') || (c == '\0')) { ++ hexarr[hexidx++] = val; ++ if ((hexidx > 3) || (c == '\0')) /* end? */ ++ break; ++ val = 0; ++ continue; ++ } ++ if ((c >= '0') && (c <= '9')) ++ c -= '0'; ++ else ++ c = c - 'a' + (char)10; ++ val = val*16 + c; ++ } ++ ++ adev->firmware_numver = (u32)( ++ (hexarr[0] << 24) | (hexarr[1] << 16) ++ | (hexarr[2] << 8) | hexarr[3]); ++ log(L_DEBUG, "firmware_numver 0x%08X\n", adev->firmware_numver); ++ } ++ if (IS_ACX111(adev)) { ++ if (adev->firmware_numver == 0x00010011) { ++ /* This one does not survive floodpinging */ ++ printk("acx: firmware '%s' is known to be buggy, " ++ "please upgrade\n", adev->firmware_version); ++ } ++ } ++ ++ adev->firmware_id = le32_to_cpu(fw.hw_id); ++ ++ /* we're able to find out more detailed chip names now */ ++ switch (adev->firmware_id & 0xffff0000) { ++ case 0x01010000: ++ case 0x01020000: ++ adev->chip_name = "TNETW1100A"; ++ break; ++ case 0x01030000: ++ adev->chip_name = "TNETW1100B"; ++ break; ++ case 0x03000000: ++ case 0x03010000: ++ adev->chip_name = "TNETW1130"; ++ break; ++ case 0x04030000: /* 0x04030101 is TNETW1450 */ ++ adev->chip_name = "TNETW1450"; ++ break; ++ default: ++ printk("acx: unknown chip ID 0x%08X, " ++ "please report\n", adev->firmware_id); ++ break; ++ } ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_display_hardware_details ++** ++** Displays hw/fw version, radio type etc... ++*/ ++void ++acx_display_hardware_details(acx_device_t *adev) ++{ ++ const char *radio_str, *form_str; ++ ++ FN_ENTER; ++ ++ switch (adev->radio_type) { ++ case RADIO_MAXIM_0D: ++ radio_str = "Maxim"; ++ break; ++ case RADIO_RFMD_11: ++ radio_str = "RFMD"; ++ break; ++ case RADIO_RALINK_15: ++ radio_str = "Ralink"; ++ break; ++ case RADIO_RADIA_16: ++ radio_str = "Radia"; ++ break; ++ case RADIO_UNKNOWN_17: ++ /* TI seems to have a radio which is ++ * additionally 802.11a capable, too */ ++ radio_str = "802.11a/b/g radio?! Please report"; ++ break; ++ case RADIO_UNKNOWN_19: ++ radio_str = "A radio used by Safecom cards?! Please report"; ++ break; ++ case RADIO_UNKNOWN_1B: ++ radio_str = "An unknown radio used by TNETW1450 USB adapters"; ++ break; ++ default: ++ radio_str = "UNKNOWN, please report radio type name!"; ++ break; ++ } ++ ++ switch (adev->form_factor) { ++ case 0x00: ++ form_str = "unspecified"; ++ break; ++ case 0x01: ++ form_str = "(mini-)PCI / CardBus"; ++ break; ++ case 0x02: ++ form_str = "USB"; ++ break; ++ case 0x03: ++ form_str = "Compact Flash"; ++ break; ++ default: ++ form_str = "UNKNOWN, please report"; ++ break; ++ } ++ ++ printk("acx: === chipset %s, radio type 0x%02X (%s), " ++ "form factor 0x%02X (%s), EEPROM version 0x%02X: " ++ "uploaded firmware '%s' ===\n", ++ adev->chip_name, adev->radio_type, radio_str, ++ adev->form_factor, form_str, adev->eeprom_version, ++ adev->firmware_version); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acx_e_change_mtu(struct net_device *ndev, int mtu) ++{ ++ enum { ++ MIN_MTU = 256, ++ MAX_MTU = WLAN_DATA_MAXLEN - (ETH_HLEN) ++ }; ++ ++ if (mtu < MIN_MTU || mtu > MAX_MTU) ++ return -EINVAL; ++ ++ ndev->mtu = mtu; ++ return 0; ++} ++ ++ ++/*********************************************************************** ++** acx_e_get_stats, acx_e_get_wireless_stats ++*/ ++struct net_device_stats* ++acx_e_get_stats(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ return &adev->stats; ++} ++ ++struct iw_statistics* ++acx_e_get_wireless_stats(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ return &adev->wstats; ++} ++ ++ ++/*********************************************************************** ++** maps acx111 tx descr rate field to acx100 one ++*/ ++const u8 ++acx_bitpos2rate100[] = { ++ RATE100_1 ,/* 0 */ ++ RATE100_2 ,/* 1 */ ++ RATE100_5 ,/* 2 */ ++ RATE100_2 ,/* 3, should not happen */ ++ RATE100_2 ,/* 4, should not happen */ ++ RATE100_11 ,/* 5 */ ++ RATE100_2 ,/* 6, should not happen */ ++ RATE100_2 ,/* 7, should not happen */ ++ RATE100_22 ,/* 8 */ ++ RATE100_2 ,/* 9, should not happen */ ++ RATE100_2 ,/* 10, should not happen */ ++ RATE100_2 ,/* 11, should not happen */ ++ RATE100_2 ,/* 12, should not happen */ ++ RATE100_2 ,/* 13, should not happen */ ++ RATE100_2 ,/* 14, should not happen */ ++ RATE100_2 ,/* 15, should not happen */ ++}; ++ ++u8 ++acx_rate111to100(u16 r) { ++ return acx_bitpos2rate100[highest_bit(r)]; ++} ++ ++ ++/*********************************************************************** ++** Calculate level like the feb 2003 windows driver seems to do ++*/ ++static u8 ++acx_signal_to_winlevel(u8 rawlevel) ++{ ++ /* u8 winlevel = (u8) (0.5 + 0.625 * rawlevel); */ ++ u8 winlevel = ((4 + (rawlevel * 5)) / 8); ++ ++ if (winlevel > 100) ++ winlevel = 100; ++ return winlevel; ++} ++ ++u8 ++acx_signal_determine_quality(u8 signal, u8 noise) ++{ ++ int qual; ++ ++ qual = (((signal - 30) * 100 / 70) + (100 - noise * 4)) / 2; ++ ++ if (qual > 100) ++ return 100; ++ if (qual < 0) ++ return 0; ++ return qual; ++} ++ ++ ++/*********************************************************************** ++** Interrogate/configure commands ++*/ ++ ++/* FIXME: the lengths given here probably aren't always correct. ++ * They should be gradually replaced by proper "sizeof(acx1XX_ie_XXXX)-4", ++ * unless the firmware actually expects a different length than the struct length */ ++static const u16 ++acx100_ie_len[] = { ++ 0, ++ ACX100_IE_ACX_TIMER_LEN, ++ sizeof(acx100_ie_powersave_t)-4, /* is that 6 or 8??? */ ++ ACX1xx_IE_QUEUE_CONFIG_LEN, ++ ACX100_IE_BLOCK_SIZE_LEN, ++ ACX1xx_IE_MEMORY_CONFIG_OPTIONS_LEN, ++ ACX1xx_IE_RATE_FALLBACK_LEN, ++ ACX100_IE_WEP_OPTIONS_LEN, ++ ACX1xx_IE_MEMORY_MAP_LEN, /* ACX1xx_IE_SSID_LEN, */ ++ 0, ++ ACX1xx_IE_ASSOC_ID_LEN, ++ 0, ++ ACX111_IE_CONFIG_OPTIONS_LEN, ++ ACX1xx_IE_FWREV_LEN, ++ ACX1xx_IE_FCS_ERROR_COUNT_LEN, ++ ACX1xx_IE_MEDIUM_USAGE_LEN, ++ ACX1xx_IE_RXCONFIG_LEN, ++ 0, ++ 0, ++ sizeof(fw_stats_t)-4, ++ 0, ++ ACX1xx_IE_FEATURE_CONFIG_LEN, ++ ACX111_IE_KEY_CHOOSE_LEN, ++ ACX1FF_IE_MISC_CONFIG_TABLE_LEN, ++ ACX1FF_IE_WONE_CONFIG_LEN, ++ 0, ++ ACX1FF_IE_TID_CONFIG_LEN, ++ 0, ++ 0, ++ 0, ++ ACX1FF_IE_CALIB_ASSESSMENT_LEN, ++ ACX1FF_IE_BEACON_FILTER_OPTIONS_LEN, ++ ACX1FF_IE_LOW_RSSI_THRESH_OPT_LEN, ++ ACX1FF_IE_NOISE_HISTOGRAM_RESULTS_LEN, ++ 0, ++ ACX1FF_IE_PACKET_DETECT_THRESH_LEN, ++ ACX1FF_IE_TX_CONFIG_OPTIONS_LEN, ++ ACX1FF_IE_CCA_THRESHOLD_LEN, ++ ACX1FF_IE_EVENT_MASK_LEN, ++ ACX1FF_IE_DTIM_PERIOD_LEN, ++ 0, ++ ACX1FF_IE_ACI_CONFIG_SET_LEN, ++ 0, ++ 0, ++ 0, ++ 0, ++ 0, ++ 0, ++ ACX1FF_IE_EEPROM_VER_LEN, ++}; ++ ++static const u16 ++acx100_ie_len_dot11[] = { ++ 0, ++ ACX1xx_IE_DOT11_STATION_ID_LEN, ++ 0, ++ ACX100_IE_DOT11_BEACON_PERIOD_LEN, ++ ACX1xx_IE_DOT11_DTIM_PERIOD_LEN, ++ ACX1xx_IE_DOT11_SHORT_RETRY_LIMIT_LEN, ++ ACX1xx_IE_DOT11_LONG_RETRY_LIMIT_LEN, ++ ACX100_IE_DOT11_WEP_DEFAULT_KEY_WRITE_LEN, ++ ACX1xx_IE_DOT11_MAX_XMIT_MSDU_LIFETIME_LEN, ++ 0, ++ ACX1xx_IE_DOT11_CURRENT_REG_DOMAIN_LEN, ++ ACX1xx_IE_DOT11_CURRENT_ANTENNA_LEN, ++ 0, ++ ACX1xx_IE_DOT11_TX_POWER_LEVEL_LEN, ++ ACX1xx_IE_DOT11_CURRENT_CCA_MODE_LEN, ++ ACX100_IE_DOT11_ED_THRESHOLD_LEN, ++ ACX1xx_IE_DOT11_WEP_DEFAULT_KEY_SET_LEN, ++ 0, ++ 0, ++ 0, ++}; ++ ++static const u16 ++acx111_ie_len[] = { ++ 0, ++ ACX100_IE_ACX_TIMER_LEN, ++ sizeof(acx111_ie_powersave_t)-4, ++ ACX1xx_IE_QUEUE_CONFIG_LEN, ++ ACX100_IE_BLOCK_SIZE_LEN, ++ ACX1xx_IE_MEMORY_CONFIG_OPTIONS_LEN, ++ ACX1xx_IE_RATE_FALLBACK_LEN, ++ ACX100_IE_WEP_OPTIONS_LEN, ++ ACX1xx_IE_MEMORY_MAP_LEN, /* ACX1xx_IE_SSID_LEN, */ ++ 0, ++ ACX1xx_IE_ASSOC_ID_LEN, ++ 0, ++ ACX111_IE_CONFIG_OPTIONS_LEN, ++ ACX1xx_IE_FWREV_LEN, ++ ACX1xx_IE_FCS_ERROR_COUNT_LEN, ++ ACX1xx_IE_MEDIUM_USAGE_LEN, ++ ACX1xx_IE_RXCONFIG_LEN, ++ 0, ++ 0, ++ sizeof(fw_stats_t)-4, ++ 0, ++ ACX1xx_IE_FEATURE_CONFIG_LEN, ++ ACX111_IE_KEY_CHOOSE_LEN, ++ ACX1FF_IE_MISC_CONFIG_TABLE_LEN, ++ ACX1FF_IE_WONE_CONFIG_LEN, ++ 0, ++ ACX1FF_IE_TID_CONFIG_LEN, ++ 0, ++ 0, ++ 0, ++ ACX1FF_IE_CALIB_ASSESSMENT_LEN, ++ ACX1FF_IE_BEACON_FILTER_OPTIONS_LEN, ++ ACX1FF_IE_LOW_RSSI_THRESH_OPT_LEN, ++ ACX1FF_IE_NOISE_HISTOGRAM_RESULTS_LEN, ++ 0, ++ ACX1FF_IE_PACKET_DETECT_THRESH_LEN, ++ ACX1FF_IE_TX_CONFIG_OPTIONS_LEN, ++ ACX1FF_IE_CCA_THRESHOLD_LEN, ++ ACX1FF_IE_EVENT_MASK_LEN, ++ ACX1FF_IE_DTIM_PERIOD_LEN, ++ 0, ++ ACX1FF_IE_ACI_CONFIG_SET_LEN, ++ 0, ++ 0, ++ 0, ++ 0, ++ 0, ++ 0, ++ ACX1FF_IE_EEPROM_VER_LEN, ++}; ++ ++static const u16 ++acx111_ie_len_dot11[] = { ++ 0, ++ ACX1xx_IE_DOT11_STATION_ID_LEN, ++ 0, ++ ACX100_IE_DOT11_BEACON_PERIOD_LEN, ++ ACX1xx_IE_DOT11_DTIM_PERIOD_LEN, ++ ACX1xx_IE_DOT11_SHORT_RETRY_LIMIT_LEN, ++ ACX1xx_IE_DOT11_LONG_RETRY_LIMIT_LEN, ++ ACX100_IE_DOT11_WEP_DEFAULT_KEY_WRITE_LEN, ++ ACX1xx_IE_DOT11_MAX_XMIT_MSDU_LIFETIME_LEN, ++ 0, ++ ACX1xx_IE_DOT11_CURRENT_REG_DOMAIN_LEN, ++ ACX1xx_IE_DOT11_CURRENT_ANTENNA_LEN, ++ 0, ++ ACX1xx_IE_DOT11_TX_POWER_LEVEL_LEN, ++ ACX1xx_IE_DOT11_CURRENT_CCA_MODE_LEN, ++ ACX100_IE_DOT11_ED_THRESHOLD_LEN, ++ ACX1xx_IE_DOT11_WEP_DEFAULT_KEY_SET_LEN, ++ 0, ++ 0, ++ 0, ++}; ++ ++ ++#undef FUNC ++#define FUNC "configure" ++#if !ACX_DEBUG ++int ++acx_s_configure(acx_device_t *adev, void *pdr, int type) ++{ ++#else ++int ++acx_s_configure_debug(acx_device_t *adev, void *pdr, int type, const char* typestr) ++{ ++#endif ++ u16 len; ++ int res; ++ ++ if (type < 0x1000) ++ len = adev->ie_len[type]; ++ else ++ len = adev->ie_len_dot11[type - 0x1000]; ++ ++ log(L_CTL, FUNC"(type:%s,len:%u)\n", typestr, len); ++ if (unlikely(!len)) { ++ log(L_DEBUG, "zero-length type %s?!\n", typestr); ++ } ++ ++ ((acx_ie_generic_t *)pdr)->type = cpu_to_le16(type); ++ ((acx_ie_generic_t *)pdr)->len = cpu_to_le16(len); ++ res = acx_s_issue_cmd(adev, ACX1xx_CMD_CONFIGURE, pdr, len + 4); ++ if (unlikely(OK != res)) { ++#if ACX_DEBUG ++ printk("%s: "FUNC"(type:%s) FAILED\n", adev->ndev->name, typestr); ++#else ++ printk("%s: "FUNC"(type:0x%X) FAILED\n", adev->ndev->name, type); ++#endif ++ /* dump_stack() is already done in issue_cmd() */ ++ } ++ return res; ++} ++ ++#undef FUNC ++#define FUNC "interrogate" ++#if !ACX_DEBUG ++int ++acx_s_interrogate(acx_device_t *adev, void *pdr, int type) ++{ ++#else ++int ++acx_s_interrogate_debug(acx_device_t *adev, void *pdr, int type, ++ const char* typestr) ++{ ++#endif ++ u16 len; ++ int res; ++ ++ /* FIXME: no check whether this exceeds the array yet. ++ * We should probably remember the number of entries... */ ++ if (type < 0x1000) ++ len = adev->ie_len[type]; ++ else ++ len = adev->ie_len_dot11[type-0x1000]; ++ ++ log(L_CTL, FUNC"(type:%s,len:%u)\n", typestr, len); ++ ++ ((acx_ie_generic_t *)pdr)->type = cpu_to_le16(type); ++ ((acx_ie_generic_t *)pdr)->len = cpu_to_le16(len); ++ res = acx_s_issue_cmd(adev, ACX1xx_CMD_INTERROGATE, pdr, len + 4); ++ if (unlikely(OK != res)) { ++#if ACX_DEBUG ++ printk("%s: "FUNC"(type:%s) FAILED\n", adev->ndev->name, typestr); ++#else ++ printk("%s: "FUNC"(type:0x%X) FAILED\n", adev->ndev->name, type); ++#endif ++ /* dump_stack() is already done in issue_cmd() */ ++ } ++ return res; ++} ++ ++#if CMD_DISCOVERY ++void ++great_inquisitor(acx_device_t *adev) ++{ ++ static struct { ++ u16 type; ++ u16 len; ++ /* 0x200 was too large here: */ ++ u8 data[0x100 - 4]; ++ } ACX_PACKED ie; ++ u16 type; ++ ++ FN_ENTER; ++ ++ /* 0..0x20, 0x1000..0x1020 */ ++ for (type = 0; type <= 0x1020; type++) { ++ if (type == 0x21) ++ type = 0x1000; ++ ie.type = cpu_to_le16(type); ++ ie.len = cpu_to_le16(sizeof(ie) - 4); ++ acx_s_issue_cmd(adev, ACX1xx_CMD_INTERROGATE, &ie, sizeof(ie)); ++ } ++ FN_EXIT0; ++} ++#endif ++ ++ ++#ifdef CONFIG_PROC_FS ++/*********************************************************************** ++** /proc files ++*/ ++/*********************************************************************** ++** acx_l_proc_output ++** Generate content for our /proc entry ++** ++** Arguments: ++** buf is a pointer to write output to ++** adev is the usual pointer to our private struct acx_device ++** Returns: ++** number of bytes actually written to buf ++** Side effects: ++** none ++*/ ++static int ++acx_l_proc_output(char *buf, acx_device_t *adev) ++{ ++ char *p = buf; ++ int i; ++ ++ FN_ENTER; ++ ++ p += sprintf(p, ++ "acx driver version:\t\t" ACX_RELEASE "\n" ++ "Wireless extension version:\t" STRING(WIRELESS_EXT) "\n" ++ "chip name:\t\t\t%s (0x%08X)\n" ++ "radio type:\t\t\t0x%02X\n" ++ "form factor:\t\t\t0x%02X\n" ++ "EEPROM version:\t\t\t0x%02X\n" ++ "firmware version:\t\t%s (0x%08X)\n", ++ adev->chip_name, adev->firmware_id, ++ adev->radio_type, ++ adev->form_factor, ++ adev->eeprom_version, ++ adev->firmware_version, adev->firmware_numver); ++ ++ for (i = 0; i < VEC_SIZE(adev->sta_list); i++) { ++ struct client *bss = &adev->sta_list[i]; ++ if (!bss->used) continue; ++ p += sprintf(p, "BSS %u BSSID "MACSTR" ESSID %s channel %u " ++ "Cap 0x%X SIR %u SNR %u\n", ++ i, MAC(bss->bssid), (char*)bss->essid, bss->channel, ++ bss->cap_info, bss->sir, bss->snr); ++ } ++ p += sprintf(p, "status:\t\t\t%u (%s)\n", ++ adev->status, acx_get_status_name(adev->status)); ++ ++ FN_EXIT1(p - buf); ++ return p - buf; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx_s_proc_diag_output(char *buf, acx_device_t *adev) ++{ ++ char *p = buf; ++ unsigned long flags; ++ unsigned int len = 0, partlen; ++ u32 temp1, temp2; ++ u8 *st, *st_end; ++#ifdef __BIG_ENDIAN ++ u8 *st2; ++#endif ++ fw_stats_t *fw_stats; ++ char *part_str = NULL; ++ fw_stats_tx_t *tx = NULL; ++ fw_stats_rx_t *rx = NULL; ++ fw_stats_dma_t *dma = NULL; ++ fw_stats_irq_t *irq = NULL; ++ fw_stats_wep_t *wep = NULL; ++ fw_stats_pwr_t *pwr = NULL; ++ fw_stats_mic_t *mic = NULL; ++ fw_stats_aes_t *aes = NULL; ++ fw_stats_event_t *evt = NULL; ++ ++ FN_ENTER; ++ ++ acx_lock(adev, flags); ++ ++#if defined (ACX_MEM) ++ p = acxmem_s_proc_diag_output(p, adev); ++#else ++ if (IS_PCI(adev)) ++ p = acxpci_s_proc_diag_output(p, adev); ++#endif ++ ++ p += sprintf(p, ++ "\n" ++ "** network status **\n" ++ "dev_state_mask 0x%04X\n" ++ "status %u (%s), " ++ "mode %u, channel %u, " ++ "reg_dom_id 0x%02X, reg_dom_chanmask 0x%04X, ", ++ adev->dev_state_mask, ++ adev->status, acx_get_status_name(adev->status), ++ adev->mode, adev->channel, ++ adev->reg_dom_id, adev->reg_dom_chanmask ++ ); ++ p += sprintf(p, ++ "ESSID \"%s\", essid_active %d, essid_len %d, " ++ "essid_for_assoc \"%s\", nick \"%s\"\n" ++ "WEP ena %d, restricted %d, idx %d\n", ++ adev->essid, adev->essid_active, (int)adev->essid_len, ++ adev->essid_for_assoc, adev->nick, ++ adev->wep_enabled, adev->wep_restricted, ++ adev->wep_current_index); ++ p += sprintf(p, "dev_addr "MACSTR"\n", MAC(adev->dev_addr)); ++ p += sprintf(p, "bssid "MACSTR"\n", MAC(adev->bssid)); ++ p += sprintf(p, "ap_filter "MACSTR"\n", MAC(adev->ap)); ++ ++ p += sprintf(p, ++ "\n" ++ "** PHY status **\n" ++ "tx_disabled %d, tx_level_dbm %d\n" /* "tx_level_val %d, tx_level_auto %d\n" */ ++ "sensitivity %d, antenna 0x%02X, ed_threshold %d, cca %d, preamble_mode %d\n" ++ "rate_basic 0x%04X, rate_oper 0x%04X\n" ++ "rts_threshold %d, frag_threshold %d, short_retry %d, long_retry %d\n" ++ "msdu_lifetime %d, listen_interval %d, beacon_interval %d\n", ++ adev->tx_disabled, adev->tx_level_dbm, /* adev->tx_level_val, adev->tx_level_auto, */ ++ adev->sensitivity, adev->antenna, adev->ed_threshold, adev->cca, adev->preamble_mode, ++ adev->rate_basic, adev->rate_oper, ++ adev->rts_threshold, adev->frag_threshold, adev->short_retry, adev->long_retry, ++ adev->msdu_lifetime, adev->listen_interval, adev->beacon_interval); ++ ++ acx_unlock(adev, flags); ++ ++ p += sprintf(p, ++ "\n" ++ "** Firmware **\n" ++ "NOTE: version dependent statistics layout, " ++ "please report if you suspect wrong parsing!\n" ++ "\n" ++ "version \"%s\"\n", adev->firmware_version); ++ ++ /* TODO: may replace kmalloc/memset with kzalloc once ++ * Linux 2.6.14 is widespread */ ++ fw_stats = kmalloc(sizeof(*fw_stats), GFP_KERNEL); ++ if (!fw_stats) { ++ FN_EXIT1(0); ++ return 0; ++ } ++ memset(fw_stats, 0, sizeof(*fw_stats)); ++ ++ st = (u8 *)fw_stats; ++ ++ part_str = "statistics query command"; ++ ++ if (OK != acx_s_interrogate(adev, st, ACX1xx_IE_FIRMWARE_STATISTICS)) ++ goto fw_stats_end; ++ ++ st += sizeof(u16); ++ len = *(u16 *)st; ++ ++ if (len > sizeof(*fw_stats)) { ++ p += sprintf(p, ++ "firmware version with bigger fw_stats struct detected\n" ++ "(%u vs. %u), please report\n", len, sizeof(fw_stats_t)); ++ if (len > sizeof(*fw_stats)) { ++ p += sprintf(p, "struct size exceeded allocation!\n"); ++ len = sizeof(*fw_stats); ++ } ++ } ++ st += sizeof(u16); ++ st_end = st - 2*sizeof(u16) + len; ++ ++#ifdef __BIG_ENDIAN ++ /* let's make one bold assumption here: ++ * (hopefully!) *all* statistics fields are u32 only, ++ * thus if we need to make endianness corrections ++ * we can simply do them in one go, in advance */ ++ st2 = (u8 *)fw_stats; ++ for (temp1 = 0; temp1 < len; temp1 += 4, st2 += 4) ++ *(u32 *)st2 = le32_to_cpu(*(u32 *)st2); ++#endif ++ ++ part_str = "Rx/Tx"; ++ ++ /* directly at end of a struct part? --> no error! */ ++ if (st == st_end) ++ goto fw_stats_end; ++ ++ tx = (fw_stats_tx_t *)st; ++ st += sizeof(fw_stats_tx_t); ++ rx = (fw_stats_rx_t *)st; ++ st += sizeof(fw_stats_rx_t); ++ partlen = sizeof(fw_stats_tx_t) + sizeof(fw_stats_rx_t); ++ ++ if (IS_ACX100(adev)) { ++ /* at least ACX100 PCI F/W 1.9.8.b ++ * and ACX100 USB F/W 1.0.7-USB ++ * don't have those two fields... */ ++ st -= 2*sizeof(u32); ++ ++ /* our parsing doesn't quite match this firmware yet, ++ * log failure */ ++ if (st > st_end) ++ goto fw_stats_fail; ++ temp1 = temp2 = 999999999; ++ } else { ++ if (st > st_end) ++ goto fw_stats_fail; ++ temp1 = rx->rx_aci_events; ++ temp2 = rx->rx_aci_resets; ++ } ++ ++ p += sprintf(p, ++ "%s:\n" ++ " tx_desc_overfl %u\n" ++ " rx_OutOfMem %u, rx_hdr_overfl %u, rx_hw_stuck %u\n" ++ " rx_dropped_frame %u, rx_frame_ptr_err %u, rx_xfr_hint_trig %u\n" ++ " rx_aci_events %u, rx_aci_resets %u\n", ++ part_str, ++ tx->tx_desc_of, ++ rx->rx_oom, ++ rx->rx_hdr_of, ++ rx->rx_hw_stuck, ++ rx->rx_dropped_frame, ++ rx->rx_frame_ptr_err, ++ rx->rx_xfr_hint_trig, ++ temp1, ++ temp2); ++ ++ part_str = "DMA"; ++ ++ if (st == st_end) ++ goto fw_stats_end; ++ ++ dma = (fw_stats_dma_t *)st; ++ partlen = sizeof(fw_stats_dma_t); ++ st += partlen; ++ ++ if (st > st_end) ++ goto fw_stats_fail; ++ ++ p += sprintf(p, ++ "%s:\n" ++ " rx_dma_req %u, rx_dma_err %u, tx_dma_req %u, tx_dma_err %u\n", ++ part_str, ++ dma->rx_dma_req, ++ dma->rx_dma_err, ++ dma->tx_dma_req, ++ dma->tx_dma_err); ++ ++ part_str = "IRQ"; ++ ++ if (st == st_end) ++ goto fw_stats_end; ++ ++ irq = (fw_stats_irq_t *)st; ++ partlen = sizeof(fw_stats_irq_t); ++ st += partlen; ++ ++ if (st > st_end) ++ goto fw_stats_fail; ++ ++ p += sprintf(p, ++ "%s:\n" ++ " cmd_cplt %u, fiq %u\n" ++ " rx_hdrs %u, rx_cmplt %u, rx_mem_overfl %u, rx_rdys %u\n" ++ " irqs %u, tx_procs %u, decrypt_done %u\n" ++ " dma_0_done %u, dma_1_done %u, tx_exch_complet %u\n" ++ " commands %u, rx_procs %u, hw_pm_mode_changes %u\n" ++ " host_acks %u, pci_pm %u, acm_wakeups %u\n", ++ part_str, ++ irq->cmd_cplt, ++ irq->fiq, ++ irq->rx_hdrs, ++ irq->rx_cmplt, ++ irq->rx_mem_of, ++ irq->rx_rdys, ++ irq->irqs, ++ irq->tx_procs, ++ irq->decrypt_done, ++ irq->dma_0_done, ++ irq->dma_1_done, ++ irq->tx_exch_complet, ++ irq->commands, ++ irq->rx_procs, ++ irq->hw_pm_mode_changes, ++ irq->host_acks, ++ irq->pci_pm, ++ irq->acm_wakeups); ++ ++ part_str = "WEP"; ++ ++ if (st == st_end) ++ goto fw_stats_end; ++ ++ wep = (fw_stats_wep_t *)st; ++ partlen = sizeof(fw_stats_wep_t); ++ st += partlen; ++ ++ if ( ++ (IS_PCI(adev) && IS_ACX100(adev)) ++ || (IS_USB(adev) && IS_ACX100(adev)) ++ || (IS_MEM(adev) && IS_ACX100(adev)) ++ ) { ++ /* at least ACX100 PCI F/W 1.9.8.b, ++ * ACX100 USB F/W 1.0.7-USB ++ * and ACX100 Generic Slave F/W 1.10.7.K ++ * don't have those two fields... ++ */ ++ st -= 2*sizeof(u32); ++ if (st > st_end) ++ goto fw_stats_fail; ++ temp1 = temp2 = 999999999; ++ } else { ++ if (st > st_end) ++ goto fw_stats_fail; ++ temp1 = wep->wep_pkt_decrypt; ++ temp2 = wep->wep_decrypt_irqs; ++ } ++ ++ p += sprintf(p, ++ "%s:\n" ++ " wep_key_count %u, wep_default_key_count %u, dot11_def_key_mib %u\n" ++ " wep_key_not_found %u, wep_decrypt_fail %u\n" ++ " wep_pkt_decrypt %u, wep_decrypt_irqs %u\n", ++ part_str, ++ wep->wep_key_count, ++ wep->wep_default_key_count, ++ wep->dot11_def_key_mib, ++ wep->wep_key_not_found, ++ wep->wep_decrypt_fail, ++ temp1, ++ temp2); ++ ++ part_str = "power"; ++ ++ if (st == st_end) ++ goto fw_stats_end; ++ ++ pwr = (fw_stats_pwr_t *)st; ++ partlen = sizeof(fw_stats_pwr_t); ++ st += partlen; ++ ++ if (st > st_end) ++ goto fw_stats_fail; ++ ++ p += sprintf(p, ++ "%s:\n" ++ " tx_start_ctr %u, no_ps_tx_too_short %u\n" ++ " rx_start_ctr %u, no_ps_rx_too_short %u\n" ++ " lppd_started %u\n" ++ " no_lppd_too_noisy %u, no_lppd_too_short %u, no_lppd_matching_frame %u\n", ++ part_str, ++ pwr->tx_start_ctr, ++ pwr->no_ps_tx_too_short, ++ pwr->rx_start_ctr, ++ pwr->no_ps_rx_too_short, ++ pwr->lppd_started, ++ pwr->no_lppd_too_noisy, ++ pwr->no_lppd_too_short, ++ pwr->no_lppd_matching_frame); ++ ++ part_str = "MIC"; ++ ++ if (st == st_end) ++ goto fw_stats_end; ++ ++ mic = (fw_stats_mic_t *)st; ++ partlen = sizeof(fw_stats_mic_t); ++ st += partlen; ++ ++ if (st > st_end) ++ goto fw_stats_fail; ++ ++ p += sprintf(p, ++ "%s:\n" ++ " mic_rx_pkts %u, mic_calc_fail %u\n", ++ part_str, ++ mic->mic_rx_pkts, ++ mic->mic_calc_fail); ++ ++ part_str = "AES"; ++ ++ if (st == st_end) ++ goto fw_stats_end; ++ ++ aes = (fw_stats_aes_t *)st; ++ partlen = sizeof(fw_stats_aes_t); ++ st += partlen; ++ ++ if (st > st_end) ++ goto fw_stats_fail; ++ ++ p += sprintf(p, ++ "%s:\n" ++ " aes_enc_fail %u, aes_dec_fail %u\n" ++ " aes_enc_pkts %u, aes_dec_pkts %u\n" ++ " aes_enc_irq %u, aes_dec_irq %u\n", ++ part_str, ++ aes->aes_enc_fail, ++ aes->aes_dec_fail, ++ aes->aes_enc_pkts, ++ aes->aes_dec_pkts, ++ aes->aes_enc_irq, ++ aes->aes_dec_irq); ++ ++ part_str = "event"; ++ ++ if (st == st_end) ++ goto fw_stats_end; ++ ++ evt = (fw_stats_event_t *)st; ++ partlen = sizeof(fw_stats_event_t); ++ st += partlen; ++ ++ if (st > st_end) ++ goto fw_stats_fail; ++ ++ p += sprintf(p, ++ "%s:\n" ++ " heartbeat %u, calibration %u\n" ++ " rx_mismatch %u, rx_mem_empty %u, rx_pool %u\n" ++ " oom_late %u\n" ++ " phy_tx_err %u, tx_stuck %u\n", ++ part_str, ++ evt->heartbeat, ++ evt->calibration, ++ evt->rx_mismatch, ++ evt->rx_mem_empty, ++ evt->rx_pool, ++ evt->oom_late, ++ evt->phy_tx_err, ++ evt->tx_stuck); ++ ++ if (st < st_end) ++ goto fw_stats_bigger; ++ ++ goto fw_stats_end; ++ ++fw_stats_fail: ++ st -= partlen; ++ p += sprintf(p, ++ "failed at %s part (size %u), offset %u (struct size %u), " ++ "please report\n", part_str, partlen, ++ (int)st - (int)fw_stats, len); ++ ++fw_stats_bigger: ++ for (; st < st_end; st += 4) ++ p += sprintf(p, ++ "UNKN%3d: %u\n", (int)st - (int)fw_stats, *(u32 *)st); ++ ++fw_stats_end: ++ kfree(fw_stats); ++ ++ FN_EXIT1(p - buf); ++ return p - buf; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx_s_proc_phy_output(char *buf, acx_device_t *adev) ++{ ++ char *p = buf; ++ int i; ++ ++ FN_ENTER; ++ ++ /* ++ if (RADIO_RFMD_11 != adev->radio_type) { ++ printk("sorry, not yet adapted for radio types " ++ "other than RFMD, please verify " ++ "PHY size etc. first!\n"); ++ goto end; ++ } ++ */ ++ ++ /* The PHY area is only 0x80 bytes long; further pages after that ++ * only have some page number registers with altered value, ++ * all other registers remain the same. */ ++ for (i = 0; i < 0x80; i++) { ++ acx_s_read_phy_reg(adev, i, p++); ++ } ++ ++ FN_EXIT1(p - buf); ++ return p - buf; ++} ++ ++ ++/*********************************************************************** ++** acx_e_read_proc_XXXX ++** Handle our /proc entry ++** ++** Arguments: ++** standard kernel read_proc interface ++** Returns: ++** number of bytes written to buf ++** Side effects: ++** none ++*/ ++static int ++acx_e_read_proc(char *buf, char **start, off_t offset, int count, ++ int *eof, void *data) ++{ ++ acx_device_t *adev = (acx_device_t*)data; ++ unsigned long flags; ++ int length; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ acx_lock(adev, flags); ++ /* fill buf */ ++ length = acx_l_proc_output(buf, adev); ++ acx_unlock(adev, flags); ++ acx_sem_unlock(adev); ++ ++ /* housekeeping */ ++ if (length <= offset + count) ++ *eof = 1; ++ *start = buf + offset; ++ length -= offset; ++ if (length > count) ++ length = count; ++ if (length < 0) ++ length = 0; ++ FN_EXIT1(length); ++ return length; ++} ++ ++static char _buf[32768]; ++static int ++acx_e_read_proc_diag(char *buf, char **start, off_t offset, int count, ++ int *eof, void *data) ++{ ++ acx_device_t *adev = (acx_device_t*)data; ++ int length; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ /* fill buf */ ++ length = acx_s_proc_diag_output(_buf, adev); ++ acx_sem_unlock(adev); ++ ++ memcpy(buf, _buf + offset, count); ++ ++ /* housekeeping */ ++ if (length <= offset + count) ++ *eof = 1; ++ *start = count; ++ length -= offset; ++ if (length > count) ++ length = count; ++ if (length < 0) ++ length = 0; ++ FN_EXIT1(length); ++ return length; ++} ++ ++static int ++acx_e_read_proc_eeprom(char *buf, char **start, off_t offset, int count, ++ int *eof, void *data) ++{ ++ acx_device_t *adev = (acx_device_t*)data; ++ int length; ++ ++ FN_ENTER; ++ ++ /* fill buf */ ++ length = 0; ++#if defined (ACX_MEM) ++ acx_sem_lock(adev); ++ length = acxmem_proc_eeprom_output(buf, adev); ++ acx_sem_unlock(adev); ++#else ++ if (IS_PCI(adev)) { ++ acx_sem_lock(adev); ++ length = acxpci_proc_eeprom_output(buf, adev); ++ acx_sem_unlock(adev); ++ } ++#endif ++ ++ /* housekeeping */ ++ if (length <= offset + count) ++ *eof = 1; ++ *start = buf + offset; ++ length -= offset; ++ if (length > count) ++ length = count; ++ if (length < 0) ++ length = 0; ++ FN_EXIT1(length); ++ return length; ++} ++ ++static int ++acx_e_read_proc_phy(char *buf, char **start, off_t offset, int count, ++ int *eof, void *data) ++{ ++ acx_device_t *adev = (acx_device_t*)data; ++ int length; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ /* fill buf */ ++ length = acx_s_proc_phy_output(buf, adev); ++ acx_sem_unlock(adev); ++ ++ /* housekeeping */ ++ if (length <= offset + count) ++ *eof = 1; ++ *start = buf + offset; ++ length -= offset; ++ if (length > count) ++ length = count; ++ if (length < 0) ++ length = 0; ++ FN_EXIT1(length); ++ return length; ++} ++ ++ ++/*********************************************************************** ++** /proc files registration ++*/ ++static const char * const ++proc_files[] = { "", "_diag", "_eeprom", "_phy" }; ++ ++static read_proc_t * const ++proc_funcs[] = { ++ acx_e_read_proc, ++ acx_e_read_proc_diag, ++ acx_e_read_proc_eeprom, ++ acx_e_read_proc_phy ++}; ++ ++static int ++manage_proc_entries(const struct net_device *ndev, int remove) ++{ ++ acx_device_t *adev = ndev2adev((struct net_device *)ndev); ++ char procbuf[80]; ++ int i; ++ ++ for (i = 0; i < VEC_SIZE(proc_files); i++) { ++ snprintf(procbuf, sizeof(procbuf), ++ "driver/acx_%s%s", ndev->name, proc_files[i]); ++ log(L_INIT, "%sing /proc entry %s\n", ++ remove ? "remov" : "creat", procbuf); ++ if (!remove) { ++ if (!create_proc_read_entry(procbuf, 0, 0, proc_funcs[i], adev)) { ++ printk("acx: cannot register /proc entry %s\n", procbuf); ++ return NOT_OK; ++ } ++ } else { ++ remove_proc_entry(procbuf, NULL); ++ } ++ } ++ return OK; ++} ++ ++int ++acx_proc_register_entries(const struct net_device *ndev) ++{ ++ return manage_proc_entries(ndev, 0); ++} ++ ++int ++acx_proc_unregister_entries(const struct net_device *ndev) ++{ ++ return manage_proc_entries(ndev, 1); ++} ++#endif /* CONFIG_PROC_FS */ ++ ++ ++/*********************************************************************** ++** acx_cmd_join_bssid ++** ++** Common code for both acx100 and acx111. ++*/ ++/* NB: does NOT match RATE100_nn but matches ACX[111]_SCAN_RATE_n */ ++static const u8 ++bitpos2genframe_txrate[] = { ++ 10, /* 0. 1 Mbit/s */ ++ 20, /* 1. 2 Mbit/s */ ++ 55, /* 2. 5.5 Mbit/s */ ++ 0x0B, /* 3. 6 Mbit/s */ ++ 0x0F, /* 4. 9 Mbit/s */ ++ 110, /* 5. 11 Mbit/s */ ++ 0x0A, /* 6. 12 Mbit/s */ ++ 0x0E, /* 7. 18 Mbit/s */ ++ 220, /* 8. 22 Mbit/s */ ++ 0x09, /* 9. 24 Mbit/s */ ++ 0x0D, /* 10. 36 Mbit/s */ ++ 0x08, /* 11. 48 Mbit/s */ ++ 0x0C, /* 12. 54 Mbit/s */ ++ 10, /* 13. 1 Mbit/s, should never happen */ ++ 10, /* 14. 1 Mbit/s, should never happen */ ++ 10, /* 15. 1 Mbit/s, should never happen */ ++}; ++ ++/* Looks scary, eh? ++** Actually, each one compiled into one AND and one SHIFT, ++** 31 bytes in x86 asm (more if uints are replaced by u16/u8) */ ++static inline unsigned int ++rate111to5bits(unsigned int rate) ++{ ++ return (rate & 0x7) ++ | ( (rate & RATE111_11) / (RATE111_11/JOINBSS_RATES_11) ) ++ | ( (rate & RATE111_22) / (RATE111_22/JOINBSS_RATES_22) ) ++ ; ++} ++ ++static void ++acx_s_cmd_join_bssid(acx_device_t *adev, const u8 *bssid) ++{ ++ acx_joinbss_t tmp; ++ int dtim_interval; ++ int i; ++ ++ if (mac_is_zero(bssid)) ++ return; ++ ++ FN_ENTER; ++ ++ dtim_interval = (ACX_MODE_0_ADHOC == adev->mode) ? ++ 1 : adev->dtim_interval; ++ ++ memset(&tmp, 0, sizeof(tmp)); ++ ++ for (i = 0; i < ETH_ALEN; i++) { ++ tmp.bssid[i] = bssid[ETH_ALEN-1 - i]; ++ } ++ ++ tmp.beacon_interval = cpu_to_le16(adev->beacon_interval); ++ ++ /* Basic rate set. Control frame responses (such as ACK or CTS frames) ++ ** are sent with one of these rates */ ++ if (IS_ACX111(adev)) { ++ /* It was experimentally determined that rates_basic ++ ** can take 11g rates as well, not only rates ++ ** defined with JOINBSS_RATES_BASIC111_nnn. ++ ** Just use RATE111_nnn constants... */ ++ tmp.u.acx111.dtim_interval = dtim_interval; ++ tmp.u.acx111.rates_basic = cpu_to_le16(adev->rate_basic); ++ log(L_ASSOC, "rates_basic:%04X, rates_supported:%04X\n", ++ adev->rate_basic, adev->rate_oper); ++ } else { ++ tmp.u.acx100.dtim_interval = dtim_interval; ++ tmp.u.acx100.rates_basic = rate111to5bits(adev->rate_basic); ++ tmp.u.acx100.rates_supported = rate111to5bits(adev->rate_oper); ++ log(L_ASSOC, "rates_basic:%04X->%02X, " ++ "rates_supported:%04X->%02X\n", ++ adev->rate_basic, tmp.u.acx100.rates_basic, ++ adev->rate_oper, tmp.u.acx100.rates_supported); ++ } ++ ++ /* Setting up how Beacon, Probe Response, RTS, and PS-Poll frames ++ ** will be sent (rate/modulation/preamble) */ ++ tmp.u.txrate.genfrm_txrate = bitpos2genframe_txrate[lowest_bit(adev->rate_basic)]; ++ tmp.genfrm_mod_pre = 0; /* FIXME: was = adev->capab_short (which was always 0); */ ++ /* we can use short pre *if* all peers can understand it */ ++ /* FIXME #2: we need to correctly set PBCC/OFDM bits here too */ ++ ++ /* we switch fw to STA mode in MONITOR mode, it seems to be ++ ** the only mode where fw does not emit beacons by itself ++ ** but allows us to send anything (we really want to retain ++ ** ability to tx arbitrary frames in MONITOR mode) ++ */ ++ tmp.macmode = (adev->mode != ACX_MODE_MONITOR ? adev->mode : ACX_MODE_2_STA); ++ tmp.channel = adev->channel; ++ tmp.essid_len = adev->essid_len; ++ /* NOTE: the code memcpy'd essid_len + 1 before, which is WRONG! */ ++ memcpy(tmp.essid, adev->essid, tmp.essid_len); ++ acx_s_issue_cmd(adev, ACX1xx_CMD_JOIN, &tmp, tmp.essid_len + 0x11); ++ ++ log(L_ASSOC|L_DEBUG, "BSS_Type = %u\n", tmp.macmode); ++ acxlog_mac(L_ASSOC|L_DEBUG, "JoinBSSID MAC:", adev->bssid, "\n"); ++ ++ acx_update_capabilities(adev); ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_s_cmd_start_scan ++** ++** Issue scan command to the hardware ++** ++** unified function for both ACX111 and ACX100 ++*/ ++static void ++acx_s_scan_chan(acx_device_t *adev) ++{ ++ union { ++ acx111_scan_t acx111; ++ acx100_scan_t acx100; ++ } s; ++ ++ FN_ENTER; ++ ++ memset(&s, 0, sizeof(s)); ++ ++ /* first common positions... */ ++ ++ s.acx111.count = cpu_to_le16(adev->scan_count); ++ s.acx111.rate = adev->scan_rate; ++ s.acx111.options = adev->scan_mode; ++ s.acx111.chan_duration = cpu_to_le16(adev->scan_duration); ++ s.acx111.max_probe_delay = cpu_to_le16(adev->scan_probe_delay); ++ ++ /* ...then differences */ ++ ++ if (IS_ACX111(adev)) { ++ s.acx111.channel_list_select = 0; /* scan every allowed channel */ ++ /*s.acx111.channel_list_select = 1;*/ /* scan given channels */ ++ /*s.acx111.modulation = 0x40;*/ /* long preamble? OFDM? -> only for active scan */ ++ s.acx111.modulation = 0; ++ /*s.acx111.channel_list[0] = 6; ++ s.acx111.channel_list[1] = 4;*/ ++ } else { ++ s.acx100.start_chan = cpu_to_le16(1); ++ s.acx100.flags = cpu_to_le16(0x8000); ++ } ++ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_SCAN, &s, sizeof(s)); ++ FN_EXIT0; ++} ++ ++ ++void ++acx_s_cmd_start_scan(acx_device_t *adev) ++{ ++ /* time_before check is 'just in case' thing */ ++ if (!(adev->irq_status & HOST_INT_SCAN_COMPLETE) ++ && time_before(jiffies, adev->scan_start + 10*HZ) ++ ) { ++ log(L_INIT, "start_scan: seems like previous scan " ++ "is still running. Not starting anew. Please report\n"); ++ return; ++ } ++ ++ log(L_INIT, "starting radio scan\n"); ++ /* remember that fw is commanded to do scan */ ++ adev->scan_start = jiffies; ++ CLEAR_BIT(adev->irq_status, HOST_INT_SCAN_COMPLETE); ++ /* issue it */ ++ acx_s_scan_chan(adev); ++} ++ ++ ++/*********************************************************************** ++** acx111 feature config ++*/ ++static int ++acx111_s_get_feature_config(acx_device_t *adev, ++ u32 *feature_options, u32 *data_flow_options) ++{ ++ struct acx111_ie_feature_config feat; ++ ++ if (!IS_ACX111(adev)) { ++ return NOT_OK; ++ } ++ ++ memset(&feat, 0, sizeof(feat)); ++ ++ if (OK != acx_s_interrogate(adev, &feat, ACX1xx_IE_FEATURE_CONFIG)) { ++ return NOT_OK; ++ } ++ log(L_DEBUG, ++ "got Feature option:0x%X, DataFlow option: 0x%X\n", ++ feat.feature_options, ++ feat.data_flow_options); ++ ++ if (feature_options) ++ *feature_options = le32_to_cpu(feat.feature_options); ++ if (data_flow_options) ++ *data_flow_options = le32_to_cpu(feat.data_flow_options); ++ ++ return OK; ++} ++ ++static int ++acx111_s_set_feature_config(acx_device_t *adev, ++ u32 feature_options, u32 data_flow_options, ++ unsigned int mode /* 0 == remove, 1 == add, 2 == set */) ++{ ++ struct acx111_ie_feature_config feat; ++ ++ if (!IS_ACX111(adev)) { ++ return NOT_OK; ++ } ++ ++ if ((mode < 0) || (mode > 2)) ++ return NOT_OK; ++ ++ if (mode != 2) ++ /* need to modify old data */ ++ acx111_s_get_feature_config(adev, &feat.feature_options, &feat.data_flow_options); ++ else { ++ /* need to set a completely new value */ ++ feat.feature_options = 0; ++ feat.data_flow_options = 0; ++ } ++ ++ if (mode == 0) { /* remove */ ++ CLEAR_BIT(feat.feature_options, cpu_to_le32(feature_options)); ++ CLEAR_BIT(feat.data_flow_options, cpu_to_le32(data_flow_options)); ++ } else { /* add or set */ ++ SET_BIT(feat.feature_options, cpu_to_le32(feature_options)); ++ SET_BIT(feat.data_flow_options, cpu_to_le32(data_flow_options)); ++ } ++ ++ log(L_DEBUG, ++ "old: feature 0x%08X dataflow 0x%08X. mode: %u\n" ++ "new: feature 0x%08X dataflow 0x%08X\n", ++ feature_options, data_flow_options, mode, ++ le32_to_cpu(feat.feature_options), ++ le32_to_cpu(feat.data_flow_options)); ++ ++ if (OK != acx_s_configure(adev, &feat, ACX1xx_IE_FEATURE_CONFIG)) { ++ return NOT_OK; ++ } ++ ++ return OK; ++} ++ ++static inline int ++acx111_s_feature_off(acx_device_t *adev, u32 f, u32 d) ++{ ++ return acx111_s_set_feature_config(adev, f, d, 0); ++} ++static inline int ++acx111_s_feature_on(acx_device_t *adev, u32 f, u32 d) ++{ ++ return acx111_s_set_feature_config(adev, f, d, 1); ++} ++static inline int ++acx111_s_feature_set(acx_device_t *adev, u32 f, u32 d) ++{ ++ return acx111_s_set_feature_config(adev, f, d, 2); ++} ++ ++ ++/*********************************************************************** ++** acx100_s_init_memory_pools ++*/ ++static int ++acx100_s_init_memory_pools(acx_device_t *adev, const acx_ie_memmap_t *mmt) ++{ ++ acx100_ie_memblocksize_t MemoryBlockSize; ++ acx100_ie_memconfigoption_t MemoryConfigOption; ++ int TotalMemoryBlocks; ++ int RxBlockNum; ++ int TotalRxBlockSize; ++ int TxBlockNum; ++ int TotalTxBlockSize; ++ ++ FN_ENTER; ++ ++ /* Let's see if we can follow this: ++ first we select our memory block size (which I think is ++ completely arbitrary) */ ++ MemoryBlockSize.size = cpu_to_le16(adev->memblocksize); ++ ++ /* Then we alert the card to our decision of block size */ ++ if (OK != acx_s_configure(adev, &MemoryBlockSize, ACX100_IE_BLOCK_SIZE)) { ++ goto bad; ++ } ++ ++ /* We figure out how many total blocks we can create, using ++ the block size we chose, and the beginning and ending ++ memory pointers, i.e.: end-start/size */ ++ TotalMemoryBlocks = (le32_to_cpu(mmt->PoolEnd) - le32_to_cpu(mmt->PoolStart)) / adev->memblocksize; ++ ++ log(L_DEBUG, "TotalMemoryBlocks=%u (%u bytes)\n", ++ TotalMemoryBlocks, TotalMemoryBlocks*adev->memblocksize); ++ ++ /* MemoryConfigOption.DMA_config bitmask: ++ access to ACX memory is to be done: ++ 0x00080000 using PCI conf space?! ++ 0x00040000 using IO instructions? ++ 0x00000000 using memory access instructions ++ 0x00020000 using local memory block linked list (else what?) ++ 0x00010000 using host indirect descriptors (else host must access ACX memory?) ++ */ ++#if defined (ACX_MEM) ++ /* ++ * ACX ignores DMA_config for generic slave mode. ++ */ ++ MemoryConfigOption.DMA_config = 0; ++ /* Declare start of the Rx host pool */ ++ MemoryConfigOption.pRxHostDesc = cpu2acx(0); ++ log(L_DEBUG, "pRxHostDesc 0x%08X, rxhostdesc_startphy 0x%lX\n", ++ acx2cpu(MemoryConfigOption.pRxHostDesc), ++ (long)adev->rxhostdesc_startphy); ++#else ++ if (IS_PCI(adev)) { ++ MemoryConfigOption.DMA_config = cpu_to_le32(0x30000); ++ /* Declare start of the Rx host pool */ ++ MemoryConfigOption.pRxHostDesc = cpu2acx(adev->rxhostdesc_startphy); ++ log(L_DEBUG, "pRxHostDesc 0x%08X, rxhostdesc_startphy 0x%lX\n", ++ acx2cpu(MemoryConfigOption.pRxHostDesc), ++ (long)adev->rxhostdesc_startphy); ++ } else { ++ MemoryConfigOption.DMA_config = cpu_to_le32(0x20000); ++ } ++#endif ++ ++ /* 50% of the allotment of memory blocks go to tx descriptors */ ++ TxBlockNum = TotalMemoryBlocks / 2; ++ MemoryConfigOption.TxBlockNum = cpu_to_le16(TxBlockNum); ++ ++ /* and 50% go to the rx descriptors */ ++ RxBlockNum = TotalMemoryBlocks - TxBlockNum; ++ MemoryConfigOption.RxBlockNum = cpu_to_le16(RxBlockNum); ++ ++ /* size of the tx and rx descriptor queues */ ++ TotalTxBlockSize = TxBlockNum * adev->memblocksize; ++ TotalRxBlockSize = RxBlockNum * adev->memblocksize; ++ log(L_DEBUG, "TxBlockNum %u RxBlockNum %u TotalTxBlockSize %u " ++ "TotalTxBlockSize %u\n", TxBlockNum, RxBlockNum, ++ TotalTxBlockSize, TotalRxBlockSize); ++ ++ ++ /* align the tx descriptor queue to an alignment of 0x20 (32 bytes) */ ++ MemoryConfigOption.rx_mem = ++ cpu_to_le32((le32_to_cpu(mmt->PoolStart) + 0x1f) & ~0x1f); ++ ++ /* align the rx descriptor queue to units of 0x20 ++ * and offset it by the tx descriptor queue */ ++ MemoryConfigOption.tx_mem = ++ cpu_to_le32((le32_to_cpu(mmt->PoolStart) + TotalRxBlockSize + 0x1f) & ~0x1f); ++ log(L_DEBUG, "rx_mem %08X rx_mem %08X\n", ++ MemoryConfigOption.tx_mem, MemoryConfigOption.rx_mem); ++ ++ /* alert the device to our decision */ ++ if (OK != acx_s_configure(adev, &MemoryConfigOption, ACX1xx_IE_MEMORY_CONFIG_OPTIONS)) { ++ goto bad; ++ } ++ ++ /* and tell the device to kick it into gear */ ++ if (OK != acx_s_issue_cmd(adev, ACX100_CMD_INIT_MEMORY, NULL, 0)) { ++ goto bad; ++ } ++#ifdef ACX_MEM ++ /* ++ * slave memory interface has to manage the transmit pools for the ACX, ++ * so it needs to know what we chose here. ++ */ ++ adev->acx_txbuf_start = MemoryConfigOption.tx_mem; ++ adev->acx_txbuf_numblocks = MemoryConfigOption.TxBlockNum; ++#endif ++ ++ FN_EXIT1(OK); ++ return OK; ++bad: ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*********************************************************************** ++** acx100_s_create_dma_regions ++** ++** Note that this fn messes up heavily with hardware, but we cannot ++** lock it (we need to sleep). Not a problem since IRQs can't happen ++*/ ++static int ++acx100_s_create_dma_regions(acx_device_t *adev) ++{ ++ acx100_ie_queueconfig_t queueconf; ++ acx_ie_memmap_t memmap; ++ int res = NOT_OK; ++ u32 tx_queue_start, rx_queue_start; ++ ++ FN_ENTER; ++ ++ /* read out the acx100 physical start address for the queues */ ++ if (OK != acx_s_interrogate(adev, &memmap, ACX1xx_IE_MEMORY_MAP)) { ++ goto fail; ++ } ++ ++ tx_queue_start = le32_to_cpu(memmap.QueueStart); ++ rx_queue_start = tx_queue_start + TX_CNT * sizeof(txdesc_t); ++ ++ log(L_DEBUG, "initializing Queue Indicator\n"); ++ ++ memset(&queueconf, 0, sizeof(queueconf)); ++ ++ /* Not needed for PCI or slave memory, so we can avoid setting them altogether */ ++ if (IS_USB(adev)) { ++ queueconf.NumTxDesc = USB_TX_CNT; ++ queueconf.NumRxDesc = USB_RX_CNT; ++ } ++ ++ /* calculate size of queues */ ++ queueconf.AreaSize = cpu_to_le32( ++ TX_CNT * sizeof(txdesc_t) + ++ RX_CNT * sizeof(rxdesc_t) + 8 ++ ); ++ queueconf.NumTxQueues = 1; /* number of tx queues */ ++ /* sets the beginning of the tx descriptor queue */ ++ queueconf.TxQueueStart = memmap.QueueStart; ++ /* done by memset: queueconf.TxQueuePri = 0; */ ++ queueconf.RxQueueStart = cpu_to_le32(rx_queue_start); ++ queueconf.QueueOptions = 1; /* auto reset descriptor */ ++ /* sets the end of the rx descriptor queue */ ++ queueconf.QueueEnd = cpu_to_le32( ++ rx_queue_start + RX_CNT * sizeof(rxdesc_t) ++ ); ++ /* sets the beginning of the next queue */ ++ queueconf.HostQueueEnd = cpu_to_le32(le32_to_cpu(queueconf.QueueEnd) + 8); ++ if (OK != acx_s_configure(adev, &queueconf, ACX1xx_IE_QUEUE_CONFIG)) { ++ goto fail; ++ } ++ ++#if defined (ACX_MEM) ++ /* sets the beginning of the rx descriptor queue, after the tx descrs */ ++ adev->acx_queue_indicator = ++ (queueindicator_t *) le32_to_cpu (queueconf.QueueEnd); ++ if (OK != acxmem_s_create_hostdesc_queues(adev)) ++ goto fail; ++ ++ acxmem_create_desc_queues(adev, tx_queue_start, rx_queue_start); ++#else ++ if (IS_PCI(adev)) { ++ /* sets the beginning of the rx descriptor queue, after the tx descrs */ ++ if (OK != acxpci_s_create_hostdesc_queues(adev)) ++ goto fail; ++ acxpci_create_desc_queues(adev, tx_queue_start, rx_queue_start); ++ } ++#endif ++ ++ if (OK != acx_s_interrogate(adev, &memmap, ACX1xx_IE_MEMORY_MAP)) { ++ goto fail; ++ } ++ ++ /* ++ * Have to make sure we skip past the Queue Indicator (QueueEnd) and Host Queue Indicator ++ * maps, each of which are 8 bytes and follow immediately after the transmit and ++ * receive queues. ++ */ ++ memmap.PoolStart = cpu_to_le32( ++ (le32_to_cpu(memmap.QueueEnd) + 4 + 0x1f) & ~0x1f ++ ); ++ ++ if (OK != acx_s_configure(adev, &memmap, ACX1xx_IE_MEMORY_MAP)) { ++ goto fail; ++ } ++ ++ if (OK != acx100_s_init_memory_pools(adev, &memmap)) { ++ goto fail; ++ } ++ ++ res = OK; ++ goto end; ++ ++fail: ++ acx_s_msleep(1000); /* ? */ ++#if defined (ACX_MEM) ++ acxmem_free_desc_queues(adev); ++#else ++ if (IS_PCI(adev)) ++ acxpci_free_desc_queues(adev); ++#endif ++end: ++ FN_EXIT1(res); ++ return res; ++} ++ ++ ++/*********************************************************************** ++** acx111_s_create_dma_regions ++** ++** Note that this fn messes heavily with hardware, but we cannot ++** lock it (we need to sleep). Not a problem since IRQs can't happen ++*/ ++#define ACX111_PERCENT(percent) ((percent)/5) ++ ++static int ++acx111_s_create_dma_regions(acx_device_t *adev) ++{ ++ struct acx111_ie_memoryconfig memconf; ++ struct acx111_ie_queueconfig queueconf; ++ u32 tx_queue_start, rx_queue_start; ++ ++ FN_ENTER; ++ ++ /* Calculate memory positions and queue sizes */ ++ ++ /* Set up our host descriptor pool + data pool */ ++#if defined (ACX_MEM) ++ if (OK != acxmem_s_create_hostdesc_queues(adev)) ++ goto fail; ++#else ++ if (IS_PCI(adev)) { ++ if (OK != acxpci_s_create_hostdesc_queues(adev)) ++ goto fail; ++ } ++#endif ++ ++ memset(&memconf, 0, sizeof(memconf)); ++ /* the number of STAs (STA contexts) to support ++ ** NB: was set to 1 and everything seemed to work nevertheless... */ ++ memconf.no_of_stations = cpu_to_le16(VEC_SIZE(adev->sta_list)); ++ /* specify the memory block size. Default is 256 */ ++ memconf.memory_block_size = cpu_to_le16(adev->memblocksize); ++ /* let's use 50%/50% for tx/rx (specify percentage, units of 5%) */ ++ memconf.tx_rx_memory_block_allocation = ACX111_PERCENT(50); ++ /* set the count of our queues ++ ** NB: struct acx111_ie_memoryconfig shall be modified ++ ** if we ever will switch to more than one rx and/or tx queue */ ++ memconf.count_rx_queues = 1; ++ memconf.count_tx_queues = 1; ++ /* 0 == Busmaster Indirect Memory Organization, which is what we want ++ * (using linked host descs with their allocated mem). ++ * 2 == Generic Bus Slave */ ++ /* done by memset: memconf.options = 0; */ ++ /* let's use 25% for fragmentations and 75% for frame transfers ++ * (specified in units of 5%) */ ++ memconf.fragmentation = ACX111_PERCENT(75); ++ /* Rx descriptor queue config */ ++ memconf.rx_queue1_count_descs = RX_CNT; ++ memconf.rx_queue1_type = 7; /* must be set to 7 */ ++ /* done by memset: memconf.rx_queue1_prio = 0; low prio */ ++#if defined (ACX_MEM) ++ memconf.rx_queue1_host_rx_start = cpu2acx(adev->rxhostdesc_startphy); ++#else ++ if (IS_PCI(adev)) { ++ memconf.rx_queue1_host_rx_start = cpu2acx(adev->rxhostdesc_startphy); ++ } ++#endif ++ /* Tx descriptor queue config */ ++ memconf.tx_queue1_count_descs = TX_CNT; ++ /* done by memset: memconf.tx_queue1_attributes = 0; lowest priority */ ++ ++ /* NB1: this looks wrong: (memconf,ACX1xx_IE_QUEUE_CONFIG), ++ ** (queueconf,ACX1xx_IE_MEMORY_CONFIG_OPTIONS) look swapped, eh? ++ ** But it is actually correct wrt IE numbers. ++ ** NB2: sizeof(memconf) == 28 == 0x1c but configure(ACX1xx_IE_QUEUE_CONFIG) ++ ** writes 0x20 bytes (because same IE for acx100 uses struct acx100_ie_queueconfig ++ ** which is 4 bytes larger. what a mess. TODO: clean it up) */ ++ if (OK != acx_s_configure(adev, &memconf, ACX1xx_IE_QUEUE_CONFIG)) { ++ goto fail; ++ } ++ ++ acx_s_interrogate(adev, &queueconf, ACX1xx_IE_MEMORY_CONFIG_OPTIONS); ++ ++ tx_queue_start = le32_to_cpu(queueconf.tx1_queue_address); ++ rx_queue_start = le32_to_cpu(queueconf.rx1_queue_address); ++ ++ log(L_INIT, "dump queue head (from card):\n" ++ "len: %u\n" ++ "tx_memory_block_address: %X\n" ++ "rx_memory_block_address: %X\n" ++ "tx1_queue address: %X\n" ++ "rx1_queue address: %X\n", ++ le16_to_cpu(queueconf.len), ++ le32_to_cpu(queueconf.tx_memory_block_address), ++ le32_to_cpu(queueconf.rx_memory_block_address), ++ tx_queue_start, ++ rx_queue_start); ++ ++#if defined (ACX_MEM) ++ acxmem_create_desc_queues(adev, tx_queue_start, rx_queue_start); ++#else ++ if (IS_PCI(adev)) ++ acxpci_create_desc_queues(adev, tx_queue_start, rx_queue_start); ++#endif ++ ++ FN_EXIT1(OK); ++ return OK; ++fail: ++#if defined (ACX_MEM) ++ acxmem_free_desc_queues(adev); ++#else ++ if (IS_PCI(adev)) ++ acxpci_free_desc_queues(adev); ++#endif ++ ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*********************************************************************** ++*/ ++static void ++acx_s_initialize_rx_config(acx_device_t *adev) ++{ ++ struct { ++ u16 id; ++ u16 len; ++ u16 rx_cfg1; ++ u16 rx_cfg2; ++ } ACX_PACKED cfg; ++ ++ switch (adev->mode) { ++ case ACX_MODE_OFF: ++ adev->rx_config_1 = (u16) (0 ++ /* | RX_CFG1_INCLUDE_RXBUF_HDR */ ++ /* | RX_CFG1_FILTER_SSID */ ++ /* | RX_CFG1_FILTER_BCAST */ ++ /* | RX_CFG1_RCV_MC_ADDR1 */ ++ /* | RX_CFG1_RCV_MC_ADDR0 */ ++ /* | RX_CFG1_FILTER_ALL_MULTI */ ++ /* | RX_CFG1_FILTER_BSSID */ ++ /* | RX_CFG1_FILTER_MAC */ ++ /* | RX_CFG1_RCV_PROMISCUOUS */ ++ /* | RX_CFG1_INCLUDE_FCS */ ++ /* | RX_CFG1_INCLUDE_PHY_HDR */ ++ ); ++ adev->rx_config_2 = (u16) (0 ++ /*| RX_CFG2_RCV_ASSOC_REQ */ ++ /*| RX_CFG2_RCV_AUTH_FRAMES */ ++ /*| RX_CFG2_RCV_BEACON_FRAMES */ ++ /*| RX_CFG2_RCV_CONTENTION_FREE */ ++ /*| RX_CFG2_RCV_CTRL_FRAMES */ ++ /*| RX_CFG2_RCV_DATA_FRAMES */ ++ /*| RX_CFG2_RCV_BROKEN_FRAMES */ ++ /*| RX_CFG2_RCV_MGMT_FRAMES */ ++ /*| RX_CFG2_RCV_PROBE_REQ */ ++ /*| RX_CFG2_RCV_PROBE_RESP */ ++ /*| RX_CFG2_RCV_ACK_FRAMES */ ++ /*| RX_CFG2_RCV_OTHER */ ++ ); ++ break; ++ case ACX_MODE_MONITOR: ++ adev->rx_config_1 = (u16) (0 ++ /* | RX_CFG1_INCLUDE_RXBUF_HDR */ ++ /* | RX_CFG1_FILTER_SSID */ ++ /* | RX_CFG1_FILTER_BCAST */ ++ /* | RX_CFG1_RCV_MC_ADDR1 */ ++ /* | RX_CFG1_RCV_MC_ADDR0 */ ++ /* | RX_CFG1_FILTER_ALL_MULTI */ ++ /* | RX_CFG1_FILTER_BSSID */ ++ /* | RX_CFG1_FILTER_MAC */ ++ | RX_CFG1_RCV_PROMISCUOUS ++ /* | RX_CFG1_INCLUDE_FCS */ ++ /* | RX_CFG1_INCLUDE_PHY_HDR */ ++ ); ++ adev->rx_config_2 = (u16) (0 ++ | RX_CFG2_RCV_ASSOC_REQ ++ | RX_CFG2_RCV_AUTH_FRAMES ++ | RX_CFG2_RCV_BEACON_FRAMES ++ | RX_CFG2_RCV_CONTENTION_FREE ++ | RX_CFG2_RCV_CTRL_FRAMES ++ | RX_CFG2_RCV_DATA_FRAMES ++ | RX_CFG2_RCV_BROKEN_FRAMES ++ | RX_CFG2_RCV_MGMT_FRAMES ++ | RX_CFG2_RCV_PROBE_REQ ++ | RX_CFG2_RCV_PROBE_RESP ++ | RX_CFG2_RCV_ACK_FRAMES ++ | RX_CFG2_RCV_OTHER ++ ); ++ break; ++ default: ++ adev->rx_config_1 = (u16) (0 ++ /* | RX_CFG1_INCLUDE_RXBUF_HDR */ ++ /* | RX_CFG1_FILTER_SSID */ ++ /* | RX_CFG1_FILTER_BCAST */ ++ /* | RX_CFG1_RCV_MC_ADDR1 */ ++ /* | RX_CFG1_RCV_MC_ADDR0 */ ++ /* | RX_CFG1_FILTER_ALL_MULTI */ ++ /* | RX_CFG1_FILTER_BSSID */ ++ | RX_CFG1_FILTER_MAC ++ /* | RX_CFG1_RCV_PROMISCUOUS */ ++ /* | RX_CFG1_INCLUDE_FCS */ ++ /* | RX_CFG1_INCLUDE_PHY_HDR */ ++ ); ++ adev->rx_config_2 = (u16) (0 ++ | RX_CFG2_RCV_ASSOC_REQ ++ | RX_CFG2_RCV_AUTH_FRAMES ++ | RX_CFG2_RCV_BEACON_FRAMES ++ | RX_CFG2_RCV_CONTENTION_FREE ++ | RX_CFG2_RCV_CTRL_FRAMES ++ | RX_CFG2_RCV_DATA_FRAMES ++ /*| RX_CFG2_RCV_BROKEN_FRAMES */ ++ | RX_CFG2_RCV_MGMT_FRAMES ++ | RX_CFG2_RCV_PROBE_REQ ++ | RX_CFG2_RCV_PROBE_RESP ++ /*| RX_CFG2_RCV_ACK_FRAMES */ ++ | RX_CFG2_RCV_OTHER ++ ); ++ break; ++ } ++ adev->rx_config_1 |= RX_CFG1_INCLUDE_RXBUF_HDR; ++ ++ if ((adev->rx_config_1 & RX_CFG1_INCLUDE_PHY_HDR) ++ || (adev->firmware_numver >= 0x02000000)) ++ adev->phy_header_len = IS_ACX111(adev) ? 8 : 4; ++ else ++ adev->phy_header_len = 0; ++ ++ log(L_INIT, "setting RXconfig to %04X:%04X\n", ++ adev->rx_config_1, adev->rx_config_2); ++ cfg.rx_cfg1 = cpu_to_le16(adev->rx_config_1); ++ cfg.rx_cfg2 = cpu_to_le16(adev->rx_config_2); ++ acx_s_configure(adev, &cfg, ACX1xx_IE_RXCONFIG); ++} ++ ++ ++/*********************************************************************** ++** acx_s_set_defaults ++*/ ++void ++acx_s_set_defaults(acx_device_t *adev) ++{ ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ /* do it before getting settings, prevent bogus channel 0 warning */ ++ adev->channel = 1; ++ ++ /* query some settings from the card. ++ * NOTE: for some settings, e.g. CCA and ED (ACX100!), an initial ++ * query is REQUIRED, otherwise the card won't work correctly! */ ++ adev->get_mask = GETSET_ANTENNA|GETSET_SENSITIVITY|GETSET_STATION_ID|GETSET_REG_DOMAIN; ++ /* Only ACX100 supports ED and CCA */ ++ if (IS_ACX100(adev)) ++ adev->get_mask |= GETSET_CCA|GETSET_ED_THRESH; ++ ++ acx_s_update_card_settings(adev); ++ ++ acx_lock(adev, flags); ++ ++ /* set our global interrupt mask */ ++#if defined (ACX_MEM) ++ acxmem_set_interrupt_mask(adev); ++#else ++ if (IS_PCI(adev)) ++ acxpci_set_interrupt_mask(adev); ++#endif ++ ++ adev->led_power = 1; /* LED is active on startup */ ++ adev->brange_max_quality = 60; /* LED blink max quality is 60 */ ++ adev->brange_time_last_state_change = jiffies; ++ ++ /* copy the MAC address we just got from the card ++ * into our MAC address used during current 802.11 session */ ++ MAC_COPY(adev->dev_addr, adev->ndev->dev_addr); ++ MAC_BCAST(adev->ap); ++ ++ adev->essid_len = ++ snprintf(adev->essid, sizeof(adev->essid), "STA%02X%02X%02X", ++ adev->dev_addr[3], adev->dev_addr[4], adev->dev_addr[5]); ++ adev->essid_active = 1; ++ ++ /* we have a nick field to waste, so why not abuse it ++ * to announce the driver version? ;-) */ ++ strncpy(adev->nick, "acx " ACX_RELEASE, IW_ESSID_MAX_SIZE); ++ ++#if defined (ACX_MEM) ++ adev->reg_dom_id = adev->cfgopt_domains.list[0]; ++#else ++ if (IS_PCI(adev)) { /* FIXME: this should be made to apply to USB, too! */ ++ /* first regulatory domain entry in EEPROM == default reg. domain */ ++ adev->reg_dom_id = adev->cfgopt_domains.list[0]; ++ } ++#endif ++ ++ /* 0xffff would be better, but then we won't get a "scan complete" ++ * interrupt, so our current infrastructure will fail: */ ++ adev->scan_count = 1; ++ adev->scan_mode = ACX_SCAN_OPT_ACTIVE; ++ adev->scan_duration = 100; ++ adev->scan_probe_delay = 200; ++ /* reported to break scanning: adev->scan_probe_delay = adev->cfgopt_probe_delay; */ ++ adev->scan_rate = ACX_SCAN_RATE_1; ++ ++ adev->mode = ACX_MODE_2_STA; ++ adev->auth_alg = WLAN_AUTH_ALG_OPENSYSTEM; ++ adev->listen_interval = 100; ++ adev->beacon_interval = DEFAULT_BEACON_INTERVAL; ++ adev->dtim_interval = DEFAULT_DTIM_INTERVAL; ++ ++ adev->msdu_lifetime = DEFAULT_MSDU_LIFETIME; ++ ++ adev->rts_threshold = DEFAULT_RTS_THRESHOLD; ++ adev->frag_threshold = 2346; ++ ++ /* use standard default values for retry limits */ ++ adev->short_retry = 7; /* max. retries for (short) non-RTS packets */ ++ adev->long_retry = 4; /* max. retries for long (RTS) packets */ ++ ++ adev->preamble_mode = 2; /* auto */ ++ adev->fallback_threshold = 3; ++ adev->stepup_threshold = 10; ++ adev->rate_bcast = RATE111_1; ++ adev->rate_bcast100 = RATE100_1; ++ adev->rate_basic = RATE111_1 | RATE111_2; ++ adev->rate_auto = 1; ++ if (IS_ACX111(adev)) { ++ adev->rate_oper = RATE111_ALL; ++ } else { ++ adev->rate_oper = RATE111_ACX100_COMPAT; ++ } ++ ++ /* Supported Rates element - the rates here are given in units of ++ * 500 kbit/s, plus 0x80 added. See 802.11-1999.pdf item 7.3.2.2 */ ++ acx_l_update_ratevector(adev); ++ ++ /* set some more defaults */ ++ if (IS_ACX111(adev)) { ++ /* 30mW (15dBm) is default, at least in my acx111 card: */ ++ adev->tx_level_dbm = 15; ++ } else { ++ /* don't use max. level, since it might be dangerous ++ * (e.g. WRT54G people experience ++ * excessive Tx power damage!) */ ++ adev->tx_level_dbm = 18; ++ /* ++ * Lower power for the iPaq hx4700 ++ */ ++ if (IS_MEM(adev)) { ++ adev->tx_level_dbm = 14; ++ } ++ } ++ /* adev->tx_level_auto = 1; */ ++ if (IS_ACX111(adev)) { ++ /* start with sensitivity level 1 out of 3: */ ++ adev->sensitivity = 1; ++ } ++ ++/* #define ENABLE_POWER_SAVE */ ++#ifdef ENABLE_POWER_SAVE ++ adev->ps_wakeup_cfg = PS_CFG_ENABLE | PS_CFG_WAKEUP_ALL_BEAC; ++ adev->ps_listen_interval = 1; ++ adev->ps_options = PS_OPT_ENA_ENHANCED_PS | PS_OPT_TX_PSPOLL | PS_OPT_STILL_RCV_BCASTS; ++ adev->ps_hangover_period = 30; ++ adev->ps_enhanced_transition_time = 0; ++#else ++ adev->ps_wakeup_cfg = 0; ++ adev->ps_listen_interval = 0; ++ adev->ps_options = 0; ++ adev->ps_hangover_period = 0; ++ adev->ps_enhanced_transition_time = 0; ++#endif ++ ++ /* These settings will be set in fw on ifup */ ++ adev->set_mask = 0 ++ | GETSET_RETRY ++ | SET_MSDU_LIFETIME ++ /* configure card to do rate fallback when in auto rate mode */ ++ | SET_RATE_FALLBACK ++ | SET_RXCONFIG ++ | GETSET_TXPOWER ++ /* better re-init the antenna value we got above */ ++ | GETSET_ANTENNA ++#if POWER_SAVE_80211 ++ | GETSET_POWER_80211 ++#endif ++ ; ++ ++ acx_unlock(adev, flags); ++ acx_lock_unhold(); /* hold time 844814 CPU ticks @2GHz */ ++ ++ acx_s_initialize_rx_config(adev); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** FIXME: this should be solved in a general way for all radio types ++** by decoding the radio firmware module, ++** since it probably has some standard structure describing how to ++** set the power level of the radio module which it controls. ++** Or maybe not, since the radio module probably has a function interface ++** instead which then manages Tx level programming :-\ ++*/ ++static int ++acx111_s_set_tx_level(acx_device_t *adev, u8 level_dbm) ++{ ++ struct acx111_ie_tx_level tx_level; ++ ++ /* my acx111 card has two power levels in its configoptions (== EEPROM): ++ * 1 (30mW) [15dBm] ++ * 2 (10mW) [10dBm] ++ * For now, just assume all other acx111 cards have the same. ++ * FIXME: Ideally we would query it here, but we first need a ++ * standard way to query individual configoptions easily. ++ * Well, now we have proper cfgopt txpower variables, but this still ++ * hasn't been done yet, since it also requires dBm <-> mW conversion here... */ ++ if (level_dbm <= 12) { ++ tx_level.level = 2; /* 10 dBm */ ++ adev->tx_level_dbm = 10; ++ } else { ++ tx_level.level = 1; /* 15 dBm */ ++ adev->tx_level_dbm = 15; ++ } ++ if (level_dbm != adev->tx_level_dbm) ++ log(L_INIT, "acx111 firmware has specific " ++ "power levels only: adjusted %d dBm to %d dBm!\n", ++ level_dbm, adev->tx_level_dbm); ++ ++ return acx_s_configure(adev, &tx_level, ACX1xx_IE_DOT11_TX_POWER_LEVEL); ++} ++ ++static int ++acx_s_set_tx_level(acx_device_t *adev, u8 level_dbm) ++{ ++ if (IS_ACX111(adev)) { ++ return acx111_s_set_tx_level(adev, level_dbm); ++ } ++#if defined (ACX_MEM) ++ return acx100mem_s_set_tx_level(adev, level_dbm); ++#else ++ if (IS_PCI(adev)) { ++ return acx100pci_s_set_tx_level(adev, level_dbm); ++ } ++#endif ++ return OK; ++} ++ ++ ++/*********************************************************************** ++*/ ++#ifdef UNUSED ++/* Returns the current tx level (ACX111) */ ++static u8 ++acx111_s_get_tx_level(acx_device_t *adev) ++{ ++ struct acx111_ie_tx_level tx_level; ++ ++ tx_level.level = 0; ++ acx_s_interrogate(adev, &tx_level, ACX1xx_IE_DOT11_TX_POWER_LEVEL); ++ return tx_level.level; ++} ++#endif ++ ++ ++/*********************************************************************** ++** acx_l_rxmonitor ++** Called from IRQ context only ++*/ ++static void ++acx_l_rxmonitor(acx_device_t *adev, const rxbuffer_t *rxbuf) ++{ ++ wlansniffrm_t *msg; ++ struct sk_buff *skb; ++ void *datap; ++ unsigned int skb_len; ++ int payload_offset; ++ ++ FN_ENTER; ++ ++ /* we are in big luck: the acx100 doesn't modify any of the fields */ ++ /* in the 802.11 frame. just pass this packet into the PF_PACKET */ ++ /* subsystem. yeah. */ ++ payload_offset = ((u8*)acx_get_wlan_hdr(adev, rxbuf) - (u8*)rxbuf); ++ skb_len = RXBUF_BYTES_USED(rxbuf) - payload_offset; ++ ++ /* sanity check */ ++ if (unlikely(skb_len > WLAN_A4FR_MAXLEN_WEP)) { ++ printk("%s: monitor mode panic: oversized frame!\n", ++ adev->ndev->name); ++ goto end; ++ } ++ ++ if (adev->ndev->type == ARPHRD_IEEE80211_PRISM) ++ skb_len += sizeof(*msg); ++ ++ /* allocate skb */ ++ skb = dev_alloc_skb(skb_len); ++ if (unlikely(!skb)) { ++ printk("%s: no memory for skb (%u bytes)\n", ++ adev->ndev->name, skb_len); ++ goto end; ++ } ++ ++ skb_put(skb, skb_len); ++ ++ if (adev->ndev->type == ARPHRD_IEEE80211) { ++ /* when in raw 802.11 mode, just copy frame as-is */ ++ datap = skb->data; ++ } else if (adev->ndev->type == ARPHRD_IEEE80211_PRISM) { ++ /* emulate prism header */ ++ msg = (wlansniffrm_t*)skb->data; ++ datap = msg + 1; ++ ++ msg->msgcode = WLANSNIFFFRM; ++ msg->msglen = sizeof(*msg); ++ strncpy(msg->devname, adev->ndev->name, sizeof(msg->devname)-1); ++ msg->devname[sizeof(msg->devname)-1] = '\0'; ++ ++ msg->hosttime.did = WLANSNIFFFRM_hosttime; ++ msg->hosttime.status = WLANITEM_STATUS_data_ok; ++ msg->hosttime.len = 4; ++ msg->hosttime.data = jiffies; ++ ++ msg->mactime.did = WLANSNIFFFRM_mactime; ++ msg->mactime.status = WLANITEM_STATUS_data_ok; ++ msg->mactime.len = 4; ++ msg->mactime.data = rxbuf->time; ++ ++ msg->channel.did = WLANSNIFFFRM_channel; ++ msg->channel.status = WLANITEM_STATUS_data_ok; ++ msg->channel.len = 4; ++ msg->channel.data = adev->channel; ++ ++ msg->rssi.did = WLANSNIFFFRM_rssi; ++ msg->rssi.status = WLANITEM_STATUS_no_value; ++ msg->rssi.len = 4; ++ msg->rssi.data = 0; ++ ++ msg->sq.did = WLANSNIFFFRM_sq; ++ msg->sq.status = WLANITEM_STATUS_no_value; ++ msg->sq.len = 4; ++ msg->sq.data = 0; ++ ++ msg->signal.did = WLANSNIFFFRM_signal; ++ msg->signal.status = WLANITEM_STATUS_data_ok; ++ msg->signal.len = 4; ++ msg->signal.data = rxbuf->phy_snr; ++ ++ msg->noise.did = WLANSNIFFFRM_noise; ++ msg->noise.status = WLANITEM_STATUS_data_ok; ++ msg->noise.len = 4; ++ msg->noise.data = rxbuf->phy_level; ++ ++ msg->rate.did = WLANSNIFFFRM_rate; ++ msg->rate.status = WLANITEM_STATUS_data_ok; ++ msg->rate.len = 4; ++ msg->rate.data = rxbuf->phy_plcp_signal / 5; ++ ++ msg->istx.did = WLANSNIFFFRM_istx; ++ msg->istx.status = WLANITEM_STATUS_data_ok; ++ msg->istx.len = 4; ++ msg->istx.data = 0; /* tx=0: it's not a tx packet */ ++ ++ skb_len -= sizeof(*msg); ++ ++ msg->frmlen.did = WLANSNIFFFRM_signal; ++ msg->frmlen.status = WLANITEM_STATUS_data_ok; ++ msg->frmlen.len = 4; ++ msg->frmlen.data = skb_len; ++ } else { ++ printk("acx: unsupported netdev type %d!\n", adev->ndev->type); ++ dev_kfree_skb(skb); ++ return; ++ } ++ ++ /* sanity check (keep it here) */ ++ if (unlikely((int)skb_len < 0)) { ++ printk("acx: skb_len=%d. Driver bug, please report\n", (int)skb_len); ++ dev_kfree_skb(skb); ++ return; ++ } ++ memcpy(datap, ((unsigned char*)rxbuf)+payload_offset, skb_len); ++ ++ skb->dev = adev->ndev; ++ skb->dev->last_rx = jiffies; ++ ++ skb_reset_mac_header(skb); ++ skb->ip_summed = CHECKSUM_NONE; ++ skb->pkt_type = PACKET_OTHERHOST; ++ skb->protocol = htons(ETH_P_80211_RAW); ++ netif_rx(skb); ++ ++ adev->stats.rx_packets++; ++ adev->stats.rx_bytes += skb->len; ++ ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_l_rx_ieee802_11_frame ++** ++** Called from IRQ context only ++*/ ++ ++/* All these contortions are for saner dup logging ++** ++** We want: (a) to know about excessive dups ++** (b) to not spam kernel log about occasional dups ++** ++** 1/64 threshold was chosen by running "ping -A" ++** It gave "rx: 59 DUPs in 2878 packets" only with 4 parallel ++** "ping -A" streams running. */ ++/* 2005-10-11: bumped up to 1/8 ++** subtract a $smallint from dup_count in order to ++** avoid "2 DUPs in 19 packets" messages */ ++static inline int ++acx_l_handle_dup(acx_device_t *adev, u16 seq) ++{ ++ if (adev->dup_count) { ++ adev->nondup_count++; ++ if (time_after(jiffies, adev->dup_msg_expiry)) { ++ /* Log only if more than 1 dup in 64 packets */ ++ if (adev->nondup_count/8 < adev->dup_count-5) { ++ printk(KERN_INFO "%s: rx: %d DUPs in " ++ "%d packets received in 10 secs\n", ++ adev->ndev->name, ++ adev->dup_count, ++ adev->nondup_count); ++ } ++ adev->dup_count = 0; ++ adev->nondup_count = 0; ++ } ++ } ++ if (unlikely(seq == adev->last_seq_ctrl)) { ++ if (!adev->dup_count++) ++ adev->dup_msg_expiry = jiffies + 10*HZ; ++ adev->stats.rx_errors++; ++ return 1; /* a dup */ ++ } ++ adev->last_seq_ctrl = seq; ++ return 0; ++} ++ ++static int ++acx_l_rx_ieee802_11_frame(acx_device_t *adev, rxbuffer_t *rxbuf) ++{ ++ unsigned int ftype, fstype; ++ const wlan_hdr_t *hdr; ++ int result = NOT_OK; ++ ++ FN_ENTER; ++ ++ hdr = acx_get_wlan_hdr(adev, rxbuf); ++ ++ /* see IEEE 802.11-1999.pdf chapter 7 "MAC frame formats" */ ++ if (unlikely((hdr->fc & WF_FC_PVERi) != 0)) { ++ printk_ratelimited(KERN_INFO "rx: unsupported 802.11 protocol\n"); ++ goto end; ++ } ++ ++ ftype = hdr->fc & WF_FC_FTYPEi; ++ fstype = hdr->fc & WF_FC_FSTYPEi; ++ ++ switch (ftype) { ++ /* check data frames first, for speed */ ++ case WF_FTYPE_DATAi: ++ switch (fstype) { ++ case WF_FSTYPE_DATAONLYi: ++ if (acx_l_handle_dup(adev, hdr->seq)) ++ break; /* a dup, simply discard it */ ++ ++ /* TODO: ++ if (WF_FC_FROMTODSi == (hdr->fc & WF_FC_FROMTODSi)) { ++ result = acx_l_process_data_frame_wds(adev, rxbuf); ++ break; ++ } ++ */ ++ ++ switch (adev->mode) { ++ case ACX_MODE_3_AP: ++ result = acx_l_process_data_frame_master(adev, rxbuf); ++ break; ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_2_STA: ++ result = acx_l_process_data_frame_client(adev, rxbuf); ++ break; ++ } ++ case WF_FSTYPE_DATA_CFACKi: ++ case WF_FSTYPE_DATA_CFPOLLi: ++ case WF_FSTYPE_DATA_CFACK_CFPOLLi: ++ case WF_FSTYPE_CFPOLLi: ++ case WF_FSTYPE_CFACK_CFPOLLi: ++ /* see above. ++ acx_process_class_frame(adev, rxbuf, 3); */ ++ break; ++ case WF_FSTYPE_NULLi: ++ /* acx_l_process_NULL_frame(adev, rxbuf, 3); */ ++ break; ++ /* FIXME: same here, see above */ ++ case WF_FSTYPE_CFACKi: ++ default: ++ break; ++ } ++ break; ++ case WF_FTYPE_MGMTi: ++ result = acx_l_process_mgmt_frame(adev, rxbuf); ++ break; ++ case WF_FTYPE_CTLi: ++ if (fstype == WF_FSTYPE_PSPOLLi) ++ result = OK; ++ /* this call is irrelevant, since ++ * acx_process_class_frame is a stub, so return ++ * immediately instead. ++ * return acx_process_class_frame(adev, rxbuf, 3); */ ++ break; ++ default: ++ break; ++ } ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_l_process_rxbuf ++** ++** NB: used by USB code also ++*/ ++void ++acx_l_process_rxbuf(acx_device_t *adev, rxbuffer_t *rxbuf) ++{ ++ struct wlan_hdr *hdr; ++ unsigned int qual; ++ int buf_len; ++ u16 fc; ++ ++ hdr = acx_get_wlan_hdr(adev, rxbuf); ++ fc = le16_to_cpu(hdr->fc); ++ /* length of frame from control field to first byte of FCS */ ++ buf_len = RXBUF_BYTES_RCVD(adev, rxbuf); ++ ++ if ( ((WF_FC_FSTYPE & fc) != WF_FSTYPE_BEACON) ++ || (acx_debug & L_XFER_BEACON) ++ ) { ++ log(L_XFER|L_DATA, "rx: %s " ++ "time:%u len:%u signal:%u SNR:%u macstat:%02X " ++ "phystat:%02X phyrate:%u status:%u\n", ++ acx_get_packet_type_string(fc), ++ le32_to_cpu(rxbuf->time), ++ buf_len, ++ acx_signal_to_winlevel(rxbuf->phy_level), ++ acx_signal_to_winlevel(rxbuf->phy_snr), ++ rxbuf->mac_status, ++ rxbuf->phy_stat_baseband, ++ rxbuf->phy_plcp_signal, ++ adev->status); ++ } ++ ++ if (unlikely(acx_debug & L_DATA)) { ++ printk("rx: 802.11 buf[%u]: ", buf_len); ++ acx_dump_bytes(hdr, buf_len); ++ } ++ ++ /* FIXME: should check for Rx errors (rxbuf->mac_status? ++ * discard broken packets - but NOT for monitor!) ++ * and update Rx packet statistics here */ ++ ++ if (unlikely(adev->mode == ACX_MODE_MONITOR)) { ++ acx_l_rxmonitor(adev, rxbuf); ++ } else if (likely(buf_len >= WLAN_HDR_A3_LEN)) { ++ acx_l_rx_ieee802_11_frame(adev, rxbuf); ++ } else { ++ log(L_DEBUG|L_XFER|L_DATA, ++ "rx: NOT receiving packet (%s): " ++ "size too small (%u)\n", ++ acx_get_packet_type_string(fc), ++ buf_len); ++ } ++ ++ /* Now check Rx quality level, AFTER processing packet. ++ * I tried to figure out how to map these levels to dBm ++ * values, but for the life of me I really didn't ++ * manage to get it. Either these values are not meant to ++ * be expressed in dBm, or it's some pretty complicated ++ * calculation. */ ++ ++#ifdef FROM_SCAN_SOURCE_ONLY ++ /* only consider packets originating from the MAC ++ * address of the device that's managing our BSSID. ++ * Disable it for now, since it removes information (levels ++ * from different peers) and slows the Rx path. */ ++ if (adev->ap_client ++ && mac_is_equal(hdr->a2, adev->ap_client->address)) { ++#endif ++ adev->wstats.qual.level = acx_signal_to_winlevel(rxbuf->phy_level); ++ adev->wstats.qual.noise = acx_signal_to_winlevel(rxbuf->phy_snr); ++#ifndef OLD_QUALITY ++ qual = acx_signal_determine_quality(adev->wstats.qual.level, ++ adev->wstats.qual.noise); ++#else ++ qual = (adev->wstats.qual.noise <= 100) ? ++ 100 - adev->wstats.qual.noise : 0; ++#endif ++ adev->wstats.qual.qual = qual; ++ adev->wstats.qual.updated = 7; /* all 3 indicators updated */ ++#ifdef FROM_SCAN_SOURCE_ONLY ++ } ++#endif ++} ++ ++ ++/*********************************************************************** ++** acx_l_handle_txrate_auto ++** ++** Theory of operation: ++** client->rate_cap is a bitmask of rates client is capable of. ++** client->rate_cfg is a bitmask of allowed (configured) rates. ++** It is set as a result of iwconfig rate N [auto] ++** or iwpriv set_rates "N,N,N N,N,N" commands. ++** It can be fixed (e.g. 0x0080 == 18Mbit only), ++** auto (0x00ff == 18Mbit or any lower value), ++** and code handles any bitmask (0x1081 == try 54Mbit,18Mbit,1Mbit _only_). ++** ++** client->rate_cur is a value for rate111 field in tx descriptor. ++** It is always set to txrate_cfg sans zero or more most significant ++** bits. This routine handles selection of new rate_cur value depending on ++** outcome of last tx event. ++** ++** client->rate_100 is a precalculated rate value for acx100 ++** (we can do without it, but will need to calculate it on each tx). ++** ++** You cannot configure mixed usage of 5.5 and/or 11Mbit rate ++** with PBCC and CCK modulation. Either both at CCK or both at PBCC. ++** In theory you can implement it, but so far it is considered not worth doing. ++** ++** 22Mbit, of course, is PBCC always. */ ++ ++/* maps acx100 tx descr rate field to acx111 one */ ++static u16 ++rate100to111(u8 r) ++{ ++ switch (r) { ++ case RATE100_1: return RATE111_1; ++ case RATE100_2: return RATE111_2; ++ case RATE100_5: ++ case (RATE100_5 | RATE100_PBCC511): return RATE111_5; ++ case RATE100_11: ++ case (RATE100_11 | RATE100_PBCC511): return RATE111_11; ++ case RATE100_22: return RATE111_22; ++ default: ++ printk("acx: unexpected acx100 txrate: %u! " ++ "Please report\n", r); ++ return RATE111_1; ++ } ++} ++ ++ ++void ++acx_l_handle_txrate_auto(acx_device_t *adev, struct client *txc, ++ u16 cur, u8 rate100, u16 rate111, ++ u8 error, int pkts_to_ignore) ++{ ++ u16 sent_rate; ++ int slower_rate_was_used; ++ ++ /* vda: hmm. current code will do this: ++ ** 1. send packets at 11 Mbit, stepup++ ++ ** 2. will try to send at 22Mbit. hardware will see no ACK, ++ ** retries at 11Mbit, success. code notes that used rate ++ ** is lower. stepup = 0, fallback++ ++ ** 3. repeat step 2 fallback_count times. Fall back to ++ ** 11Mbit. go to step 1. ++ ** If stepup_count is large (say, 16) and fallback_count ++ ** is small (3), this wouldn't be too bad wrt throughput */ ++ ++ if (unlikely(!cur)) { ++ printk("acx: BUG! ratemask is empty\n"); ++ return; /* or else we may lock up the box */ ++ } ++ ++ /* do some preparations, i.e. calculate the one rate that was ++ * used to send this packet */ ++ if (IS_ACX111(adev)) { ++ sent_rate = 1 << highest_bit(rate111 & RATE111_ALL); ++ } else { ++ sent_rate = rate100to111(rate100); ++ } ++ /* sent_rate has only one bit set now, corresponding to tx rate ++ * which was used by hardware to tx this particular packet */ ++ ++ /* now do the actual auto rate management */ ++ log(L_XFER, "tx: %sclient=%p/"MACSTR" used=%04X cur=%04X cfg=%04X " ++ "__=%u/%u ^^=%u/%u\n", ++ (txc->ignore_count > 0) ? "[IGN] " : "", ++ txc, MAC(txc->address), sent_rate, cur, txc->rate_cfg, ++ txc->fallback_count, adev->fallback_threshold, ++ txc->stepup_count, adev->stepup_threshold ++ ); ++ ++ /* we need to ignore old packets already in the tx queue since ++ * they use older rate bytes configured before our last rate change, ++ * otherwise our mechanism will get confused by interpreting old data. ++ * Do it after logging above */ ++ if (txc->ignore_count) { ++ txc->ignore_count--; ++ return; ++ } ++ ++ /* true only if the only nonzero bit in sent_rate is ++ ** less significant than highest nonzero bit in cur */ ++ slower_rate_was_used = ( cur > ((sent_rate<<1)-1) ); ++ ++ if (slower_rate_was_used || error) { ++ txc->stepup_count = 0; ++ if (++txc->fallback_count <= adev->fallback_threshold) ++ return; ++ txc->fallback_count = 0; ++ ++ /* clear highest 1 bit in cur */ ++ sent_rate = RATE111_54; ++ while (!(cur & sent_rate)) sent_rate >>= 1; ++ CLEAR_BIT(cur, sent_rate); ++ if (!cur) /* we can't disable all rates! */ ++ cur = sent_rate; ++ log(L_XFER, "tx: falling back to ratemask %04X\n", cur); ++ ++ } else { /* there was neither lower rate nor error */ ++ txc->fallback_count = 0; ++ if (++txc->stepup_count <= adev->stepup_threshold) ++ return; ++ txc->stepup_count = 0; ++ ++ /* Sanitize. Sort of not needed, but I dont trust hw that much... ++ ** what if it can report bogus tx rates sometimes? */ ++ while (!(cur & sent_rate)) sent_rate >>= 1; ++ ++ /* try to find a higher sent_rate that isn't yet in our ++ * current set, but is an allowed cfg */ ++ while (1) { ++ sent_rate <<= 1; ++ if (sent_rate > txc->rate_cfg) ++ /* no higher rates allowed by config */ ++ return; ++ if (!(cur & sent_rate) && (txc->rate_cfg & sent_rate)) ++ /* found */ ++ break; ++ /* not found, try higher one */ ++ } ++ SET_BIT(cur, sent_rate); ++ log(L_XFER, "tx: stepping up to ratemask %04X\n", cur); ++ } ++ ++ txc->rate_cur = cur; ++ txc->ignore_count = pkts_to_ignore; ++ /* calculate acx100 style rate byte if needed */ ++ if (IS_ACX100(adev)) { ++ txc->rate_100 = acx_bitpos2rate100[highest_bit(cur)]; ++ } ++} ++ ++ ++/*********************************************************************** ++** acx_i_start_xmit ++** ++** Called by network core. Can be called outside of process context. ++*/ ++int ++acx_i_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ tx_t *tx; ++ void *txbuf; ++ unsigned long flags; ++ int txresult = NOT_OK; ++ int len; ++ ++ FN_ENTER; ++ ++ if (unlikely(!skb)) { ++ /* indicate success */ ++ txresult = OK; ++ goto end_no_unlock; ++ } ++ if (unlikely(!adev)) { ++ goto end_no_unlock; ++ } ++ ++ acx_lock(adev, flags); ++ ++ if (unlikely(!(adev->dev_state_mask & ACX_STATE_IFACE_UP))) { ++ goto end; ++ } ++ if (unlikely(adev->mode == ACX_MODE_OFF)) { ++ goto end; ++ } ++ if (unlikely(acx_queue_stopped(ndev))) { ++ log(L_DEBUG, "%s: called when queue stopped\n", __func__); ++ goto end; ++ } ++ if (unlikely(ACX_STATUS_4_ASSOCIATED != adev->status)) { ++ log(L_XFER, "trying to xmit, but not associated yet: " ++ "aborting...\n"); ++ /* silently drop the packet, since we're not connected yet */ ++ txresult = OK; ++ /* ...but indicate an error nevertheless */ ++ adev->stats.tx_errors++; ++ goto end; ++ } ++ ++ tx = acx_l_alloc_tx(adev); ++ if (unlikely(!tx)) { ++#ifndef ACX_MEM ++ /* ++ * generic slave interface has to make do with the tiny amount, around ++ * 7k, of transmit buffer space on the ACX itself. It is likely this will ++ * frequently be full. ++ */ ++ printk_ratelimited("%s: start_xmit: txdesc ring is full, " ++ "dropping tx\n", ndev->name); ++#endif ++ txresult = NOT_OK; ++ goto end; ++ } ++ ++ txbuf = acx_l_get_txbuf(adev, tx); ++ if (unlikely(!txbuf)) { ++ /* Card was removed */ ++ txresult = NOT_OK; ++ acx_l_dealloc_tx(adev, tx); ++ goto end; ++ } ++ len = acx_ether_to_txbuf(adev, txbuf, skb); ++ if (unlikely(len < 0)) { ++ /* Error in packet conversion */ ++ txresult = NOT_OK; ++ acx_l_dealloc_tx(adev, tx); ++ goto end; ++ } ++ acx_l_tx_data(adev, tx, len); ++ ndev->trans_start = jiffies; ++ ++ txresult = OK; ++ adev->stats.tx_packets++; ++ adev->stats.tx_bytes += skb->len; ++ ++end: ++ acx_unlock(adev, flags); ++ ++end_no_unlock: ++ if ((txresult == OK) && skb) ++ dev_kfree_skb_any(skb); ++ ++ FN_EXIT1(txresult); ++ return txresult; ++} ++ ++ ++/*********************************************************************** ++** acx_l_update_ratevector ++** ++** Updates adev->rate_supported[_len] according to rate_{basic,oper} ++*/ ++const u8 ++acx_bitpos2ratebyte[] = { ++ DOT11RATEBYTE_1, ++ DOT11RATEBYTE_2, ++ DOT11RATEBYTE_5_5, ++ DOT11RATEBYTE_6_G, ++ DOT11RATEBYTE_9_G, ++ DOT11RATEBYTE_11, ++ DOT11RATEBYTE_12_G, ++ DOT11RATEBYTE_18_G, ++ DOT11RATEBYTE_22, ++ DOT11RATEBYTE_24_G, ++ DOT11RATEBYTE_36_G, ++ DOT11RATEBYTE_48_G, ++ DOT11RATEBYTE_54_G, ++}; ++ ++void ++acx_l_update_ratevector(acx_device_t *adev) ++{ ++ u16 bcfg = adev->rate_basic; ++ u16 ocfg = adev->rate_oper; ++ u8 *supp = adev->rate_supported; ++ const u8 *dot11 = acx_bitpos2ratebyte; ++ ++ FN_ENTER; ++ ++ while (ocfg) { ++ if (ocfg & 1) { ++ *supp = *dot11; ++ if (bcfg & 1) { ++ *supp |= 0x80; ++ } ++ supp++; ++ } ++ dot11++; ++ ocfg >>= 1; ++ bcfg >>= 1; ++ } ++ adev->rate_supported_len = supp - adev->rate_supported; ++ if (acx_debug & L_ASSOC) { ++ printk("new ratevector: "); ++ acx_dump_bytes(adev->rate_supported, adev->rate_supported_len); ++ } ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_l_sta_list_init ++*/ ++static void ++acx_l_sta_list_init(acx_device_t *adev) ++{ ++ FN_ENTER; ++ memset(adev->sta_hash_tab, 0, sizeof(adev->sta_hash_tab)); ++ memset(adev->sta_list, 0, sizeof(adev->sta_list)); ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_l_sta_list_get_from_hash ++*/ ++static inline client_t* ++acx_l_sta_list_get_from_hash(acx_device_t *adev, const u8 *address) ++{ ++ return adev->sta_hash_tab[address[5] % VEC_SIZE(adev->sta_hash_tab)]; ++} ++ ++ ++/*********************************************************************** ++** acx_l_sta_list_get ++*/ ++client_t* ++acx_l_sta_list_get(acx_device_t *adev, const u8 *address) ++{ ++ client_t *client; ++ FN_ENTER; ++ client = acx_l_sta_list_get_from_hash(adev, address); ++ while (client) { ++ if (mac_is_equal(address, client->address)) { ++ client->mtime = jiffies; ++ break; ++ } ++ client = client->next; ++ } ++ FN_EXIT0; ++ return client; ++} ++ ++ ++/*********************************************************************** ++** acx_l_sta_list_del ++*/ ++void ++acx_l_sta_list_del(acx_device_t *adev, client_t *victim) ++{ ++ client_t *client, *next; ++ ++ client = acx_l_sta_list_get_from_hash(adev, victim->address); ++ next = client; ++ /* tricky. next = client on first iteration only, ++ ** on all other iters next = client->next */ ++ while (next) { ++ if (next == victim) { ++ client->next = victim->next; ++ /* Overkill */ ++ memset(victim, 0, sizeof(*victim)); ++ break; ++ } ++ client = next; ++ next = client->next; ++ } ++} ++ ++ ++/*********************************************************************** ++** acx_l_sta_list_alloc ++** ++** Never fails - will evict oldest client if needed ++*/ ++static client_t* ++acx_l_sta_list_alloc(acx_device_t *adev) ++{ ++ int i; ++ unsigned long age, oldest_age; ++ client_t *client, *oldest; ++ ++ FN_ENTER; ++ ++ oldest = &adev->sta_list[0]; ++ oldest_age = 0; ++ for (i = 0; i < VEC_SIZE(adev->sta_list); i++) { ++ client = &adev->sta_list[i]; ++ ++ if (!client->used) { ++ goto found; ++ } else { ++ age = jiffies - client->mtime; ++ if (oldest_age < age) { ++ oldest_age = age; ++ oldest = client; ++ } ++ } ++ } ++ acx_l_sta_list_del(adev, oldest); ++ client = oldest; ++found: ++ memset(client, 0, sizeof(*client)); ++ FN_EXIT0; ++ return client; ++} ++ ++ ++/*********************************************************************** ++** acx_l_sta_list_add ++** ++** Never fails - will evict oldest client if needed ++*/ ++/* In case we will reimplement it differently... */ ++#define STA_LIST_ADD_CAN_FAIL 0 ++ ++static client_t* ++acx_l_sta_list_add(acx_device_t *adev, const u8 *address) ++{ ++ client_t *client; ++ int index; ++ ++ FN_ENTER; ++ ++ client = acx_l_sta_list_alloc(adev); ++ ++ client->mtime = jiffies; ++ MAC_COPY(client->address, address); ++ client->used = CLIENT_EXIST_1; ++ client->auth_alg = WLAN_AUTH_ALG_SHAREDKEY; ++ client->auth_step = 1; ++ /* give some tentative peer rate values ++ ** (needed because peer may do auth without probing us first, ++ ** thus we'll have no idea of peer's ratevector yet). ++ ** Will be overwritten by scanning or assoc code */ ++ client->rate_cap = adev->rate_basic; ++ client->rate_cfg = adev->rate_basic; ++ client->rate_cur = 1 << lowest_bit(adev->rate_basic); ++ ++ index = address[5] % VEC_SIZE(adev->sta_hash_tab); ++ client->next = adev->sta_hash_tab[index]; ++ adev->sta_hash_tab[index] = client; ++ ++ acxlog_mac(L_ASSOC, "sta_list_add: sta=", address, "\n"); ++ ++ FN_EXIT0; ++ return client; ++} ++ ++ ++/*********************************************************************** ++** acx_l_sta_list_get_or_add ++** ++** Never fails - will evict oldest client if needed ++*/ ++static client_t* ++acx_l_sta_list_get_or_add(acx_device_t *adev, const u8 *address) ++{ ++ client_t *client = acx_l_sta_list_get(adev, address); ++ if (!client) ++ client = acx_l_sta_list_add(adev, address); ++ return client; ++} ++ ++ ++/*********************************************************************** ++** acx_set_status ++** ++** This function is called in many atomic regions, must not sleep ++** ++** This function does not need locking UNLESS you call it ++** as acx_set_status(ACX_STATUS_4_ASSOCIATED), bacause this can ++** wake queue. This can race with stop_queue elsewhere. ++** See acx_stop_queue comment. */ ++void ++acx_set_status(acx_device_t *adev, u16 new_status) ++{ ++#define QUEUE_OPEN_AFTER_ASSOC 1 /* this really seems to be needed now */ ++ u16 old_status = adev->status; ++ ++ FN_ENTER; ++ ++ log(L_ASSOC, "%s(%d):%s\n", ++ __func__, new_status, acx_get_status_name(new_status)); ++ ++ /* wireless_send_event never sleeps */ ++ if (ACX_STATUS_4_ASSOCIATED == new_status) { ++ union iwreq_data wrqu; ++ ++ wrqu.data.length = 0; ++ wrqu.data.flags = 0; ++ wireless_send_event(adev->ndev, SIOCGIWSCAN, &wrqu, NULL); ++ ++ wrqu.data.length = 0; ++ wrqu.data.flags = 0; ++ MAC_COPY(wrqu.ap_addr.sa_data, adev->bssid); ++ wrqu.ap_addr.sa_family = ARPHRD_ETHER; ++ wireless_send_event(adev->ndev, SIOCGIWAP, &wrqu, NULL); ++ } else { ++ union iwreq_data wrqu; ++ ++ /* send event with empty BSSID to indicate we're not associated */ ++ MAC_ZERO(wrqu.ap_addr.sa_data); ++ wrqu.ap_addr.sa_family = ARPHRD_ETHER; ++ wireless_send_event(adev->ndev, SIOCGIWAP, &wrqu, NULL); ++ } ++ ++ adev->status = new_status; ++ ++ switch (new_status) { ++ case ACX_STATUS_1_SCANNING: ++ adev->scan_retries = 0; ++ /* 1.0 s initial scan time */ ++ acx_set_timer(adev, 1000000); ++ break; ++ case ACX_STATUS_2_WAIT_AUTH: ++ case ACX_STATUS_3_AUTHENTICATED: ++ adev->auth_or_assoc_retries = 0; ++ acx_set_timer(adev, 1500000); /* 1.5 s */ ++ break; ++ } ++ ++#if QUEUE_OPEN_AFTER_ASSOC ++ if (new_status == ACX_STATUS_4_ASSOCIATED) { ++ if (old_status < ACX_STATUS_4_ASSOCIATED) { ++ /* ah, we're newly associated now, ++ * so let's indicate carrier */ ++ acx_carrier_on(adev->ndev, "after association"); ++ acx_wake_queue(adev->ndev, "after association"); ++ } ++ } else { ++ /* not associated any more, so let's kill carrier */ ++ if (old_status >= ACX_STATUS_4_ASSOCIATED) { ++ acx_carrier_off(adev->ndev, "after losing association"); ++ acx_stop_queue(adev->ndev, "after losing association"); ++ } ++ } ++#endif ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_i_timer ++** ++** Fires up periodically. Used to kick scan/auth/assoc if something goes wrong ++*/ ++void ++acx_i_timer(unsigned long address) ++{ ++ unsigned long flags; ++ acx_device_t *adev = (acx_device_t*)address; ++ ++ FN_ENTER; ++ ++ acx_lock(adev, flags); ++ ++ log(L_DEBUG|L_ASSOC, "%s: adev->status=%d (%s)\n", ++ __func__, adev->status, acx_get_status_name(adev->status)); ++ ++ switch (adev->status) { ++ case ACX_STATUS_1_SCANNING: ++ /* was set to 0 by set_status() */ ++ if (++adev->scan_retries < 7) { ++ acx_set_timer(adev, 1000000); ++ /* used to interrogate for scan status. ++ ** We rely on SCAN_COMPLETE IRQ instead */ ++ log(L_ASSOC, "continuing scan (%d sec)\n", ++ adev->scan_retries); ++ } else { ++ log(L_ASSOC, "stopping scan\n"); ++ /* send stop_scan cmd when we leave the interrupt context, ++ * and make a decision what to do next (COMPLETE_SCAN) */ ++ acx_schedule_task(adev, ++ ACX_AFTER_IRQ_CMD_STOP_SCAN + ACX_AFTER_IRQ_COMPLETE_SCAN); ++ } ++ break; ++ case ACX_STATUS_2_WAIT_AUTH: ++ /* was set to 0 by set_status() */ ++ if (++adev->auth_or_assoc_retries < 10) { ++ log(L_ASSOC, "resend authen1 request (attempt %d)\n", ++ adev->auth_or_assoc_retries + 1); ++ acx_l_transmit_authen1(adev); ++ } else { ++ /* time exceeded: fall back to scanning mode */ ++ log(L_ASSOC, ++ "authen1 request reply timeout, giving up\n"); ++ /* we are a STA, need to find AP anyhow */ ++ acx_set_status(adev, ACX_STATUS_1_SCANNING); ++ acx_schedule_task(adev, ACX_AFTER_IRQ_RESTART_SCAN); ++ } ++ /* used to be 1500000, but some other driver uses 2.5s */ ++ acx_set_timer(adev, 2500000); ++ break; ++ case ACX_STATUS_3_AUTHENTICATED: ++ /* was set to 0 by set_status() */ ++ if (++adev->auth_or_assoc_retries < 10) { ++ log(L_ASSOC, "resend assoc request (attempt %d)\n", ++ adev->auth_or_assoc_retries + 1); ++ acx_l_transmit_assoc_req(adev); ++ } else { ++ /* time exceeded: give up */ ++ log(L_ASSOC, ++ "association request reply timeout, giving up\n"); ++ /* we are a STA, need to find AP anyhow */ ++ acx_set_status(adev, ACX_STATUS_1_SCANNING); ++ acx_schedule_task(adev, ACX_AFTER_IRQ_RESTART_SCAN); ++ } ++ acx_set_timer(adev, 2500000); /* see above */ ++ break; ++ case ACX_STATUS_4_ASSOCIATED: ++ default: ++ break; ++ } ++ ++ acx_unlock(adev, flags); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_set_timer ++** ++** Sets the 802.11 state management timer's timeout. ++*/ ++void ++acx_set_timer(acx_device_t *adev, int timeout_us) ++{ ++ FN_ENTER; ++ ++ log(L_DEBUG|L_IRQ, "%s(%u ms)\n", __func__, timeout_us/1000); ++ if (!(adev->dev_state_mask & ACX_STATE_IFACE_UP)) { ++ printk("attempt to set the timer " ++ "when the card interface is not up!\n"); ++ goto end; ++ } ++ ++ /* first check if the timer was already initialized, THEN modify it */ ++ if (adev->mgmt_timer.function) { ++ mod_timer(&adev->mgmt_timer, ++ jiffies + (timeout_us * HZ / 1000000)); ++ } ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_l_transmit_assocresp ++** ++** We are an AP here ++*/ ++static const u8 ++dot11ratebyte[] = { ++ DOT11RATEBYTE_1, ++ DOT11RATEBYTE_2, ++ DOT11RATEBYTE_5_5, ++ DOT11RATEBYTE_6_G, ++ DOT11RATEBYTE_9_G, ++ DOT11RATEBYTE_11, ++ DOT11RATEBYTE_12_G, ++ DOT11RATEBYTE_18_G, ++ DOT11RATEBYTE_22, ++ DOT11RATEBYTE_24_G, ++ DOT11RATEBYTE_36_G, ++ DOT11RATEBYTE_48_G, ++ DOT11RATEBYTE_54_G, ++}; ++ ++static inline int ++find_pos(const u8 *p, int size, u8 v) ++{ ++ int i; ++ for (i = 0; i < size; i++) ++ if (p[i] == v) ++ return i; ++ /* printk a message about strange byte? */ ++ return 0; ++} ++ ++static void ++add_bits_to_ratemasks(u8* ratevec, int len, u16* brate, u16* orate) ++{ ++ while (len--) { ++ int n = 1 << find_pos(dot11ratebyte, ++ sizeof(dot11ratebyte), *ratevec & 0x7f); ++ if (*ratevec & 0x80) ++ *brate |= n; ++ *orate |= n; ++ ratevec++; ++ } ++} ++ ++static int ++acx_l_transmit_assocresp(acx_device_t *adev, const wlan_fr_assocreq_t *req) ++{ ++ struct tx *tx; ++ struct wlan_hdr_mgmt *head; ++ struct assocresp_frame_body *body; ++ u8 *p; ++ const u8 *da; ++ /* const u8 *sa; */ ++ const u8 *bssid; ++ client_t *clt; ++ ++ FN_ENTER; ++ ++ /* sa = req->hdr->a1; */ ++ da = req->hdr->a2; ++ bssid = req->hdr->a3; ++ ++ clt = acx_l_sta_list_get(adev, da); ++ if (!clt) ++ goto ok; ++ ++ /* Assoc without auth is a big no-no */ ++ /* Let's be liberal: if already assoc'ed STA sends assoc req again, ++ ** we won't be rude */ ++ if (clt->used != CLIENT_AUTHENTICATED_2 ++ && clt->used != CLIENT_ASSOCIATED_3) { ++ acx_l_transmit_deauthen(adev, da, WLAN_MGMT_REASON_CLASS2_NONAUTH); ++ goto bad; ++ } ++ ++ clt->used = CLIENT_ASSOCIATED_3; ++ ++ if (clt->aid == 0) ++ clt->aid = ++adev->aid; ++ clt->cap_info = ieee2host16(*(req->cap_info)); ++ ++ /* We cheat here a bit. We don't really care which rates are flagged ++ ** as basic by the client, so we stuff them in single ratemask */ ++ clt->rate_cap = 0; ++ if (req->supp_rates) ++ add_bits_to_ratemasks(req->supp_rates->rates, ++ req->supp_rates->len, &clt->rate_cap, &clt->rate_cap); ++ if (req->ext_rates) ++ add_bits_to_ratemasks(req->ext_rates->rates, ++ req->ext_rates->len, &clt->rate_cap, &clt->rate_cap); ++ /* We can check that client supports all basic rates, ++ ** and deny assoc if not. But let's be liberal, right? ;) */ ++ clt->rate_cfg = clt->rate_cap & adev->rate_oper; ++ if (!clt->rate_cfg) clt->rate_cfg = 1 << lowest_bit(adev->rate_oper); ++ clt->rate_cur = 1 << lowest_bit(clt->rate_cfg); ++ if (IS_ACX100(adev)) ++ clt->rate_100 = acx_bitpos2rate100[lowest_bit(clt->rate_cfg)]; ++ clt->fallback_count = clt->stepup_count = 0; ++ clt->ignore_count = 16; ++ ++ tx = acx_l_alloc_tx(adev); ++ if (!tx) ++ goto bad; ++ head = acx_l_get_txbuf(adev, tx); ++ if (!head) { ++ acx_l_dealloc_tx(adev, tx); ++ goto bad; ++ } ++ body = (void*)(head + 1); ++ ++ head->fc = WF_FSTYPE_ASSOCRESPi; ++ head->dur = req->hdr->dur; ++ MAC_COPY(head->da, da); ++ MAC_COPY(head->sa, adev->dev_addr); ++ MAC_COPY(head->bssid, bssid); ++ head->seq = req->hdr->seq; ++ ++ body->cap_info = host2ieee16(adev->capabilities); ++ body->status = host2ieee16(0); ++ body->aid = host2ieee16(clt->aid); ++ p = wlan_fill_ie_rates((u8*)&body->rates, adev->rate_supported_len, ++ adev->rate_supported); ++ p = wlan_fill_ie_rates_ext(p, adev->rate_supported_len, ++ adev->rate_supported); ++ ++ acx_l_tx_data(adev, tx, p - (u8*)head); ++ok: ++ FN_EXIT1(OK); ++ return OK; ++bad: ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*********************************************************************** ++* acx_l_transmit_reassocresp ++ ++You may be wondering, just like me, what the hell ReAuth is. ++In practice it was seen sent by STA when STA feels like losing connection. ++ ++[802.11] ++ ++5.4.2.3 Reassociation ++ ++Association is sufficient for no-transition message delivery between ++IEEE 802.11 stations. Additional functionality is needed to support ++BSS-transition mobility. The additional required functionality ++is provided by the reassociation service. Reassociation is a DSS. ++The reassociation service is invoked to 'move' a current association ++from one AP to another. This keeps the DS informed of the current ++mapping between AP and STA as the station moves from BSS to BSS within ++an ESS. Reassociation also enables changing association attributes ++of an established association while the STA remains associated with ++the same AP. Reassociation is always initiated by the mobile STA. ++ ++5.4.3.1 Authentication ++... ++A STA may be authenticated with many other STAs at any given instant. ++ ++5.4.3.1.1 Preauthentication ++ ++Because the authentication process could be time-consuming (depending ++on the authentication protocol in use), the authentication service can ++be invoked independently of the association service. Preauthentication ++is typically done by a STA while it is already associated with an AP ++(with which it previously authenticated). IEEE 802.11 does not require ++that STAs preauthenticate with APs. However, authentication is required ++before an association can be established. If the authentication is left ++until reassociation time, this may impact the speed with which a STA can ++reassociate between APs, limiting BSS-transition mobility performance. ++The use of preauthentication takes the authentication service overhead ++out of the time-critical reassociation process. ++ ++5.7.3 Reassociation ++ ++For a STA to reassociate, the reassociation service causes the following ++message to occur: ++ ++ Reassociation request ++ ++* Message type: Management ++* Message subtype: Reassociation request ++* Information items: ++ - IEEE address of the STA ++ - IEEE address of the AP with which the STA will reassociate ++ - IEEE address of the AP with which the STA is currently associated ++ - ESSID ++* Direction of message: From STA to 'new' AP ++ ++The address of the current AP is included for efficiency. The inclusion ++of the current AP address facilitates MAC reassociation to be independent ++of the DS implementation. ++ ++ Reassociation response ++* Message type: Management ++* Message subtype: Reassociation response ++* Information items: ++ - Result of the requested reassociation. (success/failure) ++ - If the reassociation is successful, the response shall include the AID. ++* Direction of message: From AP to STA ++ ++7.2.3.6 Reassociation Request frame format ++ ++The frame body of a management frame of subtype Reassociation Request ++contains the information shown in Table 9. ++ ++Table 9 Reassociation Request frame body ++Order Information ++1 Capability information ++2 Listen interval ++3 Current AP address ++4 SSID ++5 Supported rates ++ ++7.2.3.7 Reassociation Response frame format ++ ++The frame body of a management frame of subtype Reassociation Response ++contains the information shown in Table 10. ++ ++Table 10 Reassociation Response frame body ++Order Information ++1 Capability information ++2 Status code ++3 Association ID (AID) ++4 Supported rates ++ ++*/ ++static int ++acx_l_transmit_reassocresp(acx_device_t *adev, const wlan_fr_reassocreq_t *req) ++{ ++ struct tx *tx; ++ struct wlan_hdr_mgmt *head; ++ struct reassocresp_frame_body *body; ++ u8 *p; ++ const u8 *da; ++ /* const u8 *sa; */ ++ const u8 *bssid; ++ client_t *clt; ++ ++ FN_ENTER; ++ ++ /* sa = req->hdr->a1; */ ++ da = req->hdr->a2; ++ bssid = req->hdr->a3; ++ ++ /* Must be already authenticated, so it must be in the list */ ++ clt = acx_l_sta_list_get(adev, da); ++ if (!clt) ++ goto ok; ++ ++ /* Assoc without auth is a big no-no */ ++ /* Already assoc'ed STAs sending ReAssoc req are ok per 802.11 */ ++ if (clt->used != CLIENT_AUTHENTICATED_2 ++ && clt->used != CLIENT_ASSOCIATED_3) { ++ acx_l_transmit_deauthen(adev, da, WLAN_MGMT_REASON_CLASS2_NONAUTH); ++ goto bad; ++ } ++ ++ clt->used = CLIENT_ASSOCIATED_3; ++ if (clt->aid == 0) { ++ clt->aid = ++adev->aid; ++ } ++ if (req->cap_info) ++ clt->cap_info = ieee2host16(*(req->cap_info)); ++ ++ /* We cheat here a bit. We don't really care which rates are flagged ++ ** as basic by the client, so we stuff them in single ratemask */ ++ clt->rate_cap = 0; ++ if (req->supp_rates) ++ add_bits_to_ratemasks(req->supp_rates->rates, ++ req->supp_rates->len, &clt->rate_cap, &clt->rate_cap); ++ if (req->ext_rates) ++ add_bits_to_ratemasks(req->ext_rates->rates, ++ req->ext_rates->len, &clt->rate_cap, &clt->rate_cap); ++ /* We can check that client supports all basic rates, ++ ** and deny assoc if not. But let's be liberal, right? ;) */ ++ clt->rate_cfg = clt->rate_cap & adev->rate_oper; ++ if (!clt->rate_cfg) clt->rate_cfg = 1 << lowest_bit(adev->rate_oper); ++ clt->rate_cur = 1 << lowest_bit(clt->rate_cfg); ++ if (IS_ACX100(adev)) ++ clt->rate_100 = acx_bitpos2rate100[lowest_bit(clt->rate_cfg)]; ++ ++ clt->fallback_count = clt->stepup_count = 0; ++ clt->ignore_count = 16; ++ ++ tx = acx_l_alloc_tx(adev); ++ if (!tx) ++ goto ok; ++ head = acx_l_get_txbuf(adev, tx); ++ if (!head) { ++ acx_l_dealloc_tx(adev, tx); ++ goto ok; ++ } ++ body = (void*)(head + 1); ++ ++ head->fc = WF_FSTYPE_REASSOCRESPi; ++ head->dur = req->hdr->dur; ++ MAC_COPY(head->da, da); ++ MAC_COPY(head->sa, adev->dev_addr); ++ MAC_COPY(head->bssid, bssid); ++ head->seq = req->hdr->seq; ++ ++ /* IEs: 1. caps */ ++ body->cap_info = host2ieee16(adev->capabilities); ++ /* 2. status code */ ++ body->status = host2ieee16(0); ++ /* 3. AID */ ++ body->aid = host2ieee16(clt->aid); ++ /* 4. supp rates */ ++ p = wlan_fill_ie_rates((u8*)&body->rates, adev->rate_supported_len, ++ adev->rate_supported); ++ /* 5. ext supp rates */ ++ p = wlan_fill_ie_rates_ext(p, adev->rate_supported_len, ++ adev->rate_supported); ++ ++ acx_l_tx_data(adev, tx, p - (u8*)head); ++ok: ++ FN_EXIT1(OK); ++ return OK; ++bad: ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*********************************************************************** ++** acx_l_process_disassoc_from_sta ++*/ ++static void ++acx_l_process_disassoc_from_sta(acx_device_t *adev, const wlan_fr_disassoc_t *req) ++{ ++ const u8 *ta; ++ client_t *clt; ++ ++ FN_ENTER; ++ ++ ta = req->hdr->a2; ++ clt = acx_l_sta_list_get(adev, ta); ++ if (!clt) ++ goto end; ++ ++ if (clt->used != CLIENT_ASSOCIATED_3 ++ && clt->used != CLIENT_AUTHENTICATED_2) { ++ /* it's disassociating, but it's ++ ** not even authenticated! Let it know that */ ++ acxlog_mac(L_ASSOC|L_XFER, "peer ", ta, "has sent disassoc " ++ "req but it is not even auth'ed! sending deauth\n"); ++ acx_l_transmit_deauthen(adev, ta, ++ WLAN_MGMT_REASON_CLASS2_NONAUTH); ++ clt->used = CLIENT_EXIST_1; ++ } else { ++ /* mark it as auth'ed only */ ++ clt->used = CLIENT_AUTHENTICATED_2; ++ } ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_l_process_deauthen_from_sta ++*/ ++static void ++acx_l_process_deauth_from_sta(acx_device_t *adev, const wlan_fr_deauthen_t *req) ++{ ++ const wlan_hdr_t *hdr; ++ client_t *client; ++ ++ FN_ENTER; ++ ++ hdr = req->hdr; ++ ++ if (acx_debug & L_ASSOC) { ++ acx_print_mac("got deauth from sta:", hdr->a2, " "); ++ acx_print_mac("a1:", hdr->a1, " "); ++ acx_print_mac("a3:", hdr->a3, " "); ++ acx_print_mac("adev->addr:", adev->dev_addr, " "); ++ acx_print_mac("adev->bssid:", adev->bssid, "\n"); ++ } ++ ++ if (!mac_is_equal(adev->dev_addr, hdr->a1)) { ++ goto end; ++ } ++ ++ client = acx_l_sta_list_get(adev, hdr->a2); ++ if (!client) { ++ goto end; ++ } ++ client->used = CLIENT_EXIST_1; ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_l_process_disassoc_from_ap ++*/ ++static void ++acx_l_process_disassoc_from_ap(acx_device_t *adev, const wlan_fr_disassoc_t *req) ++{ ++ FN_ENTER; ++ ++ if (!adev->ap_client) { ++ /* Hrm, we aren't assoc'ed yet anyhow... */ ++ goto end; ++ } ++ ++ printk("%s: got disassoc frame with reason %d (%s)\n", ++ adev->ndev->name, *req->reason, ++ acx_wlan_reason_str(*req->reason)); ++ ++ if (mac_is_equal(adev->dev_addr, req->hdr->a1)) { ++ acx_l_transmit_deauthen(adev, adev->bssid, ++ WLAN_MGMT_REASON_DEAUTH_LEAVING); ++ SET_BIT(adev->set_mask, GETSET_RESCAN); ++ acx_schedule_task(adev, ACX_AFTER_IRQ_UPDATE_CARD_CFG); ++ } ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_l_process_deauth_from_ap ++*/ ++static void ++acx_l_process_deauth_from_ap(acx_device_t *adev, const wlan_fr_deauthen_t *req) ++{ ++ FN_ENTER; ++ ++ if (!adev->ap_client) { ++ /* Hrm, we aren't assoc'ed yet anyhow... */ ++ goto end; ++ } ++ ++ printk("%s: got deauth frame with reason %d (%s)\n", ++ adev->ndev->name, *req->reason, ++ acx_wlan_reason_str(*req->reason)); ++ ++ /* Chk: is ta verified to be from our AP? */ ++ if (mac_is_equal(adev->dev_addr, req->hdr->a1)) { ++ log(L_DEBUG, "AP sent us deauth packet\n"); ++ SET_BIT(adev->set_mask, GETSET_RESCAN); ++ acx_schedule_task(adev, ACX_AFTER_IRQ_UPDATE_CARD_CFG); ++ } ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_l_rx ++** ++** The end of the Rx path. Pulls data from a rxhostdesc into a socket ++** buffer and feeds it to the network stack via netif_rx(). ++*/ ++static void ++acx_l_rx(acx_device_t *adev, rxbuffer_t *rxbuf) ++{ ++ FN_ENTER; ++ if (likely(adev->dev_state_mask & ACX_STATE_IFACE_UP)) { ++ struct sk_buff *skb; ++ skb = acx_rxbuf_to_ether(adev, rxbuf); ++ if (likely(skb)) { ++ netif_rx(skb); ++ adev->ndev->last_rx = jiffies; ++ adev->stats.rx_packets++; ++ adev->stats.rx_bytes += skb->len; ++ } ++ } ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_l_process_data_frame_master ++*/ ++static int ++acx_l_process_data_frame_master(acx_device_t *adev, rxbuffer_t *rxbuf) ++{ ++ struct wlan_hdr *hdr; ++ struct tx *tx; ++ void *txbuf; ++ int len; ++ int result = NOT_OK; ++ ++ FN_ENTER; ++ ++ hdr = acx_get_wlan_hdr(adev, rxbuf); ++ ++ switch (WF_FC_FROMTODSi & hdr->fc) { ++ case 0: ++ case WF_FC_FROMDSi: ++ log(L_DEBUG, "ap->sta or adhoc->adhoc data frame ignored\n"); ++ goto done; ++ case WF_FC_TODSi: ++ break; ++ default: /* WF_FC_FROMTODSi */ ++ log(L_DEBUG, "wds data frame ignored (TODO)\n"); ++ goto done; ++ } ++ ++ /* check if it is our BSSID, if not, leave */ ++ if (!mac_is_equal(adev->bssid, hdr->a1)) { ++ goto done; ++ } ++ ++ if (mac_is_equal(adev->dev_addr, hdr->a3)) { ++ /* this one is for us */ ++ acx_l_rx(adev, rxbuf); ++ } else { ++ if (mac_is_bcast(hdr->a3)) { ++ /* this one is bcast, rx it too */ ++ acx_l_rx(adev, rxbuf); ++ } ++ tx = acx_l_alloc_tx(adev); ++ if (!tx) { ++ goto fail; ++ } ++ /* repackage, tx, and hope it someday reaches its destination */ ++ /* order is important, we do it in-place */ ++ MAC_COPY(hdr->a1, hdr->a3); ++ MAC_COPY(hdr->a3, hdr->a2); ++ MAC_COPY(hdr->a2, adev->bssid); ++ /* To_DS = 0, From_DS = 1 */ ++ hdr->fc = WF_FC_FROMDSi + WF_FTYPE_DATAi; ++ ++ txbuf = acx_l_get_txbuf(adev, tx); ++ if (txbuf) { ++ len = RXBUF_BYTES_RCVD(adev, rxbuf); ++ memcpy(txbuf, hdr, len); ++ acx_l_tx_data(adev, tx, len); ++ } else { ++ acx_l_dealloc_tx(adev, tx); ++ } ++ } ++done: ++ result = OK; ++fail: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_l_process_data_frame_client ++*/ ++static int ++acx_l_process_data_frame_client(acx_device_t *adev, rxbuffer_t *rxbuf) ++{ ++ const u8 *da, *bssid; ++ const wlan_hdr_t *hdr; ++ struct net_device *ndev = adev->ndev; ++ int result = NOT_OK; ++ ++ FN_ENTER; ++ ++ if (ACX_STATUS_4_ASSOCIATED != adev->status) ++ goto drop; ++ ++ hdr = acx_get_wlan_hdr(adev, rxbuf); ++ ++ switch (WF_FC_FROMTODSi & hdr->fc) { ++ case 0: ++ if (adev->mode != ACX_MODE_0_ADHOC) { ++ log(L_DEBUG, "adhoc->adhoc data frame ignored\n"); ++ goto drop; ++ } ++ bssid = hdr->a3; ++ break; ++ case WF_FC_FROMDSi: ++ if (adev->mode != ACX_MODE_2_STA) { ++ log(L_DEBUG, "ap->sta data frame ignored\n"); ++ goto drop; ++ } ++ bssid = hdr->a2; ++ break; ++ case WF_FC_TODSi: ++ log(L_DEBUG, "sta->ap data frame ignored\n"); ++ goto drop; ++ default: /* WF_FC_FROMTODSi: wds->wds */ ++ log(L_DEBUG, "wds data frame ignored (todo)\n"); ++ goto drop; ++ } ++ ++ da = hdr->a1; ++ ++ if (unlikely(acx_debug & L_DEBUG)) { ++ acx_print_mac("rx: da=", da, ""); ++ acx_print_mac(" bssid=", bssid, ""); ++ acx_print_mac(" adev->bssid=", adev->bssid, ""); ++ acx_print_mac(" adev->addr=", adev->dev_addr, "\n"); ++ } ++ ++ /* promiscuous mode --> receive all packets */ ++ if (unlikely(ndev->flags & IFF_PROMISC)) ++ goto process; ++ ++ /* FIRST, check if it is our BSSID */ ++ if (!mac_is_equal(adev->bssid, bssid)) { ++ /* is not our BSSID, so bail out */ ++ goto drop; ++ } ++ ++ /* then, check if it is our address */ ++ if (mac_is_equal(adev->dev_addr, da)) { ++ goto process; ++ } ++ ++ /* then, check if it is broadcast */ ++ if (mac_is_bcast(da)) { ++ goto process; ++ } ++ ++ if (mac_is_mcast(da)) { ++ /* unconditionally receive all multicasts */ ++ if (ndev->flags & IFF_ALLMULTI) ++ goto process; ++ ++ /* FIXME: need to check against the list of ++ * multicast addresses that are configured ++ * for the interface (ifconfig) */ ++ log(L_XFER, "FIXME: multicast packet, need to check " ++ "against a list of multicast addresses " ++ "(to be created!); accepting packet for now\n"); ++ /* for now, just accept it here */ ++ goto process; ++ } ++ ++ log(L_DEBUG, "rx: foreign packet, dropping\n"); ++ goto drop; ++process: ++ /* receive packet */ ++ acx_l_rx(adev, rxbuf); ++ ++ result = OK; ++drop: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_l_process_mgmt_frame ++** ++** Theory of operation: mgmt packet gets parsed (to make it easy ++** to access variable-sized IEs), results stored in 'parsed'. ++** Then we react to the packet. ++*/ ++typedef union parsed_mgmt_req { ++ wlan_fr_mgmt_t mgmt; ++ wlan_fr_assocreq_t assocreq; ++ wlan_fr_reassocreq_t reassocreq; ++ wlan_fr_assocresp_t assocresp; ++ wlan_fr_reassocresp_t reassocresp; ++ wlan_fr_beacon_t beacon; ++ wlan_fr_disassoc_t disassoc; ++ wlan_fr_authen_t authen; ++ wlan_fr_deauthen_t deauthen; ++ wlan_fr_proberesp_t proberesp; ++} parsed_mgmt_req_t; ++ ++void BUG_excessive_stack_usage(void); ++ ++static int ++acx_l_process_mgmt_frame(acx_device_t *adev, rxbuffer_t *rxbuf) ++{ ++ parsed_mgmt_req_t parsed; /* takes ~100 bytes of stack */ ++ wlan_hdr_t *hdr; ++ int adhoc, sta_scan, sta, ap; ++ int len; ++ ++ if (sizeof(parsed) > 256) ++ BUG_excessive_stack_usage(); ++ ++ FN_ENTER; ++ ++ hdr = acx_get_wlan_hdr(adev, rxbuf); ++ ++ /* Management frames never have these set */ ++ if (WF_FC_FROMTODSi & hdr->fc) { ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++ } ++ ++ len = RXBUF_BYTES_RCVD(adev, rxbuf); ++ if (WF_FC_ISWEPi & hdr->fc) ++ len -= 0x10; ++ ++ adhoc = (adev->mode == ACX_MODE_0_ADHOC); ++ sta_scan = ((adev->mode == ACX_MODE_2_STA) ++ && (adev->status != ACX_STATUS_4_ASSOCIATED)); ++ sta = ((adev->mode == ACX_MODE_2_STA) ++ && (adev->status == ACX_STATUS_4_ASSOCIATED)); ++ ap = (adev->mode == ACX_MODE_3_AP); ++ ++ switch (WF_FC_FSTYPEi & hdr->fc) { ++ /* beacons first, for speed */ ++ case WF_FSTYPE_BEACONi: ++ memset(&parsed.beacon, 0, sizeof(parsed.beacon)); ++ parsed.beacon.hdr = hdr; ++ parsed.beacon.len = len; ++ if (acx_debug & L_DATA) { ++ printk("beacon len:%d fc:%04X dur:%04X seq:%04X", ++ len, hdr->fc, hdr->dur, hdr->seq); ++ acx_print_mac(" a1:", hdr->a1, ""); ++ acx_print_mac(" a2:", hdr->a2, ""); ++ acx_print_mac(" a3:", hdr->a3, "\n"); ++ } ++ wlan_mgmt_decode_beacon(&parsed.beacon); ++ /* beacon and probe response are very similar, so... */ ++ acx_l_process_probe_response(adev, &parsed.beacon, rxbuf); ++ break; ++ case WF_FSTYPE_ASSOCREQi: ++ if (!ap) ++ break; ++ memset(&parsed.assocreq, 0, sizeof(parsed.assocreq)); ++ parsed.assocreq.hdr = hdr; ++ parsed.assocreq.len = len; ++ wlan_mgmt_decode_assocreq(&parsed.assocreq); ++ if (mac_is_equal(hdr->a1, adev->bssid) ++ && mac_is_equal(hdr->a3, adev->bssid)) { ++ acx_l_transmit_assocresp(adev, &parsed.assocreq); ++ } ++ break; ++ case WF_FSTYPE_REASSOCREQi: ++ if (!ap) ++ break; ++ memset(&parsed.assocreq, 0, sizeof(parsed.assocreq)); ++ parsed.assocreq.hdr = hdr; ++ parsed.assocreq.len = len; ++ wlan_mgmt_decode_assocreq(&parsed.assocreq); ++ /* reassocreq and assocreq are equivalent */ ++ acx_l_transmit_reassocresp(adev, &parsed.reassocreq); ++ break; ++ case WF_FSTYPE_ASSOCRESPi: ++ if (!sta_scan) ++ break; ++ memset(&parsed.assocresp, 0, sizeof(parsed.assocresp)); ++ parsed.assocresp.hdr = hdr; ++ parsed.assocresp.len = len; ++ wlan_mgmt_decode_assocresp(&parsed.assocresp); ++ acx_l_process_assocresp(adev, &parsed.assocresp); ++ break; ++ case WF_FSTYPE_REASSOCRESPi: ++ if (!sta_scan) ++ break; ++ memset(&parsed.assocresp, 0, sizeof(parsed.assocresp)); ++ parsed.assocresp.hdr = hdr; ++ parsed.assocresp.len = len; ++ wlan_mgmt_decode_assocresp(&parsed.assocresp); ++ acx_l_process_reassocresp(adev, &parsed.reassocresp); ++ break; ++ case WF_FSTYPE_PROBEREQi: ++ if (ap || adhoc) { ++ /* FIXME: since we're supposed to be an AP, ++ ** we need to return a Probe Response packet. ++ ** Currently firmware is doing it for us, ++ ** but firmware is buggy! See comment elsewhere --vda */ ++ } ++ break; ++ case WF_FSTYPE_PROBERESPi: ++ memset(&parsed.proberesp, 0, sizeof(parsed.proberesp)); ++ parsed.proberesp.hdr = hdr; ++ parsed.proberesp.len = len; ++ wlan_mgmt_decode_proberesp(&parsed.proberesp); ++ acx_l_process_probe_response(adev, &parsed.proberesp, rxbuf); ++ break; ++ case 6: ++ case 7: ++ /* exit */ ++ break; ++ case WF_FSTYPE_ATIMi: ++ /* exit */ ++ break; ++ case WF_FSTYPE_DISASSOCi: ++ if (!sta && !ap) ++ break; ++ memset(&parsed.disassoc, 0, sizeof(parsed.disassoc)); ++ parsed.disassoc.hdr = hdr; ++ parsed.disassoc.len = len; ++ wlan_mgmt_decode_disassoc(&parsed.disassoc); ++ if (sta) ++ acx_l_process_disassoc_from_ap(adev, &parsed.disassoc); ++ else ++ acx_l_process_disassoc_from_sta(adev, &parsed.disassoc); ++ break; ++ case WF_FSTYPE_AUTHENi: ++ if (!sta_scan && !ap) ++ break; ++ memset(&parsed.authen, 0, sizeof(parsed.authen)); ++ parsed.authen.hdr = hdr; ++ parsed.authen.len = len; ++ wlan_mgmt_decode_authen(&parsed.authen); ++ acx_l_process_authen(adev, &parsed.authen); ++ break; ++ case WF_FSTYPE_DEAUTHENi: ++ if (!sta && !ap) ++ break; ++ memset(&parsed.deauthen, 0, sizeof(parsed.deauthen)); ++ parsed.deauthen.hdr = hdr; ++ parsed.deauthen.len = len; ++ wlan_mgmt_decode_deauthen(&parsed.deauthen); ++ if (sta) ++ acx_l_process_deauth_from_ap(adev, &parsed.deauthen); ++ else ++ acx_l_process_deauth_from_sta(adev, &parsed.deauthen); ++ break; ++ } ++ ++ FN_EXIT1(OK); ++ return OK; ++} ++ ++ ++#ifdef UNUSED ++/*********************************************************************** ++** acx_process_class_frame ++** ++** Called from IRQ context only ++*/ ++static int ++acx_process_class_frame(acx_device_t *adev, rxbuffer_t *rxbuf, int vala) ++{ ++ return OK; ++} ++#endif ++ ++ ++/*********************************************************************** ++** acx_l_process_NULL_frame ++*/ ++#ifdef BOGUS_ITS_NOT_A_NULL_FRAME_HANDLER_AT_ALL ++static int ++acx_l_process_NULL_frame(acx_device_t *adev, rxbuffer_t *rxbuf, int vala) ++{ ++ const signed char *esi; ++ const u8 *ebx; ++ const wlan_hdr_t *hdr; ++ const client_t *client; ++ int result = NOT_OK; ++ ++ hdr = acx_get_wlan_hdr(adev, rxbuf); ++ ++ switch (WF_FC_FROMTODSi & hdr->fc) { ++ case 0: ++ esi = hdr->a1; ++ ebx = hdr->a2; ++ break; ++ case WF_FC_FROMDSi: ++ esi = hdr->a1; ++ ebx = hdr->a3; ++ break; ++ case WF_FC_TODSi: ++ esi = hdr->a1; ++ ebx = hdr->a2; ++ break; ++ default: /* WF_FC_FROMTODSi */ ++ esi = hdr->a1; /* added by me! --vda */ ++ ebx = hdr->a2; ++ } ++ ++ if (esi[0x0] < 0) { ++ result = OK; ++ goto done; ++ } ++ ++ client = acx_l_sta_list_get(adev, ebx); ++ if (client) ++ result = NOT_OK; ++ else { ++#ifdef IS_IT_BROKEN ++ log(L_DEBUG|L_XFER, "<transmit_deauth 7>\n"); ++ acx_l_transmit_deauthen(adev, ebx, ++ WLAN_MGMT_REASON_CLASS2_NONAUTH); ++#else ++ log(L_DEBUG, "received NULL frame from unknown client! " ++ "We really shouldn't send deauthen here, right?\n"); ++#endif ++ result = OK; ++ } ++done: ++ return result; ++} ++#endif ++ ++ ++/*********************************************************************** ++** acx_l_process_probe_response ++*/ ++static int ++acx_l_process_probe_response(acx_device_t *adev, wlan_fr_proberesp_t *req, ++ const rxbuffer_t *rxbuf) ++{ ++ struct client *bss; ++ wlan_hdr_t *hdr; ++ ++ FN_ENTER; ++ ++ hdr = req->hdr; ++ ++ if (mac_is_equal(hdr->a3, adev->dev_addr)) { ++ log(L_ASSOC, "huh, scan found our own MAC!?\n"); ++ goto ok; /* just skip this one silently */ ++ } ++ ++ bss = acx_l_sta_list_get_or_add(adev, hdr->a2); ++ ++ /* NB: be careful modifying bss data! It may be one ++ ** of the already known clients (like our AP if we are a STA) ++ ** Thus do not blindly modify e.g. current ratemask! */ ++ ++ if (STA_LIST_ADD_CAN_FAIL && !bss) { ++ /* uh oh, we found more sites/stations than we can handle with ++ * our current setup: pull the emergency brake and stop scanning! */ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_CMD_STOP_SCAN); ++ /* TODO: a nice comment what below call achieves --vda */ ++ acx_set_status(adev, ACX_STATUS_2_WAIT_AUTH); ++ goto ok; ++ } ++ /* NB: get_or_add already filled bss->address = hdr->a2 */ ++ MAC_COPY(bss->bssid, hdr->a3); ++ ++ /* copy the ESSID element */ ++ if (req->ssid && req->ssid->len <= IW_ESSID_MAX_SIZE) { ++ bss->essid_len = req->ssid->len; ++ memcpy(bss->essid, req->ssid->ssid, req->ssid->len); ++ bss->essid[req->ssid->len] = '\0'; ++ } else { ++ /* Either no ESSID IE or oversized one */ ++ printk("%s: received packet has bogus ESSID\n", ++ adev->ndev->name); ++ } ++ ++ if (req->ds_parms) ++ bss->channel = req->ds_parms->curr_ch; ++ if (req->cap_info) ++ bss->cap_info = ieee2host16(*req->cap_info); ++ ++ bss->sir = acx_signal_to_winlevel(rxbuf->phy_level); ++ bss->snr = acx_signal_to_winlevel(rxbuf->phy_snr); ++ ++ bss->rate_cap = 0; /* operational mask */ ++ bss->rate_bas = 0; /* basic mask */ ++ if (req->supp_rates) ++ add_bits_to_ratemasks(req->supp_rates->rates, ++ req->supp_rates->len, &bss->rate_bas, &bss->rate_cap); ++ if (req->ext_rates) ++ add_bits_to_ratemasks(req->ext_rates->rates, ++ req->ext_rates->len, &bss->rate_bas, &bss->rate_cap); ++ /* Fix up any possible bogosity - code elsewhere ++ * is not expecting empty masks */ ++ if (!bss->rate_cap) ++ bss->rate_cap = adev->rate_basic; ++ if (!bss->rate_bas) ++ bss->rate_bas = 1 << lowest_bit(bss->rate_cap); ++ if (!bss->rate_cur) ++ bss->rate_cur = 1 << lowest_bit(bss->rate_bas); ++ ++ /* People moan about this being too noisy at L_ASSOC */ ++ log(L_DEBUG, ++ "found %s: ESSID=\"%s\" ch=%d " ++ "BSSID="MACSTR" caps=0x%04X SIR=%d SNR=%d\n", ++ (bss->cap_info & WF_MGMT_CAP_IBSS) ? "Ad-Hoc peer" : "AP", ++ bss->essid, bss->channel, MAC(bss->bssid), bss->cap_info, ++ bss->sir, bss->snr); ++ok: ++ FN_EXIT0; ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_l_process_assocresp ++*/ ++static int ++acx_l_process_assocresp(acx_device_t *adev, const wlan_fr_assocresp_t *req) ++{ ++ const wlan_hdr_t *hdr; ++ int res = OK; ++ ++ FN_ENTER; ++ ++ hdr = req->hdr; ++ ++ if ((ACX_MODE_2_STA == adev->mode) ++ && mac_is_equal(adev->dev_addr, hdr->a1)) { ++ u16 st = ieee2host16(*(req->status)); ++ if (WLAN_MGMT_STATUS_SUCCESS == st) { ++ adev->aid = ieee2host16(*(req->aid)); ++ /* tell the card we are associated when ++ ** we are out of interrupt context */ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_CMD_ASSOCIATE); ++ } else { ++ ++ /* TODO: we shall delete peer from sta_list, and try ++ ** other candidates... */ ++ ++ printk("%s: association FAILED: peer sent " ++ "Status Code %d (%s)\n", ++ adev->ndev->name, st, get_status_string(st)); ++ res = NOT_OK; ++ } ++ } ++ ++ FN_EXIT1(res); ++ return res; ++} ++ ++ ++/*********************************************************************** ++** acx_l_process_reassocresp ++*/ ++static int ++acx_l_process_reassocresp(acx_device_t *adev, const wlan_fr_reassocresp_t *req) ++{ ++ const wlan_hdr_t *hdr; ++ int result = NOT_OK; ++ u16 st; ++ ++ FN_ENTER; ++ ++ hdr = req->hdr; ++ ++ if (!mac_is_equal(adev->dev_addr, hdr->a1)) { ++ goto end; ++ } ++ st = ieee2host16(*(req->status)); ++ if (st == WLAN_MGMT_STATUS_SUCCESS) { ++ acx_set_status(adev, ACX_STATUS_4_ASSOCIATED); ++ result = OK; ++ } else { ++ printk("%s: reassociation FAILED: peer sent " ++ "response code %d (%s)\n", ++ adev->ndev->name, st, get_status_string(st)); ++ } ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_l_process_authen ++** ++** Called only in STA_SCAN or AP mode ++*/ ++static int ++acx_l_process_authen(acx_device_t *adev, const wlan_fr_authen_t *req) ++{ ++ const wlan_hdr_t *hdr; ++ client_t *clt; ++ wlan_ie_challenge_t *chal; ++ u16 alg, seq, status; ++ int ap, result; ++ ++ FN_ENTER; ++ ++ hdr = req->hdr; ++ ++ if (acx_debug & L_ASSOC) { ++ acx_print_mac("AUTHEN adev->addr=", adev->dev_addr, " "); ++ acx_print_mac("a1=", hdr->a1, " "); ++ acx_print_mac("a2=", hdr->a2, " "); ++ acx_print_mac("a3=", hdr->a3, " "); ++ acx_print_mac("adev->bssid=", adev->bssid, "\n"); ++ } ++ ++ if (!mac_is_equal(adev->dev_addr, hdr->a1) ++ || !mac_is_equal(adev->bssid, hdr->a3)) { ++ result = OK; ++ goto end; ++ } ++ ++ alg = ieee2host16(*(req->auth_alg)); ++ seq = ieee2host16(*(req->auth_seq)); ++ status = ieee2host16(*(req->status)); ++ ++ log(L_ASSOC, "auth algorithm %d, auth sequence %d, status %d\n", alg, seq, status); ++ ++ ap = (adev->mode == ACX_MODE_3_AP); ++ ++ if (adev->auth_alg <= 1) { ++ if (adev->auth_alg != alg) { ++ log(L_ASSOC, "auth algorithm mismatch: " ++ "our:%d peer:%d\n", adev->auth_alg, alg); ++ result = NOT_OK; ++ goto end; ++ } ++ } ++ if (ap) { ++ clt = acx_l_sta_list_get_or_add(adev, hdr->a2); ++ if (STA_LIST_ADD_CAN_FAIL && !clt) { ++ log(L_ASSOC, "could not allocate room for client\n"); ++ result = NOT_OK; ++ goto end; ++ } ++ } else { ++ clt = adev->ap_client; ++ if (!mac_is_equal(clt->address, hdr->a2)) { ++ printk("%s: malformed auth frame from AP?!\n", ++ adev->ndev->name); ++ result = NOT_OK; ++ goto end; ++ } ++ } ++ ++ /* now check which step in the authentication sequence we are ++ * currently in, and act accordingly */ ++ switch (seq) { ++ case 1: ++ if (!ap) ++ break; ++ acx_l_transmit_authen2(adev, req, clt); ++ break; ++ case 2: ++ if (ap) ++ break; ++ if (status == WLAN_MGMT_STATUS_SUCCESS) { ++ if (alg == WLAN_AUTH_ALG_OPENSYSTEM) { ++ acx_set_status(adev, ACX_STATUS_3_AUTHENTICATED); ++ acx_l_transmit_assoc_req(adev); ++ } else ++ if (alg == WLAN_AUTH_ALG_SHAREDKEY) { ++ acx_l_transmit_authen3(adev, req); ++ } ++ } else { ++ printk("%s: auth FAILED: peer sent " ++ "response code %d (%s), " ++ "still waiting for authentication\n", ++ adev->ndev->name, ++ status, get_status_string(status)); ++ acx_set_status(adev, ACX_STATUS_2_WAIT_AUTH); ++ } ++ break; ++ case 3: ++ if (!ap) ++ break; ++ if ((clt->auth_alg != WLAN_AUTH_ALG_SHAREDKEY) ++ || (alg != WLAN_AUTH_ALG_SHAREDKEY) ++ || (clt->auth_step != 2)) ++ break; ++ chal = req->challenge; ++ if (!chal ++ || memcmp(chal->challenge, clt->challenge_text, WLAN_CHALLENGE_LEN) ++ || (chal->eid != WLAN_EID_CHALLENGE) ++ || (chal->len != WLAN_CHALLENGE_LEN) ++ ) ++ break; ++ acx_l_transmit_authen4(adev, req); ++ MAC_COPY(clt->address, hdr->a2); ++ clt->used = CLIENT_AUTHENTICATED_2; ++ clt->auth_step = 4; ++ clt->seq = ieee2host16(hdr->seq); ++ break; ++ case 4: ++ if (ap) ++ break; ++ /* ok, we're through: we're authenticated. Woohoo!! */ ++ acx_set_status(adev, ACX_STATUS_3_AUTHENTICATED); ++ log(L_ASSOC, "Authenticated!\n"); ++ /* now that we're authenticated, request association */ ++ acx_l_transmit_assoc_req(adev); ++ break; ++ } ++ result = OK; ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_gen_challenge ++*/ ++static inline void ++acx_gen_challenge(wlan_ie_challenge_t* d) ++{ ++ FN_ENTER; ++ d->eid = WLAN_EID_CHALLENGE; ++ d->len = WLAN_CHALLENGE_LEN; ++ get_random_bytes(d->challenge, WLAN_CHALLENGE_LEN); ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_l_transmit_deauthen ++*/ ++static int ++acx_l_transmit_deauthen(acx_device_t *adev, const u8 *addr, u16 reason) ++{ ++ struct tx *tx; ++ struct wlan_hdr_mgmt *head; ++ struct deauthen_frame_body *body; ++ ++ FN_ENTER; ++ ++ tx = acx_l_alloc_tx(adev); ++ if (!tx) ++ goto bad; ++ head = acx_l_get_txbuf(adev, tx); ++ if (!head) { ++ acx_l_dealloc_tx(adev, tx); ++ goto bad; ++ } ++ body = (void*)(head + 1); ++ ++ head->fc = (WF_FTYPE_MGMTi | WF_FSTYPE_DEAUTHENi); ++ head->dur = 0; ++ MAC_COPY(head->da, addr); ++ MAC_COPY(head->sa, adev->dev_addr); ++ MAC_COPY(head->bssid, adev->bssid); ++ head->seq = 0; ++ ++ log(L_DEBUG|L_ASSOC|L_XFER, ++ "sending deauthen to "MACSTR" for %d\n", ++ MAC(addr), reason); ++ ++ body->reason = host2ieee16(reason); ++ ++ /* body is fixed size here, but beware of cutting-and-pasting this - ++ ** do not use sizeof(*body) for variable sized mgmt packets! */ ++ acx_l_tx_data(adev, tx, WLAN_HDR_A3_LEN + sizeof(*body)); ++ ++ FN_EXIT1(OK); ++ return OK; ++bad: ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*********************************************************************** ++** acx_l_transmit_authen1 ++*/ ++static int ++acx_l_transmit_authen1(acx_device_t *adev) ++{ ++ struct tx *tx; ++ struct wlan_hdr_mgmt *head; ++ struct auth_frame_body *body; ++ ++ FN_ENTER; ++ ++ log(L_ASSOC, "sending authentication1 request (auth algo %d), " ++ "awaiting response\n", adev->auth_alg); ++ ++ tx = acx_l_alloc_tx(adev); ++ if (!tx) ++ goto bad; ++ head = acx_l_get_txbuf(adev, tx); ++ if (!head) { ++ acx_l_dealloc_tx(adev, tx); ++ goto bad; ++ } ++ body = (void*)(head + 1); ++ ++ head->fc = WF_FSTYPE_AUTHENi; ++ /* duration should be 0 instead of 0x8000 to have ++ * the firmware calculate the value, right? */ ++ head->dur = 0; ++ MAC_COPY(head->da, adev->bssid); ++ MAC_COPY(head->sa, adev->dev_addr); ++ MAC_COPY(head->bssid, adev->bssid); ++ head->seq = 0; ++ ++ body->auth_alg = host2ieee16(adev->auth_alg); ++ body->auth_seq = host2ieee16(1); ++ body->status = host2ieee16(0); ++ ++ acx_l_tx_data(adev, tx, WLAN_HDR_A3_LEN + 2 + 2 + 2); ++ ++ FN_EXIT1(OK); ++ return OK; ++bad: ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*********************************************************************** ++** acx_l_transmit_authen2 ++*/ ++static int ++acx_l_transmit_authen2(acx_device_t *adev, const wlan_fr_authen_t *req, ++ client_t *clt) ++{ ++ struct tx *tx; ++ struct wlan_hdr_mgmt *head; ++ struct auth_frame_body *body; ++ unsigned int packet_len; ++ ++ FN_ENTER; ++ ++ if (!clt) ++ goto ok; ++ ++ MAC_COPY(clt->address, req->hdr->a2); ++#ifdef UNUSED ++ clt->ps = ((WF_FC_PWRMGTi & req->hdr->fc) != 0); ++#endif ++ clt->auth_alg = ieee2host16(*(req->auth_alg)); ++ clt->auth_step = 2; ++ clt->seq = ieee2host16(req->hdr->seq); ++ ++ tx = acx_l_alloc_tx(adev); ++ if (!tx) ++ goto bad; ++ head = acx_l_get_txbuf(adev, tx); ++ if (!head) { ++ acx_l_dealloc_tx(adev, tx); ++ goto bad; ++ } ++ body = (void*)(head + 1); ++ ++ head->fc = WF_FSTYPE_AUTHENi; ++ head->dur = 0 /* req->hdr->dur */; ++ MAC_COPY(head->da, req->hdr->a2); ++ MAC_COPY(head->sa, adev->dev_addr); ++ MAC_COPY(head->bssid, req->hdr->a3); ++ head->seq = 0 /* req->hdr->seq */; ++ ++ /* already in IEEE format, no endianness conversion */ ++ body->auth_alg = *(req->auth_alg); ++ body->auth_seq = host2ieee16(2); ++ body->status = host2ieee16(0); ++ ++ packet_len = WLAN_HDR_A3_LEN + 2 + 2 + 2; ++ if (ieee2host16(*(req->auth_alg)) == WLAN_AUTH_ALG_OPENSYSTEM) { ++ clt->used = CLIENT_AUTHENTICATED_2; ++ } else { /* shared key */ ++ acx_gen_challenge(&body->challenge); ++ memcpy(&clt->challenge_text, body->challenge.challenge, WLAN_CHALLENGE_LEN); ++ packet_len += 2 + 2 + 2 + 1+1+WLAN_CHALLENGE_LEN; ++ } ++ ++ acxlog_mac(L_ASSOC|L_XFER, ++ "transmit_auth2: BSSID=", head->bssid, "\n"); ++ ++ acx_l_tx_data(adev, tx, packet_len); ++ok: ++ FN_EXIT1(OK); ++ return OK; ++bad: ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*********************************************************************** ++** acx_l_transmit_authen3 ++*/ ++static int ++acx_l_transmit_authen3(acx_device_t *adev, const wlan_fr_authen_t *req) ++{ ++ struct tx *tx; ++ struct wlan_hdr_mgmt *head; ++ struct auth_frame_body *body; ++ unsigned int packet_len; ++ ++ FN_ENTER; ++ ++ tx = acx_l_alloc_tx(adev); ++ if (!tx) ++ goto ok; ++ head = acx_l_get_txbuf(adev, tx); ++ if (!head) { ++ acx_l_dealloc_tx(adev, tx); ++ goto ok; ++ } ++ body = (void*)(head + 1); ++ ++ /* add WF_FC_ISWEPi: auth step 3 needs to be encrypted */ ++ head->fc = WF_FC_ISWEPi + WF_FSTYPE_AUTHENi; ++ /* FIXME: is this needed?? authen4 does it... ++ * I think it's even wrong since we shouldn't re-use old ++ * values but instead let the firmware calculate proper ones ++ head->dur = req->hdr->dur; ++ head->seq = req->hdr->seq; ++ */ ++ MAC_COPY(head->da, adev->bssid); ++ MAC_COPY(head->sa, adev->dev_addr); ++ MAC_COPY(head->bssid, adev->bssid); ++ ++ /* already in IEEE format, no endianness conversion */ ++ body->auth_alg = *(req->auth_alg); ++ body->auth_seq = host2ieee16(3); ++ body->status = host2ieee16(0); ++ memcpy(&body->challenge, req->challenge, req->challenge->len + 2); ++ packet_len = WLAN_HDR_A3_LEN + 8 + req->challenge->len; ++ ++ log(L_ASSOC|L_XFER, "transmit_authen3!\n"); ++ ++ acx_l_tx_data(adev, tx, packet_len); ++ok: ++ FN_EXIT1(OK); ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_l_transmit_authen4 ++*/ ++static int ++acx_l_transmit_authen4(acx_device_t *adev, const wlan_fr_authen_t *req) ++{ ++ struct tx *tx; ++ struct wlan_hdr_mgmt *head; ++ struct auth_frame_body *body; ++ ++ FN_ENTER; ++ ++ tx = acx_l_alloc_tx(adev); ++ if (!tx) ++ goto ok; ++ head = acx_l_get_txbuf(adev, tx); ++ if (!head) { ++ acx_l_dealloc_tx(adev, tx); ++ goto ok; ++ } ++ body = (void*)(head + 1); ++ ++ head->fc = WF_FSTYPE_AUTHENi; /* 0xb0 */ ++ head->dur = 0 /* req->hdr->dur */; ++ MAC_COPY(head->da, req->hdr->a2); ++ MAC_COPY(head->sa, adev->dev_addr); ++ MAC_COPY(head->bssid, req->hdr->a3); ++ head->seq = 0 /* req->hdr->seq */; ++ ++ /* already in IEEE format, no endianness conversion */ ++ body->auth_alg = *(req->auth_alg); ++ body->auth_seq = host2ieee16(4); ++ body->status = host2ieee16(0); ++ ++ acx_l_tx_data(adev, tx, WLAN_HDR_A3_LEN + 2 + 2 + 2); ++ok: ++ FN_EXIT1(OK); ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_l_transmit_assoc_req ++** ++** adev->ap_client is a current candidate AP here ++*/ ++static int ++acx_l_transmit_assoc_req(acx_device_t *adev) ++{ ++ struct tx *tx; ++ struct wlan_hdr_mgmt *head; ++ u8 *body, *p, *prate; ++ unsigned int packet_len; ++ u16 cap; ++ ++ FN_ENTER; ++ ++ log(L_ASSOC, "sending association request, " ++ "awaiting response. NOT ASSOCIATED YET\n"); ++ tx = acx_l_alloc_tx(adev); ++ if (!tx) ++ goto bad; ++ head = acx_l_get_txbuf(adev, tx); ++ if (!head) { ++ acx_l_dealloc_tx(adev, tx); ++ goto bad; ++ } ++ body = (void*)(head + 1); ++ ++ head->fc = WF_FSTYPE_ASSOCREQi; ++ head->dur = host2ieee16(0x8000); ++ MAC_COPY(head->da, adev->bssid); ++ MAC_COPY(head->sa, adev->dev_addr); ++ MAC_COPY(head->bssid, adev->bssid); ++ head->seq = 0; ++ ++ p = body; ++ /* now start filling the AssocReq frame body */ ++ ++ /* since this assoc request will most likely only get ++ * sent in the STA to AP case (and not when Ad-Hoc IBSS), ++ * the cap combination indicated here will thus be ++ * WF_MGMT_CAP_ESSi *always* (no IBSS ever) ++ * The specs are more than non-obvious on all that: ++ * ++ * 802.11 7.3.1.4 Capability Information field ++ ** APs set the ESS subfield to 1 and the IBSS subfield to 0 within ++ ** Beacon or Probe Response management frames. STAs within an IBSS ++ ** set the ESS subfield to 0 and the IBSS subfield to 1 in transmitted ++ ** Beacon or Probe Response management frames ++ ** ++ ** APs set the Privacy subfield to 1 within transmitted Beacon, ++ ** Probe Response, Association Response, and Reassociation Response ++ ** if WEP is required for all data type frames within the BSS. ++ ** STAs within an IBSS set the Privacy subfield to 1 in Beacon ++ ** or Probe Response management frames if WEP is required ++ ** for all data type frames within the IBSS */ ++ ++ /* note that returning 0 will be refused by several APs... ++ * (so this indicates that you're probably supposed to ++ * "confirm" the ESS mode) */ ++ cap = WF_MGMT_CAP_ESSi; ++ ++ /* this one used to be a check on wep_restricted, ++ * but more likely it's wep_enabled instead */ ++ if (adev->wep_enabled) ++ SET_BIT(cap, WF_MGMT_CAP_PRIVACYi); ++ ++ /* Probably we can just set these always, because our hw is ++ ** capable of shortpre and PBCC --vda */ ++ /* only ask for short preamble if the peer station supports it */ ++ if (adev->ap_client->cap_info & WF_MGMT_CAP_SHORT) ++ SET_BIT(cap, WF_MGMT_CAP_SHORTi); ++ /* only ask for PBCC support if the peer station supports it */ ++ if (adev->ap_client->cap_info & WF_MGMT_CAP_PBCC) ++ SET_BIT(cap, WF_MGMT_CAP_PBCCi); ++ ++ /* IEs: 1. caps */ ++ *(u16*)p = cap; p += 2; ++ /* 2. listen interval */ ++ *(u16*)p = host2ieee16(adev->listen_interval); p += 2; ++ /* 3. ESSID */ ++ p = wlan_fill_ie_ssid(p, ++ strlen(adev->essid_for_assoc), adev->essid_for_assoc); ++ /* 4. supp rates */ ++ prate = p; ++ p = wlan_fill_ie_rates(p, ++ adev->rate_supported_len, adev->rate_supported); ++ /* 5. ext supp rates */ ++ p = wlan_fill_ie_rates_ext(p, ++ adev->rate_supported_len, adev->rate_supported); ++ ++ if (acx_debug & L_DEBUG) { ++ printk("association: rates element\n"); ++ acx_dump_bytes(prate, p - prate); ++ } ++ ++ /* calculate lengths */ ++ packet_len = WLAN_HDR_A3_LEN + (p - body); ++ ++ log(L_ASSOC, "association: requesting caps 0x%04X, ESSID \"%s\"\n", ++ cap, adev->essid_for_assoc); ++ ++ acx_l_tx_data(adev, tx, packet_len); ++ FN_EXIT1(OK); ++ return OK; ++bad: ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*********************************************************************** ++** acx_l_transmit_disassoc ++** ++** FIXME: looks like incomplete implementation of a helper: ++** acx_l_transmit_disassoc(adev, clt) - kick this client (we're an AP) ++** acx_l_transmit_disassoc(adev, NULL) - leave BSSID (we're a STA) ++*/ ++#ifdef BROKEN ++int ++acx_l_transmit_disassoc(acx_device_t *adev, client_t *clt) ++{ ++ struct tx *tx; ++ struct wlan_hdr_mgmt *head; ++ struct disassoc_frame_body *body; ++ ++ FN_ENTER; ++/* if (clt != NULL) { */ ++ tx = acx_l_alloc_tx(adev); ++ if (!tx) ++ goto bad; ++ head = acx_l_get_txbuf(adev, tx); ++ if (!head) { ++ acx_l_dealloc_tx(adev, tx); ++ goto bad; ++ } ++ body = (void*)(head + 1); ++ ++/* clt->used = CLIENT_AUTHENTICATED_2; - not (yet?) associated */ ++ ++ head->fc = WF_FSTYPE_DISASSOCi; ++ head->dur = 0; ++ /* huh? It muchly depends on whether we're STA or AP... ++ ** sta->ap: da=bssid, sa=own, bssid=bssid ++ ** ap->sta: da=sta, sa=bssid, bssid=bssid. FIXME! */ ++ MAC_COPY(head->da, adev->bssid); ++ MAC_COPY(head->sa, adev->dev_addr); ++ MAC_COPY(head->bssid, adev->dev_addr); ++ head->seq = 0; ++ ++ /* "Class 3 frame received from nonassociated station." */ ++ body->reason = host2ieee16(7); ++ ++ /* fixed size struct, ok to sizeof */ ++ acx_l_tx_data(adev, tx, WLAN_HDR_A3_LEN + sizeof(*body)); ++/* } */ ++ FN_EXIT1(OK); ++ return OK; ++bad: ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++#endif ++ ++ ++/*********************************************************************** ++** acx_s_complete_scan ++** ++** Called either from after_interrupt_task() if: ++** 1) there was Scan_Complete IRQ, or ++** 2) scanning expired in timer() ++** We need to decide which ESS or IBSS to join. ++** Iterates thru adev->sta_list: ++** if adev->ap is not bcast, will join only specified ++** ESS or IBSS with this bssid ++** checks peers' caps for ESS/IBSS bit ++** checks peers' SSID, allows exact match or hidden SSID ++** If station to join is chosen: ++** points adev->ap_client to the chosen struct client ++** sets adev->essid_for_assoc for future assoc attempt ++** Auth/assoc is not yet performed ++** Returns OK if there is no need to restart scan ++*/ ++int ++acx_s_complete_scan(acx_device_t *adev) ++{ ++ struct client *bss; ++ unsigned long flags; ++ u16 needed_cap; ++ int i; ++ int idx_found = -1; ++ int result = OK; ++ ++ FN_ENTER; ++ ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ needed_cap = WF_MGMT_CAP_IBSS; /* 2, we require Ad-Hoc */ ++ break; ++ case ACX_MODE_2_STA: ++ needed_cap = WF_MGMT_CAP_ESS; /* 1, we require Managed */ ++ break; ++ default: ++ printk("acx: driver bug: mode=%d in complete_scan()\n", adev->mode); ++ dump_stack(); ++ goto end; ++ } ++ ++ acx_lock(adev, flags); ++ ++ /* TODO: sta_iterator hiding implementation would be nice here... */ ++ ++ for (i = 0; i < VEC_SIZE(adev->sta_list); i++) { ++ bss = &adev->sta_list[i]; ++ if (!bss->used) continue; ++ ++ ++ log(L_ASSOC, "scan table: SSID=\"%s\" CH=%d SIR=%d SNR=%d\n", ++ bss->essid, bss->channel, bss->sir, bss->snr); ++ ++ if (!mac_is_bcast(adev->ap)) ++ if (!mac_is_equal(bss->bssid, adev->ap)) ++ continue; /* keep looking */ ++ ++ /* broken peer with no mode flags set? */ ++ if (unlikely(!(bss->cap_info & (WF_MGMT_CAP_ESS | WF_MGMT_CAP_IBSS)))) { ++ printk("%s: strange peer "MACSTR" found with " ++ "neither ESS (AP) nor IBSS (Ad-Hoc) " ++ "capability - skipped\n", ++ adev->ndev->name, MAC(bss->address)); ++ continue; ++ } ++ log(L_ASSOC, "peer_cap 0x%04X, needed_cap 0x%04X\n", ++ bss->cap_info, needed_cap); ++ ++ /* does peer station support what we need? */ ++ if ((bss->cap_info & needed_cap) != needed_cap) ++ continue; /* keep looking */ ++ ++ /* strange peer with NO basic rates?! */ ++ if (unlikely(!bss->rate_bas)) { ++ printk("%s: strange peer "MACSTR" with empty rate set " ++ "- skipped\n", ++ adev->ndev->name, MAC(bss->address)); ++ continue; ++ } ++ ++ /* do we support all basic rates of this peer? */ ++ if ((bss->rate_bas & adev->rate_oper) != bss->rate_bas) { ++/* we probably need to have all rates as operational rates, ++ even in case of an 11M-only configuration */ ++#ifdef THIS_IS_TROUBLESOME ++ printk("%s: peer "MACSTR": incompatible basic rates " ++ "(AP requests 0x%04X, we have 0x%04X) " ++ "- skipped\n", ++ adev->ndev->name, MAC(bss->address), ++ bss->rate_bas, adev->rate_oper); ++ continue; ++#else ++ printk("%s: peer "MACSTR": incompatible basic rates " ++ "(AP requests 0x%04X, we have 0x%04X). " ++ "Considering anyway...\n", ++ adev->ndev->name, MAC(bss->address), ++ bss->rate_bas, adev->rate_oper); ++#endif ++ } ++ ++ if ( !(adev->reg_dom_chanmask & (1<<(bss->channel-1))) ) { ++ printk("%s: warning: peer "MACSTR" is on channel %d " ++ "outside of channel range of current " ++ "regulatory domain - couldn't join " ++ "even if other settings match. " ++ "You might want to adapt your config\n", ++ adev->ndev->name, MAC(bss->address), ++ bss->channel); ++ continue; /* keep looking */ ++ } ++ ++ if (!adev->essid_active || !strcmp(bss->essid, adev->essid)) { ++ log(L_ASSOC, ++ "found station with matching ESSID! ('%s' " ++ "station, '%s' config)\n", ++ bss->essid, ++ (adev->essid_active) ? adev->essid : "[any]"); ++ /* TODO: continue looking for peer with better SNR */ ++ bss->used = CLIENT_JOIN_CANDIDATE; ++ idx_found = i; ++ ++ /* stop searching if this station is ++ * on the current channel, otherwise ++ * keep looking for an even better match */ ++ if (bss->channel == adev->channel) ++ break; ++ } else ++ if (is_hidden_essid(bss->essid)) { ++ /* hmm, station with empty or single-space SSID: ++ * using hidden SSID broadcast? ++ */ ++ /* This behaviour is broken: which AP from zillion ++ ** of APs with hidden SSID you'd try? ++ ** We should use Probe requests to get Probe responses ++ ** and check for real SSID (are those never hidden?) */ ++ bss->used = CLIENT_JOIN_CANDIDATE; ++ if (idx_found == -1) ++ idx_found = i; ++ log(L_ASSOC, "found station with empty or " ++ "single-space (hidden) SSID, considering " ++ "for assoc attempt\n"); ++ /* ...and keep looking for better matches */ ++ } else { ++ log(L_ASSOC, "ESSID doesn't match! ('%s' " ++ "station, '%s' config)\n", ++ bss->essid, ++ (adev->essid_active) ? adev->essid : "[any]"); ++ } ++ } ++ ++ /* TODO: iterate thru join candidates instead */ ++ /* TODO: rescan if not associated within some timeout */ ++ if (idx_found != -1) { ++ char *essid_src; ++ size_t essid_len; ++ ++ bss = &adev->sta_list[idx_found]; ++ adev->ap_client = bss; ++ ++ if (is_hidden_essid(bss->essid)) { ++ /* if the ESSID of the station we found is empty ++ * (no broadcast), then use user-configured ESSID ++ * instead */ ++ essid_src = adev->essid; ++ essid_len = adev->essid_len; ++ } else { ++ essid_src = bss->essid; ++ essid_len = strlen(bss->essid); ++ } ++ ++ acx_update_capabilities(adev); ++ ++ memcpy(adev->essid_for_assoc, essid_src, essid_len); ++ adev->essid_for_assoc[essid_len] = '\0'; ++ adev->channel = bss->channel; ++ MAC_COPY(adev->bssid, bss->bssid); ++ ++ bss->rate_cfg = (bss->rate_cap & adev->rate_oper); ++ bss->rate_cur = 1 << lowest_bit(bss->rate_cfg); ++ bss->rate_100 = acx_rate111to100(bss->rate_cur); ++ ++ acxlog_mac(L_ASSOC, ++ "matching station found: ", adev->bssid, ", joining\n"); ++ ++ /* TODO: do we need to switch to the peer's channel first? */ ++ ++ if (ACX_MODE_0_ADHOC == adev->mode) { ++ acx_set_status(adev, ACX_STATUS_4_ASSOCIATED); ++ } else { ++ acx_l_transmit_authen1(adev); ++ acx_set_status(adev, ACX_STATUS_2_WAIT_AUTH); ++ } ++ } else { /* idx_found == -1 */ ++ /* uh oh, no station found in range */ ++ if (ACX_MODE_0_ADHOC == adev->mode) { ++ printk("%s: no matching station found in range, " ++ "generating our own IBSS instead\n", ++ adev->ndev->name); ++ /* we do it the HostAP way: */ ++ MAC_COPY(adev->bssid, adev->dev_addr); ++ adev->bssid[0] |= 0x02; /* 'local assigned addr' bit */ ++ /* add IBSS bit to our caps... */ ++ acx_update_capabilities(adev); ++ acx_set_status(adev, ACX_STATUS_4_ASSOCIATED); ++ /* In order to cmd_join be called below */ ++ idx_found = 0; ++ } else { ++ /* we shall scan again, AP can be ++ ** just temporarily powered off */ ++ log(L_ASSOC, ++ "no matching station found in range yet\n"); ++ acx_set_status(adev, ACX_STATUS_1_SCANNING); ++ result = NOT_OK; ++ } ++ } ++ ++ acx_unlock(adev, flags); ++ ++ if (idx_found != -1) { ++ if (ACX_MODE_0_ADHOC == adev->mode) { ++ /* need to update channel in beacon template */ ++ SET_BIT(adev->set_mask, SET_TEMPLATES); ++ if (ACX_STATE_IFACE_UP & adev->dev_state_mask) ++ acx_s_update_card_settings(adev); ++ } ++ /* Inform firmware on our decision to start or join BSS */ ++ acx_s_cmd_join_bssid(adev, adev->bssid); ++ } ++ ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_s_read_fw ++** ++** Loads a firmware image ++** ++** Returns: ++** 0 unable to load file ++** pointer to firmware success ++*/ ++firmware_image_t* ++acx_s_read_fw(struct device *dev, const char *file, u32 *size) ++{ ++ firmware_image_t *res; ++ const struct firmware *fw_entry; ++ ++ res = NULL; ++ log(L_INIT, "requesting firmware image '%s'\n", file); ++ if (!request_firmware(&fw_entry, file, dev)) { ++ *size = 8; ++ if (fw_entry->size >= 8) ++ *size = 8 + le32_to_cpu(*(u32 *)(fw_entry->data + 4)); ++ if (fw_entry->size != *size) { ++ printk("acx: firmware size does not match " ++ "firmware header: %d != %d, " ++ "aborting fw upload\n", ++ (int) fw_entry->size, (int) *size); ++ goto release_ret; ++ } ++ res = vmalloc(*size); ++ if (!res) { ++ printk("acx: no memory for firmware " ++ "(%u bytes)\n", *size); ++ goto release_ret; ++ } ++ memcpy(res, fw_entry->data, fw_entry->size); ++release_ret: ++ release_firmware(fw_entry); ++ return res; ++ } ++ printk("acx: firmware image '%s' was not provided. " ++ "Check your hotplug scripts\n", file); ++ ++ /* checksum will be verified in write_fw, so don't bother here */ ++ return res; ++} ++ ++ ++/*********************************************************************** ++** acx_s_set_wepkey ++*/ ++static void ++acx100_s_set_wepkey(acx_device_t *adev) ++{ ++ ie_dot11WEPDefaultKey_t dk; ++ int i; ++ ++ for (i = 0; i < DOT11_MAX_DEFAULT_WEP_KEYS; i++) { ++ if (adev->wep_keys[i].size != 0) { ++ log(L_INIT, "setting WEP key: %d with " ++ "total size: %d\n", i, (int) adev->wep_keys[i].size); ++ dk.action = 1; ++ dk.keySize = adev->wep_keys[i].size; ++ dk.defaultKeyNum = i; ++ memcpy(dk.key, adev->wep_keys[i].key, dk.keySize); ++ acx_s_configure(adev, &dk, ACX100_IE_DOT11_WEP_DEFAULT_KEY_WRITE); ++ } ++ } ++} ++ ++static void ++acx111_s_set_wepkey(acx_device_t *adev) ++{ ++ acx111WEPDefaultKey_t dk; ++ int i; ++ ++ for (i = 0; i < DOT11_MAX_DEFAULT_WEP_KEYS; i++) { ++ if (adev->wep_keys[i].size != 0) { ++ log(L_INIT, "setting WEP key: %d with " ++ "total size: %d\n", i, (int) adev->wep_keys[i].size); ++ memset(&dk, 0, sizeof(dk)); ++ dk.action = cpu_to_le16(1); /* "add key"; yes, that's a 16bit value */ ++ dk.keySize = adev->wep_keys[i].size; ++ ++ /* are these two lines necessary? */ ++ dk.type = 0; /* default WEP key */ ++ dk.index = 0; /* ignored when setting default key */ ++ ++ dk.defaultKeyNum = i; ++ memcpy(dk.key, adev->wep_keys[i].key, dk.keySize); ++ acx_s_issue_cmd(adev, ACX1xx_CMD_WEP_MGMT, &dk, sizeof(dk)); ++ } ++ } ++} ++ ++static void ++acx_s_set_wepkey(acx_device_t *adev) ++{ ++ if (IS_ACX111(adev)) ++ acx111_s_set_wepkey(adev); ++ else ++ acx100_s_set_wepkey(adev); ++} ++ ++ ++/*********************************************************************** ++** acx100_s_init_wep ++** ++** FIXME: this should probably be moved into the new card settings ++** management, but since we're also modifying the memory map layout here ++** due to the WEP key space we want, we should take care... ++*/ ++static int ++acx100_s_init_wep(acx_device_t *adev) ++{ ++ acx100_ie_wep_options_t options; ++ ie_dot11WEPDefaultKeyID_t dk; ++ acx_ie_memmap_t pt; ++ int res = NOT_OK; ++ ++ FN_ENTER; ++ ++ if (OK != acx_s_interrogate(adev, &pt, ACX1xx_IE_MEMORY_MAP)) { ++ goto fail; ++ } ++ ++ log(L_DEBUG, "CodeEnd:%X\n", pt.CodeEnd); ++ ++ pt.WEPCacheStart = cpu_to_le32(le32_to_cpu(pt.CodeEnd) + 0x4); ++ pt.WEPCacheEnd = cpu_to_le32(le32_to_cpu(pt.CodeEnd) + 0x4); ++ ++ if (OK != acx_s_configure(adev, &pt, ACX1xx_IE_MEMORY_MAP)) { ++ goto fail; ++ } ++ ++ /* let's choose maximum setting: 4 default keys, plus 10 other keys: */ ++ options.NumKeys = cpu_to_le16(DOT11_MAX_DEFAULT_WEP_KEYS + 10); ++ options.WEPOption = 0x00; ++ ++ log(L_ASSOC, "%s: writing WEP options\n", __func__); ++ acx_s_configure(adev, &options, ACX100_IE_WEP_OPTIONS); ++ ++ acx100_s_set_wepkey(adev); ++ ++ if (adev->wep_keys[adev->wep_current_index].size != 0) { ++ log(L_ASSOC, "setting active default WEP key number: %d\n", ++ adev->wep_current_index); ++ dk.KeyID = adev->wep_current_index; ++ acx_s_configure(adev, &dk, ACX1xx_IE_DOT11_WEP_DEFAULT_KEY_SET); /* 0x1010 */ ++ } ++ /* FIXME!!! wep_key_struct is filled nowhere! But adev ++ * is initialized to 0, and we don't REALLY need those keys either */ ++/* for (i = 0; i < 10; i++) { ++ if (adev->wep_key_struct[i].len != 0) { ++ MAC_COPY(wep_mgmt.MacAddr, adev->wep_key_struct[i].addr); ++ wep_mgmt.KeySize = cpu_to_le16(adev->wep_key_struct[i].len); ++ memcpy(&wep_mgmt.Key, adev->wep_key_struct[i].key, le16_to_cpu(wep_mgmt.KeySize)); ++ wep_mgmt.Action = cpu_to_le16(1); ++ log(L_ASSOC, "writing WEP key %d (len %d)\n", i, le16_to_cpu(wep_mgmt.KeySize)); ++ if (OK == acx_s_issue_cmd(adev, ACX1xx_CMD_WEP_MGMT, &wep_mgmt, sizeof(wep_mgmt))) { ++ adev->wep_key_struct[i].index = i; ++ } ++ } ++ } ++*/ ++ ++ /* now retrieve the updated WEPCacheEnd pointer... */ ++ if (OK != acx_s_interrogate(adev, &pt, ACX1xx_IE_MEMORY_MAP)) { ++ printk("%s: ACX1xx_IE_MEMORY_MAP read #2 FAILED\n", ++ adev->ndev->name); ++ goto fail; ++ } ++ /* ...and tell it to start allocating templates at that location */ ++ /* (no endianness conversion needed) */ ++ pt.PacketTemplateStart = pt.WEPCacheEnd; ++ ++ if (OK != acx_s_configure(adev, &pt, ACX1xx_IE_MEMORY_MAP)) { ++ printk("%s: ACX1xx_IE_MEMORY_MAP write #2 FAILED\n", ++ adev->ndev->name); ++ goto fail; ++ } ++ res = OK; ++ ++fail: ++ FN_EXIT1(res); ++ return res; ++} ++ ++ ++static int ++acx_s_init_max_template_generic(acx_device_t *adev, unsigned int len, unsigned int cmd) ++{ ++ int res; ++ union { ++ acx_template_nullframe_t null; ++ acx_template_beacon_t b; ++ acx_template_tim_t tim; ++ acx_template_probereq_t preq; ++ acx_template_proberesp_t presp; ++ } templ; ++ ++ memset(&templ, 0, len); ++ templ.null.size = cpu_to_le16(len - 2); ++ res = acx_s_issue_cmd(adev, cmd, &templ, len); ++ return res; ++} ++ ++static inline int ++acx_s_init_max_null_data_template(acx_device_t *adev) ++{ ++ return acx_s_init_max_template_generic( ++ adev, sizeof(acx_template_nullframe_t), ACX1xx_CMD_CONFIG_NULL_DATA ++ ); ++} ++ ++static inline int ++acx_s_init_max_beacon_template(acx_device_t *adev) ++{ ++ return acx_s_init_max_template_generic( ++ adev, sizeof(acx_template_beacon_t), ACX1xx_CMD_CONFIG_BEACON ++ ); ++} ++ ++static inline int ++acx_s_init_max_tim_template(acx_device_t *adev) ++{ ++ return acx_s_init_max_template_generic( ++ adev, sizeof(acx_template_tim_t), ACX1xx_CMD_CONFIG_TIM ++ ); ++} ++ ++static inline int ++acx_s_init_max_probe_response_template(acx_device_t *adev) ++{ ++ return acx_s_init_max_template_generic( ++ adev, sizeof(acx_template_proberesp_t), ACX1xx_CMD_CONFIG_PROBE_RESPONSE ++ ); ++} ++ ++static inline int ++acx_s_init_max_probe_request_template(acx_device_t *adev) ++{ ++ return acx_s_init_max_template_generic( ++ adev, sizeof(acx_template_probereq_t), ACX1xx_CMD_CONFIG_PROBE_REQUEST ++ ); ++} ++ ++/*********************************************************************** ++** acx_s_set_tim_template ++** ++** FIXME: In full blown driver we will regularly update partial virtual bitmap ++** by calling this function ++** (it can be done by irq handler on each DTIM irq or by timer...) ++ ++[802.11 7.3.2.6] TIM information element: ++- 1 EID ++- 1 Length ++1 1 DTIM Count ++ indicates how many beacons (including this) appear before next DTIM ++ (0=this one is a DTIM) ++2 1 DTIM Period ++ number of beacons between successive DTIMs ++ (0=reserved, 1=all TIMs are DTIMs, 2=every other, etc) ++3 1 Bitmap Control ++ bit0: Traffic Indicator bit associated with Assoc ID 0 (Bcast AID?) ++ set to 1 in TIM elements with a value of 0 in the DTIM Count field ++ when one or more broadcast or multicast frames are buffered at the AP. ++ bit1-7: Bitmap Offset (logically Bitmap_Offset = Bitmap_Control & 0xFE). ++4 n Partial Virtual Bitmap ++ Visible part of traffic-indication bitmap. ++ Full bitmap consists of 2008 bits (251 octets) such that bit number N ++ (0<=N<=2007) in the bitmap corresponds to bit number (N mod 8) ++ in octet number N/8 where the low-order bit of each octet is bit0, ++ and the high order bit is bit7. ++ Each set bit in virtual bitmap corresponds to traffic buffered by AP ++ for a specific station (with corresponding AID?). ++ Partial Virtual Bitmap shows a part of bitmap which has non-zero. ++ Bitmap Offset is a number of skipped zero octets (see above). ++ 'Missing' octets at the tail are also assumed to be zero. ++ Example: Length=6, Bitmap_Offset=2, Partial_Virtual_Bitmap=55 55 55 ++ This means that traffic-indication bitmap is: ++ 00000000 00000000 01010101 01010101 01010101 00000000 00000000... ++ (is bit0 in the map is always 0 and real value is in Bitmap Control bit0?) ++*/ ++static int ++acx_s_set_tim_template(acx_device_t *adev) ++{ ++/* For now, configure smallish test bitmap, all zero ("no pending data") */ ++ enum { bitmap_size = 5 }; ++ ++ acx_template_tim_t t; ++ int result; ++ ++ FN_ENTER; ++ ++ memset(&t, 0, sizeof(t)); ++ t.size = 5 + bitmap_size; /* eid+len+count+period+bmap_ctrl + bmap */ ++ t.tim_eid = WLAN_EID_TIM; ++ t.len = 3 + bitmap_size; /* count+period+bmap_ctrl + bmap */ ++ result = acx_s_issue_cmd(adev, ACX1xx_CMD_CONFIG_TIM, &t, sizeof(t)); ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_fill_beacon_or_proberesp_template ++** ++** For frame format info, please see 802.11-1999.pdf item 7.2.3.9 and below!! ++** ++** NB: we use the fact that ++** struct acx_template_proberesp and struct acx_template_beacon are the same ++** (well, almost...) ++** ++** [802.11] Beacon's body consist of these IEs: ++** 1 Timestamp ++** 2 Beacon interval ++** 3 Capability information ++** 4 SSID ++** 5 Supported rates (up to 8 rates) ++** 6 FH Parameter Set (frequency-hopping PHYs only) ++** 7 DS Parameter Set (direct sequence PHYs only) ++** 8 CF Parameter Set (only if PCF is supported) ++** 9 IBSS Parameter Set (ad-hoc only) ++** ++** Beacon only: ++** 10 TIM (AP only) (see 802.11 7.3.2.6) ++** 11 Country Information (802.11d) ++** 12 FH Parameters (802.11d) ++** 13 FH Pattern Table (802.11d) ++** ... (?!! did not yet find relevant PDF file... --vda) ++** 19 ERP Information (extended rate PHYs) ++** 20 Extended Supported Rates (if more than 8 rates) ++** ++** Proberesp only: ++** 10 Country information (802.11d) ++** 11 FH Parameters (802.11d) ++** 12 FH Pattern Table (802.11d) ++** 13-n Requested information elements (802.11d) ++** ???? ++** 18 ERP Information (extended rate PHYs) ++** 19 Extended Supported Rates (if more than 8 rates) ++*/ ++static int ++acx_fill_beacon_or_proberesp_template(acx_device_t *adev, ++ struct acx_template_beacon *templ, ++ u16 fc /* in host order! */) ++{ ++ int len; ++ u8 *p; ++ ++ FN_ENTER; ++ ++ memset(templ, 0, sizeof(*templ)); ++ MAC_BCAST(templ->da); ++ MAC_COPY(templ->sa, adev->dev_addr); ++ MAC_COPY(templ->bssid, adev->bssid); ++ ++ templ->beacon_interval = cpu_to_le16(adev->beacon_interval); ++ acx_update_capabilities(adev); ++ templ->cap = cpu_to_le16(adev->capabilities); ++ ++ p = templ->variable; ++ p = wlan_fill_ie_ssid(p, adev->essid_len, adev->essid); ++ p = wlan_fill_ie_rates(p, adev->rate_supported_len, adev->rate_supported); ++ p = wlan_fill_ie_ds_parms(p, adev->channel); ++ /* NB: should go AFTER tim, but acx seem to keep tim last always */ ++ p = wlan_fill_ie_rates_ext(p, adev->rate_supported_len, adev->rate_supported); ++ ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ /* ATIM window */ ++ p = wlan_fill_ie_ibss_parms(p, 0); break; ++ case ACX_MODE_3_AP: ++ /* TIM IE is set up as separate template */ ++ break; ++ } ++ ++ len = p - (u8*)templ; ++ templ->fc = cpu_to_le16(WF_FTYPE_MGMT | fc); ++ /* - 2: do not count 'u16 size' field */ ++ templ->size = cpu_to_le16(len - 2); ++ ++ FN_EXIT1(len); ++ return len; ++} ++ ++ ++#if POWER_SAVE_80211 ++/*********************************************************************** ++** acx_s_set_null_data_template ++*/ ++static int ++acx_s_set_null_data_template(acx_device_t *adev) ++{ ++ struct acx_template_nullframe b; ++ int result; ++ ++ FN_ENTER; ++ ++ /* memset(&b, 0, sizeof(b)); not needed, setting all members */ ++ ++ b.size = cpu_to_le16(sizeof(b) - 2); ++ b.hdr.fc = WF_FTYPE_MGMTi | WF_FSTYPE_NULLi; ++ b.hdr.dur = 0; ++ MAC_BCAST(b.hdr.a1); ++ MAC_COPY(b.hdr.a2, adev->dev_addr); ++ MAC_COPY(b.hdr.a3, adev->bssid); ++ b.hdr.seq = 0; ++ ++ result = acx_s_issue_cmd(adev, ACX1xx_CMD_CONFIG_NULL_DATA, &b, sizeof(b)); ++ ++ FN_EXIT1(result); ++ return result; ++} ++#endif ++ ++ ++/*********************************************************************** ++** acx_s_set_beacon_template ++*/ ++static int ++acx_s_set_beacon_template(acx_device_t *adev) ++{ ++ struct acx_template_beacon bcn; ++ int len, result; ++ ++ FN_ENTER; ++ ++ len = acx_fill_beacon_or_proberesp_template(adev, &bcn, WF_FSTYPE_BEACON); ++ result = acx_s_issue_cmd(adev, ACX1xx_CMD_CONFIG_BEACON, &bcn, len); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_s_set_probe_response_template ++*/ ++static int ++acx_s_set_probe_response_template(acx_device_t *adev) ++{ ++ struct acx_template_proberesp pr; ++ int len, result; ++ ++ FN_ENTER; ++ ++ len = acx_fill_beacon_or_proberesp_template(adev, &pr, WF_FSTYPE_PROBERESP); ++ result = acx_s_issue_cmd(adev, ACX1xx_CMD_CONFIG_PROBE_RESPONSE, &pr, len); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_s_init_packet_templates() ++** ++** NOTE: order is very important here, to have a correct memory layout! ++** init templates: max Probe Request (station mode), max NULL data, ++** max Beacon, max TIM, max Probe Response. ++*/ ++static int ++acx_s_init_packet_templates(acx_device_t *adev) ++{ ++ acx_ie_memmap_t mm; /* ACX100 only */ ++ int result = NOT_OK; ++ ++ FN_ENTER; ++ ++ log(L_DEBUG|L_INIT, "initializing max packet templates\n"); ++ ++ if (OK != acx_s_init_max_probe_request_template(adev)) ++ goto failed; ++ ++ if (OK != acx_s_init_max_null_data_template(adev)) ++ goto failed; ++ ++ if (OK != acx_s_init_max_beacon_template(adev)) ++ goto failed; ++ ++ if (OK != acx_s_init_max_tim_template(adev)) ++ goto failed; ++ ++ if (OK != acx_s_init_max_probe_response_template(adev)) ++ goto failed; ++ ++ if (IS_ACX111(adev)) { ++ /* ACX111 doesn't need the memory map magic below, ++ * and the other templates will be set later (acx_start) */ ++ result = OK; ++ goto success; ++ } ++ ++ /* ACX100 will have its TIM template set, ++ * and we also need to update the memory map */ ++ ++ if (OK != acx_s_set_tim_template(adev)) ++ goto failed_acx100; ++ ++ log(L_DEBUG, "sizeof(memmap)=%d bytes\n", (int)sizeof(mm)); ++ ++ if (OK != acx_s_interrogate(adev, &mm, ACX1xx_IE_MEMORY_MAP)) ++ goto failed_acx100; ++ ++ mm.QueueStart = cpu_to_le32(le32_to_cpu(mm.PacketTemplateEnd) + 4); ++ if (OK != acx_s_configure(adev, &mm, ACX1xx_IE_MEMORY_MAP)) ++ goto failed_acx100; ++ ++ result = OK; ++ goto success; ++ ++failed_acx100: ++ log(L_DEBUG|L_INIT, ++ /* "cb=0x%X\n" */ ++ "ACXMemoryMap:\n" ++ ".CodeStart=0x%X\n" ++ ".CodeEnd=0x%X\n" ++ ".WEPCacheStart=0x%X\n" ++ ".WEPCacheEnd=0x%X\n" ++ ".PacketTemplateStart=0x%X\n" ++ ".PacketTemplateEnd=0x%X\n", ++ /* len, */ ++ le32_to_cpu(mm.CodeStart), ++ le32_to_cpu(mm.CodeEnd), ++ le32_to_cpu(mm.WEPCacheStart), ++ le32_to_cpu(mm.WEPCacheEnd), ++ le32_to_cpu(mm.PacketTemplateStart), ++ le32_to_cpu(mm.PacketTemplateEnd)); ++ ++failed: ++ printk("%s: %s() FAILED\n", adev->ndev->name, __func__); ++ ++success: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx_s_set_probe_request_template(acx_device_t *adev) ++{ ++ struct acx_template_probereq probereq; ++ char *p; ++ int res; ++ int frame_len; ++ ++ FN_ENTER; ++ ++ memset(&probereq, 0, sizeof(probereq)); ++ ++ probereq.fc = WF_FTYPE_MGMTi | WF_FSTYPE_PROBEREQi; ++ MAC_BCAST(probereq.da); ++ MAC_COPY(probereq.sa, adev->dev_addr); ++ MAC_BCAST(probereq.bssid); ++ ++ p = probereq.variable; ++ p = wlan_fill_ie_ssid(p, adev->essid_len, adev->essid); ++ p = wlan_fill_ie_rates(p, adev->rate_supported_len, adev->rate_supported); ++ p = wlan_fill_ie_rates_ext(p, adev->rate_supported_len, adev->rate_supported); ++ frame_len = p - (char*)&probereq; ++ probereq.size = cpu_to_le16(frame_len - 2); ++ ++ res = acx_s_issue_cmd(adev, ACX1xx_CMD_CONFIG_PROBE_REQUEST, &probereq, frame_len); ++ FN_EXIT0; ++ return res; ++} ++ ++ ++/*********************************************************************** ++** acx_s_init_mac ++*/ ++int ++acx_s_init_mac(acx_device_t *adev) ++{ ++ int result = NOT_OK; ++ ++ FN_ENTER; ++ ++ if (IS_ACX111(adev)) { ++ adev->ie_len = acx111_ie_len; ++ adev->ie_len_dot11 = acx111_ie_len_dot11; ++ } else { ++ adev->ie_len = acx100_ie_len; ++ adev->ie_len_dot11 = acx100_ie_len_dot11; ++ } ++ ++#if defined (ACX_MEM) ++ adev->memblocksize = 256; /* 256 is default */ ++ /* try to load radio for both ACX100 and ACX111, since both ++ * chips have at least some firmware versions making use of an ++ * external radio module */ ++ acxmem_s_upload_radio(adev); ++#else ++ if (IS_PCI(adev)) { ++ adev->memblocksize = 256; /* 256 is default */ ++ /* try to load radio for both ACX100 and ACX111, since both ++ * chips have at least some firmware versions making use of an ++ * external radio module */ ++ acxpci_s_upload_radio(adev); ++ } else { ++ adev->memblocksize = 128; ++ } ++#endif ++ ++ if (IS_ACX111(adev)) { ++ /* for ACX111, the order is different from ACX100 ++ 1. init packet templates ++ 2. create station context and create dma regions ++ 3. init wep default keys ++ */ ++ if (OK != acx_s_init_packet_templates(adev)) ++ goto fail; ++ if (OK != acx111_s_create_dma_regions(adev)) { ++ printk("%s: acx111_create_dma_regions FAILED\n", ++ adev->ndev->name); ++ goto fail; ++ } ++ } else { ++ if (OK != acx100_s_init_wep(adev)) ++ goto fail; ++ if (OK != acx_s_init_packet_templates(adev)) ++ goto fail; ++ if (OK != acx100_s_create_dma_regions(adev)) { ++ printk("%s: acx100_create_dma_regions FAILED\n", ++ adev->ndev->name); ++ goto fail; ++ } ++ } ++ ++ MAC_COPY(adev->ndev->dev_addr, adev->dev_addr); ++ result = OK; ++ ++fail: ++ if (result) ++ printk("acx: init_mac() FAILED\n"); ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++void ++acx_s_set_sane_reg_domain(acx_device_t *adev, int do_set) ++{ ++ unsigned mask; ++ ++ unsigned int i; ++ ++ for (i = 0; i < sizeof(acx_reg_domain_ids); i++) ++ if (acx_reg_domain_ids[i] == adev->reg_dom_id) ++ break; ++ ++ if (sizeof(acx_reg_domain_ids) == i) { ++ log(L_INIT, "Invalid or unsupported regulatory domain" ++ " 0x%02X specified, falling back to FCC (USA)!" ++ " Please report if this sounds fishy!\n", ++ adev->reg_dom_id); ++ i = 0; ++ adev->reg_dom_id = acx_reg_domain_ids[i]; ++ ++ /* since there was a mismatch, we need to force updating */ ++ do_set = 1; ++ } ++ ++ if (do_set) { ++ acx_ie_generic_t dom; ++ dom.m.bytes[0] = adev->reg_dom_id; ++ acx_s_configure(adev, &dom, ACX1xx_IE_DOT11_CURRENT_REG_DOMAIN); ++ } ++ ++ adev->reg_dom_chanmask = reg_domain_channel_masks[i]; ++ ++ mask = (1 << (adev->channel - 1)); ++ if (!(adev->reg_dom_chanmask & mask)) { ++ /* hmm, need to adjust our channel to reside within domain */ ++ mask = 1; ++ for (i = 1; i <= 14; i++) { ++ if (adev->reg_dom_chanmask & mask) { ++ printk("%s: adjusting selected channel from %d " ++ "to %d due to new regulatory domain\n", ++ adev->ndev->name, adev->channel, i); ++ adev->channel = i; ++ break; ++ } ++ mask <<= 1; ++ } ++ } ++} ++ ++ ++#if POWER_SAVE_80211 ++static void ++acx_s_update_80211_powersave_mode(acx_device_t *adev) ++{ ++ /* merge both structs in a union to be able to have common code */ ++ union { ++ acx111_ie_powersave_t acx111; ++ acx100_ie_powersave_t acx100; ++ } pm; ++ ++ /* change 802.11 power save mode settings */ ++ log(L_INIT, "updating 802.11 power save mode settings: " ++ "wakeup_cfg 0x%02X, listen interval %u, " ++ "options 0x%02X, hangover period %u, " ++ "enhanced_ps_transition_time %u\n", ++ adev->ps_wakeup_cfg, adev->ps_listen_interval, ++ adev->ps_options, adev->ps_hangover_period, ++ adev->ps_enhanced_transition_time); ++ acx_s_interrogate(adev, &pm, ACX1xx_IE_POWER_MGMT); ++ log(L_INIT, "Previous PS mode settings: wakeup_cfg 0x%02X, " ++ "listen interval %u, options 0x%02X, " ++ "hangover period %u, " ++ "enhanced_ps_transition_time %u, beacon_rx_time %u\n", ++ pm.acx111.wakeup_cfg, ++ pm.acx111.listen_interval, ++ pm.acx111.options, ++ pm.acx111.hangover_period, ++ IS_ACX111(adev) ? ++ pm.acx111.enhanced_ps_transition_time ++ : pm.acx100.enhanced_ps_transition_time, ++ IS_ACX111(adev) ? ++ pm.acx111.beacon_rx_time ++ : (u32)-1 ++ ); ++ pm.acx111.wakeup_cfg = adev->ps_wakeup_cfg; ++ pm.acx111.listen_interval = adev->ps_listen_interval; ++ pm.acx111.options = adev->ps_options; ++ pm.acx111.hangover_period = adev->ps_hangover_period; ++ if (IS_ACX111(adev)) { ++ pm.acx111.beacon_rx_time = cpu_to_le32(adev->ps_beacon_rx_time); ++ pm.acx111.enhanced_ps_transition_time = cpu_to_le32(adev->ps_enhanced_transition_time); ++ } else { ++ pm.acx100.enhanced_ps_transition_time = cpu_to_le16(adev->ps_enhanced_transition_time); ++ } ++ acx_s_configure(adev, &pm, ACX1xx_IE_POWER_MGMT); ++ acx_s_interrogate(adev, &pm, ACX1xx_IE_POWER_MGMT); ++ log(L_INIT, "wakeup_cfg: 0x%02X\n", pm.acx111.wakeup_cfg); ++ acx_s_msleep(40); ++ acx_s_interrogate(adev, &pm, ACX1xx_IE_POWER_MGMT); ++ log(L_INIT, "wakeup_cfg: 0x%02X\n", pm.acx111.wakeup_cfg); ++ log(L_INIT, "power save mode change %s\n", ++ (pm.acx111.wakeup_cfg & PS_CFG_PENDING) ? "FAILED" : "was successful"); ++ /* FIXME: maybe verify via PS_CFG_PENDING bit here ++ * that power save mode change was successful. */ ++ /* FIXME: we shouldn't trigger a scan immediately after ++ * fiddling with power save mode (since the firmware is sending ++ * a NULL frame then). */ ++} ++#endif ++ ++ ++/*********************************************************************** ++** acx_s_update_card_settings ++** ++** Applies accumulated changes in various adev->xxxx members ++** Called by ioctl commit handler, acx_start, acx_set_defaults, ++** acx_s_after_interrupt_task (if IRQ_CMD_UPDATE_CARD_CFG), ++*/ ++static void ++acx111_s_sens_radio_16_17(acx_device_t *adev) ++{ ++ u32 feature1, feature2; ++ ++ if ((adev->sensitivity < 1) || (adev->sensitivity > 3)) { ++ printk("%s: invalid sensitivity setting (1..3), " ++ "setting to 1\n", adev->ndev->name); ++ adev->sensitivity = 1; ++ } ++ acx111_s_get_feature_config(adev, &feature1, &feature2); ++ CLEAR_BIT(feature1, FEATURE1_LOW_RX|FEATURE1_EXTRA_LOW_RX); ++ if (adev->sensitivity > 1) ++ SET_BIT(feature1, FEATURE1_LOW_RX); ++ if (adev->sensitivity > 2) ++ SET_BIT(feature1, FEATURE1_EXTRA_LOW_RX); ++ acx111_s_feature_set(adev, feature1, feature2); ++} ++ ++ ++void ++acx_s_update_card_settings(acx_device_t *adev) ++{ ++ unsigned long flags; ++ unsigned int start_scan = 0; ++ int i; ++ ++ FN_ENTER; ++ ++ log(L_INIT, "get_mask 0x%08X, set_mask 0x%08X\n", ++ adev->get_mask, adev->set_mask); ++ ++ /* Track dependencies betweed various settings */ ++ ++ if (adev->set_mask & (GETSET_MODE|GETSET_RESCAN|GETSET_WEP)) { ++ log(L_INIT, "important setting has been changed. " ++ "Need to update packet templates, too\n"); ++ SET_BIT(adev->set_mask, SET_TEMPLATES); ++ } ++ if (adev->set_mask & GETSET_CHANNEL) { ++ /* This will actually tune RX/TX to the channel */ ++ SET_BIT(adev->set_mask, GETSET_RX|GETSET_TX); ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_3_AP: ++ /* Beacons contain channel# - update them */ ++ SET_BIT(adev->set_mask, SET_TEMPLATES); ++ } ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_2_STA: ++ start_scan = 1; ++ } ++ } ++ ++ /* Apply settings */ ++ ++#ifdef WHY_SHOULD_WE_BOTHER /* imagine we were just powered off */ ++ /* send a disassoc request in case it's required */ ++ if (adev->set_mask & (GETSET_MODE|GETSET_RESCAN|GETSET_CHANNEL|GETSET_WEP)) { ++ if (ACX_MODE_2_STA == adev->mode) { ++ if (ACX_STATUS_4_ASSOCIATED == adev->status) { ++ log(L_ASSOC, "we were ASSOCIATED - " ++ "sending disassoc request\n"); ++ acx_lock(adev, flags); ++ acx_l_transmit_disassoc(adev, NULL); ++ /* FIXME: deauth? */ ++ acx_unlock(adev, flags); ++ } ++ /* need to reset some other stuff as well */ ++ log(L_DEBUG, "resetting bssid\n"); ++ MAC_ZERO(adev->bssid); ++ SET_BIT(adev->set_mask, SET_TEMPLATES|SET_STA_LIST); ++ start_scan = 1; ++ } ++ } ++#endif ++ ++ if (adev->get_mask & GETSET_STATION_ID) { ++ u8 stationID[4 + ACX1xx_IE_DOT11_STATION_ID_LEN]; ++ const u8 *paddr; ++ ++ acx_s_interrogate(adev, &stationID, ACX1xx_IE_DOT11_STATION_ID); ++ paddr = &stationID[4]; ++ for (i = 0; i < ETH_ALEN; i++) { ++ /* we copy the MAC address (reversed in ++ * the card) to the netdevice's MAC ++ * address, and on ifup it will be ++ * copied into iwadev->dev_addr */ ++ adev->ndev->dev_addr[ETH_ALEN - 1 - i] = paddr[i]; ++ } ++ CLEAR_BIT(adev->get_mask, GETSET_STATION_ID); ++ } ++ ++ if (adev->get_mask & GETSET_SENSITIVITY) { ++ if ((RADIO_RFMD_11 == adev->radio_type) ++ || (RADIO_MAXIM_0D == adev->radio_type) ++ || (RADIO_RALINK_15 == adev->radio_type)) { ++ acx_s_read_phy_reg(adev, 0x30, &adev->sensitivity); ++ } else { ++ log(L_INIT, "don't know how to get sensitivity " ++ "for radio type 0x%02X\n", adev->radio_type); ++ adev->sensitivity = 0; ++ } ++ log(L_INIT, "got sensitivity value %u\n", adev->sensitivity); ++ ++ CLEAR_BIT(adev->get_mask, GETSET_SENSITIVITY); ++ } ++ ++ if (adev->get_mask & GETSET_ANTENNA) { ++ u8 antenna[4 + ACX1xx_IE_DOT11_CURRENT_ANTENNA_LEN]; ++ ++ memset(antenna, 0, sizeof(antenna)); ++ acx_s_interrogate(adev, antenna, ACX1xx_IE_DOT11_CURRENT_ANTENNA); ++ adev->antenna = antenna[4]; ++ log(L_INIT, "got antenna value 0x%02X\n", adev->antenna); ++ CLEAR_BIT(adev->get_mask, GETSET_ANTENNA); ++ } ++ ++ if (adev->get_mask & GETSET_ED_THRESH) { ++ if (IS_ACX100(adev)) { ++ u8 ed_threshold[4 + ACX100_IE_DOT11_ED_THRESHOLD_LEN]; ++ ++ memset(ed_threshold, 0, sizeof(ed_threshold)); ++ acx_s_interrogate(adev, ed_threshold, ACX100_IE_DOT11_ED_THRESHOLD); ++ adev->ed_threshold = ed_threshold[4]; ++ } else { ++ log(L_INIT, "acx111 doesn't support ED\n"); ++ adev->ed_threshold = 0; ++ } ++ log(L_INIT, "got Energy Detect (ED) threshold %u\n", adev->ed_threshold); ++ CLEAR_BIT(adev->get_mask, GETSET_ED_THRESH); ++ } ++ ++ if (adev->get_mask & GETSET_CCA) { ++ if (IS_ACX100(adev)) { ++ u8 cca[4 + ACX1xx_IE_DOT11_CURRENT_CCA_MODE_LEN]; ++ ++ memset(cca, 0, sizeof(adev->cca)); ++ acx_s_interrogate(adev, cca, ACX1xx_IE_DOT11_CURRENT_CCA_MODE); ++ adev->cca = cca[4]; ++ } else { ++ log(L_INIT, "acx111 doesn't support CCA\n"); ++ adev->cca = 0; ++ } ++ log(L_INIT, "got Channel Clear Assessment (CCA) value %u\n", adev->cca); ++ CLEAR_BIT(adev->get_mask, GETSET_CCA); ++ } ++ ++ if (adev->get_mask & GETSET_REG_DOMAIN) { ++ acx_ie_generic_t dom; ++ ++ acx_s_interrogate(adev, &dom, ACX1xx_IE_DOT11_CURRENT_REG_DOMAIN); ++ adev->reg_dom_id = dom.m.bytes[0]; ++ acx_s_set_sane_reg_domain(adev, 0); ++ log(L_INIT, "got regulatory domain 0x%02X\n", adev->reg_dom_id); ++ CLEAR_BIT(adev->get_mask, GETSET_REG_DOMAIN); ++ } ++ ++ if (adev->set_mask & GETSET_STATION_ID) { ++ u8 stationID[4 + ACX1xx_IE_DOT11_STATION_ID_LEN]; ++ u8 *paddr; ++ ++ paddr = &stationID[4]; ++ memcpy(adev->dev_addr, adev->ndev->dev_addr, ETH_ALEN); ++ for (i = 0; i < ETH_ALEN; i++) { ++ /* copy the MAC address we obtained when we noticed ++ * that the ethernet iface's MAC changed ++ * to the card (reversed in ++ * the card!) */ ++ paddr[i] = adev->dev_addr[ETH_ALEN - 1 - i]; ++ } ++ acx_s_configure(adev, &stationID, ACX1xx_IE_DOT11_STATION_ID); ++ CLEAR_BIT(adev->set_mask, GETSET_STATION_ID); ++ } ++ ++ if (adev->set_mask & SET_TEMPLATES) { ++ log(L_INIT, "updating packet templates\n"); ++ switch (adev->mode) { ++ case ACX_MODE_2_STA: ++ acx_s_set_probe_request_template(adev); ++#if POWER_SAVE_80211 ++ acx_s_set_null_data_template(adev); ++#endif ++ break; ++ case ACX_MODE_0_ADHOC: ++ acx_s_set_probe_request_template(adev); ++#if POWER_SAVE_80211 ++ /* maybe power save functionality is somehow possible ++ * for Ad-Hoc mode, too... FIXME: verify it somehow? firmware debug fields? */ ++ acx_s_set_null_data_template(adev); ++#endif ++ /* fall through */ ++ case ACX_MODE_3_AP: ++ acx_s_set_beacon_template(adev); ++ acx_s_set_tim_template(adev); ++ /* BTW acx111 firmware would not send probe responses ++ ** if probe request does not have all basic rates flagged ++ ** by 0x80! Thus firmware does not conform to 802.11, ++ ** it should ignore 0x80 bit in ratevector from STA. ++ ** We can 'fix' it by not using this template and ++ ** sending probe responses by hand. TODO --vda */ ++ acx_s_set_probe_response_template(adev); ++ } ++ /* Needed if generated frames are to be emitted at different tx rate now */ ++ log(L_IRQ, "redoing cmd_join_bssid() after template cfg\n"); ++ acx_s_cmd_join_bssid(adev, adev->bssid); ++ CLEAR_BIT(adev->set_mask, SET_TEMPLATES); ++ } ++ if (adev->set_mask & SET_STA_LIST) { ++ acx_lock(adev, flags); ++ acx_l_sta_list_init(adev); ++ CLEAR_BIT(adev->set_mask, SET_STA_LIST); ++ acx_unlock(adev, flags); ++ } ++ if (adev->set_mask & SET_RATE_FALLBACK) { ++ u8 rate[4 + ACX1xx_IE_RATE_FALLBACK_LEN]; ++ ++ /* configure to not do fallbacks when not in auto rate mode */ ++ rate[4] = (adev->rate_auto) ? /* adev->txrate_fallback_retries */ 1 : 0; ++ log(L_INIT, "updating Tx fallback to %u retries\n", rate[4]); ++ acx_s_configure(adev, &rate, ACX1xx_IE_RATE_FALLBACK); ++ CLEAR_BIT(adev->set_mask, SET_RATE_FALLBACK); ++ } ++ if (adev->set_mask & GETSET_TXPOWER) { ++ log(L_INIT, "updating transmit power: %u dBm\n", ++ adev->tx_level_dbm); ++ acx_s_set_tx_level(adev, adev->tx_level_dbm); ++ CLEAR_BIT(adev->set_mask, GETSET_TXPOWER); ++ } ++ ++ if (adev->set_mask & GETSET_SENSITIVITY) { ++ log(L_INIT, "updating sensitivity value: %u\n", ++ adev->sensitivity); ++ switch (adev->radio_type) { ++ case RADIO_RFMD_11: ++ case RADIO_MAXIM_0D: ++ case RADIO_RALINK_15: ++ acx_s_write_phy_reg(adev, 0x30, adev->sensitivity); ++ break; ++ case RADIO_RADIA_16: ++ case RADIO_UNKNOWN_17: ++ acx111_s_sens_radio_16_17(adev); ++ break; ++ default: ++ log(L_INIT, "don't know how to modify sensitivity " ++ "for radio type 0x%02X\n", adev->radio_type); ++ } ++ CLEAR_BIT(adev->set_mask, GETSET_SENSITIVITY); ++ } ++ ++ if (adev->set_mask & GETSET_ANTENNA) { ++ /* antenna */ ++ u8 antenna[4 + ACX1xx_IE_DOT11_CURRENT_ANTENNA_LEN]; ++ ++ memset(antenna, 0, sizeof(antenna)); ++ antenna[4] = adev->antenna; ++ log(L_INIT, "updating antenna value: 0x%02X\n", ++ adev->antenna); ++ acx_s_configure(adev, &antenna, ACX1xx_IE_DOT11_CURRENT_ANTENNA); ++ CLEAR_BIT(adev->set_mask, GETSET_ANTENNA); ++ } ++ ++ if (adev->set_mask & GETSET_ED_THRESH) { ++ /* ed_threshold */ ++ log(L_INIT, "updating Energy Detect (ED) threshold: %u\n", ++ adev->ed_threshold); ++ if (IS_ACX100(adev)) { ++ u8 ed_threshold[4 + ACX100_IE_DOT11_ED_THRESHOLD_LEN]; ++ ++ memset(ed_threshold, 0, sizeof(ed_threshold)); ++ ed_threshold[4] = adev->ed_threshold; ++ acx_s_configure(adev, &ed_threshold, ACX100_IE_DOT11_ED_THRESHOLD); ++ } ++ else ++ log(L_INIT, "acx111 doesn't support ED!\n"); ++ CLEAR_BIT(adev->set_mask, GETSET_ED_THRESH); ++ } ++ ++ if (adev->set_mask & GETSET_CCA) { ++ /* CCA value */ ++ log(L_INIT, "updating Channel Clear Assessment " ++ "(CCA) value: 0x%02X\n", adev->cca); ++ if (IS_ACX100(adev)) { ++ u8 cca[4 + ACX1xx_IE_DOT11_CURRENT_CCA_MODE_LEN]; ++ ++ memset(cca, 0, sizeof(cca)); ++ cca[4] = adev->cca; ++ acx_s_configure(adev, &cca, ACX1xx_IE_DOT11_CURRENT_CCA_MODE); ++ } ++ else ++ log(L_INIT, "acx111 doesn't support CCA!\n"); ++ CLEAR_BIT(adev->set_mask, GETSET_CCA); ++ } ++ ++ if (adev->set_mask & GETSET_LED_POWER) { ++ /* Enable Tx */ ++ log(L_INIT, "updating power LED status: %u\n", adev->led_power); ++ ++ acx_lock(adev, flags); ++#if defined (ACX_MEM) ++ acxmem_l_power_led(adev, adev->led_power); ++#else ++ if (IS_PCI(adev)) ++ acxpci_l_power_led(adev, adev->led_power); ++#endif ++ CLEAR_BIT(adev->set_mask, GETSET_LED_POWER); ++ acx_unlock(adev, flags); ++ } ++ ++ if (adev->set_mask & GETSET_POWER_80211) { ++#if POWER_SAVE_80211 ++ acx_s_update_80211_powersave_mode(adev); ++#endif ++ CLEAR_BIT(adev->set_mask, GETSET_POWER_80211); ++ } ++ ++ if (adev->set_mask & GETSET_CHANNEL) { ++ /* channel */ ++ log(L_INIT, "updating channel to: %u\n", adev->channel); ++ CLEAR_BIT(adev->set_mask, GETSET_CHANNEL); ++ } ++ ++ if (adev->set_mask & GETSET_TX) { ++ /* set Tx */ ++ log(L_INIT, "updating: %s Tx\n", ++ adev->tx_disabled ? "disable" : "enable"); ++ if (adev->tx_disabled) ++ acx_s_issue_cmd(adev, ACX1xx_CMD_DISABLE_TX, NULL, 0); ++ else ++ acx_s_issue_cmd(adev, ACX1xx_CMD_ENABLE_TX, &adev->channel, 1); ++ CLEAR_BIT(adev->set_mask, GETSET_TX); ++ } ++ ++ if (adev->set_mask & GETSET_RX) { ++ /* Enable Rx */ ++ log(L_INIT, "updating: enable Rx on channel: %u\n", ++ adev->channel); ++ acx_s_issue_cmd(adev, ACX1xx_CMD_ENABLE_RX, &adev->channel, 1); ++ CLEAR_BIT(adev->set_mask, GETSET_RX); ++ } ++ ++ if (adev->set_mask & GETSET_RETRY) { ++ u8 short_retry[4 + ACX1xx_IE_DOT11_SHORT_RETRY_LIMIT_LEN]; ++ u8 long_retry[4 + ACX1xx_IE_DOT11_LONG_RETRY_LIMIT_LEN]; ++ ++ log(L_INIT, "updating short retry limit: %u, long retry limit: %u\n", ++ adev->short_retry, adev->long_retry); ++ short_retry[0x4] = adev->short_retry; ++ long_retry[0x4] = adev->long_retry; ++ acx_s_configure(adev, &short_retry, ACX1xx_IE_DOT11_SHORT_RETRY_LIMIT); ++ acx_s_configure(adev, &long_retry, ACX1xx_IE_DOT11_LONG_RETRY_LIMIT); ++ CLEAR_BIT(adev->set_mask, GETSET_RETRY); ++ } ++ ++ if (adev->set_mask & SET_MSDU_LIFETIME) { ++ u8 xmt_msdu_lifetime[4 + ACX1xx_IE_DOT11_MAX_XMIT_MSDU_LIFETIME_LEN]; ++ ++ log(L_INIT, "updating tx MSDU lifetime: %u\n", ++ adev->msdu_lifetime); ++ *(u32 *)&xmt_msdu_lifetime[4] = cpu_to_le32((u32)adev->msdu_lifetime); ++ acx_s_configure(adev, &xmt_msdu_lifetime, ACX1xx_IE_DOT11_MAX_XMIT_MSDU_LIFETIME); ++ CLEAR_BIT(adev->set_mask, SET_MSDU_LIFETIME); ++ } ++ ++ if (adev->set_mask & GETSET_REG_DOMAIN) { ++ log(L_INIT, "updating regulatory domain: 0x%02X\n", ++ adev->reg_dom_id); ++ acx_s_set_sane_reg_domain(adev, 1); ++ CLEAR_BIT(adev->set_mask, GETSET_REG_DOMAIN); ++ } ++ ++ if (adev->set_mask & GETSET_MODE) { ++ adev->ndev->type = (adev->mode == ACX_MODE_MONITOR) ? ++ adev->monitor_type : ARPHRD_ETHER; ++ ++ switch (adev->mode) { ++ case ACX_MODE_3_AP: ++ ++ acx_lock(adev, flags); ++ acx_l_sta_list_init(adev); ++ adev->aid = 0; ++ adev->ap_client = NULL; ++ MAC_COPY(adev->bssid, adev->dev_addr); ++ /* this basically says "we're connected" */ ++ acx_set_status(adev, ACX_STATUS_4_ASSOCIATED); ++ acx_unlock(adev, flags); ++ ++ acx111_s_feature_off(adev, 0, FEATURE2_NO_TXCRYPT|FEATURE2_SNIFFER); ++ /* start sending beacons */ ++ acx_s_cmd_join_bssid(adev, adev->bssid); ++ break; ++ case ACX_MODE_MONITOR: ++ acx111_s_feature_on(adev, 0, FEATURE2_NO_TXCRYPT|FEATURE2_SNIFFER); ++ /* this stops beacons */ ++ acx_s_cmd_join_bssid(adev, adev->bssid); ++ /* this basically says "we're connected" */ ++ acx_set_status(adev, ACX_STATUS_4_ASSOCIATED); ++ SET_BIT(adev->set_mask, SET_RXCONFIG|SET_WEP_OPTIONS); ++ break; ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_2_STA: ++ acx111_s_feature_off(adev, 0, FEATURE2_NO_TXCRYPT|FEATURE2_SNIFFER); ++ ++ acx_lock(adev, flags); ++ adev->aid = 0; ++ adev->ap_client = NULL; ++ acx_unlock(adev, flags); ++ ++ /* we want to start looking for peer or AP */ ++ start_scan = 1; ++ break; ++ case ACX_MODE_OFF: ++ /* TODO: disable RX/TX, stop any scanning activity etc: */ ++ /* adev->tx_disabled = 1; */ ++ /* SET_BIT(adev->set_mask, GETSET_RX|GETSET_TX); */ ++ ++ /* This stops beacons (invalid macmode...) */ ++ acx_s_cmd_join_bssid(adev, adev->bssid); ++ acx_set_status(adev, ACX_STATUS_0_STOPPED); ++ break; ++ } ++ CLEAR_BIT(adev->set_mask, GETSET_MODE); ++ } ++ ++ if (adev->set_mask & SET_RXCONFIG) { ++ acx_s_initialize_rx_config(adev); ++ CLEAR_BIT(adev->set_mask, SET_RXCONFIG); ++ } ++ ++ if (adev->set_mask & GETSET_RESCAN) { ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_2_STA: ++ start_scan = 1; ++ break; ++ } ++ CLEAR_BIT(adev->set_mask, GETSET_RESCAN); ++ } ++ ++ if (adev->set_mask & GETSET_WEP) { ++ /* encode */ ++ ++ ie_dot11WEPDefaultKeyID_t dkey; ++#ifdef DEBUG_WEP ++ struct { ++ u16 type; ++ u16 len; ++ u8 val; ++ } ACX_PACKED keyindic; ++#endif ++ log(L_INIT, "updating WEP key settings\n"); ++ ++ acx_s_set_wepkey(adev); ++ ++ dkey.KeyID = adev->wep_current_index; ++ log(L_INIT, "setting WEP key %u as default\n", dkey.KeyID); ++ acx_s_configure(adev, &dkey, ACX1xx_IE_DOT11_WEP_DEFAULT_KEY_SET); ++#ifdef DEBUG_WEP ++ keyindic.val = 3; ++ acx_s_configure(adev, &keyindic, ACX111_IE_KEY_CHOOSE); ++#endif ++ start_scan = 1; ++ CLEAR_BIT(adev->set_mask, GETSET_WEP); ++ } ++ ++ if (adev->set_mask & SET_WEP_OPTIONS) { ++ acx100_ie_wep_options_t options; ++ if (IS_ACX111(adev)) { ++ log(L_DEBUG, "setting WEP Options for acx111 is not supported\n"); ++ } else { ++ log(L_INIT, "setting WEP Options\n"); ++ acx100_s_init_wep(adev); ++#if 0 ++ /* let's choose maximum setting: 4 default keys, ++ * plus 10 other keys: */ ++ options.NumKeys = cpu_to_le16(DOT11_MAX_DEFAULT_WEP_KEYS + 10); ++ /* don't decrypt default key only, ++ * don't override decryption: */ ++ options.WEPOption = 0; ++ if (adev->mode == ACX_MODE_MONITOR) { ++ /* don't decrypt default key only, ++ * override decryption mechanism: */ ++ options.WEPOption = 2; ++ } ++ ++ acx_s_configure(adev, &options, ACX100_IE_WEP_OPTIONS); ++#endif ++ } ++ CLEAR_BIT(adev->set_mask, SET_WEP_OPTIONS); ++ } ++ ++ /* Rescan was requested */ ++ if (start_scan) { ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_2_STA: ++ /* We can avoid clearing list if join code ++ ** will be a bit more clever about not picking ++ ** 'bad' AP over and over again */ ++ acx_lock(adev, flags); ++ adev->ap_client = NULL; ++ acx_l_sta_list_init(adev); ++ acx_set_status(adev, ACX_STATUS_1_SCANNING); ++ acx_unlock(adev, flags); ++ ++ acx_s_cmd_start_scan(adev); ++ } ++ } ++ ++ /* debug, rate, and nick don't need any handling */ ++ /* what about sniffing mode?? */ ++ ++ log(L_INIT, "get_mask 0x%08X, set_mask 0x%08X - after update\n", ++ adev->get_mask, adev->set_mask); ++ ++/* end: */ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_e_after_interrupt_task ++*/ ++static int ++acx_s_recalib_radio(acx_device_t *adev) ++{ ++ if (IS_ACX111(adev)) { ++ acx111_cmd_radiocalib_t cal; ++ ++ printk("%s: recalibrating radio\n", adev->ndev->name); ++ /* automatic recalibration, choose all methods: */ ++ cal.methods = cpu_to_le32(0x8000000f); ++ /* automatic recalibration every 60 seconds (value in TUs) ++ * I wonder what the firmware default here is? */ ++ cal.interval = cpu_to_le32(58594); ++ return acx_s_issue_cmd_timeo(adev, ACX111_CMD_RADIOCALIB, ++ &cal, sizeof(cal), CMD_TIMEOUT_MS(100)); ++ } else { ++ /* On ACX100, we need to recalibrate the radio ++ * by issuing a GETSET_TX|GETSET_RX */ ++ if (/* (OK == acx_s_issue_cmd(adev, ACX1xx_CMD_DISABLE_TX, NULL, 0)) && ++ (OK == acx_s_issue_cmd(adev, ACX1xx_CMD_DISABLE_RX, NULL, 0)) && */ ++ (OK == acx_s_issue_cmd(adev, ACX1xx_CMD_ENABLE_TX, &adev->channel, 1)) && ++ (OK == acx_s_issue_cmd(adev, ACX1xx_CMD_ENABLE_RX, &adev->channel, 1)) ) ++ return OK; ++ return NOT_OK; ++ } ++} ++ ++static void ++acx_s_after_interrupt_recalib(acx_device_t *adev) ++{ ++ int res; ++ ++ /* this helps with ACX100 at least; ++ * hopefully ACX111 also does a ++ * recalibration here */ ++ ++ /* clear flag beforehand, since we want to make sure ++ * it's cleared; then only set it again on specific circumstances */ ++ CLEAR_BIT(adev->after_interrupt_jobs, ACX_AFTER_IRQ_CMD_RADIO_RECALIB); ++ ++ /* better wait a bit between recalibrations to ++ * prevent overheating due to torturing the card ++ * into working too long despite high temperature ++ * (just a safety measure) */ ++ if (adev->recalib_time_last_success ++ && time_before(jiffies, adev->recalib_time_last_success ++ + RECALIB_PAUSE * 60 * HZ)) { ++ if (adev->recalib_msg_ratelimit <= 4) { ++ printk("%s: less than " STRING(RECALIB_PAUSE) ++ " minutes since last radio recalibration, " ++ "not recalibrating (maybe card is too hot?)\n", ++ adev->ndev->name); ++ adev->recalib_msg_ratelimit++; ++ if (adev->recalib_msg_ratelimit == 5) ++ printk("disabling above message until next recalib\n"); ++ } ++ return; ++ } ++ ++ adev->recalib_msg_ratelimit = 0; ++ ++ /* note that commands sometimes fail (card busy), ++ * so only clear flag if we were fully successful */ ++ res = acx_s_recalib_radio(adev); ++ if (res == OK) { ++ printk("%s: successfully recalibrated radio\n", ++ adev->ndev->name); ++ adev->recalib_time_last_success = jiffies; ++ adev->recalib_failure_count = 0; ++ } else { ++ /* failed: resubmit, but only limited ++ * amount of times within some time range ++ * to prevent endless loop */ ++ ++ adev->recalib_time_last_success = 0; /* we failed */ ++ ++ /* if some time passed between last ++ * attempts, then reset failure retry counter ++ * to be able to do next recalib attempt */ ++ if (time_after(jiffies, adev->recalib_time_last_attempt + 5*HZ)) ++ adev->recalib_failure_count = 0; ++ ++ if (adev->recalib_failure_count < 5) { ++ /* increment inside only, for speedup of outside path */ ++ adev->recalib_failure_count++; ++ adev->recalib_time_last_attempt = jiffies; ++ acx_schedule_task(adev, ACX_AFTER_IRQ_CMD_RADIO_RECALIB); ++ } ++ } ++} ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20) ++static void ++acx_e_after_interrupt_task(struct work_struct *work) ++{ ++ acx_device_t *adev = container_of(work, acx_device_t, after_interrupt_task); ++#else ++ static void ++ acx_e_after_interrupt_task(void *data) ++ { ++ struct net_device *ndev = (struct net_device*)data; ++ acx_device_t *adev = ndev2adev(ndev); ++#endif ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ if (!adev->after_interrupt_jobs) ++ goto end; /* no jobs to do */ ++ ++#if TX_CLEANUP_IN_SOFTIRQ ++ /* can happen only on PCI */ ++ if (adev->after_interrupt_jobs & ACX_AFTER_IRQ_TX_CLEANUP) { ++ acx_lock(adev, flags); ++ acxpci_l_clean_txdesc(adev); ++ CLEAR_BIT(adev->after_interrupt_jobs, ACX_AFTER_IRQ_TX_CLEANUP); ++ acx_unlock(adev, flags); ++ } ++#endif ++ /* we see lotsa tx errors */ ++ if (adev->after_interrupt_jobs & ACX_AFTER_IRQ_CMD_RADIO_RECALIB) { ++ acx_s_after_interrupt_recalib(adev); ++ } ++ ++ /* a poor interrupt code wanted to do update_card_settings() */ ++ if (adev->after_interrupt_jobs & ACX_AFTER_IRQ_UPDATE_CARD_CFG) { ++ if (ACX_STATE_IFACE_UP & adev->dev_state_mask) ++ acx_s_update_card_settings(adev); ++ CLEAR_BIT(adev->after_interrupt_jobs, ACX_AFTER_IRQ_UPDATE_CARD_CFG); ++ } ++ ++ /* 1) we detected that no Scan_Complete IRQ came from fw, or ++ ** 2) we found too many STAs */ ++ if (adev->after_interrupt_jobs & ACX_AFTER_IRQ_CMD_STOP_SCAN) { ++ log(L_IRQ, "sending a stop scan cmd...\n"); ++ acx_s_issue_cmd(adev, ACX1xx_CMD_STOP_SCAN, NULL, 0); ++ /* HACK: set the IRQ bit, since we won't get a ++ * scan complete IRQ any more on ACX111 (works on ACX100!), ++ * since _we_, not a fw, have stopped the scan */ ++ SET_BIT(adev->irq_status, HOST_INT_SCAN_COMPLETE); ++ CLEAR_BIT(adev->after_interrupt_jobs, ACX_AFTER_IRQ_CMD_STOP_SCAN); ++ } ++ ++ /* either fw sent Scan_Complete or we detected that ++ ** no Scan_Complete IRQ came from fw. Finish scanning, ++ ** pick join partner if any */ ++ if (adev->after_interrupt_jobs & ACX_AFTER_IRQ_COMPLETE_SCAN) { ++ if (adev->status == ACX_STATUS_1_SCANNING) { ++ if (OK != acx_s_complete_scan(adev)) { ++ SET_BIT(adev->after_interrupt_jobs, ++ ACX_AFTER_IRQ_RESTART_SCAN); ++ } ++ } else { ++ /* + scan kills current join status - restore it ++ ** (do we need it for STA?) */ ++ /* + does it happen only with active scans? ++ ** active and passive scans? ALL scans including ++ ** background one? */ ++ /* + was not verified that everything is restored ++ ** (but at least we start to emit beacons again) */ ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_3_AP: ++ log(L_IRQ, "redoing cmd_join_bssid() after scan\n"); ++ acx_s_cmd_join_bssid(adev, adev->bssid); ++ } ++ } ++ CLEAR_BIT(adev->after_interrupt_jobs, ACX_AFTER_IRQ_COMPLETE_SCAN); ++ } ++ ++ /* STA auth or assoc timed out, start over again */ ++ if (adev->after_interrupt_jobs & ACX_AFTER_IRQ_RESTART_SCAN) { ++ log(L_IRQ, "sending a start_scan cmd...\n"); ++ acx_s_cmd_start_scan(adev); ++ CLEAR_BIT(adev->after_interrupt_jobs, ACX_AFTER_IRQ_RESTART_SCAN); ++ } ++ ++ /* whee, we got positive assoc response! 8) */ ++ if (adev->after_interrupt_jobs & ACX_AFTER_IRQ_CMD_ASSOCIATE) { ++ acx_ie_generic_t pdr; ++ /* tiny race window exists, checking that we still a STA */ ++ switch (adev->mode) { ++ case ACX_MODE_2_STA: ++ pdr.m.aid = cpu_to_le16(adev->aid); ++ acx_s_configure(adev, &pdr, ACX1xx_IE_ASSOC_ID); ++ acx_set_status(adev, ACX_STATUS_4_ASSOCIATED); ++ log(L_ASSOC|L_DEBUG, "ASSOCIATED!\n"); ++ CLEAR_BIT(adev->after_interrupt_jobs, ACX_AFTER_IRQ_CMD_ASSOCIATE); ++ } ++ } ++end: ++ acx_sem_unlock(adev); ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_schedule_task ++** ++** Schedule the call of the after_interrupt method after leaving ++** the interrupt context. ++*/ ++void ++acx_schedule_task(acx_device_t *adev, unsigned int set_flag) ++{ ++ SET_BIT(adev->after_interrupt_jobs, set_flag); ++ SCHEDULE_WORK(&adev->after_interrupt_task); ++} ++ ++ ++/*********************************************************************** ++*/ ++void ++acx_init_task_scheduler(acx_device_t *adev) ++{ ++ /* configure task scheduler */ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20) ++ INIT_WORK(&adev->after_interrupt_task, acx_e_after_interrupt_task); ++#else ++ INIT_WORK(&adev->after_interrupt_task, acx_e_after_interrupt_task, ++ adev->ndev); ++#endif ++} ++ ++ ++/*********************************************************************** ++** acx_s_start ++*/ ++void ++acx_s_start(acx_device_t *adev) ++{ ++ FN_ENTER; ++ ++ /* ++ * Ok, now we do everything that can possibly be done with ioctl ++ * calls to make sure that when it was called before the card ++ * was up we get the changes asked for ++ */ ++ ++ SET_BIT(adev->set_mask, SET_TEMPLATES|SET_STA_LIST|GETSET_WEP ++ |GETSET_TXPOWER|GETSET_ANTENNA|GETSET_ED_THRESH|GETSET_CCA ++ |GETSET_REG_DOMAIN|GETSET_MODE|GETSET_CHANNEL ++ |GETSET_TX|GETSET_RX|GETSET_STATION_ID); ++ ++ log(L_INIT, "updating initial settings on iface activation\n"); ++ acx_s_update_card_settings(adev); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acx_update_capabilities ++*/ ++void ++acx_update_capabilities(acx_device_t *adev) ++{ ++ u16 cap = 0; ++ ++ switch (adev->mode) { ++ case ACX_MODE_3_AP: ++ SET_BIT(cap, WF_MGMT_CAP_ESS); break; ++ case ACX_MODE_0_ADHOC: ++ SET_BIT(cap, WF_MGMT_CAP_IBSS); break; ++ /* other types of stations do not emit beacons */ ++ } ++ ++ if (adev->wep_restricted) { ++ SET_BIT(cap, WF_MGMT_CAP_PRIVACY); ++ } ++ if (adev->cfgopt_dot11ShortPreambleOption) { ++ SET_BIT(cap, WF_MGMT_CAP_SHORT); ++ } ++ if (adev->cfgopt_dot11PBCCOption) { ++ SET_BIT(cap, WF_MGMT_CAP_PBCC); ++ } ++ if (adev->cfgopt_dot11ChannelAgility) { ++ SET_BIT(cap, WF_MGMT_CAP_AGILITY); ++ } ++ log(L_DEBUG, "caps updated from 0x%04X to 0x%04X\n", ++ adev->capabilities, cap); ++ adev->capabilities = cap; ++} ++ ++/*********************************************************************** ++** Common function to parse ALL configoption struct formats ++** (ACX100 and ACX111; FIXME: how to make it work with ACX100 USB!?!?). ++** FIXME: logging should be removed here and added to a /proc file instead ++*/ ++void ++acx_s_parse_configoption(acx_device_t *adev, const acx111_ie_configoption_t *pcfg) ++{ ++ const u8 *pEle; ++ int i; ++ int is_acx111 = IS_ACX111(adev); ++ ++ if (acx_debug & L_DEBUG) { ++ printk("configoption struct content:\n"); ++ acx_dump_bytes(pcfg, sizeof(*pcfg)); ++ } ++ ++ if (( is_acx111 && (adev->eeprom_version == 5)) ++ || (!is_acx111 && (adev->eeprom_version == 4)) ++ || (!is_acx111 && (adev->eeprom_version == 5))) { ++ /* these versions are known to be supported */ ++ } else { ++ printk("unknown chip and EEPROM version combination (%s, v%d), " ++ "don't know how to parse config options yet. " ++ "Please report\n", is_acx111 ? "ACX111" : "ACX100", ++ adev->eeprom_version); ++ return; ++ } ++ ++ /* first custom-parse the first part which has chip-specific layout */ ++ ++ pEle = (const u8 *) pcfg; ++ ++ pEle += 4; /* skip (type,len) header */ ++ ++ memcpy(adev->cfgopt_NVSv, pEle, sizeof(adev->cfgopt_NVSv)); ++ pEle += sizeof(adev->cfgopt_NVSv); ++ ++ if (is_acx111) { ++ adev->cfgopt_NVS_vendor_offs = le16_to_cpu(*(u16 *)pEle); ++ pEle += sizeof(adev->cfgopt_NVS_vendor_offs); ++ ++ adev->cfgopt_probe_delay = 200; /* good default value? */ ++ pEle += 2; /* FIXME: unknown, value 0x0001 */ ++ } else { ++ memcpy(adev->cfgopt_MAC, pEle, sizeof(adev->cfgopt_MAC)); ++ pEle += sizeof(adev->cfgopt_MAC); ++ ++ adev->cfgopt_probe_delay = le16_to_cpu(*(u16 *)pEle); ++ pEle += sizeof(adev->cfgopt_probe_delay); ++ if ((adev->cfgopt_probe_delay < 100) || (adev->cfgopt_probe_delay > 500)) { ++ printk("strange probe_delay value %d, " ++ "tweaking to 200\n", adev->cfgopt_probe_delay); ++ adev->cfgopt_probe_delay = 200; ++ } ++ } ++ ++ adev->cfgopt_eof_memory = le32_to_cpu(*(u32 *)pEle); ++ pEle += sizeof(adev->cfgopt_eof_memory); ++ ++ printk("NVS_vendor_offs:%04X probe_delay:%d eof_memory:%d\n", ++ adev->cfgopt_NVS_vendor_offs, ++ adev->cfgopt_probe_delay, ++ adev->cfgopt_eof_memory); ++ ++ adev->cfgopt_dot11CCAModes = *pEle++; ++ adev->cfgopt_dot11Diversity = *pEle++; ++ adev->cfgopt_dot11ShortPreambleOption = *pEle++; ++ adev->cfgopt_dot11PBCCOption = *pEle++; ++ adev->cfgopt_dot11ChannelAgility = *pEle++; ++ adev->cfgopt_dot11PhyType = *pEle++; ++ adev->cfgopt_dot11TempType = *pEle++; ++ printk("CCAModes:%02X Diversity:%02X ShortPreOpt:%02X " ++ "PBCC:%02X ChanAgil:%02X PHY:%02X Temp:%02X\n", ++ adev->cfgopt_dot11CCAModes, ++ adev->cfgopt_dot11Diversity, ++ adev->cfgopt_dot11ShortPreambleOption, ++ adev->cfgopt_dot11PBCCOption, ++ adev->cfgopt_dot11ChannelAgility, ++ adev->cfgopt_dot11PhyType, ++ adev->cfgopt_dot11TempType); ++ ++ /* then use common parsing for next part which has common layout */ ++ ++ pEle++; /* skip table_count (6) */ ++ ++ if (IS_MEM(adev) && IS_ACX100(adev)) ++ { ++ /* ++ * For iPaq hx4700 Generic Slave F/W 1.10.7.K. I'm not sure if these ++ * 4 extra bytes are before the dot11 things above or after, so I'm just ++ * going to guess after. If someone sees these aren't reasonable numbers, ++ * please fix this. ++ * The area from which the dot11 values above are read contains: ++ * 04 01 01 01 00 05 01 06 00 02 01 02 ++ * the 8 dot11 reads above take care of 8 of them, but which 8... ++ */ ++ pEle += 4; ++ } ++ ++ adev->cfgopt_antennas.type = pEle[0]; ++ adev->cfgopt_antennas.len = pEle[1]; ++ printk("AntennaID:%02X Len:%02X Data:", ++ adev->cfgopt_antennas.type, adev->cfgopt_antennas.len); ++ for (i = 0; i < pEle[1]; i++) { ++ adev->cfgopt_antennas.list[i] = pEle[i+2]; ++ printk("%02X ", pEle[i+2]); ++ } ++ printk("\n"); ++ ++ pEle += pEle[1] + 2; ++ adev->cfgopt_power_levels.type = pEle[0]; ++ adev->cfgopt_power_levels.len = pEle[1]; ++ printk("PowerLevelID:%02X Len:%02X Data:", ++ adev->cfgopt_power_levels.type, adev->cfgopt_power_levels.len); ++ for (i = 0; i < pEle[1]; i++) { ++ adev->cfgopt_power_levels.list[i] = le16_to_cpu(*(u16 *)&pEle[i*2+2]); ++ printk("%04X ", adev->cfgopt_power_levels.list[i]); ++ } ++ printk("\n"); ++ ++ pEle += pEle[1]*2 + 2; ++ adev->cfgopt_data_rates.type = pEle[0]; ++ adev->cfgopt_data_rates.len = pEle[1]; ++ printk("DataRatesID:%02X Len:%02X Data:", ++ adev->cfgopt_data_rates.type, adev->cfgopt_data_rates.len); ++ for (i = 0; i < pEle[1]; i++) { ++ adev->cfgopt_data_rates.list[i] = pEle[i+2]; ++ printk("%02X ", pEle[i+2]); ++ } ++ printk("\n"); ++ ++ pEle += pEle[1] + 2; ++ adev->cfgopt_domains.type = pEle[0]; ++ adev->cfgopt_domains.len = pEle[1]; ++ if (IS_MEM(adev) && IS_ACX100(adev)) ++ { ++ /* ++ * For iPaq hx4700 Generic Slave F/W 1.10.7.K. ++ * There's an extra byte between this structure and the next ++ * that is not accounted for with this structure's length. It's ++ * most likely a bug in the firmware, but we can fix it here ++ * by bumping the length of this field by 1. ++ */ ++ adev->cfgopt_domains.len++; ++ } ++ printk("DomainID:%02X Len:%02X Data:", ++ adev->cfgopt_domains.type, adev->cfgopt_domains.len); ++ for (i = 0; i < adev->cfgopt_domains.len; i++) { ++ adev->cfgopt_domains.list[i] = pEle[i+2]; ++ printk("%02X ", pEle[i+2]); ++ } ++ printk("\n"); ++ ++ pEle += adev->cfgopt_domains.len + 2; ++ ++ adev->cfgopt_product_id.type = pEle[0]; ++ adev->cfgopt_product_id.len = pEle[1]; ++ for (i = 0; i < pEle[1]; i++) { ++ adev->cfgopt_product_id.list[i] = pEle[i+2]; ++ } ++ printk("ProductID:%02X Len:%02X Data:%.*s\n", ++ adev->cfgopt_product_id.type, adev->cfgopt_product_id.len, ++ adev->cfgopt_product_id.len, (char *)adev->cfgopt_product_id.list); ++ ++ pEle += pEle[1] + 2; ++ adev->cfgopt_manufacturer.type = pEle[0]; ++ adev->cfgopt_manufacturer.len = pEle[1]; ++ for (i = 0; i < pEle[1]; i++) { ++ adev->cfgopt_manufacturer.list[i] = pEle[i+2]; ++ } ++ printk("ManufacturerID:%02X Len:%02X Data:%.*s\n", ++ adev->cfgopt_manufacturer.type, adev->cfgopt_manufacturer.len, ++ adev->cfgopt_manufacturer.len, (char *)adev->cfgopt_manufacturer.list); ++/* ++ printk("EEPROM part:\n"); ++ for (i=0; i<58; i++) { ++ printk("%02X =======> 0x%02X\n", ++ i, (u8 *)adev->cfgopt_NVSv[i-2]); ++ } ++*/ ++} ++ ++ ++/*********************************************************************** ++*/ ++static int __init ++acx_e_init_module(void) ++{ ++ int r1,r2,r3,r4; ++ ++ acx_struct_size_check(); ++ ++ printk("acx: this driver is still EXPERIMENTAL\n" ++ "acx: reading README file and/or Craig's HOWTO is " ++ "recommended, visit http://acx100.sf.net in case " ++ "of further questions/discussion\n"); ++ ++#if defined(CONFIG_ACX_PCI) ++ r1 = acxpci_e_init_module(); ++#else ++ r1 = -EINVAL; ++#endif ++#if defined(CONFIG_ACX_MEM) ++ r2 = acxmem_e_init_module(); ++#else ++ r2 = -EINVAL; ++#endif ++#if defined(CONFIG_ACX_USB) ++ r3 = acxusb_e_init_module(); ++#else ++ r3 = -EINVAL; ++#endif ++#if defined(CONFIG_ACX_CS) ++ r4 = acx_cs_init(); ++#else ++ r4 = -EINVAL; ++#endif ++ if (r2 && r1 && r3 && r4) { /* all failed! */ ++ if (r3 || r1) ++ return r3 ? r3 : r1; ++ else ++ return r2; ++ } ++ /* return success if at least one succeeded */ ++ return 0; ++ ++} ++ ++static void __exit ++acx_e_cleanup_module(void) ++{ ++#if defined(CONFIG_ACX_PCI) ++ acxpci_e_cleanup_module(); ++#endif ++#if defined(CONFIG_ACX_MEM) ++ acxmem_e_cleanup_module(); ++#endif ++#if defined(CONFIG_ACX_USB) ++ acxusb_e_cleanup_module(); ++#endif ++#if defined(CONFIG_ACX_CS) ++ acx_cs_cleanup(); ++#endif ++} ++ ++module_init(acx_e_init_module) ++module_exit(acx_e_cleanup_module) +Index: linux-2.6.22/drivers/net/wireless/acx/conv.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/conv.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,504 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++*/ ++ ++#include <linux/version.h> ++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) ++#include <linux/config.h> ++#endif ++#include <linux/skbuff.h> ++#include <linux/if_arp.h> ++#include <linux/etherdevice.h> ++#include <linux/wireless.h> ++#include <net/iw_handler.h> ++ ++#include "acx.h" ++ ++ ++/*********************************************************************** ++** proto_is_stt ++** ++** Searches the 802.1h Selective Translation Table for a given ++** protocol. ++** ++** prottype - protocol number (in host order) to search for. ++** ++** Returns: ++** 1 - if the table is empty or a match is found. ++** 0 - if the table is non-empty and a match is not found. ++** ++** Based largely on p80211conv.c of the linux-wlan-ng project ++*/ ++static inline int ++proto_is_stt(unsigned int proto) ++{ ++ /* Always return found for now. This is the behavior used by the */ ++ /* Zoom Win95 driver when 802.1h mode is selected */ ++ /* TODO: If necessary, add an actual search we'll probably ++ need this to match the CMAC's way of doing things. ++ Need to do some testing to confirm. ++ */ ++ ++ if (proto == 0x80f3) /* APPLETALK */ ++ return 1; ++ ++ return 0; ++/* return ((prottype == ETH_P_AARP) || (prottype == ETH_P_IPX)); */ ++} ++ ++/* Helpers */ ++ ++static inline void ++store_llc_snap(struct wlan_llc *llc) ++{ ++ llc->dsap = 0xaa; /* SNAP, see IEEE 802 */ ++ llc->ssap = 0xaa; ++ llc->ctl = 0x03; ++} ++static inline int ++llc_is_snap(const struct wlan_llc *llc) ++{ ++ return (llc->dsap == 0xaa) ++ && (llc->ssap == 0xaa) ++ && (llc->ctl == 0x03); ++} ++static inline void ++store_oui_rfc1042(struct wlan_snap *snap) ++{ ++ snap->oui[0] = 0; ++ snap->oui[1] = 0; ++ snap->oui[2] = 0; ++} ++static inline int ++oui_is_rfc1042(const struct wlan_snap *snap) ++{ ++ return (snap->oui[0] == 0) ++ && (snap->oui[1] == 0) ++ && (snap->oui[2] == 0); ++} ++static inline void ++store_oui_8021h(struct wlan_snap *snap) ++{ ++ snap->oui[0] = 0; ++ snap->oui[1] = 0; ++ snap->oui[2] = 0xf8; ++} ++static inline int ++oui_is_8021h(const struct wlan_snap *snap) ++{ ++ return (snap->oui[0] == 0) ++ && (snap->oui[1] == 0) ++ && (snap->oui[2] == 0xf8); ++} ++ ++ ++/*********************************************************************** ++** acx_ether_to_txbuf ++** ++** Uses the contents of the ether frame to build the elements of ++** the 802.11 frame. ++** ++** We don't actually set up the frame header here. That's the ++** MAC's job. We're only handling conversion of DIXII or 802.3+LLC ++** frames to something that works with 802.11. ++** ++** Based largely on p80211conv.c of the linux-wlan-ng project ++*/ ++int ++acx_ether_to_txbuf(acx_device_t *adev, void *txbuf, const struct sk_buff *skb) ++{ ++ struct wlan_hdr_a3 *w_hdr; ++ struct wlan_ethhdr *e_hdr; ++ struct wlan_llc *e_llc; ++ struct wlan_snap *e_snap; ++ const u8 *a1, *a3; ++ int header_len, payload_len = -1; ++ /* protocol type or data length, depending on whether ++ * DIX or 802.3 ethernet format */ ++ u16 proto; ++ u16 fc; ++ ++ FN_ENTER; ++ ++ if (unlikely(!skb->len)) { ++ log(L_DEBUG, "zero-length skb!\n"); ++ goto end; ++ } ++ ++ w_hdr = (struct wlan_hdr_a3*)txbuf; ++ ++ switch (adev->mode) { ++ case ACX_MODE_MONITOR: ++ /* NB: one day we might want to play with DESC_CTL2_FCS ++ ** Will need to stop doing "- WLAN_FCS_LEN" here then */ ++ if (unlikely(skb->len >= WLAN_A4FR_MAXLEN_WEP_FCS - WLAN_FCS_LEN)) { ++ printk("%s: can't tx oversized frame (%d bytes)\n", ++ adev->ndev->name, skb->len); ++ goto end; ++ } ++ memcpy(w_hdr, skb->data, skb->len); ++ payload_len = skb->len; ++ goto end; ++ } ++ ++ /* step 1: classify ether frame, DIX or 802.3? */ ++ e_hdr = (wlan_ethhdr_t *)skb->data; ++ proto = ntohs(e_hdr->type); ++ if (proto <= 1500) { ++ log(L_DEBUG, "tx: 802.3 len: %d\n", skb->len); ++ /* codes <= 1500 reserved for 802.3 lengths */ ++ /* it's 802.3, pass ether payload unchanged, */ ++ /* trim off ethernet header and copy payload to txdesc */ ++ header_len = WLAN_HDR_A3_LEN; ++ } else { ++ /* it's DIXII, time for some conversion */ ++ /* Create 802.11 packet. Header also contains llc and snap. */ ++ ++ log(L_DEBUG, "tx: DIXII len: %d\n", skb->len); ++ ++ /* size of header is 802.11 header + llc + snap */ ++ header_len = WLAN_HDR_A3_LEN + sizeof(wlan_llc_t) + sizeof(wlan_snap_t); ++ /* llc is located behind the 802.11 header */ ++ e_llc = (wlan_llc_t*)(w_hdr + 1); ++ /* snap is located behind the llc */ ++ e_snap = (wlan_snap_t*)(e_llc + 1); ++ ++ /* setup the LLC header */ ++ store_llc_snap(e_llc); ++ ++ /* setup the SNAP header */ ++ e_snap->type = htons(proto); ++ if (proto_is_stt(proto)) { ++ store_oui_8021h(e_snap); ++ } else { ++ store_oui_rfc1042(e_snap); ++ } ++ } ++ /* trim off ethernet header and copy payload to txbuf */ ++ payload_len = skb->len - sizeof(wlan_ethhdr_t); ++ /* TODO: can we just let acx DMA payload from skb instead? */ ++ memcpy((u8*)txbuf + header_len, skb->data + sizeof(wlan_ethhdr_t), payload_len); ++ payload_len += header_len; ++ ++ /* Set up the 802.11 header */ ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ fc = (WF_FTYPE_DATAi | WF_FSTYPE_DATAONLYi); ++ a1 = e_hdr->daddr; ++ a3 = adev->bssid; ++ break; ++ case ACX_MODE_2_STA: ++ fc = (WF_FTYPE_DATAi | WF_FSTYPE_DATAONLYi | WF_FC_TODSi); ++ a1 = adev->bssid; ++ a3 = e_hdr->daddr; ++ break; ++ case ACX_MODE_3_AP: ++ fc = (WF_FTYPE_DATAi | WF_FSTYPE_DATAONLYi | WF_FC_FROMDSi); ++ a1 = e_hdr->daddr; ++ a3 = e_hdr->saddr; ++ break; ++ default: ++ printk("%s: error - converting eth to wlan in unknown mode\n", ++ adev->ndev->name); ++ payload_len = -1; ++ goto end; ++ } ++ if (adev->wep_enabled) ++ SET_BIT(fc, WF_FC_ISWEPi); ++ ++ w_hdr->fc = fc; ++ w_hdr->dur = 0; ++ MAC_COPY(w_hdr->a1, a1); ++ MAC_COPY(w_hdr->a2, adev->dev_addr); ++ MAC_COPY(w_hdr->a3, a3); ++ w_hdr->seq = 0; ++ ++#ifdef DEBUG_CONVERT ++ if (acx_debug & L_DATA) { ++ printk("original eth frame [%d]: ", skb->len); ++ acx_dump_bytes(skb->data, skb->len); ++ printk("802.11 frame [%d]: ", payload_len); ++ acx_dump_bytes(w_hdr, payload_len); ++ } ++#endif ++ ++end: ++ FN_EXIT1(payload_len); ++ return payload_len; ++} ++ ++ ++/*********************************************************************** ++** acx_rxbuf_to_ether ++** ++** Uses the contents of a received 802.11 frame to build an ether ++** frame. ++** ++** This function extracts the src and dest address from the 802.11 ++** frame to use in the construction of the eth frame. ++** ++** Based largely on p80211conv.c of the linux-wlan-ng project ++*/ ++struct sk_buff* ++acx_rxbuf_to_ether(acx_device_t *adev, rxbuffer_t *rxbuf) ++{ ++ struct wlan_hdr *w_hdr; ++ struct wlan_ethhdr *e_hdr; ++ struct wlan_llc *e_llc; ++ struct wlan_snap *e_snap; ++ struct sk_buff *skb; ++ const u8 *daddr; ++ const u8 *saddr; ++ const u8 *e_payload; ++ int buflen, payload_length; ++ unsigned int payload_offset, mtu; ++ u16 fc; ++ ++ FN_ENTER; ++ ++ /* This looks complex because it must handle possible ++ ** phy header in rxbuff */ ++ w_hdr = acx_get_wlan_hdr(adev, rxbuf); ++ payload_offset = WLAN_HDR_A3_LEN; /* it is relative to w_hdr */ ++ payload_length = RXBUF_BYTES_USED(rxbuf) /* entire rxbuff... */ ++ - ((u8*)w_hdr - (u8*)rxbuf) /* minus space before 802.11 frame */ ++ - WLAN_HDR_A3_LEN; /* minus 802.11 header */ ++ ++ /* setup some vars for convenience */ ++ fc = w_hdr->fc; ++ switch (WF_FC_FROMTODSi & fc) { ++ case 0: ++ daddr = w_hdr->a1; ++ saddr = w_hdr->a2; ++ break; ++ case WF_FC_FROMDSi: ++ daddr = w_hdr->a1; ++ saddr = w_hdr->a3; ++ break; ++ case WF_FC_TODSi: ++ daddr = w_hdr->a3; ++ saddr = w_hdr->a2; ++ break; ++ default: /* WF_FC_FROMTODSi */ ++ payload_offset += (WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN); ++ payload_length -= (WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN); ++ daddr = w_hdr->a3; ++ saddr = w_hdr->a4; ++ } ++ ++ if ((WF_FC_ISWEPi & fc) && IS_ACX100(adev)) { ++ /* chop off the IV+ICV WEP header and footer */ ++ log(L_DATA|L_DEBUG, "rx: WEP packet, " ++ "chopping off IV and ICV\n"); ++ payload_offset += WLAN_WEP_IV_LEN; ++ payload_length -= WLAN_WEP_IV_LEN + WLAN_WEP_ICV_LEN; ++ } ++ ++ if (unlikely(payload_length < 0)) { ++ printk("%s: rx frame too short, ignored\n", adev->ndev->name); ++ goto ret_null; ++ } ++ ++ e_hdr = (wlan_ethhdr_t*) ((u8*) w_hdr + payload_offset); ++ e_llc = (wlan_llc_t*) e_hdr; ++ e_snap = (wlan_snap_t*) (e_llc + 1); ++ mtu = adev->ndev->mtu; ++ e_payload = (u8*) (e_snap + 1); ++ ++ log(L_DATA, "rx: payload_offset %d, payload_length %d\n", ++ payload_offset, payload_length); ++ log(L_XFER|L_DATA, ++ "rx: frame info: llc=%02X%02X%02X " ++ "snap.oui=%02X%02X%02X snap.type=%04X\n", ++ e_llc->dsap, e_llc->ssap, e_llc->ctl, ++ e_snap->oui[0], e_snap->oui[1], e_snap->oui[2], ++ ntohs(e_snap->type)); ++ ++ /* Test for the various encodings */ ++ if ((payload_length >= sizeof(wlan_ethhdr_t)) ++ && ((e_llc->dsap != 0xaa) || (e_llc->ssap != 0xaa)) ++ && ( (mac_is_equal(daddr, e_hdr->daddr)) ++ || (mac_is_equal(saddr, e_hdr->saddr)) ++ ) ++ ) { ++ /* 802.3 Encapsulated: */ ++ /* wlan frame body contains complete eth frame (header+body) */ ++ log(L_DEBUG|L_DATA, "rx: 802.3 ENCAP len=%d\n", payload_length); ++ ++ if (unlikely(payload_length > (mtu + ETH_HLEN))) { ++ printk("%s: rx: ENCAP frame too large (%d > %d)\n", ++ adev->ndev->name, ++ payload_length, mtu + ETH_HLEN); ++ goto ret_null; ++ } ++ ++ /* allocate space and setup host buffer */ ++ buflen = payload_length; ++ /* Attempt to align IP header (14 bytes eth header + 2 = 16) */ ++ skb = dev_alloc_skb(buflen + 2); ++ if (unlikely(!skb)) ++ goto no_skb; ++ skb_reserve(skb, 2); ++ skb_put(skb, buflen); /* make room */ ++ ++ /* now copy the data from the 80211 frame */ ++ memcpy(skb->data, e_hdr, payload_length); ++ ++ } else if ( (payload_length >= sizeof(wlan_llc_t)+sizeof(wlan_snap_t)) ++ && llc_is_snap(e_llc) ) { ++ /* wlan frame body contains: AA AA 03 ... (it's a SNAP) */ ++ ++ if ( !oui_is_rfc1042(e_snap) ++ || (proto_is_stt(ieee2host16(e_snap->type)) /* && (ethconv == WLAN_ETHCONV_8021h) */)) { ++ log(L_DEBUG|L_DATA, "rx: SNAP+RFC1042 len=%d\n", payload_length); ++ /* wlan frame body contains: AA AA 03 !(00 00 00) ... -or- */ ++ /* wlan frame body contains: AA AA 03 00 00 00 0x80f3 ... */ ++ /* build eth hdr, type = len, copy AA AA 03... as eth body */ ++ /* it's a SNAP + RFC1042 frame && protocol is in STT */ ++ ++ if (unlikely(payload_length > mtu)) { ++ printk("%s: rx: SNAP frame too large (%d > %d)\n", ++ adev->ndev->name, ++ payload_length, mtu); ++ goto ret_null; ++ } ++ ++ /* allocate space and setup host buffer */ ++ buflen = payload_length + ETH_HLEN; ++ skb = dev_alloc_skb(buflen + 2); ++ if (unlikely(!skb)) ++ goto no_skb; ++ skb_reserve(skb, 2); ++ skb_put(skb, buflen); /* make room */ ++ ++ /* create 802.3 header */ ++ e_hdr = (wlan_ethhdr_t*) skb->data; ++ MAC_COPY(e_hdr->daddr, daddr); ++ MAC_COPY(e_hdr->saddr, saddr); ++ e_hdr->type = htons(payload_length); ++ ++ /* Now copy the data from the 80211 frame. ++ Make room in front for the eth header, and keep the ++ llc and snap from the 802.11 payload */ ++ memcpy(skb->data + ETH_HLEN, ++ e_llc, payload_length); ++ ++ } else { ++ /* wlan frame body contains: AA AA 03 00 00 00 [type] [tail] */ ++ /* build eth hdr, type=[type], copy [tail] as eth body */ ++ log(L_DEBUG|L_DATA, "rx: 802.1h/RFC1042 len=%d\n", ++ payload_length); ++ /* it's an 802.1h frame (an RFC1042 && protocol is not in STT) */ ++ /* build a DIXII + RFC894 */ ++ ++ payload_length -= sizeof(wlan_llc_t) + sizeof(wlan_snap_t); ++ if (unlikely(payload_length > mtu)) { ++ printk("%s: rx: DIXII frame too large (%d > %d)\n", ++ adev->ndev->name, ++ payload_length, mtu); ++ goto ret_null; ++ } ++ ++ /* allocate space and setup host buffer */ ++ buflen = payload_length + ETH_HLEN; ++ skb = dev_alloc_skb(buflen + 2); ++ if (unlikely(!skb)) ++ goto no_skb; ++ skb_reserve(skb, 2); ++ skb_put(skb, buflen); /* make room */ ++ ++ /* create 802.3 header */ ++ e_hdr = (wlan_ethhdr_t *) skb->data; ++ MAC_COPY(e_hdr->daddr, daddr); ++ MAC_COPY(e_hdr->saddr, saddr); ++ e_hdr->type = e_snap->type; ++ ++ /* Now copy the data from the 80211 frame. ++ Make room in front for the eth header, and cut off the ++ llc and snap from the 802.11 payload */ ++ memcpy(skb->data + ETH_HLEN, ++ e_payload, payload_length); ++ } ++ ++ } else { ++ log(L_DEBUG|L_DATA, "rx: NON-ENCAP len=%d\n", payload_length); ++ /* build eth hdr, type=len, copy wlan body as eth body */ ++ /* any NON-ENCAP */ ++ /* it's a generic 80211+LLC or IPX 'Raw 802.3' */ ++ /* build an 802.3 frame */ ++ ++ if (unlikely(payload_length > mtu)) { ++ printk("%s: rx: OTHER frame too large (%d > %d)\n", ++ adev->ndev->name, payload_length, mtu); ++ goto ret_null; ++ } ++ ++ /* allocate space and setup host buffer */ ++ buflen = payload_length + ETH_HLEN; ++ skb = dev_alloc_skb(buflen + 2); ++ if (unlikely(!skb)) ++ goto no_skb; ++ skb_reserve(skb, 2); ++ skb_put(skb, buflen); /* make room */ ++ ++ /* set up the 802.3 header */ ++ e_hdr = (wlan_ethhdr_t *) skb->data; ++ MAC_COPY(e_hdr->daddr, daddr); ++ MAC_COPY(e_hdr->saddr, saddr); ++ e_hdr->type = htons(payload_length); ++ ++ /* now copy the data from the 80211 frame */ ++ memcpy(skb->data + ETH_HLEN, e_llc, payload_length); ++ } ++ ++ skb->dev = adev->ndev; ++ skb->protocol = eth_type_trans(skb, adev->ndev); ++ ++#ifdef DEBUG_CONVERT ++ if (acx_debug & L_DATA) { ++ int len = RXBUF_BYTES_RCVD(adev, rxbuf); ++ printk("p802.11 frame [%d]: ", len); ++ acx_dump_bytes(w_hdr, len); ++ printk("eth frame [%d]: ", skb->len); ++ acx_dump_bytes(skb->data, skb->len); ++ } ++#endif ++ ++ FN_EXIT0; ++ return skb; ++ ++no_skb: ++ printk("%s: rx: no memory for skb (%d bytes)\n", ++ adev->ndev->name, buflen + 2); ++ret_null: ++ FN_EXIT1((int)NULL); ++ return NULL; ++} +Index: linux-2.6.22/drivers/net/wireless/acx/cs.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/cs.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,5703 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++** ++** Slave memory interface support: ++** ++** Todd Blumer - SDG Systems ++** Bill Reese - HP ++** Eric McCorkle - Shadowsun ++** ++** CF support, (c) Fabrice Crohas, Paul Sokolovsky ++*/ ++#define ACX_MEM 1 ++ ++/* ++ * non-zero makes it dump the ACX memory to the console then ++ * panic when you cat /proc/driver/acx_wlan0_diag ++ */ ++#define DUMP_MEM_DEFINED 1 ++ ++#define DUMP_MEM_DURING_DIAG 0 ++#define DUMP_IF_SLOW 0 ++ ++#define PATCH_AROUND_BAD_SPOTS 1 ++#define HX4700_FIRMWARE_CHECKSUM 0x0036862e ++#define HX4700_ALTERNATE_FIRMWARE_CHECKSUM 0x00368a75 ++ ++#include <linux/version.h> ++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) ++#include <linux/config.h> ++#endif ++ ++/* Linux 2.6.18+ uses <linux/utsrelease.h> */ ++#ifndef UTS_RELEASE ++#include <linux/utsrelease.h> ++#endif ++ ++#include <linux/compiler.h> /* required for Lx 2.6.8 ?? */ ++#include <linux/kernel.h> ++#include <linux/module.h> ++#include <linux/moduleparam.h> ++#include <linux/sched.h> ++#include <linux/types.h> ++#include <linux/skbuff.h> ++#include <linux/slab.h> ++#include <linux/if_arp.h> ++#include <linux/irq.h> ++#include <linux/rtnetlink.h> ++#include <linux/wireless.h> ++#include <net/iw_handler.h> ++#include <linux/netdevice.h> ++#include <linux/ioport.h> ++#include <linux/pci.h> ++#include <linux/platform_device.h> ++#include <linux/pm.h> ++#include <linux/vmalloc.h> ++#include <linux/delay.h> ++#include <linux/workqueue.h> ++#include <linux/inetdevice.h> ++ ++#define PCMCIA_DEBUG 1 ++ ++/* ++ All the PCMCIA modules use PCMCIA_DEBUG to control debugging. If ++ you do not define PCMCIA_DEBUG at all, all the debug code will be ++ left out. If you compile with PCMCIA_DEBUG=0, the debug code will ++ be present but disabled -- but it can then be enabled for specific ++ modules at load time with a 'pc_debug=#' option to insmod. ++ ++*/ ++#include <pcmcia/cs_types.h> ++#include <pcmcia/cs.h> ++#include <pcmcia/cistpl.h> ++#include <pcmcia/cisreg.h> ++#include <pcmcia/ds.h> ++#include "acx.h" ++#include "acx_hw.h" ++ ++#ifdef PCMCIA_DEBUG ++static int pc_debug = PCMCIA_DEBUG; ++module_param(pc_debug, int, 0); ++static char *version = "$Revision: 1.10 $"; ++#define DEBUG(n, args...) if (pc_debug>(n)) printk(KERN_DEBUG args); ++#else ++#define DEBUG(n, args...) ++#endif ++ ++ ++static win_req_t memwin; ++ ++typedef struct local_info_t { ++ dev_node_t node; ++ struct net_device *ndev; ++} local_info_t; ++ ++static struct net_device *resume_ndev; ++ ++ ++/*********************************************************************** ++*/ ++ ++#define CARD_EEPROM_ID_SIZE 6 ++ ++#include <asm/io.h> ++ ++#define REG_ACX_VENDOR_ID 0x900 ++/* ++ * This is the vendor id on the HX4700, anyway ++ */ ++#define ACX_VENDOR_ID 0x8400104c ++ ++typedef enum { ++ ACX_SOFT_RESET = 0, ++ ++ ACX_SLV_REG_ADDR, ++ ACX_SLV_REG_DATA, ++ ACX_SLV_REG_ADATA, ++ ++ ACX_SLV_MEM_CP, ++ ACX_SLV_MEM_ADDR, ++ ACX_SLV_MEM_DATA, ++ ACX_SLV_MEM_CTL, ++} acxreg_t; ++ ++/*********************************************************************** ++*/ ++static void acxmem_i_tx_timeout(struct net_device *ndev); ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19) ++static irqreturn_t acxmem_i_interrupt(int irq, void *dev_id); ++#else ++static irqreturn_t acxmem_i_interrupt(int irq, void *dev_id, struct pt_regs *regs); ++#endif ++static void acxmem_i_set_multicast_list(struct net_device *ndev); ++ ++static int acxmem_e_open(struct net_device *ndev); ++static int acxmem_e_close(struct net_device *ndev); ++static void acxmem_s_up(struct net_device *ndev); ++static void acxmem_s_down(struct net_device *ndev); ++ ++static void dump_acxmem (acx_device_t *adev, u32 start, int length); ++static int acxmem_complete_hw_reset (acx_device_t *adev); ++static void acxmem_s_delete_dma_regions(acx_device_t *adev); ++ ++static int ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11) ++acxmem_e_suspend( struct net_device *ndev, pm_message_t state); ++#else ++acxmem_e_suspend( struct net_device *ndev, u32 state); ++#endif ++static void ++fw_resumer(struct work_struct *notused); ++//fw_resumer( void *data ); ++ ++static int acx_netdev_event(struct notifier_block *this, unsigned long event, void *ptr) ++{ ++ struct net_device *ndev = ptr; ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ /* ++ * Upper level ioctl() handlers send a NETDEV_CHANGEADDR if the MAC address changes. ++ */ ++ ++ if (NETDEV_CHANGEADDR == event) { ++ /* ++ * the upper layers put the new MAC address in ndev->dev_addr; we just copy ++ * it over and update the ACX with it. ++ */ ++ MAC_COPY(adev->dev_addr, adev->ndev->dev_addr); ++ adev->set_mask |= GETSET_STATION_ID; ++ acx_s_update_card_settings (adev); ++ } ++ ++ return 0; ++} ++ ++static struct notifier_block acx_netdev_notifier = { ++ .notifier_call = acx_netdev_event, ++}; ++ ++/*********************************************************************** ++** Register access ++*/ ++ ++/* Pick one */ ++/* #define INLINE_IO static */ ++#define INLINE_IO static inline ++ ++INLINE_IO u32 ++read_id_register (acx_device_t *adev) ++{ ++ writel (0x24, &adev->iobase[ACX_SLV_REG_ADDR]); ++ return readl (&adev->iobase[ACX_SLV_REG_DATA]); ++} ++ ++INLINE_IO u32 ++read_reg32(acx_device_t *adev, unsigned int offset) ++{ ++ u32 val; ++ u32 addr; ++ ++ if (offset > IO_ACX_ECPU_CTRL) ++ addr = offset; ++ else ++ addr = adev->io[offset]; ++ ++ if (addr < 0x20) { ++ return readl(((u8*)adev->iobase) + addr); ++ } ++ ++ writel( addr, &adev->iobase[ACX_SLV_REG_ADDR] ); ++ val = readl( &adev->iobase[ACX_SLV_REG_DATA] ); ++ ++ return val; ++} ++ ++INLINE_IO u16 ++read_reg16(acx_device_t *adev, unsigned int offset) ++{ ++ u16 lo; ++ u32 addr; ++ ++ if (offset > IO_ACX_ECPU_CTRL) ++ addr = offset; ++ else ++ addr = adev->io[offset]; ++ ++ if (addr < 0x20) { ++ return readw(((u8 *) adev->iobase) + addr); ++ } ++ ++ writel( addr, &adev->iobase[ACX_SLV_REG_ADDR] ); ++ lo = readw( (u16 *)&adev->iobase[ACX_SLV_REG_DATA] ); ++ ++ return lo; ++} ++ ++INLINE_IO u8 ++read_reg8(acx_device_t *adev, unsigned int offset) ++{ ++ u8 lo; ++ u32 addr; ++ ++ if (offset > IO_ACX_ECPU_CTRL) ++ addr = offset; ++ else ++ addr = adev->io[offset]; ++ ++ if (addr < 0x20) ++ return readb(((u8 *)adev->iobase) + addr); ++ ++ writel( addr, &adev->iobase[ACX_SLV_REG_ADDR] ); ++ lo = readw( (u8 *)&adev->iobase[ACX_SLV_REG_DATA] ); ++ ++ return (u8)lo; ++} ++ ++INLINE_IO void ++write_reg32(acx_device_t *adev, unsigned int offset, u32 val) ++{ ++ u32 addr; ++ ++ if (offset > IO_ACX_ECPU_CTRL) ++ addr = offset; ++ else ++ addr = adev->io[offset]; ++ ++ if (addr < 0x20) { ++ writel(val, ((u8*)adev->iobase) + addr); ++ return; ++ } ++ ++ writel( addr, &adev->iobase[ACX_SLV_REG_ADDR] ); ++ writel( val, &adev->iobase[ACX_SLV_REG_DATA] ); ++} ++ ++INLINE_IO void ++write_reg16(acx_device_t *adev, unsigned int offset, u16 val) ++{ ++ u32 addr; ++ ++ if (offset > IO_ACX_ECPU_CTRL) ++ addr = offset; ++ else ++ addr = adev->io[offset]; ++ ++ if (addr < 0x20) { ++ writew(val, ((u8 *)adev->iobase) + addr); ++ return; ++ } ++ writel( addr, &adev->iobase[ACX_SLV_REG_ADDR] ); ++ writew( val, (u16 *) &adev->iobase[ACX_SLV_REG_DATA] ); ++} ++ ++INLINE_IO void ++write_reg8(acx_device_t *adev, unsigned int offset, u8 val) ++{ ++ u32 addr; ++ ++ if (offset > IO_ACX_ECPU_CTRL) ++ addr = offset; ++ else ++ addr = adev->io[offset]; ++ ++ if (addr < 0x20) { ++ writeb(val, ((u8 *) adev->iobase) + addr); ++ return; ++ } ++ writel( addr, &adev->iobase[ACX_SLV_REG_ADDR] ); ++ writeb( val, (u8 *)&adev->iobase[ACX_SLV_REG_DATA] ); ++} ++ ++/* Handle PCI posting properly: ++ * Make sure that writes reach the adapter in case they require to be executed ++ * *before* the next write, by reading a random (and safely accessible) register. ++ * This call has to be made if there is no read following (which would flush the data ++ * to the adapter), yet the written data has to reach the adapter immediately. */ ++INLINE_IO void ++write_flush(acx_device_t *adev) ++{ ++ /* readb(adev->iobase + adev->io[IO_ACX_INFO_MAILBOX_OFFS]); */ ++ /* faster version (accesses the first register, IO_ACX_SOFT_RESET, ++ * which should also be safe): */ ++ (void) readl(adev->iobase); ++} ++ ++INLINE_IO void ++set_regbits (acx_device_t *adev, unsigned int offset, u32 bits) { ++ u32 tmp; ++ ++ tmp = read_reg32 (adev, offset); ++ tmp = tmp | bits; ++ write_reg32 (adev, offset, tmp); ++ write_flush (adev); ++} ++ ++INLINE_IO void ++clear_regbits (acx_device_t *adev, unsigned int offset, u32 bits) { ++ u32 tmp; ++ ++ tmp = read_reg32 (adev, offset); ++ tmp = tmp & ~bits; ++ write_reg32 (adev, offset, tmp); ++ write_flush (adev); ++} ++ ++/* ++ * Copy from PXA memory to the ACX memory. This assumes both the PXA and ACX ++ * addresses are 32 bit aligned. Count is in bytes. ++ */ ++INLINE_IO void ++write_slavemem32 (acx_device_t *adev, u32 slave_address, u32 val) ++{ ++ write_reg32 (adev, IO_ACX_SLV_MEM_CTL, 0x0); ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, slave_address); ++ udelay (10); ++ write_reg32 (adev, IO_ACX_SLV_MEM_DATA, val); ++} ++ ++INLINE_IO u32 ++read_slavemem32 (acx_device_t *adev, u32 slave_address) ++{ ++ u32 val; ++ ++ write_reg32 (adev, IO_ACX_SLV_MEM_CTL, 0x0); ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, slave_address); ++ udelay (10); ++ val = read_reg32 (adev, IO_ACX_SLV_MEM_DATA); ++ ++ return val; ++} ++ ++INLINE_IO void ++write_slavemem8 (acx_device_t *adev, u32 slave_address, u8 val) ++{ ++ u32 data; ++ u32 base; ++ int offset; ++ ++ /* ++ * Get the word containing the target address and the byte offset in that word. ++ */ ++ base = slave_address & ~3; ++ offset = (slave_address & 3) * 8; ++ ++ data = read_slavemem32 (adev, base); ++ data &= ~(0xff << offset); ++ data |= val << offset; ++ write_slavemem32 (adev, base, data); ++} ++ ++INLINE_IO u8 ++read_slavemem8 (acx_device_t *adev, u32 slave_address) ++{ ++ u8 val; ++ u32 base; ++ u32 data; ++ int offset; ++ ++ base = slave_address & ~3; ++ offset = (slave_address & 3) * 8; ++ ++ data = read_slavemem32 (adev, base); ++ ++ val = (data >> offset) & 0xff; ++ ++ return val; ++} ++ ++/* ++ * doesn't split across word boundaries ++ */ ++INLINE_IO void ++write_slavemem16 (acx_device_t *adev, u32 slave_address, u16 val) ++{ ++ u32 data; ++ u32 base; ++ int offset; ++ ++ /* ++ * Get the word containing the target address and the byte offset in that word. ++ */ ++ base = slave_address & ~3; ++ offset = (slave_address & 3) * 8; ++ ++ data = read_slavemem32 (adev, base); ++ data &= ~(0xffff << offset); ++ data |= val << offset; ++ write_slavemem32 (adev, base, data); ++} ++ ++/* ++ * doesn't split across word boundaries ++ */ ++INLINE_IO u16 ++read_slavemem16 (acx_device_t *adev, u32 slave_address) ++{ ++ u16 val; ++ u32 base; ++ u32 data; ++ int offset; ++ ++ base = slave_address & ~3; ++ offset = (slave_address & 3) * 8; ++ ++ data = read_slavemem32 (adev, base); ++ ++ val = (data >> offset) & 0xffff; ++ ++ return val; ++} ++ ++/* ++ * Copy from slave memory ++ * ++ * TODO - rewrite using address autoincrement, handle partial words ++ */ ++void ++copy_from_slavemem (acx_device_t *adev, u8 *destination, u32 source, int count) { ++ u32 tmp = 0; ++ u8 *ptmp = (u8 *) &tmp; ++ ++ /* ++ * Right now I'm making the assumption that the destination is aligned, but ++ * I'd better check. ++ */ ++ if ((u32) destination & 3) { ++ printk ("acx copy_from_slavemem: warning! destination not word-aligned!\n"); ++ } ++ ++ while (count >= 4) { ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, source); ++ udelay (10); ++ *((u32 *) destination) = read_reg32 (adev, IO_ACX_SLV_MEM_DATA); ++ count -= 4; ++ source += 4; ++ destination += 4; ++ } ++ ++ /* ++ * If the word reads above didn't satisfy the count, read one more word ++ * and transfer a byte at a time until the request is satisfied. ++ */ ++ if (count) { ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, source); ++ udelay (10); ++ tmp = read_reg32 (adev, IO_ACX_SLV_MEM_DATA); ++ while (count--) { ++ *destination++ = *ptmp++; ++ } ++ } ++} ++ ++/* ++ * Copy to slave memory ++ * ++ * TODO - rewrite using autoincrement, handle partial words ++ */ ++void ++copy_to_slavemem (acx_device_t *adev, u32 destination, u8 *source, int count) ++{ ++ u32 tmp = 0; ++ u8* ptmp = (u8 *) &tmp; ++ static u8 src[512]; /* make static to avoid huge stack objects */ ++ ++ /* ++ * For now, make sure the source is word-aligned by copying it to a word-aligned ++ * buffer. Someday rewrite to avoid the extra copy. ++ */ ++ if (count > sizeof (src)) { ++ printk ("acx copy_to_slavemem: Warning! buffer overflow!\n"); ++ count = sizeof (src); ++ } ++ memcpy (src, source, count); ++ source = src; ++ ++ while (count >= 4) { ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, destination); ++ udelay (10); ++ write_reg32 (adev, IO_ACX_SLV_MEM_DATA, *((u32 *) source)); ++ count -= 4; ++ source += 4; ++ destination += 4; ++ } ++ ++ /* ++ * If there are leftovers read the next word from the acx and merge in ++ * what they want to write. ++ */ ++ if (count) { ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, destination); ++ udelay (10); ++ tmp = read_reg32 (adev, IO_ACX_SLV_MEM_DATA); ++ while (count--) { ++ *ptmp++ = *source++; ++ } ++ /* ++ * reset address in case we're currently in auto-increment mode ++ */ ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, destination); ++ udelay (10); ++ write_reg32 (adev, IO_ACX_SLV_MEM_DATA, tmp); ++ udelay (10); ++ } ++ ++} ++ ++/* ++ * Block copy to slave buffers using memory block chain mode. Copies to the ACX ++ * transmit buffer structure with minimal intervention on our part. ++ * Interrupts should be disabled when calling this. ++ */ ++void ++chaincopy_to_slavemem (acx_device_t *adev, u32 destination, u8 *source, int count) ++{ ++ u32 val; ++ u32 *data = (u32 *) source; ++ static u8 aligned_source[WLAN_A4FR_MAXLEN_WEP_FCS]; ++ ++ /* ++ * Warn if the pointers don't look right. Destination must fit in [23:5] with ++ * zero elsewhere and source should be 32 bit aligned. ++ * This should never happen since we're in control of both, but I want to know about ++ * it if it does. ++ */ ++ if ((destination & 0x00ffffe0) != destination) { ++ printk ("acx chaincopy: destination block 0x%04x not aligned!\n", destination); ++ } ++ if (count > sizeof aligned_source) { ++ printk( KERN_ERR "chaincopy_to_slavemem overflow!\n" ); ++ count = sizeof aligned_source; ++ } ++ if ((u32) source & 3) { ++ memcpy (aligned_source, source, count); ++ data = (u32 *) aligned_source; ++ } ++ ++ /* ++ * SLV_MEM_CTL[17:16] = memory block chain mode with auto-increment ++ * SLV_MEM_CTL[5:2] = offset to data portion = 1 word ++ */ ++ val = 2 << 16 | 1 << 2; ++ writel (val, &adev->iobase[ACX_SLV_MEM_CTL]); ++ ++ /* ++ * SLV_MEM_CP[23:5] = start of 1st block ++ * SLV_MEM_CP[3:2] = offset to memblkptr = 0 ++ */ ++ val = destination & 0x00ffffe0; ++ writel (val, &adev->iobase[ACX_SLV_MEM_CP]); ++ ++ /* ++ * SLV_MEM_ADDR[23:2] = SLV_MEM_CTL[5:2] + SLV_MEM_CP[23:5] ++ */ ++ val = (destination & 0x00ffffe0) + (1<<2); ++ writel (val, &adev->iobase[ACX_SLV_MEM_ADDR]); ++ ++ /* ++ * Write the data to the slave data register, rounding up to the end ++ * of the word containing the last byte (hence the > 0) ++ */ ++ while (count > 0) { ++ writel (*data++, &adev->iobase[ACX_SLV_MEM_DATA]); ++ count -= 4; ++ } ++} ++ ++ ++/* ++ * Block copy from slave buffers using memory block chain mode. Copies from the ACX ++ * receive buffer structures with minimal intervention on our part. ++ * Interrupts should be disabled when calling this. ++ */ ++void ++chaincopy_from_slavemem (acx_device_t *adev, u8 *destination, u32 source, int count) ++{ ++ u32 val; ++ u32 *data = (u32 *) destination; ++ static u8 aligned_destination[WLAN_A4FR_MAXLEN_WEP_FCS]; ++ int saved_count = count; ++ ++ /* ++ * Warn if the pointers don't look right. Destination must fit in [23:5] with ++ * zero elsewhere and source should be 32 bit aligned. ++ * Turns out the network stack sends unaligned things, so fix them before ++ * copying to the ACX. ++ */ ++ if ((source & 0x00ffffe0) != source) { ++ printk ("acx chaincopy: source block 0x%04x not aligned!\n", source); ++ dump_acxmem (adev, 0, 0x10000); ++ } ++ if ((u32) destination & 3) { ++ //printk ("acx chaincopy: data destination not word aligned!\n"); ++ data = (u32 *) aligned_destination; ++ if (count > sizeof aligned_destination) { ++ printk( KERN_ERR "chaincopy_from_slavemem overflow!\n" ); ++ count = sizeof aligned_destination; ++ } ++ } ++ ++ /* ++ * SLV_MEM_CTL[17:16] = memory block chain mode with auto-increment ++ * SLV_MEM_CTL[5:2] = offset to data portion = 1 word ++ */ ++ val = (2 << 16) | (1 << 2); ++ writel (val, &adev->iobase[ACX_SLV_MEM_CTL]); ++ ++ /* ++ * SLV_MEM_CP[23:5] = start of 1st block ++ * SLV_MEM_CP[3:2] = offset to memblkptr = 0 ++ */ ++ val = source & 0x00ffffe0; ++ writel (val, &adev->iobase[ACX_SLV_MEM_CP]); ++ ++ /* ++ * SLV_MEM_ADDR[23:2] = SLV_MEM_CTL[5:2] + SLV_MEM_CP[23:5] ++ */ ++ val = (source & 0x00ffffe0) + (1<<2); ++ writel (val, &adev->iobase[ACX_SLV_MEM_ADDR]); ++ ++ /* ++ * Read the data from the slave data register, rounding up to the end ++ * of the word containing the last byte (hence the > 0) ++ */ ++ while (count > 0) { ++ *data++ = readl (&adev->iobase[ACX_SLV_MEM_DATA]); ++ count -= 4; ++ } ++ ++ /* ++ * If the destination wasn't aligned, we would have saved it in ++ * the aligned buffer, so copy it where it should go. ++ */ ++ if ((u32) destination & 3) { ++ memcpy (destination, aligned_destination, saved_count); ++ } ++} ++ ++char ++printable (char c) ++{ ++ return ((c >= 20) && (c < 127)) ? c : '.'; ++} ++ ++#if DUMP_MEM_DEFINED > 0 ++static void ++dump_acxmem (acx_device_t *adev, u32 start, int length) ++{ ++ int i; ++ u8 buf[16]; ++ ++ while (length > 0) { ++ printk ("%04x ", start); ++ copy_from_slavemem (adev, buf, start, 16); ++ for (i = 0; (i < 16) && (i < length); i++) { ++ printk ("%02x ", buf[i]); ++ } ++ for (i = 0; (i < 16) && (i < length); i++) { ++ printk ("%c", printable (buf[i])); ++ } ++ printk ("\n"); ++ start += 16; ++ length -= 16; ++ } ++} ++#endif ++ ++static void ++enable_acx_irq(acx_device_t *adev); ++static void ++disable_acx_irq(acx_device_t *adev); ++ ++/* ++ * Return an acx pointer to the next transmit data block. ++ */ ++u32 ++allocate_acx_txbuf_space (acx_device_t *adev, int count) { ++ u32 block, next, last_block; ++ int blocks_needed; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&adev->txbuf_lock, flags); ++ /* ++ * Take 4 off the memory block size to account for the reserved word at the start of ++ * the block. ++ */ ++ blocks_needed = count / (adev->memblocksize - 4); ++ if (count % (adev->memblocksize - 4)) ++ blocks_needed++; ++ ++ if (blocks_needed <= adev->acx_txbuf_blocks_free) { ++ /* ++ * Take blocks at the head of the free list. ++ */ ++ last_block = block = adev->acx_txbuf_free; ++ ++ /* ++ * Follow block pointers through the requested number of blocks both to ++ * find the new head of the free list and to set the flags for the blocks ++ * appropriately. ++ */ ++ while (blocks_needed--) { ++ /* ++ * Keep track of the last block of the allocation ++ */ ++ last_block = adev->acx_txbuf_free; ++ ++ /* ++ * Make sure the end control flag is not set. ++ */ ++ next = read_slavemem32 (adev, adev->acx_txbuf_free) & 0x7ffff; ++ write_slavemem32 (adev, adev->acx_txbuf_free, next); ++ ++ /* ++ * Update the new head of the free list ++ */ ++ adev->acx_txbuf_free = next << 5; ++ adev->acx_txbuf_blocks_free--; ++ ++ } ++ ++ /* ++ * Flag the last block both by clearing out the next pointer ++ * and marking the control field. ++ */ ++ write_slavemem32 (adev, last_block, 0x02000000); ++ ++ /* ++ * If we're out of buffers make sure the free list pointer is NULL ++ */ ++ if (!adev->acx_txbuf_blocks_free) { ++ adev->acx_txbuf_free = 0; ++ } ++ } ++ else { ++ block = 0; ++ } ++ spin_unlock_irqrestore (&adev->txbuf_lock, flags); ++ return block; ++} ++ ++/* ++ * Return buffer space back to the pool by following the next pointers until we find ++ * the block marked as the end. Point the last block to the head of the free list, ++ * then update the head of the free list to point to the newly freed memory. ++ * This routine gets called in interrupt context, so it shouldn't block to protect ++ * the integrity of the linked list. The ISR already holds the lock. ++ */ ++void ++reclaim_acx_txbuf_space (acx_device_t *adev, u32 blockptr) { ++ u32 cur, last, next; ++ unsigned long flags; ++ ++ spin_lock_irqsave (&adev->txbuf_lock, flags); ++ if ((blockptr >= adev->acx_txbuf_start) && ++ (blockptr <= adev->acx_txbuf_start + ++ (adev->acx_txbuf_numblocks - 1) * adev->memblocksize)) { ++ cur = blockptr; ++ do { ++ last = cur; ++ next = read_slavemem32 (adev, cur); ++ ++ /* ++ * Advance to the next block in this allocation ++ */ ++ cur = (next & 0x7ffff) << 5; ++ ++ /* ++ * This block now counts as free. ++ */ ++ adev->acx_txbuf_blocks_free++; ++ } while (!(next & 0x02000000)); ++ ++ /* ++ * last now points to the last block of that allocation. Update the pointer ++ * in that block to point to the free list and reset the free list to the ++ * first block of the free call. If there were no free blocks, make sure ++ * the new end of the list marks itself as truly the end. ++ */ ++ if (adev->acx_txbuf_free) { ++ write_slavemem32 (adev, last, adev->acx_txbuf_free >> 5); ++ } ++ else { ++ write_slavemem32 (adev, last, 0x02000000); ++ } ++ adev->acx_txbuf_free = blockptr; ++ } ++ spin_unlock_irqrestore(&adev->txbuf_lock, flags); ++} ++ ++/* ++ * Initialize the pieces managing the transmit buffer pool on the ACX. The transmit ++ * buffer is a circular queue with one 32 bit word reserved at the beginning of each ++ * block. The upper 13 bits are a control field, of which only 0x02000000 has any ++ * meaning. The lower 19 bits are the address of the next block divided by 32. ++ */ ++void ++init_acx_txbuf (acx_device_t *adev) { ++ ++ /* ++ * acx100_s_init_memory_pools set up txbuf_start and txbuf_numblocks for us. ++ * All we need to do is reset the rest of the bookeeping. ++ */ ++ ++ adev->acx_txbuf_free = adev->acx_txbuf_start; ++ adev->acx_txbuf_blocks_free = adev->acx_txbuf_numblocks; ++ ++ /* ++ * Initialization leaves the last transmit pool block without a pointer back to ++ * the head of the list, but marked as the end of the list. That's how we want ++ * to see it, too, so leave it alone. This is only ever called after a firmware ++ * reset, so the ACX memory is in the state we want. ++ */ ++ ++} ++ ++INLINE_IO int ++adev_present(acx_device_t *adev) ++{ ++ /* fast version (accesses the first register, IO_ACX_SOFT_RESET, ++ * which should be safe): */ ++ return readl(adev->iobase) != 0xffffffff; ++} ++ ++/*********************************************************************** ++*/ ++static inline txdesc_t* ++get_txdesc(acx_device_t *adev, int index) ++{ ++ return (txdesc_t*) (((u8*)adev->txdesc_start) + index * adev->txdesc_size); ++} ++ ++static inline txdesc_t* ++advance_txdesc(acx_device_t *adev, txdesc_t* txdesc, int inc) ++{ ++ return (txdesc_t*) (((u8*)txdesc) + inc * adev->txdesc_size); ++} ++ ++static txhostdesc_t* ++get_txhostdesc(acx_device_t *adev, txdesc_t* txdesc) ++{ ++ int index = (u8*)txdesc - (u8*)adev->txdesc_start; ++ if (unlikely(ACX_DEBUG && (index % adev->txdesc_size))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return NULL; ++ } ++ index /= adev->txdesc_size; ++ if (unlikely(ACX_DEBUG && (index >= TX_CNT))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return NULL; ++ } ++ return &adev->txhostdesc_start[index*2]; ++} ++ ++static inline client_t* ++get_txc(acx_device_t *adev, txdesc_t* txdesc) ++{ ++ int index = (u8*)txdesc - (u8*)adev->txdesc_start; ++ if (unlikely(ACX_DEBUG && (index % adev->txdesc_size))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return NULL; ++ } ++ index /= adev->txdesc_size; ++ if (unlikely(ACX_DEBUG && (index >= TX_CNT))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return NULL; ++ } ++ return adev->txc[index]; ++} ++ ++static inline u16 ++get_txr(acx_device_t *adev, txdesc_t* txdesc) ++{ ++ int index = (u8*)txdesc - (u8*)adev->txdesc_start; ++ index /= adev->txdesc_size; ++ return adev->txr[index]; ++} ++ ++static inline void ++put_txcr(acx_device_t *adev, txdesc_t* txdesc, client_t* c, u16 r111) ++{ ++ int index = (u8*)txdesc - (u8*)adev->txdesc_start; ++ if (unlikely(ACX_DEBUG && (index % adev->txdesc_size))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return; ++ } ++ index /= adev->txdesc_size; ++ if (unlikely(ACX_DEBUG && (index >= TX_CNT))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return; ++ } ++ adev->txc[index] = c; ++ adev->txr[index] = r111; ++} ++ ++ ++/*********************************************************************** ++** EEPROM and PHY read/write helpers ++*/ ++/*********************************************************************** ++** acxmem_read_eeprom_byte ++** ++** Function called to read an octet in the EEPROM. ++** ++** This function is used by acxmem_e_probe to check if the ++** connected card is a legal one or not. ++** ++** Arguments: ++** adev ptr to acx_device structure ++** addr address to read in the EEPROM ++** charbuf ptr to a char. This is where the read octet ++** will be stored ++*/ ++int ++acxmem_read_eeprom_byte(acx_device_t *adev, u32 addr, u8 *charbuf) ++{ ++ int result; ++ int count; ++ ++ write_reg32(adev, IO_ACX_EEPROM_CFG, 0); ++ write_reg32(adev, IO_ACX_EEPROM_ADDR, addr); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_EEPROM_CTL, 2); ++ ++ count = 0xffff; ++ while (read_reg16(adev, IO_ACX_EEPROM_CTL)) { ++ /* scheduling away instead of CPU burning loop ++ * doesn't seem to work here at all: ++ * awful delay, sometimes also failure. ++ * Doesn't matter anyway (only small delay). */ ++ if (unlikely(!--count)) { ++ printk("%s: timeout waiting for EEPROM read\n", ++ adev->ndev->name); ++ result = NOT_OK; ++ goto fail; ++ } ++ cpu_relax(); ++ } ++ ++ *charbuf = read_reg8(adev, IO_ACX_EEPROM_DATA); ++ log(L_DEBUG, "EEPROM at 0x%04X = 0x%02X\n", addr, *charbuf); ++ result = OK; ++ ++fail: ++ return result; ++} ++ ++ ++/*********************************************************************** ++** We don't lock hw accesses here since we never r/w eeprom in IRQ ++** Note: this function sleeps only because of GFP_KERNEL alloc ++*/ ++#ifdef UNUSED ++int ++acxmem_s_write_eeprom(acx_device_t *adev, u32 addr, u32 len, const u8 *charbuf) ++{ ++ u8 *data_verify = NULL; ++ unsigned long flags; ++ int count, i; ++ int result = NOT_OK; ++ u16 gpio_orig; ++ ++ printk("acx: WARNING! I would write to EEPROM now. " ++ "Since I really DON'T want to unless you know " ++ "what you're doing (THIS CODE WILL PROBABLY " ++ "NOT WORK YET!), I will abort that now. And " ++ "definitely make sure to make a " ++ "/proc/driver/acx_wlan0_eeprom backup copy first!!! " ++ "(the EEPROM content includes the PCI config header!! " ++ "If you kill important stuff, then you WILL " ++ "get in trouble and people DID get in trouble already)\n"); ++ return OK; ++ ++ FN_ENTER; ++ ++ data_verify = kmalloc(len, GFP_KERNEL); ++ if (!data_verify) { ++ goto end; ++ } ++ ++ /* first we need to enable the OE (EEPROM Output Enable) GPIO line ++ * to be able to write to the EEPROM. ++ * NOTE: an EEPROM writing success has been reported, ++ * but you probably have to modify GPIO_OUT, too, ++ * and you probably need to activate a different GPIO ++ * line instead! */ ++ gpio_orig = read_reg16(adev, IO_ACX_GPIO_OE); ++ write_reg16(adev, IO_ACX_GPIO_OE, gpio_orig & ~1); ++ write_flush(adev); ++ ++ /* ok, now start writing the data out */ ++ for (i = 0; i < len; i++) { ++ write_reg32(adev, IO_ACX_EEPROM_CFG, 0); ++ write_reg32(adev, IO_ACX_EEPROM_ADDR, addr + i); ++ write_reg32(adev, IO_ACX_EEPROM_DATA, *(charbuf + i)); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_EEPROM_CTL, 1); ++ ++ count = 0xffff; ++ while (read_reg16(adev, IO_ACX_EEPROM_CTL)) { ++ if (unlikely(!--count)) { ++ printk("WARNING, DANGER!!! " ++ "Timeout waiting for EEPROM write\n"); ++ goto end; ++ } ++ cpu_relax(); ++ } ++ } ++ ++ /* disable EEPROM writing */ ++ write_reg16(adev, IO_ACX_GPIO_OE, gpio_orig); ++ write_flush(adev); ++ ++ /* now start a verification run */ ++ for (i = 0; i < len; i++) { ++ write_reg32(adev, IO_ACX_EEPROM_CFG, 0); ++ write_reg32(adev, IO_ACX_EEPROM_ADDR, addr + i); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_EEPROM_CTL, 2); ++ ++ count = 0xffff; ++ while (read_reg16(adev, IO_ACX_EEPROM_CTL)) { ++ if (unlikely(!--count)) { ++ printk("timeout waiting for EEPROM read\n"); ++ goto end; ++ } ++ cpu_relax(); ++ } ++ ++ data_verify[i] = read_reg16(adev, IO_ACX_EEPROM_DATA); ++ } ++ ++ if (0 == memcmp(charbuf, data_verify, len)) ++ result = OK; /* read data matches, success */ ++ ++end: ++ kfree(data_verify); ++ FN_EXIT1(result); ++ return result; ++} ++#endif /* UNUSED */ ++ ++ ++/*********************************************************************** ++** acxmem_s_read_phy_reg ++** ++** Messing with rx/tx disabling and enabling here ++** (write_reg32(adev, IO_ACX_ENABLE, 0b000000xx)) kills traffic ++*/ ++int ++acxmem_s_read_phy_reg(acx_device_t *adev, u32 reg, u8 *charbuf) ++{ ++ int result = NOT_OK; ++ int count; ++ ++ FN_ENTER; ++ ++ write_reg32(adev, IO_ACX_PHY_ADDR, reg); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_PHY_CTL, 2); ++ ++ count = 0xffff; ++ while (read_reg32(adev, IO_ACX_PHY_CTL)) { ++ /* scheduling away instead of CPU burning loop ++ * doesn't seem to work here at all: ++ * awful delay, sometimes also failure. ++ * Doesn't matter anyway (only small delay). */ ++ if (unlikely(!--count)) { ++ printk("%s: timeout waiting for phy read\n", ++ adev->ndev->name); ++ *charbuf = 0; ++ goto fail; ++ } ++ cpu_relax(); ++ } ++ ++ log(L_DEBUG, "count was %u\n", count); ++ *charbuf = read_reg8(adev, IO_ACX_PHY_DATA); ++ ++ log(L_DEBUG, "radio PHY at 0x%04X = 0x%02X\n", *charbuf, reg); ++ result = OK; ++ goto fail; /* silence compiler warning */ ++fail: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acxmem_s_write_phy_reg(acx_device_t *adev, u32 reg, u8 value) ++{ ++ int count; ++ FN_ENTER; ++ ++ /* mprusko said that 32bit accesses result in distorted sensitivity ++ * on his card. Unconfirmed, looks like it's not true (most likely since we ++ * now properly flush writes). */ ++ write_reg32(adev, IO_ACX_PHY_DATA, value); ++ write_reg32(adev, IO_ACX_PHY_ADDR, reg); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_PHY_CTL, 1); ++ write_flush(adev); ++ ++ count = 0xffff; ++ while (read_reg32(adev, IO_ACX_PHY_CTL)) { ++ /* scheduling away instead of CPU burning loop ++ * doesn't seem to work here at all: ++ * awful delay, sometimes also failure. ++ * Doesn't matter anyway (only small delay). */ ++ if (unlikely(!--count)) { ++ printk("%s: timeout waiting for phy read\n", ++ adev->ndev->name); ++ goto fail; ++ } ++ cpu_relax(); ++ } ++ ++ log(L_DEBUG, "radio PHY write 0x%02X at 0x%04X\n", value, reg); ++ fail: ++ FN_EXIT1(OK); ++ return OK; ++} ++ ++ ++#define NO_AUTO_INCREMENT 1 ++ ++/*********************************************************************** ++** acxmem_s_write_fw ++** ++** Write the firmware image into the card. ++** ++** Arguments: ++** adev wlan device structure ++** fw_image firmware image. ++** ++** Returns: ++** 1 firmware image corrupted ++** 0 success ++*/ ++static int ++acxmem_s_write_fw(acx_device_t *adev, const firmware_image_t *fw_image, u32 offset) ++{ ++ int len, size, checkMismatch = -1; ++ u32 sum, v32, tmp, id; ++ /* we skip the first four bytes which contain the control sum */ ++ const u8 *p = (u8*)fw_image + 4; ++ ++ /* start the image checksum by adding the image size value */ ++ sum = p[0]+p[1]+p[2]+p[3]; ++ p += 4; ++ ++#ifdef NOPE ++#if NO_AUTO_INCREMENT ++ write_reg32(adev, IO_ACX_SLV_MEM_CTL, 0); /* use basic mode */ ++#else ++ write_reg32(adev, IO_ACX_SLV_MEM_CTL, 1); /* use autoincrement mode */ ++ write_reg32(adev, IO_ACX_SLV_MEM_ADDR, offset); /* configure start address */ ++ write_flush(adev); ++#endif ++#endif ++ len = 0; ++ size = le32_to_cpu(fw_image->size) & (~3); ++ ++ while (likely(len < size)) { ++ v32 = be32_to_cpu(*(u32*)p); ++ sum += p[0]+p[1]+p[2]+p[3]; ++ p += 4; ++ len += 4; ++ ++#ifdef NOPE ++#if NO_AUTO_INCREMENT ++ write_reg32(adev, IO_ACX_SLV_MEM_ADDR, offset + len - 4); ++ write_flush(adev); ++#endif ++ write_reg32(adev, IO_ACX_SLV_MEM_DATA, v32); ++ write_flush(adev); ++#endif ++ write_slavemem32 (adev, offset + len - 4, v32); ++ ++ id = read_id_register (adev); ++ ++ /* ++ * check the data written ++ */ ++ tmp = read_slavemem32 (adev, offset + len - 4); ++ if (checkMismatch && (tmp != v32)) { ++ printk ("first data mismatch at 0x%08x good 0x%08x bad 0x%08x id 0x%08x\n", ++ offset + len - 4, v32, tmp, id); ++ checkMismatch = 0; ++ } ++ } ++ log(L_DEBUG, "firmware written, size:%d sum1:%x sum2:%x\n", ++ size, sum, le32_to_cpu(fw_image->chksum)); ++ ++ /* compare our checksum with the stored image checksum */ ++ return (sum != le32_to_cpu(fw_image->chksum)); ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_validate_fw ++** ++** Compare the firmware image given with ++** the firmware image written into the card. ++** ++** Arguments: ++** adev wlan device structure ++** fw_image firmware image. ++** ++** Returns: ++** NOT_OK firmware image corrupted or not correctly written ++** OK success ++*/ ++static int ++acxmem_s_validate_fw(acx_device_t *adev, const firmware_image_t *fw_image, ++ u32 offset) ++{ ++ u32 sum, v32, w32; ++ int len, size; ++ int result = OK; ++ /* we skip the first four bytes which contain the control sum */ ++ const u8 *p = (u8*)fw_image + 4; ++ ++ /* start the image checksum by adding the image size value */ ++ sum = p[0]+p[1]+p[2]+p[3]; ++ p += 4; ++ ++ write_reg32(adev, IO_ACX_SLV_END_CTL, 0); ++ ++#if NO_AUTO_INCREMENT ++ write_reg32(adev, IO_ACX_SLV_MEM_CTL, 0); /* use basic mode */ ++#else ++ write_reg32(adev, IO_ACX_SLV_MEM_CTL, 1); /* use autoincrement mode */ ++ write_reg32(adev, IO_ACX_SLV_MEM_ADDR, offset); /* configure start address */ ++#endif ++ ++ len = 0; ++ size = le32_to_cpu(fw_image->size) & (~3); ++ ++ while (likely(len < size)) { ++ v32 = be32_to_cpu(*(u32*)p); ++ p += 4; ++ len += 4; ++ ++#ifdef NOPE ++#if NO_AUTO_INCREMENT ++ write_reg32(adev, IO_ACX_SLV_MEM_ADDR, offset + len - 4); ++#endif ++ udelay(10); ++ w32 = read_reg32(adev, IO_ACX_SLV_MEM_DATA); ++#endif ++ w32 = read_slavemem32 (adev, offset + len - 4); ++ ++ if (unlikely(w32 != v32)) { ++ printk("acx: FATAL: firmware upload: " ++ "data parts at offset %d don't match\n(0x%08X vs. 0x%08X)!\n" ++ "I/O timing issues or defective memory, with DWL-xx0+? " ++ "ACX_IO_WIDTH=16 may help. Please report\n", ++ len, v32, w32); ++ result = NOT_OK; ++ break; ++ } ++ ++ sum += (u8)w32 + (u8)(w32>>8) + (u8)(w32>>16) + (u8)(w32>>24); ++ } ++ ++ /* sum control verification */ ++ if (result != NOT_OK) { ++ if (sum != le32_to_cpu(fw_image->chksum)) { ++ printk("acx: FATAL: firmware upload: " ++ "checksums don't match!\n"); ++ result = NOT_OK; ++ } ++ } ++ ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_upload_fw ++** ++** Called from acx_reset_dev ++*/ ++static int ++acxmem_s_upload_fw(acx_device_t *adev) ++{ ++ firmware_image_t *fw_image = NULL; ++ int res = NOT_OK; ++ int try; ++ u32 file_size; ++ char *filename = "WLANGEN.BIN"; ++#ifdef PATCH_AROUND_BAD_SPOTS ++ u32 offset; ++ int i; ++ /* ++ * arm-linux-objdump -d patch.bin, or ++ * od -Ax -t x4 patch.bin after finding the bounds ++ * of the .text section with arm-linux-objdump -s patch.bin ++ */ ++ u32 patch[] = { ++ 0xe584c030, 0xe59fc008, ++ 0xe92d1000, 0xe59fc004, 0xe8bd8000, 0x0000080c, ++ 0x0000aa68, 0x605a2200, 0x2c0a689c, 0x2414d80a, ++ 0x2f00689f, 0x1c27d007, 0x06241e7c, 0x2f000e24, ++ 0xe000d1f6, 0x602e6018, 0x23036468, 0x480203db, ++ 0x60ca6003, 0xbdf0750a, 0xffff0808 ++ }; ++#endif ++ ++ FN_ENTER; ++ /* No combined image; tell common we need the radio firmware, too */ ++ adev->need_radio_fw = 1; ++ ++ fw_image = acx_s_read_fw(adev->dev, filename, &file_size); ++ if (!fw_image) { ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++ } ++ ++ for (try = 1; try <= 5; try++) { ++ res = acxmem_s_write_fw(adev, fw_image, 0); ++ log(L_DEBUG|L_INIT, "acx_write_fw (main): %d\n", res); ++ if (OK == res) { ++ res = acxmem_s_validate_fw(adev, fw_image, 0); ++ log(L_DEBUG|L_INIT, "acx_validate_fw " ++ "(main): %d\n", res); ++ } ++ ++ if (OK == res) { ++ SET_BIT(adev->dev_state_mask, ACX_STATE_FW_LOADED); ++ break; ++ } ++ printk("acx: firmware upload attempt #%d FAILED, " ++ "retrying...\n", try); ++ acx_s_msleep(1000); /* better wait for a while... */ ++ } ++ ++#ifdef PATCH_AROUND_BAD_SPOTS ++ /* ++ * Only want to do this if the firmware is exactly what we expect for an ++ * iPaq 4700; otherwise, bad things would ensue. ++ */ ++ if ((HX4700_FIRMWARE_CHECKSUM == fw_image->chksum) || ++ (HX4700_ALTERNATE_FIRMWARE_CHECKSUM == fw_image->chksum)) { ++ /* ++ * Put the patch after the main firmware image. 0x950c contains ++ * the ACX's idea of the end of the firmware. Use that location to ++ * load ours (which depends on that location being 0xab58) then ++ * update that location to point to after ours. ++ */ ++ ++ offset = read_slavemem32 (adev, 0x950c); ++ ++ log (L_DEBUG, "acx: patching in at 0x%04x\n", offset); ++ ++ for (i = 0; i < sizeof(patch) / sizeof(patch[0]); i++) { ++ write_slavemem32 (adev, offset, patch[i]); ++ offset += sizeof(u32); ++ } ++ ++ /* ++ * Patch the instruction at 0x0804 to branch to our ARM patch at 0xab58 ++ */ ++ write_slavemem32 (adev, 0x0804, 0xea000000 + (0xab58-0x0804-8)/4); ++ ++ /* ++ * Patch the instructions at 0x1f40 to branch to our Thumb patch at 0xab74 ++ * ++ * 4a00 ldr r2, [pc, #0] ++ * 4710 bx r2 ++ * .data 0xab74+1 ++ */ ++ write_slavemem32 (adev, 0x1f40, 0x47104a00); ++ write_slavemem32 (adev, 0x1f44, 0x0000ab74+1); ++ ++ /* ++ * Bump the end of the firmware up to beyond our patch. ++ */ ++ write_slavemem32 (adev, 0x950c, offset); ++ ++ } ++#endif ++ ++ vfree(fw_image); ++ ++ FN_EXIT1(res); ++ return res; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_upload_radio ++** ++** Uploads the appropriate radio module firmware into the card. ++*/ ++int ++acxmem_s_upload_radio(acx_device_t *adev) ++{ ++ acx_ie_memmap_t mm; ++ firmware_image_t *radio_image; ++ acx_cmd_radioinit_t radioinit; ++ int res = NOT_OK; ++ int try; ++ u32 offset; ++ u32 size; ++ char filename[sizeof("RADIONN.BIN")]; ++ ++ if (!adev->need_radio_fw) return OK; ++ ++ FN_ENTER; ++ ++ acx_s_interrogate(adev, &mm, ACX1xx_IE_MEMORY_MAP); ++ offset = le32_to_cpu(mm.CodeEnd); ++ ++ snprintf(filename, sizeof(filename), "RADIO%02x.BIN", ++ adev->radio_type); ++ radio_image = acx_s_read_fw(adev->dev, filename, &size); ++ if (!radio_image) { ++ printk("acx: can't load radio module '%s'\n", filename); ++ goto fail; ++ } ++ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_SLEEP, NULL, 0); ++ ++ for (try = 1; try <= 5; try++) { ++ res = acxmem_s_write_fw(adev, radio_image, offset); ++ log(L_DEBUG|L_INIT, "acx_write_fw (radio): %d\n", res); ++ if (OK == res) { ++ res = acxmem_s_validate_fw(adev, radio_image, offset); ++ log(L_DEBUG|L_INIT, "acx_validate_fw (radio): %d\n", res); ++ } ++ ++ if (OK == res) ++ break; ++ printk("acx: radio firmware upload attempt #%d FAILED, " ++ "retrying...\n", try); ++ acx_s_msleep(1000); /* better wait for a while... */ ++ } ++ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_WAKE, NULL, 0); ++ radioinit.offset = cpu_to_le32(offset); ++ ++ /* no endian conversion needed, remains in card CPU area: */ ++ radioinit.len = radio_image->size; ++ ++ vfree(radio_image); ++ ++ if (OK != res) ++ goto fail; ++ ++ /* will take a moment so let's have a big timeout */ ++ acx_s_issue_cmd_timeo(adev, ACX1xx_CMD_RADIOINIT, ++ &radioinit, sizeof(radioinit), CMD_TIMEOUT_MS(1000)); ++ ++ res = acx_s_interrogate(adev, &mm, ACX1xx_IE_MEMORY_MAP); ++ ++fail: ++ FN_EXIT1(res); ++ return res; ++} ++ ++/*********************************************************************** ++** acxmem_l_reset_mac ++** ++** MAC will be reset ++** Call context: reset_dev ++*/ ++static void ++acxmem_l_reset_mac(acx_device_t *adev) ++{ ++ int count; ++ FN_ENTER; ++ ++ /* halt eCPU */ ++ set_regbits (adev, IO_ACX_ECPU_CTRL, 0x1); ++ ++ /* now do soft reset of eCPU, set bit */ ++ set_regbits (adev, IO_ACX_SOFT_RESET, 0x1); ++ log(L_DEBUG, "%s: enable soft reset...\n", __func__); ++ ++ /* Windows driver sleeps here for a while with this sequence */ ++ for (count = 0; count < 200; count++) { ++ udelay (50); ++ } ++ ++ /* now clear bit again: deassert eCPU reset */ ++ log(L_DEBUG, "%s: disable soft reset and go to init mode...\n", __func__); ++ clear_regbits (adev, IO_ACX_SOFT_RESET, 0x1); ++ ++ /* now start a burst read from initial EEPROM */ ++ set_regbits (adev, IO_ACX_EE_START, 0x1); ++ ++ /* ++ * Windows driver sleeps here for a while with this sequence ++ */ ++ for (count = 0; count < 200; count++) { ++ udelay (50); ++ } ++ ++ /* Windows driver writes 0x10000 to register 0x808 here */ ++ ++ write_reg32 (adev, 0x808, 0x10000); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_verify_init ++*/ ++static int ++acxmem_s_verify_init(acx_device_t *adev) ++{ ++ int result = NOT_OK; ++ unsigned long timeout; ++ ++ FN_ENTER; ++ ++ timeout = jiffies + 2*HZ; ++ for (;;) { ++ u32 irqstat = read_reg32(adev, IO_ACX_IRQ_STATUS_NON_DES); ++ if ((irqstat != 0xFFFFFFFF) && (irqstat & HOST_INT_FCS_THRESHOLD)) { ++ result = OK; ++ write_reg32(adev, IO_ACX_IRQ_ACK, HOST_INT_FCS_THRESHOLD); ++ break; ++ } ++ if (time_after(jiffies, timeout)) ++ break; ++ /* Init may take up to ~0.5 sec total */ ++ acx_s_msleep(50); ++ } ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** A few low-level helpers ++** ++** Note: these functions are not protected by lock ++** and thus are never allowed to be called from IRQ. ++** Also they must not race with fw upload which uses same hw regs ++*/ ++ ++/*********************************************************************** ++** acxmem_write_cmd_type_status ++*/ ++ ++static inline void ++acxmem_write_cmd_type_status(acx_device_t *adev, u16 type, u16 status) ++{ ++ write_slavemem32 (adev, (u32) adev->cmd_area, type | (status << 16)); ++ write_flush(adev); ++} ++ ++ ++/*********************************************************************** ++** acxmem_read_cmd_type_status ++*/ ++static u32 ++acxmem_read_cmd_type_status(acx_device_t *adev) ++{ ++ u32 cmd_type, cmd_status; ++ ++ cmd_type = read_slavemem32 (adev, (u32) adev->cmd_area); ++ ++ cmd_status = (cmd_type >> 16); ++ cmd_type = (u16)cmd_type; ++ ++ log(L_CTL, "cmd_type:%04X cmd_status:%04X [%s]\n", ++ cmd_type, cmd_status, ++ acx_cmd_status_str(cmd_status)); ++ ++ return cmd_status; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_reset_dev ++** ++** Arguments: ++** netdevice that contains the adev variable ++** Returns: ++** NOT_OK on fail ++** OK on success ++** Side effects: ++** device is hard reset ++** Call context: ++** acxmem_e_probe ++** Comment: ++** This resets the device using low level hardware calls ++** as well as uploads and verifies the firmware to the card ++*/ ++ ++static inline void ++init_mboxes(acx_device_t *adev) ++{ ++ u32 cmd_offs, info_offs; ++ ++ cmd_offs = read_reg32(adev, IO_ACX_CMD_MAILBOX_OFFS); ++ info_offs = read_reg32(adev, IO_ACX_INFO_MAILBOX_OFFS); ++ adev->cmd_area = (u8*) cmd_offs; ++ adev->info_area = (u8*) info_offs; ++ /* ++ log(L_DEBUG, "iobase2=%p\n" ++ */ ++ log( L_DEBUG, "cmd_mbox_offset=%X cmd_area=%p\n" ++ "info_mbox_offset=%X info_area=%p\n", ++ cmd_offs, adev->cmd_area, ++ info_offs, adev->info_area); ++} ++ ++ ++static inline void ++read_eeprom_area(acx_device_t *adev) ++{ ++#if ACX_DEBUG > 1 ++ int offs; ++ u8 tmp; ++ ++ for (offs = 0x8c; offs < 0xb9; offs++) ++ acxmem_read_eeprom_byte(adev, offs, &tmp); ++#endif ++} ++ ++static int ++acxmem_s_reset_dev(acx_device_t *adev) ++{ ++ const char* msg = ""; ++ unsigned long flags; ++ int result = NOT_OK; ++ u16 hardware_info; ++ u16 ecpu_ctrl; ++ int count; ++ u32 tmp; ++ ++ FN_ENTER; ++ /* ++ write_reg32 (adev, IO_ACX_SLV_MEM_CP, 0); ++ */ ++ /* reset the device to make sure the eCPU is stopped ++ * to upload the firmware correctly */ ++ ++ acx_lock(adev, flags); ++ ++ /* Windows driver does some funny things here */ ++ /* ++ * clear bit 0x200 in register 0x2A0 ++ */ ++ clear_regbits (adev, 0x2A0, 0x200); ++ ++ /* ++ * Set bit 0x200 in ACX_GPIO_OUT ++ */ ++ set_regbits (adev, IO_ACX_GPIO_OUT, 0x200); ++ ++ /* ++ * read register 0x900 until its value is 0x8400104C, sleeping ++ * in between reads if it's not immediate ++ */ ++ tmp = read_reg32 (adev, REG_ACX_VENDOR_ID); ++ count = 500; ++ while (count-- && (tmp != ACX_VENDOR_ID)) { ++ mdelay (10); ++ tmp = read_reg32 (adev, REG_ACX_VENDOR_ID); ++ } ++ ++ /* end what Windows driver does */ ++ ++ acxmem_l_reset_mac(adev); ++ ++ ecpu_ctrl = read_reg32(adev, IO_ACX_ECPU_CTRL) & 1; ++ if (!ecpu_ctrl) { ++ msg = "eCPU is already running. "; ++ goto end_unlock; ++ } ++ ++#ifdef WE_DONT_NEED_THAT_DO_WE ++ if (read_reg16(adev, IO_ACX_SOR_CFG) & 2) { ++ /* eCPU most likely means "embedded CPU" */ ++ msg = "eCPU did not start after boot from flash. "; ++ goto end_unlock; ++ } ++ ++ /* check sense on reset flags */ ++ if (read_reg16(adev, IO_ACX_SOR_CFG) & 0x10) { ++ printk("%s: eCPU did not start after boot (SOR), " ++ "is this fatal?\n", adev->ndev->name); ++ } ++#endif ++ /* scan, if any, is stopped now, setting corresponding IRQ bit */ ++ adev->irq_status |= HOST_INT_SCAN_COMPLETE; ++ ++ acx_unlock(adev, flags); ++ ++ /* need to know radio type before fw load */ ++ /* Need to wait for arrival of this information in a loop, ++ * most probably since eCPU runs some init code from EEPROM ++ * (started burst read in reset_mac()) which also ++ * sets the radio type ID */ ++ ++ count = 0xffff; ++ do { ++ hardware_info = read_reg16(adev, IO_ACX_EEPROM_INFORMATION); ++ if (!--count) { ++ msg = "eCPU didn't indicate radio type"; ++ goto end_fail; ++ } ++ cpu_relax(); ++ } while (!(hardware_info & 0xff00)); /* radio type still zero? */ ++ printk("ACX radio type 0x%02x\n", (hardware_info >> 8) & 0xff); ++ /* printk("DEBUG: count %d\n", count); */ ++ adev->form_factor = hardware_info & 0xff; ++ adev->radio_type = hardware_info >> 8; ++ ++ /* load the firmware */ ++ if (OK != acxmem_s_upload_fw(adev)) ++ goto end_fail; ++ ++ /* acx_s_msleep(10); this one really shouldn't be required */ ++ ++ /* now start eCPU by clearing bit */ ++ clear_regbits (adev, IO_ACX_ECPU_CTRL, 0x1); ++ log(L_DEBUG, "booted eCPU up and waiting for completion...\n"); ++ ++ /* Windows driver clears bit 0x200 in register 0x2A0 here */ ++ clear_regbits (adev, 0x2A0, 0x200); ++ ++ /* Windows driver sets bit 0x200 in ACX_GPIO_OUT here */ ++ set_regbits (adev, IO_ACX_GPIO_OUT, 0x200); ++ /* wait for eCPU bootup */ ++ if (OK != acxmem_s_verify_init(adev)) { ++ msg = "timeout waiting for eCPU. "; ++ goto end_fail; ++ } ++ log(L_DEBUG, "eCPU has woken up, card is ready to be configured\n"); ++ init_mboxes(adev); ++ acxmem_write_cmd_type_status(adev, ACX1xx_CMD_RESET, 0); ++ ++ /* test that EEPROM is readable */ ++ read_eeprom_area(adev); ++ ++ result = OK; ++ goto end; ++ ++/* Finish error message. Indicate which function failed */ ++end_unlock: ++ acx_unlock(adev, flags); ++end_fail: ++ printk("acx: %sreset_dev() FAILED\n", msg); ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_issue_cmd_timeo ++** ++** Sends command to fw, extract result ++** ++** NB: we do _not_ take lock inside, so be sure to not touch anything ++** which may interfere with IRQ handler operation ++** ++** TODO: busy wait is a bit silly, so: ++** 1) stop doing many iters - go to sleep after first ++** 2) go to waitqueue based approach: wait, not poll! ++*/ ++#undef FUNC ++#define FUNC "issue_cmd" ++ ++#if !ACX_DEBUG ++int ++acxmem_s_issue_cmd_timeo( ++ acx_device_t *adev, ++ unsigned int cmd, ++ void *buffer, ++ unsigned buflen, ++ unsigned cmd_timeout) ++{ ++#else ++int ++acxmem_s_issue_cmd_timeo_debug( ++ acx_device_t *adev, ++ unsigned cmd, ++ void *buffer, ++ unsigned buflen, ++ unsigned cmd_timeout, ++ const char* cmdstr) ++{ ++ unsigned long start = jiffies; ++#endif ++ const char *devname; ++ unsigned counter; ++ u16 irqtype; ++ int i, j; ++ u8 *p; ++ u16 cmd_status; ++ unsigned long timeout; ++ ++ FN_ENTER; ++ ++ devname = adev->ndev->name; ++ if (!devname || !devname[0] || devname[4]=='%') ++ devname = "acx"; ++ ++ log(L_CTL, FUNC"(cmd:%s,buflen:%u,timeout:%ums,type:0x%04X)\n", ++ cmdstr, buflen, cmd_timeout, ++ buffer ? le16_to_cpu(((acx_ie_generic_t *)buffer)->type) : -1); ++ ++ if (!(adev->dev_state_mask & ACX_STATE_FW_LOADED)) { ++ printk("%s: "FUNC"(): firmware is not loaded yet, " ++ "cannot execute commands!\n", devname); ++ goto bad; ++ } ++ ++ if ((acx_debug & L_DEBUG) && (cmd != ACX1xx_CMD_INTERROGATE)) { ++ printk("input buffer (len=%u):\n", buflen); ++ acx_dump_bytes(buffer, buflen); ++ } ++ ++ /* wait for firmware to become idle for our command submission */ ++ timeout = HZ/5; ++ counter = (timeout * 1000 / HZ) - 1; /* in ms */ ++ timeout += jiffies; ++ do { ++ cmd_status = acxmem_read_cmd_type_status(adev); ++ /* Test for IDLE state */ ++ if (!cmd_status) ++ break; ++ if (counter % 8 == 0) { ++ if (time_after(jiffies, timeout)) { ++ counter = 0; ++ break; ++ } ++ /* we waited 8 iterations, no luck. Sleep 8 ms */ ++ acx_s_msleep(8); ++ } ++ } while (likely(--counter)); ++ ++ if (!counter) { ++ /* the card doesn't get idle, we're in trouble */ ++ printk("%s: "FUNC"(): cmd_status is not IDLE: 0x%04X!=0\n", ++ devname, cmd_status); ++#if DUMP_IF_SLOW > 0 ++ dump_acxmem (adev, 0, 0x10000); ++ panic ("not idle"); ++#endif ++ goto bad; ++ } else if (counter < 190) { /* if waited >10ms... */ ++ log(L_CTL|L_DEBUG, FUNC"(): waited for IDLE %dms. " ++ "Please report\n", 199 - counter); ++ } ++ ++ /* now write the parameters of the command if needed */ ++ if (buffer && buflen) { ++ /* if it's an INTERROGATE command, just pass the length ++ * of parameters to read, as data */ ++#if CMD_DISCOVERY ++ if (cmd == ACX1xx_CMD_INTERROGATE) ++ memset_io(adev->cmd_area + 4, 0xAA, buflen); ++#endif ++ /* ++ * slave memory version ++ */ ++ copy_to_slavemem (adev, (u32) (adev->cmd_area + 4), buffer, ++ (cmd == ACX1xx_CMD_INTERROGATE) ? 4 : buflen); ++ } ++ /* now write the actual command type */ ++ acxmem_write_cmd_type_status(adev, cmd, 0); ++ ++ /* clear CMD_COMPLETE bit. can be set only by IRQ handler: */ ++ adev->irq_status &= ~HOST_INT_CMD_COMPLETE; ++ ++ /* execute command */ ++ write_reg16(adev, IO_ACX_INT_TRIG, INT_TRIG_CMD); ++ write_flush(adev); ++ ++ /* wait for firmware to process command */ ++ ++ /* Ensure nonzero and not too large timeout. ++ ** Also converts e.g. 100->99, 200->199 ++ ** which is nice but not essential */ ++ cmd_timeout = (cmd_timeout-1) | 1; ++ if (unlikely(cmd_timeout > 1199)) ++ cmd_timeout = 1199; ++ ++ /* we schedule away sometimes (timeout can be large) */ ++ counter = cmd_timeout; ++ timeout = jiffies + cmd_timeout * HZ / 1000; ++ do { ++ if (!adev->irqs_active) { /* IRQ disabled: poll */ ++ irqtype = read_reg16(adev, IO_ACX_IRQ_STATUS_NON_DES); ++ if (irqtype & HOST_INT_CMD_COMPLETE) { ++ write_reg16(adev, IO_ACX_IRQ_ACK, ++ HOST_INT_CMD_COMPLETE); ++ break; ++ } ++ } else { /* Wait when IRQ will set the bit */ ++ irqtype = adev->irq_status; ++ if (irqtype & HOST_INT_CMD_COMPLETE) ++ break; ++ } ++ ++ if (counter % 8 == 0) { ++ if (time_after(jiffies, timeout)) { ++ counter = 0; ++ break; ++ } ++ /* we waited 8 iterations, no luck. Sleep 8 ms */ ++ acx_s_msleep(8); ++ } ++ } while (likely(--counter)); ++ ++ /* save state for debugging */ ++ cmd_status = acxmem_read_cmd_type_status(adev); ++ ++ /* put the card in IDLE state */ ++ acxmem_write_cmd_type_status(adev, ACX1xx_CMD_RESET, 0); ++ ++ if (!counter) { /* timed out! */ ++ printk("%s: "FUNC"(): timed out %s for CMD_COMPLETE. " ++ "irq bits:0x%04X irq_status:0x%04X timeout:%dms " ++ "cmd_status:%d (%s)\n", ++ devname, (adev->irqs_active) ? "waiting" : "polling", ++ irqtype, adev->irq_status, cmd_timeout, ++ cmd_status, acx_cmd_status_str(cmd_status)); ++ printk("%s: "FUNC"(): device irq status 0x%04x\n", ++ devname, read_reg16(adev, IO_ACX_IRQ_STATUS_NON_DES)); ++ printk("%s: "FUNC"(): IO_ACX_IRQ_MASK 0x%04x IO_ACX_FEMR 0x%04x\n", ++ devname, ++ read_reg16 (adev, IO_ACX_IRQ_MASK), ++ read_reg16 (adev, IO_ACX_FEMR)); ++ if (read_reg16 (adev, IO_ACX_IRQ_MASK) == 0xffff) { ++ printk ("acxmem: firmware probably hosed - reloading\n"); ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11) ++ { ++ pm_message_t state; ++ /* acxmem_e_suspend (resume_pdev, state); */ ++ acxmem_e_suspend (adev->ndev , state); ++ } ++#else ++ acxmem_e_suspend (adev, 0); ++#endif ++ { ++ resume_ndev = adev->ndev; ++ fw_resumer (NULL); ++ } ++ } ++ ++ goto bad; ++ } else if (cmd_timeout - counter > 30) { /* if waited >30ms... */ ++ log(L_CTL|L_DEBUG, FUNC"(): %s for CMD_COMPLETE %dms. " ++ "count:%d. Please report\n", ++ (adev->irqs_active) ? "waited" : "polled", ++ cmd_timeout - counter, counter); ++ } ++ ++ if (1 != cmd_status) { /* it is not a 'Success' */ ++ printk("%s: "FUNC"(): cmd_status is not SUCCESS: %d (%s). " ++ "Took %dms of %d\n", ++ devname, cmd_status, acx_cmd_status_str(cmd_status), ++ cmd_timeout - counter, cmd_timeout); ++ /* zero out result buffer ++ * WARNING: this will trash stack in case of illegally large input ++ * length! */ ++ if (buflen > 388) { ++ /* ++ * 388 is maximum command length ++ */ ++ printk ("invalid length 0x%08x\n", buflen); ++ buflen = 388; ++ } ++ p = (u8 *) buffer; ++ for (i = 0; i < buflen; i+= 16) { ++ printk ("%04x:", i); ++ for (j = 0; (j < 16) && (i+j < buflen); j++) { ++ printk (" %02x", *p++); ++ } ++ printk ("\n"); ++ } ++ if (buffer && buflen) ++ memset(buffer, 0, buflen); ++ goto bad; ++ } ++ ++ /* read in result parameters if needed */ ++ if (buffer && buflen && (cmd == ACX1xx_CMD_INTERROGATE)) { ++ copy_from_slavemem (adev, buffer, (u32) (adev->cmd_area + 4), buflen); ++ if (acx_debug & L_DEBUG) { ++ printk("output buffer (len=%u): ", buflen); ++ acx_dump_bytes(buffer, buflen); ++ } ++ } ++ ++/* ok: */ ++ log(L_CTL, FUNC"(%s): took %ld jiffies to complete\n", ++ cmdstr, jiffies - start); ++ FN_EXIT1(OK); ++ return OK; ++ ++bad: ++ /* Give enough info so that callers can avoid ++ ** printing their own diagnostic messages */ ++#if ACX_DEBUG ++ printk("%s: "FUNC"(cmd:%s) FAILED\n", devname, cmdstr); ++#else ++ printk("%s: "FUNC"(cmd:0x%04X) FAILED\n", devname, cmd); ++#endif ++ dump_stack(); ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*********************************************************************** ++*/ ++#if defined(NONESSENTIAL_FEATURES) ++typedef struct device_id { ++ unsigned char id[6]; ++ char *descr; ++ char *type; ++} device_id_t; ++ ++static const device_id_t ++device_ids[] = ++{ ++ { ++ {'G', 'l', 'o', 'b', 'a', 'l'}, ++ NULL, ++ NULL, ++ }, ++ { ++ {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}, ++ "uninitialized", ++ "SpeedStream SS1021 or Gigafast WF721-AEX" ++ }, ++ { ++ {0x80, 0x81, 0x82, 0x83, 0x84, 0x85}, ++ "non-standard", ++ "DrayTek Vigor 520" ++ }, ++ { ++ {'?', '?', '?', '?', '?', '?'}, ++ "non-standard", ++ "Level One WPC-0200" ++ }, ++ { ++ {0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, ++ "empty", ++ "DWL-650+ variant" ++ } ++}; ++ ++static void ++acx_show_card_eeprom_id(acx_device_t *adev) ++{ ++ unsigned char buffer[CARD_EEPROM_ID_SIZE]; ++ int i; ++ ++ memset(&buffer, 0, CARD_EEPROM_ID_SIZE); ++ /* use direct EEPROM access */ ++ for (i = 0; i < CARD_EEPROM_ID_SIZE; i++) { ++ if (OK != acxmem_read_eeprom_byte(adev, ++ ACX100_EEPROM_ID_OFFSET + i, ++ &buffer[i])) { ++ printk("acx: reading EEPROM FAILED\n"); ++ break; ++ } ++ } ++ ++ for (i = 0; i < VEC_SIZE(device_ids); i++) { ++ if (!memcmp(&buffer, device_ids[i].id, CARD_EEPROM_ID_SIZE)) { ++ if (device_ids[i].descr) { ++ printk("acx: EEPROM card ID string check " ++ "found %s card ID: is this %s?\n", ++ device_ids[i].descr, device_ids[i].type); ++ } ++ break; ++ } ++ } ++ if (i == VEC_SIZE(device_ids)) { ++ printk("acx: EEPROM card ID string check found " ++ "unknown card: expected 'Global', got '%.*s\'. " ++ "Please report\n", CARD_EEPROM_ID_SIZE, buffer); ++ } ++} ++#endif /* NONESSENTIAL_FEATURES */ ++ ++/*********************************************************************** ++** acxmem_free_desc_queues ++** ++** Releases the queues that have been allocated, the ++** others have been initialised to NULL so this ++** function can be used if only part of the queues were allocated. ++*/ ++ ++void ++acxmem_free_desc_queues(acx_device_t *adev) ++{ ++#define ACX_FREE_QUEUE(size, ptr, phyaddr) \ ++ if (ptr) { \ ++ kfree(ptr); \ ++ ptr = NULL; \ ++ size = 0; \ ++ } ++ ++ FN_ENTER; ++ ++ ACX_FREE_QUEUE(adev->txhostdesc_area_size, adev->txhostdesc_start, adev->txhostdesc_startphy); ++ ACX_FREE_QUEUE(adev->txbuf_area_size, adev->txbuf_start, adev->txbuf_startphy); ++ ++ adev->txdesc_start = NULL; ++ ++ ACX_FREE_QUEUE(adev->rxhostdesc_area_size, adev->rxhostdesc_start, adev->rxhostdesc_startphy); ++ ACX_FREE_QUEUE(adev->rxbuf_area_size, adev->rxbuf_start, adev->rxbuf_startphy); ++ ++ adev->rxdesc_start = NULL; ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_delete_dma_regions ++*/ ++static void ++acxmem_s_delete_dma_regions(acx_device_t *adev) ++{ ++ unsigned long flags; ++ ++ FN_ENTER; ++ /* disable radio Tx/Rx. Shouldn't we use the firmware commands ++ * here instead? Or are we that much down the road that it's no ++ * longer possible here? */ ++ /* ++ * slave memory interface really doesn't like this. ++ */ ++ /* ++ write_reg16(adev, IO_ACX_ENABLE, 0); ++ */ ++ ++ acx_s_msleep(100); ++ ++ acx_lock(adev, flags); ++ acxmem_free_desc_queues(adev); ++ acx_unlock(adev, flags); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_e_probe ++** ++** Probe routine called when a PCI device w/ matching ID is found. ++** Here's the sequence: ++** - Allocate the PCI resources. ++** - Read the PCMCIA attribute memory to make sure we have a WLAN card ++** - Reset the MAC ++** - Initialize the dev and wlan data ++** - Initialize the MAC ++** ++** pdev - ptr to pci device structure containing info about pci configuration ++** id - ptr to the device id entry that matched this device ++*/ ++static const u16 ++IO_ACX100[] = ++{ ++ 0x0000, /* IO_ACX_SOFT_RESET */ ++ ++ 0x0014, /* IO_ACX_SLV_MEM_ADDR */ ++ 0x0018, /* IO_ACX_SLV_MEM_DATA */ ++ 0x001c, /* IO_ACX_SLV_MEM_CTL */ ++ 0x0020, /* IO_ACX_SLV_END_CTL */ ++ ++ 0x0034, /* IO_ACX_FEMR */ ++ ++ 0x007c, /* IO_ACX_INT_TRIG */ ++ 0x0098, /* IO_ACX_IRQ_MASK */ ++ 0x00a4, /* IO_ACX_IRQ_STATUS_NON_DES */ ++ 0x00a8, /* IO_ACX_IRQ_STATUS_CLEAR */ ++ 0x00ac, /* IO_ACX_IRQ_ACK */ ++ 0x00b0, /* IO_ACX_HINT_TRIG */ ++ ++ 0x0104, /* IO_ACX_ENABLE */ ++ ++ 0x0250, /* IO_ACX_EEPROM_CTL */ ++ 0x0254, /* IO_ACX_EEPROM_ADDR */ ++ 0x0258, /* IO_ACX_EEPROM_DATA */ ++ 0x025c, /* IO_ACX_EEPROM_CFG */ ++ ++ 0x0268, /* IO_ACX_PHY_ADDR */ ++ 0x026c, /* IO_ACX_PHY_DATA */ ++ 0x0270, /* IO_ACX_PHY_CTL */ ++ ++ 0x0290, /* IO_ACX_GPIO_OE */ ++ ++ 0x0298, /* IO_ACX_GPIO_OUT */ ++ ++ 0x02a4, /* IO_ACX_CMD_MAILBOX_OFFS */ ++ 0x02a8, /* IO_ACX_INFO_MAILBOX_OFFS */ ++ 0x02ac, /* IO_ACX_EEPROM_INFORMATION */ ++ ++ 0x02d0, /* IO_ACX_EE_START */ ++ 0x02d4, /* IO_ACX_SOR_CFG */ ++ 0x02d8 /* IO_ACX_ECPU_CTRL */ ++}; ++ ++static const u16 ++IO_ACX111[] = ++{ ++ 0x0000, /* IO_ACX_SOFT_RESET */ ++ ++ 0x0014, /* IO_ACX_SLV_MEM_ADDR */ ++ 0x0018, /* IO_ACX_SLV_MEM_DATA */ ++ 0x001c, /* IO_ACX_SLV_MEM_CTL */ ++ 0x0020, /* IO_ACX_SLV_MEM_CP */ ++ ++ 0x0034, /* IO_ACX_FEMR */ ++ ++ 0x00b4, /* IO_ACX_INT_TRIG */ ++ 0x00d4, /* IO_ACX_IRQ_MASK */ ++ /* we do mean NON_DES (0xf0), not NON_DES_MASK which is at 0xe0: */ ++ 0x00f0, /* IO_ACX_IRQ_STATUS_NON_DES */ ++ 0x00e4, /* IO_ACX_IRQ_STATUS_CLEAR */ ++ 0x00e8, /* IO_ACX_IRQ_ACK */ ++ 0x00ec, /* IO_ACX_HINT_TRIG */ ++ ++ 0x01d0, /* IO_ACX_ENABLE */ ++ ++ 0x0338, /* IO_ACX_EEPROM_CTL */ ++ 0x033c, /* IO_ACX_EEPROM_ADDR */ ++ 0x0340, /* IO_ACX_EEPROM_DATA */ ++ 0x0344, /* IO_ACX_EEPROM_CFG */ ++ ++ 0x0350, /* IO_ACX_PHY_ADDR */ ++ 0x0354, /* IO_ACX_PHY_DATA */ ++ 0x0358, /* IO_ACX_PHY_CTL */ ++ ++ 0x0374, /* IO_ACX_GPIO_OE */ ++ ++ 0x037c, /* IO_ACX_GPIO_OUT */ ++ ++ 0x0388, /* IO_ACX_CMD_MAILBOX_OFFS */ ++ 0x038c, /* IO_ACX_INFO_MAILBOX_OFFS */ ++ 0x0390, /* IO_ACX_EEPROM_INFORMATION */ ++ ++ 0x0100, /* IO_ACX_EE_START */ ++ 0x0104, /* IO_ACX_SOR_CFG */ ++ 0x0108, /* IO_ACX_ECPU_CTRL */ ++}; ++ ++static void ++dummy_netdev_init(struct net_device *ndev) {} ++ ++/* ++ * Most of the acx specific pieces of hardware reset. ++ */ ++static int ++acxmem_complete_hw_reset (acx_device_t *adev) ++{ ++ acx111_ie_configoption_t co; ++ ++ /* NB: read_reg() reads may return bogus data before reset_dev(), ++ * since the firmware which directly controls large parts of the I/O ++ * registers isn't initialized yet. ++ * acx100 seems to be more affected than acx111 */ ++ if (OK != acxmem_s_reset_dev (adev)) ++ return -1; ++ ++ if (IS_ACX100(adev)) { ++ /* ACX100: configopt struct in cmd mailbox - directly after reset */ ++ copy_from_slavemem (adev, (u8*) &co, (u32) adev->cmd_area, sizeof (co)); ++ } ++ ++ if (OK != acx_s_init_mac(adev)) ++ return -3; ++ ++ if (IS_ACX111(adev)) { ++ /* ACX111: configopt struct needs to be queried after full init */ ++ acx_s_interrogate(adev, &co, ACX111_IE_CONFIG_OPTIONS); ++ } ++ ++ /* ++ * Set up transmit buffer administration ++ */ ++ init_acx_txbuf (adev); ++ ++ /* ++ * Windows driver writes 0x01000000 to register 0x288, RADIO_CTL, if the form factor ++ * is 3. It also write protects the EEPROM by writing 1<<9 to GPIO_OUT ++ */ ++ if (adev->form_factor == 3) { ++ set_regbits (adev, 0x288, 0x01000000); ++ set_regbits (adev, 0x298, 1<<9); ++ } ++ ++/* TODO: merge them into one function, they are called just once and are the same for pci & usb */ ++ if (OK != acxmem_read_eeprom_byte(adev, 0x05, &adev->eeprom_version)) ++ return -2; ++ ++ acx_s_parse_configoption(adev, &co); ++ acx_s_get_firmware_version(adev); /* needs to be after acx_s_init_mac() */ ++ acx_display_hardware_details(adev); ++ ++ return 0; ++} ++ ++static int acx_init_netdev(struct net_device *ndev, struct device *dev, int base_addr, int addr_size, int irq) ++{ ++ const char *chip_name; ++ int result = -EIO; ++ int err; ++ u8 chip_type; ++ acx_device_t *adev = NULL; ++ ++ FN_ENTER; ++ ++ /* FIXME: prism54 calls pci_set_mwi() here, ++ * should we do/support the same? */ ++ ++ /* chiptype is u8 but id->driver_data is ulong ++ ** Works for now (possible values are 1 and 2) */ ++ chip_type = CHIPTYPE_ACX100; ++ /* acx100 and acx111 have different PCI memory regions */ ++ if (chip_type == CHIPTYPE_ACX100) { ++ chip_name = "ACX100"; ++ } else if (chip_type == CHIPTYPE_ACX111) { ++ chip_name = "ACX111"; ++ } else { ++ printk("acx: unknown chip type 0x%04X\n", chip_type); ++ goto fail_unknown_chiptype; ++ } ++ ++ printk("acx: found %s-based wireless network card\n", chip_name); ++ log(L_ANY, "initial debug setting is 0x%04X\n", acx_debug); ++ ++ ++ dev_set_drvdata(dev, ndev); ++ ++ ether_setup(ndev); ++ ++ ndev->irq = irq; ++ ++ ndev->base_addr = base_addr; ++printk (KERN_INFO "memwinbase=%lx memwinsize=%u\n",memwin.Base,memwin.Size); ++ if (addr_size == 0 || ndev->irq == 0) ++ goto fail_hw_params; ++ ndev->open = &acxmem_e_open; ++ ndev->stop = &acxmem_e_close; ++ //pdev->dev.release = &acxmem_e_release; ++ ndev->hard_start_xmit = &acx_i_start_xmit; ++ ndev->get_stats = &acx_e_get_stats; ++#if IW_HANDLER_VERSION <= 5 ++ ndev->get_wireless_stats = &acx_e_get_wireless_stats; ++#endif ++ ndev->wireless_handlers = (struct iw_handler_def *)&acx_ioctl_handler_def; ++ ndev->set_multicast_list = &acxmem_i_set_multicast_list; ++ ndev->tx_timeout = &acxmem_i_tx_timeout; ++ ndev->change_mtu = &acx_e_change_mtu; ++ ndev->watchdog_timeo = 4 * HZ; ++ ++ adev = ndev2adev(ndev); ++ spin_lock_init(&adev->lock); /* initial state: unlocked */ ++ spin_lock_init(&adev->txbuf_lock); ++ /* We do not start with downed sem: we want PARANOID_LOCKING to work */ ++ sema_init(&adev->sem, 1); /* initial state: 1 (upped) */ ++ /* since nobody can see new netdev yet, we can as well ++ ** just _presume_ that we're under sem (instead of actually taking it): */ ++ /* acx_sem_lock(adev); */ ++ adev->dev = dev; ++ adev->ndev = ndev; ++ adev->dev_type = DEVTYPE_MEM; ++ adev->chip_type = chip_type; ++ adev->chip_name = chip_name; ++ adev->io = (CHIPTYPE_ACX100 == chip_type) ? IO_ACX100 : IO_ACX111; ++ adev->membase = (volatile u32 *) ndev->base_addr; ++ adev->iobase = (volatile u32 *) ioremap_nocache (ndev->base_addr, addr_size); ++ /* to find crashes due to weird driver access ++ * to unconfigured interface (ifup) */ ++ adev->mgmt_timer.function = (void (*)(unsigned long))0x0000dead; ++ ++#if defined(NONESSENTIAL_FEATURES) ++ acx_show_card_eeprom_id(adev); ++#endif /* NONESSENTIAL_FEATURES */ ++ ++#ifdef SET_MODULE_OWNER ++ SET_MODULE_OWNER(ndev); ++#endif ++ // need to fix that @@ ++ SET_NETDEV_DEV(ndev, dev); ++ ++ log(L_IRQ|L_INIT, "using IRQ %d\n", ndev->irq); ++ ++ /* ok, pci setup is finished, now start initializing the card */ ++ ++ if (OK != acxmem_complete_hw_reset (adev)) ++ goto fail_reset; ++ ++ /* ++ * Set up default things for most of the card settings. ++ */ ++ acx_s_set_defaults(adev); ++ ++ /* Register the card, AFTER everything else has been set up, ++ * since otherwise an ioctl could step on our feet due to ++ * firmware operations happening in parallel or uninitialized data */ ++ err = register_netdev(ndev); ++ if (OK != err) { ++ printk("acx: register_netdev() FAILED: %d\n", err); ++ goto fail_register_netdev; ++ } ++ ++ acx_proc_register_entries(ndev); ++ ++ /* Now we have our device, so make sure the kernel doesn't try ++ * to send packets even though we're not associated to a network yet */ ++ acx_stop_queue(ndev, "on probe"); ++ acx_carrier_off(ndev, "on probe"); ++ ++ /* ++ * Set up a default monitor type so that poor combinations of initialization ++ * sequences in monitor mode don't end up destroying the hardware type. ++ */ ++ adev->monitor_type = ARPHRD_ETHER; ++ ++ /* ++ * Register to receive inetaddr notifier changes. This will allow us to ++ * catch if the user changes the MAC address of the interface. ++ */ ++ register_netdevice_notifier(&acx_netdev_notifier); ++ ++ /* after register_netdev() userspace may start working with dev ++ * (in particular, on other CPUs), we only need to up the sem */ ++ /* acx_sem_unlock(adev); */ ++ ++ printk("acx "ACX_RELEASE": net device %s, driver compiled " ++ "against wireless extensions %d and Linux %s\n", ++ ndev->name, WIRELESS_EXT, UTS_RELEASE); ++ ++#if CMD_DISCOVERY ++ great_inquisitor(adev); ++#endif ++ ++ result = OK; ++ goto done; ++ ++ /* error paths: undo everything in reverse order... */ ++ ++fail_register_netdev: ++ ++ acxmem_s_delete_dma_regions(adev); ++ ++fail_reset: ++fail_hw_params: ++ free_netdev(ndev); ++fail_unknown_chiptype: ++ ++ ++done: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxmem_e_remove ++** ++** Shut device down (if not hot unplugged) ++** and deallocate PCI resources for the acx chip. ++** ++** pdev - ptr to PCI device structure containing info about pci configuration ++*/ ++static int __devexit ++acxmem_e_remove(struct pcmcia_device *link) ++{ ++ struct net_device *ndev; ++ acx_device_t *adev; ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ ndev = ((local_info_t*)link->priv)->ndev; ++ if (!ndev) { ++ log(L_DEBUG, "%s: card is unused. Skipping any release code\n", ++ __func__); ++ goto end; ++ } ++ ++ adev = ndev2adev(ndev); ++ ++ /* If device wasn't hot unplugged... */ ++ if (adev_present(adev)) { ++ ++ acx_sem_lock(adev); ++ ++ /* disable both Tx and Rx to shut radio down properly */ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_DISABLE_TX, NULL, 0); ++ acx_s_issue_cmd(adev, ACX1xx_CMD_DISABLE_RX, NULL, 0); ++ ++#ifdef REDUNDANT ++ /* put the eCPU to sleep to save power ++ * Halting is not possible currently, ++ * since not supported by all firmware versions */ ++ acx_s_issue_cmd(adev, ACX100_CMD_SLEEP, NULL, 0); ++#endif ++ acx_lock(adev, flags); ++ ++ /* disable power LED to save power :-) */ ++ log(L_INIT, "switching off power LED to save power\n"); ++ acxmem_l_power_led(adev, 0); ++ ++ /* stop our eCPU */ ++ if (IS_ACX111(adev)) { ++ /* FIXME: does this actually keep halting the eCPU? ++ * I don't think so... ++ */ ++ acxmem_l_reset_mac(adev); ++ } else { ++ u16 temp; ++ ++ /* halt eCPU */ ++ temp = read_reg16(adev, IO_ACX_ECPU_CTRL) | 0x1; ++ write_reg16(adev, IO_ACX_ECPU_CTRL, temp); ++ write_flush(adev); ++ } ++ ++ acx_unlock(adev, flags); ++ ++ acx_sem_unlock(adev); ++ } ++ ++ ++ /* ++ * Unregister the notifier chain ++ */ ++ unregister_netdevice_notifier(&acx_netdev_notifier); ++ ++ /* unregister the device to not let the kernel ++ * (e.g. ioctls) access a half-deconfigured device ++ * NB: this will cause acxmem_e_close() to be called, ++ * thus we shouldn't call it under sem! */ ++ log(L_INIT, "removing device %s\n", ndev->name); ++ unregister_netdev(ndev); ++ ++ /* unregister_netdev ensures that no references to us left. ++ * For paranoid reasons we continue to follow the rules */ ++ acx_sem_lock(adev); ++ ++ if (adev->dev_state_mask & ACX_STATE_IFACE_UP) { ++ acxmem_s_down(ndev); ++ CLEAR_BIT(adev->dev_state_mask, ACX_STATE_IFACE_UP); ++ } ++ ++ acx_proc_unregister_entries(ndev); ++ ++ acxmem_s_delete_dma_regions(adev); ++ ++ /* finally, clean up PCI bus state */ ++ if (adev->iobase) iounmap((void *)adev->iobase); ++ ++ acx_sem_unlock(adev); ++ ++ /* Free netdev (quite late, ++ * since otherwise we might get caught off-guard ++ * by a netdev timeout handler execution ++ * expecting to see a working dev...) */ ++ free_netdev(ndev); ++ ++ printk ("e_remove done\n"); ++end: ++ FN_EXIT0; ++ ++ return 0; ++} ++ ++ ++/*********************************************************************** ++** TODO: PM code needs to be fixed / debugged / tested. ++*/ ++#ifdef CONFIG_PM ++static int ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11) ++acxmem_e_suspend( struct net_device *ndev, pm_message_t state) ++#else ++acxmem_e_suspend( struct net_device *ndev, u32 state) ++#endif ++{ ++ FN_ENTER; ++ acx_device_t *adev; ++ printk("acx: suspend handler is experimental!\n"); ++ printk("sus: dev %p\n", ndev); ++ ++ if (!netif_running(ndev)) ++ goto end; ++ // @@ need to get it from link or something like that ++ adev = ndev2adev(ndev); ++ printk("sus: adev %p\n", adev); ++ ++ acx_sem_lock(adev); ++ ++ netif_device_detach(adev->ndev); /* this one cannot sleep */ ++ acxmem_s_down(adev->ndev); ++ /* down() does not set it to 0xffff, but here we really want that */ ++ write_reg16(adev, IO_ACX_IRQ_MASK, 0xffff); ++ write_reg16(adev, IO_ACX_FEMR, 0x0); ++ acxmem_s_delete_dma_regions(adev); ++ ++ /* ++ * Turn the ACX chip off. ++ */ ++ ++ acx_sem_unlock(adev); ++end: ++ FN_EXIT0; ++ return OK; ++} ++ ++ ++static void ++fw_resumer(struct work_struct *notused) ++{ ++ acx_device_t *adev; ++ struct net_device *ndev = resume_ndev; ++ ++ printk("acx: resume handler is experimental!\n"); ++ printk("rsm: got dev %p\n", ndev); ++ ++ if (!netif_running(ndev)) ++ return; ++ ++ adev = ndev2adev(ndev); ++ printk("rsm: got adev %p\n", adev); ++ ++ acx_sem_lock(adev); ++ ++ /* ++ * Turn on the ACX. ++ */ ++ ++ acxmem_complete_hw_reset (adev); ++ ++ /* ++ * done by acx_s_set_defaults for initial startup ++ */ ++ acxmem_set_interrupt_mask(adev); ++ ++ printk ("rsm: bringing up interface\n"); ++ SET_BIT (adev->set_mask, GETSET_ALL); ++ acxmem_s_up(ndev); ++ printk("rsm: acx up done\n"); ++ ++ /* now even reload all card parameters as they were before suspend, ++ * and possibly be back in the network again already :-) ++ */ ++ /* - most settings updated in acxmem_s_up() ++ if (ACX_STATE_IFACE_UP & adev->dev_state_mask) { ++ adev->set_mask = GETSET_ALL; ++ acx_s_update_card_settings(adev); ++ printk("rsm: settings updated\n"); ++ } ++ */ ++ netif_device_attach(ndev); ++ printk("rsm: device attached\n"); ++ ++ acx_sem_unlock(adev); ++} ++ ++DECLARE_WORK( fw_resume_work, fw_resumer ); ++ ++static int ++acxmem_e_resume(struct pcmcia_device *link) ++{ ++ FN_ENTER; ++ ++ //resume_pdev = pdev; ++ schedule_work( &fw_resume_work ); ++ ++ FN_EXIT0; ++ return OK; ++} ++#endif /* CONFIG_PM */ ++ ++ ++/*********************************************************************** ++** acxmem_s_up ++** ++** This function is called by acxmem_e_open (when ifconfig sets the device as up) ++** ++** Side effects: ++** - Enables on-card interrupt requests ++** - calls acx_s_start ++*/ ++ ++static void ++enable_acx_irq(acx_device_t *adev) ++{ ++ FN_ENTER; ++ write_reg16(adev, IO_ACX_IRQ_MASK, adev->irq_mask); ++ write_reg16(adev, IO_ACX_FEMR, 0x8000); ++ adev->irqs_active = 1; ++ FN_EXIT0; ++} ++ ++static void ++acxmem_s_up(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ acx_lock(adev, flags); ++ enable_acx_irq(adev); ++ acx_unlock(adev, flags); ++ ++ /* acx fw < 1.9.3.e has a hardware timer, and older drivers ++ ** used to use it. But we don't do that anymore, our OS ++ ** has reliable software timers */ ++ init_timer(&adev->mgmt_timer); ++ adev->mgmt_timer.function = acx_i_timer; ++ adev->mgmt_timer.data = (unsigned long)adev; ++ ++ /* Need to set ACX_STATE_IFACE_UP first, or else ++ ** timer won't be started by acx_set_status() */ ++ SET_BIT(adev->dev_state_mask, ACX_STATE_IFACE_UP); ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_2_STA: ++ /* actual scan cmd will happen in start() */ ++ acx_set_status(adev, ACX_STATUS_1_SCANNING); break; ++ case ACX_MODE_3_AP: ++ case ACX_MODE_MONITOR: ++ acx_set_status(adev, ACX_STATUS_4_ASSOCIATED); break; ++ } ++ ++ acx_s_start(adev); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_down ++** ++** This disables the netdevice ++** ++** Side effects: ++** - disables on-card interrupt request ++*/ ++ ++static void ++disable_acx_irq(acx_device_t *adev) ++{ ++ FN_ENTER; ++ ++ /* I guess mask is not 0xffff because acx100 won't signal ++ ** cmd completion then (needed for ifup). ++ ** Someone with acx100 please confirm */ ++ write_reg16(adev, IO_ACX_IRQ_MASK, adev->irq_mask_off); ++ write_reg16(adev, IO_ACX_FEMR, 0x0); ++ adev->irqs_active = 0; ++ FN_EXIT0; ++} ++ ++static void ++acxmem_s_down(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ /* Disable IRQs first, so that IRQs cannot race with us */ ++ /* then wait until interrupts have finished executing on other CPUs */ ++ acx_lock(adev, flags); ++ disable_acx_irq(adev); ++ synchronize_irq(adev->pdev->irq); ++ acx_unlock(adev, flags); ++ ++ /* we really don't want to have an asynchronous tasklet disturb us ++ ** after something vital for its job has been shut down, so ++ ** end all remaining work now. ++ ** ++ ** NB: carrier_off (done by set_status below) would lead to ++ ** not yet fully understood deadlock in FLUSH_SCHEDULED_WORK(). ++ ** That's why we do FLUSH first. ++ ** ++ ** NB2: we have a bad locking bug here: FLUSH_SCHEDULED_WORK() ++ ** waits for acx_e_after_interrupt_task to complete if it is running ++ ** on another CPU, but acx_e_after_interrupt_task ++ ** will sleep on sem forever, because it is taken by us! ++ ** Work around that by temporary sem unlock. ++ ** This will fail miserably if we'll be hit by concurrent ++ ** iwconfig or something in between. TODO! */ ++ acx_sem_unlock(adev); ++ FLUSH_SCHEDULED_WORK(); ++ acx_sem_lock(adev); ++ ++ /* This is possible: ++ ** FLUSH_SCHEDULED_WORK -> acx_e_after_interrupt_task -> ++ ** -> set_status(ASSOCIATED) -> wake_queue() ++ ** That's why we stop queue _after_ FLUSH_SCHEDULED_WORK ++ ** lock/unlock is just paranoia, maybe not needed */ ++ acx_lock(adev, flags); ++ acx_stop_queue(ndev, "on ifdown"); ++ acx_set_status(adev, ACX_STATUS_0_STOPPED); ++ acx_unlock(adev, flags); ++ ++ /* kernel/timer.c says it's illegal to del_timer_sync() ++ ** a timer which restarts itself. We guarantee this cannot ++ ** ever happen because acx_i_timer() never does this if ++ ** status is ACX_STATUS_0_STOPPED */ ++ del_timer_sync(&adev->mgmt_timer); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_e_open ++** ++** Called as a result of SIOCSIFFLAGS ioctl changing the flags bit IFF_UP ++** from clear to set. In other words: ifconfig up. ++** ++** Returns: ++** 0 success ++** >0 f/w reported error ++** <0 driver reported error ++*/ ++static int ++acxmem_e_open(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result = OK; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ acx_init_task_scheduler(adev); ++ ++/* TODO: pci_set_power_state(pdev, PCI_D0); ? */ ++ ++#if 0 ++ /* request shared IRQ handler */ ++ if (request_irq(ndev->irq, acxmem_i_interrupt, SA_INTERRUPT, ndev->name, ndev)) { ++ printk("%s: request_irq FAILED\n", ndev->name); ++ result = -EAGAIN; ++ goto done; ++ } ++ set_irq_type (ndev->irq, IRQT_FALLING); ++ log(L_DEBUG|L_IRQ, "request_irq %d successful\n", ndev->irq); ++#endif ++ ++ /* ifup device */ ++ acxmem_s_up(ndev); ++ ++ /* We don't currently have to do anything else. ++ * The setup of the MAC should be subsequently completed via ++ * the mlme commands. ++ * Higher layers know we're ready from dev->start==1 and ++ * dev->tbusy==0. Our rx path knows to pass up received/ ++ * frames because of dev->flags&IFF_UP is true. ++ */ ++done: ++ acx_sem_unlock(adev); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxmem_e_close ++** ++** Called as a result of SIOCSIIFFLAGS ioctl changing the flags bit IFF_UP ++** from set to clear. I.e. called by "ifconfig DEV down" ++** ++** Returns: ++** 0 success ++** >0 f/w reported error ++** <0 driver reported error ++*/ ++static int ++acxmem_e_close(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ /* ifdown device */ ++ CLEAR_BIT(adev->dev_state_mask, ACX_STATE_IFACE_UP); ++ if (netif_device_present(ndev)) { ++ acxmem_s_down(ndev); ++ } ++ ++ /* disable all IRQs, release shared IRQ handler */ ++ write_reg16(adev, IO_ACX_IRQ_MASK, 0xffff); ++ write_reg16(adev, IO_ACX_FEMR, 0x0); ++ free_irq(ndev->irq, ndev); ++ ++/* TODO: pci_set_power_state(pdev, PCI_D3hot); ? */ ++ ++ /* We currently don't have to do anything else. ++ * Higher layers know we're not ready from dev->start==0 and ++ * dev->tbusy==1. Our rx path knows to not pass up received ++ * frames because of dev->flags&IFF_UP is false. ++ */ ++ acx_sem_unlock(adev); ++ ++ log(L_INIT, "closed device\n"); ++ FN_EXIT0; ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acxmem_i_tx_timeout ++** ++** Called from network core. Must not sleep! ++*/ ++static void ++acxmem_i_tx_timeout(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ unsigned int tx_num_cleaned; ++ ++ FN_ENTER; ++ ++ acx_lock(adev, flags); ++ ++ /* clean processed tx descs, they may have been completely full */ ++ tx_num_cleaned = acxmem_l_clean_txdesc(adev); ++ ++ /* nothing cleaned, yet (almost) no free buffers available? ++ * --> clean all tx descs, no matter which status!! ++ * Note that I strongly suspect that doing emergency cleaning ++ * may confuse the firmware. This is a last ditch effort to get ++ * ANYTHING to work again... ++ * ++ * TODO: it's best to simply reset & reinit hw from scratch... ++ */ ++ if ((adev->tx_free <= TX_EMERG_CLEAN) && (tx_num_cleaned == 0)) { ++ printk("%s: FAILED to free any of the many full tx buffers. " ++ "Switching to emergency freeing. " ++ "Please report!\n", ndev->name); ++ acxmem_l_clean_txdesc_emergency(adev); ++ } ++ ++ if (acx_queue_stopped(ndev) && (ACX_STATUS_4_ASSOCIATED == adev->status)) ++ acx_wake_queue(ndev, "after tx timeout"); ++ ++ /* stall may have happened due to radio drift, so recalib radio */ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_CMD_RADIO_RECALIB); ++ ++ /* do unimportant work last */ ++ printk("%s: tx timeout!\n", ndev->name); ++ adev->stats.tx_errors++; ++ ++ acx_unlock(adev, flags); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_i_set_multicast_list ++** FIXME: most likely needs refinement ++*/ ++static void ++acxmem_i_set_multicast_list(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ acx_lock(adev, flags); ++ ++ /* firmwares don't have allmulti capability, ++ * so just use promiscuous mode instead in this case. */ ++ if (ndev->flags & (IFF_PROMISC|IFF_ALLMULTI)) { ++ SET_BIT(adev->rx_config_1, RX_CFG1_RCV_PROMISCUOUS); ++ CLEAR_BIT(adev->rx_config_1, RX_CFG1_FILTER_ALL_MULTI); ++ SET_BIT(adev->set_mask, SET_RXCONFIG); ++ /* let kernel know in case *we* needed to set promiscuous */ ++ ndev->flags |= (IFF_PROMISC|IFF_ALLMULTI); ++ } else { ++ CLEAR_BIT(adev->rx_config_1, RX_CFG1_RCV_PROMISCUOUS); ++ SET_BIT(adev->rx_config_1, RX_CFG1_FILTER_ALL_MULTI); ++ SET_BIT(adev->set_mask, SET_RXCONFIG); ++ ndev->flags &= ~(IFF_PROMISC|IFF_ALLMULTI); ++ } ++ ++ /* cannot update card settings directly here, atomic context */ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_UPDATE_CARD_CFG); ++ ++ acx_unlock(adev, flags); ++ ++ FN_EXIT0; ++} ++ ++ ++/*************************************************************** ++** acxmem_l_process_rxdesc ++** ++** Called directly and only from the IRQ handler ++*/ ++ ++#if !ACX_DEBUG ++static inline void log_rxbuffer(const acx_device_t *adev) {} ++#else ++static void ++log_rxbuffer(const acx_device_t *adev) ++{ ++ register const struct rxhostdesc *rxhostdesc; ++ int i; ++ /* no FN_ENTER here, we don't want that */ ++ ++ rxhostdesc = adev->rxhostdesc_start; ++ if (unlikely(!rxhostdesc)) return; ++ for (i = 0; i < RX_CNT; i++) { ++ if ((rxhostdesc->Ctl_16 & cpu_to_le16(DESC_CTL_HOSTOWN)) ++ && (rxhostdesc->Status & cpu_to_le32(DESC_STATUS_FULL))) ++ printk("rx: buf %d full\n", i); ++ rxhostdesc++; ++ } ++} ++#endif ++ ++static void ++acxmem_l_process_rxdesc(acx_device_t *adev) ++{ ++ register rxhostdesc_t *hostdesc; ++ register rxdesc_t *rxdesc; ++ unsigned count, tail; ++ u32 addr; ++ u8 Ctl_8; ++ ++ FN_ENTER; ++ ++ if (unlikely(acx_debug & L_BUFR)) ++ log_rxbuffer(adev); ++ ++ /* First, have a loop to determine the first descriptor that's ++ * full, just in case there's a mismatch between our current ++ * rx_tail and the full descriptor we're supposed to handle. */ ++ tail = adev->rx_tail; ++ count = RX_CNT; ++ while (1) { ++ hostdesc = &adev->rxhostdesc_start[tail]; ++ rxdesc = &adev->rxdesc_start[tail]; ++ /* advance tail regardless of outcome of the below test */ ++ tail = (tail + 1) % RX_CNT; ++ ++ /* ++ * Unlike the PCI interface, where the ACX can write directly to ++ * the host descriptors, on the slave memory interface we have to ++ * pull these. All we really need to do is check the Ctl_8 field ++ * in the rx descriptor on the ACX, which should be 0x11000000 if ++ * we should process it. ++ */ ++ Ctl_8 = hostdesc->Ctl_16 = read_slavemem8 (adev, (u32) &(rxdesc->Ctl_8)); ++ if ((Ctl_8 & DESC_CTL_HOSTOWN) && ++ (Ctl_8 & DESC_CTL_ACXDONE)) ++ break; /* found it! */ ++ ++ if (unlikely(!--count)) /* hmm, no luck: all descs empty, bail out */ ++ goto end; ++ } ++ ++ /* now process descriptors, starting with the first we figured out */ ++ while (1) { ++ log(L_BUFR, "rx: tail=%u Ctl_8=%02X\n", tail, Ctl_8); ++ /* ++ * If the ACX has CTL_RECLAIM set on this descriptor there ++ * is no buffer associated; it just wants us to tell it to ++ * reclaim the memory. ++ */ ++ if (!(Ctl_8 & DESC_CTL_RECLAIM)) { ++ ++ /* ++ * slave interface - pull data now ++ */ ++ hostdesc->length = read_slavemem16 (adev, (u32) &(rxdesc->total_length)); ++ ++ /* ++ * hostdesc->data is an rxbuffer_t, which includes header information, ++ * but the length in the data packet doesn't. The header information ++ * takes up an additional 12 bytes, so add that to the length we copy. ++ */ ++ addr = read_slavemem32 (adev, (u32) &(rxdesc->ACXMemPtr)); ++ if (addr) { ++ /* ++ * How can &(rxdesc->ACXMemPtr) above ever be zero? Looks like we ++ * get that now and then - try to trap it for debug. ++ */ ++ if (addr & 0xffff0000) { ++ printk("rxdesc 0x%08x\n", (u32) rxdesc); ++ dump_acxmem (adev, 0, 0x10000); ++ panic ("Bad access!"); ++ } ++ chaincopy_from_slavemem (adev, (u8 *) hostdesc->data, addr, ++ hostdesc->length + ++ (u32) &((rxbuffer_t *)0)->hdr_a3); ++ acx_l_process_rxbuf(adev, hostdesc->data); ++ } ++ } ++ else { ++ printk ("rx reclaim only!\n"); ++ } ++ ++ hostdesc->Status = 0; ++ ++ /* ++ * Let the ACX know we're done. ++ */ ++ CLEAR_BIT (Ctl_8, DESC_CTL_HOSTOWN); ++ SET_BIT (Ctl_8, DESC_CTL_HOSTDONE); ++ SET_BIT (Ctl_8, DESC_CTL_RECLAIM); ++ write_slavemem8 (adev, (u32) &rxdesc->Ctl_8, Ctl_8); ++ ++ /* ++ * Now tell the ACX we've finished with the receive buffer so ++ * it can finish the reclaim. ++ */ ++ write_reg16 (adev, IO_ACX_INT_TRIG, INT_TRIG_RXPRC); ++ ++ /* ok, descriptor is handled, now check the next descriptor */ ++ hostdesc = &adev->rxhostdesc_start[tail]; ++ rxdesc = &adev->rxdesc_start[tail]; ++ ++ Ctl_8 = hostdesc->Ctl_16 = read_slavemem8 (adev, (u32) &(rxdesc->Ctl_8)); ++ ++ /* if next descriptor is empty, then bail out */ ++ if (!(Ctl_8 & DESC_CTL_HOSTOWN) || !(Ctl_8 & DESC_CTL_ACXDONE)) ++ break; ++ ++ tail = (tail + 1) % RX_CNT; ++ } ++end: ++ adev->rx_tail = tail; ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_i_interrupt ++** ++** IRQ handler (atomic context, must not sleep, blah, blah) ++*/ ++ ++/* scan is complete. all frames now on the receive queue are valid */ ++#define INFO_SCAN_COMPLETE 0x0001 ++#define INFO_WEP_KEY_NOT_FOUND 0x0002 ++/* hw has been reset as the result of a watchdog timer timeout */ ++#define INFO_WATCH_DOG_RESET 0x0003 ++/* failed to send out NULL frame from PS mode notification to AP */ ++/* recommended action: try entering 802.11 PS mode again */ ++#define INFO_PS_FAIL 0x0004 ++/* encryption/decryption process on a packet failed */ ++#define INFO_IV_ICV_FAILURE 0x0005 ++ ++/* Info mailbox format: ++2 bytes: type ++2 bytes: status ++more bytes may follow ++ rumors say about status: ++ 0x0000 info available (set by hw) ++ 0x0001 information received (must be set by host) ++ 0x1000 info available, mailbox overflowed (messages lost) (set by hw) ++ but in practice we've seen: ++ 0x9000 when we did not set status to 0x0001 on prev message ++ 0x1001 when we did set it ++ 0x0000 was never seen ++ conclusion: this is really a bitfield: ++ 0x1000 is 'info available' bit ++ 'mailbox overflowed' bit is 0x8000, not 0x1000 ++ value of 0x0000 probably means that there are no messages at all ++ P.S. I dunno how in hell hw is supposed to notice that messages are lost - ++ it does NOT clear bit 0x0001, and this bit will probably stay forever set ++ after we set it once. Let's hope this will be fixed in firmware someday ++*/ ++ ++static void ++handle_info_irq(acx_device_t *adev) ++{ ++#if ACX_DEBUG ++ static const char * const info_type_msg[] = { ++ "(unknown)", ++ "scan complete", ++ "WEP key not found", ++ "internal watchdog reset was done", ++ "failed to send powersave (NULL frame) notification to AP", ++ "encrypt/decrypt on a packet has failed", ++ "TKIP tx keys disabled", ++ "TKIP rx keys disabled", ++ "TKIP rx: key ID not found", ++ "???", ++ "???", ++ "???", ++ "???", ++ "???", ++ "???", ++ "???", ++ "TKIP IV value exceeds thresh" ++ }; ++#endif ++ u32 info_type, info_status; ++ ++ info_type = read_slavemem32 (adev, (u32) adev->info_area); ++ ++ info_status = (info_type >> 16); ++ info_type = (u16)info_type; ++ ++ /* inform fw that we have read this info message */ ++ write_slavemem32(adev, (u32) adev->info_area, info_type | 0x00010000); ++ write_reg16(adev, IO_ACX_INT_TRIG, INT_TRIG_INFOACK); ++ write_flush(adev); ++ ++ log(L_CTL, "info_type:%04X info_status:%04X\n", ++ info_type, info_status); ++ ++ log(L_IRQ, "got Info IRQ: status %04X type %04X: %s\n", ++ info_status, info_type, ++ info_type_msg[(info_type >= VEC_SIZE(info_type_msg)) ? ++ 0 : info_type] ++ ); ++} ++ ++ ++static void ++log_unusual_irq(u16 irqtype) { ++ /* ++ if (!printk_ratelimit()) ++ return; ++ */ ++ ++ printk("acx: got"); ++ if (irqtype & HOST_INT_TX_XFER) { ++ printk(" Tx_Xfer"); ++ } ++ if (irqtype & HOST_INT_RX_COMPLETE) { ++ printk(" Rx_Complete"); ++ } ++ if (irqtype & HOST_INT_DTIM) { ++ printk(" DTIM"); ++ } ++ if (irqtype & HOST_INT_BEACON) { ++ printk(" Beacon"); ++ } ++ if (irqtype & HOST_INT_TIMER) { ++ log(L_IRQ, " Timer"); ++ } ++ if (irqtype & HOST_INT_KEY_NOT_FOUND) { ++ printk(" Key_Not_Found"); ++ } ++ if (irqtype & HOST_INT_IV_ICV_FAILURE) { ++ printk(" IV_ICV_Failure (crypto)"); ++ } ++ /* HOST_INT_CMD_COMPLETE */ ++ /* HOST_INT_INFO */ ++ if (irqtype & HOST_INT_OVERFLOW) { ++ printk(" Overflow"); ++ } ++ if (irqtype & HOST_INT_PROCESS_ERROR) { ++ printk(" Process_Error"); ++ } ++ /* HOST_INT_SCAN_COMPLETE */ ++ if (irqtype & HOST_INT_FCS_THRESHOLD) { ++ printk(" FCS_Threshold"); ++ } ++ if (irqtype & HOST_INT_UNKNOWN) { ++ printk(" Unknown"); ++ } ++ printk(" IRQ(s)\n"); ++} ++ ++ ++static void ++update_link_quality_led(acx_device_t *adev) ++{ ++ int qual; ++ ++ qual = acx_signal_determine_quality(adev->wstats.qual.level, adev->wstats.qual.noise); ++ if (qual > adev->brange_max_quality) ++ qual = adev->brange_max_quality; ++ ++ if (time_after(jiffies, adev->brange_time_last_state_change + ++ (HZ/2 - HZ/2 * (unsigned long)qual / adev->brange_max_quality ) )) { ++ acxmem_l_power_led(adev, (adev->brange_last_state == 0)); ++ adev->brange_last_state ^= 1; /* toggle */ ++ adev->brange_time_last_state_change = jiffies; ++ } ++} ++ ++ ++#define MAX_IRQLOOPS_PER_JIFFY (20000/HZ) /* a la orinoco.c */ ++ ++static irqreturn_t ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19) ++acxmem_i_interrupt(int irq, void *dev_id) ++#else ++acxmwm_i_interrupt(int irq, void *dev_id, struct pt_regs *regs) ++#endif ++{ ++ acx_device_t *adev; ++ unsigned long flags; ++ unsigned int irqcount = MAX_IRQLOOPS_PER_JIFFY; ++ register u16 irqtype; ++ u16 unmasked; ++ ++ adev = ndev2adev((struct net_device*)dev_id); ++ ++ /* LOCKING: can just spin_lock() since IRQs are disabled anyway. ++ * I am paranoid */ ++ acx_lock(adev, flags); ++ ++ unmasked = read_reg16(adev, IO_ACX_IRQ_STATUS_CLEAR); ++ if (unlikely(0xffff == unmasked)) { ++ /* 0xffff value hints at missing hardware, ++ * so don't do anything. ++ * Not very clean, but other drivers do the same... */ ++ log(L_IRQ, "IRQ type:FFFF - device removed? IRQ_NONE\n"); ++ goto none; ++ } ++ ++ /* We will check only "interesting" IRQ types */ ++ irqtype = unmasked & ~adev->irq_mask; ++ if (!irqtype) { ++ /* We are on a shared IRQ line and it wasn't our IRQ */ ++ log(L_IRQ, "IRQ type:%04X, mask:%04X - all are masked, IRQ_NONE\n", ++ unmasked, adev->irq_mask); ++ goto none; ++ } ++ ++ /* Done here because IRQ_NONEs taking three lines of log ++ ** drive me crazy */ ++ FN_ENTER; ++ ++#define IRQ_ITERATE 1 ++#if IRQ_ITERATE ++if (jiffies != adev->irq_last_jiffies) { ++ adev->irq_loops_this_jiffy = 0; ++ adev->irq_last_jiffies = jiffies; ++} ++ ++/* safety condition; we'll normally abort loop below ++ * in case no IRQ type occurred */ ++while (likely(--irqcount)) { ++#endif ++ /* ACK all IRQs ASAP */ ++ write_reg16(adev, IO_ACX_IRQ_ACK, 0xffff); ++ ++ log(L_IRQ, "IRQ type:%04X, mask:%04X, type & ~mask:%04X\n", ++ unmasked, adev->irq_mask, irqtype); ++ ++ /* Handle most important IRQ types first */ ++ if (irqtype & HOST_INT_RX_DATA) { ++ log(L_IRQ, "got Rx_Data IRQ\n"); ++ acxmem_l_process_rxdesc(adev); ++ } ++ if (irqtype & HOST_INT_TX_COMPLETE) { ++ log(L_IRQ, "got Tx_Complete IRQ\n"); ++ /* don't clean up on each Tx complete, wait a bit ++ * unless we're going towards full, in which case ++ * we do it immediately, too (otherwise we might lockup ++ * with a full Tx buffer if we go into ++ * acxmem_l_clean_txdesc() at a time when we won't wakeup ++ * the net queue in there for some reason...) */ ++ if (adev->tx_free <= TX_START_CLEAN) { ++#if TX_CLEANUP_IN_SOFTIRQ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_TX_CLEANUP); ++#else ++ acxmem_l_clean_txdesc(adev); ++#endif ++ } ++ } ++ ++ /* Less frequent ones */ ++ if (irqtype & (0 ++ | HOST_INT_CMD_COMPLETE ++ | HOST_INT_INFO ++ | HOST_INT_SCAN_COMPLETE ++ )) { ++ if (irqtype & HOST_INT_CMD_COMPLETE) { ++ log(L_IRQ, "got Command_Complete IRQ\n"); ++ /* save the state for the running issue_cmd() */ ++ SET_BIT(adev->irq_status, HOST_INT_CMD_COMPLETE); ++ } ++ if (irqtype & HOST_INT_INFO) { ++ handle_info_irq(adev); ++ } ++ if (irqtype & HOST_INT_SCAN_COMPLETE) { ++ log(L_IRQ, "got Scan_Complete IRQ\n"); ++ /* need to do that in process context */ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_COMPLETE_SCAN); ++ /* remember that fw is not scanning anymore */ ++ SET_BIT(adev->irq_status, HOST_INT_SCAN_COMPLETE); ++ } ++ } ++ ++ /* These we just log, but either they happen rarely ++ * or we keep them masked out */ ++ if (irqtype & (0 ++ /* | HOST_INT_RX_DATA */ ++ /* | HOST_INT_TX_COMPLETE */ ++ | HOST_INT_TX_XFER ++ | HOST_INT_RX_COMPLETE ++ | HOST_INT_DTIM ++ | HOST_INT_BEACON ++ | HOST_INT_TIMER ++ | HOST_INT_KEY_NOT_FOUND ++ | HOST_INT_IV_ICV_FAILURE ++ /* | HOST_INT_CMD_COMPLETE */ ++ /* | HOST_INT_INFO */ ++ | HOST_INT_OVERFLOW ++ | HOST_INT_PROCESS_ERROR ++ /* | HOST_INT_SCAN_COMPLETE */ ++ | HOST_INT_FCS_THRESHOLD ++ | HOST_INT_UNKNOWN ++ )) { ++ log_unusual_irq(irqtype); ++ } ++ ++#if IRQ_ITERATE ++ unmasked = read_reg16(adev, IO_ACX_IRQ_STATUS_CLEAR); ++ irqtype = unmasked & ~adev->irq_mask; ++ /* Bail out if no new IRQ bits or if all are masked out */ ++ if (!irqtype) ++ break; ++ ++ if (unlikely(++adev->irq_loops_this_jiffy > MAX_IRQLOOPS_PER_JIFFY)) { ++ printk(KERN_ERR "acx: too many interrupts per jiffy!\n"); ++ /* Looks like card floods us with IRQs! Try to stop that */ ++ write_reg16(adev, IO_ACX_IRQ_MASK, 0xffff); ++ /* This will short-circuit all future attempts to handle IRQ. ++ * We cant do much more... */ ++ adev->irq_mask = 0; ++ break; ++ } ++} ++#endif ++ /* Routine to perform blink with range */ ++ if (unlikely(adev->led_power == 2)) ++ update_link_quality_led(adev); ++ ++/* handled: */ ++ /* write_flush(adev); - not needed, last op was read anyway */ ++ acx_unlock(adev, flags); ++ FN_EXIT0; ++ return IRQ_HANDLED; ++ ++none: ++ acx_unlock(adev, flags); ++ return IRQ_NONE; ++} ++ ++ ++/*********************************************************************** ++** acxmem_l_power_led ++*/ ++void ++acxmem_l_power_led(acx_device_t *adev, int enable) ++{ ++ u16 gpio_pled = IS_ACX111(adev) ? 0x0040 : 0x0800; ++ ++ /* A hack. Not moving message rate limiting to adev->xxx ++ * (it's only a debug message after all) */ ++ static int rate_limit = 0; ++ ++ if (rate_limit++ < 3) ++ log(L_IOCTL, "Please report in case toggling the power " ++ "LED doesn't work for your card!\n"); ++ if (enable) ++ write_reg16(adev, IO_ACX_GPIO_OUT, ++ read_reg16(adev, IO_ACX_GPIO_OUT) & ~gpio_pled); ++ else ++ write_reg16(adev, IO_ACX_GPIO_OUT, ++ read_reg16(adev, IO_ACX_GPIO_OUT) | gpio_pled); ++} ++ ++ ++/*********************************************************************** ++** Ioctls ++*/ ++ ++/*********************************************************************** ++*/ ++int ++acx111pci_ioctl_info( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ struct iw_param *vwrq, ++ char *extra) ++{ ++#if ACX_DEBUG > 1 ++ acx_device_t *adev = ndev2adev(ndev); ++ rxdesc_t *rxdesc; ++ txdesc_t *txdesc; ++ rxhostdesc_t *rxhostdesc; ++ txhostdesc_t *txhostdesc; ++ struct acx111_ie_memoryconfig memconf; ++ struct acx111_ie_queueconfig queueconf; ++ unsigned long flags; ++ int i; ++ char memmap[0x34]; ++ char rxconfig[0x8]; ++ char fcserror[0x8]; ++ char ratefallback[0x5]; ++ ++ if ( !(acx_debug & (L_IOCTL|L_DEBUG)) ) ++ return OK; ++ /* using printk() since we checked debug flag already */ ++ ++ acx_sem_lock(adev); ++ ++ if (!IS_ACX111(adev)) { ++ printk("acx111-specific function called " ++ "with non-acx111 chip, aborting\n"); ++ goto end_ok; ++ } ++ ++ /* get Acx111 Memory Configuration */ ++ memset(&memconf, 0, sizeof(memconf)); ++ /* BTW, fails with 12 (Write only) error code. ++ ** Retained for easy testing of issue_cmd error handling :) */ ++ printk ("Interrogating queue config\n"); ++ acx_s_interrogate(adev, &memconf, ACX1xx_IE_QUEUE_CONFIG); ++ printk ("done with queue config\n"); ++ ++ /* get Acx111 Queue Configuration */ ++ memset(&queueconf, 0, sizeof(queueconf)); ++ printk ("Interrogating mem config options\n"); ++ acx_s_interrogate(adev, &queueconf, ACX1xx_IE_MEMORY_CONFIG_OPTIONS); ++ printk ("done with mem config options\n"); ++ ++ /* get Acx111 Memory Map */ ++ memset(memmap, 0, sizeof(memmap)); ++ printk ("Interrogating mem map\n"); ++ acx_s_interrogate(adev, &memmap, ACX1xx_IE_MEMORY_MAP); ++ printk ("done with mem map\n"); ++ ++ /* get Acx111 Rx Config */ ++ memset(rxconfig, 0, sizeof(rxconfig)); ++ printk ("Interrogating rxconfig\n"); ++ acx_s_interrogate(adev, &rxconfig, ACX1xx_IE_RXCONFIG); ++ printk ("done with queue rxconfig\n"); ++ ++ /* get Acx111 fcs error count */ ++ memset(fcserror, 0, sizeof(fcserror)); ++ printk ("Interrogating fcs err count\n"); ++ acx_s_interrogate(adev, &fcserror, ACX1xx_IE_FCS_ERROR_COUNT); ++ printk ("done with err count\n"); ++ ++ /* get Acx111 rate fallback */ ++ memset(ratefallback, 0, sizeof(ratefallback)); ++ printk ("Interrogating rate fallback\n"); ++ acx_s_interrogate(adev, &ratefallback, ACX1xx_IE_RATE_FALLBACK); ++ printk ("done with rate fallback\n"); ++ ++ /* force occurrence of a beacon interrupt */ ++ /* TODO: comment why is this necessary */ ++ write_reg16(adev, IO_ACX_HINT_TRIG, HOST_INT_BEACON); ++ ++ /* dump Acx111 Mem Configuration */ ++ printk("dump mem config:\n" ++ "data read: %d, struct size: %d\n" ++ "Number of stations: %1X\n" ++ "Memory block size: %1X\n" ++ "tx/rx memory block allocation: %1X\n" ++ "count rx: %X / tx: %X queues\n" ++ "options %1X\n" ++ "fragmentation %1X\n" ++ "Rx Queue 1 Count Descriptors: %X\n" ++ "Rx Queue 1 Host Memory Start: %X\n" ++ "Tx Queue 1 Count Descriptors: %X\n" ++ "Tx Queue 1 Attributes: %X\n", ++ memconf.len, (int) sizeof(memconf), ++ memconf.no_of_stations, ++ memconf.memory_block_size, ++ memconf.tx_rx_memory_block_allocation, ++ memconf.count_rx_queues, memconf.count_tx_queues, ++ memconf.options, ++ memconf.fragmentation, ++ memconf.rx_queue1_count_descs, ++ acx2cpu(memconf.rx_queue1_host_rx_start), ++ memconf.tx_queue1_count_descs, ++ memconf.tx_queue1_attributes); ++ ++ /* dump Acx111 Queue Configuration */ ++ printk("dump queue head:\n" ++ "data read: %d, struct size: %d\n" ++ "tx_memory_block_address (from card): %X\n" ++ "rx_memory_block_address (from card): %X\n" ++ "rx1_queue address (from card): %X\n" ++ "tx1_queue address (from card): %X\n" ++ "tx1_queue attributes (from card): %X\n", ++ queueconf.len, (int) sizeof(queueconf), ++ queueconf.tx_memory_block_address, ++ queueconf.rx_memory_block_address, ++ queueconf.rx1_queue_address, ++ queueconf.tx1_queue_address, ++ queueconf.tx1_attributes); ++ ++ /* dump Acx111 Mem Map */ ++ printk("dump mem map:\n" ++ "data read: %d, struct size: %d\n" ++ "Code start: %X\n" ++ "Code end: %X\n" ++ "WEP default key start: %X\n" ++ "WEP default key end: %X\n" ++ "STA table start: %X\n" ++ "STA table end: %X\n" ++ "Packet template start: %X\n" ++ "Packet template end: %X\n" ++ "Queue memory start: %X\n" ++ "Queue memory end: %X\n" ++ "Packet memory pool start: %X\n" ++ "Packet memory pool end: %X\n" ++ "iobase: %p\n" ++ "iobase2: %p\n", ++ *((u16 *)&memmap[0x02]), (int) sizeof(memmap), ++ *((u32 *)&memmap[0x04]), ++ *((u32 *)&memmap[0x08]), ++ *((u32 *)&memmap[0x0C]), ++ *((u32 *)&memmap[0x10]), ++ *((u32 *)&memmap[0x14]), ++ *((u32 *)&memmap[0x18]), ++ *((u32 *)&memmap[0x1C]), ++ *((u32 *)&memmap[0x20]), ++ *((u32 *)&memmap[0x24]), ++ *((u32 *)&memmap[0x28]), ++ *((u32 *)&memmap[0x2C]), ++ *((u32 *)&memmap[0x30]), ++ adev->iobase, ++ adev->iobase2); ++ ++ /* dump Acx111 Rx Config */ ++ printk("dump rx config:\n" ++ "data read: %d, struct size: %d\n" ++ "rx config: %X\n" ++ "rx filter config: %X\n", ++ *((u16 *)&rxconfig[0x02]), (int) sizeof(rxconfig), ++ *((u16 *)&rxconfig[0x04]), ++ *((u16 *)&rxconfig[0x06])); ++ ++ /* dump Acx111 fcs error */ ++ printk("dump fcserror:\n" ++ "data read: %d, struct size: %d\n" ++ "fcserrors: %X\n", ++ *((u16 *)&fcserror[0x02]), (int) sizeof(fcserror), ++ *((u32 *)&fcserror[0x04])); ++ ++ /* dump Acx111 rate fallback */ ++ printk("dump rate fallback:\n" ++ "data read: %d, struct size: %d\n" ++ "ratefallback: %X\n", ++ *((u16 *)&ratefallback[0x02]), (int) sizeof(ratefallback), ++ *((u8 *)&ratefallback[0x04])); ++ ++ /* protect against IRQ */ ++ acx_lock(adev, flags); ++ ++ /* dump acx111 internal rx descriptor ring buffer */ ++ rxdesc = adev->rxdesc_start; ++ ++ /* loop over complete receive pool */ ++ if (rxdesc) for (i = 0; i < RX_CNT; i++) { ++ printk("\ndump internal rxdesc %d:\n" ++ "mem pos %p\n" ++ "next 0x%X\n" ++ "acx mem pointer (dynamic) 0x%X\n" ++ "CTL (dynamic) 0x%X\n" ++ "Rate (dynamic) 0x%X\n" ++ "RxStatus (dynamic) 0x%X\n" ++ "Mod/Pre (dynamic) 0x%X\n", ++ i, ++ rxdesc, ++ acx2cpu(rxdesc->pNextDesc), ++ acx2cpu(rxdesc->ACXMemPtr), ++ rxdesc->Ctl_8, ++ rxdesc->rate, ++ rxdesc->error, ++ rxdesc->SNR); ++ rxdesc++; ++ } ++ ++ /* dump host rx descriptor ring buffer */ ++ ++ rxhostdesc = adev->rxhostdesc_start; ++ ++ /* loop over complete receive pool */ ++ if (rxhostdesc) for (i = 0; i < RX_CNT; i++) { ++ printk("\ndump host rxdesc %d:\n" ++ "mem pos %p\n" ++ "buffer mem pos 0x%X\n" ++ "buffer mem offset 0x%X\n" ++ "CTL 0x%X\n" ++ "Length 0x%X\n" ++ "next 0x%X\n" ++ "Status 0x%X\n", ++ i, ++ rxhostdesc, ++ acx2cpu(rxhostdesc->data_phy), ++ rxhostdesc->data_offset, ++ le16_to_cpu(rxhostdesc->Ctl_16), ++ le16_to_cpu(rxhostdesc->length), ++ acx2cpu(rxhostdesc->desc_phy_next), ++ rxhostdesc->Status); ++ rxhostdesc++; ++ } ++ ++ /* dump acx111 internal tx descriptor ring buffer */ ++ txdesc = adev->txdesc_start; ++ ++ /* loop over complete transmit pool */ ++ if (txdesc) for (i = 0; i < TX_CNT; i++) { ++ printk("\ndump internal txdesc %d:\n" ++ "size 0x%X\n" ++ "mem pos %p\n" ++ "next 0x%X\n" ++ "acx mem pointer (dynamic) 0x%X\n" ++ "host mem pointer (dynamic) 0x%X\n" ++ "length (dynamic) 0x%X\n" ++ "CTL (dynamic) 0x%X\n" ++ "CTL2 (dynamic) 0x%X\n" ++ "Status (dynamic) 0x%X\n" ++ "Rate (dynamic) 0x%X\n", ++ i, ++ (int) sizeof(struct txdesc), ++ txdesc, ++ acx2cpu(txdesc->pNextDesc), ++ acx2cpu(txdesc->AcxMemPtr), ++ acx2cpu(txdesc->HostMemPtr), ++ le16_to_cpu(txdesc->total_length), ++ txdesc->Ctl_8, ++ txdesc->Ctl2_8, txdesc->error, ++ txdesc->u.r1.rate); ++ txdesc = advance_txdesc(adev, txdesc, 1); ++ } ++ ++ /* dump host tx descriptor ring buffer */ ++ ++ txhostdesc = adev->txhostdesc_start; ++ ++ /* loop over complete host send pool */ ++ if (txhostdesc) for (i = 0; i < TX_CNT * 2; i++) { ++ printk("\ndump host txdesc %d:\n" ++ "mem pos %p\n" ++ "buffer mem pos 0x%X\n" ++ "buffer mem offset 0x%X\n" ++ "CTL 0x%X\n" ++ "Length 0x%X\n" ++ "next 0x%X\n" ++ "Status 0x%X\n", ++ i, ++ txhostdesc, ++ acx2cpu(txhostdesc->data_phy), ++ txhostdesc->data_offset, ++ le16_to_cpu(txhostdesc->Ctl_16), ++ le16_to_cpu(txhostdesc->length), ++ acx2cpu(txhostdesc->desc_phy_next), ++ le32_to_cpu(txhostdesc->Status)); ++ txhostdesc++; ++ } ++ ++ /* write_reg16(adev, 0xb4, 0x4); */ ++ ++ acx_unlock(adev, flags); ++end_ok: ++ ++ acx_sem_unlock(adev); ++#endif /* ACX_DEBUG */ ++ return OK; ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acx100mem_ioctl_set_phy_amp_bias( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ struct iw_param *vwrq, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ u16 gpio_old; ++ ++ if (!IS_ACX100(adev)) { ++ /* WARNING!!! ++ * Removing this check *might* damage ++ * hardware, since we're tweaking GPIOs here after all!!! ++ * You've been warned... ++ * WARNING!!! */ ++ printk("acx: sorry, setting bias level for non-acx100 " ++ "is not supported yet\n"); ++ return OK; ++ } ++ ++ if (*extra > 7) { ++ printk("acx: invalid bias parameter, range is 0-7\n"); ++ return -EINVAL; ++ } ++ ++ acx_sem_lock(adev); ++ ++ /* Need to lock accesses to [IO_ACX_GPIO_OUT]: ++ * IRQ handler uses it to update LED */ ++ acx_lock(adev, flags); ++ gpio_old = read_reg16(adev, IO_ACX_GPIO_OUT); ++ write_reg16(adev, IO_ACX_GPIO_OUT, (gpio_old & 0xf8ff) | ((u16)*extra << 8)); ++ acx_unlock(adev, flags); ++ ++ log(L_DEBUG, "gpio_old: 0x%04X\n", gpio_old); ++ printk("%s: PHY power amplifier bias: old:%d, new:%d\n", ++ ndev->name, ++ (gpio_old & 0x0700) >> 8, (unsigned char)*extra); ++ ++ acx_sem_unlock(adev); ++ ++ return OK; ++} ++ ++/*************************************************************** ++** acxmem_l_alloc_tx ++** Actually returns a txdesc_t* ptr ++** ++** FIXME: in case of fragments, should allocate multiple descrs ++** after figuring out how many we need and whether we still have ++** sufficiently many. ++*/ ++tx_t* ++acxmem_l_alloc_tx(acx_device_t *adev) ++{ ++ struct txdesc *txdesc; ++ unsigned head; ++ u8 ctl8; ++ static int txattempts = 0; ++ ++ FN_ENTER; ++ ++ if (unlikely(!adev->tx_free)) { ++ printk("acx: BUG: no free txdesc left\n"); ++ /* ++ * Probably the ACX ignored a transmit attempt and now there's a packet ++ * sitting in the queue we think should be transmitting but the ACX doesn't ++ * know about. ++ * On the first pass, send the ACX a TxProc interrupt to try moving ++ * things along, and if that doesn't work (ie, we get called again) completely ++ * flush the transmit queue. ++ */ ++ if (txattempts < 10) { ++ txattempts++; ++ printk ("acx: trying to wake up ACX\n"); ++ write_reg16(adev, IO_ACX_INT_TRIG, INT_TRIG_TXPRC); ++ write_flush(adev); } ++ else { ++ txattempts = 0; ++ printk ("acx: flushing transmit queue.\n"); ++ acxmem_l_clean_txdesc_emergency (adev); ++ } ++ txdesc = NULL; ++ goto end; ++ } ++ ++ /* ++ * Make a quick check to see if there is transmit buffer space on ++ * the ACX. This can't guarantee there is enough space for the packet ++ * since we don't yet know how big it is, but it will prevent at least some ++ * annoyances. ++ */ ++ if (!adev->acx_txbuf_blocks_free) { ++ txdesc = NULL; ++ goto end; ++ } ++ ++ head = adev->tx_head; ++ /* ++ * txdesc points to ACX memory ++ */ ++ txdesc = get_txdesc(adev, head); ++ ctl8 = read_slavemem8 (adev, (u32) &(txdesc->Ctl_8)); ++ ++ /* ++ * If we don't own the buffer (HOSTOWN) it is certainly not free; however, ++ * we may have previously thought we had enough memory to send ++ * a packet, allocated the buffer then gave up when we found not enough ++ * transmit buffer space on the ACX. In that case, HOSTOWN and ++ * ACXDONE will both be set. ++ */ ++ if (unlikely(DESC_CTL_HOSTOWN != (ctl8 & DESC_CTL_HOSTOWN))) { ++ /* whoops, descr at current index is not free, so probably ++ * ring buffer already full */ ++ printk("acx: BUG: tx_head:%d Ctl8:0x%02X - failed to find " ++ "free txdesc\n", head, ctl8); ++ txdesc = NULL; ++ goto end; ++ } ++ ++ /* Needed in case txdesc won't be eventually submitted for tx */ ++ write_slavemem8 (adev, (u32) &(txdesc->Ctl_8), DESC_CTL_ACXDONE_HOSTOWN); ++ ++ adev->tx_free--; ++ log(L_BUFT, "tx: got desc %u, %u remain\n", ++ head, adev->tx_free); ++ /* Keep a few free descs between head and tail of tx ring. ++ ** It is not absolutely needed, just feels safer */ ++ if (adev->tx_free < TX_STOP_QUEUE) { ++ log(L_BUF, "stop queue (%u tx desc left)\n", ++ adev->tx_free); ++ acx_stop_queue(adev->ndev, NULL); ++ } ++ ++ /* returning current descriptor, so advance to next free one */ ++ adev->tx_head = (head + 1) % TX_CNT; ++end: ++ FN_EXIT0; ++ ++ return (tx_t*)txdesc; ++} ++ ++ ++/*************************************************************** ++** acxmem_l_dealloc_tx ++** Clears out a previously allocatedvoid acxmem_l_dealloc_tx(tx_t *tx_opaque); ++ transmit descriptor. The ACX ++** can get confused if we skip transmit descriptors in the queue, ++** so when we don't need a descriptor return it to its original ++** state and move the queue head pointer back. ++** ++*/ ++void ++acxmem_l_dealloc_tx(acx_device_t *adev, tx_t *tx_opaque) ++{ ++ /* ++ * txdesc is the address of the descriptor on the ACX. ++ */ ++ txdesc_t *txdesc = (txdesc_t*)tx_opaque; ++ txdesc_t tmptxdesc; ++ int index; ++ ++ memset (&tmptxdesc, 0, sizeof(tmptxdesc)); ++ tmptxdesc.Ctl_8 = DESC_CTL_HOSTOWN | DESC_CTL_FIRSTFRAG; ++ tmptxdesc.u.r1.rate = 0x0a; ++ ++ /* ++ * Clear out all of the transmit descriptor except for the next pointer ++ */ ++ copy_to_slavemem (adev, (u32) &(txdesc->HostMemPtr), ++ (u8 *) &(tmptxdesc.HostMemPtr), ++ sizeof (tmptxdesc) - sizeof(tmptxdesc.pNextDesc)); ++ ++ /* ++ * This is only called immediately after we've allocated, so we should ++ * be able to set the head back to this descriptor. ++ */ ++ index = ((u8*) txdesc - (u8*)adev->txdesc_start) / adev->txdesc_size; ++ printk ("acx_dealloc: moving head from %d to %d\n", adev->tx_head, index); ++ adev->tx_head = index; ++} ++ ++ ++/*********************************************************************** ++*/ ++void* ++acxmem_l_get_txbuf(acx_device_t *adev, tx_t* tx_opaque) ++{ ++ return get_txhostdesc(adev, (txdesc_t*)tx_opaque)->data; ++} ++ ++ ++/*********************************************************************** ++** acxmem_l_tx_data ++** ++** Can be called from IRQ (rx -> (AP bridging or mgmt response) -> tx). ++** Can be called from acx_i_start_xmit (data frames from net core). ++** ++** FIXME: in case of fragments, should loop over the number of ++** pre-allocated tx descrs, properly setting up transfer data and ++** CTL_xxx flags according to fragment number. ++*/ ++void ++acxmem_update_queue_indicator (acx_device_t *adev, int txqueue) ++{ ++#ifdef USING_MORE_THAN_ONE_TRANSMIT_QUEUE ++ u32 indicator; ++ unsigned long flags; ++ int count; ++ ++ /* ++ * Can't handle an interrupt while we're fiddling with the ACX's lock, ++ * according to TI. The ACX is supposed to hold fw_lock for at most ++ * 500ns. ++ */ ++ local_irq_save (flags); ++ ++ /* ++ * Wait for ACX to release the lock (at most 500ns). ++ */ ++ count = 0; ++ while (read_slavemem16 (adev, (u32) &(adev->acx_queue_indicator->fw_lock)) ++ && (count++ < 50)) { ++ ndelay (10); ++ } ++ if (count < 50) { ++ ++ /* ++ * Take out the host lock - anything non-zero will work, so don't worry about ++ * be/le ++ */ ++ write_slavemem16 (adev, (u32) &(adev->acx_queue_indicator->host_lock), 1); ++ ++ /* ++ * Avoid a race condition ++ */ ++ count = 0; ++ while (read_slavemem16 (adev, (u32) &(adev->acx_queue_indicator->fw_lock)) ++ && (count++ < 50)) { ++ ndelay (10); ++ } ++ ++ if (count < 50) { ++ /* ++ * Mark the queue active ++ */ ++ indicator = read_slavemem32 (adev, (u32) &(adev->acx_queue_indicator->indicator)); ++ indicator |= cpu_to_le32 (1 << txqueue); ++ write_slavemem32 (adev, (u32) &(adev->acx_queue_indicator->indicator), indicator); ++ } ++ ++ /* ++ * Release the host lock ++ */ ++ write_slavemem16 (adev, (u32) &(adev->acx_queue_indicator->host_lock), 0); ++ ++ } ++ ++ /* ++ * Restore interrupts ++ */ ++ local_irq_restore (flags); ++#endif ++} ++ ++void ++acxmem_l_tx_data(acx_device_t *adev, tx_t* tx_opaque, int len) ++{ ++ /* ++ * txdesc is the address on the ACX ++ */ ++ txdesc_t *txdesc = (txdesc_t*)tx_opaque; ++ txhostdesc_t *hostdesc1, *hostdesc2; ++ client_t *clt; ++ u16 rate_cur; ++ u8 Ctl_8, Ctl2_8; ++ u32 addr; ++ ++ FN_ENTER; ++ /* fw doesn't tx such packets anyhow */ ++ if (unlikely(len < WLAN_HDR_A3_LEN)) ++ goto end; ++ ++ hostdesc1 = get_txhostdesc(adev, txdesc); ++ /* modify flag status in separate variable to be able to write it back ++ * in one big swoop later (also in order to have less device memory ++ * accesses) */ ++ Ctl_8 = read_slavemem8 (adev, (u32) &(txdesc->Ctl_8)); ++ Ctl2_8 = 0; /* really need to init it to 0, not txdesc->Ctl2_8, it seems */ ++ ++ hostdesc2 = hostdesc1 + 1; ++ ++ /* DON'T simply set Ctl field to 0 here globally, ++ * it needs to maintain a consistent flag status (those are state flags!!), ++ * otherwise it may lead to severe disruption. Only set or reset particular ++ * flags at the exact moment this is needed... */ ++ ++ /* let chip do RTS/CTS handshaking before sending ++ * in case packet size exceeds threshold */ ++ if (len > adev->rts_threshold) ++ SET_BIT(Ctl2_8, DESC_CTL2_RTS); ++ else ++ CLEAR_BIT(Ctl2_8, DESC_CTL2_RTS); ++ ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_3_AP: ++ clt = acx_l_sta_list_get(adev, ((wlan_hdr_t*)hostdesc1->data)->a1); ++ break; ++ case ACX_MODE_2_STA: ++ clt = adev->ap_client; ++ break; ++#if 0 ++/* testing was done on acx111: */ ++ case ACX_MODE_MONITOR: ++ SET_BIT(Ctl2_8, 0 ++/* sends CTS to self before packet */ ++ + DESC_CTL2_SEQ /* don't increase sequence field */ ++/* not working (looks like good fcs is still added) */ ++ + DESC_CTL2_FCS /* don't add the FCS */ ++/* not tested */ ++ + DESC_CTL2_MORE_FRAG ++/* not tested */ ++ + DESC_CTL2_RETRY /* don't increase retry field */ ++/* not tested */ ++ + DESC_CTL2_POWER /* don't increase power mgmt. field */ ++/* no effect */ ++ + DESC_CTL2_WEP /* encrypt this frame */ ++/* not tested */ ++ + DESC_CTL2_DUR /* don't increase duration field */ ++ ); ++ /* fallthrough */ ++#endif ++ default: /* ACX_MODE_OFF, ACX_MODE_MONITOR */ ++ clt = NULL; ++ break; ++ } ++ ++ rate_cur = clt ? clt->rate_cur : adev->rate_bcast; ++ if (unlikely(!rate_cur)) { ++ printk("acx: driver bug! bad ratemask\n"); ++ goto end; ++ } ++ ++ /* used in tx cleanup routine for auto rate and accounting: */ ++ put_txcr(adev, txdesc, clt, rate_cur); ++ ++ write_slavemem16 (adev, (u32) &(txdesc->total_length), cpu_to_le16(len)); ++ hostdesc2->length = cpu_to_le16(len - WLAN_HDR_A3_LEN); ++ if (IS_ACX111(adev)) { ++ /* note that if !txdesc->do_auto, txrate->cur ++ ** has only one nonzero bit */ ++ txdesc->u.r2.rate111 = cpu_to_le16( ++ rate_cur ++ /* WARNING: I was never able to make it work with prism54 AP. ++ ** It was falling down to 1Mbit where shortpre is not applicable, ++ ** and not working at all at "5,11 basic rates only" setting. ++ ** I even didn't see tx packets in radio packet capture. ++ ** Disabled for now --vda */ ++ /*| ((clt->shortpre && clt->cur!=RATE111_1) ? RATE111_SHORTPRE : 0) */ ++ ); ++#ifdef TODO_FIGURE_OUT_WHEN_TO_SET_THIS ++ /* should add this to rate111 above as necessary */ ++ | (clt->pbcc511 ? RATE111_PBCC511 : 0) ++#endif ++ hostdesc1->length = cpu_to_le16(len); ++ } else { /* ACX100 */ ++ u8 rate_100 = clt ? clt->rate_100 : adev->rate_bcast100; ++ write_slavemem8 (adev, (u32) &(txdesc->u.r1.rate), rate_100); ++#ifdef TODO_FIGURE_OUT_WHEN_TO_SET_THIS ++ if (clt->pbcc511) { ++ if (n == RATE100_5 || n == RATE100_11) ++ n |= RATE100_PBCC511; ++ } ++ ++ if (clt->shortpre && (clt->cur != RATE111_1)) ++ SET_BIT(Ctl_8, DESC_CTL_SHORT_PREAMBLE); /* set Short Preamble */ ++#endif ++ /* set autodma and reclaim and 1st mpdu */ ++ SET_BIT(Ctl_8, DESC_CTL_FIRSTFRAG); ++ ++#if ACX_FRAGMENTATION ++ /* SET_BIT(Ctl2_8, DESC_CTL2_MORE_FRAG); cannot set it unconditionally, needs to be set for all non-last fragments */ ++#endif ++ hostdesc1->length = cpu_to_le16(WLAN_HDR_A3_LEN); ++ ++ /* ++ * Since we're not using autodma copy the packet data to the acx now. ++ * Even host descriptors point to the packet header, and the odd indexed ++ * descriptor following points to the packet data. ++ * ++ * The first step is to find free memory in the ACX transmit buffers. ++ * They don't necessarily map one to one with the transmit queue entries, ++ * so search through them starting just after the last one used. ++ */ ++ addr = allocate_acx_txbuf_space (adev, len); ++ if (addr) { ++ chaincopy_to_slavemem (adev, addr, hostdesc1->data, len); ++ } ++ else { ++ /* ++ * Bummer. We thought we might have enough room in the transmit ++ * buffers to send this packet, but it turns out we don't. alloc_tx ++ * has already marked this transmit descriptor as HOSTOWN and ACXDONE, ++ * which means the ACX will hang when it gets to this descriptor unless ++ * we do something about it. Having a bubble in the transmit queue just ++ * doesn't seem to work, so we have to reset this transmit queue entry's ++ * state to its original value and back up our head pointer to point ++ * back to this entry. ++ */ ++ hostdesc1->length = 0; ++ hostdesc2->length = 0; ++ write_slavemem16 (adev, (u32) &(txdesc->total_length), 0); ++ write_slavemem8 (adev, (u32) &(txdesc->Ctl_8), DESC_CTL_HOSTOWN | DESC_CTL_FIRSTFRAG); ++ adev->tx_head = ((u8*) txdesc - (u8*) adev->txdesc_start) / adev->txdesc_size; ++ goto end; ++ } ++ /* ++ * Tell the ACX where the packet is. ++ */ ++ write_slavemem32 (adev, (u32) &(txdesc->AcxMemPtr), addr); ++ ++ } ++ /* don't need to clean ack/rts statistics here, already ++ * done on descr cleanup */ ++ ++ /* clears HOSTOWN and ACXDONE bits, thus telling that the descriptors ++ * are now owned by the acx100; do this as LAST operation */ ++ CLEAR_BIT(Ctl_8, DESC_CTL_ACXDONE_HOSTOWN); ++ /* flush writes before we release hostdesc to the adapter here */ ++ //wmb(); ++ ++ /* write back modified flags */ ++ /* ++ * At this point Ctl_8 should just be FIRSTFRAG ++ */ ++ write_slavemem8 (adev, (u32) &(txdesc->Ctl2_8),Ctl2_8); ++ write_slavemem8 (adev, (u32) &(txdesc->Ctl_8), Ctl_8); ++ /* unused: txdesc->tx_time = cpu_to_le32(jiffies); */ ++ ++ /* ++ * Update the queue indicator to say there's data on the first queue. ++ */ ++ acxmem_update_queue_indicator (adev, 0); ++ ++ /* flush writes before we tell the adapter that it's its turn now */ ++ mmiowb(); ++ write_reg16(adev, IO_ACX_INT_TRIG, INT_TRIG_TXPRC); ++ write_flush(adev); ++ ++ /* log the packet content AFTER sending it, ++ * in order to not delay sending any further than absolutely needed ++ * Do separate logs for acx100/111 to have human-readable rates */ ++ if (unlikely(acx_debug & (L_XFER|L_DATA))) { ++ u16 fc = ((wlan_hdr_t*)hostdesc1->data)->fc; ++ if (IS_ACX111(adev)) ++ printk("tx: pkt (%s): len %d " ++ "rate %04X%s status %u\n", ++ acx_get_packet_type_string(le16_to_cpu(fc)), len, ++ le16_to_cpu(txdesc->u.r2.rate111), ++ (le16_to_cpu(txdesc->u.r2.rate111) & RATE111_SHORTPRE) ? "(SPr)" : "", ++ adev->status); ++ else ++ printk("tx: pkt (%s): len %d rate %03u%s status %u\n", ++ acx_get_packet_type_string(fc), len, ++ read_slavemem8 (adev, (u32) &(txdesc->u.r1.rate)), ++ (Ctl_8 & DESC_CTL_SHORT_PREAMBLE) ? "(SPr)" : "", ++ adev->status); ++ ++ if (acx_debug & L_DATA) { ++ printk("tx: 802.11 [%d]: ", len); ++ acx_dump_bytes(hostdesc1->data, len); ++ } ++ } ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_l_clean_txdesc ++** ++** This function resets the txdescs' status when the ACX100 ++** signals the TX done IRQ (txdescs have been processed), starting with ++** the pool index of the descriptor which we would use next, ++** in order to make sure that we can be as fast as possible ++** in filling new txdescs. ++** Everytime we get called we know where the next packet to be cleaned is. ++*/ ++ ++#if !ACX_DEBUG ++static inline void log_txbuffer(const acx_device_t *adev) {} ++#else ++static void ++log_txbuffer(acx_device_t *adev) ++{ ++ txdesc_t *txdesc; ++ int i; ++ u8 Ctl_8; ++ ++ /* no FN_ENTER here, we don't want that */ ++ /* no locks here, since it's entirely non-critical code */ ++ txdesc = adev->txdesc_start; ++ if (unlikely(!txdesc)) return; ++ printk("tx: desc->Ctl8's:"); ++ for (i = 0; i < TX_CNT; i++) { ++ Ctl_8 = read_slavemem8 (adev, (u32) &(txdesc->Ctl_8)); ++ printk(" %02X", Ctl_8); ++ txdesc = advance_txdesc(adev, txdesc, 1); ++ } ++ printk("\n"); ++} ++#endif ++ ++ ++static void ++handle_tx_error(acx_device_t *adev, u8 error, unsigned int finger) ++{ ++ const char *err = "unknown error"; ++ ++ /* hmm, should we handle this as a mask ++ * of *several* bits? ++ * For now I think only caring about ++ * individual bits is ok... */ ++ switch (error) { ++ case 0x01: ++ err = "no Tx due to error in other fragment"; ++ adev->wstats.discard.fragment++; ++ break; ++ case 0x02: ++ err = "Tx aborted"; ++ adev->stats.tx_aborted_errors++; ++ break; ++ case 0x04: ++ err = "Tx desc wrong parameters"; ++ adev->wstats.discard.misc++; ++ break; ++ case 0x08: ++ err = "WEP key not found"; ++ adev->wstats.discard.misc++; ++ break; ++ case 0x10: ++ err = "MSDU lifetime timeout? - try changing " ++ "'iwconfig retry lifetime XXX'"; ++ adev->wstats.discard.misc++; ++ break; ++ case 0x20: ++ err = "excessive Tx retries due to either distance " ++ "too high or unable to Tx or Tx frame error - " ++ "try changing 'iwconfig txpower XXX' or " ++ "'sens'itivity or 'retry'"; ++ adev->wstats.discard.retries++; ++ /* Tx error 0x20 also seems to occur on ++ * overheating, so I'm not sure whether we ++ * actually want to do aggressive radio recalibration, ++ * since people maybe won't notice then that their hardware ++ * is slowly getting cooked... ++ * Or is it still a safe long distance from utter ++ * radio non-functionality despite many radio recalibs ++ * to final destructive overheating of the hardware? ++ * In this case we really should do recalib here... ++ * I guess the only way to find out is to do a ++ * potentially fatal self-experiment :-\ ++ * Or maybe only recalib in case we're using Tx ++ * rate auto (on errors switching to lower speed ++ * --> less heat?) or 802.11 power save mode? ++ * ++ * ok, just do it. */ ++ if (++adev->retry_errors_msg_ratelimit % 4 == 0) { ++ if (adev->retry_errors_msg_ratelimit <= 20) { ++ printk("%s: several excessive Tx " ++ "retry errors occurred, attempting " ++ "to recalibrate radio. Radio " ++ "drift might be caused by increasing " ++ "card temperature, please check the card " ++ "before it's too late!\n", ++ adev->ndev->name); ++ if (adev->retry_errors_msg_ratelimit == 20) ++ printk("disabling above message\n"); ++ } ++ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_CMD_RADIO_RECALIB); ++ } ++ break; ++ case 0x40: ++ err = "Tx buffer overflow"; ++ adev->stats.tx_fifo_errors++; ++ break; ++ case 0x80: ++ err = "DMA error"; ++ adev->wstats.discard.misc++; ++ break; ++ } ++ adev->stats.tx_errors++; ++ if (adev->stats.tx_errors <= 20) ++ printk("%s: tx error 0x%02X, buf %02u! (%s)\n", ++ adev->ndev->name, error, finger, err); ++ else ++ printk("%s: tx error 0x%02X, buf %02u!\n", ++ adev->ndev->name, error, finger); ++} ++ ++ ++unsigned int ++acxmem_l_clean_txdesc(acx_device_t *adev) ++{ ++ txdesc_t *txdesc; ++ unsigned finger; ++ int num_cleaned; ++ u16 r111; ++ u8 error, ack_failures, rts_failures, rts_ok, r100, Ctl_8; ++ u32 acxmem; ++ txdesc_t tmptxdesc; ++ ++ FN_ENTER; ++ ++ /* ++ * Set up a template descriptor for re-initialization. The only ++ * things that get set are Ctl_8 and the rate, and the rate defaults ++ * to 1Mbps. ++ */ ++ memset (&tmptxdesc, 0, sizeof (tmptxdesc)); ++ tmptxdesc.Ctl_8 = DESC_CTL_HOSTOWN | DESC_CTL_FIRSTFRAG; ++ tmptxdesc.u.r1.rate = 0x0a; ++ ++ if (unlikely(acx_debug & L_DEBUG)) ++ log_txbuffer(adev); ++ ++ log(L_BUFT, "tx: cleaning up bufs from %u\n", adev->tx_tail); ++ ++ /* We know first descr which is not free yet. We advance it as far ++ ** as we see correct bits set in following descs (if next desc ++ ** is NOT free, we shouldn't advance at all). We know that in ++ ** front of tx_tail may be "holes" with isolated free descs. ++ ** We will catch up when all intermediate descs will be freed also */ ++ ++ finger = adev->tx_tail; ++ num_cleaned = 0; ++ while (likely(finger != adev->tx_head)) { ++ txdesc = get_txdesc(adev, finger); ++ ++ /* If we allocated txdesc on tx path but then decided ++ ** to NOT use it, then it will be left as a free "bubble" ++ ** in the "allocated for tx" part of the ring. ++ ** We may meet it on the next ring pass here. */ ++ ++ /* stop if not marked as "tx finished" and "host owned" */ ++ Ctl_8 = read_slavemem8 (adev, (u32) &(txdesc->Ctl_8)); ++ if ((Ctl_8 & DESC_CTL_ACXDONE_HOSTOWN) ++ != DESC_CTL_ACXDONE_HOSTOWN) { ++ if (unlikely(!num_cleaned)) { /* maybe remove completely */ ++ log(L_BUFT, "clean_txdesc: tail isn't free. " ++ "tail:%d head:%d\n", ++ adev->tx_tail, adev->tx_head); ++ } ++ break; ++ } ++ ++ /* remember desc values... */ ++ error = read_slavemem8 (adev, (u32) &(txdesc->error)); ++ ack_failures = read_slavemem8 (adev, (u32) &(txdesc->ack_failures)); ++ rts_failures = read_slavemem8 (adev, (u32) &(txdesc->u.rts.rts_failures)); ++ rts_ok = read_slavemem8 (adev, (u32) &(txdesc->u.rts.rts_ok)); ++ r100 = read_slavemem8 (adev, (u32) &(txdesc->u.r1.rate)); ++ r111 = le16_to_cpu(read_slavemem16 (adev, (u32) &(txdesc->u.r2.rate111))); ++ ++ /* need to check for certain error conditions before we ++ * clean the descriptor: we still need valid descr data here */ ++ if (unlikely(0x30 & error)) { ++ /* only send IWEVTXDROP in case of retry or lifetime exceeded; ++ * all other errors mean we screwed up locally */ ++ union iwreq_data wrqu; ++ wlan_hdr_t *hdr; ++ txhostdesc_t *hostdesc; ++ ++ hostdesc = get_txhostdesc(adev, txdesc); ++ hdr = (wlan_hdr_t *)hostdesc->data; ++ MAC_COPY(wrqu.addr.sa_data, hdr->a1); ++ wireless_send_event(adev->ndev, IWEVTXDROP, &wrqu, NULL); ++ } ++ ++ /* ++ * Free up the transmit data buffers ++ */ ++ acxmem = read_slavemem32 (adev, (u32) &(txdesc->AcxMemPtr)); ++ if (acxmem) { ++ reclaim_acx_txbuf_space (adev, acxmem); ++ } ++ ++ /* ...and free the desc by clearing all the fields ++ except the next pointer */ ++ copy_to_slavemem (adev, ++ (u32) &(txdesc->HostMemPtr), ++ (u8 *) &(tmptxdesc.HostMemPtr), ++ sizeof (tmptxdesc) - sizeof(tmptxdesc.pNextDesc) ++ ); ++ ++ adev->tx_free++; ++ num_cleaned++; ++ ++ if ((adev->tx_free >= TX_START_QUEUE) ++ && (adev->status == ACX_STATUS_4_ASSOCIATED) ++ && (acx_queue_stopped(adev->ndev)) ++ ) { ++ log(L_BUF, "tx: wake queue (avail. Tx desc %u)\n", ++ adev->tx_free); ++ acx_wake_queue(adev->ndev, NULL); ++ } ++ ++ /* do error checking, rate handling and logging ++ * AFTER having done the work, it's faster */ ++ ++ /* do rate handling */ ++ if (adev->rate_auto) { ++ struct client *clt = get_txc(adev, txdesc); ++ if (clt) { ++ u16 cur = get_txr(adev, txdesc); ++ if (clt->rate_cur == cur) { ++ acx_l_handle_txrate_auto(adev, clt, ++ cur, /* intended rate */ ++ r100, r111, /* actually used rate */ ++ (error & 0x30), /* was there an error? */ ++ TX_CNT + TX_CLEAN_BACKLOG - adev->tx_free); ++ } ++ } ++ } ++ ++ if (unlikely(error)) ++ handle_tx_error(adev, error, finger); ++ ++ if (IS_ACX111(adev)) ++ log(L_BUFT, "tx: cleaned %u: !ACK=%u !RTS=%u RTS=%u r111=%04X\n", ++ finger, ack_failures, rts_failures, rts_ok, r111); ++ else ++ log(L_BUFT, "tx: cleaned %u: !ACK=%u !RTS=%u RTS=%u rate=%u\n", ++ finger, ack_failures, rts_failures, rts_ok, r100); ++ ++ /* update pointer for descr to be cleaned next */ ++ finger = (finger + 1) % TX_CNT; ++ } ++ ++ /* remember last position */ ++ adev->tx_tail = finger; ++/* end: */ ++ FN_EXIT1(num_cleaned); ++ return num_cleaned; ++} ++ ++/* clean *all* Tx descriptors, and regardless of their previous state. ++ * Used for brute-force reset handling. */ ++void ++acxmem_l_clean_txdesc_emergency(acx_device_t *adev) ++{ ++ txdesc_t *txdesc; ++ int i; ++ u32 acxmem; ++ ++ FN_ENTER; ++ ++ for (i = 0; i < TX_CNT; i++) { ++ txdesc = get_txdesc(adev, i); ++ ++ /* free it */ ++ write_slavemem8 (adev, (u32) &(txdesc->ack_failures), 0); ++ write_slavemem8 (adev, (u32) &(txdesc->u.rts.rts_failures), 0); ++ write_slavemem8 (adev, (u32) &(txdesc->u.rts.rts_ok), 0); ++ write_slavemem8 (adev, (u32) &(txdesc->error), 0); ++ write_slavemem8 (adev, (u32) &(txdesc->Ctl_8), DESC_CTL_HOSTOWN); ++ ++ /* ++ * Clean up the memory allocated on the ACX for this transmit descriptor. ++ */ ++ acxmem = read_slavemem32 (adev, (u32) &(txdesc->AcxMemPtr)); ++ if (acxmem) { ++ reclaim_acx_txbuf_space (adev, acxmem); ++ } ++ ++ write_slavemem32 (adev, (u32) &(txdesc->AcxMemPtr), 0); ++ } ++ ++ adev->tx_free = TX_CNT; ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_create_tx_host_desc_queue ++*/ ++ ++static void* ++allocate(acx_device_t *adev, size_t size, dma_addr_t *phy, const char *msg) ++{ ++ void *ptr; ++ ptr = kmalloc (size, GFP_KERNEL); ++ /* ++ * The ACX can't use the physical address, so we'll have to fake it ++ * later and it might be handy to have the virtual address. ++ */ ++ *phy = (dma_addr_t) NULL; ++ ++ if (ptr) { ++ log(L_DEBUG, "%s sz=%d adr=0x%p phy=0x%08llx\n", ++ msg, (int)size, ptr, (unsigned long long)*phy); ++ memset(ptr, 0, size); ++ return ptr; ++ } ++ printk(KERN_ERR "acx: %s allocation FAILED (%d bytes)\n", ++ msg, (int)size); ++ return NULL; ++} ++ ++ ++/* ++ * In the generic slave memory access mode, most of the stuff in ++ * the txhostdesc_t is unused. It's only here because the rest of ++ * the ACX driver expects it to be since the PCI version uses indirect ++ * host memory organization with DMA. Since we're not using DMA the ++ * only use we have for the host descriptors is to store the packets ++ * on the way out. ++ */ ++static int ++acxmem_s_create_tx_host_desc_queue(acx_device_t *adev) ++{ ++ txhostdesc_t *hostdesc; ++ u8 *txbuf; ++ int i; ++ ++ FN_ENTER; ++ ++ /* allocate TX buffer */ ++ adev->txbuf_area_size = TX_CNT * WLAN_A4FR_MAXLEN_WEP_FCS; ++ ++ adev->txbuf_start = allocate(adev, adev->txbuf_area_size, ++ &adev->txbuf_startphy, "txbuf_start"); ++ if (!adev->txbuf_start) ++ goto fail; ++ ++ /* allocate the TX host descriptor queue pool */ ++ adev->txhostdesc_area_size = TX_CNT * 2*sizeof(*hostdesc); ++ ++ adev->txhostdesc_start = allocate(adev, adev->txhostdesc_area_size, ++ &adev->txhostdesc_startphy, "txhostdesc_start"); ++ if (!adev->txhostdesc_start) ++ goto fail; ++ ++ /* check for proper alignment of TX host descriptor pool */ ++ if ((long) adev->txhostdesc_start & 3) { ++ printk("acx: driver bug: dma alloc returns unaligned address\n"); ++ goto fail; ++ } ++ ++ hostdesc = adev->txhostdesc_start; ++ txbuf = adev->txbuf_start; ++ ++#if 0 ++/* Each tx buffer is accessed by hardware via ++** txdesc -> txhostdesc(s) -> txbuffer(s). ++** We use only one txhostdesc per txdesc, but it looks like ++** acx111 is buggy: it accesses second txhostdesc ++** (via hostdesc.desc_phy_next field) even if ++** txdesc->length == hostdesc->length and thus ++** entire packet was placed into first txhostdesc. ++** Due to this bug acx111 hangs unless second txhostdesc ++** has le16_to_cpu(hostdesc.length) = 3 (or larger) ++** Storing NULL into hostdesc.desc_phy_next ++** doesn't seem to help. ++** ++** Update: although it worked on Xterasys XN-2522g ++** with len=3 trick, WG311v2 is even more bogus, doesn't work. ++** Keeping this code (#ifdef'ed out) for documentational purposes. ++*/ ++ for (i = 0; i < TX_CNT*2; i++) { ++ hostdesc_phy += sizeof(*hostdesc); ++ if (!(i & 1)) { ++ hostdesc->data_phy = cpu2acx(txbuf_phy); ++ /* hostdesc->data_offset = ... */ ++ /* hostdesc->reserved = ... */ ++ hostdesc->Ctl_16 = cpu_to_le16(DESC_CTL_HOSTOWN); ++ /* hostdesc->length = ... */ ++ hostdesc->desc_phy_next = cpu2acx(hostdesc_phy); ++ hostdesc->pNext = ptr2acx(NULL); ++ /* hostdesc->Status = ... */ ++ /* below: non-hardware fields */ ++ hostdesc->data = txbuf; ++ ++ txbuf += WLAN_A4FR_MAXLEN_WEP_FCS; ++ txbuf_phy += WLAN_A4FR_MAXLEN_WEP_FCS; ++ } else { ++ /* hostdesc->data_phy = ... */ ++ /* hostdesc->data_offset = ... */ ++ /* hostdesc->reserved = ... */ ++ /* hostdesc->Ctl_16 = ... */ ++ hostdesc->length = cpu_to_le16(3); /* bug workaround */ ++ /* hostdesc->desc_phy_next = ... */ ++ /* hostdesc->pNext = ... */ ++ /* hostdesc->Status = ... */ ++ /* below: non-hardware fields */ ++ /* hostdesc->data = ... */ ++ } ++ hostdesc++; ++ } ++#endif ++/* We initialize two hostdescs so that they point to adjacent ++** memory areas. Thus txbuf is really just a contiguous memory area */ ++ for (i = 0; i < TX_CNT*2; i++) { ++ /* ->data is a non-hardware field: */ ++ hostdesc->data = txbuf; ++ ++ if (!(i & 1)) { ++ txbuf += WLAN_HDR_A3_LEN; ++ } else { ++ txbuf += WLAN_A4FR_MAXLEN_WEP_FCS - WLAN_HDR_A3_LEN; ++ } ++ hostdesc++; ++ } ++ hostdesc--; ++ ++ FN_EXIT1(OK); ++ return OK; ++fail: ++ printk("acx: create_tx_host_desc_queue FAILED\n"); ++ /* dealloc will be done by free function on error case */ ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*************************************************************** ++** acxmem_s_create_rx_host_desc_queue ++*/ ++/* the whole size of a data buffer (header plus data body) ++ * plus 32 bytes safety offset at the end */ ++#define RX_BUFFER_SIZE (sizeof(rxbuffer_t) + 32) ++ ++static int ++acxmem_s_create_rx_host_desc_queue(acx_device_t *adev) ++{ ++ rxhostdesc_t *hostdesc; ++ rxbuffer_t *rxbuf; ++ int i; ++ ++ FN_ENTER; ++ ++ /* allocate the RX host descriptor queue pool */ ++ adev->rxhostdesc_area_size = RX_CNT * sizeof(*hostdesc); ++ ++ adev->rxhostdesc_start = allocate(adev, adev->rxhostdesc_area_size, ++ &adev->rxhostdesc_startphy, "rxhostdesc_start"); ++ if (!adev->rxhostdesc_start) ++ goto fail; ++ ++ /* check for proper alignment of RX host descriptor pool */ ++ if ((long) adev->rxhostdesc_start & 3) { ++ printk("acx: driver bug: dma alloc returns unaligned address\n"); ++ goto fail; ++ } ++ ++ /* allocate Rx buffer pool which will be used by the acx ++ * to store the whole content of the received frames in it */ ++ adev->rxbuf_area_size = RX_CNT * RX_BUFFER_SIZE; ++ ++ adev->rxbuf_start = allocate(adev, adev->rxbuf_area_size, ++ &adev->rxbuf_startphy, "rxbuf_start"); ++ if (!adev->rxbuf_start) ++ goto fail; ++ ++ rxbuf = adev->rxbuf_start; ++ hostdesc = adev->rxhostdesc_start; ++ ++ /* don't make any popular C programming pointer arithmetic mistakes ++ * here, otherwise I'll kill you... ++ * (and don't dare asking me why I'm warning you about that...) */ ++ for (i = 0; i < RX_CNT; i++) { ++ hostdesc->data = rxbuf; ++ hostdesc->length = cpu_to_le16(RX_BUFFER_SIZE); ++ rxbuf++; ++ hostdesc++; ++ } ++ hostdesc--; ++ FN_EXIT1(OK); ++ return OK; ++fail: ++ printk("acx: create_rx_host_desc_queue FAILED\n"); ++ /* dealloc will be done by free function on error case */ ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*************************************************************** ++** acxmem_s_create_hostdesc_queues ++*/ ++int ++acxmem_s_create_hostdesc_queues(acx_device_t *adev) ++{ ++ int result; ++ result = acxmem_s_create_tx_host_desc_queue(adev); ++ if (OK != result) return result; ++ result = acxmem_s_create_rx_host_desc_queue(adev); ++ return result; ++} ++ ++ ++/*************************************************************** ++** acxmem_create_tx_desc_queue ++*/ ++static void ++acxmem_create_tx_desc_queue(acx_device_t *adev, u32 tx_queue_start) ++{ ++ txdesc_t *txdesc; ++ u32 clr; ++ int i; ++ ++ FN_ENTER; ++ ++ if (IS_ACX100(adev)) ++ adev->txdesc_size = sizeof(*txdesc); ++ else ++ /* the acx111 txdesc is 4 bytes larger */ ++ adev->txdesc_size = sizeof(*txdesc) + 4; ++ ++ /* ++ * This refers to an ACX address, not one of ours ++ */ ++ adev->txdesc_start = (txdesc_t *) tx_queue_start; ++ ++ log(L_DEBUG, "adev->txdesc_start=%p\n", ++ adev->txdesc_start); ++ ++ adev->tx_free = TX_CNT; ++ /* done by memset: adev->tx_head = 0; */ ++ /* done by memset: adev->tx_tail = 0; */ ++ txdesc = adev->txdesc_start; ++ ++ if (IS_ACX111(adev)) { ++ /* ACX111 has a preinitialized Tx buffer! */ ++ /* loop over whole send pool */ ++ /* FIXME: do we have to do the hostmemptr stuff here?? */ ++ for (i = 0; i < TX_CNT; i++) { ++ txdesc->Ctl_8 = DESC_CTL_HOSTOWN; ++ /* reserve two (hdr desc and payload desc) */ ++ txdesc = advance_txdesc(adev, txdesc, 1); ++ } ++ } else { ++ /* ACX100 Tx buffer needs to be initialized by us */ ++ /* clear whole send pool. sizeof is safe here (we are acx100) */ ++ ++ /* ++ * adev->txdesc_start refers to device memory, so we can't write ++ * directly to it. ++ */ ++ clr = (u32) adev->txdesc_start; ++ while (clr < (u32) adev->txdesc_start + (TX_CNT * sizeof(*txdesc))) { ++ write_slavemem32 (adev, clr, 0); ++ clr += 4; ++ } ++ ++ /* loop over whole send pool */ ++ for (i = 0; i < TX_CNT; i++) { ++ log(L_DEBUG, "configure card tx descriptor: 0x%p, " ++ "size: 0x%X\n", txdesc, adev->txdesc_size); ++ ++ /* initialise ctl */ ++ /* ++ * No auto DMA here ++ */ ++ write_slavemem8 (adev, (u32) &(txdesc->Ctl_8), ++ (u8) (DESC_CTL_HOSTOWN | DESC_CTL_FIRSTFRAG)); ++ /* done by memset(0): txdesc->Ctl2_8 = 0; */ ++ ++ /* point to next txdesc */ ++ write_slavemem32 (adev, (u32) &(txdesc->pNextDesc), ++ (u32) cpu_to_le32 ((u8 *) txdesc + adev->txdesc_size)); ++ ++ /* go to the next one */ ++ /* ++ is safe here (we are acx100) */ ++ txdesc++; ++ } ++ /* go back to the last one */ ++ txdesc--; ++ /* and point to the first making it a ring buffer */ ++ write_slavemem32 (adev, (u32) &(txdesc->pNextDesc), ++ (u32) cpu_to_le32 (tx_queue_start)); ++ } ++ FN_EXIT0; ++} ++ ++ ++/*************************************************************** ++** acxmem_create_rx_desc_queue ++*/ ++static void ++acxmem_create_rx_desc_queue(acx_device_t *adev, u32 rx_queue_start) ++{ ++ rxdesc_t *rxdesc; ++ u32 mem_offs; ++ int i; ++ ++ FN_ENTER; ++ ++ /* done by memset: adev->rx_tail = 0; */ ++ ++ /* ACX111 doesn't need any further config: preconfigures itself. ++ * Simply print ring buffer for debugging */ ++ if (IS_ACX111(adev)) { ++ /* rxdesc_start already set here */ ++ ++ adev->rxdesc_start = (rxdesc_t *) rx_queue_start; ++ ++ rxdesc = adev->rxdesc_start; ++ for (i = 0; i < RX_CNT; i++) { ++ log(L_DEBUG, "rx descriptor %d @ 0x%p\n", i, rxdesc); ++ rxdesc = adev->rxdesc_start = (rxdesc_t *) ++ acx2cpu(rxdesc->pNextDesc); ++ } ++ } else { ++ /* we didn't pre-calculate rxdesc_start in case of ACX100 */ ++ /* rxdesc_start should be right AFTER Tx pool */ ++ adev->rxdesc_start = (rxdesc_t *) ++ ((u8 *) adev->txdesc_start + (TX_CNT * sizeof(txdesc_t))); ++ /* NB: sizeof(txdesc_t) above is valid because we know ++ ** we are in if (acx100) block. Beware of cut-n-pasting elsewhere! ++ ** acx111's txdesc is larger! */ ++ ++ mem_offs = (u32) adev->rxdesc_start; ++ while (mem_offs < (u32) adev->rxdesc_start + (RX_CNT * sizeof (*rxdesc))) { ++ write_slavemem32 (adev, mem_offs, 0); ++ mem_offs += 4; ++ } ++ ++ /* loop over whole receive pool */ ++ rxdesc = adev->rxdesc_start; ++ for (i = 0; i < RX_CNT; i++) { ++ log(L_DEBUG, "rx descriptor @ 0x%p\n", rxdesc); ++ /* point to next rxdesc */ ++ write_slavemem32 (adev, (u32) &(rxdesc->pNextDesc), ++ (u32) cpu_to_le32 ((u8 *) rxdesc + sizeof(*rxdesc))); ++ /* go to the next one */ ++ rxdesc++; ++ } ++ /* go to the last one */ ++ rxdesc--; ++ ++ /* and point to the first making it a ring buffer */ ++ write_slavemem32 (adev, (u32) &(rxdesc->pNextDesc), ++ (u32) cpu_to_le32 (rx_queue_start)); ++ } ++ FN_EXIT0; ++} ++ ++ ++/*************************************************************** ++** acxmem_create_desc_queues ++*/ ++void ++acxmem_create_desc_queues(acx_device_t *adev, u32 tx_queue_start, u32 rx_queue_start) ++{ ++ u32 *p; ++ int i; ++ ++ acxmem_create_tx_desc_queue(adev, tx_queue_start); ++ acxmem_create_rx_desc_queue(adev, rx_queue_start); ++ p = (u32 *) adev->acx_queue_indicator; ++ for (i = 0; i < 4; i++) { ++ write_slavemem32 (adev, (u32) p, 0); ++ p++; ++ } ++} ++ ++ ++/*************************************************************** ++** acxmem_s_proc_diag_output ++*/ ++char* ++acxmem_s_proc_diag_output(char *p, acx_device_t *adev) ++{ ++ const char *rtl, *thd, *ttl; ++ txdesc_t *txdesc; ++ u8 Ctl_8; ++ rxdesc_t *rxdesc; ++ int i; ++ u32 tmp; ++ txdesc_t txd; ++ u8 buf[0x200]; ++ int j, k; ++ ++ FN_ENTER; ++ ++#if DUMP_MEM_DURING_DIAG > 0 ++ dump_acxmem (adev, 0, 0x10000); ++ panic ("dump finished"); ++#endif ++ ++ p += sprintf(p, "** Rx buf **\n"); ++ rxdesc = adev->rxdesc_start; ++ if (rxdesc) for (i = 0; i < RX_CNT; i++) { ++ rtl = (i == adev->rx_tail) ? " [tail]" : ""; ++ Ctl_8 = read_slavemem8 (adev, (u32) &(rxdesc->Ctl_8)); ++ if (Ctl_8 & DESC_CTL_HOSTOWN) ++ p += sprintf(p, "%02u (%02x) FULL%s\n", i, Ctl_8, rtl); ++ else ++ p += sprintf(p, "%02u (%02x) empty%s\n", i, Ctl_8, rtl); ++ rxdesc++; ++ } ++ p += sprintf(p, "** Tx buf (free %d, Linux netqueue %s) **\n", adev->tx_free, ++ acx_queue_stopped(adev->ndev) ? "STOPPED" : "running"); ++ ++ p += sprintf(p, "** Tx buf %d blocks total, %d available, free list head %04x\n", ++ adev->acx_txbuf_numblocks, adev->acx_txbuf_blocks_free, adev->acx_txbuf_free); ++ txdesc = adev->txdesc_start; ++ if (txdesc) { ++ for (i = 0; i < TX_CNT; i++) { ++ thd = (i == adev->tx_head) ? " [head]" : ""; ++ ttl = (i == adev->tx_tail) ? " [tail]" : ""; ++ copy_from_slavemem (adev, (u8 *) &txd, (u32) txdesc, sizeof (txd)); ++ Ctl_8 = read_slavemem8 (adev, (u32) &(txdesc->Ctl_8)); ++ if (Ctl_8 & DESC_CTL_ACXDONE) ++ p += sprintf(p, "%02u ready to free (%02X)%s%s", i, Ctl_8, thd, ttl); ++ else if (Ctl_8 & DESC_CTL_HOSTOWN) ++ p += sprintf(p, "%02u available (%02X)%s%s", i, Ctl_8, thd, ttl); ++ else ++ p += sprintf(p, "%02u busy (%02X)%s%s", i, Ctl_8, thd, ttl); ++ tmp = read_slavemem32 (adev, (u32) &(txdesc->AcxMemPtr)); ++ if (tmp) { ++ p += sprintf (p, " %04x", tmp); ++ while ((tmp = read_slavemem32 (adev, (u32) tmp)) != 0x02000000) { ++ tmp <<= 5; ++ p += sprintf (p, " %04x", tmp); ++ } ++ } ++ p += sprintf (p, "\n"); ++ p += sprintf (p, " %04x: %04x %04x %04x %04x %04x %04x %04x %04x %04x %04x %02x %02x %02x %02x\n" ++ "%02x %02x %02x %02x %04x\n", ++ (u32) txdesc, ++ txd.pNextDesc.v, txd.HostMemPtr.v, txd.AcxMemPtr.v, txd.tx_time, ++ txd.total_length, txd.Reserved, ++ txd.dummy[0], txd.dummy[1], txd.dummy[2], txd.dummy[3], ++ txd.Ctl_8, txd.Ctl2_8, txd.error, txd.ack_failures, ++ txd.u.rts.rts_failures, txd.u.rts.rts_ok, txd.u.r1.rate, txd.u.r1.queue_ctrl, ++ txd.queue_info ++ ); ++ if (txd.AcxMemPtr.v) { ++ copy_from_slavemem (adev, buf, txd.AcxMemPtr.v, sizeof (buf)); ++ for (j = 0; (j < txd.total_length) && (j<(sizeof(buf)-4)); j+=16) { ++ p += sprintf (p, " "); ++ for (k = 0; (k < 16) && (j+k < txd.total_length); k++) { ++ p += sprintf (p, " %02x", buf[j+k+4]); ++ } ++ p += sprintf (p, "\n"); ++ } ++ } ++ txdesc = advance_txdesc(adev, txdesc, 1); ++ } ++ } ++ ++ p += sprintf(p, ++ "\n" ++ "** Generic slave data **\n" ++ "irq_mask 0x%04x irq_status 0x%04x irq on acx 0x%04x\n" ++ "txbuf_start 0x%p, txbuf_area_size %u\n" ++ "txdesc_size %u, txdesc_start 0x%p\n" ++ "txhostdesc_start 0x%p, txhostdesc_area_size %u\n" ++ "txbuf start 0x%04x, txbuf size %d\n" ++ "rxdesc_start 0x%p\n" ++ "rxhostdesc_start 0x%p, rxhostdesc_area_size %u\n" ++ "rxbuf_start 0x%p, rxbuf_area_size %u\n", ++ adev->irq_mask, adev->irq_status, read_reg32(adev, IO_ACX_IRQ_STATUS_NON_DES), ++ adev->txbuf_start, adev->txbuf_area_size, ++ adev->txdesc_size, adev->txdesc_start, ++ adev->txhostdesc_start, adev->txhostdesc_area_size, ++ adev->acx_txbuf_start, adev->acx_txbuf_numblocks * adev->memblocksize, ++ adev->rxdesc_start, ++ adev->rxhostdesc_start, adev->rxhostdesc_area_size, ++ adev->rxbuf_start, adev->rxbuf_area_size); ++ FN_EXIT0; ++ return p; ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acxmem_proc_eeprom_output(char *buf, acx_device_t *adev) ++{ ++ char *p = buf; ++ int i; ++ ++ FN_ENTER; ++ ++ for (i = 0; i < 0x400; i++) { ++ acxmem_read_eeprom_byte(adev, i, p++); ++ } ++ ++ FN_EXIT1(p - buf); ++ return p - buf; ++} ++ ++ ++/*********************************************************************** ++*/ ++void ++acxmem_set_interrupt_mask(acx_device_t *adev) ++{ ++ if (IS_ACX111(adev)) { ++ adev->irq_mask = (u16) ~(0 ++ | HOST_INT_RX_DATA ++ | HOST_INT_TX_COMPLETE ++ /* | HOST_INT_TX_XFER */ ++ /* | HOST_INT_RX_COMPLETE */ ++ /* | HOST_INT_DTIM */ ++ /* | HOST_INT_BEACON */ ++ /* | HOST_INT_TIMER */ ++ /* | HOST_INT_KEY_NOT_FOUND */ ++ | HOST_INT_IV_ICV_FAILURE ++ | HOST_INT_CMD_COMPLETE ++ | HOST_INT_INFO ++ | HOST_INT_OVERFLOW ++ /* | HOST_INT_PROCESS_ERROR */ ++ | HOST_INT_SCAN_COMPLETE ++ | HOST_INT_FCS_THRESHOLD ++ | HOST_INT_UNKNOWN ++ ); ++ /* Or else acx100 won't signal cmd completion, right? */ ++ adev->irq_mask_off = (u16)~( HOST_INT_CMD_COMPLETE ); /* 0xfdff */ ++ } else { ++ adev->irq_mask = (u16) ~(0 ++ | HOST_INT_RX_DATA ++ | HOST_INT_TX_COMPLETE ++ /* | HOST_INT_TX_XFER */ ++ /* | HOST_INT_RX_COMPLETE */ ++ /* | HOST_INT_DTIM */ ++ /* | HOST_INT_BEACON */ ++ /* | HOST_INT_TIMER */ ++ /* | HOST_INT_KEY_NOT_FOUND */ ++ /* | HOST_INT_IV_ICV_FAILURE */ ++ | HOST_INT_CMD_COMPLETE ++ | HOST_INT_INFO ++ /* | HOST_INT_OVERFLOW */ ++ /* | HOST_INT_PROCESS_ERROR */ ++ | HOST_INT_SCAN_COMPLETE ++ /* | HOST_INT_FCS_THRESHOLD */ ++ /* | HOST_INT_BEACON_MISSED */ ++ ); ++ adev->irq_mask_off = (u16)~( HOST_INT_UNKNOWN ); /* 0x7fff */ ++ } ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acx100mem_s_set_tx_level(acx_device_t *adev, u8 level_dbm) ++{ ++ struct acx111_ie_tx_level tx_level; ++ ++ /* since it can be assumed that at least the Maxim radio has a ++ * maximum power output of 20dBm and since it also can be ++ * assumed that these values drive the DAC responsible for ++ * setting the linear Tx level, I'd guess that these values ++ * should be the corresponding linear values for a dBm value, ++ * in other words: calculate the values from that formula: ++ * Y [dBm] = 10 * log (X [mW]) ++ * then scale the 0..63 value range onto the 1..100mW range (0..20 dBm) ++ * and you're done... ++ * Hopefully that's ok, but you never know if we're actually ++ * right... (especially since Windows XP doesn't seem to show ++ * actual Tx dBm values :-P) */ ++ ++ /* NOTE: on Maxim, value 30 IS 30mW, and value 10 IS 10mW - so the ++ * values are EXACTLY mW!!! Not sure about RFMD and others, ++ * though... */ ++ static const u8 dbm2val_maxim[21] = { ++ 63, 63, 63, 62, ++ 61, 61, 60, 60, ++ 59, 58, 57, 55, ++ 53, 50, 47, 43, ++ 38, 31, 23, 13, ++ 0 ++ }; ++ static const u8 dbm2val_rfmd[21] = { ++ 0, 0, 0, 1, ++ 2, 2, 3, 3, ++ 4, 5, 6, 8, ++ 10, 13, 16, 20, ++ 25, 32, 41, 50, ++ 63 ++ }; ++ const u8 *table; ++ ++ switch (adev->radio_type) { ++ case RADIO_MAXIM_0D: ++ table = &dbm2val_maxim[0]; ++ break; ++ case RADIO_RFMD_11: ++ case RADIO_RALINK_15: ++ table = &dbm2val_rfmd[0]; ++ break; ++ default: ++ printk("%s: unknown/unsupported radio type, " ++ "cannot modify tx power level yet!\n", ++ adev->ndev->name); ++ return NOT_OK; ++ } ++ /* ++ * The hx4700 EEPROM, at least, only supports 1 power setting. The configure ++ * routine matches the PA bias with the gain, so just use its default value. ++ * The values are: 0x2b for the gain and 0x03 for the PA bias. The firmware ++ * writes the gain level to the Tx gain control DAC and the PA bias to the Maxim ++ * radio's PA bias register. The firmware limits itself to 0 - 64 when writing to the ++ * gain control DAC. ++ * ++ * Physically between the ACX and the radio, higher Tx gain control DAC values result ++ * in less power output; 0 volts to the Maxim radio results in the highest output power ++ * level, which I'm assuming matches up with 0 in the Tx Gain DAC register. ++ * ++ * Although there is only the 1 power setting, one of the radio firmware functions adjusts ++ * the transmit power level up and down. That function is called by the ACX FIQ handler ++ * under certain conditions. ++ */ ++ tx_level.level = 1; ++ //return acx_s_configure(adev, &tx_level, ACX1xx_IE_DOT11_TX_POWER_LEVEL); ++ ++ printk("%s: changing radio power level to %u dBm (%u)\n", ++ adev->ndev->name, level_dbm, table[level_dbm]); ++ acxmem_s_write_phy_reg(adev, 0x11, table[level_dbm]); ++ ++ return 0; ++} ++ ++void acxmem_e_release(struct device *dev) { ++} ++ ++/*********************************************************************** ++** acx_cs part ++** ++** called by pcmcia card service ++*/ ++ ++/* ++ The event() function is this driver's Card Services event handler. ++ It will be called by Card Services when an appropriate card status ++ event is received. The config() and release() entry points are ++ used to configure or release a socket, in response to card ++ insertion and ejection events. They are invoked from the acx_cs ++ event handler. ++*/ ++ ++static int acx_cs_config(struct pcmcia_device *link); ++static void acx_cs_release(struct pcmcia_device *link); ++ ++/* ++ The attach() and detach() entry points are used to create and destroy ++ "instances" of the driver, where each instance represents everything ++ needed to manage one actual PCMCIA card. ++*/ ++ ++static void acx_cs_detach(struct pcmcia_device *p_dev); ++ ++/* ++ You'll also need to prototype all the functions that will actually ++ be used to talk to your device. See 'pcmem_cs' for a good example ++ of a fully self-sufficient driver; the other drivers rely more or ++ less on other parts of the kernel. ++*/ ++ ++/* ++ A linked list of "instances" of the acxnet device. Each actual ++ PCMCIA card corresponds to one device instance, and is described ++ by one struct pcmcia_device structure (defined in ds.h). ++ ++ You may not want to use a linked list for this -- for example, the ++ memory card driver uses an array of struct pcmcia_device pointers, where minor ++ device numbers are used to derive the corresponding array index. ++*/ ++ ++/* ++ A driver needs to provide a dev_node_t structure for each device ++ on a card. In some cases, there is only one device per card (for ++ example, ethernet cards, modems). In other cases, there may be ++ many actual or logical devices (SCSI adapters, memory cards with ++ multiple partitions). The dev_node_t structures need to be kept ++ in a linked list starting at the 'dev' field of a struct pcmcia_device ++ structure. We allocate them in the card's private data structure, ++ because they generally shouldn't be allocated dynamically. ++ ++ In this case, we also provide a flag to indicate if a device is ++ "stopped" due to a power management event, or card ejection. The ++ device IO routines can use a flag like this to throttle IO to a ++ card that is not ready to accept it. ++*/ ++ ++ ++/*====================================================================== ++ ++ acx_attach() creates an "instance" of the driver, allocating ++ local data structures for one device. The device is registered ++ with Card Services. ++ ++ The dev_link structure is initialized, but we don't actually ++ configure the card at this point -- we wait until we receive a ++ card insertion event. ++ ++ ======================================================================*/ ++ ++static int acx_cs_probe(struct pcmcia_device *link) ++{ ++ local_info_t *local; ++ struct net_device *ndev; ++ ++ DEBUG(0, "acx_attach()\n"); ++ ++ ndev = alloc_netdev(sizeof(acx_device_t), "wlan%d", dummy_netdev_init); ++ if (!ndev) { ++ printk("acx: no memory for netdevice struct\n"); ++ return -ENOMEM; ++ } ++ ++ /* Interrupt setup */ ++ link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT; ++ link->irq.IRQInfo1 = IRQ_LEVEL_ID; ++ link->irq.Handler = acxmem_i_interrupt; ++ link->irq.Instance = ndev; ++ ++ /* ++ General socket configuration defaults can go here. In this ++ client, we assume very little, and rely on the CIS for almost ++ everything. In most clients, many details (i.e., number, sizes, ++ and attributes of IO windows) are fixed by the nature of the ++ device, and can be hard-wired here. ++ */ ++ link->conf.Attributes = CONF_ENABLE_IRQ; ++ link->conf.IntType = INT_MEMORY_AND_IO; ++ link->conf.Present = PRESENT_OPTION | PRESENT_COPY; ++ ++ /* Allocate space for private device-specific data */ ++ local = kzalloc(sizeof(local_info_t), GFP_KERNEL); ++ if (!local) { ++ printk(KERN_ERR "acx_cs: no memory for new device\n"); ++ return -ENOMEM; ++ } ++ local->ndev = ndev; ++ ++ link->priv = local; ++ ++ return acx_cs_config(link); ++} /* acx_attach */ ++ ++/*====================================================================== ++ ++ This deletes a driver "instance". The device is de-registered ++ with Card Services. If it has been released, all local data ++ structures are freed. Otherwise, the structures will be freed ++ when the device is released. ++ ++ ======================================================================*/ ++ ++static void acx_cs_detach(struct pcmcia_device *link) ++{ ++ DEBUG(0, "acx_detach(0x%p)\n", link); ++ ++ ++ if ( ((local_info_t*)link->priv)->ndev ) { ++ acxmem_e_close( ((local_info_t*)link->priv)->ndev ); ++ } ++ ++ acx_cs_release(link); ++ ++ ((local_info_t*)link->priv)->ndev = NULL; ++ ++ kfree(link->priv); ++} /* acx_detach */ ++ ++/*====================================================================== ++ ++ acx_config() is scheduled to run after a CARD_INSERTION event ++ is received, to configure the PCMCIA socket, and to make the ++ device available to the system. ++ ++ ======================================================================*/ ++ ++#define CS_CHECK(fn, ret) \ ++do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0) ++ ++static int acx_cs_config(struct pcmcia_device *link) ++{ ++ tuple_t tuple; ++ cisparse_t parse; ++ local_info_t *local = link->priv; ++ int last_fn, last_ret; ++ u_char buf[64]; ++ win_req_t req; ++ memreq_t map; ++// int i; ++// acx_device_t *adev; ++ ++// adev = (acx_device_t *)link->priv; ++ ++ DEBUG(0, "acx_cs_config(0x%p)\n", link); ++ ++ /* ++ In this loop, we scan the CIS for configuration table entries, ++ each of which describes a valid card configuration, including ++ voltage, IO window, memory window, and interrupt settings. ++ ++ We make no assumptions about the card to be configured: we use ++ just the information available in the CIS. In an ideal world, ++ this would work for any PCMCIA card, but it requires a complete ++ and accurate CIS. In practice, a driver usually "knows" most of ++ these things without consulting the CIS, and most client drivers ++ will only use the CIS to fill in implementation-defined details. ++ */ ++ tuple.Attributes = 0; ++ tuple.TupleData = (cisdata_t *)buf; ++ tuple.TupleDataMax = sizeof(buf); ++ tuple.TupleOffset = 0; ++ tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY; ++ ++ /* don't trust the CIS on this; Linksys got it wrong */ ++ //link->conf.Present = 0x63; ++ ++ CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple)); ++ while (1) { ++ cistpl_cftable_entry_t dflt = { 0 }; ++ cistpl_cftable_entry_t *cfg = &(parse.cftable_entry); ++ if (pcmcia_get_tuple_data(link, &tuple) != 0 || ++ pcmcia_parse_tuple(link, &tuple, &parse) != 0) ++ goto next_entry; ++ ++ if (cfg->flags & CISTPL_CFTABLE_DEFAULT) dflt = *cfg; ++ if (cfg->index == 0) goto next_entry; ++ link->conf.ConfigIndex = cfg->index; ++ ++ /* Does this card need audio output? */ ++ if (cfg->flags & CISTPL_CFTABLE_AUDIO) { ++ link->conf.Attributes |= CONF_ENABLE_SPKR; ++ link->conf.Status = CCSR_AUDIO_ENA; ++ } ++ ++ /* Use power settings for Vcc and Vpp if present */ ++ /* Note that the CIS values need to be rescaled */ ++ if (cfg->vpp1.present & (1<<CISTPL_POWER_VNOM)) ++ link->conf.Vpp = ++ cfg->vpp1.param[CISTPL_POWER_VNOM]/10000; ++ else if (dflt.vpp1.present & (1<<CISTPL_POWER_VNOM)) ++ link->conf.Vpp = ++ dflt.vpp1.param[CISTPL_POWER_VNOM]/10000; ++ ++ /* Do we need to allocate an interrupt? */ ++ if (cfg->irq.IRQInfo1 || dflt.irq.IRQInfo1) ++ link->conf.Attributes |= CONF_ENABLE_IRQ; ++ if ((cfg->mem.nwin > 0) || (dflt.mem.nwin > 0)) { ++ cistpl_mem_t *mem = ++ (cfg->mem.nwin) ? &cfg->mem : &dflt.mem; ++// req.Attributes = WIN_DATA_WIDTH_16|WIN_MEMORY_TYPE_AM|WIN_ENABLE|WIN_USE_WAIT; ++ req.Attributes = WIN_DATA_WIDTH_16|WIN_MEMORY_TYPE_CM|WIN_ENABLE|WIN_USE_WAIT; ++ req.Base = mem->win[0].host_addr; ++ req.Size = mem->win[0].len; ++ req.Size=0x1000; ++ req.AccessSpeed = 0; ++ if (pcmcia_request_window(&link, &req, &link->win) != 0) ++ goto next_entry; ++ map.Page = 0; map.CardOffset = mem->win[0].card_addr; ++ if (pcmcia_map_mem_page(link->win, &map) != 0) ++ goto next_entry; ++ else ++ printk(KERN_INFO "MEMORY WINDOW FOUND!!!\n"); ++ } ++ /* If we got this far, we're cool! */ ++ break; ++ ++ next_entry: ++ CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple)); ++ } ++ ++ if (link->conf.Attributes & CONF_ENABLE_IRQ) { ++ printk(KERN_INFO "requesting Irq...\n"); ++ CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq)); ++ } ++ ++ /* ++ This actually configures the PCMCIA socket -- setting up ++ the I/O windows and the interrupt mapping, and putting the ++ card and host interface into "Memory and IO" mode. ++ */ ++ CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf)); ++ DEBUG(0,"RequestConfiguration OK\n"); ++ ++ ++ memwin.Base=req.Base; ++ memwin.Size=req.Size; ++ ++ acx_init_netdev(local->ndev, &link->dev, memwin.Base, memwin.Size, link->irq.AssignedIRQ); ++ ++#if 1 ++ /* ++ At this point, the dev_node_t structure(s) need to be ++ initialized and arranged in a linked list at link->dev_node. ++ */ ++ strcpy(local->node.dev_name, local->ndev->name ); ++ local->node.major = local->node.minor = 0; ++ link->dev_node = &local->node; ++ ++ /* Finally, report what we've done */ ++ printk(KERN_INFO "%s: index 0x%02x: ", ++ local->ndev->name, link->conf.ConfigIndex); ++#endif ++ if (link->conf.Attributes & CONF_ENABLE_IRQ) ++ printk("irq %d", link->irq.AssignedIRQ); ++ if (link->io.NumPorts1) ++ printk(", io 0x%04x-0x%04x", link->io.BasePort1, ++ link->io.BasePort1+link->io.NumPorts1-1); ++ if (link->io.NumPorts2) ++ printk(" & 0x%04x-0x%04x", link->io.BasePort2, ++ link->io.BasePort2+link->io.NumPorts2-1); ++ if (link->win) ++ printk(", mem 0x%06lx-0x%06lx\n", req.Base, ++ req.Base+req.Size-1); ++ return 0; ++ ++ cs_failed: ++ cs_error(link, last_fn, last_ret); ++ acx_cs_release(link); ++ return -ENODEV; ++} /* acx_config */ ++ ++/*====================================================================== ++ ++ After a card is removed, acx_release() will unregister the ++ device, and release the PCMCIA configuration. If the device is ++ still open, this will be postponed until it is closed. ++ ++ ======================================================================*/ ++ ++static void acx_cs_release(struct pcmcia_device *link) ++{ ++ DEBUG(0, "acx_release(0x%p)\n", link); ++ acxmem_e_remove(link); ++ pcmcia_disable_device(link); ++} ++ ++static int acx_cs_suspend(struct pcmcia_device *link) ++{ ++ local_info_t *local = link->priv; ++ ++ pm_message_t state; ++ acxmem_e_suspend ( local->ndev, state); ++ /* Already done in suspend ++ * netif_device_detach(local->ndev); */ ++ ++ return 0; ++} ++ ++static int acx_cs_resume(struct pcmcia_device *link) ++{ ++ local_info_t *local = link->priv; ++ ++ FN_ENTER; ++ resume_ndev = local->ndev; ++ ++ schedule_work( &fw_resume_work ); ++ ++ /* Already done in suspend ++ if (link->open) { ++ // do we need reset for ACX, if so what function nane is ? ++ //reset_acx_card(local->eth_dev); ++ netif_device_attach(local->ndev); ++ } */ ++ ++ FN_EXIT0; ++ return 0; ++} ++ ++static struct pcmcia_device_id acx_ids[] = { ++ PCMCIA_DEVICE_MANF_CARD(0x0097, 0x8402), ++ PCMCIA_DEVICE_MANF_CARD(0x0250, 0xb001), ++ PCMCIA_DEVICE_NULL, ++}; ++MODULE_DEVICE_TABLE(pcmcia, acx_ids); ++ ++static struct pcmcia_driver acx_driver = { ++ .owner = THIS_MODULE, ++ .drv = { ++ .name = "acx_cs", ++ }, ++ .probe = acx_cs_probe, ++ .remove = acx_cs_detach, ++ .id_table = acx_ids, ++ .suspend = acx_cs_suspend, ++ .resume = acx_cs_resume, ++}; ++ ++int acx_cs_init(void) ++{ ++ /* return success if at least one succeeded */ ++ DEBUG(0, "acxcs_init()\n"); ++ return pcmcia_register_driver(&acx_driver); ++} ++ ++void acx_cs_cleanup(void) ++{ ++ pcmcia_unregister_driver(&acx_driver); ++} ++ ++/* ++ This program is free software; you can redistribute it and/or ++ modify it under the terms of the GNU General Public License ++ as published by the Free Software Foundation; either version 2 ++ of the License, or (at your option) any later version. ++ ++ This program is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ GNU General Public License for more details. ++ ++ In addition: ++ ++ Redistribution and use in source and binary forms, with or without ++ modification, are permitted provided that the following conditions ++ are met: ++ ++ 1. Redistributions of source code must retain the above copyright ++ notice, this list of conditions and the following disclaimer. ++ 2. Redistributions in binary form must reproduce the above copyright ++ notice, this list of conditions and the following disclaimer in the ++ documentation and/or other materials provided with the distribution. ++ 3. The name of the author may not be used to endorse or promote ++ products derived from this software without specific prior written ++ permission. ++ ++ THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR ++ IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED ++ WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ++ ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, ++ INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES ++ (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR ++ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ++ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, ++ STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING ++ IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE ++ POSSIBILITY OF SUCH DAMAGE. ++*/ ++ ++MODULE_DESCRIPTION( "ACX Cardbus Driver" ); ++MODULE_LICENSE( "GPL" ); ++ +Index: linux-2.6.22/drivers/net/wireless/acx/htcsable_acx.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/htcsable_acx.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,118 @@ ++/* ++ * WLAN (TI TNETW1100B) support in the HTC Sable ++ * ++ * Copyright (c) 2006 SDG Systems, LLC ++ * ++ * This file is subject to the terms and conditions of the GNU General Public ++ * License. See the file COPYING in the main directory of this archive for ++ * more details. ++ * ++ * 28-March-2006 Todd Blumer <todd@sdgsystems.com> ++ */ ++ ++ ++#include <linux/kernel.h> ++#include <linux/platform_device.h> ++#include <linux/delay.h> ++ ++#include <asm/hardware.h> ++ ++#include <asm/arch/pxa-regs.h> ++#include <linux/mfd/asic3_base.h> ++#include <asm/arch/htcsable-gpio.h> ++#include <asm/arch/htcsable-asic.h> ++#include <asm/io.h> ++ ++#include "acx_hw.h" ++ ++#define WLAN_BASE PXA_CS2_PHYS ++ ++/* ++off: b15 c8 d3 ++on: d3 c8 b5 b5- ++*/ ++ ++#define GPIO_NR_HTCSABLE_ACX111 111 ++ ++static int ++htcsable_wlan_stop( void ); ++ ++static int ++htcsable_wlan_start( void ) ++{ ++ printk( "htcsable_wlan_start\n" ); ++ ++ /*asic3_set_gpio_out_c(&htcsable_asic3.dev, 1<<GPIOC_ACX_RESET, 0);*/ ++ asic3_set_gpio_out_c(&htcsable_asic3.dev, 1<<GPIOC_ACX_PWR_3, 1<<GPIOC_ACX_PWR_3); /* related to acx */ ++ SET_HTCSABLE_GPIO(ACX111, 1); ++ asic3_set_gpio_out_b(&htcsable_asic3.dev, 1<<GPIOB_ACX_PWR_1, 1<<GPIOB_ACX_PWR_1); ++ asic3_set_gpio_out_d(&htcsable_asic3.dev, 1<<GPIOD_ACX_PWR_2, 1<<GPIOD_ACX_PWR_2); ++ mdelay(260); ++ asic3_set_gpio_out_c(&htcsable_asic3.dev, 1<<GPIOC_ACX_RESET, 1<<GPIOC_ACX_RESET); ++ ++ return 0; ++} ++ ++static int ++htcsable_wlan_stop( void ) ++{ ++ printk( "htcsable_wlan_stop\n" ); ++ asic3_set_gpio_out_b(&htcsable_asic3.dev, 1<<GPIOB_ACX_PWR_1, 0); ++ asic3_set_gpio_out_c(&htcsable_asic3.dev, 1<<GPIOC_ACX_RESET, 0); ++ asic3_set_gpio_out_d(&htcsable_asic3.dev, 1<<GPIOD_ACX_PWR_2, 0); ++ SET_HTCSABLE_GPIO(ACX111, 0); /* not necessary to power down this one? */ ++ asic3_set_gpio_out_c(&htcsable_asic3.dev, 1<<GPIOC_ACX_PWR_3, 0); /* not necessary to power down this one? */ ++ ++ return 0; ++} ++ ++static struct resource acx_resources[] = { ++ [0] = { ++ .start = WLAN_BASE, ++ .end = WLAN_BASE + 0x20, ++ .flags = IORESOURCE_MEM, ++ }, ++ [1] = { ++// .start = asic3_irq_base(&htcsable_asic3.dev) + ASIC3_GPIOC_IRQ_BASE+GPIOC_WIFI_IRQ_N, ++// .end = asic3_irq_base(&htcsable_asic3.dev) + ASIC3_GPIOC_IRQ_BASE+GPIOC_WIFI_IRQ_N, ++ .flags = IORESOURCE_IRQ, ++ }, ++}; ++ ++static struct acx_hardware_data acx_data = { ++ .start_hw = htcsable_wlan_start, ++ .stop_hw = htcsable_wlan_stop, ++}; ++ ++static struct platform_device acx_device = { ++ .name = "acx-mem", ++ .dev = { ++ .platform_data = &acx_data, ++ }, ++ .num_resources = ARRAY_SIZE( acx_resources ), ++ .resource = acx_resources, ++}; ++ ++static int __init ++htcsable_wlan_init( void ) ++{ ++ printk( "htcsable_wlan_init: acx-mem platform_device_register\n" ); ++ acx_device.resource[1].start = asic3_irq_base(&htcsable_asic3.dev) + ASIC3_GPIOB_IRQ_BASE+GPIOB_ACX_IRQ_N; ++ acx_device.resource[1].end = asic3_irq_base(&htcsable_asic3.dev) + ASIC3_GPIOB_IRQ_BASE+GPIOB_ACX_IRQ_N; ++ return platform_device_register( &acx_device ); ++} ++ ++ ++static void __exit ++htcsable_wlan_exit( void ) ++{ ++ platform_device_unregister( &acx_device ); ++} ++ ++module_init( htcsable_wlan_init ); ++module_exit( htcsable_wlan_exit ); ++ ++MODULE_AUTHOR( "Todd Blumer <todd@sdgsystems.com>" ); ++MODULE_DESCRIPTION( "WLAN driver for HTC Sable" ); ++MODULE_LICENSE( "GPL" ); ++ +Index: linux-2.6.22/drivers/net/wireless/acx/htcuniversal_acx.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/htcuniversal_acx.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,108 @@ ++/* ++ * WLAN (TI TNETW1100B) support in the HTC Universal ++ * ++ * Copyright (c) 2006 SDG Systems, LLC ++ * ++ * This file is subject to the terms and conditions of the GNU General Public ++ * License. See the file COPYING in the main directory of this archive for ++ * more details. ++ * ++ * 28-March-2006 Todd Blumer <todd@sdgsystems.com> ++ */ ++ ++ ++#include <linux/kernel.h> ++#include <linux/platform_device.h> ++#include <linux/delay.h> ++ ++#include <asm/hardware.h> ++ ++#include <asm/arch/pxa-regs.h> ++#include <linux/soc/asic3_base.h> ++#include <asm/arch/htcuniversal-gpio.h> ++#include <asm/arch/htcuniversal-asic.h> ++#include <asm/io.h> ++ ++#include "acx_hw.h" ++ ++#define WLAN_BASE PXA_CS2_PHYS ++ ++ ++static int ++htcuniversal_wlan_start( void ) ++{ ++ htcuniversal_egpio_enable(1<<EGPIO6_WIFI_ON); ++ asic3_set_gpio_out_c(&htcuniversal_asic3.dev, 1<<GPIOC_WIFI_PWR1_ON, 1<<GPIOC_WIFI_PWR1_ON); ++ asic3_set_gpio_out_d(&htcuniversal_asic3.dev, 1<<GPIOD_WIFI_PWR3_ON, 1<<GPIOD_WIFI_PWR3_ON); ++ asic3_set_gpio_out_d(&htcuniversal_asic3.dev, 1<<GPIOD_WIFI_PWR2_ON, 1<<GPIOD_WIFI_PWR2_ON); ++ mdelay(100); ++ ++ asic3_set_gpio_out_c(&htcuniversal_asic3.dev, 1<<GPIOC_WIFI_RESET, 0); ++ mdelay(100); ++ asic3_set_gpio_out_c(&htcuniversal_asic3.dev, 1<<GPIOC_WIFI_RESET, 1<<GPIOC_WIFI_RESET); ++ mdelay(100); ++ return 0; ++} ++ ++static int ++htcuniversal_wlan_stop( void ) ++{ ++ asic3_set_gpio_out_c(&htcuniversal_asic3.dev, 1<<GPIOC_WIFI_RESET, 0); ++ ++ htcuniversal_egpio_disable(1<<EGPIO6_WIFI_ON); ++ asic3_set_gpio_out_c(&htcuniversal_asic3.dev, 1<<GPIOC_WIFI_PWR1_ON, 0); ++ asic3_set_gpio_out_d(&htcuniversal_asic3.dev, 1<<GPIOD_WIFI_PWR2_ON, 0); ++ asic3_set_gpio_out_d(&htcuniversal_asic3.dev, 1<<GPIOD_WIFI_PWR3_ON, 0); ++ return 0; ++} ++ ++static struct resource acx_resources[] = { ++ [0] = { ++ .start = WLAN_BASE, ++ .end = WLAN_BASE + 0x20, ++ .flags = IORESOURCE_MEM, ++ }, ++ [1] = { ++// .start = asic3_irq_base(&htcuniversal_asic3.dev) + ASIC3_GPIOC_IRQ_BASE+GPIOC_WIFI_IRQ_N, ++// .end = asic3_irq_base(&htcuniversal_asic3.dev) + ASIC3_GPIOC_IRQ_BASE+GPIOC_WIFI_IRQ_N, ++ .flags = IORESOURCE_IRQ, ++ }, ++}; ++ ++static struct acx_hardware_data acx_data = { ++ .start_hw = htcuniversal_wlan_start, ++ .stop_hw = htcuniversal_wlan_stop, ++}; ++ ++static struct platform_device acx_device = { ++ .name = "acx-mem", ++ .dev = { ++ .platform_data = &acx_data, ++ }, ++ .num_resources = ARRAY_SIZE( acx_resources ), ++ .resource = acx_resources, ++}; ++ ++static int __init ++htcuniversal_wlan_init( void ) ++{ ++ printk( "htcuniversal_wlan_init: acx-mem platform_device_register\n" ); ++ acx_device.resource[1].start = asic3_irq_base(&htcuniversal_asic3.dev) + ASIC3_GPIOC_IRQ_BASE+GPIOC_WIFI_IRQ_N; ++ acx_device.resource[1].end = asic3_irq_base(&htcuniversal_asic3.dev) + ASIC3_GPIOC_IRQ_BASE+GPIOC_WIFI_IRQ_N; ++ return platform_device_register( &acx_device ); ++} ++ ++ ++static void __exit ++htcuniversal_wlan_exit( void ) ++{ ++ platform_device_unregister( &acx_device ); ++} ++ ++module_init( htcuniversal_wlan_init ); ++module_exit( htcuniversal_wlan_exit ); ++ ++MODULE_AUTHOR( "Todd Blumer <todd@sdgsystems.com>" ); ++MODULE_DESCRIPTION( "WLAN driver for HTC Universal" ); ++MODULE_LICENSE( "GPL" ); ++ +Index: linux-2.6.22/drivers/net/wireless/acx/hx4700_acx.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/hx4700_acx.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,108 @@ ++/* ++ * WLAN (TI TNETW1100B) support in the hx470x. ++ * ++ * Copyright (c) 2006 SDG Systems, LLC ++ * ++ * This file is subject to the terms and conditions of the GNU General Public ++ * License. See the file COPYING in the main directory of this archive for ++ * more details. ++ * ++ * 28-March-2006 Todd Blumer <todd@sdgsystems.com> ++ */ ++ ++ ++#include <linux/kernel.h> ++#include <linux/platform_device.h> ++#include <linux/delay.h> ++#include <linux/leds.h> ++ ++#include <asm/hardware.h> ++ ++#include <asm/arch/pxa-regs.h> ++#include <asm/arch/hx4700-gpio.h> ++#include <asm/arch/hx4700-core.h> ++#include <asm/io.h> ++ ++#include "acx_hw.h" ++ ++#define WLAN_OFFSET 0x1000000 ++#define WLAN_BASE (PXA_CS5_PHYS+WLAN_OFFSET) ++ ++ ++static int ++hx4700_wlan_start( void ) ++{ ++ SET_HX4700_GPIO( WLAN_RESET_N, 0 ); ++ mdelay(5); ++ hx4700_egpio_enable( EGPIO0_VCC_3V3_EN ); ++ mdelay(100); ++ hx4700_egpio_enable( EGPIO7_VCC_3V3_WL_EN ); ++ mdelay(150); ++ hx4700_egpio_enable( EGPIO1_WL_VREG_EN | EGPIO2_VCC_2V1_WL_EN | ++ EGPIO6_WL1V8_EN ); ++ mdelay(10); ++ SET_HX4700_GPIO( WLAN_RESET_N, 1 ); ++ mdelay(50); ++ led_trigger_event_shared(hx4700_radio_trig, LED_FULL); ++ return 0; ++} ++ ++static int ++hx4700_wlan_stop( void ) ++{ ++ hx4700_egpio_disable( EGPIO0_VCC_3V3_EN | EGPIO1_WL_VREG_EN | ++ EGPIO7_VCC_3V3_WL_EN | EGPIO2_VCC_2V1_WL_EN | ++ EGPIO6_WL1V8_EN ); ++ SET_HX4700_GPIO( WLAN_RESET_N, 0 ); ++ led_trigger_event_shared(hx4700_radio_trig, LED_OFF); ++ return 0; ++} ++ ++static struct resource acx_resources[] = { ++ [0] = { ++ .start = WLAN_BASE, ++ .end = WLAN_BASE + 0x20, ++ .flags = IORESOURCE_MEM, ++ }, ++ [1] = { ++ .start = HX4700_IRQ(WLAN_IRQ_N), ++ .end = HX4700_IRQ(WLAN_IRQ_N), ++ .flags = IORESOURCE_IRQ, ++ }, ++}; ++ ++static struct acx_hardware_data acx_data = { ++ .start_hw = hx4700_wlan_start, ++ .stop_hw = hx4700_wlan_stop, ++}; ++ ++static struct platform_device acx_device = { ++ .name = "acx-mem", ++ .dev = { ++ .platform_data = &acx_data, ++ }, ++ .num_resources = ARRAY_SIZE( acx_resources ), ++ .resource = acx_resources, ++}; ++ ++static int __init ++hx4700_wlan_init( void ) ++{ ++ printk( "hx4700_wlan_init: acx-mem platform_device_register\n" ); ++ return platform_device_register( &acx_device ); ++} ++ ++ ++static void __exit ++hx4700_wlan_exit( void ) ++{ ++ platform_device_unregister( &acx_device ); ++} ++ ++module_init( hx4700_wlan_init ); ++module_exit( hx4700_wlan_exit ); ++ ++MODULE_AUTHOR( "Todd Blumer <todd@sdgsystems.com>" ); ++MODULE_DESCRIPTION( "WLAN driver for iPAQ hx4700" ); ++MODULE_LICENSE( "GPL" ); ++ +Index: linux-2.6.22/drivers/net/wireless/acx/ioctl.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/ioctl.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,2748 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++*/ ++ ++#include <linux/version.h> ++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) ++#include <linux/config.h> ++#endif ++#include <linux/kernel.h> ++#include <linux/types.h> ++#include <asm/io.h> ++/* #include <asm/uaccess.h> */ /* required for 2.4.x kernels; verify_write() */ ++#include <linux/if_arp.h> ++#include <linux/wireless.h> ++#include <net/iw_handler.h> ++ ++#include "acx.h" ++ ++ ++/*********************************************************************** ++*/ ++ ++/* channel frequencies ++ * TODO: Currently, every other 802.11 driver keeps its own copy of this. In ++ * the long run this should be integrated into ieee802_11.h or wireless.h or ++ * whatever IEEE802.11x framework evolves */ ++static const u16 acx_channel_freq[] = { ++ 2412, 2417, 2422, 2427, 2432, 2437, 2442, ++ 2447, 2452, 2457, 2462, 2467, 2472, 2484, ++}; ++ ++ ++/*********************************************************************** ++** acx_ioctl_commit ++*/ ++static int ++acx_ioctl_commit(struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ if (ACX_STATE_IFACE_UP & adev->dev_state_mask) ++ acx_s_update_card_settings(adev); ++ acx_sem_unlock(adev); ++ ++ FN_EXIT0; ++ return OK; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx_ioctl_get_name( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ static const char * const names[] = { "IEEE 802.11b+/g+", "IEEE 802.11b+" }; ++ ++ strcpy(wrqu->name, names[IS_ACX111(adev) ? 0 : 1]); ++ ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_freq ++*/ ++static int ++acx_ioctl_set_freq( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int channel = -1; ++ unsigned int mult = 1; ++ int result; ++ ++ FN_ENTER; ++ ++ if (wrqu->freq.e == 0 && wrqu->freq.m <= 1000) { ++ /* Setting by channel number */ ++ channel = wrqu->freq.m; ++ } else { ++ /* If setting by frequency, convert to a channel */ ++ int i; ++ ++ for (i = 0; i < (6 - wrqu->freq.e); i++) ++ mult *= 10; ++ ++ for (i = 1; i <= 14; i++) ++ if (wrqu->freq.m == acx_channel_freq[i - 1] * mult) ++ channel = i; ++ } ++ ++ if (channel > 14) { ++ result = -EINVAL; ++ goto end; ++ } ++ ++ acx_sem_lock(adev); ++ ++ adev->channel = channel; ++ /* hmm, the following code part is strange, but this is how ++ * it was being done before... */ ++ log(L_IOCTL, "Changing to channel %d\n", channel); ++ SET_BIT(adev->set_mask, GETSET_CHANNEL); ++ ++ result = -EINPROGRESS; /* need to call commit handler */ ++ ++ acx_sem_unlock(adev); ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++static inline int ++acx_ioctl_get_freq( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ wrqu->freq.e = 0; ++ wrqu->freq.m = adev->channel; ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_mode ++*/ ++static int ++acx_ioctl_set_mode( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ switch (wrqu->mode) { ++ case IW_MODE_AUTO: ++ adev->mode = ACX_MODE_OFF; ++ break; ++ case IW_MODE_MONITOR: ++ adev->mode = ACX_MODE_MONITOR; ++ break; ++ case IW_MODE_ADHOC: ++ adev->mode = ACX_MODE_0_ADHOC; ++ break; ++ case IW_MODE_INFRA: ++ adev->mode = ACX_MODE_2_STA; ++ break; ++ case IW_MODE_MASTER: ++ printk("acx: master mode (HostAP) is very, very " ++ "experimental! It might work partially, but " ++ "better get prepared for nasty surprises " ++ "at any time\n"); ++ adev->mode = ACX_MODE_3_AP; ++ break; ++ case IW_MODE_REPEAT: ++ case IW_MODE_SECOND: ++ default: ++ result = -EOPNOTSUPP; ++ goto end_unlock; ++ } ++ ++ log(L_ASSOC, "new adev->mode=%d\n", adev->mode); ++ SET_BIT(adev->set_mask, GETSET_MODE); ++ result = -EINPROGRESS; ++ ++end_unlock: ++ acx_sem_unlock(adev); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx_ioctl_get_mode( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result = 0; ++ ++ switch (adev->mode) { ++ case ACX_MODE_OFF: ++ wrqu->mode = IW_MODE_AUTO; break; ++ case ACX_MODE_MONITOR: ++ wrqu->mode = IW_MODE_MONITOR; break; ++ case ACX_MODE_0_ADHOC: ++ wrqu->mode = IW_MODE_ADHOC; break; ++ case ACX_MODE_2_STA: ++ wrqu->mode = IW_MODE_INFRA; break; ++ case ACX_MODE_3_AP: ++ wrqu->mode = IW_MODE_MASTER; break; ++ default: ++ result = -EOPNOTSUPP; ++ } ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx_ioctl_set_sens( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->sens; ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ acx_sem_lock(adev); ++ ++ adev->sensitivity = (1 == vwrq->disabled) ? 0 : vwrq->value; ++ SET_BIT(adev->set_mask, GETSET_SENSITIVITY); ++ ++ acx_sem_unlock(adev); ++ ++ return -EINPROGRESS; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx_ioctl_get_sens( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->sens; ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ if (IS_USB(adev)) ++ /* setting the PHY reg via fw cmd doesn't work yet */ ++ return -EOPNOTSUPP; ++ ++ /* acx_sem_lock(adev); */ ++ ++ vwrq->value = adev->sensitivity; ++ vwrq->disabled = (vwrq->value == 0); ++ vwrq->fixed = 1; ++ ++ /* acx_sem_unlock(adev); */ ++ ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_ap ++** ++** Sets the MAC address of the AP to associate with ++*/ ++static int ++acx_ioctl_set_ap( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct sockaddr *awrq = &wrqu->ap_addr; ++ acx_device_t *adev = ndev2adev(ndev); ++ int result = 0; ++ const u8 *ap; ++ ++ FN_ENTER; ++ if (NULL == awrq) { ++ result = -EFAULT; ++ goto end; ++ } ++ if (ARPHRD_ETHER != awrq->sa_family) { ++ result = -EINVAL; ++ goto end; ++ } ++ ++ ap = awrq->sa_data; ++ acxlog_mac(L_IOCTL, "set AP=", ap, "\n"); ++ ++ MAC_COPY(adev->ap, ap); ++ ++ /* We want to start rescan in managed or ad-hoc mode, ++ ** otherwise just set adev->ap. ++ ** "iwconfig <if> ap <mac> mode managed": we must be able ++ ** to set ap _first_ and _then_ set mode */ ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_2_STA: ++ /* FIXME: if there is a convention on what zero AP means, ++ ** please add a comment about that. I don't know of any --vda */ ++ if (mac_is_zero(ap)) { ++ /* "off" == 00:00:00:00:00:00 */ ++ MAC_BCAST(adev->ap); ++ log(L_IOCTL, "Not reassociating\n"); ++ } else { ++ log(L_IOCTL, "Forcing reassociation\n"); ++ SET_BIT(adev->set_mask, GETSET_RESCAN); ++ } ++ break; ++ } ++ result = -EINPROGRESS; ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx_ioctl_get_ap( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct sockaddr *awrq = &wrqu->ap_addr; ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ if (ACX_STATUS_4_ASSOCIATED == adev->status) { ++ /* as seen in Aironet driver, airo.c */ ++ MAC_COPY(awrq->sa_data, adev->bssid); ++ } else { ++ MAC_ZERO(awrq->sa_data); ++ } ++ awrq->sa_family = ARPHRD_ETHER; ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_get_aplist ++** ++** Deprecated in favor of iwscan. ++** We simply return the list of currently available stations in range, ++** don't do a new scan. ++*/ ++static int ++acx_ioctl_get_aplist( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_point *dwrq = &wrqu->data; ++ acx_device_t *adev = ndev2adev(ndev); ++ struct sockaddr *address = (struct sockaddr *) extra; ++ struct iw_quality qual[IW_MAX_AP]; ++ int i, cur; ++ int result = OK; ++ ++ FN_ENTER; ++ ++ /* we have AP list only in STA mode */ ++ if (ACX_MODE_2_STA != adev->mode) { ++ result = -EOPNOTSUPP; ++ goto end; ++ } ++ ++ cur = 0; ++ for (i = 0; i < VEC_SIZE(adev->sta_list); i++) { ++ struct client *bss = &adev->sta_list[i]; ++ if (!bss->used) continue; ++ MAC_COPY(address[cur].sa_data, bss->bssid); ++ address[cur].sa_family = ARPHRD_ETHER; ++ qual[cur].level = bss->sir; ++ qual[cur].noise = bss->snr; ++#ifndef OLD_QUALITY ++ qual[cur].qual = acx_signal_determine_quality(qual[cur].level, ++ qual[cur].noise); ++#else ++ qual[cur].qual = (qual[cur].noise <= 100) ? ++ 100 - qual[cur].noise : 0; ++#endif ++ /* no scan: level/noise/qual not updated: */ ++ qual[cur].updated = 0; ++ cur++; ++ } ++ if (cur) { ++ dwrq->flags = 1; ++ memcpy(extra + sizeof(struct sockaddr)*cur, &qual, ++ sizeof(struct iw_quality)*cur); ++ } ++ dwrq->length = cur; ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx_ioctl_set_scan( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ /* don't start scan if device is not up yet */ ++ if (!(adev->dev_state_mask & ACX_STATE_IFACE_UP)) { ++ result = -EAGAIN; ++ goto end_unlock; ++ } ++ ++ /* This is NOT a rescan for new AP! ++ ** Do not use SET_BIT(GETSET_RESCAN); */ ++ acx_s_cmd_start_scan(adev); ++ result = OK; ++ ++end_unlock: ++ acx_sem_unlock(adev); ++/* end: */ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_s_scan_add_station ++*/ ++/* helper. not sure whether it's really a _s_leeping fn */ ++static char* ++acx_s_scan_add_station( ++ acx_device_t *adev, ++ char *ptr, ++ char *end_buf, ++ struct client *bss) ++{ ++ struct iw_event iwe; ++ char *ptr_rate; ++ ++ FN_ENTER; ++ ++ /* MAC address has to be added first */ ++ iwe.cmd = SIOCGIWAP; ++ iwe.u.ap_addr.sa_family = ARPHRD_ETHER; ++ MAC_COPY(iwe.u.ap_addr.sa_data, bss->bssid); ++ acxlog_mac(L_IOCTL, "scan, station address: ", bss->bssid, "\n"); ++ ptr = iwe_stream_add_event(ptr, end_buf, &iwe, IW_EV_ADDR_LEN); ++ ++ /* Add ESSID */ ++ iwe.cmd = SIOCGIWESSID; ++ iwe.u.data.length = bss->essid_len; ++ iwe.u.data.flags = 1; ++ log(L_IOCTL, "scan, essid: %s\n", bss->essid); ++ ptr = iwe_stream_add_point(ptr, end_buf, &iwe, bss->essid); ++ ++ /* Add mode */ ++ iwe.cmd = SIOCGIWMODE; ++ if (bss->cap_info & (WF_MGMT_CAP_ESS | WF_MGMT_CAP_IBSS)) { ++ if (bss->cap_info & WF_MGMT_CAP_ESS) ++ iwe.u.mode = IW_MODE_MASTER; ++ else ++ iwe.u.mode = IW_MODE_ADHOC; ++ log(L_IOCTL, "scan, mode: %d\n", iwe.u.mode); ++ ptr = iwe_stream_add_event(ptr, end_buf, &iwe, IW_EV_UINT_LEN); ++ } ++ ++ /* Add frequency */ ++ iwe.cmd = SIOCGIWFREQ; ++ iwe.u.freq.m = acx_channel_freq[bss->channel - 1] * 100000; ++ iwe.u.freq.e = 1; ++ log(L_IOCTL, "scan, frequency: %d\n", iwe.u.freq.m); ++ ptr = iwe_stream_add_event(ptr, end_buf, &iwe, IW_EV_FREQ_LEN); ++ ++ /* Add link quality */ ++ iwe.cmd = IWEVQUAL; ++ /* FIXME: these values should be expressed in dBm, but we don't know ++ * how to calibrate it yet */ ++ iwe.u.qual.level = bss->sir; ++ iwe.u.qual.noise = bss->snr; ++#ifndef OLD_QUALITY ++ iwe.u.qual.qual = acx_signal_determine_quality(iwe.u.qual.level, ++ iwe.u.qual.noise); ++#else ++ iwe.u.qual.qual = (iwe.u.qual.noise <= 100) ? ++ 100 - iwe.u.qual.noise : 0; ++#endif ++ iwe.u.qual.updated = 7; ++ log(L_IOCTL, "scan, link quality: %d/%d/%d\n", ++ iwe.u.qual.level, iwe.u.qual.noise, iwe.u.qual.qual); ++ ptr = iwe_stream_add_event(ptr, end_buf, &iwe, IW_EV_QUAL_LEN); ++ ++ /* Add encryption */ ++ iwe.cmd = SIOCGIWENCODE; ++ if (bss->cap_info & WF_MGMT_CAP_PRIVACY) ++ iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY; ++ else ++ iwe.u.data.flags = IW_ENCODE_DISABLED; ++ iwe.u.data.length = 0; ++ log(L_IOCTL, "scan, encryption flags: %X\n", iwe.u.data.flags); ++ ptr = iwe_stream_add_point(ptr, end_buf, &iwe, bss->essid); ++ ++ /* add rates */ ++ iwe.cmd = SIOCGIWRATE; ++ iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0; ++ ptr_rate = ptr + IW_EV_LCP_LEN; ++ ++ { ++ u16 rate = bss->rate_cap; ++ const u8* p = acx_bitpos2ratebyte; ++ while (rate) { ++ if (rate & 1) { ++ iwe.u.bitrate.value = *p * 500000; /* units of 500kb/s */ ++ log(L_IOCTL, "scan, rate: %d\n", iwe.u.bitrate.value); ++ ptr_rate = iwe_stream_add_value(ptr, ptr_rate, end_buf, ++ &iwe, IW_EV_PARAM_LEN); ++ } ++ rate >>= 1; ++ p++; ++ }} ++ ++ if ((ptr_rate - ptr) > (ptrdiff_t)IW_EV_LCP_LEN) ++ ptr = ptr_rate; ++ ++ /* drop remaining station data items for now */ ++ ++ FN_EXIT0; ++ return ptr; ++} ++ ++ ++/*********************************************************************** ++ * acx_ioctl_get_scan ++ */ ++static int ++acx_ioctl_get_scan( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_point *dwrq = &wrqu->data; ++ acx_device_t *adev = ndev2adev(ndev); ++ char *ptr = extra; ++ int i; ++ int result = OK; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ /* no scan available if device is not up yet */ ++ if (!(adev->dev_state_mask & ACX_STATE_IFACE_UP)) { ++ log(L_IOCTL, "iface not up yet\n"); ++ result = -EAGAIN; ++ goto end_unlock; ++ } ++ ++#ifdef ENODATA_TO_BE_USED_AFTER_SCAN_ERROR_ONLY ++ if (adev->bss_table_count == 0) { ++ /* no stations found */ ++ result = -ENODATA; ++ goto end_unlock; ++ } ++#endif ++ ++ for (i = 0; i < VEC_SIZE(adev->sta_list); i++) { ++ struct client *bss = &adev->sta_list[i]; ++ if (!bss->used) continue; ++ ptr = acx_s_scan_add_station(adev, ptr, ++ extra + IW_SCAN_MAX_DATA, bss); ++ } ++ dwrq->length = ptr - extra; ++ dwrq->flags = 0; ++ ++end_unlock: ++ acx_sem_unlock(adev); ++/* end: */ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_essid ++*/ ++static int ++acx_ioctl_set_essid( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_point *dwrq = &wrqu->essid; ++ acx_device_t *adev = ndev2adev(ndev); ++ int len = dwrq->length; ++ int result; ++ ++ FN_ENTER; ++ ++ if (len < 0) { ++ result = -EINVAL; ++ goto end; ++ } ++ ++ log(L_IOCTL, "set ESSID '%*s', length %d, flags 0x%04X\n", ++ len, extra, len, dwrq->flags); ++ ++#if WIRELESS_EXT >= 21 ++ /* WE 21 gives real ESSID strlen, not +1 (trailing zero): ++ * see LKML "[patch] drivers/net/wireless: correct reported ssid lengths" */ ++ len += 1; ++#endif ++ ++ acx_sem_lock(adev); ++ ++ /* ESSID disabled? */ ++ if (0 == dwrq->flags) { ++ adev->essid_active = 0; ++ ++ } else { ++ if (len > IW_ESSID_MAX_SIZE) { ++ result = -E2BIG; ++ goto end_unlock; ++ } ++ ++ if (len >= sizeof(adev->essid)) ++ len = sizeof(adev->essid) - 1; ++ memcpy(adev->essid, extra, len); ++ adev->essid[len] = '\0'; ++ /* Paranoia: just in case there is a '\0'... */ ++ adev->essid_len = strlen(adev->essid); ++ adev->essid_active = 1; ++ } ++ ++ SET_BIT(adev->set_mask, GETSET_RESCAN); ++ ++ result = -EINPROGRESS; ++ ++end_unlock: ++ acx_sem_unlock(adev); ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx_ioctl_get_essid( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_point *dwrq = &wrqu->essid; ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ dwrq->flags = adev->essid_active; ++ if (adev->essid_active) { ++ memcpy(extra, adev->essid, adev->essid_len); ++ extra[adev->essid_len] = '\0'; ++ dwrq->length = adev->essid_len + 1; ++ dwrq->flags = 1; ++ } ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_l_update_client_rates ++*/ ++static void ++acx_l_update_client_rates(acx_device_t *adev, u16 rate) ++{ ++ int i; ++ for (i = 0; i < VEC_SIZE(adev->sta_list); i++) { ++ client_t *clt = &adev->sta_list[i]; ++ if (!clt->used) continue; ++ clt->rate_cfg = (clt->rate_cap & rate); ++ if (!clt->rate_cfg) { ++ /* no compatible rates left: kick client */ ++ acxlog_mac(L_ASSOC, "client ",clt->address," kicked: " ++ "rates are not compatible anymore\n"); ++ acx_l_sta_list_del(adev, clt); ++ continue; ++ } ++ clt->rate_cur &= clt->rate_cfg; ++ if (!clt->rate_cur) { ++ /* current rate become invalid, choose a valid one */ ++ clt->rate_cur = 1 << lowest_bit(clt->rate_cfg); ++ } ++ if (IS_ACX100(adev)) ++ clt->rate_100 = acx_bitpos2rate100[highest_bit(clt->rate_cur)]; ++ clt->fallback_count = clt->stepup_count = 0; ++ clt->ignore_count = 16; ++ } ++ switch (adev->mode) { ++ case ACX_MODE_2_STA: ++ if (adev->ap_client && !adev->ap_client->used) { ++ /* Owwww... we kicked our AP!! :) */ ++ SET_BIT(adev->set_mask, GETSET_RESCAN); ++ } ++ } ++} ++ ++ ++/*********************************************************************** ++*/ ++/* maps bits from acx111 rate to rate in Mbits */ ++static const unsigned int ++acx111_rate_tbl[] = { ++ 1000000, /* 0 */ ++ 2000000, /* 1 */ ++ 5500000, /* 2 */ ++ 6000000, /* 3 */ ++ 9000000, /* 4 */ ++ 11000000, /* 5 */ ++ 12000000, /* 6 */ ++ 18000000, /* 7 */ ++ 22000000, /* 8 */ ++ 24000000, /* 9 */ ++ 36000000, /* 10 */ ++ 48000000, /* 11 */ ++ 54000000, /* 12 */ ++ 500000, /* 13, should not happen */ ++ 500000, /* 14, should not happen */ ++ 500000, /* 15, should not happen */ ++}; ++ ++/*********************************************************************** ++ * acx_ioctl_set_rate ++ */ ++static int ++acx_ioctl_set_rate( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->param; ++ acx_device_t *adev = ndev2adev(ndev); ++ u16 txrate_cfg = 1; ++ unsigned long flags; ++ int autorate; ++ int result = -EINVAL; ++ ++ FN_ENTER; ++ log(L_IOCTL, "rate %d fixed 0x%X disabled 0x%X flags 0x%X\n", ++ vwrq->value, vwrq->fixed, vwrq->disabled, vwrq->flags); ++ ++ if ((0 == vwrq->fixed) || (1 == vwrq->fixed)) { ++ int i = VEC_SIZE(acx111_rate_tbl)-1; ++ if (vwrq->value == -1) ++ /* "iwconfig rate auto" --> choose highest */ ++ vwrq->value = IS_ACX100(adev) ? 22000000 : 54000000; ++ while (i >= 0) { ++ if (vwrq->value == acx111_rate_tbl[i]) { ++ txrate_cfg <<= i; ++ i = 0; ++ break; ++ } ++ i--; ++ } ++ if (i == -1) { /* no matching rate */ ++ result = -EINVAL; ++ goto end; ++ } ++ } else { /* rate N, N<1000 (driver specific): we don't use this */ ++ result = -EOPNOTSUPP; ++ goto end; ++ } ++ /* now: only one bit is set in txrate_cfg, corresponding to ++ ** indicated rate */ ++ ++ autorate = (vwrq->fixed == 0) && (RATE111_1 != txrate_cfg); ++ if (autorate) { ++ /* convert 00100000 -> 00111111 */ ++ txrate_cfg = (txrate_cfg<<1)-1; ++ } ++ ++ if (IS_ACX100(adev)) { ++ txrate_cfg &= RATE111_ACX100_COMPAT; ++ if (!txrate_cfg) { ++ result = -ENOTSUPP; /* rate is not supported by acx100 */ ++ goto end; ++ } ++ } ++ ++ acx_sem_lock(adev); ++ acx_lock(adev, flags); ++ ++ adev->rate_auto = autorate; ++ adev->rate_oper = txrate_cfg; ++ adev->rate_basic = txrate_cfg; ++ /* only do that in auto mode, non-auto will be able to use ++ * one specific Tx rate only anyway */ ++ if (autorate) { ++ /* only use 802.11b base rates, for standard 802.11b H/W ++ * compatibility */ ++ adev->rate_basic &= RATE111_80211B_COMPAT; ++ } ++ adev->rate_bcast = 1 << lowest_bit(txrate_cfg); ++ if (IS_ACX100(adev)) ++ adev->rate_bcast100 = acx_rate111to100(adev->rate_bcast); ++ acx_l_update_ratevector(adev); ++ acx_l_update_client_rates(adev, txrate_cfg); ++ ++ /* Do/don't do tx rate fallback; beacon contents and rate */ ++ SET_BIT(adev->set_mask, SET_RATE_FALLBACK|SET_TEMPLATES); ++ result = -EINPROGRESS; ++ ++ acx_unlock(adev, flags); ++ acx_sem_unlock(adev); ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_get_rate ++*/ ++static int ++acx_ioctl_get_rate( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->param; ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ u16 rate; ++ ++ acx_lock(adev, flags); ++ rate = adev->rate_oper; ++ if (adev->ap_client) ++ rate = adev->ap_client->rate_cur; ++ vwrq->value = acx111_rate_tbl[highest_bit(rate)]; ++ vwrq->fixed = !adev->rate_auto; ++ vwrq->disabled = 0; ++ acx_unlock(adev, flags); ++ ++ return OK; ++} ++ ++static int ++acx_ioctl_set_rts( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->rts; ++ acx_device_t *adev = ndev2adev(ndev); ++ int val = vwrq->value; ++ ++ if (vwrq->disabled) ++ val = 2312; ++ if ((val < 0) || (val > 2312)) ++ return -EINVAL; ++ ++ adev->rts_threshold = val; ++ return OK; ++} ++ ++static inline int ++acx_ioctl_get_rts( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->rts; ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ vwrq->value = adev->rts_threshold; ++ vwrq->disabled = (vwrq->value >= 2312); ++ vwrq->fixed = 1; ++ return OK; ++} ++ ++ ++#if ACX_FRAGMENTATION ++static int ++acx_ioctl_set_frag( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ struct iw_param *vwrq, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int val = vwrq->value; ++ ++ if (vwrq->disabled) ++ val = 32767; ++ else ++ if ((val < 256) || (val > 2347)) ++ return -EINVAL; ++ ++ adev->frag_threshold = val; ++ return OK; ++} ++ ++static inline int ++acx_ioctl_get_frag( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->frag; ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ vwrq->value = adev->frag_threshold; ++ vwrq->disabled = (vwrq->value >= 2347); ++ vwrq->fixed = 1; ++ return OK; ++} ++#endif ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_encode ++*/ ++static int ++acx_ioctl_set_encode( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_point *dwrq = &wrqu->encoding; ++ acx_device_t *adev = ndev2adev(ndev); ++ int index; ++ int result; ++ ++ FN_ENTER; ++ ++ log(L_IOCTL, "set encoding flags=0x%04X, size=%d, key: %s\n", ++ dwrq->flags, dwrq->length, extra ? "set" : "No key"); ++ ++ acx_sem_lock(adev); ++ ++ index = (dwrq->flags & IW_ENCODE_INDEX) - 1; ++ ++ if (dwrq->length > 0) { ++ /* if index is 0 or invalid, use default key */ ++ if ((index < 0) || (index > 3)) ++ index = (int)adev->wep_current_index; ++ ++ if (0 == (dwrq->flags & IW_ENCODE_NOKEY)) { ++ if (dwrq->length > 29) ++ dwrq->length = 29; /* restrict it */ ++ ++ if (dwrq->length > 13) { ++ /* 29*8 == 232, WEP256 */ ++ adev->wep_keys[index].size = 29; ++ } else if (dwrq->length > 5) { ++ /* 13*8 == 104bit, WEP128 */ ++ adev->wep_keys[index].size = 13; ++ } else if (dwrq->length > 0) { ++ /* 5*8 == 40bit, WEP64 */ ++ adev->wep_keys[index].size = 5; ++ } else { ++ /* disable key */ ++ adev->wep_keys[index].size = 0; ++ } ++ ++ memset(adev->wep_keys[index].key, 0, ++ sizeof(adev->wep_keys[index].key)); ++ memcpy(adev->wep_keys[index].key, extra, dwrq->length); ++ } ++ } else { ++ /* set transmit key */ ++ if ((index >= 0) && (index <= 3)) ++ adev->wep_current_index = index; ++ else if (0 == (dwrq->flags & IW_ENCODE_MODE)) { ++ /* complain if we were not just setting ++ * the key mode */ ++ result = -EINVAL; ++ goto end_unlock; ++ } ++ } ++ ++ adev->wep_enabled = !(dwrq->flags & IW_ENCODE_DISABLED); ++ ++ if (dwrq->flags & IW_ENCODE_OPEN) { ++ adev->auth_alg = WLAN_AUTH_ALG_OPENSYSTEM; ++ adev->wep_restricted = 0; ++ ++ } else if (dwrq->flags & IW_ENCODE_RESTRICTED) { ++ adev->auth_alg = WLAN_AUTH_ALG_SHAREDKEY; ++ adev->wep_restricted = 1; ++ } ++ ++ /* set flag to make sure the card WEP settings get updated */ ++ SET_BIT(adev->set_mask, GETSET_WEP); ++ ++ log(L_IOCTL, "len=%d, key at 0x%p, flags=0x%X\n", ++ dwrq->length, extra, dwrq->flags); ++ ++ for (index = 0; index <= 3; index++) { ++ if (adev->wep_keys[index].size) { ++ log(L_IOCTL, "index=%d, size=%d, key at 0x%p\n", ++ adev->wep_keys[index].index, ++ (int) adev->wep_keys[index].size, ++ adev->wep_keys[index].key); ++ } ++ } ++ result = -EINPROGRESS; ++ ++end_unlock: ++ acx_sem_unlock(adev); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_get_encode ++*/ ++static int ++acx_ioctl_get_encode( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_point *dwrq = &wrqu->encoding; ++ acx_device_t *adev = ndev2adev(ndev); ++ int index = (dwrq->flags & IW_ENCODE_INDEX) - 1; ++ ++ FN_ENTER; ++ ++ if (adev->wep_enabled == 0) { ++ dwrq->flags = IW_ENCODE_DISABLED; ++ } else { ++ if ((index < 0) || (index > 3)) ++ index = (int)adev->wep_current_index; ++ ++ dwrq->flags = (adev->wep_restricted == 1) ? ++ IW_ENCODE_RESTRICTED : IW_ENCODE_OPEN; ++ dwrq->length = adev->wep_keys[index].size; ++ ++ memcpy(extra, adev->wep_keys[index].key, ++ adev->wep_keys[index].size); ++ } ++ ++ /* set the current index */ ++ SET_BIT(dwrq->flags, index + 1); ++ ++ log(L_IOCTL, "len=%d, key=%p, flags=0x%X\n", ++ dwrq->length, dwrq->pointer, ++ dwrq->flags); ++ ++ FN_EXIT1(OK); ++ return OK; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx_ioctl_set_power( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->power; ++ acx_device_t *adev = ndev2adev(ndev); ++ int result = -EINPROGRESS; ++ ++ FN_ENTER; ++ ++ log(L_IOCTL, "set 802.11 powersave flags=0x%04X\n", vwrq->flags); ++ ++ acx_sem_lock(adev); ++ ++ if (vwrq->disabled) { ++ CLEAR_BIT(adev->ps_wakeup_cfg, PS_CFG_ENABLE); ++ SET_BIT(adev->set_mask, GETSET_POWER_80211); ++ goto end; ++ } ++ if ((vwrq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) { ++ u16 ps_timeout = (vwrq->value * 1024) / 1000; ++ ++ if (ps_timeout > 255) ++ ps_timeout = 255; ++ log(L_IOCTL, "setting PS timeout value to %d time units " ++ "due to %dus\n", ps_timeout, vwrq->value); ++ adev->ps_hangover_period = ps_timeout; ++ } else if ((vwrq->flags & IW_POWER_TYPE) == IW_POWER_PERIOD) { ++ u16 ps_periods = vwrq->value / 1000000; ++ ++ if (ps_periods > 255) ++ ps_periods = 255; ++ log(L_IOCTL, "setting PS period value to %d periods " ++ "due to %dus\n", ps_periods, vwrq->value); ++ adev->ps_listen_interval = ps_periods; ++ CLEAR_BIT(adev->ps_wakeup_cfg, PS_CFG_WAKEUP_MODE_MASK); ++ SET_BIT(adev->ps_wakeup_cfg, PS_CFG_WAKEUP_EACH_ITVL); ++ } ++ ++ switch (vwrq->flags & IW_POWER_MODE) { ++ /* FIXME: are we doing the right thing here? */ ++ case IW_POWER_UNICAST_R: ++ CLEAR_BIT(adev->ps_options, PS_OPT_STILL_RCV_BCASTS); ++ break; ++ case IW_POWER_MULTICAST_R: ++ SET_BIT(adev->ps_options, PS_OPT_STILL_RCV_BCASTS); ++ break; ++ case IW_POWER_ALL_R: ++ SET_BIT(adev->ps_options, PS_OPT_STILL_RCV_BCASTS); ++ break; ++ case IW_POWER_ON: ++ break; ++ default: ++ log(L_IOCTL, "unknown PS mode\n"); ++ result = -EINVAL; ++ goto end; ++ } ++ ++ SET_BIT(adev->ps_wakeup_cfg, PS_CFG_ENABLE); ++ SET_BIT(adev->set_mask, GETSET_POWER_80211); ++end: ++ acx_sem_unlock(adev); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx_ioctl_get_power( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->power; ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ FN_ENTER; ++ ++ log(L_IOCTL, "Get 802.11 Power Save flags = 0x%04X\n", vwrq->flags); ++ vwrq->disabled = ((adev->ps_wakeup_cfg & PS_CFG_ENABLE) == 0); ++ if (vwrq->disabled) ++ goto end; ++ ++ if ((vwrq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) { ++ vwrq->value = adev->ps_hangover_period * 1000 / 1024; ++ vwrq->flags = IW_POWER_TIMEOUT; ++ } else { ++ vwrq->value = adev->ps_listen_interval * 1000000; ++ vwrq->flags = IW_POWER_PERIOD|IW_POWER_RELATIVE; ++ } ++ if (adev->ps_options & PS_OPT_STILL_RCV_BCASTS) ++ SET_BIT(vwrq->flags, IW_POWER_ALL_R); ++ else ++ SET_BIT(vwrq->flags, IW_POWER_UNICAST_R); ++end: ++ FN_EXIT1(OK); ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_get_txpow ++*/ ++static inline int ++acx_ioctl_get_txpow( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->power; ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ FN_ENTER; ++ ++ vwrq->flags = IW_TXPOW_DBM; ++ vwrq->disabled = 0; ++ vwrq->fixed = 1; ++ vwrq->value = adev->tx_level_dbm; ++ ++ log(L_IOCTL, "get txpower:%d dBm\n", adev->tx_level_dbm); ++ ++ FN_EXIT1(OK); ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_txpow ++*/ ++static int ++acx_ioctl_set_txpow( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->power; ++ acx_device_t *adev = ndev2adev(ndev); ++ int result; ++ ++ FN_ENTER; ++ ++ log(L_IOCTL, "set txpower:%d, disabled:%d, flags:0x%04X\n", ++ vwrq->value, vwrq->disabled, vwrq->flags); ++ ++ acx_sem_lock(adev); ++ ++ if (vwrq->disabled != adev->tx_disabled) { ++ SET_BIT(adev->set_mask, GETSET_TX); ++ } ++ ++ adev->tx_disabled = vwrq->disabled; ++ if (vwrq->value == -1) { ++ if (vwrq->disabled) { ++ adev->tx_level_dbm = 0; ++ log(L_IOCTL, "disable radio tx\n"); ++ } else { ++ /* adev->tx_level_auto = 1; */ ++ log(L_IOCTL, "set tx power auto (NIY)\n"); ++ } ++ } else { ++ adev->tx_level_dbm = vwrq->value <= 20 ? vwrq->value : 20; ++ /* adev->tx_level_auto = 0; */ ++ log(L_IOCTL, "set txpower=%d dBm\n", adev->tx_level_dbm); ++ } ++ SET_BIT(adev->set_mask, GETSET_TXPOWER); ++ ++ result = -EINPROGRESS; ++ ++ acx_sem_unlock(adev); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_get_range ++*/ ++static int ++acx_ioctl_get_range( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_point *dwrq = &wrqu->data; ++ struct iw_range *range = (struct iw_range *)extra; ++ acx_device_t *adev = ndev2adev(ndev); ++ int i,n; ++ ++ FN_ENTER; ++ ++ if (!dwrq->pointer) ++ goto end; ++ ++ dwrq->length = sizeof(struct iw_range); ++ memset(range, 0, sizeof(struct iw_range)); ++ n = 0; ++ for (i = 1; i <= 14; i++) { ++ if (adev->reg_dom_chanmask & (1 << (i - 1))) { ++ range->freq[n].i = i; ++ range->freq[n].m = acx_channel_freq[i - 1] * 100000; ++ range->freq[n].e = 1; /* units are MHz */ ++ n++; ++ } ++ } ++ range->num_channels = n; ++ range->num_frequency = n; ++ ++ range->min_rts = 0; ++ range->max_rts = 2312; ++ ++#if ACX_FRAGMENTATION ++ range->min_frag = 256; ++ range->max_frag = 2312; ++#endif ++ ++ range->encoding_size[0] = 5; ++ range->encoding_size[1] = 13; ++ range->encoding_size[2] = 29; ++ range->num_encoding_sizes = 3; ++ range->max_encoding_tokens = 4; ++ ++ range->min_pmp = 0; ++ range->max_pmp = 5000000; ++ range->min_pmt = 0; ++ range->max_pmt = 65535 * 1000; ++ range->pmp_flags = IW_POWER_PERIOD; ++ range->pmt_flags = IW_POWER_TIMEOUT; ++ range->pm_capa = IW_POWER_PERIOD | IW_POWER_TIMEOUT | IW_POWER_ALL_R; ++ ++ if (IS_ACX100(adev)) { /* ACX100 has direct radio programming - arbitrary levels, so offer a lot */ ++ for (i = 0; i <= IW_MAX_TXPOWER - 1; i++) ++ range->txpower[i] = 20 * i / (IW_MAX_TXPOWER - 1); ++ range->num_txpower = IW_MAX_TXPOWER; ++ range->txpower_capa = IW_TXPOW_DBM; ++ } ++ else { ++ int count = min(IW_MAX_TXPOWER, (int)adev->cfgopt_power_levels.len); ++ for (i = 0; i <= count; i++) ++ range->txpower[i] = adev->cfgopt_power_levels.list[i]; ++ range->num_txpower = count; ++ /* this list is given in mW */ ++ range->txpower_capa = IW_TXPOW_MWATT; ++ } ++ ++ range->we_version_compiled = WIRELESS_EXT; ++ range->we_version_source = 0x9; ++ ++ range->retry_capa = IW_RETRY_LIMIT; ++ range->retry_flags = IW_RETRY_LIMIT; ++ range->min_retry = 1; ++ range->max_retry = 255; ++ ++ range->r_time_flags = IW_RETRY_LIFETIME; ++ range->min_r_time = 0; ++ /* FIXME: lifetime ranges and orders of magnitude are strange?? */ ++ range->max_r_time = 65535; ++ ++ if (IS_USB(adev)) ++ range->sensitivity = 0; ++ else if (IS_ACX111(adev)) ++ range->sensitivity = 3; ++ else ++ range->sensitivity = 255; ++ ++ for (i=0; i < adev->rate_supported_len; i++) { ++ range->bitrate[i] = (adev->rate_supported[i] & ~0x80) * 500000; ++ /* never happens, but keep it, to be safe: */ ++ if (range->bitrate[i] == 0) ++ break; ++ } ++ range->num_bitrates = i; ++ ++ range->max_qual.qual = 100; ++ range->max_qual.level = 100; ++ range->max_qual.noise = 100; ++ /* TODO: better values */ ++ range->avg_qual.qual = 90; ++ range->avg_qual.level = 80; ++ range->avg_qual.noise = 2; ++ ++end: ++ FN_EXIT1(OK); ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** Private functions ++*/ ++ ++/*********************************************************************** ++** acx_ioctl_get_nick ++*/ ++static inline int ++acx_ioctl_get_nick( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_point *dwrq = &wrqu->data; ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ strcpy(extra, adev->nick); ++ dwrq->length = strlen(extra) + 1; ++ ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_nick ++*/ ++static int ++acx_ioctl_set_nick( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_point *dwrq = &wrqu->data; ++ acx_device_t *adev = ndev2adev(ndev); ++ int result; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ if (dwrq->length > IW_ESSID_MAX_SIZE + 1) { ++ result = -E2BIG; ++ goto end_unlock; ++ } ++ ++ /* extra includes trailing \0, so it's ok */ ++ strcpy(adev->nick, extra); ++ result = OK; ++ ++end_unlock: ++ acx_sem_unlock(adev); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_get_retry ++*/ ++static int ++acx_ioctl_get_retry( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->retry; ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned int type = vwrq->flags & IW_RETRY_TYPE; ++ unsigned int modifier = vwrq->flags & IW_RETRY_MODIFIER; ++ int result; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ /* return the short retry number by default */ ++ if (type == IW_RETRY_LIFETIME) { ++ vwrq->flags = IW_RETRY_LIFETIME; ++ vwrq->value = adev->msdu_lifetime; ++ } else if (modifier == IW_RETRY_MAX) { ++ vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_MAX; ++ vwrq->value = adev->long_retry; ++ } else { ++ vwrq->flags = IW_RETRY_LIMIT; ++ if (adev->long_retry != adev->short_retry) ++ SET_BIT(vwrq->flags, IW_RETRY_MIN); ++ vwrq->value = adev->short_retry; ++ } ++ ++ /* can't be disabled */ ++ vwrq->disabled = (u8)0; ++ result = OK; ++ ++ acx_sem_unlock(adev); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_retry ++*/ ++static int ++acx_ioctl_set_retry( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->retry; ++ acx_device_t *adev = ndev2adev(ndev); ++ int result; ++ ++ FN_ENTER; ++ ++ if (!vwrq) { ++ result = -EFAULT; ++ goto end; ++ } ++ if (vwrq->disabled) { ++ result = -EINVAL; ++ goto end; ++ } ++ ++ acx_sem_lock(adev); ++ ++ result = -EINVAL; ++ if (IW_RETRY_LIMIT == (vwrq->flags & IW_RETRY_TYPE)) { ++ printk("old retry limits: short %d long %d\n", ++ adev->short_retry, adev->long_retry); ++ if (vwrq->flags & IW_RETRY_MAX) { ++ adev->long_retry = vwrq->value; ++ } else if (vwrq->flags & IW_RETRY_MIN) { ++ adev->short_retry = vwrq->value; ++ } else { ++ /* no modifier: set both */ ++ adev->long_retry = vwrq->value; ++ adev->short_retry = vwrq->value; ++ } ++ printk("new retry limits: short %d long %d\n", ++ adev->short_retry, adev->long_retry); ++ SET_BIT(adev->set_mask, GETSET_RETRY); ++ result = -EINPROGRESS; ++ } ++ else if (vwrq->flags & IW_RETRY_LIFETIME) { ++ adev->msdu_lifetime = vwrq->value; ++ printk("new MSDU lifetime: %d\n", adev->msdu_lifetime); ++ SET_BIT(adev->set_mask, SET_MSDU_LIFETIME); ++ result = -EINPROGRESS; ++ } ++ ++ acx_sem_unlock(adev); ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/************************ private ioctls ******************************/ ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_debug ++*/ ++#if ACX_DEBUG ++static int ++acx_ioctl_set_debug( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ unsigned int debug_new = *((unsigned int *)extra); ++ int result = -EINVAL; ++ ++ log(L_ANY, "setting debug from %04X to %04X\n", acx_debug, debug_new); ++ acx_debug = debug_new; ++ ++ result = OK; ++ return result; ++ ++} ++#endif ++ ++ ++/*********************************************************************** ++** acx_ioctl_list_reg_domain ++*/ ++static int ++acx_ioctl_list_reg_domain( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ int i = 1; ++ const char * const *entry = acx_reg_domain_strings; ++ ++ printk("dom# chan# domain/country\n"); ++ while (*entry) ++ printk("%4d %s\n", i++, *entry++); ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_reg_domain ++*/ ++static int ++acx_ioctl_set_reg_domain( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result; ++ ++ FN_ENTER; ++ ++ if ((*extra < 1) || ((size_t)*extra > acx_reg_domain_ids_len)) { ++ result = -EINVAL; ++ goto end; ++ } ++ ++ acx_sem_lock(adev); ++ ++ adev->reg_dom_id = acx_reg_domain_ids[*extra - 1]; ++ SET_BIT(adev->set_mask, GETSET_REG_DOMAIN); ++ ++ result = -EINPROGRESS; ++ ++ acx_sem_unlock(adev); ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_get_reg_domain ++*/ ++static int ++acx_ioctl_get_reg_domain( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int dom,i; ++ ++ /* no locking */ ++ dom = adev->reg_dom_id; ++ ++ for (i = 1; i <= acx_reg_domain_ids_len; i++) { ++ if (acx_reg_domain_ids[i-1] == dom) { ++ log(L_IOCTL, "regulatory domain is currently set " ++ "to %d (0x%X): %s\n", i, dom, ++ acx_reg_domain_strings[i-1]); ++ *extra = i; ++ break; ++ } ++ } ++ ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_short_preamble ++*/ ++static const char * const ++preamble_modes[] = { ++ "off", ++ "on", ++ "auto (peer capability dependent)", ++ "unknown mode, error" ++}; ++ ++static int ++acx_ioctl_set_short_preamble( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int i; ++ int result; ++ ++ FN_ENTER; ++ ++ if ((unsigned char)*extra > 2) { ++ result = -EINVAL; ++ goto end; ++ } ++ ++ acx_sem_lock(adev); ++ ++ adev->preamble_mode = (u8)*extra; ++ switch (adev->preamble_mode) { ++ case 0: /* long */ ++ adev->preamble_cur = 0; ++ break; ++ case 1: ++ /* short, kick incapable peers */ ++ adev->preamble_cur = 1; ++ for (i = 0; i < VEC_SIZE(adev->sta_list); i++) { ++ client_t *clt = &adev->sta_list[i]; ++ if (!clt->used) continue; ++ if (!(clt->cap_info & WF_MGMT_CAP_SHORT)) { ++ clt->used = CLIENT_EMPTY_SLOT_0; ++ } ++ } ++ switch (adev->mode) { ++ case ACX_MODE_2_STA: ++ if (adev->ap_client && !adev->ap_client->used) { ++ /* We kicked our AP :) */ ++ SET_BIT(adev->set_mask, GETSET_RESCAN); ++ } ++ } ++ break; ++ case 2: /* auto. short only if all peers are short-capable */ ++ adev->preamble_cur = 1; ++ for (i = 0; i < VEC_SIZE(adev->sta_list); i++) { ++ client_t *clt = &adev->sta_list[i]; ++ if (!clt->used) continue; ++ if (!(clt->cap_info & WF_MGMT_CAP_SHORT)) { ++ adev->preamble_cur = 0; ++ break; ++ } ++ } ++ break; ++ } ++ printk("new short preamble setting: configured %s, active %s\n", ++ preamble_modes[adev->preamble_mode], ++ preamble_modes[adev->preamble_cur]); ++ result = OK; ++ ++ acx_sem_unlock(adev); ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_get_short_preamble ++*/ ++static int ++acx_ioctl_get_short_preamble( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ acx_sem_lock(adev); ++ ++ printk("current short preamble setting: configured %s, active %s\n", ++ preamble_modes[adev->preamble_mode], ++ preamble_modes[adev->preamble_cur]); ++ ++ *extra = (char)adev->preamble_mode; ++ ++ acx_sem_unlock(adev); ++ ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_antenna ++** ++** TX and RX antenna can be set separately but this function good ++** for testing 0-4 bits ++*/ ++static int ++acx_ioctl_set_antenna( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ acx_sem_lock(adev); ++ ++ printk("old antenna value: 0x%02X (COMBINED bit mask)\n" ++ "Rx antenna selection:\n" ++ "0x00 ant. 1\n" ++ "0x40 ant. 2\n" ++ "0x80 full diversity\n" ++ "0xc0 partial diversity\n" ++ "0x0f dwell time mask (in units of us)\n" ++ "Tx antenna selection:\n" ++ "0x00 ant. 2\n" /* yep, those ARE reversed! */ ++ "0x20 ant. 1\n" ++ "new antenna value: 0x%02X\n", ++ adev->antenna, (u8)*extra); ++ ++ adev->antenna = (u8)*extra; ++ SET_BIT(adev->set_mask, GETSET_ANTENNA); ++ ++ acx_sem_unlock(adev); ++ ++ return -EINPROGRESS; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_get_antenna ++*/ ++static int ++acx_ioctl_get_antenna( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ /* no locking. it's pointless to lock a single load */ ++ printk("current antenna value: 0x%02X (COMBINED bit mask)\n" ++ "Rx antenna selection:\n" ++ "0x00 ant. 1\n" ++ "0x40 ant. 2\n" ++ "0x80 full diversity\n" ++ "0xc0 partial diversity\n" ++ "Tx antenna selection:\n" ++ "0x00 ant. 2\n" /* yep, those ARE reversed! */ ++ "0x20 ant. 1\n", adev->antenna); ++ ++ return 0; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_rx_antenna ++** ++** 0 = antenna1; 1 = antenna2; 2 = full diversity; 3 = partial diversity ++** Could anybody test which antenna is the external one? ++*/ ++static int ++acx_ioctl_set_rx_antenna( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result; ++ ++ FN_ENTER; ++ ++ if (*extra > 3) { ++ result = -EINVAL; ++ goto end; ++ } ++ ++ printk("old antenna value: 0x%02X\n", adev->antenna); ++ ++ acx_sem_lock(adev); ++ ++ adev->antenna &= 0x3f; ++ SET_BIT(adev->antenna, (*extra << 6)); ++ SET_BIT(adev->set_mask, GETSET_ANTENNA); ++ printk("new antenna value: 0x%02X\n", adev->antenna); ++ result = -EINPROGRESS; ++ ++ acx_sem_unlock(adev); ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_tx_antenna ++** ++** Arguments: 0 == antenna2; 1 == antenna1; ++** Could anybody test which antenna is the external one? ++*/ ++static int ++acx_ioctl_set_tx_antenna( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result; ++ ++ FN_ENTER; ++ ++ if (*extra > 1) { ++ result = -EINVAL; ++ goto end; ++ } ++ ++ printk("old antenna value: 0x%02X\n", adev->antenna); ++ ++ acx_sem_lock(adev); ++ ++ adev->antenna &= ~0x30; ++ SET_BIT(adev->antenna, ((*extra & 0x01) << 5)); ++ SET_BIT(adev->set_mask, GETSET_ANTENNA); ++ printk("new antenna value: 0x%02X\n", adev->antenna); ++ result = -EINPROGRESS; ++ ++ acx_sem_unlock(adev); ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_wlansniff ++** ++** can we just remove this in favor of monitor mode? --vda ++*/ ++static int ++acx_ioctl_wlansniff( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned int *params = (unsigned int*)extra; ++ unsigned int enable = (unsigned int)(params[0] > 0); ++ int result; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ /* not using printk() here, since it distorts kismet display ++ * when printk messages activated */ ++ log(L_IOCTL, "setting monitor to: 0x%02X\n", params[0]); ++ ++ switch (params[0]) { ++ case 0: ++ /* no monitor mode. hmm, should we simply ignore it ++ * or go back to enabling adev->netdev->type ARPHRD_ETHER? */ ++ break; ++ case 1: ++ adev->monitor_type = ARPHRD_IEEE80211_PRISM; ++ break; ++ case 2: ++ adev->monitor_type = ARPHRD_IEEE80211; ++ break; ++ } ++ ++ if (params[0]) { ++ adev->mode = ACX_MODE_MONITOR; ++ SET_BIT(adev->set_mask, GETSET_MODE); ++ } ++ ++ if (enable) { ++ adev->channel = params[1]; ++ SET_BIT(adev->set_mask, GETSET_RX); ++ } ++ result = -EINPROGRESS; ++ ++ acx_sem_unlock(adev); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_unknown11 ++** FIXME: looks like some sort of "iwpriv kick_sta MAC" but it's broken ++*/ ++static int ++acx_ioctl_unknown11( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++#ifdef BROKEN ++ struct iw_param *vwrq = &wrqu->param; ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ client_t client; ++ int result; ++ ++ acx_sem_lock(adev); ++ acx_lock(adev, flags); ++ ++ acx_l_transmit_disassoc(adev, &client); ++ result = OK; ++ ++ acx_unlock(adev, flags); ++ acx_sem_unlock(adev); ++ ++ return result; ++#endif ++ return -EINVAL; ++} ++ ++ ++/*********************************************************************** ++** debug helper function to be able to debug various issues relatively easily ++*/ ++static int ++acx_ioctl_dbg_set_masks( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ const unsigned int *params = (unsigned int*)extra; ++ int result; ++ ++ acx_sem_lock(adev); ++ ++ log(L_IOCTL, "setting flags in settings mask: " ++ "get_mask %08X set_mask %08X\n" ++ "before: get_mask %08X set_mask %08X\n", ++ params[0], params[1], ++ adev->get_mask, adev->set_mask); ++ SET_BIT(adev->get_mask, params[0]); ++ SET_BIT(adev->set_mask, params[1]); ++ log(L_IOCTL, "after: get_mask %08X set_mask %08X\n", ++ adev->get_mask, adev->set_mask); ++ result = -EINPROGRESS; /* immediately call commit handler */ ++ ++ acx_sem_unlock(adev); ++ ++ return result; ++} ++ ++ ++/*********************************************************************** ++* acx_ioctl_set_rates ++* ++* This ioctl takes string parameter. Examples: ++* iwpriv wlan0 SetRates "1,2" ++* use 1 and 2 Mbit rates, both are in basic rate set ++* iwpriv wlan0 SetRates "1,2 5,11" ++* use 1,2,5.5,11 Mbit rates. 1 and 2 are basic ++* iwpriv wlan0 SetRates "1,2 5c,11c" ++* same ('c' means 'CCK modulation' and it is a default for 5 and 11) ++* iwpriv wlan0 SetRates "1,2 5p,11p" ++* use 1,2,5.5,11 Mbit, 1,2 are basic. 5 and 11 are using PBCC ++* iwpriv wlan0 SetRates "1,2,5,11 22p" ++* use 1,2,5.5,11,22 Mbit. 1,2,5.5 and 11 are basic. 22 is using PBCC ++* (this is the maximum acx100 can do (modulo x4 mode)) ++* iwpriv wlan0 SetRates "1,2,5,11 22" ++* same. 802.11 defines only PBCC modulation ++* for 22 and 33 Mbit rates, so there is no ambiguity ++* iwpriv wlan0 SetRates "1,2,5,11 6o,9o,12o,18o,24o,36o,48o,54o" ++* 1,2,5.5 and 11 are basic. 11g OFDM rates are enabled but ++* they are not in basic rate set. 22 Mbit is disabled. ++* iwpriv wlan0 SetRates "1,2,5,11 6,9,12,18,24,36,48,54" ++* same. OFDM is default for 11g rates except 22 and 33 Mbit, ++* thus 'o' is optional ++* iwpriv wlan0 SetRates "1,2,5,11 6d,9d,12d,18d,24d,36d,48d,54d" ++* 1,2,5.5 and 11 are basic. 11g CCK-OFDM rates are enabled ++* (acx111 does not support CCK-OFDM, driver will reject this cmd) ++* iwpriv wlan0 SetRates "6,9,12 18,24,36,48,54" ++* 6,9,12 are basic, rest of 11g rates is enabled. Using OFDM ++*/ ++#include "setrate.c" ++ ++/* disallow: 33Mbit (unsupported by hw) */ ++/* disallow: CCKOFDM (unsupported by hw) */ ++static int ++acx111_supported(int mbit, int modulation, void *opaque) ++{ ++ if (mbit==33) return -ENOTSUPP; ++ if (modulation==DOT11_MOD_CCKOFDM) return -ENOTSUPP; ++ return OK; ++} ++ ++static const u16 ++acx111mask[] = { ++ [DOT11_RATE_1 ] = RATE111_1 , ++ [DOT11_RATE_2 ] = RATE111_2 , ++ [DOT11_RATE_5 ] = RATE111_5 , ++ [DOT11_RATE_11] = RATE111_11, ++ [DOT11_RATE_22] = RATE111_22, ++ /* [DOT11_RATE_33] = */ ++ [DOT11_RATE_6 ] = RATE111_6 , ++ [DOT11_RATE_9 ] = RATE111_9 , ++ [DOT11_RATE_12] = RATE111_12, ++ [DOT11_RATE_18] = RATE111_18, ++ [DOT11_RATE_24] = RATE111_24, ++ [DOT11_RATE_36] = RATE111_36, ++ [DOT11_RATE_48] = RATE111_48, ++ [DOT11_RATE_54] = RATE111_54, ++}; ++ ++static u32 ++acx111_gen_mask(int mbit, int modulation, void *opaque) ++{ ++ /* lower 16 bits show selected 1, 2, CCK and OFDM rates */ ++ /* upper 16 bits show selected PBCC rates */ ++ u32 m = acx111mask[rate_mbit2enum(mbit)]; ++ if (modulation==DOT11_MOD_PBCC) ++ return m<<16; ++ return m; ++} ++ ++static int ++verify_rate(u32 rate, int chip_type) ++{ ++ /* never happens. be paranoid */ ++ if (!rate) return -EINVAL; ++ ++ /* disallow: mixing PBCC and CCK at 5 and 11Mbit ++ ** (can be supported, but needs complicated handling in tx code) */ ++ if (( rate & ((RATE111_11+RATE111_5)<<16) ) ++ && ( rate & (RATE111_11+RATE111_5) ) ++ ) { ++ return -ENOTSUPP; ++ } ++ if (CHIPTYPE_ACX100 == chip_type) { ++ if ( rate & ~(RATE111_ACX100_COMPAT+(RATE111_ACX100_COMPAT<<16)) ) ++ return -ENOTSUPP; ++ } ++ return 0; ++} ++ ++static int ++acx_ioctl_set_rates(struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ int result; ++ u32 brate = 0, orate = 0; /* basic, operational rate set */ ++ ++ FN_ENTER; ++ ++ log(L_IOCTL, "set_rates %s\n", extra); ++ result = fill_ratemasks(extra, &brate, &orate, ++ acx111_supported, acx111_gen_mask, 0); ++ if (result) goto end; ++ SET_BIT(orate, brate); ++ log(L_IOCTL, "brate %08X orate %08X\n", brate, orate); ++ ++ result = verify_rate(brate, adev->chip_type); ++ if (result) goto end; ++ result = verify_rate(orate, adev->chip_type); ++ if (result) goto end; ++ ++ acx_sem_lock(adev); ++ acx_lock(adev, flags); ++ ++ adev->rate_basic = brate; ++ adev->rate_oper = orate; ++ /* TODO: ideally, we shall monitor highest basic rate ++ ** which was successfully sent to every peer ++ ** (say, last we checked, everybody could hear 5.5 Mbits) ++ ** and use that for bcasts when we want to reach all peers. ++ ** For beacons, we probably shall use lowest basic rate ++ ** because we want to reach all *potential* new peers too */ ++ adev->rate_bcast = 1 << lowest_bit(brate); ++ if (IS_ACX100(adev)) ++ adev->rate_bcast100 = acx_rate111to100(adev->rate_bcast); ++ adev->rate_auto = !has_only_one_bit(orate); ++ acx_l_update_client_rates(adev, orate); ++ /* TODO: get rid of ratevector, build it only when needed */ ++ acx_l_update_ratevector(adev); ++ ++ /* Do/don't do tx rate fallback; beacon contents and rate */ ++ SET_BIT(adev->set_mask, SET_RATE_FALLBACK|SET_TEMPLATES); ++ result = -EINPROGRESS; ++ ++ acx_unlock(adev, flags); ++ acx_sem_unlock(adev); ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_get_phy_chan_busy_percentage ++*/ ++static int ++acx_ioctl_get_phy_chan_busy_percentage( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ struct { ++ u16 type; ++ u16 len; ++ u32 busytime; ++ u32 totaltime; ++ } ACX_PACKED usage; ++ int result; ++ ++ acx_sem_lock(adev); ++ ++ if (OK != acx_s_interrogate(adev, &usage, ACX1xx_IE_MEDIUM_USAGE)) { ++ result = NOT_OK; ++ goto end_unlock; ++ } ++ ++ usage.busytime = le32_to_cpu(usage.busytime); ++ usage.totaltime = le32_to_cpu(usage.totaltime); ++ ++ /* yes, this is supposed to be "Medium" (singular of media), ++ not "average"! OK, reword the message to make it obvious... */ ++ printk("%s: busy percentage of medium (since last invocation): %d%% " ++ "(%u of %u microseconds)\n", ++ ndev->name, ++ usage.busytime / ((usage.totaltime / 100) + 1), ++ usage.busytime, usage.totaltime); ++ ++ result = OK; ++ ++end_unlock: ++ acx_sem_unlock(adev); ++ ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_ed_threshold ++*/ ++static inline int ++acx_ioctl_set_ed_threshold( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ acx_sem_lock(adev); ++ ++ printk("old ED threshold value: %d\n", adev->ed_threshold); ++ adev->ed_threshold = (unsigned char)*extra; ++ printk("new ED threshold value: %d\n", (unsigned char)*extra); ++ SET_BIT(adev->set_mask, GETSET_ED_THRESH); ++ ++ acx_sem_unlock(adev); ++ ++ return -EINPROGRESS; ++} ++ ++ ++/*********************************************************************** ++** acx_ioctl_set_cca ++*/ ++static inline int ++acx_ioctl_set_cca( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result; ++ ++ acx_sem_lock(adev); ++ ++ printk("old CCA value: 0x%02X\n", adev->cca); ++ adev->cca = (unsigned char)*extra; ++ printk("new CCA value: 0x%02X\n", (unsigned char)*extra); ++ SET_BIT(adev->set_mask, GETSET_CCA); ++ result = -EINPROGRESS; ++ ++ acx_sem_unlock(adev); ++ ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++static const char * const ++scan_modes[] = { "active", "passive", "background" }; ++ ++static void ++acx_print_scan_params(acx_device_t *adev, const char* head) ++{ ++ printk("%s: %smode %d (%s), min chan time %dTU, " ++ "max chan time %dTU, max scan rate byte: %d\n", ++ adev->ndev->name, head, ++ adev->scan_mode, scan_modes[adev->scan_mode], ++ adev->scan_probe_delay, adev->scan_duration, adev->scan_rate); ++} ++ ++static int ++acx_ioctl_set_scan_params( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result; ++ const int *params = (int *)extra; ++ ++ acx_sem_lock(adev); ++ ++ acx_print_scan_params(adev, "old scan parameters: "); ++ if ((params[0] != -1) && (params[0] >= 0) && (params[0] <= 2)) ++ adev->scan_mode = params[0]; ++ if (params[1] != -1) ++ adev->scan_probe_delay = params[1]; ++ if (params[2] != -1) ++ adev->scan_duration = params[2]; ++ if ((params[3] != -1) && (params[3] <= 255)) ++ adev->scan_rate = params[3]; ++ acx_print_scan_params(adev, "new scan parameters: "); ++ SET_BIT(adev->set_mask, GETSET_RESCAN); ++ result = -EINPROGRESS; ++ ++ acx_sem_unlock(adev); ++ ++ return result; ++} ++ ++static int ++acx_ioctl_get_scan_params( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result; ++ int *params = (int *)extra; ++ ++ acx_sem_lock(adev); ++ ++ acx_print_scan_params(adev, "current scan parameters: "); ++ params[0] = adev->scan_mode; ++ params[1] = adev->scan_probe_delay; ++ params[2] = adev->scan_duration; ++ params[3] = adev->scan_rate; ++ result = OK; ++ ++ acx_sem_unlock(adev); ++ ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx100_ioctl_set_led_power( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ static const char * const led_modes[] = { "off", "on", "LinkQuality" }; ++ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result; ++ ++ acx_sem_lock(adev); ++ ++ printk("%s: power LED status: old %d (%s), ", ++ ndev->name, ++ adev->led_power, ++ led_modes[adev->led_power]); ++ adev->led_power = extra[0]; ++ if (adev->led_power > 2) adev->led_power = 2; ++ printk("new %d (%s)\n", ++ adev->led_power, ++ led_modes[adev->led_power]); ++ ++ if (adev->led_power == 2) { ++ printk("%s: max link quality setting: old %d, ", ++ ndev->name, adev->brange_max_quality); ++ if (extra[1]) ++ adev->brange_max_quality = extra[1]; ++ printk("new %d\n", adev->brange_max_quality); ++ } ++ ++ SET_BIT(adev->set_mask, GETSET_LED_POWER); ++ ++ result = -EINPROGRESS; ++ ++ acx_sem_unlock(adev); ++ ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++static inline int ++acx100_ioctl_get_led_power( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ acx_sem_lock(adev); ++ ++ extra[0] = adev->led_power; ++ if (adev->led_power == 2) ++ extra[1] = adev->brange_max_quality; ++ else ++ extra[1] = -1; ++ ++ acx_sem_unlock(adev); ++ ++ return OK; ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx111_ioctl_info( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->param; ++ if (!IS_PCI(ndev2adev(ndev))) ++ return OK; ++ return acx111pci_ioctl_info(ndev, info, vwrq, extra); ++} ++ ++ ++/*********************************************************************** ++*/ ++static int ++acx100_ioctl_set_phy_amp_bias( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ union iwreq_data *wrqu, ++ char *extra) ++{ ++ struct iw_param *vwrq = &wrqu->param; ++ if (IS_USB(ndev2adev(ndev))) { ++ printk("acx: set_phy_amp_bias() is not supported on USB\n"); ++ return OK; ++ } ++#ifdef ACX_MEM ++ return acx100mem_ioctl_set_phy_amp_bias(ndev, info, vwrq, extra); ++#else ++ return acx100pci_ioctl_set_phy_amp_bias(ndev, info, vwrq, extra); ++#endif ++} ++ ++ ++/*********************************************************************** ++*/ ++static const iw_handler acx_ioctl_handler[] = ++{ ++ acx_ioctl_commit, /* SIOCSIWCOMMIT */ ++ acx_ioctl_get_name, /* SIOCGIWNAME */ ++ NULL, /* SIOCSIWNWID */ ++ NULL, /* SIOCGIWNWID */ ++ acx_ioctl_set_freq, /* SIOCSIWFREQ */ ++ acx_ioctl_get_freq, /* SIOCGIWFREQ */ ++ acx_ioctl_set_mode, /* SIOCSIWMODE */ ++ acx_ioctl_get_mode, /* SIOCGIWMODE */ ++ acx_ioctl_set_sens, /* SIOCSIWSENS */ ++ acx_ioctl_get_sens, /* SIOCGIWSENS */ ++ NULL, /* SIOCSIWRANGE */ ++ acx_ioctl_get_range, /* SIOCGIWRANGE */ ++ NULL, /* SIOCSIWPRIV */ ++ NULL, /* SIOCGIWPRIV */ ++ NULL, /* SIOCSIWSTATS */ ++ NULL, /* SIOCGIWSTATS */ ++#if IW_HANDLER_VERSION > 4 ++ iw_handler_set_spy, /* SIOCSIWSPY */ ++ iw_handler_get_spy, /* SIOCGIWSPY */ ++ iw_handler_set_thrspy, /* SIOCSIWTHRSPY */ ++ iw_handler_get_thrspy, /* SIOCGIWTHRSPY */ ++#else /* IW_HANDLER_VERSION > 4 */ ++#ifdef WIRELESS_SPY ++ NULL /* acx_ioctl_set_spy FIXME */, /* SIOCSIWSPY */ ++ NULL /* acx_ioctl_get_spy */, /* SIOCGIWSPY */ ++#else /* WSPY */ ++ NULL, /* SIOCSIWSPY */ ++ NULL, /* SIOCGIWSPY */ ++#endif /* WSPY */ ++ NULL, /* [nothing] */ ++ NULL, /* [nothing] */ ++#endif /* IW_HANDLER_VERSION > 4 */ ++ acx_ioctl_set_ap, /* SIOCSIWAP */ ++ acx_ioctl_get_ap, /* SIOCGIWAP */ ++ NULL, /* [nothing] */ ++ acx_ioctl_get_aplist, /* SIOCGIWAPLIST */ ++ acx_ioctl_set_scan, /* SIOCSIWSCAN */ ++ acx_ioctl_get_scan, /* SIOCGIWSCAN */ ++ acx_ioctl_set_essid, /* SIOCSIWESSID */ ++ acx_ioctl_get_essid, /* SIOCGIWESSID */ ++ acx_ioctl_set_nick, /* SIOCSIWNICKN */ ++ acx_ioctl_get_nick, /* SIOCGIWNICKN */ ++ NULL, /* [nothing] */ ++ NULL, /* [nothing] */ ++ acx_ioctl_set_rate, /* SIOCSIWRATE */ ++ acx_ioctl_get_rate, /* SIOCGIWRATE */ ++ acx_ioctl_set_rts, /* SIOCSIWRTS */ ++ acx_ioctl_get_rts, /* SIOCGIWRTS */ ++#if ACX_FRAGMENTATION ++ acx_ioctl_set_frag, /* SIOCSIWFRAG */ ++ acx_ioctl_get_frag, /* SIOCGIWFRAG */ ++#else ++ NULL, /* SIOCSIWFRAG */ ++ NULL, /* SIOCGIWFRAG */ ++#endif ++ acx_ioctl_set_txpow, /* SIOCSIWTXPOW */ ++ acx_ioctl_get_txpow, /* SIOCGIWTXPOW */ ++ acx_ioctl_set_retry, /* SIOCSIWRETRY */ ++ acx_ioctl_get_retry, /* SIOCGIWRETRY */ ++ acx_ioctl_set_encode, /* SIOCSIWENCODE */ ++ acx_ioctl_get_encode, /* SIOCGIWENCODE */ ++ acx_ioctl_set_power, /* SIOCSIWPOWER */ ++ acx_ioctl_get_power, /* SIOCGIWPOWER */ ++}; ++ ++ ++/*********************************************************************** ++*/ ++ ++/* if you plan to reorder something, make sure to reorder all other places ++ * accordingly! */ ++/* SET/GET convention: SETs must have even position, GETs odd */ ++#define ACX100_IOCTL SIOCIWFIRSTPRIV ++enum { ++ ACX100_IOCTL_DEBUG = ACX100_IOCTL, ++ ACX100_IOCTL_GET__________UNUSED1, ++ ACX100_IOCTL_SET_PLED, ++ ACX100_IOCTL_GET_PLED, ++ ACX100_IOCTL_SET_RATES, ++ ACX100_IOCTL_LIST_DOM, ++ ACX100_IOCTL_SET_DOM, ++ ACX100_IOCTL_GET_DOM, ++ ACX100_IOCTL_SET_SCAN_PARAMS, ++ ACX100_IOCTL_GET_SCAN_PARAMS, ++ ACX100_IOCTL_SET_PREAMB, ++ ACX100_IOCTL_GET_PREAMB, ++ ACX100_IOCTL_SET_ANT, ++ ACX100_IOCTL_GET_ANT, ++ ACX100_IOCTL_RX_ANT, ++ ACX100_IOCTL_TX_ANT, ++ ACX100_IOCTL_SET_PHY_AMP_BIAS, ++ ACX100_IOCTL_GET_PHY_CHAN_BUSY, ++ ACX100_IOCTL_SET_ED, ++ ACX100_IOCTL_GET__________UNUSED3, ++ ACX100_IOCTL_SET_CCA, ++ ACX100_IOCTL_GET__________UNUSED4, ++ ACX100_IOCTL_MONITOR, ++ ACX100_IOCTL_TEST, ++ ACX100_IOCTL_DBG_SET_MASKS, ++ ACX111_IOCTL_INFO, ++ ACX100_IOCTL_DBG_SET_IO, ++ ACX100_IOCTL_DBG_GET_IO ++}; ++ ++ ++static const iw_handler acx_ioctl_private_handler[] = ++{ ++#if ACX_DEBUG ++[ACX100_IOCTL_DEBUG - ACX100_IOCTL] = acx_ioctl_set_debug, ++#endif ++[ACX100_IOCTL_SET_PLED - ACX100_IOCTL] = acx100_ioctl_set_led_power, ++[ACX100_IOCTL_GET_PLED - ACX100_IOCTL] = acx100_ioctl_get_led_power, ++[ACX100_IOCTL_SET_RATES - ACX100_IOCTL] = acx_ioctl_set_rates, ++[ACX100_IOCTL_LIST_DOM - ACX100_IOCTL] = acx_ioctl_list_reg_domain, ++[ACX100_IOCTL_SET_DOM - ACX100_IOCTL] = acx_ioctl_set_reg_domain, ++[ACX100_IOCTL_GET_DOM - ACX100_IOCTL] = acx_ioctl_get_reg_domain, ++[ACX100_IOCTL_SET_SCAN_PARAMS - ACX100_IOCTL] = acx_ioctl_set_scan_params, ++[ACX100_IOCTL_GET_SCAN_PARAMS - ACX100_IOCTL] = acx_ioctl_get_scan_params, ++[ACX100_IOCTL_SET_PREAMB - ACX100_IOCTL] = acx_ioctl_set_short_preamble, ++[ACX100_IOCTL_GET_PREAMB - ACX100_IOCTL] = acx_ioctl_get_short_preamble, ++[ACX100_IOCTL_SET_ANT - ACX100_IOCTL] = acx_ioctl_set_antenna, ++[ACX100_IOCTL_GET_ANT - ACX100_IOCTL] = acx_ioctl_get_antenna, ++[ACX100_IOCTL_RX_ANT - ACX100_IOCTL] = acx_ioctl_set_rx_antenna, ++[ACX100_IOCTL_TX_ANT - ACX100_IOCTL] = acx_ioctl_set_tx_antenna, ++[ACX100_IOCTL_SET_PHY_AMP_BIAS - ACX100_IOCTL] = acx100_ioctl_set_phy_amp_bias, ++[ACX100_IOCTL_GET_PHY_CHAN_BUSY - ACX100_IOCTL] = acx_ioctl_get_phy_chan_busy_percentage, ++[ACX100_IOCTL_SET_ED - ACX100_IOCTL] = acx_ioctl_set_ed_threshold, ++[ACX100_IOCTL_SET_CCA - ACX100_IOCTL] = acx_ioctl_set_cca, ++[ACX100_IOCTL_MONITOR - ACX100_IOCTL] = acx_ioctl_wlansniff, ++[ACX100_IOCTL_TEST - ACX100_IOCTL] = acx_ioctl_unknown11, ++[ACX100_IOCTL_DBG_SET_MASKS - ACX100_IOCTL] = acx_ioctl_dbg_set_masks, ++[ACX111_IOCTL_INFO - ACX100_IOCTL] = acx111_ioctl_info, ++}; ++ ++ ++static const struct iw_priv_args acx_ioctl_private_args[] = { ++#if ACX_DEBUG ++{ cmd : ACX100_IOCTL_DEBUG, ++ set_args : IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, ++ get_args : 0, ++ name : "SetDebug" }, ++#endif ++{ cmd : ACX100_IOCTL_SET_PLED, ++ set_args : IW_PRIV_TYPE_BYTE | 2, ++ get_args : 0, ++ name : "SetLEDPower" }, ++{ cmd : ACX100_IOCTL_GET_PLED, ++ set_args : 0, ++ get_args : IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 2, ++ name : "GetLEDPower" }, ++{ cmd : ACX100_IOCTL_SET_RATES, ++ set_args : IW_PRIV_TYPE_CHAR | 256, ++ get_args : 0, ++ name : "SetRates" }, ++{ cmd : ACX100_IOCTL_LIST_DOM, ++ set_args : 0, ++ get_args : 0, ++ name : "ListRegDomain" }, ++{ cmd : ACX100_IOCTL_SET_DOM, ++ set_args : IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, ++ get_args : 0, ++ name : "SetRegDomain" }, ++{ cmd : ACX100_IOCTL_GET_DOM, ++ set_args : 0, ++ get_args : IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, ++ name : "GetRegDomain" }, ++{ cmd : ACX100_IOCTL_SET_SCAN_PARAMS, ++ set_args : IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 4, ++ get_args : 0, ++ name : "SetScanParams" }, ++{ cmd : ACX100_IOCTL_GET_SCAN_PARAMS, ++ set_args : 0, ++ get_args : IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 4, ++ name : "GetScanParams" }, ++{ cmd : ACX100_IOCTL_SET_PREAMB, ++ set_args : IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, ++ get_args : 0, ++ name : "SetSPreamble" }, ++{ cmd : ACX100_IOCTL_GET_PREAMB, ++ set_args : 0, ++ get_args : IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, ++ name : "GetSPreamble" }, ++{ cmd : ACX100_IOCTL_SET_ANT, ++ set_args : IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, ++ get_args : 0, ++ name : "SetAntenna" }, ++{ cmd : ACX100_IOCTL_GET_ANT, ++ set_args : 0, ++ get_args : 0, ++ name : "GetAntenna" }, ++{ cmd : ACX100_IOCTL_RX_ANT, ++ set_args : IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, ++ get_args : 0, ++ name : "SetRxAnt" }, ++{ cmd : ACX100_IOCTL_TX_ANT, ++ set_args : IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, ++ get_args : 0, ++ name : "SetTxAnt" }, ++{ cmd : ACX100_IOCTL_SET_PHY_AMP_BIAS, ++ set_args : IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, ++ get_args : 0, ++ name : "SetPhyAmpBias"}, ++{ cmd : ACX100_IOCTL_GET_PHY_CHAN_BUSY, ++ set_args : 0, ++ get_args : 0, ++ name : "GetPhyChanBusy" }, ++{ cmd : ACX100_IOCTL_SET_ED, ++ set_args : IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, ++ get_args : 0, ++ name : "SetED" }, ++{ cmd : ACX100_IOCTL_SET_CCA, ++ set_args : IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, ++ get_args : 0, ++ name : "SetCCA" }, ++{ cmd : ACX100_IOCTL_MONITOR, ++ set_args : IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, ++ get_args : 0, ++ name : "monitor" }, ++{ cmd : ACX100_IOCTL_TEST, ++ set_args : 0, ++ get_args : 0, ++ name : "Test" }, ++{ cmd : ACX100_IOCTL_DBG_SET_MASKS, ++ set_args : IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, ++ get_args : 0, ++ name : "DbgSetMasks" }, ++{ cmd : ACX111_IOCTL_INFO, ++ set_args : 0, ++ get_args : 0, ++ name : "GetAcx111Info" }, ++{ cmd : ACX100_IOCTL_DBG_SET_IO, ++ set_args : IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 4, ++ get_args : 0, ++ name : "DbgSetIO" }, ++{ cmd : ACX100_IOCTL_DBG_GET_IO, ++ set_args : IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 3, ++ get_args : 0, ++ name : "DbgGetIO" }, ++}; ++ ++ ++const struct iw_handler_def acx_ioctl_handler_def = ++{ ++ .num_standard = VEC_SIZE(acx_ioctl_handler), ++ .num_private = VEC_SIZE(acx_ioctl_private_handler), ++ .num_private_args = VEC_SIZE(acx_ioctl_private_args), ++ .standard = (iw_handler *) acx_ioctl_handler, ++ .private = (iw_handler *) acx_ioctl_private_handler, ++ .private_args = (struct iw_priv_args *) acx_ioctl_private_args, ++#if IW_HANDLER_VERSION > 5 ++ .get_wireless_stats = acx_e_get_wireless_stats ++#endif /* IW > 5 */ ++}; +Index: linux-2.6.22/drivers/net/wireless/acx/Kconfig +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/Kconfig 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,113 @@ ++config ACX ++ tristate "TI acx100/acx111 802.11b/g wireless chipsets" ++ depends on NET_RADIO && EXPERIMENTAL ++ select FW_LOADER ++ ---help--- ++ A driver for 802.11b/g wireless cards based on ++ Texas Instruments acx100 and acx111 chipsets. ++ ++ This driver supports Host AP mode that allows ++ your computer to act as an IEEE 802.11 access point. ++ This driver is new and experimental. ++ ++ Texas Instruments did not take part in development of this driver ++ in any way, shape or form. ++ ++ The driver can be compiled as a module and will be named "acx". ++ ++config ACX_PCI ++ bool "TI acx100/acx111 802.11b/g PCI" ++ depends on ACX && PCI ++ ---help--- ++ Include PCI and CardBus support in acx. ++ ++ acx chipsets need their firmware loaded at startup. ++ You will need to provide a firmware image via hotplug. ++ ++ Firmware may be in a form of single image 40-100kb in size ++ (a 'combined' firmware) or two images - main image ++ (again 40-100kb) and radio image (~10kb or less). ++ ++ Firmware images are requested from hotplug using following names: ++ ++ tiacx100 - main firmware image for acx100 chipset ++ tiacx100rNN - radio acx100 firmware for radio type NN ++ tiacx100cNN - combined acx100 firmware for radio type NN ++ tiacx111 - main acx111 firmware ++ tiacx111rNN - radio acx111 firmware for radio type NN ++ tiacx111cNN - combined acx111 firmware for radio type NN ++ ++ Driver will attempt to load combined image first. ++ If no such image is found, it will try to load main image ++ and radio image instead. ++ ++ Firmware files are not covered by GPL and are not distributed ++ with this driver for legal reasons. ++ ++config ACX_USB ++ bool "TI acx100/acx111 802.11b/g USB" ++ depends on ACX && (USB=y || USB=ACX) ++ ---help--- ++ Include USB support in acx. ++ ++ There is only one currently known device in this category, ++ D-Link DWL-120+, but newer devices seem to be on the horizon. ++ ++ acx chipsets need their firmware loaded at startup. ++ You will need to provide a firmware image via hotplug. ++ ++ Firmware for USB device is requested from hotplug ++ by the 'tiacx100usb' name. ++ ++ Firmware files are not covered by GPL and are not distributed ++ with this driver for legal reasons. ++ ++config ACX_MEM ++ bool "TI acx100/acx111 802.11b/g memory mapped slave 16 interface" ++ depends on ACX ++ ---help--- ++ acx chipsets need their firmware loaded at startup. ++ You will need to provide a firmware image via hotplug. ++ ++ Firmware for USB device is requested from hotplug ++ by the 'tiacx100usb' name. ++ ++ Firmware files are not covered by GPL and are not distributed ++ with this driver for legal reasons. ++ ++config ACX_CS ++ bool "TI acx100/acx111 802.11b/g cardbus interface" ++ depends on ACX ++ ---help--- ++ acx chipsets need their firmware loaded at startup. ++ You will need to provide a firmware image via hotplug. ++ ++ This driver is based on memory mapped driver. ++ ++ Firmware files are not covered by GPL and are not distributed ++ with this driver for legal reasons. ++ ++config ACX_HX4700 ++ tristate "ACX support for the iPAQ hx4700 using ACX_MEM" ++ depends on HX4700_CORE && ACX_MEM ++ ---help--- ++ Include memory interface support in acx for the iPAQ hx4700. ++ ++config ACX_HTCUNIVERSAL ++ tristate "ACX support for the HTC Universal using ACX_MEM" ++ depends on HTCUNIVERSAL_CORE && HTC_ASIC3 && ACX_MEM ++ ---help--- ++ Include memory interface support in acx for the HTC Universal. ++ ++config ACX_HTCSABLE ++ tristate "ACX support for the HTC Sable (IPAQ hw6915) using ACX_MEM" ++ depends on MACH_HW6900 && HTC_ASIC3 && ACX_MEM ++ ---help--- ++ Include memory interface support in acx for the HTC Sable (IPAQ hw6915). ++ ++config ACX_RX3000 ++ tristate "ACX support for the iPAQ RX3000 using ACX_MEM" ++ depends on MACH_RX3715 && ACX_MEM && LEDS_ASIC3 ++ ---help--- ++ Include memory interface support in acx for the IPAQ RX3000. ++ +Index: linux-2.6.22/drivers/net/wireless/acx/Makefile +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/Makefile 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,21 @@ ++#obj-m += acx.o ++ ++#acx-obj-y += pci.o ++#acx-obj-y += usb.o ++ ++#acx-objs := wlan.o conv.o ioctl.o common.o $(acx-obj-y) ++ ++# Use this if you have proper Kconfig integration: ++ ++obj-$(CONFIG_ACX) += acx.o ++obj-$(CONFIG_ACX_HX4700) += hx4700_acx.o ++obj-$(CONFIG_ACX_HTCUNIVERSAL) += htcuniversal_acx.o ++obj-$(CONFIG_ACX_HTCSABLE) += htcsable_acx.o ++obj-$(CONFIG_ACX_RX3000) += rx3000_acx.o ++# ++acx-obj-$(CONFIG_ACX_PCI) += pci.o ++acx-obj-$(CONFIG_ACX_USB) += usb.o ++acx-obj-$(CONFIG_ACX_MEM) += mem.o ++acx-obj-$(CONFIG_ACX_CS) += cs.o ++# ++acx-objs := wlan.o conv.o ioctl.o common.o $(acx-obj-y) +Index: linux-2.6.22/drivers/net/wireless/acx/mem.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/mem.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,5363 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++** ++** Slave memory interface support: ++** ++** Todd Blumer - SDG Systems ++** Bill Reese - HP ++** Eric McCorkle - Shadowsun ++*/ ++#define ACX_MEM 1 ++ ++/* ++ * non-zero makes it dump the ACX memory to the console then ++ * panic when you cat /proc/driver/acx_wlan0_diag ++ */ ++#define DUMP_MEM_DEFINED 1 ++ ++#define DUMP_MEM_DURING_DIAG 0 ++#define DUMP_IF_SLOW 0 ++ ++#define PATCH_AROUND_BAD_SPOTS 1 ++#define HX4700_FIRMWARE_CHECKSUM 0x0036862e ++#define HX4700_ALTERNATE_FIRMWARE_CHECKSUM 0x00368a75 ++ ++#include <linux/version.h> ++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) ++#include <linux/config.h> ++#endif ++ ++/* Linux 2.6.18+ uses <linux/utsrelease.h> */ ++#ifndef UTS_RELEASE ++#include <linux/utsrelease.h> ++#endif ++ ++#include <linux/compiler.h> /* required for Lx 2.6.8 ?? */ ++#include <linux/kernel.h> ++#include <linux/module.h> ++#include <linux/moduleparam.h> ++#include <linux/sched.h> ++#include <linux/types.h> ++#include <linux/skbuff.h> ++#include <linux/slab.h> ++#include <linux/if_arp.h> ++#include <linux/irq.h> ++#include <linux/rtnetlink.h> ++#include <linux/wireless.h> ++#include <net/iw_handler.h> ++#include <linux/netdevice.h> ++#include <linux/ioport.h> ++#include <linux/pci.h> ++#include <linux/platform_device.h> ++#include <linux/pm.h> ++#include <linux/vmalloc.h> ++#include <linux/delay.h> ++#include <linux/workqueue.h> ++#include <linux/inetdevice.h> ++ ++#include "acx.h" ++#include "acx_hw.h" ++ ++/*********************************************************************** ++*/ ++ ++#define CARD_EEPROM_ID_SIZE 6 ++ ++#include <asm/io.h> ++ ++#define REG_ACX_VENDOR_ID 0x900 ++/* ++ * This is the vendor id on the HX4700, anyway ++ */ ++#define ACX_VENDOR_ID 0x8400104c ++ ++typedef enum { ++ ACX_SOFT_RESET = 0, ++ ++ ACX_SLV_REG_ADDR, ++ ACX_SLV_REG_DATA, ++ ACX_SLV_REG_ADATA, ++ ++ ACX_SLV_MEM_CP, ++ ACX_SLV_MEM_ADDR, ++ ACX_SLV_MEM_DATA, ++ ACX_SLV_MEM_CTL, ++} acxreg_t; ++ ++/*********************************************************************** ++*/ ++static void acxmem_i_tx_timeout(struct net_device *ndev); ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19) ++static irqreturn_t acxmem_i_interrupt(int irq, void *dev_id); ++#else ++static irqreturn_t acxmem_i_interrupt(int irq, void *dev_id, struct pt_regs *regs); ++#endif ++static void acxmem_i_set_multicast_list(struct net_device *ndev); ++ ++static int acxmem_e_open(struct net_device *ndev); ++static int acxmem_e_close(struct net_device *ndev); ++static void acxmem_s_up(struct net_device *ndev); ++static void acxmem_s_down(struct net_device *ndev); ++ ++static void dump_acxmem (acx_device_t *adev, u32 start, int length); ++static int acxmem_complete_hw_reset (acx_device_t *adev); ++static void acxmem_s_delete_dma_regions(acx_device_t *adev); ++ ++static struct platform_device *resume_pdev; ++ ++static int ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11) ++acxmem_e_suspend(struct platform_device *pdev, pm_message_t state); ++#else ++acxmem_e_suspend(struct device *pdev, u32 state); ++#endif ++static void ++fw_resumer(struct work_struct *notused); ++//fw_resumer( void *data ); ++ ++static int acx_netdev_event(struct notifier_block *this, unsigned long event, void *ptr) ++{ ++ struct net_device *ndev = ptr; ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ /* ++ * Upper level ioctl() handlers send a NETDEV_CHANGEADDR if the MAC address changes. ++ */ ++ ++ if (NETDEV_CHANGEADDR == event) { ++ /* ++ * the upper layers put the new MAC address in ndev->dev_addr; we just copy ++ * it over and update the ACX with it. ++ */ ++ MAC_COPY(adev->dev_addr, adev->ndev->dev_addr); ++ adev->set_mask |= GETSET_STATION_ID; ++ acx_s_update_card_settings (adev); ++ } ++ ++ return 0; ++} ++ ++static struct notifier_block acx_netdev_notifier = { ++ .notifier_call = acx_netdev_event, ++}; ++ ++/*********************************************************************** ++** Register access ++*/ ++ ++/* Pick one */ ++/* #define INLINE_IO static */ ++#define INLINE_IO static inline ++ ++INLINE_IO u32 ++read_id_register (acx_device_t *adev) ++{ ++ writel (0x24, &adev->iobase[ACX_SLV_REG_ADDR]); ++ return readl (&adev->iobase[ACX_SLV_REG_DATA]); ++} ++ ++INLINE_IO u32 ++read_reg32(acx_device_t *adev, unsigned int offset) ++{ ++ u32 val; ++ u32 addr; ++ ++ if (offset > IO_ACX_ECPU_CTRL) ++ addr = offset; ++ else ++ addr = adev->io[offset]; ++ ++ if (addr < 0x20) { ++ return readl(((u8*)adev->iobase) + addr); ++ } ++ ++ writel( addr, &adev->iobase[ACX_SLV_REG_ADDR] ); ++ val = readl( &adev->iobase[ACX_SLV_REG_DATA] ); ++ ++ return val; ++} ++ ++INLINE_IO u16 ++read_reg16(acx_device_t *adev, unsigned int offset) ++{ ++ u16 lo; ++ u32 addr; ++ ++ if (offset > IO_ACX_ECPU_CTRL) ++ addr = offset; ++ else ++ addr = adev->io[offset]; ++ ++ if (addr < 0x20) { ++ return readw(((u8 *) adev->iobase) + addr); ++ } ++ ++ writel( addr, &adev->iobase[ACX_SLV_REG_ADDR] ); ++ lo = readw( (u16 *)&adev->iobase[ACX_SLV_REG_DATA] ); ++ ++ return lo; ++} ++ ++INLINE_IO u8 ++read_reg8(acx_device_t *adev, unsigned int offset) ++{ ++ u8 lo; ++ u32 addr; ++ ++ if (offset > IO_ACX_ECPU_CTRL) ++ addr = offset; ++ else ++ addr = adev->io[offset]; ++ ++ if (addr < 0x20) ++ return readb(((u8 *)adev->iobase) + addr); ++ ++ writel( addr, &adev->iobase[ACX_SLV_REG_ADDR] ); ++ lo = readw( (u8 *)&adev->iobase[ACX_SLV_REG_DATA] ); ++ ++ return (u8)lo; ++} ++ ++INLINE_IO void ++write_reg32(acx_device_t *adev, unsigned int offset, u32 val) ++{ ++ u32 addr; ++ ++ if (offset > IO_ACX_ECPU_CTRL) ++ addr = offset; ++ else ++ addr = adev->io[offset]; ++ ++ if (addr < 0x20) { ++ writel(val, ((u8*)adev->iobase) + addr); ++ return; ++ } ++ ++ writel( addr, &adev->iobase[ACX_SLV_REG_ADDR] ); ++ writel( val, &adev->iobase[ACX_SLV_REG_DATA] ); ++} ++ ++INLINE_IO void ++write_reg16(acx_device_t *adev, unsigned int offset, u16 val) ++{ ++ u32 addr; ++ ++ if (offset > IO_ACX_ECPU_CTRL) ++ addr = offset; ++ else ++ addr = adev->io[offset]; ++ ++ if (addr < 0x20) { ++ writew(val, ((u8 *)adev->iobase) + addr); ++ return; ++ } ++ writel( addr, &adev->iobase[ACX_SLV_REG_ADDR] ); ++ writew( val, (u16 *) &adev->iobase[ACX_SLV_REG_DATA] ); ++} ++ ++INLINE_IO void ++write_reg8(acx_device_t *adev, unsigned int offset, u8 val) ++{ ++ u32 addr; ++ ++ if (offset > IO_ACX_ECPU_CTRL) ++ addr = offset; ++ else ++ addr = adev->io[offset]; ++ ++ if (addr < 0x20) { ++ writeb(val, ((u8 *) adev->iobase) + addr); ++ return; ++ } ++ writel( addr, &adev->iobase[ACX_SLV_REG_ADDR] ); ++ writeb( val, (u8 *)&adev->iobase[ACX_SLV_REG_DATA] ); ++} ++ ++/* Handle PCI posting properly: ++ * Make sure that writes reach the adapter in case they require to be executed ++ * *before* the next write, by reading a random (and safely accessible) register. ++ * This call has to be made if there is no read following (which would flush the data ++ * to the adapter), yet the written data has to reach the adapter immediately. */ ++INLINE_IO void ++write_flush(acx_device_t *adev) ++{ ++ /* readb(adev->iobase + adev->io[IO_ACX_INFO_MAILBOX_OFFS]); */ ++ /* faster version (accesses the first register, IO_ACX_SOFT_RESET, ++ * which should also be safe): */ ++ (void) readl(adev->iobase); ++} ++ ++INLINE_IO void ++set_regbits (acx_device_t *adev, unsigned int offset, u32 bits) { ++ u32 tmp; ++ ++ tmp = read_reg32 (adev, offset); ++ tmp = tmp | bits; ++ write_reg32 (adev, offset, tmp); ++ write_flush (adev); ++} ++ ++INLINE_IO void ++clear_regbits (acx_device_t *adev, unsigned int offset, u32 bits) { ++ u32 tmp; ++ ++ tmp = read_reg32 (adev, offset); ++ tmp = tmp & ~bits; ++ write_reg32 (adev, offset, tmp); ++ write_flush (adev); ++} ++ ++/* ++ * Copy from PXA memory to the ACX memory. This assumes both the PXA and ACX ++ * addresses are 32 bit aligned. Count is in bytes. ++ */ ++INLINE_IO void ++write_slavemem32 (acx_device_t *adev, u32 slave_address, u32 val) ++{ ++ write_reg32 (adev, IO_ACX_SLV_MEM_CTL, 0x0); ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, slave_address); ++ udelay (10); ++ write_reg32 (adev, IO_ACX_SLV_MEM_DATA, val); ++} ++ ++INLINE_IO u32 ++read_slavemem32 (acx_device_t *adev, u32 slave_address) ++{ ++ u32 val; ++ ++ write_reg32 (adev, IO_ACX_SLV_MEM_CTL, 0x0); ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, slave_address); ++ udelay (10); ++ val = read_reg32 (adev, IO_ACX_SLV_MEM_DATA); ++ ++ return val; ++} ++ ++INLINE_IO void ++write_slavemem8 (acx_device_t *adev, u32 slave_address, u8 val) ++{ ++ u32 data; ++ u32 base; ++ int offset; ++ ++ /* ++ * Get the word containing the target address and the byte offset in that word. ++ */ ++ base = slave_address & ~3; ++ offset = (slave_address & 3) * 8; ++ ++ data = read_slavemem32 (adev, base); ++ data &= ~(0xff << offset); ++ data |= val << offset; ++ write_slavemem32 (adev, base, data); ++} ++ ++INLINE_IO u8 ++read_slavemem8 (acx_device_t *adev, u32 slave_address) ++{ ++ u8 val; ++ u32 base; ++ u32 data; ++ int offset; ++ ++ base = slave_address & ~3; ++ offset = (slave_address & 3) * 8; ++ ++ data = read_slavemem32 (adev, base); ++ ++ val = (data >> offset) & 0xff; ++ ++ return val; ++} ++ ++/* ++ * doesn't split across word boundaries ++ */ ++INLINE_IO void ++write_slavemem16 (acx_device_t *adev, u32 slave_address, u16 val) ++{ ++ u32 data; ++ u32 base; ++ int offset; ++ ++ /* ++ * Get the word containing the target address and the byte offset in that word. ++ */ ++ base = slave_address & ~3; ++ offset = (slave_address & 3) * 8; ++ ++ data = read_slavemem32 (adev, base); ++ data &= ~(0xffff << offset); ++ data |= val << offset; ++ write_slavemem32 (adev, base, data); ++} ++ ++/* ++ * doesn't split across word boundaries ++ */ ++INLINE_IO u16 ++read_slavemem16 (acx_device_t *adev, u32 slave_address) ++{ ++ u16 val; ++ u32 base; ++ u32 data; ++ int offset; ++ ++ base = slave_address & ~3; ++ offset = (slave_address & 3) * 8; ++ ++ data = read_slavemem32 (adev, base); ++ ++ val = (data >> offset) & 0xffff; ++ ++ return val; ++} ++ ++/* ++ * Copy from slave memory ++ * ++ * TODO - rewrite using address autoincrement, handle partial words ++ */ ++void ++copy_from_slavemem (acx_device_t *adev, u8 *destination, u32 source, int count) { ++ u32 tmp = 0; ++ u8 *ptmp = (u8 *) &tmp; ++ ++ /* ++ * Right now I'm making the assumption that the destination is aligned, but ++ * I'd better check. ++ */ ++ if ((u32) destination & 3) { ++ printk ("acx copy_from_slavemem: warning! destination not word-aligned!\n"); ++ } ++ ++ while (count >= 4) { ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, source); ++ udelay (10); ++ *((u32 *) destination) = read_reg32 (adev, IO_ACX_SLV_MEM_DATA); ++ count -= 4; ++ source += 4; ++ destination += 4; ++ } ++ ++ /* ++ * If the word reads above didn't satisfy the count, read one more word ++ * and transfer a byte at a time until the request is satisfied. ++ */ ++ if (count) { ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, source); ++ udelay (10); ++ tmp = read_reg32 (adev, IO_ACX_SLV_MEM_DATA); ++ while (count--) { ++ *destination++ = *ptmp++; ++ } ++ } ++} ++ ++/* ++ * Copy to slave memory ++ * ++ * TODO - rewrite using autoincrement, handle partial words ++ */ ++void ++copy_to_slavemem (acx_device_t *adev, u32 destination, u8 *source, int count) ++{ ++ u32 tmp = 0; ++ u8* ptmp = (u8 *) &tmp; ++ static u8 src[512]; /* make static to avoid huge stack objects */ ++ ++ /* ++ * For now, make sure the source is word-aligned by copying it to a word-aligned ++ * buffer. Someday rewrite to avoid the extra copy. ++ */ ++ if (count > sizeof (src)) { ++ printk ("acx copy_to_slavemem: Warning! buffer overflow!\n"); ++ count = sizeof (src); ++ } ++ memcpy (src, source, count); ++ source = src; ++ ++ while (count >= 4) { ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, destination); ++ udelay (10); ++ write_reg32 (adev, IO_ACX_SLV_MEM_DATA, *((u32 *) source)); ++ count -= 4; ++ source += 4; ++ destination += 4; ++ } ++ ++ /* ++ * If there are leftovers read the next word from the acx and merge in ++ * what they want to write. ++ */ ++ if (count) { ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, destination); ++ udelay (10); ++ tmp = read_reg32 (adev, IO_ACX_SLV_MEM_DATA); ++ while (count--) { ++ *ptmp++ = *source++; ++ } ++ /* ++ * reset address in case we're currently in auto-increment mode ++ */ ++ write_reg32 (adev, IO_ACX_SLV_MEM_ADDR, destination); ++ udelay (10); ++ write_reg32 (adev, IO_ACX_SLV_MEM_DATA, tmp); ++ udelay (10); ++ } ++ ++} ++ ++/* ++ * Block copy to slave buffers using memory block chain mode. Copies to the ACX ++ * transmit buffer structure with minimal intervention on our part. ++ * Interrupts should be disabled when calling this. ++ */ ++void ++chaincopy_to_slavemem (acx_device_t *adev, u32 destination, u8 *source, int count) ++{ ++ u32 val; ++ u32 *data = (u32 *) source; ++ static u8 aligned_source[WLAN_A4FR_MAXLEN_WEP_FCS]; ++ ++ /* ++ * Warn if the pointers don't look right. Destination must fit in [23:5] with ++ * zero elsewhere and source should be 32 bit aligned. ++ * This should never happen since we're in control of both, but I want to know about ++ * it if it does. ++ */ ++ if ((destination & 0x00ffffe0) != destination) { ++ printk ("acx chaincopy: destination block 0x%04x not aligned!\n", destination); ++ } ++ if (count > sizeof aligned_source) { ++ printk( KERN_ERR "chaincopy_to_slavemem overflow!\n" ); ++ count = sizeof aligned_source; ++ } ++ if ((u32) source & 3) { ++ memcpy (aligned_source, source, count); ++ data = (u32 *) aligned_source; ++ } ++ ++ /* ++ * SLV_MEM_CTL[17:16] = memory block chain mode with auto-increment ++ * SLV_MEM_CTL[5:2] = offset to data portion = 1 word ++ */ ++ val = 2 << 16 | 1 << 2; ++ writel (val, &adev->iobase[ACX_SLV_MEM_CTL]); ++ ++ /* ++ * SLV_MEM_CP[23:5] = start of 1st block ++ * SLV_MEM_CP[3:2] = offset to memblkptr = 0 ++ */ ++ val = destination & 0x00ffffe0; ++ writel (val, &adev->iobase[ACX_SLV_MEM_CP]); ++ ++ /* ++ * SLV_MEM_ADDR[23:2] = SLV_MEM_CTL[5:2] + SLV_MEM_CP[23:5] ++ */ ++ val = (destination & 0x00ffffe0) + (1<<2); ++ writel (val, &adev->iobase[ACX_SLV_MEM_ADDR]); ++ ++ /* ++ * Write the data to the slave data register, rounding up to the end ++ * of the word containing the last byte (hence the > 0) ++ */ ++ while (count > 0) { ++ writel (*data++, &adev->iobase[ACX_SLV_MEM_DATA]); ++ count -= 4; ++ } ++} ++ ++ ++/* ++ * Block copy from slave buffers using memory block chain mode. Copies from the ACX ++ * receive buffer structures with minimal intervention on our part. ++ * Interrupts should be disabled when calling this. ++ */ ++void ++chaincopy_from_slavemem (acx_device_t *adev, u8 *destination, u32 source, int count) ++{ ++ u32 val; ++ u32 *data = (u32 *) destination; ++ static u8 aligned_destination[WLAN_A4FR_MAXLEN_WEP_FCS]; ++ int saved_count = count; ++ ++ /* ++ * Warn if the pointers don't look right. Destination must fit in [23:5] with ++ * zero elsewhere and source should be 32 bit aligned. ++ * Turns out the network stack sends unaligned things, so fix them before ++ * copying to the ACX. ++ */ ++ if ((source & 0x00ffffe0) != source) { ++ printk ("acx chaincopy: source block 0x%04x not aligned!\n", source); ++ dump_acxmem (adev, 0, 0x10000); ++ } ++ if ((u32) destination & 3) { ++ //printk ("acx chaincopy: data destination not word aligned!\n"); ++ data = (u32 *) aligned_destination; ++ if (count > sizeof aligned_destination) { ++ printk( KERN_ERR "chaincopy_from_slavemem overflow!\n" ); ++ count = sizeof aligned_destination; ++ } ++ } ++ ++ /* ++ * SLV_MEM_CTL[17:16] = memory block chain mode with auto-increment ++ * SLV_MEM_CTL[5:2] = offset to data portion = 1 word ++ */ ++ val = (2 << 16) | (1 << 2); ++ writel (val, &adev->iobase[ACX_SLV_MEM_CTL]); ++ ++ /* ++ * SLV_MEM_CP[23:5] = start of 1st block ++ * SLV_MEM_CP[3:2] = offset to memblkptr = 0 ++ */ ++ val = source & 0x00ffffe0; ++ writel (val, &adev->iobase[ACX_SLV_MEM_CP]); ++ ++ /* ++ * SLV_MEM_ADDR[23:2] = SLV_MEM_CTL[5:2] + SLV_MEM_CP[23:5] ++ */ ++ val = (source & 0x00ffffe0) + (1<<2); ++ writel (val, &adev->iobase[ACX_SLV_MEM_ADDR]); ++ ++ /* ++ * Read the data from the slave data register, rounding up to the end ++ * of the word containing the last byte (hence the > 0) ++ */ ++ while (count > 0) { ++ *data++ = readl (&adev->iobase[ACX_SLV_MEM_DATA]); ++ count -= 4; ++ } ++ ++ /* ++ * If the destination wasn't aligned, we would have saved it in ++ * the aligned buffer, so copy it where it should go. ++ */ ++ if ((u32) destination & 3) { ++ memcpy (destination, aligned_destination, saved_count); ++ } ++} ++ ++char ++printable (char c) ++{ ++ return ((c >= 20) && (c < 127)) ? c : '.'; ++} ++ ++#if DUMP_MEM_DEFINED > 0 ++static void ++dump_acxmem (acx_device_t *adev, u32 start, int length) ++{ ++ int i; ++ u8 buf[16]; ++ ++ while (length > 0) { ++ printk ("%04x ", start); ++ copy_from_slavemem (adev, buf, start, 16); ++ for (i = 0; (i < 16) && (i < length); i++) { ++ printk ("%02x ", buf[i]); ++ } ++ for (i = 0; (i < 16) && (i < length); i++) { ++ printk ("%c", printable (buf[i])); ++ } ++ printk ("\n"); ++ start += 16; ++ length -= 16; ++ } ++} ++#endif ++ ++static void ++enable_acx_irq(acx_device_t *adev); ++static void ++disable_acx_irq(acx_device_t *adev); ++ ++/* ++ * Return an acx pointer to the next transmit data block. ++ */ ++u32 ++allocate_acx_txbuf_space (acx_device_t *adev, int count) { ++ u32 block, next, last_block; ++ int blocks_needed; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&adev->txbuf_lock, flags); ++ /* ++ * Take 4 off the memory block size to account for the reserved word at the start of ++ * the block. ++ */ ++ blocks_needed = count / (adev->memblocksize - 4); ++ if (count % (adev->memblocksize - 4)) ++ blocks_needed++; ++ ++ if (blocks_needed <= adev->acx_txbuf_blocks_free) { ++ /* ++ * Take blocks at the head of the free list. ++ */ ++ last_block = block = adev->acx_txbuf_free; ++ ++ /* ++ * Follow block pointers through the requested number of blocks both to ++ * find the new head of the free list and to set the flags for the blocks ++ * appropriately. ++ */ ++ while (blocks_needed--) { ++ /* ++ * Keep track of the last block of the allocation ++ */ ++ last_block = adev->acx_txbuf_free; ++ ++ /* ++ * Make sure the end control flag is not set. ++ */ ++ next = read_slavemem32 (adev, adev->acx_txbuf_free) & 0x7ffff; ++ write_slavemem32 (adev, adev->acx_txbuf_free, next); ++ ++ /* ++ * Update the new head of the free list ++ */ ++ adev->acx_txbuf_free = next << 5; ++ adev->acx_txbuf_blocks_free--; ++ ++ } ++ ++ /* ++ * Flag the last block both by clearing out the next pointer ++ * and marking the control field. ++ */ ++ write_slavemem32 (adev, last_block, 0x02000000); ++ ++ /* ++ * If we're out of buffers make sure the free list pointer is NULL ++ */ ++ if (!adev->acx_txbuf_blocks_free) { ++ adev->acx_txbuf_free = 0; ++ } ++ } ++ else { ++ block = 0; ++ } ++ spin_unlock_irqrestore (&adev->txbuf_lock, flags); ++ return block; ++} ++ ++/* ++ * Return buffer space back to the pool by following the next pointers until we find ++ * the block marked as the end. Point the last block to the head of the free list, ++ * then update the head of the free list to point to the newly freed memory. ++ * This routine gets called in interrupt context, so it shouldn't block to protect ++ * the integrity of the linked list. The ISR already holds the lock. ++ */ ++void ++reclaim_acx_txbuf_space (acx_device_t *adev, u32 blockptr) { ++ u32 cur, last, next; ++ unsigned long flags; ++ ++ spin_lock_irqsave (&adev->txbuf_lock, flags); ++ if ((blockptr >= adev->acx_txbuf_start) && ++ (blockptr <= adev->acx_txbuf_start + ++ (adev->acx_txbuf_numblocks - 1) * adev->memblocksize)) { ++ cur = blockptr; ++ do { ++ last = cur; ++ next = read_slavemem32 (adev, cur); ++ ++ /* ++ * Advance to the next block in this allocation ++ */ ++ cur = (next & 0x7ffff) << 5; ++ ++ /* ++ * This block now counts as free. ++ */ ++ adev->acx_txbuf_blocks_free++; ++ } while (!(next & 0x02000000)); ++ ++ /* ++ * last now points to the last block of that allocation. Update the pointer ++ * in that block to point to the free list and reset the free list to the ++ * first block of the free call. If there were no free blocks, make sure ++ * the new end of the list marks itself as truly the end. ++ */ ++ if (adev->acx_txbuf_free) { ++ write_slavemem32 (adev, last, adev->acx_txbuf_free >> 5); ++ } ++ else { ++ write_slavemem32 (adev, last, 0x02000000); ++ } ++ adev->acx_txbuf_free = blockptr; ++ } ++ spin_unlock_irqrestore(&adev->txbuf_lock, flags); ++} ++ ++/* ++ * Initialize the pieces managing the transmit buffer pool on the ACX. The transmit ++ * buffer is a circular queue with one 32 bit word reserved at the beginning of each ++ * block. The upper 13 bits are a control field, of which only 0x02000000 has any ++ * meaning. The lower 19 bits are the address of the next block divided by 32. ++ */ ++void ++init_acx_txbuf (acx_device_t *adev) { ++ ++ /* ++ * acx100_s_init_memory_pools set up txbuf_start and txbuf_numblocks for us. ++ * All we need to do is reset the rest of the bookeeping. ++ */ ++ ++ adev->acx_txbuf_free = adev->acx_txbuf_start; ++ adev->acx_txbuf_blocks_free = adev->acx_txbuf_numblocks; ++ ++ /* ++ * Initialization leaves the last transmit pool block without a pointer back to ++ * the head of the list, but marked as the end of the list. That's how we want ++ * to see it, too, so leave it alone. This is only ever called after a firmware ++ * reset, so the ACX memory is in the state we want. ++ */ ++ ++} ++ ++INLINE_IO int ++adev_present(acx_device_t *adev) ++{ ++ /* fast version (accesses the first register, IO_ACX_SOFT_RESET, ++ * which should be safe): */ ++ return readl(adev->iobase) != 0xffffffff; ++} ++ ++/*********************************************************************** ++*/ ++static inline txdesc_t* ++get_txdesc(acx_device_t *adev, int index) ++{ ++ return (txdesc_t*) (((u8*)adev->txdesc_start) + index * adev->txdesc_size); ++} ++ ++static inline txdesc_t* ++advance_txdesc(acx_device_t *adev, txdesc_t* txdesc, int inc) ++{ ++ return (txdesc_t*) (((u8*)txdesc) + inc * adev->txdesc_size); ++} ++ ++static txhostdesc_t* ++get_txhostdesc(acx_device_t *adev, txdesc_t* txdesc) ++{ ++ int index = (u8*)txdesc - (u8*)adev->txdesc_start; ++ if (unlikely(ACX_DEBUG && (index % adev->txdesc_size))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return NULL; ++ } ++ index /= adev->txdesc_size; ++ if (unlikely(ACX_DEBUG && (index >= TX_CNT))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return NULL; ++ } ++ return &adev->txhostdesc_start[index*2]; ++} ++ ++static inline client_t* ++get_txc(acx_device_t *adev, txdesc_t* txdesc) ++{ ++ int index = (u8*)txdesc - (u8*)adev->txdesc_start; ++ if (unlikely(ACX_DEBUG && (index % adev->txdesc_size))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return NULL; ++ } ++ index /= adev->txdesc_size; ++ if (unlikely(ACX_DEBUG && (index >= TX_CNT))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return NULL; ++ } ++ return adev->txc[index]; ++} ++ ++static inline u16 ++get_txr(acx_device_t *adev, txdesc_t* txdesc) ++{ ++ int index = (u8*)txdesc - (u8*)adev->txdesc_start; ++ index /= adev->txdesc_size; ++ return adev->txr[index]; ++} ++ ++static inline void ++put_txcr(acx_device_t *adev, txdesc_t* txdesc, client_t* c, u16 r111) ++{ ++ int index = (u8*)txdesc - (u8*)adev->txdesc_start; ++ if (unlikely(ACX_DEBUG && (index % adev->txdesc_size))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return; ++ } ++ index /= adev->txdesc_size; ++ if (unlikely(ACX_DEBUG && (index >= TX_CNT))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return; ++ } ++ adev->txc[index] = c; ++ adev->txr[index] = r111; ++} ++ ++ ++/*********************************************************************** ++** EEPROM and PHY read/write helpers ++*/ ++/*********************************************************************** ++** acxmem_read_eeprom_byte ++** ++** Function called to read an octet in the EEPROM. ++** ++** This function is used by acxmem_e_probe to check if the ++** connected card is a legal one or not. ++** ++** Arguments: ++** adev ptr to acx_device structure ++** addr address to read in the EEPROM ++** charbuf ptr to a char. This is where the read octet ++** will be stored ++*/ ++int ++acxmem_read_eeprom_byte(acx_device_t *adev, u32 addr, u8 *charbuf) ++{ ++ int result; ++ int count; ++ ++ write_reg32(adev, IO_ACX_EEPROM_CFG, 0); ++ write_reg32(adev, IO_ACX_EEPROM_ADDR, addr); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_EEPROM_CTL, 2); ++ ++ count = 0xffff; ++ while (read_reg16(adev, IO_ACX_EEPROM_CTL)) { ++ /* scheduling away instead of CPU burning loop ++ * doesn't seem to work here at all: ++ * awful delay, sometimes also failure. ++ * Doesn't matter anyway (only small delay). */ ++ if (unlikely(!--count)) { ++ printk("%s: timeout waiting for EEPROM read\n", ++ adev->ndev->name); ++ result = NOT_OK; ++ goto fail; ++ } ++ cpu_relax(); ++ } ++ ++ *charbuf = read_reg8(adev, IO_ACX_EEPROM_DATA); ++ log(L_DEBUG, "EEPROM at 0x%04X = 0x%02X\n", addr, *charbuf); ++ result = OK; ++ ++fail: ++ return result; ++} ++ ++ ++/*********************************************************************** ++** We don't lock hw accesses here since we never r/w eeprom in IRQ ++** Note: this function sleeps only because of GFP_KERNEL alloc ++*/ ++#ifdef UNUSED ++int ++acxmem_s_write_eeprom(acx_device_t *adev, u32 addr, u32 len, const u8 *charbuf) ++{ ++ u8 *data_verify = NULL; ++ unsigned long flags; ++ int count, i; ++ int result = NOT_OK; ++ u16 gpio_orig; ++ ++ printk("acx: WARNING! I would write to EEPROM now. " ++ "Since I really DON'T want to unless you know " ++ "what you're doing (THIS CODE WILL PROBABLY " ++ "NOT WORK YET!), I will abort that now. And " ++ "definitely make sure to make a " ++ "/proc/driver/acx_wlan0_eeprom backup copy first!!! " ++ "(the EEPROM content includes the PCI config header!! " ++ "If you kill important stuff, then you WILL " ++ "get in trouble and people DID get in trouble already)\n"); ++ return OK; ++ ++ FN_ENTER; ++ ++ data_verify = kmalloc(len, GFP_KERNEL); ++ if (!data_verify) { ++ goto end; ++ } ++ ++ /* first we need to enable the OE (EEPROM Output Enable) GPIO line ++ * to be able to write to the EEPROM. ++ * NOTE: an EEPROM writing success has been reported, ++ * but you probably have to modify GPIO_OUT, too, ++ * and you probably need to activate a different GPIO ++ * line instead! */ ++ gpio_orig = read_reg16(adev, IO_ACX_GPIO_OE); ++ write_reg16(adev, IO_ACX_GPIO_OE, gpio_orig & ~1); ++ write_flush(adev); ++ ++ /* ok, now start writing the data out */ ++ for (i = 0; i < len; i++) { ++ write_reg32(adev, IO_ACX_EEPROM_CFG, 0); ++ write_reg32(adev, IO_ACX_EEPROM_ADDR, addr + i); ++ write_reg32(adev, IO_ACX_EEPROM_DATA, *(charbuf + i)); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_EEPROM_CTL, 1); ++ ++ count = 0xffff; ++ while (read_reg16(adev, IO_ACX_EEPROM_CTL)) { ++ if (unlikely(!--count)) { ++ printk("WARNING, DANGER!!! " ++ "Timeout waiting for EEPROM write\n"); ++ goto end; ++ } ++ cpu_relax(); ++ } ++ } ++ ++ /* disable EEPROM writing */ ++ write_reg16(adev, IO_ACX_GPIO_OE, gpio_orig); ++ write_flush(adev); ++ ++ /* now start a verification run */ ++ for (i = 0; i < len; i++) { ++ write_reg32(adev, IO_ACX_EEPROM_CFG, 0); ++ write_reg32(adev, IO_ACX_EEPROM_ADDR, addr + i); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_EEPROM_CTL, 2); ++ ++ count = 0xffff; ++ while (read_reg16(adev, IO_ACX_EEPROM_CTL)) { ++ if (unlikely(!--count)) { ++ printk("timeout waiting for EEPROM read\n"); ++ goto end; ++ } ++ cpu_relax(); ++ } ++ ++ data_verify[i] = read_reg16(adev, IO_ACX_EEPROM_DATA); ++ } ++ ++ if (0 == memcmp(charbuf, data_verify, len)) ++ result = OK; /* read data matches, success */ ++ ++end: ++ kfree(data_verify); ++ FN_EXIT1(result); ++ return result; ++} ++#endif /* UNUSED */ ++ ++ ++/*********************************************************************** ++** acxmem_s_read_phy_reg ++** ++** Messing with rx/tx disabling and enabling here ++** (write_reg32(adev, IO_ACX_ENABLE, 0b000000xx)) kills traffic ++*/ ++int ++acxmem_s_read_phy_reg(acx_device_t *adev, u32 reg, u8 *charbuf) ++{ ++ int result = NOT_OK; ++ int count; ++ ++ FN_ENTER; ++ ++ write_reg32(adev, IO_ACX_PHY_ADDR, reg); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_PHY_CTL, 2); ++ ++ count = 0xffff; ++ while (read_reg32(adev, IO_ACX_PHY_CTL)) { ++ /* scheduling away instead of CPU burning loop ++ * doesn't seem to work here at all: ++ * awful delay, sometimes also failure. ++ * Doesn't matter anyway (only small delay). */ ++ if (unlikely(!--count)) { ++ printk("%s: timeout waiting for phy read\n", ++ adev->ndev->name); ++ *charbuf = 0; ++ goto fail; ++ } ++ cpu_relax(); ++ } ++ ++ log(L_DEBUG, "count was %u\n", count); ++ *charbuf = read_reg8(adev, IO_ACX_PHY_DATA); ++ ++ log(L_DEBUG, "radio PHY at 0x%04X = 0x%02X\n", *charbuf, reg); ++ result = OK; ++ goto fail; /* silence compiler warning */ ++fail: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acxmem_s_write_phy_reg(acx_device_t *adev, u32 reg, u8 value) ++{ ++ int count; ++ FN_ENTER; ++ ++ /* mprusko said that 32bit accesses result in distorted sensitivity ++ * on his card. Unconfirmed, looks like it's not true (most likely since we ++ * now properly flush writes). */ ++ write_reg32(adev, IO_ACX_PHY_DATA, value); ++ write_reg32(adev, IO_ACX_PHY_ADDR, reg); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_PHY_CTL, 1); ++ write_flush(adev); ++ ++ count = 0xffff; ++ while (read_reg32(adev, IO_ACX_PHY_CTL)) { ++ /* scheduling away instead of CPU burning loop ++ * doesn't seem to work here at all: ++ * awful delay, sometimes also failure. ++ * Doesn't matter anyway (only small delay). */ ++ if (unlikely(!--count)) { ++ printk("%s: timeout waiting for phy read\n", ++ adev->ndev->name); ++ goto fail; ++ } ++ cpu_relax(); ++ } ++ ++ log(L_DEBUG, "radio PHY write 0x%02X at 0x%04X\n", value, reg); ++ fail: ++ FN_EXIT1(OK); ++ return OK; ++} ++ ++ ++#define NO_AUTO_INCREMENT 1 ++ ++/*********************************************************************** ++** acxmem_s_write_fw ++** ++** Write the firmware image into the card. ++** ++** Arguments: ++** adev wlan device structure ++** fw_image firmware image. ++** ++** Returns: ++** 1 firmware image corrupted ++** 0 success ++*/ ++static int ++acxmem_s_write_fw(acx_device_t *adev, const firmware_image_t *fw_image, u32 offset) ++{ ++ int len, size, checkMismatch = -1; ++ u32 sum, v32, tmp, id; ++ /* we skip the first four bytes which contain the control sum */ ++ const u8 *p = (u8*)fw_image + 4; ++ ++ /* start the image checksum by adding the image size value */ ++ sum = p[0]+p[1]+p[2]+p[3]; ++ p += 4; ++ ++#ifdef NOPE ++#if NO_AUTO_INCREMENT ++ write_reg32(adev, IO_ACX_SLV_MEM_CTL, 0); /* use basic mode */ ++#else ++ write_reg32(adev, IO_ACX_SLV_MEM_CTL, 1); /* use autoincrement mode */ ++ write_reg32(adev, IO_ACX_SLV_MEM_ADDR, offset); /* configure start address */ ++ write_flush(adev); ++#endif ++#endif ++ len = 0; ++ size = le32_to_cpu(fw_image->size) & (~3); ++ ++ while (likely(len < size)) { ++ v32 = be32_to_cpu(*(u32*)p); ++ sum += p[0]+p[1]+p[2]+p[3]; ++ p += 4; ++ len += 4; ++ ++#ifdef NOPE ++#if NO_AUTO_INCREMENT ++ write_reg32(adev, IO_ACX_SLV_MEM_ADDR, offset + len - 4); ++ write_flush(adev); ++#endif ++ write_reg32(adev, IO_ACX_SLV_MEM_DATA, v32); ++ write_flush(adev); ++#endif ++ write_slavemem32 (adev, offset + len - 4, v32); ++ ++ id = read_id_register (adev); ++ ++ /* ++ * check the data written ++ */ ++ tmp = read_slavemem32 (adev, offset + len - 4); ++ if (checkMismatch && (tmp != v32)) { ++ printk ("first data mismatch at 0x%08x good 0x%08x bad 0x%08x id 0x%08x\n", ++ offset + len - 4, v32, tmp, id); ++ checkMismatch = 0; ++ } ++ } ++ log(L_DEBUG, "firmware written, size:%d sum1:%x sum2:%x\n", ++ size, sum, le32_to_cpu(fw_image->chksum)); ++ ++ /* compare our checksum with the stored image checksum */ ++ return (sum != le32_to_cpu(fw_image->chksum)); ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_validate_fw ++** ++** Compare the firmware image given with ++** the firmware image written into the card. ++** ++** Arguments: ++** adev wlan device structure ++** fw_image firmware image. ++** ++** Returns: ++** NOT_OK firmware image corrupted or not correctly written ++** OK success ++*/ ++static int ++acxmem_s_validate_fw(acx_device_t *adev, const firmware_image_t *fw_image, ++ u32 offset) ++{ ++ u32 sum, v32, w32; ++ int len, size; ++ int result = OK; ++ /* we skip the first four bytes which contain the control sum */ ++ const u8 *p = (u8*)fw_image + 4; ++ ++ /* start the image checksum by adding the image size value */ ++ sum = p[0]+p[1]+p[2]+p[3]; ++ p += 4; ++ ++ write_reg32(adev, IO_ACX_SLV_END_CTL, 0); ++ ++#if NO_AUTO_INCREMENT ++ write_reg32(adev, IO_ACX_SLV_MEM_CTL, 0); /* use basic mode */ ++#else ++ write_reg32(adev, IO_ACX_SLV_MEM_CTL, 1); /* use autoincrement mode */ ++ write_reg32(adev, IO_ACX_SLV_MEM_ADDR, offset); /* configure start address */ ++#endif ++ ++ len = 0; ++ size = le32_to_cpu(fw_image->size) & (~3); ++ ++ while (likely(len < size)) { ++ v32 = be32_to_cpu(*(u32*)p); ++ p += 4; ++ len += 4; ++ ++#ifdef NOPE ++#if NO_AUTO_INCREMENT ++ write_reg32(adev, IO_ACX_SLV_MEM_ADDR, offset + len - 4); ++#endif ++ udelay(10); ++ w32 = read_reg32(adev, IO_ACX_SLV_MEM_DATA); ++#endif ++ w32 = read_slavemem32 (adev, offset + len - 4); ++ ++ if (unlikely(w32 != v32)) { ++ printk("acx: FATAL: firmware upload: " ++ "data parts at offset %d don't match\n(0x%08X vs. 0x%08X)!\n" ++ "I/O timing issues or defective memory, with DWL-xx0+? " ++ "ACX_IO_WIDTH=16 may help. Please report\n", ++ len, v32, w32); ++ result = NOT_OK; ++ break; ++ } ++ ++ sum += (u8)w32 + (u8)(w32>>8) + (u8)(w32>>16) + (u8)(w32>>24); ++ } ++ ++ /* sum control verification */ ++ if (result != NOT_OK) { ++ if (sum != le32_to_cpu(fw_image->chksum)) { ++ printk("acx: FATAL: firmware upload: " ++ "checksums don't match!\n"); ++ result = NOT_OK; ++ } ++ } ++ ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_upload_fw ++** ++** Called from acx_reset_dev ++*/ ++static int ++acxmem_s_upload_fw(acx_device_t *adev) ++{ ++ firmware_image_t *fw_image = NULL; ++ int res = NOT_OK; ++ int try; ++ u32 file_size; ++ char *filename = "WLANGEN.BIN"; ++#ifdef PATCH_AROUND_BAD_SPOTS ++ u32 offset; ++ int i; ++ /* ++ * arm-linux-objdump -d patch.bin, or ++ * od -Ax -t x4 patch.bin after finding the bounds ++ * of the .text section with arm-linux-objdump -s patch.bin ++ */ ++ u32 patch[] = { ++ 0xe584c030, 0xe59fc008, ++ 0xe92d1000, 0xe59fc004, 0xe8bd8000, 0x0000080c, ++ 0x0000aa68, 0x605a2200, 0x2c0a689c, 0x2414d80a, ++ 0x2f00689f, 0x1c27d007, 0x06241e7c, 0x2f000e24, ++ 0xe000d1f6, 0x602e6018, 0x23036468, 0x480203db, ++ 0x60ca6003, 0xbdf0750a, 0xffff0808 ++ }; ++#endif ++ ++ FN_ENTER; ++ /* No combined image; tell common we need the radio firmware, too */ ++ adev->need_radio_fw = 1; ++ ++ fw_image = acx_s_read_fw(adev->dev, filename, &file_size); ++ if (!fw_image) { ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++ } ++ ++ for (try = 1; try <= 5; try++) { ++ res = acxmem_s_write_fw(adev, fw_image, 0); ++ log(L_DEBUG|L_INIT, "acx_write_fw (main): %d\n", res); ++ if (OK == res) { ++ res = acxmem_s_validate_fw(adev, fw_image, 0); ++ log(L_DEBUG|L_INIT, "acx_validate_fw " ++ "(main): %d\n", res); ++ } ++ ++ if (OK == res) { ++ SET_BIT(adev->dev_state_mask, ACX_STATE_FW_LOADED); ++ break; ++ } ++ printk("acx: firmware upload attempt #%d FAILED, " ++ "retrying...\n", try); ++ acx_s_msleep(1000); /* better wait for a while... */ ++ } ++ ++#ifdef PATCH_AROUND_BAD_SPOTS ++ /* ++ * Only want to do this if the firmware is exactly what we expect for an ++ * iPaq 4700; otherwise, bad things would ensue. ++ */ ++ if ((HX4700_FIRMWARE_CHECKSUM == fw_image->chksum) || ++ (HX4700_ALTERNATE_FIRMWARE_CHECKSUM == fw_image->chksum)) { ++ /* ++ * Put the patch after the main firmware image. 0x950c contains ++ * the ACX's idea of the end of the firmware. Use that location to ++ * load ours (which depends on that location being 0xab58) then ++ * update that location to point to after ours. ++ */ ++ ++ offset = read_slavemem32 (adev, 0x950c); ++ ++ log (L_DEBUG, "acx: patching in at 0x%04x\n", offset); ++ ++ for (i = 0; i < sizeof(patch) / sizeof(patch[0]); i++) { ++ write_slavemem32 (adev, offset, patch[i]); ++ offset += sizeof(u32); ++ } ++ ++ /* ++ * Patch the instruction at 0x0804 to branch to our ARM patch at 0xab58 ++ */ ++ write_slavemem32 (adev, 0x0804, 0xea000000 + (0xab58-0x0804-8)/4); ++ ++ /* ++ * Patch the instructions at 0x1f40 to branch to our Thumb patch at 0xab74 ++ * ++ * 4a00 ldr r2, [pc, #0] ++ * 4710 bx r2 ++ * .data 0xab74+1 ++ */ ++ write_slavemem32 (adev, 0x1f40, 0x47104a00); ++ write_slavemem32 (adev, 0x1f44, 0x0000ab74+1); ++ ++ /* ++ * Bump the end of the firmware up to beyond our patch. ++ */ ++ write_slavemem32 (adev, 0x950c, offset); ++ ++ } ++#endif ++ ++ vfree(fw_image); ++ ++ FN_EXIT1(res); ++ return res; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_upload_radio ++** ++** Uploads the appropriate radio module firmware into the card. ++*/ ++int ++acxmem_s_upload_radio(acx_device_t *adev) ++{ ++ acx_ie_memmap_t mm; ++ firmware_image_t *radio_image; ++ acx_cmd_radioinit_t radioinit; ++ int res = NOT_OK; ++ int try; ++ u32 offset; ++ u32 size; ++ char filename[sizeof("RADIONN.BIN")]; ++ ++ if (!adev->need_radio_fw) return OK; ++ ++ FN_ENTER; ++ ++ acx_s_interrogate(adev, &mm, ACX1xx_IE_MEMORY_MAP); ++ offset = le32_to_cpu(mm.CodeEnd); ++ ++ snprintf(filename, sizeof(filename), "RADIO%02x.BIN", ++ adev->radio_type); ++ radio_image = acx_s_read_fw(adev->dev, filename, &size); ++ if (!radio_image) { ++ printk("acx: can't load radio module '%s'\n", filename); ++ goto fail; ++ } ++ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_SLEEP, NULL, 0); ++ ++ for (try = 1; try <= 5; try++) { ++ res = acxmem_s_write_fw(adev, radio_image, offset); ++ log(L_DEBUG|L_INIT, "acx_write_fw (radio): %d\n", res); ++ if (OK == res) { ++ res = acxmem_s_validate_fw(adev, radio_image, offset); ++ log(L_DEBUG|L_INIT, "acx_validate_fw (radio): %d\n", res); ++ } ++ ++ if (OK == res) ++ break; ++ printk("acx: radio firmware upload attempt #%d FAILED, " ++ "retrying...\n", try); ++ acx_s_msleep(1000); /* better wait for a while... */ ++ } ++ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_WAKE, NULL, 0); ++ radioinit.offset = cpu_to_le32(offset); ++ ++ /* no endian conversion needed, remains in card CPU area: */ ++ radioinit.len = radio_image->size; ++ ++ vfree(radio_image); ++ ++ if (OK != res) ++ goto fail; ++ ++ /* will take a moment so let's have a big timeout */ ++ acx_s_issue_cmd_timeo(adev, ACX1xx_CMD_RADIOINIT, ++ &radioinit, sizeof(radioinit), CMD_TIMEOUT_MS(1000)); ++ ++ res = acx_s_interrogate(adev, &mm, ACX1xx_IE_MEMORY_MAP); ++ ++fail: ++ FN_EXIT1(res); ++ return res; ++} ++ ++/*********************************************************************** ++** acxmem_l_reset_mac ++** ++** MAC will be reset ++** Call context: reset_dev ++*/ ++static void ++acxmem_l_reset_mac(acx_device_t *adev) ++{ ++ int count; ++ FN_ENTER; ++ ++ /* halt eCPU */ ++ set_regbits (adev, IO_ACX_ECPU_CTRL, 0x1); ++ ++ /* now do soft reset of eCPU, set bit */ ++ set_regbits (adev, IO_ACX_SOFT_RESET, 0x1); ++ log(L_DEBUG, "%s: enable soft reset...\n", __func__); ++ ++ /* Windows driver sleeps here for a while with this sequence */ ++ for (count = 0; count < 200; count++) { ++ udelay (50); ++ } ++ ++ /* now clear bit again: deassert eCPU reset */ ++ log(L_DEBUG, "%s: disable soft reset and go to init mode...\n", __func__); ++ clear_regbits (adev, IO_ACX_SOFT_RESET, 0x1); ++ ++ /* now start a burst read from initial EEPROM */ ++ set_regbits (adev, IO_ACX_EE_START, 0x1); ++ ++ /* ++ * Windows driver sleeps here for a while with this sequence ++ */ ++ for (count = 0; count < 200; count++) { ++ udelay (50); ++ } ++ ++ /* Windows driver writes 0x10000 to register 0x808 here */ ++ ++ write_reg32 (adev, 0x808, 0x10000); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_verify_init ++*/ ++static int ++acxmem_s_verify_init(acx_device_t *adev) ++{ ++ int result = NOT_OK; ++ unsigned long timeout; ++ ++ FN_ENTER; ++ ++ timeout = jiffies + 2*HZ; ++ for (;;) { ++ u32 irqstat = read_reg32(adev, IO_ACX_IRQ_STATUS_NON_DES); ++ if ((irqstat != 0xFFFFFFFF) && (irqstat & HOST_INT_FCS_THRESHOLD)) { ++ result = OK; ++ write_reg32(adev, IO_ACX_IRQ_ACK, HOST_INT_FCS_THRESHOLD); ++ break; ++ } ++ if (time_after(jiffies, timeout)) ++ break; ++ /* Init may take up to ~0.5 sec total */ ++ acx_s_msleep(50); ++ } ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** A few low-level helpers ++** ++** Note: these functions are not protected by lock ++** and thus are never allowed to be called from IRQ. ++** Also they must not race with fw upload which uses same hw regs ++*/ ++ ++/*********************************************************************** ++** acxmem_write_cmd_type_status ++*/ ++ ++static inline void ++acxmem_write_cmd_type_status(acx_device_t *adev, u16 type, u16 status) ++{ ++ write_slavemem32 (adev, (u32) adev->cmd_area, type | (status << 16)); ++ write_flush(adev); ++} ++ ++ ++/*********************************************************************** ++** acxmem_read_cmd_type_status ++*/ ++static u32 ++acxmem_read_cmd_type_status(acx_device_t *adev) ++{ ++ u32 cmd_type, cmd_status; ++ ++ cmd_type = read_slavemem32 (adev, (u32) adev->cmd_area); ++ ++ cmd_status = (cmd_type >> 16); ++ cmd_type = (u16)cmd_type; ++ ++ log(L_CTL, "cmd_type:%04X cmd_status:%04X [%s]\n", ++ cmd_type, cmd_status, ++ acx_cmd_status_str(cmd_status)); ++ ++ return cmd_status; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_reset_dev ++** ++** Arguments: ++** netdevice that contains the adev variable ++** Returns: ++** NOT_OK on fail ++** OK on success ++** Side effects: ++** device is hard reset ++** Call context: ++** acxmem_e_probe ++** Comment: ++** This resets the device using low level hardware calls ++** as well as uploads and verifies the firmware to the card ++*/ ++ ++static inline void ++init_mboxes(acx_device_t *adev) ++{ ++ u32 cmd_offs, info_offs; ++ ++ cmd_offs = read_reg32(adev, IO_ACX_CMD_MAILBOX_OFFS); ++ info_offs = read_reg32(adev, IO_ACX_INFO_MAILBOX_OFFS); ++ adev->cmd_area = (u8*) cmd_offs; ++ adev->info_area = (u8*) info_offs; ++ /* ++ log(L_DEBUG, "iobase2=%p\n" ++ */ ++ log( L_DEBUG, "cmd_mbox_offset=%X cmd_area=%p\n" ++ "info_mbox_offset=%X info_area=%p\n", ++ cmd_offs, adev->cmd_area, ++ info_offs, adev->info_area); ++} ++ ++ ++static inline void ++read_eeprom_area(acx_device_t *adev) ++{ ++#if ACX_DEBUG > 1 ++ int offs; ++ u8 tmp; ++ ++ for (offs = 0x8c; offs < 0xb9; offs++) ++ acxmem_read_eeprom_byte(adev, offs, &tmp); ++#endif ++} ++ ++static int ++acxmem_s_reset_dev(acx_device_t *adev) ++{ ++ const char* msg = ""; ++ unsigned long flags; ++ int result = NOT_OK; ++ u16 hardware_info; ++ u16 ecpu_ctrl; ++ int count; ++ u32 tmp; ++ ++ FN_ENTER; ++ /* ++ write_reg32 (adev, IO_ACX_SLV_MEM_CP, 0); ++ */ ++ /* reset the device to make sure the eCPU is stopped ++ * to upload the firmware correctly */ ++ ++ acx_lock(adev, flags); ++ ++ /* Windows driver does some funny things here */ ++ /* ++ * clear bit 0x200 in register 0x2A0 ++ */ ++ clear_regbits (adev, 0x2A0, 0x200); ++ ++ /* ++ * Set bit 0x200 in ACX_GPIO_OUT ++ */ ++ set_regbits (adev, IO_ACX_GPIO_OUT, 0x200); ++ ++ /* ++ * read register 0x900 until its value is 0x8400104C, sleeping ++ * in between reads if it's not immediate ++ */ ++ tmp = read_reg32 (adev, REG_ACX_VENDOR_ID); ++ count = 500; ++ while (count-- && (tmp != ACX_VENDOR_ID)) { ++ mdelay (10); ++ tmp = read_reg32 (adev, REG_ACX_VENDOR_ID); ++ } ++ ++ /* end what Windows driver does */ ++ ++ acxmem_l_reset_mac(adev); ++ ++ ecpu_ctrl = read_reg32(adev, IO_ACX_ECPU_CTRL) & 1; ++ if (!ecpu_ctrl) { ++ msg = "eCPU is already running. "; ++ goto end_unlock; ++ } ++ ++#ifdef WE_DONT_NEED_THAT_DO_WE ++ if (read_reg16(adev, IO_ACX_SOR_CFG) & 2) { ++ /* eCPU most likely means "embedded CPU" */ ++ msg = "eCPU did not start after boot from flash. "; ++ goto end_unlock; ++ } ++ ++ /* check sense on reset flags */ ++ if (read_reg16(adev, IO_ACX_SOR_CFG) & 0x10) { ++ printk("%s: eCPU did not start after boot (SOR), " ++ "is this fatal?\n", adev->ndev->name); ++ } ++#endif ++ /* scan, if any, is stopped now, setting corresponding IRQ bit */ ++ adev->irq_status |= HOST_INT_SCAN_COMPLETE; ++ ++ acx_unlock(adev, flags); ++ ++ /* need to know radio type before fw load */ ++ /* Need to wait for arrival of this information in a loop, ++ * most probably since eCPU runs some init code from EEPROM ++ * (started burst read in reset_mac()) which also ++ * sets the radio type ID */ ++ ++ count = 0xffff; ++ do { ++ hardware_info = read_reg16(adev, IO_ACX_EEPROM_INFORMATION); ++ if (!--count) { ++ msg = "eCPU didn't indicate radio type"; ++ goto end_fail; ++ } ++ cpu_relax(); ++ } while (!(hardware_info & 0xff00)); /* radio type still zero? */ ++ printk("ACX radio type 0x%02x\n", (hardware_info >> 8) & 0xff); ++ /* printk("DEBUG: count %d\n", count); */ ++ adev->form_factor = hardware_info & 0xff; ++ adev->radio_type = hardware_info >> 8; ++ ++ /* load the firmware */ ++ if (OK != acxmem_s_upload_fw(adev)) ++ goto end_fail; ++ ++ /* acx_s_msleep(10); this one really shouldn't be required */ ++ ++ /* now start eCPU by clearing bit */ ++ clear_regbits (adev, IO_ACX_ECPU_CTRL, 0x1); ++ log(L_DEBUG, "booted eCPU up and waiting for completion...\n"); ++ ++ /* Windows driver clears bit 0x200 in register 0x2A0 here */ ++ clear_regbits (adev, 0x2A0, 0x200); ++ ++ /* Windows driver sets bit 0x200 in ACX_GPIO_OUT here */ ++ set_regbits (adev, IO_ACX_GPIO_OUT, 0x200); ++ /* wait for eCPU bootup */ ++ if (OK != acxmem_s_verify_init(adev)) { ++ msg = "timeout waiting for eCPU. "; ++ goto end_fail; ++ } ++ log(L_DEBUG, "eCPU has woken up, card is ready to be configured\n"); ++ init_mboxes(adev); ++ acxmem_write_cmd_type_status(adev, ACX1xx_CMD_RESET, 0); ++ ++ /* test that EEPROM is readable */ ++ read_eeprom_area(adev); ++ ++ result = OK; ++ goto end; ++ ++/* Finish error message. Indicate which function failed */ ++end_unlock: ++ acx_unlock(adev, flags); ++end_fail: ++ printk("acx: %sreset_dev() FAILED\n", msg); ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_issue_cmd_timeo ++** ++** Sends command to fw, extract result ++** ++** NB: we do _not_ take lock inside, so be sure to not touch anything ++** which may interfere with IRQ handler operation ++** ++** TODO: busy wait is a bit silly, so: ++** 1) stop doing many iters - go to sleep after first ++** 2) go to waitqueue based approach: wait, not poll! ++*/ ++#undef FUNC ++#define FUNC "issue_cmd" ++ ++#if !ACX_DEBUG ++int ++acxmem_s_issue_cmd_timeo( ++ acx_device_t *adev, ++ unsigned int cmd, ++ void *buffer, ++ unsigned buflen, ++ unsigned cmd_timeout) ++{ ++#else ++int ++acxmem_s_issue_cmd_timeo_debug( ++ acx_device_t *adev, ++ unsigned cmd, ++ void *buffer, ++ unsigned buflen, ++ unsigned cmd_timeout, ++ const char* cmdstr) ++{ ++ unsigned long start = jiffies; ++#endif ++ const char *devname; ++ unsigned counter; ++ u16 irqtype; ++ int i, j; ++ u8 *p; ++ u16 cmd_status; ++ unsigned long timeout; ++ ++ FN_ENTER; ++ ++ devname = adev->ndev->name; ++ if (!devname || !devname[0] || devname[4]=='%') ++ devname = "acx"; ++ ++ log(L_CTL, FUNC"(cmd:%s,buflen:%u,timeout:%ums,type:0x%04X)\n", ++ cmdstr, buflen, cmd_timeout, ++ buffer ? le16_to_cpu(((acx_ie_generic_t *)buffer)->type) : -1); ++ ++ if (!(adev->dev_state_mask & ACX_STATE_FW_LOADED)) { ++ printk("%s: "FUNC"(): firmware is not loaded yet, " ++ "cannot execute commands!\n", devname); ++ goto bad; ++ } ++ ++ if ((acx_debug & L_DEBUG) && (cmd != ACX1xx_CMD_INTERROGATE)) { ++ printk("input buffer (len=%u):\n", buflen); ++ acx_dump_bytes(buffer, buflen); ++ } ++ ++ /* wait for firmware to become idle for our command submission */ ++ timeout = HZ/5; ++ counter = (timeout * 1000 / HZ) - 1; /* in ms */ ++ timeout += jiffies; ++ do { ++ cmd_status = acxmem_read_cmd_type_status(adev); ++ /* Test for IDLE state */ ++ if (!cmd_status) ++ break; ++ if (counter % 8 == 0) { ++ if (time_after(jiffies, timeout)) { ++ counter = 0; ++ break; ++ } ++ /* we waited 8 iterations, no luck. Sleep 8 ms */ ++ acx_s_msleep(8); ++ } ++ } while (likely(--counter)); ++ ++ if (!counter) { ++ /* the card doesn't get idle, we're in trouble */ ++ printk("%s: "FUNC"(): cmd_status is not IDLE: 0x%04X!=0\n", ++ devname, cmd_status); ++#if DUMP_IF_SLOW > 0 ++ dump_acxmem (adev, 0, 0x10000); ++ panic ("not idle"); ++#endif ++ goto bad; ++ } else if (counter < 190) { /* if waited >10ms... */ ++ log(L_CTL|L_DEBUG, FUNC"(): waited for IDLE %dms. " ++ "Please report\n", 199 - counter); ++ } ++ ++ /* now write the parameters of the command if needed */ ++ if (buffer && buflen) { ++ /* if it's an INTERROGATE command, just pass the length ++ * of parameters to read, as data */ ++#if CMD_DISCOVERY ++ if (cmd == ACX1xx_CMD_INTERROGATE) ++ memset_io(adev->cmd_area + 4, 0xAA, buflen); ++#endif ++ /* ++ * slave memory version ++ */ ++ copy_to_slavemem (adev, (u32) (adev->cmd_area + 4), buffer, ++ (cmd == ACX1xx_CMD_INTERROGATE) ? 4 : buflen); ++ } ++ /* now write the actual command type */ ++ acxmem_write_cmd_type_status(adev, cmd, 0); ++ ++ /* clear CMD_COMPLETE bit. can be set only by IRQ handler: */ ++ adev->irq_status &= ~HOST_INT_CMD_COMPLETE; ++ ++ /* execute command */ ++ write_reg16(adev, IO_ACX_INT_TRIG, INT_TRIG_CMD); ++ write_flush(adev); ++ ++ /* wait for firmware to process command */ ++ ++ /* Ensure nonzero and not too large timeout. ++ ** Also converts e.g. 100->99, 200->199 ++ ** which is nice but not essential */ ++ cmd_timeout = (cmd_timeout-1) | 1; ++ if (unlikely(cmd_timeout > 1199)) ++ cmd_timeout = 1199; ++ ++ /* we schedule away sometimes (timeout can be large) */ ++ counter = cmd_timeout; ++ timeout = jiffies + cmd_timeout * HZ / 1000; ++ do { ++ if (!adev->irqs_active) { /* IRQ disabled: poll */ ++ irqtype = read_reg16(adev, IO_ACX_IRQ_STATUS_NON_DES); ++ if (irqtype & HOST_INT_CMD_COMPLETE) { ++ write_reg16(adev, IO_ACX_IRQ_ACK, ++ HOST_INT_CMD_COMPLETE); ++ break; ++ } ++ } else { /* Wait when IRQ will set the bit */ ++ irqtype = adev->irq_status; ++ if (irqtype & HOST_INT_CMD_COMPLETE) ++ break; ++ } ++ ++ if (counter % 8 == 0) { ++ if (time_after(jiffies, timeout)) { ++ counter = 0; ++ break; ++ } ++ /* we waited 8 iterations, no luck. Sleep 8 ms */ ++ acx_s_msleep(8); ++ } ++ } while (likely(--counter)); ++ ++ /* save state for debugging */ ++ cmd_status = acxmem_read_cmd_type_status(adev); ++ ++ /* put the card in IDLE state */ ++ acxmem_write_cmd_type_status(adev, ACX1xx_CMD_RESET, 0); ++ ++ if (!counter) { /* timed out! */ ++ printk("%s: "FUNC"(): timed out %s for CMD_COMPLETE. " ++ "irq bits:0x%04X irq_status:0x%04X timeout:%dms " ++ "cmd_status:%d (%s)\n", ++ devname, (adev->irqs_active) ? "waiting" : "polling", ++ irqtype, adev->irq_status, cmd_timeout, ++ cmd_status, acx_cmd_status_str(cmd_status)); ++ printk("%s: "FUNC"(): device irq status 0x%04x\n", ++ devname, read_reg16(adev, IO_ACX_IRQ_STATUS_NON_DES)); ++ printk("%s: "FUNC"(): IO_ACX_IRQ_MASK 0x%04x IO_ACX_FEMR 0x%04x\n", ++ devname, ++ read_reg16 (adev, IO_ACX_IRQ_MASK), ++ read_reg16 (adev, IO_ACX_FEMR)); ++ if (read_reg16 (adev, IO_ACX_IRQ_MASK) == 0xffff) { ++ printk ("acxmem: firmware probably hosed - reloading\n"); ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11) ++ { ++ pm_message_t state; ++ acxmem_e_suspend (resume_pdev, state); ++ } ++#else ++ acxmem_e_suspend (adev->dev, 0); ++#endif ++ { ++ struct work_struct *notused; ++ fw_resumer (notused); ++ } ++ } ++ ++ goto bad; ++ } else if (cmd_timeout - counter > 30) { /* if waited >30ms... */ ++ log(L_CTL|L_DEBUG, FUNC"(): %s for CMD_COMPLETE %dms. " ++ "count:%d. Please report\n", ++ (adev->irqs_active) ? "waited" : "polled", ++ cmd_timeout - counter, counter); ++ } ++ ++ if (1 != cmd_status) { /* it is not a 'Success' */ ++ printk("%s: "FUNC"(): cmd_status is not SUCCESS: %d (%s). " ++ "Took %dms of %d\n", ++ devname, cmd_status, acx_cmd_status_str(cmd_status), ++ cmd_timeout - counter, cmd_timeout); ++ /* zero out result buffer ++ * WARNING: this will trash stack in case of illegally large input ++ * length! */ ++ if (buflen > 388) { ++ /* ++ * 388 is maximum command length ++ */ ++ printk ("invalid length 0x%08x\n", buflen); ++ buflen = 388; ++ } ++ p = (u8 *) buffer; ++ for (i = 0; i < buflen; i+= 16) { ++ printk ("%04x:", i); ++ for (j = 0; (j < 16) && (i+j < buflen); j++) { ++ printk (" %02x", *p++); ++ } ++ printk ("\n"); ++ } ++ ++ if (buffer && buflen) ++ memset(buffer, 0, buflen); ++ goto bad; ++ } ++ ++ /* read in result parameters if needed */ ++ if (buffer && buflen && (cmd == ACX1xx_CMD_INTERROGATE)) { ++ copy_from_slavemem (adev, buffer, (u32) (adev->cmd_area + 4), buflen); ++ if (acx_debug & L_DEBUG) { ++ printk("output buffer (len=%u): ", buflen); ++ acx_dump_bytes(buffer, buflen); ++ } ++ } ++ ++/* ok: */ ++ log(L_CTL, FUNC"(%s): took %ld jiffies to complete\n", ++ cmdstr, jiffies - start); ++ FN_EXIT1(OK); ++ return OK; ++ ++bad: ++ /* Give enough info so that callers can avoid ++ ** printing their own diagnostic messages */ ++#if ACX_DEBUG ++ printk("%s: "FUNC"(cmd:%s) FAILED\n", devname, cmdstr); ++#else ++ printk("%s: "FUNC"(cmd:0x%04X) FAILED\n", devname, cmd); ++#endif ++ dump_stack(); ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*********************************************************************** ++*/ ++#if defined(NONESSENTIAL_FEATURES) ++typedef struct device_id { ++ unsigned char id[6]; ++ char *descr; ++ char *type; ++} device_id_t; ++ ++static const device_id_t ++device_ids[] = ++{ ++ { ++ {'G', 'l', 'o', 'b', 'a', 'l'}, ++ NULL, ++ NULL, ++ }, ++ { ++ {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}, ++ "uninitialized", ++ "SpeedStream SS1021 or Gigafast WF721-AEX" ++ }, ++ { ++ {0x80, 0x81, 0x82, 0x83, 0x84, 0x85}, ++ "non-standard", ++ "DrayTek Vigor 520" ++ }, ++ { ++ {'?', '?', '?', '?', '?', '?'}, ++ "non-standard", ++ "Level One WPC-0200" ++ }, ++ { ++ {0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, ++ "empty", ++ "DWL-650+ variant" ++ } ++}; ++ ++static void ++acx_show_card_eeprom_id(acx_device_t *adev) ++{ ++ unsigned char buffer[CARD_EEPROM_ID_SIZE]; ++ int i; ++ ++ memset(&buffer, 0, CARD_EEPROM_ID_SIZE); ++ /* use direct EEPROM access */ ++ for (i = 0; i < CARD_EEPROM_ID_SIZE; i++) { ++ if (OK != acxmem_read_eeprom_byte(adev, ++ ACX100_EEPROM_ID_OFFSET + i, ++ &buffer[i])) { ++ printk("acx: reading EEPROM FAILED\n"); ++ break; ++ } ++ } ++ ++ for (i = 0; i < VEC_SIZE(device_ids); i++) { ++ if (!memcmp(&buffer, device_ids[i].id, CARD_EEPROM_ID_SIZE)) { ++ if (device_ids[i].descr) { ++ printk("acx: EEPROM card ID string check " ++ "found %s card ID: is this %s?\n", ++ device_ids[i].descr, device_ids[i].type); ++ } ++ break; ++ } ++ } ++ if (i == VEC_SIZE(device_ids)) { ++ printk("acx: EEPROM card ID string check found " ++ "unknown card: expected 'Global', got '%.*s\'. " ++ "Please report\n", CARD_EEPROM_ID_SIZE, buffer); ++ } ++} ++#endif /* NONESSENTIAL_FEATURES */ ++ ++/*********************************************************************** ++** acxmem_free_desc_queues ++** ++** Releases the queues that have been allocated, the ++** others have been initialised to NULL so this ++** function can be used if only part of the queues were allocated. ++*/ ++ ++void ++acxmem_free_desc_queues(acx_device_t *adev) ++{ ++#define ACX_FREE_QUEUE(size, ptr, phyaddr) \ ++ if (ptr) { \ ++ kfree(ptr); \ ++ ptr = NULL; \ ++ size = 0; \ ++ } ++ ++ FN_ENTER; ++ ++ ACX_FREE_QUEUE(adev->txhostdesc_area_size, adev->txhostdesc_start, adev->txhostdesc_startphy); ++ ACX_FREE_QUEUE(adev->txbuf_area_size, adev->txbuf_start, adev->txbuf_startphy); ++ ++ adev->txdesc_start = NULL; ++ ++ ACX_FREE_QUEUE(adev->rxhostdesc_area_size, adev->rxhostdesc_start, adev->rxhostdesc_startphy); ++ ACX_FREE_QUEUE(adev->rxbuf_area_size, adev->rxbuf_start, adev->rxbuf_startphy); ++ ++ adev->rxdesc_start = NULL; ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_delete_dma_regions ++*/ ++static void ++acxmem_s_delete_dma_regions(acx_device_t *adev) ++{ ++ unsigned long flags; ++ ++ FN_ENTER; ++ /* disable radio Tx/Rx. Shouldn't we use the firmware commands ++ * here instead? Or are we that much down the road that it's no ++ * longer possible here? */ ++ /* ++ * slave memory interface really doesn't like this. ++ */ ++ /* ++ write_reg16(adev, IO_ACX_ENABLE, 0); ++ */ ++ ++ acx_s_msleep(100); ++ ++ acx_lock(adev, flags); ++ acxmem_free_desc_queues(adev); ++ acx_unlock(adev, flags); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_e_probe ++** ++** Probe routine called when a PCI device w/ matching ID is found. ++** Here's the sequence: ++** - Allocate the PCI resources. ++** - Read the PCMCIA attribute memory to make sure we have a WLAN card ++** - Reset the MAC ++** - Initialize the dev and wlan data ++** - Initialize the MAC ++** ++** pdev - ptr to pci device structure containing info about pci configuration ++** id - ptr to the device id entry that matched this device ++*/ ++static const u16 ++IO_ACX100[] = ++{ ++ 0x0000, /* IO_ACX_SOFT_RESET */ ++ ++ 0x0014, /* IO_ACX_SLV_MEM_ADDR */ ++ 0x0018, /* IO_ACX_SLV_MEM_DATA */ ++ 0x001c, /* IO_ACX_SLV_MEM_CTL */ ++ 0x0020, /* IO_ACX_SLV_END_CTL */ ++ ++ 0x0034, /* IO_ACX_FEMR */ ++ ++ 0x007c, /* IO_ACX_INT_TRIG */ ++ 0x0098, /* IO_ACX_IRQ_MASK */ ++ 0x00a4, /* IO_ACX_IRQ_STATUS_NON_DES */ ++ 0x00a8, /* IO_ACX_IRQ_STATUS_CLEAR */ ++ 0x00ac, /* IO_ACX_IRQ_ACK */ ++ 0x00b0, /* IO_ACX_HINT_TRIG */ ++ ++ 0x0104, /* IO_ACX_ENABLE */ ++ ++ 0x0250, /* IO_ACX_EEPROM_CTL */ ++ 0x0254, /* IO_ACX_EEPROM_ADDR */ ++ 0x0258, /* IO_ACX_EEPROM_DATA */ ++ 0x025c, /* IO_ACX_EEPROM_CFG */ ++ ++ 0x0268, /* IO_ACX_PHY_ADDR */ ++ 0x026c, /* IO_ACX_PHY_DATA */ ++ 0x0270, /* IO_ACX_PHY_CTL */ ++ ++ 0x0290, /* IO_ACX_GPIO_OE */ ++ ++ 0x0298, /* IO_ACX_GPIO_OUT */ ++ ++ 0x02a4, /* IO_ACX_CMD_MAILBOX_OFFS */ ++ 0x02a8, /* IO_ACX_INFO_MAILBOX_OFFS */ ++ 0x02ac, /* IO_ACX_EEPROM_INFORMATION */ ++ ++ 0x02d0, /* IO_ACX_EE_START */ ++ 0x02d4, /* IO_ACX_SOR_CFG */ ++ 0x02d8 /* IO_ACX_ECPU_CTRL */ ++}; ++ ++static const u16 ++IO_ACX111[] = ++{ ++ 0x0000, /* IO_ACX_SOFT_RESET */ ++ ++ 0x0014, /* IO_ACX_SLV_MEM_ADDR */ ++ 0x0018, /* IO_ACX_SLV_MEM_DATA */ ++ 0x001c, /* IO_ACX_SLV_MEM_CTL */ ++ 0x0020, /* IO_ACX_SLV_MEM_CP */ ++ ++ 0x0034, /* IO_ACX_FEMR */ ++ ++ 0x00b4, /* IO_ACX_INT_TRIG */ ++ 0x00d4, /* IO_ACX_IRQ_MASK */ ++ /* we do mean NON_DES (0xf0), not NON_DES_MASK which is at 0xe0: */ ++ 0x00f0, /* IO_ACX_IRQ_STATUS_NON_DES */ ++ 0x00e4, /* IO_ACX_IRQ_STATUS_CLEAR */ ++ 0x00e8, /* IO_ACX_IRQ_ACK */ ++ 0x00ec, /* IO_ACX_HINT_TRIG */ ++ ++ 0x01d0, /* IO_ACX_ENABLE */ ++ ++ 0x0338, /* IO_ACX_EEPROM_CTL */ ++ 0x033c, /* IO_ACX_EEPROM_ADDR */ ++ 0x0340, /* IO_ACX_EEPROM_DATA */ ++ 0x0344, /* IO_ACX_EEPROM_CFG */ ++ ++ 0x0350, /* IO_ACX_PHY_ADDR */ ++ 0x0354, /* IO_ACX_PHY_DATA */ ++ 0x0358, /* IO_ACX_PHY_CTL */ ++ ++ 0x0374, /* IO_ACX_GPIO_OE */ ++ ++ 0x037c, /* IO_ACX_GPIO_OUT */ ++ ++ 0x0388, /* IO_ACX_CMD_MAILBOX_OFFS */ ++ 0x038c, /* IO_ACX_INFO_MAILBOX_OFFS */ ++ 0x0390, /* IO_ACX_EEPROM_INFORMATION */ ++ ++ 0x0100, /* IO_ACX_EE_START */ ++ 0x0104, /* IO_ACX_SOR_CFG */ ++ 0x0108, /* IO_ACX_ECPU_CTRL */ ++}; ++ ++static void ++dummy_netdev_init(struct net_device *ndev) {} ++ ++/* ++ * Most of the acx specific pieces of hardware reset. ++ */ ++static int ++acxmem_complete_hw_reset (acx_device_t *adev) ++{ ++ acx111_ie_configoption_t co; ++ ++ /* NB: read_reg() reads may return bogus data before reset_dev(), ++ * since the firmware which directly controls large parts of the I/O ++ * registers isn't initialized yet. ++ * acx100 seems to be more affected than acx111 */ ++ if (OK != acxmem_s_reset_dev (adev)) ++ return -1; ++ ++ if (IS_ACX100(adev)) { ++ /* ACX100: configopt struct in cmd mailbox - directly after reset */ ++ copy_from_slavemem (adev, (u8*) &co, (u32) adev->cmd_area, sizeof (co)); ++ } ++ ++ if (OK != acx_s_init_mac(adev)) ++ return -3; ++ ++ if (IS_ACX111(adev)) { ++ /* ACX111: configopt struct needs to be queried after full init */ ++ acx_s_interrogate(adev, &co, ACX111_IE_CONFIG_OPTIONS); ++ } ++ ++ /* ++ * Set up transmit buffer administration ++ */ ++ init_acx_txbuf (adev); ++ ++ /* ++ * Windows driver writes 0x01000000 to register 0x288, RADIO_CTL, if the form factor ++ * is 3. It also write protects the EEPROM by writing 1<<9 to GPIO_OUT ++ */ ++ if (adev->form_factor == 3) { ++ set_regbits (adev, 0x288, 0x01000000); ++ set_regbits (adev, 0x298, 1<<9); ++ } ++ ++/* TODO: merge them into one function, they are called just once and are the same for pci & usb */ ++ if (OK != acxmem_read_eeprom_byte(adev, 0x05, &adev->eeprom_version)) ++ return -2; ++ ++ acx_s_parse_configoption(adev, &co); ++ acx_s_get_firmware_version(adev); /* needs to be after acx_s_init_mac() */ ++ acx_display_hardware_details(adev); ++ ++ return 0; ++} ++ ++static int __devinit ++acxmem_e_probe(struct platform_device *pdev) ++{ ++ struct acx_hardware_data *hwdata = pdev->dev.platform_data; ++ acx_device_t *adev = NULL; ++ struct net_device *ndev = NULL; ++ const char *chip_name; ++ int result = -EIO; ++ int err; ++ int i; ++ unsigned long addr_size=0; ++ u8 chip_type; ++ ++ FN_ENTER; ++ (void) hwdata->start_hw(); ++ ++ /* FIXME: prism54 calls pci_set_mwi() here, ++ * should we do/support the same? */ ++ ++ /* chiptype is u8 but id->driver_data is ulong ++ ** Works for now (possible values are 1 and 2) */ ++ chip_type = CHIPTYPE_ACX100; ++ /* acx100 and acx111 have different PCI memory regions */ ++ if (chip_type == CHIPTYPE_ACX100) { ++ chip_name = "ACX100"; ++ } else if (chip_type == CHIPTYPE_ACX111) { ++ chip_name = "ACX111"; ++ } else { ++ printk("acx: unknown chip type 0x%04X\n", chip_type); ++ goto fail_unknown_chiptype; ++ } ++ ++ printk("acx: found %s-based wireless network card\n", chip_name); ++ log(L_ANY, "initial debug setting is 0x%04X\n", acx_debug); ++ ++ ndev = alloc_netdev(sizeof(*adev), "wlan%d", dummy_netdev_init); ++ /* (NB: memsets to 0 entire area) */ ++ if (!ndev) { ++ printk("acx: no memory for netdevice struct\n"); ++ goto fail_alloc_netdev; ++ } ++ ++ platform_set_drvdata (pdev, ndev); ++ ++ ether_setup(ndev); ++ ++ /* ++ * use platform_data resources that were provided ++ */ ++ ndev->irq = 0; ++ for (i=0; i<pdev->num_resources; i++) { ++ if (pdev->resource[i].flags == IORESOURCE_IRQ) { ++ ndev->irq = pdev->resource[i].start; ++ } ++ else if (pdev->resource[i].flags == IORESOURCE_MEM) { ++ ndev->base_addr = pdev->resource[i].start; ++ addr_size = pdev->resource[i].end - pdev->resource[i].start; ++ } ++ } ++ if (addr_size == 0 || ndev->irq == 0) ++ goto fail_hw_params; ++ ndev->open = &acxmem_e_open; ++ ndev->stop = &acxmem_e_close; ++ pdev->dev.release = &acxmem_e_release; ++ ndev->hard_start_xmit = &acx_i_start_xmit; ++ ndev->get_stats = &acx_e_get_stats; ++#if IW_HANDLER_VERSION <= 5 ++ ndev->get_wireless_stats = &acx_e_get_wireless_stats; ++#endif ++ ndev->wireless_handlers = (struct iw_handler_def *)&acx_ioctl_handler_def; ++ ndev->set_multicast_list = &acxmem_i_set_multicast_list; ++ ndev->tx_timeout = &acxmem_i_tx_timeout; ++ ndev->change_mtu = &acx_e_change_mtu; ++ ndev->watchdog_timeo = 4 * HZ; ++ ++ adev = ndev2adev(ndev); ++ spin_lock_init(&adev->lock); /* initial state: unlocked */ ++ spin_lock_init(&adev->txbuf_lock); ++ /* We do not start with downed sem: we want PARANOID_LOCKING to work */ ++ sema_init(&adev->sem, 1); /* initial state: 1 (upped) */ ++ /* since nobody can see new netdev yet, we can as well ++ ** just _presume_ that we're under sem (instead of actually taking it): */ ++ /* acx_sem_lock(adev); */ ++ adev->dev = &pdev->dev; ++ adev->ndev = ndev; ++ adev->dev_type = DEVTYPE_MEM; ++ adev->chip_type = chip_type; ++ adev->chip_name = chip_name; ++ adev->io = (CHIPTYPE_ACX100 == chip_type) ? IO_ACX100 : IO_ACX111; ++ adev->membase = (volatile u32 *) ndev->base_addr; ++ adev->iobase = (volatile u32 *) ioremap_nocache (ndev->base_addr, addr_size); ++ /* to find crashes due to weird driver access ++ * to unconfigured interface (ifup) */ ++ adev->mgmt_timer.function = (void (*)(unsigned long))0x0000dead; ++ ++#if defined(NONESSENTIAL_FEATURES) ++ acx_show_card_eeprom_id(adev); ++#endif /* NONESSENTIAL_FEATURES */ ++ ++#ifdef SET_MODULE_OWNER ++ SET_MODULE_OWNER(ndev); ++#endif ++ SET_NETDEV_DEV(ndev, &pdev->dev); ++ ++ log(L_IRQ|L_INIT, "using IRQ %d\n", ndev->irq); ++ ++ /* ok, pci setup is finished, now start initializing the card */ ++ ++ if (OK != acxmem_complete_hw_reset (adev)) ++ goto fail_reset; ++ ++ /* ++ * Set up default things for most of the card settings. ++ */ ++ acx_s_set_defaults(adev); ++ ++ /* Register the card, AFTER everything else has been set up, ++ * since otherwise an ioctl could step on our feet due to ++ * firmware operations happening in parallel or uninitialized data */ ++ err = register_netdev(ndev); ++ if (OK != err) { ++ printk("acx: register_netdev() FAILED: %d\n", err); ++ goto fail_register_netdev; ++ } ++ ++ acx_proc_register_entries(ndev); ++ ++ /* Now we have our device, so make sure the kernel doesn't try ++ * to send packets even though we're not associated to a network yet */ ++ acx_stop_queue(ndev, "on probe"); ++ acx_carrier_off(ndev, "on probe"); ++ ++ /* ++ * Set up a default monitor type so that poor combinations of initialization ++ * sequences in monitor mode don't end up destroying the hardware type. ++ */ ++ adev->monitor_type = ARPHRD_ETHER; ++ ++ /* ++ * Register to receive inetaddr notifier changes. This will allow us to ++ * catch if the user changes the MAC address of the interface. ++ */ ++ register_netdevice_notifier(&acx_netdev_notifier); ++ ++ /* after register_netdev() userspace may start working with dev ++ * (in particular, on other CPUs), we only need to up the sem */ ++ /* acx_sem_unlock(adev); */ ++ ++ printk("acx "ACX_RELEASE": net device %s, driver compiled " ++ "against wireless extensions %d and Linux %s\n", ++ ndev->name, WIRELESS_EXT, UTS_RELEASE); ++ ++#if CMD_DISCOVERY ++ great_inquisitor(adev); ++#endif ++ ++ result = OK; ++ goto done; ++ ++ /* error paths: undo everything in reverse order... */ ++ ++fail_register_netdev: ++ ++ acxmem_s_delete_dma_regions(adev); ++ ++fail_reset: ++fail_hw_params: ++ free_netdev(ndev); ++fail_alloc_netdev: ++fail_unknown_chiptype: ++ ++ ++done: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxmem_e_remove ++** ++** Shut device down (if not hot unplugged) ++** and deallocate PCI resources for the acx chip. ++** ++** pdev - ptr to PCI device structure containing info about pci configuration ++*/ ++static int __devexit ++acxmem_e_remove(struct platform_device *pdev) ++{ ++ struct acx_hardware_data *hwdata = pdev->dev.platform_data; ++ struct net_device *ndev; ++ acx_device_t *adev; ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ ndev = (struct net_device*) platform_get_drvdata(pdev); ++ if (!ndev) { ++ log(L_DEBUG, "%s: card is unused. Skipping any release code\n", ++ __func__); ++ goto end; ++ } ++ ++ adev = ndev2adev(ndev); ++ ++ /* If device wasn't hot unplugged... */ ++ if (adev_present(adev)) { ++ ++ acx_sem_lock(adev); ++ ++ /* disable both Tx and Rx to shut radio down properly */ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_DISABLE_TX, NULL, 0); ++ acx_s_issue_cmd(adev, ACX1xx_CMD_DISABLE_RX, NULL, 0); ++ ++#ifdef REDUNDANT ++ /* put the eCPU to sleep to save power ++ * Halting is not possible currently, ++ * since not supported by all firmware versions */ ++ acx_s_issue_cmd(adev, ACX100_CMD_SLEEP, NULL, 0); ++#endif ++ acx_lock(adev, flags); ++ ++ /* disable power LED to save power :-) */ ++ log(L_INIT, "switching off power LED to save power\n"); ++ acxmem_l_power_led(adev, 0); ++ ++ /* stop our eCPU */ ++ if (IS_ACX111(adev)) { ++ /* FIXME: does this actually keep halting the eCPU? ++ * I don't think so... ++ */ ++ acxmem_l_reset_mac(adev); ++ } else { ++ u16 temp; ++ ++ /* halt eCPU */ ++ temp = read_reg16(adev, IO_ACX_ECPU_CTRL) | 0x1; ++ write_reg16(adev, IO_ACX_ECPU_CTRL, temp); ++ write_flush(adev); ++ } ++ ++ acx_unlock(adev, flags); ++ ++ acx_sem_unlock(adev); ++ } ++ ++ ++ /* ++ * Unregister the notifier chain ++ */ ++ unregister_netdevice_notifier(&acx_netdev_notifier); ++ ++ /* unregister the device to not let the kernel ++ * (e.g. ioctls) access a half-deconfigured device ++ * NB: this will cause acxmem_e_close() to be called, ++ * thus we shouldn't call it under sem! */ ++ log(L_INIT, "removing device %s\n", ndev->name); ++ unregister_netdev(ndev); ++ ++ /* unregister_netdev ensures that no references to us left. ++ * For paranoid reasons we continue to follow the rules */ ++ acx_sem_lock(adev); ++ ++ if (adev->dev_state_mask & ACX_STATE_IFACE_UP) { ++ acxmem_s_down(ndev); ++ CLEAR_BIT(adev->dev_state_mask, ACX_STATE_IFACE_UP); ++ } ++ ++ acx_proc_unregister_entries(ndev); ++ ++ acxmem_s_delete_dma_regions(adev); ++ ++ /* finally, clean up PCI bus state */ ++ if (adev->iobase) iounmap((void *)adev->iobase); ++ ++ acx_sem_unlock(adev); ++ ++ /* Free netdev (quite late, ++ * since otherwise we might get caught off-guard ++ * by a netdev timeout handler execution ++ * expecting to see a working dev...) */ ++ free_netdev(ndev); ++ ++ (void) hwdata->stop_hw(); ++ ++ printk ("e_remove done\n"); ++end: ++ FN_EXIT0; ++ ++ return 0; ++} ++ ++ ++/*********************************************************************** ++** TODO: PM code needs to be fixed / debugged / tested. ++*/ ++#ifdef CONFIG_PM ++static int ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11) ++acxmem_e_suspend(struct platform_device *pdev, pm_message_t state) ++#else ++acxmem_e_suspend(struct device *pdev, u32 state) ++#endif ++{ ++ struct net_device *ndev = platform_get_drvdata(pdev); ++ acx_device_t *adev; ++ struct acx_hardware_data *hwdata; ++ ++ FN_ENTER; ++ printk("acx: suspend handler is experimental!\n"); ++ printk("sus: dev %p\n", ndev); ++ ++ if (!netif_running(ndev)) ++ goto end; ++ ++ adev = ndev2adev(ndev); ++ printk("sus: adev %p\n", adev); ++ ++ hwdata = adev->dev->platform_data; ++ ++ acx_sem_lock(adev); ++ ++ netif_device_detach(ndev); /* this one cannot sleep */ ++ acxmem_s_down(ndev); ++ /* down() does not set it to 0xffff, but here we really want that */ ++ write_reg16(adev, IO_ACX_IRQ_MASK, 0xffff); ++ write_reg16(adev, IO_ACX_FEMR, 0x0); ++ acxmem_s_delete_dma_regions(adev); ++ ++ /* ++ * Turn the ACX chip off. ++ */ ++ hwdata->stop_hw(); ++ ++ acx_sem_unlock(adev); ++end: ++ FN_EXIT0; ++ return OK; ++} ++ ++ ++ ++static void ++fw_resumer(struct work_struct *notused) ++{ ++ struct platform_device *pdev = resume_pdev; ++ struct net_device *ndev = platform_get_drvdata(pdev); ++ acx_device_t *adev; ++ struct acx_hardware_data *hwdata; ++ ++ printk("acx: resume handler is experimental!\n"); ++ printk("rsm: got dev %p\n", ndev); ++ ++ if (!netif_running(ndev)) ++ return; ++ ++ adev = ndev2adev(ndev); ++ printk("rsm: got adev %p\n", adev); ++ ++ acx_sem_lock(adev); ++ ++ hwdata = adev->dev->platform_data; ++ ++ /* ++ * Turn on the ACX. ++ */ ++ hwdata->start_hw(); ++ ++ acxmem_complete_hw_reset (adev); ++ ++ /* ++ * done by acx_s_set_defaults for initial startup ++ */ ++ acxmem_set_interrupt_mask(adev); ++ ++ printk ("rsm: bringing up interface\n"); ++ SET_BIT (adev->set_mask, GETSET_ALL); ++ acxmem_s_up(ndev); ++ printk("rsm: acx up done\n"); ++ ++ /* now even reload all card parameters as they were before suspend, ++ * and possibly be back in the network again already :-) ++ */ ++ /* - most settings updated in acxmem_s_up() ++ if (ACX_STATE_IFACE_UP & adev->dev_state_mask) { ++ adev->set_mask = GETSET_ALL; ++ acx_s_update_card_settings(adev); ++ printk("rsm: settings updated\n"); ++ } ++ */ ++ netif_device_attach(ndev); ++ printk("rsm: device attached\n"); ++ ++ acx_sem_unlock(adev); ++} ++ ++DECLARE_WORK( fw_resume_work, fw_resumer ); ++ ++static int ++acxmem_e_resume(struct platform_device *pdev) ++{ ++ FN_ENTER; ++ ++ resume_pdev = pdev; ++ schedule_work( &fw_resume_work ); ++ ++ FN_EXIT0; ++ return OK; ++} ++#endif /* CONFIG_PM */ ++ ++ ++/*********************************************************************** ++** acxmem_s_up ++** ++** This function is called by acxmem_e_open (when ifconfig sets the device as up) ++** ++** Side effects: ++** - Enables on-card interrupt requests ++** - calls acx_s_start ++*/ ++ ++static void ++enable_acx_irq(acx_device_t *adev) ++{ ++ FN_ENTER; ++ write_reg16(adev, IO_ACX_IRQ_MASK, adev->irq_mask); ++ write_reg16(adev, IO_ACX_FEMR, 0x8000); ++ adev->irqs_active = 1; ++ FN_EXIT0; ++} ++ ++static void ++acxmem_s_up(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ acx_lock(adev, flags); ++ enable_acx_irq(adev); ++ acx_unlock(adev, flags); ++ ++ /* acx fw < 1.9.3.e has a hardware timer, and older drivers ++ ** used to use it. But we don't do that anymore, our OS ++ ** has reliable software timers */ ++ init_timer(&adev->mgmt_timer); ++ adev->mgmt_timer.function = acx_i_timer; ++ adev->mgmt_timer.data = (unsigned long)adev; ++ ++ /* Need to set ACX_STATE_IFACE_UP first, or else ++ ** timer won't be started by acx_set_status() */ ++ SET_BIT(adev->dev_state_mask, ACX_STATE_IFACE_UP); ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_2_STA: ++ /* actual scan cmd will happen in start() */ ++ acx_set_status(adev, ACX_STATUS_1_SCANNING); break; ++ case ACX_MODE_3_AP: ++ case ACX_MODE_MONITOR: ++ acx_set_status(adev, ACX_STATUS_4_ASSOCIATED); break; ++ } ++ ++ acx_s_start(adev); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_down ++** ++** This disables the netdevice ++** ++** Side effects: ++** - disables on-card interrupt request ++*/ ++ ++static void ++disable_acx_irq(acx_device_t *adev) ++{ ++ FN_ENTER; ++ ++ /* I guess mask is not 0xffff because acx100 won't signal ++ ** cmd completion then (needed for ifup). ++ ** Someone with acx100 please confirm */ ++ write_reg16(adev, IO_ACX_IRQ_MASK, adev->irq_mask_off); ++ write_reg16(adev, IO_ACX_FEMR, 0x0); ++ adev->irqs_active = 0; ++ FN_EXIT0; ++} ++ ++static void ++acxmem_s_down(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ /* Disable IRQs first, so that IRQs cannot race with us */ ++ /* then wait until interrupts have finished executing on other CPUs */ ++ acx_lock(adev, flags); ++ disable_acx_irq(adev); ++ synchronize_irq(adev->pdev->irq); ++ acx_unlock(adev, flags); ++ ++ /* we really don't want to have an asynchronous tasklet disturb us ++ ** after something vital for its job has been shut down, so ++ ** end all remaining work now. ++ ** ++ ** NB: carrier_off (done by set_status below) would lead to ++ ** not yet fully understood deadlock in FLUSH_SCHEDULED_WORK(). ++ ** That's why we do FLUSH first. ++ ** ++ ** NB2: we have a bad locking bug here: FLUSH_SCHEDULED_WORK() ++ ** waits for acx_e_after_interrupt_task to complete if it is running ++ ** on another CPU, but acx_e_after_interrupt_task ++ ** will sleep on sem forever, because it is taken by us! ++ ** Work around that by temporary sem unlock. ++ ** This will fail miserably if we'll be hit by concurrent ++ ** iwconfig or something in between. TODO! */ ++ acx_sem_unlock(adev); ++ FLUSH_SCHEDULED_WORK(); ++ acx_sem_lock(adev); ++ ++ /* This is possible: ++ ** FLUSH_SCHEDULED_WORK -> acx_e_after_interrupt_task -> ++ ** -> set_status(ASSOCIATED) -> wake_queue() ++ ** That's why we stop queue _after_ FLUSH_SCHEDULED_WORK ++ ** lock/unlock is just paranoia, maybe not needed */ ++ acx_lock(adev, flags); ++ acx_stop_queue(ndev, "on ifdown"); ++ acx_set_status(adev, ACX_STATUS_0_STOPPED); ++ acx_unlock(adev, flags); ++ ++ /* kernel/timer.c says it's illegal to del_timer_sync() ++ ** a timer which restarts itself. We guarantee this cannot ++ ** ever happen because acx_i_timer() never does this if ++ ** status is ACX_STATUS_0_STOPPED */ ++ del_timer_sync(&adev->mgmt_timer); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_e_open ++** ++** Called as a result of SIOCSIFFLAGS ioctl changing the flags bit IFF_UP ++** from clear to set. In other words: ifconfig up. ++** ++** Returns: ++** 0 success ++** >0 f/w reported error ++** <0 driver reported error ++*/ ++static int ++acxmem_e_open(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result = OK; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ acx_init_task_scheduler(adev); ++ ++/* TODO: pci_set_power_state(pdev, PCI_D0); ? */ ++ ++ /* request shared IRQ handler */ ++ if (request_irq(ndev->irq, acxmem_i_interrupt, SA_INTERRUPT, ndev->name, ndev)) { ++ printk("%s: request_irq FAILED\n", ndev->name); ++ result = -EAGAIN; ++ goto done; ++ } ++ set_irq_type (ndev->irq, IRQT_FALLING); ++ log(L_DEBUG|L_IRQ, "request_irq %d successful\n", ndev->irq); ++ ++ /* ifup device */ ++ acxmem_s_up(ndev); ++ ++ /* We don't currently have to do anything else. ++ * The setup of the MAC should be subsequently completed via ++ * the mlme commands. ++ * Higher layers know we're ready from dev->start==1 and ++ * dev->tbusy==0. Our rx path knows to pass up received/ ++ * frames because of dev->flags&IFF_UP is true. ++ */ ++done: ++ acx_sem_unlock(adev); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxmem_e_close ++** ++** Called as a result of SIOCSIIFFLAGS ioctl changing the flags bit IFF_UP ++** from set to clear. I.e. called by "ifconfig DEV down" ++** ++** Returns: ++** 0 success ++** >0 f/w reported error ++** <0 driver reported error ++*/ ++static int ++acxmem_e_close(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ /* ifdown device */ ++ CLEAR_BIT(adev->dev_state_mask, ACX_STATE_IFACE_UP); ++ if (netif_device_present(ndev)) { ++ acxmem_s_down(ndev); ++ } ++ ++ /* disable all IRQs, release shared IRQ handler */ ++ write_reg16(adev, IO_ACX_IRQ_MASK, 0xffff); ++ write_reg16(adev, IO_ACX_FEMR, 0x0); ++ free_irq(ndev->irq, ndev); ++ ++/* TODO: pci_set_power_state(pdev, PCI_D3hot); ? */ ++ ++ /* We currently don't have to do anything else. ++ * Higher layers know we're not ready from dev->start==0 and ++ * dev->tbusy==1. Our rx path knows to not pass up received ++ * frames because of dev->flags&IFF_UP is false. ++ */ ++ acx_sem_unlock(adev); ++ ++ log(L_INIT, "closed device\n"); ++ FN_EXIT0; ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acxmem_i_tx_timeout ++** ++** Called from network core. Must not sleep! ++*/ ++static void ++acxmem_i_tx_timeout(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ unsigned int tx_num_cleaned; ++ ++ FN_ENTER; ++ ++ acx_lock(adev, flags); ++ ++ /* clean processed tx descs, they may have been completely full */ ++ tx_num_cleaned = acxmem_l_clean_txdesc(adev); ++ ++ /* nothing cleaned, yet (almost) no free buffers available? ++ * --> clean all tx descs, no matter which status!! ++ * Note that I strongly suspect that doing emergency cleaning ++ * may confuse the firmware. This is a last ditch effort to get ++ * ANYTHING to work again... ++ * ++ * TODO: it's best to simply reset & reinit hw from scratch... ++ */ ++ if ((adev->tx_free <= TX_EMERG_CLEAN) && (tx_num_cleaned == 0)) { ++ printk("%s: FAILED to free any of the many full tx buffers. " ++ "Switching to emergency freeing. " ++ "Please report!\n", ndev->name); ++ acxmem_l_clean_txdesc_emergency(adev); ++ } ++ ++ if (acx_queue_stopped(ndev) && (ACX_STATUS_4_ASSOCIATED == adev->status)) ++ acx_wake_queue(ndev, "after tx timeout"); ++ ++ /* stall may have happened due to radio drift, so recalib radio */ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_CMD_RADIO_RECALIB); ++ ++ /* do unimportant work last */ ++ printk("%s: tx timeout!\n", ndev->name); ++ adev->stats.tx_errors++; ++ ++ acx_unlock(adev, flags); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_i_set_multicast_list ++** FIXME: most likely needs refinement ++*/ ++static void ++acxmem_i_set_multicast_list(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ acx_lock(adev, flags); ++ ++ /* firmwares don't have allmulti capability, ++ * so just use promiscuous mode instead in this case. */ ++ if (ndev->flags & (IFF_PROMISC|IFF_ALLMULTI)) { ++ SET_BIT(adev->rx_config_1, RX_CFG1_RCV_PROMISCUOUS); ++ CLEAR_BIT(adev->rx_config_1, RX_CFG1_FILTER_ALL_MULTI); ++ SET_BIT(adev->set_mask, SET_RXCONFIG); ++ /* let kernel know in case *we* needed to set promiscuous */ ++ ndev->flags |= (IFF_PROMISC|IFF_ALLMULTI); ++ } else { ++ CLEAR_BIT(adev->rx_config_1, RX_CFG1_RCV_PROMISCUOUS); ++ SET_BIT(adev->rx_config_1, RX_CFG1_FILTER_ALL_MULTI); ++ SET_BIT(adev->set_mask, SET_RXCONFIG); ++ ndev->flags &= ~(IFF_PROMISC|IFF_ALLMULTI); ++ } ++ ++ /* cannot update card settings directly here, atomic context */ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_UPDATE_CARD_CFG); ++ ++ acx_unlock(adev, flags); ++ ++ FN_EXIT0; ++} ++ ++ ++/*************************************************************** ++** acxmem_l_process_rxdesc ++** ++** Called directly and only from the IRQ handler ++*/ ++ ++#if !ACX_DEBUG ++static inline void log_rxbuffer(const acx_device_t *adev) {} ++#else ++static void ++log_rxbuffer(const acx_device_t *adev) ++{ ++ register const struct rxhostdesc *rxhostdesc; ++ int i; ++ /* no FN_ENTER here, we don't want that */ ++ ++ rxhostdesc = adev->rxhostdesc_start; ++ if (unlikely(!rxhostdesc)) return; ++ for (i = 0; i < RX_CNT; i++) { ++ if ((rxhostdesc->Ctl_16 & cpu_to_le16(DESC_CTL_HOSTOWN)) ++ && (rxhostdesc->Status & cpu_to_le32(DESC_STATUS_FULL))) ++ printk("rx: buf %d full\n", i); ++ rxhostdesc++; ++ } ++} ++#endif ++ ++static void ++acxmem_l_process_rxdesc(acx_device_t *adev) ++{ ++ register rxhostdesc_t *hostdesc; ++ register rxdesc_t *rxdesc; ++ unsigned count, tail; ++ u32 addr; ++ u8 Ctl_8; ++ ++ FN_ENTER; ++ ++ if (unlikely(acx_debug & L_BUFR)) ++ log_rxbuffer(adev); ++ ++ /* First, have a loop to determine the first descriptor that's ++ * full, just in case there's a mismatch between our current ++ * rx_tail and the full descriptor we're supposed to handle. */ ++ tail = adev->rx_tail; ++ count = RX_CNT; ++ while (1) { ++ hostdesc = &adev->rxhostdesc_start[tail]; ++ rxdesc = &adev->rxdesc_start[tail]; ++ /* advance tail regardless of outcome of the below test */ ++ tail = (tail + 1) % RX_CNT; ++ ++ /* ++ * Unlike the PCI interface, where the ACX can write directly to ++ * the host descriptors, on the slave memory interface we have to ++ * pull these. All we really need to do is check the Ctl_8 field ++ * in the rx descriptor on the ACX, which should be 0x11000000 if ++ * we should process it. ++ */ ++ Ctl_8 = hostdesc->Ctl_16 = read_slavemem8 (adev, (u32) &(rxdesc->Ctl_8)); ++ if ((Ctl_8 & DESC_CTL_HOSTOWN) && ++ (Ctl_8 & DESC_CTL_ACXDONE)) ++ break; /* found it! */ ++ ++ if (unlikely(!--count)) /* hmm, no luck: all descs empty, bail out */ ++ goto end; ++ } ++ ++ /* now process descriptors, starting with the first we figured out */ ++ while (1) { ++ log(L_BUFR, "rx: tail=%u Ctl_8=%02X\n", tail, Ctl_8); ++ /* ++ * If the ACX has CTL_RECLAIM set on this descriptor there ++ * is no buffer associated; it just wants us to tell it to ++ * reclaim the memory. ++ */ ++ if (!(Ctl_8 & DESC_CTL_RECLAIM)) { ++ ++ /* ++ * slave interface - pull data now ++ */ ++ hostdesc->length = read_slavemem16 (adev, (u32) &(rxdesc->total_length)); ++ ++ /* ++ * hostdesc->data is an rxbuffer_t, which includes header information, ++ * but the length in the data packet doesn't. The header information ++ * takes up an additional 12 bytes, so add that to the length we copy. ++ */ ++ addr = read_slavemem32 (adev, (u32) &(rxdesc->ACXMemPtr)); ++ if (addr) { ++ /* ++ * How can &(rxdesc->ACXMemPtr) above ever be zero? Looks like we ++ * get that now and then - try to trap it for debug. ++ */ ++ if (addr & 0xffff0000) { ++ printk("rxdesc 0x%08x\n", (u32) rxdesc); ++ dump_acxmem (adev, 0, 0x10000); ++ panic ("Bad access!"); ++ } ++ chaincopy_from_slavemem (adev, (u8 *) hostdesc->data, addr, ++ hostdesc->length + ++ (u32) &((rxbuffer_t *)0)->hdr_a3); ++ acx_l_process_rxbuf(adev, hostdesc->data); ++ } ++ } ++ else { ++ printk ("rx reclaim only!\n"); ++ } ++ ++ hostdesc->Status = 0; ++ ++ /* ++ * Let the ACX know we're done. ++ */ ++ CLEAR_BIT (Ctl_8, DESC_CTL_HOSTOWN); ++ SET_BIT (Ctl_8, DESC_CTL_HOSTDONE); ++ SET_BIT (Ctl_8, DESC_CTL_RECLAIM); ++ write_slavemem8 (adev, (u32) &rxdesc->Ctl_8, Ctl_8); ++ ++ /* ++ * Now tell the ACX we've finished with the receive buffer so ++ * it can finish the reclaim. ++ */ ++ write_reg16 (adev, IO_ACX_INT_TRIG, INT_TRIG_RXPRC); ++ ++ /* ok, descriptor is handled, now check the next descriptor */ ++ hostdesc = &adev->rxhostdesc_start[tail]; ++ rxdesc = &adev->rxdesc_start[tail]; ++ ++ Ctl_8 = hostdesc->Ctl_16 = read_slavemem8 (adev, (u32) &(rxdesc->Ctl_8)); ++ ++ /* if next descriptor is empty, then bail out */ ++ if (!(Ctl_8 & DESC_CTL_HOSTOWN) || !(Ctl_8 & DESC_CTL_ACXDONE)) ++ break; ++ ++ tail = (tail + 1) % RX_CNT; ++ } ++end: ++ adev->rx_tail = tail; ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_i_interrupt ++** ++** IRQ handler (atomic context, must not sleep, blah, blah) ++*/ ++ ++/* scan is complete. all frames now on the receive queue are valid */ ++#define INFO_SCAN_COMPLETE 0x0001 ++#define INFO_WEP_KEY_NOT_FOUND 0x0002 ++/* hw has been reset as the result of a watchdog timer timeout */ ++#define INFO_WATCH_DOG_RESET 0x0003 ++/* failed to send out NULL frame from PS mode notification to AP */ ++/* recommended action: try entering 802.11 PS mode again */ ++#define INFO_PS_FAIL 0x0004 ++/* encryption/decryption process on a packet failed */ ++#define INFO_IV_ICV_FAILURE 0x0005 ++ ++/* Info mailbox format: ++2 bytes: type ++2 bytes: status ++more bytes may follow ++ rumors say about status: ++ 0x0000 info available (set by hw) ++ 0x0001 information received (must be set by host) ++ 0x1000 info available, mailbox overflowed (messages lost) (set by hw) ++ but in practice we've seen: ++ 0x9000 when we did not set status to 0x0001 on prev message ++ 0x1001 when we did set it ++ 0x0000 was never seen ++ conclusion: this is really a bitfield: ++ 0x1000 is 'info available' bit ++ 'mailbox overflowed' bit is 0x8000, not 0x1000 ++ value of 0x0000 probably means that there are no messages at all ++ P.S. I dunno how in hell hw is supposed to notice that messages are lost - ++ it does NOT clear bit 0x0001, and this bit will probably stay forever set ++ after we set it once. Let's hope this will be fixed in firmware someday ++*/ ++ ++static void ++handle_info_irq(acx_device_t *adev) ++{ ++#if ACX_DEBUG ++ static const char * const info_type_msg[] = { ++ "(unknown)", ++ "scan complete", ++ "WEP key not found", ++ "internal watchdog reset was done", ++ "failed to send powersave (NULL frame) notification to AP", ++ "encrypt/decrypt on a packet has failed", ++ "TKIP tx keys disabled", ++ "TKIP rx keys disabled", ++ "TKIP rx: key ID not found", ++ "???", ++ "???", ++ "???", ++ "???", ++ "???", ++ "???", ++ "???", ++ "TKIP IV value exceeds thresh" ++ }; ++#endif ++ u32 info_type, info_status; ++ ++ info_type = read_slavemem32 (adev, (u32) adev->info_area); ++ ++ info_status = (info_type >> 16); ++ info_type = (u16)info_type; ++ ++ /* inform fw that we have read this info message */ ++ write_slavemem32(adev, (u32) adev->info_area, info_type | 0x00010000); ++ write_reg16(adev, IO_ACX_INT_TRIG, INT_TRIG_INFOACK); ++ write_flush(adev); ++ ++ log(L_CTL, "info_type:%04X info_status:%04X\n", ++ info_type, info_status); ++ ++ log(L_IRQ, "got Info IRQ: status %04X type %04X: %s\n", ++ info_status, info_type, ++ info_type_msg[(info_type >= VEC_SIZE(info_type_msg)) ? ++ 0 : info_type] ++ ); ++} ++ ++ ++static void ++log_unusual_irq(u16 irqtype) { ++ /* ++ if (!printk_ratelimit()) ++ return; ++ */ ++ ++ printk("acx: got"); ++ if (irqtype & HOST_INT_TX_XFER) { ++ printk(" Tx_Xfer"); ++ } ++ if (irqtype & HOST_INT_RX_COMPLETE) { ++ printk(" Rx_Complete"); ++ } ++ if (irqtype & HOST_INT_DTIM) { ++ printk(" DTIM"); ++ } ++ if (irqtype & HOST_INT_BEACON) { ++ printk(" Beacon"); ++ } ++ if (irqtype & HOST_INT_TIMER) { ++ log(L_IRQ, " Timer"); ++ } ++ if (irqtype & HOST_INT_KEY_NOT_FOUND) { ++ printk(" Key_Not_Found"); ++ } ++ if (irqtype & HOST_INT_IV_ICV_FAILURE) { ++ printk(" IV_ICV_Failure (crypto)"); ++ } ++ /* HOST_INT_CMD_COMPLETE */ ++ /* HOST_INT_INFO */ ++ if (irqtype & HOST_INT_OVERFLOW) { ++ printk(" Overflow"); ++ } ++ if (irqtype & HOST_INT_PROCESS_ERROR) { ++ printk(" Process_Error"); ++ } ++ /* HOST_INT_SCAN_COMPLETE */ ++ if (irqtype & HOST_INT_FCS_THRESHOLD) { ++ printk(" FCS_Threshold"); ++ } ++ if (irqtype & HOST_INT_UNKNOWN) { ++ printk(" Unknown"); ++ } ++ printk(" IRQ(s)\n"); ++} ++ ++ ++static void ++update_link_quality_led(acx_device_t *adev) ++{ ++ int qual; ++ ++ qual = acx_signal_determine_quality(adev->wstats.qual.level, adev->wstats.qual.noise); ++ if (qual > adev->brange_max_quality) ++ qual = adev->brange_max_quality; ++ ++ if (time_after(jiffies, adev->brange_time_last_state_change + ++ (HZ/2 - HZ/2 * (unsigned long)qual / adev->brange_max_quality ) )) { ++ acxmem_l_power_led(adev, (adev->brange_last_state == 0)); ++ adev->brange_last_state ^= 1; /* toggle */ ++ adev->brange_time_last_state_change = jiffies; ++ } ++} ++ ++ ++#define MAX_IRQLOOPS_PER_JIFFY (20000/HZ) /* a la orinoco.c */ ++ ++static irqreturn_t ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19) ++acxmem_i_interrupt(int irq, void *dev_id) ++#else ++acxmwm_i_interrupt(int irq, void *dev_id, struct pt_regs *regs) ++#endif ++{ ++ acx_device_t *adev; ++ unsigned long flags; ++ unsigned int irqcount = MAX_IRQLOOPS_PER_JIFFY; ++ register u16 irqtype; ++ u16 unmasked; ++ ++ adev = ndev2adev((struct net_device*)dev_id); ++ ++ /* LOCKING: can just spin_lock() since IRQs are disabled anyway. ++ * I am paranoid */ ++ acx_lock(adev, flags); ++ ++ unmasked = read_reg16(adev, IO_ACX_IRQ_STATUS_CLEAR); ++ if (unlikely(0xffff == unmasked)) { ++ /* 0xffff value hints at missing hardware, ++ * so don't do anything. ++ * Not very clean, but other drivers do the same... */ ++ log(L_IRQ, "IRQ type:FFFF - device removed? IRQ_NONE\n"); ++ goto none; ++ } ++ ++ /* We will check only "interesting" IRQ types */ ++ irqtype = unmasked & ~adev->irq_mask; ++ if (!irqtype) { ++ /* We are on a shared IRQ line and it wasn't our IRQ */ ++ log(L_IRQ, "IRQ type:%04X, mask:%04X - all are masked, IRQ_NONE\n", ++ unmasked, adev->irq_mask); ++ goto none; ++ } ++ ++ /* Done here because IRQ_NONEs taking three lines of log ++ ** drive me crazy */ ++ FN_ENTER; ++ ++#define IRQ_ITERATE 1 ++#if IRQ_ITERATE ++if (jiffies != adev->irq_last_jiffies) { ++ adev->irq_loops_this_jiffy = 0; ++ adev->irq_last_jiffies = jiffies; ++} ++ ++/* safety condition; we'll normally abort loop below ++ * in case no IRQ type occurred */ ++while (likely(--irqcount)) { ++#endif ++ /* ACK all IRQs ASAP */ ++ write_reg16(adev, IO_ACX_IRQ_ACK, 0xffff); ++ ++ log(L_IRQ, "IRQ type:%04X, mask:%04X, type & ~mask:%04X\n", ++ unmasked, adev->irq_mask, irqtype); ++ ++ /* Handle most important IRQ types first */ ++ if (irqtype & HOST_INT_RX_DATA) { ++ log(L_IRQ, "got Rx_Data IRQ\n"); ++ acxmem_l_process_rxdesc(adev); ++ } ++ if (irqtype & HOST_INT_TX_COMPLETE) { ++ log(L_IRQ, "got Tx_Complete IRQ\n"); ++ /* don't clean up on each Tx complete, wait a bit ++ * unless we're going towards full, in which case ++ * we do it immediately, too (otherwise we might lockup ++ * with a full Tx buffer if we go into ++ * acxmem_l_clean_txdesc() at a time when we won't wakeup ++ * the net queue in there for some reason...) */ ++ if (adev->tx_free <= TX_START_CLEAN) { ++#if TX_CLEANUP_IN_SOFTIRQ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_TX_CLEANUP); ++#else ++ acxmem_l_clean_txdesc(adev); ++#endif ++ } ++ } ++ ++ /* Less frequent ones */ ++ if (irqtype & (0 ++ | HOST_INT_CMD_COMPLETE ++ | HOST_INT_INFO ++ | HOST_INT_SCAN_COMPLETE ++ )) { ++ if (irqtype & HOST_INT_CMD_COMPLETE) { ++ log(L_IRQ, "got Command_Complete IRQ\n"); ++ /* save the state for the running issue_cmd() */ ++ SET_BIT(adev->irq_status, HOST_INT_CMD_COMPLETE); ++ } ++ if (irqtype & HOST_INT_INFO) { ++ handle_info_irq(adev); ++ } ++ if (irqtype & HOST_INT_SCAN_COMPLETE) { ++ log(L_IRQ, "got Scan_Complete IRQ\n"); ++ /* need to do that in process context */ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_COMPLETE_SCAN); ++ /* remember that fw is not scanning anymore */ ++ SET_BIT(adev->irq_status, HOST_INT_SCAN_COMPLETE); ++ } ++ } ++ ++ /* These we just log, but either they happen rarely ++ * or we keep them masked out */ ++ if (irqtype & (0 ++ /* | HOST_INT_RX_DATA */ ++ /* | HOST_INT_TX_COMPLETE */ ++ | HOST_INT_TX_XFER ++ | HOST_INT_RX_COMPLETE ++ | HOST_INT_DTIM ++ | HOST_INT_BEACON ++ | HOST_INT_TIMER ++ | HOST_INT_KEY_NOT_FOUND ++ | HOST_INT_IV_ICV_FAILURE ++ /* | HOST_INT_CMD_COMPLETE */ ++ /* | HOST_INT_INFO */ ++ | HOST_INT_OVERFLOW ++ | HOST_INT_PROCESS_ERROR ++ /* | HOST_INT_SCAN_COMPLETE */ ++ | HOST_INT_FCS_THRESHOLD ++ | HOST_INT_UNKNOWN ++ )) { ++ log_unusual_irq(irqtype); ++ } ++ ++#if IRQ_ITERATE ++ unmasked = read_reg16(adev, IO_ACX_IRQ_STATUS_CLEAR); ++ irqtype = unmasked & ~adev->irq_mask; ++ /* Bail out if no new IRQ bits or if all are masked out */ ++ if (!irqtype) ++ break; ++ ++ if (unlikely(++adev->irq_loops_this_jiffy > MAX_IRQLOOPS_PER_JIFFY)) { ++ printk(KERN_ERR "acx: too many interrupts per jiffy!\n"); ++ /* Looks like card floods us with IRQs! Try to stop that */ ++ write_reg16(adev, IO_ACX_IRQ_MASK, 0xffff); ++ /* This will short-circuit all future attempts to handle IRQ. ++ * We cant do much more... */ ++ adev->irq_mask = 0; ++ break; ++ } ++} ++#endif ++ /* Routine to perform blink with range */ ++ if (unlikely(adev->led_power == 2)) ++ update_link_quality_led(adev); ++ ++/* handled: */ ++ /* write_flush(adev); - not needed, last op was read anyway */ ++ acx_unlock(adev, flags); ++ FN_EXIT0; ++ return IRQ_HANDLED; ++ ++none: ++ acx_unlock(adev, flags); ++ return IRQ_NONE; ++} ++ ++ ++/*********************************************************************** ++** acxmem_l_power_led ++*/ ++void ++acxmem_l_power_led(acx_device_t *adev, int enable) ++{ ++ u16 gpio_pled = IS_ACX111(adev) ? 0x0040 : 0x0800; ++ ++ /* A hack. Not moving message rate limiting to adev->xxx ++ * (it's only a debug message after all) */ ++ static int rate_limit = 0; ++ ++ if (rate_limit++ < 3) ++ log(L_IOCTL, "Please report in case toggling the power " ++ "LED doesn't work for your card!\n"); ++ if (enable) ++ write_reg16(adev, IO_ACX_GPIO_OUT, ++ read_reg16(adev, IO_ACX_GPIO_OUT) & ~gpio_pled); ++ else ++ write_reg16(adev, IO_ACX_GPIO_OUT, ++ read_reg16(adev, IO_ACX_GPIO_OUT) | gpio_pled); ++} ++ ++ ++/*********************************************************************** ++** Ioctls ++*/ ++ ++/*********************************************************************** ++*/ ++int ++acx111pci_ioctl_info( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ struct iw_param *vwrq, ++ char *extra) ++{ ++#if ACX_DEBUG > 1 ++ acx_device_t *adev = ndev2adev(ndev); ++ rxdesc_t *rxdesc; ++ txdesc_t *txdesc; ++ rxhostdesc_t *rxhostdesc; ++ txhostdesc_t *txhostdesc; ++ struct acx111_ie_memoryconfig memconf; ++ struct acx111_ie_queueconfig queueconf; ++ unsigned long flags; ++ int i; ++ char memmap[0x34]; ++ char rxconfig[0x8]; ++ char fcserror[0x8]; ++ char ratefallback[0x5]; ++ ++ if ( !(acx_debug & (L_IOCTL|L_DEBUG)) ) ++ return OK; ++ /* using printk() since we checked debug flag already */ ++ ++ acx_sem_lock(adev); ++ ++ if (!IS_ACX111(adev)) { ++ printk("acx111-specific function called " ++ "with non-acx111 chip, aborting\n"); ++ goto end_ok; ++ } ++ ++ /* get Acx111 Memory Configuration */ ++ memset(&memconf, 0, sizeof(memconf)); ++ /* BTW, fails with 12 (Write only) error code. ++ ** Retained for easy testing of issue_cmd error handling :) */ ++ printk ("Interrogating queue config\n"); ++ acx_s_interrogate(adev, &memconf, ACX1xx_IE_QUEUE_CONFIG); ++ printk ("done with queue config\n"); ++ ++ /* get Acx111 Queue Configuration */ ++ memset(&queueconf, 0, sizeof(queueconf)); ++ printk ("Interrogating mem config options\n"); ++ acx_s_interrogate(adev, &queueconf, ACX1xx_IE_MEMORY_CONFIG_OPTIONS); ++ printk ("done with mem config options\n"); ++ ++ /* get Acx111 Memory Map */ ++ memset(memmap, 0, sizeof(memmap)); ++ printk ("Interrogating mem map\n"); ++ acx_s_interrogate(adev, &memmap, ACX1xx_IE_MEMORY_MAP); ++ printk ("done with mem map\n"); ++ ++ /* get Acx111 Rx Config */ ++ memset(rxconfig, 0, sizeof(rxconfig)); ++ printk ("Interrogating rxconfig\n"); ++ acx_s_interrogate(adev, &rxconfig, ACX1xx_IE_RXCONFIG); ++ printk ("done with queue rxconfig\n"); ++ ++ /* get Acx111 fcs error count */ ++ memset(fcserror, 0, sizeof(fcserror)); ++ printk ("Interrogating fcs err count\n"); ++ acx_s_interrogate(adev, &fcserror, ACX1xx_IE_FCS_ERROR_COUNT); ++ printk ("done with err count\n"); ++ ++ /* get Acx111 rate fallback */ ++ memset(ratefallback, 0, sizeof(ratefallback)); ++ printk ("Interrogating rate fallback\n"); ++ acx_s_interrogate(adev, &ratefallback, ACX1xx_IE_RATE_FALLBACK); ++ printk ("done with rate fallback\n"); ++ ++ /* force occurrence of a beacon interrupt */ ++ /* TODO: comment why is this necessary */ ++ write_reg16(adev, IO_ACX_HINT_TRIG, HOST_INT_BEACON); ++ ++ /* dump Acx111 Mem Configuration */ ++ printk("dump mem config:\n" ++ "data read: %d, struct size: %d\n" ++ "Number of stations: %1X\n" ++ "Memory block size: %1X\n" ++ "tx/rx memory block allocation: %1X\n" ++ "count rx: %X / tx: %X queues\n" ++ "options %1X\n" ++ "fragmentation %1X\n" ++ "Rx Queue 1 Count Descriptors: %X\n" ++ "Rx Queue 1 Host Memory Start: %X\n" ++ "Tx Queue 1 Count Descriptors: %X\n" ++ "Tx Queue 1 Attributes: %X\n", ++ memconf.len, (int) sizeof(memconf), ++ memconf.no_of_stations, ++ memconf.memory_block_size, ++ memconf.tx_rx_memory_block_allocation, ++ memconf.count_rx_queues, memconf.count_tx_queues, ++ memconf.options, ++ memconf.fragmentation, ++ memconf.rx_queue1_count_descs, ++ acx2cpu(memconf.rx_queue1_host_rx_start), ++ memconf.tx_queue1_count_descs, ++ memconf.tx_queue1_attributes); ++ ++ /* dump Acx111 Queue Configuration */ ++ printk("dump queue head:\n" ++ "data read: %d, struct size: %d\n" ++ "tx_memory_block_address (from card): %X\n" ++ "rx_memory_block_address (from card): %X\n" ++ "rx1_queue address (from card): %X\n" ++ "tx1_queue address (from card): %X\n" ++ "tx1_queue attributes (from card): %X\n", ++ queueconf.len, (int) sizeof(queueconf), ++ queueconf.tx_memory_block_address, ++ queueconf.rx_memory_block_address, ++ queueconf.rx1_queue_address, ++ queueconf.tx1_queue_address, ++ queueconf.tx1_attributes); ++ ++ /* dump Acx111 Mem Map */ ++ printk("dump mem map:\n" ++ "data read: %d, struct size: %d\n" ++ "Code start: %X\n" ++ "Code end: %X\n" ++ "WEP default key start: %X\n" ++ "WEP default key end: %X\n" ++ "STA table start: %X\n" ++ "STA table end: %X\n" ++ "Packet template start: %X\n" ++ "Packet template end: %X\n" ++ "Queue memory start: %X\n" ++ "Queue memory end: %X\n" ++ "Packet memory pool start: %X\n" ++ "Packet memory pool end: %X\n" ++ "iobase: %p\n" ++ "iobase2: %p\n", ++ *((u16 *)&memmap[0x02]), (int) sizeof(memmap), ++ *((u32 *)&memmap[0x04]), ++ *((u32 *)&memmap[0x08]), ++ *((u32 *)&memmap[0x0C]), ++ *((u32 *)&memmap[0x10]), ++ *((u32 *)&memmap[0x14]), ++ *((u32 *)&memmap[0x18]), ++ *((u32 *)&memmap[0x1C]), ++ *((u32 *)&memmap[0x20]), ++ *((u32 *)&memmap[0x24]), ++ *((u32 *)&memmap[0x28]), ++ *((u32 *)&memmap[0x2C]), ++ *((u32 *)&memmap[0x30]), ++ adev->iobase, ++ adev->iobase2); ++ ++ /* dump Acx111 Rx Config */ ++ printk("dump rx config:\n" ++ "data read: %d, struct size: %d\n" ++ "rx config: %X\n" ++ "rx filter config: %X\n", ++ *((u16 *)&rxconfig[0x02]), (int) sizeof(rxconfig), ++ *((u16 *)&rxconfig[0x04]), ++ *((u16 *)&rxconfig[0x06])); ++ ++ /* dump Acx111 fcs error */ ++ printk("dump fcserror:\n" ++ "data read: %d, struct size: %d\n" ++ "fcserrors: %X\n", ++ *((u16 *)&fcserror[0x02]), (int) sizeof(fcserror), ++ *((u32 *)&fcserror[0x04])); ++ ++ /* dump Acx111 rate fallback */ ++ printk("dump rate fallback:\n" ++ "data read: %d, struct size: %d\n" ++ "ratefallback: %X\n", ++ *((u16 *)&ratefallback[0x02]), (int) sizeof(ratefallback), ++ *((u8 *)&ratefallback[0x04])); ++ ++ /* protect against IRQ */ ++ acx_lock(adev, flags); ++ ++ /* dump acx111 internal rx descriptor ring buffer */ ++ rxdesc = adev->rxdesc_start; ++ ++ /* loop over complete receive pool */ ++ if (rxdesc) for (i = 0; i < RX_CNT; i++) { ++ printk("\ndump internal rxdesc %d:\n" ++ "mem pos %p\n" ++ "next 0x%X\n" ++ "acx mem pointer (dynamic) 0x%X\n" ++ "CTL (dynamic) 0x%X\n" ++ "Rate (dynamic) 0x%X\n" ++ "RxStatus (dynamic) 0x%X\n" ++ "Mod/Pre (dynamic) 0x%X\n", ++ i, ++ rxdesc, ++ acx2cpu(rxdesc->pNextDesc), ++ acx2cpu(rxdesc->ACXMemPtr), ++ rxdesc->Ctl_8, ++ rxdesc->rate, ++ rxdesc->error, ++ rxdesc->SNR); ++ rxdesc++; ++ } ++ ++ /* dump host rx descriptor ring buffer */ ++ ++ rxhostdesc = adev->rxhostdesc_start; ++ ++ /* loop over complete receive pool */ ++ if (rxhostdesc) for (i = 0; i < RX_CNT; i++) { ++ printk("\ndump host rxdesc %d:\n" ++ "mem pos %p\n" ++ "buffer mem pos 0x%X\n" ++ "buffer mem offset 0x%X\n" ++ "CTL 0x%X\n" ++ "Length 0x%X\n" ++ "next 0x%X\n" ++ "Status 0x%X\n", ++ i, ++ rxhostdesc, ++ acx2cpu(rxhostdesc->data_phy), ++ rxhostdesc->data_offset, ++ le16_to_cpu(rxhostdesc->Ctl_16), ++ le16_to_cpu(rxhostdesc->length), ++ acx2cpu(rxhostdesc->desc_phy_next), ++ rxhostdesc->Status); ++ rxhostdesc++; ++ } ++ ++ /* dump acx111 internal tx descriptor ring buffer */ ++ txdesc = adev->txdesc_start; ++ ++ /* loop over complete transmit pool */ ++ if (txdesc) for (i = 0; i < TX_CNT; i++) { ++ printk("\ndump internal txdesc %d:\n" ++ "size 0x%X\n" ++ "mem pos %p\n" ++ "next 0x%X\n" ++ "acx mem pointer (dynamic) 0x%X\n" ++ "host mem pointer (dynamic) 0x%X\n" ++ "length (dynamic) 0x%X\n" ++ "CTL (dynamic) 0x%X\n" ++ "CTL2 (dynamic) 0x%X\n" ++ "Status (dynamic) 0x%X\n" ++ "Rate (dynamic) 0x%X\n", ++ i, ++ (int) sizeof(struct txdesc), ++ txdesc, ++ acx2cpu(txdesc->pNextDesc), ++ acx2cpu(txdesc->AcxMemPtr), ++ acx2cpu(txdesc->HostMemPtr), ++ le16_to_cpu(txdesc->total_length), ++ txdesc->Ctl_8, ++ txdesc->Ctl2_8, txdesc->error, ++ txdesc->u.r1.rate); ++ txdesc = advance_txdesc(adev, txdesc, 1); ++ } ++ ++ /* dump host tx descriptor ring buffer */ ++ ++ txhostdesc = adev->txhostdesc_start; ++ ++ /* loop over complete host send pool */ ++ if (txhostdesc) for (i = 0; i < TX_CNT * 2; i++) { ++ printk("\ndump host txdesc %d:\n" ++ "mem pos %p\n" ++ "buffer mem pos 0x%X\n" ++ "buffer mem offset 0x%X\n" ++ "CTL 0x%X\n" ++ "Length 0x%X\n" ++ "next 0x%X\n" ++ "Status 0x%X\n", ++ i, ++ txhostdesc, ++ acx2cpu(txhostdesc->data_phy), ++ txhostdesc->data_offset, ++ le16_to_cpu(txhostdesc->Ctl_16), ++ le16_to_cpu(txhostdesc->length), ++ acx2cpu(txhostdesc->desc_phy_next), ++ le32_to_cpu(txhostdesc->Status)); ++ txhostdesc++; ++ } ++ ++ /* write_reg16(adev, 0xb4, 0x4); */ ++ ++ acx_unlock(adev, flags); ++end_ok: ++ ++ acx_sem_unlock(adev); ++#endif /* ACX_DEBUG */ ++ return OK; ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acx100mem_ioctl_set_phy_amp_bias( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ struct iw_param *vwrq, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ u16 gpio_old; ++ ++ if (!IS_ACX100(adev)) { ++ /* WARNING!!! ++ * Removing this check *might* damage ++ * hardware, since we're tweaking GPIOs here after all!!! ++ * You've been warned... ++ * WARNING!!! */ ++ printk("acx: sorry, setting bias level for non-acx100 " ++ "is not supported yet\n"); ++ return OK; ++ } ++ ++ if (*extra > 7) { ++ printk("acx: invalid bias parameter, range is 0-7\n"); ++ return -EINVAL; ++ } ++ ++ acx_sem_lock(adev); ++ ++ /* Need to lock accesses to [IO_ACX_GPIO_OUT]: ++ * IRQ handler uses it to update LED */ ++ acx_lock(adev, flags); ++ gpio_old = read_reg16(adev, IO_ACX_GPIO_OUT); ++ write_reg16(adev, IO_ACX_GPIO_OUT, (gpio_old & 0xf8ff) | ((u16)*extra << 8)); ++ acx_unlock(adev, flags); ++ ++ log(L_DEBUG, "gpio_old: 0x%04X\n", gpio_old); ++ printk("%s: PHY power amplifier bias: old:%d, new:%d\n", ++ ndev->name, ++ (gpio_old & 0x0700) >> 8, (unsigned char)*extra); ++ ++ acx_sem_unlock(adev); ++ ++ return OK; ++} ++ ++/*************************************************************** ++** acxmem_l_alloc_tx ++** Actually returns a txdesc_t* ptr ++** ++** FIXME: in case of fragments, should allocate multiple descrs ++** after figuring out how many we need and whether we still have ++** sufficiently many. ++*/ ++tx_t* ++acxmem_l_alloc_tx(acx_device_t *adev) ++{ ++ struct txdesc *txdesc; ++ unsigned head; ++ u8 ctl8; ++ static int txattempts = 0; ++ ++ FN_ENTER; ++ ++ if (unlikely(!adev->tx_free)) { ++ printk("acx: BUG: no free txdesc left\n"); ++ /* ++ * Probably the ACX ignored a transmit attempt and now there's a packet ++ * sitting in the queue we think should be transmitting but the ACX doesn't ++ * know about. ++ * On the first pass, send the ACX a TxProc interrupt to try moving ++ * things along, and if that doesn't work (ie, we get called again) completely ++ * flush the transmit queue. ++ */ ++ if (txattempts < 10) { ++ txattempts++; ++ printk ("acx: trying to wake up ACX\n"); ++ write_reg16(adev, IO_ACX_INT_TRIG, INT_TRIG_TXPRC); ++ write_flush(adev); } ++ else { ++ txattempts = 0; ++ printk ("acx: flushing transmit queue.\n"); ++ acxmem_l_clean_txdesc_emergency (adev); ++ } ++ txdesc = NULL; ++ goto end; ++ } ++ ++ /* ++ * Make a quick check to see if there is transmit buffer space on ++ * the ACX. This can't guarantee there is enough space for the packet ++ * since we don't yet know how big it is, but it will prevent at least some ++ * annoyances. ++ */ ++ if (!adev->acx_txbuf_blocks_free) { ++ txdesc = NULL; ++ goto end; ++ } ++ ++ head = adev->tx_head; ++ /* ++ * txdesc points to ACX memory ++ */ ++ txdesc = get_txdesc(adev, head); ++ ctl8 = read_slavemem8 (adev, (u32) &(txdesc->Ctl_8)); ++ ++ /* ++ * If we don't own the buffer (HOSTOWN) it is certainly not free; however, ++ * we may have previously thought we had enough memory to send ++ * a packet, allocated the buffer then gave up when we found not enough ++ * transmit buffer space on the ACX. In that case, HOSTOWN and ++ * ACXDONE will both be set. ++ */ ++ if (unlikely(DESC_CTL_HOSTOWN != (ctl8 & DESC_CTL_HOSTOWN))) { ++ /* whoops, descr at current index is not free, so probably ++ * ring buffer already full */ ++ printk("acx: BUG: tx_head:%d Ctl8:0x%02X - failed to find " ++ "free txdesc\n", head, ctl8); ++ txdesc = NULL; ++ goto end; ++ } ++ ++ /* Needed in case txdesc won't be eventually submitted for tx */ ++ write_slavemem8 (adev, (u32) &(txdesc->Ctl_8), DESC_CTL_ACXDONE_HOSTOWN); ++ ++ adev->tx_free--; ++ log(L_BUFT, "tx: got desc %u, %u remain\n", ++ head, adev->tx_free); ++ /* Keep a few free descs between head and tail of tx ring. ++ ** It is not absolutely needed, just feels safer */ ++ if (adev->tx_free < TX_STOP_QUEUE) { ++ log(L_BUF, "stop queue (%u tx desc left)\n", ++ adev->tx_free); ++ acx_stop_queue(adev->ndev, NULL); ++ } ++ ++ /* returning current descriptor, so advance to next free one */ ++ adev->tx_head = (head + 1) % TX_CNT; ++end: ++ FN_EXIT0; ++ ++ return (tx_t*)txdesc; ++} ++ ++ ++/*************************************************************** ++** acxmem_l_dealloc_tx ++** Clears out a previously allocatedvoid acxmem_l_dealloc_tx(tx_t *tx_opaque); ++ transmit descriptor. The ACX ++** can get confused if we skip transmit descriptors in the queue, ++** so when we don't need a descriptor return it to its original ++** state and move the queue head pointer back. ++** ++*/ ++void ++acxmem_l_dealloc_tx(acx_device_t *adev, tx_t *tx_opaque) ++{ ++ /* ++ * txdesc is the address of the descriptor on the ACX. ++ */ ++ txdesc_t *txdesc = (txdesc_t*)tx_opaque; ++ txdesc_t tmptxdesc; ++ int index; ++ ++ memset (&tmptxdesc, 0, sizeof(tmptxdesc)); ++ tmptxdesc.Ctl_8 = DESC_CTL_HOSTOWN | DESC_CTL_FIRSTFRAG; ++ tmptxdesc.u.r1.rate = 0x0a; ++ ++ /* ++ * Clear out all of the transmit descriptor except for the next pointer ++ */ ++ copy_to_slavemem (adev, (u32) &(txdesc->HostMemPtr), ++ (u8 *) &(tmptxdesc.HostMemPtr), ++ sizeof (tmptxdesc) - sizeof(tmptxdesc.pNextDesc)); ++ ++ /* ++ * This is only called immediately after we've allocated, so we should ++ * be able to set the head back to this descriptor. ++ */ ++ index = ((u8*) txdesc - (u8*)adev->txdesc_start) / adev->txdesc_size; ++ printk ("acx_dealloc: moving head from %d to %d\n", adev->tx_head, index); ++ adev->tx_head = index; ++} ++ ++ ++/*********************************************************************** ++*/ ++void* ++acxmem_l_get_txbuf(acx_device_t *adev, tx_t* tx_opaque) ++{ ++ return get_txhostdesc(adev, (txdesc_t*)tx_opaque)->data; ++} ++ ++ ++/*********************************************************************** ++** acxmem_l_tx_data ++** ++** Can be called from IRQ (rx -> (AP bridging or mgmt response) -> tx). ++** Can be called from acx_i_start_xmit (data frames from net core). ++** ++** FIXME: in case of fragments, should loop over the number of ++** pre-allocated tx descrs, properly setting up transfer data and ++** CTL_xxx flags according to fragment number. ++*/ ++void ++acxmem_update_queue_indicator (acx_device_t *adev, int txqueue) ++{ ++#ifdef USING_MORE_THAN_ONE_TRANSMIT_QUEUE ++ u32 indicator; ++ unsigned long flags; ++ int count; ++ ++ /* ++ * Can't handle an interrupt while we're fiddling with the ACX's lock, ++ * according to TI. The ACX is supposed to hold fw_lock for at most ++ * 500ns. ++ */ ++ local_irq_save (flags); ++ ++ /* ++ * Wait for ACX to release the lock (at most 500ns). ++ */ ++ count = 0; ++ while (read_slavemem16 (adev, (u32) &(adev->acx_queue_indicator->fw_lock)) ++ && (count++ < 50)) { ++ ndelay (10); ++ } ++ if (count < 50) { ++ ++ /* ++ * Take out the host lock - anything non-zero will work, so don't worry about ++ * be/le ++ */ ++ write_slavemem16 (adev, (u32) &(adev->acx_queue_indicator->host_lock), 1); ++ ++ /* ++ * Avoid a race condition ++ */ ++ count = 0; ++ while (read_slavemem16 (adev, (u32) &(adev->acx_queue_indicator->fw_lock)) ++ && (count++ < 50)) { ++ ndelay (10); ++ } ++ ++ if (count < 50) { ++ /* ++ * Mark the queue active ++ */ ++ indicator = read_slavemem32 (adev, (u32) &(adev->acx_queue_indicator->indicator)); ++ indicator |= cpu_to_le32 (1 << txqueue); ++ write_slavemem32 (adev, (u32) &(adev->acx_queue_indicator->indicator), indicator); ++ } ++ ++ /* ++ * Release the host lock ++ */ ++ write_slavemem16 (adev, (u32) &(adev->acx_queue_indicator->host_lock), 0); ++ ++ } ++ ++ /* ++ * Restore interrupts ++ */ ++ local_irq_restore (flags); ++#endif ++} ++ ++void ++acxmem_l_tx_data(acx_device_t *adev, tx_t* tx_opaque, int len) ++{ ++ /* ++ * txdesc is the address on the ACX ++ */ ++ txdesc_t *txdesc = (txdesc_t*)tx_opaque; ++ txhostdesc_t *hostdesc1, *hostdesc2; ++ client_t *clt; ++ u16 rate_cur; ++ u8 Ctl_8, Ctl2_8; ++ u32 addr; ++ ++ FN_ENTER; ++ /* fw doesn't tx such packets anyhow */ ++ if (unlikely(len < WLAN_HDR_A3_LEN)) ++ goto end; ++ ++ hostdesc1 = get_txhostdesc(adev, txdesc); ++ /* modify flag status in separate variable to be able to write it back ++ * in one big swoop later (also in order to have less device memory ++ * accesses) */ ++ Ctl_8 = read_slavemem8 (adev, (u32) &(txdesc->Ctl_8)); ++ Ctl2_8 = 0; /* really need to init it to 0, not txdesc->Ctl2_8, it seems */ ++ ++ hostdesc2 = hostdesc1 + 1; ++ ++ /* DON'T simply set Ctl field to 0 here globally, ++ * it needs to maintain a consistent flag status (those are state flags!!), ++ * otherwise it may lead to severe disruption. Only set or reset particular ++ * flags at the exact moment this is needed... */ ++ ++ /* let chip do RTS/CTS handshaking before sending ++ * in case packet size exceeds threshold */ ++ if (len > adev->rts_threshold) ++ SET_BIT(Ctl2_8, DESC_CTL2_RTS); ++ else ++ CLEAR_BIT(Ctl2_8, DESC_CTL2_RTS); ++ ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_3_AP: ++ clt = acx_l_sta_list_get(adev, ((wlan_hdr_t*)hostdesc1->data)->a1); ++ break; ++ case ACX_MODE_2_STA: ++ clt = adev->ap_client; ++ break; ++#if 0 ++/* testing was done on acx111: */ ++ case ACX_MODE_MONITOR: ++ SET_BIT(Ctl2_8, 0 ++/* sends CTS to self before packet */ ++ + DESC_CTL2_SEQ /* don't increase sequence field */ ++/* not working (looks like good fcs is still added) */ ++ + DESC_CTL2_FCS /* don't add the FCS */ ++/* not tested */ ++ + DESC_CTL2_MORE_FRAG ++/* not tested */ ++ + DESC_CTL2_RETRY /* don't increase retry field */ ++/* not tested */ ++ + DESC_CTL2_POWER /* don't increase power mgmt. field */ ++/* no effect */ ++ + DESC_CTL2_WEP /* encrypt this frame */ ++/* not tested */ ++ + DESC_CTL2_DUR /* don't increase duration field */ ++ ); ++ /* fallthrough */ ++#endif ++ default: /* ACX_MODE_OFF, ACX_MODE_MONITOR */ ++ clt = NULL; ++ break; ++ } ++ ++ rate_cur = clt ? clt->rate_cur : adev->rate_bcast; ++ if (unlikely(!rate_cur)) { ++ printk("acx: driver bug! bad ratemask\n"); ++ goto end; ++ } ++ ++ /* used in tx cleanup routine for auto rate and accounting: */ ++ put_txcr(adev, txdesc, clt, rate_cur); ++ ++ write_slavemem16 (adev, (u32) &(txdesc->total_length), cpu_to_le16(len)); ++ hostdesc2->length = cpu_to_le16(len - WLAN_HDR_A3_LEN); ++ if (IS_ACX111(adev)) { ++ /* note that if !txdesc->do_auto, txrate->cur ++ ** has only one nonzero bit */ ++ txdesc->u.r2.rate111 = cpu_to_le16( ++ rate_cur ++ /* WARNING: I was never able to make it work with prism54 AP. ++ ** It was falling down to 1Mbit where shortpre is not applicable, ++ ** and not working at all at "5,11 basic rates only" setting. ++ ** I even didn't see tx packets in radio packet capture. ++ ** Disabled for now --vda */ ++ /*| ((clt->shortpre && clt->cur!=RATE111_1) ? RATE111_SHORTPRE : 0) */ ++ ); ++#ifdef TODO_FIGURE_OUT_WHEN_TO_SET_THIS ++ /* should add this to rate111 above as necessary */ ++ | (clt->pbcc511 ? RATE111_PBCC511 : 0) ++#endif ++ hostdesc1->length = cpu_to_le16(len); ++ } else { /* ACX100 */ ++ u8 rate_100 = clt ? clt->rate_100 : adev->rate_bcast100; ++ write_slavemem8 (adev, (u32) &(txdesc->u.r1.rate), rate_100); ++#ifdef TODO_FIGURE_OUT_WHEN_TO_SET_THIS ++ if (clt->pbcc511) { ++ if (n == RATE100_5 || n == RATE100_11) ++ n |= RATE100_PBCC511; ++ } ++ ++ if (clt->shortpre && (clt->cur != RATE111_1)) ++ SET_BIT(Ctl_8, DESC_CTL_SHORT_PREAMBLE); /* set Short Preamble */ ++#endif ++ /* set autodma and reclaim and 1st mpdu */ ++ SET_BIT(Ctl_8, DESC_CTL_FIRSTFRAG); ++ ++#if ACX_FRAGMENTATION ++ /* SET_BIT(Ctl2_8, DESC_CTL2_MORE_FRAG); cannot set it unconditionally, needs to be set for all non-last fragments */ ++#endif ++ hostdesc1->length = cpu_to_le16(WLAN_HDR_A3_LEN); ++ ++ /* ++ * Since we're not using autodma copy the packet data to the acx now. ++ * Even host descriptors point to the packet header, and the odd indexed ++ * descriptor following points to the packet data. ++ * ++ * The first step is to find free memory in the ACX transmit buffers. ++ * They don't necessarily map one to one with the transmit queue entries, ++ * so search through them starting just after the last one used. ++ */ ++ addr = allocate_acx_txbuf_space (adev, len); ++ if (addr) { ++ chaincopy_to_slavemem (adev, addr, hostdesc1->data, len); ++ } ++ else { ++ /* ++ * Bummer. We thought we might have enough room in the transmit ++ * buffers to send this packet, but it turns out we don't. alloc_tx ++ * has already marked this transmit descriptor as HOSTOWN and ACXDONE, ++ * which means the ACX will hang when it gets to this descriptor unless ++ * we do something about it. Having a bubble in the transmit queue just ++ * doesn't seem to work, so we have to reset this transmit queue entry's ++ * state to its original value and back up our head pointer to point ++ * back to this entry. ++ */ ++ hostdesc1->length = 0; ++ hostdesc2->length = 0; ++ write_slavemem16 (adev, (u32) &(txdesc->total_length), 0); ++ write_slavemem8 (adev, (u32) &(txdesc->Ctl_8), DESC_CTL_HOSTOWN | DESC_CTL_FIRSTFRAG); ++ adev->tx_head = ((u8*) txdesc - (u8*) adev->txdesc_start) / adev->txdesc_size; ++ goto end; ++ } ++ /* ++ * Tell the ACX where the packet is. ++ */ ++ write_slavemem32 (adev, (u32) &(txdesc->AcxMemPtr), addr); ++ ++ } ++ /* don't need to clean ack/rts statistics here, already ++ * done on descr cleanup */ ++ ++ /* clears HOSTOWN and ACXDONE bits, thus telling that the descriptors ++ * are now owned by the acx100; do this as LAST operation */ ++ CLEAR_BIT(Ctl_8, DESC_CTL_ACXDONE_HOSTOWN); ++ /* flush writes before we release hostdesc to the adapter here */ ++ //wmb(); ++ ++ /* write back modified flags */ ++ /* ++ * At this point Ctl_8 should just be FIRSTFRAG ++ */ ++ write_slavemem8 (adev, (u32) &(txdesc->Ctl2_8),Ctl2_8); ++ write_slavemem8 (adev, (u32) &(txdesc->Ctl_8), Ctl_8); ++ /* unused: txdesc->tx_time = cpu_to_le32(jiffies); */ ++ ++ /* ++ * Update the queue indicator to say there's data on the first queue. ++ */ ++ acxmem_update_queue_indicator (adev, 0); ++ ++ /* flush writes before we tell the adapter that it's its turn now */ ++ mmiowb(); ++ write_reg16(adev, IO_ACX_INT_TRIG, INT_TRIG_TXPRC); ++ write_flush(adev); ++ ++ /* log the packet content AFTER sending it, ++ * in order to not delay sending any further than absolutely needed ++ * Do separate logs for acx100/111 to have human-readable rates */ ++ if (unlikely(acx_debug & (L_XFER|L_DATA))) { ++ u16 fc = ((wlan_hdr_t*)hostdesc1->data)->fc; ++ if (IS_ACX111(adev)) ++ printk("tx: pkt (%s): len %d " ++ "rate %04X%s status %u\n", ++ acx_get_packet_type_string(le16_to_cpu(fc)), len, ++ le16_to_cpu(txdesc->u.r2.rate111), ++ (le16_to_cpu(txdesc->u.r2.rate111) & RATE111_SHORTPRE) ? "(SPr)" : "", ++ adev->status); ++ else ++ printk("tx: pkt (%s): len %d rate %03u%s status %u\n", ++ acx_get_packet_type_string(fc), len, ++ read_slavemem8 (adev, (u32) &(txdesc->u.r1.rate)), ++ (Ctl_8 & DESC_CTL_SHORT_PREAMBLE) ? "(SPr)" : "", ++ adev->status); ++ ++ if (acx_debug & L_DATA) { ++ printk("tx: 802.11 [%d]: ", len); ++ acx_dump_bytes(hostdesc1->data, len); ++ } ++ } ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_l_clean_txdesc ++** ++** This function resets the txdescs' status when the ACX100 ++** signals the TX done IRQ (txdescs have been processed), starting with ++** the pool index of the descriptor which we would use next, ++** in order to make sure that we can be as fast as possible ++** in filling new txdescs. ++** Everytime we get called we know where the next packet to be cleaned is. ++*/ ++ ++#if !ACX_DEBUG ++static inline void log_txbuffer(const acx_device_t *adev) {} ++#else ++static void ++log_txbuffer(acx_device_t *adev) ++{ ++ txdesc_t *txdesc; ++ int i; ++ u8 Ctl_8; ++ ++ /* no FN_ENTER here, we don't want that */ ++ /* no locks here, since it's entirely non-critical code */ ++ txdesc = adev->txdesc_start; ++ if (unlikely(!txdesc)) return; ++ printk("tx: desc->Ctl8's:"); ++ for (i = 0; i < TX_CNT; i++) { ++ Ctl_8 = read_slavemem8 (adev, (u32) &(txdesc->Ctl_8)); ++ printk(" %02X", Ctl_8); ++ txdesc = advance_txdesc(adev, txdesc, 1); ++ } ++ printk("\n"); ++} ++#endif ++ ++ ++static void ++handle_tx_error(acx_device_t *adev, u8 error, unsigned int finger) ++{ ++ const char *err = "unknown error"; ++ ++ /* hmm, should we handle this as a mask ++ * of *several* bits? ++ * For now I think only caring about ++ * individual bits is ok... */ ++ switch (error) { ++ case 0x01: ++ err = "no Tx due to error in other fragment"; ++ adev->wstats.discard.fragment++; ++ break; ++ case 0x02: ++ err = "Tx aborted"; ++ adev->stats.tx_aborted_errors++; ++ break; ++ case 0x04: ++ err = "Tx desc wrong parameters"; ++ adev->wstats.discard.misc++; ++ break; ++ case 0x08: ++ err = "WEP key not found"; ++ adev->wstats.discard.misc++; ++ break; ++ case 0x10: ++ err = "MSDU lifetime timeout? - try changing " ++ "'iwconfig retry lifetime XXX'"; ++ adev->wstats.discard.misc++; ++ break; ++ case 0x20: ++ err = "excessive Tx retries due to either distance " ++ "too high or unable to Tx or Tx frame error - " ++ "try changing 'iwconfig txpower XXX' or " ++ "'sens'itivity or 'retry'"; ++ adev->wstats.discard.retries++; ++ /* Tx error 0x20 also seems to occur on ++ * overheating, so I'm not sure whether we ++ * actually want to do aggressive radio recalibration, ++ * since people maybe won't notice then that their hardware ++ * is slowly getting cooked... ++ * Or is it still a safe long distance from utter ++ * radio non-functionality despite many radio recalibs ++ * to final destructive overheating of the hardware? ++ * In this case we really should do recalib here... ++ * I guess the only way to find out is to do a ++ * potentially fatal self-experiment :-\ ++ * Or maybe only recalib in case we're using Tx ++ * rate auto (on errors switching to lower speed ++ * --> less heat?) or 802.11 power save mode? ++ * ++ * ok, just do it. */ ++ if (++adev->retry_errors_msg_ratelimit % 4 == 0) { ++ if (adev->retry_errors_msg_ratelimit <= 20) { ++ printk("%s: several excessive Tx " ++ "retry errors occurred, attempting " ++ "to recalibrate radio. Radio " ++ "drift might be caused by increasing " ++ "card temperature, please check the card " ++ "before it's too late!\n", ++ adev->ndev->name); ++ if (adev->retry_errors_msg_ratelimit == 20) ++ printk("disabling above message\n"); ++ } ++ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_CMD_RADIO_RECALIB); ++ } ++ break; ++ case 0x40: ++ err = "Tx buffer overflow"; ++ adev->stats.tx_fifo_errors++; ++ break; ++ case 0x80: ++ err = "DMA error"; ++ adev->wstats.discard.misc++; ++ break; ++ } ++ adev->stats.tx_errors++; ++ if (adev->stats.tx_errors <= 20) ++ printk("%s: tx error 0x%02X, buf %02u! (%s)\n", ++ adev->ndev->name, error, finger, err); ++ else ++ printk("%s: tx error 0x%02X, buf %02u!\n", ++ adev->ndev->name, error, finger); ++} ++ ++ ++unsigned int ++acxmem_l_clean_txdesc(acx_device_t *adev) ++{ ++ txdesc_t *txdesc; ++ unsigned finger; ++ int num_cleaned; ++ u16 r111; ++ u8 error, ack_failures, rts_failures, rts_ok, r100, Ctl_8; ++ u32 acxmem; ++ txdesc_t tmptxdesc; ++ ++ FN_ENTER; ++ ++ /* ++ * Set up a template descriptor for re-initialization. The only ++ * things that get set are Ctl_8 and the rate, and the rate defaults ++ * to 1Mbps. ++ */ ++ memset (&tmptxdesc, 0, sizeof (tmptxdesc)); ++ tmptxdesc.Ctl_8 = DESC_CTL_HOSTOWN | DESC_CTL_FIRSTFRAG; ++ tmptxdesc.u.r1.rate = 0x0a; ++ ++ if (unlikely(acx_debug & L_DEBUG)) ++ log_txbuffer(adev); ++ ++ log(L_BUFT, "tx: cleaning up bufs from %u\n", adev->tx_tail); ++ ++ /* We know first descr which is not free yet. We advance it as far ++ ** as we see correct bits set in following descs (if next desc ++ ** is NOT free, we shouldn't advance at all). We know that in ++ ** front of tx_tail may be "holes" with isolated free descs. ++ ** We will catch up when all intermediate descs will be freed also */ ++ ++ finger = adev->tx_tail; ++ num_cleaned = 0; ++ while (likely(finger != adev->tx_head)) { ++ txdesc = get_txdesc(adev, finger); ++ ++ /* If we allocated txdesc on tx path but then decided ++ ** to NOT use it, then it will be left as a free "bubble" ++ ** in the "allocated for tx" part of the ring. ++ ** We may meet it on the next ring pass here. */ ++ ++ /* stop if not marked as "tx finished" and "host owned" */ ++ Ctl_8 = read_slavemem8 (adev, (u32) &(txdesc->Ctl_8)); ++ if ((Ctl_8 & DESC_CTL_ACXDONE_HOSTOWN) ++ != DESC_CTL_ACXDONE_HOSTOWN) { ++ if (unlikely(!num_cleaned)) { /* maybe remove completely */ ++ log(L_BUFT, "clean_txdesc: tail isn't free. " ++ "tail:%d head:%d\n", ++ adev->tx_tail, adev->tx_head); ++ } ++ break; ++ } ++ ++ /* remember desc values... */ ++ error = read_slavemem8 (adev, (u32) &(txdesc->error)); ++ ack_failures = read_slavemem8 (adev, (u32) &(txdesc->ack_failures)); ++ rts_failures = read_slavemem8 (adev, (u32) &(txdesc->u.rts.rts_failures)); ++ rts_ok = read_slavemem8 (adev, (u32) &(txdesc->u.rts.rts_ok)); ++ r100 = read_slavemem8 (adev, (u32) &(txdesc->u.r1.rate)); ++ r111 = le16_to_cpu(read_slavemem16 (adev, (u32) &(txdesc->u.r2.rate111))); ++ ++ /* need to check for certain error conditions before we ++ * clean the descriptor: we still need valid descr data here */ ++ if (unlikely(0x30 & error)) { ++ /* only send IWEVTXDROP in case of retry or lifetime exceeded; ++ * all other errors mean we screwed up locally */ ++ union iwreq_data wrqu; ++ wlan_hdr_t *hdr; ++ txhostdesc_t *hostdesc; ++ ++ hostdesc = get_txhostdesc(adev, txdesc); ++ hdr = (wlan_hdr_t *)hostdesc->data; ++ MAC_COPY(wrqu.addr.sa_data, hdr->a1); ++ wireless_send_event(adev->ndev, IWEVTXDROP, &wrqu, NULL); ++ } ++ ++ /* ++ * Free up the transmit data buffers ++ */ ++ acxmem = read_slavemem32 (adev, (u32) &(txdesc->AcxMemPtr)); ++ if (acxmem) { ++ reclaim_acx_txbuf_space (adev, acxmem); ++ } ++ ++ /* ...and free the desc by clearing all the fields ++ except the next pointer */ ++ copy_to_slavemem (adev, ++ (u32) &(txdesc->HostMemPtr), ++ (u8 *) &(tmptxdesc.HostMemPtr), ++ sizeof (tmptxdesc) - sizeof(tmptxdesc.pNextDesc) ++ ); ++ ++ adev->tx_free++; ++ num_cleaned++; ++ ++ if ((adev->tx_free >= TX_START_QUEUE) ++ && (adev->status == ACX_STATUS_4_ASSOCIATED) ++ && (acx_queue_stopped(adev->ndev)) ++ ) { ++ log(L_BUF, "tx: wake queue (avail. Tx desc %u)\n", ++ adev->tx_free); ++ acx_wake_queue(adev->ndev, NULL); ++ } ++ ++ /* do error checking, rate handling and logging ++ * AFTER having done the work, it's faster */ ++ ++ /* do rate handling */ ++ if (adev->rate_auto) { ++ struct client *clt = get_txc(adev, txdesc); ++ if (clt) { ++ u16 cur = get_txr(adev, txdesc); ++ if (clt->rate_cur == cur) { ++ acx_l_handle_txrate_auto(adev, clt, ++ cur, /* intended rate */ ++ r100, r111, /* actually used rate */ ++ (error & 0x30), /* was there an error? */ ++ TX_CNT + TX_CLEAN_BACKLOG - adev->tx_free); ++ } ++ } ++ } ++ ++ if (unlikely(error)) ++ handle_tx_error(adev, error, finger); ++ ++ if (IS_ACX111(adev)) ++ log(L_BUFT, "tx: cleaned %u: !ACK=%u !RTS=%u RTS=%u r111=%04X\n", ++ finger, ack_failures, rts_failures, rts_ok, r111); ++ else ++ log(L_BUFT, "tx: cleaned %u: !ACK=%u !RTS=%u RTS=%u rate=%u\n", ++ finger, ack_failures, rts_failures, rts_ok, r100); ++ ++ /* update pointer for descr to be cleaned next */ ++ finger = (finger + 1) % TX_CNT; ++ } ++ ++ /* remember last position */ ++ adev->tx_tail = finger; ++/* end: */ ++ FN_EXIT1(num_cleaned); ++ return num_cleaned; ++} ++ ++/* clean *all* Tx descriptors, and regardless of their previous state. ++ * Used for brute-force reset handling. */ ++void ++acxmem_l_clean_txdesc_emergency(acx_device_t *adev) ++{ ++ txdesc_t *txdesc; ++ int i; ++ u32 acxmem; ++ ++ FN_ENTER; ++ ++ for (i = 0; i < TX_CNT; i++) { ++ txdesc = get_txdesc(adev, i); ++ ++ /* free it */ ++ write_slavemem8 (adev, (u32) &(txdesc->ack_failures), 0); ++ write_slavemem8 (adev, (u32) &(txdesc->u.rts.rts_failures), 0); ++ write_slavemem8 (adev, (u32) &(txdesc->u.rts.rts_ok), 0); ++ write_slavemem8 (adev, (u32) &(txdesc->error), 0); ++ write_slavemem8 (adev, (u32) &(txdesc->Ctl_8), DESC_CTL_HOSTOWN); ++ ++ /* ++ * Clean up the memory allocated on the ACX for this transmit descriptor. ++ */ ++ acxmem = read_slavemem32 (adev, (u32) &(txdesc->AcxMemPtr)); ++ if (acxmem) { ++ reclaim_acx_txbuf_space (adev, acxmem); ++ } ++ ++ write_slavemem32 (adev, (u32) &(txdesc->AcxMemPtr), 0); ++ } ++ ++ adev->tx_free = TX_CNT; ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxmem_s_create_tx_host_desc_queue ++*/ ++ ++static void* ++allocate(acx_device_t *adev, size_t size, dma_addr_t *phy, const char *msg) ++{ ++ void *ptr; ++ ptr = kmalloc (size, GFP_KERNEL); ++ /* ++ * The ACX can't use the physical address, so we'll have to fake it ++ * later and it might be handy to have the virtual address. ++ */ ++ *phy = (dma_addr_t) NULL; ++ ++ if (ptr) { ++ log(L_DEBUG, "%s sz=%d adr=0x%p phy=0x%08llx\n", ++ msg, (int)size, ptr, (unsigned long long)*phy); ++ memset(ptr, 0, size); ++ return ptr; ++ } ++ printk(KERN_ERR "acx: %s allocation FAILED (%d bytes)\n", ++ msg, (int)size); ++ return NULL; ++} ++ ++ ++/* ++ * In the generic slave memory access mode, most of the stuff in ++ * the txhostdesc_t is unused. It's only here because the rest of ++ * the ACX driver expects it to be since the PCI version uses indirect ++ * host memory organization with DMA. Since we're not using DMA the ++ * only use we have for the host descriptors is to store the packets ++ * on the way out. ++ */ ++static int ++acxmem_s_create_tx_host_desc_queue(acx_device_t *adev) ++{ ++ txhostdesc_t *hostdesc; ++ u8 *txbuf; ++ int i; ++ ++ FN_ENTER; ++ ++ /* allocate TX buffer */ ++ adev->txbuf_area_size = TX_CNT * WLAN_A4FR_MAXLEN_WEP_FCS; ++ ++ adev->txbuf_start = allocate(adev, adev->txbuf_area_size, ++ &adev->txbuf_startphy, "txbuf_start"); ++ if (!adev->txbuf_start) ++ goto fail; ++ ++ /* allocate the TX host descriptor queue pool */ ++ adev->txhostdesc_area_size = TX_CNT * 2*sizeof(*hostdesc); ++ ++ adev->txhostdesc_start = allocate(adev, adev->txhostdesc_area_size, ++ &adev->txhostdesc_startphy, "txhostdesc_start"); ++ if (!adev->txhostdesc_start) ++ goto fail; ++ ++ /* check for proper alignment of TX host descriptor pool */ ++ if ((long) adev->txhostdesc_start & 3) { ++ printk("acx: driver bug: dma alloc returns unaligned address\n"); ++ goto fail; ++ } ++ ++ hostdesc = adev->txhostdesc_start; ++ txbuf = adev->txbuf_start; ++ ++#if 0 ++/* Each tx buffer is accessed by hardware via ++** txdesc -> txhostdesc(s) -> txbuffer(s). ++** We use only one txhostdesc per txdesc, but it looks like ++** acx111 is buggy: it accesses second txhostdesc ++** (via hostdesc.desc_phy_next field) even if ++** txdesc->length == hostdesc->length and thus ++** entire packet was placed into first txhostdesc. ++** Due to this bug acx111 hangs unless second txhostdesc ++** has le16_to_cpu(hostdesc.length) = 3 (or larger) ++** Storing NULL into hostdesc.desc_phy_next ++** doesn't seem to help. ++** ++** Update: although it worked on Xterasys XN-2522g ++** with len=3 trick, WG311v2 is even more bogus, doesn't work. ++** Keeping this code (#ifdef'ed out) for documentational purposes. ++*/ ++ for (i = 0; i < TX_CNT*2; i++) { ++ hostdesc_phy += sizeof(*hostdesc); ++ if (!(i & 1)) { ++ hostdesc->data_phy = cpu2acx(txbuf_phy); ++ /* hostdesc->data_offset = ... */ ++ /* hostdesc->reserved = ... */ ++ hostdesc->Ctl_16 = cpu_to_le16(DESC_CTL_HOSTOWN); ++ /* hostdesc->length = ... */ ++ hostdesc->desc_phy_next = cpu2acx(hostdesc_phy); ++ hostdesc->pNext = ptr2acx(NULL); ++ /* hostdesc->Status = ... */ ++ /* below: non-hardware fields */ ++ hostdesc->data = txbuf; ++ ++ txbuf += WLAN_A4FR_MAXLEN_WEP_FCS; ++ txbuf_phy += WLAN_A4FR_MAXLEN_WEP_FCS; ++ } else { ++ /* hostdesc->data_phy = ... */ ++ /* hostdesc->data_offset = ... */ ++ /* hostdesc->reserved = ... */ ++ /* hostdesc->Ctl_16 = ... */ ++ hostdesc->length = cpu_to_le16(3); /* bug workaround */ ++ /* hostdesc->desc_phy_next = ... */ ++ /* hostdesc->pNext = ... */ ++ /* hostdesc->Status = ... */ ++ /* below: non-hardware fields */ ++ /* hostdesc->data = ... */ ++ } ++ hostdesc++; ++ } ++#endif ++/* We initialize two hostdescs so that they point to adjacent ++** memory areas. Thus txbuf is really just a contiguous memory area */ ++ for (i = 0; i < TX_CNT*2; i++) { ++ /* ->data is a non-hardware field: */ ++ hostdesc->data = txbuf; ++ ++ if (!(i & 1)) { ++ txbuf += WLAN_HDR_A3_LEN; ++ } else { ++ txbuf += WLAN_A4FR_MAXLEN_WEP_FCS - WLAN_HDR_A3_LEN; ++ } ++ hostdesc++; ++ } ++ hostdesc--; ++ ++ FN_EXIT1(OK); ++ return OK; ++fail: ++ printk("acx: create_tx_host_desc_queue FAILED\n"); ++ /* dealloc will be done by free function on error case */ ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*************************************************************** ++** acxmem_s_create_rx_host_desc_queue ++*/ ++/* the whole size of a data buffer (header plus data body) ++ * plus 32 bytes safety offset at the end */ ++#define RX_BUFFER_SIZE (sizeof(rxbuffer_t) + 32) ++ ++static int ++acxmem_s_create_rx_host_desc_queue(acx_device_t *adev) ++{ ++ rxhostdesc_t *hostdesc; ++ rxbuffer_t *rxbuf; ++ int i; ++ ++ FN_ENTER; ++ ++ /* allocate the RX host descriptor queue pool */ ++ adev->rxhostdesc_area_size = RX_CNT * sizeof(*hostdesc); ++ ++ adev->rxhostdesc_start = allocate(adev, adev->rxhostdesc_area_size, ++ &adev->rxhostdesc_startphy, "rxhostdesc_start"); ++ if (!adev->rxhostdesc_start) ++ goto fail; ++ ++ /* check for proper alignment of RX host descriptor pool */ ++ if ((long) adev->rxhostdesc_start & 3) { ++ printk("acx: driver bug: dma alloc returns unaligned address\n"); ++ goto fail; ++ } ++ ++ /* allocate Rx buffer pool which will be used by the acx ++ * to store the whole content of the received frames in it */ ++ adev->rxbuf_area_size = RX_CNT * RX_BUFFER_SIZE; ++ ++ adev->rxbuf_start = allocate(adev, adev->rxbuf_area_size, ++ &adev->rxbuf_startphy, "rxbuf_start"); ++ if (!adev->rxbuf_start) ++ goto fail; ++ ++ rxbuf = adev->rxbuf_start; ++ hostdesc = adev->rxhostdesc_start; ++ ++ /* don't make any popular C programming pointer arithmetic mistakes ++ * here, otherwise I'll kill you... ++ * (and don't dare asking me why I'm warning you about that...) */ ++ for (i = 0; i < RX_CNT; i++) { ++ hostdesc->data = rxbuf; ++ hostdesc->length = cpu_to_le16(RX_BUFFER_SIZE); ++ rxbuf++; ++ hostdesc++; ++ } ++ hostdesc--; ++ FN_EXIT1(OK); ++ return OK; ++fail: ++ printk("acx: create_rx_host_desc_queue FAILED\n"); ++ /* dealloc will be done by free function on error case */ ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*************************************************************** ++** acxmem_s_create_hostdesc_queues ++*/ ++int ++acxmem_s_create_hostdesc_queues(acx_device_t *adev) ++{ ++ int result; ++ result = acxmem_s_create_tx_host_desc_queue(adev); ++ if (OK != result) return result; ++ result = acxmem_s_create_rx_host_desc_queue(adev); ++ return result; ++} ++ ++ ++/*************************************************************** ++** acxmem_create_tx_desc_queue ++*/ ++static void ++acxmem_create_tx_desc_queue(acx_device_t *adev, u32 tx_queue_start) ++{ ++ txdesc_t *txdesc; ++ u32 clr; ++ int i; ++ ++ FN_ENTER; ++ ++ if (IS_ACX100(adev)) ++ adev->txdesc_size = sizeof(*txdesc); ++ else ++ /* the acx111 txdesc is 4 bytes larger */ ++ adev->txdesc_size = sizeof(*txdesc) + 4; ++ ++ /* ++ * This refers to an ACX address, not one of ours ++ */ ++ adev->txdesc_start = (txdesc_t *) tx_queue_start; ++ ++ log(L_DEBUG, "adev->txdesc_start=%p\n", ++ adev->txdesc_start); ++ ++ adev->tx_free = TX_CNT; ++ /* done by memset: adev->tx_head = 0; */ ++ /* done by memset: adev->tx_tail = 0; */ ++ txdesc = adev->txdesc_start; ++ ++ if (IS_ACX111(adev)) { ++ /* ACX111 has a preinitialized Tx buffer! */ ++ /* loop over whole send pool */ ++ /* FIXME: do we have to do the hostmemptr stuff here?? */ ++ for (i = 0; i < TX_CNT; i++) { ++ txdesc->Ctl_8 = DESC_CTL_HOSTOWN; ++ /* reserve two (hdr desc and payload desc) */ ++ txdesc = advance_txdesc(adev, txdesc, 1); ++ } ++ } else { ++ /* ACX100 Tx buffer needs to be initialized by us */ ++ /* clear whole send pool. sizeof is safe here (we are acx100) */ ++ ++ /* ++ * adev->txdesc_start refers to device memory, so we can't write ++ * directly to it. ++ */ ++ clr = (u32) adev->txdesc_start; ++ while (clr < (u32) adev->txdesc_start + (TX_CNT * sizeof(*txdesc))) { ++ write_slavemem32 (adev, clr, 0); ++ clr += 4; ++ } ++ ++ /* loop over whole send pool */ ++ for (i = 0; i < TX_CNT; i++) { ++ log(L_DEBUG, "configure card tx descriptor: 0x%p, " ++ "size: 0x%X\n", txdesc, adev->txdesc_size); ++ ++ /* initialise ctl */ ++ /* ++ * No auto DMA here ++ */ ++ write_slavemem8 (adev, (u32) &(txdesc->Ctl_8), ++ (u8) (DESC_CTL_HOSTOWN | DESC_CTL_FIRSTFRAG)); ++ /* done by memset(0): txdesc->Ctl2_8 = 0; */ ++ ++ /* point to next txdesc */ ++ write_slavemem32 (adev, (u32) &(txdesc->pNextDesc), ++ (u32) cpu_to_le32 ((u8 *) txdesc + adev->txdesc_size)); ++ ++ /* go to the next one */ ++ /* ++ is safe here (we are acx100) */ ++ txdesc++; ++ } ++ /* go back to the last one */ ++ txdesc--; ++ /* and point to the first making it a ring buffer */ ++ write_slavemem32 (adev, (u32) &(txdesc->pNextDesc), ++ (u32) cpu_to_le32 (tx_queue_start)); ++ } ++ FN_EXIT0; ++} ++ ++ ++/*************************************************************** ++** acxmem_create_rx_desc_queue ++*/ ++static void ++acxmem_create_rx_desc_queue(acx_device_t *adev, u32 rx_queue_start) ++{ ++ rxdesc_t *rxdesc; ++ u32 mem_offs; ++ int i; ++ ++ FN_ENTER; ++ ++ /* done by memset: adev->rx_tail = 0; */ ++ ++ /* ACX111 doesn't need any further config: preconfigures itself. ++ * Simply print ring buffer for debugging */ ++ if (IS_ACX111(adev)) { ++ /* rxdesc_start already set here */ ++ ++ adev->rxdesc_start = (rxdesc_t *) rx_queue_start; ++ ++ rxdesc = adev->rxdesc_start; ++ for (i = 0; i < RX_CNT; i++) { ++ log(L_DEBUG, "rx descriptor %d @ 0x%p\n", i, rxdesc); ++ rxdesc = adev->rxdesc_start = (rxdesc_t *) ++ acx2cpu(rxdesc->pNextDesc); ++ } ++ } else { ++ /* we didn't pre-calculate rxdesc_start in case of ACX100 */ ++ /* rxdesc_start should be right AFTER Tx pool */ ++ adev->rxdesc_start = (rxdesc_t *) ++ ((u8 *) adev->txdesc_start + (TX_CNT * sizeof(txdesc_t))); ++ /* NB: sizeof(txdesc_t) above is valid because we know ++ ** we are in if (acx100) block. Beware of cut-n-pasting elsewhere! ++ ** acx111's txdesc is larger! */ ++ ++ mem_offs = (u32) adev->rxdesc_start; ++ while (mem_offs < (u32) adev->rxdesc_start + (RX_CNT * sizeof (*rxdesc))) { ++ write_slavemem32 (adev, mem_offs, 0); ++ mem_offs += 4; ++ } ++ ++ /* loop over whole receive pool */ ++ rxdesc = adev->rxdesc_start; ++ for (i = 0; i < RX_CNT; i++) { ++ log(L_DEBUG, "rx descriptor @ 0x%p\n", rxdesc); ++ /* point to next rxdesc */ ++ write_slavemem32 (adev, (u32) &(rxdesc->pNextDesc), ++ (u32) cpu_to_le32 ((u8 *) rxdesc + sizeof(*rxdesc))); ++ /* go to the next one */ ++ rxdesc++; ++ } ++ /* go to the last one */ ++ rxdesc--; ++ ++ /* and point to the first making it a ring buffer */ ++ write_slavemem32 (adev, (u32) &(rxdesc->pNextDesc), ++ (u32) cpu_to_le32 (rx_queue_start)); ++ } ++ FN_EXIT0; ++} ++ ++ ++/*************************************************************** ++** acxmem_create_desc_queues ++*/ ++void ++acxmem_create_desc_queues(acx_device_t *adev, u32 tx_queue_start, u32 rx_queue_start) ++{ ++ u32 *p; ++ int i; ++ ++ acxmem_create_tx_desc_queue(adev, tx_queue_start); ++ acxmem_create_rx_desc_queue(adev, rx_queue_start); ++ p = (u32 *) adev->acx_queue_indicator; ++ for (i = 0; i < 4; i++) { ++ write_slavemem32 (adev, (u32) p, 0); ++ p++; ++ } ++} ++ ++ ++/*************************************************************** ++** acxmem_s_proc_diag_output ++*/ ++char* ++acxmem_s_proc_diag_output(char *p, acx_device_t *adev) ++{ ++ const char *rtl, *thd, *ttl; ++ txdesc_t *txdesc; ++ u8 Ctl_8; ++ rxdesc_t *rxdesc; ++ int i; ++ u32 tmp; ++ txdesc_t txd; ++ u8 buf[0x200]; ++ int j, k; ++ ++ FN_ENTER; ++ ++#if DUMP_MEM_DURING_DIAG > 0 ++ dump_acxmem (adev, 0, 0x10000); ++ panic ("dump finished"); ++#endif ++ ++ p += sprintf(p, "** Rx buf **\n"); ++ rxdesc = adev->rxdesc_start; ++ if (rxdesc) for (i = 0; i < RX_CNT; i++) { ++ rtl = (i == adev->rx_tail) ? " [tail]" : ""; ++ Ctl_8 = read_slavemem8 (adev, (u32) &(rxdesc->Ctl_8)); ++ if (Ctl_8 & DESC_CTL_HOSTOWN) ++ p += sprintf(p, "%02u (%02x) FULL%s\n", i, Ctl_8, rtl); ++ else ++ p += sprintf(p, "%02u (%02x) empty%s\n", i, Ctl_8, rtl); ++ rxdesc++; ++ } ++ p += sprintf(p, "** Tx buf (free %d, Linux netqueue %s) **\n", adev->tx_free, ++ acx_queue_stopped(adev->ndev) ? "STOPPED" : "running"); ++ ++ p += sprintf(p, "** Tx buf %d blocks total, %d available, free list head %04x\n", ++ adev->acx_txbuf_numblocks, adev->acx_txbuf_blocks_free, adev->acx_txbuf_free); ++ txdesc = adev->txdesc_start; ++ if (txdesc) { ++ for (i = 0; i < TX_CNT; i++) { ++ thd = (i == adev->tx_head) ? " [head]" : ""; ++ ttl = (i == adev->tx_tail) ? " [tail]" : ""; ++ copy_from_slavemem (adev, (u8 *) &txd, (u32) txdesc, sizeof (txd)); ++ Ctl_8 = read_slavemem8 (adev, (u32) &(txdesc->Ctl_8)); ++ if (Ctl_8 & DESC_CTL_ACXDONE) ++ p += sprintf(p, "%02u ready to free (%02X)%s%s", i, Ctl_8, thd, ttl); ++ else if (Ctl_8 & DESC_CTL_HOSTOWN) ++ p += sprintf(p, "%02u available (%02X)%s%s", i, Ctl_8, thd, ttl); ++ else ++ p += sprintf(p, "%02u busy (%02X)%s%s", i, Ctl_8, thd, ttl); ++ tmp = read_slavemem32 (adev, (u32) &(txdesc->AcxMemPtr)); ++ if (tmp) { ++ p += sprintf (p, " %04x", tmp); ++ while ((tmp = read_slavemem32 (adev, (u32) tmp)) != 0x02000000) { ++ tmp <<= 5; ++ p += sprintf (p, " %04x", tmp); ++ } ++ } ++ p += sprintf (p, "\n"); ++ p += sprintf (p, " %04x: %04x %04x %04x %04x %04x %04x %04x %04x %04x %04x %02x %02x %02x %02x\n" ++ "%02x %02x %02x %02x %04x\n", ++ (u32) txdesc, ++ txd.pNextDesc.v, txd.HostMemPtr.v, txd.AcxMemPtr.v, txd.tx_time, ++ txd.total_length, txd.Reserved, ++ txd.dummy[0], txd.dummy[1], txd.dummy[2], txd.dummy[3], ++ txd.Ctl_8, txd.Ctl2_8, txd.error, txd.ack_failures, ++ txd.u.rts.rts_failures, txd.u.rts.rts_ok, txd.u.r1.rate, txd.u.r1.queue_ctrl, ++ txd.queue_info ++ ); ++ if (txd.AcxMemPtr.v) { ++ copy_from_slavemem (adev, buf, txd.AcxMemPtr.v, sizeof (buf)); ++ for (j = 0; (j < txd.total_length) && (j<(sizeof(buf)-4)); j+=16) { ++ p += sprintf (p, " "); ++ for (k = 0; (k < 16) && (j+k < txd.total_length); k++) { ++ p += sprintf (p, " %02x", buf[j+k+4]); ++ } ++ p += sprintf (p, "\n"); ++ } ++ } ++ txdesc = advance_txdesc(adev, txdesc, 1); ++ } ++ } ++ ++ p += sprintf(p, ++ "\n" ++ "** Generic slave data **\n" ++ "irq_mask 0x%04x irq_status 0x%04x irq on acx 0x%04x\n" ++ "txbuf_start 0x%p, txbuf_area_size %u\n" ++ "txdesc_size %u, txdesc_start 0x%p\n" ++ "txhostdesc_start 0x%p, txhostdesc_area_size %u\n" ++ "txbuf start 0x%04x, txbuf size %d\n" ++ "rxdesc_start 0x%p\n" ++ "rxhostdesc_start 0x%p, rxhostdesc_area_size %u\n" ++ "rxbuf_start 0x%p, rxbuf_area_size %u\n", ++ adev->irq_mask, adev->irq_status, read_reg32(adev, IO_ACX_IRQ_STATUS_NON_DES), ++ adev->txbuf_start, adev->txbuf_area_size, ++ adev->txdesc_size, adev->txdesc_start, ++ adev->txhostdesc_start, adev->txhostdesc_area_size, ++ adev->acx_txbuf_start, adev->acx_txbuf_numblocks * adev->memblocksize, ++ adev->rxdesc_start, ++ adev->rxhostdesc_start, adev->rxhostdesc_area_size, ++ adev->rxbuf_start, adev->rxbuf_area_size); ++ FN_EXIT0; ++ return p; ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acxmem_proc_eeprom_output(char *buf, acx_device_t *adev) ++{ ++ char *p = buf; ++ int i; ++ ++ FN_ENTER; ++ ++ for (i = 0; i < 0x400; i++) { ++ acxmem_read_eeprom_byte(adev, i, p++); ++ } ++ ++ FN_EXIT1(p - buf); ++ return p - buf; ++} ++ ++ ++/*********************************************************************** ++*/ ++void ++acxmem_set_interrupt_mask(acx_device_t *adev) ++{ ++ if (IS_ACX111(adev)) { ++ adev->irq_mask = (u16) ~(0 ++ | HOST_INT_RX_DATA ++ | HOST_INT_TX_COMPLETE ++ /* | HOST_INT_TX_XFER */ ++ /* | HOST_INT_RX_COMPLETE */ ++ /* | HOST_INT_DTIM */ ++ /* | HOST_INT_BEACON */ ++ /* | HOST_INT_TIMER */ ++ /* | HOST_INT_KEY_NOT_FOUND */ ++ | HOST_INT_IV_ICV_FAILURE ++ | HOST_INT_CMD_COMPLETE ++ | HOST_INT_INFO ++ | HOST_INT_OVERFLOW ++ /* | HOST_INT_PROCESS_ERROR */ ++ | HOST_INT_SCAN_COMPLETE ++ | HOST_INT_FCS_THRESHOLD ++ | HOST_INT_UNKNOWN ++ ); ++ /* Or else acx100 won't signal cmd completion, right? */ ++ adev->irq_mask_off = (u16)~( HOST_INT_CMD_COMPLETE ); /* 0xfdff */ ++ } else { ++ adev->irq_mask = (u16) ~(0 ++ | HOST_INT_RX_DATA ++ | HOST_INT_TX_COMPLETE ++ /* | HOST_INT_TX_XFER */ ++ /* | HOST_INT_RX_COMPLETE */ ++ /* | HOST_INT_DTIM */ ++ /* | HOST_INT_BEACON */ ++ /* | HOST_INT_TIMER */ ++ /* | HOST_INT_KEY_NOT_FOUND */ ++ /* | HOST_INT_IV_ICV_FAILURE */ ++ | HOST_INT_CMD_COMPLETE ++ | HOST_INT_INFO ++ /* | HOST_INT_OVERFLOW */ ++ /* | HOST_INT_PROCESS_ERROR */ ++ | HOST_INT_SCAN_COMPLETE ++ /* | HOST_INT_FCS_THRESHOLD */ ++ /* | HOST_INT_BEACON_MISSED */ ++ ); ++ adev->irq_mask_off = (u16)~( HOST_INT_UNKNOWN ); /* 0x7fff */ ++ } ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acx100mem_s_set_tx_level(acx_device_t *adev, u8 level_dbm) ++{ ++ struct acx111_ie_tx_level tx_level; ++ ++ /* since it can be assumed that at least the Maxim radio has a ++ * maximum power output of 20dBm and since it also can be ++ * assumed that these values drive the DAC responsible for ++ * setting the linear Tx level, I'd guess that these values ++ * should be the corresponding linear values for a dBm value, ++ * in other words: calculate the values from that formula: ++ * Y [dBm] = 10 * log (X [mW]) ++ * then scale the 0..63 value range onto the 1..100mW range (0..20 dBm) ++ * and you're done... ++ * Hopefully that's ok, but you never know if we're actually ++ * right... (especially since Windows XP doesn't seem to show ++ * actual Tx dBm values :-P) */ ++ ++ /* NOTE: on Maxim, value 30 IS 30mW, and value 10 IS 10mW - so the ++ * values are EXACTLY mW!!! Not sure about RFMD and others, ++ * though... */ ++ static const u8 dbm2val_maxim[21] = { ++ 63, 63, 63, 62, ++ 61, 61, 60, 60, ++ 59, 58, 57, 55, ++ 53, 50, 47, 43, ++ 38, 31, 23, 13, ++ 0 ++ }; ++ static const u8 dbm2val_rfmd[21] = { ++ 0, 0, 0, 1, ++ 2, 2, 3, 3, ++ 4, 5, 6, 8, ++ 10, 13, 16, 20, ++ 25, 32, 41, 50, ++ 63 ++ }; ++ const u8 *table; ++ ++ switch (adev->radio_type) { ++ case RADIO_MAXIM_0D: ++ table = &dbm2val_maxim[0]; ++ break; ++ case RADIO_RFMD_11: ++ case RADIO_RALINK_15: ++ table = &dbm2val_rfmd[0]; ++ break; ++ default: ++ printk("%s: unknown/unsupported radio type, " ++ "cannot modify tx power level yet!\n", ++ adev->ndev->name); ++ return NOT_OK; ++ } ++ /* ++ * The hx4700 EEPROM, at least, only supports 1 power setting. The configure ++ * routine matches the PA bias with the gain, so just use its default value. ++ * The values are: 0x2b for the gain and 0x03 for the PA bias. The firmware ++ * writes the gain level to the Tx gain control DAC and the PA bias to the Maxim ++ * radio's PA bias register. The firmware limits itself to 0 - 64 when writing to the ++ * gain control DAC. ++ * ++ * Physically between the ACX and the radio, higher Tx gain control DAC values result ++ * in less power output; 0 volts to the Maxim radio results in the highest output power ++ * level, which I'm assuming matches up with 0 in the Tx Gain DAC register. ++ * ++ * Although there is only the 1 power setting, one of the radio firmware functions adjusts ++ * the transmit power level up and down. That function is called by the ACX FIQ handler ++ * under certain conditions. ++ */ ++ tx_level.level = 1; ++ //return acx_s_configure(adev, &tx_level, ACX1xx_IE_DOT11_TX_POWER_LEVEL); ++ ++ printk("%s: changing radio power level to %u dBm (%u)\n", ++ adev->ndev->name, level_dbm, table[level_dbm]); ++ acxmem_s_write_phy_reg(adev, 0x11, table[level_dbm]); ++ ++ return 0; ++} ++ ++ ++static struct platform_driver ++acxmem_drv_id = { ++ .driver = { ++ .name = "acx-mem", ++ }, ++ .probe = acxmem_e_probe, ++ .remove = __devexit_p(acxmem_e_remove), ++#ifdef CONFIG_PM ++ .suspend = acxmem_e_suspend, ++ .resume = acxmem_e_resume ++#endif /* CONFIG_PM */ ++}; ++ ++ ++/*********************************************************************** ++** acxmem_e_init_module ++** ++** Module initialization routine, called once at module load time ++*/ ++int __init ++acxmem_e_init_module(void) ++{ ++ int res; ++ ++ FN_ENTER; ++ ++#if (ACX_IO_WIDTH==32) ++ printk("acx: compiled to use 32bit I/O access. " ++ "I/O timing issues might occur, such as " ++ "non-working firmware upload. Report them\n"); ++#else ++ printk("acx: compiled to use 16bit I/O access only " ++ "(compatibility mode)\n"); ++#endif ++ ++#ifdef __LITTLE_ENDIAN ++#define ENDIANNESS_STRING "running on a little-endian CPU\n" ++#else ++#define ENDIANNESS_STRING "running on a BIG-ENDIAN CPU\n" ++#endif ++ log(L_INIT, ++ ENDIANNESS_STRING ++ "PCI module " ACX_RELEASE " initialized, " ++ "waiting for cards to probe...\n" ++ ); ++ ++ res = platform_driver_register (&acxmem_drv_id); ++ FN_EXIT1(res); ++ return res; ++} ++ ++ ++/*********************************************************************** ++** acxmem_e_cleanup_module ++** ++** Called at module unload time. This is our last chance to ++** clean up after ourselves. ++*/ ++void __exit ++acxmem_e_cleanup_module(void) ++{ ++ FN_ENTER; ++ ++ printk ("cleanup_module\n"); ++ platform_driver_unregister( &acxmem_drv_id ); ++ ++ FN_EXIT0; ++} ++ ++void acxmem_e_release(struct device *dev) { ++} ++ ++MODULE_AUTHOR( "Todd Blumer <todd@sdgsystems.com>" ); ++MODULE_DESCRIPTION( "ACX Slave Memory Driver" ); ++MODULE_LICENSE( "GPL" ); ++ +Index: linux-2.6.22/drivers/net/wireless/acx/pci.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/pci.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,4234 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++*/ ++#define ACX_PCI 1 ++ ++#include <linux/version.h> ++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) ++#include <linux/config.h> ++#endif ++ ++/* Linux 2.6.18+ uses <linux/utsrelease.h> */ ++#ifndef UTS_RELEASE ++#include <linux/utsrelease.h> ++#endif ++ ++#include <linux/compiler.h> /* required for Lx 2.6.8 ?? */ ++#include <linux/kernel.h> ++#include <linux/module.h> ++#include <linux/moduleparam.h> ++#include <linux/sched.h> ++#include <linux/types.h> ++#include <linux/skbuff.h> ++#include <linux/slab.h> ++#include <linux/if_arp.h> ++#include <linux/rtnetlink.h> ++#include <linux/wireless.h> ++#include <net/iw_handler.h> ++#include <linux/netdevice.h> ++#include <linux/ioport.h> ++#include <linux/pci.h> ++#include <linux/pm.h> ++#include <linux/vmalloc.h> ++#include <linux/dma-mapping.h> ++ ++#include "acx.h" ++ ++ ++/*********************************************************************** ++*/ ++#define PCI_TYPE (PCI_USES_MEM | PCI_ADDR0 | PCI_NO_ACPI_WAKE) ++#define PCI_ACX100_REGION1 0x01 ++#define PCI_ACX100_REGION1_SIZE 0x1000 /* Memory size - 4K bytes */ ++#define PCI_ACX100_REGION2 0x02 ++#define PCI_ACX100_REGION2_SIZE 0x10000 /* Memory size - 64K bytes */ ++ ++#define PCI_ACX111_REGION1 0x00 ++#define PCI_ACX111_REGION1_SIZE 0x2000 /* Memory size - 8K bytes */ ++#define PCI_ACX111_REGION2 0x01 ++#define PCI_ACX111_REGION2_SIZE 0x20000 /* Memory size - 128K bytes */ ++ ++/* Texas Instruments Vendor ID */ ++#define PCI_VENDOR_ID_TI 0x104c ++ ++/* ACX100 22Mb/s WLAN controller */ ++#define PCI_DEVICE_ID_TI_TNETW1100A 0x8400 ++#define PCI_DEVICE_ID_TI_TNETW1100B 0x8401 ++ ++/* ACX111 54Mb/s WLAN controller */ ++#define PCI_DEVICE_ID_TI_TNETW1130 0x9066 ++ ++/* PCI Class & Sub-Class code, Network-'Other controller' */ ++#define PCI_CLASS_NETWORK_OTHERS 0x0280 ++ ++#define CARD_EEPROM_ID_SIZE 6 ++ ++#ifndef PCI_D0 ++/* From include/linux/pci.h */ ++#define PCI_D0 0 ++#define PCI_D1 1 ++#define PCI_D2 2 ++#define PCI_D3hot 3 ++#define PCI_D3cold 4 ++#define PCI_UNKNOWN 5 ++#define PCI_POWER_ERROR -1 ++#endif ++ ++ ++/*********************************************************************** ++*/ ++static void acxpci_i_tx_timeout(struct net_device *ndev); ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19) ++static irqreturn_t acxpci_i_interrupt(int irq, void *dev_id); ++#else ++static irqreturn_t acxpci_i_interrupt(int irq, void *dev_id, struct pt_regs *regs); ++#endif ++static void acxpci_i_set_multicast_list(struct net_device *ndev); ++ ++static int acxpci_e_open(struct net_device *ndev); ++static int acxpci_e_close(struct net_device *ndev); ++static void acxpci_s_up(struct net_device *ndev); ++static void acxpci_s_down(struct net_device *ndev); ++ ++ ++/*********************************************************************** ++** Register access ++*/ ++ ++/* Pick one */ ++/* #define INLINE_IO static */ ++#define INLINE_IO static inline ++ ++INLINE_IO u32 ++read_reg32(acx_device_t *adev, unsigned int offset) ++{ ++#if ACX_IO_WIDTH == 32 ++ return readl((u8 *)adev->iobase + adev->io[offset]); ++#else ++ return readw((u8 *)adev->iobase + adev->io[offset]) ++ + (readw((u8 *)adev->iobase + adev->io[offset] + 2) << 16); ++#endif ++} ++ ++INLINE_IO u16 ++read_reg16(acx_device_t *adev, unsigned int offset) ++{ ++ return readw((u8 *)adev->iobase + adev->io[offset]); ++} ++ ++INLINE_IO u8 ++read_reg8(acx_device_t *adev, unsigned int offset) ++{ ++ return readb((u8 *)adev->iobase + adev->io[offset]); ++} ++ ++INLINE_IO void ++write_reg32(acx_device_t *adev, unsigned int offset, u32 val) ++{ ++#if ACX_IO_WIDTH == 32 ++ writel(val, (u8 *)adev->iobase + adev->io[offset]); ++#else ++ writew(val & 0xffff, (u8 *)adev->iobase + adev->io[offset]); ++ writew(val >> 16, (u8 *)adev->iobase + adev->io[offset] + 2); ++#endif ++} ++ ++INLINE_IO void ++write_reg16(acx_device_t *adev, unsigned int offset, u16 val) ++{ ++ writew(val, (u8 *)adev->iobase + adev->io[offset]); ++} ++ ++INLINE_IO void ++write_reg8(acx_device_t *adev, unsigned int offset, u8 val) ++{ ++ writeb(val, (u8 *)adev->iobase + adev->io[offset]); ++} ++ ++/* Handle PCI posting properly: ++ * Make sure that writes reach the adapter in case they require to be executed ++ * *before* the next write, by reading a random (and safely accessible) register. ++ * This call has to be made if there is no read following (which would flush the data ++ * to the adapter), yet the written data has to reach the adapter immediately. */ ++INLINE_IO void ++write_flush(acx_device_t *adev) ++{ ++ /* readb(adev->iobase + adev->io[IO_ACX_INFO_MAILBOX_OFFS]); */ ++ /* faster version (accesses the first register, IO_ACX_SOFT_RESET, ++ * which should also be safe): */ ++ readb(adev->iobase); ++} ++ ++INLINE_IO int ++adev_present(acx_device_t *adev) ++{ ++ /* fast version (accesses the first register, IO_ACX_SOFT_RESET, ++ * which should be safe): */ ++ return readl(adev->iobase) != 0xffffffff; ++} ++ ++ ++/*********************************************************************** ++*/ ++static inline txdesc_t* ++get_txdesc(acx_device_t *adev, int index) ++{ ++ return (txdesc_t*) (((u8*)adev->txdesc_start) + index * adev->txdesc_size); ++} ++ ++static inline txdesc_t* ++advance_txdesc(acx_device_t *adev, txdesc_t* txdesc, int inc) ++{ ++ return (txdesc_t*) (((u8*)txdesc) + inc * adev->txdesc_size); ++} ++ ++static txhostdesc_t* ++get_txhostdesc(acx_device_t *adev, txdesc_t* txdesc) ++{ ++ int index = (u8*)txdesc - (u8*)adev->txdesc_start; ++ if (unlikely(ACX_DEBUG && (index % adev->txdesc_size))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return NULL; ++ } ++ index /= adev->txdesc_size; ++ if (unlikely(ACX_DEBUG && (index >= TX_CNT))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return NULL; ++ } ++ return &adev->txhostdesc_start[index*2]; ++} ++ ++static inline client_t* ++get_txc(acx_device_t *adev, txdesc_t* txdesc) ++{ ++ int index = (u8*)txdesc - (u8*)adev->txdesc_start; ++ if (unlikely(ACX_DEBUG && (index % adev->txdesc_size))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return NULL; ++ } ++ index /= adev->txdesc_size; ++ if (unlikely(ACX_DEBUG && (index >= TX_CNT))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return NULL; ++ } ++ return adev->txc[index]; ++} ++ ++static inline u16 ++get_txr(acx_device_t *adev, txdesc_t* txdesc) ++{ ++ int index = (u8*)txdesc - (u8*)adev->txdesc_start; ++ index /= adev->txdesc_size; ++ return adev->txr[index]; ++} ++ ++static inline void ++put_txcr(acx_device_t *adev, txdesc_t* txdesc, client_t* c, u16 r111) ++{ ++ int index = (u8*)txdesc - (u8*)adev->txdesc_start; ++ if (unlikely(ACX_DEBUG && (index % adev->txdesc_size))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return; ++ } ++ index /= adev->txdesc_size; ++ if (unlikely(ACX_DEBUG && (index >= TX_CNT))) { ++ printk("bad txdesc ptr %p\n", txdesc); ++ return; ++ } ++ adev->txc[index] = c; ++ adev->txr[index] = r111; ++} ++ ++ ++/*********************************************************************** ++** EEPROM and PHY read/write helpers ++*/ ++/*********************************************************************** ++** acxpci_read_eeprom_byte ++** ++** Function called to read an octet in the EEPROM. ++** ++** This function is used by acxpci_e_probe to check if the ++** connected card is a legal one or not. ++** ++** Arguments: ++** adev ptr to acx_device structure ++** addr address to read in the EEPROM ++** charbuf ptr to a char. This is where the read octet ++** will be stored ++*/ ++int ++acxpci_read_eeprom_byte(acx_device_t *adev, u32 addr, u8 *charbuf) ++{ ++ int result; ++ int count; ++ ++ write_reg32(adev, IO_ACX_EEPROM_CFG, 0); ++ write_reg32(adev, IO_ACX_EEPROM_ADDR, addr); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_EEPROM_CTL, 2); ++ ++ count = 0xffff; ++ while (read_reg16(adev, IO_ACX_EEPROM_CTL)) { ++ /* scheduling away instead of CPU burning loop ++ * doesn't seem to work here at all: ++ * awful delay, sometimes also failure. ++ * Doesn't matter anyway (only small delay). */ ++ if (unlikely(!--count)) { ++ printk("%s: timeout waiting for EEPROM read\n", ++ adev->ndev->name); ++ result = NOT_OK; ++ goto fail; ++ } ++ cpu_relax(); ++ } ++ ++ *charbuf = read_reg8(adev, IO_ACX_EEPROM_DATA); ++ log(L_DEBUG, "EEPROM at 0x%04X = 0x%02X\n", addr, *charbuf); ++ result = OK; ++ ++fail: ++ return result; ++} ++ ++ ++/*********************************************************************** ++** We don't lock hw accesses here since we never r/w eeprom in IRQ ++** Note: this function sleeps only because of GFP_KERNEL alloc ++*/ ++#ifdef UNUSED ++int ++acxpci_s_write_eeprom(acx_device_t *adev, u32 addr, u32 len, const u8 *charbuf) ++{ ++ u8 *data_verify = NULL; ++ unsigned long flags; ++ int count, i; ++ int result = NOT_OK; ++ u16 gpio_orig; ++ ++ printk("acx: WARNING! I would write to EEPROM now. " ++ "Since I really DON'T want to unless you know " ++ "what you're doing (THIS CODE WILL PROBABLY " ++ "NOT WORK YET!), I will abort that now. And " ++ "definitely make sure to make a " ++ "/proc/driver/acx_wlan0_eeprom backup copy first!!! " ++ "(the EEPROM content includes the PCI config header!! " ++ "If you kill important stuff, then you WILL " ++ "get in trouble and people DID get in trouble already)\n"); ++ return OK; ++ ++ FN_ENTER; ++ ++ data_verify = kmalloc(len, GFP_KERNEL); ++ if (!data_verify) { ++ goto end; ++ } ++ ++ /* first we need to enable the OE (EEPROM Output Enable) GPIO line ++ * to be able to write to the EEPROM. ++ * NOTE: an EEPROM writing success has been reported, ++ * but you probably have to modify GPIO_OUT, too, ++ * and you probably need to activate a different GPIO ++ * line instead! */ ++ gpio_orig = read_reg16(adev, IO_ACX_GPIO_OE); ++ write_reg16(adev, IO_ACX_GPIO_OE, gpio_orig & ~1); ++ write_flush(adev); ++ ++ /* ok, now start writing the data out */ ++ for (i = 0; i < len; i++) { ++ write_reg32(adev, IO_ACX_EEPROM_CFG, 0); ++ write_reg32(adev, IO_ACX_EEPROM_ADDR, addr + i); ++ write_reg32(adev, IO_ACX_EEPROM_DATA, *(charbuf + i)); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_EEPROM_CTL, 1); ++ ++ count = 0xffff; ++ while (read_reg16(adev, IO_ACX_EEPROM_CTL)) { ++ if (unlikely(!--count)) { ++ printk("WARNING, DANGER!!! " ++ "Timeout waiting for EEPROM write\n"); ++ goto end; ++ } ++ cpu_relax(); ++ } ++ } ++ ++ /* disable EEPROM writing */ ++ write_reg16(adev, IO_ACX_GPIO_OE, gpio_orig); ++ write_flush(adev); ++ ++ /* now start a verification run */ ++ for (i = 0; i < len; i++) { ++ write_reg32(adev, IO_ACX_EEPROM_CFG, 0); ++ write_reg32(adev, IO_ACX_EEPROM_ADDR, addr + i); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_EEPROM_CTL, 2); ++ ++ count = 0xffff; ++ while (read_reg16(adev, IO_ACX_EEPROM_CTL)) { ++ if (unlikely(!--count)) { ++ printk("timeout waiting for EEPROM read\n"); ++ goto end; ++ } ++ cpu_relax(); ++ } ++ ++ data_verify[i] = read_reg16(adev, IO_ACX_EEPROM_DATA); ++ } ++ ++ if (0 == memcmp(charbuf, data_verify, len)) ++ result = OK; /* read data matches, success */ ++ ++end: ++ kfree(data_verify); ++ FN_EXIT1(result); ++ return result; ++} ++#endif /* UNUSED */ ++ ++ ++/*********************************************************************** ++** acxpci_s_read_phy_reg ++** ++** Messing with rx/tx disabling and enabling here ++** (write_reg32(adev, IO_ACX_ENABLE, 0b000000xx)) kills traffic ++*/ ++int ++acxpci_s_read_phy_reg(acx_device_t *adev, u32 reg, u8 *charbuf) ++{ ++ int result = NOT_OK; ++ int count; ++ ++ FN_ENTER; ++ ++ write_reg32(adev, IO_ACX_PHY_ADDR, reg); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_PHY_CTL, 2); ++ ++ count = 0xffff; ++ while (read_reg32(adev, IO_ACX_PHY_CTL)) { ++ /* scheduling away instead of CPU burning loop ++ * doesn't seem to work here at all: ++ * awful delay, sometimes also failure. ++ * Doesn't matter anyway (only small delay). */ ++ if (unlikely(!--count)) { ++ printk("%s: timeout waiting for phy read\n", ++ adev->ndev->name); ++ *charbuf = 0; ++ goto fail; ++ } ++ cpu_relax(); ++ } ++ ++ log(L_DEBUG, "count was %u\n", count); ++ *charbuf = read_reg8(adev, IO_ACX_PHY_DATA); ++ ++ log(L_DEBUG, "radio PHY at 0x%04X = 0x%02X\n", *charbuf, reg); ++ result = OK; ++ goto fail; /* silence compiler warning */ ++fail: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acxpci_s_write_phy_reg(acx_device_t *adev, u32 reg, u8 value) ++{ ++ FN_ENTER; ++ ++ /* mprusko said that 32bit accesses result in distorted sensitivity ++ * on his card. Unconfirmed, looks like it's not true (most likely since we ++ * now properly flush writes). */ ++ write_reg32(adev, IO_ACX_PHY_DATA, value); ++ write_reg32(adev, IO_ACX_PHY_ADDR, reg); ++ write_flush(adev); ++ write_reg32(adev, IO_ACX_PHY_CTL, 1); ++ write_flush(adev); ++ log(L_DEBUG, "radio PHY write 0x%02X at 0x%04X\n", value, reg); ++ ++ FN_EXIT1(OK); ++ return OK; ++} ++ ++ ++#define NO_AUTO_INCREMENT 1 ++ ++/*********************************************************************** ++** acxpci_s_write_fw ++** ++** Write the firmware image into the card. ++** ++** Arguments: ++** adev wlan device structure ++** fw_image firmware image. ++** ++** Returns: ++** 1 firmware image corrupted ++** 0 success ++*/ ++static int ++acxpci_s_write_fw(acx_device_t *adev, const firmware_image_t *fw_image, u32 offset) ++{ ++ int len, size; ++ u32 sum, v32; ++ /* we skip the first four bytes which contain the control sum */ ++ const u8 *p = (u8*)fw_image + 4; ++ ++ /* start the image checksum by adding the image size value */ ++ sum = p[0]+p[1]+p[2]+p[3]; ++ p += 4; ++ ++ write_reg32(adev, IO_ACX_SLV_END_CTL, 0); ++ ++#if NO_AUTO_INCREMENT ++ write_reg32(adev, IO_ACX_SLV_MEM_CTL, 0); /* use basic mode */ ++#else ++ write_reg32(adev, IO_ACX_SLV_MEM_CTL, 1); /* use autoincrement mode */ ++ write_reg32(adev, IO_ACX_SLV_MEM_ADDR, offset); /* configure start address */ ++ write_flush(adev); ++#endif ++ ++ len = 0; ++ size = le32_to_cpu(fw_image->size) & (~3); ++ ++ while (likely(len < size)) { ++ v32 = be32_to_cpu(*(u32*)p); ++ sum += p[0]+p[1]+p[2]+p[3]; ++ p += 4; ++ len += 4; ++ ++#if NO_AUTO_INCREMENT ++ write_reg32(adev, IO_ACX_SLV_MEM_ADDR, offset + len - 4); ++ write_flush(adev); ++#endif ++ write_reg32(adev, IO_ACX_SLV_MEM_DATA, v32); ++ } ++ ++ log(L_DEBUG, "firmware written, size:%d sum1:%x sum2:%x\n", ++ size, sum, le32_to_cpu(fw_image->chksum)); ++ ++ /* compare our checksum with the stored image checksum */ ++ return (sum != le32_to_cpu(fw_image->chksum)); ++} ++ ++ ++/*********************************************************************** ++** acxpci_s_validate_fw ++** ++** Compare the firmware image given with ++** the firmware image written into the card. ++** ++** Arguments: ++** adev wlan device structure ++** fw_image firmware image. ++** ++** Returns: ++** NOT_OK firmware image corrupted or not correctly written ++** OK success ++*/ ++static int ++acxpci_s_validate_fw(acx_device_t *adev, const firmware_image_t *fw_image, ++ u32 offset) ++{ ++ u32 sum, v32, w32; ++ int len, size; ++ int result = OK; ++ /* we skip the first four bytes which contain the control sum */ ++ const u8 *p = (u8*)fw_image + 4; ++ ++ /* start the image checksum by adding the image size value */ ++ sum = p[0]+p[1]+p[2]+p[3]; ++ p += 4; ++ ++ write_reg32(adev, IO_ACX_SLV_END_CTL, 0); ++ ++#if NO_AUTO_INCREMENT ++ write_reg32(adev, IO_ACX_SLV_MEM_CTL, 0); /* use basic mode */ ++#else ++ write_reg32(adev, IO_ACX_SLV_MEM_CTL, 1); /* use autoincrement mode */ ++ write_reg32(adev, IO_ACX_SLV_MEM_ADDR, offset); /* configure start address */ ++#endif ++ ++ len = 0; ++ size = le32_to_cpu(fw_image->size) & (~3); ++ ++ while (likely(len < size)) { ++ v32 = be32_to_cpu(*(u32*)p); ++ p += 4; ++ len += 4; ++ ++#if NO_AUTO_INCREMENT ++ write_reg32(adev, IO_ACX_SLV_MEM_ADDR, offset + len - 4); ++#endif ++ w32 = read_reg32(adev, IO_ACX_SLV_MEM_DATA); ++ ++ if (unlikely(w32 != v32)) { ++ printk("acx: FATAL: firmware upload: " ++ "data parts at offset %d don't match (0x%08X vs. 0x%08X)! " ++ "I/O timing issues or defective memory, with DWL-xx0+? " ++ "ACX_IO_WIDTH=16 may help. Please report\n", ++ len, v32, w32); ++ result = NOT_OK; ++ break; ++ } ++ ++ sum += (u8)w32 + (u8)(w32>>8) + (u8)(w32>>16) + (u8)(w32>>24); ++ } ++ ++ /* sum control verification */ ++ if (result != NOT_OK) { ++ if (sum != le32_to_cpu(fw_image->chksum)) { ++ printk("acx: FATAL: firmware upload: " ++ "checksums don't match!\n"); ++ result = NOT_OK; ++ } ++ } ++ ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxpci_s_upload_fw ++** ++** Called from acx_reset_dev ++*/ ++static int ++acxpci_s_upload_fw(acx_device_t *adev) ++{ ++ firmware_image_t *fw_image = NULL; ++ int res = NOT_OK; ++ int try; ++ u32 file_size; ++ char filename[sizeof("tiacx1NNcNN")]; ++ ++ FN_ENTER; ++ ++ /* print exact chipset and radio ID to make sure people really get a clue on which files exactly they are supposed to provide, ++ * since firmware loading is the biggest enduser PITA with these chipsets. ++ * Not printing radio ID in 0xHEX in order to not confuse them into wrong file naming */ ++ printk( "acx: need to load firmware for acx1%02d chipset with radio ID %02x, please provide via firmware hotplug:\n" ++ "acx: either one file only (<c>ombined firmware image file, radio-specific) or two files (radio-less base image file *plus* separate <r>adio-specific extension file)\n", ++ IS_ACX111(adev)*11, adev->radio_type); ++ ++ /* Try combined, then main image */ ++ adev->need_radio_fw = 0; ++ snprintf(filename, sizeof(filename), "tiacx1%02dc%02X", ++ IS_ACX111(adev)*11, adev->radio_type); ++ ++ fw_image = acx_s_read_fw(&adev->pdev->dev, filename, &file_size); ++ if (!fw_image) { ++ adev->need_radio_fw = 1; ++ filename[sizeof("tiacx1NN")-1] = '\0'; ++ fw_image = acx_s_read_fw(&adev->pdev->dev, filename, &file_size); ++ if (!fw_image) { ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++ } ++ } ++ ++ for (try = 1; try <= 5; try++) { ++ res = acxpci_s_write_fw(adev, fw_image, 0); ++ log(L_DEBUG|L_INIT, "acx_write_fw (main/combined): %d\n", res); ++ if (OK == res) { ++ res = acxpci_s_validate_fw(adev, fw_image, 0); ++ log(L_DEBUG|L_INIT, "acx_validate_fw " ++ "(main/combined): %d\n", res); ++ } ++ ++ if (OK == res) { ++ SET_BIT(adev->dev_state_mask, ACX_STATE_FW_LOADED); ++ break; ++ } ++ printk("acx: firmware upload attempt #%d FAILED, " ++ "retrying...\n", try); ++ acx_s_msleep(1000); /* better wait for a while... */ ++ } ++ ++ vfree(fw_image); ++ ++ FN_EXIT1(res); ++ return res; ++} ++ ++ ++/*********************************************************************** ++** acxpci_s_upload_radio ++** ++** Uploads the appropriate radio module firmware into the card. ++*/ ++int ++acxpci_s_upload_radio(acx_device_t *adev) ++{ ++ acx_ie_memmap_t mm; ++ firmware_image_t *radio_image; ++ acx_cmd_radioinit_t radioinit; ++ int res = NOT_OK; ++ int try; ++ u32 offset; ++ u32 size; ++ char filename[sizeof("tiacx1NNrNN")]; ++ ++ if (!adev->need_radio_fw) return OK; ++ ++ FN_ENTER; ++ ++ acx_s_interrogate(adev, &mm, ACX1xx_IE_MEMORY_MAP); ++ offset = le32_to_cpu(mm.CodeEnd); ++ ++ snprintf(filename, sizeof(filename), "tiacx1%02dr%02X", ++ IS_ACX111(adev)*11, ++ adev->radio_type); ++ radio_image = acx_s_read_fw(&adev->pdev->dev, filename, &size); ++ if (!radio_image) { ++ printk("acx: can't load radio module '%s'\n", filename); ++ goto fail; ++ } ++ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_SLEEP, NULL, 0); ++ ++ for (try = 1; try <= 5; try++) { ++ res = acxpci_s_write_fw(adev, radio_image, offset); ++ log(L_DEBUG|L_INIT, "acx_write_fw (radio): %d\n", res); ++ if (OK == res) { ++ res = acxpci_s_validate_fw(adev, radio_image, offset); ++ log(L_DEBUG|L_INIT, "acx_validate_fw (radio): %d\n", res); ++ } ++ ++ if (OK == res) ++ break; ++ printk("acx: radio firmware upload attempt #%d FAILED, " ++ "retrying...\n", try); ++ acx_s_msleep(1000); /* better wait for a while... */ ++ } ++ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_WAKE, NULL, 0); ++ radioinit.offset = cpu_to_le32(offset); ++ /* no endian conversion needed, remains in card CPU area: */ ++ radioinit.len = radio_image->size; ++ ++ vfree(radio_image); ++ ++ if (OK != res) ++ goto fail; ++ ++ /* will take a moment so let's have a big timeout */ ++ acx_s_issue_cmd_timeo(adev, ACX1xx_CMD_RADIOINIT, ++ &radioinit, sizeof(radioinit), CMD_TIMEOUT_MS(1000)); ++ ++ res = acx_s_interrogate(adev, &mm, ACX1xx_IE_MEMORY_MAP); ++fail: ++ FN_EXIT1(res); ++ return res; ++} ++ ++ ++/*********************************************************************** ++** acxpci_l_reset_mac ++** ++** MAC will be reset ++** Call context: reset_dev ++*/ ++static void ++acxpci_l_reset_mac(acx_device_t *adev) ++{ ++ u16 temp; ++ ++ FN_ENTER; ++ ++ /* halt eCPU */ ++ temp = read_reg16(adev, IO_ACX_ECPU_CTRL) | 0x1; ++ write_reg16(adev, IO_ACX_ECPU_CTRL, temp); ++ ++ /* now do soft reset of eCPU, set bit */ ++ temp = read_reg16(adev, IO_ACX_SOFT_RESET) | 0x1; ++ log(L_DEBUG, "%s: enable soft reset...\n", __func__); ++ write_reg16(adev, IO_ACX_SOFT_RESET, temp); ++ write_flush(adev); ++ ++ /* now clear bit again: deassert eCPU reset */ ++ log(L_DEBUG, "%s: disable soft reset and go to init mode...\n", __func__); ++ write_reg16(adev, IO_ACX_SOFT_RESET, temp & ~0x1); ++ ++ /* now start a burst read from initial EEPROM */ ++ temp = read_reg16(adev, IO_ACX_EE_START) | 0x1; ++ write_reg16(adev, IO_ACX_EE_START, temp); ++ write_flush(adev); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxpci_s_verify_init ++*/ ++static int ++acxpci_s_verify_init(acx_device_t *adev) ++{ ++ int result = NOT_OK; ++ unsigned long timeout; ++ ++ FN_ENTER; ++ ++ timeout = jiffies + 2*HZ; ++ for (;;) { ++ u16 irqstat = read_reg16(adev, IO_ACX_IRQ_STATUS_NON_DES); ++ if (irqstat & HOST_INT_FCS_THRESHOLD) { ++ result = OK; ++ write_reg16(adev, IO_ACX_IRQ_ACK, HOST_INT_FCS_THRESHOLD); ++ break; ++ } ++ if (time_after(jiffies, timeout)) ++ break; ++ /* Init may take up to ~0.5 sec total */ ++ acx_s_msleep(50); ++ } ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** A few low-level helpers ++** ++** Note: these functions are not protected by lock ++** and thus are never allowed to be called from IRQ. ++** Also they must not race with fw upload which uses same hw regs ++*/ ++ ++/*********************************************************************** ++** acxpci_write_cmd_type_status ++*/ ++ ++static inline void ++acxpci_write_cmd_type_status(acx_device_t *adev, u16 type, u16 status) ++{ ++ writel(type | (status << 16), adev->cmd_area); ++ write_flush(adev); ++} ++ ++ ++/*********************************************************************** ++** acxpci_read_cmd_type_status ++*/ ++static u32 ++acxpci_read_cmd_type_status(acx_device_t *adev) ++{ ++ u32 cmd_type, cmd_status; ++ ++ cmd_type = readl(adev->cmd_area); ++ cmd_status = (cmd_type >> 16); ++ cmd_type = (u16)cmd_type; ++ ++ log(L_CTL, "cmd_type:%04X cmd_status:%04X [%s]\n", ++ cmd_type, cmd_status, ++ acx_cmd_status_str(cmd_status)); ++ ++ return cmd_status; ++} ++ ++ ++/*********************************************************************** ++** acxpci_s_reset_dev ++** ++** Arguments: ++** netdevice that contains the adev variable ++** Returns: ++** NOT_OK on fail ++** OK on success ++** Side effects: ++** device is hard reset ++** Call context: ++** acxpci_e_probe ++** Comment: ++** This resets the device using low level hardware calls ++** as well as uploads and verifies the firmware to the card ++*/ ++ ++static inline void ++init_mboxes(acx_device_t *adev) ++{ ++ u32 cmd_offs, info_offs; ++ ++ cmd_offs = read_reg32(adev, IO_ACX_CMD_MAILBOX_OFFS); ++ info_offs = read_reg32(adev, IO_ACX_INFO_MAILBOX_OFFS); ++ adev->cmd_area = (u8 *)adev->iobase2 + cmd_offs; ++ adev->info_area = (u8 *)adev->iobase2 + info_offs; ++ log(L_DEBUG, "iobase2=%p\n" ++ "cmd_mbox_offset=%X cmd_area=%p\n" ++ "info_mbox_offset=%X info_area=%p\n", ++ adev->iobase2, ++ cmd_offs, adev->cmd_area, ++ info_offs, adev->info_area); ++} ++ ++ ++static inline void ++read_eeprom_area(acx_device_t *adev) ++{ ++#if ACX_DEBUG > 1 ++ int offs; ++ u8 tmp; ++ ++ for (offs = 0x8c; offs < 0xb9; offs++) ++ acxpci_read_eeprom_byte(adev, offs, &tmp); ++#endif ++} ++ ++ ++static int ++acxpci_s_reset_dev(acx_device_t *adev) ++{ ++ const char* msg = ""; ++ unsigned long flags; ++ int result = NOT_OK; ++ u16 hardware_info; ++ u16 ecpu_ctrl; ++ int count; ++ ++ FN_ENTER; ++ ++ /* reset the device to make sure the eCPU is stopped ++ * to upload the firmware correctly */ ++ ++ acx_lock(adev, flags); ++ ++ acxpci_l_reset_mac(adev); ++ ++ ecpu_ctrl = read_reg16(adev, IO_ACX_ECPU_CTRL) & 1; ++ if (!ecpu_ctrl) { ++ msg = "eCPU is already running. "; ++ goto end_unlock; ++ } ++ ++#ifdef WE_DONT_NEED_THAT_DO_WE ++ if (read_reg16(adev, IO_ACX_SOR_CFG) & 2) { ++ /* eCPU most likely means "embedded CPU" */ ++ msg = "eCPU did not start after boot from flash. "; ++ goto end_unlock; ++ } ++ ++ /* check sense on reset flags */ ++ if (read_reg16(adev, IO_ACX_SOR_CFG) & 0x10) { ++ printk("%s: eCPU did not start after boot (SOR), " ++ "is this fatal?\n", adev->ndev->name); ++ } ++#endif ++ /* scan, if any, is stopped now, setting corresponding IRQ bit */ ++ adev->irq_status |= HOST_INT_SCAN_COMPLETE; ++ ++ acx_unlock(adev, flags); ++ ++ /* need to know radio type before fw load */ ++ /* Need to wait for arrival of this information in a loop, ++ * most probably since eCPU runs some init code from EEPROM ++ * (started burst read in reset_mac()) which also ++ * sets the radio type ID */ ++ ++ count = 0xffff; ++ do { ++ hardware_info = read_reg16(adev, IO_ACX_EEPROM_INFORMATION); ++ if (!--count) { ++ msg = "eCPU didn't indicate radio type"; ++ goto end_fail; ++ } ++ cpu_relax(); ++ } while (!(hardware_info & 0xff00)); /* radio type still zero? */ ++ ++ /* printk("DEBUG: count %d\n", count); */ ++ adev->form_factor = hardware_info & 0xff; ++ adev->radio_type = hardware_info >> 8; ++ ++ /* load the firmware */ ++ if (OK != acxpci_s_upload_fw(adev)) ++ goto end_fail; ++ ++ /* acx_s_msleep(10); this one really shouldn't be required */ ++ ++ /* now start eCPU by clearing bit */ ++ write_reg16(adev, IO_ACX_ECPU_CTRL, ecpu_ctrl & ~0x1); ++ log(L_DEBUG, "booted eCPU up and waiting for completion...\n"); ++ ++ /* wait for eCPU bootup */ ++ if (OK != acxpci_s_verify_init(adev)) { ++ msg = "timeout waiting for eCPU. "; ++ goto end_fail; ++ } ++ log(L_DEBUG, "eCPU has woken up, card is ready to be configured\n"); ++ ++ init_mboxes(adev); ++ acxpci_write_cmd_type_status(adev, 0, 0); ++ ++ /* test that EEPROM is readable */ ++ read_eeprom_area(adev); ++ ++ result = OK; ++ goto end; ++ ++/* Finish error message. Indicate which function failed */ ++end_unlock: ++ acx_unlock(adev, flags); ++end_fail: ++ printk("acx: %sreset_dev() FAILED\n", msg); ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxpci_s_issue_cmd_timeo ++** ++** Sends command to fw, extract result ++** ++** NB: we do _not_ take lock inside, so be sure to not touch anything ++** which may interfere with IRQ handler operation ++** ++** TODO: busy wait is a bit silly, so: ++** 1) stop doing many iters - go to sleep after first ++** 2) go to waitqueue based approach: wait, not poll! ++*/ ++#undef FUNC ++#define FUNC "issue_cmd" ++ ++#if !ACX_DEBUG ++int ++acxpci_s_issue_cmd_timeo( ++ acx_device_t *adev, ++ unsigned int cmd, ++ void *buffer, ++ unsigned buflen, ++ unsigned cmd_timeout) ++{ ++#else ++int ++acxpci_s_issue_cmd_timeo_debug( ++ acx_device_t *adev, ++ unsigned cmd, ++ void *buffer, ++ unsigned buflen, ++ unsigned cmd_timeout, ++ const char* cmdstr) ++{ ++ unsigned long start = jiffies; ++#endif ++ const char *devname; ++ unsigned counter; ++ u16 irqtype; ++ u16 cmd_status; ++ unsigned long timeout; ++ ++ FN_ENTER; ++ ++ devname = adev->ndev->name; ++ if (!devname || !devname[0] || devname[4]=='%') ++ devname = "acx"; ++ ++ log(L_CTL, FUNC"(cmd:%s,buflen:%u,timeout:%ums,type:0x%04X)\n", ++ cmdstr, buflen, cmd_timeout, ++ buffer ? le16_to_cpu(((acx_ie_generic_t *)buffer)->type) : -1); ++ ++ if (!(adev->dev_state_mask & ACX_STATE_FW_LOADED)) { ++ printk("%s: "FUNC"(): firmware is not loaded yet, " ++ "cannot execute commands!\n", devname); ++ goto bad; ++ } ++ ++ if ((acx_debug & L_DEBUG) && (cmd != ACX1xx_CMD_INTERROGATE)) { ++ printk("input buffer (len=%u):\n", buflen); ++ acx_dump_bytes(buffer, buflen); ++ } ++ ++ /* wait for firmware to become idle for our command submission */ ++ timeout = HZ/5; ++ counter = (timeout * 1000 / HZ) - 1; /* in ms */ ++ timeout += jiffies; ++ do { ++ cmd_status = acxpci_read_cmd_type_status(adev); ++ /* Test for IDLE state */ ++ if (!cmd_status) ++ break; ++ if (counter % 8 == 0) { ++ if (time_after(jiffies, timeout)) { ++ counter = 0; ++ break; ++ } ++ /* we waited 8 iterations, no luck. Sleep 8 ms */ ++ acx_s_msleep(8); ++ } ++ } while (likely(--counter)); ++ ++ if (!counter) { ++ /* the card doesn't get idle, we're in trouble */ ++ printk("%s: "FUNC"(): cmd_status is not IDLE: 0x%04X!=0\n", ++ devname, cmd_status); ++ goto bad; ++ } else if (counter < 190) { /* if waited >10ms... */ ++ log(L_CTL|L_DEBUG, FUNC"(): waited for IDLE %dms. " ++ "Please report\n", 199 - counter); ++ } ++ ++ /* now write the parameters of the command if needed */ ++ if (buffer && buflen) { ++ /* if it's an INTERROGATE command, just pass the length ++ * of parameters to read, as data */ ++#if CMD_DISCOVERY ++ if (cmd == ACX1xx_CMD_INTERROGATE) ++ memset_io(adev->cmd_area + 4, 0xAA, buflen); ++#endif ++ /* adev->cmd_area points to PCI device's memory, not to RAM! */ ++ memcpy_toio(adev->cmd_area + 4, buffer, ++ (cmd == ACX1xx_CMD_INTERROGATE) ? 4 : buflen); ++ } ++ /* now write the actual command type */ ++ acxpci_write_cmd_type_status(adev, cmd, 0); ++ /* execute command */ ++ write_reg16(adev, IO_ACX_INT_TRIG, INT_TRIG_CMD); ++ write_flush(adev); ++ ++ /* wait for firmware to process command */ ++ ++ /* Ensure nonzero and not too large timeout. ++ ** Also converts e.g. 100->99, 200->199 ++ ** which is nice but not essential */ ++ cmd_timeout = (cmd_timeout-1) | 1; ++ if (unlikely(cmd_timeout > 1199)) ++ cmd_timeout = 1199; ++ /* clear CMD_COMPLETE bit. can be set only by IRQ handler: */ ++ adev->irq_status &= ~HOST_INT_CMD_COMPLETE; ++ ++ /* we schedule away sometimes (timeout can be large) */ ++ counter = cmd_timeout; ++ timeout = jiffies + cmd_timeout * HZ / 1000; ++ do { ++ if (!adev->irqs_active) { /* IRQ disabled: poll */ ++ irqtype = read_reg16(adev, IO_ACX_IRQ_STATUS_NON_DES); ++ if (irqtype & HOST_INT_CMD_COMPLETE) { ++ write_reg16(adev, IO_ACX_IRQ_ACK, ++ HOST_INT_CMD_COMPLETE); ++ break; ++ } ++ } else { /* Wait when IRQ will set the bit */ ++ irqtype = adev->irq_status; ++ if (irqtype & HOST_INT_CMD_COMPLETE) ++ break; ++ } ++ ++ if (counter % 8 == 0) { ++ if (time_after(jiffies, timeout)) { ++ counter = 0; ++ break; ++ } ++ /* we waited 8 iterations, no luck. Sleep 8 ms */ ++ acx_s_msleep(8); ++ } ++ } while (likely(--counter)); ++ ++ /* save state for debugging */ ++ cmd_status = acxpci_read_cmd_type_status(adev); ++ ++ /* put the card in IDLE state */ ++ acxpci_write_cmd_type_status(adev, 0, 0); ++ ++ if (!counter) { /* timed out! */ ++ printk("%s: "FUNC"(): timed out %s for CMD_COMPLETE. " ++ "irq bits:0x%04X irq_status:0x%04X timeout:%dms " ++ "cmd_status:%d (%s)\n", ++ devname, (adev->irqs_active) ? "waiting" : "polling", ++ irqtype, adev->irq_status, cmd_timeout, ++ cmd_status, acx_cmd_status_str(cmd_status)); ++ goto bad; ++ } else if (cmd_timeout - counter > 30) { /* if waited >30ms... */ ++ log(L_CTL|L_DEBUG, FUNC"(): %s for CMD_COMPLETE %dms. " ++ "count:%d. Please report\n", ++ (adev->irqs_active) ? "waited" : "polled", ++ cmd_timeout - counter, counter); ++ } ++ ++ if (1 != cmd_status) { /* it is not a 'Success' */ ++ printk("%s: "FUNC"(): cmd_status is not SUCCESS: %d (%s). " ++ "Took %dms of %d\n", ++ devname, cmd_status, acx_cmd_status_str(cmd_status), ++ cmd_timeout - counter, cmd_timeout); ++ /* zero out result buffer ++ * WARNING: this will trash stack in case of illegally large input ++ * length! */ ++ if (buffer && buflen) ++ memset(buffer, 0, buflen); ++ goto bad; ++ } ++ ++ /* read in result parameters if needed */ ++ if (buffer && buflen && (cmd == ACX1xx_CMD_INTERROGATE)) { ++ /* adev->cmd_area points to PCI device's memory, not to RAM! */ ++ memcpy_fromio(buffer, adev->cmd_area + 4, buflen); ++ if (acx_debug & L_DEBUG) { ++ printk("output buffer (len=%u): ", buflen); ++ acx_dump_bytes(buffer, buflen); ++ } ++ } ++/* ok: */ ++ log(L_CTL, FUNC"(%s): took %ld jiffies to complete\n", ++ cmdstr, jiffies - start); ++ FN_EXIT1(OK); ++ return OK; ++ ++bad: ++ /* Give enough info so that callers can avoid ++ ** printing their own diagnostic messages */ ++#if ACX_DEBUG ++ printk("%s: "FUNC"(cmd:%s) FAILED\n", devname, cmdstr); ++#else ++ printk("%s: "FUNC"(cmd:0x%04X) FAILED\n", devname, cmd); ++#endif ++ dump_stack(); ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*********************************************************************** ++*/ ++#ifdef NONESSENTIAL_FEATURES ++typedef struct device_id { ++ unsigned char id[6]; ++ char *descr; ++ char *type; ++} device_id_t; ++ ++static const device_id_t ++device_ids[] = ++{ ++ { ++ {'G', 'l', 'o', 'b', 'a', 'l'}, ++ NULL, ++ NULL, ++ }, ++ { ++ {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}, ++ "uninitialized", ++ "SpeedStream SS1021 or Gigafast WF721-AEX" ++ }, ++ { ++ {0x80, 0x81, 0x82, 0x83, 0x84, 0x85}, ++ "non-standard", ++ "DrayTek Vigor 520" ++ }, ++ { ++ {'?', '?', '?', '?', '?', '?'}, ++ "non-standard", ++ "Level One WPC-0200" ++ }, ++ { ++ {0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, ++ "empty", ++ "DWL-650+ variant" ++ } ++}; ++ ++static void ++acx_show_card_eeprom_id(acx_device_t *adev) ++{ ++ unsigned char buffer[CARD_EEPROM_ID_SIZE]; ++ int i; ++ ++ memset(&buffer, 0, CARD_EEPROM_ID_SIZE); ++ /* use direct EEPROM access */ ++ for (i = 0; i < CARD_EEPROM_ID_SIZE; i++) { ++ if (OK != acxpci_read_eeprom_byte(adev, ++ ACX100_EEPROM_ID_OFFSET + i, ++ &buffer[i])) { ++ printk("acx: reading EEPROM FAILED\n"); ++ break; ++ } ++ } ++ ++ for (i = 0; i < VEC_SIZE(device_ids); i++) { ++ if (!memcmp(&buffer, device_ids[i].id, CARD_EEPROM_ID_SIZE)) { ++ if (device_ids[i].descr) { ++ printk("acx: EEPROM card ID string check " ++ "found %s card ID: is this %s?\n", ++ device_ids[i].descr, device_ids[i].type); ++ } ++ break; ++ } ++ } ++ if (i == VEC_SIZE(device_ids)) { ++ printk("acx: EEPROM card ID string check found " ++ "unknown card: expected 'Global', got '%.*s\'. " ++ "Please report\n", CARD_EEPROM_ID_SIZE, buffer); ++ } ++} ++#endif /* NONESSENTIAL_FEATURES */ ++ ++ ++/*********************************************************************** ++** acxpci_free_desc_queues ++** ++** Releases the queues that have been allocated, the ++** others have been initialised to NULL so this ++** function can be used if only part of the queues were allocated. ++*/ ++ ++static inline void ++free_coherent(struct pci_dev *hwdev, size_t size, ++ void *vaddr, dma_addr_t dma_handle) ++{ ++ dma_free_coherent(hwdev == NULL ? NULL : &hwdev->dev, ++ size, vaddr, dma_handle); ++} ++ ++void ++acxpci_free_desc_queues(acx_device_t *adev) ++{ ++#define ACX_FREE_QUEUE(size, ptr, phyaddr) \ ++ if (ptr) { \ ++ free_coherent(0, size, ptr, phyaddr); \ ++ ptr = NULL; \ ++ size = 0; \ ++ } ++ ++ FN_ENTER; ++ ++ ACX_FREE_QUEUE(adev->txhostdesc_area_size, adev->txhostdesc_start, adev->txhostdesc_startphy); ++ ACX_FREE_QUEUE(adev->txbuf_area_size, adev->txbuf_start, adev->txbuf_startphy); ++ ++ adev->txdesc_start = NULL; ++ ++ ACX_FREE_QUEUE(adev->rxhostdesc_area_size, adev->rxhostdesc_start, adev->rxhostdesc_startphy); ++ ACX_FREE_QUEUE(adev->rxbuf_area_size, adev->rxbuf_start, adev->rxbuf_startphy); ++ ++ adev->rxdesc_start = NULL; ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxpci_s_delete_dma_regions ++*/ ++static void ++acxpci_s_delete_dma_regions(acx_device_t *adev) ++{ ++ unsigned long flags; ++ ++ FN_ENTER; ++ /* disable radio Tx/Rx. Shouldn't we use the firmware commands ++ * here instead? Or are we that much down the road that it's no ++ * longer possible here? */ ++ write_reg16(adev, IO_ACX_ENABLE, 0); ++ ++ acx_s_msleep(100); ++ ++ acx_lock(adev, flags); ++ acxpci_free_desc_queues(adev); ++ acx_unlock(adev, flags); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxpci_e_probe ++** ++** Probe routine called when a PCI device w/ matching ID is found. ++** Here's the sequence: ++** - Allocate the PCI resources. ++** - Read the PCMCIA attribute memory to make sure we have a WLAN card ++** - Reset the MAC ++** - Initialize the dev and wlan data ++** - Initialize the MAC ++** ++** pdev - ptr to pci device structure containing info about pci configuration ++** id - ptr to the device id entry that matched this device ++*/ ++static const u16 ++IO_ACX100[] = ++{ ++ 0x0000, /* IO_ACX_SOFT_RESET */ ++ ++ 0x0014, /* IO_ACX_SLV_MEM_ADDR */ ++ 0x0018, /* IO_ACX_SLV_MEM_DATA */ ++ 0x001c, /* IO_ACX_SLV_MEM_CTL */ ++ 0x0020, /* IO_ACX_SLV_END_CTL */ ++ ++ 0x0034, /* IO_ACX_FEMR */ ++ ++ 0x007c, /* IO_ACX_INT_TRIG */ ++ 0x0098, /* IO_ACX_IRQ_MASK */ ++ 0x00a4, /* IO_ACX_IRQ_STATUS_NON_DES */ ++ 0x00a8, /* IO_ACX_IRQ_STATUS_CLEAR */ ++ 0x00ac, /* IO_ACX_IRQ_ACK */ ++ 0x00b0, /* IO_ACX_HINT_TRIG */ ++ ++ 0x0104, /* IO_ACX_ENABLE */ ++ ++ 0x0250, /* IO_ACX_EEPROM_CTL */ ++ 0x0254, /* IO_ACX_EEPROM_ADDR */ ++ 0x0258, /* IO_ACX_EEPROM_DATA */ ++ 0x025c, /* IO_ACX_EEPROM_CFG */ ++ ++ 0x0268, /* IO_ACX_PHY_ADDR */ ++ 0x026c, /* IO_ACX_PHY_DATA */ ++ 0x0270, /* IO_ACX_PHY_CTL */ ++ ++ 0x0290, /* IO_ACX_GPIO_OE */ ++ ++ 0x0298, /* IO_ACX_GPIO_OUT */ ++ ++ 0x02a4, /* IO_ACX_CMD_MAILBOX_OFFS */ ++ 0x02a8, /* IO_ACX_INFO_MAILBOX_OFFS */ ++ 0x02ac, /* IO_ACX_EEPROM_INFORMATION */ ++ ++ 0x02d0, /* IO_ACX_EE_START */ ++ 0x02d4, /* IO_ACX_SOR_CFG */ ++ 0x02d8 /* IO_ACX_ECPU_CTRL */ ++}; ++ ++static const u16 ++IO_ACX111[] = ++{ ++ 0x0000, /* IO_ACX_SOFT_RESET */ ++ ++ 0x0014, /* IO_ACX_SLV_MEM_ADDR */ ++ 0x0018, /* IO_ACX_SLV_MEM_DATA */ ++ 0x001c, /* IO_ACX_SLV_MEM_CTL */ ++ 0x0020, /* IO_ACX_SLV_END_CTL */ ++ ++ 0x0034, /* IO_ACX_FEMR */ ++ ++ 0x00b4, /* IO_ACX_INT_TRIG */ ++ 0x00d4, /* IO_ACX_IRQ_MASK */ ++ /* we do mean NON_DES (0xf0), not NON_DES_MASK which is at 0xe0: */ ++ 0x00f0, /* IO_ACX_IRQ_STATUS_NON_DES */ ++ 0x00e4, /* IO_ACX_IRQ_STATUS_CLEAR */ ++ 0x00e8, /* IO_ACX_IRQ_ACK */ ++ 0x00ec, /* IO_ACX_HINT_TRIG */ ++ ++ 0x01d0, /* IO_ACX_ENABLE */ ++ ++ 0x0338, /* IO_ACX_EEPROM_CTL */ ++ 0x033c, /* IO_ACX_EEPROM_ADDR */ ++ 0x0340, /* IO_ACX_EEPROM_DATA */ ++ 0x0344, /* IO_ACX_EEPROM_CFG */ ++ ++ 0x0350, /* IO_ACX_PHY_ADDR */ ++ 0x0354, /* IO_ACX_PHY_DATA */ ++ 0x0358, /* IO_ACX_PHY_CTL */ ++ ++ 0x0374, /* IO_ACX_GPIO_OE */ ++ ++ 0x037c, /* IO_ACX_GPIO_OUT */ ++ ++ 0x0388, /* IO_ACX_CMD_MAILBOX_OFFS */ ++ 0x038c, /* IO_ACX_INFO_MAILBOX_OFFS */ ++ 0x0390, /* IO_ACX_EEPROM_INFORMATION */ ++ ++ 0x0100, /* IO_ACX_EE_START */ ++ 0x0104, /* IO_ACX_SOR_CFG */ ++ 0x0108, /* IO_ACX_ECPU_CTRL */ ++}; ++ ++static void ++dummy_netdev_init(struct net_device *ndev) {} ++ ++static int __devinit ++acxpci_e_probe(struct pci_dev *pdev, const struct pci_device_id *id) ++{ ++ acx111_ie_configoption_t co; ++ unsigned long mem_region1 = 0; ++ unsigned long mem_region2 = 0; ++ unsigned long mem_region1_size; ++ unsigned long mem_region2_size; ++ unsigned long phymem1; ++ unsigned long phymem2; ++ void *mem1 = NULL; ++ void *mem2 = NULL; ++ acx_device_t *adev = NULL; ++ struct net_device *ndev = NULL; ++ const char *chip_name; ++ int result = -EIO; ++ int err; ++ u8 chip_type; ++ ++ FN_ENTER; ++ ++ /* Enable the PCI device */ ++ if (pci_enable_device(pdev)) { ++ printk("acx: pci_enable_device() FAILED\n"); ++ result = -ENODEV; ++ goto fail_pci_enable_device; ++ } ++ ++ /* enable busmastering (required for CardBus) */ ++ pci_set_master(pdev); ++ ++ /* FIXME: prism54 calls pci_set_mwi() here, ++ * should we do/support the same? */ ++ ++ /* chiptype is u8 but id->driver_data is ulong ++ ** Works for now (possible values are 1 and 2) */ ++ chip_type = (u8)id->driver_data; ++ /* acx100 and acx111 have different PCI memory regions */ ++ if (chip_type == CHIPTYPE_ACX100) { ++ chip_name = "ACX100"; ++ mem_region1 = PCI_ACX100_REGION1; ++ mem_region1_size = PCI_ACX100_REGION1_SIZE; ++ ++ mem_region2 = PCI_ACX100_REGION2; ++ mem_region2_size = PCI_ACX100_REGION2_SIZE; ++ } else if (chip_type == CHIPTYPE_ACX111) { ++ chip_name = "ACX111"; ++ mem_region1 = PCI_ACX111_REGION1; ++ mem_region1_size = PCI_ACX111_REGION1_SIZE; ++ ++ mem_region2 = PCI_ACX111_REGION2; ++ mem_region2_size = PCI_ACX111_REGION2_SIZE; ++ } else { ++ printk("acx: unknown chip type 0x%04X\n", chip_type); ++ goto fail_unknown_chiptype; ++ } ++ ++ /* Figure out our resources */ ++ phymem1 = pci_resource_start(pdev, mem_region1); ++ phymem2 = pci_resource_start(pdev, mem_region2); ++ if (!request_mem_region(phymem1, pci_resource_len(pdev, mem_region1), "acx_1")) { ++ printk("acx: cannot reserve PCI memory region 1 (are you sure " ++ "you have CardBus support in kernel?)\n"); ++ goto fail_request_mem_region1; ++ } ++ if (!request_mem_region(phymem2, pci_resource_len(pdev, mem_region2), "acx_2")) { ++ printk("acx: cannot reserve PCI memory region 2\n"); ++ goto fail_request_mem_region2; ++ } ++ ++ /* this used to be ioremap(), but ioremap_nocache() ++ * is much less risky, right? (and slower?) ++ * FIXME: we may want to go back to cached variant if it's ++ * certain that our code really properly handles ++ * cached operation (memory barriers, volatile?, ...) ++ * (but always keep this comment here regardless!) ++ * Possibly make this a driver config setting? */ ++ ++ mem1 = ioremap_nocache(phymem1, mem_region1_size); ++ if (!mem1) { ++ printk("acx: ioremap() FAILED\n"); ++ goto fail_ioremap1; ++ } ++ mem2 = ioremap_nocache(phymem2, mem_region2_size); ++ if (!mem2) { ++ printk("acx: ioremap() #2 FAILED\n"); ++ goto fail_ioremap2; ++ } ++ ++ printk("acx: found %s-based wireless network card at %s, irq:%d, " ++ "phymem1:0x%lX, phymem2:0x%lX, mem1:0x%p, mem1_size:%ld, " ++ "mem2:0x%p, mem2_size:%ld\n", ++ chip_name, pci_name(pdev), pdev->irq, phymem1, phymem2, ++ mem1, mem_region1_size, ++ mem2, mem_region2_size); ++ log(L_ANY, "initial debug setting is 0x%04X\n", acx_debug); ++ ++ if (0 == pdev->irq) { ++ printk("acx: can't use IRQ 0\n"); ++ goto fail_irq; ++ } ++ ++ ndev = alloc_netdev(sizeof(*adev), "wlan%d", dummy_netdev_init); ++ /* (NB: memsets to 0 entire area) */ ++ if (!ndev) { ++ printk("acx: no memory for netdevice struct\n"); ++ goto fail_alloc_netdev; ++ } ++ ++ ether_setup(ndev); ++ ndev->open = &acxpci_e_open; ++ ndev->stop = &acxpci_e_close; ++ ndev->hard_start_xmit = &acx_i_start_xmit; ++ ndev->get_stats = &acx_e_get_stats; ++#if IW_HANDLER_VERSION <= 5 ++ ndev->get_wireless_stats = &acx_e_get_wireless_stats; ++#endif ++ ndev->wireless_handlers = (struct iw_handler_def *)&acx_ioctl_handler_def; ++ ndev->set_multicast_list = &acxpci_i_set_multicast_list; ++ ndev->tx_timeout = &acxpci_i_tx_timeout; ++ ndev->change_mtu = &acx_e_change_mtu; ++ ndev->watchdog_timeo = 4 * HZ; ++ ndev->irq = pdev->irq; ++ ndev->base_addr = pci_resource_start(pdev, 0); ++ ++ adev = ndev2adev(ndev); ++ spin_lock_init(&adev->lock); /* initial state: unlocked */ ++ /* We do not start with downed sem: we want PARANOID_LOCKING to work */ ++ sema_init(&adev->sem, 1); /* initial state: 1 (upped) */ ++ /* since nobody can see new netdev yet, we can as well ++ ** just _presume_ that we're under sem (instead of actually taking it): */ ++ /* acx_sem_lock(adev); */ ++ adev->pdev = pdev; ++ adev->ndev = ndev; ++ adev->dev_type = DEVTYPE_PCI; ++ adev->chip_type = chip_type; ++ adev->chip_name = chip_name; ++ adev->io = (CHIPTYPE_ACX100 == chip_type) ? IO_ACX100 : IO_ACX111; ++ adev->membase = phymem1; ++ adev->iobase = mem1; ++ adev->membase2 = phymem2; ++ adev->iobase2 = mem2; ++ /* to find crashes due to weird driver access ++ * to unconfigured interface (ifup) */ ++ adev->mgmt_timer.function = (void (*)(unsigned long))0x0000dead; ++ ++#ifdef NONESSENTIAL_FEATURES ++ acx_show_card_eeprom_id(adev); ++#endif /* NONESSENTIAL_FEATURES */ ++ ++#ifdef SET_MODULE_OWNER ++ SET_MODULE_OWNER(ndev); ++#endif ++ SET_NETDEV_DEV(ndev, &pdev->dev); ++ ++ log(L_IRQ|L_INIT, "using IRQ %d\n", pdev->irq); ++ ++ /* need to be able to restore PCI state after a suspend */ ++ pci_save_state(pdev); ++ pci_set_drvdata(pdev, ndev); ++ ++ /* ok, pci setup is finished, now start initializing the card */ ++ ++ /* NB: read_reg() reads may return bogus data before reset_dev(), ++ * since the firmware which directly controls large parts of the I/O ++ * registers isn't initialized yet. ++ * acx100 seems to be more affected than acx111 */ ++ if (OK != acxpci_s_reset_dev(adev)) ++ goto fail_reset; ++ ++ if (IS_ACX100(adev)) { ++ /* ACX100: configopt struct in cmd mailbox - directly after reset */ ++ memcpy_fromio(&co, adev->cmd_area, sizeof(co)); ++ } ++ ++ if (OK != acx_s_init_mac(adev)) ++ goto fail_init_mac; ++ ++ if (IS_ACX111(adev)) { ++ /* ACX111: configopt struct needs to be queried after full init */ ++ acx_s_interrogate(adev, &co, ACX111_IE_CONFIG_OPTIONS); ++ } ++ ++/* TODO: merge them into one function, they are called just once and are the same for pci & usb */ ++ if (OK != acxpci_read_eeprom_byte(adev, 0x05, &adev->eeprom_version)) ++ goto fail_read_eeprom_version; ++ ++ acx_s_parse_configoption(adev, &co); ++ acx_s_set_defaults(adev); ++ acx_s_get_firmware_version(adev); /* needs to be after acx_s_init_mac() */ ++ acx_display_hardware_details(adev); ++ ++ /* Register the card, AFTER everything else has been set up, ++ * since otherwise an ioctl could step on our feet due to ++ * firmware operations happening in parallel or uninitialized data */ ++ err = register_netdev(ndev); ++ if (OK != err) { ++ printk("acx: register_netdev() FAILED: %d\n", err); ++ goto fail_register_netdev; ++ } ++ ++ acx_proc_register_entries(ndev); ++ ++ /* Now we have our device, so make sure the kernel doesn't try ++ * to send packets even though we're not associated to a network yet */ ++ acx_stop_queue(ndev, "on probe"); ++ acx_carrier_off(ndev, "on probe"); ++ ++ /* after register_netdev() userspace may start working with dev ++ * (in particular, on other CPUs), we only need to up the sem */ ++ /* acx_sem_unlock(adev); */ ++ ++ printk("acx "ACX_RELEASE": net device %s, driver compiled " ++ "against wireless extensions %d and Linux %s\n", ++ ndev->name, WIRELESS_EXT, UTS_RELEASE); ++ ++#if CMD_DISCOVERY ++ great_inquisitor(adev); ++#endif ++ ++ result = OK; ++ goto done; ++ ++ /* error paths: undo everything in reverse order... */ ++ ++fail_register_netdev: ++ ++ acxpci_s_delete_dma_regions(adev); ++ pci_set_drvdata(pdev, NULL); ++ ++fail_init_mac: ++fail_read_eeprom_version: ++fail_reset: ++ ++ free_netdev(ndev); ++fail_alloc_netdev: ++fail_irq: ++ ++ iounmap(mem2); ++fail_ioremap2: ++ ++ iounmap(mem1); ++fail_ioremap1: ++ ++ release_mem_region(pci_resource_start(pdev, mem_region2), ++ pci_resource_len(pdev, mem_region2)); ++fail_request_mem_region2: ++ ++ release_mem_region(pci_resource_start(pdev, mem_region1), ++ pci_resource_len(pdev, mem_region1)); ++fail_request_mem_region1: ++fail_unknown_chiptype: ++ ++ pci_disable_device(pdev); ++fail_pci_enable_device: ++ ++ pci_set_power_state(pdev, PCI_D3hot); ++ ++done: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxpci_e_remove ++** ++** Shut device down (if not hot unplugged) ++** and deallocate PCI resources for the acx chip. ++** ++** pdev - ptr to PCI device structure containing info about pci configuration ++*/ ++static void __devexit ++acxpci_e_remove(struct pci_dev *pdev) ++{ ++ struct net_device *ndev; ++ acx_device_t *adev; ++ unsigned long mem_region1, mem_region2; ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ ndev = (struct net_device*) pci_get_drvdata(pdev); ++ if (!ndev) { ++ log(L_DEBUG, "%s: card is unused. Skipping any release code\n", ++ __func__); ++ goto end; ++ } ++ ++ adev = ndev2adev(ndev); ++ ++ /* If device wasn't hot unplugged... */ ++ if (adev_present(adev)) { ++ ++ acx_sem_lock(adev); ++ ++ /* disable both Tx and Rx to shut radio down properly */ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_DISABLE_TX, NULL, 0); ++ acx_s_issue_cmd(adev, ACX1xx_CMD_DISABLE_RX, NULL, 0); ++ ++#ifdef REDUNDANT ++ /* put the eCPU to sleep to save power ++ * Halting is not possible currently, ++ * since not supported by all firmware versions */ ++ acx_s_issue_cmd(adev, ACX100_CMD_SLEEP, NULL, 0); ++#endif ++ acx_lock(adev, flags); ++ /* disable power LED to save power :-) */ ++ log(L_INIT, "switching off power LED to save power\n"); ++ acxpci_l_power_led(adev, 0); ++ /* stop our eCPU */ ++ if (IS_ACX111(adev)) { ++ /* FIXME: does this actually keep halting the eCPU? ++ * I don't think so... ++ */ ++ acxpci_l_reset_mac(adev); ++ } else { ++ u16 temp; ++ /* halt eCPU */ ++ temp = read_reg16(adev, IO_ACX_ECPU_CTRL) | 0x1; ++ write_reg16(adev, IO_ACX_ECPU_CTRL, temp); ++ write_flush(adev); ++ } ++ acx_unlock(adev, flags); ++ ++ acx_sem_unlock(adev); ++ } ++ ++ /* unregister the device to not let the kernel ++ * (e.g. ioctls) access a half-deconfigured device ++ * NB: this will cause acxpci_e_close() to be called, ++ * thus we shouldn't call it under sem! */ ++ log(L_INIT, "removing device %s\n", ndev->name); ++ unregister_netdev(ndev); ++ ++ /* unregister_netdev ensures that no references to us left. ++ * For paranoid reasons we continue to follow the rules */ ++ acx_sem_lock(adev); ++ ++ if (adev->dev_state_mask & ACX_STATE_IFACE_UP) { ++ acxpci_s_down(ndev); ++ CLEAR_BIT(adev->dev_state_mask, ACX_STATE_IFACE_UP); ++ } ++ ++ acx_proc_unregister_entries(ndev); ++ ++ if (IS_ACX100(adev)) { ++ mem_region1 = PCI_ACX100_REGION1; ++ mem_region2 = PCI_ACX100_REGION2; ++ } else { ++ mem_region1 = PCI_ACX111_REGION1; ++ mem_region2 = PCI_ACX111_REGION2; ++ } ++ ++ /* finally, clean up PCI bus state */ ++ acxpci_s_delete_dma_regions(adev); ++ if (adev->iobase) iounmap(adev->iobase); ++ if (adev->iobase2) iounmap(adev->iobase2); ++ release_mem_region(pci_resource_start(pdev, mem_region1), ++ pci_resource_len(pdev, mem_region1)); ++ release_mem_region(pci_resource_start(pdev, mem_region2), ++ pci_resource_len(pdev, mem_region2)); ++ pci_disable_device(pdev); ++ ++ /* remove dev registration */ ++ pci_set_drvdata(pdev, NULL); ++ ++ acx_sem_unlock(adev); ++ ++ /* Free netdev (quite late, ++ * since otherwise we might get caught off-guard ++ * by a netdev timeout handler execution ++ * expecting to see a working dev...) */ ++ free_netdev(ndev); ++ ++ /* put device into ACPI D3 mode (shutdown) */ ++ pci_set_power_state(pdev, PCI_D3hot); ++ ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** TODO: PM code needs to be fixed / debugged / tested. ++*/ ++#ifdef CONFIG_PM ++static int ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11) ++acxpci_e_suspend(struct pci_dev *pdev, pm_message_t state) ++#else ++acxpci_e_suspend(struct pci_dev *pdev, u32 state) ++#endif ++{ ++ struct net_device *ndev = pci_get_drvdata(pdev); ++ acx_device_t *adev; ++ ++ FN_ENTER; ++ printk("acx: suspend handler is experimental!\n"); ++ printk("sus: dev %p\n", ndev); ++ ++ if (!netif_running(ndev)) ++ goto end; ++ ++ adev = ndev2adev(ndev); ++ printk("sus: adev %p\n", adev); ++ ++ acx_sem_lock(adev); ++ ++ netif_device_detach(ndev); /* this one cannot sleep */ ++ acxpci_s_down(ndev); ++ /* down() does not set it to 0xffff, but here we really want that */ ++ write_reg16(adev, IO_ACX_IRQ_MASK, 0xffff); ++ write_reg16(adev, IO_ACX_FEMR, 0x0); ++ acxpci_s_delete_dma_regions(adev); ++ pci_save_state(pdev); ++ pci_set_power_state(pdev, PCI_D3hot); ++ ++ acx_sem_unlock(adev); ++end: ++ FN_EXIT0; ++ return OK; ++} ++ ++ ++static int ++acxpci_e_resume(struct pci_dev *pdev) ++{ ++ struct net_device *ndev = pci_get_drvdata(pdev); ++ acx_device_t *adev; ++ ++ FN_ENTER; ++ ++ printk("acx: resume handler is experimental!\n"); ++ printk("rsm: got dev %p\n", ndev); ++ ++ if (!netif_running(ndev)) ++ goto end; ++ ++ adev = ndev2adev(ndev); ++ printk("rsm: got adev %p\n", adev); ++ ++ acx_sem_lock(adev); ++ ++ pci_set_power_state(pdev, PCI_D0); ++ printk("rsm: power state PCI_D0 set\n"); ++ pci_restore_state(pdev); ++ printk("rsm: PCI state restored\n"); ++ ++ if (OK != acxpci_s_reset_dev(adev)) ++ goto end_unlock; ++ printk("rsm: device reset done\n"); ++ if (OK != acx_s_init_mac(adev)) ++ goto end_unlock; ++ printk("rsm: init MAC done\n"); ++ ++ acxpci_s_up(ndev); ++ printk("rsm: acx up done\n"); ++ ++ /* now even reload all card parameters as they were before suspend, ++ * and possibly be back in the network again already :-) */ ++ if (ACX_STATE_IFACE_UP & adev->dev_state_mask) { ++ adev->set_mask = GETSET_ALL; ++ acx_s_update_card_settings(adev); ++ printk("rsm: settings updated\n"); ++ } ++ netif_device_attach(ndev); ++ printk("rsm: device attached\n"); ++ ++end_unlock: ++ acx_sem_unlock(adev); ++end: ++ /* we need to return OK here anyway, right? */ ++ FN_EXIT0; ++ return OK; ++} ++#endif /* CONFIG_PM */ ++ ++ ++/*********************************************************************** ++** acxpci_s_up ++** ++** This function is called by acxpci_e_open (when ifconfig sets the device as up) ++** ++** Side effects: ++** - Enables on-card interrupt requests ++** - calls acx_s_start ++*/ ++ ++static void ++enable_acx_irq(acx_device_t *adev) ++{ ++ FN_ENTER; ++ write_reg16(adev, IO_ACX_IRQ_MASK, adev->irq_mask); ++ write_reg16(adev, IO_ACX_FEMR, 0x8000); ++ adev->irqs_active = 1; ++ FN_EXIT0; ++} ++ ++static void ++acxpci_s_up(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ acx_lock(adev, flags); ++ enable_acx_irq(adev); ++ acx_unlock(adev, flags); ++ ++ /* acx fw < 1.9.3.e has a hardware timer, and older drivers ++ ** used to use it. But we don't do that anymore, our OS ++ ** has reliable software timers */ ++ init_timer(&adev->mgmt_timer); ++ adev->mgmt_timer.function = acx_i_timer; ++ adev->mgmt_timer.data = (unsigned long)adev; ++ ++ /* Need to set ACX_STATE_IFACE_UP first, or else ++ ** timer won't be started by acx_set_status() */ ++ SET_BIT(adev->dev_state_mask, ACX_STATE_IFACE_UP); ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_2_STA: ++ /* actual scan cmd will happen in start() */ ++ acx_set_status(adev, ACX_STATUS_1_SCANNING); break; ++ case ACX_MODE_3_AP: ++ case ACX_MODE_MONITOR: ++ acx_set_status(adev, ACX_STATUS_4_ASSOCIATED); break; ++ } ++ ++ acx_s_start(adev); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxpci_s_down ++** ++** NB: device may be already hot unplugged if called from acxpci_e_remove() ++** ++** Disables on-card interrupt request, stops softirq and timer, stops queue, ++** sets status == STOPPED ++*/ ++ ++static void ++disable_acx_irq(acx_device_t *adev) ++{ ++ FN_ENTER; ++ ++ /* I guess mask is not 0xffff because acx100 won't signal ++ ** cmd completion then (needed for ifup). ++ ** Someone with acx100 please confirm */ ++ write_reg16(adev, IO_ACX_IRQ_MASK, adev->irq_mask_off); ++ write_reg16(adev, IO_ACX_FEMR, 0x0); ++ adev->irqs_active = 0; ++ FN_EXIT0; ++} ++ ++static void ++acxpci_s_down(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ /* Disable IRQs first, so that IRQs cannot race with us */ ++ /* then wait until interrupts have finished executing on other CPUs */ ++ acx_lock(adev, flags); ++ disable_acx_irq(adev); ++ synchronize_irq(adev->pdev->irq); ++ acx_unlock(adev, flags); ++ ++ /* we really don't want to have an asynchronous tasklet disturb us ++ ** after something vital for its job has been shut down, so ++ ** end all remaining work now. ++ ** ++ ** NB: carrier_off (done by set_status below) would lead to ++ ** not yet fully understood deadlock in FLUSH_SCHEDULED_WORK(). ++ ** That's why we do FLUSH first. ++ ** ++ ** NB2: we have a bad locking bug here: FLUSH_SCHEDULED_WORK() ++ ** waits for acx_e_after_interrupt_task to complete if it is running ++ ** on another CPU, but acx_e_after_interrupt_task ++ ** will sleep on sem forever, because it is taken by us! ++ ** Work around that by temporary sem unlock. ++ ** This will fail miserably if we'll be hit by concurrent ++ ** iwconfig or something in between. TODO! */ ++ acx_sem_unlock(adev); ++ FLUSH_SCHEDULED_WORK(); ++ acx_sem_lock(adev); ++ ++ /* This is possible: ++ ** FLUSH_SCHEDULED_WORK -> acx_e_after_interrupt_task -> ++ ** -> set_status(ASSOCIATED) -> wake_queue() ++ ** That's why we stop queue _after_ FLUSH_SCHEDULED_WORK ++ ** lock/unlock is just paranoia, maybe not needed */ ++ acx_lock(adev, flags); ++ acx_stop_queue(ndev, "on ifdown"); ++ acx_set_status(adev, ACX_STATUS_0_STOPPED); ++ acx_unlock(adev, flags); ++ ++ /* kernel/timer.c says it's illegal to del_timer_sync() ++ ** a timer which restarts itself. We guarantee this cannot ++ ** ever happen because acx_i_timer() never does this if ++ ** status is ACX_STATUS_0_STOPPED */ ++ del_timer_sync(&adev->mgmt_timer); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxpci_e_open ++** ++** Called as a result of SIOCSIFFLAGS ioctl changing the flags bit IFF_UP ++** from clear to set. In other words: ifconfig up. ++** ++** Returns: ++** 0 success ++** >0 f/w reported error ++** <0 driver reported error ++*/ ++static int ++acxpci_e_open(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ int result = OK; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ acx_init_task_scheduler(adev); ++ ++/* TODO: pci_set_power_state(pdev, PCI_D0); ? */ ++ ++ /* request shared IRQ handler */ ++ if (request_irq(ndev->irq, acxpci_i_interrupt, SA_SHIRQ, ndev->name, ndev)) { ++ printk("%s: request_irq FAILED\n", ndev->name); ++ result = -EAGAIN; ++ goto done; ++ } ++ log(L_DEBUG|L_IRQ, "request_irq %d successful\n", ndev->irq); ++ ++ /* ifup device */ ++ acxpci_s_up(ndev); ++ ++ /* We don't currently have to do anything else. ++ * The setup of the MAC should be subsequently completed via ++ * the mlme commands. ++ * Higher layers know we're ready from dev->start==1 and ++ * dev->tbusy==0. Our rx path knows to pass up received/ ++ * frames because of dev->flags&IFF_UP is true. ++ */ ++done: ++ acx_sem_unlock(adev); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxpci_e_close ++** ++** Called as a result of SIOCSIIFFLAGS ioctl changing the flags bit IFF_UP ++** from set to clear. I.e. called by "ifconfig DEV down" ++** ++** Returns: ++** 0 success ++** >0 f/w reported error ++** <0 driver reported error ++*/ ++static int ++acxpci_e_close(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ /* ifdown device */ ++ CLEAR_BIT(adev->dev_state_mask, ACX_STATE_IFACE_UP); ++ if (netif_device_present(ndev)) { ++ acxpci_s_down(ndev); ++ } ++ ++ /* disable all IRQs, release shared IRQ handler */ ++ write_reg16(adev, IO_ACX_IRQ_MASK, 0xffff); ++ write_reg16(adev, IO_ACX_FEMR, 0x0); ++ free_irq(ndev->irq, ndev); ++ ++/* TODO: pci_set_power_state(pdev, PCI_D3hot); ? */ ++ ++ /* We currently don't have to do anything else. ++ * Higher layers know we're not ready from dev->start==0 and ++ * dev->tbusy==1. Our rx path knows to not pass up received ++ * frames because of dev->flags&IFF_UP is false. ++ */ ++ acx_sem_unlock(adev); ++ ++ log(L_INIT, "closed device\n"); ++ FN_EXIT0; ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acxpci_i_tx_timeout ++** ++** Called from network core. Must not sleep! ++*/ ++static void ++acxpci_i_tx_timeout(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ unsigned int tx_num_cleaned; ++ ++ FN_ENTER; ++ ++ acx_lock(adev, flags); ++ ++ /* clean processed tx descs, they may have been completely full */ ++ tx_num_cleaned = acxpci_l_clean_txdesc(adev); ++ ++ /* nothing cleaned, yet (almost) no free buffers available? ++ * --> clean all tx descs, no matter which status!! ++ * Note that I strongly suspect that doing emergency cleaning ++ * may confuse the firmware. This is a last ditch effort to get ++ * ANYTHING to work again... ++ * ++ * TODO: it's best to simply reset & reinit hw from scratch... ++ */ ++ if ((adev->tx_free <= TX_EMERG_CLEAN) && (tx_num_cleaned == 0)) { ++ printk("%s: FAILED to free any of the many full tx buffers. " ++ "Switching to emergency freeing. " ++ "Please report!\n", ndev->name); ++ acxpci_l_clean_txdesc_emergency(adev); ++ } ++ ++ if (acx_queue_stopped(ndev) && (ACX_STATUS_4_ASSOCIATED == adev->status)) ++ acx_wake_queue(ndev, "after tx timeout"); ++ ++ /* stall may have happened due to radio drift, so recalib radio */ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_CMD_RADIO_RECALIB); ++ ++ /* do unimportant work last */ ++ printk("%s: tx timeout!\n", ndev->name); ++ adev->stats.tx_errors++; ++ ++ acx_unlock(adev, flags); ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxpci_i_set_multicast_list ++** FIXME: most likely needs refinement ++*/ ++static void ++acxpci_i_set_multicast_list(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ ++ FN_ENTER; ++ ++ acx_lock(adev, flags); ++ ++ /* firmwares don't have allmulti capability, ++ * so just use promiscuous mode instead in this case. */ ++ if (ndev->flags & (IFF_PROMISC|IFF_ALLMULTI)) { ++ SET_BIT(adev->rx_config_1, RX_CFG1_RCV_PROMISCUOUS); ++ CLEAR_BIT(adev->rx_config_1, RX_CFG1_FILTER_ALL_MULTI); ++ SET_BIT(adev->set_mask, SET_RXCONFIG); ++ /* let kernel know in case *we* needed to set promiscuous */ ++ ndev->flags |= (IFF_PROMISC|IFF_ALLMULTI); ++ } else { ++ CLEAR_BIT(adev->rx_config_1, RX_CFG1_RCV_PROMISCUOUS); ++ SET_BIT(adev->rx_config_1, RX_CFG1_FILTER_ALL_MULTI); ++ SET_BIT(adev->set_mask, SET_RXCONFIG); ++ ndev->flags &= ~(IFF_PROMISC|IFF_ALLMULTI); ++ } ++ ++ /* cannot update card settings directly here, atomic context */ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_UPDATE_CARD_CFG); ++ ++ acx_unlock(adev, flags); ++ ++ FN_EXIT0; ++} ++ ++ ++/*************************************************************** ++** acxpci_l_process_rxdesc ++** ++** Called directly and only from the IRQ handler ++*/ ++ ++#if !ACX_DEBUG ++static inline void log_rxbuffer(const acx_device_t *adev) {} ++#else ++static void ++log_rxbuffer(const acx_device_t *adev) ++{ ++ register const struct rxhostdesc *rxhostdesc; ++ int i; ++ /* no FN_ENTER here, we don't want that */ ++ ++ rxhostdesc = adev->rxhostdesc_start; ++ if (unlikely(!rxhostdesc)) return; ++ for (i = 0; i < RX_CNT; i++) { ++ if ((rxhostdesc->Ctl_16 & cpu_to_le16(DESC_CTL_HOSTOWN)) ++ && (rxhostdesc->Status & cpu_to_le32(DESC_STATUS_FULL))) ++ printk("rx: buf %d full\n", i); ++ rxhostdesc++; ++ } ++} ++#endif ++ ++static void ++acxpci_l_process_rxdesc(acx_device_t *adev) ++{ ++ register rxhostdesc_t *hostdesc; ++ unsigned count, tail; ++ ++ FN_ENTER; ++ ++ if (unlikely(acx_debug & L_BUFR)) ++ log_rxbuffer(adev); ++ ++ /* First, have a loop to determine the first descriptor that's ++ * full, just in case there's a mismatch between our current ++ * rx_tail and the full descriptor we're supposed to handle. */ ++ tail = adev->rx_tail; ++ count = RX_CNT; ++ while (1) { ++ hostdesc = &adev->rxhostdesc_start[tail]; ++ /* advance tail regardless of outcome of the below test */ ++ tail = (tail + 1) % RX_CNT; ++ ++ if ((hostdesc->Ctl_16 & cpu_to_le16(DESC_CTL_HOSTOWN)) ++ && (hostdesc->Status & cpu_to_le32(DESC_STATUS_FULL))) ++ break; /* found it! */ ++ ++ if (unlikely(!--count)) /* hmm, no luck: all descs empty, bail out */ ++ goto end; ++ } ++ ++ /* now process descriptors, starting with the first we figured out */ ++ while (1) { ++ log(L_BUFR, "rx: tail=%u Ctl_16=%04X Status=%08X\n", ++ tail, hostdesc->Ctl_16, hostdesc->Status); ++ ++ acx_l_process_rxbuf(adev, hostdesc->data); ++ ++ hostdesc->Status = 0; ++ /* flush all writes before adapter sees CTL_HOSTOWN change */ ++ wmb(); ++ /* Host no longer owns this, needs to be LAST */ ++ CLEAR_BIT(hostdesc->Ctl_16, cpu_to_le16(DESC_CTL_HOSTOWN)); ++ ++ /* ok, descriptor is handled, now check the next descriptor */ ++ hostdesc = &adev->rxhostdesc_start[tail]; ++ ++ /* if next descriptor is empty, then bail out */ ++ if (!(hostdesc->Ctl_16 & cpu_to_le16(DESC_CTL_HOSTOWN)) ++ || !(hostdesc->Status & cpu_to_le32(DESC_STATUS_FULL))) ++ break; ++ ++ tail = (tail + 1) % RX_CNT; ++ } ++end: ++ adev->rx_tail = tail; ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxpci_i_interrupt ++** ++** IRQ handler (atomic context, must not sleep, blah, blah) ++*/ ++ ++/* scan is complete. all frames now on the receive queue are valid */ ++#define INFO_SCAN_COMPLETE 0x0001 ++#define INFO_WEP_KEY_NOT_FOUND 0x0002 ++/* hw has been reset as the result of a watchdog timer timeout */ ++#define INFO_WATCH_DOG_RESET 0x0003 ++/* failed to send out NULL frame from PS mode notification to AP */ ++/* recommended action: try entering 802.11 PS mode again */ ++#define INFO_PS_FAIL 0x0004 ++/* encryption/decryption process on a packet failed */ ++#define INFO_IV_ICV_FAILURE 0x0005 ++ ++/* Info mailbox format: ++2 bytes: type ++2 bytes: status ++more bytes may follow ++ rumors say about status: ++ 0x0000 info available (set by hw) ++ 0x0001 information received (must be set by host) ++ 0x1000 info available, mailbox overflowed (messages lost) (set by hw) ++ but in practice we've seen: ++ 0x9000 when we did not set status to 0x0001 on prev message ++ 0x1001 when we did set it ++ 0x0000 was never seen ++ conclusion: this is really a bitfield: ++ 0x1000 is 'info available' bit ++ 'mailbox overflowed' bit is 0x8000, not 0x1000 ++ value of 0x0000 probably means that there are no messages at all ++ P.S. I dunno how in hell hw is supposed to notice that messages are lost - ++ it does NOT clear bit 0x0001, and this bit will probably stay forever set ++ after we set it once. Let's hope this will be fixed in firmware someday ++*/ ++ ++static void ++handle_info_irq(acx_device_t *adev) ++{ ++#if ACX_DEBUG ++ static const char * const info_type_msg[] = { ++ "(unknown)", ++ "scan complete", ++ "WEP key not found", ++ "internal watchdog reset was done", ++ "failed to send powersave (NULL frame) notification to AP", ++ "encrypt/decrypt on a packet has failed", ++ "TKIP tx keys disabled", ++ "TKIP rx keys disabled", ++ "TKIP rx: key ID not found", ++ "???", ++ "???", ++ "???", ++ "???", ++ "???", ++ "???", ++ "???", ++ "TKIP IV value exceeds thresh" ++ }; ++#endif ++ u32 info_type, info_status; ++ ++ info_type = readl(adev->info_area); ++ info_status = (info_type >> 16); ++ info_type = (u16)info_type; ++ ++ /* inform fw that we have read this info message */ ++ writel(info_type | 0x00010000, adev->info_area); ++ write_reg16(adev, IO_ACX_INT_TRIG, INT_TRIG_INFOACK); ++ write_flush(adev); ++ ++ log(L_CTL, "info_type:%04X info_status:%04X\n", ++ info_type, info_status); ++ ++ log(L_IRQ, "got Info IRQ: status %04X type %04X: %s\n", ++ info_status, info_type, ++ info_type_msg[(info_type >= VEC_SIZE(info_type_msg)) ? ++ 0 : info_type] ++ ); ++} ++ ++ ++static void ++log_unusual_irq(u16 irqtype) { ++ /* ++ if (!printk_ratelimit()) ++ return; ++ */ ++ ++ printk("acx: got"); ++ if (irqtype & HOST_INT_RX_DATA) { ++ printk(" Rx_Data"); ++ } ++ /* HOST_INT_TX_COMPLETE */ ++ if (irqtype & HOST_INT_TX_XFER) { ++ printk(" Tx_Xfer"); ++ } ++ /* HOST_INT_RX_COMPLETE */ ++ if (irqtype & HOST_INT_DTIM) { ++ printk(" DTIM"); ++ } ++ if (irqtype & HOST_INT_BEACON) { ++ printk(" Beacon"); ++ } ++ if (irqtype & HOST_INT_TIMER) { ++ log(L_IRQ, " Timer"); ++ } ++ if (irqtype & HOST_INT_KEY_NOT_FOUND) { ++ printk(" Key_Not_Found"); ++ } ++ if (irqtype & HOST_INT_IV_ICV_FAILURE) { ++ printk(" IV_ICV_Failure (crypto)"); ++ } ++ /* HOST_INT_CMD_COMPLETE */ ++ /* HOST_INT_INFO */ ++ if (irqtype & HOST_INT_OVERFLOW) { ++ printk(" Overflow"); ++ } ++ if (irqtype & HOST_INT_PROCESS_ERROR) { ++ printk(" Process_Error"); ++ } ++ /* HOST_INT_SCAN_COMPLETE */ ++ if (irqtype & HOST_INT_FCS_THRESHOLD) { ++ printk(" FCS_Threshold"); ++ } ++ if (irqtype & HOST_INT_UNKNOWN) { ++ printk(" Unknown"); ++ } ++ printk(" IRQ(s)\n"); ++} ++ ++ ++static void ++update_link_quality_led(acx_device_t *adev) ++{ ++ int qual; ++ ++ qual = acx_signal_determine_quality(adev->wstats.qual.level, adev->wstats.qual.noise); ++ if (qual > adev->brange_max_quality) ++ qual = adev->brange_max_quality; ++ ++ if (time_after(jiffies, adev->brange_time_last_state_change + ++ (HZ/2 - HZ/2 * (unsigned long)qual / adev->brange_max_quality ) )) { ++ acxpci_l_power_led(adev, (adev->brange_last_state == 0)); ++ adev->brange_last_state ^= 1; /* toggle */ ++ adev->brange_time_last_state_change = jiffies; ++ } ++} ++ ++ ++#define MAX_IRQLOOPS_PER_JIFFY (20000/HZ) /* a la orinoco.c */ ++ ++static irqreturn_t ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19) ++acxpci_i_interrupt(int irq, void *dev_id) ++#else ++acxpci_i_interrupt(int irq, void *dev_id, struct pt_regs *regs) ++#endif ++{ ++ acx_device_t *adev; ++ unsigned long flags; ++ unsigned int irqcount = MAX_IRQLOOPS_PER_JIFFY; ++ register u16 irqtype; ++ u16 unmasked; ++ ++ adev = ndev2adev((struct net_device*)dev_id); ++ ++ /* LOCKING: can just spin_lock() since IRQs are disabled anyway. ++ * I am paranoid */ ++ acx_lock(adev, flags); ++ ++ unmasked = read_reg16(adev, IO_ACX_IRQ_STATUS_CLEAR); ++ if (unlikely(0xffff == unmasked)) { ++ /* 0xffff value hints at missing hardware, ++ * so don't do anything. ++ * Not very clean, but other drivers do the same... */ ++ log(L_IRQ, "IRQ type:FFFF - device removed? IRQ_NONE\n"); ++ goto none; ++ } ++ ++ /* We will check only "interesting" IRQ types */ ++ irqtype = unmasked & ~adev->irq_mask; ++ if (!irqtype) { ++ /* We are on a shared IRQ line and it wasn't our IRQ */ ++ log(L_IRQ, "IRQ type:%04X, mask:%04X - all are masked, IRQ_NONE\n", ++ unmasked, adev->irq_mask); ++ goto none; ++ } ++ ++ /* Done here because IRQ_NONEs taking three lines of log ++ ** drive me crazy */ ++ FN_ENTER; ++ ++#define IRQ_ITERATE 1 ++#if IRQ_ITERATE ++if (jiffies != adev->irq_last_jiffies) { ++ adev->irq_loops_this_jiffy = 0; ++ adev->irq_last_jiffies = jiffies; ++} ++ ++/* safety condition; we'll normally abort loop below ++ * in case no IRQ type occurred */ ++while (likely(--irqcount)) { ++#endif ++ /* ACK all IRQs ASAP */ ++ write_reg16(adev, IO_ACX_IRQ_ACK, 0xffff); ++ ++ log(L_IRQ, "IRQ type:%04X, mask:%04X, type & ~mask:%04X\n", ++ unmasked, adev->irq_mask, irqtype); ++ ++ /* Handle most important IRQ types first */ ++ if (irqtype & HOST_INT_RX_COMPLETE) { ++ log(L_IRQ, "got Rx_Complete IRQ\n"); ++ acxpci_l_process_rxdesc(adev); ++ } ++ if (irqtype & HOST_INT_TX_COMPLETE) { ++ log(L_IRQ, "got Tx_Complete IRQ\n"); ++ /* don't clean up on each Tx complete, wait a bit ++ * unless we're going towards full, in which case ++ * we do it immediately, too (otherwise we might lockup ++ * with a full Tx buffer if we go into ++ * acxpci_l_clean_txdesc() at a time when we won't wakeup ++ * the net queue in there for some reason...) */ ++ if (adev->tx_free <= TX_START_CLEAN) { ++#if TX_CLEANUP_IN_SOFTIRQ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_TX_CLEANUP); ++#else ++ acxpci_l_clean_txdesc(adev); ++#endif ++ } ++ } ++ ++ /* Less frequent ones */ ++ if (irqtype & (0 ++ | HOST_INT_CMD_COMPLETE ++ | HOST_INT_INFO ++ | HOST_INT_SCAN_COMPLETE ++ )) { ++ if (irqtype & HOST_INT_CMD_COMPLETE) { ++ log(L_IRQ, "got Command_Complete IRQ\n"); ++ /* save the state for the running issue_cmd() */ ++ SET_BIT(adev->irq_status, HOST_INT_CMD_COMPLETE); ++ } ++ if (irqtype & HOST_INT_INFO) { ++ handle_info_irq(adev); ++ } ++ if (irqtype & HOST_INT_SCAN_COMPLETE) { ++ log(L_IRQ, "got Scan_Complete IRQ\n"); ++ /* need to do that in process context */ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_COMPLETE_SCAN); ++ /* remember that fw is not scanning anymore */ ++ SET_BIT(adev->irq_status, HOST_INT_SCAN_COMPLETE); ++ } ++ } ++ ++ /* These we just log, but either they happen rarely ++ * or we keep them masked out */ ++ if (irqtype & (0 ++ | HOST_INT_RX_DATA ++ /* | HOST_INT_TX_COMPLETE */ ++ | HOST_INT_TX_XFER ++ /* | HOST_INT_RX_COMPLETE */ ++ | HOST_INT_DTIM ++ | HOST_INT_BEACON ++ | HOST_INT_TIMER ++ | HOST_INT_KEY_NOT_FOUND ++ | HOST_INT_IV_ICV_FAILURE ++ /* | HOST_INT_CMD_COMPLETE */ ++ /* | HOST_INT_INFO */ ++ | HOST_INT_OVERFLOW ++ | HOST_INT_PROCESS_ERROR ++ /* | HOST_INT_SCAN_COMPLETE */ ++ | HOST_INT_FCS_THRESHOLD ++ | HOST_INT_UNKNOWN ++ )) { ++ log_unusual_irq(irqtype); ++ } ++ ++#if IRQ_ITERATE ++ unmasked = read_reg16(adev, IO_ACX_IRQ_STATUS_CLEAR); ++ irqtype = unmasked & ~adev->irq_mask; ++ /* Bail out if no new IRQ bits or if all are masked out */ ++ if (!irqtype) ++ break; ++ ++ if (unlikely(++adev->irq_loops_this_jiffy > MAX_IRQLOOPS_PER_JIFFY)) { ++ printk(KERN_ERR "acx: too many interrupts per jiffy!\n"); ++ /* Looks like card floods us with IRQs! Try to stop that */ ++ write_reg16(adev, IO_ACX_IRQ_MASK, 0xffff); ++ /* This will short-circuit all future attempts to handle IRQ. ++ * We cant do much more... */ ++ adev->irq_mask = 0; ++ break; ++ } ++} ++#endif ++ /* Routine to perform blink with range */ ++ if (unlikely(adev->led_power == 2)) ++ update_link_quality_led(adev); ++ ++/* handled: */ ++ /* write_flush(adev); - not needed, last op was read anyway */ ++ acx_unlock(adev, flags); ++ FN_EXIT0; ++ return IRQ_HANDLED; ++ ++none: ++ acx_unlock(adev, flags); ++ return IRQ_NONE; ++} ++ ++ ++/*********************************************************************** ++** acxpci_l_power_led ++*/ ++void ++acxpci_l_power_led(acx_device_t *adev, int enable) ++{ ++ u16 gpio_pled = IS_ACX111(adev) ? 0x0040 : 0x0800; ++ ++ /* A hack. Not moving message rate limiting to adev->xxx ++ * (it's only a debug message after all) */ ++ static int rate_limit = 0; ++ ++ if (rate_limit++ < 3) ++ log(L_IOCTL, "Please report in case toggling the power " ++ "LED doesn't work for your card!\n"); ++ if (enable) ++ write_reg16(adev, IO_ACX_GPIO_OUT, ++ read_reg16(adev, IO_ACX_GPIO_OUT) & ~gpio_pled); ++ else ++ write_reg16(adev, IO_ACX_GPIO_OUT, ++ read_reg16(adev, IO_ACX_GPIO_OUT) | gpio_pled); ++} ++ ++ ++/*********************************************************************** ++** Ioctls ++*/ ++ ++/*********************************************************************** ++*/ ++int ++acx111pci_ioctl_info( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ struct iw_param *vwrq, ++ char *extra) ++{ ++#if ACX_DEBUG > 1 ++ acx_device_t *adev = ndev2adev(ndev); ++ rxdesc_t *rxdesc; ++ txdesc_t *txdesc; ++ rxhostdesc_t *rxhostdesc; ++ txhostdesc_t *txhostdesc; ++ struct acx111_ie_memoryconfig memconf; ++ struct acx111_ie_queueconfig queueconf; ++ unsigned long flags; ++ int i; ++ char memmap[0x34]; ++ char rxconfig[0x8]; ++ char fcserror[0x8]; ++ char ratefallback[0x5]; ++ ++ if ( !(acx_debug & (L_IOCTL|L_DEBUG)) ) ++ return OK; ++ /* using printk() since we checked debug flag already */ ++ ++ acx_sem_lock(adev); ++ ++ if (!IS_ACX111(adev)) { ++ printk("acx111-specific function called " ++ "with non-acx111 chip, aborting\n"); ++ goto end_ok; ++ } ++ ++ /* get Acx111 Memory Configuration */ ++ memset(&memconf, 0, sizeof(memconf)); ++ /* BTW, fails with 12 (Write only) error code. ++ ** Retained for easy testing of issue_cmd error handling :) */ ++ acx_s_interrogate(adev, &memconf, ACX1xx_IE_QUEUE_CONFIG); ++ ++ /* get Acx111 Queue Configuration */ ++ memset(&queueconf, 0, sizeof(queueconf)); ++ acx_s_interrogate(adev, &queueconf, ACX1xx_IE_MEMORY_CONFIG_OPTIONS); ++ ++ /* get Acx111 Memory Map */ ++ memset(memmap, 0, sizeof(memmap)); ++ acx_s_interrogate(adev, &memmap, ACX1xx_IE_MEMORY_MAP); ++ ++ /* get Acx111 Rx Config */ ++ memset(rxconfig, 0, sizeof(rxconfig)); ++ acx_s_interrogate(adev, &rxconfig, ACX1xx_IE_RXCONFIG); ++ ++ /* get Acx111 fcs error count */ ++ memset(fcserror, 0, sizeof(fcserror)); ++ acx_s_interrogate(adev, &fcserror, ACX1xx_IE_FCS_ERROR_COUNT); ++ ++ /* get Acx111 rate fallback */ ++ memset(ratefallback, 0, sizeof(ratefallback)); ++ acx_s_interrogate(adev, &ratefallback, ACX1xx_IE_RATE_FALLBACK); ++ ++ /* force occurrence of a beacon interrupt */ ++ /* TODO: comment why is this necessary */ ++ write_reg16(adev, IO_ACX_HINT_TRIG, HOST_INT_BEACON); ++ ++ /* dump Acx111 Mem Configuration */ ++ printk("dump mem config:\n" ++ "data read: %d, struct size: %d\n" ++ "Number of stations: %1X\n" ++ "Memory block size: %1X\n" ++ "tx/rx memory block allocation: %1X\n" ++ "count rx: %X / tx: %X queues\n" ++ "options %1X\n" ++ "fragmentation %1X\n" ++ "Rx Queue 1 Count Descriptors: %X\n" ++ "Rx Queue 1 Host Memory Start: %X\n" ++ "Tx Queue 1 Count Descriptors: %X\n" ++ "Tx Queue 1 Attributes: %X\n", ++ memconf.len, (int) sizeof(memconf), ++ memconf.no_of_stations, ++ memconf.memory_block_size, ++ memconf.tx_rx_memory_block_allocation, ++ memconf.count_rx_queues, memconf.count_tx_queues, ++ memconf.options, ++ memconf.fragmentation, ++ memconf.rx_queue1_count_descs, ++ acx2cpu(memconf.rx_queue1_host_rx_start), ++ memconf.tx_queue1_count_descs, ++ memconf.tx_queue1_attributes); ++ ++ /* dump Acx111 Queue Configuration */ ++ printk("dump queue head:\n" ++ "data read: %d, struct size: %d\n" ++ "tx_memory_block_address (from card): %X\n" ++ "rx_memory_block_address (from card): %X\n" ++ "rx1_queue address (from card): %X\n" ++ "tx1_queue address (from card): %X\n" ++ "tx1_queue attributes (from card): %X\n", ++ queueconf.len, (int) sizeof(queueconf), ++ queueconf.tx_memory_block_address, ++ queueconf.rx_memory_block_address, ++ queueconf.rx1_queue_address, ++ queueconf.tx1_queue_address, ++ queueconf.tx1_attributes); ++ ++ /* dump Acx111 Mem Map */ ++ printk("dump mem map:\n" ++ "data read: %d, struct size: %d\n" ++ "Code start: %X\n" ++ "Code end: %X\n" ++ "WEP default key start: %X\n" ++ "WEP default key end: %X\n" ++ "STA table start: %X\n" ++ "STA table end: %X\n" ++ "Packet template start: %X\n" ++ "Packet template end: %X\n" ++ "Queue memory start: %X\n" ++ "Queue memory end: %X\n" ++ "Packet memory pool start: %X\n" ++ "Packet memory pool end: %X\n" ++ "iobase: %p\n" ++ "iobase2: %p\n", ++ *((u16 *)&memmap[0x02]), (int) sizeof(memmap), ++ *((u32 *)&memmap[0x04]), ++ *((u32 *)&memmap[0x08]), ++ *((u32 *)&memmap[0x0C]), ++ *((u32 *)&memmap[0x10]), ++ *((u32 *)&memmap[0x14]), ++ *((u32 *)&memmap[0x18]), ++ *((u32 *)&memmap[0x1C]), ++ *((u32 *)&memmap[0x20]), ++ *((u32 *)&memmap[0x24]), ++ *((u32 *)&memmap[0x28]), ++ *((u32 *)&memmap[0x2C]), ++ *((u32 *)&memmap[0x30]), ++ adev->iobase, ++ adev->iobase2); ++ ++ /* dump Acx111 Rx Config */ ++ printk("dump rx config:\n" ++ "data read: %d, struct size: %d\n" ++ "rx config: %X\n" ++ "rx filter config: %X\n", ++ *((u16 *)&rxconfig[0x02]), (int) sizeof(rxconfig), ++ *((u16 *)&rxconfig[0x04]), ++ *((u16 *)&rxconfig[0x06])); ++ ++ /* dump Acx111 fcs error */ ++ printk("dump fcserror:\n" ++ "data read: %d, struct size: %d\n" ++ "fcserrors: %X\n", ++ *((u16 *)&fcserror[0x02]), (int) sizeof(fcserror), ++ *((u32 *)&fcserror[0x04])); ++ ++ /* dump Acx111 rate fallback */ ++ printk("dump rate fallback:\n" ++ "data read: %d, struct size: %d\n" ++ "ratefallback: %X\n", ++ *((u16 *)&ratefallback[0x02]), (int) sizeof(ratefallback), ++ *((u8 *)&ratefallback[0x04])); ++ ++ /* protect against IRQ */ ++ acx_lock(adev, flags); ++ ++ /* dump acx111 internal rx descriptor ring buffer */ ++ rxdesc = adev->rxdesc_start; ++ ++ /* loop over complete receive pool */ ++ if (rxdesc) for (i = 0; i < RX_CNT; i++) { ++ printk("\ndump internal rxdesc %d:\n" ++ "mem pos %p\n" ++ "next 0x%X\n" ++ "acx mem pointer (dynamic) 0x%X\n" ++ "CTL (dynamic) 0x%X\n" ++ "Rate (dynamic) 0x%X\n" ++ "RxStatus (dynamic) 0x%X\n" ++ "Mod/Pre (dynamic) 0x%X\n", ++ i, ++ rxdesc, ++ acx2cpu(rxdesc->pNextDesc), ++ acx2cpu(rxdesc->ACXMemPtr), ++ rxdesc->Ctl_8, ++ rxdesc->rate, ++ rxdesc->error, ++ rxdesc->SNR); ++ rxdesc++; ++ } ++ ++ /* dump host rx descriptor ring buffer */ ++ ++ rxhostdesc = adev->rxhostdesc_start; ++ ++ /* loop over complete receive pool */ ++ if (rxhostdesc) for (i = 0; i < RX_CNT; i++) { ++ printk("\ndump host rxdesc %d:\n" ++ "mem pos %p\n" ++ "buffer mem pos 0x%X\n" ++ "buffer mem offset 0x%X\n" ++ "CTL 0x%X\n" ++ "Length 0x%X\n" ++ "next 0x%X\n" ++ "Status 0x%X\n", ++ i, ++ rxhostdesc, ++ acx2cpu(rxhostdesc->data_phy), ++ rxhostdesc->data_offset, ++ le16_to_cpu(rxhostdesc->Ctl_16), ++ le16_to_cpu(rxhostdesc->length), ++ acx2cpu(rxhostdesc->desc_phy_next), ++ rxhostdesc->Status); ++ rxhostdesc++; ++ } ++ ++ /* dump acx111 internal tx descriptor ring buffer */ ++ txdesc = adev->txdesc_start; ++ ++ /* loop over complete transmit pool */ ++ if (txdesc) for (i = 0; i < TX_CNT; i++) { ++ printk("\ndump internal txdesc %d:\n" ++ "size 0x%X\n" ++ "mem pos %p\n" ++ "next 0x%X\n" ++ "acx mem pointer (dynamic) 0x%X\n" ++ "host mem pointer (dynamic) 0x%X\n" ++ "length (dynamic) 0x%X\n" ++ "CTL (dynamic) 0x%X\n" ++ "CTL2 (dynamic) 0x%X\n" ++ "Status (dynamic) 0x%X\n" ++ "Rate (dynamic) 0x%X\n", ++ i, ++ (int) sizeof(struct txdesc), ++ txdesc, ++ acx2cpu(txdesc->pNextDesc), ++ acx2cpu(txdesc->AcxMemPtr), ++ acx2cpu(txdesc->HostMemPtr), ++ le16_to_cpu(txdesc->total_length), ++ txdesc->Ctl_8, ++ txdesc->Ctl2_8, txdesc->error, ++ txdesc->u.r1.rate); ++ txdesc = advance_txdesc(adev, txdesc, 1); ++ } ++ ++ /* dump host tx descriptor ring buffer */ ++ ++ txhostdesc = adev->txhostdesc_start; ++ ++ /* loop over complete host send pool */ ++ if (txhostdesc) for (i = 0; i < TX_CNT * 2; i++) { ++ printk("\ndump host txdesc %d:\n" ++ "mem pos %p\n" ++ "buffer mem pos 0x%X\n" ++ "buffer mem offset 0x%X\n" ++ "CTL 0x%X\n" ++ "Length 0x%X\n" ++ "next 0x%X\n" ++ "Status 0x%X\n", ++ i, ++ txhostdesc, ++ acx2cpu(txhostdesc->data_phy), ++ txhostdesc->data_offset, ++ le16_to_cpu(txhostdesc->Ctl_16), ++ le16_to_cpu(txhostdesc->length), ++ acx2cpu(txhostdesc->desc_phy_next), ++ le32_to_cpu(txhostdesc->Status)); ++ txhostdesc++; ++ } ++ ++ /* write_reg16(adev, 0xb4, 0x4); */ ++ ++ acx_unlock(adev, flags); ++end_ok: ++ ++ acx_sem_unlock(adev); ++#endif /* ACX_DEBUG */ ++ return OK; ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acx100pci_ioctl_set_phy_amp_bias( ++ struct net_device *ndev, ++ struct iw_request_info *info, ++ struct iw_param *vwrq, ++ char *extra) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ u16 gpio_old; ++ ++ if (!IS_ACX100(adev)) { ++ /* WARNING!!! ++ * Removing this check *might* damage ++ * hardware, since we're tweaking GPIOs here after all!!! ++ * You've been warned... ++ * WARNING!!! */ ++ printk("acx: sorry, setting bias level for non-acx100 " ++ "is not supported yet\n"); ++ return OK; ++ } ++ ++ if (*extra > 7) { ++ printk("acx: invalid bias parameter, range is 0-7\n"); ++ return -EINVAL; ++ } ++ ++ acx_sem_lock(adev); ++ ++ /* Need to lock accesses to [IO_ACX_GPIO_OUT]: ++ * IRQ handler uses it to update LED */ ++ acx_lock(adev, flags); ++ gpio_old = read_reg16(adev, IO_ACX_GPIO_OUT); ++ write_reg16(adev, IO_ACX_GPIO_OUT, (gpio_old & 0xf8ff) | ((u16)*extra << 8)); ++ acx_unlock(adev, flags); ++ ++ log(L_DEBUG, "gpio_old: 0x%04X\n", gpio_old); ++ printk("%s: PHY power amplifier bias: old:%d, new:%d\n", ++ ndev->name, ++ (gpio_old & 0x0700) >> 8, (unsigned char)*extra); ++ ++ acx_sem_unlock(adev); ++ ++ return OK; ++} ++ ++ ++/*************************************************************** ++** acxpci_l_alloc_tx ++** Actually returns a txdesc_t* ptr ++** ++** FIXME: in case of fragments, should allocate multiple descrs ++** after figuring out how many we need and whether we still have ++** sufficiently many. ++*/ ++tx_t* ++acxpci_l_alloc_tx(acx_device_t *adev) ++{ ++ struct txdesc *txdesc; ++ unsigned head; ++ u8 ctl8; ++ ++ FN_ENTER; ++ ++ if (unlikely(!adev->tx_free)) { ++ printk("acx: BUG: no free txdesc left\n"); ++ txdesc = NULL; ++ goto end; ++ } ++ ++ head = adev->tx_head; ++ txdesc = get_txdesc(adev, head); ++ ctl8 = txdesc->Ctl_8; ++ ++ /* 2005-10-11: there were several bug reports on this happening ++ ** but now cause seems to be understood & fixed */ ++ if (unlikely(DESC_CTL_HOSTOWN != (ctl8 & DESC_CTL_ACXDONE_HOSTOWN))) { ++ /* whoops, descr at current index is not free, so probably ++ * ring buffer already full */ ++ printk("acx: BUG: tx_head:%d Ctl8:0x%02X - failed to find " ++ "free txdesc\n", head, ctl8); ++ txdesc = NULL; ++ goto end; ++ } ++ ++ /* Needed in case txdesc won't be eventually submitted for tx */ ++ txdesc->Ctl_8 = DESC_CTL_ACXDONE_HOSTOWN; ++ ++ adev->tx_free--; ++ log(L_BUFT, "tx: got desc %u, %u remain\n", ++ head, adev->tx_free); ++ /* Keep a few free descs between head and tail of tx ring. ++ ** It is not absolutely needed, just feels safer */ ++ if (adev->tx_free < TX_STOP_QUEUE) { ++ log(L_BUF, "stop queue (%u tx desc left)\n", ++ adev->tx_free); ++ acx_stop_queue(adev->ndev, NULL); ++ } ++ ++ /* returning current descriptor, so advance to next free one */ ++ adev->tx_head = (head + 1) % TX_CNT; ++end: ++ FN_EXIT0; ++ ++ return (tx_t*)txdesc; ++} ++ ++ ++/*********************************************************************** ++*/ ++void* ++acxpci_l_get_txbuf(acx_device_t *adev, tx_t* tx_opaque) ++{ ++ return get_txhostdesc(adev, (txdesc_t*)tx_opaque)->data; ++} ++ ++ ++/*********************************************************************** ++** acxpci_l_tx_data ++** ++** Can be called from IRQ (rx -> (AP bridging or mgmt response) -> tx). ++** Can be called from acx_i_start_xmit (data frames from net core). ++** ++** FIXME: in case of fragments, should loop over the number of ++** pre-allocated tx descrs, properly setting up transfer data and ++** CTL_xxx flags according to fragment number. ++*/ ++void ++acxpci_l_tx_data(acx_device_t *adev, tx_t* tx_opaque, int len) ++{ ++ txdesc_t *txdesc = (txdesc_t*)tx_opaque; ++ txhostdesc_t *hostdesc1, *hostdesc2; ++ client_t *clt; ++ u16 rate_cur; ++ u8 Ctl_8, Ctl2_8; ++ ++ FN_ENTER; ++ ++ /* fw doesn't tx such packets anyhow */ ++ if (unlikely(len < WLAN_HDR_A3_LEN)) ++ goto end; ++ ++ hostdesc1 = get_txhostdesc(adev, txdesc); ++ /* modify flag status in separate variable to be able to write it back ++ * in one big swoop later (also in order to have less device memory ++ * accesses) */ ++ Ctl_8 = txdesc->Ctl_8; ++ Ctl2_8 = 0; /* really need to init it to 0, not txdesc->Ctl2_8, it seems */ ++ ++ hostdesc2 = hostdesc1 + 1; ++ ++ /* DON'T simply set Ctl field to 0 here globally, ++ * it needs to maintain a consistent flag status (those are state flags!!), ++ * otherwise it may lead to severe disruption. Only set or reset particular ++ * flags at the exact moment this is needed... */ ++ ++ /* let chip do RTS/CTS handshaking before sending ++ * in case packet size exceeds threshold */ ++ if (len > adev->rts_threshold) ++ SET_BIT(Ctl2_8, DESC_CTL2_RTS); ++ else ++ CLEAR_BIT(Ctl2_8, DESC_CTL2_RTS); ++ ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_3_AP: ++ clt = acx_l_sta_list_get(adev, ((wlan_hdr_t*)hostdesc1->data)->a1); ++ break; ++ case ACX_MODE_2_STA: ++ clt = adev->ap_client; ++ break; ++#if 0 ++/* testing was done on acx111: */ ++ case ACX_MODE_MONITOR: ++ SET_BIT(Ctl2_8, 0 ++/* sends CTS to self before packet */ ++ + DESC_CTL2_SEQ /* don't increase sequence field */ ++/* not working (looks like good fcs is still added) */ ++ + DESC_CTL2_FCS /* don't add the FCS */ ++/* not tested */ ++ + DESC_CTL2_MORE_FRAG ++/* not tested */ ++ + DESC_CTL2_RETRY /* don't increase retry field */ ++/* not tested */ ++ + DESC_CTL2_POWER /* don't increase power mgmt. field */ ++/* no effect */ ++ + DESC_CTL2_WEP /* encrypt this frame */ ++/* not tested */ ++ + DESC_CTL2_DUR /* don't increase duration field */ ++ ); ++ /* fallthrough */ ++#endif ++ default: /* ACX_MODE_OFF, ACX_MODE_MONITOR */ ++ clt = NULL; ++ break; ++ } ++ ++ rate_cur = clt ? clt->rate_cur : adev->rate_bcast; ++ if (unlikely(!rate_cur)) { ++ printk("acx: driver bug! bad ratemask\n"); ++ goto end; ++ } ++ ++ /* used in tx cleanup routine for auto rate and accounting: */ ++ put_txcr(adev, txdesc, clt, rate_cur); ++ ++ txdesc->total_length = cpu_to_le16(len); ++ hostdesc2->length = cpu_to_le16(len - WLAN_HDR_A3_LEN); ++ if (IS_ACX111(adev)) { ++ /* note that if !txdesc->do_auto, txrate->cur ++ ** has only one nonzero bit */ ++ txdesc->u.r2.rate111 = cpu_to_le16( ++ rate_cur ++ /* WARNING: I was never able to make it work with prism54 AP. ++ ** It was falling down to 1Mbit where shortpre is not applicable, ++ ** and not working at all at "5,11 basic rates only" setting. ++ ** I even didn't see tx packets in radio packet capture. ++ ** Disabled for now --vda */ ++ /*| ((clt->shortpre && clt->cur!=RATE111_1) ? RATE111_SHORTPRE : 0) */ ++ ); ++#ifdef TODO_FIGURE_OUT_WHEN_TO_SET_THIS ++ /* should add this to rate111 above as necessary */ ++ | (clt->pbcc511 ? RATE111_PBCC511 : 0) ++#endif ++ hostdesc1->length = cpu_to_le16(len); ++ } else { /* ACX100 */ ++ u8 rate_100 = clt ? clt->rate_100 : adev->rate_bcast100; ++ txdesc->u.r1.rate = rate_100; ++#ifdef TODO_FIGURE_OUT_WHEN_TO_SET_THIS ++ if (clt->pbcc511) { ++ if (n == RATE100_5 || n == RATE100_11) ++ n |= RATE100_PBCC511; ++ } ++ ++ if (clt->shortpre && (clt->cur != RATE111_1)) ++ SET_BIT(Ctl_8, DESC_CTL_SHORT_PREAMBLE); /* set Short Preamble */ ++#endif ++ /* set autodma and reclaim and 1st mpdu */ ++ SET_BIT(Ctl_8, DESC_CTL_AUTODMA | DESC_CTL_RECLAIM | DESC_CTL_FIRSTFRAG); ++#if ACX_FRAGMENTATION ++ /* SET_BIT(Ctl2_8, DESC_CTL2_MORE_FRAG); cannot set it unconditionally, needs to be set for all non-last fragments */ ++#endif ++ hostdesc1->length = cpu_to_le16(WLAN_HDR_A3_LEN); ++ } ++ /* don't need to clean ack/rts statistics here, already ++ * done on descr cleanup */ ++ ++ /* clears HOSTOWN and ACXDONE bits, thus telling that the descriptors ++ * are now owned by the acx100; do this as LAST operation */ ++ CLEAR_BIT(Ctl_8, DESC_CTL_ACXDONE_HOSTOWN); ++ /* flush writes before we release hostdesc to the adapter here */ ++ wmb(); ++ CLEAR_BIT(hostdesc1->Ctl_16, cpu_to_le16(DESC_CTL_HOSTOWN)); ++ CLEAR_BIT(hostdesc2->Ctl_16, cpu_to_le16(DESC_CTL_HOSTOWN)); ++ ++ /* write back modified flags */ ++ txdesc->Ctl2_8 = Ctl2_8; ++ txdesc->Ctl_8 = Ctl_8; ++ /* unused: txdesc->tx_time = cpu_to_le32(jiffies); */ ++ ++ /* flush writes before we tell the adapter that it's its turn now */ ++ mmiowb(); ++ write_reg16(adev, IO_ACX_INT_TRIG, INT_TRIG_TXPRC); ++ write_flush(adev); ++ ++ /* log the packet content AFTER sending it, ++ * in order to not delay sending any further than absolutely needed ++ * Do separate logs for acx100/111 to have human-readable rates */ ++ if (unlikely(acx_debug & (L_XFER|L_DATA))) { ++ u16 fc = ((wlan_hdr_t*)hostdesc1->data)->fc; ++ if (IS_ACX111(adev)) ++ printk("tx: pkt (%s): len %d " ++ "rate %04X%s status %u\n", ++ acx_get_packet_type_string(le16_to_cpu(fc)), len, ++ le16_to_cpu(txdesc->u.r2.rate111), ++ (le16_to_cpu(txdesc->u.r2.rate111) & RATE111_SHORTPRE) ? "(SPr)" : "", ++ adev->status); ++ else ++ printk("tx: pkt (%s): len %d rate %03u%s status %u\n", ++ acx_get_packet_type_string(fc), len, ++ txdesc->u.r1.rate, ++ (Ctl_8 & DESC_CTL_SHORT_PREAMBLE) ? "(SPr)" : "", ++ adev->status); ++ ++ if (acx_debug & L_DATA) { ++ printk("tx: 802.11 [%d]: ", len); ++ acx_dump_bytes(hostdesc1->data, len); ++ } ++ } ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxpci_l_clean_txdesc ++** ++** This function resets the txdescs' status when the ACX100 ++** signals the TX done IRQ (txdescs have been processed), starting with ++** the pool index of the descriptor which we would use next, ++** in order to make sure that we can be as fast as possible ++** in filling new txdescs. ++** Everytime we get called we know where the next packet to be cleaned is. ++*/ ++ ++#if !ACX_DEBUG ++static inline void log_txbuffer(const acx_device_t *adev) {} ++#else ++static void ++log_txbuffer(acx_device_t *adev) ++{ ++ txdesc_t *txdesc; ++ int i; ++ ++ /* no FN_ENTER here, we don't want that */ ++ /* no locks here, since it's entirely non-critical code */ ++ txdesc = adev->txdesc_start; ++ if (unlikely(!txdesc)) return; ++ printk("tx: desc->Ctl8's:"); ++ for (i = 0; i < TX_CNT; i++) { ++ printk(" %02X", txdesc->Ctl_8); ++ txdesc = advance_txdesc(adev, txdesc, 1); ++ } ++ printk("\n"); ++} ++#endif ++ ++ ++static void ++handle_tx_error(acx_device_t *adev, u8 error, unsigned int finger) ++{ ++ const char *err = "unknown error"; ++ ++ /* hmm, should we handle this as a mask ++ * of *several* bits? ++ * For now I think only caring about ++ * individual bits is ok... */ ++ switch (error) { ++ case 0x01: ++ err = "no Tx due to error in other fragment"; ++ adev->wstats.discard.fragment++; ++ break; ++ case 0x02: ++ err = "Tx aborted"; ++ adev->stats.tx_aborted_errors++; ++ break; ++ case 0x04: ++ err = "Tx desc wrong parameters"; ++ adev->wstats.discard.misc++; ++ break; ++ case 0x08: ++ err = "WEP key not found"; ++ adev->wstats.discard.misc++; ++ break; ++ case 0x10: ++ err = "MSDU lifetime timeout? - try changing " ++ "'iwconfig retry lifetime XXX'"; ++ adev->wstats.discard.misc++; ++ break; ++ case 0x20: ++ err = "excessive Tx retries due to either distance " ++ "too high or unable to Tx or Tx frame error - " ++ "try changing 'iwconfig txpower XXX' or " ++ "'sens'itivity or 'retry'"; ++ adev->wstats.discard.retries++; ++ /* Tx error 0x20 also seems to occur on ++ * overheating, so I'm not sure whether we ++ * actually want to do aggressive radio recalibration, ++ * since people maybe won't notice then that their hardware ++ * is slowly getting cooked... ++ * Or is it still a safe long distance from utter ++ * radio non-functionality despite many radio recalibs ++ * to final destructive overheating of the hardware? ++ * In this case we really should do recalib here... ++ * I guess the only way to find out is to do a ++ * potentially fatal self-experiment :-\ ++ * Or maybe only recalib in case we're using Tx ++ * rate auto (on errors switching to lower speed ++ * --> less heat?) or 802.11 power save mode? ++ * ++ * ok, just do it. */ ++ if (++adev->retry_errors_msg_ratelimit % 4 == 0) { ++ if (adev->retry_errors_msg_ratelimit <= 20) { ++ printk("%s: several excessive Tx " ++ "retry errors occurred, attempting " ++ "to recalibrate radio. Radio " ++ "drift might be caused by increasing " ++ "card temperature, please check the card " ++ "before it's too late!\n", ++ adev->ndev->name); ++ if (adev->retry_errors_msg_ratelimit == 20) ++ printk("disabling above message\n"); ++ } ++ ++ acx_schedule_task(adev, ACX_AFTER_IRQ_CMD_RADIO_RECALIB); ++ } ++ break; ++ case 0x40: ++ err = "Tx buffer overflow"; ++ adev->stats.tx_fifo_errors++; ++ break; ++ case 0x80: ++ /* possibly ACPI C-state powersaving related!!! ++ * (DMA timeout due to excessively high wakeup ++ * latency after C-state activation!?) ++ * Disable C-State powersaving and try again, ++ * then PLEASE REPORT, I'm VERY interested in ++ * whether my theory is correct that this is ++ * actually the problem here. ++ * In that case, use new Linux idle wakeup latency ++ * requirements kernel API to prevent this issue. */ ++ err = "DMA error"; ++ adev->wstats.discard.misc++; ++ break; ++ } ++ adev->stats.tx_errors++; ++ if (adev->stats.tx_errors <= 20) ++ printk("%s: tx error 0x%02X, buf %02u! (%s)\n", ++ adev->ndev->name, error, finger, err); ++ else ++ printk("%s: tx error 0x%02X, buf %02u!\n", ++ adev->ndev->name, error, finger); ++} ++ ++ ++unsigned int ++acxpci_l_clean_txdesc(acx_device_t *adev) ++{ ++ txdesc_t *txdesc; ++ unsigned finger; ++ int num_cleaned; ++ u16 r111; ++ u8 error, ack_failures, rts_failures, rts_ok, r100; ++ ++ FN_ENTER; ++ ++ if (unlikely(acx_debug & L_DEBUG)) ++ log_txbuffer(adev); ++ ++ log(L_BUFT, "tx: cleaning up bufs from %u\n", adev->tx_tail); ++ ++ /* We know first descr which is not free yet. We advance it as far ++ ** as we see correct bits set in following descs (if next desc ++ ** is NOT free, we shouldn't advance at all). We know that in ++ ** front of tx_tail may be "holes" with isolated free descs. ++ ** We will catch up when all intermediate descs will be freed also */ ++ ++ finger = adev->tx_tail; ++ num_cleaned = 0; ++ while (likely(finger != adev->tx_head)) { ++ txdesc = get_txdesc(adev, finger); ++ ++ /* If we allocated txdesc on tx path but then decided ++ ** to NOT use it, then it will be left as a free "bubble" ++ ** in the "allocated for tx" part of the ring. ++ ** We may meet it on the next ring pass here. */ ++ ++ /* stop if not marked as "tx finished" and "host owned" */ ++ if ((txdesc->Ctl_8 & DESC_CTL_ACXDONE_HOSTOWN) ++ != DESC_CTL_ACXDONE_HOSTOWN) { ++ if (unlikely(!num_cleaned)) { /* maybe remove completely */ ++ log(L_BUFT, "clean_txdesc: tail isn't free. " ++ "tail:%d head:%d\n", ++ adev->tx_tail, adev->tx_head); ++ } ++ break; ++ } ++ ++ /* remember desc values... */ ++ error = txdesc->error; ++ ack_failures = txdesc->ack_failures; ++ rts_failures = txdesc->rts_failures; ++ rts_ok = txdesc->rts_ok; ++ r100 = txdesc->u.r1.rate; ++ r111 = le16_to_cpu(txdesc->u.r2.rate111); ++ ++ /* need to check for certain error conditions before we ++ * clean the descriptor: we still need valid descr data here */ ++ if (unlikely(0x30 & error)) { ++ /* only send IWEVTXDROP in case of retry or lifetime exceeded; ++ * all other errors mean we screwed up locally */ ++ union iwreq_data wrqu; ++ wlan_hdr_t *hdr; ++ txhostdesc_t *hostdesc; ++ ++ hostdesc = get_txhostdesc(adev, txdesc); ++ hdr = (wlan_hdr_t *)hostdesc->data; ++ MAC_COPY(wrqu.addr.sa_data, hdr->a1); ++ wireless_send_event(adev->ndev, IWEVTXDROP, &wrqu, NULL); ++ } ++ ++ /* ...and free the desc */ ++ txdesc->error = 0; ++ txdesc->ack_failures = 0; ++ txdesc->rts_failures = 0; ++ txdesc->rts_ok = 0; ++ /* signal host owning it LAST, since ACX already knows that this ++ ** descriptor is finished since it set Ctl_8 accordingly. */ ++ txdesc->Ctl_8 = DESC_CTL_HOSTOWN; ++ ++ adev->tx_free++; ++ num_cleaned++; ++ ++ if ((adev->tx_free >= TX_START_QUEUE) ++ && (adev->status == ACX_STATUS_4_ASSOCIATED) ++ && (acx_queue_stopped(adev->ndev)) ++ ) { ++ log(L_BUF, "tx: wake queue (avail. Tx desc %u)\n", ++ adev->tx_free); ++ acx_wake_queue(adev->ndev, NULL); ++ } ++ ++ /* do error checking, rate handling and logging ++ * AFTER having done the work, it's faster */ ++ ++ /* do rate handling */ ++ if (adev->rate_auto) { ++ struct client *clt = get_txc(adev, txdesc); ++ if (clt) { ++ u16 cur = get_txr(adev, txdesc); ++ if (clt->rate_cur == cur) { ++ acx_l_handle_txrate_auto(adev, clt, ++ cur, /* intended rate */ ++ r100, r111, /* actually used rate */ ++ (error & 0x30), /* was there an error? */ ++ TX_CNT + TX_CLEAN_BACKLOG - adev->tx_free); ++ } ++ } ++ } ++ ++ if (unlikely(error)) ++ handle_tx_error(adev, error, finger); ++ ++ if (IS_ACX111(adev)) ++ log(L_BUFT, "tx: cleaned %u: !ACK=%u !RTS=%u RTS=%u r111=%04X\n", ++ finger, ack_failures, rts_failures, rts_ok, r111); ++ else ++ log(L_BUFT, "tx: cleaned %u: !ACK=%u !RTS=%u RTS=%u rate=%u\n", ++ finger, ack_failures, rts_failures, rts_ok, r100); ++ ++ /* update pointer for descr to be cleaned next */ ++ finger = (finger + 1) % TX_CNT; ++ } ++ ++ /* remember last position */ ++ adev->tx_tail = finger; ++/* end: */ ++ FN_EXIT1(num_cleaned); ++ return num_cleaned; ++} ++ ++/* clean *all* Tx descriptors, and regardless of their previous state. ++ * Used for brute-force reset handling. */ ++void ++acxpci_l_clean_txdesc_emergency(acx_device_t *adev) ++{ ++ txdesc_t *txdesc; ++ int i; ++ ++ FN_ENTER; ++ ++ for (i = 0; i < TX_CNT; i++) { ++ txdesc = get_txdesc(adev, i); ++ ++ /* free it */ ++ txdesc->ack_failures = 0; ++ txdesc->rts_failures = 0; ++ txdesc->rts_ok = 0; ++ txdesc->error = 0; ++ txdesc->Ctl_8 = DESC_CTL_HOSTOWN; ++ } ++ ++ adev->tx_free = TX_CNT; ++ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxpci_s_create_tx_host_desc_queue ++*/ ++ ++static void* ++allocate(acx_device_t *adev, size_t size, dma_addr_t *phy, const char *msg) ++{ ++ void *ptr; ++ ++ ptr = dma_alloc_coherent(adev->pdev ? &adev->pdev->dev : NULL, ++ size, phy, GFP_KERNEL); ++ ++ if (ptr) { ++ log(L_DEBUG, "%s sz=%d adr=0x%p phy=0x%08llx\n", ++ msg, (int)size, ptr, (unsigned long long)*phy); ++ memset(ptr, 0, size); ++ return ptr; ++ } ++ printk(KERN_ERR "acx: %s allocation FAILED (%d bytes)\n", ++ msg, (int)size); ++ return NULL; ++} ++ ++ ++static int ++acxpci_s_create_tx_host_desc_queue(acx_device_t *adev) ++{ ++ txhostdesc_t *hostdesc; ++ u8 *txbuf; ++ dma_addr_t hostdesc_phy; ++ dma_addr_t txbuf_phy; ++ int i; ++ ++ FN_ENTER; ++ ++ /* allocate TX buffer */ ++ adev->txbuf_area_size = TX_CNT * WLAN_A4FR_MAXLEN_WEP_FCS; ++ adev->txbuf_start = allocate(adev, adev->txbuf_area_size, ++ &adev->txbuf_startphy, "txbuf_start"); ++ if (!adev->txbuf_start) ++ goto fail; ++ ++ /* allocate the TX host descriptor queue pool */ ++ adev->txhostdesc_area_size = TX_CNT * 2*sizeof(*hostdesc); ++ adev->txhostdesc_start = allocate(adev, adev->txhostdesc_area_size, ++ &adev->txhostdesc_startphy, "txhostdesc_start"); ++ if (!adev->txhostdesc_start) ++ goto fail; ++ /* check for proper alignment of TX host descriptor pool */ ++ if ((long) adev->txhostdesc_start & 3) { ++ printk("acx: driver bug: dma alloc returns unaligned address\n"); ++ goto fail; ++ } ++ ++ hostdesc = adev->txhostdesc_start; ++ hostdesc_phy = adev->txhostdesc_startphy; ++ txbuf = adev->txbuf_start; ++ txbuf_phy = adev->txbuf_startphy; ++ ++#if 0 ++/* Each tx buffer is accessed by hardware via ++** txdesc -> txhostdesc(s) -> txbuffer(s). ++** We use only one txhostdesc per txdesc, but it looks like ++** acx111 is buggy: it accesses second txhostdesc ++** (via hostdesc.desc_phy_next field) even if ++** txdesc->length == hostdesc->length and thus ++** entire packet was placed into first txhostdesc. ++** Due to this bug acx111 hangs unless second txhostdesc ++** has le16_to_cpu(hostdesc.length) = 3 (or larger) ++** Storing NULL into hostdesc.desc_phy_next ++** doesn't seem to help. ++** ++** Update: although it worked on Xterasys XN-2522g ++** with len=3 trick, WG311v2 is even more bogus, doesn't work. ++** Keeping this code (#ifdef'ed out) for documentational purposes. ++*/ ++ for (i = 0; i < TX_CNT*2; i++) { ++ hostdesc_phy += sizeof(*hostdesc); ++ if (!(i & 1)) { ++ hostdesc->data_phy = cpu2acx(txbuf_phy); ++ /* hostdesc->data_offset = ... */ ++ /* hostdesc->reserved = ... */ ++ hostdesc->Ctl_16 = cpu_to_le16(DESC_CTL_HOSTOWN); ++ /* hostdesc->length = ... */ ++ hostdesc->desc_phy_next = cpu2acx(hostdesc_phy); ++ hostdesc->pNext = ptr2acx(NULL); ++ /* hostdesc->Status = ... */ ++ /* below: non-hardware fields */ ++ hostdesc->data = txbuf; ++ ++ txbuf += WLAN_A4FR_MAXLEN_WEP_FCS; ++ txbuf_phy += WLAN_A4FR_MAXLEN_WEP_FCS; ++ } else { ++ /* hostdesc->data_phy = ... */ ++ /* hostdesc->data_offset = ... */ ++ /* hostdesc->reserved = ... */ ++ /* hostdesc->Ctl_16 = ... */ ++ hostdesc->length = cpu_to_le16(3); /* bug workaround */ ++ /* hostdesc->desc_phy_next = ... */ ++ /* hostdesc->pNext = ... */ ++ /* hostdesc->Status = ... */ ++ /* below: non-hardware fields */ ++ /* hostdesc->data = ... */ ++ } ++ hostdesc++; ++ } ++#endif ++/* We initialize two hostdescs so that they point to adjacent ++** memory areas. Thus txbuf is really just a contiguous memory area */ ++ for (i = 0; i < TX_CNT*2; i++) { ++ hostdesc_phy += sizeof(*hostdesc); ++ ++ hostdesc->data_phy = cpu2acx(txbuf_phy); ++ /* done by memset(0): hostdesc->data_offset = 0; */ ++ /* hostdesc->reserved = ... */ ++ hostdesc->Ctl_16 = cpu_to_le16(DESC_CTL_HOSTOWN); ++ /* hostdesc->length = ... */ ++ hostdesc->desc_phy_next = cpu2acx(hostdesc_phy); ++ /* done by memset(0): hostdesc->pNext = ptr2acx(NULL); */ ++ /* hostdesc->Status = ... */ ++ /* ->data is a non-hardware field: */ ++ hostdesc->data = txbuf; ++ ++ if (!(i & 1)) { ++ txbuf += WLAN_HDR_A3_LEN; ++ txbuf_phy += WLAN_HDR_A3_LEN; ++ } else { ++ txbuf += WLAN_A4FR_MAXLEN_WEP_FCS - WLAN_HDR_A3_LEN; ++ txbuf_phy += WLAN_A4FR_MAXLEN_WEP_FCS - WLAN_HDR_A3_LEN; ++ } ++ hostdesc++; ++ } ++ hostdesc--; ++ hostdesc->desc_phy_next = cpu2acx(adev->txhostdesc_startphy); ++ ++ FN_EXIT1(OK); ++ return OK; ++fail: ++ printk("acx: create_tx_host_desc_queue FAILED\n"); ++ /* dealloc will be done by free function on error case */ ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*************************************************************** ++** acxpci_s_create_rx_host_desc_queue ++*/ ++/* the whole size of a data buffer (header plus data body) ++ * plus 32 bytes safety offset at the end */ ++#define RX_BUFFER_SIZE (sizeof(rxbuffer_t) + 32) ++ ++static int ++acxpci_s_create_rx_host_desc_queue(acx_device_t *adev) ++{ ++ rxhostdesc_t *hostdesc; ++ rxbuffer_t *rxbuf; ++ dma_addr_t hostdesc_phy; ++ dma_addr_t rxbuf_phy; ++ int i; ++ ++ FN_ENTER; ++ ++ /* allocate the RX host descriptor queue pool */ ++ adev->rxhostdesc_area_size = RX_CNT * sizeof(*hostdesc); ++ adev->rxhostdesc_start = allocate(adev, adev->rxhostdesc_area_size, ++ &adev->rxhostdesc_startphy, "rxhostdesc_start"); ++ if (!adev->rxhostdesc_start) ++ goto fail; ++ /* check for proper alignment of RX host descriptor pool */ ++ if ((long) adev->rxhostdesc_start & 3) { ++ printk("acx: driver bug: dma alloc returns unaligned address\n"); ++ goto fail; ++ } ++ ++ /* allocate Rx buffer pool which will be used by the acx ++ * to store the whole content of the received frames in it */ ++ adev->rxbuf_area_size = RX_CNT * RX_BUFFER_SIZE; ++ adev->rxbuf_start = allocate(adev, adev->rxbuf_area_size, ++ &adev->rxbuf_startphy, "rxbuf_start"); ++ if (!adev->rxbuf_start) ++ goto fail; ++ ++ rxbuf = adev->rxbuf_start; ++ rxbuf_phy = adev->rxbuf_startphy; ++ hostdesc = adev->rxhostdesc_start; ++ hostdesc_phy = adev->rxhostdesc_startphy; ++ ++ /* don't make any popular C programming pointer arithmetic mistakes ++ * here, otherwise I'll kill you... ++ * (and don't dare asking me why I'm warning you about that...) */ ++ for (i = 0; i < RX_CNT; i++) { ++ hostdesc->data = rxbuf; ++ hostdesc->data_phy = cpu2acx(rxbuf_phy); ++ hostdesc->length = cpu_to_le16(RX_BUFFER_SIZE); ++ CLEAR_BIT(hostdesc->Ctl_16, cpu_to_le16(DESC_CTL_HOSTOWN)); ++ rxbuf++; ++ rxbuf_phy += sizeof(*rxbuf); ++ hostdesc_phy += sizeof(*hostdesc); ++ hostdesc->desc_phy_next = cpu2acx(hostdesc_phy); ++ hostdesc++; ++ } ++ hostdesc--; ++ hostdesc->desc_phy_next = cpu2acx(adev->rxhostdesc_startphy); ++ FN_EXIT1(OK); ++ return OK; ++fail: ++ printk("acx: create_rx_host_desc_queue FAILED\n"); ++ /* dealloc will be done by free function on error case */ ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*************************************************************** ++** acxpci_s_create_hostdesc_queues ++*/ ++int ++acxpci_s_create_hostdesc_queues(acx_device_t *adev) ++{ ++ int result; ++ result = acxpci_s_create_tx_host_desc_queue(adev); ++ if (OK != result) return result; ++ result = acxpci_s_create_rx_host_desc_queue(adev); ++ return result; ++} ++ ++ ++/*************************************************************** ++** acxpci_create_tx_desc_queue ++*/ ++static void ++acxpci_create_tx_desc_queue(acx_device_t *adev, u32 tx_queue_start) ++{ ++ txdesc_t *txdesc; ++ txhostdesc_t *hostdesc; ++ dma_addr_t hostmemptr; ++ u32 mem_offs; ++ int i; ++ ++ FN_ENTER; ++ ++ if (IS_ACX100(adev)) ++ adev->txdesc_size = sizeof(*txdesc); ++ else ++ /* the acx111 txdesc is 4 bytes larger */ ++ adev->txdesc_size = sizeof(*txdesc) + 4; ++ ++ adev->txdesc_start = (txdesc_t *) (adev->iobase2 + tx_queue_start); ++ ++ log(L_DEBUG, "adev->iobase2=%p\n" ++ "tx_queue_start=%08X\n" ++ "adev->txdesc_start=%p\n", ++ adev->iobase2, ++ tx_queue_start, ++ adev->txdesc_start); ++ ++ adev->tx_free = TX_CNT; ++ /* done by memset: adev->tx_head = 0; */ ++ /* done by memset: adev->tx_tail = 0; */ ++ txdesc = adev->txdesc_start; ++ mem_offs = tx_queue_start; ++ hostmemptr = adev->txhostdesc_startphy; ++ hostdesc = adev->txhostdesc_start; ++ ++ if (IS_ACX111(adev)) { ++ /* ACX111 has a preinitialized Tx buffer! */ ++ /* loop over whole send pool */ ++ /* FIXME: do we have to do the hostmemptr stuff here?? */ ++ for (i = 0; i < TX_CNT; i++) { ++ txdesc->HostMemPtr = ptr2acx(hostmemptr); ++ txdesc->Ctl_8 = DESC_CTL_HOSTOWN; ++ /* reserve two (hdr desc and payload desc) */ ++ hostdesc += 2; ++ hostmemptr += 2 * sizeof(*hostdesc); ++ txdesc = advance_txdesc(adev, txdesc, 1); ++ } ++ } else { ++ /* ACX100 Tx buffer needs to be initialized by us */ ++ /* clear whole send pool. sizeof is safe here (we are acx100) */ ++ memset(adev->txdesc_start, 0, TX_CNT * sizeof(*txdesc)); ++ ++ /* loop over whole send pool */ ++ for (i = 0; i < TX_CNT; i++) { ++ log(L_DEBUG, "configure card tx descriptor: 0x%p, " ++ "size: 0x%X\n", txdesc, adev->txdesc_size); ++ ++ /* pointer to hostdesc memory */ ++ txdesc->HostMemPtr = ptr2acx(hostmemptr); ++ /* initialise ctl */ ++ txdesc->Ctl_8 = ( DESC_CTL_HOSTOWN | DESC_CTL_RECLAIM ++ | DESC_CTL_AUTODMA | DESC_CTL_FIRSTFRAG); ++ /* done by memset(0): txdesc->Ctl2_8 = 0; */ ++ /* point to next txdesc */ ++ txdesc->pNextDesc = cpu2acx(mem_offs + adev->txdesc_size); ++ /* reserve two (hdr desc and payload desc) */ ++ hostdesc += 2; ++ hostmemptr += 2 * sizeof(*hostdesc); ++ /* go to the next one */ ++ mem_offs += adev->txdesc_size; ++ /* ++ is safe here (we are acx100) */ ++ txdesc++; ++ } ++ /* go back to the last one */ ++ txdesc--; ++ /* and point to the first making it a ring buffer */ ++ txdesc->pNextDesc = cpu2acx(tx_queue_start); ++ } ++ FN_EXIT0; ++} ++ ++ ++/*************************************************************** ++** acxpci_create_rx_desc_queue ++*/ ++static void ++acxpci_create_rx_desc_queue(acx_device_t *adev, u32 rx_queue_start) ++{ ++ rxdesc_t *rxdesc; ++ u32 mem_offs; ++ int i; ++ ++ FN_ENTER; ++ ++ /* done by memset: adev->rx_tail = 0; */ ++ ++ /* ACX111 doesn't need any further config: preconfigures itself. ++ * Simply print ring buffer for debugging */ ++ if (IS_ACX111(adev)) { ++ /* rxdesc_start already set here */ ++ ++ adev->rxdesc_start = (rxdesc_t *) ((u8 *)adev->iobase2 + rx_queue_start); ++ ++ rxdesc = adev->rxdesc_start; ++ for (i = 0; i < RX_CNT; i++) { ++ log(L_DEBUG, "rx descriptor %d @ 0x%p\n", i, rxdesc); ++ rxdesc = adev->rxdesc_start = (rxdesc_t *) ++ (adev->iobase2 + acx2cpu(rxdesc->pNextDesc)); ++ } ++ } else { ++ /* we didn't pre-calculate rxdesc_start in case of ACX100 */ ++ /* rxdesc_start should be right AFTER Tx pool */ ++ adev->rxdesc_start = (rxdesc_t *) ++ ((u8 *) adev->txdesc_start + (TX_CNT * sizeof(txdesc_t))); ++ /* NB: sizeof(txdesc_t) above is valid because we know ++ ** we are in if (acx100) block. Beware of cut-n-pasting elsewhere! ++ ** acx111's txdesc is larger! */ ++ ++ memset(adev->rxdesc_start, 0, RX_CNT * sizeof(*rxdesc)); ++ ++ /* loop over whole receive pool */ ++ rxdesc = adev->rxdesc_start; ++ mem_offs = rx_queue_start; ++ for (i = 0; i < RX_CNT; i++) { ++ log(L_DEBUG, "rx descriptor @ 0x%p\n", rxdesc); ++ rxdesc->Ctl_8 = DESC_CTL_RECLAIM | DESC_CTL_AUTODMA; ++ /* point to next rxdesc */ ++ rxdesc->pNextDesc = cpu2acx(mem_offs + sizeof(*rxdesc)); ++ /* go to the next one */ ++ mem_offs += sizeof(*rxdesc); ++ rxdesc++; ++ } ++ /* go to the last one */ ++ rxdesc--; ++ ++ /* and point to the first making it a ring buffer */ ++ rxdesc->pNextDesc = cpu2acx(rx_queue_start); ++ } ++ FN_EXIT0; ++} ++ ++ ++/*************************************************************** ++** acxpci_create_desc_queues ++*/ ++void ++acxpci_create_desc_queues(acx_device_t *adev, u32 tx_queue_start, u32 rx_queue_start) ++{ ++ acxpci_create_tx_desc_queue(adev, tx_queue_start); ++ acxpci_create_rx_desc_queue(adev, rx_queue_start); ++} ++ ++ ++/*************************************************************** ++** acxpci_s_proc_diag_output ++*/ ++char* ++acxpci_s_proc_diag_output(char *p, acx_device_t *adev) ++{ ++ const char *rtl, *thd, *ttl; ++ rxhostdesc_t *rxhostdesc; ++ txdesc_t *txdesc; ++ int i; ++ ++ FN_ENTER; ++ ++ p += sprintf(p, "** Rx buf **\n"); ++ rxhostdesc = adev->rxhostdesc_start; ++ if (rxhostdesc) for (i = 0; i < RX_CNT; i++) { ++ rtl = (i == adev->rx_tail) ? " [tail]" : ""; ++ if ((rxhostdesc->Ctl_16 & cpu_to_le16(DESC_CTL_HOSTOWN)) ++ && (rxhostdesc->Status & cpu_to_le32(DESC_STATUS_FULL)) ) ++ p += sprintf(p, "%02u FULL%s\n", i, rtl); ++ else ++ p += sprintf(p, "%02u empty%s\n", i, rtl); ++ rxhostdesc++; ++ } ++ p += sprintf(p, "** Tx buf (free %d, Linux netqueue %s) **\n", adev->tx_free, ++ acx_queue_stopped(adev->ndev) ? "STOPPED" : "running"); ++ txdesc = adev->txdesc_start; ++ if (txdesc) for (i = 0; i < TX_CNT; i++) { ++ thd = (i == adev->tx_head) ? " [head]" : ""; ++ ttl = (i == adev->tx_tail) ? " [tail]" : ""; ++ if (txdesc->Ctl_8 & DESC_CTL_ACXDONE) ++ p += sprintf(p, "%02u free (%02X)%s%s\n", i, txdesc->Ctl_8, thd, ttl); ++ else ++ p += sprintf(p, "%02u tx (%02X)%s%s\n", i, txdesc->Ctl_8, thd, ttl); ++ txdesc = advance_txdesc(adev, txdesc, 1); ++ } ++ p += sprintf(p, ++ "\n" ++ "** PCI data **\n" ++ "txbuf_start %p, txbuf_area_size %u, txbuf_startphy %08llx\n" ++ "txdesc_size %u, txdesc_start %p\n" ++ "txhostdesc_start %p, txhostdesc_area_size %u, txhostdesc_startphy %08llx\n" ++ "rxdesc_start %p\n" ++ "rxhostdesc_start %p, rxhostdesc_area_size %u, rxhostdesc_startphy %08llx\n" ++ "rxbuf_start %p, rxbuf_area_size %u, rxbuf_startphy %08llx\n", ++ adev->txbuf_start, adev->txbuf_area_size, ++ (unsigned long long)adev->txbuf_startphy, ++ adev->txdesc_size, adev->txdesc_start, ++ adev->txhostdesc_start, adev->txhostdesc_area_size, ++ (unsigned long long)adev->txhostdesc_startphy, ++ adev->rxdesc_start, ++ adev->rxhostdesc_start, adev->rxhostdesc_area_size, ++ (unsigned long long)adev->rxhostdesc_startphy, ++ adev->rxbuf_start, adev->rxbuf_area_size, ++ (unsigned long long)adev->rxbuf_startphy); ++ ++ FN_EXIT0; ++ return p; ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acxpci_proc_eeprom_output(char *buf, acx_device_t *adev) ++{ ++ char *p = buf; ++ int i; ++ ++ FN_ENTER; ++ ++ for (i = 0; i < 0x400; i++) { ++ acxpci_read_eeprom_byte(adev, i, p++); ++ } ++ ++ FN_EXIT1(p - buf); ++ return p - buf; ++} ++ ++ ++/*********************************************************************** ++*/ ++void ++acxpci_set_interrupt_mask(acx_device_t *adev) ++{ ++ if (IS_ACX111(adev)) { ++ adev->irq_mask = (u16) ~(0 ++ /* | HOST_INT_RX_DATA */ ++ | HOST_INT_TX_COMPLETE ++ /* | HOST_INT_TX_XFER */ ++ | HOST_INT_RX_COMPLETE ++ /* | HOST_INT_DTIM */ ++ /* | HOST_INT_BEACON */ ++ /* | HOST_INT_TIMER */ ++ /* | HOST_INT_KEY_NOT_FOUND */ ++ | HOST_INT_IV_ICV_FAILURE ++ | HOST_INT_CMD_COMPLETE ++ | HOST_INT_INFO ++ /* | HOST_INT_OVERFLOW */ ++ /* | HOST_INT_PROCESS_ERROR */ ++ | HOST_INT_SCAN_COMPLETE ++ | HOST_INT_FCS_THRESHOLD ++ /* | HOST_INT_UNKNOWN */ ++ ); ++ /* Or else acx100 won't signal cmd completion, right? */ ++ adev->irq_mask_off = (u16)~( HOST_INT_CMD_COMPLETE ); /* 0xfdff */ ++ } else { ++ adev->irq_mask = (u16) ~(0 ++ /* | HOST_INT_RX_DATA */ ++ | HOST_INT_TX_COMPLETE ++ /* | HOST_INT_TX_XFER */ ++ | HOST_INT_RX_COMPLETE ++ /* | HOST_INT_DTIM */ ++ /* | HOST_INT_BEACON */ ++ /* | HOST_INT_TIMER */ ++ /* | HOST_INT_KEY_NOT_FOUND */ ++ /* | HOST_INT_IV_ICV_FAILURE */ ++ | HOST_INT_CMD_COMPLETE ++ | HOST_INT_INFO ++ /* | HOST_INT_OVERFLOW */ ++ /* | HOST_INT_PROCESS_ERROR */ ++ | HOST_INT_SCAN_COMPLETE ++ /* | HOST_INT_FCS_THRESHOLD */ ++ /* | HOST_INT_UNKNOWN */ ++ ); ++ adev->irq_mask_off = (u16)~( HOST_INT_UNKNOWN ); /* 0x7fff */ ++ } ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acx100pci_s_set_tx_level(acx_device_t *adev, u8 level_dbm) ++{ ++ /* since it can be assumed that at least the Maxim radio has a ++ * maximum power output of 20dBm and since it also can be ++ * assumed that these values drive the DAC responsible for ++ * setting the linear Tx level, I'd guess that these values ++ * should be the corresponding linear values for a dBm value, ++ * in other words: calculate the values from that formula: ++ * Y [dBm] = 10 * log (X [mW]) ++ * then scale the 0..63 value range onto the 1..100mW range (0..20 dBm) ++ * and you're done... ++ * Hopefully that's ok, but you never know if we're actually ++ * right... (especially since Windows XP doesn't seem to show ++ * actual Tx dBm values :-P) */ ++ ++ /* NOTE: on Maxim, value 30 IS 30mW, and value 10 IS 10mW - so the ++ * values are EXACTLY mW!!! Not sure about RFMD and others, ++ * though... */ ++ static const u8 dbm2val_maxim[21] = { ++ 63, 63, 63, 62, ++ 61, 61, 60, 60, ++ 59, 58, 57, 55, ++ 53, 50, 47, 43, ++ 38, 31, 23, 13, ++ 0 ++ }; ++ static const u8 dbm2val_rfmd[21] = { ++ 0, 0, 0, 1, ++ 2, 2, 3, 3, ++ 4, 5, 6, 8, ++ 10, 13, 16, 20, ++ 25, 32, 41, 50, ++ 63 ++ }; ++ const u8 *table; ++ ++ switch (adev->radio_type) { ++ case RADIO_MAXIM_0D: ++ table = &dbm2val_maxim[0]; ++ break; ++ case RADIO_RFMD_11: ++ case RADIO_RALINK_15: ++ table = &dbm2val_rfmd[0]; ++ break; ++ default: ++ printk("%s: unknown/unsupported radio type, " ++ "cannot modify tx power level yet!\n", ++ adev->ndev->name); ++ return NOT_OK; ++ } ++ printk("%s: changing radio power level to %u dBm (%u)\n", ++ adev->ndev->name, level_dbm, table[level_dbm]); ++ acxpci_s_write_phy_reg(adev, 0x11, table[level_dbm]); ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** Data for init_module/cleanup_module ++*/ ++static const struct pci_device_id ++acxpci_id_tbl[] __devinitdata = { ++ { ++ .vendor = PCI_VENDOR_ID_TI, ++ .device = PCI_DEVICE_ID_TI_TNETW1100A, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = CHIPTYPE_ACX100, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_TI, ++ .device = PCI_DEVICE_ID_TI_TNETW1100B, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = CHIPTYPE_ACX100, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_TI, ++ .device = PCI_DEVICE_ID_TI_TNETW1130, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = CHIPTYPE_ACX111, ++ }, ++ { ++ .vendor = 0, ++ .device = 0, ++ .subvendor = 0, ++ .subdevice = 0, ++ .driver_data = 0, ++ } ++}; ++ ++MODULE_DEVICE_TABLE(pci, acxpci_id_tbl); ++ ++/* FIXME: checks should be removed once driver is included in the kernel */ ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 11) ++/* pci_name() got introduced at start of 2.6.x, ++ * got mandatory (slot_name member removed) in 2.6.11-bk1 */ ++#define pci_name(x) x->slot_name ++#endif ++ ++static struct pci_driver ++acxpci_drv_id = { ++ .name = "acx_pci", ++ .id_table = acxpci_id_tbl, ++ .probe = acxpci_e_probe, ++ .remove = __devexit_p(acxpci_e_remove), ++#ifdef CONFIG_PM ++ .suspend = acxpci_e_suspend, ++ .resume = acxpci_e_resume ++#endif /* CONFIG_PM */ ++}; ++ ++ ++/*********************************************************************** ++** acxpci_e_init_module ++** ++** Module initialization routine, called once at module load time ++*/ ++int __init ++acxpci_e_init_module(void) ++{ ++ int res; ++ ++ FN_ENTER; ++ ++#if (ACX_IO_WIDTH==32) ++ printk("acx: compiled to use 32bit I/O access. " ++ "I/O timing issues might occur, such as " ++ "non-working firmware upload. Report them\n"); ++#else ++ printk("acx: compiled to use 16bit I/O access only " ++ "(compatibility mode)\n"); ++#endif ++ ++#ifdef __LITTLE_ENDIAN ++#define ENDIANNESS_STRING "running on a little-endian CPU\n" ++#else ++#define ENDIANNESS_STRING "running on a BIG-ENDIAN CPU\n" ++#endif ++ log(L_INIT, ++ ENDIANNESS_STRING ++ "PCI module " ACX_RELEASE " initialized, " ++ "waiting for cards to probe...\n" ++ ); ++ ++ res = pci_register_driver(&acxpci_drv_id); ++ FN_EXIT1(res); ++ return res; ++} ++ ++ ++/*********************************************************************** ++** acxpci_e_cleanup_module ++** ++** Called at module unload time. This is our last chance to ++** clean up after ourselves. ++*/ ++void __exit ++acxpci_e_cleanup_module(void) ++{ ++ FN_ENTER; ++ ++ pci_unregister_driver(&acxpci_drv_id); ++ ++ FN_EXIT0; ++} +Index: linux-2.6.22/drivers/net/wireless/acx/rx3000_acx.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/rx3000_acx.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,110 @@ ++/* ++ * WLAN (TI TNETW1100B) support in the HP iPAQ RX3000 ++ * ++ * Copyright (c) 2006 SDG Systems, LLC ++ * Copyright (c) 2006 Roman Moravcik ++ * ++ * This file is subject to the terms and conditions of the GNU General Public ++ * License. See the file COPYING in the main directory of this archive for ++ * more details. ++ * ++ * Based on hx4700_acx.c ++ */ ++ ++ ++#include <linux/kernel.h> ++#include <linux/platform_device.h> ++#include <linux/delay.h> ++#include <linux/dpm.h> ++#include <linux/leds.h> ++ ++#include <asm/hardware.h> ++ ++#include <asm/arch/regs-gpio.h> ++#include <linux/mfd/asic3_base.h> ++#include <asm/arch/rx3000.h> ++#include <asm/arch/rx3000-asic3.h> ++#include <asm/io.h> ++ ++#include "acx_hw.h" ++ ++extern struct platform_device s3c_device_asic3; ++ ++static int rx3000_wlan_start(void) ++{ ++ DPM_DEBUG("rx3000_acx: Turning on\n"); ++ asic3_set_gpio_out_b(&s3c_device_asic3.dev, ASIC3_GPB3, ASIC3_GPB3); ++ mdelay(20); ++ asic3_set_gpio_out_c(&s3c_device_asic3.dev, ASIC3_GPC13, ASIC3_GPC13); ++ mdelay(20); ++ asic3_set_gpio_out_c(&s3c_device_asic3.dev, ASIC3_GPC11, ASIC3_GPC11); ++ mdelay(100); ++ asic3_set_gpio_out_b(&s3c_device_asic3.dev, ASIC3_GPB3, ASIC3_GPB3); ++ mdelay(20); ++ s3c2410_gpio_cfgpin(S3C2410_GPA15, S3C2410_GPA15_nGCS4); ++ mdelay(100); ++ s3c2410_gpio_setpin(S3C2410_GPA11, 0); ++ mdelay(50); ++ s3c2410_gpio_setpin(S3C2410_GPA11, 1); ++ led_trigger_event_shared(rx3000_radio_trig, LED_FULL); ++ return 0; ++} ++ ++static int rx3000_wlan_stop(void) ++{ ++ DPM_DEBUG("rx3000_acx: Turning off\n"); ++ s3c2410_gpio_setpin(S3C2410_GPA15, 1); ++ s3c2410_gpio_cfgpin(S3C2410_GPA15, S3C2410_GPA15_OUT); ++ asic3_set_gpio_out_b(&s3c_device_asic3.dev, ASIC3_GPB3, 0); ++ asic3_set_gpio_out_c(&s3c_device_asic3.dev, ASIC3_GPC13, 0); ++ asic3_set_gpio_out_c(&s3c_device_asic3.dev, ASIC3_GPC11, 0); ++ led_trigger_event_shared(rx3000_radio_trig, LED_OFF); ++ return 0; ++} ++ ++static struct resource acx_resources[] = { ++ [0] = { ++ .start = RX3000_PA_WLAN, ++ .end = RX3000_PA_WLAN + 0x20, ++ .flags = IORESOURCE_MEM, ++ }, ++ [1] = { ++ .start = IRQ_EINT16, ++ .end = IRQ_EINT16, ++ .flags = IORESOURCE_IRQ, ++ }, ++}; ++ ++static struct acx_hardware_data acx_data = { ++ .start_hw = rx3000_wlan_start, ++ .stop_hw = rx3000_wlan_stop, ++}; ++ ++static struct platform_device acx_device = { ++ .name = "acx-mem", ++ .dev = { ++ .platform_data = &acx_data, ++ }, ++ .num_resources = ARRAY_SIZE(acx_resources), ++ .resource = acx_resources, ++}; ++ ++static int __init rx3000_wlan_init(void) ++{ ++ printk("rx3000_wlan_init: acx-mem platform_device_register\n"); ++ return platform_device_register(&acx_device); ++} ++ ++ ++static void __exit rx3000_wlan_exit(void) ++{ ++ platform_device_unregister(&acx_device); ++} ++ ++module_init(rx3000_wlan_init); ++module_exit(rx3000_wlan_exit); ++ ++MODULE_AUTHOR("Todd Blumer <todd@sdgsystems.com>, Roman Moravcik <roman.moravcik@gmail.com>"); ++MODULE_DESCRIPTION("WLAN driver for HP iPAQ RX3000"); ++MODULE_LICENSE("GPL"); ++ +Index: linux-2.6.22/drivers/net/wireless/acx/setrate.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/setrate.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,213 @@ ++/* TODO: stop #including, move into wireless.c ++ * until then, keep in sync copies in prism54/ and acx/ dirs ++ * code+data size: less than 1k */ ++ ++enum { ++ DOT11_RATE_1, ++ DOT11_RATE_2, ++ DOT11_RATE_5, ++ DOT11_RATE_11, ++ DOT11_RATE_22, ++ DOT11_RATE_33, ++ DOT11_RATE_6, ++ DOT11_RATE_9, ++ DOT11_RATE_12, ++ DOT11_RATE_18, ++ DOT11_RATE_24, ++ DOT11_RATE_36, ++ DOT11_RATE_48, ++ DOT11_RATE_54 ++}; ++enum { ++ DOT11_MOD_DBPSK, ++ DOT11_MOD_DQPSK, ++ DOT11_MOD_CCK, ++ DOT11_MOD_OFDM, ++ DOT11_MOD_CCKOFDM, ++ DOT11_MOD_PBCC ++}; ++static const u8 ratelist[] = { 1,2,5,11,22,33,6,9,12,18,24,36,48,54 }; ++static const u8 dot11ratebyte[] = { 1*2,2*2,11,11*2,22*2,33*2,6*2,9*2,12*2,18*2,24*2,36*2,48*2,54*2 }; ++static const u8 default_modulation[] = { ++ DOT11_MOD_DBPSK, ++ DOT11_MOD_DQPSK, ++ DOT11_MOD_CCK, ++ DOT11_MOD_CCK, ++ DOT11_MOD_PBCC, ++ DOT11_MOD_PBCC, ++ DOT11_MOD_OFDM, ++ DOT11_MOD_OFDM, ++ DOT11_MOD_OFDM, ++ DOT11_MOD_OFDM, ++ DOT11_MOD_OFDM, ++ DOT11_MOD_OFDM, ++ DOT11_MOD_OFDM, ++ DOT11_MOD_OFDM ++}; ++ ++static /* TODO: remove 'static' when moved to wireless.c */ ++int ++rate_mbit2enum(int n) { ++ int i=0; ++ while(i<sizeof(ratelist)) { ++ if(n==ratelist[i]) return i; ++ i++; ++ } ++ return -EINVAL; ++} ++ ++static int ++get_modulation(int r_enum, char suffix) { ++ if(suffix==',' || suffix==' ' || suffix=='\0') { ++ /* could shorten default_mod by 8 bytes: ++ if(r_enum>=DOT11_RATE_6) return DOT11_MOD_OFDM; */ ++ return default_modulation[r_enum]; ++ } ++ if(suffix=='c') { ++ if(r_enum<DOT11_RATE_5 || r_enum>DOT11_RATE_11) return -EINVAL; ++ return DOT11_MOD_CCK; ++ } ++ if(suffix=='p') { ++ if(r_enum<DOT11_RATE_5 || r_enum>DOT11_RATE_33) return -EINVAL; ++ return DOT11_MOD_PBCC; ++ } ++ if(suffix=='o') { ++ if(r_enum<DOT11_RATE_6) return -EINVAL; ++ return DOT11_MOD_OFDM; ++ } ++ if(suffix=='d') { ++ if(r_enum<DOT11_RATE_6) return -EINVAL; ++ return DOT11_MOD_CCKOFDM; ++ } ++ return -EINVAL; ++} ++ ++#ifdef UNUSED ++static int ++fill_ratevector(const char **pstr, u8 *vector, int size, ++ int (*supported)(int mbit, int mod, void *opaque), void *opaque, int or_mask) ++{ ++ unsigned long rate_mbit; ++ int rate_enum,mod; ++ const char *str = *pstr; ++ char c; ++ ++ do { ++ rate_mbit = simple_strtoul(str, (char**)&str, 10); ++ if(rate_mbit>INT_MAX) return -EINVAL; ++ ++ rate_enum = rate_mbit2enum(rate_mbit); ++ if(rate_enum<0) return rate_enum; ++ ++ c = *str; ++ mod = get_modulation(rate_enum, c); ++ if(mod<0) return mod; ++ ++ if(c>='a' && c<='z') c = *++str; ++ if(c!=',' && c!=' ' && c!='\0') return -EINVAL; ++ ++ if(supported) { ++ int r = supported(rate_mbit, mod, opaque); ++ if(r) return r; ++ } ++ ++ *vector++ = dot11ratebyte[rate_enum] | or_mask; ++ ++ size--; ++ str++; ++ } while(size>0 && c==','); ++ ++ if(size<1) return -E2BIG; ++ *vector=0; /* TODO: sort, remove dups? */ ++ ++ *pstr = str-1; ++ return 0; ++} ++ ++static /* TODO: remove 'static' when moved to wireless.c */ ++int ++fill_ratevectors(const char *str, u8 *brate, u8 *orate, int size, ++ int (*supported)(int mbit, int mod, void *opaque), void *opaque) ++{ ++ int r; ++ ++ r = fill_ratevector(&str, brate, size, supported, opaque, 0x80); ++ if(r) return r; ++ ++ orate[0] = 0; ++ if(*str==' ') { ++ str++; ++ r = fill_ratevector(&str, orate, size, supported, opaque, 0); ++ if(r) return r; ++ /* TODO: sanitize, e.g. remove/error on rates already in basic rate set? */ ++ } ++ if(*str) ++ return -EINVAL; ++ ++ return 0; ++} ++#endif ++ ++/* TODO: use u64 masks? */ ++ ++static int ++fill_ratemask(const char **pstr, u32* mask, ++ int (*supported)(int mbit, int mod,void *opaque), ++ u32 (*gen_mask)(int mbit, int mod,void *opaque), ++ void *opaque) ++{ ++ unsigned long rate_mbit; ++ int rate_enum,mod; ++ u32 m = 0; ++ const char *str = *pstr; ++ char c; ++ ++ do { ++ rate_mbit = simple_strtoul(str, (char**)&str, 10); ++ if(rate_mbit>INT_MAX) return -EINVAL; ++ ++ rate_enum = rate_mbit2enum(rate_mbit); ++ if(rate_enum<0) return rate_enum; ++ ++ c = *str; ++ mod = get_modulation(rate_enum, c); ++ if(mod<0) return mod; ++ ++ if(c>='a' && c<='z') c = *++str; ++ if(c!=',' && c!=' ' && c!='\0') return -EINVAL; ++ ++ if(supported) { ++ int r = supported(rate_mbit, mod, opaque); ++ if(r) return r; ++ } ++ ++ m |= gen_mask(rate_mbit, mod, opaque); ++ str++; ++ } while(c==','); ++ ++ *pstr = str-1; ++ *mask |= m; ++ return 0; ++} ++ ++static /* TODO: remove 'static' when moved to wireless.c */ ++int ++fill_ratemasks(const char *str, u32 *bmask, u32 *omask, ++ int (*supported)(int mbit, int mod,void *opaque), ++ u32 (*gen_mask)(int mbit, int mod,void *opaque), ++ void *opaque) ++{ ++ int r; ++ ++ r = fill_ratemask(&str, bmask, supported, gen_mask, opaque); ++ if(r) return r; ++ ++ if(*str==' ') { ++ str++; ++ r = fill_ratemask(&str, omask, supported, gen_mask, opaque); ++ if(r) return r; ++ } ++ if(*str) ++ return -EINVAL; ++ return 0; ++} +Index: linux-2.6.22/drivers/net/wireless/acx/usb.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/usb.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,1922 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++*/ ++ ++/*********************************************************************** ++** USB support for TI ACX100 based devices. Many parts are taken from ++** the PCI driver. ++** ++** Authors: ++** Martin Wawro <martin.wawro AT uni-dortmund.de> ++** Andreas Mohr <andi AT lisas.de> ++** ++** LOCKING ++** callback functions called by USB core are running in interrupt context ++** and thus have names with _i_. ++*/ ++#define ACX_USB 1 ++ ++#include <linux/version.h> ++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) ++#include <linux/config.h> ++#endif ++#include <linux/types.h> ++#include <linux/module.h> ++#include <linux/moduleparam.h> ++#include <linux/kernel.h> ++#include <linux/usb.h> ++#include <linux/netdevice.h> ++#include <linux/rtnetlink.h> ++#include <linux/etherdevice.h> ++#include <linux/wireless.h> ++#include <net/iw_handler.h> ++#include <linux/vmalloc.h> ++ ++#include "acx.h" ++ ++ ++/*********************************************************************** ++*/ ++/* number of endpoints of an interface */ ++#define NUM_EP(intf) (intf)->altsetting[0].desc.bNumEndpoints ++#define EP(intf, nr) (intf)->altsetting[0].endpoint[(nr)].desc ++#define GET_DEV(udev) usb_get_dev((udev)) ++#define PUT_DEV(udev) usb_put_dev((udev)) ++#define SET_NETDEV_OWNER(ndev, owner) /* not needed anymore ??? */ ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,14) ++/* removed in 2.6.14. We will use fake value for now */ ++#define URB_ASYNC_UNLINK 0 ++#endif ++ ++ ++/*********************************************************************** ++*/ ++/* ACX100 (TNETW1100) USB device: D-Link DWL-120+ */ ++#define ACX100_VENDOR_ID 0x2001 ++#define ACX100_PRODUCT_ID_UNBOOTED 0x3B01 ++#define ACX100_PRODUCT_ID_BOOTED 0x3B00 ++ ++/* TNETW1450 USB devices */ ++#define VENDOR_ID_DLINK 0x07b8 /* D-Link Corp. */ ++#define PRODUCT_ID_WUG2400 0xb21a /* AboCom WUG2400 or SafeCom SWLUT-54125 */ ++#define VENDOR_ID_AVM_GMBH 0x057c ++#define PRODUCT_ID_AVM_WLAN_USB 0x5601 ++#define PRODUCT_ID_AVM_WLAN_USB_si 0x6201 /* "self install" named Version: driver kills kernel on inbound scans from fritz box ??? */ ++#define VENDOR_ID_ZCOM 0x0cde ++#define PRODUCT_ID_ZCOM_XG750 0x0017 /* not tested yet */ ++#define VENDOR_ID_TI 0x0451 ++#define PRODUCT_ID_TI_UNKNOWN 0x60c5 /* not tested yet */ ++ ++#define ACX_USB_CTRL_TIMEOUT 5500 /* steps in ms */ ++ ++/* Buffer size for fw upload, same for both ACX100 USB and TNETW1450 */ ++#define USB_RWMEM_MAXLEN 2048 ++ ++/* The number of bulk URBs to use */ ++#define ACX_TX_URB_CNT 8 ++#define ACX_RX_URB_CNT 2 ++ ++/* Should be sent to the bulkout endpoint */ ++#define ACX_USB_REQ_UPLOAD_FW 0x10 ++#define ACX_USB_REQ_ACK_CS 0x11 ++#define ACX_USB_REQ_CMD 0x12 ++ ++/*********************************************************************** ++** Prototypes ++*/ ++static int acxusb_e_probe(struct usb_interface *, const struct usb_device_id *); ++static void acxusb_e_disconnect(struct usb_interface *); ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19) ++static void acxusb_i_complete_tx(struct urb *); ++static void acxusb_i_complete_rx(struct urb *); ++#else ++static void acxusb_i_complete_tx(struct urb *, struct pt_regs *); ++static void acxusb_i_complete_rx(struct urb *, struct pt_regs *); ++#endif ++static int acxusb_e_open(struct net_device *); ++static int acxusb_e_close(struct net_device *); ++static void acxusb_i_set_rx_mode(struct net_device *); ++static int acxusb_boot(struct usb_device *, int is_tnetw1450, int *radio_type); ++ ++static void acxusb_l_poll_rx(acx_device_t *adev, usb_rx_t* rx); ++ ++static void acxusb_i_tx_timeout(struct net_device *); ++ ++/* static void dump_device(struct usb_device *); */ ++/* static void dump_device_descriptor(struct usb_device_descriptor *); */ ++/* static void dump_config_descriptor(struct usb_config_descriptor *); */ ++ ++/*********************************************************************** ++** Module Data ++*/ ++#define TXBUFSIZE sizeof(usb_txbuffer_t) ++/* ++ * Now, this is just plain lying, but the device insists in giving us ++ * huge packets. We supply extra space after rxbuffer. Need to understand ++ * it better... ++ */ ++#define RXBUFSIZE (sizeof(rxbuffer_t) + \ ++ (sizeof(usb_rx_t) - sizeof(struct usb_rx_plain))) ++ ++static const struct usb_device_id ++acxusb_ids[] = { ++ { USB_DEVICE(ACX100_VENDOR_ID, ACX100_PRODUCT_ID_BOOTED) }, ++ { USB_DEVICE(ACX100_VENDOR_ID, ACX100_PRODUCT_ID_UNBOOTED) }, ++ { USB_DEVICE(VENDOR_ID_DLINK, PRODUCT_ID_WUG2400) }, ++ { USB_DEVICE(VENDOR_ID_AVM_GMBH, PRODUCT_ID_AVM_WLAN_USB) }, ++ { USB_DEVICE(VENDOR_ID_AVM_GMBH, PRODUCT_ID_AVM_WLAN_USB_si) }, ++ { USB_DEVICE(VENDOR_ID_ZCOM, PRODUCT_ID_ZCOM_XG750) }, ++ { USB_DEVICE(VENDOR_ID_TI, PRODUCT_ID_TI_UNKNOWN) }, ++ {} ++}; ++ ++MODULE_DEVICE_TABLE(usb, acxusb_ids); ++ ++/* USB driver data structure as required by the kernel's USB core */ ++static struct usb_driver ++acxusb_driver = { ++ .name = "acx_usb", ++ .probe = acxusb_e_probe, ++ .disconnect = acxusb_e_disconnect, ++ .id_table = acxusb_ids ++}; ++ ++ ++/*********************************************************************** ++** USB helper ++** ++** ldd3 ch13 says: ++** When the function is usb_kill_urb, the urb lifecycle is stopped. This ++** function is usually used when the device is disconnected from the system, ++** in the disconnect callback. For some drivers, the usb_unlink_urb function ++** should be used to tell the USB core to stop an urb. This function does not ++** wait for the urb to be fully stopped before returning to the caller. ++** This is useful for stoppingthe urb while in an interrupt handler or when ++** a spinlock is held, as waiting for a urb to fully stop requires the ability ++** for the USB core to put the calling process to sleep. This function requires ++** that the URB_ASYNC_UNLINK flag value be set in the urb that is being asked ++** to be stopped in order to work properly. ++** ++** (URB_ASYNC_UNLINK is obsolete, usb_unlink_urb will always be ++** asynchronous while usb_kill_urb is synchronous and should be called ++** directly (drivers/usb/core/urb.c)) ++** ++** In light of this, timeout is just for paranoid reasons... ++* ++* Actually, it's useful for debugging. If we reach timeout, we're doing ++* something wrong with the urbs. ++*/ ++static void ++acxusb_unlink_urb(struct urb* urb) ++{ ++ if (!urb) ++ return; ++ ++ if (urb->status == -EINPROGRESS) { ++ int timeout = 10; ++ ++ usb_unlink_urb(urb); ++ while (--timeout && urb->status == -EINPROGRESS) { ++ mdelay(1); ++ } ++ if (!timeout) { ++ printk("acx_usb: urb unlink timeout!\n"); ++ } ++ } ++} ++ ++ ++/*********************************************************************** ++** EEPROM and PHY read/write helpers ++*/ ++/*********************************************************************** ++** acxusb_s_read_phy_reg ++*/ ++int ++acxusb_s_read_phy_reg(acx_device_t *adev, u32 reg, u8 *charbuf) ++{ ++ /* mem_read_write_t mem; */ ++ ++ FN_ENTER; ++ ++ printk("%s doesn't seem to work yet, disabled.\n", __func__); ++ ++ /* ++ mem.addr = cpu_to_le16(reg); ++ mem.type = cpu_to_le16(0x82); ++ mem.len = cpu_to_le32(4); ++ acx_s_issue_cmd(adev, ACX1xx_CMD_MEM_READ, &mem, sizeof(mem)); ++ *charbuf = mem.data; ++ log(L_DEBUG, "read radio PHY[0x%04X]=0x%02X\n", reg, *charbuf); ++ */ ++ ++ FN_EXIT1(OK); ++ return OK; ++} ++ ++ ++/*********************************************************************** ++*/ ++int ++acxusb_s_write_phy_reg(acx_device_t *adev, u32 reg, u8 value) ++{ ++ mem_read_write_t mem; ++ ++ FN_ENTER; ++ ++ mem.addr = cpu_to_le16(reg); ++ mem.type = cpu_to_le16(0x82); ++ mem.len = cpu_to_le32(4); ++ mem.data = value; ++ acx_s_issue_cmd(adev, ACX1xx_CMD_MEM_WRITE, &mem, sizeof(mem)); ++ log(L_DEBUG, "write radio PHY[0x%04X]=0x%02X\n", reg, value); ++ ++ FN_EXIT1(OK); ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acxusb_s_issue_cmd_timeo ++** Excecutes a command in the command mailbox ++** ++** buffer = a pointer to the data. ++** The data must not include 4 byte command header ++*/ ++ ++/* TODO: ideally we shall always know how much we need ++** and this shall be 0 */ ++#define BOGUS_SAFETY_PADDING 0x40 ++ ++#undef FUNC ++#define FUNC "issue_cmd" ++ ++#if !ACX_DEBUG ++int ++acxusb_s_issue_cmd_timeo( ++ acx_device_t *adev, ++ unsigned cmd, ++ void *buffer, ++ unsigned buflen, ++ unsigned timeout) ++{ ++#else ++int ++acxusb_s_issue_cmd_timeo_debug( ++ acx_device_t *adev, ++ unsigned cmd, ++ void *buffer, ++ unsigned buflen, ++ unsigned timeout, ++ const char* cmdstr) ++{ ++#endif ++ /* USB ignores timeout param */ ++ ++ struct usb_device *usbdev; ++ struct { ++ u16 cmd; ++ u16 status; ++ u8 data[1]; ++ } ACX_PACKED *loc; ++ const char *devname; ++ int acklen, blocklen, inpipe, outpipe; ++ int cmd_status; ++ int result; ++ ++ FN_ENTER; ++ ++ devname = adev->ndev->name; ++ /* no "wlan%%d: ..." please */ ++ if (!devname || !devname[0] || devname[4]=='%') ++ devname = "acx"; ++ ++ log(L_CTL, FUNC"(cmd:%s,buflen:%u,type:0x%04X)\n", ++ cmdstr, buflen, ++ buffer ? le16_to_cpu(((acx_ie_generic_t *)buffer)->type) : -1); ++ ++ loc = kmalloc(buflen + 4 + BOGUS_SAFETY_PADDING, GFP_KERNEL); ++ if (!loc) { ++ printk("%s: "FUNC"(): no memory for data buffer\n", devname); ++ goto bad; ++ } ++ ++ /* get context from acx_device */ ++ usbdev = adev->usbdev; ++ ++ /* check which kind of command was issued */ ++ loc->cmd = cpu_to_le16(cmd); ++ loc->status = 0; ++ ++/* NB: buflen == frmlen + 4 ++** ++** Interrogate: write 8 bytes: (cmd,status,rid,frmlen), then ++** read (cmd,status,rid,frmlen,data[frmlen]) back ++** ++** Configure: write (cmd,status,rid,frmlen,data[frmlen]) ++** ++** Possibly bogus special handling of ACX1xx_IE_SCAN_STATUS removed ++*/ ++ ++ /* now write the parameters of the command if needed */ ++ acklen = buflen + 4 + BOGUS_SAFETY_PADDING; ++ blocklen = buflen; ++ if (buffer && buflen) { ++ /* if it's an INTERROGATE command, just pass the length ++ * of parameters to read, as data */ ++ if (cmd == ACX1xx_CMD_INTERROGATE) { ++ blocklen = 4; ++ acklen = buflen + 4; ++ } ++ memcpy(loc->data, buffer, blocklen); ++ } ++ blocklen += 4; /* account for cmd,status */ ++ ++ /* obtain the I/O pipes */ ++ outpipe = usb_sndctrlpipe(usbdev, 0); ++ inpipe = usb_rcvctrlpipe(usbdev, 0); ++ log(L_CTL, "ctrl inpipe=0x%X outpipe=0x%X\n", inpipe, outpipe); ++ log(L_CTL, "sending USB control msg (out) (blocklen=%d)\n", blocklen); ++ if (acx_debug & L_DATA) ++ acx_dump_bytes(loc, blocklen); ++ ++ result = usb_control_msg(usbdev, outpipe, ++ ACX_USB_REQ_CMD, /* request */ ++ USB_TYPE_VENDOR|USB_DIR_OUT, /* requesttype */ ++ 0, /* value */ ++ 0, /* index */ ++ loc, /* dataptr */ ++ blocklen, /* size */ ++ ACX_USB_CTRL_TIMEOUT /* timeout in ms */ ++ ); ++ ++ if (result == -ENODEV) { ++ log(L_CTL, "no device present (unplug?)\n"); ++ goto good; ++ } ++ ++ log(L_CTL, "wrote %d bytes\n", result); ++ if (result < 0) { ++ goto bad; ++ } ++ ++ /* check for device acknowledge */ ++ log(L_CTL, "sending USB control msg (in) (acklen=%d)\n", acklen); ++ loc->status = 0; /* delete old status flag -> set to IDLE */ ++ /* shall we zero out the rest? */ ++ result = usb_control_msg(usbdev, inpipe, ++ ACX_USB_REQ_CMD, /* request */ ++ USB_TYPE_VENDOR|USB_DIR_IN, /* requesttype */ ++ 0, /* value */ ++ 0, /* index */ ++ loc, /* dataptr */ ++ acklen, /* size */ ++ ACX_USB_CTRL_TIMEOUT /* timeout in ms */ ++ ); ++ if (result < 0) { ++ printk("%s: "FUNC"(): USB read error %d\n", devname, result); ++ goto bad; ++ } ++ if (acx_debug & L_CTL) { ++ printk("read %d bytes: ", result); ++ acx_dump_bytes(loc, result); ++ } ++ ++/* ++ check for result==buflen+4? Was seen: ++ ++interrogate(type:ACX100_IE_DOT11_ED_THRESHOLD,len:4) ++issue_cmd(cmd:ACX1xx_CMD_INTERROGATE,buflen:8,type:4111) ++ctrl inpipe=0x80000280 outpipe=0x80000200 ++sending USB control msg (out) (blocklen=8) ++01 00 00 00 0F 10 04 00 ++wrote 8 bytes ++sending USB control msg (in) (acklen=12) sizeof(loc->data ++read 4 bytes <==== MUST BE 12!! ++*/ ++ ++ cmd_status = le16_to_cpu(loc->status); ++ if (cmd_status != 1) { ++ printk("%s: "FUNC"(): cmd_status is not SUCCESS: %d (%s)\n", ++ devname, cmd_status, acx_cmd_status_str(cmd_status)); ++ /* TODO: goto bad; ? */ ++ } ++ if ((cmd == ACX1xx_CMD_INTERROGATE) && buffer && buflen) { ++ memcpy(buffer, loc->data, buflen); ++ log(L_CTL, "response frame: cmd=0x%04X status=%d\n", ++ le16_to_cpu(loc->cmd), ++ cmd_status); ++ } ++good: ++ kfree(loc); ++ FN_EXIT1(OK); ++ return OK; ++bad: ++ /* Give enough info so that callers can avoid ++ ** printing their own diagnostic messages */ ++#if ACX_DEBUG ++ printk("%s: "FUNC"(cmd:%s) FAILED\n", devname, cmdstr); ++#else ++ printk("%s: "FUNC"(cmd:0x%04X) FAILED\n", devname, cmd); ++#endif ++ dump_stack(); ++ kfree(loc); ++ FN_EXIT1(NOT_OK); ++ return NOT_OK; ++} ++ ++ ++/*********************************************************************** ++** acxusb_boot() ++** Inputs: ++** usbdev -> Pointer to kernel's usb_device structure ++** ++** Returns: ++** (int) Errorcode or 0 on success ++** ++** This function triggers the loading of the firmware image from harddisk ++** and then uploads the firmware to the USB device. After uploading the ++** firmware and transmitting the checksum, the device resets and appears ++** as a new device on the USB bus (the device we can finally deal with) ++*/ ++static inline int ++acxusb_fw_needs_padding(firmware_image_t *fw_image, unsigned int usb_maxlen) ++{ ++ unsigned int num_xfers = ((fw_image->size - 1) / usb_maxlen) + 1; ++ ++ return ((num_xfers % 2) == 0); ++} ++ ++static int ++acxusb_boot(struct usb_device *usbdev, int is_tnetw1450, int *radio_type) ++{ ++ char filename[sizeof("tiacx1NNusbcRR")]; ++ ++ firmware_image_t *fw_image = NULL; ++ char *usbbuf; ++ unsigned int offset; ++ unsigned int blk_len, inpipe, outpipe; ++ u32 num_processed; ++ u32 img_checksum, sum; ++ u32 file_size; ++ int result = -EIO; ++ int i; ++ ++ FN_ENTER; ++ ++ /* dump_device(usbdev); */ ++ ++ usbbuf = kmalloc(USB_RWMEM_MAXLEN, GFP_KERNEL); ++ if (!usbbuf) { ++ printk(KERN_ERR "acx: no memory for USB transfer buffer (%d bytes)\n", USB_RWMEM_MAXLEN); ++ result = -ENOMEM; ++ goto end; ++ } ++ if (is_tnetw1450) { ++ /* Obtain the I/O pipes */ ++ outpipe = usb_sndbulkpipe(usbdev, 1); ++ inpipe = usb_rcvbulkpipe(usbdev, 2); ++ ++ printk(KERN_DEBUG "wait for device ready\n"); ++ for (i = 0; i <= 2; i++) { ++ result = usb_bulk_msg(usbdev, inpipe, ++ usbbuf, ++ USB_RWMEM_MAXLEN, ++ &num_processed, ++ 2000 ++ ); ++ ++ if ((*(u32 *)&usbbuf[4] == 0x40000001) ++ && (*(u16 *)&usbbuf[2] == 0x1) ++ && ((*(u16 *)usbbuf & 0x3fff) == 0) ++ && ((*(u16 *)usbbuf & 0xc000) == 0xc000)) ++ break; ++ msleep(10); ++ } ++ if (i == 2) ++ goto fw_end; ++ ++ *radio_type = usbbuf[8]; ++ } else { ++ /* Obtain the I/O pipes */ ++ outpipe = usb_sndctrlpipe(usbdev, 0); ++ inpipe = usb_rcvctrlpipe(usbdev, 0); ++ ++ /* FIXME: shouldn't be hardcoded */ ++ *radio_type = RADIO_MAXIM_0D; ++ } ++ ++ snprintf(filename, sizeof(filename), "tiacx1%02dusbc%02X", ++ is_tnetw1450 * 11, *radio_type); ++ ++ fw_image = acx_s_read_fw(&usbdev->dev, filename, &file_size); ++ if (!fw_image) { ++ result = -EIO; ++ goto end; ++ } ++ log(L_INIT, "firmware size: %d bytes\n", file_size); ++ ++ img_checksum = le32_to_cpu(fw_image->chksum); ++ ++ if (is_tnetw1450) { ++ u8 cmdbuf[20]; ++ const u8 *p; ++ u8 need_padding; ++ u32 tmplen, val; ++ ++ memset(cmdbuf, 0, 16); ++ ++ need_padding = acxusb_fw_needs_padding(fw_image, USB_RWMEM_MAXLEN); ++ tmplen = need_padding ? file_size-4 : file_size-8; ++ *(u16 *)&cmdbuf[0] = 0xc000; ++ *(u16 *)&cmdbuf[2] = 0x000b; ++ *(u32 *)&cmdbuf[4] = tmplen; ++ *(u32 *)&cmdbuf[8] = file_size-8; ++ *(u32 *)&cmdbuf[12] = img_checksum; ++ ++ result = usb_bulk_msg(usbdev, outpipe, cmdbuf, 16, &num_processed, HZ); ++ if (result < 0) ++ goto fw_end; ++ ++ p = (const u8 *)&fw_image->size; ++ ++ /* first calculate checksum for image size part */ ++ sum = p[0]+p[1]+p[2]+p[3]; ++ p += 4; ++ ++ /* now continue checksum for firmware data part */ ++ tmplen = le32_to_cpu(fw_image->size); ++ for (i = 0; i < tmplen /* image size */; i++) { ++ sum += *p++; ++ } ++ ++ if (sum != le32_to_cpu(fw_image->chksum)) { ++ printk("acx: FATAL: firmware upload: " ++ "checksums don't match! " ++ "(0x%08x vs. 0x%08x)\n", ++ sum, fw_image->chksum); ++ goto fw_end; ++ } ++ ++ offset = 8; ++ while (offset < file_size) { ++ blk_len = file_size - offset; ++ if (blk_len > USB_RWMEM_MAXLEN) { ++ blk_len = USB_RWMEM_MAXLEN; ++ } ++ ++ log(L_INIT, "uploading firmware (%d bytes, offset=%d)\n", ++ blk_len, offset); ++ memcpy(usbbuf, ((u8 *)fw_image) + offset, blk_len); ++ ++ p = usbbuf; ++ for (i = 0; i < blk_len; i += 4) { ++ *(u32 *)p = be32_to_cpu(*(u32 *)p); ++ p += 4; ++ } ++ ++ result = usb_bulk_msg(usbdev, outpipe, usbbuf, blk_len, &num_processed, HZ); ++ if ((result < 0) || (num_processed != blk_len)) ++ goto fw_end; ++ offset += blk_len; ++ } ++ if (need_padding) { ++ printk(KERN_DEBUG "send padding\n"); ++ memset(usbbuf, 0, 4); ++ result = usb_bulk_msg(usbdev, outpipe, usbbuf, 4, &num_processed, HZ); ++ if ((result < 0) || (num_processed != 4)) ++ goto fw_end; ++ } ++ printk(KERN_DEBUG "read firmware upload result\n"); ++ memset(cmdbuf, 0, 20); /* additional memset */ ++ result = usb_bulk_msg(usbdev, inpipe, cmdbuf, 20, &num_processed, 2000); ++ if (result < 0) ++ goto fw_end; ++ if (*(u32 *)&cmdbuf[4] == 0x40000003) ++ goto fw_end; ++ if (*(u32 *)&cmdbuf[4]) ++ goto fw_end; ++ if (*(u16 *)&cmdbuf[16] != 1) ++ goto fw_end; ++ ++ val = *(u32 *)&cmdbuf[0]; ++ if ((val & 0x3fff) ++ || ((val & 0xc000) != 0xc000)) ++ goto fw_end; ++ ++ val = *(u32 *)&cmdbuf[8]; ++ if (val & 2) { ++ result = usb_bulk_msg(usbdev, inpipe, cmdbuf, 20, &num_processed, 2000); ++ if (result < 0) ++ goto fw_end; ++ val = *(u32 *)&cmdbuf[8]; ++ } ++ /* yup, no "else" here! */ ++ if (val & 1) { ++ memset(usbbuf, 0, 4); ++ result = usb_bulk_msg(usbdev, outpipe, usbbuf, 4, &num_processed, HZ); ++ if ((result < 0) || (!num_processed)) ++ goto fw_end; ++ } ++ ++ printk("TNETW1450 firmware upload successful!\n"); ++ result = 0; ++ goto end; ++fw_end: ++ result = -EIO; ++ goto end; ++ } else { ++ /* ACX100 USB */ ++ ++ /* now upload the firmware, slice the data into blocks */ ++ offset = 8; ++ while (offset < file_size) { ++ blk_len = file_size - offset; ++ if (blk_len > USB_RWMEM_MAXLEN) { ++ blk_len = USB_RWMEM_MAXLEN; ++ } ++ log(L_INIT, "uploading firmware (%d bytes, offset=%d)\n", ++ blk_len, offset); ++ memcpy(usbbuf, ((u8 *)fw_image) + offset, blk_len); ++ result = usb_control_msg(usbdev, outpipe, ++ ACX_USB_REQ_UPLOAD_FW, ++ USB_TYPE_VENDOR|USB_DIR_OUT, ++ (file_size - 8) & 0xffff, /* value */ ++ (file_size - 8) >> 16, /* index */ ++ usbbuf, /* dataptr */ ++ blk_len, /* size */ ++ 3000 /* timeout in ms */ ++ ); ++ offset += blk_len; ++ if (result < 0) { ++ printk(KERN_ERR "acx: error %d during upload " ++ "of firmware, aborting\n", result); ++ goto end; ++ } ++ } ++ ++ /* finally, send the checksum and reboot the device */ ++ /* does this trigger the reboot? */ ++ result = usb_control_msg(usbdev, outpipe, ++ ACX_USB_REQ_UPLOAD_FW, ++ USB_TYPE_VENDOR|USB_DIR_OUT, ++ img_checksum & 0xffff, /* value */ ++ img_checksum >> 16, /* index */ ++ NULL, /* dataptr */ ++ 0, /* size */ ++ 3000 /* timeout in ms */ ++ ); ++ if (result < 0) { ++ printk(KERN_ERR "acx: error %d during tx of checksum, " ++ "aborting\n", result); ++ goto end; ++ } ++ result = usb_control_msg(usbdev, inpipe, ++ ACX_USB_REQ_ACK_CS, ++ USB_TYPE_VENDOR|USB_DIR_IN, ++ img_checksum & 0xffff, /* value */ ++ img_checksum >> 16, /* index */ ++ usbbuf, /* dataptr */ ++ 8, /* size */ ++ 3000 /* timeout in ms */ ++ ); ++ if (result < 0) { ++ printk(KERN_ERR "acx: error %d during ACK of checksum, " ++ "aborting\n", result); ++ goto end; ++ } ++ if (*usbbuf != 0x10) { ++ printk(KERN_ERR "acx: invalid checksum?\n"); ++ result = -EINVAL; ++ goto end; ++ } ++ result = 0; ++ } ++ ++end: ++ vfree(fw_image); ++ kfree(usbbuf); ++ ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/* FIXME: maybe merge it with usual eeprom reading, into common code? */ ++static void ++acxusb_s_read_eeprom_version(acx_device_t *adev) ++{ ++ u8 eeprom_ver[0x8]; ++ ++ memset(eeprom_ver, 0, sizeof(eeprom_ver)); ++ acx_s_interrogate(adev, &eeprom_ver, ACX1FF_IE_EEPROM_VER); ++ ++ /* FIXME: which one of those values to take? */ ++ adev->eeprom_version = eeprom_ver[5]; ++} ++ ++ ++/* ++ * temporary helper function to at least fill important cfgopt members with ++ * useful replacement values until we figure out how one manages to fetch ++ * the configoption struct in the USB device case... ++ */ ++static int ++acxusb_s_fill_configoption(acx_device_t *adev) ++{ ++ adev->cfgopt_probe_delay = 200; ++ adev->cfgopt_dot11CCAModes = 4; ++ adev->cfgopt_dot11Diversity = 1; ++ adev->cfgopt_dot11ShortPreambleOption = 1; ++ adev->cfgopt_dot11PBCCOption = 1; ++ adev->cfgopt_dot11ChannelAgility = 0; ++ adev->cfgopt_dot11PhyType = 5; ++ adev->cfgopt_dot11TempType = 1; ++ return OK; ++} ++ ++ ++/*********************************************************************** ++** acxusb_e_probe() ++** ++** This function is invoked by the kernel's USB core whenever a new device is ++** attached to the system or the module is loaded. It is presented a usb_device ++** structure from which information regarding the device is obtained and evaluated. ++** In case this driver is able to handle one of the offered devices, it returns ++** a non-null pointer to a driver context and thereby claims the device. ++*/ ++ ++static void ++dummy_netdev_init(struct net_device *ndev) {} ++ ++static int ++acxusb_e_probe(struct usb_interface *intf, const struct usb_device_id *devID) ++{ ++ struct usb_device *usbdev = interface_to_usbdev(intf); ++ acx_device_t *adev = NULL; ++ struct net_device *ndev = NULL; ++ struct usb_config_descriptor *config; ++ struct usb_endpoint_descriptor *epdesc; ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11) ++ struct usb_host_endpoint *ep; ++#endif ++ struct usb_interface_descriptor *ifdesc; ++ const char* msg; ++ int numconfigs, numfaces, numep; ++ int result = OK; ++ int i; ++ int radio_type; ++ /* this one needs to be more precise in case there appears a TNETW1450 from the same vendor */ ++ int is_tnetw1450 = (usbdev->descriptor.idVendor != ACX100_VENDOR_ID); ++ ++ FN_ENTER; ++ ++ if (is_tnetw1450) { ++ /* Boot the device (i.e. upload the firmware) */ ++ acxusb_boot(usbdev, is_tnetw1450, &radio_type); ++ ++ /* TNETW1450-based cards will continue right away with ++ * the same USB ID after booting */ ++ } else { ++ /* First check if this is the "unbooted" hardware */ ++ if (usbdev->descriptor.idProduct == ACX100_PRODUCT_ID_UNBOOTED) { ++ ++ /* Boot the device (i.e. upload the firmware) */ ++ acxusb_boot(usbdev, is_tnetw1450, &radio_type); ++ ++ /* DWL-120+ will first boot the firmware, ++ * then later have a *separate* probe() run ++ * since its USB ID will have changed after ++ * firmware boot! ++ * Since the first probe() run has no ++ * other purpose than booting the firmware, ++ * simply return immediately. ++ */ ++ log(L_INIT, "finished booting, returning from probe()\n"); ++ result = OK; /* success */ ++ goto end; ++ } ++ else ++ /* device not unbooted, but invalid USB ID!? */ ++ if (usbdev->descriptor.idProduct != ACX100_PRODUCT_ID_BOOTED) ++ goto end_nodev; ++ } ++ ++/* Ok, so it's our device and it has already booted */ ++ ++ /* Allocate memory for a network device */ ++ ++ ndev = alloc_netdev(sizeof(*adev), "wlan%d", dummy_netdev_init); ++ /* (NB: memsets to 0 entire area) */ ++ if (!ndev) { ++ msg = "acx: no memory for netdev\n"; ++ goto end_nomem; ++ } ++ ++ /* Register the callbacks for the network device functions */ ++ ++ ether_setup(ndev); ++ ndev->open = &acxusb_e_open; ++ ndev->stop = &acxusb_e_close; ++ ndev->hard_start_xmit = (void *)&acx_i_start_xmit; ++ ndev->get_stats = (void *)&acx_e_get_stats; ++#if IW_HANDLER_VERSION <= 5 ++ ndev->get_wireless_stats = (void *)&acx_e_get_wireless_stats; ++#endif ++ ndev->wireless_handlers = (struct iw_handler_def *)&acx_ioctl_handler_def; ++ ndev->set_multicast_list = (void *)&acxusb_i_set_rx_mode; ++#ifdef HAVE_TX_TIMEOUT ++ ndev->tx_timeout = &acxusb_i_tx_timeout; ++ ndev->watchdog_timeo = 4 * HZ; ++#endif ++ ndev->change_mtu = &acx_e_change_mtu; ++ SET_MODULE_OWNER(ndev); ++ ++ /* Setup private driver context */ ++ ++ adev = ndev2adev(ndev); ++ adev->ndev = ndev; ++ ++ adev->dev_type = DEVTYPE_USB; ++ adev->radio_type = radio_type; ++ if (is_tnetw1450) { ++ /* well, actually it's a TNETW1450, but since it ++ * seems to be sufficiently similar to TNETW1130, ++ * I don't want to change large amounts of code now */ ++ adev->chip_type = CHIPTYPE_ACX111; ++ } else { ++ adev->chip_type = CHIPTYPE_ACX100; ++ } ++ ++ adev->usbdev = usbdev; ++ spin_lock_init(&adev->lock); /* initial state: unlocked */ ++ sema_init(&adev->sem, 1); /* initial state: 1 (upped) */ ++ ++ /* Check that this is really the hardware we know about. ++ ** If not sure, at least notify the user that he ++ ** may be in trouble... ++ */ ++ numconfigs = (int)usbdev->descriptor.bNumConfigurations; ++ if (numconfigs != 1) ++ printk("acx: number of configurations is %d, " ++ "this driver only knows how to handle 1, " ++ "be prepared for surprises\n", numconfigs); ++ ++ config = &usbdev->config->desc; ++ numfaces = config->bNumInterfaces; ++ if (numfaces != 1) ++ printk("acx: number of interfaces is %d, " ++ "this driver only knows how to handle 1, " ++ "be prepared for surprises\n", numfaces); ++ ++ ifdesc = &intf->altsetting->desc; ++ numep = ifdesc->bNumEndpoints; ++ log(L_DEBUG, "# of endpoints: %d\n", numep); ++ ++ if (is_tnetw1450) { ++ adev->bulkoutep = 1; ++ adev->bulkinep = 2; ++ } else { ++ /* obtain information about the endpoint ++ ** addresses, begin with some default values ++ */ ++ adev->bulkoutep = 1; ++ adev->bulkinep = 1; ++ for (i = 0; i < numep; i++) { ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11) ++ ep = usbdev->ep_in[i]; ++ if (!ep) ++ continue; ++ epdesc = &ep->desc; ++#else ++ epdesc = usb_epnum_to_ep_desc(usbdev, i); ++ if (!epdesc) ++ continue; ++#endif ++ if (epdesc->bmAttributes & USB_ENDPOINT_XFER_BULK) { ++ if (epdesc->bEndpointAddress & 0x80) ++ adev->bulkinep = epdesc->bEndpointAddress & 0xF; ++ else ++ adev->bulkoutep = epdesc->bEndpointAddress & 0xF; ++ } ++ } ++ } ++ log(L_DEBUG, "bulkout ep: 0x%X\n", adev->bulkoutep); ++ log(L_DEBUG, "bulkin ep: 0x%X\n", adev->bulkinep); ++ ++ /* already done by memset: adev->rxtruncsize = 0; */ ++ log(L_DEBUG, "TXBUFSIZE=%d RXBUFSIZE=%d\n", ++ (int) TXBUFSIZE, (int) RXBUFSIZE); ++ ++ /* Allocate the RX/TX containers. */ ++ adev->usb_tx = kmalloc(sizeof(usb_tx_t) * ACX_TX_URB_CNT, GFP_KERNEL); ++ if (!adev->usb_tx) { ++ msg = "acx: no memory for tx container"; ++ goto end_nomem; ++ } ++ adev->usb_rx = kmalloc(sizeof(usb_rx_t) * ACX_RX_URB_CNT, GFP_KERNEL); ++ if (!adev->usb_rx) { ++ msg = "acx: no memory for rx container"; ++ goto end_nomem; ++ } ++ ++ /* Setup URBs for bulk-in/out messages */ ++ for (i = 0; i < ACX_RX_URB_CNT; i++) { ++ adev->usb_rx[i].urb = usb_alloc_urb(0, GFP_KERNEL); ++ if (!adev->usb_rx[i].urb) { ++ msg = "acx: no memory for input URB\n"; ++ goto end_nomem; ++ } ++ adev->usb_rx[i].urb->status = 0; ++ adev->usb_rx[i].adev = adev; ++ adev->usb_rx[i].busy = 0; ++ } ++ ++ for (i = 0; i< ACX_TX_URB_CNT; i++) { ++ adev->usb_tx[i].urb = usb_alloc_urb(0, GFP_KERNEL); ++ if (!adev->usb_tx[i].urb) { ++ msg = "acx: no memory for output URB\n"; ++ goto end_nomem; ++ } ++ adev->usb_tx[i].urb->status = 0; ++ adev->usb_tx[i].adev = adev; ++ adev->usb_tx[i].busy = 0; ++ } ++ adev->tx_free = ACX_TX_URB_CNT; ++ ++ usb_set_intfdata(intf, adev); ++ SET_NETDEV_DEV(ndev, &intf->dev); ++ ++ /* TODO: move all of fw cmds to open()? But then we won't know our MAC addr ++ until ifup (it's available via reading ACX1xx_IE_DOT11_STATION_ID)... */ ++ ++ /* put acx out of sleep mode and initialize it */ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_WAKE, NULL, 0); ++ ++ result = acx_s_init_mac(adev); ++ if (result) ++ goto end; ++ ++ /* TODO: see similar code in pci.c */ ++ acxusb_s_read_eeprom_version(adev); ++ acxusb_s_fill_configoption(adev); ++ acx_s_set_defaults(adev); ++ acx_s_get_firmware_version(adev); ++ acx_display_hardware_details(adev); ++ ++ /* Register the network device */ ++ log(L_INIT, "registering network device\n"); ++ result = register_netdev(ndev); ++ if (result) { ++ msg = "acx: failed to register USB network device " ++ "(error %d)\n"; ++ goto end_nomem; ++ } ++ ++ acx_proc_register_entries(ndev); ++ ++ acx_stop_queue(ndev, "on probe"); ++ acx_carrier_off(ndev, "on probe"); ++ ++ printk("acx: USB module " ACX_RELEASE " loaded successfully\n"); ++ ++#if CMD_DISCOVERY ++ great_inquisitor(adev); ++#endif ++ ++ /* Everything went OK, we are happy now */ ++ result = OK; ++ goto end; ++ ++end_nomem: ++ printk(msg, result); ++ ++ if (ndev) { ++ if (adev->usb_rx) { ++ for (i = 0; i < ACX_RX_URB_CNT; i++) ++ usb_free_urb(adev->usb_rx[i].urb); ++ kfree(adev->usb_rx); ++ } ++ if (adev->usb_tx) { ++ for (i = 0; i < ACX_TX_URB_CNT; i++) ++ usb_free_urb(adev->usb_tx[i].urb); ++ kfree(adev->usb_tx); ++ } ++ free_netdev(ndev); ++ } ++ ++ result = -ENOMEM; ++ goto end; ++ ++end_nodev: ++ /* no device we could handle, return error. */ ++ result = -EIO; ++ ++end: ++ FN_EXIT1(result); ++ return result; ++} ++ ++ ++/*********************************************************************** ++** acxusb_e_disconnect() ++** ++** This function is invoked whenever the user pulls the plug from the USB ++** device or the module is removed from the kernel. In these cases, the ++** network devices have to be taken down and all allocated memory has ++** to be freed. ++*/ ++static void ++acxusb_e_disconnect(struct usb_interface *intf) ++{ ++ acx_device_t *adev = usb_get_intfdata(intf); ++ unsigned long flags; ++ int i; ++ ++ FN_ENTER; ++ ++ /* No WLAN device... no sense */ ++ if (!adev) ++ goto end; ++ ++ /* Unregister network device ++ * ++ * If the interface is up, unregister_netdev() will take ++ * care of calling our close() function, which takes ++ * care of unlinking the urbs, sending the device to ++ * sleep, etc... ++ * This can't be called with sem or lock held because ++ * _close() will try to grab it as well if it's called, ++ * deadlocking the machine. ++ */ ++ unregister_netdev(adev->ndev); ++ ++ acx_sem_lock(adev); ++ acx_lock(adev, flags); ++ /* This device exists no more */ ++ usb_set_intfdata(intf, NULL); ++ acx_proc_unregister_entries(adev->ndev); ++ ++ /* ++ * Here we only free them. _close() took care of ++ * unlinking them. ++ */ ++ for (i = 0; i < ACX_RX_URB_CNT; ++i) { ++ usb_free_urb(adev->usb_rx[i].urb); ++ } ++ for (i = 0; i< ACX_TX_URB_CNT; ++i) { ++ usb_free_urb(adev->usb_tx[i].urb); ++ } ++ ++ /* Freeing containers */ ++ kfree(adev->usb_rx); ++ kfree(adev->usb_tx); ++ ++ acx_unlock(adev, flags); ++ acx_sem_unlock(adev); ++ ++ free_netdev(adev->ndev); ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxusb_e_open() ++** This function is called when the user sets up the network interface. ++** It initializes a management timer, sets up the USB card and starts ++** the network tx queue and USB receive. ++*/ ++static int ++acxusb_e_open(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ int i; ++ ++ FN_ENTER; ++ ++ acx_sem_lock(adev); ++ ++ /* put the ACX100 out of sleep mode */ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_WAKE, NULL, 0); ++ ++ acx_init_task_scheduler(adev); ++ ++ init_timer(&adev->mgmt_timer); ++ adev->mgmt_timer.function = acx_i_timer; ++ adev->mgmt_timer.data = (unsigned long)adev; ++ ++ /* acx_s_start needs it */ ++ SET_BIT(adev->dev_state_mask, ACX_STATE_IFACE_UP); ++ acx_s_start(adev); ++ ++ /* don't acx_start_queue() here, we need to associate first */ ++ ++ acx_lock(adev, flags); ++ for (i = 0; i < ACX_RX_URB_CNT; i++) { ++ adev->usb_rx[i].urb->status = 0; ++ } ++ ++ acxusb_l_poll_rx(adev, &adev->usb_rx[0]); ++ ++ acx_unlock(adev, flags); ++ ++ acx_sem_unlock(adev); ++ ++ FN_EXIT0; ++ return 0; ++} ++ ++ ++/*********************************************************************** ++** acxusb_e_close() ++** ++** This function stops the network functionality of the interface (invoked ++** when the user calls ifconfig <wlan> down). The tx queue is halted and ++** the device is marked as down. In case there were any pending USB bulk ++** transfers, these are unlinked (asynchronously). The module in-use count ++** is also decreased in this function. ++*/ ++static int ++acxusb_e_close(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ int i; ++ ++ FN_ENTER; ++ ++#ifdef WE_STILL_DONT_CARE_ABOUT_IT ++ /* Transmit a disassociate frame */ ++ lock ++ acx_l_transmit_disassoc(adev, &client); ++ unlock ++#endif ++ ++ acx_sem_lock(adev); ++ ++ CLEAR_BIT(adev->dev_state_mask, ACX_STATE_IFACE_UP); ++ ++/* Code below is remarkably similar to acxpci_s_down(). Maybe we can merge them? */ ++ ++ /* Make sure we don't get any more rx requests */ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_DISABLE_RX, NULL, 0); ++ acx_s_issue_cmd(adev, ACX1xx_CMD_DISABLE_TX, NULL, 0); ++ ++ /* ++ * We must do FLUSH *without* holding sem to avoid a deadlock. ++ * See pci.c:acxpci_s_down() for deails. ++ */ ++ acx_sem_unlock(adev); ++ FLUSH_SCHEDULED_WORK(); ++ acx_sem_lock(adev); ++ ++ /* Power down the device */ ++ acx_s_issue_cmd(adev, ACX1xx_CMD_SLEEP, NULL, 0); ++ ++ /* Stop the transmit queue, mark the device as DOWN */ ++ acx_lock(adev, flags); ++ acx_stop_queue(ndev, "on ifdown"); ++ acx_set_status(adev, ACX_STATUS_0_STOPPED); ++ /* stop pending rx/tx urb transfers */ ++ for (i = 0; i < ACX_TX_URB_CNT; i++) { ++ acxusb_unlink_urb(adev->usb_tx[i].urb); ++ adev->usb_tx[i].busy = 0; ++ } ++ for (i = 0; i < ACX_RX_URB_CNT; i++) { ++ acxusb_unlink_urb(adev->usb_rx[i].urb); ++ adev->usb_rx[i].busy = 0; ++ } ++ adev->tx_free = ACX_TX_URB_CNT; ++ acx_unlock(adev, flags); ++ ++ /* Must do this outside of lock */ ++ del_timer_sync(&adev->mgmt_timer); ++ ++ acx_sem_unlock(adev); ++ ++ FN_EXIT0; ++ return 0; ++} ++ ++ ++/*********************************************************************** ++** acxusb_l_poll_rx ++** This function (re)initiates a bulk-in USB transfer on a given urb ++*/ ++static void ++acxusb_l_poll_rx(acx_device_t *adev, usb_rx_t* rx) ++{ ++ struct usb_device *usbdev; ++ struct urb *rxurb; ++ int errcode, rxnum; ++ unsigned int inpipe; ++ ++ FN_ENTER; ++ ++ rxurb = rx->urb; ++ usbdev = adev->usbdev; ++ ++ rxnum = rx - adev->usb_rx; ++ ++ inpipe = usb_rcvbulkpipe(usbdev, adev->bulkinep); ++ if (unlikely(rxurb->status == -EINPROGRESS)) { ++ printk(KERN_ERR "acx: error, rx triggered while rx urb in progress\n"); ++ /* FIXME: this is nasty, receive is being cancelled by this code ++ * on the other hand, this should not happen anyway... ++ */ ++ usb_unlink_urb(rxurb); ++ } else ++ if (unlikely(rxurb->status == -ECONNRESET)) { ++ log(L_USBRXTX, "acx_usb: _poll_rx: connection reset\n"); ++ goto end; ++ } ++ rxurb->actual_length = 0; ++ usb_fill_bulk_urb(rxurb, usbdev, inpipe, ++ &rx->bulkin, /* dataptr */ ++ RXBUFSIZE, /* size */ ++ acxusb_i_complete_rx, /* handler */ ++ rx /* handler param */ ++ ); ++ rxurb->transfer_flags = URB_ASYNC_UNLINK; ++ ++ /* ATOMIC: we may be called from complete_rx() usb callback */ ++ errcode = usb_submit_urb(rxurb, GFP_ATOMIC); ++ /* FIXME: evaluate the error code! */ ++ log(L_USBRXTX, "SUBMIT RX (%d) inpipe=0x%X size=%d errcode=%d\n", ++ rxnum, inpipe, (int) RXBUFSIZE, errcode); ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxusb_i_complete_rx() ++** Inputs: ++** urb -> pointer to USB request block ++** regs -> pointer to register-buffer for syscalls (see asm/ptrace.h) ++** ++** This function is invoked by USB subsystem whenever a bulk receive ++** request returns. ++** The received data is then committed to the network stack and the next ++** USB receive is triggered. ++*/ ++static void ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19) ++acxusb_i_complete_rx(struct urb *urb) ++#else ++acxusb_i_complete_rx(struct urb *urb, struct pt_regs *regs) ++#endif ++{ ++ acx_device_t *adev; ++ rxbuffer_t *ptr; ++ rxbuffer_t *inbuf; ++ usb_rx_t *rx; ++ unsigned long flags; ++ int size, remsize, packetsize, rxnum; ++ ++ FN_ENTER; ++ ++ BUG_ON(!urb->context); ++ ++ rx = (usb_rx_t *)urb->context; ++ adev = rx->adev; ++ ++ acx_lock(adev, flags); ++ ++ /* ++ * Happens on disconnect or close. Don't play with the urb. ++ * Don't resubmit it. It will get unlinked by close() ++ */ ++ if (unlikely(!(adev->dev_state_mask & ACX_STATE_IFACE_UP))) { ++ log(L_USBRXTX, "rx: device is down, not doing anything\n"); ++ goto end_unlock; ++ } ++ ++ inbuf = &rx->bulkin; ++ size = urb->actual_length; ++ remsize = size; ++ rxnum = rx - adev->usb_rx; ++ ++ log(L_USBRXTX, "RETURN RX (%d) status=%d size=%d\n", ++ rxnum, urb->status, size); ++ ++ /* Send the URB that's waiting. */ ++ log(L_USBRXTX, "rxnum=%d, sending=%d\n", rxnum, rxnum^1); ++ acxusb_l_poll_rx(adev, &adev->usb_rx[rxnum^1]); ++ ++ if (unlikely(size > sizeof(rxbuffer_t))) ++ printk("acx_usb: rx too large: %d, please report\n", size); ++ ++ /* check if the transfer was aborted */ ++ switch (urb->status) { ++ case 0: /* No error */ ++ break; ++ case -EOVERFLOW: ++ printk(KERN_ERR "acx: rx data overrun\n"); ++ adev->rxtruncsize = 0; /* Not valid anymore. */ ++ goto end_unlock; ++ case -ECONNRESET: ++ adev->rxtruncsize = 0; ++ goto end_unlock; ++ case -ESHUTDOWN: /* rmmod */ ++ adev->rxtruncsize = 0; ++ goto end_unlock; ++ default: ++ adev->rxtruncsize = 0; ++ adev->stats.rx_errors++; ++ printk("acx: rx error (urb status=%d)\n", urb->status); ++ goto end_unlock; ++ } ++ ++ if (unlikely(!size)) ++ printk("acx: warning, encountered zerolength rx packet\n"); ++ ++ if (urb->transfer_buffer != inbuf) ++ goto end_unlock; ++ ++ /* check if previous frame was truncated ++ ** FIXME: this code can only handle truncation ++ ** of consecutive packets! ++ */ ++ ptr = inbuf; ++ if (adev->rxtruncsize) { ++ int tail_size; ++ ++ ptr = &adev->rxtruncbuf; ++ packetsize = RXBUF_BYTES_USED(ptr); ++ if (acx_debug & L_USBRXTX) { ++ printk("handling truncated frame (truncsize=%d size=%d " ++ "packetsize(from trunc)=%d)\n", ++ adev->rxtruncsize, size, packetsize); ++ acx_dump_bytes(ptr, RXBUF_HDRSIZE); ++ acx_dump_bytes(inbuf, RXBUF_HDRSIZE); ++ } ++ ++ /* bytes needed for rxtruncbuf completion: */ ++ tail_size = packetsize - adev->rxtruncsize; ++ ++ if (size < tail_size) { ++ /* there is not enough data to complete this packet, ++ ** simply append the stuff to the truncation buffer ++ */ ++ memcpy(((char *)ptr) + adev->rxtruncsize, inbuf, size); ++ adev->rxtruncsize += size; ++ remsize = 0; ++ } else { ++ /* ok, this data completes the previously ++ ** truncated packet. copy it into a descriptor ++ ** and give it to the rest of the stack */ ++ ++ /* append tail to previously truncated part ++ ** NB: adev->rxtruncbuf (pointed to by ptr) can't ++ ** overflow because this is already checked before ++ ** truncation buffer was filled. See below, ++ ** "if (packetsize > sizeof(rxbuffer_t))..." code */ ++ memcpy(((char *)ptr) + adev->rxtruncsize, inbuf, tail_size); ++ ++ if (acx_debug & L_USBRXTX) { ++ printk("full trailing packet + 12 bytes:\n"); ++ acx_dump_bytes(inbuf, tail_size + RXBUF_HDRSIZE); ++ } ++ acx_l_process_rxbuf(adev, ptr); ++ adev->rxtruncsize = 0; ++ ptr = (rxbuffer_t *) (((char *)inbuf) + tail_size); ++ remsize -= tail_size; ++ } ++ log(L_USBRXTX, "post-merge size=%d remsize=%d\n", ++ size, remsize); ++ } ++ ++ /* size = USB data block size ++ ** remsize = unprocessed USB bytes left ++ ** ptr = current pos in USB data block ++ */ ++ while (remsize) { ++ if (remsize < RXBUF_HDRSIZE) { ++ printk("acx: truncated rx header (%d bytes)!\n", ++ remsize); ++ if (ACX_DEBUG) ++ acx_dump_bytes(ptr, remsize); ++ break; ++ } ++ ++ packetsize = RXBUF_BYTES_USED(ptr); ++ log(L_USBRXTX, "packet with packetsize=%d\n", packetsize); ++ ++ if (RXBUF_IS_TXSTAT(ptr)) { ++ /* do rate handling */ ++ usb_txstatus_t *stat = (void*)ptr; ++ u16 client_no = (u16)stat->hostdata; ++ ++ log(L_USBRXTX, "tx: stat: mac_cnt_rcvd:%04X " ++ "queue_index:%02X mac_status:%02X hostdata:%08X " ++ "rate:%u ack_failures:%02X rts_failures:%02X " ++ "rts_ok:%02X\n", ++ stat->mac_cnt_rcvd, ++ stat->queue_index, stat->mac_status, stat->hostdata, ++ stat->rate, stat->ack_failures, stat->rts_failures, ++ stat->rts_ok); ++ ++ if (adev->rate_auto && client_no < VEC_SIZE(adev->sta_list)) { ++ client_t *clt = &adev->sta_list[client_no]; ++ u16 cur = stat->hostdata >> 16; ++ ++ if (clt && clt->rate_cur == cur) { ++ acx_l_handle_txrate_auto(adev, clt, ++ cur, /* intended rate */ ++ stat->rate, 0, /* actually used rate */ ++ stat->mac_status, /* error? */ ++ ACX_TX_URB_CNT - adev->tx_free); ++ } ++ } ++ goto next; ++ } ++ ++ if (packetsize > sizeof(rxbuffer_t)) { ++ printk("acx: packet exceeds max wlan " ++ "frame size (%d > %d). size=%d\n", ++ packetsize, (int) sizeof(rxbuffer_t), size); ++ if (ACX_DEBUG) ++ acx_dump_bytes(ptr, 16); ++ /* FIXME: put some real error-handling in here! */ ++ break; ++ } ++ ++ if (packetsize > remsize) { ++ /* frame truncation handling */ ++ if (acx_debug & L_USBRXTX) { ++ printk("need to truncate packet, " ++ "packetsize=%d remsize=%d " ++ "size=%d bytes:", ++ packetsize, remsize, size); ++ acx_dump_bytes(ptr, RXBUF_HDRSIZE); ++ } ++ memcpy(&adev->rxtruncbuf, ptr, remsize); ++ adev->rxtruncsize = remsize; ++ break; ++ } ++ ++ /* packetsize <= remsize */ ++ /* now handle the received data */ ++ acx_l_process_rxbuf(adev, ptr); ++next: ++ ptr = (rxbuffer_t *)(((char *)ptr) + packetsize); ++ remsize -= packetsize; ++ if ((acx_debug & L_USBRXTX) && remsize) { ++ printk("more than one packet in buffer, " ++ "second packet hdr:"); ++ acx_dump_bytes(ptr, RXBUF_HDRSIZE); ++ } ++ } ++ ++end_unlock: ++ acx_unlock(adev, flags); ++/* end: */ ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++** acxusb_i_complete_tx() ++** Inputs: ++** urb -> pointer to USB request block ++** regs -> pointer to register-buffer for syscalls (see asm/ptrace.h) ++** ++** This function is invoked upon termination of a USB transfer. ++*/ ++static void ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19) ++acxusb_i_complete_tx(struct urb *urb) ++#else ++acxusb_i_complete_tx(struct urb *urb, struct pt_regs *regs) ++#endif ++{ ++ acx_device_t *adev; ++ usb_tx_t *tx; ++ unsigned long flags; ++ int txnum; ++ ++ FN_ENTER; ++ ++ BUG_ON(!urb->context); ++ ++ tx = (usb_tx_t *)urb->context; ++ adev = tx->adev; ++ ++ txnum = tx - adev->usb_tx; ++ ++ acx_lock(adev, flags); ++ ++ /* ++ * If the iface isn't up, we don't have any right ++ * to play with them. The urb may get unlinked. ++ */ ++ if (unlikely(!(adev->dev_state_mask & ACX_STATE_IFACE_UP))) { ++ log(L_USBRXTX, "tx: device is down, not doing anything\n"); ++ goto end_unlock; ++ } ++ ++ log(L_USBRXTX, "RETURN TX (%d): status=%d size=%d\n", ++ txnum, urb->status, urb->actual_length); ++ ++ /* handle USB transfer errors */ ++ switch (urb->status) { ++ case 0: /* No error */ ++ break; ++ case -ESHUTDOWN: ++ goto end_unlock; ++ break; ++ case -ECONNRESET: ++ goto end_unlock; ++ break; ++ /* FIXME: real error-handling code here please */ ++ default: ++ printk(KERN_ERR "acx: tx error, urb status=%d\n", urb->status); ++ /* FIXME: real error-handling code here please */ ++ } ++ ++ /* free the URB and check for more data */ ++ tx->busy = 0; ++ adev->tx_free++; ++ if ((adev->tx_free >= TX_START_QUEUE) ++ && (adev->status == ACX_STATUS_4_ASSOCIATED) ++ && (acx_queue_stopped(adev->ndev)) ++ ) { ++ log(L_BUF, "tx: wake queue (%u free txbufs)\n", ++ adev->tx_free); ++ acx_wake_queue(adev->ndev, NULL); ++ } ++ ++end_unlock: ++ acx_unlock(adev, flags); ++/* end: */ ++ FN_EXIT0; ++} ++ ++ ++/*************************************************************** ++** acxusb_l_alloc_tx ++** Actually returns a usb_tx_t* ptr ++*/ ++tx_t* ++acxusb_l_alloc_tx(acx_device_t *adev) ++{ ++ usb_tx_t *tx; ++ unsigned head; ++ ++ FN_ENTER; ++ ++ head = adev->tx_head; ++ do { ++ head = (head + 1) % ACX_TX_URB_CNT; ++ if (!adev->usb_tx[head].busy) { ++ log(L_USBRXTX, "allocated tx %d\n", head); ++ tx = &adev->usb_tx[head]; ++ tx->busy = 1; ++ adev->tx_free--; ++ /* Keep a few free descs between head and tail of tx ring. ++ ** It is not absolutely needed, just feels safer */ ++ if (adev->tx_free < TX_STOP_QUEUE) { ++ log(L_BUF, "tx: stop queue " ++ "(%u free txbufs)\n", adev->tx_free); ++ acx_stop_queue(adev->ndev, NULL); ++ } ++ goto end; ++ } ++ } while (likely(head!=adev->tx_head)); ++ tx = NULL; ++ printk_ratelimited("acx: tx buffers full\n"); ++end: ++ adev->tx_head = head; ++ FN_EXIT0; ++ return (tx_t*)tx; ++} ++ ++ ++/*************************************************************** ++** Used if alloc_tx()'ed buffer needs to be cancelled without doing tx ++*/ ++void ++acxusb_l_dealloc_tx(tx_t *tx_opaque) ++{ ++ usb_tx_t* tx = (usb_tx_t*)tx_opaque; ++ tx->busy = 0; ++} ++ ++ ++/*************************************************************** ++*/ ++void* ++acxusb_l_get_txbuf(acx_device_t *adev, tx_t* tx_opaque) ++{ ++ usb_tx_t* tx = (usb_tx_t*)tx_opaque; ++ return &tx->bulkout.data; ++} ++ ++ ++/*************************************************************** ++** acxusb_l_tx_data ++** ++** Can be called from IRQ (rx -> (AP bridging or mgmt response) -> tx). ++** Can be called from acx_i_start_xmit (data frames from net core). ++*/ ++void ++acxusb_l_tx_data(acx_device_t *adev, tx_t* tx_opaque, int wlanpkt_len) ++{ ++ struct usb_device *usbdev; ++ struct urb* txurb; ++ usb_tx_t* tx; ++ usb_txbuffer_t* txbuf; ++ client_t *clt; ++ wlan_hdr_t* whdr; ++ unsigned int outpipe; ++ int ucode, txnum; ++ ++ FN_ENTER; ++ ++ tx = ((usb_tx_t *)tx_opaque); ++ txurb = tx->urb; ++ txbuf = &tx->bulkout; ++ whdr = (wlan_hdr_t *)txbuf->data; ++ txnum = tx - adev->usb_tx; ++ ++ log(L_DEBUG, "using buf#%d free=%d len=%d\n", ++ txnum, adev->tx_free, wlanpkt_len); ++ ++ switch (adev->mode) { ++ case ACX_MODE_0_ADHOC: ++ case ACX_MODE_3_AP: ++ clt = acx_l_sta_list_get(adev, whdr->a1); ++ break; ++ case ACX_MODE_2_STA: ++ clt = adev->ap_client; ++ break; ++ default: /* ACX_MODE_OFF, ACX_MODE_MONITOR */ ++ clt = NULL; ++ break; ++ } ++ ++ if (unlikely(clt && !clt->rate_cur)) { ++ printk("acx: driver bug! bad ratemask\n"); ++ goto end; ++ } ++ ++ /* fill the USB transfer header */ ++ txbuf->desc = cpu_to_le16(USB_TXBUF_TXDESC); ++ txbuf->mpdu_len = cpu_to_le16(wlanpkt_len); ++ txbuf->queue_index = 1; ++ if (clt) { ++ txbuf->rate = clt->rate_100; ++ txbuf->hostdata = (clt - adev->sta_list) | (clt->rate_cur << 16); ++ } else { ++ txbuf->rate = adev->rate_bcast100; ++ txbuf->hostdata = ((u16)-1) | (adev->rate_bcast << 16); ++ } ++ txbuf->ctrl1 = DESC_CTL_FIRSTFRAG; ++ if (1 == adev->preamble_cur) ++ SET_BIT(txbuf->ctrl1, DESC_CTL_SHORT_PREAMBLE); ++ txbuf->ctrl2 = 0; ++ txbuf->data_len = cpu_to_le16(wlanpkt_len); ++ ++ if (unlikely(acx_debug & L_DATA)) { ++ printk("dump of bulk out urb:\n"); ++ acx_dump_bytes(txbuf, wlanpkt_len + USB_TXBUF_HDRSIZE); ++ } ++ ++ if (unlikely(txurb->status == -EINPROGRESS)) { ++ printk("acx: trying to submit tx urb while already in progress\n"); ++ } ++ ++ /* now schedule the USB transfer */ ++ usbdev = adev->usbdev; ++ outpipe = usb_sndbulkpipe(usbdev, adev->bulkoutep); ++ ++ usb_fill_bulk_urb(txurb, usbdev, outpipe, ++ txbuf, /* dataptr */ ++ wlanpkt_len + USB_TXBUF_HDRSIZE, /* size */ ++ acxusb_i_complete_tx, /* handler */ ++ tx /* handler param */ ++ ); ++ ++ txurb->transfer_flags = URB_ASYNC_UNLINK|URB_ZERO_PACKET; ++ ucode = usb_submit_urb(txurb, GFP_ATOMIC); ++ log(L_USBRXTX, "SUBMIT TX (%d): outpipe=0x%X buf=%p txsize=%d " ++ "rate=%u errcode=%d\n", txnum, outpipe, txbuf, ++ wlanpkt_len + USB_TXBUF_HDRSIZE, txbuf->rate, ucode); ++ ++ if (unlikely(ucode)) { ++ printk(KERN_ERR "acx: submit_urb() error=%d txsize=%d\n", ++ ucode, wlanpkt_len + USB_TXBUF_HDRSIZE); ++ ++ /* on error, just mark the frame as done and update ++ ** the statistics ++ */ ++ adev->stats.tx_errors++; ++ tx->busy = 0; ++ adev->tx_free++; ++ /* needed? if (adev->tx_free > TX_START_QUEUE) acx_wake_queue(...) */ ++ } ++end: ++ FN_EXIT0; ++} ++ ++ ++/*********************************************************************** ++*/ ++static void ++acxusb_i_set_rx_mode(struct net_device *ndev) ++{ ++} ++ ++ ++/*********************************************************************** ++*/ ++#ifdef HAVE_TX_TIMEOUT ++static void ++acxusb_i_tx_timeout(struct net_device *ndev) ++{ ++ acx_device_t *adev = ndev2adev(ndev); ++ unsigned long flags; ++ int i; ++ ++ FN_ENTER; ++ ++ acx_lock(adev, flags); ++ /* unlink the URBs */ ++ for (i = 0; i < ACX_TX_URB_CNT; i++) { ++ acxusb_unlink_urb(adev->usb_tx[i].urb); ++ adev->usb_tx[i].busy = 0; ++ } ++ adev->tx_free = ACX_TX_URB_CNT; ++ /* TODO: stats update */ ++ acx_unlock(adev, flags); ++ ++ FN_EXIT0; ++} ++#endif ++ ++ ++/*********************************************************************** ++** init_module() ++** ++** This function is invoked upon loading of the kernel module. ++** It registers itself at the kernel's USB subsystem. ++** ++** Returns: Errorcode on failure, 0 on success ++*/ ++int __init ++acxusb_e_init_module(void) ++{ ++ log(L_INIT, "USB module " ACX_RELEASE " initialized, " ++ "probing for devices...\n"); ++ return usb_register(&acxusb_driver); ++} ++ ++ ++ ++/*********************************************************************** ++** cleanup_module() ++** ++** This function is invoked as last step of the module unloading. It simply ++** deregisters this module at the kernel's USB subsystem. ++*/ ++void __exit ++acxusb_e_cleanup_module() ++{ ++ usb_deregister(&acxusb_driver); ++} ++ ++ ++/*********************************************************************** ++** DEBUG STUFF ++*/ ++#if ACX_DEBUG ++ ++#ifdef UNUSED ++static void ++dump_device(struct usb_device *usbdev) ++{ ++ int i; ++ struct usb_config_descriptor *cd; ++ ++ printk("acx device dump:\n"); ++ printk(" devnum: %d\n", usbdev->devnum); ++ printk(" speed: %d\n", usbdev->speed); ++ printk(" tt: 0x%X\n", (unsigned int)(usbdev->tt)); ++ printk(" ttport: %d\n", (unsigned int)(usbdev->ttport)); ++ printk(" toggle[0]: 0x%X toggle[1]: 0x%X\n", (unsigned int)(usbdev->toggle[0]), (unsigned int)(usbdev->toggle[1])); ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11) ++ /* This saw a change after 2.6.10 */ ++ printk(" ep_in wMaxPacketSize: "); ++ for (i = 0; i < 16; ++i) ++ if (usbdev->ep_in[i] != NULL) ++ printk("%d:%d ", i, usbdev->ep_in[i]->desc.wMaxPacketSize); ++ printk("\n"); ++ printk(" ep_out wMaxPacketSize: "); ++ for (i = 0; i < VEC_SIZE(usbdev->ep_out); ++i) ++ if (usbdev->ep_out[i] != NULL) ++ printk("%d:%d ", i, usbdev->ep_out[i]->desc.wMaxPacketSize); ++ printk("\n"); ++#else ++ printk(" epmaxpacketin: "); ++ for (i = 0; i < 16; i++) ++ printk("%d ", usbdev->epmaxpacketin[i]); ++ printk("\n"); ++ printk(" epmaxpacketout: "); ++ for (i = 0; i < 16; i++) ++ printk("%d ", usbdev->epmaxpacketout[i]); ++ printk("\n"); ++#endif ++ printk(" parent: 0x%X\n", (unsigned int)usbdev->parent); ++ printk(" bus: 0x%X\n", (unsigned int)usbdev->bus); ++#ifdef NO_DATATYPE ++ printk(" configs: "); ++ for (i = 0; i < usbdev->descriptor.bNumConfigurations; i++) ++ printk("0x%X ", usbdev->config[i]); ++ printk("\n"); ++#endif ++ printk(" actconfig: %p\n", usbdev->actconfig); ++ dump_device_descriptor(&usbdev->descriptor); ++ ++ cd = &usbdev->config->desc; ++ dump_config_descriptor(cd); ++} ++ ++ ++/*********************************************************************** ++*/ ++static void ++dump_config_descriptor(struct usb_config_descriptor *cd) ++{ ++ printk("Configuration Descriptor:\n"); ++ if (!cd) { ++ printk("NULL\n"); ++ return; ++ } ++ printk(" bLength: %d (0x%X)\n", cd->bLength, cd->bLength); ++ printk(" bDescriptorType: %d (0x%X)\n", cd->bDescriptorType, cd->bDescriptorType); ++ printk(" bNumInterfaces: %d (0x%X)\n", cd->bNumInterfaces, cd->bNumInterfaces); ++ printk(" bConfigurationValue: %d (0x%X)\n", cd->bConfigurationValue, cd->bConfigurationValue); ++ printk(" iConfiguration: %d (0x%X)\n", cd->iConfiguration, cd->iConfiguration); ++ printk(" bmAttributes: %d (0x%X)\n", cd->bmAttributes, cd->bmAttributes); ++ /* printk(" MaxPower: %d (0x%X)\n", cd->bMaxPower, cd->bMaxPower); */ ++} ++ ++ ++static void ++dump_device_descriptor(struct usb_device_descriptor *dd) ++{ ++ printk("Device Descriptor:\n"); ++ if (!dd) { ++ printk("NULL\n"); ++ return; ++ } ++ printk(" bLength: %d (0x%X)\n", dd->bLength, dd->bLength); ++ printk(" bDescriptortype: %d (0x%X)\n", dd->bDescriptorType, dd->bDescriptorType); ++ printk(" bcdUSB: %d (0x%X)\n", dd->bcdUSB, dd->bcdUSB); ++ printk(" bDeviceClass: %d (0x%X)\n", dd->bDeviceClass, dd->bDeviceClass); ++ printk(" bDeviceSubClass: %d (0x%X)\n", dd->bDeviceSubClass, dd->bDeviceSubClass); ++ printk(" bDeviceProtocol: %d (0x%X)\n", dd->bDeviceProtocol, dd->bDeviceProtocol); ++ printk(" bMaxPacketSize0: %d (0x%X)\n", dd->bMaxPacketSize0, dd->bMaxPacketSize0); ++ printk(" idVendor: %d (0x%X)\n", dd->idVendor, dd->idVendor); ++ printk(" idProduct: %d (0x%X)\n", dd->idProduct, dd->idProduct); ++ printk(" bcdDevice: %d (0x%X)\n", dd->bcdDevice, dd->bcdDevice); ++ printk(" iManufacturer: %d (0x%X)\n", dd->iManufacturer, dd->iManufacturer); ++ printk(" iProduct: %d (0x%X)\n", dd->iProduct, dd->iProduct); ++ printk(" iSerialNumber: %d (0x%X)\n", dd->iSerialNumber, dd->iSerialNumber); ++ printk(" bNumConfigurations: %d (0x%X)\n", dd->bNumConfigurations, dd->bNumConfigurations); ++} ++#endif /* UNUSED */ ++ ++#endif /* ACX_DEBUG */ +Index: linux-2.6.22/drivers/net/wireless/acx/wlan.c +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/wlan.c 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,424 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++*/ ++ ++/*********************************************************************** ++** This code is based on elements which are ++** Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved. ++** info@linux-wlan.com ++** http://www.linux-wlan.com ++*/ ++ ++#include <linux/version.h> ++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18) ++#include <linux/config.h> ++#endif ++#include <linux/types.h> ++#include <linux/if_arp.h> ++#include <linux/wireless.h> ++#include <net/iw_handler.h> ++ ++#include "acx.h" ++ ++ ++/*********************************************************************** ++*/ ++#define LOG_BAD_EID(hdr,len,ie_ptr) acx_log_bad_eid(hdr, len, ((wlan_ie_t*)ie_ptr)) ++ ++#define IE_EID(ie_ptr) (((wlan_ie_t*)(ie_ptr))->eid) ++#define IE_LEN(ie_ptr) (((wlan_ie_t*)(ie_ptr))->len) ++#define OFFSET(hdr,off) (WLAN_HDR_A3_DATAP(hdr) + (off)) ++ ++ ++/*********************************************************************** ++** wlan_mgmt_decode_XXX ++** ++** Given a complete frame in f->hdr, sets the pointers in f to ++** the areas that correspond to the parts of the frame. ++** ++** Assumptions: ++** 1) f->len and f->hdr are already set ++** 2) f->len is the length of the MAC header + data, the FCS ++** is NOT included ++** 3) all members except len and hdr are zero ++** Arguments: ++** f frame structure ++** ++** Returns: ++** nothing ++** ++** Side effects: ++** frame structure members are pointing at their ++** respective portions of the frame buffer. ++*/ ++void ++wlan_mgmt_decode_beacon(wlan_fr_beacon_t * f) ++{ ++ u8 *ie_ptr; ++ u8 *end = (u8*)f->hdr + f->len; ++ ++ f->type = WLAN_FSTYPE_BEACON; ++ ++ /*-- Fixed Fields ----*/ ++ f->ts = (u64 *) OFFSET(f->hdr, WLAN_BEACON_OFF_TS); ++ f->bcn_int = (u16 *) OFFSET(f->hdr, WLAN_BEACON_OFF_BCN_INT); ++ f->cap_info = (u16 *) OFFSET(f->hdr, WLAN_BEACON_OFF_CAPINFO); ++ ++ /*-- Information elements */ ++ ie_ptr = OFFSET(f->hdr, WLAN_BEACON_OFF_SSID); ++ while (ie_ptr < end) { ++ switch (IE_EID(ie_ptr)) { ++ case WLAN_EID_SSID: ++ f->ssid = (wlan_ie_ssid_t *) ie_ptr; ++ break; ++ case WLAN_EID_SUPP_RATES: ++ f->supp_rates = (wlan_ie_supp_rates_t *) ie_ptr; ++ break; ++ case WLAN_EID_EXT_RATES: ++ f->ext_rates = (wlan_ie_supp_rates_t *) ie_ptr; ++ break; ++ case WLAN_EID_FH_PARMS: ++ f->fh_parms = (wlan_ie_fh_parms_t *) ie_ptr; ++ break; ++ case WLAN_EID_DS_PARMS: ++ f->ds_parms = (wlan_ie_ds_parms_t *) ie_ptr; ++ break; ++ case WLAN_EID_CF_PARMS: ++ f->cf_parms = (wlan_ie_cf_parms_t *) ie_ptr; ++ break; ++ case WLAN_EID_IBSS_PARMS: ++ f->ibss_parms = (wlan_ie_ibss_parms_t *) ie_ptr; ++ break; ++ case WLAN_EID_TIM: ++ f->tim = (wlan_ie_tim_t *) ie_ptr; ++ break; ++ case WLAN_EID_ERP_INFO: ++ f->erp = (wlan_ie_erp_t *) ie_ptr; ++ break; ++ ++ case WLAN_EID_COUNTRY: ++ /* was seen: 07 06 47 42 20 01 0D 14 */ ++ case WLAN_EID_PWR_CONSTRAINT: ++ /* was seen by Ashwin Mansinghka <ashwin_man@yahoo.com> from ++ Atheros-based PCI card in AP mode using madwifi drivers: */ ++ /* 20 01 00 */ ++ case WLAN_EID_NONERP: ++ /* was seen from WRT54GS with OpenWrt: 2F 01 07 */ ++ case WLAN_EID_UNKNOWN128: ++ /* was seen by Jacek Jablonski <conexion2000@gmail.com> from Orinoco AP */ ++ /* 80 06 00 60 1D 2C 3B 00 */ ++ case WLAN_EID_UNKNOWN133: ++ /* was seen by David Bronaugh <dbronaugh@linuxboxen.org> from ???? */ ++ /* 85 1E 00 00 84 12 07 00 FF 00 11 00 61 70 63 31 */ ++ /* 63 73 72 30 34 32 00 00 00 00 00 00 00 00 00 25 */ ++ case WLAN_EID_UNKNOWN223: ++ /* was seen by Carlos Martin <carlosmn@gmail.com> from ???? */ ++ /* DF 20 01 1E 04 00 00 00 06 63 09 02 FF 0F 30 30 */ ++ /* 30 42 36 42 33 34 30 39 46 31 00 00 00 00 00 00 00 00 */ ++ case WLAN_EID_GENERIC: ++ /* WPA: hostap code: ++ if (pos[1] >= 4 && ++ pos[2] == 0x00 && pos[3] == 0x50 && ++ pos[4] == 0xf2 && pos[5] == 1) { ++ wpa = pos; ++ wpa_len = pos[1] + 2; ++ } ++ TI x4 mode: seen DD 04 08 00 28 00 ++ (08 00 28 is TI's OUI) ++ last byte is probably 0/1 - disabled/enabled ++ */ ++ case WLAN_EID_RSN: ++ /* hostap does something with it: ++ rsn = pos; ++ rsn_len = pos[1] + 2; ++ */ ++ break; ++ ++ default: ++ LOG_BAD_EID(f->hdr, f->len, ie_ptr); ++ break; ++ } ++ ie_ptr = ie_ptr + 2 + IE_LEN(ie_ptr); ++ } ++} ++ ++ ++#ifdef UNUSED ++void wlan_mgmt_decode_ibssatim(wlan_fr_ibssatim_t * f) ++{ ++ f->type = WLAN_FSTYPE_ATIM; ++ /*-- Fixed Fields ----*/ ++ /*-- Information elements */ ++} ++#endif /* UNUSED */ ++ ++void ++wlan_mgmt_decode_disassoc(wlan_fr_disassoc_t * f) ++{ ++ f->type = WLAN_FSTYPE_DISASSOC; ++ ++ /*-- Fixed Fields ----*/ ++ f->reason = (u16 *) OFFSET(f->hdr, WLAN_DISASSOC_OFF_REASON); ++ ++ /*-- Information elements */ ++} ++ ++ ++void ++wlan_mgmt_decode_assocreq(wlan_fr_assocreq_t * f) ++{ ++ u8 *ie_ptr; ++ u8 *end = (u8*)f->hdr + f->len; ++ ++ ++ f->type = WLAN_FSTYPE_ASSOCREQ; ++ ++ /*-- Fixed Fields ----*/ ++ f->cap_info = (u16 *) OFFSET(f->hdr, WLAN_ASSOCREQ_OFF_CAP_INFO); ++ f->listen_int = (u16 *) OFFSET(f->hdr, WLAN_ASSOCREQ_OFF_LISTEN_INT); ++ ++ /*-- Information elements */ ++ ie_ptr = OFFSET(f->hdr, WLAN_ASSOCREQ_OFF_SSID); ++ while (ie_ptr < end) { ++ switch (IE_EID(ie_ptr)) { ++ case WLAN_EID_SSID: ++ f->ssid = (wlan_ie_ssid_t *) ie_ptr; ++ break; ++ case WLAN_EID_SUPP_RATES: ++ f->supp_rates = (wlan_ie_supp_rates_t *) ie_ptr; ++ break; ++ case WLAN_EID_EXT_RATES: ++ f->ext_rates = (wlan_ie_supp_rates_t *) ie_ptr; ++ break; ++ default: ++ LOG_BAD_EID(f->hdr, f->len, ie_ptr); ++ break; ++ } ++ ie_ptr = ie_ptr + 2 + IE_LEN(ie_ptr); ++ } ++} ++ ++ ++void ++wlan_mgmt_decode_assocresp(wlan_fr_assocresp_t * f) ++{ ++ f->type = WLAN_FSTYPE_ASSOCRESP; ++ ++ /*-- Fixed Fields ----*/ ++ f->cap_info = (u16 *) OFFSET(f->hdr, WLAN_ASSOCRESP_OFF_CAP_INFO); ++ f->status = (u16 *) OFFSET(f->hdr, WLAN_ASSOCRESP_OFF_STATUS); ++ f->aid = (u16 *) OFFSET(f->hdr, WLAN_ASSOCRESP_OFF_AID); ++ ++ /*-- Information elements */ ++ f->supp_rates = (wlan_ie_supp_rates_t *) ++ OFFSET(f->hdr, WLAN_ASSOCRESP_OFF_SUPP_RATES); ++} ++ ++ ++#ifdef UNUSED ++void ++wlan_mgmt_decode_reassocreq(wlan_fr_reassocreq_t * f) ++{ ++ u8 *ie_ptr; ++ u8 *end = (u8*)f->hdr + f->len; ++ ++ f->type = WLAN_FSTYPE_REASSOCREQ; ++ ++ /*-- Fixed Fields ----*/ ++ f->cap_info = (u16 *) OFFSET(f->hdr, WLAN_REASSOCREQ_OFF_CAP_INFO); ++ f->listen_int = (u16 *) OFFSET(f->hdr, WLAN_REASSOCREQ_OFF_LISTEN_INT); ++ f->curr_ap = (u8 *) OFFSET(f->hdr, WLAN_REASSOCREQ_OFF_CURR_AP); ++ ++ /*-- Information elements */ ++ ie_ptr = OFFSET(f->hdr, WLAN_REASSOCREQ_OFF_SSID); ++ while (ie_ptr < end) { ++ switch (IE_EID(ie_ptr)) { ++ case WLAN_EID_SSID: ++ f->ssid = (wlan_ie_ssid_t *) ie_ptr; ++ break; ++ case WLAN_EID_SUPP_RATES: ++ f->supp_rates = (wlan_ie_supp_rates_t *) ie_ptr; ++ break; ++ case WLAN_EID_EXT_RATES: ++ f->ext_rates = (wlan_ie_supp_rates_t *) ie_ptr; ++ break; ++ default: ++ LOG_BAD_EID(f->hdr, f->len, ie_ptr); ++ break; ++ } ++ ie_ptr = ie_ptr + 2 + IE_LEN(ie_ptr); ++ } ++} ++ ++ ++void ++wlan_mgmt_decode_reassocresp(wlan_fr_reassocresp_t * f) ++{ ++ f->type = WLAN_FSTYPE_REASSOCRESP; ++ ++ /*-- Fixed Fields ----*/ ++ f->cap_info = (u16 *) OFFSET(f->hdr, WLAN_REASSOCRESP_OFF_CAP_INFO); ++ f->status = (u16 *) OFFSET(f->hdr, WLAN_REASSOCRESP_OFF_STATUS); ++ f->aid = (u16 *) OFFSET(f->hdr, WLAN_REASSOCRESP_OFF_AID); ++ ++ /*-- Information elements */ ++ f->supp_rates = (wlan_ie_supp_rates_t *) ++ OFFSET(f->hdr, WLAN_REASSOCRESP_OFF_SUPP_RATES); ++} ++ ++ ++void ++wlan_mgmt_decode_probereq(wlan_fr_probereq_t * f) ++{ ++ u8 *ie_ptr; ++ u8 *end = (u8*)f->hdr + f->len; ++ ++ f->type = WLAN_FSTYPE_PROBEREQ; ++ ++ /*-- Fixed Fields ----*/ ++ ++ /*-- Information elements */ ++ ie_ptr = OFFSET(f->hdr, WLAN_PROBEREQ_OFF_SSID); ++ while (ie_ptr < end) { ++ switch (IE_EID(ie_ptr)) { ++ case WLAN_EID_SSID: ++ f->ssid = (wlan_ie_ssid_t *) ie_ptr; ++ break; ++ case WLAN_EID_SUPP_RATES: ++ f->supp_rates = (wlan_ie_supp_rates_t *) ie_ptr; ++ break; ++ case WLAN_EID_EXT_RATES: ++ f->ext_rates = (wlan_ie_supp_rates_t *) ie_ptr; ++ break; ++ default: ++ LOG_BAD_EID(f->hdr, f->len, ie_ptr); ++ break; ++ } ++ ie_ptr = ie_ptr + 2 + IE_LEN(ie_ptr); ++ } ++} ++#endif /* UNUSED */ ++ ++ ++/* TODO: decoding of beacon and proberesp can be merged (similar structure) */ ++void ++wlan_mgmt_decode_proberesp(wlan_fr_proberesp_t * f) ++{ ++ u8 *ie_ptr; ++ u8 *end = (u8*)f->hdr + f->len; ++ ++ f->type = WLAN_FSTYPE_PROBERESP; ++ ++ /*-- Fixed Fields ----*/ ++ f->ts = (u64 *) OFFSET(f->hdr, WLAN_PROBERESP_OFF_TS); ++ f->bcn_int = (u16 *) OFFSET(f->hdr, WLAN_PROBERESP_OFF_BCN_INT); ++ f->cap_info = (u16 *) OFFSET(f->hdr, WLAN_PROBERESP_OFF_CAP_INFO); ++ ++ /*-- Information elements */ ++ ie_ptr = OFFSET(f->hdr, WLAN_PROBERESP_OFF_SSID); ++ while (ie_ptr < end) { ++ switch (IE_EID(ie_ptr)) { ++ case WLAN_EID_SSID: ++ f->ssid = (wlan_ie_ssid_t *) ie_ptr; ++ break; ++ case WLAN_EID_SUPP_RATES: ++ f->supp_rates = (wlan_ie_supp_rates_t *) ie_ptr; ++ break; ++ case WLAN_EID_EXT_RATES: ++ f->ext_rates = (wlan_ie_supp_rates_t *) ie_ptr; ++ break; ++ case WLAN_EID_FH_PARMS: ++ f->fh_parms = (wlan_ie_fh_parms_t *) ie_ptr; ++ break; ++ case WLAN_EID_DS_PARMS: ++ f->ds_parms = (wlan_ie_ds_parms_t *) ie_ptr; ++ break; ++ case WLAN_EID_CF_PARMS: ++ f->cf_parms = (wlan_ie_cf_parms_t *) ie_ptr; ++ break; ++ case WLAN_EID_IBSS_PARMS: ++ f->ibss_parms = (wlan_ie_ibss_parms_t *) ie_ptr; ++ break; ++#ifdef DONT_DO_IT_ADD_REAL_HANDLING_INSTEAD ++ case WLAN_EID_COUNTRY: ++ break; ++ ... ++#endif ++#ifdef SENT_HERE_BY_OPENWRT ++ /* should those be trapped or handled?? */ ++ case WLAN_EID_ERP_INFO: ++ break; ++ case WLAN_EID_NONERP: ++ break; ++ case WLAN_EID_GENERIC: ++ break; ++#endif ++ default: ++ LOG_BAD_EID(f->hdr, f->len, ie_ptr); ++ break; ++ } ++ ++ ie_ptr = ie_ptr + 2 + IE_LEN(ie_ptr); ++ } ++} ++ ++ ++void ++wlan_mgmt_decode_authen(wlan_fr_authen_t * f) ++{ ++ u8 *ie_ptr; ++ u8 *end = (u8*)f->hdr + f->len; ++ ++ f->type = WLAN_FSTYPE_AUTHEN; ++ ++ /*-- Fixed Fields ----*/ ++ f->auth_alg = (u16 *) OFFSET(f->hdr, WLAN_AUTHEN_OFF_AUTH_ALG); ++ f->auth_seq = (u16 *) OFFSET(f->hdr, WLAN_AUTHEN_OFF_AUTH_SEQ); ++ f->status = (u16 *) OFFSET(f->hdr, WLAN_AUTHEN_OFF_STATUS); ++ ++ /*-- Information elements */ ++ ie_ptr = OFFSET(f->hdr, WLAN_AUTHEN_OFF_CHALLENGE); ++ if ((ie_ptr < end) && (IE_EID(ie_ptr) == WLAN_EID_CHALLENGE)) { ++ f->challenge = (wlan_ie_challenge_t *) ie_ptr; ++ } ++} ++ ++ ++void ++wlan_mgmt_decode_deauthen(wlan_fr_deauthen_t * f) ++{ ++ f->type = WLAN_FSTYPE_DEAUTHEN; ++ ++ /*-- Fixed Fields ----*/ ++ f->reason = (u16 *) OFFSET(f->hdr, WLAN_DEAUTHEN_OFF_REASON); ++ ++ /*-- Information elements */ ++} +Index: linux-2.6.22/drivers/net/wireless/acx/wlan_compat.h +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/wlan_compat.h 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,260 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++*/ ++ ++/*********************************************************************** ++** This code is based on elements which are ++** Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved. ++** info@linux-wlan.com ++** http://www.linux-wlan.com ++*/ ++ ++/*=============================================================*/ ++/*------ Establish Platform Identity --------------------------*/ ++/*=============================================================*/ ++/* Key macros: */ ++/* WLAN_CPU_FAMILY */ ++#define WLAN_Ix86 1 ++#define WLAN_PPC 2 ++#define WLAN_Ix96 3 ++#define WLAN_ARM 4 ++#define WLAN_ALPHA 5 ++#define WLAN_MIPS 6 ++#define WLAN_HPPA 7 ++#define WLAN_SPARC 8 ++#define WLAN_SH 9 ++#define WLAN_x86_64 10 ++/* WLAN_CPU_CORE */ ++#define WLAN_I386CORE 1 ++#define WLAN_PPCCORE 2 ++#define WLAN_I296 3 ++#define WLAN_ARMCORE 4 ++#define WLAN_ALPHACORE 5 ++#define WLAN_MIPSCORE 6 ++#define WLAN_HPPACORE 7 ++/* WLAN_CPU_PART */ ++#define WLAN_I386PART 1 ++#define WLAN_MPC860 2 ++#define WLAN_MPC823 3 ++#define WLAN_I296SA 4 ++#define WLAN_PPCPART 5 ++#define WLAN_ARMPART 6 ++#define WLAN_ALPHAPART 7 ++#define WLAN_MIPSPART 8 ++#define WLAN_HPPAPART 9 ++/* WLAN_SYSARCH */ ++#define WLAN_PCAT 1 ++#define WLAN_MBX 2 ++#define WLAN_RPX 3 ++#define WLAN_LWARCH 4 ++#define WLAN_PMAC 5 ++#define WLAN_SKIFF 6 ++#define WLAN_BITSY 7 ++#define WLAN_ALPHAARCH 7 ++#define WLAN_MIPSARCH 9 ++#define WLAN_HPPAARCH 10 ++/* WLAN_HOSTIF (generally set on the command line, not detected) */ ++#define WLAN_PCMCIA 1 ++#define WLAN_ISA 2 ++#define WLAN_PCI 3 ++#define WLAN_USB 4 ++#define WLAN_PLX 5 ++ ++/* Note: the PLX HOSTIF above refers to some vendors implementations for */ ++/* PCI. It's a PLX chip that is a PCI to PCMCIA adapter, but it */ ++/* isn't a real PCMCIA host interface adapter providing all the */ ++/* card&socket services. */ ++ ++#ifdef __powerpc__ ++#ifndef __ppc__ ++#define __ppc__ ++#endif ++#endif ++ ++#if (defined(CONFIG_PPC) || defined(CONFIG_8xx)) ++#ifndef __ppc__ ++#define __ppc__ ++#endif ++#endif ++ ++#if defined(__x86_64__) ++ #define WLAN_CPU_FAMILY WLAN_x86_64 ++ #define WLAN_SYSARCH WLAN_PCAT ++#elif defined(__i386__) || defined(__i486__) || defined(__i586__) || defined(__i686__) ++ #define WLAN_CPU_FAMILY WLAN_Ix86 ++ #define WLAN_CPU_CORE WLAN_I386CORE ++ #define WLAN_CPU_PART WLAN_I386PART ++ #define WLAN_SYSARCH WLAN_PCAT ++#elif defined(__ppc__) ++ #define WLAN_CPU_FAMILY WLAN_PPC ++ #define WLAN_CPU_CORE WLAN_PPCCORE ++ #if defined(CONFIG_MBX) ++ #define WLAN_CPU_PART WLAN_MPC860 ++ #define WLAN_SYSARCH WLAN_MBX ++ #elif defined(CONFIG_RPXLITE) ++ #define WLAN_CPU_PART WLAN_MPC823 ++ #define WLAN_SYSARCH WLAN_RPX ++ #elif defined(CONFIG_RPXCLASSIC) ++ #define WLAN_CPU_PART WLAN_MPC860 ++ #define WLAN_SYSARCH WLAN_RPX ++ #else ++ #define WLAN_CPU_PART WLAN_PPCPART ++ #define WLAN_SYSARCH WLAN_PMAC ++ #endif ++#elif defined(__arm__) ++ #define WLAN_CPU_FAMILY WLAN_ARM ++ #define WLAN_CPU_CORE WLAN_ARMCORE ++ #define WLAN_CPU_PART WLAN_ARM_PART ++ #define WLAN_SYSARCH WLAN_SKIFF ++#elif defined(__alpha__) ++ #define WLAN_CPU_FAMILY WLAN_ALPHA ++ #define WLAN_CPU_CORE WLAN_ALPHACORE ++ #define WLAN_CPU_PART WLAN_ALPHAPART ++ #define WLAN_SYSARCH WLAN_ALPHAARCH ++#elif defined(__mips__) ++ #define WLAN_CPU_FAMILY WLAN_MIPS ++ #define WLAN_CPU_CORE WLAN_MIPSCORE ++ #define WLAN_CPU_PART WLAN_MIPSPART ++ #define WLAN_SYSARCH WLAN_MIPSARCH ++#elif defined(__hppa__) ++ #define WLAN_CPU_FAMILY WLAN_HPPA ++ #define WLAN_CPU_CORE WLAN_HPPACORE ++ #define WLAN_CPU_PART WLAN_HPPAPART ++ #define WLAN_SYSARCH WLAN_HPPAARCH ++#elif defined(__sparc__) ++ #define WLAN_CPU_FAMILY WLAN_SPARC ++ #define WLAN_SYSARCH WLAN_SPARC ++#elif defined(__sh__) ++ #define WLAN_CPU_FAMILY WLAN_SH ++ #define WLAN_SYSARCH WLAN_SHARCH ++ #ifndef __LITTLE_ENDIAN__ ++ #define __LITTLE_ENDIAN__ ++ #endif ++#else ++ #error "No CPU identified!" ++#endif ++ ++/* ++ Some big endian machines implicitly do all I/O in little endian mode. ++ ++ In particular: ++ Linux/PPC on PowerMacs (PCI) ++ Arm/Intel Xscale (PCI) ++ ++ This may also affect PLX boards and other BE &| PPC platforms; ++ as new ones are discovered, add them below. ++*/ ++ ++#if ((WLAN_SYSARCH == WLAN_SKIFF) || (WLAN_SYSARCH == WLAN_PMAC)) ++#define REVERSE_ENDIAN ++#endif ++ ++/*=============================================================*/ ++/*------ Hardware Portability Macros --------------------------*/ ++/*=============================================================*/ ++#if (WLAN_CPU_FAMILY == WLAN_PPC) ++#define wlan_inw(a) in_be16((unsigned short *)((a)+_IO_BASE)) ++#define wlan_inw_le16_to_cpu(a) inw((a)) ++#define wlan_outw(v,a) out_be16((unsigned short *)((a)+_IO_BASE), (v)) ++#define wlan_outw_cpu_to_le16(v,a) outw((v),(a)) ++#else ++#define wlan_inw(a) inw((a)) ++#define wlan_inw_le16_to_cpu(a) __cpu_to_le16(inw((a))) ++#define wlan_outw(v,a) outw((v),(a)) ++#define wlan_outw_cpu_to_le16(v,a) outw(__cpu_to_le16((v)),(a)) ++#endif ++ ++/*=============================================================*/ ++/*------ Bit settings -----------------------------------------*/ ++/*=============================================================*/ ++#define ieee2host16(n) __le16_to_cpu(n) ++#define ieee2host32(n) __le32_to_cpu(n) ++#define host2ieee16(n) __cpu_to_le16(n) ++#define host2ieee32(n) __cpu_to_le32(n) ++ ++/* for constants */ ++#ifdef __LITTLE_ENDIAN ++ #define IEEE16(a,n) a = n, a##i = n, ++#else ++ #ifdef __BIG_ENDIAN ++ /* shifts would produce gcc warnings. Oh well... */ ++ #define IEEE16(a,n) a = n, a##i = ((n&0xff)*256 + ((n&0xff00)/256)), ++ #else ++ #error give me endianness or give me death ++ #endif ++#endif ++ ++/*=============================================================*/ ++/*------ Compiler Portability Macros --------------------------*/ ++/*=============================================================*/ ++#define WLAN_PACKED __attribute__ ((packed)) ++ ++/* Interrupt handler backwards compatibility stuff */ ++#ifndef IRQ_NONE ++#define IRQ_NONE ++#define IRQ_HANDLED ++typedef void irqreturn_t; ++#endif ++ ++#ifndef ARPHRD_IEEE80211_PRISM ++#define ARPHRD_IEEE80211_PRISM 802 ++#endif ++ ++#define ETH_P_80211_RAW (ETH_P_ECONET + 1) ++ ++/*============================================================================* ++ * Constants * ++ *============================================================================*/ ++#define WLAN_IEEE_OUI_LEN 3 ++ ++/*============================================================================* ++ * Types * ++ *============================================================================*/ ++ ++/* local ether header type */ ++typedef struct wlan_ethhdr { ++ u8 daddr[ETH_ALEN]; ++ u8 saddr[ETH_ALEN]; ++ u16 type; ++} WLAN_PACKED wlan_ethhdr_t; ++ ++/* local llc header type */ ++typedef struct wlan_llc { ++ u8 dsap; ++ u8 ssap; ++ u8 ctl; ++} WLAN_PACKED wlan_llc_t; ++ ++/* local snap header type */ ++typedef struct wlan_snap { ++ u8 oui[WLAN_IEEE_OUI_LEN]; ++ u16 type; ++} WLAN_PACKED wlan_snap_t; +Index: linux-2.6.22/drivers/net/wireless/acx/wlan_hdr.h +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/wlan_hdr.h 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,497 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++*/ ++ ++/*********************************************************************** ++** This code is based on elements which are ++** Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved. ++** info@linux-wlan.com ++** http://www.linux-wlan.com ++*/ ++ ++/* mini-doc ++ ++Here are all 11b/11g/11a rates and modulations: ++ ++ 11b 11g 11a ++ --- --- --- ++ 1 |B |B | ++ 2 |Q |Q | ++ 5.5|Cp |C p| ++ 6 | |Od |O ++ 9 | |od |o ++11 |Cp |C p| ++12 | |Od |O ++18 | |od |o ++22 | | p| ++24 | |Od |O ++33 | | p| ++36 | |od |o ++48 | |od |o ++54 | |od |o ++ ++Mandatory: ++ B - DBPSK (Differential Binary Phase Shift Keying) ++ Q - DQPSK (Differential Quaternary Phase Shift Keying) ++ C - CCK (Complementary Code Keying, a form of DSSS ++ (Direct Sequence Spread Spectrum) modulation) ++ O - OFDM (Orthogonal Frequency Division Multiplexing) ++Optional: ++ o - OFDM ++ d - CCK-OFDM (also known as DSSS-OFDM) ++ p - PBCC (Packet Binary Convolutional Coding) ++ ++The term CCK-OFDM may be used interchangeably with DSSS-OFDM ++(the IEEE 802.11g-2003 standard uses the latter terminology). ++In the CCK-OFDM, the PLCP header of the frame uses the CCK form of DSSS, ++while the PLCP payload (the MAC frame) is modulated using OFDM. ++ ++Basically, you must use CCK-OFDM if you have mixed 11b/11g environment, ++or else (pure OFDM) 11b equipment may not realize that AP ++is sending a packet and start sending its own one. ++Sadly, looks like acx111 does not support CCK-OFDM, only pure OFDM. ++ ++Re PBCC: avoid using it. It makes sense only if you have ++TI "11b+" hardware. You _must_ use PBCC in order to reach 22Mbps on it. ++ ++Preambles: ++ ++Long preamble (at 1Mbit rate, takes 144 us): ++ 16 bytes ones ++ 2 bytes 0xF3A0 (lsb sent first) ++PLCP header follows (at 1Mbit also): ++ 1 byte Signal: speed, in 0.1Mbit units, except for: ++ 33Mbit: 33 (instead of 330 - doesn't fit in octet) ++ all CCK-OFDM rates: 30 ++ 1 byte Service ++ 0,1,4: reserved ++ 2: 1=locked clock ++ 3: 1=PBCC ++ 5: Length Extension (PBCC 22,33Mbit (11g only)) <- ++ 6: Length Extension (PBCC 22,33Mbit (11g only)) <- BLACK MAGIC HERE ++ 7: Length Extension <- ++ 2 bytes Length (time needed to tx this frame) ++ a) 5.5 Mbit/s CCK ++ Length = octets*8/5.5, rounded up to integer ++ b) 11 Mbit/s CCK ++ Length = octets*8/11, rounded up to integer ++ Service bit 7: ++ 0 = rounding took less than 8/11 ++ 1 = rounding took more than or equal to 8/11 ++ c) 5.5 Mbit/s PBCC ++ Length = (octets+1)*8/5.5, rounded up to integer ++ d) 11 Mbit/s PBCC ++ Length = (octets+1)*8/11, rounded up to integer ++ Service bit 7: ++ 0 = rounding took less than 8/11 ++ 1 = rounding took more than or equal to 8/11 ++ e) 22 Mbit/s PBCC ++ Length = (octets+1)*8/22, rounded up to integer ++ Service bits 6,7: ++ 00 = rounding took less than 8/22ths ++ 01 = rounding took 8/22...15/22ths ++ 10 = rounding took 16/22ths or more. ++ f) 33 Mbit/s PBCC ++ Length = (octets+1)*8/33, rounded up to integer ++ Service bits 5,6,7: ++ 000 rounding took less than 8/33 ++ 001 rounding took 8/33...15/33 ++ 010 rounding took 16/33...23/33 ++ 011 rounding took 24/33...31/33 ++ 100 rounding took 32/33 or more ++ 2 bytes CRC ++ ++PSDU follows (up to 2346 bytes at selected rate) ++ ++While Signal value alone is not enough to determine rate and modulation, ++Signal+Service is always sufficient. ++ ++Short preamble (at 1Mbit rate, takes 72 us): ++ 7 bytes zeroes ++ 2 bytes 0x05CF (lsb sent first) ++PLCP header follows *at 2Mbit/s*. Format is the same as in long preamble. ++PSDU follows (up to 2346 bytes at selected rate) ++ ++OFDM preamble is completely different, uses OFDM ++modulation from the start and thus easily identifiable. ++Not shown here. ++*/ ++ ++ ++/*********************************************************************** ++** Constants ++*/ ++ ++#define WLAN_HDR_A3_LEN 24 ++#define WLAN_HDR_A4_LEN 30 ++/* IV structure: ++** 3 bytes: Initialization Vector (24 bits) ++** 1 byte: 0..5: padding, must be 0; 6..7: key selector (0-3) ++*/ ++#define WLAN_WEP_IV_LEN 4 ++/* 802.11 says 2312 but looks like 2312 is a max size of _WEPed data_ */ ++#define WLAN_DATA_MAXLEN 2304 ++#define WLAN_WEP_ICV_LEN 4 ++#define WLAN_FCS_LEN 4 ++#define WLAN_A3FR_MAXLEN (WLAN_HDR_A3_LEN + WLAN_DATA_MAXLEN) ++#define WLAN_A4FR_MAXLEN (WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN) ++#define WLAN_A3FR_MAXLEN_FCS (WLAN_HDR_A3_LEN + WLAN_DATA_MAXLEN + 4) ++#define WLAN_A4FR_MAXLEN_FCS (WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + 4) ++#define WLAN_A3FR_MAXLEN_WEP (WLAN_A3FR_MAXLEN + 8) ++#define WLAN_A4FR_MAXLEN_WEP (WLAN_A4FR_MAXLEN + 8) ++#define WLAN_A3FR_MAXLEN_WEP_FCS (WLAN_A3FR_MAXLEN_FCS + 8) ++#define WLAN_A4FR_MAXLEN_WEP_FCS (WLAN_A4FR_MAXLEN_FCS + 8) ++ ++#define WLAN_BSS_TS_LEN 8 ++#define WLAN_SSID_MAXLEN 32 ++#define WLAN_BEACON_FR_MAXLEN (WLAN_HDR_A3_LEN + 334) ++#define WLAN_ATIM_FR_MAXLEN (WLAN_HDR_A3_LEN + 0) ++#define WLAN_DISASSOC_FR_MAXLEN (WLAN_HDR_A3_LEN + 2) ++#define WLAN_ASSOCREQ_FR_MAXLEN (WLAN_HDR_A3_LEN + 48) ++#define WLAN_ASSOCRESP_FR_MAXLEN (WLAN_HDR_A3_LEN + 16) ++#define WLAN_REASSOCREQ_FR_MAXLEN (WLAN_HDR_A3_LEN + 54) ++#define WLAN_REASSOCRESP_FR_MAXLEN (WLAN_HDR_A3_LEN + 16) ++#define WLAN_PROBEREQ_FR_MAXLEN (WLAN_HDR_A3_LEN + 44) ++#define WLAN_PROBERESP_FR_MAXLEN (WLAN_HDR_A3_LEN + 78) ++#define WLAN_AUTHEN_FR_MAXLEN (WLAN_HDR_A3_LEN + 261) ++#define WLAN_DEAUTHEN_FR_MAXLEN (WLAN_HDR_A3_LEN + 2) ++#define WLAN_CHALLENGE_IE_LEN 130 ++#define WLAN_CHALLENGE_LEN 128 ++#define WLAN_WEP_MAXKEYLEN 13 ++#define WLAN_WEP_NKEYS 4 ++ ++/*--- Frame Control Field -------------------------------------*/ ++/* Frame Types */ ++#define WLAN_FTYPE_MGMT 0x00 ++#define WLAN_FTYPE_CTL 0x01 ++#define WLAN_FTYPE_DATA 0x02 ++ ++/* Frame subtypes */ ++/* Management */ ++#define WLAN_FSTYPE_ASSOCREQ 0x00 ++#define WLAN_FSTYPE_ASSOCRESP 0x01 ++#define WLAN_FSTYPE_REASSOCREQ 0x02 ++#define WLAN_FSTYPE_REASSOCRESP 0x03 ++#define WLAN_FSTYPE_PROBEREQ 0x04 ++#define WLAN_FSTYPE_PROBERESP 0x05 ++#define WLAN_FSTYPE_BEACON 0x08 ++#define WLAN_FSTYPE_ATIM 0x09 ++#define WLAN_FSTYPE_DISASSOC 0x0a ++#define WLAN_FSTYPE_AUTHEN 0x0b ++#define WLAN_FSTYPE_DEAUTHEN 0x0c ++ ++/* Control */ ++#define WLAN_FSTYPE_PSPOLL 0x0a ++#define WLAN_FSTYPE_RTS 0x0b ++#define WLAN_FSTYPE_CTS 0x0c ++#define WLAN_FSTYPE_ACK 0x0d ++#define WLAN_FSTYPE_CFEND 0x0e ++#define WLAN_FSTYPE_CFENDCFACK 0x0f ++ ++/* Data */ ++#define WLAN_FSTYPE_DATAONLY 0x00 ++#define WLAN_FSTYPE_DATA_CFACK 0x01 ++#define WLAN_FSTYPE_DATA_CFPOLL 0x02 ++#define WLAN_FSTYPE_DATA_CFACK_CFPOLL 0x03 ++#define WLAN_FSTYPE_NULL 0x04 ++#define WLAN_FSTYPE_CFACK 0x05 ++#define WLAN_FSTYPE_CFPOLL 0x06 ++#define WLAN_FSTYPE_CFACK_CFPOLL 0x07 ++ ++/*--- FC Constants v. 2.0 ------------------------------------*/ ++/* Each constant is defined twice: WF_CONST is in host */ ++/* byteorder, WF_CONSTi is in ieee byteorder. */ ++/* Usage: */ ++/* printf("the frame subtype is %X", WF_FC_FTYPEi & rx.fc); */ ++/* tx.fc = WF_FTYPE_CTLi | WF_FSTYPE_RTSi; */ ++/*------------------------------------------------------------*/ ++ ++enum { ++/*--- Frame Control Field -------------------------------------*/ ++/* Protocol version: always 0 for current 802.11 standards */ ++IEEE16(WF_FC_PVER, 0x0003) ++IEEE16(WF_FC_FTYPE, 0x000c) ++IEEE16(WF_FC_FSTYPE, 0x00f0) ++IEEE16(WF_FC_TODS, 0x0100) ++IEEE16(WF_FC_FROMDS, 0x0200) ++IEEE16(WF_FC_FROMTODS, 0x0300) ++IEEE16(WF_FC_MOREFRAG, 0x0400) ++IEEE16(WF_FC_RETRY, 0x0800) ++/* Indicates PS mode in which STA will be after successful completion ++** of current frame exchange sequence. Always 0 for AP frames */ ++IEEE16(WF_FC_PWRMGT, 0x1000) ++/* What MoreData=1 means: ++** From AP to STA in PS mode: don't sleep yet, I have more frames for you ++** From Contention-Free (CF) Pollable STA in response to a CF-Poll: ++** STA has buffered frames for transmission in response to next CF-Poll ++** Bcast/mcast frames transmitted from AP: ++** when additional bcast/mcast frames remain to be transmitted by AP ++** during this beacon interval ++** In all other cases MoreData=0 */ ++IEEE16(WF_FC_MOREDATA, 0x2000) ++IEEE16(WF_FC_ISWEP, 0x4000) ++IEEE16(WF_FC_ORDER, 0x8000) ++ ++/* Frame Types */ ++IEEE16(WF_FTYPE_MGMT, 0x00) ++IEEE16(WF_FTYPE_CTL, 0x04) ++IEEE16(WF_FTYPE_DATA, 0x08) ++ ++/* Frame subtypes */ ++/* Management */ ++IEEE16(WF_FSTYPE_ASSOCREQ, 0x00) ++IEEE16(WF_FSTYPE_ASSOCRESP, 0x10) ++IEEE16(WF_FSTYPE_REASSOCREQ, 0x20) ++IEEE16(WF_FSTYPE_REASSOCRESP, 0x30) ++IEEE16(WF_FSTYPE_PROBEREQ, 0x40) ++IEEE16(WF_FSTYPE_PROBERESP, 0x50) ++IEEE16(WF_FSTYPE_BEACON, 0x80) ++IEEE16(WF_FSTYPE_ATIM, 0x90) ++IEEE16(WF_FSTYPE_DISASSOC, 0xa0) ++IEEE16(WF_FSTYPE_AUTHEN, 0xb0) ++IEEE16(WF_FSTYPE_DEAUTHEN, 0xc0) ++ ++/* Control */ ++IEEE16(WF_FSTYPE_PSPOLL, 0xa0) ++IEEE16(WF_FSTYPE_RTS, 0xb0) ++IEEE16(WF_FSTYPE_CTS, 0xc0) ++IEEE16(WF_FSTYPE_ACK, 0xd0) ++IEEE16(WF_FSTYPE_CFEND, 0xe0) ++IEEE16(WF_FSTYPE_CFENDCFACK, 0xf0) ++ ++/* Data */ ++IEEE16(WF_FSTYPE_DATAONLY, 0x00) ++IEEE16(WF_FSTYPE_DATA_CFACK, 0x10) ++IEEE16(WF_FSTYPE_DATA_CFPOLL, 0x20) ++IEEE16(WF_FSTYPE_DATA_CFACK_CFPOLL, 0x30) ++IEEE16(WF_FSTYPE_NULL, 0x40) ++IEEE16(WF_FSTYPE_CFACK, 0x50) ++IEEE16(WF_FSTYPE_CFPOLL, 0x60) ++IEEE16(WF_FSTYPE_CFACK_CFPOLL, 0x70) ++}; ++ ++ ++/*********************************************************************** ++** Macros ++*/ ++ ++/*--- Duration Macros ----------------------------------------*/ ++/* Macros to get/set the bitfields of the Duration Field */ ++/* - the duration value is only valid when bit15 is zero */ ++/* - the firmware handles these values, so I'm not going */ ++/* to use these macros right now. */ ++/*------------------------------------------------------------*/ ++ ++/*--- Sequence Control Macros -------------------------------*/ ++/* Macros to get/set the bitfields of the Sequence Control */ ++/* Field. */ ++/*------------------------------------------------------------*/ ++#define WLAN_GET_SEQ_FRGNUM(n) ((u16)(n) & 0x000f) ++#define WLAN_GET_SEQ_SEQNUM(n) (((u16)(n) & 0xfff0) >> 4) ++ ++/*--- Data ptr macro -----------------------------------------*/ ++/* Creates a u8* to the data portion of a frame */ ++/* Assumes you're passing in a ptr to the beginning of the hdr*/ ++/*------------------------------------------------------------*/ ++#define WLAN_HDR_A3_DATAP(p) (((u8*)(p)) + WLAN_HDR_A3_LEN) ++#define WLAN_HDR_A4_DATAP(p) (((u8*)(p)) + WLAN_HDR_A4_LEN) ++ ++ ++/*********************************************************************** ++** Types ++*/ ++ ++/* 802.11 header type ++** ++** Note the following: ++** a1 *always* is receiver's mac or bcast/mcast ++** a2 *always* is transmitter's mac, if a2 exists ++** seq: [0:3] frag#, [4:15] seq# - used for dup detection ++** (dups from retries have same seq#) */ ++typedef struct wlan_hdr { ++ u16 fc; ++ u16 dur; ++ u8 a1[ETH_ALEN]; ++ u8 a2[ETH_ALEN]; ++ u8 a3[ETH_ALEN]; ++ u16 seq; ++ u8 a4[ETH_ALEN]; ++} WLAN_PACKED wlan_hdr_t; ++ ++/* Separate structs for use if frame type is known */ ++typedef struct wlan_hdr_a3 { ++ u16 fc; ++ u16 dur; ++ u8 a1[ETH_ALEN]; ++ u8 a2[ETH_ALEN]; ++ u8 a3[ETH_ALEN]; ++ u16 seq; ++} WLAN_PACKED wlan_hdr_a3_t; ++ ++typedef struct wlan_hdr_mgmt { ++ u16 fc; ++ u16 dur; ++ u8 da[ETH_ALEN]; ++ u8 sa[ETH_ALEN]; ++ u8 bssid[ETH_ALEN]; ++ u16 seq; ++} WLAN_PACKED wlan_hdr_mgmt_t; ++ ++#ifdef NOT_NEEDED_YET ++typedef struct { /* ad-hoc peer->peer (to/from DS = 0/0) */ ++ u16 fc; ++ u16 dur; ++ u8 da[ETH_ALEN]; ++ u8 sa[ETH_ALEN]; ++ u8 bssid[ETH_ALEN]; ++ u16 seq; ++} WLAN_PACKED ibss; ++typedef struct { /* ap->sta (to/from DS = 0/1) */ ++ u16 fc; ++ u16 dur; ++ u8 da[ETH_ALEN]; ++ u8 bssid[ETH_ALEN]; ++ u8 sa[ETH_ALEN]; ++ u16 seq; ++} WLAN_PACKED fromap; ++typedef struct { /* sta->ap (to/from DS = 1/0) */ ++ u16 fc; ++ u16 dur; ++ u8 bssid[ETH_ALEN]; ++ u8 sa[ETH_ALEN]; ++ u8 da[ETH_ALEN]; ++ u16 seq; ++} WLAN_PACKED toap; ++typedef struct { /* wds->wds (to/from DS = 1/1), the only 4addr pkt */ ++ u16 fc; ++ u16 dur; ++ u8 ra[ETH_ALEN]; ++ u8 ta[ETH_ALEN]; ++ u8 da[ETH_ALEN]; ++ u16 seq; ++ u8 sa[ETH_ALEN]; ++} WLAN_PACKED wds; ++typedef struct { /* all management packets */ ++ u16 fc; ++ u16 dur; ++ u8 da[ETH_ALEN]; ++ u8 sa[ETH_ALEN]; ++ u8 bssid[ETH_ALEN]; ++ u16 seq; ++} WLAN_PACKED mgmt; ++typedef struct { /* has no body, just a FCS */ ++ u16 fc; ++ u16 dur; ++ u8 ra[ETH_ALEN]; ++ u8 ta[ETH_ALEN]; ++} WLAN_PACKED rts; ++typedef struct { /* has no body, just a FCS */ ++ u16 fc; ++ u16 dur; ++ u8 ra[ETH_ALEN]; ++} WLAN_PACKED cts; ++typedef struct { /* has no body, just a FCS */ ++ u16 fc; ++ u16 dur; ++ u8 ra[ETH_ALEN]; ++} WLAN_PACKED ack; ++typedef struct { /* has no body, just a FCS */ ++ u16 fc; ++ /* NB: this one holds Assoc ID in dur field: */ ++ u16 aid; ++ u8 bssid[ETH_ALEN]; ++ u8 ta[ETH_ALEN]; ++} WLAN_PACKED pspoll; ++typedef struct { /* has no body, just a FCS */ ++ u16 fc; ++ u16 dur; ++ u8 ra[ETH_ALEN]; ++ u8 bssid[ETH_ALEN]; ++} WLAN_PACKED cfend; ++typedef struct { /* has no body, just a FCS */ ++ u16 fc; ++ u16 dur; ++ u8 ra[ETH_ALEN]; ++ u8 bssid[ETH_ALEN]; ++} WLAN_PACKED cfendcfack; ++#endif ++ ++/* Prism header emulation (monitor mode) */ ++typedef struct wlanitem_u32 { ++ u32 did; ++ u16 status; ++ u16 len; ++ u32 data; ++} WLAN_PACKED wlanitem_u32_t; ++#define WLANITEM_STATUS_data_ok 0 ++#define WLANITEM_STATUS_no_value 1 ++#define WLANITEM_STATUS_invalid_itemname 2 ++#define WLANITEM_STATUS_invalid_itemdata 3 ++#define WLANITEM_STATUS_missing_itemdata 4 ++#define WLANITEM_STATUS_incomplete_itemdata 5 ++#define WLANITEM_STATUS_invalid_msg_did 6 ++#define WLANITEM_STATUS_invalid_mib_did 7 ++#define WLANITEM_STATUS_missing_conv_func 8 ++#define WLANITEM_STATUS_string_too_long 9 ++#define WLANITEM_STATUS_data_out_of_range 10 ++#define WLANITEM_STATUS_string_too_short 11 ++#define WLANITEM_STATUS_missing_valid_func 12 ++#define WLANITEM_STATUS_unknown 13 ++#define WLANITEM_STATUS_invalid_did 14 ++#define WLANITEM_STATUS_missing_print_func 15 ++ ++#define WLAN_DEVNAMELEN_MAX 16 ++typedef struct wlansniffrm { ++ u32 msgcode; ++ u32 msglen; ++ u8 devname[WLAN_DEVNAMELEN_MAX]; ++ wlanitem_u32_t hosttime; ++ wlanitem_u32_t mactime; ++ wlanitem_u32_t channel; ++ wlanitem_u32_t rssi; ++ wlanitem_u32_t sq; ++ wlanitem_u32_t signal; ++ wlanitem_u32_t noise; ++ wlanitem_u32_t rate; ++ wlanitem_u32_t istx; /* tx? 0:no 1:yes */ ++ wlanitem_u32_t frmlen; ++} WLAN_PACKED wlansniffrm_t; ++#define WLANSNIFFFRM 0x0041 ++#define WLANSNIFFFRM_hosttime 0x1041 ++#define WLANSNIFFFRM_mactime 0x2041 ++#define WLANSNIFFFRM_channel 0x3041 ++#define WLANSNIFFFRM_rssi 0x4041 ++#define WLANSNIFFFRM_sq 0x5041 ++#define WLANSNIFFFRM_signal 0x6041 ++#define WLANSNIFFFRM_noise 0x7041 ++#define WLANSNIFFFRM_rate 0x8041 ++#define WLANSNIFFFRM_istx 0x9041 ++#define WLANSNIFFFRM_frmlen 0xA041 +Index: linux-2.6.22/drivers/net/wireless/acx/wlan_mgmt.h +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ linux-2.6.22/drivers/net/wireless/acx/wlan_mgmt.h 2007-08-23 18:34:19.000000000 +0200 +@@ -0,0 +1,582 @@ ++/*********************************************************************** ++** Copyright (C) 2003 ACX100 Open Source Project ++** ++** The contents of this file are subject to the Mozilla Public ++** License Version 1.1 (the "License"); you may not use this file ++** except in compliance with the License. You may obtain a copy of ++** the License at http://www.mozilla.org/MPL/ ++** ++** Software distributed under the License is distributed on an "AS ++** IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or ++** implied. See the License for the specific language governing ++** rights and limitations under the License. ++** ++** Alternatively, the contents of this file may be used under the ++** terms of the GNU Public License version 2 (the "GPL"), in which ++** case the provisions of the GPL are applicable instead of the ++** above. If you wish to allow the use of your version of this file ++** only under the terms of the GPL and not to allow others to use ++** your version of this file under the MPL, indicate your decision ++** by deleting the provisions above and replace them with the notice ++** and other provisions required by the GPL. If you do not delete ++** the provisions above, a recipient may use your version of this ++** file under either the MPL or the GPL. ++** --------------------------------------------------------------------- ++** Inquiries regarding the ACX100 Open Source Project can be ++** made directly to: ++** ++** acx100-users@lists.sf.net ++** http://acx100.sf.net ++** --------------------------------------------------------------------- ++*/ ++ ++/*********************************************************************** ++** This code is based on elements which are ++** Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved. ++** info@linux-wlan.com ++** http://www.linux-wlan.com ++*/ ++ ++/*********************************************************************** ++** Constants ++*/ ++ ++/*-- Information Element IDs --------------------*/ ++#define WLAN_EID_SSID 0 ++#define WLAN_EID_SUPP_RATES 1 ++#define WLAN_EID_FH_PARMS 2 ++#define WLAN_EID_DS_PARMS 3 ++#define WLAN_EID_CF_PARMS 4 ++#define WLAN_EID_TIM 5 ++#define WLAN_EID_IBSS_PARMS 6 ++#define WLAN_EID_COUNTRY 7 /* 802.11d */ ++#define WLAN_EID_FH_HOP_PARMS 8 /* 802.11d */ ++#define WLAN_EID_FH_TABLE 9 /* 802.11d */ ++#define WLAN_EID_REQUEST 10 /* 802.11d */ ++/*-- values 11-15 reserved --*/ ++#define WLAN_EID_CHALLENGE 16 ++/*-- values 17-31 reserved for challenge text extension --*/ ++#define WLAN_EID_PWR_CONSTRAINT 32 /* 11h PowerConstraint */ ++#define WLAN_EID_ERP_INFO 42 /* was seen from WRT54GS with OpenWrt */ ++#define WLAN_EID_NONERP 47 /* was seen from WRT54GS with OpenWrt */ ++#define WLAN_EID_RSN 48 ++#define WLAN_EID_EXT_RATES 50 ++#define WLAN_EID_UNKNOWN128 128 ++#define WLAN_EID_UNKNOWN133 133 ++#define WLAN_EID_GENERIC 221 /* was seen from WRT54GS with OpenWrt */ ++#define WLAN_EID_UNKNOWN223 223 ++ ++#if 0 ++#define WLAN_EID_PWR_CAP 33 /* 11h PowerCapability */ ++#define WLAN_EID_TPC_REQUEST 34 /* 11h TPC Request */ ++#define WLAN_EID_TPC_REPORT 35 /* 11h TPC Report */ ++#define WLAN_EID_SUPP_CHANNELS 36 /* 11h Supported Channels */ ++#define WLAN_EID_CHANNEL_SWITCH 37 /* 11h ChannelSwitch */ ++#define WLAN_EID_MEASURE_REQUEST 38 /* 11h MeasurementRequest */ ++#define WLAN_EID_MEASURE_REPORT 39 /* 11h MeasurementReport */ ++#define WLAN_EID_QUIET_ID 40 /* 11h Quiet */ ++#define WLAN_EID_IBSS_DFS_ID 41 /* 11h IBSS_DFS */ ++#endif ++ ++/*-- Reason Codes -------------------------------*/ ++#define WLAN_MGMT_REASON_RSVD 0 ++#define WLAN_MGMT_REASON_UNSPEC 1 ++#define WLAN_MGMT_REASON_PRIOR_AUTH_INVALID 2 ++#define WLAN_MGMT_REASON_DEAUTH_LEAVING 3 ++#define WLAN_MGMT_REASON_DISASSOC_INACTIVE 4 ++#define WLAN_MGMT_REASON_DISASSOC_AP_BUSY 5 ++#define WLAN_MGMT_REASON_CLASS2_NONAUTH 6 ++#define WLAN_MGMT_REASON_CLASS3_NONASSOC 7 ++#define WLAN_MGMT_REASON_DISASSOC_STA_HASLEFT 8 ++#define WLAN_MGMT_REASON_CANT_ASSOC_NONAUTH 9 ++ ++/*-- Status Codes -------------------------------*/ ++#define WLAN_MGMT_STATUS_SUCCESS 0 ++#define WLAN_MGMT_STATUS_UNSPEC_FAILURE 1 ++#define WLAN_MGMT_STATUS_CAPS_UNSUPPORTED 10 ++#define WLAN_MGMT_STATUS_REASSOC_NO_ASSOC 11 ++#define WLAN_MGMT_STATUS_ASSOC_DENIED_UNSPEC 12 ++#define WLAN_MGMT_STATUS_UNSUPPORTED_AUTHALG 13 ++#define WLAN_MGMT_STATUS_RX_AUTH_NOSEQ 14 ++#define WLAN_MGMT_STATUS_CHALLENGE_FAIL 15 ++#define WLAN_MGMT_STATUS_AUTH_TIMEOUT 16 ++#define WLAN_MGMT_STATUS_ASSOC_DENIED_BUSY 17 ++#define WLAN_MGMT_STATUS_ASSOC_DENIED_RATES 18 ++/* p80211b additions */ ++#define WLAN_MGMT_STATUS_ASSOC_DENIED_NOSHORT 19 ++#define WLAN_MGMT_STATUS_ASSOC_DENIED_NOPBCC 20 ++#define WLAN_MGMT_STATUS_ASSOC_DENIED_NOAGILITY 21 ++ ++/*-- Auth Algorithm Field ---------------------------*/ ++#define WLAN_AUTH_ALG_OPENSYSTEM 0 ++#define WLAN_AUTH_ALG_SHAREDKEY 1 ++ ++/*-- Management Frame Field Offsets -------------*/ ++/* Note: Not all fields are listed because of variable lengths */ ++/* Note: These offsets are from the start of the frame data */ ++ ++#define WLAN_BEACON_OFF_TS 0 ++#define WLAN_BEACON_OFF_BCN_INT 8 ++#define WLAN_BEACON_OFF_CAPINFO 10 ++#define WLAN_BEACON_OFF_SSID 12 ++ ++#define WLAN_DISASSOC_OFF_REASON 0 ++ ++#define WLAN_ASSOCREQ_OFF_CAP_INFO 0 ++#define WLAN_ASSOCREQ_OFF_LISTEN_INT 2 ++#define WLAN_ASSOCREQ_OFF_SSID 4 ++ ++#define WLAN_ASSOCRESP_OFF_CAP_INFO 0 ++#define WLAN_ASSOCRESP_OFF_STATUS 2 ++#define WLAN_ASSOCRESP_OFF_AID 4 ++#define WLAN_ASSOCRESP_OFF_SUPP_RATES 6 ++ ++#define WLAN_REASSOCREQ_OFF_CAP_INFO 0 ++#define WLAN_REASSOCREQ_OFF_LISTEN_INT 2 ++#define WLAN_REASSOCREQ_OFF_CURR_AP 4 ++#define WLAN_REASSOCREQ_OFF_SSID 10 ++ ++#define WLAN_REASSOCRESP_OFF_CAP_INFO 0 ++#define WLAN_REASSOCRESP_OFF_STATUS 2 ++#define WLAN_REASSOCRESP_OFF_AID 4 ++#define WLAN_REASSOCRESP_OFF_SUPP_RATES 6 ++ ++#define WLAN_PROBEREQ_OFF_SSID 0 ++ ++#define WLAN_PROBERESP_OFF_TS 0 ++#define WLAN_PROBERESP_OFF_BCN_INT 8 ++#define WLAN_PROBERESP_OFF_CAP_INFO 10 ++#define WLAN_PROBERESP_OFF_SSID 12 ++ ++#define WLAN_AUTHEN_OFF_AUTH_ALG 0 ++#define WLAN_AUTHEN_OFF_AUTH_SEQ 2 ++#define WLAN_AUTHEN_OFF_STATUS 4 ++#define WLAN_AUTHEN_OFF_CHALLENGE 6 ++ ++#define WLAN_DEAUTHEN_OFF_REASON 0 ++ ++enum { ++IEEE16(WF_MGMT_CAP_ESS, 0x0001) ++IEEE16(WF_MGMT_CAP_IBSS, 0x0002) ++/* In (re)assoc request frames by STA: ++** Pollable=0, PollReq=0: STA is not CF-Pollable ++** 0 1: STA is CF-Pollable, not requesting to be placed on the CF-Polling list ++** 1 0: STA is CF-Pollable, requesting to be placed on the CF-Polling list ++** 1 1: STA is CF-Pollable, requesting never to be polled ++** In beacon, proberesp, (re)assoc resp frames by AP: ++** 0 0: No point coordinator at AP ++** 0 1: Point coordinator at AP for delivery only (no polling) ++** 1 0: Point coordinator at AP for delivery and polling ++** 1 1: Reserved */ ++IEEE16(WF_MGMT_CAP_CFPOLLABLE, 0x0004) ++IEEE16(WF_MGMT_CAP_CFPOLLREQ, 0x0008) ++/* 1=non-WEP data frames are disallowed */ ++IEEE16(WF_MGMT_CAP_PRIVACY, 0x0010) ++/* In beacon, proberesp, (re)assocresp by AP/AdHoc: ++** 1=use of shortpre is allowed ("I can receive shortpre") */ ++IEEE16(WF_MGMT_CAP_SHORT, 0x0020) ++IEEE16(WF_MGMT_CAP_PBCC, 0x0040) ++IEEE16(WF_MGMT_CAP_AGILITY, 0x0080) ++/* In (re)assoc request frames by STA: ++** 1=short slot time implemented and enabled ++** NB: AP shall use long slot time beginning at the next Beacon after assoc ++** of STA with this bit set to 0 ++** In beacon, proberesp, (re)assoc resp frames by AP: ++** currently used slot time value: 0/1 - long/short */ ++IEEE16(WF_MGMT_CAP_SHORTSLOT, 0x0400) ++/* In (re)assoc request frames by STA: 1=CCK-OFDM is implemented and enabled ++** In beacon, proberesp, (re)assoc resp frames by AP/AdHoc: ++** 1=CCK-OFDM is allowed */ ++IEEE16(WF_MGMT_CAP_CCKOFDM, 0x2000) ++}; ++ ++ ++/*********************************************************************** ++** Types ++*/ ++ ++/* Information Element types */ ++ ++/* prototype structure, all IEs start with these members */ ++typedef struct wlan_ie { ++ u8 eid; ++ u8 len; ++} WLAN_PACKED wlan_ie_t; ++ ++/*-- Service Set Identity (SSID) -----------------*/ ++typedef struct wlan_ie_ssid { ++ u8 eid; ++ u8 len; ++ u8 ssid[1]; /* may be zero */ ++} WLAN_PACKED wlan_ie_ssid_t; ++ ++/*-- Supported Rates -----------------------------*/ ++typedef struct wlan_ie_supp_rates { ++ u8 eid; ++ u8 len; ++ u8 rates[1]; /* had better be at LEAST one! */ ++} WLAN_PACKED wlan_ie_supp_rates_t; ++ ++/*-- FH Parameter Set ----------------------------*/ ++typedef struct wlan_ie_fh_parms { ++ u8 eid; ++ u8 len; ++ u16 dwell; ++ u8 hopset; ++ u8 hoppattern; ++ u8 hopindex; ++} WLAN_PACKED wlan_ie_fh_parms_t; ++ ++/*-- DS Parameter Set ----------------------------*/ ++typedef struct wlan_ie_ds_parms { ++ u8 eid; ++ u8 len; ++ u8 curr_ch; ++} WLAN_PACKED wlan_ie_ds_parms_t; ++ ++/*-- CF Parameter Set ----------------------------*/ ++typedef struct wlan_ie_cf_parms { ++ u8 eid; ++ u8 len; ++ u8 cfp_cnt; ++ u8 cfp_period; ++ u16 cfp_maxdur; ++ u16 cfp_durremaining; ++} WLAN_PACKED wlan_ie_cf_parms_t; ++ ++/*-- TIM ------------------------------------------*/ ++typedef struct wlan_ie_tim { ++ u8 eid; ++ u8 len; ++ u8 dtim_cnt; ++ u8 dtim_period; ++ u8 bitmap_ctl; ++ u8 virt_bm[1]; ++} WLAN_PACKED wlan_ie_tim_t; ++ ++/*-- IBSS Parameter Set ---------------------------*/ ++typedef struct wlan_ie_ibss_parms { ++ u8 eid; ++ u8 len; ++ u16 atim_win; ++} WLAN_PACKED wlan_ie_ibss_parms_t; ++ ++/*-- Challenge Text ------------------------------*/ ++typedef struct wlan_ie_challenge { ++ u8 eid; ++ u8 len; ++ u8 challenge[1]; ++} WLAN_PACKED wlan_ie_challenge_t; ++ ++/*-- ERP (42) -------------------------------------*/ ++typedef struct wlan_ie_erp { ++ u8 eid; ++ u8 len; ++ /* bit 0:Non ERP present ++ ** 1:Use Protection ++ ** 2:Barker Preamble mode ++ ** 3-7:reserved */ ++ u8 erp; ++} WLAN_PACKED wlan_ie_erp_t; ++ ++/* Types for parsing mgmt frames */ ++ ++/* prototype structure, all mgmt frame types will start with these members */ ++typedef struct wlan_fr_mgmt { ++ u16 type; ++ u16 len; /* DOES NOT include FCS */ ++ wlan_hdr_t *hdr; ++ /* used for target specific data, skb in Linux */ ++ /*-- fixed fields -----------*/ ++ /*-- info elements ----------*/ ++} WLAN_PACKED wlan_fr_mgmt_t; ++ ++/*-- Beacon ---------------------------------------*/ ++typedef struct wlan_fr_beacon { ++ u16 type; ++ u16 len; ++ wlan_hdr_t *hdr; ++ /*-- fixed fields -----------*/ ++ u64 *ts; ++ u16 *bcn_int; ++ u16 *cap_info; ++ /*-- info elements ----------*/ ++ wlan_ie_ssid_t *ssid; ++ wlan_ie_supp_rates_t *supp_rates; ++ wlan_ie_supp_rates_t *ext_rates; ++ wlan_ie_fh_parms_t *fh_parms; ++ wlan_ie_ds_parms_t *ds_parms; ++ wlan_ie_cf_parms_t *cf_parms; ++ wlan_ie_ibss_parms_t *ibss_parms; ++ wlan_ie_tim_t *tim; /* in beacon only, not proberesp */ ++ wlan_ie_erp_t *erp; /* in beacon only, not proberesp */ ++} wlan_fr_beacon_t; ++#define wlan_fr_proberesp wlan_fr_beacon ++#define wlan_fr_proberesp_t wlan_fr_beacon_t ++ ++/*-- IBSS ATIM ------------------------------------*/ ++typedef struct wlan_fr_ibssatim { ++ u16 type; ++ u16 len; ++ wlan_hdr_t *hdr; ++ /*-- fixed fields -----------*/ ++ /*-- info elements ----------*/ ++ /* this frame type has a null body */ ++} wlan_fr_ibssatim_t; ++ ++/*-- Disassociation -------------------------------*/ ++typedef struct wlan_fr_disassoc { ++ u16 type; ++ u16 len; ++ wlan_hdr_t *hdr; ++ /*-- fixed fields -----------*/ ++ u16 *reason; ++ /*-- info elements ----------*/ ++} wlan_fr_disassoc_t; ++ ++/*-- Association Request --------------------------*/ ++typedef struct wlan_fr_assocreq { ++ u16 type; ++ u16 len; ++ wlan_hdr_t *hdr; ++ /*-- fixed fields -----------*/ ++ u16 *cap_info; ++ u16 *listen_int; ++ /*-- info elements ----------*/ ++ wlan_ie_ssid_t *ssid; ++ wlan_ie_supp_rates_t *supp_rates; ++ wlan_ie_supp_rates_t *ext_rates; ++} wlan_fr_assocreq_t; ++ ++/*-- Association Response -------------------------*/ ++typedef struct wlan_fr_assocresp { ++ u16 type; ++ u16 len; ++ wlan_hdr_t *hdr; ++ /*-- fixed fields -----------*/ ++ u16 *cap_info; ++ u16 *status; ++ u16 *aid; ++ /*-- info elements ----------*/ ++ wlan_ie_supp_rates_t *supp_rates; ++ wlan_ie_supp_rates_t *ext_rates; ++} wlan_fr_assocresp_t; ++ ++/*-- Reassociation Request ------------------------*/ ++typedef struct wlan_fr_reassocreq { ++ u16 type; ++ u16 len; ++ wlan_hdr_t *hdr; ++ /*-- fixed fields -----------*/ ++ u16 *cap_info; ++ u16 *listen_int; ++ u8 *curr_ap; ++ /*-- info elements ----------*/ ++ wlan_ie_ssid_t *ssid; ++ wlan_ie_supp_rates_t *supp_rates; ++ wlan_ie_supp_rates_t *ext_rates; ++} wlan_fr_reassocreq_t; ++ ++/*-- Reassociation Response -----------------------*/ ++typedef struct wlan_fr_reassocresp { ++ u16 type; ++ u16 len; ++ wlan_hdr_t *hdr; ++ /*-- fixed fields -----------*/ ++ u16 *cap_info; ++ u16 *status; ++ u16 *aid; ++ /*-- info elements ----------*/ ++ wlan_ie_supp_rates_t *supp_rates; ++ wlan_ie_supp_rates_t *ext_rates; ++} wlan_fr_reassocresp_t; ++ ++/*-- Probe Request --------------------------------*/ ++typedef struct wlan_fr_probereq { ++ u16 type; ++ u16 len; ++ wlan_hdr_t *hdr; ++ /*-- fixed fields -----------*/ ++ /*-- info elements ----------*/ ++ wlan_ie_ssid_t *ssid; ++ wlan_ie_supp_rates_t *supp_rates; ++ wlan_ie_supp_rates_t *ext_rates; ++} wlan_fr_probereq_t; ++ ++/*-- Authentication -------------------------------*/ ++typedef struct wlan_fr_authen { ++ u16 type; ++ u16 len; ++ wlan_hdr_t *hdr; ++ /*-- fixed fields -----------*/ ++ u16 *auth_alg; ++ u16 *auth_seq; ++ u16 *status; ++ /*-- info elements ----------*/ ++ wlan_ie_challenge_t *challenge; ++} wlan_fr_authen_t; ++ ++/*-- Deauthenication -----------------------------*/ ++typedef struct wlan_fr_deauthen { ++ u16 type; ++ u16 len; ++ wlan_hdr_t *hdr; ++ /*-- fixed fields -----------*/ ++ u16 *reason; ++ /*-- info elements ----------*/ ++} wlan_fr_deauthen_t; ++ ++/* Types for building mgmt frames */ ++ ++/* Warning. Several types used in below structs are ++** in fact variable length. Use structs with such fields with caution */ ++typedef struct auth_frame_body { ++ u16 auth_alg; ++ u16 auth_seq; ++ u16 status; ++ wlan_ie_challenge_t challenge; ++} WLAN_PACKED auth_frame_body_t; ++ ++typedef struct assocresp_frame_body { ++ u16 cap_info; ++ u16 status; ++ u16 aid; ++ wlan_ie_supp_rates_t rates; ++} WLAN_PACKED assocresp_frame_body_t; ++ ++typedef struct reassocreq_frame_body { ++ u16 cap_info; ++ u16 listen_int; ++ u8 current_ap[ETH_ALEN]; ++ wlan_ie_ssid_t ssid; ++/* access to this one is disabled since ssid_t is variable length: */ ++ /* wlan_ie_supp_rates_t rates; */ ++} WLAN_PACKED reassocreq_frame_body_t; ++ ++typedef struct reassocresp_frame_body { ++ u16 cap_info; ++ u16 status; ++ u16 aid; ++ wlan_ie_supp_rates_t rates; ++} WLAN_PACKED reassocresp_frame_body_t; ++ ++typedef struct deauthen_frame_body { ++ u16 reason; ++} WLAN_PACKED deauthen_frame_body_t; ++ ++typedef struct disassoc_frame_body { ++ u16 reason; ++} WLAN_PACKED disassoc_frame_body_t; ++ ++typedef struct probereq_frame_body { ++ wlan_ie_ssid_t ssid; ++ wlan_ie_supp_rates_t rates; ++} WLAN_PACKED probereq_frame_body_t; ++ ++typedef struct proberesp_frame_body { ++ u8 timestamp[8]; ++ u16 beacon_int; ++ u16 cap_info; ++ wlan_ie_ssid_t ssid; ++/* access to these is disabled since ssid_t is variable length: */ ++ /* wlan_ie_supp_rates_t rates; */ ++ /* fhps_t fhps; */ ++ /* dsps_t dsps; */ ++ /* cfps_t cfps; */ ++} WLAN_PACKED proberesp_frame_body_t; ++ ++ ++/*********************************************************************** ++** Functions ++*/ ++ ++/* Helpers for parsing mgmt frames */ ++void wlan_mgmt_decode_ibssatim(wlan_fr_ibssatim_t *f); ++void wlan_mgmt_decode_assocreq(wlan_fr_assocreq_t *f); ++void wlan_mgmt_decode_assocresp(wlan_fr_assocresp_t *f); ++void wlan_mgmt_decode_authen(wlan_fr_authen_t *f); ++void wlan_mgmt_decode_beacon(wlan_fr_beacon_t *f); ++void wlan_mgmt_decode_deauthen(wlan_fr_deauthen_t *f); ++void wlan_mgmt_decode_disassoc(wlan_fr_disassoc_t *f); ++void wlan_mgmt_decode_probereq(wlan_fr_probereq_t *f); ++void wlan_mgmt_decode_proberesp(wlan_fr_proberesp_t *f); ++void wlan_mgmt_decode_reassocreq(wlan_fr_reassocreq_t *f); ++void wlan_mgmt_decode_reassocresp(wlan_fr_reassocresp_t *f); ++ ++/* Helpers for building mgmt frames */ ++static inline u8* ++wlan_fill_ie_ssid(u8 *p, int len, const char *ssid) ++{ ++ struct wlan_ie_ssid *ie = (void*)p; ++ ie->eid = WLAN_EID_SSID; ++ ie->len = len; ++ memcpy(ie->ssid, ssid, len); ++ return p + len + 2; ++} ++/* This controls whether we create 802.11g 'ext supported rates' IEs ++** or just create overlong 'supported rates' IEs instead ++** (non-11g compliant) */ ++#define WE_OBEY_802_11G 1 ++static inline u8* ++wlan_fill_ie_rates(u8 *p, int len, const u8 *rates) ++{ ++ struct wlan_ie_supp_rates *ie = (void*)p; ++#if WE_OBEY_802_11G ++ if (len > 8 ) len = 8; ++#endif ++ /* supported rates (1 to 8 octets) */ ++ ie->eid = WLAN_EID_SUPP_RATES; ++ ie->len = len; ++ memcpy(ie->rates, rates, len); ++ return p + len + 2; ++} ++/* This one wouldn't create an IE at all if not needed */ ++static inline u8* ++wlan_fill_ie_rates_ext(u8 *p, int len, const u8 *rates) ++{ ++ struct wlan_ie_supp_rates *ie = (void*)p; ++#if !WE_OBEY_802_11G ++ return p; ++#endif ++ len -= 8; ++ if (len <= 0) return p; ++ /* ext supported rates */ ++ ie->eid = WLAN_EID_EXT_RATES; ++ ie->len = len; ++ memcpy(ie->rates, rates+8, len); ++ return p + len + 2; ++} ++static inline u8* ++wlan_fill_ie_ds_parms(u8 *p, int channel) ++{ ++ struct wlan_ie_ds_parms *ie = (void*)p; ++ ie->eid = WLAN_EID_DS_PARMS; ++ ie->len = 1; ++ ie->curr_ch = channel; ++ return p + sizeof(*ie); ++} ++static inline u8* ++wlan_fill_ie_ibss_parms(u8 *p, int atim_win) ++{ ++ struct wlan_ie_ibss_parms *ie = (void*)p; ++ ie->eid = WLAN_EID_IBSS_PARMS; ++ ie->len = 2; ++ ie->atim_win = atim_win; ++ return p + sizeof(*ie); ++} ++static inline u8* ++wlan_fill_ie_tim(u8 *p, int rem, int period, int bcast, ++ int ofs, int len, const u8 *vbm) ++{ ++ struct wlan_ie_tim *ie = (void*)p; ++ ie->eid = WLAN_EID_TIM; ++ ie->len = len + 3; ++ ie->dtim_cnt = rem; ++ ie->dtim_period = period; ++ ie->bitmap_ctl = ofs | (bcast!=0); ++ if (vbm) ++ memcpy(ie->virt_bm, vbm, len); /* min 1 byte */ ++ else ++ ie->virt_bm[0] = 0; ++ return p + len + 3 + 2; ++} +Index: linux-2.6.22/drivers/net/wireless/Kconfig +=================================================================== +--- linux-2.6.22.orig/drivers/net/wireless/Kconfig 2007-07-09 01:32:17.000000000 +0200 ++++ linux-2.6.22/drivers/net/wireless/Kconfig 2007-08-23 18:34:19.000000000 +0200 +@@ -5,6 +5,36 @@ + menu "Wireless LAN" + depends on !S390 + ++config NET_RADIO ++ bool "Wireless LAN drivers (non-hamradio) & Wireless Extensions" ++ select WIRELESS_EXT ++ ---help--- ++ Support for wireless LANs and everything having to do with radio, ++ but not with amateur radio or FM broadcasting. ++ ++ Saying Y here also enables the Wireless Extensions (creates ++ /proc/net/wireless and enables iwconfig access). The Wireless ++ Extension is a generic API allowing a driver to expose to the user ++ space configuration and statistics specific to common Wireless LANs. ++ The beauty of it is that a single set of tool can support all the ++ variations of Wireless LANs, regardless of their type (as long as ++ the driver supports Wireless Extension). Another advantage is that ++ these parameters may be changed on the fly without restarting the ++ driver (or Linux). If you wish to use Wireless Extensions with ++ wireless PCMCIA (PC-) cards, you need to say Y here; you can fetch ++ the tools from ++ <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>. ++ ++config NET_WIRELESS_RTNETLINK ++ bool "Wireless Extension API over RtNetlink" ++ depends on NET_RADIO ++ ---help--- ++ Support the Wireless Extension API over the RtNetlink socket ++ in addition to the traditional ioctl interface (selected above). ++ ++ For now, few tools use this facility, but it might grow in the ++ future. The only downside is that it adds 4.5 kB to your kernel. ++ + config WLAN_PRE80211 + bool "Wireless LAN (pre-802.11)" + depends on NETDEVICES +@@ -549,5 +579,6 @@ + source "drivers/net/wireless/hostap/Kconfig" + source "drivers/net/wireless/bcm43xx/Kconfig" + source "drivers/net/wireless/zd1211rw/Kconfig" ++source "drivers/net/wireless/acx/Kconfig" + + endmenu +Index: linux-2.6.22/drivers/net/wireless/Makefile +=================================================================== +--- linux-2.6.22.orig/drivers/net/wireless/Makefile 2007-07-09 01:32:17.000000000 +0200 ++++ linux-2.6.22/drivers/net/wireless/Makefile 2007-08-23 18:34:19.000000000 +0200 +@@ -34,6 +34,8 @@ + + obj-$(CONFIG_PRISM54) += prism54/ + ++obj-$(CONFIG_ACX) += acx/ ++ + obj-$(CONFIG_HOSTAP) += hostap/ + obj-$(CONFIG_BCM43XX) += bcm43xx/ + obj-$(CONFIG_ZD1211RW) += zd1211rw/ |