drivers/net/wireless/ipw2200.c

   1 /******************************************************************************
   2
   3   Copyright(c) 2003 - 2006 Intel Corporation. All rights reserved.
   4
   5   802.11 status code portion of this file from ethereal-0.10.6:
   6     Copyright 2000, Axis Communications AB
   7     Ethereal - Network traffic analyzer
   8     By Gerald Combs <gerald@ethereal.com>
   9     Copyright 1998 Gerald Combs
  10
  11   This program is free software; you can redistribute it and/or modify it
  12   under the terms of version 2 of the GNU General Public License as
  13   published by the Free Software Foundation.
  14
  15   This program is distributed in the hope that it will be useful, but WITHOUT
  16   ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  17   FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  18   more details.
  19
  20   You should have received a copy of the GNU General Public License along with
  21   this program; if not, write to the Free Software Foundation, Inc., 59
  22   Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  23
  24   The full GNU General Public License is included in this distribution in the
  25   file called LICENSE.
  26
  27   Contact Information:
  28   James P. Ketrenos <ipw2100-admin@linux.intel.com>
  29   Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  30
  31 ******************************************************************************/
  32
  33 #include "ipw2200.h"
  34 #include <linux/version.h>
  35
  36
  37 #ifndef KBUILD_EXTMOD
  38 #define VK "k"
  39 #else
  40 #define VK
  41 #endif
  42
  43 #ifdef CONFIG_IPW2200_DEBUG
  44 #define VD "d"
  45 #else
  46 #define VD
  47 #endif
  48
  49 #ifdef CONFIG_IPW2200_MONITOR
  50 #define VM "m"
  51 #else
  52 #define VM
  53 #endif
  54
  55 #ifdef CONFIG_IPW2200_PROMISCUOUS
  56 #define VP "p"
  57 #else
  58 #define VP
  59 #endif
  60
  61 #ifdef CONFIG_IPW2200_RADIOTAP
  62 #define VR "r"
  63 #else
  64 #define VR
  65 #endif
  66
  67 #ifdef CONFIG_IPW2200_QOS
  68 #define VQ "q"
  69 #else
  70 #define VQ
  71 #endif
  72
  73 #define IPW2200_VERSION "1.2.2" VK VD VM VP VR VQ
  74 #define DRV_DESCRIPTION "Intel(R) PRO/Wireless 2200/2915 Network Driver"
  75 #define DRV_COPYRIGHT   "Copyright(c) 2003-2006 Intel Corporation"
  76 #define DRV_VERSION     IPW2200_VERSION
  77
  78 #define ETH_P_80211_STATS (ETH_P_80211_RAW + 1)
  79
  80 MODULE_DESCRIPTION(DRV_DESCRIPTION);
  81 MODULE_VERSION(DRV_VERSION);
  82 MODULE_AUTHOR(DRV_COPYRIGHT);
  83 MODULE_LICENSE("GPL");
  84
  85 static int cmdlog = 0;
  86 static int debug = 0;
  87 static int channel = 0;
  88 static int mode = 0;
  89
  90 static u32 ipw_debug_level;
  91 static int associate = 1;
  92 static int auto_create = 1;
  93 static int led = 0;
  94 static int disable = 0;
  95 static int bt_coexist = 0;
  96 static int hwcrypto = 0;
  97 static int roaming = 1;
  98 static const char ipw_modes[] = {
  99         'a', 'b', 'g', '?'
 100 };
 101 static int antenna = CFG_SYS_ANTENNA_BOTH;
 102
 103 #ifdef CONFIG_IPW2200_PROMISCUOUS
 104 static int rtap_iface = 0;     /* def: 0 -- do not create rtap interface */
 105 #endif
 106
 107
 108 #ifdef CONFIG_IPW2200_QOS
 109 static int qos_enable = 0;
 110 static int qos_burst_enable = 0;
 111 static int qos_no_ack_mask = 0;
 112 static int burst_duration_CCK = 0;
 113 static int burst_duration_OFDM = 0;
 114
 115 static struct ieee80211_qos_parameters def_qos_parameters_OFDM = {
 116         {QOS_TX0_CW_MIN_OFDM, QOS_TX1_CW_MIN_OFDM, QOS_TX2_CW_MIN_OFDM,
 117          QOS_TX3_CW_MIN_OFDM},
 118         {QOS_TX0_CW_MAX_OFDM, QOS_TX1_CW_MAX_OFDM, QOS_TX2_CW_MAX_OFDM,
 119          QOS_TX3_CW_MAX_OFDM},
 120         {QOS_TX0_AIFS, QOS_TX1_AIFS, QOS_TX2_AIFS, QOS_TX3_AIFS},
 121         {QOS_TX0_ACM, QOS_TX1_ACM, QOS_TX2_ACM, QOS_TX3_ACM},
 122         {QOS_TX0_TXOP_LIMIT_OFDM, QOS_TX1_TXOP_LIMIT_OFDM,
 123          QOS_TX2_TXOP_LIMIT_OFDM, QOS_TX3_TXOP_LIMIT_OFDM}
 124 };
 125
 126 static struct ieee80211_qos_parameters def_qos_parameters_CCK = {
 127         {QOS_TX0_CW_MIN_CCK, QOS_TX1_CW_MIN_CCK, QOS_TX2_CW_MIN_CCK,
 128          QOS_TX3_CW_MIN_CCK},
 129         {QOS_TX0_CW_MAX_CCK, QOS_TX1_CW_MAX_CCK, QOS_TX2_CW_MAX_CCK,
 130          QOS_TX3_CW_MAX_CCK},
 131         {QOS_TX0_AIFS, QOS_TX1_AIFS, QOS_TX2_AIFS, QOS_TX3_AIFS},
 132         {QOS_TX0_ACM, QOS_TX1_ACM, QOS_TX2_ACM, QOS_TX3_ACM},
 133         {QOS_TX0_TXOP_LIMIT_CCK, QOS_TX1_TXOP_LIMIT_CCK, QOS_TX2_TXOP_LIMIT_CCK,
 134          QOS_TX3_TXOP_LIMIT_CCK}
 135 };
 136
 137 static struct ieee80211_qos_parameters def_parameters_OFDM = {
 138         {DEF_TX0_CW_MIN_OFDM, DEF_TX1_CW_MIN_OFDM, DEF_TX2_CW_MIN_OFDM,
 139          DEF_TX3_CW_MIN_OFDM},
 140         {DEF_TX0_CW_MAX_OFDM, DEF_TX1_CW_MAX_OFDM, DEF_TX2_CW_MAX_OFDM,
 141          DEF_TX3_CW_MAX_OFDM},
 142         {DEF_TX0_AIFS, DEF_TX1_AIFS, DEF_TX2_AIFS, DEF_TX3_AIFS},
 143         {DEF_TX0_ACM, DEF_TX1_ACM, DEF_TX2_ACM, DEF_TX3_ACM},
 144         {DEF_TX0_TXOP_LIMIT_OFDM, DEF_TX1_TXOP_LIMIT_OFDM,
 145          DEF_TX2_TXOP_LIMIT_OFDM, DEF_TX3_TXOP_LIMIT_OFDM}
 146 };
 147
 148 static struct ieee80211_qos_parameters def_parameters_CCK = {
 149         {DEF_TX0_CW_MIN_CCK, DEF_TX1_CW_MIN_CCK, DEF_TX2_CW_MIN_CCK,
 150          DEF_TX3_CW_MIN_CCK},
 151         {DEF_TX0_CW_MAX_CCK, DEF_TX1_CW_MAX_CCK, DEF_TX2_CW_MAX_CCK,
 152          DEF_TX3_CW_MAX_CCK},
 153         {DEF_TX0_AIFS, DEF_TX1_AIFS, DEF_TX2_AIFS, DEF_TX3_AIFS},
 154         {DEF_TX0_ACM, DEF_TX1_ACM, DEF_TX2_ACM, DEF_TX3_ACM},
 155         {DEF_TX0_TXOP_LIMIT_CCK, DEF_TX1_TXOP_LIMIT_CCK, DEF_TX2_TXOP_LIMIT_CCK,
 156          DEF_TX3_TXOP_LIMIT_CCK}
 157 };
 158
 159 static u8 qos_oui[QOS_OUI_LEN] = { 0x00, 0x50, 0xF2 };
 160
 161 static int from_priority_to_tx_queue[] = {
 162         IPW_TX_QUEUE_1, IPW_TX_QUEUE_2, IPW_TX_QUEUE_2, IPW_TX_QUEUE_1,
 163         IPW_TX_QUEUE_3, IPW_TX_QUEUE_3, IPW_TX_QUEUE_4, IPW_TX_QUEUE_4
 164 };
 165
 166 static u32 ipw_qos_get_burst_duration(struct ipw_priv *priv);
 167
 168 static int ipw_send_qos_params_command(struct ipw_priv *priv, struct ieee80211_qos_parameters
 169                                        *qos_param);
 170 static int ipw_send_qos_info_command(struct ipw_priv *priv, struct ieee80211_qos_information_element
 171                                      *qos_param);
 172 #endif                          /* CONFIG_IPW2200_QOS */
 173
 174 static struct iw_statistics *ipw_get_wireless_stats(struct net_device *dev);
 175 static void ipw_remove_current_network(struct ipw_priv *priv);
 176 static void ipw_rx(struct ipw_priv *priv);
 177 static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
 178                                 struct clx2_tx_queue *txq, int qindex);
 179 static int ipw_queue_reset(struct ipw_priv *priv);
 180
 181 static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
 182                              int len, int sync);
 183
 184 static void ipw_tx_queue_free(struct ipw_priv *);
 185
 186 static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *);
 187 static void ipw_rx_queue_free(struct ipw_priv *, struct ipw_rx_queue *);
 188 static void ipw_rx_queue_replenish(void *);
 189 static int ipw_up(struct ipw_priv *);
 190 static void ipw_bg_up(struct work_struct *work);
 191 static void ipw_down(struct ipw_priv *);
 192 static void ipw_bg_down(struct work_struct *work);
 193 static int ipw_config(struct ipw_priv *);
 194 static int init_supported_rates(struct ipw_priv *priv,
 195                                 struct ipw_supported_rates *prates);
 196 static void ipw_set_hwcrypto_keys(struct ipw_priv *);
 197 static void ipw_send_wep_keys(struct ipw_priv *, int);
 198
 199 static int snprint_line(char *buf, size_t count,
 200                         const u8 * data, u32 len, u32 ofs)
 201 {
 202         int out, i, j, l;
 203         char c;
 204
 205         out = snprintf(buf, count, "%08X", ofs);
 206
 207         for (l = 0, i = 0; i < 2; i++) {
 208                 out += snprintf(buf + out, count - out, " ");
 209                 for (j = 0; j < 8 && l < len; j++, l++)
 210                         out += snprintf(buf + out, count - out, "%02X ",
 211                                         data[(i * 8 + j)]);
 212                 for (; j < 8; j++)
 213                         out += snprintf(buf + out, count - out, "   ");
 214         }
 215
 216         out += snprintf(buf + out, count - out, " ");
 217         for (l = 0, i = 0; i < 2; i++) {
 218                 out += snprintf(buf + out, count - out, " ");
 219                 for (j = 0; j < 8 && l < len; j++, l++) {
 220                         c = data[(i * 8 + j)];
 221                         if (!isascii(c) || !isprint(c))
 222                                 c = '.';
 223
 224                         out += snprintf(buf + out, count - out, "%c", c);
 225                 }
 226
 227                 for (; j < 8; j++)
 228                         out += snprintf(buf + out, count - out, " ");
 229         }
 230
 231         return out;
 232 }
 233
 234 static void printk_buf(int level, const u8 * data, u32 len)
 235 {
 236         char line[81];
 237         u32 ofs = 0;
 238         if (!(ipw_debug_level & level))
 239                 return;
 240
 241         while (len) {
 242                 snprint_line(line, sizeof(line), &data[ofs],
 243                              min(len, 16U), ofs);
 244                 printk(KERN_DEBUG "%s\n", line);
 245                 ofs += 16;
 246                 len -= min(len, 16U);
 247         }
 248 }
 249
 250 static int snprintk_buf(u8 * output, size_t size, const u8 * data, size_t len)
 251 {
 252         size_t out = size;
 253         u32 ofs = 0;
 254         int total = 0;
 255
 256         while (size && len) {
 257                 out = snprint_line(output, size, &data[ofs],
 258                                    min_t(size_t, len, 16U), ofs);
 259
 260                 ofs += 16;
 261                 output += out;
 262                 size -= out;
 263                 len -= min_t(size_t, len, 16U);
 264                 total += out;
 265         }
 266         return total;
 267 }
 268
 269 /* alias for 32-bit indirect read (for SRAM/reg above 4K), with debug wrapper */
 270 static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg);
 271 #define ipw_read_reg32(a, b) _ipw_read_reg32(a, b)
 272
 273 /* alias for 8-bit indirect read (for SRAM/reg above 4K), with debug wrapper */
 274 static u8 _ipw_read_reg8(struct ipw_priv *ipw, u32 reg);
 275 #define ipw_read_reg8(a, b) _ipw_read_reg8(a, b)
 276
 277 /* 8-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
 278 static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value);
 279 static inline void ipw_write_reg8(struct ipw_priv *a, u32 b, u8 c)
 280 {
 281         IPW_DEBUG_IO("%s %d: write_indirect8(0x%08X, 0x%08X)\n", __FILE__,
 282                      __LINE__, (u32) (b), (u32) (c));
 283         _ipw_write_reg8(a, b, c);
 284 }
 285
 286 /* 16-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
 287 static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value);
 288 static inline void ipw_write_reg16(struct ipw_priv *a, u32 b, u16 c)
 289 {
 290         IPW_DEBUG_IO("%s %d: write_indirect16(0x%08X, 0x%08X)\n", __FILE__,
 291                      __LINE__, (u32) (b), (u32) (c));
 292         _ipw_write_reg16(a, b, c);
 293 }
 294
 295 /* 32-bit indirect write (for SRAM/reg above 4K), with debug wrapper */
 296 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value);
 297 static inline void ipw_write_reg32(struct ipw_priv *a, u32 b, u32 c)
 298 {
 299         IPW_DEBUG_IO("%s %d: write_indirect32(0x%08X, 0x%08X)\n", __FILE__,
 300                      __LINE__, (u32) (b), (u32) (c));
 301         _ipw_write_reg32(a, b, c);
 302 }
 303
 304 /* 8-bit direct write (low 4K) */
 305 #define _ipw_write8(ipw, ofs, val) writeb((val), (ipw)->hw_base + (ofs))
 306
 307 /* 8-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 308 #define ipw_write8(ipw, ofs, val) \
 309  IPW_DEBUG_IO("%s %d: write_direct8(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
 310  _ipw_write8(ipw, ofs, val)
 311
 312 /* 16-bit direct write (low 4K) */
 313 #define _ipw_write16(ipw, ofs, val) writew((val), (ipw)->hw_base + (ofs))
 314
 315 /* 16-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 316 #define ipw_write16(ipw, ofs, val) \
 317  IPW_DEBUG_IO("%s %d: write_direct16(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
 318  _ipw_write16(ipw, ofs, val)
 319
 320 /* 32-bit direct write (low 4K) */
 321 #define _ipw_write32(ipw, ofs, val) writel((val), (ipw)->hw_base + (ofs))
 322
 323 /* 32-bit direct write (for low 4K of SRAM/regs), with debug wrapper */
 324 #define ipw_write32(ipw, ofs, val) \
 325  IPW_DEBUG_IO("%s %d: write_direct32(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
 326  _ipw_write32(ipw, ofs, val)
 327
 328 /* 8-bit direct read (low 4K) */
 329 #define _ipw_read8(ipw, ofs) readb((ipw)->hw_base + (ofs))
 330
 331 /* 8-bit direct read (low 4K), with debug wrapper */
 332 static inline u8 __ipw_read8(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
 333 {
 334         IPW_DEBUG_IO("%s %d: read_direct8(0x%08X)\n", f, l, (u32) (ofs));
 335         return _ipw_read8(ipw, ofs);
 336 }
 337
 338 /* alias to 8-bit direct read (low 4K of SRAM/regs), with debug wrapper */
 339 #define ipw_read8(ipw, ofs) __ipw_read8(__FILE__, __LINE__, ipw, ofs)
 340
 341 /* 16-bit direct read (low 4K) */
 342 #define _ipw_read16(ipw, ofs) readw((ipw)->hw_base + (ofs))
 343
 344 /* 16-bit direct read (low 4K), with debug wrapper */
 345 static inline u16 __ipw_read16(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
 346 {
 347         IPW_DEBUG_IO("%s %d: read_direct16(0x%08X)\n", f, l, (u32) (ofs));
 348         return _ipw_read16(ipw, ofs);
 349 }
 350
 351 /* alias to 16-bit direct read (low 4K of SRAM/regs), with debug wrapper */
 352 #define ipw_read16(ipw, ofs) __ipw_read16(__FILE__, __LINE__, ipw, ofs)
 353
 354 /* 32-bit direct read (low 4K) */
 355 #define _ipw_read32(ipw, ofs) readl((ipw)->hw_base + (ofs))
 356
 357 /* 32-bit direct read (low 4K), with debug wrapper */
 358 static inline u32 __ipw_read32(char *f, u32 l, struct ipw_priv *ipw, u32 ofs)
 359 {
 360         IPW_DEBUG_IO("%s %d: read_direct32(0x%08X)\n", f, l, (u32) (ofs));
 361         return _ipw_read32(ipw, ofs);
 362 }
 363
 364 /* alias to 32-bit direct read (low 4K of SRAM/regs), with debug wrapper */
 365 #define ipw_read32(ipw, ofs) __ipw_read32(__FILE__, __LINE__, ipw, ofs)
 366
 367 /* multi-byte read (above 4K), with debug wrapper */
 368 static void _ipw_read_indirect(struct ipw_priv *, u32, u8 *, int);
 369 static inline void __ipw_read_indirect(const char *f, int l,
 370                                        struct ipw_priv *a, u32 b, u8 * c, int d)
 371 {
 372         IPW_DEBUG_IO("%s %d: read_indirect(0x%08X) %d bytes\n", f, l, (u32) (b),
 373                      d);
 374         _ipw_read_indirect(a, b, c, d);
 375 }
 376
 377 /* alias to multi-byte read (SRAM/regs above 4K), with debug wrapper */
 378 #define ipw_read_indirect(a, b, c, d) __ipw_read_indirect(__FILE__, __LINE__, a, b, c, d)
 379
 380 /* alias to multi-byte read (SRAM/regs above 4K), with debug wrapper */
 381 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * data,
 382                                 int num);
 383 #define ipw_write_indirect(a, b, c, d) \
 384         IPW_DEBUG_IO("%s %d: write_indirect(0x%08X) %d bytes\n", __FILE__, __LINE__, (u32)(b), d); \
 385         _ipw_write_indirect(a, b, c, d)
 386
 387 /* 32-bit indirect write (above 4K) */
 388 static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value)
 389 {
 390         IPW_DEBUG_IO(" %p : reg = 0x%8X : value = 0x%8X\n", priv, reg, value);
 391         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
 392         _ipw_write32(priv, IPW_INDIRECT_DATA, value);
 393 }
 394
 395 /* 8-bit indirect write (above 4K) */
 396 static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value)
 397 {
 398         u32 aligned_addr = reg & IPW_INDIRECT_ADDR_MASK;        /* dword align */
 399         u32 dif_len = reg - aligned_addr;
 400
 401         IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
 402         _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 403         _ipw_write8(priv, IPW_INDIRECT_DATA + dif_len, value);
 404 }
 405
 406 /* 16-bit indirect write (above 4K) */
 407 static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value)
 408 {
 409         u32 aligned_addr = reg & IPW_INDIRECT_ADDR_MASK;        /* dword align */
 410         u32 dif_len = (reg - aligned_addr) & (~0x1ul);
 411
 412         IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
 413         _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 414         _ipw_write16(priv, IPW_INDIRECT_DATA + dif_len, value);
 415 }
 416
 417 /* 8-bit indirect read (above 4K) */
 418 static u8 _ipw_read_reg8(struct ipw_priv *priv, u32 reg)
 419 {
 420         u32 word;
 421         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg & IPW_INDIRECT_ADDR_MASK);
 422         IPW_DEBUG_IO(" reg = 0x%8X : \n", reg);
 423         word = _ipw_read32(priv, IPW_INDIRECT_DATA);
 424         return (word >> ((reg & 0x3) * 8)) & 0xff;
 425 }
 426
 427 /* 32-bit indirect read (above 4K) */
 428 static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg)
 429 {
 430         u32 value;
 431
 432         IPW_DEBUG_IO("%p : reg = 0x%08x\n", priv, reg);
 433
 434         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
 435         value = _ipw_read32(priv, IPW_INDIRECT_DATA);
 436         IPW_DEBUG_IO(" reg = 0x%4X : value = 0x%4x \n", reg, value);
 437         return value;
 438 }
 439
 440 /* General purpose, no alignment requirement, iterative (multi-byte) read, */
 441 /*    for area above 1st 4K of SRAM/reg space */
 442 static void _ipw_read_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
 443                                int num)
 444 {
 445         u32 aligned_addr = addr & IPW_INDIRECT_ADDR_MASK;       /* dword align */
 446         u32 dif_len = addr - aligned_addr;
 447         u32 i;
 448
 449         IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
 450
 451         if (num <= 0) {
 452                 return;
 453         }
 454
 455         /* Read the first dword (or portion) byte by byte */
 456         if (unlikely(dif_len)) {
 457                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 458                 /* Start reading at aligned_addr + dif_len */
 459                 for (i = dif_len; ((i < 4) && (num > 0)); i++, num--)
 460                         *buf++ = _ipw_read8(priv, IPW_INDIRECT_DATA + i);
 461                 aligned_addr += 4;
 462         }
 463
 464         /* Read all of the middle dwords as dwords, with auto-increment */
 465         _ipw_write32(priv, IPW_AUTOINC_ADDR, aligned_addr);
 466         for (; num >= 4; buf += 4, aligned_addr += 4, num -= 4)
 467                 *(u32 *) buf = _ipw_read32(priv, IPW_AUTOINC_DATA);
 468
 469         /* Read the last dword (or portion) byte by byte */
 470         if (unlikely(num)) {
 471                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 472                 for (i = 0; num > 0; i++, num--)
 473                         *buf++ = ipw_read8(priv, IPW_INDIRECT_DATA + i);
 474         }
 475 }
 476
 477 /* General purpose, no alignment requirement, iterative (multi-byte) write, */
 478 /*    for area above 1st 4K of SRAM/reg space */
 479 static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
 480                                 int num)
 481 {
 482         u32 aligned_addr = addr & IPW_INDIRECT_ADDR_MASK;       /* dword align */
 483         u32 dif_len = addr - aligned_addr;
 484         u32 i;
 485
 486         IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
 487
 488         if (num <= 0) {
 489                 return;
 490         }
 491
 492         /* Write the first dword (or portion) byte by byte */
 493         if (unlikely(dif_len)) {
 494                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 495                 /* Start writing at aligned_addr + dif_len */
 496                 for (i = dif_len; ((i < 4) && (num > 0)); i++, num--, buf++)
 497                         _ipw_write8(priv, IPW_INDIRECT_DATA + i, *buf);
 498                 aligned_addr += 4;
 499         }
 500
 501         /* Write all of the middle dwords as dwords, with auto-increment */
 502         _ipw_write32(priv, IPW_AUTOINC_ADDR, aligned_addr);
 503         for (; num >= 4; buf += 4, aligned_addr += 4, num -= 4)
 504                 _ipw_write32(priv, IPW_AUTOINC_DATA, *(u32 *) buf);
 505
 506         /* Write the last dword (or portion) byte by byte */
 507         if (unlikely(num)) {
 508                 _ipw_write32(priv, IPW_INDIRECT_ADDR, aligned_addr);
 509                 for (i = 0; num > 0; i++, num--, buf++)
 510                         _ipw_write8(priv, IPW_INDIRECT_DATA + i, *buf);
 511         }
 512 }
 513
 514 /* General purpose, no alignment requirement, iterative (multi-byte) write, */
 515 /*    for 1st 4K of SRAM/regs space */
 516 static void ipw_write_direct(struct ipw_priv *priv, u32 addr, void *buf,
 517                              int num)
 518 {
 519         memcpy_toio((priv->hw_base + addr), buf, num);
 520 }
 521
 522 /* Set bit(s) in low 4K of SRAM/regs */
 523 static inline void ipw_set_bit(struct ipw_priv *priv, u32 reg, u32 mask)
 524 {
 525         ipw_write32(priv, reg, ipw_read32(priv, reg) | mask);
 526 }
 527
 528 /* Clear bit(s) in low 4K of SRAM/regs */
 529 static inline void ipw_clear_bit(struct ipw_priv *priv, u32 reg, u32 mask)
 530 {
 531         ipw_write32(priv, reg, ipw_read32(priv, reg) & ~mask);
 532 }
 533
 534 static inline void __ipw_enable_interrupts(struct ipw_priv *priv)
 535 {
 536         if (priv->status & STATUS_INT_ENABLED)
 537                 return;
 538         priv->status |= STATUS_INT_ENABLED;
 539         ipw_write32(priv, IPW_INTA_MASK_R, IPW_INTA_MASK_ALL);
 540 }
 541
 542 static inline void __ipw_disable_interrupts(struct ipw_priv *priv)
 543 {
 544         if (!(priv->status & STATUS_INT_ENABLED))
 545                 return;
 546         priv->status &= ~STATUS_INT_ENABLED;
 547         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
 548 }
 549
 550 static inline void ipw_enable_interrupts(struct ipw_priv *priv)
 551 {
 552         unsigned long flags;
 553
 554         spin_lock_irqsave(&priv->irq_lock, flags);
 555         __ipw_enable_interrupts(priv);
 556         spin_unlock_irqrestore(&priv->irq_lock, flags);
 557 }
 558
 559 static inline void ipw_disable_interrupts(struct ipw_priv *priv)
 560 {
 561         unsigned long flags;
 562
 563         spin_lock_irqsave(&priv->irq_lock, flags);
 564         __ipw_disable_interrupts(priv);
 565         spin_unlock_irqrestore(&priv->irq_lock, flags);
 566 }
 567
 568 static char *ipw_error_desc(u32 val)
 569 {
 570         switch (val) {
 571         case IPW_FW_ERROR_OK:
 572                 return "ERROR_OK";
 573         case IPW_FW_ERROR_FAIL:
 574                 return "ERROR_FAIL";
 575         case IPW_FW_ERROR_MEMORY_UNDERFLOW:
 576                 return "MEMORY_UNDERFLOW";
 577         case IPW_FW_ERROR_MEMORY_OVERFLOW:
 578                 return "MEMORY_OVERFLOW";
 579         case IPW_FW_ERROR_BAD_PARAM:
 580                 return "BAD_PARAM";
 581         case IPW_FW_ERROR_BAD_CHECKSUM:
 582                 return "BAD_CHECKSUM";
 583         case IPW_FW_ERROR_NMI_INTERRUPT:
 584                 return "NMI_INTERRUPT";
 585         case IPW_FW_ERROR_BAD_DATABASE:
 586                 return "BAD_DATABASE";
 587         case IPW_FW_ERROR_ALLOC_FAIL:
 588                 return "ALLOC_FAIL";
 589         case IPW_FW_ERROR_DMA_UNDERRUN:
 590                 return "DMA_UNDERRUN";
 591         case IPW_FW_ERROR_DMA_STATUS:
 592                 return "DMA_STATUS";
 593         case IPW_FW_ERROR_DINO_ERROR:
 594                 return "DINO_ERROR";
 595         case IPW_FW_ERROR_EEPROM_ERROR:
 596                 return "EEPROM_ERROR";
 597         case IPW_FW_ERROR_SYSASSERT:
 598                 return "SYSASSERT";
 599         case IPW_FW_ERROR_FATAL_ERROR:
 600                 return "FATAL_ERROR";
 601         default:
 602                 return "UNKNOWN_ERROR";
 603         }
 604 }
 605
 606 static void ipw_dump_error_log(struct ipw_priv *priv,
 607                                struct ipw_fw_error *error)
 608 {
 609         u32 i;
 610
 611         if (!error) {
 612                 IPW_ERROR("Error allocating and capturing error log.  "
 613                           "Nothing to dump.\n");
 614                 return;
 615         }
 616
 617         IPW_ERROR("Start IPW Error Log Dump:\n");
 618         IPW_ERROR("Status: 0x%08X, Config: %08X\n",
 619                   error->status, error->config);
 620
 621         for (i = 0; i < error->elem_len; i++)
 622                 IPW_ERROR("%s %i 0x%08x  0x%08x  0x%08x  0x%08x  0x%08x\n",
 623                           ipw_error_desc(error->elem[i].desc),
 624                           error->elem[i].time,
 625                           error->elem[i].blink1,
 626                           error->elem[i].blink2,
 627                           error->elem[i].link1,
 628                           error->elem[i].link2, error->elem[i].data);
 629         for (i = 0; i < error->log_len; i++)
 630                 IPW_ERROR("%i\t0x%08x\t%i\n",
 631                           error->log[i].time,
 632                           error->log[i].data, error->log[i].event);
 633 }
 634
 635 static inline int ipw_is_init(struct ipw_priv *priv)
 636 {
 637         return (priv->status & STATUS_INIT) ? 1 : 0;
 638 }
 639
 640 static int ipw_get_ordinal(struct ipw_priv *priv, u32 ord, void *val, u32 * len)
 641 {
 642         u32 addr, field_info, field_len, field_count, total_len;
 643
 644         IPW_DEBUG_ORD("ordinal = %i\n", ord);
 645
 646         if (!priv || !val || !len) {
 647                 IPW_DEBUG_ORD("Invalid argument\n");
 648                 return -EINVAL;
 649         }
 650
 651         /* verify device ordinal tables have been initialized */
 652         if (!priv->table0_addr || !priv->table1_addr || !priv->table2_addr) {
 653                 IPW_DEBUG_ORD("Access ordinals before initialization\n");
 654                 return -EINVAL;
 655         }
 656
 657         switch (IPW_ORD_TABLE_ID_MASK & ord) {
 658         case IPW_ORD_TABLE_0_MASK:
 659                 /*
 660                  * TABLE 0: Direct access to a table of 32 bit values
 661                  *
 662                  * This is a very simple table with the data directly
 663                  * read from the table
 664                  */
 665
 666                 /* remove the table id from the ordinal */
 667                 ord &= IPW_ORD_TABLE_VALUE_MASK;
 668
 669                 /* boundary check */
 670                 if (ord > priv->table0_len) {
 671                         IPW_DEBUG_ORD("ordinal value (%i) longer then "
 672                                       "max (%i)\n", ord, priv->table0_len);
 673                         return -EINVAL;
 674                 }
 675
 676                 /* verify we have enough room to store the value */
 677                 if (*len < sizeof(u32)) {
 678                         IPW_DEBUG_ORD("ordinal buffer length too small, "
 679                                       "need %zd\n", sizeof(u32));
 680                         return -EINVAL;
 681                 }
 682
 683                 IPW_DEBUG_ORD("Reading TABLE0[%i] from offset 0x%08x\n",
 684                               ord, priv->table0_addr + (ord << 2));
 685
 686                 *len = sizeof(u32);
 687                 ord <<= 2;
 688                 *((u32 *) val) = ipw_read32(priv, priv->table0_addr + ord);
 689                 break;
 690
 691         case IPW_ORD_TABLE_1_MASK:
 692                 /*
 693                  * TABLE 1: Indirect access to a table of 32 bit values
 694                  *
 695                  * This is a fairly large table of u32 values each
 696                  * representing starting addr for the data (which is
 697                  * also a u32)
 698                  */
 699
 700                 /* remove the table id from the ordinal */
 701                 ord &= IPW_ORD_TABLE_VALUE_MASK;
 702
 703                 /* boundary check */
 704                 if (ord > priv->table1_len) {
 705                         IPW_DEBUG_ORD("ordinal value too long\n");
 706                         return -EINVAL;
 707                 }
 708
 709                 /* verify we have enough room to store the value */
 710                 if (*len < sizeof(u32)) {
 711                         IPW_DEBUG_ORD("ordinal buffer length too small, "
 712                                       "need %zd\n", sizeof(u32));
 713                         return -EINVAL;
 714                 }
 715
 716                 *((u32 *) val) =
 717                     ipw_read_reg32(priv, (priv->table1_addr + (ord << 2)));
 718                 *len = sizeof(u32);
 719                 break;
 720
 721         case IPW_ORD_TABLE_2_MASK:
 722                 /*
 723                  * TABLE 2: Indirect access to a table of variable sized values
 724                  *
 725                  * This table consist of six values, each containing
 726                  *     - dword containing the starting offset of the data
 727                  *     - dword containing the lengh in the first 16bits
 728                  *       and the count in the second 16bits
 729                  */
 730
 731                 /* remove the table id from the ordinal */
 732                 ord &= IPW_ORD_TABLE_VALUE_MASK;
 733
 734                 /* boundary check */
 735                 if (ord > priv->table2_len) {
 736                         IPW_DEBUG_ORD("ordinal value too long\n");
 737                         return -EINVAL;
 738                 }
 739
 740                 /* get the address of statistic */
 741                 addr = ipw_read_reg32(priv, priv->table2_addr + (ord << 3));
 742
 743                 /* get the second DW of statistics ;
 744                  * two 16-bit words - first is length, second is count */
 745                 field_info =
 746                     ipw_read_reg32(priv,
 747                                    priv->table2_addr + (ord << 3) +
 748                                    sizeof(u32));
 749
 750                 /* get each entry length */
 751                 field_len = *((u16 *) & field_info);
 752
 753                 /* get number of entries */
 754                 field_count = *(((u16 *) & field_info) + 1);
 755
 756                 /* abort if not enought memory */
 757                 total_len = field_len * field_count;
 758                 if (total_len > *len) {
 759                         *len = total_len;
 760                         return -EINVAL;
 761                 }
 762
 763                 *len = total_len;
 764                 if (!total_len)
 765                         return 0;
 766
 767                 IPW_DEBUG_ORD("addr = 0x%08x, total_len = %i, "
 768                               "field_info = 0x%08x\n",
 769                               addr, total_len, field_info);
 770                 ipw_read_indirect(priv, addr, val, total_len);
 771                 break;
 772
 773         default:
 774                 IPW_DEBUG_ORD("Invalid ordinal!\n");
 775                 return -EINVAL;
 776
 777         }
 778
 779         return 0;
 780 }
 781
 782 static void ipw_init_ordinals(struct ipw_priv *priv)
 783 {
 784         priv->table0_addr = IPW_ORDINALS_TABLE_LOWER;
 785         priv->table0_len = ipw_read32(priv, priv->table0_addr);
 786
 787         IPW_DEBUG_ORD("table 0 offset at 0x%08x, len = %i\n",
 788                       priv->table0_addr, priv->table0_len);
 789
 790         priv->table1_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_1);
 791         priv->table1_len = ipw_read_reg32(priv, priv->table1_addr);
 792
 793         IPW_DEBUG_ORD("table 1 offset at 0x%08x, len = %i\n",
 794                       priv->table1_addr, priv->table1_len);
 795
 796         priv->table2_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_2);
 797         priv->table2_len = ipw_read_reg32(priv, priv->table2_addr);
 798         priv->table2_len &= 0x0000ffff; /* use first two bytes */
 799
 800         IPW_DEBUG_ORD("table 2 offset at 0x%08x, len = %i\n",
 801                       priv->table2_addr, priv->table2_len);
 802
 803 }
 804
 805 static u32 ipw_register_toggle(u32 reg)
 806 {
 807         reg &= ~IPW_START_STANDBY;
 808         if (reg & IPW_GATE_ODMA)
 809                 reg &= ~IPW_GATE_ODMA;
 810         if (reg & IPW_GATE_IDMA)
 811                 reg &= ~IPW_GATE_IDMA;
 812         if (reg & IPW_GATE_ADMA)
 813                 reg &= ~IPW_GATE_ADMA;
 814         return reg;
 815 }
 816
 817 /*
 818  * LED behavior:
 819  * - On radio ON, turn on any LEDs that require to be on during start
 820  * - On initialization, start unassociated blink
 821  * - On association, disable unassociated blink
 822  * - On disassociation, start unassociated blink
 823  * - On radio OFF, turn off any LEDs started during radio on
 824  *
 825  */
 826 #define LD_TIME_LINK_ON msecs_to_jiffies(300)
 827 #define LD_TIME_LINK_OFF msecs_to_jiffies(2700)
 828 #define LD_TIME_ACT_ON msecs_to_jiffies(250)
 829
 830 static void ipw_led_link_on(struct ipw_priv *priv)
 831 {
 832         unsigned long flags;
 833         u32 led;
 834
 835         /* If configured to not use LEDs, or nic_type is 1,
 836          * then we don't toggle a LINK led */
 837         if (priv->config & CFG_NO_LED || priv->nic_type == EEPROM_NIC_TYPE_1)
 838                 return;
 839
 840         spin_lock_irqsave(&priv->lock, flags);
 841
 842         if (!(priv->status & STATUS_RF_KILL_MASK) &&
 843             !(priv->status & STATUS_LED_LINK_ON)) {
 844                 IPW_DEBUG_LED("Link LED On\n");
 845                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 846                 led |= priv->led_association_on;
 847
 848                 led = ipw_register_toggle(led);
 849
 850                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 851                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 852
 853                 priv->status |= STATUS_LED_LINK_ON;
 854
 855                 /* If we aren't associated, schedule turning the LED off */
 856                 if (!(priv->status & STATUS_ASSOCIATED))
 857                         queue_delayed_work(priv->workqueue,
 858                                            &priv->led_link_off,
 859                                            LD_TIME_LINK_ON);
 860         }
 861
 862         spin_unlock_irqrestore(&priv->lock, flags);
 863 }
 864
 865 static void ipw_bg_led_link_on(struct work_struct *work)
 866 {
 867         struct ipw_priv *priv =
 868                 container_of(work, struct ipw_priv, led_link_on.work);
 869         mutex_lock(&priv->mutex);
 870         ipw_led_link_on(priv);
 871         mutex_unlock(&priv->mutex);
 872 }
 873
 874 static void ipw_led_link_off(struct ipw_priv *priv)
 875 {
 876         unsigned long flags;
 877         u32 led;
 878
 879         /* If configured not to use LEDs, or nic type is 1,
 880          * then we don't goggle the LINK led. */
 881         if (priv->config & CFG_NO_LED || priv->nic_type == EEPROM_NIC_TYPE_1)
 882                 return;
 883
 884         spin_lock_irqsave(&priv->lock, flags);
 885
 886         if (priv->status & STATUS_LED_LINK_ON) {
 887                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 888                 led &= priv->led_association_off;
 889                 led = ipw_register_toggle(led);
 890
 891                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 892                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 893
 894                 IPW_DEBUG_LED("Link LED Off\n");
 895
 896                 priv->status &= ~STATUS_LED_LINK_ON;
 897
 898                 /* If we aren't associated and the radio is on, schedule
 899                  * turning the LED on (blink while unassociated) */
 900                 if (!(priv->status & STATUS_RF_KILL_MASK) &&
 901                     !(priv->status & STATUS_ASSOCIATED))
 902                         queue_delayed_work(priv->workqueue, &priv->led_link_on,
 903                                            LD_TIME_LINK_OFF);
 904
 905         }
 906
 907         spin_unlock_irqrestore(&priv->lock, flags);
 908 }
 909
 910 static void ipw_bg_led_link_off(struct work_struct *work)
 911 {
 912         struct ipw_priv *priv =
 913                 container_of(work, struct ipw_priv, led_link_off.work);
 914         mutex_lock(&priv->mutex);
 915         ipw_led_link_off(priv);
 916         mutex_unlock(&priv->mutex);
 917 }
 918
 919 static void __ipw_led_activity_on(struct ipw_priv *priv)
 920 {
 921         u32 led;
 922
 923         if (priv->config & CFG_NO_LED)
 924                 return;
 925
 926         if (priv->status & STATUS_RF_KILL_MASK)
 927                 return;
 928
 929         if (!(priv->status & STATUS_LED_ACT_ON)) {
 930                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 931                 led |= priv->led_activity_on;
 932
 933                 led = ipw_register_toggle(led);
 934
 935                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 936                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 937
 938                 IPW_DEBUG_LED("Activity LED On\n");
 939
 940                 priv->status |= STATUS_LED_ACT_ON;
 941
 942                 cancel_delayed_work(&priv->led_act_off);
 943                 queue_delayed_work(priv->workqueue, &priv->led_act_off,
 944                                    LD_TIME_ACT_ON);
 945         } else {
 946                 /* Reschedule LED off for full time period */
 947                 cancel_delayed_work(&priv->led_act_off);
 948                 queue_delayed_work(priv->workqueue, &priv->led_act_off,
 949                                    LD_TIME_ACT_ON);
 950         }
 951 }
 952
 953 #if 0
 954 void ipw_led_activity_on(struct ipw_priv *priv)
 955 {
 956         unsigned long flags;
 957         spin_lock_irqsave(&priv->lock, flags);
 958         __ipw_led_activity_on(priv);
 959         spin_unlock_irqrestore(&priv->lock, flags);
 960 }
 961 #endif  /*  0  */
 962
 963 static void ipw_led_activity_off(struct ipw_priv *priv)
 964 {
 965         unsigned long flags;
 966         u32 led;
 967
 968         if (priv->config & CFG_NO_LED)
 969                 return;
 970
 971         spin_lock_irqsave(&priv->lock, flags);
 972
 973         if (priv->status & STATUS_LED_ACT_ON) {
 974                 led = ipw_read_reg32(priv, IPW_EVENT_REG);
 975                 led &= priv->led_activity_off;
 976
 977                 led = ipw_register_toggle(led);
 978
 979                 IPW_DEBUG_LED("Reg: 0x%08X\n", led);
 980                 ipw_write_reg32(priv, IPW_EVENT_REG, led);
 981
 982                 IPW_DEBUG_LED("Activity LED Off\n");
 983
 984                 priv->status &= ~STATUS_LED_ACT_ON;
 985         }
 986
 987         spin_unlock_irqrestore(&priv->lock, flags);
 988 }
 989
 990 static void ipw_bg_led_activity_off(struct work_struct *work)
 991 {
 992         struct ipw_priv *priv =
 993                 container_of(work, struct ipw_priv, led_act_off.work);
 994         mutex_lock(&priv->mutex);
 995         ipw_led_activity_off(priv);
 996         mutex_unlock(&priv->mutex);
 997 }
 998
 999 static void ipw_led_band_on(struct ipw_priv *priv)
1000 {
1001         unsigned long flags;
1002         u32 led;
1003
1004         /* Only nic type 1 supports mode LEDs */
1005         if (priv->config & CFG_NO_LED ||
1006             priv->nic_type != EEPROM_NIC_TYPE_1 || !priv->assoc_network)
1007                 return;
1008
1009         spin_lock_irqsave(&priv->lock, flags);
1010
1011         led = ipw_read_reg32(priv, IPW_EVENT_REG);
1012         if (priv->assoc_network->mode == IEEE_A) {
1013                 led |= priv->led_ofdm_on;
1014                 led &= priv->led_association_off;
1015                 IPW_DEBUG_LED("Mode LED On: 802.11a\n");
1016         } else if (priv->assoc_network->mode == IEEE_G) {
1017                 led |= priv->led_ofdm_on;
1018                 led |= priv->led_association_on;
1019                 IPW_DEBUG_LED("Mode LED On: 802.11g\n");
1020         } else {
1021                 led &= priv->led_ofdm_off;
1022                 led |= priv->led_association_on;
1023                 IPW_DEBUG_LED("Mode LED On: 802.11b\n");
1024         }
1025
1026         led = ipw_register_toggle(led);
1027
1028         IPW_DEBUG_LED("Reg: 0x%08X\n", led);
1029         ipw_write_reg32(priv, IPW_EVENT_REG, led);
1030
1031         spin_unlock_irqrestore(&priv->lock, flags);
1032 }
1033
1034 static void ipw_led_band_off(struct ipw_priv *priv)
1035 {
1036         unsigned long flags;
1037         u32 led;
1038
1039         /* Only nic type 1 supports mode LEDs */
1040         if (priv->config & CFG_NO_LED || priv->nic_type != EEPROM_NIC_TYPE_1)
1041                 return;
1042
1043         spin_lock_irqsave(&priv->lock, flags);
1044
1045         led = ipw_read_reg32(priv, IPW_EVENT_REG);
1046         led &= priv->led_ofdm_off;
1047         led &= priv->led_association_off;
1048
1049         led = ipw_register_toggle(led);
1050
1051         IPW_DEBUG_LED("Reg: 0x%08X\n", led);
1052         ipw_write_reg32(priv, IPW_EVENT_REG, led);
1053
1054         spin_unlock_irqrestore(&priv->lock, flags);
1055 }
1056
1057 static void ipw_led_radio_on(struct ipw_priv *priv)
1058 {
1059         ipw_led_link_on(priv);
1060 }
1061
1062 static void ipw_led_radio_off(struct ipw_priv *priv)
1063 {
1064         ipw_led_activity_off(priv);
1065         ipw_led_link_off(priv);
1066 }
1067
1068 static void ipw_led_link_up(struct ipw_priv *priv)
1069 {
1070         /* Set the Link Led on for all nic types */
1071         ipw_led_link_on(priv);
1072 }
1073
1074 static void ipw_led_link_down(struct ipw_priv *priv)
1075 {
1076         ipw_led_activity_off(priv);
1077         ipw_led_link_off(priv);
1078
1079         if (priv->status & STATUS_RF_KILL_MASK)
1080                 ipw_led_radio_off(priv);
1081 }
1082
1083 static void ipw_led_init(struct ipw_priv *priv)
1084 {
1085         priv->nic_type = priv->eeprom[EEPROM_NIC_TYPE];
1086
1087         /* Set the default PINs for the link and activity leds */
1088         priv->led_activity_on = IPW_ACTIVITY_LED;
1089         priv->led_activity_off = ~(IPW_ACTIVITY_LED);
1090
1091         priv->led_association_on = IPW_ASSOCIATED_LED;
1092         priv->led_association_off = ~(IPW_ASSOCIATED_LED);
1093
1094         /* Set the default PINs for the OFDM leds */
1095         priv->led_ofdm_on = IPW_OFDM_LED;
1096         priv->led_ofdm_off = ~(IPW_OFDM_LED);
1097
1098         switch (priv->nic_type) {
1099         case EEPROM_NIC_TYPE_1:
1100                 /* In this NIC type, the LEDs are reversed.... */
1101                 priv->led_activity_on = IPW_ASSOCIATED_LED;
1102                 priv->led_activity_off = ~(IPW_ASSOCIATED_LED);
1103                 priv->led_association_on = IPW_ACTIVITY_LED;
1104                 priv->led_association_off = ~(IPW_ACTIVITY_LED);
1105
1106                 if (!(priv->config & CFG_NO_LED))
1107                         ipw_led_band_on(priv);
1108
1109                 /* And we don't blink link LEDs for this nic, so
1110                  * just return here */
1111                 return;
1112
1113         case EEPROM_NIC_TYPE_3:
1114         case EEPROM_NIC_TYPE_2:
1115         case EEPROM_NIC_TYPE_4:
1116         case EEPROM_NIC_TYPE_0:
1117                 break;
1118
1119         default:
1120                 IPW_DEBUG_INFO("Unknown NIC type from EEPROM: %d\n",
1121                                priv->nic_type);
1122                 priv->nic_type = EEPROM_NIC_TYPE_0;
1123                 break;
1124         }
1125
1126         if (!(priv->config & CFG_NO_LED)) {
1127                 if (priv->status & STATUS_ASSOCIATED)
1128                         ipw_led_link_on(priv);
1129                 else
1130                         ipw_led_link_off(priv);
1131         }
1132 }
1133
1134 static void ipw_led_shutdown(struct ipw_priv *priv)
1135 {
1136         ipw_led_activity_off(priv);
1137         ipw_led_link_off(priv);
1138         ipw_led_band_off(priv);
1139         cancel_delayed_work(&priv->led_link_on);
1140         cancel_delayed_work(&priv->led_link_off);
1141         cancel_delayed_work(&priv->led_act_off);
1142 }
1143
1144 /*
1145  * The following adds a new attribute to the sysfs representation
1146  * of this device driver (i.e. a new file in /sys/bus/pci/drivers/ipw/)
1147  * used for controling the debug level.
1148  *
1149  * See the level definitions in ipw for details.
1150  */
1151 static ssize_t show_debug_level(struct device_driver *d, char *buf)
1152 {
1153         return sprintf(buf, "0x%08X\n", ipw_debug_level);
1154 }
1155
1156 static ssize_t store_debug_level(struct device_driver *d, const char *buf,
1157                                  size_t count)
1158 {
1159         char *p = (char *)buf;
1160         u32 val;
1161
1162         if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
1163                 p++;
1164                 if (p[0] == 'x' || p[0] == 'X')
1165                         p++;
1166                 val = simple_strtoul(p, &p, 16);
1167         } else
1168                 val = simple_strtoul(p, &p, 10);
1169         if (p == buf)
1170                 printk(KERN_INFO DRV_NAME
1171                        ": %s is not in hex or decimal form.\n", buf);
1172         else
1173                 ipw_debug_level = val;
1174
1175         return strnlen(buf, count);
1176 }
1177
1178 static DRIVER_ATTR(debug_level, S_IWUSR | S_IRUGO,
1179                    show_debug_level, store_debug_level);
1180
1181 static inline u32 ipw_get_event_log_len(struct ipw_priv *priv)
1182 {
1183         /* length = 1st dword in log */
1184         return ipw_read_reg32(priv, ipw_read32(priv, IPW_EVENT_LOG));
1185 }
1186
1187 static void ipw_capture_event_log(struct ipw_priv *priv,
1188                                   u32 log_len, struct ipw_event *log)
1189 {
1190         u32 base;
1191
1192         if (log_len) {
1193                 base = ipw_read32(priv, IPW_EVENT_LOG);
1194                 ipw_read_indirect(priv, base + sizeof(base) + sizeof(u32),
1195                                   (u8 *) log, sizeof(*log) * log_len);
1196         }
1197 }
1198
1199 static struct ipw_fw_error *ipw_alloc_error_log(struct ipw_priv *priv)
1200 {
1201         struct ipw_fw_error *error;
1202         u32 log_len = ipw_get_event_log_len(priv);
1203         u32 base = ipw_read32(priv, IPW_ERROR_LOG);
1204         u32 elem_len = ipw_read_reg32(priv, base);
1205
1206         error = kmalloc(sizeof(*error) +
1207                         sizeof(*error->elem) * elem_len +
1208                         sizeof(*error->log) * log_len, GFP_ATOMIC);
1209         if (!error) {
1210                 IPW_ERROR("Memory allocation for firmware error log "
1211                           "failed.\n");
1212                 return NULL;
1213         }
1214         error->jiffies = jiffies;
1215         error->status = priv->status;
1216         error->config = priv->config;
1217         error->elem_len = elem_len;
1218         error->log_len = log_len;
1219         error->elem = (struct ipw_error_elem *)error->payload;
1220         error->log = (struct ipw_event *)(error->elem + elem_len);
1221
1222         ipw_capture_event_log(priv, log_len, error->log);
1223
1224         if (elem_len)
1225                 ipw_read_indirect(priv, base + sizeof(base), (u8 *) error->elem,
1226                                   sizeof(*error->elem) * elem_len);
1227
1228         return error;
1229 }
1230
1231 static ssize_t show_event_log(struct device *d,
1232                               struct device_attribute *attr, char *buf)
1233 {
1234         struct ipw_priv *priv = dev_get_drvdata(d);
1235         u32 log_len = ipw_get_event_log_len(priv);
1236         u32 log_size;
1237         struct ipw_event *log;
1238         u32 len = 0, i;
1239
1240         /* not using min() because of its strict type checking */
1241         log_size = PAGE_SIZE / sizeof(*log) > log_len ?
1242                         sizeof(*log) * log_len : PAGE_SIZE;
1243         log = kzalloc(log_size, GFP_KERNEL);
1244         if (!log) {
1245                 IPW_ERROR("Unable to allocate memory for log\n");
1246                 return 0;
1247         }
1248         log_len = log_size / sizeof(*log);
1249         ipw_capture_event_log(priv, log_len, log);
1250
1251         len += snprintf(buf + len, PAGE_SIZE - len, "%08X", log_len);
1252         for (i = 0; i < log_len; i++)
1253                 len += snprintf(buf + len, PAGE_SIZE - len,
1254                                 "\n%08X%08X%08X",
1255                                 log[i].time, log[i].event, log[i].data);
1256         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1257         kfree(log);
1258         return len;
1259 }
1260
1261 static DEVICE_ATTR(event_log, S_IRUGO, show_event_log, NULL);
1262
1263 static ssize_t show_error(struct device *d,
1264                           struct device_attribute *attr, char *buf)
1265 {
1266         struct ipw_priv *priv = dev_get_drvdata(d);
1267         u32 len = 0, i;
1268         if (!priv->error)
1269                 return 0;
1270         len += snprintf(buf + len, PAGE_SIZE - len,
1271                         "%08lX%08X%08X%08X",
1272                         priv->error->jiffies,
1273                         priv->error->status,
1274                         priv->error->config, priv->error->elem_len);
1275         for (i = 0; i < priv->error->elem_len; i++)
1276                 len += snprintf(buf + len, PAGE_SIZE - len,
1277                                 "\n%08X%08X%08X%08X%08X%08X%08X",
1278                                 priv->error->elem[i].time,
1279                                 priv->error->elem[i].desc,
1280                                 priv->error->elem[i].blink1,
1281                                 priv->error->elem[i].blink2,
1282                                 priv->error->elem[i].link1,
1283                                 priv->error->elem[i].link2,
1284                                 priv->error->elem[i].data);
1285
1286         len += snprintf(buf + len, PAGE_SIZE - len,
1287                         "\n%08X", priv->error->log_len);
1288         for (i = 0; i < priv->error->log_len; i++)
1289                 len += snprintf(buf + len, PAGE_SIZE - len,
1290                                 "\n%08X%08X%08X",
1291                                 priv->error->log[i].time,
1292                                 priv->error->log[i].event,
1293                                 priv->error->log[i].data);
1294         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1295         return len;
1296 }
1297
1298 static ssize_t clear_error(struct device *d,
1299                            struct device_attribute *attr,
1300                            const char *buf, size_t count)
1301 {
1302         struct ipw_priv *priv = dev_get_drvdata(d);
1303
1304         kfree(priv->error);
1305         priv->error = NULL;
1306         return count;
1307 }
1308
1309 static DEVICE_ATTR(error, S_IRUGO | S_IWUSR, show_error, clear_error);
1310
1311 static ssize_t show_cmd_log(struct device *d,
1312                             struct device_attribute *attr, char *buf)
1313 {
1314         struct ipw_priv *priv = dev_get_drvdata(d);
1315         u32 len = 0, i;
1316         if (!priv->cmdlog)
1317                 return 0;
1318         for (i = (priv->cmdlog_pos + 1) % priv->cmdlog_len;
1319              (i != priv->cmdlog_pos) && (PAGE_SIZE - len);
1320              i = (i + 1) % priv->cmdlog_len) {
1321                 len +=
1322                     snprintf(buf + len, PAGE_SIZE - len,
1323                              "\n%08lX%08X%08X%08X\n", priv->cmdlog[i].jiffies,
1324                              priv->cmdlog[i].retcode, priv->cmdlog[i].cmd.cmd,
1325                              priv->cmdlog[i].cmd.len);
1326                 len +=
1327                     snprintk_buf(buf + len, PAGE_SIZE - len,
1328                                  (u8 *) priv->cmdlog[i].cmd.param,
1329                                  priv->cmdlog[i].cmd.len);
1330                 len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1331         }
1332         len += snprintf(buf + len, PAGE_SIZE - len, "\n");
1333         return len;
1334 }
1335
1336 static DEVICE_ATTR(cmd_log, S_IRUGO, show_cmd_log, NULL);
1337
1338 #ifdef CONFIG_IPW2200_PROMISCUOUS
1339 static void ipw_prom_free(struct ipw_priv *priv);
1340 static int ipw_prom_alloc(struct ipw_priv *priv);
1341 static ssize_t store_rtap_iface(struct device *d,
1342                          struct device_attribute *attr,
1343                          const char *buf, size_t count)
1344 {
1345         struct ipw_priv *priv = dev_get_drvdata(d);
1346         int rc = 0;
1347
1348         if (count < 1)
1349                 return -EINVAL;
1350
1351         switch (buf[0]) {
1352         case '0':
1353                 if (!rtap_iface)
1354                         return count;
1355
1356                 if (netif_running(priv->prom_net_dev)) {
1357                         IPW_WARNING("Interface is up.  Cannot unregister.\n");
1358                         return count;
1359                 }
1360
1361                 ipw_prom_free(priv);
1362                 rtap_iface = 0;
1363                 break;
1364
1365         case '1':
1366                 if (rtap_iface)
1367                         return count;
1368
1369                 rc = ipw_prom_alloc(priv);
1370                 if (!rc)
1371                         rtap_iface = 1;
1372                 break;
1373
1374         default:
1375                 return -EINVAL;
1376         }
1377
1378         if (rc) {
1379                 IPW_ERROR("Failed to register promiscuous network "
1380                           "device (error %d).\n", rc);
1381         }
1382
1383         return count;
1384 }
1385
1386 static ssize_t show_rtap_iface(struct device *d,
1387                         struct device_attribute *attr,
1388                         char *buf)
1389 {
1390         struct ipw_priv *priv = dev_get_drvdata(d);
1391         if (rtap_iface)
1392                 return sprintf(buf, "%s", priv->prom_net_dev->name);
1393         else {
1394                 buf[0] = '-';
1395                 buf[1] = '1';
1396                 buf[2] = '\0';
1397                 return 3;
1398         }
1399 }
1400
1401 static DEVICE_ATTR(rtap_iface, S_IWUSR | S_IRUSR, show_rtap_iface,
1402                    store_rtap_iface);
1403
1404 static ssize_t store_rtap_filter(struct device *d,
1405                          struct device_attribute *attr,
1406                          const char *buf, size_t count)
1407 {
1408         struct ipw_priv *priv = dev_get_drvdata(d);
1409
1410         if (!priv->prom_priv) {
1411                 IPW_ERROR("Attempting to set filter without "
1412                           "rtap_iface enabled.\n");
1413                 return -EPERM;
1414         }
1415
1416         priv->prom_priv->filter = simple_strtol(buf, NULL, 0);
1417
1418         IPW_DEBUG_INFO("Setting rtap filter to " BIT_FMT16 "\n",
1419                        BIT_ARG16(priv->prom_priv->filter));
1420
1421         return count;
1422 }
1423
1424 static ssize_t show_rtap_filter(struct device *d,
1425                         struct device_attribute *attr,
1426                         char *buf)
1427 {
1428         struct ipw_priv *priv = dev_get_drvdata(d);
1429         return sprintf(buf, "0x%04X",
1430                        priv->prom_priv ? priv->prom_priv->filter : 0);
1431 }
1432
1433 static DEVICE_ATTR(rtap_filter, S_IWUSR | S_IRUSR, show_rtap_filter,
1434                    store_rtap_filter);
1435 #endif
1436
1437 static ssize_t show_scan_age(struct device *d, struct device_attribute *attr,
1438                              char *buf)
1439 {
1440         struct ipw_priv *priv = dev_get_drvdata(d);
1441         return sprintf(buf, "%d\n", priv->ieee->scan_age);
1442 }
1443
1444 static ssize_t store_scan_age(struct device *d, struct device_attribute *attr,
1445                               const char *buf, size_t count)
1446 {
1447         struct ipw_priv *priv = dev_get_drvdata(d);
1448         struct net_device *dev = priv->net_dev;
1449         char buffer[] = "00000000";
1450         unsigned long len =
1451             (sizeof(buffer) - 1) > count ? count : sizeof(buffer) - 1;
1452         unsigned long val;
1453         char *p = buffer;
1454
1455         IPW_DEBUG_INFO("enter\n");
1456
1457         strncpy(buffer, buf, len);
1458         buffer[len] = 0;
1459
1460         if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
1461                 p++;
1462                 if (p[0] == 'x' || p[0] == 'X')
1463                         p++;
1464                 val = simple_strtoul(p, &p, 16);
1465         } else
1466                 val = simple_strtoul(p, &p, 10);
1467         if (p == buffer) {
1468                 IPW_DEBUG_INFO("%s: user supplied invalid value.\n", dev->name);
1469         } else {
1470                 priv->ieee->scan_age = val;
1471                 IPW_DEBUG_INFO("set scan_age = %u\n", priv->ieee->scan_age);
1472         }
1473
1474         IPW_DEBUG_INFO("exit\n");
1475         return len;
1476 }
1477
1478 static DEVICE_ATTR(scan_age, S_IWUSR | S_IRUGO, show_scan_age, store_scan_age);
1479
1480 static ssize_t show_led(struct device *d, struct device_attribute *attr,
1481                         char *buf)
1482 {
1483         struct ipw_priv *priv = dev_get_drvdata(d);
1484         return sprintf(buf, "%d\n", (priv->config & CFG_NO_LED) ? 0 : 1);
1485 }
1486
1487 static ssize_t store_led(struct device *d, struct device_attribute *attr,
1488                          const char *buf, size_t count)
1489 {
1490         struct ipw_priv *priv = dev_get_drvdata(d);
1491
1492         IPW_DEBUG_INFO("enter\n");
1493
1494         if (count == 0)
1495                 return 0;
1496
1497         if (*buf == 0) {
1498                 IPW_DEBUG_LED("Disabling LED control.\n");
1499                 priv->config |= CFG_NO_LED;
1500                 ipw_led_shutdown(priv);
1501         } else {
1502                 IPW_DEBUG_LED("Enabling LED control.\n");
1503                 priv->config &= ~CFG_NO_LED;
1504                 ipw_led_init(priv);
1505         }
1506
1507         IPW_DEBUG_INFO("exit\n");
1508         return count;
1509 }
1510
1511 static DEVICE_ATTR(led, S_IWUSR | S_IRUGO, show_led, store_led);
1512
1513 static ssize_t show_status(struct device *d,
1514                            struct device_attribute *attr, char *buf)
1515 {
1516         struct ipw_priv *p = d->driver_data;
1517         return sprintf(buf, "0x%08x\n", (int)p->status);
1518 }
1519
1520 static DEVICE_ATTR(status, S_IRUGO, show_status, NULL);
1521
1522 static ssize_t show_cfg(struct device *d, struct device_attribute *attr,
1523                         char *buf)
1524 {
1525         struct ipw_priv *p = d->driver_data;
1526         return sprintf(buf, "0x%08x\n", (int)p->config);
1527 }
1528
1529 static DEVICE_ATTR(cfg, S_IRUGO, show_cfg, NULL);
1530
1531 static ssize_t show_nic_type(struct device *d,
1532                              struct device_attribute *attr, char *buf)
1533 {
1534         struct ipw_priv *priv = d->driver_data;
1535         return sprintf(buf, "TYPE: %d\n", priv->nic_type);
1536 }
1537
1538 static DEVICE_ATTR(nic_type, S_IRUGO, show_nic_type, NULL);
1539
1540 static ssize_t show_ucode_version(struct device *d,
1541                                   struct device_attribute *attr, char *buf)
1542 {
1543         u32 len = sizeof(u32), tmp = 0;
1544         struct ipw_priv *p = d->driver_data;
1545
1546         if (ipw_get_ordinal(p, IPW_ORD_STAT_UCODE_VERSION, &tmp, &len))
1547                 return 0;
1548
1549         return sprintf(buf, "0x%08x\n", tmp);
1550 }
1551
1552 static DEVICE_ATTR(ucode_version, S_IWUSR | S_IRUGO, show_ucode_version, NULL);
1553
1554 static ssize_t show_rtc(struct device *d, struct device_attribute *attr,
1555                         char *buf)
1556 {
1557         u32 len = sizeof(u32), tmp = 0;
1558         struct ipw_priv *p = d->driver_data;
1559
1560         if (ipw_get_ordinal(p, IPW_ORD_STAT_RTC, &tmp, &len))
1561                 return 0;
1562
1563         return sprintf(buf, "0x%08x\n", tmp);
1564 }
1565
1566 static DEVICE_ATTR(rtc, S_IWUSR | S_IRUGO, show_rtc, NULL);
1567
1568 /*
1569  * Add a device attribute to view/control the delay between eeprom
1570  * operations.
1571  */
1572 static ssize_t show_eeprom_delay(struct device *d,
1573                                  struct device_attribute *attr, char *buf)
1574 {
1575         int n = ((struct ipw_priv *)d->driver_data)->eeprom_delay;
1576         return sprintf(buf, "%i\n", n);
1577 }
1578 static ssize_t store_eeprom_delay(struct device *d,
1579                                   struct device_attribute *attr,
1580                                   const char *buf, size_t count)
1581 {
1582         struct ipw_priv *p = d->driver_data;
1583         sscanf(buf, "%i", &p->eeprom_delay);
1584         return strnlen(buf, count);
1585 }
1586
1587 static DEVICE_ATTR(eeprom_delay, S_IWUSR | S_IRUGO,
1588                    show_eeprom_delay, store_eeprom_delay);
1589
1590 static ssize_t show_command_event_reg(struct device *d,
1591                                       struct device_attribute *attr, char *buf)
1592 {
1593         u32 reg = 0;
1594         struct ipw_priv *p = d->driver_data;
1595
1596         reg = ipw_read_reg32(p, IPW_INTERNAL_CMD_EVENT);
1597         return sprintf(buf, "0x%08x\n", reg);
1598 }
1599 static ssize_t store_command_event_reg(struct device *d,
1600                                        struct device_attribute *attr,
1601                                        const char *buf, size_t count)
1602 {
1603         u32 reg;
1604         struct ipw_priv *p = d->driver_data;
1605
1606         sscanf(buf, "%x", &reg);
1607         ipw_write_reg32(p, IPW_INTERNAL_CMD_EVENT, reg);
1608         return strnlen(buf, count);
1609 }
1610
1611 static DEVICE_ATTR(command_event_reg, S_IWUSR | S_IRUGO,
1612                    show_command_event_reg, store_command_event_reg);
1613
1614 static ssize_t show_mem_gpio_reg(struct device *d,
1615                                  struct device_attribute *attr, char *buf)
1616 {
1617         u32 reg = 0;
1618         struct ipw_priv *p = d->driver_data;
1619
1620         reg = ipw_read_reg32(p, 0x301100);
1621         return sprintf(buf, "0x%08x\n", reg);
1622 }
1623 static ssize_t store_mem_gpio_reg(struct device *d,
1624                                   struct device_attribute *attr,
1625                                   const char *buf, size_t count)
1626 {
1627         u32 reg;
1628         struct ipw_priv *p = d->driver_data;
1629
1630         sscanf(buf, "%x", &reg);
1631         ipw_write_reg32(p, 0x301100, reg);
1632         return strnlen(buf, count);
1633 }
1634
1635 static DEVICE_ATTR(mem_gpio_reg, S_IWUSR | S_IRUGO,
1636                    show_mem_gpio_reg, store_mem_gpio_reg);
1637
1638 static ssize_t show_indirect_dword(struct device *d,
1639                                    struct device_attribute *attr, char *buf)
1640 {
1641         u32 reg = 0;
1642         struct ipw_priv *priv = d->driver_data;
1643
1644         if (priv->status & STATUS_INDIRECT_DWORD)
1645                 reg = ipw_read_reg32(priv, priv->indirect_dword);
1646         else
1647                 reg = 0;
1648
1649         return sprintf(buf, "0x%08x\n", reg);
1650 }
1651 static ssize_t store_indirect_dword(struct device *d,
1652                                     struct device_attribute *attr,
1653                                     const char *buf, size_t count)
1654 {
1655         struct ipw_priv *priv = d->driver_data;
1656
1657         sscanf(buf, "%x", &priv->indirect_dword);
1658         priv->status |= STATUS_INDIRECT_DWORD;
1659         return strnlen(buf, count);
1660 }
1661
1662 static DEVICE_ATTR(indirect_dword, S_IWUSR | S_IRUGO,
1663                    show_indirect_dword, store_indirect_dword);
1664
1665 static ssize_t show_indirect_byte(struct device *d,
1666                                   struct device_attribute *attr, char *buf)
1667 {
1668         u8 reg = 0;
1669         struct ipw_priv *priv = d->driver_data;
1670
1671         if (priv->status & STATUS_INDIRECT_BYTE)
1672                 reg = ipw_read_reg8(priv, priv->indirect_byte);
1673         else
1674                 reg = 0;
1675
1676         return sprintf(buf, "0x%02x\n", reg);
1677 }
1678 static ssize_t store_indirect_byte(struct device *d,
1679                                    struct device_attribute *attr,
1680                                    const char *buf, size_t count)
1681 {
1682         struct ipw_priv *priv = d->driver_data;
1683
1684         sscanf(buf, "%x", &priv->indirect_byte);
1685         priv->status |= STATUS_INDIRECT_BYTE;
1686         return strnlen(buf, count);
1687 }
1688
1689 static DEVICE_ATTR(indirect_byte, S_IWUSR | S_IRUGO,
1690                    show_indirect_byte, store_indirect_byte);
1691
1692 static ssize_t show_direct_dword(struct device *d,
1693                                  struct device_attribute *attr, char *buf)
1694 {
1695         u32 reg = 0;
1696         struct ipw_priv *priv = d->driver_data;
1697
1698         if (priv->status & STATUS_DIRECT_DWORD)
1699                 reg = ipw_read32(priv, priv->direct_dword);
1700         else
1701                 reg = 0;
1702
1703         return sprintf(buf, "0x%08x\n", reg);
1704 }
1705 static ssize_t store_direct_dword(struct device *d,
1706                                   struct device_attribute *attr,
1707                                   const char *buf, size_t count)
1708 {
1709         struct ipw_priv *priv = d->driver_data;
1710
1711         sscanf(buf, "%x", &priv->direct_dword);
1712         priv->status |= STATUS_DIRECT_DWORD;
1713         return strnlen(buf, count);
1714 }
1715
1716 static DEVICE_ATTR(direct_dword, S_IWUSR | S_IRUGO,
1717                    show_direct_dword, store_direct_dword);
1718
1719 static int rf_kill_active(struct ipw_priv *priv)
1720 {
1721         if (0 == (ipw_read32(priv, 0x30) & 0x10000))
1722                 priv->status |= STATUS_RF_KILL_HW;
1723         else
1724                 priv->status &= ~STATUS_RF_KILL_HW;
1725
1726         return (priv->status & STATUS_RF_KILL_HW) ? 1 : 0;
1727 }
1728
1729 static ssize_t show_rf_kill(struct device *d, struct device_attribute *attr,
1730                             char *buf)
1731 {
1732         /* 0 - RF kill not enabled
1733            1 - SW based RF kill active (sysfs)
1734            2 - HW based RF kill active
1735            3 - Both HW and SW baed RF kill active */
1736         struct ipw_priv *priv = d->driver_data;
1737         int val = ((priv->status & STATUS_RF_KILL_SW) ? 0x1 : 0x0) |
1738             (rf_kill_active(priv) ? 0x2 : 0x0);
1739         return sprintf(buf, "%i\n", val);
1740 }
1741
1742 static int ipw_radio_kill_sw(struct ipw_priv *priv, int disable_radio)
1743 {
1744         if ((disable_radio ? 1 : 0) ==
1745             ((priv->status & STATUS_RF_KILL_SW) ? 1 : 0))
1746                 return 0;
1747
1748         IPW_DEBUG_RF_KILL("Manual SW RF Kill set to: RADIO  %s\n",
1749                           disable_radio ? "OFF" : "ON");
1750
1751         if (disable_radio) {
1752                 priv->status |= STATUS_RF_KILL_SW;
1753
1754                 if (priv->workqueue) {
1755                         cancel_delayed_work(&priv->request_scan);
1756                         cancel_delayed_work(&priv->scan_event);
1757                 }
1758                 queue_work(priv->workqueue, &priv->down);
1759         } else {
1760                 priv->status &= ~STATUS_RF_KILL_SW;
1761                 if (rf_kill_active(priv)) {
1762                         IPW_DEBUG_RF_KILL("Can not turn radio back on - "
1763                                           "disabled by HW switch\n");
1764                         /* Make sure the RF_KILL check timer is running */
1765                         cancel_delayed_work(&priv->rf_kill);
1766                         queue_delayed_work(priv->workqueue, &priv->rf_kill,
1767                                            round_jiffies_relative(2 * HZ));
1768                 } else
1769                         queue_work(priv->workqueue, &priv->up);
1770         }
1771
1772         return 1;
1773 }
1774
1775 static ssize_t store_rf_kill(struct device *d, struct device_attribute *attr,
1776                              const char *buf, size_t count)
1777 {
1778         struct ipw_priv *priv = d->driver_data;
1779
1780         ipw_radio_kill_sw(priv, buf[0] == '1');
1781
1782         return count;
1783 }
1784
1785 static DEVICE_ATTR(rf_kill, S_IWUSR | S_IRUGO, show_rf_kill, store_rf_kill);
1786
1787 static ssize_t show_speed_scan(struct device *d, struct device_attribute *attr,
1788                                char *buf)
1789 {
1790         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1791         int pos = 0, len = 0;
1792         if (priv->config & CFG_SPEED_SCAN) {
1793                 while (priv->speed_scan[pos] != 0)
1794                         len += sprintf(&buf[len], "%d ",
1795                                        priv->speed_scan[pos++]);
1796                 return len + sprintf(&buf[len], "\n");
1797         }
1798
1799         return sprintf(buf, "0\n");
1800 }
1801
1802 static ssize_t store_speed_scan(struct device *d, struct device_attribute *attr,
1803                                 const char *buf, size_t count)
1804 {
1805         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1806         int channel, pos = 0;
1807         const char *p = buf;
1808
1809         /* list of space separated channels to scan, optionally ending with 0 */
1810         while ((channel = simple_strtol(p, NULL, 0))) {
1811                 if (pos == MAX_SPEED_SCAN - 1) {
1812                         priv->speed_scan[pos] = 0;
1813                         break;
1814                 }
1815
1816                 if (ieee80211_is_valid_channel(priv->ieee, channel))
1817                         priv->speed_scan[pos++] = channel;
1818                 else
1819                         IPW_WARNING("Skipping invalid channel request: %d\n",
1820                                     channel);
1821                 p = strchr(p, ' ');
1822                 if (!p)
1823                         break;
1824                 while (*p == ' ' || *p == '\t')
1825                         p++;
1826         }
1827
1828         if (pos == 0)
1829                 priv->config &= ~CFG_SPEED_SCAN;
1830         else {
1831                 priv->speed_scan_pos = 0;
1832                 priv->config |= CFG_SPEED_SCAN;
1833         }
1834
1835         return count;
1836 }
1837
1838 static DEVICE_ATTR(speed_scan, S_IWUSR | S_IRUGO, show_speed_scan,
1839                    store_speed_scan);
1840
1841 static ssize_t show_net_stats(struct device *d, struct device_attribute *attr,
1842                               char *buf)
1843 {
1844         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1845         return sprintf(buf, "%c\n", (priv->config & CFG_NET_STATS) ? '1' : '0');
1846 }
1847
1848 static ssize_t store_net_stats(struct device *d, struct device_attribute *attr,
1849                                const char *buf, size_t count)
1850 {
1851         struct ipw_priv *priv = (struct ipw_priv *)d->driver_data;
1852         if (buf[0] == '1')
1853                 priv->config |= CFG_NET_STATS;
1854         else
1855                 priv->config &= ~CFG_NET_STATS;
1856
1857         return count;
1858 }
1859
1860 static DEVICE_ATTR(net_stats, S_IWUSR | S_IRUGO,
1861                    show_net_stats, store_net_stats);
1862
1863 static ssize_t show_channels(struct device *d,
1864                              struct device_attribute *attr,
1865                              char *buf)
1866 {
1867         struct ipw_priv *priv = dev_get_drvdata(d);
1868         const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
1869         int len = 0, i;
1870
1871         len = sprintf(&buf[len],
1872                       "Displaying %d channels in 2.4Ghz band "
1873                       "(802.11bg):\n", geo->bg_channels);
1874
1875         for (i = 0; i < geo->bg_channels; i++) {
1876                 len += sprintf(&buf[len], "%d: BSS%s%s, %s, Band %s.\n",
1877                                geo->bg[i].channel,
1878                                geo->bg[i].flags & IEEE80211_CH_RADAR_DETECT ?
1879                                " (radar spectrum)" : "",
1880                                ((geo->bg[i].flags & IEEE80211_CH_NO_IBSS) ||
1881                                 (geo->bg[i].flags & IEEE80211_CH_RADAR_DETECT))
1882                                ? "" : ", IBSS",
1883                                geo->bg[i].flags & IEEE80211_CH_PASSIVE_ONLY ?
1884                                "passive only" : "active/passive",
1885                                geo->bg[i].flags & IEEE80211_CH_B_ONLY ?
1886                                "B" : "B/G");
1887         }
1888
1889         len += sprintf(&buf[len],
1890                        "Displaying %d channels in 5.2Ghz band "
1891                        "(802.11a):\n", geo->a_channels);
1892         for (i = 0; i < geo->a_channels; i++) {
1893                 len += sprintf(&buf[len], "%d: BSS%s%s, %s.\n",
1894                                geo->a[i].channel,
1895                                geo->a[i].flags & IEEE80211_CH_RADAR_DETECT ?
1896                                " (radar spectrum)" : "",
1897                                ((geo->a[i].flags & IEEE80211_CH_NO_IBSS) ||
1898                                 (geo->a[i].flags & IEEE80211_CH_RADAR_DETECT))
1899                                ? "" : ", IBSS",
1900                                geo->a[i].flags & IEEE80211_CH_PASSIVE_ONLY ?
1901                                "passive only" : "active/passive");
1902         }
1903
1904         return len;
1905 }
1906
1907 static DEVICE_ATTR(channels, S_IRUSR, show_channels, NULL);
1908
1909 static void notify_wx_assoc_event(struct ipw_priv *priv)
1910 {
1911         union iwreq_data wrqu;
1912         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1913         if (priv->status & STATUS_ASSOCIATED)
1914                 memcpy(wrqu.ap_addr.sa_data, priv->bssid, ETH_ALEN);
1915         else
1916                 memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
1917         wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
1918 }
1919
1920 static void ipw_irq_tasklet(struct ipw_priv *priv)
1921 {
1922         u32 inta, inta_mask, handled = 0;
1923         unsigned long flags;
1924         int rc = 0;
1925
1926         spin_lock_irqsave(&priv->irq_lock, flags);
1927
1928         inta = ipw_read32(priv, IPW_INTA_RW);
1929         inta_mask = ipw_read32(priv, IPW_INTA_MASK_R);
1930         inta &= (IPW_INTA_MASK_ALL & inta_mask);
1931
1932         /* Add any cached INTA values that need to be handled */
1933         inta |= priv->isr_inta;
1934
1935         spin_unlock_irqrestore(&priv->irq_lock, flags);
1936
1937         spin_lock_irqsave(&priv->lock, flags);
1938
1939         /* handle all the justifications for the interrupt */
1940         if (inta & IPW_INTA_BIT_RX_TRANSFER) {
1941                 ipw_rx(priv);
1942                 handled |= IPW_INTA_BIT_RX_TRANSFER;
1943         }
1944
1945         if (inta & IPW_INTA_BIT_TX_CMD_QUEUE) {
1946                 IPW_DEBUG_HC("Command completed.\n");
1947                 rc = ipw_queue_tx_reclaim(priv, &priv->txq_cmd, -1);
1948                 priv->status &= ~STATUS_HCMD_ACTIVE;
1949                 wake_up_interruptible(&priv->wait_command_queue);
1950                 handled |= IPW_INTA_BIT_TX_CMD_QUEUE;
1951         }
1952
1953         if (inta & IPW_INTA_BIT_TX_QUEUE_1) {
1954                 IPW_DEBUG_TX("TX_QUEUE_1\n");
1955                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[0], 0);
1956                 handled |= IPW_INTA_BIT_TX_QUEUE_1;
1957         }
1958
1959         if (inta & IPW_INTA_BIT_TX_QUEUE_2) {
1960                 IPW_DEBUG_TX("TX_QUEUE_2\n");
1961                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[1], 1);
1962                 handled |= IPW_INTA_BIT_TX_QUEUE_2;
1963         }
1964
1965         if (inta & IPW_INTA_BIT_TX_QUEUE_3) {
1966                 IPW_DEBUG_TX("TX_QUEUE_3\n");
1967                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[2], 2);
1968                 handled |= IPW_INTA_BIT_TX_QUEUE_3;
1969         }
1970
1971         if (inta & IPW_INTA_BIT_TX_QUEUE_4) {
1972                 IPW_DEBUG_TX("TX_QUEUE_4\n");
1973                 rc = ipw_queue_tx_reclaim(priv, &priv->txq[3], 3);
1974                 handled |= IPW_INTA_BIT_TX_QUEUE_4;
1975         }
1976
1977         if (inta & IPW_INTA_BIT_STATUS_CHANGE) {
1978                 IPW_WARNING("STATUS_CHANGE\n");
1979                 handled |= IPW_INTA_BIT_STATUS_CHANGE;
1980         }
1981
1982         if (inta & IPW_INTA_BIT_BEACON_PERIOD_EXPIRED) {
1983                 IPW_WARNING("TX_PERIOD_EXPIRED\n");
1984                 handled |= IPW_INTA_BIT_BEACON_PERIOD_EXPIRED;
1985         }
1986
1987         if (inta & IPW_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE) {
1988                 IPW_WARNING("HOST_CMD_DONE\n");
1989                 handled |= IPW_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE;
1990         }
1991
1992         if (inta & IPW_INTA_BIT_FW_INITIALIZATION_DONE) {
1993                 IPW_WARNING("FW_INITIALIZATION_DONE\n");
1994                 handled |= IPW_INTA_BIT_FW_INITIALIZATION_DONE;
1995         }
1996
1997         if (inta & IPW_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE) {
1998                 IPW_WARNING("PHY_OFF_DONE\n");
1999                 handled |= IPW_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE;
2000         }
2001
2002         if (inta & IPW_INTA_BIT_RF_KILL_DONE) {
2003                 IPW_DEBUG_RF_KILL("RF_KILL_DONE\n");
2004                 priv->status |= STATUS_RF_KILL_HW;
2005                 wake_up_interruptible(&priv->wait_command_queue);
2006                 priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
2007                 cancel_delayed_work(&priv->request_scan);
2008                 cancel_delayed_work(&priv->scan_event);
2009                 schedule_work(&priv->link_down);
2010                 queue_delayed_work(priv->workqueue, &priv->rf_kill, 2 * HZ);
2011                 handled |= IPW_INTA_BIT_RF_KILL_DONE;
2012         }
2013
2014         if (inta & IPW_INTA_BIT_FATAL_ERROR) {
2015                 IPW_WARNING("Firmware error detected.  Restarting.\n");
2016                 if (priv->error) {
2017                         IPW_DEBUG_FW("Sysfs 'error' log already exists.\n");
2018                         if (ipw_debug_level & IPW_DL_FW_ERRORS) {
2019                                 struct ipw_fw_error *error =
2020                                     ipw_alloc_error_log(priv);
2021                                 ipw_dump_error_log(priv, error);
2022                                 kfree(error);
2023                         }
2024                 } else {
2025                         priv->error = ipw_alloc_error_log(priv);
2026                         if (priv->error)
2027                                 IPW_DEBUG_FW("Sysfs 'error' log captured.\n");
2028                         else
2029                                 IPW_DEBUG_FW("Error allocating sysfs 'error' "
2030                                              "log.\n");
2031                         if (ipw_debug_level & IPW_DL_FW_ERRORS)
2032                                 ipw_dump_error_log(priv, priv->error);
2033                 }
2034
2035                 /* XXX: If hardware encryption is for WPA/WPA2,
2036                  * we have to notify the supplicant. */
2037                 if (priv->ieee->sec.encrypt) {
2038                         priv->status &= ~STATUS_ASSOCIATED;
2039                         notify_wx_assoc_event(priv);
2040                 }
2041
2042                 /* Keep the restart process from trying to send host
2043                  * commands by clearing the INIT status bit */
2044                 priv->status &= ~STATUS_INIT;
2045
2046                 /* Cancel currently queued command. */
2047                 priv->status &= ~STATUS_HCMD_ACTIVE;
2048                 wake_up_interruptible(&priv->wait_command_queue);
2049
2050                 queue_work(priv->workqueue, &priv->adapter_restart);
2051                 handled |= IPW_INTA_BIT_FATAL_ERROR;
2052         }
2053
2054         if (inta & IPW_INTA_BIT_PARITY_ERROR) {
2055                 IPW_ERROR("Parity error\n");
2056                 handled |= IPW_INTA_BIT_PARITY_ERROR;
2057         }
2058
2059         if (handled != inta) {
2060                 IPW_ERROR("Unhandled INTA bits 0x%08x\n", inta & ~handled);
2061         }
2062
2063         spin_unlock_irqrestore(&priv->lock, flags);
2064
2065         /* enable all interrupts */
2066         ipw_enable_interrupts(priv);
2067 }
2068
2069 #define IPW_CMD(x) case IPW_CMD_ ## x : return #x
2070 static char *get_cmd_string(u8 cmd)
2071 {
2072         switch (cmd) {
2073                 IPW_CMD(HOST_COMPLETE);
2074                 IPW_CMD(POWER_DOWN);
2075                 IPW_CMD(SYSTEM_CONFIG);
2076                 IPW_CMD(MULTICAST_ADDRESS);
2077                 IPW_CMD(SSID);
2078                 IPW_CMD(ADAPTER_ADDRESS);
2079                 IPW_CMD(PORT_TYPE);
2080                 IPW_CMD(RTS_THRESHOLD);
2081                 IPW_CMD(FRAG_THRESHOLD);
2082                 IPW_CMD(POWER_MODE);
2083                 IPW_CMD(WEP_KEY);
2084                 IPW_CMD(TGI_TX_KEY);
2085                 IPW_CMD(SCAN_REQUEST);
2086                 IPW_CMD(SCAN_REQUEST_EXT);
2087                 IPW_CMD(ASSOCIATE);
2088                 IPW_CMD(SUPPORTED_RATES);
2089                 IPW_CMD(SCAN_ABORT);
2090                 IPW_CMD(TX_FLUSH);
2091                 IPW_CMD(QOS_PARAMETERS);
2092                 IPW_CMD(DINO_CONFIG);
2093                 IPW_CMD(RSN_CAPABILITIES);
2094                 IPW_CMD(RX_KEY);
2095                 IPW_CMD(CARD_DISABLE);
2096                 IPW_CMD(SEED_NUMBER);
2097                 IPW_CMD(TX_POWER);
2098                 IPW_CMD(COUNTRY_INFO);
2099                 IPW_CMD(AIRONET_INFO);
2100                 IPW_CMD(AP_TX_POWER);
2101                 IPW_CMD(CCKM_INFO);
2102                 IPW_CMD(CCX_VER_INFO);
2103                 IPW_CMD(SET_CALIBRATION);
2104                 IPW_CMD(SENSITIVITY_CALIB);
2105                 IPW_CMD(RETRY_LIMIT);
2106                 IPW_CMD(IPW_PRE_POWER_DOWN);
2107                 IPW_CMD(VAP_BEACON_TEMPLATE);
2108                 IPW_CMD(VAP_DTIM_PERIOD);
2109                 IPW_CMD(EXT_SUPPORTED_RATES);
2110                 IPW_CMD(VAP_LOCAL_TX_PWR_CONSTRAINT);
2111                 IPW_CMD(VAP_QUIET_INTERVALS);
2112                 IPW_CMD(VAP_CHANNEL_SWITCH);
2113                 IPW_CMD(VAP_MANDATORY_CHANNELS);
2114                 IPW_CMD(VAP_CELL_PWR_LIMIT);
2115                 IPW_CMD(VAP_CF_PARAM_SET);
2116                 IPW_CMD(VAP_SET_BEACONING_STATE);
2117                 IPW_CMD(MEASUREMENT);
2118                 IPW_CMD(POWER_CAPABILITY);
2119                 IPW_CMD(SUPPORTED_CHANNELS);
2120                 IPW_CMD(TPC_REPORT);
2121                 IPW_CMD(WME_INFO);
2122                 IPW_CMD(PRODUCTION_COMMAND);
2123         default:
2124                 return "UNKNOWN";
2125         }
2126 }
2127
2128 #define HOST_COMPLETE_TIMEOUT HZ
2129
2130 static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
2131 {
2132         int rc = 0;
2133         unsigned long flags;
2134
2135         spin_lock_irqsave(&priv->lock, flags);
2136         if (priv->status & STATUS_HCMD_ACTIVE) {
2137                 IPW_ERROR("Failed to send %s: Already sending a command.\n",
2138                           get_cmd_string(cmd->cmd));
2139                 spin_unlock_irqrestore(&priv->lock, flags);
2140                 return -EAGAIN;
2141         }
2142
2143         priv->status |= STATUS_HCMD_ACTIVE;
2144
2145         if (priv->cmdlog) {
2146                 priv->cmdlog[priv->cmdlog_pos].jiffies = jiffies;
2147                 priv->cmdlog[priv->cmdlog_pos].cmd.cmd = cmd->cmd;
2148                 priv->cmdlog[priv->cmdlog_pos].cmd.len = cmd->len;
2149                 memcpy(priv->cmdlog[priv->cmdlog_pos].cmd.param, cmd->param,
2150                        cmd->len);
2151                 priv->cmdlog[priv->cmdlog_pos].retcode = -1;
2152         }
2153
2154         IPW_DEBUG_HC("%s command (#%d) %d bytes: 0x%08X\n",
2155                      get_cmd_string(cmd->cmd), cmd->cmd, cmd->len,
2156                      priv->status);
2157
2158 #ifndef DEBUG_CMD_WEP_KEY
2159         if (cmd->cmd == IPW_CMD_WEP_KEY)
2160                 IPW_DEBUG_HC("WEP_KEY command masked out for secure.\n");
2161         else
2162 #endif
2163                 printk_buf(IPW_DL_HOST_COMMAND, (u8 *) cmd->param, cmd->len);
2164
2165         rc = ipw_queue_tx_hcmd(priv, cmd->cmd, cmd->param, cmd->len, 0);
2166         if (rc) {
2167                 priv->status &= ~STATUS_HCMD_ACTIVE;
2168                 IPW_ERROR("Failed to send %s: Reason %d\n",
2169                           get_cmd_string(cmd->cmd), rc);
2170                 spin_unlock_irqrestore(&priv->lock, flags);
2171                 goto exit;
2172         }
2173         spin_unlock_irqrestore(&priv->lock, flags);
2174
2175         rc = wait_event_interruptible_timeout(priv->wait_command_queue,
2176                                               !(priv->
2177                                                 status & STATUS_HCMD_ACTIVE),
2178                                               HOST_COMPLETE_TIMEOUT);
2179         if (rc == 0) {
2180                 spin_lock_irqsave(&priv->lock, flags);
2181                 if (priv->status & STATUS_HCMD_ACTIVE) {
2182                         IPW_ERROR("Failed to send %s: Command timed out.\n",
2183                                   get_cmd_string(cmd->cmd));
2184                         priv->status &= ~STATUS_HCMD_ACTIVE;
2185                         spin_unlock_irqrestore(&priv->lock, flags);
2186                         rc = -EIO;
2187                         goto exit;
2188                 }
2189                 spin_unlock_irqrestore(&priv->lock, flags);
2190         } else
2191                 rc = 0;
2192
2193         if (priv->status & STATUS_RF_KILL_HW) {
2194                 IPW_ERROR("Failed to send %s: Aborted due to RF kill switch.\n",
2195                           get_cmd_string(cmd->cmd));
2196                 rc = -EIO;
2197                 goto exit;
2198         }
2199
2200       exit:
2201         if (priv->cmdlog) {
2202                 priv->cmdlog[priv->cmdlog_pos++].retcode = rc;
2203                 priv->cmdlog_pos %= priv->cmdlog_len;
2204         }
2205         return rc;
2206 }
2207
2208 static int ipw_send_cmd_simple(struct ipw_priv *priv, u8 command)
2209 {
2210         struct host_cmd cmd = {
2211                 .cmd = command,
2212         };
2213
2214         return __ipw_send_cmd(priv, &cmd);
2215 }
2216
2217 static int ipw_send_cmd_pdu(struct ipw_priv *priv, u8 command, u8 len,
2218                             void *data)
2219 {
2220         struct host_cmd cmd = {
2221                 .cmd = command,
2222                 .len = len,
2223                 .param = data,
2224         };
2225
2226         return __ipw_send_cmd(priv, &cmd);
2227 }
2228
2229 static int ipw_send_host_complete(struct ipw_priv *priv)
2230 {
2231         if (!priv) {
2232                 IPW_ERROR("Invalid args\n");
2233                 return -1;
2234         }
2235
2236         return ipw_send_cmd_simple(priv, IPW_CMD_HOST_COMPLETE);
2237 }
2238
2239 static int ipw_send_system_config(struct ipw_priv *priv)
2240 {
2241         return ipw_send_cmd_pdu(priv, IPW_CMD_SYSTEM_CONFIG,
2242                                 sizeof(priv->sys_config),
2243                                 &priv->sys_config);
2244 }
2245
2246 static int ipw_send_ssid(struct ipw_priv *priv, u8 * ssid, int len)
2247 {
2248         if (!priv || !ssid) {
2249                 IPW_ERROR("Invalid args\n");
2250                 return -1;
2251         }
2252
2253         return ipw_send_cmd_pdu(priv, IPW_CMD_SSID, min(len, IW_ESSID_MAX_SIZE),
2254                                 ssid);
2255 }
2256
2257 static int ipw_send_adapter_address(struct ipw_priv *priv, u8 * mac)
2258 {
2259         if (!priv || !mac) {
2260                 IPW_ERROR("Invalid args\n");
2261                 return -1;
2262         }
2263
2264         IPW_DEBUG_INFO("%s: Setting MAC to %s\n",
2265                        priv->net_dev->name, print_mac(mac, mac));
2266
2267         return ipw_send_cmd_pdu(priv, IPW_CMD_ADAPTER_ADDRESS, ETH_ALEN, mac);
2268 }
2269
2270 /*
2271  * NOTE: This must be executed from our workqueue as it results in udelay
2272  * being called which may corrupt the keyboard if executed on default
2273  * workqueue
2274  */
2275 static void ipw_adapter_restart(void *adapter)
2276 {
2277         struct ipw_priv *priv = adapter;
2278
2279         if (priv->status & STATUS_RF_KILL_MASK)
2280                 return;
2281
2282         ipw_down(priv);
2283
2284         if (priv->assoc_network &&
2285             (priv->assoc_network->capability & WLAN_CAPABILITY_IBSS))
2286                 ipw_remove_current_network(priv);
2287
2288         if (ipw_up(priv)) {
2289                 IPW_ERROR("Failed to up device\n");
2290                 return;
2291         }
2292 }
2293
2294 static void ipw_bg_adapter_restart(struct work_struct *work)
2295 {
2296         struct ipw_priv *priv =
2297                 container_of(work, struct ipw_priv, adapter_restart);
2298         mutex_lock(&priv->mutex);
2299         ipw_adapter_restart(priv);
2300         mutex_unlock(&priv->mutex);
2301 }
2302
2303 #define IPW_SCAN_CHECK_WATCHDOG (5 * HZ)
2304
2305 static void ipw_scan_check(void *data)
2306 {
2307         struct ipw_priv *priv = data;
2308         if (priv->status & (STATUS_SCANNING | STATUS_SCAN_ABORTING)) {
2309                 IPW_DEBUG_SCAN("Scan completion watchdog resetting "
2310                                "adapter after (%dms).\n",
2311                                jiffies_to_msecs(IPW_SCAN_CHECK_WATCHDOG));
2312                 queue_work(priv->workqueue, &priv->adapter_restart);
2313         }
2314 }
2315
2316 static void ipw_bg_scan_check(struct work_struct *work)
2317 {
2318         struct ipw_priv *priv =
2319                 container_of(work, struct ipw_priv, scan_check.work);
2320         mutex_lock(&priv->mutex);
2321         ipw_scan_check(priv);
2322         mutex_unlock(&priv->mutex);
2323 }
2324
2325 static int ipw_send_scan_request_ext(struct ipw_priv *priv,
2326                                      struct ipw_scan_request_ext *request)
2327 {
2328         return ipw_send_cmd_pdu(priv, IPW_CMD_SCAN_REQUEST_EXT,
2329                                 sizeof(*request), request);
2330 }
2331
2332 static int ipw_send_scan_abort(struct ipw_priv *priv)
2333 {
2334         if (!priv) {
2335                 IPW_ERROR("Invalid args\n");
2336                 return -1;
2337         }
2338
2339         return ipw_send_cmd_simple(priv, IPW_CMD_SCAN_ABORT);
2340 }
2341
2342 static int ipw_set_sensitivity(struct ipw_priv *priv, u16 sens)
2343 {
2344         struct ipw_sensitivity_calib calib = {
2345                 .beacon_rssi_raw = cpu_to_le16(sens),
2346         };
2347
2348         return ipw_send_cmd_pdu(priv, IPW_CMD_SENSITIVITY_CALIB, sizeof(calib),
2349                                 &calib);
2350 }
2351
2352 static int ipw_send_associate(struct ipw_priv *priv,
2353                               struct ipw_associate *associate)
2354 {
2355         if (!priv || !associate) {
2356                 IPW_ERROR("Invalid args\n");
2357                 return -1;
2358         }
2359
2360         return ipw_send_cmd_pdu(priv, IPW_CMD_ASSOCIATE, sizeof(*associate),
2361                                 associate);
2362 }
2363
2364 static int ipw_send_supported_rates(struct ipw_priv *priv,
2365                                     struct ipw_supported_rates *rates)
2366 {
2367         if (!priv || !rates) {
2368                 IPW_ERROR("Invalid args\n");
2369                 return -1;
2370         }
2371
2372         return ipw_send_cmd_pdu(priv, IPW_CMD_SUPPORTED_RATES, sizeof(*rates),
2373                                 rates);
2374 }
2375
2376 static int ipw_set_random_seed(struct ipw_priv *priv)
2377 {
2378         u32 val;
2379
2380         if (!priv) {
2381                 IPW_ERROR("Invalid args\n");
2382                 return -1;
2383         }
2384
2385         get_random_bytes(&val, sizeof(val));
2386
2387         return ipw_send_cmd_pdu(priv, IPW_CMD_SEED_NUMBER, sizeof(val), &val);
2388 }
2389
2390 static int ipw_send_card_disable(struct ipw_priv *priv, u32 phy_off)
2391 {
2392         __le32 v = cpu_to_le32(phy_off);
2393         if (!priv) {
2394                 IPW_ERROR("Invalid args\n");
2395                 return -1;
2396         }
2397
2398         return ipw_send_cmd_pdu(priv, IPW_CMD_CARD_DISABLE, sizeof(v), &v);
2399 }
2400
2401 static int ipw_send_tx_power(struct ipw_priv *priv, struct ipw_tx_power *power)
2402 {
2403         if (!priv || !power) {
2404                 IPW_ERROR("Invalid args\n");
2405                 return -1;
2406         }
2407
2408         return ipw_send_cmd_pdu(priv, IPW_CMD_TX_POWER, sizeof(*power), power);
2409 }
2410
2411 static int ipw_set_tx_power(struct ipw_priv *priv)
2412 {
2413         const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
2414         struct ipw_tx_power tx_power;
2415         s8 max_power;
2416         int i;
2417
2418         memset(&tx_power, 0, sizeof(tx_power));
2419
2420         /* configure device for 'G' band */
2421         tx_power.ieee_mode = IPW_G_MODE;
2422         tx_power.num_channels = geo->bg_channels;
2423         for (i = 0; i < geo->bg_channels; i++) {
2424                 max_power = geo->bg[i].max_power;
2425                 tx_power.channels_tx_power[i].channel_number =
2426                     geo->bg[i].channel;
2427                 tx_power.channels_tx_power[i].tx_power = max_power ?
2428                     min(max_power, priv->tx_power) : priv->tx_power;
2429         }
2430         if (ipw_send_tx_power(priv, &tx_power))
2431                 return -EIO;
2432
2433         /* configure device to also handle 'B' band */
2434         tx_power.ieee_mode = IPW_B_MODE;
2435         if (ipw_send_tx_power(priv, &tx_power))
2436                 return -EIO;
2437
2438         /* configure device to also handle 'A' band */
2439         if (priv->ieee->abg_true) {
2440                 tx_power.ieee_mode = IPW_A_MODE;
2441                 tx_power.num_channels = geo->a_channels;
2442                 for (i = 0; i < tx_power.num_channels; i++) {
2443                         max_power = geo->a[i].max_power;
2444                         tx_power.channels_tx_power[i].channel_number =
2445                             geo->a[i].channel;
2446                         tx_power.channels_tx_power[i].tx_power = max_power ?
2447                             min(max_power, priv->tx_power) : priv->tx_power;
2448                 }
2449                 if (ipw_send_tx_power(priv, &tx_power))
2450                         return -EIO;
2451         }
2452         return 0;
2453 }
2454
2455 static int ipw_send_rts_threshold(struct ipw_priv *priv, u16 rts)
2456 {
2457         struct ipw_rts_threshold rts_threshold = {
2458                 .rts_threshold = cpu_to_le16(rts),
2459         };
2460
2461         if (!priv) {
2462                 IPW_ERROR("Invalid args\n");
2463                 return -1;
2464         }
2465
2466         return ipw_send_cmd_pdu(priv, IPW_CMD_RTS_THRESHOLD,
2467                                 sizeof(rts_threshold), &rts_threshold);
2468 }
2469
2470 static int ipw_send_frag_threshold(struct ipw_priv *priv, u16 frag)
2471 {
2472         struct ipw_frag_threshold frag_threshold = {
2473                 .frag_threshold = cpu_to_le16(frag),
2474         };
2475
2476         if (!priv) {
2477                 IPW_ERROR("Invalid args\n");
2478                 return -1;
2479         }
2480
2481         return ipw_send_cmd_pdu(priv, IPW_CMD_FRAG_THRESHOLD,
2482                                 sizeof(frag_threshold), &frag_threshold);
2483 }
2484
2485 static int ipw_send_power_mode(struct ipw_priv *priv, u32 mode)
2486 {
2487         __le32 param;
2488
2489         if (!priv) {
2490                 IPW_ERROR("Invalid args\n");
2491                 return -1;
2492         }
2493
2494         /* If on battery, set to 3, if AC set to CAM, else user
2495          * level */
2496         switch (mode) {
2497         case IPW_POWER_BATTERY:
2498                 param = cpu_to_le32(IPW_POWER_INDEX_3);
2499                 break;
2500         case IPW_POWER_AC:
2501                 param = cpu_to_le32(IPW_POWER_MODE_CAM);
2502                 break;
2503         default:
2504                 param = cpu_to_le32(mode);
2505                 break;
2506         }
2507
2508         return ipw_send_cmd_pdu(priv, IPW_CMD_POWER_MODE, sizeof(param),
2509                                 &param);
2510 }
2511
2512 static int ipw_send_retry_limit(struct ipw_priv *priv, u8 slimit, u8 llimit)
2513 {
2514         struct ipw_retry_limit retry_limit = {
2515                 .short_retry_limit = slimit,
2516                 .long_retry_limit = llimit
2517         };
2518
2519         if (!priv) {
2520                 IPW_ERROR("Invalid args\n");
2521                 return -1;
2522         }
2523
2524         return ipw_send_cmd_pdu(priv, IPW_CMD_RETRY_LIMIT, sizeof(retry_limit),
2525                                 &retry_limit);
2526 }
2527
2528 /*
2529  * The IPW device contains a Microwire compatible EEPROM that stores
2530  * various data like the MAC address.  Usually the firmware has exclusive
2531  * access to the eeprom, but during device initialization (before the
2532  * device driver has sent the HostComplete command to the firmware) the
2533  * device driver has read access to the EEPROM by way of indirect addressing
2534  * through a couple of memory mapped registers.
2535  *
2536  * The following is a simplified implementation for pulling data out of the
2537  * the eeprom, along with some helper functions to find information in
2538  * the per device private data's copy of the eeprom.
2539  *
2540  * NOTE: To better understand how these functions work (i.e what is a chip
2541  *       select and why do have to keep driving the eeprom clock?), read
2542  *       just about any data sheet for a Microwire compatible EEPROM.
2543  */
2544
2545 /* write a 32 bit value into the indirect accessor register */
2546 static inline void eeprom_write_reg(struct ipw_priv *p, u32 data)
2547 {
2548         ipw_write_reg32(p, FW_MEM_REG_EEPROM_ACCESS, data);
2549
2550         /* the eeprom requires some time to complete the operation */
2551         udelay(p->eeprom_delay);
2552
2553         return;
2554 }
2555
2556 /* perform a chip select operation */
2557 static void eeprom_cs(struct ipw_priv *priv)
2558 {
2559         eeprom_write_reg(priv, 0);
2560         eeprom_write_reg(priv, EEPROM_BIT_CS);
2561         eeprom_write_reg(priv, EEPROM_BIT_CS | EEPROM_BIT_SK);
2562         eeprom_write_reg(priv, EEPROM_BIT_CS);
2563 }
2564
2565 /* perform a chip select operation */
2566 static void eeprom_disable_cs(struct ipw_priv *priv)
2567 {
2568         eeprom_write_reg(priv, EEPROM_BIT_CS);
2569         eeprom_write_reg(priv, 0);
2570         eeprom_write_reg(priv, EEPROM_BIT_SK);
2571 }
2572
2573 /* push a single bit down to the eeprom */
2574 static inline void eeprom_write_bit(struct ipw_priv *p, u8 bit)
2575 {
2576         int d = (bit ? EEPROM_BIT_DI : 0);
2577         eeprom_write_reg(p, EEPROM_BIT_CS | d);
2578         eeprom_write_reg(p, EEPROM_BIT_CS | d | EEPROM_BIT_SK);
2579 }
2580
2581 /* push an opcode followed by an address down to the eeprom */
2582 static void eeprom_op(struct ipw_priv *priv, u8 op, u8 addr)
2583 {
2584         int i;
2585
2586         eeprom_cs(priv);
2587         eeprom_write_bit(priv, 1);
2588         eeprom_write_bit(priv, op & 2);
2589         eeprom_write_bit(priv, op & 1);
2590         for (i = 7; i >= 0; i--) {
2591                 eeprom_write_bit(priv, addr & (1 << i));
2592         }
2593 }
2594
2595 /* pull 16 bits off the eeprom, one bit at a time */
2596 static u16 eeprom_read_u16(struct ipw_priv *priv, u8 addr)
2597 {
2598         int i;
2599         u16 r = 0;
2600
2601         /* Send READ Opcode */
2602         eeprom_op(priv, EEPROM_CMD_READ, addr);
2603
2604         /* Send dummy bit */
2605         eeprom_write_reg(priv, EEPROM_BIT_CS);
2606
2607         /* Read the byte off the eeprom one bit at a time */
2608         for (i = 0; i < 16; i++) {
2609                 u32 data = 0;
2610                 eeprom_write_reg(priv, EEPROM_BIT_CS | EEPROM_BIT_SK);
2611                 eeprom_write_reg(priv, EEPROM_BIT_CS);
2612                 data = ipw_read_reg32(priv, FW_MEM_REG_EEPROM_ACCESS);
2613                 r = (r << 1) | ((data & EEPROM_BIT_DO) ? 1 : 0);
2614         }
2615
2616         /* Send another dummy bit */
2617         eeprom_write_reg(priv, 0);
2618         eeprom_disable_cs(priv);
2619
2620         return r;
2621 }
2622
2623 /* helper function for pulling the mac address out of the private */
2624 /* data's copy of the eeprom data                                 */
2625 static void eeprom_parse_mac(struct ipw_priv *priv, u8 * mac)
2626 {
2627         memcpy(mac, &priv->eeprom[EEPROM_MAC_ADDRESS], 6);
2628 }
2629
2630 /*
2631  * Either the device driver (i.e. the host) or the firmware can
2632  * load eeprom data into the designated region in SRAM.  If neither
2633  * happens then the FW will shutdown with a fatal error.
2634  *
2635  * In order to signal the FW to load the EEPROM, the EEPROM_LOAD_DISABLE
2636  * bit needs region of shared SRAM needs to be non-zero.
2637  */
2638 static void ipw_eeprom_init_sram(struct ipw_priv *priv)
2639 {
2640         int i;
2641         __le16 *eeprom = (__le16 *) priv->eeprom;
2642
2643         IPW_DEBUG_TRACE(">>\n");
2644
2645         /* read entire contents of eeprom into private buffer */
2646         for (i = 0; i < 128; i++)
2647                 eeprom[i] = cpu_to_le16(eeprom_read_u16(priv, (u8) i));
2648
2649         /*
2650            If the data looks correct, then copy it to our private
2651            copy.  Otherwise let the firmware know to perform the operation
2652            on its own.
2653          */
2654         if (priv->eeprom[EEPROM_VERSION] != 0) {
2655                 IPW_DEBUG_INFO("Writing EEPROM data into SRAM\n");
2656
2657                 /* write the eeprom data to sram */
2658                 for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
2659                         ipw_write8(priv, IPW_EEPROM_DATA + i, priv->eeprom[i]);
2660
2661                 /* Do not load eeprom data on fatal error or suspend */
2662                 ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
2663         } else {
2664                 IPW_DEBUG_INFO("Enabling FW initializationg of SRAM\n");
2665
2666                 /* Load eeprom data on fatal error or suspend */
2667                 ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 1);
2668         }
2669
2670         IPW_DEBUG_TRACE("<<\n");
2671 }
2672
2673 static void ipw_zero_memory(struct ipw_priv *priv, u32 start, u32 count)
2674 {
2675         count >>= 2;
2676         if (!count)
2677                 return;
2678         _ipw_write32(priv, IPW_AUTOINC_ADDR, start);
2679         while (count--)
2680                 _ipw_write32(priv, IPW_AUTOINC_DATA, 0);
2681 }
2682
2683 static inline void ipw_fw_dma_reset_command_blocks(struct ipw_priv *priv)
2684 {
2685         ipw_zero_memory(priv, IPW_SHARED_SRAM_DMA_CONTROL,
2686                         CB_NUMBER_OF_ELEMENTS_SMALL *
2687                         sizeof(struct command_block));
2688 }
2689
2690 static int ipw_fw_dma_enable(struct ipw_priv *priv)
2691 {                               /* start dma engine but no transfers yet */
2692
2693         IPW_DEBUG_FW(">> : \n");
2694
2695         /* Start the dma */
2696         ipw_fw_dma_reset_command_blocks(priv);
2697
2698         /* Write CB base address */
2699         ipw_write_reg32(priv, IPW_DMA_I_CB_BASE, IPW_SHARED_SRAM_DMA_CONTROL);
2700
2701         IPW_DEBUG_FW("<< : \n");
2702         return 0;
2703 }
2704
2705 static void ipw_fw_dma_abort(struct ipw_priv *priv)
2706 {
2707         u32 control = 0;
2708
2709         IPW_DEBUG_FW(">> :\n");
2710
2711         /* set the Stop and Abort bit */
2712         control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_STOP_AND_ABORT;
2713         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
2714         priv->sram_desc.last_cb_index = 0;
2715
2716         IPW_DEBUG_FW("<< \n");
2717 }
2718
2719 static int ipw_fw_dma_write_command_block(struct ipw_priv *priv, int index,
2720                                           struct command_block *cb)
2721 {
2722         u32 address =
2723             IPW_SHARED_SRAM_DMA_CONTROL +
2724             (sizeof(struct command_block) * index);
2725         IPW_DEBUG_FW(">> :\n");
2726
2727         ipw_write_indirect(priv, address, (u8 *) cb,
2728                            (int)sizeof(struct command_block));
2729
2730         IPW_DEBUG_FW("<< :\n");
2731         return 0;
2732
2733 }
2734
2735 static int ipw_fw_dma_kick(struct ipw_priv *priv)
2736 {
2737         u32 control = 0;
2738         u32 index = 0;
2739
2740         IPW_DEBUG_FW(">> :\n");
2741
2742         for (index = 0; index < priv->sram_desc.last_cb_index; index++)
2743                 ipw_fw_dma_write_command_block(priv, index,
2744                                                &priv->sram_desc.cb_list[index]);
2745
2746         /* Enable the DMA in the CSR register */
2747         ipw_clear_bit(priv, IPW_RESET_REG,
2748                       IPW_RESET_REG_MASTER_DISABLED |
2749                       IPW_RESET_REG_STOP_MASTER);
2750
2751         /* Set the Start bit. */
2752         control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_START;
2753         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
2754
2755         IPW_DEBUG_FW("<< :\n");
2756         return 0;
2757 }
2758
2759 static void ipw_fw_dma_dump_command_block(struct ipw_priv *priv)
2760 {
2761         u32 address;
2762         u32 register_value = 0;
2763         u32 cb_fields_address = 0;
2764
2765         IPW_DEBUG_FW(">> :\n");
2766         address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
2767         IPW_DEBUG_FW_INFO("Current CB is 0x%x \n", address);
2768
2769         /* Read the DMA Controlor register */
2770         register_value = ipw_read_reg32(priv, IPW_DMA_I_DMA_CONTROL);
2771         IPW_DEBUG_FW_INFO("IPW_DMA_I_DMA_CONTROL is 0x%x \n", register_value);
2772
2773         /* Print the CB values */
2774         cb_fields_address = address;
2775         register_value = ipw_read_reg32(priv, cb_fields_address);
2776         IPW_DEBUG_FW_INFO("Current CB ControlField is 0x%x \n", register_value);
2777
2778         cb_fields_address += sizeof(u32);
2779         register_value = ipw_read_reg32(priv, cb_fields_address);
2780         IPW_DEBUG_FW_INFO("Current CB Source Field is 0x%x \n", register_value);
2781
2782         cb_fields_address += sizeof(u32);
2783         register_value = ipw_read_reg32(priv, cb_fields_address);
2784         IPW_DEBUG_FW_INFO("Current CB Destination Field is 0x%x \n",
2785                           register_value);
2786
2787         cb_fields_address += sizeof(u32);
2788         register_value = ipw_read_reg32(priv, cb_fields_address);
2789         IPW_DEBUG_FW_INFO("Current CB Status Field is 0x%x \n", register_value);
2790
2791         IPW_DEBUG_FW(">> :\n");
2792 }
2793
2794 static int ipw_fw_dma_command_block_index(struct ipw_priv *priv)
2795 {
2796         u32 current_cb_address = 0;
2797         u32 current_cb_index = 0;
2798
2799         IPW_DEBUG_FW("<< :\n");
2800         current_cb_address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
2801
2802         current_cb_index = (current_cb_address - IPW_SHARED_SRAM_DMA_CONTROL) /
2803             sizeof(struct command_block);
2804
2805         IPW_DEBUG_FW_INFO("Current CB index 0x%x address = 0x%X \n",
2806                           current_cb_index, current_cb_address);
2807
2808         IPW_DEBUG_FW(">> :\n");
2809         return current_cb_index;
2810
2811 }
2812
2813 static int ipw_fw_dma_add_command_block(struct ipw_priv *priv,
2814                                         u32 src_address,
2815                                         u32 dest_address,
2816                                         u32 length,
2817                                         int interrupt_enabled, int is_last)
2818 {
2819
2820         u32 control = CB_VALID | CB_SRC_LE | CB_DEST_LE | CB_SRC_AUTOINC |
2821             CB_SRC_IO_GATED | CB_DEST_AUTOINC | CB_SRC_SIZE_LONG |
2822             CB_DEST_SIZE_LONG;
2823         struct command_block *cb;
2824         u32 last_cb_element = 0;
2825
2826         IPW_DEBUG_FW_INFO("src_address=0x%x dest_address=0x%x length=0x%x\n",
2827                           src_address, dest_address, length);
2828
2829         if (priv->sram_desc.last_cb_index >= CB_NUMBER_OF_ELEMENTS_SMALL)
2830                 return -1;
2831
2832         last_cb_element = priv->sram_desc.last_cb_index;
2833         cb = &priv->sram_desc.cb_list[last_cb_element];
2834         priv->sram_desc.last_cb_index++;
2835
2836         /* Calculate the new CB control word */
2837         if (interrupt_enabled)
2838                 control |= CB_INT_ENABLED;
2839
2840         if (is_last)
2841                 control |= CB_LAST_VALID;
2842
2843         control |= length;
2844
2845         /* Calculate the CB Element's checksum value */
2846         cb->status = control ^ src_address ^ dest_address;
2847
2848         /* Copy the Source and Destination addresses */
2849         cb->dest_addr = dest_address;
2850         cb->source_addr = src_address;
2851
2852         /* Copy the Control Word last */
2853         cb->control = control;
2854
2855         return 0;
2856 }
2857
2858 static int ipw_fw_dma_add_buffer(struct ipw_priv *priv,
2859                                  u32 src_phys, u32 dest_address, u32 length)
2860 {
2861         u32 bytes_left = length;
2862         u32 src_offset = 0;
2863         u32 dest_offset = 0;
2864         int status = 0;
2865         IPW_DEBUG_FW(">> \n");
2866         IPW_DEBUG_FW_INFO("src_phys=0x%x dest_address=0x%x length=0x%x\n",
2867                           src_phys, dest_address, length);
2868         while (bytes_left > CB_MAX_LENGTH) {
2869                 status = ipw_fw_dma_add_command_block(priv,
2870                                                       src_phys + src_offset,
2871                                                       dest_address +
2872                                                       dest_offset,
2873                                                       CB_MAX_LENGTH, 0, 0);
2874                 if (status) {
2875                         IPW_DEBUG_FW_INFO(": Failed\n");
2876                         return -1;
2877                 } else
2878                         IPW_DEBUG_FW_INFO(": Added new cb\n");
2879
2880                 src_offset += CB_MAX_LENGTH;
2881                 dest_offset += CB_MAX_LENGTH;
2882                 bytes_left -= CB_MAX_LENGTH;
2883         }
2884
2885         /* add the buffer tail */
2886         if (bytes_left > 0) {
2887                 status =
2888                     ipw_fw_dma_add_command_block(priv, src_phys + src_offset,
2889                                                  dest_address + dest_offset,
2890                                                  bytes_left, 0, 0);
2891                 if (status) {
2892                         IPW_DEBUG_FW_INFO(": Failed on the buffer tail\n");
2893                         return -1;
2894                 } else
2895                         IPW_DEBUG_FW_INFO
2896                             (": Adding new cb - the buffer tail\n");
2897         }
2898
2899         IPW_DEBUG_FW("<< \n");
2900         return 0;
2901 }
2902
2903 static int ipw_fw_dma_wait(struct ipw_priv *priv)
2904 {
2905         u32 current_index = 0, previous_index;
2906         u32 watchdog = 0;
2907
2908         IPW_DEBUG_FW(">> : \n");
2909
2910         current_index = ipw_fw_dma_command_block_index(priv);
2911         IPW_DEBUG_FW_INFO("sram_desc.last_cb_index:0x%08X\n",
2912                           (int)priv->sram_desc.last_cb_index);
2913
2914         while (current_index < priv->sram_desc.last_cb_index) {
2915                 udelay(50);
2916                 previous_index = current_index;
2917                 current_index = ipw_fw_dma_command_block_index(priv);
2918
2919                 if (previous_index < current_index) {
2920                         watchdog = 0;
2921                         continue;
2922                 }
2923                 if (++watchdog > 400) {
2924                         IPW_DEBUG_FW_INFO("Timeout\n");
2925                         ipw_fw_dma_dump_command_block(priv);
2926                         ipw_fw_dma_abort(priv);
2927                         return -1;
2928                 }
2929         }
2930
2931         ipw_fw_dma_abort(priv);
2932
2933         /*Disable the DMA in the CSR register */
2934         ipw_set_bit(priv, IPW_RESET_REG,
2935                     IPW_RESET_REG_MASTER_DISABLED | IPW_RESET_REG_STOP_MASTER);
2936
2937         IPW_DEBUG_FW("<< dmaWaitSync \n");
2938         return 0;
2939 }
2940
2941 static void ipw_remove_current_network(struct ipw_priv *priv)
2942 {
2943         struct list_head *element, *safe;
2944         struct ieee80211_network *network = NULL;
2945         unsigned long flags;
2946
2947         spin_lock_irqsave(&priv->ieee->lock, flags);
2948         list_for_each_safe(element, safe, &priv->ieee->network_list) {
2949                 network = list_entry(element, struct ieee80211_network, list);
2950                 if (!memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
2951                         list_del(element);
2952                         list_add_tail(&network->list,
2953                                       &priv->ieee->network_free_list);
2954                 }
2955         }
2956         spin_unlock_irqrestore(&priv->ieee->lock, flags);
2957 }
2958
2959 /**
2960  * Check that card is still alive.
2961  * Reads debug register from domain0.
2962  * If card is present, pre-defined value should
2963  * be found there.
2964  *
2965  * @param priv
2966  * @return 1 if card is present, 0 otherwise
2967  */
2968 static inline int ipw_alive(struct ipw_priv *priv)
2969 {
2970         return ipw_read32(priv, 0x90) == 0xd55555d5;
2971 }
2972
2973 /* timeout in msec, attempted in 10-msec quanta */
2974 static int ipw_poll_bit(struct ipw_priv *priv, u32 addr, u32 mask,
2975                                int timeout)
2976 {
2977         int i = 0;
2978
2979         do {
2980                 if ((ipw_read32(priv, addr) & mask) == mask)
2981                         return i;
2982                 mdelay(10);
2983                 i += 10;
2984         } while (i < timeout);
2985
2986         return -ETIME;
2987 }
2988
2989 /* These functions load the firmware and micro code for the operation of
2990  * the ipw hardware.  It assumes the buffer has all the bits for the
2991  * image and the caller is handling the memory allocation and clean up.
2992  */
2993
2994 static int ipw_stop_master(struct ipw_priv *priv)
2995 {
2996         int rc;
2997
2998         IPW_DEBUG_TRACE(">> \n");
2999         /* stop master. typical delay - 0 */
3000         ipw_set_bit(priv, IPW_RESET_REG, IPW_RESET_REG_STOP_MASTER);
3001
3002         /* timeout is in msec, polled in 10-msec quanta */
3003         rc = ipw_poll_bit(priv, IPW_RESET_REG,
3004                           IPW_RESET_REG_MASTER_DISABLED, 100);
3005         if (rc < 0) {
3006                 IPW_ERROR("wait for stop master failed after 100ms\n");
3007                 return -1;
3008         }
3009
3010         IPW_DEBUG_INFO("stop master %dms\n", rc);
3011
3012         return rc;
3013 }
3014
3015 static void ipw_arc_release(struct ipw_priv *priv)
3016 {
3017         IPW_DEBUG_TRACE(">> \n");
3018         mdelay(5);
3019
3020         ipw_clear_bit(priv, IPW_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
3021
3022         /* no one knows timing, for safety add some delay */
3023         mdelay(5);
3024 }
3025
3026 struct fw_chunk {
3027         __le32 address;
3028         __le32 length;
3029 };
3030
3031 static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
3032 {
3033         int rc = 0, i, addr;
3034         u8 cr = 0;
3035         __le16 *image;
3036
3037         image = (__le16 *) data;
3038
3039         IPW_DEBUG_TRACE(">> \n");
3040
3041         rc = ipw_stop_master(priv);
3042
3043         if (rc < 0)
3044                 return rc;
3045
3046         for (addr = IPW_SHARED_LOWER_BOUND;
3047              addr < IPW_REGISTER_DOMAIN1_END; addr += 4) {
3048                 ipw_write32(priv, addr, 0);
3049         }
3050
3051         /* no ucode (yet) */
3052         memset(&priv->dino_alive, 0, sizeof(priv->dino_alive));
3053         /* destroy DMA queues */
3054         /* reset sequence */
3055
3056         ipw_write_reg32(priv, IPW_MEM_HALT_AND_RESET, IPW_BIT_HALT_RESET_ON);
3057         ipw_arc_release(priv);
3058         ipw_write_reg32(priv, IPW_MEM_HALT_AND_RESET, IPW_BIT_HALT_RESET_OFF);
3059         mdelay(1);
3060
3061         /* reset PHY */
3062         ipw_write_reg32(priv, IPW_INTERNAL_CMD_EVENT, IPW_BASEBAND_POWER_DOWN);
3063         mdelay(1);
3064
3065         ipw_write_reg32(priv, IPW_INTERNAL_CMD_EVENT, 0);
3066         mdelay(1);
3067
3068         /* enable ucode store */
3069         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0x0);
3070         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, DINO_ENABLE_CS);
3071         mdelay(1);
3072
3073         /* write ucode */
3074         /**
3075          * @bug
3076          * Do NOT set indirect address register once and then
3077          * store data to indirect data register in the loop.
3078          * It seems very reasonable, but in this case DINO do not
3079          * accept ucode. It is essential to set address each time.
3080          */
3081         /* load new ipw uCode */
3082         for (i = 0; i < len / 2; i++)
3083                 ipw_write_reg16(priv, IPW_BASEBAND_CONTROL_STORE,
3084                                 le16_to_cpu(image[i]));
3085
3086         /* enable DINO */
3087         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0);
3088         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, DINO_ENABLE_SYSTEM);
3089
3090         /* this is where the igx / win driver deveates from the VAP driver. */
3091
3092         /* wait for alive response */
3093         for (i = 0; i < 100; i++) {
3094                 /* poll for incoming data */
3095                 cr = ipw_read_reg8(priv, IPW_BASEBAND_CONTROL_STATUS);
3096                 if (cr & DINO_RXFIFO_DATA)
3097                         break;
3098                 mdelay(1);
3099         }
3100
3101         if (cr & DINO_RXFIFO_DATA) {
3102                 /* alive_command_responce size is NOT multiple of 4 */
3103                 __le32 response_buffer[(sizeof(priv->dino_alive) + 3) / 4];
3104
3105                 for (i = 0; i < ARRAY_SIZE(response_buffer); i++)
3106                         response_buffer[i] =
3107                             cpu_to_le32(ipw_read_reg32(priv,
3108                                                        IPW_BASEBAND_RX_FIFO_READ));
3109                 memcpy(&priv->dino_alive, response_buffer,
3110                        sizeof(priv->dino_alive));
3111                 if (priv->dino_alive.alive_command == 1
3112                     && priv->dino_alive.ucode_valid == 1) {
3113                         rc = 0;
3114                         IPW_DEBUG_INFO
3115                             ("Microcode OK, rev. %d (0x%x) dev. %d (0x%x) "
3116                              "of %02d/%02d/%02d %02d:%02d\n",
3117                              priv->dino_alive.software_revision,
3118                              priv->dino_alive.software_revision,
3119                              priv->dino_alive.device_identifier,
3120                              priv->dino_alive.device_identifier,
3121                              priv->dino_alive.time_stamp[0],
3122                              priv->dino_alive.time_stamp[1],
3123                              priv->dino_alive.time_stamp[2],
3124                              priv->dino_alive.time_stamp[3],
3125                              priv->dino_alive.time_stamp[4]);
3126                 } else {
3127                         IPW_DEBUG_INFO("Microcode is not alive\n");
3128                         rc = -EINVAL;
3129                 }
3130         } else {
3131                 IPW_DEBUG_INFO("No alive response from DINO\n");
3132                 rc = -ETIME;
3133         }
3134
3135         /* disable DINO, otherwise for some reason
3136            firmware have problem getting alive resp. */
3137         ipw_write_reg8(priv, IPW_BASEBAND_CONTROL_STATUS, 0);
3138
3139         return rc;
3140 }
3141
3142 static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
3143 {
3144         int rc = -1;
3145         int offset = 0;
3146         struct fw_chunk *chunk;
3147         dma_addr_t shared_phys;
3148         u8 *shared_virt;
3149
3150         IPW_DEBUG_TRACE("<< : \n");
3151         shared_virt = pci_alloc_consistent(priv->pci_dev, len, &shared_phys);
3152
3153         if (!shared_virt)
3154                 return -ENOMEM;
3155
3156         memmove(shared_virt, data, len);
3157
3158         /* Start the Dma */
3159         rc = ipw_fw_dma_enable(priv);
3160
3161         if (priv->sram_desc.last_cb_index > 0) {
3162                 /* the DMA is already ready this would be a bug. */
3163                 BUG();
3164                 goto out;
3165         }
3166
3167         do {
3168                 chunk = (struct fw_chunk *)(data + offset);
3169                 offset += sizeof(struct fw_chunk);
3170                 /* build DMA packet and queue up for sending */
3171                 /* dma to chunk->address, the chunk->length bytes from data +
3172                  * offeset*/
3173                 /* Dma loading */
3174                 rc = ipw_fw_dma_add_buffer(priv, shared_phys + offset,
3175                                            le32_to_cpu(chunk->address),
3176                                            le32_to_cpu(chunk->length));
3177                 if (rc) {
3178                         IPW_DEBUG_INFO("dmaAddBuffer Failed\n");
3179                         goto out;
3180                 }
3181
3182                 offset += le32_to_cpu(chunk->length);
3183         } while (offset < len);
3184
3185         /* Run the DMA and wait for the answer */
3186         rc = ipw_fw_dma_kick(priv);
3187         if (rc) {
3188                 IPW_ERROR("dmaKick Failed\n");
3189                 goto out;
3190         }
3191
3192         rc = ipw_fw_dma_wait(priv);
3193         if (rc) {
3194                 IPW_ERROR("dmaWaitSync Failed\n");
3195                 goto out;
3196         }
3197       out:
3198         pci_free_consistent(priv->pci_dev, len, shared_virt, shared_phys);
3199         return rc;
3200 }
3201
3202 /* stop nic */
3203 static int ipw_stop_nic(struct ipw_priv *priv)
3204 {
3205         int rc = 0;
3206
3207         /* stop */
3208         ipw_write32(priv, IPW_RESET_REG, IPW_RESET_REG_STOP_MASTER);
3209
3210         rc = ipw_poll_bit(priv, IPW_RESET_REG,
3211                           IPW_RESET_REG_MASTER_DISABLED, 500);
3212         if (rc < 0) {
3213                 IPW_ERROR("wait for reg master disabled failed after 500ms\n");
3214                 return rc;
3215         }
3216
3217         ipw_set_bit(priv, IPW_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
3218
3219         return rc;
3220 }
3221
3222 static void ipw_start_nic(struct ipw_priv *priv)
3223 {
3224         IPW_DEBUG_TRACE(">>\n");
3225
3226         /* prvHwStartNic  release ARC */
3227         ipw_clear_bit(priv, IPW_RESET_REG,
3228                       IPW_RESET_REG_MASTER_DISABLED |
3229                       IPW_RESET_REG_STOP_MASTER |
3230                       CBD_RESET_REG_PRINCETON_RESET);
3231
3232         /* enable power management */
3233         ipw_set_bit(priv, IPW_GP_CNTRL_RW,
3234                     IPW_GP_CNTRL_BIT_HOST_ALLOWS_STANDBY);
3235
3236         IPW_DEBUG_TRACE("<<\n");
3237 }
3238
3239 static int ipw_init_nic(struct ipw_priv *priv)
3240 {
3241         int rc;
3242
3243         IPW_DEBUG_TRACE(">>\n");
3244         /* reset */
3245         /*prvHwInitNic */
3246         /* set "initialization complete" bit to move adapter to D0 state */
3247         ipw_set_bit(priv, IPW_GP_CNTRL_RW, IPW_GP_CNTRL_BIT_INIT_DONE);
3248
3249         /* low-level PLL activation */
3250         ipw_write32(priv, IPW_READ_INT_REGISTER,
3251                     IPW_BIT_INT_HOST_SRAM_READ_INT_REGISTER);
3252
3253         /* wait for clock stabilization */
3254         rc = ipw_poll_bit(priv, IPW_GP_CNTRL_RW,
3255                           IPW_GP_CNTRL_BIT_CLOCK_READY, 250);
3256         if (rc < 0)
3257                 IPW_DEBUG_INFO("FAILED wait for clock stablization\n");
3258
3259         /* assert SW reset */
3260         ipw_set_bit(priv, IPW_RESET_REG, IPW_RESET_REG_SW_RESET);
3261
3262         udelay(10);
3263
3264         /* set "initialization complete" bit to move adapter to D0 state */
3265         ipw_set_bit(priv, IPW_GP_CNTRL_RW, IPW_GP_CNTRL_BIT_INIT_DONE);
3266
3267         IPW_DEBUG_TRACE(">>\n");
3268         return 0;
3269 }
3270
3271 /* Call this function from process context, it will sleep in request_firmware.
3272  * Probe is an ok place to call this from.
3273  */
3274 static int ipw_reset_nic(struct ipw_priv *priv)
3275 {
3276         int rc = 0;
3277         unsigned long flags;
3278
3279         IPW_DEBUG_TRACE(">>\n");
3280
3281         rc = ipw_init_nic(priv);
3282
3283         spin_lock_irqsave(&priv->lock, flags);
3284         /* Clear the 'host command active' bit... */
3285         priv->status &= ~STATUS_HCMD_ACTIVE;
3286         wake_up_interruptible(&priv->wait_command_queue);
3287         priv->status &= ~(STATUS_SCANNING | STATUS_SCAN_ABORTING);
3288         wake_up_interruptible(&priv->wait_state);
3289         spin_unlock_irqrestore(&priv->lock, flags);
3290
3291         IPW_DEBUG_TRACE("<<\n");
3292         return rc;
3293 }
3294
3295
3296 struct ipw_fw {
3297         __le32 ver;
3298         __le32 boot_size;
3299         __le32 ucode_size;
3300         __le32 fw_size;
3301         u8 data[0];
3302 };
3303
3304 static int ipw_get_fw(struct ipw_priv *priv,
3305                       const struct firmware **raw, const char *name)
3306 {
3307         struct ipw_fw *fw;
3308         int rc;
3309
3310         /* ask firmware_class module to get the boot firmware off disk */
3311         rc = request_firmware(raw, name, &priv->pci_dev->dev);
3312         if (rc < 0) {
3313                 IPW_ERROR("%s request_firmware failed: Reason %d\n", name, rc);
3314                 return rc;
3315         }
3316
3317         if ((*raw)->size < sizeof(*fw)) {
3318                 IPW_ERROR("%s is too small (%zd)\n", name, (*raw)->size);
3319                 return -EINVAL;
3320         }
3321
3322         fw = (void *)(*raw)->data;
3323
3324         if ((*raw)->size < sizeof(*fw) + le32_to_cpu(fw->boot_size) +
3325             le32_to_cpu(fw->ucode_size) + le32_to_cpu(fw->fw_size)) {
3326                 IPW_ERROR("%s is too small or corrupt (%zd)\n",
3327                           name, (*raw)->size);
3328                 return -EINVAL;
3329         }
3330
3331         IPW_DEBUG_INFO("Read firmware '%s' image v%d.%d (%zd bytes)\n",
3332                        name,
3333                        le32_to_cpu(fw->ver) >> 16,
3334                        le32_to_cpu(fw->ver) & 0xff,
3335                        (*raw)->size - sizeof(*fw));
3336         return 0;
3337 }
3338
3339 #define IPW_RX_BUF_SIZE (3000)
3340
3341 static void ipw_rx_queue_reset(struct ipw_priv *priv,
3342                                       struct ipw_rx_queue *rxq)
3343 {
3344         unsigned long flags;
3345         int i;
3346
3347         spin_lock_irqsave(&rxq->lock, flags);
3348
3349         INIT_LIST_HEAD(&rxq->rx_free);
3350         INIT_LIST_HEAD(&rxq->rx_used);
3351
3352         /* Fill the rx_used queue with _all_ of the Rx buffers */
3353         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
3354                 /* In the reset function, these buffers may have been allocated
3355                  * to an SKB, so we need to unmap and free potential storage */
3356                 if (rxq->pool[i].skb != NULL) {
3357                         pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
3358                                          IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
3359                         dev_kfree_skb(rxq->pool[i].skb);
3360                         rxq->pool[i].skb = NULL;
3361                 }
3362                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
3363         }
3364
3365         /* Set us so that we have processed and used all buffers, but have
3366          * not restocked the Rx queue with fresh buffers */
3367         rxq->read = rxq->write = 0;
3368         rxq->free_count = 0;
3369         spin_unlock_irqrestore(&rxq->lock, flags);
3370 }
3371
3372 #ifdef CONFIG_PM
3373 static int fw_loaded = 0;
3374 static const struct firmware *raw = NULL;
3375
3376 static void free_firmware(void)
3377 {
3378         if (fw_loaded) {
3379                 release_firmware(raw);
3380                 raw = NULL;
3381                 fw_loaded = 0;
3382         }
3383 }
3384 #else
3385 #define free_firmware() do {} while (0)
3386 #endif
3387
3388 static int ipw_load(struct ipw_priv *priv)
3389 {
3390 #ifndef CONFIG_PM
3391         const struct firmware *raw = NULL;
3392 #endif
3393         struct ipw_fw *fw;
3394         u8 *boot_img, *ucode_img, *fw_img;
3395         u8 *name = NULL;
3396         int rc = 0, retries = 3;
3397
3398         switch (priv->ieee->iw_mode) {
3399         case IW_MODE_ADHOC:
3400                 name = "ipw2200-ibss.fw";
3401                 break;
3402 #ifdef CONFIG_IPW2200_MONITOR
3403         case IW_MODE_MONITOR:
3404                 name = "ipw2200-sniffer.fw";
3405                 break;
3406 #endif
3407         case IW_MODE_INFRA:
3408                 name = "ipw2200-bss.fw";
3409                 break;
3410         }
3411
3412         if (!name) {
3413                 rc = -EINVAL;
3414                 goto error;
3415         }
3416
3417 #ifdef CONFIG_PM
3418         if (!fw_loaded) {
3419 #endif
3420                 rc = ipw_get_fw(priv, &raw, name);
3421                 if (rc < 0)
3422                         goto error;
3423 #ifdef CONFIG_PM
3424         }
3425 #endif
3426
3427         fw = (void *)raw->data;
3428         boot_img = &fw->data[0];
3429         ucode_img = &fw->data[le32_to_cpu(fw->boot_size)];
3430         fw_img = &fw->data[le32_to_cpu(fw->boot_size) +
3431                            le32_to_cpu(fw->ucode_size)];
3432
3433         if (rc < 0)
3434                 goto error;
3435
3436         if (!priv->rxq)
3437                 priv->rxq = ipw_rx_queue_alloc(priv);
3438         else
3439                 ipw_rx_queue_reset(priv, priv->rxq);
3440         if (!priv->rxq) {
3441                 IPW_ERROR("Unable to initialize Rx queue\n");
3442                 goto error;
3443         }
3444
3445       retry:
3446         /* Ensure interrupts are disabled */
3447         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
3448         priv->status &= ~STATUS_INT_ENABLED;
3449
3450         /* ack pending interrupts */
3451         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3452
3453         ipw_stop_nic(priv);
3454
3455         rc = ipw_reset_nic(priv);
3456         if (rc < 0) {
3457                 IPW_ERROR("Unable to reset NIC\n");
3458                 goto error;
3459         }
3460
3461         ipw_zero_memory(priv, IPW_NIC_SRAM_LOWER_BOUND,
3462                         IPW_NIC_SRAM_UPPER_BOUND - IPW_NIC_SRAM_LOWER_BOUND);
3463
3464         /* DMA the initial boot firmware into the device */
3465         rc = ipw_load_firmware(priv, boot_img, le32_to_cpu(fw->boot_size));
3466         if (rc < 0) {
3467                 IPW_ERROR("Unable to load boot firmware: %d\n", rc);
3468                 goto error;
3469         }
3470
3471         /* kick start the device */
3472         ipw_start_nic(priv);
3473
3474         /* wait for the device to finish its initial startup sequence */
3475         rc = ipw_poll_bit(priv, IPW_INTA_RW,
3476                           IPW_INTA_BIT_FW_INITIALIZATION_DONE, 500);
3477         if (rc < 0) {
3478                 IPW_ERROR("device failed to boot initial fw image\n");
3479                 goto error;
3480         }
3481         IPW_DEBUG_INFO("initial device response after %dms\n", rc);
3482
3483         /* ack fw init done interrupt */
3484         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
3485
3486         /* DMA the ucode into the device */
3487         rc = ipw_load_ucode(priv, ucode_img, le32_to_cpu(fw->ucode_size));
3488         if (rc < 0) {
3489                 IPW_ERROR("Unable to load ucode: %d\n", rc);
3490                 goto error;
3491         }
3492
3493         /* stop nic */
3494         ipw_stop_nic(priv);
3495
3496         /* DMA bss firmware into the device */
3497         rc = ipw_load_firmware(priv, fw_img, le32_to_cpu(fw->fw_size));
3498         if (rc < 0) {
3499                 IPW_ERROR("Unable to load firmware: %d\n", rc);
3500                 goto error;
3501         }
3502 #ifdef CONFIG_PM
3503         fw_loaded = 1;
3504 #endif
3505
3506         ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
3507
3508         rc = ipw_queue_reset(priv);
3509         if (rc < 0) {
3510                 IPW_ERROR("Unable to initialize queues\n");
3511                 goto error;
3512         }
3513
3514         /* Ensure interrupts are disabled */
3515         ipw_write32(priv, IPW_INTA_MASK_R, ~IPW_INTA_MASK_ALL);
3516         /* ack pending interrupts */
3517         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3518
3519         /* kick start the device */
3520         ipw_start_nic(priv);
3521
3522         if (ipw_read32(priv, IPW_INTA_RW) & IPW_INTA_BIT_PARITY_ERROR) {
3523                 if (retries > 0) {
3524                         IPW_WARNING("Parity error.  Retrying init.\n");
3525                         retries--;
3526                         goto retry;
3527                 }
3528
3529                 IPW_ERROR("TODO: Handle parity error -- schedule restart?\n");
3530                 rc = -EIO;
3531                 goto error;
3532         }
3533
3534         /* wait for the device */
3535         rc = ipw_poll_bit(priv, IPW_INTA_RW,
3536                           IPW_INTA_BIT_FW_INITIALIZATION_DONE, 500);
3537         if (rc < 0) {
3538                 IPW_ERROR("device failed to start within 500ms\n");
3539                 goto error;
3540         }
3541         IPW_DEBUG_INFO("device response after %dms\n", rc);
3542
3543         /* ack fw init done interrupt */
3544         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
3545
3546         /* read eeprom data and initialize the eeprom region of sram */
3547         priv->eeprom_delay = 1;
3548         ipw_eeprom_init_sram(priv);
3549
3550         /* enable interrupts */
3551         ipw_enable_interrupts(priv);
3552
3553         /* Ensure our queue has valid packets */
3554         ipw_rx_queue_replenish(priv);
3555
3556         ipw_write32(priv, IPW_RX_READ_INDEX, priv->rxq->read);
3557
3558         /* ack pending interrupts */
3559         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_MASK_ALL);
3560
3561 #ifndef CONFIG_PM
3562         release_firmware(raw);
3563 #endif
3564         return 0;
3565
3566       error:
3567         if (priv->rxq) {
3568                 ipw_rx_queue_free(priv, priv->rxq);
3569                 priv->rxq = NULL;
3570         }
3571         ipw_tx_queue_free(priv);
3572         if (raw)
3573                 release_firmware(raw);
3574 #ifdef CONFIG_PM
3575         fw_loaded = 0;
3576         raw = NULL;
3577 #endif
3578
3579         return rc;
3580 }
3581
3582 /**
3583  * DMA services
3584  *
3585  * Theory of operation
3586  *
3587  * A queue is a circular buffers with 'Read' and 'Write' pointers.
3588  * 2 empty entries always kept in the buffer to protect from overflow.
3589  *
3590  * For Tx queue, there are low mark and high mark limits. If, after queuing
3591  * the packet for Tx, free space become < low mark, Tx queue stopped. When
3592  * reclaiming packets (on 'tx done IRQ), if free space become > high mark,
3593  * Tx queue resumed.
3594  *
3595  * The IPW operates with six queues, one receive queue in the device's
3596  * sram, one transmit queue for sending commands to the device firmware,
3597  * and four transmit queues for data.
3598  *
3599  * The four transmit queues allow for performing quality of service (qos)
3600  * transmissions as per the 802.11 protocol.  Currently Linux does not
3601  * provide a mechanism to the user for utilizing prioritized queues, so
3602  * we only utilize the first data transmit queue (queue1).
3603  */
3604
3605 /**
3606  * Driver allocates buffers of this size for Rx
3607  */
3608
3609 /**
3610  * ipw_rx_queue_space - Return number of free slots available in queue.
3611  */
3612 static int ipw_rx_queue_space(const struct ipw_rx_queue *q)
3613 {
3614         int s = q->read - q->write;
3615         if (s <= 0)
3616                 s += RX_QUEUE_SIZE;
3617         /* keep some buffer to not confuse full and empty queue */
3618         s -= 2;
3619         if (s < 0)
3620                 s = 0;
3621         return s;
3622 }
3623
3624 static inline int ipw_tx_queue_space(const struct clx2_queue *q)
3625 {
3626         int s = q->last_used - q->first_empty;
3627         if (s <= 0)
3628                 s += q->n_bd;
3629         s -= 2;                 /* keep some reserve to not confuse empty and full situations */
3630         if (s < 0)
3631                 s = 0;
3632         return s;
3633 }
3634
3635 static inline int ipw_queue_inc_wrap(int index, int n_bd)
3636 {
3637         return (++index == n_bd) ? 0 : index;
3638 }
3639
3640 /**
3641  * Initialize common DMA queue structure
3642  *
3643  * @param q                queue to init
3644  * @param count            Number of BD's to allocate. Should be power of 2
3645  * @param read_register    Address for 'read' register
3646  *                         (not offset within BAR, full address)
3647  * @param write_register   Address for 'write' register
3648  *                         (not offset within BAR, full address)
3649  * @param base_register    Address for 'base' register
3650  *                         (not offset within BAR, full address)
3651  * @param size             Address for 'size' register
3652  *                         (not offset within BAR, full address)
3653  */
3654 static void ipw_queue_init(struct ipw_priv *priv, struct clx2_queue *q,
3655                            int count, u32 read, u32 write, u32 base, u32 size)
3656 {
3657         q->n_bd = count;
3658
3659         q->low_mark = q->n_bd / 4;
3660         if (q->low_mark < 4)
3661                 q->low_mark = 4;
3662
3663         q->high_mark = q->n_bd / 8;
3664         if (q->high_mark < 2)
3665                 q->high_mark = 2;
3666
3667         q->first_empty = q->last_used = 0;
3668         q->reg_r = read;
3669         q->reg_w = write;
3670
3671         ipw_write32(priv, base, q->dma_addr);
3672         ipw_write32(priv, size, count);
3673         ipw_write32(priv, read, 0);
3674         ipw_write32(priv, write, 0);
3675
3676         _ipw_read32(priv, 0x90);
3677 }
3678
3679 static int ipw_queue_tx_init(struct ipw_priv *priv,
3680                              struct clx2_tx_queue *q,
3681                              int count, u32 read, u32 write, u32 base, u32 size)
3682 {
3683         struct pci_dev *dev = priv->pci_dev;
3684
3685         q->txb = kmalloc(sizeof(q->txb[0]) * count, GFP_KERNEL);
3686         if (!q->txb) {
3687                 IPW_ERROR("vmalloc for auxilary BD structures failed\n");
3688                 return -ENOMEM;
3689         }
3690
3691         q->bd =
3692             pci_alloc_consistent(dev, sizeof(q->bd[0]) * count, &q->q.dma_addr);
3693         if (!q->bd) {
3694                 IPW_ERROR("pci_alloc_consistent(%zd) failed\n",
3695                           sizeof(q->bd[0]) * count);
3696                 kfree(q->txb);
3697                 q->txb = NULL;
3698                 return -ENOMEM;
3699         }
3700
3701         ipw_queue_init(priv, &q->q, count, read, write, base, size);
3702         return 0;
3703 }
3704
3705 /**
3706  * Free one TFD, those at index [txq->q.last_used].
3707  * Do NOT advance any indexes
3708  *
3709  * @param dev
3710  * @param txq
3711  */
3712 static void ipw_queue_tx_free_tfd(struct ipw_priv *priv,
3713                                   struct clx2_tx_queue *txq)
3714 {
3715         struct tfd_frame *bd = &txq->bd[txq->q.last_used];
3716         struct pci_dev *dev = priv->pci_dev;
3717         int i;
3718
3719         /* classify bd */
3720         if (bd->control_flags.message_type == TX_HOST_COMMAND_TYPE)
3721                 /* nothing to cleanup after for host commands */
3722                 return;
3723
3724         /* sanity check */
3725         if (le32_to_cpu(bd->u.data.num_chunks) > NUM_TFD_CHUNKS) {
3726                 IPW_ERROR("Too many chunks: %i\n",
3727                           le32_to_cpu(bd->u.data.num_chunks));
3728                 /** @todo issue fatal error, it is quite serious situation */
3729                 return;
3730         }
3731
3732         /* unmap chunks if any */
3733         for (i = 0; i < le32_to_cpu(bd->u.data.num_chunks); i++) {
3734                 pci_unmap_single(dev, le32_to_cpu(bd->u.data.chunk_ptr[i]),
3735                                  le16_to_cpu(bd->u.data.chunk_len[i]),
3736                                  PCI_DMA_TODEVICE);
3737                 if (txq->txb[txq->q.last_used]) {
3738                         ieee80211_txb_free(txq->txb[txq->q.last_used]);
3739                         txq->txb[txq->q.last_used] = NULL;
3740                 }
3741         }
3742 }
3743
3744 /**
3745  * Deallocate DMA queue.
3746  *
3747  * Empty queue by removing and destroying all BD's.
3748  * Free all buffers.
3749  *
3750  * @param dev
3751  * @param q
3752  */
3753 static void ipw_queue_tx_free(struct ipw_priv *priv, struct clx2_tx_queue *txq)
3754 {
3755         struct clx2_queue *q = &txq->q;
3756         struct pci_dev *dev = priv->pci_dev;
3757
3758         if (q->n_bd == 0)
3759                 return;
3760
3761         /* first, empty all BD's */
3762         for (; q->first_empty != q->last_used;
3763              q->last_used = ipw_queue_inc_wrap(q->last_used, q->n_bd)) {
3764                 ipw_queue_tx_free_tfd(priv, txq);
3765         }
3766
3767         /* free buffers belonging to queue itself */
3768         pci_free_consistent(dev, sizeof(txq->bd[0]) * q->n_bd, txq->bd,
3769                             q->dma_addr);
3770         kfree(txq->txb);
3771
3772         /* 0 fill whole structure */
3773         memset(txq, 0, sizeof(*txq));
3774 }
3775
3776 /**
3777  * Destroy all DMA queues and structures
3778  *
3779  * @param priv
3780  */
3781 static void ipw_tx_queue_free(struct ipw_priv *priv)
3782 {
3783         /* Tx CMD queue */
3784         ipw_queue_tx_free(priv, &priv->txq_cmd);
3785
3786         /* Tx queues */
3787         ipw_queue_tx_free(priv, &priv->txq[0]);
3788         ipw_queue_tx_free(priv, &priv->txq[1]);
3789         ipw_queue_tx_free(priv, &priv->txq[2]);
3790         ipw_queue_tx_free(priv, &priv->txq[3]);
3791 }
3792
3793 static void ipw_create_bssid(struct ipw_priv *priv, u8 * bssid)
3794 {
3795         /* First 3 bytes are manufacturer */
3796         bssid[0] = priv->mac_addr[0];
3797         bssid[1] = priv->mac_addr[1];
3798         bssid[2] = priv->mac_addr[2];
3799
3800         /* Last bytes are random */
3801         get_random_bytes(&bssid[3], ETH_ALEN - 3);
3802
3803         bssid[0] &= 0xfe;       /* clear multicast bit */
3804         bssid[0] |= 0x02;       /* set local assignment bit (IEEE802) */
3805 }
3806
3807 static u8 ipw_add_station(struct ipw_priv *priv, u8 * bssid)
3808 {
3809         struct ipw_station_entry entry;
3810         int i;
3811         DECLARE_MAC_BUF(mac);
3812
3813         for (i = 0; i < priv->num_stations; i++) {
3814                 if (!memcmp(priv->stations[i], bssid, ETH_ALEN)) {
3815                         /* Another node is active in network */
3816                         priv->missed_adhoc_beacons = 0;
3817                         if (!(priv->config & CFG_STATIC_CHANNEL))
3818                                 /* when other nodes drop out, we drop out */
3819                                 priv->config &= ~CFG_ADHOC_PERSIST;
3820
3821                         return i;
3822                 }
3823         }
3824
3825         if (i == MAX_STATIONS)
3826                 return IPW_INVALID_STATION;
3827
3828         IPW_DEBUG_SCAN("Adding AdHoc station: %s\n", print_mac(mac, bssid));
3829
3830         entry.reserved = 0;
3831         entry.support_mode = 0;
3832         memcpy(entry.mac_addr, bssid, ETH_ALEN);
3833         memcpy(priv->stations[i], bssid, ETH_ALEN);
3834         ipw_write_direct(priv, IPW_STATION_TABLE_LOWER + i * sizeof(entry),
3835                          &entry, sizeof(entry));
3836         priv->num_stations++;
3837
3838         return i;
3839 }
3840
3841 static u8 ipw_find_station(struct ipw_priv *priv, u8 * bssid)
3842 {
3843         int i;
3844
3845         for (i = 0; i < priv->num_stations; i++)
3846                 if (!memcmp(priv->stations[i], bssid, ETH_ALEN))
3847                         return i;
3848
3849         return IPW_INVALID_STATION;
3850 }
3851
3852 static void ipw_send_disassociate(struct ipw_priv *priv, int quiet)
3853 {
3854         int err;
3855         DECLARE_MAC_BUF(mac);
3856
3857         if (priv->status & STATUS_ASSOCIATING) {
3858                 IPW_DEBUG_ASSOC("Disassociating while associating.\n");
3859                 queue_work(priv->workqueue, &priv->disassociate);
3860                 return;
3861         }
3862
3863         if (!(priv->status & STATUS_ASSOCIATED)) {
3864                 IPW_DEBUG_ASSOC("Disassociating while not associated.\n");
3865                 return;
3866         }
3867
3868         IPW_DEBUG_ASSOC("Disassocation attempt from %s "
3869                         "on channel %d.\n",
3870                         print_mac(mac, priv->assoc_request.bssid),
3871                         priv->assoc_request.channel);
3872
3873         priv->status &= ~(STATUS_ASSOCIATING | STATUS_ASSOCIATED);
3874         priv->status |= STATUS_DISASSOCIATING;
3875
3876         if (quiet)
3877                 priv->assoc_request.assoc_type = HC_DISASSOC_QUIET;
3878         else
3879                 priv->assoc_request.assoc_type = HC_DISASSOCIATE;
3880
3881         err = ipw_send_associate(priv, &priv->assoc_request);
3882         if (err) {
3883                 IPW_DEBUG_HC("Attempt to send [dis]associate command "
3884                              "failed.\n");
3885                 return;
3886         }
3887
3888 }
3889
3890 static int ipw_disassociate(void *data)
3891 {
3892         struct ipw_priv *priv = data;
3893         if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)))
3894                 return 0;
3895         ipw_send_disassociate(data, 0);
3896         return 1;
3897 }
3898
3899 static void ipw_bg_disassociate(struct work_struct *work)
3900 {
3901         struct ipw_priv *priv =
3902                 container_of(work, struct ipw_priv, disassociate);
3903         mutex_lock(&priv->mutex);
3904         ipw_disassociate(priv);
3905         mutex_unlock(&priv->mutex);
3906 }
3907
3908 static void ipw_system_config(struct work_struct *work)
3909 {
3910         struct ipw_priv *priv =
3911                 container_of(work, struct ipw_priv, system_config);
3912
3913 #ifdef CONFIG_IPW2200_PROMISCUOUS
3914         if (priv->prom_net_dev && netif_running(priv->prom_net_dev)) {
3915                 priv->sys_config.accept_all_data_frames = 1;
3916                 priv->sys_config.accept_non_directed_frames = 1;
3917                 priv->sys_config.accept_all_mgmt_bcpr = 1;
3918                 priv->sys_config.accept_all_mgmt_frames = 1;
3919         }
3920 #endif
3921
3922         ipw_send_system_config(priv);
3923 }
3924
3925 struct ipw_status_code {
3926         u16 status;
3927         const char *reason;
3928 };
3929
3930 static const struct ipw_status_code ipw_status_codes[] = {
3931         {0x00, "Successful"},
3932         {0x01, "Unspecified failure"},
3933         {0x0A, "Cannot support all requested capabilities in the "
3934          "Capability information field"},
3935         {0x0B, "Reassociation denied due to inability to confirm that "
3936          "association exists"},
3937         {0x0C, "Association denied due to reason outside the scope of this "
3938          "standard"},
3939         {0x0D,
3940          "Responding station does not support the specified authentication "
3941          "algorithm"},
3942         {0x0E,
3943          "Received an Authentication frame with authentication sequence "
3944          "transaction sequence number out of expected sequence"},
3945         {0x0F, "Authentication rejected because of challenge failure"},
3946         {0x10, "Authentication rejected due to timeout waiting for next "
3947          "frame in sequence"},
3948         {0x11, "Association denied because AP is unable to handle additional "
3949          "associated stations"},
3950         {0x12,
3951          "Association denied due to requesting station not supporting all "
3952          "of the datarates in the BSSBasicServiceSet Parameter"},
3953         {0x13,
3954          "Association denied due to requesting station not supporting "
3955          "short preamble operation"},
3956         {0x14,
3957          "Association denied due to requesting station not supporting "
3958          "PBCC encoding"},
3959         {0x15,
3960          "Association denied due to requesting station not supporting "
3961          "channel agility"},
3962         {0x19,
3963          "Association denied due to requesting station not supporting "
3964          "short slot operation"},
3965         {0x1A,
3966          "Association denied due to requesting station not supporting "
3967          "DSSS-OFDM operation"},
3968         {0x28, "Invalid Information Element"},
3969         {0x29, "Group Cipher is not valid"},
3970         {0x2A, "Pairwise Cipher is not valid"},
3971         {0x2B, "AKMP is not valid"},
3972         {0x2C, "Unsupported RSN IE version"},
3973         {0x2D, "Invalid RSN IE Capabilities"},
3974         {0x2E, "Cipher suite is rejected per security policy"},
3975 };
3976
3977 static const char *ipw_get_status_code(u16 status)
3978 {
3979         int i;
3980         for (i = 0; i < ARRAY_SIZE(ipw_status_codes); i++)
3981                 if (ipw_status_codes[i].status == (status & 0xff))
3982                         return ipw_status_codes[i].reason;
3983         return "Unknown status value.";
3984 }
3985
3986 static void inline average_init(struct average *avg)
3987 {
3988         memset(avg, 0, sizeof(*avg));
3989 }
3990
3991 #define DEPTH_RSSI 8
3992 #define DEPTH_NOISE 16
3993 static s16 exponential_average(s16 prev_avg, s16 val, u8 depth)
3994 {
3995         return ((depth-1)*prev_avg +  val)/depth;
3996 }
3997
3998 static void average_add(struct average *avg, s16 val)
3999 {
4000         avg->sum -= avg->entries[avg->pos];
4001         avg->sum += val;
4002         avg->entries[avg->pos++] = val;
4003         if (unlikely(avg->pos == AVG_ENTRIES)) {
4004                 avg->init = 1;
4005                 avg->pos = 0;
4006         }
4007 }
4008
4009 static s16 average_value(struct average *avg)
4010 {
4011         if (!unlikely(avg->init)) {
4012                 if (avg->pos)
4013                         return avg->sum / avg->pos;
4014                 return 0;
4015         }
4016
4017         return avg->sum / AVG_ENTRIES;
4018 }
4019
4020 static void ipw_reset_stats(struct ipw_priv *priv)
4021 {
4022         u32 len = sizeof(u32);
4023
4024         priv->quality = 0;
4025
4026         average_init(&priv->average_missed_beacons);
4027         priv->exp_avg_rssi = -60;
4028         priv->exp_avg_noise = -85 + 0x100;
4029
4030         priv->last_rate = 0;
4031         priv->last_missed_beacons = 0;
4032         priv->last_rx_packets = 0;
4033         priv->last_tx_packets = 0;
4034         priv->last_tx_failures = 0;
4035
4036         /* Firmware managed, reset only when NIC is restarted, so we have to
4037          * normalize on the current value */
4038         ipw_get_ordinal(priv, IPW_ORD_STAT_RX_ERR_CRC,
4039                         &priv->last_rx_err, &len);
4040         ipw_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURE,
4041                         &priv->last_tx_failures, &len);
4042
4043         /* Driver managed, reset with each association */
4044         priv->missed_adhoc_beacons = 0;
4045         priv->missed_beacons = 0;
4046         priv->tx_packets = 0;
4047         priv->rx_packets = 0;
4048
4049 }
4050
4051 static u32 ipw_get_max_rate(struct ipw_priv *priv)
4052 {
4053         u32 i = 0x80000000;
4054         u32 mask = priv->rates_mask;
4055         /* If currently associated in B mode, restrict the maximum
4056          * rate match to B rates */
4057         if (priv->assoc_request.ieee_mode == IPW_B_MODE)
4058                 mask &= IEEE80211_CCK_RATES_MASK;
4059
4060         /* TODO: Verify that the rate is supported by the current rates
4061          * list. */
4062
4063         while (i && !(mask & i))
4064                 i >>= 1;
4065         switch (i) {
4066         case IEEE80211_CCK_RATE_1MB_MASK:
4067                 return 1000000;
4068         case IEEE80211_CCK_RATE_2MB_MASK:
4069                 return 2000000;
4070         case IEEE80211_CCK_RATE_5MB_MASK:
4071                 return 5500000;
4072         case IEEE80211_OFDM_RATE_6MB_MASK:
4073                 return 6000000;
4074         case IEEE80211_OFDM_RATE_9MB_MASK:
4075                 return 9000000;
4076         case IEEE80211_CCK_RATE_11MB_MASK:
4077                 return 11000000;
4078         case IEEE80211_OFDM_RATE_12MB_MASK:
4079                 return 12000000;
4080         case IEEE80211_OFDM_RATE_18MB_MASK:
4081                 return 18000000;
4082         case IEEE80211_OFDM_RATE_24MB_MASK:
4083                 return 24000000;
4084         case IEEE80211_OFDM_RATE_36MB_MASK:
4085                 return 36000000;
4086         case IEEE80211_OFDM_RATE_48MB_MASK:
4087                 return 48000000;
4088         case IEEE80211_OFDM_RATE_54MB_MASK:
4089                 return 54000000;
4090         }
4091
4092         if (priv->ieee->mode == IEEE_B)
4093                 return 11000000;
4094         else
4095                 return 54000000;
4096 }
4097
4098 static u32 ipw_get_current_rate(struct ipw_priv *priv)
4099 {
4100         u32 rate, len = sizeof(rate);
4101         int err;
4102
4103         if (!(priv->status & STATUS_ASSOCIATED))
4104                 return 0;
4105
4106         if (priv->tx_packets > IPW_REAL_RATE_RX_PACKET_THRESHOLD) {
4107                 err = ipw_get_ordinal(priv, IPW_ORD_STAT_TX_CURR_RATE, &rate,
4108                                       &len);
4109                 if (err) {
4110                         IPW_DEBUG_INFO("failed querying ordinals.\n");
4111                         return 0;
4112                 }
4113         } else
4114                 return ipw_get_max_rate(priv);
4115
4116         switch (rate) {
4117         case IPW_TX_RATE_1MB:
4118                 return 1000000;
4119         case IPW_TX_RATE_2MB:
4120                 return 2000000;
4121         case IPW_TX_RATE_5MB:
4122                 return 5500000;
4123         case IPW_TX_RATE_6MB:
4124                 return 6000000;
4125         case IPW_TX_RATE_9MB:
4126                 return 9000000;
4127         case IPW_TX_RATE_11MB:
4128                 return 11000000;
4129         case IPW_TX_RATE_12MB:
4130                 return 12000000;
4131         case IPW_TX_RATE_18MB:
4132                 return 18000000;
4133         case IPW_TX_RATE_24MB:
4134                 return 24000000;
4135         case IPW_TX_RATE_36MB:
4136                 return 36000000;
4137         case IPW_TX_RATE_48MB:
4138                 return 48000000;
4139         case IPW_TX_RATE_54MB:
4140                 return 54000000;
4141         }
4142
4143         return 0;
4144 }
4145
4146 #define IPW_STATS_INTERVAL (2 * HZ)
4147 static void ipw_gather_stats(struct ipw_priv *priv)
4148 {
4149         u32 rx_err, rx_err_delta, rx_packets_delta;
4150         u32 tx_failures, tx_failures_delta, tx_packets_delta;
4151         u32 missed_beacons_percent, missed_beacons_delta;
4152         u32 quality = 0;
4153         u32 len = sizeof(u32);
4154         s16 rssi;
4155         u32 beacon_quality, signal_quality, tx_quality, rx_quality,
4156             rate_quality;
4157         u32 max_rate;
4158
4159         if (!(priv->status & STATUS_ASSOCIATED)) {
4160                 priv->quality = 0;
4161                 return;
4162         }
4163
4164         /* Update the statistics */
4165         ipw_get_ordinal(priv, IPW_ORD_STAT_MISSED_BEACONS,
4166                         &priv->missed_beacons, &len);
4167         missed_beacons_delta = priv->missed_beacons - priv->last_missed_beacons;
4168         priv->last_missed_beacons = priv->missed_beacons;
4169         if (priv->assoc_request.beacon_interval) {
4170                 missed_beacons_percent = missed_beacons_delta *
4171                     (HZ * le16_to_cpu(priv->assoc_request.beacon_interval)) /
4172                     (IPW_STATS_INTERVAL * 10);
4173         } else {
4174                 missed_beacons_percent = 0;
4175         }
4176         average_add(&priv->average_missed_beacons, missed_beacons_percent);
4177
4178         ipw_get_ordinal(priv, IPW_ORD_STAT_RX_ERR_CRC, &rx_err, &len);
4179         rx_err_delta = rx_err - priv->last_rx_err;
4180         priv->last_rx_err = rx_err;
4181
4182         ipw_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURE, &tx_failures, &len);
4183         tx_failures_delta = tx_failures - priv->last_tx_failures;
4184         priv->last_tx_failures = tx_failures;
4185
4186         rx_packets_delta = priv->rx_packets - priv->last_rx_packets;
4187         priv->last_rx_packets = priv->rx_packets;
4188
4189         tx_packets_delta = priv->tx_packets - priv->last_tx_packets;
4190         priv->last_tx_packets = priv->tx_packets;
4191
4192         /* Calculate quality based on the following:
4193          *
4194          * Missed beacon: 100% = 0, 0% = 70% missed
4195          * Rate: 60% = 1Mbs, 100% = Max
4196          * Rx and Tx errors represent a straight % of total Rx/Tx
4197          * RSSI: 100% = > -50,  0% = < -80
4198          * Rx errors: 100% = 0, 0% = 50% missed
4199          *
4200          * The lowest computed quality is used.
4201          *
4202          */
4203 #define BEACON_THRESHOLD 5
4204         beacon_quality = 100 - missed_beacons_percent;
4205         if (beacon_quality < BEACON_THRESHOLD)
4206                 beacon_quality = 0;
4207         else
4208                 beacon_quality = (beacon_quality - BEACON_THRESHOLD) * 100 /
4209                     (100 - BEACON_THRESHOLD);
4210         IPW_DEBUG_STATS("Missed beacon: %3d%% (%d%%)\n",
4211                         beacon_quality, missed_beacons_percent);
4212
4213         priv->last_rate = ipw_get_current_rate(priv);
4214         max_rate = ipw_get_max_rate(priv);
4215         rate_quality = priv->last_rate * 40 / max_rate + 60;
4216         IPW_DEBUG_STATS("Rate quality : %3d%% (%dMbs)\n",
4217                         rate_quality, priv->last_rate / 1000000);
4218
4219         if (rx_packets_delta > 100 && rx_packets_delta + rx_err_delta)
4220                 rx_quality = 100 - (rx_err_delta * 100) /
4221                     (rx_packets_delta + rx_err_delta);
4222         else
4223                 rx_quality = 100;
4224         IPW_DEBUG_STATS("Rx quality   : %3d%% (%u errors, %u packets)\n",
4225                         rx_quality, rx_err_delta, rx_packets_delta);
4226
4227         if (tx_packets_delta > 100 && tx_packets_delta + tx_failures_delta)
4228                 tx_quality = 100 - (tx_failures_delta * 100) /
4229                     (tx_packets_delta + tx_failures_delta);
4230         else
4231                 tx_quality = 100;
4232         IPW_DEBUG_STATS("Tx quality   : %3d%% (%u errors, %u packets)\n",
4233                         tx_quality, tx_failures_delta, tx_packets_delta);
4234
4235         rssi = priv->exp_avg_rssi;
4236         signal_quality =
4237             (100 *
4238              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) *
4239              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) -
4240              (priv->ieee->perfect_rssi - rssi) *
4241              (15 * (priv->ieee->perfect_rssi - priv->ieee->worst_rssi) +
4242               62 * (priv->ieee->perfect_rssi - rssi))) /
4243             ((priv->ieee->perfect_rssi - priv->ieee->worst_rssi) *
4244              (priv->ieee->perfect_rssi - priv->ieee->worst_rssi));
4245         if (signal_quality > 100)
4246                 signal_quality = 100;
4247         else if (signal_quality < 1)
4248                 signal_quality = 0;
4249
4250         IPW_DEBUG_STATS("Signal level : %3d%% (%d dBm)\n",
4251                         signal_quality, rssi);
4252
4253         quality = min(beacon_quality,
4254                       min(rate_quality,
4255                           min(tx_quality, min(rx_quality, signal_quality))));
4256         if (quality == beacon_quality)
4257                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to missed beacons.\n",
4258                                 quality);
4259         if (quality == rate_quality)
4260                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to rate quality.\n",
4261                                 quality);
4262         if (quality == tx_quality)
4263                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to Tx quality.\n",
4264                                 quality);
4265         if (quality == rx_quality)
4266                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to Rx quality.\n",
4267                                 quality);
4268         if (quality == signal_quality)
4269                 IPW_DEBUG_STATS("Quality (%d%%): Clamped to signal quality.\n",
4270                                 quality);
4271
4272         priv->quality = quality;
4273
4274         queue_delayed_work(priv->workqueue, &priv->gather_stats,
4275                            IPW_STATS_INTERVAL);
4276 }
4277
4278 static void ipw_bg_gather_stats(struct work_struct *work)
4279 {
4280         struct ipw_priv *priv =
4281                 container_of(work, struct ipw_priv, gather_stats.work);
4282         mutex_lock(&priv->mutex);
4283         ipw_gather_stats(priv);
4284         mutex_unlock(&priv->mutex);
4285 }
4286
4287 /* Missed beacon behavior:
4288  * 1st missed -> roaming_threshold, just wait, don't do any scan/roam.
4289  * roaming_threshold -> disassociate_threshold, scan and roam for better signal.
4290  * Above disassociate threshold, give up and stop scanning.
4291  * Roaming is disabled if disassociate_threshold <= roaming_threshold  */
4292 static void ipw_handle_missed_beacon(struct ipw_priv *priv,
4293                                             int missed_count)
4294 {
4295         priv->notif_missed_beacons = missed_count;
4296
4297         if (missed_count > priv->disassociate_threshold &&
4298             priv->status & STATUS_ASSOCIATED) {
4299                 /* If associated and we've hit the missed
4300                  * beacon threshold, disassociate, turn
4301                  * off roaming, and abort any active scans */
4302                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
4303                           IPW_DL_STATE | IPW_DL_ASSOC,
4304                           "Missed beacon: %d - disassociate\n", missed_count);
4305                 priv->status &= ~STATUS_ROAMING;
4306                 if (priv->status & STATUS_SCANNING) {
4307                         IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
4308                                   IPW_DL_STATE,
4309                                   "Aborting scan with missed beacon.\n");
4310                         queue_work(priv->workqueue, &priv->abort_scan);
4311                 }
4312
4313                 queue_work(priv->workqueue, &priv->disassociate);
4314                 return;
4315         }
4316
4317         if (priv->status & STATUS_ROAMING) {
4318                 /* If we are currently roaming, then just
4319                  * print a debug statement... */
4320                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4321                           "Missed beacon: %d - roam in progress\n",
4322                           missed_count);
4323                 return;
4324         }
4325
4326         if (roaming &&
4327             (missed_count > priv->roaming_threshold &&
4328              missed_count <= priv->disassociate_threshold)) {
4329                 /* If we are not already roaming, set the ROAM
4330                  * bit in the status and kick off a scan.
4331                  * This can happen several times before we reach
4332                  * disassociate_threshold. */
4333                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4334                           "Missed beacon: %d - initiate "
4335                           "roaming\n", missed_count);
4336                 if (!(priv->status & STATUS_ROAMING)) {
4337                         priv->status |= STATUS_ROAMING;
4338                         if (!(priv->status & STATUS_SCANNING))
4339                                 queue_delayed_work(priv->workqueue,
4340                                                    &priv->request_scan, 0);
4341                 }
4342                 return;
4343         }
4344
4345         if (priv->status & STATUS_SCANNING) {
4346                 /* Stop scan to keep fw from getting
4347                  * stuck (only if we aren't roaming --
4348                  * otherwise we'll never scan more than 2 or 3
4349                  * channels..) */
4350                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF | IPW_DL_STATE,
4351                           "Aborting scan with missed beacon.\n");
4352                 queue_work(priv->workqueue, &priv->abort_scan);
4353         }
4354
4355         IPW_DEBUG_NOTIF("Missed beacon: %d\n", missed_count);
4356 }
4357
4358 static void ipw_scan_event(struct work_struct *work)
4359 {
4360         union iwreq_data wrqu;
4361
4362         struct ipw_priv *priv =
4363                 container_of(work, struct ipw_priv, scan_event.work);
4364
4365         wrqu.data.length = 0;
4366         wrqu.data.flags = 0;
4367         wireless_send_event(priv->net_dev, SIOCGIWSCAN, &wrqu, NULL);
4368 }
4369
4370 static void handle_scan_event(struct ipw_priv *priv)
4371 {
4372         /* Only userspace-requested scan completion events go out immediately */
4373         if (!priv->user_requested_scan) {
4374                 if (!delayed_work_pending(&priv->scan_event))
4375                         queue_delayed_work(priv->workqueue, &priv->scan_event,
4376                                          round_jiffies_relative(msecs_to_jiffies(4000)));
4377         } else {
4378                 union iwreq_data wrqu;
4379
4380                 priv->user_requested_scan = 0;
4381                 cancel_delayed_work(&priv->scan_event);
4382
4383                 wrqu.data.length = 0;
4384                 wrqu.data.flags = 0;
4385                 wireless_send_event(priv->net_dev, SIOCGIWSCAN, &wrqu, NULL);
4386         }
4387 }
4388
4389 /**
4390  * Handle host notification packet.
4391  * Called from interrupt routine
4392  */
4393 static void ipw_rx_notification(struct ipw_priv *priv,
4394                                        struct ipw_rx_notification *notif)
4395 {
4396         DECLARE_MAC_BUF(mac);
4397         u16 size = le16_to_cpu(notif->size);
4398         notif->size = le16_to_cpu(notif->size);
4399
4400         IPW_DEBUG_NOTIF("type = %i (%d bytes)\n", notif->subtype, size);
4401
4402         switch (notif->subtype) {
4403         case HOST_NOTIFICATION_STATUS_ASSOCIATED:{
4404                         struct notif_association *assoc = &notif->u.assoc;
4405
4406                         switch (assoc->state) {
4407                         case CMAS_ASSOCIATED:{
4408                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4409                                                   IPW_DL_ASSOC,
4410                                                   "associated: '%s' %s"
4411                                                   " \n",
4412                                                   escape_essid(priv->essid,
4413                                                                priv->essid_len),
4414                                                   print_mac(mac, priv->bssid));
4415
4416                                         switch (priv->ieee->iw_mode) {
4417                                         case IW_MODE_INFRA:
4418                                                 memcpy(priv->ieee->bssid,
4419                                                        priv->bssid, ETH_ALEN);
4420                                                 break;
4421
4422                                         case IW_MODE_ADHOC:
4423                                                 memcpy(priv->ieee->bssid,
4424                                                        priv->bssid, ETH_ALEN);
4425
4426                                                 /* clear out the station table */
4427                                                 priv->num_stations = 0;
4428
4429                                                 IPW_DEBUG_ASSOC
4430                                                     ("queueing adhoc check\n");
4431                                                 queue_delayed_work(priv->
4432                                                                    workqueue,
4433                                                                    &priv->
4434                                                                    adhoc_check,
4435                                                                    le16_to_cpu(priv->
4436                                                                    assoc_request.
4437                                                                    beacon_interval));
4438                                                 break;
4439                                         }
4440
4441                                         priv->status &= ~STATUS_ASSOCIATING;
4442                                         priv->status |= STATUS_ASSOCIATED;
4443                                         queue_work(priv->workqueue,
4444                                                    &priv->system_config);
4445
4446 #ifdef CONFIG_IPW2200_QOS
4447 #define IPW_GET_PACKET_STYPE(x) WLAN_FC_GET_STYPE( \
4448                          le16_to_cpu(((struct ieee80211_hdr *)(x))->frame_ctl))
4449                                         if ((priv->status & STATUS_AUTH) &&
4450                                             (IPW_GET_PACKET_STYPE(&notif->u.raw)
4451                                              == IEEE80211_STYPE_ASSOC_RESP)) {
4452                                                 if ((sizeof
4453                                                      (struct
4454                                                       ieee80211_assoc_response)
4455                                                      <= size)
4456                                                     && (size <= 2314)) {
4457                                                         struct
4458                                                         ieee80211_rx_stats
4459                                                             stats = {
4460                                                                 .len = size - 1,
4461                                                         };
4462
4463                                                         IPW_DEBUG_QOS
4464                                                             ("QoS Associate "
4465                                                              "size %d\n", size);
4466                                                         ieee80211_rx_mgt(priv->
4467                                                                          ieee,
4468                                                                          (struct
4469                                                                           ieee80211_hdr_4addr
4470                                                                           *)
4471                                                                          &notif->u.raw, &stats);
4472                                                 }
4473                                         }
4474 #endif
4475
4476                                         schedule_work(&priv->link_up);
4477
4478                                         break;
4479                                 }
4480
4481                         case CMAS_AUTHENTICATED:{
4482                                         if (priv->
4483                                             status & (STATUS_ASSOCIATED |
4484                                                       STATUS_AUTH)) {
4485                                                 struct notif_authenticate *auth
4486                                                     = &notif->u.auth;
4487                                                 IPW_DEBUG(IPW_DL_NOTIF |
4488                                                           IPW_DL_STATE |
4489                                                           IPW_DL_ASSOC,
4490                                                           "deauthenticated: '%s' "
4491                                                           "%s"
4492                                                           ": (0x%04X) - %s \n",
4493                                                           escape_essid(priv->
4494                                                                        essid,
4495                                                                        priv->
4496                                                                        essid_len),
4497                                                           print_mac(mac, priv->bssid),
4498                                                           ntohs(auth->status),
4499                                                           ipw_get_status_code
4500                                                           (ntohs
4501                                                            (auth->status)));
4502
4503                                                 priv->status &=
4504                                                     ~(STATUS_ASSOCIATING |
4505                                                       STATUS_AUTH |
4506                                                       STATUS_ASSOCIATED);
4507
4508                                                 schedule_work(&priv->link_down);
4509                                                 break;
4510                                         }
4511
4512                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4513                                                   IPW_DL_ASSOC,
4514                                                   "authenticated: '%s' %s"
4515                                                   "\n",
4516                                                   escape_essid(priv->essid,
4517                                                                priv->essid_len),
4518                                                   print_mac(mac, priv->bssid));
4519                                         break;
4520                                 }
4521
4522                         case CMAS_INIT:{
4523                                         if (priv->status & STATUS_AUTH) {
4524                                                 struct
4525                                                     ieee80211_assoc_response
4526                                                 *resp;
4527                                                 resp =
4528                                                     (struct
4529                                                      ieee80211_assoc_response
4530                                                      *)&notif->u.raw;
4531                                                 IPW_DEBUG(IPW_DL_NOTIF |
4532                                                           IPW_DL_STATE |
4533                                                           IPW_DL_ASSOC,
4534                                                           "association failed (0x%04X): %s\n",
4535                                                           ntohs(resp->status),
4536                                                           ipw_get_status_code
4537                                                           (ntohs
4538                                                            (resp->status)));
4539                                         }
4540
4541                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4542                                                   IPW_DL_ASSOC,
4543                                                   "disassociated: '%s' %s"
4544                                                   " \n",
4545                                                   escape_essid(priv->essid,
4546                                                                priv->essid_len),
4547                                                   print_mac(mac, priv->bssid));
4548
4549                                         priv->status &=
4550                                             ~(STATUS_DISASSOCIATING |
4551                                               STATUS_ASSOCIATING |
4552                                               STATUS_ASSOCIATED | STATUS_AUTH);
4553                                         if (priv->assoc_network
4554                                             && (priv->assoc_network->
4555                                                 capability &
4556                                                 WLAN_CAPABILITY_IBSS))
4557                                                 ipw_remove_current_network
4558                                                     (priv);
4559
4560                                         schedule_work(&priv->link_down);
4561
4562                                         break;
4563                                 }
4564
4565                         case CMAS_RX_ASSOC_RESP:
4566                                 break;
4567
4568                         default:
4569                                 IPW_ERROR("assoc: unknown (%d)\n",
4570                                           assoc->state);
4571                                 break;
4572                         }
4573
4574                         break;
4575                 }
4576
4577         case HOST_NOTIFICATION_STATUS_AUTHENTICATE:{
4578                         struct notif_authenticate *auth = &notif->u.auth;
4579                         switch (auth->state) {
4580                         case CMAS_AUTHENTICATED:
4581                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4582                                           "authenticated: '%s' %s \n",
4583                                           escape_essid(priv->essid,
4584                                                        priv->essid_len),
4585                                           print_mac(mac, priv->bssid));
4586                                 priv->status |= STATUS_AUTH;
4587                                 break;
4588
4589                         case CMAS_INIT:
4590                                 if (priv->status & STATUS_AUTH) {
4591                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4592                                                   IPW_DL_ASSOC,
4593                                                   "authentication failed (0x%04X): %s\n",
4594                                                   ntohs(auth->status),
4595                                                   ipw_get_status_code(ntohs
4596                                                                       (auth->
4597                                                                        status)));
4598                                 }
4599                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4600                                           IPW_DL_ASSOC,
4601                                           "deauthenticated: '%s' %s\n",
4602                                           escape_essid(priv->essid,
4603                                                        priv->essid_len),
4604                                           print_mac(mac, priv->bssid));
4605
4606                                 priv->status &= ~(STATUS_ASSOCIATING |
4607                                                   STATUS_AUTH |
4608                                                   STATUS_ASSOCIATED);
4609
4610                                 schedule_work(&priv->link_down);
4611                                 break;
4612
4613                         case CMAS_TX_AUTH_SEQ_1:
4614                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4615                                           IPW_DL_ASSOC, "AUTH_SEQ_1\n");
4616                                 break;
4617                         case CMAS_RX_AUTH_SEQ_2:
4618                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4619                                           IPW_DL_ASSOC, "AUTH_SEQ_2\n");
4620                                 break;
4621                         case CMAS_AUTH_SEQ_1_PASS:
4622                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4623                                           IPW_DL_ASSOC, "AUTH_SEQ_1_PASS\n");
4624                                 break;
4625                         case CMAS_AUTH_SEQ_1_FAIL:
4626                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4627                                           IPW_DL_ASSOC, "AUTH_SEQ_1_FAIL\n");
4628                                 break;
4629                         case CMAS_TX_AUTH_SEQ_3:
4630                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4631                                           IPW_DL_ASSOC, "AUTH_SEQ_3\n");
4632                                 break;
4633                         case CMAS_RX_AUTH_SEQ_4:
4634                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4635                                           IPW_DL_ASSOC, "RX_AUTH_SEQ_4\n");
4636                                 break;
4637                         case CMAS_AUTH_SEQ_2_PASS:
4638                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4639                                           IPW_DL_ASSOC, "AUTH_SEQ_2_PASS\n");
4640                                 break;
4641                         case CMAS_AUTH_SEQ_2_FAIL:
4642                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4643                                           IPW_DL_ASSOC, "AUT_SEQ_2_FAIL\n");
4644                                 break;
4645                         case CMAS_TX_ASSOC:
4646                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4647                                           IPW_DL_ASSOC, "TX_ASSOC\n");
4648                                 break;
4649                         case CMAS_RX_ASSOC_RESP:
4650                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4651                                           IPW_DL_ASSOC, "RX_ASSOC_RESP\n");
4652
4653                                 break;
4654                         case CMAS_ASSOCIATED:
4655                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
4656                                           IPW_DL_ASSOC, "ASSOCIATED\n");
4657                                 break;
4658                         default:
4659                                 IPW_DEBUG_NOTIF("auth: failure - %d\n",
4660                                                 auth->state);
4661                                 break;
4662                         }
4663                         break;
4664                 }
4665
4666         case HOST_NOTIFICATION_STATUS_SCAN_CHANNEL_RESULT:{
4667                         struct notif_channel_result *x =
4668                             &notif->u.channel_result;
4669
4670                         if (size == sizeof(*x)) {
4671                                 IPW_DEBUG_SCAN("Scan result for channel %d\n",
4672                                                x->channel_num);
4673                         } else {
4674                                 IPW_DEBUG_SCAN("Scan result of wrong size %d "
4675                                                "(should be %zd)\n",
4676                                                size, sizeof(*x));
4677                         }
4678                         break;
4679                 }
4680
4681         case HOST_NOTIFICATION_STATUS_SCAN_COMPLETED:{
4682                         struct notif_scan_complete *x = &notif->u.scan_complete;
4683                         if (size == sizeof(*x)) {
4684                                 IPW_DEBUG_SCAN
4685                                     ("Scan completed: type %d, %d channels, "
4686                                      "%d status\n", x->scan_type,
4687                                      x->num_channels, x->status);
4688                         } else {
4689                                 IPW_ERROR("Scan completed of wrong size %d "
4690                                           "(should be %zd)\n",
4691                                           size, sizeof(*x));
4692                         }
4693
4694                         priv->status &=
4695                             ~(STATUS_SCANNING | STATUS_SCAN_ABORTING);
4696
4697                         wake_up_interruptible(&priv->wait_state);
4698                         cancel_delayed_work(&priv->scan_check);
4699
4700                         if (priv->status & STATUS_EXIT_PENDING)
4701                                 break;
4702
4703                         priv->ieee->scans++;
4704
4705 #ifdef CONFIG_IPW2200_MONITOR
4706                         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
4707                                 priv->status |= STATUS_SCAN_FORCED;
4708                                 queue_delayed_work(priv->workqueue,
4709                                                    &priv->request_scan, 0);
4710                                 break;
4711                         }
4712                         priv->status &= ~STATUS_SCAN_FORCED;
4713 #endif                          /* CONFIG_IPW2200_MONITOR */
4714
4715                         if (!(priv->status & (STATUS_ASSOCIATED |
4716                                               STATUS_ASSOCIATING |
4717                                               STATUS_ROAMING |
4718                                               STATUS_DISASSOCIATING)))
4719                                 queue_work(priv->workqueue, &priv->associate);
4720                         else if (priv->status & STATUS_ROAMING) {
4721                                 if (x->status == SCAN_COMPLETED_STATUS_COMPLETE)
4722                                         /* If a scan completed and we are in roam mode, then
4723                                          * the scan that completed was the one requested as a
4724                                          * result of entering roam... so, schedule the
4725                                          * roam work */
4726                                         queue_work(priv->workqueue,
4727                                                    &priv->roam);
4728                                 else
4729                                         /* Don't schedule if we aborted the scan */
4730                                         priv->status &= ~STATUS_ROAMING;
4731                         } else if (priv->status & STATUS_SCAN_PENDING)
4732                                 queue_delayed_work(priv->workqueue,
4733                                                    &priv->request_scan, 0);
4734                         else if (priv->config & CFG_BACKGROUND_SCAN
4735                                  && priv->status & STATUS_ASSOCIATED)
4736                                 queue_delayed_work(priv->workqueue,
4737                                                    &priv->request_scan,
4738                                                    round_jiffies_relative(HZ));
4739
4740                         /* Send an empty event to user space.
4741                          * We don't send the received data on the event because
4742                          * it would require us to do complex transcoding, and
4743                          * we want to minimise the work done in the irq handler
4744                          * Use a request to extract the data.
4745                          * Also, we generate this even for any scan, regardless
4746                          * on how the scan was initiated. User space can just
4747                          * sync on periodic scan to get fresh data...
4748                          * Jean II */
4749                         if (x->status == SCAN_COMPLETED_STATUS_COMPLETE)
4750                                 handle_scan_event(priv);
4751                         break;
4752                 }
4753
4754         case HOST_NOTIFICATION_STATUS_FRAG_LENGTH:{
4755                         struct notif_frag_length *x = &notif->u.frag_len;
4756
4757                         if (size == sizeof(*x))
4758                                 IPW_ERROR("Frag length: %d\n",
4759                                           le16_to_cpu(x->frag_length));
4760                         else
4761                                 IPW_ERROR("Frag length of wrong size %d "
4762                                           "(should be %zd)\n",
4763                                           size, sizeof(*x));
4764                         break;
4765                 }
4766
4767         case HOST_NOTIFICATION_STATUS_LINK_DETERIORATION:{
4768                         struct notif_link_deterioration *x =
4769                             &notif->u.link_deterioration;
4770
4771                         if (size == sizeof(*x)) {
4772                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
4773                                         "link deterioration: type %d, cnt %d\n",
4774                                         x->silence_notification_type,
4775                                         x->silence_count);
4776                                 memcpy(&priv->last_link_deterioration, x,
4777                                        sizeof(*x));
4778                         } else {
4779                                 IPW_ERROR("Link Deterioration of wrong size %d "
4780                                           "(should be %zd)\n",
4781                                           size, sizeof(*x));
4782                         }
4783                         break;
4784                 }
4785
4786         case HOST_NOTIFICATION_DINO_CONFIG_RESPONSE:{
4787                         IPW_ERROR("Dino config\n");
4788                         if (priv->hcmd
4789                             && priv->hcmd->cmd != HOST_CMD_DINO_CONFIG)
4790                                 IPW_ERROR("Unexpected DINO_CONFIG_RESPONSE\n");
4791
4792                         break;
4793                 }
4794
4795         case HOST_NOTIFICATION_STATUS_BEACON_STATE:{
4796                         struct notif_beacon_state *x = &notif->u.beacon_state;
4797                         if (size != sizeof(*x)) {
4798                                 IPW_ERROR
4799                                     ("Beacon state of wrong size %d (should "
4800                                      "be %zd)\n", size, sizeof(*x));
4801                                 break;
4802                         }
4803
4804                         if (le32_to_cpu(x->state) ==
4805                             HOST_NOTIFICATION_STATUS_BEACON_MISSING)
4806                                 ipw_handle_missed_beacon(priv,
4807                                                          le32_to_cpu(x->
4808                                                                      number));
4809
4810                         break;
4811                 }
4812
4813         case HOST_NOTIFICATION_STATUS_TGI_TX_KEY:{
4814                         struct notif_tgi_tx_key *x = &notif->u.tgi_tx_key;
4815                         if (size == sizeof(*x)) {
4816                                 IPW_ERROR("TGi Tx Key: state 0x%02x sec type "
4817                                           "0x%02x station %d\n",
4818                                           x->key_state, x->security_type,
4819                                           x->station_index);
4820                                 break;
4821                         }
4822
4823                         IPW_ERROR
4824                             ("TGi Tx Key of wrong size %d (should be %zd)\n",
4825                              size, sizeof(*x));
4826                         break;
4827                 }
4828
4829         case HOST_NOTIFICATION_CALIB_KEEP_RESULTS:{
4830                         struct notif_calibration *x = &notif->u.calibration;
4831
4832                         if (size == sizeof(*x)) {
4833                                 memcpy(&priv->calib, x, sizeof(*x));
4834                                 IPW_DEBUG_INFO("TODO: Calibration\n");
4835                                 break;
4836                         }
4837
4838                         IPW_ERROR
4839                             ("Calibration of wrong size %d (should be %zd)\n",
4840                              size, sizeof(*x));
4841                         break;
4842                 }
4843
4844         case HOST_NOTIFICATION_NOISE_STATS:{
4845                         if (size == sizeof(u32)) {
4846                                 priv->exp_avg_noise =
4847                                     exponential_average(priv->exp_avg_noise,
4848                                     (u8) (le32_to_cpu(notif->u.noise.value) & 0xff),
4849                                     DEPTH_NOISE);
4850                                 break;
4851                         }
4852
4853                         IPW_ERROR
4854                             ("Noise stat is wrong size %d (should be %zd)\n",
4855                              size, sizeof(u32));
4856                         break;
4857                 }
4858
4859         default:
4860                 IPW_DEBUG_NOTIF("Unknown notification: "
4861                                 "subtype=%d,flags=0x%2x,size=%d\n",
4862                                 notif->subtype, notif->flags, size);
4863         }
4864 }
4865
4866 /**
4867  * Destroys all DMA structures and initialise them again
4868  *
4869  * @param priv
4870  * @return error code
4871  */
4872 static int ipw_queue_reset(struct ipw_priv *priv)
4873 {
4874         int rc = 0;
4875         /** @todo customize queue sizes */
4876         int nTx = 64, nTxCmd = 8;
4877         ipw_tx_queue_free(priv);
4878         /* Tx CMD queue */
4879         rc = ipw_queue_tx_init(priv, &priv->txq_cmd, nTxCmd,
4880                                IPW_TX_CMD_QUEUE_READ_INDEX,
4881                                IPW_TX_CMD_QUEUE_WRITE_INDEX,
4882                                IPW_TX_CMD_QUEUE_BD_BASE,
4883                                IPW_TX_CMD_QUEUE_BD_SIZE);
4884         if (rc) {
4885                 IPW_ERROR("Tx Cmd queue init failed\n");
4886                 goto error;
4887         }
4888         /* Tx queue(s) */
4889         rc = ipw_queue_tx_init(priv, &priv->txq[0], nTx,
4890                                IPW_TX_QUEUE_0_READ_INDEX,
4891                                IPW_TX_QUEUE_0_WRITE_INDEX,
4892                                IPW_TX_QUEUE_0_BD_BASE, IPW_TX_QUEUE_0_BD_SIZE);
4893         if (rc) {
4894                 IPW_ERROR("Tx 0 queue init failed\n");
4895                 goto error;
4896         }
4897         rc = ipw_queue_tx_init(priv, &priv->txq[1], nTx,
4898                                IPW_TX_QUEUE_1_READ_INDEX,
4899                                IPW_TX_QUEUE_1_WRITE_INDEX,
4900                                IPW_TX_QUEUE_1_BD_BASE, IPW_TX_QUEUE_1_BD_SIZE);
4901         if (rc) {
4902                 IPW_ERROR("Tx 1 queue init failed\n");
4903                 goto error;
4904         }
4905         rc = ipw_queue_tx_init(priv, &priv->txq[2], nTx,
4906                                IPW_TX_QUEUE_2_READ_INDEX,
4907                                IPW_TX_QUEUE_2_WRITE_INDEX,
4908                                IPW_TX_QUEUE_2_BD_BASE, IPW_TX_QUEUE_2_BD_SIZE);
4909         if (rc) {
4910                 IPW_ERROR("Tx 2 queue init failed\n");
4911                 goto error;
4912         }
4913         rc = ipw_queue_tx_init(priv, &priv->txq[3], nTx,
4914                                IPW_TX_QUEUE_3_READ_INDEX,
4915                                IPW_TX_QUEUE_3_WRITE_INDEX,
4916                                IPW_TX_QUEUE_3_BD_BASE, IPW_TX_QUEUE_3_BD_SIZE);
4917         if (rc) {
4918                 IPW_ERROR("Tx 3 queue init failed\n");
4919                 goto error;
4920         }
4921         /* statistics */
4922         priv->rx_bufs_min = 0;
4923         priv->rx_pend_max = 0;
4924         return rc;
4925
4926       error:
4927         ipw_tx_queue_free(priv);
4928         return rc;
4929 }
4930
4931 /**
4932  * Reclaim Tx queue entries no more used by NIC.
4933  *
4934  * When FW advances 'R' index, all entries between old and
4935  * new 'R' index need to be reclaimed. As result, some free space
4936  * forms. If there is enough free space (> low mark), wake Tx queue.
4937  *
4938  * @note Need to protect against garbage in 'R' index
4939  * @param priv
4940  * @param txq
4941  * @param qindex
4942  * @return Number of used entries remains in the queue
4943  */
4944 static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
4945                                 struct clx2_tx_queue *txq, int qindex)
4946 {
4947         u32 hw_tail;
4948         int used;
4949         struct clx2_queue *q = &txq->q;
4950
4951         hw_tail = ipw_read32(priv, q->reg_r);
4952         if (hw_tail >= q->n_bd) {
4953                 IPW_ERROR
4954                     ("Read index for DMA queue (%d) is out of range [0-%d)\n",
4955                      hw_tail, q->n_bd);
4956                 goto done;
4957         }
4958         for (; q->last_used != hw_tail;
4959              q->last_used = ipw_queue_inc_wrap(q->last_used, q->n_bd)) {
4960                 ipw_queue_tx_free_tfd(priv, txq);
4961                 priv->tx_packets++;
4962         }
4963       done:
4964         if ((ipw_tx_queue_space(q) > q->low_mark) &&
4965             (qindex >= 0) &&
4966             (priv->status & STATUS_ASSOCIATED) && netif_running(priv->net_dev))
4967                 netif_wake_queue(priv->net_dev);
4968         used = q->first_empty - q->last_used;
4969         if (used < 0)
4970                 used += q->n_bd;
4971
4972         return used;
4973 }
4974
4975 static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
4976                              int len, int sync)
4977 {
4978         struct clx2_tx_queue *txq = &priv->txq_cmd;
4979         struct clx2_queue *q = &txq->q;
4980         struct tfd_frame *tfd;
4981
4982         if (ipw_tx_queue_space(q) < (sync ? 1 : 2)) {
4983                 IPW_ERROR("No space for Tx\n");
4984                 return -EBUSY;
4985         }
4986
4987         tfd = &txq->bd[q->first_empty];
4988         txq->txb[q->first_empty] = NULL;
4989
4990         memset(tfd, 0, sizeof(*tfd));
4991         tfd->control_flags.message_type = TX_HOST_COMMAND_TYPE;
4992         tfd->control_flags.control_bits = TFD_NEED_IRQ_MASK;
4993         priv->hcmd_seq++;
4994         tfd->u.cmd.index = hcmd;
4995         tfd->u.cmd.length = len;
4996         memcpy(tfd->u.cmd.payload, buf, len);
4997         q->first_empty = ipw_queue_inc_wrap(q->first_empty, q->n_bd);
4998         ipw_write32(priv, q->reg_w, q->first_empty);
4999         _ipw_read32(priv, 0x90);
5000
5001         return 0;
5002 }
5003
5004 /*
5005  * Rx theory of operation
5006  *
5007  * The host allocates 32 DMA target addresses and passes the host address
5008  * to the firmware at register IPW_RFDS_TABLE_LOWER + N * RFD_SIZE where N is
5009  * 0 to 31
5010  *
5011  * Rx Queue Indexes
5012  * The host/firmware share two index registers for managing the Rx buffers.
5013  *
5014  * The READ index maps to the first position that the firmware may be writing
5015  * to -- the driver can read up to (but not including) this position and get
5016  * good data.
5017  * The READ index is managed by the firmware once the card is enabled.
5018  *
5019  * The WRITE index maps to the last position the driver has read from -- the
5020  * position preceding WRITE is the last slot the firmware can place a packet.
5021  *
5022  * The queue is empty (no good data) if WRITE = READ - 1, and is full if
5023  * WRITE = READ.
5024  *
5025  * During initialization the host sets up the READ queue position to the first
5026  * INDEX position, and WRITE to the last (READ - 1 wrapped)
5027  *
5028  * When the firmware places a packet in a buffer it will advance the READ index
5029  * and fire the RX interrupt.  The driver can then query the READ index and
5030  * process as many packets as possible, moving the WRITE index forward as it
5031  * resets the Rx queue buffers with new memory.
5032  *
5033  * The management in the driver is as follows:
5034  * + A list of pre-allocated SKBs is stored in ipw->rxq->rx_free.  When
5035  *   ipw->rxq->free_count drops to or below RX_LOW_WATERMARK, work is scheduled
5036  *   to replensish the ipw->rxq->rx_free.
5037  * + In ipw_rx_queue_replenish (scheduled) if 'processed' != 'read' then the
5038  *   ipw->rxq is replenished and the READ INDEX is updated (updating the
5039  *   'processed' and 'read' driver indexes as well)
5040  * + A received packet is processed and handed to the kernel network stack,
5041  *   detached from the ipw->rxq.  The driver 'processed' index is updated.
5042  * + The Host/Firmware ipw->rxq is replenished at tasklet time from the rx_free
5043  *   list. If there are no allocated buffers in ipw->rxq->rx_free, the READ
5044  *   INDEX is not incremented and ipw->status(RX_STALLED) is set.  If there
5045  *   were enough free buffers and RX_STALLED is set it is cleared.
5046  *
5047  *
5048  * Driver sequence:
5049  *
5050  * ipw_rx_queue_alloc()       Allocates rx_free
5051  * ipw_rx_queue_replenish()   Replenishes rx_free list from rx_used, and calls
5052  *                            ipw_rx_queue_restock
5053  * ipw_rx_queue_restock()     Moves available buffers from rx_free into Rx
5054  *                            queue, updates firmware pointers, and updates
5055  *                            the WRITE index.  If insufficient rx_free buffers
5056  *                            are available, schedules ipw_rx_queue_replenish
5057  *
5058  * -- enable interrupts --
5059  * ISR - ipw_rx()             Detach ipw_rx_mem_buffers from pool up to the
5060  *                            READ INDEX, detaching the SKB from the pool.
5061  *                            Moves the packet buffer from queue to rx_used.
5062  *                            Calls ipw_rx_queue_restock to refill any empty
5063  *                            slots.
5064  * ...
5065  *
5066  */
5067
5068 /*
5069  * If there are slots in the RX queue that  need to be restocked,
5070  * and we have free pre-allocated buffers, fill the ranks as much
5071  * as we can pulling from rx_free.
5072  *
5073  * This moves the 'write' index forward to catch up with 'processed', and
5074  * also updates the memory address in the firmware to reference the new
5075  * target buffer.
5076  */
5077 static void ipw_rx_queue_restock(struct ipw_priv *priv)
5078 {
5079         struct ipw_rx_queue *rxq = priv->rxq;
5080         struct list_head *element;
5081         struct ipw_rx_mem_buffer *rxb;
5082         unsigned long flags;
5083         int write;
5084
5085         spin_lock_irqsave(&rxq->lock, flags);
5086         write = rxq->write;
5087         while ((ipw_rx_queue_space(rxq) > 0) && (rxq->free_count)) {
5088                 element = rxq->rx_free.next;
5089                 rxb = list_entry(element, struct ipw_rx_mem_buffer, list);
5090                 list_del(element);
5091
5092                 ipw_write32(priv, IPW_RFDS_TABLE_LOWER + rxq->write * RFD_SIZE,
5093                             rxb->dma_addr);
5094                 rxq->queue[rxq->write] = rxb;
5095                 rxq->write = (rxq->write + 1) % RX_QUEUE_SIZE;
5096                 rxq->free_count--;
5097         }
5098         spin_unlock_irqrestore(&rxq->lock, flags);
5099
5100         /* If the pre-allocated buffer pool is dropping low, schedule to
5101          * refill it */
5102         if (rxq->free_count <= RX_LOW_WATERMARK)
5103                 queue_work(priv->workqueue, &priv->rx_replenish);
5104
5105         /* If we've added more space for the firmware to place data, tell it */
5106         if (write != rxq->write)
5107                 ipw_write32(priv, IPW_RX_WRITE_INDEX, rxq->write);
5108 }
5109
5110 /*
5111  * Move all used packet from rx_used to rx_free, allocating a new SKB for each.
5112  * Also restock the Rx queue via ipw_rx_queue_restock.
5113  *
5114  * This is called as a scheduled work item (except for during intialization)
5115  */
5116 static void ipw_rx_queue_replenish(void *data)
5117 {
5118         struct ipw_priv *priv = data;
5119         struct ipw_rx_queue *rxq = priv->rxq;
5120         struct list_head *element;
5121         struct ipw_rx_mem_buffer *rxb;
5122         unsigned long flags;
5123
5124         spin_lock_irqsave(&rxq->lock, flags);
5125         while (!list_empty(&rxq->rx_used)) {
5126                 element = rxq->rx_used.next;
5127                 rxb = list_entry(element, struct ipw_rx_mem_buffer, list);
5128                 rxb->skb = alloc_skb(IPW_RX_BUF_SIZE, GFP_ATOMIC);
5129                 if (!rxb->skb) {
5130                         printk(KERN_CRIT "%s: Can not allocate SKB buffers.\n",
5131                                priv->net_dev->name);
5132                         /* We don't reschedule replenish work here -- we will
5133                          * call the restock method and if it still needs
5134                          * more buffers it will schedule replenish */
5135                         break;
5136                 }
5137                 list_del(element);
5138
5139                 rxb->dma_addr =
5140                     pci_map_single(priv->pci_dev, rxb->skb->data,
5141                                    IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
5142
5143                 list_add_tail(&rxb->list, &rxq->rx_free);
5144                 rxq->free_count++;
5145         }
5146         spin_unlock_irqrestore(&rxq->lock, flags);
5147
5148         ipw_rx_queue_restock(priv);
5149 }
5150
5151 static void ipw_bg_rx_queue_replenish(struct work_struct *work)
5152 {
5153         struct ipw_priv *priv =
5154                 container_of(work, struct ipw_priv, rx_replenish);
5155         mutex_lock(&priv->mutex);
5156         ipw_rx_queue_replenish(priv);
5157         mutex_unlock(&priv->mutex);
5158 }
5159
5160 /* Assumes that the skb field of the buffers in 'pool' is kept accurate.
5161  * If an SKB has been detached, the POOL needs to have its SKB set to NULL
5162  * This free routine walks the list of POOL entries and if SKB is set to
5163  * non NULL it is unmapped and freed
5164  */
5165 static void ipw_rx_queue_free(struct ipw_priv *priv, struct ipw_rx_queue *rxq)
5166 {
5167         int i;
5168
5169         if (!rxq)
5170                 return;
5171
5172         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
5173                 if (rxq->pool[i].skb != NULL) {
5174                         pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
5175                                          IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
5176                         dev_kfree_skb(rxq->pool[i].skb);
5177                 }
5178         }
5179
5180         kfree(rxq);
5181 }
5182
5183 static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *priv)
5184 {
5185         struct ipw_rx_queue *rxq;
5186         int i;
5187
5188         rxq = kzalloc(sizeof(*rxq), GFP_KERNEL);
5189         if (unlikely(!rxq)) {
5190                 IPW_ERROR("memory allocation failed\n");
5191                 return NULL;
5192         }
5193         spin_lock_init(&rxq->lock);
5194         INIT_LIST_HEAD(&rxq->rx_free);
5195         INIT_LIST_HEAD(&rxq->rx_used);
5196
5197         /* Fill the rx_used queue with _all_ of the Rx buffers */
5198         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++)
5199                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
5200
5201         /* Set us so that we have processed and used all buffers, but have
5202          * not restocked the Rx queue with fresh buffers */
5203         rxq->read = rxq->write = 0;
5204         rxq->free_count = 0;
5205
5206         return rxq;
5207 }
5208
5209 static int ipw_is_rate_in_mask(struct ipw_priv *priv, int ieee_mode, u8 rate)
5210 {
5211         rate &= ~IEEE80211_BASIC_RATE_MASK;
5212         if (ieee_mode == IEEE_A) {
5213                 switch (rate) {
5214                 case IEEE80211_OFDM_RATE_6MB:
5215                         return priv->rates_mask & IEEE80211_OFDM_RATE_6MB_MASK ?
5216                             1 : 0;
5217                 case IEEE80211_OFDM_RATE_9MB:
5218                         return priv->rates_mask & IEEE80211_OFDM_RATE_9MB_MASK ?
5219                             1 : 0;
5220                 case IEEE80211_OFDM_RATE_12MB:
5221                         return priv->
5222                             rates_mask & IEEE80211_OFDM_RATE_12MB_MASK ? 1 : 0;
5223                 case IEEE80211_OFDM_RATE_18MB:
5224                         return priv->
5225                             rates_mask & IEEE80211_OFDM_RATE_18MB_MASK ? 1 : 0;
5226                 case IEEE80211_OFDM_RATE_24MB:
5227                         return priv->
5228                             rates_mask & IEEE80211_OFDM_RATE_24MB_MASK ? 1 : 0;
5229                 case IEEE80211_OFDM_RATE_36MB:
5230                         return priv->
5231                             rates_mask & IEEE80211_OFDM_RATE_36MB_MASK ? 1 : 0;
5232                 case IEEE80211_OFDM_RATE_48MB:
5233                         return priv->
5234                             rates_mask & IEEE80211_OFDM_RATE_48MB_MASK ? 1 : 0;
5235                 case IEEE80211_OFDM_RATE_54MB:
5236                         return priv->
5237                             rates_mask & IEEE80211_OFDM_RATE_54MB_MASK ? 1 : 0;
5238                 default:
5239                         return 0;
5240                 }
5241         }
5242
5243         /* B and G mixed */
5244         switch (rate) {
5245         case IEEE80211_CCK_RATE_1MB:
5246                 return priv->rates_mask & IEEE80211_CCK_RATE_1MB_MASK ? 1 : 0;
5247         case IEEE80211_CCK_RATE_2MB:
5248                 return priv->rates_mask & IEEE80211_CCK_RATE_2MB_MASK ? 1 : 0;
5249         case IEEE80211_CCK_RATE_5MB:
5250                 return priv->rates_mask & IEEE80211_CCK_RATE_5MB_MASK ? 1 : 0;
5251         case IEEE80211_CCK_RATE_11MB:
5252                 return priv->rates_mask & IEEE80211_CCK_RATE_11MB_MASK ? 1 : 0;
5253         }
5254
5255         /* If we are limited to B modulations, bail at this point */
5256         if (ieee_mode == IEEE_B)
5257                 return 0;
5258
5259         /* G */
5260         switch (rate) {
5261         case IEEE80211_OFDM_RATE_6MB:
5262                 return priv->rates_mask & IEEE80211_OFDM_RATE_6MB_MASK ? 1 : 0;
5263         case IEEE80211_OFDM_RATE_9MB:
5264                 return priv->rates_mask & IEEE80211_OFDM_RATE_9MB_MASK ? 1 : 0;
5265         case IEEE80211_OFDM_RATE_12MB:
5266                 return priv->rates_mask & IEEE80211_OFDM_RATE_12MB_MASK ? 1 : 0;
5267         case IEEE80211_OFDM_RATE_18MB:
5268                 return priv->rates_mask & IEEE80211_OFDM_RATE_18MB_MASK ? 1 : 0;
5269         case IEEE80211_OFDM_RATE_24MB:
5270                 return priv->rates_mask & IEEE80211_OFDM_RATE_24MB_MASK ? 1 : 0;
5271         case IEEE80211_OFDM_RATE_36MB:
5272                 return priv->rates_mask & IEEE80211_OFDM_RATE_36MB_MASK ? 1 : 0;
5273         case IEEE80211_OFDM_RATE_48MB:
5274                 return priv->rates_mask & IEEE80211_OFDM_RATE_48MB_MASK ? 1 : 0;
5275         case IEEE80211_OFDM_RATE_54MB:
5276                 return priv->rates_mask & IEEE80211_OFDM_RATE_54MB_MASK ? 1 : 0;
5277         }
5278
5279         return 0;
5280 }
5281
5282 static int ipw_compatible_rates(struct ipw_priv *priv,
5283                                 const struct ieee80211_network *network,
5284                                 struct ipw_supported_rates *rates)
5285 {
5286         int num_rates, i;
5287
5288         memset(rates, 0, sizeof(*rates));
5289         num_rates = min(network->rates_len, (u8) IPW_MAX_RATES);
5290         rates->num_rates = 0;
5291         for (i = 0; i < num_rates; i++) {
5292                 if (!ipw_is_rate_in_mask(priv, network->mode,
5293                                          network->rates[i])) {
5294
5295                         if (network->rates[i] & IEEE80211_BASIC_RATE_MASK) {
5296                                 IPW_DEBUG_SCAN("Adding masked mandatory "
5297                                                "rate %02X\n",
5298                                                network->rates[i]);
5299                                 rates->supported_rates[rates->num_rates++] =
5300                                     network->rates[i];
5301                                 continue;
5302                         }
5303
5304                         IPW_DEBUG_SCAN("Rate %02X masked : 0x%08X\n",
5305                                        network->rates[i], priv->rates_mask);
5306                         continue;
5307                 }
5308
5309                 rates->supported_rates[rates->num_rates++] = network->rates[i];
5310         }
5311
5312         num_rates = min(network->rates_ex_len,
5313                         (u8) (IPW_MAX_RATES - num_rates));
5314         for (i = 0; i < num_rates; i++) {
5315                 if (!ipw_is_rate_in_mask(priv, network->mode,
5316                                          network->rates_ex[i])) {
5317                         if (network->rates_ex[i] & IEEE80211_BASIC_RATE_MASK) {
5318                                 IPW_DEBUG_SCAN("Adding masked mandatory "
5319                                                "rate %02X\n",
5320                                                network->rates_ex[i]);
5321                                 rates->supported_rates[rates->num_rates++] =
5322                                     network->rates[i];
5323                                 continue;
5324                         }
5325
5326                         IPW_DEBUG_SCAN("Rate %02X masked : 0x%08X\n",
5327                                        network->rates_ex[i], priv->rates_mask);
5328                         continue;
5329                 }
5330
5331                 rates->supported_rates[rates->num_rates++] =
5332                     network->rates_ex[i];
5333         }
5334
5335         return 1;
5336 }
5337
5338 static void ipw_copy_rates(struct ipw_supported_rates *dest,
5339                                   const struct ipw_supported_rates *src)
5340 {
5341         u8 i;
5342         for (i = 0; i < src->num_rates; i++)
5343                 dest->supported_rates[i] = src->supported_rates[i];
5344         dest->num_rates = src->num_rates;
5345 }
5346
5347 /* TODO: Look at sniffed packets in the air to determine if the basic rate
5348  * mask should ever be used -- right now all callers to add the scan rates are
5349  * set with the modulation = CCK, so BASIC_RATE_MASK is never set... */
5350 static void ipw_add_cck_scan_rates(struct ipw_supported_rates *rates,
5351                                    u8 modulation, u32 rate_mask)
5352 {
5353         u8 basic_mask = (IEEE80211_OFDM_MODULATION == modulation) ?
5354             IEEE80211_BASIC_RATE_MASK : 0;
5355
5356         if (rate_mask & IEEE80211_CCK_RATE_1MB_MASK)
5357                 rates->supported_rates[rates->num_rates++] =
5358                     IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
5359
5360         if (rate_mask & IEEE80211_CCK_RATE_2MB_MASK)
5361                 rates->supported_rates[rates->num_rates++] =
5362                     IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
5363
5364         if (rate_mask & IEEE80211_CCK_RATE_5MB_MASK)
5365                 rates->supported_rates[rates->num_rates++] = basic_mask |
5366                     IEEE80211_CCK_RATE_5MB;
5367
5368         if (rate_mask & IEEE80211_CCK_RATE_11MB_MASK)
5369                 rates->supported_rates[rates->num_rates++] = basic_mask |
5370                     IEEE80211_CCK_RATE_11MB;
5371 }
5372
5373 static void ipw_add_ofdm_scan_rates(struct ipw_supported_rates *rates,
5374                                     u8 modulation, u32 rate_mask)
5375 {
5376         u8 basic_mask = (IEEE80211_OFDM_MODULATION == modulation) ?
5377             IEEE80211_BASIC_RATE_MASK : 0;
5378
5379         if (rate_mask & IEEE80211_OFDM_RATE_6MB_MASK)
5380                 rates->supported_rates[rates->num_rates++] = basic_mask |
5381                     IEEE80211_OFDM_RATE_6MB;
5382
5383         if (rate_mask & IEEE80211_OFDM_RATE_9MB_MASK)
5384                 rates->supported_rates[rates->num_rates++] =
5385                     IEEE80211_OFDM_RATE_9MB;
5386
5387         if (rate_mask & IEEE80211_OFDM_RATE_12MB_MASK)
5388                 rates->supported_rates[rates->num_rates++] = basic_mask |
5389                     IEEE80211_OFDM_RATE_12MB;
5390
5391         if (rate_mask & IEEE80211_OFDM_RATE_18MB_MASK)
5392                 rates->supported_rates[rates->num_rates++] =
5393                     IEEE80211_OFDM_RATE_18MB;
5394
5395         if (rate_mask & IEEE80211_OFDM_RATE_24MB_MASK)
5396                 rates->supported_rates[rates->num_rates++] = basic_mask |
5397                     IEEE80211_OFDM_RATE_24MB;
5398
5399         if (rate_mask & IEEE80211_OFDM_RATE_36MB_MASK)
5400                 rates->supported_rates[rates->num_rates++] =
5401                     IEEE80211_OFDM_RATE_36MB;
5402
5403         if (rate_mask & IEEE80211_OFDM_RATE_48MB_MASK)
5404                 rates->supported_rates[rates->num_rates++] =
5405                     IEEE80211_OFDM_RATE_48MB;
5406
5407         if (rate_mask & IEEE80211_OFDM_RATE_54MB_MASK)
5408                 rates->supported_rates[rates->num_rates++] =
5409                     IEEE80211_OFDM_RATE_54MB;
5410 }
5411
5412 struct ipw_network_match {
5413         struct ieee80211_network *network;
5414         struct ipw_supported_rates rates;
5415 };
5416
5417 static int ipw_find_adhoc_network(struct ipw_priv *priv,
5418                                   struct ipw_network_match *match,
5419                                   struct ieee80211_network *network,
5420                                   int roaming)
5421 {
5422         struct ipw_supported_rates rates;
5423         DECLARE_MAC_BUF(mac);
5424         DECLARE_MAC_BUF(mac2);
5425
5426         /* Verify that this network's capability is compatible with the
5427          * current mode (AdHoc or Infrastructure) */
5428         if ((priv->ieee->iw_mode == IW_MODE_ADHOC &&
5429              !(network->capability & WLAN_CAPABILITY_IBSS))) {
5430                 IPW_DEBUG_MERGE("Network '%s (%s)' excluded due to "
5431                                 "capability mismatch.\n",
5432                                 escape_essid(network->ssid, network->ssid_len),
5433                                 print_mac(mac, network->bssid));
5434                 return 0;
5435         }
5436
5437         /* If we do not have an ESSID for this AP, we can not associate with
5438          * it */
5439         if (network->flags & NETWORK_EMPTY_ESSID) {
5440                 IPW_DEBUG_MERGE("Network '%s (%s)' excluded "
5441                                 "because of hidden ESSID.\n",
5442                                 escape_essid(network->ssid, network->ssid_len),
5443                                 print_mac(mac, network->bssid));
5444                 return 0;
5445         }
5446
5447         if (unlikely(roaming)) {
5448                 /* If we are roaming, then ensure check if this is a valid
5449                  * network to try and roam to */
5450                 if ((network->ssid_len != match->network->ssid_len) ||
5451                     memcmp(network->ssid, match->network->ssid,
5452                            network->ssid_len)) {
5453                         IPW_DEBUG_MERGE("Network '%s (%s)' excluded "
5454                                         "because of non-network ESSID.\n",
5455                                         escape_essid(network->ssid,
5456                                                      network->ssid_len),
5457                                         print_mac(mac, network->bssid));
5458                         return 0;
5459                 }
5460         } else {
5461                 /* If an ESSID has been configured then compare the broadcast
5462                  * ESSID to ours */
5463                 if ((priv->config & CFG_STATIC_ESSID) &&
5464                     ((network->ssid_len != priv->essid_len) ||
5465                      memcmp(network->ssid, priv->essid,
5466                             min(network->ssid_len, priv->essid_len)))) {
5467                         char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
5468
5469                         strncpy(escaped,
5470                                 escape_essid(network->ssid, network->ssid_len),
5471                                 sizeof(escaped));
5472                         IPW_DEBUG_MERGE("Network '%s (%s)' excluded "
5473                                         "because of ESSID mismatch: '%s'.\n",
5474                                         escaped, print_mac(mac, network->bssid),
5475                                         escape_essid(priv->essid,
5476                                                      priv->essid_len));
5477                         return 0;
5478                 }
5479         }
5480
5481         /* If the old network rate is better than this one, don't bother
5482          * testing everything else. */
5483
5484         if (network->time_stamp[0] < match->network->time_stamp[0]) {
5485                 IPW_DEBUG_MERGE("Network '%s excluded because newer than "
5486                                 "current network.\n",
5487                                 escape_essid(match->network->ssid,
5488                                              match->network->ssid_len));
5489                 return 0;
5490         } else if (network->time_stamp[1] < match->network->time_stamp[1]) {
5491                 IPW_DEBUG_MERGE("Network '%s excluded because newer than "
5492                                 "current network.\n",
5493                                 escape_essid(match->network->ssid,
5494                                              match->network->ssid_len));
5495                 return 0;
5496         }
5497
5498         /* Now go through and see if the requested network is valid... */
5499         if (priv->ieee->scan_age != 0 &&
5500             time_after(jiffies, network->last_scanned + priv->ieee->scan_age)) {
5501                 IPW_DEBUG_MERGE("Network '%s (%s)' excluded "
5502                                 "because of age: %ums.\n",
5503                                 escape_essid(network->ssid, network->ssid_len),
5504                                 print_mac(mac, network->bssid),
5505                                 jiffies_to_msecs(jiffies -
5506                                                  network->last_scanned));
5507                 return 0;
5508         }
5509
5510         if ((priv->config & CFG_STATIC_CHANNEL) &&
5511             (network->channel != priv->channel)) {
5512                 IPW_DEBUG_MERGE("Network '%s (%s)' excluded "
5513                                 "because of channel mismatch: %d != %d.\n",
5514                                 escape_essid(network->ssid, network->ssid_len),
5515                                 print_mac(mac, network->bssid),
5516                                 network->channel, priv->channel);
5517                 return 0;
5518         }
5519
5520         /* Verify privacy compatability */
5521         if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
5522             ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
5523                 IPW_DEBUG_MERGE("Network '%s (%s)' excluded "
5524                                 "because of privacy mismatch: %s != %s.\n",
5525                                 escape_essid(network->ssid, network->ssid_len),
5526                                 print_mac(mac, network->bssid),
5527                                 priv->
5528                                 capability & CAP_PRIVACY_ON ? "on" : "off",
5529                                 network->
5530                                 capability & WLAN_CAPABILITY_PRIVACY ? "on" :
5531                                 "off");
5532                 return 0;
5533         }
5534
5535         if (!memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
5536                 IPW_DEBUG_MERGE("Network '%s (%s)' excluded "
5537                                 "because of the same BSSID match: %s"
5538                                 ".\n", escape_essid(network->ssid,
5539                                                     network->ssid_len),
5540                                 print_mac(mac, network->bssid),
5541                                 print_mac(mac2, priv->bssid));
5542                 return 0;
5543         }
5544
5545         /* Filter out any incompatible freq / mode combinations */
5546         if (!ieee80211_is_valid_mode(priv->ieee, network->mode)) {
5547                 IPW_DEBUG_MERGE("Network '%s (%s)' excluded "
5548                                 "because of invalid frequency/mode "
5549                                 "combination.\n",
5550                                 escape_essid(network->ssid, network->ssid_len),
5551                                 print_mac(mac, network->bssid));
5552                 return 0;
5553         }
5554
5555         /* Ensure that the rates supported by the driver are compatible with
5556          * this AP, including verification of basic rates (mandatory) */
5557         if (!ipw_compatible_rates(priv, network, &rates)) {
5558                 IPW_DEBUG_MERGE("Network '%s (%s)' excluded "
5559                                 "because configured rate mask excludes "
5560                                 "AP mandatory rate.\n",
5561                                 escape_essid(network->ssid, network->ssid_len),
5562                                 print_mac(mac, network->bssid));
5563                 return 0;
5564         }
5565
5566         if (rates.num_rates == 0) {
5567                 IPW_DEBUG_MERGE("Network '%s (%s)' excluded "
5568                                 "because of no compatible rates.\n",
5569                                 escape_essid(network->ssid, network->ssid_len),
5570                                 print_mac(mac, network->bssid));
5571                 return 0;
5572         }
5573
5574         /* TODO: Perform any further minimal comparititive tests.  We do not
5575          * want to put too much policy logic here; intelligent scan selection
5576          * should occur within a generic IEEE 802.11 user space tool.  */
5577
5578         /* Set up 'new' AP to this network */
5579         ipw_copy_rates(&match->rates, &rates);
5580         match->network = network;
5581         IPW_DEBUG_MERGE("Network '%s (%s)' is a viable match.\n",
5582                         escape_essid(network->ssid, network->ssid_len),
5583                         print_mac(mac, network->bssid));
5584
5585         return 1;
5586 }
5587
5588 static void ipw_merge_adhoc_network(struct work_struct *work)
5589 {
5590         struct ipw_priv *priv =
5591                 container_of(work, struct ipw_priv, merge_networks);
5592         struct ieee80211_network *network = NULL;
5593         struct ipw_network_match match = {
5594                 .network = priv->assoc_network
5595         };
5596
5597         if ((priv->status & STATUS_ASSOCIATED) &&
5598             (priv->ieee->iw_mode == IW_MODE_ADHOC)) {
5599                 /* First pass through ROAM process -- look for a better
5600                  * network */
5601                 unsigned long flags;
5602
5603                 spin_lock_irqsave(&priv->ieee->lock, flags);
5604                 list_for_each_entry(network, &priv->ieee->network_list, list) {
5605                         if (network != priv->assoc_network)
5606                                 ipw_find_adhoc_network(priv, &match, network,
5607                                                        1);
5608                 }
5609                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
5610
5611                 if (match.network == priv->assoc_network) {
5612                         IPW_DEBUG_MERGE("No better ADHOC in this network to "
5613                                         "merge to.\n");
5614                         return;
5615                 }
5616
5617                 mutex_lock(&priv->mutex);
5618                 if ((priv->ieee->iw_mode == IW_MODE_ADHOC)) {
5619                         IPW_DEBUG_MERGE("remove network %s\n",
5620                                         escape_essid(priv->essid,
5621                                                      priv->essid_len));
5622                         ipw_remove_current_network(priv);
5623                 }
5624
5625                 ipw_disassociate(priv);
5626                 priv->assoc_network = match.network;
5627                 mutex_unlock(&priv->mutex);
5628                 return;
5629         }
5630 }
5631
5632 static int ipw_best_network(struct ipw_priv *priv,
5633                             struct ipw_network_match *match,
5634                             struct ieee80211_network *network, int roaming)
5635 {
5636         struct ipw_supported_rates rates;
5637         DECLARE_MAC_BUF(mac);
5638
5639         /* Verify that this network's capability is compatible with the
5640          * current mode (AdHoc or Infrastructure) */
5641         if ((priv->ieee->iw_mode == IW_MODE_INFRA &&
5642              !(network->capability & WLAN_CAPABILITY_ESS)) ||
5643             (priv->ieee->iw_mode == IW_MODE_ADHOC &&
5644              !(network->capability & WLAN_CAPABILITY_IBSS))) {
5645                 IPW_DEBUG_ASSOC("Network '%s (%s)' excluded due to "
5646                                 "capability mismatch.\n",
5647                                 escape_essid(network->ssid, network->ssid_len),
5648                                 print_mac(mac, network->bssid));
5649                 return 0;
5650         }
5651
5652         /* If we do not have an ESSID for this AP, we can not associate with
5653          * it */
5654         if (network->flags & NETWORK_EMPTY_ESSID) {
5655                 IPW_DEBUG_ASSOC("Network '%s (%s)' excluded "
5656                                 "because of hidden ESSID.\n",
5657                                 escape_essid(network->ssid, network->ssid_len),
5658                                 print_mac(mac, network->bssid));
5659                 return 0;
5660         }
5661
5662         if (unlikely(roaming)) {
5663                 /* If we are roaming, then ensure check if this is a valid
5664                  * network to try and roam to */
5665                 if ((network->ssid_len != match->network->ssid_len) ||
5666                     memcmp(network->ssid, match->network->ssid,
5667                            network->ssid_len)) {
5668                         IPW_DEBUG_ASSOC("Network '%s (%s)' excluded "
5669                                         "because of non-network ESSID.\n",
5670                                         escape_essid(network->ssid,
5671                                                      network->ssid_len),
5672                                         print_mac(mac, network->bssid));
5673                         return 0;
5674                 }
5675         } else {
5676                 /* If an ESSID has been configured then compare the broadcast
5677                  * ESSID to ours */
5678                 if ((priv->config & CFG_STATIC_ESSID) &&
5679                     ((network->ssid_len != priv->essid_len) ||
5680                      memcmp(network->ssid, priv->essid,
5681                             min(network->ssid_len, priv->essid_len)))) {
5682                         char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
5683                         strncpy(escaped,
5684                                 escape_essid(network->ssid, network->ssid_len),
5685                                 sizeof(escaped));
5686                         IPW_DEBUG_ASSOC("Network '%s (%s)' excluded "
5687                                         "because of ESSID mismatch: '%s'.\n",
5688                                         escaped, print_mac(mac, network->bssid),
5689                                         escape_essid(priv->essid,
5690                                                      priv->essid_len));
5691                         return 0;
5692                 }
5693         }
5694
5695         /* If the old network rate is better than this one, don't bother
5696          * testing everything else. */
5697         if (match->network && match->network->stats.rssi > network->stats.rssi) {
5698                 char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
5699                 strncpy(escaped,
5700                         escape_essid(network->ssid, network->ssid_len),
5701                         sizeof(escaped));
5702                 IPW_DEBUG_ASSOC("Network '%s (%s)' excluded because "
5703                                 "'%s (%s)' has a stronger signal.\n",
5704                                 escaped, print_mac(mac, network->bssid),
5705                                 escape_essid(match->network->ssid,
5706                                              match->network->ssid_len),
5707                                 print_mac(mac, match->network->bssid));
5708                 return 0;
5709         }
5710
5711         /* If this network has already had an association attempt within the
5712          * last 3 seconds, do not try and associate again... */
5713         if (network->last_associate &&
5714             time_after(network->last_associate + (HZ * 3UL), jiffies)) {
5715                 IPW_DEBUG_ASSOC("Network '%s (%s)' excluded "
5716                                 "because of storming (%ums since last "
5717                                 "assoc attempt).\n",
5718                                 escape_essid(network->ssid, network->ssid_len),
5719                                 print_mac(mac, network->bssid),
5720                                 jiffies_to_msecs(jiffies -
5721                                                  network->last_associate));
5722                 return 0;
5723         }
5724
5725         /* Now go through and see if the requested network is valid... */
5726         if (priv->ieee->scan_age != 0 &&
5727             time_after(jiffies, network->last_scanned + priv->ieee->scan_age)) {
5728                 IPW_DEBUG_ASSOC("Network '%s (%s)' excluded "
5729                                 "because of age: %ums.\n",
5730                                 escape_essid(network->ssid, network->ssid_len),
5731                                 print_mac(mac, network->bssid),
5732                                 jiffies_to_msecs(jiffies -
5733                                                  network->last_scanned));
5734                 return 0;
5735         }
5736
5737         if ((priv->config & CFG_STATIC_CHANNEL) &&
5738             (network->channel != priv->channel)) {
5739                 IPW_DEBUG_ASSOC("Network '%s (%s)' excluded "
5740                                 "because of channel mismatch: %d != %d.\n",
5741                                 escape_essid(network->ssid, network->ssid_len),
5742                                 print_mac(mac, network->bssid),
5743                                 network->channel, priv->channel);
5744                 return 0;
5745         }
5746
5747         /* Verify privacy compatability */
5748         if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
5749             ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
5750                 IPW_DEBUG_ASSOC("Network '%s (%s)' excluded "
5751                                 "because of privacy mismatch: %s != %s.\n",
5752                                 escape_essid(network->ssid, network->ssid_len),
5753                                 print_mac(mac, network->bssid),
5754                                 priv->capability & CAP_PRIVACY_ON ? "on" :
5755                                 "off",
5756                                 network->capability &
5757                                 WLAN_CAPABILITY_PRIVACY ? "on" : "off");
5758                 return 0;
5759         }
5760
5761         if ((priv->config & CFG_STATIC_BSSID) &&
5762             memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
5763                 IPW_DEBUG_ASSOC("Network '%s (%s)' excluded "
5764                                 "because of BSSID mismatch: %s.\n",
5765                                 escape_essid(network->ssid, network->ssid_len),
5766                                 print_mac(mac, network->bssid), print_mac(mac, priv->bssid));
5767                 return 0;
5768         }
5769
5770         /* Filter out any incompatible freq / mode combinations */
5771         if (!ieee80211_is_valid_mode(priv->ieee, network->mode)) {
5772                 IPW_DEBUG_ASSOC("Network '%s (%s)' excluded "
5773                                 "because of invalid frequency/mode "
5774                                 "combination.\n",
5775                                 escape_essid(network->ssid, network->ssid_len),
5776                                 print_mac(mac, network->bssid));
5777                 return 0;
5778         }
5779
5780         /* Filter out invalid channel in current GEO */
5781         if (!ieee80211_is_valid_channel(priv->ieee, network->channel)) {
5782                 IPW_DEBUG_ASSOC("Network '%s (%s)' excluded "
5783                                 "because of invalid channel in current GEO\n",
5784                                 escape_essid(network->ssid, network->ssid_len),
5785                                 print_mac(mac, network->bssid));
5786                 return 0;
5787         }
5788
5789         /* Ensure that the rates supported by the driver are compatible with
5790          * this AP, including verification of basic rates (mandatory) */
5791         if (!ipw_compatible_rates(priv, network, &rates)) {
5792                 IPW_DEBUG_ASSOC("Network '%s (%s)' excluded "
5793                                 "because configured rate mask excludes "
5794                                 "AP mandatory rate.\n",
5795                                 escape_essid(network->ssid, network->ssid_len),
5796                                 print_mac(mac, network->bssid));
5797                 return 0;
5798         }
5799
5800         if (rates.num_rates == 0) {
5801                 IPW_DEBUG_ASSOC("Network '%s (%s)' excluded "
5802                                 "because of no compatible rates.\n",
5803                                 escape_essid(network->ssid, network->ssid_len),
5804                                 print_mac(mac, network->bssid));
5805                 return 0;
5806         }
5807
5808         /* TODO: Perform any further minimal comparititive tests.  We do not
5809          * want to put too much policy logic here; intelligent scan selection
5810          * should occur within a generic IEEE 802.11 user space tool.  */
5811
5812         /* Set up 'new' AP to this network */
5813         ipw_copy_rates(&match->rates, &rates);
5814         match->network = network;
5815
5816         IPW_DEBUG_ASSOC("Network '%s (%s)' is a viable match.\n",
5817                         escape_essid(network->ssid, network->ssid_len),
5818                         print_mac(mac, network->bssid));
5819
5820         return 1;
5821 }
5822
5823 static void ipw_adhoc_create(struct ipw_priv *priv,
5824                              struct ieee80211_network *network)
5825 {
5826         const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
5827         int i;
5828
5829         /*
5830          * For the purposes of scanning, we can set our wireless mode
5831          * to trigger scans across combinations of bands, but when it
5832          * comes to creating a new ad-hoc network, we have tell the FW
5833          * exactly which band to use.
5834          *
5835          * We also have the possibility of an invalid channel for the
5836          * chossen band.  Attempting to create a new ad-hoc network
5837          * with an invalid channel for wireless mode will trigger a
5838          * FW fatal error.
5839          *
5840          */
5841         switch (ieee80211_is_valid_channel(priv->ieee, priv->channel)) {
5842         case IEEE80211_52GHZ_BAND:
5843                 network->mode = IEEE_A;
5844                 i = ieee80211_channel_to_index(priv->ieee, priv->channel);
5845                 BUG_ON(i == -1);
5846                 if (geo->a[i].flags & IEEE80211_CH_PASSIVE_ONLY) {
5847                         IPW_WARNING("Overriding invalid channel\n");
5848                         priv->channel = geo->a[0].channel;
5849                 }
5850                 break;
5851
5852         case IEEE80211_24GHZ_BAND:
5853                 if (priv->ieee->mode & IEEE_G)
5854                         network->mode = IEEE_G;
5855                 else
5856                         network->mode = IEEE_B;
5857                 i = ieee80211_channel_to_index(priv->ieee, priv->channel);
5858                 BUG_ON(i == -1);
5859                 if (geo->bg[i].flags & IEEE80211_CH_PASSIVE_ONLY) {
5860                         IPW_WARNING("Overriding invalid channel\n");
5861                         priv->channel = geo->bg[0].channel;
5862                 }
5863                 break;
5864
5865         default:
5866                 IPW_WARNING("Overriding invalid channel\n");
5867                 if (priv->ieee->mode & IEEE_A) {
5868                         network->mode = IEEE_A;
5869                         priv->channel = geo->a[0].channel;
5870                 } else if (priv->ieee->mode & IEEE_G) {
5871                         network->mode = IEEE_G;
5872                         priv->channel = geo->bg[0].channel;
5873                 } else {
5874                         network->mode = IEEE_B;
5875                         priv->channel = geo->bg[0].channel;
5876                 }
5877                 break;
5878         }
5879
5880         network->channel = priv->channel;
5881         priv->config |= CFG_ADHOC_PERSIST;
5882         ipw_create_bssid(priv, network->bssid);
5883         network->ssid_len = priv->essid_len;
5884         memcpy(network->ssid, priv->essid, priv->essid_len);
5885         memset(&network->stats, 0, sizeof(network->stats));
5886         network->capability = WLAN_CAPABILITY_IBSS;
5887         if (!(priv->config & CFG_PREAMBLE_LONG))
5888                 network->capability |= WLAN_CAPABILITY_SHORT_PREAMBLE;
5889         if (priv->capability & CAP_PRIVACY_ON)
5890                 network->capability |= WLAN_CAPABILITY_PRIVACY;
5891         network->rates_len = min(priv->rates.num_rates, MAX_RATES_LENGTH);
5892         memcpy(network->rates, priv->rates.supported_rates, network->rates_len);
5893         network->rates_ex_len = priv->rates.num_rates - network->rates_len;
5894         memcpy(network->rates_ex,
5895                &priv->rates.supported_rates[network->rates_len],
5896                network->rates_ex_len);
5897         network->last_scanned = 0;
5898         network->flags = 0;
5899         network->last_associate = 0;
5900         network->time_stamp[0] = 0;
5901         network->time_stamp[1] = 0;
5902         network->beacon_interval = 100; /* Default */
5903         network->listen_interval = 10;  /* Default */
5904         network->atim_window = 0;       /* Default */
5905         network->wpa_ie_len = 0;
5906         network->rsn_ie_len = 0;
5907 }
5908
5909 static void ipw_send_tgi_tx_key(struct ipw_priv *priv, int type, int index)
5910 {
5911         struct ipw_tgi_tx_key key;
5912
5913         if (!(priv->ieee->sec.flags & (1 << index)))
5914                 return;
5915
5916         key.key_id = index;
5917         memcpy(key.key, priv->ieee->sec.keys[index], SCM_TEMPORAL_KEY_LENGTH);
5918         key.security_type = type;
5919         key.station_index = 0;  /* always 0 for BSS */
5920         key.flags = 0;
5921         /* 0 for new key; previous value of counter (after fatal error) */
5922         key.tx_counter[0] = cpu_to_le32(0);
5923         key.tx_counter[1] = cpu_to_le32(0);
5924
5925         ipw_send_cmd_pdu(priv, IPW_CMD_TGI_TX_KEY, sizeof(key), &key);
5926 }
5927
5928 static void ipw_send_wep_keys(struct ipw_priv *priv, int type)
5929 {
5930         struct ipw_wep_key key;
5931         int i;
5932
5933         key.cmd_id = DINO_CMD_WEP_KEY;
5934         key.seq_num = 0;
5935
5936         /* Note: AES keys cannot be set for multiple times.
5937          * Only set it at the first time. */
5938         for (i = 0; i < 4; i++) {
5939                 key.key_index = i | type;
5940                 if (!(priv->ieee->sec.flags & (1 << i))) {
5941                         key.key_size = 0;
5942                         continue;
5943                 }
5944
5945                 key.key_size = priv->ieee->sec.key_sizes[i];
5946                 memcpy(key.key, priv->ieee->sec.keys[i], key.key_size);
5947
5948                 ipw_send_cmd_pdu(priv, IPW_CMD_WEP_KEY, sizeof(key), &key);
5949         }
5950 }
5951
5952 static void ipw_set_hw_decrypt_unicast(struct ipw_priv *priv, int level)
5953 {
5954         if (priv->ieee->host_encrypt)
5955                 return;
5956
5957         switch (level) {
5958         case SEC_LEVEL_3:
5959                 priv->sys_config.disable_unicast_decryption = 0;
5960                 priv->ieee->host_decrypt = 0;
5961                 break;
5962         case SEC_LEVEL_2:
5963                 priv->sys_config.disable_unicast_decryption = 1;
5964                 priv->ieee->host_decrypt = 1;
5965                 break;
5966         case SEC_LEVEL_1:
5967                 priv->sys_config.disable_unicast_decryption = 0;
5968                 priv->ieee->host_decrypt = 0;
5969                 break;
5970         case SEC_LEVEL_0:
5971                 priv->sys_config.disable_unicast_decryption = 1;
5972                 break;
5973         default:
5974                 break;
5975         }
5976 }
5977
5978 static void ipw_set_hw_decrypt_multicast(struct ipw_priv *priv, int level)
5979 {
5980         if (priv->ieee->host_encrypt)
5981                 return;
5982
5983         switch (level) {
5984         case SEC_LEVEL_3:
5985                 priv->sys_config.disable_multicast_decryption = 0;
5986                 break;
5987         case SEC_LEVEL_2:
5988                 priv->sys_config.disable_multicast_decryption = 1;
5989                 break;
5990         case SEC_LEVEL_1:
5991                 priv->sys_config.disable_multicast_decryption = 0;
5992                 break;
5993         case SEC_LEVEL_0:
5994                 priv->sys_config.disable_multicast_decryption = 1;
5995                 break;
5996         default:
5997                 break;
5998         }
5999 }
6000
6001 static void ipw_set_hwcrypto_keys(struct ipw_priv *priv)
6002 {
6003         switch (priv->ieee->sec.level) {
6004         case SEC_LEVEL_3:
6005                 if (priv->ieee->sec.flags & SEC_ACTIVE_KEY)
6006                         ipw_send_tgi_tx_key(priv,
6007                                             DCT_FLAG_EXT_SECURITY_CCM,
6008                                             priv->ieee->sec.active_key);
6009
6010                 if (!priv->ieee->host_mc_decrypt)
6011                         ipw_send_wep_keys(priv, DCW_WEP_KEY_SEC_TYPE_CCM);
6012                 break;
6013         case SEC_LEVEL_2:
6014                 if (priv->ieee->sec.flags & SEC_ACTIVE_KEY)
6015                         ipw_send_tgi_tx_key(priv,
6016                                             DCT_FLAG_EXT_SECURITY_TKIP,
6017                                             priv->ieee->sec.active_key);
6018                 break;
6019         case SEC_LEVEL_1:
6020                 ipw_send_wep_keys(priv, DCW_WEP_KEY_SEC_TYPE_WEP);
6021                 ipw_set_hw_decrypt_unicast(priv, priv->ieee->sec.level);
6022                 ipw_set_hw_decrypt_multicast(priv, priv->ieee->sec.level);
6023                 break;
6024         case SEC_LEVEL_0:
6025         default:
6026                 break;
6027         }
6028 }
6029
6030 static void ipw_adhoc_check(void *data)
6031 {
6032         struct ipw_priv *priv = data;
6033
6034         if (priv->missed_adhoc_beacons++ > priv->disassociate_threshold &&
6035             !(priv->config & CFG_ADHOC_PERSIST)) {
6036                 IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
6037                           IPW_DL_STATE | IPW_DL_ASSOC,
6038                           "Missed beacon: %d - disassociate\n",
6039                           priv->missed_adhoc_beacons);
6040                 ipw_remove_current_network(priv);
6041                 ipw_disassociate(priv);
6042                 return;
6043         }
6044
6045         queue_delayed_work(priv->workqueue, &priv->adhoc_check,
6046                            le16_to_cpu(priv->assoc_request.beacon_interval));
6047 }
6048
6049 static void ipw_bg_adhoc_check(struct work_struct *work)
6050 {
6051         struct ipw_priv *priv =
6052                 container_of(work, struct ipw_priv, adhoc_check.work);
6053         mutex_lock(&priv->mutex);
6054         ipw_adhoc_check(priv);
6055         mutex_unlock(&priv->mutex);
6056 }
6057
6058 static void ipw_debug_config(struct ipw_priv *priv)
6059 {
6060         DECLARE_MAC_BUF(mac);
6061         IPW_DEBUG_INFO("Scan completed, no valid APs matched "
6062                        "[CFG 0x%08X]\n", priv->config);
6063         if (priv->config & CFG_STATIC_CHANNEL)
6064                 IPW_DEBUG_INFO("Channel locked to %d\n", priv->channel);
6065         else
6066                 IPW_DEBUG_INFO("Channel unlocked.\n");
6067         if (priv->config & CFG_STATIC_ESSID)
6068                 IPW_DEBUG_INFO("ESSID locked to '%s'\n",
6069                                escape_essid(priv->essid, priv->essid_len));
6070         else
6071                 IPW_DEBUG_INFO("ESSID unlocked.\n");
6072         if (priv->config & CFG_STATIC_BSSID)
6073                 IPW_DEBUG_INFO("BSSID locked to %s\n",
6074                                print_mac(mac, priv->bssid));
6075         else
6076                 IPW_DEBUG_INFO("BSSID unlocked.\n");
6077         if (priv->capability & CAP_PRIVACY_ON)
6078                 IPW_DEBUG_INFO("PRIVACY on\n");
6079         else
6080                 IPW_DEBUG_INFO("PRIVACY off\n");
6081         IPW_DEBUG_INFO("RATE MASK: 0x%08X\n", priv->rates_mask);
6082 }
6083
6084 static void ipw_set_fixed_rate(struct ipw_priv *priv, int mode)
6085 {
6086         /* TODO: Verify that this works... */
6087         struct ipw_fixed_rate fr = {
6088                 .tx_rates = priv->rates_mask
6089         };
6090         u32 reg;
6091         u16 mask = 0;
6092
6093         /* Identify 'current FW band' and match it with the fixed
6094          * Tx rates */
6095
6096         switch (priv->ieee->freq_band) {
6097         case IEEE80211_52GHZ_BAND:      /* A only */
6098                 /* IEEE_A */
6099                 if (priv->rates_mask & ~IEEE80211_OFDM_RATES_MASK) {
6100                         /* Invalid fixed rate mask */
6101                         IPW_DEBUG_WX
6102                             ("invalid fixed rate mask in ipw_set_fixed_rate\n");
6103                         fr.tx_rates = 0;
6104                         break;
6105                 }
6106
6107                 fr.tx_rates >>= IEEE80211_OFDM_SHIFT_MASK_A;
6108                 break;
6109
6110         default:                /* 2.4Ghz or Mixed */
6111                 /* IEEE_B */
6112                 if (mode == IEEE_B) {
6113                         if (fr.tx_rates & ~IEEE80211_CCK_RATES_MASK) {
6114                                 /* Invalid fixed rate mask */
6115                                 IPW_DEBUG_WX
6116                                     ("invalid fixed rate mask in ipw_set_fixed_rate\n");
6117                                 fr.tx_rates = 0;
6118                         }
6119                         break;
6120                 }
6121
6122                 /* IEEE_G */
6123                 if (fr.tx_rates & ~(IEEE80211_CCK_RATES_MASK |
6124                                     IEEE80211_OFDM_RATES_MASK)) {
6125                         /* Invalid fixed rate mask */
6126                         IPW_DEBUG_WX
6127                             ("invalid fixed rate mask in ipw_set_fixed_rate\n");
6128                         fr.tx_rates = 0;
6129                         break;
6130                 }
6131
6132                 if (IEEE80211_OFDM_RATE_6MB_MASK & fr.tx_rates) {
6133                         mask |= (IEEE80211_OFDM_RATE_6MB_MASK >> 1);
6134                         fr.tx_rates &= ~IEEE80211_OFDM_RATE_6MB_MASK;
6135                 }
6136
6137                 if (IEEE80211_OFDM_RATE_9MB_MASK & fr.tx_rates) {
6138                         mask |= (IEEE80211_OFDM_RATE_9MB_MASK >> 1);
6139                         fr.tx_rates &= ~IEEE80211_OFDM_RATE_9MB_MASK;
6140                 }
6141
6142                 if (IEEE80211_OFDM_RATE_12MB_MASK & fr.tx_rates) {
6143                         mask |= (IEEE80211_OFDM_RATE_12MB_MASK >> 1);
6144                         fr.tx_rates &= ~IEEE80211_OFDM_RATE_12MB_MASK;
6145                 }
6146
6147                 fr.tx_rates |= mask;
6148                 break;
6149         }
6150
6151         reg = ipw_read32(priv, IPW_MEM_FIXED_OVERRIDE);
6152         ipw_write_reg32(priv, reg, *(u32 *) & fr);
6153 }
6154
6155 static void ipw_abort_scan(struct ipw_priv *priv)
6156 {
6157         int err;
6158
6159         if (priv->status & STATUS_SCAN_ABORTING) {
6160                 IPW_DEBUG_HC("Ignoring concurrent scan abort request.\n");
6161                 return;
6162         }
6163         priv->status |= STATUS_SCAN_ABORTING;
6164
6165         err = ipw_send_scan_abort(priv);
6166         if (err)
6167                 IPW_DEBUG_HC("Request to abort scan failed.\n");
6168 }
6169
6170 static void ipw_add_scan_channels(struct ipw_priv *priv,
6171                                   struct ipw_scan_request_ext *scan,
6172                                   int scan_type)
6173 {
6174         int channel_index = 0;
6175         const struct ieee80211_geo *geo;
6176         int i;
6177
6178         geo = ieee80211_get_geo(priv->ieee);
6179
6180         if (priv->ieee->freq_band & IEEE80211_52GHZ_BAND) {
6181                 int start = channel_index;
6182                 for (i = 0; i < geo->a_channels; i++) {
6183                         if ((priv->status & STATUS_ASSOCIATED) &&
6184                             geo->a[i].channel == priv->channel)
6185                                 continue;
6186                         channel_index++;
6187                         scan->channels_list[channel_index] = geo->a[i].channel;
6188                         ipw_set_scan_type(scan, channel_index,
6189                                           geo->a[i].
6190                                           flags & IEEE80211_CH_PASSIVE_ONLY ?
6191                                           IPW_SCAN_PASSIVE_FULL_DWELL_SCAN :
6192                                           scan_type);
6193                 }
6194
6195                 if (start != channel_index) {
6196                         scan->channels_list[start] = (u8) (IPW_A_MODE << 6) |
6197                             (channel_index - start);
6198                         channel_index++;
6199                 }
6200         }
6201
6202         if (priv->ieee->freq_band & IEEE80211_24GHZ_BAND) {
6203                 int start = channel_index;
6204                 if (priv->config & CFG_SPEED_SCAN) {
6205                         int index;
6206                         u8 channels[IEEE80211_24GHZ_CHANNELS] = {
6207                                 /* nop out the list */
6208                                 [0] = 0
6209                         };
6210
6211                         u8 channel;
6212                         while (channel_index < IPW_SCAN_CHANNELS) {
6213                                 channel =
6214                                     priv->speed_scan[priv->speed_scan_pos];
6215                                 if (channel == 0) {
6216                                         priv->speed_scan_pos = 0;
6217                                         channel = priv->speed_scan[0];
6218                                 }
6219                                 if ((priv->status & STATUS_ASSOCIATED) &&
6220                                     channel == priv->channel) {
6221                                         priv->speed_scan_pos++;
6222                                         continue;
6223                                 }
6224
6225                                 /* If this channel has already been
6226                                  * added in scan, break from loop
6227                                  * and this will be the first channel
6228                                  * in the next scan.
6229                                  */
6230                                 if (channels[channel - 1] != 0)
6231                                         break;
6232
6233                                 channels[channel - 1] = 1;
6234                                 priv->speed_scan_pos++;
6235                                 channel_index++;
6236                                 scan->channels_list[channel_index] = channel;
6237                                 index =
6238                                     ieee80211_channel_to_index(priv->ieee, channel);
6239                                 ipw_set_scan_type(scan, channel_index,
6240                                                   geo->bg[index].
6241                                                   flags &
6242                                                   IEEE80211_CH_PASSIVE_ONLY ?
6243                                                   IPW_SCAN_PASSIVE_FULL_DWELL_SCAN
6244                                                   : scan_type);
6245                         }
6246                 } else {
6247                         for (i = 0; i < geo->bg_channels; i++) {
6248                                 if ((priv->status & STATUS_ASSOCIATED) &&
6249                                     geo->bg[i].channel == priv->channel)
6250                                         continue;
6251                                 channel_index++;
6252                                 scan->channels_list[channel_index] =
6253                                     geo->bg[i].channel;
6254                                 ipw_set_scan_type(scan, channel_index,
6255                                                   geo->bg[i].
6256                                                   flags &
6257                                                   IEEE80211_CH_PASSIVE_ONLY ?
6258                                                   IPW_SCAN_PASSIVE_FULL_DWELL_SCAN
6259                                                   : scan_type);
6260                         }
6261                 }
6262
6263                 if (start != channel_index) {
6264                         scan->channels_list[start] = (u8) (IPW_B_MODE << 6) |
6265                             (channel_index - start);
6266                 }
6267         }
6268 }
6269
6270 static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
6271 {
6272         struct ipw_scan_request_ext scan;
6273         int err = 0, scan_type;
6274
6275         if (!(priv->status & STATUS_INIT) ||
6276             (priv->status & STATUS_EXIT_PENDING))
6277                 return 0;
6278
6279         mutex_lock(&priv->mutex);
6280
6281         if (priv->status & STATUS_SCANNING) {
6282                 IPW_DEBUG_HC("Concurrent scan requested.  Ignoring.\n");
6283                 priv->status |= STATUS_SCAN_PENDING;
6284                 goto done;
6285         }
6286
6287         if (!(priv->status & STATUS_SCAN_FORCED) &&
6288             priv->status & STATUS_SCAN_ABORTING) {
6289                 IPW_DEBUG_HC("Scan request while abort pending.  Queuing.\n");
6290                 priv->status |= STATUS_SCAN_PENDING;
6291                 goto done;
6292         }
6293
6294         if (priv->status & STATUS_RF_KILL_MASK) {
6295                 IPW_DEBUG_HC("Aborting scan due to RF Kill activation\n");
6296                 priv->status |= STATUS_SCAN_PENDING;
6297                 goto done;
6298         }
6299
6300         memset(&scan, 0, sizeof(scan));
6301         scan.full_scan_index = cpu_to_le32(ieee80211_get_scans(priv->ieee));
6302
6303         if (type == IW_SCAN_TYPE_PASSIVE) {
6304                 IPW_DEBUG_WX("use passive scanning\n");
6305                 scan_type = IPW_SCAN_PASSIVE_FULL_DWELL_SCAN;
6306                 scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] =
6307                         cpu_to_le16(120);
6308                 ipw_add_scan_channels(priv, &scan, scan_type);
6309                 goto send_request;
6310         }
6311
6312         /* Use active scan by default. */
6313         if (priv->config & CFG_SPEED_SCAN)
6314                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
6315                         cpu_to_le16(30);
6316         else
6317                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
6318                         cpu_to_le16(20);
6319
6320         scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN] =
6321                 cpu_to_le16(20);
6322
6323         scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = cpu_to_le16(120);
6324
6325 #ifdef CONFIG_IPW2200_MONITOR
6326         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
6327                 u8 channel;
6328                 u8 band = 0;
6329
6330                 switch (ieee80211_is_valid_channel(priv->ieee, priv->channel)) {
6331                 case IEEE80211_52GHZ_BAND:
6332                         band = (u8) (IPW_A_MODE << 6) | 1;
6333                         channel = priv->channel;
6334                         break;
6335
6336                 case IEEE80211_24GHZ_BAND:
6337                         band = (u8) (IPW_B_MODE << 6) | 1;
6338                         channel = priv->channel;
6339                         break;
6340
6341                 default:
6342                         band = (u8) (IPW_B_MODE << 6) | 1;
6343                         channel = 9;
6344                         break;
6345                 }
6346
6347                 scan.channels_list[0] = band;
6348                 scan.channels_list[1] = channel;
6349                 ipw_set_scan_type(&scan, 1, IPW_SCAN_PASSIVE_FULL_DWELL_SCAN);
6350
6351                 /* NOTE:  The card will sit on this channel for this time
6352                  * period.  Scan aborts are timing sensitive and frequently
6353                  * result in firmware restarts.  As such, it is best to
6354                  * set a small dwell_time here and just keep re-issuing
6355                  * scans.  Otherwise fast channel hopping will not actually
6356                  * hop channels.
6357                  *
6358                  * TODO: Move SPEED SCAN support to all modes and bands */
6359                 scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] =
6360                         cpu_to_le16(2000);
6361         } else {
6362 #endif                          /* CONFIG_IPW2200_MONITOR */
6363                 /* If we are roaming, then make this a directed scan for the
6364                  * current network.  Otherwise, ensure that every other scan
6365                  * is a fast channel hop scan */
6366                 if ((priv->status & STATUS_ROAMING)
6367                     || (!(priv->status & STATUS_ASSOCIATED)
6368                         && (priv->config & CFG_STATIC_ESSID)
6369                         && (le32_to_cpu(scan.full_scan_index) % 2))) {
6370                         err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
6371                         if (err) {
6372                                 IPW_DEBUG_HC("Attempt to send SSID command "
6373                                              "failed.\n");
6374                                 goto done;
6375                         }
6376
6377                         scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
6378                 } else
6379                         scan_type = IPW_SCAN_ACTIVE_BROADCAST_SCAN;
6380
6381                 ipw_add_scan_channels(priv, &scan, scan_type);
6382 #ifdef CONFIG_IPW2200_MONITOR
6383         }
6384 #endif
6385
6386 send_request:
6387         err = ipw_send_scan_request_ext(priv, &scan);
6388         if (err) {
6389                 IPW_DEBUG_HC("Sending scan command failed: %08X\n", err);
6390                 goto done;
6391         }
6392
6393         priv->status |= STATUS_SCANNING;
6394         priv->status &= ~STATUS_SCAN_PENDING;
6395         queue_delayed_work(priv->workqueue, &priv->scan_check,
6396                            IPW_SCAN_CHECK_WATCHDOG);
6397 done:
6398         mutex_unlock(&priv->mutex);
6399         return err;
6400 }
6401
6402 static void ipw_request_passive_scan(struct work_struct *work)
6403 {
6404         struct ipw_priv *priv =
6405                 container_of(work, struct ipw_priv, request_passive_scan);
6406         ipw_request_scan_helper(priv, IW_SCAN_TYPE_PASSIVE);
6407 }
6408
6409 static void ipw_request_scan(struct work_struct *work)
6410 {
6411         struct ipw_priv *priv =
6412                 container_of(work, struct ipw_priv, request_scan.work);
6413         ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE);
6414 }
6415
6416 static void ipw_bg_abort_scan(struct work_struct *work)
6417 {
6418         struct ipw_priv *priv =
6419                 container_of(work, struct ipw_priv, abort_scan);
6420         mutex_lock(&priv->mutex);
6421         ipw_abort_scan(priv);
6422         mutex_unlock(&priv->mutex);
6423 }
6424
6425 static int ipw_wpa_enable(struct ipw_priv *priv, int value)
6426 {
6427         /* This is called when wpa_supplicant loads and closes the driver
6428          * interface. */
6429         priv->ieee->wpa_enabled = value;
6430         return 0;
6431 }
6432
6433 static int ipw_wpa_set_auth_algs(struct ipw_priv *priv, int value)
6434 {
6435         struct ieee80211_device *ieee = priv->ieee;
6436         struct ieee80211_security sec = {
6437                 .flags = SEC_AUTH_MODE,
6438         };
6439         int ret = 0;
6440
6441         if (value & IW_AUTH_ALG_SHARED_KEY) {
6442                 sec.auth_mode = WLAN_AUTH_SHARED_KEY;
6443                 ieee->open_wep = 0;
6444         } else if (value & IW_AUTH_ALG_OPEN_SYSTEM) {
6445                 sec.auth_mode = WLAN_AUTH_OPEN;
6446                 ieee->open_wep = 1;
6447         } else if (value & IW_AUTH_ALG_LEAP) {
6448                 sec.auth_mode = WLAN_AUTH_LEAP;
6449                 ieee->open_wep = 1;
6450         } else
6451                 return -EINVAL;
6452
6453         if (ieee->set_security)
6454                 ieee->set_security(ieee->dev, &sec);
6455         else
6456                 ret = -EOPNOTSUPP;
6457
6458         return ret;
6459 }
6460
6461 static void ipw_wpa_assoc_frame(struct ipw_priv *priv, char *wpa_ie,
6462                                 int wpa_ie_len)
6463 {
6464         /* make sure WPA is enabled */
6465         ipw_wpa_enable(priv, 1);
6466 }
6467
6468 static int ipw_set_rsn_capa(struct ipw_priv *priv,
6469                             char *capabilities, int length)
6470 {
6471         IPW_DEBUG_HC("HOST_CMD_RSN_CAPABILITIES\n");
6472
6473         return ipw_send_cmd_pdu(priv, IPW_CMD_RSN_CAPABILITIES, length,
6474                                 capabilities);
6475 }
6476
6477 /*
6478  * WE-18 support
6479  */
6480
6481 /* SIOCSIWGENIE */
6482 static int ipw_wx_set_genie(struct net_device *dev,
6483                             struct iw_request_info *info,
6484                             union iwreq_data *wrqu, char *extra)
6485 {
6486         struct ipw_priv *priv = ieee80211_priv(dev);
6487         struct ieee80211_device *ieee = priv->ieee;
6488         u8 *buf;
6489         int err = 0;
6490
6491         if (wrqu->data.length > MAX_WPA_IE_LEN ||
6492             (wrqu->data.length && extra == NULL))
6493                 return -EINVAL;
6494
6495         if (wrqu->data.length) {
6496                 buf = kmalloc(wrqu->data.length, GFP_KERNEL);
6497                 if (buf == NULL) {
6498                         err = -ENOMEM;
6499                         goto out;
6500                 }
6501
6502                 memcpy(buf, extra, wrqu->data.length);
6503                 kfree(ieee->wpa_ie);
6504                 ieee->wpa_ie = buf;
6505                 ieee->wpa_ie_len = wrqu->data.length;
6506         } else {
6507                 kfree(ieee->wpa_ie);
6508                 ieee->wpa_ie = NULL;
6509                 ieee->wpa_ie_len = 0;
6510         }
6511
6512         ipw_wpa_assoc_frame(priv, ieee->wpa_ie, ieee->wpa_ie_len);
6513       out:
6514         return err;
6515 }
6516
6517 /* SIOCGIWGENIE */
6518 static int ipw_wx_get_genie(struct net_device *dev,
6519                             struct iw_request_info *info,
6520                             union iwreq_data *wrqu, char *extra)
6521 {
6522         struct ipw_priv *priv = ieee80211_priv(dev);
6523         struct ieee80211_device *ieee = priv->ieee;
6524         int err = 0;
6525
6526         if (ieee->wpa_ie_len == 0 || ieee->wpa_ie == NULL) {
6527                 wrqu->data.length = 0;
6528                 goto out;
6529         }
6530
6531         if (wrqu->data.length < ieee->wpa_ie_len) {
6532                 err = -E2BIG;
6533                 goto out;
6534         }
6535
6536         wrqu->data.length = ieee->wpa_ie_len;
6537         memcpy(extra, ieee->wpa_ie, ieee->wpa_ie_len);
6538
6539       out:
6540         return err;
6541 }
6542
6543 static int wext_cipher2level(int cipher)
6544 {
6545         switch (cipher) {
6546         case IW_AUTH_CIPHER_NONE:
6547                 return SEC_LEVEL_0;
6548         case IW_AUTH_CIPHER_WEP40:
6549         case IW_AUTH_CIPHER_WEP104:
6550                 return SEC_LEVEL_1;
6551         case IW_AUTH_CIPHER_TKIP:
6552                 return SEC_LEVEL_2;
6553         case IW_AUTH_CIPHER_CCMP:
6554                 return SEC_LEVEL_3;
6555         default:
6556                 return -1;
6557         }
6558 }
6559
6560 /* SIOCSIWAUTH */
6561 static int ipw_wx_set_auth(struct net_device *dev,
6562                            struct iw_request_info *info,
6563                            union iwreq_data *wrqu, char *extra)
6564 {
6565         struct ipw_priv *priv = ieee80211_priv(dev);
6566         struct ieee80211_device *ieee = priv->ieee;
6567         struct iw_param *param = &wrqu->param;
6568         struct ieee80211_crypt_data *crypt;
6569         unsigned long flags;
6570         int ret = 0;
6571
6572         switch (param->flags & IW_AUTH_INDEX) {
6573         case IW_AUTH_WPA_VERSION:
6574                 break;
6575         case IW_AUTH_CIPHER_PAIRWISE:
6576                 ipw_set_hw_decrypt_unicast(priv,
6577                                            wext_cipher2level(param->value));
6578                 break;
6579         case IW_AUTH_CIPHER_GROUP:
6580                 ipw_set_hw_decrypt_multicast(priv,
6581                                              wext_cipher2level(param->value));
6582                 break;
6583         case IW_AUTH_KEY_MGMT:
6584                 /*
6585                  * ipw2200 does not use these parameters
6586                  */
6587                 break;
6588
6589         case IW_AUTH_TKIP_COUNTERMEASURES:
6590                 crypt = priv->ieee->crypt[priv->ieee->tx_keyidx];
6591                 if (!crypt || !crypt->ops->set_flags || !crypt->ops->get_flags)
6592                         break;
6593
6594                 flags = crypt->ops->get_flags(crypt->priv);
6595
6596                 if (param->value)
6597                         flags |= IEEE80211_CRYPTO_TKIP_COUNTERMEASURES;
6598                 else
6599                         flags &= ~IEEE80211_CRYPTO_TKIP_COUNTERMEASURES;
6600
6601                 crypt->ops->set_flags(flags, crypt->priv);
6602
6603                 break;
6604
6605         case IW_AUTH_DROP_UNENCRYPTED:{
6606                         /* HACK:
6607                          *
6608                          * wpa_supplicant calls set_wpa_enabled when the driver
6609                          * is loaded and unloaded, regardless of if WPA is being
6610                          * used.  No other calls are made which can be used to
6611                          * determine if encryption will be used or not prior to
6612                          * association being expected.  If encryption is not being
6613                          * used, drop_unencrypted is set to false, else true -- we
6614                          * can use this to determine if the CAP_PRIVACY_ON bit should
6615                          * be set.
6616                          */
6617                         struct ieee80211_security sec = {
6618                                 .flags = SEC_ENABLED,
6619                                 .enabled = param->value,
6620                         };
6621                         priv->ieee->drop_unencrypted = param->value;
6622                         /* We only change SEC_LEVEL for open mode. Others
6623                          * are set by ipw_wpa_set_encryption.
6624                          */
6625                         if (!param->value) {
6626                                 sec.flags |= SEC_LEVEL;
6627                                 sec.level = SEC_LEVEL_0;
6628                         } else {
6629                                 sec.flags |= SEC_LEVEL;
6630                                 sec.level = SEC_LEVEL_1;
6631                         }
6632                         if (priv->ieee->set_security)
6633                                 priv->ieee->set_security(priv->ieee->dev, &sec);
6634                         break;
6635                 }
6636
6637         case IW_AUTH_80211_AUTH_ALG:
6638                 ret = ipw_wpa_set_auth_algs(priv, param->value);
6639                 break;
6640
6641         case IW_AUTH_WPA_ENABLED:
6642                 ret = ipw_wpa_enable(priv, param->value);
6643                 ipw_disassociate(priv);
6644                 break;
6645
6646         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
6647                 ieee->ieee802_1x = param->value;
6648                 break;
6649
6650         case IW_AUTH_PRIVACY_INVOKED:
6651                 ieee->privacy_invoked = param->value;
6652                 break;
6653
6654         default:
6655                 return -EOPNOTSUPP;
6656         }
6657         return ret;
6658 }
6659
6660 /* SIOCGIWAUTH */
6661 static int ipw_wx_get_auth(struct net_device *dev,
6662                            struct iw_request_info *info,
6663                            union iwreq_data *wrqu, char *extra)
6664 {
6665         struct ipw_priv *priv = ieee80211_priv(dev);
6666         struct ieee80211_device *ieee = priv->ieee;
6667         struct ieee80211_crypt_data *crypt;
6668         struct iw_param *param = &wrqu->param;
6669         int ret = 0;
6670
6671         switch (param->flags & IW_AUTH_INDEX) {
6672         case IW_AUTH_WPA_VERSION:
6673         case IW_AUTH_CIPHER_PAIRWISE:
6674         case IW_AUTH_CIPHER_GROUP:
6675         case IW_AUTH_KEY_MGMT:
6676                 /*
6677                  * wpa_supplicant will control these internally
6678                  */
6679                 ret = -EOPNOTSUPP;
6680                 break;
6681
6682         case IW_AUTH_TKIP_COUNTERMEASURES:
6683                 crypt = priv->ieee->crypt[priv->ieee->tx_keyidx];
6684                 if (!crypt || !crypt->ops->get_flags)
6685                         break;
6686
6687                 param->value = (crypt->ops->get_flags(crypt->priv) &
6688                                 IEEE80211_CRYPTO_TKIP_COUNTERMEASURES) ? 1 : 0;
6689
6690                 break;
6691
6692         case IW_AUTH_DROP_UNENCRYPTED:
6693                 param->value = ieee->drop_unencrypted;
6694                 break;
6695
6696         case IW_AUTH_80211_AUTH_ALG:
6697                 param->value = ieee->sec.auth_mode;
6698                 break;
6699
6700         case IW_AUTH_WPA_ENABLED:
6701                 param->value = ieee->wpa_enabled;
6702                 break;
6703
6704         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
6705                 param->value = ieee->ieee802_1x;
6706                 break;
6707
6708         case IW_AUTH_ROAMING_CONTROL:
6709         case IW_AUTH_PRIVACY_INVOKED:
6710                 param->value = ieee->privacy_invoked;
6711                 break;
6712
6713         default:
6714                 return -EOPNOTSUPP;
6715         }
6716         return 0;
6717 }
6718
6719 /* SIOCSIWENCODEEXT */
6720 static int ipw_wx_set_encodeext(struct net_device *dev,
6721                                 struct iw_request_info *info,
6722                                 union iwreq_data *wrqu, char *extra)
6723 {
6724         struct ipw_priv *priv = ieee80211_priv(dev);
6725         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
6726
6727         if (hwcrypto) {
6728                 if (ext->alg == IW_ENCODE_ALG_TKIP) {
6729                         /* IPW HW can't build TKIP MIC,
6730                            host decryption still needed */
6731                         if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY)
6732                                 priv->ieee->host_mc_decrypt = 1;
6733                         else {
6734                                 priv->ieee->host_encrypt = 0;
6735                                 priv->ieee->host_encrypt_msdu = 1;
6736                                 priv->ieee->host_decrypt = 1;
6737                         }
6738                 } else {
6739                         priv->ieee->host_encrypt = 0;
6740                         priv->ieee->host_encrypt_msdu = 0;
6741                         priv->ieee->host_decrypt = 0;
6742                         priv->ieee->host_mc_decrypt = 0;
6743                 }
6744         }
6745
6746         return ieee80211_wx_set_encodeext(priv->ieee, info, wrqu, extra);
6747 }
6748
6749 /* SIOCGIWENCODEEXT */
6750 static int ipw_wx_get_encodeext(struct net_device *dev,
6751                                 struct iw_request_info *info,
6752                                 union iwreq_data *wrqu, char *extra)
6753 {
6754         struct ipw_priv *priv = ieee80211_priv(dev);
6755         return ieee80211_wx_get_encodeext(priv->ieee, info, wrqu, extra);
6756 }
6757
6758 /* SIOCSIWMLME */
6759 static int ipw_wx_set_mlme(struct net_device *dev,
6760                            struct iw_request_info *info,
6761                            union iwreq_data *wrqu, char *extra)
6762 {
6763         struct ipw_priv *priv = ieee80211_priv(dev);
6764         struct iw_mlme *mlme = (struct iw_mlme *)extra;
6765         __le16 reason;
6766
6767         reason = cpu_to_le16(mlme->reason_code);
6768
6769         switch (mlme->cmd) {
6770         case IW_MLME_DEAUTH:
6771                 /* silently ignore */
6772                 break;
6773
6774         case IW_MLME_DISASSOC:
6775                 ipw_disassociate(priv);
6776                 break;
6777
6778         default:
6779                 return -EOPNOTSUPP;
6780         }
6781         return 0;
6782 }
6783
6784 #ifdef CONFIG_IPW2200_QOS
6785
6786 /* QoS */
6787 /*
6788 * get the modulation type of the current network or
6789 * the card current mode
6790 */
6791 static u8 ipw_qos_current_mode(struct ipw_priv * priv)
6792 {
6793         u8 mode = 0;
6794
6795         if (priv->status & STATUS_ASSOCIATED) {
6796                 unsigned long flags;
6797
6798                 spin_lock_irqsave(&priv->ieee->lock, flags);
6799                 mode = priv->assoc_network->mode;
6800                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
6801         } else {
6802                 mode = priv->ieee->mode;
6803         }
6804         IPW_DEBUG_QOS("QoS network/card mode %d \n", mode);
6805         return mode;
6806 }
6807
6808 /*
6809 * Handle management frame beacon and probe response
6810 */
6811 static int ipw_qos_handle_probe_response(struct ipw_priv *priv,
6812                                          int active_network,
6813                                          struct ieee80211_network *network)
6814 {
6815         u32 size = sizeof(struct ieee80211_qos_parameters);
6816
6817         if (network->capability & WLAN_CAPABILITY_IBSS)
6818                 network->qos_data.active = network->qos_data.supported;
6819
6820         if (network->flags & NETWORK_HAS_QOS_MASK) {
6821                 if (active_network &&
6822                     (network->flags & NETWORK_HAS_QOS_PARAMETERS))
6823                         network->qos_data.active = network->qos_data.supported;
6824
6825                 if ((network->qos_data.active == 1) && (active_network == 1) &&
6826                     (network->flags & NETWORK_HAS_QOS_PARAMETERS) &&
6827                     (network->qos_data.old_param_count !=
6828                      network->qos_data.param_count)) {
6829                         network->qos_data.old_param_count =
6830                             network->qos_data.param_count;
6831                         schedule_work(&priv->qos_activate);
6832                         IPW_DEBUG_QOS("QoS parameters change call "
6833                                       "qos_activate\n");
6834                 }
6835         } else {
6836                 if ((priv->ieee->mode == IEEE_B) || (network->mode == IEEE_B))
6837                         memcpy(&network->qos_data.parameters,
6838                                &def_parameters_CCK, size);
6839                 else
6840                         memcpy(&network->qos_data.parameters,
6841                                &def_parameters_OFDM, size);
6842
6843                 if ((network->qos_data.active == 1) && (active_network == 1)) {
6844                         IPW_DEBUG_QOS("QoS was disabled call qos_activate \n");
6845                         schedule_work(&priv->qos_activate);
6846                 }
6847
6848                 network->qos_data.active = 0;
6849                 network->qos_data.supported = 0;
6850         }
6851         if ((priv->status & STATUS_ASSOCIATED) &&
6852             (priv->ieee->iw_mode == IW_MODE_ADHOC) && (active_network == 0)) {
6853                 if (memcmp(network->bssid, priv->bssid, ETH_ALEN))
6854                         if ((network->capability & WLAN_CAPABILITY_IBSS) &&
6855                             !(network->flags & NETWORK_EMPTY_ESSID))
6856                                 if ((network->ssid_len ==
6857                                      priv->assoc_network->ssid_len) &&
6858                                     !memcmp(network->ssid,
6859                                             priv->assoc_network->ssid,
6860                                             network->ssid_len)) {
6861                                         queue_work(priv->workqueue,
6862                                                    &priv->merge_networks);
6863                                 }
6864         }
6865
6866         return 0;
6867 }
6868
6869 /*
6870 * This function set up the firmware to support QoS. It sends
6871 * IPW_CMD_QOS_PARAMETERS and IPW_CMD_WME_INFO
6872 */
6873 static int ipw_qos_activate(struct ipw_priv *priv,
6874                             struct ieee80211_qos_data *qos_network_data)
6875 {
6876         int err;
6877         struct ieee80211_qos_parameters qos_parameters[QOS_QOS_SETS];
6878         struct ieee80211_qos_parameters *active_one = NULL;
6879         u32 size = sizeof(struct ieee80211_qos_parameters);
6880         u32 burst_duration;
6881         int i;
6882         u8 type;
6883
6884         type = ipw_qos_current_mode(priv);
6885
6886         active_one = &(qos_parameters[QOS_PARAM_SET_DEF_CCK]);
6887         memcpy(active_one, priv->qos_data.def_qos_parm_CCK, size);
6888         active_one = &(qos_parameters[QOS_PARAM_SET_DEF_OFDM]);
6889         memcpy(active_one, priv->qos_data.def_qos_parm_OFDM, size);
6890
6891         if (qos_network_data == NULL) {
6892                 if (type == IEEE_B) {
6893                         IPW_DEBUG_QOS("QoS activate network mode %d\n", type);
6894                         active_one = &def_parameters_CCK;
6895                 } else
6896                         active_one = &def_parameters_OFDM;
6897
6898                 memcpy(&qos_parameters[QOS_PARAM_SET_ACTIVE], active_one, size);
6899                 burst_duration = ipw_qos_get_burst_duration(priv);
6900                 for (i = 0; i < QOS_QUEUE_NUM; i++)
6901                         qos_parameters[QOS_PARAM_SET_ACTIVE].tx_op_limit[i] =
6902                             cpu_to_le16(burst_duration);
6903         } else if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
6904                 if (type == IEEE_B) {
6905                         IPW_DEBUG_QOS("QoS activate IBSS nework mode %d\n",
6906                                       type);
6907                         if (priv->qos_data.qos_enable == 0)
6908                                 active_one = &def_parameters_CCK;
6909                         else
6910                                 active_one = priv->qos_data.def_qos_parm_CCK;
6911                 } else {
6912                         if (priv->qos_data.qos_enable == 0)
6913                                 active_one = &def_parameters_OFDM;
6914                         else
6915                                 active_one = priv->qos_data.def_qos_parm_OFDM;
6916                 }
6917                 memcpy(&qos_parameters[QOS_PARAM_SET_ACTIVE], active_one, size);
6918         } else {
6919                 unsigned long flags;
6920                 int active;
6921
6922                 spin_lock_irqsave(&priv->ieee->lock, flags);
6923                 active_one = &(qos_network_data->parameters);
6924                 qos_network_data->old_param_count =
6925                     qos_network_data->param_count;
6926                 memcpy(&qos_parameters[QOS_PARAM_SET_ACTIVE], active_one, size);
6927                 active = qos_network_data->supported;
6928                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
6929
6930                 if (active == 0) {
6931                         burst_duration = ipw_qos_get_burst_duration(priv);
6932                         for (i = 0; i < QOS_QUEUE_NUM; i++)
6933                                 qos_parameters[QOS_PARAM_SET_ACTIVE].
6934                                     tx_op_limit[i] = cpu_to_le16(burst_duration);
6935                 }
6936         }
6937
6938         IPW_DEBUG_QOS("QoS sending IPW_CMD_QOS_PARAMETERS\n");
6939         err = ipw_send_qos_params_command(priv,
6940                                           (struct ieee80211_qos_parameters *)
6941                                           &(qos_parameters[0]));
6942         if (err)
6943                 IPW_DEBUG_QOS("QoS IPW_CMD_QOS_PARAMETERS failed\n");
6944
6945         return err;
6946 }
6947
6948 /*
6949 * send IPW_CMD_WME_INFO to the firmware
6950 */
6951 static int ipw_qos_set_info_element(struct ipw_priv *priv)
6952 {
6953         int ret = 0;
6954         struct ieee80211_qos_information_element qos_info;
6955
6956         if (priv == NULL)
6957                 return -1;
6958
6959         qos_info.elementID = QOS_ELEMENT_ID;
6960         qos_info.length = sizeof(struct ieee80211_qos_information_element) - 2;
6961
6962         qos_info.version = QOS_VERSION_1;
6963         qos_info.ac_info = 0;
6964
6965         memcpy(qos_info.qui, qos_oui, QOS_OUI_LEN);
6966         qos_info.qui_type = QOS_OUI_TYPE;
6967         qos_info.qui_subtype = QOS_OUI_INFO_SUB_TYPE;
6968
6969         ret = ipw_send_qos_info_command(priv, &qos_info);
6970         if (ret != 0) {
6971                 IPW_DEBUG_QOS("QoS error calling ipw_send_qos_info_command\n");
6972         }
6973         return ret;
6974 }
6975
6976 /*
6977 * Set the QoS parameter with the association request structure
6978 */
6979 static int ipw_qos_association(struct ipw_priv *priv,
6980                                struct ieee80211_network *network)
6981 {
6982         int err = 0;
6983         struct ieee80211_qos_data *qos_data = NULL;
6984         struct ieee80211_qos_data ibss_data = {
6985                 .supported = 1,
6986                 .active = 1,
6987         };
6988
6989         switch (priv->ieee->iw_mode) {
6990         case IW_MODE_ADHOC:
6991                 BUG_ON(!(network->capability & WLAN_CAPABILITY_IBSS));
6992
6993                 qos_data = &ibss_data;
6994                 break;
6995
6996         case IW_MODE_INFRA:
6997                 qos_data = &network->qos_data;
6998                 break;
6999
7000         default:
7001                 BUG();
7002                 break;
7003         }
7004
7005         err = ipw_qos_activate(priv, qos_data);
7006         if (err) {
7007                 priv->assoc_request.policy_support &= ~HC_QOS_SUPPORT_ASSOC;
7008                 return err;
7009         }
7010
7011         if (priv->qos_data.qos_enable && qos_data->supported) {
7012                 IPW_DEBUG_QOS("QoS will be enabled for this association\n");
7013                 priv->assoc_request.policy_support |= HC_QOS_SUPPORT_ASSOC;
7014                 return ipw_qos_set_info_element(priv);
7015         }
7016
7017         return 0;
7018 }
7019
7020 /*
7021 * handling the beaconing responses. if we get different QoS setting
7022 * off the network from the associated setting, adjust the QoS
7023 * setting
7024 */
7025 static int ipw_qos_association_resp(struct ipw_priv *priv,
7026                                     struct ieee80211_network *network)
7027 {
7028         int ret = 0;
7029         unsigned long flags;
7030         u32 size = sizeof(struct ieee80211_qos_parameters);
7031         int set_qos_param = 0;
7032
7033         if ((priv == NULL) || (network == NULL) ||
7034             (priv->assoc_network == NULL))
7035                 return ret;
7036
7037         if (!(priv->status & STATUS_ASSOCIATED))
7038                 return ret;
7039
7040         if ((priv->ieee->iw_mode != IW_MODE_INFRA))
7041                 return ret;
7042
7043         spin_lock_irqsave(&priv->ieee->lock, flags);
7044         if (network->flags & NETWORK_HAS_QOS_PARAMETERS) {
7045                 memcpy(&priv->assoc_network->qos_data, &network->qos_data,
7046                        sizeof(struct ieee80211_qos_data));
7047                 priv->assoc_network->qos_data.active = 1;
7048                 if ((network->qos_data.old_param_count !=
7049                      network->qos_data.param_count)) {
7050                         set_qos_param = 1;
7051                         network->qos_data.old_param_count =
7052                             network->qos_data.param_count;
7053                 }
7054
7055         } else {
7056                 if ((network->mode == IEEE_B) || (priv->ieee->mode == IEEE_B))
7057                         memcpy(&priv->assoc_network->qos_data.parameters,
7058                                &def_parameters_CCK, size);
7059                 else
7060                         memcpy(&priv->assoc_network->qos_data.parameters,
7061                                &def_parameters_OFDM, size);
7062                 priv->assoc_network->qos_data.active = 0;
7063                 priv->assoc_network->qos_data.supported = 0;
7064                 set_qos_param = 1;
7065         }
7066
7067         spin_unlock_irqrestore(&priv->ieee->lock, flags);
7068
7069         if (set_qos_param == 1)
7070                 schedule_work(&priv->qos_activate);
7071
7072         return ret;
7073 }
7074
7075 static u32 ipw_qos_get_burst_duration(struct ipw_priv *priv)
7076 {
7077         u32 ret = 0;
7078
7079         if ((priv == NULL))
7080                 return 0;
7081
7082         if (!(priv->ieee->modulation & IEEE80211_OFDM_MODULATION))
7083                 ret = priv->qos_data.burst_duration_CCK;
7084         else
7085                 ret = priv->qos_data.burst_duration_OFDM;
7086
7087         return ret;
7088 }
7089
7090 /*
7091 * Initialize the setting of QoS global
7092 */
7093 static void ipw_qos_init(struct ipw_priv *priv, int enable,
7094                          int burst_enable, u32 burst_duration_CCK,
7095                          u32 burst_duration_OFDM)
7096 {
7097         priv->qos_data.qos_enable = enable;
7098
7099         if (priv->qos_data.qos_enable) {
7100                 priv->qos_data.def_qos_parm_CCK = &def_qos_parameters_CCK;
7101                 priv->qos_data.def_qos_parm_OFDM = &def_qos_parameters_OFDM;
7102                 IPW_DEBUG_QOS("QoS is enabled\n");
7103         } else {
7104                 priv->qos_data.def_qos_parm_CCK = &def_parameters_CCK;
7105                 priv->qos_data.def_qos_parm_OFDM = &def_parameters_OFDM;
7106                 IPW_DEBUG_QOS("QoS is not enabled\n");
7107         }
7108
7109         priv->qos_data.burst_enable = burst_enable;
7110
7111         if (burst_enable) {
7112                 priv->qos_data.burst_duration_CCK = burst_duration_CCK;
7113                 priv->qos_data.burst_duration_OFDM = burst_duration_OFDM;
7114         } else {
7115                 priv->qos_data.burst_duration_CCK = 0;
7116                 priv->qos_data.burst_duration_OFDM = 0;
7117         }
7118 }
7119
7120 /*
7121 * map the packet priority to the right TX Queue
7122 */
7123 static int ipw_get_tx_queue_number(struct ipw_priv *priv, u16 priority)
7124 {
7125         if (priority > 7 || !priv->qos_data.qos_enable)
7126                 priority = 0;
7127
7128         return from_priority_to_tx_queue[priority] - 1;
7129 }
7130
7131 static int ipw_is_qos_active(struct net_device *dev,
7132                              struct sk_buff *skb)
7133 {
7134         struct ipw_priv *priv = ieee80211_priv(dev);
7135         struct ieee80211_qos_data *qos_data = NULL;
7136         int active, supported;
7137         u8 *daddr = skb->data + ETH_ALEN;
7138         int unicast = !is_multicast_ether_addr(daddr);
7139
7140         if (!(priv->status & STATUS_ASSOCIATED))
7141                 return 0;
7142
7143         qos_data = &priv->assoc_network->qos_data;
7144
7145         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
7146                 if (unicast == 0)
7147                         qos_data->active = 0;
7148                 else
7149                         qos_data->active = qos_data->supported;
7150         }
7151         active = qos_data->active;
7152         supported = qos_data->supported;
7153         IPW_DEBUG_QOS("QoS  %d network is QoS active %d  supported %d  "
7154                       "unicast %d\n",
7155                       priv->qos_data.qos_enable, active, supported, unicast);
7156         if (active && priv->qos_data.qos_enable)
7157                 return 1;
7158
7159         return 0;
7160
7161 }
7162 /*
7163 * add QoS parameter to the TX command
7164 */
7165 static int ipw_qos_set_tx_queue_command(struct ipw_priv *priv,
7166                                         u16 priority,
7167                                         struct tfd_data *tfd)
7168 {
7169         int tx_queue_id = 0;
7170
7171
7172         tx_queue_id = from_priority_to_tx_queue[priority] - 1;
7173         tfd->tx_flags_ext |= DCT_FLAG_EXT_QOS_ENABLED;
7174
7175         if (priv->qos_data.qos_no_ack_mask & (1UL << tx_queue_id)) {
7176                 tfd->tx_flags &= ~DCT_FLAG_ACK_REQD;
7177                 tfd->tfd.tfd_26.mchdr.qos_ctrl |= cpu_to_le16(CTRL_QOS_NO_ACK);
7178         }
7179         return 0;
7180 }
7181
7182 /*
7183 * background support to run QoS activate functionality
7184 */
7185 static void ipw_bg_qos_activate(struct work_struct *work)
7186 {
7187         struct ipw_priv *priv =
7188                 container_of(work, struct ipw_priv, qos_activate);
7189
7190         if (priv == NULL)
7191                 return;
7192
7193         mutex_lock(&priv->mutex);
7194
7195         if (priv->status & STATUS_ASSOCIATED)
7196                 ipw_qos_activate(priv, &(priv->assoc_network->qos_data));
7197
7198         mutex_unlock(&priv->mutex);
7199 }
7200
7201 static int ipw_handle_probe_response(struct net_device *dev,
7202                                      struct ieee80211_probe_response *resp,
7203                                      struct ieee80211_network *network)
7204 {
7205         struct ipw_priv *priv = ieee80211_priv(dev);
7206         int active_network = ((priv->status & STATUS_ASSOCIATED) &&
7207                               (network == priv->assoc_network));
7208
7209         ipw_qos_handle_probe_response(priv, active_network, network);
7210
7211         return 0;
7212 }
7213
7214 static int ipw_handle_beacon(struct net_device *dev,
7215                              struct ieee80211_beacon *resp,
7216                              struct ieee80211_network *network)
7217 {
7218         struct ipw_priv *priv = ieee80211_priv(dev);
7219         int active_network = ((priv->status & STATUS_ASSOCIATED) &&
7220                               (network == priv->assoc_network));
7221
7222         ipw_qos_handle_probe_response(priv, active_network, network);
7223
7224         return 0;
7225 }
7226
7227 static int ipw_handle_assoc_response(struct net_device *dev,
7228                                      struct ieee80211_assoc_response *resp,
7229                                      struct ieee80211_network *network)
7230 {
7231         struct ipw_priv *priv = ieee80211_priv(dev);
7232         ipw_qos_association_resp(priv, network);
7233         return 0;
7234 }
7235
7236 static int ipw_send_qos_params_command(struct ipw_priv *priv, struct ieee80211_qos_parameters
7237                                        *qos_param)
7238 {
7239         return ipw_send_cmd_pdu(priv, IPW_CMD_QOS_PARAMETERS,
7240                                 sizeof(*qos_param) * 3, qos_param);
7241 }
7242
7243 static int ipw_send_qos_info_command(struct ipw_priv *priv, struct ieee80211_qos_information_element
7244                                      *qos_param)
7245 {
7246         return ipw_send_cmd_pdu(priv, IPW_CMD_WME_INFO, sizeof(*qos_param),
7247                                 qos_param);
7248 }
7249
7250 #endif                          /* CONFIG_IPW2200_QOS */
7251
7252 static int ipw_associate_network(struct ipw_priv *priv,
7253                                  struct ieee80211_network *network,
7254                                  struct ipw_supported_rates *rates, int roaming)
7255 {
7256         int err;
7257         DECLARE_MAC_BUF(mac);
7258
7259         if (priv->config & CFG_FIXED_RATE)
7260                 ipw_set_fixed_rate(priv, network->mode);
7261
7262         if (!(priv->config & CFG_STATIC_ESSID)) {
7263                 priv->essid_len = min(network->ssid_len,
7264                                       (u8) IW_ESSID_MAX_SIZE);
7265                 memcpy(priv->essid, network->ssid, priv->essid_len);
7266         }
7267
7268         network->last_associate = jiffies;
7269
7270         memset(&priv->assoc_request, 0, sizeof(priv->assoc_request));
7271         priv->assoc_request.channel = network->channel;
7272         priv->assoc_request.auth_key = 0;
7273
7274         if ((priv->capability & CAP_PRIVACY_ON) &&
7275             (priv->ieee->sec.auth_mode == WLAN_AUTH_SHARED_KEY)) {
7276                 priv->assoc_request.auth_type = AUTH_SHARED_KEY;
7277                 priv->assoc_request.auth_key = priv->ieee->sec.active_key;
7278
7279                 if (priv->ieee->sec.level == SEC_LEVEL_1)
7280                         ipw_send_wep_keys(priv, DCW_WEP_KEY_SEC_TYPE_WEP);
7281
7282         } else if ((priv->capability & CAP_PRIVACY_ON) &&
7283                    (priv->ieee->sec.auth_mode == WLAN_AUTH_LEAP))
7284                 priv->assoc_request.auth_type = AUTH_LEAP;
7285         else
7286                 priv->assoc_request.auth_type = AUTH_OPEN;
7287
7288         if (priv->ieee->wpa_ie_len) {
7289                 priv->assoc_request.policy_support = cpu_to_le16(0x02); /* RSN active */
7290                 ipw_set_rsn_capa(priv, priv->ieee->wpa_ie,
7291                                  priv->ieee->wpa_ie_len);
7292         }
7293
7294         /*
7295          * It is valid for our ieee device to support multiple modes, but
7296          * when it comes to associating to a given network we have to choose
7297          * just one mode.
7298          */
7299         if (network->mode & priv->ieee->mode & IEEE_A)
7300                 priv->assoc_request.ieee_mode = IPW_A_MODE;
7301         else if (network->mode & priv->ieee->mode & IEEE_G)
7302                 priv->assoc_request.ieee_mode = IPW_G_MODE;
7303         else if (network->mode & priv->ieee->mode & IEEE_B)
7304                 priv->assoc_request.ieee_mode = IPW_B_MODE;
7305
7306         priv->assoc_request.capability = cpu_to_le16(network->capability);
7307         if ((network->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
7308             && !(priv->config & CFG_PREAMBLE_LONG)) {
7309                 priv->assoc_request.preamble_length = DCT_FLAG_SHORT_PREAMBLE;
7310         } else {
7311                 priv->assoc_request.preamble_length = DCT_FLAG_LONG_PREAMBLE;
7312
7313                 /* Clear the short preamble if we won't be supporting it */
7314                 priv->assoc_request.capability &=
7315                     ~cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE);
7316         }
7317
7318         /* Clear capability bits that aren't used in Ad Hoc */
7319         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
7320                 priv->assoc_request.capability &=
7321                     ~cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME);
7322
7323         IPW_DEBUG_ASSOC("%sssocation attempt: '%s', channel %d, "
7324                         "802.11%c [%d], %s[:%s], enc=%s%s%s%c%c\n",
7325                         roaming ? "Rea" : "A",
7326                         escape_essid(priv->essid, priv->essid_len),
7327                         network->channel,
7328                         ipw_modes[priv->assoc_request.ieee_mode],
7329                         rates->num_rates,
7330                         (priv->assoc_request.preamble_length ==
7331                          DCT_FLAG_LONG_PREAMBLE) ? "long" : "short",
7332                         network->capability &
7333                         WLAN_CAPABILITY_SHORT_PREAMBLE ? "short" : "long",
7334                         priv->capability & CAP_PRIVACY_ON ? "on " : "off",
7335                         priv->capability & CAP_PRIVACY_ON ?
7336                         (priv->capability & CAP_SHARED_KEY ? "(shared)" :
7337                          "(open)") : "",
7338                         priv->capability & CAP_PRIVACY_ON ? " key=" : "",
7339                         priv->capability & CAP_PRIVACY_ON ?
7340                         '1' + priv->ieee->sec.active_key : '.',
7341                         priv->capability & CAP_PRIVACY_ON ? '.' : ' ');
7342
7343         priv->assoc_request.beacon_interval = cpu_to_le16(network->beacon_interval);
7344         if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
7345             (network->time_stamp[0] == 0) && (network->time_stamp[1] == 0)) {
7346                 priv->assoc_request.assoc_type = HC_IBSS_START;
7347                 priv->assoc_request.assoc_tsf_msw = 0;
7348                 priv->assoc_request.assoc_tsf_lsw = 0;
7349         } else {
7350                 if (unlikely(roaming))
7351                         priv->assoc_request.assoc_type = HC_REASSOCIATE;
7352                 else
7353                         priv->assoc_request.assoc_type = HC_ASSOCIATE;
7354                 priv->assoc_request.assoc_tsf_msw = cpu_to_le32(network->time_stamp[1]);
7355                 priv->assoc_request.assoc_tsf_lsw = cpu_to_le32(network->time_stamp[0]);
7356         }
7357
7358         memcpy(priv->assoc_request.bssid, network->bssid, ETH_ALEN);
7359
7360         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
7361                 memset(&priv->assoc_request.dest, 0xFF, ETH_ALEN);
7362                 priv->assoc_request.atim_window = cpu_to_le16(network->atim_window);
7363         } else {
7364                 memcpy(priv->assoc_request.dest, network->bssid, ETH_ALEN);
7365                 priv->assoc_request.atim_window = 0;
7366         }
7367
7368         priv->assoc_request.listen_interval = cpu_to_le16(network->listen_interval);
7369
7370         err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
7371         if (err) {
7372                 IPW_DEBUG_HC("Attempt to send SSID command failed.\n");
7373                 return err;
7374         }
7375
7376         rates->ieee_mode = priv->assoc_request.ieee_mode;
7377         rates->purpose = IPW_RATE_CONNECT;
7378         ipw_send_supported_rates(priv, rates);
7379
7380         if (priv->assoc_request.ieee_mode == IPW_G_MODE)
7381                 priv->sys_config.dot11g_auto_detection = 1;
7382         else
7383                 priv->sys_config.dot11g_auto_detection = 0;
7384
7385         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
7386                 priv->sys_config.answer_broadcast_ssid_probe = 1;
7387         else
7388                 priv->sys_config.answer_broadcast_ssid_probe = 0;
7389
7390         err = ipw_send_system_config(priv);
7391         if (err) {
7392                 IPW_DEBUG_HC("Attempt to send sys config command failed.\n");
7393                 return err;
7394         }
7395
7396         IPW_DEBUG_ASSOC("Association sensitivity: %d\n", network->stats.rssi);
7397         err = ipw_set_sensitivity(priv, network->stats.rssi + IPW_RSSI_TO_DBM);
7398         if (err) {
7399                 IPW_DEBUG_HC("Attempt to send associate command failed.\n");
7400                 return err;
7401         }
7402
7403         /*
7404          * If preemption is enabled, it is possible for the association
7405          * to complete before we return from ipw_send_associate.  Therefore
7406          * we have to be sure and update our priviate data first.
7407          */
7408         priv->channel = network->channel;
7409         memcpy(priv->bssid, network->bssid, ETH_ALEN);
7410         priv->status |= STATUS_ASSOCIATING;
7411         priv->status &= ~STATUS_SECURITY_UPDATED;
7412
7413         priv->assoc_network = network;
7414
7415 #ifdef CONFIG_IPW2200_QOS
7416         ipw_qos_association(priv, network);
7417 #endif
7418
7419         err = ipw_send_associate(priv, &priv->assoc_request);
7420         if (err) {
7421                 IPW_DEBUG_HC("Attempt to send associate command failed.\n");
7422                 return err;
7423         }
7424
7425         IPW_DEBUG(IPW_DL_STATE, "associating: '%s' %s \n",
7426                   escape_essid(priv->essid, priv->essid_len),
7427                   print_mac(mac, priv->bssid));
7428
7429         return 0;
7430 }
7431
7432 static void ipw_roam(void *data)
7433 {
7434         struct ipw_priv *priv = data;
7435         struct ieee80211_network *network = NULL;
7436         struct ipw_network_match match = {
7437                 .network = priv->assoc_network
7438         };
7439
7440         /* The roaming process is as follows:
7441          *
7442          * 1.  Missed beacon threshold triggers the roaming process by
7443          *     setting the status ROAM bit and requesting a scan.
7444          * 2.  When the scan completes, it schedules the ROAM work
7445          * 3.  The ROAM work looks at all of the known networks for one that
7446          *     is a better network than the currently associated.  If none
7447          *     found, the ROAM process is over (ROAM bit cleared)
7448          * 4.  If a better network is found, a disassociation request is
7449          *     sent.
7450          * 5.  When the disassociation completes, the roam work is again
7451          *     scheduled.  The second time through, the driver is no longer
7452          *     associated, and the newly selected network is sent an
7453          *     association request.
7454          * 6.  At this point ,the roaming process is complete and the ROAM
7455          *     status bit is cleared.
7456          */
7457
7458         /* If we are no longer associated, and the roaming bit is no longer
7459          * set, then we are not actively roaming, so just return */
7460         if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ROAMING)))
7461                 return;
7462
7463         if (priv->status & STATUS_ASSOCIATED) {
7464                 /* First pass through ROAM process -- look for a better
7465                  * network */
7466                 unsigned long flags;
7467                 u8 rssi = priv->assoc_network->stats.rssi;
7468                 priv->assoc_network->stats.rssi = -128;
7469                 spin_lock_irqsave(&priv->ieee->lock, flags);
7470                 list_for_each_entry(network, &priv->ieee->network_list, list) {
7471                         if (network != priv->assoc_network)
7472                                 ipw_best_network(priv, &match, network, 1);
7473                 }
7474                 spin_unlock_irqrestore(&priv->ieee->lock, flags);
7475                 priv->assoc_network->stats.rssi = rssi;
7476
7477                 if (match.network == priv->assoc_network) {
7478                         IPW_DEBUG_ASSOC("No better APs in this network to "
7479                                         "roam to.\n");
7480                         priv->status &= ~STATUS_ROAMING;
7481                         ipw_debug_config(priv);
7482                         return;
7483                 }
7484
7485                 ipw_send_disassociate(priv, 1);
7486                 priv->assoc_network = match.network;
7487
7488                 return;
7489         }
7490
7491         /* Second pass through ROAM process -- request association */
7492         ipw_compatible_rates(priv, priv->assoc_network, &match.rates);
7493         ipw_associate_network(priv, priv->assoc_network, &match.rates, 1);
7494         priv->status &= ~STATUS_ROAMING;
7495 }
7496
7497 static void ipw_bg_roam(struct work_struct *work)
7498 {
7499         struct ipw_priv *priv =
7500                 container_of(work, struct ipw_priv, roam);
7501         mutex_lock(&priv->mutex);
7502         ipw_roam(priv);
7503         mutex_unlock(&priv->mutex);
7504 }
7505
7506 static int ipw_associate(void *data)
7507 {
7508         struct ipw_priv *priv = data;
7509
7510         struct ieee80211_network *network = NULL;
7511         struct ipw_network_match match = {
7512                 .network = NULL
7513         };
7514         struct ipw_supported_rates *rates;
7515         struct list_head *element;
7516         unsigned long flags;
7517
7518         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
7519                 IPW_DEBUG_ASSOC("Not attempting association (monitor mode)\n");
7520                 return 0;
7521         }
7522
7523         if (priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
7524                 IPW_DEBUG_ASSOC("Not attempting association (already in "
7525                                 "progress)\n");
7526                 return 0;
7527         }
7528
7529         if (priv->status & STATUS_DISASSOCIATING) {
7530                 IPW_DEBUG_ASSOC("Not attempting association (in "
7531                                 "disassociating)\n ");
7532                 queue_work(priv->workqueue, &priv->associate);
7533                 return 0;
7534         }
7535
7536         if (!ipw_is_init(priv) || (priv->status & STATUS_SCANNING)) {
7537                 IPW_DEBUG_ASSOC("Not attempting association (scanning or not "
7538                                 "initialized)\n");
7539                 return 0;
7540         }
7541
7542         if (!(priv->config & CFG_ASSOCIATE) &&
7543             !(priv->config & (CFG_STATIC_ESSID |
7544                               CFG_STATIC_CHANNEL | CFG_STATIC_BSSID))) {
7545                 IPW_DEBUG_ASSOC("Not attempting association (associate=0)\n");
7546                 return 0;
7547         }
7548
7549         /* Protect our use of the network_list */
7550         spin_lock_irqsave(&priv->ieee->lock, flags);
7551         list_for_each_entry(network, &priv->ieee->network_list, list)
7552             ipw_best_network(priv, &match, network, 0);
7553
7554         network = match.network;
7555         rates = &match.rates;
7556
7557         if (network == NULL &&
7558             priv->ieee->iw_mode == IW_MODE_ADHOC &&
7559             priv->config & CFG_ADHOC_CREATE &&
7560             priv->config & CFG_STATIC_ESSID &&
7561             priv->config & CFG_STATIC_CHANNEL &&
7562             !list_empty(&priv->ieee->network_free_list)) {
7563                 element = priv->ieee->network_free_list.next;
7564                 network = list_entry(element, struct ieee80211_network, list);
7565                 ipw_adhoc_create(priv, network);
7566                 rates = &priv->rates;
7567                 list_del(element);
7568                 list_add_tail(&network->list, &priv->ieee->network_list);
7569         }
7570         spin_unlock_irqrestore(&priv->ieee->lock, flags);
7571
7572         /* If we reached the end of the list, then we don't have any valid
7573          * matching APs */
7574         if (!network) {
7575                 ipw_debug_config(priv);
7576
7577                 if (!(priv->status & STATUS_SCANNING)) {
7578                         if (!(priv->config & CFG_SPEED_SCAN))
7579                                 queue_delayed_work(priv->workqueue,
7580                                                    &priv->request_scan,
7581                                                    SCAN_INTERVAL);
7582                         else
7583                                 queue_delayed_work(priv->workqueue,
7584                                                    &priv->request_scan, 0);
7585                 }
7586
7587                 return 0;
7588         }
7589
7590         ipw_associate_network(priv, network, rates, 0);
7591
7592         return 1;
7593 }
7594
7595 static void ipw_bg_associate(struct work_struct *work)
7596 {
7597         struct ipw_priv *priv =
7598                 container_of(work, struct ipw_priv, associate);
7599         mutex_lock(&priv->mutex);
7600         ipw_associate(priv);
7601         mutex_unlock(&priv->mutex);
7602 }
7603
7604 static void ipw_rebuild_decrypted_skb(struct ipw_priv *priv,
7605                                       struct sk_buff *skb)
7606 {
7607         struct ieee80211_hdr *hdr;
7608         u16 fc;
7609
7610         hdr = (struct ieee80211_hdr *)skb->data;
7611         fc = le16_to_cpu(hdr->frame_ctl);
7612         if (!(fc & IEEE80211_FCTL_PROTECTED))
7613                 return;
7614
7615         fc &= ~IEEE80211_FCTL_PROTECTED;
7616         hdr->frame_ctl = cpu_to_le16(fc);
7617         switch (priv->ieee->sec.level) {
7618         case SEC_LEVEL_3:
7619                 /* Remove CCMP HDR */
7620                 memmove(skb->data + IEEE80211_3ADDR_LEN,
7621                         skb->data + IEEE80211_3ADDR_LEN + 8,
7622                         skb->len - IEEE80211_3ADDR_LEN - 8);
7623                 skb_trim(skb, skb->len - 16);   /* CCMP_HDR_LEN + CCMP_MIC_LEN */
7624                 break;
7625         case SEC_LEVEL_2:
7626                 break;
7627         case SEC_LEVEL_1:
7628                 /* Remove IV */
7629                 memmove(skb->data + IEEE80211_3ADDR_LEN,
7630                         skb->data + IEEE80211_3ADDR_LEN + 4,
7631                         skb->len - IEEE80211_3ADDR_LEN - 4);
7632                 skb_trim(skb, skb->len - 8);    /* IV + ICV */
7633                 break;
7634         case SEC_LEVEL_0:
7635                 break;
7636         default:
7637                 printk(KERN_ERR "Unknow security level %d\n",
7638                        priv->ieee->sec.level);
7639                 break;
7640         }
7641 }
7642
7643 static void ipw_handle_data_packet(struct ipw_priv *priv,
7644                                    struct ipw_rx_mem_buffer *rxb,
7645                                    struct ieee80211_rx_stats *stats)
7646 {
7647         struct ieee80211_hdr_4addr *hdr;
7648         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
7649
7650         /* We received data from the HW, so stop the watchdog */
7651         priv->net_dev->trans_start = jiffies;
7652
7653         /* We only process data packets if the
7654          * interface is open */
7655         if (unlikely((le16_to_cpu(pkt->u.frame.length) + IPW_RX_FRAME_SIZE) >
7656                      skb_tailroom(rxb->skb))) {
7657                 priv->ieee->stats.rx_errors++;
7658                 priv->wstats.discard.misc++;
7659                 IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
7660                 return;
7661         } else if (unlikely(!netif_running(priv->net_dev))) {
7662                 priv->ieee->stats.rx_dropped++;
7663                 priv->wstats.discard.misc++;
7664                 IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
7665                 return;
7666         }
7667
7668         /* Advance skb->data to the start of the actual payload */
7669         skb_reserve(rxb->skb, offsetof(struct ipw_rx_packet, u.frame.data));
7670
7671         /* Set the size of the skb to the size of the frame */
7672         skb_put(rxb->skb, le16_to_cpu(pkt->u.frame.length));
7673
7674         IPW_DEBUG_RX("Rx packet of %d bytes.\n", rxb->skb->len);
7675
7676         /* HW decrypt will not clear the WEP bit, MIC, PN, etc. */
7677         hdr = (struct ieee80211_hdr_4addr *)rxb->skb->data;
7678         if (priv->ieee->iw_mode != IW_MODE_MONITOR &&
7679             (is_multicast_ether_addr(hdr->addr1) ?
7680              !priv->ieee->host_mc_decrypt : !priv->ieee->host_decrypt))
7681                 ipw_rebuild_decrypted_skb(priv, rxb->skb);
7682
7683         if (!ieee80211_rx(priv->ieee, rxb->skb, stats))
7684                 priv->ieee->stats.rx_errors++;
7685         else {                  /* ieee80211_rx succeeded, so it now owns the SKB */
7686                 rxb->skb = NULL;
7687                 __ipw_led_activity_on(priv);
7688         }
7689 }
7690
7691 #ifdef CONFIG_IPW2200_RADIOTAP
7692 static void ipw_handle_data_packet_monitor(struct ipw_priv *priv,
7693                                            struct ipw_rx_mem_buffer *rxb,
7694                                            struct ieee80211_rx_stats *stats)
7695 {
7696         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
7697         struct ipw_rx_frame *frame = &pkt->u.frame;
7698
7699         /* initial pull of some data */
7700         u16 received_channel = frame->received_channel;
7701         u8 antennaAndPhy = frame->antennaAndPhy;
7702         s8 antsignal = frame->rssi_dbm - IPW_RSSI_TO_DBM;       /* call it signed anyhow */
7703         u16 pktrate = frame->rate;
7704
7705         /* Magic struct that slots into the radiotap header -- no reason
7706          * to build this manually element by element, we can write it much
7707          * more efficiently than we can parse it. ORDER MATTERS HERE */
7708         struct ipw_rt_hdr *ipw_rt;
7709
7710         short len = le16_to_cpu(pkt->u.frame.length);
7711
7712         /* We received data from the HW, so stop the watchdog */
7713         priv->net_dev->trans_start = jiffies;
7714
7715         /* We only process data packets if the
7716          * interface is open */
7717         if (unlikely((le16_to_cpu(pkt->u.frame.length) + IPW_RX_FRAME_SIZE) >
7718                      skb_tailroom(rxb->skb))) {
7719                 priv->ieee->stats.rx_errors++;
7720                 priv->wstats.discard.misc++;
7721                 IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
7722                 return;
7723         } else if (unlikely(!netif_running(priv->net_dev))) {
7724                 priv->ieee->stats.rx_dropped++;
7725                 priv->wstats.discard.misc++;
7726                 IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
7727                 return;
7728         }
7729
7730         /* Libpcap 0.9.3+ can handle variable length radiotap, so we'll use
7731          * that now */
7732         if (len > IPW_RX_BUF_SIZE - sizeof(struct ipw_rt_hdr)) {
7733                 /* FIXME: Should alloc bigger skb instead */
7734                 priv->ieee->stats.rx_dropped++;
7735                 priv->wstats.discard.misc++;
7736                 IPW_DEBUG_DROP("Dropping too large packet in monitor\n");
7737                 return;
7738         }
7739
7740         /* copy the frame itself */
7741         memmove(rxb->skb->data + sizeof(struct ipw_rt_hdr),
7742                 rxb->skb->data + IPW_RX_FRAME_SIZE, len);
7743
7744         /* Zero the radiotap static buffer  ...  We only need to zero the bytes NOT
7745          * part of our real header, saves a little time.
7746          *
7747          * No longer necessary since we fill in all our data.  Purge before merging
7748          * patch officially.
7749          * memset(rxb->skb->data + sizeof(struct ipw_rt_hdr), 0,
7750          *        IEEE80211_RADIOTAP_HDRLEN - sizeof(struct ipw_rt_hdr));
7751          */
7752
7753         ipw_rt = (struct ipw_rt_hdr *)rxb->skb->data;
7754
7755         ipw_rt->rt_hdr.it_version = PKTHDR_RADIOTAP_VERSION;
7756         ipw_rt->rt_hdr.it_pad = 0;      /* always good to zero */
7757         ipw_rt->rt_hdr.it_len = cpu_to_le16(sizeof(struct ipw_rt_hdr)); /* total header+data */
7758
7759         /* Big bitfield of all the fields we provide in radiotap */
7760         ipw_rt->rt_hdr.it_present = cpu_to_le32(
7761              (1 << IEEE80211_RADIOTAP_TSFT) |
7762              (1 << IEEE80211_RADIOTAP_FLAGS) |
7763              (1 << IEEE80211_RADIOTAP_RATE) |
7764              (1 << IEEE80211_RADIOTAP_CHANNEL) |
7765              (1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL) |
7766              (1 << IEEE80211_RADIOTAP_DBM_ANTNOISE) |
7767              (1 << IEEE80211_RADIOTAP_ANTENNA));
7768
7769         /* Zero the flags, we'll add to them as we go */
7770         ipw_rt->rt_flags = 0;
7771         ipw_rt->rt_tsf = (u64)(frame->parent_tsf[3] << 24 |
7772                                frame->parent_tsf[2] << 16 |
7773                                frame->parent_tsf[1] << 8  |
7774                                frame->parent_tsf[0]);
7775
7776         /* Convert signal to DBM */
7777         ipw_rt->rt_dbmsignal = antsignal;
7778         ipw_rt->rt_dbmnoise = frame->noise;
7779
7780         /* Convert the channel data and set the flags */
7781         ipw_rt->rt_channel = cpu_to_le16(ieee80211chan2mhz(received_channel));
7782         if (received_channel > 14) {    /* 802.11a */
7783                 ipw_rt->rt_chbitmask =
7784                     cpu_to_le16((IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ));
7785         } else if (antennaAndPhy & 32) {        /* 802.11b */
7786                 ipw_rt->rt_chbitmask =
7787                     cpu_to_le16((IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ));
7788         } else {                /* 802.11g */
7789                 ipw_rt->rt_chbitmask =
7790                     cpu_to_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ);
7791         }
7792
7793         /* set the rate in multiples of 500k/s */
7794         switch (pktrate) {
7795         case IPW_TX_RATE_1MB:
7796                 ipw_rt->rt_rate = 2;
7797                 break;
7798         case IPW_TX_RATE_2MB:
7799                 ipw_rt->rt_rate = 4;
7800                 break;
7801         case IPW_TX_RATE_5MB:
7802                 ipw_rt->rt_rate = 10;
7803                 break;
7804         case IPW_TX_RATE_6MB:
7805                 ipw_rt->rt_rate = 12;
7806                 break;
7807         case IPW_TX_RATE_9MB:
7808                 ipw_rt->rt_rate = 18;
7809                 break;
7810         case IPW_TX_RATE_11MB:
7811                 ipw_rt->rt_rate = 22;
7812                 break;
7813         case IPW_TX_RATE_12MB:
7814                 ipw_rt->rt_rate = 24;
7815                 break;
7816         case IPW_TX_RATE_18MB:
7817                 ipw_rt->rt_rate = 36;
7818                 break;
7819         case IPW_TX_RATE_24MB:
7820                 ipw_rt->rt_rate = 48;
7821                 break;
7822         case IPW_TX_RATE_36MB:
7823                 ipw_rt->rt_rate = 72;
7824                 break;
7825         case IPW_TX_RATE_48MB:
7826                 ipw_rt->rt_rate = 96;
7827                 break;
7828         case IPW_TX_RATE_54MB:
7829                 ipw_rt->rt_rate = 108;
7830                 break;
7831         default:
7832                 ipw_rt->rt_rate = 0;
7833                 break;
7834         }
7835
7836         /* antenna number */
7837         ipw_rt->rt_antenna = (antennaAndPhy & 3);       /* Is this right? */
7838
7839         /* set the preamble flag if we have it */
7840         if ((antennaAndPhy & 64))
7841                 ipw_rt->rt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
7842
7843         /* Set the size of the skb to the size of the frame */
7844         skb_put(rxb->skb, len + sizeof(struct ipw_rt_hdr));
7845
7846         IPW_DEBUG_RX("Rx packet of %d bytes.\n", rxb->skb->len);
7847
7848         if (!ieee80211_rx(priv->ieee, rxb->skb, stats))
7849                 priv->ieee->stats.rx_errors++;
7850         else {                  /* ieee80211_rx succeeded, so it now owns the SKB */
7851                 rxb->skb = NULL;
7852                 /* no LED during capture */
7853         }
7854 }
7855 #endif
7856
7857 #ifdef CONFIG_IPW2200_PROMISCUOUS
7858 #define ieee80211_is_probe_response(fc) \
7859    ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT && \
7860     (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP )
7861
7862 #define ieee80211_is_management(fc) \
7863    ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)
7864
7865 #define ieee80211_is_control(fc) \
7866    ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL)
7867
7868 #define ieee80211_is_data(fc) \
7869    ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
7870
7871 #define ieee80211_is_assoc_request(fc) \
7872    ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_ASSOC_REQ)
7873
7874 #define ieee80211_is_reassoc_request(fc) \
7875    ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_REASSOC_REQ)
7876
7877 static void ipw_handle_promiscuous_rx(struct ipw_priv *priv,
7878                                       struct ipw_rx_mem_buffer *rxb,
7879                                       struct ieee80211_rx_stats *stats)
7880 {
7881         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
7882         struct ipw_rx_frame *frame = &pkt->u.frame;
7883         struct ipw_rt_hdr *ipw_rt;
7884
7885         /* First cache any information we need before we overwrite
7886          * the information provided in the skb from the hardware */
7887         struct ieee80211_hdr *hdr;
7888         u16 channel = frame->received_channel;
7889         u8 phy_flags = frame->antennaAndPhy;
7890         s8 signal = frame->rssi_dbm - IPW_RSSI_TO_DBM;
7891         s8 noise = frame->noise;
7892         u8 rate = frame->rate;
7893         short len = le16_to_cpu(pkt->u.frame.length);
7894         struct sk_buff *skb;
7895         int hdr_only = 0;
7896         u16 filter = priv->prom_priv->filter;
7897
7898         /* If the filter is set to not include Rx frames then return */
7899         if (filter & IPW_PROM_NO_RX)
7900                 return;
7901
7902         /* We received data from the HW, so stop the watchdog */
7903         priv->prom_net_dev->trans_start = jiffies;
7904
7905         if (unlikely((len + IPW_RX_FRAME_SIZE) > skb_tailroom(rxb->skb))) {
7906                 priv->prom_priv->ieee->stats.rx_errors++;
7907                 IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
7908                 return;
7909         }
7910
7911         /* We only process data packets if the interface is open */
7912         if (unlikely(!netif_running(priv->prom_net_dev))) {
7913                 priv->prom_priv->ieee->stats.rx_dropped++;
7914                 IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
7915                 return;
7916         }
7917
7918         /* Libpcap 0.9.3+ can handle variable length radiotap, so we'll use
7919          * that now */
7920         if (len > IPW_RX_BUF_SIZE - sizeof(struct ipw_rt_hdr)) {
7921                 /* FIXME: Should alloc bigger skb instead */
7922                 priv->prom_priv->ieee->stats.rx_dropped++;
7923                 IPW_DEBUG_DROP("Dropping too large packet in monitor\n");
7924                 return;
7925         }
7926
7927         hdr = (void *)rxb->skb->data + IPW_RX_FRAME_SIZE;
7928         if (ieee80211_is_management(le16_to_cpu(hdr->frame_ctl))) {
7929                 if (filter & IPW_PROM_NO_MGMT)
7930                         return;
7931                 if (filter & IPW_PROM_MGMT_HEADER_ONLY)
7932                         hdr_only = 1;
7933         } else if (ieee80211_is_control(le16_to_cpu(hdr->frame_ctl))) {
7934                 if (filter & IPW_PROM_NO_CTL)
7935                         return;
7936                 if (filter & IPW_PROM_CTL_HEADER_ONLY)
7937                         hdr_only = 1;
7938         } else if (ieee80211_is_data(le16_to_cpu(hdr->frame_ctl))) {
7939                 if (filter & IPW_PROM_NO_DATA)
7940                         return;
7941                 if (filter & IPW_PROM_DATA_HEADER_ONLY)
7942                         hdr_only = 1;
7943         }
7944
7945         /* Copy the SKB since this is for the promiscuous side */
7946         skb = skb_copy(rxb->skb, GFP_ATOMIC);
7947         if (skb == NULL) {
7948                 IPW_ERROR("skb_clone failed for promiscuous copy.\n");
7949                 return;
7950         }
7951
7952         /* copy the frame data to write after where the radiotap header goes */
7953         ipw_rt = (void *)skb->data;
7954
7955         if (hdr_only)
7956                 len = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
7957
7958         memcpy(ipw_rt->payload, hdr, len);
7959
7960         /* Zero the radiotap static buffer  ...  We only need to zero the bytes
7961          * NOT part of our real header, saves a little time.
7962          *
7963          * No longer necessary since we fill in all our data.  Purge before
7964          * merging patch officially.
7965          * memset(rxb->skb->data + sizeof(struct ipw_rt_hdr), 0,
7966          *        IEEE80211_RADIOTAP_HDRLEN - sizeof(struct ipw_rt_hdr));
7967          */
7968
7969         ipw_rt->rt_hdr.it_version = PKTHDR_RADIOTAP_VERSION;
7970         ipw_rt->rt_hdr.it_pad = 0;      /* always good to zero */
7971         ipw_rt->rt_hdr.it_len = cpu_to_le16(sizeof(*ipw_rt));   /* total header+data */
7972
7973         /* Set the size of the skb to the size of the frame */
7974         skb_put(skb, sizeof(*ipw_rt) + len);
7975
7976         /* Big bitfield of all the fields we provide in radiotap */
7977         ipw_rt->rt_hdr.it_present = cpu_to_le32(
7978              (1 << IEEE80211_RADIOTAP_TSFT) |
7979              (1 << IEEE80211_RADIOTAP_FLAGS) |
7980              (1 << IEEE80211_RADIOTAP_RATE) |
7981              (1 << IEEE80211_RADIOTAP_CHANNEL) |
7982              (1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL) |
7983              (1 << IEEE80211_RADIOTAP_DBM_ANTNOISE) |
7984              (1 << IEEE80211_RADIOTAP_ANTENNA));
7985
7986         /* Zero the flags, we'll add to them as we go */
7987         ipw_rt->rt_flags = 0;
7988         ipw_rt->rt_tsf = (u64)(frame->parent_tsf[3] << 24 |
7989                                frame->parent_tsf[2] << 16 |
7990                                frame->parent_tsf[1] << 8  |
7991                                frame->parent_tsf[0]);
7992
7993         /* Convert to DBM */
7994         ipw_rt->rt_dbmsignal = signal;
7995         ipw_rt->rt_dbmnoise = noise;
7996
7997         /* Convert the channel data and set the flags */
7998         ipw_rt->rt_channel = cpu_to_le16(ieee80211chan2mhz(channel));
7999         if (channel > 14) {     /* 802.11a */
8000                 ipw_rt->rt_chbitmask =
8001                     cpu_to_le16((IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ));
8002         } else if (phy_flags & (1 << 5)) {      /* 802.11b */
8003                 ipw_rt->rt_chbitmask =
8004                     cpu_to_le16((IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ));
8005         } else {                /* 802.11g */
8006                 ipw_rt->rt_chbitmask =
8007                     cpu_to_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ);
8008         }
8009
8010         /* set the rate in multiples of 500k/s */
8011         switch (rate) {
8012         case IPW_TX_RATE_1MB:
8013                 ipw_rt->rt_rate = 2;
8014                 break;
8015         case IPW_TX_RATE_2MB:
8016                 ipw_rt->rt_rate = 4;
8017                 break;
8018         case IPW_TX_RATE_5MB:
8019                 ipw_rt->rt_rate = 10;
8020                 break;
8021         case IPW_TX_RATE_6MB:
8022                 ipw_rt->rt_rate = 12;
8023                 break;
8024         case IPW_TX_RATE_9MB:
8025                 ipw_rt->rt_rate = 18;
8026                 break;
8027         case IPW_TX_RATE_11MB:
8028                 ipw_rt->rt_rate = 22;
8029                 break;
8030         case IPW_TX_RATE_12MB:
8031                 ipw_rt->rt_rate = 24;
8032                 break;
8033         case IPW_TX_RATE_18MB:
8034                 ipw_rt->rt_rate = 36;
8035                 break;
8036         case IPW_TX_RATE_24MB:
8037                 ipw_rt->rt_rate = 48;
8038                 break;
8039         case IPW_TX_RATE_36MB:
8040                 ipw_rt->rt_rate = 72;
8041                 break;
8042         case IPW_TX_RATE_48MB:
8043                 ipw_rt->rt_rate = 96;
8044                 break;
8045         case IPW_TX_RATE_54MB:
8046                 ipw_rt->rt_rate = 108;
8047                 break;
8048         default:
8049                 ipw_rt->rt_rate = 0;
8050                 break;
8051         }
8052
8053         /* antenna number */
8054         ipw_rt->rt_antenna = (phy_flags & 3);
8055
8056         /* set the preamble flag if we have it */
8057         if (phy_flags & (1 << 6))
8058                 ipw_rt->rt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
8059
8060         IPW_DEBUG_RX("Rx packet of %d bytes.\n", skb->len);
8061
8062         if (!ieee80211_rx(priv->prom_priv->ieee, skb, stats)) {
8063                 priv->prom_priv->ieee->stats.rx_errors++;
8064                 dev_kfree_skb_any(skb);
8065         }
8066 }
8067 #endif
8068
8069 static int is_network_packet(struct ipw_priv *priv,
8070                                     struct ieee80211_hdr_4addr *header)
8071 {
8072         /* Filter incoming packets to determine if they are targetted toward
8073          * this network, discarding packets coming from ourselves */
8074         switch (priv->ieee->iw_mode) {
8075         case IW_MODE_ADHOC:     /* Header: Dest. | Source    | BSSID */
8076                 /* packets from our adapter are dropped (echo) */
8077                 if (!memcmp(header->addr2, priv->net_dev->dev_addr, ETH_ALEN))
8078                         return 0;
8079
8080                 /* {broad,multi}cast packets to our BSSID go through */
8081                 if (is_multicast_ether_addr(header->addr1))
8082                         return !memcmp(header->addr3, priv->bssid, ETH_ALEN);
8083
8084                 /* packets to our adapter go through */
8085                 return !memcmp(header->addr1, priv->net_dev->dev_addr,
8086                                ETH_ALEN);
8087
8088         case IW_MODE_INFRA:     /* Header: Dest. | BSSID | Source */
8089                 /* packets from our adapter are dropped (echo) */
8090                 if (!memcmp(header->addr3, priv->net_dev->dev_addr, ETH_ALEN))
8091                         return 0;
8092
8093                 /* {broad,multi}cast packets to our BSS go through */
8094                 if (is_multicast_ether_addr(header->addr1))
8095                         return !memcmp(header->addr2, priv->bssid, ETH_ALEN);
8096
8097                 /* packets to our adapter go through */
8098                 return !memcmp(header->addr1, priv->net_dev->dev_addr,
8099                                ETH_ALEN);
8100         }
8101
8102         return 1;
8103 }
8104
8105 #define IPW_PACKET_RETRY_TIME HZ
8106
8107 static  int is_duplicate_packet(struct ipw_priv *priv,
8108                                       struct ieee80211_hdr_4addr *header)
8109 {
8110         u16 sc = le16_to_cpu(header->seq_ctl);
8111         u16 seq = WLAN_GET_SEQ_SEQ(sc);
8112         u16 frag = WLAN_GET_SEQ_FRAG(sc);
8113         u16 *last_seq, *last_frag;
8114         unsigned long *last_time;
8115
8116         switch (priv->ieee->iw_mode) {
8117         case IW_MODE_ADHOC:
8118                 {
8119                         struct list_head *p;
8120                         struct ipw_ibss_seq *entry = NULL;
8121                         u8 *mac = header->addr2;
8122                         int index = mac[5] % IPW_IBSS_MAC_HASH_SIZE;
8123
8124                         __list_for_each(p, &priv->ibss_mac_hash[index]) {
8125                                 entry =
8126                                     list_entry(p, struct ipw_ibss_seq, list);
8127                                 if (!memcmp(entry->mac, mac, ETH_ALEN))
8128                                         break;
8129                         }
8130                         if (p == &priv->ibss_mac_hash[index]) {
8131                                 entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
8132                                 if (!entry) {
8133                                         IPW_ERROR
8134                                             ("Cannot malloc new mac entry\n");
8135                                         return 0;
8136                                 }
8137                                 memcpy(entry->mac, mac, ETH_ALEN);
8138                                 entry->seq_num = seq;
8139                                 entry->frag_num = frag;
8140                                 entry->packet_time = jiffies;
8141                                 list_add(&entry->list,
8142                                          &priv->ibss_mac_hash[index]);
8143                                 return 0;
8144                         }
8145                         last_seq = &entry->seq_num;
8146                         last_frag = &entry->frag_num;
8147                         last_time = &entry->packet_time;
8148                         break;
8149                 }
8150         case IW_MODE_INFRA:
8151                 last_seq = &priv->last_seq_num;
8152                 last_frag = &priv->last_frag_num;
8153                 last_time = &priv->last_packet_time;
8154                 break;
8155         default:
8156                 return 0;
8157         }
8158         if ((*last_seq == seq) &&
8159             time_after(*last_time + IPW_PACKET_RETRY_TIME, jiffies)) {
8160                 if (*last_frag == frag)
8161                         goto drop;
8162                 if (*last_frag + 1 != frag)
8163                         /* out-of-order fragment */
8164                         goto drop;
8165         } else
8166                 *last_seq = seq;
8167
8168         *last_frag = frag;
8169         *last_time = jiffies;
8170         return 0;
8171
8172       drop:
8173         /* Comment this line now since we observed the card receives
8174          * duplicate packets but the FCTL_RETRY bit is not set in the
8175          * IBSS mode with fragmentation enabled.
8176          BUG_ON(!(le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_RETRY)); */
8177         return 1;
8178 }
8179
8180 static void ipw_handle_mgmt_packet(struct ipw_priv *priv,
8181                                    struct ipw_rx_mem_buffer *rxb,
8182                                    struct ieee80211_rx_stats *stats)
8183 {
8184         struct sk_buff *skb = rxb->skb;
8185         struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)skb->data;
8186         struct ieee80211_hdr_4addr *header = (struct ieee80211_hdr_4addr *)
8187             (skb->data + IPW_RX_FRAME_SIZE);
8188
8189         ieee80211_rx_mgt(priv->ieee, header, stats);
8190
8191         if (priv->ieee->iw_mode == IW_MODE_ADHOC &&
8192             ((WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) ==
8193               IEEE80211_STYPE_PROBE_RESP) ||
8194              (WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) ==
8195               IEEE80211_STYPE_BEACON))) {
8196                 if (!memcmp(header->addr3, priv->bssid, ETH_ALEN))
8197                         ipw_add_station(priv, header->addr2);
8198         }
8199
8200         if (priv->config & CFG_NET_STATS) {
8201                 IPW_DEBUG_HC("sending stat packet\n");
8202
8203                 /* Set the size of the skb to the size of the full
8204                  * ipw header and 802.11 frame */
8205                 skb_put(skb, le16_to_cpu(pkt->u.frame.length) +
8206                         IPW_RX_FRAME_SIZE);
8207
8208                 /* Advance past the ipw packet header to the 802.11 frame */
8209                 skb_pull(skb, IPW_RX_FRAME_SIZE);
8210
8211                 /* Push the ieee80211_rx_stats before the 802.11 frame */
8212                 memcpy(skb_push(skb, sizeof(*stats)), stats, sizeof(*stats));
8213
8214                 skb->dev = priv->ieee->dev;
8215
8216                 /* Point raw at the ieee80211_stats */
8217                 skb_reset_mac_header(skb);
8218
8219                 skb->pkt_type = PACKET_OTHERHOST;
8220                 skb->protocol = __constant_htons(ETH_P_80211_STATS);
8221                 memset(skb->cb, 0, sizeof(rxb->skb->cb));
8222                 netif_rx(skb);
8223                 rxb->skb = NULL;
8224         }
8225 }
8226
8227 /*
8228  * Main entry function for recieving a packet with 80211 headers.  This
8229  * should be called when ever the FW has notified us that there is a new
8230  * skb in the recieve queue.
8231  */
8232 static void ipw_rx(struct ipw_priv *priv)
8233 {
8234         struct ipw_rx_mem_buffer *rxb;
8235         struct ipw_rx_packet *pkt;
8236         struct ieee80211_hdr_4addr *header;
8237         u32 r, w, i;
8238         u8 network_packet;
8239         u8 fill_rx = 0;
8240         DECLARE_MAC_BUF(mac);
8241         DECLARE_MAC_BUF(mac2);
8242         DECLARE_MAC_BUF(mac3);
8243
8244         r = ipw_read32(priv, IPW_RX_READ_INDEX);
8245         w = ipw_read32(priv, IPW_RX_WRITE_INDEX);
8246         i = priv->rxq->read;
8247
8248         if (ipw_rx_queue_space (priv->rxq) > (RX_QUEUE_SIZE / 2))
8249                 fill_rx = 1;
8250
8251         while (i != r) {
8252                 rxb = priv->rxq->queue[i];
8253                 if (unlikely(rxb == NULL)) {
8254                         printk(KERN_CRIT "Queue not allocated!\n");
8255                         break;
8256                 }
8257                 priv->rxq->queue[i] = NULL;
8258
8259                 pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->dma_addr,
8260                                             IPW_RX_BUF_SIZE,
8261                                             PCI_DMA_FROMDEVICE);
8262
8263                 pkt = (struct ipw_rx_packet *)rxb->skb->data;
8264                 IPW_DEBUG_RX("Packet: type=%02X seq=%02X bits=%02X\n",
8265                              pkt->header.message_type,
8266                              pkt->header.rx_seq_num, pkt->header.control_bits);
8267
8268                 switch (pkt->header.message_type) {
8269                 case RX_FRAME_TYPE:     /* 802.11 frame */  {
8270                                 struct ieee80211_rx_stats stats = {
8271                                         .rssi = pkt->u.frame.rssi_dbm -
8272                                             IPW_RSSI_TO_DBM,
8273                                         .signal =
8274                                             le16_to_cpu(pkt->u.frame.rssi_dbm) -
8275                                             IPW_RSSI_TO_DBM + 0x100,
8276                                         .noise =
8277                                             le16_to_cpu(pkt->u.frame.noise),
8278                                         .rate = pkt->u.frame.rate,
8279                                         .mac_time = jiffies,
8280                                         .received_channel =
8281                                             pkt->u.frame.received_channel,
8282                                         .freq =
8283                                             (pkt->u.frame.
8284                                              control & (1 << 0)) ?
8285                                             IEEE80211_24GHZ_BAND :
8286                                             IEEE80211_52GHZ_BAND,
8287                                         .len = le16_to_cpu(pkt->u.frame.length),
8288                                 };
8289
8290                                 if (stats.rssi != 0)
8291                                         stats.mask |= IEEE80211_STATMASK_RSSI;
8292                                 if (stats.signal != 0)
8293                                         stats.mask |= IEEE80211_STATMASK_SIGNAL;
8294                                 if (stats.noise != 0)
8295                                         stats.mask |= IEEE80211_STATMASK_NOISE;
8296                                 if (stats.rate != 0)
8297                                         stats.mask |= IEEE80211_STATMASK_RATE;
8298
8299                                 priv->rx_packets++;
8300
8301 #ifdef CONFIG_IPW2200_PROMISCUOUS
8302         if (priv->prom_net_dev && netif_running(priv->prom_net_dev))
8303                 ipw_handle_promiscuous_rx(priv, rxb, &stats);
8304 #endif
8305
8306 #ifdef CONFIG_IPW2200_MONITOR
8307                                 if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
8308 #ifdef CONFIG_IPW2200_RADIOTAP
8309
8310                 ipw_handle_data_packet_monitor(priv,
8311                                                rxb,
8312                                                &stats);
8313 #else
8314                 ipw_handle_data_packet(priv, rxb,
8315                                        &stats);
8316 #endif
8317                                         break;
8318                                 }
8319 #endif
8320
8321                                 header =
8322                                     (struct ieee80211_hdr_4addr *)(rxb->skb->
8323                                                                    data +
8324                                                                    IPW_RX_FRAME_SIZE);
8325                                 /* TODO: Check Ad-Hoc dest/source and make sure
8326                                  * that we are actually parsing these packets
8327                                  * correctly -- we should probably use the
8328                                  * frame control of the packet and disregard
8329                                  * the current iw_mode */
8330
8331                                 network_packet =
8332                                     is_network_packet(priv, header);
8333                                 if (network_packet && priv->assoc_network) {
8334                                         priv->assoc_network->stats.rssi =
8335                                             stats.rssi;
8336                                         priv->exp_avg_rssi =
8337                                             exponential_average(priv->exp_avg_rssi,
8338                                             stats.rssi, DEPTH_RSSI);
8339                                 }
8340
8341                                 IPW_DEBUG_RX("Frame: len=%u\n",
8342                                              le16_to_cpu(pkt->u.frame.length));
8343
8344                                 if (le16_to_cpu(pkt->u.frame.length) <
8345                                     ieee80211_get_hdrlen(le16_to_cpu(
8346                                                     header->frame_ctl))) {
8347                                         IPW_DEBUG_DROP
8348                                             ("Received packet is too small. "
8349                                              "Dropping.\n");
8350                                         priv->ieee->stats.rx_errors++;
8351                                         priv->wstats.discard.misc++;
8352                                         break;
8353                                 }
8354
8355                                 switch (WLAN_FC_GET_TYPE
8356                                         (le16_to_cpu(header->frame_ctl))) {
8357
8358                                 case IEEE80211_FTYPE_MGMT:
8359                                         ipw_handle_mgmt_packet(priv, rxb,
8360                                                                &stats);
8361                                         break;
8362
8363                                 case IEEE80211_FTYPE_CTL:
8364                                         break;
8365
8366                                 case IEEE80211_FTYPE_DATA:
8367                                         if (unlikely(!network_packet ||
8368                                                      is_duplicate_packet(priv,
8369                                                                          header)))
8370                                         {
8371                                                 IPW_DEBUG_DROP("Dropping: "
8372                                                                "%s, "
8373                                                                "%s, "
8374                                                                "%s\n",
8375                                                                print_mac(mac,
8376                                                                          header->
8377                                                                        addr1),
8378                                                                print_mac(mac2,
8379                                                                          header->
8380                                                                        addr2),
8381                                                                print_mac(mac3,
8382                                                                          header->
8383                                                                        addr3));
8384                                                 break;
8385                                         }
8386
8387                                         ipw_handle_data_packet(priv, rxb,
8388                                                                &stats);
8389
8390                                         break;
8391                                 }
8392                                 break;
8393                         }
8394
8395                 case RX_HOST_NOTIFICATION_TYPE:{
8396                                 IPW_DEBUG_RX
8397                                     ("Notification: subtype=%02X flags=%02X size=%d\n",
8398                                      pkt->u.notification.subtype,
8399                                      pkt->u.notification.flags,
8400                                      le16_to_cpu(pkt->u.notification.size));
8401                                 ipw_rx_notification(priv, &pkt->u.notification);
8402                                 break;
8403                         }
8404
8405                 default:
8406                         IPW_DEBUG_RX("Bad Rx packet of type %d\n",
8407                                      pkt->header.message_type);
8408                         break;
8409                 }
8410
8411                 /* For now we just don't re-use anything.  We can tweak this
8412                  * later to try and re-use notification packets and SKBs that
8413                  * fail to Rx correctly */
8414                 if (rxb->skb != NULL) {
8415                         dev_kfree_skb_any(rxb->skb);
8416                         rxb->skb = NULL;
8417                 }
8418
8419                 pci_unmap_single(priv->pci_dev, rxb->dma_addr,
8420                                  IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
8421                 list_add_tail(&rxb->list, &priv->rxq->rx_used);
8422
8423                 i = (i + 1) % RX_QUEUE_SIZE;
8424
8425                 /* If there are a lot of unsued frames, restock the Rx queue
8426                  * so the ucode won't assert */
8427                 if (fill_rx) {
8428                         priv->rxq->read = i;
8429                         ipw_rx_queue_replenish(priv);
8430                 }
8431         }
8432
8433         /* Backtrack one entry */
8434         priv->rxq->read = i;
8435         ipw_rx_queue_restock(priv);
8436 }
8437
8438 #define DEFAULT_RTS_THRESHOLD     2304U
8439 #define MIN_RTS_THRESHOLD         1U
8440 #define MAX_RTS_THRESHOLD         2304U
8441 #define DEFAULT_BEACON_INTERVAL   100U
8442 #define DEFAULT_SHORT_RETRY_LIMIT 7U
8443 #define DEFAULT_LONG_RETRY_LIMIT  4U
8444
8445 /**
8446  * ipw_sw_reset
8447  * @option: options to control different reset behaviour
8448  *          0 = reset everything except the 'disable' module_param
8449  *          1 = reset everything and print out driver info (for probe only)
8450  *          2 = reset everything
8451  */
8452 static int ipw_sw_reset(struct ipw_priv *priv, int option)
8453 {
8454         int band, modulation;
8455         int old_mode = priv->ieee->iw_mode;
8456
8457         /* Initialize module parameter values here */
8458         priv->config = 0;
8459
8460         /* We default to disabling the LED code as right now it causes
8461          * too many systems to lock up... */
8462         if (!led)
8463                 priv->config |= CFG_NO_LED;
8464
8465         if (associate)
8466                 priv->config |= CFG_ASSOCIATE;
8467         else
8468                 IPW_DEBUG_INFO("Auto associate disabled.\n");
8469
8470         if (auto_create)
8471                 priv->config |= CFG_ADHOC_CREATE;
8472         else
8473                 IPW_DEBUG_INFO("Auto adhoc creation disabled.\n");
8474
8475         priv->config &= ~CFG_STATIC_ESSID;
8476         priv->essid_len = 0;
8477         memset(priv->essid, 0, IW_ESSID_MAX_SIZE);
8478
8479         if (disable && option) {
8480                 priv->status |= STATUS_RF_KILL_SW;
8481                 IPW_DEBUG_INFO("Radio disabled.\n");
8482         }
8483
8484         if (channel != 0) {
8485                 priv->config |= CFG_STATIC_CHANNEL;
8486                 priv->channel = channel;
8487                 IPW_DEBUG_INFO("Bind to static channel %d\n", channel);
8488                 /* TODO: Validate that provided channel is in range */
8489         }
8490 #ifdef CONFIG_IPW2200_QOS
8491         ipw_qos_init(priv, qos_enable, qos_burst_enable,
8492                      burst_duration_CCK, burst_duration_OFDM);
8493 #endif                          /* CONFIG_IPW2200_QOS */
8494
8495         switch (mode) {
8496         case 1:
8497                 priv->ieee->iw_mode = IW_MODE_ADHOC;
8498                 priv->net_dev->type = ARPHRD_ETHER;
8499
8500                 break;
8501 #ifdef CONFIG_IPW2200_MONITOR
8502         case 2:
8503                 priv->ieee->iw_mode = IW_MODE_MONITOR;
8504 #ifdef CONFIG_IPW2200_RADIOTAP
8505                 priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
8506 #else
8507                 priv->net_dev->type = ARPHRD_IEEE80211;
8508 #endif
8509                 break;
8510 #endif
8511         default:
8512         case 0:
8513                 priv->net_dev->type = ARPHRD_ETHER;
8514                 priv->ieee->iw_mode = IW_MODE_INFRA;
8515                 break;
8516         }
8517
8518         if (hwcrypto) {
8519                 priv->ieee->host_encrypt = 0;
8520                 priv->ieee->host_encrypt_msdu = 0;
8521                 priv->ieee->host_decrypt = 0;
8522                 priv->ieee->host_mc_decrypt = 0;
8523         }
8524         IPW_DEBUG_INFO("Hardware crypto [%s]\n", hwcrypto ? "on" : "off");
8525
8526         /* IPW2200/2915 is abled to do hardware fragmentation. */
8527         priv->ieee->host_open_frag = 0;
8528
8529         if ((priv->pci_dev->device == 0x4223) ||
8530             (priv->pci_dev->device == 0x4224)) {
8531                 if (option == 1)
8532                         printk(KERN_INFO DRV_NAME
8533                                ": Detected Intel PRO/Wireless 2915ABG Network "
8534                                "Connection\n");
8535                 priv->ieee->abg_true = 1;
8536                 band = IEEE80211_52GHZ_BAND | IEEE80211_24GHZ_BAND;
8537                 modulation = IEEE80211_OFDM_MODULATION |
8538                     IEEE80211_CCK_MODULATION;
8539                 priv->adapter = IPW_2915ABG;
8540                 priv->ieee->mode = IEEE_A | IEEE_G | IEEE_B;
8541         } else {
8542                 if (option == 1)
8543                         printk(KERN_INFO DRV_NAME
8544                                ": Detected Intel PRO/Wireless 2200BG Network "
8545                                "Connection\n");
8546
8547                 priv->ieee->abg_true = 0;
8548                 band = IEEE80211_24GHZ_BAND;
8549                 modulation = IEEE80211_OFDM_MODULATION |
8550                     IEEE80211_CCK_MODULATION;
8551                 priv->adapter = IPW_2200BG;
8552                 priv->ieee->mode = IEEE_G | IEEE_B;
8553         }
8554
8555         priv->ieee->freq_band = band;
8556         priv->ieee->modulation = modulation;
8557
8558         priv->rates_mask = IEEE80211_DEFAULT_RATES_MASK;
8559
8560         priv->disassociate_threshold = IPW_MB_DISASSOCIATE_THRESHOLD_DEFAULT;
8561         priv->roaming_threshold = IPW_MB_ROAMING_THRESHOLD_DEFAULT;
8562
8563         priv->rts_threshold = DEFAULT_RTS_THRESHOLD;
8564         priv->short_retry_limit = DEFAULT_SHORT_RETRY_LIMIT;
8565         priv->long_retry_limit = DEFAULT_LONG_RETRY_LIMIT;
8566
8567         /* If power management is turned on, default to AC mode */
8568         priv->power_mode = IPW_POWER_AC;
8569         priv->tx_power = IPW_TX_POWER_DEFAULT;
8570
8571         return old_mode == priv->ieee->iw_mode;
8572 }
8573
8574 /*
8575  * This file defines the Wireless Extension handlers.  It does not
8576  * define any methods of hardware manipulation and relies on the
8577  * functions defined in ipw_main to provide the HW interaction.
8578  *
8579  * The exception to this is the use of the ipw_get_ordinal()
8580  * function used to poll the hardware vs. making unecessary calls.
8581  *
8582  */
8583
8584 static int ipw_wx_get_name(struct net_device *dev,
8585                            struct iw_request_info *info,
8586                            union iwreq_data *wrqu, char *extra)
8587 {
8588         struct ipw_priv *priv = ieee80211_priv(dev);
8589         mutex_lock(&priv->mutex);
8590         if (priv->status & STATUS_RF_KILL_MASK)
8591                 strcpy(wrqu->name, "radio off");
8592         else if (!(priv->status & STATUS_ASSOCIATED))
8593                 strcpy(wrqu->name, "unassociated");
8594         else
8595                 snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11%c",
8596                          ipw_modes[priv->assoc_request.ieee_mode]);
8597         IPW_DEBUG_WX("Name: %s\n", wrqu->name);
8598         mutex_unlock(&priv->mutex);
8599         return 0;
8600 }
8601
8602 static int ipw_set_channel(struct ipw_priv *priv, u8 channel)
8603 {
8604         if (channel == 0) {
8605                 IPW_DEBUG_INFO("Setting channel to ANY (0)\n");
8606                 priv->config &= ~CFG_STATIC_CHANNEL;
8607                 IPW_DEBUG_ASSOC("Attempting to associate with new "
8608                                 "parameters.\n");
8609                 ipw_associate(priv);
8610                 return 0;
8611         }
8612
8613         priv->config |= CFG_STATIC_CHANNEL;
8614
8615         if (priv->channel == channel) {
8616                 IPW_DEBUG_INFO("Request to set channel to current value (%d)\n",
8617                                channel);
8618                 return 0;
8619         }
8620
8621         IPW_DEBUG_INFO("Setting channel to %i\n", (int)channel);
8622         priv->channel = channel;
8623
8624 #ifdef CONFIG_IPW2200_MONITOR
8625         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
8626                 int i;
8627                 if (priv->status & STATUS_SCANNING) {
8628                         IPW_DEBUG_SCAN("Scan abort triggered due to "
8629                                        "channel change.\n");
8630                         ipw_abort_scan(priv);
8631                 }
8632
8633                 for (i = 1000; i && (priv->status & STATUS_SCANNING); i--)
8634                         udelay(10);
8635
8636                 if (priv->status & STATUS_SCANNING)
8637                         IPW_DEBUG_SCAN("Still scanning...\n");
8638                 else
8639                         IPW_DEBUG_SCAN("Took %dms to abort current scan\n",
8640                                        1000 - i);
8641
8642                 return 0;
8643         }
8644 #endif                          /* CONFIG_IPW2200_MONITOR */
8645
8646         /* Network configuration changed -- force [re]association */
8647         IPW_DEBUG_ASSOC("[re]association triggered due to channel change.\n");
8648         if (!ipw_disassociate(priv))
8649                 ipw_associate(priv);
8650
8651         return 0;
8652 }
8653
8654 static int ipw_wx_set_freq(struct net_device *dev,
8655                            struct iw_request_info *info,
8656                            union iwreq_data *wrqu, char *extra)
8657 {
8658         struct ipw_priv *priv = ieee80211_priv(dev);
8659         const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
8660         struct iw_freq *fwrq = &wrqu->freq;
8661         int ret = 0, i;
8662         u8 channel, flags;
8663         int band;
8664
8665         if (fwrq->m == 0) {
8666                 IPW_DEBUG_WX("SET Freq/Channel -> any\n");
8667                 mutex_lock(&priv->mutex);
8668                 ret = ipw_set_channel(priv, 0);
8669                 mutex_unlock(&priv->mutex);
8670                 return ret;
8671         }
8672         /* if setting by freq convert to channel */
8673         if (fwrq->e == 1) {
8674                 channel = ieee80211_freq_to_channel(priv->ieee, fwrq->m);
8675                 if (channel == 0)
8676                         return -EINVAL;
8677         } else
8678                 channel = fwrq->m;
8679
8680         if (!(band = ieee80211_is_valid_channel(priv->ieee, channel)))
8681                 return -EINVAL;
8682
8683         if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
8684                 i = ieee80211_channel_to_index(priv->ieee, channel);
8685                 if (i == -1)
8686                         return -EINVAL;
8687
8688                 flags = (band == IEEE80211_24GHZ_BAND) ?
8689                     geo->bg[i].flags : geo->a[i].flags;
8690                 if (flags & IEEE80211_CH_PASSIVE_ONLY) {
8691                         IPW_DEBUG_WX("Invalid Ad-Hoc channel for 802.11a\n");
8692                         return -EINVAL;
8693                 }
8694         }
8695
8696         IPW_DEBUG_WX("SET Freq/Channel -> %d \n", fwrq->m);
8697         mutex_lock(&priv->mutex);
8698         ret = ipw_set_channel(priv, channel);
8699         mutex_unlock(&priv->mutex);
8700         return ret;
8701 }
8702
8703 static int ipw_wx_get_freq(struct net_device *dev,
8704                            struct iw_request_info *info,
8705                            union iwreq_data *wrqu, char *extra)
8706 {
8707         struct ipw_priv *priv = ieee80211_priv(dev);
8708
8709         wrqu->freq.e = 0;
8710
8711         /* If we are associated, trying to associate, or have a statically
8712          * configured CHANNEL then return that; otherwise return ANY */
8713         mutex_lock(&priv->mutex);
8714         if (priv->config & CFG_STATIC_CHANNEL ||
8715             priv->status & (STATUS_ASSOCIATING | STATUS_ASSOCIATED)) {
8716                 int i;
8717
8718                 i = ieee80211_channel_to_index(priv->ieee, priv->channel);
8719                 BUG_ON(i == -1);
8720                 wrqu->freq.e = 1;
8721
8722                 switch (ieee80211_is_valid_channel(priv->ieee, priv->channel)) {
8723                 case IEEE80211_52GHZ_BAND:
8724                         wrqu->freq.m = priv->ieee->geo.a[i].freq * 100000;
8725                         break;
8726
8727                 case IEEE80211_24GHZ_BAND:
8728                         wrqu->freq.m = priv->ieee->geo.bg[i].freq * 100000;
8729                         break;
8730
8731                 default:
8732                         BUG();
8733                 }
8734         } else
8735                 wrqu->freq.m = 0;
8736
8737         mutex_unlock(&priv->mutex);
8738         IPW_DEBUG_WX("GET Freq/Channel -> %d \n", priv->channel);
8739         return 0;
8740 }
8741
8742 static int ipw_wx_set_mode(struct net_device *dev,
8743                            struct iw_request_info *info,
8744                            union iwreq_data *wrqu, char *extra)
8745 {
8746         struct ipw_priv *priv = ieee80211_priv(dev);
8747         int err = 0;
8748
8749         IPW_DEBUG_WX("Set MODE: %d\n", wrqu->mode);
8750
8751         switch (wrqu->mode) {
8752 #ifdef CONFIG_IPW2200_MONITOR
8753         case IW_MODE_MONITOR:
8754 #endif
8755         case IW_MODE_ADHOC:
8756         case IW_MODE_INFRA:
8757                 break;
8758         case IW_MODE_AUTO:
8759                 wrqu->mode = IW_MODE_INFRA;
8760                 break;
8761         default:
8762                 return -EINVAL;
8763         }
8764         if (wrqu->mode == priv->ieee->iw_mode)
8765                 return 0;
8766
8767         mutex_lock(&priv->mutex);
8768
8769         ipw_sw_reset(priv, 0);
8770
8771 #ifdef CONFIG_IPW2200_MONITOR
8772         if (priv->ieee->iw_mode == IW_MODE_MONITOR)
8773                 priv->net_dev->type = ARPHRD_ETHER;
8774
8775         if (wrqu->mode == IW_MODE_MONITOR)
8776 #ifdef CONFIG_IPW2200_RADIOTAP
8777                 priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
8778 #else
8779                 priv->net_dev->type = ARPHRD_IEEE80211;
8780 #endif
8781 #endif                          /* CONFIG_IPW2200_MONITOR */
8782
8783         /* Free the existing firmware and reset the fw_loaded
8784          * flag so ipw_load() will bring in the new firmawre */
8785         free_firmware();
8786
8787         priv->ieee->iw_mode = wrqu->mode;
8788
8789         queue_work(priv->workqueue, &priv->adapter_restart);
8790         mutex_unlock(&priv->mutex);
8791         return err;
8792 }
8793
8794 static int ipw_wx_get_mode(struct net_device *dev,
8795                            struct iw_request_info *info,
8796                            union iwreq_data *wrqu, char *extra)
8797 {
8798         struct ipw_priv *priv = ieee80211_priv(dev);
8799         mutex_lock(&priv->mutex);
8800         wrqu->mode = priv->ieee->iw_mode;
8801         IPW_DEBUG_WX("Get MODE -> %d\n", wrqu->mode);
8802         mutex_unlock(&priv->mutex);
8803         return 0;
8804 }
8805
8806 /* Values are in microsecond */
8807 static const s32 timeout_duration[] = {
8808         350000,
8809         250000,
8810         75000,
8811         37000,
8812         25000,
8813 };
8814
8815 static const s32 period_duration[] = {
8816         400000,
8817         700000,
8818         1000000,
8819         1000000,
8820         1000000
8821 };
8822
8823 static int ipw_wx_get_range(struct net_device *dev,
8824                             struct iw_request_info *info,
8825                             union iwreq_data *wrqu, char *extra)
8826 {
8827         struct ipw_priv *priv = ieee80211_priv(dev);
8828         struct iw_range *range = (struct iw_range *)extra;
8829         const struct ieee80211_geo *geo = ieee80211_get_geo(priv->ieee);
8830         int i = 0, j;
8831
8832         wrqu->data.length = sizeof(*range);
8833         memset(range, 0, sizeof(*range));
8834
8835         /* 54Mbs == ~27 Mb/s real (802.11g) */
8836         range->throughput = 27 * 1000 * 1000;
8837
8838         range->max_qual.qual = 100;
8839         /* TODO: Find real max RSSI and stick here */
8840         range->max_qual.level = 0;
8841         range->max_qual.noise = 0;
8842         range->max_qual.updated = 7;    /* Updated all three */
8843
8844         range->avg_qual.qual = 70;
8845         /* TODO: Find real 'good' to 'bad' threshol value for RSSI */
8846         range->avg_qual.level = 0;      /* FIXME to real average level */
8847         range->avg_qual.noise = 0;
8848         range->avg_qual.updated = 7;    /* Updated all three */
8849         mutex_lock(&priv->mutex);
8850         range->num_bitrates = min(priv->rates.num_rates, (u8) IW_MAX_BITRATES);
8851
8852         for (i = 0; i < range->num_bitrates; i++)
8853                 range->bitrate[i] = (priv->rates.supported_rates[i] & 0x7F) *
8854                     500000;
8855
8856         range->max_rts = DEFAULT_RTS_THRESHOLD;
8857         range->min_frag = MIN_FRAG_THRESHOLD;
8858         range->max_frag = MAX_FRAG_THRESHOLD;
8859
8860         range->encoding_size[0] = 5;
8861         range->encoding_size[1] = 13;
8862         range->num_encoding_sizes = 2;
8863         range->max_encoding_tokens = WEP_KEYS;
8864
8865         /* Set the Wireless Extension versions */
8866         range->we_version_compiled = WIRELESS_EXT;
8867         range->we_version_source = 18;
8868
8869         i = 0;
8870         if (priv->ieee->mode & (IEEE_B | IEEE_G)) {
8871                 for (j = 0; j < geo->bg_channels && i < IW_MAX_FREQUENCIES; j++) {
8872                         if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
8873                             (geo->bg[j].flags & IEEE80211_CH_PASSIVE_ONLY))
8874                                 continue;
8875
8876                         range->freq[i].i = geo->bg[j].channel;
8877                         range->freq[i].m = geo->bg[j].freq * 100000;
8878                         range->freq[i].e = 1;
8879                         i++;
8880                 }
8881         }
8882
8883         if (priv->ieee->mode & IEEE_A) {
8884                 for (j = 0; j < geo->a_channels && i < IW_MAX_FREQUENCIES; j++) {
8885                         if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
8886                             (geo->a[j].flags & IEEE80211_CH_PASSIVE_ONLY))
8887                                 continue;
8888
8889                         range->freq[i].i = geo->a[j].channel;
8890                         range->freq[i].m = geo->a[j].freq * 100000;
8891                         range->freq[i].e = 1;
8892                         i++;
8893                 }
8894         }
8895
8896         range->num_channels = i;
8897         range->num_frequency = i;
8898
8899         mutex_unlock(&priv->mutex);
8900
8901         /* Event capability (kernel + driver) */
8902         range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
8903                                 IW_EVENT_CAPA_MASK(SIOCGIWTHRSPY) |
8904                                 IW_EVENT_CAPA_MASK(SIOCGIWAP) |
8905                                 IW_EVENT_CAPA_MASK(SIOCGIWSCAN));
8906         range->event_capa[1] = IW_EVENT_CAPA_K_1;
8907
8908         range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
8909                 IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
8910
8911         range->scan_capa = IW_SCAN_CAPA_ESSID | IW_SCAN_CAPA_TYPE;
8912
8913         IPW_DEBUG_WX("GET Range\n");
8914         return 0;
8915 }
8916
8917 static int ipw_wx_set_wap(struct net_device *dev,
8918                           struct iw_request_info *info,
8919                           union iwreq_data *wrqu, char *extra)
8920 {
8921         struct ipw_priv *priv = ieee80211_priv(dev);
8922         DECLARE_MAC_BUF(mac);
8923
8924         static const unsigned char any[] = {
8925                 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
8926         };
8927         static const unsigned char off[] = {
8928                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
8929         };
8930
8931         if (wrqu->ap_addr.sa_family != ARPHRD_ETHER)
8932                 return -EINVAL;
8933         mutex_lock(&priv->mutex);
8934         if (!memcmp(any, wrqu->ap_addr.sa_data, ETH_ALEN) ||
8935             !memcmp(off, wrqu->ap_addr.sa_data, ETH_ALEN)) {
8936                 /* we disable mandatory BSSID association */
8937                 IPW_DEBUG_WX("Setting AP BSSID to ANY\n");
8938                 priv->config &= ~CFG_STATIC_BSSID;
8939                 IPW_DEBUG_ASSOC("Attempting to associate with new "
8940                                 "parameters.\n");
8941                 ipw_associate(priv);
8942                 mutex_unlock(&priv->mutex);
8943                 return 0;
8944         }
8945
8946         priv->config |= CFG_STATIC_BSSID;
8947         if (!memcmp(priv->bssid, wrqu->ap_addr.sa_data, ETH_ALEN)) {
8948                 IPW_DEBUG_WX("BSSID set to current BSSID.\n");
8949                 mutex_unlock(&priv->mutex);
8950                 return 0;
8951         }
8952
8953         IPW_DEBUG_WX("Setting mandatory BSSID to %s\n",
8954                      print_mac(mac, wrqu->ap_addr.sa_data));
8955
8956         memcpy(priv->bssid, wrqu->ap_addr.sa_data, ETH_ALEN);
8957
8958         /* Network configuration changed -- force [re]association */
8959         IPW_DEBUG_ASSOC("[re]association triggered due to BSSID change.\n");
8960         if (!ipw_disassociate(priv))
8961                 ipw_associate(priv);
8962
8963         mutex_unlock(&priv->mutex);
8964         return 0;
8965 }
8966
8967 static int ipw_wx_get_wap(struct net_device *dev,
8968                           struct iw_request_info *info,
8969                           union iwreq_data *wrqu, char *extra)
8970 {
8971         struct ipw_priv *priv = ieee80211_priv(dev);
8972         DECLARE_MAC_BUF(mac);
8973
8974         /* If we are associated, trying to associate, or have a statically
8975          * configured BSSID then return that; otherwise return ANY */
8976         mutex_lock(&priv->mutex);
8977         if (priv->config & CFG_STATIC_BSSID ||
8978             priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
8979                 wrqu->ap_addr.sa_family = ARPHRD_ETHER;
8980                 memcpy(wrqu->ap_addr.sa_data, priv->bssid, ETH_ALEN);
8981         } else
8982                 memset(wrqu->ap_addr.sa_data, 0, ETH_ALEN);
8983
8984         IPW_DEBUG_WX("Getting WAP BSSID: %s\n",
8985                      print_mac(mac, wrqu->ap_addr.sa_data));
8986         mutex_unlock(&priv->mutex);
8987         return 0;
8988 }
8989
8990 static int ipw_wx_set_essid(struct net_device *dev,
8991                             struct iw_request_info *info,
8992                             union iwreq_data *wrqu, char *extra)
8993 {
8994         struct ipw_priv *priv = ieee80211_priv(dev);
8995         int length;
8996
8997         mutex_lock(&priv->mutex);
8998
8999         if (!wrqu->essid.flags)
9000         {
9001                 IPW_DEBUG_WX("Setting ESSID to ANY\n");
9002                 ipw_disassociate(priv);
9003                 priv->config &= ~CFG_STATIC_ESSID;
9004                 ipw_associate(priv);
9005                 mutex_unlock(&priv->mutex);
9006                 return 0;
9007         }
9008
9009         length = min((int)wrqu->essid.length, IW_ESSID_MAX_SIZE);
9010
9011         priv->config |= CFG_STATIC_ESSID;
9012
9013         if (priv->essid_len == length && !memcmp(priv->essid, extra, length)
9014             && (priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING))) {
9015                 IPW_DEBUG_WX("ESSID set to current ESSID.\n");
9016                 mutex_unlock(&priv->mutex);
9017                 return 0;
9018         }
9019
9020         IPW_DEBUG_WX("Setting ESSID: '%s' (%d)\n", escape_essid(extra, length),
9021                      length);
9022
9023         priv->essid_len = length;
9024         memcpy(priv->essid, extra, priv->essid_len);
9025
9026         /* Network configuration changed -- force [re]association */
9027         IPW_DEBUG_ASSOC("[re]association triggered due to ESSID change.\n");
9028         if (!ipw_disassociate(priv))
9029                 ipw_associate(priv);
9030
9031         mutex_unlock(&priv->mutex);
9032         return 0;
9033 }
9034
9035 static int ipw_wx_get_essid(struct net_device *dev,
9036                             struct iw_request_info *info,
9037                             union iwreq_data *wrqu, char *extra)
9038 {
9039         struct ipw_priv *priv = ieee80211_priv(dev);
9040
9041         /* If we are associated, trying to associate, or have a statically
9042          * configured ESSID then return that; otherwise return ANY */
9043         mutex_lock(&priv->mutex);
9044         if (priv->config & CFG_STATIC_ESSID ||
9045             priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
9046                 IPW_DEBUG_WX("Getting essid: '%s'\n",
9047                              escape_essid(priv->essid, priv->essid_len));
9048                 memcpy(extra, priv->essid, priv->essid_len);
9049                 wrqu->essid.length = priv->essid_len;
9050                 wrqu->essid.flags = 1;  /* active */
9051         } else {
9052                 IPW_DEBUG_WX("Getting essid: ANY\n");
9053                 wrqu->essid.length = 0;
9054                 wrqu->essid.flags = 0;  /* active */
9055         }
9056         mutex_unlock(&priv->mutex);
9057         return 0;
9058 }
9059
9060 static int ipw_wx_set_nick(struct net_device *dev,
9061                            struct iw_request_info *info,
9062                            union iwreq_data *wrqu, char *extra)
9063 {
9064         struct ipw_priv *priv = ieee80211_priv(dev);
9065
9066         IPW_DEBUG_WX("Setting nick to '%s'\n", extra);
9067         if (wrqu->data.length > IW_ESSID_MAX_SIZE)
9068                 return -E2BIG;
9069         mutex_lock(&priv->mutex);
9070         wrqu->data.length = min((size_t) wrqu->data.length, sizeof(priv->nick));
9071         memset(priv->nick, 0, sizeof(priv->nick));
9072         memcpy(priv->nick, extra, wrqu->data.length);
9073         IPW_DEBUG_TRACE("<<\n");
9074         mutex_unlock(&priv->mutex);
9075         return 0;
9076
9077 }
9078
9079 static int ipw_wx_get_nick(struct net_device *dev,
9080                            struct iw_request_info *info,
9081                            union iwreq_data *wrqu, char *extra)
9082 {
9083         struct ipw_priv *priv = ieee80211_priv(dev);
9084         IPW_DEBUG_WX("Getting nick\n");
9085         mutex_lock(&priv->mutex);
9086         wrqu->data.length = strlen(priv->nick);
9087         memcpy(extra, priv->nick, wrqu->data.length);
9088         wrqu->data.flags = 1;   /* active */
9089         mutex_unlock(&priv->mutex);
9090         return 0;
9091 }
9092
9093 static int ipw_wx_set_sens(struct net_device *dev,
9094                             struct iw_request_info *info,
9095                             union iwreq_data *wrqu, char *extra)
9096 {
9097         struct ipw_priv *priv = ieee80211_priv(dev);
9098         int err = 0;
9099
9100         IPW_DEBUG_WX("Setting roaming threshold to %d\n", wrqu->sens.value);
9101         IPW_DEBUG_WX("Setting disassociate threshold to %d\n", 3*wrqu->sens.value);
9102         mutex_lock(&priv->mutex);
9103
9104         if (wrqu->sens.fixed == 0)
9105         {
9106                 priv->roaming_threshold = IPW_MB_ROAMING_THRESHOLD_DEFAULT;
9107                 priv->disassociate_threshold = IPW_MB_DISASSOCIATE_THRESHOLD_DEFAULT;
9108                 goto out;
9109         }
9110         if ((wrqu->sens.value > IPW_MB_ROAMING_THRESHOLD_MAX) ||
9111             (wrqu->sens.value < IPW_MB_ROAMING_THRESHOLD_MIN)) {
9112                 err = -EINVAL;
9113                 goto out;
9114         }
9115
9116         priv->roaming_threshold = wrqu->sens.value;
9117         priv->disassociate_threshold = 3*wrqu->sens.value;
9118       out:
9119         mutex_unlock(&priv->mutex);
9120         return err;
9121 }
9122
9123 static int ipw_wx_get_sens(struct net_device *dev,
9124                             struct iw_request_info *info,
9125                             union iwreq_data *wrqu, char *extra)
9126 {
9127         struct ipw_priv *priv = ieee80211_priv(dev);
9128         mutex_lock(&priv->mutex);
9129         wrqu->sens.fixed = 1;
9130         wrqu->sens.value = priv->roaming_threshold;
9131         mutex_unlock(&priv->mutex);
9132
9133         IPW_DEBUG_WX("GET roaming threshold -> %s %d \n",
9134                      wrqu->power.disabled ? "OFF" : "ON", wrqu->power.value);
9135
9136         return 0;
9137 }
9138
9139 static int ipw_wx_set_rate(struct net_device *dev,
9140                            struct iw_request_info *info,
9141                            union iwreq_data *wrqu, char *extra)
9142 {
9143         /* TODO: We should use semaphores or locks for access to priv */
9144         struct ipw_priv *priv = ieee80211_priv(dev);
9145         u32 target_rate = wrqu->bitrate.value;
9146         u32 fixed, mask;
9147
9148         /* value = -1, fixed = 0 means auto only, so we should use all rates offered by AP */
9149         /* value = X, fixed = 1 means only rate X */
9150         /* value = X, fixed = 0 means all rates lower equal X */
9151
9152         if (target_rate == -1) {
9153                 fixed = 0;
9154                 mask = IEEE80211_DEFAULT_RATES_MASK;
9155                 /* Now we should reassociate */
9156                 goto apply;
9157         }
9158
9159         mask = 0;
9160         fixed = wrqu->bitrate.fixed;
9161
9162         if (target_rate == 1000000 || !fixed)
9163                 mask |= IEEE80211_CCK_RATE_1MB_MASK;
9164         if (target_rate == 1000000)
9165                 goto apply;
9166
9167         if (target_rate == 2000000 || !fixed)
9168                 mask |= IEEE80211_CCK_RATE_2MB_MASK;
9169         if (target_rate == 2000000)
9170                 goto apply;
9171
9172         if (target_rate == 5500000 || !fixed)
9173                 mask |= IEEE80211_CCK_RATE_5MB_MASK;
9174         if (target_rate == 5500000)
9175                 goto apply;
9176
9177         if (target_rate == 6000000 || !fixed)
9178                 mask |= IEEE80211_OFDM_RATE_6MB_MASK;
9179         if (target_rate == 6000000)
9180                 goto apply;
9181
9182         if (target_rate == 9000000 || !fixed)
9183                 mask |= IEEE80211_OFDM_RATE_9MB_MASK;
9184         if (target_rate == 9000000)
9185                 goto apply;
9186
9187         if (target_rate == 11000000 || !fixed)
9188                 mask |= IEEE80211_CCK_RATE_11MB_MASK;
9189         if (target_rate == 11000000)
9190                 goto apply;
9191
9192         if (target_rate == 12000000 || !fixed)
9193                 mask |= IEEE80211_OFDM_RATE_12MB_MASK;
9194         if (target_rate == 12000000)
9195                 goto apply;
9196
9197         if (target_rate == 18000000 || !fixed)
9198                 mask |= IEEE80211_OFDM_RATE_18MB_MASK;
9199         if (target_rate == 18000000)
9200                 goto apply;
9201
9202         if (target_rate == 24000000 || !fixed)
9203                 mask |= IEEE80211_OFDM_RATE_24MB_MASK;
9204         if (target_rate == 24000000)
9205                 goto apply;
9206
9207         if (target_rate == 36000000 || !fixed)
9208                 mask |= IEEE80211_OFDM_RATE_36MB_MASK;
9209         if (target_rate == 36000000)
9210                 goto apply;
9211
9212         if (target_rate == 48000000 || !fixed)
9213                 mask |= IEEE80211_OFDM_RATE_48MB_MASK;
9214         if (target_rate == 48000000)
9215                 goto apply;
9216
9217         if (target_rate == 54000000 || !fixed)
9218                 mask |= IEEE80211_OFDM_RATE_54MB_MASK;
9219         if (target_rate == 54000000)
9220                 goto apply;
9221
9222         IPW_DEBUG_WX("invalid rate specified, returning error\n");
9223         return -EINVAL;
9224
9225       apply:
9226         IPW_DEBUG_WX("Setting rate mask to 0x%08X [%s]\n",
9227                      mask, fixed ? "fixed" : "sub-rates");
9228         mutex_lock(&priv->mutex);
9229         if (mask == IEEE80211_DEFAULT_RATES_MASK) {
9230                 priv->config &= ~CFG_FIXED_RATE;
9231                 ipw_set_fixed_rate(priv, priv->ieee->mode);
9232         } else
9233                 priv->config |= CFG_FIXED_RATE;
9234
9235         if (priv->rates_mask == mask) {
9236                 IPW_DEBUG_WX("Mask set to current mask.\n");
9237                 mutex_unlock(&priv->mutex);
9238                 return 0;
9239         }
9240
9241         priv->rates_mask = mask;
9242
9243         /* Network configuration changed -- force [re]association */
9244         IPW_DEBUG_ASSOC("[re]association triggered due to rates change.\n");
9245         if (!ipw_disassociate(priv))
9246                 ipw_associate(priv);
9247
9248         mutex_unlock(&priv->mutex);
9249         return 0;
9250 }
9251
9252 static int ipw_wx_get_rate(struct net_device *dev,
9253                            struct iw_request_info *info,
9254                            union iwreq_data *wrqu, char *extra)
9255 {
9256         struct ipw_priv *priv = ieee80211_priv(dev);
9257         mutex_lock(&priv->mutex);
9258         wrqu->bitrate.value = priv->last_rate;
9259         wrqu->bitrate.fixed = (priv->config & CFG_FIXED_RATE) ? 1 : 0;
9260         mutex_unlock(&priv->mutex);
9261         IPW_DEBUG_WX("GET Rate -> %d \n", wrqu->bitrate.value);
9262         return 0;
9263 }
9264
9265 static int ipw_wx_set_rts(struct net_device *dev,
9266                           struct iw_request_info *info,
9267                           union iwreq_data *wrqu, char *extra)
9268 {
9269         struct ipw_priv *priv = ieee80211_priv(dev);
9270         mutex_lock(&priv->mutex);
9271         if (wrqu->rts.disabled || !wrqu->rts.fixed)
9272                 priv->rts_threshold = DEFAULT_RTS_THRESHOLD;
9273         else {
9274                 if (wrqu->rts.value < MIN_RTS_THRESHOLD ||
9275                     wrqu->rts.value > MAX_RTS_THRESHOLD) {
9276                         mutex_unlock(&priv->mutex);
9277                         return -EINVAL;
9278                 }
9279                 priv->rts_threshold = wrqu->rts.value;
9280         }
9281
9282         ipw_send_rts_threshold(priv, priv->rts_threshold);
9283         mutex_unlock(&priv->mutex);
9284         IPW_DEBUG_WX("SET RTS Threshold -> %d \n", priv->rts_threshold);
9285         return 0;
9286 }
9287
9288 static int ipw_wx_get_rts(struct net_device *dev,
9289                           struct iw_request_info *info,
9290                           union iwreq_data *wrqu, char *extra)
9291 {
9292         struct ipw_priv *priv = ieee80211_priv(dev);
9293         mutex_lock(&priv->mutex);
9294         wrqu->rts.value = priv->rts_threshold;
9295         wrqu->rts.fixed = 0;    /* no auto select */
9296         wrqu->rts.disabled = (wrqu->rts.value == DEFAULT_RTS_THRESHOLD);
9297         mutex_unlock(&priv->mutex);
9298         IPW_DEBUG_WX("GET RTS Threshold -> %d \n", wrqu->rts.value);
9299         return 0;
9300 }
9301
9302 static int ipw_wx_set_txpow(struct net_device *dev,
9303                             struct iw_request_info *info,
9304                             union iwreq_data *wrqu, char *extra)
9305 {
9306         struct ipw_priv *priv = ieee80211_priv(dev);
9307         int err = 0;
9308
9309         mutex_lock(&priv->mutex);
9310         if (ipw_radio_kill_sw(priv, wrqu->power.disabled)) {
9311                 err = -EINPROGRESS;
9312                 goto out;
9313         }
9314
9315         if (!wrqu->power.fixed)
9316                 wrqu->power.value = IPW_TX_POWER_DEFAULT;
9317
9318         if (wrqu->power.flags != IW_TXPOW_DBM) {
9319                 err = -EINVAL;
9320                 goto out;
9321         }
9322
9323         if ((wrqu->power.value > IPW_TX_POWER_MAX) ||
9324             (wrqu->power.value < IPW_TX_POWER_MIN)) {
9325                 err = -EINVAL;
9326                 goto out;
9327         }
9328
9329         priv->tx_power = wrqu->power.value;
9330         err = ipw_set_tx_power(priv);
9331       out:
9332         mutex_unlock(&priv->mutex);
9333         return err;
9334 }
9335
9336 static int ipw_wx_get_txpow(struct net_device *dev,
9337                             struct iw_request_info *info,
9338                             union iwreq_data *wrqu, char *extra)
9339 {
9340         struct ipw_priv *priv = ieee80211_priv(dev);
9341         mutex_lock(&priv->mutex);
9342         wrqu->power.value = priv->tx_power;
9343         wrqu->power.fixed = 1;
9344         wrqu->power.flags = IW_TXPOW_DBM;
9345         wrqu->power.disabled = (priv->status & STATUS_RF_KILL_MASK) ? 1 : 0;
9346         mutex_unlock(&priv->mutex);
9347
9348         IPW_DEBUG_WX("GET TX Power -> %s %d \n",
9349                      wrqu->power.disabled ? "OFF" : "ON", wrqu->power.value);
9350
9351         return 0;
9352 }
9353
9354 static int ipw_wx_set_frag(struct net_device *dev,
9355                            struct iw_request_info *info,
9356                            union iwreq_data *wrqu, char *extra)
9357 {
9358         struct ipw_priv *priv = ieee80211_priv(dev);
9359         mutex_lock(&priv->mutex);
9360         if (wrqu->frag.disabled || !wrqu->frag.fixed)
9361                 priv->ieee->fts = DEFAULT_FTS;
9362         else {
9363                 if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
9364                     wrqu->frag.value > MAX_FRAG_THRESHOLD) {
9365                         mutex_unlock(&priv->mutex);
9366                         return -EINVAL;
9367                 }
9368
9369                 priv->ieee->fts = wrqu->frag.value & ~0x1;
9370         }
9371
9372         ipw_send_frag_threshold(priv, wrqu->frag.value);
9373         mutex_unlock(&priv->mutex);
9374         IPW_DEBUG_WX("SET Frag Threshold -> %d \n", wrqu->frag.value);
9375         return 0;
9376 }
9377
9378 static int ipw_wx_get_frag(struct net_device *dev,
9379                            struct iw_request_info *info,
9380                            union iwreq_data *wrqu, char *extra)
9381 {
9382         struct ipw_priv *priv = ieee80211_priv(dev);
9383         mutex_lock(&priv->mutex);
9384         wrqu->frag.value = priv->ieee->fts;
9385         wrqu->frag.fixed = 0;   /* no auto select */
9386         wrqu->frag.disabled = (wrqu->frag.value == DEFAULT_FTS);
9387         mutex_unlock(&priv->mutex);
9388         IPW_DEBUG_WX("GET Frag Threshold -> %d \n", wrqu->frag.value);
9389
9390         return 0;
9391 }
9392
9393 static int ipw_wx_set_retry(struct net_device *dev,
9394                             struct iw_request_info *info,
9395                             union iwreq_data *wrqu, char *extra)
9396 {
9397         struct ipw_priv *priv = ieee80211_priv(dev);
9398
9399         if (wrqu->retry.flags & IW_RETRY_LIFETIME || wrqu->retry.disabled)
9400                 return -EINVAL;
9401
9402         if (!(wrqu->retry.flags & IW_RETRY_LIMIT))
9403                 return 0;
9404
9405         if (wrqu->retry.value < 0 || wrqu->retry.value >= 255)
9406                 return -EINVAL;
9407
9408         mutex_lock(&priv->mutex);
9409         if (wrqu->retry.flags & IW_RETRY_SHORT)
9410                 priv->short_retry_limit = (u8) wrqu->retry.value;
9411         else if (wrqu->retry.flags & IW_RETRY_LONG)
9412                 priv->long_retry_limit = (u8) wrqu->retry.value;
9413         else {
9414                 priv->short_retry_limit = (u8) wrqu->retry.value;
9415                 priv->long_retry_limit = (u8) wrqu->retry.value;
9416         }
9417
9418         ipw_send_retry_limit(priv, priv->short_retry_limit,
9419                              priv->long_retry_limit);
9420         mutex_unlock(&priv->mutex);
9421         IPW_DEBUG_WX("SET retry limit -> short:%d long:%d\n",
9422                      priv->short_retry_limit, priv->long_retry_limit);
9423         return 0;
9424 }
9425
9426 static int ipw_wx_get_retry(struct net_device *dev,
9427                             struct iw_request_info *info,
9428                             union iwreq_data *wrqu, char *extra)
9429 {
9430         struct ipw_priv *priv = ieee80211_priv(dev);
9431
9432         mutex_lock(&priv->mutex);
9433         wrqu->retry.disabled = 0;
9434
9435         if ((wrqu->retry.flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME) {
9436                 mutex_unlock(&priv->mutex);
9437                 return -EINVAL;
9438         }
9439
9440         if (wrqu->retry.flags & IW_RETRY_LONG) {
9441                 wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
9442                 wrqu->retry.value = priv->long_retry_limit;
9443         } else if (wrqu->retry.flags & IW_RETRY_SHORT) {
9444                 wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_SHORT;
9445                 wrqu->retry.value = priv->short_retry_limit;
9446         } else {
9447                 wrqu->retry.flags = IW_RETRY_LIMIT;
9448                 wrqu->retry.value = priv->short_retry_limit;
9449         }
9450         mutex_unlock(&priv->mutex);
9451
9452         IPW_DEBUG_WX("GET retry -> %d \n", wrqu->retry.value);
9453
9454         return 0;
9455 }
9456
9457 static int ipw_request_direct_scan(struct ipw_priv *priv, char *essid,
9458                                    int essid_len)
9459 {
9460         struct ipw_scan_request_ext scan;
9461         int err = 0, scan_type;
9462
9463         if (!(priv->status & STATUS_INIT) ||
9464             (priv->status & STATUS_EXIT_PENDING))
9465                 return 0;
9466
9467         mutex_lock(&priv->mutex);
9468
9469         if (priv->status & STATUS_RF_KILL_MASK) {
9470                 IPW_DEBUG_HC("Aborting scan due to RF kill activation\n");
9471                 priv->status |= STATUS_SCAN_PENDING;
9472                 goto done;
9473         }
9474
9475         IPW_DEBUG_HC("starting request direct scan!\n");
9476
9477         if (priv->status & (STATUS_SCANNING | STATUS_SCAN_ABORTING)) {
9478                 /* We should not sleep here; otherwise we will block most
9479                  * of the system (for instance, we hold rtnl_lock when we
9480                  * get here).
9481                  */
9482                 err = -EAGAIN;
9483                 goto done;
9484         }
9485         memset(&scan, 0, sizeof(scan));
9486
9487         if (priv->config & CFG_SPEED_SCAN)
9488                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
9489                     cpu_to_le16(30);
9490         else
9491                 scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
9492                     cpu_to_le16(20);
9493
9494         scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN] =
9495             cpu_to_le16(20);
9496         scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = cpu_to_le16(120);
9497         scan.dwell_time[IPW_SCAN_ACTIVE_DIRECT_SCAN] = cpu_to_le16(20);
9498
9499         scan.full_scan_index = cpu_to_le32(ieee80211_get_scans(priv->ieee));
9500
9501         err = ipw_send_ssid(priv, essid, essid_len);
9502         if (err) {
9503                 IPW_DEBUG_HC("Attempt to send SSID command failed\n");
9504                 goto done;
9505         }
9506         scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
9507
9508         ipw_add_scan_channels(priv, &scan, scan_type);
9509
9510         err = ipw_send_scan_request_ext(priv, &scan);
9511         if (err) {
9512                 IPW_DEBUG_HC("Sending scan command failed: %08X\n", err);
9513                 goto done;
9514         }
9515
9516         priv->status |= STATUS_SCANNING;
9517
9518       done:
9519         mutex_unlock(&priv->mutex);
9520         return err;
9521 }
9522
9523 static int ipw_wx_set_scan(struct net_device *dev,
9524                            struct iw_request_info *info,
9525                            union iwreq_data *wrqu, char *extra)
9526 {
9527         struct ipw_priv *priv = ieee80211_priv(dev);
9528         struct iw_scan_req *req = (struct iw_scan_req *)extra;
9529
9530         mutex_lock(&priv->mutex);
9531         priv->user_requested_scan = 1;
9532         mutex_unlock(&priv->mutex);
9533
9534         if (wrqu->data.length == sizeof(struct iw_scan_req)) {
9535                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
9536                         ipw_request_direct_scan(priv, req->essid,
9537                                                 req->essid_len);
9538                         return 0;
9539                 }
9540                 if (req->scan_type == IW_SCAN_TYPE_PASSIVE) {
9541                         queue_work(priv->workqueue,
9542                                    &priv->request_passive_scan);
9543                         return 0;
9544                 }
9545         }
9546
9547         IPW_DEBUG_WX("Start scan\n");
9548
9549         queue_delayed_work(priv->workqueue, &priv->request_scan, 0);
9550
9551         return 0;
9552 }
9553
9554 static int ipw_wx_get_scan(struct net_device *dev,
9555                            struct iw_request_info *info,
9556                            union iwreq_data *wrqu, char *extra)
9557 {
9558         struct ipw_priv *priv = ieee80211_priv(dev);
9559         return ieee80211_wx_get_scan(priv->ieee, info, wrqu, extra);
9560 }
9561
9562 static int ipw_wx_set_encode(struct net_device *dev,
9563                              struct iw_request_info *info,
9564                              union iwreq_data *wrqu, char *key)
9565 {
9566         struct ipw_priv *priv = ieee80211_priv(dev);
9567         int ret;
9568         u32 cap = priv->capability;
9569
9570         mutex_lock(&priv->mutex);
9571         ret = ieee80211_wx_set_encode(priv->ieee, info, wrqu, key);
9572
9573         /* In IBSS mode, we need to notify the firmware to update
9574          * the beacon info after we changed the capability. */
9575         if (cap != priv->capability &&
9576             priv->ieee->iw_mode == IW_MODE_ADHOC &&
9577             priv->status & STATUS_ASSOCIATED)
9578                 ipw_disassociate(priv);
9579
9580         mutex_unlock(&priv->mutex);
9581         return ret;
9582 }
9583
9584 static int ipw_wx_get_encode(struct net_device *dev,
9585                              struct iw_request_info *info,
9586                              union iwreq_data *wrqu, char *key)
9587 {
9588         struct ipw_priv *priv = ieee80211_priv(dev);
9589         return ieee80211_wx_get_encode(priv->ieee, info, wrqu, key);
9590 }
9591
9592 static int ipw_wx_set_power(struct net_device *dev,
9593                             struct iw_request_info *info,
9594                             union iwreq_data *wrqu, char *extra)
9595 {
9596         struct ipw_priv *priv = ieee80211_priv(dev);
9597         int err;
9598         mutex_lock(&priv->mutex);
9599         if (wrqu->power.disabled) {
9600                 priv->power_mode = IPW_POWER_LEVEL(priv->power_mode);
9601                 err = ipw_send_power_mode(priv, IPW_POWER_MODE_CAM);
9602                 if (err) {
9603                         IPW_DEBUG_WX("failed setting power mode.\n");
9604                         mutex_unlock(&priv->mutex);
9605                         return err;
9606                 }
9607                 IPW_DEBUG_WX("SET Power Management Mode -> off\n");
9608                 mutex_unlock(&priv->mutex);
9609                 return 0;
9610         }
9611
9612         switch (wrqu->power.flags & IW_POWER_MODE) {
9613         case IW_POWER_ON:       /* If not specified */
9614         case IW_POWER_MODE:     /* If set all mask */
9615         case IW_POWER_ALL_R:    /* If explicitly state all */
9616                 break;
9617         default:                /* Otherwise we don't support it */
9618                 IPW_DEBUG_WX("SET PM Mode: %X not supported.\n",
9619                              wrqu->power.flags);
9620                 mutex_unlock(&priv->mutex);
9621                 return -EOPNOTSUPP;
9622         }
9623
9624         /* If the user hasn't specified a power management mode yet, default
9625          * to BATTERY */
9626         if (IPW_POWER_LEVEL(priv->power_mode) == IPW_POWER_AC)
9627                 priv->power_mode = IPW_POWER_ENABLED | IPW_POWER_BATTERY;
9628         else
9629                 priv->power_mode = IPW_POWER_ENABLED | priv->power_mode;
9630
9631         err = ipw_send_power_mode(priv, IPW_POWER_LEVEL(priv->power_mode));
9632         if (err) {
9633                 IPW_DEBUG_WX("failed setting power mode.\n");
9634                 mutex_unlock(&priv->mutex);
9635                 return err;
9636         }
9637
9638         IPW_DEBUG_WX("SET Power Management Mode -> 0x%02X\n", priv->power_mode);
9639         mutex_unlock(&priv->mutex);
9640         return 0;
9641 }
9642
9643 static int ipw_wx_get_power(struct net_device *dev,
9644                             struct iw_request_info *info,
9645                             union iwreq_data *wrqu, char *extra)
9646 {
9647         struct ipw_priv *priv = ieee80211_priv(dev);
9648         mutex_lock(&priv->mutex);
9649         if (!(priv->power_mode & IPW_POWER_ENABLED))
9650                 wrqu->power.disabled = 1;
9651         else
9652                 wrqu->power.disabled = 0;
9653
9654         mutex_unlock(&priv->mutex);
9655         IPW_DEBUG_WX("GET Power Management Mode -> %02X\n", priv->power_mode);
9656
9657         return 0;
9658 }
9659
9660 static int ipw_wx_set_powermode(struct net_device *dev,
9661                                 struct iw_request_info *info,
9662                                 union iwreq_data *wrqu, char *extra)
9663 {
9664         struct ipw_priv *priv = ieee80211_priv(dev);
9665         int mode = *(int *)extra;
9666         int err;
9667
9668         mutex_lock(&priv->mutex);
9669         if ((mode < 1) || (mode > IPW_POWER_LIMIT))
9670                 mode = IPW_POWER_AC;
9671
9672         if (IPW_POWER_LEVEL(priv->power_mode) != mode) {
9673                 err = ipw_send_power_mode(priv, mode);
9674                 if (err) {
9675                         IPW_DEBUG_WX("failed setting power mode.\n");
9676                         mutex_unlock(&priv->mutex);
9677                         return err;
9678                 }
9679                 priv->power_mode = IPW_POWER_ENABLED | mode;
9680         }
9681         mutex_unlock(&priv->mutex);
9682         return 0;
9683 }
9684
9685 #define MAX_WX_STRING 80
9686 static int ipw_wx_get_powermode(struct net_device *dev,
9687                                 struct iw_request_info *info,
9688                                 union iwreq_data *wrqu, char *extra)
9689 {
9690         struct ipw_priv *priv = ieee80211_priv(dev);
9691         int level = IPW_POWER_LEVEL(priv->power_mode);
9692         char *p = extra;
9693
9694         p += snprintf(p, MAX_WX_STRING, "Power save level: %d ", level);
9695
9696         switch (level) {
9697         case IPW_POWER_AC:
9698                 p += snprintf(p, MAX_WX_STRING - (p - extra), "(AC)");
9699                 break;
9700         case IPW_POWER_BATTERY:
9701                 p += snprintf(p, MAX_WX_STRING - (p - extra), "(BATTERY)");
9702                 break;
9703         default:
9704                 p += snprintf(p, MAX_WX_STRING - (p - extra),
9705                               "(Timeout %dms, Period %dms)",
9706                               timeout_duration[level - 1] / 1000,
9707                               period_duration[level - 1] / 1000);
9708         }
9709
9710         if (!(priv->power_mode & IPW_POWER_ENABLED))
9711                 p += snprintf(p, MAX_WX_STRING - (p - extra), " OFF");
9712
9713         wrqu->data.length = p - extra + 1;
9714
9715         return 0;
9716 }
9717
9718 static int ipw_wx_set_wireless_mode(struct net_device *dev,
9719                                     struct iw_request_info *info,
9720                                     union iwreq_data *wrqu, char *extra)
9721 {
9722         struct ipw_priv *priv = ieee80211_priv(dev);
9723         int mode = *(int *)extra;
9724         u8 band = 0, modulation = 0;
9725
9726         if (mode == 0 || mode & ~IEEE_MODE_MASK) {
9727                 IPW_WARNING("Attempt to set invalid wireless mode: %d\n", mode);
9728                 return -EINVAL;
9729         }
9730         mutex_lock(&priv->mutex);
9731         if (priv->adapter == IPW_2915ABG) {
9732                 priv->ieee->abg_true = 1;
9733                 if (mode & IEEE_A) {
9734                         band |= IEEE80211_52GHZ_BAND;
9735                         modulation |= IEEE80211_OFDM_MODULATION;
9736                 } else
9737                         priv->ieee->abg_true = 0;
9738         } else {
9739                 if (mode & IEEE_A) {
9740                         IPW_WARNING("Attempt to set 2200BG into "
9741                                     "802.11a mode\n");
9742                         mutex_unlock(&priv->mutex);
9743                         return -EINVAL;
9744                 }
9745
9746                 priv->ieee->abg_true = 0;
9747         }
9748
9749         if (mode & IEEE_B) {
9750                 band |= IEEE80211_24GHZ_BAND;
9751                 modulation |= IEEE80211_CCK_MODULATION;
9752         } else
9753                 priv->ieee->abg_true = 0;
9754
9755         if (mode & IEEE_G) {
9756                 band |= IEEE80211_24GHZ_BAND;
9757                 modulation |= IEEE80211_OFDM_MODULATION;
9758         } else
9759                 priv->ieee->abg_true = 0;
9760
9761         priv->ieee->mode = mode;
9762         priv->ieee->freq_band = band;
9763         priv->ieee->modulation = modulation;
9764         init_supported_rates(priv, &priv->rates);
9765
9766         /* Network configuration changed -- force [re]association */
9767         IPW_DEBUG_ASSOC("[re]association triggered due to mode change.\n");
9768         if (!ipw_disassociate(priv)) {
9769                 ipw_send_supported_rates(priv, &priv->rates);
9770                 ipw_associate(priv);
9771         }
9772
9773         /* Update the band LEDs */
9774         ipw_led_band_on(priv);
9775
9776         IPW_DEBUG_WX("PRIV SET MODE: %c%c%c\n",
9777                      mode & IEEE_A ? 'a' : '.',
9778                      mode & IEEE_B ? 'b' : '.', mode & IEEE_G ? 'g' : '.');
9779         mutex_unlock(&priv->mutex);
9780         return 0;
9781 }
9782
9783 static int ipw_wx_get_wireless_mode(struct net_device *dev,
9784                                     struct iw_request_info *info,
9785                                     union iwreq_data *wrqu, char *extra)
9786 {
9787         struct ipw_priv *priv = ieee80211_priv(dev);
9788         mutex_lock(&priv->mutex);
9789         switch (priv->ieee->mode) {
9790         case IEEE_A:
9791                 strncpy(extra, "802.11a (1)", MAX_WX_STRING);
9792                 break;
9793         case IEEE_B:
9794                 strncpy(extra, "802.11b (2)", MAX_WX_STRING);
9795                 break;
9796         case IEEE_A | IEEE_B:
9797                 strncpy(extra, "802.11ab (3)", MAX_WX_STRING);
9798                 break;
9799         case IEEE_G:
9800                 strncpy(extra, "802.11g (4)", MAX_WX_STRING);
9801                 break;
9802         case IEEE_A | IEEE_G:
9803                 strncpy(extra, "802.11ag (5)", MAX_WX_STRING);
9804                 break;
9805         case IEEE_B | IEEE_G:
9806                 strncpy(extra, "802.11bg (6)", MAX_WX_STRING);
9807                 break;
9808         case IEEE_A | IEEE_B | IEEE_G:
9809                 strncpy(extra, "802.11abg (7)", MAX_WX_STRING);
9810                 break;
9811         default:
9812                 strncpy(extra, "unknown", MAX_WX_STRING);
9813                 break;
9814         }
9815
9816         IPW_DEBUG_WX("PRIV GET MODE: %s\n", extra);
9817
9818         wrqu->data.length = strlen(extra) + 1;
9819         mutex_unlock(&priv->mutex);
9820
9821         return 0;
9822 }
9823
9824 static int ipw_wx_set_preamble(struct net_device *dev,
9825                                struct iw_request_info *info,
9826                                union iwreq_data *wrqu, char *extra)
9827 {
9828         struct ipw_priv *priv = ieee80211_priv(dev);
9829         int mode = *(int *)extra;
9830         mutex_lock(&priv->mutex);
9831         /* Switching from SHORT -> LONG requires a disassociation */
9832         if (mode == 1) {
9833                 if (!(priv->config & CFG_PREAMBLE_LONG)) {
9834                         priv->config |= CFG_PREAMBLE_LONG;
9835
9836                         /* Network configuration changed -- force [re]association */
9837                         IPW_DEBUG_ASSOC
9838                             ("[re]association triggered due to preamble change.\n");
9839                         if (!ipw_disassociate(priv))
9840                                 ipw_associate(priv);
9841                 }
9842                 goto done;
9843         }
9844
9845         if (mode == 0) {
9846                 priv->config &= ~CFG_PREAMBLE_LONG;
9847                 goto done;
9848         }
9849         mutex_unlock(&priv->mutex);
9850         return -EINVAL;
9851
9852       done:
9853         mutex_unlock(&priv->mutex);
9854         return 0;
9855 }
9856
9857 static int ipw_wx_get_preamble(struct net_device *dev,
9858                                struct iw_request_info *info,
9859                                union iwreq_data *wrqu, char *extra)
9860 {
9861         struct ipw_priv *priv = ieee80211_priv(dev);
9862         mutex_lock(&priv->mutex);
9863         if (priv->config & CFG_PREAMBLE_LONG)
9864                 snprintf(wrqu->name, IFNAMSIZ, "long (1)");
9865         else
9866                 snprintf(wrqu->name, IFNAMSIZ, "auto (0)");
9867         mutex_unlock(&priv->mutex);
9868         return 0;
9869 }
9870
9871 #ifdef CONFIG_IPW2200_MONITOR
9872 static int ipw_wx_set_monitor(struct net_device *dev,
9873                               struct iw_request_info *info,
9874                               union iwreq_data *wrqu, char *extra)
9875 {
9876         struct ipw_priv *priv = ieee80211_priv(dev);
9877         int *parms = (int *)extra;
9878         int enable = (parms[0] > 0);
9879         mutex_lock(&priv->mutex);
9880         IPW_DEBUG_WX("SET MONITOR: %d %d\n", enable, parms[1]);
9881         if (enable) {
9882                 if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
9883 #ifdef CONFIG_IPW2200_RADIOTAP
9884                         priv->net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
9885 #else
9886                         priv->net_dev->type = ARPHRD_IEEE80211;
9887 #endif
9888                         queue_work(priv->workqueue, &priv->adapter_restart);
9889                 }
9890
9891                 ipw_set_channel(priv, parms[1]);
9892         } else {
9893                 if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
9894                         mutex_unlock(&priv->mutex);
9895                         return 0;
9896                 }
9897                 priv->net_dev->type = ARPHRD_ETHER;
9898                 queue_work(priv->workqueue, &priv->adapter_restart);
9899         }
9900         mutex_unlock(&priv->mutex);
9901         return 0;
9902 }
9903
9904 #endif                          /* CONFIG_IPW2200_MONITOR */
9905
9906 static int ipw_wx_reset(struct net_device *dev,
9907                         struct iw_request_info *info,
9908                         union iwreq_data *wrqu, char *extra)
9909 {
9910         struct ipw_priv *priv = ieee80211_priv(dev);
9911         IPW_DEBUG_WX("RESET\n");
9912         queue_work(priv->workqueue, &priv->adapter_restart);
9913         return 0;
9914 }
9915
9916 static int ipw_wx_sw_reset(struct net_device *dev,
9917                            struct iw_request_info *info,
9918                            union iwreq_data *wrqu, char *extra)
9919 {
9920         struct ipw_priv *priv = ieee80211_priv(dev);
9921         union iwreq_data wrqu_sec = {
9922                 .encoding = {
9923                              .flags = IW_ENCODE_DISABLED,
9924                              },
9925         };
9926         int ret;
9927
9928         IPW_DEBUG_WX("SW_RESET\n");
9929
9930         mutex_lock(&priv->mutex);
9931
9932         ret = ipw_sw_reset(priv, 2);
9933         if (!ret) {
9934                 free_firmware();
9935                 ipw_adapter_restart(priv);
9936         }
9937
9938         /* The SW reset bit might have been toggled on by the 'disable'
9939          * module parameter, so take appropriate action */
9940         ipw_radio_kill_sw(priv, priv->status & STATUS_RF_KILL_SW);
9941
9942         mutex_unlock(&priv->mutex);
9943         ieee80211_wx_set_encode(priv->ieee, info, &wrqu_sec, NULL);
9944         mutex_lock(&priv->mutex);
9945
9946         if (!(priv->status & STATUS_RF_KILL_MASK)) {
9947                 /* Configuration likely changed -- force [re]association */
9948                 IPW_DEBUG_ASSOC("[re]association triggered due to sw "
9949                                 "reset.\n");
9950                 if (!ipw_disassociate(priv))
9951                         ipw_associate(priv);
9952         }
9953
9954         mutex_unlock(&priv->mutex);
9955
9956         return 0;
9957 }
9958
9959 /* Rebase the WE IOCTLs to zero for the handler array */
9960 #define IW_IOCTL(x) [(x)-SIOCSIWCOMMIT]
9961 static iw_handler ipw_wx_handlers[] = {
9962         IW_IOCTL(SIOCGIWNAME) = ipw_wx_get_name,
9963         IW_IOCTL(SIOCSIWFREQ) = ipw_wx_set_freq,
9964         IW_IOCTL(SIOCGIWFREQ) = ipw_wx_get_freq,
9965         IW_IOCTL(SIOCSIWMODE) = ipw_wx_set_mode,
9966         IW_IOCTL(SIOCGIWMODE) = ipw_wx_get_mode,
9967         IW_IOCTL(SIOCSIWSENS) = ipw_wx_set_sens,
9968         IW_IOCTL(SIOCGIWSENS) = ipw_wx_get_sens,
9969         IW_IOCTL(SIOCGIWRANGE) = ipw_wx_get_range,
9970         IW_IOCTL(SIOCSIWAP) = ipw_wx_set_wap,
9971         IW_IOCTL(SIOCGIWAP) = ipw_wx_get_wap,
9972         IW_IOCTL(SIOCSIWSCAN) = ipw_wx_set_scan,
9973         IW_IOCTL(SIOCGIWSCAN) = ipw_wx_get_scan,
9974         IW_IOCTL(SIOCSIWESSID) = ipw_wx_set_essid,
9975         IW_IOCTL(SIOCGIWESSID) = ipw_wx_get_essid,
9976         IW_IOCTL(SIOCSIWNICKN) = ipw_wx_set_nick,
9977         IW_IOCTL(SIOCGIWNICKN) = ipw_wx_get_nick,
9978         IW_IOCTL(SIOCSIWRATE) = ipw_wx_set_rate,
9979         IW_IOCTL(SIOCGIWRATE) = ipw_wx_get_rate,
9980         IW_IOCTL(SIOCSIWRTS) = ipw_wx_set_rts,
9981         IW_IOCTL(SIOCGIWRTS) = ipw_wx_get_rts,
9982         IW_IOCTL(SIOCSIWFRAG) = ipw_wx_set_frag,
9983         IW_IOCTL(SIOCGIWFRAG) = ipw_wx_get_frag,
9984         IW_IOCTL(SIOCSIWTXPOW) = ipw_wx_set_txpow,
9985         IW_IOCTL(SIOCGIWTXPOW) = ipw_wx_get_txpow,
9986         IW_IOCTL(SIOCSIWRETRY) = ipw_wx_set_retry,
9987         IW_IOCTL(SIOCGIWRETRY) = ipw_wx_get_retry,
9988         IW_IOCTL(SIOCSIWENCODE) = ipw_wx_set_encode,
9989         IW_IOCTL(SIOCGIWENCODE) = ipw_wx_get_encode,
9990         IW_IOCTL(SIOCSIWPOWER) = ipw_wx_set_power,
9991         IW_IOCTL(SIOCGIWPOWER) = ipw_wx_get_power,
9992         IW_IOCTL(SIOCSIWSPY) = iw_handler_set_spy,
9993         IW_IOCTL(SIOCGIWSPY) = iw_handler_get_spy,
9994         IW_IOCTL(SIOCSIWTHRSPY) = iw_handler_set_thrspy,
9995         IW_IOCTL(SIOCGIWTHRSPY) = iw_handler_get_thrspy,
9996         IW_IOCTL(SIOCSIWGENIE) = ipw_wx_set_genie,
9997         IW_IOCTL(SIOCGIWGENIE) = ipw_wx_get_genie,
9998         IW_IOCTL(SIOCSIWMLME) = ipw_wx_set_mlme,
9999         IW_IOCTL(SIOCSIWAUTH) = ipw_wx_set_auth,
10000         IW_IOCTL(SIOCGIWAUTH) = ipw_wx_get_auth,
10001         IW_IOCTL(SIOCSIWENCODEEXT) = ipw_wx_set_encodeext,
10002         IW_IOCTL(SIOCGIWENCODEEXT) = ipw_wx_get_encodeext,
10003 };
10004
10005 enum {
10006         IPW_PRIV_SET_POWER = SIOCIWFIRSTPRIV,
10007         IPW_PRIV_GET_POWER,
10008         IPW_PRIV_SET_MODE,
10009         IPW_PRIV_GET_MODE,
10010         IPW_PRIV_SET_PREAMBLE,
10011         IPW_PRIV_GET_PREAMBLE,
10012         IPW_PRIV_RESET,
10013         IPW_PRIV_SW_RESET,
10014 #ifdef CONFIG_IPW2200_MONITOR
10015         IPW_PRIV_SET_MONITOR,
10016 #endif
10017 };
10018
10019 static struct iw_priv_args ipw_priv_args[] = {
10020         {
10021          .cmd = IPW_PRIV_SET_POWER,
10022          .set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
10023          .name = "set_power"},
10024         {
10025          .cmd = IPW_PRIV_GET_POWER,
10026          .get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
10027          .name = "get_power"},
10028         {
10029          .cmd = IPW_PRIV_SET_MODE,
10030          .set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
10031          .name = "set_mode"},
10032         {
10033          .cmd = IPW_PRIV_GET_MODE,
10034          .get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
10035          .name = "get_mode"},
10036         {
10037          .cmd = IPW_PRIV_SET_PREAMBLE,
10038          .set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
10039          .name = "set_preamble"},
10040         {
10041          .cmd = IPW_PRIV_GET_PREAMBLE,
10042          .get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | IFNAMSIZ,
10043          .name = "get_preamble"},
10044         {
10045          IPW_PRIV_RESET,
10046          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 0, 0, "reset"},
10047         {
10048          IPW_PRIV_SW_RESET,
10049          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 0, 0, "sw_reset"},
10050 #ifdef CONFIG_IPW2200_MONITOR
10051         {
10052          IPW_PRIV_SET_MONITOR,
10053          IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "monitor"},
10054 #endif                          /* CONFIG_IPW2200_MONITOR */
10055 };
10056
10057 static iw_handler ipw_priv_handler[] = {
10058         ipw_wx_set_powermode,
10059         ipw_wx_get_powermode,
10060         ipw_wx_set_wireless_mode,
10061         ipw_wx_get_wireless_mode,
10062         ipw_wx_set_preamble,
10063         ipw_wx_get_preamble,
10064         ipw_wx_reset,
10065         ipw_wx_sw_reset,
10066 #ifdef CONFIG_IPW2200_MONITOR
10067         ipw_wx_set_monitor,
10068 #endif
10069 };
10070
10071 static struct iw_handler_def ipw_wx_handler_def = {
10072         .standard = ipw_wx_handlers,
10073         .num_standard = ARRAY_SIZE(ipw_wx_handlers),
10074         .num_private = ARRAY_SIZE(ipw_priv_handler),
10075         .num_private_args = ARRAY_SIZE(ipw_priv_args),
10076         .private = ipw_priv_handler,
10077         .private_args = ipw_priv_args,
10078         .get_wireless_stats = ipw_get_wireless_stats,
10079 };
10080
10081 /*
10082  * Get wireless statistics.
10083  * Called by /proc/net/wireless
10084  * Also called by SIOCGIWSTATS
10085  */
10086 static struct iw_statistics *ipw_get_wireless_stats(struct net_device *dev)
10087 {
10088         struct ipw_priv *priv = ieee80211_priv(dev);
10089         struct iw_statistics *wstats;
10090
10091         wstats = &priv->wstats;
10092
10093         /* if hw is disabled, then ipw_get_ordinal() can't be called.
10094          * netdev->get_wireless_stats seems to be called before fw is
10095          * initialized.  STATUS_ASSOCIATED will only be set if the hw is up
10096          * and associated; if not associcated, the values are all meaningless
10097          * anyway, so set them all to NULL and INVALID */
10098         if (!(priv->status & STATUS_ASSOCIATED)) {
10099                 wstats->miss.beacon = 0;
10100                 wstats->discard.retries = 0;
10101                 wstats->qual.qual = 0;
10102                 wstats->qual.level = 0;
10103                 wstats->qual.noise = 0;
10104                 wstats->qual.updated = 7;
10105                 wstats->qual.updated |= IW_QUAL_NOISE_INVALID |
10106                     IW_QUAL_QUAL_INVALID | IW_QUAL_LEVEL_INVALID;
10107                 return wstats;
10108         }
10109
10110         wstats->qual.qual = priv->quality;
10111         wstats->qual.level = priv->exp_avg_rssi;
10112         wstats->qual.noise = priv->exp_avg_noise;
10113         wstats->qual.updated = IW_QUAL_QUAL_UPDATED | IW_QUAL_LEVEL_UPDATED |
10114             IW_QUAL_NOISE_UPDATED | IW_QUAL_DBM;
10115
10116         wstats->miss.beacon = average_value(&priv->average_missed_beacons);
10117         wstats->discard.retries = priv->last_tx_failures;
10118         wstats->discard.code = priv->ieee->ieee_stats.rx_discards_undecryptable;
10119
10120 /*      if (ipw_get_ordinal(priv, IPW_ORD_STAT_TX_RETRY, &tx_retry, &len))
10121         goto fail_get_ordinal;
10122         wstats->discard.retries += tx_retry; */
10123
10124         return wstats;
10125 }
10126
10127 /* net device stuff */
10128
10129 static  void init_sys_config(struct ipw_sys_config *sys_config)
10130 {
10131         memset(sys_config, 0, sizeof(struct ipw_sys_config));
10132         sys_config->bt_coexistence = 0;
10133         sys_config->answer_broadcast_ssid_probe = 0;
10134         sys_config->accept_all_data_frames = 0;
10135         sys_config->accept_non_directed_frames = 1;
10136         sys_config->exclude_unicast_unencrypted = 0;
10137         sys_config->disable_unicast_decryption = 1;
10138         sys_config->exclude_multicast_unencrypted = 0;
10139         sys_config->disable_multicast_decryption = 1;
10140         if (antenna < CFG_SYS_ANTENNA_BOTH || antenna > CFG_SYS_ANTENNA_B)
10141                 antenna = CFG_SYS_ANTENNA_BOTH;
10142         sys_config->antenna_diversity = antenna;
10143         sys_config->pass_crc_to_host = 0;       /* TODO: See if 1 gives us FCS */
10144         sys_config->dot11g_auto_detection = 0;
10145         sys_config->enable_cts_to_self = 0;
10146         sys_config->bt_coexist_collision_thr = 0;
10147         sys_config->pass_noise_stats_to_host = 1;       /* 1 -- fix for 256 */
10148         sys_config->silence_threshold = 0x1e;
10149 }
10150
10151 static int ipw_net_open(struct net_device *dev)
10152 {
10153         struct ipw_priv *priv = ieee80211_priv(dev);
10154         IPW_DEBUG_INFO("dev->open\n");
10155         /* we should be verifying the device is ready to be opened */
10156         mutex_lock(&priv->mutex);
10157         if (!(priv->status & STATUS_RF_KILL_MASK) &&
10158             (priv->status & STATUS_ASSOCIATED))
10159                 netif_start_queue(dev);
10160         mutex_unlock(&priv->mutex);
10161         return 0;
10162 }
10163
10164 static int ipw_net_stop(struct net_device *dev)
10165 {
10166         IPW_DEBUG_INFO("dev->close\n");
10167         netif_stop_queue(dev);
10168         return 0;
10169 }
10170
10171 /*
10172 todo:
10173
10174 modify to send one tfd per fragment instead of using chunking.  otherwise
10175 we need to heavily modify the ieee80211_skb_to_txb.
10176 */
10177
10178 static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
10179                              int pri)
10180 {
10181         struct ieee80211_hdr_3addrqos *hdr = (struct ieee80211_hdr_3addrqos *)
10182             txb->fragments[0]->data;
10183         int i = 0;
10184         struct tfd_frame *tfd;
10185 #ifdef CONFIG_IPW2200_QOS
10186         int tx_id = ipw_get_tx_queue_number(priv, pri);
10187         struct clx2_tx_queue *txq = &priv->txq[tx_id];
10188 #else
10189         struct clx2_tx_queue *txq = &priv->txq[0];
10190 #endif
10191         struct clx2_queue *q = &txq->q;
10192         u8 id, hdr_len, unicast;
10193         u16 remaining_bytes;
10194         int fc;
10195         DECLARE_MAC_BUF(mac);
10196
10197         hdr_len = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
10198         switch (priv->ieee->iw_mode) {
10199         case IW_MODE_ADHOC:
10200                 unicast = !is_multicast_ether_addr(hdr->addr1);
10201                 id = ipw_find_station(priv, hdr->addr1);
10202                 if (id == IPW_INVALID_STATION) {
10203                         id = ipw_add_station(priv, hdr->addr1);
10204                         if (id == IPW_INVALID_STATION) {
10205                                 IPW_WARNING("Attempt to send data to "
10206                                             "invalid cell: %s\n",
10207                                             print_mac(mac, hdr->addr1));
10208                                 goto drop;
10209                         }
10210                 }
10211                 break;
10212
10213         case IW_MODE_INFRA:
10214         default:
10215                 unicast = !is_multicast_ether_addr(hdr->addr3);
10216                 id = 0;
10217                 break;
10218         }
10219
10220         tfd = &txq->bd[q->first_empty];
10221         txq->txb[q->first_empty] = txb;
10222         memset(tfd, 0, sizeof(*tfd));
10223         tfd->u.data.station_number = id;
10224
10225         tfd->control_flags.message_type = TX_FRAME_TYPE;
10226         tfd->control_flags.control_bits = TFD_NEED_IRQ_MASK;
10227
10228         tfd->u.data.cmd_id = DINO_CMD_TX;
10229         tfd->u.data.len = cpu_to_le16(txb->payload_size);
10230         remaining_bytes = txb->payload_size;
10231
10232         if (priv->assoc_request.ieee_mode == IPW_B_MODE)
10233                 tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_MODE_CCK;
10234         else
10235                 tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_MODE_OFDM;
10236
10237         if (priv->assoc_request.preamble_length == DCT_FLAG_SHORT_PREAMBLE)
10238                 tfd->u.data.tx_flags |= DCT_FLAG_SHORT_PREAMBLE;
10239
10240         fc = le16_to_cpu(hdr->frame_ctl);
10241         hdr->frame_ctl = cpu_to_le16(fc & ~IEEE80211_FCTL_MOREFRAGS);
10242
10243         memcpy(&tfd->u.data.tfd.tfd_24.mchdr, hdr, hdr_len);
10244
10245         if (likely(unicast))
10246                 tfd->u.data.tx_flags |= DCT_FLAG_ACK_REQD;
10247
10248         if (txb->encrypted && !priv->ieee->host_encrypt) {
10249                 switch (priv->ieee->sec.level) {
10250                 case SEC_LEVEL_3:
10251                         tfd->u.data.tfd.tfd_24.mchdr.frame_ctl |=
10252                             cpu_to_le16(IEEE80211_FCTL_PROTECTED);
10253                         /* XXX: ACK flag must be set for CCMP even if it
10254                          * is a multicast/broadcast packet, because CCMP
10255                          * group communication encrypted by GTK is
10256                          * actually done by the AP. */
10257                         if (!unicast)
10258                                 tfd->u.data.tx_flags |= DCT_FLAG_ACK_REQD;
10259
10260                         tfd->u.data.tx_flags &= ~DCT_FLAG_NO_WEP;
10261                         tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_SECURITY_CCM;
10262                         tfd->u.data.key_index = 0;
10263                         tfd->u.data.key_index |= DCT_WEP_INDEX_USE_IMMEDIATE;
10264                         break;
10265                 case SEC_LEVEL_2:
10266                         tfd->u.data.tfd.tfd_24.mchdr.frame_ctl |=
10267                             cpu_to_le16(IEEE80211_FCTL_PROTECTED);
10268                         tfd->u.data.tx_flags &= ~DCT_FLAG_NO_WEP;
10269                         tfd->u.data.tx_flags_ext |= DCT_FLAG_EXT_SECURITY_TKIP;
10270                         tfd->u.data.key_index = DCT_WEP_INDEX_USE_IMMEDIATE;
10271                         break;
10272                 case SEC_LEVEL_1:
10273                         tfd->u.data.tfd.tfd_24.mchdr.frame_ctl |=
10274                             cpu_to_le16(IEEE80211_FCTL_PROTECTED);
10275                         tfd->u.data.key_index = priv->ieee->tx_keyidx;
10276                         if (priv->ieee->sec.key_sizes[priv->ieee->tx_keyidx] <=
10277                             40)
10278                                 tfd->u.data.key_index |= DCT_WEP_KEY_64Bit;
10279                         else
10280                                 tfd->u.data.key_index |= DCT_WEP_KEY_128Bit;
10281                         break;
10282                 case SEC_LEVEL_0:
10283                         break;
10284                 default:
10285                         printk(KERN_ERR "Unknow security level %d\n",
10286                                priv->ieee->sec.level);
10287                         break;
10288                 }
10289         } else
10290                 /* No hardware encryption */
10291                 tfd->u.data.tx_flags |= DCT_FLAG_NO_WEP;
10292
10293 #ifdef CONFIG_IPW2200_QOS
10294         if (fc & IEEE80211_STYPE_QOS_DATA)
10295                 ipw_qos_set_tx_queue_command(priv, pri, &(tfd->u.data));
10296 #endif                          /* CONFIG_IPW2200_QOS */
10297
10298         /* payload */
10299         tfd->u.data.num_chunks = cpu_to_le32(min((u8) (NUM_TFD_CHUNKS - 2),
10300                                                  txb->nr_frags));
10301         IPW_DEBUG_FRAG("%i fragments being sent as %i chunks.\n",
10302                        txb->nr_frags, le32_to_cpu(tfd->u.data.num_chunks));
10303         for (i = 0; i < le32_to_cpu(tfd->u.data.num_chunks); i++) {
10304                 IPW_DEBUG_FRAG("Adding fragment %i of %i (%d bytes).\n",
10305                                i, le32_to_cpu(tfd->u.data.num_chunks),
10306                                txb->fragments[i]->len - hdr_len);
10307                 IPW_DEBUG_TX("Dumping TX packet frag %i of %i (%d bytes):\n",
10308                              i, tfd->u.data.num_chunks,
10309                              txb->fragments[i]->len - hdr_len);
10310                 printk_buf(IPW_DL_TX, txb->fragments[i]->data + hdr_len,
10311                            txb->fragments[i]->len - hdr_len);
10312
10313                 tfd->u.data.chunk_ptr[i] =
10314                     cpu_to_le32(pci_map_single
10315                                 (priv->pci_dev,
10316                                  txb->fragments[i]->data + hdr_len,
10317                                  txb->fragments[i]->len - hdr_len,
10318                                  PCI_DMA_TODEVICE));
10319                 tfd->u.data.chunk_len[i] =
10320                     cpu_to_le16(txb->fragments[i]->len - hdr_len);
10321         }
10322
10323         if (i != txb->nr_frags) {
10324                 struct sk_buff *skb;
10325                 u16 remaining_bytes = 0;
10326                 int j;
10327
10328                 for (j = i; j < txb->nr_frags; j++)
10329                         remaining_bytes += txb->fragments[j]->len - hdr_len;
10330
10331                 printk(KERN_INFO "Trying to reallocate for %d bytes\n",
10332                        remaining_bytes);
10333                 skb = alloc_skb(remaining_bytes, GFP_ATOMIC);
10334                 if (skb != NULL) {
10335                         tfd->u.data.chunk_len[i] = cpu_to_le16(remaining_bytes);
10336                         for (j = i; j < txb->nr_frags; j++) {
10337                                 int size = txb->fragments[j]->len - hdr_len;
10338
10339                                 printk(KERN_INFO "Adding frag %d %d...\n",
10340                                        j, size);
10341                                 memcpy(skb_put(skb, size),
10342                                        txb->fragments[j]->data + hdr_len, size);
10343                         }
10344                         dev_kfree_skb_any(txb->fragments[i]);
10345                         txb->fragments[i] = skb;
10346                         tfd->u.data.chunk_ptr[i] =
10347                             cpu_to_le32(pci_map_single
10348                                         (priv->pci_dev, skb->data,
10349                                          remaining_bytes,
10350                                          PCI_DMA_TODEVICE));
10351
10352                         tfd->u.data.num_chunks =
10353                             cpu_to_le32(le32_to_cpu(tfd->u.data.num_chunks) +
10354                                         1);
10355                 }
10356         }
10357
10358         /* kick DMA */
10359         q->first_empty = ipw_queue_inc_wrap(q->first_empty, q->n_bd);
10360         ipw_write32(priv, q->reg_w, q->first_empty);
10361
10362         if (ipw_tx_queue_space(q) < q->high_mark)
10363                 netif_stop_queue(priv->net_dev);
10364
10365         return NETDEV_TX_OK;
10366
10367       drop:
10368         IPW_DEBUG_DROP("Silently dropping Tx packet.\n");
10369         ieee80211_txb_free(txb);
10370         return NETDEV_TX_OK;
10371 }
10372
10373 static int ipw_net_is_queue_full(struct net_device *dev, int pri)
10374 {
10375         struct ipw_priv *priv = ieee80211_priv(dev);
10376 #ifdef CONFIG_IPW2200_QOS
10377         int tx_id = ipw_get_tx_queue_number(priv, pri);
10378         struct clx2_tx_queue *txq = &priv->txq[tx_id];
10379 #else
10380         struct clx2_tx_queue *txq = &priv->txq[0];
10381 #endif                          /* CONFIG_IPW2200_QOS */
10382
10383         if (ipw_tx_queue_space(&txq->q) < txq->q.high_mark)
10384                 return 1;
10385
10386         return 0;
10387 }
10388
10389 #ifdef CONFIG_IPW2200_PROMISCUOUS
10390 static void ipw_handle_promiscuous_tx(struct ipw_priv *priv,
10391                                       struct ieee80211_txb *txb)
10392 {
10393         struct ieee80211_rx_stats dummystats;
10394         struct ieee80211_hdr *hdr;
10395         u8 n;
10396         u16 filter = priv->prom_priv->filter;
10397         int hdr_only = 0;
10398
10399         if (filter & IPW_PROM_NO_TX)
10400                 return;
10401
10402         memset(&dummystats, 0, sizeof(dummystats));
10403
10404         /* Filtering of fragment chains is done agains the first fragment */
10405         hdr = (void *)txb->fragments[0]->data;
10406         if (ieee80211_is_management(le16_to_cpu(hdr->frame_ctl))) {
10407                 if (filter & IPW_PROM_NO_MGMT)
10408                         return;
10409                 if (filter & IPW_PROM_MGMT_HEADER_ONLY)
10410                         hdr_only = 1;
10411         } else if (ieee80211_is_control(le16_to_cpu(hdr->frame_ctl))) {
10412                 if (filter & IPW_PROM_NO_CTL)
10413                         return;
10414                 if (filter & IPW_PROM_CTL_HEADER_ONLY)
10415                         hdr_only = 1;
10416         } else if (ieee80211_is_data(le16_to_cpu(hdr->frame_ctl))) {
10417                 if (filter & IPW_PROM_NO_DATA)
10418                         return;
10419                 if (filter & IPW_PROM_DATA_HEADER_ONLY)
10420                         hdr_only = 1;
10421         }
10422
10423         for(n=0; n<txb->nr_frags; ++n) {
10424                 struct sk_buff *src = txb->fragments[n];
10425                 struct sk_buff *dst;
10426                 struct ieee80211_radiotap_header *rt_hdr;
10427                 int len;
10428
10429                 if (hdr_only) {
10430                         hdr = (void *)src->data;
10431                         len = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
10432                 } else
10433                         len = src->len;
10434
10435                 dst = alloc_skb(
10436                         len + IEEE80211_RADIOTAP_HDRLEN, GFP_ATOMIC);
10437                 if (!dst) continue;
10438
10439                 rt_hdr = (void *)skb_put(dst, sizeof(*rt_hdr));
10440
10441                 rt_hdr->it_version = PKTHDR_RADIOTAP_VERSION;
10442                 rt_hdr->it_pad = 0;
10443                 rt_hdr->it_present = 0; /* after all, it's just an idea */
10444                 rt_hdr->it_present |=  cpu_to_le32(1 << IEEE80211_RADIOTAP_CHANNEL);
10445
10446                 *(__le16*)skb_put(dst, sizeof(u16)) = cpu_to_le16(
10447                         ieee80211chan2mhz(priv->channel));
10448                 if (priv->channel > 14)         /* 802.11a */
10449                         *(__le16*)skb_put(dst, sizeof(u16)) =
10450                                 cpu_to_le16(IEEE80211_CHAN_OFDM |
10451                                              IEEE80211_CHAN_5GHZ);
10452                 else if (priv->ieee->mode == IEEE_B) /* 802.11b */
10453                         *(__le16*)skb_put(dst, sizeof(u16)) =
10454                                 cpu_to_le16(IEEE80211_CHAN_CCK |
10455                                              IEEE80211_CHAN_2GHZ);
10456                 else            /* 802.11g */
10457                         *(__le16*)skb_put(dst, sizeof(u16)) =
10458                                 cpu_to_le16(IEEE80211_CHAN_OFDM |
10459                                  IEEE80211_CHAN_2GHZ);
10460
10461                 rt_hdr->it_len = cpu_to_le16(dst->len);
10462
10463                 skb_copy_from_linear_data(src, skb_put(dst, len), len);
10464
10465                 if (!ieee80211_rx(priv->prom_priv->ieee, dst, &dummystats))
10466                         dev_kfree_skb_any(dst);
10467         }
10468 }
10469 #endif
10470
10471 static int ipw_net_hard_start_xmit(struct ieee80211_txb *txb,
10472                                    struct net_device *dev, int pri)
10473 {
10474         struct ipw_priv *priv = ieee80211_priv(dev);
10475         unsigned long flags;
10476         int ret;
10477
10478         IPW_DEBUG_TX("dev->xmit(%d bytes)\n", txb->payload_size);
10479         spin_lock_irqsave(&priv->lock, flags);
10480
10481         if (!(priv->status & STATUS_ASSOCIATED)) {
10482                 IPW_DEBUG_INFO("Tx attempt while not associated.\n");
10483                 priv->ieee->stats.tx_carrier_errors++;
10484                 netif_stop_queue(dev);
10485                 goto fail_unlock;
10486         }
10487
10488 #ifdef CONFIG_IPW2200_PROMISCUOUS
10489         if (rtap_iface && netif_running(priv->prom_net_dev))
10490                 ipw_handle_promiscuous_tx(priv, txb);
10491 #endif
10492
10493         ret = ipw_tx_skb(priv, txb, pri);
10494         if (ret == NETDEV_TX_OK)
10495                 __ipw_led_activity_on(priv);
10496         spin_unlock_irqrestore(&priv->lock, flags);
10497
10498         return ret;
10499
10500       fail_unlock:
10501         spin_unlock_irqrestore(&priv->lock, flags);
10502         return 1;
10503 }
10504
10505 static struct net_device_stats *ipw_net_get_stats(struct net_device *dev)
10506 {
10507         struct ipw_priv *priv = ieee80211_priv(dev);
10508
10509         priv->ieee->stats.tx_packets = priv->tx_packets;
10510         priv->ieee->stats.rx_packets = priv->rx_packets;
10511         return &priv->ieee->stats;
10512 }
10513
10514 static void ipw_net_set_multicast_list(struct net_device *dev)
10515 {
10516
10517 }
10518
10519 static int ipw_net_set_mac_address(struct net_device *dev, void *p)
10520 {
10521         struct ipw_priv *priv = ieee80211_priv(dev);
10522         struct sockaddr *addr = p;
10523         DECLARE_MAC_BUF(mac);
10524
10525         if (!is_valid_ether_addr(addr->sa_data))
10526                 return -EADDRNOTAVAIL;
10527         mutex_lock(&priv->mutex);
10528         priv->config |= CFG_CUSTOM_MAC;
10529         memcpy(priv->mac_addr, addr->sa_data, ETH_ALEN);
10530         printk(KERN_INFO "%s: Setting MAC to %s\n",
10531                priv->net_dev->name, print_mac(mac, priv->mac_addr));
10532         queue_work(priv->workqueue, &priv->adapter_restart);
10533         mutex_unlock(&priv->mutex);
10534         return 0;
10535 }
10536
10537 static void ipw_ethtool_get_drvinfo(struct net_device *dev,
10538                                     struct ethtool_drvinfo *info)
10539 {
10540         struct ipw_priv *p = ieee80211_priv(dev);
10541         char vers[64];
10542         char date[32];
10543         u32 len;
10544
10545         strcpy(info->driver, DRV_NAME);
10546         strcpy(info->version, DRV_VERSION);
10547
10548         len = sizeof(vers);
10549         ipw_get_ordinal(p, IPW_ORD_STAT_FW_VERSION, vers, &len);
10550         len = sizeof(date);
10551         ipw_get_ordinal(p, IPW_ORD_STAT_FW_DATE, date, &len);
10552
10553         snprintf(info->fw_version, sizeof(info->fw_version), "%s (%s)",
10554                  vers, date);
10555         strcpy(info->bus_info, pci_name(p->pci_dev));
10556         info->eedump_len = IPW_EEPROM_IMAGE_SIZE;
10557 }
10558
10559 static u32 ipw_ethtool_get_link(struct net_device *dev)
10560 {
10561         struct ipw_priv *priv = ieee80211_priv(dev);
10562         return (priv->status & STATUS_ASSOCIATED) != 0;
10563 }
10564
10565 static int ipw_ethtool_get_eeprom_len(struct net_device *dev)
10566 {
10567         return IPW_EEPROM_IMAGE_SIZE;
10568 }
10569
10570 static int ipw_ethtool_get_eeprom(struct net_device *dev,
10571                                   struct ethtool_eeprom *eeprom, u8 * bytes)
10572 {
10573         struct ipw_priv *p = ieee80211_priv(dev);
10574
10575         if (eeprom->offset + eeprom->len > IPW_EEPROM_IMAGE_SIZE)
10576                 return -EINVAL;
10577         mutex_lock(&p->mutex);
10578         memcpy(bytes, &p->eeprom[eeprom->offset], eeprom->len);
10579         mutex_unlock(&p->mutex);
10580         return 0;
10581 }
10582
10583 static int ipw_ethtool_set_eeprom(struct net_device *dev,
10584                                   struct ethtool_eeprom *eeprom, u8 * bytes)
10585 {
10586         struct ipw_priv *p = ieee80211_priv(dev);
10587         int i;
10588
10589         if (eeprom->offset + eeprom->len > IPW_EEPROM_IMAGE_SIZE)
10590                 return -EINVAL;
10591         mutex_lock(&p->mutex);
10592         memcpy(&p->eeprom[eeprom->offset], bytes, eeprom->len);
10593         for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
10594                 ipw_write8(p, i + IPW_EEPROM_DATA, p->eeprom[i]);
10595         mutex_unlock(&p->mutex);
10596         return 0;
10597 }
10598
10599 static const struct ethtool_ops ipw_ethtool_ops = {
10600         .get_link = ipw_ethtool_get_link,
10601         .get_drvinfo = ipw_ethtool_get_drvinfo,
10602         .get_eeprom_len = ipw_ethtool_get_eeprom_len,
10603         .get_eeprom = ipw_ethtool_get_eeprom,
10604         .set_eeprom = ipw_ethtool_set_eeprom,
10605 };
10606
10607 static irqreturn_t ipw_isr(int irq, void *data)
10608 {
10609         struct ipw_priv *priv = data;
10610         u32 inta, inta_mask;
10611
10612         if (!priv)
10613                 return IRQ_NONE;
10614
10615         spin_lock(&priv->irq_lock);
10616
10617         if (!(priv->status & STATUS_INT_ENABLED)) {
10618                 /* IRQ is disabled */
10619                 goto none;
10620         }
10621
10622         inta = ipw_read32(priv, IPW_INTA_RW);
10623         inta_mask = ipw_read32(priv, IPW_INTA_MASK_R);
10624
10625         if (inta == 0xFFFFFFFF) {
10626                 /* Hardware disappeared */
10627                 IPW_WARNING("IRQ INTA == 0xFFFFFFFF\n");
10628                 goto none;
10629         }
10630
10631         if (!(inta & (IPW_INTA_MASK_ALL & inta_mask))) {
10632                 /* Shared interrupt */
10633                 goto none;
10634         }
10635
10636         /* tell the device to stop sending interrupts */
10637         __ipw_disable_interrupts(priv);
10638
10639         /* ack current interrupts */
10640         inta &= (IPW_INTA_MASK_ALL & inta_mask);
10641         ipw_write32(priv, IPW_INTA_RW, inta);
10642
10643         /* Cache INTA value for our tasklet */
10644         priv->isr_inta = inta;
10645
10646         tasklet_schedule(&priv->irq_tasklet);
10647
10648         spin_unlock(&priv->irq_lock);
10649
10650         return IRQ_HANDLED;
10651       none:
10652         spin_unlock(&priv->irq_lock);
10653         return IRQ_NONE;
10654 }
10655
10656 static void ipw_rf_kill(void *adapter)
10657 {
10658         struct ipw_priv *priv = adapter;
10659         unsigned long flags;
10660
10661         spin_lock_irqsave(&priv->lock, flags);
10662
10663         if (rf_kill_active(priv)) {
10664                 IPW_DEBUG_RF_KILL("RF Kill active, rescheduling GPIO check\n");
10665                 if (priv->workqueue)
10666                         queue_delayed_work(priv->workqueue,
10667                                            &priv->rf_kill, 2 * HZ);
10668                 goto exit_unlock;
10669         }
10670
10671         /* RF Kill is now disabled, so bring the device back up */
10672
10673         if (!(priv->status & STATUS_RF_KILL_MASK)) {
10674                 IPW_DEBUG_RF_KILL("HW RF Kill no longer active, restarting "
10675                                   "device\n");
10676
10677                 /* we can not do an adapter restart while inside an irq lock */
10678                 queue_work(priv->workqueue, &priv->adapter_restart);
10679         } else
10680                 IPW_DEBUG_RF_KILL("HW RF Kill deactivated.  SW RF Kill still "
10681                                   "enabled\n");
10682
10683       exit_unlock:
10684         spin_unlock_irqrestore(&priv->lock, flags);
10685 }
10686
10687 static void ipw_bg_rf_kill(struct work_struct *work)
10688 {
10689         struct ipw_priv *priv =
10690                 container_of(work, struct ipw_priv, rf_kill.work);
10691         mutex_lock(&priv->mutex);
10692         ipw_rf_kill(priv);
10693         mutex_unlock(&priv->mutex);
10694 }
10695
10696 static void ipw_link_up(struct ipw_priv *priv)
10697 {
10698         priv->last_seq_num = -1;
10699         priv->last_frag_num = -1;
10700         priv->last_packet_time = 0;
10701
10702         netif_carrier_on(priv->net_dev);
10703         if (netif_queue_stopped(priv->net_dev)) {
10704                 IPW_DEBUG_NOTIF("waking queue\n");
10705                 netif_wake_queue(priv->net_dev);
10706         } else {
10707                 IPW_DEBUG_NOTIF("starting queue\n");
10708                 netif_start_queue(priv->net_dev);
10709         }
10710
10711         cancel_delayed_work(&priv->request_scan);
10712         cancel_delayed_work(&priv->scan_event);
10713         ipw_reset_stats(priv);
10714         /* Ensure the rate is updated immediately */
10715         priv->last_rate = ipw_get_current_rate(priv);
10716         ipw_gather_stats(priv);
10717         ipw_led_link_up(priv);
10718         notify_wx_assoc_event(priv);
10719
10720         if (priv->config & CFG_BACKGROUND_SCAN)
10721                 queue_delayed_work(priv->workqueue, &priv->request_scan, HZ);
10722 }
10723
10724 static void ipw_bg_link_up(struct work_struct *work)
10725 {
10726         struct ipw_priv *priv =
10727                 container_of(work, struct ipw_priv, link_up);
10728         mutex_lock(&priv->mutex);
10729         ipw_link_up(priv);
10730         mutex_unlock(&priv->mutex);
10731 }
10732
10733 static void ipw_link_down(struct ipw_priv *priv)
10734 {
10735         ipw_led_link_down(priv);
10736         netif_carrier_off(priv->net_dev);
10737         netif_stop_queue(priv->net_dev);
10738         notify_wx_assoc_event(priv);
10739
10740         /* Cancel any queued work ... */
10741         cancel_delayed_work(&priv->request_scan);
10742         cancel_delayed_work(&priv->adhoc_check);
10743         cancel_delayed_work(&priv->gather_stats);
10744
10745         ipw_reset_stats(priv);
10746
10747         if (!(priv->status & STATUS_EXIT_PENDING)) {
10748                 /* Queue up another scan... */
10749                 queue_delayed_work(priv->workqueue, &priv->request_scan, 0);
10750         } else
10751                 cancel_delayed_work(&priv->scan_event);
10752 }
10753
10754 static void ipw_bg_link_down(struct work_struct *work)
10755 {
10756         struct ipw_priv *priv =
10757                 container_of(work, struct ipw_priv, link_down);
10758         mutex_lock(&priv->mutex);
10759         ipw_link_down(priv);
10760         mutex_unlock(&priv->mutex);
10761 }
10762
10763 static int __devinit ipw_setup_deferred_work(struct ipw_priv *priv)
10764 {
10765         int ret = 0;
10766
10767         priv->workqueue = create_workqueue(DRV_NAME);
10768         init_waitqueue_head(&priv->wait_command_queue);
10769         init_waitqueue_head(&priv->wait_state);
10770
10771         INIT_DELAYED_WORK(&priv->adhoc_check, ipw_bg_adhoc_check);
10772         INIT_WORK(&priv->associate, ipw_bg_associate);
10773         INIT_WORK(&priv->disassociate, ipw_bg_disassociate);
10774         INIT_WORK(&priv->system_config, ipw_system_config);
10775         INIT_WORK(&priv->rx_replenish, ipw_bg_rx_queue_replenish);
10776         INIT_WORK(&priv->adapter_restart, ipw_bg_adapter_restart);
10777         INIT_DELAYED_WORK(&priv->rf_kill, ipw_bg_rf_kill);
10778         INIT_WORK(&priv->up, ipw_bg_up);
10779         INIT_WORK(&priv->down, ipw_bg_down);
10780         INIT_DELAYED_WORK(&priv->request_scan, ipw_request_scan);
10781         INIT_DELAYED_WORK(&priv->scan_event, ipw_scan_event);
10782         INIT_WORK(&priv->request_passive_scan, ipw_request_passive_scan);
10783         INIT_DELAYED_WORK(&priv->gather_stats, ipw_bg_gather_stats);
10784         INIT_WORK(&priv->abort_scan, ipw_bg_abort_scan);
10785         INIT_WORK(&priv->roam, ipw_bg_roam);
10786         INIT_DELAYED_WORK(&priv->scan_check, ipw_bg_scan_check);
10787         INIT_WORK(&priv->link_up, ipw_bg_link_up);
10788         INIT_WORK(&priv->link_down, ipw_bg_link_down);
10789         INIT_DELAYED_WORK(&priv->led_link_on, ipw_bg_led_link_on);
10790         INIT_DELAYED_WORK(&priv->led_link_off, ipw_bg_led_link_off);
10791         INIT_DELAYED_WORK(&priv->led_act_off, ipw_bg_led_activity_off);
10792         INIT_WORK(&priv->merge_networks, ipw_merge_adhoc_network);
10793
10794 #ifdef CONFIG_IPW2200_QOS
10795         INIT_WORK(&priv->qos_activate, ipw_bg_qos_activate);
10796 #endif                          /* CONFIG_IPW2200_QOS */
10797
10798         tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
10799                      ipw_irq_tasklet, (unsigned long)priv);
10800
10801         return ret;
10802 }
10803
10804 static void shim__set_security(struct net_device *dev,
10805                                struct ieee80211_security *sec)
10806 {
10807         struct ipw_priv *priv = ieee80211_priv(dev);
10808         int i;
10809         for (i = 0; i < 4; i++) {
10810                 if (sec->flags & (1 << i)) {
10811                         priv->ieee->sec.encode_alg[i] = sec->encode_alg[i];
10812                         priv->ieee->sec.key_sizes[i] = sec->key_sizes[i];
10813                         if (sec->key_sizes[i] == 0)
10814                                 priv->ieee->sec.flags &= ~(1 << i);
10815                         else {
10816                                 memcpy(priv->ieee->sec.keys[i], sec->keys[i],
10817                                        sec->key_sizes[i]);
10818                                 priv->ieee->sec.flags |= (1 << i);
10819                         }
10820                         priv->status |= STATUS_SECURITY_UPDATED;
10821                 } else if (sec->level != SEC_LEVEL_1)
10822                         priv->ieee->sec.flags &= ~(1 << i);
10823         }
10824
10825         if (sec->flags & SEC_ACTIVE_KEY) {
10826                 if (sec->active_key <= 3) {
10827                         priv->ieee->sec.active_key = sec->active_key;
10828                         priv->ieee->sec.flags |= SEC_ACTIVE_KEY;
10829                 } else
10830                         priv->ieee->sec.flags &= ~SEC_ACTIVE_KEY;
10831                 priv->status |= STATUS_SECURITY_UPDATED;
10832         } else
10833                 priv->ieee->sec.flags &= ~SEC_ACTIVE_KEY;
10834
10835         if ((sec->flags & SEC_AUTH_MODE) &&
10836             (priv->ieee->sec.auth_mode != sec->auth_mode)) {
10837                 priv->ieee->sec.auth_mode = sec->auth_mode;
10838                 priv->ieee->sec.flags |= SEC_AUTH_MODE;
10839                 if (sec->auth_mode == WLAN_AUTH_SHARED_KEY)
10840                         priv->capability |= CAP_SHARED_KEY;
10841                 else
10842                         priv->capability &= ~CAP_SHARED_KEY;
10843                 priv->status |= STATUS_SECURITY_UPDATED;
10844         }
10845
10846         if (sec->flags & SEC_ENABLED && priv->ieee->sec.enabled != sec->enabled) {
10847                 priv->ieee->sec.flags |= SEC_ENABLED;
10848                 priv->ieee->sec.enabled = sec->enabled;
10849                 priv->status |= STATUS_SECURITY_UPDATED;
10850                 if (sec->enabled)
10851                         priv->capability |= CAP_PRIVACY_ON;
10852                 else
10853                         priv->capability &= ~CAP_PRIVACY_ON;
10854         }
10855
10856         if (sec->flags & SEC_ENCRYPT)
10857                 priv->ieee->sec.encrypt = sec->encrypt;
10858
10859         if (sec->flags & SEC_LEVEL && priv->ieee->sec.level != sec->level) {
10860                 priv->ieee->sec.level = sec->level;
10861                 priv->ieee->sec.flags |= SEC_LEVEL;
10862                 priv->status |= STATUS_SECURITY_UPDATED;
10863         }
10864
10865         if (!priv->ieee->host_encrypt && (sec->flags & SEC_ENCRYPT))
10866                 ipw_set_hwcrypto_keys(priv);
10867
10868         /* To match current functionality of ipw2100 (which works well w/
10869          * various supplicants, we don't force a disassociate if the
10870          * privacy capability changes ... */
10871 #if 0
10872         if ((priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) &&
10873             (((priv->assoc_request.capability &
10874                cpu_to_le16(WLAN_CAPABILITY_PRIVACY)) && !sec->enabled) ||
10875              (!(priv->assoc_request.capability &
10876                 cpu_to_le16(WLAN_CAPABILITY_PRIVACY)) && sec->enabled))) {
10877                 IPW_DEBUG_ASSOC("Disassociating due to capability "
10878                                 "change.\n");
10879                 ipw_disassociate(priv);
10880         }
10881 #endif
10882 }
10883
10884 static int init_supported_rates(struct ipw_priv *priv,
10885                                 struct ipw_supported_rates *rates)
10886 {
10887         /* TODO: Mask out rates based on priv->rates_mask */
10888
10889         memset(rates, 0, sizeof(*rates));
10890         /* configure supported rates */
10891         switch (priv->ieee->freq_band) {
10892         case IEEE80211_52GHZ_BAND:
10893                 rates->ieee_mode = IPW_A_MODE;
10894                 rates->purpose = IPW_RATE_CAPABILITIES;
10895                 ipw_add_ofdm_scan_rates(rates, IEEE80211_CCK_MODULATION,
10896                                         IEEE80211_OFDM_DEFAULT_RATES_MASK);
10897                 break;
10898
10899         default:                /* Mixed or 2.4Ghz */
10900                 rates->ieee_mode = IPW_G_MODE;
10901                 rates->purpose = IPW_RATE_CAPABILITIES;
10902                 ipw_add_cck_scan_rates(rates, IEEE80211_CCK_MODULATION,
10903                                        IEEE80211_CCK_DEFAULT_RATES_MASK);
10904                 if (priv->ieee->modulation & IEEE80211_OFDM_MODULATION) {
10905                         ipw_add_ofdm_scan_rates(rates, IEEE80211_CCK_MODULATION,
10906                                                 IEEE80211_OFDM_DEFAULT_RATES_MASK);
10907                 }
10908                 break;
10909         }
10910
10911         return 0;
10912 }
10913
10914 static int ipw_config(struct ipw_priv *priv)
10915 {
10916         /* This is only called from ipw_up, which resets/reloads the firmware
10917            so, we don't need to first disable the card before we configure
10918            it */
10919         if (ipw_set_tx_power(priv))
10920                 goto error;
10921
10922         /* initialize adapter address */
10923         if (ipw_send_adapter_address(priv, priv->net_dev->dev_addr))
10924                 goto error;
10925
10926         /* set basic system config settings */
10927         init_sys_config(&priv->sys_config);
10928
10929         /* Support Bluetooth if we have BT h/w on board, and user wants to.
10930          * Does not support BT priority yet (don't abort or defer our Tx) */
10931         if (bt_coexist) {
10932                 unsigned char bt_caps = priv->eeprom[EEPROM_SKU_CAPABILITY];
10933
10934                 if (bt_caps & EEPROM_SKU_CAP_BT_CHANNEL_SIG)
10935                         priv->sys_config.bt_coexistence
10936                             |= CFG_BT_COEXISTENCE_SIGNAL_CHNL;
10937                 if (bt_caps & EEPROM_SKU_CAP_BT_OOB)
10938                         priv->sys_config.bt_coexistence
10939                             |= CFG_BT_COEXISTENCE_OOB;
10940         }
10941
10942 #ifdef CONFIG_IPW2200_PROMISCUOUS
10943         if (priv->prom_net_dev && netif_running(priv->prom_net_dev)) {
10944                 priv->sys_config.accept_all_data_frames = 1;
10945                 priv->sys_config.accept_non_directed_frames = 1;
10946                 priv->sys_config.accept_all_mgmt_bcpr = 1;
10947                 priv->sys_config.accept_all_mgmt_frames = 1;
10948         }
10949 #endif
10950
10951         if (priv->ieee->iw_mode == IW_MODE_ADHOC)
10952                 priv->sys_config.answer_broadcast_ssid_probe = 1;
10953         else
10954                 priv->sys_config.answer_broadcast_ssid_probe = 0;
10955
10956         if (ipw_send_system_config(priv))
10957                 goto error;
10958
10959         init_supported_rates(priv, &priv->rates);
10960         if (ipw_send_supported_rates(priv, &priv->rates))
10961                 goto error;
10962
10963         /* Set request-to-send threshold */
10964         if (priv->rts_threshold) {
10965                 if (ipw_send_rts_threshold(priv, priv->rts_threshold))
10966                         goto error;
10967         }
10968 #ifdef CONFIG_IPW2200_QOS
10969         IPW_DEBUG_QOS("QoS: call ipw_qos_activate\n");
10970         ipw_qos_activate(priv, NULL);
10971 #endif                          /* CONFIG_IPW2200_QOS */
10972
10973         if (ipw_set_random_seed(priv))
10974                 goto error;
10975
10976         /* final state transition to the RUN state */
10977         if (ipw_send_host_complete(priv))
10978                 goto error;
10979
10980         priv->status |= STATUS_INIT;
10981
10982         ipw_led_init(priv);
10983         ipw_led_radio_on(priv);
10984         priv->notif_missed_beacons = 0;
10985
10986         /* Set hardware WEP key if it is configured. */
10987         if ((priv->capability & CAP_PRIVACY_ON) &&
10988             (priv->ieee->sec.level == SEC_LEVEL_1) &&
10989             !(priv->ieee->host_encrypt || priv->ieee->host_decrypt))
10990                 ipw_set_hwcrypto_keys(priv);
10991
10992         return 0;
10993
10994       error:
10995         return -EIO;
10996 }
10997
10998 /*
10999  * NOTE:
11000  *
11001  * These tables have been tested in conjunction with the
11002  * Intel PRO/Wireless 2200BG and 2915ABG Network Connection Adapters.
11003  *
11004  * Altering this values, using it on other hardware, or in geographies
11005  * not intended for resale of the above mentioned Intel adapters has
11006  * not been tested.
11007  *
11008  * Remember to update the table in README.ipw2200 when changing this
11009  * table.
11010  *
11011  */
11012 static const struct ieee80211_geo ipw_geos[] = {
11013         {                       /* Restricted */
11014          "---",
11015          .bg_channels = 11,
11016          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11017                 {2427, 4}, {2432, 5}, {2437, 6},
11018                 {2442, 7}, {2447, 8}, {2452, 9},
11019                 {2457, 10}, {2462, 11}},
11020          },
11021
11022         {                       /* Custom US/Canada */
11023          "ZZF",
11024          .bg_channels = 11,
11025          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11026                 {2427, 4}, {2432, 5}, {2437, 6},
11027                 {2442, 7}, {2447, 8}, {2452, 9},
11028                 {2457, 10}, {2462, 11}},
11029          .a_channels = 8,
11030          .a = {{5180, 36},
11031                {5200, 40},
11032                {5220, 44},
11033                {5240, 48},
11034                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
11035                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
11036                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
11037                {5320, 64, IEEE80211_CH_PASSIVE_ONLY}},
11038          },
11039
11040         {                       /* Rest of World */
11041          "ZZD",
11042          .bg_channels = 13,
11043          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11044                 {2427, 4}, {2432, 5}, {2437, 6},
11045                 {2442, 7}, {2447, 8}, {2452, 9},
11046                 {2457, 10}, {2462, 11}, {2467, 12},
11047                 {2472, 13}},
11048          },
11049
11050         {                       /* Custom USA & Europe & High */
11051          "ZZA",
11052          .bg_channels = 11,
11053          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11054                 {2427, 4}, {2432, 5}, {2437, 6},
11055                 {2442, 7}, {2447, 8}, {2452, 9},
11056                 {2457, 10}, {2462, 11}},
11057          .a_channels = 13,
11058          .a = {{5180, 36},
11059                {5200, 40},
11060                {5220, 44},
11061                {5240, 48},
11062                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
11063                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
11064                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
11065                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
11066                {5745, 149},
11067                {5765, 153},
11068                {5785, 157},
11069                {5805, 161},
11070                {5825, 165}},
11071          },
11072
11073         {                       /* Custom NA & Europe */
11074          "ZZB",
11075          .bg_channels = 11,
11076          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11077                 {2427, 4}, {2432, 5}, {2437, 6},
11078                 {2442, 7}, {2447, 8}, {2452, 9},
11079                 {2457, 10}, {2462, 11}},
11080          .a_channels = 13,
11081          .a = {{5180, 36},
11082                {5200, 40},
11083                {5220, 44},
11084                {5240, 48},
11085                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
11086                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
11087                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
11088                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
11089                {5745, 149, IEEE80211_CH_PASSIVE_ONLY},
11090                {5765, 153, IEEE80211_CH_PASSIVE_ONLY},
11091                {5785, 157, IEEE80211_CH_PASSIVE_ONLY},
11092                {5805, 161, IEEE80211_CH_PASSIVE_ONLY},
11093                {5825, 165, IEEE80211_CH_PASSIVE_ONLY}},
11094          },
11095
11096         {                       /* Custom Japan */
11097          "ZZC",
11098          .bg_channels = 11,
11099          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11100                 {2427, 4}, {2432, 5}, {2437, 6},
11101                 {2442, 7}, {2447, 8}, {2452, 9},
11102                 {2457, 10}, {2462, 11}},
11103          .a_channels = 4,
11104          .a = {{5170, 34}, {5190, 38},
11105                {5210, 42}, {5230, 46}},
11106          },
11107
11108         {                       /* Custom */
11109          "ZZM",
11110          .bg_channels = 11,
11111          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11112                 {2427, 4}, {2432, 5}, {2437, 6},
11113                 {2442, 7}, {2447, 8}, {2452, 9},
11114                 {2457, 10}, {2462, 11}},
11115          },
11116
11117         {                       /* Europe */
11118          "ZZE",
11119          .bg_channels = 13,
11120          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11121                 {2427, 4}, {2432, 5}, {2437, 6},
11122                 {2442, 7}, {2447, 8}, {2452, 9},
11123                 {2457, 10}, {2462, 11}, {2467, 12},
11124                 {2472, 13}},
11125          .a_channels = 19,
11126          .a = {{5180, 36},
11127                {5200, 40},
11128                {5220, 44},
11129                {5240, 48},
11130                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
11131                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
11132                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
11133                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
11134                {5500, 100, IEEE80211_CH_PASSIVE_ONLY},
11135                {5520, 104, IEEE80211_CH_PASSIVE_ONLY},
11136                {5540, 108, IEEE80211_CH_PASSIVE_ONLY},
11137                {5560, 112, IEEE80211_CH_PASSIVE_ONLY},
11138                {5580, 116, IEEE80211_CH_PASSIVE_ONLY},
11139                {5600, 120, IEEE80211_CH_PASSIVE_ONLY},
11140                {5620, 124, IEEE80211_CH_PASSIVE_ONLY},
11141                {5640, 128, IEEE80211_CH_PASSIVE_ONLY},
11142                {5660, 132, IEEE80211_CH_PASSIVE_ONLY},
11143                {5680, 136, IEEE80211_CH_PASSIVE_ONLY},
11144                {5700, 140, IEEE80211_CH_PASSIVE_ONLY}},
11145          },
11146
11147         {                       /* Custom Japan */
11148          "ZZJ",
11149          .bg_channels = 14,
11150          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11151                 {2427, 4}, {2432, 5}, {2437, 6},
11152                 {2442, 7}, {2447, 8}, {2452, 9},
11153                 {2457, 10}, {2462, 11}, {2467, 12},
11154                 {2472, 13}, {2484, 14, IEEE80211_CH_B_ONLY}},
11155          .a_channels = 4,
11156          .a = {{5170, 34}, {5190, 38},
11157                {5210, 42}, {5230, 46}},
11158          },
11159
11160         {                       /* Rest of World */
11161          "ZZR",
11162          .bg_channels = 14,
11163          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11164                 {2427, 4}, {2432, 5}, {2437, 6},
11165                 {2442, 7}, {2447, 8}, {2452, 9},
11166                 {2457, 10}, {2462, 11}, {2467, 12},
11167                 {2472, 13}, {2484, 14, IEEE80211_CH_B_ONLY |
11168                              IEEE80211_CH_PASSIVE_ONLY}},
11169          },
11170
11171         {                       /* High Band */
11172          "ZZH",
11173          .bg_channels = 13,
11174          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11175                 {2427, 4}, {2432, 5}, {2437, 6},
11176                 {2442, 7}, {2447, 8}, {2452, 9},
11177                 {2457, 10}, {2462, 11},
11178                 {2467, 12, IEEE80211_CH_PASSIVE_ONLY},
11179                 {2472, 13, IEEE80211_CH_PASSIVE_ONLY}},
11180          .a_channels = 4,
11181          .a = {{5745, 149}, {5765, 153},
11182                {5785, 157}, {5805, 161}},
11183          },
11184
11185         {                       /* Custom Europe */
11186          "ZZG",
11187          .bg_channels = 13,
11188          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11189                 {2427, 4}, {2432, 5}, {2437, 6},
11190                 {2442, 7}, {2447, 8}, {2452, 9},
11191                 {2457, 10}, {2462, 11},
11192                 {2467, 12}, {2472, 13}},
11193          .a_channels = 4,
11194          .a = {{5180, 36}, {5200, 40},
11195                {5220, 44}, {5240, 48}},
11196          },
11197
11198         {                       /* Europe */
11199          "ZZK",
11200          .bg_channels = 13,
11201          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11202                 {2427, 4}, {2432, 5}, {2437, 6},
11203                 {2442, 7}, {2447, 8}, {2452, 9},
11204                 {2457, 10}, {2462, 11},
11205                 {2467, 12, IEEE80211_CH_PASSIVE_ONLY},
11206                 {2472, 13, IEEE80211_CH_PASSIVE_ONLY}},
11207          .a_channels = 24,
11208          .a = {{5180, 36, IEEE80211_CH_PASSIVE_ONLY},
11209                {5200, 40, IEEE80211_CH_PASSIVE_ONLY},
11210                {5220, 44, IEEE80211_CH_PASSIVE_ONLY},
11211                {5240, 48, IEEE80211_CH_PASSIVE_ONLY},
11212                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
11213                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
11214                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
11215                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
11216                {5500, 100, IEEE80211_CH_PASSIVE_ONLY},
11217                {5520, 104, IEEE80211_CH_PASSIVE_ONLY},
11218                {5540, 108, IEEE80211_CH_PASSIVE_ONLY},
11219                {5560, 112, IEEE80211_CH_PASSIVE_ONLY},
11220                {5580, 116, IEEE80211_CH_PASSIVE_ONLY},
11221                {5600, 120, IEEE80211_CH_PASSIVE_ONLY},
11222                {5620, 124, IEEE80211_CH_PASSIVE_ONLY},
11223                {5640, 128, IEEE80211_CH_PASSIVE_ONLY},
11224                {5660, 132, IEEE80211_CH_PASSIVE_ONLY},
11225                {5680, 136, IEEE80211_CH_PASSIVE_ONLY},
11226                {5700, 140, IEEE80211_CH_PASSIVE_ONLY},
11227                {5745, 149, IEEE80211_CH_PASSIVE_ONLY},
11228                {5765, 153, IEEE80211_CH_PASSIVE_ONLY},
11229                {5785, 157, IEEE80211_CH_PASSIVE_ONLY},
11230                {5805, 161, IEEE80211_CH_PASSIVE_ONLY},
11231                {5825, 165, IEEE80211_CH_PASSIVE_ONLY}},
11232          },
11233
11234         {                       /* Europe */
11235          "ZZL",
11236          .bg_channels = 11,
11237          .bg = {{2412, 1}, {2417, 2}, {2422, 3},
11238                 {2427, 4}, {2432, 5}, {2437, 6},
11239                 {2442, 7}, {2447, 8}, {2452, 9},
11240                 {2457, 10}, {2462, 11}},
11241          .a_channels = 13,
11242          .a = {{5180, 36, IEEE80211_CH_PASSIVE_ONLY},
11243                {5200, 40, IEEE80211_CH_PASSIVE_ONLY},
11244                {5220, 44, IEEE80211_CH_PASSIVE_ONLY},
11245                {5240, 48, IEEE80211_CH_PASSIVE_ONLY},
11246                {5260, 52, IEEE80211_CH_PASSIVE_ONLY},
11247                {5280, 56, IEEE80211_CH_PASSIVE_ONLY},
11248                {5300, 60, IEEE80211_CH_PASSIVE_ONLY},
11249                {5320, 64, IEEE80211_CH_PASSIVE_ONLY},
11250                {5745, 149, IEEE80211_CH_PASSIVE_ONLY},
11251                {5765, 153, IEEE80211_CH_PASSIVE_ONLY},
11252                {5785, 157, IEEE80211_CH_PASSIVE_ONLY},
11253                {5805, 161, IEEE80211_CH_PASSIVE_ONLY},
11254                {5825, 165, IEEE80211_CH_PASSIVE_ONLY}},
11255          }
11256 };
11257
11258 #define MAX_HW_RESTARTS 5
11259 static int ipw_up(struct ipw_priv *priv)
11260 {
11261         int rc, i, j;
11262
11263         if (priv->status & STATUS_EXIT_PENDING)
11264                 return -EIO;
11265
11266         if (cmdlog && !priv->cmdlog) {
11267                 priv->cmdlog = kcalloc(cmdlog, sizeof(*priv->cmdlog),
11268                                        GFP_KERNEL);
11269                 if (priv->cmdlog == NULL) {
11270                         IPW_ERROR("Error allocating %d command log entries.\n",
11271                                   cmdlog);
11272                         return -ENOMEM;
11273                 } else {
11274                         priv->cmdlog_len = cmdlog;
11275                 }
11276         }
11277
11278         for (i = 0; i < MAX_HW_RESTARTS; i++) {
11279                 /* Load the microcode, firmware, and eeprom.
11280                  * Also start the clocks. */
11281                 rc = ipw_load(priv);
11282                 if (rc) {
11283                         IPW_ERROR("Unable to load firmware: %d\n", rc);
11284                         return rc;
11285                 }
11286
11287                 ipw_init_ordinals(priv);
11288                 if (!(priv->config & CFG_CUSTOM_MAC))
11289                         eeprom_parse_mac(priv, priv->mac_addr);
11290                 memcpy(priv->net_dev->dev_addr, priv->mac_addr, ETH_ALEN);
11291
11292                 for (j = 0; j < ARRAY_SIZE(ipw_geos); j++) {
11293                         if (!memcmp(&priv->eeprom[EEPROM_COUNTRY_CODE],
11294                                     ipw_geos[j].name, 3))
11295                                 break;
11296                 }
11297                 if (j == ARRAY_SIZE(ipw_geos)) {
11298                         IPW_WARNING("SKU [%c%c%c] not recognized.\n",
11299                                     priv->eeprom[EEPROM_COUNTRY_CODE + 0],
11300                                     priv->eeprom[EEPROM_COUNTRY_CODE + 1],
11301                                     priv->eeprom[EEPROM_COUNTRY_CODE + 2]);
11302                         j = 0;
11303                 }
11304                 if (ieee80211_set_geo(priv->ieee, &ipw_geos[j])) {
11305                         IPW_WARNING("Could not set geography.");
11306                         return 0;
11307                 }
11308
11309                 if (priv->status & STATUS_RF_KILL_SW) {
11310                         IPW_WARNING("Radio disabled by module parameter.\n");
11311                         return 0;
11312                 } else if (rf_kill_active(priv)) {
11313                         IPW_WARNING("Radio Frequency Kill Switch is On:\n"
11314                                     "Kill switch must be turned off for "
11315                                     "wireless networking to work.\n");
11316                         queue_delayed_work(priv->workqueue, &priv->rf_kill,
11317                                            2 * HZ);
11318                         return 0;
11319                 }
11320
11321                 rc = ipw_config(priv);
11322                 if (!rc) {
11323                         IPW_DEBUG_INFO("Configured device on count %i\n", i);
11324
11325                         /* If configure to try and auto-associate, kick
11326                          * off a scan. */
11327                         queue_delayed_work(priv->workqueue,
11328                                            &priv->request_scan, 0);
11329
11330                         return 0;
11331                 }
11332
11333                 IPW_DEBUG_INFO("Device configuration failed: 0x%08X\n", rc);
11334                 IPW_DEBUG_INFO("Failed to config device on retry %d of %d\n",
11335                                i, MAX_HW_RESTARTS);
11336
11337                 /* We had an error bringing up the hardware, so take it
11338                  * all the way back down so we can try again */
11339                 ipw_down(priv);
11340         }
11341
11342         /* tried to restart and config the device for as long as our
11343          * patience could withstand */
11344         IPW_ERROR("Unable to initialize device after %d attempts.\n", i);
11345
11346         return -EIO;
11347 }
11348
11349 static void ipw_bg_up(struct work_struct *work)
11350 {
11351         struct ipw_priv *priv =
11352                 container_of(work, struct ipw_priv, up);
11353         mutex_lock(&priv->mutex);
11354         ipw_up(priv);
11355         mutex_unlock(&priv->mutex);
11356 }
11357
11358 static void ipw_deinit(struct ipw_priv *priv)
11359 {
11360         int i;
11361
11362         if (priv->status & STATUS_SCANNING) {
11363                 IPW_DEBUG_INFO("Aborting scan during shutdown.\n");
11364                 ipw_abort_scan(priv);
11365         }
11366
11367         if (priv->status & STATUS_ASSOCIATED) {
11368                 IPW_DEBUG_INFO("Disassociating during shutdown.\n");
11369                 ipw_disassociate(priv);
11370         }
11371
11372         ipw_led_shutdown(priv);
11373
11374         /* Wait up to 1s for status to change to not scanning and not
11375          * associated (disassociation can take a while for a ful 802.11
11376          * exchange */
11377         for (i = 1000; i && (priv->status &
11378                              (STATUS_DISASSOCIATING |
11379                               STATUS_ASSOCIATED | STATUS_SCANNING)); i--)
11380                 udelay(10);
11381
11382         if (priv->status & (STATUS_DISASSOCIATING |
11383                             STATUS_ASSOCIATED | STATUS_SCANNING))
11384                 IPW_DEBUG_INFO("Still associated or scanning...\n");
11385         else
11386                 IPW_DEBUG_INFO("Took %dms to de-init\n", 1000 - i);
11387
11388         /* Attempt to disable the card */
11389         ipw_send_card_disable(priv, 0);
11390
11391         priv->status &= ~STATUS_INIT;
11392 }
11393
11394 static void ipw_down(struct ipw_priv *priv)
11395 {
11396         int exit_pending = priv->status & STATUS_EXIT_PENDING;
11397
11398         priv->status |= STATUS_EXIT_PENDING;
11399
11400         if (ipw_is_init(priv))
11401                 ipw_deinit(priv);
11402
11403         /* Wipe out the EXIT_PENDING status bit if we are not actually
11404          * exiting the module */
11405         if (!exit_pending)
11406                 priv->status &= ~STATUS_EXIT_PENDING;
11407
11408         /* tell the device to stop sending interrupts */
11409         ipw_disable_interrupts(priv);
11410
11411         /* Clear all bits but the RF Kill */
11412         priv->status &= STATUS_RF_KILL_MASK | STATUS_EXIT_PENDING;
11413         netif_carrier_off(priv->net_dev);
11414         netif_stop_queue(priv->net_dev);
11415
11416         ipw_stop_nic(priv);
11417
11418         ipw_led_radio_off(priv);
11419 }
11420
11421 static void ipw_bg_down(struct work_struct *work)
11422 {
11423         struct ipw_priv *priv =
11424                 container_of(work, struct ipw_priv, down);
11425         mutex_lock(&priv->mutex);
11426         ipw_down(priv);
11427         mutex_unlock(&priv->mutex);
11428 }
11429
11430 /* Called by register_netdev() */
11431 static int ipw_net_init(struct net_device *dev)
11432 {
11433         struct ipw_priv *priv = ieee80211_priv(dev);
11434         mutex_lock(&priv->mutex);
11435
11436         if (ipw_up(priv)) {
11437                 mutex_unlock(&priv->mutex);
11438                 return -EIO;
11439         }
11440
11441         mutex_unlock(&priv->mutex);
11442         return 0;
11443 }
11444
11445 /* PCI driver stuff */
11446 static struct pci_device_id card_ids[] = {
11447         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2701, 0, 0, 0},
11448         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2702, 0, 0, 0},
11449         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2711, 0, 0, 0},
11450         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2712, 0, 0, 0},
11451         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2721, 0, 0, 0},
11452         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2722, 0, 0, 0},
11453         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2731, 0, 0, 0},
11454         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2732, 0, 0, 0},
11455         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2741, 0, 0, 0},
11456         {PCI_VENDOR_ID_INTEL, 0x1043, 0x103c, 0x2741, 0, 0, 0},
11457         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2742, 0, 0, 0},
11458         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2751, 0, 0, 0},
11459         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2752, 0, 0, 0},
11460         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2753, 0, 0, 0},
11461         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2754, 0, 0, 0},
11462         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2761, 0, 0, 0},
11463         {PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2762, 0, 0, 0},
11464         {PCI_VENDOR_ID_INTEL, 0x104f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
11465         {PCI_VENDOR_ID_INTEL, 0x4220, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* BG */
11466         {PCI_VENDOR_ID_INTEL, 0x4221, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* BG */
11467         {PCI_VENDOR_ID_INTEL, 0x4223, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* ABG */
11468         {PCI_VENDOR_ID_INTEL, 0x4224, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* ABG */
11469
11470         /* required last entry */
11471         {0,}
11472 };
11473
11474 MODULE_DEVICE_TABLE(pci, card_ids);
11475
11476 static struct attribute *ipw_sysfs_entries[] = {
11477         &dev_attr_rf_kill.attr,
11478         &dev_attr_direct_dword.attr,
11479         &dev_attr_indirect_byte.attr,
11480         &dev_attr_indirect_dword.attr,
11481         &dev_attr_mem_gpio_reg.attr,
11482         &dev_attr_command_event_reg.attr,
11483         &dev_attr_nic_type.attr,
11484         &dev_attr_status.attr,
11485         &dev_attr_cfg.attr,
11486         &dev_attr_error.attr,
11487         &dev_attr_event_log.attr,
11488         &dev_attr_cmd_log.attr,
11489         &dev_attr_eeprom_delay.attr,
11490         &dev_attr_ucode_version.attr,
11491         &dev_attr_rtc.attr,
11492         &dev_attr_scan_age.attr,
11493         &dev_attr_led.attr,
11494         &dev_attr_speed_scan.attr,
11495         &dev_attr_net_stats.attr,
11496         &dev_attr_channels.attr,
11497 #ifdef CONFIG_IPW2200_PROMISCUOUS
11498         &dev_attr_rtap_iface.attr,
11499         &dev_attr_rtap_filter.attr,
11500 #endif
11501         NULL
11502 };
11503
11504 static struct attribute_group ipw_attribute_group = {
11505         .name = NULL,           /* put in device directory */
11506         .attrs = ipw_sysfs_entries,
11507 };
11508
11509 #ifdef CONFIG_IPW2200_PROMISCUOUS
11510 static int ipw_prom_open(struct net_device *dev)
11511 {
11512         struct ipw_prom_priv *prom_priv = ieee80211_priv(dev);
11513         struct ipw_priv *priv = prom_priv->priv;
11514
11515         IPW_DEBUG_INFO("prom dev->open\n");
11516         netif_carrier_off(dev);
11517         netif_stop_queue(dev);
11518
11519         if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
11520                 priv->sys_config.accept_all_data_frames = 1;
11521                 priv->sys_config.accept_non_directed_frames = 1;
11522                 priv->sys_config.accept_all_mgmt_bcpr = 1;
11523                 priv->sys_config.accept_all_mgmt_frames = 1;
11524
11525                 ipw_send_system_config(priv);
11526         }
11527
11528         return 0;
11529 }
11530
11531 static int ipw_prom_stop(struct net_device *dev)
11532 {
11533         struct ipw_prom_priv *prom_priv = ieee80211_priv(dev);
11534         struct ipw_priv *priv = prom_priv->priv;
11535
11536         IPW_DEBUG_INFO("prom dev->stop\n");
11537
11538         if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
11539                 priv->sys_config.accept_all_data_frames = 0;
11540                 priv->sys_config.accept_non_directed_frames = 0;
11541                 priv->sys_config.accept_all_mgmt_bcpr = 0;
11542                 priv->sys_config.accept_all_mgmt_frames = 0;
11543
11544                 ipw_send_system_config(priv);
11545         }
11546
11547         return 0;
11548 }
11549
11550 static int ipw_prom_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
11551 {
11552         IPW_DEBUG_INFO("prom dev->xmit\n");
11553         netif_stop_queue(dev);
11554         return -EOPNOTSUPP;
11555 }
11556
11557 static struct net_device_stats *ipw_prom_get_stats(struct net_device *dev)
11558 {
11559         struct ipw_prom_priv *prom_priv = ieee80211_priv(dev);
11560         return &prom_priv->ieee->stats;
11561 }
11562
11563 static int ipw_prom_alloc(struct ipw_priv *priv)
11564 {
11565         int rc = 0;
11566
11567         if (priv->prom_net_dev)
11568                 return -EPERM;
11569
11570         priv->prom_net_dev = alloc_ieee80211(sizeof(struct ipw_prom_priv));
11571         if (priv->prom_net_dev == NULL)
11572                 return -ENOMEM;
11573
11574         priv->prom_priv = ieee80211_priv(priv->prom_net_dev);
11575         priv->prom_priv->ieee = netdev_priv(priv->prom_net_dev);
11576         priv->prom_priv->priv = priv;
11577
11578         strcpy(priv->prom_net_dev->name, "rtap%d");
11579
11580         priv->prom_net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
11581         priv->prom_net_dev->open = ipw_prom_open;
11582         priv->prom_net_dev->stop = ipw_prom_stop;
11583         priv->prom_net_dev->get_stats = ipw_prom_get_stats;
11584         priv->prom_net_dev->hard_start_xmit = ipw_prom_hard_start_xmit;
11585
11586         priv->prom_priv->ieee->iw_mode = IW_MODE_MONITOR;
11587
11588         rc = register_netdev(priv->prom_net_dev);
11589         if (rc) {
11590                 free_ieee80211(priv->prom_net_dev);
11591                 priv->prom_net_dev = NULL;
11592                 return rc;
11593         }
11594
11595         return 0;
11596 }
11597
11598 static void ipw_prom_free(struct ipw_priv *priv)
11599 {
11600         if (!priv->prom_net_dev)
11601                 return;
11602
11603         unregister_netdev(priv->prom_net_dev);
11604         free_ieee80211(priv->prom_net_dev);
11605
11606         priv->prom_net_dev = NULL;
11607 }
11608
11609 #endif
11610
11611
11612 static int __devinit ipw_pci_probe(struct pci_dev *pdev,
11613                                    const struct pci_device_id *ent)
11614 {
11615         int err = 0;
11616         struct net_device *net_dev;
11617         void __iomem *base;
11618         u32 length, val;
11619         struct ipw_priv *priv;
11620         int i;
11621
11622         net_dev = alloc_ieee80211(sizeof(struct ipw_priv));
11623         if (net_dev == NULL) {
11624                 err = -ENOMEM;
11625                 goto out;
11626         }
11627
11628         priv = ieee80211_priv(net_dev);
11629         priv->ieee = netdev_priv(net_dev);
11630
11631         priv->net_dev = net_dev;
11632         priv->pci_dev = pdev;
11633         ipw_debug_level = debug;
11634         spin_lock_init(&priv->irq_lock);
11635         spin_lock_init(&priv->lock);
11636         for (i = 0; i < IPW_IBSS_MAC_HASH_SIZE; i++)
11637                 INIT_LIST_HEAD(&priv->ibss_mac_hash[i]);
11638
11639         mutex_init(&priv->mutex);
11640         if (pci_enable_device(pdev)) {
11641                 err = -ENODEV;
11642                 goto out_free_ieee80211;
11643         }
11644
11645         pci_set_master(pdev);
11646
11647         err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
11648         if (!err)
11649                 err = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
11650         if (err) {
11651                 printk(KERN_WARNING DRV_NAME ": No suitable DMA available.\n");
11652                 goto out_pci_disable_device;
11653         }
11654
11655         pci_set_drvdata(pdev, priv);
11656
11657         err = pci_request_regions(pdev, DRV_NAME);
11658         if (err)
11659                 goto out_pci_disable_device;
11660
11661         /* We disable the RETRY_TIMEOUT register (0x41) to keep
11662          * PCI Tx retries from interfering with C3 CPU state */
11663         pci_read_config_dword(pdev, 0x40, &val);
11664         if ((val & 0x0000ff00) != 0)
11665                 pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
11666
11667         length = pci_resource_len(pdev, 0);
11668         priv->hw_len = length;
11669
11670         base = ioremap_nocache(pci_resource_start(pdev, 0), length);
11671         if (!base) {
11672                 err = -ENODEV;
11673                 goto out_pci_release_regions;
11674         }
11675
11676         priv->hw_base = base;
11677         IPW_DEBUG_INFO("pci_resource_len = 0x%08x\n", length);
11678         IPW_DEBUG_INFO("pci_resource_base = %p\n", base);
11679
11680         err = ipw_setup_deferred_work(priv);
11681         if (err) {
11682                 IPW_ERROR("Unable to setup deferred work\n");
11683                 goto out_iounmap;
11684         }
11685
11686         ipw_sw_reset(priv, 1);
11687
11688         err = request_irq(pdev->irq, ipw_isr, IRQF_SHARED, DRV_NAME, priv);
11689         if (err) {
11690                 IPW_ERROR("Error allocating IRQ %d\n", pdev->irq);
11691                 goto out_destroy_workqueue;
11692         }
11693
11694         SET_NETDEV_DEV(net_dev, &pdev->dev);
11695
11696         mutex_lock(&priv->mutex);
11697
11698         priv->ieee->hard_start_xmit = ipw_net_hard_start_xmit;
11699         priv->ieee->set_security = shim__set_security;
11700         priv->ieee->is_queue_full = ipw_net_is_queue_full;
11701
11702 #ifdef CONFIG_IPW2200_QOS
11703         priv->ieee->is_qos_active = ipw_is_qos_active;
11704         priv->ieee->handle_probe_response = ipw_handle_beacon;
11705         priv->ieee->handle_beacon = ipw_handle_probe_response;
11706         priv->ieee->handle_assoc_response = ipw_handle_assoc_response;
11707 #endif                          /* CONFIG_IPW2200_QOS */
11708
11709         priv->ieee->perfect_rssi = -20;
11710         priv->ieee->worst_rssi = -85;
11711
11712         net_dev->open = ipw_net_open;
11713         net_dev->stop = ipw_net_stop;
11714         net_dev->init = ipw_net_init;
11715         net_dev->get_stats = ipw_net_get_stats;
11716         net_dev->set_multicast_list = ipw_net_set_multicast_list;
11717         net_dev->set_mac_address = ipw_net_set_mac_address;
11718         priv->wireless_data.spy_data = &priv->ieee->spy_data;
11719         net_dev->wireless_data = &priv->wireless_data;
11720         net_dev->wireless_handlers = &ipw_wx_handler_def;
11721         net_dev->ethtool_ops = &ipw_ethtool_ops;
11722         net_dev->irq = pdev->irq;
11723         net_dev->base_addr = (unsigned long)priv->hw_base;
11724         net_dev->mem_start = pci_resource_start(pdev, 0);
11725         net_dev->mem_end = net_dev->mem_start + pci_resource_len(pdev, 0) - 1;
11726
11727         err = sysfs_create_group(&pdev->dev.kobj, &ipw_attribute_group);
11728         if (err) {
11729                 IPW_ERROR("failed to create sysfs device attributes\n");
11730                 mutex_unlock(&priv->mutex);
11731                 goto out_release_irq;
11732         }
11733
11734         mutex_unlock(&priv->mutex);
11735         err = register_netdev(net_dev);
11736         if (err) {
11737                 IPW_ERROR("failed to register network device\n");
11738                 goto out_remove_sysfs;
11739         }
11740
11741 #ifdef CONFIG_IPW2200_PROMISCUOUS
11742         if (rtap_iface) {
11743                 err = ipw_prom_alloc(priv);
11744                 if (err) {
11745                         IPW_ERROR("Failed to register promiscuous network "
11746                                   "device (error %d).\n", err);
11747                         unregister_netdev(priv->net_dev);
11748                         goto out_remove_sysfs;
11749                 }
11750         }
11751 #endif
11752
11753         printk(KERN_INFO DRV_NAME ": Detected geography %s (%d 802.11bg "
11754                "channels, %d 802.11a channels)\n",
11755                priv->ieee->geo.name, priv->ieee->geo.bg_channels,
11756                priv->ieee->geo.a_channels);
11757
11758         return 0;
11759
11760       out_remove_sysfs:
11761         sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
11762       out_release_irq:
11763         free_irq(pdev->irq, priv);
11764       out_destroy_workqueue:
11765         destroy_workqueue(priv->workqueue);
11766         priv->workqueue = NULL;
11767       out_iounmap:
11768         iounmap(priv->hw_base);
11769       out_pci_release_regions:
11770         pci_release_regions(pdev);
11771       out_pci_disable_device:
11772         pci_disable_device(pdev);
11773         pci_set_drvdata(pdev, NULL);
11774       out_free_ieee80211:
11775         free_ieee80211(priv->net_dev);
11776       out:
11777         return err;
11778 }
11779
11780 static void __devexit ipw_pci_remove(struct pci_dev *pdev)
11781 {
11782         struct ipw_priv *priv = pci_get_drvdata(pdev);
11783         struct list_head *p, *q;
11784         int i;
11785
11786         if (!priv)
11787                 return;
11788
11789         mutex_lock(&priv->mutex);
11790
11791         priv->status |= STATUS_EXIT_PENDING;
11792         ipw_down(priv);
11793         sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
11794
11795         mutex_unlock(&priv->mutex);
11796
11797         unregister_netdev(priv->net_dev);
11798
11799         if (priv->rxq) {
11800                 ipw_rx_queue_free(priv, priv->rxq);
11801                 priv->rxq = NULL;
11802         }
11803         ipw_tx_queue_free(priv);
11804
11805         if (priv->cmdlog) {
11806                 kfree(priv->cmdlog);
11807                 priv->cmdlog = NULL;
11808         }
11809         /* ipw_down will ensure that there is no more pending work
11810          * in the workqueue's, so we can safely remove them now. */
11811         cancel_delayed_work(&priv->adhoc_check);
11812         cancel_delayed_work(&priv->gather_stats);
11813         cancel_delayed_work(&priv->request_scan);
11814         cancel_delayed_work(&priv->scan_event);
11815         cancel_delayed_work(&priv->rf_kill);
11816         cancel_delayed_work(&priv->scan_check);
11817         destroy_workqueue(priv->workqueue);
11818         priv->workqueue = NULL;
11819
11820         /* Free MAC hash list for ADHOC */
11821         for (i = 0; i < IPW_IBSS_MAC_HASH_SIZE; i++) {
11822                 list_for_each_safe(p, q, &priv->ibss_mac_hash[i]) {
11823                         list_del(p);
11824                         kfree(list_entry(p, struct ipw_ibss_seq, list));
11825                 }
11826         }
11827
11828         kfree(priv->error);
11829         priv->error = NULL;
11830
11831 #ifdef CONFIG_IPW2200_PROMISCUOUS
11832         ipw_prom_free(priv);
11833 #endif
11834
11835         free_irq(pdev->irq, priv);
11836         iounmap(priv->hw_base);
11837         pci_release_regions(pdev);
11838         pci_disable_device(pdev);
11839         pci_set_drvdata(pdev, NULL);
11840         free_ieee80211(priv->net_dev);
11841         free_firmware();
11842 }
11843
11844 #ifdef CONFIG_PM
11845 static int ipw_pci_suspend(struct pci_dev *pdev, pm_message_t state)
11846 {
11847         struct ipw_priv *priv = pci_get_drvdata(pdev);
11848         struct net_device *dev = priv->net_dev;
11849
11850         printk(KERN_INFO "%s: Going into suspend...\n", dev->name);
11851
11852         /* Take down the device; powers it off, etc. */
11853         ipw_down(priv);
11854
11855         /* Remove the PRESENT state of the device */
11856         netif_device_detach(dev);
11857
11858         pci_save_state(pdev);
11859         pci_disable_device(pdev);
11860         pci_set_power_state(pdev, pci_choose_state(pdev, state));
11861
11862         return 0;
11863 }
11864
11865 static int ipw_pci_resume(struct pci_dev *pdev)
11866 {
11867         struct ipw_priv *priv = pci_get_drvdata(pdev);
11868         struct net_device *dev = priv->net_dev;
11869         int err;
11870         u32 val;
11871
11872         printk(KERN_INFO "%s: Coming out of suspend...\n", dev->name);
11873
11874         pci_set_power_state(pdev, PCI_D0);
11875         err = pci_enable_device(pdev);
11876         if (err) {
11877                 printk(KERN_ERR "%s: pci_enable_device failed on resume\n",
11878                        dev->name);
11879                 return err;
11880         }
11881         pci_restore_state(pdev);
11882
11883         /*
11884          * Suspend/Resume resets the PCI configuration space, so we have to
11885          * re-disable the RETRY_TIMEOUT register (0x41) to keep PCI Tx retries
11886          * from interfering with C3 CPU state. pci_restore_state won't help
11887          * here since it only restores the first 64 bytes pci config header.
11888          */
11889         pci_read_config_dword(pdev, 0x40, &val);
11890         if ((val & 0x0000ff00) != 0)
11891                 pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
11892
11893         /* Set the device back into the PRESENT state; this will also wake
11894          * the queue of needed */
11895         netif_device_attach(dev);
11896
11897         /* Bring the device back up */
11898         queue_work(priv->workqueue, &priv->up);
11899
11900         return 0;
11901 }
11902 #endif
11903
11904 static void ipw_pci_shutdown(struct pci_dev *pdev)
11905 {
11906         struct ipw_priv *priv = pci_get_drvdata(pdev);
11907
11908         /* Take down the device; powers it off, etc. */
11909         ipw_down(priv);
11910
11911         pci_disable_device(pdev);
11912 }
11913
11914 /* driver initialization stuff */
11915 static struct pci_driver ipw_driver = {
11916         .name = DRV_NAME,
11917         .id_table = card_ids,
11918         .probe = ipw_pci_probe,
11919         .remove = __devexit_p(ipw_pci_remove),
11920 #ifdef CONFIG_PM
11921         .suspend = ipw_pci_suspend,
11922         .resume = ipw_pci_resume,
11923 #endif
11924         .shutdown = ipw_pci_shutdown,
11925 };
11926
11927 static int __init ipw_init(void)
11928 {
11929         int ret;
11930
11931         printk(KERN_INFO DRV_NAME ": " DRV_DESCRIPTION ", " DRV_VERSION "\n");
11932         printk(KERN_INFO DRV_NAME ": " DRV_COPYRIGHT "\n");
11933
11934         ret = pci_register_driver(&ipw_driver);
11935         if (ret) {
11936                 IPW_ERROR("Unable to initialize PCI module\n");
11937                 return ret;
11938         }
11939
11940         ret = driver_create_file(&ipw_driver.driver, &driver_attr_debug_level);
11941         if (ret) {
11942                 IPW_ERROR("Unable to create driver sysfs file\n");
11943                 pci_unregister_driver(&ipw_driver);
11944                 return ret;
11945         }
11946
11947         return ret;
11948 }
11949
11950 static void __exit ipw_exit(void)
11951 {
11952         driver_remove_file(&ipw_driver.driver, &driver_attr_debug_level);
11953         pci_unregister_driver(&ipw_driver);
11954 }
11955
11956 module_param(disable, int, 0444);
11957 MODULE_PARM_DESC(disable, "manually disable the radio (default 0 [radio on])");
11958
11959 module_param(associate, int, 0444);
11960 MODULE_PARM_DESC(associate, "auto associate when scanning (default on)");
11961
11962 module_param(auto_create, int, 0444);
11963 MODULE_PARM_DESC(auto_create, "auto create adhoc network (default on)");
11964
11965 module_param(led, int, 0444);
11966 MODULE_PARM_DESC(led, "enable led control on some systems (default 0 off)\n");
11967
11968 module_param(debug, int, 0444);
11969 MODULE_PARM_DESC(debug, "debug output mask");
11970
11971 module_param(channel, int, 0444);
11972 MODULE_PARM_DESC(channel, "channel to limit associate to (default 0 [ANY])");
11973
11974 #ifdef CONFIG_IPW2200_PROMISCUOUS
11975 module_param(rtap_iface, int, 0444);
11976 MODULE_PARM_DESC(rtap_iface, "create the rtap interface (1 - create, default 0)");
11977 #endif
11978
11979 #ifdef CONFIG_IPW2200_QOS
11980 module_param(qos_enable, int, 0444);
11981 MODULE_PARM_DESC(qos_enable, "enable all QoS functionalitis");
11982
11983 module_param(qos_burst_enable, int, 0444);
11984 MODULE_PARM_DESC(qos_burst_enable, "enable QoS burst mode");
11985
11986 module_param(qos_no_ack_mask, int, 0444);
11987 MODULE_PARM_DESC(qos_no_ack_mask, "mask Tx_Queue to no ack");
11988
11989 module_param(burst_duration_CCK, int, 0444);
11990 MODULE_PARM_DESC(burst_duration_CCK, "set CCK burst value");
11991
11992 module_param(burst_duration_OFDM, int, 0444);
11993 MODULE_PARM_DESC(burst_duration_OFDM, "set OFDM burst value");
11994 #endif                          /* CONFIG_IPW2200_QOS */
11995
11996 #ifdef CONFIG_IPW2200_MONITOR
11997 module_param(mode, int, 0444);
11998 MODULE_PARM_DESC(mode, "network mode (0=BSS,1=IBSS,2=Monitor)");
11999 #else
12000 module_param(mode, int, 0444);
12001 MODULE_PARM_DESC(mode, "network mode (0=BSS,1=IBSS)");
12002 #endif
12003
12004 module_param(bt_coexist, int, 0444);
12005 MODULE_PARM_DESC(bt_coexist, "enable bluetooth coexistence (default off)");
12006
12007 module_param(hwcrypto, int, 0444);
12008 MODULE_PARM_DESC(hwcrypto, "enable hardware crypto (default off)");
12009
12010 module_param(cmdlog, int, 0444);
12011 MODULE_PARM_DESC(cmdlog,
12012                  "allocate a ring buffer for logging firmware commands");
12013
12014 module_param(roaming, int, 0444);
12015 MODULE_PARM_DESC(roaming, "enable roaming support (default on)");
12016
12017 module_param(antenna, int, 0444);
12018 MODULE_PARM_DESC(antenna, "select antenna 1=Main, 3=Aux, default 0 [both], 2=slow_diversity (choose the one with lower background noise)");
12019
12020 module_exit(ipw_exit);
12021 module_init(ipw_init);