SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/net/wireless/ath/ar9170/main.c

   1 /*
   2  * Atheros AR9170 driver
   3  *
   4  * mac80211 interaction code
   5  *
   6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright 2009, Christian Lamparter <chunkeey@web.de>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; see the file COPYING.  If not, see
  21  * http://www.gnu.org/licenses/.
  22  *
  23  * This file incorporates work covered by the following copyright and
  24  * permission notice:
  25  *    Copyright (c) 2007-2008 Atheros Communications, Inc.
  26  *
  27  *    Permission to use, copy, modify, and/or distribute this software for any
  28  *    purpose with or without fee is hereby granted, provided that the above
  29  *    copyright notice and this permission notice appear in all copies.
  30  *
  31  *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  32  *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  33  *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  34  *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  35  *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  36  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  37  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  38  */
  39
  40 #include <linux/init.h>
  41 #include <linux/module.h>
  42 #include <linux/etherdevice.h>
  43 #include <net/mac80211.h>
  44 #include "ar9170.h"
  45 #include "hw.h"
  46 #include "cmd.h"
  47
  48 static int modparam_nohwcrypt;
  49 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
  50 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  51
  52 #define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
  53         .bitrate        = (_bitrate),                   \
  54         .flags          = (_flags),                     \
  55         .hw_value       = (_hw_rate) | (_txpidx) << 4,  \
  56 }
  57
  58 static struct ieee80211_rate __ar9170_ratetable[] = {
  59         RATE(10, 0, 0, 0),
  60         RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
  61         RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
  62         RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
  63         RATE(60, 0xb, 0, 0),
  64         RATE(90, 0xf, 0, 0),
  65         RATE(120, 0xa, 0, 0),
  66         RATE(180, 0xe, 0, 0),
  67         RATE(240, 0x9, 0, 0),
  68         RATE(360, 0xd, 1, 0),
  69         RATE(480, 0x8, 2, 0),
  70         RATE(540, 0xc, 3, 0),
  71 };
  72 #undef RATE
  73
  74 #define ar9170_g_ratetable      (__ar9170_ratetable + 0)
  75 #define ar9170_g_ratetable_size 12
  76 #define ar9170_a_ratetable      (__ar9170_ratetable + 4)
  77 #define ar9170_a_ratetable_size 8
  78
  79 /*
  80  * NB: The hw_value is used as an index into the ar9170_phy_freq_params
  81  *     array in phy.c so that we don't have to do frequency lookups!
  82  */
  83 #define CHAN(_freq, _idx) {             \
  84         .center_freq    = (_freq),      \
  85         .hw_value       = (_idx),       \
  86         .max_power      = 18, /* XXX */ \
  87 }
  88
  89 static struct ieee80211_channel ar9170_2ghz_chantable[] = {
  90         CHAN(2412,  0),
  91         CHAN(2417,  1),
  92         CHAN(2422,  2),
  93         CHAN(2427,  3),
  94         CHAN(2432,  4),
  95         CHAN(2437,  5),
  96         CHAN(2442,  6),
  97         CHAN(2447,  7),
  98         CHAN(2452,  8),
  99         CHAN(2457,  9),
 100         CHAN(2462, 10),
 101         CHAN(2467, 11),
 102         CHAN(2472, 12),
 103         CHAN(2484, 13),
 104 };
 105
 106 static struct ieee80211_channel ar9170_5ghz_chantable[] = {
 107         CHAN(4920, 14),
 108         CHAN(4940, 15),
 109         CHAN(4960, 16),
 110         CHAN(4980, 17),
 111         CHAN(5040, 18),
 112         CHAN(5060, 19),
 113         CHAN(5080, 20),
 114         CHAN(5180, 21),
 115         CHAN(5200, 22),
 116         CHAN(5220, 23),
 117         CHAN(5240, 24),
 118         CHAN(5260, 25),
 119         CHAN(5280, 26),
 120         CHAN(5300, 27),
 121         CHAN(5320, 28),
 122         CHAN(5500, 29),
 123         CHAN(5520, 30),
 124         CHAN(5540, 31),
 125         CHAN(5560, 32),
 126         CHAN(5580, 33),
 127         CHAN(5600, 34),
 128         CHAN(5620, 35),
 129         CHAN(5640, 36),
 130         CHAN(5660, 37),
 131         CHAN(5680, 38),
 132         CHAN(5700, 39),
 133         CHAN(5745, 40),
 134         CHAN(5765, 41),
 135         CHAN(5785, 42),
 136         CHAN(5805, 43),
 137         CHAN(5825, 44),
 138         CHAN(5170, 45),
 139         CHAN(5190, 46),
 140         CHAN(5210, 47),
 141         CHAN(5230, 48),
 142 };
 143 #undef CHAN
 144
 145 #define AR9170_HT_CAP                                                   \
 146 {                                                                       \
 147         .ht_supported   = true,                                         \
 148         .cap            = IEEE80211_HT_CAP_MAX_AMSDU |                  \
 149                           IEEE80211_HT_CAP_SUP_WIDTH_20_40 |            \
 150                           IEEE80211_HT_CAP_SGI_40 |                     \
 151                           IEEE80211_HT_CAP_DSSSCCK40 |                  \
 152                           IEEE80211_HT_CAP_SM_PS,                       \
 153         .ampdu_factor   = 3,                                            \
 154         .ampdu_density  = 6,                                            \
 155         .mcs            = {                                             \
 156                 .rx_mask = { 0xFF, 0xFF, 0, 0, 0, 0, 0, 0, 0, 0, },     \
 157         },                                                              \
 158 }
 159
 160 static struct ieee80211_supported_band ar9170_band_2GHz = {
 161         .channels       = ar9170_2ghz_chantable,
 162         .n_channels     = ARRAY_SIZE(ar9170_2ghz_chantable),
 163         .bitrates       = ar9170_g_ratetable,
 164         .n_bitrates     = ar9170_g_ratetable_size,
 165         .ht_cap         = AR9170_HT_CAP,
 166 };
 167
 168 static struct ieee80211_supported_band ar9170_band_5GHz = {
 169         .channels       = ar9170_5ghz_chantable,
 170         .n_channels     = ARRAY_SIZE(ar9170_5ghz_chantable),
 171         .bitrates       = ar9170_a_ratetable,
 172         .n_bitrates     = ar9170_a_ratetable_size,
 173         .ht_cap         = AR9170_HT_CAP,
 174 };
 175
 176 #ifdef AR9170_QUEUE_DEBUG
 177 /*
 178  * In case some wants works with AR9170's crazy tx_status queueing techniques.
 179  * He might need this rather useful probing function.
 180  *
 181  * NOTE: caller must hold the queue's spinlock!
 182  */
 183
 184 static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
 185 {
 186         struct ar9170_tx_control *txc = (void *) skb->data;
 187         struct ieee80211_hdr *hdr = (void *)txc->frame_data;
 188
 189         printk(KERN_DEBUG "%s: => FRAME [skb:%p, queue:%d, DA:[%pM] "
 190                           "mac_control:%04x, phy_control:%08x]\n",
 191                wiphy_name(ar->hw->wiphy), skb, skb_get_queue_mapping(skb),
 192                ieee80211_get_DA(hdr), le16_to_cpu(txc->mac_control),
 193                le32_to_cpu(txc->phy_control));
 194 }
 195
 196 static void ar9170_dump_station_tx_status_queue(struct ar9170 *ar,
 197                                                 struct sk_buff_head *queue)
 198 {
 199         struct sk_buff *skb;
 200         int i = 0;
 201
 202         printk(KERN_DEBUG "---[ cut here ]---\n");
 203         printk(KERN_DEBUG "%s: %d entries in tx_status queue.\n",
 204                wiphy_name(ar->hw->wiphy), skb_queue_len(queue));
 205
 206         skb_queue_walk(queue, skb) {
 207                 struct ar9170_tx_control *txc = (void *) skb->data;
 208                 struct ieee80211_hdr *hdr = (void *)txc->frame_data;
 209
 210                 printk(KERN_DEBUG "index:%d => \n", i);
 211                 ar9170_print_txheader(ar, skb);
 212         }
 213         printk(KERN_DEBUG "---[ end ]---\n");
 214 }
 215 #endif /* AR9170_QUEUE_DEBUG */
 216
 217 void ar9170_handle_tx_status(struct ar9170 *ar, struct sk_buff *skb,
 218                              bool valid_status, u16 tx_status)
 219 {
 220         struct ieee80211_tx_info *txinfo;
 221         unsigned int retries = 0, queue = skb_get_queue_mapping(skb);
 222         unsigned long flags;
 223
 224         spin_lock_irqsave(&ar->tx_stats_lock, flags);
 225         ar->tx_stats[queue].len--;
 226         if (ieee80211_queue_stopped(ar->hw, queue))
 227                 ieee80211_wake_queue(ar->hw, queue);
 228         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 229
 230         txinfo = IEEE80211_SKB_CB(skb);
 231         ieee80211_tx_info_clear_status(txinfo);
 232
 233         switch (tx_status) {
 234         case AR9170_TX_STATUS_RETRY:
 235                 retries = 2;
 236         case AR9170_TX_STATUS_COMPLETE:
 237                 txinfo->flags |= IEEE80211_TX_STAT_ACK;
 238                 break;
 239
 240         case AR9170_TX_STATUS_FAILED:
 241                 retries = ar->hw->conf.long_frame_max_tx_count;
 242                 break;
 243
 244         default:
 245                 printk(KERN_ERR "%s: invalid tx_status response (%x).\n",
 246                        wiphy_name(ar->hw->wiphy), tx_status);
 247                 break;
 248         }
 249
 250         if (valid_status)
 251                 txinfo->status.rates[0].count = retries + 1;
 252
 253         skb_pull(skb, sizeof(struct ar9170_tx_control));
 254         ieee80211_tx_status_irqsafe(ar->hw, skb);
 255 }
 256
 257 static struct sk_buff *ar9170_find_skb_in_queue(struct ar9170 *ar,
 258                                                 const u8 *mac,
 259                                                 const u32 queue,
 260                                                 struct sk_buff_head *q)
 261 {
 262         unsigned long flags;
 263         struct sk_buff *skb;
 264
 265         spin_lock_irqsave(&q->lock, flags);
 266         skb_queue_walk(q, skb) {
 267                 struct ar9170_tx_control *txc = (void *) skb->data;
 268                 struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 269                 u32 txc_queue = (le32_to_cpu(txc->phy_control) &
 270                                 AR9170_TX_PHY_QOS_MASK) >>
 271                                 AR9170_TX_PHY_QOS_SHIFT;
 272
 273                 if  ((queue != txc_queue) ||
 274                      (compare_ether_addr(ieee80211_get_DA(hdr), mac)))
 275                         continue;
 276
 277                 __skb_unlink(skb, q);
 278                 spin_unlock_irqrestore(&q->lock, flags);
 279                 return skb;
 280         }
 281         spin_unlock_irqrestore(&q->lock, flags);
 282         return NULL;
 283 }
 284
 285 static struct sk_buff *ar9170_find_queued_skb(struct ar9170 *ar, const u8 *mac,
 286                                               const u32 queue)
 287 {
 288         struct ieee80211_sta *sta;
 289         struct sk_buff *skb;
 290
 291         /*
 292          * Unfortunately, the firmware does not tell to which (queued) frame
 293          * this transmission status report belongs to.
 294          *
 295          * So we have to make risky guesses - with the scarce information
 296          * the firmware provided (-> destination MAC, and phy_control) -
 297          * and hope that we picked the right one...
 298          */
 299         rcu_read_lock();
 300         sta = ieee80211_find_sta(ar->hw, mac);
 301
 302         if (likely(sta)) {
 303                 struct ar9170_sta_info *sta_priv = (void *) sta->drv_priv;
 304                 skb = skb_dequeue(&sta_priv->tx_status[queue]);
 305                 rcu_read_unlock();
 306                 if (likely(skb))
 307                         return skb;
 308         } else
 309                 rcu_read_unlock();
 310
 311         /* scan the waste queue for candidates */
 312         skb = ar9170_find_skb_in_queue(ar, mac, queue,
 313                                        &ar->global_tx_status_waste);
 314         if (!skb) {
 315                 /* so it still _must_ be in the global list. */
 316                 skb = ar9170_find_skb_in_queue(ar, mac, queue,
 317                                                &ar->global_tx_status);
 318         }
 319
 320 #ifdef AR9170_QUEUE_DEBUG
 321         if (unlikely((!skb) && net_ratelimit())) {
 322                 printk(KERN_ERR "%s: ESS:[%pM] does not have any "
 323                                 "outstanding frames in this queue (%d).\n",
 324                                 wiphy_name(ar->hw->wiphy), mac, queue);
 325         }
 326 #endif /* AR9170_QUEUE_DEBUG */
 327         return skb;
 328 }
 329
 330 /*
 331  * This worker tries to keep the global tx_status queue empty.
 332  * So we can guarantee that incoming tx_status reports for
 333  * unregistered stations are always synced with the actual
 334  * frame - which we think - belongs to.
 335  */
 336
 337 static void ar9170_tx_status_janitor(struct work_struct *work)
 338 {
 339         struct ar9170 *ar = container_of(work, struct ar9170,
 340                                          tx_status_janitor.work);
 341         struct sk_buff *skb;
 342
 343         if (unlikely(!IS_STARTED(ar)))
 344                 return ;
 345
 346         /* recycle the garbage back to mac80211... one by one. */
 347         while ((skb = skb_dequeue(&ar->global_tx_status_waste))) {
 348 #ifdef AR9170_QUEUE_DEBUG
 349                 printk(KERN_DEBUG "%s: dispose queued frame =>\n",
 350                        wiphy_name(ar->hw->wiphy));
 351                 ar9170_print_txheader(ar, skb);
 352 #endif /* AR9170_QUEUE_DEBUG */
 353                 ar9170_handle_tx_status(ar, skb, false,
 354                                         AR9170_TX_STATUS_FAILED);
 355         }
 356
 357         while ((skb = skb_dequeue(&ar->global_tx_status))) {
 358 #ifdef AR9170_QUEUE_DEBUG
 359                 printk(KERN_DEBUG "%s: moving frame into waste queue =>\n",
 360                        wiphy_name(ar->hw->wiphy));
 361
 362                 ar9170_print_txheader(ar, skb);
 363 #endif /* AR9170_QUEUE_DEBUG */
 364                 skb_queue_tail(&ar->global_tx_status_waste, skb);
 365         }
 366
 367         /* recall the janitor in 100ms - if there's garbage in the can. */
 368         if (skb_queue_len(&ar->global_tx_status_waste) > 0)
 369                 queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
 370                                    msecs_to_jiffies(100));
 371 }
 372
 373 static void ar9170_handle_command_response(struct ar9170 *ar,
 374                                            void *buf, u32 len)
 375 {
 376         struct ar9170_cmd_response *cmd = (void *) buf;
 377
 378         if ((cmd->type & 0xc0) != 0xc0) {
 379                 ar->callback_cmd(ar, len, buf);
 380                 return;
 381         }
 382
 383         /* hardware event handlers */
 384         switch (cmd->type) {
 385         case 0xc1: {
 386                 /*
 387                  * TX status notification:
 388                  * bytes: 0c c1 XX YY M1 M2 M3 M4 M5 M6 R4 R3 R2 R1 S2 S1
 389                  *
 390                  * XX always 81
 391                  * YY always 00
 392                  * M1-M6 is the MAC address
 393                  * R1-R4 is the transmit rate
 394                  * S1-S2 is the transmit status
 395                  */
 396
 397                 struct sk_buff *skb;
 398                 u32 queue = (le32_to_cpu(cmd->tx_status.rate) &
 399                             AR9170_TX_PHY_QOS_MASK) >> AR9170_TX_PHY_QOS_SHIFT;
 400
 401                 skb = ar9170_find_queued_skb(ar, cmd->tx_status.dst, queue);
 402                 if (unlikely(!skb))
 403                         return ;
 404
 405                 ar9170_handle_tx_status(ar, skb, true,
 406                                         le16_to_cpu(cmd->tx_status.status));
 407                 break;
 408                 }
 409
 410         case 0xc0:
 411                 /*
 412                  * pre-TBTT event
 413                  */
 414                 if (ar->vif && ar->vif->type == NL80211_IFTYPE_AP)
 415                         queue_work(ar->hw->workqueue, &ar->beacon_work);
 416                 break;
 417
 418         case 0xc2:
 419                 /*
 420                  * (IBSS) beacon send notification
 421                  * bytes: 04 c2 XX YY B4 B3 B2 B1
 422                  *
 423                  * XX always 80
 424                  * YY always 00
 425                  * B1-B4 "should" be the number of send out beacons.
 426                  */
 427                 break;
 428
 429         case 0xc3:
 430                 /* End of Atim Window */
 431                 break;
 432
 433         case 0xc4:
 434         case 0xc5:
 435                 /* BlockACK events */
 436                 break;
 437
 438         case 0xc6:
 439                 /* Watchdog Interrupt */
 440                 break;
 441
 442         case 0xc9:
 443                 /* retransmission issue / SIFS/EIFS collision ?! */
 444                 break;
 445
 446         default:
 447                 printk(KERN_INFO "received unhandled event %x\n", cmd->type);
 448                 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
 449                 break;
 450         }
 451 }
 452
 453 static void ar9170_rx_reset_rx_mpdu(struct ar9170 *ar)
 454 {
 455         memset(&ar->rx_mpdu.plcp, 0, sizeof(struct ar9170_rx_head));
 456         ar->rx_mpdu.has_plcp = false;
 457 }
 458
 459 static int ar9170_nag_limiter(struct ar9170 *ar)
 460 {
 461         bool print_message;
 462
 463         /*
 464          * we expect all sorts of errors in promiscuous mode.
 465          * don't bother with it, it's OK!
 466          */
 467         if (ar->sniffer_enabled)
 468                 return false;
 469
 470         /*
 471          * only go for frequent errors! The hardware tends to
 472          * do some stupid thing once in a while under load, in
 473          * noisy environments or just for fun!
 474          */
 475         if (time_before(jiffies, ar->bad_hw_nagger) && net_ratelimit())
 476                 print_message = true;
 477         else
 478                 print_message = false;
 479
 480         /* reset threshold for "once in a while" */
 481         ar->bad_hw_nagger = jiffies + HZ / 4;
 482         return print_message;
 483 }
 484
 485 static int ar9170_rx_mac_status(struct ar9170 *ar,
 486                                 struct ar9170_rx_head *head,
 487                                 struct ar9170_rx_macstatus *mac,
 488                                 struct ieee80211_rx_status *status)
 489 {
 490         u8 error, decrypt;
 491
 492         BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
 493         BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4);
 494
 495         error = mac->error;
 496         if (error & AR9170_RX_ERROR_MMIC) {
 497                 status->flag |= RX_FLAG_MMIC_ERROR;
 498                 error &= ~AR9170_RX_ERROR_MMIC;
 499         }
 500
 501         if (error & AR9170_RX_ERROR_PLCP) {
 502                 status->flag |= RX_FLAG_FAILED_PLCP_CRC;
 503                 error &= ~AR9170_RX_ERROR_PLCP;
 504
 505                 if (!(ar->filter_state & FIF_PLCPFAIL))
 506                         return -EINVAL;
 507         }
 508
 509         if (error & AR9170_RX_ERROR_FCS) {
 510                 status->flag |= RX_FLAG_FAILED_FCS_CRC;
 511                 error &= ~AR9170_RX_ERROR_FCS;
 512
 513                 if (!(ar->filter_state & FIF_FCSFAIL))
 514                         return -EINVAL;
 515         }
 516
 517         decrypt = ar9170_get_decrypt_type(mac);
 518         if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
 519             decrypt != AR9170_ENC_ALG_NONE)
 520                 status->flag |= RX_FLAG_DECRYPTED;
 521
 522         /* ignore wrong RA errors */
 523         error &= ~AR9170_RX_ERROR_WRONG_RA;
 524
 525         if (error & AR9170_RX_ERROR_DECRYPT) {
 526                 error &= ~AR9170_RX_ERROR_DECRYPT;
 527                 /*
 528                  * Rx decryption is done in place,
 529                  * the original data is lost anyway.
 530                  */
 531
 532                 return -EINVAL;
 533         }
 534
 535         /* drop any other error frames */
 536         if (unlikely(error)) {
 537                 /* TODO: update netdevice's RX dropped/errors statistics */
 538
 539                 if (ar9170_nag_limiter(ar))
 540                         printk(KERN_DEBUG "%s: received frame with "
 541                                "suspicious error code (%#x).\n",
 542                                wiphy_name(ar->hw->wiphy), error);
 543
 544                 return -EINVAL;
 545         }
 546
 547         status->band = ar->channel->band;
 548         status->freq = ar->channel->center_freq;
 549
 550         switch (mac->status & AR9170_RX_STATUS_MODULATION_MASK) {
 551         case AR9170_RX_STATUS_MODULATION_CCK:
 552                 if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
 553                         status->flag |= RX_FLAG_SHORTPRE;
 554                 switch (head->plcp[0]) {
 555                 case 0x0a:
 556                         status->rate_idx = 0;
 557                         break;
 558                 case 0x14:
 559                         status->rate_idx = 1;
 560                         break;
 561                 case 0x37:
 562                         status->rate_idx = 2;
 563                         break;
 564                 case 0x6e:
 565                         status->rate_idx = 3;
 566                         break;
 567                 default:
 568                         if (ar9170_nag_limiter(ar))
 569                                 printk(KERN_ERR "%s: invalid plcp cck rate "
 570                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 571                                        head->plcp[0]);
 572                         return -EINVAL;
 573                 }
 574                 break;
 575
 576         case AR9170_RX_STATUS_MODULATION_OFDM:
 577                 switch (head->plcp[0] & 0xf) {
 578                 case 0xb:
 579                         status->rate_idx = 0;
 580                         break;
 581                 case 0xf:
 582                         status->rate_idx = 1;
 583                         break;
 584                 case 0xa:
 585                         status->rate_idx = 2;
 586                         break;
 587                 case 0xe:
 588                         status->rate_idx = 3;
 589                         break;
 590                 case 0x9:
 591                         status->rate_idx = 4;
 592                         break;
 593                 case 0xd:
 594                         status->rate_idx = 5;
 595                         break;
 596                 case 0x8:
 597                         status->rate_idx = 6;
 598                         break;
 599                 case 0xc:
 600                         status->rate_idx = 7;
 601                         break;
 602                 default:
 603                         if (ar9170_nag_limiter(ar))
 604                                 printk(KERN_ERR "%s: invalid plcp ofdm rate "
 605                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 606                                        head->plcp[0]);
 607                         return -EINVAL;
 608                 }
 609                 if (status->band == IEEE80211_BAND_2GHZ)
 610                         status->rate_idx += 4;
 611                 break;
 612
 613         case AR9170_RX_STATUS_MODULATION_HT:
 614                 if (head->plcp[3] & 0x80)
 615                         status->flag |= RX_FLAG_40MHZ;
 616                 if (head->plcp[6] & 0x80)
 617                         status->flag |= RX_FLAG_SHORT_GI;
 618
 619                 status->rate_idx = clamp(0, 75, head->plcp[6] & 0x7f);
 620                 status->flag |= RX_FLAG_HT;
 621                 break;
 622
 623         case AR9170_RX_STATUS_MODULATION_DUPOFDM:
 624                 /* XXX */
 625                 if (ar9170_nag_limiter(ar))
 626                         printk(KERN_ERR "%s: invalid modulation\n",
 627                                wiphy_name(ar->hw->wiphy));
 628                 return -EINVAL;
 629         }
 630
 631         return 0;
 632 }
 633
 634 static void ar9170_rx_phy_status(struct ar9170 *ar,
 635                                  struct ar9170_rx_phystatus *phy,
 636                                  struct ieee80211_rx_status *status)
 637 {
 638         int i;
 639
 640         BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20);
 641
 642         for (i = 0; i < 3; i++)
 643                 if (phy->rssi[i] != 0x80)
 644                         status->antenna |= BIT(i);
 645
 646         /* post-process RSSI */
 647         for (i = 0; i < 7; i++)
 648                 if (phy->rssi[i] & 0x80)
 649                         phy->rssi[i] = ((phy->rssi[i] & 0x7f) + 1) & 0x7f;
 650
 651         /* TODO: we could do something with phy_errors */
 652         status->signal = ar->noise[0] + phy->rssi_combined;
 653         status->noise = ar->noise[0];
 654 }
 655
 656 static struct sk_buff *ar9170_rx_copy_data(u8 *buf, int len)
 657 {
 658         struct sk_buff *skb;
 659         int reserved = 0;
 660         struct ieee80211_hdr *hdr = (void *) buf;
 661
 662         if (ieee80211_is_data_qos(hdr->frame_control)) {
 663                 u8 *qc = ieee80211_get_qos_ctl(hdr);
 664                 reserved += NET_IP_ALIGN;
 665
 666                 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
 667                         reserved += NET_IP_ALIGN;
 668         }
 669
 670         if (ieee80211_has_a4(hdr->frame_control))
 671                 reserved += NET_IP_ALIGN;
 672
 673         reserved = 32 + (reserved & NET_IP_ALIGN);
 674
 675         skb = dev_alloc_skb(len + reserved);
 676         if (likely(skb)) {
 677                 skb_reserve(skb, reserved);
 678                 memcpy(skb_put(skb, len), buf, len);
 679         }
 680
 681         return skb;
 682 }
 683
 684 /*
 685  * If the frame alignment is right (or the kernel has
 686  * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
 687  * is only a single MPDU in the USB frame, then we could
 688  * submit to mac80211 the SKB directly. However, since
 689  * there may be multiple packets in one SKB in stream
 690  * mode, and we need to observe the proper ordering,
 691  * this is non-trivial.
 692  */
 693
 694 static void ar9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
 695 {
 696         struct ar9170_rx_head *head;
 697         struct ar9170_rx_macstatus *mac;
 698         struct ar9170_rx_phystatus *phy = NULL;
 699         struct ieee80211_rx_status status;
 700         struct sk_buff *skb;
 701         int mpdu_len;
 702
 703         if (unlikely(!IS_STARTED(ar) || len < (sizeof(*mac))))
 704                 return ;
 705
 706         /* Received MPDU */
 707         mpdu_len = len - sizeof(*mac);
 708
 709         mac = (void *)(buf + mpdu_len);
 710         if (unlikely(mac->error & AR9170_RX_ERROR_FATAL)) {
 711                 /* this frame is too damaged and can't be used - drop it */
 712
 713                 return ;
 714         }
 715
 716         switch (mac->status & AR9170_RX_STATUS_MPDU_MASK) {
 717         case AR9170_RX_STATUS_MPDU_FIRST:
 718                 /* first mpdu packet has the plcp header */
 719                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) {
 720                         head = (void *) buf;
 721                         memcpy(&ar->rx_mpdu.plcp, (void *) buf,
 722                                sizeof(struct ar9170_rx_head));
 723
 724                         mpdu_len -= sizeof(struct ar9170_rx_head);
 725                         buf += sizeof(struct ar9170_rx_head);
 726                         ar->rx_mpdu.has_plcp = true;
 727                 } else {
 728                         if (ar9170_nag_limiter(ar))
 729                                 printk(KERN_ERR "%s: plcp info is clipped.\n",
 730                                        wiphy_name(ar->hw->wiphy));
 731                         return ;
 732                 }
 733                 break;
 734
 735         case AR9170_RX_STATUS_MPDU_LAST:
 736                 /* last mpdu has a extra tail with phy status information */
 737
 738                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) {
 739                         mpdu_len -= sizeof(struct ar9170_rx_phystatus);
 740                         phy = (void *)(buf + mpdu_len);
 741                 } else {
 742                         if (ar9170_nag_limiter(ar))
 743                                 printk(KERN_ERR "%s: frame tail is clipped.\n",
 744                                        wiphy_name(ar->hw->wiphy));
 745                         return ;
 746                 }
 747
 748         case AR9170_RX_STATUS_MPDU_MIDDLE:
 749                 /* middle mpdus are just data */
 750                 if (unlikely(!ar->rx_mpdu.has_plcp)) {
 751                         if (!ar9170_nag_limiter(ar))
 752                                 return ;
 753
 754                         printk(KERN_ERR "%s: rx stream did not start "
 755                                         "with a first_mpdu frame tag.\n",
 756                                wiphy_name(ar->hw->wiphy));
 757
 758                         return ;
 759                 }
 760
 761                 head = &ar->rx_mpdu.plcp;
 762                 break;
 763
 764         case AR9170_RX_STATUS_MPDU_SINGLE:
 765                 /* single mpdu - has plcp (head) and phy status (tail) */
 766                 head = (void *) buf;
 767
 768                 mpdu_len -= sizeof(struct ar9170_rx_head);
 769                 mpdu_len -= sizeof(struct ar9170_rx_phystatus);
 770
 771                 buf += sizeof(struct ar9170_rx_head);
 772                 phy = (void *)(buf + mpdu_len);
 773                 break;
 774
 775         default:
 776                 BUG_ON(1);
 777                 break;
 778         }
 779
 780         if (unlikely(mpdu_len < FCS_LEN))
 781                 return ;
 782
 783         memset(&status, 0, sizeof(status));
 784         if (unlikely(ar9170_rx_mac_status(ar, head, mac, &status)))
 785                 return ;
 786
 787         if (phy)
 788                 ar9170_rx_phy_status(ar, phy, &status);
 789
 790         skb = ar9170_rx_copy_data(buf, mpdu_len);
 791         if (likely(skb))
 792                 ieee80211_rx_irqsafe(ar->hw, skb, &status);
 793 }
 794
 795 void ar9170_rx(struct ar9170 *ar, struct sk_buff *skb)
 796 {
 797         unsigned int i, tlen, resplen, wlen = 0, clen = 0;
 798         u8 *tbuf, *respbuf;
 799
 800         tbuf = skb->data;
 801         tlen = skb->len;
 802
 803         while (tlen >= 4) {
 804                 clen = tbuf[1] << 8 | tbuf[0];
 805                 wlen = ALIGN(clen, 4);
 806
 807                 /* check if this is stream has a valid tag.*/
 808                 if (tbuf[2] != 0 || tbuf[3] != 0x4e) {
 809                         /*
 810                          * TODO: handle the highly unlikely event that the
 811                          * corrupted stream has the TAG at the right position.
 812                          */
 813
 814                         /* check if the frame can be repaired. */
 815                         if (!ar->rx_failover_missing) {
 816                                 /* this is no "short read". */
 817                                 if (ar9170_nag_limiter(ar)) {
 818                                         printk(KERN_ERR "%s: missing tag!\n",
 819                                                wiphy_name(ar->hw->wiphy));
 820                                         goto err_telluser;
 821                                 } else
 822                                         goto err_silent;
 823                         }
 824
 825                         if (ar->rx_failover_missing > tlen) {
 826                                 if (ar9170_nag_limiter(ar)) {
 827                                         printk(KERN_ERR "%s: possible multi "
 828                                                "stream corruption!\n",
 829                                                wiphy_name(ar->hw->wiphy));
 830                                         goto err_telluser;
 831                                 } else
 832                                         goto err_silent;
 833                         }
 834
 835                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
 836                         ar->rx_failover_missing -= tlen;
 837
 838                         if (ar->rx_failover_missing <= 0) {
 839                                 /*
 840                                  * nested ar9170_rx call!
 841                                  * termination is guranteed, even when the
 842                                  * combined frame also have a element with
 843                                  * a bad tag.
 844                                  */
 845
 846                                 ar->rx_failover_missing = 0;
 847                                 ar9170_rx(ar, ar->rx_failover);
 848
 849                                 skb_reset_tail_pointer(ar->rx_failover);
 850                                 skb_trim(ar->rx_failover, 0);
 851                         }
 852
 853                         return ;
 854                 }
 855
 856                 /* check if stream is clipped */
 857                 if (wlen > tlen - 4) {
 858                         if (ar->rx_failover_missing) {
 859                                 /* TODO: handle double stream corruption. */
 860                                 if (ar9170_nag_limiter(ar)) {
 861                                         printk(KERN_ERR "%s: double rx stream "
 862                                                "corruption!\n",
 863                                                 wiphy_name(ar->hw->wiphy));
 864                                         goto err_telluser;
 865                                 } else
 866                                         goto err_silent;
 867                         }
 868
 869                         /*
 870                          * save incomplete data set.
 871                          * the firmware will resend the missing bits when
 872                          * the rx - descriptor comes round again.
 873                          */
 874
 875                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
 876                         ar->rx_failover_missing = clen - tlen;
 877                         return ;
 878                 }
 879                 resplen = clen;
 880                 respbuf = tbuf + 4;
 881                 tbuf += wlen + 4;
 882                 tlen -= wlen + 4;
 883
 884                 i = 0;
 885
 886                 /* weird thing, but this is the same in the original driver */
 887                 while (resplen > 2 && i < 12 &&
 888                        respbuf[0] == 0xff && respbuf[1] == 0xff) {
 889                         i += 2;
 890                         resplen -= 2;
 891                         respbuf += 2;
 892                 }
 893
 894                 if (resplen < 4)
 895                         continue;
 896
 897                 /* found the 6 * 0xffff marker? */
 898                 if (i == 12)
 899                         ar9170_handle_command_response(ar, respbuf, resplen);
 900                 else
 901                         ar9170_handle_mpdu(ar, respbuf, clen);
 902         }
 903
 904         if (tlen) {
 905                 if (net_ratelimit())
 906                         printk(KERN_ERR "%s: %d bytes of unprocessed "
 907                                         "data left in rx stream!\n",
 908                                wiphy_name(ar->hw->wiphy), tlen);
 909
 910                 goto err_telluser;
 911         }
 912
 913         return ;
 914
 915 err_telluser:
 916         printk(KERN_ERR "%s: damaged RX stream data [want:%d, "
 917                         "data:%d, rx:%d, pending:%d ]\n",
 918                wiphy_name(ar->hw->wiphy), clen, wlen, tlen,
 919                ar->rx_failover_missing);
 920
 921         if (ar->rx_failover_missing)
 922                 print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET,
 923                                      ar->rx_failover->data,
 924                                      ar->rx_failover->len);
 925
 926         print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET,
 927                              skb->data, skb->len);
 928
 929         printk(KERN_ERR "%s: please check your hardware and cables, if "
 930                         "you see this message frequently.\n",
 931                wiphy_name(ar->hw->wiphy));
 932
 933 err_silent:
 934         if (ar->rx_failover_missing) {
 935                 skb_reset_tail_pointer(ar->rx_failover);
 936                 skb_trim(ar->rx_failover, 0);
 937                 ar->rx_failover_missing = 0;
 938         }
 939 }
 940
 941 #define AR9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)            \
 942 do {                                                                    \
 943         queue.aifs = ai_fs;                                             \
 944         queue.cw_min = cwmin;                                           \
 945         queue.cw_max = cwmax;                                           \
 946         queue.txop = _txop;                                             \
 947 } while (0)
 948
 949 static int ar9170_op_start(struct ieee80211_hw *hw)
 950 {
 951         struct ar9170 *ar = hw->priv;
 952         int err, i;
 953
 954         mutex_lock(&ar->mutex);
 955
 956         ar->filter_changed = 0;
 957
 958         /* reinitialize queues statistics */
 959         memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
 960         for (i = 0; i < ARRAY_SIZE(ar->tx_stats); i++)
 961                 ar->tx_stats[i].limit = 8;
 962
 963         /* reset QoS defaults */
 964         AR9170_FILL_QUEUE(ar->edcf[0], 3, 15, 1023,  0); /* BEST EFFORT*/
 965         AR9170_FILL_QUEUE(ar->edcf[1], 7, 15, 1023,  0); /* BACKGROUND */
 966         AR9170_FILL_QUEUE(ar->edcf[2], 2, 7,    15, 94); /* VIDEO */
 967         AR9170_FILL_QUEUE(ar->edcf[3], 2, 3,     7, 47); /* VOICE */
 968         AR9170_FILL_QUEUE(ar->edcf[4], 2, 3,     7,  0); /* SPECIAL */
 969
 970         ar->bad_hw_nagger = jiffies;
 971
 972         err = ar->open(ar);
 973         if (err)
 974                 goto out;
 975
 976         err = ar9170_init_mac(ar);
 977         if (err)
 978                 goto out;
 979
 980         err = ar9170_set_qos(ar);
 981         if (err)
 982                 goto out;
 983
 984         err = ar9170_init_phy(ar, IEEE80211_BAND_2GHZ);
 985         if (err)
 986                 goto out;
 987
 988         err = ar9170_init_rf(ar);
 989         if (err)
 990                 goto out;
 991
 992         /* start DMA */
 993         err = ar9170_write_reg(ar, 0x1c3d30, 0x100);
 994         if (err)
 995                 goto out;
 996
 997         ar->state = AR9170_STARTED;
 998
 999 out:
1000         mutex_unlock(&ar->mutex);
1001         return err;
1002 }
1003
1004 static void ar9170_op_stop(struct ieee80211_hw *hw)
1005 {
1006         struct ar9170 *ar = hw->priv;
1007
1008         if (IS_STARTED(ar))
1009                 ar->state = AR9170_IDLE;
1010
1011         flush_workqueue(ar->hw->workqueue);
1012
1013         cancel_delayed_work_sync(&ar->tx_status_janitor);
1014         cancel_work_sync(&ar->filter_config_work);
1015         cancel_work_sync(&ar->beacon_work);
1016         mutex_lock(&ar->mutex);
1017         skb_queue_purge(&ar->global_tx_status_waste);
1018         skb_queue_purge(&ar->global_tx_status);
1019
1020         if (IS_ACCEPTING_CMD(ar)) {
1021                 ar9170_set_leds_state(ar, 0);
1022
1023                 /* stop DMA */
1024                 ar9170_write_reg(ar, 0x1c3d30, 0);
1025                 ar->stop(ar);
1026         }
1027
1028         mutex_unlock(&ar->mutex);
1029 }
1030
1031 int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
1032 {
1033         struct ar9170 *ar = hw->priv;
1034         struct ieee80211_hdr *hdr;
1035         struct ar9170_tx_control *txc;
1036         struct ieee80211_tx_info *info;
1037         struct ieee80211_rate *rate = NULL;
1038         struct ieee80211_tx_rate *txrate;
1039         unsigned int queue = skb_get_queue_mapping(skb);
1040         unsigned long flags = 0;
1041         struct ar9170_sta_info *sta_info = NULL;
1042         u32 power, chains;
1043         u16 keytype = 0;
1044         u16 len, icv = 0;
1045         int err;
1046         bool tx_status;
1047
1048         if (unlikely(!IS_STARTED(ar)))
1049                 goto err_free;
1050
1051         hdr = (void *)skb->data;
1052         info = IEEE80211_SKB_CB(skb);
1053         len = skb->len;
1054
1055         spin_lock_irqsave(&ar->tx_stats_lock, flags);
1056         if (ar->tx_stats[queue].limit < ar->tx_stats[queue].len) {
1057                 spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1058                 return NETDEV_TX_OK;
1059         }
1060
1061         ar->tx_stats[queue].len++;
1062         ar->tx_stats[queue].count++;
1063         if (ar->tx_stats[queue].limit == ar->tx_stats[queue].len)
1064                 ieee80211_stop_queue(hw, queue);
1065
1066         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1067
1068         txc = (void *)skb_push(skb, sizeof(*txc));
1069
1070         tx_status = (((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) != 0) ||
1071                     ((info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) != 0));
1072
1073         if (info->control.hw_key) {
1074                 icv = info->control.hw_key->icv_len;
1075
1076                 switch (info->control.hw_key->alg) {
1077                 case ALG_WEP:
1078                         keytype = AR9170_TX_MAC_ENCR_RC4;
1079                         break;
1080                 case ALG_TKIP:
1081                         keytype = AR9170_TX_MAC_ENCR_RC4;
1082                         break;
1083                 case ALG_CCMP:
1084                         keytype = AR9170_TX_MAC_ENCR_AES;
1085                         break;
1086                 default:
1087                         WARN_ON(1);
1088                         goto err_dequeue;
1089                 }
1090         }
1091
1092         /* Length */
1093         txc->length = cpu_to_le16(len + icv + 4);
1094
1095         txc->mac_control = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
1096                                        AR9170_TX_MAC_BACKOFF);
1097         txc->mac_control |= cpu_to_le16(ar9170_qos_hwmap[queue] <<
1098                                         AR9170_TX_MAC_QOS_SHIFT);
1099         txc->mac_control |= cpu_to_le16(keytype);
1100         txc->phy_control = cpu_to_le32(0);
1101
1102         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1103                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_NO_ACK);
1104
1105         if (info->flags & IEEE80211_TX_CTL_AMPDU)
1106                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
1107
1108         txrate = &info->control.rates[0];
1109
1110         if (txrate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1111                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
1112         else if (txrate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1113                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
1114
1115         if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1116                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_GREENFIELD);
1117
1118         if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1119                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_PREAMBLE);
1120
1121         if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1122                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ);
1123         /* this works because 40 MHz is 2 and dup is 3 */
1124         if (txrate->flags & IEEE80211_TX_RC_DUP_DATA)
1125                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ_DUP);
1126
1127         if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
1128                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_GI);
1129
1130         if (txrate->flags & IEEE80211_TX_RC_MCS) {
1131                 u32 r = txrate->idx;
1132                 u8 *txpower;
1133
1134                 r <<= AR9170_TX_PHY_MCS_SHIFT;
1135                 if (WARN_ON(r & ~AR9170_TX_PHY_MCS_MASK))
1136                         goto err_dequeue;
1137                 txc->phy_control |= cpu_to_le32(r & AR9170_TX_PHY_MCS_MASK);
1138                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_MOD_HT);
1139
1140                 if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
1141                         if (info->band == IEEE80211_BAND_5GHZ)
1142                                 txpower = ar->power_5G_ht40;
1143                         else
1144                                 txpower = ar->power_2G_ht40;
1145                 } else {
1146                         if (info->band == IEEE80211_BAND_5GHZ)
1147                                 txpower = ar->power_5G_ht20;
1148                         else
1149                                 txpower = ar->power_2G_ht20;
1150                 }
1151
1152                 power = txpower[(txrate->idx) & 7];
1153         } else {
1154                 u8 *txpower;
1155                 u32 mod;
1156                 u32 phyrate;
1157                 u8 idx = txrate->idx;
1158
1159                 if (info->band != IEEE80211_BAND_2GHZ) {
1160                         idx += 4;
1161                         txpower = ar->power_5G_leg;
1162                         mod = AR9170_TX_PHY_MOD_OFDM;
1163                 } else {
1164                         if (idx < 4) {
1165                                 txpower = ar->power_2G_cck;
1166                                 mod = AR9170_TX_PHY_MOD_CCK;
1167                         } else {
1168                                 mod = AR9170_TX_PHY_MOD_OFDM;
1169                                 txpower = ar->power_2G_ofdm;
1170                         }
1171                 }
1172
1173                 rate = &__ar9170_ratetable[idx];
1174
1175                 phyrate = rate->hw_value & 0xF;
1176                 power = txpower[(rate->hw_value & 0x30) >> 4];
1177                 phyrate <<= AR9170_TX_PHY_MCS_SHIFT;
1178
1179                 txc->phy_control |= cpu_to_le32(mod);
1180                 txc->phy_control |= cpu_to_le32(phyrate);
1181         }
1182
1183         power <<= AR9170_TX_PHY_TX_PWR_SHIFT;
1184         power &= AR9170_TX_PHY_TX_PWR_MASK;
1185         txc->phy_control |= cpu_to_le32(power);
1186
1187         /* set TX chains */
1188         if (ar->eeprom.tx_mask == 1) {
1189                 chains = AR9170_TX_PHY_TXCHAIN_1;
1190         } else {
1191                 chains = AR9170_TX_PHY_TXCHAIN_2;
1192
1193                 /* >= 36M legacy OFDM - use only one chain */
1194                 if (rate && rate->bitrate >= 360)
1195                         chains = AR9170_TX_PHY_TXCHAIN_1;
1196         }
1197         txc->phy_control |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_SHIFT);
1198
1199         if (tx_status) {
1200                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
1201                 /*
1202                  * WARNING:
1203                  * Putting the QoS queue bits into an unexplored territory is
1204                  * certainly not elegant.
1205                  *
1206                  * In my defense: This idea provides a reasonable way to
1207                  * smuggle valuable information to the tx_status callback.
1208                  * Also, the idea behind this bit-abuse came straight from
1209                  * the original driver code.
1210                  */
1211
1212                 txc->phy_control |=
1213                         cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
1214
1215                 if (info->control.sta) {
1216                         sta_info = (void *) info->control.sta->drv_priv;
1217                         skb_queue_tail(&sta_info->tx_status[queue], skb);
1218                 } else {
1219                         skb_queue_tail(&ar->global_tx_status, skb);
1220
1221                         queue_delayed_work(ar->hw->workqueue,
1222                                            &ar->tx_status_janitor,
1223                                            msecs_to_jiffies(100));
1224                 }
1225         }
1226
1227         err = ar->tx(ar, skb, tx_status, 0);
1228         if (unlikely(tx_status && err)) {
1229                 if (info->control.sta)
1230                         skb_unlink(skb, &sta_info->tx_status[queue]);
1231                 else
1232                         skb_unlink(skb, &ar->global_tx_status);
1233         }
1234
1235         return NETDEV_TX_OK;
1236
1237 err_dequeue:
1238         spin_lock_irqsave(&ar->tx_stats_lock, flags);
1239         ar->tx_stats[queue].len--;
1240         ar->tx_stats[queue].count--;
1241         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1242
1243 err_free:
1244         dev_kfree_skb(skb);
1245         return NETDEV_TX_OK;
1246 }
1247
1248 static int ar9170_op_add_interface(struct ieee80211_hw *hw,
1249                                    struct ieee80211_if_init_conf *conf)
1250 {
1251         struct ar9170 *ar = hw->priv;
1252         int err = 0;
1253
1254         mutex_lock(&ar->mutex);
1255
1256         if (ar->vif) {
1257                 err = -EBUSY;
1258                 goto unlock;
1259         }
1260
1261         ar->vif = conf->vif;
1262         memcpy(ar->mac_addr, conf->mac_addr, ETH_ALEN);
1263
1264         if (modparam_nohwcrypt || (ar->vif->type != NL80211_IFTYPE_STATION)) {
1265                 ar->rx_software_decryption = true;
1266                 ar->disable_offload = true;
1267         }
1268
1269         ar->cur_filter = 0;
1270         ar->want_filter = AR9170_MAC_REG_FTF_DEFAULTS;
1271         err = ar9170_update_frame_filter(ar);
1272         if (err)
1273                 goto unlock;
1274
1275         err = ar9170_set_operating_mode(ar);
1276
1277 unlock:
1278         mutex_unlock(&ar->mutex);
1279         return err;
1280 }
1281
1282 static void ar9170_op_remove_interface(struct ieee80211_hw *hw,
1283                                        struct ieee80211_if_init_conf *conf)
1284 {
1285         struct ar9170 *ar = hw->priv;
1286
1287         mutex_lock(&ar->mutex);
1288         ar->vif = NULL;
1289         ar->want_filter = 0;
1290         ar9170_update_frame_filter(ar);
1291         ar9170_set_beacon_timers(ar);
1292         dev_kfree_skb(ar->beacon);
1293         ar->beacon = NULL;
1294         ar->sniffer_enabled = false;
1295         ar->rx_software_decryption = false;
1296         ar9170_set_operating_mode(ar);
1297         mutex_unlock(&ar->mutex);
1298 }
1299
1300 static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
1301 {
1302         struct ar9170 *ar = hw->priv;
1303         int err = 0;
1304
1305         mutex_lock(&ar->mutex);
1306
1307         if (changed & IEEE80211_CONF_CHANGE_RADIO_ENABLED) {
1308                 /* TODO */
1309                 err = 0;
1310         }
1311
1312         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
1313                 /* TODO */
1314                 err = 0;
1315         }
1316
1317         if (changed & IEEE80211_CONF_CHANGE_PS) {
1318                 /* TODO */
1319                 err = 0;
1320         }
1321
1322         if (changed & IEEE80211_CONF_CHANGE_POWER) {
1323                 /* TODO */
1324                 err = 0;
1325         }
1326
1327         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
1328                 /*
1329                  * is it long_frame_max_tx_count or short_frame_max_tx_count?
1330                  */
1331
1332                 err = ar9170_set_hwretry_limit(ar,
1333                         ar->hw->conf.long_frame_max_tx_count);
1334                 if (err)
1335                         goto out;
1336         }
1337
1338         if (changed & BSS_CHANGED_BEACON_INT) {
1339                 err = ar9170_set_beacon_timers(ar);
1340                 if (err)
1341                         goto out;
1342         }
1343
1344         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
1345
1346                 /* adjust slot time for 5 GHz */
1347                 err = ar9170_set_slot_time(ar);
1348                 if (err)
1349                         goto out;
1350
1351                 err = ar9170_set_dyn_sifs_ack(ar);
1352                 if (err)
1353                         goto out;
1354
1355                 err = ar9170_set_channel(ar, hw->conf.channel,
1356                                 AR9170_RFI_NONE,
1357                                 nl80211_to_ar9170(hw->conf.channel_type));
1358                 if (err)
1359                         goto out;
1360         }
1361
1362 out:
1363         mutex_unlock(&ar->mutex);
1364         return err;
1365 }
1366
1367 static void ar9170_set_filters(struct work_struct *work)
1368 {
1369         struct ar9170 *ar = container_of(work, struct ar9170,
1370                                          filter_config_work);
1371         int err;
1372
1373         if (unlikely(!IS_STARTED(ar)))
1374                 return ;
1375
1376         mutex_lock(&ar->mutex);
1377         if (test_and_clear_bit(AR9170_FILTER_CHANGED_MODE,
1378                                &ar->filter_changed)) {
1379                 err = ar9170_set_operating_mode(ar);
1380                 if (err)
1381                         goto unlock;
1382         }
1383
1384         if (test_and_clear_bit(AR9170_FILTER_CHANGED_MULTICAST,
1385                                &ar->filter_changed)) {
1386                 err = ar9170_update_multicast(ar);
1387                 if (err)
1388                         goto unlock;
1389         }
1390
1391         if (test_and_clear_bit(AR9170_FILTER_CHANGED_FRAMEFILTER,
1392                                &ar->filter_changed)) {
1393                 err = ar9170_update_frame_filter(ar);
1394                 if (err)
1395                         goto unlock;
1396         }
1397
1398 unlock:
1399         mutex_unlock(&ar->mutex);
1400 }
1401
1402 static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
1403                                        unsigned int changed_flags,
1404                                        unsigned int *new_flags,
1405                                        int mc_count, struct dev_mc_list *mclist)
1406 {
1407         struct ar9170 *ar = hw->priv;
1408
1409         /* mask supported flags */
1410         *new_flags &= FIF_ALLMULTI | FIF_CONTROL | FIF_BCN_PRBRESP_PROMISC |
1411                       FIF_PROMISC_IN_BSS | FIF_FCSFAIL | FIF_PLCPFAIL;
1412         ar->filter_state = *new_flags;
1413         /*
1414          * We can support more by setting the sniffer bit and
1415          * then checking the error flags, later.
1416          */
1417
1418         if (changed_flags & FIF_ALLMULTI) {
1419                 if (*new_flags & FIF_ALLMULTI) {
1420                         ar->want_mc_hash = ~0ULL;
1421                 } else {
1422                         u64 mchash;
1423                         int i;
1424
1425                         /* always get broadcast frames */
1426                         mchash = 1ULL << (0xff >> 2);
1427
1428                         for (i = 0; i < mc_count; i++) {
1429                                 if (WARN_ON(!mclist))
1430                                         break;
1431                                 mchash |= 1ULL << (mclist->dmi_addr[5] >> 2);
1432                                 mclist = mclist->next;
1433                         }
1434                 ar->want_mc_hash = mchash;
1435                 }
1436                 set_bit(AR9170_FILTER_CHANGED_MULTICAST, &ar->filter_changed);
1437         }
1438
1439         if (changed_flags & FIF_CONTROL) {
1440                 u32 filter = AR9170_MAC_REG_FTF_PSPOLL |
1441                              AR9170_MAC_REG_FTF_RTS |
1442                              AR9170_MAC_REG_FTF_CTS |
1443                              AR9170_MAC_REG_FTF_ACK |
1444                              AR9170_MAC_REG_FTF_CFE |
1445                              AR9170_MAC_REG_FTF_CFE_ACK;
1446
1447                 if (*new_flags & FIF_CONTROL)
1448                         ar->want_filter = ar->cur_filter | filter;
1449                 else
1450                         ar->want_filter = ar->cur_filter & ~filter;
1451
1452                 set_bit(AR9170_FILTER_CHANGED_FRAMEFILTER,
1453                         &ar->filter_changed);
1454         }
1455
1456         if (changed_flags & FIF_PROMISC_IN_BSS) {
1457                 ar->sniffer_enabled = ((*new_flags) & FIF_PROMISC_IN_BSS) != 0;
1458                 set_bit(AR9170_FILTER_CHANGED_MODE,
1459                         &ar->filter_changed);
1460         }
1461
1462         if (likely(IS_STARTED(ar)))
1463                 queue_work(ar->hw->workqueue, &ar->filter_config_work);
1464 }
1465
1466 static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
1467                                        struct ieee80211_vif *vif,
1468                                        struct ieee80211_bss_conf *bss_conf,
1469                                        u32 changed)
1470 {
1471         struct ar9170 *ar = hw->priv;
1472         int err = 0;
1473
1474         mutex_lock(&ar->mutex);
1475
1476         if (changed & BSS_CHANGED_BSSID) {
1477                 memcpy(ar->bssid, bss_conf->bssid, ETH_ALEN);
1478                 err = ar9170_set_operating_mode(ar);
1479                 if (err)
1480                         goto out;
1481         }
1482
1483         if (changed & (BSS_CHANGED_BEACON | BSS_CHANGED_BEACON_ENABLED)) {
1484                 err = ar9170_update_beacon(ar);
1485                 if (err)
1486                         goto out;
1487
1488                 err = ar9170_set_beacon_timers(ar);
1489                 if (err)
1490                         goto out;
1491         }
1492
1493         if (changed & BSS_CHANGED_ASSOC) {
1494                 ar->state = bss_conf->assoc ? AR9170_ASSOCIATED : ar->state;
1495
1496 #ifndef CONFIG_AR9170_LEDS
1497                 /* enable assoc LED. */
1498                 err = ar9170_set_leds_state(ar, bss_conf->assoc ? 2 : 0);
1499 #endif /* CONFIG_AR9170_LEDS */
1500         }
1501
1502         if (changed & BSS_CHANGED_BEACON_INT) {
1503                 err = ar9170_set_beacon_timers(ar);
1504                 if (err)
1505                         goto out;
1506         }
1507
1508         if (changed & BSS_CHANGED_HT) {
1509                 /* TODO */
1510                 err = 0;
1511         }
1512
1513         if (changed & BSS_CHANGED_ERP_SLOT) {
1514                 err = ar9170_set_slot_time(ar);
1515                 if (err)
1516                         goto out;
1517         }
1518
1519         if (changed & BSS_CHANGED_BASIC_RATES) {
1520                 err = ar9170_set_basic_rates(ar);
1521                 if (err)
1522                         goto out;
1523         }
1524
1525 out:
1526         mutex_unlock(&ar->mutex);
1527 }
1528
1529 static u64 ar9170_op_get_tsf(struct ieee80211_hw *hw)
1530 {
1531         struct ar9170 *ar = hw->priv;
1532         int err;
1533         u32 tsf_low;
1534         u32 tsf_high;
1535         u64 tsf;
1536
1537         mutex_lock(&ar->mutex);
1538         err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_L, &tsf_low);
1539         if (!err)
1540                 err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_H, &tsf_high);
1541         mutex_unlock(&ar->mutex);
1542
1543         if (WARN_ON(err))
1544                 return 0;
1545
1546         tsf = tsf_high;
1547         tsf = (tsf << 32) | tsf_low;
1548         return tsf;
1549 }
1550
1551 static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
1552                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
1553                           struct ieee80211_key_conf *key)
1554 {
1555         struct ar9170 *ar = hw->priv;
1556         int err = 0, i;
1557         u8 ktype;
1558
1559         if ((!ar->vif) || (ar->disable_offload))
1560                 return -EOPNOTSUPP;
1561
1562         switch (key->alg) {
1563         case ALG_WEP:
1564                 if (key->keylen == WLAN_KEY_LEN_WEP40)
1565                         ktype = AR9170_ENC_ALG_WEP64;
1566                 else
1567                         ktype = AR9170_ENC_ALG_WEP128;
1568                 break;
1569         case ALG_TKIP:
1570                 ktype = AR9170_ENC_ALG_TKIP;
1571                 break;
1572         case ALG_CCMP:
1573                 ktype = AR9170_ENC_ALG_AESCCMP;
1574                 break;
1575         default:
1576                 return -EOPNOTSUPP;
1577         }
1578
1579         mutex_lock(&ar->mutex);
1580         if (cmd == SET_KEY) {
1581                 if (unlikely(!IS_STARTED(ar))) {
1582                         err = -EOPNOTSUPP;
1583                         goto out;
1584                 }
1585
1586                 /* group keys need all-zeroes address */
1587                 if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1588                         sta = NULL;
1589
1590                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
1591                         for (i = 0; i < 64; i++)
1592                                 if (!(ar->usedkeys & BIT(i)))
1593                                         break;
1594                         if (i == 64) {
1595                                 ar->rx_software_decryption = true;
1596                                 ar9170_set_operating_mode(ar);
1597                                 err = -ENOSPC;
1598                                 goto out;
1599                         }
1600                 } else {
1601                         i = 64 + key->keyidx;
1602                 }
1603
1604                 key->hw_key_idx = i;
1605
1606                 err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL, ktype, 0,
1607                                         key->key, min_t(u8, 16, key->keylen));
1608                 if (err)
1609                         goto out;
1610
1611                 if (key->alg == ALG_TKIP) {
1612                         err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL,
1613                                                 ktype, 1, key->key + 16, 16);
1614                         if (err)
1615                                 goto out;
1616
1617                         /*
1618                          * hardware is not capable generating the MMIC
1619                          * for fragmented frames!
1620                          */
1621                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
1622                 }
1623
1624                 if (i < 64)
1625                         ar->usedkeys |= BIT(i);
1626
1627                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
1628         } else {
1629                 if (unlikely(!IS_STARTED(ar))) {
1630                         /* The device is gone... together with the key ;-) */
1631                         err = 0;
1632                         goto out;
1633                 }
1634
1635                 err = ar9170_disable_key(ar, key->hw_key_idx);
1636                 if (err)
1637                         goto out;
1638
1639                 if (key->hw_key_idx < 64) {
1640                         ar->usedkeys &= ~BIT(key->hw_key_idx);
1641                 } else {
1642                         err = ar9170_upload_key(ar, key->hw_key_idx, NULL,
1643                                                 AR9170_ENC_ALG_NONE, 0,
1644                                                 NULL, 0);
1645                         if (err)
1646                                 goto out;
1647
1648                         if (key->alg == ALG_TKIP) {
1649                                 err = ar9170_upload_key(ar, key->hw_key_idx,
1650                                                         NULL,
1651                                                         AR9170_ENC_ALG_NONE, 1,
1652                                                         NULL, 0);
1653                                 if (err)
1654                                         goto out;
1655                         }
1656
1657                 }
1658         }
1659
1660         ar9170_regwrite_begin(ar);
1661         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_L, ar->usedkeys);
1662         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_H, ar->usedkeys >> 32);
1663         ar9170_regwrite_finish();
1664         err = ar9170_regwrite_result();
1665
1666 out:
1667         mutex_unlock(&ar->mutex);
1668
1669         return err;
1670 }
1671
1672 static void ar9170_sta_notify(struct ieee80211_hw *hw,
1673                               struct ieee80211_vif *vif,
1674                               enum sta_notify_cmd cmd,
1675                               struct ieee80211_sta *sta)
1676 {
1677         struct ar9170 *ar = hw->priv;
1678         struct ar9170_sta_info *info = (void *) sta->drv_priv;
1679         struct sk_buff *skb;
1680         unsigned int i;
1681
1682         switch (cmd) {
1683         case STA_NOTIFY_ADD:
1684                 for (i = 0; i < ar->hw->queues; i++)
1685                         skb_queue_head_init(&info->tx_status[i]);
1686                 break;
1687
1688         case STA_NOTIFY_REMOVE:
1689
1690                 /*
1691                  * transfer all outstanding frames that need a tx_status
1692                  * reports to the global tx_status queue
1693                  */
1694
1695                 for (i = 0; i < ar->hw->queues; i++) {
1696                         while ((skb = skb_dequeue(&info->tx_status[i]))) {
1697 #ifdef AR9170_QUEUE_DEBUG
1698                                 printk(KERN_DEBUG "%s: queueing frame in "
1699                                           "global tx_status queue =>\n",
1700                                        wiphy_name(ar->hw->wiphy));
1701
1702                                 ar9170_print_txheader(ar, skb);
1703 #endif /* AR9170_QUEUE_DEBUG */
1704                                 skb_queue_tail(&ar->global_tx_status, skb);
1705                         }
1706                 }
1707                 queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
1708                                    msecs_to_jiffies(100));
1709                 break;
1710
1711         default:
1712                 break;
1713         }
1714 }
1715
1716 static int ar9170_get_stats(struct ieee80211_hw *hw,
1717                             struct ieee80211_low_level_stats *stats)
1718 {
1719         struct ar9170 *ar = hw->priv;
1720         u32 val;
1721         int err;
1722
1723         mutex_lock(&ar->mutex);
1724         err = ar9170_read_reg(ar, AR9170_MAC_REG_TX_RETRY, &val);
1725         ar->stats.dot11ACKFailureCount += val;
1726
1727         memcpy(stats, &ar->stats, sizeof(*stats));
1728         mutex_unlock(&ar->mutex);
1729
1730         return 0;
1731 }
1732
1733 static int ar9170_get_tx_stats(struct ieee80211_hw *hw,
1734                                struct ieee80211_tx_queue_stats *tx_stats)
1735 {
1736         struct ar9170 *ar = hw->priv;
1737
1738         spin_lock_bh(&ar->tx_stats_lock);
1739         memcpy(tx_stats, ar->tx_stats, sizeof(tx_stats[0]) * hw->queues);
1740         spin_unlock_bh(&ar->tx_stats_lock);
1741
1742         return 0;
1743 }
1744
1745 static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
1746                           const struct ieee80211_tx_queue_params *param)
1747 {
1748         struct ar9170 *ar = hw->priv;
1749         int ret;
1750
1751         mutex_lock(&ar->mutex);
1752         if ((param) && !(queue > ar->hw->queues)) {
1753                 memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
1754                        param, sizeof(*param));
1755
1756                 ret = ar9170_set_qos(ar);
1757         } else
1758                 ret = -EINVAL;
1759
1760         mutex_unlock(&ar->mutex);
1761         return ret;
1762 }
1763
1764 static int ar9170_ampdu_action(struct ieee80211_hw *hw,
1765                                enum ieee80211_ampdu_mlme_action action,
1766                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
1767 {
1768         switch (action) {
1769         case IEEE80211_AMPDU_RX_START:
1770         case IEEE80211_AMPDU_RX_STOP:
1771                 /*
1772                  * Something goes wrong -- RX locks up
1773                  * after a while of receiving aggregated
1774                  * frames -- not enabling for now.
1775                  */
1776                 return -EOPNOTSUPP;
1777         default:
1778                 return -EOPNOTSUPP;
1779         }
1780 }
1781
1782 static const struct ieee80211_ops ar9170_ops = {
1783         .start                  = ar9170_op_start,
1784         .stop                   = ar9170_op_stop,
1785         .tx                     = ar9170_op_tx,
1786         .add_interface          = ar9170_op_add_interface,
1787         .remove_interface       = ar9170_op_remove_interface,
1788         .config                 = ar9170_op_config,
1789         .configure_filter       = ar9170_op_configure_filter,
1790         .conf_tx                = ar9170_conf_tx,
1791         .bss_info_changed       = ar9170_op_bss_info_changed,
1792         .get_tsf                = ar9170_op_get_tsf,
1793         .set_key                = ar9170_set_key,
1794         .sta_notify             = ar9170_sta_notify,
1795         .get_stats              = ar9170_get_stats,
1796         .get_tx_stats           = ar9170_get_tx_stats,
1797         .ampdu_action           = ar9170_ampdu_action,
1798 };
1799
1800 void *ar9170_alloc(size_t priv_size)
1801 {
1802         struct ieee80211_hw *hw;
1803         struct ar9170 *ar;
1804         struct sk_buff *skb;
1805         int i;
1806
1807         /*
1808          * this buffer is used for rx stream reconstruction.
1809          * Under heavy load this device (or the transport layer?)
1810          * tends to split the streams into seperate rx descriptors.
1811          */
1812
1813         skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL);
1814         if (!skb)
1815                 goto err_nomem;
1816
1817         hw = ieee80211_alloc_hw(priv_size, &ar9170_ops);
1818         if (!hw)
1819                 goto err_nomem;
1820
1821         ar = hw->priv;
1822         ar->hw = hw;
1823         ar->rx_failover = skb;
1824
1825         mutex_init(&ar->mutex);
1826         spin_lock_init(&ar->cmdlock);
1827         spin_lock_init(&ar->tx_stats_lock);
1828         skb_queue_head_init(&ar->global_tx_status);
1829         skb_queue_head_init(&ar->global_tx_status_waste);
1830         ar9170_rx_reset_rx_mpdu(ar);
1831         INIT_WORK(&ar->filter_config_work, ar9170_set_filters);
1832         INIT_WORK(&ar->beacon_work, ar9170_new_beacon);
1833         INIT_DELAYED_WORK(&ar->tx_status_janitor, ar9170_tx_status_janitor);
1834
1835         /* all hw supports 2.4 GHz, so set channel to 1 by default */
1836         ar->channel = &ar9170_2ghz_chantable[0];
1837
1838         /* first part of wiphy init */
1839         ar->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
1840                                          BIT(NL80211_IFTYPE_WDS) |
1841                                          BIT(NL80211_IFTYPE_ADHOC);
1842         ar->hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
1843                          IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
1844                          IEEE80211_HW_SIGNAL_DBM |
1845                          IEEE80211_HW_NOISE_DBM;
1846
1847         ar->hw->queues = __AR9170_NUM_TXQ;
1848         ar->hw->extra_tx_headroom = 8;
1849         ar->hw->sta_data_size = sizeof(struct ar9170_sta_info);
1850
1851         ar->hw->max_rates = 1;
1852         ar->hw->max_rate_tries = 3;
1853
1854         for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
1855                 ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
1856
1857         return ar;
1858
1859 err_nomem:
1860         kfree_skb(skb);
1861         return ERR_PTR(-ENOMEM);
1862 }
1863
1864 static int ar9170_read_eeprom(struct ar9170 *ar)
1865 {
1866 #define RW      8       /* number of words to read at once */
1867 #define RB      (sizeof(u32) * RW)
1868         DECLARE_MAC_BUF(mbuf);
1869         u8 *eeprom = (void *)&ar->eeprom;
1870         u8 *addr = ar->eeprom.mac_address;
1871         __le32 offsets[RW];
1872         int i, j, err, bands = 0;
1873
1874         BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
1875
1876         BUILD_BUG_ON(RB > AR9170_MAX_CMD_LEN - 4);
1877 #ifndef __CHECKER__
1878         /* don't want to handle trailing remains */
1879         BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
1880 #endif
1881
1882         for (i = 0; i < sizeof(ar->eeprom)/RB; i++) {
1883                 for (j = 0; j < RW; j++)
1884                         offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
1885                                                  RB * i + 4 * j);
1886
1887                 err = ar->exec_cmd(ar, AR9170_CMD_RREG,
1888                                    RB, (u8 *) &offsets,
1889                                    RB, eeprom + RB * i);
1890                 if (err)
1891                         return err;
1892         }
1893
1894 #undef RW
1895 #undef RB
1896
1897         if (ar->eeprom.length == cpu_to_le16(0xFFFF))
1898                 return -ENODATA;
1899
1900         if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
1901                 ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar9170_band_2GHz;
1902                 bands++;
1903         }
1904         if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
1905                 ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &ar9170_band_5GHz;
1906                 bands++;
1907         }
1908         /*
1909          * I measured this, a bandswitch takes roughly
1910          * 135 ms and a frequency switch about 80.
1911          *
1912          * FIXME: measure these values again once EEPROM settings
1913          *        are used, that will influence them!
1914          */
1915         if (bands == 2)
1916                 ar->hw->channel_change_time = 135 * 1000;
1917         else
1918                 ar->hw->channel_change_time = 80 * 1000;
1919
1920         ar->regulatory.current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
1921         ar->regulatory.current_rd_ext = le16_to_cpu(ar->eeprom.reg_domain[1]);
1922
1923         /* second part of wiphy init */
1924         SET_IEEE80211_PERM_ADDR(ar->hw, addr);
1925
1926         return bands ? 0 : -EINVAL;
1927 }
1928
1929 static int ar9170_reg_notifier(struct wiphy *wiphy,
1930                         struct regulatory_request *request)
1931 {
1932         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
1933         struct ar9170 *ar = hw->priv;
1934
1935         return ath_reg_notifier_apply(wiphy, request, &ar->regulatory);
1936 }
1937
1938 int ar9170_register(struct ar9170 *ar, struct device *pdev)
1939 {
1940         int err;
1941
1942         /* try to read EEPROM, init MAC addr */
1943         err = ar9170_read_eeprom(ar);
1944         if (err)
1945                 goto err_out;
1946
1947         err = ath_regd_init(&ar->regulatory, ar->hw->wiphy,
1948                             ar9170_reg_notifier);
1949         if (err)
1950                 goto err_out;
1951
1952         err = ieee80211_register_hw(ar->hw);
1953         if (err)
1954                 goto err_out;
1955
1956         if (!ath_is_world_regd(&ar->regulatory))
1957                 regulatory_hint(ar->hw->wiphy, ar->regulatory.alpha2);
1958
1959         err = ar9170_init_leds(ar);
1960         if (err)
1961                 goto err_unreg;
1962
1963 #ifdef CONFIG_AR9170_LEDS
1964         err = ar9170_register_leds(ar);
1965         if (err)
1966                 goto err_unreg;
1967 #endif /* CONFIG_AR9170_LEDS */
1968
1969         dev_info(pdev, "Atheros AR9170 is registered as '%s'\n",
1970                  wiphy_name(ar->hw->wiphy));
1971
1972         return err;
1973
1974 err_unreg:
1975         ieee80211_unregister_hw(ar->hw);
1976
1977 err_out:
1978         return err;
1979 }
1980
1981 void ar9170_unregister(struct ar9170 *ar)
1982 {
1983 #ifdef CONFIG_AR9170_LEDS
1984         ar9170_unregister_leds(ar);
1985 #endif /* CONFIG_AR9170_LEDS */
1986
1987         kfree_skb(ar->rx_failover);
1988         ieee80211_unregister_hw(ar->hw);
1989         mutex_destroy(&ar->mutex);
1990 }