SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/net/wireless/ath/ar9170/main.c

   1 /*
   2  * Atheros AR9170 driver
   3  *
   4  * mac80211 interaction code
   5  *
   6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright 2009, Christian Lamparter <chunkeey@web.de>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; see the file COPYING.  If not, see
  21  * http://www.gnu.org/licenses/.
  22  *
  23  * This file incorporates work covered by the following copyright and
  24  * permission notice:
  25  *    Copyright (c) 2007-2008 Atheros Communications, Inc.
  26  *
  27  *    Permission to use, copy, modify, and/or distribute this software for any
  28  *    purpose with or without fee is hereby granted, provided that the above
  29  *    copyright notice and this permission notice appear in all copies.
  30  *
  31  *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  32  *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  33  *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  34  *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  35  *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  36  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  37  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  38  */
  39
  40 #include <linux/init.h>
  41 #include <linux/module.h>
  42 #include <linux/etherdevice.h>
  43 #include <net/mac80211.h>
  44 #include "ar9170.h"
  45 #include "hw.h"
  46 #include "cmd.h"
  47
  48 static int modparam_nohwcrypt;
  49 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
  50 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  51
  52 #define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
  53         .bitrate        = (_bitrate),                   \
  54         .flags          = (_flags),                     \
  55         .hw_value       = (_hw_rate) | (_txpidx) << 4,  \
  56 }
  57
  58 static struct ieee80211_rate __ar9170_ratetable[] = {
  59         RATE(10, 0, 0, 0),
  60         RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
  61         RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
  62         RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
  63         RATE(60, 0xb, 0, 0),
  64         RATE(90, 0xf, 0, 0),
  65         RATE(120, 0xa, 0, 0),
  66         RATE(180, 0xe, 0, 0),
  67         RATE(240, 0x9, 0, 0),
  68         RATE(360, 0xd, 1, 0),
  69         RATE(480, 0x8, 2, 0),
  70         RATE(540, 0xc, 3, 0),
  71 };
  72 #undef RATE
  73
  74 #define ar9170_g_ratetable      (__ar9170_ratetable + 0)
  75 #define ar9170_g_ratetable_size 12
  76 #define ar9170_a_ratetable      (__ar9170_ratetable + 4)
  77 #define ar9170_a_ratetable_size 8
  78
  79 /*
  80  * NB: The hw_value is used as an index into the ar9170_phy_freq_params
  81  *     array in phy.c so that we don't have to do frequency lookups!
  82  */
  83 #define CHAN(_freq, _idx) {             \
  84         .center_freq    = (_freq),      \
  85         .hw_value       = (_idx),       \
  86         .max_power      = 18, /* XXX */ \
  87 }
  88
  89 static struct ieee80211_channel ar9170_2ghz_chantable[] = {
  90         CHAN(2412,  0),
  91         CHAN(2417,  1),
  92         CHAN(2422,  2),
  93         CHAN(2427,  3),
  94         CHAN(2432,  4),
  95         CHAN(2437,  5),
  96         CHAN(2442,  6),
  97         CHAN(2447,  7),
  98         CHAN(2452,  8),
  99         CHAN(2457,  9),
 100         CHAN(2462, 10),
 101         CHAN(2467, 11),
 102         CHAN(2472, 12),
 103         CHAN(2484, 13),
 104 };
 105
 106 static struct ieee80211_channel ar9170_5ghz_chantable[] = {
 107         CHAN(4920, 14),
 108         CHAN(4940, 15),
 109         CHAN(4960, 16),
 110         CHAN(4980, 17),
 111         CHAN(5040, 18),
 112         CHAN(5060, 19),
 113         CHAN(5080, 20),
 114         CHAN(5180, 21),
 115         CHAN(5200, 22),
 116         CHAN(5220, 23),
 117         CHAN(5240, 24),
 118         CHAN(5260, 25),
 119         CHAN(5280, 26),
 120         CHAN(5300, 27),
 121         CHAN(5320, 28),
 122         CHAN(5500, 29),
 123         CHAN(5520, 30),
 124         CHAN(5540, 31),
 125         CHAN(5560, 32),
 126         CHAN(5580, 33),
 127         CHAN(5600, 34),
 128         CHAN(5620, 35),
 129         CHAN(5640, 36),
 130         CHAN(5660, 37),
 131         CHAN(5680, 38),
 132         CHAN(5700, 39),
 133         CHAN(5745, 40),
 134         CHAN(5765, 41),
 135         CHAN(5785, 42),
 136         CHAN(5805, 43),
 137         CHAN(5825, 44),
 138         CHAN(5170, 45),
 139         CHAN(5190, 46),
 140         CHAN(5210, 47),
 141         CHAN(5230, 48),
 142 };
 143 #undef CHAN
 144
 145 #define AR9170_HT_CAP                                                   \
 146 {                                                                       \
 147         .ht_supported   = true,                                         \
 148         .cap            = IEEE80211_HT_CAP_MAX_AMSDU |                  \
 149                           IEEE80211_HT_CAP_SUP_WIDTH_20_40 |            \
 150                           IEEE80211_HT_CAP_SGI_40 |                     \
 151                           IEEE80211_HT_CAP_DSSSCCK40 |                  \
 152                           IEEE80211_HT_CAP_SM_PS,                       \
 153         .ampdu_factor   = 3,                                            \
 154         .ampdu_density  = 6,                                            \
 155         .mcs            = {                                             \
 156                 .rx_mask = { 0xFF, 0xFF, 0, 0, 0, 0, 0, 0, 0, 0, },     \
 157         },                                                              \
 158 }
 159
 160 static struct ieee80211_supported_band ar9170_band_2GHz = {
 161         .channels       = ar9170_2ghz_chantable,
 162         .n_channels     = ARRAY_SIZE(ar9170_2ghz_chantable),
 163         .bitrates       = ar9170_g_ratetable,
 164         .n_bitrates     = ar9170_g_ratetable_size,
 165         .ht_cap         = AR9170_HT_CAP,
 166 };
 167
 168 static struct ieee80211_supported_band ar9170_band_5GHz = {
 169         .channels       = ar9170_5ghz_chantable,
 170         .n_channels     = ARRAY_SIZE(ar9170_5ghz_chantable),
 171         .bitrates       = ar9170_a_ratetable,
 172         .n_bitrates     = ar9170_a_ratetable_size,
 173         .ht_cap         = AR9170_HT_CAP,
 174 };
 175
 176 static void ar9170_tx(struct ar9170 *ar);
 177
 178 #ifdef AR9170_QUEUE_DEBUG
 179 static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
 180 {
 181         struct ar9170_tx_control *txc = (void *) skb->data;
 182         struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
 183         struct ar9170_tx_info *arinfo = (void *) txinfo->rate_driver_data;
 184         struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 185
 186         printk(KERN_DEBUG "%s: => FRAME [skb:%p, q:%d, DA:[%pM] flags:%x "
 187                           "mac_ctrl:%04x, phy_ctrl:%08x, timeout:[%d ms]]\n",
 188                wiphy_name(ar->hw->wiphy), skb, skb_get_queue_mapping(skb),
 189                ieee80211_get_DA(hdr), arinfo->flags,
 190                le16_to_cpu(txc->mac_control), le32_to_cpu(txc->phy_control),
 191                jiffies_to_msecs(arinfo->timeout - jiffies));
 192 }
 193
 194 static void __ar9170_dump_txqueue(struct ar9170 *ar,
 195                                 struct sk_buff_head *queue)
 196 {
 197         struct sk_buff *skb;
 198         int i = 0;
 199
 200         printk(KERN_DEBUG "---[ cut here ]---\n");
 201         printk(KERN_DEBUG "%s: %d entries in queue.\n",
 202                wiphy_name(ar->hw->wiphy), skb_queue_len(queue));
 203
 204         skb_queue_walk(queue, skb) {
 205                 printk(KERN_DEBUG "index:%d => \n", i++);
 206                 ar9170_print_txheader(ar, skb);
 207         }
 208         if (i != skb_queue_len(queue))
 209                 printk(KERN_DEBUG "WARNING: queue frame counter "
 210                        "mismatch %d != %d\n", skb_queue_len(queue), i);
 211         printk(KERN_DEBUG "---[ end ]---\n");
 212 }
 213
 214 static void ar9170_dump_txqueue(struct ar9170 *ar,
 215                                 struct sk_buff_head *queue)
 216 {
 217         unsigned long flags;
 218
 219         spin_lock_irqsave(&queue->lock, flags);
 220         __ar9170_dump_txqueue(ar, queue);
 221         spin_unlock_irqrestore(&queue->lock, flags);
 222 }
 223
 224 static void __ar9170_dump_txstats(struct ar9170 *ar)
 225 {
 226         int i;
 227
 228         printk(KERN_DEBUG "%s: QoS queue stats\n",
 229                wiphy_name(ar->hw->wiphy));
 230
 231         for (i = 0; i < __AR9170_NUM_TXQ; i++)
 232                 printk(KERN_DEBUG "%s: queue:%d limit:%d len:%d waitack:%d\n",
 233                        wiphy_name(ar->hw->wiphy), i, ar->tx_stats[i].limit,
 234                        ar->tx_stats[i].len, skb_queue_len(&ar->tx_status[i]));
 235 }
 236
 237 static void ar9170_dump_txstats(struct ar9170 *ar)
 238 {
 239         unsigned long flags;
 240
 241         spin_lock_irqsave(&ar->tx_stats_lock, flags);
 242         __ar9170_dump_txstats(ar);
 243         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 244 }
 245 #endif /* AR9170_QUEUE_DEBUG */
 246
 247 /* caller must guarantee exclusive access for _bin_ queue. */
 248 static void ar9170_recycle_expired(struct ar9170 *ar,
 249                                    struct sk_buff_head *queue,
 250                                    struct sk_buff_head *bin)
 251 {
 252         struct sk_buff *skb, *old = NULL;
 253         unsigned long flags;
 254
 255         spin_lock_irqsave(&queue->lock, flags);
 256         while ((skb = skb_peek(queue))) {
 257                 struct ieee80211_tx_info *txinfo;
 258                 struct ar9170_tx_info *arinfo;
 259
 260                 txinfo = IEEE80211_SKB_CB(skb);
 261                 arinfo = (void *) txinfo->rate_driver_data;
 262
 263                 if (time_is_before_jiffies(arinfo->timeout)) {
 264 #ifdef AR9170_QUEUE_DEBUG
 265                         printk(KERN_DEBUG "%s: [%ld > %ld] frame expired => "
 266                                "recycle \n", wiphy_name(ar->hw->wiphy),
 267                                jiffies, arinfo->timeout);
 268                         ar9170_print_txheader(ar, skb);
 269 #endif /* AR9170_QUEUE_DEBUG */
 270                         __skb_unlink(skb, queue);
 271                         __skb_queue_tail(bin, skb);
 272                 } else {
 273                         break;
 274                 }
 275
 276                 if (unlikely(old == skb)) {
 277                         /* bail out - queue is shot. */
 278
 279                         WARN_ON(1);
 280                         break;
 281                 }
 282                 old = skb;
 283         }
 284         spin_unlock_irqrestore(&queue->lock, flags);
 285 }
 286
 287 static void ar9170_tx_status(struct ar9170 *ar, struct sk_buff *skb,
 288                                     u16 tx_status)
 289 {
 290         struct ieee80211_tx_info *txinfo;
 291         unsigned int retries = 0;
 292
 293         txinfo = IEEE80211_SKB_CB(skb);
 294         ieee80211_tx_info_clear_status(txinfo);
 295
 296         switch (tx_status) {
 297         case AR9170_TX_STATUS_RETRY:
 298                 retries = 2;
 299         case AR9170_TX_STATUS_COMPLETE:
 300                 txinfo->flags |= IEEE80211_TX_STAT_ACK;
 301                 break;
 302
 303         case AR9170_TX_STATUS_FAILED:
 304                 retries = ar->hw->conf.long_frame_max_tx_count;
 305                 break;
 306
 307         default:
 308                 printk(KERN_ERR "%s: invalid tx_status response (%x).\n",
 309                        wiphy_name(ar->hw->wiphy), tx_status);
 310                 break;
 311         }
 312
 313         txinfo->status.rates[0].count = retries + 1;
 314         skb_pull(skb, sizeof(struct ar9170_tx_control));
 315         ieee80211_tx_status_irqsafe(ar->hw, skb);
 316 }
 317
 318 void ar9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb)
 319 {
 320         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 321         struct ar9170_tx_info *arinfo = (void *) info->rate_driver_data;
 322         unsigned int queue = skb_get_queue_mapping(skb);
 323         unsigned long flags;
 324
 325         spin_lock_irqsave(&ar->tx_stats_lock, flags);
 326         ar->tx_stats[queue].len--;
 327
 328         if (skb_queue_empty(&ar->tx_pending[queue])) {
 329 #ifdef AR9170_QUEUE_STOP_DEBUG
 330                 printk(KERN_DEBUG "%s: wake queue %d\n",
 331                        wiphy_name(ar->hw->wiphy), queue);
 332                 __ar9170_dump_txstats(ar);
 333 #endif /* AR9170_QUEUE_STOP_DEBUG */
 334                 ieee80211_wake_queue(ar->hw, queue);
 335         }
 336         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 337
 338         if (arinfo->flags & AR9170_TX_FLAG_BLOCK_ACK) {
 339                 dev_kfree_skb_any(skb);
 340         } else if (arinfo->flags & AR9170_TX_FLAG_WAIT_FOR_ACK) {
 341                 arinfo->timeout = jiffies +
 342                                   msecs_to_jiffies(AR9170_TX_TIMEOUT);
 343
 344                 skb_queue_tail(&ar->tx_status[queue], skb);
 345         } else if (arinfo->flags & AR9170_TX_FLAG_NO_ACK) {
 346                 ar9170_tx_status(ar, skb, AR9170_TX_STATUS_FAILED);
 347         } else {
 348 #ifdef AR9170_QUEUE_DEBUG
 349                 printk(KERN_DEBUG "%s: unsupported frame flags!\n",
 350                        wiphy_name(ar->hw->wiphy));
 351                 ar9170_print_txheader(ar, skb);
 352 #endif /* AR9170_QUEUE_DEBUG */
 353                 dev_kfree_skb_any(skb);
 354         }
 355
 356         if (!ar->tx_stats[queue].len &&
 357             !skb_queue_empty(&ar->tx_pending[queue])) {
 358                 ar9170_tx(ar);
 359         }
 360 }
 361
 362 static struct sk_buff *ar9170_get_queued_skb(struct ar9170 *ar,
 363                                              const u8 *mac,
 364                                              struct sk_buff_head *queue,
 365                                              const u32 rate)
 366 {
 367         unsigned long flags;
 368         struct sk_buff *skb;
 369
 370         /*
 371          * Unfortunately, the firmware does not tell to which (queued) frame
 372          * this transmission status report belongs to.
 373          *
 374          * So we have to make risky guesses - with the scarce information
 375          * the firmware provided (-> destination MAC, and phy_control) -
 376          * and hope that we picked the right one...
 377          */
 378
 379         spin_lock_irqsave(&queue->lock, flags);
 380         skb_queue_walk(queue, skb) {
 381                 struct ar9170_tx_control *txc = (void *) skb->data;
 382                 struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 383                 u32 r;
 384
 385                 if (mac && compare_ether_addr(ieee80211_get_DA(hdr), mac)) {
 386 #ifdef AR9170_QUEUE_DEBUG
 387                         printk(KERN_DEBUG "%s: skip frame => DA %pM != %pM\n",
 388                                wiphy_name(ar->hw->wiphy), mac,
 389                                ieee80211_get_DA(hdr));
 390                         ar9170_print_txheader(ar, skb);
 391 #endif /* AR9170_QUEUE_DEBUG */
 392                         continue;
 393                 }
 394
 395                 r = (le32_to_cpu(txc->phy_control) & AR9170_TX_PHY_MCS_MASK) >>
 396                     AR9170_TX_PHY_MCS_SHIFT;
 397
 398                 if ((rate != AR9170_TX_INVALID_RATE) && (r != rate)) {
 399 #ifdef AR9170_QUEUE_DEBUG
 400                         printk(KERN_DEBUG "%s: skip frame => rate %d != %d\n",
 401                                wiphy_name(ar->hw->wiphy), rate, r);
 402                         ar9170_print_txheader(ar, skb);
 403 #endif /* AR9170_QUEUE_DEBUG */
 404                         continue;
 405                 }
 406
 407                 __skb_unlink(skb, queue);
 408                 spin_unlock_irqrestore(&queue->lock, flags);
 409                 return skb;
 410         }
 411
 412 #ifdef AR9170_QUEUE_DEBUG
 413         printk(KERN_ERR "%s: ESS:[%pM] does not have any "
 414                         "outstanding frames in queue.\n",
 415                         wiphy_name(ar->hw->wiphy), mac);
 416         __ar9170_dump_txqueue(ar, queue);
 417 #endif /* AR9170_QUEUE_DEBUG */
 418         spin_unlock_irqrestore(&queue->lock, flags);
 419
 420         return NULL;
 421 }
 422
 423 /*
 424  * This worker tries to keeps an maintain tx_status queues.
 425  * So we can guarantee that incoming tx_status reports are
 426  * actually for a pending frame.
 427  */
 428
 429 static void ar9170_tx_janitor(struct work_struct *work)
 430 {
 431         struct ar9170 *ar = container_of(work, struct ar9170,
 432                                          tx_janitor.work);
 433         struct sk_buff_head waste;
 434         unsigned int i;
 435         bool resched = false;
 436
 437         if (unlikely(!IS_STARTED(ar)))
 438                 return ;
 439
 440         skb_queue_head_init(&waste);
 441
 442         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
 443 #ifdef AR9170_QUEUE_DEBUG
 444                 printk(KERN_DEBUG "%s: garbage collector scans queue:%d\n",
 445                        wiphy_name(ar->hw->wiphy), i);
 446                 ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
 447                 ar9170_dump_txqueue(ar, &ar->tx_status[i]);
 448 #endif /* AR9170_QUEUE_DEBUG */
 449
 450                 ar9170_recycle_expired(ar, &ar->tx_status[i], &waste);
 451                 ar9170_recycle_expired(ar, &ar->tx_pending[i], &waste);
 452                 skb_queue_purge(&waste);
 453
 454                 if (!skb_queue_empty(&ar->tx_status[i]) ||
 455                     !skb_queue_empty(&ar->tx_pending[i]))
 456                         resched = true;
 457         }
 458
 459         if (resched)
 460                 queue_delayed_work(ar->hw->workqueue,
 461                                    &ar->tx_janitor,
 462                                    msecs_to_jiffies(AR9170_JANITOR_DELAY));
 463 }
 464
 465 void ar9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len)
 466 {
 467         struct ar9170_cmd_response *cmd = (void *) buf;
 468
 469         if ((cmd->type & 0xc0) != 0xc0) {
 470                 ar->callback_cmd(ar, len, buf);
 471                 return;
 472         }
 473
 474         /* hardware event handlers */
 475         switch (cmd->type) {
 476         case 0xc1: {
 477                 /*
 478                  * TX status notification:
 479                  * bytes: 0c c1 XX YY M1 M2 M3 M4 M5 M6 R4 R3 R2 R1 S2 S1
 480                  *
 481                  * XX always 81
 482                  * YY always 00
 483                  * M1-M6 is the MAC address
 484                  * R1-R4 is the transmit rate
 485                  * S1-S2 is the transmit status
 486                  */
 487
 488                 struct sk_buff *skb;
 489                 u32 phy = le32_to_cpu(cmd->tx_status.rate);
 490                 u32 q = (phy & AR9170_TX_PHY_QOS_MASK) >>
 491                         AR9170_TX_PHY_QOS_SHIFT;
 492 #ifdef AR9170_QUEUE_DEBUG
 493                 printk(KERN_DEBUG "%s: recv tx_status for %pM, p:%08x, q:%d\n",
 494                        wiphy_name(ar->hw->wiphy), cmd->tx_status.dst, phy, q);
 495 #endif /* AR9170_QUEUE_DEBUG */
 496
 497                 skb = ar9170_get_queued_skb(ar, cmd->tx_status.dst,
 498                                             &ar->tx_status[q],
 499                                             AR9170_TX_INVALID_RATE);
 500                 if (unlikely(!skb))
 501                         return ;
 502
 503                 ar9170_tx_status(ar, skb, le16_to_cpu(cmd->tx_status.status));
 504                 break;
 505                 }
 506
 507         case 0xc0:
 508                 /*
 509                  * pre-TBTT event
 510                  */
 511                 if (ar->vif && ar->vif->type == NL80211_IFTYPE_AP)
 512                         queue_work(ar->hw->workqueue, &ar->beacon_work);
 513                 break;
 514
 515         case 0xc2:
 516                 /*
 517                  * (IBSS) beacon send notification
 518                  * bytes: 04 c2 XX YY B4 B3 B2 B1
 519                  *
 520                  * XX always 80
 521                  * YY always 00
 522                  * B1-B4 "should" be the number of send out beacons.
 523                  */
 524                 break;
 525
 526         case 0xc3:
 527                 /* End of Atim Window */
 528                 break;
 529
 530         case 0xc4:
 531         case 0xc5:
 532                 /* BlockACK events */
 533                 break;
 534
 535         case 0xc6:
 536                 /* Watchdog Interrupt */
 537                 break;
 538
 539         case 0xc9:
 540                 /* retransmission issue / SIFS/EIFS collision ?! */
 541                 break;
 542
 543         /* firmware debug */
 544         case 0xca:
 545                 printk(KERN_DEBUG "ar9170 FW: %.*s\n", len - 4, (char *)buf + 4);
 546                 break;
 547         case 0xcb:
 548                 len -= 4;
 549
 550                 switch (len) {
 551                 case 1:
 552                         printk(KERN_DEBUG "ar9170 FW: u8: %#.2x\n",
 553                                 *((char *)buf + 4));
 554                         break;
 555                 case 2:
 556                         printk(KERN_DEBUG "ar9170 FW: u8: %#.4x\n",
 557                                 le16_to_cpup((__le16 *)((char *)buf + 4)));
 558                         break;
 559                 case 4:
 560                         printk(KERN_DEBUG "ar9170 FW: u8: %#.8x\n",
 561                                 le32_to_cpup((__le32 *)((char *)buf + 4)));
 562                         break;
 563                 case 8:
 564                         printk(KERN_DEBUG "ar9170 FW: u8: %#.16lx\n",
 565                                 (unsigned long)le64_to_cpup(
 566                                                 (__le64 *)((char *)buf + 4)));
 567                         break;
 568                 }
 569                 break;
 570         case 0xcc:
 571                 print_hex_dump_bytes("ar9170 FW:", DUMP_PREFIX_NONE,
 572                                      (char *)buf + 4, len - 4);
 573                 break;
 574
 575         default:
 576                 printk(KERN_INFO "received unhandled event %x\n", cmd->type);
 577                 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
 578                 break;
 579         }
 580 }
 581
 582 static void ar9170_rx_reset_rx_mpdu(struct ar9170 *ar)
 583 {
 584         memset(&ar->rx_mpdu.plcp, 0, sizeof(struct ar9170_rx_head));
 585         ar->rx_mpdu.has_plcp = false;
 586 }
 587
 588 int ar9170_nag_limiter(struct ar9170 *ar)
 589 {
 590         bool print_message;
 591
 592         /*
 593          * we expect all sorts of errors in promiscuous mode.
 594          * don't bother with it, it's OK!
 595          */
 596         if (ar->sniffer_enabled)
 597                 return false;
 598
 599         /*
 600          * only go for frequent errors! The hardware tends to
 601          * do some stupid thing once in a while under load, in
 602          * noisy environments or just for fun!
 603          */
 604         if (time_before(jiffies, ar->bad_hw_nagger) && net_ratelimit())
 605                 print_message = true;
 606         else
 607                 print_message = false;
 608
 609         /* reset threshold for "once in a while" */
 610         ar->bad_hw_nagger = jiffies + HZ / 4;
 611         return print_message;
 612 }
 613
 614 static int ar9170_rx_mac_status(struct ar9170 *ar,
 615                                 struct ar9170_rx_head *head,
 616                                 struct ar9170_rx_macstatus *mac,
 617                                 struct ieee80211_rx_status *status)
 618 {
 619         u8 error, decrypt;
 620
 621         BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
 622         BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4);
 623
 624         error = mac->error;
 625         if (error & AR9170_RX_ERROR_MMIC) {
 626                 status->flag |= RX_FLAG_MMIC_ERROR;
 627                 error &= ~AR9170_RX_ERROR_MMIC;
 628         }
 629
 630         if (error & AR9170_RX_ERROR_PLCP) {
 631                 status->flag |= RX_FLAG_FAILED_PLCP_CRC;
 632                 error &= ~AR9170_RX_ERROR_PLCP;
 633
 634                 if (!(ar->filter_state & FIF_PLCPFAIL))
 635                         return -EINVAL;
 636         }
 637
 638         if (error & AR9170_RX_ERROR_FCS) {
 639                 status->flag |= RX_FLAG_FAILED_FCS_CRC;
 640                 error &= ~AR9170_RX_ERROR_FCS;
 641
 642                 if (!(ar->filter_state & FIF_FCSFAIL))
 643                         return -EINVAL;
 644         }
 645
 646         decrypt = ar9170_get_decrypt_type(mac);
 647         if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
 648             decrypt != AR9170_ENC_ALG_NONE)
 649                 status->flag |= RX_FLAG_DECRYPTED;
 650
 651         /* ignore wrong RA errors */
 652         error &= ~AR9170_RX_ERROR_WRONG_RA;
 653
 654         if (error & AR9170_RX_ERROR_DECRYPT) {
 655                 error &= ~AR9170_RX_ERROR_DECRYPT;
 656                 /*
 657                  * Rx decryption is done in place,
 658                  * the original data is lost anyway.
 659                  */
 660
 661                 return -EINVAL;
 662         }
 663
 664         /* drop any other error frames */
 665         if (unlikely(error)) {
 666                 /* TODO: update netdevice's RX dropped/errors statistics */
 667
 668                 if (ar9170_nag_limiter(ar))
 669                         printk(KERN_DEBUG "%s: received frame with "
 670                                "suspicious error code (%#x).\n",
 671                                wiphy_name(ar->hw->wiphy), error);
 672
 673                 return -EINVAL;
 674         }
 675
 676         status->band = ar->channel->band;
 677         status->freq = ar->channel->center_freq;
 678
 679         switch (mac->status & AR9170_RX_STATUS_MODULATION_MASK) {
 680         case AR9170_RX_STATUS_MODULATION_CCK:
 681                 if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
 682                         status->flag |= RX_FLAG_SHORTPRE;
 683                 switch (head->plcp[0]) {
 684                 case 0x0a:
 685                         status->rate_idx = 0;
 686                         break;
 687                 case 0x14:
 688                         status->rate_idx = 1;
 689                         break;
 690                 case 0x37:
 691                         status->rate_idx = 2;
 692                         break;
 693                 case 0x6e:
 694                         status->rate_idx = 3;
 695                         break;
 696                 default:
 697                         if (ar9170_nag_limiter(ar))
 698                                 printk(KERN_ERR "%s: invalid plcp cck rate "
 699                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 700                                        head->plcp[0]);
 701                         return -EINVAL;
 702                 }
 703                 break;
 704
 705         case AR9170_RX_STATUS_MODULATION_OFDM:
 706                 switch (head->plcp[0] & 0xf) {
 707                 case 0xb:
 708                         status->rate_idx = 0;
 709                         break;
 710                 case 0xf:
 711                         status->rate_idx = 1;
 712                         break;
 713                 case 0xa:
 714                         status->rate_idx = 2;
 715                         break;
 716                 case 0xe:
 717                         status->rate_idx = 3;
 718                         break;
 719                 case 0x9:
 720                         status->rate_idx = 4;
 721                         break;
 722                 case 0xd:
 723                         status->rate_idx = 5;
 724                         break;
 725                 case 0x8:
 726                         status->rate_idx = 6;
 727                         break;
 728                 case 0xc:
 729                         status->rate_idx = 7;
 730                         break;
 731                 default:
 732                         if (ar9170_nag_limiter(ar))
 733                                 printk(KERN_ERR "%s: invalid plcp ofdm rate "
 734                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 735                                        head->plcp[0]);
 736                         return -EINVAL;
 737                 }
 738                 if (status->band == IEEE80211_BAND_2GHZ)
 739                         status->rate_idx += 4;
 740                 break;
 741
 742         case AR9170_RX_STATUS_MODULATION_HT:
 743                 if (head->plcp[3] & 0x80)
 744                         status->flag |= RX_FLAG_40MHZ;
 745                 if (head->plcp[6] & 0x80)
 746                         status->flag |= RX_FLAG_SHORT_GI;
 747
 748                 status->rate_idx = clamp(0, 75, head->plcp[6] & 0x7f);
 749                 status->flag |= RX_FLAG_HT;
 750                 break;
 751
 752         case AR9170_RX_STATUS_MODULATION_DUPOFDM:
 753                 /* XXX */
 754                 if (ar9170_nag_limiter(ar))
 755                         printk(KERN_ERR "%s: invalid modulation\n",
 756                                wiphy_name(ar->hw->wiphy));
 757                 return -EINVAL;
 758         }
 759
 760         return 0;
 761 }
 762
 763 static void ar9170_rx_phy_status(struct ar9170 *ar,
 764                                  struct ar9170_rx_phystatus *phy,
 765                                  struct ieee80211_rx_status *status)
 766 {
 767         int i;
 768
 769         BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20);
 770
 771         for (i = 0; i < 3; i++)
 772                 if (phy->rssi[i] != 0x80)
 773                         status->antenna |= BIT(i);
 774
 775         /* post-process RSSI */
 776         for (i = 0; i < 7; i++)
 777                 if (phy->rssi[i] & 0x80)
 778                         phy->rssi[i] = ((phy->rssi[i] & 0x7f) + 1) & 0x7f;
 779
 780         /* TODO: we could do something with phy_errors */
 781         status->signal = ar->noise[0] + phy->rssi_combined;
 782         status->noise = ar->noise[0];
 783 }
 784
 785 static struct sk_buff *ar9170_rx_copy_data(u8 *buf, int len)
 786 {
 787         struct sk_buff *skb;
 788         int reserved = 0;
 789         struct ieee80211_hdr *hdr = (void *) buf;
 790
 791         if (ieee80211_is_data_qos(hdr->frame_control)) {
 792                 u8 *qc = ieee80211_get_qos_ctl(hdr);
 793                 reserved += NET_IP_ALIGN;
 794
 795                 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
 796                         reserved += NET_IP_ALIGN;
 797         }
 798
 799         if (ieee80211_has_a4(hdr->frame_control))
 800                 reserved += NET_IP_ALIGN;
 801
 802         reserved = 32 + (reserved & NET_IP_ALIGN);
 803
 804         skb = dev_alloc_skb(len + reserved);
 805         if (likely(skb)) {
 806                 skb_reserve(skb, reserved);
 807                 memcpy(skb_put(skb, len), buf, len);
 808         }
 809
 810         return skb;
 811 }
 812
 813 /*
 814  * If the frame alignment is right (or the kernel has
 815  * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
 816  * is only a single MPDU in the USB frame, then we could
 817  * submit to mac80211 the SKB directly. However, since
 818  * there may be multiple packets in one SKB in stream
 819  * mode, and we need to observe the proper ordering,
 820  * this is non-trivial.
 821  */
 822
 823 static void ar9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
 824 {
 825         struct ar9170_rx_head *head;
 826         struct ar9170_rx_macstatus *mac;
 827         struct ar9170_rx_phystatus *phy = NULL;
 828         struct ieee80211_rx_status status;
 829         struct sk_buff *skb;
 830         int mpdu_len;
 831
 832         if (unlikely(!IS_STARTED(ar) || len < (sizeof(*mac))))
 833                 return ;
 834
 835         /* Received MPDU */
 836         mpdu_len = len - sizeof(*mac);
 837
 838         mac = (void *)(buf + mpdu_len);
 839         if (unlikely(mac->error & AR9170_RX_ERROR_FATAL)) {
 840                 /* this frame is too damaged and can't be used - drop it */
 841
 842                 return ;
 843         }
 844
 845         switch (mac->status & AR9170_RX_STATUS_MPDU_MASK) {
 846         case AR9170_RX_STATUS_MPDU_FIRST:
 847                 /* first mpdu packet has the plcp header */
 848                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) {
 849                         head = (void *) buf;
 850                         memcpy(&ar->rx_mpdu.plcp, (void *) buf,
 851                                sizeof(struct ar9170_rx_head));
 852
 853                         mpdu_len -= sizeof(struct ar9170_rx_head);
 854                         buf += sizeof(struct ar9170_rx_head);
 855                         ar->rx_mpdu.has_plcp = true;
 856                 } else {
 857                         if (ar9170_nag_limiter(ar))
 858                                 printk(KERN_ERR "%s: plcp info is clipped.\n",
 859                                        wiphy_name(ar->hw->wiphy));
 860                         return ;
 861                 }
 862                 break;
 863
 864         case AR9170_RX_STATUS_MPDU_LAST:
 865                 /* last mpdu has a extra tail with phy status information */
 866
 867                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) {
 868                         mpdu_len -= sizeof(struct ar9170_rx_phystatus);
 869                         phy = (void *)(buf + mpdu_len);
 870                 } else {
 871                         if (ar9170_nag_limiter(ar))
 872                                 printk(KERN_ERR "%s: frame tail is clipped.\n",
 873                                        wiphy_name(ar->hw->wiphy));
 874                         return ;
 875                 }
 876
 877         case AR9170_RX_STATUS_MPDU_MIDDLE:
 878                 /* middle mpdus are just data */
 879                 if (unlikely(!ar->rx_mpdu.has_plcp)) {
 880                         if (!ar9170_nag_limiter(ar))
 881                                 return ;
 882
 883                         printk(KERN_ERR "%s: rx stream did not start "
 884                                         "with a first_mpdu frame tag.\n",
 885                                wiphy_name(ar->hw->wiphy));
 886
 887                         return ;
 888                 }
 889
 890                 head = &ar->rx_mpdu.plcp;
 891                 break;
 892
 893         case AR9170_RX_STATUS_MPDU_SINGLE:
 894                 /* single mpdu - has plcp (head) and phy status (tail) */
 895                 head = (void *) buf;
 896
 897                 mpdu_len -= sizeof(struct ar9170_rx_head);
 898                 mpdu_len -= sizeof(struct ar9170_rx_phystatus);
 899
 900                 buf += sizeof(struct ar9170_rx_head);
 901                 phy = (void *)(buf + mpdu_len);
 902                 break;
 903
 904         default:
 905                 BUG_ON(1);
 906                 break;
 907         }
 908
 909         if (unlikely(mpdu_len < FCS_LEN))
 910                 return ;
 911
 912         memset(&status, 0, sizeof(status));
 913         if (unlikely(ar9170_rx_mac_status(ar, head, mac, &status)))
 914                 return ;
 915
 916         if (phy)
 917                 ar9170_rx_phy_status(ar, phy, &status);
 918
 919         skb = ar9170_rx_copy_data(buf, mpdu_len);
 920         if (likely(skb)) {
 921                 memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
 922                 ieee80211_rx_irqsafe(ar->hw, skb);
 923         }
 924 }
 925
 926 void ar9170_rx(struct ar9170 *ar, struct sk_buff *skb)
 927 {
 928         unsigned int i, tlen, resplen, wlen = 0, clen = 0;
 929         u8 *tbuf, *respbuf;
 930
 931         tbuf = skb->data;
 932         tlen = skb->len;
 933
 934         while (tlen >= 4) {
 935                 clen = tbuf[1] << 8 | tbuf[0];
 936                 wlen = ALIGN(clen, 4);
 937
 938                 /* check if this is stream has a valid tag.*/
 939                 if (tbuf[2] != 0 || tbuf[3] != 0x4e) {
 940                         /*
 941                          * TODO: handle the highly unlikely event that the
 942                          * corrupted stream has the TAG at the right position.
 943                          */
 944
 945                         /* check if the frame can be repaired. */
 946                         if (!ar->rx_failover_missing) {
 947                                 /* this is no "short read". */
 948                                 if (ar9170_nag_limiter(ar)) {
 949                                         printk(KERN_ERR "%s: missing tag!\n",
 950                                                wiphy_name(ar->hw->wiphy));
 951                                         goto err_telluser;
 952                                 } else
 953                                         goto err_silent;
 954                         }
 955
 956                         if (ar->rx_failover_missing > tlen) {
 957                                 if (ar9170_nag_limiter(ar)) {
 958                                         printk(KERN_ERR "%s: possible multi "
 959                                                "stream corruption!\n",
 960                                                wiphy_name(ar->hw->wiphy));
 961                                         goto err_telluser;
 962                                 } else
 963                                         goto err_silent;
 964                         }
 965
 966                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
 967                         ar->rx_failover_missing -= tlen;
 968
 969                         if (ar->rx_failover_missing <= 0) {
 970                                 /*
 971                                  * nested ar9170_rx call!
 972                                  * termination is guranteed, even when the
 973                                  * combined frame also have a element with
 974                                  * a bad tag.
 975                                  */
 976
 977                                 ar->rx_failover_missing = 0;
 978                                 ar9170_rx(ar, ar->rx_failover);
 979
 980                                 skb_reset_tail_pointer(ar->rx_failover);
 981                                 skb_trim(ar->rx_failover, 0);
 982                         }
 983
 984                         return ;
 985                 }
 986
 987                 /* check if stream is clipped */
 988                 if (wlen > tlen - 4) {
 989                         if (ar->rx_failover_missing) {
 990                                 /* TODO: handle double stream corruption. */
 991                                 if (ar9170_nag_limiter(ar)) {
 992                                         printk(KERN_ERR "%s: double rx stream "
 993                                                "corruption!\n",
 994                                                 wiphy_name(ar->hw->wiphy));
 995                                         goto err_telluser;
 996                                 } else
 997                                         goto err_silent;
 998                         }
 999
1000                         /*
1001                          * save incomplete data set.
1002                          * the firmware will resend the missing bits when
1003                          * the rx - descriptor comes round again.
1004                          */
1005
1006                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
1007                         ar->rx_failover_missing = clen - tlen;
1008                         return ;
1009                 }
1010                 resplen = clen;
1011                 respbuf = tbuf + 4;
1012                 tbuf += wlen + 4;
1013                 tlen -= wlen + 4;
1014
1015                 i = 0;
1016
1017                 /* weird thing, but this is the same in the original driver */
1018                 while (resplen > 2 && i < 12 &&
1019                        respbuf[0] == 0xff && respbuf[1] == 0xff) {
1020                         i += 2;
1021                         resplen -= 2;
1022                         respbuf += 2;
1023                 }
1024
1025                 if (resplen < 4)
1026                         continue;
1027
1028                 /* found the 6 * 0xffff marker? */
1029                 if (i == 12)
1030                         ar9170_handle_command_response(ar, respbuf, resplen);
1031                 else
1032                         ar9170_handle_mpdu(ar, respbuf, clen);
1033         }
1034
1035         if (tlen) {
1036                 if (net_ratelimit())
1037                         printk(KERN_ERR "%s: %d bytes of unprocessed "
1038                                         "data left in rx stream!\n",
1039                                wiphy_name(ar->hw->wiphy), tlen);
1040
1041                 goto err_telluser;
1042         }
1043
1044         return ;
1045
1046 err_telluser:
1047         printk(KERN_ERR "%s: damaged RX stream data [want:%d, "
1048                         "data:%d, rx:%d, pending:%d ]\n",
1049                wiphy_name(ar->hw->wiphy), clen, wlen, tlen,
1050                ar->rx_failover_missing);
1051
1052         if (ar->rx_failover_missing)
1053                 print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET,
1054                                      ar->rx_failover->data,
1055                                      ar->rx_failover->len);
1056
1057         print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET,
1058                              skb->data, skb->len);
1059
1060         printk(KERN_ERR "%s: please check your hardware and cables, if "
1061                         "you see this message frequently.\n",
1062                wiphy_name(ar->hw->wiphy));
1063
1064 err_silent:
1065         if (ar->rx_failover_missing) {
1066                 skb_reset_tail_pointer(ar->rx_failover);
1067                 skb_trim(ar->rx_failover, 0);
1068                 ar->rx_failover_missing = 0;
1069         }
1070 }
1071
1072 #define AR9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)            \
1073 do {                                                                    \
1074         queue.aifs = ai_fs;                                             \
1075         queue.cw_min = cwmin;                                           \
1076         queue.cw_max = cwmax;                                           \
1077         queue.txop = _txop;                                             \
1078 } while (0)
1079
1080 static int ar9170_op_start(struct ieee80211_hw *hw)
1081 {
1082         struct ar9170 *ar = hw->priv;
1083         int err, i;
1084
1085         mutex_lock(&ar->mutex);
1086
1087         ar->filter_changed = 0;
1088
1089         /* reinitialize queues statistics */
1090         memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
1091         for (i = 0; i < __AR9170_NUM_TXQ; i++)
1092                 ar->tx_stats[i].limit = AR9170_TXQ_DEPTH;
1093
1094         /* reset QoS defaults */
1095         AR9170_FILL_QUEUE(ar->edcf[0], 3, 15, 1023,  0); /* BEST EFFORT*/
1096         AR9170_FILL_QUEUE(ar->edcf[1], 7, 15, 1023,  0); /* BACKGROUND */
1097         AR9170_FILL_QUEUE(ar->edcf[2], 2, 7,    15, 94); /* VIDEO */
1098         AR9170_FILL_QUEUE(ar->edcf[3], 2, 3,     7, 47); /* VOICE */
1099         AR9170_FILL_QUEUE(ar->edcf[4], 2, 3,     7,  0); /* SPECIAL */
1100
1101         ar->bad_hw_nagger = jiffies;
1102
1103         err = ar->open(ar);
1104         if (err)
1105                 goto out;
1106
1107         err = ar9170_init_mac(ar);
1108         if (err)
1109                 goto out;
1110
1111         err = ar9170_set_qos(ar);
1112         if (err)
1113                 goto out;
1114
1115         err = ar9170_init_phy(ar, IEEE80211_BAND_2GHZ);
1116         if (err)
1117                 goto out;
1118
1119         err = ar9170_init_rf(ar);
1120         if (err)
1121                 goto out;
1122
1123         /* start DMA */
1124         err = ar9170_write_reg(ar, 0x1c3d30, 0x100);
1125         if (err)
1126                 goto out;
1127
1128         ar->state = AR9170_STARTED;
1129
1130 out:
1131         mutex_unlock(&ar->mutex);
1132         return err;
1133 }
1134
1135 static void ar9170_op_stop(struct ieee80211_hw *hw)
1136 {
1137         struct ar9170 *ar = hw->priv;
1138         unsigned int i;
1139
1140         if (IS_STARTED(ar))
1141                 ar->state = AR9170_IDLE;
1142
1143         flush_workqueue(ar->hw->workqueue);
1144
1145         cancel_delayed_work_sync(&ar->tx_janitor);
1146         cancel_work_sync(&ar->filter_config_work);
1147         cancel_work_sync(&ar->beacon_work);
1148         mutex_lock(&ar->mutex);
1149
1150         if (IS_ACCEPTING_CMD(ar)) {
1151                 ar9170_set_leds_state(ar, 0);
1152
1153                 /* stop DMA */
1154                 ar9170_write_reg(ar, 0x1c3d30, 0);
1155                 ar->stop(ar);
1156         }
1157
1158         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
1159                 skb_queue_purge(&ar->tx_pending[i]);
1160                 skb_queue_purge(&ar->tx_status[i]);
1161         }
1162         mutex_unlock(&ar->mutex);
1163 }
1164
1165 static int ar9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
1166 {
1167         struct ieee80211_hdr *hdr;
1168         struct ar9170_tx_control *txc;
1169         struct ieee80211_tx_info *info;
1170         struct ieee80211_tx_rate *txrate;
1171         struct ar9170_tx_info *arinfo;
1172         unsigned int queue = skb_get_queue_mapping(skb);
1173         u16 keytype = 0;
1174         u16 len, icv = 0;
1175
1176         BUILD_BUG_ON(sizeof(*arinfo) > sizeof(info->rate_driver_data));
1177
1178         hdr = (void *)skb->data;
1179         info = IEEE80211_SKB_CB(skb);
1180         len = skb->len;
1181
1182         txc = (void *)skb_push(skb, sizeof(*txc));
1183
1184         if (info->control.hw_key) {
1185                 icv = info->control.hw_key->icv_len;
1186
1187                 switch (info->control.hw_key->alg) {
1188                 case ALG_WEP:
1189                         keytype = AR9170_TX_MAC_ENCR_RC4;
1190                         break;
1191                 case ALG_TKIP:
1192                         keytype = AR9170_TX_MAC_ENCR_RC4;
1193                         break;
1194                 case ALG_CCMP:
1195                         keytype = AR9170_TX_MAC_ENCR_AES;
1196                         break;
1197                 default:
1198                         WARN_ON(1);
1199                         goto err_out;
1200                 }
1201         }
1202
1203         /* Length */
1204         txc->length = cpu_to_le16(len + icv + 4);
1205
1206         txc->mac_control = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
1207                                        AR9170_TX_MAC_BACKOFF);
1208         txc->mac_control |= cpu_to_le16(ar9170_qos_hwmap[queue] <<
1209                                         AR9170_TX_MAC_QOS_SHIFT);
1210         txc->mac_control |= cpu_to_le16(keytype);
1211         txc->phy_control = cpu_to_le32(0);
1212
1213         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1214                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_NO_ACK);
1215
1216         txrate = &info->control.rates[0];
1217         if (txrate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1218                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
1219         else if (txrate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1220                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
1221
1222         arinfo = (void *)info->rate_driver_data;
1223         arinfo->timeout = jiffies + msecs_to_jiffies(AR9170_QUEUE_TIMEOUT);
1224
1225         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
1226              (is_valid_ether_addr(ieee80211_get_DA(hdr)))) {
1227                 if (info->flags & IEEE80211_TX_CTL_AMPDU) {
1228                         if (unlikely(!info->control.sta))
1229                                 goto err_out;
1230
1231                         txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
1232                         arinfo->flags = AR9170_TX_FLAG_BLOCK_ACK;
1233                         goto out;
1234                 }
1235
1236                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
1237                 /*
1238                  * WARNING:
1239                  * Putting the QoS queue bits into an unexplored territory is
1240                  * certainly not elegant.
1241                  *
1242                  * In my defense: This idea provides a reasonable way to
1243                  * smuggle valuable information to the tx_status callback.
1244                  * Also, the idea behind this bit-abuse came straight from
1245                  * the original driver code.
1246                  */
1247
1248                 txc->phy_control |=
1249                         cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
1250                 arinfo->flags = AR9170_TX_FLAG_WAIT_FOR_ACK;
1251         } else {
1252                 arinfo->flags = AR9170_TX_FLAG_NO_ACK;
1253         }
1254
1255 out:
1256         return 0;
1257
1258 err_out:
1259         skb_pull(skb, sizeof(*txc));
1260         return -EINVAL;
1261 }
1262
1263 static void ar9170_tx_prepare_phy(struct ar9170 *ar, struct sk_buff *skb)
1264 {
1265         struct ar9170_tx_control *txc;
1266         struct ieee80211_tx_info *info;
1267         struct ieee80211_rate *rate = NULL;
1268         struct ieee80211_tx_rate *txrate;
1269         u32 power, chains;
1270
1271         txc = (void *) skb->data;
1272         info = IEEE80211_SKB_CB(skb);
1273         txrate = &info->control.rates[0];
1274
1275         if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1276                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_GREENFIELD);
1277
1278         if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1279                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_PREAMBLE);
1280
1281         if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1282                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ);
1283         /* this works because 40 MHz is 2 and dup is 3 */
1284         if (txrate->flags & IEEE80211_TX_RC_DUP_DATA)
1285                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ_DUP);
1286
1287         if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
1288                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_GI);
1289
1290         if (txrate->flags & IEEE80211_TX_RC_MCS) {
1291                 u32 r = txrate->idx;
1292                 u8 *txpower;
1293
1294                 /* heavy clip control */
1295                 txc->phy_control |= cpu_to_le32((r & 0x7) << 7);
1296
1297                 r <<= AR9170_TX_PHY_MCS_SHIFT;
1298                 BUG_ON(r & ~AR9170_TX_PHY_MCS_MASK);
1299
1300                 txc->phy_control |= cpu_to_le32(r & AR9170_TX_PHY_MCS_MASK);
1301                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_MOD_HT);
1302
1303                 if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
1304                         if (info->band == IEEE80211_BAND_5GHZ)
1305                                 txpower = ar->power_5G_ht40;
1306                         else
1307                                 txpower = ar->power_2G_ht40;
1308                 } else {
1309                         if (info->band == IEEE80211_BAND_5GHZ)
1310                                 txpower = ar->power_5G_ht20;
1311                         else
1312                                 txpower = ar->power_2G_ht20;
1313                 }
1314
1315                 power = txpower[(txrate->idx) & 7];
1316         } else {
1317                 u8 *txpower;
1318                 u32 mod;
1319                 u32 phyrate;
1320                 u8 idx = txrate->idx;
1321
1322                 if (info->band != IEEE80211_BAND_2GHZ) {
1323                         idx += 4;
1324                         txpower = ar->power_5G_leg;
1325                         mod = AR9170_TX_PHY_MOD_OFDM;
1326                 } else {
1327                         if (idx < 4) {
1328                                 txpower = ar->power_2G_cck;
1329                                 mod = AR9170_TX_PHY_MOD_CCK;
1330                         } else {
1331                                 mod = AR9170_TX_PHY_MOD_OFDM;
1332                                 txpower = ar->power_2G_ofdm;
1333                         }
1334                 }
1335
1336                 rate = &__ar9170_ratetable[idx];
1337
1338                 phyrate = rate->hw_value & 0xF;
1339                 power = txpower[(rate->hw_value & 0x30) >> 4];
1340                 phyrate <<= AR9170_TX_PHY_MCS_SHIFT;
1341
1342                 txc->phy_control |= cpu_to_le32(mod);
1343                 txc->phy_control |= cpu_to_le32(phyrate);
1344         }
1345
1346         power <<= AR9170_TX_PHY_TX_PWR_SHIFT;
1347         power &= AR9170_TX_PHY_TX_PWR_MASK;
1348         txc->phy_control |= cpu_to_le32(power);
1349
1350         /* set TX chains */
1351         if (ar->eeprom.tx_mask == 1) {
1352                 chains = AR9170_TX_PHY_TXCHAIN_1;
1353         } else {
1354                 chains = AR9170_TX_PHY_TXCHAIN_2;
1355
1356                 /* >= 36M legacy OFDM - use only one chain */
1357                 if (rate && rate->bitrate >= 360)
1358                         chains = AR9170_TX_PHY_TXCHAIN_1;
1359         }
1360         txc->phy_control |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_SHIFT);
1361 }
1362
1363 static void ar9170_tx(struct ar9170 *ar)
1364 {
1365         struct sk_buff *skb;
1366         unsigned long flags;
1367         struct ieee80211_tx_info *info;
1368         struct ar9170_tx_info *arinfo;
1369         unsigned int i, frames, frames_failed, remaining_space;
1370         int err;
1371         bool schedule_garbagecollector = false;
1372
1373         BUILD_BUG_ON(sizeof(*arinfo) > sizeof(info->rate_driver_data));
1374
1375         if (unlikely(!IS_STARTED(ar)))
1376                 return ;
1377
1378         remaining_space = AR9170_TX_MAX_PENDING;
1379
1380         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
1381                 spin_lock_irqsave(&ar->tx_stats_lock, flags);
1382                 if (ar->tx_stats[i].len >= ar->tx_stats[i].limit) {
1383 #ifdef AR9170_QUEUE_DEBUG
1384                         printk(KERN_DEBUG "%s: queue %d full\n",
1385                                wiphy_name(ar->hw->wiphy), i);
1386
1387                         __ar9170_dump_txstats(ar);
1388                         printk(KERN_DEBUG "stuck frames: ===> \n");
1389                         ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
1390                         ar9170_dump_txqueue(ar, &ar->tx_status[i]);
1391 #endif /* AR9170_QUEUE_DEBUG */
1392                         ieee80211_stop_queue(ar->hw, i);
1393                         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1394                         continue;
1395                 }
1396
1397                 frames = min(ar->tx_stats[i].limit - ar->tx_stats[i].len,
1398                              skb_queue_len(&ar->tx_pending[i]));
1399
1400                 if (remaining_space < frames) {
1401 #ifdef AR9170_QUEUE_DEBUG
1402                         printk(KERN_DEBUG "%s: tx quota reached queue:%d, "
1403                                "remaining slots:%d, needed:%d\n",
1404                                wiphy_name(ar->hw->wiphy), i, remaining_space,
1405                                frames);
1406
1407                         ar9170_dump_txstats(ar);
1408 #endif /* AR9170_QUEUE_DEBUG */
1409                         frames = remaining_space;
1410                 }
1411
1412                 ar->tx_stats[i].len += frames;
1413                 ar->tx_stats[i].count += frames;
1414                 spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1415
1416                 if (!frames)
1417                         continue;
1418
1419                 frames_failed = 0;
1420                 while (frames) {
1421                         skb = skb_dequeue(&ar->tx_pending[i]);
1422                         if (unlikely(!skb)) {
1423                                 frames_failed += frames;
1424                                 frames = 0;
1425                                 break;
1426                         }
1427
1428                         info = IEEE80211_SKB_CB(skb);
1429                         arinfo = (void *) info->rate_driver_data;
1430
1431                         /* TODO: cancel stuck frames */
1432                         arinfo->timeout = jiffies +
1433                                           msecs_to_jiffies(AR9170_TX_TIMEOUT);
1434
1435 #ifdef AR9170_QUEUE_DEBUG
1436                         printk(KERN_DEBUG "%s: send frame q:%d =>\n",
1437                                wiphy_name(ar->hw->wiphy), i);
1438                         ar9170_print_txheader(ar, skb);
1439 #endif /* AR9170_QUEUE_DEBUG */
1440
1441                         err = ar->tx(ar, skb);
1442                         if (unlikely(err)) {
1443                                 frames_failed++;
1444                                 dev_kfree_skb_any(skb);
1445                         } else {
1446                                 remaining_space--;
1447                                 schedule_garbagecollector = true;
1448                         }
1449
1450                         frames--;
1451                 }
1452
1453 #ifdef AR9170_QUEUE_DEBUG
1454                 printk(KERN_DEBUG "%s: ar9170_tx report for queue %d\n",
1455                        wiphy_name(ar->hw->wiphy), i);
1456
1457                 printk(KERN_DEBUG "%s: unprocessed pending frames left:\n",
1458                        wiphy_name(ar->hw->wiphy));
1459                 ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
1460 #endif /* AR9170_QUEUE_DEBUG */
1461
1462                 if (unlikely(frames_failed)) {
1463 #ifdef AR9170_QUEUE_DEBUG
1464                         printk(KERN_DEBUG "%s: frames failed =>\n",
1465                                wiphy_name(ar->hw->wiphy), frames_failed);
1466 #endif /* AR9170_QUEUE_DEBUG */
1467
1468                         spin_lock_irqsave(&ar->tx_stats_lock, flags);
1469                         ar->tx_stats[i].len -= frames_failed;
1470                         ar->tx_stats[i].count -= frames_failed;
1471                         ieee80211_wake_queue(ar->hw, i);
1472                         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1473                 }
1474         }
1475
1476         if (schedule_garbagecollector)
1477                 queue_delayed_work(ar->hw->workqueue,
1478                                    &ar->tx_janitor,
1479                                    msecs_to_jiffies(AR9170_JANITOR_DELAY));
1480 }
1481
1482 int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
1483 {
1484         struct ar9170 *ar = hw->priv;
1485         struct ieee80211_tx_info *info;
1486
1487         if (unlikely(!IS_STARTED(ar)))
1488                 goto err_free;
1489
1490         if (unlikely(ar9170_tx_prepare(ar, skb)))
1491                 goto err_free;
1492
1493         info = IEEE80211_SKB_CB(skb);
1494         if (info->flags & IEEE80211_TX_CTL_AMPDU) {
1495                 /* drop frame, we do not allow TX A-MPDU aggregation yet. */
1496                 goto err_free;
1497         } else {
1498                 unsigned int queue = skb_get_queue_mapping(skb);
1499
1500                 ar9170_tx_prepare_phy(ar, skb);
1501                 skb_queue_tail(&ar->tx_pending[queue], skb);
1502         }
1503
1504         ar9170_tx(ar);
1505         return NETDEV_TX_OK;
1506
1507 err_free:
1508         dev_kfree_skb_any(skb);
1509         return NETDEV_TX_OK;
1510 }
1511
1512 static int ar9170_op_add_interface(struct ieee80211_hw *hw,
1513                                    struct ieee80211_if_init_conf *conf)
1514 {
1515         struct ar9170 *ar = hw->priv;
1516         int err = 0;
1517
1518         mutex_lock(&ar->mutex);
1519
1520         if (ar->vif) {
1521                 err = -EBUSY;
1522                 goto unlock;
1523         }
1524
1525         ar->vif = conf->vif;
1526         memcpy(ar->mac_addr, conf->mac_addr, ETH_ALEN);
1527
1528         if (modparam_nohwcrypt || (ar->vif->type != NL80211_IFTYPE_STATION)) {
1529                 ar->rx_software_decryption = true;
1530                 ar->disable_offload = true;
1531         }
1532
1533         ar->cur_filter = 0;
1534         ar->want_filter = AR9170_MAC_REG_FTF_DEFAULTS;
1535         err = ar9170_update_frame_filter(ar);
1536         if (err)
1537                 goto unlock;
1538
1539         err = ar9170_set_operating_mode(ar);
1540
1541 unlock:
1542         mutex_unlock(&ar->mutex);
1543         return err;
1544 }
1545
1546 static void ar9170_op_remove_interface(struct ieee80211_hw *hw,
1547                                        struct ieee80211_if_init_conf *conf)
1548 {
1549         struct ar9170 *ar = hw->priv;
1550
1551         mutex_lock(&ar->mutex);
1552         ar->vif = NULL;
1553         ar->want_filter = 0;
1554         ar9170_update_frame_filter(ar);
1555         ar9170_set_beacon_timers(ar);
1556         dev_kfree_skb(ar->beacon);
1557         ar->beacon = NULL;
1558         ar->sniffer_enabled = false;
1559         ar->rx_software_decryption = false;
1560         ar9170_set_operating_mode(ar);
1561         mutex_unlock(&ar->mutex);
1562 }
1563
1564 static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
1565 {
1566         struct ar9170 *ar = hw->priv;
1567         int err = 0;
1568
1569         mutex_lock(&ar->mutex);
1570
1571         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
1572                 /* TODO */
1573                 err = 0;
1574         }
1575
1576         if (changed & IEEE80211_CONF_CHANGE_PS) {
1577                 /* TODO */
1578                 err = 0;
1579         }
1580
1581         if (changed & IEEE80211_CONF_CHANGE_POWER) {
1582                 /* TODO */
1583                 err = 0;
1584         }
1585
1586         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
1587                 /*
1588                  * is it long_frame_max_tx_count or short_frame_max_tx_count?
1589                  */
1590
1591                 err = ar9170_set_hwretry_limit(ar,
1592                         ar->hw->conf.long_frame_max_tx_count);
1593                 if (err)
1594                         goto out;
1595         }
1596
1597         if (changed & BSS_CHANGED_BEACON_INT) {
1598                 err = ar9170_set_beacon_timers(ar);
1599                 if (err)
1600                         goto out;
1601         }
1602
1603         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
1604
1605                 /* adjust slot time for 5 GHz */
1606                 err = ar9170_set_slot_time(ar);
1607                 if (err)
1608                         goto out;
1609
1610                 err = ar9170_set_dyn_sifs_ack(ar);
1611                 if (err)
1612                         goto out;
1613
1614                 err = ar9170_set_channel(ar, hw->conf.channel,
1615                                 AR9170_RFI_NONE,
1616                                 nl80211_to_ar9170(hw->conf.channel_type));
1617                 if (err)
1618                         goto out;
1619         }
1620
1621 out:
1622         mutex_unlock(&ar->mutex);
1623         return err;
1624 }
1625
1626 static void ar9170_set_filters(struct work_struct *work)
1627 {
1628         struct ar9170 *ar = container_of(work, struct ar9170,
1629                                          filter_config_work);
1630         int err;
1631
1632         if (unlikely(!IS_STARTED(ar)))
1633                 return ;
1634
1635         mutex_lock(&ar->mutex);
1636         if (test_and_clear_bit(AR9170_FILTER_CHANGED_MODE,
1637                                &ar->filter_changed)) {
1638                 err = ar9170_set_operating_mode(ar);
1639                 if (err)
1640                         goto unlock;
1641         }
1642
1643         if (test_and_clear_bit(AR9170_FILTER_CHANGED_MULTICAST,
1644                                &ar->filter_changed)) {
1645                 err = ar9170_update_multicast(ar);
1646                 if (err)
1647                         goto unlock;
1648         }
1649
1650         if (test_and_clear_bit(AR9170_FILTER_CHANGED_FRAMEFILTER,
1651                                &ar->filter_changed)) {
1652                 err = ar9170_update_frame_filter(ar);
1653                 if (err)
1654                         goto unlock;
1655         }
1656
1657 unlock:
1658         mutex_unlock(&ar->mutex);
1659 }
1660
1661 static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
1662                                        unsigned int changed_flags,
1663                                        unsigned int *new_flags,
1664                                        int mc_count, struct dev_mc_list *mclist)
1665 {
1666         struct ar9170 *ar = hw->priv;
1667
1668         /* mask supported flags */
1669         *new_flags &= FIF_ALLMULTI | FIF_CONTROL | FIF_BCN_PRBRESP_PROMISC |
1670                       FIF_PROMISC_IN_BSS | FIF_FCSFAIL | FIF_PLCPFAIL;
1671         ar->filter_state = *new_flags;
1672         /*
1673          * We can support more by setting the sniffer bit and
1674          * then checking the error flags, later.
1675          */
1676
1677         if (changed_flags & FIF_ALLMULTI) {
1678                 if (*new_flags & FIF_ALLMULTI) {
1679                         ar->want_mc_hash = ~0ULL;
1680                 } else {
1681                         u64 mchash;
1682                         int i;
1683
1684                         /* always get broadcast frames */
1685                         mchash = 1ULL << (0xff >> 2);
1686
1687                         for (i = 0; i < mc_count; i++) {
1688                                 if (WARN_ON(!mclist))
1689                                         break;
1690                                 mchash |= 1ULL << (mclist->dmi_addr[5] >> 2);
1691                                 mclist = mclist->next;
1692                         }
1693                 ar->want_mc_hash = mchash;
1694                 }
1695                 set_bit(AR9170_FILTER_CHANGED_MULTICAST, &ar->filter_changed);
1696         }
1697
1698         if (changed_flags & FIF_CONTROL) {
1699                 u32 filter = AR9170_MAC_REG_FTF_PSPOLL |
1700                              AR9170_MAC_REG_FTF_RTS |
1701                              AR9170_MAC_REG_FTF_CTS |
1702                              AR9170_MAC_REG_FTF_ACK |
1703                              AR9170_MAC_REG_FTF_CFE |
1704                              AR9170_MAC_REG_FTF_CFE_ACK;
1705
1706                 if (*new_flags & FIF_CONTROL)
1707                         ar->want_filter = ar->cur_filter | filter;
1708                 else
1709                         ar->want_filter = ar->cur_filter & ~filter;
1710
1711                 set_bit(AR9170_FILTER_CHANGED_FRAMEFILTER,
1712                         &ar->filter_changed);
1713         }
1714
1715         if (changed_flags & FIF_PROMISC_IN_BSS) {
1716                 ar->sniffer_enabled = ((*new_flags) & FIF_PROMISC_IN_BSS) != 0;
1717                 set_bit(AR9170_FILTER_CHANGED_MODE,
1718                         &ar->filter_changed);
1719         }
1720
1721         if (likely(IS_STARTED(ar)))
1722                 queue_work(ar->hw->workqueue, &ar->filter_config_work);
1723 }
1724
1725 static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
1726                                        struct ieee80211_vif *vif,
1727                                        struct ieee80211_bss_conf *bss_conf,
1728                                        u32 changed)
1729 {
1730         struct ar9170 *ar = hw->priv;
1731         int err = 0;
1732
1733         mutex_lock(&ar->mutex);
1734
1735         if (changed & BSS_CHANGED_BSSID) {
1736                 memcpy(ar->bssid, bss_conf->bssid, ETH_ALEN);
1737                 err = ar9170_set_operating_mode(ar);
1738                 if (err)
1739                         goto out;
1740         }
1741
1742         if (changed & (BSS_CHANGED_BEACON | BSS_CHANGED_BEACON_ENABLED)) {
1743                 err = ar9170_update_beacon(ar);
1744                 if (err)
1745                         goto out;
1746
1747                 err = ar9170_set_beacon_timers(ar);
1748                 if (err)
1749                         goto out;
1750         }
1751
1752         if (changed & BSS_CHANGED_ASSOC) {
1753 #ifndef CONFIG_AR9170_LEDS
1754                 /* enable assoc LED. */
1755                 err = ar9170_set_leds_state(ar, bss_conf->assoc ? 2 : 0);
1756 #endif /* CONFIG_AR9170_LEDS */
1757         }
1758
1759         if (changed & BSS_CHANGED_BEACON_INT) {
1760                 err = ar9170_set_beacon_timers(ar);
1761                 if (err)
1762                         goto out;
1763         }
1764
1765         if (changed & BSS_CHANGED_HT) {
1766                 /* TODO */
1767                 err = 0;
1768         }
1769
1770         if (changed & BSS_CHANGED_ERP_SLOT) {
1771                 err = ar9170_set_slot_time(ar);
1772                 if (err)
1773                         goto out;
1774         }
1775
1776         if (changed & BSS_CHANGED_BASIC_RATES) {
1777                 err = ar9170_set_basic_rates(ar);
1778                 if (err)
1779                         goto out;
1780         }
1781
1782 out:
1783         mutex_unlock(&ar->mutex);
1784 }
1785
1786 static u64 ar9170_op_get_tsf(struct ieee80211_hw *hw)
1787 {
1788         struct ar9170 *ar = hw->priv;
1789         int err;
1790         u32 tsf_low;
1791         u32 tsf_high;
1792         u64 tsf;
1793
1794         mutex_lock(&ar->mutex);
1795         err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_L, &tsf_low);
1796         if (!err)
1797                 err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_H, &tsf_high);
1798         mutex_unlock(&ar->mutex);
1799
1800         if (WARN_ON(err))
1801                 return 0;
1802
1803         tsf = tsf_high;
1804         tsf = (tsf << 32) | tsf_low;
1805         return tsf;
1806 }
1807
1808 static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
1809                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
1810                           struct ieee80211_key_conf *key)
1811 {
1812         struct ar9170 *ar = hw->priv;
1813         int err = 0, i;
1814         u8 ktype;
1815
1816         if ((!ar->vif) || (ar->disable_offload))
1817                 return -EOPNOTSUPP;
1818
1819         switch (key->alg) {
1820         case ALG_WEP:
1821                 if (key->keylen == WLAN_KEY_LEN_WEP40)
1822                         ktype = AR9170_ENC_ALG_WEP64;
1823                 else
1824                         ktype = AR9170_ENC_ALG_WEP128;
1825                 break;
1826         case ALG_TKIP:
1827                 ktype = AR9170_ENC_ALG_TKIP;
1828                 break;
1829         case ALG_CCMP:
1830                 ktype = AR9170_ENC_ALG_AESCCMP;
1831                 break;
1832         default:
1833                 return -EOPNOTSUPP;
1834         }
1835
1836         mutex_lock(&ar->mutex);
1837         if (cmd == SET_KEY) {
1838                 if (unlikely(!IS_STARTED(ar))) {
1839                         err = -EOPNOTSUPP;
1840                         goto out;
1841                 }
1842
1843                 /* group keys need all-zeroes address */
1844                 if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1845                         sta = NULL;
1846
1847                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
1848                         for (i = 0; i < 64; i++)
1849                                 if (!(ar->usedkeys & BIT(i)))
1850                                         break;
1851                         if (i == 64) {
1852                                 ar->rx_software_decryption = true;
1853                                 ar9170_set_operating_mode(ar);
1854                                 err = -ENOSPC;
1855                                 goto out;
1856                         }
1857                 } else {
1858                         i = 64 + key->keyidx;
1859                 }
1860
1861                 key->hw_key_idx = i;
1862
1863                 err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL, ktype, 0,
1864                                         key->key, min_t(u8, 16, key->keylen));
1865                 if (err)
1866                         goto out;
1867
1868                 if (key->alg == ALG_TKIP) {
1869                         err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL,
1870                                                 ktype, 1, key->key + 16, 16);
1871                         if (err)
1872                                 goto out;
1873
1874                         /*
1875                          * hardware is not capable generating the MMIC
1876                          * for fragmented frames!
1877                          */
1878                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
1879                 }
1880
1881                 if (i < 64)
1882                         ar->usedkeys |= BIT(i);
1883
1884                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
1885         } else {
1886                 if (unlikely(!IS_STARTED(ar))) {
1887                         /* The device is gone... together with the key ;-) */
1888                         err = 0;
1889                         goto out;
1890                 }
1891
1892                 err = ar9170_disable_key(ar, key->hw_key_idx);
1893                 if (err)
1894                         goto out;
1895
1896                 if (key->hw_key_idx < 64) {
1897                         ar->usedkeys &= ~BIT(key->hw_key_idx);
1898                 } else {
1899                         err = ar9170_upload_key(ar, key->hw_key_idx, NULL,
1900                                                 AR9170_ENC_ALG_NONE, 0,
1901                                                 NULL, 0);
1902                         if (err)
1903                                 goto out;
1904
1905                         if (key->alg == ALG_TKIP) {
1906                                 err = ar9170_upload_key(ar, key->hw_key_idx,
1907                                                         NULL,
1908                                                         AR9170_ENC_ALG_NONE, 1,
1909                                                         NULL, 0);
1910                                 if (err)
1911                                         goto out;
1912                         }
1913
1914                 }
1915         }
1916
1917         ar9170_regwrite_begin(ar);
1918         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_L, ar->usedkeys);
1919         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_H, ar->usedkeys >> 32);
1920         ar9170_regwrite_finish();
1921         err = ar9170_regwrite_result();
1922
1923 out:
1924         mutex_unlock(&ar->mutex);
1925
1926         return err;
1927 }
1928
1929 static void ar9170_sta_notify(struct ieee80211_hw *hw,
1930                               struct ieee80211_vif *vif,
1931                               enum sta_notify_cmd cmd,
1932                               struct ieee80211_sta *sta)
1933 {
1934 }
1935
1936 static int ar9170_get_stats(struct ieee80211_hw *hw,
1937                             struct ieee80211_low_level_stats *stats)
1938 {
1939         struct ar9170 *ar = hw->priv;
1940         u32 val;
1941         int err;
1942
1943         mutex_lock(&ar->mutex);
1944         err = ar9170_read_reg(ar, AR9170_MAC_REG_TX_RETRY, &val);
1945         ar->stats.dot11ACKFailureCount += val;
1946
1947         memcpy(stats, &ar->stats, sizeof(*stats));
1948         mutex_unlock(&ar->mutex);
1949
1950         return 0;
1951 }
1952
1953 static int ar9170_get_tx_stats(struct ieee80211_hw *hw,
1954                                struct ieee80211_tx_queue_stats *tx_stats)
1955 {
1956         struct ar9170 *ar = hw->priv;
1957
1958         spin_lock_bh(&ar->tx_stats_lock);
1959         memcpy(tx_stats, ar->tx_stats, sizeof(tx_stats[0]) * hw->queues);
1960         spin_unlock_bh(&ar->tx_stats_lock);
1961
1962         return 0;
1963 }
1964
1965 static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
1966                           const struct ieee80211_tx_queue_params *param)
1967 {
1968         struct ar9170 *ar = hw->priv;
1969         int ret;
1970
1971         mutex_lock(&ar->mutex);
1972         if ((param) && !(queue > __AR9170_NUM_TXQ)) {
1973                 memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
1974                        param, sizeof(*param));
1975
1976                 ret = ar9170_set_qos(ar);
1977         } else
1978                 ret = -EINVAL;
1979
1980         mutex_unlock(&ar->mutex);
1981         return ret;
1982 }
1983
1984 static int ar9170_ampdu_action(struct ieee80211_hw *hw,
1985                                enum ieee80211_ampdu_mlme_action action,
1986                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
1987 {
1988         switch (action) {
1989         case IEEE80211_AMPDU_RX_START:
1990         case IEEE80211_AMPDU_RX_STOP:
1991                 /*
1992                  * Something goes wrong -- RX locks up
1993                  * after a while of receiving aggregated
1994                  * frames -- not enabling for now.
1995                  */
1996                 return -EOPNOTSUPP;
1997         default:
1998                 return -EOPNOTSUPP;
1999         }
2000 }
2001
2002 static const struct ieee80211_ops ar9170_ops = {
2003         .start                  = ar9170_op_start,
2004         .stop                   = ar9170_op_stop,
2005         .tx                     = ar9170_op_tx,
2006         .add_interface          = ar9170_op_add_interface,
2007         .remove_interface       = ar9170_op_remove_interface,
2008         .config                 = ar9170_op_config,
2009         .configure_filter       = ar9170_op_configure_filter,
2010         .conf_tx                = ar9170_conf_tx,
2011         .bss_info_changed       = ar9170_op_bss_info_changed,
2012         .get_tsf                = ar9170_op_get_tsf,
2013         .set_key                = ar9170_set_key,
2014         .sta_notify             = ar9170_sta_notify,
2015         .get_stats              = ar9170_get_stats,
2016         .get_tx_stats           = ar9170_get_tx_stats,
2017         .ampdu_action           = ar9170_ampdu_action,
2018 };
2019
2020 void *ar9170_alloc(size_t priv_size)
2021 {
2022         struct ieee80211_hw *hw;
2023         struct ar9170 *ar;
2024         struct sk_buff *skb;
2025         int i;
2026
2027         /*
2028          * this buffer is used for rx stream reconstruction.
2029          * Under heavy load this device (or the transport layer?)
2030          * tends to split the streams into seperate rx descriptors.
2031          */
2032
2033         skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL);
2034         if (!skb)
2035                 goto err_nomem;
2036
2037         hw = ieee80211_alloc_hw(priv_size, &ar9170_ops);
2038         if (!hw)
2039                 goto err_nomem;
2040
2041         ar = hw->priv;
2042         ar->hw = hw;
2043         ar->rx_failover = skb;
2044
2045         mutex_init(&ar->mutex);
2046         spin_lock_init(&ar->cmdlock);
2047         spin_lock_init(&ar->tx_stats_lock);
2048         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
2049                 skb_queue_head_init(&ar->tx_status[i]);
2050                 skb_queue_head_init(&ar->tx_pending[i]);
2051         }
2052         ar9170_rx_reset_rx_mpdu(ar);
2053         INIT_WORK(&ar->filter_config_work, ar9170_set_filters);
2054         INIT_WORK(&ar->beacon_work, ar9170_new_beacon);
2055         INIT_DELAYED_WORK(&ar->tx_janitor, ar9170_tx_janitor);
2056
2057         /* all hw supports 2.4 GHz, so set channel to 1 by default */
2058         ar->channel = &ar9170_2ghz_chantable[0];
2059
2060         /* first part of wiphy init */
2061         ar->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
2062                                          BIT(NL80211_IFTYPE_WDS) |
2063                                          BIT(NL80211_IFTYPE_ADHOC);
2064         ar->hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
2065                          IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
2066                          IEEE80211_HW_SIGNAL_DBM |
2067                          IEEE80211_HW_NOISE_DBM;
2068
2069         ar->hw->queues = __AR9170_NUM_TXQ;
2070         ar->hw->extra_tx_headroom = 8;
2071         ar->hw->sta_data_size = sizeof(struct ar9170_sta_info);
2072
2073         ar->hw->max_rates = 1;
2074         ar->hw->max_rate_tries = 3;
2075
2076         for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
2077                 ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
2078
2079         return ar;
2080
2081 err_nomem:
2082         kfree_skb(skb);
2083         return ERR_PTR(-ENOMEM);
2084 }
2085
2086 static int ar9170_read_eeprom(struct ar9170 *ar)
2087 {
2088 #define RW      8       /* number of words to read at once */
2089 #define RB      (sizeof(u32) * RW)
2090         DECLARE_MAC_BUF(mbuf);
2091         u8 *eeprom = (void *)&ar->eeprom;
2092         u8 *addr = ar->eeprom.mac_address;
2093         __le32 offsets[RW];
2094         int i, j, err, bands = 0;
2095
2096         BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
2097
2098         BUILD_BUG_ON(RB > AR9170_MAX_CMD_LEN - 4);
2099 #ifndef __CHECKER__
2100         /* don't want to handle trailing remains */
2101         BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
2102 #endif
2103
2104         for (i = 0; i < sizeof(ar->eeprom)/RB; i++) {
2105                 for (j = 0; j < RW; j++)
2106                         offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
2107                                                  RB * i + 4 * j);
2108
2109                 err = ar->exec_cmd(ar, AR9170_CMD_RREG,
2110                                    RB, (u8 *) &offsets,
2111                                    RB, eeprom + RB * i);
2112                 if (err)
2113                         return err;
2114         }
2115
2116 #undef RW
2117 #undef RB
2118
2119         if (ar->eeprom.length == cpu_to_le16(0xFFFF))
2120                 return -ENODATA;
2121
2122         if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
2123                 ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar9170_band_2GHz;
2124                 bands++;
2125         }
2126         if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
2127                 ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &ar9170_band_5GHz;
2128                 bands++;
2129         }
2130         /*
2131          * I measured this, a bandswitch takes roughly
2132          * 135 ms and a frequency switch about 80.
2133          *
2134          * FIXME: measure these values again once EEPROM settings
2135          *        are used, that will influence them!
2136          */
2137         if (bands == 2)
2138                 ar->hw->channel_change_time = 135 * 1000;
2139         else
2140                 ar->hw->channel_change_time = 80 * 1000;
2141
2142         ar->regulatory.current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
2143         ar->regulatory.current_rd_ext = le16_to_cpu(ar->eeprom.reg_domain[1]);
2144
2145         /* second part of wiphy init */
2146         SET_IEEE80211_PERM_ADDR(ar->hw, addr);
2147
2148         return bands ? 0 : -EINVAL;
2149 }
2150
2151 static int ar9170_reg_notifier(struct wiphy *wiphy,
2152                         struct regulatory_request *request)
2153 {
2154         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
2155         struct ar9170 *ar = hw->priv;
2156
2157         return ath_reg_notifier_apply(wiphy, request, &ar->regulatory);
2158 }
2159
2160 int ar9170_register(struct ar9170 *ar, struct device *pdev)
2161 {
2162         int err;
2163
2164         /* try to read EEPROM, init MAC addr */
2165         err = ar9170_read_eeprom(ar);
2166         if (err)
2167                 goto err_out;
2168
2169         err = ath_regd_init(&ar->regulatory, ar->hw->wiphy,
2170                             ar9170_reg_notifier);
2171         if (err)
2172                 goto err_out;
2173
2174         err = ieee80211_register_hw(ar->hw);
2175         if (err)
2176                 goto err_out;
2177
2178         if (!ath_is_world_regd(&ar->regulatory))
2179                 regulatory_hint(ar->hw->wiphy, ar->regulatory.alpha2);
2180
2181         err = ar9170_init_leds(ar);
2182         if (err)
2183                 goto err_unreg;
2184
2185 #ifdef CONFIG_AR9170_LEDS
2186         err = ar9170_register_leds(ar);
2187         if (err)
2188                 goto err_unreg;
2189 #endif /* CONFIG_AR9170_LEDS */
2190
2191         dev_info(pdev, "Atheros AR9170 is registered as '%s'\n",
2192                  wiphy_name(ar->hw->wiphy));
2193
2194         return err;
2195
2196 err_unreg:
2197         ieee80211_unregister_hw(ar->hw);
2198
2199 err_out:
2200         return err;
2201 }
2202
2203 void ar9170_unregister(struct ar9170 *ar)
2204 {
2205 #ifdef CONFIG_AR9170_LEDS
2206         ar9170_unregister_leds(ar);
2207 #endif /* CONFIG_AR9170_LEDS */
2208
2209         kfree_skb(ar->rx_failover);
2210         ieee80211_unregister_hw(ar->hw);
2211         mutex_destroy(&ar->mutex);
2212 }