SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/net/wireless/ath/ar9170/main.c

   1 /*
   2  * Atheros AR9170 driver
   3  *
   4  * mac80211 interaction code
   5  *
   6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright 2009, Christian Lamparter <chunkeey@web.de>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; see the file COPYING.  If not, see
  21  * http://www.gnu.org/licenses/.
  22  *
  23  * This file incorporates work covered by the following copyright and
  24  * permission notice:
  25  *    Copyright (c) 2007-2008 Atheros Communications, Inc.
  26  *
  27  *    Permission to use, copy, modify, and/or distribute this software for any
  28  *    purpose with or without fee is hereby granted, provided that the above
  29  *    copyright notice and this permission notice appear in all copies.
  30  *
  31  *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  32  *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  33  *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  34  *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  35  *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  36  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  37  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  38  */
  39
  40 #include <linux/init.h>
  41 #include <linux/module.h>
  42 #include <linux/etherdevice.h>
  43 #include <net/mac80211.h>
  44 #include "ar9170.h"
  45 #include "hw.h"
  46 #include "cmd.h"
  47
  48 static int modparam_nohwcrypt;
  49 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
  50 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  51
  52 #define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
  53         .bitrate        = (_bitrate),                   \
  54         .flags          = (_flags),                     \
  55         .hw_value       = (_hw_rate) | (_txpidx) << 4,  \
  56 }
  57
  58 static struct ieee80211_rate __ar9170_ratetable[] = {
  59         RATE(10, 0, 0, 0),
  60         RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
  61         RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
  62         RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
  63         RATE(60, 0xb, 0, 0),
  64         RATE(90, 0xf, 0, 0),
  65         RATE(120, 0xa, 0, 0),
  66         RATE(180, 0xe, 0, 0),
  67         RATE(240, 0x9, 0, 0),
  68         RATE(360, 0xd, 1, 0),
  69         RATE(480, 0x8, 2, 0),
  70         RATE(540, 0xc, 3, 0),
  71 };
  72 #undef RATE
  73
  74 #define ar9170_g_ratetable      (__ar9170_ratetable + 0)
  75 #define ar9170_g_ratetable_size 12
  76 #define ar9170_a_ratetable      (__ar9170_ratetable + 4)
  77 #define ar9170_a_ratetable_size 8
  78
  79 /*
  80  * NB: The hw_value is used as an index into the ar9170_phy_freq_params
  81  *     array in phy.c so that we don't have to do frequency lookups!
  82  */
  83 #define CHAN(_freq, _idx) {             \
  84         .center_freq    = (_freq),      \
  85         .hw_value       = (_idx),       \
  86         .max_power      = 18, /* XXX */ \
  87 }
  88
  89 static struct ieee80211_channel ar9170_2ghz_chantable[] = {
  90         CHAN(2412,  0),
  91         CHAN(2417,  1),
  92         CHAN(2422,  2),
  93         CHAN(2427,  3),
  94         CHAN(2432,  4),
  95         CHAN(2437,  5),
  96         CHAN(2442,  6),
  97         CHAN(2447,  7),
  98         CHAN(2452,  8),
  99         CHAN(2457,  9),
 100         CHAN(2462, 10),
 101         CHAN(2467, 11),
 102         CHAN(2472, 12),
 103         CHAN(2484, 13),
 104 };
 105
 106 static struct ieee80211_channel ar9170_5ghz_chantable[] = {
 107         CHAN(4920, 14),
 108         CHAN(4940, 15),
 109         CHAN(4960, 16),
 110         CHAN(4980, 17),
 111         CHAN(5040, 18),
 112         CHAN(5060, 19),
 113         CHAN(5080, 20),
 114         CHAN(5180, 21),
 115         CHAN(5200, 22),
 116         CHAN(5220, 23),
 117         CHAN(5240, 24),
 118         CHAN(5260, 25),
 119         CHAN(5280, 26),
 120         CHAN(5300, 27),
 121         CHAN(5320, 28),
 122         CHAN(5500, 29),
 123         CHAN(5520, 30),
 124         CHAN(5540, 31),
 125         CHAN(5560, 32),
 126         CHAN(5580, 33),
 127         CHAN(5600, 34),
 128         CHAN(5620, 35),
 129         CHAN(5640, 36),
 130         CHAN(5660, 37),
 131         CHAN(5680, 38),
 132         CHAN(5700, 39),
 133         CHAN(5745, 40),
 134         CHAN(5765, 41),
 135         CHAN(5785, 42),
 136         CHAN(5805, 43),
 137         CHAN(5825, 44),
 138         CHAN(5170, 45),
 139         CHAN(5190, 46),
 140         CHAN(5210, 47),
 141         CHAN(5230, 48),
 142 };
 143 #undef CHAN
 144
 145 #define AR9170_HT_CAP                                                   \
 146 {                                                                       \
 147         .ht_supported   = true,                                         \
 148         .cap            = IEEE80211_HT_CAP_MAX_AMSDU |                  \
 149                           IEEE80211_HT_CAP_SUP_WIDTH_20_40 |            \
 150                           IEEE80211_HT_CAP_SGI_40 |                     \
 151                           IEEE80211_HT_CAP_DSSSCCK40 |                  \
 152                           IEEE80211_HT_CAP_SM_PS,                       \
 153         .ampdu_factor   = 3,                                            \
 154         .ampdu_density  = 6,                                            \
 155         .mcs            = {                                             \
 156                 .rx_mask = { 0xFF, 0xFF, 0, 0, 0, 0, 0, 0, 0, 0, },     \
 157         },                                                              \
 158 }
 159
 160 static struct ieee80211_supported_band ar9170_band_2GHz = {
 161         .channels       = ar9170_2ghz_chantable,
 162         .n_channels     = ARRAY_SIZE(ar9170_2ghz_chantable),
 163         .bitrates       = ar9170_g_ratetable,
 164         .n_bitrates     = ar9170_g_ratetable_size,
 165         .ht_cap         = AR9170_HT_CAP,
 166 };
 167
 168 static struct ieee80211_supported_band ar9170_band_5GHz = {
 169         .channels       = ar9170_5ghz_chantable,
 170         .n_channels     = ARRAY_SIZE(ar9170_5ghz_chantable),
 171         .bitrates       = ar9170_a_ratetable,
 172         .n_bitrates     = ar9170_a_ratetable_size,
 173         .ht_cap         = AR9170_HT_CAP,
 174 };
 175
 176 #ifdef AR9170_QUEUE_DEBUG
 177 /*
 178  * In case some wants works with AR9170's crazy tx_status queueing techniques.
 179  * He might need this rather useful probing function.
 180  *
 181  * NOTE: caller must hold the queue's spinlock!
 182  */
 183
 184 static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
 185 {
 186         struct ar9170_tx_control *txc = (void *) skb->data;
 187         struct ieee80211_hdr *hdr = (void *)txc->frame_data;
 188
 189         printk(KERN_DEBUG "%s: => FRAME [skb:%p, queue:%d, DA:[%pM] "
 190                           "mac_control:%04x, phy_control:%08x]\n",
 191                wiphy_name(ar->hw->wiphy), skb, skb_get_queue_mapping(skb),
 192                ieee80211_get_DA(hdr), le16_to_cpu(txc->mac_control),
 193                le32_to_cpu(txc->phy_control));
 194 }
 195
 196 static void ar9170_dump_station_tx_status_queue(struct ar9170 *ar,
 197                                                 struct sk_buff_head *queue)
 198 {
 199         struct sk_buff *skb;
 200         int i = 0;
 201
 202         printk(KERN_DEBUG "---[ cut here ]---\n");
 203         printk(KERN_DEBUG "%s: %d entries in tx_status queue.\n",
 204                wiphy_name(ar->hw->wiphy), skb_queue_len(queue));
 205
 206         skb_queue_walk(queue, skb) {
 207                 struct ar9170_tx_control *txc = (void *) skb->data;
 208                 struct ieee80211_hdr *hdr = (void *)txc->frame_data;
 209
 210                 printk(KERN_DEBUG "index:%d => \n", i);
 211                 ar9170_print_txheader(ar, skb);
 212         }
 213         printk(KERN_DEBUG "---[ end ]---\n");
 214 }
 215 #endif /* AR9170_QUEUE_DEBUG */
 216
 217 void ar9170_handle_tx_status(struct ar9170 *ar, struct sk_buff *skb,
 218                              bool valid_status, u16 tx_status)
 219 {
 220         struct ieee80211_tx_info *txinfo;
 221         unsigned int retries = 0, queue = skb_get_queue_mapping(skb);
 222         unsigned long flags;
 223
 224         spin_lock_irqsave(&ar->tx_stats_lock, flags);
 225         ar->tx_stats[queue].len--;
 226         if (ieee80211_queue_stopped(ar->hw, queue))
 227                 ieee80211_wake_queue(ar->hw, queue);
 228         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 229
 230         txinfo = IEEE80211_SKB_CB(skb);
 231         ieee80211_tx_info_clear_status(txinfo);
 232
 233         switch (tx_status) {
 234         case AR9170_TX_STATUS_RETRY:
 235                 retries = 2;
 236         case AR9170_TX_STATUS_COMPLETE:
 237                 txinfo->flags |= IEEE80211_TX_STAT_ACK;
 238                 break;
 239
 240         case AR9170_TX_STATUS_FAILED:
 241                 retries = ar->hw->conf.long_frame_max_tx_count;
 242                 break;
 243
 244         default:
 245                 printk(KERN_ERR "%s: invalid tx_status response (%x).\n",
 246                        wiphy_name(ar->hw->wiphy), tx_status);
 247                 break;
 248         }
 249
 250         if (valid_status)
 251                 txinfo->status.rates[0].count = retries + 1;
 252
 253         skb_pull(skb, sizeof(struct ar9170_tx_control));
 254         ieee80211_tx_status_irqsafe(ar->hw, skb);
 255 }
 256
 257 static struct sk_buff *ar9170_find_skb_in_queue(struct ar9170 *ar,
 258                                                 const u8 *mac,
 259                                                 const u32 queue,
 260                                                 struct sk_buff_head *q)
 261 {
 262         unsigned long flags;
 263         struct sk_buff *skb;
 264
 265         spin_lock_irqsave(&q->lock, flags);
 266         skb_queue_walk(q, skb) {
 267                 struct ar9170_tx_control *txc = (void *) skb->data;
 268                 struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 269                 u32 txc_queue = (le32_to_cpu(txc->phy_control) &
 270                                 AR9170_TX_PHY_QOS_MASK) >>
 271                                 AR9170_TX_PHY_QOS_SHIFT;
 272
 273                 if  ((queue != txc_queue) ||
 274                      (compare_ether_addr(ieee80211_get_DA(hdr), mac)))
 275                         continue;
 276
 277                 __skb_unlink(skb, q);
 278                 spin_unlock_irqrestore(&q->lock, flags);
 279                 return skb;
 280         }
 281         spin_unlock_irqrestore(&q->lock, flags);
 282         return NULL;
 283 }
 284
 285 static struct sk_buff *ar9170_find_queued_skb(struct ar9170 *ar, const u8 *mac,
 286                                               const u32 queue)
 287 {
 288         struct ieee80211_sta *sta;
 289         struct sk_buff *skb;
 290
 291         /*
 292          * Unfortunately, the firmware does not tell to which (queued) frame
 293          * this transmission status report belongs to.
 294          *
 295          * So we have to make risky guesses - with the scarce information
 296          * the firmware provided (-> destination MAC, and phy_control) -
 297          * and hope that we picked the right one...
 298          */
 299         rcu_read_lock();
 300         sta = ieee80211_find_sta(ar->hw, mac);
 301
 302         if (likely(sta)) {
 303                 struct ar9170_sta_info *sta_priv = (void *) sta->drv_priv;
 304                 skb = skb_dequeue(&sta_priv->tx_status[queue]);
 305                 rcu_read_unlock();
 306                 if (likely(skb))
 307                         return skb;
 308         } else
 309                 rcu_read_unlock();
 310
 311         /* scan the waste queue for candidates */
 312         skb = ar9170_find_skb_in_queue(ar, mac, queue,
 313                                        &ar->global_tx_status_waste);
 314         if (!skb) {
 315                 /* so it still _must_ be in the global list. */
 316                 skb = ar9170_find_skb_in_queue(ar, mac, queue,
 317                                                &ar->global_tx_status);
 318         }
 319
 320 #ifdef AR9170_QUEUE_DEBUG
 321         if (unlikely((!skb) && net_ratelimit())) {
 322                 printk(KERN_ERR "%s: ESS:[%pM] does not have any "
 323                                 "outstanding frames in this queue (%d).\n",
 324                                 wiphy_name(ar->hw->wiphy), mac, queue);
 325         }
 326 #endif /* AR9170_QUEUE_DEBUG */
 327         return skb;
 328 }
 329
 330 /*
 331  * This worker tries to keep the global tx_status queue empty.
 332  * So we can guarantee that incoming tx_status reports for
 333  * unregistered stations are always synced with the actual
 334  * frame - which we think - belongs to.
 335  */
 336
 337 static void ar9170_tx_status_janitor(struct work_struct *work)
 338 {
 339         struct ar9170 *ar = container_of(work, struct ar9170,
 340                                          tx_status_janitor.work);
 341         struct sk_buff *skb;
 342
 343         if (unlikely(!IS_STARTED(ar)))
 344                 return ;
 345
 346         /* recycle the garbage back to mac80211... one by one. */
 347         while ((skb = skb_dequeue(&ar->global_tx_status_waste))) {
 348 #ifdef AR9170_QUEUE_DEBUG
 349                 printk(KERN_DEBUG "%s: dispose queued frame =>\n",
 350                        wiphy_name(ar->hw->wiphy));
 351                 ar9170_print_txheader(ar, skb);
 352 #endif /* AR9170_QUEUE_DEBUG */
 353                 ar9170_handle_tx_status(ar, skb, false,
 354                                         AR9170_TX_STATUS_FAILED);
 355         }
 356
 357         while ((skb = skb_dequeue(&ar->global_tx_status))) {
 358 #ifdef AR9170_QUEUE_DEBUG
 359                 printk(KERN_DEBUG "%s: moving frame into waste queue =>\n",
 360                        wiphy_name(ar->hw->wiphy));
 361
 362                 ar9170_print_txheader(ar, skb);
 363 #endif /* AR9170_QUEUE_DEBUG */
 364                 skb_queue_tail(&ar->global_tx_status_waste, skb);
 365         }
 366
 367         /* recall the janitor in 100ms - if there's garbage in the can. */
 368         if (skb_queue_len(&ar->global_tx_status_waste) > 0)
 369                 queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
 370                                    msecs_to_jiffies(100));
 371 }
 372
 373 void ar9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len)
 374 {
 375         struct ar9170_cmd_response *cmd = (void *) buf;
 376
 377         if ((cmd->type & 0xc0) != 0xc0) {
 378                 ar->callback_cmd(ar, len, buf);
 379                 return;
 380         }
 381
 382         /* hardware event handlers */
 383         switch (cmd->type) {
 384         case 0xc1: {
 385                 /*
 386                  * TX status notification:
 387                  * bytes: 0c c1 XX YY M1 M2 M3 M4 M5 M6 R4 R3 R2 R1 S2 S1
 388                  *
 389                  * XX always 81
 390                  * YY always 00
 391                  * M1-M6 is the MAC address
 392                  * R1-R4 is the transmit rate
 393                  * S1-S2 is the transmit status
 394                  */
 395
 396                 struct sk_buff *skb;
 397                 u32 queue = (le32_to_cpu(cmd->tx_status.rate) &
 398                             AR9170_TX_PHY_QOS_MASK) >> AR9170_TX_PHY_QOS_SHIFT;
 399
 400                 skb = ar9170_find_queued_skb(ar, cmd->tx_status.dst, queue);
 401                 if (unlikely(!skb))
 402                         return ;
 403
 404                 ar9170_handle_tx_status(ar, skb, true,
 405                                         le16_to_cpu(cmd->tx_status.status));
 406                 break;
 407                 }
 408
 409         case 0xc0:
 410                 /*
 411                  * pre-TBTT event
 412                  */
 413                 if (ar->vif && ar->vif->type == NL80211_IFTYPE_AP)
 414                         queue_work(ar->hw->workqueue, &ar->beacon_work);
 415                 break;
 416
 417         case 0xc2:
 418                 /*
 419                  * (IBSS) beacon send notification
 420                  * bytes: 04 c2 XX YY B4 B3 B2 B1
 421                  *
 422                  * XX always 80
 423                  * YY always 00
 424                  * B1-B4 "should" be the number of send out beacons.
 425                  */
 426                 break;
 427
 428         case 0xc3:
 429                 /* End of Atim Window */
 430                 break;
 431
 432         case 0xc4:
 433         case 0xc5:
 434                 /* BlockACK events */
 435                 break;
 436
 437         case 0xc6:
 438                 /* Watchdog Interrupt */
 439                 break;
 440
 441         case 0xc9:
 442                 /* retransmission issue / SIFS/EIFS collision ?! */
 443                 break;
 444
 445         default:
 446                 printk(KERN_INFO "received unhandled event %x\n", cmd->type);
 447                 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
 448                 break;
 449         }
 450 }
 451
 452 static void ar9170_rx_reset_rx_mpdu(struct ar9170 *ar)
 453 {
 454         memset(&ar->rx_mpdu.plcp, 0, sizeof(struct ar9170_rx_head));
 455         ar->rx_mpdu.has_plcp = false;
 456 }
 457
 458 static int ar9170_nag_limiter(struct ar9170 *ar)
 459 {
 460         bool print_message;
 461
 462         /*
 463          * we expect all sorts of errors in promiscuous mode.
 464          * don't bother with it, it's OK!
 465          */
 466         if (ar->sniffer_enabled)
 467                 return false;
 468
 469         /*
 470          * only go for frequent errors! The hardware tends to
 471          * do some stupid thing once in a while under load, in
 472          * noisy environments or just for fun!
 473          */
 474         if (time_before(jiffies, ar->bad_hw_nagger) && net_ratelimit())
 475                 print_message = true;
 476         else
 477                 print_message = false;
 478
 479         /* reset threshold for "once in a while" */
 480         ar->bad_hw_nagger = jiffies + HZ / 4;
 481         return print_message;
 482 }
 483
 484 static int ar9170_rx_mac_status(struct ar9170 *ar,
 485                                 struct ar9170_rx_head *head,
 486                                 struct ar9170_rx_macstatus *mac,
 487                                 struct ieee80211_rx_status *status)
 488 {
 489         u8 error, decrypt;
 490
 491         BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
 492         BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4);
 493
 494         error = mac->error;
 495         if (error & AR9170_RX_ERROR_MMIC) {
 496                 status->flag |= RX_FLAG_MMIC_ERROR;
 497                 error &= ~AR9170_RX_ERROR_MMIC;
 498         }
 499
 500         if (error & AR9170_RX_ERROR_PLCP) {
 501                 status->flag |= RX_FLAG_FAILED_PLCP_CRC;
 502                 error &= ~AR9170_RX_ERROR_PLCP;
 503
 504                 if (!(ar->filter_state & FIF_PLCPFAIL))
 505                         return -EINVAL;
 506         }
 507
 508         if (error & AR9170_RX_ERROR_FCS) {
 509                 status->flag |= RX_FLAG_FAILED_FCS_CRC;
 510                 error &= ~AR9170_RX_ERROR_FCS;
 511
 512                 if (!(ar->filter_state & FIF_FCSFAIL))
 513                         return -EINVAL;
 514         }
 515
 516         decrypt = ar9170_get_decrypt_type(mac);
 517         if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
 518             decrypt != AR9170_ENC_ALG_NONE)
 519                 status->flag |= RX_FLAG_DECRYPTED;
 520
 521         /* ignore wrong RA errors */
 522         error &= ~AR9170_RX_ERROR_WRONG_RA;
 523
 524         if (error & AR9170_RX_ERROR_DECRYPT) {
 525                 error &= ~AR9170_RX_ERROR_DECRYPT;
 526                 /*
 527                  * Rx decryption is done in place,
 528                  * the original data is lost anyway.
 529                  */
 530
 531                 return -EINVAL;
 532         }
 533
 534         /* drop any other error frames */
 535         if (unlikely(error)) {
 536                 /* TODO: update netdevice's RX dropped/errors statistics */
 537
 538                 if (ar9170_nag_limiter(ar))
 539                         printk(KERN_DEBUG "%s: received frame with "
 540                                "suspicious error code (%#x).\n",
 541                                wiphy_name(ar->hw->wiphy), error);
 542
 543                 return -EINVAL;
 544         }
 545
 546         status->band = ar->channel->band;
 547         status->freq = ar->channel->center_freq;
 548
 549         switch (mac->status & AR9170_RX_STATUS_MODULATION_MASK) {
 550         case AR9170_RX_STATUS_MODULATION_CCK:
 551                 if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
 552                         status->flag |= RX_FLAG_SHORTPRE;
 553                 switch (head->plcp[0]) {
 554                 case 0x0a:
 555                         status->rate_idx = 0;
 556                         break;
 557                 case 0x14:
 558                         status->rate_idx = 1;
 559                         break;
 560                 case 0x37:
 561                         status->rate_idx = 2;
 562                         break;
 563                 case 0x6e:
 564                         status->rate_idx = 3;
 565                         break;
 566                 default:
 567                         if (ar9170_nag_limiter(ar))
 568                                 printk(KERN_ERR "%s: invalid plcp cck rate "
 569                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 570                                        head->plcp[0]);
 571                         return -EINVAL;
 572                 }
 573                 break;
 574
 575         case AR9170_RX_STATUS_MODULATION_OFDM:
 576                 switch (head->plcp[0] & 0xf) {
 577                 case 0xb:
 578                         status->rate_idx = 0;
 579                         break;
 580                 case 0xf:
 581                         status->rate_idx = 1;
 582                         break;
 583                 case 0xa:
 584                         status->rate_idx = 2;
 585                         break;
 586                 case 0xe:
 587                         status->rate_idx = 3;
 588                         break;
 589                 case 0x9:
 590                         status->rate_idx = 4;
 591                         break;
 592                 case 0xd:
 593                         status->rate_idx = 5;
 594                         break;
 595                 case 0x8:
 596                         status->rate_idx = 6;
 597                         break;
 598                 case 0xc:
 599                         status->rate_idx = 7;
 600                         break;
 601                 default:
 602                         if (ar9170_nag_limiter(ar))
 603                                 printk(KERN_ERR "%s: invalid plcp ofdm rate "
 604                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 605                                        head->plcp[0]);
 606                         return -EINVAL;
 607                 }
 608                 if (status->band == IEEE80211_BAND_2GHZ)
 609                         status->rate_idx += 4;
 610                 break;
 611
 612         case AR9170_RX_STATUS_MODULATION_HT:
 613                 if (head->plcp[3] & 0x80)
 614                         status->flag |= RX_FLAG_40MHZ;
 615                 if (head->plcp[6] & 0x80)
 616                         status->flag |= RX_FLAG_SHORT_GI;
 617
 618                 status->rate_idx = clamp(0, 75, head->plcp[6] & 0x7f);
 619                 status->flag |= RX_FLAG_HT;
 620                 break;
 621
 622         case AR9170_RX_STATUS_MODULATION_DUPOFDM:
 623                 /* XXX */
 624                 if (ar9170_nag_limiter(ar))
 625                         printk(KERN_ERR "%s: invalid modulation\n",
 626                                wiphy_name(ar->hw->wiphy));
 627                 return -EINVAL;
 628         }
 629
 630         return 0;
 631 }
 632
 633 static void ar9170_rx_phy_status(struct ar9170 *ar,
 634                                  struct ar9170_rx_phystatus *phy,
 635                                  struct ieee80211_rx_status *status)
 636 {
 637         int i;
 638
 639         BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20);
 640
 641         for (i = 0; i < 3; i++)
 642                 if (phy->rssi[i] != 0x80)
 643                         status->antenna |= BIT(i);
 644
 645         /* post-process RSSI */
 646         for (i = 0; i < 7; i++)
 647                 if (phy->rssi[i] & 0x80)
 648                         phy->rssi[i] = ((phy->rssi[i] & 0x7f) + 1) & 0x7f;
 649
 650         /* TODO: we could do something with phy_errors */
 651         status->signal = ar->noise[0] + phy->rssi_combined;
 652         status->noise = ar->noise[0];
 653 }
 654
 655 static struct sk_buff *ar9170_rx_copy_data(u8 *buf, int len)
 656 {
 657         struct sk_buff *skb;
 658         int reserved = 0;
 659         struct ieee80211_hdr *hdr = (void *) buf;
 660
 661         if (ieee80211_is_data_qos(hdr->frame_control)) {
 662                 u8 *qc = ieee80211_get_qos_ctl(hdr);
 663                 reserved += NET_IP_ALIGN;
 664
 665                 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
 666                         reserved += NET_IP_ALIGN;
 667         }
 668
 669         if (ieee80211_has_a4(hdr->frame_control))
 670                 reserved += NET_IP_ALIGN;
 671
 672         reserved = 32 + (reserved & NET_IP_ALIGN);
 673
 674         skb = dev_alloc_skb(len + reserved);
 675         if (likely(skb)) {
 676                 skb_reserve(skb, reserved);
 677                 memcpy(skb_put(skb, len), buf, len);
 678         }
 679
 680         return skb;
 681 }
 682
 683 /*
 684  * If the frame alignment is right (or the kernel has
 685  * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
 686  * is only a single MPDU in the USB frame, then we could
 687  * submit to mac80211 the SKB directly. However, since
 688  * there may be multiple packets in one SKB in stream
 689  * mode, and we need to observe the proper ordering,
 690  * this is non-trivial.
 691  */
 692
 693 static void ar9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
 694 {
 695         struct ar9170_rx_head *head;
 696         struct ar9170_rx_macstatus *mac;
 697         struct ar9170_rx_phystatus *phy = NULL;
 698         struct ieee80211_rx_status status;
 699         struct sk_buff *skb;
 700         int mpdu_len;
 701
 702         if (unlikely(!IS_STARTED(ar) || len < (sizeof(*mac))))
 703                 return ;
 704
 705         /* Received MPDU */
 706         mpdu_len = len - sizeof(*mac);
 707
 708         mac = (void *)(buf + mpdu_len);
 709         if (unlikely(mac->error & AR9170_RX_ERROR_FATAL)) {
 710                 /* this frame is too damaged and can't be used - drop it */
 711
 712                 return ;
 713         }
 714
 715         switch (mac->status & AR9170_RX_STATUS_MPDU_MASK) {
 716         case AR9170_RX_STATUS_MPDU_FIRST:
 717                 /* first mpdu packet has the plcp header */
 718                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) {
 719                         head = (void *) buf;
 720                         memcpy(&ar->rx_mpdu.plcp, (void *) buf,
 721                                sizeof(struct ar9170_rx_head));
 722
 723                         mpdu_len -= sizeof(struct ar9170_rx_head);
 724                         buf += sizeof(struct ar9170_rx_head);
 725                         ar->rx_mpdu.has_plcp = true;
 726                 } else {
 727                         if (ar9170_nag_limiter(ar))
 728                                 printk(KERN_ERR "%s: plcp info is clipped.\n",
 729                                        wiphy_name(ar->hw->wiphy));
 730                         return ;
 731                 }
 732                 break;
 733
 734         case AR9170_RX_STATUS_MPDU_LAST:
 735                 /* last mpdu has a extra tail with phy status information */
 736
 737                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) {
 738                         mpdu_len -= sizeof(struct ar9170_rx_phystatus);
 739                         phy = (void *)(buf + mpdu_len);
 740                 } else {
 741                         if (ar9170_nag_limiter(ar))
 742                                 printk(KERN_ERR "%s: frame tail is clipped.\n",
 743                                        wiphy_name(ar->hw->wiphy));
 744                         return ;
 745                 }
 746
 747         case AR9170_RX_STATUS_MPDU_MIDDLE:
 748                 /* middle mpdus are just data */
 749                 if (unlikely(!ar->rx_mpdu.has_plcp)) {
 750                         if (!ar9170_nag_limiter(ar))
 751                                 return ;
 752
 753                         printk(KERN_ERR "%s: rx stream did not start "
 754                                         "with a first_mpdu frame tag.\n",
 755                                wiphy_name(ar->hw->wiphy));
 756
 757                         return ;
 758                 }
 759
 760                 head = &ar->rx_mpdu.plcp;
 761                 break;
 762
 763         case AR9170_RX_STATUS_MPDU_SINGLE:
 764                 /* single mpdu - has plcp (head) and phy status (tail) */
 765                 head = (void *) buf;
 766
 767                 mpdu_len -= sizeof(struct ar9170_rx_head);
 768                 mpdu_len -= sizeof(struct ar9170_rx_phystatus);
 769
 770                 buf += sizeof(struct ar9170_rx_head);
 771                 phy = (void *)(buf + mpdu_len);
 772                 break;
 773
 774         default:
 775                 BUG_ON(1);
 776                 break;
 777         }
 778
 779         if (unlikely(mpdu_len < FCS_LEN))
 780                 return ;
 781
 782         memset(&status, 0, sizeof(status));
 783         if (unlikely(ar9170_rx_mac_status(ar, head, mac, &status)))
 784                 return ;
 785
 786         if (phy)
 787                 ar9170_rx_phy_status(ar, phy, &status);
 788
 789         skb = ar9170_rx_copy_data(buf, mpdu_len);
 790         if (likely(skb))
 791                 ieee80211_rx_irqsafe(ar->hw, skb, &status);
 792 }
 793
 794 void ar9170_rx(struct ar9170 *ar, struct sk_buff *skb)
 795 {
 796         unsigned int i, tlen, resplen, wlen = 0, clen = 0;
 797         u8 *tbuf, *respbuf;
 798
 799         tbuf = skb->data;
 800         tlen = skb->len;
 801
 802         while (tlen >= 4) {
 803                 clen = tbuf[1] << 8 | tbuf[0];
 804                 wlen = ALIGN(clen, 4);
 805
 806                 /* check if this is stream has a valid tag.*/
 807                 if (tbuf[2] != 0 || tbuf[3] != 0x4e) {
 808                         /*
 809                          * TODO: handle the highly unlikely event that the
 810                          * corrupted stream has the TAG at the right position.
 811                          */
 812
 813                         /* check if the frame can be repaired. */
 814                         if (!ar->rx_failover_missing) {
 815                                 /* this is no "short read". */
 816                                 if (ar9170_nag_limiter(ar)) {
 817                                         printk(KERN_ERR "%s: missing tag!\n",
 818                                                wiphy_name(ar->hw->wiphy));
 819                                         goto err_telluser;
 820                                 } else
 821                                         goto err_silent;
 822                         }
 823
 824                         if (ar->rx_failover_missing > tlen) {
 825                                 if (ar9170_nag_limiter(ar)) {
 826                                         printk(KERN_ERR "%s: possible multi "
 827                                                "stream corruption!\n",
 828                                                wiphy_name(ar->hw->wiphy));
 829                                         goto err_telluser;
 830                                 } else
 831                                         goto err_silent;
 832                         }
 833
 834                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
 835                         ar->rx_failover_missing -= tlen;
 836
 837                         if (ar->rx_failover_missing <= 0) {
 838                                 /*
 839                                  * nested ar9170_rx call!
 840                                  * termination is guranteed, even when the
 841                                  * combined frame also have a element with
 842                                  * a bad tag.
 843                                  */
 844
 845                                 ar->rx_failover_missing = 0;
 846                                 ar9170_rx(ar, ar->rx_failover);
 847
 848                                 skb_reset_tail_pointer(ar->rx_failover);
 849                                 skb_trim(ar->rx_failover, 0);
 850                         }
 851
 852                         return ;
 853                 }
 854
 855                 /* check if stream is clipped */
 856                 if (wlen > tlen - 4) {
 857                         if (ar->rx_failover_missing) {
 858                                 /* TODO: handle double stream corruption. */
 859                                 if (ar9170_nag_limiter(ar)) {
 860                                         printk(KERN_ERR "%s: double rx stream "
 861                                                "corruption!\n",
 862                                                 wiphy_name(ar->hw->wiphy));
 863                                         goto err_telluser;
 864                                 } else
 865                                         goto err_silent;
 866                         }
 867
 868                         /*
 869                          * save incomplete data set.
 870                          * the firmware will resend the missing bits when
 871                          * the rx - descriptor comes round again.
 872                          */
 873
 874                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
 875                         ar->rx_failover_missing = clen - tlen;
 876                         return ;
 877                 }
 878                 resplen = clen;
 879                 respbuf = tbuf + 4;
 880                 tbuf += wlen + 4;
 881                 tlen -= wlen + 4;
 882
 883                 i = 0;
 884
 885                 /* weird thing, but this is the same in the original driver */
 886                 while (resplen > 2 && i < 12 &&
 887                        respbuf[0] == 0xff && respbuf[1] == 0xff) {
 888                         i += 2;
 889                         resplen -= 2;
 890                         respbuf += 2;
 891                 }
 892
 893                 if (resplen < 4)
 894                         continue;
 895
 896                 /* found the 6 * 0xffff marker? */
 897                 if (i == 12)
 898                         ar9170_handle_command_response(ar, respbuf, resplen);
 899                 else
 900                         ar9170_handle_mpdu(ar, respbuf, clen);
 901         }
 902
 903         if (tlen) {
 904                 if (net_ratelimit())
 905                         printk(KERN_ERR "%s: %d bytes of unprocessed "
 906                                         "data left in rx stream!\n",
 907                                wiphy_name(ar->hw->wiphy), tlen);
 908
 909                 goto err_telluser;
 910         }
 911
 912         return ;
 913
 914 err_telluser:
 915         printk(KERN_ERR "%s: damaged RX stream data [want:%d, "
 916                         "data:%d, rx:%d, pending:%d ]\n",
 917                wiphy_name(ar->hw->wiphy), clen, wlen, tlen,
 918                ar->rx_failover_missing);
 919
 920         if (ar->rx_failover_missing)
 921                 print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET,
 922                                      ar->rx_failover->data,
 923                                      ar->rx_failover->len);
 924
 925         print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET,
 926                              skb->data, skb->len);
 927
 928         printk(KERN_ERR "%s: please check your hardware and cables, if "
 929                         "you see this message frequently.\n",
 930                wiphy_name(ar->hw->wiphy));
 931
 932 err_silent:
 933         if (ar->rx_failover_missing) {
 934                 skb_reset_tail_pointer(ar->rx_failover);
 935                 skb_trim(ar->rx_failover, 0);
 936                 ar->rx_failover_missing = 0;
 937         }
 938 }
 939
 940 #define AR9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)            \
 941 do {                                                                    \
 942         queue.aifs = ai_fs;                                             \
 943         queue.cw_min = cwmin;                                           \
 944         queue.cw_max = cwmax;                                           \
 945         queue.txop = _txop;                                             \
 946 } while (0)
 947
 948 static int ar9170_op_start(struct ieee80211_hw *hw)
 949 {
 950         struct ar9170 *ar = hw->priv;
 951         int err, i;
 952
 953         mutex_lock(&ar->mutex);
 954
 955         ar->filter_changed = 0;
 956
 957         /* reinitialize queues statistics */
 958         memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
 959         for (i = 0; i < ARRAY_SIZE(ar->tx_stats); i++)
 960                 ar->tx_stats[i].limit = 8;
 961
 962         /* reset QoS defaults */
 963         AR9170_FILL_QUEUE(ar->edcf[0], 3, 15, 1023,  0); /* BEST EFFORT*/
 964         AR9170_FILL_QUEUE(ar->edcf[1], 7, 15, 1023,  0); /* BACKGROUND */
 965         AR9170_FILL_QUEUE(ar->edcf[2], 2, 7,    15, 94); /* VIDEO */
 966         AR9170_FILL_QUEUE(ar->edcf[3], 2, 3,     7, 47); /* VOICE */
 967         AR9170_FILL_QUEUE(ar->edcf[4], 2, 3,     7,  0); /* SPECIAL */
 968
 969         ar->bad_hw_nagger = jiffies;
 970
 971         err = ar->open(ar);
 972         if (err)
 973                 goto out;
 974
 975         err = ar9170_init_mac(ar);
 976         if (err)
 977                 goto out;
 978
 979         err = ar9170_set_qos(ar);
 980         if (err)
 981                 goto out;
 982
 983         err = ar9170_init_phy(ar, IEEE80211_BAND_2GHZ);
 984         if (err)
 985                 goto out;
 986
 987         err = ar9170_init_rf(ar);
 988         if (err)
 989                 goto out;
 990
 991         /* start DMA */
 992         err = ar9170_write_reg(ar, 0x1c3d30, 0x100);
 993         if (err)
 994                 goto out;
 995
 996         ar->state = AR9170_STARTED;
 997
 998 out:
 999         mutex_unlock(&ar->mutex);
1000         return err;
1001 }
1002
1003 static void ar9170_op_stop(struct ieee80211_hw *hw)
1004 {
1005         struct ar9170 *ar = hw->priv;
1006
1007         if (IS_STARTED(ar))
1008                 ar->state = AR9170_IDLE;
1009
1010         flush_workqueue(ar->hw->workqueue);
1011
1012         cancel_delayed_work_sync(&ar->tx_status_janitor);
1013         cancel_work_sync(&ar->filter_config_work);
1014         cancel_work_sync(&ar->beacon_work);
1015         mutex_lock(&ar->mutex);
1016         skb_queue_purge(&ar->global_tx_status_waste);
1017         skb_queue_purge(&ar->global_tx_status);
1018
1019         if (IS_ACCEPTING_CMD(ar)) {
1020                 ar9170_set_leds_state(ar, 0);
1021
1022                 /* stop DMA */
1023                 ar9170_write_reg(ar, 0x1c3d30, 0);
1024                 ar->stop(ar);
1025         }
1026
1027         mutex_unlock(&ar->mutex);
1028 }
1029
1030 int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
1031 {
1032         struct ar9170 *ar = hw->priv;
1033         struct ieee80211_hdr *hdr;
1034         struct ar9170_tx_control *txc;
1035         struct ieee80211_tx_info *info;
1036         struct ieee80211_rate *rate = NULL;
1037         struct ieee80211_tx_rate *txrate;
1038         unsigned int queue = skb_get_queue_mapping(skb);
1039         unsigned long flags = 0;
1040         struct ar9170_sta_info *sta_info = NULL;
1041         u32 power, chains;
1042         u16 keytype = 0;
1043         u16 len, icv = 0;
1044         int err;
1045         bool tx_status;
1046
1047         if (unlikely(!IS_STARTED(ar)))
1048                 goto err_free;
1049
1050         hdr = (void *)skb->data;
1051         info = IEEE80211_SKB_CB(skb);
1052         len = skb->len;
1053
1054         spin_lock_irqsave(&ar->tx_stats_lock, flags);
1055         if (ar->tx_stats[queue].limit < ar->tx_stats[queue].len) {
1056                 spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1057                 return NETDEV_TX_OK;
1058         }
1059
1060         ar->tx_stats[queue].len++;
1061         ar->tx_stats[queue].count++;
1062         if (ar->tx_stats[queue].limit == ar->tx_stats[queue].len)
1063                 ieee80211_stop_queue(hw, queue);
1064
1065         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1066
1067         txc = (void *)skb_push(skb, sizeof(*txc));
1068
1069         tx_status = (((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) != 0) ||
1070                     ((info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) != 0));
1071
1072         if (info->control.hw_key) {
1073                 icv = info->control.hw_key->icv_len;
1074
1075                 switch (info->control.hw_key->alg) {
1076                 case ALG_WEP:
1077                         keytype = AR9170_TX_MAC_ENCR_RC4;
1078                         break;
1079                 case ALG_TKIP:
1080                         keytype = AR9170_TX_MAC_ENCR_RC4;
1081                         break;
1082                 case ALG_CCMP:
1083                         keytype = AR9170_TX_MAC_ENCR_AES;
1084                         break;
1085                 default:
1086                         WARN_ON(1);
1087                         goto err_dequeue;
1088                 }
1089         }
1090
1091         /* Length */
1092         txc->length = cpu_to_le16(len + icv + 4);
1093
1094         txc->mac_control = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
1095                                        AR9170_TX_MAC_BACKOFF);
1096         txc->mac_control |= cpu_to_le16(ar9170_qos_hwmap[queue] <<
1097                                         AR9170_TX_MAC_QOS_SHIFT);
1098         txc->mac_control |= cpu_to_le16(keytype);
1099         txc->phy_control = cpu_to_le32(0);
1100
1101         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1102                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_NO_ACK);
1103
1104         if (info->flags & IEEE80211_TX_CTL_AMPDU)
1105                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
1106
1107         txrate = &info->control.rates[0];
1108
1109         if (txrate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1110                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
1111         else if (txrate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1112                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
1113
1114         if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1115                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_GREENFIELD);
1116
1117         if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1118                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_PREAMBLE);
1119
1120         if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1121                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ);
1122         /* this works because 40 MHz is 2 and dup is 3 */
1123         if (txrate->flags & IEEE80211_TX_RC_DUP_DATA)
1124                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ_DUP);
1125
1126         if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
1127                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_GI);
1128
1129         if (txrate->flags & IEEE80211_TX_RC_MCS) {
1130                 u32 r = txrate->idx;
1131                 u8 *txpower;
1132
1133                 r <<= AR9170_TX_PHY_MCS_SHIFT;
1134                 if (WARN_ON(r & ~AR9170_TX_PHY_MCS_MASK))
1135                         goto err_dequeue;
1136                 txc->phy_control |= cpu_to_le32(r & AR9170_TX_PHY_MCS_MASK);
1137                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_MOD_HT);
1138
1139                 if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
1140                         if (info->band == IEEE80211_BAND_5GHZ)
1141                                 txpower = ar->power_5G_ht40;
1142                         else
1143                                 txpower = ar->power_2G_ht40;
1144                 } else {
1145                         if (info->band == IEEE80211_BAND_5GHZ)
1146                                 txpower = ar->power_5G_ht20;
1147                         else
1148                                 txpower = ar->power_2G_ht20;
1149                 }
1150
1151                 power = txpower[(txrate->idx) & 7];
1152         } else {
1153                 u8 *txpower;
1154                 u32 mod;
1155                 u32 phyrate;
1156                 u8 idx = txrate->idx;
1157
1158                 if (info->band != IEEE80211_BAND_2GHZ) {
1159                         idx += 4;
1160                         txpower = ar->power_5G_leg;
1161                         mod = AR9170_TX_PHY_MOD_OFDM;
1162                 } else {
1163                         if (idx < 4) {
1164                                 txpower = ar->power_2G_cck;
1165                                 mod = AR9170_TX_PHY_MOD_CCK;
1166                         } else {
1167                                 mod = AR9170_TX_PHY_MOD_OFDM;
1168                                 txpower = ar->power_2G_ofdm;
1169                         }
1170                 }
1171
1172                 rate = &__ar9170_ratetable[idx];
1173
1174                 phyrate = rate->hw_value & 0xF;
1175                 power = txpower[(rate->hw_value & 0x30) >> 4];
1176                 phyrate <<= AR9170_TX_PHY_MCS_SHIFT;
1177
1178                 txc->phy_control |= cpu_to_le32(mod);
1179                 txc->phy_control |= cpu_to_le32(phyrate);
1180         }
1181
1182         power <<= AR9170_TX_PHY_TX_PWR_SHIFT;
1183         power &= AR9170_TX_PHY_TX_PWR_MASK;
1184         txc->phy_control |= cpu_to_le32(power);
1185
1186         /* set TX chains */
1187         if (ar->eeprom.tx_mask == 1) {
1188                 chains = AR9170_TX_PHY_TXCHAIN_1;
1189         } else {
1190                 chains = AR9170_TX_PHY_TXCHAIN_2;
1191
1192                 /* >= 36M legacy OFDM - use only one chain */
1193                 if (rate && rate->bitrate >= 360)
1194                         chains = AR9170_TX_PHY_TXCHAIN_1;
1195         }
1196         txc->phy_control |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_SHIFT);
1197
1198         if (tx_status) {
1199                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
1200                 /*
1201                  * WARNING:
1202                  * Putting the QoS queue bits into an unexplored territory is
1203                  * certainly not elegant.
1204                  *
1205                  * In my defense: This idea provides a reasonable way to
1206                  * smuggle valuable information to the tx_status callback.
1207                  * Also, the idea behind this bit-abuse came straight from
1208                  * the original driver code.
1209                  */
1210
1211                 txc->phy_control |=
1212                         cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
1213
1214                 if (info->control.sta) {
1215                         sta_info = (void *) info->control.sta->drv_priv;
1216                         skb_queue_tail(&sta_info->tx_status[queue], skb);
1217                 } else {
1218                         skb_queue_tail(&ar->global_tx_status, skb);
1219
1220                         queue_delayed_work(ar->hw->workqueue,
1221                                            &ar->tx_status_janitor,
1222                                            msecs_to_jiffies(100));
1223                 }
1224         }
1225
1226         err = ar->tx(ar, skb, tx_status, 0);
1227         if (unlikely(tx_status && err)) {
1228                 if (info->control.sta)
1229                         skb_unlink(skb, &sta_info->tx_status[queue]);
1230                 else
1231                         skb_unlink(skb, &ar->global_tx_status);
1232         }
1233
1234         return NETDEV_TX_OK;
1235
1236 err_dequeue:
1237         spin_lock_irqsave(&ar->tx_stats_lock, flags);
1238         ar->tx_stats[queue].len--;
1239         ar->tx_stats[queue].count--;
1240         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1241
1242 err_free:
1243         dev_kfree_skb(skb);
1244         return NETDEV_TX_OK;
1245 }
1246
1247 static int ar9170_op_add_interface(struct ieee80211_hw *hw,
1248                                    struct ieee80211_if_init_conf *conf)
1249 {
1250         struct ar9170 *ar = hw->priv;
1251         int err = 0;
1252
1253         mutex_lock(&ar->mutex);
1254
1255         if (ar->vif) {
1256                 err = -EBUSY;
1257                 goto unlock;
1258         }
1259
1260         ar->vif = conf->vif;
1261         memcpy(ar->mac_addr, conf->mac_addr, ETH_ALEN);
1262
1263         if (modparam_nohwcrypt || (ar->vif->type != NL80211_IFTYPE_STATION)) {
1264                 ar->rx_software_decryption = true;
1265                 ar->disable_offload = true;
1266         }
1267
1268         ar->cur_filter = 0;
1269         ar->want_filter = AR9170_MAC_REG_FTF_DEFAULTS;
1270         err = ar9170_update_frame_filter(ar);
1271         if (err)
1272                 goto unlock;
1273
1274         err = ar9170_set_operating_mode(ar);
1275
1276 unlock:
1277         mutex_unlock(&ar->mutex);
1278         return err;
1279 }
1280
1281 static void ar9170_op_remove_interface(struct ieee80211_hw *hw,
1282                                        struct ieee80211_if_init_conf *conf)
1283 {
1284         struct ar9170 *ar = hw->priv;
1285
1286         mutex_lock(&ar->mutex);
1287         ar->vif = NULL;
1288         ar->want_filter = 0;
1289         ar9170_update_frame_filter(ar);
1290         ar9170_set_beacon_timers(ar);
1291         dev_kfree_skb(ar->beacon);
1292         ar->beacon = NULL;
1293         ar->sniffer_enabled = false;
1294         ar->rx_software_decryption = false;
1295         ar9170_set_operating_mode(ar);
1296         mutex_unlock(&ar->mutex);
1297 }
1298
1299 static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
1300 {
1301         struct ar9170 *ar = hw->priv;
1302         int err = 0;
1303
1304         mutex_lock(&ar->mutex);
1305
1306         if (changed & IEEE80211_CONF_CHANGE_RADIO_ENABLED) {
1307                 /* TODO */
1308                 err = 0;
1309         }
1310
1311         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
1312                 /* TODO */
1313                 err = 0;
1314         }
1315
1316         if (changed & IEEE80211_CONF_CHANGE_PS) {
1317                 /* TODO */
1318                 err = 0;
1319         }
1320
1321         if (changed & IEEE80211_CONF_CHANGE_POWER) {
1322                 /* TODO */
1323                 err = 0;
1324         }
1325
1326         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
1327                 /*
1328                  * is it long_frame_max_tx_count or short_frame_max_tx_count?
1329                  */
1330
1331                 err = ar9170_set_hwretry_limit(ar,
1332                         ar->hw->conf.long_frame_max_tx_count);
1333                 if (err)
1334                         goto out;
1335         }
1336
1337         if (changed & BSS_CHANGED_BEACON_INT) {
1338                 err = ar9170_set_beacon_timers(ar);
1339                 if (err)
1340                         goto out;
1341         }
1342
1343         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
1344
1345                 /* adjust slot time for 5 GHz */
1346                 err = ar9170_set_slot_time(ar);
1347                 if (err)
1348                         goto out;
1349
1350                 err = ar9170_set_dyn_sifs_ack(ar);
1351                 if (err)
1352                         goto out;
1353
1354                 err = ar9170_set_channel(ar, hw->conf.channel,
1355                                 AR9170_RFI_NONE,
1356                                 nl80211_to_ar9170(hw->conf.channel_type));
1357                 if (err)
1358                         goto out;
1359         }
1360
1361 out:
1362         mutex_unlock(&ar->mutex);
1363         return err;
1364 }
1365
1366 static void ar9170_set_filters(struct work_struct *work)
1367 {
1368         struct ar9170 *ar = container_of(work, struct ar9170,
1369                                          filter_config_work);
1370         int err;
1371
1372         if (unlikely(!IS_STARTED(ar)))
1373                 return ;
1374
1375         mutex_lock(&ar->mutex);
1376         if (test_and_clear_bit(AR9170_FILTER_CHANGED_MODE,
1377                                &ar->filter_changed)) {
1378                 err = ar9170_set_operating_mode(ar);
1379                 if (err)
1380                         goto unlock;
1381         }
1382
1383         if (test_and_clear_bit(AR9170_FILTER_CHANGED_MULTICAST,
1384                                &ar->filter_changed)) {
1385                 err = ar9170_update_multicast(ar);
1386                 if (err)
1387                         goto unlock;
1388         }
1389
1390         if (test_and_clear_bit(AR9170_FILTER_CHANGED_FRAMEFILTER,
1391                                &ar->filter_changed)) {
1392                 err = ar9170_update_frame_filter(ar);
1393                 if (err)
1394                         goto unlock;
1395         }
1396
1397 unlock:
1398         mutex_unlock(&ar->mutex);
1399 }
1400
1401 static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
1402                                        unsigned int changed_flags,
1403                                        unsigned int *new_flags,
1404                                        int mc_count, struct dev_mc_list *mclist)
1405 {
1406         struct ar9170 *ar = hw->priv;
1407
1408         /* mask supported flags */
1409         *new_flags &= FIF_ALLMULTI | FIF_CONTROL | FIF_BCN_PRBRESP_PROMISC |
1410                       FIF_PROMISC_IN_BSS | FIF_FCSFAIL | FIF_PLCPFAIL;
1411         ar->filter_state = *new_flags;
1412         /*
1413          * We can support more by setting the sniffer bit and
1414          * then checking the error flags, later.
1415          */
1416
1417         if (changed_flags & FIF_ALLMULTI) {
1418                 if (*new_flags & FIF_ALLMULTI) {
1419                         ar->want_mc_hash = ~0ULL;
1420                 } else {
1421                         u64 mchash;
1422                         int i;
1423
1424                         /* always get broadcast frames */
1425                         mchash = 1ULL << (0xff >> 2);
1426
1427                         for (i = 0; i < mc_count; i++) {
1428                                 if (WARN_ON(!mclist))
1429                                         break;
1430                                 mchash |= 1ULL << (mclist->dmi_addr[5] >> 2);
1431                                 mclist = mclist->next;
1432                         }
1433                 ar->want_mc_hash = mchash;
1434                 }
1435                 set_bit(AR9170_FILTER_CHANGED_MULTICAST, &ar->filter_changed);
1436         }
1437
1438         if (changed_flags & FIF_CONTROL) {
1439                 u32 filter = AR9170_MAC_REG_FTF_PSPOLL |
1440                              AR9170_MAC_REG_FTF_RTS |
1441                              AR9170_MAC_REG_FTF_CTS |
1442                              AR9170_MAC_REG_FTF_ACK |
1443                              AR9170_MAC_REG_FTF_CFE |
1444                              AR9170_MAC_REG_FTF_CFE_ACK;
1445
1446                 if (*new_flags & FIF_CONTROL)
1447                         ar->want_filter = ar->cur_filter | filter;
1448                 else
1449                         ar->want_filter = ar->cur_filter & ~filter;
1450
1451                 set_bit(AR9170_FILTER_CHANGED_FRAMEFILTER,
1452                         &ar->filter_changed);
1453         }
1454
1455         if (changed_flags & FIF_PROMISC_IN_BSS) {
1456                 ar->sniffer_enabled = ((*new_flags) & FIF_PROMISC_IN_BSS) != 0;
1457                 set_bit(AR9170_FILTER_CHANGED_MODE,
1458                         &ar->filter_changed);
1459         }
1460
1461         if (likely(IS_STARTED(ar)))
1462                 queue_work(ar->hw->workqueue, &ar->filter_config_work);
1463 }
1464
1465 static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
1466                                        struct ieee80211_vif *vif,
1467                                        struct ieee80211_bss_conf *bss_conf,
1468                                        u32 changed)
1469 {
1470         struct ar9170 *ar = hw->priv;
1471         int err = 0;
1472
1473         mutex_lock(&ar->mutex);
1474
1475         if (changed & BSS_CHANGED_BSSID) {
1476                 memcpy(ar->bssid, bss_conf->bssid, ETH_ALEN);
1477                 err = ar9170_set_operating_mode(ar);
1478                 if (err)
1479                         goto out;
1480         }
1481
1482         if (changed & (BSS_CHANGED_BEACON | BSS_CHANGED_BEACON_ENABLED)) {
1483                 err = ar9170_update_beacon(ar);
1484                 if (err)
1485                         goto out;
1486
1487                 err = ar9170_set_beacon_timers(ar);
1488                 if (err)
1489                         goto out;
1490         }
1491
1492         if (changed & BSS_CHANGED_ASSOC) {
1493                 ar->state = bss_conf->assoc ? AR9170_ASSOCIATED : ar->state;
1494
1495 #ifndef CONFIG_AR9170_LEDS
1496                 /* enable assoc LED. */
1497                 err = ar9170_set_leds_state(ar, bss_conf->assoc ? 2 : 0);
1498 #endif /* CONFIG_AR9170_LEDS */
1499         }
1500
1501         if (changed & BSS_CHANGED_BEACON_INT) {
1502                 err = ar9170_set_beacon_timers(ar);
1503                 if (err)
1504                         goto out;
1505         }
1506
1507         if (changed & BSS_CHANGED_HT) {
1508                 /* TODO */
1509                 err = 0;
1510         }
1511
1512         if (changed & BSS_CHANGED_ERP_SLOT) {
1513                 err = ar9170_set_slot_time(ar);
1514                 if (err)
1515                         goto out;
1516         }
1517
1518         if (changed & BSS_CHANGED_BASIC_RATES) {
1519                 err = ar9170_set_basic_rates(ar);
1520                 if (err)
1521                         goto out;
1522         }
1523
1524 out:
1525         mutex_unlock(&ar->mutex);
1526 }
1527
1528 static u64 ar9170_op_get_tsf(struct ieee80211_hw *hw)
1529 {
1530         struct ar9170 *ar = hw->priv;
1531         int err;
1532         u32 tsf_low;
1533         u32 tsf_high;
1534         u64 tsf;
1535
1536         mutex_lock(&ar->mutex);
1537         err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_L, &tsf_low);
1538         if (!err)
1539                 err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_H, &tsf_high);
1540         mutex_unlock(&ar->mutex);
1541
1542         if (WARN_ON(err))
1543                 return 0;
1544
1545         tsf = tsf_high;
1546         tsf = (tsf << 32) | tsf_low;
1547         return tsf;
1548 }
1549
1550 static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
1551                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
1552                           struct ieee80211_key_conf *key)
1553 {
1554         struct ar9170 *ar = hw->priv;
1555         int err = 0, i;
1556         u8 ktype;
1557
1558         if ((!ar->vif) || (ar->disable_offload))
1559                 return -EOPNOTSUPP;
1560
1561         switch (key->alg) {
1562         case ALG_WEP:
1563                 if (key->keylen == WLAN_KEY_LEN_WEP40)
1564                         ktype = AR9170_ENC_ALG_WEP64;
1565                 else
1566                         ktype = AR9170_ENC_ALG_WEP128;
1567                 break;
1568         case ALG_TKIP:
1569                 ktype = AR9170_ENC_ALG_TKIP;
1570                 break;
1571         case ALG_CCMP:
1572                 ktype = AR9170_ENC_ALG_AESCCMP;
1573                 break;
1574         default:
1575                 return -EOPNOTSUPP;
1576         }
1577
1578         mutex_lock(&ar->mutex);
1579         if (cmd == SET_KEY) {
1580                 if (unlikely(!IS_STARTED(ar))) {
1581                         err = -EOPNOTSUPP;
1582                         goto out;
1583                 }
1584
1585                 /* group keys need all-zeroes address */
1586                 if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1587                         sta = NULL;
1588
1589                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
1590                         for (i = 0; i < 64; i++)
1591                                 if (!(ar->usedkeys & BIT(i)))
1592                                         break;
1593                         if (i == 64) {
1594                                 ar->rx_software_decryption = true;
1595                                 ar9170_set_operating_mode(ar);
1596                                 err = -ENOSPC;
1597                                 goto out;
1598                         }
1599                 } else {
1600                         i = 64 + key->keyidx;
1601                 }
1602
1603                 key->hw_key_idx = i;
1604
1605                 err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL, ktype, 0,
1606                                         key->key, min_t(u8, 16, key->keylen));
1607                 if (err)
1608                         goto out;
1609
1610                 if (key->alg == ALG_TKIP) {
1611                         err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL,
1612                                                 ktype, 1, key->key + 16, 16);
1613                         if (err)
1614                                 goto out;
1615
1616                         /*
1617                          * hardware is not capable generating the MMIC
1618                          * for fragmented frames!
1619                          */
1620                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
1621                 }
1622
1623                 if (i < 64)
1624                         ar->usedkeys |= BIT(i);
1625
1626                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
1627         } else {
1628                 if (unlikely(!IS_STARTED(ar))) {
1629                         /* The device is gone... together with the key ;-) */
1630                         err = 0;
1631                         goto out;
1632                 }
1633
1634                 err = ar9170_disable_key(ar, key->hw_key_idx);
1635                 if (err)
1636                         goto out;
1637
1638                 if (key->hw_key_idx < 64) {
1639                         ar->usedkeys &= ~BIT(key->hw_key_idx);
1640                 } else {
1641                         err = ar9170_upload_key(ar, key->hw_key_idx, NULL,
1642                                                 AR9170_ENC_ALG_NONE, 0,
1643                                                 NULL, 0);
1644                         if (err)
1645                                 goto out;
1646
1647                         if (key->alg == ALG_TKIP) {
1648                                 err = ar9170_upload_key(ar, key->hw_key_idx,
1649                                                         NULL,
1650                                                         AR9170_ENC_ALG_NONE, 1,
1651                                                         NULL, 0);
1652                                 if (err)
1653                                         goto out;
1654                         }
1655
1656                 }
1657         }
1658
1659         ar9170_regwrite_begin(ar);
1660         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_L, ar->usedkeys);
1661         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_H, ar->usedkeys >> 32);
1662         ar9170_regwrite_finish();
1663         err = ar9170_regwrite_result();
1664
1665 out:
1666         mutex_unlock(&ar->mutex);
1667
1668         return err;
1669 }
1670
1671 static void ar9170_sta_notify(struct ieee80211_hw *hw,
1672                               struct ieee80211_vif *vif,
1673                               enum sta_notify_cmd cmd,
1674                               struct ieee80211_sta *sta)
1675 {
1676         struct ar9170 *ar = hw->priv;
1677         struct ar9170_sta_info *info = (void *) sta->drv_priv;
1678         struct sk_buff *skb;
1679         unsigned int i;
1680
1681         switch (cmd) {
1682         case STA_NOTIFY_ADD:
1683                 for (i = 0; i < ar->hw->queues; i++)
1684                         skb_queue_head_init(&info->tx_status[i]);
1685                 break;
1686
1687         case STA_NOTIFY_REMOVE:
1688
1689                 /*
1690                  * transfer all outstanding frames that need a tx_status
1691                  * reports to the global tx_status queue
1692                  */
1693
1694                 for (i = 0; i < ar->hw->queues; i++) {
1695                         while ((skb = skb_dequeue(&info->tx_status[i]))) {
1696 #ifdef AR9170_QUEUE_DEBUG
1697                                 printk(KERN_DEBUG "%s: queueing frame in "
1698                                           "global tx_status queue =>\n",
1699                                        wiphy_name(ar->hw->wiphy));
1700
1701                                 ar9170_print_txheader(ar, skb);
1702 #endif /* AR9170_QUEUE_DEBUG */
1703                                 skb_queue_tail(&ar->global_tx_status, skb);
1704                         }
1705                 }
1706                 queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
1707                                    msecs_to_jiffies(100));
1708                 break;
1709
1710         default:
1711                 break;
1712         }
1713 }
1714
1715 static int ar9170_get_stats(struct ieee80211_hw *hw,
1716                             struct ieee80211_low_level_stats *stats)
1717 {
1718         struct ar9170 *ar = hw->priv;
1719         u32 val;
1720         int err;
1721
1722         mutex_lock(&ar->mutex);
1723         err = ar9170_read_reg(ar, AR9170_MAC_REG_TX_RETRY, &val);
1724         ar->stats.dot11ACKFailureCount += val;
1725
1726         memcpy(stats, &ar->stats, sizeof(*stats));
1727         mutex_unlock(&ar->mutex);
1728
1729         return 0;
1730 }
1731
1732 static int ar9170_get_tx_stats(struct ieee80211_hw *hw,
1733                                struct ieee80211_tx_queue_stats *tx_stats)
1734 {
1735         struct ar9170 *ar = hw->priv;
1736
1737         spin_lock_bh(&ar->tx_stats_lock);
1738         memcpy(tx_stats, ar->tx_stats, sizeof(tx_stats[0]) * hw->queues);
1739         spin_unlock_bh(&ar->tx_stats_lock);
1740
1741         return 0;
1742 }
1743
1744 static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
1745                           const struct ieee80211_tx_queue_params *param)
1746 {
1747         struct ar9170 *ar = hw->priv;
1748         int ret;
1749
1750         mutex_lock(&ar->mutex);
1751         if ((param) && !(queue > ar->hw->queues)) {
1752                 memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
1753                        param, sizeof(*param));
1754
1755                 ret = ar9170_set_qos(ar);
1756         } else
1757                 ret = -EINVAL;
1758
1759         mutex_unlock(&ar->mutex);
1760         return ret;
1761 }
1762
1763 static int ar9170_ampdu_action(struct ieee80211_hw *hw,
1764                                enum ieee80211_ampdu_mlme_action action,
1765                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
1766 {
1767         switch (action) {
1768         case IEEE80211_AMPDU_RX_START:
1769         case IEEE80211_AMPDU_RX_STOP:
1770                 /*
1771                  * Something goes wrong -- RX locks up
1772                  * after a while of receiving aggregated
1773                  * frames -- not enabling for now.
1774                  */
1775                 return -EOPNOTSUPP;
1776         default:
1777                 return -EOPNOTSUPP;
1778         }
1779 }
1780
1781 static const struct ieee80211_ops ar9170_ops = {
1782         .start                  = ar9170_op_start,
1783         .stop                   = ar9170_op_stop,
1784         .tx                     = ar9170_op_tx,
1785         .add_interface          = ar9170_op_add_interface,
1786         .remove_interface       = ar9170_op_remove_interface,
1787         .config                 = ar9170_op_config,
1788         .configure_filter       = ar9170_op_configure_filter,
1789         .conf_tx                = ar9170_conf_tx,
1790         .bss_info_changed       = ar9170_op_bss_info_changed,
1791         .get_tsf                = ar9170_op_get_tsf,
1792         .set_key                = ar9170_set_key,
1793         .sta_notify             = ar9170_sta_notify,
1794         .get_stats              = ar9170_get_stats,
1795         .get_tx_stats           = ar9170_get_tx_stats,
1796         .ampdu_action           = ar9170_ampdu_action,
1797 };
1798
1799 void *ar9170_alloc(size_t priv_size)
1800 {
1801         struct ieee80211_hw *hw;
1802         struct ar9170 *ar;
1803         struct sk_buff *skb;
1804         int i;
1805
1806         /*
1807          * this buffer is used for rx stream reconstruction.
1808          * Under heavy load this device (or the transport layer?)
1809          * tends to split the streams into seperate rx descriptors.
1810          */
1811
1812         skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL);
1813         if (!skb)
1814                 goto err_nomem;
1815
1816         hw = ieee80211_alloc_hw(priv_size, &ar9170_ops);
1817         if (!hw)
1818                 goto err_nomem;
1819
1820         ar = hw->priv;
1821         ar->hw = hw;
1822         ar->rx_failover = skb;
1823
1824         mutex_init(&ar->mutex);
1825         spin_lock_init(&ar->cmdlock);
1826         spin_lock_init(&ar->tx_stats_lock);
1827         skb_queue_head_init(&ar->global_tx_status);
1828         skb_queue_head_init(&ar->global_tx_status_waste);
1829         ar9170_rx_reset_rx_mpdu(ar);
1830         INIT_WORK(&ar->filter_config_work, ar9170_set_filters);
1831         INIT_WORK(&ar->beacon_work, ar9170_new_beacon);
1832         INIT_DELAYED_WORK(&ar->tx_status_janitor, ar9170_tx_status_janitor);
1833
1834         /* all hw supports 2.4 GHz, so set channel to 1 by default */
1835         ar->channel = &ar9170_2ghz_chantable[0];
1836
1837         /* first part of wiphy init */
1838         ar->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
1839                                          BIT(NL80211_IFTYPE_WDS) |
1840                                          BIT(NL80211_IFTYPE_ADHOC);
1841         ar->hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
1842                          IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
1843                          IEEE80211_HW_SIGNAL_DBM |
1844                          IEEE80211_HW_NOISE_DBM;
1845
1846         ar->hw->queues = __AR9170_NUM_TXQ;
1847         ar->hw->extra_tx_headroom = 8;
1848         ar->hw->sta_data_size = sizeof(struct ar9170_sta_info);
1849
1850         ar->hw->max_rates = 1;
1851         ar->hw->max_rate_tries = 3;
1852
1853         for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
1854                 ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
1855
1856         return ar;
1857
1858 err_nomem:
1859         kfree_skb(skb);
1860         return ERR_PTR(-ENOMEM);
1861 }
1862
1863 static int ar9170_read_eeprom(struct ar9170 *ar)
1864 {
1865 #define RW      8       /* number of words to read at once */
1866 #define RB      (sizeof(u32) * RW)
1867         DECLARE_MAC_BUF(mbuf);
1868         u8 *eeprom = (void *)&ar->eeprom;
1869         u8 *addr = ar->eeprom.mac_address;
1870         __le32 offsets[RW];
1871         int i, j, err, bands = 0;
1872
1873         BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
1874
1875         BUILD_BUG_ON(RB > AR9170_MAX_CMD_LEN - 4);
1876 #ifndef __CHECKER__
1877         /* don't want to handle trailing remains */
1878         BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
1879 #endif
1880
1881         for (i = 0; i < sizeof(ar->eeprom)/RB; i++) {
1882                 for (j = 0; j < RW; j++)
1883                         offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
1884                                                  RB * i + 4 * j);
1885
1886                 err = ar->exec_cmd(ar, AR9170_CMD_RREG,
1887                                    RB, (u8 *) &offsets,
1888                                    RB, eeprom + RB * i);
1889                 if (err)
1890                         return err;
1891         }
1892
1893 #undef RW
1894 #undef RB
1895
1896         if (ar->eeprom.length == cpu_to_le16(0xFFFF))
1897                 return -ENODATA;
1898
1899         if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
1900                 ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar9170_band_2GHz;
1901                 bands++;
1902         }
1903         if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
1904                 ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &ar9170_band_5GHz;
1905                 bands++;
1906         }
1907         /*
1908          * I measured this, a bandswitch takes roughly
1909          * 135 ms and a frequency switch about 80.
1910          *
1911          * FIXME: measure these values again once EEPROM settings
1912          *        are used, that will influence them!
1913          */
1914         if (bands == 2)
1915                 ar->hw->channel_change_time = 135 * 1000;
1916         else
1917                 ar->hw->channel_change_time = 80 * 1000;
1918
1919         ar->regulatory.current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
1920         ar->regulatory.current_rd_ext = le16_to_cpu(ar->eeprom.reg_domain[1]);
1921
1922         /* second part of wiphy init */
1923         SET_IEEE80211_PERM_ADDR(ar->hw, addr);
1924
1925         return bands ? 0 : -EINVAL;
1926 }
1927
1928 static int ar9170_reg_notifier(struct wiphy *wiphy,
1929                         struct regulatory_request *request)
1930 {
1931         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
1932         struct ar9170 *ar = hw->priv;
1933
1934         return ath_reg_notifier_apply(wiphy, request, &ar->regulatory);
1935 }
1936
1937 int ar9170_register(struct ar9170 *ar, struct device *pdev)
1938 {
1939         int err;
1940
1941         /* try to read EEPROM, init MAC addr */
1942         err = ar9170_read_eeprom(ar);
1943         if (err)
1944                 goto err_out;
1945
1946         err = ath_regd_init(&ar->regulatory, ar->hw->wiphy,
1947                             ar9170_reg_notifier);
1948         if (err)
1949                 goto err_out;
1950
1951         err = ieee80211_register_hw(ar->hw);
1952         if (err)
1953                 goto err_out;
1954
1955         if (!ath_is_world_regd(&ar->regulatory))
1956                 regulatory_hint(ar->hw->wiphy, ar->regulatory.alpha2);
1957
1958         err = ar9170_init_leds(ar);
1959         if (err)
1960                 goto err_unreg;
1961
1962 #ifdef CONFIG_AR9170_LEDS
1963         err = ar9170_register_leds(ar);
1964         if (err)
1965                 goto err_unreg;
1966 #endif /* CONFIG_AR9170_LEDS */
1967
1968         dev_info(pdev, "Atheros AR9170 is registered as '%s'\n",
1969                  wiphy_name(ar->hw->wiphy));
1970
1971         return err;
1972
1973 err_unreg:
1974         ieee80211_unregister_hw(ar->hw);
1975
1976 err_out:
1977         return err;
1978 }
1979
1980 void ar9170_unregister(struct ar9170 *ar)
1981 {
1982 #ifdef CONFIG_AR9170_LEDS
1983         ar9170_unregister_leds(ar);
1984 #endif /* CONFIG_AR9170_LEDS */
1985
1986         kfree_skb(ar->rx_failover);
1987         ieee80211_unregister_hw(ar->hw);
1988         mutex_destroy(&ar->mutex);
1989 }