SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/net/wireless/ath/ar9170/main.c

   1 /*
   2  * Atheros AR9170 driver
   3  *
   4  * mac80211 interaction code
   5  *
   6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright 2009, Christian Lamparter <chunkeey@web.de>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; see the file COPYING.  If not, see
  21  * http://www.gnu.org/licenses/.
  22  *
  23  * This file incorporates work covered by the following copyright and
  24  * permission notice:
  25  *    Copyright (c) 2007-2008 Atheros Communications, Inc.
  26  *
  27  *    Permission to use, copy, modify, and/or distribute this software for any
  28  *    purpose with or without fee is hereby granted, provided that the above
  29  *    copyright notice and this permission notice appear in all copies.
  30  *
  31  *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  32  *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  33  *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  34  *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  35  *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  36  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  37  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  38  */
  39
  40 #include <linux/init.h>
  41 #include <linux/module.h>
  42 #include <linux/etherdevice.h>
  43 #include <net/mac80211.h>
  44 #include "ar9170.h"
  45 #include "hw.h"
  46 #include "cmd.h"
  47
  48 static int modparam_nohwcrypt;
  49 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
  50 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  51
  52 #define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
  53         .bitrate        = (_bitrate),                   \
  54         .flags          = (_flags),                     \
  55         .hw_value       = (_hw_rate) | (_txpidx) << 4,  \
  56 }
  57
  58 static struct ieee80211_rate __ar9170_ratetable[] = {
  59         RATE(10, 0, 0, 0),
  60         RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
  61         RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
  62         RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
  63         RATE(60, 0xb, 0, 0),
  64         RATE(90, 0xf, 0, 0),
  65         RATE(120, 0xa, 0, 0),
  66         RATE(180, 0xe, 0, 0),
  67         RATE(240, 0x9, 0, 0),
  68         RATE(360, 0xd, 1, 0),
  69         RATE(480, 0x8, 2, 0),
  70         RATE(540, 0xc, 3, 0),
  71 };
  72 #undef RATE
  73
  74 #define ar9170_g_ratetable      (__ar9170_ratetable + 0)
  75 #define ar9170_g_ratetable_size 12
  76 #define ar9170_a_ratetable      (__ar9170_ratetable + 4)
  77 #define ar9170_a_ratetable_size 8
  78
  79 /*
  80  * NB: The hw_value is used as an index into the ar9170_phy_freq_params
  81  *     array in phy.c so that we don't have to do frequency lookups!
  82  */
  83 #define CHAN(_freq, _idx) {             \
  84         .center_freq    = (_freq),      \
  85         .hw_value       = (_idx),       \
  86         .max_power      = 18, /* XXX */ \
  87 }
  88
  89 static struct ieee80211_channel ar9170_2ghz_chantable[] = {
  90         CHAN(2412,  0),
  91         CHAN(2417,  1),
  92         CHAN(2422,  2),
  93         CHAN(2427,  3),
  94         CHAN(2432,  4),
  95         CHAN(2437,  5),
  96         CHAN(2442,  6),
  97         CHAN(2447,  7),
  98         CHAN(2452,  8),
  99         CHAN(2457,  9),
 100         CHAN(2462, 10),
 101         CHAN(2467, 11),
 102         CHAN(2472, 12),
 103         CHAN(2484, 13),
 104 };
 105
 106 static struct ieee80211_channel ar9170_5ghz_chantable[] = {
 107         CHAN(4920, 14),
 108         CHAN(4940, 15),
 109         CHAN(4960, 16),
 110         CHAN(4980, 17),
 111         CHAN(5040, 18),
 112         CHAN(5060, 19),
 113         CHAN(5080, 20),
 114         CHAN(5180, 21),
 115         CHAN(5200, 22),
 116         CHAN(5220, 23),
 117         CHAN(5240, 24),
 118         CHAN(5260, 25),
 119         CHAN(5280, 26),
 120         CHAN(5300, 27),
 121         CHAN(5320, 28),
 122         CHAN(5500, 29),
 123         CHAN(5520, 30),
 124         CHAN(5540, 31),
 125         CHAN(5560, 32),
 126         CHAN(5580, 33),
 127         CHAN(5600, 34),
 128         CHAN(5620, 35),
 129         CHAN(5640, 36),
 130         CHAN(5660, 37),
 131         CHAN(5680, 38),
 132         CHAN(5700, 39),
 133         CHAN(5745, 40),
 134         CHAN(5765, 41),
 135         CHAN(5785, 42),
 136         CHAN(5805, 43),
 137         CHAN(5825, 44),
 138         CHAN(5170, 45),
 139         CHAN(5190, 46),
 140         CHAN(5210, 47),
 141         CHAN(5230, 48),
 142 };
 143 #undef CHAN
 144
 145 #define AR9170_HT_CAP                                                   \
 146 {                                                                       \
 147         .ht_supported   = true,                                         \
 148         .cap            = IEEE80211_HT_CAP_MAX_AMSDU |                  \
 149                           IEEE80211_HT_CAP_SM_PS |                      \
 150                           IEEE80211_HT_CAP_SUP_WIDTH_20_40 |            \
 151                           IEEE80211_HT_CAP_SGI_40 |                     \
 152                           IEEE80211_HT_CAP_DSSSCCK40 |                  \
 153                           IEEE80211_HT_CAP_SM_PS,                       \
 154         .ampdu_factor   = 3, /* ?? */                                   \
 155         .ampdu_density  = 7, /* ?? */                                   \
 156         .mcs            = {                                             \
 157                 .rx_mask = { 0xFF, 0xFF, 0, 0, 0, 0, 0, 0, 0, 0, },     \
 158         },                                                              \
 159 }
 160
 161 static struct ieee80211_supported_band ar9170_band_2GHz = {
 162         .channels       = ar9170_2ghz_chantable,
 163         .n_channels     = ARRAY_SIZE(ar9170_2ghz_chantable),
 164         .bitrates       = ar9170_g_ratetable,
 165         .n_bitrates     = ar9170_g_ratetable_size,
 166         .ht_cap         = AR9170_HT_CAP,
 167 };
 168
 169 static struct ieee80211_supported_band ar9170_band_5GHz = {
 170         .channels       = ar9170_5ghz_chantable,
 171         .n_channels     = ARRAY_SIZE(ar9170_5ghz_chantable),
 172         .bitrates       = ar9170_a_ratetable,
 173         .n_bitrates     = ar9170_a_ratetable_size,
 174         .ht_cap         = AR9170_HT_CAP,
 175 };
 176
 177 #ifdef AR9170_QUEUE_DEBUG
 178 /*
 179  * In case some wants works with AR9170's crazy tx_status queueing techniques.
 180  * He might need this rather useful probing function.
 181  *
 182  * NOTE: caller must hold the queue's spinlock!
 183  */
 184
 185 static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
 186 {
 187         struct ar9170_tx_control *txc = (void *) skb->data;
 188         struct ieee80211_hdr *hdr = (void *)txc->frame_data;
 189
 190         printk(KERN_DEBUG "%s: => FRAME [skb:%p, queue:%d, DA:[%pM] "
 191                           "mac_control:%04x, phy_control:%08x]\n",
 192                wiphy_name(ar->hw->wiphy), skb, skb_get_queue_mapping(skb),
 193                ieee80211_get_DA(hdr), le16_to_cpu(txc->mac_control),
 194                le32_to_cpu(txc->phy_control));
 195 }
 196
 197 static void ar9170_dump_station_tx_status_queue(struct ar9170 *ar,
 198                                                 struct sk_buff_head *queue)
 199 {
 200         struct sk_buff *skb;
 201         int i = 0;
 202
 203         printk(KERN_DEBUG "---[ cut here ]---\n");
 204         printk(KERN_DEBUG "%s: %d entries in tx_status queue.\n",
 205                wiphy_name(ar->hw->wiphy), skb_queue_len(queue));
 206
 207         skb_queue_walk(queue, skb) {
 208                 struct ar9170_tx_control *txc = (void *) skb->data;
 209                 struct ieee80211_hdr *hdr = (void *)txc->frame_data;
 210
 211                 printk(KERN_DEBUG "index:%d => \n", i);
 212                 ar9170_print_txheader(ar, skb);
 213         }
 214         printk(KERN_DEBUG "---[ end ]---\n");
 215 }
 216 #endif /* AR9170_QUEUE_DEBUG */
 217
 218 void ar9170_handle_tx_status(struct ar9170 *ar, struct sk_buff *skb,
 219                              bool valid_status, u16 tx_status)
 220 {
 221         struct ieee80211_tx_info *txinfo;
 222         unsigned int retries = 0, queue = skb_get_queue_mapping(skb);
 223         unsigned long flags;
 224
 225         spin_lock_irqsave(&ar->tx_stats_lock, flags);
 226         ar->tx_stats[queue].len--;
 227         if (ieee80211_queue_stopped(ar->hw, queue))
 228                 ieee80211_wake_queue(ar->hw, queue);
 229         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 230
 231         txinfo = IEEE80211_SKB_CB(skb);
 232         ieee80211_tx_info_clear_status(txinfo);
 233
 234         switch (tx_status) {
 235         case AR9170_TX_STATUS_RETRY:
 236                 retries = 2;
 237         case AR9170_TX_STATUS_COMPLETE:
 238                 txinfo->flags |= IEEE80211_TX_STAT_ACK;
 239                 break;
 240
 241         case AR9170_TX_STATUS_FAILED:
 242                 retries = ar->hw->conf.long_frame_max_tx_count;
 243                 break;
 244
 245         default:
 246                 printk(KERN_ERR "%s: invalid tx_status response (%x).\n",
 247                        wiphy_name(ar->hw->wiphy), tx_status);
 248                 break;
 249         }
 250
 251         if (valid_status)
 252                 txinfo->status.rates[0].count = retries + 1;
 253
 254         skb_pull(skb, sizeof(struct ar9170_tx_control));
 255         ieee80211_tx_status_irqsafe(ar->hw, skb);
 256 }
 257
 258 static struct sk_buff *ar9170_find_skb_in_queue(struct ar9170 *ar,
 259                                                 const u8 *mac,
 260                                                 const u32 queue,
 261                                                 struct sk_buff_head *q)
 262 {
 263         unsigned long flags;
 264         struct sk_buff *skb;
 265
 266         spin_lock_irqsave(&q->lock, flags);
 267         skb_queue_walk(q, skb) {
 268                 struct ar9170_tx_control *txc = (void *) skb->data;
 269                 struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 270                 u32 txc_queue = (le32_to_cpu(txc->phy_control) &
 271                                 AR9170_TX_PHY_QOS_MASK) >>
 272                                 AR9170_TX_PHY_QOS_SHIFT;
 273
 274                 if  ((queue != txc_queue) ||
 275                      (compare_ether_addr(ieee80211_get_DA(hdr), mac)))
 276                         continue;
 277
 278                 __skb_unlink(skb, q);
 279                 spin_unlock_irqrestore(&q->lock, flags);
 280                 return skb;
 281         }
 282         spin_unlock_irqrestore(&q->lock, flags);
 283         return NULL;
 284 }
 285
 286 static struct sk_buff *ar9170_find_queued_skb(struct ar9170 *ar, const u8 *mac,
 287                                               const u32 queue)
 288 {
 289         struct ieee80211_sta *sta;
 290         struct sk_buff *skb;
 291
 292         /*
 293          * Unfortunately, the firmware does not tell to which (queued) frame
 294          * this transmission status report belongs to.
 295          *
 296          * So we have to make risky guesses - with the scarce information
 297          * the firmware provided (-> destination MAC, and phy_control) -
 298          * and hope that we picked the right one...
 299          */
 300         rcu_read_lock();
 301         sta = ieee80211_find_sta(ar->hw, mac);
 302
 303         if (likely(sta)) {
 304                 struct ar9170_sta_info *sta_priv = (void *) sta->drv_priv;
 305                 skb = skb_dequeue(&sta_priv->tx_status[queue]);
 306                 rcu_read_unlock();
 307                 if (likely(skb))
 308                         return skb;
 309         } else
 310                 rcu_read_unlock();
 311
 312         /* scan the waste queue for candidates */
 313         skb = ar9170_find_skb_in_queue(ar, mac, queue,
 314                                        &ar->global_tx_status_waste);
 315         if (!skb) {
 316                 /* so it still _must_ be in the global list. */
 317                 skb = ar9170_find_skb_in_queue(ar, mac, queue,
 318                                                &ar->global_tx_status);
 319         }
 320
 321 #ifdef AR9170_QUEUE_DEBUG
 322         if (unlikely((!skb) && net_ratelimit())) {
 323                 printk(KERN_ERR "%s: ESS:[%pM] does not have any "
 324                                 "outstanding frames in this queue (%d).\n",
 325                                 wiphy_name(ar->hw->wiphy), mac, queue);
 326         }
 327 #endif /* AR9170_QUEUE_DEBUG */
 328         return skb;
 329 }
 330
 331 /*
 332  * This worker tries to keep the global tx_status queue empty.
 333  * So we can guarantee that incoming tx_status reports for
 334  * unregistered stations are always synced with the actual
 335  * frame - which we think - belongs to.
 336  */
 337
 338 static void ar9170_tx_status_janitor(struct work_struct *work)
 339 {
 340         struct ar9170 *ar = container_of(work, struct ar9170,
 341                                          tx_status_janitor.work);
 342         struct sk_buff *skb;
 343
 344         if (unlikely(!IS_STARTED(ar)))
 345                 return ;
 346
 347         mutex_lock(&ar->mutex);
 348         /* recycle the garbage back to mac80211... one by one. */
 349         while ((skb = skb_dequeue(&ar->global_tx_status_waste))) {
 350 #ifdef AR9170_QUEUE_DEBUG
 351                 printk(KERN_DEBUG "%s: dispose queued frame =>\n",
 352                        wiphy_name(ar->hw->wiphy));
 353                 ar9170_print_txheader(ar, skb);
 354 #endif /* AR9170_QUEUE_DEBUG */
 355                 ar9170_handle_tx_status(ar, skb, false,
 356                                         AR9170_TX_STATUS_FAILED);
 357         }
 358
 359         while ((skb = skb_dequeue(&ar->global_tx_status))) {
 360 #ifdef AR9170_QUEUE_DEBUG
 361                 printk(KERN_DEBUG "%s: moving frame into waste queue =>\n",
 362                        wiphy_name(ar->hw->wiphy));
 363
 364                 ar9170_print_txheader(ar, skb);
 365 #endif /* AR9170_QUEUE_DEBUG */
 366                 skb_queue_tail(&ar->global_tx_status_waste, skb);
 367         }
 368
 369         /* recall the janitor in 100ms - if there's garbage in the can. */
 370         if (skb_queue_len(&ar->global_tx_status_waste) > 0)
 371                 queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
 372                                    msecs_to_jiffies(100));
 373
 374         mutex_unlock(&ar->mutex);
 375 }
 376
 377 static void ar9170_handle_command_response(struct ar9170 *ar,
 378                                            void *buf, u32 len)
 379 {
 380         struct ar9170_cmd_response *cmd = (void *) buf;
 381
 382         if ((cmd->type & 0xc0) != 0xc0) {
 383                 ar->callback_cmd(ar, len, buf);
 384                 return;
 385         }
 386
 387         /* hardware event handlers */
 388         switch (cmd->type) {
 389         case 0xc1: {
 390                 /*
 391                  * TX status notification:
 392                  * bytes: 0c c1 XX YY M1 M2 M3 M4 M5 M6 R4 R3 R2 R1 S2 S1
 393                  *
 394                  * XX always 81
 395                  * YY always 00
 396                  * M1-M6 is the MAC address
 397                  * R1-R4 is the transmit rate
 398                  * S1-S2 is the transmit status
 399                  */
 400
 401                 struct sk_buff *skb;
 402                 u32 queue = (le32_to_cpu(cmd->tx_status.rate) &
 403                             AR9170_TX_PHY_QOS_MASK) >> AR9170_TX_PHY_QOS_SHIFT;
 404
 405                 skb = ar9170_find_queued_skb(ar, cmd->tx_status.dst, queue);
 406                 if (unlikely(!skb))
 407                         return ;
 408
 409                 ar9170_handle_tx_status(ar, skb, true,
 410                                         le16_to_cpu(cmd->tx_status.status));
 411                 break;
 412                 }
 413
 414         case 0xc0:
 415                 /*
 416                  * pre-TBTT event
 417                  */
 418                 if (ar->vif && ar->vif->type == NL80211_IFTYPE_AP)
 419                         queue_work(ar->hw->workqueue, &ar->beacon_work);
 420                 break;
 421
 422         case 0xc2:
 423                 /*
 424                  * (IBSS) beacon send notification
 425                  * bytes: 04 c2 XX YY B4 B3 B2 B1
 426                  *
 427                  * XX always 80
 428                  * YY always 00
 429                  * B1-B4 "should" be the number of send out beacons.
 430                  */
 431                 break;
 432
 433         case 0xc3:
 434                 /* End of Atim Window */
 435                 break;
 436
 437         case 0xc4:
 438         case 0xc5:
 439                 /* BlockACK events */
 440                 break;
 441
 442         case 0xc6:
 443                 /* Watchdog Interrupt */
 444                 break;
 445
 446         case 0xc9:
 447                 /* retransmission issue / SIFS/EIFS collision ?! */
 448                 break;
 449
 450         default:
 451                 printk(KERN_INFO "received unhandled event %x\n", cmd->type);
 452                 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
 453                 break;
 454         }
 455 }
 456
 457 static void ar9170_rx_reset_rx_mpdu(struct ar9170 *ar)
 458 {
 459         memset(&ar->rx_mpdu.plcp, 0, sizeof(struct ar9170_rx_head));
 460         ar->rx_mpdu.has_plcp = false;
 461 }
 462
 463 static int ar9170_nag_limiter(struct ar9170 *ar)
 464 {
 465         bool print_message;
 466
 467         /*
 468          * we expect all sorts of errors in promiscuous mode.
 469          * don't bother with it, it's OK!
 470          */
 471         if (ar->sniffer_enabled)
 472                 return false;
 473
 474         /*
 475          * only go for frequent errors! The hardware tends to
 476          * do some stupid thing once in a while under load, in
 477          * noisy environments or just for fun!
 478          */
 479         if (time_before(jiffies, ar->bad_hw_nagger) && net_ratelimit())
 480                 print_message = true;
 481         else
 482                 print_message = false;
 483
 484         /* reset threshold for "once in a while" */
 485         ar->bad_hw_nagger = jiffies + HZ / 4;
 486         return print_message;
 487 }
 488
 489 static int ar9170_rx_mac_status(struct ar9170 *ar,
 490                                 struct ar9170_rx_head *head,
 491                                 struct ar9170_rx_macstatus *mac,
 492                                 struct ieee80211_rx_status *status)
 493 {
 494         u8 error, decrypt;
 495
 496         BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
 497         BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4);
 498
 499         error = mac->error;
 500         if (error & AR9170_RX_ERROR_MMIC) {
 501                 status->flag |= RX_FLAG_MMIC_ERROR;
 502                 error &= ~AR9170_RX_ERROR_MMIC;
 503         }
 504
 505         if (error & AR9170_RX_ERROR_PLCP) {
 506                 status->flag |= RX_FLAG_FAILED_PLCP_CRC;
 507                 error &= ~AR9170_RX_ERROR_PLCP;
 508
 509                 if (!(ar->filter_state & FIF_PLCPFAIL))
 510                         return -EINVAL;
 511         }
 512
 513         if (error & AR9170_RX_ERROR_FCS) {
 514                 status->flag |= RX_FLAG_FAILED_FCS_CRC;
 515                 error &= ~AR9170_RX_ERROR_FCS;
 516
 517                 if (!(ar->filter_state & FIF_FCSFAIL))
 518                         return -EINVAL;
 519         }
 520
 521         decrypt = ar9170_get_decrypt_type(mac);
 522         if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
 523             decrypt != AR9170_ENC_ALG_NONE)
 524                 status->flag |= RX_FLAG_DECRYPTED;
 525
 526         /* ignore wrong RA errors */
 527         error &= ~AR9170_RX_ERROR_WRONG_RA;
 528
 529         if (error & AR9170_RX_ERROR_DECRYPT) {
 530                 error &= ~AR9170_RX_ERROR_DECRYPT;
 531                 /*
 532                  * Rx decryption is done in place,
 533                  * the original data is lost anyway.
 534                  */
 535
 536                 return -EINVAL;
 537         }
 538
 539         /* drop any other error frames */
 540         if (unlikely(error)) {
 541                 /* TODO: update netdevice's RX dropped/errors statistics */
 542
 543                 if (ar9170_nag_limiter(ar))
 544                         printk(KERN_DEBUG "%s: received frame with "
 545                                "suspicious error code (%#x).\n",
 546                                wiphy_name(ar->hw->wiphy), error);
 547
 548                 return -EINVAL;
 549         }
 550
 551         status->band = ar->channel->band;
 552         status->freq = ar->channel->center_freq;
 553
 554         switch (mac->status & AR9170_RX_STATUS_MODULATION_MASK) {
 555         case AR9170_RX_STATUS_MODULATION_CCK:
 556                 if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
 557                         status->flag |= RX_FLAG_SHORTPRE;
 558                 switch (head->plcp[0]) {
 559                 case 0x0a:
 560                         status->rate_idx = 0;
 561                         break;
 562                 case 0x14:
 563                         status->rate_idx = 1;
 564                         break;
 565                 case 0x37:
 566                         status->rate_idx = 2;
 567                         break;
 568                 case 0x6e:
 569                         status->rate_idx = 3;
 570                         break;
 571                 default:
 572                         if (ar9170_nag_limiter(ar))
 573                                 printk(KERN_ERR "%s: invalid plcp cck rate "
 574                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 575                                        head->plcp[0]);
 576                         return -EINVAL;
 577                 }
 578                 break;
 579
 580         case AR9170_RX_STATUS_MODULATION_OFDM:
 581                 switch (head->plcp[0] & 0xf) {
 582                 case 0xb:
 583                         status->rate_idx = 0;
 584                         break;
 585                 case 0xf:
 586                         status->rate_idx = 1;
 587                         break;
 588                 case 0xa:
 589                         status->rate_idx = 2;
 590                         break;
 591                 case 0xe:
 592                         status->rate_idx = 3;
 593                         break;
 594                 case 0x9:
 595                         status->rate_idx = 4;
 596                         break;
 597                 case 0xd:
 598                         status->rate_idx = 5;
 599                         break;
 600                 case 0x8:
 601                         status->rate_idx = 6;
 602                         break;
 603                 case 0xc:
 604                         status->rate_idx = 7;
 605                         break;
 606                 default:
 607                         if (ar9170_nag_limiter(ar))
 608                                 printk(KERN_ERR "%s: invalid plcp ofdm rate "
 609                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 610                                        head->plcp[0]);
 611                         return -EINVAL;
 612                 }
 613                 if (status->band == IEEE80211_BAND_2GHZ)
 614                         status->rate_idx += 4;
 615                 break;
 616
 617         case AR9170_RX_STATUS_MODULATION_HT:
 618                 if (head->plcp[3] & 0x80)
 619                         status->flag |= RX_FLAG_40MHZ;
 620                 if (head->plcp[6] & 0x80)
 621                         status->flag |= RX_FLAG_SHORT_GI;
 622
 623                 status->rate_idx = clamp(0, 75, head->plcp[6] & 0x7f);
 624                 status->flag |= RX_FLAG_HT;
 625                 break;
 626
 627         case AR9170_RX_STATUS_MODULATION_DUPOFDM:
 628                 /* XXX */
 629                 if (ar9170_nag_limiter(ar))
 630                         printk(KERN_ERR "%s: invalid modulation\n",
 631                                wiphy_name(ar->hw->wiphy));
 632                 return -EINVAL;
 633         }
 634
 635         return 0;
 636 }
 637
 638 static void ar9170_rx_phy_status(struct ar9170 *ar,
 639                                  struct ar9170_rx_phystatus *phy,
 640                                  struct ieee80211_rx_status *status)
 641 {
 642         int i;
 643
 644         BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20);
 645
 646         for (i = 0; i < 3; i++)
 647                 if (phy->rssi[i] != 0x80)
 648                         status->antenna |= BIT(i);
 649
 650         /* post-process RSSI */
 651         for (i = 0; i < 7; i++)
 652                 if (phy->rssi[i] & 0x80)
 653                         phy->rssi[i] = ((phy->rssi[i] & 0x7f) + 1) & 0x7f;
 654
 655         /* TODO: we could do something with phy_errors */
 656         status->signal = ar->noise[0] + phy->rssi_combined;
 657         status->noise = ar->noise[0];
 658 }
 659
 660 static struct sk_buff *ar9170_rx_copy_data(u8 *buf, int len)
 661 {
 662         struct sk_buff *skb;
 663         int reserved = 0;
 664         struct ieee80211_hdr *hdr = (void *) buf;
 665
 666         if (ieee80211_is_data_qos(hdr->frame_control)) {
 667                 u8 *qc = ieee80211_get_qos_ctl(hdr);
 668                 reserved += NET_IP_ALIGN;
 669
 670                 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
 671                         reserved += NET_IP_ALIGN;
 672         }
 673
 674         if (ieee80211_has_a4(hdr->frame_control))
 675                 reserved += NET_IP_ALIGN;
 676
 677         reserved = 32 + (reserved & NET_IP_ALIGN);
 678
 679         skb = dev_alloc_skb(len + reserved);
 680         if (likely(skb)) {
 681                 skb_reserve(skb, reserved);
 682                 memcpy(skb_put(skb, len), buf, len);
 683         }
 684
 685         return skb;
 686 }
 687
 688 /*
 689  * If the frame alignment is right (or the kernel has
 690  * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
 691  * is only a single MPDU in the USB frame, then we could
 692  * submit to mac80211 the SKB directly. However, since
 693  * there may be multiple packets in one SKB in stream
 694  * mode, and we need to observe the proper ordering,
 695  * this is non-trivial.
 696  */
 697
 698 static void ar9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
 699 {
 700         struct ar9170_rx_head *head;
 701         struct ar9170_rx_macstatus *mac;
 702         struct ar9170_rx_phystatus *phy = NULL;
 703         struct ieee80211_rx_status status;
 704         struct sk_buff *skb;
 705         int mpdu_len;
 706
 707         if (unlikely(!IS_STARTED(ar) || len < (sizeof(*mac))))
 708                 return ;
 709
 710         /* Received MPDU */
 711         mpdu_len = len - sizeof(*mac);
 712
 713         mac = (void *)(buf + mpdu_len);
 714         if (unlikely(mac->error & AR9170_RX_ERROR_FATAL)) {
 715                 /* this frame is too damaged and can't be used - drop it */
 716
 717                 return ;
 718         }
 719
 720         switch (mac->status & AR9170_RX_STATUS_MPDU_MASK) {
 721         case AR9170_RX_STATUS_MPDU_FIRST:
 722                 /* first mpdu packet has the plcp header */
 723                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) {
 724                         head = (void *) buf;
 725                         memcpy(&ar->rx_mpdu.plcp, (void *) buf,
 726                                sizeof(struct ar9170_rx_head));
 727
 728                         mpdu_len -= sizeof(struct ar9170_rx_head);
 729                         buf += sizeof(struct ar9170_rx_head);
 730                         ar->rx_mpdu.has_plcp = true;
 731                 } else {
 732                         if (ar9170_nag_limiter(ar))
 733                                 printk(KERN_ERR "%s: plcp info is clipped.\n",
 734                                        wiphy_name(ar->hw->wiphy));
 735                         return ;
 736                 }
 737                 break;
 738
 739         case AR9170_RX_STATUS_MPDU_LAST:
 740                 /* last mpdu has a extra tail with phy status information */
 741
 742                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) {
 743                         mpdu_len -= sizeof(struct ar9170_rx_phystatus);
 744                         phy = (void *)(buf + mpdu_len);
 745                 } else {
 746                         if (ar9170_nag_limiter(ar))
 747                                 printk(KERN_ERR "%s: frame tail is clipped.\n",
 748                                        wiphy_name(ar->hw->wiphy));
 749                         return ;
 750                 }
 751
 752         case AR9170_RX_STATUS_MPDU_MIDDLE:
 753                 /* middle mpdus are just data */
 754                 if (unlikely(!ar->rx_mpdu.has_plcp)) {
 755                         if (!ar9170_nag_limiter(ar))
 756                                 return ;
 757
 758                         printk(KERN_ERR "%s: rx stream did not start "
 759                                         "with a first_mpdu frame tag.\n",
 760                                wiphy_name(ar->hw->wiphy));
 761
 762                         return ;
 763                 }
 764
 765                 head = &ar->rx_mpdu.plcp;
 766                 break;
 767
 768         case AR9170_RX_STATUS_MPDU_SINGLE:
 769                 /* single mpdu - has plcp (head) and phy status (tail) */
 770                 head = (void *) buf;
 771
 772                 mpdu_len -= sizeof(struct ar9170_rx_head);
 773                 mpdu_len -= sizeof(struct ar9170_rx_phystatus);
 774
 775                 buf += sizeof(struct ar9170_rx_head);
 776                 phy = (void *)(buf + mpdu_len);
 777                 break;
 778
 779         default:
 780                 BUG_ON(1);
 781                 break;
 782         }
 783
 784         if (unlikely(mpdu_len < FCS_LEN))
 785                 return ;
 786
 787         memset(&status, 0, sizeof(status));
 788         if (unlikely(ar9170_rx_mac_status(ar, head, mac, &status)))
 789                 return ;
 790
 791         if (phy)
 792                 ar9170_rx_phy_status(ar, phy, &status);
 793
 794         skb = ar9170_rx_copy_data(buf, mpdu_len);
 795         if (likely(skb))
 796                 ieee80211_rx_irqsafe(ar->hw, skb, &status);
 797 }
 798
 799 void ar9170_rx(struct ar9170 *ar, struct sk_buff *skb)
 800 {
 801         unsigned int i, tlen, resplen, wlen = 0, clen = 0;
 802         u8 *tbuf, *respbuf;
 803
 804         tbuf = skb->data;
 805         tlen = skb->len;
 806
 807         while (tlen >= 4) {
 808                 clen = tbuf[1] << 8 | tbuf[0];
 809                 wlen = ALIGN(clen, 4);
 810
 811                 /* check if this is stream has a valid tag.*/
 812                 if (tbuf[2] != 0 || tbuf[3] != 0x4e) {
 813                         /*
 814                          * TODO: handle the highly unlikely event that the
 815                          * corrupted stream has the TAG at the right position.
 816                          */
 817
 818                         /* check if the frame can be repaired. */
 819                         if (!ar->rx_failover_missing) {
 820                                 /* this is no "short read". */
 821                                 if (ar9170_nag_limiter(ar)) {
 822                                         printk(KERN_ERR "%s: missing tag!\n",
 823                                                wiphy_name(ar->hw->wiphy));
 824                                         goto err_telluser;
 825                                 } else
 826                                         goto err_silent;
 827                         }
 828
 829                         if (ar->rx_failover_missing > tlen) {
 830                                 if (ar9170_nag_limiter(ar)) {
 831                                         printk(KERN_ERR "%s: possible multi "
 832                                                "stream corruption!\n",
 833                                                wiphy_name(ar->hw->wiphy));
 834                                         goto err_telluser;
 835                                 } else
 836                                         goto err_silent;
 837                         }
 838
 839                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
 840                         ar->rx_failover_missing -= tlen;
 841
 842                         if (ar->rx_failover_missing <= 0) {
 843                                 /*
 844                                  * nested ar9170_rx call!
 845                                  * termination is guranteed, even when the
 846                                  * combined frame also have a element with
 847                                  * a bad tag.
 848                                  */
 849
 850                                 ar->rx_failover_missing = 0;
 851                                 ar9170_rx(ar, ar->rx_failover);
 852
 853                                 skb_reset_tail_pointer(ar->rx_failover);
 854                                 skb_trim(ar->rx_failover, 0);
 855                         }
 856
 857                         return ;
 858                 }
 859
 860                 /* check if stream is clipped */
 861                 if (wlen > tlen - 4) {
 862                         if (ar->rx_failover_missing) {
 863                                 /* TODO: handle double stream corruption. */
 864                                 if (ar9170_nag_limiter(ar)) {
 865                                         printk(KERN_ERR "%s: double rx stream "
 866                                                "corruption!\n",
 867                                                 wiphy_name(ar->hw->wiphy));
 868                                         goto err_telluser;
 869                                 } else
 870                                         goto err_silent;
 871                         }
 872
 873                         /*
 874                          * save incomplete data set.
 875                          * the firmware will resend the missing bits when
 876                          * the rx - descriptor comes round again.
 877                          */
 878
 879                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
 880                         ar->rx_failover_missing = clen - tlen;
 881                         return ;
 882                 }
 883                 resplen = clen;
 884                 respbuf = tbuf + 4;
 885                 tbuf += wlen + 4;
 886                 tlen -= wlen + 4;
 887
 888                 i = 0;
 889
 890                 /* weird thing, but this is the same in the original driver */
 891                 while (resplen > 2 && i < 12 &&
 892                        respbuf[0] == 0xff && respbuf[1] == 0xff) {
 893                         i += 2;
 894                         resplen -= 2;
 895                         respbuf += 2;
 896                 }
 897
 898                 if (resplen < 4)
 899                         continue;
 900
 901                 /* found the 6 * 0xffff marker? */
 902                 if (i == 12)
 903                         ar9170_handle_command_response(ar, respbuf, resplen);
 904                 else
 905                         ar9170_handle_mpdu(ar, respbuf, clen);
 906         }
 907
 908         if (tlen) {
 909                 if (net_ratelimit())
 910                         printk(KERN_ERR "%s: %d bytes of unprocessed "
 911                                         "data left in rx stream!\n",
 912                                wiphy_name(ar->hw->wiphy), tlen);
 913
 914                 goto err_telluser;
 915         }
 916
 917         return ;
 918
 919 err_telluser:
 920         printk(KERN_ERR "%s: damaged RX stream data [want:%d, "
 921                         "data:%d, rx:%d, pending:%d ]\n",
 922                wiphy_name(ar->hw->wiphy), clen, wlen, tlen,
 923                ar->rx_failover_missing);
 924
 925         if (ar->rx_failover_missing)
 926                 print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET,
 927                                      ar->rx_failover->data,
 928                                      ar->rx_failover->len);
 929
 930         print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET,
 931                              skb->data, skb->len);
 932
 933         printk(KERN_ERR "%s: please check your hardware and cables, if "
 934                         "you see this message frequently.\n",
 935                wiphy_name(ar->hw->wiphy));
 936
 937 err_silent:
 938         if (ar->rx_failover_missing) {
 939                 skb_reset_tail_pointer(ar->rx_failover);
 940                 skb_trim(ar->rx_failover, 0);
 941                 ar->rx_failover_missing = 0;
 942         }
 943 }
 944
 945 #define AR9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)            \
 946 do {                                                                    \
 947         queue.aifs = ai_fs;                                             \
 948         queue.cw_min = cwmin;                                           \
 949         queue.cw_max = cwmax;                                           \
 950         queue.txop = _txop;                                             \
 951 } while (0)
 952
 953 static int ar9170_op_start(struct ieee80211_hw *hw)
 954 {
 955         struct ar9170 *ar = hw->priv;
 956         int err, i;
 957
 958         mutex_lock(&ar->mutex);
 959
 960         /* reinitialize queues statistics */
 961         memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
 962         for (i = 0; i < ARRAY_SIZE(ar->tx_stats); i++)
 963                 ar->tx_stats[i].limit = 8;
 964
 965         /* reset QoS defaults */
 966         AR9170_FILL_QUEUE(ar->edcf[0], 3, 15, 1023,  0); /* BEST EFFORT*/
 967         AR9170_FILL_QUEUE(ar->edcf[1], 7, 15, 1023,  0); /* BACKGROUND */
 968         AR9170_FILL_QUEUE(ar->edcf[2], 2, 7,    15, 94); /* VIDEO */
 969         AR9170_FILL_QUEUE(ar->edcf[3], 2, 3,     7, 47); /* VOICE */
 970         AR9170_FILL_QUEUE(ar->edcf[4], 2, 3,     7,  0); /* SPECIAL */
 971
 972         ar->bad_hw_nagger = jiffies;
 973
 974         err = ar->open(ar);
 975         if (err)
 976                 goto out;
 977
 978         err = ar9170_init_mac(ar);
 979         if (err)
 980                 goto out;
 981
 982         err = ar9170_set_qos(ar);
 983         if (err)
 984                 goto out;
 985
 986         err = ar9170_init_phy(ar, IEEE80211_BAND_2GHZ);
 987         if (err)
 988                 goto out;
 989
 990         err = ar9170_init_rf(ar);
 991         if (err)
 992                 goto out;
 993
 994         /* start DMA */
 995         err = ar9170_write_reg(ar, 0x1c3d30, 0x100);
 996         if (err)
 997                 goto out;
 998
 999         ar->state = AR9170_STARTED;
1000
1001 out:
1002         mutex_unlock(&ar->mutex);
1003         return err;
1004 }
1005
1006 static void ar9170_op_stop(struct ieee80211_hw *hw)
1007 {
1008         struct ar9170 *ar = hw->priv;
1009
1010         if (IS_STARTED(ar))
1011                 ar->state = AR9170_IDLE;
1012
1013         flush_workqueue(ar->hw->workqueue);
1014
1015         mutex_lock(&ar->mutex);
1016         cancel_delayed_work_sync(&ar->tx_status_janitor);
1017         cancel_work_sync(&ar->filter_config_work);
1018         cancel_work_sync(&ar->beacon_work);
1019         skb_queue_purge(&ar->global_tx_status_waste);
1020         skb_queue_purge(&ar->global_tx_status);
1021
1022         if (IS_ACCEPTING_CMD(ar)) {
1023                 ar9170_set_leds_state(ar, 0);
1024
1025                 /* stop DMA */
1026                 ar9170_write_reg(ar, 0x1c3d30, 0);
1027                 ar->stop(ar);
1028         }
1029
1030         mutex_unlock(&ar->mutex);
1031 }
1032
1033 int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
1034 {
1035         struct ar9170 *ar = hw->priv;
1036         struct ieee80211_hdr *hdr;
1037         struct ar9170_tx_control *txc;
1038         struct ieee80211_tx_info *info;
1039         struct ieee80211_rate *rate = NULL;
1040         struct ieee80211_tx_rate *txrate;
1041         unsigned int queue = skb_get_queue_mapping(skb);
1042         unsigned long flags = 0;
1043         struct ar9170_sta_info *sta_info = NULL;
1044         u32 power, chains;
1045         u16 keytype = 0;
1046         u16 len, icv = 0;
1047         int err;
1048         bool tx_status;
1049
1050         if (unlikely(!IS_STARTED(ar)))
1051                 goto err_free;
1052
1053         hdr = (void *)skb->data;
1054         info = IEEE80211_SKB_CB(skb);
1055         len = skb->len;
1056
1057         spin_lock_irqsave(&ar->tx_stats_lock, flags);
1058         if (ar->tx_stats[queue].limit < ar->tx_stats[queue].len) {
1059                 spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1060                 return NETDEV_TX_OK;
1061         }
1062
1063         ar->tx_stats[queue].len++;
1064         ar->tx_stats[queue].count++;
1065         if (ar->tx_stats[queue].limit == ar->tx_stats[queue].len)
1066                 ieee80211_stop_queue(hw, queue);
1067
1068         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1069
1070         txc = (void *)skb_push(skb, sizeof(*txc));
1071
1072         tx_status = (((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) != 0) ||
1073                     ((info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) != 0));
1074
1075         if (info->control.hw_key) {
1076                 icv = info->control.hw_key->icv_len;
1077
1078                 switch (info->control.hw_key->alg) {
1079                 case ALG_WEP:
1080                         keytype = AR9170_TX_MAC_ENCR_RC4;
1081                         break;
1082                 case ALG_TKIP:
1083                         keytype = AR9170_TX_MAC_ENCR_RC4;
1084                         break;
1085                 case ALG_CCMP:
1086                         keytype = AR9170_TX_MAC_ENCR_AES;
1087                         break;
1088                 default:
1089                         WARN_ON(1);
1090                         goto err_dequeue;
1091                 }
1092         }
1093
1094         /* Length */
1095         txc->length = cpu_to_le16(len + icv + 4);
1096
1097         txc->mac_control = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
1098                                        AR9170_TX_MAC_BACKOFF);
1099         txc->mac_control |= cpu_to_le16(ar9170_qos_hwmap[queue] <<
1100                                         AR9170_TX_MAC_QOS_SHIFT);
1101         txc->mac_control |= cpu_to_le16(keytype);
1102         txc->phy_control = cpu_to_le32(0);
1103
1104         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1105                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_NO_ACK);
1106
1107         if (info->flags & IEEE80211_TX_CTL_AMPDU)
1108                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
1109
1110         txrate = &info->control.rates[0];
1111
1112         if (txrate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1113                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
1114         else if (txrate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1115                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
1116
1117         if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1118                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_GREENFIELD);
1119
1120         if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1121                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_PREAMBLE);
1122
1123         if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1124                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ);
1125         /* this works because 40 MHz is 2 and dup is 3 */
1126         if (txrate->flags & IEEE80211_TX_RC_DUP_DATA)
1127                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ_DUP);
1128
1129         if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
1130                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_GI);
1131
1132         if (txrate->flags & IEEE80211_TX_RC_MCS) {
1133                 u32 r = txrate->idx;
1134                 u8 *txpower;
1135
1136                 r <<= AR9170_TX_PHY_MCS_SHIFT;
1137                 if (WARN_ON(r & ~AR9170_TX_PHY_MCS_MASK))
1138                         goto err_dequeue;
1139                 txc->phy_control |= cpu_to_le32(r & AR9170_TX_PHY_MCS_MASK);
1140                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_MOD_HT);
1141
1142                 if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
1143                         if (info->band == IEEE80211_BAND_5GHZ)
1144                                 txpower = ar->power_5G_ht40;
1145                         else
1146                                 txpower = ar->power_2G_ht40;
1147                 } else {
1148                         if (info->band == IEEE80211_BAND_5GHZ)
1149                                 txpower = ar->power_5G_ht20;
1150                         else
1151                                 txpower = ar->power_2G_ht20;
1152                 }
1153
1154                 power = txpower[(txrate->idx) & 7];
1155         } else {
1156                 u8 *txpower;
1157                 u32 mod;
1158                 u32 phyrate;
1159                 u8 idx = txrate->idx;
1160
1161                 if (info->band != IEEE80211_BAND_2GHZ) {
1162                         idx += 4;
1163                         txpower = ar->power_5G_leg;
1164                         mod = AR9170_TX_PHY_MOD_OFDM;
1165                 } else {
1166                         if (idx < 4) {
1167                                 txpower = ar->power_2G_cck;
1168                                 mod = AR9170_TX_PHY_MOD_CCK;
1169                         } else {
1170                                 mod = AR9170_TX_PHY_MOD_OFDM;
1171                                 txpower = ar->power_2G_ofdm;
1172                         }
1173                 }
1174
1175                 rate = &__ar9170_ratetable[idx];
1176
1177                 phyrate = rate->hw_value & 0xF;
1178                 power = txpower[(rate->hw_value & 0x30) >> 4];
1179                 phyrate <<= AR9170_TX_PHY_MCS_SHIFT;
1180
1181                 txc->phy_control |= cpu_to_le32(mod);
1182                 txc->phy_control |= cpu_to_le32(phyrate);
1183         }
1184
1185         power <<= AR9170_TX_PHY_TX_PWR_SHIFT;
1186         power &= AR9170_TX_PHY_TX_PWR_MASK;
1187         txc->phy_control |= cpu_to_le32(power);
1188
1189         /* set TX chains */
1190         if (ar->eeprom.tx_mask == 1) {
1191                 chains = AR9170_TX_PHY_TXCHAIN_1;
1192         } else {
1193                 chains = AR9170_TX_PHY_TXCHAIN_2;
1194
1195                 /* >= 36M legacy OFDM - use only one chain */
1196                 if (rate && rate->bitrate >= 360)
1197                         chains = AR9170_TX_PHY_TXCHAIN_1;
1198         }
1199         txc->phy_control |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_SHIFT);
1200
1201         if (tx_status) {
1202                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
1203                 /*
1204                  * WARNING:
1205                  * Putting the QoS queue bits into an unexplored territory is
1206                  * certainly not elegant.
1207                  *
1208                  * In my defense: This idea provides a reasonable way to
1209                  * smuggle valuable information to the tx_status callback.
1210                  * Also, the idea behind this bit-abuse came straight from
1211                  * the original driver code.
1212                  */
1213
1214                 txc->phy_control |=
1215                         cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
1216
1217                 if (info->control.sta) {
1218                         sta_info = (void *) info->control.sta->drv_priv;
1219                         skb_queue_tail(&sta_info->tx_status[queue], skb);
1220                 } else {
1221                         skb_queue_tail(&ar->global_tx_status, skb);
1222
1223                         queue_delayed_work(ar->hw->workqueue,
1224                                            &ar->tx_status_janitor,
1225                                            msecs_to_jiffies(100));
1226                 }
1227         }
1228
1229         err = ar->tx(ar, skb, tx_status, 0);
1230         if (unlikely(tx_status && err)) {
1231                 if (info->control.sta)
1232                         skb_unlink(skb, &sta_info->tx_status[queue]);
1233                 else
1234                         skb_unlink(skb, &ar->global_tx_status);
1235         }
1236
1237         return NETDEV_TX_OK;
1238
1239 err_dequeue:
1240         spin_lock_irqsave(&ar->tx_stats_lock, flags);
1241         ar->tx_stats[queue].len--;
1242         ar->tx_stats[queue].count--;
1243         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1244
1245 err_free:
1246         dev_kfree_skb(skb);
1247         return NETDEV_TX_OK;
1248 }
1249
1250 static int ar9170_op_add_interface(struct ieee80211_hw *hw,
1251                                    struct ieee80211_if_init_conf *conf)
1252 {
1253         struct ar9170 *ar = hw->priv;
1254         int err = 0;
1255
1256         mutex_lock(&ar->mutex);
1257
1258         if (ar->vif) {
1259                 err = -EBUSY;
1260                 goto unlock;
1261         }
1262
1263         ar->vif = conf->vif;
1264         memcpy(ar->mac_addr, conf->mac_addr, ETH_ALEN);
1265
1266         if (modparam_nohwcrypt || (ar->vif->type != NL80211_IFTYPE_STATION)) {
1267                 ar->rx_software_decryption = true;
1268                 ar->disable_offload = true;
1269         }
1270
1271         ar->cur_filter = 0;
1272         ar->want_filter = AR9170_MAC_REG_FTF_DEFAULTS;
1273         err = ar9170_update_frame_filter(ar);
1274         if (err)
1275                 goto unlock;
1276
1277         err = ar9170_set_operating_mode(ar);
1278
1279 unlock:
1280         mutex_unlock(&ar->mutex);
1281         return err;
1282 }
1283
1284 static void ar9170_op_remove_interface(struct ieee80211_hw *hw,
1285                                        struct ieee80211_if_init_conf *conf)
1286 {
1287         struct ar9170 *ar = hw->priv;
1288
1289         mutex_lock(&ar->mutex);
1290         ar->vif = NULL;
1291         ar->want_filter = 0;
1292         ar9170_update_frame_filter(ar);
1293         ar9170_set_beacon_timers(ar);
1294         dev_kfree_skb(ar->beacon);
1295         ar->beacon = NULL;
1296         ar->sniffer_enabled = false;
1297         ar->rx_software_decryption = false;
1298         ar9170_set_operating_mode(ar);
1299         mutex_unlock(&ar->mutex);
1300 }
1301
1302 static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
1303 {
1304         struct ar9170 *ar = hw->priv;
1305         int err = 0;
1306
1307         mutex_lock(&ar->mutex);
1308
1309         if (changed & IEEE80211_CONF_CHANGE_RADIO_ENABLED) {
1310                 /* TODO */
1311                 err = 0;
1312         }
1313
1314         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
1315                 /* TODO */
1316                 err = 0;
1317         }
1318
1319         if (changed & IEEE80211_CONF_CHANGE_PS) {
1320                 /* TODO */
1321                 err = 0;
1322         }
1323
1324         if (changed & IEEE80211_CONF_CHANGE_POWER) {
1325                 /* TODO */
1326                 err = 0;
1327         }
1328
1329         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
1330                 /*
1331                  * is it long_frame_max_tx_count or short_frame_max_tx_count?
1332                  */
1333
1334                 err = ar9170_set_hwretry_limit(ar,
1335                         ar->hw->conf.long_frame_max_tx_count);
1336                 if (err)
1337                         goto out;
1338         }
1339
1340         if (changed & IEEE80211_CONF_CHANGE_BEACON_INTERVAL) {
1341                 err = ar9170_set_beacon_timers(ar);
1342                 if (err)
1343                         goto out;
1344         }
1345
1346         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
1347                 err = ar9170_set_channel(ar, hw->conf.channel,
1348                                 AR9170_RFI_NONE,
1349                                 nl80211_to_ar9170(hw->conf.channel_type));
1350                 if (err)
1351                         goto out;
1352                 /* adjust slot time for 5 GHz */
1353                 if (hw->conf.channel->band == IEEE80211_BAND_5GHZ)
1354                         err = ar9170_write_reg(ar, AR9170_MAC_REG_SLOT_TIME,
1355                                                9 << 10);
1356         }
1357
1358 out:
1359         mutex_unlock(&ar->mutex);
1360         return err;
1361 }
1362
1363 static int ar9170_op_config_interface(struct ieee80211_hw *hw,
1364                                       struct ieee80211_vif *vif,
1365                                       struct ieee80211_if_conf *conf)
1366 {
1367         struct ar9170 *ar = hw->priv;
1368         int err = 0;
1369
1370         mutex_lock(&ar->mutex);
1371
1372         if (conf->changed & IEEE80211_IFCC_BSSID) {
1373                 memcpy(ar->bssid, conf->bssid, ETH_ALEN);
1374                 err = ar9170_set_operating_mode(ar);
1375         }
1376
1377         if (conf->changed & IEEE80211_IFCC_BEACON) {
1378                 err = ar9170_update_beacon(ar);
1379
1380                 if (err)
1381                         goto out;
1382                 err = ar9170_set_beacon_timers(ar);
1383         }
1384
1385 out:
1386         mutex_unlock(&ar->mutex);
1387         return err;
1388 }
1389
1390 static void ar9170_set_filters(struct work_struct *work)
1391 {
1392         struct ar9170 *ar = container_of(work, struct ar9170,
1393                                          filter_config_work);
1394         int err;
1395
1396         if (unlikely(!IS_STARTED(ar)))
1397                 return ;
1398
1399         mutex_lock(&ar->mutex);
1400         if (ar->filter_changed & AR9170_FILTER_CHANGED_PROMISC) {
1401                 err = ar9170_set_operating_mode(ar);
1402                 if (err)
1403                         goto unlock;
1404         }
1405
1406         if (ar->filter_changed & AR9170_FILTER_CHANGED_MULTICAST) {
1407                 err = ar9170_update_multicast(ar);
1408                 if (err)
1409                         goto unlock;
1410         }
1411
1412         if (ar->filter_changed & AR9170_FILTER_CHANGED_FRAMEFILTER)
1413                 err = ar9170_update_frame_filter(ar);
1414
1415 unlock:
1416         mutex_unlock(&ar->mutex);
1417 }
1418
1419 static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
1420                                        unsigned int changed_flags,
1421                                        unsigned int *new_flags,
1422                                        int mc_count, struct dev_mc_list *mclist)
1423 {
1424         struct ar9170 *ar = hw->priv;
1425
1426         /* mask supported flags */
1427         *new_flags &= FIF_ALLMULTI | FIF_CONTROL | FIF_BCN_PRBRESP_PROMISC |
1428                       FIF_PROMISC_IN_BSS | FIF_FCSFAIL | FIF_PLCPFAIL;
1429         ar->filter_state = *new_flags;
1430         /*
1431          * We can support more by setting the sniffer bit and
1432          * then checking the error flags, later.
1433          */
1434
1435         if (changed_flags & FIF_ALLMULTI) {
1436                 if (*new_flags & FIF_ALLMULTI) {
1437                         ar->want_mc_hash = ~0ULL;
1438                 } else {
1439                         u64 mchash;
1440                         int i;
1441
1442                         /* always get broadcast frames */
1443                         mchash = 1ULL << (0xff>>2);
1444
1445                         for (i = 0; i < mc_count; i++) {
1446                                 if (WARN_ON(!mclist))
1447                                         break;
1448                                 mchash |= 1ULL << (mclist->dmi_addr[5] >> 2);
1449                                 mclist = mclist->next;
1450                         }
1451                 ar->want_mc_hash = mchash;
1452                 }
1453                 ar->filter_changed |= AR9170_FILTER_CHANGED_MULTICAST;
1454         }
1455
1456         if (changed_flags & FIF_CONTROL) {
1457                 u32 filter = AR9170_MAC_REG_FTF_PSPOLL |
1458                              AR9170_MAC_REG_FTF_RTS |
1459                              AR9170_MAC_REG_FTF_CTS |
1460                              AR9170_MAC_REG_FTF_ACK |
1461                              AR9170_MAC_REG_FTF_CFE |
1462                              AR9170_MAC_REG_FTF_CFE_ACK;
1463
1464                 if (*new_flags & FIF_CONTROL)
1465                         ar->want_filter = ar->cur_filter | filter;
1466                 else
1467                         ar->want_filter = ar->cur_filter & ~filter;
1468
1469                 ar->filter_changed |= AR9170_FILTER_CHANGED_FRAMEFILTER;
1470         }
1471
1472         if (changed_flags & FIF_PROMISC_IN_BSS) {
1473                 ar->sniffer_enabled = ((*new_flags) & FIF_PROMISC_IN_BSS) != 0;
1474                 ar->filter_changed |= AR9170_FILTER_CHANGED_PROMISC;
1475         }
1476
1477         if (likely(IS_STARTED(ar)))
1478                 queue_work(ar->hw->workqueue, &ar->filter_config_work);
1479 }
1480
1481 static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
1482                                        struct ieee80211_vif *vif,
1483                                        struct ieee80211_bss_conf *bss_conf,
1484                                        u32 changed)
1485 {
1486         struct ar9170 *ar = hw->priv;
1487         int err = 0;
1488
1489         mutex_lock(&ar->mutex);
1490
1491         ar9170_regwrite_begin(ar);
1492
1493         if (changed & BSS_CHANGED_ASSOC) {
1494                 ar->state = bss_conf->assoc ? AR9170_ASSOCIATED : ar->state;
1495
1496 #ifndef CONFIG_AR9170_LEDS
1497                 /* enable assoc LED. */
1498                 err = ar9170_set_leds_state(ar, bss_conf->assoc ? 2 : 0);
1499 #endif /* CONFIG_AR9170_LEDS */
1500         }
1501
1502         if (changed & BSS_CHANGED_HT) {
1503                 /* TODO */
1504                 err = 0;
1505         }
1506
1507         if (changed & BSS_CHANGED_ERP_SLOT) {
1508                 u32 slottime = 20;
1509
1510                 if (bss_conf->use_short_slot)
1511                         slottime = 9;
1512
1513                 ar9170_regwrite(AR9170_MAC_REG_SLOT_TIME, slottime << 10);
1514         }
1515
1516         if (changed & BSS_CHANGED_BASIC_RATES) {
1517                 u32 cck, ofdm;
1518
1519                 if (hw->conf.channel->band == IEEE80211_BAND_5GHZ) {
1520                         ofdm = bss_conf->basic_rates;
1521                         cck = 0;
1522                 } else {
1523                         /* four cck rates */
1524                         cck = bss_conf->basic_rates & 0xf;
1525                         ofdm = bss_conf->basic_rates >> 4;
1526                 }
1527                 ar9170_regwrite(AR9170_MAC_REG_BASIC_RATE,
1528                                 ofdm << 8 | cck);
1529         }
1530
1531         ar9170_regwrite_finish();
1532         err = ar9170_regwrite_result();
1533         mutex_unlock(&ar->mutex);
1534 }
1535
1536 static u64 ar9170_op_get_tsf(struct ieee80211_hw *hw)
1537 {
1538         struct ar9170 *ar = hw->priv;
1539         int err;
1540         u32 tsf_low;
1541         u32 tsf_high;
1542         u64 tsf;
1543
1544         mutex_lock(&ar->mutex);
1545         err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_L, &tsf_low);
1546         if (!err)
1547                 err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_H, &tsf_high);
1548         mutex_unlock(&ar->mutex);
1549
1550         if (WARN_ON(err))
1551                 return 0;
1552
1553         tsf = tsf_high;
1554         tsf = (tsf << 32) | tsf_low;
1555         return tsf;
1556 }
1557
1558 static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
1559                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
1560                           struct ieee80211_key_conf *key)
1561 {
1562         struct ar9170 *ar = hw->priv;
1563         int err = 0, i;
1564         u8 ktype;
1565
1566         if ((!ar->vif) || (ar->disable_offload))
1567                 return -EOPNOTSUPP;
1568
1569         switch (key->alg) {
1570         case ALG_WEP:
1571                 if (key->keylen == LEN_WEP40)
1572                         ktype = AR9170_ENC_ALG_WEP64;
1573                 else
1574                         ktype = AR9170_ENC_ALG_WEP128;
1575                 break;
1576         case ALG_TKIP:
1577                 ktype = AR9170_ENC_ALG_TKIP;
1578                 break;
1579         case ALG_CCMP:
1580                 ktype = AR9170_ENC_ALG_AESCCMP;
1581                 break;
1582         default:
1583                 return -EOPNOTSUPP;
1584         }
1585
1586         mutex_lock(&ar->mutex);
1587         if (cmd == SET_KEY) {
1588                 if (unlikely(!IS_STARTED(ar))) {
1589                         err = -EOPNOTSUPP;
1590                         goto out;
1591                 }
1592
1593                 /* group keys need all-zeroes address */
1594                 if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1595                         sta = NULL;
1596
1597                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
1598                         for (i = 0; i < 64; i++)
1599                                 if (!(ar->usedkeys & BIT(i)))
1600                                         break;
1601                         if (i == 64) {
1602                                 ar->rx_software_decryption = true;
1603                                 ar9170_set_operating_mode(ar);
1604                                 err = -ENOSPC;
1605                                 goto out;
1606                         }
1607                 } else {
1608                         i = 64 + key->keyidx;
1609                 }
1610
1611                 key->hw_key_idx = i;
1612
1613                 err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL, ktype, 0,
1614                                         key->key, min_t(u8, 16, key->keylen));
1615                 if (err)
1616                         goto out;
1617
1618                 if (key->alg == ALG_TKIP) {
1619                         err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL,
1620                                                 ktype, 1, key->key + 16, 16);
1621                         if (err)
1622                                 goto out;
1623
1624                         /*
1625                          * hardware is not capable generating the MMIC
1626                          * for fragmented frames!
1627                          */
1628                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
1629                 }
1630
1631                 if (i < 64)
1632                         ar->usedkeys |= BIT(i);
1633
1634                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
1635         } else {
1636                 if (unlikely(!IS_STARTED(ar))) {
1637                         /* The device is gone... together with the key ;-) */
1638                         err = 0;
1639                         goto out;
1640                 }
1641
1642                 err = ar9170_disable_key(ar, key->hw_key_idx);
1643                 if (err)
1644                         goto out;
1645
1646                 if (key->hw_key_idx < 64) {
1647                         ar->usedkeys &= ~BIT(key->hw_key_idx);
1648                 } else {
1649                         err = ar9170_upload_key(ar, key->hw_key_idx, NULL,
1650                                                 AR9170_ENC_ALG_NONE, 0,
1651                                                 NULL, 0);
1652                         if (err)
1653                                 goto out;
1654
1655                         if (key->alg == ALG_TKIP) {
1656                                 err = ar9170_upload_key(ar, key->hw_key_idx,
1657                                                         NULL,
1658                                                         AR9170_ENC_ALG_NONE, 1,
1659                                                         NULL, 0);
1660                                 if (err)
1661                                         goto out;
1662                         }
1663
1664                 }
1665         }
1666
1667         ar9170_regwrite_begin(ar);
1668         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_L, ar->usedkeys);
1669         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_H, ar->usedkeys >> 32);
1670         ar9170_regwrite_finish();
1671         err = ar9170_regwrite_result();
1672
1673 out:
1674         mutex_unlock(&ar->mutex);
1675
1676         return err;
1677 }
1678
1679 static void ar9170_sta_notify(struct ieee80211_hw *hw,
1680                               struct ieee80211_vif *vif,
1681                               enum sta_notify_cmd cmd,
1682                               struct ieee80211_sta *sta)
1683 {
1684         struct ar9170 *ar = hw->priv;
1685         struct ar9170_sta_info *info = (void *) sta->drv_priv;
1686         struct sk_buff *skb;
1687         unsigned int i;
1688
1689         switch (cmd) {
1690         case STA_NOTIFY_ADD:
1691                 for (i = 0; i < ar->hw->queues; i++)
1692                         skb_queue_head_init(&info->tx_status[i]);
1693                 break;
1694
1695         case STA_NOTIFY_REMOVE:
1696
1697                 /*
1698                  * transfer all outstanding frames that need a tx_status
1699                  * reports to the global tx_status queue
1700                  */
1701
1702                 for (i = 0; i < ar->hw->queues; i++) {
1703                         while ((skb = skb_dequeue(&info->tx_status[i]))) {
1704 #ifdef AR9170_QUEUE_DEBUG
1705                                 printk(KERN_DEBUG "%s: queueing frame in "
1706                                           "global tx_status queue =>\n",
1707                                        wiphy_name(ar->hw->wiphy));
1708
1709                                 ar9170_print_txheader(ar, skb);
1710 #endif /* AR9170_QUEUE_DEBUG */
1711                                 skb_queue_tail(&ar->global_tx_status, skb);
1712                         }
1713                 }
1714                 queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
1715                                    msecs_to_jiffies(100));
1716                 break;
1717
1718         default:
1719                 break;
1720         }
1721 }
1722
1723 static int ar9170_get_stats(struct ieee80211_hw *hw,
1724                             struct ieee80211_low_level_stats *stats)
1725 {
1726         struct ar9170 *ar = hw->priv;
1727         u32 val;
1728         int err;
1729
1730         mutex_lock(&ar->mutex);
1731         err = ar9170_read_reg(ar, AR9170_MAC_REG_TX_RETRY, &val);
1732         ar->stats.dot11ACKFailureCount += val;
1733
1734         memcpy(stats, &ar->stats, sizeof(*stats));
1735         mutex_unlock(&ar->mutex);
1736
1737         return 0;
1738 }
1739
1740 static int ar9170_get_tx_stats(struct ieee80211_hw *hw,
1741                                struct ieee80211_tx_queue_stats *tx_stats)
1742 {
1743         struct ar9170 *ar = hw->priv;
1744
1745         spin_lock_bh(&ar->tx_stats_lock);
1746         memcpy(tx_stats, ar->tx_stats, sizeof(tx_stats[0]) * hw->queues);
1747         spin_unlock_bh(&ar->tx_stats_lock);
1748
1749         return 0;
1750 }
1751
1752 static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
1753                           const struct ieee80211_tx_queue_params *param)
1754 {
1755         struct ar9170 *ar = hw->priv;
1756         int ret;
1757
1758         mutex_lock(&ar->mutex);
1759         if ((param) && !(queue > ar->hw->queues)) {
1760                 memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
1761                        param, sizeof(*param));
1762
1763                 ret = ar9170_set_qos(ar);
1764         } else
1765                 ret = -EINVAL;
1766
1767         mutex_unlock(&ar->mutex);
1768         return ret;
1769 }
1770
1771 static int ar9170_ampdu_action(struct ieee80211_hw *hw,
1772                                enum ieee80211_ampdu_mlme_action action,
1773                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
1774 {
1775         switch (action) {
1776         case IEEE80211_AMPDU_RX_START:
1777         case IEEE80211_AMPDU_RX_STOP:
1778                 /*
1779                  * Something goes wrong -- RX locks up
1780                  * after a while of receiving aggregated
1781                  * frames -- not enabling for now.
1782                  */
1783                 return -EOPNOTSUPP;
1784         default:
1785                 return -EOPNOTSUPP;
1786         }
1787 }
1788
1789 static const struct ieee80211_ops ar9170_ops = {
1790         .start                  = ar9170_op_start,
1791         .stop                   = ar9170_op_stop,
1792         .tx                     = ar9170_op_tx,
1793         .add_interface          = ar9170_op_add_interface,
1794         .remove_interface       = ar9170_op_remove_interface,
1795         .config                 = ar9170_op_config,
1796         .config_interface       = ar9170_op_config_interface,
1797         .configure_filter       = ar9170_op_configure_filter,
1798         .conf_tx                = ar9170_conf_tx,
1799         .bss_info_changed       = ar9170_op_bss_info_changed,
1800         .get_tsf                = ar9170_op_get_tsf,
1801         .set_key                = ar9170_set_key,
1802         .sta_notify             = ar9170_sta_notify,
1803         .get_stats              = ar9170_get_stats,
1804         .get_tx_stats           = ar9170_get_tx_stats,
1805         .ampdu_action           = ar9170_ampdu_action,
1806 };
1807
1808 void *ar9170_alloc(size_t priv_size)
1809 {
1810         struct ieee80211_hw *hw;
1811         struct ar9170 *ar;
1812         struct sk_buff *skb;
1813         int i;
1814
1815         /*
1816          * this buffer is used for rx stream reconstruction.
1817          * Under heavy load this device (or the transport layer?)
1818          * tends to split the streams into seperate rx descriptors.
1819          */
1820
1821         skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL);
1822         if (!skb)
1823                 goto err_nomem;
1824
1825         hw = ieee80211_alloc_hw(priv_size, &ar9170_ops);
1826         if (!hw)
1827                 goto err_nomem;
1828
1829         ar = hw->priv;
1830         ar->hw = hw;
1831         ar->rx_failover = skb;
1832
1833         mutex_init(&ar->mutex);
1834         spin_lock_init(&ar->cmdlock);
1835         spin_lock_init(&ar->tx_stats_lock);
1836         skb_queue_head_init(&ar->global_tx_status);
1837         skb_queue_head_init(&ar->global_tx_status_waste);
1838         ar9170_rx_reset_rx_mpdu(ar);
1839         INIT_WORK(&ar->filter_config_work, ar9170_set_filters);
1840         INIT_WORK(&ar->beacon_work, ar9170_new_beacon);
1841         INIT_DELAYED_WORK(&ar->tx_status_janitor, ar9170_tx_status_janitor);
1842
1843         /* all hw supports 2.4 GHz, so set channel to 1 by default */
1844         ar->channel = &ar9170_2ghz_chantable[0];
1845
1846         /* first part of wiphy init */
1847         ar->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
1848                                          BIT(NL80211_IFTYPE_WDS) |
1849                                          BIT(NL80211_IFTYPE_ADHOC);
1850         ar->hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
1851                          IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
1852                          IEEE80211_HW_SIGNAL_DBM |
1853                          IEEE80211_HW_NOISE_DBM;
1854
1855         ar->hw->queues = __AR9170_NUM_TXQ;
1856         ar->hw->extra_tx_headroom = 8;
1857         ar->hw->sta_data_size = sizeof(struct ar9170_sta_info);
1858
1859         ar->hw->max_rates = 1;
1860         ar->hw->max_rate_tries = 3;
1861
1862         for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
1863                 ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
1864
1865         return ar;
1866
1867 err_nomem:
1868         kfree_skb(skb);
1869         return ERR_PTR(-ENOMEM);
1870 }
1871
1872 static int ar9170_read_eeprom(struct ar9170 *ar)
1873 {
1874 #define RW      8       /* number of words to read at once */
1875 #define RB      (sizeof(u32) * RW)
1876         DECLARE_MAC_BUF(mbuf);
1877         u8 *eeprom = (void *)&ar->eeprom;
1878         u8 *addr = ar->eeprom.mac_address;
1879         __le32 offsets[RW];
1880         int i, j, err, bands = 0;
1881
1882         BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
1883
1884         BUILD_BUG_ON(RB > AR9170_MAX_CMD_LEN - 4);
1885 #ifndef __CHECKER__
1886         /* don't want to handle trailing remains */
1887         BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
1888 #endif
1889
1890         for (i = 0; i < sizeof(ar->eeprom)/RB; i++) {
1891                 for (j = 0; j < RW; j++)
1892                         offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
1893                                                  RB * i + 4 * j);
1894
1895                 err = ar->exec_cmd(ar, AR9170_CMD_RREG,
1896                                    RB, (u8 *) &offsets,
1897                                    RB, eeprom + RB * i);
1898                 if (err)
1899                         return err;
1900         }
1901
1902 #undef RW
1903 #undef RB
1904
1905         if (ar->eeprom.length == cpu_to_le16(0xFFFF))
1906                 return -ENODATA;
1907
1908         if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
1909                 ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar9170_band_2GHz;
1910                 bands++;
1911         }
1912         if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
1913                 ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &ar9170_band_5GHz;
1914                 bands++;
1915         }
1916         /*
1917          * I measured this, a bandswitch takes roughly
1918          * 135 ms and a frequency switch about 80.
1919          *
1920          * FIXME: measure these values again once EEPROM settings
1921          *        are used, that will influence them!
1922          */
1923         if (bands == 2)
1924                 ar->hw->channel_change_time = 135 * 1000;
1925         else
1926                 ar->hw->channel_change_time = 80 * 1000;
1927
1928         ar->regulatory.current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
1929         ar->regulatory.current_rd_ext = le16_to_cpu(ar->eeprom.reg_domain[1]);
1930
1931         /* second part of wiphy init */
1932         SET_IEEE80211_PERM_ADDR(ar->hw, addr);
1933
1934         return bands ? 0 : -EINVAL;
1935 }
1936
1937 static int ar9170_reg_notifier(struct wiphy *wiphy,
1938                         struct regulatory_request *request)
1939 {
1940         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
1941         struct ar9170 *ar = hw->priv;
1942
1943         return ath_reg_notifier_apply(wiphy, request, &ar->regulatory);
1944 }
1945
1946 int ar9170_register(struct ar9170 *ar, struct device *pdev)
1947 {
1948         int err;
1949
1950         /* try to read EEPROM, init MAC addr */
1951         err = ar9170_read_eeprom(ar);
1952         if (err)
1953                 goto err_out;
1954
1955         err = ath_regd_init(&ar->regulatory, ar->hw->wiphy,
1956                             ar9170_reg_notifier);
1957         if (err)
1958                 goto err_out;
1959
1960         err = ieee80211_register_hw(ar->hw);
1961         if (err)
1962                 goto err_out;
1963
1964         if (!ath_is_world_regd(&ar->regulatory))
1965                 regulatory_hint(ar->hw->wiphy, ar->regulatory.alpha2);
1966
1967         err = ar9170_init_leds(ar);
1968         if (err)
1969                 goto err_unreg;
1970
1971 #ifdef CONFIG_AR9170_LEDS
1972         err = ar9170_register_leds(ar);
1973         if (err)
1974                 goto err_unreg;
1975 #endif /* CONFIG_AR9170_LEDS */
1976
1977         dev_info(pdev, "Atheros AR9170 is registered as '%s'\n",
1978                  wiphy_name(ar->hw->wiphy));
1979
1980         return err;
1981
1982 err_unreg:
1983         ieee80211_unregister_hw(ar->hw);
1984
1985 err_out:
1986         return err;
1987 }
1988
1989 void ar9170_unregister(struct ar9170 *ar)
1990 {
1991 #ifdef CONFIG_AR9170_LEDS
1992         ar9170_unregister_leds(ar);
1993 #endif /* CONFIG_AR9170_LEDS */
1994
1995         kfree_skb(ar->rx_failover);
1996         ieee80211_unregister_hw(ar->hw);
1997         mutex_destroy(&ar->mutex);
1998 }