drivers/net/wireless/ath/ar9170/main.c

   1 /*
   2  * Atheros AR9170 driver
   3  *
   4  * mac80211 interaction code
   5  *
   6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright 2009, Christian Lamparter <chunkeey@web.de>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; see the file COPYING.  If not, see
  21  * http://www.gnu.org/licenses/.
  22  *
  23  * This file incorporates work covered by the following copyright and
  24  * permission notice:
  25  *    Copyright (c) 2007-2008 Atheros Communications, Inc.
  26  *
  27  *    Permission to use, copy, modify, and/or distribute this software for any
  28  *    purpose with or without fee is hereby granted, provided that the above
  29  *    copyright notice and this permission notice appear in all copies.
  30  *
  31  *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  32  *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  33  *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  34  *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  35  *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  36  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  37  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  38  */
  39
  40 #include <linux/init.h>
  41 #include <linux/slab.h>
  42 #include <linux/module.h>
  43 #include <linux/etherdevice.h>
  44 #include <net/mac80211.h>
  45 #include "ar9170.h"
  46 #include "hw.h"
  47 #include "cmd.h"
  48
  49 static int modparam_nohwcrypt;
  50 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
  51 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  52
  53 #define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
  54         .bitrate        = (_bitrate),                   \
  55         .flags          = (_flags),                     \
  56         .hw_value       = (_hw_rate) | (_txpidx) << 4,  \
  57 }
  58
  59 static struct ieee80211_rate __ar9170_ratetable[] = {
  60         RATE(10, 0, 0, 0),
  61         RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
  62         RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
  63         RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
  64         RATE(60, 0xb, 0, 0),
  65         RATE(90, 0xf, 0, 0),
  66         RATE(120, 0xa, 0, 0),
  67         RATE(180, 0xe, 0, 0),
  68         RATE(240, 0x9, 0, 0),
  69         RATE(360, 0xd, 1, 0),
  70         RATE(480, 0x8, 2, 0),
  71         RATE(540, 0xc, 3, 0),
  72 };
  73 #undef RATE
  74
  75 #define ar9170_g_ratetable      (__ar9170_ratetable + 0)
  76 #define ar9170_g_ratetable_size 12
  77 #define ar9170_a_ratetable      (__ar9170_ratetable + 4)
  78 #define ar9170_a_ratetable_size 8
  79
  80 /*
  81  * NB: The hw_value is used as an index into the ar9170_phy_freq_params
  82  *     array in phy.c so that we don't have to do frequency lookups!
  83  */
  84 #define CHAN(_freq, _idx) {             \
  85         .center_freq    = (_freq),      \
  86         .hw_value       = (_idx),       \
  87         .max_power      = 18, /* XXX */ \
  88 }
  89
  90 static struct ieee80211_channel ar9170_2ghz_chantable[] = {
  91         CHAN(2412,  0),
  92         CHAN(2417,  1),
  93         CHAN(2422,  2),
  94         CHAN(2427,  3),
  95         CHAN(2432,  4),
  96         CHAN(2437,  5),
  97         CHAN(2442,  6),
  98         CHAN(2447,  7),
  99         CHAN(2452,  8),
 100         CHAN(2457,  9),
 101         CHAN(2462, 10),
 102         CHAN(2467, 11),
 103         CHAN(2472, 12),
 104         CHAN(2484, 13),
 105 };
 106
 107 static struct ieee80211_channel ar9170_5ghz_chantable[] = {
 108         CHAN(4920, 14),
 109         CHAN(4940, 15),
 110         CHAN(4960, 16),
 111         CHAN(4980, 17),
 112         CHAN(5040, 18),
 113         CHAN(5060, 19),
 114         CHAN(5080, 20),
 115         CHAN(5180, 21),
 116         CHAN(5200, 22),
 117         CHAN(5220, 23),
 118         CHAN(5240, 24),
 119         CHAN(5260, 25),
 120         CHAN(5280, 26),
 121         CHAN(5300, 27),
 122         CHAN(5320, 28),
 123         CHAN(5500, 29),
 124         CHAN(5520, 30),
 125         CHAN(5540, 31),
 126         CHAN(5560, 32),
 127         CHAN(5580, 33),
 128         CHAN(5600, 34),
 129         CHAN(5620, 35),
 130         CHAN(5640, 36),
 131         CHAN(5660, 37),
 132         CHAN(5680, 38),
 133         CHAN(5700, 39),
 134         CHAN(5745, 40),
 135         CHAN(5765, 41),
 136         CHAN(5785, 42),
 137         CHAN(5805, 43),
 138         CHAN(5825, 44),
 139         CHAN(5170, 45),
 140         CHAN(5190, 46),
 141         CHAN(5210, 47),
 142         CHAN(5230, 48),
 143 };
 144 #undef CHAN
 145
 146 #define AR9170_HT_CAP                                                   \
 147 {                                                                       \
 148         .ht_supported   = true,                                         \
 149         .cap            = IEEE80211_HT_CAP_MAX_AMSDU |                  \
 150                           IEEE80211_HT_CAP_SUP_WIDTH_20_40 |            \
 151                           IEEE80211_HT_CAP_SGI_40 |                     \
 152                           IEEE80211_HT_CAP_GRN_FLD |                    \
 153                           IEEE80211_HT_CAP_DSSSCCK40 |                  \
 154                           IEEE80211_HT_CAP_SM_PS,                       \
 155         .ampdu_factor   = 3,                                            \
 156         .ampdu_density  = 6,                                            \
 157         .mcs            = {                                             \
 158                 .rx_mask = { 0xff, 0xff, 0, 0, 0x1, 0, 0, 0, 0, 0, },   \
 159                 .rx_highest = cpu_to_le16(300),                         \
 160                 .tx_params = IEEE80211_HT_MCS_TX_DEFINED,               \
 161         },                                                              \
 162 }
 163
 164 static struct ieee80211_supported_band ar9170_band_2GHz = {
 165         .channels       = ar9170_2ghz_chantable,
 166         .n_channels     = ARRAY_SIZE(ar9170_2ghz_chantable),
 167         .bitrates       = ar9170_g_ratetable,
 168         .n_bitrates     = ar9170_g_ratetable_size,
 169         .ht_cap         = AR9170_HT_CAP,
 170 };
 171
 172 static struct ieee80211_supported_band ar9170_band_5GHz = {
 173         .channels       = ar9170_5ghz_chantable,
 174         .n_channels     = ARRAY_SIZE(ar9170_5ghz_chantable),
 175         .bitrates       = ar9170_a_ratetable,
 176         .n_bitrates     = ar9170_a_ratetable_size,
 177         .ht_cap         = AR9170_HT_CAP,
 178 };
 179
 180 static void ar9170_tx(struct ar9170 *ar);
 181
 182 static inline u16 ar9170_get_seq_h(struct ieee80211_hdr *hdr)
 183 {
 184         return le16_to_cpu(hdr->seq_ctrl) >> 4;
 185 }
 186
 187 static inline u16 ar9170_get_seq(struct sk_buff *skb)
 188 {
 189         struct ar9170_tx_control *txc = (void *) skb->data;
 190         return ar9170_get_seq_h((void *) txc->frame_data);
 191 }
 192
 193 #ifdef AR9170_QUEUE_DEBUG
 194 static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
 195 {
 196         struct ar9170_tx_control *txc = (void *) skb->data;
 197         struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
 198         struct ar9170_tx_info *arinfo = (void *) txinfo->rate_driver_data;
 199         struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 200
 201         printk(KERN_DEBUG "%s: => FRAME [skb:%p, q:%d, DA:[%pM] s:%d "
 202                           "mac_ctrl:%04x, phy_ctrl:%08x, timeout:[%d ms]]\n",
 203                wiphy_name(ar->hw->wiphy), skb, skb_get_queue_mapping(skb),
 204                ieee80211_get_DA(hdr), ar9170_get_seq_h(hdr),
 205                le16_to_cpu(txc->mac_control), le32_to_cpu(txc->phy_control),
 206                jiffies_to_msecs(arinfo->timeout - jiffies));
 207 }
 208
 209 static void __ar9170_dump_txqueue(struct ar9170 *ar,
 210                                 struct sk_buff_head *queue)
 211 {
 212         struct sk_buff *skb;
 213         int i = 0;
 214
 215         printk(KERN_DEBUG "---[ cut here ]---\n");
 216         printk(KERN_DEBUG "%s: %d entries in queue.\n",
 217                wiphy_name(ar->hw->wiphy), skb_queue_len(queue));
 218
 219         skb_queue_walk(queue, skb) {
 220                 printk(KERN_DEBUG "index:%d =>\n", i++);
 221                 ar9170_print_txheader(ar, skb);
 222         }
 223         if (i != skb_queue_len(queue))
 224                 printk(KERN_DEBUG "WARNING: queue frame counter "
 225                        "mismatch %d != %d\n", skb_queue_len(queue), i);
 226         printk(KERN_DEBUG "---[ end ]---\n");
 227 }
 228 #endif /* AR9170_QUEUE_DEBUG */
 229
 230 #ifdef AR9170_QUEUE_DEBUG
 231 static void ar9170_dump_txqueue(struct ar9170 *ar,
 232                                 struct sk_buff_head *queue)
 233 {
 234         unsigned long flags;
 235
 236         spin_lock_irqsave(&queue->lock, flags);
 237         __ar9170_dump_txqueue(ar, queue);
 238         spin_unlock_irqrestore(&queue->lock, flags);
 239 }
 240 #endif /* AR9170_QUEUE_DEBUG */
 241
 242 #ifdef AR9170_QUEUE_STOP_DEBUG
 243 static void __ar9170_dump_txstats(struct ar9170 *ar)
 244 {
 245         int i;
 246
 247         printk(KERN_DEBUG "%s: QoS queue stats\n",
 248                wiphy_name(ar->hw->wiphy));
 249
 250         for (i = 0; i < __AR9170_NUM_TXQ; i++)
 251                 printk(KERN_DEBUG "%s: queue:%d limit:%d len:%d waitack:%d "
 252                        " stopped:%d\n", wiphy_name(ar->hw->wiphy), i,
 253                        ar->tx_stats[i].limit, ar->tx_stats[i].len,
 254                        skb_queue_len(&ar->tx_status[i]),
 255                        ieee80211_queue_stopped(ar->hw, i));
 256 }
 257 #endif /* AR9170_QUEUE_STOP_DEBUG */
 258
 259 /* caller must guarantee exclusive access for _bin_ queue. */
 260 static void ar9170_recycle_expired(struct ar9170 *ar,
 261                                    struct sk_buff_head *queue,
 262                                    struct sk_buff_head *bin)
 263 {
 264         struct sk_buff *skb, *old = NULL;
 265         unsigned long flags;
 266
 267         spin_lock_irqsave(&queue->lock, flags);
 268         while ((skb = skb_peek(queue))) {
 269                 struct ieee80211_tx_info *txinfo;
 270                 struct ar9170_tx_info *arinfo;
 271
 272                 txinfo = IEEE80211_SKB_CB(skb);
 273                 arinfo = (void *) txinfo->rate_driver_data;
 274
 275                 if (time_is_before_jiffies(arinfo->timeout)) {
 276 #ifdef AR9170_QUEUE_DEBUG
 277                         printk(KERN_DEBUG "%s: [%ld > %ld] frame expired => "
 278                                "recycle\n", wiphy_name(ar->hw->wiphy),
 279                                jiffies, arinfo->timeout);
 280                         ar9170_print_txheader(ar, skb);
 281 #endif /* AR9170_QUEUE_DEBUG */
 282                         __skb_unlink(skb, queue);
 283                         __skb_queue_tail(bin, skb);
 284                 } else {
 285                         break;
 286                 }
 287
 288                 if (unlikely(old == skb)) {
 289                         /* bail out - queue is shot. */
 290
 291                         WARN_ON(1);
 292                         break;
 293                 }
 294                 old = skb;
 295         }
 296         spin_unlock_irqrestore(&queue->lock, flags);
 297 }
 298
 299 static void ar9170_tx_status(struct ar9170 *ar, struct sk_buff *skb,
 300                                     u16 tx_status)
 301 {
 302         struct ieee80211_tx_info *txinfo;
 303         unsigned int retries = 0;
 304
 305         txinfo = IEEE80211_SKB_CB(skb);
 306         ieee80211_tx_info_clear_status(txinfo);
 307
 308         switch (tx_status) {
 309         case AR9170_TX_STATUS_RETRY:
 310                 retries = 2;
 311         case AR9170_TX_STATUS_COMPLETE:
 312                 txinfo->flags |= IEEE80211_TX_STAT_ACK;
 313                 break;
 314
 315         case AR9170_TX_STATUS_FAILED:
 316                 retries = ar->hw->conf.long_frame_max_tx_count;
 317                 break;
 318
 319         default:
 320                 printk(KERN_ERR "%s: invalid tx_status response (%x).\n",
 321                        wiphy_name(ar->hw->wiphy), tx_status);
 322                 break;
 323         }
 324
 325         txinfo->status.rates[0].count = retries + 1;
 326         skb_pull(skb, sizeof(struct ar9170_tx_control));
 327         ieee80211_tx_status_irqsafe(ar->hw, skb);
 328 }
 329
 330 void ar9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb)
 331 {
 332         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 333         struct ar9170_tx_info *arinfo = (void *) info->rate_driver_data;
 334         unsigned int queue = skb_get_queue_mapping(skb);
 335         unsigned long flags;
 336
 337         spin_lock_irqsave(&ar->tx_stats_lock, flags);
 338         ar->tx_stats[queue].len--;
 339
 340         if (ar->tx_stats[queue].len < AR9170_NUM_TX_LIMIT_SOFT) {
 341 #ifdef AR9170_QUEUE_STOP_DEBUG
 342                 printk(KERN_DEBUG "%s: wake queue %d\n",
 343                        wiphy_name(ar->hw->wiphy), queue);
 344                 __ar9170_dump_txstats(ar);
 345 #endif /* AR9170_QUEUE_STOP_DEBUG */
 346                 ieee80211_wake_queue(ar->hw, queue);
 347         }
 348         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 349
 350         if (info->flags & IEEE80211_TX_CTL_NO_ACK) {
 351                 ar9170_tx_status(ar, skb, AR9170_TX_STATUS_FAILED);
 352         } else {
 353                 arinfo->timeout = jiffies +
 354                           msecs_to_jiffies(AR9170_TX_TIMEOUT);
 355
 356                 skb_queue_tail(&ar->tx_status[queue], skb);
 357         }
 358
 359         if (!ar->tx_stats[queue].len &&
 360             !skb_queue_empty(&ar->tx_pending[queue])) {
 361                 ar9170_tx(ar);
 362         }
 363 }
 364
 365 static struct sk_buff *ar9170_get_queued_skb(struct ar9170 *ar,
 366                                              const u8 *mac,
 367                                              struct sk_buff_head *queue,
 368                                              const u32 rate)
 369 {
 370         unsigned long flags;
 371         struct sk_buff *skb;
 372
 373         /*
 374          * Unfortunately, the firmware does not tell to which (queued) frame
 375          * this transmission status report belongs to.
 376          *
 377          * So we have to make risky guesses - with the scarce information
 378          * the firmware provided (-> destination MAC, and phy_control) -
 379          * and hope that we picked the right one...
 380          */
 381
 382         spin_lock_irqsave(&queue->lock, flags);
 383         skb_queue_walk(queue, skb) {
 384                 struct ar9170_tx_control *txc = (void *) skb->data;
 385                 struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 386                 u32 r;
 387
 388                 if (mac && compare_ether_addr(ieee80211_get_DA(hdr), mac)) {
 389 #ifdef AR9170_QUEUE_DEBUG
 390                         printk(KERN_DEBUG "%s: skip frame => DA %pM != %pM\n",
 391                                wiphy_name(ar->hw->wiphy), mac,
 392                                ieee80211_get_DA(hdr));
 393                         ar9170_print_txheader(ar, skb);
 394 #endif /* AR9170_QUEUE_DEBUG */
 395                         continue;
 396                 }
 397
 398                 r = (le32_to_cpu(txc->phy_control) & AR9170_TX_PHY_MCS_MASK) >>
 399                     AR9170_TX_PHY_MCS_SHIFT;
 400
 401                 if ((rate != AR9170_TX_INVALID_RATE) && (r != rate)) {
 402 #ifdef AR9170_QUEUE_DEBUG
 403                         printk(KERN_DEBUG "%s: skip frame => rate %d != %d\n",
 404                                wiphy_name(ar->hw->wiphy), rate, r);
 405                         ar9170_print_txheader(ar, skb);
 406 #endif /* AR9170_QUEUE_DEBUG */
 407                         continue;
 408                 }
 409
 410                 __skb_unlink(skb, queue);
 411                 spin_unlock_irqrestore(&queue->lock, flags);
 412                 return skb;
 413         }
 414
 415 #ifdef AR9170_QUEUE_DEBUG
 416         printk(KERN_ERR "%s: ESS:[%pM] does not have any "
 417                         "outstanding frames in queue.\n",
 418                         wiphy_name(ar->hw->wiphy), mac);
 419         __ar9170_dump_txqueue(ar, queue);
 420 #endif /* AR9170_QUEUE_DEBUG */
 421         spin_unlock_irqrestore(&queue->lock, flags);
 422
 423         return NULL;
 424 }
 425
 426 /*
 427  * This worker tries to keeps an maintain tx_status queues.
 428  * So we can guarantee that incoming tx_status reports are
 429  * actually for a pending frame.
 430  */
 431
 432 static void ar9170_tx_janitor(struct work_struct *work)
 433 {
 434         struct ar9170 *ar = container_of(work, struct ar9170,
 435                                          tx_janitor.work);
 436         struct sk_buff_head waste;
 437         unsigned int i;
 438         bool resched = false;
 439
 440         if (unlikely(!IS_STARTED(ar)))
 441                 return ;
 442
 443         skb_queue_head_init(&waste);
 444
 445         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
 446 #ifdef AR9170_QUEUE_DEBUG
 447                 printk(KERN_DEBUG "%s: garbage collector scans queue:%d\n",
 448                        wiphy_name(ar->hw->wiphy), i);
 449                 ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
 450                 ar9170_dump_txqueue(ar, &ar->tx_status[i]);
 451 #endif /* AR9170_QUEUE_DEBUG */
 452
 453                 ar9170_recycle_expired(ar, &ar->tx_status[i], &waste);
 454                 ar9170_recycle_expired(ar, &ar->tx_pending[i], &waste);
 455                 skb_queue_purge(&waste);
 456
 457                 if (!skb_queue_empty(&ar->tx_status[i]) ||
 458                     !skb_queue_empty(&ar->tx_pending[i]))
 459                         resched = true;
 460         }
 461
 462         if (!resched)
 463                 return;
 464
 465         ieee80211_queue_delayed_work(ar->hw,
 466                                      &ar->tx_janitor,
 467                                      msecs_to_jiffies(AR9170_JANITOR_DELAY));
 468 }
 469
 470 void ar9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len)
 471 {
 472         struct ar9170_cmd_response *cmd = (void *) buf;
 473
 474         if ((cmd->type & 0xc0) != 0xc0) {
 475                 ar->callback_cmd(ar, len, buf);
 476                 return;
 477         }
 478
 479         /* hardware event handlers */
 480         switch (cmd->type) {
 481         case 0xc1: {
 482                 /*
 483                  * TX status notification:
 484                  * bytes: 0c c1 XX YY M1 M2 M3 M4 M5 M6 R4 R3 R2 R1 S2 S1
 485                  *
 486                  * XX always 81
 487                  * YY always 00
 488                  * M1-M6 is the MAC address
 489                  * R1-R4 is the transmit rate
 490                  * S1-S2 is the transmit status
 491                  */
 492
 493                 struct sk_buff *skb;
 494                 u32 phy = le32_to_cpu(cmd->tx_status.rate);
 495                 u32 q = (phy & AR9170_TX_PHY_QOS_MASK) >>
 496                         AR9170_TX_PHY_QOS_SHIFT;
 497 #ifdef AR9170_QUEUE_DEBUG
 498                 printk(KERN_DEBUG "%s: recv tx_status for %pM, p:%08x, q:%d\n",
 499                        wiphy_name(ar->hw->wiphy), cmd->tx_status.dst, phy, q);
 500 #endif /* AR9170_QUEUE_DEBUG */
 501
 502                 skb = ar9170_get_queued_skb(ar, cmd->tx_status.dst,
 503                                             &ar->tx_status[q],
 504                                             AR9170_TX_INVALID_RATE);
 505                 if (unlikely(!skb))
 506                         return ;
 507
 508                 ar9170_tx_status(ar, skb, le16_to_cpu(cmd->tx_status.status));
 509                 break;
 510                 }
 511
 512         case 0xc0:
 513                 /*
 514                  * pre-TBTT event
 515                  */
 516                 if (ar->vif && ar->vif->type == NL80211_IFTYPE_AP)
 517                         ieee80211_queue_work(ar->hw, &ar->beacon_work);
 518                 break;
 519
 520         case 0xc2:
 521                 /*
 522                  * (IBSS) beacon send notification
 523                  * bytes: 04 c2 XX YY B4 B3 B2 B1
 524                  *
 525                  * XX always 80
 526                  * YY always 00
 527                  * B1-B4 "should" be the number of send out beacons.
 528                  */
 529                 break;
 530
 531         case 0xc3:
 532                 /* End of Atim Window */
 533                 break;
 534
 535         case 0xc4:
 536                 /* BlockACK bitmap */
 537                 break;
 538
 539         case 0xc5:
 540                 /* BlockACK events */
 541                 break;
 542
 543         case 0xc6:
 544                 /* Watchdog Interrupt */
 545                 break;
 546
 547         case 0xc9:
 548                 /* retransmission issue / SIFS/EIFS collision ?! */
 549                 break;
 550
 551         /* firmware debug */
 552         case 0xca:
 553                 printk(KERN_DEBUG "ar9170 FW: %.*s\n", len - 4,
 554                                 (char *)buf + 4);
 555                 break;
 556         case 0xcb:
 557                 len -= 4;
 558
 559                 switch (len) {
 560                 case 1:
 561                         printk(KERN_DEBUG "ar9170 FW: u8: %#.2x\n",
 562                                 *((char *)buf + 4));
 563                         break;
 564                 case 2:
 565                         printk(KERN_DEBUG "ar9170 FW: u8: %#.4x\n",
 566                                 le16_to_cpup((__le16 *)((char *)buf + 4)));
 567                         break;
 568                 case 4:
 569                         printk(KERN_DEBUG "ar9170 FW: u8: %#.8x\n",
 570                                 le32_to_cpup((__le32 *)((char *)buf + 4)));
 571                         break;
 572                 case 8:
 573                         printk(KERN_DEBUG "ar9170 FW: u8: %#.16lx\n",
 574                                 (unsigned long)le64_to_cpup(
 575                                                 (__le64 *)((char *)buf + 4)));
 576                         break;
 577                 }
 578                 break;
 579         case 0xcc:
 580                 print_hex_dump_bytes("ar9170 FW:", DUMP_PREFIX_NONE,
 581                                      (char *)buf + 4, len - 4);
 582                 break;
 583
 584         default:
 585                 printk(KERN_INFO "received unhandled event %x\n", cmd->type);
 586                 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
 587                 break;
 588         }
 589 }
 590
 591 static void ar9170_rx_reset_rx_mpdu(struct ar9170 *ar)
 592 {
 593         memset(&ar->rx_mpdu.plcp, 0, sizeof(struct ar9170_rx_head));
 594         ar->rx_mpdu.has_plcp = false;
 595 }
 596
 597 int ar9170_nag_limiter(struct ar9170 *ar)
 598 {
 599         bool print_message;
 600
 601         /*
 602          * we expect all sorts of errors in promiscuous mode.
 603          * don't bother with it, it's OK!
 604          */
 605         if (ar->sniffer_enabled)
 606                 return false;
 607
 608         /*
 609          * only go for frequent errors! The hardware tends to
 610          * do some stupid thing once in a while under load, in
 611          * noisy environments or just for fun!
 612          */
 613         if (time_before(jiffies, ar->bad_hw_nagger) && net_ratelimit())
 614                 print_message = true;
 615         else
 616                 print_message = false;
 617
 618         /* reset threshold for "once in a while" */
 619         ar->bad_hw_nagger = jiffies + HZ / 4;
 620         return print_message;
 621 }
 622
 623 static int ar9170_rx_mac_status(struct ar9170 *ar,
 624                                 struct ar9170_rx_head *head,
 625                                 struct ar9170_rx_macstatus *mac,
 626                                 struct ieee80211_rx_status *status)
 627 {
 628         u8 error, decrypt;
 629
 630         BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
 631         BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4);
 632
 633         error = mac->error;
 634         if (error & AR9170_RX_ERROR_MMIC) {
 635                 status->flag |= RX_FLAG_MMIC_ERROR;
 636                 error &= ~AR9170_RX_ERROR_MMIC;
 637         }
 638
 639         if (error & AR9170_RX_ERROR_PLCP) {
 640                 status->flag |= RX_FLAG_FAILED_PLCP_CRC;
 641                 error &= ~AR9170_RX_ERROR_PLCP;
 642
 643                 if (!(ar->filter_state & FIF_PLCPFAIL))
 644                         return -EINVAL;
 645         }
 646
 647         if (error & AR9170_RX_ERROR_FCS) {
 648                 status->flag |= RX_FLAG_FAILED_FCS_CRC;
 649                 error &= ~AR9170_RX_ERROR_FCS;
 650
 651                 if (!(ar->filter_state & FIF_FCSFAIL))
 652                         return -EINVAL;
 653         }
 654
 655         decrypt = ar9170_get_decrypt_type(mac);
 656         if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
 657             decrypt != AR9170_ENC_ALG_NONE)
 658                 status->flag |= RX_FLAG_DECRYPTED;
 659
 660         /* ignore wrong RA errors */
 661         error &= ~AR9170_RX_ERROR_WRONG_RA;
 662
 663         if (error & AR9170_RX_ERROR_DECRYPT) {
 664                 error &= ~AR9170_RX_ERROR_DECRYPT;
 665                 /*
 666                  * Rx decryption is done in place,
 667                  * the original data is lost anyway.
 668                  */
 669
 670                 return -EINVAL;
 671         }
 672
 673         /* drop any other error frames */
 674         if (unlikely(error)) {
 675                 /* TODO: update netdevice's RX dropped/errors statistics */
 676
 677                 if (ar9170_nag_limiter(ar))
 678                         printk(KERN_DEBUG "%s: received frame with "
 679                                "suspicious error code (%#x).\n",
 680                                wiphy_name(ar->hw->wiphy), error);
 681
 682                 return -EINVAL;
 683         }
 684
 685         status->band = ar->channel->band;
 686         status->freq = ar->channel->center_freq;
 687
 688         switch (mac->status & AR9170_RX_STATUS_MODULATION_MASK) {
 689         case AR9170_RX_STATUS_MODULATION_CCK:
 690                 if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
 691                         status->flag |= RX_FLAG_SHORTPRE;
 692                 switch (head->plcp[0]) {
 693                 case 0x0a:
 694                         status->rate_idx = 0;
 695                         break;
 696                 case 0x14:
 697                         status->rate_idx = 1;
 698                         break;
 699                 case 0x37:
 700                         status->rate_idx = 2;
 701                         break;
 702                 case 0x6e:
 703                         status->rate_idx = 3;
 704                         break;
 705                 default:
 706                         if (ar9170_nag_limiter(ar))
 707                                 printk(KERN_ERR "%s: invalid plcp cck rate "
 708                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 709                                        head->plcp[0]);
 710                         return -EINVAL;
 711                 }
 712                 break;
 713
 714         case AR9170_RX_STATUS_MODULATION_DUPOFDM:
 715         case AR9170_RX_STATUS_MODULATION_OFDM:
 716                 switch (head->plcp[0] & 0xf) {
 717                 case 0xb:
 718                         status->rate_idx = 0;
 719                         break;
 720                 case 0xf:
 721                         status->rate_idx = 1;
 722                         break;
 723                 case 0xa:
 724                         status->rate_idx = 2;
 725                         break;
 726                 case 0xe:
 727                         status->rate_idx = 3;
 728                         break;
 729                 case 0x9:
 730                         status->rate_idx = 4;
 731                         break;
 732                 case 0xd:
 733                         status->rate_idx = 5;
 734                         break;
 735                 case 0x8:
 736                         status->rate_idx = 6;
 737                         break;
 738                 case 0xc:
 739                         status->rate_idx = 7;
 740                         break;
 741                 default:
 742                         if (ar9170_nag_limiter(ar))
 743                                 printk(KERN_ERR "%s: invalid plcp ofdm rate "
 744                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 745                                        head->plcp[0]);
 746                         return -EINVAL;
 747                 }
 748                 if (status->band == IEEE80211_BAND_2GHZ)
 749                         status->rate_idx += 4;
 750                 break;
 751
 752         case AR9170_RX_STATUS_MODULATION_HT:
 753                 if (head->plcp[3] & 0x80)
 754                         status->flag |= RX_FLAG_40MHZ;
 755                 if (head->plcp[6] & 0x80)
 756                         status->flag |= RX_FLAG_SHORT_GI;
 757
 758                 status->rate_idx = clamp(0, 75, head->plcp[6] & 0x7f);
 759                 status->flag |= RX_FLAG_HT;
 760                 break;
 761
 762         default:
 763                 if (ar9170_nag_limiter(ar))
 764                         printk(KERN_ERR "%s: invalid modulation\n",
 765                                wiphy_name(ar->hw->wiphy));
 766                 return -EINVAL;
 767         }
 768
 769         return 0;
 770 }
 771
 772 static void ar9170_rx_phy_status(struct ar9170 *ar,
 773                                  struct ar9170_rx_phystatus *phy,
 774                                  struct ieee80211_rx_status *status)
 775 {
 776         int i;
 777
 778         BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20);
 779
 780         for (i = 0; i < 3; i++)
 781                 if (phy->rssi[i] != 0x80)
 782                         status->antenna |= BIT(i);
 783
 784         /* post-process RSSI */
 785         for (i = 0; i < 7; i++)
 786                 if (phy->rssi[i] & 0x80)
 787                         phy->rssi[i] = ((phy->rssi[i] & 0x7f) + 1) & 0x7f;
 788
 789         /* TODO: we could do something with phy_errors */
 790         status->signal = ar->noise[0] + phy->rssi_combined;
 791 }
 792
 793 static struct sk_buff *ar9170_rx_copy_data(u8 *buf, int len)
 794 {
 795         struct sk_buff *skb;
 796         int reserved = 0;
 797         struct ieee80211_hdr *hdr = (void *) buf;
 798
 799         if (ieee80211_is_data_qos(hdr->frame_control)) {
 800                 u8 *qc = ieee80211_get_qos_ctl(hdr);
 801                 reserved += NET_IP_ALIGN;
 802
 803                 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
 804                         reserved += NET_IP_ALIGN;
 805         }
 806
 807         if (ieee80211_has_a4(hdr->frame_control))
 808                 reserved += NET_IP_ALIGN;
 809
 810         reserved = 32 + (reserved & NET_IP_ALIGN);
 811
 812         skb = dev_alloc_skb(len + reserved);
 813         if (likely(skb)) {
 814                 skb_reserve(skb, reserved);
 815                 memcpy(skb_put(skb, len), buf, len);
 816         }
 817
 818         return skb;
 819 }
 820
 821 /*
 822  * If the frame alignment is right (or the kernel has
 823  * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
 824  * is only a single MPDU in the USB frame, then we could
 825  * submit to mac80211 the SKB directly. However, since
 826  * there may be multiple packets in one SKB in stream
 827  * mode, and we need to observe the proper ordering,
 828  * this is non-trivial.
 829  */
 830
 831 static void ar9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
 832 {
 833         struct ar9170_rx_head *head;
 834         struct ar9170_rx_macstatus *mac;
 835         struct ar9170_rx_phystatus *phy = NULL;
 836         struct ieee80211_rx_status status;
 837         struct sk_buff *skb;
 838         int mpdu_len;
 839
 840         if (unlikely(!IS_STARTED(ar) || len < (sizeof(*mac))))
 841                 return ;
 842
 843         /* Received MPDU */
 844         mpdu_len = len - sizeof(*mac);
 845
 846         mac = (void *)(buf + mpdu_len);
 847         if (unlikely(mac->error & AR9170_RX_ERROR_FATAL)) {
 848                 /* this frame is too damaged and can't be used - drop it */
 849
 850                 return ;
 851         }
 852
 853         switch (mac->status & AR9170_RX_STATUS_MPDU_MASK) {
 854         case AR9170_RX_STATUS_MPDU_FIRST:
 855                 /* first mpdu packet has the plcp header */
 856                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) {
 857                         head = (void *) buf;
 858                         memcpy(&ar->rx_mpdu.plcp, (void *) buf,
 859                                sizeof(struct ar9170_rx_head));
 860
 861                         mpdu_len -= sizeof(struct ar9170_rx_head);
 862                         buf += sizeof(struct ar9170_rx_head);
 863                         ar->rx_mpdu.has_plcp = true;
 864                 } else {
 865                         if (ar9170_nag_limiter(ar))
 866                                 printk(KERN_ERR "%s: plcp info is clipped.\n",
 867                                        wiphy_name(ar->hw->wiphy));
 868                         return ;
 869                 }
 870                 break;
 871
 872         case AR9170_RX_STATUS_MPDU_LAST:
 873                 /* last mpdu has a extra tail with phy status information */
 874
 875                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) {
 876                         mpdu_len -= sizeof(struct ar9170_rx_phystatus);
 877                         phy = (void *)(buf + mpdu_len);
 878                 } else {
 879                         if (ar9170_nag_limiter(ar))
 880                                 printk(KERN_ERR "%s: frame tail is clipped.\n",
 881                                        wiphy_name(ar->hw->wiphy));
 882                         return ;
 883                 }
 884
 885         case AR9170_RX_STATUS_MPDU_MIDDLE:
 886                 /* middle mpdus are just data */
 887                 if (unlikely(!ar->rx_mpdu.has_plcp)) {
 888                         if (!ar9170_nag_limiter(ar))
 889                                 return ;
 890
 891                         printk(KERN_ERR "%s: rx stream did not start "
 892                                         "with a first_mpdu frame tag.\n",
 893                                wiphy_name(ar->hw->wiphy));
 894
 895                         return ;
 896                 }
 897
 898                 head = &ar->rx_mpdu.plcp;
 899                 break;
 900
 901         case AR9170_RX_STATUS_MPDU_SINGLE:
 902                 /* single mpdu - has plcp (head) and phy status (tail) */
 903                 head = (void *) buf;
 904
 905                 mpdu_len -= sizeof(struct ar9170_rx_head);
 906                 mpdu_len -= sizeof(struct ar9170_rx_phystatus);
 907
 908                 buf += sizeof(struct ar9170_rx_head);
 909                 phy = (void *)(buf + mpdu_len);
 910                 break;
 911
 912         default:
 913                 BUG_ON(1);
 914                 break;
 915         }
 916
 917         if (unlikely(mpdu_len < FCS_LEN))
 918                 return ;
 919
 920         memset(&status, 0, sizeof(status));
 921         if (unlikely(ar9170_rx_mac_status(ar, head, mac, &status)))
 922                 return ;
 923
 924         if (phy)
 925                 ar9170_rx_phy_status(ar, phy, &status);
 926
 927         skb = ar9170_rx_copy_data(buf, mpdu_len);
 928         if (likely(skb)) {
 929                 memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
 930                 ieee80211_rx_irqsafe(ar->hw, skb);
 931         }
 932 }
 933
 934 void ar9170_rx(struct ar9170 *ar, struct sk_buff *skb)
 935 {
 936         unsigned int i, tlen, resplen, wlen = 0, clen = 0;
 937         u8 *tbuf, *respbuf;
 938
 939         tbuf = skb->data;
 940         tlen = skb->len;
 941
 942         while (tlen >= 4) {
 943                 clen = tbuf[1] << 8 | tbuf[0];
 944                 wlen = ALIGN(clen, 4);
 945
 946                 /* check if this is stream has a valid tag.*/
 947                 if (tbuf[2] != 0 || tbuf[3] != 0x4e) {
 948                         /*
 949                          * TODO: handle the highly unlikely event that the
 950                          * corrupted stream has the TAG at the right position.
 951                          */
 952
 953                         /* check if the frame can be repaired. */
 954                         if (!ar->rx_failover_missing) {
 955                                 /* this is no "short read". */
 956                                 if (ar9170_nag_limiter(ar)) {
 957                                         printk(KERN_ERR "%s: missing tag!\n",
 958                                                wiphy_name(ar->hw->wiphy));
 959                                         goto err_telluser;
 960                                 } else
 961                                         goto err_silent;
 962                         }
 963
 964                         if (ar->rx_failover_missing > tlen) {
 965                                 if (ar9170_nag_limiter(ar)) {
 966                                         printk(KERN_ERR "%s: possible multi "
 967                                                "stream corruption!\n",
 968                                                wiphy_name(ar->hw->wiphy));
 969                                         goto err_telluser;
 970                                 } else
 971                                         goto err_silent;
 972                         }
 973
 974                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
 975                         ar->rx_failover_missing -= tlen;
 976
 977                         if (ar->rx_failover_missing <= 0) {
 978                                 /*
 979                                  * nested ar9170_rx call!
 980                                  * termination is guranteed, even when the
 981                                  * combined frame also have a element with
 982                                  * a bad tag.
 983                                  */
 984
 985                                 ar->rx_failover_missing = 0;
 986                                 ar9170_rx(ar, ar->rx_failover);
 987
 988                                 skb_reset_tail_pointer(ar->rx_failover);
 989                                 skb_trim(ar->rx_failover, 0);
 990                         }
 991
 992                         return ;
 993                 }
 994
 995                 /* check if stream is clipped */
 996                 if (wlen > tlen - 4) {
 997                         if (ar->rx_failover_missing) {
 998                                 /* TODO: handle double stream corruption. */
 999                                 if (ar9170_nag_limiter(ar)) {
1000                                         printk(KERN_ERR "%s: double rx stream "
1001                                                "corruption!\n",
1002                                                 wiphy_name(ar->hw->wiphy));
1003                                         goto err_telluser;
1004                                 } else
1005                                         goto err_silent;
1006                         }
1007
1008                         /*
1009                          * save incomplete data set.
1010                          * the firmware will resend the missing bits when
1011                          * the rx - descriptor comes round again.
1012                          */
1013
1014                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
1015                         ar->rx_failover_missing = clen - tlen;
1016                         return ;
1017                 }
1018                 resplen = clen;
1019                 respbuf = tbuf + 4;
1020                 tbuf += wlen + 4;
1021                 tlen -= wlen + 4;
1022
1023                 i = 0;
1024
1025                 /* weird thing, but this is the same in the original driver */
1026                 while (resplen > 2 && i < 12 &&
1027                        respbuf[0] == 0xff && respbuf[1] == 0xff) {
1028                         i += 2;
1029                         resplen -= 2;
1030                         respbuf += 2;
1031                 }
1032
1033                 if (resplen < 4)
1034                         continue;
1035
1036                 /* found the 6 * 0xffff marker? */
1037                 if (i == 12)
1038                         ar9170_handle_command_response(ar, respbuf, resplen);
1039                 else
1040                         ar9170_handle_mpdu(ar, respbuf, clen);
1041         }
1042
1043         if (tlen) {
1044                 if (net_ratelimit())
1045                         printk(KERN_ERR "%s: %d bytes of unprocessed "
1046                                         "data left in rx stream!\n",
1047                                wiphy_name(ar->hw->wiphy), tlen);
1048
1049                 goto err_telluser;
1050         }
1051
1052         return ;
1053
1054 err_telluser:
1055         printk(KERN_ERR "%s: damaged RX stream data [want:%d, "
1056                         "data:%d, rx:%d, pending:%d ]\n",
1057                wiphy_name(ar->hw->wiphy), clen, wlen, tlen,
1058                ar->rx_failover_missing);
1059
1060         if (ar->rx_failover_missing)
1061                 print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET,
1062                                      ar->rx_failover->data,
1063                                      ar->rx_failover->len);
1064
1065         print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET,
1066                              skb->data, skb->len);
1067
1068         printk(KERN_ERR "%s: please check your hardware and cables, if "
1069                         "you see this message frequently.\n",
1070                wiphy_name(ar->hw->wiphy));
1071
1072 err_silent:
1073         if (ar->rx_failover_missing) {
1074                 skb_reset_tail_pointer(ar->rx_failover);
1075                 skb_trim(ar->rx_failover, 0);
1076                 ar->rx_failover_missing = 0;
1077         }
1078 }
1079
1080 #define AR9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)            \
1081 do {                                                                    \
1082         queue.aifs = ai_fs;                                             \
1083         queue.cw_min = cwmin;                                           \
1084         queue.cw_max = cwmax;                                           \
1085         queue.txop = _txop;                                             \
1086 } while (0)
1087
1088 static int ar9170_op_start(struct ieee80211_hw *hw)
1089 {
1090         struct ar9170 *ar = hw->priv;
1091         int err, i;
1092
1093         mutex_lock(&ar->mutex);
1094
1095         /* reinitialize queues statistics */
1096         memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
1097         for (i = 0; i < __AR9170_NUM_TXQ; i++)
1098                 ar->tx_stats[i].limit = AR9170_TXQ_DEPTH;
1099
1100         /* reset QoS defaults */
1101         AR9170_FILL_QUEUE(ar->edcf[0], 3, 15, 1023,  0); /* BEST EFFORT*/
1102         AR9170_FILL_QUEUE(ar->edcf[1], 7, 15, 1023,  0); /* BACKGROUND */
1103         AR9170_FILL_QUEUE(ar->edcf[2], 2, 7,    15, 94); /* VIDEO */
1104         AR9170_FILL_QUEUE(ar->edcf[3], 2, 3,     7, 47); /* VOICE */
1105         AR9170_FILL_QUEUE(ar->edcf[4], 2, 3,     7,  0); /* SPECIAL */
1106
1107         /* set sane AMPDU defaults */
1108         ar->global_ampdu_density = 6;
1109         ar->global_ampdu_factor = 3;
1110
1111         ar->bad_hw_nagger = jiffies;
1112
1113         err = ar->open(ar);
1114         if (err)
1115                 goto out;
1116
1117         err = ar9170_init_mac(ar);
1118         if (err)
1119                 goto out;
1120
1121         err = ar9170_set_qos(ar);
1122         if (err)
1123                 goto out;
1124
1125         err = ar9170_init_phy(ar, IEEE80211_BAND_2GHZ);
1126         if (err)
1127                 goto out;
1128
1129         err = ar9170_init_rf(ar);
1130         if (err)
1131                 goto out;
1132
1133         /* start DMA */
1134         err = ar9170_write_reg(ar, 0x1c3d30, 0x100);
1135         if (err)
1136                 goto out;
1137
1138         ar->state = AR9170_STARTED;
1139
1140 out:
1141         mutex_unlock(&ar->mutex);
1142         return err;
1143 }
1144
1145 static void ar9170_op_stop(struct ieee80211_hw *hw)
1146 {
1147         struct ar9170 *ar = hw->priv;
1148         unsigned int i;
1149
1150         if (IS_STARTED(ar))
1151                 ar->state = AR9170_IDLE;
1152
1153         cancel_delayed_work_sync(&ar->tx_janitor);
1154 #ifdef CONFIG_AR9170_LEDS
1155         cancel_delayed_work_sync(&ar->led_work);
1156 #endif
1157         cancel_work_sync(&ar->beacon_work);
1158
1159         mutex_lock(&ar->mutex);
1160
1161         if (IS_ACCEPTING_CMD(ar)) {
1162                 ar9170_set_leds_state(ar, 0);
1163
1164                 /* stop DMA */
1165                 ar9170_write_reg(ar, 0x1c3d30, 0);
1166                 ar->stop(ar);
1167         }
1168
1169         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
1170                 skb_queue_purge(&ar->tx_pending[i]);
1171                 skb_queue_purge(&ar->tx_status[i]);
1172         }
1173
1174         mutex_unlock(&ar->mutex);
1175 }
1176
1177 static int ar9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
1178 {
1179         struct ieee80211_hdr *hdr;
1180         struct ar9170_tx_control *txc;
1181         struct ieee80211_tx_info *info;
1182         struct ieee80211_tx_rate *txrate;
1183         struct ar9170_tx_info *arinfo;
1184         unsigned int queue = skb_get_queue_mapping(skb);
1185         u16 keytype = 0;
1186         u16 len, icv = 0;
1187
1188         BUILD_BUG_ON(sizeof(*arinfo) > sizeof(info->rate_driver_data));
1189
1190         hdr = (void *)skb->data;
1191         info = IEEE80211_SKB_CB(skb);
1192         len = skb->len;
1193
1194         txc = (void *)skb_push(skb, sizeof(*txc));
1195
1196         if (info->control.hw_key) {
1197                 icv = info->control.hw_key->icv_len;
1198
1199                 switch (info->control.hw_key->alg) {
1200                 case ALG_WEP:
1201                         keytype = AR9170_TX_MAC_ENCR_RC4;
1202                         break;
1203                 case ALG_TKIP:
1204                         keytype = AR9170_TX_MAC_ENCR_RC4;
1205                         break;
1206                 case ALG_CCMP:
1207                         keytype = AR9170_TX_MAC_ENCR_AES;
1208                         break;
1209                 default:
1210                         WARN_ON(1);
1211                         goto err_out;
1212                 }
1213         }
1214
1215         /* Length */
1216         txc->length = cpu_to_le16(len + icv + 4);
1217
1218         txc->mac_control = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
1219                                        AR9170_TX_MAC_BACKOFF);
1220         txc->mac_control |= cpu_to_le16(ar9170_qos_hwmap[queue] <<
1221                                         AR9170_TX_MAC_QOS_SHIFT);
1222         txc->mac_control |= cpu_to_le16(keytype);
1223         txc->phy_control = cpu_to_le32(0);
1224
1225         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1226                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_NO_ACK);
1227
1228         txrate = &info->control.rates[0];
1229         if (txrate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1230                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
1231         else if (txrate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1232                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
1233
1234         arinfo = (void *)info->rate_driver_data;
1235         arinfo->timeout = jiffies + msecs_to_jiffies(AR9170_QUEUE_TIMEOUT);
1236
1237         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
1238              (is_valid_ether_addr(ieee80211_get_DA(hdr)))) {
1239                 /*
1240                  * WARNING:
1241                  * Putting the QoS queue bits into an unexplored territory is
1242                  * certainly not elegant.
1243                  *
1244                  * In my defense: This idea provides a reasonable way to
1245                  * smuggle valuable information to the tx_status callback.
1246                  * Also, the idea behind this bit-abuse came straight from
1247                  * the original driver code.
1248                  */
1249
1250                 txc->phy_control |=
1251                         cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
1252
1253                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
1254         }
1255
1256         return 0;
1257
1258 err_out:
1259         skb_pull(skb, sizeof(*txc));
1260         return -EINVAL;
1261 }
1262
1263 static void ar9170_tx_prepare_phy(struct ar9170 *ar, struct sk_buff *skb)
1264 {
1265         struct ar9170_tx_control *txc;
1266         struct ieee80211_tx_info *info;
1267         struct ieee80211_rate *rate = NULL;
1268         struct ieee80211_tx_rate *txrate;
1269         u32 power, chains;
1270
1271         txc = (void *) skb->data;
1272         info = IEEE80211_SKB_CB(skb);
1273         txrate = &info->control.rates[0];
1274
1275         if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1276                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_GREENFIELD);
1277
1278         if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1279                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_PREAMBLE);
1280
1281         if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1282                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ);
1283         /* this works because 40 MHz is 2 and dup is 3 */
1284         if (txrate->flags & IEEE80211_TX_RC_DUP_DATA)
1285                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ_DUP);
1286
1287         if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
1288                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_GI);
1289
1290         if (txrate->flags & IEEE80211_TX_RC_MCS) {
1291                 u32 r = txrate->idx;
1292                 u8 *txpower;
1293
1294                 /* heavy clip control */
1295                 txc->phy_control |= cpu_to_le32((r & 0x7) << 7);
1296
1297                 r <<= AR9170_TX_PHY_MCS_SHIFT;
1298                 BUG_ON(r & ~AR9170_TX_PHY_MCS_MASK);
1299
1300                 txc->phy_control |= cpu_to_le32(r & AR9170_TX_PHY_MCS_MASK);
1301                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_MOD_HT);
1302
1303                 if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
1304                         if (info->band == IEEE80211_BAND_5GHZ)
1305                                 txpower = ar->power_5G_ht40;
1306                         else
1307                                 txpower = ar->power_2G_ht40;
1308                 } else {
1309                         if (info->band == IEEE80211_BAND_5GHZ)
1310                                 txpower = ar->power_5G_ht20;
1311                         else
1312                                 txpower = ar->power_2G_ht20;
1313                 }
1314
1315                 power = txpower[(txrate->idx) & 7];
1316         } else {
1317                 u8 *txpower;
1318                 u32 mod;
1319                 u32 phyrate;
1320                 u8 idx = txrate->idx;
1321
1322                 if (info->band != IEEE80211_BAND_2GHZ) {
1323                         idx += 4;
1324                         txpower = ar->power_5G_leg;
1325                         mod = AR9170_TX_PHY_MOD_OFDM;
1326                 } else {
1327                         if (idx < 4) {
1328                                 txpower = ar->power_2G_cck;
1329                                 mod = AR9170_TX_PHY_MOD_CCK;
1330                         } else {
1331                                 mod = AR9170_TX_PHY_MOD_OFDM;
1332                                 txpower = ar->power_2G_ofdm;
1333                         }
1334                 }
1335
1336                 rate = &__ar9170_ratetable[idx];
1337
1338                 phyrate = rate->hw_value & 0xF;
1339                 power = txpower[(rate->hw_value & 0x30) >> 4];
1340                 phyrate <<= AR9170_TX_PHY_MCS_SHIFT;
1341
1342                 txc->phy_control |= cpu_to_le32(mod);
1343                 txc->phy_control |= cpu_to_le32(phyrate);
1344         }
1345
1346         power <<= AR9170_TX_PHY_TX_PWR_SHIFT;
1347         power &= AR9170_TX_PHY_TX_PWR_MASK;
1348         txc->phy_control |= cpu_to_le32(power);
1349
1350         /* set TX chains */
1351         if (ar->eeprom.tx_mask == 1) {
1352                 chains = AR9170_TX_PHY_TXCHAIN_1;
1353         } else {
1354                 chains = AR9170_TX_PHY_TXCHAIN_2;
1355
1356                 /* >= 36M legacy OFDM - use only one chain */
1357                 if (rate && rate->bitrate >= 360)
1358                         chains = AR9170_TX_PHY_TXCHAIN_1;
1359         }
1360         txc->phy_control |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_SHIFT);
1361 }
1362
1363 static void ar9170_tx(struct ar9170 *ar)
1364 {
1365         struct sk_buff *skb;
1366         unsigned long flags;
1367         struct ieee80211_tx_info *info;
1368         struct ar9170_tx_info *arinfo;
1369         unsigned int i, frames, frames_failed, remaining_space;
1370         int err;
1371         bool schedule_garbagecollector = false;
1372
1373         BUILD_BUG_ON(sizeof(*arinfo) > sizeof(info->rate_driver_data));
1374
1375         if (unlikely(!IS_STARTED(ar)))
1376                 return ;
1377
1378         remaining_space = AR9170_TX_MAX_PENDING;
1379
1380         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
1381                 spin_lock_irqsave(&ar->tx_stats_lock, flags);
1382                 frames = min(ar->tx_stats[i].limit - ar->tx_stats[i].len,
1383                              skb_queue_len(&ar->tx_pending[i]));
1384
1385                 if (remaining_space < frames) {
1386 #ifdef AR9170_QUEUE_DEBUG
1387                         printk(KERN_DEBUG "%s: tx quota reached queue:%d, "
1388                                "remaining slots:%d, needed:%d\n",
1389                                wiphy_name(ar->hw->wiphy), i, remaining_space,
1390                                frames);
1391 #endif /* AR9170_QUEUE_DEBUG */
1392                         frames = remaining_space;
1393                 }
1394
1395                 ar->tx_stats[i].len += frames;
1396                 ar->tx_stats[i].count += frames;
1397                 if (ar->tx_stats[i].len >= ar->tx_stats[i].limit) {
1398 #ifdef AR9170_QUEUE_DEBUG
1399                         printk(KERN_DEBUG "%s: queue %d full\n",
1400                                wiphy_name(ar->hw->wiphy), i);
1401
1402                         printk(KERN_DEBUG "%s: stuck frames: ===>\n",
1403                                wiphy_name(ar->hw->wiphy));
1404                         ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
1405                         ar9170_dump_txqueue(ar, &ar->tx_status[i]);
1406 #endif /* AR9170_QUEUE_DEBUG */
1407
1408 #ifdef AR9170_QUEUE_STOP_DEBUG
1409                         printk(KERN_DEBUG "%s: stop queue %d\n",
1410                                wiphy_name(ar->hw->wiphy), i);
1411                         __ar9170_dump_txstats(ar);
1412 #endif /* AR9170_QUEUE_STOP_DEBUG */
1413                         ieee80211_stop_queue(ar->hw, i);
1414                 }
1415
1416                 spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1417
1418                 if (!frames)
1419                         continue;
1420
1421                 frames_failed = 0;
1422                 while (frames) {
1423                         skb = skb_dequeue(&ar->tx_pending[i]);
1424                         if (unlikely(!skb)) {
1425                                 frames_failed += frames;
1426                                 frames = 0;
1427                                 break;
1428                         }
1429
1430                         info = IEEE80211_SKB_CB(skb);
1431                         arinfo = (void *) info->rate_driver_data;
1432
1433                         /* TODO: cancel stuck frames */
1434                         arinfo->timeout = jiffies +
1435                                           msecs_to_jiffies(AR9170_TX_TIMEOUT);
1436
1437 #ifdef AR9170_QUEUE_DEBUG
1438                         printk(KERN_DEBUG "%s: send frame q:%d =>\n",
1439                                wiphy_name(ar->hw->wiphy), i);
1440                         ar9170_print_txheader(ar, skb);
1441 #endif /* AR9170_QUEUE_DEBUG */
1442
1443                         err = ar->tx(ar, skb);
1444                         if (unlikely(err)) {
1445                                 frames_failed++;
1446                                 dev_kfree_skb_any(skb);
1447                         } else {
1448                                 remaining_space--;
1449                                 schedule_garbagecollector = true;
1450                         }
1451
1452                         frames--;
1453                 }
1454
1455 #ifdef AR9170_QUEUE_DEBUG
1456                 printk(KERN_DEBUG "%s: ar9170_tx report for queue %d\n",
1457                        wiphy_name(ar->hw->wiphy), i);
1458
1459                 printk(KERN_DEBUG "%s: unprocessed pending frames left:\n",
1460                        wiphy_name(ar->hw->wiphy));
1461                 ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
1462 #endif /* AR9170_QUEUE_DEBUG */
1463
1464                 if (unlikely(frames_failed)) {
1465 #ifdef AR9170_QUEUE_DEBUG
1466                         printk(KERN_DEBUG "%s: frames failed %d =>\n",
1467                                wiphy_name(ar->hw->wiphy), frames_failed);
1468 #endif /* AR9170_QUEUE_DEBUG */
1469
1470                         spin_lock_irqsave(&ar->tx_stats_lock, flags);
1471                         ar->tx_stats[i].len -= frames_failed;
1472                         ar->tx_stats[i].count -= frames_failed;
1473 #ifdef AR9170_QUEUE_STOP_DEBUG
1474                         printk(KERN_DEBUG "%s: wake queue %d\n",
1475                                wiphy_name(ar->hw->wiphy), i);
1476                         __ar9170_dump_txstats(ar);
1477 #endif /* AR9170_QUEUE_STOP_DEBUG */
1478                         ieee80211_wake_queue(ar->hw, i);
1479                         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1480                 }
1481         }
1482
1483         if (!schedule_garbagecollector)
1484                 return;
1485
1486         ieee80211_queue_delayed_work(ar->hw,
1487                                      &ar->tx_janitor,
1488                                      msecs_to_jiffies(AR9170_JANITOR_DELAY));
1489 }
1490
1491 int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
1492 {
1493         struct ar9170 *ar = hw->priv;
1494         struct ieee80211_tx_info *info;
1495         unsigned int queue;
1496
1497         if (unlikely(!IS_STARTED(ar)))
1498                 goto err_free;
1499
1500         if (unlikely(ar9170_tx_prepare(ar, skb)))
1501                 goto err_free;
1502
1503         queue = skb_get_queue_mapping(skb);
1504         info = IEEE80211_SKB_CB(skb);
1505         ar9170_tx_prepare_phy(ar, skb);
1506         skb_queue_tail(&ar->tx_pending[queue], skb);
1507
1508         ar9170_tx(ar);
1509         return NETDEV_TX_OK;
1510
1511 err_free:
1512         dev_kfree_skb_any(skb);
1513         return NETDEV_TX_OK;
1514 }
1515
1516 static int ar9170_op_add_interface(struct ieee80211_hw *hw,
1517                                    struct ieee80211_vif *vif)
1518 {
1519         struct ar9170 *ar = hw->priv;
1520         struct ath_common *common = &ar->common;
1521         int err = 0;
1522
1523         mutex_lock(&ar->mutex);
1524
1525         if (ar->vif) {
1526                 err = -EBUSY;
1527                 goto unlock;
1528         }
1529
1530         ar->vif = vif;
1531         memcpy(common->macaddr, vif->addr, ETH_ALEN);
1532
1533         if (modparam_nohwcrypt || (ar->vif->type != NL80211_IFTYPE_STATION)) {
1534                 ar->rx_software_decryption = true;
1535                 ar->disable_offload = true;
1536         }
1537
1538         ar->cur_filter = 0;
1539         err = ar9170_update_frame_filter(ar, AR9170_MAC_REG_FTF_DEFAULTS);
1540         if (err)
1541                 goto unlock;
1542
1543         err = ar9170_set_operating_mode(ar);
1544
1545 unlock:
1546         mutex_unlock(&ar->mutex);
1547         return err;
1548 }
1549
1550 static void ar9170_op_remove_interface(struct ieee80211_hw *hw,
1551                                        struct ieee80211_vif *vif)
1552 {
1553         struct ar9170 *ar = hw->priv;
1554
1555         mutex_lock(&ar->mutex);
1556         ar->vif = NULL;
1557         ar9170_update_frame_filter(ar, 0);
1558         ar9170_set_beacon_timers(ar);
1559         dev_kfree_skb(ar->beacon);
1560         ar->beacon = NULL;
1561         ar->sniffer_enabled = false;
1562         ar->rx_software_decryption = false;
1563         ar9170_set_operating_mode(ar);
1564         mutex_unlock(&ar->mutex);
1565 }
1566
1567 static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
1568 {
1569         struct ar9170 *ar = hw->priv;
1570         int err = 0;
1571
1572         mutex_lock(&ar->mutex);
1573
1574         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
1575                 /* TODO */
1576                 err = 0;
1577         }
1578
1579         if (changed & IEEE80211_CONF_CHANGE_PS) {
1580                 /* TODO */
1581                 err = 0;
1582         }
1583
1584         if (changed & IEEE80211_CONF_CHANGE_POWER) {
1585                 /* TODO */
1586                 err = 0;
1587         }
1588
1589         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
1590                 /*
1591                  * is it long_frame_max_tx_count or short_frame_max_tx_count?
1592                  */
1593
1594                 err = ar9170_set_hwretry_limit(ar,
1595                         ar->hw->conf.long_frame_max_tx_count);
1596                 if (err)
1597                         goto out;
1598         }
1599
1600         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
1601
1602                 /* adjust slot time for 5 GHz */
1603                 err = ar9170_set_slot_time(ar);
1604                 if (err)
1605                         goto out;
1606
1607                 err = ar9170_set_dyn_sifs_ack(ar);
1608                 if (err)
1609                         goto out;
1610
1611                 err = ar9170_set_channel(ar, hw->conf.channel,
1612                                 AR9170_RFI_NONE,
1613                                 nl80211_to_ar9170(hw->conf.channel_type));
1614                 if (err)
1615                         goto out;
1616         }
1617
1618 out:
1619         mutex_unlock(&ar->mutex);
1620         return err;
1621 }
1622
1623 static u64 ar9170_op_prepare_multicast(struct ieee80211_hw *hw,
1624                                        struct netdev_hw_addr_list *mc_list)
1625 {
1626         u64 mchash;
1627         struct netdev_hw_addr *ha;
1628
1629         /* always get broadcast frames */
1630         mchash = 1ULL << (0xff >> 2);
1631
1632         netdev_hw_addr_list_for_each(ha, mc_list)
1633                 mchash |= 1ULL << (ha->addr[5] >> 2);
1634
1635         return mchash;
1636 }
1637
1638 static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
1639                                        unsigned int changed_flags,
1640                                        unsigned int *new_flags,
1641                                        u64 multicast)
1642 {
1643         struct ar9170 *ar = hw->priv;
1644
1645         if (unlikely(!IS_ACCEPTING_CMD(ar)))
1646                 return ;
1647
1648         mutex_lock(&ar->mutex);
1649
1650         /* mask supported flags */
1651         *new_flags &= FIF_ALLMULTI | FIF_CONTROL | FIF_BCN_PRBRESP_PROMISC |
1652                       FIF_PROMISC_IN_BSS | FIF_FCSFAIL | FIF_PLCPFAIL;
1653         ar->filter_state = *new_flags;
1654         /*
1655          * We can support more by setting the sniffer bit and
1656          * then checking the error flags, later.
1657          */
1658
1659         if (changed_flags & FIF_ALLMULTI && *new_flags & FIF_ALLMULTI)
1660                 multicast = ~0ULL;
1661
1662         if (multicast != ar->cur_mc_hash)
1663                 ar9170_update_multicast(ar, multicast);
1664
1665         if (changed_flags & FIF_CONTROL) {
1666                 u32 filter = AR9170_MAC_REG_FTF_PSPOLL |
1667                              AR9170_MAC_REG_FTF_RTS |
1668                              AR9170_MAC_REG_FTF_CTS |
1669                              AR9170_MAC_REG_FTF_ACK |
1670                              AR9170_MAC_REG_FTF_CFE |
1671                              AR9170_MAC_REG_FTF_CFE_ACK;
1672
1673                 if (*new_flags & FIF_CONTROL)
1674                         filter |= ar->cur_filter;
1675                 else
1676                         filter &= (~ar->cur_filter);
1677
1678                 ar9170_update_frame_filter(ar, filter);
1679         }
1680
1681         if (changed_flags & FIF_PROMISC_IN_BSS) {
1682                 ar->sniffer_enabled = ((*new_flags) & FIF_PROMISC_IN_BSS) != 0;
1683                 ar9170_set_operating_mode(ar);
1684         }
1685
1686         mutex_unlock(&ar->mutex);
1687 }
1688
1689
1690 static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
1691                                        struct ieee80211_vif *vif,
1692                                        struct ieee80211_bss_conf *bss_conf,
1693                                        u32 changed)
1694 {
1695         struct ar9170 *ar = hw->priv;
1696         struct ath_common *common = &ar->common;
1697         int err = 0;
1698
1699         mutex_lock(&ar->mutex);
1700
1701         if (changed & BSS_CHANGED_BSSID) {
1702                 memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
1703                 err = ar9170_set_operating_mode(ar);
1704                 if (err)
1705                         goto out;
1706         }
1707
1708         if (changed & BSS_CHANGED_BEACON_ENABLED)
1709                 ar->enable_beacon = bss_conf->enable_beacon;
1710
1711         if (changed & BSS_CHANGED_BEACON) {
1712                 err = ar9170_update_beacon(ar);
1713                 if (err)
1714                         goto out;
1715         }
1716
1717         if (changed & (BSS_CHANGED_BEACON_ENABLED | BSS_CHANGED_BEACON |
1718                        BSS_CHANGED_BEACON_INT)) {
1719                 err = ar9170_set_beacon_timers(ar);
1720                 if (err)
1721                         goto out;
1722         }
1723
1724         if (changed & BSS_CHANGED_ASSOC) {
1725 #ifndef CONFIG_AR9170_LEDS
1726                 /* enable assoc LED. */
1727                 err = ar9170_set_leds_state(ar, bss_conf->assoc ? 2 : 0);
1728 #endif /* CONFIG_AR9170_LEDS */
1729         }
1730
1731         if (changed & BSS_CHANGED_HT) {
1732                 /* TODO */
1733                 err = 0;
1734         }
1735
1736         if (changed & BSS_CHANGED_ERP_SLOT) {
1737                 err = ar9170_set_slot_time(ar);
1738                 if (err)
1739                         goto out;
1740         }
1741
1742         if (changed & BSS_CHANGED_BASIC_RATES) {
1743                 err = ar9170_set_basic_rates(ar);
1744                 if (err)
1745                         goto out;
1746         }
1747
1748 out:
1749         mutex_unlock(&ar->mutex);
1750 }
1751
1752 static u64 ar9170_op_get_tsf(struct ieee80211_hw *hw)
1753 {
1754         struct ar9170 *ar = hw->priv;
1755         int err;
1756         u64 tsf;
1757 #define NR 3
1758         static const u32 addr[NR] = { AR9170_MAC_REG_TSF_H,
1759                                     AR9170_MAC_REG_TSF_L,
1760                                     AR9170_MAC_REG_TSF_H };
1761         u32 val[NR];
1762         int loops = 0;
1763
1764         mutex_lock(&ar->mutex);
1765
1766         while (loops++ < 10) {
1767                 err = ar9170_read_mreg(ar, NR, addr, val);
1768                 if (err || val[0] == val[2])
1769                         break;
1770         }
1771
1772         mutex_unlock(&ar->mutex);
1773
1774         if (WARN_ON(err))
1775                 return 0;
1776         tsf = val[0];
1777         tsf = (tsf << 32) | val[1];
1778         return tsf;
1779 #undef NR
1780 }
1781
1782 static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
1783                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
1784                           struct ieee80211_key_conf *key)
1785 {
1786         struct ar9170 *ar = hw->priv;
1787         int err = 0, i;
1788         u8 ktype;
1789
1790         if ((!ar->vif) || (ar->disable_offload))
1791                 return -EOPNOTSUPP;
1792
1793         switch (key->alg) {
1794         case ALG_WEP:
1795                 if (key->keylen == WLAN_KEY_LEN_WEP40)
1796                         ktype = AR9170_ENC_ALG_WEP64;
1797                 else
1798                         ktype = AR9170_ENC_ALG_WEP128;
1799                 break;
1800         case ALG_TKIP:
1801                 ktype = AR9170_ENC_ALG_TKIP;
1802                 break;
1803         case ALG_CCMP:
1804                 ktype = AR9170_ENC_ALG_AESCCMP;
1805                 break;
1806         default:
1807                 return -EOPNOTSUPP;
1808         }
1809
1810         mutex_lock(&ar->mutex);
1811         if (cmd == SET_KEY) {
1812                 if (unlikely(!IS_STARTED(ar))) {
1813                         err = -EOPNOTSUPP;
1814                         goto out;
1815                 }
1816
1817                 /* group keys need all-zeroes address */
1818                 if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1819                         sta = NULL;
1820
1821                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
1822                         for (i = 0; i < 64; i++)
1823                                 if (!(ar->usedkeys & BIT(i)))
1824                                         break;
1825                         if (i == 64) {
1826                                 ar->rx_software_decryption = true;
1827                                 ar9170_set_operating_mode(ar);
1828                                 err = -ENOSPC;
1829                                 goto out;
1830                         }
1831                 } else {
1832                         i = 64 + key->keyidx;
1833                 }
1834
1835                 key->hw_key_idx = i;
1836
1837                 err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL, ktype, 0,
1838                                         key->key, min_t(u8, 16, key->keylen));
1839                 if (err)
1840                         goto out;
1841
1842                 if (key->alg == ALG_TKIP) {
1843                         err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL,
1844                                                 ktype, 1, key->key + 16, 16);
1845                         if (err)
1846                                 goto out;
1847
1848                         /*
1849                          * hardware is not capable generating the MMIC
1850                          * for fragmented frames!
1851                          */
1852                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
1853                 }
1854
1855                 if (i < 64)
1856                         ar->usedkeys |= BIT(i);
1857
1858                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
1859         } else {
1860                 if (unlikely(!IS_STARTED(ar))) {
1861                         /* The device is gone... together with the key ;-) */
1862                         err = 0;
1863                         goto out;
1864                 }
1865
1866                 err = ar9170_disable_key(ar, key->hw_key_idx);
1867                 if (err)
1868                         goto out;
1869
1870                 if (key->hw_key_idx < 64) {
1871                         ar->usedkeys &= ~BIT(key->hw_key_idx);
1872                 } else {
1873                         err = ar9170_upload_key(ar, key->hw_key_idx, NULL,
1874                                                 AR9170_ENC_ALG_NONE, 0,
1875                                                 NULL, 0);
1876                         if (err)
1877                                 goto out;
1878
1879                         if (key->alg == ALG_TKIP) {
1880                                 err = ar9170_upload_key(ar, key->hw_key_idx,
1881                                                         NULL,
1882                                                         AR9170_ENC_ALG_NONE, 1,
1883                                                         NULL, 0);
1884                                 if (err)
1885                                         goto out;
1886                         }
1887
1888                 }
1889         }
1890
1891         ar9170_regwrite_begin(ar);
1892         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_L, ar->usedkeys);
1893         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_H, ar->usedkeys >> 32);
1894         ar9170_regwrite_finish();
1895         err = ar9170_regwrite_result();
1896
1897 out:
1898         mutex_unlock(&ar->mutex);
1899
1900         return err;
1901 }
1902
1903 static int ar9170_get_stats(struct ieee80211_hw *hw,
1904                             struct ieee80211_low_level_stats *stats)
1905 {
1906         struct ar9170 *ar = hw->priv;
1907         u32 val;
1908         int err;
1909
1910         mutex_lock(&ar->mutex);
1911         err = ar9170_read_reg(ar, AR9170_MAC_REG_TX_RETRY, &val);
1912         ar->stats.dot11ACKFailureCount += val;
1913
1914         memcpy(stats, &ar->stats, sizeof(*stats));
1915         mutex_unlock(&ar->mutex);
1916
1917         return 0;
1918 }
1919
1920 static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
1921                           const struct ieee80211_tx_queue_params *param)
1922 {
1923         struct ar9170 *ar = hw->priv;
1924         int ret;
1925
1926         mutex_lock(&ar->mutex);
1927         if (queue < __AR9170_NUM_TXQ) {
1928                 memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
1929                        param, sizeof(*param));
1930
1931                 ret = ar9170_set_qos(ar);
1932         } else {
1933                 ret = -EINVAL;
1934         }
1935
1936         mutex_unlock(&ar->mutex);
1937         return ret;
1938 }
1939
1940 static int ar9170_ampdu_action(struct ieee80211_hw *hw,
1941                                struct ieee80211_vif *vif,
1942                                enum ieee80211_ampdu_mlme_action action,
1943                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
1944 {
1945         switch (action) {
1946         case IEEE80211_AMPDU_RX_START:
1947         case IEEE80211_AMPDU_RX_STOP:
1948                 /* Handled by firmware */
1949                 break;
1950
1951         default:
1952                 return -EOPNOTSUPP;
1953         }
1954
1955         return 0;
1956 }
1957
1958 static const struct ieee80211_ops ar9170_ops = {
1959         .start                  = ar9170_op_start,
1960         .stop                   = ar9170_op_stop,
1961         .tx                     = ar9170_op_tx,
1962         .add_interface          = ar9170_op_add_interface,
1963         .remove_interface       = ar9170_op_remove_interface,
1964         .config                 = ar9170_op_config,
1965         .prepare_multicast      = ar9170_op_prepare_multicast,
1966         .configure_filter       = ar9170_op_configure_filter,
1967         .conf_tx                = ar9170_conf_tx,
1968         .bss_info_changed       = ar9170_op_bss_info_changed,
1969         .get_tsf                = ar9170_op_get_tsf,
1970         .set_key                = ar9170_set_key,
1971         .get_stats              = ar9170_get_stats,
1972         .ampdu_action           = ar9170_ampdu_action,
1973 };
1974
1975 void *ar9170_alloc(size_t priv_size)
1976 {
1977         struct ieee80211_hw *hw;
1978         struct ar9170 *ar;
1979         struct sk_buff *skb;
1980         int i;
1981
1982         /*
1983          * this buffer is used for rx stream reconstruction.
1984          * Under heavy load this device (or the transport layer?)
1985          * tends to split the streams into separate rx descriptors.
1986          */
1987
1988         skb = __dev_alloc_skb(AR9170_RX_STREAM_MAX_SIZE, GFP_KERNEL);
1989         if (!skb)
1990                 goto err_nomem;
1991
1992         hw = ieee80211_alloc_hw(priv_size, &ar9170_ops);
1993         if (!hw)
1994                 goto err_nomem;
1995
1996         ar = hw->priv;
1997         ar->hw = hw;
1998         ar->rx_failover = skb;
1999
2000         mutex_init(&ar->mutex);
2001         spin_lock_init(&ar->cmdlock);
2002         spin_lock_init(&ar->tx_stats_lock);
2003         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
2004                 skb_queue_head_init(&ar->tx_status[i]);
2005                 skb_queue_head_init(&ar->tx_pending[i]);
2006         }
2007         ar9170_rx_reset_rx_mpdu(ar);
2008         INIT_WORK(&ar->beacon_work, ar9170_new_beacon);
2009         INIT_DELAYED_WORK(&ar->tx_janitor, ar9170_tx_janitor);
2010
2011         /* all hw supports 2.4 GHz, so set channel to 1 by default */
2012         ar->channel = &ar9170_2ghz_chantable[0];
2013
2014         /* first part of wiphy init */
2015         ar->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
2016                                          BIT(NL80211_IFTYPE_WDS) |
2017                                          BIT(NL80211_IFTYPE_ADHOC);
2018         ar->hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
2019                          IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
2020                          IEEE80211_HW_SIGNAL_DBM;
2021
2022         ar->hw->queues = __AR9170_NUM_TXQ;
2023         ar->hw->extra_tx_headroom = 8;
2024
2025         ar->hw->max_rates = 1;
2026         ar->hw->max_rate_tries = 3;
2027
2028         for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
2029                 ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
2030
2031         return ar;
2032
2033 err_nomem:
2034         kfree_skb(skb);
2035         return ERR_PTR(-ENOMEM);
2036 }
2037
2038 static int ar9170_read_eeprom(struct ar9170 *ar)
2039 {
2040 #define RW      8       /* number of words to read at once */
2041 #define RB      (sizeof(u32) * RW)
2042         struct ath_regulatory *regulatory = &ar->common.regulatory;
2043         u8 *eeprom = (void *)&ar->eeprom;
2044         u8 *addr = ar->eeprom.mac_address;
2045         __le32 offsets[RW];
2046         unsigned int rx_streams, tx_streams, tx_params = 0;
2047         int i, j, err, bands = 0;
2048
2049         BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
2050
2051         BUILD_BUG_ON(RB > AR9170_MAX_CMD_LEN - 4);
2052 #ifndef __CHECKER__
2053         /* don't want to handle trailing remains */
2054         BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
2055 #endif
2056
2057         for (i = 0; i < sizeof(ar->eeprom)/RB; i++) {
2058                 for (j = 0; j < RW; j++)
2059                         offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
2060                                                  RB * i + 4 * j);
2061
2062                 err = ar->exec_cmd(ar, AR9170_CMD_RREG,
2063                                    RB, (u8 *) &offsets,
2064                                    RB, eeprom + RB * i);
2065                 if (err)
2066                         return err;
2067         }
2068
2069 #undef RW
2070 #undef RB
2071
2072         if (ar->eeprom.length == cpu_to_le16(0xFFFF))
2073                 return -ENODATA;
2074
2075         if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
2076                 ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar9170_band_2GHz;
2077                 bands++;
2078         }
2079         if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
2080                 ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &ar9170_band_5GHz;
2081                 bands++;
2082         }
2083
2084         rx_streams = hweight8(ar->eeprom.rx_mask);
2085         tx_streams = hweight8(ar->eeprom.tx_mask);
2086
2087         if (rx_streams != tx_streams)
2088                 tx_params = IEEE80211_HT_MCS_TX_RX_DIFF;
2089
2090         if (tx_streams >= 1 && tx_streams <= IEEE80211_HT_MCS_TX_MAX_STREAMS)
2091                 tx_params = (tx_streams - 1) <<
2092                             IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
2093
2094         ar9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params;
2095         ar9170_band_5GHz.ht_cap.mcs.tx_params |= tx_params;
2096
2097         /*
2098          * I measured this, a bandswitch takes roughly
2099          * 135 ms and a frequency switch about 80.
2100          *
2101          * FIXME: measure these values again once EEPROM settings
2102          *        are used, that will influence them!
2103          */
2104         if (bands == 2)
2105                 ar->hw->channel_change_time = 135 * 1000;
2106         else
2107                 ar->hw->channel_change_time = 80 * 1000;
2108
2109         regulatory->current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
2110         regulatory->current_rd_ext = le16_to_cpu(ar->eeprom.reg_domain[1]);
2111
2112         /* second part of wiphy init */
2113         SET_IEEE80211_PERM_ADDR(ar->hw, addr);
2114
2115         return bands ? 0 : -EINVAL;
2116 }
2117
2118 static int ar9170_reg_notifier(struct wiphy *wiphy,
2119                         struct regulatory_request *request)
2120 {
2121         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
2122         struct ar9170 *ar = hw->priv;
2123
2124         return ath_reg_notifier_apply(wiphy, request, &ar->common.regulatory);
2125 }
2126
2127 int ar9170_register(struct ar9170 *ar, struct device *pdev)
2128 {
2129         struct ath_regulatory *regulatory = &ar->common.regulatory;
2130         int err;
2131
2132         /* try to read EEPROM, init MAC addr */
2133         err = ar9170_read_eeprom(ar);
2134         if (err)
2135                 goto err_out;
2136
2137         err = ath_regd_init(regulatory, ar->hw->wiphy,
2138                             ar9170_reg_notifier);
2139         if (err)
2140                 goto err_out;
2141
2142         err = ieee80211_register_hw(ar->hw);
2143         if (err)
2144                 goto err_out;
2145
2146         if (!ath_is_world_regd(regulatory))
2147                 regulatory_hint(ar->hw->wiphy, regulatory->alpha2);
2148
2149         err = ar9170_init_leds(ar);
2150         if (err)
2151                 goto err_unreg;
2152
2153 #ifdef CONFIG_AR9170_LEDS
2154         err = ar9170_register_leds(ar);
2155         if (err)
2156                 goto err_unreg;
2157 #endif /* CONFIG_AR9170_LEDS */
2158
2159         dev_info(pdev, "Atheros AR9170 is registered as '%s'\n",
2160                  wiphy_name(ar->hw->wiphy));
2161
2162         ar->registered = true;
2163         return 0;
2164
2165 err_unreg:
2166         ieee80211_unregister_hw(ar->hw);
2167
2168 err_out:
2169         return err;
2170 }
2171
2172 void ar9170_unregister(struct ar9170 *ar)
2173 {
2174         if (ar->registered) {
2175 #ifdef CONFIG_AR9170_LEDS
2176                 ar9170_unregister_leds(ar);
2177 #endif /* CONFIG_AR9170_LEDS */
2178
2179         ieee80211_unregister_hw(ar->hw);
2180         }
2181
2182         kfree_skb(ar->rx_failover);
2183         mutex_destroy(&ar->mutex);
2184 }