drivers/net/wireless/mwl8k.c

   1 /*
   2  * drivers/net/wireless/mwl8k.c
   3  * Driver for Marvell TOPDOG 802.11 Wireless cards
   4  *
   5  * Copyright (C) 2008, 2009, 2010 Marvell Semiconductor Inc.
   6  *
   7  * This file is licensed under the terms of the GNU General Public
   8  * License version 2.  This program is licensed "as is" without any
   9  * warranty of any kind, whether express or implied.
  10  */
  11
  12 #include <linux/init.h>
  13 #include <linux/module.h>
  14 #include <linux/kernel.h>
  15 #include <linux/sched.h>
  16 #include <linux/spinlock.h>
  17 #include <linux/list.h>
  18 #include <linux/pci.h>
  19 #include <linux/delay.h>
  20 #include <linux/completion.h>
  21 #include <linux/etherdevice.h>
  22 #include <linux/slab.h>
  23 #include <net/mac80211.h>
  24 #include <linux/moduleparam.h>
  25 #include <linux/firmware.h>
  26 #include <linux/workqueue.h>
  27
  28 #define MWL8K_DESC      "Marvell TOPDOG(R) 802.11 Wireless Network Driver"
  29 #define MWL8K_NAME      KBUILD_MODNAME
  30 #define MWL8K_VERSION   "0.12"
  31
  32 /* Module parameters */
  33 static unsigned ap_mode_default;
  34 module_param(ap_mode_default, bool, 0);
  35 MODULE_PARM_DESC(ap_mode_default,
  36                  "Set to 1 to make ap mode the default instead of sta mode");
  37
  38 /* Register definitions */
  39 #define MWL8K_HIU_GEN_PTR                       0x00000c10
  40 #define  MWL8K_MODE_STA                          0x0000005a
  41 #define  MWL8K_MODE_AP                           0x000000a5
  42 #define MWL8K_HIU_INT_CODE                      0x00000c14
  43 #define  MWL8K_FWSTA_READY                       0xf0f1f2f4
  44 #define  MWL8K_FWAP_READY                        0xf1f2f4a5
  45 #define  MWL8K_INT_CODE_CMD_FINISHED             0x00000005
  46 #define MWL8K_HIU_SCRATCH                       0x00000c40
  47
  48 /* Host->device communications */
  49 #define MWL8K_HIU_H2A_INTERRUPT_EVENTS          0x00000c18
  50 #define MWL8K_HIU_H2A_INTERRUPT_STATUS          0x00000c1c
  51 #define MWL8K_HIU_H2A_INTERRUPT_MASK            0x00000c20
  52 #define MWL8K_HIU_H2A_INTERRUPT_CLEAR_SEL       0x00000c24
  53 #define MWL8K_HIU_H2A_INTERRUPT_STATUS_MASK     0x00000c28
  54 #define  MWL8K_H2A_INT_DUMMY                     (1 << 20)
  55 #define  MWL8K_H2A_INT_RESET                     (1 << 15)
  56 #define  MWL8K_H2A_INT_DOORBELL                  (1 << 1)
  57 #define  MWL8K_H2A_INT_PPA_READY                 (1 << 0)
  58
  59 /* Device->host communications */
  60 #define MWL8K_HIU_A2H_INTERRUPT_EVENTS          0x00000c2c
  61 #define MWL8K_HIU_A2H_INTERRUPT_STATUS          0x00000c30
  62 #define MWL8K_HIU_A2H_INTERRUPT_MASK            0x00000c34
  63 #define MWL8K_HIU_A2H_INTERRUPT_CLEAR_SEL       0x00000c38
  64 #define MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK     0x00000c3c
  65 #define  MWL8K_A2H_INT_DUMMY                     (1 << 20)
  66 #define  MWL8K_A2H_INT_CHNL_SWITCHED             (1 << 11)
  67 #define  MWL8K_A2H_INT_QUEUE_EMPTY               (1 << 10)
  68 #define  MWL8K_A2H_INT_RADAR_DETECT              (1 << 7)
  69 #define  MWL8K_A2H_INT_RADIO_ON                  (1 << 6)
  70 #define  MWL8K_A2H_INT_RADIO_OFF                 (1 << 5)
  71 #define  MWL8K_A2H_INT_MAC_EVENT                 (1 << 3)
  72 #define  MWL8K_A2H_INT_OPC_DONE                  (1 << 2)
  73 #define  MWL8K_A2H_INT_RX_READY                  (1 << 1)
  74 #define  MWL8K_A2H_INT_TX_DONE                   (1 << 0)
  75
  76 #define MWL8K_A2H_EVENTS        (MWL8K_A2H_INT_DUMMY | \
  77                                  MWL8K_A2H_INT_CHNL_SWITCHED | \
  78                                  MWL8K_A2H_INT_QUEUE_EMPTY | \
  79                                  MWL8K_A2H_INT_RADAR_DETECT | \
  80                                  MWL8K_A2H_INT_RADIO_ON | \
  81                                  MWL8K_A2H_INT_RADIO_OFF | \
  82                                  MWL8K_A2H_INT_MAC_EVENT | \
  83                                  MWL8K_A2H_INT_OPC_DONE | \
  84                                  MWL8K_A2H_INT_RX_READY | \
  85                                  MWL8K_A2H_INT_TX_DONE)
  86
  87 #define MWL8K_RX_QUEUES         1
  88 #define MWL8K_TX_WMM_QUEUES     4
  89 #define MWL8K_MAX_AMPDU_QUEUES  8
  90 #define MWL8K_MAX_TX_QUEUES     (MWL8K_TX_WMM_QUEUES + MWL8K_MAX_AMPDU_QUEUES)
  91 #define mwl8k_tx_queues(priv)   (MWL8K_TX_WMM_QUEUES + (priv)->num_ampdu_queues)
  92
  93 struct rxd_ops {
  94         int rxd_size;
  95         void (*rxd_init)(void *rxd, dma_addr_t next_dma_addr);
  96         void (*rxd_refill)(void *rxd, dma_addr_t addr, int len);
  97         int (*rxd_process)(void *rxd, struct ieee80211_rx_status *status,
  98                            __le16 *qos, s8 *noise);
  99 };
 100
 101 struct mwl8k_device_info {
 102         char *part_name;
 103         char *helper_image;
 104         char *fw_image_sta;
 105         char *fw_image_ap;
 106         struct rxd_ops *ap_rxd_ops;
 107         u32 fw_api_ap;
 108 };
 109
 110 struct mwl8k_rx_queue {
 111         int rxd_count;
 112
 113         /* hw receives here */
 114         int head;
 115
 116         /* refill descs here */
 117         int tail;
 118
 119         void *rxd;
 120         dma_addr_t rxd_dma;
 121         struct {
 122                 struct sk_buff *skb;
 123                 DEFINE_DMA_UNMAP_ADDR(dma);
 124         } *buf;
 125 };
 126
 127 struct mwl8k_tx_queue {
 128         /* hw transmits here */
 129         int head;
 130
 131         /* sw appends here */
 132         int tail;
 133
 134         unsigned int len;
 135         struct mwl8k_tx_desc *txd;
 136         dma_addr_t txd_dma;
 137         struct sk_buff **skb;
 138 };
 139
 140 enum {
 141         AMPDU_NO_STREAM,
 142         AMPDU_STREAM_NEW,
 143         AMPDU_STREAM_IN_PROGRESS,
 144         AMPDU_STREAM_ACTIVE,
 145 };
 146
 147 struct mwl8k_ampdu_stream {
 148         struct ieee80211_sta *sta;
 149         u8 tid;
 150         u8 state;
 151         u8 idx;
 152         u8 txq_idx; /* index of this stream in priv->txq */
 153 };
 154
 155 struct mwl8k_priv {
 156         struct ieee80211_hw *hw;
 157         struct pci_dev *pdev;
 158
 159         struct mwl8k_device_info *device_info;
 160
 161         void __iomem *sram;
 162         void __iomem *regs;
 163
 164         /* firmware */
 165         const struct firmware *fw_helper;
 166         const struct firmware *fw_ucode;
 167
 168         /* hardware/firmware parameters */
 169         bool ap_fw;
 170         struct rxd_ops *rxd_ops;
 171         struct ieee80211_supported_band band_24;
 172         struct ieee80211_channel channels_24[14];
 173         struct ieee80211_rate rates_24[14];
 174         struct ieee80211_supported_band band_50;
 175         struct ieee80211_channel channels_50[4];
 176         struct ieee80211_rate rates_50[9];
 177         u32 ap_macids_supported;
 178         u32 sta_macids_supported;
 179
 180         /* Ampdu stream information */
 181         u8 num_ampdu_queues;
 182         spinlock_t stream_lock;
 183         struct mwl8k_ampdu_stream ampdu[MWL8K_MAX_AMPDU_QUEUES];
 184
 185         /* firmware access */
 186         struct mutex fw_mutex;
 187         struct task_struct *fw_mutex_owner;
 188         int fw_mutex_depth;
 189         struct completion *hostcmd_wait;
 190
 191         /* lock held over TX and TX reap */
 192         spinlock_t tx_lock;
 193
 194         /* TX quiesce completion, protected by fw_mutex and tx_lock */
 195         struct completion *tx_wait;
 196
 197         /* List of interfaces.  */
 198         u32 macids_used;
 199         struct list_head vif_list;
 200
 201         /* power management status cookie from firmware */
 202         u32 *cookie;
 203         dma_addr_t cookie_dma;
 204
 205         u16 num_mcaddrs;
 206         u8 hw_rev;
 207         u32 fw_rev;
 208
 209         /*
 210          * Running count of TX packets in flight, to avoid
 211          * iterating over the transmit rings each time.
 212          */
 213         int pending_tx_pkts;
 214
 215         struct mwl8k_rx_queue rxq[MWL8K_RX_QUEUES];
 216         struct mwl8k_tx_queue txq[MWL8K_MAX_TX_QUEUES];
 217         u32 txq_offset[MWL8K_MAX_TX_QUEUES];
 218
 219         bool radio_on;
 220         bool radio_short_preamble;
 221         bool sniffer_enabled;
 222         bool wmm_enabled;
 223
 224         /* XXX need to convert this to handle multiple interfaces */
 225         bool capture_beacon;
 226         u8 capture_bssid[ETH_ALEN];
 227         struct sk_buff *beacon_skb;
 228
 229         /*
 230          * This FJ worker has to be global as it is scheduled from the
 231          * RX handler.  At this point we don't know which interface it
 232          * belongs to until the list of bssids waiting to complete join
 233          * is checked.
 234          */
 235         struct work_struct finalize_join_worker;
 236
 237         /* Tasklet to perform TX reclaim.  */
 238         struct tasklet_struct poll_tx_task;
 239
 240         /* Tasklet to perform RX.  */
 241         struct tasklet_struct poll_rx_task;
 242
 243         /* Most recently reported noise in dBm */
 244         s8 noise;
 245
 246         /*
 247          * preserve the queue configurations so they can be restored if/when
 248          * the firmware image is swapped.
 249          */
 250         struct ieee80211_tx_queue_params wmm_params[MWL8K_TX_WMM_QUEUES];
 251
 252         /* async firmware loading state */
 253         unsigned fw_state;
 254         char *fw_pref;
 255         char *fw_alt;
 256         struct completion firmware_loading_complete;
 257 };
 258
 259 #define MAX_WEP_KEY_LEN         13
 260 #define NUM_WEP_KEYS            4
 261
 262 /* Per interface specific private data */
 263 struct mwl8k_vif {
 264         struct list_head list;
 265         struct ieee80211_vif *vif;
 266
 267         /* Firmware macid for this vif.  */
 268         int macid;
 269
 270         /* Non AMPDU sequence number assigned by driver.  */
 271         u16 seqno;
 272
 273         /* Saved WEP keys */
 274         struct {
 275                 u8 enabled;
 276                 u8 key[sizeof(struct ieee80211_key_conf) + MAX_WEP_KEY_LEN];
 277         } wep_key_conf[NUM_WEP_KEYS];
 278
 279         /* BSSID */
 280         u8 bssid[ETH_ALEN];
 281
 282         /* A flag to indicate is HW crypto is enabled for this bssid */
 283         bool is_hw_crypto_enabled;
 284 };
 285 #define MWL8K_VIF(_vif) ((struct mwl8k_vif *)&((_vif)->drv_priv))
 286 #define IEEE80211_KEY_CONF(_u8) ((struct ieee80211_key_conf *)(_u8))
 287
 288 struct mwl8k_sta {
 289         /* Index into station database. Returned by UPDATE_STADB.  */
 290         u8 peer_id;
 291 };
 292 #define MWL8K_STA(_sta) ((struct mwl8k_sta *)&((_sta)->drv_priv))
 293
 294 static const struct ieee80211_channel mwl8k_channels_24[] = {
 295         { .center_freq = 2412, .hw_value = 1, },
 296         { .center_freq = 2417, .hw_value = 2, },
 297         { .center_freq = 2422, .hw_value = 3, },
 298         { .center_freq = 2427, .hw_value = 4, },
 299         { .center_freq = 2432, .hw_value = 5, },
 300         { .center_freq = 2437, .hw_value = 6, },
 301         { .center_freq = 2442, .hw_value = 7, },
 302         { .center_freq = 2447, .hw_value = 8, },
 303         { .center_freq = 2452, .hw_value = 9, },
 304         { .center_freq = 2457, .hw_value = 10, },
 305         { .center_freq = 2462, .hw_value = 11, },
 306         { .center_freq = 2467, .hw_value = 12, },
 307         { .center_freq = 2472, .hw_value = 13, },
 308         { .center_freq = 2484, .hw_value = 14, },
 309 };
 310
 311 static const struct ieee80211_rate mwl8k_rates_24[] = {
 312         { .bitrate = 10, .hw_value = 2, },
 313         { .bitrate = 20, .hw_value = 4, },
 314         { .bitrate = 55, .hw_value = 11, },
 315         { .bitrate = 110, .hw_value = 22, },
 316         { .bitrate = 220, .hw_value = 44, },
 317         { .bitrate = 60, .hw_value = 12, },
 318         { .bitrate = 90, .hw_value = 18, },
 319         { .bitrate = 120, .hw_value = 24, },
 320         { .bitrate = 180, .hw_value = 36, },
 321         { .bitrate = 240, .hw_value = 48, },
 322         { .bitrate = 360, .hw_value = 72, },
 323         { .bitrate = 480, .hw_value = 96, },
 324         { .bitrate = 540, .hw_value = 108, },
 325         { .bitrate = 720, .hw_value = 144, },
 326 };
 327
 328 static const struct ieee80211_channel mwl8k_channels_50[] = {
 329         { .center_freq = 5180, .hw_value = 36, },
 330         { .center_freq = 5200, .hw_value = 40, },
 331         { .center_freq = 5220, .hw_value = 44, },
 332         { .center_freq = 5240, .hw_value = 48, },
 333 };
 334
 335 static const struct ieee80211_rate mwl8k_rates_50[] = {
 336         { .bitrate = 60, .hw_value = 12, },
 337         { .bitrate = 90, .hw_value = 18, },
 338         { .bitrate = 120, .hw_value = 24, },
 339         { .bitrate = 180, .hw_value = 36, },
 340         { .bitrate = 240, .hw_value = 48, },
 341         { .bitrate = 360, .hw_value = 72, },
 342         { .bitrate = 480, .hw_value = 96, },
 343         { .bitrate = 540, .hw_value = 108, },
 344         { .bitrate = 720, .hw_value = 144, },
 345 };
 346
 347 /* Set or get info from Firmware */
 348 #define MWL8K_CMD_GET                   0x0000
 349 #define MWL8K_CMD_SET                   0x0001
 350 #define MWL8K_CMD_SET_LIST              0x0002
 351
 352 /* Firmware command codes */
 353 #define MWL8K_CMD_CODE_DNLD             0x0001
 354 #define MWL8K_CMD_GET_HW_SPEC           0x0003
 355 #define MWL8K_CMD_SET_HW_SPEC           0x0004
 356 #define MWL8K_CMD_MAC_MULTICAST_ADR     0x0010
 357 #define MWL8K_CMD_GET_STAT              0x0014
 358 #define MWL8K_CMD_RADIO_CONTROL         0x001c
 359 #define MWL8K_CMD_RF_TX_POWER           0x001e
 360 #define MWL8K_CMD_TX_POWER              0x001f
 361 #define MWL8K_CMD_RF_ANTENNA            0x0020
 362 #define MWL8K_CMD_SET_BEACON            0x0100          /* per-vif */
 363 #define MWL8K_CMD_SET_PRE_SCAN          0x0107
 364 #define MWL8K_CMD_SET_POST_SCAN         0x0108
 365 #define MWL8K_CMD_SET_RF_CHANNEL        0x010a
 366 #define MWL8K_CMD_SET_AID               0x010d
 367 #define MWL8K_CMD_SET_RATE              0x0110
 368 #define MWL8K_CMD_SET_FINALIZE_JOIN     0x0111
 369 #define MWL8K_CMD_RTS_THRESHOLD         0x0113
 370 #define MWL8K_CMD_SET_SLOT              0x0114
 371 #define MWL8K_CMD_SET_EDCA_PARAMS       0x0115
 372 #define MWL8K_CMD_SET_WMM_MODE          0x0123
 373 #define MWL8K_CMD_MIMO_CONFIG           0x0125
 374 #define MWL8K_CMD_USE_FIXED_RATE        0x0126
 375 #define MWL8K_CMD_ENABLE_SNIFFER        0x0150
 376 #define MWL8K_CMD_SET_MAC_ADDR          0x0202          /* per-vif */
 377 #define MWL8K_CMD_SET_RATEADAPT_MODE    0x0203
 378 #define MWL8K_CMD_BSS_START             0x1100          /* per-vif */
 379 #define MWL8K_CMD_SET_NEW_STN           0x1111          /* per-vif */
 380 #define MWL8K_CMD_UPDATE_ENCRYPTION     0x1122          /* per-vif */
 381 #define MWL8K_CMD_UPDATE_STADB          0x1123
 382 #define MWL8K_CMD_BASTREAM              0x1125
 383
 384 static const char *mwl8k_cmd_name(__le16 cmd, char *buf, int bufsize)
 385 {
 386         u16 command = le16_to_cpu(cmd);
 387
 388 #define MWL8K_CMDNAME(x)        case MWL8K_CMD_##x: do {\
 389                                         snprintf(buf, bufsize, "%s", #x);\
 390                                         return buf;\
 391                                         } while (0)
 392         switch (command & ~0x8000) {
 393                 MWL8K_CMDNAME(CODE_DNLD);
 394                 MWL8K_CMDNAME(GET_HW_SPEC);
 395                 MWL8K_CMDNAME(SET_HW_SPEC);
 396                 MWL8K_CMDNAME(MAC_MULTICAST_ADR);
 397                 MWL8K_CMDNAME(GET_STAT);
 398                 MWL8K_CMDNAME(RADIO_CONTROL);
 399                 MWL8K_CMDNAME(RF_TX_POWER);
 400                 MWL8K_CMDNAME(TX_POWER);
 401                 MWL8K_CMDNAME(RF_ANTENNA);
 402                 MWL8K_CMDNAME(SET_BEACON);
 403                 MWL8K_CMDNAME(SET_PRE_SCAN);
 404                 MWL8K_CMDNAME(SET_POST_SCAN);
 405                 MWL8K_CMDNAME(SET_RF_CHANNEL);
 406                 MWL8K_CMDNAME(SET_AID);
 407                 MWL8K_CMDNAME(SET_RATE);
 408                 MWL8K_CMDNAME(SET_FINALIZE_JOIN);
 409                 MWL8K_CMDNAME(RTS_THRESHOLD);
 410                 MWL8K_CMDNAME(SET_SLOT);
 411                 MWL8K_CMDNAME(SET_EDCA_PARAMS);
 412                 MWL8K_CMDNAME(SET_WMM_MODE);
 413                 MWL8K_CMDNAME(MIMO_CONFIG);
 414                 MWL8K_CMDNAME(USE_FIXED_RATE);
 415                 MWL8K_CMDNAME(ENABLE_SNIFFER);
 416                 MWL8K_CMDNAME(SET_MAC_ADDR);
 417                 MWL8K_CMDNAME(SET_RATEADAPT_MODE);
 418                 MWL8K_CMDNAME(BSS_START);
 419                 MWL8K_CMDNAME(SET_NEW_STN);
 420                 MWL8K_CMDNAME(UPDATE_ENCRYPTION);
 421                 MWL8K_CMDNAME(UPDATE_STADB);
 422                 MWL8K_CMDNAME(BASTREAM);
 423         default:
 424                 snprintf(buf, bufsize, "0x%x", cmd);
 425         }
 426 #undef MWL8K_CMDNAME
 427
 428         return buf;
 429 }
 430
 431 /* Hardware and firmware reset */
 432 static void mwl8k_hw_reset(struct mwl8k_priv *priv)
 433 {
 434         iowrite32(MWL8K_H2A_INT_RESET,
 435                 priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
 436         iowrite32(MWL8K_H2A_INT_RESET,
 437                 priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
 438         msleep(20);
 439 }
 440
 441 /* Release fw image */
 442 static void mwl8k_release_fw(const struct firmware **fw)
 443 {
 444         if (*fw == NULL)
 445                 return;
 446         release_firmware(*fw);
 447         *fw = NULL;
 448 }
 449
 450 static void mwl8k_release_firmware(struct mwl8k_priv *priv)
 451 {
 452         mwl8k_release_fw(&priv->fw_ucode);
 453         mwl8k_release_fw(&priv->fw_helper);
 454 }
 455
 456 /* states for asynchronous f/w loading */
 457 static void mwl8k_fw_state_machine(const struct firmware *fw, void *context);
 458 enum {
 459         FW_STATE_INIT = 0,
 460         FW_STATE_LOADING_PREF,
 461         FW_STATE_LOADING_ALT,
 462         FW_STATE_ERROR,
 463 };
 464
 465 /* Request fw image */
 466 static int mwl8k_request_fw(struct mwl8k_priv *priv,
 467                             const char *fname, const struct firmware **fw,
 468                             bool nowait)
 469 {
 470         /* release current image */
 471         if (*fw != NULL)
 472                 mwl8k_release_fw(fw);
 473
 474         if (nowait)
 475                 return request_firmware_nowait(THIS_MODULE, 1, fname,
 476                                                &priv->pdev->dev, GFP_KERNEL,
 477                                                priv, mwl8k_fw_state_machine);
 478         else
 479                 return request_firmware(fw, fname, &priv->pdev->dev);
 480 }
 481
 482 static int mwl8k_request_firmware(struct mwl8k_priv *priv, char *fw_image,
 483                                   bool nowait)
 484 {
 485         struct mwl8k_device_info *di = priv->device_info;
 486         int rc;
 487
 488         if (di->helper_image != NULL) {
 489                 if (nowait)
 490                         rc = mwl8k_request_fw(priv, di->helper_image,
 491                                               &priv->fw_helper, true);
 492                 else
 493                         rc = mwl8k_request_fw(priv, di->helper_image,
 494                                               &priv->fw_helper, false);
 495                 if (rc)
 496                         printk(KERN_ERR "%s: Error requesting helper fw %s\n",
 497                                pci_name(priv->pdev), di->helper_image);
 498
 499                 if (rc || nowait)
 500                         return rc;
 501         }
 502
 503         if (nowait) {
 504                 /*
 505                  * if we get here, no helper image is needed.  Skip the
 506                  * FW_STATE_INIT state.
 507                  */
 508                 priv->fw_state = FW_STATE_LOADING_PREF;
 509                 rc = mwl8k_request_fw(priv, fw_image,
 510                                       &priv->fw_ucode,
 511                                       true);
 512         } else
 513                 rc = mwl8k_request_fw(priv, fw_image,
 514                                       &priv->fw_ucode, false);
 515         if (rc) {
 516                 printk(KERN_ERR "%s: Error requesting firmware file %s\n",
 517                        pci_name(priv->pdev), fw_image);
 518                 mwl8k_release_fw(&priv->fw_helper);
 519                 return rc;
 520         }
 521
 522         return 0;
 523 }
 524
 525 struct mwl8k_cmd_pkt {
 526         __le16  code;
 527         __le16  length;
 528         __u8    seq_num;
 529         __u8    macid;
 530         __le16  result;
 531         char    payload[0];
 532 } __packed;
 533
 534 /*
 535  * Firmware loading.
 536  */
 537 static int
 538 mwl8k_send_fw_load_cmd(struct mwl8k_priv *priv, void *data, int length)
 539 {
 540         void __iomem *regs = priv->regs;
 541         dma_addr_t dma_addr;
 542         int loops;
 543
 544         dma_addr = pci_map_single(priv->pdev, data, length, PCI_DMA_TODEVICE);
 545         if (pci_dma_mapping_error(priv->pdev, dma_addr))
 546                 return -ENOMEM;
 547
 548         iowrite32(dma_addr, regs + MWL8K_HIU_GEN_PTR);
 549         iowrite32(0, regs + MWL8K_HIU_INT_CODE);
 550         iowrite32(MWL8K_H2A_INT_DOORBELL,
 551                 regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
 552         iowrite32(MWL8K_H2A_INT_DUMMY,
 553                 regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
 554
 555         loops = 1000;
 556         do {
 557                 u32 int_code;
 558
 559                 int_code = ioread32(regs + MWL8K_HIU_INT_CODE);
 560                 if (int_code == MWL8K_INT_CODE_CMD_FINISHED) {
 561                         iowrite32(0, regs + MWL8K_HIU_INT_CODE);
 562                         break;
 563                 }
 564
 565                 cond_resched();
 566                 udelay(1);
 567         } while (--loops);
 568
 569         pci_unmap_single(priv->pdev, dma_addr, length, PCI_DMA_TODEVICE);
 570
 571         return loops ? 0 : -ETIMEDOUT;
 572 }
 573
 574 static int mwl8k_load_fw_image(struct mwl8k_priv *priv,
 575                                 const u8 *data, size_t length)
 576 {
 577         struct mwl8k_cmd_pkt *cmd;
 578         int done;
 579         int rc = 0;
 580
 581         cmd = kmalloc(sizeof(*cmd) + 256, GFP_KERNEL);
 582         if (cmd == NULL)
 583                 return -ENOMEM;
 584
 585         cmd->code = cpu_to_le16(MWL8K_CMD_CODE_DNLD);
 586         cmd->seq_num = 0;
 587         cmd->macid = 0;
 588         cmd->result = 0;
 589
 590         done = 0;
 591         while (length) {
 592                 int block_size = length > 256 ? 256 : length;
 593
 594                 memcpy(cmd->payload, data + done, block_size);
 595                 cmd->length = cpu_to_le16(block_size);
 596
 597                 rc = mwl8k_send_fw_load_cmd(priv, cmd,
 598                                                 sizeof(*cmd) + block_size);
 599                 if (rc)
 600                         break;
 601
 602                 done += block_size;
 603                 length -= block_size;
 604         }
 605
 606         if (!rc) {
 607                 cmd->length = 0;
 608                 rc = mwl8k_send_fw_load_cmd(priv, cmd, sizeof(*cmd));
 609         }
 610
 611         kfree(cmd);
 612
 613         return rc;
 614 }
 615
 616 static int mwl8k_feed_fw_image(struct mwl8k_priv *priv,
 617                                 const u8 *data, size_t length)
 618 {
 619         unsigned char *buffer;
 620         int may_continue, rc = 0;
 621         u32 done, prev_block_size;
 622
 623         buffer = kmalloc(1024, GFP_KERNEL);
 624         if (buffer == NULL)
 625                 return -ENOMEM;
 626
 627         done = 0;
 628         prev_block_size = 0;
 629         may_continue = 1000;
 630         while (may_continue > 0) {
 631                 u32 block_size;
 632
 633                 block_size = ioread32(priv->regs + MWL8K_HIU_SCRATCH);
 634                 if (block_size & 1) {
 635                         block_size &= ~1;
 636                         may_continue--;
 637                 } else {
 638                         done += prev_block_size;
 639                         length -= prev_block_size;
 640                 }
 641
 642                 if (block_size > 1024 || block_size > length) {
 643                         rc = -EOVERFLOW;
 644                         break;
 645                 }
 646
 647                 if (length == 0) {
 648                         rc = 0;
 649                         break;
 650                 }
 651
 652                 if (block_size == 0) {
 653                         rc = -EPROTO;
 654                         may_continue--;
 655                         udelay(1);
 656                         continue;
 657                 }
 658
 659                 prev_block_size = block_size;
 660                 memcpy(buffer, data + done, block_size);
 661
 662                 rc = mwl8k_send_fw_load_cmd(priv, buffer, block_size);
 663                 if (rc)
 664                         break;
 665         }
 666
 667         if (!rc && length != 0)
 668                 rc = -EREMOTEIO;
 669
 670         kfree(buffer);
 671
 672         return rc;
 673 }
 674
 675 static int mwl8k_load_firmware(struct ieee80211_hw *hw)
 676 {
 677         struct mwl8k_priv *priv = hw->priv;
 678         const struct firmware *fw = priv->fw_ucode;
 679         int rc;
 680         int loops;
 681
 682         if (!memcmp(fw->data, "\x01\x00\x00\x00", 4)) {
 683                 const struct firmware *helper = priv->fw_helper;
 684
 685                 if (helper == NULL) {
 686                         printk(KERN_ERR "%s: helper image needed but none "
 687                                "given\n", pci_name(priv->pdev));
 688                         return -EINVAL;
 689                 }
 690
 691                 rc = mwl8k_load_fw_image(priv, helper->data, helper->size);
 692                 if (rc) {
 693                         printk(KERN_ERR "%s: unable to load firmware "
 694                                "helper image\n", pci_name(priv->pdev));
 695                         return rc;
 696                 }
 697                 msleep(5);
 698
 699                 rc = mwl8k_feed_fw_image(priv, fw->data, fw->size);
 700         } else {
 701                 rc = mwl8k_load_fw_image(priv, fw->data, fw->size);
 702         }
 703
 704         if (rc) {
 705                 printk(KERN_ERR "%s: unable to load firmware image\n",
 706                        pci_name(priv->pdev));
 707                 return rc;
 708         }
 709
 710         iowrite32(MWL8K_MODE_STA, priv->regs + MWL8K_HIU_GEN_PTR);
 711
 712         loops = 500000;
 713         do {
 714                 u32 ready_code;
 715
 716                 ready_code = ioread32(priv->regs + MWL8K_HIU_INT_CODE);
 717                 if (ready_code == MWL8K_FWAP_READY) {
 718                         priv->ap_fw = 1;
 719                         break;
 720                 } else if (ready_code == MWL8K_FWSTA_READY) {
 721                         priv->ap_fw = 0;
 722                         break;
 723                 }
 724
 725                 cond_resched();
 726                 udelay(1);
 727         } while (--loops);
 728
 729         return loops ? 0 : -ETIMEDOUT;
 730 }
 731
 732
 733 /* DMA header used by firmware and hardware.  */
 734 struct mwl8k_dma_data {
 735         __le16 fwlen;
 736         struct ieee80211_hdr wh;
 737         char data[0];
 738 } __packed;
 739
 740 /* Routines to add/remove DMA header from skb.  */
 741 static inline void mwl8k_remove_dma_header(struct sk_buff *skb, __le16 qos)
 742 {
 743         struct mwl8k_dma_data *tr;
 744         int hdrlen;
 745
 746         tr = (struct mwl8k_dma_data *)skb->data;
 747         hdrlen = ieee80211_hdrlen(tr->wh.frame_control);
 748
 749         if (hdrlen != sizeof(tr->wh)) {
 750                 if (ieee80211_is_data_qos(tr->wh.frame_control)) {
 751                         memmove(tr->data - hdrlen, &tr->wh, hdrlen - 2);
 752                         *((__le16 *)(tr->data - 2)) = qos;
 753                 } else {
 754                         memmove(tr->data - hdrlen, &tr->wh, hdrlen);
 755                 }
 756         }
 757
 758         if (hdrlen != sizeof(*tr))
 759                 skb_pull(skb, sizeof(*tr) - hdrlen);
 760 }
 761
 762 static void
 763 mwl8k_add_dma_header(struct sk_buff *skb, int tail_pad)
 764 {
 765         struct ieee80211_hdr *wh;
 766         int hdrlen;
 767         int reqd_hdrlen;
 768         struct mwl8k_dma_data *tr;
 769
 770         /*
 771          * Add a firmware DMA header; the firmware requires that we
 772          * present a 2-byte payload length followed by a 4-address
 773          * header (without QoS field), followed (optionally) by any
 774          * WEP/ExtIV header (but only filled in for CCMP).
 775          */
 776         wh = (struct ieee80211_hdr *)skb->data;
 777
 778         hdrlen = ieee80211_hdrlen(wh->frame_control);
 779         reqd_hdrlen = sizeof(*tr);
 780
 781         if (hdrlen != reqd_hdrlen)
 782                 skb_push(skb, reqd_hdrlen - hdrlen);
 783
 784         if (ieee80211_is_data_qos(wh->frame_control))
 785                 hdrlen -= IEEE80211_QOS_CTL_LEN;
 786
 787         tr = (struct mwl8k_dma_data *)skb->data;
 788         if (wh != &tr->wh)
 789                 memmove(&tr->wh, wh, hdrlen);
 790         if (hdrlen != sizeof(tr->wh))
 791                 memset(((void *)&tr->wh) + hdrlen, 0, sizeof(tr->wh) - hdrlen);
 792
 793         /*
 794          * Firmware length is the length of the fully formed "802.11
 795          * payload".  That is, everything except for the 802.11 header.
 796          * This includes all crypto material including the MIC.
 797          */
 798         tr->fwlen = cpu_to_le16(skb->len - sizeof(*tr) + tail_pad);
 799 }
 800
 801 static void mwl8k_encapsulate_tx_frame(struct sk_buff *skb)
 802 {
 803         struct ieee80211_hdr *wh;
 804         struct ieee80211_tx_info *tx_info;
 805         struct ieee80211_key_conf *key_conf;
 806         int data_pad;
 807
 808         wh = (struct ieee80211_hdr *)skb->data;
 809
 810         tx_info = IEEE80211_SKB_CB(skb);
 811
 812         key_conf = NULL;
 813         if (ieee80211_is_data(wh->frame_control))
 814                 key_conf = tx_info->control.hw_key;
 815
 816         /*
 817          * Make sure the packet header is in the DMA header format (4-address
 818          * without QoS), the necessary crypto padding between the header and the
 819          * payload has already been provided by mac80211, but it doesn't add tail
 820          * padding when HW crypto is enabled.
 821          *
 822          * We have the following trailer padding requirements:
 823          * - WEP: 4 trailer bytes (ICV)
 824          * - TKIP: 12 trailer bytes (8 MIC + 4 ICV)
 825          * - CCMP: 8 trailer bytes (MIC)
 826          */
 827         data_pad = 0;
 828         if (key_conf != NULL) {
 829                 switch (key_conf->cipher) {
 830                 case WLAN_CIPHER_SUITE_WEP40:
 831                 case WLAN_CIPHER_SUITE_WEP104:
 832                         data_pad = 4;
 833                         break;
 834                 case WLAN_CIPHER_SUITE_TKIP:
 835                         data_pad = 12;
 836                         break;
 837                 case WLAN_CIPHER_SUITE_CCMP:
 838                         data_pad = 8;
 839                         break;
 840                 }
 841         }
 842         mwl8k_add_dma_header(skb, data_pad);
 843 }
 844
 845 /*
 846  * Packet reception for 88w8366 AP firmware.
 847  */
 848 struct mwl8k_rxd_8366_ap {
 849         __le16 pkt_len;
 850         __u8 sq2;
 851         __u8 rate;
 852         __le32 pkt_phys_addr;
 853         __le32 next_rxd_phys_addr;
 854         __le16 qos_control;
 855         __le16 htsig2;
 856         __le32 hw_rssi_info;
 857         __le32 hw_noise_floor_info;
 858         __u8 noise_floor;
 859         __u8 pad0[3];
 860         __u8 rssi;
 861         __u8 rx_status;
 862         __u8 channel;
 863         __u8 rx_ctrl;
 864 } __packed;
 865
 866 #define MWL8K_8366_AP_RATE_INFO_MCS_FORMAT      0x80
 867 #define MWL8K_8366_AP_RATE_INFO_40MHZ           0x40
 868 #define MWL8K_8366_AP_RATE_INFO_RATEID(x)       ((x) & 0x3f)
 869
 870 #define MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST     0x80
 871
 872 /* 8366 AP rx_status bits */
 873 #define MWL8K_8366_AP_RXSTAT_DECRYPT_ERR_MASK           0x80
 874 #define MWL8K_8366_AP_RXSTAT_GENERAL_DECRYPT_ERR        0xFF
 875 #define MWL8K_8366_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR       0x02
 876 #define MWL8K_8366_AP_RXSTAT_WEP_DECRYPT_ICV_ERR        0x04
 877 #define MWL8K_8366_AP_RXSTAT_TKIP_DECRYPT_ICV_ERR       0x08
 878
 879 static void mwl8k_rxd_8366_ap_init(void *_rxd, dma_addr_t next_dma_addr)
 880 {
 881         struct mwl8k_rxd_8366_ap *rxd = _rxd;
 882
 883         rxd->next_rxd_phys_addr = cpu_to_le32(next_dma_addr);
 884         rxd->rx_ctrl = MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST;
 885 }
 886
 887 static void mwl8k_rxd_8366_ap_refill(void *_rxd, dma_addr_t addr, int len)
 888 {
 889         struct mwl8k_rxd_8366_ap *rxd = _rxd;
 890
 891         rxd->pkt_len = cpu_to_le16(len);
 892         rxd->pkt_phys_addr = cpu_to_le32(addr);
 893         wmb();
 894         rxd->rx_ctrl = 0;
 895 }
 896
 897 static int
 898 mwl8k_rxd_8366_ap_process(void *_rxd, struct ieee80211_rx_status *status,
 899                           __le16 *qos, s8 *noise)
 900 {
 901         struct mwl8k_rxd_8366_ap *rxd = _rxd;
 902
 903         if (!(rxd->rx_ctrl & MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST))
 904                 return -1;
 905         rmb();
 906
 907         memset(status, 0, sizeof(*status));
 908
 909         status->signal = -rxd->rssi;
 910         *noise = -rxd->noise_floor;
 911
 912         if (rxd->rate & MWL8K_8366_AP_RATE_INFO_MCS_FORMAT) {
 913                 status->flag |= RX_FLAG_HT;
 914                 if (rxd->rate & MWL8K_8366_AP_RATE_INFO_40MHZ)
 915                         status->flag |= RX_FLAG_40MHZ;
 916                 status->rate_idx = MWL8K_8366_AP_RATE_INFO_RATEID(rxd->rate);
 917         } else {
 918                 int i;
 919
 920                 for (i = 0; i < ARRAY_SIZE(mwl8k_rates_24); i++) {
 921                         if (mwl8k_rates_24[i].hw_value == rxd->rate) {
 922                                 status->rate_idx = i;
 923                                 break;
 924                         }
 925                 }
 926         }
 927
 928         if (rxd->channel > 14) {
 929                 status->band = IEEE80211_BAND_5GHZ;
 930                 if (!(status->flag & RX_FLAG_HT))
 931                         status->rate_idx -= 5;
 932         } else {
 933                 status->band = IEEE80211_BAND_2GHZ;
 934         }
 935         status->freq = ieee80211_channel_to_frequency(rxd->channel,
 936                                                       status->band);
 937
 938         *qos = rxd->qos_control;
 939
 940         if ((rxd->rx_status != MWL8K_8366_AP_RXSTAT_GENERAL_DECRYPT_ERR) &&
 941             (rxd->rx_status & MWL8K_8366_AP_RXSTAT_DECRYPT_ERR_MASK) &&
 942             (rxd->rx_status & MWL8K_8366_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR))
 943                 status->flag |= RX_FLAG_MMIC_ERROR;
 944
 945         return le16_to_cpu(rxd->pkt_len);
 946 }
 947
 948 static struct rxd_ops rxd_8366_ap_ops = {
 949         .rxd_size       = sizeof(struct mwl8k_rxd_8366_ap),
 950         .rxd_init       = mwl8k_rxd_8366_ap_init,
 951         .rxd_refill     = mwl8k_rxd_8366_ap_refill,
 952         .rxd_process    = mwl8k_rxd_8366_ap_process,
 953 };
 954
 955 /*
 956  * Packet reception for STA firmware.
 957  */
 958 struct mwl8k_rxd_sta {
 959         __le16 pkt_len;
 960         __u8 link_quality;
 961         __u8 noise_level;
 962         __le32 pkt_phys_addr;
 963         __le32 next_rxd_phys_addr;
 964         __le16 qos_control;
 965         __le16 rate_info;
 966         __le32 pad0[4];
 967         __u8 rssi;
 968         __u8 channel;
 969         __le16 pad1;
 970         __u8 rx_ctrl;
 971         __u8 rx_status;
 972         __u8 pad2[2];
 973 } __packed;
 974
 975 #define MWL8K_STA_RATE_INFO_SHORTPRE            0x8000
 976 #define MWL8K_STA_RATE_INFO_ANTSELECT(x)        (((x) >> 11) & 0x3)
 977 #define MWL8K_STA_RATE_INFO_RATEID(x)           (((x) >> 3) & 0x3f)
 978 #define MWL8K_STA_RATE_INFO_40MHZ               0x0004
 979 #define MWL8K_STA_RATE_INFO_SHORTGI             0x0002
 980 #define MWL8K_STA_RATE_INFO_MCS_FORMAT          0x0001
 981
 982 #define MWL8K_STA_RX_CTRL_OWNED_BY_HOST         0x02
 983 #define MWL8K_STA_RX_CTRL_DECRYPT_ERROR         0x04
 984 /* ICV=0 or MIC=1 */
 985 #define MWL8K_STA_RX_CTRL_DEC_ERR_TYPE          0x08
 986 /* Key is uploaded only in failure case */
 987 #define MWL8K_STA_RX_CTRL_KEY_INDEX                     0x30
 988
 989 static void mwl8k_rxd_sta_init(void *_rxd, dma_addr_t next_dma_addr)
 990 {
 991         struct mwl8k_rxd_sta *rxd = _rxd;
 992
 993         rxd->next_rxd_phys_addr = cpu_to_le32(next_dma_addr);
 994         rxd->rx_ctrl = MWL8K_STA_RX_CTRL_OWNED_BY_HOST;
 995 }
 996
 997 static void mwl8k_rxd_sta_refill(void *_rxd, dma_addr_t addr, int len)
 998 {
 999         struct mwl8k_rxd_sta *rxd = _rxd;
1000
1001         rxd->pkt_len = cpu_to_le16(len);
1002         rxd->pkt_phys_addr = cpu_to_le32(addr);
1003         wmb();
1004         rxd->rx_ctrl = 0;
1005 }
1006
1007 static int
1008 mwl8k_rxd_sta_process(void *_rxd, struct ieee80211_rx_status *status,
1009                        __le16 *qos, s8 *noise)
1010 {
1011         struct mwl8k_rxd_sta *rxd = _rxd;
1012         u16 rate_info;
1013
1014         if (!(rxd->rx_ctrl & MWL8K_STA_RX_CTRL_OWNED_BY_HOST))
1015                 return -1;
1016         rmb();
1017
1018         rate_info = le16_to_cpu(rxd->rate_info);
1019
1020         memset(status, 0, sizeof(*status));
1021
1022         status->signal = -rxd->rssi;
1023         *noise = -rxd->noise_level;
1024         status->antenna = MWL8K_STA_RATE_INFO_ANTSELECT(rate_info);
1025         status->rate_idx = MWL8K_STA_RATE_INFO_RATEID(rate_info);
1026
1027         if (rate_info & MWL8K_STA_RATE_INFO_SHORTPRE)
1028                 status->flag |= RX_FLAG_SHORTPRE;
1029         if (rate_info & MWL8K_STA_RATE_INFO_40MHZ)
1030                 status->flag |= RX_FLAG_40MHZ;
1031         if (rate_info & MWL8K_STA_RATE_INFO_SHORTGI)
1032                 status->flag |= RX_FLAG_SHORT_GI;
1033         if (rate_info & MWL8K_STA_RATE_INFO_MCS_FORMAT)
1034                 status->flag |= RX_FLAG_HT;
1035
1036         if (rxd->channel > 14) {
1037                 status->band = IEEE80211_BAND_5GHZ;
1038                 if (!(status->flag & RX_FLAG_HT))
1039                         status->rate_idx -= 5;
1040         } else {
1041                 status->band = IEEE80211_BAND_2GHZ;
1042         }
1043         status->freq = ieee80211_channel_to_frequency(rxd->channel,
1044                                                       status->band);
1045
1046         *qos = rxd->qos_control;
1047         if ((rxd->rx_ctrl & MWL8K_STA_RX_CTRL_DECRYPT_ERROR) &&
1048             (rxd->rx_ctrl & MWL8K_STA_RX_CTRL_DEC_ERR_TYPE))
1049                 status->flag |= RX_FLAG_MMIC_ERROR;
1050
1051         return le16_to_cpu(rxd->pkt_len);
1052 }
1053
1054 static struct rxd_ops rxd_sta_ops = {
1055         .rxd_size       = sizeof(struct mwl8k_rxd_sta),
1056         .rxd_init       = mwl8k_rxd_sta_init,
1057         .rxd_refill     = mwl8k_rxd_sta_refill,
1058         .rxd_process    = mwl8k_rxd_sta_process,
1059 };
1060
1061
1062 #define MWL8K_RX_DESCS          256
1063 #define MWL8K_RX_MAXSZ          3800
1064
1065 static int mwl8k_rxq_init(struct ieee80211_hw *hw, int index)
1066 {
1067         struct mwl8k_priv *priv = hw->priv;
1068         struct mwl8k_rx_queue *rxq = priv->rxq + index;
1069         int size;
1070         int i;
1071
1072         rxq->rxd_count = 0;
1073         rxq->head = 0;
1074         rxq->tail = 0;
1075
1076         size = MWL8K_RX_DESCS * priv->rxd_ops->rxd_size;
1077
1078         rxq->rxd = pci_alloc_consistent(priv->pdev, size, &rxq->rxd_dma);
1079         if (rxq->rxd == NULL) {
1080                 wiphy_err(hw->wiphy, "failed to alloc RX descriptors\n");
1081                 return -ENOMEM;
1082         }
1083         memset(rxq->rxd, 0, size);
1084
1085         rxq->buf = kcalloc(MWL8K_RX_DESCS, sizeof(*rxq->buf), GFP_KERNEL);
1086         if (rxq->buf == NULL) {
1087                 wiphy_err(hw->wiphy, "failed to alloc RX skbuff list\n");
1088                 pci_free_consistent(priv->pdev, size, rxq->rxd, rxq->rxd_dma);
1089                 return -ENOMEM;
1090         }
1091
1092         for (i = 0; i < MWL8K_RX_DESCS; i++) {
1093                 int desc_size;
1094                 void *rxd;
1095                 int nexti;
1096                 dma_addr_t next_dma_addr;
1097
1098                 desc_size = priv->rxd_ops->rxd_size;
1099                 rxd = rxq->rxd + (i * priv->rxd_ops->rxd_size);
1100
1101                 nexti = i + 1;
1102                 if (nexti == MWL8K_RX_DESCS)
1103                         nexti = 0;
1104                 next_dma_addr = rxq->rxd_dma + (nexti * desc_size);
1105
1106                 priv->rxd_ops->rxd_init(rxd, next_dma_addr);
1107         }
1108
1109         return 0;
1110 }
1111
1112 static int rxq_refill(struct ieee80211_hw *hw, int index, int limit)
1113 {
1114         struct mwl8k_priv *priv = hw->priv;
1115         struct mwl8k_rx_queue *rxq = priv->rxq + index;
1116         int refilled;
1117
1118         refilled = 0;
1119         while (rxq->rxd_count < MWL8K_RX_DESCS && limit--) {
1120                 struct sk_buff *skb;
1121                 dma_addr_t addr;
1122                 int rx;
1123                 void *rxd;
1124
1125                 skb = dev_alloc_skb(MWL8K_RX_MAXSZ);
1126                 if (skb == NULL)
1127                         break;
1128
1129                 addr = pci_map_single(priv->pdev, skb->data,
1130                                       MWL8K_RX_MAXSZ, DMA_FROM_DEVICE);
1131
1132                 rxq->rxd_count++;
1133                 rx = rxq->tail++;
1134                 if (rxq->tail == MWL8K_RX_DESCS)
1135                         rxq->tail = 0;
1136                 rxq->buf[rx].skb = skb;
1137                 dma_unmap_addr_set(&rxq->buf[rx], dma, addr);
1138
1139                 rxd = rxq->rxd + (rx * priv->rxd_ops->rxd_size);
1140                 priv->rxd_ops->rxd_refill(rxd, addr, MWL8K_RX_MAXSZ);
1141
1142                 refilled++;
1143         }
1144
1145         return refilled;
1146 }
1147
1148 /* Must be called only when the card's reception is completely halted */
1149 static void mwl8k_rxq_deinit(struct ieee80211_hw *hw, int index)
1150 {
1151         struct mwl8k_priv *priv = hw->priv;
1152         struct mwl8k_rx_queue *rxq = priv->rxq + index;
1153         int i;
1154
1155         if (rxq->rxd == NULL)
1156                 return;
1157
1158         for (i = 0; i < MWL8K_RX_DESCS; i++) {
1159                 if (rxq->buf[i].skb != NULL) {
1160                         pci_unmap_single(priv->pdev,
1161                                          dma_unmap_addr(&rxq->buf[i], dma),
1162                                          MWL8K_RX_MAXSZ, PCI_DMA_FROMDEVICE);
1163                         dma_unmap_addr_set(&rxq->buf[i], dma, 0);
1164
1165                         kfree_skb(rxq->buf[i].skb);
1166                         rxq->buf[i].skb = NULL;
1167                 }
1168         }
1169
1170         kfree(rxq->buf);
1171         rxq->buf = NULL;
1172
1173         pci_free_consistent(priv->pdev,
1174                             MWL8K_RX_DESCS * priv->rxd_ops->rxd_size,
1175                             rxq->rxd, rxq->rxd_dma);
1176         rxq->rxd = NULL;
1177 }
1178
1179
1180 /*
1181  * Scan a list of BSSIDs to process for finalize join.
1182  * Allows for extension to process multiple BSSIDs.
1183  */
1184 static inline int
1185 mwl8k_capture_bssid(struct mwl8k_priv *priv, struct ieee80211_hdr *wh)
1186 {
1187         return priv->capture_beacon &&
1188                 ieee80211_is_beacon(wh->frame_control) &&
1189                 !compare_ether_addr(wh->addr3, priv->capture_bssid);
1190 }
1191
1192 static inline void mwl8k_save_beacon(struct ieee80211_hw *hw,
1193                                      struct sk_buff *skb)
1194 {
1195         struct mwl8k_priv *priv = hw->priv;
1196
1197         priv->capture_beacon = false;
1198         memset(priv->capture_bssid, 0, ETH_ALEN);
1199
1200         /*
1201          * Use GFP_ATOMIC as rxq_process is called from
1202          * the primary interrupt handler, memory allocation call
1203          * must not sleep.
1204          */
1205         priv->beacon_skb = skb_copy(skb, GFP_ATOMIC);
1206         if (priv->beacon_skb != NULL)
1207                 ieee80211_queue_work(hw, &priv->finalize_join_worker);
1208 }
1209
1210 static inline struct mwl8k_vif *mwl8k_find_vif_bss(struct list_head *vif_list,
1211                                                    u8 *bssid)
1212 {
1213         struct mwl8k_vif *mwl8k_vif;
1214
1215         list_for_each_entry(mwl8k_vif,
1216                             vif_list, list) {
1217                 if (memcmp(bssid, mwl8k_vif->bssid,
1218                            ETH_ALEN) == 0)
1219                         return mwl8k_vif;
1220         }
1221
1222         return NULL;
1223 }
1224
1225 static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
1226 {
1227         struct mwl8k_priv *priv = hw->priv;
1228         struct mwl8k_vif *mwl8k_vif = NULL;
1229         struct mwl8k_rx_queue *rxq = priv->rxq + index;
1230         int processed;
1231
1232         processed = 0;
1233         while (rxq->rxd_count && limit--) {
1234                 struct sk_buff *skb;
1235                 void *rxd;
1236                 int pkt_len;
1237                 struct ieee80211_rx_status status;
1238                 struct ieee80211_hdr *wh;
1239                 __le16 qos;
1240
1241                 skb = rxq->buf[rxq->head].skb;
1242                 if (skb == NULL)
1243                         break;
1244
1245                 rxd = rxq->rxd + (rxq->head * priv->rxd_ops->rxd_size);
1246
1247                 pkt_len = priv->rxd_ops->rxd_process(rxd, &status, &qos,
1248                                                         &priv->noise);
1249                 if (pkt_len < 0)
1250                         break;
1251
1252                 rxq->buf[rxq->head].skb = NULL;
1253
1254                 pci_unmap_single(priv->pdev,
1255                                  dma_unmap_addr(&rxq->buf[rxq->head], dma),
1256                                  MWL8K_RX_MAXSZ, PCI_DMA_FROMDEVICE);
1257                 dma_unmap_addr_set(&rxq->buf[rxq->head], dma, 0);
1258
1259                 rxq->head++;
1260                 if (rxq->head == MWL8K_RX_DESCS)
1261                         rxq->head = 0;
1262
1263                 rxq->rxd_count--;
1264
1265                 wh = &((struct mwl8k_dma_data *)skb->data)->wh;
1266
1267                 /*
1268                  * Check for a pending join operation.  Save a
1269                  * copy of the beacon and schedule a tasklet to
1270                  * send a FINALIZE_JOIN command to the firmware.
1271                  */
1272                 if (mwl8k_capture_bssid(priv, (void *)skb->data))
1273                         mwl8k_save_beacon(hw, skb);
1274
1275                 if (ieee80211_has_protected(wh->frame_control)) {
1276
1277                         /* Check if hw crypto has been enabled for
1278                          * this bss. If yes, set the status flags
1279                          * accordingly
1280                          */
1281                         mwl8k_vif = mwl8k_find_vif_bss(&priv->vif_list,
1282                                                                 wh->addr1);
1283
1284                         if (mwl8k_vif != NULL &&
1285                             mwl8k_vif->is_hw_crypto_enabled == true) {
1286                                 /*
1287                                  * When MMIC ERROR is encountered
1288                                  * by the firmware, payload is
1289                                  * dropped and only 32 bytes of
1290                                  * mwl8k Firmware header is sent
1291                                  * to the host.
1292                                  *
1293                                  * We need to add four bytes of
1294                                  * key information.  In it
1295                                  * MAC80211 expects keyidx set to
1296                                  * 0 for triggering Counter
1297                                  * Measure of MMIC failure.
1298                                  */
1299                                 if (status.flag & RX_FLAG_MMIC_ERROR) {
1300                                         struct mwl8k_dma_data *tr;
1301                                         tr = (struct mwl8k_dma_data *)skb->data;
1302                                         memset((void *)&(tr->data), 0, 4);
1303                                         pkt_len += 4;
1304                                 }
1305
1306                                 if (!ieee80211_is_auth(wh->frame_control))
1307                                         status.flag |= RX_FLAG_IV_STRIPPED |
1308                                                        RX_FLAG_DECRYPTED |
1309                                                        RX_FLAG_MMIC_STRIPPED;
1310                         }
1311                 }
1312
1313                 skb_put(skb, pkt_len);
1314                 mwl8k_remove_dma_header(skb, qos);
1315                 memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
1316                 ieee80211_rx_irqsafe(hw, skb);
1317
1318                 processed++;
1319         }
1320
1321         return processed;
1322 }
1323
1324
1325 /*
1326  * Packet transmission.
1327  */
1328
1329 #define MWL8K_TXD_STATUS_OK                     0x00000001
1330 #define MWL8K_TXD_STATUS_OK_RETRY               0x00000002
1331 #define MWL8K_TXD_STATUS_OK_MORE_RETRY          0x00000004
1332 #define MWL8K_TXD_STATUS_MULTICAST_TX           0x00000008
1333 #define MWL8K_TXD_STATUS_FW_OWNED               0x80000000
1334
1335 #define MWL8K_QOS_QLEN_UNSPEC                   0xff00
1336 #define MWL8K_QOS_ACK_POLICY_MASK               0x0060
1337 #define MWL8K_QOS_ACK_POLICY_NORMAL             0x0000
1338 #define MWL8K_QOS_ACK_POLICY_BLOCKACK           0x0060
1339 #define MWL8K_QOS_EOSP                          0x0010
1340
1341 struct mwl8k_tx_desc {
1342         __le32 status;
1343         __u8 data_rate;
1344         __u8 tx_priority;
1345         __le16 qos_control;
1346         __le32 pkt_phys_addr;
1347         __le16 pkt_len;
1348         __u8 dest_MAC_addr[ETH_ALEN];
1349         __le32 next_txd_phys_addr;
1350         __le32 timestamp;
1351         __le16 rate_info;
1352         __u8 peer_id;
1353         __u8 tx_frag_cnt;
1354 } __packed;
1355
1356 #define MWL8K_TX_DESCS          128
1357
1358 static int mwl8k_txq_init(struct ieee80211_hw *hw, int index)
1359 {
1360         struct mwl8k_priv *priv = hw->priv;
1361         struct mwl8k_tx_queue *txq = priv->txq + index;
1362         int size;
1363         int i;
1364
1365         txq->len = 0;
1366         txq->head = 0;
1367         txq->tail = 0;
1368
1369         size = MWL8K_TX_DESCS * sizeof(struct mwl8k_tx_desc);
1370
1371         txq->txd = pci_alloc_consistent(priv->pdev, size, &txq->txd_dma);
1372         if (txq->txd == NULL) {
1373                 wiphy_err(hw->wiphy, "failed to alloc TX descriptors\n");
1374                 return -ENOMEM;
1375         }
1376         memset(txq->txd, 0, size);
1377
1378         txq->skb = kcalloc(MWL8K_TX_DESCS, sizeof(*txq->skb), GFP_KERNEL);
1379         if (txq->skb == NULL) {
1380                 wiphy_err(hw->wiphy, "failed to alloc TX skbuff list\n");
1381                 pci_free_consistent(priv->pdev, size, txq->txd, txq->txd_dma);
1382                 return -ENOMEM;
1383         }
1384
1385         for (i = 0; i < MWL8K_TX_DESCS; i++) {
1386                 struct mwl8k_tx_desc *tx_desc;
1387                 int nexti;
1388
1389                 tx_desc = txq->txd + i;
1390                 nexti = (i + 1) % MWL8K_TX_DESCS;
1391
1392                 tx_desc->status = 0;
1393                 tx_desc->next_txd_phys_addr =
1394                         cpu_to_le32(txq->txd_dma + nexti * sizeof(*tx_desc));
1395         }
1396
1397         return 0;
1398 }
1399
1400 static inline void mwl8k_tx_start(struct mwl8k_priv *priv)
1401 {
1402         iowrite32(MWL8K_H2A_INT_PPA_READY,
1403                 priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
1404         iowrite32(MWL8K_H2A_INT_DUMMY,
1405                 priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
1406         ioread32(priv->regs + MWL8K_HIU_INT_CODE);
1407 }
1408
1409 static void mwl8k_dump_tx_rings(struct ieee80211_hw *hw)
1410 {
1411         struct mwl8k_priv *priv = hw->priv;
1412         int i;
1413
1414         for (i = 0; i < mwl8k_tx_queues(priv); i++) {
1415                 struct mwl8k_tx_queue *txq = priv->txq + i;
1416                 int fw_owned = 0;
1417                 int drv_owned = 0;
1418                 int unused = 0;
1419                 int desc;
1420
1421                 for (desc = 0; desc < MWL8K_TX_DESCS; desc++) {
1422                         struct mwl8k_tx_desc *tx_desc = txq->txd + desc;
1423                         u32 status;
1424
1425                         status = le32_to_cpu(tx_desc->status);
1426                         if (status & MWL8K_TXD_STATUS_FW_OWNED)
1427                                 fw_owned++;
1428                         else
1429                                 drv_owned++;
1430
1431                         if (tx_desc->pkt_len == 0)
1432                                 unused++;
1433                 }
1434
1435                 wiphy_err(hw->wiphy,
1436                           "txq[%d] len=%d head=%d tail=%d "
1437                           "fw_owned=%d drv_owned=%d unused=%d\n",
1438                           i,
1439                           txq->len, txq->head, txq->tail,
1440                           fw_owned, drv_owned, unused);
1441         }
1442 }
1443
1444 /*
1445  * Must be called with priv->fw_mutex held and tx queues stopped.
1446  */
1447 #define MWL8K_TX_WAIT_TIMEOUT_MS        5000
1448
1449 static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
1450 {
1451         struct mwl8k_priv *priv = hw->priv;
1452         DECLARE_COMPLETION_ONSTACK(tx_wait);
1453         int retry;
1454         int rc;
1455
1456         might_sleep();
1457
1458         /*
1459          * The TX queues are stopped at this point, so this test
1460          * doesn't need to take ->tx_lock.
1461          */
1462         if (!priv->pending_tx_pkts)
1463                 return 0;
1464
1465         retry = 0;
1466         rc = 0;
1467
1468         spin_lock_bh(&priv->tx_lock);
1469         priv->tx_wait = &tx_wait;
1470         while (!rc) {
1471                 int oldcount;
1472                 unsigned long timeout;
1473
1474                 oldcount = priv->pending_tx_pkts;
1475
1476                 spin_unlock_bh(&priv->tx_lock);
1477                 timeout = wait_for_completion_timeout(&tx_wait,
1478                             msecs_to_jiffies(MWL8K_TX_WAIT_TIMEOUT_MS));
1479                 spin_lock_bh(&priv->tx_lock);
1480
1481                 if (timeout) {
1482                         WARN_ON(priv->pending_tx_pkts);
1483                         if (retry) {
1484                                 wiphy_notice(hw->wiphy, "tx rings drained\n");
1485                         }
1486                         break;
1487                 }
1488
1489                 if (priv->pending_tx_pkts < oldcount) {
1490                         wiphy_notice(hw->wiphy,
1491                                      "waiting for tx rings to drain (%d -> %d pkts)\n",
1492                                      oldcount, priv->pending_tx_pkts);
1493                         retry = 1;
1494                         continue;
1495                 }
1496
1497                 priv->tx_wait = NULL;
1498
1499                 wiphy_err(hw->wiphy, "tx rings stuck for %d ms\n",
1500                           MWL8K_TX_WAIT_TIMEOUT_MS);
1501                 mwl8k_dump_tx_rings(hw);
1502
1503                 rc = -ETIMEDOUT;
1504         }
1505         spin_unlock_bh(&priv->tx_lock);
1506
1507         return rc;
1508 }
1509
1510 #define MWL8K_TXD_SUCCESS(status)                               \
1511         ((status) & (MWL8K_TXD_STATUS_OK |                      \
1512                      MWL8K_TXD_STATUS_OK_RETRY |                \
1513                      MWL8K_TXD_STATUS_OK_MORE_RETRY))
1514
1515 static int
1516 mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
1517 {
1518         struct mwl8k_priv *priv = hw->priv;
1519         struct mwl8k_tx_queue *txq = priv->txq + index;
1520         int processed;
1521
1522         processed = 0;
1523         while (txq->len > 0 && limit--) {
1524                 int tx;
1525                 struct mwl8k_tx_desc *tx_desc;
1526                 unsigned long addr;
1527                 int size;
1528                 struct sk_buff *skb;
1529                 struct ieee80211_tx_info *info;
1530                 u32 status;
1531
1532                 tx = txq->head;
1533                 tx_desc = txq->txd + tx;
1534
1535                 status = le32_to_cpu(tx_desc->status);
1536
1537                 if (status & MWL8K_TXD_STATUS_FW_OWNED) {
1538                         if (!force)
1539                                 break;
1540                         tx_desc->status &=
1541                                 ~cpu_to_le32(MWL8K_TXD_STATUS_FW_OWNED);
1542                 }
1543
1544                 txq->head = (tx + 1) % MWL8K_TX_DESCS;
1545                 BUG_ON(txq->len == 0);
1546                 txq->len--;
1547                 priv->pending_tx_pkts--;
1548
1549                 addr = le32_to_cpu(tx_desc->pkt_phys_addr);
1550                 size = le16_to_cpu(tx_desc->pkt_len);
1551                 skb = txq->skb[tx];
1552                 txq->skb[tx] = NULL;
1553
1554                 BUG_ON(skb == NULL);
1555                 pci_unmap_single(priv->pdev, addr, size, PCI_DMA_TODEVICE);
1556
1557                 mwl8k_remove_dma_header(skb, tx_desc->qos_control);
1558
1559                 /* Mark descriptor as unused */
1560                 tx_desc->pkt_phys_addr = 0;
1561                 tx_desc->pkt_len = 0;
1562
1563                 info = IEEE80211_SKB_CB(skb);
1564                 ieee80211_tx_info_clear_status(info);
1565
1566                 /* Rate control is happening in the firmware.
1567                  * Ensure no tx rate is being reported.
1568                  */
1569                 info->status.rates[0].idx = -1;
1570                 info->status.rates[0].count = 1;
1571
1572                 if (MWL8K_TXD_SUCCESS(status))
1573                         info->flags |= IEEE80211_TX_STAT_ACK;
1574
1575                 ieee80211_tx_status_irqsafe(hw, skb);
1576
1577                 processed++;
1578         }
1579
1580         if (index < MWL8K_TX_WMM_QUEUES && processed && priv->radio_on &&
1581             !mutex_is_locked(&priv->fw_mutex))
1582                 ieee80211_wake_queue(hw, index);
1583
1584         return processed;
1585 }
1586
1587 /* must be called only when the card's transmit is completely halted */
1588 static void mwl8k_txq_deinit(struct ieee80211_hw *hw, int index)
1589 {
1590         struct mwl8k_priv *priv = hw->priv;
1591         struct mwl8k_tx_queue *txq = priv->txq + index;
1592
1593         if (txq->txd == NULL)
1594                 return;
1595
1596         mwl8k_txq_reclaim(hw, index, INT_MAX, 1);
1597
1598         kfree(txq->skb);
1599         txq->skb = NULL;
1600
1601         pci_free_consistent(priv->pdev,
1602                             MWL8K_TX_DESCS * sizeof(struct mwl8k_tx_desc),
1603                             txq->txd, txq->txd_dma);
1604         txq->txd = NULL;
1605 }
1606
1607 /* caller must hold priv->stream_lock when calling the stream functions */
1608 struct mwl8k_ampdu_stream *
1609 mwl8k_add_stream(struct ieee80211_hw *hw, struct ieee80211_sta *sta, u8 tid)
1610 {
1611         struct mwl8k_ampdu_stream *stream;
1612         struct mwl8k_priv *priv = hw->priv;
1613         int i;
1614
1615         for (i = 0; i < priv->num_ampdu_queues; i++) {
1616                 stream = &priv->ampdu[i];
1617                 if (stream->state == AMPDU_NO_STREAM) {
1618                         stream->sta = sta;
1619                         stream->state = AMPDU_STREAM_NEW;
1620                         stream->tid = tid;
1621                         stream->idx = i;
1622                         stream->txq_idx = MWL8K_TX_WMM_QUEUES + i;
1623                         wiphy_debug(hw->wiphy, "Added a new stream for %pM %d",
1624                                     sta->addr, tid);
1625                         return stream;
1626                 }
1627         }
1628         return NULL;
1629 }
1630
1631 static int
1632 mwl8k_start_stream(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream)
1633 {
1634         int ret;
1635
1636         /* if the stream has already been started, don't start it again */
1637         if (stream->state != AMPDU_STREAM_NEW)
1638                 return 0;
1639         ret = ieee80211_start_tx_ba_session(stream->sta, stream->tid, 0);
1640         if (ret)
1641                 wiphy_debug(hw->wiphy, "Failed to start stream for %pM %d: "
1642                             "%d\n", stream->sta->addr, stream->tid, ret);
1643         else
1644                 wiphy_debug(hw->wiphy, "Started stream for %pM %d\n",
1645                             stream->sta->addr, stream->tid);
1646         return ret;
1647 }
1648
1649 static void
1650 mwl8k_remove_stream(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream)
1651 {
1652         wiphy_debug(hw->wiphy, "Remove stream for %pM %d\n", stream->sta->addr,
1653                     stream->tid);
1654         memset(stream, 0, sizeof(*stream));
1655 }
1656
1657 static struct mwl8k_ampdu_stream *
1658 mwl8k_lookup_stream(struct ieee80211_hw *hw, u8 *addr, u8 tid)
1659 {
1660         struct mwl8k_priv *priv = hw->priv;
1661         int i;
1662
1663         for (i = 0 ; i < priv->num_ampdu_queues; i++) {
1664                 struct mwl8k_ampdu_stream *stream;
1665                 stream = &priv->ampdu[i];
1666                 if (stream->state == AMPDU_NO_STREAM)
1667                         continue;
1668                 if (!memcmp(stream->sta->addr, addr, ETH_ALEN) &&
1669                     stream->tid == tid)
1670                         return stream;
1671         }
1672         return NULL;
1673 }
1674
1675 static void
1676 mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
1677 {
1678         struct mwl8k_priv *priv = hw->priv;
1679         struct ieee80211_tx_info *tx_info;
1680         struct mwl8k_vif *mwl8k_vif;
1681         struct ieee80211_sta *sta;
1682         struct ieee80211_hdr *wh;
1683         struct mwl8k_tx_queue *txq;
1684         struct mwl8k_tx_desc *tx;
1685         dma_addr_t dma;
1686         u32 txstatus;
1687         u8 txdatarate;
1688         u16 qos;
1689         int txpriority;
1690         u8 tid = 0;
1691         struct mwl8k_ampdu_stream *stream = NULL;
1692         bool start_ba_session = false;
1693
1694         wh = (struct ieee80211_hdr *)skb->data;
1695         if (ieee80211_is_data_qos(wh->frame_control))
1696                 qos = le16_to_cpu(*((__le16 *)ieee80211_get_qos_ctl(wh)));
1697         else
1698                 qos = 0;
1699
1700         if (priv->ap_fw)
1701                 mwl8k_encapsulate_tx_frame(skb);
1702         else
1703                 mwl8k_add_dma_header(skb, 0);
1704
1705         wh = &((struct mwl8k_dma_data *)skb->data)->wh;
1706
1707         tx_info = IEEE80211_SKB_CB(skb);
1708         sta = tx_info->control.sta;
1709         mwl8k_vif = MWL8K_VIF(tx_info->control.vif);
1710
1711         if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
1712                 wh->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
1713                 wh->seq_ctrl |= cpu_to_le16(mwl8k_vif->seqno);
1714                 mwl8k_vif->seqno += 0x10;
1715         }
1716
1717         /* Setup firmware control bit fields for each frame type.  */
1718         txstatus = 0;
1719         txdatarate = 0;
1720         if (ieee80211_is_mgmt(wh->frame_control) ||
1721             ieee80211_is_ctl(wh->frame_control)) {
1722                 txdatarate = 0;
1723                 qos |= MWL8K_QOS_QLEN_UNSPEC | MWL8K_QOS_EOSP;
1724         } else if (ieee80211_is_data(wh->frame_control)) {
1725                 txdatarate = 1;
1726                 if (is_multicast_ether_addr(wh->addr1))
1727                         txstatus |= MWL8K_TXD_STATUS_MULTICAST_TX;
1728
1729                 qos &= ~MWL8K_QOS_ACK_POLICY_MASK;
1730                 if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
1731                         qos |= MWL8K_QOS_ACK_POLICY_BLOCKACK;
1732                 else
1733                         qos |= MWL8K_QOS_ACK_POLICY_NORMAL;
1734         }
1735
1736         txpriority = index;
1737
1738         if (ieee80211_is_data_qos(wh->frame_control) &&
1739             skb->protocol != cpu_to_be16(ETH_P_PAE) &&
1740             sta->ht_cap.ht_supported && priv->ap_fw) {
1741                 tid = qos & 0xf;
1742                 spin_lock(&priv->stream_lock);
1743                 stream = mwl8k_lookup_stream(hw, sta->addr, tid);
1744                 if (stream != NULL) {
1745                         if (stream->state == AMPDU_STREAM_ACTIVE) {
1746                                 txpriority = stream->txq_idx;
1747                                 index = stream->txq_idx;
1748                         } else if (stream->state == AMPDU_STREAM_NEW) {
1749                                 /* We get here if the driver sends us packets
1750                                  * after we've initiated a stream, but before
1751                                  * our ampdu_action routine has been called
1752                                  * with IEEE80211_AMPDU_TX_START to get the SSN
1753                                  * for the ADDBA request.  So this packet can
1754                                  * go out with no risk of sequence number
1755                                  * mismatch.  No special handling is required.
1756                                  */
1757                         } else {
1758                                 /* Drop packets that would go out after the
1759                                  * ADDBA request was sent but before the ADDBA
1760                                  * response is received.  If we don't do this,
1761                                  * the recipient would probably receive it
1762                                  * after the ADDBA request with SSN 0.  This
1763                                  * will cause the recipient's BA receive window
1764                                  * to shift, which would cause the subsequent
1765                                  * packets in the BA stream to be discarded.
1766                                  * mac80211 queues our packets for us in this
1767                                  * case, so this is really just a safety check.
1768                                  */
1769                                 wiphy_warn(hw->wiphy,
1770                                            "Cannot send packet while ADDBA "
1771                                            "dialog is underway.\n");
1772                                 spin_unlock(&priv->stream_lock);
1773                                 dev_kfree_skb(skb);
1774                                 return;
1775                         }
1776                 } else {
1777                         /* Defer calling mwl8k_start_stream so that the current
1778                          * skb can go out before the ADDBA request.  This
1779                          * prevents sequence number mismatch at the recepient
1780                          * as described above.
1781                          */
1782                         stream = mwl8k_add_stream(hw, sta, tid);
1783                         if (stream != NULL)
1784                                 start_ba_session = true;
1785                 }
1786                 spin_unlock(&priv->stream_lock);
1787         }
1788
1789         dma = pci_map_single(priv->pdev, skb->data,
1790                                 skb->len, PCI_DMA_TODEVICE);
1791
1792         if (pci_dma_mapping_error(priv->pdev, dma)) {
1793                 wiphy_debug(hw->wiphy,
1794                             "failed to dma map skb, dropping TX frame.\n");
1795                 if (start_ba_session) {
1796                         spin_lock(&priv->stream_lock);
1797                         mwl8k_remove_stream(hw, stream);
1798                         spin_unlock(&priv->stream_lock);
1799                 }
1800                 dev_kfree_skb(skb);
1801                 return;
1802         }
1803
1804         spin_lock_bh(&priv->tx_lock);
1805
1806         txq = priv->txq + index;
1807
1808         if (index >= MWL8K_TX_WMM_QUEUES && txq->len >= MWL8K_TX_DESCS) {
1809                 /* This is the case in which the tx packet is destined for an
1810                  * AMPDU queue and that AMPDU queue is full.  Because we don't
1811                  * start and stop the AMPDU queues, we must drop these packets.
1812                  */
1813                 dev_kfree_skb(skb);
1814                 spin_unlock_bh(&priv->tx_lock);
1815                 return;
1816         }
1817
1818         BUG_ON(txq->skb[txq->tail] != NULL);
1819         txq->skb[txq->tail] = skb;
1820
1821         tx = txq->txd + txq->tail;
1822         tx->data_rate = txdatarate;
1823         tx->tx_priority = txpriority;
1824         tx->qos_control = cpu_to_le16(qos);
1825         tx->pkt_phys_addr = cpu_to_le32(dma);
1826         tx->pkt_len = cpu_to_le16(skb->len);
1827         tx->rate_info = 0;
1828         if (!priv->ap_fw && tx_info->control.sta != NULL)
1829                 tx->peer_id = MWL8K_STA(tx_info->control.sta)->peer_id;
1830         else
1831                 tx->peer_id = 0;
1832         wmb();
1833         tx->status = cpu_to_le32(MWL8K_TXD_STATUS_FW_OWNED | txstatus);
1834
1835         txq->len++;
1836         priv->pending_tx_pkts++;
1837
1838         txq->tail++;
1839         if (txq->tail == MWL8K_TX_DESCS)
1840                 txq->tail = 0;
1841
1842         if (txq->head == txq->tail && index < MWL8K_TX_WMM_QUEUES)
1843                 ieee80211_stop_queue(hw, index);
1844
1845         mwl8k_tx_start(priv);
1846
1847         spin_unlock_bh(&priv->tx_lock);
1848
1849         /* Initiate the ampdu session here */
1850         if (start_ba_session) {
1851                 spin_lock(&priv->stream_lock);
1852                 if (mwl8k_start_stream(hw, stream))
1853                         mwl8k_remove_stream(hw, stream);
1854                 spin_unlock(&priv->stream_lock);
1855         }
1856 }
1857
1858
1859 /*
1860  * Firmware access.
1861  *
1862  * We have the following requirements for issuing firmware commands:
1863  * - Some commands require that the packet transmit path is idle when
1864  *   the command is issued.  (For simplicity, we'll just quiesce the
1865  *   transmit path for every command.)
1866  * - There are certain sequences of commands that need to be issued to
1867  *   the hardware sequentially, with no other intervening commands.
1868  *
1869  * This leads to an implementation of a "firmware lock" as a mutex that
1870  * can be taken recursively, and which is taken by both the low-level
1871  * command submission function (mwl8k_post_cmd) as well as any users of
1872  * that function that require issuing of an atomic sequence of commands,
1873  * and quiesces the transmit path whenever it's taken.
1874  */
1875 static int mwl8k_fw_lock(struct ieee80211_hw *hw)
1876 {
1877         struct mwl8k_priv *priv = hw->priv;
1878
1879         if (priv->fw_mutex_owner != current) {
1880                 int rc;
1881
1882                 mutex_lock(&priv->fw_mutex);
1883                 ieee80211_stop_queues(hw);
1884
1885                 rc = mwl8k_tx_wait_empty(hw);
1886                 if (rc) {
1887                         ieee80211_wake_queues(hw);
1888                         mutex_unlock(&priv->fw_mutex);
1889
1890                         return rc;
1891                 }
1892
1893                 priv->fw_mutex_owner = current;
1894         }
1895
1896         priv->fw_mutex_depth++;
1897
1898         return 0;
1899 }
1900
1901 static void mwl8k_fw_unlock(struct ieee80211_hw *hw)
1902 {
1903         struct mwl8k_priv *priv = hw->priv;
1904
1905         if (!--priv->fw_mutex_depth) {
1906                 ieee80211_wake_queues(hw);
1907                 priv->fw_mutex_owner = NULL;
1908                 mutex_unlock(&priv->fw_mutex);
1909         }
1910 }
1911
1912
1913 /*
1914  * Command processing.
1915  */
1916
1917 /* Timeout firmware commands after 10s */
1918 #define MWL8K_CMD_TIMEOUT_MS    10000
1919
1920 static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
1921 {
1922         DECLARE_COMPLETION_ONSTACK(cmd_wait);
1923         struct mwl8k_priv *priv = hw->priv;
1924         void __iomem *regs = priv->regs;
1925         dma_addr_t dma_addr;
1926         unsigned int dma_size;
1927         int rc;
1928         unsigned long timeout = 0;
1929         u8 buf[32];
1930
1931         cmd->result = (__force __le16) 0xffff;
1932         dma_size = le16_to_cpu(cmd->length);
1933         dma_addr = pci_map_single(priv->pdev, cmd, dma_size,
1934                                   PCI_DMA_BIDIRECTIONAL);
1935         if (pci_dma_mapping_error(priv->pdev, dma_addr))
1936                 return -ENOMEM;
1937
1938         rc = mwl8k_fw_lock(hw);
1939         if (rc) {
1940                 pci_unmap_single(priv->pdev, dma_addr, dma_size,
1941                                                 PCI_DMA_BIDIRECTIONAL);
1942                 return rc;
1943         }
1944
1945         priv->hostcmd_wait = &cmd_wait;
1946         iowrite32(dma_addr, regs + MWL8K_HIU_GEN_PTR);
1947         iowrite32(MWL8K_H2A_INT_DOORBELL,
1948                 regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
1949         iowrite32(MWL8K_H2A_INT_DUMMY,
1950                 regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
1951
1952         timeout = wait_for_completion_timeout(&cmd_wait,
1953                                 msecs_to_jiffies(MWL8K_CMD_TIMEOUT_MS));
1954
1955         priv->hostcmd_wait = NULL;
1956
1957         mwl8k_fw_unlock(hw);
1958
1959         pci_unmap_single(priv->pdev, dma_addr, dma_size,
1960                                         PCI_DMA_BIDIRECTIONAL);
1961
1962         if (!timeout) {
1963                 wiphy_err(hw->wiphy, "Command %s timeout after %u ms\n",
1964                           mwl8k_cmd_name(cmd->code, buf, sizeof(buf)),
1965                           MWL8K_CMD_TIMEOUT_MS);
1966                 rc = -ETIMEDOUT;
1967         } else {
1968                 int ms;
1969
1970                 ms = MWL8K_CMD_TIMEOUT_MS - jiffies_to_msecs(timeout);
1971
1972                 rc = cmd->result ? -EINVAL : 0;
1973                 if (rc)
1974                         wiphy_err(hw->wiphy, "Command %s error 0x%x\n",
1975                                   mwl8k_cmd_name(cmd->code, buf, sizeof(buf)),
1976                                   le16_to_cpu(cmd->result));
1977                 else if (ms > 2000)
1978                         wiphy_notice(hw->wiphy, "Command %s took %d ms\n",
1979                                      mwl8k_cmd_name(cmd->code,
1980                                                     buf, sizeof(buf)),
1981                                      ms);
1982         }
1983
1984         return rc;
1985 }
1986
1987 static int mwl8k_post_pervif_cmd(struct ieee80211_hw *hw,
1988                                  struct ieee80211_vif *vif,
1989                                  struct mwl8k_cmd_pkt *cmd)
1990 {
1991         if (vif != NULL)
1992                 cmd->macid = MWL8K_VIF(vif)->macid;
1993         return mwl8k_post_cmd(hw, cmd);
1994 }
1995
1996 /*
1997  * Setup code shared between STA and AP firmware images.
1998  */
1999 static void mwl8k_setup_2ghz_band(struct ieee80211_hw *hw)
2000 {
2001         struct mwl8k_priv *priv = hw->priv;
2002
2003         BUILD_BUG_ON(sizeof(priv->channels_24) != sizeof(mwl8k_channels_24));
2004         memcpy(priv->channels_24, mwl8k_channels_24, sizeof(mwl8k_channels_24));
2005
2006         BUILD_BUG_ON(sizeof(priv->rates_24) != sizeof(mwl8k_rates_24));
2007         memcpy(priv->rates_24, mwl8k_rates_24, sizeof(mwl8k_rates_24));
2008
2009         priv->band_24.band = IEEE80211_BAND_2GHZ;
2010         priv->band_24.channels = priv->channels_24;
2011         priv->band_24.n_channels = ARRAY_SIZE(mwl8k_channels_24);
2012         priv->band_24.bitrates = priv->rates_24;
2013         priv->band_24.n_bitrates = ARRAY_SIZE(mwl8k_rates_24);
2014
2015         hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band_24;
2016 }
2017
2018 static void mwl8k_setup_5ghz_band(struct ieee80211_hw *hw)
2019 {
2020         struct mwl8k_priv *priv = hw->priv;
2021
2022         BUILD_BUG_ON(sizeof(priv->channels_50) != sizeof(mwl8k_channels_50));
2023         memcpy(priv->channels_50, mwl8k_channels_50, sizeof(mwl8k_channels_50));
2024
2025         BUILD_BUG_ON(sizeof(priv->rates_50) != sizeof(mwl8k_rates_50));
2026         memcpy(priv->rates_50, mwl8k_rates_50, sizeof(mwl8k_rates_50));
2027
2028         priv->band_50.band = IEEE80211_BAND_5GHZ;
2029         priv->band_50.channels = priv->channels_50;
2030         priv->band_50.n_channels = ARRAY_SIZE(mwl8k_channels_50);
2031         priv->band_50.bitrates = priv->rates_50;
2032         priv->band_50.n_bitrates = ARRAY_SIZE(mwl8k_rates_50);
2033
2034         hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &priv->band_50;
2035 }
2036
2037 /*
2038  * CMD_GET_HW_SPEC (STA version).
2039  */
2040 struct mwl8k_cmd_get_hw_spec_sta {
2041         struct mwl8k_cmd_pkt header;
2042         __u8 hw_rev;
2043         __u8 host_interface;
2044         __le16 num_mcaddrs;
2045         __u8 perm_addr[ETH_ALEN];
2046         __le16 region_code;
2047         __le32 fw_rev;
2048         __le32 ps_cookie;
2049         __le32 caps;
2050         __u8 mcs_bitmap[16];
2051         __le32 rx_queue_ptr;
2052         __le32 num_tx_queues;
2053         __le32 tx_queue_ptrs[MWL8K_TX_WMM_QUEUES];
2054         __le32 caps2;
2055         __le32 num_tx_desc_per_queue;
2056         __le32 total_rxd;
2057 } __packed;
2058
2059 #define MWL8K_CAP_MAX_AMSDU             0x20000000
2060 #define MWL8K_CAP_GREENFIELD            0x08000000
2061 #define MWL8K_CAP_AMPDU                 0x04000000
2062 #define MWL8K_CAP_RX_STBC               0x01000000
2063 #define MWL8K_CAP_TX_STBC               0x00800000
2064 #define MWL8K_CAP_SHORTGI_40MHZ         0x00400000
2065 #define MWL8K_CAP_SHORTGI_20MHZ         0x00200000
2066 #define MWL8K_CAP_RX_ANTENNA_MASK       0x000e0000
2067 #define MWL8K_CAP_TX_ANTENNA_MASK       0x0001c000
2068 #define MWL8K_CAP_DELAY_BA              0x00003000
2069 #define MWL8K_CAP_MIMO                  0x00000200
2070 #define MWL8K_CAP_40MHZ                 0x00000100
2071 #define MWL8K_CAP_BAND_MASK             0x00000007
2072 #define MWL8K_CAP_5GHZ                  0x00000004
2073 #define MWL8K_CAP_2GHZ4                 0x00000001
2074
2075 static void
2076 mwl8k_set_ht_caps(struct ieee80211_hw *hw,
2077                   struct ieee80211_supported_band *band, u32 cap)
2078 {
2079         int rx_streams;
2080         int tx_streams;
2081
2082         band->ht_cap.ht_supported = 1;
2083
2084         if (cap & MWL8K_CAP_MAX_AMSDU)
2085                 band->ht_cap.cap |= IEEE80211_HT_CAP_MAX_AMSDU;
2086         if (cap & MWL8K_CAP_GREENFIELD)
2087                 band->ht_cap.cap |= IEEE80211_HT_CAP_GRN_FLD;
2088         if (cap & MWL8K_CAP_AMPDU) {
2089                 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
2090                 band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
2091                 band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_NONE;
2092         }
2093         if (cap & MWL8K_CAP_RX_STBC)
2094                 band->ht_cap.cap |= IEEE80211_HT_CAP_RX_STBC;
2095         if (cap & MWL8K_CAP_TX_STBC)
2096                 band->ht_cap.cap |= IEEE80211_HT_CAP_TX_STBC;
2097         if (cap & MWL8K_CAP_SHORTGI_40MHZ)
2098                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
2099         if (cap & MWL8K_CAP_SHORTGI_20MHZ)
2100                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
2101         if (cap & MWL8K_CAP_DELAY_BA)
2102                 band->ht_cap.cap |= IEEE80211_HT_CAP_DELAY_BA;
2103         if (cap & MWL8K_CAP_40MHZ)
2104                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
2105
2106         rx_streams = hweight32(cap & MWL8K_CAP_RX_ANTENNA_MASK);
2107         tx_streams = hweight32(cap & MWL8K_CAP_TX_ANTENNA_MASK);
2108
2109         band->ht_cap.mcs.rx_mask[0] = 0xff;
2110         if (rx_streams >= 2)
2111                 band->ht_cap.mcs.rx_mask[1] = 0xff;
2112         if (rx_streams >= 3)
2113                 band->ht_cap.mcs.rx_mask[2] = 0xff;
2114         band->ht_cap.mcs.rx_mask[4] = 0x01;
2115         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
2116
2117         if (rx_streams != tx_streams) {
2118                 band->ht_cap.mcs.tx_params |= IEEE80211_HT_MCS_TX_RX_DIFF;
2119                 band->ht_cap.mcs.tx_params |= (tx_streams - 1) <<
2120                                 IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
2121         }
2122 }
2123
2124 static void
2125 mwl8k_set_caps(struct ieee80211_hw *hw, u32 caps)
2126 {
2127         struct mwl8k_priv *priv = hw->priv;
2128
2129         if ((caps & MWL8K_CAP_2GHZ4) || !(caps & MWL8K_CAP_BAND_MASK)) {
2130                 mwl8k_setup_2ghz_band(hw);
2131                 if (caps & MWL8K_CAP_MIMO)
2132                         mwl8k_set_ht_caps(hw, &priv->band_24, caps);
2133         }
2134
2135         if (caps & MWL8K_CAP_5GHZ) {
2136                 mwl8k_setup_5ghz_band(hw);
2137                 if (caps & MWL8K_CAP_MIMO)
2138                         mwl8k_set_ht_caps(hw, &priv->band_50, caps);
2139         }
2140 }
2141
2142 static int mwl8k_cmd_get_hw_spec_sta(struct ieee80211_hw *hw)
2143 {
2144         struct mwl8k_priv *priv = hw->priv;
2145         struct mwl8k_cmd_get_hw_spec_sta *cmd;
2146         int rc;
2147         int i;
2148
2149         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2150         if (cmd == NULL)
2151                 return -ENOMEM;
2152
2153         cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_HW_SPEC);
2154         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2155
2156         memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
2157         cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
2158         cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rxd_dma);
2159         cmd->num_tx_queues = cpu_to_le32(mwl8k_tx_queues(priv));
2160         for (i = 0; i < mwl8k_tx_queues(priv); i++)
2161                 cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[i].txd_dma);
2162         cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
2163         cmd->total_rxd = cpu_to_le32(MWL8K_RX_DESCS);
2164
2165         rc = mwl8k_post_cmd(hw, &cmd->header);
2166
2167         if (!rc) {
2168                 SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
2169                 priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
2170                 priv->fw_rev = le32_to_cpu(cmd->fw_rev);
2171                 priv->hw_rev = cmd->hw_rev;
2172                 mwl8k_set_caps(hw, le32_to_cpu(cmd->caps));
2173                 priv->ap_macids_supported = 0x00000000;
2174                 priv->sta_macids_supported = 0x00000001;
2175         }
2176
2177         kfree(cmd);
2178         return rc;
2179 }
2180
2181 /*
2182  * CMD_GET_HW_SPEC (AP version).
2183  */
2184 struct mwl8k_cmd_get_hw_spec_ap {
2185         struct mwl8k_cmd_pkt header;
2186         __u8 hw_rev;
2187         __u8 host_interface;
2188         __le16 num_wcb;
2189         __le16 num_mcaddrs;
2190         __u8 perm_addr[ETH_ALEN];
2191         __le16 region_code;
2192         __le16 num_antenna;
2193         __le32 fw_rev;
2194         __le32 wcbbase0;
2195         __le32 rxwrptr;
2196         __le32 rxrdptr;
2197         __le32 ps_cookie;
2198         __le32 wcbbase1;
2199         __le32 wcbbase2;
2200         __le32 wcbbase3;
2201         __le32 fw_api_version;
2202         __le32 caps;
2203         __le32 num_of_ampdu_queues;
2204         __le32 wcbbase_ampdu[MWL8K_MAX_AMPDU_QUEUES];
2205 } __packed;
2206
2207 static int mwl8k_cmd_get_hw_spec_ap(struct ieee80211_hw *hw)
2208 {
2209         struct mwl8k_priv *priv = hw->priv;
2210         struct mwl8k_cmd_get_hw_spec_ap *cmd;
2211         int rc, i;
2212         u32 api_version;
2213
2214         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2215         if (cmd == NULL)
2216                 return -ENOMEM;
2217
2218         cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_HW_SPEC);
2219         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2220
2221         memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
2222         cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
2223
2224         rc = mwl8k_post_cmd(hw, &cmd->header);
2225
2226         if (!rc) {
2227                 int off;
2228
2229                 api_version = le32_to_cpu(cmd->fw_api_version);
2230                 if (priv->device_info->fw_api_ap != api_version) {
2231                         printk(KERN_ERR "%s: Unsupported fw API version for %s."
2232                                "  Expected %d got %d.\n", MWL8K_NAME,
2233                                priv->device_info->part_name,
2234                                priv->device_info->fw_api_ap,
2235                                api_version);
2236                         rc = -EINVAL;
2237                         goto done;
2238                 }
2239                 SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
2240                 priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
2241                 priv->fw_rev = le32_to_cpu(cmd->fw_rev);
2242                 priv->hw_rev = cmd->hw_rev;
2243                 mwl8k_set_caps(hw, le32_to_cpu(cmd->caps));
2244                 priv->ap_macids_supported = 0x000000ff;
2245                 priv->sta_macids_supported = 0x00000000;
2246                 priv->num_ampdu_queues = le32_to_cpu(cmd->num_of_ampdu_queues);
2247                 if (priv->num_ampdu_queues > MWL8K_MAX_AMPDU_QUEUES) {
2248                         wiphy_warn(hw->wiphy, "fw reported %d ampdu queues"
2249                                    " but we only support %d.\n",
2250                                    priv->num_ampdu_queues,
2251                                    MWL8K_MAX_AMPDU_QUEUES);
2252                         priv->num_ampdu_queues = MWL8K_MAX_AMPDU_QUEUES;
2253                 }
2254                 off = le32_to_cpu(cmd->rxwrptr) & 0xffff;
2255                 iowrite32(priv->rxq[0].rxd_dma, priv->sram + off);
2256
2257                 off = le32_to_cpu(cmd->rxrdptr) & 0xffff;
2258                 iowrite32(priv->rxq[0].rxd_dma, priv->sram + off);
2259
2260                 priv->txq_offset[0] = le32_to_cpu(cmd->wcbbase0) & 0xffff;
2261                 priv->txq_offset[1] = le32_to_cpu(cmd->wcbbase1) & 0xffff;
2262                 priv->txq_offset[2] = le32_to_cpu(cmd->wcbbase2) & 0xffff;
2263                 priv->txq_offset[3] = le32_to_cpu(cmd->wcbbase3) & 0xffff;
2264
2265                 for (i = 0; i < priv->num_ampdu_queues; i++)
2266                         priv->txq_offset[i + MWL8K_TX_WMM_QUEUES] =
2267                                 le32_to_cpu(cmd->wcbbase_ampdu[i]) & 0xffff;
2268         }
2269
2270 done:
2271         kfree(cmd);
2272         return rc;
2273 }
2274
2275 /*
2276  * CMD_SET_HW_SPEC.
2277  */
2278 struct mwl8k_cmd_set_hw_spec {
2279         struct mwl8k_cmd_pkt header;
2280         __u8 hw_rev;
2281         __u8 host_interface;
2282         __le16 num_mcaddrs;
2283         __u8 perm_addr[ETH_ALEN];
2284         __le16 region_code;
2285         __le32 fw_rev;
2286         __le32 ps_cookie;
2287         __le32 caps;
2288         __le32 rx_queue_ptr;
2289         __le32 num_tx_queues;
2290         __le32 tx_queue_ptrs[MWL8K_MAX_TX_QUEUES];
2291         __le32 flags;
2292         __le32 num_tx_desc_per_queue;
2293         __le32 total_rxd;
2294 } __packed;
2295
2296 /* If enabled, MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY will cause
2297  * packets to expire 500 ms after the timestamp in the tx descriptor.  That is,
2298  * the packets that are queued for more than 500ms, will be dropped in the
2299  * hardware. This helps minimizing the issues caused due to head-of-line
2300  * blocking where a slow client can hog the bandwidth and affect traffic to a
2301  * faster client.
2302  */
2303 #define MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY  0x00000400
2304 #define MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT           0x00000080
2305 #define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP       0x00000020
2306 #define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON          0x00000010
2307
2308 static int mwl8k_cmd_set_hw_spec(struct ieee80211_hw *hw)
2309 {
2310         struct mwl8k_priv *priv = hw->priv;
2311         struct mwl8k_cmd_set_hw_spec *cmd;
2312         int rc;
2313         int i;
2314
2315         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2316         if (cmd == NULL)
2317                 return -ENOMEM;
2318
2319         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_HW_SPEC);
2320         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2321
2322         cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
2323         cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rxd_dma);
2324         cmd->num_tx_queues = cpu_to_le32(mwl8k_tx_queues(priv));
2325
2326         /*
2327          * Mac80211 stack has Q0 as highest priority and Q3 as lowest in
2328          * that order. Firmware has Q3 as highest priority and Q0 as lowest
2329          * in that order. Map Q3 of mac80211 to Q0 of firmware so that the
2330          * priority is interpreted the right way in firmware.
2331          */
2332         for (i = 0; i < mwl8k_tx_queues(priv); i++) {
2333                 int j = mwl8k_tx_queues(priv) - 1 - i;
2334                 cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[j].txd_dma);
2335         }
2336
2337         cmd->flags = cpu_to_le32(MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT |
2338                                  MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP |
2339                                  MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON);
2340         cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
2341         cmd->total_rxd = cpu_to_le32(MWL8K_RX_DESCS);
2342
2343         rc = mwl8k_post_cmd(hw, &cmd->header);
2344         kfree(cmd);
2345
2346         return rc;
2347 }
2348
2349 /*
2350  * CMD_MAC_MULTICAST_ADR.
2351  */
2352 struct mwl8k_cmd_mac_multicast_adr {
2353         struct mwl8k_cmd_pkt header;
2354         __le16 action;
2355         __le16 numaddr;
2356         __u8 addr[0][ETH_ALEN];
2357 };
2358
2359 #define MWL8K_ENABLE_RX_DIRECTED        0x0001
2360 #define MWL8K_ENABLE_RX_MULTICAST       0x0002
2361 #define MWL8K_ENABLE_RX_ALL_MULTICAST   0x0004
2362 #define MWL8K_ENABLE_RX_BROADCAST       0x0008
2363
2364 static struct mwl8k_cmd_pkt *
2365 __mwl8k_cmd_mac_multicast_adr(struct ieee80211_hw *hw, int allmulti,
2366                               struct netdev_hw_addr_list *mc_list)
2367 {
2368         struct mwl8k_priv *priv = hw->priv;
2369         struct mwl8k_cmd_mac_multicast_adr *cmd;
2370         int size;
2371         int mc_count = 0;
2372
2373         if (mc_list)
2374                 mc_count = netdev_hw_addr_list_count(mc_list);
2375
2376         if (allmulti || mc_count > priv->num_mcaddrs) {
2377                 allmulti = 1;
2378                 mc_count = 0;
2379         }
2380
2381         size = sizeof(*cmd) + mc_count * ETH_ALEN;
2382
2383         cmd = kzalloc(size, GFP_ATOMIC);
2384         if (cmd == NULL)
2385                 return NULL;
2386
2387         cmd->header.code = cpu_to_le16(MWL8K_CMD_MAC_MULTICAST_ADR);
2388         cmd->header.length = cpu_to_le16(size);
2389         cmd->action = cpu_to_le16(MWL8K_ENABLE_RX_DIRECTED |
2390                                   MWL8K_ENABLE_RX_BROADCAST);
2391
2392         if (allmulti) {
2393                 cmd->action |= cpu_to_le16(MWL8K_ENABLE_RX_ALL_MULTICAST);
2394         } else if (mc_count) {
2395                 struct netdev_hw_addr *ha;
2396                 int i = 0;
2397
2398                 cmd->action |= cpu_to_le16(MWL8K_ENABLE_RX_MULTICAST);
2399                 cmd->numaddr = cpu_to_le16(mc_count);
2400                 netdev_hw_addr_list_for_each(ha, mc_list) {
2401                         memcpy(cmd->addr[i], ha->addr, ETH_ALEN);
2402                 }
2403         }
2404
2405         return &cmd->header;
2406 }
2407
2408 /*
2409  * CMD_GET_STAT.
2410  */
2411 struct mwl8k_cmd_get_stat {
2412         struct mwl8k_cmd_pkt header;
2413         __le32 stats[64];
2414 } __packed;
2415
2416 #define MWL8K_STAT_ACK_FAILURE  9
2417 #define MWL8K_STAT_RTS_FAILURE  12
2418 #define MWL8K_STAT_FCS_ERROR    24
2419 #define MWL8K_STAT_RTS_SUCCESS  11
2420
2421 static int mwl8k_cmd_get_stat(struct ieee80211_hw *hw,
2422                               struct ieee80211_low_level_stats *stats)
2423 {
2424         struct mwl8k_cmd_get_stat *cmd;
2425         int rc;
2426
2427         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2428         if (cmd == NULL)
2429                 return -ENOMEM;
2430
2431         cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_STAT);
2432         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2433
2434         rc = mwl8k_post_cmd(hw, &cmd->header);
2435         if (!rc) {
2436                 stats->dot11ACKFailureCount =
2437                         le32_to_cpu(cmd->stats[MWL8K_STAT_ACK_FAILURE]);
2438                 stats->dot11RTSFailureCount =
2439                         le32_to_cpu(cmd->stats[MWL8K_STAT_RTS_FAILURE]);
2440                 stats->dot11FCSErrorCount =
2441                         le32_to_cpu(cmd->stats[MWL8K_STAT_FCS_ERROR]);
2442                 stats->dot11RTSSuccessCount =
2443                         le32_to_cpu(cmd->stats[MWL8K_STAT_RTS_SUCCESS]);
2444         }
2445         kfree(cmd);
2446
2447         return rc;
2448 }
2449
2450 /*
2451  * CMD_RADIO_CONTROL.
2452  */
2453 struct mwl8k_cmd_radio_control {
2454         struct mwl8k_cmd_pkt header;
2455         __le16 action;
2456         __le16 control;
2457         __le16 radio_on;
2458 } __packed;
2459
2460 static int
2461 mwl8k_cmd_radio_control(struct ieee80211_hw *hw, bool enable, bool force)
2462 {
2463         struct mwl8k_priv *priv = hw->priv;
2464         struct mwl8k_cmd_radio_control *cmd;
2465         int rc;
2466
2467         if (enable == priv->radio_on && !force)
2468                 return 0;
2469
2470         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2471         if (cmd == NULL)
2472                 return -ENOMEM;
2473
2474         cmd->header.code = cpu_to_le16(MWL8K_CMD_RADIO_CONTROL);
2475         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2476         cmd->action = cpu_to_le16(MWL8K_CMD_SET);
2477         cmd->control = cpu_to_le16(priv->radio_short_preamble ? 3 : 1);
2478         cmd->radio_on = cpu_to_le16(enable ? 0x0001 : 0x0000);
2479
2480         rc = mwl8k_post_cmd(hw, &cmd->header);
2481         kfree(cmd);
2482
2483         if (!rc)
2484                 priv->radio_on = enable;
2485
2486         return rc;
2487 }
2488
2489 static int mwl8k_cmd_radio_disable(struct ieee80211_hw *hw)
2490 {
2491         return mwl8k_cmd_radio_control(hw, 0, 0);
2492 }
2493
2494 static int mwl8k_cmd_radio_enable(struct ieee80211_hw *hw)
2495 {
2496         return mwl8k_cmd_radio_control(hw, 1, 0);
2497 }
2498
2499 static int
2500 mwl8k_set_radio_preamble(struct ieee80211_hw *hw, bool short_preamble)
2501 {
2502         struct mwl8k_priv *priv = hw->priv;
2503
2504         priv->radio_short_preamble = short_preamble;
2505
2506         return mwl8k_cmd_radio_control(hw, 1, 1);
2507 }
2508
2509 /*
2510  * CMD_RF_TX_POWER.
2511  */
2512 #define MWL8K_RF_TX_POWER_LEVEL_TOTAL   8
2513
2514 struct mwl8k_cmd_rf_tx_power {
2515         struct mwl8k_cmd_pkt header;
2516         __le16 action;
2517         __le16 support_level;
2518         __le16 current_level;
2519         __le16 reserved;
2520         __le16 power_level_list[MWL8K_RF_TX_POWER_LEVEL_TOTAL];
2521 } __packed;
2522
2523 static int mwl8k_cmd_rf_tx_power(struct ieee80211_hw *hw, int dBm)
2524 {
2525         struct mwl8k_cmd_rf_tx_power *cmd;
2526         int rc;
2527
2528         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2529         if (cmd == NULL)
2530                 return -ENOMEM;
2531
2532         cmd->header.code = cpu_to_le16(MWL8K_CMD_RF_TX_POWER);
2533         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2534         cmd->action = cpu_to_le16(MWL8K_CMD_SET);
2535         cmd->support_level = cpu_to_le16(dBm);
2536
2537         rc = mwl8k_post_cmd(hw, &cmd->header);
2538         kfree(cmd);
2539
2540         return rc;
2541 }
2542
2543 /*
2544  * CMD_TX_POWER.
2545  */
2546 #define MWL8K_TX_POWER_LEVEL_TOTAL      12
2547
2548 struct mwl8k_cmd_tx_power {
2549         struct mwl8k_cmd_pkt header;
2550         __le16 action;
2551         __le16 band;
2552         __le16 channel;
2553         __le16 bw;
2554         __le16 sub_ch;
2555         __le16 power_level_list[MWL8K_TX_POWER_LEVEL_TOTAL];
2556 } __attribute__((packed));
2557
2558 static int mwl8k_cmd_tx_power(struct ieee80211_hw *hw,
2559                                      struct ieee80211_conf *conf,
2560                                      unsigned short pwr)
2561 {
2562         struct ieee80211_channel *channel = conf->channel;
2563         struct mwl8k_cmd_tx_power *cmd;
2564         int rc;
2565         int i;
2566
2567         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2568         if (cmd == NULL)
2569                 return -ENOMEM;
2570
2571         cmd->header.code = cpu_to_le16(MWL8K_CMD_TX_POWER);
2572         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2573         cmd->action = cpu_to_le16(MWL8K_CMD_SET_LIST);
2574
2575         if (channel->band == IEEE80211_BAND_2GHZ)
2576                 cmd->band = cpu_to_le16(0x1);
2577         else if (channel->band == IEEE80211_BAND_5GHZ)
2578                 cmd->band = cpu_to_le16(0x4);
2579
2580         cmd->channel = channel->hw_value;
2581
2582         if (conf->channel_type == NL80211_CHAN_NO_HT ||
2583             conf->channel_type == NL80211_CHAN_HT20) {
2584                 cmd->bw = cpu_to_le16(0x2);
2585         } else {
2586                 cmd->bw = cpu_to_le16(0x4);
2587                 if (conf->channel_type == NL80211_CHAN_HT40MINUS)
2588                         cmd->sub_ch = cpu_to_le16(0x3);
2589                 else if (conf->channel_type == NL80211_CHAN_HT40PLUS)
2590                         cmd->sub_ch = cpu_to_le16(0x1);
2591         }
2592
2593         for (i = 0; i < MWL8K_TX_POWER_LEVEL_TOTAL; i++)
2594                 cmd->power_level_list[i] = cpu_to_le16(pwr);
2595
2596         rc = mwl8k_post_cmd(hw, &cmd->header);
2597         kfree(cmd);
2598
2599         return rc;
2600 }
2601
2602 /*
2603  * CMD_RF_ANTENNA.
2604  */
2605 struct mwl8k_cmd_rf_antenna {
2606         struct mwl8k_cmd_pkt header;
2607         __le16 antenna;
2608         __le16 mode;
2609 } __packed;
2610
2611 #define MWL8K_RF_ANTENNA_RX             1
2612 #define MWL8K_RF_ANTENNA_TX             2
2613
2614 static int
2615 mwl8k_cmd_rf_antenna(struct ieee80211_hw *hw, int antenna, int mask)
2616 {
2617         struct mwl8k_cmd_rf_antenna *cmd;
2618         int rc;
2619
2620         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2621         if (cmd == NULL)
2622                 return -ENOMEM;
2623
2624         cmd->header.code = cpu_to_le16(MWL8K_CMD_RF_ANTENNA);
2625         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2626         cmd->antenna = cpu_to_le16(antenna);
2627         cmd->mode = cpu_to_le16(mask);
2628
2629         rc = mwl8k_post_cmd(hw, &cmd->header);
2630         kfree(cmd);
2631
2632         return rc;
2633 }
2634
2635 /*
2636  * CMD_SET_BEACON.
2637  */
2638 struct mwl8k_cmd_set_beacon {
2639         struct mwl8k_cmd_pkt header;
2640         __le16 beacon_len;
2641         __u8 beacon[0];
2642 };
2643
2644 static int mwl8k_cmd_set_beacon(struct ieee80211_hw *hw,
2645                                 struct ieee80211_vif *vif, u8 *beacon, int len)
2646 {
2647         struct mwl8k_cmd_set_beacon *cmd;
2648         int rc;
2649
2650         cmd = kzalloc(sizeof(*cmd) + len, GFP_KERNEL);
2651         if (cmd == NULL)
2652                 return -ENOMEM;
2653
2654         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_BEACON);
2655         cmd->header.length = cpu_to_le16(sizeof(*cmd) + len);
2656         cmd->beacon_len = cpu_to_le16(len);
2657         memcpy(cmd->beacon, beacon, len);
2658
2659         rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
2660         kfree(cmd);
2661
2662         return rc;
2663 }
2664
2665 /*
2666  * CMD_SET_PRE_SCAN.
2667  */
2668 struct mwl8k_cmd_set_pre_scan {
2669         struct mwl8k_cmd_pkt header;
2670 } __packed;
2671
2672 static int mwl8k_cmd_set_pre_scan(struct ieee80211_hw *hw)
2673 {
2674         struct mwl8k_cmd_set_pre_scan *cmd;
2675         int rc;
2676
2677         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2678         if (cmd == NULL)
2679                 return -ENOMEM;
2680
2681         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_PRE_SCAN);
2682         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2683
2684         rc = mwl8k_post_cmd(hw, &cmd->header);
2685         kfree(cmd);
2686
2687         return rc;
2688 }
2689
2690 /*
2691  * CMD_SET_POST_SCAN.
2692  */
2693 struct mwl8k_cmd_set_post_scan {
2694         struct mwl8k_cmd_pkt header;
2695         __le32 isibss;
2696         __u8 bssid[ETH_ALEN];
2697 } __packed;
2698
2699 static int
2700 mwl8k_cmd_set_post_scan(struct ieee80211_hw *hw, const __u8 *mac)
2701 {
2702         struct mwl8k_cmd_set_post_scan *cmd;
2703         int rc;
2704
2705         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2706         if (cmd == NULL)
2707                 return -ENOMEM;
2708
2709         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_POST_SCAN);
2710         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2711         cmd->isibss = 0;
2712         memcpy(cmd->bssid, mac, ETH_ALEN);
2713
2714         rc = mwl8k_post_cmd(hw, &cmd->header);
2715         kfree(cmd);
2716
2717         return rc;
2718 }
2719
2720 /*
2721  * CMD_SET_RF_CHANNEL.
2722  */
2723 struct mwl8k_cmd_set_rf_channel {
2724         struct mwl8k_cmd_pkt header;
2725         __le16 action;
2726         __u8 current_channel;
2727         __le32 channel_flags;
2728 } __packed;
2729
2730 static int mwl8k_cmd_set_rf_channel(struct ieee80211_hw *hw,
2731                                     struct ieee80211_conf *conf)
2732 {
2733         struct ieee80211_channel *channel = conf->channel;
2734         struct mwl8k_cmd_set_rf_channel *cmd;
2735         int rc;
2736
2737         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2738         if (cmd == NULL)
2739                 return -ENOMEM;
2740
2741         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RF_CHANNEL);
2742         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2743         cmd->action = cpu_to_le16(MWL8K_CMD_SET);
2744         cmd->current_channel = channel->hw_value;
2745
2746         if (channel->band == IEEE80211_BAND_2GHZ)
2747                 cmd->channel_flags |= cpu_to_le32(0x00000001);
2748         else if (channel->band == IEEE80211_BAND_5GHZ)
2749                 cmd->channel_flags |= cpu_to_le32(0x00000004);
2750
2751         if (conf->channel_type == NL80211_CHAN_NO_HT ||
2752             conf->channel_type == NL80211_CHAN_HT20)
2753                 cmd->channel_flags |= cpu_to_le32(0x00000080);
2754         else if (conf->channel_type == NL80211_CHAN_HT40MINUS)
2755                 cmd->channel_flags |= cpu_to_le32(0x000001900);
2756         else if (conf->channel_type == NL80211_CHAN_HT40PLUS)
2757                 cmd->channel_flags |= cpu_to_le32(0x000000900);
2758
2759         rc = mwl8k_post_cmd(hw, &cmd->header);
2760         kfree(cmd);
2761
2762         return rc;
2763 }
2764
2765 /*
2766  * CMD_SET_AID.
2767  */
2768 #define MWL8K_FRAME_PROT_DISABLED                       0x00
2769 #define MWL8K_FRAME_PROT_11G                            0x07
2770 #define MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY              0x02
2771 #define MWL8K_FRAME_PROT_11N_HT_ALL                     0x06
2772
2773 struct mwl8k_cmd_update_set_aid {
2774         struct  mwl8k_cmd_pkt header;
2775         __le16  aid;
2776
2777          /* AP's MAC address (BSSID) */
2778         __u8    bssid[ETH_ALEN];
2779         __le16  protection_mode;
2780         __u8    supp_rates[14];
2781 } __packed;
2782
2783 static void legacy_rate_mask_to_array(u8 *rates, u32 mask)
2784 {
2785         int i;
2786         int j;
2787
2788         /*
2789          * Clear nonstandard rates 4 and 13.
2790          */
2791         mask &= 0x1fef;
2792
2793         for (i = 0, j = 0; i < 14; i++) {
2794                 if (mask & (1 << i))
2795                         rates[j++] = mwl8k_rates_24[i].hw_value;
2796         }
2797 }
2798
2799 static int
2800 mwl8k_cmd_set_aid(struct ieee80211_hw *hw,
2801                   struct ieee80211_vif *vif, u32 legacy_rate_mask)
2802 {
2803         struct mwl8k_cmd_update_set_aid *cmd;
2804         u16 prot_mode;
2805         int rc;
2806
2807         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2808         if (cmd == NULL)
2809                 return -ENOMEM;
2810
2811         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_AID);
2812         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2813         cmd->aid = cpu_to_le16(vif->bss_conf.aid);
2814         memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
2815
2816         if (vif->bss_conf.use_cts_prot) {
2817                 prot_mode = MWL8K_FRAME_PROT_11G;
2818         } else {
2819                 switch (vif->bss_conf.ht_operation_mode &
2820                         IEEE80211_HT_OP_MODE_PROTECTION) {
2821                 case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
2822                         prot_mode = MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY;
2823                         break;
2824                 case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
2825                         prot_mode = MWL8K_FRAME_PROT_11N_HT_ALL;
2826                         break;
2827                 default:
2828                         prot_mode = MWL8K_FRAME_PROT_DISABLED;
2829                         break;
2830                 }
2831         }
2832         cmd->protection_mode = cpu_to_le16(prot_mode);
2833
2834         legacy_rate_mask_to_array(cmd->supp_rates, legacy_rate_mask);
2835
2836         rc = mwl8k_post_cmd(hw, &cmd->header);
2837         kfree(cmd);
2838
2839         return rc;
2840 }
2841
2842 /*
2843  * CMD_SET_RATE.
2844  */
2845 struct mwl8k_cmd_set_rate {
2846         struct  mwl8k_cmd_pkt header;
2847         __u8    legacy_rates[14];
2848
2849         /* Bitmap for supported MCS codes.  */
2850         __u8    mcs_set[16];
2851         __u8    reserved[16];
2852 } __packed;
2853
2854 static int
2855 mwl8k_cmd_set_rate(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2856                    u32 legacy_rate_mask, u8 *mcs_rates)
2857 {
2858         struct mwl8k_cmd_set_rate *cmd;
2859         int rc;
2860
2861         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2862         if (cmd == NULL)
2863                 return -ENOMEM;
2864
2865         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATE);
2866         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2867         legacy_rate_mask_to_array(cmd->legacy_rates, legacy_rate_mask);
2868         memcpy(cmd->mcs_set, mcs_rates, 16);
2869
2870         rc = mwl8k_post_cmd(hw, &cmd->header);
2871         kfree(cmd);
2872
2873         return rc;
2874 }
2875
2876 /*
2877  * CMD_FINALIZE_JOIN.
2878  */
2879 #define MWL8K_FJ_BEACON_MAXLEN  128
2880
2881 struct mwl8k_cmd_finalize_join {
2882         struct mwl8k_cmd_pkt header;
2883         __le32 sleep_interval;  /* Number of beacon periods to sleep */
2884         __u8 beacon_data[MWL8K_FJ_BEACON_MAXLEN];
2885 } __packed;
2886
2887 static int mwl8k_cmd_finalize_join(struct ieee80211_hw *hw, void *frame,
2888                                    int framelen, int dtim)
2889 {
2890         struct mwl8k_cmd_finalize_join *cmd;
2891         struct ieee80211_mgmt *payload = frame;
2892         int payload_len;
2893         int rc;
2894
2895         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2896         if (cmd == NULL)
2897                 return -ENOMEM;
2898
2899         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_FINALIZE_JOIN);
2900         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2901         cmd->sleep_interval = cpu_to_le32(dtim ? dtim : 1);
2902
2903         payload_len = framelen - ieee80211_hdrlen(payload->frame_control);
2904         if (payload_len < 0)
2905                 payload_len = 0;
2906         else if (payload_len > MWL8K_FJ_BEACON_MAXLEN)
2907                 payload_len = MWL8K_FJ_BEACON_MAXLEN;
2908
2909         memcpy(cmd->beacon_data, &payload->u.beacon, payload_len);
2910
2911         rc = mwl8k_post_cmd(hw, &cmd->header);
2912         kfree(cmd);
2913
2914         return rc;
2915 }
2916
2917 /*
2918  * CMD_SET_RTS_THRESHOLD.
2919  */
2920 struct mwl8k_cmd_set_rts_threshold {
2921         struct mwl8k_cmd_pkt header;
2922         __le16 action;
2923         __le16 threshold;
2924 } __packed;
2925
2926 static int
2927 mwl8k_cmd_set_rts_threshold(struct ieee80211_hw *hw, int rts_thresh)
2928 {
2929         struct mwl8k_cmd_set_rts_threshold *cmd;
2930         int rc;
2931
2932         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2933         if (cmd == NULL)
2934                 return -ENOMEM;
2935
2936         cmd->header.code = cpu_to_le16(MWL8K_CMD_RTS_THRESHOLD);
2937         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2938         cmd->action = cpu_to_le16(MWL8K_CMD_SET);
2939         cmd->threshold = cpu_to_le16(rts_thresh);
2940
2941         rc = mwl8k_post_cmd(hw, &cmd->header);
2942         kfree(cmd);
2943
2944         return rc;
2945 }
2946
2947 /*
2948  * CMD_SET_SLOT.
2949  */
2950 struct mwl8k_cmd_set_slot {
2951         struct mwl8k_cmd_pkt header;
2952         __le16 action;
2953         __u8 short_slot;
2954 } __packed;
2955
2956 static int mwl8k_cmd_set_slot(struct ieee80211_hw *hw, bool short_slot_time)
2957 {
2958         struct mwl8k_cmd_set_slot *cmd;
2959         int rc;
2960
2961         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2962         if (cmd == NULL)
2963                 return -ENOMEM;
2964
2965         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_SLOT);
2966         cmd->header.length = cpu_to_le16(sizeof(*cmd));
2967         cmd->action = cpu_to_le16(MWL8K_CMD_SET);
2968         cmd->short_slot = short_slot_time;
2969
2970         rc = mwl8k_post_cmd(hw, &cmd->header);
2971         kfree(cmd);
2972
2973         return rc;
2974 }
2975
2976 /*
2977  * CMD_SET_EDCA_PARAMS.
2978  */
2979 struct mwl8k_cmd_set_edca_params {
2980         struct mwl8k_cmd_pkt header;
2981
2982         /* See MWL8K_SET_EDCA_XXX below */
2983         __le16 action;
2984
2985         /* TX opportunity in units of 32 us */
2986         __le16 txop;
2987
2988         union {
2989                 struct {
2990                         /* Log exponent of max contention period: 0...15 */
2991                         __le32 log_cw_max;
2992
2993                         /* Log exponent of min contention period: 0...15 */
2994                         __le32 log_cw_min;
2995
2996                         /* Adaptive interframe spacing in units of 32us */
2997                         __u8 aifs;
2998
2999                         /* TX queue to configure */
3000                         __u8 txq;
3001                 } ap;
3002                 struct {
3003                         /* Log exponent of max contention period: 0...15 */
3004                         __u8 log_cw_max;
3005
3006                         /* Log exponent of min contention period: 0...15 */
3007                         __u8 log_cw_min;
3008
3009                         /* Adaptive interframe spacing in units of 32us */
3010                         __u8 aifs;
3011
3012                         /* TX queue to configure */
3013                         __u8 txq;
3014                 } sta;
3015         };
3016 } __packed;
3017
3018 #define MWL8K_SET_EDCA_CW       0x01
3019 #define MWL8K_SET_EDCA_TXOP     0x02
3020 #define MWL8K_SET_EDCA_AIFS     0x04
3021
3022 #define MWL8K_SET_EDCA_ALL      (MWL8K_SET_EDCA_CW | \
3023                                  MWL8K_SET_EDCA_TXOP | \
3024                                  MWL8K_SET_EDCA_AIFS)
3025
3026 static int
3027 mwl8k_cmd_set_edca_params(struct ieee80211_hw *hw, __u8 qnum,
3028                           __u16 cw_min, __u16 cw_max,
3029                           __u8 aifs, __u16 txop)
3030 {
3031         struct mwl8k_priv *priv = hw->priv;
3032         struct mwl8k_cmd_set_edca_params *cmd;
3033         int rc;
3034
3035         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3036         if (cmd == NULL)
3037                 return -ENOMEM;
3038
3039         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_EDCA_PARAMS);
3040         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3041         cmd->action = cpu_to_le16(MWL8K_SET_EDCA_ALL);
3042         cmd->txop = cpu_to_le16(txop);
3043         if (priv->ap_fw) {
3044                 cmd->ap.log_cw_max = cpu_to_le32(ilog2(cw_max + 1));
3045                 cmd->ap.log_cw_min = cpu_to_le32(ilog2(cw_min + 1));
3046                 cmd->ap.aifs = aifs;
3047                 cmd->ap.txq = qnum;
3048         } else {
3049                 cmd->sta.log_cw_max = (u8)ilog2(cw_max + 1);
3050                 cmd->sta.log_cw_min = (u8)ilog2(cw_min + 1);
3051                 cmd->sta.aifs = aifs;
3052                 cmd->sta.txq = qnum;
3053         }
3054
3055         rc = mwl8k_post_cmd(hw, &cmd->header);
3056         kfree(cmd);
3057
3058         return rc;
3059 }
3060
3061 /*
3062  * CMD_SET_WMM_MODE.
3063  */
3064 struct mwl8k_cmd_set_wmm_mode {
3065         struct mwl8k_cmd_pkt header;
3066         __le16 action;
3067 } __packed;
3068
3069 static int mwl8k_cmd_set_wmm_mode(struct ieee80211_hw *hw, bool enable)
3070 {
3071         struct mwl8k_priv *priv = hw->priv;
3072         struct mwl8k_cmd_set_wmm_mode *cmd;
3073         int rc;
3074
3075         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3076         if (cmd == NULL)
3077                 return -ENOMEM;
3078
3079         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_WMM_MODE);
3080         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3081         cmd->action = cpu_to_le16(!!enable);
3082
3083         rc = mwl8k_post_cmd(hw, &cmd->header);
3084         kfree(cmd);
3085
3086         if (!rc)
3087                 priv->wmm_enabled = enable;
3088
3089         return rc;
3090 }
3091
3092 /*
3093  * CMD_MIMO_CONFIG.
3094  */
3095 struct mwl8k_cmd_mimo_config {
3096         struct mwl8k_cmd_pkt header;
3097         __le32 action;
3098         __u8 rx_antenna_map;
3099         __u8 tx_antenna_map;
3100 } __packed;
3101
3102 static int mwl8k_cmd_mimo_config(struct ieee80211_hw *hw, __u8 rx, __u8 tx)
3103 {
3104         struct mwl8k_cmd_mimo_config *cmd;
3105         int rc;
3106
3107         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3108         if (cmd == NULL)
3109                 return -ENOMEM;
3110
3111         cmd->header.code = cpu_to_le16(MWL8K_CMD_MIMO_CONFIG);
3112         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3113         cmd->action = cpu_to_le32((u32)MWL8K_CMD_SET);
3114         cmd->rx_antenna_map = rx;
3115         cmd->tx_antenna_map = tx;
3116
3117         rc = mwl8k_post_cmd(hw, &cmd->header);
3118         kfree(cmd);
3119
3120         return rc;
3121 }
3122
3123 /*
3124  * CMD_USE_FIXED_RATE (STA version).
3125  */
3126 struct mwl8k_cmd_use_fixed_rate_sta {
3127         struct mwl8k_cmd_pkt header;
3128         __le32 action;
3129         __le32 allow_rate_drop;
3130         __le32 num_rates;
3131         struct {
3132                 __le32 is_ht_rate;
3133                 __le32 enable_retry;
3134                 __le32 rate;
3135                 __le32 retry_count;
3136         } rate_entry[8];
3137         __le32 rate_type;
3138         __le32 reserved1;
3139         __le32 reserved2;
3140 } __packed;
3141
3142 #define MWL8K_USE_AUTO_RATE     0x0002
3143 #define MWL8K_UCAST_RATE        0
3144
3145 static int mwl8k_cmd_use_fixed_rate_sta(struct ieee80211_hw *hw)
3146 {
3147         struct mwl8k_cmd_use_fixed_rate_sta *cmd;
3148         int rc;
3149
3150         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3151         if (cmd == NULL)
3152                 return -ENOMEM;
3153
3154         cmd->header.code = cpu_to_le16(MWL8K_CMD_USE_FIXED_RATE);
3155         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3156         cmd->action = cpu_to_le32(MWL8K_USE_AUTO_RATE);
3157         cmd->rate_type = cpu_to_le32(MWL8K_UCAST_RATE);
3158
3159         rc = mwl8k_post_cmd(hw, &cmd->header);
3160         kfree(cmd);
3161
3162         return rc;
3163 }
3164
3165 /*
3166  * CMD_USE_FIXED_RATE (AP version).
3167  */
3168 struct mwl8k_cmd_use_fixed_rate_ap {
3169         struct mwl8k_cmd_pkt header;
3170         __le32 action;
3171         __le32 allow_rate_drop;
3172         __le32 num_rates;
3173         struct mwl8k_rate_entry_ap {
3174                 __le32 is_ht_rate;
3175                 __le32 enable_retry;
3176                 __le32 rate;
3177                 __le32 retry_count;
3178         } rate_entry[4];
3179         u8 multicast_rate;
3180         u8 multicast_rate_type;
3181         u8 management_rate;
3182 } __packed;
3183
3184 static int
3185 mwl8k_cmd_use_fixed_rate_ap(struct ieee80211_hw *hw, int mcast, int mgmt)
3186 {
3187         struct mwl8k_cmd_use_fixed_rate_ap *cmd;
3188         int rc;
3189
3190         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3191         if (cmd == NULL)
3192                 return -ENOMEM;
3193
3194         cmd->header.code = cpu_to_le16(MWL8K_CMD_USE_FIXED_RATE);
3195         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3196         cmd->action = cpu_to_le32(MWL8K_USE_AUTO_RATE);
3197         cmd->multicast_rate = mcast;
3198         cmd->management_rate = mgmt;
3199
3200         rc = mwl8k_post_cmd(hw, &cmd->header);
3201         kfree(cmd);
3202
3203         return rc;
3204 }
3205
3206 /*
3207  * CMD_ENABLE_SNIFFER.
3208  */
3209 struct mwl8k_cmd_enable_sniffer {
3210         struct mwl8k_cmd_pkt header;
3211         __le32 action;
3212 } __packed;
3213
3214 static int mwl8k_cmd_enable_sniffer(struct ieee80211_hw *hw, bool enable)
3215 {
3216         struct mwl8k_cmd_enable_sniffer *cmd;
3217         int rc;
3218
3219         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3220         if (cmd == NULL)
3221                 return -ENOMEM;
3222
3223         cmd->header.code = cpu_to_le16(MWL8K_CMD_ENABLE_SNIFFER);
3224         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3225         cmd->action = cpu_to_le32(!!enable);
3226
3227         rc = mwl8k_post_cmd(hw, &cmd->header);
3228         kfree(cmd);
3229
3230         return rc;
3231 }
3232
3233 /*
3234  * CMD_SET_MAC_ADDR.
3235  */
3236 struct mwl8k_cmd_set_mac_addr {
3237         struct mwl8k_cmd_pkt header;
3238         union {
3239                 struct {
3240                         __le16 mac_type;
3241                         __u8 mac_addr[ETH_ALEN];
3242                 } mbss;
3243                 __u8 mac_addr[ETH_ALEN];
3244         };
3245 } __packed;
3246
3247 #define MWL8K_MAC_TYPE_PRIMARY_CLIENT           0
3248 #define MWL8K_MAC_TYPE_SECONDARY_CLIENT         1
3249 #define MWL8K_MAC_TYPE_PRIMARY_AP               2
3250 #define MWL8K_MAC_TYPE_SECONDARY_AP             3
3251
3252 static int mwl8k_cmd_set_mac_addr(struct ieee80211_hw *hw,
3253                                   struct ieee80211_vif *vif, u8 *mac)
3254 {
3255         struct mwl8k_priv *priv = hw->priv;
3256         struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
3257         struct mwl8k_cmd_set_mac_addr *cmd;
3258         int mac_type;
3259         int rc;
3260
3261         mac_type = MWL8K_MAC_TYPE_PRIMARY_AP;
3262         if (vif != NULL && vif->type == NL80211_IFTYPE_STATION) {
3263                 if (mwl8k_vif->macid + 1 == ffs(priv->sta_macids_supported))
3264                         mac_type = MWL8K_MAC_TYPE_PRIMARY_CLIENT;
3265                 else
3266                         mac_type = MWL8K_MAC_TYPE_SECONDARY_CLIENT;
3267         } else if (vif != NULL && vif->type == NL80211_IFTYPE_AP) {
3268                 if (mwl8k_vif->macid + 1 == ffs(priv->ap_macids_supported))
3269                         mac_type = MWL8K_MAC_TYPE_PRIMARY_AP;
3270                 else
3271                         mac_type = MWL8K_MAC_TYPE_SECONDARY_AP;
3272         }
3273
3274         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3275         if (cmd == NULL)
3276                 return -ENOMEM;
3277
3278         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_MAC_ADDR);
3279         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3280         if (priv->ap_fw) {
3281                 cmd->mbss.mac_type = cpu_to_le16(mac_type);
3282                 memcpy(cmd->mbss.mac_addr, mac, ETH_ALEN);
3283         } else {
3284                 memcpy(cmd->mac_addr, mac, ETH_ALEN);
3285         }
3286
3287         rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3288         kfree(cmd);
3289
3290         return rc;
3291 }
3292
3293 /*
3294  * CMD_SET_RATEADAPT_MODE.
3295  */
3296 struct mwl8k_cmd_set_rate_adapt_mode {
3297         struct mwl8k_cmd_pkt header;
3298         __le16 action;
3299         __le16 mode;
3300 } __packed;
3301
3302 static int mwl8k_cmd_set_rateadapt_mode(struct ieee80211_hw *hw, __u16 mode)
3303 {
3304         struct mwl8k_cmd_set_rate_adapt_mode *cmd;
3305         int rc;
3306
3307         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3308         if (cmd == NULL)
3309                 return -ENOMEM;
3310
3311         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATEADAPT_MODE);
3312         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3313         cmd->action = cpu_to_le16(MWL8K_CMD_SET);
3314         cmd->mode = cpu_to_le16(mode);
3315
3316         rc = mwl8k_post_cmd(hw, &cmd->header);
3317         kfree(cmd);
3318
3319         return rc;
3320 }
3321
3322 /*
3323  * CMD_BSS_START.
3324  */
3325 struct mwl8k_cmd_bss_start {
3326         struct mwl8k_cmd_pkt header;
3327         __le32 enable;
3328 } __packed;
3329
3330 static int mwl8k_cmd_bss_start(struct ieee80211_hw *hw,
3331                                struct ieee80211_vif *vif, int enable)
3332 {
3333         struct mwl8k_cmd_bss_start *cmd;
3334         int rc;
3335
3336         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3337         if (cmd == NULL)
3338                 return -ENOMEM;
3339
3340         cmd->header.code = cpu_to_le16(MWL8K_CMD_BSS_START);
3341         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3342         cmd->enable = cpu_to_le32(enable);
3343
3344         rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3345         kfree(cmd);
3346
3347         return rc;
3348 }
3349
3350 /*
3351  * CMD_BASTREAM.
3352  */
3353
3354 /*
3355  * UPSTREAM is tx direction
3356  */
3357 #define BASTREAM_FLAG_DIRECTION_UPSTREAM        0x00
3358 #define BASTREAM_FLAG_IMMEDIATE_TYPE            0x01
3359
3360 enum {
3361         MWL8K_BA_CREATE,
3362         MWL8K_BA_UPDATE,
3363         MWL8K_BA_DESTROY,
3364         MWL8K_BA_FLUSH,
3365         MWL8K_BA_CHECK,
3366 } ba_stream_action_type;
3367
3368
3369 struct mwl8k_create_ba_stream {
3370         __le32  flags;
3371         __le32  idle_thrs;
3372         __le32  bar_thrs;
3373         __le32  window_size;
3374         u8      peer_mac_addr[6];
3375         u8      dialog_token;
3376         u8      tid;
3377         u8      queue_id;
3378         u8      param_info;
3379         __le32  ba_context;
3380         u8      reset_seq_no_flag;
3381         __le16  curr_seq_no;
3382         u8      sta_src_mac_addr[6];
3383 } __packed;
3384
3385 struct mwl8k_destroy_ba_stream {
3386         __le32  flags;
3387         __le32  ba_context;
3388 } __packed;
3389
3390 struct mwl8k_cmd_bastream {
3391         struct mwl8k_cmd_pkt    header;
3392         __le32  action;
3393         union {
3394                 struct mwl8k_create_ba_stream   create_params;
3395                 struct mwl8k_destroy_ba_stream  destroy_params;
3396         };
3397 } __packed;
3398
3399 static int
3400 mwl8k_check_ba(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream)
3401 {
3402         struct mwl8k_cmd_bastream *cmd;
3403         int rc;
3404
3405         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3406         if (cmd == NULL)
3407                 return -ENOMEM;
3408
3409         cmd->header.code = cpu_to_le16(MWL8K_CMD_BASTREAM);
3410         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3411
3412         cmd->action = cpu_to_le32(MWL8K_BA_CHECK);
3413
3414         cmd->create_params.queue_id = stream->idx;
3415         memcpy(&cmd->create_params.peer_mac_addr[0], stream->sta->addr,
3416                ETH_ALEN);
3417         cmd->create_params.tid = stream->tid;
3418
3419         cmd->create_params.flags =
3420                 cpu_to_le32(BASTREAM_FLAG_IMMEDIATE_TYPE) |
3421                 cpu_to_le32(BASTREAM_FLAG_DIRECTION_UPSTREAM);
3422
3423         rc = mwl8k_post_cmd(hw, &cmd->header);
3424
3425         kfree(cmd);
3426
3427         return rc;
3428 }
3429
3430 static int
3431 mwl8k_create_ba(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream,
3432                 u8 buf_size)
3433 {
3434         struct mwl8k_cmd_bastream *cmd;
3435         int rc;
3436
3437         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3438         if (cmd == NULL)
3439                 return -ENOMEM;
3440
3441
3442         cmd->header.code = cpu_to_le16(MWL8K_CMD_BASTREAM);
3443         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3444
3445         cmd->action = cpu_to_le32(MWL8K_BA_CREATE);
3446
3447         cmd->create_params.bar_thrs = cpu_to_le32((u32)buf_size);
3448         cmd->create_params.window_size = cpu_to_le32((u32)buf_size);
3449         cmd->create_params.queue_id = stream->idx;
3450
3451         memcpy(cmd->create_params.peer_mac_addr, stream->sta->addr, ETH_ALEN);
3452         cmd->create_params.tid = stream->tid;
3453         cmd->create_params.curr_seq_no = cpu_to_le16(0);
3454         cmd->create_params.reset_seq_no_flag = 1;
3455
3456         cmd->create_params.param_info =
3457                 (stream->sta->ht_cap.ampdu_factor &
3458                  IEEE80211_HT_AMPDU_PARM_FACTOR) |
3459                 ((stream->sta->ht_cap.ampdu_density << 2) &
3460                  IEEE80211_HT_AMPDU_PARM_DENSITY);
3461
3462         cmd->create_params.flags =
3463                 cpu_to_le32(BASTREAM_FLAG_IMMEDIATE_TYPE |
3464                                         BASTREAM_FLAG_DIRECTION_UPSTREAM);
3465
3466         rc = mwl8k_post_cmd(hw, &cmd->header);
3467
3468         wiphy_debug(hw->wiphy, "Created a BA stream for %pM : tid %d\n",
3469                 stream->sta->addr, stream->tid);
3470         kfree(cmd);
3471
3472         return rc;
3473 }
3474
3475 static void mwl8k_destroy_ba(struct ieee80211_hw *hw,
3476                              struct mwl8k_ampdu_stream *stream)
3477 {
3478         struct mwl8k_cmd_bastream *cmd;
3479
3480         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3481         if (cmd == NULL)
3482                 return;
3483
3484         cmd->header.code = cpu_to_le16(MWL8K_CMD_BASTREAM);
3485         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3486         cmd->action = cpu_to_le32(MWL8K_BA_DESTROY);
3487
3488         cmd->destroy_params.ba_context = cpu_to_le32(stream->idx);
3489         mwl8k_post_cmd(hw, &cmd->header);
3490
3491         wiphy_debug(hw->wiphy, "Deleted BA stream index %d\n", stream->idx);
3492
3493         kfree(cmd);
3494 }
3495
3496 /*
3497  * CMD_SET_NEW_STN.
3498  */
3499 struct mwl8k_cmd_set_new_stn {
3500         struct mwl8k_cmd_pkt header;
3501         __le16 aid;
3502         __u8 mac_addr[6];
3503         __le16 stn_id;
3504         __le16 action;
3505         __le16 rsvd;
3506         __le32 legacy_rates;
3507         __u8 ht_rates[4];
3508         __le16 cap_info;
3509         __le16 ht_capabilities_info;
3510         __u8 mac_ht_param_info;
3511         __u8 rev;
3512         __u8 control_channel;
3513         __u8 add_channel;
3514         __le16 op_mode;
3515         __le16 stbc;
3516         __u8 add_qos_info;
3517         __u8 is_qos_sta;
3518         __le32 fw_sta_ptr;
3519 } __packed;
3520
3521 #define MWL8K_STA_ACTION_ADD            0
3522 #define MWL8K_STA_ACTION_REMOVE         2
3523
3524 static int mwl8k_cmd_set_new_stn_add(struct ieee80211_hw *hw,
3525                                      struct ieee80211_vif *vif,
3526                                      struct ieee80211_sta *sta)
3527 {
3528         struct mwl8k_cmd_set_new_stn *cmd;
3529         u32 rates;
3530         int rc;
3531
3532         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3533         if (cmd == NULL)
3534                 return -ENOMEM;
3535
3536         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_NEW_STN);
3537         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3538         cmd->aid = cpu_to_le16(sta->aid);
3539         memcpy(cmd->mac_addr, sta->addr, ETH_ALEN);
3540         cmd->stn_id = cpu_to_le16(sta->aid);
3541         cmd->action = cpu_to_le16(MWL8K_STA_ACTION_ADD);
3542         if (hw->conf.channel->band == IEEE80211_BAND_2GHZ)
3543                 rates = sta->supp_rates[IEEE80211_BAND_2GHZ];
3544         else
3545                 rates = sta->supp_rates[IEEE80211_BAND_5GHZ] << 5;
3546         cmd->legacy_rates = cpu_to_le32(rates);
3547         if (sta->ht_cap.ht_supported) {
3548                 cmd->ht_rates[0] = sta->ht_cap.mcs.rx_mask[0];
3549                 cmd->ht_rates[1] = sta->ht_cap.mcs.rx_mask[1];
3550                 cmd->ht_rates[2] = sta->ht_cap.mcs.rx_mask[2];
3551                 cmd->ht_rates[3] = sta->ht_cap.mcs.rx_mask[3];
3552                 cmd->ht_capabilities_info = cpu_to_le16(sta->ht_cap.cap);
3553                 cmd->mac_ht_param_info = (sta->ht_cap.ampdu_factor & 3) |
3554                         ((sta->ht_cap.ampdu_density & 7) << 2);
3555                 cmd->is_qos_sta = 1;
3556         }
3557
3558         rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3559         kfree(cmd);
3560
3561         return rc;
3562 }
3563
3564 static int mwl8k_cmd_set_new_stn_add_self(struct ieee80211_hw *hw,
3565                                           struct ieee80211_vif *vif)
3566 {
3567         struct mwl8k_cmd_set_new_stn *cmd;
3568         int rc;
3569
3570         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3571         if (cmd == NULL)
3572                 return -ENOMEM;
3573
3574         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_NEW_STN);
3575         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3576         memcpy(cmd->mac_addr, vif->addr, ETH_ALEN);
3577
3578         rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3579         kfree(cmd);
3580
3581         return rc;
3582 }
3583
3584 static int mwl8k_cmd_set_new_stn_del(struct ieee80211_hw *hw,
3585                                      struct ieee80211_vif *vif, u8 *addr)
3586 {
3587         struct mwl8k_cmd_set_new_stn *cmd;
3588         int rc;
3589
3590         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3591         if (cmd == NULL)
3592                 return -ENOMEM;
3593
3594         cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_NEW_STN);
3595         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3596         memcpy(cmd->mac_addr, addr, ETH_ALEN);
3597         cmd->action = cpu_to_le16(MWL8K_STA_ACTION_REMOVE);
3598
3599         rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3600         kfree(cmd);
3601
3602         return rc;
3603 }
3604
3605 /*
3606  * CMD_UPDATE_ENCRYPTION.
3607  */
3608
3609 #define MAX_ENCR_KEY_LENGTH     16
3610 #define MIC_KEY_LENGTH          8
3611
3612 struct mwl8k_cmd_update_encryption {
3613         struct mwl8k_cmd_pkt header;
3614
3615         __le32 action;
3616         __le32 reserved;
3617         __u8 mac_addr[6];
3618         __u8 encr_type;
3619
3620 } __attribute__((packed));
3621
3622 struct mwl8k_cmd_set_key {
3623         struct mwl8k_cmd_pkt header;
3624
3625         __le32 action;
3626         __le32 reserved;
3627         __le16 length;
3628         __le16 key_type_id;
3629         __le32 key_info;
3630         __le32 key_id;
3631         __le16 key_len;
3632         __u8 key_material[MAX_ENCR_KEY_LENGTH];
3633         __u8 tkip_tx_mic_key[MIC_KEY_LENGTH];
3634         __u8 tkip_rx_mic_key[MIC_KEY_LENGTH];
3635         __le16 tkip_rsc_low;
3636         __le32 tkip_rsc_high;
3637         __le16 tkip_tsc_low;
3638         __le32 tkip_tsc_high;
3639         __u8 mac_addr[6];
3640 } __attribute__((packed));
3641
3642 enum {
3643         MWL8K_ENCR_ENABLE,
3644         MWL8K_ENCR_SET_KEY,
3645         MWL8K_ENCR_REMOVE_KEY,
3646         MWL8K_ENCR_SET_GROUP_KEY,
3647 };
3648
3649 #define MWL8K_UPDATE_ENCRYPTION_TYPE_WEP        0
3650 #define MWL8K_UPDATE_ENCRYPTION_TYPE_DISABLE    1
3651 #define MWL8K_UPDATE_ENCRYPTION_TYPE_TKIP       4
3652 #define MWL8K_UPDATE_ENCRYPTION_TYPE_MIXED      7
3653 #define MWL8K_UPDATE_ENCRYPTION_TYPE_AES        8
3654
3655 enum {
3656         MWL8K_ALG_WEP,
3657         MWL8K_ALG_TKIP,
3658         MWL8K_ALG_CCMP,
3659 };
3660
3661 #define MWL8K_KEY_FLAG_TXGROUPKEY       0x00000004
3662 #define MWL8K_KEY_FLAG_PAIRWISE         0x00000008
3663 #define MWL8K_KEY_FLAG_TSC_VALID        0x00000040
3664 #define MWL8K_KEY_FLAG_WEP_TXKEY        0x01000000
3665 #define MWL8K_KEY_FLAG_MICKEY_VALID     0x02000000
3666
3667 static int mwl8k_cmd_update_encryption_enable(struct ieee80211_hw *hw,
3668                                               struct ieee80211_vif *vif,
3669                                               u8 *addr,
3670                                               u8 encr_type)
3671 {
3672         struct mwl8k_cmd_update_encryption *cmd;
3673         int rc;
3674
3675         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3676         if (cmd == NULL)
3677                 return -ENOMEM;
3678
3679         cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_ENCRYPTION);
3680         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3681         cmd->action = cpu_to_le32(MWL8K_ENCR_ENABLE);
3682         memcpy(cmd->mac_addr, addr, ETH_ALEN);
3683         cmd->encr_type = encr_type;
3684
3685         rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3686         kfree(cmd);
3687
3688         return rc;
3689 }
3690
3691 static int mwl8k_encryption_set_cmd_info(struct mwl8k_cmd_set_key *cmd,
3692                                                 u8 *addr,
3693                                                 struct ieee80211_key_conf *key)
3694 {
3695         cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_ENCRYPTION);
3696         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3697         cmd->length = cpu_to_le16(sizeof(*cmd) -
3698                                 offsetof(struct mwl8k_cmd_set_key, length));
3699         cmd->key_id = cpu_to_le32(key->keyidx);
3700         cmd->key_len = cpu_to_le16(key->keylen);
3701         memcpy(cmd->mac_addr, addr, ETH_ALEN);
3702
3703         switch (key->cipher) {
3704         case WLAN_CIPHER_SUITE_WEP40:
3705         case WLAN_CIPHER_SUITE_WEP104:
3706                 cmd->key_type_id = cpu_to_le16(MWL8K_ALG_WEP);
3707                 if (key->keyidx == 0)
3708                         cmd->key_info = cpu_to_le32(MWL8K_KEY_FLAG_WEP_TXKEY);
3709
3710                 break;
3711         case WLAN_CIPHER_SUITE_TKIP:
3712                 cmd->key_type_id = cpu_to_le16(MWL8K_ALG_TKIP);
3713                 cmd->key_info = (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
3714                         ? cpu_to_le32(MWL8K_KEY_FLAG_PAIRWISE)
3715                         : cpu_to_le32(MWL8K_KEY_FLAG_TXGROUPKEY);
3716                 cmd->key_info |= cpu_to_le32(MWL8K_KEY_FLAG_MICKEY_VALID
3717                                                 | MWL8K_KEY_FLAG_TSC_VALID);
3718                 break;
3719         case WLAN_CIPHER_SUITE_CCMP:
3720                 cmd->key_type_id = cpu_to_le16(MWL8K_ALG_CCMP);
3721                 cmd->key_info = (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
3722                         ? cpu_to_le32(MWL8K_KEY_FLAG_PAIRWISE)
3723                         : cpu_to_le32(MWL8K_KEY_FLAG_TXGROUPKEY);
3724                 break;
3725         default:
3726                 return -ENOTSUPP;
3727         }
3728
3729         return 0;
3730 }
3731
3732 static int mwl8k_cmd_encryption_set_key(struct ieee80211_hw *hw,
3733                                                 struct ieee80211_vif *vif,
3734                                                 u8 *addr,
3735                                                 struct ieee80211_key_conf *key)
3736 {
3737         struct mwl8k_cmd_set_key *cmd;
3738         int rc;
3739         int keymlen;
3740         u32 action;
3741         u8 idx;
3742         struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
3743
3744         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3745         if (cmd == NULL)
3746                 return -ENOMEM;
3747
3748         rc = mwl8k_encryption_set_cmd_info(cmd, addr, key);
3749         if (rc < 0)
3750                 goto done;
3751
3752         idx = key->keyidx;
3753
3754         if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
3755                 action = MWL8K_ENCR_SET_KEY;
3756         else
3757                 action = MWL8K_ENCR_SET_GROUP_KEY;
3758
3759         switch (key->cipher) {
3760         case WLAN_CIPHER_SUITE_WEP40:
3761         case WLAN_CIPHER_SUITE_WEP104:
3762                 if (!mwl8k_vif->wep_key_conf[idx].enabled) {
3763                         memcpy(mwl8k_vif->wep_key_conf[idx].key, key,
3764                                                 sizeof(*key) + key->keylen);
3765                         mwl8k_vif->wep_key_conf[idx].enabled = 1;
3766                 }
3767
3768                 keymlen = 0;
3769                 action = MWL8K_ENCR_SET_KEY;
3770                 break;
3771         case WLAN_CIPHER_SUITE_TKIP:
3772                 keymlen = MAX_ENCR_KEY_LENGTH + 2 * MIC_KEY_LENGTH;
3773                 break;
3774         case WLAN_CIPHER_SUITE_CCMP:
3775                 keymlen = key->keylen;
3776                 break;
3777         default:
3778                 rc = -ENOTSUPP;
3779                 goto done;
3780         }
3781
3782         memcpy(cmd->key_material, key->key, keymlen);
3783         cmd->action = cpu_to_le32(action);
3784
3785         rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3786 done:
3787         kfree(cmd);
3788
3789         return rc;
3790 }
3791
3792 static int mwl8k_cmd_encryption_remove_key(struct ieee80211_hw *hw,
3793                                                 struct ieee80211_vif *vif,
3794                                                 u8 *addr,
3795                                                 struct ieee80211_key_conf *key)
3796 {
3797         struct mwl8k_cmd_set_key *cmd;
3798         int rc;
3799         struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
3800
3801         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3802         if (cmd == NULL)
3803                 return -ENOMEM;
3804
3805         rc = mwl8k_encryption_set_cmd_info(cmd, addr, key);
3806         if (rc < 0)
3807                 goto done;
3808
3809         if (key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
3810                         WLAN_CIPHER_SUITE_WEP104)
3811                 mwl8k_vif->wep_key_conf[key->keyidx].enabled = 0;
3812
3813         cmd->action = cpu_to_le32(MWL8K_ENCR_REMOVE_KEY);
3814
3815         rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3816 done:
3817         kfree(cmd);
3818
3819         return rc;
3820 }
3821
3822 static int mwl8k_set_key(struct ieee80211_hw *hw,
3823                          enum set_key_cmd cmd_param,
3824                          struct ieee80211_vif *vif,
3825                          struct ieee80211_sta *sta,
3826                          struct ieee80211_key_conf *key)
3827 {
3828         int rc = 0;
3829         u8 encr_type;
3830         u8 *addr;
3831         struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
3832
3833         if (vif->type == NL80211_IFTYPE_STATION)
3834                 return -EOPNOTSUPP;
3835
3836         if (sta == NULL)
3837                 addr = hw->wiphy->perm_addr;
3838         else
3839                 addr = sta->addr;
3840
3841         if (cmd_param == SET_KEY) {
3842                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3843                 rc = mwl8k_cmd_encryption_set_key(hw, vif, addr, key);
3844                 if (rc)
3845                         goto out;
3846
3847                 if ((key->cipher == WLAN_CIPHER_SUITE_WEP40)
3848                                 || (key->cipher == WLAN_CIPHER_SUITE_WEP104))
3849                         encr_type = MWL8K_UPDATE_ENCRYPTION_TYPE_WEP;
3850                 else
3851                         encr_type = MWL8K_UPDATE_ENCRYPTION_TYPE_MIXED;
3852
3853                 rc = mwl8k_cmd_update_encryption_enable(hw, vif, addr,
3854                                                                 encr_type);
3855                 if (rc)
3856                         goto out;
3857
3858                 mwl8k_vif->is_hw_crypto_enabled = true;
3859
3860         } else {
3861                 rc = mwl8k_cmd_encryption_remove_key(hw, vif, addr, key);
3862
3863                 if (rc)
3864                         goto out;
3865
3866                 mwl8k_vif->is_hw_crypto_enabled = false;
3867
3868         }
3869 out:
3870         return rc;
3871 }
3872
3873 /*
3874  * CMD_UPDATE_STADB.
3875  */
3876 struct ewc_ht_info {
3877         __le16  control1;
3878         __le16  control2;
3879         __le16  control3;
3880 } __packed;
3881
3882 struct peer_capability_info {
3883         /* Peer type - AP vs. STA.  */
3884         __u8    peer_type;
3885
3886         /* Basic 802.11 capabilities from assoc resp.  */
3887         __le16  basic_caps;
3888
3889         /* Set if peer supports 802.11n high throughput (HT).  */
3890         __u8    ht_support;
3891
3892         /* Valid if HT is supported.  */
3893         __le16  ht_caps;
3894         __u8    extended_ht_caps;
3895         struct ewc_ht_info      ewc_info;
3896
3897         /* Legacy rate table. Intersection of our rates and peer rates.  */
3898         __u8    legacy_rates[12];
3899
3900         /* HT rate table. Intersection of our rates and peer rates.  */
3901         __u8    ht_rates[16];
3902         __u8    pad[16];
3903
3904         /* If set, interoperability mode, no proprietary extensions.  */
3905         __u8    interop;
3906         __u8    pad2;
3907         __u8    station_id;
3908         __le16  amsdu_enabled;
3909 } __packed;
3910
3911 struct mwl8k_cmd_update_stadb {
3912         struct mwl8k_cmd_pkt header;
3913
3914         /* See STADB_ACTION_TYPE */
3915         __le32  action;
3916
3917         /* Peer MAC address */
3918         __u8    peer_addr[ETH_ALEN];
3919
3920         __le32  reserved;
3921
3922         /* Peer info - valid during add/update.  */
3923         struct peer_capability_info     peer_info;
3924 } __packed;
3925
3926 #define MWL8K_STA_DB_MODIFY_ENTRY       1
3927 #define MWL8K_STA_DB_DEL_ENTRY          2
3928
3929 /* Peer Entry flags - used to define the type of the peer node */
3930 #define MWL8K_PEER_TYPE_ACCESSPOINT     2
3931
3932 static int mwl8k_cmd_update_stadb_add(struct ieee80211_hw *hw,
3933                                       struct ieee80211_vif *vif,
3934                                       struct ieee80211_sta *sta)
3935 {
3936         struct mwl8k_cmd_update_stadb *cmd;
3937         struct peer_capability_info *p;
3938         u32 rates;
3939         int rc;
3940
3941         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3942         if (cmd == NULL)
3943                 return -ENOMEM;
3944
3945         cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_STADB);
3946         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3947         cmd->action = cpu_to_le32(MWL8K_STA_DB_MODIFY_ENTRY);
3948         memcpy(cmd->peer_addr, sta->addr, ETH_ALEN);
3949
3950         p = &cmd->peer_info;
3951         p->peer_type = MWL8K_PEER_TYPE_ACCESSPOINT;
3952         p->basic_caps = cpu_to_le16(vif->bss_conf.assoc_capability);
3953         p->ht_support = sta->ht_cap.ht_supported;
3954         p->ht_caps = cpu_to_le16(sta->ht_cap.cap);
3955         p->extended_ht_caps = (sta->ht_cap.ampdu_factor & 3) |
3956                 ((sta->ht_cap.ampdu_density & 7) << 2);
3957         if (hw->conf.channel->band == IEEE80211_BAND_2GHZ)
3958                 rates = sta->supp_rates[IEEE80211_BAND_2GHZ];
3959         else
3960                 rates = sta->supp_rates[IEEE80211_BAND_5GHZ] << 5;
3961         legacy_rate_mask_to_array(p->legacy_rates, rates);
3962         memcpy(p->ht_rates, sta->ht_cap.mcs.rx_mask, 16);
3963         p->interop = 1;
3964         p->amsdu_enabled = 0;
3965
3966         rc = mwl8k_post_cmd(hw, &cmd->header);
3967         kfree(cmd);
3968
3969         return rc ? rc : p->station_id;
3970 }
3971
3972 static int mwl8k_cmd_update_stadb_del(struct ieee80211_hw *hw,
3973                                       struct ieee80211_vif *vif, u8 *addr)
3974 {
3975         struct mwl8k_cmd_update_stadb *cmd;
3976         int rc;
3977
3978         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3979         if (cmd == NULL)
3980                 return -ENOMEM;
3981
3982         cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_STADB);
3983         cmd->header.length = cpu_to_le16(sizeof(*cmd));
3984         cmd->action = cpu_to_le32(MWL8K_STA_DB_DEL_ENTRY);
3985         memcpy(cmd->peer_addr, addr, ETH_ALEN);
3986
3987         rc = mwl8k_post_cmd(hw, &cmd->header);
3988         kfree(cmd);
3989
3990         return rc;
3991 }
3992
3993
3994 /*
3995  * Interrupt handling.
3996  */
3997 static irqreturn_t mwl8k_interrupt(int irq, void *dev_id)
3998 {
3999         struct ieee80211_hw *hw = dev_id;
4000         struct mwl8k_priv *priv = hw->priv;
4001         u32 status;
4002
4003         status = ioread32(priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
4004         if (!status)
4005                 return IRQ_NONE;
4006
4007         if (status & MWL8K_A2H_INT_TX_DONE) {
4008                 status &= ~MWL8K_A2H_INT_TX_DONE;
4009                 tasklet_schedule(&priv->poll_tx_task);
4010         }
4011
4012         if (status & MWL8K_A2H_INT_RX_READY) {
4013                 status &= ~MWL8K_A2H_INT_RX_READY;
4014                 tasklet_schedule(&priv->poll_rx_task);
4015         }
4016
4017         if (status)
4018                 iowrite32(~status, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
4019
4020         if (status & MWL8K_A2H_INT_OPC_DONE) {
4021                 if (priv->hostcmd_wait != NULL)
4022                         complete(priv->hostcmd_wait);
4023         }
4024
4025         if (status & MWL8K_A2H_INT_QUEUE_EMPTY) {
4026                 if (!mutex_is_locked(&priv->fw_mutex) &&
4027                     priv->radio_on && priv->pending_tx_pkts)
4028                         mwl8k_tx_start(priv);
4029         }
4030
4031         return IRQ_HANDLED;
4032 }
4033
4034 static void mwl8k_tx_poll(unsigned long data)
4035 {
4036         struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
4037         struct mwl8k_priv *priv = hw->priv;
4038         int limit;
4039         int i;
4040
4041         limit = 32;
4042
4043         spin_lock_bh(&priv->tx_lock);
4044
4045         for (i = 0; i < mwl8k_tx_queues(priv); i++)
4046                 limit -= mwl8k_txq_reclaim(hw, i, limit, 0);
4047
4048         if (!priv->pending_tx_pkts && priv->tx_wait != NULL) {
4049                 complete(priv->tx_wait);
4050                 priv->tx_wait = NULL;
4051         }
4052
4053         spin_unlock_bh(&priv->tx_lock);
4054
4055         if (limit) {
4056                 writel(~MWL8K_A2H_INT_TX_DONE,
4057                        priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
4058         } else {
4059                 tasklet_schedule(&priv->poll_tx_task);
4060         }
4061 }
4062
4063 static void mwl8k_rx_poll(unsigned long data)
4064 {
4065         struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
4066         struct mwl8k_priv *priv = hw->priv;
4067         int limit;
4068
4069         limit = 32;
4070         limit -= rxq_process(hw, 0, limit);
4071         limit -= rxq_refill(hw, 0, limit);
4072
4073         if (limit) {
4074                 writel(~MWL8K_A2H_INT_RX_READY,
4075                        priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
4076         } else {
4077                 tasklet_schedule(&priv->poll_rx_task);
4078         }
4079 }
4080
4081
4082 /*
4083  * Core driver operations.
4084  */
4085 static void mwl8k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
4086 {
4087         struct mwl8k_priv *priv = hw->priv;
4088         int index = skb_get_queue_mapping(skb);
4089
4090         if (!priv->radio_on) {
4091                 wiphy_debug(hw->wiphy,
4092                             "dropped TX frame since radio disabled\n");
4093                 dev_kfree_skb(skb);
4094                 return;
4095         }
4096
4097         mwl8k_txq_xmit(hw, index, skb);
4098 }
4099
4100 static int mwl8k_start(struct ieee80211_hw *hw)
4101 {
4102         struct mwl8k_priv *priv = hw->priv;
4103         int rc;
4104
4105         rc = request_irq(priv->pdev->irq, mwl8k_interrupt,
4106                          IRQF_SHARED, MWL8K_NAME, hw);
4107         if (rc) {
4108                 wiphy_err(hw->wiphy, "failed to register IRQ handler\n");
4109                 return -EIO;
4110         }
4111
4112         /* Enable TX reclaim and RX tasklets.  */
4113         tasklet_enable(&priv->poll_tx_task);
4114         tasklet_enable(&priv->poll_rx_task);
4115
4116         /* Enable interrupts */
4117         iowrite32(MWL8K_A2H_EVENTS, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
4118
4119         rc = mwl8k_fw_lock(hw);
4120         if (!rc) {
4121                 rc = mwl8k_cmd_radio_enable(hw);
4122
4123                 if (!priv->ap_fw) {
4124                         if (!rc)
4125                                 rc = mwl8k_cmd_enable_sniffer(hw, 0);
4126
4127                         if (!rc)
4128                                 rc = mwl8k_cmd_set_pre_scan(hw);
4129
4130                         if (!rc)
4131                                 rc = mwl8k_cmd_set_post_scan(hw,
4132                                                 "\x00\x00\x00\x00\x00\x00");
4133                 }
4134
4135                 if (!rc)
4136                         rc = mwl8k_cmd_set_rateadapt_mode(hw, 0);
4137
4138                 if (!rc)
4139                         rc = mwl8k_cmd_set_wmm_mode(hw, 0);
4140
4141                 mwl8k_fw_unlock(hw);
4142         }
4143
4144         if (rc) {
4145                 iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
4146                 free_irq(priv->pdev->irq, hw);
4147                 tasklet_disable(&priv->poll_tx_task);
4148                 tasklet_disable(&priv->poll_rx_task);
4149         }
4150
4151         return rc;
4152 }
4153
4154 static void mwl8k_stop(struct ieee80211_hw *hw)
4155 {
4156         struct mwl8k_priv *priv = hw->priv;
4157         int i;
4158
4159         mwl8k_cmd_radio_disable(hw);
4160
4161         ieee80211_stop_queues(hw);
4162
4163         /* Disable interrupts */
4164         iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
4165         free_irq(priv->pdev->irq, hw);
4166
4167         /* Stop finalize join worker */
4168         cancel_work_sync(&priv->finalize_join_worker);
4169         if (priv->beacon_skb != NULL)
4170                 dev_kfree_skb(priv->beacon_skb);
4171
4172         /* Stop TX reclaim and RX tasklets.  */
4173         tasklet_disable(&priv->poll_tx_task);
4174         tasklet_disable(&priv->poll_rx_task);
4175
4176         /* Return all skbs to mac80211 */
4177         for (i = 0; i < mwl8k_tx_queues(priv); i++)
4178                 mwl8k_txq_reclaim(hw, i, INT_MAX, 1);
4179 }
4180
4181 static int mwl8k_reload_firmware(struct ieee80211_hw *hw, char *fw_image);
4182
4183 static int mwl8k_add_interface(struct ieee80211_hw *hw,
4184                                struct ieee80211_vif *vif)
4185 {
4186         struct mwl8k_priv *priv = hw->priv;
4187         struct mwl8k_vif *mwl8k_vif;
4188         u32 macids_supported;
4189         int macid, rc;
4190         struct mwl8k_device_info *di;
4191
4192         /*
4193          * Reject interface creation if sniffer mode is active, as
4194          * STA operation is mutually exclusive with hardware sniffer
4195          * mode.  (Sniffer mode is only used on STA firmware.)
4196          */
4197         if (priv->sniffer_enabled) {
4198                 wiphy_info(hw->wiphy,
4199                            "unable to create STA interface because sniffer mode is enabled\n");
4200                 return -EINVAL;
4201         }
4202
4203         di = priv->device_info;
4204         switch (vif->type) {
4205         case NL80211_IFTYPE_AP:
4206                 if (!priv->ap_fw && di->fw_image_ap) {
4207                         /* we must load the ap fw to meet this request */
4208                         if (!list_empty(&priv->vif_list))
4209                                 return -EBUSY;
4210                         rc = mwl8k_reload_firmware(hw, di->fw_image_ap);
4211                         if (rc)
4212                                 return rc;
4213                 }
4214                 macids_supported = priv->ap_macids_supported;
4215                 break;
4216         case NL80211_IFTYPE_STATION:
4217                 if (priv->ap_fw && di->fw_image_sta) {
4218                         /* we must load the sta fw to meet this request */
4219                         if (!list_empty(&priv->vif_list))
4220                                 return -EBUSY;
4221                         rc = mwl8k_reload_firmware(hw, di->fw_image_sta);
4222                         if (rc)
4223                                 return rc;
4224                 }
4225                 macids_supported = priv->sta_macids_supported;
4226                 break;
4227         default:
4228                 return -EINVAL;
4229         }
4230
4231         macid = ffs(macids_supported & ~priv->macids_used);
4232         if (!macid--)
4233                 return -EBUSY;
4234
4235         /* Setup driver private area. */
4236         mwl8k_vif = MWL8K_VIF(vif);
4237         memset(mwl8k_vif, 0, sizeof(*mwl8k_vif));
4238         mwl8k_vif->vif = vif;
4239         mwl8k_vif->macid = macid;
4240         mwl8k_vif->seqno = 0;
4241         memcpy(mwl8k_vif->bssid, vif->addr, ETH_ALEN);
4242         mwl8k_vif->is_hw_crypto_enabled = false;
4243
4244         /* Set the mac address.  */
4245         mwl8k_cmd_set_mac_addr(hw, vif, vif->addr);
4246
4247         if (priv->ap_fw)
4248                 mwl8k_cmd_set_new_stn_add_self(hw, vif);
4249
4250         priv->macids_used |= 1 << mwl8k_vif->macid;
4251         list_add_tail(&mwl8k_vif->list, &priv->vif_list);
4252
4253         return 0;
4254 }
4255
4256 static void mwl8k_remove_interface(struct ieee80211_hw *hw,
4257                                    struct ieee80211_vif *vif)
4258 {
4259         struct mwl8k_priv *priv = hw->priv;
4260         struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
4261
4262         if (priv->ap_fw)
4263                 mwl8k_cmd_set_new_stn_del(hw, vif, vif->addr);
4264
4265         mwl8k_cmd_set_mac_addr(hw, vif, "\x00\x00\x00\x00\x00\x00");
4266
4267         priv->macids_used &= ~(1 << mwl8k_vif->macid);
4268         list_del(&mwl8k_vif->list);
4269 }
4270
4271 static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
4272 {
4273         struct ieee80211_conf *conf = &hw->conf;
4274         struct mwl8k_priv *priv = hw->priv;
4275         int rc;
4276
4277         if (conf->flags & IEEE80211_CONF_IDLE) {
4278                 mwl8k_cmd_radio_disable(hw);
4279                 return 0;
4280         }
4281
4282         rc = mwl8k_fw_lock(hw);
4283         if (rc)
4284                 return rc;
4285
4286         rc = mwl8k_cmd_radio_enable(hw);
4287         if (rc)
4288                 goto out;
4289
4290         rc = mwl8k_cmd_set_rf_channel(hw, conf);
4291         if (rc)
4292                 goto out;
4293
4294         if (conf->power_level > 18)
4295                 conf->power_level = 18;
4296
4297         if (priv->ap_fw) {
4298                 rc = mwl8k_cmd_tx_power(hw, conf, conf->power_level);
4299                 if (rc)
4300                         goto out;
4301
4302                 rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_RX, 0x3);
4303                 if (rc)
4304                         wiphy_warn(hw->wiphy, "failed to set # of RX antennas");
4305                 rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_TX, 0x7);
4306                 if (rc)
4307                         wiphy_warn(hw->wiphy, "failed to set # of TX antennas");
4308
4309         } else {
4310                 rc = mwl8k_cmd_rf_tx_power(hw, conf->power_level);
4311                 if (rc)
4312                         goto out;
4313                 rc = mwl8k_cmd_mimo_config(hw, 0x7, 0x7);
4314         }
4315
4316 out:
4317         mwl8k_fw_unlock(hw);
4318
4319         return rc;
4320 }
4321
4322 static void
4323 mwl8k_bss_info_changed_sta(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
4324                            struct ieee80211_bss_conf *info, u32 changed)
4325 {
4326         struct mwl8k_priv *priv = hw->priv;
4327         u32 ap_legacy_rates;
4328         u8 ap_mcs_rates[16];
4329         int rc;
4330
4331         if (mwl8k_fw_lock(hw))
4332                 return;
4333
4334         /*
4335          * No need to capture a beacon if we're no longer associated.
4336          */
4337         if ((changed & BSS_CHANGED_ASSOC) && !vif->bss_conf.assoc)
4338                 priv->capture_beacon = false;
4339
4340         /*
4341          * Get the AP's legacy and MCS rates.
4342          */
4343         if (vif->bss_conf.assoc) {
4344                 struct ieee80211_sta *ap;
4345
4346                 rcu_read_lock();
4347
4348                 ap = ieee80211_find_sta(vif, vif->bss_conf.bssid);
4349                 if (ap == NULL) {
4350                         rcu_read_unlock();
4351                         goto out;
4352                 }
4353
4354                 if (hw->conf.channel->band == IEEE80211_BAND_2GHZ) {
4355                         ap_legacy_rates = ap->supp_rates[IEEE80211_BAND_2GHZ];
4356                 } else {
4357                         ap_legacy_rates =
4358                                 ap->supp_rates[IEEE80211_BAND_5GHZ] << 5;
4359                 }
4360                 memcpy(ap_mcs_rates, ap->ht_cap.mcs.rx_mask, 16);
4361
4362                 rcu_read_unlock();
4363         }
4364
4365         if ((changed & BSS_CHANGED_ASSOC) && vif->bss_conf.assoc) {
4366                 rc = mwl8k_cmd_set_rate(hw, vif, ap_legacy_rates, ap_mcs_rates);
4367                 if (rc)
4368                         goto out;
4369
4370                 rc = mwl8k_cmd_use_fixed_rate_sta(hw);
4371                 if (rc)
4372                         goto out;
4373         }
4374
4375         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
4376                 rc = mwl8k_set_radio_preamble(hw,
4377                                 vif->bss_conf.use_short_preamble);
4378                 if (rc)
4379                         goto out;
4380         }
4381
4382         if (changed & BSS_CHANGED_ERP_SLOT) {
4383                 rc = mwl8k_cmd_set_slot(hw, vif->bss_conf.use_short_slot);
4384                 if (rc)
4385                         goto out;
4386         }
4387
4388         if (vif->bss_conf.assoc &&
4389             (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_ERP_CTS_PROT |
4390                         BSS_CHANGED_HT))) {
4391                 rc = mwl8k_cmd_set_aid(hw, vif, ap_legacy_rates);
4392                 if (rc)
4393                         goto out;
4394         }
4395
4396         if (vif->bss_conf.assoc &&
4397             (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_BEACON_INT))) {
4398                 /*
4399                  * Finalize the join.  Tell rx handler to process
4400                  * next beacon from our BSSID.
4401                  */
4402                 memcpy(priv->capture_bssid, vif->bss_conf.bssid, ETH_ALEN);
4403                 priv->capture_beacon = true;
4404         }
4405
4406 out:
4407         mwl8k_fw_unlock(hw);
4408 }
4409
4410 static void
4411 mwl8k_bss_info_changed_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
4412                           struct ieee80211_bss_conf *info, u32 changed)
4413 {
4414         int rc;
4415
4416         if (mwl8k_fw_lock(hw))
4417                 return;
4418
4419         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
4420                 rc = mwl8k_set_radio_preamble(hw,
4421                                 vif->bss_conf.use_short_preamble);
4422                 if (rc)
4423                         goto out;
4424         }
4425
4426         if (changed & BSS_CHANGED_BASIC_RATES) {
4427                 int idx;
4428                 int rate;
4429
4430                 /*
4431                  * Use lowest supported basic rate for multicasts
4432                  * and management frames (such as probe responses --
4433                  * beacons will always go out at 1 Mb/s).
4434                  */
4435                 idx = ffs(vif->bss_conf.basic_rates);
4436                 if (idx)
4437                         idx--;
4438
4439                 if (hw->conf.channel->band == IEEE80211_BAND_2GHZ)
4440                         rate = mwl8k_rates_24[idx].hw_value;
4441                 else
4442                         rate = mwl8k_rates_50[idx].hw_value;
4443
4444                 mwl8k_cmd_use_fixed_rate_ap(hw, rate, rate);
4445         }
4446
4447         if (changed & (BSS_CHANGED_BEACON_INT | BSS_CHANGED_BEACON)) {
4448                 struct sk_buff *skb;
4449
4450                 skb = ieee80211_beacon_get(hw, vif);
4451                 if (skb != NULL) {
4452                         mwl8k_cmd_set_beacon(hw, vif, skb->data, skb->len);
4453                         kfree_skb(skb);
4454                 }
4455         }
4456
4457         if (changed & BSS_CHANGED_BEACON_ENABLED)
4458                 mwl8k_cmd_bss_start(hw, vif, info->enable_beacon);
4459
4460 out:
4461         mwl8k_fw_unlock(hw);
4462 }
4463
4464 static void
4465 mwl8k_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
4466                        struct ieee80211_bss_conf *info, u32 changed)
4467 {
4468         struct mwl8k_priv *priv = hw->priv;
4469
4470         if (!priv->ap_fw)
4471                 mwl8k_bss_info_changed_sta(hw, vif, info, changed);
4472         else
4473                 mwl8k_bss_info_changed_ap(hw, vif, info, changed);
4474 }
4475
4476 static u64 mwl8k_prepare_multicast(struct ieee80211_hw *hw,
4477                                    struct netdev_hw_addr_list *mc_list)
4478 {
4479         struct mwl8k_cmd_pkt *cmd;
4480
4481         /*
4482          * Synthesize and return a command packet that programs the
4483          * hardware multicast address filter.  At this point we don't
4484          * know whether FIF_ALLMULTI is being requested, but if it is,
4485          * we'll end up throwing this packet away and creating a new
4486          * one in mwl8k_configure_filter().
4487          */
4488         cmd = __mwl8k_cmd_mac_multicast_adr(hw, 0, mc_list);
4489
4490         return (unsigned long)cmd;
4491 }
4492
4493 static int
4494 mwl8k_configure_filter_sniffer(struct ieee80211_hw *hw,
4495                                unsigned int changed_flags,
4496                                unsigned int *total_flags)
4497 {
4498         struct mwl8k_priv *priv = hw->priv;
4499
4500         /*
4501          * Hardware sniffer mode is mutually exclusive with STA
4502          * operation, so refuse to enable sniffer mode if a STA
4503          * interface is active.
4504          */
4505         if (!list_empty(&priv->vif_list)) {
4506                 if (net_ratelimit())
4507                         wiphy_info(hw->wiphy,
4508                                    "not enabling sniffer mode because STA interface is active\n");
4509                 return 0;
4510         }
4511
4512         if (!priv->sniffer_enabled) {
4513                 if (mwl8k_cmd_enable_sniffer(hw, 1))
4514                         return 0;
4515                 priv->sniffer_enabled = true;
4516         }
4517
4518         *total_flags &= FIF_PROMISC_IN_BSS | FIF_ALLMULTI |
4519                         FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL |
4520                         FIF_OTHER_BSS;
4521
4522         return 1;
4523 }
4524
4525 static struct mwl8k_vif *mwl8k_first_vif(struct mwl8k_priv *priv)
4526 {
4527         if (!list_empty(&priv->vif_list))
4528                 return list_entry(priv->vif_list.next, struct mwl8k_vif, list);
4529
4530         return NULL;
4531 }
4532
4533 static void mwl8k_configure_filter(struct ieee80211_hw *hw,
4534                                    unsigned int changed_flags,
4535                                    unsigned int *total_flags,
4536                                    u64 multicast)
4537 {
4538         struct mwl8k_priv *priv = hw->priv;
4539         struct mwl8k_cmd_pkt *cmd = (void *)(unsigned long)multicast;
4540
4541         /*
4542          * AP firmware doesn't allow fine-grained control over
4543          * the receive filter.
4544          */
4545         if (priv->ap_fw) {
4546                 *total_flags &= FIF_ALLMULTI | FIF_BCN_PRBRESP_PROMISC;
4547                 kfree(cmd);
4548                 return;
4549         }
4550
4551         /*
4552          * Enable hardware sniffer mode if FIF_CONTROL or
4553          * FIF_OTHER_BSS is requested.
4554          */
4555         if (*total_flags & (FIF_CONTROL | FIF_OTHER_BSS) &&
4556             mwl8k_configure_filter_sniffer(hw, changed_flags, total_flags)) {
4557                 kfree(cmd);
4558                 return;
4559         }
4560
4561         /* Clear unsupported feature flags */
4562         *total_flags &= FIF_ALLMULTI | FIF_BCN_PRBRESP_PROMISC;
4563
4564         if (mwl8k_fw_lock(hw)) {
4565                 kfree(cmd);
4566                 return;
4567         }
4568
4569         if (priv->sniffer_enabled) {
4570                 mwl8k_cmd_enable_sniffer(hw, 0);
4571                 priv->sniffer_enabled = false;
4572         }
4573
4574         if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
4575                 if (*total_flags & FIF_BCN_PRBRESP_PROMISC) {
4576                         /*
4577                          * Disable the BSS filter.
4578                          */
4579                         mwl8k_cmd_set_pre_scan(hw);
4580                 } else {
4581                         struct mwl8k_vif *mwl8k_vif;
4582                         const u8 *bssid;
4583
4584                         /*
4585                          * Enable the BSS filter.
4586                          *
4587                          * If there is an active STA interface, use that
4588                          * interface's BSSID, otherwise use a dummy one
4589                          * (where the OUI part needs to be nonzero for
4590                          * the BSSID to be accepted by POST_SCAN).
4591                          */
4592                         mwl8k_vif = mwl8k_first_vif(priv);
4593                         if (mwl8k_vif != NULL)
4594                                 bssid = mwl8k_vif->vif->bss_conf.bssid;
4595                         else
4596                                 bssid = "\x01\x00\x00\x00\x00\x00";
4597
4598                         mwl8k_cmd_set_post_scan(hw, bssid);
4599                 }
4600         }
4601
4602         /*
4603          * If FIF_ALLMULTI is being requested, throw away the command
4604          * packet that ->prepare_multicast() built and replace it with
4605          * a command packet that enables reception of all multicast
4606          * packets.
4607          */
4608         if (*total_flags & FIF_ALLMULTI) {
4609                 kfree(cmd);
4610                 cmd = __mwl8k_cmd_mac_multicast_adr(hw, 1, NULL);
4611         }
4612
4613         if (cmd != NULL) {
4614                 mwl8k_post_cmd(hw, cmd);
4615                 kfree(cmd);
4616         }
4617
4618         mwl8k_fw_unlock(hw);
4619 }
4620
4621 static int mwl8k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
4622 {
4623         return mwl8k_cmd_set_rts_threshold(hw, value);
4624 }
4625
4626 static int mwl8k_sta_remove(struct ieee80211_hw *hw,
4627                             struct ieee80211_vif *vif,
4628                             struct ieee80211_sta *sta)
4629 {
4630         struct mwl8k_priv *priv = hw->priv;
4631
4632         if (priv->ap_fw)
4633                 return mwl8k_cmd_set_new_stn_del(hw, vif, sta->addr);
4634         else
4635                 return mwl8k_cmd_update_stadb_del(hw, vif, sta->addr);
4636 }
4637
4638 static int mwl8k_sta_add(struct ieee80211_hw *hw,
4639                          struct ieee80211_vif *vif,
4640                          struct ieee80211_sta *sta)
4641 {
4642         struct mwl8k_priv *priv = hw->priv;
4643         int ret;
4644         int i;
4645         struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
4646         struct ieee80211_key_conf *key;
4647
4648         if (!priv->ap_fw) {
4649                 ret = mwl8k_cmd_update_stadb_add(hw, vif, sta);
4650                 if (ret >= 0) {
4651                         MWL8K_STA(sta)->peer_id = ret;
4652                         ret = 0;
4653                 }
4654
4655         } else {
4656                 ret = mwl8k_cmd_set_new_stn_add(hw, vif, sta);
4657         }
4658
4659         for (i = 0; i < NUM_WEP_KEYS; i++) {
4660                 key = IEEE80211_KEY_CONF(mwl8k_vif->wep_key_conf[i].key);
4661                 if (mwl8k_vif->wep_key_conf[i].enabled)
4662                         mwl8k_set_key(hw, SET_KEY, vif, sta, key);
4663         }
4664         return ret;
4665 }
4666
4667 static int mwl8k_conf_tx(struct ieee80211_hw *hw, u16 queue,
4668                          const struct ieee80211_tx_queue_params *params)
4669 {
4670         struct mwl8k_priv *priv = hw->priv;
4671         int rc;
4672
4673         rc = mwl8k_fw_lock(hw);
4674         if (!rc) {
4675                 BUG_ON(queue > MWL8K_TX_WMM_QUEUES - 1);
4676                 memcpy(&priv->wmm_params[queue], params, sizeof(*params));
4677
4678                 if (!priv->wmm_enabled)
4679                         rc = mwl8k_cmd_set_wmm_mode(hw, 1);
4680
4681                 if (!rc) {
4682                         int q = MWL8K_TX_WMM_QUEUES - 1 - queue;
4683                         rc = mwl8k_cmd_set_edca_params(hw, q,
4684                                                        params->cw_min,
4685                                                        params->cw_max,
4686                                                        params->aifs,
4687                                                        params->txop);
4688                 }
4689
4690                 mwl8k_fw_unlock(hw);
4691         }
4692
4693         return rc;
4694 }
4695
4696 static int mwl8k_get_stats(struct ieee80211_hw *hw,
4697                            struct ieee80211_low_level_stats *stats)
4698 {
4699         return mwl8k_cmd_get_stat(hw, stats);
4700 }
4701
4702 static int mwl8k_get_survey(struct ieee80211_hw *hw, int idx,
4703                                 struct survey_info *survey)
4704 {
4705         struct mwl8k_priv *priv = hw->priv;
4706         struct ieee80211_conf *conf = &hw->conf;
4707
4708         if (idx != 0)
4709                 return -ENOENT;
4710
4711         survey->channel = conf->channel;
4712         survey->filled = SURVEY_INFO_NOISE_DBM;
4713         survey->noise = priv->noise;
4714
4715         return 0;
4716 }
4717
4718 #define MAX_AMPDU_ATTEMPTS 5
4719
4720 static int
4721 mwl8k_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
4722                    enum ieee80211_ampdu_mlme_action action,
4723                    struct ieee80211_sta *sta, u16 tid, u16 *ssn,
4724                    u8 buf_size)
4725 {
4726
4727         int i, rc = 0;
4728         struct mwl8k_priv *priv = hw->priv;
4729         struct mwl8k_ampdu_stream *stream;
4730         u8 *addr = sta->addr;
4731
4732         if (!(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
4733                 return -ENOTSUPP;
4734
4735         spin_lock(&priv->stream_lock);
4736         stream = mwl8k_lookup_stream(hw, addr, tid);
4737
4738         switch (action) {
4739         case IEEE80211_AMPDU_RX_START:
4740         case IEEE80211_AMPDU_RX_STOP:
4741                 break;
4742         case IEEE80211_AMPDU_TX_START:
4743                 /* By the time we get here the hw queues may contain outgoing
4744                  * packets for this RA/TID that are not part of this BA
4745                  * session.  The hw will assign sequence numbers to these
4746                  * packets as they go out.  So if we query the hw for its next
4747                  * sequence number and use that for the SSN here, it may end up
4748                  * being wrong, which will lead to sequence number mismatch at
4749                  * the recipient.  To avoid this, we reset the sequence number
4750                  * to O for the first MPDU in this BA stream.
4751                  */
4752                 *ssn = 0;
4753                 if (stream == NULL) {
4754                         /* This means that somebody outside this driver called
4755                          * ieee80211_start_tx_ba_session.  This is unexpected
4756                          * because we do our own rate control.  Just warn and
4757                          * move on.
4758                          */
4759                         wiphy_warn(hw->wiphy, "Unexpected call to %s.  "
4760                                    "Proceeding anyway.\n", __func__);
4761                         stream = mwl8k_add_stream(hw, sta, tid);
4762                 }
4763                 if (stream == NULL) {
4764                         wiphy_debug(hw->wiphy, "no free AMPDU streams\n");
4765                         rc = -EBUSY;
4766                         break;
4767                 }
4768                 stream->state = AMPDU_STREAM_IN_PROGRESS;
4769
4770                 /* Release the lock before we do the time consuming stuff */
4771                 spin_unlock(&priv->stream_lock);
4772                 for (i = 0; i < MAX_AMPDU_ATTEMPTS; i++) {
4773                         rc = mwl8k_check_ba(hw, stream);
4774
4775                         if (!rc)
4776                                 break;
4777                         /*
4778                          * HW queues take time to be flushed, give them
4779                          * sufficient time
4780                          */
4781
4782                         msleep(1000);
4783                 }
4784                 spin_lock(&priv->stream_lock);
4785                 if (rc) {
4786                         wiphy_err(hw->wiphy, "Stream for tid %d busy after %d"
4787                                 " attempts\n", tid, MAX_AMPDU_ATTEMPTS);
4788                         mwl8k_remove_stream(hw, stream);
4789                         rc = -EBUSY;
4790                         break;
4791                 }
4792                 ieee80211_start_tx_ba_cb_irqsafe(vif, addr, tid);
4793                 break;
4794         case IEEE80211_AMPDU_TX_STOP:
4795                 if (stream == NULL)
4796                         break;
4797                 if (stream->state == AMPDU_STREAM_ACTIVE) {
4798                         spin_unlock(&priv->stream_lock);
4799                         mwl8k_destroy_ba(hw, stream);
4800                         spin_lock(&priv->stream_lock);
4801                 }
4802                 mwl8k_remove_stream(hw, stream);
4803                 ieee80211_stop_tx_ba_cb_irqsafe(vif, addr, tid);
4804                 break;
4805         case IEEE80211_AMPDU_TX_OPERATIONAL:
4806                 BUG_ON(stream == NULL);
4807                 BUG_ON(stream->state != AMPDU_STREAM_IN_PROGRESS);
4808                 spin_unlock(&priv->stream_lock);
4809                 rc = mwl8k_create_ba(hw, stream, buf_size);
4810                 spin_lock(&priv->stream_lock);
4811                 if (!rc)
4812                         stream->state = AMPDU_STREAM_ACTIVE;
4813                 else {
4814                         spin_unlock(&priv->stream_lock);
4815                         mwl8k_destroy_ba(hw, stream);
4816                         spin_lock(&priv->stream_lock);
4817                         wiphy_debug(hw->wiphy,
4818                                 "Failed adding stream for sta %pM tid %d\n",
4819                                 addr, tid);
4820                         mwl8k_remove_stream(hw, stream);
4821                 }
4822                 break;
4823
4824         default:
4825                 rc = -ENOTSUPP;
4826         }
4827
4828         spin_unlock(&priv->stream_lock);
4829         return rc;
4830 }
4831
4832 static const struct ieee80211_ops mwl8k_ops = {
4833         .tx                     = mwl8k_tx,
4834         .start                  = mwl8k_start,
4835         .stop                   = mwl8k_stop,
4836         .add_interface          = mwl8k_add_interface,
4837         .remove_interface       = mwl8k_remove_interface,
4838         .config                 = mwl8k_config,
4839         .bss_info_changed       = mwl8k_bss_info_changed,
4840         .prepare_multicast      = mwl8k_prepare_multicast,
4841         .configure_filter       = mwl8k_configure_filter,
4842         .set_key                = mwl8k_set_key,
4843         .set_rts_threshold      = mwl8k_set_rts_threshold,
4844         .sta_add                = mwl8k_sta_add,
4845         .sta_remove             = mwl8k_sta_remove,
4846         .conf_tx                = mwl8k_conf_tx,
4847         .get_stats              = mwl8k_get_stats,
4848         .get_survey             = mwl8k_get_survey,
4849         .ampdu_action           = mwl8k_ampdu_action,
4850 };
4851
4852 static void mwl8k_finalize_join_worker(struct work_struct *work)
4853 {
4854         struct mwl8k_priv *priv =
4855                 container_of(work, struct mwl8k_priv, finalize_join_worker);
4856         struct sk_buff *skb = priv->beacon_skb;
4857         struct ieee80211_mgmt *mgmt = (void *)skb->data;
4858         int len = skb->len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
4859         const u8 *tim = cfg80211_find_ie(WLAN_EID_TIM,
4860                                          mgmt->u.beacon.variable, len);
4861         int dtim_period = 1;
4862
4863         if (tim && tim[1] >= 2)
4864                 dtim_period = tim[3];
4865
4866         mwl8k_cmd_finalize_join(priv->hw, skb->data, skb->len, dtim_period);
4867
4868         dev_kfree_skb(skb);
4869         priv->beacon_skb = NULL;
4870 }
4871
4872 enum {
4873         MWL8363 = 0,
4874         MWL8687,
4875         MWL8366,
4876 };
4877
4878 #define MWL8K_8366_AP_FW_API 2
4879 #define _MWL8K_8366_AP_FW(api) "mwl8k/fmimage_8366_ap-" #api ".fw"
4880 #define MWL8K_8366_AP_FW(api) _MWL8K_8366_AP_FW(api)
4881
4882 static struct mwl8k_device_info mwl8k_info_tbl[] __devinitdata = {
4883         [MWL8363] = {
4884                 .part_name      = "88w8363",
4885                 .helper_image   = "mwl8k/helper_8363.fw",
4886                 .fw_image_sta   = "mwl8k/fmimage_8363.fw",
4887         },
4888         [MWL8687] = {
4889                 .part_name      = "88w8687",
4890                 .helper_image   = "mwl8k/helper_8687.fw",
4891                 .fw_image_sta   = "mwl8k/fmimage_8687.fw",
4892         },
4893         [MWL8366] = {
4894                 .part_name      = "88w8366",
4895                 .helper_image   = "mwl8k/helper_8366.fw",
4896                 .fw_image_sta   = "mwl8k/fmimage_8366.fw",
4897                 .fw_image_ap    = MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API),
4898                 .fw_api_ap      = MWL8K_8366_AP_FW_API,
4899                 .ap_rxd_ops     = &rxd_8366_ap_ops,
4900         },
4901 };
4902
4903 MODULE_FIRMWARE("mwl8k/helper_8363.fw");
4904 MODULE_FIRMWARE("mwl8k/fmimage_8363.fw");
4905 MODULE_FIRMWARE("mwl8k/helper_8687.fw");
4906 MODULE_FIRMWARE("mwl8k/fmimage_8687.fw");
4907 MODULE_FIRMWARE("mwl8k/helper_8366.fw");
4908 MODULE_FIRMWARE("mwl8k/fmimage_8366.fw");
4909 MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
4910
4911 static DEFINE_PCI_DEVICE_TABLE(mwl8k_pci_id_table) = {
4912         { PCI_VDEVICE(MARVELL, 0x2a0a), .driver_data = MWL8363, },
4913         { PCI_VDEVICE(MARVELL, 0x2a0c), .driver_data = MWL8363, },
4914         { PCI_VDEVICE(MARVELL, 0x2a24), .driver_data = MWL8363, },
4915         { PCI_VDEVICE(MARVELL, 0x2a2b), .driver_data = MWL8687, },
4916         { PCI_VDEVICE(MARVELL, 0x2a30), .driver_data = MWL8687, },
4917         { PCI_VDEVICE(MARVELL, 0x2a40), .driver_data = MWL8366, },
4918         { PCI_VDEVICE(MARVELL, 0x2a43), .driver_data = MWL8366, },
4919         { },
4920 };
4921 MODULE_DEVICE_TABLE(pci, mwl8k_pci_id_table);
4922
4923 static int mwl8k_request_alt_fw(struct mwl8k_priv *priv)
4924 {
4925         int rc;
4926         printk(KERN_ERR "%s: Error requesting preferred fw %s.\n"
4927                "Trying alternative firmware %s\n", pci_name(priv->pdev),
4928                priv->fw_pref, priv->fw_alt);
4929         rc = mwl8k_request_fw(priv, priv->fw_alt, &priv->fw_ucode, true);
4930         if (rc) {
4931                 printk(KERN_ERR "%s: Error requesting alt fw %s\n",
4932                        pci_name(priv->pdev), priv->fw_alt);
4933                 return rc;
4934         }
4935         return 0;
4936 }
4937
4938 static int mwl8k_firmware_load_success(struct mwl8k_priv *priv);
4939 static void mwl8k_fw_state_machine(const struct firmware *fw, void *context)
4940 {
4941         struct mwl8k_priv *priv = context;
4942         struct mwl8k_device_info *di = priv->device_info;
4943         int rc;
4944
4945         switch (priv->fw_state) {
4946         case FW_STATE_INIT:
4947                 if (!fw) {
4948                         printk(KERN_ERR "%s: Error requesting helper fw %s\n",
4949                                pci_name(priv->pdev), di->helper_image);
4950                         goto fail;
4951                 }
4952                 priv->fw_helper = fw;
4953                 rc = mwl8k_request_fw(priv, priv->fw_pref, &priv->fw_ucode,
4954                                       true);
4955                 if (rc && priv->fw_alt) {
4956                         rc = mwl8k_request_alt_fw(priv);
4957                         if (rc)
4958                                 goto fail;
4959                         priv->fw_state = FW_STATE_LOADING_ALT;
4960                 } else if (rc)
4961                         goto fail;
4962                 else
4963                         priv->fw_state = FW_STATE_LOADING_PREF;
4964                 break;
4965
4966         case FW_STATE_LOADING_PREF:
4967                 if (!fw) {
4968                         if (priv->fw_alt) {
4969                                 rc = mwl8k_request_alt_fw(priv);
4970                                 if (rc)
4971                                         goto fail;
4972                                 priv->fw_state = FW_STATE_LOADING_ALT;
4973                         } else
4974                                 goto fail;
4975                 } else {
4976                         priv->fw_ucode = fw;
4977                         rc = mwl8k_firmware_load_success(priv);
4978                         if (rc)
4979                                 goto fail;
4980                         else
4981                                 complete(&priv->firmware_loading_complete);
4982                 }
4983                 break;
4984
4985         case FW_STATE_LOADING_ALT:
4986                 if (!fw) {
4987                         printk(KERN_ERR "%s: Error requesting alt fw %s\n",
4988                                pci_name(priv->pdev), di->helper_image);
4989                         goto fail;
4990                 }
4991                 priv->fw_ucode = fw;
4992                 rc = mwl8k_firmware_load_success(priv);
4993                 if (rc)
4994                         goto fail;
4995                 else
4996                         complete(&priv->firmware_loading_complete);
4997                 break;
4998
4999         default:
5000                 printk(KERN_ERR "%s: Unexpected firmware loading state: %d\n",
5001                        MWL8K_NAME, priv->fw_state);
5002                 BUG_ON(1);
5003         }
5004
5005         return;
5006
5007 fail:
5008         priv->fw_state = FW_STATE_ERROR;
5009         complete(&priv->firmware_loading_complete);
5010         device_release_driver(&priv->pdev->dev);
5011         mwl8k_release_firmware(priv);
5012 }
5013
5014 static int mwl8k_init_firmware(struct ieee80211_hw *hw, char *fw_image,
5015                                bool nowait)
5016 {
5017         struct mwl8k_priv *priv = hw->priv;
5018         int rc;
5019
5020         /* Reset firmware and hardware */
5021         mwl8k_hw_reset(priv);
5022
5023         /* Ask userland hotplug daemon for the device firmware */
5024         rc = mwl8k_request_firmware(priv, fw_image, nowait);
5025         if (rc) {
5026                 wiphy_err(hw->wiphy, "Firmware files not found\n");
5027                 return rc;
5028         }
5029
5030         if (nowait)
5031                 return rc;
5032
5033         /* Load firmware into hardware */
5034         rc = mwl8k_load_firmware(hw);
5035         if (rc)
5036                 wiphy_err(hw->wiphy, "Cannot start firmware\n");
5037
5038         /* Reclaim memory once firmware is successfully loaded */
5039         mwl8k_release_firmware(priv);
5040
5041         return rc;
5042 }
5043
5044 static int mwl8k_init_txqs(struct ieee80211_hw *hw)
5045 {
5046         struct mwl8k_priv *priv = hw->priv;
5047         int rc = 0;
5048         int i;
5049
5050         for (i = 0; i < mwl8k_tx_queues(priv); i++) {
5051                 rc = mwl8k_txq_init(hw, i);
5052                 if (rc)
5053                         break;
5054                 if (priv->ap_fw)
5055                         iowrite32(priv->txq[i].txd_dma,
5056                                   priv->sram + priv->txq_offset[i]);
5057         }
5058         return rc;
5059 }
5060
5061 /* initialize hw after successfully loading a firmware image */
5062 static int mwl8k_probe_hw(struct ieee80211_hw *hw)
5063 {
5064         struct mwl8k_priv *priv = hw->priv;
5065         int rc = 0;
5066         int i;
5067
5068         if (priv->ap_fw) {
5069                 priv->rxd_ops = priv->device_info->ap_rxd_ops;
5070                 if (priv->rxd_ops == NULL) {
5071                         wiphy_err(hw->wiphy,
5072                                   "Driver does not have AP firmware image support for this hardware\n");
5073                         goto err_stop_firmware;
5074                 }
5075         } else {
5076                 priv->rxd_ops = &rxd_sta_ops;
5077         }
5078
5079         priv->sniffer_enabled = false;
5080         priv->wmm_enabled = false;
5081         priv->pending_tx_pkts = 0;
5082
5083         rc = mwl8k_rxq_init(hw, 0);
5084         if (rc)
5085                 goto err_stop_firmware;
5086         rxq_refill(hw, 0, INT_MAX);
5087
5088         /* For the sta firmware, we need to know the dma addresses of tx queues
5089          * before sending MWL8K_CMD_GET_HW_SPEC.  So we must initialize them
5090          * prior to issuing this command.  But for the AP case, we learn the
5091          * total number of queues from the result CMD_GET_HW_SPEC, so for this
5092          * case we must initialize the tx queues after.
5093          */
5094         priv->num_ampdu_queues = 0;
5095         if (!priv->ap_fw) {
5096                 rc = mwl8k_init_txqs(hw);
5097                 if (rc)
5098                         goto err_free_queues;
5099         }
5100
5101         iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
5102         iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
5103         iowrite32(MWL8K_A2H_INT_TX_DONE | MWL8K_A2H_INT_RX_READY,
5104                   priv->regs + MWL8K_HIU_A2H_INTERRUPT_CLEAR_SEL);
5105         iowrite32(0xffffffff, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
5106
5107         rc = request_irq(priv->pdev->irq, mwl8k_interrupt,
5108                          IRQF_SHARED, MWL8K_NAME, hw);
5109         if (rc) {
5110                 wiphy_err(hw->wiphy, "failed to register IRQ handler\n");
5111                 goto err_free_queues;
5112         }
5113
5114         memset(priv->ampdu, 0, sizeof(priv->ampdu));
5115
5116         /*
5117          * Temporarily enable interrupts.  Initial firmware host
5118          * commands use interrupts and avoid polling.  Disable
5119          * interrupts when done.
5120          */
5121         iowrite32(MWL8K_A2H_EVENTS, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
5122
5123         /* Get config data, mac addrs etc */
5124         if (priv->ap_fw) {
5125                 rc = mwl8k_cmd_get_hw_spec_ap(hw);
5126                 if (!rc)
5127                         rc = mwl8k_init_txqs(hw);
5128                 if (!rc)
5129                         rc = mwl8k_cmd_set_hw_spec(hw);
5130         } else {
5131                 rc = mwl8k_cmd_get_hw_spec_sta(hw);
5132         }
5133         if (rc) {
5134                 wiphy_err(hw->wiphy, "Cannot initialise firmware\n");
5135                 goto err_free_irq;
5136         }
5137
5138         /* Turn radio off */
5139         rc = mwl8k_cmd_radio_disable(hw);
5140         if (rc) {
5141                 wiphy_err(hw->wiphy, "Cannot disable\n");
5142                 goto err_free_irq;
5143         }
5144
5145         /* Clear MAC address */
5146         rc = mwl8k_cmd_set_mac_addr(hw, NULL, "\x00\x00\x00\x00\x00\x00");
5147         if (rc) {
5148                 wiphy_err(hw->wiphy, "Cannot clear MAC address\n");
5149                 goto err_free_irq;
5150         }
5151
5152         /* Disable interrupts */
5153         iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
5154         free_irq(priv->pdev->irq, hw);
5155
5156         wiphy_info(hw->wiphy, "%s v%d, %pm, %s firmware %u.%u.%u.%u\n",
5157                    priv->device_info->part_name,
5158                    priv->hw_rev, hw->wiphy->perm_addr,
5159                    priv->ap_fw ? "AP" : "STA",
5160                    (priv->fw_rev >> 24) & 0xff, (priv->fw_rev >> 16) & 0xff,
5161                    (priv->fw_rev >> 8) & 0xff, priv->fw_rev & 0xff);
5162
5163         return 0;
5164
5165 err_free_irq:
5166         iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
5167         free_irq(priv->pdev->irq, hw);
5168
5169 err_free_queues:
5170         for (i = 0; i < mwl8k_tx_queues(priv); i++)
5171                 mwl8k_txq_deinit(hw, i);
5172         mwl8k_rxq_deinit(hw, 0);
5173
5174 err_stop_firmware:
5175         mwl8k_hw_reset(priv);
5176
5177         return rc;
5178 }
5179
5180 /*
5181  * invoke mwl8k_reload_firmware to change the firmware image after the device
5182  * has already been registered
5183  */
5184 static int mwl8k_reload_firmware(struct ieee80211_hw *hw, char *fw_image)
5185 {
5186         int i, rc = 0;
5187         struct mwl8k_priv *priv = hw->priv;
5188
5189         mwl8k_stop(hw);
5190         mwl8k_rxq_deinit(hw, 0);
5191
5192         for (i = 0; i < mwl8k_tx_queues(priv); i++)
5193                 mwl8k_txq_deinit(hw, i);
5194
5195         rc = mwl8k_init_firmware(hw, fw_image, false);
5196         if (rc)
5197                 goto fail;
5198
5199         rc = mwl8k_probe_hw(hw);
5200         if (rc)
5201                 goto fail;
5202
5203         rc = mwl8k_start(hw);
5204         if (rc)
5205                 goto fail;
5206
5207         rc = mwl8k_config(hw, ~0);
5208         if (rc)
5209                 goto fail;
5210
5211         for (i = 0; i < MWL8K_TX_WMM_QUEUES; i++) {
5212                 rc = mwl8k_conf_tx(hw, i, &priv->wmm_params[i]);
5213                 if (rc)
5214                         goto fail;
5215         }
5216
5217         return rc;
5218
5219 fail:
5220         printk(KERN_WARNING "mwl8k: Failed to reload firmware image.\n");
5221         return rc;
5222 }
5223
5224 static int mwl8k_firmware_load_success(struct mwl8k_priv *priv)
5225 {
5226         struct ieee80211_hw *hw = priv->hw;
5227         int i, rc;
5228
5229         rc = mwl8k_load_firmware(hw);
5230         mwl8k_release_firmware(priv);
5231         if (rc) {
5232                 wiphy_err(hw->wiphy, "Cannot start firmware\n");
5233                 return rc;
5234         }
5235
5236         /*
5237          * Extra headroom is the size of the required DMA header
5238          * minus the size of the smallest 802.11 frame (CTS frame).
5239          */
5240         hw->extra_tx_headroom =
5241                 sizeof(struct mwl8k_dma_data) - sizeof(struct ieee80211_cts);
5242
5243         hw->channel_change_time = 10;
5244
5245         hw->queues = MWL8K_TX_WMM_QUEUES;
5246
5247         /* Set rssi values to dBm */
5248         hw->flags |= IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_HAS_RATE_CONTROL;
5249         hw->vif_data_size = sizeof(struct mwl8k_vif);
5250         hw->sta_data_size = sizeof(struct mwl8k_sta);
5251
5252         priv->macids_used = 0;
5253         INIT_LIST_HEAD(&priv->vif_list);
5254
5255         /* Set default radio state and preamble */
5256         priv->radio_on = 0;
5257         priv->radio_short_preamble = 0;
5258
5259         /* Finalize join worker */
5260         INIT_WORK(&priv->finalize_join_worker, mwl8k_finalize_join_worker);
5261
5262         /* TX reclaim and RX tasklets.  */
5263         tasklet_init(&priv->poll_tx_task, mwl8k_tx_poll, (unsigned long)hw);
5264         tasklet_disable(&priv->poll_tx_task);
5265         tasklet_init(&priv->poll_rx_task, mwl8k_rx_poll, (unsigned long)hw);
5266         tasklet_disable(&priv->poll_rx_task);
5267
5268         /* Power management cookie */
5269         priv->cookie = pci_alloc_consistent(priv->pdev, 4, &priv->cookie_dma);
5270         if (priv->cookie == NULL)
5271                 return -ENOMEM;
5272
5273         mutex_init(&priv->fw_mutex);
5274         priv->fw_mutex_owner = NULL;
5275         priv->fw_mutex_depth = 0;
5276         priv->hostcmd_wait = NULL;
5277
5278         spin_lock_init(&priv->tx_lock);
5279
5280         spin_lock_init(&priv->stream_lock);
5281
5282         priv->tx_wait = NULL;
5283
5284         rc = mwl8k_probe_hw(hw);
5285         if (rc)
5286                 goto err_free_cookie;
5287
5288         hw->wiphy->interface_modes = 0;
5289         if (priv->ap_macids_supported || priv->device_info->fw_image_ap)
5290                 hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP);
5291         if (priv->sta_macids_supported || priv->device_info->fw_image_sta)
5292                 hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_STATION);
5293
5294         rc = ieee80211_register_hw(hw);
5295         if (rc) {
5296                 wiphy_err(hw->wiphy, "Cannot register device\n");
5297                 goto err_unprobe_hw;
5298         }
5299
5300         return 0;
5301
5302 err_unprobe_hw:
5303         for (i = 0; i < mwl8k_tx_queues(priv); i++)
5304                 mwl8k_txq_deinit(hw, i);
5305         mwl8k_rxq_deinit(hw, 0);
5306
5307 err_free_cookie:
5308         if (priv->cookie != NULL)
5309                 pci_free_consistent(priv->pdev, 4,
5310                                 priv->cookie, priv->cookie_dma);
5311
5312         return rc;
5313 }
5314 static int __devinit mwl8k_probe(struct pci_dev *pdev,
5315                                  const struct pci_device_id *id)
5316 {
5317         static int printed_version;
5318         struct ieee80211_hw *hw;
5319         struct mwl8k_priv *priv;
5320         struct mwl8k_device_info *di;
5321         int rc;
5322
5323         if (!printed_version) {
5324                 printk(KERN_INFO "%s version %s\n", MWL8K_DESC, MWL8K_VERSION);
5325                 printed_version = 1;
5326         }
5327
5328
5329         rc = pci_enable_device(pdev);
5330         if (rc) {
5331                 printk(KERN_ERR "%s: Cannot enable new PCI device\n",
5332                        MWL8K_NAME);
5333                 return rc;
5334         }
5335
5336         rc = pci_request_regions(pdev, MWL8K_NAME);
5337         if (rc) {
5338                 printk(KERN_ERR "%s: Cannot obtain PCI resources\n",
5339                        MWL8K_NAME);
5340                 goto err_disable_device;
5341         }
5342
5343         pci_set_master(pdev);
5344
5345
5346         hw = ieee80211_alloc_hw(sizeof(*priv), &mwl8k_ops);
5347         if (hw == NULL) {
5348                 printk(KERN_ERR "%s: ieee80211 alloc failed\n", MWL8K_NAME);
5349                 rc = -ENOMEM;
5350                 goto err_free_reg;
5351         }
5352
5353         SET_IEEE80211_DEV(hw, &pdev->dev);
5354         pci_set_drvdata(pdev, hw);
5355
5356         priv = hw->priv;
5357         priv->hw = hw;
5358         priv->pdev = pdev;
5359         priv->device_info = &mwl8k_info_tbl[id->driver_data];
5360
5361
5362         priv->sram = pci_iomap(pdev, 0, 0x10000);
5363         if (priv->sram == NULL) {
5364                 wiphy_err(hw->wiphy, "Cannot map device SRAM\n");
5365                 goto err_iounmap;
5366         }
5367
5368         /*
5369          * If BAR0 is a 32 bit BAR, the register BAR will be BAR1.
5370          * If BAR0 is a 64 bit BAR, the register BAR will be BAR2.
5371          */
5372         priv->regs = pci_iomap(pdev, 1, 0x10000);
5373         if (priv->regs == NULL) {
5374                 priv->regs = pci_iomap(pdev, 2, 0x10000);
5375                 if (priv->regs == NULL) {
5376                         wiphy_err(hw->wiphy, "Cannot map device registers\n");
5377                         goto err_iounmap;
5378                 }
5379         }
5380
5381         /*
5382          * Choose the initial fw image depending on user input.  If a second
5383          * image is available, make it the alternative image that will be
5384          * loaded if the first one fails.
5385          */
5386         init_completion(&priv->firmware_loading_complete);
5387         di = priv->device_info;
5388         if (ap_mode_default && di->fw_image_ap) {
5389                 priv->fw_pref = di->fw_image_ap;
5390                 priv->fw_alt = di->fw_image_sta;
5391         } else if (!ap_mode_default && di->fw_image_sta) {
5392                 priv->fw_pref = di->fw_image_sta;
5393                 priv->fw_alt = di->fw_image_ap;
5394         } else if (ap_mode_default && !di->fw_image_ap && di->fw_image_sta) {
5395                 printk(KERN_WARNING "AP fw is unavailable.  Using STA fw.");
5396                 priv->fw_pref = di->fw_image_sta;
5397         } else if (!ap_mode_default && !di->fw_image_sta && di->fw_image_ap) {
5398                 printk(KERN_WARNING "STA fw is unavailable.  Using AP fw.");
5399                 priv->fw_pref = di->fw_image_ap;
5400         }
5401         rc = mwl8k_init_firmware(hw, priv->fw_pref, true);
5402         if (rc)
5403                 goto err_stop_firmware;
5404         return rc;
5405
5406 err_stop_firmware:
5407         mwl8k_hw_reset(priv);
5408
5409 err_iounmap:
5410         if (priv->regs != NULL)
5411                 pci_iounmap(pdev, priv->regs);
5412
5413         if (priv->sram != NULL)
5414                 pci_iounmap(pdev, priv->sram);
5415
5416         pci_set_drvdata(pdev, NULL);
5417         ieee80211_free_hw(hw);
5418
5419 err_free_reg:
5420         pci_release_regions(pdev);
5421
5422 err_disable_device:
5423         pci_disable_device(pdev);
5424
5425         return rc;
5426 }
5427
5428 static void __devexit mwl8k_shutdown(struct pci_dev *pdev)
5429 {
5430         printk(KERN_ERR "===>%s(%u)\n", __func__, __LINE__);
5431 }
5432
5433 static void __devexit mwl8k_remove(struct pci_dev *pdev)
5434 {
5435         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
5436         struct mwl8k_priv *priv;
5437         int i;
5438
5439         if (hw == NULL)
5440                 return;
5441         priv = hw->priv;
5442
5443         wait_for_completion(&priv->firmware_loading_complete);
5444
5445         if (priv->fw_state == FW_STATE_ERROR) {
5446                 mwl8k_hw_reset(priv);
5447                 goto unmap;
5448         }
5449
5450         ieee80211_stop_queues(hw);
5451
5452         ieee80211_unregister_hw(hw);
5453
5454         /* Remove TX reclaim and RX tasklets.  */
5455         tasklet_kill(&priv->poll_tx_task);
5456         tasklet_kill(&priv->poll_rx_task);
5457
5458         /* Stop hardware */
5459         mwl8k_hw_reset(priv);
5460
5461         /* Return all skbs to mac80211 */
5462         for (i = 0; i < mwl8k_tx_queues(priv); i++)
5463                 mwl8k_txq_reclaim(hw, i, INT_MAX, 1);
5464
5465         for (i = 0; i < mwl8k_tx_queues(priv); i++)
5466                 mwl8k_txq_deinit(hw, i);
5467
5468         mwl8k_rxq_deinit(hw, 0);
5469
5470         pci_free_consistent(priv->pdev, 4, priv->cookie, priv->cookie_dma);
5471
5472 unmap:
5473         pci_iounmap(pdev, priv->regs);
5474         pci_iounmap(pdev, priv->sram);
5475         pci_set_drvdata(pdev, NULL);
5476         ieee80211_free_hw(hw);
5477         pci_release_regions(pdev);
5478         pci_disable_device(pdev);
5479 }
5480
5481 static struct pci_driver mwl8k_driver = {
5482         .name           = MWL8K_NAME,
5483         .id_table       = mwl8k_pci_id_table,
5484         .probe          = mwl8k_probe,
5485         .remove         = __devexit_p(mwl8k_remove),
5486         .shutdown       = __devexit_p(mwl8k_shutdown),
5487 };
5488
5489 static int __init mwl8k_init(void)
5490 {
5491         return pci_register_driver(&mwl8k_driver);
5492 }
5493
5494 static void __exit mwl8k_exit(void)
5495 {
5496         pci_unregister_driver(&mwl8k_driver);
5497 }
5498
5499 module_init(mwl8k_init);
5500 module_exit(mwl8k_exit);
5501
5502 MODULE_DESCRIPTION(MWL8K_DESC);
5503 MODULE_VERSION(MWL8K_VERSION);
5504 MODULE_AUTHOR("Lennert Buytenhek <buytenh@marvell.com>");
5505 MODULE_LICENSE("GPL");