drivers/net/wireless/ath/ar9170/main.c

   1 /*
   2  * Atheros AR9170 driver
   3  *
   4  * mac80211 interaction code
   5  *
   6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright 2009, Christian Lamparter <chunkeey@web.de>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; see the file COPYING.  If not, see
  21  * http://www.gnu.org/licenses/.
  22  *
  23  * This file incorporates work covered by the following copyright and
  24  * permission notice:
  25  *    Copyright (c) 2007-2008 Atheros Communications, Inc.
  26  *
  27  *    Permission to use, copy, modify, and/or distribute this software for any
  28  *    purpose with or without fee is hereby granted, provided that the above
  29  *    copyright notice and this permission notice appear in all copies.
  30  *
  31  *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  32  *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  33  *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  34  *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  35  *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  36  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  37  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  38  */
  39
  40 #include <linux/init.h>
  41 #include <linux/module.h>
  42 #include <linux/etherdevice.h>
  43 #include <net/mac80211.h>
  44 #include "ar9170.h"
  45 #include "hw.h"
  46 #include "cmd.h"
  47
  48 static int modparam_nohwcrypt;
  49 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
  50 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  51
  52 static int modparam_ht;
  53 module_param_named(ht, modparam_ht, bool, S_IRUGO);
  54 MODULE_PARM_DESC(ht, "enable MPDU aggregation.");
  55
  56 #define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
  57         .bitrate        = (_bitrate),                   \
  58         .flags          = (_flags),                     \
  59         .hw_value       = (_hw_rate) | (_txpidx) << 4,  \
  60 }
  61
  62 static struct ieee80211_rate __ar9170_ratetable[] = {
  63         RATE(10, 0, 0, 0),
  64         RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
  65         RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
  66         RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
  67         RATE(60, 0xb, 0, 0),
  68         RATE(90, 0xf, 0, 0),
  69         RATE(120, 0xa, 0, 0),
  70         RATE(180, 0xe, 0, 0),
  71         RATE(240, 0x9, 0, 0),
  72         RATE(360, 0xd, 1, 0),
  73         RATE(480, 0x8, 2, 0),
  74         RATE(540, 0xc, 3, 0),
  75 };
  76 #undef RATE
  77
  78 #define ar9170_g_ratetable      (__ar9170_ratetable + 0)
  79 #define ar9170_g_ratetable_size 12
  80 #define ar9170_a_ratetable      (__ar9170_ratetable + 4)
  81 #define ar9170_a_ratetable_size 8
  82
  83 /*
  84  * NB: The hw_value is used as an index into the ar9170_phy_freq_params
  85  *     array in phy.c so that we don't have to do frequency lookups!
  86  */
  87 #define CHAN(_freq, _idx) {             \
  88         .center_freq    = (_freq),      \
  89         .hw_value       = (_idx),       \
  90         .max_power      = 18, /* XXX */ \
  91 }
  92
  93 static struct ieee80211_channel ar9170_2ghz_chantable[] = {
  94         CHAN(2412,  0),
  95         CHAN(2417,  1),
  96         CHAN(2422,  2),
  97         CHAN(2427,  3),
  98         CHAN(2432,  4),
  99         CHAN(2437,  5),
 100         CHAN(2442,  6),
 101         CHAN(2447,  7),
 102         CHAN(2452,  8),
 103         CHAN(2457,  9),
 104         CHAN(2462, 10),
 105         CHAN(2467, 11),
 106         CHAN(2472, 12),
 107         CHAN(2484, 13),
 108 };
 109
 110 static struct ieee80211_channel ar9170_5ghz_chantable[] = {
 111         CHAN(4920, 14),
 112         CHAN(4940, 15),
 113         CHAN(4960, 16),
 114         CHAN(4980, 17),
 115         CHAN(5040, 18),
 116         CHAN(5060, 19),
 117         CHAN(5080, 20),
 118         CHAN(5180, 21),
 119         CHAN(5200, 22),
 120         CHAN(5220, 23),
 121         CHAN(5240, 24),
 122         CHAN(5260, 25),
 123         CHAN(5280, 26),
 124         CHAN(5300, 27),
 125         CHAN(5320, 28),
 126         CHAN(5500, 29),
 127         CHAN(5520, 30),
 128         CHAN(5540, 31),
 129         CHAN(5560, 32),
 130         CHAN(5580, 33),
 131         CHAN(5600, 34),
 132         CHAN(5620, 35),
 133         CHAN(5640, 36),
 134         CHAN(5660, 37),
 135         CHAN(5680, 38),
 136         CHAN(5700, 39),
 137         CHAN(5745, 40),
 138         CHAN(5765, 41),
 139         CHAN(5785, 42),
 140         CHAN(5805, 43),
 141         CHAN(5825, 44),
 142         CHAN(5170, 45),
 143         CHAN(5190, 46),
 144         CHAN(5210, 47),
 145         CHAN(5230, 48),
 146 };
 147 #undef CHAN
 148
 149 #define AR9170_HT_CAP                                                   \
 150 {                                                                       \
 151         .ht_supported   = true,                                         \
 152         .cap            = IEEE80211_HT_CAP_MAX_AMSDU |                  \
 153                           IEEE80211_HT_CAP_SUP_WIDTH_20_40 |            \
 154                           IEEE80211_HT_CAP_SGI_40 |                     \
 155                           IEEE80211_HT_CAP_GRN_FLD |                    \
 156                           IEEE80211_HT_CAP_DSSSCCK40 |                  \
 157                           IEEE80211_HT_CAP_SM_PS,                       \
 158         .ampdu_factor   = 3,                                            \
 159         .ampdu_density  = 6,                                            \
 160         .mcs            = {                                             \
 161                 .rx_mask = { 0xff, 0xff, 0, 0, 0x1, 0, 0, 0, 0, 0, },   \
 162                 .rx_highest = cpu_to_le16(300),                         \
 163                 .tx_params = IEEE80211_HT_MCS_TX_DEFINED,               \
 164         },                                                              \
 165 }
 166
 167 static struct ieee80211_supported_band ar9170_band_2GHz = {
 168         .channels       = ar9170_2ghz_chantable,
 169         .n_channels     = ARRAY_SIZE(ar9170_2ghz_chantable),
 170         .bitrates       = ar9170_g_ratetable,
 171         .n_bitrates     = ar9170_g_ratetable_size,
 172         .ht_cap         = AR9170_HT_CAP,
 173 };
 174
 175 static struct ieee80211_supported_band ar9170_band_5GHz = {
 176         .channels       = ar9170_5ghz_chantable,
 177         .n_channels     = ARRAY_SIZE(ar9170_5ghz_chantable),
 178         .bitrates       = ar9170_a_ratetable,
 179         .n_bitrates     = ar9170_a_ratetable_size,
 180         .ht_cap         = AR9170_HT_CAP,
 181 };
 182
 183 static void ar9170_tx(struct ar9170 *ar);
 184 static bool ar9170_tx_ampdu(struct ar9170 *ar);
 185
 186 static inline u16 ar9170_get_seq_h(struct ieee80211_hdr *hdr)
 187 {
 188         return le16_to_cpu(hdr->seq_ctrl) >> 4;
 189 }
 190
 191 static inline u16 ar9170_get_seq(struct sk_buff *skb)
 192 {
 193         struct ar9170_tx_control *txc = (void *) skb->data;
 194         return ar9170_get_seq_h((void *) txc->frame_data);
 195 }
 196
 197 static inline u16 ar9170_get_tid(struct sk_buff *skb)
 198 {
 199         struct ar9170_tx_control *txc = (void *) skb->data;
 200         struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 201
 202         return (ieee80211_get_qos_ctl(hdr))[0] & IEEE80211_QOS_CTL_TID_MASK;
 203 }
 204
 205 #define GET_NEXT_SEQ(seq)       ((seq + 1) & 0x0fff)
 206 #define GET_NEXT_SEQ_FROM_SKB(skb)      (GET_NEXT_SEQ(ar9170_get_seq(skb)))
 207
 208 #if (defined AR9170_QUEUE_DEBUG) || (defined AR9170_TXAGG_DEBUG)
 209 static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
 210 {
 211         struct ar9170_tx_control *txc = (void *) skb->data;
 212         struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
 213         struct ar9170_tx_info *arinfo = (void *) txinfo->rate_driver_data;
 214         struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 215
 216         printk(KERN_DEBUG "%s: => FRAME [skb:%p, q:%d, DA:[%pM] flags:%x s:%d "
 217                           "mac_ctrl:%04x, phy_ctrl:%08x, timeout:[%d ms]]\n",
 218                wiphy_name(ar->hw->wiphy), skb, skb_get_queue_mapping(skb),
 219                ieee80211_get_DA(hdr), arinfo->flags, ar9170_get_seq_h(hdr),
 220                le16_to_cpu(txc->mac_control), le32_to_cpu(txc->phy_control),
 221                jiffies_to_msecs(arinfo->timeout - jiffies));
 222 }
 223
 224 static void __ar9170_dump_txqueue(struct ar9170 *ar,
 225                                 struct sk_buff_head *queue)
 226 {
 227         struct sk_buff *skb;
 228         int i = 0;
 229
 230         printk(KERN_DEBUG "---[ cut here ]---\n");
 231         printk(KERN_DEBUG "%s: %d entries in queue.\n",
 232                wiphy_name(ar->hw->wiphy), skb_queue_len(queue));
 233
 234         skb_queue_walk(queue, skb) {
 235                 printk(KERN_DEBUG "index:%d => \n", i++);
 236                 ar9170_print_txheader(ar, skb);
 237         }
 238         if (i != skb_queue_len(queue))
 239                 printk(KERN_DEBUG "WARNING: queue frame counter "
 240                        "mismatch %d != %d\n", skb_queue_len(queue), i);
 241         printk(KERN_DEBUG "---[ end ]---\n");
 242 }
 243 #endif /* AR9170_QUEUE_DEBUG || AR9170_TXAGG_DEBUG */
 244
 245 #ifdef AR9170_QUEUE_DEBUG
 246 static void ar9170_dump_txqueue(struct ar9170 *ar,
 247                                 struct sk_buff_head *queue)
 248 {
 249         unsigned long flags;
 250
 251         spin_lock_irqsave(&queue->lock, flags);
 252         __ar9170_dump_txqueue(ar, queue);
 253         spin_unlock_irqrestore(&queue->lock, flags);
 254 }
 255 #endif /* AR9170_QUEUE_DEBUG */
 256
 257 #ifdef AR9170_QUEUE_STOP_DEBUG
 258 static void __ar9170_dump_txstats(struct ar9170 *ar)
 259 {
 260         int i;
 261
 262         printk(KERN_DEBUG "%s: QoS queue stats\n",
 263                wiphy_name(ar->hw->wiphy));
 264
 265         for (i = 0; i < __AR9170_NUM_TXQ; i++)
 266                 printk(KERN_DEBUG "%s: queue:%d limit:%d len:%d waitack:%d "
 267                        " stopped:%d\n", wiphy_name(ar->hw->wiphy), i,
 268                        ar->tx_stats[i].limit, ar->tx_stats[i].len,
 269                        skb_queue_len(&ar->tx_status[i]),
 270                        ieee80211_queue_stopped(ar->hw, i));
 271 }
 272 #endif /* AR9170_QUEUE_STOP_DEBUG */
 273
 274 #ifdef AR9170_TXAGG_DEBUG
 275 static void ar9170_dump_tx_status_ampdu(struct ar9170 *ar)
 276 {
 277         unsigned long flags;
 278
 279         spin_lock_irqsave(&ar->tx_status_ampdu.lock, flags);
 280         printk(KERN_DEBUG "%s: A-MPDU tx_status queue => \n",
 281                wiphy_name(ar->hw->wiphy));
 282         __ar9170_dump_txqueue(ar, &ar->tx_status_ampdu);
 283         spin_unlock_irqrestore(&ar->tx_status_ampdu.lock, flags);
 284 }
 285
 286 #endif /* AR9170_TXAGG_DEBUG */
 287
 288 /* caller must guarantee exclusive access for _bin_ queue. */
 289 static void ar9170_recycle_expired(struct ar9170 *ar,
 290                                    struct sk_buff_head *queue,
 291                                    struct sk_buff_head *bin)
 292 {
 293         struct sk_buff *skb, *old = NULL;
 294         unsigned long flags;
 295
 296         spin_lock_irqsave(&queue->lock, flags);
 297         while ((skb = skb_peek(queue))) {
 298                 struct ieee80211_tx_info *txinfo;
 299                 struct ar9170_tx_info *arinfo;
 300
 301                 txinfo = IEEE80211_SKB_CB(skb);
 302                 arinfo = (void *) txinfo->rate_driver_data;
 303
 304                 if (time_is_before_jiffies(arinfo->timeout)) {
 305 #ifdef AR9170_QUEUE_DEBUG
 306                         printk(KERN_DEBUG "%s: [%ld > %ld] frame expired => "
 307                                "recycle \n", wiphy_name(ar->hw->wiphy),
 308                                jiffies, arinfo->timeout);
 309                         ar9170_print_txheader(ar, skb);
 310 #endif /* AR9170_QUEUE_DEBUG */
 311                         __skb_unlink(skb, queue);
 312                         __skb_queue_tail(bin, skb);
 313                 } else {
 314                         break;
 315                 }
 316
 317                 if (unlikely(old == skb)) {
 318                         /* bail out - queue is shot. */
 319
 320                         WARN_ON(1);
 321                         break;
 322                 }
 323                 old = skb;
 324         }
 325         spin_unlock_irqrestore(&queue->lock, flags);
 326 }
 327
 328 static void ar9170_tx_status(struct ar9170 *ar, struct sk_buff *skb,
 329                                     u16 tx_status)
 330 {
 331         struct ieee80211_tx_info *txinfo;
 332         unsigned int retries = 0;
 333
 334         txinfo = IEEE80211_SKB_CB(skb);
 335         ieee80211_tx_info_clear_status(txinfo);
 336
 337         switch (tx_status) {
 338         case AR9170_TX_STATUS_RETRY:
 339                 retries = 2;
 340         case AR9170_TX_STATUS_COMPLETE:
 341                 txinfo->flags |= IEEE80211_TX_STAT_ACK;
 342                 break;
 343
 344         case AR9170_TX_STATUS_FAILED:
 345                 retries = ar->hw->conf.long_frame_max_tx_count;
 346                 break;
 347
 348         default:
 349                 printk(KERN_ERR "%s: invalid tx_status response (%x).\n",
 350                        wiphy_name(ar->hw->wiphy), tx_status);
 351                 break;
 352         }
 353
 354         txinfo->status.rates[0].count = retries + 1;
 355         skb_pull(skb, sizeof(struct ar9170_tx_control));
 356         ieee80211_tx_status_irqsafe(ar->hw, skb);
 357 }
 358
 359 static void ar9170_tx_fake_ampdu_status(struct ar9170 *ar)
 360 {
 361         struct sk_buff_head success;
 362         struct sk_buff *skb;
 363         unsigned int i;
 364         unsigned long queue_bitmap = 0;
 365
 366         skb_queue_head_init(&success);
 367
 368         while (skb_queue_len(&ar->tx_status_ampdu) > AR9170_NUM_TX_STATUS)
 369                 __skb_queue_tail(&success, skb_dequeue(&ar->tx_status_ampdu));
 370
 371         ar9170_recycle_expired(ar, &ar->tx_status_ampdu, &success);
 372
 373 #ifdef AR9170_TXAGG_DEBUG
 374         printk(KERN_DEBUG "%s: collected %d A-MPDU frames.\n",
 375                wiphy_name(ar->hw->wiphy), skb_queue_len(&success));
 376         __ar9170_dump_txqueue(ar, &success);
 377 #endif /* AR9170_TXAGG_DEBUG */
 378
 379         while ((skb = __skb_dequeue(&success))) {
 380                 struct ieee80211_tx_info *txinfo;
 381
 382                 queue_bitmap |= BIT(skb_get_queue_mapping(skb));
 383
 384                 txinfo = IEEE80211_SKB_CB(skb);
 385                 ieee80211_tx_info_clear_status(txinfo);
 386
 387                 txinfo->flags |= IEEE80211_TX_STAT_ACK;
 388                 txinfo->status.rates[0].count = 1;
 389
 390                 skb_pull(skb, sizeof(struct ar9170_tx_control));
 391                 ieee80211_tx_status_irqsafe(ar->hw, skb);
 392         }
 393
 394         for_each_bit(i, &queue_bitmap, BITS_PER_BYTE) {
 395 #ifdef AR9170_QUEUE_STOP_DEBUG
 396                 printk(KERN_DEBUG "%s: wake queue %d\n",
 397                        wiphy_name(ar->hw->wiphy), i);
 398                 __ar9170_dump_txstats(ar);
 399 #endif /* AR9170_QUEUE_STOP_DEBUG */
 400                 ieee80211_wake_queue(ar->hw, i);
 401         }
 402
 403         if (queue_bitmap)
 404                 ar9170_tx(ar);
 405 }
 406
 407 static void ar9170_tx_ampdu_callback(struct ar9170 *ar, struct sk_buff *skb)
 408 {
 409         struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
 410         struct ar9170_tx_info *arinfo = (void *) txinfo->rate_driver_data;
 411
 412         arinfo->timeout = jiffies +
 413                           msecs_to_jiffies(AR9170_BA_TIMEOUT);
 414
 415         skb_queue_tail(&ar->tx_status_ampdu, skb);
 416         ar9170_tx_fake_ampdu_status(ar);
 417         ar->tx_ampdu_pending--;
 418
 419         if (!list_empty(&ar->tx_ampdu_list) && !ar->tx_ampdu_pending)
 420                 ar9170_tx_ampdu(ar);
 421 }
 422
 423 void ar9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb)
 424 {
 425         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 426         struct ar9170_tx_info *arinfo = (void *) info->rate_driver_data;
 427         unsigned int queue = skb_get_queue_mapping(skb);
 428         unsigned long flags;
 429
 430         spin_lock_irqsave(&ar->tx_stats_lock, flags);
 431         ar->tx_stats[queue].len--;
 432
 433         if (skb_queue_empty(&ar->tx_pending[queue])) {
 434 #ifdef AR9170_QUEUE_STOP_DEBUG
 435                 printk(KERN_DEBUG "%s: wake queue %d\n",
 436                        wiphy_name(ar->hw->wiphy), queue);
 437                 __ar9170_dump_txstats(ar);
 438 #endif /* AR9170_QUEUE_STOP_DEBUG */
 439                 ieee80211_wake_queue(ar->hw, queue);
 440         }
 441         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 442
 443         if (arinfo->flags & AR9170_TX_FLAG_BLOCK_ACK) {
 444                 ar9170_tx_ampdu_callback(ar, skb);
 445         } else if (arinfo->flags & AR9170_TX_FLAG_WAIT_FOR_ACK) {
 446                 arinfo->timeout = jiffies +
 447                                   msecs_to_jiffies(AR9170_TX_TIMEOUT);
 448
 449                 skb_queue_tail(&ar->tx_status[queue], skb);
 450         } else if (arinfo->flags & AR9170_TX_FLAG_NO_ACK) {
 451                 ar9170_tx_status(ar, skb, AR9170_TX_STATUS_FAILED);
 452         } else {
 453 #ifdef AR9170_QUEUE_DEBUG
 454                 printk(KERN_DEBUG "%s: unsupported frame flags!\n",
 455                        wiphy_name(ar->hw->wiphy));
 456                 ar9170_print_txheader(ar, skb);
 457 #endif /* AR9170_QUEUE_DEBUG */
 458                 dev_kfree_skb_any(skb);
 459         }
 460
 461         if (!ar->tx_stats[queue].len &&
 462             !skb_queue_empty(&ar->tx_pending[queue])) {
 463                 ar9170_tx(ar);
 464         }
 465 }
 466
 467 static struct sk_buff *ar9170_get_queued_skb(struct ar9170 *ar,
 468                                              const u8 *mac,
 469                                              struct sk_buff_head *queue,
 470                                              const u32 rate)
 471 {
 472         unsigned long flags;
 473         struct sk_buff *skb;
 474
 475         /*
 476          * Unfortunately, the firmware does not tell to which (queued) frame
 477          * this transmission status report belongs to.
 478          *
 479          * So we have to make risky guesses - with the scarce information
 480          * the firmware provided (-> destination MAC, and phy_control) -
 481          * and hope that we picked the right one...
 482          */
 483
 484         spin_lock_irqsave(&queue->lock, flags);
 485         skb_queue_walk(queue, skb) {
 486                 struct ar9170_tx_control *txc = (void *) skb->data;
 487                 struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 488                 u32 r;
 489
 490                 if (mac && compare_ether_addr(ieee80211_get_DA(hdr), mac)) {
 491 #ifdef AR9170_QUEUE_DEBUG
 492                         printk(KERN_DEBUG "%s: skip frame => DA %pM != %pM\n",
 493                                wiphy_name(ar->hw->wiphy), mac,
 494                                ieee80211_get_DA(hdr));
 495                         ar9170_print_txheader(ar, skb);
 496 #endif /* AR9170_QUEUE_DEBUG */
 497                         continue;
 498                 }
 499
 500                 r = (le32_to_cpu(txc->phy_control) & AR9170_TX_PHY_MCS_MASK) >>
 501                     AR9170_TX_PHY_MCS_SHIFT;
 502
 503                 if ((rate != AR9170_TX_INVALID_RATE) && (r != rate)) {
 504 #ifdef AR9170_QUEUE_DEBUG
 505                         printk(KERN_DEBUG "%s: skip frame => rate %d != %d\n",
 506                                wiphy_name(ar->hw->wiphy), rate, r);
 507                         ar9170_print_txheader(ar, skb);
 508 #endif /* AR9170_QUEUE_DEBUG */
 509                         continue;
 510                 }
 511
 512                 __skb_unlink(skb, queue);
 513                 spin_unlock_irqrestore(&queue->lock, flags);
 514                 return skb;
 515         }
 516
 517 #ifdef AR9170_QUEUE_DEBUG
 518         printk(KERN_ERR "%s: ESS:[%pM] does not have any "
 519                         "outstanding frames in queue.\n",
 520                         wiphy_name(ar->hw->wiphy), mac);
 521         __ar9170_dump_txqueue(ar, queue);
 522 #endif /* AR9170_QUEUE_DEBUG */
 523         spin_unlock_irqrestore(&queue->lock, flags);
 524
 525         return NULL;
 526 }
 527
 528 static void ar9170_handle_block_ack(struct ar9170 *ar, u16 count, u16 r)
 529 {
 530         struct sk_buff *skb;
 531         struct ieee80211_tx_info *txinfo;
 532
 533         while (count) {
 534                 skb = ar9170_get_queued_skb(ar, NULL, &ar->tx_status_ampdu, r);
 535                 if (!skb)
 536                         break;
 537
 538                 txinfo = IEEE80211_SKB_CB(skb);
 539                 ieee80211_tx_info_clear_status(txinfo);
 540
 541                 /* FIXME: maybe more ? */
 542                 txinfo->status.rates[0].count = 1;
 543
 544                 skb_pull(skb, sizeof(struct ar9170_tx_control));
 545                 ieee80211_tx_status_irqsafe(ar->hw, skb);
 546                 count--;
 547         }
 548
 549 #ifdef AR9170_TXAGG_DEBUG
 550         if (count) {
 551                 printk(KERN_DEBUG "%s: got %d more failed mpdus, but no more "
 552                        "suitable frames left in tx_status queue.\n",
 553                        wiphy_name(ar->hw->wiphy), count);
 554
 555                 ar9170_dump_tx_status_ampdu(ar);
 556         }
 557 #endif /* AR9170_TXAGG_DEBUG */
 558 }
 559
 560 /*
 561  * This worker tries to keeps an maintain tx_status queues.
 562  * So we can guarantee that incoming tx_status reports are
 563  * actually for a pending frame.
 564  */
 565
 566 static void ar9170_tx_janitor(struct work_struct *work)
 567 {
 568         struct ar9170 *ar = container_of(work, struct ar9170,
 569                                          tx_janitor.work);
 570         struct sk_buff_head waste;
 571         unsigned int i;
 572         bool resched = false;
 573
 574         if (unlikely(!IS_STARTED(ar)))
 575                 return ;
 576
 577         skb_queue_head_init(&waste);
 578
 579         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
 580 #ifdef AR9170_QUEUE_DEBUG
 581                 printk(KERN_DEBUG "%s: garbage collector scans queue:%d\n",
 582                        wiphy_name(ar->hw->wiphy), i);
 583                 ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
 584                 ar9170_dump_txqueue(ar, &ar->tx_status[i]);
 585 #endif /* AR9170_QUEUE_DEBUG */
 586
 587                 ar9170_recycle_expired(ar, &ar->tx_status[i], &waste);
 588                 ar9170_recycle_expired(ar, &ar->tx_pending[i], &waste);
 589                 skb_queue_purge(&waste);
 590
 591                 if (!skb_queue_empty(&ar->tx_status[i]) ||
 592                     !skb_queue_empty(&ar->tx_pending[i]))
 593                         resched = true;
 594         }
 595
 596         ar9170_tx_fake_ampdu_status(ar);
 597
 598         if (!resched)
 599                 return;
 600
 601         ieee80211_queue_delayed_work(ar->hw,
 602                                      &ar->tx_janitor,
 603                                      msecs_to_jiffies(AR9170_JANITOR_DELAY));
 604 }
 605
 606 void ar9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len)
 607 {
 608         struct ar9170_cmd_response *cmd = (void *) buf;
 609
 610         if ((cmd->type & 0xc0) != 0xc0) {
 611                 ar->callback_cmd(ar, len, buf);
 612                 return;
 613         }
 614
 615         /* hardware event handlers */
 616         switch (cmd->type) {
 617         case 0xc1: {
 618                 /*
 619                  * TX status notification:
 620                  * bytes: 0c c1 XX YY M1 M2 M3 M4 M5 M6 R4 R3 R2 R1 S2 S1
 621                  *
 622                  * XX always 81
 623                  * YY always 00
 624                  * M1-M6 is the MAC address
 625                  * R1-R4 is the transmit rate
 626                  * S1-S2 is the transmit status
 627                  */
 628
 629                 struct sk_buff *skb;
 630                 u32 phy = le32_to_cpu(cmd->tx_status.rate);
 631                 u32 q = (phy & AR9170_TX_PHY_QOS_MASK) >>
 632                         AR9170_TX_PHY_QOS_SHIFT;
 633 #ifdef AR9170_QUEUE_DEBUG
 634                 printk(KERN_DEBUG "%s: recv tx_status for %pM, p:%08x, q:%d\n",
 635                        wiphy_name(ar->hw->wiphy), cmd->tx_status.dst, phy, q);
 636 #endif /* AR9170_QUEUE_DEBUG */
 637
 638                 skb = ar9170_get_queued_skb(ar, cmd->tx_status.dst,
 639                                             &ar->tx_status[q],
 640                                             AR9170_TX_INVALID_RATE);
 641                 if (unlikely(!skb))
 642                         return ;
 643
 644                 ar9170_tx_status(ar, skb, le16_to_cpu(cmd->tx_status.status));
 645                 break;
 646                 }
 647
 648         case 0xc0:
 649                 /*
 650                  * pre-TBTT event
 651                  */
 652                 if (ar->vif && ar->vif->type == NL80211_IFTYPE_AP)
 653                         ieee80211_queue_work(ar->hw, &ar->beacon_work);
 654                 break;
 655
 656         case 0xc2:
 657                 /*
 658                  * (IBSS) beacon send notification
 659                  * bytes: 04 c2 XX YY B4 B3 B2 B1
 660                  *
 661                  * XX always 80
 662                  * YY always 00
 663                  * B1-B4 "should" be the number of send out beacons.
 664                  */
 665                 break;
 666
 667         case 0xc3:
 668                 /* End of Atim Window */
 669                 break;
 670
 671         case 0xc4:
 672                 /* BlockACK bitmap */
 673                 break;
 674
 675         case 0xc5:
 676                 /* BlockACK events */
 677                 ar9170_handle_block_ack(ar,
 678                                         le16_to_cpu(cmd->ba_fail_cnt.failed),
 679                                         le16_to_cpu(cmd->ba_fail_cnt.rate));
 680                 ar9170_tx_fake_ampdu_status(ar);
 681                 break;
 682
 683         case 0xc6:
 684                 /* Watchdog Interrupt */
 685                 break;
 686
 687         case 0xc9:
 688                 /* retransmission issue / SIFS/EIFS collision ?! */
 689                 break;
 690
 691         /* firmware debug */
 692         case 0xca:
 693                 printk(KERN_DEBUG "ar9170 FW: %.*s\n", len - 4, (char *)buf + 4);
 694                 break;
 695         case 0xcb:
 696                 len -= 4;
 697
 698                 switch (len) {
 699                 case 1:
 700                         printk(KERN_DEBUG "ar9170 FW: u8: %#.2x\n",
 701                                 *((char *)buf + 4));
 702                         break;
 703                 case 2:
 704                         printk(KERN_DEBUG "ar9170 FW: u8: %#.4x\n",
 705                                 le16_to_cpup((__le16 *)((char *)buf + 4)));
 706                         break;
 707                 case 4:
 708                         printk(KERN_DEBUG "ar9170 FW: u8: %#.8x\n",
 709                                 le32_to_cpup((__le32 *)((char *)buf + 4)));
 710                         break;
 711                 case 8:
 712                         printk(KERN_DEBUG "ar9170 FW: u8: %#.16lx\n",
 713                                 (unsigned long)le64_to_cpup(
 714                                                 (__le64 *)((char *)buf + 4)));
 715                         break;
 716                 }
 717                 break;
 718         case 0xcc:
 719                 print_hex_dump_bytes("ar9170 FW:", DUMP_PREFIX_NONE,
 720                                      (char *)buf + 4, len - 4);
 721                 break;
 722
 723         default:
 724                 printk(KERN_INFO "received unhandled event %x\n", cmd->type);
 725                 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
 726                 break;
 727         }
 728 }
 729
 730 static void ar9170_rx_reset_rx_mpdu(struct ar9170 *ar)
 731 {
 732         memset(&ar->rx_mpdu.plcp, 0, sizeof(struct ar9170_rx_head));
 733         ar->rx_mpdu.has_plcp = false;
 734 }
 735
 736 int ar9170_nag_limiter(struct ar9170 *ar)
 737 {
 738         bool print_message;
 739
 740         /*
 741          * we expect all sorts of errors in promiscuous mode.
 742          * don't bother with it, it's OK!
 743          */
 744         if (ar->sniffer_enabled)
 745                 return false;
 746
 747         /*
 748          * only go for frequent errors! The hardware tends to
 749          * do some stupid thing once in a while under load, in
 750          * noisy environments or just for fun!
 751          */
 752         if (time_before(jiffies, ar->bad_hw_nagger) && net_ratelimit())
 753                 print_message = true;
 754         else
 755                 print_message = false;
 756
 757         /* reset threshold for "once in a while" */
 758         ar->bad_hw_nagger = jiffies + HZ / 4;
 759         return print_message;
 760 }
 761
 762 static int ar9170_rx_mac_status(struct ar9170 *ar,
 763                                 struct ar9170_rx_head *head,
 764                                 struct ar9170_rx_macstatus *mac,
 765                                 struct ieee80211_rx_status *status)
 766 {
 767         u8 error, decrypt;
 768
 769         BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
 770         BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4);
 771
 772         error = mac->error;
 773         if (error & AR9170_RX_ERROR_MMIC) {
 774                 status->flag |= RX_FLAG_MMIC_ERROR;
 775                 error &= ~AR9170_RX_ERROR_MMIC;
 776         }
 777
 778         if (error & AR9170_RX_ERROR_PLCP) {
 779                 status->flag |= RX_FLAG_FAILED_PLCP_CRC;
 780                 error &= ~AR9170_RX_ERROR_PLCP;
 781
 782                 if (!(ar->filter_state & FIF_PLCPFAIL))
 783                         return -EINVAL;
 784         }
 785
 786         if (error & AR9170_RX_ERROR_FCS) {
 787                 status->flag |= RX_FLAG_FAILED_FCS_CRC;
 788                 error &= ~AR9170_RX_ERROR_FCS;
 789
 790                 if (!(ar->filter_state & FIF_FCSFAIL))
 791                         return -EINVAL;
 792         }
 793
 794         decrypt = ar9170_get_decrypt_type(mac);
 795         if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
 796             decrypt != AR9170_ENC_ALG_NONE)
 797                 status->flag |= RX_FLAG_DECRYPTED;
 798
 799         /* ignore wrong RA errors */
 800         error &= ~AR9170_RX_ERROR_WRONG_RA;
 801
 802         if (error & AR9170_RX_ERROR_DECRYPT) {
 803                 error &= ~AR9170_RX_ERROR_DECRYPT;
 804                 /*
 805                  * Rx decryption is done in place,
 806                  * the original data is lost anyway.
 807                  */
 808
 809                 return -EINVAL;
 810         }
 811
 812         /* drop any other error frames */
 813         if (unlikely(error)) {
 814                 /* TODO: update netdevice's RX dropped/errors statistics */
 815
 816                 if (ar9170_nag_limiter(ar))
 817                         printk(KERN_DEBUG "%s: received frame with "
 818                                "suspicious error code (%#x).\n",
 819                                wiphy_name(ar->hw->wiphy), error);
 820
 821                 return -EINVAL;
 822         }
 823
 824         status->band = ar->channel->band;
 825         status->freq = ar->channel->center_freq;
 826
 827         switch (mac->status & AR9170_RX_STATUS_MODULATION_MASK) {
 828         case AR9170_RX_STATUS_MODULATION_CCK:
 829                 if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
 830                         status->flag |= RX_FLAG_SHORTPRE;
 831                 switch (head->plcp[0]) {
 832                 case 0x0a:
 833                         status->rate_idx = 0;
 834                         break;
 835                 case 0x14:
 836                         status->rate_idx = 1;
 837                         break;
 838                 case 0x37:
 839                         status->rate_idx = 2;
 840                         break;
 841                 case 0x6e:
 842                         status->rate_idx = 3;
 843                         break;
 844                 default:
 845                         if (ar9170_nag_limiter(ar))
 846                                 printk(KERN_ERR "%s: invalid plcp cck rate "
 847                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 848                                        head->plcp[0]);
 849                         return -EINVAL;
 850                 }
 851                 break;
 852
 853         case AR9170_RX_STATUS_MODULATION_OFDM:
 854                 switch (head->plcp[0] & 0xf) {
 855                 case 0xb:
 856                         status->rate_idx = 0;
 857                         break;
 858                 case 0xf:
 859                         status->rate_idx = 1;
 860                         break;
 861                 case 0xa:
 862                         status->rate_idx = 2;
 863                         break;
 864                 case 0xe:
 865                         status->rate_idx = 3;
 866                         break;
 867                 case 0x9:
 868                         status->rate_idx = 4;
 869                         break;
 870                 case 0xd:
 871                         status->rate_idx = 5;
 872                         break;
 873                 case 0x8:
 874                         status->rate_idx = 6;
 875                         break;
 876                 case 0xc:
 877                         status->rate_idx = 7;
 878                         break;
 879                 default:
 880                         if (ar9170_nag_limiter(ar))
 881                                 printk(KERN_ERR "%s: invalid plcp ofdm rate "
 882                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 883                                        head->plcp[0]);
 884                         return -EINVAL;
 885                 }
 886                 if (status->band == IEEE80211_BAND_2GHZ)
 887                         status->rate_idx += 4;
 888                 break;
 889
 890         case AR9170_RX_STATUS_MODULATION_HT:
 891                 if (head->plcp[3] & 0x80)
 892                         status->flag |= RX_FLAG_40MHZ;
 893                 if (head->plcp[6] & 0x80)
 894                         status->flag |= RX_FLAG_SHORT_GI;
 895
 896                 status->rate_idx = clamp(0, 75, head->plcp[6] & 0x7f);
 897                 status->flag |= RX_FLAG_HT;
 898                 break;
 899
 900         case AR9170_RX_STATUS_MODULATION_DUPOFDM:
 901                 /* XXX */
 902                 if (ar9170_nag_limiter(ar))
 903                         printk(KERN_ERR "%s: invalid modulation\n",
 904                                wiphy_name(ar->hw->wiphy));
 905                 return -EINVAL;
 906         }
 907
 908         return 0;
 909 }
 910
 911 static void ar9170_rx_phy_status(struct ar9170 *ar,
 912                                  struct ar9170_rx_phystatus *phy,
 913                                  struct ieee80211_rx_status *status)
 914 {
 915         int i;
 916
 917         BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20);
 918
 919         for (i = 0; i < 3; i++)
 920                 if (phy->rssi[i] != 0x80)
 921                         status->antenna |= BIT(i);
 922
 923         /* post-process RSSI */
 924         for (i = 0; i < 7; i++)
 925                 if (phy->rssi[i] & 0x80)
 926                         phy->rssi[i] = ((phy->rssi[i] & 0x7f) + 1) & 0x7f;
 927
 928         /* TODO: we could do something with phy_errors */
 929         status->signal = ar->noise[0] + phy->rssi_combined;
 930         status->noise = ar->noise[0];
 931 }
 932
 933 static struct sk_buff *ar9170_rx_copy_data(u8 *buf, int len)
 934 {
 935         struct sk_buff *skb;
 936         int reserved = 0;
 937         struct ieee80211_hdr *hdr = (void *) buf;
 938
 939         if (ieee80211_is_data_qos(hdr->frame_control)) {
 940                 u8 *qc = ieee80211_get_qos_ctl(hdr);
 941                 reserved += NET_IP_ALIGN;
 942
 943                 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
 944                         reserved += NET_IP_ALIGN;
 945         }
 946
 947         if (ieee80211_has_a4(hdr->frame_control))
 948                 reserved += NET_IP_ALIGN;
 949
 950         reserved = 32 + (reserved & NET_IP_ALIGN);
 951
 952         skb = dev_alloc_skb(len + reserved);
 953         if (likely(skb)) {
 954                 skb_reserve(skb, reserved);
 955                 memcpy(skb_put(skb, len), buf, len);
 956         }
 957
 958         return skb;
 959 }
 960
 961 /*
 962  * If the frame alignment is right (or the kernel has
 963  * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
 964  * is only a single MPDU in the USB frame, then we could
 965  * submit to mac80211 the SKB directly. However, since
 966  * there may be multiple packets in one SKB in stream
 967  * mode, and we need to observe the proper ordering,
 968  * this is non-trivial.
 969  */
 970
 971 static void ar9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
 972 {
 973         struct ar9170_rx_head *head;
 974         struct ar9170_rx_macstatus *mac;
 975         struct ar9170_rx_phystatus *phy = NULL;
 976         struct ieee80211_rx_status status;
 977         struct sk_buff *skb;
 978         int mpdu_len;
 979
 980         if (unlikely(!IS_STARTED(ar) || len < (sizeof(*mac))))
 981                 return ;
 982
 983         /* Received MPDU */
 984         mpdu_len = len - sizeof(*mac);
 985
 986         mac = (void *)(buf + mpdu_len);
 987         if (unlikely(mac->error & AR9170_RX_ERROR_FATAL)) {
 988                 /* this frame is too damaged and can't be used - drop it */
 989
 990                 return ;
 991         }
 992
 993         switch (mac->status & AR9170_RX_STATUS_MPDU_MASK) {
 994         case AR9170_RX_STATUS_MPDU_FIRST:
 995                 /* first mpdu packet has the plcp header */
 996                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) {
 997                         head = (void *) buf;
 998                         memcpy(&ar->rx_mpdu.plcp, (void *) buf,
 999                                sizeof(struct ar9170_rx_head));
1000
1001                         mpdu_len -= sizeof(struct ar9170_rx_head);
1002                         buf += sizeof(struct ar9170_rx_head);
1003                         ar->rx_mpdu.has_plcp = true;
1004                 } else {
1005                         if (ar9170_nag_limiter(ar))
1006                                 printk(KERN_ERR "%s: plcp info is clipped.\n",
1007                                        wiphy_name(ar->hw->wiphy));
1008                         return ;
1009                 }
1010                 break;
1011
1012         case AR9170_RX_STATUS_MPDU_LAST:
1013                 /* last mpdu has a extra tail with phy status information */
1014
1015                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) {
1016                         mpdu_len -= sizeof(struct ar9170_rx_phystatus);
1017                         phy = (void *)(buf + mpdu_len);
1018                 } else {
1019                         if (ar9170_nag_limiter(ar))
1020                                 printk(KERN_ERR "%s: frame tail is clipped.\n",
1021                                        wiphy_name(ar->hw->wiphy));
1022                         return ;
1023                 }
1024
1025         case AR9170_RX_STATUS_MPDU_MIDDLE:
1026                 /* middle mpdus are just data */
1027                 if (unlikely(!ar->rx_mpdu.has_plcp)) {
1028                         if (!ar9170_nag_limiter(ar))
1029                                 return ;
1030
1031                         printk(KERN_ERR "%s: rx stream did not start "
1032                                         "with a first_mpdu frame tag.\n",
1033                                wiphy_name(ar->hw->wiphy));
1034
1035                         return ;
1036                 }
1037
1038                 head = &ar->rx_mpdu.plcp;
1039                 break;
1040
1041         case AR9170_RX_STATUS_MPDU_SINGLE:
1042                 /* single mpdu - has plcp (head) and phy status (tail) */
1043                 head = (void *) buf;
1044
1045                 mpdu_len -= sizeof(struct ar9170_rx_head);
1046                 mpdu_len -= sizeof(struct ar9170_rx_phystatus);
1047
1048                 buf += sizeof(struct ar9170_rx_head);
1049                 phy = (void *)(buf + mpdu_len);
1050                 break;
1051
1052         default:
1053                 BUG_ON(1);
1054                 break;
1055         }
1056
1057         if (unlikely(mpdu_len < FCS_LEN))
1058                 return ;
1059
1060         memset(&status, 0, sizeof(status));
1061         if (unlikely(ar9170_rx_mac_status(ar, head, mac, &status)))
1062                 return ;
1063
1064         if (phy)
1065                 ar9170_rx_phy_status(ar, phy, &status);
1066
1067         skb = ar9170_rx_copy_data(buf, mpdu_len);
1068         if (likely(skb)) {
1069                 memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
1070                 ieee80211_rx_irqsafe(ar->hw, skb);
1071         }
1072 }
1073
1074 void ar9170_rx(struct ar9170 *ar, struct sk_buff *skb)
1075 {
1076         unsigned int i, tlen, resplen, wlen = 0, clen = 0;
1077         u8 *tbuf, *respbuf;
1078
1079         tbuf = skb->data;
1080         tlen = skb->len;
1081
1082         while (tlen >= 4) {
1083                 clen = tbuf[1] << 8 | tbuf[0];
1084                 wlen = ALIGN(clen, 4);
1085
1086                 /* check if this is stream has a valid tag.*/
1087                 if (tbuf[2] != 0 || tbuf[3] != 0x4e) {
1088                         /*
1089                          * TODO: handle the highly unlikely event that the
1090                          * corrupted stream has the TAG at the right position.
1091                          */
1092
1093                         /* check if the frame can be repaired. */
1094                         if (!ar->rx_failover_missing) {
1095                                 /* this is no "short read". */
1096                                 if (ar9170_nag_limiter(ar)) {
1097                                         printk(KERN_ERR "%s: missing tag!\n",
1098                                                wiphy_name(ar->hw->wiphy));
1099                                         goto err_telluser;
1100                                 } else
1101                                         goto err_silent;
1102                         }
1103
1104                         if (ar->rx_failover_missing > tlen) {
1105                                 if (ar9170_nag_limiter(ar)) {
1106                                         printk(KERN_ERR "%s: possible multi "
1107                                                "stream corruption!\n",
1108                                                wiphy_name(ar->hw->wiphy));
1109                                         goto err_telluser;
1110                                 } else
1111                                         goto err_silent;
1112                         }
1113
1114                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
1115                         ar->rx_failover_missing -= tlen;
1116
1117                         if (ar->rx_failover_missing <= 0) {
1118                                 /*
1119                                  * nested ar9170_rx call!
1120                                  * termination is guranteed, even when the
1121                                  * combined frame also have a element with
1122                                  * a bad tag.
1123                                  */
1124
1125                                 ar->rx_failover_missing = 0;
1126                                 ar9170_rx(ar, ar->rx_failover);
1127
1128                                 skb_reset_tail_pointer(ar->rx_failover);
1129                                 skb_trim(ar->rx_failover, 0);
1130                         }
1131
1132                         return ;
1133                 }
1134
1135                 /* check if stream is clipped */
1136                 if (wlen > tlen - 4) {
1137                         if (ar->rx_failover_missing) {
1138                                 /* TODO: handle double stream corruption. */
1139                                 if (ar9170_nag_limiter(ar)) {
1140                                         printk(KERN_ERR "%s: double rx stream "
1141                                                "corruption!\n",
1142                                                 wiphy_name(ar->hw->wiphy));
1143                                         goto err_telluser;
1144                                 } else
1145                                         goto err_silent;
1146                         }
1147
1148                         /*
1149                          * save incomplete data set.
1150                          * the firmware will resend the missing bits when
1151                          * the rx - descriptor comes round again.
1152                          */
1153
1154                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
1155                         ar->rx_failover_missing = clen - tlen;
1156                         return ;
1157                 }
1158                 resplen = clen;
1159                 respbuf = tbuf + 4;
1160                 tbuf += wlen + 4;
1161                 tlen -= wlen + 4;
1162
1163                 i = 0;
1164
1165                 /* weird thing, but this is the same in the original driver */
1166                 while (resplen > 2 && i < 12 &&
1167                        respbuf[0] == 0xff && respbuf[1] == 0xff) {
1168                         i += 2;
1169                         resplen -= 2;
1170                         respbuf += 2;
1171                 }
1172
1173                 if (resplen < 4)
1174                         continue;
1175
1176                 /* found the 6 * 0xffff marker? */
1177                 if (i == 12)
1178                         ar9170_handle_command_response(ar, respbuf, resplen);
1179                 else
1180                         ar9170_handle_mpdu(ar, respbuf, clen);
1181         }
1182
1183         if (tlen) {
1184                 if (net_ratelimit())
1185                         printk(KERN_ERR "%s: %d bytes of unprocessed "
1186                                         "data left in rx stream!\n",
1187                                wiphy_name(ar->hw->wiphy), tlen);
1188
1189                 goto err_telluser;
1190         }
1191
1192         return ;
1193
1194 err_telluser:
1195         printk(KERN_ERR "%s: damaged RX stream data [want:%d, "
1196                         "data:%d, rx:%d, pending:%d ]\n",
1197                wiphy_name(ar->hw->wiphy), clen, wlen, tlen,
1198                ar->rx_failover_missing);
1199
1200         if (ar->rx_failover_missing)
1201                 print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET,
1202                                      ar->rx_failover->data,
1203                                      ar->rx_failover->len);
1204
1205         print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET,
1206                              skb->data, skb->len);
1207
1208         printk(KERN_ERR "%s: please check your hardware and cables, if "
1209                         "you see this message frequently.\n",
1210                wiphy_name(ar->hw->wiphy));
1211
1212 err_silent:
1213         if (ar->rx_failover_missing) {
1214                 skb_reset_tail_pointer(ar->rx_failover);
1215                 skb_trim(ar->rx_failover, 0);
1216                 ar->rx_failover_missing = 0;
1217         }
1218 }
1219
1220 #define AR9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)            \
1221 do {                                                                    \
1222         queue.aifs = ai_fs;                                             \
1223         queue.cw_min = cwmin;                                           \
1224         queue.cw_max = cwmax;                                           \
1225         queue.txop = _txop;                                             \
1226 } while (0)
1227
1228 static int ar9170_op_start(struct ieee80211_hw *hw)
1229 {
1230         struct ar9170 *ar = hw->priv;
1231         int err, i;
1232
1233         mutex_lock(&ar->mutex);
1234
1235         /* reinitialize queues statistics */
1236         memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
1237         for (i = 0; i < __AR9170_NUM_TXQ; i++)
1238                 ar->tx_stats[i].limit = AR9170_TXQ_DEPTH;
1239
1240         /* reset QoS defaults */
1241         AR9170_FILL_QUEUE(ar->edcf[0], 3, 15, 1023,  0); /* BEST EFFORT*/
1242         AR9170_FILL_QUEUE(ar->edcf[1], 7, 15, 1023,  0); /* BACKGROUND */
1243         AR9170_FILL_QUEUE(ar->edcf[2], 2, 7,    15, 94); /* VIDEO */
1244         AR9170_FILL_QUEUE(ar->edcf[3], 2, 3,     7, 47); /* VOICE */
1245         AR9170_FILL_QUEUE(ar->edcf[4], 2, 3,     7,  0); /* SPECIAL */
1246
1247         /* set sane AMPDU defaults */
1248         ar->global_ampdu_density = 6;
1249         ar->global_ampdu_factor = 3;
1250
1251         ar->bad_hw_nagger = jiffies;
1252
1253         err = ar->open(ar);
1254         if (err)
1255                 goto out;
1256
1257         err = ar9170_init_mac(ar);
1258         if (err)
1259                 goto out;
1260
1261         err = ar9170_set_qos(ar);
1262         if (err)
1263                 goto out;
1264
1265         err = ar9170_init_phy(ar, IEEE80211_BAND_2GHZ);
1266         if (err)
1267                 goto out;
1268
1269         err = ar9170_init_rf(ar);
1270         if (err)
1271                 goto out;
1272
1273         /* start DMA */
1274         err = ar9170_write_reg(ar, 0x1c3d30, 0x100);
1275         if (err)
1276                 goto out;
1277
1278         ar->state = AR9170_STARTED;
1279
1280 out:
1281         mutex_unlock(&ar->mutex);
1282         return err;
1283 }
1284
1285 static void ar9170_op_stop(struct ieee80211_hw *hw)
1286 {
1287         struct ar9170 *ar = hw->priv;
1288         unsigned int i;
1289
1290         if (IS_STARTED(ar))
1291                 ar->state = AR9170_IDLE;
1292
1293         cancel_delayed_work_sync(&ar->tx_janitor);
1294 #ifdef CONFIG_AR9170_LEDS
1295         cancel_delayed_work_sync(&ar->led_work);
1296 #endif
1297         cancel_work_sync(&ar->beacon_work);
1298
1299         mutex_lock(&ar->mutex);
1300
1301         if (IS_ACCEPTING_CMD(ar)) {
1302                 ar9170_set_leds_state(ar, 0);
1303
1304                 /* stop DMA */
1305                 ar9170_write_reg(ar, 0x1c3d30, 0);
1306                 ar->stop(ar);
1307         }
1308
1309         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
1310                 skb_queue_purge(&ar->tx_pending[i]);
1311                 skb_queue_purge(&ar->tx_status[i]);
1312         }
1313         skb_queue_purge(&ar->tx_status_ampdu);
1314
1315         mutex_unlock(&ar->mutex);
1316 }
1317
1318 static void ar9170_tx_indicate_immba(struct ar9170 *ar, struct sk_buff *skb)
1319 {
1320         struct ar9170_tx_control *txc = (void *) skb->data;
1321
1322         txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_IMM_AMPDU);
1323 }
1324
1325 static void ar9170_tx_copy_phy(struct ar9170 *ar, struct sk_buff *dst,
1326                                struct sk_buff *src)
1327 {
1328         struct ar9170_tx_control *dst_txc, *src_txc;
1329         struct ieee80211_tx_info *dst_info, *src_info;
1330         struct ar9170_tx_info *dst_arinfo, *src_arinfo;
1331
1332         src_txc = (void *) src->data;
1333         src_info = IEEE80211_SKB_CB(src);
1334         src_arinfo = (void *) src_info->rate_driver_data;
1335
1336         dst_txc = (void *) dst->data;
1337         dst_info = IEEE80211_SKB_CB(dst);
1338         dst_arinfo = (void *) dst_info->rate_driver_data;
1339
1340         dst_txc->phy_control = src_txc->phy_control;
1341
1342         /* same MCS for the whole aggregate */
1343         memcpy(dst_info->driver_rates, src_info->driver_rates,
1344                sizeof(dst_info->driver_rates));
1345 }
1346
1347 static int ar9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
1348 {
1349         struct ieee80211_hdr *hdr;
1350         struct ar9170_tx_control *txc;
1351         struct ieee80211_tx_info *info;
1352         struct ieee80211_tx_rate *txrate;
1353         struct ar9170_tx_info *arinfo;
1354         unsigned int queue = skb_get_queue_mapping(skb);
1355         u16 keytype = 0;
1356         u16 len, icv = 0;
1357
1358         BUILD_BUG_ON(sizeof(*arinfo) > sizeof(info->rate_driver_data));
1359
1360         hdr = (void *)skb->data;
1361         info = IEEE80211_SKB_CB(skb);
1362         len = skb->len;
1363
1364         txc = (void *)skb_push(skb, sizeof(*txc));
1365
1366         if (info->control.hw_key) {
1367                 icv = info->control.hw_key->icv_len;
1368
1369                 switch (info->control.hw_key->alg) {
1370                 case ALG_WEP:
1371                         keytype = AR9170_TX_MAC_ENCR_RC4;
1372                         break;
1373                 case ALG_TKIP:
1374                         keytype = AR9170_TX_MAC_ENCR_RC4;
1375                         break;
1376                 case ALG_CCMP:
1377                         keytype = AR9170_TX_MAC_ENCR_AES;
1378                         break;
1379                 default:
1380                         WARN_ON(1);
1381                         goto err_out;
1382                 }
1383         }
1384
1385         /* Length */
1386         txc->length = cpu_to_le16(len + icv + 4);
1387
1388         txc->mac_control = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
1389                                        AR9170_TX_MAC_BACKOFF);
1390         txc->mac_control |= cpu_to_le16(ar9170_qos_hwmap[queue] <<
1391                                         AR9170_TX_MAC_QOS_SHIFT);
1392         txc->mac_control |= cpu_to_le16(keytype);
1393         txc->phy_control = cpu_to_le32(0);
1394
1395         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1396                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_NO_ACK);
1397
1398         txrate = &info->control.rates[0];
1399         if (txrate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1400                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
1401         else if (txrate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1402                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
1403
1404         arinfo = (void *)info->rate_driver_data;
1405         arinfo->timeout = jiffies + msecs_to_jiffies(AR9170_QUEUE_TIMEOUT);
1406
1407         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
1408              (is_valid_ether_addr(ieee80211_get_DA(hdr)))) {
1409                 if (info->flags & IEEE80211_TX_CTL_AMPDU) {
1410                         if (unlikely(!info->control.sta))
1411                                 goto err_out;
1412
1413                         txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
1414                         arinfo->flags = AR9170_TX_FLAG_BLOCK_ACK;
1415
1416                         goto out;
1417                 }
1418
1419                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
1420                 /*
1421                  * WARNING:
1422                  * Putting the QoS queue bits into an unexplored territory is
1423                  * certainly not elegant.
1424                  *
1425                  * In my defense: This idea provides a reasonable way to
1426                  * smuggle valuable information to the tx_status callback.
1427                  * Also, the idea behind this bit-abuse came straight from
1428                  * the original driver code.
1429                  */
1430
1431                 txc->phy_control |=
1432                         cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
1433                 arinfo->flags = AR9170_TX_FLAG_WAIT_FOR_ACK;
1434         } else {
1435                 arinfo->flags = AR9170_TX_FLAG_NO_ACK;
1436         }
1437
1438 out:
1439         return 0;
1440
1441 err_out:
1442         skb_pull(skb, sizeof(*txc));
1443         return -EINVAL;
1444 }
1445
1446 static void ar9170_tx_prepare_phy(struct ar9170 *ar, struct sk_buff *skb)
1447 {
1448         struct ar9170_tx_control *txc;
1449         struct ieee80211_tx_info *info;
1450         struct ieee80211_rate *rate = NULL;
1451         struct ieee80211_tx_rate *txrate;
1452         u32 power, chains;
1453
1454         txc = (void *) skb->data;
1455         info = IEEE80211_SKB_CB(skb);
1456         txrate = &info->control.rates[0];
1457
1458         if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1459                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_GREENFIELD);
1460
1461         if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1462                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_PREAMBLE);
1463
1464         if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1465                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ);
1466         /* this works because 40 MHz is 2 and dup is 3 */
1467         if (txrate->flags & IEEE80211_TX_RC_DUP_DATA)
1468                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ_DUP);
1469
1470         if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
1471                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_GI);
1472
1473         if (txrate->flags & IEEE80211_TX_RC_MCS) {
1474                 u32 r = txrate->idx;
1475                 u8 *txpower;
1476
1477                 /* heavy clip control */
1478                 txc->phy_control |= cpu_to_le32((r & 0x7) << 7);
1479
1480                 r <<= AR9170_TX_PHY_MCS_SHIFT;
1481                 BUG_ON(r & ~AR9170_TX_PHY_MCS_MASK);
1482
1483                 txc->phy_control |= cpu_to_le32(r & AR9170_TX_PHY_MCS_MASK);
1484                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_MOD_HT);
1485
1486                 if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
1487                         if (info->band == IEEE80211_BAND_5GHZ)
1488                                 txpower = ar->power_5G_ht40;
1489                         else
1490                                 txpower = ar->power_2G_ht40;
1491                 } else {
1492                         if (info->band == IEEE80211_BAND_5GHZ)
1493                                 txpower = ar->power_5G_ht20;
1494                         else
1495                                 txpower = ar->power_2G_ht20;
1496                 }
1497
1498                 power = txpower[(txrate->idx) & 7];
1499         } else {
1500                 u8 *txpower;
1501                 u32 mod;
1502                 u32 phyrate;
1503                 u8 idx = txrate->idx;
1504
1505                 if (info->band != IEEE80211_BAND_2GHZ) {
1506                         idx += 4;
1507                         txpower = ar->power_5G_leg;
1508                         mod = AR9170_TX_PHY_MOD_OFDM;
1509                 } else {
1510                         if (idx < 4) {
1511                                 txpower = ar->power_2G_cck;
1512                                 mod = AR9170_TX_PHY_MOD_CCK;
1513                         } else {
1514                                 mod = AR9170_TX_PHY_MOD_OFDM;
1515                                 txpower = ar->power_2G_ofdm;
1516                         }
1517                 }
1518
1519                 rate = &__ar9170_ratetable[idx];
1520
1521                 phyrate = rate->hw_value & 0xF;
1522                 power = txpower[(rate->hw_value & 0x30) >> 4];
1523                 phyrate <<= AR9170_TX_PHY_MCS_SHIFT;
1524
1525                 txc->phy_control |= cpu_to_le32(mod);
1526                 txc->phy_control |= cpu_to_le32(phyrate);
1527         }
1528
1529         power <<= AR9170_TX_PHY_TX_PWR_SHIFT;
1530         power &= AR9170_TX_PHY_TX_PWR_MASK;
1531         txc->phy_control |= cpu_to_le32(power);
1532
1533         /* set TX chains */
1534         if (ar->eeprom.tx_mask == 1) {
1535                 chains = AR9170_TX_PHY_TXCHAIN_1;
1536         } else {
1537                 chains = AR9170_TX_PHY_TXCHAIN_2;
1538
1539                 /* >= 36M legacy OFDM - use only one chain */
1540                 if (rate && rate->bitrate >= 360)
1541                         chains = AR9170_TX_PHY_TXCHAIN_1;
1542         }
1543         txc->phy_control |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_SHIFT);
1544 }
1545
1546 static bool ar9170_tx_ampdu(struct ar9170 *ar)
1547 {
1548         struct sk_buff_head agg;
1549         struct ar9170_sta_tid *tid_info = NULL, *tmp;
1550         struct sk_buff *skb, *first = NULL;
1551         unsigned long flags, f2;
1552         unsigned int i = 0;
1553         u16 seq, queue, tmpssn;
1554         bool run = false;
1555
1556         skb_queue_head_init(&agg);
1557
1558         spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
1559         if (list_empty(&ar->tx_ampdu_list)) {
1560 #ifdef AR9170_TXAGG_DEBUG
1561                 printk(KERN_DEBUG "%s: aggregation list is empty.\n",
1562                        wiphy_name(ar->hw->wiphy));
1563 #endif /* AR9170_TXAGG_DEBUG */
1564                 goto out_unlock;
1565         }
1566
1567         list_for_each_entry_safe(tid_info, tmp, &ar->tx_ampdu_list, list) {
1568                 if (tid_info->state != AR9170_TID_STATE_COMPLETE) {
1569 #ifdef AR9170_TXAGG_DEBUG
1570                         printk(KERN_DEBUG "%s: dangling aggregation entry!\n",
1571                                wiphy_name(ar->hw->wiphy));
1572 #endif /* AR9170_TXAGG_DEBUG */
1573                         continue;
1574                 }
1575
1576                 if (++i > 64) {
1577 #ifdef AR9170_TXAGG_DEBUG
1578                         printk(KERN_DEBUG "%s: enough frames aggregated.\n",
1579                                wiphy_name(ar->hw->wiphy));
1580 #endif /* AR9170_TXAGG_DEBUG */
1581                         break;
1582                 }
1583
1584                 queue = TID_TO_WME_AC(tid_info->tid);
1585
1586                 if (skb_queue_len(&ar->tx_pending[queue]) >=
1587                     AR9170_NUM_TX_AGG_MAX) {
1588 #ifdef AR9170_TXAGG_DEBUG
1589                         printk(KERN_DEBUG "%s: queue %d full.\n",
1590                                wiphy_name(ar->hw->wiphy), queue);
1591 #endif /* AR9170_TXAGG_DEBUG */
1592                         continue;
1593                 }
1594
1595                 list_del_init(&tid_info->list);
1596
1597                 spin_lock_irqsave(&tid_info->queue.lock, f2);
1598                 tmpssn = seq = tid_info->ssn;
1599                 first = skb_peek(&tid_info->queue);
1600
1601                 if (likely(first))
1602                         tmpssn = ar9170_get_seq(first);
1603
1604                 if (unlikely(tmpssn != seq)) {
1605 #ifdef AR9170_TXAGG_DEBUG
1606                         printk(KERN_DEBUG "%s: ssn mismatch [%d != %d]\n.",
1607                                wiphy_name(ar->hw->wiphy), seq, tmpssn);
1608 #endif /* AR9170_TXAGG_DEBUG */
1609                         tid_info->ssn = tmpssn;
1610                 }
1611
1612 #ifdef AR9170_TXAGG_DEBUG
1613                 printk(KERN_DEBUG "%s: generate A-MPDU for tid:%d ssn:%d with "
1614                        "%d queued frames.\n", wiphy_name(ar->hw->wiphy),
1615                        tid_info->tid, tid_info->ssn,
1616                        skb_queue_len(&tid_info->queue));
1617                 __ar9170_dump_txqueue(ar, &tid_info->queue);
1618 #endif /* AR9170_TXAGG_DEBUG */
1619
1620                 while ((skb = skb_peek(&tid_info->queue))) {
1621                         if (unlikely(ar9170_get_seq(skb) != seq))
1622                                 break;
1623
1624                         __skb_unlink(skb, &tid_info->queue);
1625                         tid_info->ssn = seq = GET_NEXT_SEQ(seq);
1626
1627                         if (unlikely(skb_get_queue_mapping(skb) != queue)) {
1628 #ifdef AR9170_TXAGG_DEBUG
1629                                 printk(KERN_DEBUG "%s: tid:%d(q:%d) queue:%d "
1630                                        "!match.\n", wiphy_name(ar->hw->wiphy),
1631                                        tid_info->tid,
1632                                        TID_TO_WME_AC(tid_info->tid),
1633                                        skb_get_queue_mapping(skb));
1634 #endif /* AR9170_TXAGG_DEBUG */
1635                                         dev_kfree_skb_any(skb);
1636                                         continue;
1637                         }
1638
1639                         if (unlikely(first == skb)) {
1640                                 ar9170_tx_prepare_phy(ar, skb);
1641                                 __skb_queue_tail(&agg, skb);
1642                                 first = skb;
1643                         } else {
1644                                 ar9170_tx_copy_phy(ar, skb, first);
1645                                 __skb_queue_tail(&agg, skb);
1646                         }
1647
1648                         if (unlikely(skb_queue_len(&agg) ==
1649                             AR9170_NUM_TX_AGG_MAX))
1650                                 break;
1651                 }
1652
1653                 if (skb_queue_empty(&tid_info->queue))
1654                         tid_info->active = false;
1655                 else
1656                         list_add_tail(&tid_info->list,
1657                                       &ar->tx_ampdu_list);
1658
1659                 spin_unlock_irqrestore(&tid_info->queue.lock, f2);
1660
1661                 if (unlikely(skb_queue_empty(&agg))) {
1662 #ifdef AR9170_TXAGG_DEBUG
1663                         printk(KERN_DEBUG "%s: queued empty list!\n",
1664                                wiphy_name(ar->hw->wiphy));
1665 #endif /* AR9170_TXAGG_DEBUG */
1666                         continue;
1667                 }
1668
1669                 /*
1670                  * tell the FW/HW that this is the last frame,
1671                  * that way it will wait for the immediate block ack.
1672                  */
1673                 if (likely(skb_peek_tail(&agg)))
1674                         ar9170_tx_indicate_immba(ar, skb_peek_tail(&agg));
1675
1676 #ifdef AR9170_TXAGG_DEBUG
1677                 printk(KERN_DEBUG "%s: generated A-MPDU looks like this:\n",
1678                        wiphy_name(ar->hw->wiphy));
1679                 __ar9170_dump_txqueue(ar, &agg);
1680 #endif /* AR9170_TXAGG_DEBUG */
1681
1682                 spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
1683
1684                 spin_lock_irqsave(&ar->tx_pending[queue].lock, flags);
1685                 skb_queue_splice_tail_init(&agg, &ar->tx_pending[queue]);
1686                 spin_unlock_irqrestore(&ar->tx_pending[queue].lock, flags);
1687                 run = true;
1688
1689                 spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
1690         }
1691
1692 out_unlock:
1693         spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
1694         __skb_queue_purge(&agg);
1695
1696         return run;
1697 }
1698
1699 static void ar9170_tx(struct ar9170 *ar)
1700 {
1701         struct sk_buff *skb;
1702         unsigned long flags;
1703         struct ieee80211_tx_info *info;
1704         struct ar9170_tx_info *arinfo;
1705         unsigned int i, frames, frames_failed, remaining_space;
1706         int err;
1707         bool schedule_garbagecollector = false;
1708
1709         BUILD_BUG_ON(sizeof(*arinfo) > sizeof(info->rate_driver_data));
1710
1711         if (unlikely(!IS_STARTED(ar)))
1712                 return ;
1713
1714         remaining_space = AR9170_TX_MAX_PENDING;
1715
1716         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
1717                 spin_lock_irqsave(&ar->tx_stats_lock, flags);
1718                 if (ar->tx_stats[i].len >= ar->tx_stats[i].limit) {
1719 #ifdef AR9170_QUEUE_DEBUG
1720                         printk(KERN_DEBUG "%s: queue %d full\n",
1721                                wiphy_name(ar->hw->wiphy), i);
1722
1723                         printk(KERN_DEBUG "%s: stuck frames: ===> \n",
1724                                wiphy_name(ar->hw->wiphy));
1725                         ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
1726                         ar9170_dump_txqueue(ar, &ar->tx_status[i]);
1727 #endif /* AR9170_QUEUE_DEBUG */
1728
1729 #ifdef AR9170_QUEUE_STOP_DEBUG
1730                         printk(KERN_DEBUG "%s: stop queue %d\n",
1731                                wiphy_name(ar->hw->wiphy), i);
1732                         __ar9170_dump_txstats(ar);
1733 #endif /* AR9170_QUEUE_STOP_DEBUG */
1734                         ieee80211_stop_queue(ar->hw, i);
1735                         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1736                         continue;
1737                 }
1738
1739                 frames = min(ar->tx_stats[i].limit - ar->tx_stats[i].len,
1740                              skb_queue_len(&ar->tx_pending[i]));
1741
1742                 if (remaining_space < frames) {
1743 #ifdef AR9170_QUEUE_DEBUG
1744                         printk(KERN_DEBUG "%s: tx quota reached queue:%d, "
1745                                "remaining slots:%d, needed:%d\n",
1746                                wiphy_name(ar->hw->wiphy), i, remaining_space,
1747                                frames);
1748 #endif /* AR9170_QUEUE_DEBUG */
1749                         frames = remaining_space;
1750                 }
1751
1752                 ar->tx_stats[i].len += frames;
1753                 ar->tx_stats[i].count += frames;
1754                 spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1755
1756                 if (!frames)
1757                         continue;
1758
1759                 frames_failed = 0;
1760                 while (frames) {
1761                         skb = skb_dequeue(&ar->tx_pending[i]);
1762                         if (unlikely(!skb)) {
1763                                 frames_failed += frames;
1764                                 frames = 0;
1765                                 break;
1766                         }
1767
1768                         info = IEEE80211_SKB_CB(skb);
1769                         arinfo = (void *) info->rate_driver_data;
1770
1771                         /* TODO: cancel stuck frames */
1772                         arinfo->timeout = jiffies +
1773                                           msecs_to_jiffies(AR9170_TX_TIMEOUT);
1774
1775                         if (arinfo->flags == AR9170_TX_FLAG_BLOCK_ACK)
1776                                 ar->tx_ampdu_pending++;
1777
1778 #ifdef AR9170_QUEUE_DEBUG
1779                         printk(KERN_DEBUG "%s: send frame q:%d =>\n",
1780                                wiphy_name(ar->hw->wiphy), i);
1781                         ar9170_print_txheader(ar, skb);
1782 #endif /* AR9170_QUEUE_DEBUG */
1783
1784                         err = ar->tx(ar, skb);
1785                         if (unlikely(err)) {
1786                                 if (arinfo->flags == AR9170_TX_FLAG_BLOCK_ACK)
1787                                         ar->tx_ampdu_pending--;
1788
1789                                 frames_failed++;
1790                                 dev_kfree_skb_any(skb);
1791                         } else {
1792                                 remaining_space--;
1793                                 schedule_garbagecollector = true;
1794                         }
1795
1796                         frames--;
1797                 }
1798
1799 #ifdef AR9170_QUEUE_DEBUG
1800                 printk(KERN_DEBUG "%s: ar9170_tx report for queue %d\n",
1801                        wiphy_name(ar->hw->wiphy), i);
1802
1803                 printk(KERN_DEBUG "%s: unprocessed pending frames left:\n",
1804                        wiphy_name(ar->hw->wiphy));
1805                 ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
1806 #endif /* AR9170_QUEUE_DEBUG */
1807
1808                 if (unlikely(frames_failed)) {
1809 #ifdef AR9170_QUEUE_DEBUG
1810                         printk(KERN_DEBUG "%s: frames failed %d =>\n",
1811                                wiphy_name(ar->hw->wiphy), frames_failed);
1812 #endif /* AR9170_QUEUE_DEBUG */
1813
1814                         spin_lock_irqsave(&ar->tx_stats_lock, flags);
1815                         ar->tx_stats[i].len -= frames_failed;
1816                         ar->tx_stats[i].count -= frames_failed;
1817 #ifdef AR9170_QUEUE_STOP_DEBUG
1818                         printk(KERN_DEBUG "%s: wake queue %d\n",
1819                                wiphy_name(ar->hw->wiphy), i);
1820                         __ar9170_dump_txstats(ar);
1821 #endif /* AR9170_QUEUE_STOP_DEBUG */
1822                         ieee80211_wake_queue(ar->hw, i);
1823                         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1824                 }
1825         }
1826
1827         if (!schedule_garbagecollector)
1828                 return;
1829
1830         ieee80211_queue_delayed_work(ar->hw,
1831                                      &ar->tx_janitor,
1832                                      msecs_to_jiffies(AR9170_JANITOR_DELAY));
1833 }
1834
1835 static bool ar9170_tx_ampdu_queue(struct ar9170 *ar, struct sk_buff *skb)
1836 {
1837         struct ieee80211_tx_info *txinfo;
1838         struct ar9170_sta_info *sta_info;
1839         struct ar9170_sta_tid *agg;
1840         struct sk_buff *iter;
1841         unsigned long flags, f2;
1842         unsigned int max;
1843         u16 tid, seq, qseq;
1844         bool run = false, queue = false;
1845
1846         tid = ar9170_get_tid(skb);
1847         seq = ar9170_get_seq(skb);
1848         txinfo = IEEE80211_SKB_CB(skb);
1849         sta_info = (void *) txinfo->control.sta->drv_priv;
1850         agg = &sta_info->agg[tid];
1851         max = sta_info->ampdu_max_len;
1852
1853         spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
1854
1855         if (unlikely(agg->state != AR9170_TID_STATE_COMPLETE)) {
1856 #ifdef AR9170_TXAGG_DEBUG
1857                 printk(KERN_DEBUG "%s: BlockACK session not fully initialized "
1858                        "for ESS:%pM tid:%d state:%d.\n",
1859                        wiphy_name(ar->hw->wiphy), agg->addr, agg->tid,
1860                        agg->state);
1861 #endif /* AR9170_TXAGG_DEBUG */
1862                 goto err_unlock;
1863         }
1864
1865         if (!agg->active) {
1866                 agg->active = true;
1867                 agg->ssn = seq;
1868                 queue = true;
1869         }
1870
1871         /* check if seq is within the BA window */
1872         if (unlikely(!BAW_WITHIN(agg->ssn, max, seq))) {
1873 #ifdef AR9170_TXAGG_DEBUG
1874                 printk(KERN_DEBUG "%s: frame with tid:%d seq:%d does not "
1875                        "fit into BA window (%d - %d)\n",
1876                        wiphy_name(ar->hw->wiphy), tid, seq, agg->ssn,
1877                        (agg->ssn + max) & 0xfff);
1878 #endif /* AR9170_TXAGG_DEBUG */
1879                 goto err_unlock;
1880         }
1881
1882         spin_lock_irqsave(&agg->queue.lock, f2);
1883
1884         skb_queue_reverse_walk(&agg->queue, iter) {
1885                 qseq = ar9170_get_seq(iter);
1886
1887                 if (GET_NEXT_SEQ(qseq) == seq) {
1888                         __skb_queue_after(&agg->queue, iter, skb);
1889                         goto queued;
1890                 }
1891         }
1892
1893         __skb_queue_head(&agg->queue, skb);
1894
1895 queued:
1896         spin_unlock_irqrestore(&agg->queue.lock, f2);
1897
1898 #ifdef AR9170_TXAGG_DEBUG
1899         printk(KERN_DEBUG "%s: new aggregate %p queued.\n",
1900                wiphy_name(ar->hw->wiphy), skb);
1901         __ar9170_dump_txqueue(ar, &agg->queue);
1902 #endif /* AR9170_TXAGG_DEBUG */
1903
1904         if (skb_queue_len(&agg->queue) >= AR9170_NUM_TX_AGG_MAX)
1905                 run = true;
1906
1907         if (queue)
1908                 list_add_tail(&agg->list, &ar->tx_ampdu_list);
1909
1910         spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
1911         return run;
1912
1913 err_unlock:
1914         spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
1915         dev_kfree_skb_irq(skb);
1916         return false;
1917 }
1918
1919 int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
1920 {
1921         struct ar9170 *ar = hw->priv;
1922         struct ieee80211_tx_info *info;
1923
1924         if (unlikely(!IS_STARTED(ar)))
1925                 goto err_free;
1926
1927         if (unlikely(ar9170_tx_prepare(ar, skb)))
1928                 goto err_free;
1929
1930         info = IEEE80211_SKB_CB(skb);
1931         if (info->flags & IEEE80211_TX_CTL_AMPDU) {
1932                 bool run = ar9170_tx_ampdu_queue(ar, skb);
1933
1934                 if (run || !ar->tx_ampdu_pending)
1935                         ar9170_tx_ampdu(ar);
1936         } else {
1937                 unsigned int queue = skb_get_queue_mapping(skb);
1938
1939                 ar9170_tx_prepare_phy(ar, skb);
1940                 skb_queue_tail(&ar->tx_pending[queue], skb);
1941         }
1942
1943         ar9170_tx(ar);
1944         return NETDEV_TX_OK;
1945
1946 err_free:
1947         dev_kfree_skb_any(skb);
1948         return NETDEV_TX_OK;
1949 }
1950
1951 static int ar9170_op_add_interface(struct ieee80211_hw *hw,
1952                                    struct ieee80211_if_init_conf *conf)
1953 {
1954         struct ar9170 *ar = hw->priv;
1955         int err = 0;
1956
1957         mutex_lock(&ar->mutex);
1958
1959         if (ar->vif) {
1960                 err = -EBUSY;
1961                 goto unlock;
1962         }
1963
1964         ar->vif = conf->vif;
1965         memcpy(ar->mac_addr, conf->mac_addr, ETH_ALEN);
1966
1967         if (modparam_nohwcrypt || (ar->vif->type != NL80211_IFTYPE_STATION)) {
1968                 ar->rx_software_decryption = true;
1969                 ar->disable_offload = true;
1970         }
1971
1972         ar->cur_filter = 0;
1973         err = ar9170_update_frame_filter(ar, AR9170_MAC_REG_FTF_DEFAULTS);
1974         if (err)
1975                 goto unlock;
1976
1977         err = ar9170_set_operating_mode(ar);
1978
1979 unlock:
1980         mutex_unlock(&ar->mutex);
1981         return err;
1982 }
1983
1984 static void ar9170_op_remove_interface(struct ieee80211_hw *hw,
1985                                        struct ieee80211_if_init_conf *conf)
1986 {
1987         struct ar9170 *ar = hw->priv;
1988
1989         mutex_lock(&ar->mutex);
1990         ar->vif = NULL;
1991         ar9170_update_frame_filter(ar, 0);
1992         ar9170_set_beacon_timers(ar);
1993         dev_kfree_skb(ar->beacon);
1994         ar->beacon = NULL;
1995         ar->sniffer_enabled = false;
1996         ar->rx_software_decryption = false;
1997         ar9170_set_operating_mode(ar);
1998         mutex_unlock(&ar->mutex);
1999 }
2000
2001 static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
2002 {
2003         struct ar9170 *ar = hw->priv;
2004         int err = 0;
2005
2006         mutex_lock(&ar->mutex);
2007
2008         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
2009                 /* TODO */
2010                 err = 0;
2011         }
2012
2013         if (changed & IEEE80211_CONF_CHANGE_PS) {
2014                 /* TODO */
2015                 err = 0;
2016         }
2017
2018         if (changed & IEEE80211_CONF_CHANGE_POWER) {
2019                 /* TODO */
2020                 err = 0;
2021         }
2022
2023         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
2024                 /*
2025                  * is it long_frame_max_tx_count or short_frame_max_tx_count?
2026                  */
2027
2028                 err = ar9170_set_hwretry_limit(ar,
2029                         ar->hw->conf.long_frame_max_tx_count);
2030                 if (err)
2031                         goto out;
2032         }
2033
2034         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
2035
2036                 /* adjust slot time for 5 GHz */
2037                 err = ar9170_set_slot_time(ar);
2038                 if (err)
2039                         goto out;
2040
2041                 err = ar9170_set_dyn_sifs_ack(ar);
2042                 if (err)
2043                         goto out;
2044
2045                 err = ar9170_set_channel(ar, hw->conf.channel,
2046                                 AR9170_RFI_NONE,
2047                                 nl80211_to_ar9170(hw->conf.channel_type));
2048                 if (err)
2049                         goto out;
2050         }
2051
2052 out:
2053         mutex_unlock(&ar->mutex);
2054         return err;
2055 }
2056
2057 static u64 ar9170_op_prepare_multicast(struct ieee80211_hw *hw, int mc_count,
2058                                        struct dev_addr_list *mclist)
2059 {
2060         u64 mchash;
2061         int i;
2062
2063         /* always get broadcast frames */
2064         mchash = 1ULL << (0xff >> 2);
2065
2066         for (i = 0; i < mc_count; i++) {
2067                 if (WARN_ON(!mclist))
2068                         break;
2069                 mchash |= 1ULL << (mclist->dmi_addr[5] >> 2);
2070                 mclist = mclist->next;
2071         }
2072
2073         return mchash;
2074 }
2075
2076 static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
2077                                        unsigned int changed_flags,
2078                                        unsigned int *new_flags,
2079                                        u64 multicast)
2080 {
2081         struct ar9170 *ar = hw->priv;
2082
2083         if (unlikely(!IS_ACCEPTING_CMD(ar)))
2084                 return ;
2085
2086         mutex_lock(&ar->mutex);
2087
2088         /* mask supported flags */
2089         *new_flags &= FIF_ALLMULTI | FIF_CONTROL | FIF_BCN_PRBRESP_PROMISC |
2090                       FIF_PROMISC_IN_BSS | FIF_FCSFAIL | FIF_PLCPFAIL;
2091         ar->filter_state = *new_flags;
2092         /*
2093          * We can support more by setting the sniffer bit and
2094          * then checking the error flags, later.
2095          */
2096
2097         if (changed_flags & FIF_ALLMULTI && *new_flags & FIF_ALLMULTI)
2098                 multicast = ~0ULL;
2099
2100         if (multicast != ar->cur_mc_hash)
2101                 ar9170_update_multicast(ar, multicast);
2102
2103         if (changed_flags & FIF_CONTROL) {
2104                 u32 filter = AR9170_MAC_REG_FTF_PSPOLL |
2105                              AR9170_MAC_REG_FTF_RTS |
2106                              AR9170_MAC_REG_FTF_CTS |
2107                              AR9170_MAC_REG_FTF_ACK |
2108                              AR9170_MAC_REG_FTF_CFE |
2109                              AR9170_MAC_REG_FTF_CFE_ACK;
2110
2111                 if (*new_flags & FIF_CONTROL)
2112                         filter |= ar->cur_filter;
2113                 else
2114                         filter &= (~ar->cur_filter);
2115
2116                 ar9170_update_frame_filter(ar, filter);
2117         }
2118
2119         if (changed_flags & FIF_PROMISC_IN_BSS) {
2120                 ar->sniffer_enabled = ((*new_flags) & FIF_PROMISC_IN_BSS) != 0;
2121                 ar9170_set_operating_mode(ar);
2122         }
2123
2124         mutex_unlock(&ar->mutex);
2125 }
2126
2127
2128 static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
2129                                        struct ieee80211_vif *vif,
2130                                        struct ieee80211_bss_conf *bss_conf,
2131                                        u32 changed)
2132 {
2133         struct ar9170 *ar = hw->priv;
2134         int err = 0;
2135
2136         mutex_lock(&ar->mutex);
2137
2138         if (changed & BSS_CHANGED_BSSID) {
2139                 memcpy(ar->bssid, bss_conf->bssid, ETH_ALEN);
2140                 err = ar9170_set_operating_mode(ar);
2141                 if (err)
2142                         goto out;
2143         }
2144
2145         if (changed & BSS_CHANGED_BEACON_ENABLED)
2146                 ar->enable_beacon = bss_conf->enable_beacon;
2147
2148         if (changed & BSS_CHANGED_BEACON) {
2149                 err = ar9170_update_beacon(ar);
2150                 if (err)
2151                         goto out;
2152         }
2153
2154         if (changed & (BSS_CHANGED_BEACON_ENABLED | BSS_CHANGED_BEACON |
2155                        BSS_CHANGED_BEACON_INT)) {
2156                 err = ar9170_set_beacon_timers(ar);
2157                 if (err)
2158                         goto out;
2159         }
2160
2161         if (changed & BSS_CHANGED_ASSOC) {
2162 #ifndef CONFIG_AR9170_LEDS
2163                 /* enable assoc LED. */
2164                 err = ar9170_set_leds_state(ar, bss_conf->assoc ? 2 : 0);
2165 #endif /* CONFIG_AR9170_LEDS */
2166         }
2167
2168         if (changed & BSS_CHANGED_HT) {
2169                 /* TODO */
2170                 err = 0;
2171         }
2172
2173         if (changed & BSS_CHANGED_ERP_SLOT) {
2174                 err = ar9170_set_slot_time(ar);
2175                 if (err)
2176                         goto out;
2177         }
2178
2179         if (changed & BSS_CHANGED_BASIC_RATES) {
2180                 err = ar9170_set_basic_rates(ar);
2181                 if (err)
2182                         goto out;
2183         }
2184
2185 out:
2186         mutex_unlock(&ar->mutex);
2187 }
2188
2189 static u64 ar9170_op_get_tsf(struct ieee80211_hw *hw)
2190 {
2191         struct ar9170 *ar = hw->priv;
2192         int err;
2193         u32 tsf_low;
2194         u32 tsf_high;
2195         u64 tsf;
2196
2197         mutex_lock(&ar->mutex);
2198         err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_L, &tsf_low);
2199         if (!err)
2200                 err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_H, &tsf_high);
2201         mutex_unlock(&ar->mutex);
2202
2203         if (WARN_ON(err))
2204                 return 0;
2205
2206         tsf = tsf_high;
2207         tsf = (tsf << 32) | tsf_low;
2208         return tsf;
2209 }
2210
2211 static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
2212                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
2213                           struct ieee80211_key_conf *key)
2214 {
2215         struct ar9170 *ar = hw->priv;
2216         int err = 0, i;
2217         u8 ktype;
2218
2219         if ((!ar->vif) || (ar->disable_offload))
2220                 return -EOPNOTSUPP;
2221
2222         switch (key->alg) {
2223         case ALG_WEP:
2224                 if (key->keylen == WLAN_KEY_LEN_WEP40)
2225                         ktype = AR9170_ENC_ALG_WEP64;
2226                 else
2227                         ktype = AR9170_ENC_ALG_WEP128;
2228                 break;
2229         case ALG_TKIP:
2230                 ktype = AR9170_ENC_ALG_TKIP;
2231                 break;
2232         case ALG_CCMP:
2233                 ktype = AR9170_ENC_ALG_AESCCMP;
2234                 break;
2235         default:
2236                 return -EOPNOTSUPP;
2237         }
2238
2239         mutex_lock(&ar->mutex);
2240         if (cmd == SET_KEY) {
2241                 if (unlikely(!IS_STARTED(ar))) {
2242                         err = -EOPNOTSUPP;
2243                         goto out;
2244                 }
2245
2246                 /* group keys need all-zeroes address */
2247                 if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
2248                         sta = NULL;
2249
2250                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
2251                         for (i = 0; i < 64; i++)
2252                                 if (!(ar->usedkeys & BIT(i)))
2253                                         break;
2254                         if (i == 64) {
2255                                 ar->rx_software_decryption = true;
2256                                 ar9170_set_operating_mode(ar);
2257                                 err = -ENOSPC;
2258                                 goto out;
2259                         }
2260                 } else {
2261                         i = 64 + key->keyidx;
2262                 }
2263
2264                 key->hw_key_idx = i;
2265
2266                 err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL, ktype, 0,
2267                                         key->key, min_t(u8, 16, key->keylen));
2268                 if (err)
2269                         goto out;
2270
2271                 if (key->alg == ALG_TKIP) {
2272                         err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL,
2273                                                 ktype, 1, key->key + 16, 16);
2274                         if (err)
2275                                 goto out;
2276
2277                         /*
2278                          * hardware is not capable generating the MMIC
2279                          * for fragmented frames!
2280                          */
2281                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
2282                 }
2283
2284                 if (i < 64)
2285                         ar->usedkeys |= BIT(i);
2286
2287                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
2288         } else {
2289                 if (unlikely(!IS_STARTED(ar))) {
2290                         /* The device is gone... together with the key ;-) */
2291                         err = 0;
2292                         goto out;
2293                 }
2294
2295                 err = ar9170_disable_key(ar, key->hw_key_idx);
2296                 if (err)
2297                         goto out;
2298
2299                 if (key->hw_key_idx < 64) {
2300                         ar->usedkeys &= ~BIT(key->hw_key_idx);
2301                 } else {
2302                         err = ar9170_upload_key(ar, key->hw_key_idx, NULL,
2303                                                 AR9170_ENC_ALG_NONE, 0,
2304                                                 NULL, 0);
2305                         if (err)
2306                                 goto out;
2307
2308                         if (key->alg == ALG_TKIP) {
2309                                 err = ar9170_upload_key(ar, key->hw_key_idx,
2310                                                         NULL,
2311                                                         AR9170_ENC_ALG_NONE, 1,
2312                                                         NULL, 0);
2313                                 if (err)
2314                                         goto out;
2315                         }
2316
2317                 }
2318         }
2319
2320         ar9170_regwrite_begin(ar);
2321         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_L, ar->usedkeys);
2322         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_H, ar->usedkeys >> 32);
2323         ar9170_regwrite_finish();
2324         err = ar9170_regwrite_result();
2325
2326 out:
2327         mutex_unlock(&ar->mutex);
2328
2329         return err;
2330 }
2331
2332 static void ar9170_sta_notify(struct ieee80211_hw *hw,
2333                               struct ieee80211_vif *vif,
2334                               enum sta_notify_cmd cmd,
2335                               struct ieee80211_sta *sta)
2336 {
2337         struct ar9170 *ar = hw->priv;
2338         struct ar9170_sta_info *sta_info = (void *) sta->drv_priv;
2339         unsigned int i;
2340
2341         switch (cmd) {
2342         case STA_NOTIFY_ADD:
2343                 memset(sta_info, 0, sizeof(*sta_info));
2344
2345                 if (!sta->ht_cap.ht_supported)
2346                         break;
2347
2348                 if (sta->ht_cap.ampdu_density > ar->global_ampdu_density)
2349                         ar->global_ampdu_density = sta->ht_cap.ampdu_density;
2350
2351                 if (sta->ht_cap.ampdu_factor < ar->global_ampdu_factor)
2352                         ar->global_ampdu_factor = sta->ht_cap.ampdu_factor;
2353
2354                 for (i = 0; i < AR9170_NUM_TID; i++) {
2355                         sta_info->agg[i].state = AR9170_TID_STATE_SHUTDOWN;
2356                         sta_info->agg[i].active = false;
2357                         sta_info->agg[i].ssn = 0;
2358                         sta_info->agg[i].retry = 0;
2359                         sta_info->agg[i].tid = i;
2360                         INIT_LIST_HEAD(&sta_info->agg[i].list);
2361                         skb_queue_head_init(&sta_info->agg[i].queue);
2362                 }
2363
2364                 sta_info->ampdu_max_len = 1 << (3 + sta->ht_cap.ampdu_factor);
2365                 break;
2366
2367         case STA_NOTIFY_REMOVE:
2368                 if (!sta->ht_cap.ht_supported)
2369                         break;
2370
2371                 for (i = 0; i < AR9170_NUM_TID; i++) {
2372                         sta_info->agg[i].state = AR9170_TID_STATE_INVALID;
2373                         skb_queue_purge(&sta_info->agg[i].queue);
2374                 }
2375
2376                 break;
2377
2378         default:
2379                 break;
2380         }
2381 }
2382
2383 static int ar9170_get_stats(struct ieee80211_hw *hw,
2384                             struct ieee80211_low_level_stats *stats)
2385 {
2386         struct ar9170 *ar = hw->priv;
2387         u32 val;
2388         int err;
2389
2390         mutex_lock(&ar->mutex);
2391         err = ar9170_read_reg(ar, AR9170_MAC_REG_TX_RETRY, &val);
2392         ar->stats.dot11ACKFailureCount += val;
2393
2394         memcpy(stats, &ar->stats, sizeof(*stats));
2395         mutex_unlock(&ar->mutex);
2396
2397         return 0;
2398 }
2399
2400 static int ar9170_get_tx_stats(struct ieee80211_hw *hw,
2401                                struct ieee80211_tx_queue_stats *tx_stats)
2402 {
2403         struct ar9170 *ar = hw->priv;
2404
2405         spin_lock_bh(&ar->tx_stats_lock);
2406         memcpy(tx_stats, ar->tx_stats, sizeof(tx_stats[0]) * hw->queues);
2407         spin_unlock_bh(&ar->tx_stats_lock);
2408
2409         return 0;
2410 }
2411
2412 static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
2413                           const struct ieee80211_tx_queue_params *param)
2414 {
2415         struct ar9170 *ar = hw->priv;
2416         int ret;
2417
2418         mutex_lock(&ar->mutex);
2419         if (queue < __AR9170_NUM_TXQ) {
2420                 memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
2421                        param, sizeof(*param));
2422
2423                 ret = ar9170_set_qos(ar);
2424         } else {
2425                 ret = -EINVAL;
2426         }
2427
2428         mutex_unlock(&ar->mutex);
2429         return ret;
2430 }
2431
2432 static int ar9170_ampdu_action(struct ieee80211_hw *hw,
2433                                enum ieee80211_ampdu_mlme_action action,
2434                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
2435 {
2436         struct ar9170 *ar = hw->priv;
2437         struct ar9170_sta_info *sta_info = (void *) sta->drv_priv;
2438         struct ar9170_sta_tid *tid_info = &sta_info->agg[tid];
2439         unsigned long flags;
2440
2441         if (!modparam_ht)
2442                 return -EOPNOTSUPP;
2443
2444         switch (action) {
2445         case IEEE80211_AMPDU_TX_START:
2446                 spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
2447                 if (tid_info->state != AR9170_TID_STATE_SHUTDOWN ||
2448                     !list_empty(&tid_info->list)) {
2449                         spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
2450 #ifdef AR9170_TXAGG_DEBUG
2451                         printk(KERN_INFO "%s: A-MPDU [ESS:[%pM] tid:[%d]] "
2452                                "is in a very bad state!\n",
2453                                wiphy_name(hw->wiphy), sta->addr, tid);
2454 #endif /* AR9170_TXAGG_DEBUG */
2455                         return -EBUSY;
2456                 }
2457
2458                 *ssn = tid_info->ssn;
2459                 tid_info->state = AR9170_TID_STATE_PROGRESS;
2460                 tid_info->active = false;
2461                 spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
2462                 ieee80211_start_tx_ba_cb_irqsafe(hw, sta->addr, tid);
2463                 break;
2464
2465         case IEEE80211_AMPDU_TX_STOP:
2466                 spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
2467                 tid_info->state = AR9170_TID_STATE_SHUTDOWN;
2468                 list_del_init(&tid_info->list);
2469                 tid_info->active = false;
2470                 skb_queue_purge(&tid_info->queue);
2471                 spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
2472                 ieee80211_stop_tx_ba_cb_irqsafe(hw, sta->addr, tid);
2473                 break;
2474
2475         case IEEE80211_AMPDU_TX_OPERATIONAL:
2476 #ifdef AR9170_TXAGG_DEBUG
2477                 printk(KERN_INFO "%s: A-MPDU for %pM [tid:%d] Operational.\n",
2478                        wiphy_name(hw->wiphy), sta->addr, tid);
2479 #endif /* AR9170_TXAGG_DEBUG */
2480                 spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
2481                 sta_info->agg[tid].state = AR9170_TID_STATE_COMPLETE;
2482                 spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
2483                 break;
2484
2485         case IEEE80211_AMPDU_RX_START:
2486         case IEEE80211_AMPDU_RX_STOP:
2487                 /* Handled by firmware */
2488                 break;
2489
2490         default:
2491                 return -EOPNOTSUPP;
2492         }
2493
2494         return 0;
2495 }
2496
2497 static const struct ieee80211_ops ar9170_ops = {
2498         .start                  = ar9170_op_start,
2499         .stop                   = ar9170_op_stop,
2500         .tx                     = ar9170_op_tx,
2501         .add_interface          = ar9170_op_add_interface,
2502         .remove_interface       = ar9170_op_remove_interface,
2503         .config                 = ar9170_op_config,
2504         .prepare_multicast      = ar9170_op_prepare_multicast,
2505         .configure_filter       = ar9170_op_configure_filter,
2506         .conf_tx                = ar9170_conf_tx,
2507         .bss_info_changed       = ar9170_op_bss_info_changed,
2508         .get_tsf                = ar9170_op_get_tsf,
2509         .set_key                = ar9170_set_key,
2510         .sta_notify             = ar9170_sta_notify,
2511         .get_stats              = ar9170_get_stats,
2512         .get_tx_stats           = ar9170_get_tx_stats,
2513         .ampdu_action           = ar9170_ampdu_action,
2514 };
2515
2516 void *ar9170_alloc(size_t priv_size)
2517 {
2518         struct ieee80211_hw *hw;
2519         struct ar9170 *ar;
2520         struct sk_buff *skb;
2521         int i;
2522
2523         /*
2524          * this buffer is used for rx stream reconstruction.
2525          * Under heavy load this device (or the transport layer?)
2526          * tends to split the streams into seperate rx descriptors.
2527          */
2528
2529         skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL);
2530         if (!skb)
2531                 goto err_nomem;
2532
2533         hw = ieee80211_alloc_hw(priv_size, &ar9170_ops);
2534         if (!hw)
2535                 goto err_nomem;
2536
2537         ar = hw->priv;
2538         ar->hw = hw;
2539         ar->rx_failover = skb;
2540
2541         mutex_init(&ar->mutex);
2542         spin_lock_init(&ar->cmdlock);
2543         spin_lock_init(&ar->tx_stats_lock);
2544         spin_lock_init(&ar->tx_ampdu_list_lock);
2545         skb_queue_head_init(&ar->tx_status_ampdu);
2546         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
2547                 skb_queue_head_init(&ar->tx_status[i]);
2548                 skb_queue_head_init(&ar->tx_pending[i]);
2549         }
2550         ar9170_rx_reset_rx_mpdu(ar);
2551         INIT_WORK(&ar->beacon_work, ar9170_new_beacon);
2552         INIT_DELAYED_WORK(&ar->tx_janitor, ar9170_tx_janitor);
2553         INIT_LIST_HEAD(&ar->tx_ampdu_list);
2554
2555         /* all hw supports 2.4 GHz, so set channel to 1 by default */
2556         ar->channel = &ar9170_2ghz_chantable[0];
2557
2558         /* first part of wiphy init */
2559         ar->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
2560                                          BIT(NL80211_IFTYPE_WDS) |
2561                                          BIT(NL80211_IFTYPE_ADHOC);
2562         ar->hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
2563                          IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
2564                          IEEE80211_HW_SIGNAL_DBM |
2565                          IEEE80211_HW_NOISE_DBM;
2566
2567         if (modparam_ht) {
2568                 ar->hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
2569         } else {
2570                 ar9170_band_2GHz.ht_cap.ht_supported = false;
2571                 ar9170_band_5GHz.ht_cap.ht_supported = false;
2572         }
2573
2574         ar->hw->queues = __AR9170_NUM_TXQ;
2575         ar->hw->extra_tx_headroom = 8;
2576         ar->hw->sta_data_size = sizeof(struct ar9170_sta_info);
2577
2578         ar->hw->max_rates = 1;
2579         ar->hw->max_rate_tries = 3;
2580
2581         for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
2582                 ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
2583
2584         return ar;
2585
2586 err_nomem:
2587         kfree_skb(skb);
2588         return ERR_PTR(-ENOMEM);
2589 }
2590
2591 static int ar9170_read_eeprom(struct ar9170 *ar)
2592 {
2593 #define RW      8       /* number of words to read at once */
2594 #define RB      (sizeof(u32) * RW)
2595         struct ath_regulatory *regulatory = &ar->common.regulatory;
2596         u8 *eeprom = (void *)&ar->eeprom;
2597         u8 *addr = ar->eeprom.mac_address;
2598         __le32 offsets[RW];
2599         unsigned int rx_streams, tx_streams, tx_params = 0;
2600         int i, j, err, bands = 0;
2601
2602         BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
2603
2604         BUILD_BUG_ON(RB > AR9170_MAX_CMD_LEN - 4);
2605 #ifndef __CHECKER__
2606         /* don't want to handle trailing remains */
2607         BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
2608 #endif
2609
2610         for (i = 0; i < sizeof(ar->eeprom)/RB; i++) {
2611                 for (j = 0; j < RW; j++)
2612                         offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
2613                                                  RB * i + 4 * j);
2614
2615                 err = ar->exec_cmd(ar, AR9170_CMD_RREG,
2616                                    RB, (u8 *) &offsets,
2617                                    RB, eeprom + RB * i);
2618                 if (err)
2619                         return err;
2620         }
2621
2622 #undef RW
2623 #undef RB
2624
2625         if (ar->eeprom.length == cpu_to_le16(0xFFFF))
2626                 return -ENODATA;
2627
2628         if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
2629                 ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar9170_band_2GHz;
2630                 bands++;
2631         }
2632         if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
2633                 ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &ar9170_band_5GHz;
2634                 bands++;
2635         }
2636
2637         rx_streams = hweight8(ar->eeprom.rx_mask);
2638         tx_streams = hweight8(ar->eeprom.tx_mask);
2639
2640         if (rx_streams != tx_streams)
2641                 tx_params = IEEE80211_HT_MCS_TX_RX_DIFF;
2642
2643         if (tx_streams >= 1 && tx_streams <= IEEE80211_HT_MCS_TX_MAX_STREAMS)
2644                 tx_params = (tx_streams - 1) <<
2645                             IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
2646
2647         ar9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params;
2648         ar9170_band_5GHz.ht_cap.mcs.tx_params |= tx_params;
2649
2650         /*
2651          * I measured this, a bandswitch takes roughly
2652          * 135 ms and a frequency switch about 80.
2653          *
2654          * FIXME: measure these values again once EEPROM settings
2655          *        are used, that will influence them!
2656          */
2657         if (bands == 2)
2658                 ar->hw->channel_change_time = 135 * 1000;
2659         else
2660                 ar->hw->channel_change_time = 80 * 1000;
2661
2662         regulatory->current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
2663         regulatory->current_rd_ext = le16_to_cpu(ar->eeprom.reg_domain[1]);
2664
2665         /* second part of wiphy init */
2666         SET_IEEE80211_PERM_ADDR(ar->hw, addr);
2667
2668         return bands ? 0 : -EINVAL;
2669 }
2670
2671 static int ar9170_reg_notifier(struct wiphy *wiphy,
2672                         struct regulatory_request *request)
2673 {
2674         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
2675         struct ar9170 *ar = hw->priv;
2676
2677         return ath_reg_notifier_apply(wiphy, request, &ar->common.regulatory);
2678 }
2679
2680 int ar9170_register(struct ar9170 *ar, struct device *pdev)
2681 {
2682         struct ath_regulatory *regulatory = &ar->common.regulatory;
2683         int err;
2684
2685         /* try to read EEPROM, init MAC addr */
2686         err = ar9170_read_eeprom(ar);
2687         if (err)
2688                 goto err_out;
2689
2690         err = ath_regd_init(regulatory, ar->hw->wiphy,
2691                             ar9170_reg_notifier);
2692         if (err)
2693                 goto err_out;
2694
2695         err = ieee80211_register_hw(ar->hw);
2696         if (err)
2697                 goto err_out;
2698
2699         if (!ath_is_world_regd(regulatory))
2700                 regulatory_hint(ar->hw->wiphy, regulatory->alpha2);
2701
2702         err = ar9170_init_leds(ar);
2703         if (err)
2704                 goto err_unreg;
2705
2706 #ifdef CONFIG_AR9170_LEDS
2707         err = ar9170_register_leds(ar);
2708         if (err)
2709                 goto err_unreg;
2710 #endif /* CONFIG_AR9170_LEDS */
2711
2712         dev_info(pdev, "Atheros AR9170 is registered as '%s'\n",
2713                  wiphy_name(ar->hw->wiphy));
2714
2715         return err;
2716
2717 err_unreg:
2718         ieee80211_unregister_hw(ar->hw);
2719
2720 err_out:
2721         return err;
2722 }
2723
2724 void ar9170_unregister(struct ar9170 *ar)
2725 {
2726 #ifdef CONFIG_AR9170_LEDS
2727         ar9170_unregister_leds(ar);
2728 #endif /* CONFIG_AR9170_LEDS */
2729
2730         kfree_skb(ar->rx_failover);
2731         ieee80211_unregister_hw(ar->hw);
2732         mutex_destroy(&ar->mutex);
2733 }