Pileus Git - ~andy/linux/blob - drivers/net/wireless/ath/ar9170/main.c

   1 /*
   2  * Atheros AR9170 driver
   3  *
   4  * mac80211 interaction code
   5  *
   6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright 2009, Christian Lamparter <chunkeey@web.de>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; see the file COPYING.  If not, see
  21  * http://www.gnu.org/licenses/.
  22  *
  23  * This file incorporates work covered by the following copyright and
  24  * permission notice:
  25  *    Copyright (c) 2007-2008 Atheros Communications, Inc.
  26  *
  27  *    Permission to use, copy, modify, and/or distribute this software for any
  28  *    purpose with or without fee is hereby granted, provided that the above
  29  *    copyright notice and this permission notice appear in all copies.
  30  *
  31  *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  32  *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  33  *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  34  *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  35  *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  36  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  37  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  38  */
  39
  40 #include <linux/init.h>
  41 #include <linux/module.h>
  42 #include <linux/etherdevice.h>
  43 #include <net/mac80211.h>
  44 #include "ar9170.h"
  45 #include "hw.h"
  46 #include "cmd.h"
  47
  48 static int modparam_nohwcrypt;
  49 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
  50 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  51
  52 #define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
  53         .bitrate        = (_bitrate),                   \
  54         .flags          = (_flags),                     \
  55         .hw_value       = (_hw_rate) | (_txpidx) << 4,  \
  56 }
  57
  58 static struct ieee80211_rate __ar9170_ratetable[] = {
  59         RATE(10, 0, 0, 0),
  60         RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
  61         RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
  62         RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
  63         RATE(60, 0xb, 0, 0),
  64         RATE(90, 0xf, 0, 0),
  65         RATE(120, 0xa, 0, 0),
  66         RATE(180, 0xe, 0, 0),
  67         RATE(240, 0x9, 0, 0),
  68         RATE(360, 0xd, 1, 0),
  69         RATE(480, 0x8, 2, 0),
  70         RATE(540, 0xc, 3, 0),
  71 };
  72 #undef RATE
  73
  74 #define ar9170_g_ratetable      (__ar9170_ratetable + 0)
  75 #define ar9170_g_ratetable_size 12
  76 #define ar9170_a_ratetable      (__ar9170_ratetable + 4)
  77 #define ar9170_a_ratetable_size 8
  78
  79 /*
  80  * NB: The hw_value is used as an index into the ar9170_phy_freq_params
  81  *     array in phy.c so that we don't have to do frequency lookups!
  82  */
  83 #define CHAN(_freq, _idx) {             \
  84         .center_freq    = (_freq),      \
  85         .hw_value       = (_idx),       \
  86         .max_power      = 18, /* XXX */ \
  87 }
  88
  89 static struct ieee80211_channel ar9170_2ghz_chantable[] = {
  90         CHAN(2412,  0),
  91         CHAN(2417,  1),
  92         CHAN(2422,  2),
  93         CHAN(2427,  3),
  94         CHAN(2432,  4),
  95         CHAN(2437,  5),
  96         CHAN(2442,  6),
  97         CHAN(2447,  7),
  98         CHAN(2452,  8),
  99         CHAN(2457,  9),
 100         CHAN(2462, 10),
 101         CHAN(2467, 11),
 102         CHAN(2472, 12),
 103         CHAN(2484, 13),
 104 };
 105
 106 static struct ieee80211_channel ar9170_5ghz_chantable[] = {
 107         CHAN(4920, 14),
 108         CHAN(4940, 15),
 109         CHAN(4960, 16),
 110         CHAN(4980, 17),
 111         CHAN(5040, 18),
 112         CHAN(5060, 19),
 113         CHAN(5080, 20),
 114         CHAN(5180, 21),
 115         CHAN(5200, 22),
 116         CHAN(5220, 23),
 117         CHAN(5240, 24),
 118         CHAN(5260, 25),
 119         CHAN(5280, 26),
 120         CHAN(5300, 27),
 121         CHAN(5320, 28),
 122         CHAN(5500, 29),
 123         CHAN(5520, 30),
 124         CHAN(5540, 31),
 125         CHAN(5560, 32),
 126         CHAN(5580, 33),
 127         CHAN(5600, 34),
 128         CHAN(5620, 35),
 129         CHAN(5640, 36),
 130         CHAN(5660, 37),
 131         CHAN(5680, 38),
 132         CHAN(5700, 39),
 133         CHAN(5745, 40),
 134         CHAN(5765, 41),
 135         CHAN(5785, 42),
 136         CHAN(5805, 43),
 137         CHAN(5825, 44),
 138         CHAN(5170, 45),
 139         CHAN(5190, 46),
 140         CHAN(5210, 47),
 141         CHAN(5230, 48),
 142 };
 143 #undef CHAN
 144
 145 #define AR9170_HT_CAP                                                   \
 146 {                                                                       \
 147         .ht_supported   = true,                                         \
 148         .cap            = IEEE80211_HT_CAP_MAX_AMSDU |                  \
 149                           IEEE80211_HT_CAP_SM_PS |                      \
 150                           IEEE80211_HT_CAP_SUP_WIDTH_20_40 |            \
 151                           IEEE80211_HT_CAP_SGI_40 |                     \
 152                           IEEE80211_HT_CAP_DSSSCCK40 |                  \
 153                           IEEE80211_HT_CAP_SM_PS,                       \
 154         .ampdu_factor   = 3, /* ?? */                                   \
 155         .ampdu_density  = 7, /* ?? */                                   \
 156         .mcs            = {                                             \
 157                 .rx_mask = { 0xFF, 0xFF, 0, 0, 0, 0, 0, 0, 0, 0, },     \
 158         },                                                              \
 159 }
 160
 161 static struct ieee80211_supported_band ar9170_band_2GHz = {
 162         .channels       = ar9170_2ghz_chantable,
 163         .n_channels     = ARRAY_SIZE(ar9170_2ghz_chantable),
 164         .bitrates       = ar9170_g_ratetable,
 165         .n_bitrates     = ar9170_g_ratetable_size,
 166         .ht_cap         = AR9170_HT_CAP,
 167 };
 168
 169 static struct ieee80211_supported_band ar9170_band_5GHz = {
 170         .channels       = ar9170_5ghz_chantable,
 171         .n_channels     = ARRAY_SIZE(ar9170_5ghz_chantable),
 172         .bitrates       = ar9170_a_ratetable,
 173         .n_bitrates     = ar9170_a_ratetable_size,
 174         .ht_cap         = AR9170_HT_CAP,
 175 };
 176
 177 #ifdef AR9170_QUEUE_DEBUG
 178 /*
 179  * In case some wants works with AR9170's crazy tx_status queueing techniques.
 180  * He might need this rather useful probing function.
 181  *
 182  * NOTE: caller must hold the queue's spinlock!
 183  */
 184
 185 static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
 186 {
 187         struct ar9170_tx_control *txc = (void *) skb->data;
 188         struct ieee80211_hdr *hdr = (void *)txc->frame_data;
 189
 190         printk(KERN_DEBUG "%s: => FRAME [skb:%p, queue:%d, DA:[%pM] "
 191                           "mac_control:%04x, phy_control:%08x]\n",
 192                wiphy_name(ar->hw->wiphy), skb, skb_get_queue_mapping(skb),
 193                ieee80211_get_DA(hdr), le16_to_cpu(txc->mac_control),
 194                le32_to_cpu(txc->phy_control));
 195 }
 196
 197 static void ar9170_dump_station_tx_status_queue(struct ar9170 *ar,
 198                                                 struct sk_buff_head *queue)
 199 {
 200         struct sk_buff *skb;
 201         int i = 0;
 202
 203         printk(KERN_DEBUG "---[ cut here ]---\n");
 204         printk(KERN_DEBUG "%s: %d entries in tx_status queue.\n",
 205                wiphy_name(ar->hw->wiphy), skb_queue_len(queue));
 206
 207         skb_queue_walk(queue, skb) {
 208                 struct ar9170_tx_control *txc = (void *) skb->data;
 209                 struct ieee80211_hdr *hdr = (void *)txc->frame_data;
 210
 211                 printk(KERN_DEBUG "index:%d => \n", i);
 212                 ar9170_print_txheader(ar, skb);
 213         }
 214         printk(KERN_DEBUG "---[ end ]---\n");
 215 }
 216 #endif /* AR9170_QUEUE_DEBUG */
 217
 218 void ar9170_handle_tx_status(struct ar9170 *ar, struct sk_buff *skb,
 219                              bool valid_status, u16 tx_status)
 220 {
 221         struct ieee80211_tx_info *txinfo;
 222         unsigned int retries = 0, queue = skb_get_queue_mapping(skb);
 223         unsigned long flags;
 224
 225         spin_lock_irqsave(&ar->tx_stats_lock, flags);
 226         ar->tx_stats[queue].len--;
 227         if (ieee80211_queue_stopped(ar->hw, queue))
 228                 ieee80211_wake_queue(ar->hw, queue);
 229         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 230
 231         txinfo = IEEE80211_SKB_CB(skb);
 232         ieee80211_tx_info_clear_status(txinfo);
 233
 234         switch (tx_status) {
 235         case AR9170_TX_STATUS_RETRY:
 236                 retries = 2;
 237         case AR9170_TX_STATUS_COMPLETE:
 238                 txinfo->flags |= IEEE80211_TX_STAT_ACK;
 239                 break;
 240
 241         case AR9170_TX_STATUS_FAILED:
 242                 retries = ar->hw->conf.long_frame_max_tx_count;
 243                 break;
 244
 245         default:
 246                 printk(KERN_ERR "%s: invalid tx_status response (%x).\n",
 247                        wiphy_name(ar->hw->wiphy), tx_status);
 248                 break;
 249         }
 250
 251         if (valid_status)
 252                 txinfo->status.rates[0].count = retries + 1;
 253
 254         skb_pull(skb, sizeof(struct ar9170_tx_control));
 255         ieee80211_tx_status_irqsafe(ar->hw, skb);
 256 }
 257
 258 static struct sk_buff *ar9170_find_skb_in_queue(struct ar9170 *ar,
 259                                                 const u8 *mac,
 260                                                 const u32 queue,
 261                                                 struct sk_buff_head *q)
 262 {
 263         unsigned long flags;
 264         struct sk_buff *skb;
 265
 266         spin_lock_irqsave(&q->lock, flags);
 267         skb_queue_walk(q, skb) {
 268                 struct ar9170_tx_control *txc = (void *) skb->data;
 269                 struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 270                 u32 txc_queue = (le32_to_cpu(txc->phy_control) &
 271                                 AR9170_TX_PHY_QOS_MASK) >>
 272                                 AR9170_TX_PHY_QOS_SHIFT;
 273
 274                 if  ((queue != txc_queue) ||
 275                      (compare_ether_addr(ieee80211_get_DA(hdr), mac)))
 276                         continue;
 277
 278                 __skb_unlink(skb, q);
 279                 spin_unlock_irqrestore(&q->lock, flags);
 280                 return skb;
 281         }
 282         spin_unlock_irqrestore(&q->lock, flags);
 283         return NULL;
 284 }
 285
 286 static struct sk_buff *ar9170_find_queued_skb(struct ar9170 *ar, const u8 *mac,
 287                                               const u32 queue)
 288 {
 289         struct ieee80211_sta *sta;
 290         struct sk_buff *skb;
 291
 292         /*
 293          * Unfortunately, the firmware does not tell to which (queued) frame
 294          * this transmission status report belongs to.
 295          *
 296          * So we have to make risky guesses - with the scarce information
 297          * the firmware provided (-> destination MAC, and phy_control) -
 298          * and hope that we picked the right one...
 299          */
 300         rcu_read_lock();
 301         sta = ieee80211_find_sta(ar->hw, mac);
 302
 303         if (likely(sta)) {
 304                 struct ar9170_sta_info *sta_priv = (void *) sta->drv_priv;
 305                 skb = skb_dequeue(&sta_priv->tx_status[queue]);
 306                 rcu_read_unlock();
 307                 if (likely(skb))
 308                         return skb;
 309         } else
 310                 rcu_read_unlock();
 311
 312         /* scan the waste queue for candidates */
 313         skb = ar9170_find_skb_in_queue(ar, mac, queue,
 314                                        &ar->global_tx_status_waste);
 315         if (!skb) {
 316                 /* so it still _must_ be in the global list. */
 317                 skb = ar9170_find_skb_in_queue(ar, mac, queue,
 318                                                &ar->global_tx_status);
 319         }
 320
 321 #ifdef AR9170_QUEUE_DEBUG
 322         if (unlikely((!skb) && net_ratelimit())) {
 323                 printk(KERN_ERR "%s: ESS:[%pM] does not have any "
 324                                 "outstanding frames in this queue (%d).\n",
 325                                 wiphy_name(ar->hw->wiphy), mac, queue);
 326         }
 327 #endif /* AR9170_QUEUE_DEBUG */
 328         return skb;
 329 }
 330
 331 /*
 332  * This worker tries to keep the global tx_status queue empty.
 333  * So we can guarantee that incoming tx_status reports for
 334  * unregistered stations are always synced with the actual
 335  * frame - which we think - belongs to.
 336  */
 337
 338 static void ar9170_tx_status_janitor(struct work_struct *work)
 339 {
 340         struct ar9170 *ar = container_of(work, struct ar9170,
 341                                          tx_status_janitor.work);
 342         struct sk_buff *skb;
 343
 344         if (unlikely(!IS_STARTED(ar)))
 345                 return ;
 346
 347         mutex_lock(&ar->mutex);
 348         /* recycle the garbage back to mac80211... one by one. */
 349         while ((skb = skb_dequeue(&ar->global_tx_status_waste))) {
 350 #ifdef AR9170_QUEUE_DEBUG
 351                 printk(KERN_DEBUG "%s: dispose queued frame =>\n",
 352                        wiphy_name(ar->hw->wiphy));
 353                 ar9170_print_txheader(ar, skb);
 354 #endif /* AR9170_QUEUE_DEBUG */
 355                 ar9170_handle_tx_status(ar, skb, false,
 356                                         AR9170_TX_STATUS_FAILED);
 357         }
 358
 359         while ((skb = skb_dequeue(&ar->global_tx_status))) {
 360 #ifdef AR9170_QUEUE_DEBUG
 361                 printk(KERN_DEBUG "%s: moving frame into waste queue =>\n",
 362                        wiphy_name(ar->hw->wiphy));
 363
 364                 ar9170_print_txheader(ar, skb);
 365 #endif /* AR9170_QUEUE_DEBUG */
 366                 skb_queue_tail(&ar->global_tx_status_waste, skb);
 367         }
 368
 369         /* recall the janitor in 100ms - if there's garbage in the can. */
 370         if (skb_queue_len(&ar->global_tx_status_waste) > 0)
 371                 queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
 372                                    msecs_to_jiffies(100));
 373
 374         mutex_unlock(&ar->mutex);
 375 }
 376
 377 static void ar9170_handle_command_response(struct ar9170 *ar,
 378                                            void *buf, u32 len)
 379 {
 380         struct ar9170_cmd_response *cmd = (void *) buf;
 381
 382         if ((cmd->type & 0xc0) != 0xc0) {
 383                 ar->callback_cmd(ar, len, buf);
 384                 return;
 385         }
 386
 387         /* hardware event handlers */
 388         switch (cmd->type) {
 389         case 0xc1: {
 390                 /*
 391                  * TX status notification:
 392                  * bytes: 0c c1 XX YY M1 M2 M3 M4 M5 M6 R4 R3 R2 R1 S2 S1
 393                  *
 394                  * XX always 81
 395                  * YY always 00
 396                  * M1-M6 is the MAC address
 397                  * R1-R4 is the transmit rate
 398                  * S1-S2 is the transmit status
 399                  */
 400
 401                 struct sk_buff *skb;
 402                 u32 queue = (le32_to_cpu(cmd->tx_status.rate) &
 403                             AR9170_TX_PHY_QOS_MASK) >> AR9170_TX_PHY_QOS_SHIFT;
 404
 405                 skb = ar9170_find_queued_skb(ar, cmd->tx_status.dst, queue);
 406                 if (unlikely(!skb))
 407                         return ;
 408
 409                 ar9170_handle_tx_status(ar, skb, true,
 410                                         le16_to_cpu(cmd->tx_status.status));
 411                 break;
 412                 }
 413
 414         case 0xc0:
 415                 /*
 416                  * pre-TBTT event
 417                  */
 418                 if (ar->vif && ar->vif->type == NL80211_IFTYPE_AP)
 419                         queue_work(ar->hw->workqueue, &ar->beacon_work);
 420                 break;
 421
 422         case 0xc2:
 423                 /*
 424                  * (IBSS) beacon send notification
 425                  * bytes: 04 c2 XX YY B4 B3 B2 B1
 426                  *
 427                  * XX always 80
 428                  * YY always 00
 429                  * B1-B4 "should" be the number of send out beacons.
 430                  */
 431                 break;
 432
 433         case 0xc3:
 434                 /* End of Atim Window */
 435                 break;
 436
 437         case 0xc4:
 438         case 0xc5:
 439                 /* BlockACK events */
 440                 break;
 441
 442         case 0xc6:
 443                 /* Watchdog Interrupt */
 444                 break;
 445
 446         case 0xc9:
 447                 /* retransmission issue / SIFS/EIFS collision ?! */
 448                 break;
 449
 450         default:
 451                 printk(KERN_INFO "received unhandled event %x\n", cmd->type);
 452                 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
 453                 break;
 454         }
 455 }
 456
 457 /*
 458  * If the frame alignment is right (or the kernel has
 459  * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
 460  * is only a single MPDU in the USB frame, then we can
 461  * submit to mac80211 the SKB directly. However, since
 462  * there may be multiple packets in one SKB in stream
 463  * mode, and we need to observe the proper ordering,
 464  * this is non-trivial.
 465  */
 466 static void ar9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
 467 {
 468         struct sk_buff *skb;
 469         struct ar9170_rx_head *head = (void *)buf;
 470         struct ar9170_rx_tail *tail;
 471         struct ieee80211_rx_status status;
 472         int mpdu_len, i;
 473         u8 error, antennas = 0, decrypt;
 474         __le16 fc;
 475         int reserved;
 476
 477         if (unlikely(!IS_STARTED(ar)))
 478                 return ;
 479
 480         /* Received MPDU */
 481         mpdu_len = len;
 482         mpdu_len -= sizeof(struct ar9170_rx_head);
 483         mpdu_len -= sizeof(struct ar9170_rx_tail);
 484         BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
 485         BUILD_BUG_ON(sizeof(struct ar9170_rx_tail) != 24);
 486
 487         if (mpdu_len <= FCS_LEN)
 488                 return;
 489
 490         tail = (void *)(buf + sizeof(struct ar9170_rx_head) + mpdu_len);
 491
 492         for (i = 0; i < 3; i++)
 493                 if (tail->rssi[i] != 0x80)
 494                         antennas |= BIT(i);
 495
 496         /* post-process RSSI */
 497         for (i = 0; i < 7; i++)
 498                 if (tail->rssi[i] & 0x80)
 499                         tail->rssi[i] = ((tail->rssi[i] & 0x7f) + 1) & 0x7f;
 500
 501         memset(&status, 0, sizeof(status));
 502
 503         status.band = ar->channel->band;
 504         status.freq = ar->channel->center_freq;
 505         status.signal = ar->noise[0] + tail->rssi_combined;
 506         status.noise = ar->noise[0];
 507         status.antenna = antennas;
 508
 509         switch (tail->status & AR9170_RX_STATUS_MODULATION_MASK) {
 510         case AR9170_RX_STATUS_MODULATION_CCK:
 511                 if (tail->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
 512                         status.flag |= RX_FLAG_SHORTPRE;
 513                 switch (head->plcp[0]) {
 514                 case 0x0a:
 515                         status.rate_idx = 0;
 516                         break;
 517                 case 0x14:
 518                         status.rate_idx = 1;
 519                         break;
 520                 case 0x37:
 521                         status.rate_idx = 2;
 522                         break;
 523                 case 0x6e:
 524                         status.rate_idx = 3;
 525                         break;
 526                 default:
 527                         if ((!ar->sniffer_enabled) && (net_ratelimit()))
 528                                 printk(KERN_ERR "%s: invalid plcp cck rate "
 529                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 530                                        head->plcp[0]);
 531                         return;
 532                 }
 533                 break;
 534         case AR9170_RX_STATUS_MODULATION_OFDM:
 535                 switch (head->plcp[0] & 0xF) {
 536                 case 0xB:
 537                         status.rate_idx = 0;
 538                         break;
 539                 case 0xF:
 540                         status.rate_idx = 1;
 541                         break;
 542                 case 0xA:
 543                         status.rate_idx = 2;
 544                         break;
 545                 case 0xE:
 546                         status.rate_idx = 3;
 547                         break;
 548                 case 0x9:
 549                         status.rate_idx = 4;
 550                         break;
 551                 case 0xD:
 552                         status.rate_idx = 5;
 553                         break;
 554                 case 0x8:
 555                         status.rate_idx = 6;
 556                         break;
 557                 case 0xC:
 558                         status.rate_idx = 7;
 559                         break;
 560                 default:
 561                         if ((!ar->sniffer_enabled) && (net_ratelimit()))
 562                                 printk(KERN_ERR "%s: invalid plcp ofdm rate "
 563                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 564                                        head->plcp[0]);
 565                         return;
 566                 }
 567                 if (status.band == IEEE80211_BAND_2GHZ)
 568                         status.rate_idx += 4;
 569                 break;
 570         case AR9170_RX_STATUS_MODULATION_HT:
 571         case AR9170_RX_STATUS_MODULATION_DUPOFDM:
 572                 /* XXX */
 573
 574                 if (net_ratelimit())
 575                         printk(KERN_ERR "%s: invalid modulation\n",
 576                                wiphy_name(ar->hw->wiphy));
 577                 return;
 578         }
 579
 580         error = tail->error;
 581
 582         if (error & AR9170_RX_ERROR_MMIC) {
 583                 status.flag |= RX_FLAG_MMIC_ERROR;
 584                 error &= ~AR9170_RX_ERROR_MMIC;
 585         }
 586
 587         if (error & AR9170_RX_ERROR_PLCP) {
 588                 status.flag |= RX_FLAG_FAILED_PLCP_CRC;
 589                 error &= ~AR9170_RX_ERROR_PLCP;
 590         }
 591
 592         if (error & AR9170_RX_ERROR_FCS) {
 593                 status.flag |= RX_FLAG_FAILED_FCS_CRC;
 594                 error &= ~AR9170_RX_ERROR_FCS;
 595         }
 596
 597         decrypt = ar9170_get_decrypt_type(tail);
 598         if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
 599             decrypt != AR9170_ENC_ALG_NONE)
 600                 status.flag |= RX_FLAG_DECRYPTED;
 601
 602         /* ignore wrong RA errors */
 603         error &= ~AR9170_RX_ERROR_WRONG_RA;
 604
 605         if (error & AR9170_RX_ERROR_DECRYPT) {
 606                 error &= ~AR9170_RX_ERROR_DECRYPT;
 607
 608                 /*
 609                  * Rx decryption is done in place,
 610                  * the original data is lost anyway.
 611                  */
 612                 return ;
 613         }
 614
 615         /* drop any other error frames */
 616         if ((error) && (net_ratelimit())) {
 617                 printk(KERN_DEBUG "%s: errors: %#x\n",
 618                        wiphy_name(ar->hw->wiphy), error);
 619                 return;
 620         }
 621
 622         buf += sizeof(struct ar9170_rx_head);
 623         fc = *(__le16 *)buf;
 624
 625         if (ieee80211_is_data_qos(fc) ^ ieee80211_has_a4(fc))
 626                 reserved = 32 + 2;
 627         else
 628                 reserved = 32;
 629
 630         skb = dev_alloc_skb(mpdu_len + reserved);
 631         if (!skb)
 632                 return;
 633
 634         skb_reserve(skb, reserved);
 635         memcpy(skb_put(skb, mpdu_len), buf, mpdu_len);
 636         ieee80211_rx_irqsafe(ar->hw, skb, &status);
 637 }
 638
 639 void ar9170_rx(struct ar9170 *ar, struct sk_buff *skb)
 640 {
 641         unsigned int i, tlen, resplen;
 642         u8 *tbuf, *respbuf;
 643
 644         tbuf = skb->data;
 645         tlen = skb->len;
 646
 647         while (tlen >= 4) {
 648                 int clen = tbuf[1] << 8 | tbuf[0];
 649                 int wlen = (clen + 3) & ~3;
 650
 651                 /*
 652                  * parse stream (if any)
 653                  */
 654                 if (tbuf[2] != 0 || tbuf[3] != 0x4e) {
 655                         printk(KERN_ERR "%s: missing tag!\n",
 656                                wiphy_name(ar->hw->wiphy));
 657                         return ;
 658                 }
 659                 if (wlen > tlen - 4) {
 660                         printk(KERN_ERR "%s: invalid RX (%d, %d, %d)\n",
 661                                wiphy_name(ar->hw->wiphy), clen, wlen, tlen);
 662                         print_hex_dump(KERN_DEBUG, "data: ",
 663                                        DUMP_PREFIX_OFFSET,
 664                                        16, 1, tbuf, tlen, true);
 665                         return ;
 666                 }
 667                 resplen = clen;
 668                 respbuf = tbuf + 4;
 669                 tbuf += wlen + 4;
 670                 tlen -= wlen + 4;
 671
 672                 i = 0;
 673
 674                 /* weird thing, but this is the same in the original driver */
 675                 while (resplen > 2 && i < 12 &&
 676                        respbuf[0] == 0xff && respbuf[1] == 0xff) {
 677                         i += 2;
 678                         resplen -= 2;
 679                         respbuf += 2;
 680                 }
 681
 682                 if (resplen < 4)
 683                         continue;
 684
 685                 /* found the 6 * 0xffff marker? */
 686                 if (i == 12)
 687                         ar9170_handle_command_response(ar, respbuf, resplen);
 688                 else
 689                         ar9170_handle_mpdu(ar, respbuf, resplen);
 690         }
 691
 692         if (tlen)
 693                 printk(KERN_ERR "%s: buffer remains!\n",
 694                        wiphy_name(ar->hw->wiphy));
 695 }
 696
 697 #define AR9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)            \
 698 do {                                                                    \
 699         queue.aifs = ai_fs;                                             \
 700         queue.cw_min = cwmin;                                           \
 701         queue.cw_max = cwmax;                                           \
 702         queue.txop = _txop;                                             \
 703 } while (0)
 704
 705 static int ar9170_op_start(struct ieee80211_hw *hw)
 706 {
 707         struct ar9170 *ar = hw->priv;
 708         int err, i;
 709
 710         mutex_lock(&ar->mutex);
 711
 712         /* reinitialize queues statistics */
 713         memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
 714         for (i = 0; i < ARRAY_SIZE(ar->tx_stats); i++)
 715                 ar->tx_stats[i].limit = 8;
 716
 717         /* reset QoS defaults */
 718         AR9170_FILL_QUEUE(ar->edcf[0], 3, 15, 1023,  0); /* BEST EFFORT*/
 719         AR9170_FILL_QUEUE(ar->edcf[1], 7, 15, 1023,  0); /* BACKGROUND */
 720         AR9170_FILL_QUEUE(ar->edcf[2], 2, 7,    15, 94); /* VIDEO */
 721         AR9170_FILL_QUEUE(ar->edcf[3], 2, 3,     7, 47); /* VOICE */
 722         AR9170_FILL_QUEUE(ar->edcf[4], 2, 3,     7,  0); /* SPECIAL */
 723
 724         err = ar->open(ar);
 725         if (err)
 726                 goto out;
 727
 728         err = ar9170_init_mac(ar);
 729         if (err)
 730                 goto out;
 731
 732         err = ar9170_set_qos(ar);
 733         if (err)
 734                 goto out;
 735
 736         err = ar9170_init_phy(ar, IEEE80211_BAND_2GHZ);
 737         if (err)
 738                 goto out;
 739
 740         err = ar9170_init_rf(ar);
 741         if (err)
 742                 goto out;
 743
 744         /* start DMA */
 745         err = ar9170_write_reg(ar, 0x1c3d30, 0x100);
 746         if (err)
 747                 goto out;
 748
 749         ar->state = AR9170_STARTED;
 750
 751 out:
 752         mutex_unlock(&ar->mutex);
 753         return err;
 754 }
 755
 756 static void ar9170_op_stop(struct ieee80211_hw *hw)
 757 {
 758         struct ar9170 *ar = hw->priv;
 759
 760         if (IS_STARTED(ar))
 761                 ar->state = AR9170_IDLE;
 762
 763         flush_workqueue(ar->hw->workqueue);
 764
 765         mutex_lock(&ar->mutex);
 766         cancel_delayed_work_sync(&ar->tx_status_janitor);
 767         cancel_work_sync(&ar->filter_config_work);
 768         cancel_work_sync(&ar->beacon_work);
 769         skb_queue_purge(&ar->global_tx_status_waste);
 770         skb_queue_purge(&ar->global_tx_status);
 771
 772         if (IS_ACCEPTING_CMD(ar)) {
 773                 ar9170_set_leds_state(ar, 0);
 774
 775                 /* stop DMA */
 776                 ar9170_write_reg(ar, 0x1c3d30, 0);
 777                 ar->stop(ar);
 778         }
 779
 780         mutex_unlock(&ar->mutex);
 781 }
 782
 783 int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 784 {
 785         struct ar9170 *ar = hw->priv;
 786         struct ieee80211_hdr *hdr;
 787         struct ar9170_tx_control *txc;
 788         struct ieee80211_tx_info *info;
 789         struct ieee80211_rate *rate = NULL;
 790         struct ieee80211_tx_rate *txrate;
 791         unsigned int queue = skb_get_queue_mapping(skb);
 792         unsigned long flags = 0;
 793         struct ar9170_sta_info *sta_info = NULL;
 794         u32 power, chains;
 795         u16 keytype = 0;
 796         u16 len, icv = 0;
 797         int err;
 798         bool tx_status;
 799
 800         if (unlikely(!IS_STARTED(ar)))
 801                 goto err_free;
 802
 803         hdr = (void *)skb->data;
 804         info = IEEE80211_SKB_CB(skb);
 805         len = skb->len;
 806
 807         spin_lock_irqsave(&ar->tx_stats_lock, flags);
 808         if (ar->tx_stats[queue].limit < ar->tx_stats[queue].len) {
 809                 spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 810                 return NETDEV_TX_OK;
 811         }
 812
 813         ar->tx_stats[queue].len++;
 814         ar->tx_stats[queue].count++;
 815         if (ar->tx_stats[queue].limit == ar->tx_stats[queue].len)
 816                 ieee80211_stop_queue(hw, queue);
 817
 818         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 819
 820         txc = (void *)skb_push(skb, sizeof(*txc));
 821
 822         tx_status = (((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) != 0) ||
 823                     ((info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) != 0));
 824
 825         if (info->control.hw_key) {
 826                 icv = info->control.hw_key->icv_len;
 827
 828                 switch (info->control.hw_key->alg) {
 829                 case ALG_WEP:
 830                         keytype = AR9170_TX_MAC_ENCR_RC4;
 831                         break;
 832                 case ALG_TKIP:
 833                         keytype = AR9170_TX_MAC_ENCR_RC4;
 834                         break;
 835                 case ALG_CCMP:
 836                         keytype = AR9170_TX_MAC_ENCR_AES;
 837                         break;
 838                 default:
 839                         WARN_ON(1);
 840                         goto err_dequeue;
 841                 }
 842         }
 843
 844         /* Length */
 845         txc->length = cpu_to_le16(len + icv + 4);
 846
 847         txc->mac_control = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
 848                                        AR9170_TX_MAC_BACKOFF);
 849         txc->mac_control |= cpu_to_le16(ar9170_qos_hwmap[queue] <<
 850                                         AR9170_TX_MAC_QOS_SHIFT);
 851         txc->mac_control |= cpu_to_le16(keytype);
 852         txc->phy_control = cpu_to_le32(0);
 853
 854         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
 855                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_NO_ACK);
 856
 857         if (info->flags & IEEE80211_TX_CTL_AMPDU)
 858                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
 859
 860         txrate = &info->control.rates[0];
 861
 862         if (txrate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
 863                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
 864         else if (txrate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
 865                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
 866
 867         if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
 868                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_GREENFIELD);
 869
 870         if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
 871                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_PREAMBLE);
 872
 873         if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
 874                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ);
 875         /* this works because 40 MHz is 2 and dup is 3 */
 876         if (txrate->flags & IEEE80211_TX_RC_DUP_DATA)
 877                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ_DUP);
 878
 879         if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
 880                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_GI);
 881
 882         if (txrate->flags & IEEE80211_TX_RC_MCS) {
 883                 u32 r = txrate->idx;
 884                 u8 *txpower;
 885
 886                 r <<= AR9170_TX_PHY_MCS_SHIFT;
 887                 if (WARN_ON(r & ~AR9170_TX_PHY_MCS_MASK))
 888                         goto err_dequeue;
 889                 txc->phy_control |= cpu_to_le32(r & AR9170_TX_PHY_MCS_MASK);
 890                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_MOD_HT);
 891
 892                 if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
 893                         if (info->band == IEEE80211_BAND_5GHZ)
 894                                 txpower = ar->power_5G_ht40;
 895                         else
 896                                 txpower = ar->power_2G_ht40;
 897                 } else {
 898                         if (info->band == IEEE80211_BAND_5GHZ)
 899                                 txpower = ar->power_5G_ht20;
 900                         else
 901                                 txpower = ar->power_2G_ht20;
 902                 }
 903
 904                 power = txpower[(txrate->idx) & 7];
 905         } else {
 906                 u8 *txpower;
 907                 u32 mod;
 908                 u32 phyrate;
 909                 u8 idx = txrate->idx;
 910
 911                 if (info->band != IEEE80211_BAND_2GHZ) {
 912                         idx += 4;
 913                         txpower = ar->power_5G_leg;
 914                         mod = AR9170_TX_PHY_MOD_OFDM;
 915                 } else {
 916                         if (idx < 4) {
 917                                 txpower = ar->power_2G_cck;
 918                                 mod = AR9170_TX_PHY_MOD_CCK;
 919                         } else {
 920                                 mod = AR9170_TX_PHY_MOD_OFDM;
 921                                 txpower = ar->power_2G_ofdm;
 922                         }
 923                 }
 924
 925                 rate = &__ar9170_ratetable[idx];
 926
 927                 phyrate = rate->hw_value & 0xF;
 928                 power = txpower[(rate->hw_value & 0x30) >> 4];
 929                 phyrate <<= AR9170_TX_PHY_MCS_SHIFT;
 930
 931                 txc->phy_control |= cpu_to_le32(mod);
 932                 txc->phy_control |= cpu_to_le32(phyrate);
 933         }
 934
 935         power <<= AR9170_TX_PHY_TX_PWR_SHIFT;
 936         power &= AR9170_TX_PHY_TX_PWR_MASK;
 937         txc->phy_control |= cpu_to_le32(power);
 938
 939         /* set TX chains */
 940         if (ar->eeprom.tx_mask == 1) {
 941                 chains = AR9170_TX_PHY_TXCHAIN_1;
 942         } else {
 943                 chains = AR9170_TX_PHY_TXCHAIN_2;
 944
 945                 /* >= 36M legacy OFDM - use only one chain */
 946                 if (rate && rate->bitrate >= 360)
 947                         chains = AR9170_TX_PHY_TXCHAIN_1;
 948         }
 949         txc->phy_control |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_SHIFT);
 950
 951         if (tx_status) {
 952                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
 953                 /*
 954                  * WARNING:
 955                  * Putting the QoS queue bits into an unexplored territory is
 956                  * certainly not elegant.
 957                  *
 958                  * In my defense: This idea provides a reasonable way to
 959                  * smuggle valuable information to the tx_status callback.
 960                  * Also, the idea behind this bit-abuse came straight from
 961                  * the original driver code.
 962                  */
 963
 964                 txc->phy_control |=
 965                         cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
 966
 967                 if (info->control.sta) {
 968                         sta_info = (void *) info->control.sta->drv_priv;
 969                         skb_queue_tail(&sta_info->tx_status[queue], skb);
 970                 } else {
 971                         skb_queue_tail(&ar->global_tx_status, skb);
 972
 973                         queue_delayed_work(ar->hw->workqueue,
 974                                            &ar->tx_status_janitor,
 975                                            msecs_to_jiffies(100));
 976                 }
 977         }
 978
 979         err = ar->tx(ar, skb, tx_status, 0);
 980         if (unlikely(tx_status && err)) {
 981                 if (info->control.sta)
 982                         skb_unlink(skb, &sta_info->tx_status[queue]);
 983                 else
 984                         skb_unlink(skb, &ar->global_tx_status);
 985         }
 986
 987         return NETDEV_TX_OK;
 988
 989 err_dequeue:
 990         spin_lock_irqsave(&ar->tx_stats_lock, flags);
 991         ar->tx_stats[queue].len--;
 992         ar->tx_stats[queue].count--;
 993         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 994
 995 err_free:
 996         dev_kfree_skb(skb);
 997         return NETDEV_TX_OK;
 998 }
 999
1000 static int ar9170_op_add_interface(struct ieee80211_hw *hw,
1001                                    struct ieee80211_if_init_conf *conf)
1002 {
1003         struct ar9170 *ar = hw->priv;
1004         int err = 0;
1005
1006         mutex_lock(&ar->mutex);
1007
1008         if (ar->vif) {
1009                 err = -EBUSY;
1010                 goto unlock;
1011         }
1012
1013         ar->vif = conf->vif;
1014         memcpy(ar->mac_addr, conf->mac_addr, ETH_ALEN);
1015
1016         if (modparam_nohwcrypt || (ar->vif->type != NL80211_IFTYPE_STATION)) {
1017                 ar->rx_software_decryption = true;
1018                 ar->disable_offload = true;
1019         }
1020
1021         ar->cur_filter = 0;
1022         ar->want_filter = AR9170_MAC_REG_FTF_DEFAULTS;
1023         err = ar9170_update_frame_filter(ar);
1024         if (err)
1025                 goto unlock;
1026
1027         err = ar9170_set_operating_mode(ar);
1028
1029 unlock:
1030         mutex_unlock(&ar->mutex);
1031         return err;
1032 }
1033
1034 static void ar9170_op_remove_interface(struct ieee80211_hw *hw,
1035                                        struct ieee80211_if_init_conf *conf)
1036 {
1037         struct ar9170 *ar = hw->priv;
1038
1039         mutex_lock(&ar->mutex);
1040         ar->vif = NULL;
1041         ar->want_filter = 0;
1042         ar9170_update_frame_filter(ar);
1043         ar9170_set_beacon_timers(ar);
1044         dev_kfree_skb(ar->beacon);
1045         ar->beacon = NULL;
1046         ar->sniffer_enabled = false;
1047         ar->rx_software_decryption = false;
1048         ar9170_set_operating_mode(ar);
1049         mutex_unlock(&ar->mutex);
1050 }
1051
1052 static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
1053 {
1054         struct ar9170 *ar = hw->priv;
1055         int err = 0;
1056
1057         mutex_lock(&ar->mutex);
1058
1059         if (changed & IEEE80211_CONF_CHANGE_RADIO_ENABLED) {
1060                 /* TODO */
1061                 err = 0;
1062         }
1063
1064         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
1065                 /* TODO */
1066                 err = 0;
1067         }
1068
1069         if (changed & IEEE80211_CONF_CHANGE_PS) {
1070                 /* TODO */
1071                 err = 0;
1072         }
1073
1074         if (changed & IEEE80211_CONF_CHANGE_POWER) {
1075                 /* TODO */
1076                 err = 0;
1077         }
1078
1079         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
1080                 /*
1081                  * is it long_frame_max_tx_count or short_frame_max_tx_count?
1082                  */
1083
1084                 err = ar9170_set_hwretry_limit(ar,
1085                         ar->hw->conf.long_frame_max_tx_count);
1086                 if (err)
1087                         goto out;
1088         }
1089
1090         if (changed & IEEE80211_CONF_CHANGE_BEACON_INTERVAL) {
1091                 err = ar9170_set_beacon_timers(ar);
1092                 if (err)
1093                         goto out;
1094         }
1095
1096         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
1097                 err = ar9170_set_channel(ar, hw->conf.channel,
1098                                 AR9170_RFI_NONE,
1099                                 nl80211_to_ar9170(hw->conf.channel_type));
1100                 if (err)
1101                         goto out;
1102                 /* adjust slot time for 5 GHz */
1103                 if (hw->conf.channel->band == IEEE80211_BAND_5GHZ)
1104                         err = ar9170_write_reg(ar, AR9170_MAC_REG_SLOT_TIME,
1105                                                9 << 10);
1106         }
1107
1108 out:
1109         mutex_unlock(&ar->mutex);
1110         return err;
1111 }
1112
1113 static int ar9170_op_config_interface(struct ieee80211_hw *hw,
1114                                       struct ieee80211_vif *vif,
1115                                       struct ieee80211_if_conf *conf)
1116 {
1117         struct ar9170 *ar = hw->priv;
1118         int err = 0;
1119
1120         mutex_lock(&ar->mutex);
1121
1122         if (conf->changed & IEEE80211_IFCC_BSSID) {
1123                 memcpy(ar->bssid, conf->bssid, ETH_ALEN);
1124                 err = ar9170_set_operating_mode(ar);
1125         }
1126
1127         if (conf->changed & IEEE80211_IFCC_BEACON) {
1128                 err = ar9170_update_beacon(ar);
1129
1130                 if (err)
1131                         goto out;
1132                 err = ar9170_set_beacon_timers(ar);
1133         }
1134
1135 out:
1136         mutex_unlock(&ar->mutex);
1137         return err;
1138 }
1139
1140 static void ar9170_set_filters(struct work_struct *work)
1141 {
1142         struct ar9170 *ar = container_of(work, struct ar9170,
1143                                          filter_config_work);
1144         int err;
1145
1146         if (unlikely(!IS_STARTED(ar)))
1147                 return ;
1148
1149         mutex_lock(&ar->mutex);
1150         if (ar->filter_changed & AR9170_FILTER_CHANGED_PROMISC) {
1151                 err = ar9170_set_operating_mode(ar);
1152                 if (err)
1153                         goto unlock;
1154         }
1155
1156         if (ar->filter_changed & AR9170_FILTER_CHANGED_MULTICAST) {
1157                 err = ar9170_update_multicast(ar);
1158                 if (err)
1159                         goto unlock;
1160         }
1161
1162         if (ar->filter_changed & AR9170_FILTER_CHANGED_FRAMEFILTER)
1163                 err = ar9170_update_frame_filter(ar);
1164
1165 unlock:
1166         mutex_unlock(&ar->mutex);
1167 }
1168
1169 static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
1170                                        unsigned int changed_flags,
1171                                        unsigned int *new_flags,
1172                                        int mc_count, struct dev_mc_list *mclist)
1173 {
1174         struct ar9170 *ar = hw->priv;
1175
1176         /* mask supported flags */
1177         *new_flags &= FIF_ALLMULTI | FIF_CONTROL | FIF_BCN_PRBRESP_PROMISC |
1178                       FIF_PROMISC_IN_BSS;
1179
1180         /*
1181          * We can support more by setting the sniffer bit and
1182          * then checking the error flags, later.
1183          */
1184
1185         if (changed_flags & FIF_ALLMULTI) {
1186                 if (*new_flags & FIF_ALLMULTI) {
1187                         ar->want_mc_hash = ~0ULL;
1188                 } else {
1189                         u64 mchash;
1190                         int i;
1191
1192                         /* always get broadcast frames */
1193                         mchash = 1ULL << (0xff>>2);
1194
1195                         for (i = 0; i < mc_count; i++) {
1196                                 if (WARN_ON(!mclist))
1197                                         break;
1198                                 mchash |= 1ULL << (mclist->dmi_addr[5] >> 2);
1199                                 mclist = mclist->next;
1200                         }
1201                 ar->want_mc_hash = mchash;
1202                 }
1203                 ar->filter_changed |= AR9170_FILTER_CHANGED_MULTICAST;
1204         }
1205
1206         if (changed_flags & FIF_CONTROL) {
1207                 u32 filter = AR9170_MAC_REG_FTF_PSPOLL |
1208                              AR9170_MAC_REG_FTF_RTS |
1209                              AR9170_MAC_REG_FTF_CTS |
1210                              AR9170_MAC_REG_FTF_ACK |
1211                              AR9170_MAC_REG_FTF_CFE |
1212                              AR9170_MAC_REG_FTF_CFE_ACK;
1213
1214                 if (*new_flags & FIF_CONTROL)
1215                         ar->want_filter = ar->cur_filter | filter;
1216                 else
1217                         ar->want_filter = ar->cur_filter & ~filter;
1218
1219                 ar->filter_changed |= AR9170_FILTER_CHANGED_FRAMEFILTER;
1220         }
1221
1222         if (changed_flags & FIF_PROMISC_IN_BSS) {
1223                 ar->sniffer_enabled = ((*new_flags) & FIF_PROMISC_IN_BSS) != 0;
1224                 ar->filter_changed |= AR9170_FILTER_CHANGED_PROMISC;
1225         }
1226
1227         if (likely(IS_STARTED(ar)))
1228                 queue_work(ar->hw->workqueue, &ar->filter_config_work);
1229 }
1230
1231 static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
1232                                        struct ieee80211_vif *vif,
1233                                        struct ieee80211_bss_conf *bss_conf,
1234                                        u32 changed)
1235 {
1236         struct ar9170 *ar = hw->priv;
1237         int err = 0;
1238
1239         mutex_lock(&ar->mutex);
1240
1241         ar9170_regwrite_begin(ar);
1242
1243         if (changed & BSS_CHANGED_ASSOC) {
1244                 ar->state = bss_conf->assoc ? AR9170_ASSOCIATED : ar->state;
1245
1246 #ifndef CONFIG_AR9170_LEDS
1247                 /* enable assoc LED. */
1248                 err = ar9170_set_leds_state(ar, bss_conf->assoc ? 2 : 0);
1249 #endif /* CONFIG_AR9170_LEDS */
1250         }
1251
1252         if (changed & BSS_CHANGED_HT) {
1253                 /* TODO */
1254                 err = 0;
1255         }
1256
1257         if (changed & BSS_CHANGED_ERP_SLOT) {
1258                 u32 slottime = 20;
1259
1260                 if (bss_conf->use_short_slot)
1261                         slottime = 9;
1262
1263                 ar9170_regwrite(AR9170_MAC_REG_SLOT_TIME, slottime << 10);
1264         }
1265
1266         if (changed & BSS_CHANGED_BASIC_RATES) {
1267                 u32 cck, ofdm;
1268
1269                 if (hw->conf.channel->band == IEEE80211_BAND_5GHZ) {
1270                         ofdm = bss_conf->basic_rates;
1271                         cck = 0;
1272                 } else {
1273                         /* four cck rates */
1274                         cck = bss_conf->basic_rates & 0xf;
1275                         ofdm = bss_conf->basic_rates >> 4;
1276                 }
1277                 ar9170_regwrite(AR9170_MAC_REG_BASIC_RATE,
1278                                 ofdm << 8 | cck);
1279         }
1280
1281         ar9170_regwrite_finish();
1282         err = ar9170_regwrite_result();
1283         mutex_unlock(&ar->mutex);
1284 }
1285
1286 static u64 ar9170_op_get_tsf(struct ieee80211_hw *hw)
1287 {
1288         struct ar9170 *ar = hw->priv;
1289         int err;
1290         u32 tsf_low;
1291         u32 tsf_high;
1292         u64 tsf;
1293
1294         mutex_lock(&ar->mutex);
1295         err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_L, &tsf_low);
1296         if (!err)
1297                 err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_H, &tsf_high);
1298         mutex_unlock(&ar->mutex);
1299
1300         if (WARN_ON(err))
1301                 return 0;
1302
1303         tsf = tsf_high;
1304         tsf = (tsf << 32) | tsf_low;
1305         return tsf;
1306 }
1307
1308 static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
1309                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
1310                           struct ieee80211_key_conf *key)
1311 {
1312         struct ar9170 *ar = hw->priv;
1313         int err = 0, i;
1314         u8 ktype;
1315
1316         if ((!ar->vif) || (ar->disable_offload))
1317                 return -EOPNOTSUPP;
1318
1319         switch (key->alg) {
1320         case ALG_WEP:
1321                 if (key->keylen == LEN_WEP40)
1322                         ktype = AR9170_ENC_ALG_WEP64;
1323                 else
1324                         ktype = AR9170_ENC_ALG_WEP128;
1325                 break;
1326         case ALG_TKIP:
1327                 ktype = AR9170_ENC_ALG_TKIP;
1328                 break;
1329         case ALG_CCMP:
1330                 ktype = AR9170_ENC_ALG_AESCCMP;
1331                 break;
1332         default:
1333                 return -EOPNOTSUPP;
1334         }
1335
1336         mutex_lock(&ar->mutex);
1337         if (cmd == SET_KEY) {
1338                 if (unlikely(!IS_STARTED(ar))) {
1339                         err = -EOPNOTSUPP;
1340                         goto out;
1341                 }
1342
1343                 /* group keys need all-zeroes address */
1344                 if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1345                         sta = NULL;
1346
1347                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
1348                         for (i = 0; i < 64; i++)
1349                                 if (!(ar->usedkeys & BIT(i)))
1350                                         break;
1351                         if (i == 64) {
1352                                 ar->rx_software_decryption = true;
1353                                 ar9170_set_operating_mode(ar);
1354                                 err = -ENOSPC;
1355                                 goto out;
1356                         }
1357                 } else {
1358                         i = 64 + key->keyidx;
1359                 }
1360
1361                 key->hw_key_idx = i;
1362
1363                 err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL, ktype, 0,
1364                                         key->key, min_t(u8, 16, key->keylen));
1365                 if (err)
1366                         goto out;
1367
1368                 if (key->alg == ALG_TKIP) {
1369                         err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL,
1370                                                 ktype, 1, key->key + 16, 16);
1371                         if (err)
1372                                 goto out;
1373
1374                         /*
1375                          * hardware is not capable generating the MMIC
1376                          * for fragmented frames!
1377                          */
1378                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
1379                 }
1380
1381                 if (i < 64)
1382                         ar->usedkeys |= BIT(i);
1383
1384                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
1385         } else {
1386                 if (unlikely(!IS_STARTED(ar))) {
1387                         /* The device is gone... together with the key ;-) */
1388                         err = 0;
1389                         goto out;
1390                 }
1391
1392                 err = ar9170_disable_key(ar, key->hw_key_idx);
1393                 if (err)
1394                         goto out;
1395
1396                 if (key->hw_key_idx < 64) {
1397                         ar->usedkeys &= ~BIT(key->hw_key_idx);
1398                 } else {
1399                         err = ar9170_upload_key(ar, key->hw_key_idx, NULL,
1400                                                 AR9170_ENC_ALG_NONE, 0,
1401                                                 NULL, 0);
1402                         if (err)
1403                                 goto out;
1404
1405                         if (key->alg == ALG_TKIP) {
1406                                 err = ar9170_upload_key(ar, key->hw_key_idx,
1407                                                         NULL,
1408                                                         AR9170_ENC_ALG_NONE, 1,
1409                                                         NULL, 0);
1410                                 if (err)
1411                                         goto out;
1412                         }
1413
1414                 }
1415         }
1416
1417         ar9170_regwrite_begin(ar);
1418         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_L, ar->usedkeys);
1419         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_H, ar->usedkeys >> 32);
1420         ar9170_regwrite_finish();
1421         err = ar9170_regwrite_result();
1422
1423 out:
1424         mutex_unlock(&ar->mutex);
1425
1426         return err;
1427 }
1428
1429 static void ar9170_sta_notify(struct ieee80211_hw *hw,
1430                               struct ieee80211_vif *vif,
1431                               enum sta_notify_cmd cmd,
1432                               struct ieee80211_sta *sta)
1433 {
1434         struct ar9170 *ar = hw->priv;
1435         struct ar9170_sta_info *info = (void *) sta->drv_priv;
1436         struct sk_buff *skb;
1437         unsigned int i;
1438
1439         switch (cmd) {
1440         case STA_NOTIFY_ADD:
1441                 for (i = 0; i < ar->hw->queues; i++)
1442                         skb_queue_head_init(&info->tx_status[i]);
1443                 break;
1444
1445         case STA_NOTIFY_REMOVE:
1446
1447                 /*
1448                  * transfer all outstanding frames that need a tx_status
1449                  * reports to the global tx_status queue
1450                  */
1451
1452                 for (i = 0; i < ar->hw->queues; i++) {
1453                         while ((skb = skb_dequeue(&info->tx_status[i]))) {
1454 #ifdef AR9170_QUEUE_DEBUG
1455                                 printk(KERN_DEBUG "%s: queueing frame in "
1456                                           "global tx_status queue =>\n",
1457                                        wiphy_name(ar->hw->wiphy));
1458
1459                                 ar9170_print_txheader(ar, skb);
1460 #endif /* AR9170_QUEUE_DEBUG */
1461                                 skb_queue_tail(&ar->global_tx_status, skb);
1462                         }
1463                 }
1464                 queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
1465                                    msecs_to_jiffies(100));
1466                 break;
1467
1468         default:
1469                 break;
1470         }
1471 }
1472
1473 static int ar9170_get_stats(struct ieee80211_hw *hw,
1474                             struct ieee80211_low_level_stats *stats)
1475 {
1476         struct ar9170 *ar = hw->priv;
1477         u32 val;
1478         int err;
1479
1480         mutex_lock(&ar->mutex);
1481         err = ar9170_read_reg(ar, AR9170_MAC_REG_TX_RETRY, &val);
1482         ar->stats.dot11ACKFailureCount += val;
1483
1484         memcpy(stats, &ar->stats, sizeof(*stats));
1485         mutex_unlock(&ar->mutex);
1486
1487         return 0;
1488 }
1489
1490 static int ar9170_get_tx_stats(struct ieee80211_hw *hw,
1491                                struct ieee80211_tx_queue_stats *tx_stats)
1492 {
1493         struct ar9170 *ar = hw->priv;
1494
1495         spin_lock_bh(&ar->tx_stats_lock);
1496         memcpy(tx_stats, ar->tx_stats, sizeof(tx_stats[0]) * hw->queues);
1497         spin_unlock_bh(&ar->tx_stats_lock);
1498
1499         return 0;
1500 }
1501
1502 static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
1503                           const struct ieee80211_tx_queue_params *param)
1504 {
1505         struct ar9170 *ar = hw->priv;
1506         int ret;
1507
1508         mutex_lock(&ar->mutex);
1509         if ((param) && !(queue > ar->hw->queues)) {
1510                 memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
1511                        param, sizeof(*param));
1512
1513                 ret = ar9170_set_qos(ar);
1514         } else
1515                 ret = -EINVAL;
1516
1517         mutex_unlock(&ar->mutex);
1518         return ret;
1519 }
1520
1521 static int ar9170_ampdu_action(struct ieee80211_hw *hw,
1522                                enum ieee80211_ampdu_mlme_action action,
1523                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
1524 {
1525         switch (action) {
1526         case IEEE80211_AMPDU_RX_START:
1527         case IEEE80211_AMPDU_RX_STOP:
1528                 /*
1529                  * Something goes wrong -- RX locks up
1530                  * after a while of receiving aggregated
1531                  * frames -- not enabling for now.
1532                  */
1533                 return -EOPNOTSUPP;
1534         default:
1535                 return -EOPNOTSUPP;
1536         }
1537 }
1538
1539 static const struct ieee80211_ops ar9170_ops = {
1540         .start                  = ar9170_op_start,
1541         .stop                   = ar9170_op_stop,
1542         .tx                     = ar9170_op_tx,
1543         .add_interface          = ar9170_op_add_interface,
1544         .remove_interface       = ar9170_op_remove_interface,
1545         .config                 = ar9170_op_config,
1546         .config_interface       = ar9170_op_config_interface,
1547         .configure_filter       = ar9170_op_configure_filter,
1548         .conf_tx                = ar9170_conf_tx,
1549         .bss_info_changed       = ar9170_op_bss_info_changed,
1550         .get_tsf                = ar9170_op_get_tsf,
1551         .set_key                = ar9170_set_key,
1552         .sta_notify             = ar9170_sta_notify,
1553         .get_stats              = ar9170_get_stats,
1554         .get_tx_stats           = ar9170_get_tx_stats,
1555         .ampdu_action           = ar9170_ampdu_action,
1556 };
1557
1558 void *ar9170_alloc(size_t priv_size)
1559 {
1560         struct ieee80211_hw *hw;
1561         struct ar9170 *ar;
1562         int i;
1563
1564         hw = ieee80211_alloc_hw(priv_size, &ar9170_ops);
1565         if (!hw)
1566                 return ERR_PTR(-ENOMEM);
1567
1568         ar = hw->priv;
1569         ar->hw = hw;
1570
1571         mutex_init(&ar->mutex);
1572         spin_lock_init(&ar->cmdlock);
1573         spin_lock_init(&ar->tx_stats_lock);
1574         skb_queue_head_init(&ar->global_tx_status);
1575         skb_queue_head_init(&ar->global_tx_status_waste);
1576         INIT_WORK(&ar->filter_config_work, ar9170_set_filters);
1577         INIT_WORK(&ar->beacon_work, ar9170_new_beacon);
1578         INIT_DELAYED_WORK(&ar->tx_status_janitor, ar9170_tx_status_janitor);
1579
1580         /* all hw supports 2.4 GHz, so set channel to 1 by default */
1581         ar->channel = &ar9170_2ghz_chantable[0];
1582
1583         /* first part of wiphy init */
1584         ar->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
1585                                          BIT(NL80211_IFTYPE_WDS) |
1586                                          BIT(NL80211_IFTYPE_ADHOC);
1587         ar->hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
1588                          IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
1589                          IEEE80211_HW_SIGNAL_DBM |
1590                          IEEE80211_HW_NOISE_DBM;
1591
1592         ar->hw->queues = __AR9170_NUM_TXQ;
1593         ar->hw->extra_tx_headroom = 8;
1594         ar->hw->sta_data_size = sizeof(struct ar9170_sta_info);
1595
1596         ar->hw->max_rates = 1;
1597         ar->hw->max_rate_tries = 3;
1598
1599         for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
1600                 ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
1601
1602         return ar;
1603 }
1604
1605 static int ar9170_read_eeprom(struct ar9170 *ar)
1606 {
1607 #define RW      8       /* number of words to read at once */
1608 #define RB      (sizeof(u32) * RW)
1609         DECLARE_MAC_BUF(mbuf);
1610         u8 *eeprom = (void *)&ar->eeprom;
1611         u8 *addr = ar->eeprom.mac_address;
1612         __le32 offsets[RW];
1613         int i, j, err, bands = 0;
1614
1615         BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
1616
1617         BUILD_BUG_ON(RB > AR9170_MAX_CMD_LEN - 4);
1618 #ifndef __CHECKER__
1619         /* don't want to handle trailing remains */
1620         BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
1621 #endif
1622
1623         for (i = 0; i < sizeof(ar->eeprom)/RB; i++) {
1624                 for (j = 0; j < RW; j++)
1625                         offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
1626                                                  RB * i + 4 * j);
1627
1628                 err = ar->exec_cmd(ar, AR9170_CMD_RREG,
1629                                    RB, (u8 *) &offsets,
1630                                    RB, eeprom + RB * i);
1631                 if (err)
1632                         return err;
1633         }
1634
1635 #undef RW
1636 #undef RB
1637
1638         if (ar->eeprom.length == cpu_to_le16(0xFFFF))
1639                 return -ENODATA;
1640
1641         if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
1642                 ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar9170_band_2GHz;
1643                 bands++;
1644         }
1645         if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
1646                 ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &ar9170_band_5GHz;
1647                 bands++;
1648         }
1649         /*
1650          * I measured this, a bandswitch takes roughly
1651          * 135 ms and a frequency switch about 80.
1652          *
1653          * FIXME: measure these values again once EEPROM settings
1654          *        are used, that will influence them!
1655          */
1656         if (bands == 2)
1657                 ar->hw->channel_change_time = 135 * 1000;
1658         else
1659                 ar->hw->channel_change_time = 80 * 1000;
1660
1661         ar->regulatory.current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
1662         ar->regulatory.current_rd_ext = le16_to_cpu(ar->eeprom.reg_domain[1]);
1663
1664         /* second part of wiphy init */
1665         SET_IEEE80211_PERM_ADDR(ar->hw, addr);
1666
1667         return bands ? 0 : -EINVAL;
1668 }
1669
1670 static int ar9170_reg_notifier(struct wiphy *wiphy,
1671                         struct regulatory_request *request)
1672 {
1673         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
1674         struct ar9170 *ar = hw->priv;
1675
1676         return ath_reg_notifier_apply(wiphy, request, &ar->regulatory);
1677 }
1678
1679 int ar9170_register(struct ar9170 *ar, struct device *pdev)
1680 {
1681         int err;
1682
1683         /* try to read EEPROM, init MAC addr */
1684         err = ar9170_read_eeprom(ar);
1685         if (err)
1686                 goto err_out;
1687
1688         err = ath_regd_init(&ar->regulatory, ar->hw->wiphy,
1689                             ar9170_reg_notifier);
1690         if (err)
1691                 goto err_out;
1692
1693         err = ieee80211_register_hw(ar->hw);
1694         if (err)
1695                 goto err_out;
1696
1697         if (!ath_is_world_regd(&ar->regulatory))
1698                 regulatory_hint(ar->hw->wiphy, ar->regulatory.alpha2);
1699
1700         err = ar9170_init_leds(ar);
1701         if (err)
1702                 goto err_unreg;
1703
1704 #ifdef CONFIG_AR9170_LEDS
1705         err = ar9170_register_leds(ar);
1706         if (err)
1707                 goto err_unreg;
1708 #endif /* CONFIG_AR9170_LEDS */
1709
1710         dev_info(pdev, "Atheros AR9170 is registered as '%s'\n",
1711                  wiphy_name(ar->hw->wiphy));
1712
1713         return err;
1714
1715 err_unreg:
1716         ieee80211_unregister_hw(ar->hw);
1717
1718 err_out:
1719         return err;
1720 }
1721
1722 void ar9170_unregister(struct ar9170 *ar)
1723 {
1724 #ifdef CONFIG_AR9170_LEDS
1725         ar9170_unregister_leds(ar);
1726 #endif /* CONFIG_AR9170_LEDS */
1727
1728         ieee80211_unregister_hw(ar->hw);
1729         mutex_destroy(&ar->mutex);
1730 }