drivers/net/wireless/ath/ar9170/main.c

   1 /*
   2  * Atheros AR9170 driver
   3  *
   4  * mac80211 interaction code
   5  *
   6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright 2009, Christian Lamparter <chunkeey@web.de>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; see the file COPYING.  If not, see
  21  * http://www.gnu.org/licenses/.
  22  *
  23  * This file incorporates work covered by the following copyright and
  24  * permission notice:
  25  *    Copyright (c) 2007-2008 Atheros Communications, Inc.
  26  *
  27  *    Permission to use, copy, modify, and/or distribute this software for any
  28  *    purpose with or without fee is hereby granted, provided that the above
  29  *    copyright notice and this permission notice appear in all copies.
  30  *
  31  *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  32  *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  33  *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  34  *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  35  *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  36  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  37  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  38  */
  39
  40 #include <linux/init.h>
  41 #include <linux/slab.h>
  42 #include <linux/module.h>
  43 #include <linux/etherdevice.h>
  44 #include <net/mac80211.h>
  45 #include "ar9170.h"
  46 #include "hw.h"
  47 #include "cmd.h"
  48
  49 static int modparam_nohwcrypt;
  50 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
  51 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  52
  53 static int modparam_ht;
  54 module_param_named(ht, modparam_ht, bool, S_IRUGO);
  55 MODULE_PARM_DESC(ht, "enable MPDU aggregation.");
  56
  57 #define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
  58         .bitrate        = (_bitrate),                   \
  59         .flags          = (_flags),                     \
  60         .hw_value       = (_hw_rate) | (_txpidx) << 4,  \
  61 }
  62
  63 static struct ieee80211_rate __ar9170_ratetable[] = {
  64         RATE(10, 0, 0, 0),
  65         RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
  66         RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
  67         RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
  68         RATE(60, 0xb, 0, 0),
  69         RATE(90, 0xf, 0, 0),
  70         RATE(120, 0xa, 0, 0),
  71         RATE(180, 0xe, 0, 0),
  72         RATE(240, 0x9, 0, 0),
  73         RATE(360, 0xd, 1, 0),
  74         RATE(480, 0x8, 2, 0),
  75         RATE(540, 0xc, 3, 0),
  76 };
  77 #undef RATE
  78
  79 #define ar9170_g_ratetable      (__ar9170_ratetable + 0)
  80 #define ar9170_g_ratetable_size 12
  81 #define ar9170_a_ratetable      (__ar9170_ratetable + 4)
  82 #define ar9170_a_ratetable_size 8
  83
  84 /*
  85  * NB: The hw_value is used as an index into the ar9170_phy_freq_params
  86  *     array in phy.c so that we don't have to do frequency lookups!
  87  */
  88 #define CHAN(_freq, _idx) {             \
  89         .center_freq    = (_freq),      \
  90         .hw_value       = (_idx),       \
  91         .max_power      = 18, /* XXX */ \
  92 }
  93
  94 static struct ieee80211_channel ar9170_2ghz_chantable[] = {
  95         CHAN(2412,  0),
  96         CHAN(2417,  1),
  97         CHAN(2422,  2),
  98         CHAN(2427,  3),
  99         CHAN(2432,  4),
 100         CHAN(2437,  5),
 101         CHAN(2442,  6),
 102         CHAN(2447,  7),
 103         CHAN(2452,  8),
 104         CHAN(2457,  9),
 105         CHAN(2462, 10),
 106         CHAN(2467, 11),
 107         CHAN(2472, 12),
 108         CHAN(2484, 13),
 109 };
 110
 111 static struct ieee80211_channel ar9170_5ghz_chantable[] = {
 112         CHAN(4920, 14),
 113         CHAN(4940, 15),
 114         CHAN(4960, 16),
 115         CHAN(4980, 17),
 116         CHAN(5040, 18),
 117         CHAN(5060, 19),
 118         CHAN(5080, 20),
 119         CHAN(5180, 21),
 120         CHAN(5200, 22),
 121         CHAN(5220, 23),
 122         CHAN(5240, 24),
 123         CHAN(5260, 25),
 124         CHAN(5280, 26),
 125         CHAN(5300, 27),
 126         CHAN(5320, 28),
 127         CHAN(5500, 29),
 128         CHAN(5520, 30),
 129         CHAN(5540, 31),
 130         CHAN(5560, 32),
 131         CHAN(5580, 33),
 132         CHAN(5600, 34),
 133         CHAN(5620, 35),
 134         CHAN(5640, 36),
 135         CHAN(5660, 37),
 136         CHAN(5680, 38),
 137         CHAN(5700, 39),
 138         CHAN(5745, 40),
 139         CHAN(5765, 41),
 140         CHAN(5785, 42),
 141         CHAN(5805, 43),
 142         CHAN(5825, 44),
 143         CHAN(5170, 45),
 144         CHAN(5190, 46),
 145         CHAN(5210, 47),
 146         CHAN(5230, 48),
 147 };
 148 #undef CHAN
 149
 150 #define AR9170_HT_CAP                                                   \
 151 {                                                                       \
 152         .ht_supported   = true,                                         \
 153         .cap            = IEEE80211_HT_CAP_MAX_AMSDU |                  \
 154                           IEEE80211_HT_CAP_SUP_WIDTH_20_40 |            \
 155                           IEEE80211_HT_CAP_SGI_40 |                     \
 156                           IEEE80211_HT_CAP_GRN_FLD |                    \
 157                           IEEE80211_HT_CAP_DSSSCCK40 |                  \
 158                           IEEE80211_HT_CAP_SM_PS,                       \
 159         .ampdu_factor   = 3,                                            \
 160         .ampdu_density  = 6,                                            \
 161         .mcs            = {                                             \
 162                 .rx_mask = { 0xff, 0xff, 0, 0, 0x1, 0, 0, 0, 0, 0, },   \
 163                 .rx_highest = cpu_to_le16(300),                         \
 164                 .tx_params = IEEE80211_HT_MCS_TX_DEFINED,               \
 165         },                                                              \
 166 }
 167
 168 static struct ieee80211_supported_band ar9170_band_2GHz = {
 169         .channels       = ar9170_2ghz_chantable,
 170         .n_channels     = ARRAY_SIZE(ar9170_2ghz_chantable),
 171         .bitrates       = ar9170_g_ratetable,
 172         .n_bitrates     = ar9170_g_ratetable_size,
 173         .ht_cap         = AR9170_HT_CAP,
 174 };
 175
 176 static struct ieee80211_supported_band ar9170_band_5GHz = {
 177         .channels       = ar9170_5ghz_chantable,
 178         .n_channels     = ARRAY_SIZE(ar9170_5ghz_chantable),
 179         .bitrates       = ar9170_a_ratetable,
 180         .n_bitrates     = ar9170_a_ratetable_size,
 181         .ht_cap         = AR9170_HT_CAP,
 182 };
 183
 184 static void ar9170_tx(struct ar9170 *ar);
 185 static bool ar9170_tx_ampdu(struct ar9170 *ar);
 186
 187 static inline u16 ar9170_get_seq_h(struct ieee80211_hdr *hdr)
 188 {
 189         return le16_to_cpu(hdr->seq_ctrl) >> 4;
 190 }
 191
 192 static inline u16 ar9170_get_seq(struct sk_buff *skb)
 193 {
 194         struct ar9170_tx_control *txc = (void *) skb->data;
 195         return ar9170_get_seq_h((void *) txc->frame_data);
 196 }
 197
 198 static inline u16 ar9170_get_tid_h(struct ieee80211_hdr *hdr)
 199 {
 200         return (ieee80211_get_qos_ctl(hdr))[0] & IEEE80211_QOS_CTL_TID_MASK;
 201 }
 202
 203 static inline u16 ar9170_get_tid(struct sk_buff *skb)
 204 {
 205         struct ar9170_tx_control *txc = (void *) skb->data;
 206         return ar9170_get_tid_h((struct ieee80211_hdr *) txc->frame_data);
 207 }
 208
 209 #define GET_NEXT_SEQ(seq)       ((seq + 1) & 0x0fff)
 210 #define GET_NEXT_SEQ_FROM_SKB(skb)      (GET_NEXT_SEQ(ar9170_get_seq(skb)))
 211
 212 #if (defined AR9170_QUEUE_DEBUG) || (defined AR9170_TXAGG_DEBUG)
 213 static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
 214 {
 215         struct ar9170_tx_control *txc = (void *) skb->data;
 216         struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
 217         struct ar9170_tx_info *arinfo = (void *) txinfo->rate_driver_data;
 218         struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 219
 220         printk(KERN_DEBUG "%s: => FRAME [skb:%p, q:%d, DA:[%pM] s:%d "
 221                           "mac_ctrl:%04x, phy_ctrl:%08x, timeout:[%d ms]]\n",
 222                wiphy_name(ar->hw->wiphy), skb, skb_get_queue_mapping(skb),
 223                ieee80211_get_DA(hdr), ar9170_get_seq_h(hdr),
 224                le16_to_cpu(txc->mac_control), le32_to_cpu(txc->phy_control),
 225                jiffies_to_msecs(arinfo->timeout - jiffies));
 226 }
 227
 228 static void __ar9170_dump_txqueue(struct ar9170 *ar,
 229                                 struct sk_buff_head *queue)
 230 {
 231         struct sk_buff *skb;
 232         int i = 0;
 233
 234         printk(KERN_DEBUG "---[ cut here ]---\n");
 235         printk(KERN_DEBUG "%s: %d entries in queue.\n",
 236                wiphy_name(ar->hw->wiphy), skb_queue_len(queue));
 237
 238         skb_queue_walk(queue, skb) {
 239                 printk(KERN_DEBUG "index:%d =>\n", i++);
 240                 ar9170_print_txheader(ar, skb);
 241         }
 242         if (i != skb_queue_len(queue))
 243                 printk(KERN_DEBUG "WARNING: queue frame counter "
 244                        "mismatch %d != %d\n", skb_queue_len(queue), i);
 245         printk(KERN_DEBUG "---[ end ]---\n");
 246 }
 247 #endif /* AR9170_QUEUE_DEBUG || AR9170_TXAGG_DEBUG */
 248
 249 #ifdef AR9170_QUEUE_DEBUG
 250 static void ar9170_dump_txqueue(struct ar9170 *ar,
 251                                 struct sk_buff_head *queue)
 252 {
 253         unsigned long flags;
 254
 255         spin_lock_irqsave(&queue->lock, flags);
 256         __ar9170_dump_txqueue(ar, queue);
 257         spin_unlock_irqrestore(&queue->lock, flags);
 258 }
 259 #endif /* AR9170_QUEUE_DEBUG */
 260
 261 #ifdef AR9170_QUEUE_STOP_DEBUG
 262 static void __ar9170_dump_txstats(struct ar9170 *ar)
 263 {
 264         int i;
 265
 266         printk(KERN_DEBUG "%s: QoS queue stats\n",
 267                wiphy_name(ar->hw->wiphy));
 268
 269         for (i = 0; i < __AR9170_NUM_TXQ; i++)
 270                 printk(KERN_DEBUG "%s: queue:%d limit:%d len:%d waitack:%d "
 271                        " stopped:%d\n", wiphy_name(ar->hw->wiphy), i,
 272                        ar->tx_stats[i].limit, ar->tx_stats[i].len,
 273                        skb_queue_len(&ar->tx_status[i]),
 274                        ieee80211_queue_stopped(ar->hw, i));
 275 }
 276 #endif /* AR9170_QUEUE_STOP_DEBUG */
 277
 278 #ifdef AR9170_TXAGG_DEBUG
 279 static void ar9170_dump_tx_status_ampdu(struct ar9170 *ar)
 280 {
 281         unsigned long flags;
 282
 283         spin_lock_irqsave(&ar->tx_status_ampdu.lock, flags);
 284         printk(KERN_DEBUG "%s: A-MPDU tx_status queue =>\n",
 285                wiphy_name(ar->hw->wiphy));
 286         __ar9170_dump_txqueue(ar, &ar->tx_status_ampdu);
 287         spin_unlock_irqrestore(&ar->tx_status_ampdu.lock, flags);
 288 }
 289
 290 #endif /* AR9170_TXAGG_DEBUG */
 291
 292 /* caller must guarantee exclusive access for _bin_ queue. */
 293 static void ar9170_recycle_expired(struct ar9170 *ar,
 294                                    struct sk_buff_head *queue,
 295                                    struct sk_buff_head *bin)
 296 {
 297         struct sk_buff *skb, *old = NULL;
 298         unsigned long flags;
 299
 300         spin_lock_irqsave(&queue->lock, flags);
 301         while ((skb = skb_peek(queue))) {
 302                 struct ieee80211_tx_info *txinfo;
 303                 struct ar9170_tx_info *arinfo;
 304
 305                 txinfo = IEEE80211_SKB_CB(skb);
 306                 arinfo = (void *) txinfo->rate_driver_data;
 307
 308                 if (time_is_before_jiffies(arinfo->timeout)) {
 309 #ifdef AR9170_QUEUE_DEBUG
 310                         printk(KERN_DEBUG "%s: [%ld > %ld] frame expired => "
 311                                "recycle\n", wiphy_name(ar->hw->wiphy),
 312                                jiffies, arinfo->timeout);
 313                         ar9170_print_txheader(ar, skb);
 314 #endif /* AR9170_QUEUE_DEBUG */
 315                         __skb_unlink(skb, queue);
 316                         __skb_queue_tail(bin, skb);
 317                 } else {
 318                         break;
 319                 }
 320
 321                 if (unlikely(old == skb)) {
 322                         /* bail out - queue is shot. */
 323
 324                         WARN_ON(1);
 325                         break;
 326                 }
 327                 old = skb;
 328         }
 329         spin_unlock_irqrestore(&queue->lock, flags);
 330 }
 331
 332 static void ar9170_tx_status(struct ar9170 *ar, struct sk_buff *skb,
 333                                     u16 tx_status)
 334 {
 335         struct ieee80211_tx_info *txinfo;
 336         unsigned int retries = 0;
 337
 338         txinfo = IEEE80211_SKB_CB(skb);
 339         ieee80211_tx_info_clear_status(txinfo);
 340
 341         switch (tx_status) {
 342         case AR9170_TX_STATUS_RETRY:
 343                 retries = 2;
 344         case AR9170_TX_STATUS_COMPLETE:
 345                 txinfo->flags |= IEEE80211_TX_STAT_ACK;
 346                 break;
 347
 348         case AR9170_TX_STATUS_FAILED:
 349                 retries = ar->hw->conf.long_frame_max_tx_count;
 350                 break;
 351
 352         default:
 353                 printk(KERN_ERR "%s: invalid tx_status response (%x).\n",
 354                        wiphy_name(ar->hw->wiphy), tx_status);
 355                 break;
 356         }
 357
 358         txinfo->status.rates[0].count = retries + 1;
 359         skb_pull(skb, sizeof(struct ar9170_tx_control));
 360         ieee80211_tx_status_irqsafe(ar->hw, skb);
 361 }
 362
 363 static void ar9170_tx_fake_ampdu_status(struct ar9170 *ar)
 364 {
 365         struct sk_buff_head success;
 366         struct sk_buff *skb;
 367         unsigned int i;
 368         unsigned long queue_bitmap = 0;
 369
 370         skb_queue_head_init(&success);
 371
 372         while (skb_queue_len(&ar->tx_status_ampdu) > AR9170_NUM_TX_STATUS)
 373                 __skb_queue_tail(&success, skb_dequeue(&ar->tx_status_ampdu));
 374
 375         ar9170_recycle_expired(ar, &ar->tx_status_ampdu, &success);
 376
 377 #ifdef AR9170_TXAGG_DEBUG
 378         printk(KERN_DEBUG "%s: collected %d A-MPDU frames.\n",
 379                wiphy_name(ar->hw->wiphy), skb_queue_len(&success));
 380         __ar9170_dump_txqueue(ar, &success);
 381 #endif /* AR9170_TXAGG_DEBUG */
 382
 383         while ((skb = __skb_dequeue(&success))) {
 384                 struct ieee80211_tx_info *txinfo;
 385
 386                 queue_bitmap |= BIT(skb_get_queue_mapping(skb));
 387
 388                 txinfo = IEEE80211_SKB_CB(skb);
 389                 ieee80211_tx_info_clear_status(txinfo);
 390
 391                 txinfo->flags |= IEEE80211_TX_STAT_ACK;
 392                 txinfo->status.rates[0].count = 1;
 393
 394                 skb_pull(skb, sizeof(struct ar9170_tx_control));
 395                 ieee80211_tx_status_irqsafe(ar->hw, skb);
 396         }
 397
 398         for_each_set_bit(i, &queue_bitmap, BITS_PER_BYTE) {
 399 #ifdef AR9170_QUEUE_STOP_DEBUG
 400                 printk(KERN_DEBUG "%s: wake queue %d\n",
 401                        wiphy_name(ar->hw->wiphy), i);
 402                 __ar9170_dump_txstats(ar);
 403 #endif /* AR9170_QUEUE_STOP_DEBUG */
 404                 ieee80211_wake_queue(ar->hw, i);
 405         }
 406
 407         if (queue_bitmap)
 408                 ar9170_tx(ar);
 409 }
 410
 411 static void ar9170_tx_ampdu_callback(struct ar9170 *ar, struct sk_buff *skb)
 412 {
 413         struct ieee80211_tx_info *txinfo = IEEE80211_SKB_CB(skb);
 414         struct ar9170_tx_info *arinfo = (void *) txinfo->rate_driver_data;
 415
 416         arinfo->timeout = jiffies +
 417                           msecs_to_jiffies(AR9170_BA_TIMEOUT);
 418
 419         skb_queue_tail(&ar->tx_status_ampdu, skb);
 420         ar9170_tx_fake_ampdu_status(ar);
 421
 422         if (atomic_dec_and_test(&ar->tx_ampdu_pending) &&
 423             !list_empty(&ar->tx_ampdu_list))
 424                 ar9170_tx_ampdu(ar);
 425 }
 426
 427 void ar9170_tx_callback(struct ar9170 *ar, struct sk_buff *skb)
 428 {
 429         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 430         struct ar9170_tx_info *arinfo = (void *) info->rate_driver_data;
 431         unsigned int queue = skb_get_queue_mapping(skb);
 432         unsigned long flags;
 433
 434         spin_lock_irqsave(&ar->tx_stats_lock, flags);
 435         ar->tx_stats[queue].len--;
 436
 437         if (ar->tx_stats[queue].len < AR9170_NUM_TX_LIMIT_SOFT) {
 438 #ifdef AR9170_QUEUE_STOP_DEBUG
 439                 printk(KERN_DEBUG "%s: wake queue %d\n",
 440                        wiphy_name(ar->hw->wiphy), queue);
 441                 __ar9170_dump_txstats(ar);
 442 #endif /* AR9170_QUEUE_STOP_DEBUG */
 443                 ieee80211_wake_queue(ar->hw, queue);
 444         }
 445         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 446
 447         if (info->flags & IEEE80211_TX_CTL_NO_ACK) {
 448                 ar9170_tx_status(ar, skb, AR9170_TX_STATUS_FAILED);
 449         } else {
 450                 if (info->flags & IEEE80211_TX_CTL_AMPDU) {
 451                         ar9170_tx_ampdu_callback(ar, skb);
 452                 } else {
 453                         arinfo->timeout = jiffies +
 454                                   msecs_to_jiffies(AR9170_TX_TIMEOUT);
 455
 456                         skb_queue_tail(&ar->tx_status[queue], skb);
 457                 }
 458         }
 459
 460         if (!ar->tx_stats[queue].len &&
 461             !skb_queue_empty(&ar->tx_pending[queue])) {
 462                 ar9170_tx(ar);
 463         }
 464 }
 465
 466 static struct sk_buff *ar9170_get_queued_skb(struct ar9170 *ar,
 467                                              const u8 *mac,
 468                                              struct sk_buff_head *queue,
 469                                              const u32 rate)
 470 {
 471         unsigned long flags;
 472         struct sk_buff *skb;
 473
 474         /*
 475          * Unfortunately, the firmware does not tell to which (queued) frame
 476          * this transmission status report belongs to.
 477          *
 478          * So we have to make risky guesses - with the scarce information
 479          * the firmware provided (-> destination MAC, and phy_control) -
 480          * and hope that we picked the right one...
 481          */
 482
 483         spin_lock_irqsave(&queue->lock, flags);
 484         skb_queue_walk(queue, skb) {
 485                 struct ar9170_tx_control *txc = (void *) skb->data;
 486                 struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 487                 u32 r;
 488
 489                 if (mac && compare_ether_addr(ieee80211_get_DA(hdr), mac)) {
 490 #ifdef AR9170_QUEUE_DEBUG
 491                         printk(KERN_DEBUG "%s: skip frame => DA %pM != %pM\n",
 492                                wiphy_name(ar->hw->wiphy), mac,
 493                                ieee80211_get_DA(hdr));
 494                         ar9170_print_txheader(ar, skb);
 495 #endif /* AR9170_QUEUE_DEBUG */
 496                         continue;
 497                 }
 498
 499                 r = (le32_to_cpu(txc->phy_control) & AR9170_TX_PHY_MCS_MASK) >>
 500                     AR9170_TX_PHY_MCS_SHIFT;
 501
 502                 if ((rate != AR9170_TX_INVALID_RATE) && (r != rate)) {
 503 #ifdef AR9170_QUEUE_DEBUG
 504                         printk(KERN_DEBUG "%s: skip frame => rate %d != %d\n",
 505                                wiphy_name(ar->hw->wiphy), rate, r);
 506                         ar9170_print_txheader(ar, skb);
 507 #endif /* AR9170_QUEUE_DEBUG */
 508                         continue;
 509                 }
 510
 511                 __skb_unlink(skb, queue);
 512                 spin_unlock_irqrestore(&queue->lock, flags);
 513                 return skb;
 514         }
 515
 516 #ifdef AR9170_QUEUE_DEBUG
 517         printk(KERN_ERR "%s: ESS:[%pM] does not have any "
 518                         "outstanding frames in queue.\n",
 519                         wiphy_name(ar->hw->wiphy), mac);
 520         __ar9170_dump_txqueue(ar, queue);
 521 #endif /* AR9170_QUEUE_DEBUG */
 522         spin_unlock_irqrestore(&queue->lock, flags);
 523
 524         return NULL;
 525 }
 526
 527 static void ar9170_handle_block_ack(struct ar9170 *ar, u16 count, u16 r)
 528 {
 529         struct sk_buff *skb;
 530         struct ieee80211_tx_info *txinfo;
 531
 532         while (count) {
 533                 skb = ar9170_get_queued_skb(ar, NULL, &ar->tx_status_ampdu, r);
 534                 if (!skb)
 535                         break;
 536
 537                 txinfo = IEEE80211_SKB_CB(skb);
 538                 ieee80211_tx_info_clear_status(txinfo);
 539
 540                 /* FIXME: maybe more ? */
 541                 txinfo->status.rates[0].count = 1;
 542
 543                 skb_pull(skb, sizeof(struct ar9170_tx_control));
 544                 ieee80211_tx_status_irqsafe(ar->hw, skb);
 545                 count--;
 546         }
 547
 548 #ifdef AR9170_TXAGG_DEBUG
 549         if (count) {
 550                 printk(KERN_DEBUG "%s: got %d more failed mpdus, but no more "
 551                        "suitable frames left in tx_status queue.\n",
 552                        wiphy_name(ar->hw->wiphy), count);
 553
 554                 ar9170_dump_tx_status_ampdu(ar);
 555         }
 556 #endif /* AR9170_TXAGG_DEBUG */
 557 }
 558
 559 /*
 560  * This worker tries to keeps an maintain tx_status queues.
 561  * So we can guarantee that incoming tx_status reports are
 562  * actually for a pending frame.
 563  */
 564
 565 static void ar9170_tx_janitor(struct work_struct *work)
 566 {
 567         struct ar9170 *ar = container_of(work, struct ar9170,
 568                                          tx_janitor.work);
 569         struct sk_buff_head waste;
 570         unsigned int i;
 571         bool resched = false;
 572
 573         if (unlikely(!IS_STARTED(ar)))
 574                 return ;
 575
 576         skb_queue_head_init(&waste);
 577
 578         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
 579 #ifdef AR9170_QUEUE_DEBUG
 580                 printk(KERN_DEBUG "%s: garbage collector scans queue:%d\n",
 581                        wiphy_name(ar->hw->wiphy), i);
 582                 ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
 583                 ar9170_dump_txqueue(ar, &ar->tx_status[i]);
 584 #endif /* AR9170_QUEUE_DEBUG */
 585
 586                 ar9170_recycle_expired(ar, &ar->tx_status[i], &waste);
 587                 ar9170_recycle_expired(ar, &ar->tx_pending[i], &waste);
 588                 skb_queue_purge(&waste);
 589
 590                 if (!skb_queue_empty(&ar->tx_status[i]) ||
 591                     !skb_queue_empty(&ar->tx_pending[i]))
 592                         resched = true;
 593         }
 594
 595         ar9170_tx_fake_ampdu_status(ar);
 596
 597         if (!resched)
 598                 return;
 599
 600         ieee80211_queue_delayed_work(ar->hw,
 601                                      &ar->tx_janitor,
 602                                      msecs_to_jiffies(AR9170_JANITOR_DELAY));
 603 }
 604
 605 void ar9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len)
 606 {
 607         struct ar9170_cmd_response *cmd = (void *) buf;
 608
 609         if ((cmd->type & 0xc0) != 0xc0) {
 610                 ar->callback_cmd(ar, len, buf);
 611                 return;
 612         }
 613
 614         /* hardware event handlers */
 615         switch (cmd->type) {
 616         case 0xc1: {
 617                 /*
 618                  * TX status notification:
 619                  * bytes: 0c c1 XX YY M1 M2 M3 M4 M5 M6 R4 R3 R2 R1 S2 S1
 620                  *
 621                  * XX always 81
 622                  * YY always 00
 623                  * M1-M6 is the MAC address
 624                  * R1-R4 is the transmit rate
 625                  * S1-S2 is the transmit status
 626                  */
 627
 628                 struct sk_buff *skb;
 629                 u32 phy = le32_to_cpu(cmd->tx_status.rate);
 630                 u32 q = (phy & AR9170_TX_PHY_QOS_MASK) >>
 631                         AR9170_TX_PHY_QOS_SHIFT;
 632 #ifdef AR9170_QUEUE_DEBUG
 633                 printk(KERN_DEBUG "%s: recv tx_status for %pM, p:%08x, q:%d\n",
 634                        wiphy_name(ar->hw->wiphy), cmd->tx_status.dst, phy, q);
 635 #endif /* AR9170_QUEUE_DEBUG */
 636
 637                 skb = ar9170_get_queued_skb(ar, cmd->tx_status.dst,
 638                                             &ar->tx_status[q],
 639                                             AR9170_TX_INVALID_RATE);
 640                 if (unlikely(!skb))
 641                         return ;
 642
 643                 ar9170_tx_status(ar, skb, le16_to_cpu(cmd->tx_status.status));
 644                 break;
 645                 }
 646
 647         case 0xc0:
 648                 /*
 649                  * pre-TBTT event
 650                  */
 651                 if (ar->vif && ar->vif->type == NL80211_IFTYPE_AP)
 652                         ieee80211_queue_work(ar->hw, &ar->beacon_work);
 653                 break;
 654
 655         case 0xc2:
 656                 /*
 657                  * (IBSS) beacon send notification
 658                  * bytes: 04 c2 XX YY B4 B3 B2 B1
 659                  *
 660                  * XX always 80
 661                  * YY always 00
 662                  * B1-B4 "should" be the number of send out beacons.
 663                  */
 664                 break;
 665
 666         case 0xc3:
 667                 /* End of Atim Window */
 668                 break;
 669
 670         case 0xc4:
 671                 /* BlockACK bitmap */
 672                 break;
 673
 674         case 0xc5:
 675                 /* BlockACK events */
 676                 ar9170_handle_block_ack(ar,
 677                                         le16_to_cpu(cmd->ba_fail_cnt.failed),
 678                                         le16_to_cpu(cmd->ba_fail_cnt.rate));
 679                 ar9170_tx_fake_ampdu_status(ar);
 680                 break;
 681
 682         case 0xc6:
 683                 /* Watchdog Interrupt */
 684                 break;
 685
 686         case 0xc9:
 687                 /* retransmission issue / SIFS/EIFS collision ?! */
 688                 break;
 689
 690         /* firmware debug */
 691         case 0xca:
 692                 printk(KERN_DEBUG "ar9170 FW: %.*s\n", len - 4,
 693                                 (char *)buf + 4);
 694                 break;
 695         case 0xcb:
 696                 len -= 4;
 697
 698                 switch (len) {
 699                 case 1:
 700                         printk(KERN_DEBUG "ar9170 FW: u8: %#.2x\n",
 701                                 *((char *)buf + 4));
 702                         break;
 703                 case 2:
 704                         printk(KERN_DEBUG "ar9170 FW: u8: %#.4x\n",
 705                                 le16_to_cpup((__le16 *)((char *)buf + 4)));
 706                         break;
 707                 case 4:
 708                         printk(KERN_DEBUG "ar9170 FW: u8: %#.8x\n",
 709                                 le32_to_cpup((__le32 *)((char *)buf + 4)));
 710                         break;
 711                 case 8:
 712                         printk(KERN_DEBUG "ar9170 FW: u8: %#.16lx\n",
 713                                 (unsigned long)le64_to_cpup(
 714                                                 (__le64 *)((char *)buf + 4)));
 715                         break;
 716                 }
 717                 break;
 718         case 0xcc:
 719                 print_hex_dump_bytes("ar9170 FW:", DUMP_PREFIX_NONE,
 720                                      (char *)buf + 4, len - 4);
 721                 break;
 722
 723         default:
 724                 printk(KERN_INFO "received unhandled event %x\n", cmd->type);
 725                 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
 726                 break;
 727         }
 728 }
 729
 730 static void ar9170_rx_reset_rx_mpdu(struct ar9170 *ar)
 731 {
 732         memset(&ar->rx_mpdu.plcp, 0, sizeof(struct ar9170_rx_head));
 733         ar->rx_mpdu.has_plcp = false;
 734 }
 735
 736 int ar9170_nag_limiter(struct ar9170 *ar)
 737 {
 738         bool print_message;
 739
 740         /*
 741          * we expect all sorts of errors in promiscuous mode.
 742          * don't bother with it, it's OK!
 743          */
 744         if (ar->sniffer_enabled)
 745                 return false;
 746
 747         /*
 748          * only go for frequent errors! The hardware tends to
 749          * do some stupid thing once in a while under load, in
 750          * noisy environments or just for fun!
 751          */
 752         if (time_before(jiffies, ar->bad_hw_nagger) && net_ratelimit())
 753                 print_message = true;
 754         else
 755                 print_message = false;
 756
 757         /* reset threshold for "once in a while" */
 758         ar->bad_hw_nagger = jiffies + HZ / 4;
 759         return print_message;
 760 }
 761
 762 static int ar9170_rx_mac_status(struct ar9170 *ar,
 763                                 struct ar9170_rx_head *head,
 764                                 struct ar9170_rx_macstatus *mac,
 765                                 struct ieee80211_rx_status *status)
 766 {
 767         u8 error, decrypt;
 768
 769         BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
 770         BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4);
 771
 772         error = mac->error;
 773         if (error & AR9170_RX_ERROR_MMIC) {
 774                 status->flag |= RX_FLAG_MMIC_ERROR;
 775                 error &= ~AR9170_RX_ERROR_MMIC;
 776         }
 777
 778         if (error & AR9170_RX_ERROR_PLCP) {
 779                 status->flag |= RX_FLAG_FAILED_PLCP_CRC;
 780                 error &= ~AR9170_RX_ERROR_PLCP;
 781
 782                 if (!(ar->filter_state & FIF_PLCPFAIL))
 783                         return -EINVAL;
 784         }
 785
 786         if (error & AR9170_RX_ERROR_FCS) {
 787                 status->flag |= RX_FLAG_FAILED_FCS_CRC;
 788                 error &= ~AR9170_RX_ERROR_FCS;
 789
 790                 if (!(ar->filter_state & FIF_FCSFAIL))
 791                         return -EINVAL;
 792         }
 793
 794         decrypt = ar9170_get_decrypt_type(mac);
 795         if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
 796             decrypt != AR9170_ENC_ALG_NONE)
 797                 status->flag |= RX_FLAG_DECRYPTED;
 798
 799         /* ignore wrong RA errors */
 800         error &= ~AR9170_RX_ERROR_WRONG_RA;
 801
 802         if (error & AR9170_RX_ERROR_DECRYPT) {
 803                 error &= ~AR9170_RX_ERROR_DECRYPT;
 804                 /*
 805                  * Rx decryption is done in place,
 806                  * the original data is lost anyway.
 807                  */
 808
 809                 return -EINVAL;
 810         }
 811
 812         /* drop any other error frames */
 813         if (unlikely(error)) {
 814                 /* TODO: update netdevice's RX dropped/errors statistics */
 815
 816                 if (ar9170_nag_limiter(ar))
 817                         printk(KERN_DEBUG "%s: received frame with "
 818                                "suspicious error code (%#x).\n",
 819                                wiphy_name(ar->hw->wiphy), error);
 820
 821                 return -EINVAL;
 822         }
 823
 824         status->band = ar->channel->band;
 825         status->freq = ar->channel->center_freq;
 826
 827         switch (mac->status & AR9170_RX_STATUS_MODULATION_MASK) {
 828         case AR9170_RX_STATUS_MODULATION_CCK:
 829                 if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
 830                         status->flag |= RX_FLAG_SHORTPRE;
 831                 switch (head->plcp[0]) {
 832                 case 0x0a:
 833                         status->rate_idx = 0;
 834                         break;
 835                 case 0x14:
 836                         status->rate_idx = 1;
 837                         break;
 838                 case 0x37:
 839                         status->rate_idx = 2;
 840                         break;
 841                 case 0x6e:
 842                         status->rate_idx = 3;
 843                         break;
 844                 default:
 845                         if (ar9170_nag_limiter(ar))
 846                                 printk(KERN_ERR "%s: invalid plcp cck rate "
 847                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 848                                        head->plcp[0]);
 849                         return -EINVAL;
 850                 }
 851                 break;
 852
 853         case AR9170_RX_STATUS_MODULATION_DUPOFDM:
 854         case AR9170_RX_STATUS_MODULATION_OFDM:
 855                 switch (head->plcp[0] & 0xf) {
 856                 case 0xb:
 857                         status->rate_idx = 0;
 858                         break;
 859                 case 0xf:
 860                         status->rate_idx = 1;
 861                         break;
 862                 case 0xa:
 863                         status->rate_idx = 2;
 864                         break;
 865                 case 0xe:
 866                         status->rate_idx = 3;
 867                         break;
 868                 case 0x9:
 869                         status->rate_idx = 4;
 870                         break;
 871                 case 0xd:
 872                         status->rate_idx = 5;
 873                         break;
 874                 case 0x8:
 875                         status->rate_idx = 6;
 876                         break;
 877                 case 0xc:
 878                         status->rate_idx = 7;
 879                         break;
 880                 default:
 881                         if (ar9170_nag_limiter(ar))
 882                                 printk(KERN_ERR "%s: invalid plcp ofdm rate "
 883                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 884                                        head->plcp[0]);
 885                         return -EINVAL;
 886                 }
 887                 if (status->band == IEEE80211_BAND_2GHZ)
 888                         status->rate_idx += 4;
 889                 break;
 890
 891         case AR9170_RX_STATUS_MODULATION_HT:
 892                 if (head->plcp[3] & 0x80)
 893                         status->flag |= RX_FLAG_40MHZ;
 894                 if (head->plcp[6] & 0x80)
 895                         status->flag |= RX_FLAG_SHORT_GI;
 896
 897                 status->rate_idx = clamp(0, 75, head->plcp[6] & 0x7f);
 898                 status->flag |= RX_FLAG_HT;
 899                 break;
 900
 901         default:
 902                 if (ar9170_nag_limiter(ar))
 903                         printk(KERN_ERR "%s: invalid modulation\n",
 904                                wiphy_name(ar->hw->wiphy));
 905                 return -EINVAL;
 906         }
 907
 908         return 0;
 909 }
 910
 911 static void ar9170_rx_phy_status(struct ar9170 *ar,
 912                                  struct ar9170_rx_phystatus *phy,
 913                                  struct ieee80211_rx_status *status)
 914 {
 915         int i;
 916
 917         BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20);
 918
 919         for (i = 0; i < 3; i++)
 920                 if (phy->rssi[i] != 0x80)
 921                         status->antenna |= BIT(i);
 922
 923         /* post-process RSSI */
 924         for (i = 0; i < 7; i++)
 925                 if (phy->rssi[i] & 0x80)
 926                         phy->rssi[i] = ((phy->rssi[i] & 0x7f) + 1) & 0x7f;
 927
 928         /* TODO: we could do something with phy_errors */
 929         status->signal = ar->noise[0] + phy->rssi_combined;
 930         status->noise = ar->noise[0];
 931 }
 932
 933 static struct sk_buff *ar9170_rx_copy_data(u8 *buf, int len)
 934 {
 935         struct sk_buff *skb;
 936         int reserved = 0;
 937         struct ieee80211_hdr *hdr = (void *) buf;
 938
 939         if (ieee80211_is_data_qos(hdr->frame_control)) {
 940                 u8 *qc = ieee80211_get_qos_ctl(hdr);
 941                 reserved += NET_IP_ALIGN;
 942
 943                 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
 944                         reserved += NET_IP_ALIGN;
 945         }
 946
 947         if (ieee80211_has_a4(hdr->frame_control))
 948                 reserved += NET_IP_ALIGN;
 949
 950         reserved = 32 + (reserved & NET_IP_ALIGN);
 951
 952         skb = dev_alloc_skb(len + reserved);
 953         if (likely(skb)) {
 954                 skb_reserve(skb, reserved);
 955                 memcpy(skb_put(skb, len), buf, len);
 956         }
 957
 958         return skb;
 959 }
 960
 961 /*
 962  * If the frame alignment is right (or the kernel has
 963  * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
 964  * is only a single MPDU in the USB frame, then we could
 965  * submit to mac80211 the SKB directly. However, since
 966  * there may be multiple packets in one SKB in stream
 967  * mode, and we need to observe the proper ordering,
 968  * this is non-trivial.
 969  */
 970
 971 static void ar9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
 972 {
 973         struct ar9170_rx_head *head;
 974         struct ar9170_rx_macstatus *mac;
 975         struct ar9170_rx_phystatus *phy = NULL;
 976         struct ieee80211_rx_status status;
 977         struct sk_buff *skb;
 978         int mpdu_len;
 979
 980         if (unlikely(!IS_STARTED(ar) || len < (sizeof(*mac))))
 981                 return ;
 982
 983         /* Received MPDU */
 984         mpdu_len = len - sizeof(*mac);
 985
 986         mac = (void *)(buf + mpdu_len);
 987         if (unlikely(mac->error & AR9170_RX_ERROR_FATAL)) {
 988                 /* this frame is too damaged and can't be used - drop it */
 989
 990                 return ;
 991         }
 992
 993         switch (mac->status & AR9170_RX_STATUS_MPDU_MASK) {
 994         case AR9170_RX_STATUS_MPDU_FIRST:
 995                 /* first mpdu packet has the plcp header */
 996                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) {
 997                         head = (void *) buf;
 998                         memcpy(&ar->rx_mpdu.plcp, (void *) buf,
 999                                sizeof(struct ar9170_rx_head));
1000
1001                         mpdu_len -= sizeof(struct ar9170_rx_head);
1002                         buf += sizeof(struct ar9170_rx_head);
1003                         ar->rx_mpdu.has_plcp = true;
1004                 } else {
1005                         if (ar9170_nag_limiter(ar))
1006                                 printk(KERN_ERR "%s: plcp info is clipped.\n",
1007                                        wiphy_name(ar->hw->wiphy));
1008                         return ;
1009                 }
1010                 break;
1011
1012         case AR9170_RX_STATUS_MPDU_LAST:
1013                 /* last mpdu has a extra tail with phy status information */
1014
1015                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) {
1016                         mpdu_len -= sizeof(struct ar9170_rx_phystatus);
1017                         phy = (void *)(buf + mpdu_len);
1018                 } else {
1019                         if (ar9170_nag_limiter(ar))
1020                                 printk(KERN_ERR "%s: frame tail is clipped.\n",
1021                                        wiphy_name(ar->hw->wiphy));
1022                         return ;
1023                 }
1024
1025         case AR9170_RX_STATUS_MPDU_MIDDLE:
1026                 /* middle mpdus are just data */
1027                 if (unlikely(!ar->rx_mpdu.has_plcp)) {
1028                         if (!ar9170_nag_limiter(ar))
1029                                 return ;
1030
1031                         printk(KERN_ERR "%s: rx stream did not start "
1032                                         "with a first_mpdu frame tag.\n",
1033                                wiphy_name(ar->hw->wiphy));
1034
1035                         return ;
1036                 }
1037
1038                 head = &ar->rx_mpdu.plcp;
1039                 break;
1040
1041         case AR9170_RX_STATUS_MPDU_SINGLE:
1042                 /* single mpdu - has plcp (head) and phy status (tail) */
1043                 head = (void *) buf;
1044
1045                 mpdu_len -= sizeof(struct ar9170_rx_head);
1046                 mpdu_len -= sizeof(struct ar9170_rx_phystatus);
1047
1048                 buf += sizeof(struct ar9170_rx_head);
1049                 phy = (void *)(buf + mpdu_len);
1050                 break;
1051
1052         default:
1053                 BUG_ON(1);
1054                 break;
1055         }
1056
1057         if (unlikely(mpdu_len < FCS_LEN))
1058                 return ;
1059
1060         memset(&status, 0, sizeof(status));
1061         if (unlikely(ar9170_rx_mac_status(ar, head, mac, &status)))
1062                 return ;
1063
1064         if (phy)
1065                 ar9170_rx_phy_status(ar, phy, &status);
1066
1067         skb = ar9170_rx_copy_data(buf, mpdu_len);
1068         if (likely(skb)) {
1069                 memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
1070                 ieee80211_rx_irqsafe(ar->hw, skb);
1071         }
1072 }
1073
1074 void ar9170_rx(struct ar9170 *ar, struct sk_buff *skb)
1075 {
1076         unsigned int i, tlen, resplen, wlen = 0, clen = 0;
1077         u8 *tbuf, *respbuf;
1078
1079         tbuf = skb->data;
1080         tlen = skb->len;
1081
1082         while (tlen >= 4) {
1083                 clen = tbuf[1] << 8 | tbuf[0];
1084                 wlen = ALIGN(clen, 4);
1085
1086                 /* check if this is stream has a valid tag.*/
1087                 if (tbuf[2] != 0 || tbuf[3] != 0x4e) {
1088                         /*
1089                          * TODO: handle the highly unlikely event that the
1090                          * corrupted stream has the TAG at the right position.
1091                          */
1092
1093                         /* check if the frame can be repaired. */
1094                         if (!ar->rx_failover_missing) {
1095                                 /* this is no "short read". */
1096                                 if (ar9170_nag_limiter(ar)) {
1097                                         printk(KERN_ERR "%s: missing tag!\n",
1098                                                wiphy_name(ar->hw->wiphy));
1099                                         goto err_telluser;
1100                                 } else
1101                                         goto err_silent;
1102                         }
1103
1104                         if (ar->rx_failover_missing > tlen) {
1105                                 if (ar9170_nag_limiter(ar)) {
1106                                         printk(KERN_ERR "%s: possible multi "
1107                                                "stream corruption!\n",
1108                                                wiphy_name(ar->hw->wiphy));
1109                                         goto err_telluser;
1110                                 } else
1111                                         goto err_silent;
1112                         }
1113
1114                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
1115                         ar->rx_failover_missing -= tlen;
1116
1117                         if (ar->rx_failover_missing <= 0) {
1118                                 /*
1119                                  * nested ar9170_rx call!
1120                                  * termination is guranteed, even when the
1121                                  * combined frame also have a element with
1122                                  * a bad tag.
1123                                  */
1124
1125                                 ar->rx_failover_missing = 0;
1126                                 ar9170_rx(ar, ar->rx_failover);
1127
1128                                 skb_reset_tail_pointer(ar->rx_failover);
1129                                 skb_trim(ar->rx_failover, 0);
1130                         }
1131
1132                         return ;
1133                 }
1134
1135                 /* check if stream is clipped */
1136                 if (wlen > tlen - 4) {
1137                         if (ar->rx_failover_missing) {
1138                                 /* TODO: handle double stream corruption. */
1139                                 if (ar9170_nag_limiter(ar)) {
1140                                         printk(KERN_ERR "%s: double rx stream "
1141                                                "corruption!\n",
1142                                                 wiphy_name(ar->hw->wiphy));
1143                                         goto err_telluser;
1144                                 } else
1145                                         goto err_silent;
1146                         }
1147
1148                         /*
1149                          * save incomplete data set.
1150                          * the firmware will resend the missing bits when
1151                          * the rx - descriptor comes round again.
1152                          */
1153
1154                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
1155                         ar->rx_failover_missing = clen - tlen;
1156                         return ;
1157                 }
1158                 resplen = clen;
1159                 respbuf = tbuf + 4;
1160                 tbuf += wlen + 4;
1161                 tlen -= wlen + 4;
1162
1163                 i = 0;
1164
1165                 /* weird thing, but this is the same in the original driver */
1166                 while (resplen > 2 && i < 12 &&
1167                        respbuf[0] == 0xff && respbuf[1] == 0xff) {
1168                         i += 2;
1169                         resplen -= 2;
1170                         respbuf += 2;
1171                 }
1172
1173                 if (resplen < 4)
1174                         continue;
1175
1176                 /* found the 6 * 0xffff marker? */
1177                 if (i == 12)
1178                         ar9170_handle_command_response(ar, respbuf, resplen);
1179                 else
1180                         ar9170_handle_mpdu(ar, respbuf, clen);
1181         }
1182
1183         if (tlen) {
1184                 if (net_ratelimit())
1185                         printk(KERN_ERR "%s: %d bytes of unprocessed "
1186                                         "data left in rx stream!\n",
1187                                wiphy_name(ar->hw->wiphy), tlen);
1188
1189                 goto err_telluser;
1190         }
1191
1192         return ;
1193
1194 err_telluser:
1195         printk(KERN_ERR "%s: damaged RX stream data [want:%d, "
1196                         "data:%d, rx:%d, pending:%d ]\n",
1197                wiphy_name(ar->hw->wiphy), clen, wlen, tlen,
1198                ar->rx_failover_missing);
1199
1200         if (ar->rx_failover_missing)
1201                 print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET,
1202                                      ar->rx_failover->data,
1203                                      ar->rx_failover->len);
1204
1205         print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET,
1206                              skb->data, skb->len);
1207
1208         printk(KERN_ERR "%s: please check your hardware and cables, if "
1209                         "you see this message frequently.\n",
1210                wiphy_name(ar->hw->wiphy));
1211
1212 err_silent:
1213         if (ar->rx_failover_missing) {
1214                 skb_reset_tail_pointer(ar->rx_failover);
1215                 skb_trim(ar->rx_failover, 0);
1216                 ar->rx_failover_missing = 0;
1217         }
1218 }
1219
1220 #define AR9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)            \
1221 do {                                                                    \
1222         queue.aifs = ai_fs;                                             \
1223         queue.cw_min = cwmin;                                           \
1224         queue.cw_max = cwmax;                                           \
1225         queue.txop = _txop;                                             \
1226 } while (0)
1227
1228 static int ar9170_op_start(struct ieee80211_hw *hw)
1229 {
1230         struct ar9170 *ar = hw->priv;
1231         int err, i;
1232
1233         mutex_lock(&ar->mutex);
1234
1235         /* reinitialize queues statistics */
1236         memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
1237         for (i = 0; i < __AR9170_NUM_TXQ; i++)
1238                 ar->tx_stats[i].limit = AR9170_TXQ_DEPTH;
1239
1240         /* reset QoS defaults */
1241         AR9170_FILL_QUEUE(ar->edcf[0], 3, 15, 1023,  0); /* BEST EFFORT*/
1242         AR9170_FILL_QUEUE(ar->edcf[1], 7, 15, 1023,  0); /* BACKGROUND */
1243         AR9170_FILL_QUEUE(ar->edcf[2], 2, 7,    15, 94); /* VIDEO */
1244         AR9170_FILL_QUEUE(ar->edcf[3], 2, 3,     7, 47); /* VOICE */
1245         AR9170_FILL_QUEUE(ar->edcf[4], 2, 3,     7,  0); /* SPECIAL */
1246
1247         /* set sane AMPDU defaults */
1248         ar->global_ampdu_density = 6;
1249         ar->global_ampdu_factor = 3;
1250
1251         atomic_set(&ar->tx_ampdu_pending, 0);
1252         ar->bad_hw_nagger = jiffies;
1253
1254         err = ar->open(ar);
1255         if (err)
1256                 goto out;
1257
1258         err = ar9170_init_mac(ar);
1259         if (err)
1260                 goto out;
1261
1262         err = ar9170_set_qos(ar);
1263         if (err)
1264                 goto out;
1265
1266         err = ar9170_init_phy(ar, IEEE80211_BAND_2GHZ);
1267         if (err)
1268                 goto out;
1269
1270         err = ar9170_init_rf(ar);
1271         if (err)
1272                 goto out;
1273
1274         /* start DMA */
1275         err = ar9170_write_reg(ar, 0x1c3d30, 0x100);
1276         if (err)
1277                 goto out;
1278
1279         ar->state = AR9170_STARTED;
1280
1281 out:
1282         mutex_unlock(&ar->mutex);
1283         return err;
1284 }
1285
1286 static void ar9170_op_stop(struct ieee80211_hw *hw)
1287 {
1288         struct ar9170 *ar = hw->priv;
1289         unsigned int i;
1290
1291         if (IS_STARTED(ar))
1292                 ar->state = AR9170_IDLE;
1293
1294         cancel_delayed_work_sync(&ar->tx_janitor);
1295 #ifdef CONFIG_AR9170_LEDS
1296         cancel_delayed_work_sync(&ar->led_work);
1297 #endif
1298         cancel_work_sync(&ar->beacon_work);
1299
1300         mutex_lock(&ar->mutex);
1301
1302         if (IS_ACCEPTING_CMD(ar)) {
1303                 ar9170_set_leds_state(ar, 0);
1304
1305                 /* stop DMA */
1306                 ar9170_write_reg(ar, 0x1c3d30, 0);
1307                 ar->stop(ar);
1308         }
1309
1310         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
1311                 skb_queue_purge(&ar->tx_pending[i]);
1312                 skb_queue_purge(&ar->tx_status[i]);
1313         }
1314         skb_queue_purge(&ar->tx_status_ampdu);
1315
1316         mutex_unlock(&ar->mutex);
1317 }
1318
1319 static void ar9170_tx_indicate_immba(struct ar9170 *ar, struct sk_buff *skb)
1320 {
1321         struct ar9170_tx_control *txc = (void *) skb->data;
1322
1323         txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_IMM_AMPDU);
1324 }
1325
1326 static void ar9170_tx_copy_phy(struct ar9170 *ar, struct sk_buff *dst,
1327                                struct sk_buff *src)
1328 {
1329         struct ar9170_tx_control *dst_txc, *src_txc;
1330         struct ieee80211_tx_info *dst_info, *src_info;
1331         struct ar9170_tx_info *dst_arinfo, *src_arinfo;
1332
1333         src_txc = (void *) src->data;
1334         src_info = IEEE80211_SKB_CB(src);
1335         src_arinfo = (void *) src_info->rate_driver_data;
1336
1337         dst_txc = (void *) dst->data;
1338         dst_info = IEEE80211_SKB_CB(dst);
1339         dst_arinfo = (void *) dst_info->rate_driver_data;
1340
1341         dst_txc->phy_control = src_txc->phy_control;
1342
1343         /* same MCS for the whole aggregate */
1344         memcpy(dst_info->driver_rates, src_info->driver_rates,
1345                sizeof(dst_info->driver_rates));
1346 }
1347
1348 static int ar9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
1349 {
1350         struct ieee80211_hdr *hdr;
1351         struct ar9170_tx_control *txc;
1352         struct ieee80211_tx_info *info;
1353         struct ieee80211_tx_rate *txrate;
1354         struct ar9170_tx_info *arinfo;
1355         unsigned int queue = skb_get_queue_mapping(skb);
1356         u16 keytype = 0;
1357         u16 len, icv = 0;
1358
1359         BUILD_BUG_ON(sizeof(*arinfo) > sizeof(info->rate_driver_data));
1360
1361         hdr = (void *)skb->data;
1362         info = IEEE80211_SKB_CB(skb);
1363         len = skb->len;
1364
1365         txc = (void *)skb_push(skb, sizeof(*txc));
1366
1367         if (info->control.hw_key) {
1368                 icv = info->control.hw_key->icv_len;
1369
1370                 switch (info->control.hw_key->alg) {
1371                 case ALG_WEP:
1372                         keytype = AR9170_TX_MAC_ENCR_RC4;
1373                         break;
1374                 case ALG_TKIP:
1375                         keytype = AR9170_TX_MAC_ENCR_RC4;
1376                         break;
1377                 case ALG_CCMP:
1378                         keytype = AR9170_TX_MAC_ENCR_AES;
1379                         break;
1380                 default:
1381                         WARN_ON(1);
1382                         goto err_out;
1383                 }
1384         }
1385
1386         /* Length */
1387         txc->length = cpu_to_le16(len + icv + 4);
1388
1389         txc->mac_control = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
1390                                        AR9170_TX_MAC_BACKOFF);
1391         txc->mac_control |= cpu_to_le16(ar9170_qos_hwmap[queue] <<
1392                                         AR9170_TX_MAC_QOS_SHIFT);
1393         txc->mac_control |= cpu_to_le16(keytype);
1394         txc->phy_control = cpu_to_le32(0);
1395
1396         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1397                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_NO_ACK);
1398
1399         txrate = &info->control.rates[0];
1400         if (txrate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1401                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
1402         else if (txrate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1403                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
1404
1405         arinfo = (void *)info->rate_driver_data;
1406         arinfo->timeout = jiffies + msecs_to_jiffies(AR9170_QUEUE_TIMEOUT);
1407
1408         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
1409              (is_valid_ether_addr(ieee80211_get_DA(hdr)))) {
1410                 /*
1411                  * WARNING:
1412                  * Putting the QoS queue bits into an unexplored territory is
1413                  * certainly not elegant.
1414                  *
1415                  * In my defense: This idea provides a reasonable way to
1416                  * smuggle valuable information to the tx_status callback.
1417                  * Also, the idea behind this bit-abuse came straight from
1418                  * the original driver code.
1419                  */
1420
1421                 txc->phy_control |=
1422                         cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
1423
1424                 if (info->flags & IEEE80211_TX_CTL_AMPDU) {
1425                         if (unlikely(!info->control.sta))
1426                                 goto err_out;
1427
1428                         txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
1429                 } else {
1430                         txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
1431                 }
1432         }
1433
1434         return 0;
1435
1436 err_out:
1437         skb_pull(skb, sizeof(*txc));
1438         return -EINVAL;
1439 }
1440
1441 static void ar9170_tx_prepare_phy(struct ar9170 *ar, struct sk_buff *skb)
1442 {
1443         struct ar9170_tx_control *txc;
1444         struct ieee80211_tx_info *info;
1445         struct ieee80211_rate *rate = NULL;
1446         struct ieee80211_tx_rate *txrate;
1447         u32 power, chains;
1448
1449         txc = (void *) skb->data;
1450         info = IEEE80211_SKB_CB(skb);
1451         txrate = &info->control.rates[0];
1452
1453         if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1454                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_GREENFIELD);
1455
1456         if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1457                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_PREAMBLE);
1458
1459         if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1460                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ);
1461         /* this works because 40 MHz is 2 and dup is 3 */
1462         if (txrate->flags & IEEE80211_TX_RC_DUP_DATA)
1463                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ_DUP);
1464
1465         if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
1466                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_GI);
1467
1468         if (txrate->flags & IEEE80211_TX_RC_MCS) {
1469                 u32 r = txrate->idx;
1470                 u8 *txpower;
1471
1472                 /* heavy clip control */
1473                 txc->phy_control |= cpu_to_le32((r & 0x7) << 7);
1474
1475                 r <<= AR9170_TX_PHY_MCS_SHIFT;
1476                 BUG_ON(r & ~AR9170_TX_PHY_MCS_MASK);
1477
1478                 txc->phy_control |= cpu_to_le32(r & AR9170_TX_PHY_MCS_MASK);
1479                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_MOD_HT);
1480
1481                 if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
1482                         if (info->band == IEEE80211_BAND_5GHZ)
1483                                 txpower = ar->power_5G_ht40;
1484                         else
1485                                 txpower = ar->power_2G_ht40;
1486                 } else {
1487                         if (info->band == IEEE80211_BAND_5GHZ)
1488                                 txpower = ar->power_5G_ht20;
1489                         else
1490                                 txpower = ar->power_2G_ht20;
1491                 }
1492
1493                 power = txpower[(txrate->idx) & 7];
1494         } else {
1495                 u8 *txpower;
1496                 u32 mod;
1497                 u32 phyrate;
1498                 u8 idx = txrate->idx;
1499
1500                 if (info->band != IEEE80211_BAND_2GHZ) {
1501                         idx += 4;
1502                         txpower = ar->power_5G_leg;
1503                         mod = AR9170_TX_PHY_MOD_OFDM;
1504                 } else {
1505                         if (idx < 4) {
1506                                 txpower = ar->power_2G_cck;
1507                                 mod = AR9170_TX_PHY_MOD_CCK;
1508                         } else {
1509                                 mod = AR9170_TX_PHY_MOD_OFDM;
1510                                 txpower = ar->power_2G_ofdm;
1511                         }
1512                 }
1513
1514                 rate = &__ar9170_ratetable[idx];
1515
1516                 phyrate = rate->hw_value & 0xF;
1517                 power = txpower[(rate->hw_value & 0x30) >> 4];
1518                 phyrate <<= AR9170_TX_PHY_MCS_SHIFT;
1519
1520                 txc->phy_control |= cpu_to_le32(mod);
1521                 txc->phy_control |= cpu_to_le32(phyrate);
1522         }
1523
1524         power <<= AR9170_TX_PHY_TX_PWR_SHIFT;
1525         power &= AR9170_TX_PHY_TX_PWR_MASK;
1526         txc->phy_control |= cpu_to_le32(power);
1527
1528         /* set TX chains */
1529         if (ar->eeprom.tx_mask == 1) {
1530                 chains = AR9170_TX_PHY_TXCHAIN_1;
1531         } else {
1532                 chains = AR9170_TX_PHY_TXCHAIN_2;
1533
1534                 /* >= 36M legacy OFDM - use only one chain */
1535                 if (rate && rate->bitrate >= 360)
1536                         chains = AR9170_TX_PHY_TXCHAIN_1;
1537         }
1538         txc->phy_control |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_SHIFT);
1539 }
1540
1541 static bool ar9170_tx_ampdu(struct ar9170 *ar)
1542 {
1543         struct sk_buff_head agg;
1544         struct ar9170_sta_tid *tid_info = NULL, *tmp;
1545         struct sk_buff *skb, *first = NULL;
1546         unsigned long flags, f2;
1547         unsigned int i = 0;
1548         u16 seq, queue, tmpssn;
1549         bool run = false;
1550
1551         skb_queue_head_init(&agg);
1552
1553         spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
1554         if (list_empty(&ar->tx_ampdu_list)) {
1555 #ifdef AR9170_TXAGG_DEBUG
1556                 printk(KERN_DEBUG "%s: aggregation list is empty.\n",
1557                        wiphy_name(ar->hw->wiphy));
1558 #endif /* AR9170_TXAGG_DEBUG */
1559                 goto out_unlock;
1560         }
1561
1562         list_for_each_entry_safe(tid_info, tmp, &ar->tx_ampdu_list, list) {
1563                 if (tid_info->state != AR9170_TID_STATE_COMPLETE) {
1564 #ifdef AR9170_TXAGG_DEBUG
1565                         printk(KERN_DEBUG "%s: dangling aggregation entry!\n",
1566                                wiphy_name(ar->hw->wiphy));
1567 #endif /* AR9170_TXAGG_DEBUG */
1568                         continue;
1569                 }
1570
1571                 if (++i > 64) {
1572 #ifdef AR9170_TXAGG_DEBUG
1573                         printk(KERN_DEBUG "%s: enough frames aggregated.\n",
1574                                wiphy_name(ar->hw->wiphy));
1575 #endif /* AR9170_TXAGG_DEBUG */
1576                         break;
1577                 }
1578
1579                 queue = TID_TO_WME_AC(tid_info->tid);
1580
1581                 if (skb_queue_len(&ar->tx_pending[queue]) >=
1582                     AR9170_NUM_TX_AGG_MAX) {
1583 #ifdef AR9170_TXAGG_DEBUG
1584                         printk(KERN_DEBUG "%s: queue %d full.\n",
1585                                wiphy_name(ar->hw->wiphy), queue);
1586 #endif /* AR9170_TXAGG_DEBUG */
1587                         continue;
1588                 }
1589
1590                 list_del_init(&tid_info->list);
1591
1592                 spin_lock_irqsave(&tid_info->queue.lock, f2);
1593                 tmpssn = seq = tid_info->ssn;
1594                 first = skb_peek(&tid_info->queue);
1595
1596                 if (likely(first))
1597                         tmpssn = ar9170_get_seq(first);
1598
1599                 if (unlikely(tmpssn != seq)) {
1600 #ifdef AR9170_TXAGG_DEBUG
1601                         printk(KERN_DEBUG "%s: ssn mismatch [%d != %d]\n.",
1602                                wiphy_name(ar->hw->wiphy), seq, tmpssn);
1603 #endif /* AR9170_TXAGG_DEBUG */
1604                         tid_info->ssn = tmpssn;
1605                 }
1606
1607 #ifdef AR9170_TXAGG_DEBUG
1608                 printk(KERN_DEBUG "%s: generate A-MPDU for tid:%d ssn:%d with "
1609                        "%d queued frames.\n", wiphy_name(ar->hw->wiphy),
1610                        tid_info->tid, tid_info->ssn,
1611                        skb_queue_len(&tid_info->queue));
1612                 __ar9170_dump_txqueue(ar, &tid_info->queue);
1613 #endif /* AR9170_TXAGG_DEBUG */
1614
1615                 while ((skb = skb_peek(&tid_info->queue))) {
1616                         if (unlikely(ar9170_get_seq(skb) != seq))
1617                                 break;
1618
1619                         __skb_unlink(skb, &tid_info->queue);
1620                         tid_info->ssn = seq = GET_NEXT_SEQ(seq);
1621
1622                         if (unlikely(skb_get_queue_mapping(skb) != queue)) {
1623 #ifdef AR9170_TXAGG_DEBUG
1624                                 printk(KERN_DEBUG "%s: tid:%d(q:%d) queue:%d "
1625                                        "!match.\n", wiphy_name(ar->hw->wiphy),
1626                                        tid_info->tid,
1627                                        TID_TO_WME_AC(tid_info->tid),
1628                                        skb_get_queue_mapping(skb));
1629 #endif /* AR9170_TXAGG_DEBUG */
1630                                         dev_kfree_skb_any(skb);
1631                                         continue;
1632                         }
1633
1634                         if (unlikely(first == skb)) {
1635                                 ar9170_tx_prepare_phy(ar, skb);
1636                                 __skb_queue_tail(&agg, skb);
1637                                 first = skb;
1638                         } else {
1639                                 ar9170_tx_copy_phy(ar, skb, first);
1640                                 __skb_queue_tail(&agg, skb);
1641                         }
1642
1643                         if (unlikely(skb_queue_len(&agg) ==
1644                             AR9170_NUM_TX_AGG_MAX))
1645                                 break;
1646                 }
1647
1648                 if (skb_queue_empty(&tid_info->queue))
1649                         tid_info->active = false;
1650                 else
1651                         list_add_tail(&tid_info->list,
1652                                       &ar->tx_ampdu_list);
1653
1654                 spin_unlock_irqrestore(&tid_info->queue.lock, f2);
1655
1656                 if (unlikely(skb_queue_empty(&agg))) {
1657 #ifdef AR9170_TXAGG_DEBUG
1658                         printk(KERN_DEBUG "%s: queued empty list!\n",
1659                                wiphy_name(ar->hw->wiphy));
1660 #endif /* AR9170_TXAGG_DEBUG */
1661                         continue;
1662                 }
1663
1664                 /*
1665                  * tell the FW/HW that this is the last frame,
1666                  * that way it will wait for the immediate block ack.
1667                  */
1668                 ar9170_tx_indicate_immba(ar, skb_peek_tail(&agg));
1669
1670 #ifdef AR9170_TXAGG_DEBUG
1671                 printk(KERN_DEBUG "%s: generated A-MPDU looks like this:\n",
1672                        wiphy_name(ar->hw->wiphy));
1673                 __ar9170_dump_txqueue(ar, &agg);
1674 #endif /* AR9170_TXAGG_DEBUG */
1675
1676                 spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
1677
1678                 spin_lock_irqsave(&ar->tx_pending[queue].lock, flags);
1679                 skb_queue_splice_tail_init(&agg, &ar->tx_pending[queue]);
1680                 spin_unlock_irqrestore(&ar->tx_pending[queue].lock, flags);
1681                 run = true;
1682
1683                 spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
1684         }
1685
1686 out_unlock:
1687         spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
1688         __skb_queue_purge(&agg);
1689
1690         return run;
1691 }
1692
1693 static void ar9170_tx(struct ar9170 *ar)
1694 {
1695         struct sk_buff *skb;
1696         unsigned long flags;
1697         struct ieee80211_tx_info *info;
1698         struct ar9170_tx_info *arinfo;
1699         unsigned int i, frames, frames_failed, remaining_space;
1700         int err;
1701         bool schedule_garbagecollector = false;
1702
1703         BUILD_BUG_ON(sizeof(*arinfo) > sizeof(info->rate_driver_data));
1704
1705         if (unlikely(!IS_STARTED(ar)))
1706                 return ;
1707
1708         remaining_space = AR9170_TX_MAX_PENDING;
1709
1710         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
1711                 spin_lock_irqsave(&ar->tx_stats_lock, flags);
1712                 frames = min(ar->tx_stats[i].limit - ar->tx_stats[i].len,
1713                              skb_queue_len(&ar->tx_pending[i]));
1714
1715                 if (remaining_space < frames) {
1716 #ifdef AR9170_QUEUE_DEBUG
1717                         printk(KERN_DEBUG "%s: tx quota reached queue:%d, "
1718                                "remaining slots:%d, needed:%d\n",
1719                                wiphy_name(ar->hw->wiphy), i, remaining_space,
1720                                frames);
1721 #endif /* AR9170_QUEUE_DEBUG */
1722                         frames = remaining_space;
1723                 }
1724
1725                 ar->tx_stats[i].len += frames;
1726                 ar->tx_stats[i].count += frames;
1727                 if (ar->tx_stats[i].len >= ar->tx_stats[i].limit) {
1728 #ifdef AR9170_QUEUE_DEBUG
1729                         printk(KERN_DEBUG "%s: queue %d full\n",
1730                                wiphy_name(ar->hw->wiphy), i);
1731
1732                         printk(KERN_DEBUG "%s: stuck frames: ===>\n",
1733                                wiphy_name(ar->hw->wiphy));
1734                         ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
1735                         ar9170_dump_txqueue(ar, &ar->tx_status[i]);
1736 #endif /* AR9170_QUEUE_DEBUG */
1737
1738 #ifdef AR9170_QUEUE_STOP_DEBUG
1739                         printk(KERN_DEBUG "%s: stop queue %d\n",
1740                                wiphy_name(ar->hw->wiphy), i);
1741                         __ar9170_dump_txstats(ar);
1742 #endif /* AR9170_QUEUE_STOP_DEBUG */
1743                         ieee80211_stop_queue(ar->hw, i);
1744                 }
1745
1746                 spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1747
1748                 if (!frames)
1749                         continue;
1750
1751                 frames_failed = 0;
1752                 while (frames) {
1753                         skb = skb_dequeue(&ar->tx_pending[i]);
1754                         if (unlikely(!skb)) {
1755                                 frames_failed += frames;
1756                                 frames = 0;
1757                                 break;
1758                         }
1759
1760                         info = IEEE80211_SKB_CB(skb);
1761                         arinfo = (void *) info->rate_driver_data;
1762
1763                         /* TODO: cancel stuck frames */
1764                         arinfo->timeout = jiffies +
1765                                           msecs_to_jiffies(AR9170_TX_TIMEOUT);
1766
1767                         if (info->flags & IEEE80211_TX_CTL_AMPDU)
1768                                 atomic_inc(&ar->tx_ampdu_pending);
1769
1770 #ifdef AR9170_QUEUE_DEBUG
1771                         printk(KERN_DEBUG "%s: send frame q:%d =>\n",
1772                                wiphy_name(ar->hw->wiphy), i);
1773                         ar9170_print_txheader(ar, skb);
1774 #endif /* AR9170_QUEUE_DEBUG */
1775
1776                         err = ar->tx(ar, skb);
1777                         if (unlikely(err)) {
1778                                 if (info->flags & IEEE80211_TX_CTL_AMPDU)
1779                                         atomic_dec(&ar->tx_ampdu_pending);
1780
1781                                 frames_failed++;
1782                                 dev_kfree_skb_any(skb);
1783                         } else {
1784                                 remaining_space--;
1785                                 schedule_garbagecollector = true;
1786                         }
1787
1788                         frames--;
1789                 }
1790
1791 #ifdef AR9170_QUEUE_DEBUG
1792                 printk(KERN_DEBUG "%s: ar9170_tx report for queue %d\n",
1793                        wiphy_name(ar->hw->wiphy), i);
1794
1795                 printk(KERN_DEBUG "%s: unprocessed pending frames left:\n",
1796                        wiphy_name(ar->hw->wiphy));
1797                 ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
1798 #endif /* AR9170_QUEUE_DEBUG */
1799
1800                 if (unlikely(frames_failed)) {
1801 #ifdef AR9170_QUEUE_DEBUG
1802                         printk(KERN_DEBUG "%s: frames failed %d =>\n",
1803                                wiphy_name(ar->hw->wiphy), frames_failed);
1804 #endif /* AR9170_QUEUE_DEBUG */
1805
1806                         spin_lock_irqsave(&ar->tx_stats_lock, flags);
1807                         ar->tx_stats[i].len -= frames_failed;
1808                         ar->tx_stats[i].count -= frames_failed;
1809 #ifdef AR9170_QUEUE_STOP_DEBUG
1810                         printk(KERN_DEBUG "%s: wake queue %d\n",
1811                                wiphy_name(ar->hw->wiphy), i);
1812                         __ar9170_dump_txstats(ar);
1813 #endif /* AR9170_QUEUE_STOP_DEBUG */
1814                         ieee80211_wake_queue(ar->hw, i);
1815                         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1816                 }
1817         }
1818
1819         if (!schedule_garbagecollector)
1820                 return;
1821
1822         ieee80211_queue_delayed_work(ar->hw,
1823                                      &ar->tx_janitor,
1824                                      msecs_to_jiffies(AR9170_JANITOR_DELAY));
1825 }
1826
1827 static bool ar9170_tx_ampdu_queue(struct ar9170 *ar, struct sk_buff *skb)
1828 {
1829         struct ieee80211_tx_info *txinfo;
1830         struct ar9170_sta_info *sta_info;
1831         struct ar9170_sta_tid *agg;
1832         struct sk_buff *iter;
1833         unsigned long flags, f2;
1834         unsigned int max;
1835         u16 tid, seq, qseq;
1836         bool run = false, queue = false;
1837
1838         tid = ar9170_get_tid(skb);
1839         seq = ar9170_get_seq(skb);
1840         txinfo = IEEE80211_SKB_CB(skb);
1841         sta_info = (void *) txinfo->control.sta->drv_priv;
1842         agg = &sta_info->agg[tid];
1843         max = sta_info->ampdu_max_len;
1844
1845         spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
1846
1847         if (unlikely(agg->state != AR9170_TID_STATE_COMPLETE)) {
1848 #ifdef AR9170_TXAGG_DEBUG
1849                 printk(KERN_DEBUG "%s: BlockACK session not fully initialized "
1850                        "for ESS:%pM tid:%d state:%d.\n",
1851                        wiphy_name(ar->hw->wiphy), agg->addr, agg->tid,
1852                        agg->state);
1853 #endif /* AR9170_TXAGG_DEBUG */
1854                 goto err_unlock;
1855         }
1856
1857         if (!agg->active) {
1858                 agg->active = true;
1859                 agg->ssn = seq;
1860                 queue = true;
1861         }
1862
1863         /* check if seq is within the BA window */
1864         if (unlikely(!BAW_WITHIN(agg->ssn, max, seq))) {
1865 #ifdef AR9170_TXAGG_DEBUG
1866                 printk(KERN_DEBUG "%s: frame with tid:%d seq:%d does not "
1867                        "fit into BA window (%d - %d)\n",
1868                        wiphy_name(ar->hw->wiphy), tid, seq, agg->ssn,
1869                        (agg->ssn + max) & 0xfff);
1870 #endif /* AR9170_TXAGG_DEBUG */
1871                 goto err_unlock;
1872         }
1873
1874         spin_lock_irqsave(&agg->queue.lock, f2);
1875
1876         skb_queue_reverse_walk(&agg->queue, iter) {
1877                 qseq = ar9170_get_seq(iter);
1878
1879                 if (GET_NEXT_SEQ(qseq) == seq) {
1880                         __skb_queue_after(&agg->queue, iter, skb);
1881                         goto queued;
1882                 }
1883         }
1884
1885         __skb_queue_head(&agg->queue, skb);
1886
1887 queued:
1888         spin_unlock_irqrestore(&agg->queue.lock, f2);
1889
1890 #ifdef AR9170_TXAGG_DEBUG
1891         printk(KERN_DEBUG "%s: new aggregate %p queued.\n",
1892                wiphy_name(ar->hw->wiphy), skb);
1893         __ar9170_dump_txqueue(ar, &agg->queue);
1894 #endif /* AR9170_TXAGG_DEBUG */
1895
1896         if (skb_queue_len(&agg->queue) >= AR9170_NUM_TX_AGG_MAX)
1897                 run = true;
1898
1899         if (queue)
1900                 list_add_tail(&agg->list, &ar->tx_ampdu_list);
1901
1902         spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
1903         return run;
1904
1905 err_unlock:
1906         spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
1907         dev_kfree_skb_irq(skb);
1908         return false;
1909 }
1910
1911 int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
1912 {
1913         struct ar9170 *ar = hw->priv;
1914         struct ieee80211_tx_info *info;
1915
1916         if (unlikely(!IS_STARTED(ar)))
1917                 goto err_free;
1918
1919         if (unlikely(ar9170_tx_prepare(ar, skb)))
1920                 goto err_free;
1921
1922         info = IEEE80211_SKB_CB(skb);
1923         if (info->flags & IEEE80211_TX_CTL_AMPDU) {
1924                 bool run = ar9170_tx_ampdu_queue(ar, skb);
1925
1926                 if (run || !atomic_read(&ar->tx_ampdu_pending))
1927                         ar9170_tx_ampdu(ar);
1928         } else {
1929                 unsigned int queue = skb_get_queue_mapping(skb);
1930
1931                 ar9170_tx_prepare_phy(ar, skb);
1932                 skb_queue_tail(&ar->tx_pending[queue], skb);
1933         }
1934
1935         ar9170_tx(ar);
1936         return NETDEV_TX_OK;
1937
1938 err_free:
1939         dev_kfree_skb_any(skb);
1940         return NETDEV_TX_OK;
1941 }
1942
1943 static int ar9170_op_add_interface(struct ieee80211_hw *hw,
1944                                    struct ieee80211_vif *vif)
1945 {
1946         struct ar9170 *ar = hw->priv;
1947         struct ath_common *common = &ar->common;
1948         int err = 0;
1949
1950         mutex_lock(&ar->mutex);
1951
1952         if (ar->vif) {
1953                 err = -EBUSY;
1954                 goto unlock;
1955         }
1956
1957         ar->vif = vif;
1958         memcpy(common->macaddr, vif->addr, ETH_ALEN);
1959
1960         if (modparam_nohwcrypt || (ar->vif->type != NL80211_IFTYPE_STATION)) {
1961                 ar->rx_software_decryption = true;
1962                 ar->disable_offload = true;
1963         }
1964
1965         ar->cur_filter = 0;
1966         err = ar9170_update_frame_filter(ar, AR9170_MAC_REG_FTF_DEFAULTS);
1967         if (err)
1968                 goto unlock;
1969
1970         err = ar9170_set_operating_mode(ar);
1971
1972 unlock:
1973         mutex_unlock(&ar->mutex);
1974         return err;
1975 }
1976
1977 static void ar9170_op_remove_interface(struct ieee80211_hw *hw,
1978                                        struct ieee80211_vif *vif)
1979 {
1980         struct ar9170 *ar = hw->priv;
1981
1982         mutex_lock(&ar->mutex);
1983         ar->vif = NULL;
1984         ar9170_update_frame_filter(ar, 0);
1985         ar9170_set_beacon_timers(ar);
1986         dev_kfree_skb(ar->beacon);
1987         ar->beacon = NULL;
1988         ar->sniffer_enabled = false;
1989         ar->rx_software_decryption = false;
1990         ar9170_set_operating_mode(ar);
1991         mutex_unlock(&ar->mutex);
1992 }
1993
1994 static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
1995 {
1996         struct ar9170 *ar = hw->priv;
1997         int err = 0;
1998
1999         mutex_lock(&ar->mutex);
2000
2001         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
2002                 /* TODO */
2003                 err = 0;
2004         }
2005
2006         if (changed & IEEE80211_CONF_CHANGE_PS) {
2007                 /* TODO */
2008                 err = 0;
2009         }
2010
2011         if (changed & IEEE80211_CONF_CHANGE_POWER) {
2012                 /* TODO */
2013                 err = 0;
2014         }
2015
2016         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
2017                 /*
2018                  * is it long_frame_max_tx_count or short_frame_max_tx_count?
2019                  */
2020
2021                 err = ar9170_set_hwretry_limit(ar,
2022                         ar->hw->conf.long_frame_max_tx_count);
2023                 if (err)
2024                         goto out;
2025         }
2026
2027         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
2028
2029                 /* adjust slot time for 5 GHz */
2030                 err = ar9170_set_slot_time(ar);
2031                 if (err)
2032                         goto out;
2033
2034                 err = ar9170_set_dyn_sifs_ack(ar);
2035                 if (err)
2036                         goto out;
2037
2038                 err = ar9170_set_channel(ar, hw->conf.channel,
2039                                 AR9170_RFI_NONE,
2040                                 nl80211_to_ar9170(hw->conf.channel_type));
2041                 if (err)
2042                         goto out;
2043         }
2044
2045 out:
2046         mutex_unlock(&ar->mutex);
2047         return err;
2048 }
2049
2050 static u64 ar9170_op_prepare_multicast(struct ieee80211_hw *hw,
2051                                        struct netdev_hw_addr_list *mc_list)
2052 {
2053         u64 mchash;
2054         struct netdev_hw_addr *ha;
2055
2056         /* always get broadcast frames */
2057         mchash = 1ULL << (0xff >> 2);
2058
2059         netdev_hw_addr_list_for_each(ha, mc_list)
2060                 mchash |= 1ULL << (ha->addr[5] >> 2);
2061
2062         return mchash;
2063 }
2064
2065 static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
2066                                        unsigned int changed_flags,
2067                                        unsigned int *new_flags,
2068                                        u64 multicast)
2069 {
2070         struct ar9170 *ar = hw->priv;
2071
2072         if (unlikely(!IS_ACCEPTING_CMD(ar)))
2073                 return ;
2074
2075         mutex_lock(&ar->mutex);
2076
2077         /* mask supported flags */
2078         *new_flags &= FIF_ALLMULTI | FIF_CONTROL | FIF_BCN_PRBRESP_PROMISC |
2079                       FIF_PROMISC_IN_BSS | FIF_FCSFAIL | FIF_PLCPFAIL;
2080         ar->filter_state = *new_flags;
2081         /*
2082          * We can support more by setting the sniffer bit and
2083          * then checking the error flags, later.
2084          */
2085
2086         if (changed_flags & FIF_ALLMULTI && *new_flags & FIF_ALLMULTI)
2087                 multicast = ~0ULL;
2088
2089         if (multicast != ar->cur_mc_hash)
2090                 ar9170_update_multicast(ar, multicast);
2091
2092         if (changed_flags & FIF_CONTROL) {
2093                 u32 filter = AR9170_MAC_REG_FTF_PSPOLL |
2094                              AR9170_MAC_REG_FTF_RTS |
2095                              AR9170_MAC_REG_FTF_CTS |
2096                              AR9170_MAC_REG_FTF_ACK |
2097                              AR9170_MAC_REG_FTF_CFE |
2098                              AR9170_MAC_REG_FTF_CFE_ACK;
2099
2100                 if (*new_flags & FIF_CONTROL)
2101                         filter |= ar->cur_filter;
2102                 else
2103                         filter &= (~ar->cur_filter);
2104
2105                 ar9170_update_frame_filter(ar, filter);
2106         }
2107
2108         if (changed_flags & FIF_PROMISC_IN_BSS) {
2109                 ar->sniffer_enabled = ((*new_flags) & FIF_PROMISC_IN_BSS) != 0;
2110                 ar9170_set_operating_mode(ar);
2111         }
2112
2113         mutex_unlock(&ar->mutex);
2114 }
2115
2116
2117 static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
2118                                        struct ieee80211_vif *vif,
2119                                        struct ieee80211_bss_conf *bss_conf,
2120                                        u32 changed)
2121 {
2122         struct ar9170 *ar = hw->priv;
2123         struct ath_common *common = &ar->common;
2124         int err = 0;
2125
2126         mutex_lock(&ar->mutex);
2127
2128         if (changed & BSS_CHANGED_BSSID) {
2129                 memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
2130                 err = ar9170_set_operating_mode(ar);
2131                 if (err)
2132                         goto out;
2133         }
2134
2135         if (changed & BSS_CHANGED_BEACON_ENABLED)
2136                 ar->enable_beacon = bss_conf->enable_beacon;
2137
2138         if (changed & BSS_CHANGED_BEACON) {
2139                 err = ar9170_update_beacon(ar);
2140                 if (err)
2141                         goto out;
2142         }
2143
2144         if (changed & (BSS_CHANGED_BEACON_ENABLED | BSS_CHANGED_BEACON |
2145                        BSS_CHANGED_BEACON_INT)) {
2146                 err = ar9170_set_beacon_timers(ar);
2147                 if (err)
2148                         goto out;
2149         }
2150
2151         if (changed & BSS_CHANGED_ASSOC) {
2152 #ifndef CONFIG_AR9170_LEDS
2153                 /* enable assoc LED. */
2154                 err = ar9170_set_leds_state(ar, bss_conf->assoc ? 2 : 0);
2155 #endif /* CONFIG_AR9170_LEDS */
2156         }
2157
2158         if (changed & BSS_CHANGED_HT) {
2159                 /* TODO */
2160                 err = 0;
2161         }
2162
2163         if (changed & BSS_CHANGED_ERP_SLOT) {
2164                 err = ar9170_set_slot_time(ar);
2165                 if (err)
2166                         goto out;
2167         }
2168
2169         if (changed & BSS_CHANGED_BASIC_RATES) {
2170                 err = ar9170_set_basic_rates(ar);
2171                 if (err)
2172                         goto out;
2173         }
2174
2175 out:
2176         mutex_unlock(&ar->mutex);
2177 }
2178
2179 static u64 ar9170_op_get_tsf(struct ieee80211_hw *hw)
2180 {
2181         struct ar9170 *ar = hw->priv;
2182         int err;
2183         u64 tsf;
2184 #define NR 3
2185         static const u32 addr[NR] = { AR9170_MAC_REG_TSF_H,
2186                                     AR9170_MAC_REG_TSF_L,
2187                                     AR9170_MAC_REG_TSF_H };
2188         u32 val[NR];
2189         int loops = 0;
2190
2191         mutex_lock(&ar->mutex);
2192
2193         while (loops++ < 10) {
2194                 err = ar9170_read_mreg(ar, NR, addr, val);
2195                 if (err || val[0] == val[2])
2196                         break;
2197         }
2198
2199         mutex_unlock(&ar->mutex);
2200
2201         if (WARN_ON(err))
2202                 return 0;
2203         tsf = val[0];
2204         tsf = (tsf << 32) | val[1];
2205         return tsf;
2206 #undef NR
2207 }
2208
2209 static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
2210                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
2211                           struct ieee80211_key_conf *key)
2212 {
2213         struct ar9170 *ar = hw->priv;
2214         int err = 0, i;
2215         u8 ktype;
2216
2217         if ((!ar->vif) || (ar->disable_offload))
2218                 return -EOPNOTSUPP;
2219
2220         switch (key->alg) {
2221         case ALG_WEP:
2222                 if (key->keylen == WLAN_KEY_LEN_WEP40)
2223                         ktype = AR9170_ENC_ALG_WEP64;
2224                 else
2225                         ktype = AR9170_ENC_ALG_WEP128;
2226                 break;
2227         case ALG_TKIP:
2228                 ktype = AR9170_ENC_ALG_TKIP;
2229                 break;
2230         case ALG_CCMP:
2231                 ktype = AR9170_ENC_ALG_AESCCMP;
2232                 break;
2233         default:
2234                 return -EOPNOTSUPP;
2235         }
2236
2237         mutex_lock(&ar->mutex);
2238         if (cmd == SET_KEY) {
2239                 if (unlikely(!IS_STARTED(ar))) {
2240                         err = -EOPNOTSUPP;
2241                         goto out;
2242                 }
2243
2244                 /* group keys need all-zeroes address */
2245                 if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
2246                         sta = NULL;
2247
2248                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
2249                         for (i = 0; i < 64; i++)
2250                                 if (!(ar->usedkeys & BIT(i)))
2251                                         break;
2252                         if (i == 64) {
2253                                 ar->rx_software_decryption = true;
2254                                 ar9170_set_operating_mode(ar);
2255                                 err = -ENOSPC;
2256                                 goto out;
2257                         }
2258                 } else {
2259                         i = 64 + key->keyidx;
2260                 }
2261
2262                 key->hw_key_idx = i;
2263
2264                 err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL, ktype, 0,
2265                                         key->key, min_t(u8, 16, key->keylen));
2266                 if (err)
2267                         goto out;
2268
2269                 if (key->alg == ALG_TKIP) {
2270                         err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL,
2271                                                 ktype, 1, key->key + 16, 16);
2272                         if (err)
2273                                 goto out;
2274
2275                         /*
2276                          * hardware is not capable generating the MMIC
2277                          * for fragmented frames!
2278                          */
2279                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
2280                 }
2281
2282                 if (i < 64)
2283                         ar->usedkeys |= BIT(i);
2284
2285                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
2286         } else {
2287                 if (unlikely(!IS_STARTED(ar))) {
2288                         /* The device is gone... together with the key ;-) */
2289                         err = 0;
2290                         goto out;
2291                 }
2292
2293                 err = ar9170_disable_key(ar, key->hw_key_idx);
2294                 if (err)
2295                         goto out;
2296
2297                 if (key->hw_key_idx < 64) {
2298                         ar->usedkeys &= ~BIT(key->hw_key_idx);
2299                 } else {
2300                         err = ar9170_upload_key(ar, key->hw_key_idx, NULL,
2301                                                 AR9170_ENC_ALG_NONE, 0,
2302                                                 NULL, 0);
2303                         if (err)
2304                                 goto out;
2305
2306                         if (key->alg == ALG_TKIP) {
2307                                 err = ar9170_upload_key(ar, key->hw_key_idx,
2308                                                         NULL,
2309                                                         AR9170_ENC_ALG_NONE, 1,
2310                                                         NULL, 0);
2311                                 if (err)
2312                                         goto out;
2313                         }
2314
2315                 }
2316         }
2317
2318         ar9170_regwrite_begin(ar);
2319         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_L, ar->usedkeys);
2320         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_H, ar->usedkeys >> 32);
2321         ar9170_regwrite_finish();
2322         err = ar9170_regwrite_result();
2323
2324 out:
2325         mutex_unlock(&ar->mutex);
2326
2327         return err;
2328 }
2329
2330 static int ar9170_sta_add(struct ieee80211_hw *hw,
2331                           struct ieee80211_vif *vif,
2332                           struct ieee80211_sta *sta)
2333 {
2334         struct ar9170 *ar = hw->priv;
2335         struct ar9170_sta_info *sta_info = (void *) sta->drv_priv;
2336         unsigned int i;
2337
2338         memset(sta_info, 0, sizeof(*sta_info));
2339
2340         if (!sta->ht_cap.ht_supported)
2341                 return 0;
2342
2343         if (sta->ht_cap.ampdu_density > ar->global_ampdu_density)
2344                 ar->global_ampdu_density = sta->ht_cap.ampdu_density;
2345
2346         if (sta->ht_cap.ampdu_factor < ar->global_ampdu_factor)
2347                 ar->global_ampdu_factor = sta->ht_cap.ampdu_factor;
2348
2349         for (i = 0; i < AR9170_NUM_TID; i++) {
2350                 sta_info->agg[i].state = AR9170_TID_STATE_SHUTDOWN;
2351                 sta_info->agg[i].active = false;
2352                 sta_info->agg[i].ssn = 0;
2353                 sta_info->agg[i].tid = i;
2354                 INIT_LIST_HEAD(&sta_info->agg[i].list);
2355                 skb_queue_head_init(&sta_info->agg[i].queue);
2356         }
2357
2358         sta_info->ampdu_max_len = 1 << (3 + sta->ht_cap.ampdu_factor);
2359
2360         return 0;
2361 }
2362
2363 static int ar9170_sta_remove(struct ieee80211_hw *hw,
2364                              struct ieee80211_vif *vif,
2365                              struct ieee80211_sta *sta)
2366 {
2367         struct ar9170_sta_info *sta_info = (void *) sta->drv_priv;
2368         unsigned int i;
2369
2370         if (!sta->ht_cap.ht_supported)
2371                 return 0;
2372
2373         for (i = 0; i < AR9170_NUM_TID; i++) {
2374                 sta_info->agg[i].state = AR9170_TID_STATE_INVALID;
2375                 skb_queue_purge(&sta_info->agg[i].queue);
2376         }
2377
2378         return 0;
2379 }
2380
2381 static int ar9170_get_stats(struct ieee80211_hw *hw,
2382                             struct ieee80211_low_level_stats *stats)
2383 {
2384         struct ar9170 *ar = hw->priv;
2385         u32 val;
2386         int err;
2387
2388         mutex_lock(&ar->mutex);
2389         err = ar9170_read_reg(ar, AR9170_MAC_REG_TX_RETRY, &val);
2390         ar->stats.dot11ACKFailureCount += val;
2391
2392         memcpy(stats, &ar->stats, sizeof(*stats));
2393         mutex_unlock(&ar->mutex);
2394
2395         return 0;
2396 }
2397
2398 static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
2399                           const struct ieee80211_tx_queue_params *param)
2400 {
2401         struct ar9170 *ar = hw->priv;
2402         int ret;
2403
2404         mutex_lock(&ar->mutex);
2405         if (queue < __AR9170_NUM_TXQ) {
2406                 memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
2407                        param, sizeof(*param));
2408
2409                 ret = ar9170_set_qos(ar);
2410         } else {
2411                 ret = -EINVAL;
2412         }
2413
2414         mutex_unlock(&ar->mutex);
2415         return ret;
2416 }
2417
2418 static int ar9170_ampdu_action(struct ieee80211_hw *hw,
2419                                struct ieee80211_vif *vif,
2420                                enum ieee80211_ampdu_mlme_action action,
2421                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
2422 {
2423         struct ar9170 *ar = hw->priv;
2424         struct ar9170_sta_info *sta_info = (void *) sta->drv_priv;
2425         struct ar9170_sta_tid *tid_info = &sta_info->agg[tid];
2426         unsigned long flags;
2427
2428         if (!modparam_ht)
2429                 return -EOPNOTSUPP;
2430
2431         switch (action) {
2432         case IEEE80211_AMPDU_TX_START:
2433                 spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
2434                 if (tid_info->state != AR9170_TID_STATE_SHUTDOWN ||
2435                     !list_empty(&tid_info->list)) {
2436                         spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
2437 #ifdef AR9170_TXAGG_DEBUG
2438                         printk(KERN_INFO "%s: A-MPDU [ESS:[%pM] tid:[%d]] "
2439                                "is in a very bad state!\n",
2440                                wiphy_name(hw->wiphy), sta->addr, tid);
2441 #endif /* AR9170_TXAGG_DEBUG */
2442                         return -EBUSY;
2443                 }
2444
2445                 *ssn = tid_info->ssn;
2446                 tid_info->state = AR9170_TID_STATE_PROGRESS;
2447                 tid_info->active = false;
2448                 spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
2449                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
2450                 break;
2451
2452         case IEEE80211_AMPDU_TX_STOP:
2453                 spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
2454                 tid_info->state = AR9170_TID_STATE_SHUTDOWN;
2455                 list_del_init(&tid_info->list);
2456                 tid_info->active = false;
2457                 skb_queue_purge(&tid_info->queue);
2458                 spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
2459                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
2460                 break;
2461
2462         case IEEE80211_AMPDU_TX_OPERATIONAL:
2463 #ifdef AR9170_TXAGG_DEBUG
2464                 printk(KERN_INFO "%s: A-MPDU for %pM [tid:%d] Operational.\n",
2465                        wiphy_name(hw->wiphy), sta->addr, tid);
2466 #endif /* AR9170_TXAGG_DEBUG */
2467                 spin_lock_irqsave(&ar->tx_ampdu_list_lock, flags);
2468                 sta_info->agg[tid].state = AR9170_TID_STATE_COMPLETE;
2469                 spin_unlock_irqrestore(&ar->tx_ampdu_list_lock, flags);
2470                 break;
2471
2472         case IEEE80211_AMPDU_RX_START:
2473         case IEEE80211_AMPDU_RX_STOP:
2474                 /* Handled by firmware */
2475                 break;
2476
2477         default:
2478                 return -EOPNOTSUPP;
2479         }
2480
2481         return 0;
2482 }
2483
2484 static const struct ieee80211_ops ar9170_ops = {
2485         .start                  = ar9170_op_start,
2486         .stop                   = ar9170_op_stop,
2487         .tx                     = ar9170_op_tx,
2488         .add_interface          = ar9170_op_add_interface,
2489         .remove_interface       = ar9170_op_remove_interface,
2490         .config                 = ar9170_op_config,
2491         .prepare_multicast      = ar9170_op_prepare_multicast,
2492         .configure_filter       = ar9170_op_configure_filter,
2493         .conf_tx                = ar9170_conf_tx,
2494         .bss_info_changed       = ar9170_op_bss_info_changed,
2495         .get_tsf                = ar9170_op_get_tsf,
2496         .set_key                = ar9170_set_key,
2497         .sta_add                = ar9170_sta_add,
2498         .sta_remove             = ar9170_sta_remove,
2499         .get_stats              = ar9170_get_stats,
2500         .ampdu_action           = ar9170_ampdu_action,
2501 };
2502
2503 void *ar9170_alloc(size_t priv_size)
2504 {
2505         struct ieee80211_hw *hw;
2506         struct ar9170 *ar;
2507         struct sk_buff *skb;
2508         int i;
2509
2510         /*
2511          * this buffer is used for rx stream reconstruction.
2512          * Under heavy load this device (or the transport layer?)
2513          * tends to split the streams into separate rx descriptors.
2514          */
2515
2516         skb = __dev_alloc_skb(AR9170_RX_STREAM_MAX_SIZE, GFP_KERNEL);
2517         if (!skb)
2518                 goto err_nomem;
2519
2520         hw = ieee80211_alloc_hw(priv_size, &ar9170_ops);
2521         if (!hw)
2522                 goto err_nomem;
2523
2524         ar = hw->priv;
2525         ar->hw = hw;
2526         ar->rx_failover = skb;
2527
2528         mutex_init(&ar->mutex);
2529         spin_lock_init(&ar->cmdlock);
2530         spin_lock_init(&ar->tx_stats_lock);
2531         spin_lock_init(&ar->tx_ampdu_list_lock);
2532         skb_queue_head_init(&ar->tx_status_ampdu);
2533         for (i = 0; i < __AR9170_NUM_TXQ; i++) {
2534                 skb_queue_head_init(&ar->tx_status[i]);
2535                 skb_queue_head_init(&ar->tx_pending[i]);
2536         }
2537         ar9170_rx_reset_rx_mpdu(ar);
2538         INIT_WORK(&ar->beacon_work, ar9170_new_beacon);
2539         INIT_DELAYED_WORK(&ar->tx_janitor, ar9170_tx_janitor);
2540         INIT_LIST_HEAD(&ar->tx_ampdu_list);
2541
2542         /* all hw supports 2.4 GHz, so set channel to 1 by default */
2543         ar->channel = &ar9170_2ghz_chantable[0];
2544
2545         /* first part of wiphy init */
2546         ar->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
2547                                          BIT(NL80211_IFTYPE_WDS) |
2548                                          BIT(NL80211_IFTYPE_ADHOC);
2549         ar->hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
2550                          IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
2551                          IEEE80211_HW_SIGNAL_DBM |
2552                          IEEE80211_HW_NOISE_DBM;
2553
2554         if (modparam_ht) {
2555                 ar->hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
2556         } else {
2557                 ar9170_band_2GHz.ht_cap.ht_supported = false;
2558                 ar9170_band_5GHz.ht_cap.ht_supported = false;
2559         }
2560
2561         ar->hw->queues = __AR9170_NUM_TXQ;
2562         ar->hw->extra_tx_headroom = 8;
2563         ar->hw->sta_data_size = sizeof(struct ar9170_sta_info);
2564
2565         ar->hw->max_rates = 1;
2566         ar->hw->max_rate_tries = 3;
2567
2568         for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
2569                 ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
2570
2571         return ar;
2572
2573 err_nomem:
2574         kfree_skb(skb);
2575         return ERR_PTR(-ENOMEM);
2576 }
2577
2578 static int ar9170_read_eeprom(struct ar9170 *ar)
2579 {
2580 #define RW      8       /* number of words to read at once */
2581 #define RB      (sizeof(u32) * RW)
2582         struct ath_regulatory *regulatory = &ar->common.regulatory;
2583         u8 *eeprom = (void *)&ar->eeprom;
2584         u8 *addr = ar->eeprom.mac_address;
2585         __le32 offsets[RW];
2586         unsigned int rx_streams, tx_streams, tx_params = 0;
2587         int i, j, err, bands = 0;
2588
2589         BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
2590
2591         BUILD_BUG_ON(RB > AR9170_MAX_CMD_LEN - 4);
2592 #ifndef __CHECKER__
2593         /* don't want to handle trailing remains */
2594         BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
2595 #endif
2596
2597         for (i = 0; i < sizeof(ar->eeprom)/RB; i++) {
2598                 for (j = 0; j < RW; j++)
2599                         offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
2600                                                  RB * i + 4 * j);
2601
2602                 err = ar->exec_cmd(ar, AR9170_CMD_RREG,
2603                                    RB, (u8 *) &offsets,
2604                                    RB, eeprom + RB * i);
2605                 if (err)
2606                         return err;
2607         }
2608
2609 #undef RW
2610 #undef RB
2611
2612         if (ar->eeprom.length == cpu_to_le16(0xFFFF))
2613                 return -ENODATA;
2614
2615         if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
2616                 ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar9170_band_2GHz;
2617                 bands++;
2618         }
2619         if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
2620                 ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &ar9170_band_5GHz;
2621                 bands++;
2622         }
2623
2624         rx_streams = hweight8(ar->eeprom.rx_mask);
2625         tx_streams = hweight8(ar->eeprom.tx_mask);
2626
2627         if (rx_streams != tx_streams)
2628                 tx_params = IEEE80211_HT_MCS_TX_RX_DIFF;
2629
2630         if (tx_streams >= 1 && tx_streams <= IEEE80211_HT_MCS_TX_MAX_STREAMS)
2631                 tx_params = (tx_streams - 1) <<
2632                             IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
2633
2634         ar9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params;
2635         ar9170_band_5GHz.ht_cap.mcs.tx_params |= tx_params;
2636
2637         /*
2638          * I measured this, a bandswitch takes roughly
2639          * 135 ms and a frequency switch about 80.
2640          *
2641          * FIXME: measure these values again once EEPROM settings
2642          *        are used, that will influence them!
2643          */
2644         if (bands == 2)
2645                 ar->hw->channel_change_time = 135 * 1000;
2646         else
2647                 ar->hw->channel_change_time = 80 * 1000;
2648
2649         regulatory->current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
2650         regulatory->current_rd_ext = le16_to_cpu(ar->eeprom.reg_domain[1]);
2651
2652         /* second part of wiphy init */
2653         SET_IEEE80211_PERM_ADDR(ar->hw, addr);
2654
2655         return bands ? 0 : -EINVAL;
2656 }
2657
2658 static int ar9170_reg_notifier(struct wiphy *wiphy,
2659                         struct regulatory_request *request)
2660 {
2661         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
2662         struct ar9170 *ar = hw->priv;
2663
2664         return ath_reg_notifier_apply(wiphy, request, &ar->common.regulatory);
2665 }
2666
2667 int ar9170_register(struct ar9170 *ar, struct device *pdev)
2668 {
2669         struct ath_regulatory *regulatory = &ar->common.regulatory;
2670         int err;
2671
2672         /* try to read EEPROM, init MAC addr */
2673         err = ar9170_read_eeprom(ar);
2674         if (err)
2675                 goto err_out;
2676
2677         err = ath_regd_init(regulatory, ar->hw->wiphy,
2678                             ar9170_reg_notifier);
2679         if (err)
2680                 goto err_out;
2681
2682         err = ieee80211_register_hw(ar->hw);
2683         if (err)
2684                 goto err_out;
2685
2686         if (!ath_is_world_regd(regulatory))
2687                 regulatory_hint(ar->hw->wiphy, regulatory->alpha2);
2688
2689         err = ar9170_init_leds(ar);
2690         if (err)
2691                 goto err_unreg;
2692
2693 #ifdef CONFIG_AR9170_LEDS
2694         err = ar9170_register_leds(ar);
2695         if (err)
2696                 goto err_unreg;
2697 #endif /* CONFIG_AR9170_LEDS */
2698
2699         dev_info(pdev, "Atheros AR9170 is registered as '%s'\n",
2700                  wiphy_name(ar->hw->wiphy));
2701
2702         ar->registered = true;
2703         return 0;
2704
2705 err_unreg:
2706         ieee80211_unregister_hw(ar->hw);
2707
2708 err_out:
2709         return err;
2710 }
2711
2712 void ar9170_unregister(struct ar9170 *ar)
2713 {
2714         if (ar->registered) {
2715 #ifdef CONFIG_AR9170_LEDS
2716                 ar9170_unregister_leds(ar);
2717 #endif /* CONFIG_AR9170_LEDS */
2718
2719         ieee80211_unregister_hw(ar->hw);
2720         }
2721
2722         kfree_skb(ar->rx_failover);
2723         mutex_destroy(&ar->mutex);
2724 }