drivers/net/wireless/ath/ath6kl/txrx.c

   1 /*
   2  * Copyright (c) 2004-2011 Atheros Communications Inc.
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include "core.h"
  18 #include "debug.h"
  19
  20 /*
  21  * tid - tid_mux0..tid_mux3
  22  * aid - tid_mux4..tid_mux7
  23  */
  24 #define ATH6KL_TID_MASK 0xf
  25 #define ATH6KL_AID_SHIFT 4
  26
  27 static inline u8 ath6kl_get_tid(u8 tid_mux)
  28 {
  29         return tid_mux & ATH6KL_TID_MASK;
  30 }
  31
  32 static inline u8 ath6kl_get_aid(u8 tid_mux)
  33 {
  34         return tid_mux >> ATH6KL_AID_SHIFT;
  35 }
  36
  37 static u8 ath6kl_ibss_map_epid(struct sk_buff *skb, struct net_device *dev,
  38                                u32 *map_no)
  39 {
  40         struct ath6kl *ar = ath6kl_priv(dev);
  41         struct ethhdr *eth_hdr;
  42         u32 i, ep_map = -1;
  43         u8 *datap;
  44
  45         *map_no = 0;
  46         datap = skb->data;
  47         eth_hdr = (struct ethhdr *) (datap + sizeof(struct wmi_data_hdr));
  48
  49         if (is_multicast_ether_addr(eth_hdr->h_dest))
  50                 return ENDPOINT_2;
  51
  52         for (i = 0; i < ar->node_num; i++) {
  53                 if (memcmp(eth_hdr->h_dest, ar->node_map[i].mac_addr,
  54                            ETH_ALEN) == 0) {
  55                         *map_no = i + 1;
  56                         ar->node_map[i].tx_pend++;
  57                         return ar->node_map[i].ep_id;
  58                 }
  59
  60                 if ((ep_map == -1) && !ar->node_map[i].tx_pend)
  61                         ep_map = i;
  62         }
  63
  64         if (ep_map == -1) {
  65                 ep_map = ar->node_num;
  66                 ar->node_num++;
  67                 if (ar->node_num > MAX_NODE_NUM)
  68                         return ENDPOINT_UNUSED;
  69         }
  70
  71         memcpy(ar->node_map[ep_map].mac_addr, eth_hdr->h_dest, ETH_ALEN);
  72
  73         for (i = ENDPOINT_2; i <= ENDPOINT_5; i++) {
  74                 if (!ar->tx_pending[i]) {
  75                         ar->node_map[ep_map].ep_id = i;
  76                         break;
  77                 }
  78
  79                 /*
  80                  * No free endpoint is available, start redistribution on
  81                  * the inuse endpoints.
  82                  */
  83                 if (i == ENDPOINT_5) {
  84                         ar->node_map[ep_map].ep_id = ar->next_ep_id;
  85                         ar->next_ep_id++;
  86                         if (ar->next_ep_id > ENDPOINT_5)
  87                                 ar->next_ep_id = ENDPOINT_2;
  88                 }
  89         }
  90
  91         *map_no = ep_map + 1;
  92         ar->node_map[ep_map].tx_pend++;
  93
  94         return ar->node_map[ep_map].ep_id;
  95 }
  96
  97 static bool ath6kl_process_uapsdq(struct ath6kl_sta *conn,
  98                                 struct ath6kl_vif *vif,
  99                                 struct sk_buff *skb,
 100                                 u32 *flags)
 101 {
 102         struct ath6kl *ar = vif->ar;
 103         bool is_apsdq_empty = false;
 104         struct ethhdr *datap = (struct ethhdr *) skb->data;
 105         u8 up = 0, traffic_class, *ip_hdr;
 106         u16 ether_type;
 107         struct ath6kl_llc_snap_hdr *llc_hdr;
 108
 109         if (conn->sta_flags & STA_PS_APSD_TRIGGER) {
 110                 /*
 111                  * This tx is because of a uAPSD trigger, determine
 112                  * more and EOSP bit. Set EOSP if queue is empty
 113                  * or sufficient frames are delivered for this trigger.
 114                  */
 115                 spin_lock_bh(&conn->psq_lock);
 116                 if (!skb_queue_empty(&conn->apsdq))
 117                         *flags |= WMI_DATA_HDR_FLAGS_MORE;
 118                 else if (conn->sta_flags & STA_PS_APSD_EOSP)
 119                         *flags |= WMI_DATA_HDR_FLAGS_EOSP;
 120                 *flags |= WMI_DATA_HDR_FLAGS_UAPSD;
 121                 spin_unlock_bh(&conn->psq_lock);
 122                 return false;
 123         } else if (!conn->apsd_info)
 124                 return false;
 125
 126         if (test_bit(WMM_ENABLED, &vif->flags)) {
 127                 ether_type = be16_to_cpu(datap->h_proto);
 128                 if (is_ethertype(ether_type)) {
 129                         /* packet is in DIX format  */
 130                         ip_hdr = (u8 *)(datap + 1);
 131                 } else {
 132                         /* packet is in 802.3 format */
 133                         llc_hdr = (struct ath6kl_llc_snap_hdr *)
 134                                                         (datap + 1);
 135                         ether_type = be16_to_cpu(llc_hdr->eth_type);
 136                         ip_hdr = (u8 *)(llc_hdr + 1);
 137                 }
 138
 139                 if (ether_type == IP_ETHERTYPE)
 140                         up = ath6kl_wmi_determine_user_priority(
 141                                                         ip_hdr, 0);
 142         }
 143
 144         traffic_class = ath6kl_wmi_get_traffic_class(up);
 145
 146         if ((conn->apsd_info & (1 << traffic_class)) == 0)
 147                 return false;
 148
 149         /* Queue the frames if the STA is sleeping */
 150         spin_lock_bh(&conn->psq_lock);
 151         is_apsdq_empty = skb_queue_empty(&conn->apsdq);
 152         skb_queue_tail(&conn->apsdq, skb);
 153         spin_unlock_bh(&conn->psq_lock);
 154
 155         /*
 156          * If this is the first pkt getting queued
 157          * for this STA, update the PVB for this STA
 158          */
 159         if (is_apsdq_empty) {
 160                 ath6kl_wmi_set_apsd_bfrd_traf(ar->wmi,
 161                                 vif->fw_vif_idx,
 162                                 conn->aid, 1, 0);
 163         }
 164         *flags |= WMI_DATA_HDR_FLAGS_UAPSD;
 165
 166         return true;
 167 }
 168
 169 static bool ath6kl_process_psq(struct ath6kl_sta *conn,
 170                                 struct ath6kl_vif *vif,
 171                                 struct sk_buff *skb,
 172                                 u32 *flags)
 173 {
 174         bool is_psq_empty = false;
 175         struct ath6kl *ar = vif->ar;
 176
 177         if (conn->sta_flags & STA_PS_POLLED) {
 178                 spin_lock_bh(&conn->psq_lock);
 179                 if (!skb_queue_empty(&conn->psq))
 180                         *flags |= WMI_DATA_HDR_FLAGS_MORE;
 181                 spin_unlock_bh(&conn->psq_lock);
 182                 return false;
 183         }
 184
 185         /* Queue the frames if the STA is sleeping */
 186         spin_lock_bh(&conn->psq_lock);
 187         is_psq_empty = skb_queue_empty(&conn->psq);
 188         skb_queue_tail(&conn->psq, skb);
 189         spin_unlock_bh(&conn->psq_lock);
 190
 191         /*
 192          * If this is the first pkt getting queued
 193          * for this STA, update the PVB for this
 194          * STA.
 195          */
 196         if (is_psq_empty)
 197                 ath6kl_wmi_set_pvb_cmd(ar->wmi,
 198                                        vif->fw_vif_idx,
 199                                        conn->aid, 1);
 200         return true;
 201 }
 202
 203 static bool ath6kl_powersave_ap(struct ath6kl_vif *vif, struct sk_buff *skb,
 204                                 u32 *flags)
 205 {
 206         struct ethhdr *datap = (struct ethhdr *) skb->data;
 207         struct ath6kl_sta *conn = NULL;
 208         bool ps_queued = false;
 209         struct ath6kl *ar = vif->ar;
 210
 211         if (is_multicast_ether_addr(datap->h_dest)) {
 212                 u8 ctr = 0;
 213                 bool q_mcast = false;
 214
 215                 for (ctr = 0; ctr < AP_MAX_NUM_STA; ctr++) {
 216                         if (ar->sta_list[ctr].sta_flags & STA_PS_SLEEP) {
 217                                 q_mcast = true;
 218                                 break;
 219                         }
 220                 }
 221
 222                 if (q_mcast) {
 223                         /*
 224                          * If this transmit is not because of a Dtim Expiry
 225                          * q it.
 226                          */
 227                         if (!test_bit(DTIM_EXPIRED, &vif->flags)) {
 228                                 bool is_mcastq_empty = false;
 229
 230                                 spin_lock_bh(&ar->mcastpsq_lock);
 231                                 is_mcastq_empty =
 232                                         skb_queue_empty(&ar->mcastpsq);
 233                                 skb_queue_tail(&ar->mcastpsq, skb);
 234                                 spin_unlock_bh(&ar->mcastpsq_lock);
 235
 236                                 /*
 237                                  * If this is the first Mcast pkt getting
 238                                  * queued indicate to the target to set the
 239                                  * BitmapControl LSB of the TIM IE.
 240                                  */
 241                                 if (is_mcastq_empty)
 242                                         ath6kl_wmi_set_pvb_cmd(ar->wmi,
 243                                                                vif->fw_vif_idx,
 244                                                                MCAST_AID, 1);
 245
 246                                 ps_queued = true;
 247                         } else {
 248                                 /*
 249                                  * This transmit is because of Dtim expiry.
 250                                  * Determine if MoreData bit has to be set.
 251                                  */
 252                                 spin_lock_bh(&ar->mcastpsq_lock);
 253                                 if (!skb_queue_empty(&ar->mcastpsq))
 254                                         *flags |= WMI_DATA_HDR_FLAGS_MORE;
 255                                 spin_unlock_bh(&ar->mcastpsq_lock);
 256                         }
 257                 }
 258         } else {
 259                 conn = ath6kl_find_sta(vif, datap->h_dest);
 260                 if (!conn) {
 261                         dev_kfree_skb(skb);
 262
 263                         /* Inform the caller that the skb is consumed */
 264                         return true;
 265                 }
 266
 267                 if (conn->sta_flags & STA_PS_SLEEP) {
 268                         ps_queued = ath6kl_process_uapsdq(conn,
 269                                                 vif, skb, flags);
 270                         if (!(*flags & WMI_DATA_HDR_FLAGS_UAPSD))
 271                                 ps_queued = ath6kl_process_psq(conn,
 272                                                 vif, skb, flags);
 273                 }
 274         }
 275         return ps_queued;
 276 }
 277
 278 /* Tx functions */
 279
 280 int ath6kl_control_tx(void *devt, struct sk_buff *skb,
 281                       enum htc_endpoint_id eid)
 282 {
 283         struct ath6kl *ar = devt;
 284         int status = 0;
 285         struct ath6kl_cookie *cookie = NULL;
 286
 287         spin_lock_bh(&ar->lock);
 288
 289         ath6kl_dbg(ATH6KL_DBG_WLAN_TX,
 290                    "%s: skb=0x%p, len=0x%x eid =%d\n", __func__,
 291                    skb, skb->len, eid);
 292
 293         if (test_bit(WMI_CTRL_EP_FULL, &ar->flag) && (eid == ar->ctrl_ep)) {
 294                 /*
 295                  * Control endpoint is full, don't allocate resources, we
 296                  * are just going to drop this packet.
 297                  */
 298                 cookie = NULL;
 299                 ath6kl_err("wmi ctrl ep full, dropping pkt : 0x%p, len:%d\n",
 300                            skb, skb->len);
 301         } else
 302                 cookie = ath6kl_alloc_cookie(ar);
 303
 304         if (cookie == NULL) {
 305                 spin_unlock_bh(&ar->lock);
 306                 status = -ENOMEM;
 307                 goto fail_ctrl_tx;
 308         }
 309
 310         ar->tx_pending[eid]++;
 311
 312         if (eid != ar->ctrl_ep)
 313                 ar->total_tx_data_pend++;
 314
 315         spin_unlock_bh(&ar->lock);
 316
 317         cookie->skb = skb;
 318         cookie->map_no = 0;
 319         set_htc_pkt_info(&cookie->htc_pkt, cookie, skb->data, skb->len,
 320                          eid, ATH6KL_CONTROL_PKT_TAG);
 321
 322         /*
 323          * This interface is asynchronous, if there is an error, cleanup
 324          * will happen in the TX completion callback.
 325          */
 326         ath6kl_htc_tx(ar->htc_target, &cookie->htc_pkt);
 327
 328         return 0;
 329
 330 fail_ctrl_tx:
 331         dev_kfree_skb(skb);
 332         return status;
 333 }
 334
 335 int ath6kl_data_tx(struct sk_buff *skb, struct net_device *dev)
 336 {
 337         struct ath6kl *ar = ath6kl_priv(dev);
 338         struct ath6kl_cookie *cookie = NULL;
 339         enum htc_endpoint_id eid = ENDPOINT_UNUSED;
 340         struct ath6kl_vif *vif = netdev_priv(dev);
 341         u32 map_no = 0;
 342         u16 htc_tag = ATH6KL_DATA_PKT_TAG;
 343         u8 ac = 99 ; /* initialize to unmapped ac */
 344         bool chk_adhoc_ps_mapping = false;
 345         int ret;
 346         struct wmi_tx_meta_v2 meta_v2;
 347         void *meta;
 348         u8 csum_start = 0, csum_dest = 0, csum = skb->ip_summed;
 349         u8 meta_ver = 0;
 350         u32 flags = 0;
 351
 352         ath6kl_dbg(ATH6KL_DBG_WLAN_TX,
 353                    "%s: skb=0x%p, data=0x%p, len=0x%x\n", __func__,
 354                    skb, skb->data, skb->len);
 355
 356         /* If target is not associated */
 357         if (!test_bit(CONNECTED, &vif->flags)) {
 358                 dev_kfree_skb(skb);
 359                 return 0;
 360         }
 361
 362         if (!test_bit(WMI_READY, &ar->flag))
 363                 goto fail_tx;
 364
 365         /* AP mode Power saving processing */
 366         if (vif->nw_type == AP_NETWORK) {
 367                 if (ath6kl_powersave_ap(vif, skb, &flags))
 368                         return 0;
 369         }
 370
 371         if (test_bit(WMI_ENABLED, &ar->flag)) {
 372                 if ((dev->features & NETIF_F_IP_CSUM) &&
 373                                 (csum == CHECKSUM_PARTIAL)) {
 374                         csum_start = skb->csum_start -
 375                                         (skb_network_header(skb) - skb->head) +
 376                                         sizeof(struct ath6kl_llc_snap_hdr);
 377                         csum_dest = skb->csum_offset + csum_start;
 378                 }
 379
 380                 if (skb_headroom(skb) < dev->needed_headroom) {
 381                         struct sk_buff *tmp_skb = skb;
 382
 383                         skb = skb_realloc_headroom(skb, dev->needed_headroom);
 384                         kfree_skb(tmp_skb);
 385                         if (skb == NULL) {
 386                                 vif->net_stats.tx_dropped++;
 387                                 return 0;
 388                         }
 389                 }
 390
 391                 if (ath6kl_wmi_dix_2_dot3(ar->wmi, skb)) {
 392                         ath6kl_err("ath6kl_wmi_dix_2_dot3 failed\n");
 393                         goto fail_tx;
 394                 }
 395
 396                 if ((dev->features & NETIF_F_IP_CSUM) &&
 397                                 (csum == CHECKSUM_PARTIAL)) {
 398                         meta_v2.csum_start = csum_start;
 399                         meta_v2.csum_dest = csum_dest;
 400
 401                         /* instruct target to calculate checksum */
 402                         meta_v2.csum_flags = WMI_META_V2_FLAG_CSUM_OFFLOAD;
 403                         meta_ver = WMI_META_VERSION_2;
 404                         meta = &meta_v2;
 405                 } else {
 406                         meta_ver = 0;
 407                         meta = NULL;
 408                 }
 409
 410                 ret = ath6kl_wmi_data_hdr_add(ar->wmi, skb,
 411                                 DATA_MSGTYPE, flags, 0,
 412                                 meta_ver,
 413                                 meta, vif->fw_vif_idx);
 414
 415                 if (ret) {
 416                         ath6kl_warn("failed to add wmi data header:%d\n"
 417                                 , ret);
 418                         goto fail_tx;
 419                 }
 420
 421                 if ((vif->nw_type == ADHOC_NETWORK) &&
 422                      ar->ibss_ps_enable && test_bit(CONNECTED, &vif->flags))
 423                         chk_adhoc_ps_mapping = true;
 424                 else {
 425                         /* get the stream mapping */
 426                         ret = ath6kl_wmi_implicit_create_pstream(ar->wmi,
 427                                     vif->fw_vif_idx, skb,
 428                                     0, test_bit(WMM_ENABLED, &vif->flags), &ac);
 429                         if (ret)
 430                                 goto fail_tx;
 431                 }
 432         } else
 433                 goto fail_tx;
 434
 435         spin_lock_bh(&ar->lock);
 436
 437         if (chk_adhoc_ps_mapping)
 438                 eid = ath6kl_ibss_map_epid(skb, dev, &map_no);
 439         else
 440                 eid = ar->ac2ep_map[ac];
 441
 442         if (eid == 0 || eid == ENDPOINT_UNUSED) {
 443                 ath6kl_err("eid %d is not mapped!\n", eid);
 444                 spin_unlock_bh(&ar->lock);
 445                 goto fail_tx;
 446         }
 447
 448         /* allocate resource for this packet */
 449         cookie = ath6kl_alloc_cookie(ar);
 450
 451         if (!cookie) {
 452                 spin_unlock_bh(&ar->lock);
 453                 goto fail_tx;
 454         }
 455
 456         /* update counts while the lock is held */
 457         ar->tx_pending[eid]++;
 458         ar->total_tx_data_pend++;
 459
 460         spin_unlock_bh(&ar->lock);
 461
 462         if (!IS_ALIGNED((unsigned long) skb->data - HTC_HDR_LENGTH, 4) &&
 463             skb_cloned(skb)) {
 464                 /*
 465                  * We will touch (move the buffer data to align it. Since the
 466                  * skb buffer is cloned and not only the header is changed, we
 467                  * have to copy it to allow the changes. Since we are copying
 468                  * the data here, we may as well align it by reserving suitable
 469                  * headroom to avoid the memmove in ath6kl_htc_tx_buf_align().
 470                  */
 471                 struct sk_buff *nskb;
 472
 473                 nskb = skb_copy_expand(skb, HTC_HDR_LENGTH, 0, GFP_ATOMIC);
 474                 if (nskb == NULL)
 475                         goto fail_tx;
 476                 kfree_skb(skb);
 477                 skb = nskb;
 478         }
 479
 480         cookie->skb = skb;
 481         cookie->map_no = map_no;
 482         set_htc_pkt_info(&cookie->htc_pkt, cookie, skb->data, skb->len,
 483                          eid, htc_tag);
 484
 485         ath6kl_dbg_dump(ATH6KL_DBG_RAW_BYTES, __func__, "tx ",
 486                         skb->data, skb->len);
 487
 488         /*
 489          * HTC interface is asynchronous, if this fails, cleanup will
 490          * happen in the ath6kl_tx_complete callback.
 491          */
 492         ath6kl_htc_tx(ar->htc_target, &cookie->htc_pkt);
 493
 494         return 0;
 495
 496 fail_tx:
 497         dev_kfree_skb(skb);
 498
 499         vif->net_stats.tx_dropped++;
 500         vif->net_stats.tx_aborted_errors++;
 501
 502         return 0;
 503 }
 504
 505 /* indicate tx activity or inactivity on a WMI stream */
 506 void ath6kl_indicate_tx_activity(void *devt, u8 traffic_class, bool active)
 507 {
 508         struct ath6kl *ar = devt;
 509         enum htc_endpoint_id eid;
 510         int i;
 511
 512         eid = ar->ac2ep_map[traffic_class];
 513
 514         if (!test_bit(WMI_ENABLED, &ar->flag))
 515                 goto notify_htc;
 516
 517         spin_lock_bh(&ar->lock);
 518
 519         ar->ac_stream_active[traffic_class] = active;
 520
 521         if (active) {
 522                 /*
 523                  * Keep track of the active stream with the highest
 524                  * priority.
 525                  */
 526                 if (ar->ac_stream_pri_map[traffic_class] >
 527                     ar->hiac_stream_active_pri)
 528                         /* set the new highest active priority */
 529                         ar->hiac_stream_active_pri =
 530                                         ar->ac_stream_pri_map[traffic_class];
 531
 532         } else {
 533                 /*
 534                  * We may have to search for the next active stream
 535                  * that is the highest priority.
 536                  */
 537                 if (ar->hiac_stream_active_pri ==
 538                         ar->ac_stream_pri_map[traffic_class]) {
 539                         /*
 540                          * The highest priority stream just went inactive
 541                          * reset and search for the "next" highest "active"
 542                          * priority stream.
 543                          */
 544                         ar->hiac_stream_active_pri = 0;
 545
 546                         for (i = 0; i < WMM_NUM_AC; i++) {
 547                                 if (ar->ac_stream_active[i] &&
 548                                     (ar->ac_stream_pri_map[i] >
 549                                      ar->hiac_stream_active_pri))
 550                                         /*
 551                                          * Set the new highest active
 552                                          * priority.
 553                                          */
 554                                         ar->hiac_stream_active_pri =
 555                                                 ar->ac_stream_pri_map[i];
 556                         }
 557                 }
 558         }
 559
 560         spin_unlock_bh(&ar->lock);
 561
 562 notify_htc:
 563         /* notify HTC, this may cause credit distribution changes */
 564         ath6kl_htc_indicate_activity_change(ar->htc_target, eid, active);
 565 }
 566
 567 enum htc_send_full_action ath6kl_tx_queue_full(struct htc_target *target,
 568                                                struct htc_packet *packet)
 569 {
 570         struct ath6kl *ar = target->dev->ar;
 571         struct ath6kl_vif *vif;
 572         enum htc_endpoint_id endpoint = packet->endpoint;
 573         enum htc_send_full_action action = HTC_SEND_FULL_KEEP;
 574
 575         if (endpoint == ar->ctrl_ep) {
 576                 /*
 577                  * Under normal WMI if this is getting full, then something
 578                  * is running rampant the host should not be exhausting the
 579                  * WMI queue with too many commands the only exception to
 580                  * this is during testing using endpointping.
 581                  */
 582                 set_bit(WMI_CTRL_EP_FULL, &ar->flag);
 583                 ath6kl_err("wmi ctrl ep is full\n");
 584                 return action;
 585         }
 586
 587         if (packet->info.tx.tag == ATH6KL_CONTROL_PKT_TAG)
 588                 return action;
 589
 590         /*
 591          * The last MAX_HI_COOKIE_NUM "batch" of cookies are reserved for
 592          * the highest active stream.
 593          */
 594         if (ar->ac_stream_pri_map[ar->ep2ac_map[endpoint]] <
 595             ar->hiac_stream_active_pri &&
 596             ar->cookie_count <= MAX_HI_COOKIE_NUM)
 597                 /*
 598                  * Give preference to the highest priority stream by
 599                  * dropping the packets which overflowed.
 600                  */
 601                 action = HTC_SEND_FULL_DROP;
 602
 603         /* FIXME: Locking */
 604         spin_lock_bh(&ar->list_lock);
 605         list_for_each_entry(vif, &ar->vif_list, list) {
 606                 if (vif->nw_type == ADHOC_NETWORK ||
 607                     action != HTC_SEND_FULL_DROP) {
 608                         spin_unlock_bh(&ar->list_lock);
 609
 610                         set_bit(NETQ_STOPPED, &vif->flags);
 611                         netif_stop_queue(vif->ndev);
 612
 613                         return action;
 614                 }
 615         }
 616         spin_unlock_bh(&ar->list_lock);
 617
 618         return action;
 619 }
 620
 621 /* TODO this needs to be looked at */
 622 static void ath6kl_tx_clear_node_map(struct ath6kl_vif *vif,
 623                                      enum htc_endpoint_id eid, u32 map_no)
 624 {
 625         struct ath6kl *ar = vif->ar;
 626         u32 i;
 627
 628         if (vif->nw_type != ADHOC_NETWORK)
 629                 return;
 630
 631         if (!ar->ibss_ps_enable)
 632                 return;
 633
 634         if (eid == ar->ctrl_ep)
 635                 return;
 636
 637         if (map_no == 0)
 638                 return;
 639
 640         map_no--;
 641         ar->node_map[map_no].tx_pend--;
 642
 643         if (ar->node_map[map_no].tx_pend)
 644                 return;
 645
 646         if (map_no != (ar->node_num - 1))
 647                 return;
 648
 649         for (i = ar->node_num; i > 0; i--) {
 650                 if (ar->node_map[i - 1].tx_pend)
 651                         break;
 652
 653                 memset(&ar->node_map[i - 1], 0,
 654                        sizeof(struct ath6kl_node_mapping));
 655                 ar->node_num--;
 656         }
 657 }
 658
 659 void ath6kl_tx_complete(void *context, struct list_head *packet_queue)
 660 {
 661         struct ath6kl *ar = context;
 662         struct sk_buff_head skb_queue;
 663         struct htc_packet *packet;
 664         struct sk_buff *skb;
 665         struct ath6kl_cookie *ath6kl_cookie;
 666         u32 map_no = 0;
 667         int status;
 668         enum htc_endpoint_id eid;
 669         bool wake_event = false;
 670         bool flushing[ATH6KL_VIF_MAX] = {false};
 671         u8 if_idx;
 672         struct ath6kl_vif *vif;
 673
 674         skb_queue_head_init(&skb_queue);
 675
 676         /* lock the driver as we update internal state */
 677         spin_lock_bh(&ar->lock);
 678
 679         /* reap completed packets */
 680         while (!list_empty(packet_queue)) {
 681
 682                 packet = list_first_entry(packet_queue, struct htc_packet,
 683                                           list);
 684                 list_del(&packet->list);
 685
 686                 ath6kl_cookie = (struct ath6kl_cookie *)packet->pkt_cntxt;
 687                 if (!ath6kl_cookie)
 688                         goto fatal;
 689
 690                 status = packet->status;
 691                 skb = ath6kl_cookie->skb;
 692                 eid = packet->endpoint;
 693                 map_no = ath6kl_cookie->map_no;
 694
 695                 if (!skb || !skb->data)
 696                         goto fatal;
 697
 698                 __skb_queue_tail(&skb_queue, skb);
 699
 700                 if (!status && (packet->act_len != skb->len))
 701                         goto fatal;
 702
 703                 ar->tx_pending[eid]--;
 704
 705                 if (eid != ar->ctrl_ep)
 706                         ar->total_tx_data_pend--;
 707
 708                 if (eid == ar->ctrl_ep) {
 709                         if (test_bit(WMI_CTRL_EP_FULL, &ar->flag))
 710                                 clear_bit(WMI_CTRL_EP_FULL, &ar->flag);
 711
 712                         if (ar->tx_pending[eid] == 0)
 713                                 wake_event = true;
 714                 }
 715
 716                 if (eid == ar->ctrl_ep) {
 717                         if_idx = wmi_cmd_hdr_get_if_idx(
 718                                 (struct wmi_cmd_hdr *) packet->buf);
 719                 } else {
 720                         if_idx = wmi_data_hdr_get_if_idx(
 721                                 (struct wmi_data_hdr *) packet->buf);
 722                 }
 723
 724                 vif = ath6kl_get_vif_by_index(ar, if_idx);
 725                 if (!vif) {
 726                         ath6kl_free_cookie(ar, ath6kl_cookie);
 727                         continue;
 728                 }
 729
 730                 if (status) {
 731                         if (status == -ECANCELED)
 732                                 /* a packet was flushed  */
 733                                 flushing[if_idx] = true;
 734
 735                         vif->net_stats.tx_errors++;
 736
 737                         if (status != -ENOSPC && status != -ECANCELED)
 738                                 ath6kl_warn("tx complete error: %d\n", status);
 739
 740                         ath6kl_dbg(ATH6KL_DBG_WLAN_TX,
 741                                    "%s: skb=0x%p data=0x%p len=0x%x eid=%d %s\n",
 742                                    __func__, skb, packet->buf, packet->act_len,
 743                                    eid, "error!");
 744                 } else {
 745                         ath6kl_dbg(ATH6KL_DBG_WLAN_TX,
 746                                    "%s: skb=0x%p data=0x%p len=0x%x eid=%d %s\n",
 747                                    __func__, skb, packet->buf, packet->act_len,
 748                                    eid, "OK");
 749
 750                         flushing[if_idx] = false;
 751                         vif->net_stats.tx_packets++;
 752                         vif->net_stats.tx_bytes += skb->len;
 753                 }
 754
 755                 ath6kl_tx_clear_node_map(vif, eid, map_no);
 756
 757                 ath6kl_free_cookie(ar, ath6kl_cookie);
 758
 759                 if (test_bit(NETQ_STOPPED, &vif->flags))
 760                         clear_bit(NETQ_STOPPED, &vif->flags);
 761         }
 762
 763         spin_unlock_bh(&ar->lock);
 764
 765         __skb_queue_purge(&skb_queue);
 766
 767         /* FIXME: Locking */
 768         spin_lock_bh(&ar->list_lock);
 769         list_for_each_entry(vif, &ar->vif_list, list) {
 770                 if (test_bit(CONNECTED, &vif->flags) &&
 771                     !flushing[vif->fw_vif_idx]) {
 772                         spin_unlock_bh(&ar->list_lock);
 773                         netif_wake_queue(vif->ndev);
 774                         spin_lock_bh(&ar->list_lock);
 775                 }
 776         }
 777         spin_unlock_bh(&ar->list_lock);
 778
 779         if (wake_event)
 780                 wake_up(&ar->event_wq);
 781
 782         return;
 783
 784 fatal:
 785         WARN_ON(1);
 786         spin_unlock_bh(&ar->lock);
 787         return;
 788 }
 789
 790 void ath6kl_tx_data_cleanup(struct ath6kl *ar)
 791 {
 792         int i;
 793
 794         /* flush all the data (non-control) streams */
 795         for (i = 0; i < WMM_NUM_AC; i++)
 796                 ath6kl_htc_flush_txep(ar->htc_target, ar->ac2ep_map[i],
 797                                       ATH6KL_DATA_PKT_TAG);
 798 }
 799
 800 /* Rx functions */
 801
 802 static void ath6kl_deliver_frames_to_nw_stack(struct net_device *dev,
 803                                               struct sk_buff *skb)
 804 {
 805         if (!skb)
 806                 return;
 807
 808         skb->dev = dev;
 809
 810         if (!(skb->dev->flags & IFF_UP)) {
 811                 dev_kfree_skb(skb);
 812                 return;
 813         }
 814
 815         skb->protocol = eth_type_trans(skb, skb->dev);
 816
 817         netif_rx_ni(skb);
 818 }
 819
 820 static void ath6kl_alloc_netbufs(struct sk_buff_head *q, u16 num)
 821 {
 822         struct sk_buff *skb;
 823
 824         while (num) {
 825                 skb = ath6kl_buf_alloc(ATH6KL_BUFFER_SIZE);
 826                 if (!skb) {
 827                         ath6kl_err("netbuf allocation failed\n");
 828                         return;
 829                 }
 830                 skb_queue_tail(q, skb);
 831                 num--;
 832         }
 833 }
 834
 835 static struct sk_buff *aggr_get_free_skb(struct aggr_info *p_aggr)
 836 {
 837         struct sk_buff *skb = NULL;
 838
 839         if (skb_queue_len(&p_aggr->rx_amsdu_freeq) <
 840             (AGGR_NUM_OF_FREE_NETBUFS >> 2))
 841                 ath6kl_alloc_netbufs(&p_aggr->rx_amsdu_freeq,
 842                                      AGGR_NUM_OF_FREE_NETBUFS);
 843
 844         skb = skb_dequeue(&p_aggr->rx_amsdu_freeq);
 845
 846         return skb;
 847 }
 848
 849 void ath6kl_rx_refill(struct htc_target *target, enum htc_endpoint_id endpoint)
 850 {
 851         struct ath6kl *ar = target->dev->ar;
 852         struct sk_buff *skb;
 853         int rx_buf;
 854         int n_buf_refill;
 855         struct htc_packet *packet;
 856         struct list_head queue;
 857
 858         n_buf_refill = ATH6KL_MAX_RX_BUFFERS -
 859                           ath6kl_htc_get_rxbuf_num(ar->htc_target, endpoint);
 860
 861         if (n_buf_refill <= 0)
 862                 return;
 863
 864         INIT_LIST_HEAD(&queue);
 865
 866         ath6kl_dbg(ATH6KL_DBG_WLAN_RX,
 867                    "%s: providing htc with %d buffers at eid=%d\n",
 868                    __func__, n_buf_refill, endpoint);
 869
 870         for (rx_buf = 0; rx_buf < n_buf_refill; rx_buf++) {
 871                 skb = ath6kl_buf_alloc(ATH6KL_BUFFER_SIZE);
 872                 if (!skb)
 873                         break;
 874
 875                 packet = (struct htc_packet *) skb->head;
 876                 if (!IS_ALIGNED((unsigned long) skb->data, 4))
 877                         skb->data = PTR_ALIGN(skb->data - 4, 4);
 878                 set_htc_rxpkt_info(packet, skb, skb->data,
 879                                 ATH6KL_BUFFER_SIZE, endpoint);
 880                 list_add_tail(&packet->list, &queue);
 881         }
 882
 883         if (!list_empty(&queue))
 884                 ath6kl_htc_add_rxbuf_multiple(ar->htc_target, &queue);
 885 }
 886
 887 void ath6kl_refill_amsdu_rxbufs(struct ath6kl *ar, int count)
 888 {
 889         struct htc_packet *packet;
 890         struct sk_buff *skb;
 891
 892         while (count) {
 893                 skb = ath6kl_buf_alloc(ATH6KL_AMSDU_BUFFER_SIZE);
 894                 if (!skb)
 895                         return;
 896
 897                 packet = (struct htc_packet *) skb->head;
 898                 if (!IS_ALIGNED((unsigned long) skb->data, 4))
 899                         skb->data = PTR_ALIGN(skb->data - 4, 4);
 900                 set_htc_rxpkt_info(packet, skb, skb->data,
 901                                    ATH6KL_AMSDU_BUFFER_SIZE, 0);
 902                 spin_lock_bh(&ar->lock);
 903                 list_add_tail(&packet->list, &ar->amsdu_rx_buffer_queue);
 904                 spin_unlock_bh(&ar->lock);
 905                 count--;
 906         }
 907 }
 908
 909 /*
 910  * Callback to allocate a receive buffer for a pending packet. We use a
 911  * pre-allocated list of buffers of maximum AMSDU size (4K).
 912  */
 913 struct htc_packet *ath6kl_alloc_amsdu_rxbuf(struct htc_target *target,
 914                                             enum htc_endpoint_id endpoint,
 915                                             int len)
 916 {
 917         struct ath6kl *ar = target->dev->ar;
 918         struct htc_packet *packet = NULL;
 919         struct list_head *pkt_pos;
 920         int refill_cnt = 0, depth = 0;
 921
 922         ath6kl_dbg(ATH6KL_DBG_WLAN_RX, "%s: eid=%d, len:%d\n",
 923                    __func__, endpoint, len);
 924
 925         if ((len <= ATH6KL_BUFFER_SIZE) ||
 926             (len > ATH6KL_AMSDU_BUFFER_SIZE))
 927                 return NULL;
 928
 929         spin_lock_bh(&ar->lock);
 930
 931         if (list_empty(&ar->amsdu_rx_buffer_queue)) {
 932                 spin_unlock_bh(&ar->lock);
 933                 refill_cnt = ATH6KL_MAX_AMSDU_RX_BUFFERS;
 934                 goto refill_buf;
 935         }
 936
 937         packet = list_first_entry(&ar->amsdu_rx_buffer_queue,
 938                                   struct htc_packet, list);
 939         list_del(&packet->list);
 940         list_for_each(pkt_pos, &ar->amsdu_rx_buffer_queue)
 941                 depth++;
 942
 943         refill_cnt = ATH6KL_MAX_AMSDU_RX_BUFFERS - depth;
 944         spin_unlock_bh(&ar->lock);
 945
 946         /* set actual endpoint ID */
 947         packet->endpoint = endpoint;
 948
 949 refill_buf:
 950         if (refill_cnt >= ATH6KL_AMSDU_REFILL_THRESHOLD)
 951                 ath6kl_refill_amsdu_rxbufs(ar, refill_cnt);
 952
 953         return packet;
 954 }
 955
 956 static void aggr_slice_amsdu(struct aggr_info *p_aggr,
 957                              struct rxtid *rxtid, struct sk_buff *skb)
 958 {
 959         struct sk_buff *new_skb;
 960         struct ethhdr *hdr;
 961         u16 frame_8023_len, payload_8023_len, mac_hdr_len, amsdu_len;
 962         u8 *framep;
 963
 964         mac_hdr_len = sizeof(struct ethhdr);
 965         framep = skb->data + mac_hdr_len;
 966         amsdu_len = skb->len - mac_hdr_len;
 967
 968         while (amsdu_len > mac_hdr_len) {
 969                 hdr = (struct ethhdr *) framep;
 970                 payload_8023_len = ntohs(hdr->h_proto);
 971
 972                 if (payload_8023_len < MIN_MSDU_SUBFRAME_PAYLOAD_LEN ||
 973                     payload_8023_len > MAX_MSDU_SUBFRAME_PAYLOAD_LEN) {
 974                         ath6kl_err("802.3 AMSDU frame bound check failed. len %d\n",
 975                                    payload_8023_len);
 976                         break;
 977                 }
 978
 979                 frame_8023_len = payload_8023_len + mac_hdr_len;
 980                 new_skb = aggr_get_free_skb(p_aggr);
 981                 if (!new_skb) {
 982                         ath6kl_err("no buffer available\n");
 983                         break;
 984                 }
 985
 986                 memcpy(new_skb->data, framep, frame_8023_len);
 987                 skb_put(new_skb, frame_8023_len);
 988                 if (ath6kl_wmi_dot3_2_dix(new_skb)) {
 989                         ath6kl_err("dot3_2_dix error\n");
 990                         dev_kfree_skb(new_skb);
 991                         break;
 992                 }
 993
 994                 skb_queue_tail(&rxtid->q, new_skb);
 995
 996                 /* Is this the last subframe within this aggregate ? */
 997                 if ((amsdu_len - frame_8023_len) == 0)
 998                         break;
 999
1000                 /* Add the length of A-MSDU subframe padding bytes -
1001                  * Round to nearest word.
1002                  */
1003                 frame_8023_len = ALIGN(frame_8023_len, 4);
1004
1005                 framep += frame_8023_len;
1006                 amsdu_len -= frame_8023_len;
1007         }
1008
1009         dev_kfree_skb(skb);
1010 }
1011
1012 static void aggr_deque_frms(struct aggr_info_conn *agg_conn, u8 tid,
1013                             u16 seq_no, u8 order)
1014 {
1015         struct sk_buff *skb;
1016         struct rxtid *rxtid;
1017         struct skb_hold_q *node;
1018         u16 idx, idx_end, seq_end;
1019         struct rxtid_stats *stats;
1020
1021         rxtid = &agg_conn->rx_tid[tid];
1022         stats = &agg_conn->stat[tid];
1023
1024         idx = AGGR_WIN_IDX(rxtid->seq_next, rxtid->hold_q_sz);
1025
1026         /*
1027          * idx_end is typically the last possible frame in the window,
1028          * but changes to 'the' seq_no, when BAR comes. If seq_no
1029          * is non-zero, we will go up to that and stop.
1030          * Note: last seq no in current window will occupy the same
1031          * index position as index that is just previous to start.
1032          * An imp point : if win_sz is 7, for seq_no space of 4095,
1033          * then, there would be holes when sequence wrap around occurs.
1034          * Target should judiciously choose the win_sz, based on
1035          * this condition. For 4095, (TID_WINDOW_SZ = 2 x win_sz
1036          * 2, 4, 8, 16 win_sz works fine).
1037          * We must deque from "idx" to "idx_end", including both.
1038          */
1039         seq_end = seq_no ? seq_no : rxtid->seq_next;
1040         idx_end = AGGR_WIN_IDX(seq_end, rxtid->hold_q_sz);
1041
1042         spin_lock_bh(&rxtid->lock);
1043
1044         do {
1045                 node = &rxtid->hold_q[idx];
1046                 if ((order == 1) && (!node->skb))
1047                         break;
1048
1049                 if (node->skb) {
1050                         if (node->is_amsdu)
1051                                 aggr_slice_amsdu(agg_conn->aggr_info, rxtid,
1052                                                  node->skb);
1053                         else
1054                                 skb_queue_tail(&rxtid->q, node->skb);
1055                         node->skb = NULL;
1056                 } else
1057                         stats->num_hole++;
1058
1059                 rxtid->seq_next = ATH6KL_NEXT_SEQ_NO(rxtid->seq_next);
1060                 idx = AGGR_WIN_IDX(rxtid->seq_next, rxtid->hold_q_sz);
1061         } while (idx != idx_end);
1062
1063         spin_unlock_bh(&rxtid->lock);
1064
1065         stats->num_delivered += skb_queue_len(&rxtid->q);
1066
1067         while ((skb = skb_dequeue(&rxtid->q)))
1068                 ath6kl_deliver_frames_to_nw_stack(agg_conn->dev, skb);
1069 }
1070
1071 static bool aggr_process_recv_frm(struct aggr_info_conn *agg_conn, u8 tid,
1072                                   u16 seq_no,
1073                                   bool is_amsdu, struct sk_buff *frame)
1074 {
1075         struct rxtid *rxtid;
1076         struct rxtid_stats *stats;
1077         struct sk_buff *skb;
1078         struct skb_hold_q *node;
1079         u16 idx, st, cur, end;
1080         bool is_queued = false;
1081         u16 extended_end;
1082
1083         rxtid = &agg_conn->rx_tid[tid];
1084         stats = &agg_conn->stat[tid];
1085
1086         stats->num_into_aggr++;
1087
1088         if (!rxtid->aggr) {
1089                 if (is_amsdu) {
1090                         aggr_slice_amsdu(agg_conn->aggr_info, rxtid, frame);
1091                         is_queued = true;
1092                         stats->num_amsdu++;
1093                         while ((skb = skb_dequeue(&rxtid->q)))
1094                                 ath6kl_deliver_frames_to_nw_stack(agg_conn->dev,
1095                                                                   skb);
1096                 }
1097                 return is_queued;
1098         }
1099
1100         /* Check the incoming sequence no, if it's in the window */
1101         st = rxtid->seq_next;
1102         cur = seq_no;
1103         end = (st + rxtid->hold_q_sz-1) & ATH6KL_MAX_SEQ_NO;
1104
1105         if (((st < end) && (cur < st || cur > end)) ||
1106             ((st > end) && (cur > end) && (cur < st))) {
1107                 extended_end = (end + rxtid->hold_q_sz - 1) &
1108                         ATH6KL_MAX_SEQ_NO;
1109
1110                 if (((end < extended_end) &&
1111                      (cur < end || cur > extended_end)) ||
1112                     ((end > extended_end) && (cur > extended_end) &&
1113                      (cur < end))) {
1114                         aggr_deque_frms(agg_conn, tid, 0, 0);
1115                         if (cur >= rxtid->hold_q_sz - 1)
1116                                 rxtid->seq_next = cur - (rxtid->hold_q_sz - 1);
1117                         else
1118                                 rxtid->seq_next = ATH6KL_MAX_SEQ_NO -
1119                                                   (rxtid->hold_q_sz - 2 - cur);
1120                 } else {
1121                         /*
1122                          * Dequeue only those frames that are outside the
1123                          * new shifted window.
1124                          */
1125                         if (cur >= rxtid->hold_q_sz - 1)
1126                                 st = cur - (rxtid->hold_q_sz - 1);
1127                         else
1128                                 st = ATH6KL_MAX_SEQ_NO -
1129                                         (rxtid->hold_q_sz - 2 - cur);
1130
1131                         aggr_deque_frms(agg_conn, tid, st, 0);
1132                 }
1133
1134                 stats->num_oow++;
1135         }
1136
1137         idx = AGGR_WIN_IDX(seq_no, rxtid->hold_q_sz);
1138
1139         node = &rxtid->hold_q[idx];
1140
1141         spin_lock_bh(&rxtid->lock);
1142
1143         /*
1144          * Is the cur frame duplicate or something beyond our window(hold_q
1145          * -> which is 2x, already)?
1146          *
1147          * 1. Duplicate is easy - drop incoming frame.
1148          * 2. Not falling in current sliding window.
1149          *  2a. is the frame_seq_no preceding current tid_seq_no?
1150          *      -> drop the frame. perhaps sender did not get our ACK.
1151          *         this is taken care of above.
1152          *  2b. is the frame_seq_no beyond window(st, TID_WINDOW_SZ);
1153          *      -> Taken care of it above, by moving window forward.
1154          */
1155         dev_kfree_skb(node->skb);
1156         stats->num_dups++;
1157
1158         node->skb = frame;
1159         is_queued = true;
1160         node->is_amsdu = is_amsdu;
1161         node->seq_no = seq_no;
1162
1163         if (node->is_amsdu)
1164                 stats->num_amsdu++;
1165         else
1166                 stats->num_mpdu++;
1167
1168         spin_unlock_bh(&rxtid->lock);
1169
1170         aggr_deque_frms(agg_conn, tid, 0, 1);
1171
1172         if (agg_conn->timer_scheduled)
1173                 rxtid->progress = true;
1174         else
1175                 for (idx = 0 ; idx < rxtid->hold_q_sz; idx++) {
1176                         if (rxtid->hold_q[idx].skb) {
1177                                 /*
1178                                  * There is a frame in the queue and no
1179                                  * timer so start a timer to ensure that
1180                                  * the frame doesn't remain stuck
1181                                  * forever.
1182                                  */
1183                                 agg_conn->timer_scheduled = true;
1184                                 mod_timer(&agg_conn->timer,
1185                                           (jiffies +
1186                                            HZ * (AGGR_RX_TIMEOUT) / 1000));
1187                                 rxtid->progress = false;
1188                                 rxtid->timer_mon = true;
1189                                 break;
1190                         }
1191                 }
1192
1193         return is_queued;
1194 }
1195
1196 static void ath6kl_uapsd_trigger_frame_rx(struct ath6kl_vif *vif,
1197                                                  struct ath6kl_sta *conn)
1198 {
1199         struct ath6kl *ar = vif->ar;
1200         bool is_apsdq_empty, is_apsdq_empty_at_start;
1201         u32 num_frames_to_deliver, flags;
1202         struct sk_buff *skb = NULL;
1203
1204         /*
1205          * If the APSD q for this STA is not empty, dequeue and
1206          * send a pkt from the head of the q. Also update the
1207          * More data bit in the WMI_DATA_HDR if there are
1208          * more pkts for this STA in the APSD q.
1209          * If there are no more pkts for this STA,
1210          * update the APSD bitmap for this STA.
1211          */
1212
1213         num_frames_to_deliver = (conn->apsd_info >> ATH6KL_APSD_NUM_OF_AC) &
1214                                                     ATH6KL_APSD_FRAME_MASK;
1215         /*
1216          * Number of frames to send in a service period is
1217          * indicated by the station
1218          * in the QOS_INFO of the association request
1219          * If it is zero, send all frames
1220          */
1221         if (!num_frames_to_deliver)
1222                 num_frames_to_deliver = ATH6KL_APSD_ALL_FRAME;
1223
1224         spin_lock_bh(&conn->psq_lock);
1225         is_apsdq_empty = skb_queue_empty(&conn->apsdq);
1226         spin_unlock_bh(&conn->psq_lock);
1227         is_apsdq_empty_at_start = is_apsdq_empty;
1228
1229         while ((!is_apsdq_empty) && (num_frames_to_deliver)) {
1230
1231                 spin_lock_bh(&conn->psq_lock);
1232                 skb = skb_dequeue(&conn->apsdq);
1233                 is_apsdq_empty = skb_queue_empty(&conn->apsdq);
1234                 spin_unlock_bh(&conn->psq_lock);
1235
1236                 /*
1237                  * Set the STA flag to Trigger delivery,
1238                  * so that the frame will go out
1239                  */
1240                 conn->sta_flags |= STA_PS_APSD_TRIGGER;
1241                 num_frames_to_deliver--;
1242
1243                 /* Last frame in the service period, set EOSP or queue empty */
1244                 if ((is_apsdq_empty) || (!num_frames_to_deliver))
1245                         conn->sta_flags |= STA_PS_APSD_EOSP;
1246
1247                 ath6kl_data_tx(skb, vif->ndev);
1248                 conn->sta_flags &= ~(STA_PS_APSD_TRIGGER);
1249                 conn->sta_flags &= ~(STA_PS_APSD_EOSP);
1250         }
1251
1252         if (is_apsdq_empty) {
1253                 if (is_apsdq_empty_at_start)
1254                         flags = WMI_AP_APSD_NO_DELIVERY_FRAMES;
1255                 else
1256                         flags = 0;
1257
1258                 ath6kl_wmi_set_apsd_bfrd_traf(ar->wmi,
1259                                 vif->fw_vif_idx,
1260                                 conn->aid, 0, flags);
1261         }
1262
1263         return;
1264 }
1265
1266 void ath6kl_rx(struct htc_target *target, struct htc_packet *packet)
1267 {
1268         struct ath6kl *ar = target->dev->ar;
1269         struct sk_buff *skb = packet->pkt_cntxt;
1270         struct wmi_rx_meta_v2 *meta;
1271         struct wmi_data_hdr *dhdr;
1272         int min_hdr_len;
1273         u8 meta_type, dot11_hdr = 0;
1274         int status = packet->status;
1275         enum htc_endpoint_id ept = packet->endpoint;
1276         bool is_amsdu, prev_ps, ps_state = false;
1277         bool trig_state = false;
1278         struct ath6kl_sta *conn = NULL;
1279         struct sk_buff *skb1 = NULL;
1280         struct ethhdr *datap = NULL;
1281         struct ath6kl_vif *vif;
1282         struct aggr_info_conn *aggr_conn;
1283         u16 seq_no, offset;
1284         u8 tid, if_idx;
1285
1286         ath6kl_dbg(ATH6KL_DBG_WLAN_RX,
1287                    "%s: ar=0x%p eid=%d, skb=0x%p, data=0x%p, len=0x%x status:%d",
1288                    __func__, ar, ept, skb, packet->buf,
1289                    packet->act_len, status);
1290
1291         if (status || !(skb->data + HTC_HDR_LENGTH)) {
1292                 dev_kfree_skb(skb);
1293                 return;
1294         }
1295
1296         skb_put(skb, packet->act_len + HTC_HDR_LENGTH);
1297         skb_pull(skb, HTC_HDR_LENGTH);
1298
1299         if (ept == ar->ctrl_ep) {
1300                 if_idx =
1301                 wmi_cmd_hdr_get_if_idx((struct wmi_cmd_hdr *) skb->data);
1302         } else {
1303                 if_idx =
1304                 wmi_data_hdr_get_if_idx((struct wmi_data_hdr *) skb->data);
1305         }
1306
1307         vif = ath6kl_get_vif_by_index(ar, if_idx);
1308         if (!vif) {
1309                 dev_kfree_skb(skb);
1310                 return;
1311         }
1312
1313         /*
1314          * Take lock to protect buffer counts and adaptive power throughput
1315          * state.
1316          */
1317         spin_lock_bh(&vif->if_lock);
1318
1319         vif->net_stats.rx_packets++;
1320         vif->net_stats.rx_bytes += packet->act_len;
1321
1322         spin_unlock_bh(&vif->if_lock);
1323
1324
1325         ath6kl_dbg_dump(ATH6KL_DBG_RAW_BYTES, __func__, "rx ",
1326                         skb->data, skb->len);
1327
1328         skb->dev = vif->ndev;
1329
1330         if (!test_bit(WMI_ENABLED, &ar->flag)) {
1331                 if (EPPING_ALIGNMENT_PAD > 0)
1332                         skb_pull(skb, EPPING_ALIGNMENT_PAD);
1333                 ath6kl_deliver_frames_to_nw_stack(vif->ndev, skb);
1334                 return;
1335         }
1336
1337         ath6kl_check_wow_status(ar);
1338
1339         if (ept == ar->ctrl_ep) {
1340                 ath6kl_wmi_control_rx(ar->wmi, skb);
1341                 return;
1342         }
1343
1344         min_hdr_len = sizeof(struct ethhdr) + sizeof(struct wmi_data_hdr) +
1345                       sizeof(struct ath6kl_llc_snap_hdr);
1346
1347         dhdr = (struct wmi_data_hdr *) skb->data;
1348
1349         /*
1350          * In the case of AP mode we may receive NULL data frames
1351          * that do not have LLC hdr. They are 16 bytes in size.
1352          * Allow these frames in the AP mode.
1353          */
1354         if (vif->nw_type != AP_NETWORK &&
1355             ((packet->act_len < min_hdr_len) ||
1356              (packet->act_len > WMI_MAX_AMSDU_RX_DATA_FRAME_LENGTH))) {
1357                 ath6kl_info("frame len is too short or too long\n");
1358                 vif->net_stats.rx_errors++;
1359                 vif->net_stats.rx_length_errors++;
1360                 dev_kfree_skb(skb);
1361                 return;
1362         }
1363
1364         /* Get the Power save state of the STA */
1365         if (vif->nw_type == AP_NETWORK) {
1366                 meta_type = wmi_data_hdr_get_meta(dhdr);
1367
1368                 ps_state = !!((dhdr->info >> WMI_DATA_HDR_PS_SHIFT) &
1369                               WMI_DATA_HDR_PS_MASK);
1370
1371                 offset = sizeof(struct wmi_data_hdr);
1372                 trig_state = !!(le16_to_cpu(dhdr->info3) & WMI_DATA_HDR_TRIG);
1373
1374                 switch (meta_type) {
1375                 case 0:
1376                         break;
1377                 case WMI_META_VERSION_1:
1378                         offset += sizeof(struct wmi_rx_meta_v1);
1379                         break;
1380                 case WMI_META_VERSION_2:
1381                         offset += sizeof(struct wmi_rx_meta_v2);
1382                         break;
1383                 default:
1384                         break;
1385                 }
1386
1387                 datap = (struct ethhdr *) (skb->data + offset);
1388                 conn = ath6kl_find_sta(vif, datap->h_source);
1389
1390                 if (!conn) {
1391                         dev_kfree_skb(skb);
1392                         return;
1393                 }
1394
1395                 /*
1396                  * If there is a change in PS state of the STA,
1397                  * take appropriate steps:
1398                  *
1399                  * 1. If Sleep-->Awake, flush the psq for the STA
1400                  *    Clear the PVB for the STA.
1401                  * 2. If Awake-->Sleep, Starting queueing frames
1402                  *    the STA.
1403                  */
1404                 prev_ps = !!(conn->sta_flags & STA_PS_SLEEP);
1405
1406                 if (ps_state)
1407                         conn->sta_flags |= STA_PS_SLEEP;
1408                 else
1409                         conn->sta_flags &= ~STA_PS_SLEEP;
1410
1411                 /* Accept trigger only when the station is in sleep */
1412                 if ((conn->sta_flags & STA_PS_SLEEP) && trig_state)
1413                         ath6kl_uapsd_trigger_frame_rx(vif, conn);
1414
1415                 if (prev_ps ^ !!(conn->sta_flags & STA_PS_SLEEP)) {
1416                         if (!(conn->sta_flags & STA_PS_SLEEP)) {
1417                                 struct sk_buff *skbuff = NULL;
1418                                 bool is_apsdq_empty;
1419
1420                                 spin_lock_bh(&conn->psq_lock);
1421                                 while ((skbuff = skb_dequeue(&conn->psq))) {
1422                                         spin_unlock_bh(&conn->psq_lock);
1423                                         ath6kl_data_tx(skbuff, vif->ndev);
1424                                         spin_lock_bh(&conn->psq_lock);
1425                                 }
1426
1427                                 is_apsdq_empty = skb_queue_empty(&conn->apsdq);
1428                                 while ((skbuff = skb_dequeue(&conn->apsdq))) {
1429                                         spin_unlock_bh(&conn->psq_lock);
1430                                         ath6kl_data_tx(skbuff, vif->ndev);
1431                                         spin_lock_bh(&conn->psq_lock);
1432                                 }
1433                                 spin_unlock_bh(&conn->psq_lock);
1434
1435                                 if (!is_apsdq_empty)
1436                                         ath6kl_wmi_set_apsd_bfrd_traf(
1437                                                         ar->wmi,
1438                                                         vif->fw_vif_idx,
1439                                                         conn->aid, 0, 0);
1440
1441                                 /* Clear the PVB for this STA */
1442                                 ath6kl_wmi_set_pvb_cmd(ar->wmi, vif->fw_vif_idx,
1443                                                        conn->aid, 0);
1444                         }
1445                 }
1446
1447                 /* drop NULL data frames here */
1448                 if ((packet->act_len < min_hdr_len) ||
1449                     (packet->act_len >
1450                      WMI_MAX_AMSDU_RX_DATA_FRAME_LENGTH)) {
1451                         dev_kfree_skb(skb);
1452                         return;
1453                 }
1454         }
1455
1456         is_amsdu = wmi_data_hdr_is_amsdu(dhdr) ? true : false;
1457         tid = wmi_data_hdr_get_up(dhdr);
1458         seq_no = wmi_data_hdr_get_seqno(dhdr);
1459         meta_type = wmi_data_hdr_get_meta(dhdr);
1460         dot11_hdr = wmi_data_hdr_get_dot11(dhdr);
1461         skb_pull(skb, sizeof(struct wmi_data_hdr));
1462
1463         switch (meta_type) {
1464         case WMI_META_VERSION_1:
1465                 skb_pull(skb, sizeof(struct wmi_rx_meta_v1));
1466                 break;
1467         case WMI_META_VERSION_2:
1468                 meta = (struct wmi_rx_meta_v2 *) skb->data;
1469                 if (meta->csum_flags & 0x1) {
1470                         skb->ip_summed = CHECKSUM_COMPLETE;
1471                         skb->csum = (__force __wsum) meta->csum;
1472                 }
1473                 skb_pull(skb, sizeof(struct wmi_rx_meta_v2));
1474                 break;
1475         default:
1476                 break;
1477         }
1478
1479         if (dot11_hdr)
1480                 status = ath6kl_wmi_dot11_hdr_remove(ar->wmi, skb);
1481         else if (!is_amsdu)
1482                 status = ath6kl_wmi_dot3_2_dix(skb);
1483
1484         if (status) {
1485                 /*
1486                  * Drop frames that could not be processed (lack of
1487                  * memory, etc.)
1488                  */
1489                 dev_kfree_skb(skb);
1490                 return;
1491         }
1492
1493         if (!(vif->ndev->flags & IFF_UP)) {
1494                 dev_kfree_skb(skb);
1495                 return;
1496         }
1497
1498         if (vif->nw_type == AP_NETWORK) {
1499                 datap = (struct ethhdr *) skb->data;
1500                 if (is_multicast_ether_addr(datap->h_dest))
1501                         /*
1502                          * Bcast/Mcast frames should be sent to the
1503                          * OS stack as well as on the air.
1504                          */
1505                         skb1 = skb_copy(skb, GFP_ATOMIC);
1506                 else {
1507                         /*
1508                          * Search for a connected STA with dstMac
1509                          * as the Mac address. If found send the
1510                          * frame to it on the air else send the
1511                          * frame up the stack.
1512                          */
1513                         conn = ath6kl_find_sta(vif, datap->h_dest);
1514
1515                         if (conn && ar->intra_bss) {
1516                                 skb1 = skb;
1517                                 skb = NULL;
1518                         } else if (conn && !ar->intra_bss) {
1519                                 dev_kfree_skb(skb);
1520                                 skb = NULL;
1521                         }
1522                 }
1523                 if (skb1)
1524                         ath6kl_data_tx(skb1, vif->ndev);
1525
1526                 if (skb == NULL) {
1527                         /* nothing to deliver up the stack */
1528                         return;
1529                 }
1530         }
1531
1532         datap = (struct ethhdr *) skb->data;
1533
1534         if (is_unicast_ether_addr(datap->h_dest)) {
1535                 if (vif->nw_type == AP_NETWORK) {
1536                         conn = ath6kl_find_sta(vif, datap->h_source);
1537                         if (!conn)
1538                                 return;
1539                         aggr_conn = conn->aggr_conn;
1540                 } else
1541                         aggr_conn = vif->aggr_cntxt->aggr_conn;
1542
1543                 if (aggr_process_recv_frm(aggr_conn, tid, seq_no,
1544                     is_amsdu, skb)) {
1545                         /* aggregation code will handle the skb */
1546                         return;
1547                 }
1548         }
1549
1550         ath6kl_deliver_frames_to_nw_stack(vif->ndev, skb);
1551 }
1552
1553 static void aggr_timeout(unsigned long arg)
1554 {
1555         u8 i, j;
1556         struct aggr_info_conn *aggr_conn = (struct aggr_info_conn *) arg;
1557         struct rxtid *rxtid;
1558         struct rxtid_stats *stats;
1559
1560         for (i = 0; i < NUM_OF_TIDS; i++) {
1561                 rxtid = &aggr_conn->rx_tid[i];
1562                 stats = &aggr_conn->stat[i];
1563
1564                 if (!rxtid->aggr || !rxtid->timer_mon || rxtid->progress)
1565                         continue;
1566
1567                 stats->num_timeouts++;
1568                 ath6kl_dbg(ATH6KL_DBG_AGGR,
1569                            "aggr timeout (st %d end %d)\n",
1570                            rxtid->seq_next,
1571                            ((rxtid->seq_next + rxtid->hold_q_sz-1) &
1572                             ATH6KL_MAX_SEQ_NO));
1573                 aggr_deque_frms(aggr_conn, i, 0, 0);
1574         }
1575
1576         aggr_conn->timer_scheduled = false;
1577
1578         for (i = 0; i < NUM_OF_TIDS; i++) {
1579                 rxtid = &aggr_conn->rx_tid[i];
1580
1581                 if (rxtid->aggr && rxtid->hold_q) {
1582                         for (j = 0; j < rxtid->hold_q_sz; j++) {
1583                                 if (rxtid->hold_q[j].skb) {
1584                                         aggr_conn->timer_scheduled = true;
1585                                         rxtid->timer_mon = true;
1586                                         rxtid->progress = false;
1587                                         break;
1588                                 }
1589                         }
1590
1591                         if (j >= rxtid->hold_q_sz)
1592                                 rxtid->timer_mon = false;
1593                 }
1594         }
1595
1596         if (aggr_conn->timer_scheduled)
1597                 mod_timer(&aggr_conn->timer,
1598                           jiffies + msecs_to_jiffies(AGGR_RX_TIMEOUT));
1599 }
1600
1601 static void aggr_delete_tid_state(struct aggr_info_conn *aggr_conn, u8 tid)
1602 {
1603         struct rxtid *rxtid;
1604         struct rxtid_stats *stats;
1605
1606         if (!aggr_conn || tid >= NUM_OF_TIDS)
1607                 return;
1608
1609         rxtid = &aggr_conn->rx_tid[tid];
1610         stats = &aggr_conn->stat[tid];
1611
1612         if (rxtid->aggr)
1613                 aggr_deque_frms(aggr_conn, tid, 0, 0);
1614
1615         rxtid->aggr = false;
1616         rxtid->progress = false;
1617         rxtid->timer_mon = false;
1618         rxtid->win_sz = 0;
1619         rxtid->seq_next = 0;
1620         rxtid->hold_q_sz = 0;
1621
1622         kfree(rxtid->hold_q);
1623         rxtid->hold_q = NULL;
1624
1625         memset(stats, 0, sizeof(struct rxtid_stats));
1626 }
1627
1628 void aggr_recv_addba_req_evt(struct ath6kl_vif *vif, u8 tid_mux, u16 seq_no,
1629                              u8 win_sz)
1630 {
1631         struct ath6kl_sta *sta;
1632         struct aggr_info_conn *aggr_conn = NULL;
1633         struct rxtid *rxtid;
1634         struct rxtid_stats *stats;
1635         u16 hold_q_size;
1636         u8 tid, aid;
1637
1638         if (vif->nw_type == AP_NETWORK) {
1639                 aid = ath6kl_get_aid(tid_mux);
1640                 sta = ath6kl_find_sta_by_aid(vif->ar, aid);
1641                 if (sta)
1642                         aggr_conn = sta->aggr_conn;
1643         } else
1644                 aggr_conn = vif->aggr_cntxt->aggr_conn;
1645
1646         if (!aggr_conn)
1647                 return;
1648
1649         tid = ath6kl_get_tid(tid_mux);
1650         if (tid >= NUM_OF_TIDS)
1651                 return;
1652
1653         rxtid = &aggr_conn->rx_tid[tid];
1654         stats = &aggr_conn->stat[tid];
1655
1656         if (win_sz < AGGR_WIN_SZ_MIN || win_sz > AGGR_WIN_SZ_MAX)
1657                 ath6kl_dbg(ATH6KL_DBG_WLAN_RX, "%s: win_sz %d, tid %d\n",
1658                            __func__, win_sz, tid);
1659
1660         if (rxtid->aggr)
1661                 aggr_delete_tid_state(aggr_conn, tid);
1662
1663         rxtid->seq_next = seq_no;
1664         hold_q_size = TID_WINDOW_SZ(win_sz) * sizeof(struct skb_hold_q);
1665         rxtid->hold_q = kzalloc(hold_q_size, GFP_KERNEL);
1666         if (!rxtid->hold_q)
1667                 return;
1668
1669         rxtid->win_sz = win_sz;
1670         rxtid->hold_q_sz = TID_WINDOW_SZ(win_sz);
1671         if (!skb_queue_empty(&rxtid->q))
1672                 return;
1673
1674         rxtid->aggr = true;
1675 }
1676
1677 void aggr_conn_init(struct ath6kl_vif *vif, struct aggr_info *aggr_info,
1678                     struct aggr_info_conn *aggr_conn)
1679 {
1680         struct rxtid *rxtid;
1681         u8 i;
1682
1683         aggr_conn->aggr_sz = AGGR_SZ_DEFAULT;
1684         aggr_conn->dev = vif->ndev;
1685         init_timer(&aggr_conn->timer);
1686         aggr_conn->timer.function = aggr_timeout;
1687         aggr_conn->timer.data = (unsigned long) aggr_conn;
1688         aggr_conn->aggr_info = aggr_info;
1689
1690         aggr_conn->timer_scheduled = false;
1691
1692         for (i = 0; i < NUM_OF_TIDS; i++) {
1693                 rxtid = &aggr_conn->rx_tid[i];
1694                 rxtid->aggr = false;
1695                 rxtid->progress = false;
1696                 rxtid->timer_mon = false;
1697                 skb_queue_head_init(&rxtid->q);
1698                 spin_lock_init(&rxtid->lock);
1699         }
1700
1701 }
1702
1703 struct aggr_info *aggr_init(struct ath6kl_vif *vif)
1704 {
1705         struct aggr_info *p_aggr = NULL;
1706
1707         p_aggr = kzalloc(sizeof(struct aggr_info), GFP_KERNEL);
1708         if (!p_aggr) {
1709                 ath6kl_err("failed to alloc memory for aggr_node\n");
1710                 return NULL;
1711         }
1712
1713         p_aggr->aggr_conn = kzalloc(sizeof(struct aggr_info_conn), GFP_KERNEL);
1714         if (!p_aggr->aggr_conn) {
1715                 ath6kl_err("failed to alloc memory for connection specific aggr info\n");
1716                 kfree(p_aggr);
1717                 return NULL;
1718         }
1719
1720         aggr_conn_init(vif, p_aggr, p_aggr->aggr_conn);
1721
1722         skb_queue_head_init(&p_aggr->rx_amsdu_freeq);
1723         ath6kl_alloc_netbufs(&p_aggr->rx_amsdu_freeq, AGGR_NUM_OF_FREE_NETBUFS);
1724
1725         return p_aggr;
1726 }
1727
1728 void aggr_recv_delba_req_evt(struct ath6kl_vif *vif, u8 tid_mux)
1729 {
1730         struct ath6kl_sta *sta;
1731         struct rxtid *rxtid;
1732         struct aggr_info_conn *aggr_conn = NULL;
1733         u8 tid, aid;
1734
1735         if (vif->nw_type == AP_NETWORK) {
1736                 aid = ath6kl_get_aid(tid_mux);
1737                 sta = ath6kl_find_sta_by_aid(vif->ar, aid);
1738                 if (sta)
1739                         aggr_conn = sta->aggr_conn;
1740         } else
1741                 aggr_conn = vif->aggr_cntxt->aggr_conn;
1742
1743         if (!aggr_conn)
1744                 return;
1745
1746         tid = ath6kl_get_tid(tid_mux);
1747         if (tid >= NUM_OF_TIDS)
1748                 return;
1749
1750         rxtid = &aggr_conn->rx_tid[tid];
1751
1752         if (rxtid->aggr)
1753                 aggr_delete_tid_state(aggr_conn, tid);
1754 }
1755
1756 void aggr_reset_state(struct aggr_info_conn *aggr_conn)
1757 {
1758         u8 tid;
1759
1760         if (!aggr_conn)
1761                 return;
1762
1763         if (aggr_conn->timer_scheduled) {
1764                 del_timer(&aggr_conn->timer);
1765                 aggr_conn->timer_scheduled = false;
1766         }
1767
1768         for (tid = 0; tid < NUM_OF_TIDS; tid++)
1769                 aggr_delete_tid_state(aggr_conn, tid);
1770 }
1771
1772 /* clean up our amsdu buffer list */
1773 void ath6kl_cleanup_amsdu_rxbufs(struct ath6kl *ar)
1774 {
1775         struct htc_packet *packet, *tmp_pkt;
1776
1777         spin_lock_bh(&ar->lock);
1778         if (list_empty(&ar->amsdu_rx_buffer_queue)) {
1779                 spin_unlock_bh(&ar->lock);
1780                 return;
1781         }
1782
1783         list_for_each_entry_safe(packet, tmp_pkt, &ar->amsdu_rx_buffer_queue,
1784                                  list) {
1785                 list_del(&packet->list);
1786                 spin_unlock_bh(&ar->lock);
1787                 dev_kfree_skb(packet->pkt_cntxt);
1788                 spin_lock_bh(&ar->lock);
1789         }
1790
1791         spin_unlock_bh(&ar->lock);
1792 }
1793
1794 void aggr_module_destroy(struct aggr_info *aggr_info)
1795 {
1796         if (!aggr_info)
1797                 return;
1798
1799         aggr_reset_state(aggr_info->aggr_conn);
1800         skb_queue_purge(&aggr_info->rx_amsdu_freeq);
1801         kfree(aggr_info->aggr_conn);
1802         kfree(aggr_info);
1803 }