drivers/net/wireless/ath/ar9170/main.c

   1 /*
   2  * Atheros AR9170 driver
   3  *
   4  * mac80211 interaction code
   5  *
   6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright 2009, Christian Lamparter <chunkeey@web.de>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; see the file COPYING.  If not, see
  21  * http://www.gnu.org/licenses/.
  22  *
  23  * This file incorporates work covered by the following copyright and
  24  * permission notice:
  25  *    Copyright (c) 2007-2008 Atheros Communications, Inc.
  26  *
  27  *    Permission to use, copy, modify, and/or distribute this software for any
  28  *    purpose with or without fee is hereby granted, provided that the above
  29  *    copyright notice and this permission notice appear in all copies.
  30  *
  31  *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  32  *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  33  *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  34  *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  35  *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  36  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  37  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  38  */
  39
  40 #include <linux/init.h>
  41 #include <linux/module.h>
  42 #include <linux/etherdevice.h>
  43 #include <net/mac80211.h>
  44 #include "ar9170.h"
  45 #include "hw.h"
  46 #include "cmd.h"
  47
  48 static int modparam_nohwcrypt;
  49 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
  50 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  51
  52 #define RATE(_bitrate, _hw_rate, _txpidx, _flags) {     \
  53         .bitrate        = (_bitrate),                   \
  54         .flags          = (_flags),                     \
  55         .hw_value       = (_hw_rate) | (_txpidx) << 4,  \
  56 }
  57
  58 static struct ieee80211_rate __ar9170_ratetable[] = {
  59         RATE(10, 0, 0, 0),
  60         RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
  61         RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
  62         RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
  63         RATE(60, 0xb, 0, 0),
  64         RATE(90, 0xf, 0, 0),
  65         RATE(120, 0xa, 0, 0),
  66         RATE(180, 0xe, 0, 0),
  67         RATE(240, 0x9, 0, 0),
  68         RATE(360, 0xd, 1, 0),
  69         RATE(480, 0x8, 2, 0),
  70         RATE(540, 0xc, 3, 0),
  71 };
  72 #undef RATE
  73
  74 #define ar9170_g_ratetable      (__ar9170_ratetable + 0)
  75 #define ar9170_g_ratetable_size 12
  76 #define ar9170_a_ratetable      (__ar9170_ratetable + 4)
  77 #define ar9170_a_ratetable_size 8
  78
  79 /*
  80  * NB: The hw_value is used as an index into the ar9170_phy_freq_params
  81  *     array in phy.c so that we don't have to do frequency lookups!
  82  */
  83 #define CHAN(_freq, _idx) {             \
  84         .center_freq    = (_freq),      \
  85         .hw_value       = (_idx),       \
  86         .max_power      = 18, /* XXX */ \
  87 }
  88
  89 static struct ieee80211_channel ar9170_2ghz_chantable[] = {
  90         CHAN(2412,  0),
  91         CHAN(2417,  1),
  92         CHAN(2422,  2),
  93         CHAN(2427,  3),
  94         CHAN(2432,  4),
  95         CHAN(2437,  5),
  96         CHAN(2442,  6),
  97         CHAN(2447,  7),
  98         CHAN(2452,  8),
  99         CHAN(2457,  9),
 100         CHAN(2462, 10),
 101         CHAN(2467, 11),
 102         CHAN(2472, 12),
 103         CHAN(2484, 13),
 104 };
 105
 106 static struct ieee80211_channel ar9170_5ghz_chantable[] = {
 107         CHAN(4920, 14),
 108         CHAN(4940, 15),
 109         CHAN(4960, 16),
 110         CHAN(4980, 17),
 111         CHAN(5040, 18),
 112         CHAN(5060, 19),
 113         CHAN(5080, 20),
 114         CHAN(5180, 21),
 115         CHAN(5200, 22),
 116         CHAN(5220, 23),
 117         CHAN(5240, 24),
 118         CHAN(5260, 25),
 119         CHAN(5280, 26),
 120         CHAN(5300, 27),
 121         CHAN(5320, 28),
 122         CHAN(5500, 29),
 123         CHAN(5520, 30),
 124         CHAN(5540, 31),
 125         CHAN(5560, 32),
 126         CHAN(5580, 33),
 127         CHAN(5600, 34),
 128         CHAN(5620, 35),
 129         CHAN(5640, 36),
 130         CHAN(5660, 37),
 131         CHAN(5680, 38),
 132         CHAN(5700, 39),
 133         CHAN(5745, 40),
 134         CHAN(5765, 41),
 135         CHAN(5785, 42),
 136         CHAN(5805, 43),
 137         CHAN(5825, 44),
 138         CHAN(5170, 45),
 139         CHAN(5190, 46),
 140         CHAN(5210, 47),
 141         CHAN(5230, 48),
 142 };
 143 #undef CHAN
 144
 145 #define AR9170_HT_CAP                                                   \
 146 {                                                                       \
 147         .ht_supported   = true,                                         \
 148         .cap            = IEEE80211_HT_CAP_MAX_AMSDU |                  \
 149                           IEEE80211_HT_CAP_SM_PS |                      \
 150                           IEEE80211_HT_CAP_SUP_WIDTH_20_40 |            \
 151                           IEEE80211_HT_CAP_SGI_40 |                     \
 152                           IEEE80211_HT_CAP_DSSSCCK40 |                  \
 153                           IEEE80211_HT_CAP_SM_PS,                       \
 154         .ampdu_factor   = 3,                                            \
 155         .ampdu_density  = 6,                                            \
 156         .mcs            = {                                             \
 157                 .rx_mask = { 0xFF, 0xFF, 0, 0, 0, 0, 0, 0, 0, 0, },     \
 158         },                                                              \
 159 }
 160
 161 static struct ieee80211_supported_band ar9170_band_2GHz = {
 162         .channels       = ar9170_2ghz_chantable,
 163         .n_channels     = ARRAY_SIZE(ar9170_2ghz_chantable),
 164         .bitrates       = ar9170_g_ratetable,
 165         .n_bitrates     = ar9170_g_ratetable_size,
 166         .ht_cap         = AR9170_HT_CAP,
 167 };
 168
 169 static struct ieee80211_supported_band ar9170_band_5GHz = {
 170         .channels       = ar9170_5ghz_chantable,
 171         .n_channels     = ARRAY_SIZE(ar9170_5ghz_chantable),
 172         .bitrates       = ar9170_a_ratetable,
 173         .n_bitrates     = ar9170_a_ratetable_size,
 174         .ht_cap         = AR9170_HT_CAP,
 175 };
 176
 177 #ifdef AR9170_QUEUE_DEBUG
 178 /*
 179  * In case some wants works with AR9170's crazy tx_status queueing techniques.
 180  * He might need this rather useful probing function.
 181  *
 182  * NOTE: caller must hold the queue's spinlock!
 183  */
 184
 185 static void ar9170_print_txheader(struct ar9170 *ar, struct sk_buff *skb)
 186 {
 187         struct ar9170_tx_control *txc = (void *) skb->data;
 188         struct ieee80211_hdr *hdr = (void *)txc->frame_data;
 189
 190         printk(KERN_DEBUG "%s: => FRAME [skb:%p, queue:%d, DA:[%pM] "
 191                           "mac_control:%04x, phy_control:%08x]\n",
 192                wiphy_name(ar->hw->wiphy), skb, skb_get_queue_mapping(skb),
 193                ieee80211_get_DA(hdr), le16_to_cpu(txc->mac_control),
 194                le32_to_cpu(txc->phy_control));
 195 }
 196
 197 static void ar9170_dump_station_tx_status_queue(struct ar9170 *ar,
 198                                                 struct sk_buff_head *queue)
 199 {
 200         struct sk_buff *skb;
 201         int i = 0;
 202
 203         printk(KERN_DEBUG "---[ cut here ]---\n");
 204         printk(KERN_DEBUG "%s: %d entries in tx_status queue.\n",
 205                wiphy_name(ar->hw->wiphy), skb_queue_len(queue));
 206
 207         skb_queue_walk(queue, skb) {
 208                 struct ar9170_tx_control *txc = (void *) skb->data;
 209                 struct ieee80211_hdr *hdr = (void *)txc->frame_data;
 210
 211                 printk(KERN_DEBUG "index:%d => \n", i);
 212                 ar9170_print_txheader(ar, skb);
 213         }
 214         printk(KERN_DEBUG "---[ end ]---\n");
 215 }
 216 #endif /* AR9170_QUEUE_DEBUG */
 217
 218 void ar9170_handle_tx_status(struct ar9170 *ar, struct sk_buff *skb,
 219                              bool valid_status, u16 tx_status)
 220 {
 221         struct ieee80211_tx_info *txinfo;
 222         unsigned int retries = 0, queue = skb_get_queue_mapping(skb);
 223         unsigned long flags;
 224
 225         spin_lock_irqsave(&ar->tx_stats_lock, flags);
 226         ar->tx_stats[queue].len--;
 227         if (ieee80211_queue_stopped(ar->hw, queue))
 228                 ieee80211_wake_queue(ar->hw, queue);
 229         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
 230
 231         txinfo = IEEE80211_SKB_CB(skb);
 232         ieee80211_tx_info_clear_status(txinfo);
 233
 234         switch (tx_status) {
 235         case AR9170_TX_STATUS_RETRY:
 236                 retries = 2;
 237         case AR9170_TX_STATUS_COMPLETE:
 238                 txinfo->flags |= IEEE80211_TX_STAT_ACK;
 239                 break;
 240
 241         case AR9170_TX_STATUS_FAILED:
 242                 retries = ar->hw->conf.long_frame_max_tx_count;
 243                 break;
 244
 245         default:
 246                 printk(KERN_ERR "%s: invalid tx_status response (%x).\n",
 247                        wiphy_name(ar->hw->wiphy), tx_status);
 248                 break;
 249         }
 250
 251         if (valid_status)
 252                 txinfo->status.rates[0].count = retries + 1;
 253
 254         skb_pull(skb, sizeof(struct ar9170_tx_control));
 255         ieee80211_tx_status_irqsafe(ar->hw, skb);
 256 }
 257
 258 static struct sk_buff *ar9170_find_skb_in_queue(struct ar9170 *ar,
 259                                                 const u8 *mac,
 260                                                 const u32 queue,
 261                                                 struct sk_buff_head *q)
 262 {
 263         unsigned long flags;
 264         struct sk_buff *skb;
 265
 266         spin_lock_irqsave(&q->lock, flags);
 267         skb_queue_walk(q, skb) {
 268                 struct ar9170_tx_control *txc = (void *) skb->data;
 269                 struct ieee80211_hdr *hdr = (void *) txc->frame_data;
 270                 u32 txc_queue = (le32_to_cpu(txc->phy_control) &
 271                                 AR9170_TX_PHY_QOS_MASK) >>
 272                                 AR9170_TX_PHY_QOS_SHIFT;
 273
 274                 if  ((queue != txc_queue) ||
 275                      (compare_ether_addr(ieee80211_get_DA(hdr), mac)))
 276                         continue;
 277
 278                 __skb_unlink(skb, q);
 279                 spin_unlock_irqrestore(&q->lock, flags);
 280                 return skb;
 281         }
 282         spin_unlock_irqrestore(&q->lock, flags);
 283         return NULL;
 284 }
 285
 286 static struct sk_buff *ar9170_find_queued_skb(struct ar9170 *ar, const u8 *mac,
 287                                               const u32 queue)
 288 {
 289         struct ieee80211_sta *sta;
 290         struct sk_buff *skb;
 291
 292         /*
 293          * Unfortunately, the firmware does not tell to which (queued) frame
 294          * this transmission status report belongs to.
 295          *
 296          * So we have to make risky guesses - with the scarce information
 297          * the firmware provided (-> destination MAC, and phy_control) -
 298          * and hope that we picked the right one...
 299          */
 300         rcu_read_lock();
 301         sta = ieee80211_find_sta(ar->hw, mac);
 302
 303         if (likely(sta)) {
 304                 struct ar9170_sta_info *sta_priv = (void *) sta->drv_priv;
 305                 skb = skb_dequeue(&sta_priv->tx_status[queue]);
 306                 rcu_read_unlock();
 307                 if (likely(skb))
 308                         return skb;
 309         } else
 310                 rcu_read_unlock();
 311
 312         /* scan the waste queue for candidates */
 313         skb = ar9170_find_skb_in_queue(ar, mac, queue,
 314                                        &ar->global_tx_status_waste);
 315         if (!skb) {
 316                 /* so it still _must_ be in the global list. */
 317                 skb = ar9170_find_skb_in_queue(ar, mac, queue,
 318                                                &ar->global_tx_status);
 319         }
 320
 321 #ifdef AR9170_QUEUE_DEBUG
 322         if (unlikely((!skb) && net_ratelimit())) {
 323                 printk(KERN_ERR "%s: ESS:[%pM] does not have any "
 324                                 "outstanding frames in this queue (%d).\n",
 325                                 wiphy_name(ar->hw->wiphy), mac, queue);
 326         }
 327 #endif /* AR9170_QUEUE_DEBUG */
 328         return skb;
 329 }
 330
 331 /*
 332  * This worker tries to keep the global tx_status queue empty.
 333  * So we can guarantee that incoming tx_status reports for
 334  * unregistered stations are always synced with the actual
 335  * frame - which we think - belongs to.
 336  */
 337
 338 static void ar9170_tx_status_janitor(struct work_struct *work)
 339 {
 340         struct ar9170 *ar = container_of(work, struct ar9170,
 341                                          tx_status_janitor.work);
 342         struct sk_buff *skb;
 343
 344         if (unlikely(!IS_STARTED(ar)))
 345                 return ;
 346
 347         mutex_lock(&ar->mutex);
 348         /* recycle the garbage back to mac80211... one by one. */
 349         while ((skb = skb_dequeue(&ar->global_tx_status_waste))) {
 350 #ifdef AR9170_QUEUE_DEBUG
 351                 printk(KERN_DEBUG "%s: dispose queued frame =>\n",
 352                        wiphy_name(ar->hw->wiphy));
 353                 ar9170_print_txheader(ar, skb);
 354 #endif /* AR9170_QUEUE_DEBUG */
 355                 ar9170_handle_tx_status(ar, skb, false,
 356                                         AR9170_TX_STATUS_FAILED);
 357         }
 358
 359         while ((skb = skb_dequeue(&ar->global_tx_status))) {
 360 #ifdef AR9170_QUEUE_DEBUG
 361                 printk(KERN_DEBUG "%s: moving frame into waste queue =>\n",
 362                        wiphy_name(ar->hw->wiphy));
 363
 364                 ar9170_print_txheader(ar, skb);
 365 #endif /* AR9170_QUEUE_DEBUG */
 366                 skb_queue_tail(&ar->global_tx_status_waste, skb);
 367         }
 368
 369         /* recall the janitor in 100ms - if there's garbage in the can. */
 370         if (skb_queue_len(&ar->global_tx_status_waste) > 0)
 371                 queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
 372                                    msecs_to_jiffies(100));
 373
 374         mutex_unlock(&ar->mutex);
 375 }
 376
 377 static void ar9170_handle_command_response(struct ar9170 *ar,
 378                                            void *buf, u32 len)
 379 {
 380         struct ar9170_cmd_response *cmd = (void *) buf;
 381
 382         if ((cmd->type & 0xc0) != 0xc0) {
 383                 ar->callback_cmd(ar, len, buf);
 384                 return;
 385         }
 386
 387         /* hardware event handlers */
 388         switch (cmd->type) {
 389         case 0xc1: {
 390                 /*
 391                  * TX status notification:
 392                  * bytes: 0c c1 XX YY M1 M2 M3 M4 M5 M6 R4 R3 R2 R1 S2 S1
 393                  *
 394                  * XX always 81
 395                  * YY always 00
 396                  * M1-M6 is the MAC address
 397                  * R1-R4 is the transmit rate
 398                  * S1-S2 is the transmit status
 399                  */
 400
 401                 struct sk_buff *skb;
 402                 u32 queue = (le32_to_cpu(cmd->tx_status.rate) &
 403                             AR9170_TX_PHY_QOS_MASK) >> AR9170_TX_PHY_QOS_SHIFT;
 404
 405                 skb = ar9170_find_queued_skb(ar, cmd->tx_status.dst, queue);
 406                 if (unlikely(!skb))
 407                         return ;
 408
 409                 ar9170_handle_tx_status(ar, skb, true,
 410                                         le16_to_cpu(cmd->tx_status.status));
 411                 break;
 412                 }
 413
 414         case 0xc0:
 415                 /*
 416                  * pre-TBTT event
 417                  */
 418                 if (ar->vif && ar->vif->type == NL80211_IFTYPE_AP)
 419                         queue_work(ar->hw->workqueue, &ar->beacon_work);
 420                 break;
 421
 422         case 0xc2:
 423                 /*
 424                  * (IBSS) beacon send notification
 425                  * bytes: 04 c2 XX YY B4 B3 B2 B1
 426                  *
 427                  * XX always 80
 428                  * YY always 00
 429                  * B1-B4 "should" be the number of send out beacons.
 430                  */
 431                 break;
 432
 433         case 0xc3:
 434                 /* End of Atim Window */
 435                 break;
 436
 437         case 0xc4:
 438         case 0xc5:
 439                 /* BlockACK events */
 440                 break;
 441
 442         case 0xc6:
 443                 /* Watchdog Interrupt */
 444                 break;
 445
 446         case 0xc9:
 447                 /* retransmission issue / SIFS/EIFS collision ?! */
 448                 break;
 449
 450         default:
 451                 printk(KERN_INFO "received unhandled event %x\n", cmd->type);
 452                 print_hex_dump_bytes("dump:", DUMP_PREFIX_NONE, buf, len);
 453                 break;
 454         }
 455 }
 456
 457 static void ar9170_rx_reset_rx_mpdu(struct ar9170 *ar)
 458 {
 459         memset(&ar->rx_mpdu.plcp, 0, sizeof(struct ar9170_rx_head));
 460         ar->rx_mpdu.has_plcp = false;
 461 }
 462
 463 static int ar9170_nag_limiter(struct ar9170 *ar)
 464 {
 465         bool print_message;
 466
 467         /*
 468          * we expect all sorts of errors in promiscuous mode.
 469          * don't bother with it, it's OK!
 470          */
 471         if (ar->sniffer_enabled)
 472                 return false;
 473
 474         /*
 475          * only go for frequent errors! The hardware tends to
 476          * do some stupid thing once in a while under load, in
 477          * noisy environments or just for fun!
 478          */
 479         if (time_before(jiffies, ar->bad_hw_nagger) && net_ratelimit())
 480                 print_message = true;
 481         else
 482                 print_message = false;
 483
 484         /* reset threshold for "once in a while" */
 485         ar->bad_hw_nagger = jiffies + HZ / 4;
 486         return print_message;
 487 }
 488
 489 static int ar9170_rx_mac_status(struct ar9170 *ar,
 490                                 struct ar9170_rx_head *head,
 491                                 struct ar9170_rx_macstatus *mac,
 492                                 struct ieee80211_rx_status *status)
 493 {
 494         u8 error, decrypt;
 495
 496         BUILD_BUG_ON(sizeof(struct ar9170_rx_head) != 12);
 497         BUILD_BUG_ON(sizeof(struct ar9170_rx_macstatus) != 4);
 498
 499         error = mac->error;
 500         if (error & AR9170_RX_ERROR_MMIC) {
 501                 status->flag |= RX_FLAG_MMIC_ERROR;
 502                 error &= ~AR9170_RX_ERROR_MMIC;
 503         }
 504
 505         if (error & AR9170_RX_ERROR_PLCP) {
 506                 status->flag |= RX_FLAG_FAILED_PLCP_CRC;
 507                 error &= ~AR9170_RX_ERROR_PLCP;
 508
 509                 if (!(ar->filter_state & FIF_PLCPFAIL))
 510                         return -EINVAL;
 511         }
 512
 513         if (error & AR9170_RX_ERROR_FCS) {
 514                 status->flag |= RX_FLAG_FAILED_FCS_CRC;
 515                 error &= ~AR9170_RX_ERROR_FCS;
 516
 517                 if (!(ar->filter_state & FIF_FCSFAIL))
 518                         return -EINVAL;
 519         }
 520
 521         decrypt = ar9170_get_decrypt_type(mac);
 522         if (!(decrypt & AR9170_RX_ENC_SOFTWARE) &&
 523             decrypt != AR9170_ENC_ALG_NONE)
 524                 status->flag |= RX_FLAG_DECRYPTED;
 525
 526         /* ignore wrong RA errors */
 527         error &= ~AR9170_RX_ERROR_WRONG_RA;
 528
 529         if (error & AR9170_RX_ERROR_DECRYPT) {
 530                 error &= ~AR9170_RX_ERROR_DECRYPT;
 531                 /*
 532                  * Rx decryption is done in place,
 533                  * the original data is lost anyway.
 534                  */
 535
 536                 return -EINVAL;
 537         }
 538
 539         /* drop any other error frames */
 540         if (unlikely(error)) {
 541                 /* TODO: update netdevice's RX dropped/errors statistics */
 542
 543                 if (ar9170_nag_limiter(ar))
 544                         printk(KERN_DEBUG "%s: received frame with "
 545                                "suspicious error code (%#x).\n",
 546                                wiphy_name(ar->hw->wiphy), error);
 547
 548                 return -EINVAL;
 549         }
 550
 551         status->band = ar->channel->band;
 552         status->freq = ar->channel->center_freq;
 553
 554         switch (mac->status & AR9170_RX_STATUS_MODULATION_MASK) {
 555         case AR9170_RX_STATUS_MODULATION_CCK:
 556                 if (mac->status & AR9170_RX_STATUS_SHORT_PREAMBLE)
 557                         status->flag |= RX_FLAG_SHORTPRE;
 558                 switch (head->plcp[0]) {
 559                 case 0x0a:
 560                         status->rate_idx = 0;
 561                         break;
 562                 case 0x14:
 563                         status->rate_idx = 1;
 564                         break;
 565                 case 0x37:
 566                         status->rate_idx = 2;
 567                         break;
 568                 case 0x6e:
 569                         status->rate_idx = 3;
 570                         break;
 571                 default:
 572                         if (ar9170_nag_limiter(ar))
 573                                 printk(KERN_ERR "%s: invalid plcp cck rate "
 574                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 575                                        head->plcp[0]);
 576                         return -EINVAL;
 577                 }
 578                 break;
 579
 580         case AR9170_RX_STATUS_MODULATION_OFDM:
 581                 switch (head->plcp[0] & 0xf) {
 582                 case 0xb:
 583                         status->rate_idx = 0;
 584                         break;
 585                 case 0xf:
 586                         status->rate_idx = 1;
 587                         break;
 588                 case 0xa:
 589                         status->rate_idx = 2;
 590                         break;
 591                 case 0xe:
 592                         status->rate_idx = 3;
 593                         break;
 594                 case 0x9:
 595                         status->rate_idx = 4;
 596                         break;
 597                 case 0xd:
 598                         status->rate_idx = 5;
 599                         break;
 600                 case 0x8:
 601                         status->rate_idx = 6;
 602                         break;
 603                 case 0xc:
 604                         status->rate_idx = 7;
 605                         break;
 606                 default:
 607                         if (ar9170_nag_limiter(ar))
 608                                 printk(KERN_ERR "%s: invalid plcp ofdm rate "
 609                                        "(%x).\n", wiphy_name(ar->hw->wiphy),
 610                                        head->plcp[0]);
 611                         return -EINVAL;
 612                 }
 613                 if (status->band == IEEE80211_BAND_2GHZ)
 614                         status->rate_idx += 4;
 615                 break;
 616
 617         case AR9170_RX_STATUS_MODULATION_HT:
 618                 if (head->plcp[3] & 0x80)
 619                         status->flag |= RX_FLAG_40MHZ;
 620                 if (head->plcp[6] & 0x80)
 621                         status->flag |= RX_FLAG_SHORT_GI;
 622
 623                 status->rate_idx = clamp(0, 75, head->plcp[6] & 0x7f);
 624                 status->flag |= RX_FLAG_HT;
 625                 break;
 626
 627         case AR9170_RX_STATUS_MODULATION_DUPOFDM:
 628                 /* XXX */
 629                 if (ar9170_nag_limiter(ar))
 630                         printk(KERN_ERR "%s: invalid modulation\n",
 631                                wiphy_name(ar->hw->wiphy));
 632                 return -EINVAL;
 633         }
 634
 635         return 0;
 636 }
 637
 638 static void ar9170_rx_phy_status(struct ar9170 *ar,
 639                                  struct ar9170_rx_phystatus *phy,
 640                                  struct ieee80211_rx_status *status)
 641 {
 642         int i;
 643
 644         BUILD_BUG_ON(sizeof(struct ar9170_rx_phystatus) != 20);
 645
 646         for (i = 0; i < 3; i++)
 647                 if (phy->rssi[i] != 0x80)
 648                         status->antenna |= BIT(i);
 649
 650         /* post-process RSSI */
 651         for (i = 0; i < 7; i++)
 652                 if (phy->rssi[i] & 0x80)
 653                         phy->rssi[i] = ((phy->rssi[i] & 0x7f) + 1) & 0x7f;
 654
 655         /* TODO: we could do something with phy_errors */
 656         status->signal = ar->noise[0] + phy->rssi_combined;
 657         status->noise = ar->noise[0];
 658 }
 659
 660 static struct sk_buff *ar9170_rx_copy_data(u8 *buf, int len)
 661 {
 662         struct sk_buff *skb;
 663         int reserved = 0;
 664         struct ieee80211_hdr *hdr = (void *) buf;
 665
 666         if (ieee80211_is_data_qos(hdr->frame_control)) {
 667                 u8 *qc = ieee80211_get_qos_ctl(hdr);
 668                 reserved += NET_IP_ALIGN;
 669
 670                 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
 671                         reserved += NET_IP_ALIGN;
 672         }
 673
 674         if (ieee80211_has_a4(hdr->frame_control))
 675                 reserved += NET_IP_ALIGN;
 676
 677         reserved = 32 + (reserved & NET_IP_ALIGN);
 678
 679         skb = dev_alloc_skb(len + reserved);
 680         if (likely(skb)) {
 681                 skb_reserve(skb, reserved);
 682                 memcpy(skb_put(skb, len), buf, len);
 683         }
 684
 685         return skb;
 686 }
 687
 688 /*
 689  * If the frame alignment is right (or the kernel has
 690  * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), and there
 691  * is only a single MPDU in the USB frame, then we could
 692  * submit to mac80211 the SKB directly. However, since
 693  * there may be multiple packets in one SKB in stream
 694  * mode, and we need to observe the proper ordering,
 695  * this is non-trivial.
 696  */
 697
 698 static void ar9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
 699 {
 700         struct ar9170_rx_head *head;
 701         struct ar9170_rx_macstatus *mac;
 702         struct ar9170_rx_phystatus *phy = NULL;
 703         struct ieee80211_rx_status status;
 704         struct sk_buff *skb;
 705         int mpdu_len;
 706
 707         if (unlikely(!IS_STARTED(ar) || len < (sizeof(*mac))))
 708                 return ;
 709
 710         /* Received MPDU */
 711         mpdu_len = len - sizeof(*mac);
 712
 713         mac = (void *)(buf + mpdu_len);
 714         if (unlikely(mac->error & AR9170_RX_ERROR_FATAL)) {
 715                 /* this frame is too damaged and can't be used - drop it */
 716
 717                 return ;
 718         }
 719
 720         switch (mac->status & AR9170_RX_STATUS_MPDU_MASK) {
 721         case AR9170_RX_STATUS_MPDU_FIRST:
 722                 /* first mpdu packet has the plcp header */
 723                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) {
 724                         head = (void *) buf;
 725                         memcpy(&ar->rx_mpdu.plcp, (void *) buf,
 726                                sizeof(struct ar9170_rx_head));
 727
 728                         mpdu_len -= sizeof(struct ar9170_rx_head);
 729                         buf += sizeof(struct ar9170_rx_head);
 730                         ar->rx_mpdu.has_plcp = true;
 731                 } else {
 732                         if (ar9170_nag_limiter(ar))
 733                                 printk(KERN_ERR "%s: plcp info is clipped.\n",
 734                                        wiphy_name(ar->hw->wiphy));
 735                         return ;
 736                 }
 737                 break;
 738
 739         case AR9170_RX_STATUS_MPDU_LAST:
 740                 /* last mpdu has a extra tail with phy status information */
 741
 742                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) {
 743                         mpdu_len -= sizeof(struct ar9170_rx_phystatus);
 744                         phy = (void *)(buf + mpdu_len);
 745                 } else {
 746                         if (ar9170_nag_limiter(ar))
 747                                 printk(KERN_ERR "%s: frame tail is clipped.\n",
 748                                        wiphy_name(ar->hw->wiphy));
 749                         return ;
 750                 }
 751
 752         case AR9170_RX_STATUS_MPDU_MIDDLE:
 753                 /* middle mpdus are just data */
 754                 if (unlikely(!ar->rx_mpdu.has_plcp)) {
 755                         if (!ar9170_nag_limiter(ar))
 756                                 return ;
 757
 758                         printk(KERN_ERR "%s: rx stream did not start "
 759                                         "with a first_mpdu frame tag.\n",
 760                                wiphy_name(ar->hw->wiphy));
 761
 762                         return ;
 763                 }
 764
 765                 head = &ar->rx_mpdu.plcp;
 766                 break;
 767
 768         case AR9170_RX_STATUS_MPDU_SINGLE:
 769                 /* single mpdu - has plcp (head) and phy status (tail) */
 770                 head = (void *) buf;
 771
 772                 mpdu_len -= sizeof(struct ar9170_rx_head);
 773                 mpdu_len -= sizeof(struct ar9170_rx_phystatus);
 774
 775                 buf += sizeof(struct ar9170_rx_head);
 776                 phy = (void *)(buf + mpdu_len);
 777                 break;
 778
 779         default:
 780                 BUG_ON(1);
 781                 break;
 782         }
 783
 784         if (unlikely(mpdu_len < FCS_LEN))
 785                 return ;
 786
 787         memset(&status, 0, sizeof(status));
 788         if (unlikely(ar9170_rx_mac_status(ar, head, mac, &status)))
 789                 return ;
 790
 791         if (phy)
 792                 ar9170_rx_phy_status(ar, phy, &status);
 793
 794         skb = ar9170_rx_copy_data(buf, mpdu_len);
 795         if (likely(skb))
 796                 ieee80211_rx_irqsafe(ar->hw, skb, &status);
 797 }
 798
 799 void ar9170_rx(struct ar9170 *ar, struct sk_buff *skb)
 800 {
 801         unsigned int i, tlen, resplen, wlen = 0, clen = 0;
 802         u8 *tbuf, *respbuf;
 803
 804         tbuf = skb->data;
 805         tlen = skb->len;
 806
 807         while (tlen >= 4) {
 808                 clen = tbuf[1] << 8 | tbuf[0];
 809                 wlen = ALIGN(clen, 4);
 810
 811                 /* check if this is stream has a valid tag.*/
 812                 if (tbuf[2] != 0 || tbuf[3] != 0x4e) {
 813                         /*
 814                          * TODO: handle the highly unlikely event that the
 815                          * corrupted stream has the TAG at the right position.
 816                          */
 817
 818                         /* check if the frame can be repaired. */
 819                         if (!ar->rx_failover_missing) {
 820                                 /* this is no "short read". */
 821                                 if (ar9170_nag_limiter(ar)) {
 822                                         printk(KERN_ERR "%s: missing tag!\n",
 823                                                wiphy_name(ar->hw->wiphy));
 824                                         goto err_telluser;
 825                                 } else
 826                                         goto err_silent;
 827                         }
 828
 829                         if (ar->rx_failover_missing > tlen) {
 830                                 if (ar9170_nag_limiter(ar)) {
 831                                         printk(KERN_ERR "%s: possible multi "
 832                                                "stream corruption!\n",
 833                                                wiphy_name(ar->hw->wiphy));
 834                                         goto err_telluser;
 835                                 } else
 836                                         goto err_silent;
 837                         }
 838
 839                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
 840                         ar->rx_failover_missing -= tlen;
 841
 842                         if (ar->rx_failover_missing <= 0) {
 843                                 /*
 844                                  * nested ar9170_rx call!
 845                                  * termination is guranteed, even when the
 846                                  * combined frame also have a element with
 847                                  * a bad tag.
 848                                  */
 849
 850                                 ar->rx_failover_missing = 0;
 851                                 ar9170_rx(ar, ar->rx_failover);
 852
 853                                 skb_reset_tail_pointer(ar->rx_failover);
 854                                 skb_trim(ar->rx_failover, 0);
 855                         }
 856
 857                         return ;
 858                 }
 859
 860                 /* check if stream is clipped */
 861                 if (wlen > tlen - 4) {
 862                         if (ar->rx_failover_missing) {
 863                                 /* TODO: handle double stream corruption. */
 864                                 if (ar9170_nag_limiter(ar)) {
 865                                         printk(KERN_ERR "%s: double rx stream "
 866                                                "corruption!\n",
 867                                                 wiphy_name(ar->hw->wiphy));
 868                                         goto err_telluser;
 869                                 } else
 870                                         goto err_silent;
 871                         }
 872
 873                         /*
 874                          * save incomplete data set.
 875                          * the firmware will resend the missing bits when
 876                          * the rx - descriptor comes round again.
 877                          */
 878
 879                         memcpy(skb_put(ar->rx_failover, tlen), tbuf, tlen);
 880                         ar->rx_failover_missing = clen - tlen;
 881                         return ;
 882                 }
 883                 resplen = clen;
 884                 respbuf = tbuf + 4;
 885                 tbuf += wlen + 4;
 886                 tlen -= wlen + 4;
 887
 888                 i = 0;
 889
 890                 /* weird thing, but this is the same in the original driver */
 891                 while (resplen > 2 && i < 12 &&
 892                        respbuf[0] == 0xff && respbuf[1] == 0xff) {
 893                         i += 2;
 894                         resplen -= 2;
 895                         respbuf += 2;
 896                 }
 897
 898                 if (resplen < 4)
 899                         continue;
 900
 901                 /* found the 6 * 0xffff marker? */
 902                 if (i == 12)
 903                         ar9170_handle_command_response(ar, respbuf, resplen);
 904                 else
 905                         ar9170_handle_mpdu(ar, respbuf, clen);
 906         }
 907
 908         if (tlen) {
 909                 if (net_ratelimit())
 910                         printk(KERN_ERR "%s: %d bytes of unprocessed "
 911                                         "data left in rx stream!\n",
 912                                wiphy_name(ar->hw->wiphy), tlen);
 913
 914                 goto err_telluser;
 915         }
 916
 917         return ;
 918
 919 err_telluser:
 920         printk(KERN_ERR "%s: damaged RX stream data [want:%d, "
 921                         "data:%d, rx:%d, pending:%d ]\n",
 922                wiphy_name(ar->hw->wiphy), clen, wlen, tlen,
 923                ar->rx_failover_missing);
 924
 925         if (ar->rx_failover_missing)
 926                 print_hex_dump_bytes("rxbuf:", DUMP_PREFIX_OFFSET,
 927                                      ar->rx_failover->data,
 928                                      ar->rx_failover->len);
 929
 930         print_hex_dump_bytes("stream:", DUMP_PREFIX_OFFSET,
 931                              skb->data, skb->len);
 932
 933         printk(KERN_ERR "%s: please check your hardware and cables, if "
 934                         "you see this message frequently.\n",
 935                wiphy_name(ar->hw->wiphy));
 936
 937 err_silent:
 938         if (ar->rx_failover_missing) {
 939                 skb_reset_tail_pointer(ar->rx_failover);
 940                 skb_trim(ar->rx_failover, 0);
 941                 ar->rx_failover_missing = 0;
 942         }
 943 }
 944
 945 #define AR9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)            \
 946 do {                                                                    \
 947         queue.aifs = ai_fs;                                             \
 948         queue.cw_min = cwmin;                                           \
 949         queue.cw_max = cwmax;                                           \
 950         queue.txop = _txop;                                             \
 951 } while (0)
 952
 953 static int ar9170_op_start(struct ieee80211_hw *hw)
 954 {
 955         struct ar9170 *ar = hw->priv;
 956         int err, i;
 957
 958         mutex_lock(&ar->mutex);
 959
 960         /* reinitialize queues statistics */
 961         memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
 962         for (i = 0; i < ARRAY_SIZE(ar->tx_stats); i++)
 963                 ar->tx_stats[i].limit = 8;
 964
 965         /* reset QoS defaults */
 966         AR9170_FILL_QUEUE(ar->edcf[0], 3, 15, 1023,  0); /* BEST EFFORT*/
 967         AR9170_FILL_QUEUE(ar->edcf[1], 7, 15, 1023,  0); /* BACKGROUND */
 968         AR9170_FILL_QUEUE(ar->edcf[2], 2, 7,    15, 94); /* VIDEO */
 969         AR9170_FILL_QUEUE(ar->edcf[3], 2, 3,     7, 47); /* VOICE */
 970         AR9170_FILL_QUEUE(ar->edcf[4], 2, 3,     7,  0); /* SPECIAL */
 971
 972         ar->bad_hw_nagger = jiffies;
 973
 974         err = ar->open(ar);
 975         if (err)
 976                 goto out;
 977
 978         err = ar9170_init_mac(ar);
 979         if (err)
 980                 goto out;
 981
 982         err = ar9170_set_qos(ar);
 983         if (err)
 984                 goto out;
 985
 986         err = ar9170_init_phy(ar, IEEE80211_BAND_2GHZ);
 987         if (err)
 988                 goto out;
 989
 990         err = ar9170_init_rf(ar);
 991         if (err)
 992                 goto out;
 993
 994         /* start DMA */
 995         err = ar9170_write_reg(ar, 0x1c3d30, 0x100);
 996         if (err)
 997                 goto out;
 998
 999         ar->state = AR9170_STARTED;
1000
1001 out:
1002         mutex_unlock(&ar->mutex);
1003         return err;
1004 }
1005
1006 static void ar9170_op_stop(struct ieee80211_hw *hw)
1007 {
1008         struct ar9170 *ar = hw->priv;
1009
1010         if (IS_STARTED(ar))
1011                 ar->state = AR9170_IDLE;
1012
1013         flush_workqueue(ar->hw->workqueue);
1014
1015         mutex_lock(&ar->mutex);
1016         cancel_delayed_work_sync(&ar->tx_status_janitor);
1017         cancel_work_sync(&ar->filter_config_work);
1018         cancel_work_sync(&ar->beacon_work);
1019         skb_queue_purge(&ar->global_tx_status_waste);
1020         skb_queue_purge(&ar->global_tx_status);
1021
1022         if (IS_ACCEPTING_CMD(ar)) {
1023                 ar9170_set_leds_state(ar, 0);
1024
1025                 /* stop DMA */
1026                 ar9170_write_reg(ar, 0x1c3d30, 0);
1027                 ar->stop(ar);
1028         }
1029
1030         mutex_unlock(&ar->mutex);
1031 }
1032
1033 int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
1034 {
1035         struct ar9170 *ar = hw->priv;
1036         struct ieee80211_hdr *hdr;
1037         struct ar9170_tx_control *txc;
1038         struct ieee80211_tx_info *info;
1039         struct ieee80211_rate *rate = NULL;
1040         struct ieee80211_tx_rate *txrate;
1041         unsigned int queue = skb_get_queue_mapping(skb);
1042         unsigned long flags = 0;
1043         struct ar9170_sta_info *sta_info = NULL;
1044         u32 power, chains;
1045         u16 keytype = 0;
1046         u16 len, icv = 0;
1047         int err;
1048         bool tx_status;
1049
1050         if (unlikely(!IS_STARTED(ar)))
1051                 goto err_free;
1052
1053         hdr = (void *)skb->data;
1054         info = IEEE80211_SKB_CB(skb);
1055         len = skb->len;
1056
1057         spin_lock_irqsave(&ar->tx_stats_lock, flags);
1058         if (ar->tx_stats[queue].limit < ar->tx_stats[queue].len) {
1059                 spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1060                 return NETDEV_TX_OK;
1061         }
1062
1063         ar->tx_stats[queue].len++;
1064         ar->tx_stats[queue].count++;
1065         if (ar->tx_stats[queue].limit == ar->tx_stats[queue].len)
1066                 ieee80211_stop_queue(hw, queue);
1067
1068         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1069
1070         txc = (void *)skb_push(skb, sizeof(*txc));
1071
1072         tx_status = (((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) != 0) ||
1073                     ((info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) != 0));
1074
1075         if (info->control.hw_key) {
1076                 icv = info->control.hw_key->icv_len;
1077
1078                 switch (info->control.hw_key->alg) {
1079                 case ALG_WEP:
1080                         keytype = AR9170_TX_MAC_ENCR_RC4;
1081                         break;
1082                 case ALG_TKIP:
1083                         keytype = AR9170_TX_MAC_ENCR_RC4;
1084                         break;
1085                 case ALG_CCMP:
1086                         keytype = AR9170_TX_MAC_ENCR_AES;
1087                         break;
1088                 default:
1089                         WARN_ON(1);
1090                         goto err_dequeue;
1091                 }
1092         }
1093
1094         /* Length */
1095         txc->length = cpu_to_le16(len + icv + 4);
1096
1097         txc->mac_control = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
1098                                        AR9170_TX_MAC_BACKOFF);
1099         txc->mac_control |= cpu_to_le16(ar9170_qos_hwmap[queue] <<
1100                                         AR9170_TX_MAC_QOS_SHIFT);
1101         txc->mac_control |= cpu_to_le16(keytype);
1102         txc->phy_control = cpu_to_le32(0);
1103
1104         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1105                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_NO_ACK);
1106
1107         if (info->flags & IEEE80211_TX_CTL_AMPDU)
1108                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_AGGR);
1109
1110         txrate = &info->control.rates[0];
1111
1112         if (txrate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1113                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
1114         else if (txrate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1115                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
1116
1117         if (txrate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1118                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_GREENFIELD);
1119
1120         if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1121                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_PREAMBLE);
1122
1123         if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1124                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ);
1125         /* this works because 40 MHz is 2 and dup is 3 */
1126         if (txrate->flags & IEEE80211_TX_RC_DUP_DATA)
1127                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_BW_40MHZ_DUP);
1128
1129         if (txrate->flags & IEEE80211_TX_RC_SHORT_GI)
1130                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_SHORT_GI);
1131
1132         if (txrate->flags & IEEE80211_TX_RC_MCS) {
1133                 u32 r = txrate->idx;
1134                 u8 *txpower;
1135
1136                 r <<= AR9170_TX_PHY_MCS_SHIFT;
1137                 if (WARN_ON(r & ~AR9170_TX_PHY_MCS_MASK))
1138                         goto err_dequeue;
1139                 txc->phy_control |= cpu_to_le32(r & AR9170_TX_PHY_MCS_MASK);
1140                 txc->phy_control |= cpu_to_le32(AR9170_TX_PHY_MOD_HT);
1141
1142                 if (txrate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
1143                         if (info->band == IEEE80211_BAND_5GHZ)
1144                                 txpower = ar->power_5G_ht40;
1145                         else
1146                                 txpower = ar->power_2G_ht40;
1147                 } else {
1148                         if (info->band == IEEE80211_BAND_5GHZ)
1149                                 txpower = ar->power_5G_ht20;
1150                         else
1151                                 txpower = ar->power_2G_ht20;
1152                 }
1153
1154                 power = txpower[(txrate->idx) & 7];
1155         } else {
1156                 u8 *txpower;
1157                 u32 mod;
1158                 u32 phyrate;
1159                 u8 idx = txrate->idx;
1160
1161                 if (info->band != IEEE80211_BAND_2GHZ) {
1162                         idx += 4;
1163                         txpower = ar->power_5G_leg;
1164                         mod = AR9170_TX_PHY_MOD_OFDM;
1165                 } else {
1166                         if (idx < 4) {
1167                                 txpower = ar->power_2G_cck;
1168                                 mod = AR9170_TX_PHY_MOD_CCK;
1169                         } else {
1170                                 mod = AR9170_TX_PHY_MOD_OFDM;
1171                                 txpower = ar->power_2G_ofdm;
1172                         }
1173                 }
1174
1175                 rate = &__ar9170_ratetable[idx];
1176
1177                 phyrate = rate->hw_value & 0xF;
1178                 power = txpower[(rate->hw_value & 0x30) >> 4];
1179                 phyrate <<= AR9170_TX_PHY_MCS_SHIFT;
1180
1181                 txc->phy_control |= cpu_to_le32(mod);
1182                 txc->phy_control |= cpu_to_le32(phyrate);
1183         }
1184
1185         power <<= AR9170_TX_PHY_TX_PWR_SHIFT;
1186         power &= AR9170_TX_PHY_TX_PWR_MASK;
1187         txc->phy_control |= cpu_to_le32(power);
1188
1189         /* set TX chains */
1190         if (ar->eeprom.tx_mask == 1) {
1191                 chains = AR9170_TX_PHY_TXCHAIN_1;
1192         } else {
1193                 chains = AR9170_TX_PHY_TXCHAIN_2;
1194
1195                 /* >= 36M legacy OFDM - use only one chain */
1196                 if (rate && rate->bitrate >= 360)
1197                         chains = AR9170_TX_PHY_TXCHAIN_1;
1198         }
1199         txc->phy_control |= cpu_to_le32(chains << AR9170_TX_PHY_TXCHAIN_SHIFT);
1200
1201         if (tx_status) {
1202                 txc->mac_control |= cpu_to_le16(AR9170_TX_MAC_RATE_PROBE);
1203                 /*
1204                  * WARNING:
1205                  * Putting the QoS queue bits into an unexplored territory is
1206                  * certainly not elegant.
1207                  *
1208                  * In my defense: This idea provides a reasonable way to
1209                  * smuggle valuable information to the tx_status callback.
1210                  * Also, the idea behind this bit-abuse came straight from
1211                  * the original driver code.
1212                  */
1213
1214                 txc->phy_control |=
1215                         cpu_to_le32(queue << AR9170_TX_PHY_QOS_SHIFT);
1216
1217                 if (info->control.sta) {
1218                         sta_info = (void *) info->control.sta->drv_priv;
1219                         skb_queue_tail(&sta_info->tx_status[queue], skb);
1220                 } else {
1221                         skb_queue_tail(&ar->global_tx_status, skb);
1222
1223                         queue_delayed_work(ar->hw->workqueue,
1224                                            &ar->tx_status_janitor,
1225                                            msecs_to_jiffies(100));
1226                 }
1227         }
1228
1229         err = ar->tx(ar, skb, tx_status, 0);
1230         if (unlikely(tx_status && err)) {
1231                 if (info->control.sta)
1232                         skb_unlink(skb, &sta_info->tx_status[queue]);
1233                 else
1234                         skb_unlink(skb, &ar->global_tx_status);
1235         }
1236
1237         return NETDEV_TX_OK;
1238
1239 err_dequeue:
1240         spin_lock_irqsave(&ar->tx_stats_lock, flags);
1241         ar->tx_stats[queue].len--;
1242         ar->tx_stats[queue].count--;
1243         spin_unlock_irqrestore(&ar->tx_stats_lock, flags);
1244
1245 err_free:
1246         dev_kfree_skb(skb);
1247         return NETDEV_TX_OK;
1248 }
1249
1250 static int ar9170_op_add_interface(struct ieee80211_hw *hw,
1251                                    struct ieee80211_if_init_conf *conf)
1252 {
1253         struct ar9170 *ar = hw->priv;
1254         int err = 0;
1255
1256         mutex_lock(&ar->mutex);
1257
1258         if (ar->vif) {
1259                 err = -EBUSY;
1260                 goto unlock;
1261         }
1262
1263         ar->vif = conf->vif;
1264         memcpy(ar->mac_addr, conf->mac_addr, ETH_ALEN);
1265
1266         if (modparam_nohwcrypt || (ar->vif->type != NL80211_IFTYPE_STATION)) {
1267                 ar->rx_software_decryption = true;
1268                 ar->disable_offload = true;
1269         }
1270
1271         ar->cur_filter = 0;
1272         ar->want_filter = AR9170_MAC_REG_FTF_DEFAULTS;
1273         err = ar9170_update_frame_filter(ar);
1274         if (err)
1275                 goto unlock;
1276
1277         err = ar9170_set_operating_mode(ar);
1278
1279 unlock:
1280         mutex_unlock(&ar->mutex);
1281         return err;
1282 }
1283
1284 static void ar9170_op_remove_interface(struct ieee80211_hw *hw,
1285                                        struct ieee80211_if_init_conf *conf)
1286 {
1287         struct ar9170 *ar = hw->priv;
1288
1289         mutex_lock(&ar->mutex);
1290         ar->vif = NULL;
1291         ar->want_filter = 0;
1292         ar9170_update_frame_filter(ar);
1293         ar9170_set_beacon_timers(ar);
1294         dev_kfree_skb(ar->beacon);
1295         ar->beacon = NULL;
1296         ar->sniffer_enabled = false;
1297         ar->rx_software_decryption = false;
1298         ar9170_set_operating_mode(ar);
1299         mutex_unlock(&ar->mutex);
1300 }
1301
1302 static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
1303 {
1304         struct ar9170 *ar = hw->priv;
1305         int err = 0;
1306
1307         mutex_lock(&ar->mutex);
1308
1309         if (changed & IEEE80211_CONF_CHANGE_RADIO_ENABLED) {
1310                 /* TODO */
1311                 err = 0;
1312         }
1313
1314         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
1315                 /* TODO */
1316                 err = 0;
1317         }
1318
1319         if (changed & IEEE80211_CONF_CHANGE_PS) {
1320                 /* TODO */
1321                 err = 0;
1322         }
1323
1324         if (changed & IEEE80211_CONF_CHANGE_POWER) {
1325                 /* TODO */
1326                 err = 0;
1327         }
1328
1329         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
1330                 /*
1331                  * is it long_frame_max_tx_count or short_frame_max_tx_count?
1332                  */
1333
1334                 err = ar9170_set_hwretry_limit(ar,
1335                         ar->hw->conf.long_frame_max_tx_count);
1336                 if (err)
1337                         goto out;
1338         }
1339
1340         if (changed & BSS_CHANGED_BEACON_INT) {
1341                 err = ar9170_set_beacon_timers(ar);
1342                 if (err)
1343                         goto out;
1344         }
1345
1346         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
1347                 err = ar9170_set_channel(ar, hw->conf.channel,
1348                                 AR9170_RFI_NONE,
1349                                 nl80211_to_ar9170(hw->conf.channel_type));
1350                 if (err)
1351                         goto out;
1352                 /* adjust slot time for 5 GHz */
1353                 if (hw->conf.channel->band == IEEE80211_BAND_5GHZ)
1354                         err = ar9170_write_reg(ar, AR9170_MAC_REG_SLOT_TIME,
1355                                                9 << 10);
1356         }
1357
1358 out:
1359         mutex_unlock(&ar->mutex);
1360         return err;
1361 }
1362
1363 static void ar9170_set_filters(struct work_struct *work)
1364 {
1365         struct ar9170 *ar = container_of(work, struct ar9170,
1366                                          filter_config_work);
1367         int err;
1368
1369         if (unlikely(!IS_STARTED(ar)))
1370                 return ;
1371
1372         mutex_lock(&ar->mutex);
1373         if (ar->filter_changed & AR9170_FILTER_CHANGED_PROMISC) {
1374                 err = ar9170_set_operating_mode(ar);
1375                 if (err)
1376                         goto unlock;
1377         }
1378
1379         if (ar->filter_changed & AR9170_FILTER_CHANGED_MULTICAST) {
1380                 err = ar9170_update_multicast(ar);
1381                 if (err)
1382                         goto unlock;
1383         }
1384
1385         if (ar->filter_changed & AR9170_FILTER_CHANGED_FRAMEFILTER)
1386                 err = ar9170_update_frame_filter(ar);
1387
1388 unlock:
1389         mutex_unlock(&ar->mutex);
1390 }
1391
1392 static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
1393                                        unsigned int changed_flags,
1394                                        unsigned int *new_flags,
1395                                        int mc_count, struct dev_mc_list *mclist)
1396 {
1397         struct ar9170 *ar = hw->priv;
1398
1399         /* mask supported flags */
1400         *new_flags &= FIF_ALLMULTI | FIF_CONTROL | FIF_BCN_PRBRESP_PROMISC |
1401                       FIF_PROMISC_IN_BSS | FIF_FCSFAIL | FIF_PLCPFAIL;
1402         ar->filter_state = *new_flags;
1403         /*
1404          * We can support more by setting the sniffer bit and
1405          * then checking the error flags, later.
1406          */
1407
1408         if (changed_flags & FIF_ALLMULTI) {
1409                 if (*new_flags & FIF_ALLMULTI) {
1410                         ar->want_mc_hash = ~0ULL;
1411                 } else {
1412                         u64 mchash;
1413                         int i;
1414
1415                         /* always get broadcast frames */
1416                         mchash = 1ULL << (0xff>>2);
1417
1418                         for (i = 0; i < mc_count; i++) {
1419                                 if (WARN_ON(!mclist))
1420                                         break;
1421                                 mchash |= 1ULL << (mclist->dmi_addr[5] >> 2);
1422                                 mclist = mclist->next;
1423                         }
1424                 ar->want_mc_hash = mchash;
1425                 }
1426                 ar->filter_changed |= AR9170_FILTER_CHANGED_MULTICAST;
1427         }
1428
1429         if (changed_flags & FIF_CONTROL) {
1430                 u32 filter = AR9170_MAC_REG_FTF_PSPOLL |
1431                              AR9170_MAC_REG_FTF_RTS |
1432                              AR9170_MAC_REG_FTF_CTS |
1433                              AR9170_MAC_REG_FTF_ACK |
1434                              AR9170_MAC_REG_FTF_CFE |
1435                              AR9170_MAC_REG_FTF_CFE_ACK;
1436
1437                 if (*new_flags & FIF_CONTROL)
1438                         ar->want_filter = ar->cur_filter | filter;
1439                 else
1440                         ar->want_filter = ar->cur_filter & ~filter;
1441
1442                 ar->filter_changed |= AR9170_FILTER_CHANGED_FRAMEFILTER;
1443         }
1444
1445         if (changed_flags & FIF_PROMISC_IN_BSS) {
1446                 ar->sniffer_enabled = ((*new_flags) & FIF_PROMISC_IN_BSS) != 0;
1447                 ar->filter_changed |= AR9170_FILTER_CHANGED_PROMISC;
1448         }
1449
1450         if (likely(IS_STARTED(ar)))
1451                 queue_work(ar->hw->workqueue, &ar->filter_config_work);
1452 }
1453
1454 static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
1455                                        struct ieee80211_vif *vif,
1456                                        struct ieee80211_bss_conf *bss_conf,
1457                                        u32 changed)
1458 {
1459         struct ar9170 *ar = hw->priv;
1460         int err = 0;
1461
1462         mutex_lock(&ar->mutex);
1463
1464         if (changed & BSS_CHANGED_BSSID) {
1465                 memcpy(ar->bssid, bss_conf->bssid, ETH_ALEN);
1466                 err = ar9170_set_operating_mode(ar);
1467         }
1468
1469         if (changed & (BSS_CHANGED_BEACON | BSS_CHANGED_BEACON_ENABLED)) {
1470                 err = ar9170_update_beacon(ar);
1471                 if (!err)
1472                         ar9170_set_beacon_timers(ar);
1473         }
1474
1475         ar9170_regwrite_begin(ar);
1476
1477         if (changed & BSS_CHANGED_ASSOC) {
1478                 ar->state = bss_conf->assoc ? AR9170_ASSOCIATED : ar->state;
1479
1480 #ifndef CONFIG_AR9170_LEDS
1481                 /* enable assoc LED. */
1482                 err = ar9170_set_leds_state(ar, bss_conf->assoc ? 2 : 0);
1483 #endif /* CONFIG_AR9170_LEDS */
1484         }
1485
1486         if (changed & BSS_CHANGED_BEACON_INT)
1487                 err = ar9170_set_beacon_timers(ar);
1488
1489         if (changed & BSS_CHANGED_HT) {
1490                 /* TODO */
1491                 err = 0;
1492         }
1493
1494         if (changed & BSS_CHANGED_ERP_SLOT) {
1495                 u32 slottime = 20;
1496
1497                 if (bss_conf->use_short_slot)
1498                         slottime = 9;
1499
1500                 ar9170_regwrite(AR9170_MAC_REG_SLOT_TIME, slottime << 10);
1501         }
1502
1503         if (changed & BSS_CHANGED_BASIC_RATES) {
1504                 u32 cck, ofdm;
1505
1506                 if (hw->conf.channel->band == IEEE80211_BAND_5GHZ) {
1507                         ofdm = bss_conf->basic_rates;
1508                         cck = 0;
1509                 } else {
1510                         /* four cck rates */
1511                         cck = bss_conf->basic_rates & 0xf;
1512                         ofdm = bss_conf->basic_rates >> 4;
1513                 }
1514                 ar9170_regwrite(AR9170_MAC_REG_BASIC_RATE,
1515                                 ofdm << 8 | cck);
1516         }
1517
1518         ar9170_regwrite_finish();
1519         err = ar9170_regwrite_result();
1520         mutex_unlock(&ar->mutex);
1521 }
1522
1523 static u64 ar9170_op_get_tsf(struct ieee80211_hw *hw)
1524 {
1525         struct ar9170 *ar = hw->priv;
1526         int err;
1527         u32 tsf_low;
1528         u32 tsf_high;
1529         u64 tsf;
1530
1531         mutex_lock(&ar->mutex);
1532         err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_L, &tsf_low);
1533         if (!err)
1534                 err = ar9170_read_reg(ar, AR9170_MAC_REG_TSF_H, &tsf_high);
1535         mutex_unlock(&ar->mutex);
1536
1537         if (WARN_ON(err))
1538                 return 0;
1539
1540         tsf = tsf_high;
1541         tsf = (tsf << 32) | tsf_low;
1542         return tsf;
1543 }
1544
1545 static int ar9170_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
1546                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
1547                           struct ieee80211_key_conf *key)
1548 {
1549         struct ar9170 *ar = hw->priv;
1550         int err = 0, i;
1551         u8 ktype;
1552
1553         if ((!ar->vif) || (ar->disable_offload))
1554                 return -EOPNOTSUPP;
1555
1556         switch (key->alg) {
1557         case ALG_WEP:
1558                 if (key->keylen == WLAN_KEY_LEN_WEP40)
1559                         ktype = AR9170_ENC_ALG_WEP64;
1560                 else
1561                         ktype = AR9170_ENC_ALG_WEP128;
1562                 break;
1563         case ALG_TKIP:
1564                 ktype = AR9170_ENC_ALG_TKIP;
1565                 break;
1566         case ALG_CCMP:
1567                 ktype = AR9170_ENC_ALG_AESCCMP;
1568                 break;
1569         default:
1570                 return -EOPNOTSUPP;
1571         }
1572
1573         mutex_lock(&ar->mutex);
1574         if (cmd == SET_KEY) {
1575                 if (unlikely(!IS_STARTED(ar))) {
1576                         err = -EOPNOTSUPP;
1577                         goto out;
1578                 }
1579
1580                 /* group keys need all-zeroes address */
1581                 if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1582                         sta = NULL;
1583
1584                 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
1585                         for (i = 0; i < 64; i++)
1586                                 if (!(ar->usedkeys & BIT(i)))
1587                                         break;
1588                         if (i == 64) {
1589                                 ar->rx_software_decryption = true;
1590                                 ar9170_set_operating_mode(ar);
1591                                 err = -ENOSPC;
1592                                 goto out;
1593                         }
1594                 } else {
1595                         i = 64 + key->keyidx;
1596                 }
1597
1598                 key->hw_key_idx = i;
1599
1600                 err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL, ktype, 0,
1601                                         key->key, min_t(u8, 16, key->keylen));
1602                 if (err)
1603                         goto out;
1604
1605                 if (key->alg == ALG_TKIP) {
1606                         err = ar9170_upload_key(ar, i, sta ? sta->addr : NULL,
1607                                                 ktype, 1, key->key + 16, 16);
1608                         if (err)
1609                                 goto out;
1610
1611                         /*
1612                          * hardware is not capable generating the MMIC
1613                          * for fragmented frames!
1614                          */
1615                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
1616                 }
1617
1618                 if (i < 64)
1619                         ar->usedkeys |= BIT(i);
1620
1621                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
1622         } else {
1623                 if (unlikely(!IS_STARTED(ar))) {
1624                         /* The device is gone... together with the key ;-) */
1625                         err = 0;
1626                         goto out;
1627                 }
1628
1629                 err = ar9170_disable_key(ar, key->hw_key_idx);
1630                 if (err)
1631                         goto out;
1632
1633                 if (key->hw_key_idx < 64) {
1634                         ar->usedkeys &= ~BIT(key->hw_key_idx);
1635                 } else {
1636                         err = ar9170_upload_key(ar, key->hw_key_idx, NULL,
1637                                                 AR9170_ENC_ALG_NONE, 0,
1638                                                 NULL, 0);
1639                         if (err)
1640                                 goto out;
1641
1642                         if (key->alg == ALG_TKIP) {
1643                                 err = ar9170_upload_key(ar, key->hw_key_idx,
1644                                                         NULL,
1645                                                         AR9170_ENC_ALG_NONE, 1,
1646                                                         NULL, 0);
1647                                 if (err)
1648                                         goto out;
1649                         }
1650
1651                 }
1652         }
1653
1654         ar9170_regwrite_begin(ar);
1655         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_L, ar->usedkeys);
1656         ar9170_regwrite(AR9170_MAC_REG_ROLL_CALL_TBL_H, ar->usedkeys >> 32);
1657         ar9170_regwrite_finish();
1658         err = ar9170_regwrite_result();
1659
1660 out:
1661         mutex_unlock(&ar->mutex);
1662
1663         return err;
1664 }
1665
1666 static void ar9170_sta_notify(struct ieee80211_hw *hw,
1667                               struct ieee80211_vif *vif,
1668                               enum sta_notify_cmd cmd,
1669                               struct ieee80211_sta *sta)
1670 {
1671         struct ar9170 *ar = hw->priv;
1672         struct ar9170_sta_info *info = (void *) sta->drv_priv;
1673         struct sk_buff *skb;
1674         unsigned int i;
1675
1676         switch (cmd) {
1677         case STA_NOTIFY_ADD:
1678                 for (i = 0; i < ar->hw->queues; i++)
1679                         skb_queue_head_init(&info->tx_status[i]);
1680                 break;
1681
1682         case STA_NOTIFY_REMOVE:
1683
1684                 /*
1685                  * transfer all outstanding frames that need a tx_status
1686                  * reports to the global tx_status queue
1687                  */
1688
1689                 for (i = 0; i < ar->hw->queues; i++) {
1690                         while ((skb = skb_dequeue(&info->tx_status[i]))) {
1691 #ifdef AR9170_QUEUE_DEBUG
1692                                 printk(KERN_DEBUG "%s: queueing frame in "
1693                                           "global tx_status queue =>\n",
1694                                        wiphy_name(ar->hw->wiphy));
1695
1696                                 ar9170_print_txheader(ar, skb);
1697 #endif /* AR9170_QUEUE_DEBUG */
1698                                 skb_queue_tail(&ar->global_tx_status, skb);
1699                         }
1700                 }
1701                 queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
1702                                    msecs_to_jiffies(100));
1703                 break;
1704
1705         default:
1706                 break;
1707         }
1708 }
1709
1710 static int ar9170_get_stats(struct ieee80211_hw *hw,
1711                             struct ieee80211_low_level_stats *stats)
1712 {
1713         struct ar9170 *ar = hw->priv;
1714         u32 val;
1715         int err;
1716
1717         mutex_lock(&ar->mutex);
1718         err = ar9170_read_reg(ar, AR9170_MAC_REG_TX_RETRY, &val);
1719         ar->stats.dot11ACKFailureCount += val;
1720
1721         memcpy(stats, &ar->stats, sizeof(*stats));
1722         mutex_unlock(&ar->mutex);
1723
1724         return 0;
1725 }
1726
1727 static int ar9170_get_tx_stats(struct ieee80211_hw *hw,
1728                                struct ieee80211_tx_queue_stats *tx_stats)
1729 {
1730         struct ar9170 *ar = hw->priv;
1731
1732         spin_lock_bh(&ar->tx_stats_lock);
1733         memcpy(tx_stats, ar->tx_stats, sizeof(tx_stats[0]) * hw->queues);
1734         spin_unlock_bh(&ar->tx_stats_lock);
1735
1736         return 0;
1737 }
1738
1739 static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
1740                           const struct ieee80211_tx_queue_params *param)
1741 {
1742         struct ar9170 *ar = hw->priv;
1743         int ret;
1744
1745         mutex_lock(&ar->mutex);
1746         if ((param) && !(queue > ar->hw->queues)) {
1747                 memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
1748                        param, sizeof(*param));
1749
1750                 ret = ar9170_set_qos(ar);
1751         } else
1752                 ret = -EINVAL;
1753
1754         mutex_unlock(&ar->mutex);
1755         return ret;
1756 }
1757
1758 static int ar9170_ampdu_action(struct ieee80211_hw *hw,
1759                                enum ieee80211_ampdu_mlme_action action,
1760                                struct ieee80211_sta *sta, u16 tid, u16 *ssn)
1761 {
1762         switch (action) {
1763         case IEEE80211_AMPDU_RX_START:
1764         case IEEE80211_AMPDU_RX_STOP:
1765                 /*
1766                  * Something goes wrong -- RX locks up
1767                  * after a while of receiving aggregated
1768                  * frames -- not enabling for now.
1769                  */
1770                 return -EOPNOTSUPP;
1771         default:
1772                 return -EOPNOTSUPP;
1773         }
1774 }
1775
1776 static const struct ieee80211_ops ar9170_ops = {
1777         .start                  = ar9170_op_start,
1778         .stop                   = ar9170_op_stop,
1779         .tx                     = ar9170_op_tx,
1780         .add_interface          = ar9170_op_add_interface,
1781         .remove_interface       = ar9170_op_remove_interface,
1782         .config                 = ar9170_op_config,
1783         .configure_filter       = ar9170_op_configure_filter,
1784         .conf_tx                = ar9170_conf_tx,
1785         .bss_info_changed       = ar9170_op_bss_info_changed,
1786         .get_tsf                = ar9170_op_get_tsf,
1787         .set_key                = ar9170_set_key,
1788         .sta_notify             = ar9170_sta_notify,
1789         .get_stats              = ar9170_get_stats,
1790         .get_tx_stats           = ar9170_get_tx_stats,
1791         .ampdu_action           = ar9170_ampdu_action,
1792 };
1793
1794 void *ar9170_alloc(size_t priv_size)
1795 {
1796         struct ieee80211_hw *hw;
1797         struct ar9170 *ar;
1798         struct sk_buff *skb;
1799         int i;
1800
1801         /*
1802          * this buffer is used for rx stream reconstruction.
1803          * Under heavy load this device (or the transport layer?)
1804          * tends to split the streams into seperate rx descriptors.
1805          */
1806
1807         skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL);
1808         if (!skb)
1809                 goto err_nomem;
1810
1811         hw = ieee80211_alloc_hw(priv_size, &ar9170_ops);
1812         if (!hw)
1813                 goto err_nomem;
1814
1815         ar = hw->priv;
1816         ar->hw = hw;
1817         ar->rx_failover = skb;
1818
1819         mutex_init(&ar->mutex);
1820         spin_lock_init(&ar->cmdlock);
1821         spin_lock_init(&ar->tx_stats_lock);
1822         skb_queue_head_init(&ar->global_tx_status);
1823         skb_queue_head_init(&ar->global_tx_status_waste);
1824         ar9170_rx_reset_rx_mpdu(ar);
1825         INIT_WORK(&ar->filter_config_work, ar9170_set_filters);
1826         INIT_WORK(&ar->beacon_work, ar9170_new_beacon);
1827         INIT_DELAYED_WORK(&ar->tx_status_janitor, ar9170_tx_status_janitor);
1828
1829         /* all hw supports 2.4 GHz, so set channel to 1 by default */
1830         ar->channel = &ar9170_2ghz_chantable[0];
1831
1832         /* first part of wiphy init */
1833         ar->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
1834                                          BIT(NL80211_IFTYPE_WDS) |
1835                                          BIT(NL80211_IFTYPE_ADHOC);
1836         ar->hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
1837                          IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
1838                          IEEE80211_HW_SIGNAL_DBM |
1839                          IEEE80211_HW_NOISE_DBM;
1840
1841         ar->hw->queues = __AR9170_NUM_TXQ;
1842         ar->hw->extra_tx_headroom = 8;
1843         ar->hw->sta_data_size = sizeof(struct ar9170_sta_info);
1844
1845         ar->hw->max_rates = 1;
1846         ar->hw->max_rate_tries = 3;
1847
1848         for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
1849                 ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
1850
1851         return ar;
1852
1853 err_nomem:
1854         kfree_skb(skb);
1855         return ERR_PTR(-ENOMEM);
1856 }
1857
1858 static int ar9170_read_eeprom(struct ar9170 *ar)
1859 {
1860 #define RW      8       /* number of words to read at once */
1861 #define RB      (sizeof(u32) * RW)
1862         DECLARE_MAC_BUF(mbuf);
1863         u8 *eeprom = (void *)&ar->eeprom;
1864         u8 *addr = ar->eeprom.mac_address;
1865         __le32 offsets[RW];
1866         int i, j, err, bands = 0;
1867
1868         BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
1869
1870         BUILD_BUG_ON(RB > AR9170_MAX_CMD_LEN - 4);
1871 #ifndef __CHECKER__
1872         /* don't want to handle trailing remains */
1873         BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
1874 #endif
1875
1876         for (i = 0; i < sizeof(ar->eeprom)/RB; i++) {
1877                 for (j = 0; j < RW; j++)
1878                         offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
1879                                                  RB * i + 4 * j);
1880
1881                 err = ar->exec_cmd(ar, AR9170_CMD_RREG,
1882                                    RB, (u8 *) &offsets,
1883                                    RB, eeprom + RB * i);
1884                 if (err)
1885                         return err;
1886         }
1887
1888 #undef RW
1889 #undef RB
1890
1891         if (ar->eeprom.length == cpu_to_le16(0xFFFF))
1892                 return -ENODATA;
1893
1894         if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
1895                 ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar9170_band_2GHz;
1896                 bands++;
1897         }
1898         if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
1899                 ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &ar9170_band_5GHz;
1900                 bands++;
1901         }
1902         /*
1903          * I measured this, a bandswitch takes roughly
1904          * 135 ms and a frequency switch about 80.
1905          *
1906          * FIXME: measure these values again once EEPROM settings
1907          *        are used, that will influence them!
1908          */
1909         if (bands == 2)
1910                 ar->hw->channel_change_time = 135 * 1000;
1911         else
1912                 ar->hw->channel_change_time = 80 * 1000;
1913
1914         ar->regulatory.current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
1915         ar->regulatory.current_rd_ext = le16_to_cpu(ar->eeprom.reg_domain[1]);
1916
1917         /* second part of wiphy init */
1918         SET_IEEE80211_PERM_ADDR(ar->hw, addr);
1919
1920         return bands ? 0 : -EINVAL;
1921 }
1922
1923 static int ar9170_reg_notifier(struct wiphy *wiphy,
1924                         struct regulatory_request *request)
1925 {
1926         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
1927         struct ar9170 *ar = hw->priv;
1928
1929         return ath_reg_notifier_apply(wiphy, request, &ar->regulatory);
1930 }
1931
1932 int ar9170_register(struct ar9170 *ar, struct device *pdev)
1933 {
1934         int err;
1935
1936         /* try to read EEPROM, init MAC addr */
1937         err = ar9170_read_eeprom(ar);
1938         if (err)
1939                 goto err_out;
1940
1941         err = ath_regd_init(&ar->regulatory, ar->hw->wiphy,
1942                             ar9170_reg_notifier);
1943         if (err)
1944                 goto err_out;
1945
1946         err = ieee80211_register_hw(ar->hw);
1947         if (err)
1948                 goto err_out;
1949
1950         if (!ath_is_world_regd(&ar->regulatory))
1951                 regulatory_hint(ar->hw->wiphy, ar->regulatory.alpha2);
1952
1953         err = ar9170_init_leds(ar);
1954         if (err)
1955                 goto err_unreg;
1956
1957 #ifdef CONFIG_AR9170_LEDS
1958         err = ar9170_register_leds(ar);
1959         if (err)
1960                 goto err_unreg;
1961 #endif /* CONFIG_AR9170_LEDS */
1962
1963         dev_info(pdev, "Atheros AR9170 is registered as '%s'\n",
1964                  wiphy_name(ar->hw->wiphy));
1965
1966         return err;
1967
1968 err_unreg:
1969         ieee80211_unregister_hw(ar->hw);
1970
1971 err_out:
1972         return err;
1973 }
1974
1975 void ar9170_unregister(struct ar9170 *ar)
1976 {
1977 #ifdef CONFIG_AR9170_LEDS
1978         ar9170_unregister_leds(ar);
1979 #endif /* CONFIG_AR9170_LEDS */
1980
1981         kfree_skb(ar->rx_failover);
1982         ieee80211_unregister_hw(ar->hw);
1983         mutex_destroy(&ar->mutex);
1984 }