drivers/net/wireless/ath/ath6kl/txrx.c

   1 /*
   2  * Copyright (c) 2004-2011 Atheros Communications Inc.
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include "core.h"
  18 #include "debug.h"
  19
  20 static u8 ath6kl_ibss_map_epid(struct sk_buff *skb, struct net_device *dev,
  21                                u32 *map_no)
  22 {
  23         struct ath6kl *ar = ath6kl_priv(dev);
  24         struct ethhdr *eth_hdr;
  25         u32 i, ep_map = -1;
  26         u8 *datap;
  27
  28         *map_no = 0;
  29         datap = skb->data;
  30         eth_hdr = (struct ethhdr *) (datap + sizeof(struct wmi_data_hdr));
  31
  32         if (is_multicast_ether_addr(eth_hdr->h_dest))
  33                 return ENDPOINT_2;
  34
  35         for (i = 0; i < ar->node_num; i++) {
  36                 if (memcmp(eth_hdr->h_dest, ar->node_map[i].mac_addr,
  37                            ETH_ALEN) == 0) {
  38                         *map_no = i + 1;
  39                         ar->node_map[i].tx_pend++;
  40                         return ar->node_map[i].ep_id;
  41                 }
  42
  43                 if ((ep_map == -1) && !ar->node_map[i].tx_pend)
  44                         ep_map = i;
  45         }
  46
  47         if (ep_map == -1) {
  48                 ep_map = ar->node_num;
  49                 ar->node_num++;
  50                 if (ar->node_num > MAX_NODE_NUM)
  51                         return ENDPOINT_UNUSED;
  52         }
  53
  54         memcpy(ar->node_map[ep_map].mac_addr, eth_hdr->h_dest, ETH_ALEN);
  55
  56         for (i = ENDPOINT_2; i <= ENDPOINT_5; i++) {
  57                 if (!ar->tx_pending[i]) {
  58                         ar->node_map[ep_map].ep_id = i;
  59                         break;
  60                 }
  61
  62                 /*
  63                  * No free endpoint is available, start redistribution on
  64                  * the inuse endpoints.
  65                  */
  66                 if (i == ENDPOINT_5) {
  67                         ar->node_map[ep_map].ep_id = ar->next_ep_id;
  68                         ar->next_ep_id++;
  69                         if (ar->next_ep_id > ENDPOINT_5)
  70                                 ar->next_ep_id = ENDPOINT_2;
  71                 }
  72         }
  73
  74         *map_no = ep_map + 1;
  75         ar->node_map[ep_map].tx_pend++;
  76
  77         return ar->node_map[ep_map].ep_id;
  78 }
  79
  80 static bool ath6kl_powersave_ap(struct ath6kl_vif *vif, struct sk_buff *skb,
  81                                 bool *more_data)
  82 {
  83         struct ethhdr *datap = (struct ethhdr *) skb->data;
  84         struct ath6kl_sta *conn = NULL;
  85         bool ps_queued = false, is_psq_empty = false;
  86         struct ath6kl *ar = vif->ar;
  87
  88         if (is_multicast_ether_addr(datap->h_dest)) {
  89                 u8 ctr = 0;
  90                 bool q_mcast = false;
  91
  92                 for (ctr = 0; ctr < AP_MAX_NUM_STA; ctr++) {
  93                         if (ar->sta_list[ctr].sta_flags & STA_PS_SLEEP) {
  94                                 q_mcast = true;
  95                                 break;
  96                         }
  97                 }
  98
  99                 if (q_mcast) {
 100                         /*
 101                          * If this transmit is not because of a Dtim Expiry
 102                          * q it.
 103                          */
 104                         if (!test_bit(DTIM_EXPIRED, &vif->flags)) {
 105                                 bool is_mcastq_empty = false;
 106
 107                                 spin_lock_bh(&ar->mcastpsq_lock);
 108                                 is_mcastq_empty =
 109                                         skb_queue_empty(&ar->mcastpsq);
 110                                 skb_queue_tail(&ar->mcastpsq, skb);
 111                                 spin_unlock_bh(&ar->mcastpsq_lock);
 112
 113                                 /*
 114                                  * If this is the first Mcast pkt getting
 115                                  * queued indicate to the target to set the
 116                                  * BitmapControl LSB of the TIM IE.
 117                                  */
 118                                 if (is_mcastq_empty)
 119                                         ath6kl_wmi_set_pvb_cmd(ar->wmi,
 120                                                                vif->fw_vif_idx,
 121                                                                MCAST_AID, 1);
 122
 123                                 ps_queued = true;
 124                         } else {
 125                                 /*
 126                                  * This transmit is because of Dtim expiry.
 127                                  * Determine if MoreData bit has to be set.
 128                                  */
 129                                 spin_lock_bh(&ar->mcastpsq_lock);
 130                                 if (!skb_queue_empty(&ar->mcastpsq))
 131                                         *more_data = true;
 132                                 spin_unlock_bh(&ar->mcastpsq_lock);
 133                         }
 134                 }
 135         } else {
 136                 conn = ath6kl_find_sta(vif, datap->h_dest);
 137                 if (!conn) {
 138                         dev_kfree_skb(skb);
 139
 140                         /* Inform the caller that the skb is consumed */
 141                         return true;
 142                 }
 143
 144                 if (conn->sta_flags & STA_PS_SLEEP) {
 145                         if (!(conn->sta_flags & STA_PS_POLLED)) {
 146                                 /* Queue the frames if the STA is sleeping */
 147                                 spin_lock_bh(&conn->psq_lock);
 148                                 is_psq_empty = skb_queue_empty(&conn->psq);
 149                                 skb_queue_tail(&conn->psq, skb);
 150                                 spin_unlock_bh(&conn->psq_lock);
 151
 152                                 /*
 153                                  * If this is the first pkt getting queued
 154                                  * for this STA, update the PVB for this
 155                                  * STA.
 156                                  */
 157                                 if (is_psq_empty)
 158                                         ath6kl_wmi_set_pvb_cmd(ar->wmi,
 159                                                                vif->fw_vif_idx,
 160                                                                conn->aid, 1);
 161
 162                                 ps_queued = true;
 163                         } else {
 164                                 /*
 165                                  * This tx is because of a PsPoll.
 166                                  * Determine if MoreData bit has to be set.
 167                                  */
 168                                 spin_lock_bh(&conn->psq_lock);
 169                                 if (!skb_queue_empty(&conn->psq))
 170                                         *more_data = true;
 171                                 spin_unlock_bh(&conn->psq_lock);
 172                         }
 173                 }
 174         }
 175
 176         return ps_queued;
 177 }
 178
 179 /* Tx functions */
 180
 181 int ath6kl_control_tx(void *devt, struct sk_buff *skb,
 182                       enum htc_endpoint_id eid)
 183 {
 184         struct ath6kl *ar = devt;
 185         int status = 0;
 186         struct ath6kl_cookie *cookie = NULL;
 187
 188         spin_lock_bh(&ar->lock);
 189
 190         ath6kl_dbg(ATH6KL_DBG_WLAN_TX,
 191                    "%s: skb=0x%p, len=0x%x eid =%d\n", __func__,
 192                    skb, skb->len, eid);
 193
 194         if (test_bit(WMI_CTRL_EP_FULL, &ar->flag) && (eid == ar->ctrl_ep)) {
 195                 /*
 196                  * Control endpoint is full, don't allocate resources, we
 197                  * are just going to drop this packet.
 198                  */
 199                 cookie = NULL;
 200                 ath6kl_err("wmi ctrl ep full, dropping pkt : 0x%p, len:%d\n",
 201                            skb, skb->len);
 202         } else
 203                 cookie = ath6kl_alloc_cookie(ar);
 204
 205         if (cookie == NULL) {
 206                 spin_unlock_bh(&ar->lock);
 207                 status = -ENOMEM;
 208                 goto fail_ctrl_tx;
 209         }
 210
 211         ar->tx_pending[eid]++;
 212
 213         if (eid != ar->ctrl_ep)
 214                 ar->total_tx_data_pend++;
 215
 216         spin_unlock_bh(&ar->lock);
 217
 218         cookie->skb = skb;
 219         cookie->map_no = 0;
 220         set_htc_pkt_info(&cookie->htc_pkt, cookie, skb->data, skb->len,
 221                          eid, ATH6KL_CONTROL_PKT_TAG);
 222
 223         /*
 224          * This interface is asynchronous, if there is an error, cleanup
 225          * will happen in the TX completion callback.
 226          */
 227         ath6kl_htc_tx(ar->htc_target, &cookie->htc_pkt);
 228
 229         return 0;
 230
 231 fail_ctrl_tx:
 232         dev_kfree_skb(skb);
 233         return status;
 234 }
 235
 236 int ath6kl_data_tx(struct sk_buff *skb, struct net_device *dev)
 237 {
 238         struct ath6kl *ar = ath6kl_priv(dev);
 239         struct ath6kl_cookie *cookie = NULL;
 240         enum htc_endpoint_id eid = ENDPOINT_UNUSED;
 241         struct ath6kl_vif *vif = netdev_priv(dev);
 242         u32 map_no = 0;
 243         u16 htc_tag = ATH6KL_DATA_PKT_TAG;
 244         u8 ac = 99 ; /* initialize to unmapped ac */
 245         bool chk_adhoc_ps_mapping = false, more_data = false;
 246         int ret;
 247
 248         ath6kl_dbg(ATH6KL_DBG_WLAN_TX,
 249                    "%s: skb=0x%p, data=0x%p, len=0x%x\n", __func__,
 250                    skb, skb->data, skb->len);
 251
 252         /* If target is not associated */
 253         if (!test_bit(CONNECTED, &vif->flags)) {
 254                 dev_kfree_skb(skb);
 255                 return 0;
 256         }
 257
 258         if (!test_bit(WMI_READY, &ar->flag))
 259                 goto fail_tx;
 260
 261         /* AP mode Power saving processing */
 262         if (vif->nw_type == AP_NETWORK) {
 263                 if (ath6kl_powersave_ap(vif, skb, &more_data))
 264                         return 0;
 265         }
 266
 267         if (test_bit(WMI_ENABLED, &ar->flag)) {
 268                 if (skb_headroom(skb) < dev->needed_headroom) {
 269                         struct sk_buff *tmp_skb = skb;
 270
 271                         skb = skb_realloc_headroom(skb, dev->needed_headroom);
 272                         kfree_skb(tmp_skb);
 273                         if (skb == NULL) {
 274                                 vif->net_stats.tx_dropped++;
 275                                 return 0;
 276                         }
 277                 }
 278
 279                 if (ath6kl_wmi_dix_2_dot3(ar->wmi, skb)) {
 280                         ath6kl_err("ath6kl_wmi_dix_2_dot3 failed\n");
 281                         goto fail_tx;
 282                 }
 283
 284                 if (ath6kl_wmi_data_hdr_add(ar->wmi, skb, DATA_MSGTYPE,
 285                                             more_data, 0, 0, NULL,
 286                                             vif->fw_vif_idx)) {
 287                         ath6kl_err("wmi_data_hdr_add failed\n");
 288                         goto fail_tx;
 289                 }
 290
 291                 if ((vif->nw_type == ADHOC_NETWORK) &&
 292                      ar->ibss_ps_enable && test_bit(CONNECTED, &vif->flags))
 293                         chk_adhoc_ps_mapping = true;
 294                 else {
 295                         /* get the stream mapping */
 296                         ret = ath6kl_wmi_implicit_create_pstream(ar->wmi,
 297                                     vif->fw_vif_idx, skb,
 298                                     0, test_bit(WMM_ENABLED, &vif->flags), &ac);
 299                         if (ret)
 300                                 goto fail_tx;
 301                 }
 302         } else
 303                 goto fail_tx;
 304
 305         spin_lock_bh(&ar->lock);
 306
 307         if (chk_adhoc_ps_mapping)
 308                 eid = ath6kl_ibss_map_epid(skb, dev, &map_no);
 309         else
 310                 eid = ar->ac2ep_map[ac];
 311
 312         if (eid == 0 || eid == ENDPOINT_UNUSED) {
 313                 ath6kl_err("eid %d is not mapped!\n", eid);
 314                 spin_unlock_bh(&ar->lock);
 315                 goto fail_tx;
 316         }
 317
 318         /* allocate resource for this packet */
 319         cookie = ath6kl_alloc_cookie(ar);
 320
 321         if (!cookie) {
 322                 spin_unlock_bh(&ar->lock);
 323                 goto fail_tx;
 324         }
 325
 326         /* update counts while the lock is held */
 327         ar->tx_pending[eid]++;
 328         ar->total_tx_data_pend++;
 329
 330         spin_unlock_bh(&ar->lock);
 331
 332         if (!IS_ALIGNED((unsigned long) skb->data - HTC_HDR_LENGTH, 4) &&
 333             skb_cloned(skb)) {
 334                 /*
 335                  * We will touch (move the buffer data to align it. Since the
 336                  * skb buffer is cloned and not only the header is changed, we
 337                  * have to copy it to allow the changes. Since we are copying
 338                  * the data here, we may as well align it by reserving suitable
 339                  * headroom to avoid the memmove in ath6kl_htc_tx_buf_align().
 340                  */
 341                 struct sk_buff *nskb;
 342
 343                 nskb = skb_copy_expand(skb, HTC_HDR_LENGTH, 0, GFP_ATOMIC);
 344                 if (nskb == NULL)
 345                         goto fail_tx;
 346                 kfree_skb(skb);
 347                 skb = nskb;
 348         }
 349
 350         cookie->skb = skb;
 351         cookie->map_no = map_no;
 352         set_htc_pkt_info(&cookie->htc_pkt, cookie, skb->data, skb->len,
 353                          eid, htc_tag);
 354
 355         ath6kl_dbg_dump(ATH6KL_DBG_RAW_BYTES, __func__, "tx ",
 356                         skb->data, skb->len);
 357
 358         /*
 359          * HTC interface is asynchronous, if this fails, cleanup will
 360          * happen in the ath6kl_tx_complete callback.
 361          */
 362         ath6kl_htc_tx(ar->htc_target, &cookie->htc_pkt);
 363
 364         return 0;
 365
 366 fail_tx:
 367         dev_kfree_skb(skb);
 368
 369         vif->net_stats.tx_dropped++;
 370         vif->net_stats.tx_aborted_errors++;
 371
 372         return 0;
 373 }
 374
 375 /* indicate tx activity or inactivity on a WMI stream */
 376 void ath6kl_indicate_tx_activity(void *devt, u8 traffic_class, bool active)
 377 {
 378         struct ath6kl *ar = devt;
 379         enum htc_endpoint_id eid;
 380         int i;
 381
 382         eid = ar->ac2ep_map[traffic_class];
 383
 384         if (!test_bit(WMI_ENABLED, &ar->flag))
 385                 goto notify_htc;
 386
 387         spin_lock_bh(&ar->lock);
 388
 389         ar->ac_stream_active[traffic_class] = active;
 390
 391         if (active) {
 392                 /*
 393                  * Keep track of the active stream with the highest
 394                  * priority.
 395                  */
 396                 if (ar->ac_stream_pri_map[traffic_class] >
 397                     ar->hiac_stream_active_pri)
 398                         /* set the new highest active priority */
 399                         ar->hiac_stream_active_pri =
 400                                         ar->ac_stream_pri_map[traffic_class];
 401
 402         } else {
 403                 /*
 404                  * We may have to search for the next active stream
 405                  * that is the highest priority.
 406                  */
 407                 if (ar->hiac_stream_active_pri ==
 408                         ar->ac_stream_pri_map[traffic_class]) {
 409                         /*
 410                          * The highest priority stream just went inactive
 411                          * reset and search for the "next" highest "active"
 412                          * priority stream.
 413                          */
 414                         ar->hiac_stream_active_pri = 0;
 415
 416                         for (i = 0; i < WMM_NUM_AC; i++) {
 417                                 if (ar->ac_stream_active[i] &&
 418                                     (ar->ac_stream_pri_map[i] >
 419                                      ar->hiac_stream_active_pri))
 420                                         /*
 421                                          * Set the new highest active
 422                                          * priority.
 423                                          */
 424                                         ar->hiac_stream_active_pri =
 425                                                 ar->ac_stream_pri_map[i];
 426                         }
 427                 }
 428         }
 429
 430         spin_unlock_bh(&ar->lock);
 431
 432 notify_htc:
 433         /* notify HTC, this may cause credit distribution changes */
 434         ath6kl_htc_indicate_activity_change(ar->htc_target, eid, active);
 435 }
 436
 437 enum htc_send_full_action ath6kl_tx_queue_full(struct htc_target *target,
 438                                                struct htc_packet *packet)
 439 {
 440         struct ath6kl *ar = target->dev->ar;
 441         struct ath6kl_vif *vif;
 442         enum htc_endpoint_id endpoint = packet->endpoint;
 443         enum htc_send_full_action action = HTC_SEND_FULL_KEEP;
 444
 445         if (endpoint == ar->ctrl_ep) {
 446                 /*
 447                  * Under normal WMI if this is getting full, then something
 448                  * is running rampant the host should not be exhausting the
 449                  * WMI queue with too many commands the only exception to
 450                  * this is during testing using endpointping.
 451                  */
 452                 spin_lock_bh(&ar->lock);
 453                 set_bit(WMI_CTRL_EP_FULL, &ar->flag);
 454                 spin_unlock_bh(&ar->lock);
 455                 ath6kl_err("wmi ctrl ep is full\n");
 456                 return action;
 457         }
 458
 459         if (packet->info.tx.tag == ATH6KL_CONTROL_PKT_TAG)
 460                 return action;
 461
 462         /*
 463          * The last MAX_HI_COOKIE_NUM "batch" of cookies are reserved for
 464          * the highest active stream.
 465          */
 466         if (ar->ac_stream_pri_map[ar->ep2ac_map[endpoint]] <
 467             ar->hiac_stream_active_pri &&
 468             ar->cookie_count <= MAX_HI_COOKIE_NUM)
 469                 /*
 470                  * Give preference to the highest priority stream by
 471                  * dropping the packets which overflowed.
 472                  */
 473                 action = HTC_SEND_FULL_DROP;
 474
 475         /* FIXME: Locking */
 476         spin_lock_bh(&ar->list_lock);
 477         list_for_each_entry(vif, &ar->vif_list, list) {
 478                 if (vif->nw_type == ADHOC_NETWORK ||
 479                     action != HTC_SEND_FULL_DROP) {
 480                         spin_unlock_bh(&ar->list_lock);
 481
 482                         spin_lock_bh(&vif->if_lock);
 483                         set_bit(NETQ_STOPPED, &vif->flags);
 484                         spin_unlock_bh(&vif->if_lock);
 485                         netif_stop_queue(vif->ndev);
 486
 487                         return action;
 488                 }
 489         }
 490         spin_unlock_bh(&ar->list_lock);
 491
 492         return action;
 493 }
 494
 495 /* TODO this needs to be looked at */
 496 static void ath6kl_tx_clear_node_map(struct ath6kl_vif *vif,
 497                                      enum htc_endpoint_id eid, u32 map_no)
 498 {
 499         struct ath6kl *ar = vif->ar;
 500         u32 i;
 501
 502         if (vif->nw_type != ADHOC_NETWORK)
 503                 return;
 504
 505         if (!ar->ibss_ps_enable)
 506                 return;
 507
 508         if (eid == ar->ctrl_ep)
 509                 return;
 510
 511         if (map_no == 0)
 512                 return;
 513
 514         map_no--;
 515         ar->node_map[map_no].tx_pend--;
 516
 517         if (ar->node_map[map_no].tx_pend)
 518                 return;
 519
 520         if (map_no != (ar->node_num - 1))
 521                 return;
 522
 523         for (i = ar->node_num; i > 0; i--) {
 524                 if (ar->node_map[i - 1].tx_pend)
 525                         break;
 526
 527                 memset(&ar->node_map[i - 1], 0,
 528                        sizeof(struct ath6kl_node_mapping));
 529                 ar->node_num--;
 530         }
 531 }
 532
 533 void ath6kl_tx_complete(void *context, struct list_head *packet_queue)
 534 {
 535         struct ath6kl *ar = context;
 536         struct sk_buff_head skb_queue;
 537         struct htc_packet *packet;
 538         struct sk_buff *skb;
 539         struct ath6kl_cookie *ath6kl_cookie;
 540         u32 map_no = 0;
 541         int status;
 542         enum htc_endpoint_id eid;
 543         bool wake_event = false;
 544         bool flushing[ATH6KL_VIF_MAX] = {false};
 545         u8 if_idx;
 546         struct ath6kl_vif *vif;
 547
 548         skb_queue_head_init(&skb_queue);
 549
 550         /* lock the driver as we update internal state */
 551         spin_lock_bh(&ar->lock);
 552
 553         /* reap completed packets */
 554         while (!list_empty(packet_queue)) {
 555
 556                 packet = list_first_entry(packet_queue, struct htc_packet,
 557                                           list);
 558                 list_del(&packet->list);
 559
 560                 ath6kl_cookie = (struct ath6kl_cookie *)packet->pkt_cntxt;
 561                 if (!ath6kl_cookie)
 562                         goto fatal;
 563
 564                 status = packet->status;
 565                 skb = ath6kl_cookie->skb;
 566                 eid = packet->endpoint;
 567                 map_no = ath6kl_cookie->map_no;
 568
 569                 if (!skb || !skb->data)
 570                         goto fatal;
 571
 572                 __skb_queue_tail(&skb_queue, skb);
 573
 574                 if (!status && (packet->act_len != skb->len))
 575                         goto fatal;
 576
 577                 ar->tx_pending[eid]--;
 578
 579                 if (eid != ar->ctrl_ep)
 580                         ar->total_tx_data_pend--;
 581
 582                 if (eid == ar->ctrl_ep) {
 583                         if (test_bit(WMI_CTRL_EP_FULL, &ar->flag))
 584                                 clear_bit(WMI_CTRL_EP_FULL, &ar->flag);
 585
 586                         if (ar->tx_pending[eid] == 0)
 587                                 wake_event = true;
 588                 }
 589
 590                 if (eid == ar->ctrl_ep) {
 591                         if_idx = wmi_cmd_hdr_get_if_idx(
 592                                 (struct wmi_cmd_hdr *) packet->buf);
 593                 } else {
 594                         if_idx = wmi_data_hdr_get_if_idx(
 595                                 (struct wmi_data_hdr *) packet->buf);
 596                 }
 597
 598                 vif = ath6kl_get_vif_by_index(ar, if_idx);
 599                 if (!vif) {
 600                         ath6kl_free_cookie(ar, ath6kl_cookie);
 601                         continue;
 602                 }
 603
 604                 if (status) {
 605                         if (status == -ECANCELED)
 606                                 /* a packet was flushed  */
 607                                 flushing[if_idx] = true;
 608
 609                         vif->net_stats.tx_errors++;
 610
 611                         if (status != -ENOSPC && status != -ECANCELED)
 612                                 ath6kl_warn("tx complete error: %d\n", status);
 613
 614                         ath6kl_dbg(ATH6KL_DBG_WLAN_TX,
 615                                    "%s: skb=0x%p data=0x%p len=0x%x eid=%d %s\n",
 616                                    __func__, skb, packet->buf, packet->act_len,
 617                                    eid, "error!");
 618                 } else {
 619                         ath6kl_dbg(ATH6KL_DBG_WLAN_TX,
 620                                    "%s: skb=0x%p data=0x%p len=0x%x eid=%d %s\n",
 621                                    __func__, skb, packet->buf, packet->act_len,
 622                                    eid, "OK");
 623
 624                         flushing[if_idx] = false;
 625                         vif->net_stats.tx_packets++;
 626                         vif->net_stats.tx_bytes += skb->len;
 627                 }
 628
 629                 ath6kl_tx_clear_node_map(vif, eid, map_no);
 630
 631                 ath6kl_free_cookie(ar, ath6kl_cookie);
 632
 633                 if (test_bit(NETQ_STOPPED, &vif->flags))
 634                         clear_bit(NETQ_STOPPED, &vif->flags);
 635         }
 636
 637         spin_unlock_bh(&ar->lock);
 638
 639         __skb_queue_purge(&skb_queue);
 640
 641         /* FIXME: Locking */
 642         spin_lock_bh(&ar->list_lock);
 643         list_for_each_entry(vif, &ar->vif_list, list) {
 644                 if (test_bit(CONNECTED, &vif->flags) &&
 645                     !flushing[vif->fw_vif_idx]) {
 646                         spin_unlock_bh(&ar->list_lock);
 647                         netif_wake_queue(vif->ndev);
 648                         spin_lock_bh(&ar->list_lock);
 649                 }
 650         }
 651         spin_unlock_bh(&ar->list_lock);
 652
 653         if (wake_event)
 654                 wake_up(&ar->event_wq);
 655
 656         return;
 657
 658 fatal:
 659         WARN_ON(1);
 660         spin_unlock_bh(&ar->lock);
 661         return;
 662 }
 663
 664 void ath6kl_tx_data_cleanup(struct ath6kl *ar)
 665 {
 666         int i;
 667
 668         /* flush all the data (non-control) streams */
 669         for (i = 0; i < WMM_NUM_AC; i++)
 670                 ath6kl_htc_flush_txep(ar->htc_target, ar->ac2ep_map[i],
 671                                       ATH6KL_DATA_PKT_TAG);
 672 }
 673
 674 /* Rx functions */
 675
 676 static void ath6kl_deliver_frames_to_nw_stack(struct net_device *dev,
 677                                               struct sk_buff *skb)
 678 {
 679         if (!skb)
 680                 return;
 681
 682         skb->dev = dev;
 683
 684         if (!(skb->dev->flags & IFF_UP)) {
 685                 dev_kfree_skb(skb);
 686                 return;
 687         }
 688
 689         skb->protocol = eth_type_trans(skb, skb->dev);
 690
 691         netif_rx_ni(skb);
 692 }
 693
 694 static void ath6kl_alloc_netbufs(struct sk_buff_head *q, u16 num)
 695 {
 696         struct sk_buff *skb;
 697
 698         while (num) {
 699                 skb = ath6kl_buf_alloc(ATH6KL_BUFFER_SIZE);
 700                 if (!skb) {
 701                         ath6kl_err("netbuf allocation failed\n");
 702                         return;
 703                 }
 704                 skb_queue_tail(q, skb);
 705                 num--;
 706         }
 707 }
 708
 709 static struct sk_buff *aggr_get_free_skb(struct aggr_info *p_aggr)
 710 {
 711         struct sk_buff *skb = NULL;
 712
 713         if (skb_queue_len(&p_aggr->free_q) < (AGGR_NUM_OF_FREE_NETBUFS >> 2))
 714                 ath6kl_alloc_netbufs(&p_aggr->free_q, AGGR_NUM_OF_FREE_NETBUFS);
 715
 716         skb = skb_dequeue(&p_aggr->free_q);
 717
 718         return skb;
 719 }
 720
 721 void ath6kl_rx_refill(struct htc_target *target, enum htc_endpoint_id endpoint)
 722 {
 723         struct ath6kl *ar = target->dev->ar;
 724         struct sk_buff *skb;
 725         int rx_buf;
 726         int n_buf_refill;
 727         struct htc_packet *packet;
 728         struct list_head queue;
 729
 730         n_buf_refill = ATH6KL_MAX_RX_BUFFERS -
 731                           ath6kl_htc_get_rxbuf_num(ar->htc_target, endpoint);
 732
 733         if (n_buf_refill <= 0)
 734                 return;
 735
 736         INIT_LIST_HEAD(&queue);
 737
 738         ath6kl_dbg(ATH6KL_DBG_WLAN_RX,
 739                    "%s: providing htc with %d buffers at eid=%d\n",
 740                    __func__, n_buf_refill, endpoint);
 741
 742         for (rx_buf = 0; rx_buf < n_buf_refill; rx_buf++) {
 743                 skb = ath6kl_buf_alloc(ATH6KL_BUFFER_SIZE);
 744                 if (!skb)
 745                         break;
 746
 747                 packet = (struct htc_packet *) skb->head;
 748                 if (!IS_ALIGNED((unsigned long) skb->data, 4))
 749                         skb->data = PTR_ALIGN(skb->data - 4, 4);
 750                 set_htc_rxpkt_info(packet, skb, skb->data,
 751                                 ATH6KL_BUFFER_SIZE, endpoint);
 752                 list_add_tail(&packet->list, &queue);
 753         }
 754
 755         if (!list_empty(&queue))
 756                 ath6kl_htc_add_rxbuf_multiple(ar->htc_target, &queue);
 757 }
 758
 759 void ath6kl_refill_amsdu_rxbufs(struct ath6kl *ar, int count)
 760 {
 761         struct htc_packet *packet;
 762         struct sk_buff *skb;
 763
 764         while (count) {
 765                 skb = ath6kl_buf_alloc(ATH6KL_AMSDU_BUFFER_SIZE);
 766                 if (!skb)
 767                         return;
 768
 769                 packet = (struct htc_packet *) skb->head;
 770                 if (!IS_ALIGNED((unsigned long) skb->data, 4))
 771                         skb->data = PTR_ALIGN(skb->data - 4, 4);
 772                 set_htc_rxpkt_info(packet, skb, skb->data,
 773                                    ATH6KL_AMSDU_BUFFER_SIZE, 0);
 774                 spin_lock_bh(&ar->lock);
 775                 list_add_tail(&packet->list, &ar->amsdu_rx_buffer_queue);
 776                 spin_unlock_bh(&ar->lock);
 777                 count--;
 778         }
 779 }
 780
 781 /*
 782  * Callback to allocate a receive buffer for a pending packet. We use a
 783  * pre-allocated list of buffers of maximum AMSDU size (4K).
 784  */
 785 struct htc_packet *ath6kl_alloc_amsdu_rxbuf(struct htc_target *target,
 786                                             enum htc_endpoint_id endpoint,
 787                                             int len)
 788 {
 789         struct ath6kl *ar = target->dev->ar;
 790         struct htc_packet *packet = NULL;
 791         struct list_head *pkt_pos;
 792         int refill_cnt = 0, depth = 0;
 793
 794         ath6kl_dbg(ATH6KL_DBG_WLAN_RX, "%s: eid=%d, len:%d\n",
 795                    __func__, endpoint, len);
 796
 797         if ((len <= ATH6KL_BUFFER_SIZE) ||
 798             (len > ATH6KL_AMSDU_BUFFER_SIZE))
 799                 return NULL;
 800
 801         spin_lock_bh(&ar->lock);
 802
 803         if (list_empty(&ar->amsdu_rx_buffer_queue)) {
 804                 spin_unlock_bh(&ar->lock);
 805                 refill_cnt = ATH6KL_MAX_AMSDU_RX_BUFFERS;
 806                 goto refill_buf;
 807         }
 808
 809         packet = list_first_entry(&ar->amsdu_rx_buffer_queue,
 810                                   struct htc_packet, list);
 811         list_del(&packet->list);
 812         list_for_each(pkt_pos, &ar->amsdu_rx_buffer_queue)
 813                 depth++;
 814
 815         refill_cnt = ATH6KL_MAX_AMSDU_RX_BUFFERS - depth;
 816         spin_unlock_bh(&ar->lock);
 817
 818         /* set actual endpoint ID */
 819         packet->endpoint = endpoint;
 820
 821 refill_buf:
 822         if (refill_cnt >= ATH6KL_AMSDU_REFILL_THRESHOLD)
 823                 ath6kl_refill_amsdu_rxbufs(ar, refill_cnt);
 824
 825         return packet;
 826 }
 827
 828 static void aggr_slice_amsdu(struct aggr_info *p_aggr,
 829                              struct rxtid *rxtid, struct sk_buff *skb)
 830 {
 831         struct sk_buff *new_skb;
 832         struct ethhdr *hdr;
 833         u16 frame_8023_len, payload_8023_len, mac_hdr_len, amsdu_len;
 834         u8 *framep;
 835
 836         mac_hdr_len = sizeof(struct ethhdr);
 837         framep = skb->data + mac_hdr_len;
 838         amsdu_len = skb->len - mac_hdr_len;
 839
 840         while (amsdu_len > mac_hdr_len) {
 841                 hdr = (struct ethhdr *) framep;
 842                 payload_8023_len = ntohs(hdr->h_proto);
 843
 844                 if (payload_8023_len < MIN_MSDU_SUBFRAME_PAYLOAD_LEN ||
 845                     payload_8023_len > MAX_MSDU_SUBFRAME_PAYLOAD_LEN) {
 846                         ath6kl_err("802.3 AMSDU frame bound check failed. len %d\n",
 847                                    payload_8023_len);
 848                         break;
 849                 }
 850
 851                 frame_8023_len = payload_8023_len + mac_hdr_len;
 852                 new_skb = aggr_get_free_skb(p_aggr);
 853                 if (!new_skb) {
 854                         ath6kl_err("no buffer available\n");
 855                         break;
 856                 }
 857
 858                 memcpy(new_skb->data, framep, frame_8023_len);
 859                 skb_put(new_skb, frame_8023_len);
 860                 if (ath6kl_wmi_dot3_2_dix(new_skb)) {
 861                         ath6kl_err("dot3_2_dix error\n");
 862                         dev_kfree_skb(new_skb);
 863                         break;
 864                 }
 865
 866                 skb_queue_tail(&rxtid->q, new_skb);
 867
 868                 /* Is this the last subframe within this aggregate ? */
 869                 if ((amsdu_len - frame_8023_len) == 0)
 870                         break;
 871
 872                 /* Add the length of A-MSDU subframe padding bytes -
 873                  * Round to nearest word.
 874                  */
 875                 frame_8023_len = ALIGN(frame_8023_len, 4);
 876
 877                 framep += frame_8023_len;
 878                 amsdu_len -= frame_8023_len;
 879         }
 880
 881         dev_kfree_skb(skb);
 882 }
 883
 884 static void aggr_deque_frms(struct aggr_info *p_aggr, u8 tid,
 885                             u16 seq_no, u8 order)
 886 {
 887         struct sk_buff *skb;
 888         struct rxtid *rxtid;
 889         struct skb_hold_q *node;
 890         u16 idx, idx_end, seq_end;
 891         struct rxtid_stats *stats;
 892
 893         if (!p_aggr)
 894                 return;
 895
 896         rxtid = &p_aggr->rx_tid[tid];
 897         stats = &p_aggr->stat[tid];
 898
 899         idx = AGGR_WIN_IDX(rxtid->seq_next, rxtid->hold_q_sz);
 900
 901         /*
 902          * idx_end is typically the last possible frame in the window,
 903          * but changes to 'the' seq_no, when BAR comes. If seq_no
 904          * is non-zero, we will go up to that and stop.
 905          * Note: last seq no in current window will occupy the same
 906          * index position as index that is just previous to start.
 907          * An imp point : if win_sz is 7, for seq_no space of 4095,
 908          * then, there would be holes when sequence wrap around occurs.
 909          * Target should judiciously choose the win_sz, based on
 910          * this condition. For 4095, (TID_WINDOW_SZ = 2 x win_sz
 911          * 2, 4, 8, 16 win_sz works fine).
 912          * We must deque from "idx" to "idx_end", including both.
 913          */
 914         seq_end = seq_no ? seq_no : rxtid->seq_next;
 915         idx_end = AGGR_WIN_IDX(seq_end, rxtid->hold_q_sz);
 916
 917         spin_lock_bh(&rxtid->lock);
 918
 919         do {
 920                 node = &rxtid->hold_q[idx];
 921                 if ((order == 1) && (!node->skb))
 922                         break;
 923
 924                 if (node->skb) {
 925                         if (node->is_amsdu)
 926                                 aggr_slice_amsdu(p_aggr, rxtid, node->skb);
 927                         else
 928                                 skb_queue_tail(&rxtid->q, node->skb);
 929                         node->skb = NULL;
 930                 } else
 931                         stats->num_hole++;
 932
 933                 rxtid->seq_next = ATH6KL_NEXT_SEQ_NO(rxtid->seq_next);
 934                 idx = AGGR_WIN_IDX(rxtid->seq_next, rxtid->hold_q_sz);
 935         } while (idx != idx_end);
 936
 937         spin_unlock_bh(&rxtid->lock);
 938
 939         stats->num_delivered += skb_queue_len(&rxtid->q);
 940
 941         while ((skb = skb_dequeue(&rxtid->q)))
 942                 ath6kl_deliver_frames_to_nw_stack(p_aggr->dev, skb);
 943 }
 944
 945 static bool aggr_process_recv_frm(struct aggr_info *agg_info, u8 tid,
 946                                   u16 seq_no,
 947                                   bool is_amsdu, struct sk_buff *frame)
 948 {
 949         struct rxtid *rxtid;
 950         struct rxtid_stats *stats;
 951         struct sk_buff *skb;
 952         struct skb_hold_q *node;
 953         u16 idx, st, cur, end;
 954         bool is_queued = false;
 955         u16 extended_end;
 956
 957         rxtid = &agg_info->rx_tid[tid];
 958         stats = &agg_info->stat[tid];
 959
 960         stats->num_into_aggr++;
 961
 962         if (!rxtid->aggr) {
 963                 if (is_amsdu) {
 964                         aggr_slice_amsdu(agg_info, rxtid, frame);
 965                         is_queued = true;
 966                         stats->num_amsdu++;
 967                         while ((skb = skb_dequeue(&rxtid->q)))
 968                                 ath6kl_deliver_frames_to_nw_stack(agg_info->dev,
 969                                                                   skb);
 970                 }
 971                 return is_queued;
 972         }
 973
 974         /* Check the incoming sequence no, if it's in the window */
 975         st = rxtid->seq_next;
 976         cur = seq_no;
 977         end = (st + rxtid->hold_q_sz-1) & ATH6KL_MAX_SEQ_NO;
 978
 979         if (((st < end) && (cur < st || cur > end)) ||
 980             ((st > end) && (cur > end) && (cur < st))) {
 981                 extended_end = (end + rxtid->hold_q_sz - 1) &
 982                         ATH6KL_MAX_SEQ_NO;
 983
 984                 if (((end < extended_end) &&
 985                      (cur < end || cur > extended_end)) ||
 986                     ((end > extended_end) && (cur > extended_end) &&
 987                      (cur < end))) {
 988                         aggr_deque_frms(agg_info, tid, 0, 0);
 989                         if (cur >= rxtid->hold_q_sz - 1)
 990                                 rxtid->seq_next = cur - (rxtid->hold_q_sz - 1);
 991                         else
 992                                 rxtid->seq_next = ATH6KL_MAX_SEQ_NO -
 993                                                   (rxtid->hold_q_sz - 2 - cur);
 994                 } else {
 995                         /*
 996                          * Dequeue only those frames that are outside the
 997                          * new shifted window.
 998                          */
 999                         if (cur >= rxtid->hold_q_sz - 1)
1000                                 st = cur - (rxtid->hold_q_sz - 1);
1001                         else
1002                                 st = ATH6KL_MAX_SEQ_NO -
1003                                         (rxtid->hold_q_sz - 2 - cur);
1004
1005                         aggr_deque_frms(agg_info, tid, st, 0);
1006                 }
1007
1008                 stats->num_oow++;
1009         }
1010
1011         idx = AGGR_WIN_IDX(seq_no, rxtid->hold_q_sz);
1012
1013         node = &rxtid->hold_q[idx];
1014
1015         spin_lock_bh(&rxtid->lock);
1016
1017         /*
1018          * Is the cur frame duplicate or something beyond our window(hold_q
1019          * -> which is 2x, already)?
1020          *
1021          * 1. Duplicate is easy - drop incoming frame.
1022          * 2. Not falling in current sliding window.
1023          *  2a. is the frame_seq_no preceding current tid_seq_no?
1024          *      -> drop the frame. perhaps sender did not get our ACK.
1025          *         this is taken care of above.
1026          *  2b. is the frame_seq_no beyond window(st, TID_WINDOW_SZ);
1027          *      -> Taken care of it above, by moving window forward.
1028          */
1029         dev_kfree_skb(node->skb);
1030         stats->num_dups++;
1031
1032         node->skb = frame;
1033         is_queued = true;
1034         node->is_amsdu = is_amsdu;
1035         node->seq_no = seq_no;
1036
1037         if (node->is_amsdu)
1038                 stats->num_amsdu++;
1039         else
1040                 stats->num_mpdu++;
1041
1042         spin_unlock_bh(&rxtid->lock);
1043
1044         aggr_deque_frms(agg_info, tid, 0, 1);
1045
1046         if (agg_info->timer_scheduled)
1047                 rxtid->progress = true;
1048         else
1049                 for (idx = 0 ; idx < rxtid->hold_q_sz; idx++) {
1050                         if (rxtid->hold_q[idx].skb) {
1051                                 /*
1052                                  * There is a frame in the queue and no
1053                                  * timer so start a timer to ensure that
1054                                  * the frame doesn't remain stuck
1055                                  * forever.
1056                                  */
1057                                 agg_info->timer_scheduled = true;
1058                                 mod_timer(&agg_info->timer,
1059                                           (jiffies +
1060                                            HZ * (AGGR_RX_TIMEOUT) / 1000));
1061                                 rxtid->progress = false;
1062                                 rxtid->timer_mon = true;
1063                                 break;
1064                         }
1065                 }
1066
1067         return is_queued;
1068 }
1069
1070 void ath6kl_rx(struct htc_target *target, struct htc_packet *packet)
1071 {
1072         struct ath6kl *ar = target->dev->ar;
1073         struct sk_buff *skb = packet->pkt_cntxt;
1074         struct wmi_rx_meta_v2 *meta;
1075         struct wmi_data_hdr *dhdr;
1076         int min_hdr_len;
1077         u8 meta_type, dot11_hdr = 0;
1078         int status = packet->status;
1079         enum htc_endpoint_id ept = packet->endpoint;
1080         bool is_amsdu, prev_ps, ps_state = false;
1081         struct ath6kl_sta *conn = NULL;
1082         struct sk_buff *skb1 = NULL;
1083         struct ethhdr *datap = NULL;
1084         struct ath6kl_vif *vif;
1085         u16 seq_no, offset;
1086         u8 tid, if_idx;
1087
1088         ath6kl_dbg(ATH6KL_DBG_WLAN_RX,
1089                    "%s: ar=0x%p eid=%d, skb=0x%p, data=0x%p, len=0x%x status:%d",
1090                    __func__, ar, ept, skb, packet->buf,
1091                    packet->act_len, status);
1092
1093         if (status || !(skb->data + HTC_HDR_LENGTH)) {
1094                 dev_kfree_skb(skb);
1095                 return;
1096         }
1097
1098         skb_put(skb, packet->act_len + HTC_HDR_LENGTH);
1099         skb_pull(skb, HTC_HDR_LENGTH);
1100
1101         if (ept == ar->ctrl_ep) {
1102                 if_idx =
1103                 wmi_cmd_hdr_get_if_idx((struct wmi_cmd_hdr *) skb->data);
1104         } else {
1105                 if_idx =
1106                 wmi_data_hdr_get_if_idx((struct wmi_data_hdr *) skb->data);
1107         }
1108
1109         vif = ath6kl_get_vif_by_index(ar, if_idx);
1110         if (!vif) {
1111                 dev_kfree_skb(skb);
1112                 return;
1113         }
1114
1115         /*
1116          * Take lock to protect buffer counts and adaptive power throughput
1117          * state.
1118          */
1119         spin_lock_bh(&vif->if_lock);
1120
1121         vif->net_stats.rx_packets++;
1122         vif->net_stats.rx_bytes += packet->act_len;
1123
1124         spin_unlock_bh(&vif->if_lock);
1125
1126
1127         ath6kl_dbg_dump(ATH6KL_DBG_RAW_BYTES, __func__, "rx ",
1128                         skb->data, skb->len);
1129
1130         skb->dev = vif->ndev;
1131
1132         if (!test_bit(WMI_ENABLED, &ar->flag)) {
1133                 if (EPPING_ALIGNMENT_PAD > 0)
1134                         skb_pull(skb, EPPING_ALIGNMENT_PAD);
1135                 ath6kl_deliver_frames_to_nw_stack(vif->ndev, skb);
1136                 return;
1137         }
1138
1139         ath6kl_check_wow_status(ar);
1140
1141         if (ept == ar->ctrl_ep) {
1142                 ath6kl_wmi_control_rx(ar->wmi, skb);
1143                 return;
1144         }
1145
1146         min_hdr_len = sizeof(struct ethhdr) + sizeof(struct wmi_data_hdr) +
1147                       sizeof(struct ath6kl_llc_snap_hdr);
1148
1149         dhdr = (struct wmi_data_hdr *) skb->data;
1150
1151         /*
1152          * In the case of AP mode we may receive NULL data frames
1153          * that do not have LLC hdr. They are 16 bytes in size.
1154          * Allow these frames in the AP mode.
1155          */
1156         if (vif->nw_type != AP_NETWORK &&
1157             ((packet->act_len < min_hdr_len) ||
1158              (packet->act_len > WMI_MAX_AMSDU_RX_DATA_FRAME_LENGTH))) {
1159                 ath6kl_info("frame len is too short or too long\n");
1160                 vif->net_stats.rx_errors++;
1161                 vif->net_stats.rx_length_errors++;
1162                 dev_kfree_skb(skb);
1163                 return;
1164         }
1165
1166         /* Get the Power save state of the STA */
1167         if (vif->nw_type == AP_NETWORK) {
1168                 meta_type = wmi_data_hdr_get_meta(dhdr);
1169
1170                 ps_state = !!((dhdr->info >> WMI_DATA_HDR_PS_SHIFT) &
1171                               WMI_DATA_HDR_PS_MASK);
1172
1173                 offset = sizeof(struct wmi_data_hdr);
1174
1175                 switch (meta_type) {
1176                 case 0:
1177                         break;
1178                 case WMI_META_VERSION_1:
1179                         offset += sizeof(struct wmi_rx_meta_v1);
1180                         break;
1181                 case WMI_META_VERSION_2:
1182                         offset += sizeof(struct wmi_rx_meta_v2);
1183                         break;
1184                 default:
1185                         break;
1186                 }
1187
1188                 datap = (struct ethhdr *) (skb->data + offset);
1189                 conn = ath6kl_find_sta(vif, datap->h_source);
1190
1191                 if (!conn) {
1192                         dev_kfree_skb(skb);
1193                         return;
1194                 }
1195
1196                 /*
1197                  * If there is a change in PS state of the STA,
1198                  * take appropriate steps:
1199                  *
1200                  * 1. If Sleep-->Awake, flush the psq for the STA
1201                  *    Clear the PVB for the STA.
1202                  * 2. If Awake-->Sleep, Starting queueing frames
1203                  *    the STA.
1204                  */
1205                 prev_ps = !!(conn->sta_flags & STA_PS_SLEEP);
1206
1207                 if (ps_state)
1208                         conn->sta_flags |= STA_PS_SLEEP;
1209                 else
1210                         conn->sta_flags &= ~STA_PS_SLEEP;
1211
1212                 if (prev_ps ^ !!(conn->sta_flags & STA_PS_SLEEP)) {
1213                         if (!(conn->sta_flags & STA_PS_SLEEP)) {
1214                                 struct sk_buff *skbuff = NULL;
1215
1216                                 spin_lock_bh(&conn->psq_lock);
1217                                 while ((skbuff = skb_dequeue(&conn->psq))
1218                                        != NULL) {
1219                                         spin_unlock_bh(&conn->psq_lock);
1220                                         ath6kl_data_tx(skbuff, vif->ndev);
1221                                         spin_lock_bh(&conn->psq_lock);
1222                                 }
1223                                 spin_unlock_bh(&conn->psq_lock);
1224                                 /* Clear the PVB for this STA */
1225                                 ath6kl_wmi_set_pvb_cmd(ar->wmi, vif->fw_vif_idx,
1226                                                        conn->aid, 0);
1227                         }
1228                 }
1229
1230                 /* drop NULL data frames here */
1231                 if ((packet->act_len < min_hdr_len) ||
1232                     (packet->act_len >
1233                      WMI_MAX_AMSDU_RX_DATA_FRAME_LENGTH)) {
1234                         dev_kfree_skb(skb);
1235                         return;
1236                 }
1237         }
1238
1239         is_amsdu = wmi_data_hdr_is_amsdu(dhdr) ? true : false;
1240         tid = wmi_data_hdr_get_up(dhdr);
1241         seq_no = wmi_data_hdr_get_seqno(dhdr);
1242         meta_type = wmi_data_hdr_get_meta(dhdr);
1243         dot11_hdr = wmi_data_hdr_get_dot11(dhdr);
1244         skb_pull(skb, sizeof(struct wmi_data_hdr));
1245
1246         switch (meta_type) {
1247         case WMI_META_VERSION_1:
1248                 skb_pull(skb, sizeof(struct wmi_rx_meta_v1));
1249                 break;
1250         case WMI_META_VERSION_2:
1251                 meta = (struct wmi_rx_meta_v2 *) skb->data;
1252                 if (meta->csum_flags & 0x1) {
1253                         skb->ip_summed = CHECKSUM_COMPLETE;
1254                         skb->csum = (__force __wsum) meta->csum;
1255                 }
1256                 skb_pull(skb, sizeof(struct wmi_rx_meta_v2));
1257                 break;
1258         default:
1259                 break;
1260         }
1261
1262         if (dot11_hdr)
1263                 status = ath6kl_wmi_dot11_hdr_remove(ar->wmi, skb);
1264         else if (!is_amsdu)
1265                 status = ath6kl_wmi_dot3_2_dix(skb);
1266
1267         if (status) {
1268                 /*
1269                  * Drop frames that could not be processed (lack of
1270                  * memory, etc.)
1271                  */
1272                 dev_kfree_skb(skb);
1273                 return;
1274         }
1275
1276         if (!(vif->ndev->flags & IFF_UP)) {
1277                 dev_kfree_skb(skb);
1278                 return;
1279         }
1280
1281         if (vif->nw_type == AP_NETWORK) {
1282                 datap = (struct ethhdr *) skb->data;
1283                 if (is_multicast_ether_addr(datap->h_dest))
1284                         /*
1285                          * Bcast/Mcast frames should be sent to the
1286                          * OS stack as well as on the air.
1287                          */
1288                         skb1 = skb_copy(skb, GFP_ATOMIC);
1289                 else {
1290                         /*
1291                          * Search for a connected STA with dstMac
1292                          * as the Mac address. If found send the
1293                          * frame to it on the air else send the
1294                          * frame up the stack.
1295                          */
1296                         conn = ath6kl_find_sta(vif, datap->h_dest);
1297
1298                         if (conn && ar->intra_bss) {
1299                                 skb1 = skb;
1300                                 skb = NULL;
1301                         } else if (conn && !ar->intra_bss) {
1302                                 dev_kfree_skb(skb);
1303                                 skb = NULL;
1304                         }
1305                 }
1306                 if (skb1)
1307                         ath6kl_data_tx(skb1, vif->ndev);
1308
1309                 if (skb == NULL) {
1310                         /* nothing to deliver up the stack */
1311                         return;
1312                 }
1313         }
1314
1315         datap = (struct ethhdr *) skb->data;
1316
1317         if (is_unicast_ether_addr(datap->h_dest) &&
1318             aggr_process_recv_frm(vif->aggr_cntxt, tid, seq_no,
1319                                   is_amsdu, skb))
1320                 /* aggregation code will handle the skb */
1321                 return;
1322
1323         ath6kl_deliver_frames_to_nw_stack(vif->ndev, skb);
1324 }
1325
1326 static void aggr_timeout(unsigned long arg)
1327 {
1328         u8 i, j;
1329         struct aggr_info *p_aggr = (struct aggr_info *) arg;
1330         struct rxtid *rxtid;
1331         struct rxtid_stats *stats;
1332
1333         for (i = 0; i < NUM_OF_TIDS; i++) {
1334                 rxtid = &p_aggr->rx_tid[i];
1335                 stats = &p_aggr->stat[i];
1336
1337                 if (!rxtid->aggr || !rxtid->timer_mon || rxtid->progress)
1338                         continue;
1339
1340                 stats->num_timeouts++;
1341                 ath6kl_dbg(ATH6KL_DBG_AGGR,
1342                            "aggr timeout (st %d end %d)\n",
1343                            rxtid->seq_next,
1344                            ((rxtid->seq_next + rxtid->hold_q_sz-1) &
1345                             ATH6KL_MAX_SEQ_NO));
1346                 aggr_deque_frms(p_aggr, i, 0, 0);
1347         }
1348
1349         p_aggr->timer_scheduled = false;
1350
1351         for (i = 0; i < NUM_OF_TIDS; i++) {
1352                 rxtid = &p_aggr->rx_tid[i];
1353
1354                 if (rxtid->aggr && rxtid->hold_q) {
1355                         for (j = 0; j < rxtid->hold_q_sz; j++) {
1356                                 if (rxtid->hold_q[j].skb) {
1357                                         p_aggr->timer_scheduled = true;
1358                                         rxtid->timer_mon = true;
1359                                         rxtid->progress = false;
1360                                         break;
1361                                 }
1362                         }
1363
1364                         if (j >= rxtid->hold_q_sz)
1365                                 rxtid->timer_mon = false;
1366                 }
1367         }
1368
1369         if (p_aggr->timer_scheduled)
1370                 mod_timer(&p_aggr->timer,
1371                           jiffies + msecs_to_jiffies(AGGR_RX_TIMEOUT));
1372 }
1373
1374 static void aggr_delete_tid_state(struct aggr_info *p_aggr, u8 tid)
1375 {
1376         struct rxtid *rxtid;
1377         struct rxtid_stats *stats;
1378
1379         if (!p_aggr || tid >= NUM_OF_TIDS)
1380                 return;
1381
1382         rxtid = &p_aggr->rx_tid[tid];
1383         stats = &p_aggr->stat[tid];
1384
1385         if (rxtid->aggr)
1386                 aggr_deque_frms(p_aggr, tid, 0, 0);
1387
1388         rxtid->aggr = false;
1389         rxtid->progress = false;
1390         rxtid->timer_mon = false;
1391         rxtid->win_sz = 0;
1392         rxtid->seq_next = 0;
1393         rxtid->hold_q_sz = 0;
1394
1395         kfree(rxtid->hold_q);
1396         rxtid->hold_q = NULL;
1397
1398         memset(stats, 0, sizeof(struct rxtid_stats));
1399 }
1400
1401 void aggr_recv_addba_req_evt(struct ath6kl_vif *vif, u8 tid, u16 seq_no,
1402                              u8 win_sz)
1403 {
1404         struct aggr_info *p_aggr = vif->aggr_cntxt;
1405         struct rxtid *rxtid;
1406         struct rxtid_stats *stats;
1407         u16 hold_q_size;
1408
1409         if (!p_aggr)
1410                 return;
1411
1412         rxtid = &p_aggr->rx_tid[tid];
1413         stats = &p_aggr->stat[tid];
1414
1415         if (win_sz < AGGR_WIN_SZ_MIN || win_sz > AGGR_WIN_SZ_MAX)
1416                 ath6kl_dbg(ATH6KL_DBG_WLAN_RX, "%s: win_sz %d, tid %d\n",
1417                            __func__, win_sz, tid);
1418
1419         if (rxtid->aggr)
1420                 aggr_delete_tid_state(p_aggr, tid);
1421
1422         rxtid->seq_next = seq_no;
1423         hold_q_size = TID_WINDOW_SZ(win_sz) * sizeof(struct skb_hold_q);
1424         rxtid->hold_q = kzalloc(hold_q_size, GFP_KERNEL);
1425         if (!rxtid->hold_q)
1426                 return;
1427
1428         rxtid->win_sz = win_sz;
1429         rxtid->hold_q_sz = TID_WINDOW_SZ(win_sz);
1430         if (!skb_queue_empty(&rxtid->q))
1431                 return;
1432
1433         rxtid->aggr = true;
1434 }
1435
1436 struct aggr_info *aggr_init(struct net_device *dev)
1437 {
1438         struct aggr_info *p_aggr = NULL;
1439         struct rxtid *rxtid;
1440         u8 i;
1441
1442         p_aggr = kzalloc(sizeof(struct aggr_info), GFP_KERNEL);
1443         if (!p_aggr) {
1444                 ath6kl_err("failed to alloc memory for aggr_node\n");
1445                 return NULL;
1446         }
1447
1448         p_aggr->aggr_sz = AGGR_SZ_DEFAULT;
1449         p_aggr->dev = dev;
1450         init_timer(&p_aggr->timer);
1451         p_aggr->timer.function = aggr_timeout;
1452         p_aggr->timer.data = (unsigned long) p_aggr;
1453
1454         p_aggr->timer_scheduled = false;
1455         skb_queue_head_init(&p_aggr->free_q);
1456
1457         ath6kl_alloc_netbufs(&p_aggr->free_q, AGGR_NUM_OF_FREE_NETBUFS);
1458
1459         for (i = 0; i < NUM_OF_TIDS; i++) {
1460                 rxtid = &p_aggr->rx_tid[i];
1461                 rxtid->aggr = false;
1462                 rxtid->progress = false;
1463                 rxtid->timer_mon = false;
1464                 skb_queue_head_init(&rxtid->q);
1465                 spin_lock_init(&rxtid->lock);
1466         }
1467
1468         return p_aggr;
1469 }
1470
1471 void aggr_recv_delba_req_evt(struct ath6kl_vif *vif, u8 tid)
1472 {
1473         struct aggr_info *p_aggr = vif->aggr_cntxt;
1474         struct rxtid *rxtid;
1475
1476         if (!p_aggr)
1477                 return;
1478
1479         rxtid = &p_aggr->rx_tid[tid];
1480
1481         if (rxtid->aggr)
1482                 aggr_delete_tid_state(p_aggr, tid);
1483 }
1484
1485 void aggr_reset_state(struct aggr_info *aggr_info)
1486 {
1487         u8 tid;
1488
1489         for (tid = 0; tid < NUM_OF_TIDS; tid++)
1490                 aggr_delete_tid_state(aggr_info, tid);
1491 }
1492
1493 /* clean up our amsdu buffer list */
1494 void ath6kl_cleanup_amsdu_rxbufs(struct ath6kl *ar)
1495 {
1496         struct htc_packet *packet, *tmp_pkt;
1497
1498         spin_lock_bh(&ar->lock);
1499         if (list_empty(&ar->amsdu_rx_buffer_queue)) {
1500                 spin_unlock_bh(&ar->lock);
1501                 return;
1502         }
1503
1504         list_for_each_entry_safe(packet, tmp_pkt, &ar->amsdu_rx_buffer_queue,
1505                                  list) {
1506                 list_del(&packet->list);
1507                 spin_unlock_bh(&ar->lock);
1508                 dev_kfree_skb(packet->pkt_cntxt);
1509                 spin_lock_bh(&ar->lock);
1510         }
1511
1512         spin_unlock_bh(&ar->lock);
1513 }
1514
1515 void aggr_module_destroy(struct aggr_info *aggr_info)
1516 {
1517         struct rxtid *rxtid;
1518         u8 i, k;
1519
1520         if (!aggr_info)
1521                 return;
1522
1523         if (aggr_info->timer_scheduled) {
1524                 del_timer(&aggr_info->timer);
1525                 aggr_info->timer_scheduled = false;
1526         }
1527
1528         for (i = 0; i < NUM_OF_TIDS; i++) {
1529                 rxtid = &aggr_info->rx_tid[i];
1530                 if (rxtid->hold_q) {
1531                         for (k = 0; k < rxtid->hold_q_sz; k++)
1532                                 dev_kfree_skb(rxtid->hold_q[k].skb);
1533                         kfree(rxtid->hold_q);
1534                 }
1535
1536                 skb_queue_purge(&rxtid->q);
1537         }
1538
1539         skb_queue_purge(&aggr_info->free_q);
1540         kfree(aggr_info);
1541 }