mwl8k.c revision eb93992207dadb946a3b5cf4544957dc924a6f58
1/*
2 * drivers/net/wireless/mwl8k.c
3 * Driver for Marvell TOPDOG 802.11 Wireless cards
4 *
5 * Copyright (C) 2008, 2009, 2010 Marvell Semiconductor Inc.
6 *
7 * This file is licensed under the terms of the GNU General Public
8 * License version 2.  This program is licensed "as is" without any
9 * warranty of any kind, whether express or implied.
10 */
11
12#include <linux/init.h>
13#include <linux/interrupt.h>
14#include <linux/module.h>
15#include <linux/kernel.h>
16#include <linux/sched.h>
17#include <linux/spinlock.h>
18#include <linux/list.h>
19#include <linux/pci.h>
20#include <linux/delay.h>
21#include <linux/completion.h>
22#include <linux/etherdevice.h>
23#include <linux/slab.h>
24#include <net/mac80211.h>
25#include <linux/moduleparam.h>
26#include <linux/firmware.h>
27#include <linux/workqueue.h>
28
29#define MWL8K_DESC	"Marvell TOPDOG(R) 802.11 Wireless Network Driver"
30#define MWL8K_NAME	KBUILD_MODNAME
31#define MWL8K_VERSION	"0.12"
32
33/* Module parameters */
34static bool ap_mode_default;
35module_param(ap_mode_default, bool, 0);
36MODULE_PARM_DESC(ap_mode_default,
37		 "Set to 1 to make ap mode the default instead of sta mode");
38
39/* Register definitions */
40#define MWL8K_HIU_GEN_PTR			0x00000c10
41#define  MWL8K_MODE_STA				 0x0000005a
42#define  MWL8K_MODE_AP				 0x000000a5
43#define MWL8K_HIU_INT_CODE			0x00000c14
44#define  MWL8K_FWSTA_READY			 0xf0f1f2f4
45#define  MWL8K_FWAP_READY			 0xf1f2f4a5
46#define  MWL8K_INT_CODE_CMD_FINISHED		 0x00000005
47#define MWL8K_HIU_SCRATCH			0x00000c40
48
49/* Host->device communications */
50#define MWL8K_HIU_H2A_INTERRUPT_EVENTS		0x00000c18
51#define MWL8K_HIU_H2A_INTERRUPT_STATUS		0x00000c1c
52#define MWL8K_HIU_H2A_INTERRUPT_MASK		0x00000c20
53#define MWL8K_HIU_H2A_INTERRUPT_CLEAR_SEL	0x00000c24
54#define MWL8K_HIU_H2A_INTERRUPT_STATUS_MASK	0x00000c28
55#define  MWL8K_H2A_INT_DUMMY			 (1 << 20)
56#define  MWL8K_H2A_INT_RESET			 (1 << 15)
57#define  MWL8K_H2A_INT_DOORBELL			 (1 << 1)
58#define  MWL8K_H2A_INT_PPA_READY		 (1 << 0)
59
60/* Device->host communications */
61#define MWL8K_HIU_A2H_INTERRUPT_EVENTS		0x00000c2c
62#define MWL8K_HIU_A2H_INTERRUPT_STATUS		0x00000c30
63#define MWL8K_HIU_A2H_INTERRUPT_MASK		0x00000c34
64#define MWL8K_HIU_A2H_INTERRUPT_CLEAR_SEL	0x00000c38
65#define MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK	0x00000c3c
66#define  MWL8K_A2H_INT_DUMMY			 (1 << 20)
67#define  MWL8K_A2H_INT_BA_WATCHDOG		 (1 << 14)
68#define  MWL8K_A2H_INT_CHNL_SWITCHED		 (1 << 11)
69#define  MWL8K_A2H_INT_QUEUE_EMPTY		 (1 << 10)
70#define  MWL8K_A2H_INT_RADAR_DETECT		 (1 << 7)
71#define  MWL8K_A2H_INT_RADIO_ON			 (1 << 6)
72#define  MWL8K_A2H_INT_RADIO_OFF		 (1 << 5)
73#define  MWL8K_A2H_INT_MAC_EVENT		 (1 << 3)
74#define  MWL8K_A2H_INT_OPC_DONE			 (1 << 2)
75#define  MWL8K_A2H_INT_RX_READY			 (1 << 1)
76#define  MWL8K_A2H_INT_TX_DONE			 (1 << 0)
77
78/* HW micro second timer register
79 * located at offset 0xA600. This
80 * will be used to timestamp tx
81 * packets.
82 */
83
84#define	MWL8K_HW_TIMER_REGISTER			0x0000a600
85
86#define MWL8K_A2H_EVENTS	(MWL8K_A2H_INT_DUMMY | \
87				 MWL8K_A2H_INT_CHNL_SWITCHED | \
88				 MWL8K_A2H_INT_QUEUE_EMPTY | \
89				 MWL8K_A2H_INT_RADAR_DETECT | \
90				 MWL8K_A2H_INT_RADIO_ON | \
91				 MWL8K_A2H_INT_RADIO_OFF | \
92				 MWL8K_A2H_INT_MAC_EVENT | \
93				 MWL8K_A2H_INT_OPC_DONE | \
94				 MWL8K_A2H_INT_RX_READY | \
95				 MWL8K_A2H_INT_TX_DONE | \
96				 MWL8K_A2H_INT_BA_WATCHDOG)
97
98#define MWL8K_RX_QUEUES		1
99#define MWL8K_TX_WMM_QUEUES	4
100#define MWL8K_MAX_AMPDU_QUEUES	8
101#define MWL8K_MAX_TX_QUEUES	(MWL8K_TX_WMM_QUEUES + MWL8K_MAX_AMPDU_QUEUES)
102#define mwl8k_tx_queues(priv)	(MWL8K_TX_WMM_QUEUES + (priv)->num_ampdu_queues)
103
104struct rxd_ops {
105	int rxd_size;
106	void (*rxd_init)(void *rxd, dma_addr_t next_dma_addr);
107	void (*rxd_refill)(void *rxd, dma_addr_t addr, int len);
108	int (*rxd_process)(void *rxd, struct ieee80211_rx_status *status,
109			   __le16 *qos, s8 *noise);
110};
111
112struct mwl8k_device_info {
113	char *part_name;
114	char *helper_image;
115	char *fw_image_sta;
116	char *fw_image_ap;
117	struct rxd_ops *ap_rxd_ops;
118	u32 fw_api_ap;
119};
120
121struct mwl8k_rx_queue {
122	int rxd_count;
123
124	/* hw receives here */
125	int head;
126
127	/* refill descs here */
128	int tail;
129
130	void *rxd;
131	dma_addr_t rxd_dma;
132	struct {
133		struct sk_buff *skb;
134		DEFINE_DMA_UNMAP_ADDR(dma);
135	} *buf;
136};
137
138struct mwl8k_tx_queue {
139	/* hw transmits here */
140	int head;
141
142	/* sw appends here */
143	int tail;
144
145	unsigned int len;
146	struct mwl8k_tx_desc *txd;
147	dma_addr_t txd_dma;
148	struct sk_buff **skb;
149};
150
151enum {
152	AMPDU_NO_STREAM,
153	AMPDU_STREAM_NEW,
154	AMPDU_STREAM_IN_PROGRESS,
155	AMPDU_STREAM_ACTIVE,
156};
157
158struct mwl8k_ampdu_stream {
159	struct ieee80211_sta *sta;
160	u8 tid;
161	u8 state;
162	u8 idx;
163	u8 txq_idx; /* index of this stream in priv->txq */
164};
165
166struct mwl8k_priv {
167	struct ieee80211_hw *hw;
168	struct pci_dev *pdev;
169	int irq;
170
171	struct mwl8k_device_info *device_info;
172
173	void __iomem *sram;
174	void __iomem *regs;
175
176	/* firmware */
177	const struct firmware *fw_helper;
178	const struct firmware *fw_ucode;
179
180	/* hardware/firmware parameters */
181	bool ap_fw;
182	struct rxd_ops *rxd_ops;
183	struct ieee80211_supported_band band_24;
184	struct ieee80211_channel channels_24[14];
185	struct ieee80211_rate rates_24[14];
186	struct ieee80211_supported_band band_50;
187	struct ieee80211_channel channels_50[4];
188	struct ieee80211_rate rates_50[9];
189	u32 ap_macids_supported;
190	u32 sta_macids_supported;
191
192	/* Ampdu stream information */
193	u8 num_ampdu_queues;
194	spinlock_t stream_lock;
195	struct mwl8k_ampdu_stream ampdu[MWL8K_MAX_AMPDU_QUEUES];
196	struct work_struct watchdog_ba_handle;
197
198	/* firmware access */
199	struct mutex fw_mutex;
200	struct task_struct *fw_mutex_owner;
201	int fw_mutex_depth;
202	struct completion *hostcmd_wait;
203
204	/* lock held over TX and TX reap */
205	spinlock_t tx_lock;
206
207	/* TX quiesce completion, protected by fw_mutex and tx_lock */
208	struct completion *tx_wait;
209
210	/* List of interfaces.  */
211	u32 macids_used;
212	struct list_head vif_list;
213
214	/* power management status cookie from firmware */
215	u32 *cookie;
216	dma_addr_t cookie_dma;
217
218	u16 num_mcaddrs;
219	u8 hw_rev;
220	u32 fw_rev;
221
222	/*
223	 * Running count of TX packets in flight, to avoid
224	 * iterating over the transmit rings each time.
225	 */
226	int pending_tx_pkts;
227
228	struct mwl8k_rx_queue rxq[MWL8K_RX_QUEUES];
229	struct mwl8k_tx_queue txq[MWL8K_MAX_TX_QUEUES];
230	u32 txq_offset[MWL8K_MAX_TX_QUEUES];
231
232	bool radio_on;
233	bool radio_short_preamble;
234	bool sniffer_enabled;
235	bool wmm_enabled;
236
237	/* XXX need to convert this to handle multiple interfaces */
238	bool capture_beacon;
239	u8 capture_bssid[ETH_ALEN];
240	struct sk_buff *beacon_skb;
241
242	/*
243	 * This FJ worker has to be global as it is scheduled from the
244	 * RX handler.  At this point we don't know which interface it
245	 * belongs to until the list of bssids waiting to complete join
246	 * is checked.
247	 */
248	struct work_struct finalize_join_worker;
249
250	/* Tasklet to perform TX reclaim.  */
251	struct tasklet_struct poll_tx_task;
252
253	/* Tasklet to perform RX.  */
254	struct tasklet_struct poll_rx_task;
255
256	/* Most recently reported noise in dBm */
257	s8 noise;
258
259	/*
260	 * preserve the queue configurations so they can be restored if/when
261	 * the firmware image is swapped.
262	 */
263	struct ieee80211_tx_queue_params wmm_params[MWL8K_TX_WMM_QUEUES];
264
265	/* async firmware loading state */
266	unsigned fw_state;
267	char *fw_pref;
268	char *fw_alt;
269	struct completion firmware_loading_complete;
270};
271
272#define MAX_WEP_KEY_LEN         13
273#define NUM_WEP_KEYS            4
274
275/* Per interface specific private data */
276struct mwl8k_vif {
277	struct list_head list;
278	struct ieee80211_vif *vif;
279
280	/* Firmware macid for this vif.  */
281	int macid;
282
283	/* Non AMPDU sequence number assigned by driver.  */
284	u16 seqno;
285
286	/* Saved WEP keys */
287	struct {
288		u8 enabled;
289		u8 key[sizeof(struct ieee80211_key_conf) + MAX_WEP_KEY_LEN];
290	} wep_key_conf[NUM_WEP_KEYS];
291
292	/* BSSID */
293	u8 bssid[ETH_ALEN];
294
295	/* A flag to indicate is HW crypto is enabled for this bssid */
296	bool is_hw_crypto_enabled;
297};
298#define MWL8K_VIF(_vif) ((struct mwl8k_vif *)&((_vif)->drv_priv))
299#define IEEE80211_KEY_CONF(_u8) ((struct ieee80211_key_conf *)(_u8))
300
301struct tx_traffic_info {
302	u32 start_time;
303	u32 pkts;
304};
305
306#define MWL8K_MAX_TID 8
307struct mwl8k_sta {
308	/* Index into station database. Returned by UPDATE_STADB.  */
309	u8 peer_id;
310	u8 is_ampdu_allowed;
311	struct tx_traffic_info tx_stats[MWL8K_MAX_TID];
312};
313#define MWL8K_STA(_sta) ((struct mwl8k_sta *)&((_sta)->drv_priv))
314
315static const struct ieee80211_channel mwl8k_channels_24[] = {
316	{ .center_freq = 2412, .hw_value = 1, },
317	{ .center_freq = 2417, .hw_value = 2, },
318	{ .center_freq = 2422, .hw_value = 3, },
319	{ .center_freq = 2427, .hw_value = 4, },
320	{ .center_freq = 2432, .hw_value = 5, },
321	{ .center_freq = 2437, .hw_value = 6, },
322	{ .center_freq = 2442, .hw_value = 7, },
323	{ .center_freq = 2447, .hw_value = 8, },
324	{ .center_freq = 2452, .hw_value = 9, },
325	{ .center_freq = 2457, .hw_value = 10, },
326	{ .center_freq = 2462, .hw_value = 11, },
327	{ .center_freq = 2467, .hw_value = 12, },
328	{ .center_freq = 2472, .hw_value = 13, },
329	{ .center_freq = 2484, .hw_value = 14, },
330};
331
332static const struct ieee80211_rate mwl8k_rates_24[] = {
333	{ .bitrate = 10, .hw_value = 2, },
334	{ .bitrate = 20, .hw_value = 4, },
335	{ .bitrate = 55, .hw_value = 11, },
336	{ .bitrate = 110, .hw_value = 22, },
337	{ .bitrate = 220, .hw_value = 44, },
338	{ .bitrate = 60, .hw_value = 12, },
339	{ .bitrate = 90, .hw_value = 18, },
340	{ .bitrate = 120, .hw_value = 24, },
341	{ .bitrate = 180, .hw_value = 36, },
342	{ .bitrate = 240, .hw_value = 48, },
343	{ .bitrate = 360, .hw_value = 72, },
344	{ .bitrate = 480, .hw_value = 96, },
345	{ .bitrate = 540, .hw_value = 108, },
346	{ .bitrate = 720, .hw_value = 144, },
347};
348
349static const struct ieee80211_channel mwl8k_channels_50[] = {
350	{ .center_freq = 5180, .hw_value = 36, },
351	{ .center_freq = 5200, .hw_value = 40, },
352	{ .center_freq = 5220, .hw_value = 44, },
353	{ .center_freq = 5240, .hw_value = 48, },
354};
355
356static const struct ieee80211_rate mwl8k_rates_50[] = {
357	{ .bitrate = 60, .hw_value = 12, },
358	{ .bitrate = 90, .hw_value = 18, },
359	{ .bitrate = 120, .hw_value = 24, },
360	{ .bitrate = 180, .hw_value = 36, },
361	{ .bitrate = 240, .hw_value = 48, },
362	{ .bitrate = 360, .hw_value = 72, },
363	{ .bitrate = 480, .hw_value = 96, },
364	{ .bitrate = 540, .hw_value = 108, },
365	{ .bitrate = 720, .hw_value = 144, },
366};
367
368/* Set or get info from Firmware */
369#define MWL8K_CMD_GET			0x0000
370#define MWL8K_CMD_SET			0x0001
371#define MWL8K_CMD_SET_LIST		0x0002
372
373/* Firmware command codes */
374#define MWL8K_CMD_CODE_DNLD		0x0001
375#define MWL8K_CMD_GET_HW_SPEC		0x0003
376#define MWL8K_CMD_SET_HW_SPEC		0x0004
377#define MWL8K_CMD_MAC_MULTICAST_ADR	0x0010
378#define MWL8K_CMD_GET_STAT		0x0014
379#define MWL8K_CMD_RADIO_CONTROL		0x001c
380#define MWL8K_CMD_RF_TX_POWER		0x001e
381#define MWL8K_CMD_TX_POWER		0x001f
382#define MWL8K_CMD_RF_ANTENNA		0x0020
383#define MWL8K_CMD_SET_BEACON		0x0100		/* per-vif */
384#define MWL8K_CMD_SET_PRE_SCAN		0x0107
385#define MWL8K_CMD_SET_POST_SCAN		0x0108
386#define MWL8K_CMD_SET_RF_CHANNEL	0x010a
387#define MWL8K_CMD_SET_AID		0x010d
388#define MWL8K_CMD_SET_RATE		0x0110
389#define MWL8K_CMD_SET_FINALIZE_JOIN	0x0111
390#define MWL8K_CMD_RTS_THRESHOLD		0x0113
391#define MWL8K_CMD_SET_SLOT		0x0114
392#define MWL8K_CMD_SET_EDCA_PARAMS	0x0115
393#define MWL8K_CMD_SET_WMM_MODE		0x0123
394#define MWL8K_CMD_MIMO_CONFIG		0x0125
395#define MWL8K_CMD_USE_FIXED_RATE	0x0126
396#define MWL8K_CMD_ENABLE_SNIFFER	0x0150
397#define MWL8K_CMD_SET_MAC_ADDR		0x0202		/* per-vif */
398#define MWL8K_CMD_SET_RATEADAPT_MODE	0x0203
399#define MWL8K_CMD_GET_WATCHDOG_BITMAP	0x0205
400#define MWL8K_CMD_BSS_START		0x1100		/* per-vif */
401#define MWL8K_CMD_SET_NEW_STN		0x1111		/* per-vif */
402#define MWL8K_CMD_UPDATE_ENCRYPTION	0x1122		/* per-vif */
403#define MWL8K_CMD_UPDATE_STADB		0x1123
404#define MWL8K_CMD_BASTREAM		0x1125
405
406static const char *mwl8k_cmd_name(__le16 cmd, char *buf, int bufsize)
407{
408	u16 command = le16_to_cpu(cmd);
409
410#define MWL8K_CMDNAME(x)	case MWL8K_CMD_##x: do {\
411					snprintf(buf, bufsize, "%s", #x);\
412					return buf;\
413					} while (0)
414	switch (command & ~0x8000) {
415		MWL8K_CMDNAME(CODE_DNLD);
416		MWL8K_CMDNAME(GET_HW_SPEC);
417		MWL8K_CMDNAME(SET_HW_SPEC);
418		MWL8K_CMDNAME(MAC_MULTICAST_ADR);
419		MWL8K_CMDNAME(GET_STAT);
420		MWL8K_CMDNAME(RADIO_CONTROL);
421		MWL8K_CMDNAME(RF_TX_POWER);
422		MWL8K_CMDNAME(TX_POWER);
423		MWL8K_CMDNAME(RF_ANTENNA);
424		MWL8K_CMDNAME(SET_BEACON);
425		MWL8K_CMDNAME(SET_PRE_SCAN);
426		MWL8K_CMDNAME(SET_POST_SCAN);
427		MWL8K_CMDNAME(SET_RF_CHANNEL);
428		MWL8K_CMDNAME(SET_AID);
429		MWL8K_CMDNAME(SET_RATE);
430		MWL8K_CMDNAME(SET_FINALIZE_JOIN);
431		MWL8K_CMDNAME(RTS_THRESHOLD);
432		MWL8K_CMDNAME(SET_SLOT);
433		MWL8K_CMDNAME(SET_EDCA_PARAMS);
434		MWL8K_CMDNAME(SET_WMM_MODE);
435		MWL8K_CMDNAME(MIMO_CONFIG);
436		MWL8K_CMDNAME(USE_FIXED_RATE);
437		MWL8K_CMDNAME(ENABLE_SNIFFER);
438		MWL8K_CMDNAME(SET_MAC_ADDR);
439		MWL8K_CMDNAME(SET_RATEADAPT_MODE);
440		MWL8K_CMDNAME(BSS_START);
441		MWL8K_CMDNAME(SET_NEW_STN);
442		MWL8K_CMDNAME(UPDATE_ENCRYPTION);
443		MWL8K_CMDNAME(UPDATE_STADB);
444		MWL8K_CMDNAME(BASTREAM);
445		MWL8K_CMDNAME(GET_WATCHDOG_BITMAP);
446	default:
447		snprintf(buf, bufsize, "0x%x", cmd);
448	}
449#undef MWL8K_CMDNAME
450
451	return buf;
452}
453
454/* Hardware and firmware reset */
455static void mwl8k_hw_reset(struct mwl8k_priv *priv)
456{
457	iowrite32(MWL8K_H2A_INT_RESET,
458		priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
459	iowrite32(MWL8K_H2A_INT_RESET,
460		priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
461	msleep(20);
462}
463
464/* Release fw image */
465static void mwl8k_release_fw(const struct firmware **fw)
466{
467	if (*fw == NULL)
468		return;
469	release_firmware(*fw);
470	*fw = NULL;
471}
472
473static void mwl8k_release_firmware(struct mwl8k_priv *priv)
474{
475	mwl8k_release_fw(&priv->fw_ucode);
476	mwl8k_release_fw(&priv->fw_helper);
477}
478
479/* states for asynchronous f/w loading */
480static void mwl8k_fw_state_machine(const struct firmware *fw, void *context);
481enum {
482	FW_STATE_INIT = 0,
483	FW_STATE_LOADING_PREF,
484	FW_STATE_LOADING_ALT,
485	FW_STATE_ERROR,
486};
487
488/* Request fw image */
489static int mwl8k_request_fw(struct mwl8k_priv *priv,
490			    const char *fname, const struct firmware **fw,
491			    bool nowait)
492{
493	/* release current image */
494	if (*fw != NULL)
495		mwl8k_release_fw(fw);
496
497	if (nowait)
498		return request_firmware_nowait(THIS_MODULE, 1, fname,
499					       &priv->pdev->dev, GFP_KERNEL,
500					       priv, mwl8k_fw_state_machine);
501	else
502		return request_firmware(fw, fname, &priv->pdev->dev);
503}
504
505static int mwl8k_request_firmware(struct mwl8k_priv *priv, char *fw_image,
506				  bool nowait)
507{
508	struct mwl8k_device_info *di = priv->device_info;
509	int rc;
510
511	if (di->helper_image != NULL) {
512		if (nowait)
513			rc = mwl8k_request_fw(priv, di->helper_image,
514					      &priv->fw_helper, true);
515		else
516			rc = mwl8k_request_fw(priv, di->helper_image,
517					      &priv->fw_helper, false);
518		if (rc)
519			printk(KERN_ERR "%s: Error requesting helper fw %s\n",
520			       pci_name(priv->pdev), di->helper_image);
521
522		if (rc || nowait)
523			return rc;
524	}
525
526	if (nowait) {
527		/*
528		 * if we get here, no helper image is needed.  Skip the
529		 * FW_STATE_INIT state.
530		 */
531		priv->fw_state = FW_STATE_LOADING_PREF;
532		rc = mwl8k_request_fw(priv, fw_image,
533				      &priv->fw_ucode,
534				      true);
535	} else
536		rc = mwl8k_request_fw(priv, fw_image,
537				      &priv->fw_ucode, false);
538	if (rc) {
539		printk(KERN_ERR "%s: Error requesting firmware file %s\n",
540		       pci_name(priv->pdev), fw_image);
541		mwl8k_release_fw(&priv->fw_helper);
542		return rc;
543	}
544
545	return 0;
546}
547
548struct mwl8k_cmd_pkt {
549	__le16	code;
550	__le16	length;
551	__u8	seq_num;
552	__u8	macid;
553	__le16	result;
554	char	payload[0];
555} __packed;
556
557/*
558 * Firmware loading.
559 */
560static int
561mwl8k_send_fw_load_cmd(struct mwl8k_priv *priv, void *data, int length)
562{
563	void __iomem *regs = priv->regs;
564	dma_addr_t dma_addr;
565	int loops;
566
567	dma_addr = pci_map_single(priv->pdev, data, length, PCI_DMA_TODEVICE);
568	if (pci_dma_mapping_error(priv->pdev, dma_addr))
569		return -ENOMEM;
570
571	iowrite32(dma_addr, regs + MWL8K_HIU_GEN_PTR);
572	iowrite32(0, regs + MWL8K_HIU_INT_CODE);
573	iowrite32(MWL8K_H2A_INT_DOORBELL,
574		regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
575	iowrite32(MWL8K_H2A_INT_DUMMY,
576		regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
577
578	loops = 1000;
579	do {
580		u32 int_code;
581
582		int_code = ioread32(regs + MWL8K_HIU_INT_CODE);
583		if (int_code == MWL8K_INT_CODE_CMD_FINISHED) {
584			iowrite32(0, regs + MWL8K_HIU_INT_CODE);
585			break;
586		}
587
588		cond_resched();
589		udelay(1);
590	} while (--loops);
591
592	pci_unmap_single(priv->pdev, dma_addr, length, PCI_DMA_TODEVICE);
593
594	return loops ? 0 : -ETIMEDOUT;
595}
596
597static int mwl8k_load_fw_image(struct mwl8k_priv *priv,
598				const u8 *data, size_t length)
599{
600	struct mwl8k_cmd_pkt *cmd;
601	int done;
602	int rc = 0;
603
604	cmd = kmalloc(sizeof(*cmd) + 256, GFP_KERNEL);
605	if (cmd == NULL)
606		return -ENOMEM;
607
608	cmd->code = cpu_to_le16(MWL8K_CMD_CODE_DNLD);
609	cmd->seq_num = 0;
610	cmd->macid = 0;
611	cmd->result = 0;
612
613	done = 0;
614	while (length) {
615		int block_size = length > 256 ? 256 : length;
616
617		memcpy(cmd->payload, data + done, block_size);
618		cmd->length = cpu_to_le16(block_size);
619
620		rc = mwl8k_send_fw_load_cmd(priv, cmd,
621						sizeof(*cmd) + block_size);
622		if (rc)
623			break;
624
625		done += block_size;
626		length -= block_size;
627	}
628
629	if (!rc) {
630		cmd->length = 0;
631		rc = mwl8k_send_fw_load_cmd(priv, cmd, sizeof(*cmd));
632	}
633
634	kfree(cmd);
635
636	return rc;
637}
638
639static int mwl8k_feed_fw_image(struct mwl8k_priv *priv,
640				const u8 *data, size_t length)
641{
642	unsigned char *buffer;
643	int may_continue, rc = 0;
644	u32 done, prev_block_size;
645
646	buffer = kmalloc(1024, GFP_KERNEL);
647	if (buffer == NULL)
648		return -ENOMEM;
649
650	done = 0;
651	prev_block_size = 0;
652	may_continue = 1000;
653	while (may_continue > 0) {
654		u32 block_size;
655
656		block_size = ioread32(priv->regs + MWL8K_HIU_SCRATCH);
657		if (block_size & 1) {
658			block_size &= ~1;
659			may_continue--;
660		} else {
661			done += prev_block_size;
662			length -= prev_block_size;
663		}
664
665		if (block_size > 1024 || block_size > length) {
666			rc = -EOVERFLOW;
667			break;
668		}
669
670		if (length == 0) {
671			rc = 0;
672			break;
673		}
674
675		if (block_size == 0) {
676			rc = -EPROTO;
677			may_continue--;
678			udelay(1);
679			continue;
680		}
681
682		prev_block_size = block_size;
683		memcpy(buffer, data + done, block_size);
684
685		rc = mwl8k_send_fw_load_cmd(priv, buffer, block_size);
686		if (rc)
687			break;
688	}
689
690	if (!rc && length != 0)
691		rc = -EREMOTEIO;
692
693	kfree(buffer);
694
695	return rc;
696}
697
698static int mwl8k_load_firmware(struct ieee80211_hw *hw)
699{
700	struct mwl8k_priv *priv = hw->priv;
701	const struct firmware *fw = priv->fw_ucode;
702	int rc;
703	int loops;
704
705	if (!memcmp(fw->data, "\x01\x00\x00\x00", 4)) {
706		const struct firmware *helper = priv->fw_helper;
707
708		if (helper == NULL) {
709			printk(KERN_ERR "%s: helper image needed but none "
710			       "given\n", pci_name(priv->pdev));
711			return -EINVAL;
712		}
713
714		rc = mwl8k_load_fw_image(priv, helper->data, helper->size);
715		if (rc) {
716			printk(KERN_ERR "%s: unable to load firmware "
717			       "helper image\n", pci_name(priv->pdev));
718			return rc;
719		}
720		msleep(20);
721
722		rc = mwl8k_feed_fw_image(priv, fw->data, fw->size);
723	} else {
724		rc = mwl8k_load_fw_image(priv, fw->data, fw->size);
725	}
726
727	if (rc) {
728		printk(KERN_ERR "%s: unable to load firmware image\n",
729		       pci_name(priv->pdev));
730		return rc;
731	}
732
733	iowrite32(MWL8K_MODE_STA, priv->regs + MWL8K_HIU_GEN_PTR);
734
735	loops = 500000;
736	do {
737		u32 ready_code;
738
739		ready_code = ioread32(priv->regs + MWL8K_HIU_INT_CODE);
740		if (ready_code == MWL8K_FWAP_READY) {
741			priv->ap_fw = true;
742			break;
743		} else if (ready_code == MWL8K_FWSTA_READY) {
744			priv->ap_fw = false;
745			break;
746		}
747
748		cond_resched();
749		udelay(1);
750	} while (--loops);
751
752	return loops ? 0 : -ETIMEDOUT;
753}
754
755
756/* DMA header used by firmware and hardware.  */
757struct mwl8k_dma_data {
758	__le16 fwlen;
759	struct ieee80211_hdr wh;
760	char data[0];
761} __packed;
762
763/* Routines to add/remove DMA header from skb.  */
764static inline void mwl8k_remove_dma_header(struct sk_buff *skb, __le16 qos)
765{
766	struct mwl8k_dma_data *tr;
767	int hdrlen;
768
769	tr = (struct mwl8k_dma_data *)skb->data;
770	hdrlen = ieee80211_hdrlen(tr->wh.frame_control);
771
772	if (hdrlen != sizeof(tr->wh)) {
773		if (ieee80211_is_data_qos(tr->wh.frame_control)) {
774			memmove(tr->data - hdrlen, &tr->wh, hdrlen - 2);
775			*((__le16 *)(tr->data - 2)) = qos;
776		} else {
777			memmove(tr->data - hdrlen, &tr->wh, hdrlen);
778		}
779	}
780
781	if (hdrlen != sizeof(*tr))
782		skb_pull(skb, sizeof(*tr) - hdrlen);
783}
784
785#define REDUCED_TX_HEADROOM	8
786
787static void
788mwl8k_add_dma_header(struct mwl8k_priv *priv, struct sk_buff *skb,
789						int head_pad, int tail_pad)
790{
791	struct ieee80211_hdr *wh;
792	int hdrlen;
793	int reqd_hdrlen;
794	struct mwl8k_dma_data *tr;
795
796	/*
797	 * Add a firmware DMA header; the firmware requires that we
798	 * present a 2-byte payload length followed by a 4-address
799	 * header (without QoS field), followed (optionally) by any
800	 * WEP/ExtIV header (but only filled in for CCMP).
801	 */
802	wh = (struct ieee80211_hdr *)skb->data;
803
804	hdrlen = ieee80211_hdrlen(wh->frame_control);
805
806	/*
807	 * Check if skb_resize is required because of
808	 * tx_headroom adjustment.
809	 */
810	if (priv->ap_fw && (hdrlen < (sizeof(struct ieee80211_cts)
811						+ REDUCED_TX_HEADROOM))) {
812		if (pskb_expand_head(skb, REDUCED_TX_HEADROOM, 0, GFP_ATOMIC)) {
813
814			wiphy_err(priv->hw->wiphy,
815					"Failed to reallocate TX buffer\n");
816			return;
817		}
818		skb->truesize += REDUCED_TX_HEADROOM;
819	}
820
821	reqd_hdrlen = sizeof(*tr) + head_pad;
822
823	if (hdrlen != reqd_hdrlen)
824		skb_push(skb, reqd_hdrlen - hdrlen);
825
826	if (ieee80211_is_data_qos(wh->frame_control))
827		hdrlen -= IEEE80211_QOS_CTL_LEN;
828
829	tr = (struct mwl8k_dma_data *)skb->data;
830	if (wh != &tr->wh)
831		memmove(&tr->wh, wh, hdrlen);
832	if (hdrlen != sizeof(tr->wh))
833		memset(((void *)&tr->wh) + hdrlen, 0, sizeof(tr->wh) - hdrlen);
834
835	/*
836	 * Firmware length is the length of the fully formed "802.11
837	 * payload".  That is, everything except for the 802.11 header.
838	 * This includes all crypto material including the MIC.
839	 */
840	tr->fwlen = cpu_to_le16(skb->len - sizeof(*tr) + tail_pad);
841}
842
843static void mwl8k_encapsulate_tx_frame(struct mwl8k_priv *priv,
844		struct sk_buff *skb)
845{
846	struct ieee80211_hdr *wh;
847	struct ieee80211_tx_info *tx_info;
848	struct ieee80211_key_conf *key_conf;
849	int data_pad;
850	int head_pad = 0;
851
852	wh = (struct ieee80211_hdr *)skb->data;
853
854	tx_info = IEEE80211_SKB_CB(skb);
855
856	key_conf = NULL;
857	if (ieee80211_is_data(wh->frame_control))
858		key_conf = tx_info->control.hw_key;
859
860	/*
861	 * Make sure the packet header is in the DMA header format (4-address
862	 * without QoS), and add head & tail padding when HW crypto is enabled.
863	 *
864	 * We have the following trailer padding requirements:
865	 * - WEP: 4 trailer bytes (ICV)
866	 * - TKIP: 12 trailer bytes (8 MIC + 4 ICV)
867	 * - CCMP: 8 trailer bytes (MIC)
868	 */
869	data_pad = 0;
870	if (key_conf != NULL) {
871		head_pad = key_conf->iv_len;
872		switch (key_conf->cipher) {
873		case WLAN_CIPHER_SUITE_WEP40:
874		case WLAN_CIPHER_SUITE_WEP104:
875			data_pad = 4;
876			break;
877		case WLAN_CIPHER_SUITE_TKIP:
878			data_pad = 12;
879			break;
880		case WLAN_CIPHER_SUITE_CCMP:
881			data_pad = 8;
882			break;
883		}
884	}
885	mwl8k_add_dma_header(priv, skb, head_pad, data_pad);
886}
887
888/*
889 * Packet reception for 88w8366 AP firmware.
890 */
891struct mwl8k_rxd_8366_ap {
892	__le16 pkt_len;
893	__u8 sq2;
894	__u8 rate;
895	__le32 pkt_phys_addr;
896	__le32 next_rxd_phys_addr;
897	__le16 qos_control;
898	__le16 htsig2;
899	__le32 hw_rssi_info;
900	__le32 hw_noise_floor_info;
901	__u8 noise_floor;
902	__u8 pad0[3];
903	__u8 rssi;
904	__u8 rx_status;
905	__u8 channel;
906	__u8 rx_ctrl;
907} __packed;
908
909#define MWL8K_8366_AP_RATE_INFO_MCS_FORMAT	0x80
910#define MWL8K_8366_AP_RATE_INFO_40MHZ		0x40
911#define MWL8K_8366_AP_RATE_INFO_RATEID(x)	((x) & 0x3f)
912
913#define MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST	0x80
914
915/* 8366 AP rx_status bits */
916#define MWL8K_8366_AP_RXSTAT_DECRYPT_ERR_MASK		0x80
917#define MWL8K_8366_AP_RXSTAT_GENERAL_DECRYPT_ERR	0xFF
918#define MWL8K_8366_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR	0x02
919#define MWL8K_8366_AP_RXSTAT_WEP_DECRYPT_ICV_ERR	0x04
920#define MWL8K_8366_AP_RXSTAT_TKIP_DECRYPT_ICV_ERR	0x08
921
922static void mwl8k_rxd_8366_ap_init(void *_rxd, dma_addr_t next_dma_addr)
923{
924	struct mwl8k_rxd_8366_ap *rxd = _rxd;
925
926	rxd->next_rxd_phys_addr = cpu_to_le32(next_dma_addr);
927	rxd->rx_ctrl = MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST;
928}
929
930static void mwl8k_rxd_8366_ap_refill(void *_rxd, dma_addr_t addr, int len)
931{
932	struct mwl8k_rxd_8366_ap *rxd = _rxd;
933
934	rxd->pkt_len = cpu_to_le16(len);
935	rxd->pkt_phys_addr = cpu_to_le32(addr);
936	wmb();
937	rxd->rx_ctrl = 0;
938}
939
940static int
941mwl8k_rxd_8366_ap_process(void *_rxd, struct ieee80211_rx_status *status,
942			  __le16 *qos, s8 *noise)
943{
944	struct mwl8k_rxd_8366_ap *rxd = _rxd;
945
946	if (!(rxd->rx_ctrl & MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST))
947		return -1;
948	rmb();
949
950	memset(status, 0, sizeof(*status));
951
952	status->signal = -rxd->rssi;
953	*noise = -rxd->noise_floor;
954
955	if (rxd->rate & MWL8K_8366_AP_RATE_INFO_MCS_FORMAT) {
956		status->flag |= RX_FLAG_HT;
957		if (rxd->rate & MWL8K_8366_AP_RATE_INFO_40MHZ)
958			status->flag |= RX_FLAG_40MHZ;
959		status->rate_idx = MWL8K_8366_AP_RATE_INFO_RATEID(rxd->rate);
960	} else {
961		int i;
962
963		for (i = 0; i < ARRAY_SIZE(mwl8k_rates_24); i++) {
964			if (mwl8k_rates_24[i].hw_value == rxd->rate) {
965				status->rate_idx = i;
966				break;
967			}
968		}
969	}
970
971	if (rxd->channel > 14) {
972		status->band = IEEE80211_BAND_5GHZ;
973		if (!(status->flag & RX_FLAG_HT))
974			status->rate_idx -= 5;
975	} else {
976		status->band = IEEE80211_BAND_2GHZ;
977	}
978	status->freq = ieee80211_channel_to_frequency(rxd->channel,
979						      status->band);
980
981	*qos = rxd->qos_control;
982
983	if ((rxd->rx_status != MWL8K_8366_AP_RXSTAT_GENERAL_DECRYPT_ERR) &&
984	    (rxd->rx_status & MWL8K_8366_AP_RXSTAT_DECRYPT_ERR_MASK) &&
985	    (rxd->rx_status & MWL8K_8366_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR))
986		status->flag |= RX_FLAG_MMIC_ERROR;
987
988	return le16_to_cpu(rxd->pkt_len);
989}
990
991static struct rxd_ops rxd_8366_ap_ops = {
992	.rxd_size	= sizeof(struct mwl8k_rxd_8366_ap),
993	.rxd_init	= mwl8k_rxd_8366_ap_init,
994	.rxd_refill	= mwl8k_rxd_8366_ap_refill,
995	.rxd_process	= mwl8k_rxd_8366_ap_process,
996};
997
998/*
999 * Packet reception for STA firmware.
1000 */
1001struct mwl8k_rxd_sta {
1002	__le16 pkt_len;
1003	__u8 link_quality;
1004	__u8 noise_level;
1005	__le32 pkt_phys_addr;
1006	__le32 next_rxd_phys_addr;
1007	__le16 qos_control;
1008	__le16 rate_info;
1009	__le32 pad0[4];
1010	__u8 rssi;
1011	__u8 channel;
1012	__le16 pad1;
1013	__u8 rx_ctrl;
1014	__u8 rx_status;
1015	__u8 pad2[2];
1016} __packed;
1017
1018#define MWL8K_STA_RATE_INFO_SHORTPRE		0x8000
1019#define MWL8K_STA_RATE_INFO_ANTSELECT(x)	(((x) >> 11) & 0x3)
1020#define MWL8K_STA_RATE_INFO_RATEID(x)		(((x) >> 3) & 0x3f)
1021#define MWL8K_STA_RATE_INFO_40MHZ		0x0004
1022#define MWL8K_STA_RATE_INFO_SHORTGI		0x0002
1023#define MWL8K_STA_RATE_INFO_MCS_FORMAT		0x0001
1024
1025#define MWL8K_STA_RX_CTRL_OWNED_BY_HOST		0x02
1026#define MWL8K_STA_RX_CTRL_DECRYPT_ERROR		0x04
1027/* ICV=0 or MIC=1 */
1028#define MWL8K_STA_RX_CTRL_DEC_ERR_TYPE		0x08
1029/* Key is uploaded only in failure case */
1030#define MWL8K_STA_RX_CTRL_KEY_INDEX			0x30
1031
1032static void mwl8k_rxd_sta_init(void *_rxd, dma_addr_t next_dma_addr)
1033{
1034	struct mwl8k_rxd_sta *rxd = _rxd;
1035
1036	rxd->next_rxd_phys_addr = cpu_to_le32(next_dma_addr);
1037	rxd->rx_ctrl = MWL8K_STA_RX_CTRL_OWNED_BY_HOST;
1038}
1039
1040static void mwl8k_rxd_sta_refill(void *_rxd, dma_addr_t addr, int len)
1041{
1042	struct mwl8k_rxd_sta *rxd = _rxd;
1043
1044	rxd->pkt_len = cpu_to_le16(len);
1045	rxd->pkt_phys_addr = cpu_to_le32(addr);
1046	wmb();
1047	rxd->rx_ctrl = 0;
1048}
1049
1050static int
1051mwl8k_rxd_sta_process(void *_rxd, struct ieee80211_rx_status *status,
1052		       __le16 *qos, s8 *noise)
1053{
1054	struct mwl8k_rxd_sta *rxd = _rxd;
1055	u16 rate_info;
1056
1057	if (!(rxd->rx_ctrl & MWL8K_STA_RX_CTRL_OWNED_BY_HOST))
1058		return -1;
1059	rmb();
1060
1061	rate_info = le16_to_cpu(rxd->rate_info);
1062
1063	memset(status, 0, sizeof(*status));
1064
1065	status->signal = -rxd->rssi;
1066	*noise = -rxd->noise_level;
1067	status->antenna = MWL8K_STA_RATE_INFO_ANTSELECT(rate_info);
1068	status->rate_idx = MWL8K_STA_RATE_INFO_RATEID(rate_info);
1069
1070	if (rate_info & MWL8K_STA_RATE_INFO_SHORTPRE)
1071		status->flag |= RX_FLAG_SHORTPRE;
1072	if (rate_info & MWL8K_STA_RATE_INFO_40MHZ)
1073		status->flag |= RX_FLAG_40MHZ;
1074	if (rate_info & MWL8K_STA_RATE_INFO_SHORTGI)
1075		status->flag |= RX_FLAG_SHORT_GI;
1076	if (rate_info & MWL8K_STA_RATE_INFO_MCS_FORMAT)
1077		status->flag |= RX_FLAG_HT;
1078
1079	if (rxd->channel > 14) {
1080		status->band = IEEE80211_BAND_5GHZ;
1081		if (!(status->flag & RX_FLAG_HT))
1082			status->rate_idx -= 5;
1083	} else {
1084		status->band = IEEE80211_BAND_2GHZ;
1085	}
1086	status->freq = ieee80211_channel_to_frequency(rxd->channel,
1087						      status->band);
1088
1089	*qos = rxd->qos_control;
1090	if ((rxd->rx_ctrl & MWL8K_STA_RX_CTRL_DECRYPT_ERROR) &&
1091	    (rxd->rx_ctrl & MWL8K_STA_RX_CTRL_DEC_ERR_TYPE))
1092		status->flag |= RX_FLAG_MMIC_ERROR;
1093
1094	return le16_to_cpu(rxd->pkt_len);
1095}
1096
1097static struct rxd_ops rxd_sta_ops = {
1098	.rxd_size	= sizeof(struct mwl8k_rxd_sta),
1099	.rxd_init	= mwl8k_rxd_sta_init,
1100	.rxd_refill	= mwl8k_rxd_sta_refill,
1101	.rxd_process	= mwl8k_rxd_sta_process,
1102};
1103
1104
1105#define MWL8K_RX_DESCS		256
1106#define MWL8K_RX_MAXSZ		3800
1107
1108static int mwl8k_rxq_init(struct ieee80211_hw *hw, int index)
1109{
1110	struct mwl8k_priv *priv = hw->priv;
1111	struct mwl8k_rx_queue *rxq = priv->rxq + index;
1112	int size;
1113	int i;
1114
1115	rxq->rxd_count = 0;
1116	rxq->head = 0;
1117	rxq->tail = 0;
1118
1119	size = MWL8K_RX_DESCS * priv->rxd_ops->rxd_size;
1120
1121	rxq->rxd = pci_alloc_consistent(priv->pdev, size, &rxq->rxd_dma);
1122	if (rxq->rxd == NULL) {
1123		wiphy_err(hw->wiphy, "failed to alloc RX descriptors\n");
1124		return -ENOMEM;
1125	}
1126	memset(rxq->rxd, 0, size);
1127
1128	rxq->buf = kcalloc(MWL8K_RX_DESCS, sizeof(*rxq->buf), GFP_KERNEL);
1129	if (rxq->buf == NULL) {
1130		wiphy_err(hw->wiphy, "failed to alloc RX skbuff list\n");
1131		pci_free_consistent(priv->pdev, size, rxq->rxd, rxq->rxd_dma);
1132		return -ENOMEM;
1133	}
1134
1135	for (i = 0; i < MWL8K_RX_DESCS; i++) {
1136		int desc_size;
1137		void *rxd;
1138		int nexti;
1139		dma_addr_t next_dma_addr;
1140
1141		desc_size = priv->rxd_ops->rxd_size;
1142		rxd = rxq->rxd + (i * priv->rxd_ops->rxd_size);
1143
1144		nexti = i + 1;
1145		if (nexti == MWL8K_RX_DESCS)
1146			nexti = 0;
1147		next_dma_addr = rxq->rxd_dma + (nexti * desc_size);
1148
1149		priv->rxd_ops->rxd_init(rxd, next_dma_addr);
1150	}
1151
1152	return 0;
1153}
1154
1155static int rxq_refill(struct ieee80211_hw *hw, int index, int limit)
1156{
1157	struct mwl8k_priv *priv = hw->priv;
1158	struct mwl8k_rx_queue *rxq = priv->rxq + index;
1159	int refilled;
1160
1161	refilled = 0;
1162	while (rxq->rxd_count < MWL8K_RX_DESCS && limit--) {
1163		struct sk_buff *skb;
1164		dma_addr_t addr;
1165		int rx;
1166		void *rxd;
1167
1168		skb = dev_alloc_skb(MWL8K_RX_MAXSZ);
1169		if (skb == NULL)
1170			break;
1171
1172		addr = pci_map_single(priv->pdev, skb->data,
1173				      MWL8K_RX_MAXSZ, DMA_FROM_DEVICE);
1174
1175		rxq->rxd_count++;
1176		rx = rxq->tail++;
1177		if (rxq->tail == MWL8K_RX_DESCS)
1178			rxq->tail = 0;
1179		rxq->buf[rx].skb = skb;
1180		dma_unmap_addr_set(&rxq->buf[rx], dma, addr);
1181
1182		rxd = rxq->rxd + (rx * priv->rxd_ops->rxd_size);
1183		priv->rxd_ops->rxd_refill(rxd, addr, MWL8K_RX_MAXSZ);
1184
1185		refilled++;
1186	}
1187
1188	return refilled;
1189}
1190
1191/* Must be called only when the card's reception is completely halted */
1192static void mwl8k_rxq_deinit(struct ieee80211_hw *hw, int index)
1193{
1194	struct mwl8k_priv *priv = hw->priv;
1195	struct mwl8k_rx_queue *rxq = priv->rxq + index;
1196	int i;
1197
1198	if (rxq->rxd == NULL)
1199		return;
1200
1201	for (i = 0; i < MWL8K_RX_DESCS; i++) {
1202		if (rxq->buf[i].skb != NULL) {
1203			pci_unmap_single(priv->pdev,
1204					 dma_unmap_addr(&rxq->buf[i], dma),
1205					 MWL8K_RX_MAXSZ, PCI_DMA_FROMDEVICE);
1206			dma_unmap_addr_set(&rxq->buf[i], dma, 0);
1207
1208			kfree_skb(rxq->buf[i].skb);
1209			rxq->buf[i].skb = NULL;
1210		}
1211	}
1212
1213	kfree(rxq->buf);
1214	rxq->buf = NULL;
1215
1216	pci_free_consistent(priv->pdev,
1217			    MWL8K_RX_DESCS * priv->rxd_ops->rxd_size,
1218			    rxq->rxd, rxq->rxd_dma);
1219	rxq->rxd = NULL;
1220}
1221
1222
1223/*
1224 * Scan a list of BSSIDs to process for finalize join.
1225 * Allows for extension to process multiple BSSIDs.
1226 */
1227static inline int
1228mwl8k_capture_bssid(struct mwl8k_priv *priv, struct ieee80211_hdr *wh)
1229{
1230	return priv->capture_beacon &&
1231		ieee80211_is_beacon(wh->frame_control) &&
1232		!compare_ether_addr(wh->addr3, priv->capture_bssid);
1233}
1234
1235static inline void mwl8k_save_beacon(struct ieee80211_hw *hw,
1236				     struct sk_buff *skb)
1237{
1238	struct mwl8k_priv *priv = hw->priv;
1239
1240	priv->capture_beacon = false;
1241	memset(priv->capture_bssid, 0, ETH_ALEN);
1242
1243	/*
1244	 * Use GFP_ATOMIC as rxq_process is called from
1245	 * the primary interrupt handler, memory allocation call
1246	 * must not sleep.
1247	 */
1248	priv->beacon_skb = skb_copy(skb, GFP_ATOMIC);
1249	if (priv->beacon_skb != NULL)
1250		ieee80211_queue_work(hw, &priv->finalize_join_worker);
1251}
1252
1253static inline struct mwl8k_vif *mwl8k_find_vif_bss(struct list_head *vif_list,
1254						   u8 *bssid)
1255{
1256	struct mwl8k_vif *mwl8k_vif;
1257
1258	list_for_each_entry(mwl8k_vif,
1259			    vif_list, list) {
1260		if (memcmp(bssid, mwl8k_vif->bssid,
1261			   ETH_ALEN) == 0)
1262			return mwl8k_vif;
1263	}
1264
1265	return NULL;
1266}
1267
1268static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
1269{
1270	struct mwl8k_priv *priv = hw->priv;
1271	struct mwl8k_vif *mwl8k_vif = NULL;
1272	struct mwl8k_rx_queue *rxq = priv->rxq + index;
1273	int processed;
1274
1275	processed = 0;
1276	while (rxq->rxd_count && limit--) {
1277		struct sk_buff *skb;
1278		void *rxd;
1279		int pkt_len;
1280		struct ieee80211_rx_status status;
1281		struct ieee80211_hdr *wh;
1282		__le16 qos;
1283
1284		skb = rxq->buf[rxq->head].skb;
1285		if (skb == NULL)
1286			break;
1287
1288		rxd = rxq->rxd + (rxq->head * priv->rxd_ops->rxd_size);
1289
1290		pkt_len = priv->rxd_ops->rxd_process(rxd, &status, &qos,
1291							&priv->noise);
1292		if (pkt_len < 0)
1293			break;
1294
1295		rxq->buf[rxq->head].skb = NULL;
1296
1297		pci_unmap_single(priv->pdev,
1298				 dma_unmap_addr(&rxq->buf[rxq->head], dma),
1299				 MWL8K_RX_MAXSZ, PCI_DMA_FROMDEVICE);
1300		dma_unmap_addr_set(&rxq->buf[rxq->head], dma, 0);
1301
1302		rxq->head++;
1303		if (rxq->head == MWL8K_RX_DESCS)
1304			rxq->head = 0;
1305
1306		rxq->rxd_count--;
1307
1308		wh = &((struct mwl8k_dma_data *)skb->data)->wh;
1309
1310		/*
1311		 * Check for a pending join operation.  Save a
1312		 * copy of the beacon and schedule a tasklet to
1313		 * send a FINALIZE_JOIN command to the firmware.
1314		 */
1315		if (mwl8k_capture_bssid(priv, (void *)skb->data))
1316			mwl8k_save_beacon(hw, skb);
1317
1318		if (ieee80211_has_protected(wh->frame_control)) {
1319
1320			/* Check if hw crypto has been enabled for
1321			 * this bss. If yes, set the status flags
1322			 * accordingly
1323			 */
1324			mwl8k_vif = mwl8k_find_vif_bss(&priv->vif_list,
1325								wh->addr1);
1326
1327			if (mwl8k_vif != NULL &&
1328			    mwl8k_vif->is_hw_crypto_enabled == true) {
1329				/*
1330				 * When MMIC ERROR is encountered
1331				 * by the firmware, payload is
1332				 * dropped and only 32 bytes of
1333				 * mwl8k Firmware header is sent
1334				 * to the host.
1335				 *
1336				 * We need to add four bytes of
1337				 * key information.  In it
1338				 * MAC80211 expects keyidx set to
1339				 * 0 for triggering Counter
1340				 * Measure of MMIC failure.
1341				 */
1342				if (status.flag & RX_FLAG_MMIC_ERROR) {
1343					struct mwl8k_dma_data *tr;
1344					tr = (struct mwl8k_dma_data *)skb->data;
1345					memset((void *)&(tr->data), 0, 4);
1346					pkt_len += 4;
1347				}
1348
1349				if (!ieee80211_is_auth(wh->frame_control))
1350					status.flag |= RX_FLAG_IV_STRIPPED |
1351						       RX_FLAG_DECRYPTED |
1352						       RX_FLAG_MMIC_STRIPPED;
1353			}
1354		}
1355
1356		skb_put(skb, pkt_len);
1357		mwl8k_remove_dma_header(skb, qos);
1358		memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
1359		ieee80211_rx_irqsafe(hw, skb);
1360
1361		processed++;
1362	}
1363
1364	return processed;
1365}
1366
1367
1368/*
1369 * Packet transmission.
1370 */
1371
1372#define MWL8K_TXD_STATUS_OK			0x00000001
1373#define MWL8K_TXD_STATUS_OK_RETRY		0x00000002
1374#define MWL8K_TXD_STATUS_OK_MORE_RETRY		0x00000004
1375#define MWL8K_TXD_STATUS_MULTICAST_TX		0x00000008
1376#define MWL8K_TXD_STATUS_FW_OWNED		0x80000000
1377
1378#define MWL8K_QOS_QLEN_UNSPEC			0xff00
1379#define MWL8K_QOS_ACK_POLICY_MASK		0x0060
1380#define MWL8K_QOS_ACK_POLICY_NORMAL		0x0000
1381#define MWL8K_QOS_ACK_POLICY_BLOCKACK		0x0060
1382#define MWL8K_QOS_EOSP				0x0010
1383
1384struct mwl8k_tx_desc {
1385	__le32 status;
1386	__u8 data_rate;
1387	__u8 tx_priority;
1388	__le16 qos_control;
1389	__le32 pkt_phys_addr;
1390	__le16 pkt_len;
1391	__u8 dest_MAC_addr[ETH_ALEN];
1392	__le32 next_txd_phys_addr;
1393	__le32 timestamp;
1394	__le16 rate_info;
1395	__u8 peer_id;
1396	__u8 tx_frag_cnt;
1397} __packed;
1398
1399#define MWL8K_TX_DESCS		128
1400
1401static int mwl8k_txq_init(struct ieee80211_hw *hw, int index)
1402{
1403	struct mwl8k_priv *priv = hw->priv;
1404	struct mwl8k_tx_queue *txq = priv->txq + index;
1405	int size;
1406	int i;
1407
1408	txq->len = 0;
1409	txq->head = 0;
1410	txq->tail = 0;
1411
1412	size = MWL8K_TX_DESCS * sizeof(struct mwl8k_tx_desc);
1413
1414	txq->txd = pci_alloc_consistent(priv->pdev, size, &txq->txd_dma);
1415	if (txq->txd == NULL) {
1416		wiphy_err(hw->wiphy, "failed to alloc TX descriptors\n");
1417		return -ENOMEM;
1418	}
1419	memset(txq->txd, 0, size);
1420
1421	txq->skb = kcalloc(MWL8K_TX_DESCS, sizeof(*txq->skb), GFP_KERNEL);
1422	if (txq->skb == NULL) {
1423		wiphy_err(hw->wiphy, "failed to alloc TX skbuff list\n");
1424		pci_free_consistent(priv->pdev, size, txq->txd, txq->txd_dma);
1425		return -ENOMEM;
1426	}
1427
1428	for (i = 0; i < MWL8K_TX_DESCS; i++) {
1429		struct mwl8k_tx_desc *tx_desc;
1430		int nexti;
1431
1432		tx_desc = txq->txd + i;
1433		nexti = (i + 1) % MWL8K_TX_DESCS;
1434
1435		tx_desc->status = 0;
1436		tx_desc->next_txd_phys_addr =
1437			cpu_to_le32(txq->txd_dma + nexti * sizeof(*tx_desc));
1438	}
1439
1440	return 0;
1441}
1442
1443static inline void mwl8k_tx_start(struct mwl8k_priv *priv)
1444{
1445	iowrite32(MWL8K_H2A_INT_PPA_READY,
1446		priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
1447	iowrite32(MWL8K_H2A_INT_DUMMY,
1448		priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
1449	ioread32(priv->regs + MWL8K_HIU_INT_CODE);
1450}
1451
1452static void mwl8k_dump_tx_rings(struct ieee80211_hw *hw)
1453{
1454	struct mwl8k_priv *priv = hw->priv;
1455	int i;
1456
1457	for (i = 0; i < mwl8k_tx_queues(priv); i++) {
1458		struct mwl8k_tx_queue *txq = priv->txq + i;
1459		int fw_owned = 0;
1460		int drv_owned = 0;
1461		int unused = 0;
1462		int desc;
1463
1464		for (desc = 0; desc < MWL8K_TX_DESCS; desc++) {
1465			struct mwl8k_tx_desc *tx_desc = txq->txd + desc;
1466			u32 status;
1467
1468			status = le32_to_cpu(tx_desc->status);
1469			if (status & MWL8K_TXD_STATUS_FW_OWNED)
1470				fw_owned++;
1471			else
1472				drv_owned++;
1473
1474			if (tx_desc->pkt_len == 0)
1475				unused++;
1476		}
1477
1478		wiphy_err(hw->wiphy,
1479			  "txq[%d] len=%d head=%d tail=%d "
1480			  "fw_owned=%d drv_owned=%d unused=%d\n",
1481			  i,
1482			  txq->len, txq->head, txq->tail,
1483			  fw_owned, drv_owned, unused);
1484	}
1485}
1486
1487/*
1488 * Must be called with priv->fw_mutex held and tx queues stopped.
1489 */
1490#define MWL8K_TX_WAIT_TIMEOUT_MS	5000
1491
1492static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
1493{
1494	struct mwl8k_priv *priv = hw->priv;
1495	DECLARE_COMPLETION_ONSTACK(tx_wait);
1496	int retry;
1497	int rc;
1498
1499	might_sleep();
1500
1501	/*
1502	 * The TX queues are stopped at this point, so this test
1503	 * doesn't need to take ->tx_lock.
1504	 */
1505	if (!priv->pending_tx_pkts)
1506		return 0;
1507
1508	retry = 0;
1509	rc = 0;
1510
1511	spin_lock_bh(&priv->tx_lock);
1512	priv->tx_wait = &tx_wait;
1513	while (!rc) {
1514		int oldcount;
1515		unsigned long timeout;
1516
1517		oldcount = priv->pending_tx_pkts;
1518
1519		spin_unlock_bh(&priv->tx_lock);
1520		timeout = wait_for_completion_timeout(&tx_wait,
1521			    msecs_to_jiffies(MWL8K_TX_WAIT_TIMEOUT_MS));
1522		spin_lock_bh(&priv->tx_lock);
1523
1524		if (timeout) {
1525			WARN_ON(priv->pending_tx_pkts);
1526			if (retry)
1527				wiphy_notice(hw->wiphy, "tx rings drained\n");
1528			break;
1529		}
1530
1531		if (priv->pending_tx_pkts < oldcount) {
1532			wiphy_notice(hw->wiphy,
1533				     "waiting for tx rings to drain (%d -> %d pkts)\n",
1534				     oldcount, priv->pending_tx_pkts);
1535			retry = 1;
1536			continue;
1537		}
1538
1539		priv->tx_wait = NULL;
1540
1541		wiphy_err(hw->wiphy, "tx rings stuck for %d ms\n",
1542			  MWL8K_TX_WAIT_TIMEOUT_MS);
1543		mwl8k_dump_tx_rings(hw);
1544
1545		rc = -ETIMEDOUT;
1546	}
1547	spin_unlock_bh(&priv->tx_lock);
1548
1549	return rc;
1550}
1551
1552#define MWL8K_TXD_SUCCESS(status)				\
1553	((status) & (MWL8K_TXD_STATUS_OK |			\
1554		     MWL8K_TXD_STATUS_OK_RETRY |		\
1555		     MWL8K_TXD_STATUS_OK_MORE_RETRY))
1556
1557static int mwl8k_tid_queue_mapping(u8 tid)
1558{
1559	BUG_ON(tid > 7);
1560
1561	switch (tid) {
1562	case 0:
1563	case 3:
1564		return IEEE80211_AC_BE;
1565		break;
1566	case 1:
1567	case 2:
1568		return IEEE80211_AC_BK;
1569		break;
1570	case 4:
1571	case 5:
1572		return IEEE80211_AC_VI;
1573		break;
1574	case 6:
1575	case 7:
1576		return IEEE80211_AC_VO;
1577		break;
1578	default:
1579		return -1;
1580		break;
1581	}
1582}
1583
1584/* The firmware will fill in the rate information
1585 * for each packet that gets queued in the hardware
1586 * and these macros will interpret that info.
1587 */
1588
1589#define RI_FORMAT(a)		  (a & 0x0001)
1590#define RI_RATE_ID_MCS(a)	 ((a & 0x01f8) >> 3)
1591
1592static int
1593mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
1594{
1595	struct mwl8k_priv *priv = hw->priv;
1596	struct mwl8k_tx_queue *txq = priv->txq + index;
1597	int processed;
1598
1599	processed = 0;
1600	while (txq->len > 0 && limit--) {
1601		int tx;
1602		struct mwl8k_tx_desc *tx_desc;
1603		unsigned long addr;
1604		int size;
1605		struct sk_buff *skb;
1606		struct ieee80211_tx_info *info;
1607		u32 status;
1608		struct ieee80211_sta *sta;
1609		struct mwl8k_sta *sta_info = NULL;
1610		u16 rate_info;
1611		struct ieee80211_hdr *wh;
1612
1613		tx = txq->head;
1614		tx_desc = txq->txd + tx;
1615
1616		status = le32_to_cpu(tx_desc->status);
1617
1618		if (status & MWL8K_TXD_STATUS_FW_OWNED) {
1619			if (!force)
1620				break;
1621			tx_desc->status &=
1622				~cpu_to_le32(MWL8K_TXD_STATUS_FW_OWNED);
1623		}
1624
1625		txq->head = (tx + 1) % MWL8K_TX_DESCS;
1626		BUG_ON(txq->len == 0);
1627		txq->len--;
1628		priv->pending_tx_pkts--;
1629
1630		addr = le32_to_cpu(tx_desc->pkt_phys_addr);
1631		size = le16_to_cpu(tx_desc->pkt_len);
1632		skb = txq->skb[tx];
1633		txq->skb[tx] = NULL;
1634
1635		BUG_ON(skb == NULL);
1636		pci_unmap_single(priv->pdev, addr, size, PCI_DMA_TODEVICE);
1637
1638		mwl8k_remove_dma_header(skb, tx_desc->qos_control);
1639
1640		wh = (struct ieee80211_hdr *) skb->data;
1641
1642		/* Mark descriptor as unused */
1643		tx_desc->pkt_phys_addr = 0;
1644		tx_desc->pkt_len = 0;
1645
1646		info = IEEE80211_SKB_CB(skb);
1647		if (ieee80211_is_data(wh->frame_control)) {
1648			sta = info->control.sta;
1649			if (sta) {
1650				sta_info = MWL8K_STA(sta);
1651				BUG_ON(sta_info == NULL);
1652				rate_info = le16_to_cpu(tx_desc->rate_info);
1653				/* If rate is < 6.5 Mpbs for an ht station
1654				 * do not form an ampdu. If the station is a
1655				 * legacy station (format = 0), do not form an
1656				 * ampdu
1657				 */
1658				if (RI_RATE_ID_MCS(rate_info) < 1 ||
1659				    RI_FORMAT(rate_info) == 0) {
1660					sta_info->is_ampdu_allowed = false;
1661				} else {
1662					sta_info->is_ampdu_allowed = true;
1663				}
1664			}
1665		}
1666
1667		ieee80211_tx_info_clear_status(info);
1668
1669		/* Rate control is happening in the firmware.
1670		 * Ensure no tx rate is being reported.
1671		 */
1672		info->status.rates[0].idx = -1;
1673		info->status.rates[0].count = 1;
1674
1675		if (MWL8K_TXD_SUCCESS(status))
1676			info->flags |= IEEE80211_TX_STAT_ACK;
1677
1678		ieee80211_tx_status_irqsafe(hw, skb);
1679
1680		processed++;
1681	}
1682
1683	return processed;
1684}
1685
1686/* must be called only when the card's transmit is completely halted */
1687static void mwl8k_txq_deinit(struct ieee80211_hw *hw, int index)
1688{
1689	struct mwl8k_priv *priv = hw->priv;
1690	struct mwl8k_tx_queue *txq = priv->txq + index;
1691
1692	if (txq->txd == NULL)
1693		return;
1694
1695	mwl8k_txq_reclaim(hw, index, INT_MAX, 1);
1696
1697	kfree(txq->skb);
1698	txq->skb = NULL;
1699
1700	pci_free_consistent(priv->pdev,
1701			    MWL8K_TX_DESCS * sizeof(struct mwl8k_tx_desc),
1702			    txq->txd, txq->txd_dma);
1703	txq->txd = NULL;
1704}
1705
1706/* caller must hold priv->stream_lock when calling the stream functions */
1707static struct mwl8k_ampdu_stream *
1708mwl8k_add_stream(struct ieee80211_hw *hw, struct ieee80211_sta *sta, u8 tid)
1709{
1710	struct mwl8k_ampdu_stream *stream;
1711	struct mwl8k_priv *priv = hw->priv;
1712	int i;
1713
1714	for (i = 0; i < priv->num_ampdu_queues; i++) {
1715		stream = &priv->ampdu[i];
1716		if (stream->state == AMPDU_NO_STREAM) {
1717			stream->sta = sta;
1718			stream->state = AMPDU_STREAM_NEW;
1719			stream->tid = tid;
1720			stream->idx = i;
1721			stream->txq_idx = MWL8K_TX_WMM_QUEUES + i;
1722			wiphy_debug(hw->wiphy, "Added a new stream for %pM %d",
1723				    sta->addr, tid);
1724			return stream;
1725		}
1726	}
1727	return NULL;
1728}
1729
1730static int
1731mwl8k_start_stream(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream)
1732{
1733	int ret;
1734
1735	/* if the stream has already been started, don't start it again */
1736	if (stream->state != AMPDU_STREAM_NEW)
1737		return 0;
1738	ret = ieee80211_start_tx_ba_session(stream->sta, stream->tid, 0);
1739	if (ret)
1740		wiphy_debug(hw->wiphy, "Failed to start stream for %pM %d: "
1741			    "%d\n", stream->sta->addr, stream->tid, ret);
1742	else
1743		wiphy_debug(hw->wiphy, "Started stream for %pM %d\n",
1744			    stream->sta->addr, stream->tid);
1745	return ret;
1746}
1747
1748static void
1749mwl8k_remove_stream(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream)
1750{
1751	wiphy_debug(hw->wiphy, "Remove stream for %pM %d\n", stream->sta->addr,
1752		    stream->tid);
1753	memset(stream, 0, sizeof(*stream));
1754}
1755
1756static struct mwl8k_ampdu_stream *
1757mwl8k_lookup_stream(struct ieee80211_hw *hw, u8 *addr, u8 tid)
1758{
1759	struct mwl8k_priv *priv = hw->priv;
1760	int i;
1761
1762	for (i = 0 ; i < priv->num_ampdu_queues; i++) {
1763		struct mwl8k_ampdu_stream *stream;
1764		stream = &priv->ampdu[i];
1765		if (stream->state == AMPDU_NO_STREAM)
1766			continue;
1767		if (!memcmp(stream->sta->addr, addr, ETH_ALEN) &&
1768		    stream->tid == tid)
1769			return stream;
1770	}
1771	return NULL;
1772}
1773
1774#define MWL8K_AMPDU_PACKET_THRESHOLD 64
1775static inline bool mwl8k_ampdu_allowed(struct ieee80211_sta *sta, u8 tid)
1776{
1777	struct mwl8k_sta *sta_info = MWL8K_STA(sta);
1778	struct tx_traffic_info *tx_stats;
1779
1780	BUG_ON(tid >= MWL8K_MAX_TID);
1781	tx_stats = &sta_info->tx_stats[tid];
1782
1783	return sta_info->is_ampdu_allowed &&
1784		tx_stats->pkts > MWL8K_AMPDU_PACKET_THRESHOLD;
1785}
1786
1787static inline void mwl8k_tx_count_packet(struct ieee80211_sta *sta, u8 tid)
1788{
1789	struct mwl8k_sta *sta_info = MWL8K_STA(sta);
1790	struct tx_traffic_info *tx_stats;
1791
1792	BUG_ON(tid >= MWL8K_MAX_TID);
1793	tx_stats = &sta_info->tx_stats[tid];
1794
1795	if (tx_stats->start_time == 0)
1796		tx_stats->start_time = jiffies;
1797
1798	/* reset the packet count after each second elapses.  If the number of
1799	 * packets ever exceeds the ampdu_min_traffic threshold, we will allow
1800	 * an ampdu stream to be started.
1801	 */
1802	if (jiffies - tx_stats->start_time > HZ) {
1803		tx_stats->pkts = 0;
1804		tx_stats->start_time = 0;
1805	} else
1806		tx_stats->pkts++;
1807}
1808
1809static void
1810mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
1811{
1812	struct mwl8k_priv *priv = hw->priv;
1813	struct ieee80211_tx_info *tx_info;
1814	struct mwl8k_vif *mwl8k_vif;
1815	struct ieee80211_sta *sta;
1816	struct ieee80211_hdr *wh;
1817	struct mwl8k_tx_queue *txq;
1818	struct mwl8k_tx_desc *tx;
1819	dma_addr_t dma;
1820	u32 txstatus;
1821	u8 txdatarate;
1822	u16 qos;
1823	int txpriority;
1824	u8 tid = 0;
1825	struct mwl8k_ampdu_stream *stream = NULL;
1826	bool start_ba_session = false;
1827	bool mgmtframe = false;
1828	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
1829
1830	wh = (struct ieee80211_hdr *)skb->data;
1831	if (ieee80211_is_data_qos(wh->frame_control))
1832		qos = le16_to_cpu(*((__le16 *)ieee80211_get_qos_ctl(wh)));
1833	else
1834		qos = 0;
1835
1836	if (ieee80211_is_mgmt(wh->frame_control))
1837		mgmtframe = true;
1838
1839	if (priv->ap_fw)
1840		mwl8k_encapsulate_tx_frame(priv, skb);
1841	else
1842		mwl8k_add_dma_header(priv, skb, 0, 0);
1843
1844	wh = &((struct mwl8k_dma_data *)skb->data)->wh;
1845
1846	tx_info = IEEE80211_SKB_CB(skb);
1847	sta = tx_info->control.sta;
1848	mwl8k_vif = MWL8K_VIF(tx_info->control.vif);
1849
1850	if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
1851		wh->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
1852		wh->seq_ctrl |= cpu_to_le16(mwl8k_vif->seqno);
1853		mwl8k_vif->seqno += 0x10;
1854	}
1855
1856	/* Setup firmware control bit fields for each frame type.  */
1857	txstatus = 0;
1858	txdatarate = 0;
1859	if (ieee80211_is_mgmt(wh->frame_control) ||
1860	    ieee80211_is_ctl(wh->frame_control)) {
1861		txdatarate = 0;
1862		qos |= MWL8K_QOS_QLEN_UNSPEC | MWL8K_QOS_EOSP;
1863	} else if (ieee80211_is_data(wh->frame_control)) {
1864		txdatarate = 1;
1865		if (is_multicast_ether_addr(wh->addr1))
1866			txstatus |= MWL8K_TXD_STATUS_MULTICAST_TX;
1867
1868		qos &= ~MWL8K_QOS_ACK_POLICY_MASK;
1869		if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
1870			qos |= MWL8K_QOS_ACK_POLICY_BLOCKACK;
1871		else
1872			qos |= MWL8K_QOS_ACK_POLICY_NORMAL;
1873	}
1874
1875	/* Queue ADDBA request in the respective data queue.  While setting up
1876	 * the ampdu stream, mac80211 queues further packets for that
1877	 * particular ra/tid pair.  However, packets piled up in the hardware
1878	 * for that ra/tid pair will still go out. ADDBA request and the
1879	 * related data packets going out from different queues asynchronously
1880	 * will cause a shift in the receiver window which might result in
1881	 * ampdu packets getting dropped at the receiver after the stream has
1882	 * been setup.
1883	 */
1884	if (unlikely(ieee80211_is_action(wh->frame_control) &&
1885	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&
1886	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ &&
1887	    priv->ap_fw)) {
1888		u16 capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
1889		tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1890		index = mwl8k_tid_queue_mapping(tid);
1891	}
1892
1893	txpriority = index;
1894
1895	if (priv->ap_fw && sta && sta->ht_cap.ht_supported
1896			&& skb->protocol != cpu_to_be16(ETH_P_PAE)
1897			&& ieee80211_is_data_qos(wh->frame_control)) {
1898		tid = qos & 0xf;
1899		mwl8k_tx_count_packet(sta, tid);
1900		spin_lock(&priv->stream_lock);
1901		stream = mwl8k_lookup_stream(hw, sta->addr, tid);
1902		if (stream != NULL) {
1903			if (stream->state == AMPDU_STREAM_ACTIVE) {
1904				txpriority = stream->txq_idx;
1905				index = stream->txq_idx;
1906			} else if (stream->state == AMPDU_STREAM_NEW) {
1907				/* We get here if the driver sends us packets
1908				 * after we've initiated a stream, but before
1909				 * our ampdu_action routine has been called
1910				 * with IEEE80211_AMPDU_TX_START to get the SSN
1911				 * for the ADDBA request.  So this packet can
1912				 * go out with no risk of sequence number
1913				 * mismatch.  No special handling is required.
1914				 */
1915			} else {
1916				/* Drop packets that would go out after the
1917				 * ADDBA request was sent but before the ADDBA
1918				 * response is received.  If we don't do this,
1919				 * the recipient would probably receive it
1920				 * after the ADDBA request with SSN 0.  This
1921				 * will cause the recipient's BA receive window
1922				 * to shift, which would cause the subsequent
1923				 * packets in the BA stream to be discarded.
1924				 * mac80211 queues our packets for us in this
1925				 * case, so this is really just a safety check.
1926				 */
1927				wiphy_warn(hw->wiphy,
1928					   "Cannot send packet while ADDBA "
1929					   "dialog is underway.\n");
1930				spin_unlock(&priv->stream_lock);
1931				dev_kfree_skb(skb);
1932				return;
1933			}
1934		} else {
1935			/* Defer calling mwl8k_start_stream so that the current
1936			 * skb can go out before the ADDBA request.  This
1937			 * prevents sequence number mismatch at the recepient
1938			 * as described above.
1939			 */
1940			if (mwl8k_ampdu_allowed(sta, tid)) {
1941				stream = mwl8k_add_stream(hw, sta, tid);
1942				if (stream != NULL)
1943					start_ba_session = true;
1944			}
1945		}
1946		spin_unlock(&priv->stream_lock);
1947	}
1948
1949	dma = pci_map_single(priv->pdev, skb->data,
1950				skb->len, PCI_DMA_TODEVICE);
1951
1952	if (pci_dma_mapping_error(priv->pdev, dma)) {
1953		wiphy_debug(hw->wiphy,
1954			    "failed to dma map skb, dropping TX frame.\n");
1955		if (start_ba_session) {
1956			spin_lock(&priv->stream_lock);
1957			mwl8k_remove_stream(hw, stream);
1958			spin_unlock(&priv->stream_lock);
1959		}
1960		dev_kfree_skb(skb);
1961		return;
1962	}
1963
1964	spin_lock_bh(&priv->tx_lock);
1965
1966	txq = priv->txq + index;
1967
1968	/* Mgmt frames that go out frequently are probe
1969	 * responses. Other mgmt frames got out relatively
1970	 * infrequently. Hence reserve 2 buffers so that
1971	 * other mgmt frames do not get dropped due to an
1972	 * already queued probe response in one of the
1973	 * reserved buffers.
1974	 */
1975
1976	if (txq->len >= MWL8K_TX_DESCS - 2) {
1977		if (mgmtframe == false ||
1978			txq->len == MWL8K_TX_DESCS) {
1979			if (start_ba_session) {
1980				spin_lock(&priv->stream_lock);
1981				mwl8k_remove_stream(hw, stream);
1982				spin_unlock(&priv->stream_lock);
1983			}
1984			spin_unlock_bh(&priv->tx_lock);
1985			dev_kfree_skb(skb);
1986			return;
1987		}
1988	}
1989
1990	BUG_ON(txq->skb[txq->tail] != NULL);
1991	txq->skb[txq->tail] = skb;
1992
1993	tx = txq->txd + txq->tail;
1994	tx->data_rate = txdatarate;
1995	tx->tx_priority = txpriority;
1996	tx->qos_control = cpu_to_le16(qos);
1997	tx->pkt_phys_addr = cpu_to_le32(dma);
1998	tx->pkt_len = cpu_to_le16(skb->len);
1999	tx->rate_info = 0;
2000	if (!priv->ap_fw && tx_info->control.sta != NULL)
2001		tx->peer_id = MWL8K_STA(tx_info->control.sta)->peer_id;
2002	else
2003		tx->peer_id = 0;
2004
2005	if (priv->ap_fw)
2006		tx->timestamp = cpu_to_le32(ioread32(priv->regs +
2007						MWL8K_HW_TIMER_REGISTER));
2008
2009	wmb();
2010	tx->status = cpu_to_le32(MWL8K_TXD_STATUS_FW_OWNED | txstatus);
2011
2012	txq->len++;
2013	priv->pending_tx_pkts++;
2014
2015	txq->tail++;
2016	if (txq->tail == MWL8K_TX_DESCS)
2017		txq->tail = 0;
2018
2019	mwl8k_tx_start(priv);
2020
2021	spin_unlock_bh(&priv->tx_lock);
2022
2023	/* Initiate the ampdu session here */
2024	if (start_ba_session) {
2025		spin_lock(&priv->stream_lock);
2026		if (mwl8k_start_stream(hw, stream))
2027			mwl8k_remove_stream(hw, stream);
2028		spin_unlock(&priv->stream_lock);
2029	}
2030}
2031
2032
2033/*
2034 * Firmware access.
2035 *
2036 * We have the following requirements for issuing firmware commands:
2037 * - Some commands require that the packet transmit path is idle when
2038 *   the command is issued.  (For simplicity, we'll just quiesce the
2039 *   transmit path for every command.)
2040 * - There are certain sequences of commands that need to be issued to
2041 *   the hardware sequentially, with no other intervening commands.
2042 *
2043 * This leads to an implementation of a "firmware lock" as a mutex that
2044 * can be taken recursively, and which is taken by both the low-level
2045 * command submission function (mwl8k_post_cmd) as well as any users of
2046 * that function that require issuing of an atomic sequence of commands,
2047 * and quiesces the transmit path whenever it's taken.
2048 */
2049static int mwl8k_fw_lock(struct ieee80211_hw *hw)
2050{
2051	struct mwl8k_priv *priv = hw->priv;
2052
2053	if (priv->fw_mutex_owner != current) {
2054		int rc;
2055
2056		mutex_lock(&priv->fw_mutex);
2057		ieee80211_stop_queues(hw);
2058
2059		rc = mwl8k_tx_wait_empty(hw);
2060		if (rc) {
2061			ieee80211_wake_queues(hw);
2062			mutex_unlock(&priv->fw_mutex);
2063
2064			return rc;
2065		}
2066
2067		priv->fw_mutex_owner = current;
2068	}
2069
2070	priv->fw_mutex_depth++;
2071
2072	return 0;
2073}
2074
2075static void mwl8k_fw_unlock(struct ieee80211_hw *hw)
2076{
2077	struct mwl8k_priv *priv = hw->priv;
2078
2079	if (!--priv->fw_mutex_depth) {
2080		ieee80211_wake_queues(hw);
2081		priv->fw_mutex_owner = NULL;
2082		mutex_unlock(&priv->fw_mutex);
2083	}
2084}
2085
2086
2087/*
2088 * Command processing.
2089 */
2090
2091/* Timeout firmware commands after 10s */
2092#define MWL8K_CMD_TIMEOUT_MS	10000
2093
2094static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
2095{
2096	DECLARE_COMPLETION_ONSTACK(cmd_wait);
2097	struct mwl8k_priv *priv = hw->priv;
2098	void __iomem *regs = priv->regs;
2099	dma_addr_t dma_addr;
2100	unsigned int dma_size;
2101	int rc;
2102	unsigned long timeout = 0;
2103	u8 buf[32];
2104
2105	cmd->result = (__force __le16) 0xffff;
2106	dma_size = le16_to_cpu(cmd->length);
2107	dma_addr = pci_map_single(priv->pdev, cmd, dma_size,
2108				  PCI_DMA_BIDIRECTIONAL);
2109	if (pci_dma_mapping_error(priv->pdev, dma_addr))
2110		return -ENOMEM;
2111
2112	rc = mwl8k_fw_lock(hw);
2113	if (rc) {
2114		pci_unmap_single(priv->pdev, dma_addr, dma_size,
2115						PCI_DMA_BIDIRECTIONAL);
2116		return rc;
2117	}
2118
2119	priv->hostcmd_wait = &cmd_wait;
2120	iowrite32(dma_addr, regs + MWL8K_HIU_GEN_PTR);
2121	iowrite32(MWL8K_H2A_INT_DOORBELL,
2122		regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
2123	iowrite32(MWL8K_H2A_INT_DUMMY,
2124		regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
2125
2126	timeout = wait_for_completion_timeout(&cmd_wait,
2127				msecs_to_jiffies(MWL8K_CMD_TIMEOUT_MS));
2128
2129	priv->hostcmd_wait = NULL;
2130
2131	mwl8k_fw_unlock(hw);
2132
2133	pci_unmap_single(priv->pdev, dma_addr, dma_size,
2134					PCI_DMA_BIDIRECTIONAL);
2135
2136	if (!timeout) {
2137		wiphy_err(hw->wiphy, "Command %s timeout after %u ms\n",
2138			  mwl8k_cmd_name(cmd->code, buf, sizeof(buf)),
2139			  MWL8K_CMD_TIMEOUT_MS);
2140		rc = -ETIMEDOUT;
2141	} else {
2142		int ms;
2143
2144		ms = MWL8K_CMD_TIMEOUT_MS - jiffies_to_msecs(timeout);
2145
2146		rc = cmd->result ? -EINVAL : 0;
2147		if (rc)
2148			wiphy_err(hw->wiphy, "Command %s error 0x%x\n",
2149				  mwl8k_cmd_name(cmd->code, buf, sizeof(buf)),
2150				  le16_to_cpu(cmd->result));
2151		else if (ms > 2000)
2152			wiphy_notice(hw->wiphy, "Command %s took %d ms\n",
2153				     mwl8k_cmd_name(cmd->code,
2154						    buf, sizeof(buf)),
2155				     ms);
2156	}
2157
2158	return rc;
2159}
2160
2161static int mwl8k_post_pervif_cmd(struct ieee80211_hw *hw,
2162				 struct ieee80211_vif *vif,
2163				 struct mwl8k_cmd_pkt *cmd)
2164{
2165	if (vif != NULL)
2166		cmd->macid = MWL8K_VIF(vif)->macid;
2167	return mwl8k_post_cmd(hw, cmd);
2168}
2169
2170/*
2171 * Setup code shared between STA and AP firmware images.
2172 */
2173static void mwl8k_setup_2ghz_band(struct ieee80211_hw *hw)
2174{
2175	struct mwl8k_priv *priv = hw->priv;
2176
2177	BUILD_BUG_ON(sizeof(priv->channels_24) != sizeof(mwl8k_channels_24));
2178	memcpy(priv->channels_24, mwl8k_channels_24, sizeof(mwl8k_channels_24));
2179
2180	BUILD_BUG_ON(sizeof(priv->rates_24) != sizeof(mwl8k_rates_24));
2181	memcpy(priv->rates_24, mwl8k_rates_24, sizeof(mwl8k_rates_24));
2182
2183	priv->band_24.band = IEEE80211_BAND_2GHZ;
2184	priv->band_24.channels = priv->channels_24;
2185	priv->band_24.n_channels = ARRAY_SIZE(mwl8k_channels_24);
2186	priv->band_24.bitrates = priv->rates_24;
2187	priv->band_24.n_bitrates = ARRAY_SIZE(mwl8k_rates_24);
2188
2189	hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band_24;
2190}
2191
2192static void mwl8k_setup_5ghz_band(struct ieee80211_hw *hw)
2193{
2194	struct mwl8k_priv *priv = hw->priv;
2195
2196	BUILD_BUG_ON(sizeof(priv->channels_50) != sizeof(mwl8k_channels_50));
2197	memcpy(priv->channels_50, mwl8k_channels_50, sizeof(mwl8k_channels_50));
2198
2199	BUILD_BUG_ON(sizeof(priv->rates_50) != sizeof(mwl8k_rates_50));
2200	memcpy(priv->rates_50, mwl8k_rates_50, sizeof(mwl8k_rates_50));
2201
2202	priv->band_50.band = IEEE80211_BAND_5GHZ;
2203	priv->band_50.channels = priv->channels_50;
2204	priv->band_50.n_channels = ARRAY_SIZE(mwl8k_channels_50);
2205	priv->band_50.bitrates = priv->rates_50;
2206	priv->band_50.n_bitrates = ARRAY_SIZE(mwl8k_rates_50);
2207
2208	hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &priv->band_50;
2209}
2210
2211/*
2212 * CMD_GET_HW_SPEC (STA version).
2213 */
2214struct mwl8k_cmd_get_hw_spec_sta {
2215	struct mwl8k_cmd_pkt header;
2216	__u8 hw_rev;
2217	__u8 host_interface;
2218	__le16 num_mcaddrs;
2219	__u8 perm_addr[ETH_ALEN];
2220	__le16 region_code;
2221	__le32 fw_rev;
2222	__le32 ps_cookie;
2223	__le32 caps;
2224	__u8 mcs_bitmap[16];
2225	__le32 rx_queue_ptr;
2226	__le32 num_tx_queues;
2227	__le32 tx_queue_ptrs[MWL8K_TX_WMM_QUEUES];
2228	__le32 caps2;
2229	__le32 num_tx_desc_per_queue;
2230	__le32 total_rxd;
2231} __packed;
2232
2233#define MWL8K_CAP_MAX_AMSDU		0x20000000
2234#define MWL8K_CAP_GREENFIELD		0x08000000
2235#define MWL8K_CAP_AMPDU			0x04000000
2236#define MWL8K_CAP_RX_STBC		0x01000000
2237#define MWL8K_CAP_TX_STBC		0x00800000
2238#define MWL8K_CAP_SHORTGI_40MHZ		0x00400000
2239#define MWL8K_CAP_SHORTGI_20MHZ		0x00200000
2240#define MWL8K_CAP_RX_ANTENNA_MASK	0x000e0000
2241#define MWL8K_CAP_TX_ANTENNA_MASK	0x0001c000
2242#define MWL8K_CAP_DELAY_BA		0x00003000
2243#define MWL8K_CAP_MIMO			0x00000200
2244#define MWL8K_CAP_40MHZ			0x00000100
2245#define MWL8K_CAP_BAND_MASK		0x00000007
2246#define MWL8K_CAP_5GHZ			0x00000004
2247#define MWL8K_CAP_2GHZ4			0x00000001
2248
2249static void
2250mwl8k_set_ht_caps(struct ieee80211_hw *hw,
2251		  struct ieee80211_supported_band *band, u32 cap)
2252{
2253	int rx_streams;
2254	int tx_streams;
2255
2256	band->ht_cap.ht_supported = 1;
2257
2258	if (cap & MWL8K_CAP_MAX_AMSDU)
2259		band->ht_cap.cap |= IEEE80211_HT_CAP_MAX_AMSDU;
2260	if (cap & MWL8K_CAP_GREENFIELD)
2261		band->ht_cap.cap |= IEEE80211_HT_CAP_GRN_FLD;
2262	if (cap & MWL8K_CAP_AMPDU) {
2263		hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
2264		band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
2265		band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_NONE;
2266	}
2267	if (cap & MWL8K_CAP_RX_STBC)
2268		band->ht_cap.cap |= IEEE80211_HT_CAP_RX_STBC;
2269	if (cap & MWL8K_CAP_TX_STBC)
2270		band->ht_cap.cap |= IEEE80211_HT_CAP_TX_STBC;
2271	if (cap & MWL8K_CAP_SHORTGI_40MHZ)
2272		band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
2273	if (cap & MWL8K_CAP_SHORTGI_20MHZ)
2274		band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
2275	if (cap & MWL8K_CAP_DELAY_BA)
2276		band->ht_cap.cap |= IEEE80211_HT_CAP_DELAY_BA;
2277	if (cap & MWL8K_CAP_40MHZ)
2278		band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
2279
2280	rx_streams = hweight32(cap & MWL8K_CAP_RX_ANTENNA_MASK);
2281	tx_streams = hweight32(cap & MWL8K_CAP_TX_ANTENNA_MASK);
2282
2283	band->ht_cap.mcs.rx_mask[0] = 0xff;
2284	if (rx_streams >= 2)
2285		band->ht_cap.mcs.rx_mask[1] = 0xff;
2286	if (rx_streams >= 3)
2287		band->ht_cap.mcs.rx_mask[2] = 0xff;
2288	band->ht_cap.mcs.rx_mask[4] = 0x01;
2289	band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
2290
2291	if (rx_streams != tx_streams) {
2292		band->ht_cap.mcs.tx_params |= IEEE80211_HT_MCS_TX_RX_DIFF;
2293		band->ht_cap.mcs.tx_params |= (tx_streams - 1) <<
2294				IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
2295	}
2296}
2297
2298static void
2299mwl8k_set_caps(struct ieee80211_hw *hw, u32 caps)
2300{
2301	struct mwl8k_priv *priv = hw->priv;
2302
2303	if ((caps & MWL8K_CAP_2GHZ4) || !(caps & MWL8K_CAP_BAND_MASK)) {
2304		mwl8k_setup_2ghz_band(hw);
2305		if (caps & MWL8K_CAP_MIMO)
2306			mwl8k_set_ht_caps(hw, &priv->band_24, caps);
2307	}
2308
2309	if (caps & MWL8K_CAP_5GHZ) {
2310		mwl8k_setup_5ghz_band(hw);
2311		if (caps & MWL8K_CAP_MIMO)
2312			mwl8k_set_ht_caps(hw, &priv->band_50, caps);
2313	}
2314}
2315
2316static int mwl8k_cmd_get_hw_spec_sta(struct ieee80211_hw *hw)
2317{
2318	struct mwl8k_priv *priv = hw->priv;
2319	struct mwl8k_cmd_get_hw_spec_sta *cmd;
2320	int rc;
2321	int i;
2322
2323	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2324	if (cmd == NULL)
2325		return -ENOMEM;
2326
2327	cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_HW_SPEC);
2328	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2329
2330	memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
2331	cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
2332	cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rxd_dma);
2333	cmd->num_tx_queues = cpu_to_le32(mwl8k_tx_queues(priv));
2334	for (i = 0; i < mwl8k_tx_queues(priv); i++)
2335		cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[i].txd_dma);
2336	cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
2337	cmd->total_rxd = cpu_to_le32(MWL8K_RX_DESCS);
2338
2339	rc = mwl8k_post_cmd(hw, &cmd->header);
2340
2341	if (!rc) {
2342		SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
2343		priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
2344		priv->fw_rev = le32_to_cpu(cmd->fw_rev);
2345		priv->hw_rev = cmd->hw_rev;
2346		mwl8k_set_caps(hw, le32_to_cpu(cmd->caps));
2347		priv->ap_macids_supported = 0x00000000;
2348		priv->sta_macids_supported = 0x00000001;
2349	}
2350
2351	kfree(cmd);
2352	return rc;
2353}
2354
2355/*
2356 * CMD_GET_HW_SPEC (AP version).
2357 */
2358struct mwl8k_cmd_get_hw_spec_ap {
2359	struct mwl8k_cmd_pkt header;
2360	__u8 hw_rev;
2361	__u8 host_interface;
2362	__le16 num_wcb;
2363	__le16 num_mcaddrs;
2364	__u8 perm_addr[ETH_ALEN];
2365	__le16 region_code;
2366	__le16 num_antenna;
2367	__le32 fw_rev;
2368	__le32 wcbbase0;
2369	__le32 rxwrptr;
2370	__le32 rxrdptr;
2371	__le32 ps_cookie;
2372	__le32 wcbbase1;
2373	__le32 wcbbase2;
2374	__le32 wcbbase3;
2375	__le32 fw_api_version;
2376	__le32 caps;
2377	__le32 num_of_ampdu_queues;
2378	__le32 wcbbase_ampdu[MWL8K_MAX_AMPDU_QUEUES];
2379} __packed;
2380
2381static int mwl8k_cmd_get_hw_spec_ap(struct ieee80211_hw *hw)
2382{
2383	struct mwl8k_priv *priv = hw->priv;
2384	struct mwl8k_cmd_get_hw_spec_ap *cmd;
2385	int rc, i;
2386	u32 api_version;
2387
2388	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2389	if (cmd == NULL)
2390		return -ENOMEM;
2391
2392	cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_HW_SPEC);
2393	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2394
2395	memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
2396	cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
2397
2398	rc = mwl8k_post_cmd(hw, &cmd->header);
2399
2400	if (!rc) {
2401		int off;
2402
2403		api_version = le32_to_cpu(cmd->fw_api_version);
2404		if (priv->device_info->fw_api_ap != api_version) {
2405			printk(KERN_ERR "%s: Unsupported fw API version for %s."
2406			       "  Expected %d got %d.\n", MWL8K_NAME,
2407			       priv->device_info->part_name,
2408			       priv->device_info->fw_api_ap,
2409			       api_version);
2410			rc = -EINVAL;
2411			goto done;
2412		}
2413		SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
2414		priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
2415		priv->fw_rev = le32_to_cpu(cmd->fw_rev);
2416		priv->hw_rev = cmd->hw_rev;
2417		mwl8k_set_caps(hw, le32_to_cpu(cmd->caps));
2418		priv->ap_macids_supported = 0x000000ff;
2419		priv->sta_macids_supported = 0x00000000;
2420		priv->num_ampdu_queues = le32_to_cpu(cmd->num_of_ampdu_queues);
2421		if (priv->num_ampdu_queues > MWL8K_MAX_AMPDU_QUEUES) {
2422			wiphy_warn(hw->wiphy, "fw reported %d ampdu queues"
2423				   " but we only support %d.\n",
2424				   priv->num_ampdu_queues,
2425				   MWL8K_MAX_AMPDU_QUEUES);
2426			priv->num_ampdu_queues = MWL8K_MAX_AMPDU_QUEUES;
2427		}
2428		off = le32_to_cpu(cmd->rxwrptr) & 0xffff;
2429		iowrite32(priv->rxq[0].rxd_dma, priv->sram + off);
2430
2431		off = le32_to_cpu(cmd->rxrdptr) & 0xffff;
2432		iowrite32(priv->rxq[0].rxd_dma, priv->sram + off);
2433
2434		priv->txq_offset[0] = le32_to_cpu(cmd->wcbbase0) & 0xffff;
2435		priv->txq_offset[1] = le32_to_cpu(cmd->wcbbase1) & 0xffff;
2436		priv->txq_offset[2] = le32_to_cpu(cmd->wcbbase2) & 0xffff;
2437		priv->txq_offset[3] = le32_to_cpu(cmd->wcbbase3) & 0xffff;
2438
2439		for (i = 0; i < priv->num_ampdu_queues; i++)
2440			priv->txq_offset[i + MWL8K_TX_WMM_QUEUES] =
2441				le32_to_cpu(cmd->wcbbase_ampdu[i]) & 0xffff;
2442	}
2443
2444done:
2445	kfree(cmd);
2446	return rc;
2447}
2448
2449/*
2450 * CMD_SET_HW_SPEC.
2451 */
2452struct mwl8k_cmd_set_hw_spec {
2453	struct mwl8k_cmd_pkt header;
2454	__u8 hw_rev;
2455	__u8 host_interface;
2456	__le16 num_mcaddrs;
2457	__u8 perm_addr[ETH_ALEN];
2458	__le16 region_code;
2459	__le32 fw_rev;
2460	__le32 ps_cookie;
2461	__le32 caps;
2462	__le32 rx_queue_ptr;
2463	__le32 num_tx_queues;
2464	__le32 tx_queue_ptrs[MWL8K_MAX_TX_QUEUES];
2465	__le32 flags;
2466	__le32 num_tx_desc_per_queue;
2467	__le32 total_rxd;
2468} __packed;
2469
2470/* If enabled, MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY will cause
2471 * packets to expire 500 ms after the timestamp in the tx descriptor.  That is,
2472 * the packets that are queued for more than 500ms, will be dropped in the
2473 * hardware. This helps minimizing the issues caused due to head-of-line
2474 * blocking where a slow client can hog the bandwidth and affect traffic to a
2475 * faster client.
2476 */
2477#define MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY	0x00000400
2478#define MWL8K_SET_HW_SPEC_FLAG_GENERATE_CCMP_HDR	0x00000200
2479#define MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT		0x00000080
2480#define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP	0x00000020
2481#define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON		0x00000010
2482
2483static int mwl8k_cmd_set_hw_spec(struct ieee80211_hw *hw)
2484{
2485	struct mwl8k_priv *priv = hw->priv;
2486	struct mwl8k_cmd_set_hw_spec *cmd;
2487	int rc;
2488	int i;
2489
2490	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2491	if (cmd == NULL)
2492		return -ENOMEM;
2493
2494	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_HW_SPEC);
2495	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2496
2497	cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
2498	cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rxd_dma);
2499	cmd->num_tx_queues = cpu_to_le32(mwl8k_tx_queues(priv));
2500
2501	/*
2502	 * Mac80211 stack has Q0 as highest priority and Q3 as lowest in
2503	 * that order. Firmware has Q3 as highest priority and Q0 as lowest
2504	 * in that order. Map Q3 of mac80211 to Q0 of firmware so that the
2505	 * priority is interpreted the right way in firmware.
2506	 */
2507	for (i = 0; i < mwl8k_tx_queues(priv); i++) {
2508		int j = mwl8k_tx_queues(priv) - 1 - i;
2509		cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[j].txd_dma);
2510	}
2511
2512	cmd->flags = cpu_to_le32(MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT |
2513				 MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP |
2514				 MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON |
2515				 MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY |
2516				 MWL8K_SET_HW_SPEC_FLAG_GENERATE_CCMP_HDR);
2517	cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
2518	cmd->total_rxd = cpu_to_le32(MWL8K_RX_DESCS);
2519
2520	rc = mwl8k_post_cmd(hw, &cmd->header);
2521	kfree(cmd);
2522
2523	return rc;
2524}
2525
2526/*
2527 * CMD_MAC_MULTICAST_ADR.
2528 */
2529struct mwl8k_cmd_mac_multicast_adr {
2530	struct mwl8k_cmd_pkt header;
2531	__le16 action;
2532	__le16 numaddr;
2533	__u8 addr[0][ETH_ALEN];
2534};
2535
2536#define MWL8K_ENABLE_RX_DIRECTED	0x0001
2537#define MWL8K_ENABLE_RX_MULTICAST	0x0002
2538#define MWL8K_ENABLE_RX_ALL_MULTICAST	0x0004
2539#define MWL8K_ENABLE_RX_BROADCAST	0x0008
2540
2541static struct mwl8k_cmd_pkt *
2542__mwl8k_cmd_mac_multicast_adr(struct ieee80211_hw *hw, int allmulti,
2543			      struct netdev_hw_addr_list *mc_list)
2544{
2545	struct mwl8k_priv *priv = hw->priv;
2546	struct mwl8k_cmd_mac_multicast_adr *cmd;
2547	int size;
2548	int mc_count = 0;
2549
2550	if (mc_list)
2551		mc_count = netdev_hw_addr_list_count(mc_list);
2552
2553	if (allmulti || mc_count > priv->num_mcaddrs) {
2554		allmulti = 1;
2555		mc_count = 0;
2556	}
2557
2558	size = sizeof(*cmd) + mc_count * ETH_ALEN;
2559
2560	cmd = kzalloc(size, GFP_ATOMIC);
2561	if (cmd == NULL)
2562		return NULL;
2563
2564	cmd->header.code = cpu_to_le16(MWL8K_CMD_MAC_MULTICAST_ADR);
2565	cmd->header.length = cpu_to_le16(size);
2566	cmd->action = cpu_to_le16(MWL8K_ENABLE_RX_DIRECTED |
2567				  MWL8K_ENABLE_RX_BROADCAST);
2568
2569	if (allmulti) {
2570		cmd->action |= cpu_to_le16(MWL8K_ENABLE_RX_ALL_MULTICAST);
2571	} else if (mc_count) {
2572		struct netdev_hw_addr *ha;
2573		int i = 0;
2574
2575		cmd->action |= cpu_to_le16(MWL8K_ENABLE_RX_MULTICAST);
2576		cmd->numaddr = cpu_to_le16(mc_count);
2577		netdev_hw_addr_list_for_each(ha, mc_list) {
2578			memcpy(cmd->addr[i], ha->addr, ETH_ALEN);
2579		}
2580	}
2581
2582	return &cmd->header;
2583}
2584
2585/*
2586 * CMD_GET_STAT.
2587 */
2588struct mwl8k_cmd_get_stat {
2589	struct mwl8k_cmd_pkt header;
2590	__le32 stats[64];
2591} __packed;
2592
2593#define MWL8K_STAT_ACK_FAILURE	9
2594#define MWL8K_STAT_RTS_FAILURE	12
2595#define MWL8K_STAT_FCS_ERROR	24
2596#define MWL8K_STAT_RTS_SUCCESS	11
2597
2598static int mwl8k_cmd_get_stat(struct ieee80211_hw *hw,
2599			      struct ieee80211_low_level_stats *stats)
2600{
2601	struct mwl8k_cmd_get_stat *cmd;
2602	int rc;
2603
2604	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2605	if (cmd == NULL)
2606		return -ENOMEM;
2607
2608	cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_STAT);
2609	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2610
2611	rc = mwl8k_post_cmd(hw, &cmd->header);
2612	if (!rc) {
2613		stats->dot11ACKFailureCount =
2614			le32_to_cpu(cmd->stats[MWL8K_STAT_ACK_FAILURE]);
2615		stats->dot11RTSFailureCount =
2616			le32_to_cpu(cmd->stats[MWL8K_STAT_RTS_FAILURE]);
2617		stats->dot11FCSErrorCount =
2618			le32_to_cpu(cmd->stats[MWL8K_STAT_FCS_ERROR]);
2619		stats->dot11RTSSuccessCount =
2620			le32_to_cpu(cmd->stats[MWL8K_STAT_RTS_SUCCESS]);
2621	}
2622	kfree(cmd);
2623
2624	return rc;
2625}
2626
2627/*
2628 * CMD_RADIO_CONTROL.
2629 */
2630struct mwl8k_cmd_radio_control {
2631	struct mwl8k_cmd_pkt header;
2632	__le16 action;
2633	__le16 control;
2634	__le16 radio_on;
2635} __packed;
2636
2637static int
2638mwl8k_cmd_radio_control(struct ieee80211_hw *hw, bool enable, bool force)
2639{
2640	struct mwl8k_priv *priv = hw->priv;
2641	struct mwl8k_cmd_radio_control *cmd;
2642	int rc;
2643
2644	if (enable == priv->radio_on && !force)
2645		return 0;
2646
2647	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2648	if (cmd == NULL)
2649		return -ENOMEM;
2650
2651	cmd->header.code = cpu_to_le16(MWL8K_CMD_RADIO_CONTROL);
2652	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2653	cmd->action = cpu_to_le16(MWL8K_CMD_SET);
2654	cmd->control = cpu_to_le16(priv->radio_short_preamble ? 3 : 1);
2655	cmd->radio_on = cpu_to_le16(enable ? 0x0001 : 0x0000);
2656
2657	rc = mwl8k_post_cmd(hw, &cmd->header);
2658	kfree(cmd);
2659
2660	if (!rc)
2661		priv->radio_on = enable;
2662
2663	return rc;
2664}
2665
2666static int mwl8k_cmd_radio_disable(struct ieee80211_hw *hw)
2667{
2668	return mwl8k_cmd_radio_control(hw, 0, 0);
2669}
2670
2671static int mwl8k_cmd_radio_enable(struct ieee80211_hw *hw)
2672{
2673	return mwl8k_cmd_radio_control(hw, 1, 0);
2674}
2675
2676static int
2677mwl8k_set_radio_preamble(struct ieee80211_hw *hw, bool short_preamble)
2678{
2679	struct mwl8k_priv *priv = hw->priv;
2680
2681	priv->radio_short_preamble = short_preamble;
2682
2683	return mwl8k_cmd_radio_control(hw, 1, 1);
2684}
2685
2686/*
2687 * CMD_RF_TX_POWER.
2688 */
2689#define MWL8K_RF_TX_POWER_LEVEL_TOTAL	8
2690
2691struct mwl8k_cmd_rf_tx_power {
2692	struct mwl8k_cmd_pkt header;
2693	__le16 action;
2694	__le16 support_level;
2695	__le16 current_level;
2696	__le16 reserved;
2697	__le16 power_level_list[MWL8K_RF_TX_POWER_LEVEL_TOTAL];
2698} __packed;
2699
2700static int mwl8k_cmd_rf_tx_power(struct ieee80211_hw *hw, int dBm)
2701{
2702	struct mwl8k_cmd_rf_tx_power *cmd;
2703	int rc;
2704
2705	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2706	if (cmd == NULL)
2707		return -ENOMEM;
2708
2709	cmd->header.code = cpu_to_le16(MWL8K_CMD_RF_TX_POWER);
2710	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2711	cmd->action = cpu_to_le16(MWL8K_CMD_SET);
2712	cmd->support_level = cpu_to_le16(dBm);
2713
2714	rc = mwl8k_post_cmd(hw, &cmd->header);
2715	kfree(cmd);
2716
2717	return rc;
2718}
2719
2720/*
2721 * CMD_TX_POWER.
2722 */
2723#define MWL8K_TX_POWER_LEVEL_TOTAL      12
2724
2725struct mwl8k_cmd_tx_power {
2726	struct mwl8k_cmd_pkt header;
2727	__le16 action;
2728	__le16 band;
2729	__le16 channel;
2730	__le16 bw;
2731	__le16 sub_ch;
2732	__le16 power_level_list[MWL8K_TX_POWER_LEVEL_TOTAL];
2733} __packed;
2734
2735static int mwl8k_cmd_tx_power(struct ieee80211_hw *hw,
2736				     struct ieee80211_conf *conf,
2737				     unsigned short pwr)
2738{
2739	struct ieee80211_channel *channel = conf->channel;
2740	struct mwl8k_cmd_tx_power *cmd;
2741	int rc;
2742	int i;
2743
2744	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2745	if (cmd == NULL)
2746		return -ENOMEM;
2747
2748	cmd->header.code = cpu_to_le16(MWL8K_CMD_TX_POWER);
2749	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2750	cmd->action = cpu_to_le16(MWL8K_CMD_SET_LIST);
2751
2752	if (channel->band == IEEE80211_BAND_2GHZ)
2753		cmd->band = cpu_to_le16(0x1);
2754	else if (channel->band == IEEE80211_BAND_5GHZ)
2755		cmd->band = cpu_to_le16(0x4);
2756
2757	cmd->channel = channel->hw_value;
2758
2759	if (conf->channel_type == NL80211_CHAN_NO_HT ||
2760	    conf->channel_type == NL80211_CHAN_HT20) {
2761		cmd->bw = cpu_to_le16(0x2);
2762	} else {
2763		cmd->bw = cpu_to_le16(0x4);
2764		if (conf->channel_type == NL80211_CHAN_HT40MINUS)
2765			cmd->sub_ch = cpu_to_le16(0x3);
2766		else if (conf->channel_type == NL80211_CHAN_HT40PLUS)
2767			cmd->sub_ch = cpu_to_le16(0x1);
2768	}
2769
2770	for (i = 0; i < MWL8K_TX_POWER_LEVEL_TOTAL; i++)
2771		cmd->power_level_list[i] = cpu_to_le16(pwr);
2772
2773	rc = mwl8k_post_cmd(hw, &cmd->header);
2774	kfree(cmd);
2775
2776	return rc;
2777}
2778
2779/*
2780 * CMD_RF_ANTENNA.
2781 */
2782struct mwl8k_cmd_rf_antenna {
2783	struct mwl8k_cmd_pkt header;
2784	__le16 antenna;
2785	__le16 mode;
2786} __packed;
2787
2788#define MWL8K_RF_ANTENNA_RX		1
2789#define MWL8K_RF_ANTENNA_TX		2
2790
2791static int
2792mwl8k_cmd_rf_antenna(struct ieee80211_hw *hw, int antenna, int mask)
2793{
2794	struct mwl8k_cmd_rf_antenna *cmd;
2795	int rc;
2796
2797	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2798	if (cmd == NULL)
2799		return -ENOMEM;
2800
2801	cmd->header.code = cpu_to_le16(MWL8K_CMD_RF_ANTENNA);
2802	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2803	cmd->antenna = cpu_to_le16(antenna);
2804	cmd->mode = cpu_to_le16(mask);
2805
2806	rc = mwl8k_post_cmd(hw, &cmd->header);
2807	kfree(cmd);
2808
2809	return rc;
2810}
2811
2812/*
2813 * CMD_SET_BEACON.
2814 */
2815struct mwl8k_cmd_set_beacon {
2816	struct mwl8k_cmd_pkt header;
2817	__le16 beacon_len;
2818	__u8 beacon[0];
2819};
2820
2821static int mwl8k_cmd_set_beacon(struct ieee80211_hw *hw,
2822				struct ieee80211_vif *vif, u8 *beacon, int len)
2823{
2824	struct mwl8k_cmd_set_beacon *cmd;
2825	int rc;
2826
2827	cmd = kzalloc(sizeof(*cmd) + len, GFP_KERNEL);
2828	if (cmd == NULL)
2829		return -ENOMEM;
2830
2831	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_BEACON);
2832	cmd->header.length = cpu_to_le16(sizeof(*cmd) + len);
2833	cmd->beacon_len = cpu_to_le16(len);
2834	memcpy(cmd->beacon, beacon, len);
2835
2836	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
2837	kfree(cmd);
2838
2839	return rc;
2840}
2841
2842/*
2843 * CMD_SET_PRE_SCAN.
2844 */
2845struct mwl8k_cmd_set_pre_scan {
2846	struct mwl8k_cmd_pkt header;
2847} __packed;
2848
2849static int mwl8k_cmd_set_pre_scan(struct ieee80211_hw *hw)
2850{
2851	struct mwl8k_cmd_set_pre_scan *cmd;
2852	int rc;
2853
2854	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2855	if (cmd == NULL)
2856		return -ENOMEM;
2857
2858	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_PRE_SCAN);
2859	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2860
2861	rc = mwl8k_post_cmd(hw, &cmd->header);
2862	kfree(cmd);
2863
2864	return rc;
2865}
2866
2867/*
2868 * CMD_SET_POST_SCAN.
2869 */
2870struct mwl8k_cmd_set_post_scan {
2871	struct mwl8k_cmd_pkt header;
2872	__le32 isibss;
2873	__u8 bssid[ETH_ALEN];
2874} __packed;
2875
2876static int
2877mwl8k_cmd_set_post_scan(struct ieee80211_hw *hw, const __u8 *mac)
2878{
2879	struct mwl8k_cmd_set_post_scan *cmd;
2880	int rc;
2881
2882	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2883	if (cmd == NULL)
2884		return -ENOMEM;
2885
2886	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_POST_SCAN);
2887	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2888	cmd->isibss = 0;
2889	memcpy(cmd->bssid, mac, ETH_ALEN);
2890
2891	rc = mwl8k_post_cmd(hw, &cmd->header);
2892	kfree(cmd);
2893
2894	return rc;
2895}
2896
2897/*
2898 * CMD_SET_RF_CHANNEL.
2899 */
2900struct mwl8k_cmd_set_rf_channel {
2901	struct mwl8k_cmd_pkt header;
2902	__le16 action;
2903	__u8 current_channel;
2904	__le32 channel_flags;
2905} __packed;
2906
2907static int mwl8k_cmd_set_rf_channel(struct ieee80211_hw *hw,
2908				    struct ieee80211_conf *conf)
2909{
2910	struct ieee80211_channel *channel = conf->channel;
2911	struct mwl8k_cmd_set_rf_channel *cmd;
2912	int rc;
2913
2914	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2915	if (cmd == NULL)
2916		return -ENOMEM;
2917
2918	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RF_CHANNEL);
2919	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2920	cmd->action = cpu_to_le16(MWL8K_CMD_SET);
2921	cmd->current_channel = channel->hw_value;
2922
2923	if (channel->band == IEEE80211_BAND_2GHZ)
2924		cmd->channel_flags |= cpu_to_le32(0x00000001);
2925	else if (channel->band == IEEE80211_BAND_5GHZ)
2926		cmd->channel_flags |= cpu_to_le32(0x00000004);
2927
2928	if (conf->channel_type == NL80211_CHAN_NO_HT ||
2929	    conf->channel_type == NL80211_CHAN_HT20)
2930		cmd->channel_flags |= cpu_to_le32(0x00000080);
2931	else if (conf->channel_type == NL80211_CHAN_HT40MINUS)
2932		cmd->channel_flags |= cpu_to_le32(0x000001900);
2933	else if (conf->channel_type == NL80211_CHAN_HT40PLUS)
2934		cmd->channel_flags |= cpu_to_le32(0x000000900);
2935
2936	rc = mwl8k_post_cmd(hw, &cmd->header);
2937	kfree(cmd);
2938
2939	return rc;
2940}
2941
2942/*
2943 * CMD_SET_AID.
2944 */
2945#define MWL8K_FRAME_PROT_DISABLED			0x00
2946#define MWL8K_FRAME_PROT_11G				0x07
2947#define MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY		0x02
2948#define MWL8K_FRAME_PROT_11N_HT_ALL			0x06
2949
2950struct mwl8k_cmd_update_set_aid {
2951	struct	mwl8k_cmd_pkt header;
2952	__le16	aid;
2953
2954	 /* AP's MAC address (BSSID) */
2955	__u8	bssid[ETH_ALEN];
2956	__le16	protection_mode;
2957	__u8	supp_rates[14];
2958} __packed;
2959
2960static void legacy_rate_mask_to_array(u8 *rates, u32 mask)
2961{
2962	int i;
2963	int j;
2964
2965	/*
2966	 * Clear nonstandard rates 4 and 13.
2967	 */
2968	mask &= 0x1fef;
2969
2970	for (i = 0, j = 0; i < 14; i++) {
2971		if (mask & (1 << i))
2972			rates[j++] = mwl8k_rates_24[i].hw_value;
2973	}
2974}
2975
2976static int
2977mwl8k_cmd_set_aid(struct ieee80211_hw *hw,
2978		  struct ieee80211_vif *vif, u32 legacy_rate_mask)
2979{
2980	struct mwl8k_cmd_update_set_aid *cmd;
2981	u16 prot_mode;
2982	int rc;
2983
2984	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2985	if (cmd == NULL)
2986		return -ENOMEM;
2987
2988	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_AID);
2989	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2990	cmd->aid = cpu_to_le16(vif->bss_conf.aid);
2991	memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
2992
2993	if (vif->bss_conf.use_cts_prot) {
2994		prot_mode = MWL8K_FRAME_PROT_11G;
2995	} else {
2996		switch (vif->bss_conf.ht_operation_mode &
2997			IEEE80211_HT_OP_MODE_PROTECTION) {
2998		case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
2999			prot_mode = MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY;
3000			break;
3001		case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
3002			prot_mode = MWL8K_FRAME_PROT_11N_HT_ALL;
3003			break;
3004		default:
3005			prot_mode = MWL8K_FRAME_PROT_DISABLED;
3006			break;
3007		}
3008	}
3009	cmd->protection_mode = cpu_to_le16(prot_mode);
3010
3011	legacy_rate_mask_to_array(cmd->supp_rates, legacy_rate_mask);
3012
3013	rc = mwl8k_post_cmd(hw, &cmd->header);
3014	kfree(cmd);
3015
3016	return rc;
3017}
3018
3019/*
3020 * CMD_SET_RATE.
3021 */
3022struct mwl8k_cmd_set_rate {
3023	struct	mwl8k_cmd_pkt header;
3024	__u8	legacy_rates[14];
3025
3026	/* Bitmap for supported MCS codes.  */
3027	__u8	mcs_set[16];
3028	__u8	reserved[16];
3029} __packed;
3030
3031static int
3032mwl8k_cmd_set_rate(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
3033		   u32 legacy_rate_mask, u8 *mcs_rates)
3034{
3035	struct mwl8k_cmd_set_rate *cmd;
3036	int rc;
3037
3038	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3039	if (cmd == NULL)
3040		return -ENOMEM;
3041
3042	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATE);
3043	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3044	legacy_rate_mask_to_array(cmd->legacy_rates, legacy_rate_mask);
3045	memcpy(cmd->mcs_set, mcs_rates, 16);
3046
3047	rc = mwl8k_post_cmd(hw, &cmd->header);
3048	kfree(cmd);
3049
3050	return rc;
3051}
3052
3053/*
3054 * CMD_FINALIZE_JOIN.
3055 */
3056#define MWL8K_FJ_BEACON_MAXLEN	128
3057
3058struct mwl8k_cmd_finalize_join {
3059	struct mwl8k_cmd_pkt header;
3060	__le32 sleep_interval;	/* Number of beacon periods to sleep */
3061	__u8 beacon_data[MWL8K_FJ_BEACON_MAXLEN];
3062} __packed;
3063
3064static int mwl8k_cmd_finalize_join(struct ieee80211_hw *hw, void *frame,
3065				   int framelen, int dtim)
3066{
3067	struct mwl8k_cmd_finalize_join *cmd;
3068	struct ieee80211_mgmt *payload = frame;
3069	int payload_len;
3070	int rc;
3071
3072	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3073	if (cmd == NULL)
3074		return -ENOMEM;
3075
3076	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_FINALIZE_JOIN);
3077	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3078	cmd->sleep_interval = cpu_to_le32(dtim ? dtim : 1);
3079
3080	payload_len = framelen - ieee80211_hdrlen(payload->frame_control);
3081	if (payload_len < 0)
3082		payload_len = 0;
3083	else if (payload_len > MWL8K_FJ_BEACON_MAXLEN)
3084		payload_len = MWL8K_FJ_BEACON_MAXLEN;
3085
3086	memcpy(cmd->beacon_data, &payload->u.beacon, payload_len);
3087
3088	rc = mwl8k_post_cmd(hw, &cmd->header);
3089	kfree(cmd);
3090
3091	return rc;
3092}
3093
3094/*
3095 * CMD_SET_RTS_THRESHOLD.
3096 */
3097struct mwl8k_cmd_set_rts_threshold {
3098	struct mwl8k_cmd_pkt header;
3099	__le16 action;
3100	__le16 threshold;
3101} __packed;
3102
3103static int
3104mwl8k_cmd_set_rts_threshold(struct ieee80211_hw *hw, int rts_thresh)
3105{
3106	struct mwl8k_cmd_set_rts_threshold *cmd;
3107	int rc;
3108
3109	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3110	if (cmd == NULL)
3111		return -ENOMEM;
3112
3113	cmd->header.code = cpu_to_le16(MWL8K_CMD_RTS_THRESHOLD);
3114	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3115	cmd->action = cpu_to_le16(MWL8K_CMD_SET);
3116	cmd->threshold = cpu_to_le16(rts_thresh);
3117
3118	rc = mwl8k_post_cmd(hw, &cmd->header);
3119	kfree(cmd);
3120
3121	return rc;
3122}
3123
3124/*
3125 * CMD_SET_SLOT.
3126 */
3127struct mwl8k_cmd_set_slot {
3128	struct mwl8k_cmd_pkt header;
3129	__le16 action;
3130	__u8 short_slot;
3131} __packed;
3132
3133static int mwl8k_cmd_set_slot(struct ieee80211_hw *hw, bool short_slot_time)
3134{
3135	struct mwl8k_cmd_set_slot *cmd;
3136	int rc;
3137
3138	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3139	if (cmd == NULL)
3140		return -ENOMEM;
3141
3142	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_SLOT);
3143	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3144	cmd->action = cpu_to_le16(MWL8K_CMD_SET);
3145	cmd->short_slot = short_slot_time;
3146
3147	rc = mwl8k_post_cmd(hw, &cmd->header);
3148	kfree(cmd);
3149
3150	return rc;
3151}
3152
3153/*
3154 * CMD_SET_EDCA_PARAMS.
3155 */
3156struct mwl8k_cmd_set_edca_params {
3157	struct mwl8k_cmd_pkt header;
3158
3159	/* See MWL8K_SET_EDCA_XXX below */
3160	__le16 action;
3161
3162	/* TX opportunity in units of 32 us */
3163	__le16 txop;
3164
3165	union {
3166		struct {
3167			/* Log exponent of max contention period: 0...15 */
3168			__le32 log_cw_max;
3169
3170			/* Log exponent of min contention period: 0...15 */
3171			__le32 log_cw_min;
3172
3173			/* Adaptive interframe spacing in units of 32us */
3174			__u8 aifs;
3175
3176			/* TX queue to configure */
3177			__u8 txq;
3178		} ap;
3179		struct {
3180			/* Log exponent of max contention period: 0...15 */
3181			__u8 log_cw_max;
3182
3183			/* Log exponent of min contention period: 0...15 */
3184			__u8 log_cw_min;
3185
3186			/* Adaptive interframe spacing in units of 32us */
3187			__u8 aifs;
3188
3189			/* TX queue to configure */
3190			__u8 txq;
3191		} sta;
3192	};
3193} __packed;
3194
3195#define MWL8K_SET_EDCA_CW	0x01
3196#define MWL8K_SET_EDCA_TXOP	0x02
3197#define MWL8K_SET_EDCA_AIFS	0x04
3198
3199#define MWL8K_SET_EDCA_ALL	(MWL8K_SET_EDCA_CW | \
3200				 MWL8K_SET_EDCA_TXOP | \
3201				 MWL8K_SET_EDCA_AIFS)
3202
3203static int
3204mwl8k_cmd_set_edca_params(struct ieee80211_hw *hw, __u8 qnum,
3205			  __u16 cw_min, __u16 cw_max,
3206			  __u8 aifs, __u16 txop)
3207{
3208	struct mwl8k_priv *priv = hw->priv;
3209	struct mwl8k_cmd_set_edca_params *cmd;
3210	int rc;
3211
3212	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3213	if (cmd == NULL)
3214		return -ENOMEM;
3215
3216	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_EDCA_PARAMS);
3217	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3218	cmd->action = cpu_to_le16(MWL8K_SET_EDCA_ALL);
3219	cmd->txop = cpu_to_le16(txop);
3220	if (priv->ap_fw) {
3221		cmd->ap.log_cw_max = cpu_to_le32(ilog2(cw_max + 1));
3222		cmd->ap.log_cw_min = cpu_to_le32(ilog2(cw_min + 1));
3223		cmd->ap.aifs = aifs;
3224		cmd->ap.txq = qnum;
3225	} else {
3226		cmd->sta.log_cw_max = (u8)ilog2(cw_max + 1);
3227		cmd->sta.log_cw_min = (u8)ilog2(cw_min + 1);
3228		cmd->sta.aifs = aifs;
3229		cmd->sta.txq = qnum;
3230	}
3231
3232	rc = mwl8k_post_cmd(hw, &cmd->header);
3233	kfree(cmd);
3234
3235	return rc;
3236}
3237
3238/*
3239 * CMD_SET_WMM_MODE.
3240 */
3241struct mwl8k_cmd_set_wmm_mode {
3242	struct mwl8k_cmd_pkt header;
3243	__le16 action;
3244} __packed;
3245
3246static int mwl8k_cmd_set_wmm_mode(struct ieee80211_hw *hw, bool enable)
3247{
3248	struct mwl8k_priv *priv = hw->priv;
3249	struct mwl8k_cmd_set_wmm_mode *cmd;
3250	int rc;
3251
3252	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3253	if (cmd == NULL)
3254		return -ENOMEM;
3255
3256	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_WMM_MODE);
3257	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3258	cmd->action = cpu_to_le16(!!enable);
3259
3260	rc = mwl8k_post_cmd(hw, &cmd->header);
3261	kfree(cmd);
3262
3263	if (!rc)
3264		priv->wmm_enabled = enable;
3265
3266	return rc;
3267}
3268
3269/*
3270 * CMD_MIMO_CONFIG.
3271 */
3272struct mwl8k_cmd_mimo_config {
3273	struct mwl8k_cmd_pkt header;
3274	__le32 action;
3275	__u8 rx_antenna_map;
3276	__u8 tx_antenna_map;
3277} __packed;
3278
3279static int mwl8k_cmd_mimo_config(struct ieee80211_hw *hw, __u8 rx, __u8 tx)
3280{
3281	struct mwl8k_cmd_mimo_config *cmd;
3282	int rc;
3283
3284	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3285	if (cmd == NULL)
3286		return -ENOMEM;
3287
3288	cmd->header.code = cpu_to_le16(MWL8K_CMD_MIMO_CONFIG);
3289	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3290	cmd->action = cpu_to_le32((u32)MWL8K_CMD_SET);
3291	cmd->rx_antenna_map = rx;
3292	cmd->tx_antenna_map = tx;
3293
3294	rc = mwl8k_post_cmd(hw, &cmd->header);
3295	kfree(cmd);
3296
3297	return rc;
3298}
3299
3300/*
3301 * CMD_USE_FIXED_RATE (STA version).
3302 */
3303struct mwl8k_cmd_use_fixed_rate_sta {
3304	struct mwl8k_cmd_pkt header;
3305	__le32 action;
3306	__le32 allow_rate_drop;
3307	__le32 num_rates;
3308	struct {
3309		__le32 is_ht_rate;
3310		__le32 enable_retry;
3311		__le32 rate;
3312		__le32 retry_count;
3313	} rate_entry[8];
3314	__le32 rate_type;
3315	__le32 reserved1;
3316	__le32 reserved2;
3317} __packed;
3318
3319#define MWL8K_USE_AUTO_RATE	0x0002
3320#define MWL8K_UCAST_RATE	0
3321
3322static int mwl8k_cmd_use_fixed_rate_sta(struct ieee80211_hw *hw)
3323{
3324	struct mwl8k_cmd_use_fixed_rate_sta *cmd;
3325	int rc;
3326
3327	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3328	if (cmd == NULL)
3329		return -ENOMEM;
3330
3331	cmd->header.code = cpu_to_le16(MWL8K_CMD_USE_FIXED_RATE);
3332	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3333	cmd->action = cpu_to_le32(MWL8K_USE_AUTO_RATE);
3334	cmd->rate_type = cpu_to_le32(MWL8K_UCAST_RATE);
3335
3336	rc = mwl8k_post_cmd(hw, &cmd->header);
3337	kfree(cmd);
3338
3339	return rc;
3340}
3341
3342/*
3343 * CMD_USE_FIXED_RATE (AP version).
3344 */
3345struct mwl8k_cmd_use_fixed_rate_ap {
3346	struct mwl8k_cmd_pkt header;
3347	__le32 action;
3348	__le32 allow_rate_drop;
3349	__le32 num_rates;
3350	struct mwl8k_rate_entry_ap {
3351		__le32 is_ht_rate;
3352		__le32 enable_retry;
3353		__le32 rate;
3354		__le32 retry_count;
3355	} rate_entry[4];
3356	u8 multicast_rate;
3357	u8 multicast_rate_type;
3358	u8 management_rate;
3359} __packed;
3360
3361static int
3362mwl8k_cmd_use_fixed_rate_ap(struct ieee80211_hw *hw, int mcast, int mgmt)
3363{
3364	struct mwl8k_cmd_use_fixed_rate_ap *cmd;
3365	int rc;
3366
3367	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3368	if (cmd == NULL)
3369		return -ENOMEM;
3370
3371	cmd->header.code = cpu_to_le16(MWL8K_CMD_USE_FIXED_RATE);
3372	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3373	cmd->action = cpu_to_le32(MWL8K_USE_AUTO_RATE);
3374	cmd->multicast_rate = mcast;
3375	cmd->management_rate = mgmt;
3376
3377	rc = mwl8k_post_cmd(hw, &cmd->header);
3378	kfree(cmd);
3379
3380	return rc;
3381}
3382
3383/*
3384 * CMD_ENABLE_SNIFFER.
3385 */
3386struct mwl8k_cmd_enable_sniffer {
3387	struct mwl8k_cmd_pkt header;
3388	__le32 action;
3389} __packed;
3390
3391static int mwl8k_cmd_enable_sniffer(struct ieee80211_hw *hw, bool enable)
3392{
3393	struct mwl8k_cmd_enable_sniffer *cmd;
3394	int rc;
3395
3396	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3397	if (cmd == NULL)
3398		return -ENOMEM;
3399
3400	cmd->header.code = cpu_to_le16(MWL8K_CMD_ENABLE_SNIFFER);
3401	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3402	cmd->action = cpu_to_le32(!!enable);
3403
3404	rc = mwl8k_post_cmd(hw, &cmd->header);
3405	kfree(cmd);
3406
3407	return rc;
3408}
3409
3410/*
3411 * CMD_SET_MAC_ADDR.
3412 */
3413struct mwl8k_cmd_set_mac_addr {
3414	struct mwl8k_cmd_pkt header;
3415	union {
3416		struct {
3417			__le16 mac_type;
3418			__u8 mac_addr[ETH_ALEN];
3419		} mbss;
3420		__u8 mac_addr[ETH_ALEN];
3421	};
3422} __packed;
3423
3424#define MWL8K_MAC_TYPE_PRIMARY_CLIENT		0
3425#define MWL8K_MAC_TYPE_SECONDARY_CLIENT		1
3426#define MWL8K_MAC_TYPE_PRIMARY_AP		2
3427#define MWL8K_MAC_TYPE_SECONDARY_AP		3
3428
3429static int mwl8k_cmd_set_mac_addr(struct ieee80211_hw *hw,
3430				  struct ieee80211_vif *vif, u8 *mac)
3431{
3432	struct mwl8k_priv *priv = hw->priv;
3433	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
3434	struct mwl8k_cmd_set_mac_addr *cmd;
3435	int mac_type;
3436	int rc;
3437
3438	mac_type = MWL8K_MAC_TYPE_PRIMARY_AP;
3439	if (vif != NULL && vif->type == NL80211_IFTYPE_STATION) {
3440		if (mwl8k_vif->macid + 1 == ffs(priv->sta_macids_supported))
3441			mac_type = MWL8K_MAC_TYPE_PRIMARY_CLIENT;
3442		else
3443			mac_type = MWL8K_MAC_TYPE_SECONDARY_CLIENT;
3444	} else if (vif != NULL && vif->type == NL80211_IFTYPE_AP) {
3445		if (mwl8k_vif->macid + 1 == ffs(priv->ap_macids_supported))
3446			mac_type = MWL8K_MAC_TYPE_PRIMARY_AP;
3447		else
3448			mac_type = MWL8K_MAC_TYPE_SECONDARY_AP;
3449	}
3450
3451	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3452	if (cmd == NULL)
3453		return -ENOMEM;
3454
3455	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_MAC_ADDR);
3456	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3457	if (priv->ap_fw) {
3458		cmd->mbss.mac_type = cpu_to_le16(mac_type);
3459		memcpy(cmd->mbss.mac_addr, mac, ETH_ALEN);
3460	} else {
3461		memcpy(cmd->mac_addr, mac, ETH_ALEN);
3462	}
3463
3464	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3465	kfree(cmd);
3466
3467	return rc;
3468}
3469
3470/*
3471 * CMD_SET_RATEADAPT_MODE.
3472 */
3473struct mwl8k_cmd_set_rate_adapt_mode {
3474	struct mwl8k_cmd_pkt header;
3475	__le16 action;
3476	__le16 mode;
3477} __packed;
3478
3479static int mwl8k_cmd_set_rateadapt_mode(struct ieee80211_hw *hw, __u16 mode)
3480{
3481	struct mwl8k_cmd_set_rate_adapt_mode *cmd;
3482	int rc;
3483
3484	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3485	if (cmd == NULL)
3486		return -ENOMEM;
3487
3488	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATEADAPT_MODE);
3489	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3490	cmd->action = cpu_to_le16(MWL8K_CMD_SET);
3491	cmd->mode = cpu_to_le16(mode);
3492
3493	rc = mwl8k_post_cmd(hw, &cmd->header);
3494	kfree(cmd);
3495
3496	return rc;
3497}
3498
3499/*
3500 * CMD_GET_WATCHDOG_BITMAP.
3501 */
3502struct mwl8k_cmd_get_watchdog_bitmap {
3503	struct mwl8k_cmd_pkt header;
3504	u8	bitmap;
3505} __packed;
3506
3507static int mwl8k_cmd_get_watchdog_bitmap(struct ieee80211_hw *hw, u8 *bitmap)
3508{
3509	struct mwl8k_cmd_get_watchdog_bitmap *cmd;
3510	int rc;
3511
3512	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3513	if (cmd == NULL)
3514		return -ENOMEM;
3515
3516	cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_WATCHDOG_BITMAP);
3517	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3518
3519	rc = mwl8k_post_cmd(hw, &cmd->header);
3520	if (!rc)
3521		*bitmap = cmd->bitmap;
3522
3523	kfree(cmd);
3524
3525	return rc;
3526}
3527
3528#define INVALID_BA	0xAA
3529static void mwl8k_watchdog_ba_events(struct work_struct *work)
3530{
3531	int rc;
3532	u8 bitmap = 0, stream_index;
3533	struct mwl8k_ampdu_stream *streams;
3534	struct mwl8k_priv *priv =
3535		container_of(work, struct mwl8k_priv, watchdog_ba_handle);
3536
3537	rc = mwl8k_cmd_get_watchdog_bitmap(priv->hw, &bitmap);
3538	if (rc)
3539		return;
3540
3541	if (bitmap == INVALID_BA)
3542		return;
3543
3544	/* the bitmap is the hw queue number.  Map it to the ampdu queue. */
3545	stream_index = bitmap - MWL8K_TX_WMM_QUEUES;
3546
3547	BUG_ON(stream_index >= priv->num_ampdu_queues);
3548
3549	streams = &priv->ampdu[stream_index];
3550
3551	if (streams->state == AMPDU_STREAM_ACTIVE)
3552		ieee80211_stop_tx_ba_session(streams->sta, streams->tid);
3553
3554	return;
3555}
3556
3557
3558/*
3559 * CMD_BSS_START.
3560 */
3561struct mwl8k_cmd_bss_start {
3562	struct mwl8k_cmd_pkt header;
3563	__le32 enable;
3564} __packed;
3565
3566static int mwl8k_cmd_bss_start(struct ieee80211_hw *hw,
3567			       struct ieee80211_vif *vif, int enable)
3568{
3569	struct mwl8k_cmd_bss_start *cmd;
3570	int rc;
3571
3572	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3573	if (cmd == NULL)
3574		return -ENOMEM;
3575
3576	cmd->header.code = cpu_to_le16(MWL8K_CMD_BSS_START);
3577	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3578	cmd->enable = cpu_to_le32(enable);
3579
3580	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3581	kfree(cmd);
3582
3583	return rc;
3584}
3585
3586/*
3587 * CMD_BASTREAM.
3588 */
3589
3590/*
3591 * UPSTREAM is tx direction
3592 */
3593#define BASTREAM_FLAG_DIRECTION_UPSTREAM	0x00
3594#define BASTREAM_FLAG_IMMEDIATE_TYPE		0x01
3595
3596enum ba_stream_action_type {
3597	MWL8K_BA_CREATE,
3598	MWL8K_BA_UPDATE,
3599	MWL8K_BA_DESTROY,
3600	MWL8K_BA_FLUSH,
3601	MWL8K_BA_CHECK,
3602};
3603
3604
3605struct mwl8k_create_ba_stream {
3606	__le32	flags;
3607	__le32	idle_thrs;
3608	__le32	bar_thrs;
3609	__le32	window_size;
3610	u8	peer_mac_addr[6];
3611	u8	dialog_token;
3612	u8	tid;
3613	u8	queue_id;
3614	u8	param_info;
3615	__le32	ba_context;
3616	u8	reset_seq_no_flag;
3617	__le16	curr_seq_no;
3618	u8	sta_src_mac_addr[6];
3619} __packed;
3620
3621struct mwl8k_destroy_ba_stream {
3622	__le32	flags;
3623	__le32	ba_context;
3624} __packed;
3625
3626struct mwl8k_cmd_bastream {
3627	struct mwl8k_cmd_pkt	header;
3628	__le32	action;
3629	union {
3630		struct mwl8k_create_ba_stream	create_params;
3631		struct mwl8k_destroy_ba_stream	destroy_params;
3632	};
3633} __packed;
3634
3635static int
3636mwl8k_check_ba(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream)
3637{
3638	struct mwl8k_cmd_bastream *cmd;
3639	int rc;
3640
3641	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3642	if (cmd == NULL)
3643		return -ENOMEM;
3644
3645	cmd->header.code = cpu_to_le16(MWL8K_CMD_BASTREAM);
3646	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3647
3648	cmd->action = cpu_to_le32(MWL8K_BA_CHECK);
3649
3650	cmd->create_params.queue_id = stream->idx;
3651	memcpy(&cmd->create_params.peer_mac_addr[0], stream->sta->addr,
3652	       ETH_ALEN);
3653	cmd->create_params.tid = stream->tid;
3654
3655	cmd->create_params.flags =
3656		cpu_to_le32(BASTREAM_FLAG_IMMEDIATE_TYPE) |
3657		cpu_to_le32(BASTREAM_FLAG_DIRECTION_UPSTREAM);
3658
3659	rc = mwl8k_post_cmd(hw, &cmd->header);
3660
3661	kfree(cmd);
3662
3663	return rc;
3664}
3665
3666static int
3667mwl8k_create_ba(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream,
3668		u8 buf_size)
3669{
3670	struct mwl8k_cmd_bastream *cmd;
3671	int rc;
3672
3673	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3674	if (cmd == NULL)
3675		return -ENOMEM;
3676
3677
3678	cmd->header.code = cpu_to_le16(MWL8K_CMD_BASTREAM);
3679	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3680
3681	cmd->action = cpu_to_le32(MWL8K_BA_CREATE);
3682
3683	cmd->create_params.bar_thrs = cpu_to_le32((u32)buf_size);
3684	cmd->create_params.window_size = cpu_to_le32((u32)buf_size);
3685	cmd->create_params.queue_id = stream->idx;
3686
3687	memcpy(cmd->create_params.peer_mac_addr, stream->sta->addr, ETH_ALEN);
3688	cmd->create_params.tid = stream->tid;
3689	cmd->create_params.curr_seq_no = cpu_to_le16(0);
3690	cmd->create_params.reset_seq_no_flag = 1;
3691
3692	cmd->create_params.param_info =
3693		(stream->sta->ht_cap.ampdu_factor &
3694		 IEEE80211_HT_AMPDU_PARM_FACTOR) |
3695		((stream->sta->ht_cap.ampdu_density << 2) &
3696		 IEEE80211_HT_AMPDU_PARM_DENSITY);
3697
3698	cmd->create_params.flags =
3699		cpu_to_le32(BASTREAM_FLAG_IMMEDIATE_TYPE |
3700					BASTREAM_FLAG_DIRECTION_UPSTREAM);
3701
3702	rc = mwl8k_post_cmd(hw, &cmd->header);
3703
3704	wiphy_debug(hw->wiphy, "Created a BA stream for %pM : tid %d\n",
3705		stream->sta->addr, stream->tid);
3706	kfree(cmd);
3707
3708	return rc;
3709}
3710
3711static void mwl8k_destroy_ba(struct ieee80211_hw *hw,
3712			     struct mwl8k_ampdu_stream *stream)
3713{
3714	struct mwl8k_cmd_bastream *cmd;
3715
3716	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3717	if (cmd == NULL)
3718		return;
3719
3720	cmd->header.code = cpu_to_le16(MWL8K_CMD_BASTREAM);
3721	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3722	cmd->action = cpu_to_le32(MWL8K_BA_DESTROY);
3723
3724	cmd->destroy_params.ba_context = cpu_to_le32(stream->idx);
3725	mwl8k_post_cmd(hw, &cmd->header);
3726
3727	wiphy_debug(hw->wiphy, "Deleted BA stream index %d\n", stream->idx);
3728
3729	kfree(cmd);
3730}
3731
3732/*
3733 * CMD_SET_NEW_STN.
3734 */
3735struct mwl8k_cmd_set_new_stn {
3736	struct mwl8k_cmd_pkt header;
3737	__le16 aid;
3738	__u8 mac_addr[6];
3739	__le16 stn_id;
3740	__le16 action;
3741	__le16 rsvd;
3742	__le32 legacy_rates;
3743	__u8 ht_rates[4];
3744	__le16 cap_info;
3745	__le16 ht_capabilities_info;
3746	__u8 mac_ht_param_info;
3747	__u8 rev;
3748	__u8 control_channel;
3749	__u8 add_channel;
3750	__le16 op_mode;
3751	__le16 stbc;
3752	__u8 add_qos_info;
3753	__u8 is_qos_sta;
3754	__le32 fw_sta_ptr;
3755} __packed;
3756
3757#define MWL8K_STA_ACTION_ADD		0
3758#define MWL8K_STA_ACTION_REMOVE		2
3759
3760static int mwl8k_cmd_set_new_stn_add(struct ieee80211_hw *hw,
3761				     struct ieee80211_vif *vif,
3762				     struct ieee80211_sta *sta)
3763{
3764	struct mwl8k_cmd_set_new_stn *cmd;
3765	u32 rates;
3766	int rc;
3767
3768	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3769	if (cmd == NULL)
3770		return -ENOMEM;
3771
3772	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_NEW_STN);
3773	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3774	cmd->aid = cpu_to_le16(sta->aid);
3775	memcpy(cmd->mac_addr, sta->addr, ETH_ALEN);
3776	cmd->stn_id = cpu_to_le16(sta->aid);
3777	cmd->action = cpu_to_le16(MWL8K_STA_ACTION_ADD);
3778	if (hw->conf.channel->band == IEEE80211_BAND_2GHZ)
3779		rates = sta->supp_rates[IEEE80211_BAND_2GHZ];
3780	else
3781		rates = sta->supp_rates[IEEE80211_BAND_5GHZ] << 5;
3782	cmd->legacy_rates = cpu_to_le32(rates);
3783	if (sta->ht_cap.ht_supported) {
3784		cmd->ht_rates[0] = sta->ht_cap.mcs.rx_mask[0];
3785		cmd->ht_rates[1] = sta->ht_cap.mcs.rx_mask[1];
3786		cmd->ht_rates[2] = sta->ht_cap.mcs.rx_mask[2];
3787		cmd->ht_rates[3] = sta->ht_cap.mcs.rx_mask[3];
3788		cmd->ht_capabilities_info = cpu_to_le16(sta->ht_cap.cap);
3789		cmd->mac_ht_param_info = (sta->ht_cap.ampdu_factor & 3) |
3790			((sta->ht_cap.ampdu_density & 7) << 2);
3791		cmd->is_qos_sta = 1;
3792	}
3793
3794	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3795	kfree(cmd);
3796
3797	return rc;
3798}
3799
3800static int mwl8k_cmd_set_new_stn_add_self(struct ieee80211_hw *hw,
3801					  struct ieee80211_vif *vif)
3802{
3803	struct mwl8k_cmd_set_new_stn *cmd;
3804	int rc;
3805
3806	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3807	if (cmd == NULL)
3808		return -ENOMEM;
3809
3810	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_NEW_STN);
3811	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3812	memcpy(cmd->mac_addr, vif->addr, ETH_ALEN);
3813
3814	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3815	kfree(cmd);
3816
3817	return rc;
3818}
3819
3820static int mwl8k_cmd_set_new_stn_del(struct ieee80211_hw *hw,
3821				     struct ieee80211_vif *vif, u8 *addr)
3822{
3823	struct mwl8k_cmd_set_new_stn *cmd;
3824	int rc;
3825
3826	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3827	if (cmd == NULL)
3828		return -ENOMEM;
3829
3830	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_NEW_STN);
3831	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3832	memcpy(cmd->mac_addr, addr, ETH_ALEN);
3833	cmd->action = cpu_to_le16(MWL8K_STA_ACTION_REMOVE);
3834
3835	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3836	kfree(cmd);
3837
3838	return rc;
3839}
3840
3841/*
3842 * CMD_UPDATE_ENCRYPTION.
3843 */
3844
3845#define MAX_ENCR_KEY_LENGTH	16
3846#define MIC_KEY_LENGTH		8
3847
3848struct mwl8k_cmd_update_encryption {
3849	struct mwl8k_cmd_pkt header;
3850
3851	__le32 action;
3852	__le32 reserved;
3853	__u8 mac_addr[6];
3854	__u8 encr_type;
3855
3856} __packed;
3857
3858struct mwl8k_cmd_set_key {
3859	struct mwl8k_cmd_pkt header;
3860
3861	__le32 action;
3862	__le32 reserved;
3863	__le16 length;
3864	__le16 key_type_id;
3865	__le32 key_info;
3866	__le32 key_id;
3867	__le16 key_len;
3868	__u8 key_material[MAX_ENCR_KEY_LENGTH];
3869	__u8 tkip_tx_mic_key[MIC_KEY_LENGTH];
3870	__u8 tkip_rx_mic_key[MIC_KEY_LENGTH];
3871	__le16 tkip_rsc_low;
3872	__le32 tkip_rsc_high;
3873	__le16 tkip_tsc_low;
3874	__le32 tkip_tsc_high;
3875	__u8 mac_addr[6];
3876} __packed;
3877
3878enum {
3879	MWL8K_ENCR_ENABLE,
3880	MWL8K_ENCR_SET_KEY,
3881	MWL8K_ENCR_REMOVE_KEY,
3882	MWL8K_ENCR_SET_GROUP_KEY,
3883};
3884
3885#define MWL8K_UPDATE_ENCRYPTION_TYPE_WEP	0
3886#define MWL8K_UPDATE_ENCRYPTION_TYPE_DISABLE	1
3887#define MWL8K_UPDATE_ENCRYPTION_TYPE_TKIP	4
3888#define MWL8K_UPDATE_ENCRYPTION_TYPE_MIXED	7
3889#define MWL8K_UPDATE_ENCRYPTION_TYPE_AES	8
3890
3891enum {
3892	MWL8K_ALG_WEP,
3893	MWL8K_ALG_TKIP,
3894	MWL8K_ALG_CCMP,
3895};
3896
3897#define MWL8K_KEY_FLAG_TXGROUPKEY	0x00000004
3898#define MWL8K_KEY_FLAG_PAIRWISE		0x00000008
3899#define MWL8K_KEY_FLAG_TSC_VALID	0x00000040
3900#define MWL8K_KEY_FLAG_WEP_TXKEY	0x01000000
3901#define MWL8K_KEY_FLAG_MICKEY_VALID	0x02000000
3902
3903static int mwl8k_cmd_update_encryption_enable(struct ieee80211_hw *hw,
3904					      struct ieee80211_vif *vif,
3905					      u8 *addr,
3906					      u8 encr_type)
3907{
3908	struct mwl8k_cmd_update_encryption *cmd;
3909	int rc;
3910
3911	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3912	if (cmd == NULL)
3913		return -ENOMEM;
3914
3915	cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_ENCRYPTION);
3916	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3917	cmd->action = cpu_to_le32(MWL8K_ENCR_ENABLE);
3918	memcpy(cmd->mac_addr, addr, ETH_ALEN);
3919	cmd->encr_type = encr_type;
3920
3921	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3922	kfree(cmd);
3923
3924	return rc;
3925}
3926
3927static int mwl8k_encryption_set_cmd_info(struct mwl8k_cmd_set_key *cmd,
3928						u8 *addr,
3929						struct ieee80211_key_conf *key)
3930{
3931	cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_ENCRYPTION);
3932	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3933	cmd->length = cpu_to_le16(sizeof(*cmd) -
3934				offsetof(struct mwl8k_cmd_set_key, length));
3935	cmd->key_id = cpu_to_le32(key->keyidx);
3936	cmd->key_len = cpu_to_le16(key->keylen);
3937	memcpy(cmd->mac_addr, addr, ETH_ALEN);
3938
3939	switch (key->cipher) {
3940	case WLAN_CIPHER_SUITE_WEP40:
3941	case WLAN_CIPHER_SUITE_WEP104:
3942		cmd->key_type_id = cpu_to_le16(MWL8K_ALG_WEP);
3943		if (key->keyidx == 0)
3944			cmd->key_info =	cpu_to_le32(MWL8K_KEY_FLAG_WEP_TXKEY);
3945
3946		break;
3947	case WLAN_CIPHER_SUITE_TKIP:
3948		cmd->key_type_id = cpu_to_le16(MWL8K_ALG_TKIP);
3949		cmd->key_info =	(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
3950			? cpu_to_le32(MWL8K_KEY_FLAG_PAIRWISE)
3951			: cpu_to_le32(MWL8K_KEY_FLAG_TXGROUPKEY);
3952		cmd->key_info |= cpu_to_le32(MWL8K_KEY_FLAG_MICKEY_VALID
3953						| MWL8K_KEY_FLAG_TSC_VALID);
3954		break;
3955	case WLAN_CIPHER_SUITE_CCMP:
3956		cmd->key_type_id = cpu_to_le16(MWL8K_ALG_CCMP);
3957		cmd->key_info =	(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
3958			? cpu_to_le32(MWL8K_KEY_FLAG_PAIRWISE)
3959			: cpu_to_le32(MWL8K_KEY_FLAG_TXGROUPKEY);
3960		break;
3961	default:
3962		return -ENOTSUPP;
3963	}
3964
3965	return 0;
3966}
3967
3968static int mwl8k_cmd_encryption_set_key(struct ieee80211_hw *hw,
3969						struct ieee80211_vif *vif,
3970						u8 *addr,
3971						struct ieee80211_key_conf *key)
3972{
3973	struct mwl8k_cmd_set_key *cmd;
3974	int rc;
3975	int keymlen;
3976	u32 action;
3977	u8 idx;
3978	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
3979
3980	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3981	if (cmd == NULL)
3982		return -ENOMEM;
3983
3984	rc = mwl8k_encryption_set_cmd_info(cmd, addr, key);
3985	if (rc < 0)
3986		goto done;
3987
3988	idx = key->keyidx;
3989
3990	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
3991		action = MWL8K_ENCR_SET_KEY;
3992	else
3993		action = MWL8K_ENCR_SET_GROUP_KEY;
3994
3995	switch (key->cipher) {
3996	case WLAN_CIPHER_SUITE_WEP40:
3997	case WLAN_CIPHER_SUITE_WEP104:
3998		if (!mwl8k_vif->wep_key_conf[idx].enabled) {
3999			memcpy(mwl8k_vif->wep_key_conf[idx].key, key,
4000						sizeof(*key) + key->keylen);
4001			mwl8k_vif->wep_key_conf[idx].enabled = 1;
4002		}
4003
4004		keymlen = key->keylen;
4005		action = MWL8K_ENCR_SET_KEY;
4006		break;
4007	case WLAN_CIPHER_SUITE_TKIP:
4008		keymlen = MAX_ENCR_KEY_LENGTH + 2 * MIC_KEY_LENGTH;
4009		break;
4010	case WLAN_CIPHER_SUITE_CCMP:
4011		keymlen = key->keylen;
4012		break;
4013	default:
4014		rc = -ENOTSUPP;
4015		goto done;
4016	}
4017
4018	memcpy(cmd->key_material, key->key, keymlen);
4019	cmd->action = cpu_to_le32(action);
4020
4021	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
4022done:
4023	kfree(cmd);
4024
4025	return rc;
4026}
4027
4028static int mwl8k_cmd_encryption_remove_key(struct ieee80211_hw *hw,
4029						struct ieee80211_vif *vif,
4030						u8 *addr,
4031						struct ieee80211_key_conf *key)
4032{
4033	struct mwl8k_cmd_set_key *cmd;
4034	int rc;
4035	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
4036
4037	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4038	if (cmd == NULL)
4039		return -ENOMEM;
4040
4041	rc = mwl8k_encryption_set_cmd_info(cmd, addr, key);
4042	if (rc < 0)
4043		goto done;
4044
4045	if (key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
4046			WLAN_CIPHER_SUITE_WEP104)
4047		mwl8k_vif->wep_key_conf[key->keyidx].enabled = 0;
4048
4049	cmd->action = cpu_to_le32(MWL8K_ENCR_REMOVE_KEY);
4050
4051	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
4052done:
4053	kfree(cmd);
4054
4055	return rc;
4056}
4057
4058static int mwl8k_set_key(struct ieee80211_hw *hw,
4059			 enum set_key_cmd cmd_param,
4060			 struct ieee80211_vif *vif,
4061			 struct ieee80211_sta *sta,
4062			 struct ieee80211_key_conf *key)
4063{
4064	int rc = 0;
4065	u8 encr_type;
4066	u8 *addr;
4067	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
4068
4069	if (vif->type == NL80211_IFTYPE_STATION)
4070		return -EOPNOTSUPP;
4071
4072	if (sta == NULL)
4073		addr = hw->wiphy->perm_addr;
4074	else
4075		addr = sta->addr;
4076
4077	if (cmd_param == SET_KEY) {
4078		rc = mwl8k_cmd_encryption_set_key(hw, vif, addr, key);
4079		if (rc)
4080			goto out;
4081
4082		if ((key->cipher == WLAN_CIPHER_SUITE_WEP40)
4083				|| (key->cipher == WLAN_CIPHER_SUITE_WEP104))
4084			encr_type = MWL8K_UPDATE_ENCRYPTION_TYPE_WEP;
4085		else
4086			encr_type = MWL8K_UPDATE_ENCRYPTION_TYPE_MIXED;
4087
4088		rc = mwl8k_cmd_update_encryption_enable(hw, vif, addr,
4089								encr_type);
4090		if (rc)
4091			goto out;
4092
4093		mwl8k_vif->is_hw_crypto_enabled = true;
4094
4095	} else {
4096		rc = mwl8k_cmd_encryption_remove_key(hw, vif, addr, key);
4097
4098		if (rc)
4099			goto out;
4100	}
4101out:
4102	return rc;
4103}
4104
4105/*
4106 * CMD_UPDATE_STADB.
4107 */
4108struct ewc_ht_info {
4109	__le16	control1;
4110	__le16	control2;
4111	__le16	control3;
4112} __packed;
4113
4114struct peer_capability_info {
4115	/* Peer type - AP vs. STA.  */
4116	__u8	peer_type;
4117
4118	/* Basic 802.11 capabilities from assoc resp.  */
4119	__le16	basic_caps;
4120
4121	/* Set if peer supports 802.11n high throughput (HT).  */
4122	__u8	ht_support;
4123
4124	/* Valid if HT is supported.  */
4125	__le16	ht_caps;
4126	__u8	extended_ht_caps;
4127	struct ewc_ht_info	ewc_info;
4128
4129	/* Legacy rate table. Intersection of our rates and peer rates.  */
4130	__u8	legacy_rates[12];
4131
4132	/* HT rate table. Intersection of our rates and peer rates.  */
4133	__u8	ht_rates[16];
4134	__u8	pad[16];
4135
4136	/* If set, interoperability mode, no proprietary extensions.  */
4137	__u8	interop;
4138	__u8	pad2;
4139	__u8	station_id;
4140	__le16	amsdu_enabled;
4141} __packed;
4142
4143struct mwl8k_cmd_update_stadb {
4144	struct mwl8k_cmd_pkt header;
4145
4146	/* See STADB_ACTION_TYPE */
4147	__le32	action;
4148
4149	/* Peer MAC address */
4150	__u8	peer_addr[ETH_ALEN];
4151
4152	__le32	reserved;
4153
4154	/* Peer info - valid during add/update.  */
4155	struct peer_capability_info	peer_info;
4156} __packed;
4157
4158#define MWL8K_STA_DB_MODIFY_ENTRY	1
4159#define MWL8K_STA_DB_DEL_ENTRY		2
4160
4161/* Peer Entry flags - used to define the type of the peer node */
4162#define MWL8K_PEER_TYPE_ACCESSPOINT	2
4163
4164static int mwl8k_cmd_update_stadb_add(struct ieee80211_hw *hw,
4165				      struct ieee80211_vif *vif,
4166				      struct ieee80211_sta *sta)
4167{
4168	struct mwl8k_cmd_update_stadb *cmd;
4169	struct peer_capability_info *p;
4170	u32 rates;
4171	int rc;
4172
4173	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4174	if (cmd == NULL)
4175		return -ENOMEM;
4176
4177	cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_STADB);
4178	cmd->header.length = cpu_to_le16(sizeof(*cmd));
4179	cmd->action = cpu_to_le32(MWL8K_STA_DB_MODIFY_ENTRY);
4180	memcpy(cmd->peer_addr, sta->addr, ETH_ALEN);
4181
4182	p = &cmd->peer_info;
4183	p->peer_type = MWL8K_PEER_TYPE_ACCESSPOINT;
4184	p->basic_caps = cpu_to_le16(vif->bss_conf.assoc_capability);
4185	p->ht_support = sta->ht_cap.ht_supported;
4186	p->ht_caps = cpu_to_le16(sta->ht_cap.cap);
4187	p->extended_ht_caps = (sta->ht_cap.ampdu_factor & 3) |
4188		((sta->ht_cap.ampdu_density & 7) << 2);
4189	if (hw->conf.channel->band == IEEE80211_BAND_2GHZ)
4190		rates = sta->supp_rates[IEEE80211_BAND_2GHZ];
4191	else
4192		rates = sta->supp_rates[IEEE80211_BAND_5GHZ] << 5;
4193	legacy_rate_mask_to_array(p->legacy_rates, rates);
4194	memcpy(p->ht_rates, sta->ht_cap.mcs.rx_mask, 16);
4195	p->interop = 1;
4196	p->amsdu_enabled = 0;
4197
4198	rc = mwl8k_post_cmd(hw, &cmd->header);
4199	kfree(cmd);
4200
4201	return rc ? rc : p->station_id;
4202}
4203
4204static int mwl8k_cmd_update_stadb_del(struct ieee80211_hw *hw,
4205				      struct ieee80211_vif *vif, u8 *addr)
4206{
4207	struct mwl8k_cmd_update_stadb *cmd;
4208	int rc;
4209
4210	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4211	if (cmd == NULL)
4212		return -ENOMEM;
4213
4214	cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_STADB);
4215	cmd->header.length = cpu_to_le16(sizeof(*cmd));
4216	cmd->action = cpu_to_le32(MWL8K_STA_DB_DEL_ENTRY);
4217	memcpy(cmd->peer_addr, addr, ETH_ALEN);
4218
4219	rc = mwl8k_post_cmd(hw, &cmd->header);
4220	kfree(cmd);
4221
4222	return rc;
4223}
4224
4225
4226/*
4227 * Interrupt handling.
4228 */
4229static irqreturn_t mwl8k_interrupt(int irq, void *dev_id)
4230{
4231	struct ieee80211_hw *hw = dev_id;
4232	struct mwl8k_priv *priv = hw->priv;
4233	u32 status;
4234
4235	status = ioread32(priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
4236	if (!status)
4237		return IRQ_NONE;
4238
4239	if (status & MWL8K_A2H_INT_TX_DONE) {
4240		status &= ~MWL8K_A2H_INT_TX_DONE;
4241		tasklet_schedule(&priv->poll_tx_task);
4242	}
4243
4244	if (status & MWL8K_A2H_INT_RX_READY) {
4245		status &= ~MWL8K_A2H_INT_RX_READY;
4246		tasklet_schedule(&priv->poll_rx_task);
4247	}
4248
4249	if (status & MWL8K_A2H_INT_BA_WATCHDOG) {
4250		status &= ~MWL8K_A2H_INT_BA_WATCHDOG;
4251		ieee80211_queue_work(hw, &priv->watchdog_ba_handle);
4252	}
4253
4254	if (status)
4255		iowrite32(~status, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
4256
4257	if (status & MWL8K_A2H_INT_OPC_DONE) {
4258		if (priv->hostcmd_wait != NULL)
4259			complete(priv->hostcmd_wait);
4260	}
4261
4262	if (status & MWL8K_A2H_INT_QUEUE_EMPTY) {
4263		if (!mutex_is_locked(&priv->fw_mutex) &&
4264		    priv->radio_on && priv->pending_tx_pkts)
4265			mwl8k_tx_start(priv);
4266	}
4267
4268	return IRQ_HANDLED;
4269}
4270
4271static void mwl8k_tx_poll(unsigned long data)
4272{
4273	struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
4274	struct mwl8k_priv *priv = hw->priv;
4275	int limit;
4276	int i;
4277
4278	limit = 32;
4279
4280	spin_lock_bh(&priv->tx_lock);
4281
4282	for (i = 0; i < mwl8k_tx_queues(priv); i++)
4283		limit -= mwl8k_txq_reclaim(hw, i, limit, 0);
4284
4285	if (!priv->pending_tx_pkts && priv->tx_wait != NULL) {
4286		complete(priv->tx_wait);
4287		priv->tx_wait = NULL;
4288	}
4289
4290	spin_unlock_bh(&priv->tx_lock);
4291
4292	if (limit) {
4293		writel(~MWL8K_A2H_INT_TX_DONE,
4294		       priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
4295	} else {
4296		tasklet_schedule(&priv->poll_tx_task);
4297	}
4298}
4299
4300static void mwl8k_rx_poll(unsigned long data)
4301{
4302	struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
4303	struct mwl8k_priv *priv = hw->priv;
4304	int limit;
4305
4306	limit = 32;
4307	limit -= rxq_process(hw, 0, limit);
4308	limit -= rxq_refill(hw, 0, limit);
4309
4310	if (limit) {
4311		writel(~MWL8K_A2H_INT_RX_READY,
4312		       priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
4313	} else {
4314		tasklet_schedule(&priv->poll_rx_task);
4315	}
4316}
4317
4318
4319/*
4320 * Core driver operations.
4321 */
4322static void mwl8k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
4323{
4324	struct mwl8k_priv *priv = hw->priv;
4325	int index = skb_get_queue_mapping(skb);
4326
4327	if (!priv->radio_on) {
4328		wiphy_debug(hw->wiphy,
4329			    "dropped TX frame since radio disabled\n");
4330		dev_kfree_skb(skb);
4331		return;
4332	}
4333
4334	mwl8k_txq_xmit(hw, index, skb);
4335}
4336
4337static int mwl8k_start(struct ieee80211_hw *hw)
4338{
4339	struct mwl8k_priv *priv = hw->priv;
4340	int rc;
4341
4342	rc = request_irq(priv->pdev->irq, mwl8k_interrupt,
4343			 IRQF_SHARED, MWL8K_NAME, hw);
4344	if (rc) {
4345		priv->irq = -1;
4346		wiphy_err(hw->wiphy, "failed to register IRQ handler\n");
4347		return -EIO;
4348	}
4349	priv->irq = priv->pdev->irq;
4350
4351	/* Enable TX reclaim and RX tasklets.  */
4352	tasklet_enable(&priv->poll_tx_task);
4353	tasklet_enable(&priv->poll_rx_task);
4354
4355	/* Enable interrupts */
4356	iowrite32(MWL8K_A2H_EVENTS, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
4357	iowrite32(MWL8K_A2H_EVENTS,
4358		  priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
4359
4360	rc = mwl8k_fw_lock(hw);
4361	if (!rc) {
4362		rc = mwl8k_cmd_radio_enable(hw);
4363
4364		if (!priv->ap_fw) {
4365			if (!rc)
4366				rc = mwl8k_cmd_enable_sniffer(hw, 0);
4367
4368			if (!rc)
4369				rc = mwl8k_cmd_set_pre_scan(hw);
4370
4371			if (!rc)
4372				rc = mwl8k_cmd_set_post_scan(hw,
4373						"\x00\x00\x00\x00\x00\x00");
4374		}
4375
4376		if (!rc)
4377			rc = mwl8k_cmd_set_rateadapt_mode(hw, 0);
4378
4379		if (!rc)
4380			rc = mwl8k_cmd_set_wmm_mode(hw, 0);
4381
4382		mwl8k_fw_unlock(hw);
4383	}
4384
4385	if (rc) {
4386		iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
4387		free_irq(priv->pdev->irq, hw);
4388		priv->irq = -1;
4389		tasklet_disable(&priv->poll_tx_task);
4390		tasklet_disable(&priv->poll_rx_task);
4391	}
4392
4393	return rc;
4394}
4395
4396static void mwl8k_stop(struct ieee80211_hw *hw)
4397{
4398	struct mwl8k_priv *priv = hw->priv;
4399	int i;
4400
4401	mwl8k_cmd_radio_disable(hw);
4402
4403	ieee80211_stop_queues(hw);
4404
4405	/* Disable interrupts */
4406	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
4407	if (priv->irq != -1) {
4408		free_irq(priv->pdev->irq, hw);
4409		priv->irq = -1;
4410	}
4411
4412	/* Stop finalize join worker */
4413	cancel_work_sync(&priv->finalize_join_worker);
4414	cancel_work_sync(&priv->watchdog_ba_handle);
4415	if (priv->beacon_skb != NULL)
4416		dev_kfree_skb(priv->beacon_skb);
4417
4418	/* Stop TX reclaim and RX tasklets.  */
4419	tasklet_disable(&priv->poll_tx_task);
4420	tasklet_disable(&priv->poll_rx_task);
4421
4422	/* Return all skbs to mac80211 */
4423	for (i = 0; i < mwl8k_tx_queues(priv); i++)
4424		mwl8k_txq_reclaim(hw, i, INT_MAX, 1);
4425}
4426
4427static int mwl8k_reload_firmware(struct ieee80211_hw *hw, char *fw_image);
4428
4429static int mwl8k_add_interface(struct ieee80211_hw *hw,
4430			       struct ieee80211_vif *vif)
4431{
4432	struct mwl8k_priv *priv = hw->priv;
4433	struct mwl8k_vif *mwl8k_vif;
4434	u32 macids_supported;
4435	int macid, rc;
4436	struct mwl8k_device_info *di;
4437
4438	/*
4439	 * Reject interface creation if sniffer mode is active, as
4440	 * STA operation is mutually exclusive with hardware sniffer
4441	 * mode.  (Sniffer mode is only used on STA firmware.)
4442	 */
4443	if (priv->sniffer_enabled) {
4444		wiphy_info(hw->wiphy,
4445			   "unable to create STA interface because sniffer mode is enabled\n");
4446		return -EINVAL;
4447	}
4448
4449	di = priv->device_info;
4450	switch (vif->type) {
4451	case NL80211_IFTYPE_AP:
4452		if (!priv->ap_fw && di->fw_image_ap) {
4453			/* we must load the ap fw to meet this request */
4454			if (!list_empty(&priv->vif_list))
4455				return -EBUSY;
4456			rc = mwl8k_reload_firmware(hw, di->fw_image_ap);
4457			if (rc)
4458				return rc;
4459		}
4460		macids_supported = priv->ap_macids_supported;
4461		break;
4462	case NL80211_IFTYPE_STATION:
4463		if (priv->ap_fw && di->fw_image_sta) {
4464			/* we must load the sta fw to meet this request */
4465			if (!list_empty(&priv->vif_list))
4466				return -EBUSY;
4467			rc = mwl8k_reload_firmware(hw, di->fw_image_sta);
4468			if (rc)
4469				return rc;
4470		}
4471		macids_supported = priv->sta_macids_supported;
4472		break;
4473	default:
4474		return -EINVAL;
4475	}
4476
4477	macid = ffs(macids_supported & ~priv->macids_used);
4478	if (!macid--)
4479		return -EBUSY;
4480
4481	/* Setup driver private area. */
4482	mwl8k_vif = MWL8K_VIF(vif);
4483	memset(mwl8k_vif, 0, sizeof(*mwl8k_vif));
4484	mwl8k_vif->vif = vif;
4485	mwl8k_vif->macid = macid;
4486	mwl8k_vif->seqno = 0;
4487	memcpy(mwl8k_vif->bssid, vif->addr, ETH_ALEN);
4488	mwl8k_vif->is_hw_crypto_enabled = false;
4489
4490	/* Set the mac address.  */
4491	mwl8k_cmd_set_mac_addr(hw, vif, vif->addr);
4492
4493	if (priv->ap_fw)
4494		mwl8k_cmd_set_new_stn_add_self(hw, vif);
4495
4496	priv->macids_used |= 1 << mwl8k_vif->macid;
4497	list_add_tail(&mwl8k_vif->list, &priv->vif_list);
4498
4499	return 0;
4500}
4501
4502static void mwl8k_remove_interface(struct ieee80211_hw *hw,
4503				   struct ieee80211_vif *vif)
4504{
4505	struct mwl8k_priv *priv = hw->priv;
4506	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
4507
4508	if (priv->ap_fw)
4509		mwl8k_cmd_set_new_stn_del(hw, vif, vif->addr);
4510
4511	mwl8k_cmd_set_mac_addr(hw, vif, "\x00\x00\x00\x00\x00\x00");
4512
4513	priv->macids_used &= ~(1 << mwl8k_vif->macid);
4514	list_del(&mwl8k_vif->list);
4515}
4516
4517static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
4518{
4519	struct ieee80211_conf *conf = &hw->conf;
4520	struct mwl8k_priv *priv = hw->priv;
4521	int rc;
4522
4523	if (conf->flags & IEEE80211_CONF_IDLE) {
4524		mwl8k_cmd_radio_disable(hw);
4525		return 0;
4526	}
4527
4528	rc = mwl8k_fw_lock(hw);
4529	if (rc)
4530		return rc;
4531
4532	rc = mwl8k_cmd_radio_enable(hw);
4533	if (rc)
4534		goto out;
4535
4536	rc = mwl8k_cmd_set_rf_channel(hw, conf);
4537	if (rc)
4538		goto out;
4539
4540	if (conf->power_level > 18)
4541		conf->power_level = 18;
4542
4543	if (priv->ap_fw) {
4544
4545		if (conf->flags & IEEE80211_CONF_CHANGE_POWER) {
4546			rc = mwl8k_cmd_tx_power(hw, conf, conf->power_level);
4547			if (rc)
4548				goto out;
4549		}
4550
4551		rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_RX, 0x3);
4552		if (rc)
4553			wiphy_warn(hw->wiphy, "failed to set # of RX antennas");
4554		rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_TX, 0x7);
4555		if (rc)
4556			wiphy_warn(hw->wiphy, "failed to set # of TX antennas");
4557
4558	} else {
4559		rc = mwl8k_cmd_rf_tx_power(hw, conf->power_level);
4560		if (rc)
4561			goto out;
4562		rc = mwl8k_cmd_mimo_config(hw, 0x7, 0x7);
4563	}
4564
4565out:
4566	mwl8k_fw_unlock(hw);
4567
4568	return rc;
4569}
4570
4571static void
4572mwl8k_bss_info_changed_sta(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
4573			   struct ieee80211_bss_conf *info, u32 changed)
4574{
4575	struct mwl8k_priv *priv = hw->priv;
4576	u32 ap_legacy_rates = 0;
4577	u8 ap_mcs_rates[16];
4578	int rc;
4579
4580	if (mwl8k_fw_lock(hw))
4581		return;
4582
4583	/*
4584	 * No need to capture a beacon if we're no longer associated.
4585	 */
4586	if ((changed & BSS_CHANGED_ASSOC) && !vif->bss_conf.assoc)
4587		priv->capture_beacon = false;
4588
4589	/*
4590	 * Get the AP's legacy and MCS rates.
4591	 */
4592	if (vif->bss_conf.assoc) {
4593		struct ieee80211_sta *ap;
4594
4595		rcu_read_lock();
4596
4597		ap = ieee80211_find_sta(vif, vif->bss_conf.bssid);
4598		if (ap == NULL) {
4599			rcu_read_unlock();
4600			goto out;
4601		}
4602
4603		if (hw->conf.channel->band == IEEE80211_BAND_2GHZ) {
4604			ap_legacy_rates = ap->supp_rates[IEEE80211_BAND_2GHZ];
4605		} else {
4606			ap_legacy_rates =
4607				ap->supp_rates[IEEE80211_BAND_5GHZ] << 5;
4608		}
4609		memcpy(ap_mcs_rates, ap->ht_cap.mcs.rx_mask, 16);
4610
4611		rcu_read_unlock();
4612	}
4613
4614	if ((changed & BSS_CHANGED_ASSOC) && vif->bss_conf.assoc) {
4615		rc = mwl8k_cmd_set_rate(hw, vif, ap_legacy_rates, ap_mcs_rates);
4616		if (rc)
4617			goto out;
4618
4619		rc = mwl8k_cmd_use_fixed_rate_sta(hw);
4620		if (rc)
4621			goto out;
4622	}
4623
4624	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
4625		rc = mwl8k_set_radio_preamble(hw,
4626				vif->bss_conf.use_short_preamble);
4627		if (rc)
4628			goto out;
4629	}
4630
4631	if (changed & BSS_CHANGED_ERP_SLOT) {
4632		rc = mwl8k_cmd_set_slot(hw, vif->bss_conf.use_short_slot);
4633		if (rc)
4634			goto out;
4635	}
4636
4637	if (vif->bss_conf.assoc &&
4638	    (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_ERP_CTS_PROT |
4639			BSS_CHANGED_HT))) {
4640		rc = mwl8k_cmd_set_aid(hw, vif, ap_legacy_rates);
4641		if (rc)
4642			goto out;
4643	}
4644
4645	if (vif->bss_conf.assoc &&
4646	    (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_BEACON_INT))) {
4647		/*
4648		 * Finalize the join.  Tell rx handler to process
4649		 * next beacon from our BSSID.
4650		 */
4651		memcpy(priv->capture_bssid, vif->bss_conf.bssid, ETH_ALEN);
4652		priv->capture_beacon = true;
4653	}
4654
4655out:
4656	mwl8k_fw_unlock(hw);
4657}
4658
4659static void
4660mwl8k_bss_info_changed_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
4661			  struct ieee80211_bss_conf *info, u32 changed)
4662{
4663	int rc;
4664
4665	if (mwl8k_fw_lock(hw))
4666		return;
4667
4668	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
4669		rc = mwl8k_set_radio_preamble(hw,
4670				vif->bss_conf.use_short_preamble);
4671		if (rc)
4672			goto out;
4673	}
4674
4675	if (changed & BSS_CHANGED_BASIC_RATES) {
4676		int idx;
4677		int rate;
4678
4679		/*
4680		 * Use lowest supported basic rate for multicasts
4681		 * and management frames (such as probe responses --
4682		 * beacons will always go out at 1 Mb/s).
4683		 */
4684		idx = ffs(vif->bss_conf.basic_rates);
4685		if (idx)
4686			idx--;
4687
4688		if (hw->conf.channel->band == IEEE80211_BAND_2GHZ)
4689			rate = mwl8k_rates_24[idx].hw_value;
4690		else
4691			rate = mwl8k_rates_50[idx].hw_value;
4692
4693		mwl8k_cmd_use_fixed_rate_ap(hw, rate, rate);
4694	}
4695
4696	if (changed & (BSS_CHANGED_BEACON_INT | BSS_CHANGED_BEACON)) {
4697		struct sk_buff *skb;
4698
4699		skb = ieee80211_beacon_get(hw, vif);
4700		if (skb != NULL) {
4701			mwl8k_cmd_set_beacon(hw, vif, skb->data, skb->len);
4702			kfree_skb(skb);
4703		}
4704	}
4705
4706	if (changed & BSS_CHANGED_BEACON_ENABLED)
4707		mwl8k_cmd_bss_start(hw, vif, info->enable_beacon);
4708
4709out:
4710	mwl8k_fw_unlock(hw);
4711}
4712
4713static void
4714mwl8k_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
4715		       struct ieee80211_bss_conf *info, u32 changed)
4716{
4717	struct mwl8k_priv *priv = hw->priv;
4718
4719	if (!priv->ap_fw)
4720		mwl8k_bss_info_changed_sta(hw, vif, info, changed);
4721	else
4722		mwl8k_bss_info_changed_ap(hw, vif, info, changed);
4723}
4724
4725static u64 mwl8k_prepare_multicast(struct ieee80211_hw *hw,
4726				   struct netdev_hw_addr_list *mc_list)
4727{
4728	struct mwl8k_cmd_pkt *cmd;
4729
4730	/*
4731	 * Synthesize and return a command packet that programs the
4732	 * hardware multicast address filter.  At this point we don't
4733	 * know whether FIF_ALLMULTI is being requested, but if it is,
4734	 * we'll end up throwing this packet away and creating a new
4735	 * one in mwl8k_configure_filter().
4736	 */
4737	cmd = __mwl8k_cmd_mac_multicast_adr(hw, 0, mc_list);
4738
4739	return (unsigned long)cmd;
4740}
4741
4742static int
4743mwl8k_configure_filter_sniffer(struct ieee80211_hw *hw,
4744			       unsigned int changed_flags,
4745			       unsigned int *total_flags)
4746{
4747	struct mwl8k_priv *priv = hw->priv;
4748
4749	/*
4750	 * Hardware sniffer mode is mutually exclusive with STA
4751	 * operation, so refuse to enable sniffer mode if a STA
4752	 * interface is active.
4753	 */
4754	if (!list_empty(&priv->vif_list)) {
4755		if (net_ratelimit())
4756			wiphy_info(hw->wiphy,
4757				   "not enabling sniffer mode because STA interface is active\n");
4758		return 0;
4759	}
4760
4761	if (!priv->sniffer_enabled) {
4762		if (mwl8k_cmd_enable_sniffer(hw, 1))
4763			return 0;
4764		priv->sniffer_enabled = true;
4765	}
4766
4767	*total_flags &=	FIF_PROMISC_IN_BSS | FIF_ALLMULTI |
4768			FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL |
4769			FIF_OTHER_BSS;
4770
4771	return 1;
4772}
4773
4774static struct mwl8k_vif *mwl8k_first_vif(struct mwl8k_priv *priv)
4775{
4776	if (!list_empty(&priv->vif_list))
4777		return list_entry(priv->vif_list.next, struct mwl8k_vif, list);
4778
4779	return NULL;
4780}
4781
4782static void mwl8k_configure_filter(struct ieee80211_hw *hw,
4783				   unsigned int changed_flags,
4784				   unsigned int *total_flags,
4785				   u64 multicast)
4786{
4787	struct mwl8k_priv *priv = hw->priv;
4788	struct mwl8k_cmd_pkt *cmd = (void *)(unsigned long)multicast;
4789
4790	/*
4791	 * AP firmware doesn't allow fine-grained control over
4792	 * the receive filter.
4793	 */
4794	if (priv->ap_fw) {
4795		*total_flags &= FIF_ALLMULTI | FIF_BCN_PRBRESP_PROMISC;
4796		kfree(cmd);
4797		return;
4798	}
4799
4800	/*
4801	 * Enable hardware sniffer mode if FIF_CONTROL or
4802	 * FIF_OTHER_BSS is requested.
4803	 */
4804	if (*total_flags & (FIF_CONTROL | FIF_OTHER_BSS) &&
4805	    mwl8k_configure_filter_sniffer(hw, changed_flags, total_flags)) {
4806		kfree(cmd);
4807		return;
4808	}
4809
4810	/* Clear unsupported feature flags */
4811	*total_flags &= FIF_ALLMULTI | FIF_BCN_PRBRESP_PROMISC;
4812
4813	if (mwl8k_fw_lock(hw)) {
4814		kfree(cmd);
4815		return;
4816	}
4817
4818	if (priv->sniffer_enabled) {
4819		mwl8k_cmd_enable_sniffer(hw, 0);
4820		priv->sniffer_enabled = false;
4821	}
4822
4823	if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
4824		if (*total_flags & FIF_BCN_PRBRESP_PROMISC) {
4825			/*
4826			 * Disable the BSS filter.
4827			 */
4828			mwl8k_cmd_set_pre_scan(hw);
4829		} else {
4830			struct mwl8k_vif *mwl8k_vif;
4831			const u8 *bssid;
4832
4833			/*
4834			 * Enable the BSS filter.
4835			 *
4836			 * If there is an active STA interface, use that
4837			 * interface's BSSID, otherwise use a dummy one
4838			 * (where the OUI part needs to be nonzero for
4839			 * the BSSID to be accepted by POST_SCAN).
4840			 */
4841			mwl8k_vif = mwl8k_first_vif(priv);
4842			if (mwl8k_vif != NULL)
4843				bssid = mwl8k_vif->vif->bss_conf.bssid;
4844			else
4845				bssid = "\x01\x00\x00\x00\x00\x00";
4846
4847			mwl8k_cmd_set_post_scan(hw, bssid);
4848		}
4849	}
4850
4851	/*
4852	 * If FIF_ALLMULTI is being requested, throw away the command
4853	 * packet that ->prepare_multicast() built and replace it with
4854	 * a command packet that enables reception of all multicast
4855	 * packets.
4856	 */
4857	if (*total_flags & FIF_ALLMULTI) {
4858		kfree(cmd);
4859		cmd = __mwl8k_cmd_mac_multicast_adr(hw, 1, NULL);
4860	}
4861
4862	if (cmd != NULL) {
4863		mwl8k_post_cmd(hw, cmd);
4864		kfree(cmd);
4865	}
4866
4867	mwl8k_fw_unlock(hw);
4868}
4869
4870static int mwl8k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
4871{
4872	return mwl8k_cmd_set_rts_threshold(hw, value);
4873}
4874
4875static int mwl8k_sta_remove(struct ieee80211_hw *hw,
4876			    struct ieee80211_vif *vif,
4877			    struct ieee80211_sta *sta)
4878{
4879	struct mwl8k_priv *priv = hw->priv;
4880
4881	if (priv->ap_fw)
4882		return mwl8k_cmd_set_new_stn_del(hw, vif, sta->addr);
4883	else
4884		return mwl8k_cmd_update_stadb_del(hw, vif, sta->addr);
4885}
4886
4887static int mwl8k_sta_add(struct ieee80211_hw *hw,
4888			 struct ieee80211_vif *vif,
4889			 struct ieee80211_sta *sta)
4890{
4891	struct mwl8k_priv *priv = hw->priv;
4892	int ret;
4893	int i;
4894	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
4895	struct ieee80211_key_conf *key;
4896
4897	if (!priv->ap_fw) {
4898		ret = mwl8k_cmd_update_stadb_add(hw, vif, sta);
4899		if (ret >= 0) {
4900			MWL8K_STA(sta)->peer_id = ret;
4901			if (sta->ht_cap.ht_supported)
4902				MWL8K_STA(sta)->is_ampdu_allowed = true;
4903			ret = 0;
4904		}
4905
4906	} else {
4907		ret = mwl8k_cmd_set_new_stn_add(hw, vif, sta);
4908	}
4909
4910	for (i = 0; i < NUM_WEP_KEYS; i++) {
4911		key = IEEE80211_KEY_CONF(mwl8k_vif->wep_key_conf[i].key);
4912		if (mwl8k_vif->wep_key_conf[i].enabled)
4913			mwl8k_set_key(hw, SET_KEY, vif, sta, key);
4914	}
4915	return ret;
4916}
4917
4918static int mwl8k_conf_tx(struct ieee80211_hw *hw,
4919			 struct ieee80211_vif *vif, u16 queue,
4920			 const struct ieee80211_tx_queue_params *params)
4921{
4922	struct mwl8k_priv *priv = hw->priv;
4923	int rc;
4924
4925	rc = mwl8k_fw_lock(hw);
4926	if (!rc) {
4927		BUG_ON(queue > MWL8K_TX_WMM_QUEUES - 1);
4928		memcpy(&priv->wmm_params[queue], params, sizeof(*params));
4929
4930		if (!priv->wmm_enabled)
4931			rc = mwl8k_cmd_set_wmm_mode(hw, 1);
4932
4933		if (!rc) {
4934			int q = MWL8K_TX_WMM_QUEUES - 1 - queue;
4935			rc = mwl8k_cmd_set_edca_params(hw, q,
4936						       params->cw_min,
4937						       params->cw_max,
4938						       params->aifs,
4939						       params->txop);
4940		}
4941
4942		mwl8k_fw_unlock(hw);
4943	}
4944
4945	return rc;
4946}
4947
4948static int mwl8k_get_stats(struct ieee80211_hw *hw,
4949			   struct ieee80211_low_level_stats *stats)
4950{
4951	return mwl8k_cmd_get_stat(hw, stats);
4952}
4953
4954static int mwl8k_get_survey(struct ieee80211_hw *hw, int idx,
4955				struct survey_info *survey)
4956{
4957	struct mwl8k_priv *priv = hw->priv;
4958	struct ieee80211_conf *conf = &hw->conf;
4959
4960	if (idx != 0)
4961		return -ENOENT;
4962
4963	survey->channel = conf->channel;
4964	survey->filled = SURVEY_INFO_NOISE_DBM;
4965	survey->noise = priv->noise;
4966
4967	return 0;
4968}
4969
4970#define MAX_AMPDU_ATTEMPTS 5
4971
4972static int
4973mwl8k_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
4974		   enum ieee80211_ampdu_mlme_action action,
4975		   struct ieee80211_sta *sta, u16 tid, u16 *ssn,
4976		   u8 buf_size)
4977{
4978
4979	int i, rc = 0;
4980	struct mwl8k_priv *priv = hw->priv;
4981	struct mwl8k_ampdu_stream *stream;
4982	u8 *addr = sta->addr;
4983
4984	if (!(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
4985		return -ENOTSUPP;
4986
4987	spin_lock(&priv->stream_lock);
4988	stream = mwl8k_lookup_stream(hw, addr, tid);
4989
4990	switch (action) {
4991	case IEEE80211_AMPDU_RX_START:
4992	case IEEE80211_AMPDU_RX_STOP:
4993		break;
4994	case IEEE80211_AMPDU_TX_START:
4995		/* By the time we get here the hw queues may contain outgoing
4996		 * packets for this RA/TID that are not part of this BA
4997		 * session.  The hw will assign sequence numbers to these
4998		 * packets as they go out.  So if we query the hw for its next
4999		 * sequence number and use that for the SSN here, it may end up
5000		 * being wrong, which will lead to sequence number mismatch at
5001		 * the recipient.  To avoid this, we reset the sequence number
5002		 * to O for the first MPDU in this BA stream.
5003		 */
5004		*ssn = 0;
5005		if (stream == NULL) {
5006			/* This means that somebody outside this driver called
5007			 * ieee80211_start_tx_ba_session.  This is unexpected
5008			 * because we do our own rate control.  Just warn and
5009			 * move on.
5010			 */
5011			wiphy_warn(hw->wiphy, "Unexpected call to %s.  "
5012				   "Proceeding anyway.\n", __func__);
5013			stream = mwl8k_add_stream(hw, sta, tid);
5014		}
5015		if (stream == NULL) {
5016			wiphy_debug(hw->wiphy, "no free AMPDU streams\n");
5017			rc = -EBUSY;
5018			break;
5019		}
5020		stream->state = AMPDU_STREAM_IN_PROGRESS;
5021
5022		/* Release the lock before we do the time consuming stuff */
5023		spin_unlock(&priv->stream_lock);
5024		for (i = 0; i < MAX_AMPDU_ATTEMPTS; i++) {
5025			rc = mwl8k_check_ba(hw, stream);
5026
5027			if (!rc)
5028				break;
5029			/*
5030			 * HW queues take time to be flushed, give them
5031			 * sufficient time
5032			 */
5033
5034			msleep(1000);
5035		}
5036		spin_lock(&priv->stream_lock);
5037		if (rc) {
5038			wiphy_err(hw->wiphy, "Stream for tid %d busy after %d"
5039				" attempts\n", tid, MAX_AMPDU_ATTEMPTS);
5040			mwl8k_remove_stream(hw, stream);
5041			rc = -EBUSY;
5042			break;
5043		}
5044		ieee80211_start_tx_ba_cb_irqsafe(vif, addr, tid);
5045		break;
5046	case IEEE80211_AMPDU_TX_STOP:
5047		if (stream == NULL)
5048			break;
5049		if (stream->state == AMPDU_STREAM_ACTIVE) {
5050			spin_unlock(&priv->stream_lock);
5051			mwl8k_destroy_ba(hw, stream);
5052			spin_lock(&priv->stream_lock);
5053		}
5054		mwl8k_remove_stream(hw, stream);
5055		ieee80211_stop_tx_ba_cb_irqsafe(vif, addr, tid);
5056		break;
5057	case IEEE80211_AMPDU_TX_OPERATIONAL:
5058		BUG_ON(stream == NULL);
5059		BUG_ON(stream->state != AMPDU_STREAM_IN_PROGRESS);
5060		spin_unlock(&priv->stream_lock);
5061		rc = mwl8k_create_ba(hw, stream, buf_size);
5062		spin_lock(&priv->stream_lock);
5063		if (!rc)
5064			stream->state = AMPDU_STREAM_ACTIVE;
5065		else {
5066			spin_unlock(&priv->stream_lock);
5067			mwl8k_destroy_ba(hw, stream);
5068			spin_lock(&priv->stream_lock);
5069			wiphy_debug(hw->wiphy,
5070				"Failed adding stream for sta %pM tid %d\n",
5071				addr, tid);
5072			mwl8k_remove_stream(hw, stream);
5073		}
5074		break;
5075
5076	default:
5077		rc = -ENOTSUPP;
5078	}
5079
5080	spin_unlock(&priv->stream_lock);
5081	return rc;
5082}
5083
5084static const struct ieee80211_ops mwl8k_ops = {
5085	.tx			= mwl8k_tx,
5086	.start			= mwl8k_start,
5087	.stop			= mwl8k_stop,
5088	.add_interface		= mwl8k_add_interface,
5089	.remove_interface	= mwl8k_remove_interface,
5090	.config			= mwl8k_config,
5091	.bss_info_changed	= mwl8k_bss_info_changed,
5092	.prepare_multicast	= mwl8k_prepare_multicast,
5093	.configure_filter	= mwl8k_configure_filter,
5094	.set_key                = mwl8k_set_key,
5095	.set_rts_threshold	= mwl8k_set_rts_threshold,
5096	.sta_add		= mwl8k_sta_add,
5097	.sta_remove		= mwl8k_sta_remove,
5098	.conf_tx		= mwl8k_conf_tx,
5099	.get_stats		= mwl8k_get_stats,
5100	.get_survey		= mwl8k_get_survey,
5101	.ampdu_action		= mwl8k_ampdu_action,
5102};
5103
5104static void mwl8k_finalize_join_worker(struct work_struct *work)
5105{
5106	struct mwl8k_priv *priv =
5107		container_of(work, struct mwl8k_priv, finalize_join_worker);
5108	struct sk_buff *skb = priv->beacon_skb;
5109	struct ieee80211_mgmt *mgmt = (void *)skb->data;
5110	int len = skb->len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
5111	const u8 *tim = cfg80211_find_ie(WLAN_EID_TIM,
5112					 mgmt->u.beacon.variable, len);
5113	int dtim_period = 1;
5114
5115	if (tim && tim[1] >= 2)
5116		dtim_period = tim[3];
5117
5118	mwl8k_cmd_finalize_join(priv->hw, skb->data, skb->len, dtim_period);
5119
5120	dev_kfree_skb(skb);
5121	priv->beacon_skb = NULL;
5122}
5123
5124enum {
5125	MWL8363 = 0,
5126	MWL8687,
5127	MWL8366,
5128};
5129
5130#define MWL8K_8366_AP_FW_API 2
5131#define _MWL8K_8366_AP_FW(api) "mwl8k/fmimage_8366_ap-" #api ".fw"
5132#define MWL8K_8366_AP_FW(api) _MWL8K_8366_AP_FW(api)
5133
5134static struct mwl8k_device_info mwl8k_info_tbl[] __devinitdata = {
5135	[MWL8363] = {
5136		.part_name	= "88w8363",
5137		.helper_image	= "mwl8k/helper_8363.fw",
5138		.fw_image_sta	= "mwl8k/fmimage_8363.fw",
5139	},
5140	[MWL8687] = {
5141		.part_name	= "88w8687",
5142		.helper_image	= "mwl8k/helper_8687.fw",
5143		.fw_image_sta	= "mwl8k/fmimage_8687.fw",
5144	},
5145	[MWL8366] = {
5146		.part_name	= "88w8366",
5147		.helper_image	= "mwl8k/helper_8366.fw",
5148		.fw_image_sta	= "mwl8k/fmimage_8366.fw",
5149		.fw_image_ap	= MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API),
5150		.fw_api_ap	= MWL8K_8366_AP_FW_API,
5151		.ap_rxd_ops	= &rxd_8366_ap_ops,
5152	},
5153};
5154
5155MODULE_FIRMWARE("mwl8k/helper_8363.fw");
5156MODULE_FIRMWARE("mwl8k/fmimage_8363.fw");
5157MODULE_FIRMWARE("mwl8k/helper_8687.fw");
5158MODULE_FIRMWARE("mwl8k/fmimage_8687.fw");
5159MODULE_FIRMWARE("mwl8k/helper_8366.fw");
5160MODULE_FIRMWARE("mwl8k/fmimage_8366.fw");
5161MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
5162
5163static DEFINE_PCI_DEVICE_TABLE(mwl8k_pci_id_table) = {
5164	{ PCI_VDEVICE(MARVELL, 0x2a0a), .driver_data = MWL8363, },
5165	{ PCI_VDEVICE(MARVELL, 0x2a0c), .driver_data = MWL8363, },
5166	{ PCI_VDEVICE(MARVELL, 0x2a24), .driver_data = MWL8363, },
5167	{ PCI_VDEVICE(MARVELL, 0x2a2b), .driver_data = MWL8687, },
5168	{ PCI_VDEVICE(MARVELL, 0x2a30), .driver_data = MWL8687, },
5169	{ PCI_VDEVICE(MARVELL, 0x2a40), .driver_data = MWL8366, },
5170	{ PCI_VDEVICE(MARVELL, 0x2a43), .driver_data = MWL8366, },
5171	{ },
5172};
5173MODULE_DEVICE_TABLE(pci, mwl8k_pci_id_table);
5174
5175static int mwl8k_request_alt_fw(struct mwl8k_priv *priv)
5176{
5177	int rc;
5178	printk(KERN_ERR "%s: Error requesting preferred fw %s.\n"
5179	       "Trying alternative firmware %s\n", pci_name(priv->pdev),
5180	       priv->fw_pref, priv->fw_alt);
5181	rc = mwl8k_request_fw(priv, priv->fw_alt, &priv->fw_ucode, true);
5182	if (rc) {
5183		printk(KERN_ERR "%s: Error requesting alt fw %s\n",
5184		       pci_name(priv->pdev), priv->fw_alt);
5185		return rc;
5186	}
5187	return 0;
5188}
5189
5190static int mwl8k_firmware_load_success(struct mwl8k_priv *priv);
5191static void mwl8k_fw_state_machine(const struct firmware *fw, void *context)
5192{
5193	struct mwl8k_priv *priv = context;
5194	struct mwl8k_device_info *di = priv->device_info;
5195	int rc;
5196
5197	switch (priv->fw_state) {
5198	case FW_STATE_INIT:
5199		if (!fw) {
5200			printk(KERN_ERR "%s: Error requesting helper fw %s\n",
5201			       pci_name(priv->pdev), di->helper_image);
5202			goto fail;
5203		}
5204		priv->fw_helper = fw;
5205		rc = mwl8k_request_fw(priv, priv->fw_pref, &priv->fw_ucode,
5206				      true);
5207		if (rc && priv->fw_alt) {
5208			rc = mwl8k_request_alt_fw(priv);
5209			if (rc)
5210				goto fail;
5211			priv->fw_state = FW_STATE_LOADING_ALT;
5212		} else if (rc)
5213			goto fail;
5214		else
5215			priv->fw_state = FW_STATE_LOADING_PREF;
5216		break;
5217
5218	case FW_STATE_LOADING_PREF:
5219		if (!fw) {
5220			if (priv->fw_alt) {
5221				rc = mwl8k_request_alt_fw(priv);
5222				if (rc)
5223					goto fail;
5224				priv->fw_state = FW_STATE_LOADING_ALT;
5225			} else
5226				goto fail;
5227		} else {
5228			priv->fw_ucode = fw;
5229			rc = mwl8k_firmware_load_success(priv);
5230			if (rc)
5231				goto fail;
5232			else
5233				complete(&priv->firmware_loading_complete);
5234		}
5235		break;
5236
5237	case FW_STATE_LOADING_ALT:
5238		if (!fw) {
5239			printk(KERN_ERR "%s: Error requesting alt fw %s\n",
5240			       pci_name(priv->pdev), di->helper_image);
5241			goto fail;
5242		}
5243		priv->fw_ucode = fw;
5244		rc = mwl8k_firmware_load_success(priv);
5245		if (rc)
5246			goto fail;
5247		else
5248			complete(&priv->firmware_loading_complete);
5249		break;
5250
5251	default:
5252		printk(KERN_ERR "%s: Unexpected firmware loading state: %d\n",
5253		       MWL8K_NAME, priv->fw_state);
5254		BUG_ON(1);
5255	}
5256
5257	return;
5258
5259fail:
5260	priv->fw_state = FW_STATE_ERROR;
5261	complete(&priv->firmware_loading_complete);
5262	device_release_driver(&priv->pdev->dev);
5263	mwl8k_release_firmware(priv);
5264}
5265
5266static int mwl8k_init_firmware(struct ieee80211_hw *hw, char *fw_image,
5267			       bool nowait)
5268{
5269	struct mwl8k_priv *priv = hw->priv;
5270	int rc;
5271
5272	/* Reset firmware and hardware */
5273	mwl8k_hw_reset(priv);
5274
5275	/* Ask userland hotplug daemon for the device firmware */
5276	rc = mwl8k_request_firmware(priv, fw_image, nowait);
5277	if (rc) {
5278		wiphy_err(hw->wiphy, "Firmware files not found\n");
5279		return rc;
5280	}
5281
5282	if (nowait)
5283		return rc;
5284
5285	/* Load firmware into hardware */
5286	rc = mwl8k_load_firmware(hw);
5287	if (rc)
5288		wiphy_err(hw->wiphy, "Cannot start firmware\n");
5289
5290	/* Reclaim memory once firmware is successfully loaded */
5291	mwl8k_release_firmware(priv);
5292
5293	return rc;
5294}
5295
5296static int mwl8k_init_txqs(struct ieee80211_hw *hw)
5297{
5298	struct mwl8k_priv *priv = hw->priv;
5299	int rc = 0;
5300	int i;
5301
5302	for (i = 0; i < mwl8k_tx_queues(priv); i++) {
5303		rc = mwl8k_txq_init(hw, i);
5304		if (rc)
5305			break;
5306		if (priv->ap_fw)
5307			iowrite32(priv->txq[i].txd_dma,
5308				  priv->sram + priv->txq_offset[i]);
5309	}
5310	return rc;
5311}
5312
5313/* initialize hw after successfully loading a firmware image */
5314static int mwl8k_probe_hw(struct ieee80211_hw *hw)
5315{
5316	struct mwl8k_priv *priv = hw->priv;
5317	int rc = 0;
5318	int i;
5319
5320	if (priv->ap_fw) {
5321		priv->rxd_ops = priv->device_info->ap_rxd_ops;
5322		if (priv->rxd_ops == NULL) {
5323			wiphy_err(hw->wiphy,
5324				  "Driver does not have AP firmware image support for this hardware\n");
5325			goto err_stop_firmware;
5326		}
5327	} else {
5328		priv->rxd_ops = &rxd_sta_ops;
5329	}
5330
5331	priv->sniffer_enabled = false;
5332	priv->wmm_enabled = false;
5333	priv->pending_tx_pkts = 0;
5334
5335	rc = mwl8k_rxq_init(hw, 0);
5336	if (rc)
5337		goto err_stop_firmware;
5338	rxq_refill(hw, 0, INT_MAX);
5339
5340	/* For the sta firmware, we need to know the dma addresses of tx queues
5341	 * before sending MWL8K_CMD_GET_HW_SPEC.  So we must initialize them
5342	 * prior to issuing this command.  But for the AP case, we learn the
5343	 * total number of queues from the result CMD_GET_HW_SPEC, so for this
5344	 * case we must initialize the tx queues after.
5345	 */
5346	priv->num_ampdu_queues = 0;
5347	if (!priv->ap_fw) {
5348		rc = mwl8k_init_txqs(hw);
5349		if (rc)
5350			goto err_free_queues;
5351	}
5352
5353	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
5354	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
5355	iowrite32(MWL8K_A2H_INT_TX_DONE|MWL8K_A2H_INT_RX_READY|
5356		  MWL8K_A2H_INT_BA_WATCHDOG,
5357		  priv->regs + MWL8K_HIU_A2H_INTERRUPT_CLEAR_SEL);
5358	iowrite32(MWL8K_A2H_INT_OPC_DONE,
5359		  priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
5360
5361	rc = request_irq(priv->pdev->irq, mwl8k_interrupt,
5362			 IRQF_SHARED, MWL8K_NAME, hw);
5363	if (rc) {
5364		wiphy_err(hw->wiphy, "failed to register IRQ handler\n");
5365		goto err_free_queues;
5366	}
5367
5368	memset(priv->ampdu, 0, sizeof(priv->ampdu));
5369
5370	/*
5371	 * Temporarily enable interrupts.  Initial firmware host
5372	 * commands use interrupts and avoid polling.  Disable
5373	 * interrupts when done.
5374	 */
5375	iowrite32(MWL8K_A2H_EVENTS, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
5376
5377	/* Get config data, mac addrs etc */
5378	if (priv->ap_fw) {
5379		rc = mwl8k_cmd_get_hw_spec_ap(hw);
5380		if (!rc)
5381			rc = mwl8k_init_txqs(hw);
5382		if (!rc)
5383			rc = mwl8k_cmd_set_hw_spec(hw);
5384	} else {
5385		rc = mwl8k_cmd_get_hw_spec_sta(hw);
5386	}
5387	if (rc) {
5388		wiphy_err(hw->wiphy, "Cannot initialise firmware\n");
5389		goto err_free_irq;
5390	}
5391
5392	/* Turn radio off */
5393	rc = mwl8k_cmd_radio_disable(hw);
5394	if (rc) {
5395		wiphy_err(hw->wiphy, "Cannot disable\n");
5396		goto err_free_irq;
5397	}
5398
5399	/* Clear MAC address */
5400	rc = mwl8k_cmd_set_mac_addr(hw, NULL, "\x00\x00\x00\x00\x00\x00");
5401	if (rc) {
5402		wiphy_err(hw->wiphy, "Cannot clear MAC address\n");
5403		goto err_free_irq;
5404	}
5405
5406	/* Disable interrupts */
5407	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
5408	free_irq(priv->pdev->irq, hw);
5409
5410	wiphy_info(hw->wiphy, "%s v%d, %pm, %s firmware %u.%u.%u.%u\n",
5411		   priv->device_info->part_name,
5412		   priv->hw_rev, hw->wiphy->perm_addr,
5413		   priv->ap_fw ? "AP" : "STA",
5414		   (priv->fw_rev >> 24) & 0xff, (priv->fw_rev >> 16) & 0xff,
5415		   (priv->fw_rev >> 8) & 0xff, priv->fw_rev & 0xff);
5416
5417	return 0;
5418
5419err_free_irq:
5420	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
5421	free_irq(priv->pdev->irq, hw);
5422
5423err_free_queues:
5424	for (i = 0; i < mwl8k_tx_queues(priv); i++)
5425		mwl8k_txq_deinit(hw, i);
5426	mwl8k_rxq_deinit(hw, 0);
5427
5428err_stop_firmware:
5429	mwl8k_hw_reset(priv);
5430
5431	return rc;
5432}
5433
5434/*
5435 * invoke mwl8k_reload_firmware to change the firmware image after the device
5436 * has already been registered
5437 */
5438static int mwl8k_reload_firmware(struct ieee80211_hw *hw, char *fw_image)
5439{
5440	int i, rc = 0;
5441	struct mwl8k_priv *priv = hw->priv;
5442
5443	mwl8k_stop(hw);
5444	mwl8k_rxq_deinit(hw, 0);
5445
5446	for (i = 0; i < mwl8k_tx_queues(priv); i++)
5447		mwl8k_txq_deinit(hw, i);
5448
5449	rc = mwl8k_init_firmware(hw, fw_image, false);
5450	if (rc)
5451		goto fail;
5452
5453	rc = mwl8k_probe_hw(hw);
5454	if (rc)
5455		goto fail;
5456
5457	rc = mwl8k_start(hw);
5458	if (rc)
5459		goto fail;
5460
5461	rc = mwl8k_config(hw, ~0);
5462	if (rc)
5463		goto fail;
5464
5465	for (i = 0; i < MWL8K_TX_WMM_QUEUES; i++) {
5466		rc = mwl8k_conf_tx(hw, NULL, i, &priv->wmm_params[i]);
5467		if (rc)
5468			goto fail;
5469	}
5470
5471	return rc;
5472
5473fail:
5474	printk(KERN_WARNING "mwl8k: Failed to reload firmware image.\n");
5475	return rc;
5476}
5477
5478static int mwl8k_firmware_load_success(struct mwl8k_priv *priv)
5479{
5480	struct ieee80211_hw *hw = priv->hw;
5481	int i, rc;
5482
5483	rc = mwl8k_load_firmware(hw);
5484	mwl8k_release_firmware(priv);
5485	if (rc) {
5486		wiphy_err(hw->wiphy, "Cannot start firmware\n");
5487		return rc;
5488	}
5489
5490	/*
5491	 * Extra headroom is the size of the required DMA header
5492	 * minus the size of the smallest 802.11 frame (CTS frame).
5493	 */
5494	hw->extra_tx_headroom =
5495		sizeof(struct mwl8k_dma_data) - sizeof(struct ieee80211_cts);
5496
5497	hw->extra_tx_headroom -= priv->ap_fw ? REDUCED_TX_HEADROOM : 0;
5498
5499	hw->channel_change_time = 10;
5500
5501	hw->queues = MWL8K_TX_WMM_QUEUES;
5502
5503	/* Set rssi values to dBm */
5504	hw->flags |= IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_HAS_RATE_CONTROL;
5505
5506	/*
5507	 * Ask mac80211 to not to trigger PS mode
5508	 * based on PM bit of incoming frames.
5509	 */
5510	if (priv->ap_fw)
5511		hw->flags |= IEEE80211_HW_AP_LINK_PS;
5512
5513	hw->vif_data_size = sizeof(struct mwl8k_vif);
5514	hw->sta_data_size = sizeof(struct mwl8k_sta);
5515
5516	priv->macids_used = 0;
5517	INIT_LIST_HEAD(&priv->vif_list);
5518
5519	/* Set default radio state and preamble */
5520	priv->radio_on = false;
5521	priv->radio_short_preamble = false;
5522
5523	/* Finalize join worker */
5524	INIT_WORK(&priv->finalize_join_worker, mwl8k_finalize_join_worker);
5525	/* Handle watchdog ba events */
5526	INIT_WORK(&priv->watchdog_ba_handle, mwl8k_watchdog_ba_events);
5527
5528	/* TX reclaim and RX tasklets.  */
5529	tasklet_init(&priv->poll_tx_task, mwl8k_tx_poll, (unsigned long)hw);
5530	tasklet_disable(&priv->poll_tx_task);
5531	tasklet_init(&priv->poll_rx_task, mwl8k_rx_poll, (unsigned long)hw);
5532	tasklet_disable(&priv->poll_rx_task);
5533
5534	/* Power management cookie */
5535	priv->cookie = pci_alloc_consistent(priv->pdev, 4, &priv->cookie_dma);
5536	if (priv->cookie == NULL)
5537		return -ENOMEM;
5538
5539	mutex_init(&priv->fw_mutex);
5540	priv->fw_mutex_owner = NULL;
5541	priv->fw_mutex_depth = 0;
5542	priv->hostcmd_wait = NULL;
5543
5544	spin_lock_init(&priv->tx_lock);
5545
5546	spin_lock_init(&priv->stream_lock);
5547
5548	priv->tx_wait = NULL;
5549
5550	rc = mwl8k_probe_hw(hw);
5551	if (rc)
5552		goto err_free_cookie;
5553
5554	hw->wiphy->interface_modes = 0;
5555	if (priv->ap_macids_supported || priv->device_info->fw_image_ap)
5556		hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP);
5557	if (priv->sta_macids_supported || priv->device_info->fw_image_sta)
5558		hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_STATION);
5559
5560	rc = ieee80211_register_hw(hw);
5561	if (rc) {
5562		wiphy_err(hw->wiphy, "Cannot register device\n");
5563		goto err_unprobe_hw;
5564	}
5565
5566	return 0;
5567
5568err_unprobe_hw:
5569	for (i = 0; i < mwl8k_tx_queues(priv); i++)
5570		mwl8k_txq_deinit(hw, i);
5571	mwl8k_rxq_deinit(hw, 0);
5572
5573err_free_cookie:
5574	if (priv->cookie != NULL)
5575		pci_free_consistent(priv->pdev, 4,
5576				priv->cookie, priv->cookie_dma);
5577
5578	return rc;
5579}
5580static int __devinit mwl8k_probe(struct pci_dev *pdev,
5581				 const struct pci_device_id *id)
5582{
5583	static int printed_version;
5584	struct ieee80211_hw *hw;
5585	struct mwl8k_priv *priv;
5586	struct mwl8k_device_info *di;
5587	int rc;
5588
5589	if (!printed_version) {
5590		printk(KERN_INFO "%s version %s\n", MWL8K_DESC, MWL8K_VERSION);
5591		printed_version = 1;
5592	}
5593
5594
5595	rc = pci_enable_device(pdev);
5596	if (rc) {
5597		printk(KERN_ERR "%s: Cannot enable new PCI device\n",
5598		       MWL8K_NAME);
5599		return rc;
5600	}
5601
5602	rc = pci_request_regions(pdev, MWL8K_NAME);
5603	if (rc) {
5604		printk(KERN_ERR "%s: Cannot obtain PCI resources\n",
5605		       MWL8K_NAME);
5606		goto err_disable_device;
5607	}
5608
5609	pci_set_master(pdev);
5610
5611
5612	hw = ieee80211_alloc_hw(sizeof(*priv), &mwl8k_ops);
5613	if (hw == NULL) {
5614		printk(KERN_ERR "%s: ieee80211 alloc failed\n", MWL8K_NAME);
5615		rc = -ENOMEM;
5616		goto err_free_reg;
5617	}
5618
5619	SET_IEEE80211_DEV(hw, &pdev->dev);
5620	pci_set_drvdata(pdev, hw);
5621
5622	priv = hw->priv;
5623	priv->hw = hw;
5624	priv->pdev = pdev;
5625	priv->device_info = &mwl8k_info_tbl[id->driver_data];
5626
5627
5628	priv->sram = pci_iomap(pdev, 0, 0x10000);
5629	if (priv->sram == NULL) {
5630		wiphy_err(hw->wiphy, "Cannot map device SRAM\n");
5631		goto err_iounmap;
5632	}
5633
5634	/*
5635	 * If BAR0 is a 32 bit BAR, the register BAR will be BAR1.
5636	 * If BAR0 is a 64 bit BAR, the register BAR will be BAR2.
5637	 */
5638	priv->regs = pci_iomap(pdev, 1, 0x10000);
5639	if (priv->regs == NULL) {
5640		priv->regs = pci_iomap(pdev, 2, 0x10000);
5641		if (priv->regs == NULL) {
5642			wiphy_err(hw->wiphy, "Cannot map device registers\n");
5643			goto err_iounmap;
5644		}
5645	}
5646
5647	/*
5648	 * Choose the initial fw image depending on user input.  If a second
5649	 * image is available, make it the alternative image that will be
5650	 * loaded if the first one fails.
5651	 */
5652	init_completion(&priv->firmware_loading_complete);
5653	di = priv->device_info;
5654	if (ap_mode_default && di->fw_image_ap) {
5655		priv->fw_pref = di->fw_image_ap;
5656		priv->fw_alt = di->fw_image_sta;
5657	} else if (!ap_mode_default && di->fw_image_sta) {
5658		priv->fw_pref = di->fw_image_sta;
5659		priv->fw_alt = di->fw_image_ap;
5660	} else if (ap_mode_default && !di->fw_image_ap && di->fw_image_sta) {
5661		printk(KERN_WARNING "AP fw is unavailable.  Using STA fw.");
5662		priv->fw_pref = di->fw_image_sta;
5663	} else if (!ap_mode_default && !di->fw_image_sta && di->fw_image_ap) {
5664		printk(KERN_WARNING "STA fw is unavailable.  Using AP fw.");
5665		priv->fw_pref = di->fw_image_ap;
5666	}
5667	rc = mwl8k_init_firmware(hw, priv->fw_pref, true);
5668	if (rc)
5669		goto err_stop_firmware;
5670	return rc;
5671
5672err_stop_firmware:
5673	mwl8k_hw_reset(priv);
5674
5675err_iounmap:
5676	if (priv->regs != NULL)
5677		pci_iounmap(pdev, priv->regs);
5678
5679	if (priv->sram != NULL)
5680		pci_iounmap(pdev, priv->sram);
5681
5682	pci_set_drvdata(pdev, NULL);
5683	ieee80211_free_hw(hw);
5684
5685err_free_reg:
5686	pci_release_regions(pdev);
5687
5688err_disable_device:
5689	pci_disable_device(pdev);
5690
5691	return rc;
5692}
5693
5694static void __devexit mwl8k_shutdown(struct pci_dev *pdev)
5695{
5696	printk(KERN_ERR "===>%s(%u)\n", __func__, __LINE__);
5697}
5698
5699static void __devexit mwl8k_remove(struct pci_dev *pdev)
5700{
5701	struct ieee80211_hw *hw = pci_get_drvdata(pdev);
5702	struct mwl8k_priv *priv;
5703	int i;
5704
5705	if (hw == NULL)
5706		return;
5707	priv = hw->priv;
5708
5709	wait_for_completion(&priv->firmware_loading_complete);
5710
5711	if (priv->fw_state == FW_STATE_ERROR) {
5712		mwl8k_hw_reset(priv);
5713		goto unmap;
5714	}
5715
5716	ieee80211_stop_queues(hw);
5717
5718	ieee80211_unregister_hw(hw);
5719
5720	/* Remove TX reclaim and RX tasklets.  */
5721	tasklet_kill(&priv->poll_tx_task);
5722	tasklet_kill(&priv->poll_rx_task);
5723
5724	/* Stop hardware */
5725	mwl8k_hw_reset(priv);
5726
5727	/* Return all skbs to mac80211 */
5728	for (i = 0; i < mwl8k_tx_queues(priv); i++)
5729		mwl8k_txq_reclaim(hw, i, INT_MAX, 1);
5730
5731	for (i = 0; i < mwl8k_tx_queues(priv); i++)
5732		mwl8k_txq_deinit(hw, i);
5733
5734	mwl8k_rxq_deinit(hw, 0);
5735
5736	pci_free_consistent(priv->pdev, 4, priv->cookie, priv->cookie_dma);
5737
5738unmap:
5739	pci_iounmap(pdev, priv->regs);
5740	pci_iounmap(pdev, priv->sram);
5741	pci_set_drvdata(pdev, NULL);
5742	ieee80211_free_hw(hw);
5743	pci_release_regions(pdev);
5744	pci_disable_device(pdev);
5745}
5746
5747static struct pci_driver mwl8k_driver = {
5748	.name		= MWL8K_NAME,
5749	.id_table	= mwl8k_pci_id_table,
5750	.probe		= mwl8k_probe,
5751	.remove		= __devexit_p(mwl8k_remove),
5752	.shutdown	= __devexit_p(mwl8k_shutdown),
5753};
5754
5755static int __init mwl8k_init(void)
5756{
5757	return pci_register_driver(&mwl8k_driver);
5758}
5759
5760static void __exit mwl8k_exit(void)
5761{
5762	pci_unregister_driver(&mwl8k_driver);
5763}
5764
5765module_init(mwl8k_init);
5766module_exit(mwl8k_exit);
5767
5768MODULE_DESCRIPTION(MWL8K_DESC);
5769MODULE_VERSION(MWL8K_VERSION);
5770MODULE_AUTHOR("Lennert Buytenhek <buytenh@marvell.com>");
5771MODULE_LICENSE("GPL");
5772