linux/drivers/net/wireless/intel/iwlegacy/4965-mac.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0-only
   2/******************************************************************************
   3 *
   4 * Copyright(c) 2003 - 2011 Intel Corporation. All rights reserved.
   5 *
   6 * Portions of this file are derived from the ipw3945 project, as well
   7 * as portions of the ieee80211 subsystem header files.
   8 *
   9 * Contact Information:
  10 *  Intel Linux Wireless <ilw@linux.intel.com>
  11 * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  12 *
  13 *****************************************************************************/
  14
  15#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  16
  17#include <linux/kernel.h>
  18#include <linux/module.h>
  19#include <linux/init.h>
  20#include <linux/pci.h>
  21#include <linux/slab.h>
  22#include <linux/dma-mapping.h>
  23#include <linux/delay.h>
  24#include <linux/sched.h>
  25#include <linux/skbuff.h>
  26#include <linux/netdevice.h>
  27#include <linux/firmware.h>
  28#include <linux/etherdevice.h>
  29#include <linux/if_arp.h>
  30#include <linux/units.h>
  31
  32#include <net/mac80211.h>
  33
  34#include <asm/div64.h>
  35
  36#define DRV_NAME        "iwl4965"
  37
  38#include "common.h"
  39#include "4965.h"
  40
  41/******************************************************************************
  42 *
  43 * module boiler plate
  44 *
  45 ******************************************************************************/
  46
  47/*
  48 * module name, copyright, version, etc.
  49 */
  50#define DRV_DESCRIPTION "Intel(R) Wireless WiFi 4965 driver for Linux"
  51
  52#ifdef CONFIG_IWLEGACY_DEBUG
  53#define VD "d"
  54#else
  55#define VD
  56#endif
  57
  58#define DRV_VERSION     IWLWIFI_VERSION VD
  59
  60MODULE_DESCRIPTION(DRV_DESCRIPTION);
  61MODULE_VERSION(DRV_VERSION);
  62MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
  63MODULE_LICENSE("GPL");
  64MODULE_ALIAS("iwl4965");
  65
  66void
  67il4965_check_abort_status(struct il_priv *il, u8 frame_count, u32 status)
  68{
  69        if (frame_count == 1 && status == TX_STATUS_FAIL_RFKILL_FLUSH) {
  70                IL_ERR("Tx flush command to flush out all frames\n");
  71                if (!test_bit(S_EXIT_PENDING, &il->status))
  72                        queue_work(il->workqueue, &il->tx_flush);
  73        }
  74}
  75
  76/*
  77 * EEPROM
  78 */
  79struct il_mod_params il4965_mod_params = {
  80        .restart_fw = 1,
  81        /* the rest are 0 by default */
  82};
  83
  84void
  85il4965_rx_queue_reset(struct il_priv *il, struct il_rx_queue *rxq)
  86{
  87        unsigned long flags;
  88        int i;
  89        spin_lock_irqsave(&rxq->lock, flags);
  90        INIT_LIST_HEAD(&rxq->rx_free);
  91        INIT_LIST_HEAD(&rxq->rx_used);
  92        /* Fill the rx_used queue with _all_ of the Rx buffers */
  93        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
  94                /* In the reset function, these buffers may have been allocated
  95                 * to an SKB, so we need to unmap and free potential storage */
  96                if (rxq->pool[i].page != NULL) {
  97                        pci_unmap_page(il->pci_dev, rxq->pool[i].page_dma,
  98                                       PAGE_SIZE << il->hw_params.rx_page_order,
  99                                       PCI_DMA_FROMDEVICE);
 100                        __il_free_pages(il, rxq->pool[i].page);
 101                        rxq->pool[i].page = NULL;
 102                }
 103                list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
 104        }
 105
 106        for (i = 0; i < RX_QUEUE_SIZE; i++)
 107                rxq->queue[i] = NULL;
 108
 109        /* Set us so that we have processed and used all buffers, but have
 110         * not restocked the Rx queue with fresh buffers */
 111        rxq->read = rxq->write = 0;
 112        rxq->write_actual = 0;
 113        rxq->free_count = 0;
 114        spin_unlock_irqrestore(&rxq->lock, flags);
 115}
 116
 117int
 118il4965_rx_init(struct il_priv *il, struct il_rx_queue *rxq)
 119{
 120        u32 rb_size;
 121        const u32 rfdnlog = RX_QUEUE_SIZE_LOG;  /* 256 RBDs */
 122        u32 rb_timeout = 0;
 123
 124        if (il->cfg->mod_params->amsdu_size_8K)
 125                rb_size = FH49_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_8K;
 126        else
 127                rb_size = FH49_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K;
 128
 129        /* Stop Rx DMA */
 130        il_wr(il, FH49_MEM_RCSR_CHNL0_CONFIG_REG, 0);
 131
 132        /* Reset driver's Rx queue write idx */
 133        il_wr(il, FH49_RSCSR_CHNL0_RBDCB_WPTR_REG, 0);
 134
 135        /* Tell device where to find RBD circular buffer in DRAM */
 136        il_wr(il, FH49_RSCSR_CHNL0_RBDCB_BASE_REG, (u32) (rxq->bd_dma >> 8));
 137
 138        /* Tell device where in DRAM to update its Rx status */
 139        il_wr(il, FH49_RSCSR_CHNL0_STTS_WPTR_REG, rxq->rb_stts_dma >> 4);
 140
 141        /* Enable Rx DMA
 142         * Direct rx interrupts to hosts
 143         * Rx buffer size 4 or 8k
 144         * RB timeout 0x10
 145         * 256 RBDs
 146         */
 147        il_wr(il, FH49_MEM_RCSR_CHNL0_CONFIG_REG,
 148              FH49_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL |
 149              FH49_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL |
 150              FH49_RCSR_CHNL0_RX_CONFIG_SINGLE_FRAME_MSK |
 151              rb_size |
 152              (rb_timeout << FH49_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS) |
 153              (rfdnlog << FH49_RCSR_RX_CONFIG_RBDCB_SIZE_POS));
 154
 155        /* Set interrupt coalescing timer to default (2048 usecs) */
 156        il_write8(il, CSR_INT_COALESCING, IL_HOST_INT_TIMEOUT_DEF);
 157
 158        return 0;
 159}
 160
 161static void
 162il4965_set_pwr_vmain(struct il_priv *il)
 163{
 164/*
 165 * (for documentation purposes)
 166 * to set power to V_AUX, do:
 167
 168                if (pci_pme_capable(il->pci_dev, PCI_D3cold))
 169                        il_set_bits_mask_prph(il, APMG_PS_CTRL_REG,
 170                                               APMG_PS_CTRL_VAL_PWR_SRC_VAUX,
 171                                               ~APMG_PS_CTRL_MSK_PWR_SRC);
 172 */
 173
 174        il_set_bits_mask_prph(il, APMG_PS_CTRL_REG,
 175                              APMG_PS_CTRL_VAL_PWR_SRC_VMAIN,
 176                              ~APMG_PS_CTRL_MSK_PWR_SRC);
 177}
 178
 179int
 180il4965_hw_nic_init(struct il_priv *il)
 181{
 182        unsigned long flags;
 183        struct il_rx_queue *rxq = &il->rxq;
 184        int ret;
 185
 186        spin_lock_irqsave(&il->lock, flags);
 187        il_apm_init(il);
 188        /* Set interrupt coalescing calibration timer to default (512 usecs) */
 189        il_write8(il, CSR_INT_COALESCING, IL_HOST_INT_CALIB_TIMEOUT_DEF);
 190        spin_unlock_irqrestore(&il->lock, flags);
 191
 192        il4965_set_pwr_vmain(il);
 193        il4965_nic_config(il);
 194
 195        /* Allocate the RX queue, or reset if it is already allocated */
 196        if (!rxq->bd) {
 197                ret = il_rx_queue_alloc(il);
 198                if (ret) {
 199                        IL_ERR("Unable to initialize Rx queue\n");
 200                        return -ENOMEM;
 201                }
 202        } else
 203                il4965_rx_queue_reset(il, rxq);
 204
 205        il4965_rx_replenish(il);
 206
 207        il4965_rx_init(il, rxq);
 208
 209        spin_lock_irqsave(&il->lock, flags);
 210
 211        rxq->need_update = 1;
 212        il_rx_queue_update_write_ptr(il, rxq);
 213
 214        spin_unlock_irqrestore(&il->lock, flags);
 215
 216        /* Allocate or reset and init all Tx and Command queues */
 217        if (!il->txq) {
 218                ret = il4965_txq_ctx_alloc(il);
 219                if (ret)
 220                        return ret;
 221        } else
 222                il4965_txq_ctx_reset(il);
 223
 224        set_bit(S_INIT, &il->status);
 225
 226        return 0;
 227}
 228
 229/*
 230 * il4965_dma_addr2rbd_ptr - convert a DMA address to a uCode read buffer ptr
 231 */
 232static inline __le32
 233il4965_dma_addr2rbd_ptr(struct il_priv *il, dma_addr_t dma_addr)
 234{
 235        return cpu_to_le32((u32) (dma_addr >> 8));
 236}
 237
 238/*
 239 * il4965_rx_queue_restock - refill RX queue from pre-allocated pool
 240 *
 241 * If there are slots in the RX queue that need to be restocked,
 242 * and we have free pre-allocated buffers, fill the ranks as much
 243 * as we can, pulling from rx_free.
 244 *
 245 * This moves the 'write' idx forward to catch up with 'processed', and
 246 * also updates the memory address in the firmware to reference the new
 247 * target buffer.
 248 */
 249void
 250il4965_rx_queue_restock(struct il_priv *il)
 251{
 252        struct il_rx_queue *rxq = &il->rxq;
 253        struct list_head *element;
 254        struct il_rx_buf *rxb;
 255        unsigned long flags;
 256
 257        spin_lock_irqsave(&rxq->lock, flags);
 258        while (il_rx_queue_space(rxq) > 0 && rxq->free_count) {
 259                /* The overwritten rxb must be a used one */
 260                rxb = rxq->queue[rxq->write];
 261                BUG_ON(rxb && rxb->page);
 262
 263                /* Get next free Rx buffer, remove from free list */
 264                element = rxq->rx_free.next;
 265                rxb = list_entry(element, struct il_rx_buf, list);
 266                list_del(element);
 267
 268                /* Point to Rx buffer via next RBD in circular buffer */
 269                rxq->bd[rxq->write] =
 270                    il4965_dma_addr2rbd_ptr(il, rxb->page_dma);
 271                rxq->queue[rxq->write] = rxb;
 272                rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
 273                rxq->free_count--;
 274        }
 275        spin_unlock_irqrestore(&rxq->lock, flags);
 276        /* If the pre-allocated buffer pool is dropping low, schedule to
 277         * refill it */
 278        if (rxq->free_count <= RX_LOW_WATERMARK)
 279                queue_work(il->workqueue, &il->rx_replenish);
 280
 281        /* If we've added more space for the firmware to place data, tell it.
 282         * Increment device's write pointer in multiples of 8. */
 283        if (rxq->write_actual != (rxq->write & ~0x7)) {
 284                spin_lock_irqsave(&rxq->lock, flags);
 285                rxq->need_update = 1;
 286                spin_unlock_irqrestore(&rxq->lock, flags);
 287                il_rx_queue_update_write_ptr(il, rxq);
 288        }
 289}
 290
 291/*
 292 * il4965_rx_replenish - Move all used packet from rx_used to rx_free
 293 *
 294 * When moving to rx_free an SKB is allocated for the slot.
 295 *
 296 * Also restock the Rx queue via il_rx_queue_restock.
 297 * This is called as a scheduled work item (except for during initialization)
 298 */
 299static void
 300il4965_rx_allocate(struct il_priv *il, gfp_t priority)
 301{
 302        struct il_rx_queue *rxq = &il->rxq;
 303        struct list_head *element;
 304        struct il_rx_buf *rxb;
 305        struct page *page;
 306        dma_addr_t page_dma;
 307        unsigned long flags;
 308        gfp_t gfp_mask = priority;
 309
 310        while (1) {
 311                spin_lock_irqsave(&rxq->lock, flags);
 312                if (list_empty(&rxq->rx_used)) {
 313                        spin_unlock_irqrestore(&rxq->lock, flags);
 314                        return;
 315                }
 316                spin_unlock_irqrestore(&rxq->lock, flags);
 317
 318                if (rxq->free_count > RX_LOW_WATERMARK)
 319                        gfp_mask |= __GFP_NOWARN;
 320
 321                if (il->hw_params.rx_page_order > 0)
 322                        gfp_mask |= __GFP_COMP;
 323
 324                /* Alloc a new receive buffer */
 325                page = alloc_pages(gfp_mask, il->hw_params.rx_page_order);
 326                if (!page) {
 327                        if (net_ratelimit())
 328                                D_INFO("alloc_pages failed, " "order: %d\n",
 329                                       il->hw_params.rx_page_order);
 330
 331                        if (rxq->free_count <= RX_LOW_WATERMARK &&
 332                            net_ratelimit())
 333                                IL_ERR("Failed to alloc_pages with %s. "
 334                                       "Only %u free buffers remaining.\n",
 335                                       priority ==
 336                                       GFP_ATOMIC ? "GFP_ATOMIC" : "GFP_KERNEL",
 337                                       rxq->free_count);
 338                        /* We don't reschedule replenish work here -- we will
 339                         * call the restock method and if it still needs
 340                         * more buffers it will schedule replenish */
 341                        return;
 342                }
 343
 344                /* Get physical address of the RB */
 345                page_dma =
 346                    pci_map_page(il->pci_dev, page, 0,
 347                                 PAGE_SIZE << il->hw_params.rx_page_order,
 348                                 PCI_DMA_FROMDEVICE);
 349                if (unlikely(pci_dma_mapping_error(il->pci_dev, page_dma))) {
 350                        __free_pages(page, il->hw_params.rx_page_order);
 351                        break;
 352                }
 353
 354                spin_lock_irqsave(&rxq->lock, flags);
 355
 356                if (list_empty(&rxq->rx_used)) {
 357                        spin_unlock_irqrestore(&rxq->lock, flags);
 358                        pci_unmap_page(il->pci_dev, page_dma,
 359                                       PAGE_SIZE << il->hw_params.rx_page_order,
 360                                       PCI_DMA_FROMDEVICE);
 361                        __free_pages(page, il->hw_params.rx_page_order);
 362                        return;
 363                }
 364
 365                element = rxq->rx_used.next;
 366                rxb = list_entry(element, struct il_rx_buf, list);
 367                list_del(element);
 368
 369                BUG_ON(rxb->page);
 370
 371                rxb->page = page;
 372                rxb->page_dma = page_dma;
 373                list_add_tail(&rxb->list, &rxq->rx_free);
 374                rxq->free_count++;
 375                il->alloc_rxb_page++;
 376
 377                spin_unlock_irqrestore(&rxq->lock, flags);
 378        }
 379}
 380
 381void
 382il4965_rx_replenish(struct il_priv *il)
 383{
 384        unsigned long flags;
 385
 386        il4965_rx_allocate(il, GFP_KERNEL);
 387
 388        spin_lock_irqsave(&il->lock, flags);
 389        il4965_rx_queue_restock(il);
 390        spin_unlock_irqrestore(&il->lock, flags);
 391}
 392
 393void
 394il4965_rx_replenish_now(struct il_priv *il)
 395{
 396        il4965_rx_allocate(il, GFP_ATOMIC);
 397
 398        il4965_rx_queue_restock(il);
 399}
 400
 401/* Assumes that the skb field of the buffers in 'pool' is kept accurate.
 402 * If an SKB has been detached, the POOL needs to have its SKB set to NULL
 403 * This free routine walks the list of POOL entries and if SKB is set to
 404 * non NULL it is unmapped and freed
 405 */
 406void
 407il4965_rx_queue_free(struct il_priv *il, struct il_rx_queue *rxq)
 408{
 409        int i;
 410        for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
 411                if (rxq->pool[i].page != NULL) {
 412                        pci_unmap_page(il->pci_dev, rxq->pool[i].page_dma,
 413                                       PAGE_SIZE << il->hw_params.rx_page_order,
 414                                       PCI_DMA_FROMDEVICE);
 415                        __il_free_pages(il, rxq->pool[i].page);
 416                        rxq->pool[i].page = NULL;
 417                }
 418        }
 419
 420        dma_free_coherent(&il->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
 421                          rxq->bd_dma);
 422        dma_free_coherent(&il->pci_dev->dev, sizeof(struct il_rb_status),
 423                          rxq->rb_stts, rxq->rb_stts_dma);
 424        rxq->bd = NULL;
 425        rxq->rb_stts = NULL;
 426}
 427
 428int
 429il4965_rxq_stop(struct il_priv *il)
 430{
 431        int ret;
 432
 433        _il_wr(il, FH49_MEM_RCSR_CHNL0_CONFIG_REG, 0);
 434        ret = _il_poll_bit(il, FH49_MEM_RSSR_RX_STATUS_REG,
 435                           FH49_RSSR_CHNL0_RX_STATUS_CHNL_IDLE,
 436                           FH49_RSSR_CHNL0_RX_STATUS_CHNL_IDLE,
 437                           1000);
 438        if (ret < 0)
 439                IL_ERR("Can't stop Rx DMA.\n");
 440
 441        return 0;
 442}
 443
 444int
 445il4965_hwrate_to_mac80211_idx(u32 rate_n_flags, enum nl80211_band band)
 446{
 447        int idx = 0;
 448        int band_offset = 0;
 449
 450        /* HT rate format: mac80211 wants an MCS number, which is just LSB */
 451        if (rate_n_flags & RATE_MCS_HT_MSK) {
 452                idx = (rate_n_flags & 0xff);
 453                return idx;
 454                /* Legacy rate format, search for match in table */
 455        } else {
 456                if (band == NL80211_BAND_5GHZ)
 457                        band_offset = IL_FIRST_OFDM_RATE;
 458                for (idx = band_offset; idx < RATE_COUNT_LEGACY; idx++)
 459                        if (il_rates[idx].plcp == (rate_n_flags & 0xFF))
 460                                return idx - band_offset;
 461        }
 462
 463        return -1;
 464}
 465
 466static int
 467il4965_calc_rssi(struct il_priv *il, struct il_rx_phy_res *rx_resp)
 468{
 469        /* data from PHY/DSP regarding signal strength, etc.,
 470         *   contents are always there, not configurable by host.  */
 471        struct il4965_rx_non_cfg_phy *ncphy =
 472            (struct il4965_rx_non_cfg_phy *)rx_resp->non_cfg_phy_buf;
 473        u32 agc =
 474            (le16_to_cpu(ncphy->agc_info) & IL49_AGC_DB_MASK) >>
 475            IL49_AGC_DB_POS;
 476
 477        u32 valid_antennae =
 478            (le16_to_cpu(rx_resp->phy_flags) & IL49_RX_PHY_FLAGS_ANTENNAE_MASK)
 479            >> IL49_RX_PHY_FLAGS_ANTENNAE_OFFSET;
 480        u8 max_rssi = 0;
 481        u32 i;
 482
 483        /* Find max rssi among 3 possible receivers.
 484         * These values are measured by the digital signal processor (DSP).
 485         * They should stay fairly constant even as the signal strength varies,
 486         *   if the radio's automatic gain control (AGC) is working right.
 487         * AGC value (see below) will provide the "interesting" info. */
 488        for (i = 0; i < 3; i++)
 489                if (valid_antennae & (1 << i))
 490                        max_rssi = max(ncphy->rssi_info[i << 1], max_rssi);
 491
 492        D_STATS("Rssi In A %d B %d C %d Max %d AGC dB %d\n",
 493                ncphy->rssi_info[0], ncphy->rssi_info[2], ncphy->rssi_info[4],
 494                max_rssi, agc);
 495
 496        /* dBm = max_rssi dB - agc dB - constant.
 497         * Higher AGC (higher radio gain) means lower signal. */
 498        return max_rssi - agc - IL4965_RSSI_OFFSET;
 499}
 500
 501static u32
 502il4965_translate_rx_status(struct il_priv *il, u32 decrypt_in)
 503{
 504        u32 decrypt_out = 0;
 505
 506        if ((decrypt_in & RX_RES_STATUS_STATION_FOUND) ==
 507            RX_RES_STATUS_STATION_FOUND)
 508                decrypt_out |=
 509                    (RX_RES_STATUS_STATION_FOUND |
 510                     RX_RES_STATUS_NO_STATION_INFO_MISMATCH);
 511
 512        decrypt_out |= (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK);
 513
 514        /* packet was not encrypted */
 515        if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
 516            RX_RES_STATUS_SEC_TYPE_NONE)
 517                return decrypt_out;
 518
 519        /* packet was encrypted with unknown alg */
 520        if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
 521            RX_RES_STATUS_SEC_TYPE_ERR)
 522                return decrypt_out;
 523
 524        /* decryption was not done in HW */
 525        if ((decrypt_in & RX_MPDU_RES_STATUS_DEC_DONE_MSK) !=
 526            RX_MPDU_RES_STATUS_DEC_DONE_MSK)
 527                return decrypt_out;
 528
 529        switch (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) {
 530
 531        case RX_RES_STATUS_SEC_TYPE_CCMP:
 532                /* alg is CCM: check MIC only */
 533                if (!(decrypt_in & RX_MPDU_RES_STATUS_MIC_OK))
 534                        /* Bad MIC */
 535                        decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
 536                else
 537                        decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
 538
 539                break;
 540
 541        case RX_RES_STATUS_SEC_TYPE_TKIP:
 542                if (!(decrypt_in & RX_MPDU_RES_STATUS_TTAK_OK)) {
 543                        /* Bad TTAK */
 544                        decrypt_out |= RX_RES_STATUS_BAD_KEY_TTAK;
 545                        break;
 546                }
 547                fallthrough;    /* if TTAK OK */
 548        default:
 549                if (!(decrypt_in & RX_MPDU_RES_STATUS_ICV_OK))
 550                        decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
 551                else
 552                        decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
 553                break;
 554        }
 555
 556        D_RX("decrypt_in:0x%x  decrypt_out = 0x%x\n", decrypt_in, decrypt_out);
 557
 558        return decrypt_out;
 559}
 560
 561#define SMALL_PACKET_SIZE 256
 562
 563static void
 564il4965_pass_packet_to_mac80211(struct il_priv *il, struct ieee80211_hdr *hdr,
 565                               u32 len, u32 ampdu_status, struct il_rx_buf *rxb,
 566                               struct ieee80211_rx_status *stats)
 567{
 568        struct sk_buff *skb;
 569        __le16 fc = hdr->frame_control;
 570
 571        /* We only process data packets if the interface is open */
 572        if (unlikely(!il->is_open)) {
 573                D_DROP("Dropping packet while interface is not open.\n");
 574                return;
 575        }
 576
 577        if (unlikely(test_bit(IL_STOP_REASON_PASSIVE, &il->stop_reason))) {
 578                il_wake_queues_by_reason(il, IL_STOP_REASON_PASSIVE);
 579                D_INFO("Woke queues - frame received on passive channel\n");
 580        }
 581
 582        /* In case of HW accelerated crypto and bad decryption, drop */
 583        if (!il->cfg->mod_params->sw_crypto &&
 584            il_set_decrypted_flag(il, hdr, ampdu_status, stats))
 585                return;
 586
 587        skb = dev_alloc_skb(SMALL_PACKET_SIZE);
 588        if (!skb) {
 589                IL_ERR("dev_alloc_skb failed\n");
 590                return;
 591        }
 592
 593        if (len <= SMALL_PACKET_SIZE) {
 594                skb_put_data(skb, hdr, len);
 595        } else {
 596                skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb),
 597                                len, PAGE_SIZE << il->hw_params.rx_page_order);
 598                il->alloc_rxb_page--;
 599                rxb->page = NULL;
 600        }
 601
 602        il_update_stats(il, false, fc, len);
 603        memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
 604
 605        ieee80211_rx(il->hw, skb);
 606}
 607
 608/* Called for N_RX (legacy ABG frames), or
 609 * N_RX_MPDU (HT high-throughput N frames). */
 610static void
 611il4965_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)
 612{
 613        struct ieee80211_hdr *header;
 614        struct ieee80211_rx_status rx_status = {};
 615        struct il_rx_pkt *pkt = rxb_addr(rxb);
 616        struct il_rx_phy_res *phy_res;
 617        __le32 rx_pkt_status;
 618        struct il_rx_mpdu_res_start *amsdu;
 619        u32 len;
 620        u32 ampdu_status;
 621        u32 rate_n_flags;
 622
 623        /**
 624         * N_RX and N_RX_MPDU are handled differently.
 625         *      N_RX: physical layer info is in this buffer
 626         *      N_RX_MPDU: physical layer info was sent in separate
 627         *              command and cached in il->last_phy_res
 628         *
 629         * Here we set up local variables depending on which command is
 630         * received.
 631         */
 632        if (pkt->hdr.cmd == N_RX) {
 633                phy_res = (struct il_rx_phy_res *)pkt->u.raw;
 634                header =
 635                    (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*phy_res) +
 636                                             phy_res->cfg_phy_cnt);
 637
 638                len = le16_to_cpu(phy_res->byte_count);
 639                rx_pkt_status =
 640                    *(__le32 *) (pkt->u.raw + sizeof(*phy_res) +
 641                                 phy_res->cfg_phy_cnt + len);
 642                ampdu_status = le32_to_cpu(rx_pkt_status);
 643        } else {
 644                if (!il->_4965.last_phy_res_valid) {
 645                        IL_ERR("MPDU frame without cached PHY data\n");
 646                        return;
 647                }
 648                phy_res = &il->_4965.last_phy_res;
 649                amsdu = (struct il_rx_mpdu_res_start *)pkt->u.raw;
 650                header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*amsdu));
 651                len = le16_to_cpu(amsdu->byte_count);
 652                rx_pkt_status = *(__le32 *) (pkt->u.raw + sizeof(*amsdu) + len);
 653                ampdu_status =
 654                    il4965_translate_rx_status(il, le32_to_cpu(rx_pkt_status));
 655        }
 656
 657        if ((unlikely(phy_res->cfg_phy_cnt > 20))) {
 658                D_DROP("dsp size out of range [0,20]: %d\n",
 659                       phy_res->cfg_phy_cnt);
 660                return;
 661        }
 662
 663        if (!(rx_pkt_status & RX_RES_STATUS_NO_CRC32_ERROR) ||
 664            !(rx_pkt_status & RX_RES_STATUS_NO_RXE_OVERFLOW)) {
 665                D_RX("Bad CRC or FIFO: 0x%08X.\n", le32_to_cpu(rx_pkt_status));
 666                return;
 667        }
 668
 669        /* This will be used in several places later */
 670        rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);
 671
 672        /* rx_status carries information about the packet to mac80211 */
 673        rx_status.mactime = le64_to_cpu(phy_res->timestamp);
 674        rx_status.band =
 675            (phy_res->
 676             phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ? NL80211_BAND_2GHZ :
 677            NL80211_BAND_5GHZ;
 678        rx_status.freq =
 679            ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel),
 680                                           rx_status.band);
 681        rx_status.rate_idx =
 682            il4965_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band);
 683        rx_status.flag = 0;
 684
 685        /* TSF isn't reliable. In order to allow smooth user experience,
 686         * this W/A doesn't propagate it to the mac80211 */
 687        /*rx_status.flag |= RX_FLAG_MACTIME_START; */
 688
 689        il->ucode_beacon_time = le32_to_cpu(phy_res->beacon_time_stamp);
 690
 691        /* Find max signal strength (dBm) among 3 antenna/receiver chains */
 692        rx_status.signal = il4965_calc_rssi(il, phy_res);
 693
 694        D_STATS("Rssi %d, TSF %llu\n", rx_status.signal,
 695                (unsigned long long)rx_status.mactime);
 696
 697        /*
 698         * "antenna number"
 699         *
 700         * It seems that the antenna field in the phy flags value
 701         * is actually a bit field. This is undefined by radiotap,
 702         * it wants an actual antenna number but I always get "7"
 703         * for most legacy frames I receive indicating that the
 704         * same frame was received on all three RX chains.
 705         *
 706         * I think this field should be removed in favor of a
 707         * new 802.11n radiotap field "RX chains" that is defined
 708         * as a bitmask.
 709         */
 710        rx_status.antenna =
 711            (le16_to_cpu(phy_res->phy_flags) & RX_RES_PHY_FLAGS_ANTENNA_MSK) >>
 712            RX_RES_PHY_FLAGS_ANTENNA_POS;
 713
 714        /* set the preamble flag if appropriate */
 715        if (phy_res->phy_flags & RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK)
 716                rx_status.enc_flags |= RX_ENC_FLAG_SHORTPRE;
 717
 718        /* Set up the HT phy flags */
 719        if (rate_n_flags & RATE_MCS_HT_MSK)
 720                rx_status.encoding = RX_ENC_HT;
 721        if (rate_n_flags & RATE_MCS_HT40_MSK)
 722                rx_status.bw = RATE_INFO_BW_40;
 723        else
 724                rx_status.bw = RATE_INFO_BW_20;
 725        if (rate_n_flags & RATE_MCS_SGI_MSK)
 726                rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;
 727
 728        if (phy_res->phy_flags & RX_RES_PHY_FLAGS_AGG_MSK) {
 729                /* We know which subframes of an A-MPDU belong
 730                 * together since we get a single PHY response
 731                 * from the firmware for all of them.
 732                 */
 733
 734                rx_status.flag |= RX_FLAG_AMPDU_DETAILS;
 735                rx_status.ampdu_reference = il->_4965.ampdu_ref;
 736        }
 737
 738        il4965_pass_packet_to_mac80211(il, header, len, ampdu_status, rxb,
 739                                       &rx_status);
 740}
 741
 742/* Cache phy data (Rx signal strength, etc) for HT frame (N_RX_PHY).
 743 * This will be used later in il_hdl_rx() for N_RX_MPDU. */
 744static void
 745il4965_hdl_rx_phy(struct il_priv *il, struct il_rx_buf *rxb)
 746{
 747        struct il_rx_pkt *pkt = rxb_addr(rxb);
 748        il->_4965.last_phy_res_valid = true;
 749        il->_4965.ampdu_ref++;
 750        memcpy(&il->_4965.last_phy_res, pkt->u.raw,
 751               sizeof(struct il_rx_phy_res));
 752}
 753
 754static int
 755il4965_get_channels_for_scan(struct il_priv *il, struct ieee80211_vif *vif,
 756                             enum nl80211_band band, u8 is_active,
 757                             u8 n_probes, struct il_scan_channel *scan_ch)
 758{
 759        struct ieee80211_channel *chan;
 760        const struct ieee80211_supported_band *sband;
 761        const struct il_channel_info *ch_info;
 762        u16 passive_dwell = 0;
 763        u16 active_dwell = 0;
 764        int added, i;
 765        u16 channel;
 766
 767        sband = il_get_hw_mode(il, band);
 768        if (!sband)
 769                return 0;
 770
 771        active_dwell = il_get_active_dwell_time(il, band, n_probes);
 772        passive_dwell = il_get_passive_dwell_time(il, band, vif);
 773
 774        if (passive_dwell <= active_dwell)
 775                passive_dwell = active_dwell + 1;
 776
 777        for (i = 0, added = 0; i < il->scan_request->n_channels; i++) {
 778                chan = il->scan_request->channels[i];
 779
 780                if (chan->band != band)
 781                        continue;
 782
 783                channel = chan->hw_value;
 784                scan_ch->channel = cpu_to_le16(channel);
 785
 786                ch_info = il_get_channel_info(il, band, channel);
 787                if (!il_is_channel_valid(ch_info)) {
 788                        D_SCAN("Channel %d is INVALID for this band.\n",
 789                               channel);
 790                        continue;
 791                }
 792
 793                if (!is_active || il_is_channel_passive(ch_info) ||
 794                    (chan->flags & IEEE80211_CHAN_NO_IR))
 795                        scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
 796                else
 797                        scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
 798
 799                if (n_probes)
 800                        scan_ch->type |= IL_SCAN_PROBE_MASK(n_probes);
 801
 802                scan_ch->active_dwell = cpu_to_le16(active_dwell);
 803                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
 804
 805                /* Set txpower levels to defaults */
 806                scan_ch->dsp_atten = 110;
 807
 808                /* NOTE: if we were doing 6Mb OFDM for scans we'd use
 809                 * power level:
 810                 * scan_ch->tx_gain = ((1 << 5) | (2 << 3)) | 3;
 811                 */
 812                if (band == NL80211_BAND_5GHZ)
 813                        scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
 814                else
 815                        scan_ch->tx_gain = ((1 << 5) | (5 << 3));
 816
 817                D_SCAN("Scanning ch=%d prob=0x%X [%s %d]\n", channel,
 818                       le32_to_cpu(scan_ch->type),
 819                       (scan_ch->
 820                        type & SCAN_CHANNEL_TYPE_ACTIVE) ? "ACTIVE" : "PASSIVE",
 821                       (scan_ch->
 822                        type & SCAN_CHANNEL_TYPE_ACTIVE) ? active_dwell :
 823                       passive_dwell);
 824
 825                scan_ch++;
 826                added++;
 827        }
 828
 829        D_SCAN("total channels to scan %d\n", added);
 830        return added;
 831}
 832
 833static void
 834il4965_toggle_tx_ant(struct il_priv *il, u8 *ant, u8 valid)
 835{
 836        int i;
 837        u8 ind = *ant;
 838
 839        for (i = 0; i < RATE_ANT_NUM - 1; i++) {
 840                ind = (ind + 1) < RATE_ANT_NUM ? ind + 1 : 0;
 841                if (valid & BIT(ind)) {
 842                        *ant = ind;
 843                        return;
 844                }
 845        }
 846}
 847
 848int
 849il4965_request_scan(struct il_priv *il, struct ieee80211_vif *vif)
 850{
 851        struct il_host_cmd cmd = {
 852                .id = C_SCAN,
 853                .len = sizeof(struct il_scan_cmd),
 854                .flags = CMD_SIZE_HUGE,
 855        };
 856        struct il_scan_cmd *scan;
 857        u32 rate_flags = 0;
 858        u16 cmd_len;
 859        u16 rx_chain = 0;
 860        enum nl80211_band band;
 861        u8 n_probes = 0;
 862        u8 rx_ant = il->hw_params.valid_rx_ant;
 863        u8 rate;
 864        bool is_active = false;
 865        int chan_mod;
 866        u8 active_chains;
 867        u8 scan_tx_antennas = il->hw_params.valid_tx_ant;
 868        int ret;
 869
 870        lockdep_assert_held(&il->mutex);
 871
 872        if (!il->scan_cmd) {
 873                il->scan_cmd =
 874                    kmalloc(sizeof(struct il_scan_cmd) + IL_MAX_SCAN_SIZE,
 875                            GFP_KERNEL);
 876                if (!il->scan_cmd) {
 877                        D_SCAN("fail to allocate memory for scan\n");
 878                        return -ENOMEM;
 879                }
 880        }
 881        scan = il->scan_cmd;
 882        memset(scan, 0, sizeof(struct il_scan_cmd) + IL_MAX_SCAN_SIZE);
 883
 884        scan->quiet_plcp_th = IL_PLCP_QUIET_THRESH;
 885        scan->quiet_time = IL_ACTIVE_QUIET_TIME;
 886
 887        if (il_is_any_associated(il)) {
 888                u16 interval;
 889                u32 extra;
 890                u32 suspend_time = 100;
 891                u32 scan_suspend_time = 100;
 892
 893                D_INFO("Scanning while associated...\n");
 894                interval = vif->bss_conf.beacon_int;
 895
 896                scan->suspend_time = 0;
 897                scan->max_out_time = cpu_to_le32(200 * 1024);
 898                if (!interval)
 899                        interval = suspend_time;
 900
 901                extra = (suspend_time / interval) << 22;
 902                scan_suspend_time =
 903                    (extra | ((suspend_time % interval) * 1024));
 904                scan->suspend_time = cpu_to_le32(scan_suspend_time);
 905                D_SCAN("suspend_time 0x%X beacon interval %d\n",
 906                       scan_suspend_time, interval);
 907        }
 908
 909        if (il->scan_request->n_ssids) {
 910                int i, p = 0;
 911                D_SCAN("Kicking off active scan\n");
 912                for (i = 0; i < il->scan_request->n_ssids; i++) {
 913                        /* always does wildcard anyway */
 914                        if (!il->scan_request->ssids[i].ssid_len)
 915                                continue;
 916                        scan->direct_scan[p].id = WLAN_EID_SSID;
 917                        scan->direct_scan[p].len =
 918                            il->scan_request->ssids[i].ssid_len;
 919                        memcpy(scan->direct_scan[p].ssid,
 920                               il->scan_request->ssids[i].ssid,
 921                               il->scan_request->ssids[i].ssid_len);
 922                        n_probes++;
 923                        p++;
 924                }
 925                is_active = true;
 926        } else
 927                D_SCAN("Start passive scan.\n");
 928
 929        scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
 930        scan->tx_cmd.sta_id = il->hw_params.bcast_id;
 931        scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
 932
 933        switch (il->scan_band) {
 934        case NL80211_BAND_2GHZ:
 935                scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
 936                chan_mod =
 937                    le32_to_cpu(il->active.flags & RXON_FLG_CHANNEL_MODE_MSK) >>
 938                    RXON_FLG_CHANNEL_MODE_POS;
 939                if (chan_mod == CHANNEL_MODE_PURE_40) {
 940                        rate = RATE_6M_PLCP;
 941                } else {
 942                        rate = RATE_1M_PLCP;
 943                        rate_flags = RATE_MCS_CCK_MSK;
 944                }
 945                break;
 946        case NL80211_BAND_5GHZ:
 947                rate = RATE_6M_PLCP;
 948                break;
 949        default:
 950                IL_WARN("Invalid scan band\n");
 951                return -EIO;
 952        }
 953
 954        /*
 955         * If active scanning is requested but a certain channel is
 956         * marked passive, we can do active scanning if we detect
 957         * transmissions.
 958         *
 959         * There is an issue with some firmware versions that triggers
 960         * a sysassert on a "good CRC threshold" of zero (== disabled),
 961         * on a radar channel even though this means that we should NOT
 962         * send probes.
 963         *
 964         * The "good CRC threshold" is the number of frames that we
 965         * need to receive during our dwell time on a channel before
 966         * sending out probes -- setting this to a huge value will
 967         * mean we never reach it, but at the same time work around
 968         * the aforementioned issue. Thus use IL_GOOD_CRC_TH_NEVER
 969         * here instead of IL_GOOD_CRC_TH_DISABLED.
 970         */
 971        scan->good_CRC_th =
 972            is_active ? IL_GOOD_CRC_TH_DEFAULT : IL_GOOD_CRC_TH_NEVER;
 973
 974        band = il->scan_band;
 975
 976        if (il->cfg->scan_rx_antennas[band])
 977                rx_ant = il->cfg->scan_rx_antennas[band];
 978
 979        il4965_toggle_tx_ant(il, &il->scan_tx_ant[band], scan_tx_antennas);
 980        rate_flags |= BIT(il->scan_tx_ant[band]) << RATE_MCS_ANT_POS;
 981        scan->tx_cmd.rate_n_flags = cpu_to_le32(rate | rate_flags);
 982
 983        /* In power save mode use one chain, otherwise use all chains */
 984        if (test_bit(S_POWER_PMI, &il->status)) {
 985                /* rx_ant has been set to all valid chains previously */
 986                active_chains =
 987                    rx_ant & ((u8) (il->chain_noise_data.active_chains));
 988                if (!active_chains)
 989                        active_chains = rx_ant;
 990
 991                D_SCAN("chain_noise_data.active_chains: %u\n",
 992                       il->chain_noise_data.active_chains);
 993
 994                rx_ant = il4965_first_antenna(active_chains);
 995        }
 996
 997        /* MIMO is not used here, but value is required */
 998        rx_chain |= il->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
 999        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
1000        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
1001        rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
1002        scan->rx_chain = cpu_to_le16(rx_chain);
1003
1004        cmd_len =
1005            il_fill_probe_req(il, (struct ieee80211_mgmt *)scan->data,
1006                              vif->addr, il->scan_request->ie,
1007                              il->scan_request->ie_len,
1008                              IL_MAX_SCAN_SIZE - sizeof(*scan));
1009        scan->tx_cmd.len = cpu_to_le16(cmd_len);
1010
1011        scan->filter_flags |=
1012            (RXON_FILTER_ACCEPT_GRP_MSK | RXON_FILTER_BCON_AWARE_MSK);
1013
1014        scan->channel_count =
1015            il4965_get_channels_for_scan(il, vif, band, is_active, n_probes,
1016                                         (void *)&scan->data[cmd_len]);
1017        if (scan->channel_count == 0) {
1018                D_SCAN("channel count %d\n", scan->channel_count);
1019                return -EIO;
1020        }
1021
1022        cmd.len +=
1023            le16_to_cpu(scan->tx_cmd.len) +
1024            scan->channel_count * sizeof(struct il_scan_channel);
1025        cmd.data = scan;
1026        scan->len = cpu_to_le16(cmd.len);
1027
1028        set_bit(S_SCAN_HW, &il->status);
1029
1030        ret = il_send_cmd_sync(il, &cmd);
1031        if (ret)
1032                clear_bit(S_SCAN_HW, &il->status);
1033
1034        return ret;
1035}
1036
1037int
1038il4965_manage_ibss_station(struct il_priv *il, struct ieee80211_vif *vif,
1039                           bool add)
1040{
1041        struct il_vif_priv *vif_priv = (void *)vif->drv_priv;
1042
1043        if (add)
1044                return il4965_add_bssid_station(il, vif->bss_conf.bssid,
1045                                                &vif_priv->ibss_bssid_sta_id);
1046        return il_remove_station(il, vif_priv->ibss_bssid_sta_id,
1047                                 vif->bss_conf.bssid);
1048}
1049
1050void
1051il4965_free_tfds_in_queue(struct il_priv *il, int sta_id, int tid, int freed)
1052{
1053        lockdep_assert_held(&il->sta_lock);
1054
1055        if (il->stations[sta_id].tid[tid].tfds_in_queue >= freed)
1056                il->stations[sta_id].tid[tid].tfds_in_queue -= freed;
1057        else {
1058                D_TX("free more than tfds_in_queue (%u:%d)\n",
1059                     il->stations[sta_id].tid[tid].tfds_in_queue, freed);
1060                il->stations[sta_id].tid[tid].tfds_in_queue = 0;
1061        }
1062}
1063
1064#define IL_TX_QUEUE_MSK 0xfffff
1065
1066static bool
1067il4965_is_single_rx_stream(struct il_priv *il)
1068{
1069        return il->current_ht_config.smps == IEEE80211_SMPS_STATIC ||
1070            il->current_ht_config.single_chain_sufficient;
1071}
1072
1073#define IL_NUM_RX_CHAINS_MULTIPLE       3
1074#define IL_NUM_RX_CHAINS_SINGLE 2
1075#define IL_NUM_IDLE_CHAINS_DUAL 2
1076#define IL_NUM_IDLE_CHAINS_SINGLE       1
1077
1078/*
1079 * Determine how many receiver/antenna chains to use.
1080 *
1081 * More provides better reception via diversity.  Fewer saves power
1082 * at the expense of throughput, but only when not in powersave to
1083 * start with.
1084 *
1085 * MIMO (dual stream) requires at least 2, but works better with 3.
1086 * This does not determine *which* chains to use, just how many.
1087 */
1088static int
1089il4965_get_active_rx_chain_count(struct il_priv *il)
1090{
1091        /* # of Rx chains to use when expecting MIMO. */
1092        if (il4965_is_single_rx_stream(il))
1093                return IL_NUM_RX_CHAINS_SINGLE;
1094        else
1095                return IL_NUM_RX_CHAINS_MULTIPLE;
1096}
1097
1098/*
1099 * When we are in power saving mode, unless device support spatial
1100 * multiplexing power save, use the active count for rx chain count.
1101 */
1102static int
1103il4965_get_idle_rx_chain_count(struct il_priv *il, int active_cnt)
1104{
1105        /* # Rx chains when idling, depending on SMPS mode */
1106        switch (il->current_ht_config.smps) {
1107        case IEEE80211_SMPS_STATIC:
1108        case IEEE80211_SMPS_DYNAMIC:
1109                return IL_NUM_IDLE_CHAINS_SINGLE;
1110        case IEEE80211_SMPS_OFF:
1111                return active_cnt;
1112        default:
1113                WARN(1, "invalid SMPS mode %d", il->current_ht_config.smps);
1114                return active_cnt;
1115        }
1116}
1117
1118/* up to 4 chains */
1119static u8
1120il4965_count_chain_bitmap(u32 chain_bitmap)
1121{
1122        u8 res;
1123        res = (chain_bitmap & BIT(0)) >> 0;
1124        res += (chain_bitmap & BIT(1)) >> 1;
1125        res += (chain_bitmap & BIT(2)) >> 2;
1126        res += (chain_bitmap & BIT(3)) >> 3;
1127        return res;
1128}
1129
1130/*
1131 * il4965_set_rxon_chain - Set up Rx chain usage in "staging" RXON image
1132 *
1133 * Selects how many and which Rx receivers/antennas/chains to use.
1134 * This should not be used for scan command ... it puts data in wrong place.
1135 */
1136void
1137il4965_set_rxon_chain(struct il_priv *il)
1138{
1139        bool is_single = il4965_is_single_rx_stream(il);
1140        bool is_cam = !test_bit(S_POWER_PMI, &il->status);
1141        u8 idle_rx_cnt, active_rx_cnt, valid_rx_cnt;
1142        u32 active_chains;
1143        u16 rx_chain;
1144
1145        /* Tell uCode which antennas are actually connected.
1146         * Before first association, we assume all antennas are connected.
1147         * Just after first association, il4965_chain_noise_calibration()
1148         *    checks which antennas actually *are* connected. */
1149        if (il->chain_noise_data.active_chains)
1150                active_chains = il->chain_noise_data.active_chains;
1151        else
1152                active_chains = il->hw_params.valid_rx_ant;
1153
1154        rx_chain = active_chains << RXON_RX_CHAIN_VALID_POS;
1155
1156        /* How many receivers should we use? */
1157        active_rx_cnt = il4965_get_active_rx_chain_count(il);
1158        idle_rx_cnt = il4965_get_idle_rx_chain_count(il, active_rx_cnt);
1159
1160        /* correct rx chain count according hw settings
1161         * and chain noise calibration
1162         */
1163        valid_rx_cnt = il4965_count_chain_bitmap(active_chains);
1164        if (valid_rx_cnt < active_rx_cnt)
1165                active_rx_cnt = valid_rx_cnt;
1166
1167        if (valid_rx_cnt < idle_rx_cnt)
1168                idle_rx_cnt = valid_rx_cnt;
1169
1170        rx_chain |= active_rx_cnt << RXON_RX_CHAIN_MIMO_CNT_POS;
1171        rx_chain |= idle_rx_cnt << RXON_RX_CHAIN_CNT_POS;
1172
1173        il->staging.rx_chain = cpu_to_le16(rx_chain);
1174
1175        if (!is_single && active_rx_cnt >= IL_NUM_RX_CHAINS_SINGLE && is_cam)
1176                il->staging.rx_chain |= RXON_RX_CHAIN_MIMO_FORCE_MSK;
1177        else
1178                il->staging.rx_chain &= ~RXON_RX_CHAIN_MIMO_FORCE_MSK;
1179
1180        D_ASSOC("rx_chain=0x%X active=%d idle=%d\n", il->staging.rx_chain,
1181                active_rx_cnt, idle_rx_cnt);
1182
1183        WARN_ON(active_rx_cnt == 0 || idle_rx_cnt == 0 ||
1184                active_rx_cnt < idle_rx_cnt);
1185}
1186
1187static const char *
1188il4965_get_fh_string(int cmd)
1189{
1190        switch (cmd) {
1191                IL_CMD(FH49_RSCSR_CHNL0_STTS_WPTR_REG);
1192                IL_CMD(FH49_RSCSR_CHNL0_RBDCB_BASE_REG);
1193                IL_CMD(FH49_RSCSR_CHNL0_WPTR);
1194                IL_CMD(FH49_MEM_RCSR_CHNL0_CONFIG_REG);
1195                IL_CMD(FH49_MEM_RSSR_SHARED_CTRL_REG);
1196                IL_CMD(FH49_MEM_RSSR_RX_STATUS_REG);
1197                IL_CMD(FH49_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV);
1198                IL_CMD(FH49_TSSR_TX_STATUS_REG);
1199                IL_CMD(FH49_TSSR_TX_ERROR_REG);
1200        default:
1201                return "UNKNOWN";
1202        }
1203}
1204
1205int
1206il4965_dump_fh(struct il_priv *il, char **buf, bool display)
1207{
1208        int i;
1209#ifdef CONFIG_IWLEGACY_DEBUG
1210        int pos = 0;
1211        size_t bufsz = 0;
1212#endif
1213        static const u32 fh_tbl[] = {
1214                FH49_RSCSR_CHNL0_STTS_WPTR_REG,
1215                FH49_RSCSR_CHNL0_RBDCB_BASE_REG,
1216                FH49_RSCSR_CHNL0_WPTR,
1217                FH49_MEM_RCSR_CHNL0_CONFIG_REG,
1218                FH49_MEM_RSSR_SHARED_CTRL_REG,
1219                FH49_MEM_RSSR_RX_STATUS_REG,
1220                FH49_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV,
1221                FH49_TSSR_TX_STATUS_REG,
1222                FH49_TSSR_TX_ERROR_REG
1223        };
1224#ifdef CONFIG_IWLEGACY_DEBUG
1225        if (display) {
1226                bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
1227                *buf = kmalloc(bufsz, GFP_KERNEL);
1228                if (!*buf)
1229                        return -ENOMEM;
1230                pos +=
1231                    scnprintf(*buf + pos, bufsz - pos, "FH register values:\n");
1232                for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
1233                        pos +=
1234                            scnprintf(*buf + pos, bufsz - pos,
1235                                      "  %34s: 0X%08x\n",
1236                                      il4965_get_fh_string(fh_tbl[i]),
1237                                      il_rd(il, fh_tbl[i]));
1238                }
1239                return pos;
1240        }
1241#endif
1242        IL_ERR("FH register values:\n");
1243        for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
1244                IL_ERR("  %34s: 0X%08x\n", il4965_get_fh_string(fh_tbl[i]),
1245                       il_rd(il, fh_tbl[i]));
1246        }
1247        return 0;
1248}
1249
1250static void
1251il4965_hdl_missed_beacon(struct il_priv *il, struct il_rx_buf *rxb)
1252{
1253        struct il_rx_pkt *pkt = rxb_addr(rxb);
1254        struct il_missed_beacon_notif *missed_beacon;
1255
1256        missed_beacon = &pkt->u.missed_beacon;
1257        if (le32_to_cpu(missed_beacon->consecutive_missed_beacons) >
1258            il->missed_beacon_threshold) {
1259                D_CALIB("missed bcn cnsq %d totl %d rcd %d expctd %d\n",
1260                        le32_to_cpu(missed_beacon->consecutive_missed_beacons),
1261                        le32_to_cpu(missed_beacon->total_missed_becons),
1262                        le32_to_cpu(missed_beacon->num_recvd_beacons),
1263                        le32_to_cpu(missed_beacon->num_expected_beacons));
1264                if (!test_bit(S_SCANNING, &il->status))
1265                        il4965_init_sensitivity(il);
1266        }
1267}
1268
1269/* Calculate noise level, based on measurements during network silence just
1270 *   before arriving beacon.  This measurement can be done only if we know
1271 *   exactly when to expect beacons, therefore only when we're associated. */
1272static void
1273il4965_rx_calc_noise(struct il_priv *il)
1274{
1275        struct stats_rx_non_phy *rx_info;
1276        int num_active_rx = 0;
1277        int total_silence = 0;
1278        int bcn_silence_a, bcn_silence_b, bcn_silence_c;
1279        int last_rx_noise;
1280
1281        rx_info = &(il->_4965.stats.rx.general);
1282        bcn_silence_a =
1283            le32_to_cpu(rx_info->beacon_silence_rssi_a) & IN_BAND_FILTER;
1284        bcn_silence_b =
1285            le32_to_cpu(rx_info->beacon_silence_rssi_b) & IN_BAND_FILTER;
1286        bcn_silence_c =
1287            le32_to_cpu(rx_info->beacon_silence_rssi_c) & IN_BAND_FILTER;
1288
1289        if (bcn_silence_a) {
1290                total_silence += bcn_silence_a;
1291                num_active_rx++;
1292        }
1293        if (bcn_silence_b) {
1294                total_silence += bcn_silence_b;
1295                num_active_rx++;
1296        }
1297        if (bcn_silence_c) {
1298                total_silence += bcn_silence_c;
1299                num_active_rx++;
1300        }
1301
1302        /* Average among active antennas */
1303        if (num_active_rx)
1304                last_rx_noise = (total_silence / num_active_rx) - 107;
1305        else
1306                last_rx_noise = IL_NOISE_MEAS_NOT_AVAILABLE;
1307
1308        D_CALIB("inband silence a %u, b %u, c %u, dBm %d\n", bcn_silence_a,
1309                bcn_silence_b, bcn_silence_c, last_rx_noise);
1310}
1311
1312#ifdef CONFIG_IWLEGACY_DEBUGFS
1313/*
1314 *  based on the assumption of all stats counter are in DWORD
1315 *  FIXME: This function is for debugging, do not deal with
1316 *  the case of counters roll-over.
1317 */
1318static void
1319il4965_accumulative_stats(struct il_priv *il, __le32 * stats)
1320{
1321        int i, size;
1322        __le32 *prev_stats;
1323        u32 *accum_stats;
1324        u32 *delta, *max_delta;
1325        struct stats_general_common *general, *accum_general;
1326
1327        prev_stats = (__le32 *) &il->_4965.stats;
1328        accum_stats = (u32 *) &il->_4965.accum_stats;
1329        size = sizeof(struct il_notif_stats);
1330        general = &il->_4965.stats.general.common;
1331        accum_general = &il->_4965.accum_stats.general.common;
1332        delta = (u32 *) &il->_4965.delta_stats;
1333        max_delta = (u32 *) &il->_4965.max_delta;
1334
1335        for (i = sizeof(__le32); i < size;
1336             i +=
1337             sizeof(__le32), stats++, prev_stats++, delta++, max_delta++,
1338             accum_stats++) {
1339                if (le32_to_cpu(*stats) > le32_to_cpu(*prev_stats)) {
1340                        *delta =
1341                            (le32_to_cpu(*stats) - le32_to_cpu(*prev_stats));
1342                        *accum_stats += *delta;
1343                        if (*delta > *max_delta)
1344                                *max_delta = *delta;
1345                }
1346        }
1347
1348        /* reset accumulative stats for "no-counter" type stats */
1349        accum_general->temperature = general->temperature;
1350        accum_general->ttl_timestamp = general->ttl_timestamp;
1351}
1352#endif
1353
1354static void
1355il4965_hdl_stats(struct il_priv *il, struct il_rx_buf *rxb)
1356{
1357        const int recalib_seconds = 60;
1358        bool change;
1359        struct il_rx_pkt *pkt = rxb_addr(rxb);
1360
1361        D_RX("Statistics notification received (%d vs %d).\n",
1362             (int)sizeof(struct il_notif_stats),
1363             le32_to_cpu(pkt->len_n_flags) & IL_RX_FRAME_SIZE_MSK);
1364
1365        change =
1366            ((il->_4965.stats.general.common.temperature !=
1367              pkt->u.stats.general.common.temperature) ||
1368             ((il->_4965.stats.flag & STATS_REPLY_FLG_HT40_MODE_MSK) !=
1369              (pkt->u.stats.flag & STATS_REPLY_FLG_HT40_MODE_MSK)));
1370#ifdef CONFIG_IWLEGACY_DEBUGFS
1371        il4965_accumulative_stats(il, (__le32 *) &pkt->u.stats);
1372#endif
1373
1374        /* TODO: reading some of stats is unneeded */
1375        memcpy(&il->_4965.stats, &pkt->u.stats, sizeof(il->_4965.stats));
1376
1377        set_bit(S_STATS, &il->status);
1378
1379        /*
1380         * Reschedule the stats timer to occur in recalib_seconds to ensure
1381         * we get a thermal update even if the uCode doesn't give us one
1382         */
1383        mod_timer(&il->stats_periodic,
1384                  jiffies + msecs_to_jiffies(recalib_seconds * 1000));
1385
1386        if (unlikely(!test_bit(S_SCANNING, &il->status)) &&
1387            (pkt->hdr.cmd == N_STATS)) {
1388                il4965_rx_calc_noise(il);
1389                queue_work(il->workqueue, &il->run_time_calib_work);
1390        }
1391
1392        if (change)
1393                il4965_temperature_calib(il);
1394}
1395
1396static void
1397il4965_hdl_c_stats(struct il_priv *il, struct il_rx_buf *rxb)
1398{
1399        struct il_rx_pkt *pkt = rxb_addr(rxb);
1400
1401        if (le32_to_cpu(pkt->u.stats.flag) & UCODE_STATS_CLEAR_MSK) {
1402#ifdef CONFIG_IWLEGACY_DEBUGFS
1403                memset(&il->_4965.accum_stats, 0,
1404                       sizeof(struct il_notif_stats));
1405                memset(&il->_4965.delta_stats, 0,
1406                       sizeof(struct il_notif_stats));
1407                memset(&il->_4965.max_delta, 0, sizeof(struct il_notif_stats));
1408#endif
1409                D_RX("Statistics have been cleared\n");
1410        }
1411        il4965_hdl_stats(il, rxb);
1412}
1413
1414
1415/*
1416 * mac80211 queues, ACs, hardware queues, FIFOs.
1417 *
1418 * Cf. https://wireless.wiki.kernel.org/en/developers/Documentation/mac80211/queues
1419 *
1420 * Mac80211 uses the following numbers, which we get as from it
1421 * by way of skb_get_queue_mapping(skb):
1422 *
1423 *     VO      0
1424 *     VI      1
1425 *     BE      2
1426 *     BK      3
1427 *
1428 *
1429 * Regular (not A-MPDU) frames are put into hardware queues corresponding
1430 * to the FIFOs, see comments in iwl-prph.h. Aggregated frames get their
1431 * own queue per aggregation session (RA/TID combination), such queues are
1432 * set up to map into FIFOs too, for which we need an AC->FIFO mapping. In
1433 * order to map frames to the right queue, we also need an AC->hw queue
1434 * mapping. This is implemented here.
1435 *
1436 * Due to the way hw queues are set up (by the hw specific modules like
1437 * 4965.c), the AC->hw queue mapping is the identity
1438 * mapping.
1439 */
1440
1441static const u8 tid_to_ac[] = {
1442        IEEE80211_AC_BE,
1443        IEEE80211_AC_BK,
1444        IEEE80211_AC_BK,
1445        IEEE80211_AC_BE,
1446        IEEE80211_AC_VI,
1447        IEEE80211_AC_VI,
1448        IEEE80211_AC_VO,
1449        IEEE80211_AC_VO
1450};
1451
1452static inline int
1453il4965_get_ac_from_tid(u16 tid)
1454{
1455        if (likely(tid < ARRAY_SIZE(tid_to_ac)))
1456                return tid_to_ac[tid];
1457
1458        /* no support for TIDs 8-15 yet */
1459        return -EINVAL;
1460}
1461
1462static inline int
1463il4965_get_fifo_from_tid(u16 tid)
1464{
1465        static const u8 ac_to_fifo[] = {
1466                IL_TX_FIFO_VO,
1467                IL_TX_FIFO_VI,
1468                IL_TX_FIFO_BE,
1469                IL_TX_FIFO_BK,
1470        };
1471
1472        if (likely(tid < ARRAY_SIZE(tid_to_ac)))
1473                return ac_to_fifo[tid_to_ac[tid]];
1474
1475        /* no support for TIDs 8-15 yet */
1476        return -EINVAL;
1477}
1478
1479/*
1480 * handle build C_TX command notification.
1481 */
1482static void
1483il4965_tx_cmd_build_basic(struct il_priv *il, struct sk_buff *skb,
1484                          struct il_tx_cmd *tx_cmd,
1485                          struct ieee80211_tx_info *info,
1486                          struct ieee80211_hdr *hdr, u8 std_id)
1487{
1488        __le16 fc = hdr->frame_control;
1489        __le32 tx_flags = tx_cmd->tx_flags;
1490
1491        tx_cmd->stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
1492        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
1493                tx_flags |= TX_CMD_FLG_ACK_MSK;
1494                if (ieee80211_is_mgmt(fc))
1495                        tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
1496                if (ieee80211_is_probe_resp(fc) &&
1497                    !(le16_to_cpu(hdr->seq_ctrl) & 0xf))
1498                        tx_flags |= TX_CMD_FLG_TSF_MSK;
1499        } else {
1500                tx_flags &= (~TX_CMD_FLG_ACK_MSK);
1501                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
1502        }
1503
1504        if (ieee80211_is_back_req(fc))
1505                tx_flags |= TX_CMD_FLG_ACK_MSK | TX_CMD_FLG_IMM_BA_RSP_MASK;
1506
1507        tx_cmd->sta_id = std_id;
1508        if (ieee80211_has_morefrags(fc))
1509                tx_flags |= TX_CMD_FLG_MORE_FRAG_MSK;
1510
1511        if (ieee80211_is_data_qos(fc)) {
1512                u8 *qc = ieee80211_get_qos_ctl(hdr);
1513                tx_cmd->tid_tspec = qc[0] & 0xf;
1514                tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
1515        } else {
1516                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
1517        }
1518
1519        il_tx_cmd_protection(il, info, fc, &tx_flags);
1520
1521        tx_flags &= ~(TX_CMD_FLG_ANT_SEL_MSK);
1522        if (ieee80211_is_mgmt(fc)) {
1523                if (ieee80211_is_assoc_req(fc) || ieee80211_is_reassoc_req(fc))
1524                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(3);
1525                else
1526                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(2);
1527        } else {
1528                tx_cmd->timeout.pm_frame_timeout = 0;
1529        }
1530
1531        tx_cmd->driver_txop = 0;
1532        tx_cmd->tx_flags = tx_flags;
1533        tx_cmd->next_frame_len = 0;
1534}
1535
1536static void
1537il4965_tx_cmd_build_rate(struct il_priv *il,
1538                         struct il_tx_cmd *tx_cmd,
1539                         struct ieee80211_tx_info *info,
1540                         struct ieee80211_sta *sta,
1541                         __le16 fc)
1542{
1543        const u8 rts_retry_limit = 60;
1544        u32 rate_flags;
1545        int rate_idx;
1546        u8 data_retry_limit;
1547        u8 rate_plcp;
1548
1549        /* Set retry limit on DATA packets and Probe Responses */
1550        if (ieee80211_is_probe_resp(fc))
1551                data_retry_limit = 3;
1552        else
1553                data_retry_limit = IL4965_DEFAULT_TX_RETRY;
1554        tx_cmd->data_retry_limit = data_retry_limit;
1555        /* Set retry limit on RTS packets */
1556        tx_cmd->rts_retry_limit = min(data_retry_limit, rts_retry_limit);
1557
1558        /* DATA packets will use the uCode station table for rate/antenna
1559         * selection */
1560        if (ieee80211_is_data(fc)) {
1561                tx_cmd->initial_rate_idx = 0;
1562                tx_cmd->tx_flags |= TX_CMD_FLG_STA_RATE_MSK;
1563                return;
1564        }
1565
1566        /**
1567         * If the current TX rate stored in mac80211 has the MCS bit set, it's
1568         * not really a TX rate.  Thus, we use the lowest supported rate for
1569         * this band.  Also use the lowest supported rate if the stored rate
1570         * idx is invalid.
1571         */
1572        rate_idx = info->control.rates[0].idx;
1573        if ((info->control.rates[0].flags & IEEE80211_TX_RC_MCS) || rate_idx < 0
1574            || rate_idx > RATE_COUNT_LEGACY)
1575                rate_idx = rate_lowest_index(&il->bands[info->band], sta);
1576        /* For 5 GHZ band, remap mac80211 rate indices into driver indices */
1577        if (info->band == NL80211_BAND_5GHZ)
1578                rate_idx += IL_FIRST_OFDM_RATE;
1579        /* Get PLCP rate for tx_cmd->rate_n_flags */
1580        rate_plcp = il_rates[rate_idx].plcp;
1581        /* Zero out flags for this packet */
1582        rate_flags = 0;
1583
1584        /* Set CCK flag as needed */
1585        if (rate_idx >= IL_FIRST_CCK_RATE && rate_idx <= IL_LAST_CCK_RATE)
1586                rate_flags |= RATE_MCS_CCK_MSK;
1587
1588        /* Set up antennas */
1589        il4965_toggle_tx_ant(il, &il->mgmt_tx_ant, il->hw_params.valid_tx_ant);
1590        rate_flags |= BIT(il->mgmt_tx_ant) << RATE_MCS_ANT_POS;
1591
1592        /* Set the rate in the TX cmd */
1593        tx_cmd->rate_n_flags = cpu_to_le32(rate_plcp | rate_flags);
1594}
1595
1596static void
1597il4965_tx_cmd_build_hwcrypto(struct il_priv *il, struct ieee80211_tx_info *info,
1598                             struct il_tx_cmd *tx_cmd, struct sk_buff *skb_frag,
1599                             int sta_id)
1600{
1601        struct ieee80211_key_conf *keyconf = info->control.hw_key;
1602
1603        switch (keyconf->cipher) {
1604        case WLAN_CIPHER_SUITE_CCMP:
1605                tx_cmd->sec_ctl = TX_CMD_SEC_CCM;
1606                memcpy(tx_cmd->key, keyconf->key, keyconf->keylen);
1607                if (info->flags & IEEE80211_TX_CTL_AMPDU)
1608                        tx_cmd->tx_flags |= TX_CMD_FLG_AGG_CCMP_MSK;
1609                D_TX("tx_cmd with AES hwcrypto\n");
1610                break;
1611
1612        case WLAN_CIPHER_SUITE_TKIP:
1613                tx_cmd->sec_ctl = TX_CMD_SEC_TKIP;
1614                ieee80211_get_tkip_p2k(keyconf, skb_frag, tx_cmd->key);
1615                D_TX("tx_cmd with tkip hwcrypto\n");
1616                break;
1617
1618        case WLAN_CIPHER_SUITE_WEP104:
1619                tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
1620                fallthrough;
1621        case WLAN_CIPHER_SUITE_WEP40:
1622                tx_cmd->sec_ctl |=
1623                    (TX_CMD_SEC_WEP | (keyconf->keyidx & TX_CMD_SEC_MSK) <<
1624                     TX_CMD_SEC_SHIFT);
1625
1626                memcpy(&tx_cmd->key[3], keyconf->key, keyconf->keylen);
1627
1628                D_TX("Configuring packet for WEP encryption " "with key %d\n",
1629                     keyconf->keyidx);
1630                break;
1631
1632        default:
1633                IL_ERR("Unknown encode cipher %x\n", keyconf->cipher);
1634                break;
1635        }
1636}
1637
1638/*
1639 * start C_TX command process
1640 */
1641int
1642il4965_tx_skb(struct il_priv *il,
1643              struct ieee80211_sta *sta,
1644              struct sk_buff *skb)
1645{
1646        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1647        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1648        struct il_station_priv *sta_priv = NULL;
1649        struct il_tx_queue *txq;
1650        struct il_queue *q;
1651        struct il_device_cmd *out_cmd;
1652        struct il_cmd_meta *out_meta;
1653        struct il_tx_cmd *tx_cmd;
1654        int txq_id;
1655        dma_addr_t phys_addr;
1656        dma_addr_t txcmd_phys;
1657        dma_addr_t scratch_phys;
1658        u16 len, firstlen, secondlen;
1659        u16 seq_number = 0;
1660        __le16 fc;
1661        u8 hdr_len;
1662        u8 sta_id;
1663        u8 wait_write_ptr = 0;
1664        u8 tid = 0;
1665        u8 *qc = NULL;
1666        unsigned long flags;
1667        bool is_agg = false;
1668
1669        spin_lock_irqsave(&il->lock, flags);
1670        if (il_is_rfkill(il)) {
1671                D_DROP("Dropping - RF KILL\n");
1672                goto drop_unlock;
1673        }
1674
1675        fc = hdr->frame_control;
1676
1677#ifdef CONFIG_IWLEGACY_DEBUG
1678        if (ieee80211_is_auth(fc))
1679                D_TX("Sending AUTH frame\n");
1680        else if (ieee80211_is_assoc_req(fc))
1681                D_TX("Sending ASSOC frame\n");
1682        else if (ieee80211_is_reassoc_req(fc))
1683                D_TX("Sending REASSOC frame\n");
1684#endif
1685
1686        hdr_len = ieee80211_hdrlen(fc);
1687
1688        /* For management frames use broadcast id to do not break aggregation */
1689        if (!ieee80211_is_data(fc))
1690                sta_id = il->hw_params.bcast_id;
1691        else {
1692                /* Find idx into station table for destination station */
1693                sta_id = il_sta_id_or_broadcast(il, sta);
1694
1695                if (sta_id == IL_INVALID_STATION) {
1696                        D_DROP("Dropping - INVALID STATION: %pM\n", hdr->addr1);
1697                        goto drop_unlock;
1698                }
1699        }
1700
1701        D_TX("station Id %d\n", sta_id);
1702
1703        if (sta)
1704                sta_priv = (void *)sta->drv_priv;
1705
1706        if (sta_priv && sta_priv->asleep &&
1707            (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER)) {
1708                /*
1709                 * This sends an asynchronous command to the device,
1710                 * but we can rely on it being processed before the
1711                 * next frame is processed -- and the next frame to
1712                 * this station is the one that will consume this
1713                 * counter.
1714                 * For now set the counter to just 1 since we do not
1715                 * support uAPSD yet.
1716                 */
1717                il4965_sta_modify_sleep_tx_count(il, sta_id, 1);
1718        }
1719
1720        /* FIXME: remove me ? */
1721        WARN_ON_ONCE(info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM);
1722
1723        /* Access category (AC) is also the queue number */
1724        txq_id = skb_get_queue_mapping(skb);
1725
1726        /* irqs already disabled/saved above when locking il->lock */
1727        spin_lock(&il->sta_lock);
1728
1729        if (ieee80211_is_data_qos(fc)) {
1730                qc = ieee80211_get_qos_ctl(hdr);
1731                tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
1732                if (WARN_ON_ONCE(tid >= MAX_TID_COUNT)) {
1733                        spin_unlock(&il->sta_lock);
1734                        goto drop_unlock;
1735                }
1736                seq_number = il->stations[sta_id].tid[tid].seq_number;
1737                seq_number &= IEEE80211_SCTL_SEQ;
1738                hdr->seq_ctrl =
1739                    hdr->seq_ctrl & cpu_to_le16(IEEE80211_SCTL_FRAG);
1740                hdr->seq_ctrl |= cpu_to_le16(seq_number);
1741                seq_number += 0x10;
1742                /* aggregation is on for this <sta,tid> */
1743                if (info->flags & IEEE80211_TX_CTL_AMPDU &&
1744                    il->stations[sta_id].tid[tid].agg.state == IL_AGG_ON) {
1745                        txq_id = il->stations[sta_id].tid[tid].agg.txq_id;
1746                        is_agg = true;
1747                }
1748        }
1749
1750        txq = &il->txq[txq_id];
1751        q = &txq->q;
1752
1753        if (unlikely(il_queue_space(q) < q->high_mark)) {
1754                spin_unlock(&il->sta_lock);
1755                goto drop_unlock;
1756        }
1757
1758        if (ieee80211_is_data_qos(fc)) {
1759                il->stations[sta_id].tid[tid].tfds_in_queue++;
1760                if (!ieee80211_has_morefrags(fc))
1761                        il->stations[sta_id].tid[tid].seq_number = seq_number;
1762        }
1763
1764        spin_unlock(&il->sta_lock);
1765
1766        txq->skbs[q->write_ptr] = skb;
1767
1768        /* Set up first empty entry in queue's array of Tx/cmd buffers */
1769        out_cmd = txq->cmd[q->write_ptr];
1770        out_meta = &txq->meta[q->write_ptr];
1771        tx_cmd = &out_cmd->cmd.tx;
1772        memset(&out_cmd->hdr, 0, sizeof(out_cmd->hdr));
1773        memset(tx_cmd, 0, sizeof(struct il_tx_cmd));
1774
1775        /*
1776         * Set up the Tx-command (not MAC!) header.
1777         * Store the chosen Tx queue and TFD idx within the sequence field;
1778         * after Tx, uCode's Tx response will return this value so driver can
1779         * locate the frame within the tx queue and do post-tx processing.
1780         */
1781        out_cmd->hdr.cmd = C_TX;
1782        out_cmd->hdr.sequence =
1783            cpu_to_le16((u16)
1784                        (QUEUE_TO_SEQ(txq_id) | IDX_TO_SEQ(q->write_ptr)));
1785
1786        /* Copy MAC header from skb into command buffer */
1787        memcpy(tx_cmd->hdr, hdr, hdr_len);
1788
1789        /* Total # bytes to be transmitted */
1790        tx_cmd->len = cpu_to_le16((u16) skb->len);
1791
1792        if (info->control.hw_key)
1793                il4965_tx_cmd_build_hwcrypto(il, info, tx_cmd, skb, sta_id);
1794
1795        /* TODO need this for burst mode later on */
1796        il4965_tx_cmd_build_basic(il, skb, tx_cmd, info, hdr, sta_id);
1797
1798        il4965_tx_cmd_build_rate(il, tx_cmd, info, sta, fc);
1799
1800        /*
1801         * Use the first empty entry in this queue's command buffer array
1802         * to contain the Tx command and MAC header concatenated together
1803         * (payload data will be in another buffer).
1804         * Size of this varies, due to varying MAC header length.
1805         * If end is not dword aligned, we'll have 2 extra bytes at the end
1806         * of the MAC header (device reads on dword boundaries).
1807         * We'll tell device about this padding later.
1808         */
1809        len = sizeof(struct il_tx_cmd) + sizeof(struct il_cmd_header) + hdr_len;
1810        firstlen = (len + 3) & ~3;
1811
1812        /* Tell NIC about any 2-byte padding after MAC header */
1813        if (firstlen != len)
1814                tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
1815
1816        /* Physical address of this Tx command's header (not MAC header!),
1817         * within command buffer array. */
1818        txcmd_phys =
1819            pci_map_single(il->pci_dev, &out_cmd->hdr, firstlen,
1820                           PCI_DMA_BIDIRECTIONAL);
1821        if (unlikely(pci_dma_mapping_error(il->pci_dev, txcmd_phys)))
1822                goto drop_unlock;
1823
1824        /* Set up TFD's 2nd entry to point directly to remainder of skb,
1825         * if any (802.11 null frames have no payload). */
1826        secondlen = skb->len - hdr_len;
1827        if (secondlen > 0) {
1828                phys_addr =
1829                    pci_map_single(il->pci_dev, skb->data + hdr_len, secondlen,
1830                                   PCI_DMA_TODEVICE);
1831                if (unlikely(pci_dma_mapping_error(il->pci_dev, phys_addr)))
1832                        goto drop_unlock;
1833        }
1834
1835        /* Add buffer containing Tx command and MAC(!) header to TFD's
1836         * first entry */
1837        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, firstlen, 1, 0);
1838        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
1839        dma_unmap_len_set(out_meta, len, firstlen);
1840        if (secondlen)
1841                il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, secondlen,
1842                                               0, 0);
1843
1844        if (!ieee80211_has_morefrags(hdr->frame_control)) {
1845                txq->need_update = 1;
1846        } else {
1847                wait_write_ptr = 1;
1848                txq->need_update = 0;
1849        }
1850
1851        scratch_phys =
1852            txcmd_phys + sizeof(struct il_cmd_header) +
1853            offsetof(struct il_tx_cmd, scratch);
1854
1855        /* take back ownership of DMA buffer to enable update */
1856        pci_dma_sync_single_for_cpu(il->pci_dev, txcmd_phys, firstlen,
1857                                    PCI_DMA_BIDIRECTIONAL);
1858        tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
1859        tx_cmd->dram_msb_ptr = il_get_dma_hi_addr(scratch_phys);
1860
1861        il_update_stats(il, true, fc, skb->len);
1862
1863        D_TX("sequence nr = 0X%x\n", le16_to_cpu(out_cmd->hdr.sequence));
1864        D_TX("tx_flags = 0X%x\n", le32_to_cpu(tx_cmd->tx_flags));
1865        il_print_hex_dump(il, IL_DL_TX, (u8 *) tx_cmd, sizeof(*tx_cmd));
1866        il_print_hex_dump(il, IL_DL_TX, (u8 *) tx_cmd->hdr, hdr_len);
1867
1868        /* Set up entry for this TFD in Tx byte-count array */
1869        if (info->flags & IEEE80211_TX_CTL_AMPDU)
1870                il->ops->txq_update_byte_cnt_tbl(il, txq, le16_to_cpu(tx_cmd->len));
1871
1872        pci_dma_sync_single_for_device(il->pci_dev, txcmd_phys, firstlen,
1873                                       PCI_DMA_BIDIRECTIONAL);
1874
1875        /* Tell device the write idx *just past* this latest filled TFD */
1876        q->write_ptr = il_queue_inc_wrap(q->write_ptr, q->n_bd);
1877        il_txq_update_write_ptr(il, txq);
1878        spin_unlock_irqrestore(&il->lock, flags);
1879
1880        /*
1881         * At this point the frame is "transmitted" successfully
1882         * and we will get a TX status notification eventually,
1883         * regardless of the value of ret. "ret" only indicates
1884         * whether or not we should update the write pointer.
1885         */
1886
1887        /*
1888         * Avoid atomic ops if it isn't an associated client.
1889         * Also, if this is a packet for aggregation, don't
1890         * increase the counter because the ucode will stop
1891         * aggregation queues when their respective station
1892         * goes to sleep.
1893         */
1894        if (sta_priv && sta_priv->client && !is_agg)
1895                atomic_inc(&sta_priv->pending_frames);
1896
1897        if (il_queue_space(q) < q->high_mark && il->mac80211_registered) {
1898                if (wait_write_ptr) {
1899                        spin_lock_irqsave(&il->lock, flags);
1900                        txq->need_update = 1;
1901                        il_txq_update_write_ptr(il, txq);
1902                        spin_unlock_irqrestore(&il->lock, flags);
1903                } else {
1904                        il_stop_queue(il, txq);
1905                }
1906        }
1907
1908        return 0;
1909
1910drop_unlock:
1911        spin_unlock_irqrestore(&il->lock, flags);
1912        return -1;
1913}
1914
1915static inline int
1916il4965_alloc_dma_ptr(struct il_priv *il, struct il_dma_ptr *ptr, size_t size)
1917{
1918        ptr->addr = dma_alloc_coherent(&il->pci_dev->dev, size, &ptr->dma,
1919                                       GFP_KERNEL);
1920        if (!ptr->addr)
1921                return -ENOMEM;
1922        ptr->size = size;
1923        return 0;
1924}
1925
1926static inline void
1927il4965_free_dma_ptr(struct il_priv *il, struct il_dma_ptr *ptr)
1928{
1929        if (unlikely(!ptr->addr))
1930                return;
1931
1932        dma_free_coherent(&il->pci_dev->dev, ptr->size, ptr->addr, ptr->dma);
1933        memset(ptr, 0, sizeof(*ptr));
1934}
1935
1936/*
1937 * il4965_hw_txq_ctx_free - Free TXQ Context
1938 *
1939 * Destroy all TX DMA queues and structures
1940 */
1941void
1942il4965_hw_txq_ctx_free(struct il_priv *il)
1943{
1944        int txq_id;
1945
1946        /* Tx queues */
1947        if (il->txq) {
1948                for (txq_id = 0; txq_id < il->hw_params.max_txq_num; txq_id++)
1949                        if (txq_id == il->cmd_queue)
1950                                il_cmd_queue_free(il);
1951                        else
1952                                il_tx_queue_free(il, txq_id);
1953        }
1954        il4965_free_dma_ptr(il, &il->kw);
1955
1956        il4965_free_dma_ptr(il, &il->scd_bc_tbls);
1957
1958        /* free tx queue structure */
1959        il_free_txq_mem(il);
1960}
1961
1962/*
1963 * il4965_txq_ctx_alloc - allocate TX queue context
1964 * Allocate all Tx DMA structures and initialize them
1965 */
1966int
1967il4965_txq_ctx_alloc(struct il_priv *il)
1968{
1969        int ret, txq_id;
1970        unsigned long flags;
1971
1972        /* Free all tx/cmd queues and keep-warm buffer */
1973        il4965_hw_txq_ctx_free(il);
1974
1975        ret =
1976            il4965_alloc_dma_ptr(il, &il->scd_bc_tbls,
1977                                 il->hw_params.scd_bc_tbls_size);
1978        if (ret) {
1979                IL_ERR("Scheduler BC Table allocation failed\n");
1980                goto error_bc_tbls;
1981        }
1982        /* Alloc keep-warm buffer */
1983        ret = il4965_alloc_dma_ptr(il, &il->kw, IL_KW_SIZE);
1984        if (ret) {
1985                IL_ERR("Keep Warm allocation failed\n");
1986                goto error_kw;
1987        }
1988
1989        /* allocate tx queue structure */
1990        ret = il_alloc_txq_mem(il);
1991        if (ret)
1992                goto error;
1993
1994        spin_lock_irqsave(&il->lock, flags);
1995
1996        /* Turn off all Tx DMA fifos */
1997        il4965_txq_set_sched(il, 0);
1998
1999        /* Tell NIC where to find the "keep warm" buffer */
2000        il_wr(il, FH49_KW_MEM_ADDR_REG, il->kw.dma >> 4);
2001
2002        spin_unlock_irqrestore(&il->lock, flags);
2003
2004        /* Alloc and init all Tx queues, including the command queue (#4/#9) */
2005        for (txq_id = 0; txq_id < il->hw_params.max_txq_num; txq_id++) {
2006                ret = il_tx_queue_init(il, txq_id);
2007                if (ret) {
2008                        IL_ERR("Tx %d queue init failed\n", txq_id);
2009                        goto error;
2010                }
2011        }
2012
2013        return ret;
2014
2015error:
2016        il4965_hw_txq_ctx_free(il);
2017        il4965_free_dma_ptr(il, &il->kw);
2018error_kw:
2019        il4965_free_dma_ptr(il, &il->scd_bc_tbls);
2020error_bc_tbls:
2021        return ret;
2022}
2023
2024void
2025il4965_txq_ctx_reset(struct il_priv *il)
2026{
2027        int txq_id;
2028        unsigned long flags;
2029
2030        spin_lock_irqsave(&il->lock, flags);
2031
2032        /* Turn off all Tx DMA fifos */
2033        il4965_txq_set_sched(il, 0);
2034        /* Tell NIC where to find the "keep warm" buffer */
2035        il_wr(il, FH49_KW_MEM_ADDR_REG, il->kw.dma >> 4);
2036
2037        spin_unlock_irqrestore(&il->lock, flags);
2038
2039        /* Alloc and init all Tx queues, including the command queue (#4) */
2040        for (txq_id = 0; txq_id < il->hw_params.max_txq_num; txq_id++)
2041                il_tx_queue_reset(il, txq_id);
2042}
2043
2044static void
2045il4965_txq_ctx_unmap(struct il_priv *il)
2046{
2047        int txq_id;
2048
2049        if (!il->txq)
2050                return;
2051
2052        /* Unmap DMA from host system and free skb's */
2053        for (txq_id = 0; txq_id < il->hw_params.max_txq_num; txq_id++)
2054                if (txq_id == il->cmd_queue)
2055                        il_cmd_queue_unmap(il);
2056                else
2057                        il_tx_queue_unmap(il, txq_id);
2058}
2059
2060/*
2061 * il4965_txq_ctx_stop - Stop all Tx DMA channels
2062 */
2063void
2064il4965_txq_ctx_stop(struct il_priv *il)
2065{
2066        int ch, ret;
2067
2068        _il_wr_prph(il, IL49_SCD_TXFACT, 0);
2069
2070        /* Stop each Tx DMA channel, and wait for it to be idle */
2071        for (ch = 0; ch < il->hw_params.dma_chnl_num; ch++) {
2072                _il_wr(il, FH49_TCSR_CHNL_TX_CONFIG_REG(ch), 0x0);
2073                ret =
2074                    _il_poll_bit(il, FH49_TSSR_TX_STATUS_REG,
2075                                 FH49_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch),
2076                                 FH49_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch),
2077                                 1000);
2078                if (ret < 0)
2079                        IL_ERR("Timeout stopping DMA channel %d [0x%08x]",
2080                               ch, _il_rd(il, FH49_TSSR_TX_STATUS_REG));
2081        }
2082}
2083
2084/*
2085 * Find first available (lowest unused) Tx Queue, mark it "active".
2086 * Called only when finding queue for aggregation.
2087 * Should never return anything < 7, because they should already
2088 * be in use as EDCA AC (0-3), Command (4), reserved (5, 6)
2089 */
2090static int
2091il4965_txq_ctx_activate_free(struct il_priv *il)
2092{
2093        int txq_id;
2094
2095        for (txq_id = 0; txq_id < il->hw_params.max_txq_num; txq_id++)
2096                if (!test_and_set_bit(txq_id, &il->txq_ctx_active_msk))
2097                        return txq_id;
2098        return -1;
2099}
2100
2101/*
2102 * il4965_tx_queue_stop_scheduler - Stop queue, but keep configuration
2103 */
2104static void
2105il4965_tx_queue_stop_scheduler(struct il_priv *il, u16 txq_id)
2106{
2107        /* Simply stop the queue, but don't change any configuration;
2108         * the SCD_ACT_EN bit is the write-enable mask for the ACTIVE bit. */
2109        il_wr_prph(il, IL49_SCD_QUEUE_STATUS_BITS(txq_id),
2110                   (0 << IL49_SCD_QUEUE_STTS_REG_POS_ACTIVE) |
2111                   (1 << IL49_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
2112}
2113
2114/*
2115 * il4965_tx_queue_set_q2ratid - Map unique receiver/tid combination to a queue
2116 */
2117static int
2118il4965_tx_queue_set_q2ratid(struct il_priv *il, u16 ra_tid, u16 txq_id)
2119{
2120        u32 tbl_dw_addr;
2121        u32 tbl_dw;
2122        u16 scd_q2ratid;
2123
2124        scd_q2ratid = ra_tid & IL_SCD_QUEUE_RA_TID_MAP_RATID_MSK;
2125
2126        tbl_dw_addr =
2127            il->scd_base_addr + IL49_SCD_TRANSLATE_TBL_OFFSET_QUEUE(txq_id);
2128
2129        tbl_dw = il_read_targ_mem(il, tbl_dw_addr);
2130
2131        if (txq_id & 0x1)
2132                tbl_dw = (scd_q2ratid << 16) | (tbl_dw & 0x0000FFFF);
2133        else
2134                tbl_dw = scd_q2ratid | (tbl_dw & 0xFFFF0000);
2135
2136        il_write_targ_mem(il, tbl_dw_addr, tbl_dw);
2137
2138        return 0;
2139}
2140
2141/*
2142 * il4965_tx_queue_agg_enable - Set up & enable aggregation for selected queue
2143 *
2144 * NOTE:  txq_id must be greater than IL49_FIRST_AMPDU_QUEUE,
2145 *        i.e. it must be one of the higher queues used for aggregation
2146 */
2147static int
2148il4965_txq_agg_enable(struct il_priv *il, int txq_id, int tx_fifo, int sta_id,
2149                      int tid, u16 ssn_idx)
2150{
2151        unsigned long flags;
2152        u16 ra_tid;
2153        int ret;
2154
2155        if ((IL49_FIRST_AMPDU_QUEUE > txq_id) ||
2156            (IL49_FIRST_AMPDU_QUEUE +
2157             il->cfg->num_of_ampdu_queues <= txq_id)) {
2158                IL_WARN("queue number out of range: %d, must be %d to %d\n",
2159                        txq_id, IL49_FIRST_AMPDU_QUEUE,
2160                        IL49_FIRST_AMPDU_QUEUE +
2161                        il->cfg->num_of_ampdu_queues - 1);
2162                return -EINVAL;
2163        }
2164
2165        ra_tid = BUILD_RAxTID(sta_id, tid);
2166
2167        /* Modify device's station table to Tx this TID */
2168        ret = il4965_sta_tx_modify_enable_tid(il, sta_id, tid);
2169        if (ret)
2170                return ret;
2171
2172        spin_lock_irqsave(&il->lock, flags);
2173
2174        /* Stop this Tx queue before configuring it */
2175        il4965_tx_queue_stop_scheduler(il, txq_id);
2176
2177        /* Map receiver-address / traffic-ID to this queue */
2178        il4965_tx_queue_set_q2ratid(il, ra_tid, txq_id);
2179
2180        /* Set this queue as a chain-building queue */
2181        il_set_bits_prph(il, IL49_SCD_QUEUECHAIN_SEL, (1 << txq_id));
2182
2183        /* Place first TFD at idx corresponding to start sequence number.
2184         * Assumes that ssn_idx is valid (!= 0xFFF) */
2185        il->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
2186        il->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
2187        il4965_set_wr_ptrs(il, txq_id, ssn_idx);
2188
2189        /* Set up Tx win size and frame limit for this queue */
2190        il_write_targ_mem(il,
2191                          il->scd_base_addr +
2192                          IL49_SCD_CONTEXT_QUEUE_OFFSET(txq_id),
2193                          (SCD_WIN_SIZE << IL49_SCD_QUEUE_CTX_REG1_WIN_SIZE_POS)
2194                          & IL49_SCD_QUEUE_CTX_REG1_WIN_SIZE_MSK);
2195
2196        il_write_targ_mem(il,
2197                          il->scd_base_addr +
2198                          IL49_SCD_CONTEXT_QUEUE_OFFSET(txq_id) + sizeof(u32),
2199                          (SCD_FRAME_LIMIT <<
2200                           IL49_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
2201                          IL49_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK);
2202
2203        il_set_bits_prph(il, IL49_SCD_INTERRUPT_MASK, (1 << txq_id));
2204
2205        /* Set up Status area in SRAM, map to Tx DMA/FIFO, activate the queue */
2206        il4965_tx_queue_set_status(il, &il->txq[txq_id], tx_fifo, 1);
2207
2208        spin_unlock_irqrestore(&il->lock, flags);
2209
2210        return 0;
2211}
2212
2213int
2214il4965_tx_agg_start(struct il_priv *il, struct ieee80211_vif *vif,
2215                    struct ieee80211_sta *sta, u16 tid, u16 * ssn)
2216{
2217        int sta_id;
2218        int tx_fifo;
2219        int txq_id;
2220        int ret;
2221        unsigned long flags;
2222        struct il_tid_data *tid_data;
2223
2224        /* FIXME: warning if tx fifo not found ? */
2225        tx_fifo = il4965_get_fifo_from_tid(tid);
2226        if (unlikely(tx_fifo < 0))
2227                return tx_fifo;
2228
2229        D_HT("%s on ra = %pM tid = %d\n", __func__, sta->addr, tid);
2230
2231        sta_id = il_sta_id(sta);
2232        if (sta_id == IL_INVALID_STATION) {
2233                IL_ERR("Start AGG on invalid station\n");
2234                return -ENXIO;
2235        }
2236        if (unlikely(tid >= MAX_TID_COUNT))
2237                return -EINVAL;
2238
2239        if (il->stations[sta_id].tid[tid].agg.state != IL_AGG_OFF) {
2240                IL_ERR("Start AGG when state is not IL_AGG_OFF !\n");
2241                return -ENXIO;
2242        }
2243
2244        txq_id = il4965_txq_ctx_activate_free(il);
2245        if (txq_id == -1) {
2246                IL_ERR("No free aggregation queue available\n");
2247                return -ENXIO;
2248        }
2249
2250        spin_lock_irqsave(&il->sta_lock, flags);
2251        tid_data = &il->stations[sta_id].tid[tid];
2252        *ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
2253        tid_data->agg.txq_id = txq_id;
2254        il_set_swq_id(&il->txq[txq_id], il4965_get_ac_from_tid(tid), txq_id);
2255        spin_unlock_irqrestore(&il->sta_lock, flags);
2256
2257        ret = il4965_txq_agg_enable(il, txq_id, tx_fifo, sta_id, tid, *ssn);
2258        if (ret)
2259                return ret;
2260
2261        spin_lock_irqsave(&il->sta_lock, flags);
2262        tid_data = &il->stations[sta_id].tid[tid];
2263        if (tid_data->tfds_in_queue == 0) {
2264                D_HT("HW queue is empty\n");
2265                tid_data->agg.state = IL_AGG_ON;
2266                ret = IEEE80211_AMPDU_TX_START_IMMEDIATE;
2267        } else {
2268                D_HT("HW queue is NOT empty: %d packets in HW queue\n",
2269                     tid_data->tfds_in_queue);
2270                tid_data->agg.state = IL_EMPTYING_HW_QUEUE_ADDBA;
2271        }
2272        spin_unlock_irqrestore(&il->sta_lock, flags);
2273        return ret;
2274}
2275
2276/*
2277 * txq_id must be greater than IL49_FIRST_AMPDU_QUEUE
2278 * il->lock must be held by the caller
2279 */
2280static int
2281il4965_txq_agg_disable(struct il_priv *il, u16 txq_id, u16 ssn_idx, u8 tx_fifo)
2282{
2283        if ((IL49_FIRST_AMPDU_QUEUE > txq_id) ||
2284            (IL49_FIRST_AMPDU_QUEUE +
2285             il->cfg->num_of_ampdu_queues <= txq_id)) {
2286                IL_WARN("queue number out of range: %d, must be %d to %d\n",
2287                        txq_id, IL49_FIRST_AMPDU_QUEUE,
2288                        IL49_FIRST_AMPDU_QUEUE +
2289                        il->cfg->num_of_ampdu_queues - 1);
2290                return -EINVAL;
2291        }
2292
2293        il4965_tx_queue_stop_scheduler(il, txq_id);
2294
2295        il_clear_bits_prph(il, IL49_SCD_QUEUECHAIN_SEL, (1 << txq_id));
2296
2297        il->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
2298        il->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
2299        /* supposes that ssn_idx is valid (!= 0xFFF) */
2300        il4965_set_wr_ptrs(il, txq_id, ssn_idx);
2301
2302        il_clear_bits_prph(il, IL49_SCD_INTERRUPT_MASK, (1 << txq_id));
2303        il_txq_ctx_deactivate(il, txq_id);
2304        il4965_tx_queue_set_status(il, &il->txq[txq_id], tx_fifo, 0);
2305
2306        return 0;
2307}
2308
2309int
2310il4965_tx_agg_stop(struct il_priv *il, struct ieee80211_vif *vif,
2311                   struct ieee80211_sta *sta, u16 tid)
2312{
2313        int tx_fifo_id, txq_id, sta_id, ssn;
2314        struct il_tid_data *tid_data;
2315        int write_ptr, read_ptr;
2316        unsigned long flags;
2317
2318        /* FIXME: warning if tx_fifo_id not found ? */
2319        tx_fifo_id = il4965_get_fifo_from_tid(tid);
2320        if (unlikely(tx_fifo_id < 0))
2321                return tx_fifo_id;
2322
2323        sta_id = il_sta_id(sta);
2324
2325        if (sta_id == IL_INVALID_STATION) {
2326                IL_ERR("Invalid station for AGG tid %d\n", tid);
2327                return -ENXIO;
2328        }
2329
2330        spin_lock_irqsave(&il->sta_lock, flags);
2331
2332        tid_data = &il->stations[sta_id].tid[tid];
2333        ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4;
2334        txq_id = tid_data->agg.txq_id;
2335
2336        switch (il->stations[sta_id].tid[tid].agg.state) {
2337        case IL_EMPTYING_HW_QUEUE_ADDBA:
2338                /*
2339                 * This can happen if the peer stops aggregation
2340                 * again before we've had a chance to drain the
2341                 * queue we selected previously, i.e. before the
2342                 * session was really started completely.
2343                 */
2344                D_HT("AGG stop before setup done\n");
2345                goto turn_off;
2346        case IL_AGG_ON:
2347                break;
2348        default:
2349                IL_WARN("Stopping AGG while state not ON or starting\n");
2350        }
2351
2352        write_ptr = il->txq[txq_id].q.write_ptr;
2353        read_ptr = il->txq[txq_id].q.read_ptr;
2354
2355        /* The queue is not empty */
2356        if (write_ptr != read_ptr) {
2357                D_HT("Stopping a non empty AGG HW QUEUE\n");
2358                il->stations[sta_id].tid[tid].agg.state =
2359                    IL_EMPTYING_HW_QUEUE_DELBA;
2360                spin_unlock_irqrestore(&il->sta_lock, flags);
2361                return 0;
2362        }
2363
2364        D_HT("HW queue is empty\n");
2365turn_off:
2366        il->stations[sta_id].tid[tid].agg.state = IL_AGG_OFF;
2367
2368        /* do not restore/save irqs */
2369        spin_unlock(&il->sta_lock);
2370        spin_lock(&il->lock);
2371
2372        /*
2373         * the only reason this call can fail is queue number out of range,
2374         * which can happen if uCode is reloaded and all the station
2375         * information are lost. if it is outside the range, there is no need
2376         * to deactivate the uCode queue, just return "success" to allow
2377         *  mac80211 to clean up it own data.
2378         */
2379        il4965_txq_agg_disable(il, txq_id, ssn, tx_fifo_id);
2380        spin_unlock_irqrestore(&il->lock, flags);
2381
2382        ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
2383
2384        return 0;
2385}
2386
2387int
2388il4965_txq_check_empty(struct il_priv *il, int sta_id, u8 tid, int txq_id)
2389{
2390        struct il_queue *q = &il->txq[txq_id].q;
2391        u8 *addr = il->stations[sta_id].sta.sta.addr;
2392        struct il_tid_data *tid_data = &il->stations[sta_id].tid[tid];
2393
2394        lockdep_assert_held(&il->sta_lock);
2395
2396        switch (il->stations[sta_id].tid[tid].agg.state) {
2397        case IL_EMPTYING_HW_QUEUE_DELBA:
2398                /* We are reclaiming the last packet of the */
2399                /* aggregated HW queue */
2400                if (txq_id == tid_data->agg.txq_id &&
2401                    q->read_ptr == q->write_ptr) {
2402                        u16 ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
2403                        int tx_fifo = il4965_get_fifo_from_tid(tid);
2404                        D_HT("HW queue empty: continue DELBA flow\n");
2405                        il4965_txq_agg_disable(il, txq_id, ssn, tx_fifo);
2406                        tid_data->agg.state = IL_AGG_OFF;
2407                        ieee80211_stop_tx_ba_cb_irqsafe(il->vif, addr, tid);
2408                }
2409                break;
2410        case IL_EMPTYING_HW_QUEUE_ADDBA:
2411                /* We are reclaiming the last packet of the queue */
2412                if (tid_data->tfds_in_queue == 0) {
2413                        D_HT("HW queue empty: continue ADDBA flow\n");
2414                        tid_data->agg.state = IL_AGG_ON;
2415                        ieee80211_start_tx_ba_cb_irqsafe(il->vif, addr, tid);
2416                }
2417                break;
2418        }
2419
2420        return 0;
2421}
2422
2423static void
2424il4965_non_agg_tx_status(struct il_priv *il, const u8 *addr1)
2425{
2426        struct ieee80211_sta *sta;
2427        struct il_station_priv *sta_priv;
2428
2429        rcu_read_lock();
2430        sta = ieee80211_find_sta(il->vif, addr1);
2431        if (sta) {
2432                sta_priv = (void *)sta->drv_priv;
2433                /* avoid atomic ops if this isn't a client */
2434                if (sta_priv->client &&
2435                    atomic_dec_return(&sta_priv->pending_frames) == 0)
2436                        ieee80211_sta_block_awake(il->hw, sta, false);
2437        }
2438        rcu_read_unlock();
2439}
2440
2441static void
2442il4965_tx_status(struct il_priv *il, struct sk_buff *skb, bool is_agg)
2443{
2444        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2445
2446        if (!is_agg)
2447                il4965_non_agg_tx_status(il, hdr->addr1);
2448
2449        ieee80211_tx_status_irqsafe(il->hw, skb);
2450}
2451
2452int
2453il4965_tx_queue_reclaim(struct il_priv *il, int txq_id, int idx)
2454{
2455        struct il_tx_queue *txq = &il->txq[txq_id];
2456        struct il_queue *q = &txq->q;
2457        int nfreed = 0;
2458        struct ieee80211_hdr *hdr;
2459        struct sk_buff *skb;
2460
2461        if (idx >= q->n_bd || il_queue_used(q, idx) == 0) {
2462                IL_ERR("Read idx for DMA queue txq id (%d), idx %d, "
2463                       "is out of range [0-%d] %d %d.\n", txq_id, idx, q->n_bd,
2464                       q->write_ptr, q->read_ptr);
2465                return 0;
2466        }
2467
2468        for (idx = il_queue_inc_wrap(idx, q->n_bd); q->read_ptr != idx;
2469             q->read_ptr = il_queue_inc_wrap(q->read_ptr, q->n_bd)) {
2470
2471                skb = txq->skbs[txq->q.read_ptr];
2472
2473                if (WARN_ON_ONCE(skb == NULL))
2474                        continue;
2475
2476                hdr = (struct ieee80211_hdr *) skb->data;
2477                if (ieee80211_is_data_qos(hdr->frame_control))
2478                        nfreed++;
2479
2480                il4965_tx_status(il, skb, txq_id >= IL4965_FIRST_AMPDU_QUEUE);
2481
2482                txq->skbs[txq->q.read_ptr] = NULL;
2483                il->ops->txq_free_tfd(il, txq);
2484        }
2485        return nfreed;
2486}
2487
2488/*
2489 * il4965_tx_status_reply_compressed_ba - Update tx status from block-ack
2490 *
2491 * Go through block-ack's bitmap of ACK'd frames, update driver's record of
2492 * ACK vs. not.  This gets sent to mac80211, then to rate scaling algo.
2493 */
2494static int
2495il4965_tx_status_reply_compressed_ba(struct il_priv *il, struct il_ht_agg *agg,
2496                                     struct il_compressed_ba_resp *ba_resp)
2497{
2498        int i, sh, ack;
2499        u16 seq_ctl = le16_to_cpu(ba_resp->seq_ctl);
2500        u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
2501        int successes = 0;
2502        struct ieee80211_tx_info *info;
2503        u64 bitmap, sent_bitmap;
2504
2505        if (unlikely(!agg->wait_for_ba)) {
2506                if (unlikely(ba_resp->bitmap))
2507                        IL_ERR("Received BA when not expected\n");
2508                return -EINVAL;
2509        }
2510
2511        /* Mark that the expected block-ack response arrived */
2512        agg->wait_for_ba = 0;
2513        D_TX_REPLY("BA %d %d\n", agg->start_idx, ba_resp->seq_ctl);
2514
2515        /* Calculate shift to align block-ack bits with our Tx win bits */
2516        sh = agg->start_idx - SEQ_TO_IDX(seq_ctl >> 4);
2517        if (sh < 0)             /* tbw something is wrong with indices */
2518                sh += 0x100;
2519
2520        if (agg->frame_count > (64 - sh)) {
2521                D_TX_REPLY("more frames than bitmap size");
2522                return -1;
2523        }
2524
2525        /* don't use 64-bit values for now */
2526        bitmap = le64_to_cpu(ba_resp->bitmap) >> sh;
2527
2528        /* check for success or failure according to the
2529         * transmitted bitmap and block-ack bitmap */
2530        sent_bitmap = bitmap & agg->bitmap;
2531
2532        /* For each frame attempted in aggregation,
2533         * update driver's record of tx frame's status. */
2534        i = 0;
2535        while (sent_bitmap) {
2536                ack = sent_bitmap & 1ULL;
2537                successes += ack;
2538                D_TX_REPLY("%s ON i=%d idx=%d raw=%d\n", ack ? "ACK" : "NACK",
2539                           i, (agg->start_idx + i) & 0xff, agg->start_idx + i);
2540                sent_bitmap >>= 1;
2541                ++i;
2542        }
2543
2544        D_TX_REPLY("Bitmap %llx\n", (unsigned long long)bitmap);
2545
2546        info = IEEE80211_SKB_CB(il->txq[scd_flow].skbs[agg->start_idx]);
2547        memset(&info->status, 0, sizeof(info->status));
2548        info->flags |= IEEE80211_TX_STAT_ACK;
2549        info->flags |= IEEE80211_TX_STAT_AMPDU;
2550        info->status.ampdu_ack_len = successes;
2551        info->status.ampdu_len = agg->frame_count;
2552        il4965_hwrate_to_tx_control(il, agg->rate_n_flags, info);
2553
2554        return 0;
2555}
2556
2557static inline bool
2558il4965_is_tx_success(u32 status)
2559{
2560        status &= TX_STATUS_MSK;
2561        return (status == TX_STATUS_SUCCESS || status == TX_STATUS_DIRECT_DONE);
2562}
2563
2564static u8
2565il4965_find_station(struct il_priv *il, const u8 *addr)
2566{
2567        int i;
2568        int start = 0;
2569        int ret = IL_INVALID_STATION;
2570        unsigned long flags;
2571
2572        if (il->iw_mode == NL80211_IFTYPE_ADHOC)
2573                start = IL_STA_ID;
2574
2575        if (is_broadcast_ether_addr(addr))
2576                return il->hw_params.bcast_id;
2577
2578        spin_lock_irqsave(&il->sta_lock, flags);
2579        for (i = start; i < il->hw_params.max_stations; i++)
2580                if (il->stations[i].used &&
2581                    ether_addr_equal(il->stations[i].sta.sta.addr, addr)) {
2582                        ret = i;
2583                        goto out;
2584                }
2585
2586        D_ASSOC("can not find STA %pM total %d\n", addr, il->num_stations);
2587
2588out:
2589        /*
2590         * It may be possible that more commands interacting with stations
2591         * arrive before we completed processing the adding of
2592         * station
2593         */
2594        if (ret != IL_INVALID_STATION &&
2595            (!(il->stations[ret].used & IL_STA_UCODE_ACTIVE) ||
2596              (il->stations[ret].used & IL_STA_UCODE_INPROGRESS))) {
2597                IL_ERR("Requested station info for sta %d before ready.\n",
2598                       ret);
2599                ret = IL_INVALID_STATION;
2600        }
2601        spin_unlock_irqrestore(&il->sta_lock, flags);
2602        return ret;
2603}
2604
2605static int
2606il4965_get_ra_sta_id(struct il_priv *il, struct ieee80211_hdr *hdr)
2607{
2608        if (il->iw_mode == NL80211_IFTYPE_STATION)
2609                return IL_AP_ID;
2610        else {
2611                u8 *da = ieee80211_get_DA(hdr);
2612
2613                return il4965_find_station(il, da);
2614        }
2615}
2616
2617static inline u32
2618il4965_get_scd_ssn(struct il4965_tx_resp *tx_resp)
2619{
2620        return le32_to_cpup(&tx_resp->u.status +
2621                            tx_resp->frame_count) & IEEE80211_MAX_SN;
2622}
2623
2624static inline u32
2625il4965_tx_status_to_mac80211(u32 status)
2626{
2627        status &= TX_STATUS_MSK;
2628
2629        switch (status) {
2630        case TX_STATUS_SUCCESS:
2631        case TX_STATUS_DIRECT_DONE:
2632                return IEEE80211_TX_STAT_ACK;
2633        case TX_STATUS_FAIL_DEST_PS:
2634                return IEEE80211_TX_STAT_TX_FILTERED;
2635        default:
2636                return 0;
2637        }
2638}
2639
2640/*
2641 * il4965_tx_status_reply_tx - Handle Tx response for frames in aggregation queue
2642 */
2643static int
2644il4965_tx_status_reply_tx(struct il_priv *il, struct il_ht_agg *agg,
2645                          struct il4965_tx_resp *tx_resp, int txq_id,
2646                          u16 start_idx)
2647{
2648        u16 status;
2649        struct agg_tx_status *frame_status = tx_resp->u.agg_status;
2650        struct ieee80211_tx_info *info = NULL;
2651        struct ieee80211_hdr *hdr = NULL;
2652        u32 rate_n_flags = le32_to_cpu(tx_resp->rate_n_flags);
2653        int i, sh, idx;
2654        u16 seq;
2655        if (agg->wait_for_ba)
2656                D_TX_REPLY("got tx response w/o block-ack\n");
2657
2658        agg->frame_count = tx_resp->frame_count;
2659        agg->start_idx = start_idx;
2660        agg->rate_n_flags = rate_n_flags;
2661        agg->bitmap = 0;
2662
2663        /* num frames attempted by Tx command */
2664        if (agg->frame_count == 1) {
2665                /* Only one frame was attempted; no block-ack will arrive */
2666                status = le16_to_cpu(frame_status[0].status);
2667                idx = start_idx;
2668
2669                D_TX_REPLY("FrameCnt = %d, StartIdx=%d idx=%d\n",
2670                           agg->frame_count, agg->start_idx, idx);
2671
2672                info = IEEE80211_SKB_CB(il->txq[txq_id].skbs[idx]);
2673                info->status.rates[0].count = tx_resp->failure_frame + 1;
2674                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
2675                info->flags |= il4965_tx_status_to_mac80211(status);
2676                il4965_hwrate_to_tx_control(il, rate_n_flags, info);
2677
2678                D_TX_REPLY("1 Frame 0x%x failure :%d\n", status & 0xff,
2679                           tx_resp->failure_frame);
2680                D_TX_REPLY("Rate Info rate_n_flags=%x\n", rate_n_flags);
2681
2682                agg->wait_for_ba = 0;
2683        } else {
2684                /* Two or more frames were attempted; expect block-ack */
2685                u64 bitmap = 0;
2686                int start = agg->start_idx;
2687                struct sk_buff *skb;
2688
2689                /* Construct bit-map of pending frames within Tx win */
2690                for (i = 0; i < agg->frame_count; i++) {
2691                        u16 sc;
2692                        status = le16_to_cpu(frame_status[i].status);
2693                        seq = le16_to_cpu(frame_status[i].sequence);
2694                        idx = SEQ_TO_IDX(seq);
2695                        txq_id = SEQ_TO_QUEUE(seq);
2696
2697                        if (status &
2698                            (AGG_TX_STATE_FEW_BYTES_MSK |
2699                             AGG_TX_STATE_ABORT_MSK))
2700                                continue;
2701
2702                        D_TX_REPLY("FrameCnt = %d, txq_id=%d idx=%d\n",
2703                                   agg->frame_count, txq_id, idx);
2704
2705                        skb = il->txq[txq_id].skbs[idx];
2706                        if (WARN_ON_ONCE(skb == NULL))
2707                                return -1;
2708                        hdr = (struct ieee80211_hdr *) skb->data;
2709
2710                        sc = le16_to_cpu(hdr->seq_ctrl);
2711                        if (idx != (IEEE80211_SEQ_TO_SN(sc) & 0xff)) {
2712                                IL_ERR("BUG_ON idx doesn't match seq control"
2713                                       " idx=%d, seq_idx=%d, seq=%d\n", idx,
2714                                       IEEE80211_SEQ_TO_SN(sc), hdr->seq_ctrl);
2715                                return -1;
2716                        }
2717
2718                        D_TX_REPLY("AGG Frame i=%d idx %d seq=%d\n", i, idx,
2719                                   IEEE80211_SEQ_TO_SN(sc));
2720
2721                        sh = idx - start;
2722                        if (sh > 64) {
2723                                sh = (start - idx) + 0xff;
2724                                bitmap = bitmap << sh;
2725                                sh = 0;
2726                                start = idx;
2727                        } else if (sh < -64)
2728                                sh = 0xff - (start - idx);
2729                        else if (sh < 0) {
2730                                sh = start - idx;
2731                                start = idx;
2732                                bitmap = bitmap << sh;
2733                                sh = 0;
2734                        }
2735                        bitmap |= 1ULL << sh;
2736                        D_TX_REPLY("start=%d bitmap=0x%llx\n", start,
2737                                   (unsigned long long)bitmap);
2738                }
2739
2740                agg->bitmap = bitmap;
2741                agg->start_idx = start;
2742                D_TX_REPLY("Frames %d start_idx=%d bitmap=0x%llx\n",
2743                           agg->frame_count, agg->start_idx,
2744                           (unsigned long long)agg->bitmap);
2745
2746                if (bitmap)
2747                        agg->wait_for_ba = 1;
2748        }
2749        return 0;
2750}
2751
2752/*
2753 * il4965_hdl_tx - Handle standard (non-aggregation) Tx response
2754 */
2755static void
2756il4965_hdl_tx(struct il_priv *il, struct il_rx_buf *rxb)
2757{
2758        struct il_rx_pkt *pkt = rxb_addr(rxb);
2759        u16 sequence = le16_to_cpu(pkt->hdr.sequence);
2760        int txq_id = SEQ_TO_QUEUE(sequence);
2761        int idx = SEQ_TO_IDX(sequence);
2762        struct il_tx_queue *txq = &il->txq[txq_id];
2763        struct sk_buff *skb;
2764        struct ieee80211_hdr *hdr;
2765        struct ieee80211_tx_info *info;
2766        struct il4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
2767        u32 status = le32_to_cpu(tx_resp->u.status);
2768        int tid;
2769        int sta_id;
2770        int freed;
2771        u8 *qc = NULL;
2772        unsigned long flags;
2773
2774        if (idx >= txq->q.n_bd || il_queue_used(&txq->q, idx) == 0) {
2775                IL_ERR("Read idx for DMA queue txq_id (%d) idx %d "
2776                       "is out of range [0-%d] %d %d\n", txq_id, idx,
2777                       txq->q.n_bd, txq->q.write_ptr, txq->q.read_ptr);
2778                return;
2779        }
2780
2781        txq->time_stamp = jiffies;
2782
2783        skb = txq->skbs[txq->q.read_ptr];
2784        info = IEEE80211_SKB_CB(skb);
2785        memset(&info->status, 0, sizeof(info->status));
2786
2787        hdr = (struct ieee80211_hdr *) skb->data;
2788        if (ieee80211_is_data_qos(hdr->frame_control)) {
2789                qc = ieee80211_get_qos_ctl(hdr);
2790                tid = qc[0] & 0xf;
2791        }
2792
2793        sta_id = il4965_get_ra_sta_id(il, hdr);
2794        if (txq->sched_retry && unlikely(sta_id == IL_INVALID_STATION)) {
2795                IL_ERR("Station not known\n");
2796                return;
2797        }
2798
2799        /*
2800         * Firmware will not transmit frame on passive channel, if it not yet
2801         * received some valid frame on that channel. When this error happen
2802         * we have to wait until firmware will unblock itself i.e. when we
2803         * note received beacon or other frame. We unblock queues in
2804         * il4965_pass_packet_to_mac80211 or in il_mac_bss_info_changed.
2805         */
2806        if (unlikely((status & TX_STATUS_MSK) == TX_STATUS_FAIL_PASSIVE_NO_RX) &&
2807            il->iw_mode == NL80211_IFTYPE_STATION) {
2808                il_stop_queues_by_reason(il, IL_STOP_REASON_PASSIVE);
2809                D_INFO("Stopped queues - RX waiting on passive channel\n");
2810        }
2811
2812        spin_lock_irqsave(&il->sta_lock, flags);
2813        if (txq->sched_retry) {
2814                const u32 scd_ssn = il4965_get_scd_ssn(tx_resp);
2815                struct il_ht_agg *agg;
2816
2817                if (WARN_ON(!qc))
2818                        goto out;
2819
2820                agg = &il->stations[sta_id].tid[tid].agg;
2821
2822                il4965_tx_status_reply_tx(il, agg, tx_resp, txq_id, idx);
2823
2824                /* check if BAR is needed */
2825                if (tx_resp->frame_count == 1 &&
2826                    !il4965_is_tx_success(status))
2827                        info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
2828
2829                if (txq->q.read_ptr != (scd_ssn & 0xff)) {
2830                        idx = il_queue_dec_wrap(scd_ssn & 0xff, txq->q.n_bd);
2831                        D_TX_REPLY("Retry scheduler reclaim scd_ssn "
2832                                   "%d idx %d\n", scd_ssn, idx);
2833                        freed = il4965_tx_queue_reclaim(il, txq_id, idx);
2834                        il4965_free_tfds_in_queue(il, sta_id, tid, freed);
2835
2836                        if (il->mac80211_registered &&
2837                            il_queue_space(&txq->q) > txq->q.low_mark &&
2838                            agg->state != IL_EMPTYING_HW_QUEUE_DELBA)
2839                                il_wake_queue(il, txq);
2840                }
2841        } else {
2842                info->status.rates[0].count = tx_resp->failure_frame + 1;
2843                info->flags |= il4965_tx_status_to_mac80211(status);
2844                il4965_hwrate_to_tx_control(il,
2845                                            le32_to_cpu(tx_resp->rate_n_flags),
2846                                            info);
2847
2848                D_TX_REPLY("TXQ %d status %s (0x%08x) "
2849                           "rate_n_flags 0x%x retries %d\n", txq_id,
2850                           il4965_get_tx_fail_reason(status), status,
2851                           le32_to_cpu(tx_resp->rate_n_flags),
2852                           tx_resp->failure_frame);
2853
2854                freed = il4965_tx_queue_reclaim(il, txq_id, idx);
2855                if (qc && likely(sta_id != IL_INVALID_STATION))
2856                        il4965_free_tfds_in_queue(il, sta_id, tid, freed);
2857                else if (sta_id == IL_INVALID_STATION)
2858                        D_TX_REPLY("Station not known\n");
2859
2860                if (il->mac80211_registered &&
2861                    il_queue_space(&txq->q) > txq->q.low_mark)
2862                        il_wake_queue(il, txq);
2863        }
2864out:
2865        if (qc && likely(sta_id != IL_INVALID_STATION))
2866                il4965_txq_check_empty(il, sta_id, tid, txq_id);
2867
2868        il4965_check_abort_status(il, tx_resp->frame_count, status);
2869
2870        spin_unlock_irqrestore(&il->sta_lock, flags);
2871}
2872
2873/*
2874 * translate ucode response to mac80211 tx status control values
2875 */
2876void
2877il4965_hwrate_to_tx_control(struct il_priv *il, u32 rate_n_flags,
2878                            struct ieee80211_tx_info *info)
2879{
2880        struct ieee80211_tx_rate *r = &info->status.rates[0];
2881
2882        info->status.antenna =
2883            ((rate_n_flags & RATE_MCS_ANT_ABC_MSK) >> RATE_MCS_ANT_POS);
2884        if (rate_n_flags & RATE_MCS_HT_MSK)
2885                r->flags |= IEEE80211_TX_RC_MCS;
2886        if (rate_n_flags & RATE_MCS_GF_MSK)
2887                r->flags |= IEEE80211_TX_RC_GREEN_FIELD;
2888        if (rate_n_flags & RATE_MCS_HT40_MSK)
2889                r->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
2890        if (rate_n_flags & RATE_MCS_DUP_MSK)
2891                r->flags |= IEEE80211_TX_RC_DUP_DATA;
2892        if (rate_n_flags & RATE_MCS_SGI_MSK)
2893                r->flags |= IEEE80211_TX_RC_SHORT_GI;
2894        r->idx = il4965_hwrate_to_mac80211_idx(rate_n_flags, info->band);
2895}
2896
2897/*
2898 * il4965_hdl_compressed_ba - Handler for N_COMPRESSED_BA
2899 *
2900 * Handles block-acknowledge notification from device, which reports success
2901 * of frames sent via aggregation.
2902 */
2903static void
2904il4965_hdl_compressed_ba(struct il_priv *il, struct il_rx_buf *rxb)
2905{
2906        struct il_rx_pkt *pkt = rxb_addr(rxb);
2907        struct il_compressed_ba_resp *ba_resp = &pkt->u.compressed_ba;
2908        struct il_tx_queue *txq = NULL;
2909        struct il_ht_agg *agg;
2910        int idx;
2911        int sta_id;
2912        int tid;
2913        unsigned long flags;
2914
2915        /* "flow" corresponds to Tx queue */
2916        u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
2917
2918        /* "ssn" is start of block-ack Tx win, corresponds to idx
2919         * (in Tx queue's circular buffer) of first TFD/frame in win */
2920        u16 ba_resp_scd_ssn = le16_to_cpu(ba_resp->scd_ssn);
2921
2922        if (scd_flow >= il->hw_params.max_txq_num) {
2923                IL_ERR("BUG_ON scd_flow is bigger than number of queues\n");
2924                return;
2925        }
2926
2927        txq = &il->txq[scd_flow];
2928        sta_id = ba_resp->sta_id;
2929        tid = ba_resp->tid;
2930        agg = &il->stations[sta_id].tid[tid].agg;
2931        if (unlikely(agg->txq_id != scd_flow)) {
2932                /*
2933                 * FIXME: this is a uCode bug which need to be addressed,
2934                 * log the information and return for now!
2935                 * since it is possible happen very often and in order
2936                 * not to fill the syslog, don't enable the logging by default
2937                 */
2938                D_TX_REPLY("BA scd_flow %d does not match txq_id %d\n",
2939                           scd_flow, agg->txq_id);
2940                return;
2941        }
2942
2943        /* Find idx just before block-ack win */
2944        idx = il_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd);
2945
2946        spin_lock_irqsave(&il->sta_lock, flags);
2947
2948        D_TX_REPLY("N_COMPRESSED_BA [%d] Received from %pM, " "sta_id = %d\n",
2949                   agg->wait_for_ba, (u8 *) &ba_resp->sta_addr_lo32,
2950                   ba_resp->sta_id);
2951        D_TX_REPLY("TID = %d, SeqCtl = %d, bitmap = 0x%llx," "scd_flow = "
2952                   "%d, scd_ssn = %d\n", ba_resp->tid, ba_resp->seq_ctl,
2953                   (unsigned long long)le64_to_cpu(ba_resp->bitmap),
2954                   ba_resp->scd_flow, ba_resp->scd_ssn);
2955        D_TX_REPLY("DAT start_idx = %d, bitmap = 0x%llx\n", agg->start_idx,
2956                   (unsigned long long)agg->bitmap);
2957
2958        /* Update driver's record of ACK vs. not for each frame in win */
2959        il4965_tx_status_reply_compressed_ba(il, agg, ba_resp);
2960
2961        /* Release all TFDs before the SSN, i.e. all TFDs in front of
2962         * block-ack win (we assume that they've been successfully
2963         * transmitted ... if not, it's too late anyway). */
2964        if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {
2965                /* calculate mac80211 ampdu sw queue to wake */
2966                int freed = il4965_tx_queue_reclaim(il, scd_flow, idx);
2967                il4965_free_tfds_in_queue(il, sta_id, tid, freed);
2968
2969                if (il_queue_space(&txq->q) > txq->q.low_mark &&
2970                    il->mac80211_registered &&
2971                    agg->state != IL_EMPTYING_HW_QUEUE_DELBA)
2972                        il_wake_queue(il, txq);
2973
2974                il4965_txq_check_empty(il, sta_id, tid, scd_flow);
2975        }
2976
2977        spin_unlock_irqrestore(&il->sta_lock, flags);
2978}
2979
2980#ifdef CONFIG_IWLEGACY_DEBUG
2981const char *
2982il4965_get_tx_fail_reason(u32 status)
2983{
2984#define TX_STATUS_FAIL(x) case TX_STATUS_FAIL_ ## x: return #x
2985#define TX_STATUS_POSTPONE(x) case TX_STATUS_POSTPONE_ ## x: return #x
2986
2987        switch (status & TX_STATUS_MSK) {
2988        case TX_STATUS_SUCCESS:
2989                return "SUCCESS";
2990                TX_STATUS_POSTPONE(DELAY);
2991                TX_STATUS_POSTPONE(FEW_BYTES);
2992                TX_STATUS_POSTPONE(QUIET_PERIOD);
2993                TX_STATUS_POSTPONE(CALC_TTAK);
2994                TX_STATUS_FAIL(INTERNAL_CROSSED_RETRY);
2995                TX_STATUS_FAIL(SHORT_LIMIT);
2996                TX_STATUS_FAIL(LONG_LIMIT);
2997                TX_STATUS_FAIL(FIFO_UNDERRUN);
2998                TX_STATUS_FAIL(DRAIN_FLOW);
2999                TX_STATUS_FAIL(RFKILL_FLUSH);
3000                TX_STATUS_FAIL(LIFE_EXPIRE);
3001                TX_STATUS_FAIL(DEST_PS);
3002                TX_STATUS_FAIL(HOST_ABORTED);
3003                TX_STATUS_FAIL(BT_RETRY);
3004                TX_STATUS_FAIL(STA_INVALID);
3005                TX_STATUS_FAIL(FRAG_DROPPED);
3006                TX_STATUS_FAIL(TID_DISABLE);
3007                TX_STATUS_FAIL(FIFO_FLUSHED);
3008                TX_STATUS_FAIL(INSUFFICIENT_CF_POLL);
3009                TX_STATUS_FAIL(PASSIVE_NO_RX);
3010                TX_STATUS_FAIL(NO_BEACON_ON_RADAR);
3011        }
3012
3013        return "UNKNOWN";
3014
3015#undef TX_STATUS_FAIL
3016#undef TX_STATUS_POSTPONE
3017}
3018#endif /* CONFIG_IWLEGACY_DEBUG */
3019
3020static struct il_link_quality_cmd *
3021il4965_sta_alloc_lq(struct il_priv *il, u8 sta_id)
3022{
3023        int i, r;
3024        struct il_link_quality_cmd *link_cmd;
3025        u32 rate_flags = 0;
3026        __le32 rate_n_flags;
3027
3028        link_cmd = kzalloc(sizeof(struct il_link_quality_cmd), GFP_KERNEL);
3029        if (!link_cmd) {
3030                IL_ERR("Unable to allocate memory for LQ cmd.\n");
3031                return NULL;
3032        }
3033        /* Set up the rate scaling to start at selected rate, fall back
3034         * all the way down to 1M in IEEE order, and then spin on 1M */
3035        if (il->band == NL80211_BAND_5GHZ)
3036                r = RATE_6M_IDX;
3037        else
3038                r = RATE_1M_IDX;
3039
3040        if (r >= IL_FIRST_CCK_RATE && r <= IL_LAST_CCK_RATE)
3041                rate_flags |= RATE_MCS_CCK_MSK;
3042
3043        rate_flags |=
3044            il4965_first_antenna(il->hw_params.
3045                                 valid_tx_ant) << RATE_MCS_ANT_POS;
3046        rate_n_flags = cpu_to_le32(il_rates[r].plcp | rate_flags);
3047        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
3048                link_cmd->rs_table[i].rate_n_flags = rate_n_flags;
3049
3050        link_cmd->general_params.single_stream_ant_msk =
3051            il4965_first_antenna(il->hw_params.valid_tx_ant);
3052
3053        link_cmd->general_params.dual_stream_ant_msk =
3054            il->hw_params.valid_tx_ant & ~il4965_first_antenna(il->hw_params.
3055                                                               valid_tx_ant);
3056        if (!link_cmd->general_params.dual_stream_ant_msk) {
3057                link_cmd->general_params.dual_stream_ant_msk = ANT_AB;
3058        } else if (il4965_num_of_ant(il->hw_params.valid_tx_ant) == 2) {
3059                link_cmd->general_params.dual_stream_ant_msk =
3060                    il->hw_params.valid_tx_ant;
3061        }
3062
3063        link_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
3064        link_cmd->agg_params.agg_time_limit =
3065            cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
3066
3067        link_cmd->sta_id = sta_id;
3068
3069        return link_cmd;
3070}
3071
3072/*
3073 * il4965_add_bssid_station - Add the special IBSS BSSID station
3074 *
3075 * Function sleeps.
3076 */
3077int
3078il4965_add_bssid_station(struct il_priv *il, const u8 *addr, u8 *sta_id_r)
3079{
3080        int ret;
3081        u8 sta_id;
3082        struct il_link_quality_cmd *link_cmd;
3083        unsigned long flags;
3084
3085        if (sta_id_r)
3086                *sta_id_r = IL_INVALID_STATION;
3087
3088        ret = il_add_station_common(il, addr, 0, NULL, &sta_id);
3089        if (ret) {
3090                IL_ERR("Unable to add station %pM\n", addr);
3091                return ret;
3092        }
3093
3094        if (sta_id_r)
3095                *sta_id_r = sta_id;
3096
3097        spin_lock_irqsave(&il->sta_lock, flags);
3098        il->stations[sta_id].used |= IL_STA_LOCAL;
3099        spin_unlock_irqrestore(&il->sta_lock, flags);
3100
3101        /* Set up default rate scaling table in device's station table */
3102        link_cmd = il4965_sta_alloc_lq(il, sta_id);
3103        if (!link_cmd) {
3104                IL_ERR("Unable to initialize rate scaling for station %pM.\n",
3105                       addr);
3106                return -ENOMEM;
3107        }
3108
3109        ret = il_send_lq_cmd(il, link_cmd, CMD_SYNC, true);
3110        if (ret)
3111                IL_ERR("Link quality command failed (%d)\n", ret);
3112
3113        spin_lock_irqsave(&il->sta_lock, flags);
3114        il->stations[sta_id].lq = link_cmd;
3115        spin_unlock_irqrestore(&il->sta_lock, flags);
3116
3117        return 0;
3118}
3119
3120static int
3121il4965_static_wepkey_cmd(struct il_priv *il, bool send_if_empty)
3122{
3123        int i;
3124        u8 buff[sizeof(struct il_wep_cmd) +
3125                sizeof(struct il_wep_key) * WEP_KEYS_MAX];
3126        struct il_wep_cmd *wep_cmd = (struct il_wep_cmd *)buff;
3127        size_t cmd_size = sizeof(struct il_wep_cmd);
3128        struct il_host_cmd cmd = {
3129                .id = C_WEPKEY,
3130                .data = wep_cmd,
3131                .flags = CMD_SYNC,
3132        };
3133        bool not_empty = false;
3134
3135        might_sleep();
3136
3137        memset(wep_cmd, 0,
3138               cmd_size + (sizeof(struct il_wep_key) * WEP_KEYS_MAX));
3139
3140        for (i = 0; i < WEP_KEYS_MAX; i++) {
3141                u8 key_size = il->_4965.wep_keys[i].key_size;
3142
3143                wep_cmd->key[i].key_idx = i;
3144                if (key_size) {
3145                        wep_cmd->key[i].key_offset = i;
3146                        not_empty = true;
3147                } else
3148                        wep_cmd->key[i].key_offset = WEP_INVALID_OFFSET;
3149
3150                wep_cmd->key[i].key_size = key_size;
3151                memcpy(&wep_cmd->key[i].key[3], il->_4965.wep_keys[i].key, key_size);
3152        }
3153
3154        wep_cmd->global_key_type = WEP_KEY_WEP_TYPE;
3155        wep_cmd->num_keys = WEP_KEYS_MAX;
3156
3157        cmd_size += sizeof(struct il_wep_key) * WEP_KEYS_MAX;
3158        cmd.len = cmd_size;
3159
3160        if (not_empty || send_if_empty)
3161                return il_send_cmd(il, &cmd);
3162        else
3163                return 0;
3164}
3165
3166int
3167il4965_restore_default_wep_keys(struct il_priv *il)
3168{
3169        lockdep_assert_held(&il->mutex);
3170
3171        return il4965_static_wepkey_cmd(il, false);
3172}
3173
3174int
3175il4965_remove_default_wep_key(struct il_priv *il,
3176                              struct ieee80211_key_conf *keyconf)
3177{
3178        int ret;
3179        int idx = keyconf->keyidx;
3180
3181        lockdep_assert_held(&il->mutex);
3182
3183        D_WEP("Removing default WEP key: idx=%d\n", idx);
3184
3185        memset(&il->_4965.wep_keys[idx], 0, sizeof(struct il_wep_key));
3186        if (il_is_rfkill(il)) {
3187                D_WEP("Not sending C_WEPKEY command due to RFKILL.\n");
3188                /* but keys in device are clear anyway so return success */
3189                return 0;
3190        }
3191        ret = il4965_static_wepkey_cmd(il, 1);
3192        D_WEP("Remove default WEP key: idx=%d ret=%d\n", idx, ret);
3193
3194        return ret;
3195}
3196
3197int
3198il4965_set_default_wep_key(struct il_priv *il,
3199                           struct ieee80211_key_conf *keyconf)
3200{
3201        int ret;
3202        int len = keyconf->keylen;
3203        int idx = keyconf->keyidx;
3204
3205        lockdep_assert_held(&il->mutex);
3206
3207        if (len != WEP_KEY_LEN_128 && len != WEP_KEY_LEN_64) {
3208                D_WEP("Bad WEP key length %d\n", keyconf->keylen);
3209                return -EINVAL;
3210        }
3211
3212        keyconf->flags &= ~IEEE80211_KEY_FLAG_GENERATE_IV;
3213        keyconf->hw_key_idx = HW_KEY_DEFAULT;
3214        il->stations[IL_AP_ID].keyinfo.cipher = keyconf->cipher;
3215
3216        il->_4965.wep_keys[idx].key_size = len;
3217        memcpy(&il->_4965.wep_keys[idx].key, &keyconf->key, len);
3218
3219        ret = il4965_static_wepkey_cmd(il, false);
3220
3221        D_WEP("Set default WEP key: len=%d idx=%d ret=%d\n", len, idx, ret);
3222        return ret;
3223}
3224
3225static int
3226il4965_set_wep_dynamic_key_info(struct il_priv *il,
3227                                struct ieee80211_key_conf *keyconf, u8 sta_id)
3228{
3229        unsigned long flags;
3230        __le16 key_flags = 0;
3231        struct il_addsta_cmd sta_cmd;
3232
3233        lockdep_assert_held(&il->mutex);
3234
3235        keyconf->flags &= ~IEEE80211_KEY_FLAG_GENERATE_IV;
3236
3237        key_flags |= (STA_KEY_FLG_WEP | STA_KEY_FLG_MAP_KEY_MSK);
3238        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
3239        key_flags &= ~STA_KEY_FLG_INVALID;
3240
3241        if (keyconf->keylen == WEP_KEY_LEN_128)
3242                key_flags |= STA_KEY_FLG_KEY_SIZE_MSK;
3243
3244        if (sta_id == il->hw_params.bcast_id)
3245                key_flags |= STA_KEY_MULTICAST_MSK;
3246
3247        spin_lock_irqsave(&il->sta_lock, flags);
3248
3249        il->stations[sta_id].keyinfo.cipher = keyconf->cipher;
3250        il->stations[sta_id].keyinfo.keylen = keyconf->keylen;
3251        il->stations[sta_id].keyinfo.keyidx = keyconf->keyidx;
3252
3253        memcpy(il->stations[sta_id].keyinfo.key, keyconf->key, keyconf->keylen);
3254
3255        memcpy(&il->stations[sta_id].sta.key.key[3], keyconf->key,
3256               keyconf->keylen);
3257
3258        if ((il->stations[sta_id].sta.key.
3259             key_flags & STA_KEY_FLG_ENCRYPT_MSK) == STA_KEY_FLG_NO_ENC)
3260                il->stations[sta_id].sta.key.key_offset =
3261                    il_get_free_ucode_key_idx(il);
3262        /* else, we are overriding an existing key => no need to allocated room
3263         * in uCode. */
3264
3265        WARN(il->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
3266             "no space for a new key");
3267
3268        il->stations[sta_id].sta.key.key_flags = key_flags;
3269        il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
3270        il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3271
3272        memcpy(&sta_cmd, &il->stations[sta_id].sta,
3273               sizeof(struct il_addsta_cmd));
3274        spin_unlock_irqrestore(&il->sta_lock, flags);
3275
3276        return il_send_add_sta(il, &sta_cmd, CMD_SYNC);
3277}
3278
3279static int
3280il4965_set_ccmp_dynamic_key_info(struct il_priv *il,
3281                                 struct ieee80211_key_conf *keyconf, u8 sta_id)
3282{
3283        unsigned long flags;
3284        __le16 key_flags = 0;
3285        struct il_addsta_cmd sta_cmd;
3286
3287        lockdep_assert_held(&il->mutex);
3288
3289        key_flags |= (STA_KEY_FLG_CCMP | STA_KEY_FLG_MAP_KEY_MSK);
3290        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
3291        key_flags &= ~STA_KEY_FLG_INVALID;
3292
3293        if (sta_id == il->hw_params.bcast_id)
3294                key_flags |= STA_KEY_MULTICAST_MSK;
3295
3296        keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3297
3298        spin_lock_irqsave(&il->sta_lock, flags);
3299        il->stations[sta_id].keyinfo.cipher = keyconf->cipher;
3300        il->stations[sta_id].keyinfo.keylen = keyconf->keylen;
3301
3302        memcpy(il->stations[sta_id].keyinfo.key, keyconf->key, keyconf->keylen);
3303
3304        memcpy(il->stations[sta_id].sta.key.key, keyconf->key, keyconf->keylen);
3305
3306        if ((il->stations[sta_id].sta.key.
3307             key_flags & STA_KEY_FLG_ENCRYPT_MSK) == STA_KEY_FLG_NO_ENC)
3308                il->stations[sta_id].sta.key.key_offset =
3309                    il_get_free_ucode_key_idx(il);
3310        /* else, we are overriding an existing key => no need to allocated room
3311         * in uCode. */
3312
3313        WARN(il->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
3314             "no space for a new key");
3315
3316        il->stations[sta_id].sta.key.key_flags = key_flags;
3317        il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
3318        il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3319
3320        memcpy(&sta_cmd, &il->stations[sta_id].sta,
3321               sizeof(struct il_addsta_cmd));
3322        spin_unlock_irqrestore(&il->sta_lock, flags);
3323
3324        return il_send_add_sta(il, &sta_cmd, CMD_SYNC);
3325}
3326
3327static int
3328il4965_set_tkip_dynamic_key_info(struct il_priv *il,
3329                                 struct ieee80211_key_conf *keyconf, u8 sta_id)
3330{
3331        unsigned long flags;
3332        __le16 key_flags = 0;
3333
3334        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
3335        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
3336        key_flags &= ~STA_KEY_FLG_INVALID;
3337
3338        if (sta_id == il->hw_params.bcast_id)
3339                key_flags |= STA_KEY_MULTICAST_MSK;
3340
3341        keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3342        keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3343
3344        spin_lock_irqsave(&il->sta_lock, flags);
3345
3346        il->stations[sta_id].keyinfo.cipher = keyconf->cipher;
3347        il->stations[sta_id].keyinfo.keylen = 16;
3348
3349        if ((il->stations[sta_id].sta.key.
3350             key_flags & STA_KEY_FLG_ENCRYPT_MSK) == STA_KEY_FLG_NO_ENC)
3351                il->stations[sta_id].sta.key.key_offset =
3352                    il_get_free_ucode_key_idx(il);
3353        /* else, we are overriding an existing key => no need to allocated room
3354         * in uCode. */
3355
3356        WARN(il->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
3357             "no space for a new key");
3358
3359        il->stations[sta_id].sta.key.key_flags = key_flags;
3360
3361        /* This copy is acutally not needed: we get the key with each TX */
3362        memcpy(il->stations[sta_id].keyinfo.key, keyconf->key, 16);
3363
3364        memcpy(il->stations[sta_id].sta.key.key, keyconf->key, 16);
3365
3366        spin_unlock_irqrestore(&il->sta_lock, flags);
3367
3368        return 0;
3369}
3370
3371void
3372il4965_update_tkip_key(struct il_priv *il, struct ieee80211_key_conf *keyconf,
3373                       struct ieee80211_sta *sta, u32 iv32, u16 *phase1key)
3374{
3375        u8 sta_id;
3376        unsigned long flags;
3377        int i;
3378
3379        if (il_scan_cancel(il)) {
3380                /* cancel scan failed, just live w/ bad key and rely
3381                   briefly on SW decryption */
3382                return;
3383        }
3384
3385        sta_id = il_sta_id_or_broadcast(il, sta);
3386        if (sta_id == IL_INVALID_STATION)
3387                return;
3388
3389        spin_lock_irqsave(&il->sta_lock, flags);
3390
3391        il->stations[sta_id].sta.key.tkip_rx_tsc_byte2 = (u8) iv32;
3392
3393        for (i = 0; i < 5; i++)
3394                il->stations[sta_id].sta.key.tkip_rx_ttak[i] =
3395                    cpu_to_le16(phase1key[i]);
3396
3397        il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
3398        il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3399
3400        il_send_add_sta(il, &il->stations[sta_id].sta, CMD_ASYNC);
3401
3402        spin_unlock_irqrestore(&il->sta_lock, flags);
3403}
3404
3405int
3406il4965_remove_dynamic_key(struct il_priv *il,
3407                          struct ieee80211_key_conf *keyconf, u8 sta_id)
3408{
3409        unsigned long flags;
3410        u16 key_flags;
3411        u8 keyidx;
3412        struct il_addsta_cmd sta_cmd;
3413
3414        lockdep_assert_held(&il->mutex);
3415
3416        il->_4965.key_mapping_keys--;
3417
3418        spin_lock_irqsave(&il->sta_lock, flags);
3419        key_flags = le16_to_cpu(il->stations[sta_id].sta.key.key_flags);
3420        keyidx = (key_flags >> STA_KEY_FLG_KEYID_POS) & 0x3;
3421
3422        D_WEP("Remove dynamic key: idx=%d sta=%d\n", keyconf->keyidx, sta_id);
3423
3424        if (keyconf->keyidx != keyidx) {
3425                /* We need to remove a key with idx different that the one
3426                 * in the uCode. This means that the key we need to remove has
3427                 * been replaced by another one with different idx.
3428                 * Don't do anything and return ok
3429                 */
3430                spin_unlock_irqrestore(&il->sta_lock, flags);
3431                return 0;
3432        }
3433
3434        if (il->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_INVALID) {
3435                IL_WARN("Removing wrong key %d 0x%x\n", keyconf->keyidx,
3436                        key_flags);
3437                spin_unlock_irqrestore(&il->sta_lock, flags);
3438                return 0;
3439        }
3440
3441        if (!test_and_clear_bit
3442            (il->stations[sta_id].sta.key.key_offset, &il->ucode_key_table))
3443                IL_ERR("idx %d not used in uCode key table.\n",
3444                       il->stations[sta_id].sta.key.key_offset);
3445        memset(&il->stations[sta_id].keyinfo, 0, sizeof(struct il_hw_key));
3446        memset(&il->stations[sta_id].sta.key, 0, sizeof(struct il4965_keyinfo));
3447        il->stations[sta_id].sta.key.key_flags =
3448            STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
3449        il->stations[sta_id].sta.key.key_offset = keyconf->hw_key_idx;
3450        il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
3451        il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3452
3453        if (il_is_rfkill(il)) {
3454                D_WEP
3455                    ("Not sending C_ADD_STA command because RFKILL enabled.\n");
3456                spin_unlock_irqrestore(&il->sta_lock, flags);
3457                return 0;
3458        }
3459        memcpy(&sta_cmd, &il->stations[sta_id].sta,
3460               sizeof(struct il_addsta_cmd));
3461        spin_unlock_irqrestore(&il->sta_lock, flags);
3462
3463        return il_send_add_sta(il, &sta_cmd, CMD_SYNC);
3464}
3465
3466int
3467il4965_set_dynamic_key(struct il_priv *il, struct ieee80211_key_conf *keyconf,
3468                       u8 sta_id)
3469{
3470        int ret;
3471
3472        lockdep_assert_held(&il->mutex);
3473
3474        il->_4965.key_mapping_keys++;
3475        keyconf->hw_key_idx = HW_KEY_DYNAMIC;
3476
3477        switch (keyconf->cipher) {
3478        case WLAN_CIPHER_SUITE_CCMP:
3479                ret =
3480                    il4965_set_ccmp_dynamic_key_info(il, keyconf, sta_id);
3481                break;
3482        case WLAN_CIPHER_SUITE_TKIP:
3483                ret =
3484                    il4965_set_tkip_dynamic_key_info(il, keyconf, sta_id);
3485                break;
3486        case WLAN_CIPHER_SUITE_WEP40:
3487        case WLAN_CIPHER_SUITE_WEP104:
3488                ret = il4965_set_wep_dynamic_key_info(il, keyconf, sta_id);
3489                break;
3490        default:
3491                IL_ERR("Unknown alg: %s cipher = %x\n", __func__,
3492                       keyconf->cipher);
3493                ret = -EINVAL;
3494        }
3495
3496        D_WEP("Set dynamic key: cipher=%x len=%d idx=%d sta=%d ret=%d\n",
3497              keyconf->cipher, keyconf->keylen, keyconf->keyidx, sta_id, ret);
3498
3499        return ret;
3500}
3501
3502/*
3503 * il4965_alloc_bcast_station - add broadcast station into driver's station table.
3504 *
3505 * This adds the broadcast station into the driver's station table
3506 * and marks it driver active, so that it will be restored to the
3507 * device at the next best time.
3508 */
3509int
3510il4965_alloc_bcast_station(struct il_priv *il)
3511{
3512        struct il_link_quality_cmd *link_cmd;
3513        unsigned long flags;
3514        u8 sta_id;
3515
3516        spin_lock_irqsave(&il->sta_lock, flags);
3517        sta_id = il_prep_station(il, il_bcast_addr, false, NULL);
3518        if (sta_id == IL_INVALID_STATION) {
3519                IL_ERR("Unable to prepare broadcast station\n");
3520                spin_unlock_irqrestore(&il->sta_lock, flags);
3521
3522                return -EINVAL;
3523        }
3524
3525        il->stations[sta_id].used |= IL_STA_DRIVER_ACTIVE;
3526        il->stations[sta_id].used |= IL_STA_BCAST;
3527        spin_unlock_irqrestore(&il->sta_lock, flags);
3528
3529        link_cmd = il4965_sta_alloc_lq(il, sta_id);
3530        if (!link_cmd) {
3531                IL_ERR
3532                    ("Unable to initialize rate scaling for bcast station.\n");
3533                return -ENOMEM;
3534        }
3535
3536        spin_lock_irqsave(&il->sta_lock, flags);
3537        il->stations[sta_id].lq = link_cmd;
3538        spin_unlock_irqrestore(&il->sta_lock, flags);
3539
3540        return 0;
3541}
3542
3543/*
3544 * il4965_update_bcast_station - update broadcast station's LQ command
3545 *
3546 * Only used by iwl4965. Placed here to have all bcast station management
3547 * code together.
3548 */
3549static int
3550il4965_update_bcast_station(struct il_priv *il)
3551{
3552        unsigned long flags;
3553        struct il_link_quality_cmd *link_cmd;
3554        u8 sta_id = il->hw_params.bcast_id;
3555
3556        link_cmd = il4965_sta_alloc_lq(il, sta_id);
3557        if (!link_cmd) {
3558                IL_ERR("Unable to initialize rate scaling for bcast sta.\n");
3559                return -ENOMEM;
3560        }
3561
3562        spin_lock_irqsave(&il->sta_lock, flags);
3563        if (il->stations[sta_id].lq)
3564                kfree(il->stations[sta_id].lq);
3565        else
3566                D_INFO("Bcast sta rate scaling has not been initialized.\n");
3567        il->stations[sta_id].lq = link_cmd;
3568        spin_unlock_irqrestore(&il->sta_lock, flags);
3569
3570        return 0;
3571}
3572
3573int
3574il4965_update_bcast_stations(struct il_priv *il)
3575{
3576        return il4965_update_bcast_station(il);
3577}
3578
3579/*
3580 * il4965_sta_tx_modify_enable_tid - Enable Tx for this TID in station table
3581 */
3582int
3583il4965_sta_tx_modify_enable_tid(struct il_priv *il, int sta_id, int tid)
3584{
3585        unsigned long flags;
3586        struct il_addsta_cmd sta_cmd;
3587
3588        lockdep_assert_held(&il->mutex);
3589
3590        /* Remove "disable" flag, to enable Tx for this TID */
3591        spin_lock_irqsave(&il->sta_lock, flags);
3592        il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_TID_DISABLE_TX;
3593        il->stations[sta_id].sta.tid_disable_tx &= cpu_to_le16(~(1 << tid));
3594        il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3595        memcpy(&sta_cmd, &il->stations[sta_id].sta,
3596               sizeof(struct il_addsta_cmd));
3597        spin_unlock_irqrestore(&il->sta_lock, flags);
3598
3599        return il_send_add_sta(il, &sta_cmd, CMD_SYNC);
3600}
3601
3602int
3603il4965_sta_rx_agg_start(struct il_priv *il, struct ieee80211_sta *sta, int tid,
3604                        u16 ssn)
3605{
3606        unsigned long flags;
3607        int sta_id;
3608        struct il_addsta_cmd sta_cmd;
3609
3610        lockdep_assert_held(&il->mutex);
3611
3612        sta_id = il_sta_id(sta);
3613        if (sta_id == IL_INVALID_STATION)
3614                return -ENXIO;
3615
3616        spin_lock_irqsave(&il->sta_lock, flags);
3617        il->stations[sta_id].sta.station_flags_msk = 0;
3618        il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_ADDBA_TID_MSK;
3619        il->stations[sta_id].sta.add_immediate_ba_tid = (u8) tid;
3620        il->stations[sta_id].sta.add_immediate_ba_ssn = cpu_to_le16(ssn);
3621        il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3622        memcpy(&sta_cmd, &il->stations[sta_id].sta,
3623               sizeof(struct il_addsta_cmd));
3624        spin_unlock_irqrestore(&il->sta_lock, flags);
3625
3626        return il_send_add_sta(il, &sta_cmd, CMD_SYNC);
3627}
3628
3629int
3630il4965_sta_rx_agg_stop(struct il_priv *il, struct ieee80211_sta *sta, int tid)
3631{
3632        unsigned long flags;
3633        int sta_id;
3634        struct il_addsta_cmd sta_cmd;
3635
3636        lockdep_assert_held(&il->mutex);
3637
3638        sta_id = il_sta_id(sta);
3639        if (sta_id == IL_INVALID_STATION) {
3640                IL_ERR("Invalid station for AGG tid %d\n", tid);
3641                return -ENXIO;
3642        }
3643
3644        spin_lock_irqsave(&il->sta_lock, flags);
3645        il->stations[sta_id].sta.station_flags_msk = 0;
3646        il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_DELBA_TID_MSK;
3647        il->stations[sta_id].sta.remove_immediate_ba_tid = (u8) tid;
3648        il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3649        memcpy(&sta_cmd, &il->stations[sta_id].sta,
3650               sizeof(struct il_addsta_cmd));
3651        spin_unlock_irqrestore(&il->sta_lock, flags);
3652
3653        return il_send_add_sta(il, &sta_cmd, CMD_SYNC);
3654}
3655
3656void
3657il4965_sta_modify_sleep_tx_count(struct il_priv *il, int sta_id, int cnt)
3658{
3659        unsigned long flags;
3660
3661        spin_lock_irqsave(&il->sta_lock, flags);
3662        il->stations[sta_id].sta.station_flags |= STA_FLG_PWR_SAVE_MSK;
3663        il->stations[sta_id].sta.station_flags_msk = STA_FLG_PWR_SAVE_MSK;
3664        il->stations[sta_id].sta.sta.modify_mask =
3665            STA_MODIFY_SLEEP_TX_COUNT_MSK;
3666        il->stations[sta_id].sta.sleep_tx_count = cpu_to_le16(cnt);
3667        il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3668        il_send_add_sta(il, &il->stations[sta_id].sta, CMD_ASYNC);
3669        spin_unlock_irqrestore(&il->sta_lock, flags);
3670
3671}
3672
3673void
3674il4965_update_chain_flags(struct il_priv *il)
3675{
3676        if (il->ops->set_rxon_chain) {
3677                il->ops->set_rxon_chain(il);
3678                if (il->active.rx_chain != il->staging.rx_chain)
3679                        il_commit_rxon(il);
3680        }
3681}
3682
3683static void
3684il4965_clear_free_frames(struct il_priv *il)
3685{
3686        struct list_head *element;
3687
3688        D_INFO("%d frames on pre-allocated heap on clear.\n", il->frames_count);
3689
3690        while (!list_empty(&il->free_frames)) {
3691                element = il->free_frames.next;
3692                list_del(element);
3693                kfree(list_entry(element, struct il_frame, list));
3694                il->frames_count--;
3695        }
3696
3697        if (il->frames_count) {
3698                IL_WARN("%d frames still in use.  Did we lose one?\n",
3699                        il->frames_count);
3700                il->frames_count = 0;
3701        }
3702}
3703
3704static struct il_frame *
3705il4965_get_free_frame(struct il_priv *il)
3706{
3707        struct il_frame *frame;
3708        struct list_head *element;
3709        if (list_empty(&il->free_frames)) {
3710                frame = kzalloc(sizeof(*frame), GFP_KERNEL);
3711                if (!frame) {
3712                        IL_ERR("Could not allocate frame!\n");
3713                        return NULL;
3714                }
3715
3716                il->frames_count++;
3717                return frame;
3718        }
3719
3720        element = il->free_frames.next;
3721        list_del(element);
3722        return list_entry(element, struct il_frame, list);
3723}
3724
3725static void
3726il4965_free_frame(struct il_priv *il, struct il_frame *frame)
3727{
3728        memset(frame, 0, sizeof(*frame));
3729        list_add(&frame->list, &il->free_frames);
3730}
3731
3732static u32
3733il4965_fill_beacon_frame(struct il_priv *il, struct ieee80211_hdr *hdr,
3734                         int left)
3735{
3736        lockdep_assert_held(&il->mutex);
3737
3738        if (!il->beacon_skb)
3739                return 0;
3740
3741        if (il->beacon_skb->len > left)
3742                return 0;
3743
3744        memcpy(hdr, il->beacon_skb->data, il->beacon_skb->len);
3745
3746        return il->beacon_skb->len;
3747}
3748
3749/* Parse the beacon frame to find the TIM element and set tim_idx & tim_size */
3750static void
3751il4965_set_beacon_tim(struct il_priv *il,
3752                      struct il_tx_beacon_cmd *tx_beacon_cmd, u8 * beacon,
3753                      u32 frame_size)
3754{
3755        u16 tim_idx;
3756        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)beacon;
3757
3758        /*
3759         * The idx is relative to frame start but we start looking at the
3760         * variable-length part of the beacon.
3761         */
3762        tim_idx = mgmt->u.beacon.variable - beacon;
3763
3764        /* Parse variable-length elements of beacon to find WLAN_EID_TIM */
3765        while ((tim_idx < (frame_size - 2)) &&
3766               (beacon[tim_idx] != WLAN_EID_TIM))
3767                tim_idx += beacon[tim_idx + 1] + 2;
3768
3769        /* If TIM field was found, set variables */
3770        if ((tim_idx < (frame_size - 1)) && (beacon[tim_idx] == WLAN_EID_TIM)) {
3771                tx_beacon_cmd->tim_idx = cpu_to_le16(tim_idx);
3772                tx_beacon_cmd->tim_size = beacon[tim_idx + 1];
3773        } else
3774                IL_WARN("Unable to find TIM Element in beacon\n");
3775}
3776
3777static unsigned int
3778il4965_hw_get_beacon_cmd(struct il_priv *il, struct il_frame *frame)
3779{
3780        struct il_tx_beacon_cmd *tx_beacon_cmd;
3781        u32 frame_size;
3782        u32 rate_flags;
3783        u32 rate;
3784        /*
3785         * We have to set up the TX command, the TX Beacon command, and the
3786         * beacon contents.
3787         */
3788
3789        lockdep_assert_held(&il->mutex);
3790
3791        if (!il->beacon_enabled) {
3792                IL_ERR("Trying to build beacon without beaconing enabled\n");
3793                return 0;
3794        }
3795
3796        /* Initialize memory */
3797        tx_beacon_cmd = &frame->u.beacon;
3798        memset(tx_beacon_cmd, 0, sizeof(*tx_beacon_cmd));
3799
3800        /* Set up TX beacon contents */
3801        frame_size =
3802            il4965_fill_beacon_frame(il, tx_beacon_cmd->frame,
3803                                     sizeof(frame->u) - sizeof(*tx_beacon_cmd));
3804        if (WARN_ON_ONCE(frame_size > MAX_MPDU_SIZE))
3805                return 0;
3806        if (!frame_size)
3807                return 0;
3808
3809        /* Set up TX command fields */
3810        tx_beacon_cmd->tx.len = cpu_to_le16((u16) frame_size);
3811        tx_beacon_cmd->tx.sta_id = il->hw_params.bcast_id;
3812        tx_beacon_cmd->tx.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
3813        tx_beacon_cmd->tx.tx_flags =
3814            TX_CMD_FLG_SEQ_CTL_MSK | TX_CMD_FLG_TSF_MSK |
3815            TX_CMD_FLG_STA_RATE_MSK;
3816
3817        /* Set up TX beacon command fields */
3818        il4965_set_beacon_tim(il, tx_beacon_cmd, (u8 *) tx_beacon_cmd->frame,
3819                              frame_size);
3820
3821        /* Set up packet rate and flags */
3822        rate = il_get_lowest_plcp(il);
3823        il4965_toggle_tx_ant(il, &il->mgmt_tx_ant, il->hw_params.valid_tx_ant);
3824        rate_flags = BIT(il->mgmt_tx_ant) << RATE_MCS_ANT_POS;
3825        if ((rate >= IL_FIRST_CCK_RATE) && (rate <= IL_LAST_CCK_RATE))
3826                rate_flags |= RATE_MCS_CCK_MSK;
3827        tx_beacon_cmd->tx.rate_n_flags = cpu_to_le32(rate | rate_flags);
3828
3829        return sizeof(*tx_beacon_cmd) + frame_size;
3830}
3831
3832int
3833il4965_send_beacon_cmd(struct il_priv *il)
3834{
3835        struct il_frame *frame;
3836        unsigned int frame_size;
3837        int rc;
3838
3839        frame = il4965_get_free_frame(il);
3840        if (!frame) {
3841                IL_ERR("Could not obtain free frame buffer for beacon "
3842                       "command.\n");
3843                return -ENOMEM;
3844        }
3845
3846        frame_size = il4965_hw_get_beacon_cmd(il, frame);
3847        if (!frame_size) {
3848                IL_ERR("Error configuring the beacon command\n");
3849                il4965_free_frame(il, frame);
3850                return -EINVAL;
3851        }
3852
3853        rc = il_send_cmd_pdu(il, C_TX_BEACON, frame_size, &frame->u.cmd[0]);
3854
3855        il4965_free_frame(il, frame);
3856
3857        return rc;
3858}
3859