1	// SPDX-License-Identifier: GPL-2.0-only
2	/******************************************************************************
3	*
4	* Copyright(c) 2003 - 2011 Intel Corporation. All rights reserved.
5	*
6	* Portions of this file are derived from the ipw3945 project, as well
7	* as portions of the ieee80211 subsystem header files.
8	*
9	* Contact Information:
10	* Intel Linux Wireless <ilw@linux.intel.com>
11	* Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
12	*
13	*****************************************************************************/
14
15	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
16
17	#include <linux/kernel.h>
18	#include <linux/module.h>
19	#include <linux/init.h>
20	#include <linux/pci.h>
21	#include <linux/slab.h>
22	#include <linux/dma-mapping.h>
23	#include <linux/delay.h>
24	#include <linux/sched.h>
25	#include <linux/skbuff.h>
26	#include <linux/netdevice.h>
27	#include <linux/firmware.h>
28	#include <linux/etherdevice.h>
29	#include <linux/if_arp.h>
30	#include <linux/units.h>
31
32	#include <net/mac80211.h>
33
34	#include <asm/div64.h>
35
36	#define DRV_NAME "iwl4965"
37
38	#include "common.h"
39	#include "4965.h"
40
41	/******************************************************************************
42	*
43	* module boiler plate
44	*
45	******************************************************************************/
46
47	/*
48	* module name, copyright, version, etc.
49	*/
50	#define DRV_DESCRIPTION "Intel(R) Wireless WiFi 4965 driver for Linux"
51
52	#ifdef CONFIG_IWLEGACY_DEBUG
53	#define VD "d"
54	#else
55	#define VD
56	#endif
57
58	#define DRV_VERSION IWLWIFI_VERSION VD
59
60	MODULE_DESCRIPTION(DRV_DESCRIPTION);
61	MODULE_VERSION(DRV_VERSION);
62	MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
63	MODULE_LICENSE("GPL");
64	MODULE_ALIAS("iwl4965");
65
66	void
67	il4965_check_abort_status(struct il_priv *il, u8 frame_count, u32 status)
68	{
69	if (frame_count == 1 && status == TX_STATUS_FAIL_RFKILL_FLUSH) {
70	IL_ERR("Tx flush command to flush out all frames\n");
71	if (!test_bit(S_EXIT_PENDING, &il->status))
72	queue_work(wq: il->workqueue, work: &il->tx_flush);
73	}
74	}
75
76	/*
77	* EEPROM
78	*/
79	struct il_mod_params il4965_mod_params = {
80	.restart_fw = 1,
81	/* the rest are 0 by default */
82	};
83
84	void
85	il4965_rx_queue_reset(struct il_priv *il, struct il_rx_queue *rxq)
86	{
87	unsigned long flags;
88	int i;
89	spin_lock_irqsave(&rxq->lock, flags);
90	INIT_LIST_HEAD(list: &rxq->rx_free);
91	INIT_LIST_HEAD(list: &rxq->rx_used);
92	/* Fill the rx_used queue with _all_ of the Rx buffers */
93	for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
94	/* In the reset function, these buffers may have been allocated
95	* to an SKB, so we need to unmap and free potential storage */
96	if (rxq->pool[i].page != NULL) {
97	dma_unmap_page(&il->pci_dev->dev,
98	rxq->pool[i].page_dma,
99	PAGE_SIZE << il->hw_params.rx_page_order,
100	DMA_FROM_DEVICE);
101	__il_free_pages(il, page: rxq->pool[i].page);
102	rxq->pool[i].page = NULL;
103	}
104	list_add_tail(new: &rxq->pool[i].list, head: &rxq->rx_used);
105	}
106
107	for (i = 0; i < RX_QUEUE_SIZE; i++)
108	rxq->queue[i] = NULL;
109
110	/* Set us so that we have processed and used all buffers, but have
111	* not restocked the Rx queue with fresh buffers */
112	rxq->read = rxq->write = 0;
113	rxq->write_actual = 0;
114	rxq->free_count = 0;
115	spin_unlock_irqrestore(lock: &rxq->lock, flags);
116	}
117
118	int
119	il4965_rx_init(struct il_priv *il, struct il_rx_queue *rxq)
120	{
121	u32 rb_size;
122	const u32 rfdnlog = RX_QUEUE_SIZE_LOG; /* 256 RBDs */
123	u32 rb_timeout = 0;
124
125	if (il->cfg->mod_params->amsdu_size_8K)
126	rb_size = FH49_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_8K;
127	else
128	rb_size = FH49_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K;
129
130	/* Stop Rx DMA */
131	il_wr(il, FH49_MEM_RCSR_CHNL0_CONFIG_REG, value: 0);
132
133	/* Reset driver's Rx queue write idx */
134	il_wr(il, FH49_RSCSR_CHNL0_RBDCB_WPTR_REG, value: 0);
135
136	/* Tell device where to find RBD circular buffer in DRAM */
137	il_wr(il, FH49_RSCSR_CHNL0_RBDCB_BASE_REG, value: (u32) (rxq->bd_dma >> 8));
138
139	/* Tell device where in DRAM to update its Rx status */
140	il_wr(il, FH49_RSCSR_CHNL0_STTS_WPTR_REG, value: rxq->rb_stts_dma >> 4);
141
142	/* Enable Rx DMA
143	* Direct rx interrupts to hosts
144	* Rx buffer size 4 or 8k
145	* RB timeout 0x10
146	* 256 RBDs
147	*/
148	il_wr(il, FH49_MEM_RCSR_CHNL0_CONFIG_REG,
149	FH49_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL |
150	FH49_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL |
151	FH49_RCSR_CHNL0_RX_CONFIG_SINGLE_FRAME_MSK |
152	rb_size |
153	(rb_timeout << FH49_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS) |
154	(rfdnlog << FH49_RCSR_RX_CONFIG_RBDCB_SIZE_POS));
155
156	/* Set interrupt coalescing timer to default (2048 usecs) */
157	il_write8(il, CSR_INT_COALESCING, IL_HOST_INT_TIMEOUT_DEF);
158
159	return 0;
160	}
161
162	static void
163	il4965_set_pwr_vmain(struct il_priv *il)
164	{
165	/*
166	* (for documentation purposes)
167	* to set power to V_AUX, do:
168
169	if (pci_pme_capable(il->pci_dev, PCI_D3cold))
170	il_set_bits_mask_prph(il, APMG_PS_CTRL_REG,
171	APMG_PS_CTRL_VAL_PWR_SRC_VAUX,
172	~APMG_PS_CTRL_MSK_PWR_SRC);
173	*/
174
175	il_set_bits_mask_prph(il, APMG_PS_CTRL_REG,
176	APMG_PS_CTRL_VAL_PWR_SRC_VMAIN,
177	mask: ~APMG_PS_CTRL_MSK_PWR_SRC);
178	}
179
180	int
181	il4965_hw_nic_init(struct il_priv *il)
182	{
183	unsigned long flags;
184	struct il_rx_queue *rxq = &il->rxq;
185	int ret;
186
187	spin_lock_irqsave(&il->lock, flags);
188	il_apm_init(il);
189	/* Set interrupt coalescing calibration timer to default (512 usecs) */
190	il_write8(il, CSR_INT_COALESCING, IL_HOST_INT_CALIB_TIMEOUT_DEF);
191	spin_unlock_irqrestore(lock: &il->lock, flags);
192
193	il4965_set_pwr_vmain(il);
194	il4965_nic_config(il);
195
196	/* Allocate the RX queue, or reset if it is already allocated */
197	if (!rxq->bd) {
198	ret = il_rx_queue_alloc(il);
199	if (ret) {
200	IL_ERR("Unable to initialize Rx queue\n");
201	return -ENOMEM;
202	}
203	} else
204	il4965_rx_queue_reset(il, rxq);
205
206	il4965_rx_replenish(il);
207
208	il4965_rx_init(il, rxq);
209
210	spin_lock_irqsave(&il->lock, flags);
211
212	rxq->need_update = 1;
213	il_rx_queue_update_write_ptr(il, q: rxq);
214
215	spin_unlock_irqrestore(lock: &il->lock, flags);
216
217	/* Allocate or reset and init all Tx and Command queues */
218	if (!il->txq) {
219	ret = il4965_txq_ctx_alloc(il);
220	if (ret)
221	return ret;
222	} else
223	il4965_txq_ctx_reset(il);
224
225	set_bit(S_INIT, addr: &il->status);
226
227	return 0;
228	}
229
230	/*
231	* il4965_dma_addr2rbd_ptr - convert a DMA address to a uCode read buffer ptr
232	*/
233	static inline __le32
234	il4965_dma_addr2rbd_ptr(struct il_priv *il, dma_addr_t dma_addr)
235	{
236	return cpu_to_le32((u32) (dma_addr >> 8));
237	}
238
239	/*
240	* il4965_rx_queue_restock - refill RX queue from pre-allocated pool
241	*
242	* If there are slots in the RX queue that need to be restocked,
243	* and we have free pre-allocated buffers, fill the ranks as much
244	* as we can, pulling from rx_free.
245	*
246	* This moves the 'write' idx forward to catch up with 'processed', and
247	* also updates the memory address in the firmware to reference the new
248	* target buffer.
249	*/
250	void
251	il4965_rx_queue_restock(struct il_priv *il)
252	{
253	struct il_rx_queue *rxq = &il->rxq;
254	struct list_head *element;
255	struct il_rx_buf *rxb;
256	unsigned long flags;
257
258	spin_lock_irqsave(&rxq->lock, flags);
259	while (il_rx_queue_space(q: rxq) > 0 && rxq->free_count) {
260	/* The overwritten rxb must be a used one */
261	rxb = rxq->queue[rxq->write];
262	BUG_ON(rxb && rxb->page);
263
264	/* Get next free Rx buffer, remove from free list */
265	element = rxq->rx_free.next;
266	rxb = list_entry(element, struct il_rx_buf, list);
267	list_del(entry: element);
268
269	/* Point to Rx buffer via next RBD in circular buffer */
270	rxq->bd[rxq->write] =
271	il4965_dma_addr2rbd_ptr(il, dma_addr: rxb->page_dma);
272	rxq->queue[rxq->write] = rxb;
273	rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
274	rxq->free_count--;
275	}
276	spin_unlock_irqrestore(lock: &rxq->lock, flags);
277	/* If the pre-allocated buffer pool is dropping low, schedule to
278	* refill it */
279	if (rxq->free_count <= RX_LOW_WATERMARK)
280	queue_work(wq: il->workqueue, work: &il->rx_replenish);
281
282	/* If we've added more space for the firmware to place data, tell it.
283	* Increment device's write pointer in multiples of 8. */
284	if (rxq->write_actual != (rxq->write & ~0x7)) {
285	spin_lock_irqsave(&rxq->lock, flags);
286	rxq->need_update = 1;
287	spin_unlock_irqrestore(lock: &rxq->lock, flags);
288	il_rx_queue_update_write_ptr(il, q: rxq);
289	}
290	}
291
292	/*
293	* il4965_rx_replenish - Move all used packet from rx_used to rx_free
294	*
295	* When moving to rx_free an SKB is allocated for the slot.
296	*
297	* Also restock the Rx queue via il_rx_queue_restock.
298	* This is called as a scheduled work item (except for during initialization)
299	*/
300	static void
301	il4965_rx_allocate(struct il_priv *il, gfp_t priority)
302	{
303	struct il_rx_queue *rxq = &il->rxq;
304	struct list_head *element;
305	struct il_rx_buf *rxb;
306	struct page *page;
307	dma_addr_t page_dma;
308	unsigned long flags;
309	gfp_t gfp_mask = priority;
310
311	while (1) {
312	spin_lock_irqsave(&rxq->lock, flags);
313	if (list_empty(head: &rxq->rx_used)) {
314	spin_unlock_irqrestore(lock: &rxq->lock, flags);
315	return;
316	}
317	spin_unlock_irqrestore(lock: &rxq->lock, flags);
318
319	if (rxq->free_count > RX_LOW_WATERMARK)
320	gfp_mask |= __GFP_NOWARN;
321
322	if (il->hw_params.rx_page_order > 0)
323	gfp_mask |= __GFP_COMP;
324
325	/* Alloc a new receive buffer */
326	page = alloc_pages(gfp: gfp_mask, order: il->hw_params.rx_page_order);
327	if (!page) {
328	if (net_ratelimit())
329	D_INFO("alloc_pages failed, " "order: %d\n",
330	il->hw_params.rx_page_order);
331
332	if (rxq->free_count <= RX_LOW_WATERMARK &&
333	net_ratelimit())
334	IL_ERR("Failed to alloc_pages with %s. "
335	"Only %u free buffers remaining.\n",
336	priority ==
337	GFP_ATOMIC ? "GFP_ATOMIC" : "GFP_KERNEL",
338	rxq->free_count);
339	/* We don't reschedule replenish work here -- we will
340	* call the restock method and if it still needs
341	* more buffers it will schedule replenish */
342	return;
343	}
344
345	/* Get physical address of the RB */
346	page_dma = dma_map_page(&il->pci_dev->dev, page, 0,
347	PAGE_SIZE << il->hw_params.rx_page_order,
348	DMA_FROM_DEVICE);
349	if (unlikely(dma_mapping_error(&il->pci_dev->dev, page_dma))) {
350	__free_pages(page, order: il->hw_params.rx_page_order);
351	break;
352	}
353
354	spin_lock_irqsave(&rxq->lock, flags);
355
356	if (list_empty(head: &rxq->rx_used)) {
357	spin_unlock_irqrestore(lock: &rxq->lock, flags);
358	dma_unmap_page(&il->pci_dev->dev, page_dma,
359	PAGE_SIZE << il->hw_params.rx_page_order,
360	DMA_FROM_DEVICE);
361	__free_pages(page, order: il->hw_params.rx_page_order);
362	return;
363	}
364
365	element = rxq->rx_used.next;
366	rxb = list_entry(element, struct il_rx_buf, list);
367	list_del(entry: element);
368
369	BUG_ON(rxb->page);
370
371	rxb->page = page;
372	rxb->page_dma = page_dma;
373	list_add_tail(new: &rxb->list, head: &rxq->rx_free);
374	rxq->free_count++;
375	il->alloc_rxb_page++;
376
377	spin_unlock_irqrestore(lock: &rxq->lock, flags);
378	}
379	}
380
381	void
382	il4965_rx_replenish(struct il_priv *il)
383	{
384	unsigned long flags;
385
386	il4965_rx_allocate(il, GFP_KERNEL);
387
388	spin_lock_irqsave(&il->lock, flags);
389	il4965_rx_queue_restock(il);
390	spin_unlock_irqrestore(lock: &il->lock, flags);
391	}
392
393	void
394	il4965_rx_replenish_now(struct il_priv *il)
395	{
396	il4965_rx_allocate(il, GFP_ATOMIC);
397
398	il4965_rx_queue_restock(il);
399	}
400
401	/* Assumes that the skb field of the buffers in 'pool' is kept accurate.
402	* If an SKB has been detached, the POOL needs to have its SKB set to NULL
403	* This free routine walks the list of POOL entries and if SKB is set to
404	* non NULL it is unmapped and freed
405	*/
406	void
407	il4965_rx_queue_free(struct il_priv *il, struct il_rx_queue *rxq)
408	{
409	int i;
410	for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
411	if (rxq->pool[i].page != NULL) {
412	dma_unmap_page(&il->pci_dev->dev,
413	rxq->pool[i].page_dma,
414	PAGE_SIZE << il->hw_params.rx_page_order,
415	DMA_FROM_DEVICE);
416	__il_free_pages(il, page: rxq->pool[i].page);
417	rxq->pool[i].page = NULL;
418	}
419	}
420
421	dma_free_coherent(dev: &il->pci_dev->dev, size: 4 * RX_QUEUE_SIZE, cpu_addr: rxq->bd,
422	dma_handle: rxq->bd_dma);
423	dma_free_coherent(dev: &il->pci_dev->dev, size: sizeof(struct il_rb_status),
424	cpu_addr: rxq->rb_stts, dma_handle: rxq->rb_stts_dma);
425	rxq->bd = NULL;
426	rxq->rb_stts = NULL;
427	}
428
429	int
430	il4965_rxq_stop(struct il_priv *il)
431	{
432	int ret;
433
434	_il_wr(il, FH49_MEM_RCSR_CHNL0_CONFIG_REG, val: 0);
435	ret = _il_poll_bit(il, FH49_MEM_RSSR_RX_STATUS_REG,
436	FH49_RSSR_CHNL0_RX_STATUS_CHNL_IDLE,
437	FH49_RSSR_CHNL0_RX_STATUS_CHNL_IDLE,
438	timeout: 1000);
439	if (ret < 0)
440	IL_ERR("Can't stop Rx DMA.\n");
441
442	return 0;
443	}
444
445	int
446	il4965_hwrate_to_mac80211_idx(u32 rate_n_flags, enum nl80211_band band)
447	{
448	int idx = 0;
449	int band_offset = 0;
450
451	/* HT rate format: mac80211 wants an MCS number, which is just LSB */
452	if (rate_n_flags & RATE_MCS_HT_MSK) {
453	idx = (rate_n_flags & 0xff);
454	return idx;
455	/* Legacy rate format, search for match in table */
456	} else {
457	if (band == NL80211_BAND_5GHZ)
458	band_offset = IL_FIRST_OFDM_RATE;
459	for (idx = band_offset; idx < RATE_COUNT_LEGACY; idx++)
460	if (il_rates[idx].plcp == (rate_n_flags & 0xFF))
461	return idx - band_offset;
462	}
463
464	return -1;
465	}
466
467	static int
468	il4965_calc_rssi(struct il_priv *il, struct il_rx_phy_res *rx_resp)
469	{
470	/* data from PHY/DSP regarding signal strength, etc.,
471	* contents are always there, not configurable by host. */
472	struct il4965_rx_non_cfg_phy *ncphy =
473	(struct il4965_rx_non_cfg_phy *)rx_resp->non_cfg_phy_buf;
474	u32 agc =
475	(le16_to_cpu(ncphy->agc_info) & IL49_AGC_DB_MASK) >>
476	IL49_AGC_DB_POS;
477
478	u32 valid_antennae =
479	(le16_to_cpu(rx_resp->phy_flags) & IL49_RX_PHY_FLAGS_ANTENNAE_MASK)
480	>> IL49_RX_PHY_FLAGS_ANTENNAE_OFFSET;
481	u8 max_rssi = 0;
482	u32 i;
483
484	/* Find max rssi among 3 possible receivers.
485	* These values are measured by the digital signal processor (DSP).
486	* They should stay fairly constant even as the signal strength varies,
487	* if the radio's automatic gain control (AGC) is working right.
488	* AGC value (see below) will provide the "interesting" info. */
489	for (i = 0; i < 3; i++)
490	if (valid_antennae & (1 << i))
491	max_rssi = max(ncphy->rssi_info[i << 1], max_rssi);
492
493	D_STATS("Rssi In A %d B %d C %d Max %d AGC dB %d\n",
494	ncphy->rssi_info[0], ncphy->rssi_info[2], ncphy->rssi_info[4],
495	max_rssi, agc);
496
497	/* dBm = max_rssi dB - agc dB - constant.
498	* Higher AGC (higher radio gain) means lower signal. */
499	return max_rssi - agc - IL4965_RSSI_OFFSET;
500	}
501
502	static u32
503	il4965_translate_rx_status(struct il_priv *il, u32 decrypt_in)
504	{
505	u32 decrypt_out = 0;
506
507	if ((decrypt_in & RX_RES_STATUS_STATION_FOUND) ==
508	RX_RES_STATUS_STATION_FOUND)
509	decrypt_out |=
510	(RX_RES_STATUS_STATION_FOUND |
511	RX_RES_STATUS_NO_STATION_INFO_MISMATCH);
512
513	decrypt_out |= (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK);
514
515	/* packet was not encrypted */
516	if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
517	RX_RES_STATUS_SEC_TYPE_NONE)
518	return decrypt_out;
519
520	/* packet was encrypted with unknown alg */
521	if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
522	RX_RES_STATUS_SEC_TYPE_ERR)
523	return decrypt_out;
524
525	/* decryption was not done in HW */
526	if ((decrypt_in & RX_MPDU_RES_STATUS_DEC_DONE_MSK) !=
527	RX_MPDU_RES_STATUS_DEC_DONE_MSK)
528	return decrypt_out;
529
530	switch (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) {
531
532	case RX_RES_STATUS_SEC_TYPE_CCMP:
533	/* alg is CCM: check MIC only */
534	if (!(decrypt_in & RX_MPDU_RES_STATUS_MIC_OK))
535	/* Bad MIC */
536	decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
537	else
538	decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
539
540	break;
541
542	case RX_RES_STATUS_SEC_TYPE_TKIP:
543	if (!(decrypt_in & RX_MPDU_RES_STATUS_TTAK_OK)) {
544	/* Bad TTAK */
545	decrypt_out |= RX_RES_STATUS_BAD_KEY_TTAK;
546	break;
547	}
548	fallthrough; /* if TTAK OK */
549	default:
550	if (!(decrypt_in & RX_MPDU_RES_STATUS_ICV_OK))
551	decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
552	else
553	decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
554	break;
555	}
556
557	D_RX("decrypt_in:0x%x decrypt_out = 0x%x\n", decrypt_in, decrypt_out);
558
559	return decrypt_out;
560	}
561
562	#define SMALL_PACKET_SIZE 256
563
564	static void
565	il4965_pass_packet_to_mac80211(struct il_priv *il, struct ieee80211_hdr *hdr,
566	u32 len, u32 ampdu_status, struct il_rx_buf *rxb,
567	struct ieee80211_rx_status *stats)
568	{
569	struct sk_buff *skb;
570	__le16 fc = hdr->frame_control;
571
572	/* We only process data packets if the interface is open */
573	if (unlikely(!il->is_open)) {
574	D_DROP("Dropping packet while interface is not open.\n");
575	return;
576	}
577
578	if (unlikely(test_bit(IL_STOP_REASON_PASSIVE, &il->stop_reason))) {
579	il_wake_queues_by_reason(il, IL_STOP_REASON_PASSIVE);
580	D_INFO("Woke queues - frame received on passive channel\n");
581	}
582
583	/* In case of HW accelerated crypto and bad decryption, drop */
584	if (!il->cfg->mod_params->sw_crypto &&
585	il_set_decrypted_flag(il, hdr, decrypt_res: ampdu_status, stats))
586	return;
587
588	skb = dev_alloc_skb(SMALL_PACKET_SIZE);
589	if (!skb) {
590	IL_ERR("dev_alloc_skb failed\n");
591	return;
592	}
593
594	if (len <= SMALL_PACKET_SIZE) {
595	skb_put_data(skb, data: hdr, len);
596	} else {
597	skb_add_rx_frag(skb, i: 0, page: rxb->page, off: (void *)hdr - rxb_addr(rxb),
598	size: len, PAGE_SIZE << il->hw_params.rx_page_order);
599	il->alloc_rxb_page--;
600	rxb->page = NULL;
601	}
602
603	il_update_stats(il, is_tx: false, fc, len);
604	memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
605
606	ieee80211_rx(hw: il->hw, skb);
607	}
608
609	/* Called for N_RX (legacy ABG frames), or
610	* N_RX_MPDU (HT high-throughput N frames). */
611	static void
612	il4965_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)
613	{
614	struct ieee80211_hdr *header;
615	struct ieee80211_rx_status rx_status = {};
616	struct il_rx_pkt *pkt = rxb_addr(rxb);
617	struct il_rx_phy_res *phy_res;
618	__le32 rx_pkt_status;
619	struct il_rx_mpdu_res_start *amsdu;
620	u32 len;
621	u32 ampdu_status;
622	u32 rate_n_flags;
623
624	/**
625	* N_RX and N_RX_MPDU are handled differently.
626	* N_RX: physical layer info is in this buffer
627	* N_RX_MPDU: physical layer info was sent in separate
628	* command and cached in il->last_phy_res
629	*
630	* Here we set up local variables depending on which command is
631	* received.
632	*/
633	if (pkt->hdr.cmd == N_RX) {
634	phy_res = (struct il_rx_phy_res *)pkt->u.raw;
635	header =
636	(struct ieee80211_hdr *)(pkt->u.raw + sizeof(*phy_res) +
637	phy_res->cfg_phy_cnt);
638
639	len = le16_to_cpu(phy_res->byte_count);
640	rx_pkt_status =
641	*(__le32 *) (pkt->u.raw + sizeof(*phy_res) +
642	phy_res->cfg_phy_cnt + len);
643	ampdu_status = le32_to_cpu(rx_pkt_status);
644	} else {
645	if (!il->_4965.last_phy_res_valid) {
646	IL_ERR("MPDU frame without cached PHY data\n");
647	return;
648	}
649	phy_res = &il->_4965.last_phy_res;
650	amsdu = (struct il_rx_mpdu_res_start *)pkt->u.raw;
651	header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*amsdu));
652	len = le16_to_cpu(amsdu->byte_count);
653	rx_pkt_status = *(__le32 *) (pkt->u.raw + sizeof(*amsdu) + len);
654	ampdu_status =
655	il4965_translate_rx_status(il, le32_to_cpu(rx_pkt_status));
656	}
657
658	if ((unlikely(phy_res->cfg_phy_cnt > 20))) {
659	D_DROP("dsp size out of range [0,20]: %d\n",
660	phy_res->cfg_phy_cnt);
661	return;
662	}
663
664	if (!(rx_pkt_status & RX_RES_STATUS_NO_CRC32_ERROR) ||
665	!(rx_pkt_status & RX_RES_STATUS_NO_RXE_OVERFLOW)) {
666	D_RX("Bad CRC or FIFO: 0x%08X.\n", le32_to_cpu(rx_pkt_status));
667	return;
668	}
669
670	/* This will be used in several places later */
671	rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);
672
673	/* rx_status carries information about the packet to mac80211 */
674	rx_status.mactime = le64_to_cpu(phy_res->timestamp);
675	rx_status.band =
676	(phy_res->
677	phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ? NL80211_BAND_2GHZ :
678	NL80211_BAND_5GHZ;
679	rx_status.freq =
680	ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel),
681	band: rx_status.band);
682	rx_status.rate_idx =
683	il4965_hwrate_to_mac80211_idx(rate_n_flags, band: rx_status.band);
684	rx_status.flag = 0;
685
686	/* TSF isn't reliable. In order to allow smooth user experience,
687	* this W/A doesn't propagate it to the mac80211 */
688	/*rx_status.flag |= RX_FLAG_MACTIME_START; */
689
690	il->ucode_beacon_time = le32_to_cpu(phy_res->beacon_time_stamp);
691
692	/* Find max signal strength (dBm) among 3 antenna/receiver chains */
693	rx_status.signal = il4965_calc_rssi(il, rx_resp: phy_res);
694
695	D_STATS("Rssi %d, TSF %llu\n", rx_status.signal,
696	(unsigned long long)rx_status.mactime);
697
698	/*
699	* "antenna number"
700	*
701	* It seems that the antenna field in the phy flags value
702	* is actually a bit field. This is undefined by radiotap,
703	* it wants an actual antenna number but I always get "7"
704	* for most legacy frames I receive indicating that the
705	* same frame was received on all three RX chains.
706	*
707	* I think this field should be removed in favor of a
708	* new 802.11n radiotap field "RX chains" that is defined
709	* as a bitmask.
710	*/
711	rx_status.antenna =
712	(le16_to_cpu(phy_res->phy_flags) & RX_RES_PHY_FLAGS_ANTENNA_MSK) >>
713	RX_RES_PHY_FLAGS_ANTENNA_POS;
714
715	/* set the preamble flag if appropriate */
716	if (phy_res->phy_flags & RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK)
717	rx_status.enc_flags |= RX_ENC_FLAG_SHORTPRE;
718
719	/* Set up the HT phy flags */
720	if (rate_n_flags & RATE_MCS_HT_MSK)
721	rx_status.encoding = RX_ENC_HT;
722	if (rate_n_flags & RATE_MCS_HT40_MSK)
723	rx_status.bw = RATE_INFO_BW_40;
724	else
725	rx_status.bw = RATE_INFO_BW_20;
726	if (rate_n_flags & RATE_MCS_SGI_MSK)
727	rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;
728
729	if (phy_res->phy_flags & RX_RES_PHY_FLAGS_AGG_MSK) {
730	/* We know which subframes of an A-MPDU belong
731	* together since we get a single PHY response
732	* from the firmware for all of them.
733	*/
734
735	rx_status.flag |= RX_FLAG_AMPDU_DETAILS;
736	rx_status.ampdu_reference = il->_4965.ampdu_ref;
737	}
738
739	il4965_pass_packet_to_mac80211(il, hdr: header, len, ampdu_status, rxb,
740	stats: &rx_status);
741	}
742
743	/* Cache phy data (Rx signal strength, etc) for HT frame (N_RX_PHY).
744	* This will be used later in il_hdl_rx() for N_RX_MPDU. */
745	static void
746	il4965_hdl_rx_phy(struct il_priv *il, struct il_rx_buf *rxb)
747	{
748	struct il_rx_pkt *pkt = rxb_addr(rxb);
749	il->_4965.last_phy_res_valid = true;
750	il->_4965.ampdu_ref++;
751	memcpy(&il->_4965.last_phy_res, pkt->u.raw,
752	sizeof(struct il_rx_phy_res));
753	}
754
755	static int
756	il4965_get_channels_for_scan(struct il_priv *il, struct ieee80211_vif *vif,
757	enum nl80211_band band, u8 is_active,
758	u8 n_probes, struct il_scan_channel *scan_ch)
759	{
760	struct ieee80211_channel *chan;
761	const struct ieee80211_supported_band *sband;
762	const struct il_channel_info *ch_info;
763	u16 passive_dwell = 0;
764	u16 active_dwell = 0;
765	int added, i;
766	u16 channel;
767
768	sband = il_get_hw_mode(il, band);
769	if (!sband)
770	return 0;
771
772	active_dwell = il_get_active_dwell_time(il, band, n_probes);
773	passive_dwell = il_get_passive_dwell_time(il, band, vif);
774
775	if (passive_dwell <= active_dwell)
776	passive_dwell = active_dwell + 1;
777
778	for (i = 0, added = 0; i < il->scan_request->n_channels; i++) {
779	chan = il->scan_request->channels[i];
780
781	if (chan->band != band)
782	continue;
783
784	channel = chan->hw_value;
785	scan_ch->channel = cpu_to_le16(channel);
786
787	ch_info = il_get_channel_info(il, band, channel);
788	if (!il_is_channel_valid(ch_info)) {
789	D_SCAN("Channel %d is INVALID for this band.\n",
790	channel);
791	continue;
792	}
793
794	if (!is_active || il_is_channel_passive(ch: ch_info) ||
795	(chan->flags & IEEE80211_CHAN_NO_IR))
796	scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
797	else
798	scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
799
800	if (n_probes)
801	scan_ch->type |= IL_SCAN_PROBE_MASK(n_probes);
802
803	scan_ch->active_dwell = cpu_to_le16(active_dwell);
804	scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
805
806	/* Set txpower levels to defaults */
807	scan_ch->dsp_atten = 110;
808
809	/* NOTE: if we were doing 6Mb OFDM for scans we'd use
810	* power level:
811	* scan_ch->tx_gain = ((1 << 5) | (2 << 3)) | 3;
812	*/
813	if (band == NL80211_BAND_5GHZ)
814	scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
815	else
816	scan_ch->tx_gain = ((1 << 5) | (5 << 3));
817
818	D_SCAN("Scanning ch=%d prob=0x%X [%s %d]\n", channel,
819	le32_to_cpu(scan_ch->type),
820	(scan_ch->
821	type & SCAN_CHANNEL_TYPE_ACTIVE) ? "ACTIVE" : "PASSIVE",
822	(scan_ch->
823	type & SCAN_CHANNEL_TYPE_ACTIVE) ? active_dwell :
824	passive_dwell);
825
826	scan_ch++;
827	added++;
828	}
829
830	D_SCAN("total channels to scan %d\n", added);
831	return added;
832	}
833
834	static void
835	il4965_toggle_tx_ant(struct il_priv *il, u8 *ant, u8 valid)
836	{
837	int i;
838	u8 ind = *ant;
839
840	for (i = 0; i < RATE_ANT_NUM - 1; i++) {
841	ind = (ind + 1) < RATE_ANT_NUM ? ind + 1 : 0;
842	if (valid & BIT(ind)) {
843	*ant = ind;
844	return;
845	}
846	}
847	}
848
849	int
850	il4965_request_scan(struct il_priv *il, struct ieee80211_vif *vif)
851	{
852	struct il_host_cmd cmd = {
853	.id = C_SCAN,
854	.len = sizeof(struct il_scan_cmd),
855	.flags = CMD_SIZE_HUGE,
856	};
857	struct il_scan_cmd *scan;
858	u32 rate_flags = 0;
859	u16 cmd_len;
860	u16 rx_chain = 0;
861	enum nl80211_band band;
862	u8 n_probes = 0;
863	u8 rx_ant = il->hw_params.valid_rx_ant;
864	u8 rate;
865	bool is_active = false;
866	int chan_mod;
867	u8 active_chains;
868	u8 scan_tx_antennas = il->hw_params.valid_tx_ant;
869	int ret;
870
871	lockdep_assert_held(&il->mutex);
872
873	if (!il->scan_cmd) {
874	il->scan_cmd =
875	kmalloc(size: sizeof(struct il_scan_cmd) + IL_MAX_SCAN_SIZE,
876	GFP_KERNEL);
877	if (!il->scan_cmd) {
878	D_SCAN("fail to allocate memory for scan\n");
879	return -ENOMEM;
880	}
881	}
882	scan = il->scan_cmd;
883	memset(scan, 0, sizeof(struct il_scan_cmd) + IL_MAX_SCAN_SIZE);
884
885	scan->quiet_plcp_th = IL_PLCP_QUIET_THRESH;
886	scan->quiet_time = IL_ACTIVE_QUIET_TIME;
887
888	if (il_is_any_associated(il)) {
889	u16 interval;
890	u32 extra;
891	u32 suspend_time = 100;
892	u32 scan_suspend_time = 100;
893
894	D_INFO("Scanning while associated...\n");
895	interval = vif->bss_conf.beacon_int;
896
897	scan->suspend_time = 0;
898	scan->max_out_time = cpu_to_le32(200 * 1024);
899	if (!interval)
900	interval = suspend_time;
901
902	extra = (suspend_time / interval) << 22;
903	scan_suspend_time =
904	(extra | ((suspend_time % interval) * 1024));
905	scan->suspend_time = cpu_to_le32(scan_suspend_time);
906	D_SCAN("suspend_time 0x%X beacon interval %d\n",
907	scan_suspend_time, interval);
908	}
909
910	if (il->scan_request->n_ssids) {
911	int i, p = 0;
912	D_SCAN("Kicking off active scan\n");
913	for (i = 0; i < il->scan_request->n_ssids; i++) {
914	/* always does wildcard anyway */
915	if (!il->scan_request->ssids[i].ssid_len)
916	continue;
917	scan->direct_scan[p].id = WLAN_EID_SSID;
918	scan->direct_scan[p].len =
919	il->scan_request->ssids[i].ssid_len;
920	memcpy(scan->direct_scan[p].ssid,
921	il->scan_request->ssids[i].ssid,
922	il->scan_request->ssids[i].ssid_len);
923	n_probes++;
924	p++;
925	}
926	is_active = true;
927	} else
928	D_SCAN("Start passive scan.\n");
929
930	scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
931	scan->tx_cmd.sta_id = il->hw_params.bcast_id;
932	scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
933
934	switch (il->scan_band) {
935	case NL80211_BAND_2GHZ:
936	scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
937	chan_mod =
938	le32_to_cpu(il->active.flags & RXON_FLG_CHANNEL_MODE_MSK) >>
939	RXON_FLG_CHANNEL_MODE_POS;
940	if (chan_mod == CHANNEL_MODE_PURE_40) {
941	rate = RATE_6M_PLCP;
942	} else {
943	rate = RATE_1M_PLCP;
944	rate_flags = RATE_MCS_CCK_MSK;
945	}
946	break;
947	case NL80211_BAND_5GHZ:
948	rate = RATE_6M_PLCP;
949	break;
950	default:
951	IL_WARN("Invalid scan band\n");
952	return -EIO;
953	}
954
955	/*
956	* If active scanning is requested but a certain channel is
957	* marked passive, we can do active scanning if we detect
958	* transmissions.
959	*
960	* There is an issue with some firmware versions that triggers
961	* a sysassert on a "good CRC threshold" of zero (== disabled),
962	* on a radar channel even though this means that we should NOT
963	* send probes.
964	*
965	* The "good CRC threshold" is the number of frames that we
966	* need to receive during our dwell time on a channel before
967	* sending out probes -- setting this to a huge value will
968	* mean we never reach it, but at the same time work around
969	* the aforementioned issue. Thus use IL_GOOD_CRC_TH_NEVER
970	* here instead of IL_GOOD_CRC_TH_DISABLED.
971	*/
972	scan->good_CRC_th =
973	is_active ? IL_GOOD_CRC_TH_DEFAULT : IL_GOOD_CRC_TH_NEVER;
974
975	band = il->scan_band;
976
977	if (il->cfg->scan_rx_antennas[band])
978	rx_ant = il->cfg->scan_rx_antennas[band];
979
980	il4965_toggle_tx_ant(il, ant: &il->scan_tx_ant[band], valid: scan_tx_antennas);
981	rate_flags |= BIT(il->scan_tx_ant[band]) << RATE_MCS_ANT_POS;
982	scan->tx_cmd.rate_n_flags = cpu_to_le32(rate | rate_flags);
983
984	/* In power save mode use one chain, otherwise use all chains */
985	if (test_bit(S_POWER_PMI, &il->status)) {
986	/* rx_ant has been set to all valid chains previously */
987	active_chains =
988	rx_ant & ((u8) (il->chain_noise_data.active_chains));
989	if (!active_chains)
990	active_chains = rx_ant;
991
992	D_SCAN("chain_noise_data.active_chains: %u\n",
993	il->chain_noise_data.active_chains);
994
995	rx_ant = il4965_first_antenna(mask: active_chains);
996	}
997
998	/* MIMO is not used here, but value is required */
999	rx_chain |= il->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
1000	rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
1001	rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
1002	rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
1003	scan->rx_chain = cpu_to_le16(rx_chain);
1004
1005	cmd_len =
1006	il_fill_probe_req(il, frame: (struct ieee80211_mgmt *)scan->data,
1007	ta: vif->addr, ie: il->scan_request->ie,
1008	ie_len: il->scan_request->ie_len,
1009	IL_MAX_SCAN_SIZE - sizeof(*scan));
1010	scan->tx_cmd.len = cpu_to_le16(cmd_len);
1011
1012	scan->filter_flags |=
1013	(RXON_FILTER_ACCEPT_GRP_MSK | RXON_FILTER_BCON_AWARE_MSK);
1014
1015	scan->channel_count =
1016	il4965_get_channels_for_scan(il, vif, band, is_active, n_probes,
1017	scan_ch: (void *)&scan->data[cmd_len]);
1018	if (scan->channel_count == 0) {
1019	D_SCAN("channel count %d\n", scan->channel_count);
1020	return -EIO;
1021	}
1022
1023	cmd.len +=
1024	le16_to_cpu(scan->tx_cmd.len) +
1025	scan->channel_count * sizeof(struct il_scan_channel);
1026	cmd.data = scan;
1027	scan->len = cpu_to_le16(cmd.len);
1028
1029	set_bit(S_SCAN_HW, addr: &il->status);
1030
1031	ret = il_send_cmd_sync(il, cmd: &cmd);
1032	if (ret)
1033	clear_bit(S_SCAN_HW, addr: &il->status);
1034
1035	return ret;
1036	}
1037
1038	int
1039	il4965_manage_ibss_station(struct il_priv *il, struct ieee80211_vif *vif,
1040	bool add)
1041	{
1042	struct il_vif_priv *vif_priv = (void *)vif->drv_priv;
1043
1044	if (add)
1045	return il4965_add_bssid_station(il, addr: vif->bss_conf.bssid,
1046	sta_id_r: &vif_priv->ibss_bssid_sta_id);
1047	return il_remove_station(il, sta_id: vif_priv->ibss_bssid_sta_id,
1048	addr: vif->bss_conf.bssid);
1049	}
1050
1051	void
1052	il4965_free_tfds_in_queue(struct il_priv *il, int sta_id, int tid, int freed)
1053	{
1054	lockdep_assert_held(&il->sta_lock);
1055
1056	if (il->stations[sta_id].tid[tid].tfds_in_queue >= freed)
1057	il->stations[sta_id].tid[tid].tfds_in_queue -= freed;
1058	else {
1059	D_TX("free more than tfds_in_queue (%u:%d)\n",
1060	il->stations[sta_id].tid[tid].tfds_in_queue, freed);
1061	il->stations[sta_id].tid[tid].tfds_in_queue = 0;
1062	}
1063	}
1064
1065	#define IL_TX_QUEUE_MSK 0xfffff
1066
1067	static bool
1068	il4965_is_single_rx_stream(struct il_priv *il)
1069	{
1070	return il->current_ht_config.smps == IEEE80211_SMPS_STATIC ||
1071	il->current_ht_config.single_chain_sufficient;
1072	}
1073
1074	#define IL_NUM_RX_CHAINS_MULTIPLE 3
1075	#define IL_NUM_RX_CHAINS_SINGLE 2
1076	#define IL_NUM_IDLE_CHAINS_DUAL 2
1077	#define IL_NUM_IDLE_CHAINS_SINGLE 1
1078
1079	/*
1080	* Determine how many receiver/antenna chains to use.
1081	*
1082	* More provides better reception via diversity. Fewer saves power
1083	* at the expense of throughput, but only when not in powersave to
1084	* start with.
1085	*
1086	* MIMO (dual stream) requires at least 2, but works better with 3.
1087	* This does not determine *which* chains to use, just how many.
1088	*/
1089	static int
1090	il4965_get_active_rx_chain_count(struct il_priv *il)
1091	{
1092	/* # of Rx chains to use when expecting MIMO. */
1093	if (il4965_is_single_rx_stream(il))
1094	return IL_NUM_RX_CHAINS_SINGLE;
1095	else
1096	return IL_NUM_RX_CHAINS_MULTIPLE;
1097	}
1098
1099	/*
1100	* When we are in power saving mode, unless device support spatial
1101	* multiplexing power save, use the active count for rx chain count.
1102	*/
1103	static int
1104	il4965_get_idle_rx_chain_count(struct il_priv *il, int active_cnt)
1105	{
1106	/* # Rx chains when idling, depending on SMPS mode */
1107	switch (il->current_ht_config.smps) {
1108	case IEEE80211_SMPS_STATIC:
1109	case IEEE80211_SMPS_DYNAMIC:
1110	return IL_NUM_IDLE_CHAINS_SINGLE;
1111	case IEEE80211_SMPS_OFF:
1112	return active_cnt;
1113	default:
1114	WARN(1, "invalid SMPS mode %d", il->current_ht_config.smps);
1115	return active_cnt;
1116	}
1117	}
1118
1119	/* up to 4 chains */
1120	static u8
1121	il4965_count_chain_bitmap(u32 chain_bitmap)
1122	{
1123	u8 res;
1124	res = (chain_bitmap & BIT(0)) >> 0;
1125	res += (chain_bitmap & BIT(1)) >> 1;
1126	res += (chain_bitmap & BIT(2)) >> 2;
1127	res += (chain_bitmap & BIT(3)) >> 3;
1128	return res;
1129	}
1130
1131	/*
1132	* il4965_set_rxon_chain - Set up Rx chain usage in "staging" RXON image
1133	*
1134	* Selects how many and which Rx receivers/antennas/chains to use.
1135	* This should not be used for scan command ... it puts data in wrong place.
1136	*/
1137	void
1138	il4965_set_rxon_chain(struct il_priv *il)
1139	{
1140	bool is_single = il4965_is_single_rx_stream(il);
1141	bool is_cam = !test_bit(S_POWER_PMI, &il->status);
1142	u8 idle_rx_cnt, active_rx_cnt, valid_rx_cnt;
1143	u32 active_chains;
1144	u16 rx_chain;
1145
1146	/* Tell uCode which antennas are actually connected.
1147	* Before first association, we assume all antennas are connected.
1148	* Just after first association, il4965_chain_noise_calibration()
1149	* checks which antennas actually *are* connected. */
1150	if (il->chain_noise_data.active_chains)
1151	active_chains = il->chain_noise_data.active_chains;
1152	else
1153	active_chains = il->hw_params.valid_rx_ant;
1154
1155	rx_chain = active_chains << RXON_RX_CHAIN_VALID_POS;
1156
1157	/* How many receivers should we use? */
1158	active_rx_cnt = il4965_get_active_rx_chain_count(il);
1159	idle_rx_cnt = il4965_get_idle_rx_chain_count(il, active_cnt: active_rx_cnt);
1160
1161	/* correct rx chain count according hw settings
1162	* and chain noise calibration
1163	*/
1164	valid_rx_cnt = il4965_count_chain_bitmap(chain_bitmap: active_chains);
1165	if (valid_rx_cnt < active_rx_cnt)
1166	active_rx_cnt = valid_rx_cnt;
1167
1168	if (valid_rx_cnt < idle_rx_cnt)
1169	idle_rx_cnt = valid_rx_cnt;
1170
1171	rx_chain |= active_rx_cnt << RXON_RX_CHAIN_MIMO_CNT_POS;
1172	rx_chain |= idle_rx_cnt << RXON_RX_CHAIN_CNT_POS;
1173
1174	il->staging.rx_chain = cpu_to_le16(rx_chain);
1175
1176	if (!is_single && active_rx_cnt >= IL_NUM_RX_CHAINS_SINGLE && is_cam)
1177	il->staging.rx_chain |= RXON_RX_CHAIN_MIMO_FORCE_MSK;
1178	else
1179	il->staging.rx_chain &= ~RXON_RX_CHAIN_MIMO_FORCE_MSK;
1180
1181	D_ASSOC("rx_chain=0x%X active=%d idle=%d\n", il->staging.rx_chain,
1182	active_rx_cnt, idle_rx_cnt);
1183
1184	WARN_ON(active_rx_cnt == 0 || idle_rx_cnt == 0 ||
1185	active_rx_cnt < idle_rx_cnt);
1186	}
1187
1188	static const char *
1189	il4965_get_fh_string(int cmd)
1190	{
1191	switch (cmd) {
1192	IL_CMD(FH49_RSCSR_CHNL0_STTS_WPTR_REG);
1193	IL_CMD(FH49_RSCSR_CHNL0_RBDCB_BASE_REG);
1194	IL_CMD(FH49_RSCSR_CHNL0_WPTR);
1195	IL_CMD(FH49_MEM_RCSR_CHNL0_CONFIG_REG);
1196	IL_CMD(FH49_MEM_RSSR_SHARED_CTRL_REG);
1197	IL_CMD(FH49_MEM_RSSR_RX_STATUS_REG);
1198	IL_CMD(FH49_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV);
1199	IL_CMD(FH49_TSSR_TX_STATUS_REG);
1200	IL_CMD(FH49_TSSR_TX_ERROR_REG);
1201	default:
1202	return "UNKNOWN";
1203	}
1204	}
1205
1206	int
1207	il4965_dump_fh(struct il_priv *il, char **buf, bool display)
1208	{
1209	int i;
1210	#ifdef CONFIG_IWLEGACY_DEBUG
1211	int pos = 0;
1212	size_t bufsz = 0;
1213	#endif
1214	static const u32 fh_tbl[] = {
1215	FH49_RSCSR_CHNL0_STTS_WPTR_REG,
1216	FH49_RSCSR_CHNL0_RBDCB_BASE_REG,
1217	FH49_RSCSR_CHNL0_WPTR,
1218	FH49_MEM_RCSR_CHNL0_CONFIG_REG,
1219	FH49_MEM_RSSR_SHARED_CTRL_REG,
1220	FH49_MEM_RSSR_RX_STATUS_REG,
1221	FH49_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV,
1222	FH49_TSSR_TX_STATUS_REG,
1223	FH49_TSSR_TX_ERROR_REG
1224	};
1225	#ifdef CONFIG_IWLEGACY_DEBUG
1226	if (display) {
1227	bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
1228	*buf = kmalloc(size: bufsz, GFP_KERNEL);
1229	if (!*buf)
1230	return -ENOMEM;
1231	pos +=
1232	scnprintf(buf: *buf + pos, size: bufsz - pos, fmt: "FH register values:\n");
1233	for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
1234	pos +=
1235	scnprintf(buf: *buf + pos, size: bufsz - pos,
1236	fmt: " %34s: 0X%08x\n",
1237	il4965_get_fh_string(cmd: fh_tbl[i]),
1238	il_rd(il, reg: fh_tbl[i]));
1239	}
1240	return pos;
1241	}
1242	#endif
1243	IL_ERR("FH register values:\n");
1244	for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
1245	IL_ERR(" %34s: 0X%08x\n", il4965_get_fh_string(fh_tbl[i]),
1246	il_rd(il, fh_tbl[i]));
1247	}
1248	return 0;
1249	}
1250
1251	static void
1252	il4965_hdl_missed_beacon(struct il_priv *il, struct il_rx_buf *rxb)
1253	{
1254	struct il_rx_pkt *pkt = rxb_addr(rxb);
1255	struct il_missed_beacon_notif *missed_beacon;
1256
1257	missed_beacon = &pkt->u.missed_beacon;
1258	if (le32_to_cpu(missed_beacon->consecutive_missed_beacons) >
1259	il->missed_beacon_threshold) {
1260	D_CALIB("missed bcn cnsq %d totl %d rcd %d expctd %d\n",
1261	le32_to_cpu(missed_beacon->consecutive_missed_beacons),
1262	le32_to_cpu(missed_beacon->total_missed_becons),
1263	le32_to_cpu(missed_beacon->num_recvd_beacons),
1264	le32_to_cpu(missed_beacon->num_expected_beacons));
1265	if (!test_bit(S_SCANNING, &il->status))
1266	il4965_init_sensitivity(il);
1267	}
1268	}
1269
1270	/* Calculate noise level, based on measurements during network silence just
1271	* before arriving beacon. This measurement can be done only if we know
1272	* exactly when to expect beacons, therefore only when we're associated. */
1273	static void
1274	il4965_rx_calc_noise(struct il_priv *il)
1275	{
1276	struct stats_rx_non_phy *rx_info;
1277	int num_active_rx = 0;
1278	int total_silence = 0;
1279	int bcn_silence_a, bcn_silence_b, bcn_silence_c;
1280	int last_rx_noise;
1281
1282	rx_info = &(il->_4965.stats.rx.general);
1283	bcn_silence_a =
1284	le32_to_cpu(rx_info->beacon_silence_rssi_a) & IN_BAND_FILTER;
1285	bcn_silence_b =
1286	le32_to_cpu(rx_info->beacon_silence_rssi_b) & IN_BAND_FILTER;
1287	bcn_silence_c =
1288	le32_to_cpu(rx_info->beacon_silence_rssi_c) & IN_BAND_FILTER;
1289
1290	if (bcn_silence_a) {
1291	total_silence += bcn_silence_a;
1292	num_active_rx++;
1293	}
1294	if (bcn_silence_b) {
1295	total_silence += bcn_silence_b;
1296	num_active_rx++;
1297	}
1298	if (bcn_silence_c) {
1299	total_silence += bcn_silence_c;
1300	num_active_rx++;
1301	}
1302
1303	/* Average among active antennas */
1304	if (num_active_rx)
1305	last_rx_noise = (total_silence / num_active_rx) - 107;
1306	else
1307	last_rx_noise = IL_NOISE_MEAS_NOT_AVAILABLE;
1308
1309	D_CALIB("inband silence a %u, b %u, c %u, dBm %d\n", bcn_silence_a,
1310	bcn_silence_b, bcn_silence_c, last_rx_noise);
1311	}
1312
1313	#ifdef CONFIG_IWLEGACY_DEBUGFS
1314	/*
1315	* based on the assumption of all stats counter are in DWORD
1316	* FIXME: This function is for debugging, do not deal with
1317	* the case of counters roll-over.
1318	*/
1319	static void
1320	il4965_accumulative_stats(struct il_priv *il, __le32 * stats)
1321	{
1322	int i, size;
1323	__le32 *prev_stats;
1324	u32 *accum_stats;
1325	u32 *delta, *max_delta;
1326	struct stats_general_common *general, *accum_general;
1327
1328	prev_stats = (__le32 *) &il->_4965.stats;
1329	accum_stats = (u32 *) &il->_4965.accum_stats;
1330	size = sizeof(struct il_notif_stats);
1331	general = &il->_4965.stats.general.common;
1332	accum_general = &il->_4965.accum_stats.general.common;
1333	delta = (u32 *) &il->_4965.delta_stats;
1334	max_delta = (u32 *) &il->_4965.max_delta;
1335
1336	for (i = sizeof(__le32); i < size;
1337	i +=
1338	sizeof(__le32), stats++, prev_stats++, delta++, max_delta++,
1339	accum_stats++) {
1340	if (le32_to_cpu(*stats) > le32_to_cpu(*prev_stats)) {
1341	*delta =
1342	(le32_to_cpu(*stats) - le32_to_cpu(*prev_stats));
1343	*accum_stats += *delta;
1344	if (*delta > *max_delta)
1345	*max_delta = *delta;
1346	}
1347	}
1348
1349	/* reset accumulative stats for "no-counter" type stats */
1350	accum_general->temperature = general->temperature;
1351	accum_general->ttl_timestamp = general->ttl_timestamp;
1352	}
1353	#endif
1354
1355	static void
1356	il4965_hdl_stats(struct il_priv *il, struct il_rx_buf *rxb)
1357	{
1358	const int recalib_seconds = 60;
1359	bool change;
1360	struct il_rx_pkt *pkt = rxb_addr(rxb);
1361
1362	D_RX("Statistics notification received (%d vs %d).\n",
1363	(int)sizeof(struct il_notif_stats),
1364	le32_to_cpu(pkt->len_n_flags) & IL_RX_FRAME_SIZE_MSK);
1365
1366	change =
1367	((il->_4965.stats.general.common.temperature !=
1368	pkt->u.stats.general.common.temperature) ||
1369	((il->_4965.stats.flag & STATS_REPLY_FLG_HT40_MODE_MSK) !=
1370	(pkt->u.stats.flag & STATS_REPLY_FLG_HT40_MODE_MSK)));
1371	#ifdef CONFIG_IWLEGACY_DEBUGFS
1372	il4965_accumulative_stats(il, stats: (__le32 *) &pkt->u.stats);
1373	#endif
1374
1375	/* TODO: reading some of stats is unneeded */
1376	memcpy(&il->_4965.stats, &pkt->u.stats, sizeof(il->_4965.stats));
1377
1378	set_bit(S_STATS, addr: &il->status);
1379
1380	/*
1381	* Reschedule the stats timer to occur in recalib_seconds to ensure
1382	* we get a thermal update even if the uCode doesn't give us one
1383	*/
1384	mod_timer(timer: &il->stats_periodic,
1385	expires: jiffies + msecs_to_jiffies(m: recalib_seconds * 1000));
1386
1387	if (unlikely(!test_bit(S_SCANNING, &il->status)) &&
1388	(pkt->hdr.cmd == N_STATS)) {
1389	il4965_rx_calc_noise(il);
1390	queue_work(wq: il->workqueue, work: &il->run_time_calib_work);
1391	}
1392
1393	if (change)
1394	il4965_temperature_calib(il);
1395	}
1396
1397	static void
1398	il4965_hdl_c_stats(struct il_priv *il, struct il_rx_buf *rxb)
1399	{
1400	struct il_rx_pkt *pkt = rxb_addr(rxb);
1401
1402	if (le32_to_cpu(pkt->u.stats.flag) & UCODE_STATS_CLEAR_MSK) {
1403	#ifdef CONFIG_IWLEGACY_DEBUGFS
1404	memset(&il->_4965.accum_stats, 0,
1405	sizeof(struct il_notif_stats));
1406	memset(&il->_4965.delta_stats, 0,
1407	sizeof(struct il_notif_stats));
1408	memset(&il->_4965.max_delta, 0, sizeof(struct il_notif_stats));
1409	#endif
1410	D_RX("Statistics have been cleared\n");
1411	}
1412	il4965_hdl_stats(il, rxb);
1413	}
1414
1415
1416	/*
1417	* mac80211 queues, ACs, hardware queues, FIFOs.
1418	*
1419	* Cf. https://wireless.wiki.kernel.org/en/developers/Documentation/mac80211/queues
1420	*
1421	* Mac80211 uses the following numbers, which we get as from it
1422	* by way of skb_get_queue_mapping(skb):
1423	*
1424	* VO 0
1425	* VI 1
1426	* BE 2
1427	* BK 3
1428	*
1429	*
1430	* Regular (not A-MPDU) frames are put into hardware queues corresponding
1431	* to the FIFOs, see comments in iwl-prph.h. Aggregated frames get their
1432	* own queue per aggregation session (RA/TID combination), such queues are
1433	* set up to map into FIFOs too, for which we need an AC->FIFO mapping. In
1434	* order to map frames to the right queue, we also need an AC->hw queue
1435	* mapping. This is implemented here.
1436	*
1437	* Due to the way hw queues are set up (by the hw specific modules like
1438	* 4965.c), the AC->hw queue mapping is the identity
1439	* mapping.
1440	*/
1441
1442	static const u8 tid_to_ac[] = {
1443	IEEE80211_AC_BE,
1444	IEEE80211_AC_BK,
1445	IEEE80211_AC_BK,
1446	IEEE80211_AC_BE,
1447	IEEE80211_AC_VI,
1448	IEEE80211_AC_VI,
1449	IEEE80211_AC_VO,
1450	IEEE80211_AC_VO
1451	};
1452
1453	static inline int
1454	il4965_get_ac_from_tid(u16 tid)
1455	{
1456	if (likely(tid < ARRAY_SIZE(tid_to_ac)))
1457	return tid_to_ac[tid];
1458
1459	/* no support for TIDs 8-15 yet */
1460	return -EINVAL;
1461	}
1462
1463	static inline int
1464	il4965_get_fifo_from_tid(u16 tid)
1465	{
1466	static const u8 ac_to_fifo[] = {
1467	IL_TX_FIFO_VO,
1468	IL_TX_FIFO_VI,
1469	IL_TX_FIFO_BE,
1470	IL_TX_FIFO_BK,
1471	};
1472
1473	if (likely(tid < ARRAY_SIZE(tid_to_ac)))
1474	return ac_to_fifo[tid_to_ac[tid]];
1475
1476	/* no support for TIDs 8-15 yet */
1477	return -EINVAL;
1478	}
1479
1480	/*
1481	* handle build C_TX command notification.
1482	*/
1483	static void
1484	il4965_tx_cmd_build_basic(struct il_priv *il, struct sk_buff *skb,
1485	struct il_tx_cmd *tx_cmd,
1486	struct ieee80211_tx_info *info,
1487	struct ieee80211_hdr *hdr, u8 std_id)
1488	{
1489	__le16 fc = hdr->frame_control;
1490	__le32 tx_flags = tx_cmd->tx_flags;
1491
1492	tx_cmd->stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
1493	if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
1494	tx_flags |= TX_CMD_FLG_ACK_MSK;
1495	if (ieee80211_is_mgmt(fc))
1496	tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
1497	if (ieee80211_is_probe_resp(fc) &&
1498	!(le16_to_cpu(hdr->seq_ctrl) & 0xf))
1499	tx_flags |= TX_CMD_FLG_TSF_MSK;
1500	} else {
1501	tx_flags &= (~TX_CMD_FLG_ACK_MSK);
1502	tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
1503	}
1504
1505	if (ieee80211_is_back_req(fc))
1506	tx_flags |= TX_CMD_FLG_ACK_MSK | TX_CMD_FLG_IMM_BA_RSP_MASK;
1507
1508	tx_cmd->sta_id = std_id;
1509	if (ieee80211_has_morefrags(fc))
1510	tx_flags |= TX_CMD_FLG_MORE_FRAG_MSK;
1511
1512	if (ieee80211_is_data_qos(fc)) {
1513	u8 *qc = ieee80211_get_qos_ctl(hdr);
1514	tx_cmd->tid_tspec = qc[0] & 0xf;
1515	tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
1516	} else {
1517	tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
1518	}
1519
1520	il_tx_cmd_protection(il, info, fc, tx_flags: &tx_flags);
1521
1522	tx_flags &= ~(TX_CMD_FLG_ANT_SEL_MSK);
1523	if (ieee80211_is_mgmt(fc)) {
1524	if (ieee80211_is_assoc_req(fc) || ieee80211_is_reassoc_req(fc))
1525	tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(3);
1526	else
1527	tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(2);
1528	} else {
1529	tx_cmd->timeout.pm_frame_timeout = 0;
1530	}
1531
1532	tx_cmd->driver_txop = 0;
1533	tx_cmd->tx_flags = tx_flags;
1534	tx_cmd->next_frame_len = 0;
1535	}
1536
1537	static void
1538	il4965_tx_cmd_build_rate(struct il_priv *il,
1539	struct il_tx_cmd *tx_cmd,
1540	struct ieee80211_tx_info *info,
1541	struct ieee80211_sta *sta,
1542	__le16 fc)
1543	{
1544	const u8 rts_retry_limit = 60;
1545	u32 rate_flags;
1546	int rate_idx;
1547	u8 data_retry_limit;
1548	u8 rate_plcp;
1549
1550	/* Set retry limit on DATA packets and Probe Responses */
1551	if (ieee80211_is_probe_resp(fc))
1552	data_retry_limit = 3;
1553	else
1554	data_retry_limit = IL4965_DEFAULT_TX_RETRY;
1555	tx_cmd->data_retry_limit = data_retry_limit;
1556	/* Set retry limit on RTS packets */
1557	tx_cmd->rts_retry_limit = min(data_retry_limit, rts_retry_limit);
1558
1559	/* DATA packets will use the uCode station table for rate/antenna
1560	* selection */
1561	if (ieee80211_is_data(fc)) {
1562	tx_cmd->initial_rate_idx = 0;
1563	tx_cmd->tx_flags |= TX_CMD_FLG_STA_RATE_MSK;
1564	return;
1565	}
1566
1567	/**
1568	* If the current TX rate stored in mac80211 has the MCS bit set, it's
1569	* not really a TX rate. Thus, we use the lowest supported rate for
1570	* this band. Also use the lowest supported rate if the stored rate
1571	* idx is invalid.
1572	*/
1573	rate_idx = info->control.rates[0].idx;
1574	if ((info->control.rates[0].flags & IEEE80211_TX_RC_MCS) || rate_idx < 0
1575	|| rate_idx > RATE_COUNT_LEGACY)
1576	rate_idx = rate_lowest_index(sband: &il->bands[info->band], sta);
1577	/* For 5 GHZ band, remap mac80211 rate indices into driver indices */
1578	if (info->band == NL80211_BAND_5GHZ)
1579	rate_idx += IL_FIRST_OFDM_RATE;
1580	/* Get PLCP rate for tx_cmd->rate_n_flags */
1581	rate_plcp = il_rates[rate_idx].plcp;
1582	/* Zero out flags for this packet */
1583	rate_flags = 0;
1584
1585	/* Set CCK flag as needed */
1586	if (rate_idx >= IL_FIRST_CCK_RATE && rate_idx <= IL_LAST_CCK_RATE)
1587	rate_flags |= RATE_MCS_CCK_MSK;
1588
1589	/* Set up antennas */
1590	il4965_toggle_tx_ant(il, ant: &il->mgmt_tx_ant, valid: il->hw_params.valid_tx_ant);
1591	rate_flags |= BIT(il->mgmt_tx_ant) << RATE_MCS_ANT_POS;
1592
1593	/* Set the rate in the TX cmd */
1594	tx_cmd->rate_n_flags = cpu_to_le32(rate_plcp | rate_flags);
1595	}
1596
1597	static void
1598	il4965_tx_cmd_build_hwcrypto(struct il_priv *il, struct ieee80211_tx_info *info,
1599	struct il_tx_cmd *tx_cmd, struct sk_buff *skb_frag,
1600	int sta_id)
1601	{
1602	struct ieee80211_key_conf *keyconf = info->control.hw_key;
1603
1604	switch (keyconf->cipher) {
1605	case WLAN_CIPHER_SUITE_CCMP:
1606	tx_cmd->sec_ctl = TX_CMD_SEC_CCM;
1607	memcpy(tx_cmd->key, keyconf->key, keyconf->keylen);
1608	if (info->flags & IEEE80211_TX_CTL_AMPDU)
1609	tx_cmd->tx_flags |= TX_CMD_FLG_AGG_CCMP_MSK;
1610	D_TX("tx_cmd with AES hwcrypto\n");
1611	break;
1612
1613	case WLAN_CIPHER_SUITE_TKIP:
1614	tx_cmd->sec_ctl = TX_CMD_SEC_TKIP;
1615	ieee80211_get_tkip_p2k(keyconf, skb: skb_frag, p2k: tx_cmd->key);
1616	D_TX("tx_cmd with tkip hwcrypto\n");
1617	break;
1618
1619	case WLAN_CIPHER_SUITE_WEP104:
1620	tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
1621	fallthrough;
1622	case WLAN_CIPHER_SUITE_WEP40:
1623	tx_cmd->sec_ctl |=
1624	(TX_CMD_SEC_WEP | (keyconf->keyidx & TX_CMD_SEC_MSK) <<
1625	TX_CMD_SEC_SHIFT);
1626
1627	memcpy(&tx_cmd->key[3], keyconf->key, keyconf->keylen);
1628
1629	D_TX("Configuring packet for WEP encryption " "with key %d\n",
1630	keyconf->keyidx);
1631	break;
1632
1633	default:
1634	IL_ERR("Unknown encode cipher %x\n", keyconf->cipher);
1635	break;
1636	}
1637	}
1638
1639	/*
1640	* start C_TX command process
1641	*/
1642	int
1643	il4965_tx_skb(struct il_priv *il,
1644	struct ieee80211_sta *sta,
1645	struct sk_buff *skb)
1646	{
1647	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1648	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1649	struct il_station_priv *sta_priv = NULL;
1650	struct il_tx_queue *txq;
1651	struct il_queue *q;
1652	struct il_device_cmd *out_cmd;
1653	struct il_cmd_meta *out_meta;
1654	struct il_tx_cmd *tx_cmd;
1655	int txq_id;
1656	dma_addr_t phys_addr;
1657	dma_addr_t txcmd_phys;
1658	dma_addr_t scratch_phys;
1659	u16 len, firstlen, secondlen;
1660	u16 seq_number = 0;
1661	__le16 fc;
1662	u8 hdr_len;
1663	u8 sta_id;
1664	u8 wait_write_ptr = 0;
1665	u8 tid = 0;
1666	u8 *qc = NULL;
1667	unsigned long flags;
1668	bool is_agg = false;
1669
1670	spin_lock_irqsave(&il->lock, flags);
1671	if (il_is_rfkill(il)) {
1672	D_DROP("Dropping - RF KILL\n");
1673	goto drop_unlock;
1674	}
1675
1676	fc = hdr->frame_control;
1677
1678	#ifdef CONFIG_IWLEGACY_DEBUG
1679	if (ieee80211_is_auth(fc))
1680	D_TX("Sending AUTH frame\n");
1681	else if (ieee80211_is_assoc_req(fc))
1682	D_TX("Sending ASSOC frame\n");
1683	else if (ieee80211_is_reassoc_req(fc))
1684	D_TX("Sending REASSOC frame\n");
1685	#endif
1686
1687	hdr_len = ieee80211_hdrlen(fc);
1688
1689	/* For management frames use broadcast id to do not break aggregation */
1690	if (!ieee80211_is_data(fc))
1691	sta_id = il->hw_params.bcast_id;
1692	else {
1693	/* Find idx into station table for destination station */
1694	sta_id = il_sta_id_or_broadcast(il, sta);
1695
1696	if (sta_id == IL_INVALID_STATION) {
1697	D_DROP("Dropping - INVALID STATION: %pM\n", hdr->addr1);
1698	goto drop_unlock;
1699	}
1700	}
1701
1702	D_TX("station Id %d\n", sta_id);
1703
1704	if (sta)
1705	sta_priv = (void *)sta->drv_priv;
1706
1707	if (sta_priv && sta_priv->asleep &&
1708	(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER)) {
1709	/*
1710	* This sends an asynchronous command to the device,
1711	* but we can rely on it being processed before the
1712	* next frame is processed -- and the next frame to
1713	* this station is the one that will consume this
1714	* counter.
1715	* For now set the counter to just 1 since we do not
1716	* support uAPSD yet.
1717	*/
1718	il4965_sta_modify_sleep_tx_count(il, sta_id, cnt: 1);
1719	}
1720
1721	/* FIXME: remove me ? */
1722	WARN_ON_ONCE(info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM);
1723
1724	/* Access category (AC) is also the queue number */
1725	txq_id = skb_get_queue_mapping(skb);
1726
1727	/* irqs already disabled/saved above when locking il->lock */
1728	spin_lock(lock: &il->sta_lock);
1729
1730	if (ieee80211_is_data_qos(fc)) {
1731	qc = ieee80211_get_qos_ctl(hdr);
1732	tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
1733	if (WARN_ON_ONCE(tid >= MAX_TID_COUNT)) {
1734	spin_unlock(lock: &il->sta_lock);
1735	goto drop_unlock;
1736	}
1737	seq_number = il->stations[sta_id].tid[tid].seq_number;
1738	seq_number &= IEEE80211_SCTL_SEQ;
1739	hdr->seq_ctrl =
1740	hdr->seq_ctrl & cpu_to_le16(IEEE80211_SCTL_FRAG);
1741	hdr->seq_ctrl |= cpu_to_le16(seq_number);
1742	seq_number += 0x10;
1743	/* aggregation is on for this <sta,tid> */
1744	if (info->flags & IEEE80211_TX_CTL_AMPDU &&
1745	il->stations[sta_id].tid[tid].agg.state == IL_AGG_ON) {
1746	txq_id = il->stations[sta_id].tid[tid].agg.txq_id;
1747	is_agg = true;
1748	}
1749	}
1750
1751	txq = &il->txq[txq_id];
1752	q = &txq->q;
1753
1754	if (unlikely(il_queue_space(q) < q->high_mark)) {
1755	spin_unlock(lock: &il->sta_lock);
1756	goto drop_unlock;
1757	}
1758
1759	if (ieee80211_is_data_qos(fc)) {
1760	il->stations[sta_id].tid[tid].tfds_in_queue++;
1761	if (!ieee80211_has_morefrags(fc))
1762	il->stations[sta_id].tid[tid].seq_number = seq_number;
1763	}
1764
1765	spin_unlock(lock: &il->sta_lock);
1766
1767	txq->skbs[q->write_ptr] = skb;
1768
1769	/* Set up first empty entry in queue's array of Tx/cmd buffers */
1770	out_cmd = txq->cmd[q->write_ptr];
1771	out_meta = &txq->meta[q->write_ptr];
1772	tx_cmd = &out_cmd->cmd.tx;
1773	memset(&out_cmd->hdr, 0, sizeof(out_cmd->hdr));
1774	memset(tx_cmd, 0, sizeof(struct il_tx_cmd));
1775
1776	/*
1777	* Set up the Tx-command (not MAC!) header.
1778	* Store the chosen Tx queue and TFD idx within the sequence field;
1779	* after Tx, uCode's Tx response will return this value so driver can
1780	* locate the frame within the tx queue and do post-tx processing.
1781	*/
1782	out_cmd->hdr.cmd = C_TX;
1783	out_cmd->hdr.sequence =
1784	cpu_to_le16((u16)
1785	(QUEUE_TO_SEQ(txq_id) | IDX_TO_SEQ(q->write_ptr)));
1786
1787	/* Copy MAC header from skb into command buffer */
1788	memcpy(tx_cmd->hdr, hdr, hdr_len);
1789
1790	/* Total # bytes to be transmitted */
1791	tx_cmd->len = cpu_to_le16((u16) skb->len);
1792
1793	if (info->control.hw_key)
1794	il4965_tx_cmd_build_hwcrypto(il, info, tx_cmd, skb_frag: skb, sta_id);
1795
1796	/* TODO need this for burst mode later on */
1797	il4965_tx_cmd_build_basic(il, skb, tx_cmd, info, hdr, std_id: sta_id);
1798
1799	il4965_tx_cmd_build_rate(il, tx_cmd, info, sta, fc);
1800
1801	/*
1802	* Use the first empty entry in this queue's command buffer array
1803	* to contain the Tx command and MAC header concatenated together
1804	* (payload data will be in another buffer).
1805	* Size of this varies, due to varying MAC header length.
1806	* If end is not dword aligned, we'll have 2 extra bytes at the end
1807	* of the MAC header (device reads on dword boundaries).
1808	* We'll tell device about this padding later.
1809	*/
1810	len = sizeof(struct il_tx_cmd) + sizeof(struct il_cmd_header) + hdr_len;
1811	firstlen = (len + 3) & ~3;
1812
1813	/* Tell NIC about any 2-byte padding after MAC header */
1814	if (firstlen != len)
1815	tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
1816
1817	/* Physical address of this Tx command's header (not MAC header!),
1818	* within command buffer array. */
1819	txcmd_phys = dma_map_single(&il->pci_dev->dev, &out_cmd->hdr, firstlen,
1820	DMA_BIDIRECTIONAL);
1821	if (unlikely(dma_mapping_error(&il->pci_dev->dev, txcmd_phys)))
1822	goto drop_unlock;
1823
1824	/* Set up TFD's 2nd entry to point directly to remainder of skb,
1825	* if any (802.11 null frames have no payload). */
1826	secondlen = skb->len - hdr_len;
1827	if (secondlen > 0) {
1828	phys_addr = dma_map_single(&il->pci_dev->dev, skb->data + hdr_len,
1829	secondlen, DMA_TO_DEVICE);
1830	if (unlikely(dma_mapping_error(&il->pci_dev->dev, phys_addr)))
1831	goto drop_unlock;
1832	}
1833
1834	/* Add buffer containing Tx command and MAC(!) header to TFD's
1835	* first entry */
1836	il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, firstlen, 1, 0);
1837	dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
1838	dma_unmap_len_set(out_meta, len, firstlen);
1839	if (secondlen)
1840	il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, secondlen,
1841	0, 0);
1842
1843	if (!ieee80211_has_morefrags(fc: hdr->frame_control)) {
1844	txq->need_update = 1;
1845	} else {
1846	wait_write_ptr = 1;
1847	txq->need_update = 0;
1848	}
1849
1850	scratch_phys =
1851	txcmd_phys + sizeof(struct il_cmd_header) +
1852	offsetof(struct il_tx_cmd, scratch);
1853
1854	/* take back ownership of DMA buffer to enable update */
1855	dma_sync_single_for_cpu(dev: &il->pci_dev->dev, addr: txcmd_phys, size: firstlen,
1856	dir: DMA_BIDIRECTIONAL);
1857	tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
1858	tx_cmd->dram_msb_ptr = il_get_dma_hi_addr(addr: scratch_phys);
1859
1860	il_update_stats(il, is_tx: true, fc, len: skb->len);
1861
1862	D_TX("sequence nr = 0X%x\n", le16_to_cpu(out_cmd->hdr.sequence));
1863	D_TX("tx_flags = 0X%x\n", le32_to_cpu(tx_cmd->tx_flags));
1864	il_print_hex_dump(il, IL_DL_TX, (u8 *) tx_cmd, sizeof(*tx_cmd));
1865	il_print_hex_dump(il, IL_DL_TX, (u8 *) tx_cmd->hdr, hdr_len);
1866
1867	/* Set up entry for this TFD in Tx byte-count array */
1868	if (info->flags & IEEE80211_TX_CTL_AMPDU)
1869	il->ops->txq_update_byte_cnt_tbl(il, txq, le16_to_cpu(tx_cmd->len));
1870
1871	dma_sync_single_for_device(dev: &il->pci_dev->dev, addr: txcmd_phys, size: firstlen,
1872	dir: DMA_BIDIRECTIONAL);
1873
1874	/* Tell device the write idx *just past* this latest filled TFD */
1875	q->write_ptr = il_queue_inc_wrap(idx: q->write_ptr, n_bd: q->n_bd);
1876	il_txq_update_write_ptr(il, txq);
1877	spin_unlock_irqrestore(lock: &il->lock, flags);
1878
1879	/*
1880	* At this point the frame is "transmitted" successfully
1881	* and we will get a TX status notification eventually,
1882	* regardless of the value of ret. "ret" only indicates
1883	* whether or not we should update the write pointer.
1884	*/
1885
1886	/*
1887	* Avoid atomic ops if it isn't an associated client.
1888	* Also, if this is a packet for aggregation, don't
1889	* increase the counter because the ucode will stop
1890	* aggregation queues when their respective station
1891	* goes to sleep.
1892	*/
1893	if (sta_priv && sta_priv->client && !is_agg)
1894	atomic_inc(v: &sta_priv->pending_frames);
1895
1896	if (il_queue_space(q) < q->high_mark && il->mac80211_registered) {
1897	if (wait_write_ptr) {
1898	spin_lock_irqsave(&il->lock, flags);
1899	txq->need_update = 1;
1900	il_txq_update_write_ptr(il, txq);
1901	spin_unlock_irqrestore(lock: &il->lock, flags);
1902	} else {
1903	il_stop_queue(il, txq);
1904	}
1905	}
1906
1907	return 0;
1908
1909	drop_unlock:
1910	spin_unlock_irqrestore(lock: &il->lock, flags);
1911	return -1;
1912	}
1913
1914	static inline int
1915	il4965_alloc_dma_ptr(struct il_priv *il, struct il_dma_ptr *ptr, size_t size)
1916	{
1917	ptr->addr = dma_alloc_coherent(dev: &il->pci_dev->dev, size, dma_handle: &ptr->dma,
1918	GFP_KERNEL);
1919	if (!ptr->addr)
1920	return -ENOMEM;
1921	ptr->size = size;
1922	return 0;
1923	}
1924
1925	static inline void
1926	il4965_free_dma_ptr(struct il_priv *il, struct il_dma_ptr *ptr)
1927	{
1928	if (unlikely(!ptr->addr))
1929	return;
1930
1931	dma_free_coherent(dev: &il->pci_dev->dev, size: ptr->size, cpu_addr: ptr->addr, dma_handle: ptr->dma);
1932	memset(ptr, 0, sizeof(*ptr));
1933	}
1934
1935	/*
1936	* il4965_hw_txq_ctx_free - Free TXQ Context
1937	*
1938	* Destroy all TX DMA queues and structures
1939	*/
1940	void
1941	il4965_hw_txq_ctx_free(struct il_priv *il)
1942	{
1943	int txq_id;
1944
1945	/* Tx queues */
1946	if (il->txq) {
1947	for (txq_id = 0; txq_id < il->hw_params.max_txq_num; txq_id++)
1948	if (txq_id == il->cmd_queue)
1949	il_cmd_queue_free(il);
1950	else
1951	il_tx_queue_free(il, txq_id);
1952	}
1953	il4965_free_dma_ptr(il, ptr: &il->kw);
1954
1955	il4965_free_dma_ptr(il, ptr: &il->scd_bc_tbls);
1956
1957	/* free tx queue structure */
1958	il_free_txq_mem(il);
1959	}
1960
1961	/*
1962	* il4965_txq_ctx_alloc - allocate TX queue context
1963	* Allocate all Tx DMA structures and initialize them
1964	*/
1965	int
1966	il4965_txq_ctx_alloc(struct il_priv *il)
1967	{
1968	int ret, txq_id;
1969	unsigned long flags;
1970
1971	/* Free all tx/cmd queues and keep-warm buffer */
1972	il4965_hw_txq_ctx_free(il);
1973
1974	ret =
1975	il4965_alloc_dma_ptr(il, ptr: &il->scd_bc_tbls,
1976	size: il->hw_params.scd_bc_tbls_size);
1977	if (ret) {
1978	IL_ERR("Scheduler BC Table allocation failed\n");
1979	goto error_bc_tbls;
1980	}
1981	/* Alloc keep-warm buffer */
1982	ret = il4965_alloc_dma_ptr(il, ptr: &il->kw, IL_KW_SIZE);
1983	if (ret) {
1984	IL_ERR("Keep Warm allocation failed\n");
1985	goto error_kw;
1986	}
1987
1988	/* allocate tx queue structure */
1989	ret = il_alloc_txq_mem(il);
1990	if (ret)
1991	goto error;
1992
1993	spin_lock_irqsave(&il->lock, flags);
1994
1995	/* Turn off all Tx DMA fifos */
1996	il4965_txq_set_sched(il, mask: 0);
1997
1998	/* Tell NIC where to find the "keep warm" buffer */
1999	il_wr(il, FH49_KW_MEM_ADDR_REG, value: il->kw.dma >> 4);
2000
2001	spin_unlock_irqrestore(lock: &il->lock, flags);
2002
2003	/* Alloc and init all Tx queues, including the command queue (#4/#9) */
2004	for (txq_id = 0; txq_id < il->hw_params.max_txq_num; txq_id++) {
2005	ret = il_tx_queue_init(il, txq_id);
2006	if (ret) {
2007	IL_ERR("Tx %d queue init failed\n", txq_id);
2008	goto error;
2009	}
2010	}
2011
2012	return ret;
2013
2014	error:
2015	il4965_hw_txq_ctx_free(il);
2016	il4965_free_dma_ptr(il, ptr: &il->kw);
2017	error_kw:
2018	il4965_free_dma_ptr(il, ptr: &il->scd_bc_tbls);
2019	error_bc_tbls:
2020	return ret;
2021	}
2022
2023	void
2024	il4965_txq_ctx_reset(struct il_priv *il)
2025	{
2026	int txq_id;
2027	unsigned long flags;
2028
2029	spin_lock_irqsave(&il->lock, flags);
2030
2031	/* Turn off all Tx DMA fifos */
2032	il4965_txq_set_sched(il, mask: 0);
2033	/* Tell NIC where to find the "keep warm" buffer */
2034	il_wr(il, FH49_KW_MEM_ADDR_REG, value: il->kw.dma >> 4);
2035
2036	spin_unlock_irqrestore(lock: &il->lock, flags);
2037
2038	/* Alloc and init all Tx queues, including the command queue (#4) */
2039	for (txq_id = 0; txq_id < il->hw_params.max_txq_num; txq_id++)
2040	il_tx_queue_reset(il, txq_id);
2041	}
2042
2043	static void
2044	il4965_txq_ctx_unmap(struct il_priv *il)
2045	{
2046	int txq_id;
2047
2048	if (!il->txq)
2049	return;
2050
2051	/* Unmap DMA from host system and free skb's */
2052	for (txq_id = 0; txq_id < il->hw_params.max_txq_num; txq_id++)
2053	if (txq_id == il->cmd_queue)
2054	il_cmd_queue_unmap(il);
2055	else
2056	il_tx_queue_unmap(il, txq_id);
2057	}
2058
2059	/*
2060	* il4965_txq_ctx_stop - Stop all Tx DMA channels
2061	*/
2062	void
2063	il4965_txq_ctx_stop(struct il_priv *il)
2064	{
2065	int ch, ret;
2066
2067	_il_wr_prph(il, IL49_SCD_TXFACT, val: 0);
2068
2069	/* Stop each Tx DMA channel, and wait for it to be idle */
2070	for (ch = 0; ch < il->hw_params.dma_chnl_num; ch++) {
2071	_il_wr(il, FH49_TCSR_CHNL_TX_CONFIG_REG(ch), val: 0x0);
2072	ret =
2073	_il_poll_bit(il, FH49_TSSR_TX_STATUS_REG,
2074	FH49_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch),
2075	FH49_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch),
2076	timeout: 1000);
2077	if (ret < 0)
2078	IL_ERR("Timeout stopping DMA channel %d [0x%08x]",
2079	ch, _il_rd(il, FH49_TSSR_TX_STATUS_REG));
2080	}
2081	}
2082
2083	/*
2084	* Find first available (lowest unused) Tx Queue, mark it "active".
2085	* Called only when finding queue for aggregation.
2086	* Should never return anything < 7, because they should already
2087	* be in use as EDCA AC (0-3), Command (4), reserved (5, 6)
2088	*/
2089	static int
2090	il4965_txq_ctx_activate_free(struct il_priv *il)
2091	{
2092	int txq_id;
2093
2094	for (txq_id = 0; txq_id < il->hw_params.max_txq_num; txq_id++)
2095	if (!test_and_set_bit(nr: txq_id, addr: &il->txq_ctx_active_msk))
2096	return txq_id;
2097	return -1;
2098	}
2099
2100	/*
2101	* il4965_tx_queue_stop_scheduler - Stop queue, but keep configuration
2102	*/
2103	static void
2104	il4965_tx_queue_stop_scheduler(struct il_priv *il, u16 txq_id)
2105	{
2106	/* Simply stop the queue, but don't change any configuration;
2107	* the SCD_ACT_EN bit is the write-enable mask for the ACTIVE bit. */
2108	il_wr_prph(il, IL49_SCD_QUEUE_STATUS_BITS(txq_id),
2109	val: (0 << IL49_SCD_QUEUE_STTS_REG_POS_ACTIVE) |
2110	(1 << IL49_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
2111	}
2112
2113	/*
2114	* il4965_tx_queue_set_q2ratid - Map unique receiver/tid combination to a queue
2115	*/
2116	static int
2117	il4965_tx_queue_set_q2ratid(struct il_priv *il, u16 ra_tid, u16 txq_id)
2118	{
2119	u32 tbl_dw_addr;
2120	u32 tbl_dw;
2121	u16 scd_q2ratid;
2122
2123	scd_q2ratid = ra_tid & IL_SCD_QUEUE_RA_TID_MAP_RATID_MSK;
2124
2125	tbl_dw_addr =
2126	il->scd_base_addr + IL49_SCD_TRANSLATE_TBL_OFFSET_QUEUE(txq_id);
2127
2128	tbl_dw = il_read_targ_mem(il, addr: tbl_dw_addr);
2129
2130	if (txq_id & 0x1)
2131	tbl_dw = (scd_q2ratid << 16) | (tbl_dw & 0x0000FFFF);
2132	else
2133	tbl_dw = scd_q2ratid | (tbl_dw & 0xFFFF0000);
2134
2135	il_write_targ_mem(il, addr: tbl_dw_addr, val: tbl_dw);
2136
2137	return 0;
2138	}
2139
2140	/*
2141	* il4965_tx_queue_agg_enable - Set up & enable aggregation for selected queue
2142	*
2143	* NOTE: txq_id must be greater than IL49_FIRST_AMPDU_QUEUE,
2144	* i.e. it must be one of the higher queues used for aggregation
2145	*/
2146	static int
2147	il4965_txq_agg_enable(struct il_priv *il, int txq_id, int tx_fifo, int sta_id,
2148	int tid, u16 ssn_idx)
2149	{
2150	unsigned long flags;
2151	u16 ra_tid;
2152	int ret;
2153
2154	if ((IL49_FIRST_AMPDU_QUEUE > txq_id) ||
2155	(IL49_FIRST_AMPDU_QUEUE +
2156	il->cfg->num_of_ampdu_queues <= txq_id)) {
2157	IL_WARN("queue number out of range: %d, must be %d to %d\n",
2158	txq_id, IL49_FIRST_AMPDU_QUEUE,
2159	IL49_FIRST_AMPDU_QUEUE +
2160	il->cfg->num_of_ampdu_queues - 1);
2161	return -EINVAL;
2162	}
2163
2164	ra_tid = BUILD_RAxTID(sta_id, tid);
2165
2166	/* Modify device's station table to Tx this TID */
2167	ret = il4965_sta_tx_modify_enable_tid(il, sta_id, tid);
2168	if (ret)
2169	return ret;
2170
2171	spin_lock_irqsave(&il->lock, flags);
2172
2173	/* Stop this Tx queue before configuring it */
2174	il4965_tx_queue_stop_scheduler(il, txq_id);
2175
2176	/* Map receiver-address / traffic-ID to this queue */
2177	il4965_tx_queue_set_q2ratid(il, ra_tid, txq_id);
2178
2179	/* Set this queue as a chain-building queue */
2180	il_set_bits_prph(il, IL49_SCD_QUEUECHAIN_SEL, mask: (1 << txq_id));
2181
2182	/* Place first TFD at idx corresponding to start sequence number.
2183	* Assumes that ssn_idx is valid (!= 0xFFF) */
2184	il->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
2185	il->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
2186	il4965_set_wr_ptrs(il, txq_id, idx: ssn_idx);
2187
2188	/* Set up Tx win size and frame limit for this queue */
2189	il_write_targ_mem(il,
2190	addr: il->scd_base_addr +
2191	IL49_SCD_CONTEXT_QUEUE_OFFSET(txq_id),
2192	val: (SCD_WIN_SIZE << IL49_SCD_QUEUE_CTX_REG1_WIN_SIZE_POS)
2193	& IL49_SCD_QUEUE_CTX_REG1_WIN_SIZE_MSK);
2194
2195	il_write_targ_mem(il,
2196	addr: il->scd_base_addr +
2197	IL49_SCD_CONTEXT_QUEUE_OFFSET(txq_id) + sizeof(u32),
2198	val: (SCD_FRAME_LIMIT <<
2199	IL49_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
2200	IL49_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK);
2201
2202	il_set_bits_prph(il, IL49_SCD_INTERRUPT_MASK, mask: (1 << txq_id));
2203
2204	/* Set up Status area in SRAM, map to Tx DMA/FIFO, activate the queue */
2205	il4965_tx_queue_set_status(il, txq: &il->txq[txq_id], tx_fifo_id: tx_fifo, scd_retry: 1);
2206
2207	spin_unlock_irqrestore(lock: &il->lock, flags);
2208
2209	return 0;
2210	}
2211
2212	int
2213	il4965_tx_agg_start(struct il_priv *il, struct ieee80211_vif *vif,
2214	struct ieee80211_sta *sta, u16 tid, u16 * ssn)
2215	{
2216	int sta_id;
2217	int tx_fifo;
2218	int txq_id;
2219	int ret;
2220	unsigned long flags;
2221	struct il_tid_data *tid_data;
2222
2223	/* FIXME: warning if tx fifo not found ? */
2224	tx_fifo = il4965_get_fifo_from_tid(tid);
2225	if (unlikely(tx_fifo < 0))
2226	return tx_fifo;
2227
2228	D_HT("%s on ra = %pM tid = %d\n", __func__, sta->addr, tid);
2229
2230	sta_id = il_sta_id(sta);
2231	if (sta_id == IL_INVALID_STATION) {
2232	IL_ERR("Start AGG on invalid station\n");
2233	return -ENXIO;
2234	}
2235	if (unlikely(tid >= MAX_TID_COUNT))
2236	return -EINVAL;
2237
2238	if (il->stations[sta_id].tid[tid].agg.state != IL_AGG_OFF) {
2239	IL_ERR("Start AGG when state is not IL_AGG_OFF !\n");
2240	return -ENXIO;
2241	}
2242
2243	txq_id = il4965_txq_ctx_activate_free(il);
2244	if (txq_id == -1) {
2245	IL_ERR("No free aggregation queue available\n");
2246	return -ENXIO;
2247	}
2248
2249	spin_lock_irqsave(&il->sta_lock, flags);
2250	tid_data = &il->stations[sta_id].tid[tid];
2251	*ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
2252	tid_data->agg.txq_id = txq_id;
2253	il_set_swq_id(txq: &il->txq[txq_id], ac: il4965_get_ac_from_tid(tid), hwq: txq_id);
2254	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
2255
2256	ret = il4965_txq_agg_enable(il, txq_id, tx_fifo, sta_id, tid, ssn_idx: *ssn);
2257	if (ret)
2258	return ret;
2259
2260	spin_lock_irqsave(&il->sta_lock, flags);
2261	tid_data = &il->stations[sta_id].tid[tid];
2262	if (tid_data->tfds_in_queue == 0) {
2263	D_HT("HW queue is empty\n");
2264	tid_data->agg.state = IL_AGG_ON;
2265	ret = IEEE80211_AMPDU_TX_START_IMMEDIATE;
2266	} else {
2267	D_HT("HW queue is NOT empty: %d packets in HW queue\n",
2268	tid_data->tfds_in_queue);
2269	tid_data->agg.state = IL_EMPTYING_HW_QUEUE_ADDBA;
2270	}
2271	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
2272	return ret;
2273	}
2274
2275	/*
2276	* txq_id must be greater than IL49_FIRST_AMPDU_QUEUE
2277	* il->lock must be held by the caller
2278	*/
2279	static int
2280	il4965_txq_agg_disable(struct il_priv *il, u16 txq_id, u16 ssn_idx, u8 tx_fifo)
2281	{
2282	if ((IL49_FIRST_AMPDU_QUEUE > txq_id) ||
2283	(IL49_FIRST_AMPDU_QUEUE +
2284	il->cfg->num_of_ampdu_queues <= txq_id)) {
2285	IL_WARN("queue number out of range: %d, must be %d to %d\n",
2286	txq_id, IL49_FIRST_AMPDU_QUEUE,
2287	IL49_FIRST_AMPDU_QUEUE +
2288	il->cfg->num_of_ampdu_queues - 1);
2289	return -EINVAL;
2290	}
2291
2292	il4965_tx_queue_stop_scheduler(il, txq_id);
2293
2294	il_clear_bits_prph(il, IL49_SCD_QUEUECHAIN_SEL, mask: (1 << txq_id));
2295
2296	il->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
2297	il->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
2298	/* supposes that ssn_idx is valid (!= 0xFFF) */
2299	il4965_set_wr_ptrs(il, txq_id, idx: ssn_idx);
2300
2301	il_clear_bits_prph(il, IL49_SCD_INTERRUPT_MASK, mask: (1 << txq_id));
2302	il_txq_ctx_deactivate(il, txq_id);
2303	il4965_tx_queue_set_status(il, txq: &il->txq[txq_id], tx_fifo_id: tx_fifo, scd_retry: 0);
2304
2305	return 0;
2306	}
2307
2308	int
2309	il4965_tx_agg_stop(struct il_priv *il, struct ieee80211_vif *vif,
2310	struct ieee80211_sta *sta, u16 tid)
2311	{
2312	int tx_fifo_id, txq_id, sta_id, ssn;
2313	struct il_tid_data *tid_data;
2314	int write_ptr, read_ptr;
2315	unsigned long flags;
2316
2317	/* FIXME: warning if tx_fifo_id not found ? */
2318	tx_fifo_id = il4965_get_fifo_from_tid(tid);
2319	if (unlikely(tx_fifo_id < 0))
2320	return tx_fifo_id;
2321
2322	sta_id = il_sta_id(sta);
2323
2324	if (sta_id == IL_INVALID_STATION) {
2325	IL_ERR("Invalid station for AGG tid %d\n", tid);
2326	return -ENXIO;
2327	}
2328
2329	spin_lock_irqsave(&il->sta_lock, flags);
2330
2331	tid_data = &il->stations[sta_id].tid[tid];
2332	ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4;
2333	txq_id = tid_data->agg.txq_id;
2334
2335	switch (il->stations[sta_id].tid[tid].agg.state) {
2336	case IL_EMPTYING_HW_QUEUE_ADDBA:
2337	/*
2338	* This can happen if the peer stops aggregation
2339	* again before we've had a chance to drain the
2340	* queue we selected previously, i.e. before the
2341	* session was really started completely.
2342	*/
2343	D_HT("AGG stop before setup done\n");
2344	goto turn_off;
2345	case IL_AGG_ON:
2346	break;
2347	default:
2348	IL_WARN("Stopping AGG while state not ON or starting\n");
2349	}
2350
2351	write_ptr = il->txq[txq_id].q.write_ptr;
2352	read_ptr = il->txq[txq_id].q.read_ptr;
2353
2354	/* The queue is not empty */
2355	if (write_ptr != read_ptr) {
2356	D_HT("Stopping a non empty AGG HW QUEUE\n");
2357	il->stations[sta_id].tid[tid].agg.state =
2358	IL_EMPTYING_HW_QUEUE_DELBA;
2359	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
2360	return 0;
2361	}
2362
2363	D_HT("HW queue is empty\n");
2364	turn_off:
2365	il->stations[sta_id].tid[tid].agg.state = IL_AGG_OFF;
2366
2367	/* do not restore/save irqs */
2368	spin_unlock(lock: &il->sta_lock);
2369	spin_lock(lock: &il->lock);
2370
2371	/*
2372	* the only reason this call can fail is queue number out of range,
2373	* which can happen if uCode is reloaded and all the station
2374	* information are lost. if it is outside the range, there is no need
2375	* to deactivate the uCode queue, just return "success" to allow
2376	* mac80211 to clean up it own data.
2377	*/
2378	il4965_txq_agg_disable(il, txq_id, ssn_idx: ssn, tx_fifo: tx_fifo_id);
2379	spin_unlock_irqrestore(lock: &il->lock, flags);
2380
2381	ieee80211_stop_tx_ba_cb_irqsafe(vif, ra: sta->addr, tid);
2382
2383	return 0;
2384	}
2385
2386	int
2387	il4965_txq_check_empty(struct il_priv *il, int sta_id, u8 tid, int txq_id)
2388	{
2389	struct il_queue *q = &il->txq[txq_id].q;
2390	u8 *addr = il->stations[sta_id].sta.sta.addr;
2391	struct il_tid_data *tid_data = &il->stations[sta_id].tid[tid];
2392
2393	lockdep_assert_held(&il->sta_lock);
2394
2395	switch (il->stations[sta_id].tid[tid].agg.state) {
2396	case IL_EMPTYING_HW_QUEUE_DELBA:
2397	/* We are reclaiming the last packet of the */
2398	/* aggregated HW queue */
2399	if (txq_id == tid_data->agg.txq_id &&
2400	q->read_ptr == q->write_ptr) {
2401	u16 ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
2402	int tx_fifo = il4965_get_fifo_from_tid(tid);
2403	D_HT("HW queue empty: continue DELBA flow\n");
2404	il4965_txq_agg_disable(il, txq_id, ssn_idx: ssn, tx_fifo);
2405	tid_data->agg.state = IL_AGG_OFF;
2406	ieee80211_stop_tx_ba_cb_irqsafe(vif: il->vif, ra: addr, tid);
2407	}
2408	break;
2409	case IL_EMPTYING_HW_QUEUE_ADDBA:
2410	/* We are reclaiming the last packet of the queue */
2411	if (tid_data->tfds_in_queue == 0) {
2412	D_HT("HW queue empty: continue ADDBA flow\n");
2413	tid_data->agg.state = IL_AGG_ON;
2414	ieee80211_start_tx_ba_cb_irqsafe(vif: il->vif, ra: addr, tid);
2415	}
2416	break;
2417	}
2418
2419	return 0;
2420	}
2421
2422	static void
2423	il4965_non_agg_tx_status(struct il_priv *il, const u8 *addr1)
2424	{
2425	struct ieee80211_sta *sta;
2426	struct il_station_priv *sta_priv;
2427
2428	rcu_read_lock();
2429	sta = ieee80211_find_sta(vif: il->vif, addr: addr1);
2430	if (sta) {
2431	sta_priv = (void *)sta->drv_priv;
2432	/* avoid atomic ops if this isn't a client */
2433	if (sta_priv->client &&
2434	atomic_dec_return(v: &sta_priv->pending_frames) == 0)
2435	ieee80211_sta_block_awake(hw: il->hw, pubsta: sta, block: false);
2436	}
2437	rcu_read_unlock();
2438	}
2439
2440	static void
2441	il4965_tx_status(struct il_priv *il, struct sk_buff *skb, bool is_agg)
2442	{
2443	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2444
2445	if (!is_agg)
2446	il4965_non_agg_tx_status(il, addr1: hdr->addr1);
2447
2448	ieee80211_tx_status_irqsafe(hw: il->hw, skb);
2449	}
2450
2451	int
2452	il4965_tx_queue_reclaim(struct il_priv *il, int txq_id, int idx)
2453	{
2454	struct il_tx_queue *txq = &il->txq[txq_id];
2455	struct il_queue *q = &txq->q;
2456	int nfreed = 0;
2457	struct ieee80211_hdr *hdr;
2458	struct sk_buff *skb;
2459
2460	if (idx >= q->n_bd || il_queue_used(q, i: idx) == 0) {
2461	IL_ERR("Read idx for DMA queue txq id (%d), idx %d, "
2462	"is out of range [0-%d] %d %d.\n", txq_id, idx, q->n_bd,
2463	q->write_ptr, q->read_ptr);
2464	return 0;
2465	}
2466
2467	for (idx = il_queue_inc_wrap(idx, n_bd: q->n_bd); q->read_ptr != idx;
2468	q->read_ptr = il_queue_inc_wrap(idx: q->read_ptr, n_bd: q->n_bd)) {
2469
2470	skb = txq->skbs[txq->q.read_ptr];
2471
2472	if (WARN_ON_ONCE(skb == NULL))
2473	continue;
2474
2475	hdr = (struct ieee80211_hdr *) skb->data;
2476	if (ieee80211_is_data_qos(fc: hdr->frame_control))
2477	nfreed++;
2478
2479	il4965_tx_status(il, skb, is_agg: txq_id >= IL4965_FIRST_AMPDU_QUEUE);
2480
2481	txq->skbs[txq->q.read_ptr] = NULL;
2482	il->ops->txq_free_tfd(il, txq);
2483	}
2484	return nfreed;
2485	}
2486
2487	/*
2488	* il4965_tx_status_reply_compressed_ba - Update tx status from block-ack
2489	*
2490	* Go through block-ack's bitmap of ACK'd frames, update driver's record of
2491	* ACK vs. not. This gets sent to mac80211, then to rate scaling algo.
2492	*/
2493	static int
2494	il4965_tx_status_reply_compressed_ba(struct il_priv *il, struct il_ht_agg *agg,
2495	struct il_compressed_ba_resp *ba_resp)
2496	{
2497	int i, sh, ack;
2498	u16 seq_ctl = le16_to_cpu(ba_resp->seq_ctl);
2499	u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
2500	int successes = 0;
2501	struct ieee80211_tx_info *info;
2502	u64 bitmap, sent_bitmap;
2503
2504	if (unlikely(!agg->wait_for_ba)) {
2505	if (unlikely(ba_resp->bitmap))
2506	IL_ERR("Received BA when not expected\n");
2507	return -EINVAL;
2508	}
2509
2510	/* Mark that the expected block-ack response arrived */
2511	agg->wait_for_ba = 0;
2512	D_TX_REPLY("BA %d %d\n", agg->start_idx, ba_resp->seq_ctl);
2513
2514	/* Calculate shift to align block-ack bits with our Tx win bits */
2515	sh = agg->start_idx - SEQ_TO_IDX(seq_ctl >> 4);
2516	if (sh < 0) /* tbw something is wrong with indices */
2517	sh += 0x100;
2518
2519	if (agg->frame_count > (64 - sh)) {
2520	D_TX_REPLY("more frames than bitmap size");
2521	return -1;
2522	}
2523
2524	/* don't use 64-bit values for now */
2525	bitmap = le64_to_cpu(ba_resp->bitmap) >> sh;
2526
2527	/* check for success or failure according to the
2528	* transmitted bitmap and block-ack bitmap */
2529	sent_bitmap = bitmap & agg->bitmap;
2530
2531	/* For each frame attempted in aggregation,
2532	* update driver's record of tx frame's status. */
2533	i = 0;
2534	while (sent_bitmap) {
2535	ack = sent_bitmap & 1ULL;
2536	successes += ack;
2537	D_TX_REPLY("%s ON i=%d idx=%d raw=%d\n", ack ? "ACK" : "NACK",
2538	i, (agg->start_idx + i) & 0xff, agg->start_idx + i);
2539	sent_bitmap >>= 1;
2540	++i;
2541	}
2542
2543	D_TX_REPLY("Bitmap %llx\n", (unsigned long long)bitmap);
2544
2545	info = IEEE80211_SKB_CB(skb: il->txq[scd_flow].skbs[agg->start_idx]);
2546	memset(&info->status, 0, sizeof(info->status));
2547	info->flags |= IEEE80211_TX_STAT_ACK;
2548	info->flags |= IEEE80211_TX_STAT_AMPDU;
2549	info->status.ampdu_ack_len = successes;
2550	info->status.ampdu_len = agg->frame_count;
2551	il4965_hwrate_to_tx_control(il, rate_n_flags: agg->rate_n_flags, info);
2552
2553	return 0;
2554	}
2555
2556	static inline bool
2557	il4965_is_tx_success(u32 status)
2558	{
2559	status &= TX_STATUS_MSK;
2560	return (status == TX_STATUS_SUCCESS || status == TX_STATUS_DIRECT_DONE);
2561	}
2562
2563	static u8
2564	il4965_find_station(struct il_priv *il, const u8 *addr)
2565	{
2566	int i;
2567	int start = 0;
2568	int ret = IL_INVALID_STATION;
2569	unsigned long flags;
2570
2571	if (il->iw_mode == NL80211_IFTYPE_ADHOC)
2572	start = IL_STA_ID;
2573
2574	if (is_broadcast_ether_addr(addr))
2575	return il->hw_params.bcast_id;
2576
2577	spin_lock_irqsave(&il->sta_lock, flags);
2578	for (i = start; i < il->hw_params.max_stations; i++)
2579	if (il->stations[i].used &&
2580	ether_addr_equal(addr1: il->stations[i].sta.sta.addr, addr2: addr)) {
2581	ret = i;
2582	goto out;
2583	}
2584
2585	D_ASSOC("can not find STA %pM total %d\n", addr, il->num_stations);
2586
2587	out:
2588	/*
2589	* It may be possible that more commands interacting with stations
2590	* arrive before we completed processing the adding of
2591	* station
2592	*/
2593	if (ret != IL_INVALID_STATION &&
2594	(!(il->stations[ret].used & IL_STA_UCODE_ACTIVE) ||
2595	(il->stations[ret].used & IL_STA_UCODE_INPROGRESS))) {
2596	IL_ERR("Requested station info for sta %d before ready.\n",
2597	ret);
2598	ret = IL_INVALID_STATION;
2599	}
2600	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
2601	return ret;
2602	}
2603
2604	static int
2605	il4965_get_ra_sta_id(struct il_priv *il, struct ieee80211_hdr *hdr)
2606	{
2607	if (il->iw_mode == NL80211_IFTYPE_STATION)
2608	return IL_AP_ID;
2609	else {
2610	u8 *da = ieee80211_get_DA(hdr);
2611
2612	return il4965_find_station(il, addr: da);
2613	}
2614	}
2615
2616	static inline u32
2617	il4965_get_scd_ssn(struct il4965_tx_resp *tx_resp)
2618	{
2619	return le32_to_cpup(p: &tx_resp->u.status +
2620	tx_resp->frame_count) & IEEE80211_MAX_SN;
2621	}
2622
2623	static inline u32
2624	il4965_tx_status_to_mac80211(u32 status)
2625	{
2626	status &= TX_STATUS_MSK;
2627
2628	switch (status) {
2629	case TX_STATUS_SUCCESS:
2630	case TX_STATUS_DIRECT_DONE:
2631	return IEEE80211_TX_STAT_ACK;
2632	case TX_STATUS_FAIL_DEST_PS:
2633	return IEEE80211_TX_STAT_TX_FILTERED;
2634	default:
2635	return 0;
2636	}
2637	}
2638
2639	/*
2640	* il4965_tx_status_reply_tx - Handle Tx response for frames in aggregation queue
2641	*/
2642	static int
2643	il4965_tx_status_reply_tx(struct il_priv *il, struct il_ht_agg *agg,
2644	struct il4965_tx_resp *tx_resp, int txq_id,
2645	u16 start_idx)
2646	{
2647	u16 status;
2648	struct agg_tx_status *frame_status = tx_resp->u.agg_status;
2649	struct ieee80211_tx_info *info = NULL;
2650	struct ieee80211_hdr *hdr = NULL;
2651	u32 rate_n_flags = le32_to_cpu(tx_resp->rate_n_flags);
2652	int i, sh, idx;
2653	u16 seq;
2654	if (agg->wait_for_ba)
2655	D_TX_REPLY("got tx response w/o block-ack\n");
2656
2657	agg->frame_count = tx_resp->frame_count;
2658	agg->start_idx = start_idx;
2659	agg->rate_n_flags = rate_n_flags;
2660	agg->bitmap = 0;
2661
2662	/* num frames attempted by Tx command */
2663	if (agg->frame_count == 1) {
2664	/* Only one frame was attempted; no block-ack will arrive */
2665	status = le16_to_cpu(frame_status[0].status);
2666	idx = start_idx;
2667
2668	D_TX_REPLY("FrameCnt = %d, StartIdx=%d idx=%d\n",
2669	agg->frame_count, agg->start_idx, idx);
2670
2671	info = IEEE80211_SKB_CB(skb: il->txq[txq_id].skbs[idx]);
2672	info->status.rates[0].count = tx_resp->failure_frame + 1;
2673	info->flags &= ~IEEE80211_TX_CTL_AMPDU;
2674	info->flags |= il4965_tx_status_to_mac80211(status);
2675	il4965_hwrate_to_tx_control(il, rate_n_flags, info);
2676
2677	D_TX_REPLY("1 Frame 0x%x failure :%d\n", status & 0xff,
2678	tx_resp->failure_frame);
2679	D_TX_REPLY("Rate Info rate_n_flags=%x\n", rate_n_flags);
2680
2681	agg->wait_for_ba = 0;
2682	} else {
2683	/* Two or more frames were attempted; expect block-ack */
2684	u64 bitmap = 0;
2685	int start = agg->start_idx;
2686	struct sk_buff *skb;
2687
2688	/* Construct bit-map of pending frames within Tx win */
2689	for (i = 0; i < agg->frame_count; i++) {
2690	u16 sc;
2691	status = le16_to_cpu(frame_status[i].status);
2692	seq = le16_to_cpu(frame_status[i].sequence);
2693	idx = SEQ_TO_IDX(seq);
2694	txq_id = SEQ_TO_QUEUE(seq);
2695
2696	if (status &
2697	(AGG_TX_STATE_FEW_BYTES_MSK |
2698	AGG_TX_STATE_ABORT_MSK))
2699	continue;
2700
2701	D_TX_REPLY("FrameCnt = %d, txq_id=%d idx=%d\n",
2702	agg->frame_count, txq_id, idx);
2703
2704	skb = il->txq[txq_id].skbs[idx];
2705	if (WARN_ON_ONCE(skb == NULL))
2706	return -1;
2707	hdr = (struct ieee80211_hdr *) skb->data;
2708
2709	sc = le16_to_cpu(hdr->seq_ctrl);
2710	if (idx != (IEEE80211_SEQ_TO_SN(sc) & 0xff)) {
2711	IL_ERR("BUG_ON idx doesn't match seq control"
2712	" idx=%d, seq_idx=%d, seq=%d\n", idx,
2713	IEEE80211_SEQ_TO_SN(sc), hdr->seq_ctrl);
2714	return -1;
2715	}
2716
2717	D_TX_REPLY("AGG Frame i=%d idx %d seq=%d\n", i, idx,
2718	IEEE80211_SEQ_TO_SN(sc));
2719
2720	sh = idx - start;
2721	if (sh > 64) {
2722	sh = (start - idx) + 0xff;
2723	bitmap = bitmap << sh;
2724	sh = 0;
2725	start = idx;
2726	} else if (sh < -64)
2727	sh = 0xff - (start - idx);
2728	else if (sh < 0) {
2729	sh = start - idx;
2730	start = idx;
2731	bitmap = bitmap << sh;
2732	sh = 0;
2733	}
2734	bitmap |= 1ULL << sh;
2735	D_TX_REPLY("start=%d bitmap=0x%llx\n", start,
2736	(unsigned long long)bitmap);
2737	}
2738
2739	agg->bitmap = bitmap;
2740	agg->start_idx = start;
2741	D_TX_REPLY("Frames %d start_idx=%d bitmap=0x%llx\n",
2742	agg->frame_count, agg->start_idx,
2743	(unsigned long long)agg->bitmap);
2744
2745	if (bitmap)
2746	agg->wait_for_ba = 1;
2747	}
2748	return 0;
2749	}
2750
2751	/*
2752	* il4965_hdl_tx - Handle standard (non-aggregation) Tx response
2753	*/
2754	static void
2755	il4965_hdl_tx(struct il_priv *il, struct il_rx_buf *rxb)
2756	{
2757	struct il_rx_pkt *pkt = rxb_addr(rxb);
2758	u16 sequence = le16_to_cpu(pkt->hdr.sequence);
2759	int txq_id = SEQ_TO_QUEUE(sequence);
2760	int idx = SEQ_TO_IDX(sequence);
2761	struct il_tx_queue *txq = &il->txq[txq_id];
2762	struct sk_buff *skb;
2763	struct ieee80211_hdr *hdr;
2764	struct ieee80211_tx_info *info;
2765	struct il4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
2766	u32 status = le32_to_cpu(tx_resp->u.status);
2767	int tid;
2768	int sta_id;
2769	int freed;
2770	u8 *qc = NULL;
2771	unsigned long flags;
2772
2773	if (idx >= txq->q.n_bd || il_queue_used(q: &txq->q, i: idx) == 0) {
2774	IL_ERR("Read idx for DMA queue txq_id (%d) idx %d "
2775	"is out of range [0-%d] %d %d\n", txq_id, idx,
2776	txq->q.n_bd, txq->q.write_ptr, txq->q.read_ptr);
2777	return;
2778	}
2779
2780	txq->time_stamp = jiffies;
2781
2782	skb = txq->skbs[txq->q.read_ptr];
2783	info = IEEE80211_SKB_CB(skb);
2784	memset(&info->status, 0, sizeof(info->status));
2785
2786	hdr = (struct ieee80211_hdr *) skb->data;
2787	if (ieee80211_is_data_qos(fc: hdr->frame_control)) {
2788	qc = ieee80211_get_qos_ctl(hdr);
2789	tid = qc[0] & 0xf;
2790	}
2791
2792	sta_id = il4965_get_ra_sta_id(il, hdr);
2793	if (txq->sched_retry && unlikely(sta_id == IL_INVALID_STATION)) {
2794	IL_ERR("Station not known\n");
2795	return;
2796	}
2797
2798	/*
2799	* Firmware will not transmit frame on passive channel, if it not yet
2800	* received some valid frame on that channel. When this error happen
2801	* we have to wait until firmware will unblock itself i.e. when we
2802	* note received beacon or other frame. We unblock queues in
2803	* il4965_pass_packet_to_mac80211 or in il_mac_bss_info_changed.
2804	*/
2805	if (unlikely((status & TX_STATUS_MSK) == TX_STATUS_FAIL_PASSIVE_NO_RX) &&
2806	il->iw_mode == NL80211_IFTYPE_STATION) {
2807	il_stop_queues_by_reason(il, IL_STOP_REASON_PASSIVE);
2808	D_INFO("Stopped queues - RX waiting on passive channel\n");
2809	}
2810
2811	spin_lock_irqsave(&il->sta_lock, flags);
2812	if (txq->sched_retry) {
2813	const u32 scd_ssn = il4965_get_scd_ssn(tx_resp);
2814	struct il_ht_agg *agg;
2815
2816	if (WARN_ON(!qc))
2817	goto out;
2818
2819	agg = &il->stations[sta_id].tid[tid].agg;
2820
2821	il4965_tx_status_reply_tx(il, agg, tx_resp, txq_id, start_idx: idx);
2822
2823	/* check if BAR is needed */
2824	if (tx_resp->frame_count == 1 &&
2825	!il4965_is_tx_success(status))
2826	info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
2827
2828	if (txq->q.read_ptr != (scd_ssn & 0xff)) {
2829	idx = il_queue_dec_wrap(idx: scd_ssn & 0xff, n_bd: txq->q.n_bd);
2830	D_TX_REPLY("Retry scheduler reclaim scd_ssn "
2831	"%d idx %d\n", scd_ssn, idx);
2832	freed = il4965_tx_queue_reclaim(il, txq_id, idx);
2833	il4965_free_tfds_in_queue(il, sta_id, tid, freed);
2834
2835	if (il->mac80211_registered &&
2836	il_queue_space(q: &txq->q) > txq->q.low_mark &&
2837	agg->state != IL_EMPTYING_HW_QUEUE_DELBA)
2838	il_wake_queue(il, txq);
2839	}
2840	} else {
2841	info->status.rates[0].count = tx_resp->failure_frame + 1;
2842	info->flags |= il4965_tx_status_to_mac80211(status);
2843	il4965_hwrate_to_tx_control(il,
2844	le32_to_cpu(tx_resp->rate_n_flags),
2845	info);
2846
2847	D_TX_REPLY("TXQ %d status %s (0x%08x) "
2848	"rate_n_flags 0x%x retries %d\n", txq_id,
2849	il4965_get_tx_fail_reason(status), status,
2850	le32_to_cpu(tx_resp->rate_n_flags),
2851	tx_resp->failure_frame);
2852
2853	freed = il4965_tx_queue_reclaim(il, txq_id, idx);
2854	if (qc && likely(sta_id != IL_INVALID_STATION))
2855	il4965_free_tfds_in_queue(il, sta_id, tid, freed);
2856	else if (sta_id == IL_INVALID_STATION)
2857	D_TX_REPLY("Station not known\n");
2858
2859	if (il->mac80211_registered &&
2860	il_queue_space(q: &txq->q) > txq->q.low_mark)
2861	il_wake_queue(il, txq);
2862	}
2863	out:
2864	if (qc && likely(sta_id != IL_INVALID_STATION))
2865	il4965_txq_check_empty(il, sta_id, tid, txq_id);
2866
2867	il4965_check_abort_status(il, frame_count: tx_resp->frame_count, status);
2868
2869	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
2870	}
2871
2872	/*
2873	* translate ucode response to mac80211 tx status control values
2874	*/
2875	void
2876	il4965_hwrate_to_tx_control(struct il_priv *il, u32 rate_n_flags,
2877	struct ieee80211_tx_info *info)
2878	{
2879	struct ieee80211_tx_rate *r = &info->status.rates[0];
2880
2881	info->status.antenna =
2882	((rate_n_flags & RATE_MCS_ANT_ABC_MSK) >> RATE_MCS_ANT_POS);
2883	if (rate_n_flags & RATE_MCS_HT_MSK)
2884	r->flags |= IEEE80211_TX_RC_MCS;
2885	if (rate_n_flags & RATE_MCS_GF_MSK)
2886	r->flags |= IEEE80211_TX_RC_GREEN_FIELD;
2887	if (rate_n_flags & RATE_MCS_HT40_MSK)
2888	r->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
2889	if (rate_n_flags & RATE_MCS_DUP_MSK)
2890	r->flags |= IEEE80211_TX_RC_DUP_DATA;
2891	if (rate_n_flags & RATE_MCS_SGI_MSK)
2892	r->flags |= IEEE80211_TX_RC_SHORT_GI;
2893	r->idx = il4965_hwrate_to_mac80211_idx(rate_n_flags, band: info->band);
2894	}
2895
2896	/*
2897	* il4965_hdl_compressed_ba - Handler for N_COMPRESSED_BA
2898	*
2899	* Handles block-acknowledge notification from device, which reports success
2900	* of frames sent via aggregation.
2901	*/
2902	static void
2903	il4965_hdl_compressed_ba(struct il_priv *il, struct il_rx_buf *rxb)
2904	{
2905	struct il_rx_pkt *pkt = rxb_addr(rxb);
2906	struct il_compressed_ba_resp *ba_resp = &pkt->u.compressed_ba;
2907	struct il_tx_queue *txq = NULL;
2908	struct il_ht_agg *agg;
2909	int idx;
2910	int sta_id;
2911	int tid;
2912	unsigned long flags;
2913
2914	/* "flow" corresponds to Tx queue */
2915	u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
2916
2917	/* "ssn" is start of block-ack Tx win, corresponds to idx
2918	* (in Tx queue's circular buffer) of first TFD/frame in win */
2919	u16 ba_resp_scd_ssn = le16_to_cpu(ba_resp->scd_ssn);
2920
2921	if (scd_flow >= il->hw_params.max_txq_num) {
2922	IL_ERR("BUG_ON scd_flow is bigger than number of queues\n");
2923	return;
2924	}
2925
2926	txq = &il->txq[scd_flow];
2927	sta_id = ba_resp->sta_id;
2928	tid = ba_resp->tid;
2929	agg = &il->stations[sta_id].tid[tid].agg;
2930	if (unlikely(agg->txq_id != scd_flow)) {
2931	/*
2932	* FIXME: this is a uCode bug which need to be addressed,
2933	* log the information and return for now!
2934	* since it is possible happen very often and in order
2935	* not to fill the syslog, don't enable the logging by default
2936	*/
2937	D_TX_REPLY("BA scd_flow %d does not match txq_id %d\n",
2938	scd_flow, agg->txq_id);
2939	return;
2940	}
2941
2942	/* Find idx just before block-ack win */
2943	idx = il_queue_dec_wrap(idx: ba_resp_scd_ssn & 0xff, n_bd: txq->q.n_bd);
2944
2945	spin_lock_irqsave(&il->sta_lock, flags);
2946
2947	D_TX_REPLY("N_COMPRESSED_BA [%d] Received from %pM, " "sta_id = %d\n",
2948	agg->wait_for_ba, (u8 *) &ba_resp->sta_addr_lo32,
2949	ba_resp->sta_id);
2950	D_TX_REPLY("TID = %d, SeqCtl = %d, bitmap = 0x%llx," "scd_flow = "
2951	"%d, scd_ssn = %d\n", ba_resp->tid, ba_resp->seq_ctl,
2952	(unsigned long long)le64_to_cpu(ba_resp->bitmap),
2953	ba_resp->scd_flow, ba_resp->scd_ssn);
2954	D_TX_REPLY("DAT start_idx = %d, bitmap = 0x%llx\n", agg->start_idx,
2955	(unsigned long long)agg->bitmap);
2956
2957	/* Update driver's record of ACK vs. not for each frame in win */
2958	il4965_tx_status_reply_compressed_ba(il, agg, ba_resp);
2959
2960	/* Release all TFDs before the SSN, i.e. all TFDs in front of
2961	* block-ack win (we assume that they've been successfully
2962	* transmitted ... if not, it's too late anyway). */
2963	if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {
2964	/* calculate mac80211 ampdu sw queue to wake */
2965	int freed = il4965_tx_queue_reclaim(il, txq_id: scd_flow, idx);
2966	il4965_free_tfds_in_queue(il, sta_id, tid, freed);
2967
2968	if (il_queue_space(q: &txq->q) > txq->q.low_mark &&
2969	il->mac80211_registered &&
2970	agg->state != IL_EMPTYING_HW_QUEUE_DELBA)
2971	il_wake_queue(il, txq);
2972
2973	il4965_txq_check_empty(il, sta_id, tid, txq_id: scd_flow);
2974	}
2975
2976	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
2977	}
2978
2979	#ifdef CONFIG_IWLEGACY_DEBUG
2980	const char *
2981	il4965_get_tx_fail_reason(u32 status)
2982	{
2983	#define TX_STATUS_FAIL(x) case TX_STATUS_FAIL_ ## x: return #x
2984	#define TX_STATUS_POSTPONE(x) case TX_STATUS_POSTPONE_ ## x: return #x
2985
2986	switch (status & TX_STATUS_MSK) {
2987	case TX_STATUS_SUCCESS:
2988	return "SUCCESS";
2989	TX_STATUS_POSTPONE(DELAY);
2990	TX_STATUS_POSTPONE(FEW_BYTES);
2991	TX_STATUS_POSTPONE(QUIET_PERIOD);
2992	TX_STATUS_POSTPONE(CALC_TTAK);
2993	TX_STATUS_FAIL(INTERNAL_CROSSED_RETRY);
2994	TX_STATUS_FAIL(SHORT_LIMIT);
2995	TX_STATUS_FAIL(LONG_LIMIT);
2996	TX_STATUS_FAIL(FIFO_UNDERRUN);
2997	TX_STATUS_FAIL(DRAIN_FLOW);
2998	TX_STATUS_FAIL(RFKILL_FLUSH);
2999	TX_STATUS_FAIL(LIFE_EXPIRE);
3000	TX_STATUS_FAIL(DEST_PS);
3001	TX_STATUS_FAIL(HOST_ABORTED);
3002	TX_STATUS_FAIL(BT_RETRY);
3003	TX_STATUS_FAIL(STA_INVALID);
3004	TX_STATUS_FAIL(FRAG_DROPPED);
3005	TX_STATUS_FAIL(TID_DISABLE);
3006	TX_STATUS_FAIL(FIFO_FLUSHED);
3007	TX_STATUS_FAIL(INSUFFICIENT_CF_POLL);
3008	TX_STATUS_FAIL(PASSIVE_NO_RX);
3009	TX_STATUS_FAIL(NO_BEACON_ON_RADAR);
3010	}
3011
3012	return "UNKNOWN";
3013
3014	#undef TX_STATUS_FAIL
3015	#undef TX_STATUS_POSTPONE
3016	}
3017	#endif /* CONFIG_IWLEGACY_DEBUG */
3018
3019	static struct il_link_quality_cmd *
3020	il4965_sta_alloc_lq(struct il_priv *il, u8 sta_id)
3021	{
3022	int i, r;
3023	struct il_link_quality_cmd *link_cmd;
3024	u32 rate_flags = 0;
3025	__le32 rate_n_flags;
3026
3027	link_cmd = kzalloc(size: sizeof(struct il_link_quality_cmd), GFP_KERNEL);
3028	if (!link_cmd) {
3029	IL_ERR("Unable to allocate memory for LQ cmd.\n");
3030	return NULL;
3031	}
3032	/* Set up the rate scaling to start at selected rate, fall back
3033	* all the way down to 1M in IEEE order, and then spin on 1M */
3034	if (il->band == NL80211_BAND_5GHZ)
3035	r = RATE_6M_IDX;
3036	else
3037	r = RATE_1M_IDX;
3038
3039	if (r >= IL_FIRST_CCK_RATE && r <= IL_LAST_CCK_RATE)
3040	rate_flags |= RATE_MCS_CCK_MSK;
3041
3042	rate_flags |=
3043	il4965_first_antenna(mask: il->hw_params.
3044	valid_tx_ant) << RATE_MCS_ANT_POS;
3045	rate_n_flags = cpu_to_le32(il_rates[r].plcp | rate_flags);
3046	for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
3047	link_cmd->rs_table[i].rate_n_flags = rate_n_flags;
3048
3049	link_cmd->general_params.single_stream_ant_msk =
3050	il4965_first_antenna(mask: il->hw_params.valid_tx_ant);
3051
3052	link_cmd->general_params.dual_stream_ant_msk =
3053	il->hw_params.valid_tx_ant & ~il4965_first_antenna(mask: il->hw_params.
3054	valid_tx_ant);
3055	if (!link_cmd->general_params.dual_stream_ant_msk) {
3056	link_cmd->general_params.dual_stream_ant_msk = ANT_AB;
3057	} else if (il4965_num_of_ant(m: il->hw_params.valid_tx_ant) == 2) {
3058	link_cmd->general_params.dual_stream_ant_msk =
3059	il->hw_params.valid_tx_ant;
3060	}
3061
3062	link_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
3063	link_cmd->agg_params.agg_time_limit =
3064	cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
3065
3066	link_cmd->sta_id = sta_id;
3067
3068	return link_cmd;
3069	}
3070
3071	/*
3072	* il4965_add_bssid_station - Add the special IBSS BSSID station
3073	*
3074	* Function sleeps.
3075	*/
3076	int
3077	il4965_add_bssid_station(struct il_priv *il, const u8 *addr, u8 *sta_id_r)
3078	{
3079	int ret;
3080	u8 sta_id;
3081	struct il_link_quality_cmd *link_cmd;
3082	unsigned long flags;
3083
3084	if (sta_id_r)
3085	*sta_id_r = IL_INVALID_STATION;
3086
3087	ret = il_add_station_common(il, addr, is_ap: 0, NULL, sta_id_r: &sta_id);
3088	if (ret) {
3089	IL_ERR("Unable to add station %pM\n", addr);
3090	return ret;
3091	}
3092
3093	if (sta_id_r)
3094	*sta_id_r = sta_id;
3095
3096	spin_lock_irqsave(&il->sta_lock, flags);
3097	il->stations[sta_id].used |= IL_STA_LOCAL;
3098	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3099
3100	/* Set up default rate scaling table in device's station table */
3101	link_cmd = il4965_sta_alloc_lq(il, sta_id);
3102	if (!link_cmd) {
3103	IL_ERR("Unable to initialize rate scaling for station %pM.\n",
3104	addr);
3105	return -ENOMEM;
3106	}
3107
3108	ret = il_send_lq_cmd(il, lq: link_cmd, flags: CMD_SYNC, init: true);
3109	if (ret)
3110	IL_ERR("Link quality command failed (%d)\n", ret);
3111
3112	spin_lock_irqsave(&il->sta_lock, flags);
3113	il->stations[sta_id].lq = link_cmd;
3114	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3115
3116	return 0;
3117	}
3118
3119	static int
3120	il4965_static_wepkey_cmd(struct il_priv *il, bool send_if_empty)
3121	{
3122	int i;
3123	u8 buff[sizeof(struct il_wep_cmd) +
3124	sizeof(struct il_wep_key) * WEP_KEYS_MAX];
3125	struct il_wep_cmd *wep_cmd = (struct il_wep_cmd *)buff;
3126	size_t cmd_size = sizeof(struct il_wep_cmd);
3127	struct il_host_cmd cmd = {
3128	.id = C_WEPKEY,
3129	.data = wep_cmd,
3130	.flags = CMD_SYNC,
3131	};
3132	bool not_empty = false;
3133
3134	might_sleep();
3135
3136	memset(wep_cmd, 0,
3137	cmd_size + (sizeof(struct il_wep_key) * WEP_KEYS_MAX));
3138
3139	for (i = 0; i < WEP_KEYS_MAX; i++) {
3140	u8 key_size = il->_4965.wep_keys[i].key_size;
3141
3142	wep_cmd->key[i].key_idx = i;
3143	if (key_size) {
3144	wep_cmd->key[i].key_offset = i;
3145	not_empty = true;
3146	} else
3147	wep_cmd->key[i].key_offset = WEP_INVALID_OFFSET;
3148
3149	wep_cmd->key[i].key_size = key_size;
3150	memcpy(&wep_cmd->key[i].key[3], il->_4965.wep_keys[i].key, key_size);
3151	}
3152
3153	wep_cmd->global_key_type = WEP_KEY_WEP_TYPE;
3154	wep_cmd->num_keys = WEP_KEYS_MAX;
3155
3156	cmd_size += sizeof(struct il_wep_key) * WEP_KEYS_MAX;
3157	cmd.len = cmd_size;
3158
3159	if (not_empty || send_if_empty)
3160	return il_send_cmd(il, cmd: &cmd);
3161	else
3162	return 0;
3163	}
3164
3165	int
3166	il4965_restore_default_wep_keys(struct il_priv *il)
3167	{
3168	lockdep_assert_held(&il->mutex);
3169
3170	return il4965_static_wepkey_cmd(il, send_if_empty: false);
3171	}
3172
3173	int
3174	il4965_remove_default_wep_key(struct il_priv *il,
3175	struct ieee80211_key_conf *keyconf)
3176	{
3177	int ret;
3178	int idx = keyconf->keyidx;
3179
3180	lockdep_assert_held(&il->mutex);
3181
3182	D_WEP("Removing default WEP key: idx=%d\n", idx);
3183
3184	memset(&il->_4965.wep_keys[idx], 0, sizeof(struct il_wep_key));
3185	if (il_is_rfkill(il)) {
3186	D_WEP("Not sending C_WEPKEY command due to RFKILL.\n");
3187	/* but keys in device are clear anyway so return success */
3188	return 0;
3189	}
3190	ret = il4965_static_wepkey_cmd(il, send_if_empty: 1);
3191	D_WEP("Remove default WEP key: idx=%d ret=%d\n", idx, ret);
3192
3193	return ret;
3194	}
3195
3196	int
3197	il4965_set_default_wep_key(struct il_priv *il,
3198	struct ieee80211_key_conf *keyconf)
3199	{
3200	int ret;
3201	int len = keyconf->keylen;
3202	int idx = keyconf->keyidx;
3203
3204	lockdep_assert_held(&il->mutex);
3205
3206	if (len != WEP_KEY_LEN_128 && len != WEP_KEY_LEN_64) {
3207	D_WEP("Bad WEP key length %d\n", keyconf->keylen);
3208	return -EINVAL;
3209	}
3210
3211	keyconf->flags &= ~IEEE80211_KEY_FLAG_GENERATE_IV;
3212	keyconf->hw_key_idx = HW_KEY_DEFAULT;
3213	il->stations[IL_AP_ID].keyinfo.cipher = keyconf->cipher;
3214
3215	il->_4965.wep_keys[idx].key_size = len;
3216	memcpy(&il->_4965.wep_keys[idx].key, &keyconf->key, len);
3217
3218	ret = il4965_static_wepkey_cmd(il, send_if_empty: false);
3219
3220	D_WEP("Set default WEP key: len=%d idx=%d ret=%d\n", len, idx, ret);
3221	return ret;
3222	}
3223
3224	static int
3225	il4965_set_wep_dynamic_key_info(struct il_priv *il,
3226	struct ieee80211_key_conf *keyconf, u8 sta_id)
3227	{
3228	unsigned long flags;
3229	__le16 key_flags = 0;
3230	struct il_addsta_cmd sta_cmd;
3231
3232	lockdep_assert_held(&il->mutex);
3233
3234	keyconf->flags &= ~IEEE80211_KEY_FLAG_GENERATE_IV;
3235
3236	key_flags |= (STA_KEY_FLG_WEP | STA_KEY_FLG_MAP_KEY_MSK);
3237	key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
3238	key_flags &= ~STA_KEY_FLG_INVALID;
3239
3240	if (keyconf->keylen == WEP_KEY_LEN_128)
3241	key_flags |= STA_KEY_FLG_KEY_SIZE_MSK;
3242
3243	if (sta_id == il->hw_params.bcast_id)
3244	key_flags |= STA_KEY_MULTICAST_MSK;
3245
3246	spin_lock_irqsave(&il->sta_lock, flags);
3247
3248	il->stations[sta_id].keyinfo.cipher = keyconf->cipher;
3249	il->stations[sta_id].keyinfo.keylen = keyconf->keylen;
3250	il->stations[sta_id].keyinfo.keyidx = keyconf->keyidx;
3251
3252	memcpy(il->stations[sta_id].keyinfo.key, keyconf->key, keyconf->keylen);
3253
3254	memcpy(&il->stations[sta_id].sta.key.key[3], keyconf->key,
3255	keyconf->keylen);
3256
3257	if ((il->stations[sta_id].sta.key.
3258	key_flags & STA_KEY_FLG_ENCRYPT_MSK) == STA_KEY_FLG_NO_ENC)
3259	il->stations[sta_id].sta.key.key_offset =
3260	il_get_free_ucode_key_idx(il);
3261	/* else, we are overriding an existing key => no need to allocated room
3262	* in uCode. */
3263
3264	WARN(il->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
3265	"no space for a new key");
3266
3267	il->stations[sta_id].sta.key.key_flags = key_flags;
3268	il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
3269	il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3270
3271	memcpy(&sta_cmd, &il->stations[sta_id].sta,
3272	sizeof(struct il_addsta_cmd));
3273	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3274
3275	return il_send_add_sta(il, sta: &sta_cmd, flags: CMD_SYNC);
3276	}
3277
3278	static int
3279	il4965_set_ccmp_dynamic_key_info(struct il_priv *il,
3280	struct ieee80211_key_conf *keyconf, u8 sta_id)
3281	{
3282	unsigned long flags;
3283	__le16 key_flags = 0;
3284	struct il_addsta_cmd sta_cmd;
3285
3286	lockdep_assert_held(&il->mutex);
3287
3288	key_flags |= (STA_KEY_FLG_CCMP | STA_KEY_FLG_MAP_KEY_MSK);
3289	key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
3290	key_flags &= ~STA_KEY_FLG_INVALID;
3291
3292	if (sta_id == il->hw_params.bcast_id)
3293	key_flags |= STA_KEY_MULTICAST_MSK;
3294
3295	keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3296
3297	spin_lock_irqsave(&il->sta_lock, flags);
3298	il->stations[sta_id].keyinfo.cipher = keyconf->cipher;
3299	il->stations[sta_id].keyinfo.keylen = keyconf->keylen;
3300
3301	memcpy(il->stations[sta_id].keyinfo.key, keyconf->key, keyconf->keylen);
3302
3303	memcpy(il->stations[sta_id].sta.key.key, keyconf->key, keyconf->keylen);
3304
3305	if ((il->stations[sta_id].sta.key.
3306	key_flags & STA_KEY_FLG_ENCRYPT_MSK) == STA_KEY_FLG_NO_ENC)
3307	il->stations[sta_id].sta.key.key_offset =
3308	il_get_free_ucode_key_idx(il);
3309	/* else, we are overriding an existing key => no need to allocated room
3310	* in uCode. */
3311
3312	WARN(il->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
3313	"no space for a new key");
3314
3315	il->stations[sta_id].sta.key.key_flags = key_flags;
3316	il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
3317	il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3318
3319	memcpy(&sta_cmd, &il->stations[sta_id].sta,
3320	sizeof(struct il_addsta_cmd));
3321	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3322
3323	return il_send_add_sta(il, sta: &sta_cmd, flags: CMD_SYNC);
3324	}
3325
3326	static int
3327	il4965_set_tkip_dynamic_key_info(struct il_priv *il,
3328	struct ieee80211_key_conf *keyconf, u8 sta_id)
3329	{
3330	unsigned long flags;
3331	__le16 key_flags = 0;
3332
3333	key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
3334	key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
3335	key_flags &= ~STA_KEY_FLG_INVALID;
3336
3337	if (sta_id == il->hw_params.bcast_id)
3338	key_flags |= STA_KEY_MULTICAST_MSK;
3339
3340	keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
3341	keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
3342
3343	spin_lock_irqsave(&il->sta_lock, flags);
3344
3345	il->stations[sta_id].keyinfo.cipher = keyconf->cipher;
3346	il->stations[sta_id].keyinfo.keylen = 16;
3347
3348	if ((il->stations[sta_id].sta.key.
3349	key_flags & STA_KEY_FLG_ENCRYPT_MSK) == STA_KEY_FLG_NO_ENC)
3350	il->stations[sta_id].sta.key.key_offset =
3351	il_get_free_ucode_key_idx(il);
3352	/* else, we are overriding an existing key => no need to allocated room
3353	* in uCode. */
3354
3355	WARN(il->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
3356	"no space for a new key");
3357
3358	il->stations[sta_id].sta.key.key_flags = key_flags;
3359
3360	/* This copy is acutally not needed: we get the key with each TX */
3361	memcpy(il->stations[sta_id].keyinfo.key, keyconf->key, 16);
3362
3363	memcpy(il->stations[sta_id].sta.key.key, keyconf->key, 16);
3364
3365	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3366
3367	return 0;
3368	}
3369
3370	void
3371	il4965_update_tkip_key(struct il_priv *il, struct ieee80211_key_conf *keyconf,
3372	struct ieee80211_sta *sta, u32 iv32, u16 *phase1key)
3373	{
3374	u8 sta_id;
3375	unsigned long flags;
3376	int i;
3377
3378	if (il_scan_cancel(il)) {
3379	/* cancel scan failed, just live w/ bad key and rely
3380	briefly on SW decryption */
3381	return;
3382	}
3383
3384	sta_id = il_sta_id_or_broadcast(il, sta);
3385	if (sta_id == IL_INVALID_STATION)
3386	return;
3387
3388	spin_lock_irqsave(&il->sta_lock, flags);
3389
3390	il->stations[sta_id].sta.key.tkip_rx_tsc_byte2 = (u8) iv32;
3391
3392	for (i = 0; i < 5; i++)
3393	il->stations[sta_id].sta.key.tkip_rx_ttak[i] =
3394	cpu_to_le16(phase1key[i]);
3395
3396	il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
3397	il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3398
3399	il_send_add_sta(il, sta: &il->stations[sta_id].sta, flags: CMD_ASYNC);
3400
3401	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3402	}
3403
3404	int
3405	il4965_remove_dynamic_key(struct il_priv *il,
3406	struct ieee80211_key_conf *keyconf, u8 sta_id)
3407	{
3408	unsigned long flags;
3409	u16 key_flags;
3410	u8 keyidx;
3411	struct il_addsta_cmd sta_cmd;
3412
3413	lockdep_assert_held(&il->mutex);
3414
3415	il->_4965.key_mapping_keys--;
3416
3417	spin_lock_irqsave(&il->sta_lock, flags);
3418	key_flags = le16_to_cpu(il->stations[sta_id].sta.key.key_flags);
3419	keyidx = (key_flags >> STA_KEY_FLG_KEYID_POS) & 0x3;
3420
3421	D_WEP("Remove dynamic key: idx=%d sta=%d\n", keyconf->keyidx, sta_id);
3422
3423	if (keyconf->keyidx != keyidx) {
3424	/* We need to remove a key with idx different that the one
3425	* in the uCode. This means that the key we need to remove has
3426	* been replaced by another one with different idx.
3427	* Don't do anything and return ok
3428	*/
3429	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3430	return 0;
3431	}
3432
3433	if (il->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_INVALID) {
3434	IL_WARN("Removing wrong key %d 0x%x\n", keyconf->keyidx,
3435	key_flags);
3436	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3437	return 0;
3438	}
3439
3440	if (!test_and_clear_bit
3441	(nr: il->stations[sta_id].sta.key.key_offset, addr: &il->ucode_key_table))
3442	IL_ERR("idx %d not used in uCode key table.\n",
3443	il->stations[sta_id].sta.key.key_offset);
3444	memset(&il->stations[sta_id].keyinfo, 0, sizeof(struct il_hw_key));
3445	memset(&il->stations[sta_id].sta.key, 0, sizeof(struct il4965_keyinfo));
3446	il->stations[sta_id].sta.key.key_flags =
3447	STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
3448	il->stations[sta_id].sta.key.key_offset = keyconf->hw_key_idx;
3449	il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
3450	il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3451
3452	if (il_is_rfkill(il)) {
3453	D_WEP
3454	("Not sending C_ADD_STA command because RFKILL enabled.\n");
3455	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3456	return 0;
3457	}
3458	memcpy(&sta_cmd, &il->stations[sta_id].sta,
3459	sizeof(struct il_addsta_cmd));
3460	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3461
3462	return il_send_add_sta(il, sta: &sta_cmd, flags: CMD_SYNC);
3463	}
3464
3465	int
3466	il4965_set_dynamic_key(struct il_priv *il, struct ieee80211_key_conf *keyconf,
3467	u8 sta_id)
3468	{
3469	int ret;
3470
3471	lockdep_assert_held(&il->mutex);
3472
3473	il->_4965.key_mapping_keys++;
3474	keyconf->hw_key_idx = HW_KEY_DYNAMIC;
3475
3476	switch (keyconf->cipher) {
3477	case WLAN_CIPHER_SUITE_CCMP:
3478	ret =
3479	il4965_set_ccmp_dynamic_key_info(il, keyconf, sta_id);
3480	break;
3481	case WLAN_CIPHER_SUITE_TKIP:
3482	ret =
3483	il4965_set_tkip_dynamic_key_info(il, keyconf, sta_id);
3484	break;
3485	case WLAN_CIPHER_SUITE_WEP40:
3486	case WLAN_CIPHER_SUITE_WEP104:
3487	ret = il4965_set_wep_dynamic_key_info(il, keyconf, sta_id);
3488	break;
3489	default:
3490	IL_ERR("Unknown alg: %s cipher = %x\n", __func__,
3491	keyconf->cipher);
3492	ret = -EINVAL;
3493	}
3494
3495	D_WEP("Set dynamic key: cipher=%x len=%d idx=%d sta=%d ret=%d\n",
3496	keyconf->cipher, keyconf->keylen, keyconf->keyidx, sta_id, ret);
3497
3498	return ret;
3499	}
3500
3501	/*
3502	* il4965_alloc_bcast_station - add broadcast station into driver's station table.
3503	*
3504	* This adds the broadcast station into the driver's station table
3505	* and marks it driver active, so that it will be restored to the
3506	* device at the next best time.
3507	*/
3508	int
3509	il4965_alloc_bcast_station(struct il_priv *il)
3510	{
3511	struct il_link_quality_cmd *link_cmd;
3512	unsigned long flags;
3513	u8 sta_id;
3514
3515	spin_lock_irqsave(&il->sta_lock, flags);
3516	sta_id = il_prep_station(il, addr: il_bcast_addr, is_ap: false, NULL);
3517	if (sta_id == IL_INVALID_STATION) {
3518	IL_ERR("Unable to prepare broadcast station\n");
3519	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3520
3521	return -EINVAL;
3522	}
3523
3524	il->stations[sta_id].used |= IL_STA_DRIVER_ACTIVE;
3525	il->stations[sta_id].used |= IL_STA_BCAST;
3526	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3527
3528	link_cmd = il4965_sta_alloc_lq(il, sta_id);
3529	if (!link_cmd) {
3530	IL_ERR
3531	("Unable to initialize rate scaling for bcast station.\n");
3532	return -ENOMEM;
3533	}
3534
3535	spin_lock_irqsave(&il->sta_lock, flags);
3536	il->stations[sta_id].lq = link_cmd;
3537	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3538
3539	return 0;
3540	}
3541
3542	/*
3543	* il4965_update_bcast_station - update broadcast station's LQ command
3544	*
3545	* Only used by iwl4965. Placed here to have all bcast station management
3546	* code together.
3547	*/
3548	static int
3549	il4965_update_bcast_station(struct il_priv *il)
3550	{
3551	unsigned long flags;
3552	struct il_link_quality_cmd *link_cmd;
3553	u8 sta_id = il->hw_params.bcast_id;
3554
3555	link_cmd = il4965_sta_alloc_lq(il, sta_id);
3556	if (!link_cmd) {
3557	IL_ERR("Unable to initialize rate scaling for bcast sta.\n");
3558	return -ENOMEM;
3559	}
3560
3561	spin_lock_irqsave(&il->sta_lock, flags);
3562	if (il->stations[sta_id].lq)
3563	kfree(objp: il->stations[sta_id].lq);
3564	else
3565	D_INFO("Bcast sta rate scaling has not been initialized.\n");
3566	il->stations[sta_id].lq = link_cmd;
3567	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3568
3569	return 0;
3570	}
3571
3572	int
3573	il4965_update_bcast_stations(struct il_priv *il)
3574	{
3575	return il4965_update_bcast_station(il);
3576	}
3577
3578	/*
3579	* il4965_sta_tx_modify_enable_tid - Enable Tx for this TID in station table
3580	*/
3581	int
3582	il4965_sta_tx_modify_enable_tid(struct il_priv *il, int sta_id, int tid)
3583	{
3584	unsigned long flags;
3585	struct il_addsta_cmd sta_cmd;
3586
3587	lockdep_assert_held(&il->mutex);
3588
3589	/* Remove "disable" flag, to enable Tx for this TID */
3590	spin_lock_irqsave(&il->sta_lock, flags);
3591	il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_TID_DISABLE_TX;
3592	il->stations[sta_id].sta.tid_disable_tx &= cpu_to_le16(~(1 << tid));
3593	il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3594	memcpy(&sta_cmd, &il->stations[sta_id].sta,
3595	sizeof(struct il_addsta_cmd));
3596	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3597
3598	return il_send_add_sta(il, sta: &sta_cmd, flags: CMD_SYNC);
3599	}
3600
3601	int
3602	il4965_sta_rx_agg_start(struct il_priv *il, struct ieee80211_sta *sta, int tid,
3603	u16 ssn)
3604	{
3605	unsigned long flags;
3606	int sta_id;
3607	struct il_addsta_cmd sta_cmd;
3608
3609	lockdep_assert_held(&il->mutex);
3610
3611	sta_id = il_sta_id(sta);
3612	if (sta_id == IL_INVALID_STATION)
3613	return -ENXIO;
3614
3615	spin_lock_irqsave(&il->sta_lock, flags);
3616	il->stations[sta_id].sta.station_flags_msk = 0;
3617	il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_ADDBA_TID_MSK;
3618	il->stations[sta_id].sta.add_immediate_ba_tid = (u8) tid;
3619	il->stations[sta_id].sta.add_immediate_ba_ssn = cpu_to_le16(ssn);
3620	il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3621	memcpy(&sta_cmd, &il->stations[sta_id].sta,
3622	sizeof(struct il_addsta_cmd));
3623	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3624
3625	return il_send_add_sta(il, sta: &sta_cmd, flags: CMD_SYNC);
3626	}
3627
3628	int
3629	il4965_sta_rx_agg_stop(struct il_priv *il, struct ieee80211_sta *sta, int tid)
3630	{
3631	unsigned long flags;
3632	int sta_id;
3633	struct il_addsta_cmd sta_cmd;
3634
3635	lockdep_assert_held(&il->mutex);
3636
3637	sta_id = il_sta_id(sta);
3638	if (sta_id == IL_INVALID_STATION) {
3639	IL_ERR("Invalid station for AGG tid %d\n", tid);
3640	return -ENXIO;
3641	}
3642
3643	spin_lock_irqsave(&il->sta_lock, flags);
3644	il->stations[sta_id].sta.station_flags_msk = 0;
3645	il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_DELBA_TID_MSK;
3646	il->stations[sta_id].sta.remove_immediate_ba_tid = (u8) tid;
3647	il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3648	memcpy(&sta_cmd, &il->stations[sta_id].sta,
3649	sizeof(struct il_addsta_cmd));
3650	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3651
3652	return il_send_add_sta(il, sta: &sta_cmd, flags: CMD_SYNC);
3653	}
3654
3655	void
3656	il4965_sta_modify_sleep_tx_count(struct il_priv *il, int sta_id, int cnt)
3657	{
3658	unsigned long flags;
3659
3660	spin_lock_irqsave(&il->sta_lock, flags);
3661	il->stations[sta_id].sta.station_flags |= STA_FLG_PWR_SAVE_MSK;
3662	il->stations[sta_id].sta.station_flags_msk = STA_FLG_PWR_SAVE_MSK;
3663	il->stations[sta_id].sta.sta.modify_mask =
3664	STA_MODIFY_SLEEP_TX_COUNT_MSK;
3665	il->stations[sta_id].sta.sleep_tx_count = cpu_to_le16(cnt);
3666	il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
3667	il_send_add_sta(il, sta: &il->stations[sta_id].sta, flags: CMD_ASYNC);
3668	spin_unlock_irqrestore(lock: &il->sta_lock, flags);
3669
3670	}
3671
3672	void
3673	il4965_update_chain_flags(struct il_priv *il)
3674	{
3675	if (il->ops->set_rxon_chain) {
3676	il->ops->set_rxon_chain(il);
3677	if (il->active.rx_chain != il->staging.rx_chain)
3678	il_commit_rxon(il);
3679	}
3680	}
3681
3682	static void
3683	il4965_clear_free_frames(struct il_priv *il)
3684	{
3685	struct list_head *element;
3686
3687	D_INFO("%d frames on pre-allocated heap on clear.\n", il->frames_count);
3688
3689	while (!list_empty(head: &il->free_frames)) {
3690	element = il->free_frames.next;
3691	list_del(entry: element);
3692	kfree(list_entry(element, struct il_frame, list));
3693	il->frames_count--;
3694	}
3695
3696	if (il->frames_count) {
3697	IL_WARN("%d frames still in use. Did we lose one?\n",
3698	il->frames_count);
3699	il->frames_count = 0;
3700	}
3701	}
3702
3703	static struct il_frame *
3704	il4965_get_free_frame(struct il_priv *il)
3705	{
3706	struct il_frame *frame;
3707	struct list_head *element;
3708	if (list_empty(head: &il->free_frames)) {
3709	frame = kzalloc(size: sizeof(*frame), GFP_KERNEL);
3710	if (!frame) {
3711	IL_ERR("Could not allocate frame!\n");
3712	return NULL;
3713	}
3714
3715	il->frames_count++;
3716	return frame;
3717	}
3718
3719	element = il->free_frames.next;
3720	list_del(entry: element);
3721	return list_entry(element, struct il_frame, list);
3722	}
3723
3724	static void
3725	il4965_free_frame(struct il_priv *il, struct il_frame *frame)
3726	{
3727	memset(frame, 0, sizeof(*frame));
3728	list_add(new: &frame->list, head: &il->free_frames);
3729	}
3730
3731	static u32
3732	il4965_fill_beacon_frame(struct il_priv *il, struct ieee80211_hdr *hdr,
3733	int left)
3734	{
3735	lockdep_assert_held(&il->mutex);
3736
3737	if (!il->beacon_skb)
3738	return 0;
3739
3740	if (il->beacon_skb->len > left)
3741	return 0;
3742
3743	memcpy(hdr, il->beacon_skb->data, il->beacon_skb->len);
3744
3745	return il->beacon_skb->len;
3746	}
3747
3748	/* Parse the beacon frame to find the TIM element and set tim_idx & tim_size */
3749	static void
3750	il4965_set_beacon_tim(struct il_priv *il,
3751	struct il_tx_beacon_cmd *tx_beacon_cmd, u8 * beacon,
3752	u32 frame_size)
3753	{
3754	u16 tim_idx;
3755	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)beacon;
3756
3757	/*
3758	* The idx is relative to frame start but we start looking at the
3759	* variable-length part of the beacon.
3760	*/
3761	tim_idx = mgmt->u.beacon.variable - beacon;
3762
3763	/* Parse variable-length elements of beacon to find WLAN_EID_TIM */
3764	while ((tim_idx < (frame_size - 2)) &&
3765	(beacon[tim_idx] != WLAN_EID_TIM))
3766	tim_idx += beacon[tim_idx + 1] + 2;
3767
3768	/* If TIM field was found, set variables */
3769	if ((tim_idx < (frame_size - 1)) && (beacon[tim_idx] == WLAN_EID_TIM)) {
3770	tx_beacon_cmd->tim_idx = cpu_to_le16(tim_idx);
3771	tx_beacon_cmd->tim_size = beacon[tim_idx + 1];
3772	} else
3773	IL_WARN("Unable to find TIM Element in beacon\n");
3774	}
3775
3776	static unsigned int
3777	il4965_hw_get_beacon_cmd(struct il_priv *il, struct il_frame *frame)
3778	{
3779	struct il_tx_beacon_cmd *tx_beacon_cmd;
3780	u32 frame_size;
3781	u32 rate_flags;
3782	u32 rate;
3783	/*
3784	* We have to set up the TX command, the TX Beacon command, and the
3785	* beacon contents.
3786	*/
3787
3788	lockdep_assert_held(&il->mutex);
3789
3790	if (!il->beacon_enabled) {
3791	IL_ERR("Trying to build beacon without beaconing enabled\n");
3792	return 0;
3793	}
3794
3795	/* Initialize memory */
3796	tx_beacon_cmd = &frame->u.beacon;
3797	memset(tx_beacon_cmd, 0, sizeof(*tx_beacon_cmd));
3798
3799	/* Set up TX beacon contents */
3800	frame_size =
3801	il4965_fill_beacon_frame(il, hdr: tx_beacon_cmd->frame,
3802	left: sizeof(frame->u) - sizeof(*tx_beacon_cmd));
3803	if (WARN_ON_ONCE(frame_size > MAX_MPDU_SIZE))
3804	return 0;
3805	if (!frame_size)
3806	return 0;
3807
3808	/* Set up TX command fields */
3809	tx_beacon_cmd->tx.len = cpu_to_le16((u16) frame_size);
3810	tx_beacon_cmd->tx.sta_id = il->hw_params.bcast_id;
3811	tx_beacon_cmd->tx.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
3812	tx_beacon_cmd->tx.tx_flags =
3813	TX_CMD_FLG_SEQ_CTL_MSK | TX_CMD_FLG_TSF_MSK |
3814	TX_CMD_FLG_STA_RATE_MSK;
3815
3816	/* Set up TX beacon command fields */
3817	il4965_set_beacon_tim(il, tx_beacon_cmd, beacon: (u8 *) tx_beacon_cmd->frame,
3818	frame_size);
3819
3820	/* Set up packet rate and flags */
3821	rate = il_get_lowest_plcp(il);
3822	il4965_toggle_tx_ant(il, ant: &il->mgmt_tx_ant, valid: il->hw_params.valid_tx_ant);
3823	rate_flags = BIT(il->mgmt_tx_ant) << RATE_MCS_ANT_POS;
3824	if ((rate >= IL_FIRST_CCK_RATE) && (rate <= IL_LAST_CCK_RATE))
3825	rate_flags |= RATE_MCS_CCK_MSK;
3826	tx_beacon_cmd->tx.rate_n_flags = cpu_to_le32(rate | rate_flags);
3827
3828	return sizeof(*tx_beacon_cmd) + frame_size;
3829	}
3830
3831	int
3832	il4965_send_beacon_cmd(struct il_priv *il)
3833	{
3834	struct il_frame *frame;
3835	unsigned int frame_size;
3836	int rc;
3837
3838	frame = il4965_get_free_frame(il);
3839	if (!frame) {
3840	IL_ERR("Could not obtain free frame buffer for beacon "
3841	"command.\n");
3842	return -ENOMEM;
3843	}
3844
3845	frame_size = il4965_hw_get_beacon_cmd(il, frame);
3846	if (!frame_size) {
3847	IL_ERR("Error configuring the beacon command\n");
3848	il4965_free_frame(il, frame);
3849	return -EINVAL;
3850	}
3851
3852	rc = il_send_cmd_pdu(il, id: C_TX_BEACON, len: frame_size, data: &frame->u.cmd[0]);
3853
3854	il4965_free_frame(il, frame);
3855
3856	return rc;
3857	}
3858
3859	static inline dma_addr_t
3860	il4965_tfd_tb_get_addr(struct il_tfd *tfd, u8 idx)
3861	{
3862	struct il_tfd_tb *tb = &tfd->tbs[idx];
3863
3864	dma_addr_t addr = get_unaligned_le32(p: &tb->lo);
3865	if (sizeof(dma_addr_t) > sizeof(u32))
3866	addr |=
3867	((dma_addr_t) (le16_to_cpu(tb->hi_n_len) & 0xF) << 16) <<
3868	16;
3869
3870	return addr;
3871	}
3872
3873	static inline u16
3874	il4965_tfd_tb_get_len(struct il_tfd *tfd, u8 idx)
3875	{
3876	struct il_tfd_tb *tb = &tfd->tbs[idx];
3877
3878	return le16_to_cpu(tb->hi_n_len) >> 4;
3879	}
3880
3881	static inline void
3882	il4965_tfd_set_tb(struct il_tfd *tfd, u8 idx, dma_addr_t addr, u16 len)
3883	{
3884	struct il_tfd_tb *tb = &tfd->tbs[idx];
3885	u16 hi_n_len = len << 4;
3886
3887	put_unaligned_le32(val: addr, p: &tb->lo);
3888	if (sizeof(dma_addr_t) > sizeof(u32))
3889	hi_n_len |= ((addr >> 16) >> 16) & 0xF;
3890
3891	tb->hi_n_len = cpu_to_le16(hi_n_len);
3892
3893	tfd->num_tbs = idx + 1;
3894	}
3895
3896	static inline u8
3897	il4965_tfd_get_num_tbs(struct il_tfd *tfd)
3898	{
3899	return tfd->num_tbs & 0x1f;
3900	}
3901
3902	/*
3903	* il4965_hw_txq_free_tfd - Free all chunks referenced by TFD [txq->q.read_ptr]
3904	*
3905	* Does NOT advance any TFD circular buffer read/write idxes
3906	* Does NOT free the TFD itself (which is within circular buffer)
3907	*/
3908	void
3909	il4965_hw_txq_free_tfd(struct il_priv *il, struct il_tx_queue *txq)
3910	{
3911	struct il_tfd *tfd_tmp = (struct il_tfd *)txq->tfds;
3912	struct il_tfd *tfd;
3913	struct pci_dev *dev = il->pci_dev;
3914	int idx = txq->q.read_ptr;
3915	int i;
3916	int num_tbs;
3917
3918	tfd = &tfd_tmp[idx];
3919
3920	/* Sanity check on number of chunks */
3921	num_tbs = il4965_tfd_get_num_tbs(tfd);
3922
3923	if (num_tbs >= IL_NUM_OF_TBS) {
3924	IL_ERR("Too many chunks: %i\n", num_tbs);
3925	/* @todo issue fatal error, it is quite serious situation */
3926	return;
3927	}
3928
3929	/* Unmap tx_cmd */
3930	if (num_tbs)
3931	dma_unmap_single(&dev->dev,
3932	dma_unmap_addr(&txq->meta[idx], mapping),
3933	dma_unmap_len(&txq->meta[idx], len),
3934	DMA_BIDIRECTIONAL);
3935
3936	/* Unmap chunks, if any. */
3937	for (i = 1; i < num_tbs; i++)
3938	dma_unmap_single(&dev->dev, il4965_tfd_tb_get_addr(tfd, i),
3939	il4965_tfd_tb_get_len(tfd, i), DMA_TO_DEVICE);
3940
3941	/* free SKB */
3942	if (txq->skbs) {
3943	struct sk_buff *skb = txq->skbs[txq->q.read_ptr];
3944
3945	/* can be called from irqs-disabled context */
3946	if (skb) {
3947	dev_kfree_skb_any(skb);
3948	txq->skbs[txq->q.read_ptr] = NULL;
3949	}
3950	}
3951	}
3952
3953	int
3954	il4965_hw_txq_attach_buf_to_tfd(struct il_priv *il, struct il_tx_queue *txq,
3955	dma_addr_t addr, u16 len, u8 reset, u8 pad)
3956	{
3957	struct il_queue *q;
3958	struct il_tfd *tfd, *tfd_tmp;
3959	u32 num_tbs;
3960
3961	q = &txq->q;
3962	tfd_tmp = (struct il_tfd *)txq->tfds;
3963	tfd = &tfd_tmp[q->write_ptr];
3964
3965	if (reset)
3966	memset(tfd, 0, sizeof(*tfd));
3967
3968	num_tbs = il4965_tfd_get_num_tbs(tfd);
3969
3970	/* Each TFD can point to a maximum 20 Tx buffers */
3971	if (num_tbs >= IL_NUM_OF_TBS) {
3972	IL_ERR("Error can not send more than %d chunks\n",
3973	IL_NUM_OF_TBS);
3974	return -EINVAL;
3975	}
3976
3977	BUG_ON(addr & ~DMA_BIT_MASK(36));
3978	if (unlikely(addr & ~IL_TX_DMA_MASK))
3979	IL_ERR("Unaligned address = %llx\n", (unsigned long long)addr);
3980
3981	il4965_tfd_set_tb(tfd, idx: num_tbs, addr, len);
3982
3983	return 0;
3984	}
3985
3986	/*
3987	* Tell nic where to find circular buffer of Tx Frame Descriptors for
3988	* given Tx queue, and enable the DMA channel used for that queue.
3989	*
3990	* 4965 supports up to 16 Tx queues in DRAM, mapped to up to 8 Tx DMA
3991	* channels supported in hardware.
3992	*/
3993	int
3994	il4965_hw_tx_queue_init(struct il_priv *il, struct il_tx_queue *txq)
3995	{
3996	int txq_id = txq->q.id;
3997
3998	/* Circular buffer (TFD queue in DRAM) physical base address */
3999	il_wr(il, FH49_MEM_CBBC_QUEUE(txq_id), value: txq->q.dma_addr >> 8);
4000
4001	return 0;
4002	}
4003
4004	/******************************************************************************
4005	*
4006	* Generic RX handler implementations
4007	*
4008	******************************************************************************/
4009	static void
4010	il4965_hdl_alive(struct il_priv *il, struct il_rx_buf *rxb)
4011	{
4012	struct il_rx_pkt *pkt = rxb_addr(rxb);
4013	struct il_alive_resp *palive;
4014	struct delayed_work *pwork;
4015
4016	palive = &pkt->u.alive_frame;
4017
4018	D_INFO("Alive ucode status 0x%08X revision " "0x%01X 0x%01X\n",
4019	palive->is_valid, palive->ver_type, palive->ver_subtype);
4020
4021	if (palive->ver_subtype == INITIALIZE_SUBTYPE) {
4022	D_INFO("Initialization Alive received.\n");
4023	memcpy(&il->card_alive_init, &pkt->u.raw,
4024	sizeof(struct il_init_alive_resp));
4025	pwork = &il->init_alive_start;
4026	} else {
4027	D_INFO("Runtime Alive received.\n");
4028	memcpy(&il->card_alive, &pkt->u.alive_frame,
4029	sizeof(struct il_alive_resp));
4030	pwork = &il->alive_start;
4031	}
4032
4033	/* We delay the ALIVE response by 5ms to
4034	* give the HW RF Kill time to activate... */
4035	if (palive->is_valid == UCODE_VALID_OK)
4036	queue_delayed_work(wq: il->workqueue, dwork: pwork, delay: msecs_to_jiffies(m: 5));
4037	else
4038	IL_WARN("uCode did not respond OK.\n");
4039	}
4040
4041	/*
4042	* il4965_bg_stats_periodic - Timer callback to queue stats
4043	*
4044	* This callback is provided in order to send a stats request.
4045	*
4046	* This timer function is continually reset to execute within
4047	* 60 seconds since the last N_STATS was received. We need to
4048	* ensure we receive the stats in order to update the temperature
4049	* used for calibrating the TXPOWER.
4050	*/
4051	static void
4052	il4965_bg_stats_periodic(struct timer_list *t)
4053	{
4054	struct il_priv *il = from_timer(il, t, stats_periodic);
4055
4056	if (test_bit(S_EXIT_PENDING, &il->status))
4057	return;
4058
4059	/* dont send host command if rf-kill is on */
4060	if (!il_is_ready_rf(il))
4061	return;
4062
4063	il_send_stats_request(il, flags: CMD_ASYNC, clear: false);
4064	}
4065
4066	static void
4067	il4965_hdl_beacon(struct il_priv *il, struct il_rx_buf *rxb)
4068	{
4069	struct il_rx_pkt *pkt = rxb_addr(rxb);
4070	struct il4965_beacon_notif *beacon =
4071	(struct il4965_beacon_notif *)pkt->u.raw;
4072	#ifdef CONFIG_IWLEGACY_DEBUG
4073	u8 rate = il4965_hw_get_rate(rate_n_flags: beacon->beacon_notify_hdr.rate_n_flags);
4074
4075	D_RX("beacon status %x retries %d iss %d tsf:0x%.8x%.8x rate %d\n",
4076	le32_to_cpu(beacon->beacon_notify_hdr.u.status) & TX_STATUS_MSK,
4077	beacon->beacon_notify_hdr.failure_frame,
4078	le32_to_cpu(beacon->ibss_mgr_status),
4079	le32_to_cpu(beacon->high_tsf), le32_to_cpu(beacon->low_tsf), rate);
4080	#endif
4081	il->ibss_manager = le32_to_cpu(beacon->ibss_mgr_status);
4082	}
4083
4084	static void
4085	il4965_perform_ct_kill_task(struct il_priv *il)
4086	{
4087	unsigned long flags;
4088
4089	D_POWER("Stop all queues\n");
4090
4091	if (il->mac80211_registered)
4092	ieee80211_stop_queues(hw: il->hw);
4093
4094	_il_wr(il, CSR_UCODE_DRV_GP1_SET,
4095	CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT);
4096	_il_rd(il, CSR_UCODE_DRV_GP1);
4097
4098	spin_lock_irqsave(&il->reg_lock, flags);
4099	if (likely(_il_grab_nic_access(il)))
4100	_il_release_nic_access(il);
4101	spin_unlock_irqrestore(lock: &il->reg_lock, flags);
4102	}
4103
4104	/* Handle notification from uCode that card's power state is changing
4105	* due to software, hardware, or critical temperature RFKILL */
4106	static void
4107	il4965_hdl_card_state(struct il_priv *il, struct il_rx_buf *rxb)
4108	{
4109	struct il_rx_pkt *pkt = rxb_addr(rxb);
4110	u32 flags = le32_to_cpu(pkt->u.card_state_notif.flags);
4111	unsigned long status = il->status;
4112
4113	D_RF_KILL("Card state received: HW:%s SW:%s CT:%s\n",
4114	(flags & HW_CARD_DISABLED) ? "Kill" : "On",
4115	(flags & SW_CARD_DISABLED) ? "Kill" : "On",
4116	(flags & CT_CARD_DISABLED) ? "Reached" : "Not reached");
4117
4118	if (flags & (SW_CARD_DISABLED | HW_CARD_DISABLED | CT_CARD_DISABLED)) {
4119
4120	_il_wr(il, CSR_UCODE_DRV_GP1_SET,
4121	CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
4122
4123	il_wr(il, HBUS_TARG_MBX_C, HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED);
4124
4125	if (!(flags & RXON_CARD_DISABLED)) {
4126	_il_wr(il, CSR_UCODE_DRV_GP1_CLR,
4127	CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
4128	il_wr(il, HBUS_TARG_MBX_C,
4129	HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED);
4130	}
4131	}
4132
4133	if (flags & CT_CARD_DISABLED)
4134	il4965_perform_ct_kill_task(il);
4135
4136	if (flags & HW_CARD_DISABLED)
4137	set_bit(S_RFKILL, addr: &il->status);
4138	else
4139	clear_bit(S_RFKILL, addr: &il->status);
4140
4141	if (!(flags & RXON_CARD_DISABLED))
4142	il_scan_cancel(il);
4143
4144	if ((test_bit(S_RFKILL, &status) !=
4145	test_bit(S_RFKILL, &il->status)))
4146	wiphy_rfkill_set_hw_state(wiphy: il->hw->wiphy,
4147	test_bit(S_RFKILL, &il->status));
4148	else
4149	wake_up(&il->wait_command_queue);
4150	}
4151
4152	/*
4153	* il4965_setup_handlers - Initialize Rx handler callbacks
4154	*
4155	* Setup the RX handlers for each of the reply types sent from the uCode
4156	* to the host.
4157	*
4158	* This function chains into the hardware specific files for them to setup
4159	* any hardware specific handlers as well.
4160	*/
4161	static void
4162	il4965_setup_handlers(struct il_priv *il)
4163	{
4164	il->handlers[N_ALIVE] = il4965_hdl_alive;
4165	il->handlers[N_ERROR] = il_hdl_error;
4166	il->handlers[N_CHANNEL_SWITCH] = il_hdl_csa;
4167	il->handlers[N_SPECTRUM_MEASUREMENT] = il_hdl_spectrum_measurement;
4168	il->handlers[N_PM_SLEEP] = il_hdl_pm_sleep;
4169	il->handlers[N_PM_DEBUG_STATS] = il_hdl_pm_debug_stats;
4170	il->handlers[N_BEACON] = il4965_hdl_beacon;
4171
4172	/*
4173	* The same handler is used for both the REPLY to a discrete
4174	* stats request from the host as well as for the periodic
4175	* stats notifications (after received beacons) from the uCode.
4176	*/
4177	il->handlers[C_STATS] = il4965_hdl_c_stats;
4178	il->handlers[N_STATS] = il4965_hdl_stats;
4179
4180	il_setup_rx_scan_handlers(il);
4181
4182	/* status change handler */
4183	il->handlers[N_CARD_STATE] = il4965_hdl_card_state;
4184
4185	il->handlers[N_MISSED_BEACONS] = il4965_hdl_missed_beacon;
4186	/* Rx handlers */
4187	il->handlers[N_RX_PHY] = il4965_hdl_rx_phy;
4188	il->handlers[N_RX_MPDU] = il4965_hdl_rx;
4189	il->handlers[N_RX] = il4965_hdl_rx;
4190	/* block ack */
4191	il->handlers[N_COMPRESSED_BA] = il4965_hdl_compressed_ba;
4192	/* Tx response */
4193	il->handlers[C_TX] = il4965_hdl_tx;
4194	}
4195
4196	/*
4197	* il4965_rx_handle - Main entry function for receiving responses from uCode
4198	*
4199	* Uses the il->handlers callback function array to invoke
4200	* the appropriate handlers, including command responses,
4201	* frame-received notifications, and other notifications.
4202	*/
4203	void
4204	il4965_rx_handle(struct il_priv *il)
4205	{
4206	struct il_rx_buf *rxb;
4207	struct il_rx_pkt *pkt;
4208	struct il_rx_queue *rxq = &il->rxq;
4209	u32 r, i;
4210	int reclaim;
4211	unsigned long flags;
4212	u8 fill_rx = 0;
4213	u32 count = 8;
4214	int total_empty;
4215
4216	/* uCode's read idx (stored in shared DRAM) indicates the last Rx
4217	* buffer that the driver may process (last buffer filled by ucode). */
4218	r = le16_to_cpu(rxq->rb_stts->closed_rb_num) & 0x0FFF;
4219	i = rxq->read;
4220
4221	/* Rx interrupt, but nothing sent from uCode */
4222	if (i == r)
4223	D_RX("r = %d, i = %d\n", r, i);
4224
4225	/* calculate total frames need to be restock after handling RX */
4226	total_empty = r - rxq->write_actual;
4227	if (total_empty < 0)
4228	total_empty += RX_QUEUE_SIZE;
4229
4230	if (total_empty > (RX_QUEUE_SIZE / 2))
4231	fill_rx = 1;
4232
4233	while (i != r) {
4234	rxb = rxq->queue[i];
4235
4236	/* If an RXB doesn't have a Rx queue slot associated with it,
4237	* then a bug has been introduced in the queue refilling
4238	* routines -- catch it here */
4239	BUG_ON(rxb == NULL);
4240
4241	rxq->queue[i] = NULL;
4242
4243	dma_unmap_page(&il->pci_dev->dev, rxb->page_dma,
4244	PAGE_SIZE << il->hw_params.rx_page_order,
4245	DMA_FROM_DEVICE);
4246	pkt = rxb_addr(rxb);
4247	reclaim = il_need_reclaim(il, pkt);
4248
4249	/* Based on type of command response or notification,
4250	* handle those that need handling via function in
4251	* handlers table. See il4965_setup_handlers() */
4252	if (il->handlers[pkt->hdr.cmd]) {
4253	D_RX("r = %d, i = %d, %s, 0x%02x\n", r, i,
4254	il_get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
4255	il->isr_stats.handlers[pkt->hdr.cmd]++;
4256	il->handlers[pkt->hdr.cmd] (il, rxb);
4257	} else {
4258	/* No handling needed */
4259	D_RX("r %d i %d No handler needed for %s, 0x%02x\n", r,
4260	i, il_get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
4261	}
4262
4263	/*
4264	* XXX: After here, we should always check rxb->page
4265	* against NULL before touching it or its virtual
4266	* memory (pkt). Because some handler might have
4267	* already taken or freed the pages.
4268	*/
4269
4270	if (reclaim) {
4271	/* Invoke any callbacks, transfer the buffer to caller,
4272	* and fire off the (possibly) blocking il_send_cmd()
4273	* as we reclaim the driver command queue */
4274	if (rxb->page)
4275	il_tx_cmd_complete(il, rxb);
4276	else
4277	IL_WARN("Claim null rxb?\n");
4278	}
4279
4280	/* Reuse the page if possible. For notification packets and
4281	* SKBs that fail to Rx correctly, add them back into the
4282	* rx_free list for reuse later. */
4283	spin_lock_irqsave(&rxq->lock, flags);
4284	if (rxb->page != NULL) {
4285	rxb->page_dma =
4286	dma_map_page(&il->pci_dev->dev, rxb->page, 0,
4287	PAGE_SIZE << il->hw_params.rx_page_order,
4288	DMA_FROM_DEVICE);
4289
4290	if (unlikely(dma_mapping_error(&il->pci_dev->dev,
4291	rxb->page_dma))) {
4292	__il_free_pages(il, page: rxb->page);
4293	rxb->page = NULL;
4294	list_add_tail(new: &rxb->list, head: &rxq->rx_used);
4295	} else {
4296	list_add_tail(new: &rxb->list, head: &rxq->rx_free);
4297	rxq->free_count++;
4298	}
4299	} else
4300	list_add_tail(new: &rxb->list, head: &rxq->rx_used);
4301
4302	spin_unlock_irqrestore(lock: &rxq->lock, flags);
4303
4304	i = (i + 1) & RX_QUEUE_MASK;
4305	/* If there are a lot of unused frames,
4306	* restock the Rx queue so ucode wont assert. */
4307	if (fill_rx) {
4308	count++;
4309	if (count >= 8) {
4310	rxq->read = i;
4311	il4965_rx_replenish_now(il);
4312	count = 0;
4313	}
4314	}
4315	}
4316
4317	/* Backtrack one entry */
4318	rxq->read = i;
4319	if (fill_rx)
4320	il4965_rx_replenish_now(il);
4321	else
4322	il4965_rx_queue_restock(il);
4323	}
4324
4325	/* call this function to flush any scheduled tasklet */
4326	static inline void
4327	il4965_synchronize_irq(struct il_priv *il)
4328	{
4329	/* wait to make sure we flush pending tasklet */
4330	synchronize_irq(irq: il->pci_dev->irq);
4331	tasklet_kill(t: &il->irq_tasklet);
4332	}
4333
4334	static void
4335	il4965_irq_tasklet(struct tasklet_struct *t)
4336	{
4337	struct il_priv *il = from_tasklet(il, t, irq_tasklet);
4338	u32 inta, handled = 0;
4339	u32 inta_fh;
4340	unsigned long flags;
4341	u32 i;
4342	#ifdef CONFIG_IWLEGACY_DEBUG
4343	u32 inta_mask;
4344	#endif
4345
4346	spin_lock_irqsave(&il->lock, flags);
4347
4348	/* Ack/clear/reset pending uCode interrupts.
4349	* Note: Some bits in CSR_INT are "OR" of bits in CSR_FH_INT_STATUS,
4350	* and will clear only when CSR_FH_INT_STATUS gets cleared. */
4351	inta = _il_rd(il, CSR_INT);
4352	_il_wr(il, CSR_INT, val: inta);
4353
4354	/* Ack/clear/reset pending flow-handler (DMA) interrupts.
4355	* Any new interrupts that happen after this, either while we're
4356	* in this tasklet, or later, will show up in next ISR/tasklet. */
4357	inta_fh = _il_rd(il, CSR_FH_INT_STATUS);
4358	_il_wr(il, CSR_FH_INT_STATUS, val: inta_fh);
4359
4360	#ifdef CONFIG_IWLEGACY_DEBUG
4361	if (il_get_debug_level(il) & IL_DL_ISR) {
4362	/* just for debug */
4363	inta_mask = _il_rd(il, CSR_INT_MASK);
4364	D_ISR("inta 0x%08x, enabled 0x%08x, fh 0x%08x\n", inta,
4365	inta_mask, inta_fh);
4366	}
4367	#endif
4368
4369	spin_unlock_irqrestore(lock: &il->lock, flags);
4370
4371	/* Since CSR_INT and CSR_FH_INT_STATUS reads and clears are not
4372	* atomic, make sure that inta covers all the interrupts that
4373	* we've discovered, even if FH interrupt came in just after
4374	* reading CSR_INT. */
4375	if (inta_fh & CSR49_FH_INT_RX_MASK)
4376	inta |= CSR_INT_BIT_FH_RX;
4377	if (inta_fh & CSR49_FH_INT_TX_MASK)
4378	inta |= CSR_INT_BIT_FH_TX;
4379
4380	/* Now service all interrupt bits discovered above. */
4381	if (inta & CSR_INT_BIT_HW_ERR) {
4382	IL_ERR("Hardware error detected. Restarting.\n");
4383
4384	/* Tell the device to stop sending interrupts */
4385	il_disable_interrupts(il);
4386
4387	il->isr_stats.hw++;
4388	il_irq_handle_error(il);
4389
4390	handled |= CSR_INT_BIT_HW_ERR;
4391
4392	return;
4393	}
4394	#ifdef CONFIG_IWLEGACY_DEBUG
4395	if (il_get_debug_level(il) & (IL_DL_ISR)) {
4396	/* NIC fires this, but we don't use it, redundant with WAKEUP */
4397	if (inta & CSR_INT_BIT_SCD) {
4398	D_ISR("Scheduler finished to transmit "
4399	"the frame/frames.\n");
4400	il->isr_stats.sch++;
4401	}
4402
4403	/* Alive notification via Rx interrupt will do the real work */
4404	if (inta & CSR_INT_BIT_ALIVE) {
4405	D_ISR("Alive interrupt\n");
4406	il->isr_stats.alive++;
4407	}
4408	}
4409	#endif
4410	/* Safely ignore these bits for debug checks below */
4411	inta &= ~(CSR_INT_BIT_SCD | CSR_INT_BIT_ALIVE);
4412
4413	/* HW RF KILL switch toggled */
4414	if (inta & CSR_INT_BIT_RF_KILL) {
4415	int hw_rf_kill = 0;
4416
4417	if (!(_il_rd(il, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW))
4418	hw_rf_kill = 1;
4419
4420	IL_WARN("RF_KILL bit toggled to %s.\n",
4421	hw_rf_kill ? "disable radio" : "enable radio");
4422
4423	il->isr_stats.rfkill++;
4424
4425	/* driver only loads ucode once setting the interface up.
4426	* the driver allows loading the ucode even if the radio
4427	* is killed. Hence update the killswitch state here. The
4428	* rfkill handler will care about restarting if needed.
4429	*/
4430	if (hw_rf_kill) {
4431	set_bit(S_RFKILL, addr: &il->status);
4432	} else {
4433	clear_bit(S_RFKILL, addr: &il->status);
4434	il_force_reset(il, external: true);
4435	}
4436	wiphy_rfkill_set_hw_state(wiphy: il->hw->wiphy, blocked: hw_rf_kill);
4437
4438	handled |= CSR_INT_BIT_RF_KILL;
4439	}
4440
4441	/* Chip got too hot and stopped itself */
4442	if (inta & CSR_INT_BIT_CT_KILL) {
4443	IL_ERR("Microcode CT kill error detected.\n");
4444	il->isr_stats.ctkill++;
4445	handled |= CSR_INT_BIT_CT_KILL;
4446	}
4447
4448	/* Error detected by uCode */
4449	if (inta & CSR_INT_BIT_SW_ERR) {
4450	IL_ERR("Microcode SW error detected. " " Restarting 0x%X.\n",
4451	inta);
4452	il->isr_stats.sw++;
4453	il_irq_handle_error(il);
4454	handled |= CSR_INT_BIT_SW_ERR;
4455	}
4456
4457	/*
4458	* uCode wakes up after power-down sleep.
4459	* Tell device about any new tx or host commands enqueued,
4460	* and about any Rx buffers made available while asleep.
4461	*/
4462	if (inta & CSR_INT_BIT_WAKEUP) {
4463	D_ISR("Wakeup interrupt\n");
4464	il_rx_queue_update_write_ptr(il, q: &il->rxq);
4465	for (i = 0; i < il->hw_params.max_txq_num; i++)
4466	il_txq_update_write_ptr(il, txq: &il->txq[i]);
4467	il->isr_stats.wakeup++;
4468	handled |= CSR_INT_BIT_WAKEUP;
4469	}
4470
4471	/* All uCode command responses, including Tx command responses,
4472	* Rx "responses" (frame-received notification), and other
4473	* notifications from uCode come through here*/
4474	if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX)) {
4475	il4965_rx_handle(il);
4476	il->isr_stats.rx++;
4477	handled |= (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX);
4478	}
4479
4480	/* This "Tx" DMA channel is used only for loading uCode */
4481	if (inta & CSR_INT_BIT_FH_TX) {
4482	D_ISR("uCode load interrupt\n");
4483	il->isr_stats.tx++;
4484	handled |= CSR_INT_BIT_FH_TX;
4485	/* Wake up uCode load routine, now that load is complete */
4486	il->ucode_write_complete = 1;
4487	wake_up(&il->wait_command_queue);
4488	}
4489
4490	if (inta & ~handled) {
4491	IL_ERR("Unhandled INTA bits 0x%08x\n", inta & ~handled);
4492	il->isr_stats.unhandled++;
4493	}
4494
4495	if (inta & ~(il->inta_mask)) {
4496	IL_WARN("Disabled INTA bits 0x%08x were pending\n",
4497	inta & ~il->inta_mask);
4498	IL_WARN(" with FH49_INT = 0x%08x\n", inta_fh);
4499	}
4500
4501	/* Re-enable all interrupts */
4502	/* only Re-enable if disabled by irq */
4503	if (test_bit(S_INT_ENABLED, &il->status))
4504	il_enable_interrupts(il);
4505	/* Re-enable RF_KILL if it occurred */
4506	else if (handled & CSR_INT_BIT_RF_KILL)
4507	il_enable_rfkill_int(il);
4508
4509	#ifdef CONFIG_IWLEGACY_DEBUG
4510	if (il_get_debug_level(il) & (IL_DL_ISR)) {
4511	inta = _il_rd(il, CSR_INT);
4512	inta_mask = _il_rd(il, CSR_INT_MASK);
4513	inta_fh = _il_rd(il, CSR_FH_INT_STATUS);
4514	D_ISR("End inta 0x%08x, enabled 0x%08x, fh 0x%08x, "
4515	"flags 0x%08lx\n", inta, inta_mask, inta_fh, flags);
4516	}
4517	#endif
4518	}
4519
4520	/*****************************************************************************
4521	*
4522	* sysfs attributes
4523	*
4524	*****************************************************************************/
4525
4526	#ifdef CONFIG_IWLEGACY_DEBUG
4527
4528	/*
4529	* The following adds a new attribute to the sysfs representation
4530	* of this device driver (i.e. a new file in /sys/class/net/wlan0/device/)
4531	* used for controlling the debug level.
4532	*
4533	* See the level definitions in iwl for details.
4534	*
4535	* The debug_level being managed using sysfs below is a per device debug
4536	* level that is used instead of the global debug level if it (the per
4537	* device debug level) is set.
4538	*/
4539	static ssize_t
4540	il4965_show_debug_level(struct device *d, struct device_attribute *attr,
4541	char *buf)
4542	{
4543	struct il_priv *il = dev_get_drvdata(dev: d);
4544	return sprintf(buf, fmt: "0x%08X\n", il_get_debug_level(il));
4545	}
4546
4547	static ssize_t
4548	il4965_store_debug_level(struct device *d, struct device_attribute *attr,
4549	const char *buf, size_t count)
4550	{
4551	struct il_priv *il = dev_get_drvdata(dev: d);
4552	unsigned long val;
4553	int ret;
4554
4555	ret = kstrtoul(s: buf, base: 0, res: &val);
4556	if (ret)
4557	IL_ERR("%s is not in hex or decimal form.\n", buf);
4558	else
4559	il->debug_level = val;
4560
4561	return strnlen(p: buf, maxlen: count);
4562	}
4563
4564	static DEVICE_ATTR(debug_level, 0644, il4965_show_debug_level,
4565	il4965_store_debug_level);
4566
4567	#endif /* CONFIG_IWLEGACY_DEBUG */
4568
4569	static ssize_t
4570	il4965_show_temperature(struct device *d, struct device_attribute *attr,
4571	char *buf)
4572	{
4573	struct il_priv *il = dev_get_drvdata(dev: d);
4574
4575	if (!il_is_alive(il))
4576	return -EAGAIN;
4577
4578	return sprintf(buf, fmt: "%d\n", il->temperature);
4579	}
4580
4581	static DEVICE_ATTR(temperature, 0444, il4965_show_temperature, NULL);
4582
4583	static ssize_t
4584	il4965_show_tx_power(struct device *d, struct device_attribute *attr, char *buf)
4585	{
4586	struct il_priv *il = dev_get_drvdata(dev: d);
4587
4588	if (!il_is_ready_rf(il))
4589	return sprintf(buf, fmt: "off\n");
4590	else
4591	return sprintf(buf, fmt: "%d\n", il->tx_power_user_lmt);
4592	}
4593
4594	static ssize_t
4595	il4965_store_tx_power(struct device *d, struct device_attribute *attr,
4596	const char *buf, size_t count)
4597	{
4598	struct il_priv *il = dev_get_drvdata(dev: d);
4599	unsigned long val;
4600	int ret;
4601
4602	ret = kstrtoul(s: buf, base: 10, res: &val);
4603	if (ret)
4604	IL_INFO("%s is not in decimal form.\n", buf);
4605	else {
4606	ret = il_set_tx_power(il, tx_power: val, force: false);
4607	if (ret)
4608	IL_ERR("failed setting tx power (0x%08x).\n", ret);
4609	else
4610	ret = count;
4611	}
4612	return ret;
4613	}
4614
4615	static DEVICE_ATTR(tx_power, 0644, il4965_show_tx_power,
4616	il4965_store_tx_power);
4617
4618	static struct attribute *il_sysfs_entries[] = {
4619	&dev_attr_temperature.attr,
4620	&dev_attr_tx_power.attr,
4621	#ifdef CONFIG_IWLEGACY_DEBUG
4622	&dev_attr_debug_level.attr,
4623	#endif
4624	NULL
4625	};
4626
4627	static const struct attribute_group il_attribute_group = {
4628	.name = NULL, /* put in device directory */
4629	.attrs = il_sysfs_entries,
4630	};
4631
4632	/******************************************************************************
4633	*
4634	* uCode download functions
4635	*
4636	******************************************************************************/
4637
4638	static void
4639	il4965_dealloc_ucode_pci(struct il_priv *il)
4640	{
4641	il_free_fw_desc(pci_dev: il->pci_dev, desc: &il->ucode_code);
4642	il_free_fw_desc(pci_dev: il->pci_dev, desc: &il->ucode_data);
4643	il_free_fw_desc(pci_dev: il->pci_dev, desc: &il->ucode_data_backup);
4644	il_free_fw_desc(pci_dev: il->pci_dev, desc: &il->ucode_init);
4645	il_free_fw_desc(pci_dev: il->pci_dev, desc: &il->ucode_init_data);
4646	il_free_fw_desc(pci_dev: il->pci_dev, desc: &il->ucode_boot);
4647	}
4648
4649	static void
4650	il4965_nic_start(struct il_priv *il)
4651	{
4652	/* Remove all resets to allow NIC to operate */
4653	_il_wr(il, CSR_RESET, val: 0);
4654	}
4655
4656	static void il4965_ucode_callback(const struct firmware *ucode_raw,
4657	void *context);
4658	static int il4965_mac_setup_register(struct il_priv *il, u32 max_probe_length);
4659
4660	static int __must_check
4661	il4965_request_firmware(struct il_priv *il, bool first)
4662	{
4663	const char *name_pre = il->cfg->fw_name_pre;
4664	char tag[8];
4665
4666	if (first) {
4667	il->fw_idx = il->cfg->ucode_api_max;
4668	sprintf(buf: tag, fmt: "%d", il->fw_idx);
4669	} else {
4670	il->fw_idx--;
4671	sprintf(buf: tag, fmt: "%d", il->fw_idx);
4672	}
4673
4674	if (il->fw_idx < il->cfg->ucode_api_min) {
4675	IL_ERR("no suitable firmware found!\n");
4676	return -ENOENT;
4677	}
4678
4679	sprintf(buf: il->firmware_name, fmt: "%s%s%s", name_pre, tag, ".ucode");
4680
4681	D_INFO("attempting to load firmware '%s'\n", il->firmware_name);
4682
4683	return request_firmware_nowait(THIS_MODULE, uevent: 1, name: il->firmware_name,
4684	device: &il->pci_dev->dev, GFP_KERNEL, context: il,
4685	cont: il4965_ucode_callback);
4686	}
4687
4688	struct il4965_firmware_pieces {
4689	const void *inst, *data, *init, *init_data, *boot;
4690	size_t inst_size, data_size, init_size, init_data_size, boot_size;
4691	};
4692
4693	static int
4694	il4965_load_firmware(struct il_priv *il, const struct firmware *ucode_raw,
4695	struct il4965_firmware_pieces *pieces)
4696	{
4697	struct il_ucode_header *ucode = (void *)ucode_raw->data;
4698	u32 api_ver, hdr_size;
4699	const u8 *src;
4700
4701	il->ucode_ver = le32_to_cpu(ucode->ver);
4702	api_ver = IL_UCODE_API(il->ucode_ver);
4703
4704	switch (api_ver) {
4705	default:
4706	case 0:
4707	case 1:
4708	case 2:
4709	hdr_size = 24;
4710	if (ucode_raw->size < hdr_size) {
4711	IL_ERR("File size too small!\n");
4712	return -EINVAL;
4713	}
4714	pieces->inst_size = le32_to_cpu(ucode->v1.inst_size);
4715	pieces->data_size = le32_to_cpu(ucode->v1.data_size);
4716	pieces->init_size = le32_to_cpu(ucode->v1.init_size);
4717	pieces->init_data_size = le32_to_cpu(ucode->v1.init_data_size);
4718	pieces->boot_size = le32_to_cpu(ucode->v1.boot_size);
4719	src = ucode->v1.data;
4720	break;
4721	}
4722
4723	/* Verify size of file vs. image size info in file's header */
4724	if (ucode_raw->size !=
4725	hdr_size + pieces->inst_size + pieces->data_size +
4726	pieces->init_size + pieces->init_data_size + pieces->boot_size) {
4727
4728	IL_ERR("uCode file size %d does not match expected size\n",
4729	(int)ucode_raw->size);
4730	return -EINVAL;
4731	}
4732
4733	pieces->inst = src;
4734	src += pieces->inst_size;
4735	pieces->data = src;
4736	src += pieces->data_size;
4737	pieces->init = src;
4738	src += pieces->init_size;
4739	pieces->init_data = src;
4740	src += pieces->init_data_size;
4741	pieces->boot = src;
4742	src += pieces->boot_size;
4743
4744	return 0;
4745	}
4746
4747	/*
4748	* il4965_ucode_callback - callback when firmware was loaded
4749	*
4750	* If loaded successfully, copies the firmware into buffers
4751	* for the card to fetch (via DMA).
4752	*/
4753	static void
4754	il4965_ucode_callback(const struct firmware *ucode_raw, void *context)
4755	{
4756	struct il_priv *il = context;
4757	int err;
4758	struct il4965_firmware_pieces pieces;
4759	const unsigned int api_max = il->cfg->ucode_api_max;
4760	const unsigned int api_min = il->cfg->ucode_api_min;
4761	u32 api_ver;
4762
4763	u32 max_probe_length = 200;
4764	u32 standard_phy_calibration_size =
4765	IL_DEFAULT_STANDARD_PHY_CALIBRATE_TBL_SIZE;
4766
4767	memset(&pieces, 0, sizeof(pieces));
4768
4769	if (!ucode_raw) {
4770	if (il->fw_idx <= il->cfg->ucode_api_max)
4771	IL_ERR("request for firmware file '%s' failed.\n",
4772	il->firmware_name);
4773	goto try_again;
4774	}
4775
4776	D_INFO("Loaded firmware file '%s' (%zd bytes).\n", il->firmware_name,
4777	ucode_raw->size);
4778
4779	/* Make sure that we got at least the API version number */
4780	if (ucode_raw->size < 4) {
4781	IL_ERR("File size way too small!\n");
4782	goto try_again;
4783	}
4784
4785	/* Data from ucode file: header followed by uCode images */
4786	err = il4965_load_firmware(il, ucode_raw, pieces: &pieces);
4787
4788	if (err)
4789	goto try_again;
4790
4791	api_ver = IL_UCODE_API(il->ucode_ver);
4792
4793	/*
4794	* api_ver should match the api version forming part of the
4795	* firmware filename ... but we don't check for that and only rely
4796	* on the API version read from firmware header from here on forward
4797	*/
4798	if (api_ver < api_min || api_ver > api_max) {
4799	IL_ERR("Driver unable to support your firmware API. "
4800	"Driver supports v%u, firmware is v%u.\n", api_max,
4801	api_ver);
4802	goto try_again;
4803	}
4804
4805	if (api_ver != api_max)
4806	IL_ERR("Firmware has old API version. Expected v%u, "
4807	"got v%u. New firmware can be obtained "
4808	"from http://www.intellinuxwireless.org.\n", api_max,
4809	api_ver);
4810
4811	IL_INFO("loaded firmware version %u.%u.%u.%u\n",
4812	IL_UCODE_MAJOR(il->ucode_ver), IL_UCODE_MINOR(il->ucode_ver),
4813	IL_UCODE_API(il->ucode_ver), IL_UCODE_SERIAL(il->ucode_ver));
4814
4815	snprintf(buf: il->hw->wiphy->fw_version, size: sizeof(il->hw->wiphy->fw_version),
4816	fmt: "%u.%u.%u.%u", IL_UCODE_MAJOR(il->ucode_ver),
4817	IL_UCODE_MINOR(il->ucode_ver), IL_UCODE_API(il->ucode_ver),
4818	IL_UCODE_SERIAL(il->ucode_ver));
4819
4820	/*
4821	* For any of the failures below (before allocating pci memory)
4822	* we will try to load a version with a smaller API -- maybe the
4823	* user just got a corrupted version of the latest API.
4824	*/
4825
4826	D_INFO("f/w package hdr ucode version raw = 0x%x\n", il->ucode_ver);
4827	D_INFO("f/w package hdr runtime inst size = %zd\n", pieces.inst_size);
4828	D_INFO("f/w package hdr runtime data size = %zd\n", pieces.data_size);
4829	D_INFO("f/w package hdr init inst size = %zd\n", pieces.init_size);
4830	D_INFO("f/w package hdr init data size = %zd\n", pieces.init_data_size);
4831	D_INFO("f/w package hdr boot inst size = %zd\n", pieces.boot_size);
4832
4833	/* Verify that uCode images will fit in card's SRAM */
4834	if (pieces.inst_size > il->hw_params.max_inst_size) {
4835	IL_ERR("uCode instr len %zd too large to fit in\n",
4836	pieces.inst_size);
4837	goto try_again;
4838	}
4839
4840	if (pieces.data_size > il->hw_params.max_data_size) {
4841	IL_ERR("uCode data len %zd too large to fit in\n",
4842	pieces.data_size);
4843	goto try_again;
4844	}
4845
4846	if (pieces.init_size > il->hw_params.max_inst_size) {
4847	IL_ERR("uCode init instr len %zd too large to fit in\n",
4848	pieces.init_size);
4849	goto try_again;
4850	}
4851
4852	if (pieces.init_data_size > il->hw_params.max_data_size) {
4853	IL_ERR("uCode init data len %zd too large to fit in\n",
4854	pieces.init_data_size);
4855	goto try_again;
4856	}
4857
4858	if (pieces.boot_size > il->hw_params.max_bsm_size) {
4859	IL_ERR("uCode boot instr len %zd too large to fit in\n",
4860	pieces.boot_size);
4861	goto try_again;
4862	}
4863
4864	/* Allocate ucode buffers for card's bus-master loading ... */
4865
4866	/* Runtime instructions and 2 copies of data:
4867	* 1) unmodified from disk
4868	* 2) backup cache for save/restore during power-downs */
4869	il->ucode_code.len = pieces.inst_size;
4870	il_alloc_fw_desc(pci_dev: il->pci_dev, desc: &il->ucode_code);
4871
4872	il->ucode_data.len = pieces.data_size;
4873	il_alloc_fw_desc(pci_dev: il->pci_dev, desc: &il->ucode_data);
4874
4875	il->ucode_data_backup.len = pieces.data_size;
4876	il_alloc_fw_desc(pci_dev: il->pci_dev, desc: &il->ucode_data_backup);
4877
4878	if (!il->ucode_code.v_addr || !il->ucode_data.v_addr ||
4879	!il->ucode_data_backup.v_addr)
4880	goto err_pci_alloc;
4881
4882	/* Initialization instructions and data */
4883	if (pieces.init_size && pieces.init_data_size) {
4884	il->ucode_init.len = pieces.init_size;
4885	il_alloc_fw_desc(pci_dev: il->pci_dev, desc: &il->ucode_init);
4886
4887	il->ucode_init_data.len = pieces.init_data_size;
4888	il_alloc_fw_desc(pci_dev: il->pci_dev, desc: &il->ucode_init_data);
4889
4890	if (!il->ucode_init.v_addr || !il->ucode_init_data.v_addr)
4891	goto err_pci_alloc;
4892	}
4893
4894	/* Bootstrap (instructions only, no data) */
4895	if (pieces.boot_size) {
4896	il->ucode_boot.len = pieces.boot_size;
4897	il_alloc_fw_desc(pci_dev: il->pci_dev, desc: &il->ucode_boot);
4898
4899	if (!il->ucode_boot.v_addr)
4900	goto err_pci_alloc;
4901	}
4902
4903	/* Now that we can no longer fail, copy information */
4904
4905	il->sta_key_max_num = STA_KEY_MAX_NUM;
4906
4907	/* Copy images into buffers for card's bus-master reads ... */
4908
4909	/* Runtime instructions (first block of data in file) */
4910	D_INFO("Copying (but not loading) uCode instr len %zd\n",
4911	pieces.inst_size);
4912	memcpy(il->ucode_code.v_addr, pieces.inst, pieces.inst_size);
4913
4914	D_INFO("uCode instr buf vaddr = 0x%p, paddr = 0x%08x\n",
4915	il->ucode_code.v_addr, (u32) il->ucode_code.p_addr);
4916
4917	/*
4918	* Runtime data
4919	* NOTE: Copy into backup buffer will be done in il_up()
4920	*/
4921	D_INFO("Copying (but not loading) uCode data len %zd\n",
4922	pieces.data_size);
4923	memcpy(il->ucode_data.v_addr, pieces.data, pieces.data_size);
4924	memcpy(il->ucode_data_backup.v_addr, pieces.data, pieces.data_size);
4925
4926	/* Initialization instructions */
4927	if (pieces.init_size) {
4928	D_INFO("Copying (but not loading) init instr len %zd\n",
4929	pieces.init_size);
4930	memcpy(il->ucode_init.v_addr, pieces.init, pieces.init_size);
4931	}
4932
4933	/* Initialization data */
4934	if (pieces.init_data_size) {
4935	D_INFO("Copying (but not loading) init data len %zd\n",
4936	pieces.init_data_size);
4937	memcpy(il->ucode_init_data.v_addr, pieces.init_data,
4938	pieces.init_data_size);
4939	}
4940
4941	/* Bootstrap instructions */
4942	D_INFO("Copying (but not loading) boot instr len %zd\n",
4943	pieces.boot_size);
4944	memcpy(il->ucode_boot.v_addr, pieces.boot, pieces.boot_size);
4945
4946	/*
4947	* figure out the offset of chain noise reset and gain commands
4948	* base on the size of standard phy calibration commands table size
4949	*/
4950	il->_4965.phy_calib_chain_noise_reset_cmd =
4951	standard_phy_calibration_size;
4952	il->_4965.phy_calib_chain_noise_gain_cmd =
4953	standard_phy_calibration_size + 1;
4954
4955	/**************************************************
4956	* This is still part of probe() in a sense...
4957	*
4958	* 9. Setup and register with mac80211 and debugfs
4959	**************************************************/
4960	err = il4965_mac_setup_register(il, max_probe_length);
4961	if (err)
4962	goto out_unbind;
4963
4964	il_dbgfs_register(il, DRV_NAME);
4965
4966	err = sysfs_create_group(kobj: &il->pci_dev->dev.kobj, grp: &il_attribute_group);
4967	if (err) {
4968	IL_ERR("failed to create sysfs device attributes\n");
4969	goto out_unbind;
4970	}
4971
4972	/* We have our copies now, allow OS release its copies */
4973	release_firmware(fw: ucode_raw);
4974	complete(&il->_4965.firmware_loading_complete);
4975	return;
4976
4977	try_again:
4978	/* try next, if any */
4979	if (il4965_request_firmware(il, first: false))
4980	goto out_unbind;
4981	release_firmware(fw: ucode_raw);
4982	return;
4983
4984	err_pci_alloc:
4985	IL_ERR("failed to allocate pci memory\n");
4986	il4965_dealloc_ucode_pci(il);
4987	out_unbind:
4988	complete(&il->_4965.firmware_loading_complete);
4989	device_release_driver(dev: &il->pci_dev->dev);
4990	release_firmware(fw: ucode_raw);
4991	}
4992
4993	static const char *const desc_lookup_text[] = {
4994	"OK",
4995	"FAIL",
4996	"BAD_PARAM",
4997	"BAD_CHECKSUM",
4998	"NMI_INTERRUPT_WDG",
4999	"SYSASSERT",
5000	"FATAL_ERROR",
5001	"BAD_COMMAND",
5002	"HW_ERROR_TUNE_LOCK",
5003	"HW_ERROR_TEMPERATURE",
5004	"ILLEGAL_CHAN_FREQ",
5005	"VCC_NOT_STBL",
5006	"FH49_ERROR",
5007	"NMI_INTERRUPT_HOST",
5008	"NMI_INTERRUPT_ACTION_PT",
5009	"NMI_INTERRUPT_UNKNOWN",
5010	"UCODE_VERSION_MISMATCH",
5011	"HW_ERROR_ABS_LOCK",
5012	"HW_ERROR_CAL_LOCK_FAIL",
5013	"NMI_INTERRUPT_INST_ACTION_PT",
5014	"NMI_INTERRUPT_DATA_ACTION_PT",
5015	"NMI_TRM_HW_ER",
5016	"NMI_INTERRUPT_TRM",
5017	"NMI_INTERRUPT_BREAK_POINT",
5018	"DEBUG_0",
5019	"DEBUG_1",
5020	"DEBUG_2",
5021	"DEBUG_3",
5022	};
5023
5024	static struct {
5025	char *name;
5026	u8 num;
5027	} advanced_lookup[] = {
5028	{
5029	"NMI_INTERRUPT_WDG", 0x34}, {
5030	"SYSASSERT", 0x35}, {
5031	"UCODE_VERSION_MISMATCH", 0x37}, {
5032	"BAD_COMMAND", 0x38}, {
5033	"NMI_INTERRUPT_DATA_ACTION_PT", 0x3C}, {
5034	"FATAL_ERROR", 0x3D}, {
5035	"NMI_TRM_HW_ERR", 0x46}, {
5036	"NMI_INTERRUPT_TRM", 0x4C}, {
5037	"NMI_INTERRUPT_BREAK_POINT", 0x54}, {
5038	"NMI_INTERRUPT_WDG_RXF_FULL", 0x5C}, {
5039	"NMI_INTERRUPT_WDG_NO_RBD_RXF_FULL", 0x64}, {
5040	"NMI_INTERRUPT_HOST", 0x66}, {
5041	"NMI_INTERRUPT_ACTION_PT", 0x7C}, {
5042	"NMI_INTERRUPT_UNKNOWN", 0x84}, {
5043	"NMI_INTERRUPT_INST_ACTION_PT", 0x86}, {
5044	"ADVANCED_SYSASSERT", 0},};
5045
5046	static const char *
5047	il4965_desc_lookup(u32 num)
5048	{
5049	int i;
5050	int max = ARRAY_SIZE(desc_lookup_text);
5051
5052	if (num < max)
5053	return desc_lookup_text[num];
5054
5055	max = ARRAY_SIZE(advanced_lookup) - 1;
5056	for (i = 0; i < max; i++) {
5057	if (advanced_lookup[i].num == num)
5058	break;
5059	}
5060	return advanced_lookup[i].name;
5061	}
5062
5063	#define ERROR_START_OFFSET (1 * sizeof(u32))
5064	#define ERROR_ELEM_SIZE (7 * sizeof(u32))
5065
5066	void
5067	il4965_dump_nic_error_log(struct il_priv *il)
5068	{
5069	u32 data2, line;
5070	u32 desc, time, count, base, data1;
5071	u32 blink1, blink2, ilink1, ilink2;
5072	u32 pc, hcmd;
5073
5074	if (il->ucode_type == UCODE_INIT)
5075	base = le32_to_cpu(il->card_alive_init.error_event_table_ptr);
5076	else
5077	base = le32_to_cpu(il->card_alive.error_event_table_ptr);
5078
5079	if (!il->ops->is_valid_rtc_data_addr(base)) {
5080	IL_ERR("Not valid error log pointer 0x%08X for %s uCode\n",
5081	base, (il->ucode_type == UCODE_INIT) ? "Init" : "RT");
5082	return;
5083	}
5084
5085	count = il_read_targ_mem(il, addr: base);
5086
5087	if (ERROR_START_OFFSET <= count * ERROR_ELEM_SIZE) {
5088	IL_ERR("Start IWL Error Log Dump:\n");
5089	IL_ERR("Status: 0x%08lX, count: %d\n", il->status, count);
5090	}
5091
5092	desc = il_read_targ_mem(il, addr: base + 1 * sizeof(u32));
5093	il->isr_stats.err_code = desc;
5094	pc = il_read_targ_mem(il, addr: base + 2 * sizeof(u32));
5095	blink1 = il_read_targ_mem(il, addr: base + 3 * sizeof(u32));
5096	blink2 = il_read_targ_mem(il, addr: base + 4 * sizeof(u32));
5097	ilink1 = il_read_targ_mem(il, addr: base + 5 * sizeof(u32));
5098	ilink2 = il_read_targ_mem(il, addr: base + 6 * sizeof(u32));
5099	data1 = il_read_targ_mem(il, addr: base + 7 * sizeof(u32));
5100	data2 = il_read_targ_mem(il, addr: base + 8 * sizeof(u32));
5101	line = il_read_targ_mem(il, addr: base + 9 * sizeof(u32));
5102	time = il_read_targ_mem(il, addr: base + 11 * sizeof(u32));
5103	hcmd = il_read_targ_mem(il, addr: base + 22 * sizeof(u32));
5104
5105	IL_ERR("Desc Time "
5106	"data1 data2 line\n");
5107	IL_ERR("%-28s (0x%04X) %010u 0x%08X 0x%08X %u\n",
5108	il4965_desc_lookup(desc), desc, time, data1, data2, line);
5109	IL_ERR("pc blink1 blink2 ilink1 ilink2 hcmd\n");
5110	IL_ERR("0x%05X 0x%05X 0x%05X 0x%05X 0x%05X 0x%05X\n", pc, blink1,
5111	blink2, ilink1, ilink2, hcmd);
5112	}
5113
5114	static void
5115	il4965_rf_kill_ct_config(struct il_priv *il)
5116	{
5117	struct il_ct_kill_config cmd;
5118	unsigned long flags;
5119	int ret = 0;
5120
5121	spin_lock_irqsave(&il->lock, flags);
5122	_il_wr(il, CSR_UCODE_DRV_GP1_CLR,
5123	CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT);
5124	spin_unlock_irqrestore(lock: &il->lock, flags);
5125
5126	cmd.critical_temperature_R =
5127	cpu_to_le32(il->hw_params.ct_kill_threshold);
5128
5129	ret = il_send_cmd_pdu(il, id: C_CT_KILL_CONFIG, len: sizeof(cmd), data: &cmd);
5130	if (ret)
5131	IL_ERR("C_CT_KILL_CONFIG failed\n");
5132	else
5133	D_INFO("C_CT_KILL_CONFIG " "succeeded, "
5134	"critical temperature is %d\n",
5135	il->hw_params.ct_kill_threshold);
5136	}
5137
5138	static const s8 default_queue_to_tx_fifo[] = {
5139	IL_TX_FIFO_VO,
5140	IL_TX_FIFO_VI,
5141	IL_TX_FIFO_BE,
5142	IL_TX_FIFO_BK,
5143	IL49_CMD_FIFO_NUM,
5144	IL_TX_FIFO_UNUSED,
5145	IL_TX_FIFO_UNUSED,
5146	};
5147
5148	#define IL_MASK(lo, hi) ((1 << (hi)) | ((1 << (hi)) - (1 << (lo))))
5149
5150	static int
5151	il4965_alive_notify(struct il_priv *il)
5152	{
5153	u32 a;
5154	unsigned long flags;
5155	int i, chan;
5156	u32 reg_val;
5157
5158	spin_lock_irqsave(&il->lock, flags);
5159
5160	/* Clear 4965's internal Tx Scheduler data base */
5161	il->scd_base_addr = il_rd_prph(il, IL49_SCD_SRAM_BASE_ADDR);
5162	a = il->scd_base_addr + IL49_SCD_CONTEXT_DATA_OFFSET;
5163	for (; a < il->scd_base_addr + IL49_SCD_TX_STTS_BITMAP_OFFSET; a += 4)
5164	il_write_targ_mem(il, addr: a, val: 0);
5165	for (; a < il->scd_base_addr + IL49_SCD_TRANSLATE_TBL_OFFSET; a += 4)
5166	il_write_targ_mem(il, addr: a, val: 0);
5167	for (;
5168	a <
5169	il->scd_base_addr +
5170	IL49_SCD_TRANSLATE_TBL_OFFSET_QUEUE(il->hw_params.max_txq_num);
5171	a += 4)
5172	il_write_targ_mem(il, addr: a, val: 0);
5173
5174	/* Tel 4965 where to find Tx byte count tables */
5175	il_wr_prph(il, IL49_SCD_DRAM_BASE_ADDR, val: il->scd_bc_tbls.dma >> 10);
5176
5177	/* Enable DMA channel */
5178	for (chan = 0; chan < FH49_TCSR_CHNL_NUM; chan++)
5179	il_wr(il, FH49_TCSR_CHNL_TX_CONFIG_REG(chan),
5180	FH49_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
5181	FH49_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE);
5182
5183	/* Update FH chicken bits */
5184	reg_val = il_rd(il, FH49_TX_CHICKEN_BITS_REG);
5185	il_wr(il, FH49_TX_CHICKEN_BITS_REG,
5186	value: reg_val | FH49_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN);
5187
5188	/* Disable chain mode for all queues */
5189	il_wr_prph(il, IL49_SCD_QUEUECHAIN_SEL, val: 0);
5190
5191	/* Initialize each Tx queue (including the command queue) */
5192	for (i = 0; i < il->hw_params.max_txq_num; i++) {
5193
5194	/* TFD circular buffer read/write idxes */
5195	il_wr_prph(il, IL49_SCD_QUEUE_RDPTR(i), val: 0);
5196	il_wr(il, HBUS_TARG_WRPTR, value: 0 | (i << 8));
5197
5198	/* Max Tx Window size for Scheduler-ACK mode */
5199	il_write_targ_mem(il,
5200	addr: il->scd_base_addr +
5201	IL49_SCD_CONTEXT_QUEUE_OFFSET(i),
5202	val: (SCD_WIN_SIZE <<
5203	IL49_SCD_QUEUE_CTX_REG1_WIN_SIZE_POS) &
5204	IL49_SCD_QUEUE_CTX_REG1_WIN_SIZE_MSK);
5205
5206	/* Frame limit */
5207	il_write_targ_mem(il,
5208	addr: il->scd_base_addr +
5209	IL49_SCD_CONTEXT_QUEUE_OFFSET(i) +
5210	sizeof(u32),
5211	val: (SCD_FRAME_LIMIT <<
5212	IL49_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
5213	IL49_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK);
5214
5215	}
5216	il_wr_prph(il, IL49_SCD_INTERRUPT_MASK,
5217	val: (1 << il->hw_params.max_txq_num) - 1);
5218
5219	/* Activate all Tx DMA/FIFO channels */
5220	il4965_txq_set_sched(il, IL_MASK(0, 6));
5221
5222	il4965_set_wr_ptrs(il, IL_DEFAULT_CMD_QUEUE_NUM, idx: 0);
5223
5224	/* make sure all queue are not stopped */
5225	memset(&il->queue_stopped[0], 0, sizeof(il->queue_stopped));
5226	for (i = 0; i < 4; i++)
5227	atomic_set(v: &il->queue_stop_count[i], i: 0);
5228
5229	/* reset to 0 to enable all the queue first */
5230	il->txq_ctx_active_msk = 0;
5231	/* Map each Tx/cmd queue to its corresponding fifo */
5232	BUILD_BUG_ON(ARRAY_SIZE(default_queue_to_tx_fifo) != 7);
5233
5234	for (i = 0; i < ARRAY_SIZE(default_queue_to_tx_fifo); i++) {
5235	int ac = default_queue_to_tx_fifo[i];
5236
5237	il_txq_ctx_activate(il, txq_id: i);
5238
5239	if (ac == IL_TX_FIFO_UNUSED)
5240	continue;
5241
5242	il4965_tx_queue_set_status(il, txq: &il->txq[i], tx_fifo_id: ac, scd_retry: 0);
5243	}
5244
5245	spin_unlock_irqrestore(lock: &il->lock, flags);
5246
5247	return 0;
5248	}
5249
5250	/*
5251	* il4965_alive_start - called after N_ALIVE notification received
5252	* from protocol/runtime uCode (initialization uCode's
5253	* Alive gets handled by il_init_alive_start()).
5254	*/
5255	static void
5256	il4965_alive_start(struct il_priv *il)
5257	{
5258	int ret = 0;
5259
5260	D_INFO("Runtime Alive received.\n");
5261
5262	if (il->card_alive.is_valid != UCODE_VALID_OK) {
5263	/* We had an error bringing up the hardware, so take it
5264	* all the way back down so we can try again */
5265	D_INFO("Alive failed.\n");
5266	goto restart;
5267	}
5268
5269	/* Initialize uCode has loaded Runtime uCode ... verify inst image.
5270	* This is a paranoid check, because we would not have gotten the
5271	* "runtime" alive if code weren't properly loaded. */
5272	if (il4965_verify_ucode(il)) {
5273	/* Runtime instruction load was bad;
5274	* take it all the way back down so we can try again */
5275	D_INFO("Bad runtime uCode load.\n");
5276	goto restart;
5277	}
5278
5279	ret = il4965_alive_notify(il);
5280	if (ret) {
5281	IL_WARN("Could not complete ALIVE transition [ntf]: %d\n", ret);
5282	goto restart;
5283	}
5284
5285	/* After the ALIVE response, we can send host commands to the uCode */
5286	set_bit(S_ALIVE, addr: &il->status);
5287
5288	/* Enable watchdog to monitor the driver tx queues */
5289	il_setup_watchdog(il);
5290
5291	if (il_is_rfkill(il))
5292	return;
5293
5294	ieee80211_wake_queues(hw: il->hw);
5295
5296	il->active_rate = RATES_MASK;
5297
5298	il_power_update_mode(il, force: true);
5299	D_INFO("Updated power mode\n");
5300
5301	if (il_is_associated(il)) {
5302	struct il_rxon_cmd *active_rxon =
5303	(struct il_rxon_cmd *)&il->active;
5304	/* apply any changes in staging */
5305	il->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
5306	active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
5307	} else {
5308	/* Initialize our rx_config data */
5309	il_connection_init_rx_config(il);
5310
5311	if (il->ops->set_rxon_chain)
5312	il->ops->set_rxon_chain(il);
5313	}
5314
5315	/* Configure bluetooth coexistence if enabled */
5316	il_send_bt_config(il);
5317
5318	il4965_reset_run_time_calib(il);
5319
5320	set_bit(S_READY, addr: &il->status);
5321
5322	/* Configure the adapter for unassociated operation */
5323	il_commit_rxon(il);
5324
5325	/* At this point, the NIC is initialized and operational */
5326	il4965_rf_kill_ct_config(il);
5327
5328	D_INFO("ALIVE processing complete.\n");
5329	wake_up(&il->wait_command_queue);
5330
5331	return;
5332
5333	restart:
5334	queue_work(wq: il->workqueue, work: &il->restart);
5335	}
5336
5337	static void il4965_cancel_deferred_work(struct il_priv *il);
5338
5339	static void
5340	__il4965_down(struct il_priv *il)
5341	{
5342	unsigned long flags;
5343	int exit_pending;
5344
5345	D_INFO(DRV_NAME " is going down\n");
5346
5347	il_scan_cancel_timeout(il, ms: 200);
5348
5349	exit_pending = test_and_set_bit(S_EXIT_PENDING, addr: &il->status);
5350
5351	/* Stop TX queues watchdog. We need to have S_EXIT_PENDING bit set
5352	* to prevent rearm timer */
5353	del_timer_sync(timer: &il->watchdog);
5354
5355	il_clear_ucode_stations(il);
5356
5357	/* FIXME: race conditions ? */
5358	spin_lock_irq(lock: &il->sta_lock);
5359	/*
5360	* Remove all key information that is not stored as part
5361	* of station information since mac80211 may not have had
5362	* a chance to remove all the keys. When device is
5363	* reconfigured by mac80211 after an error all keys will
5364	* be reconfigured.
5365	*/
5366	memset(il->_4965.wep_keys, 0, sizeof(il->_4965.wep_keys));
5367	il->_4965.key_mapping_keys = 0;
5368	spin_unlock_irq(lock: &il->sta_lock);
5369
5370	il_dealloc_bcast_stations(il);
5371	il_clear_driver_stations(il);
5372
5373	/* Unblock any waiting calls */
5374	wake_up_all(&il->wait_command_queue);
5375
5376	/* Wipe out the EXIT_PENDING status bit if we are not actually
5377	* exiting the module */
5378	if (!exit_pending)
5379	clear_bit(S_EXIT_PENDING, addr: &il->status);
5380
5381	/* stop and reset the on-board processor */
5382	_il_wr(il, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
5383
5384	/* tell the device to stop sending interrupts */
5385	spin_lock_irqsave(&il->lock, flags);
5386	il_disable_interrupts(il);
5387	spin_unlock_irqrestore(lock: &il->lock, flags);
5388	il4965_synchronize_irq(il);
5389
5390	if (il->mac80211_registered)
5391	ieee80211_stop_queues(hw: il->hw);
5392
5393	/* If we have not previously called il_init() then
5394	* clear all bits but the RF Kill bit and return */
5395	if (!il_is_init(il)) {
5396	il->status =
5397	test_bit(S_RFKILL, &il->status) << S_RFKILL |
5398	test_bit(S_GEO_CONFIGURED, &il->status) << S_GEO_CONFIGURED |
5399	test_bit(S_EXIT_PENDING, &il->status) << S_EXIT_PENDING;
5400	goto exit;
5401	}
5402
5403	/* ...otherwise clear out all the status bits but the RF Kill
5404	* bit and continue taking the NIC down. */
5405	il->status &=
5406	test_bit(S_RFKILL, &il->status) << S_RFKILL |
5407	test_bit(S_GEO_CONFIGURED, &il->status) << S_GEO_CONFIGURED |
5408	test_bit(S_FW_ERROR, &il->status) << S_FW_ERROR |
5409	test_bit(S_EXIT_PENDING, &il->status) << S_EXIT_PENDING;
5410
5411	/*
5412	* We disabled and synchronized interrupt, and priv->mutex is taken, so
5413	* here is the only thread which will program device registers, but
5414	* still have lockdep assertions, so we are taking reg_lock.
5415	*/
5416	spin_lock_irq(lock: &il->reg_lock);
5417	/* FIXME: il_grab_nic_access if rfkill is off ? */
5418
5419	il4965_txq_ctx_stop(il);
5420	il4965_rxq_stop(il);
5421	/* Power-down device's busmaster DMA clocks */
5422	_il_wr_prph(il, APMG_CLK_DIS_REG, APMG_CLK_VAL_DMA_CLK_RQT);
5423	udelay(5);
5424	/* Make sure (redundant) we've released our request to stay awake */
5425	_il_clear_bit(il, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
5426	/* Stop the device, and put it in low power state */
5427	_il_apm_stop(il);
5428
5429	spin_unlock_irq(lock: &il->reg_lock);
5430
5431	il4965_txq_ctx_unmap(il);
5432	exit:
5433	memset(&il->card_alive, 0, sizeof(struct il_alive_resp));
5434
5435	dev_kfree_skb(il->beacon_skb);
5436	il->beacon_skb = NULL;
5437
5438	/* clear out any free frames */
5439	il4965_clear_free_frames(il);
5440	}
5441
5442	static void
5443	il4965_down(struct il_priv *il)
5444	{
5445	mutex_lock(&il->mutex);
5446	__il4965_down(il);
5447	mutex_unlock(lock: &il->mutex);
5448
5449	il4965_cancel_deferred_work(il);
5450	}
5451
5452
5453	static void
5454	il4965_set_hw_ready(struct il_priv *il)
5455	{
5456	int ret;
5457
5458	il_set_bit(p: il, CSR_HW_IF_CONFIG_REG,
5459	CSR_HW_IF_CONFIG_REG_BIT_NIC_READY);
5460
5461	/* See if we got it */
5462	ret = _il_poll_bit(il, CSR_HW_IF_CONFIG_REG,
5463	CSR_HW_IF_CONFIG_REG_BIT_NIC_READY,
5464	CSR_HW_IF_CONFIG_REG_BIT_NIC_READY,
5465	timeout: 100);
5466	if (ret >= 0)
5467	il->hw_ready = true;
5468
5469	D_INFO("hardware %s ready\n", (il->hw_ready) ? "" : "not");
5470	}
5471
5472	static void
5473	il4965_prepare_card_hw(struct il_priv *il)
5474	{
5475	int ret;
5476
5477	il->hw_ready = false;
5478
5479	il4965_set_hw_ready(il);
5480	if (il->hw_ready)
5481	return;
5482
5483	/* If HW is not ready, prepare the conditions to check again */
5484	il_set_bit(p: il, CSR_HW_IF_CONFIG_REG, CSR_HW_IF_CONFIG_REG_PREPARE);
5485
5486	ret =
5487	_il_poll_bit(il, CSR_HW_IF_CONFIG_REG,
5488	bits: ~CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE,
5489	CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE, timeout: 150000);
5490
5491	/* HW should be ready by now, check again. */
5492	if (ret != -ETIMEDOUT)
5493	il4965_set_hw_ready(il);
5494	}
5495
5496	#define MAX_HW_RESTARTS 5
5497
5498	static int
5499	__il4965_up(struct il_priv *il)
5500	{
5501	int i;
5502	int ret;
5503
5504	if (test_bit(S_EXIT_PENDING, &il->status)) {
5505	IL_WARN("Exit pending; will not bring the NIC up\n");
5506	return -EIO;
5507	}
5508
5509	if (!il->ucode_data_backup.v_addr || !il->ucode_data.v_addr) {
5510	IL_ERR("ucode not available for device bringup\n");
5511	return -EIO;
5512	}
5513
5514	ret = il4965_alloc_bcast_station(il);
5515	if (ret) {
5516	il_dealloc_bcast_stations(il);
5517	return ret;
5518	}
5519
5520	il4965_prepare_card_hw(il);
5521	if (!il->hw_ready) {
5522	il_dealloc_bcast_stations(il);
5523	IL_ERR("HW not ready\n");
5524	return -EIO;
5525	}
5526
5527	/* If platform's RF_KILL switch is NOT set to KILL */
5528	if (_il_rd(il, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
5529	clear_bit(S_RFKILL, addr: &il->status);
5530	else {
5531	set_bit(S_RFKILL, addr: &il->status);
5532	wiphy_rfkill_set_hw_state(wiphy: il->hw->wiphy, blocked: true);
5533
5534	il_dealloc_bcast_stations(il);
5535	il_enable_rfkill_int(il);
5536	IL_WARN("Radio disabled by HW RF Kill switch\n");
5537	return 0;
5538	}
5539
5540	_il_wr(il, CSR_INT, val: 0xFFFFFFFF);
5541
5542	/* must be initialised before il_hw_nic_init */
5543	il->cmd_queue = IL_DEFAULT_CMD_QUEUE_NUM;
5544
5545	ret = il4965_hw_nic_init(il);
5546	if (ret) {
5547	IL_ERR("Unable to init nic\n");
5548	il_dealloc_bcast_stations(il);
5549	return ret;
5550	}
5551
5552	/* make sure rfkill handshake bits are cleared */
5553	_il_wr(il, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
5554	_il_wr(il, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
5555
5556	/* clear (again), then enable host interrupts */
5557	_il_wr(il, CSR_INT, val: 0xFFFFFFFF);
5558	il_enable_interrupts(il);
5559
5560	/* really make sure rfkill handshake bits are cleared */
5561	_il_wr(il, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
5562	_il_wr(il, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
5563
5564	/* Copy original ucode data image from disk into backup cache.
5565	* This will be used to initialize the on-board processor's
5566	* data SRAM for a clean start when the runtime program first loads. */
5567	memcpy(il->ucode_data_backup.v_addr, il->ucode_data.v_addr,
5568	il->ucode_data.len);
5569
5570	for (i = 0; i < MAX_HW_RESTARTS; i++) {
5571
5572	/* load bootstrap state machine,
5573	* load bootstrap program into processor's memory,
5574	* prepare to load the "initialize" uCode */
5575	ret = il->ops->load_ucode(il);
5576
5577	if (ret) {
5578	IL_ERR("Unable to set up bootstrap uCode: %d\n", ret);
5579	continue;
5580	}
5581
5582	/* start card; "initialize" will load runtime ucode */
5583	il4965_nic_start(il);
5584
5585	D_INFO(DRV_NAME " is coming up\n");
5586
5587	return 0;
5588	}
5589
5590	set_bit(S_EXIT_PENDING, addr: &il->status);
5591	__il4965_down(il);
5592	clear_bit(S_EXIT_PENDING, addr: &il->status);
5593
5594	/* tried to restart and config the device for as long as our
5595	* patience could withstand */
5596	IL_ERR("Unable to initialize device after %d attempts.\n", i);
5597	return -EIO;
5598	}
5599
5600	/*****************************************************************************
5601	*
5602	* Workqueue callbacks
5603	*
5604	*****************************************************************************/
5605
5606	static void
5607	il4965_bg_init_alive_start(struct work_struct *data)
5608	{
5609	struct il_priv *il =
5610	container_of(data, struct il_priv, init_alive_start.work);
5611
5612	mutex_lock(&il->mutex);
5613	if (test_bit(S_EXIT_PENDING, &il->status))
5614	goto out;
5615
5616	il->ops->init_alive_start(il);
5617	out:
5618	mutex_unlock(lock: &il->mutex);
5619	}
5620
5621	static void
5622	il4965_bg_alive_start(struct work_struct *data)
5623	{
5624	struct il_priv *il =
5625	container_of(data, struct il_priv, alive_start.work);
5626
5627	mutex_lock(&il->mutex);
5628	if (test_bit(S_EXIT_PENDING, &il->status))
5629	goto out;
5630
5631	il4965_alive_start(il);
5632	out:
5633	mutex_unlock(lock: &il->mutex);
5634	}
5635
5636	static void
5637	il4965_bg_run_time_calib_work(struct work_struct *work)
5638	{
5639	struct il_priv *il = container_of(work, struct il_priv,
5640	run_time_calib_work);
5641
5642	mutex_lock(&il->mutex);
5643
5644	if (test_bit(S_EXIT_PENDING, &il->status) ||
5645	test_bit(S_SCANNING, &il->status)) {
5646	mutex_unlock(lock: &il->mutex);
5647	return;
5648	}
5649
5650	if (il->start_calib) {
5651	il4965_chain_noise_calibration(il, stat_resp: (void *)&il->_4965.stats);
5652	il4965_sensitivity_calibration(il, resp: (void *)&il->_4965.stats);
5653	}
5654
5655	mutex_unlock(lock: &il->mutex);
5656	}
5657
5658	static void
5659	il4965_bg_restart(struct work_struct *data)
5660	{
5661	struct il_priv *il = container_of(data, struct il_priv, restart);
5662
5663	if (test_bit(S_EXIT_PENDING, &il->status))
5664	return;
5665
5666	if (test_and_clear_bit(S_FW_ERROR, addr: &il->status)) {
5667	mutex_lock(&il->mutex);
5668	il->is_open = 0;
5669
5670	__il4965_down(il);
5671
5672	mutex_unlock(lock: &il->mutex);
5673	il4965_cancel_deferred_work(il);
5674	ieee80211_restart_hw(hw: il->hw);
5675	} else {
5676	il4965_down(il);
5677
5678	mutex_lock(&il->mutex);
5679	if (test_bit(S_EXIT_PENDING, &il->status)) {
5680	mutex_unlock(lock: &il->mutex);
5681	return;
5682	}
5683
5684	__il4965_up(il);
5685	mutex_unlock(lock: &il->mutex);
5686	}
5687	}
5688
5689	static void
5690	il4965_bg_rx_replenish(struct work_struct *data)
5691	{
5692	struct il_priv *il = container_of(data, struct il_priv, rx_replenish);
5693
5694	if (test_bit(S_EXIT_PENDING, &il->status))
5695	return;
5696
5697	mutex_lock(&il->mutex);
5698	il4965_rx_replenish(il);
5699	mutex_unlock(lock: &il->mutex);
5700	}
5701
5702	/*****************************************************************************
5703	*
5704	* mac80211 entry point functions
5705	*
5706	*****************************************************************************/
5707
5708	#define UCODE_READY_TIMEOUT (4 * HZ)
5709
5710	/*
5711	* Not a mac80211 entry point function, but it fits in with all the
5712	* other mac80211 functions grouped here.
5713	*/
5714	static int
5715	il4965_mac_setup_register(struct il_priv *il, u32 max_probe_length)
5716	{
5717	int ret;
5718	struct ieee80211_hw *hw = il->hw;
5719
5720	hw->rate_control_algorithm = "iwl-4965-rs";
5721
5722	/* Tell mac80211 our characteristics */
5723	ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
5724	ieee80211_hw_set(hw, SUPPORTS_PS);
5725	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
5726	ieee80211_hw_set(hw, SPECTRUM_MGMT);
5727	ieee80211_hw_set(hw, NEED_DTIM_BEFORE_ASSOC);
5728	ieee80211_hw_set(hw, SIGNAL_DBM);
5729	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
5730	if (il->cfg->sku & IL_SKU_N)
5731	hw->wiphy->features |= NL80211_FEATURE_DYNAMIC_SMPS |
5732	NL80211_FEATURE_STATIC_SMPS;
5733
5734	hw->sta_data_size = sizeof(struct il_station_priv);
5735	hw->vif_data_size = sizeof(struct il_vif_priv);
5736
5737	hw->wiphy->interface_modes =
5738	BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_ADHOC);
5739
5740	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
5741	hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
5742	REGULATORY_DISABLE_BEACON_HINTS;
5743
5744	/*
5745	* For now, disable PS by default because it affects
5746	* RX performance significantly.
5747	*/
5748	hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
5749
5750	hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
5751	/* we create the 802.11 header and a zero-length SSID element */
5752	hw->wiphy->max_scan_ie_len = max_probe_length - 24 - 2;
5753
5754	/* Default value; 4 EDCA QOS priorities */
5755	hw->queues = 4;
5756
5757	hw->max_listen_interval = IL_CONN_MAX_LISTEN_INTERVAL;
5758
5759	if (il->bands[NL80211_BAND_2GHZ].n_channels)
5760	il->hw->wiphy->bands[NL80211_BAND_2GHZ] =
5761	&il->bands[NL80211_BAND_2GHZ];
5762	if (il->bands[NL80211_BAND_5GHZ].n_channels)
5763	il->hw->wiphy->bands[NL80211_BAND_5GHZ] =
5764	&il->bands[NL80211_BAND_5GHZ];
5765
5766	il_leds_init(il);
5767
5768	wiphy_ext_feature_set(wiphy: il->hw->wiphy, ftidx: NL80211_EXT_FEATURE_CQM_RSSI_LIST);
5769
5770	ret = ieee80211_register_hw(hw: il->hw);
5771	if (ret) {
5772	IL_ERR("Failed to register hw (error %d)\n", ret);
5773	return ret;
5774	}
5775	il->mac80211_registered = 1;
5776
5777	return 0;
5778	}
5779
5780	int
5781	il4965_mac_start(struct ieee80211_hw *hw)
5782	{
5783	struct il_priv *il = hw->priv;
5784	int ret;
5785
5786	D_MAC80211("enter\n");
5787
5788	/* we should be verifying the device is ready to be opened */
5789	mutex_lock(&il->mutex);
5790	ret = __il4965_up(il);
5791	mutex_unlock(lock: &il->mutex);
5792
5793	if (ret)
5794	return ret;
5795
5796	if (il_is_rfkill(il))
5797	goto out;
5798
5799	D_INFO("Start UP work done.\n");
5800
5801	/* Wait for START_ALIVE from Run Time ucode. Otherwise callbacks from
5802	* mac80211 will not be run successfully. */
5803	ret = wait_event_timeout(il->wait_command_queue,
5804	test_bit(S_READY, &il->status),
5805	UCODE_READY_TIMEOUT);
5806	if (!ret) {
5807	if (!test_bit(S_READY, &il->status)) {
5808	IL_ERR("START_ALIVE timeout after %dms.\n",
5809	jiffies_to_msecs(UCODE_READY_TIMEOUT));
5810	return -ETIMEDOUT;
5811	}
5812	}
5813
5814	il4965_led_enable(il);
5815
5816	out:
5817	il->is_open = 1;
5818	D_MAC80211("leave\n");
5819	return 0;
5820	}
5821
5822	void
5823	il4965_mac_stop(struct ieee80211_hw *hw)
5824	{
5825	struct il_priv *il = hw->priv;
5826
5827	D_MAC80211("enter\n");
5828
5829	if (!il->is_open)
5830	return;
5831
5832	il->is_open = 0;
5833
5834	il4965_down(il);
5835
5836	flush_workqueue(il->workqueue);
5837
5838	/* User space software may expect getting rfkill changes
5839	* even if interface is down */
5840	_il_wr(il, CSR_INT, val: 0xFFFFFFFF);
5841	il_enable_rfkill_int(il);
5842
5843	D_MAC80211("leave\n");
5844	}
5845
5846	void
5847	il4965_mac_tx(struct ieee80211_hw *hw,
5848	struct ieee80211_tx_control *control,
5849	struct sk_buff *skb)
5850	{
5851	struct il_priv *il = hw->priv;
5852
5853	D_MACDUMP("enter\n");
5854
5855	D_TX("dev->xmit(%d bytes) at rate 0x%02x\n", skb->len,
5856	ieee80211_get_tx_rate(hw, IEEE80211_SKB_CB(skb))->bitrate);
5857
5858	if (il4965_tx_skb(il, sta: control->sta, skb))
5859	dev_kfree_skb_any(skb);
5860
5861	D_MACDUMP("leave\n");
5862	}
5863
5864	void
5865	il4965_mac_update_tkip_key(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
5866	struct ieee80211_key_conf *keyconf,
5867	struct ieee80211_sta *sta, u32 iv32, u16 * phase1key)
5868	{
5869	struct il_priv *il = hw->priv;
5870
5871	D_MAC80211("enter\n");
5872
5873	il4965_update_tkip_key(il, keyconf, sta, iv32, phase1key);
5874
5875	D_MAC80211("leave\n");
5876	}
5877
5878	int
5879	il4965_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
5880	struct ieee80211_vif *vif, struct ieee80211_sta *sta,
5881	struct ieee80211_key_conf *key)
5882	{
5883	struct il_priv *il = hw->priv;
5884	int ret;
5885	u8 sta_id;
5886	bool is_default_wep_key = false;
5887
5888	D_MAC80211("enter\n");
5889
5890	if (il->cfg->mod_params->sw_crypto) {
5891	D_MAC80211("leave - hwcrypto disabled\n");
5892	return -EOPNOTSUPP;
5893	}
5894
5895	/*
5896	* To support IBSS RSN, don't program group keys in IBSS, the
5897	* hardware will then not attempt to decrypt the frames.
5898	*/
5899	if (vif->type == NL80211_IFTYPE_ADHOC &&
5900	!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
5901	D_MAC80211("leave - ad-hoc group key\n");
5902	return -EOPNOTSUPP;
5903	}
5904
5905	sta_id = il_sta_id_or_broadcast(il, sta);
5906	if (sta_id == IL_INVALID_STATION)
5907	return -EINVAL;
5908
5909	mutex_lock(&il->mutex);
5910	il_scan_cancel_timeout(il, ms: 100);
5911
5912	/*
5913	* If we are getting WEP group key and we didn't receive any key mapping
5914	* so far, we are in legacy wep mode (group key only), otherwise we are
5915	* in 1X mode.
5916	* In legacy wep mode, we use another host command to the uCode.
5917	*/
5918	if ((key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
5919	key->cipher == WLAN_CIPHER_SUITE_WEP104) && !sta) {
5920	if (cmd == SET_KEY)
5921	is_default_wep_key = !il->_4965.key_mapping_keys;
5922	else
5923	is_default_wep_key =
5924	(key->hw_key_idx == HW_KEY_DEFAULT);
5925	}
5926
5927	switch (cmd) {
5928	case SET_KEY:
5929	if (is_default_wep_key)
5930	ret = il4965_set_default_wep_key(il, keyconf: key);
5931	else
5932	ret = il4965_set_dynamic_key(il, keyconf: key, sta_id);
5933
5934	D_MAC80211("enable hwcrypto key\n");
5935	break;
5936	case DISABLE_KEY:
5937	if (is_default_wep_key)
5938	ret = il4965_remove_default_wep_key(il, keyconf: key);
5939	else
5940	ret = il4965_remove_dynamic_key(il, keyconf: key, sta_id);
5941
5942	D_MAC80211("disable hwcrypto key\n");
5943	break;
5944	default:
5945	ret = -EINVAL;
5946	}
5947
5948	mutex_unlock(lock: &il->mutex);
5949	D_MAC80211("leave\n");
5950
5951	return ret;
5952	}
5953
5954	int
5955	il4965_mac_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
5956	struct ieee80211_ampdu_params *params)
5957	{
5958	struct il_priv *il = hw->priv;
5959	int ret = -EINVAL;
5960	struct ieee80211_sta *sta = params->sta;
5961	enum ieee80211_ampdu_mlme_action action = params->action;
5962	u16 tid = params->tid;
5963	u16 *ssn = &params->ssn;
5964
5965	D_HT("A-MPDU action on addr %pM tid %d\n", sta->addr, tid);
5966
5967	if (!(il->cfg->sku & IL_SKU_N))
5968	return -EACCES;
5969
5970	mutex_lock(&il->mutex);
5971
5972	switch (action) {
5973	case IEEE80211_AMPDU_RX_START:
5974	D_HT("start Rx\n");
5975	ret = il4965_sta_rx_agg_start(il, sta, tid, ssn: *ssn);
5976	break;
5977	case IEEE80211_AMPDU_RX_STOP:
5978	D_HT("stop Rx\n");
5979	ret = il4965_sta_rx_agg_stop(il, sta, tid);
5980	if (test_bit(S_EXIT_PENDING, &il->status))
5981	ret = 0;
5982	break;
5983	case IEEE80211_AMPDU_TX_START:
5984	D_HT("start Tx\n");
5985	ret = il4965_tx_agg_start(il, vif, sta, tid, ssn);
5986	break;
5987	case IEEE80211_AMPDU_TX_STOP_CONT:
5988	case IEEE80211_AMPDU_TX_STOP_FLUSH:
5989	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
5990	D_HT("stop Tx\n");
5991	ret = il4965_tx_agg_stop(il, vif, sta, tid);
5992	if (test_bit(S_EXIT_PENDING, &il->status))
5993	ret = 0;
5994	break;
5995	case IEEE80211_AMPDU_TX_OPERATIONAL:
5996	ret = 0;
5997	break;
5998	}
5999	mutex_unlock(lock: &il->mutex);
6000
6001	return ret;
6002	}
6003
6004	int
6005	il4965_mac_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
6006	struct ieee80211_sta *sta)
6007	{
6008	struct il_priv *il = hw->priv;
6009	struct il_station_priv *sta_priv = (void *)sta->drv_priv;
6010	bool is_ap = vif->type == NL80211_IFTYPE_STATION;
6011	int ret;
6012	u8 sta_id;
6013
6014	D_INFO("received request to add station %pM\n", sta->addr);
6015	mutex_lock(&il->mutex);
6016	D_INFO("proceeding to add station %pM\n", sta->addr);
6017	sta_priv->common.sta_id = IL_INVALID_STATION;
6018
6019	atomic_set(v: &sta_priv->pending_frames, i: 0);
6020
6021	ret =
6022	il_add_station_common(il, addr: sta->addr, is_ap, sta, sta_id_r: &sta_id);
6023	if (ret) {
6024	IL_ERR("Unable to add station %pM (%d)\n", sta->addr, ret);
6025	/* Should we return success if return code is EEXIST ? */
6026	mutex_unlock(lock: &il->mutex);
6027	return ret;
6028	}
6029
6030	sta_priv->common.sta_id = sta_id;
6031
6032	/* Initialize rate scaling */
6033	D_INFO("Initializing rate scaling for station %pM\n", sta->addr);
6034	il4965_rs_rate_init(il, sta, sta_id);
6035	mutex_unlock(lock: &il->mutex);
6036
6037	return 0;
6038	}
6039
6040	void
6041	il4965_mac_channel_switch(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
6042	struct ieee80211_channel_switch *ch_switch)
6043	{
6044	struct il_priv *il = hw->priv;
6045	const struct il_channel_info *ch_info;
6046	struct ieee80211_conf *conf = &hw->conf;
6047	struct ieee80211_channel *channel = ch_switch->chandef.chan;
6048	struct il_ht_config *ht_conf = &il->current_ht_config;
6049	u16 ch;
6050
6051	D_MAC80211("enter\n");
6052
6053	mutex_lock(&il->mutex);
6054
6055	if (il_is_rfkill(il))
6056	goto out;
6057
6058	if (test_bit(S_EXIT_PENDING, &il->status) ||
6059	test_bit(S_SCANNING, &il->status) ||
6060	test_bit(S_CHANNEL_SWITCH_PENDING, &il->status))
6061	goto out;
6062
6063	if (!il_is_associated(il))
6064	goto out;
6065
6066	if (!il->ops->set_channel_switch)
6067	goto out;
6068
6069	ch = channel->hw_value;
6070	if (le16_to_cpu(il->active.channel) == ch)
6071	goto out;
6072
6073	ch_info = il_get_channel_info(il, band: channel->band, channel: ch);
6074	if (!il_is_channel_valid(ch_info)) {
6075	D_MAC80211("invalid channel\n");
6076	goto out;
6077	}
6078
6079	spin_lock_irq(lock: &il->lock);
6080
6081	il->current_ht_config.smps = conf->smps_mode;
6082
6083	/* Configure HT40 channels */
6084	switch (cfg80211_get_chandef_type(chandef: &ch_switch->chandef)) {
6085	case NL80211_CHAN_NO_HT:
6086	case NL80211_CHAN_HT20:
6087	il->ht.is_40mhz = false;
6088	il->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
6089	break;
6090	case NL80211_CHAN_HT40MINUS:
6091	il->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
6092	il->ht.is_40mhz = true;
6093	break;
6094	case NL80211_CHAN_HT40PLUS:
6095	il->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
6096	il->ht.is_40mhz = true;
6097	break;
6098	}
6099
6100	if ((le16_to_cpu(il->staging.channel) != ch))
6101	il->staging.flags = 0;
6102
6103	il_set_rxon_channel(il, ch: channel);
6104	il_set_rxon_ht(il, ht_conf);
6105	il_set_flags_for_band(il, band: channel->band, vif: il->vif);
6106
6107	spin_unlock_irq(lock: &il->lock);
6108
6109	il_set_rate(il);
6110	/*
6111	* at this point, staging_rxon has the
6112	* configuration for channel switch
6113	*/
6114	set_bit(S_CHANNEL_SWITCH_PENDING, addr: &il->status);
6115	il->switch_channel = cpu_to_le16(ch);
6116	if (il->ops->set_channel_switch(il, ch_switch)) {
6117	clear_bit(S_CHANNEL_SWITCH_PENDING, addr: &il->status);
6118	il->switch_channel = 0;
6119	ieee80211_chswitch_done(vif: il->vif, success: false, link_id: 0);
6120	}
6121
6122	out:
6123	mutex_unlock(lock: &il->mutex);
6124	D_MAC80211("leave\n");
6125	}
6126
6127	void
6128	il4965_configure_filter(struct ieee80211_hw *hw, unsigned int changed_flags,
6129	unsigned int *total_flags, u64 multicast)
6130	{
6131	struct il_priv *il = hw->priv;
6132	__le32 filter_or = 0, filter_nand = 0;
6133
6134	#define CHK(test, flag) do { \
6135	if (*total_flags & (test)) \
6136	filter_or |= (flag); \
6137	else \
6138	filter_nand |= (flag); \
6139	} while (0)
6140
6141	D_MAC80211("Enter: changed: 0x%x, total: 0x%x\n", changed_flags,
6142	*total_flags);
6143
6144	CHK(FIF_OTHER_BSS, RXON_FILTER_PROMISC_MSK);
6145	/* Setting _just_ RXON_FILTER_CTL2HOST_MSK causes FH errors */
6146	CHK(FIF_CONTROL, RXON_FILTER_CTL2HOST_MSK | RXON_FILTER_PROMISC_MSK);
6147	CHK(FIF_BCN_PRBRESP_PROMISC, RXON_FILTER_BCON_AWARE_MSK);
6148
6149	#undef CHK
6150
6151	mutex_lock(&il->mutex);
6152
6153	il->staging.filter_flags &= ~filter_nand;
6154	il->staging.filter_flags |= filter_or;
6155
6156	/*
6157	* Not committing directly because hardware can perform a scan,
6158	* but we'll eventually commit the filter flags change anyway.
6159	*/
6160
6161	mutex_unlock(lock: &il->mutex);
6162
6163	/*
6164	* Receiving all multicast frames is always enabled by the
6165	* default flags setup in il_connection_init_rx_config()
6166	* since we currently do not support programming multicast
6167	* filters into the device.
6168	*/
6169	*total_flags &=
6170	FIF_OTHER_BSS | FIF_ALLMULTI |
6171	FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
6172	}
6173
6174	/*****************************************************************************
6175	*
6176	* driver setup and teardown
6177	*
6178	*****************************************************************************/
6179
6180	static void
6181	il4965_bg_txpower_work(struct work_struct *work)
6182	{
6183	struct il_priv *il = container_of(work, struct il_priv,
6184	txpower_work);
6185
6186	mutex_lock(&il->mutex);
6187
6188	/* If a scan happened to start before we got here
6189	* then just return; the stats notification will
6190	* kick off another scheduled work to compensate for
6191	* any temperature delta we missed here. */
6192	if (test_bit(S_EXIT_PENDING, &il->status) ||
6193	test_bit(S_SCANNING, &il->status))
6194	goto out;
6195
6196	/* Regardless of if we are associated, we must reconfigure the
6197	* TX power since frames can be sent on non-radar channels while
6198	* not associated */
6199	il->ops->send_tx_power(il);
6200
6201	/* Update last_temperature to keep is_calib_needed from running
6202	* when it isn't needed... */
6203	il->last_temperature = il->temperature;
6204	out:
6205	mutex_unlock(lock: &il->mutex);
6206	}
6207
6208	static int
6209	il4965_setup_deferred_work(struct il_priv *il)
6210	{
6211	il->workqueue = create_singlethread_workqueue(DRV_NAME);
6212	if (!il->workqueue)
6213	return -ENOMEM;
6214
6215	init_waitqueue_head(&il->wait_command_queue);
6216
6217	INIT_WORK(&il->restart, il4965_bg_restart);
6218	INIT_WORK(&il->rx_replenish, il4965_bg_rx_replenish);
6219	INIT_WORK(&il->run_time_calib_work, il4965_bg_run_time_calib_work);
6220	INIT_DELAYED_WORK(&il->init_alive_start, il4965_bg_init_alive_start);
6221	INIT_DELAYED_WORK(&il->alive_start, il4965_bg_alive_start);
6222
6223	il_setup_scan_deferred_work(il);
6224
6225	INIT_WORK(&il->txpower_work, il4965_bg_txpower_work);
6226
6227	timer_setup(&il->stats_periodic, il4965_bg_stats_periodic, 0);
6228
6229	timer_setup(&il->watchdog, il_bg_watchdog, 0);
6230
6231	tasklet_setup(t: &il->irq_tasklet, callback: il4965_irq_tasklet);
6232
6233	return 0;
6234	}
6235
6236	static void
6237	il4965_cancel_deferred_work(struct il_priv *il)
6238	{
6239	cancel_work_sync(work: &il->txpower_work);
6240	cancel_delayed_work_sync(dwork: &il->init_alive_start);
6241	cancel_delayed_work(dwork: &il->alive_start);
6242	cancel_work_sync(work: &il->run_time_calib_work);
6243
6244	il_cancel_scan_deferred_work(il);
6245
6246	del_timer_sync(timer: &il->stats_periodic);
6247	}
6248
6249	static void
6250	il4965_init_hw_rates(struct il_priv *il, struct ieee80211_rate *rates)
6251	{
6252	int i;
6253
6254	for (i = 0; i < RATE_COUNT_LEGACY; i++) {
6255	rates[i].bitrate = il_rates[i].ieee * 5;
6256	rates[i].hw_value = i; /* Rate scaling will work on idxes */
6257	rates[i].hw_value_short = i;
6258	rates[i].flags = 0;
6259	if ((i >= IL_FIRST_CCK_RATE) && (i <= IL_LAST_CCK_RATE)) {
6260	/*
6261	* If CCK != 1M then set short preamble rate flag.
6262	*/
6263	rates[i].flags |=
6264	(il_rates[i].plcp ==
6265	RATE_1M_PLCP) ? 0 : IEEE80211_RATE_SHORT_PREAMBLE;
6266	}
6267	}
6268	}
6269
6270	/*
6271	* Acquire il->lock before calling this function !
6272	*/
6273	void
6274	il4965_set_wr_ptrs(struct il_priv *il, int txq_id, u32 idx)
6275	{
6276	il_wr(il, HBUS_TARG_WRPTR, value: (idx & 0xff) | (txq_id << 8));
6277	il_wr_prph(il, IL49_SCD_QUEUE_RDPTR(txq_id), val: idx);
6278	}
6279
6280	void
6281	il4965_tx_queue_set_status(struct il_priv *il, struct il_tx_queue *txq,
6282	int tx_fifo_id, int scd_retry)
6283	{
6284	int txq_id = txq->q.id;
6285
6286	/* Find out whether to activate Tx queue */
6287	int active = test_bit(txq_id, &il->txq_ctx_active_msk) ? 1 : 0;
6288
6289	/* Set up and activate */
6290	il_wr_prph(il, IL49_SCD_QUEUE_STATUS_BITS(txq_id),
6291	val: (active << IL49_SCD_QUEUE_STTS_REG_POS_ACTIVE) |
6292	(tx_fifo_id << IL49_SCD_QUEUE_STTS_REG_POS_TXF) |
6293	(scd_retry << IL49_SCD_QUEUE_STTS_REG_POS_WSL) |
6294	(scd_retry << IL49_SCD_QUEUE_STTS_REG_POS_SCD_ACK) |
6295	IL49_SCD_QUEUE_STTS_REG_MSK);
6296
6297	txq->sched_retry = scd_retry;
6298
6299	D_INFO("%s %s Queue %d on AC %d\n", active ? "Activate" : "Deactivate",
6300	scd_retry ? "BA" : "AC", txq_id, tx_fifo_id);
6301	}
6302
6303	static const struct ieee80211_ops il4965_mac_ops = {
6304	.add_chanctx = ieee80211_emulate_add_chanctx,
6305	.remove_chanctx = ieee80211_emulate_remove_chanctx,
6306	.change_chanctx = ieee80211_emulate_change_chanctx,
6307	.switch_vif_chanctx = ieee80211_emulate_switch_vif_chanctx,
6308	.tx = il4965_mac_tx,
6309	.wake_tx_queue = ieee80211_handle_wake_tx_queue,
6310	.start = il4965_mac_start,
6311	.stop = il4965_mac_stop,
6312	.add_interface = il_mac_add_interface,
6313	.remove_interface = il_mac_remove_interface,
6314	.change_interface = il_mac_change_interface,
6315	.config = il_mac_config,
6316	.configure_filter = il4965_configure_filter,
6317	.set_key = il4965_mac_set_key,
6318	.update_tkip_key = il4965_mac_update_tkip_key,
6319	.conf_tx = il_mac_conf_tx,
6320	.reset_tsf = il_mac_reset_tsf,
6321	.bss_info_changed = il_mac_bss_info_changed,
6322	.ampdu_action = il4965_mac_ampdu_action,
6323	.hw_scan = il_mac_hw_scan,
6324	.sta_add = il4965_mac_sta_add,
6325	.sta_remove = il_mac_sta_remove,
6326	.channel_switch = il4965_mac_channel_switch,
6327	.tx_last_beacon = il_mac_tx_last_beacon,
6328	.flush = il_mac_flush,
6329	};
6330
6331	static int
6332	il4965_init_drv(struct il_priv *il)
6333	{
6334	int ret;
6335
6336	spin_lock_init(&il->sta_lock);
6337	spin_lock_init(&il->hcmd_lock);
6338
6339	INIT_LIST_HEAD(list: &il->free_frames);
6340
6341	mutex_init(&il->mutex);
6342
6343	il->ieee_channels = NULL;
6344	il->ieee_rates = NULL;
6345	il->band = NL80211_BAND_2GHZ;
6346
6347	il->iw_mode = NL80211_IFTYPE_STATION;
6348	il->current_ht_config.smps = IEEE80211_SMPS_STATIC;
6349	il->missed_beacon_threshold = IL_MISSED_BEACON_THRESHOLD_DEF;
6350
6351	/* initialize force reset */
6352	il->force_reset.reset_duration = IL_DELAY_NEXT_FORCE_FW_RELOAD;
6353
6354	/* Choose which receivers/antennas to use */
6355	if (il->ops->set_rxon_chain)
6356	il->ops->set_rxon_chain(il);
6357
6358	il_init_scan_params(il);
6359
6360	ret = il_init_channel_map(il);
6361	if (ret) {
6362	IL_ERR("initializing regulatory failed: %d\n", ret);
6363	goto err;
6364	}
6365
6366	ret = il_init_geos(il);
6367	if (ret) {
6368	IL_ERR("initializing geos failed: %d\n", ret);
6369	goto err_free_channel_map;
6370	}
6371	il4965_init_hw_rates(il, rates: il->ieee_rates);
6372
6373	return 0;
6374
6375	err_free_channel_map:
6376	il_free_channel_map(il);
6377	err:
6378	return ret;
6379	}
6380
6381	static void
6382	il4965_uninit_drv(struct il_priv *il)
6383	{
6384	il_free_geos(il);
6385	il_free_channel_map(il);
6386	kfree(objp: il->scan_cmd);
6387	}
6388
6389	static void
6390	il4965_hw_detect(struct il_priv *il)
6391	{
6392	il->hw_rev = _il_rd(il, CSR_HW_REV);
6393	il->hw_wa_rev = _il_rd(il, CSR_HW_REV_WA_REG);
6394	il->rev_id = il->pci_dev->revision;
6395	D_INFO("HW Revision ID = 0x%X\n", il->rev_id);
6396	}
6397
6398	static const struct il_sensitivity_ranges il4965_sensitivity = {
6399	.min_nrg_cck = 97,
6400	.max_nrg_cck = 0, /* not used, set to 0 */
6401
6402	.auto_corr_min_ofdm = 85,
6403	.auto_corr_min_ofdm_mrc = 170,
6404	.auto_corr_min_ofdm_x1 = 105,
6405	.auto_corr_min_ofdm_mrc_x1 = 220,
6406
6407	.auto_corr_max_ofdm = 120,
6408	.auto_corr_max_ofdm_mrc = 210,
6409	.auto_corr_max_ofdm_x1 = 140,
6410	.auto_corr_max_ofdm_mrc_x1 = 270,
6411
6412	.auto_corr_min_cck = 125,
6413	.auto_corr_max_cck = 200,
6414	.auto_corr_min_cck_mrc = 200,
6415	.auto_corr_max_cck_mrc = 400,
6416
6417	.nrg_th_cck = 100,
6418	.nrg_th_ofdm = 100,
6419
6420	.barker_corr_th_min = 190,
6421	.barker_corr_th_min_mrc = 390,
6422	.nrg_th_cca = 62,
6423	};
6424
6425	static void
6426	il4965_set_hw_params(struct il_priv *il)
6427	{
6428	il->hw_params.bcast_id = IL4965_BROADCAST_ID;
6429	il->hw_params.max_rxq_size = RX_QUEUE_SIZE;
6430	il->hw_params.max_rxq_log = RX_QUEUE_SIZE_LOG;
6431	if (il->cfg->mod_params->amsdu_size_8K)
6432	il->hw_params.rx_page_order = get_order(IL_RX_BUF_SIZE_8K);
6433	else
6434	il->hw_params.rx_page_order = get_order(IL_RX_BUF_SIZE_4K);
6435
6436	il->hw_params.max_beacon_itrvl = IL_MAX_UCODE_BEACON_INTERVAL;
6437
6438	if (il->cfg->mod_params->disable_11n)
6439	il->cfg->sku &= ~IL_SKU_N;
6440
6441	if (il->cfg->mod_params->num_of_queues >= IL_MIN_NUM_QUEUES &&
6442	il->cfg->mod_params->num_of_queues <= IL49_NUM_QUEUES)
6443	il->cfg->num_of_queues =
6444	il->cfg->mod_params->num_of_queues;
6445
6446	il->hw_params.max_txq_num = il->cfg->num_of_queues;
6447	il->hw_params.dma_chnl_num = FH49_TCSR_CHNL_NUM;
6448	il->hw_params.scd_bc_tbls_size =
6449	il->cfg->num_of_queues *
6450	sizeof(struct il4965_scd_bc_tbl);
6451
6452	il->hw_params.tfd_size = sizeof(struct il_tfd);
6453	il->hw_params.max_stations = IL4965_STATION_COUNT;
6454	il->hw_params.max_data_size = IL49_RTC_DATA_SIZE;
6455	il->hw_params.max_inst_size = IL49_RTC_INST_SIZE;
6456	il->hw_params.max_bsm_size = BSM_SRAM_SIZE;
6457	il->hw_params.ht40_channel = BIT(NL80211_BAND_5GHZ);
6458
6459	il->hw_params.rx_wrt_ptr_reg = FH49_RSCSR_CHNL0_WPTR;
6460
6461	il->hw_params.tx_chains_num = il4965_num_of_ant(m: il->cfg->valid_tx_ant);
6462	il->hw_params.rx_chains_num = il4965_num_of_ant(m: il->cfg->valid_rx_ant);
6463	il->hw_params.valid_tx_ant = il->cfg->valid_tx_ant;
6464	il->hw_params.valid_rx_ant = il->cfg->valid_rx_ant;
6465
6466	il->hw_params.ct_kill_threshold =
6467	celsius_to_kelvin(CT_KILL_THRESHOLD_LEGACY);
6468
6469	il->hw_params.sens = &il4965_sensitivity;
6470	il->hw_params.beacon_time_tsf_bits = IL4965_EXT_BEACON_TIME_POS;
6471	}
6472
6473	static int
6474	il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
6475	{
6476	int err = 0;
6477	struct il_priv *il;
6478	struct ieee80211_hw *hw;
6479	struct il_cfg *cfg = (struct il_cfg *)(ent->driver_data);
6480	unsigned long flags;
6481	u16 pci_cmd;
6482
6483	/************************
6484	* 1. Allocating HW data
6485	************************/
6486
6487	hw = ieee80211_alloc_hw(priv_data_len: sizeof(struct il_priv), ops: &il4965_mac_ops);
6488	if (!hw) {
6489	err = -ENOMEM;
6490	goto out;
6491	}
6492	il = hw->priv;
6493	il->hw = hw;
6494	SET_IEEE80211_DEV(hw, dev: &pdev->dev);
6495
6496	D_INFO("*** LOAD DRIVER ***\n");
6497	il->cfg = cfg;
6498	il->ops = &il4965_ops;
6499	#ifdef CONFIG_IWLEGACY_DEBUGFS
6500	il->debugfs_ops = &il4965_debugfs_ops;
6501	#endif
6502	il->pci_dev = pdev;
6503	il->inta_mask = CSR_INI_SET_MASK;
6504
6505	/**************************
6506	* 2. Initializing PCI bus
6507	**************************/
6508	pci_disable_link_state(pdev,
6509	PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
6510	PCIE_LINK_STATE_CLKPM);
6511
6512	if (pci_enable_device(dev: pdev)) {
6513	err = -ENODEV;
6514	goto out_ieee80211_free_hw;
6515	}
6516
6517	pci_set_master(dev: pdev);
6518
6519	err = dma_set_mask_and_coherent(dev: &pdev->dev, DMA_BIT_MASK(36));
6520	if (err) {
6521	err = dma_set_mask_and_coherent(dev: &pdev->dev, DMA_BIT_MASK(32));
6522	/* both attempts failed: */
6523	if (err) {
6524	IL_WARN("No suitable DMA available.\n");
6525	goto out_pci_disable_device;
6526	}
6527	}
6528
6529	err = pci_request_regions(pdev, DRV_NAME);
6530	if (err)
6531	goto out_pci_disable_device;
6532
6533	pci_set_drvdata(pdev, data: il);
6534
6535	/***********************
6536	* 3. Read REV register
6537	***********************/
6538	il->hw_base = pci_ioremap_bar(pdev, bar: 0);
6539	if (!il->hw_base) {
6540	err = -ENODEV;
6541	goto out_pci_release_regions;
6542	}
6543
6544	D_INFO("pci_resource_len = 0x%08llx\n",
6545	(unsigned long long)pci_resource_len(pdev, 0));
6546	D_INFO("pci_resource_base = %p\n", il->hw_base);
6547
6548	/* these spin locks will be used in apm_ops.init and EEPROM access
6549	* we should init now
6550	*/
6551	spin_lock_init(&il->reg_lock);
6552	spin_lock_init(&il->lock);
6553
6554	/*
6555	* stop and reset the on-board processor just in case it is in a
6556	* strange state ... like being left stranded by a primary kernel
6557	* and this is now the kdump kernel trying to start up
6558	*/
6559	_il_wr(il, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
6560
6561	il4965_hw_detect(il);
6562	IL_INFO("Detected %s, REV=0x%X\n", il->cfg->name, il->hw_rev);
6563
6564	/* We disable the RETRY_TIMEOUT register (0x41) to keep
6565	* PCI Tx retries from interfering with C3 CPU state */
6566	pci_write_config_byte(dev: pdev, PCI_CFG_RETRY_TIMEOUT, val: 0x00);
6567
6568	il4965_prepare_card_hw(il);
6569	if (!il->hw_ready) {
6570	IL_WARN("Failed, HW not ready\n");
6571	err = -EIO;
6572	goto out_iounmap;
6573	}
6574
6575	/*****************
6576	* 4. Read EEPROM
6577	*****************/
6578	/* Read the EEPROM */
6579	err = il_eeprom_init(il);
6580	if (err) {
6581	IL_ERR("Unable to init EEPROM\n");
6582	goto out_iounmap;
6583	}
6584	err = il4965_eeprom_check_version(il);
6585	if (err)
6586	goto out_free_eeprom;
6587
6588	/* extract MAC Address */
6589	il4965_eeprom_get_mac(il, mac: il->addresses[0].addr);
6590	D_INFO("MAC address: %pM\n", il->addresses[0].addr);
6591	il->hw->wiphy->addresses = il->addresses;
6592	il->hw->wiphy->n_addresses = 1;
6593
6594	/************************
6595	* 5. Setup HW constants
6596	************************/
6597	il4965_set_hw_params(il);
6598
6599	/*******************
6600	* 6. Setup il
6601	*******************/
6602
6603	err = il4965_init_drv(il);
6604	if (err)
6605	goto out_free_eeprom;
6606	/* At this point both hw and il are initialized. */
6607
6608	/********************
6609	* 7. Setup services
6610	********************/
6611	spin_lock_irqsave(&il->lock, flags);
6612	il_disable_interrupts(il);
6613	spin_unlock_irqrestore(lock: &il->lock, flags);
6614
6615	pci_enable_msi(dev: il->pci_dev);
6616
6617	err = request_irq(irq: il->pci_dev->irq, handler: il_isr, IRQF_SHARED, DRV_NAME, dev: il);
6618	if (err) {
6619	IL_ERR("Error allocating IRQ %d\n", il->pci_dev->irq);
6620	goto out_disable_msi;
6621	}
6622
6623	err = il4965_setup_deferred_work(il);
6624	if (err)
6625	goto out_free_irq;
6626
6627	il4965_setup_handlers(il);
6628
6629	/*********************************************
6630	* 8. Enable interrupts and read RFKILL state
6631	*********************************************/
6632
6633	/* enable rfkill interrupt: hw bug w/a */
6634	pci_read_config_word(dev: il->pci_dev, PCI_COMMAND, val: &pci_cmd);
6635	if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
6636	pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
6637	pci_write_config_word(dev: il->pci_dev, PCI_COMMAND, val: pci_cmd);
6638	}
6639
6640	il_enable_rfkill_int(il);
6641
6642	/* If platform's RF_KILL switch is NOT set to KILL */
6643	if (_il_rd(il, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
6644	clear_bit(S_RFKILL, addr: &il->status);
6645	else
6646	set_bit(S_RFKILL, addr: &il->status);
6647
6648	wiphy_rfkill_set_hw_state(wiphy: il->hw->wiphy,
6649	test_bit(S_RFKILL, &il->status));
6650
6651	il_power_initialize(il);
6652
6653	init_completion(x: &il->_4965.firmware_loading_complete);
6654
6655	err = il4965_request_firmware(il, first: true);
6656	if (err)
6657	goto out_destroy_workqueue;
6658
6659	return 0;
6660
6661	out_destroy_workqueue:
6662	destroy_workqueue(wq: il->workqueue);
6663	il->workqueue = NULL;
6664	out_free_irq:
6665	free_irq(il->pci_dev->irq, il);
6666	out_disable_msi:
6667	pci_disable_msi(dev: il->pci_dev);
6668	il4965_uninit_drv(il);
6669	out_free_eeprom:
6670	il_eeprom_free(il);
6671	out_iounmap:
6672	iounmap(addr: il->hw_base);
6673	out_pci_release_regions:
6674	pci_release_regions(pdev);
6675	out_pci_disable_device:
6676	pci_disable_device(dev: pdev);
6677	out_ieee80211_free_hw:
6678	ieee80211_free_hw(hw: il->hw);
6679	out:
6680	return err;
6681	}
6682
6683	static void
6684	il4965_pci_remove(struct pci_dev *pdev)
6685	{
6686	struct il_priv *il = pci_get_drvdata(pdev);
6687	unsigned long flags;
6688
6689	if (!il)
6690	return;
6691
6692	wait_for_completion(&il->_4965.firmware_loading_complete);
6693
6694	D_INFO("*** UNLOAD DRIVER ***\n");
6695
6696	il_dbgfs_unregister(il);
6697	sysfs_remove_group(kobj: &pdev->dev.kobj, grp: &il_attribute_group);
6698
6699	/* ieee80211_unregister_hw call wil cause il_mac_stop to
6700	* be called and il4965_down since we are removing the device
6701	* we need to set S_EXIT_PENDING bit.
6702	*/
6703	set_bit(S_EXIT_PENDING, addr: &il->status);
6704
6705	il_leds_exit(il);
6706
6707	if (il->mac80211_registered) {
6708	ieee80211_unregister_hw(hw: il->hw);
6709	il->mac80211_registered = 0;
6710	} else {
6711	il4965_down(il);
6712	}
6713
6714	/*
6715	* Make sure device is reset to low power before unloading driver.
6716	* This may be redundant with il4965_down(), but there are paths to
6717	* run il4965_down() without calling apm_ops.stop(), and there are
6718	* paths to avoid running il4965_down() at all before leaving driver.
6719	* This (inexpensive) call *makes sure* device is reset.
6720	*/
6721	il_apm_stop(il);
6722
6723	/* make sure we flush any pending irq or
6724	* tasklet for the driver
6725	*/
6726	spin_lock_irqsave(&il->lock, flags);
6727	il_disable_interrupts(il);
6728	spin_unlock_irqrestore(lock: &il->lock, flags);
6729
6730	il4965_synchronize_irq(il);
6731
6732	il4965_dealloc_ucode_pci(il);
6733
6734	if (il->rxq.bd)
6735	il4965_rx_queue_free(il, rxq: &il->rxq);
6736	il4965_hw_txq_ctx_free(il);
6737
6738	il_eeprom_free(il);
6739
6740	/*netif_stop_queue(dev); */
6741
6742	/* ieee80211_unregister_hw calls il_mac_stop, which flushes
6743	* il->workqueue... so we can't take down the workqueue
6744	* until now... */
6745	destroy_workqueue(wq: il->workqueue);
6746	il->workqueue = NULL;
6747
6748	free_irq(il->pci_dev->irq, il);
6749	pci_disable_msi(dev: il->pci_dev);
6750	iounmap(addr: il->hw_base);
6751	pci_release_regions(pdev);
6752	pci_disable_device(dev: pdev);
6753
6754	il4965_uninit_drv(il);
6755
6756	dev_kfree_skb(il->beacon_skb);
6757
6758	ieee80211_free_hw(hw: il->hw);
6759	}
6760
6761	/*
6762	* Activate/Deactivate Tx DMA/FIFO channels according tx fifos mask
6763	* must be called under il->lock and mac access
6764	*/
6765	void
6766	il4965_txq_set_sched(struct il_priv *il, u32 mask)
6767	{
6768	il_wr_prph(il, IL49_SCD_TXFACT, val: mask);
6769	}
6770
6771	/*****************************************************************************
6772	*
6773	* driver and module entry point
6774	*
6775	*****************************************************************************/
6776
6777	/* Hardware specific file defines the PCI IDs table for that hardware module */
6778	static const struct pci_device_id il4965_hw_card_ids[] = {
6779	{IL_PCI_DEVICE(0x4229, PCI_ANY_ID, il4965_cfg)},
6780	{IL_PCI_DEVICE(0x4230, PCI_ANY_ID, il4965_cfg)},
6781	{0}
6782	};
6783	MODULE_DEVICE_TABLE(pci, il4965_hw_card_ids);
6784
6785	static struct pci_driver il4965_driver = {
6786	.name = DRV_NAME,
6787	.id_table = il4965_hw_card_ids,
6788	.probe = il4965_pci_probe,
6789	.remove = il4965_pci_remove,
6790	.driver.pm = IL_LEGACY_PM_OPS,
6791	};
6792
6793	static int __init
6794	il4965_init(void)
6795	{
6796
6797	int ret;
6798	pr_info(DRV_DESCRIPTION ", " DRV_VERSION "\n");
6799	pr_info(DRV_COPYRIGHT "\n");
6800
6801	ret = il4965_rate_control_register();
6802	if (ret) {
6803	pr_err("Unable to register rate control algorithm: %d\n", ret);
6804	return ret;
6805	}
6806
6807	ret = pci_register_driver(&il4965_driver);
6808	if (ret) {
6809	pr_err("Unable to initialize PCI module\n");
6810	goto error_register;
6811	}
6812
6813	return ret;
6814
6815	error_register:
6816	il4965_rate_control_unregister();
6817	return ret;
6818	}
6819
6820	static void __exit
6821	il4965_exit(void)
6822	{
6823	pci_unregister_driver(dev: &il4965_driver);
6824	il4965_rate_control_unregister();
6825	}
6826
6827	module_exit(il4965_exit);
6828	module_init(il4965_init);
6829
6830	#ifdef CONFIG_IWLEGACY_DEBUG
6831	module_param_named(debug, il_debug_level, uint, 0644);
6832	MODULE_PARM_DESC(debug, "debug output mask");
6833	#endif
6834
6835	module_param_named(swcrypto, il4965_mod_params.sw_crypto, int, 0444);
6836	MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])");
6837	module_param_named(queues_num, il4965_mod_params.num_of_queues, int, 0444);
6838	MODULE_PARM_DESC(queues_num, "number of hw queues.");
6839	module_param_named(11n_disable, il4965_mod_params.disable_11n, int, 0444);
6840	MODULE_PARM_DESC(11n_disable, "disable 11n functionality");
6841	module_param_named(amsdu_size_8K, il4965_mod_params.amsdu_size_8K, int, 0444);
6842	MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size (default 0 [disabled])");
6843	module_param_named(fw_restart, il4965_mod_params.restart_fw, int, 0444);
6844	MODULE_PARM_DESC(fw_restart, "restart firmware in case of error");
6845