1 /*
2  * Copyright (c) 2006 Damien Bergamini <damien.bergamini@free.fr>
3  * Copyright (c) 2006 Sam Leffler, Errno Consulting
4  * Copyright (c) 2007 Christoph Hellwig <hch@lst.de>
5  * Copyright (c) 2008-2009 Weongyo Jeong <weongyo@freebsd.org>
6  * Copyright (c) 2012 Pontus Fuchs <pontus.fuchs@gmail.com>
7  *
8  * Permission to use, copy, modify, and/or distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 /*
22  * This driver is based on the uath driver written by Damien Bergamini for
23  * OpenBSD, who did black-box analysis of the Windows binary driver to find
24  * out how the hardware works.  It contains a lot magic numbers because of
25  * that and only has minimal functionality.
26  */
27 #include <linux/compiler.h>
28 #include <linux/kernel.h>
29 #include <linux/module.h>
30 #include <linux/list.h>
31 #include <linux/completion.h>
32 #include <linux/firmware.h>
33 #include <linux/skbuff.h>
34 #include <linux/usb.h>
35 #include <net/mac80211.h>
36 
37 #include "ar5523.h"
38 #include "ar5523_hw.h"
39 
40 /*
41  * Various supported device vendors/products.
42  * UB51: AR5005UG 802.11b/g, UB52: AR5005UX 802.11a/b/g
43  */
44 
45 static int ar5523_submit_rx_cmd(struct ar5523 *ar);
46 static void ar5523_data_tx_pkt_put(struct ar5523 *ar);
47 
48 static void ar5523_read_reply(struct ar5523 *ar, struct ar5523_cmd_hdr *hdr,
49 			      struct ar5523_tx_cmd *cmd)
50 {
51 	int dlen, olen;
52 	__be32 *rp;
53 
54 	dlen = be32_to_cpu(hdr->len) - sizeof(*hdr);
55 
56 	if (dlen < 0) {
57 		WARN_ON(1);
58 		goto out;
59 	}
60 
61 	ar5523_dbg(ar, "Code = %d len = %d\n", be32_to_cpu(hdr->code) & 0xff,
62 		   dlen);
63 
64 	rp = (__be32 *)(hdr + 1);
65 	if (dlen >= sizeof(u32)) {
66 		olen = be32_to_cpu(rp[0]);
67 		dlen -= sizeof(u32);
68 		if (olen == 0) {
69 			/* convention is 0 =>'s one word */
70 			olen = sizeof(u32);
71 		}
72 	} else
73 		olen = 0;
74 
75 	if (cmd->odata) {
76 		if (cmd->olen < olen) {
77 			ar5523_err(ar, "olen to small %d < %d\n",
78 				   cmd->olen, olen);
79 			cmd->olen = 0;
80 			cmd->res = -EOVERFLOW;
81 		} else {
82 			cmd->olen = olen;
83 			memcpy(cmd->odata, &rp[1], olen);
84 			cmd->res = 0;
85 		}
86 	}
87 
88 out:
89 	complete(&cmd->done);
90 }
91 
92 static void ar5523_cmd_rx_cb(struct urb *urb)
93 {
94 	struct ar5523 *ar = urb->context;
95 	struct ar5523_tx_cmd *cmd = &ar->tx_cmd;
96 	struct ar5523_cmd_hdr *hdr = ar->rx_cmd_buf;
97 	int dlen;
98 	u32 code, hdrlen;
99 
100 	if (urb->status) {
101 		if (urb->status != -ESHUTDOWN)
102 			ar5523_err(ar, "RX USB error %d.\n", urb->status);
103 		goto skip;
104 	}
105 
106 	if (urb->actual_length < sizeof(struct ar5523_cmd_hdr)) {
107 		ar5523_err(ar, "RX USB to short.\n");
108 		goto skip;
109 	}
110 
111 	ar5523_dbg(ar, "%s code %02x priv %d\n", __func__,
112 		   be32_to_cpu(hdr->code) & 0xff, hdr->priv);
113 
114 	code = be32_to_cpu(hdr->code);
115 	hdrlen = be32_to_cpu(hdr->len);
116 
117 	switch (code & 0xff) {
118 	default:
119 		/* reply to a read command */
120 		if (hdr->priv != AR5523_CMD_ID) {
121 			ar5523_err(ar, "Unexpected command id: %02x\n",
122 				   code & 0xff);
123 			goto skip;
124 		}
125 		ar5523_read_reply(ar, hdr, cmd);
126 		break;
127 
128 	case WDCMSG_DEVICE_AVAIL:
129 		ar5523_dbg(ar, "WDCMSG_DEVICE_AVAIL\n");
130 		cmd->res = 0;
131 		cmd->olen = 0;
132 		complete(&cmd->done);
133 		break;
134 
135 	case WDCMSG_SEND_COMPLETE:
136 		ar5523_dbg(ar, "WDCMSG_SEND_COMPLETE: %d pending\n",
137 			atomic_read(&ar->tx_nr_pending));
138 		if (!test_bit(AR5523_HW_UP, &ar->flags))
139 			ar5523_dbg(ar, "Unexpected WDCMSG_SEND_COMPLETE\n");
140 		else {
141 			mod_timer(&ar->tx_wd_timer,
142 				  jiffies + AR5523_TX_WD_TIMEOUT);
143 			ar5523_data_tx_pkt_put(ar);
144 
145 		}
146 		break;
147 
148 	case WDCMSG_TARGET_START:
149 		/* This command returns a bogus id so it needs special
150 		   handling */
151 		dlen = hdrlen - sizeof(*hdr);
152 		if (dlen != (int)sizeof(u32)) {
153 			ar5523_err(ar, "Invalid reply to WDCMSG_TARGET_START");
154 			return;
155 		}
156 		memcpy(cmd->odata, hdr + 1, sizeof(u32));
157 		cmd->olen = sizeof(u32);
158 		cmd->res = 0;
159 		complete(&cmd->done);
160 		break;
161 
162 	case WDCMSG_STATS_UPDATE:
163 		ar5523_dbg(ar, "WDCMSG_STATS_UPDATE\n");
164 		break;
165 	}
166 
167 skip:
168 	ar5523_submit_rx_cmd(ar);
169 }
170 
171 static int ar5523_alloc_rx_cmd(struct ar5523 *ar)
172 {
173 	ar->rx_cmd_urb = usb_alloc_urb(0, GFP_KERNEL);
174 	if (!ar->rx_cmd_urb)
175 		return -ENOMEM;
176 
177 	ar->rx_cmd_buf = usb_alloc_coherent(ar->dev, AR5523_MAX_RXCMDSZ,
178 					    GFP_KERNEL,
179 					    &ar->rx_cmd_urb->transfer_dma);
180 	if (!ar->rx_cmd_buf) {
181 		usb_free_urb(ar->rx_cmd_urb);
182 		return -ENOMEM;
183 	}
184 	return 0;
185 }
186 
187 static void ar5523_cancel_rx_cmd(struct ar5523 *ar)
188 {
189 	usb_kill_urb(ar->rx_cmd_urb);
190 }
191 
192 static void ar5523_free_rx_cmd(struct ar5523 *ar)
193 {
194 	usb_free_coherent(ar->dev, AR5523_MAX_RXCMDSZ,
195 			  ar->rx_cmd_buf, ar->rx_cmd_urb->transfer_dma);
196 	usb_free_urb(ar->rx_cmd_urb);
197 }
198 
199 static int ar5523_submit_rx_cmd(struct ar5523 *ar)
200 {
201 	int error;
202 
203 	usb_fill_bulk_urb(ar->rx_cmd_urb, ar->dev,
204 			  ar5523_cmd_rx_pipe(ar->dev), ar->rx_cmd_buf,
205 			  AR5523_MAX_RXCMDSZ, ar5523_cmd_rx_cb, ar);
206 	ar->rx_cmd_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
207 
208 	error = usb_submit_urb(ar->rx_cmd_urb, GFP_ATOMIC);
209 	if (error) {
210 		if (error != -ENODEV)
211 			ar5523_err(ar, "error %d when submitting rx urb\n",
212 				   error);
213 		return error;
214 	}
215 	return 0;
216 }
217 
218 /*
219  * Command submitted cb
220  */
221 static void ar5523_cmd_tx_cb(struct urb *urb)
222 {
223 	struct ar5523_tx_cmd *cmd = urb->context;
224 	struct ar5523 *ar = cmd->ar;
225 
226 	if (urb->status) {
227 		ar5523_err(ar, "Failed to TX command. Status = %d\n",
228 			   urb->status);
229 		cmd->res = urb->status;
230 		complete(&cmd->done);
231 		return;
232 	}
233 
234 	if (!(cmd->flags & AR5523_CMD_FLAG_READ)) {
235 		cmd->res = 0;
236 		complete(&cmd->done);
237 	}
238 }
239 
240 static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata,
241 		      int ilen, void *odata, int olen, int flags)
242 {
243 	struct ar5523_cmd_hdr *hdr;
244 	struct ar5523_tx_cmd *cmd = &ar->tx_cmd;
245 	int xferlen, error;
246 
247 	/* always bulk-out a multiple of 4 bytes */
248 	xferlen = (sizeof(struct ar5523_cmd_hdr) + ilen + 3) & ~3;
249 
250 	hdr = (struct ar5523_cmd_hdr *)cmd->buf_tx;
251 	memset(hdr, 0, sizeof(struct ar5523_cmd_hdr));
252 	hdr->len  = cpu_to_be32(xferlen);
253 	hdr->code = cpu_to_be32(code);
254 	hdr->priv = AR5523_CMD_ID;
255 
256 	if (flags & AR5523_CMD_FLAG_MAGIC)
257 		hdr->magic = cpu_to_be32(1 << 24);
258 	memcpy(hdr + 1, idata, ilen);
259 
260 	cmd->odata = odata;
261 	cmd->olen = olen;
262 	cmd->flags = flags;
263 
264 	ar5523_dbg(ar, "do cmd %02x\n", code);
265 
266 	usb_fill_bulk_urb(cmd->urb_tx, ar->dev, ar5523_cmd_tx_pipe(ar->dev),
267 			  cmd->buf_tx, xferlen, ar5523_cmd_tx_cb, cmd);
268 	cmd->urb_tx->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
269 
270 	error = usb_submit_urb(cmd->urb_tx, GFP_KERNEL);
271 	if (error) {
272 		ar5523_err(ar, "could not send command 0x%x, error=%d\n",
273 			   code, error);
274 		return error;
275 	}
276 
277 	if (!wait_for_completion_timeout(&cmd->done, 2 * HZ)) {
278 		cmd->odata = NULL;
279 		ar5523_err(ar, "timeout waiting for command %02x reply\n",
280 			   code);
281 		cmd->res = -ETIMEDOUT;
282 	}
283 	return cmd->res;
284 }
285 
286 static int ar5523_cmd_write(struct ar5523 *ar, u32 code, const void *data,
287 			    int len, int flags)
288 {
289 	flags &= ~AR5523_CMD_FLAG_READ;
290 	return ar5523_cmd(ar, code, data, len, NULL, 0, flags);
291 }
292 
293 static int ar5523_cmd_read(struct ar5523 *ar, u32 code, const void *idata,
294 			   int ilen, void *odata, int olen, int flags)
295 {
296 	flags |= AR5523_CMD_FLAG_READ;
297 	return ar5523_cmd(ar, code, idata, ilen, odata, olen, flags);
298 }
299 
300 static int ar5523_config(struct ar5523 *ar, u32 reg, u32 val)
301 {
302 	struct ar5523_write_mac write;
303 	int error;
304 
305 	write.reg = cpu_to_be32(reg);
306 	write.len = cpu_to_be32(0);	/* 0 = single write */
307 	*(__be32 *)write.data = cpu_to_be32(val);
308 
309 	error = ar5523_cmd_write(ar, WDCMSG_TARGET_SET_CONFIG, &write,
310 				 3 * sizeof(u32), 0);
311 	if (error != 0)
312 		ar5523_err(ar, "could not write register 0x%02x\n", reg);
313 	return error;
314 }
315 
316 static int ar5523_config_multi(struct ar5523 *ar, u32 reg, const void *data,
317 			       int len)
318 {
319 	struct ar5523_write_mac write;
320 	int error;
321 
322 	write.reg = cpu_to_be32(reg);
323 	write.len = cpu_to_be32(len);
324 	memcpy(write.data, data, len);
325 
326 	/* properly handle the case where len is zero (reset) */
327 	error = ar5523_cmd_write(ar, WDCMSG_TARGET_SET_CONFIG, &write,
328 	    (len == 0) ? sizeof(u32) : 2 * sizeof(u32) + len, 0);
329 	if (error != 0)
330 		ar5523_err(ar, "could not write %d bytes to register 0x%02x\n",
331 			   len, reg);
332 	return error;
333 }
334 
335 static int ar5523_get_status(struct ar5523 *ar, u32 which, void *odata,
336 			     int olen)
337 {
338 	int error;
339 	__be32 which_be;
340 
341 	which_be = cpu_to_be32(which);
342 	error = ar5523_cmd_read(ar, WDCMSG_TARGET_GET_STATUS,
343 	    &which_be, sizeof(which_be), odata, olen, AR5523_CMD_FLAG_MAGIC);
344 	if (error != 0)
345 		ar5523_err(ar, "could not read EEPROM offset 0x%02x\n", which);
346 	return error;
347 }
348 
349 static int ar5523_get_capability(struct ar5523 *ar, u32 cap, u32 *val)
350 {
351 	int error;
352 	__be32 cap_be, val_be;
353 
354 	cap_be = cpu_to_be32(cap);
355 	error = ar5523_cmd_read(ar, WDCMSG_TARGET_GET_CAPABILITY, &cap_be,
356 				sizeof(cap_be), &val_be, sizeof(__be32),
357 				AR5523_CMD_FLAG_MAGIC);
358 	if (error != 0) {
359 		ar5523_err(ar, "could not read capability %u\n", cap);
360 		return error;
361 	}
362 	*val = be32_to_cpu(val_be);
363 	return error;
364 }
365 
366 static int ar5523_get_devcap(struct ar5523 *ar)
367 {
368 #define	GETCAP(x) do {				\
369 	error = ar5523_get_capability(ar, x, &cap);		\
370 	if (error != 0)					\
371 		return error;				\
372 	ar5523_info(ar, "Cap: "			\
373 	    "%s=0x%08x\n", #x, cap);	\
374 } while (0)
375 	int error;
376 	u32 cap;
377 
378 	/* collect device capabilities */
379 	GETCAP(CAP_TARGET_VERSION);
380 	GETCAP(CAP_TARGET_REVISION);
381 	GETCAP(CAP_MAC_VERSION);
382 	GETCAP(CAP_MAC_REVISION);
383 	GETCAP(CAP_PHY_REVISION);
384 	GETCAP(CAP_ANALOG_5GHz_REVISION);
385 	GETCAP(CAP_ANALOG_2GHz_REVISION);
386 
387 	GETCAP(CAP_REG_DOMAIN);
388 	GETCAP(CAP_REG_CAP_BITS);
389 	GETCAP(CAP_WIRELESS_MODES);
390 	GETCAP(CAP_CHAN_SPREAD_SUPPORT);
391 	GETCAP(CAP_COMPRESS_SUPPORT);
392 	GETCAP(CAP_BURST_SUPPORT);
393 	GETCAP(CAP_FAST_FRAMES_SUPPORT);
394 	GETCAP(CAP_CHAP_TUNING_SUPPORT);
395 	GETCAP(CAP_TURBOG_SUPPORT);
396 	GETCAP(CAP_TURBO_PRIME_SUPPORT);
397 	GETCAP(CAP_DEVICE_TYPE);
398 	GETCAP(CAP_WME_SUPPORT);
399 	GETCAP(CAP_TOTAL_QUEUES);
400 	GETCAP(CAP_CONNECTION_ID_MAX);
401 
402 	GETCAP(CAP_LOW_5GHZ_CHAN);
403 	GETCAP(CAP_HIGH_5GHZ_CHAN);
404 	GETCAP(CAP_LOW_2GHZ_CHAN);
405 	GETCAP(CAP_HIGH_2GHZ_CHAN);
406 	GETCAP(CAP_TWICE_ANTENNAGAIN_5G);
407 	GETCAP(CAP_TWICE_ANTENNAGAIN_2G);
408 
409 	GETCAP(CAP_CIPHER_AES_CCM);
410 	GETCAP(CAP_CIPHER_TKIP);
411 	GETCAP(CAP_MIC_TKIP);
412 	return 0;
413 }
414 
415 static int ar5523_set_ledsteady(struct ar5523 *ar, int lednum, int ledmode)
416 {
417 	struct ar5523_cmd_ledsteady led;
418 
419 	led.lednum = cpu_to_be32(lednum);
420 	led.ledmode = cpu_to_be32(ledmode);
421 
422 	ar5523_dbg(ar, "set %s led %s (steady)\n",
423 		   (lednum == UATH_LED_LINK) ? "link" : "activity",
424 		   ledmode ? "on" : "off");
425 	return ar5523_cmd_write(ar, WDCMSG_SET_LED_STEADY, &led, sizeof(led),
426 				 0);
427 }
428 
429 static int ar5523_set_rxfilter(struct ar5523 *ar, u32 bits, u32 op)
430 {
431 	struct ar5523_cmd_rx_filter rxfilter;
432 
433 	rxfilter.bits = cpu_to_be32(bits);
434 	rxfilter.op = cpu_to_be32(op);
435 
436 	ar5523_dbg(ar, "setting Rx filter=0x%x flags=0x%x\n", bits, op);
437 	return ar5523_cmd_write(ar, WDCMSG_RX_FILTER, &rxfilter,
438 				 sizeof(rxfilter), 0);
439 }
440 
441 static int ar5523_reset_tx_queues(struct ar5523 *ar)
442 {
443 	__be32 qid = cpu_to_be32(0);
444 
445 	ar5523_dbg(ar, "resetting Tx queue\n");
446 	return ar5523_cmd_write(ar, WDCMSG_RELEASE_TX_QUEUE,
447 				 &qid, sizeof(qid), 0);
448 }
449 
450 static int ar5523_set_chan(struct ar5523 *ar)
451 {
452 	struct ieee80211_conf *conf = &ar->hw->conf;
453 
454 	struct ar5523_cmd_reset reset;
455 
456 	memset(&reset, 0, sizeof(reset));
457 	reset.flags |= cpu_to_be32(UATH_CHAN_2GHZ);
458 	reset.flags |= cpu_to_be32(UATH_CHAN_OFDM);
459 	reset.freq = cpu_to_be32(conf->chandef.chan->center_freq);
460 	reset.maxrdpower = cpu_to_be32(50);	/* XXX */
461 	reset.channelchange = cpu_to_be32(1);
462 	reset.keeprccontent = cpu_to_be32(0);
463 
464 	ar5523_dbg(ar, "set chan flags 0x%x freq %d\n",
465 		   be32_to_cpu(reset.flags),
466 		   conf->chandef.chan->center_freq);
467 	return ar5523_cmd_write(ar, WDCMSG_RESET, &reset, sizeof(reset), 0);
468 }
469 
470 static int ar5523_queue_init(struct ar5523 *ar)
471 {
472 	struct ar5523_cmd_txq_setup qinfo;
473 
474 	ar5523_dbg(ar, "setting up Tx queue\n");
475 	qinfo.qid	     = cpu_to_be32(0);
476 	qinfo.len	     = cpu_to_be32(sizeof(qinfo.attr));
477 	qinfo.attr.priority  = cpu_to_be32(0);	/* XXX */
478 	qinfo.attr.aifs	     = cpu_to_be32(3);
479 	qinfo.attr.logcwmin  = cpu_to_be32(4);
480 	qinfo.attr.logcwmax  = cpu_to_be32(10);
481 	qinfo.attr.bursttime = cpu_to_be32(0);
482 	qinfo.attr.mode	     = cpu_to_be32(0);
483 	qinfo.attr.qflags    = cpu_to_be32(1);	/* XXX? */
484 	return ar5523_cmd_write(ar, WDCMSG_SETUP_TX_QUEUE, &qinfo,
485 				 sizeof(qinfo), 0);
486 }
487 
488 static int ar5523_switch_chan(struct ar5523 *ar)
489 {
490 	int error;
491 
492 	error = ar5523_set_chan(ar);
493 	if (error) {
494 		ar5523_err(ar, "could not set chan, error %d\n", error);
495 		goto out_err;
496 	}
497 
498 	/* reset Tx rings */
499 	error = ar5523_reset_tx_queues(ar);
500 	if (error) {
501 		ar5523_err(ar, "could not reset Tx queues, error %d\n",
502 			   error);
503 		goto out_err;
504 	}
505 	/* set Tx rings WME properties */
506 	error = ar5523_queue_init(ar);
507 	if (error)
508 		ar5523_err(ar, "could not init wme, error %d\n", error);
509 
510 out_err:
511 	return error;
512 }
513 
514 static void ar5523_rx_data_put(struct ar5523 *ar,
515 				struct ar5523_rx_data *data)
516 {
517 	unsigned long flags;
518 	spin_lock_irqsave(&ar->rx_data_list_lock, flags);
519 	list_move(&data->list, &ar->rx_data_free);
520 	spin_unlock_irqrestore(&ar->rx_data_list_lock, flags);
521 }
522 
523 static void ar5523_data_rx_cb(struct urb *urb)
524 {
525 	struct ar5523_rx_data *data = urb->context;
526 	struct ar5523 *ar = data->ar;
527 	struct ar5523_rx_desc *desc;
528 	struct ar5523_chunk *chunk;
529 	struct ieee80211_hw *hw = ar->hw;
530 	struct ieee80211_rx_status *rx_status;
531 	u32 rxlen;
532 	int usblen = urb->actual_length;
533 	int hdrlen, pad;
534 
535 	ar5523_dbg(ar, "%s\n", __func__);
536 	/* sync/async unlink faults aren't errors */
537 	if (urb->status) {
538 		if (urb->status != -ESHUTDOWN)
539 			ar5523_err(ar, "%s: USB err: %d\n", __func__,
540 				   urb->status);
541 		goto skip;
542 	}
543 
544 	if (usblen < AR5523_MIN_RXBUFSZ) {
545 		ar5523_err(ar, "RX: wrong xfer size (usblen=%d)\n", usblen);
546 		goto skip;
547 	}
548 
549 	chunk = (struct ar5523_chunk *) data->skb->data;
550 
551 	if (((chunk->flags & UATH_CFLAGS_FINAL) == 0) ||
552 		chunk->seqnum != 0) {
553 		ar5523_dbg(ar, "RX: No final flag. s: %d f: %02x l: %d\n",
554 			   chunk->seqnum, chunk->flags,
555 			   be16_to_cpu(chunk->length));
556 		goto skip;
557 	}
558 
559 	/* Rx descriptor is located at the end, 32-bit aligned */
560 	desc = (struct ar5523_rx_desc *)
561 		(data->skb->data + usblen - sizeof(struct ar5523_rx_desc));
562 
563 	rxlen = be32_to_cpu(desc->len);
564 	if (rxlen > ar->rxbufsz) {
565 		ar5523_dbg(ar, "RX: Bad descriptor (len=%d)\n",
566 			   be32_to_cpu(desc->len));
567 		goto skip;
568 	}
569 
570 	if (!rxlen) {
571 		ar5523_dbg(ar, "RX: rxlen is 0\n");
572 		goto skip;
573 	}
574 
575 	if (be32_to_cpu(desc->status) != 0) {
576 		ar5523_dbg(ar, "Bad RX status (0x%x len = %d). Skip\n",
577 			   be32_to_cpu(desc->status), be32_to_cpu(desc->len));
578 		goto skip;
579 	}
580 
581 	skb_reserve(data->skb, sizeof(*chunk));
582 	skb_put(data->skb, rxlen - sizeof(struct ar5523_rx_desc));
583 
584 	hdrlen = ieee80211_get_hdrlen_from_skb(data->skb);
585 	if (!IS_ALIGNED(hdrlen, 4)) {
586 		ar5523_dbg(ar, "eek, alignment workaround activated\n");
587 		pad = ALIGN(hdrlen, 4) - hdrlen;
588 		memmove(data->skb->data + pad, data->skb->data, hdrlen);
589 		skb_pull(data->skb, pad);
590 		skb_put(data->skb, pad);
591 	}
592 
593 	rx_status = IEEE80211_SKB_RXCB(data->skb);
594 	memset(rx_status, 0, sizeof(*rx_status));
595 	rx_status->freq = be32_to_cpu(desc->channel);
596 	rx_status->band = hw->conf.chandef.chan->band;
597 	rx_status->signal = -95 + be32_to_cpu(desc->rssi);
598 
599 	ieee80211_rx_irqsafe(hw, data->skb);
600 	data->skb = NULL;
601 
602 skip:
603 	if (data->skb) {
604 		dev_kfree_skb_irq(data->skb);
605 		data->skb = NULL;
606 	}
607 
608 	ar5523_rx_data_put(ar, data);
609 	if (atomic_inc_return(&ar->rx_data_free_cnt) >=
610 	    AR5523_RX_DATA_REFILL_COUNT &&
611 	    test_bit(AR5523_HW_UP, &ar->flags))
612 		queue_work(ar->wq, &ar->rx_refill_work);
613 }
614 
615 static void ar5523_rx_refill_work(struct work_struct *work)
616 {
617 	struct ar5523 *ar = container_of(work, struct ar5523, rx_refill_work);
618 	struct ar5523_rx_data *data;
619 	unsigned long flags;
620 	int error;
621 
622 	ar5523_dbg(ar, "%s\n", __func__);
623 	do {
624 		spin_lock_irqsave(&ar->rx_data_list_lock, flags);
625 
626 		if (!list_empty(&ar->rx_data_free))
627 			data = (struct ar5523_rx_data *) ar->rx_data_free.next;
628 		else
629 			data = NULL;
630 		spin_unlock_irqrestore(&ar->rx_data_list_lock, flags);
631 
632 		if (!data)
633 			goto done;
634 
635 		data->skb = alloc_skb(ar->rxbufsz, GFP_KERNEL);
636 		if (!data->skb) {
637 			ar5523_err(ar, "could not allocate rx skbuff\n");
638 			return;
639 		}
640 
641 		usb_fill_bulk_urb(data->urb, ar->dev,
642 				  ar5523_data_rx_pipe(ar->dev), data->skb->data,
643 				  ar->rxbufsz, ar5523_data_rx_cb, data);
644 
645 		spin_lock_irqsave(&ar->rx_data_list_lock, flags);
646 		list_move(&data->list, &ar->rx_data_used);
647 		spin_unlock_irqrestore(&ar->rx_data_list_lock, flags);
648 		atomic_dec(&ar->rx_data_free_cnt);
649 
650 		error = usb_submit_urb(data->urb, GFP_KERNEL);
651 		if (error) {
652 			kfree_skb(data->skb);
653 			if (error != -ENODEV)
654 				ar5523_err(ar, "Err sending rx data urb %d\n",
655 					   error);
656 			ar5523_rx_data_put(ar, data);
657 			atomic_inc(&ar->rx_data_free_cnt);
658 			return;
659 		}
660 
661 	} while (true);
662 done:
663 	return;
664 }
665 
666 static void ar5523_cancel_rx_bufs(struct ar5523 *ar)
667 {
668 	struct ar5523_rx_data *data;
669 	unsigned long flags;
670 
671 	do {
672 		spin_lock_irqsave(&ar->rx_data_list_lock, flags);
673 		if (!list_empty(&ar->rx_data_used))
674 			data = (struct ar5523_rx_data *) ar->rx_data_used.next;
675 		else
676 			data = NULL;
677 		spin_unlock_irqrestore(&ar->rx_data_list_lock, flags);
678 
679 		if (!data)
680 			break;
681 
682 		usb_kill_urb(data->urb);
683 		list_move(&data->list, &ar->rx_data_free);
684 		atomic_inc(&ar->rx_data_free_cnt);
685 	} while (data);
686 }
687 
688 static void ar5523_free_rx_bufs(struct ar5523 *ar)
689 {
690 	struct ar5523_rx_data *data;
691 
692 	ar5523_cancel_rx_bufs(ar);
693 	while (!list_empty(&ar->rx_data_free)) {
694 		data = (struct ar5523_rx_data *) ar->rx_data_free.next;
695 		list_del(&data->list);
696 		usb_free_urb(data->urb);
697 	}
698 }
699 
700 static int ar5523_alloc_rx_bufs(struct ar5523 *ar)
701 {
702 	int i;
703 
704 	for (i = 0; i < AR5523_RX_DATA_COUNT; i++) {
705 		struct ar5523_rx_data *data = &ar->rx_data[i];
706 
707 		data->ar = ar;
708 		data->urb = usb_alloc_urb(0, GFP_KERNEL);
709 		if (!data->urb) {
710 			ar5523_err(ar, "could not allocate rx data urb\n");
711 			goto err;
712 		}
713 		list_add_tail(&data->list, &ar->rx_data_free);
714 		atomic_inc(&ar->rx_data_free_cnt);
715 	}
716 	return 0;
717 
718 err:
719 	ar5523_free_rx_bufs(ar);
720 	return -ENOMEM;
721 }
722 
723 static void ar5523_data_tx_pkt_put(struct ar5523 *ar)
724 {
725 	atomic_dec(&ar->tx_nr_total);
726 	if (!atomic_dec_return(&ar->tx_nr_pending)) {
727 		del_timer(&ar->tx_wd_timer);
728 		wake_up(&ar->tx_flush_waitq);
729 	}
730 
731 	if (atomic_read(&ar->tx_nr_total) < AR5523_TX_DATA_RESTART_COUNT) {
732 		ar5523_dbg(ar, "restart tx queue\n");
733 		ieee80211_wake_queues(ar->hw);
734 	}
735 }
736 
737 static void ar5523_data_tx_cb(struct urb *urb)
738 {
739 	struct sk_buff *skb = urb->context;
740 	struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
741 	struct ar5523_tx_data *data = (struct ar5523_tx_data *)
742 				       txi->driver_data;
743 	struct ar5523 *ar = data->ar;
744 	unsigned long flags;
745 
746 	ar5523_dbg(ar, "data tx urb completed: %d\n", urb->status);
747 
748 	spin_lock_irqsave(&ar->tx_data_list_lock, flags);
749 	list_del(&data->list);
750 	spin_unlock_irqrestore(&ar->tx_data_list_lock, flags);
751 
752 	if (urb->status) {
753 		ar5523_dbg(ar, "%s: urb status: %d\n", __func__, urb->status);
754 		ar5523_data_tx_pkt_put(ar);
755 		ieee80211_free_txskb(ar->hw, skb);
756 	} else {
757 		skb_pull(skb, sizeof(struct ar5523_tx_desc) + sizeof(__be32));
758 		ieee80211_tx_status_irqsafe(ar->hw, skb);
759 	}
760 	usb_free_urb(urb);
761 }
762 
763 static void ar5523_tx(struct ieee80211_hw *hw,
764 		       struct ieee80211_tx_control *control,
765 		       struct sk_buff *skb)
766 {
767 	struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
768 	struct ar5523_tx_data *data = (struct ar5523_tx_data *)
769 					txi->driver_data;
770 	struct ar5523 *ar = hw->priv;
771 	unsigned long flags;
772 
773 	ar5523_dbg(ar, "tx called\n");
774 	if (atomic_inc_return(&ar->tx_nr_total) >= AR5523_TX_DATA_COUNT) {
775 		ar5523_dbg(ar, "tx queue full\n");
776 		ar5523_dbg(ar, "stop queues (tot %d pend %d)\n",
777 			   atomic_read(&ar->tx_nr_total),
778 			   atomic_read(&ar->tx_nr_pending));
779 		ieee80211_stop_queues(hw);
780 	}
781 
782 	data->skb = skb;
783 
784 	spin_lock_irqsave(&ar->tx_data_list_lock, flags);
785 	list_add_tail(&data->list, &ar->tx_queue_pending);
786 	spin_unlock_irqrestore(&ar->tx_data_list_lock, flags);
787 
788 	ieee80211_queue_work(ar->hw, &ar->tx_work);
789 }
790 
791 static void ar5523_tx_work_locked(struct ar5523 *ar)
792 {
793 	struct ar5523_tx_data *data;
794 	struct ar5523_tx_desc *desc;
795 	struct ar5523_chunk *chunk;
796 	struct ieee80211_tx_info *txi;
797 	struct urb *urb;
798 	struct sk_buff *skb;
799 	int error = 0, paylen;
800 	u32 txqid;
801 	unsigned long flags;
802 
803 	BUILD_BUG_ON(sizeof(struct ar5523_tx_data) >
804 		     IEEE80211_TX_INFO_DRIVER_DATA_SIZE);
805 
806 	ar5523_dbg(ar, "%s\n", __func__);
807 	do {
808 		spin_lock_irqsave(&ar->tx_data_list_lock, flags);
809 		if (!list_empty(&ar->tx_queue_pending)) {
810 			data = (struct ar5523_tx_data *)
811 				ar->tx_queue_pending.next;
812 			list_del(&data->list);
813 		} else
814 			data = NULL;
815 		spin_unlock_irqrestore(&ar->tx_data_list_lock, flags);
816 
817 		if (!data)
818 			break;
819 
820 		skb = data->skb;
821 		txqid = 0;
822 		txi = IEEE80211_SKB_CB(skb);
823 		paylen = skb->len;
824 		urb = usb_alloc_urb(0, GFP_KERNEL);
825 		if (!urb) {
826 			ar5523_err(ar, "Failed to allocate TX urb\n");
827 			ieee80211_free_txskb(ar->hw, skb);
828 			continue;
829 		}
830 
831 		data->ar = ar;
832 		data->urb = urb;
833 
834 		desc = (struct ar5523_tx_desc *)skb_push(skb, sizeof(*desc));
835 		chunk = (struct ar5523_chunk *)skb_push(skb, sizeof(*chunk));
836 
837 		chunk->seqnum = 0;
838 		chunk->flags = UATH_CFLAGS_FINAL;
839 		chunk->length = cpu_to_be16(skb->len);
840 
841 		desc->msglen = cpu_to_be32(skb->len);
842 		desc->msgid  = AR5523_DATA_ID;
843 		desc->buflen = cpu_to_be32(paylen);
844 		desc->type   = cpu_to_be32(WDCMSG_SEND);
845 		desc->flags  = cpu_to_be32(UATH_TX_NOTIFY);
846 
847 		if (test_bit(AR5523_CONNECTED, &ar->flags))
848 			desc->connid = cpu_to_be32(AR5523_ID_BSS);
849 		else
850 			desc->connid = cpu_to_be32(AR5523_ID_BROADCAST);
851 
852 		if (txi->flags & IEEE80211_TX_CTL_USE_MINRATE)
853 			txqid |= UATH_TXQID_MINRATE;
854 
855 		desc->txqid = cpu_to_be32(txqid);
856 
857 		urb->transfer_flags = URB_ZERO_PACKET;
858 		usb_fill_bulk_urb(urb, ar->dev, ar5523_data_tx_pipe(ar->dev),
859 				  skb->data, skb->len, ar5523_data_tx_cb, skb);
860 
861 		spin_lock_irqsave(&ar->tx_data_list_lock, flags);
862 		list_add_tail(&data->list, &ar->tx_queue_submitted);
863 		spin_unlock_irqrestore(&ar->tx_data_list_lock, flags);
864 		mod_timer(&ar->tx_wd_timer, jiffies + AR5523_TX_WD_TIMEOUT);
865 		atomic_inc(&ar->tx_nr_pending);
866 
867 		ar5523_dbg(ar, "TX Frame (%d pending)\n",
868 			   atomic_read(&ar->tx_nr_pending));
869 		error = usb_submit_urb(urb, GFP_KERNEL);
870 		if (error) {
871 			ar5523_err(ar, "error %d when submitting tx urb\n",
872 				   error);
873 			spin_lock_irqsave(&ar->tx_data_list_lock, flags);
874 			list_del(&data->list);
875 			spin_unlock_irqrestore(&ar->tx_data_list_lock, flags);
876 			atomic_dec(&ar->tx_nr_pending);
877 			ar5523_data_tx_pkt_put(ar);
878 			usb_free_urb(urb);
879 			ieee80211_free_txskb(ar->hw, skb);
880 		}
881 	} while (true);
882 }
883 
884 static void ar5523_tx_work(struct work_struct *work)
885 {
886 	struct ar5523 *ar = container_of(work, struct ar5523, tx_work);
887 
888 	ar5523_dbg(ar, "%s\n", __func__);
889 	mutex_lock(&ar->mutex);
890 	ar5523_tx_work_locked(ar);
891 	mutex_unlock(&ar->mutex);
892 }
893 
894 static void ar5523_tx_wd_timer(unsigned long arg)
895 {
896 	struct ar5523 *ar = (struct ar5523 *) arg;
897 
898 	ar5523_dbg(ar, "TX watchdog timer triggered\n");
899 	ieee80211_queue_work(ar->hw, &ar->tx_wd_work);
900 }
901 
902 static void ar5523_tx_wd_work(struct work_struct *work)
903 {
904 	struct ar5523 *ar = container_of(work, struct ar5523, tx_wd_work);
905 
906 	/* Occasionally the TX queues stop responding. The only way to
907 	 * recover seems to be to reset the dongle.
908 	 */
909 
910 	mutex_lock(&ar->mutex);
911 	ar5523_err(ar, "TX queue stuck (tot %d pend %d)\n",
912 		   atomic_read(&ar->tx_nr_total),
913 		   atomic_read(&ar->tx_nr_pending));
914 
915 	ar5523_err(ar, "Will restart dongle.\n");
916 	ar5523_cmd_write(ar, WDCMSG_TARGET_RESET, NULL, 0, 0);
917 	mutex_unlock(&ar->mutex);
918 }
919 
920 static void ar5523_flush_tx(struct ar5523 *ar)
921 {
922 	ar5523_tx_work_locked(ar);
923 
924 	/* Don't waste time trying to flush if USB is disconnected */
925 	if (test_bit(AR5523_USB_DISCONNECTED, &ar->flags))
926 		return;
927 	if (!wait_event_timeout(ar->tx_flush_waitq,
928 	    !atomic_read(&ar->tx_nr_pending), AR5523_FLUSH_TIMEOUT))
929 		ar5523_err(ar, "flush timeout (tot %d pend %d)\n",
930 			   atomic_read(&ar->tx_nr_total),
931 			   atomic_read(&ar->tx_nr_pending));
932 }
933 
934 static void ar5523_free_tx_cmd(struct ar5523 *ar)
935 {
936 	struct ar5523_tx_cmd *cmd = &ar->tx_cmd;
937 
938 	usb_free_coherent(ar->dev, AR5523_MAX_RXCMDSZ, cmd->buf_tx,
939 			  cmd->urb_tx->transfer_dma);
940 	usb_free_urb(cmd->urb_tx);
941 }
942 
943 static int ar5523_alloc_tx_cmd(struct ar5523 *ar)
944 {
945 	struct ar5523_tx_cmd *cmd = &ar->tx_cmd;
946 
947 	cmd->ar = ar;
948 	init_completion(&cmd->done);
949 
950 	cmd->urb_tx = usb_alloc_urb(0, GFP_KERNEL);
951 	if (!cmd->urb_tx) {
952 		ar5523_err(ar, "could not allocate urb\n");
953 		return -ENOMEM;
954 	}
955 	cmd->buf_tx = usb_alloc_coherent(ar->dev, AR5523_MAX_TXCMDSZ,
956 					 GFP_KERNEL,
957 					 &cmd->urb_tx->transfer_dma);
958 	if (!cmd->buf_tx) {
959 		usb_free_urb(cmd->urb_tx);
960 		return -ENOMEM;
961 	}
962 	return 0;
963 }
964 
965 /*
966  * This function is called periodically (every second) when associated to
967  * query device statistics.
968  */
969 static void ar5523_stat_work(struct work_struct *work)
970 {
971 	struct ar5523 *ar = container_of(work, struct ar5523, stat_work.work);
972 	int error;
973 
974 	ar5523_dbg(ar, "%s\n", __func__);
975 	mutex_lock(&ar->mutex);
976 
977 	/*
978 	 * Send request for statistics asynchronously once a second. This
979 	 * seems to be important. Throughput is a lot better if this is done.
980 	 */
981 	error = ar5523_cmd_write(ar, WDCMSG_TARGET_GET_STATS, NULL, 0, 0);
982 	if (error)
983 		ar5523_err(ar, "could not query stats, error %d\n", error);
984 	mutex_unlock(&ar->mutex);
985 	ieee80211_queue_delayed_work(ar->hw, &ar->stat_work, HZ);
986 }
987 
988 /*
989  * Interface routines to the mac80211 stack.
990  */
991 static int ar5523_start(struct ieee80211_hw *hw)
992 {
993 	struct ar5523 *ar = hw->priv;
994 	int error;
995 	__be32 val;
996 
997 	ar5523_dbg(ar, "start called\n");
998 
999 	mutex_lock(&ar->mutex);
1000 	val = cpu_to_be32(0);
1001 	ar5523_cmd_write(ar, WDCMSG_BIND, &val, sizeof(val), 0);
1002 
1003 	/* set MAC address */
1004 	ar5523_config_multi(ar, CFG_MAC_ADDR, &ar->hw->wiphy->perm_addr,
1005 			    ETH_ALEN);
1006 
1007 	/* XXX honor net80211 state */
1008 	ar5523_config(ar, CFG_RATE_CONTROL_ENABLE, 0x00000001);
1009 	ar5523_config(ar, CFG_DIVERSITY_CTL, 0x00000001);
1010 	ar5523_config(ar, CFG_ABOLT, 0x0000003f);
1011 	ar5523_config(ar, CFG_WME_ENABLED, 0x00000000);
1012 
1013 	ar5523_config(ar, CFG_SERVICE_TYPE, 1);
1014 	ar5523_config(ar, CFG_TP_SCALE, 0x00000000);
1015 	ar5523_config(ar, CFG_TPC_HALF_DBM5, 0x0000003c);
1016 	ar5523_config(ar, CFG_TPC_HALF_DBM2, 0x0000003c);
1017 	ar5523_config(ar, CFG_OVERRD_TX_POWER, 0x00000000);
1018 	ar5523_config(ar, CFG_GMODE_PROTECTION, 0x00000000);
1019 	ar5523_config(ar, CFG_GMODE_PROTECT_RATE_INDEX, 0x00000003);
1020 	ar5523_config(ar, CFG_PROTECTION_TYPE, 0x00000000);
1021 	ar5523_config(ar, CFG_MODE_CTS, 0x00000002);
1022 
1023 	error = ar5523_cmd_read(ar, WDCMSG_TARGET_START, NULL, 0,
1024 	    &val, sizeof(val), AR5523_CMD_FLAG_MAGIC);
1025 	if (error) {
1026 		ar5523_dbg(ar, "could not start target, error %d\n", error);
1027 		goto err;
1028 	}
1029 	ar5523_dbg(ar, "WDCMSG_TARGET_START returns handle: 0x%x\n",
1030 		   be32_to_cpu(val));
1031 
1032 	ar5523_switch_chan(ar);
1033 
1034 	val = cpu_to_be32(TARGET_DEVICE_AWAKE);
1035 	ar5523_cmd_write(ar, WDCMSG_SET_PWR_MODE, &val, sizeof(val), 0);
1036 	/* XXX? check */
1037 	ar5523_cmd_write(ar, WDCMSG_RESET_KEY_CACHE, NULL, 0, 0);
1038 
1039 	set_bit(AR5523_HW_UP, &ar->flags);
1040 	queue_work(ar->wq, &ar->rx_refill_work);
1041 
1042 	/* enable Rx */
1043 	ar5523_set_rxfilter(ar, 0, UATH_FILTER_OP_INIT);
1044 	ar5523_set_rxfilter(ar,
1045 			    UATH_FILTER_RX_UCAST | UATH_FILTER_RX_MCAST |
1046 			    UATH_FILTER_RX_BCAST | UATH_FILTER_RX_BEACON,
1047 			    UATH_FILTER_OP_SET);
1048 
1049 	ar5523_set_ledsteady(ar, UATH_LED_ACTIVITY, UATH_LED_ON);
1050 	ar5523_dbg(ar, "start OK\n");
1051 
1052 err:
1053 	mutex_unlock(&ar->mutex);
1054 	return error;
1055 }
1056 
1057 static void ar5523_stop(struct ieee80211_hw *hw)
1058 {
1059 	struct ar5523 *ar = hw->priv;
1060 
1061 	ar5523_dbg(ar, "stop called\n");
1062 
1063 	cancel_delayed_work_sync(&ar->stat_work);
1064 	mutex_lock(&ar->mutex);
1065 	clear_bit(AR5523_HW_UP, &ar->flags);
1066 
1067 	ar5523_set_ledsteady(ar, UATH_LED_LINK, UATH_LED_OFF);
1068 	ar5523_set_ledsteady(ar, UATH_LED_ACTIVITY, UATH_LED_OFF);
1069 
1070 	ar5523_cmd_write(ar, WDCMSG_TARGET_STOP, NULL, 0, 0);
1071 
1072 	del_timer_sync(&ar->tx_wd_timer);
1073 	cancel_work_sync(&ar->tx_wd_work);
1074 	cancel_work_sync(&ar->rx_refill_work);
1075 	ar5523_cancel_rx_bufs(ar);
1076 	mutex_unlock(&ar->mutex);
1077 }
1078 
1079 static int ar5523_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
1080 {
1081 	struct ar5523 *ar = hw->priv;
1082 	int ret;
1083 
1084 	ar5523_dbg(ar, "set_rts_threshold called\n");
1085 	mutex_lock(&ar->mutex);
1086 
1087 	ret = ar5523_config(ar, CFG_USER_RTS_THRESHOLD, value);
1088 
1089 	mutex_unlock(&ar->mutex);
1090 	return ret;
1091 }
1092 
1093 static void ar5523_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
1094 {
1095 	struct ar5523 *ar = hw->priv;
1096 
1097 	ar5523_dbg(ar, "flush called\n");
1098 	ar5523_flush_tx(ar);
1099 }
1100 
1101 static int ar5523_add_interface(struct ieee80211_hw *hw,
1102 				struct ieee80211_vif *vif)
1103 {
1104 	struct ar5523 *ar = hw->priv;
1105 
1106 	ar5523_dbg(ar, "add interface called\n");
1107 
1108 	if (ar->vif) {
1109 		ar5523_dbg(ar, "invalid add_interface\n");
1110 		return -EOPNOTSUPP;
1111 	}
1112 
1113 	switch (vif->type) {
1114 	case NL80211_IFTYPE_STATION:
1115 		ar->vif = vif;
1116 		break;
1117 	default:
1118 		return -EOPNOTSUPP;
1119 	}
1120 	return 0;
1121 }
1122 
1123 static void ar5523_remove_interface(struct ieee80211_hw *hw,
1124 				    struct ieee80211_vif *vif)
1125 {
1126 	struct ar5523 *ar = hw->priv;
1127 
1128 	ar5523_dbg(ar, "remove interface called\n");
1129 	ar->vif = NULL;
1130 }
1131 
1132 static int ar5523_hwconfig(struct ieee80211_hw *hw, u32 changed)
1133 {
1134 	struct ar5523 *ar = hw->priv;
1135 
1136 	ar5523_dbg(ar, "config called\n");
1137 	mutex_lock(&ar->mutex);
1138 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
1139 		ar5523_dbg(ar, "Do channel switch\n");
1140 		ar5523_flush_tx(ar);
1141 		ar5523_switch_chan(ar);
1142 	}
1143 	mutex_unlock(&ar->mutex);
1144 	return 0;
1145 }
1146 
1147 static int ar5523_get_wlan_mode(struct ar5523 *ar,
1148 				struct ieee80211_bss_conf *bss_conf)
1149 {
1150 	struct ieee80211_supported_band *band;
1151 	int bit;
1152 	struct ieee80211_sta *sta;
1153 	u32 sta_rate_set;
1154 
1155 	band = ar->hw->wiphy->bands[ar->hw->conf.chandef.chan->band];
1156 	sta = ieee80211_find_sta(ar->vif, bss_conf->bssid);
1157 	if (!sta) {
1158 		ar5523_info(ar, "STA not found!\n");
1159 		return WLAN_MODE_11b;
1160 	}
1161 	sta_rate_set = sta->supp_rates[ar->hw->conf.chandef.chan->band];
1162 
1163 	for (bit = 0; bit < band->n_bitrates; bit++) {
1164 		if (sta_rate_set & 1) {
1165 			int rate = band->bitrates[bit].bitrate;
1166 			switch (rate) {
1167 			case 60:
1168 			case 90:
1169 			case 120:
1170 			case 180:
1171 			case 240:
1172 			case 360:
1173 			case 480:
1174 			case 540:
1175 				return WLAN_MODE_11g;
1176 			}
1177 		}
1178 		sta_rate_set >>= 1;
1179 	}
1180 	return WLAN_MODE_11b;
1181 }
1182 
1183 static void ar5523_create_rateset(struct ar5523 *ar,
1184 				  struct ieee80211_bss_conf *bss_conf,
1185 				  struct ar5523_cmd_rateset *rs,
1186 				  bool basic)
1187 {
1188 	struct ieee80211_supported_band *band;
1189 	struct ieee80211_sta *sta;
1190 	int bit, i = 0;
1191 	u32 sta_rate_set, basic_rate_set;
1192 
1193 	sta = ieee80211_find_sta(ar->vif, bss_conf->bssid);
1194 	basic_rate_set = bss_conf->basic_rates;
1195 	if (!sta) {
1196 		ar5523_info(ar, "STA not found. Cannot set rates\n");
1197 		sta_rate_set = bss_conf->basic_rates;
1198 	} else
1199 		sta_rate_set = sta->supp_rates[ar->hw->conf.chandef.chan->band];
1200 
1201 	ar5523_dbg(ar, "sta rate_set = %08x\n", sta_rate_set);
1202 
1203 	band = ar->hw->wiphy->bands[ar->hw->conf.chandef.chan->band];
1204 	for (bit = 0; bit < band->n_bitrates; bit++) {
1205 		BUG_ON(i >= AR5523_MAX_NRATES);
1206 		ar5523_dbg(ar, "Considering rate %d : %d\n",
1207 			   band->bitrates[bit].hw_value, sta_rate_set & 1);
1208 		if (sta_rate_set & 1) {
1209 			rs->set[i] = band->bitrates[bit].hw_value;
1210 			if (basic_rate_set & 1 && basic)
1211 				rs->set[i] |= 0x80;
1212 			i++;
1213 		}
1214 		sta_rate_set >>= 1;
1215 		basic_rate_set >>= 1;
1216 	}
1217 
1218 	rs->length = i;
1219 }
1220 
1221 static int ar5523_set_basic_rates(struct ar5523 *ar,
1222 				  struct ieee80211_bss_conf *bss)
1223 {
1224 	struct ar5523_cmd_rates rates;
1225 
1226 	memset(&rates, 0, sizeof(rates));
1227 	rates.connid = cpu_to_be32(2);		/* XXX */
1228 	rates.size   = cpu_to_be32(sizeof(struct ar5523_cmd_rateset));
1229 	ar5523_create_rateset(ar, bss, &rates.rateset, true);
1230 
1231 	return ar5523_cmd_write(ar, WDCMSG_SET_BASIC_RATE, &rates,
1232 				sizeof(rates), 0);
1233 }
1234 
1235 static int ar5523_create_connection(struct ar5523 *ar,
1236 				    struct ieee80211_vif *vif,
1237 				    struct ieee80211_bss_conf *bss)
1238 {
1239 	struct ar5523_cmd_create_connection create;
1240 	int wlan_mode;
1241 
1242 	memset(&create, 0, sizeof(create));
1243 	create.connid = cpu_to_be32(2);
1244 	create.bssid = cpu_to_be32(0);
1245 	/* XXX packed or not?  */
1246 	create.size = cpu_to_be32(sizeof(struct ar5523_cmd_rateset));
1247 
1248 	ar5523_create_rateset(ar, bss, &create.connattr.rateset, false);
1249 
1250 	wlan_mode = ar5523_get_wlan_mode(ar, bss);
1251 	create.connattr.wlanmode = cpu_to_be32(wlan_mode);
1252 
1253 	return ar5523_cmd_write(ar, WDCMSG_CREATE_CONNECTION, &create,
1254 				sizeof(create), 0);
1255 }
1256 
1257 static int ar5523_write_associd(struct ar5523 *ar,
1258 				struct ieee80211_bss_conf *bss)
1259 {
1260 	struct ar5523_cmd_set_associd associd;
1261 
1262 	memset(&associd, 0, sizeof(associd));
1263 	associd.defaultrateix = cpu_to_be32(0);	/* XXX */
1264 	associd.associd = cpu_to_be32(bss->aid);
1265 	associd.timoffset = cpu_to_be32(0x3b);	/* XXX */
1266 	memcpy(associd.bssid, bss->bssid, ETH_ALEN);
1267 	return ar5523_cmd_write(ar, WDCMSG_WRITE_ASSOCID, &associd,
1268 				sizeof(associd), 0);
1269 }
1270 
1271 static void ar5523_bss_info_changed(struct ieee80211_hw *hw,
1272 				    struct ieee80211_vif *vif,
1273 				    struct ieee80211_bss_conf *bss,
1274 				    u32 changed)
1275 {
1276 	struct ar5523 *ar = hw->priv;
1277 	int error;
1278 
1279 	ar5523_dbg(ar, "bss_info_changed called\n");
1280 	mutex_lock(&ar->mutex);
1281 
1282 	if (!(changed & BSS_CHANGED_ASSOC))
1283 		goto out_unlock;
1284 
1285 	if (bss->assoc) {
1286 		error = ar5523_create_connection(ar, vif, bss);
1287 		if (error) {
1288 			ar5523_err(ar, "could not create connection\n");
1289 			goto out_unlock;
1290 		}
1291 
1292 		error = ar5523_set_basic_rates(ar, bss);
1293 		if (error) {
1294 			ar5523_err(ar, "could not set negotiated rate set\n");
1295 			goto out_unlock;
1296 		}
1297 
1298 		error = ar5523_write_associd(ar, bss);
1299 		if (error) {
1300 			ar5523_err(ar, "could not set association\n");
1301 			goto out_unlock;
1302 		}
1303 
1304 		/* turn link LED on */
1305 		ar5523_set_ledsteady(ar, UATH_LED_LINK, UATH_LED_ON);
1306 		set_bit(AR5523_CONNECTED, &ar->flags);
1307 		ieee80211_queue_delayed_work(hw, &ar->stat_work, HZ);
1308 
1309 	} else {
1310 		cancel_delayed_work(&ar->stat_work);
1311 		clear_bit(AR5523_CONNECTED, &ar->flags);
1312 		ar5523_set_ledsteady(ar, UATH_LED_LINK, UATH_LED_OFF);
1313 	}
1314 
1315 out_unlock:
1316 	mutex_unlock(&ar->mutex);
1317 
1318 }
1319 
1320 #define AR5523_SUPPORTED_FILTERS (FIF_PROMISC_IN_BSS | \
1321 				  FIF_ALLMULTI | \
1322 				  FIF_FCSFAIL | \
1323 				  FIF_OTHER_BSS)
1324 
1325 static void ar5523_configure_filter(struct ieee80211_hw *hw,
1326 				    unsigned int changed_flags,
1327 				    unsigned int *total_flags,
1328 				    u64 multicast)
1329 {
1330 	struct ar5523 *ar = hw->priv;
1331 	u32 filter = 0;
1332 
1333 	ar5523_dbg(ar, "configure_filter called\n");
1334 	mutex_lock(&ar->mutex);
1335 	ar5523_flush_tx(ar);
1336 
1337 	*total_flags &= AR5523_SUPPORTED_FILTERS;
1338 
1339 	/* The filters seems strange. UATH_FILTER_RX_BCAST and
1340 	 * UATH_FILTER_RX_MCAST does not result in those frames being RXed.
1341 	 * The only way I have found to get [mb]cast frames seems to be
1342 	 * to set UATH_FILTER_RX_PROM. */
1343 	filter |= UATH_FILTER_RX_UCAST | UATH_FILTER_RX_MCAST |
1344 		  UATH_FILTER_RX_BCAST | UATH_FILTER_RX_BEACON |
1345 		  UATH_FILTER_RX_PROM;
1346 
1347 	ar5523_set_rxfilter(ar, 0, UATH_FILTER_OP_INIT);
1348 	ar5523_set_rxfilter(ar, filter, UATH_FILTER_OP_SET);
1349 
1350 	mutex_unlock(&ar->mutex);
1351 }
1352 
1353 static const struct ieee80211_ops ar5523_ops = {
1354 	.start			= ar5523_start,
1355 	.stop			= ar5523_stop,
1356 	.tx			= ar5523_tx,
1357 	.set_rts_threshold	= ar5523_set_rts_threshold,
1358 	.add_interface		= ar5523_add_interface,
1359 	.remove_interface	= ar5523_remove_interface,
1360 	.config			= ar5523_hwconfig,
1361 	.bss_info_changed	= ar5523_bss_info_changed,
1362 	.configure_filter	= ar5523_configure_filter,
1363 	.flush			= ar5523_flush,
1364 };
1365 
1366 static int ar5523_host_available(struct ar5523 *ar)
1367 {
1368 	struct ar5523_cmd_host_available setup;
1369 
1370 	/* inform target the host is available */
1371 	setup.sw_ver_major = cpu_to_be32(ATH_SW_VER_MAJOR);
1372 	setup.sw_ver_minor = cpu_to_be32(ATH_SW_VER_MINOR);
1373 	setup.sw_ver_patch = cpu_to_be32(ATH_SW_VER_PATCH);
1374 	setup.sw_ver_build = cpu_to_be32(ATH_SW_VER_BUILD);
1375 	return ar5523_cmd_read(ar, WDCMSG_HOST_AVAILABLE,
1376 			       &setup, sizeof(setup), NULL, 0, 0);
1377 }
1378 
1379 static int ar5523_get_devstatus(struct ar5523 *ar)
1380 {
1381 	u8 macaddr[ETH_ALEN];
1382 	int error;
1383 
1384 	/* retrieve MAC address */
1385 	error = ar5523_get_status(ar, ST_MAC_ADDR, macaddr, ETH_ALEN);
1386 	if (error) {
1387 		ar5523_err(ar, "could not read MAC address\n");
1388 		return error;
1389 	}
1390 
1391 	SET_IEEE80211_PERM_ADDR(ar->hw, macaddr);
1392 
1393 	error = ar5523_get_status(ar, ST_SERIAL_NUMBER,
1394 	    &ar->serial[0], sizeof(ar->serial));
1395 	if (error) {
1396 		ar5523_err(ar, "could not read device serial number\n");
1397 		return error;
1398 	}
1399 	return 0;
1400 }
1401 
1402 #define AR5523_SANE_RXBUFSZ 2000
1403 
1404 static int ar5523_get_max_rxsz(struct ar5523 *ar)
1405 {
1406 	int error;
1407 	__be32 rxsize;
1408 
1409 	/* Get max rx size */
1410 	error = ar5523_get_status(ar, ST_WDC_TRANSPORT_CHUNK_SIZE, &rxsize,
1411 				  sizeof(rxsize));
1412 	if (error != 0) {
1413 		ar5523_err(ar, "could not read max RX size\n");
1414 		return error;
1415 	}
1416 
1417 	ar->rxbufsz = be32_to_cpu(rxsize);
1418 
1419 	if (!ar->rxbufsz || ar->rxbufsz > AR5523_SANE_RXBUFSZ) {
1420 		ar5523_err(ar, "Bad rxbufsz from device. Using %d instead\n",
1421 			   AR5523_SANE_RXBUFSZ);
1422 		ar->rxbufsz = AR5523_SANE_RXBUFSZ;
1423 	}
1424 
1425 	ar5523_dbg(ar, "Max RX buf size: %d\n", ar->rxbufsz);
1426 	return 0;
1427 }
1428 
1429 /*
1430  * This is copied from rtl818x, but we should probably move this
1431  * to common code as in OpenBSD.
1432  */
1433 static const struct ieee80211_rate ar5523_rates[] = {
1434 	{ .bitrate = 10, .hw_value = 2, },
1435 	{ .bitrate = 20, .hw_value = 4 },
1436 	{ .bitrate = 55, .hw_value = 11, },
1437 	{ .bitrate = 110, .hw_value = 22, },
1438 	{ .bitrate = 60, .hw_value = 12, },
1439 	{ .bitrate = 90, .hw_value = 18, },
1440 	{ .bitrate = 120, .hw_value = 24, },
1441 	{ .bitrate = 180, .hw_value = 36, },
1442 	{ .bitrate = 240, .hw_value = 48, },
1443 	{ .bitrate = 360, .hw_value = 72, },
1444 	{ .bitrate = 480, .hw_value = 96, },
1445 	{ .bitrate = 540, .hw_value = 108, },
1446 };
1447 
1448 static const struct ieee80211_channel ar5523_channels[] = {
1449 	{ .center_freq = 2412 },
1450 	{ .center_freq = 2417 },
1451 	{ .center_freq = 2422 },
1452 	{ .center_freq = 2427 },
1453 	{ .center_freq = 2432 },
1454 	{ .center_freq = 2437 },
1455 	{ .center_freq = 2442 },
1456 	{ .center_freq = 2447 },
1457 	{ .center_freq = 2452 },
1458 	{ .center_freq = 2457 },
1459 	{ .center_freq = 2462 },
1460 	{ .center_freq = 2467 },
1461 	{ .center_freq = 2472 },
1462 	{ .center_freq = 2484 },
1463 };
1464 
1465 static int ar5523_init_modes(struct ar5523 *ar)
1466 {
1467 	BUILD_BUG_ON(sizeof(ar->channels) != sizeof(ar5523_channels));
1468 	BUILD_BUG_ON(sizeof(ar->rates) != sizeof(ar5523_rates));
1469 
1470 	memcpy(ar->channels, ar5523_channels, sizeof(ar5523_channels));
1471 	memcpy(ar->rates, ar5523_rates, sizeof(ar5523_rates));
1472 
1473 	ar->band.band = IEEE80211_BAND_2GHZ;
1474 	ar->band.channels = ar->channels;
1475 	ar->band.n_channels = ARRAY_SIZE(ar5523_channels);
1476 	ar->band.bitrates = ar->rates;
1477 	ar->band.n_bitrates = ARRAY_SIZE(ar5523_rates);
1478 	ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar->band;
1479 	return 0;
1480 }
1481 
1482 /*
1483  * Load the MIPS R4000 microcode into the device.  Once the image is loaded,
1484  * the device will detach itself from the bus and reattach later with a new
1485  * product Id (a la ezusb).
1486  */
1487 static int ar5523_load_firmware(struct usb_device *dev)
1488 {
1489 	struct ar5523_fwblock *txblock, *rxblock;
1490 	const struct firmware *fw;
1491 	void *fwbuf;
1492 	int len, offset;
1493 	int foolen; /* XXX(hch): handle short transfers */
1494 	int error = -ENXIO;
1495 
1496 	if (request_firmware(&fw, AR5523_FIRMWARE_FILE, &dev->dev)) {
1497 		dev_err(&dev->dev, "no firmware found: %s\n",
1498 			AR5523_FIRMWARE_FILE);
1499 		return -ENOENT;
1500 	}
1501 
1502 	txblock = kmalloc(sizeof(*txblock), GFP_KERNEL);
1503 	if (!txblock)
1504 		goto out;
1505 
1506 	rxblock = kmalloc(sizeof(*rxblock), GFP_KERNEL);
1507 	if (!rxblock)
1508 		goto out_free_txblock;
1509 
1510 	fwbuf = kmalloc(AR5523_MAX_FWBLOCK_SIZE, GFP_KERNEL);
1511 	if (!fwbuf)
1512 		goto out_free_rxblock;
1513 
1514 	memset(txblock, 0, sizeof(struct ar5523_fwblock));
1515 	txblock->flags = cpu_to_be32(AR5523_WRITE_BLOCK);
1516 	txblock->total = cpu_to_be32(fw->size);
1517 
1518 	offset = 0;
1519 	len = fw->size;
1520 	while (len > 0) {
1521 		int mlen = min(len, AR5523_MAX_FWBLOCK_SIZE);
1522 
1523 		txblock->remain = cpu_to_be32(len - mlen);
1524 		txblock->len = cpu_to_be32(mlen);
1525 
1526 		/* send firmware block meta-data */
1527 		error = usb_bulk_msg(dev, ar5523_cmd_tx_pipe(dev),
1528 				     txblock, sizeof(*txblock), &foolen,
1529 				     AR5523_CMD_TIMEOUT);
1530 		if (error) {
1531 			dev_err(&dev->dev,
1532 				"could not send firmware block info\n");
1533 			goto out_free_fwbuf;
1534 		}
1535 
1536 		/* send firmware block data */
1537 		memcpy(fwbuf, fw->data + offset, mlen);
1538 		error = usb_bulk_msg(dev, ar5523_data_tx_pipe(dev),
1539 				     fwbuf, mlen, &foolen,
1540 				     AR5523_DATA_TIMEOUT);
1541 		if (error) {
1542 			dev_err(&dev->dev,
1543 				"could not send firmware block data\n");
1544 			goto out_free_fwbuf;
1545 		}
1546 
1547 		/* wait for ack from firmware */
1548 		error = usb_bulk_msg(dev, ar5523_cmd_rx_pipe(dev),
1549 				     rxblock, sizeof(*rxblock), &foolen,
1550 				     AR5523_CMD_TIMEOUT);
1551 		if (error) {
1552 			dev_err(&dev->dev,
1553 				"could not read firmware answer\n");
1554 			goto out_free_fwbuf;
1555 		}
1556 
1557 		len -= mlen;
1558 		offset += mlen;
1559 	}
1560 
1561 	/*
1562 	 * Set the error to -ENXIO to make sure we continue probing for
1563 	 * a driver.
1564 	 */
1565 	error = -ENXIO;
1566 
1567  out_free_fwbuf:
1568 	kfree(fwbuf);
1569  out_free_rxblock:
1570 	kfree(rxblock);
1571  out_free_txblock:
1572 	kfree(txblock);
1573  out:
1574 	release_firmware(fw);
1575 	return error;
1576 }
1577 
1578 static int ar5523_probe(struct usb_interface *intf,
1579 			const struct usb_device_id *id)
1580 {
1581 	struct usb_device *dev = interface_to_usbdev(intf);
1582 	struct ieee80211_hw *hw;
1583 	struct ar5523 *ar;
1584 	int error = -ENOMEM;
1585 
1586 	/*
1587 	 * Load firmware if the device requires it.  This will return
1588 	 * -ENXIO on success and we'll get called back afer the usb
1589 	 * id changes to indicate that the firmware is present.
1590 	 */
1591 	if (id->driver_info & AR5523_FLAG_PRE_FIRMWARE)
1592 		return ar5523_load_firmware(dev);
1593 
1594 
1595 	hw = ieee80211_alloc_hw(sizeof(*ar), &ar5523_ops);
1596 	if (!hw)
1597 		goto out;
1598 	SET_IEEE80211_DEV(hw, &intf->dev);
1599 
1600 	ar = hw->priv;
1601 	ar->hw = hw;
1602 	ar->dev = dev;
1603 	mutex_init(&ar->mutex);
1604 
1605 	INIT_DELAYED_WORK(&ar->stat_work, ar5523_stat_work);
1606 	init_timer(&ar->tx_wd_timer);
1607 	setup_timer(&ar->tx_wd_timer, ar5523_tx_wd_timer, (unsigned long) ar);
1608 	INIT_WORK(&ar->tx_wd_work, ar5523_tx_wd_work);
1609 	INIT_WORK(&ar->tx_work, ar5523_tx_work);
1610 	INIT_LIST_HEAD(&ar->tx_queue_pending);
1611 	INIT_LIST_HEAD(&ar->tx_queue_submitted);
1612 	spin_lock_init(&ar->tx_data_list_lock);
1613 	atomic_set(&ar->tx_nr_total, 0);
1614 	atomic_set(&ar->tx_nr_pending, 0);
1615 	init_waitqueue_head(&ar->tx_flush_waitq);
1616 
1617 	atomic_set(&ar->rx_data_free_cnt, 0);
1618 	INIT_WORK(&ar->rx_refill_work, ar5523_rx_refill_work);
1619 	INIT_LIST_HEAD(&ar->rx_data_free);
1620 	INIT_LIST_HEAD(&ar->rx_data_used);
1621 	spin_lock_init(&ar->rx_data_list_lock);
1622 
1623 	ar->wq = create_singlethread_workqueue("ar5523");
1624 	if (!ar->wq) {
1625 		ar5523_err(ar, "Could not create wq\n");
1626 		goto out_free_ar;
1627 	}
1628 
1629 	error = ar5523_alloc_rx_bufs(ar);
1630 	if (error) {
1631 		ar5523_err(ar, "Could not allocate rx buffers\n");
1632 		goto out_free_wq;
1633 	}
1634 
1635 	error = ar5523_alloc_rx_cmd(ar);
1636 	if (error) {
1637 		ar5523_err(ar, "Could not allocate rx command buffers\n");
1638 		goto out_free_rx_bufs;
1639 	}
1640 
1641 	error = ar5523_alloc_tx_cmd(ar);
1642 	if (error) {
1643 		ar5523_err(ar, "Could not allocate tx command buffers\n");
1644 		goto out_free_rx_cmd;
1645 	}
1646 
1647 	error = ar5523_submit_rx_cmd(ar);
1648 	if (error) {
1649 		ar5523_err(ar, "Failed to submit rx cmd\n");
1650 		goto out_free_tx_cmd;
1651 	}
1652 
1653 	/*
1654 	 * We're now ready to send/receive firmware commands.
1655 	 */
1656 	error = ar5523_host_available(ar);
1657 	if (error) {
1658 		ar5523_err(ar, "could not initialize adapter\n");
1659 		goto out_cancel_rx_cmd;
1660 	}
1661 
1662 	error = ar5523_get_max_rxsz(ar);
1663 	if (error) {
1664 		ar5523_err(ar, "could not get caps from adapter\n");
1665 		goto out_cancel_rx_cmd;
1666 	}
1667 
1668 	error = ar5523_get_devcap(ar);
1669 	if (error) {
1670 		ar5523_err(ar, "could not get caps from adapter\n");
1671 		goto out_cancel_rx_cmd;
1672 	}
1673 
1674 	error = ar5523_get_devstatus(ar);
1675 	if (error != 0) {
1676 		ar5523_err(ar, "could not get device status\n");
1677 		goto out_cancel_rx_cmd;
1678 	}
1679 
1680 	ar5523_info(ar, "MAC/BBP AR5523, RF AR%c112\n",
1681 			(id->driver_info & AR5523_FLAG_ABG) ? '5' : '2');
1682 
1683 	ar->vif = NULL;
1684 	hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
1685 		    IEEE80211_HW_SIGNAL_DBM |
1686 		    IEEE80211_HW_HAS_RATE_CONTROL;
1687 	hw->extra_tx_headroom = sizeof(struct ar5523_tx_desc) +
1688 				sizeof(struct ar5523_chunk);
1689 	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
1690 	hw->queues = 1;
1691 
1692 	error = ar5523_init_modes(ar);
1693 	if (error)
1694 		goto out_cancel_rx_cmd;
1695 
1696 	usb_set_intfdata(intf, hw);
1697 
1698 	error = ieee80211_register_hw(hw);
1699 	if (error) {
1700 		ar5523_err(ar, "could not register device\n");
1701 		goto out_cancel_rx_cmd;
1702 	}
1703 
1704 	ar5523_info(ar, "Found and initialized AR5523 device\n");
1705 	return 0;
1706 
1707 out_cancel_rx_cmd:
1708 	ar5523_cancel_rx_cmd(ar);
1709 out_free_tx_cmd:
1710 	ar5523_free_tx_cmd(ar);
1711 out_free_rx_cmd:
1712 	ar5523_free_rx_cmd(ar);
1713 out_free_rx_bufs:
1714 	ar5523_free_rx_bufs(ar);
1715 out_free_wq:
1716 	destroy_workqueue(ar->wq);
1717 out_free_ar:
1718 	ieee80211_free_hw(hw);
1719 out:
1720 	return error;
1721 }
1722 
1723 static void ar5523_disconnect(struct usb_interface *intf)
1724 {
1725 	struct ieee80211_hw *hw = usb_get_intfdata(intf);
1726 	struct ar5523 *ar = hw->priv;
1727 
1728 	ar5523_dbg(ar, "detaching\n");
1729 	set_bit(AR5523_USB_DISCONNECTED, &ar->flags);
1730 
1731 	ieee80211_unregister_hw(hw);
1732 
1733 	ar5523_cancel_rx_cmd(ar);
1734 	ar5523_free_tx_cmd(ar);
1735 	ar5523_free_rx_cmd(ar);
1736 	ar5523_free_rx_bufs(ar);
1737 
1738 	destroy_workqueue(ar->wq);
1739 
1740 	ieee80211_free_hw(hw);
1741 	usb_set_intfdata(intf, NULL);
1742 }
1743 
1744 #define AR5523_DEVICE_UG(vendor, device) \
1745 	{ USB_DEVICE((vendor), (device)) }, \
1746 	{ USB_DEVICE((vendor), (device) + 1), \
1747 		.driver_info = AR5523_FLAG_PRE_FIRMWARE }
1748 #define AR5523_DEVICE_UX(vendor, device) \
1749 	{ USB_DEVICE((vendor), (device)), \
1750 		.driver_info = AR5523_FLAG_ABG }, \
1751 	{ USB_DEVICE((vendor), (device) + 1), \
1752 		.driver_info = AR5523_FLAG_ABG|AR5523_FLAG_PRE_FIRMWARE }
1753 
1754 static struct usb_device_id ar5523_id_table[] = {
1755 	AR5523_DEVICE_UG(0x168c, 0x0001),	/* Atheros / AR5523 */
1756 	AR5523_DEVICE_UG(0x0cf3, 0x0001),	/* Atheros2 / AR5523_1 */
1757 	AR5523_DEVICE_UG(0x0cf3, 0x0003),	/* Atheros2 / AR5523_2 */
1758 	AR5523_DEVICE_UX(0x0cf3, 0x0005),	/* Atheros2 / AR5523_3 */
1759 	AR5523_DEVICE_UG(0x0d8e, 0x7801),	/* Conceptronic / AR5523_1 */
1760 	AR5523_DEVICE_UX(0x0d8e, 0x7811),	/* Conceptronic / AR5523_2 */
1761 	AR5523_DEVICE_UX(0x2001, 0x3a00),	/* Dlink / DWLAG132 */
1762 	AR5523_DEVICE_UG(0x2001, 0x3a02),	/* Dlink / DWLG132 */
1763 	AR5523_DEVICE_UX(0x2001, 0x3a04),	/* Dlink / DWLAG122 */
1764 	AR5523_DEVICE_UG(0x07d1, 0x3a07),	/* D-Link / WUA-2340 rev A1 */
1765 	AR5523_DEVICE_UG(0x1690, 0x0712),	/* Gigaset / AR5523 */
1766 	AR5523_DEVICE_UG(0x1690, 0x0710),	/* Gigaset / SMCWUSBTG */
1767 	AR5523_DEVICE_UG(0x129b, 0x160b),	/* Gigaset / USB stick 108
1768 						   (CyberTAN Technology) */
1769 	AR5523_DEVICE_UG(0x16ab, 0x7801),	/* Globalsun / AR5523_1 */
1770 	AR5523_DEVICE_UX(0x16ab, 0x7811),	/* Globalsun / AR5523_2 */
1771 	AR5523_DEVICE_UG(0x0d8e, 0x7802),	/* Globalsun / AR5523_3 */
1772 	AR5523_DEVICE_UX(0x0846, 0x4300),	/* Netgear / WG111U */
1773 	AR5523_DEVICE_UG(0x0846, 0x4250),	/* Netgear / WG111T */
1774 	AR5523_DEVICE_UG(0x0846, 0x5f00),	/* Netgear / WPN111 */
1775 	AR5523_DEVICE_UG(0x157e, 0x3006),	/* Umedia / AR5523_1 */
1776 	AR5523_DEVICE_UX(0x157e, 0x3205),	/* Umedia / AR5523_2 */
1777 	AR5523_DEVICE_UG(0x157e, 0x3006),	/* Umedia / TEW444UBEU */
1778 	AR5523_DEVICE_UG(0x1435, 0x0826),	/* Wistronneweb / AR5523_1 */
1779 	AR5523_DEVICE_UX(0x1435, 0x0828),	/* Wistronneweb / AR5523_2 */
1780 	AR5523_DEVICE_UG(0x0cde, 0x0012),	/* Zcom / AR5523 */
1781 	AR5523_DEVICE_UG(0x1385, 0x4250),	/* Netgear3 / WG111T (2) */
1782 	AR5523_DEVICE_UG(0x1385, 0x5f00),	/* Netgear / WPN111 */
1783 	AR5523_DEVICE_UG(0x1385, 0x5f02),	/* Netgear / WPN111 */
1784 	{ }
1785 };
1786 MODULE_DEVICE_TABLE(usb, ar5523_id_table);
1787 
1788 static struct usb_driver ar5523_driver = {
1789 	.name		= "ar5523",
1790 	.id_table	= ar5523_id_table,
1791 	.probe		= ar5523_probe,
1792 	.disconnect	= ar5523_disconnect,
1793 };
1794 
1795 module_usb_driver(ar5523_driver);
1796 
1797 MODULE_LICENSE("Dual BSD/GPL");
1798 MODULE_FIRMWARE(AR5523_FIRMWARE_FILE);
1799