1 /*
2  * Copyright (c) 2010-2011 Atheros Communications Inc.
3  *
4  * Permission to use, copy, modify, and/or distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "htc.h"
18 
19 /******/
20 /* TX */
21 /******/
22 
23 static const int subtype_txq_to_hwq[] = {
24 	[IEEE80211_AC_BE] = ATH_TXQ_AC_BE,
25 	[IEEE80211_AC_BK] = ATH_TXQ_AC_BK,
26 	[IEEE80211_AC_VI] = ATH_TXQ_AC_VI,
27 	[IEEE80211_AC_VO] = ATH_TXQ_AC_VO,
28 };
29 
30 #define ATH9K_HTC_INIT_TXQ(subtype) do {			\
31 		qi.tqi_subtype = subtype_txq_to_hwq[subtype];	\
32 		qi.tqi_aifs = ATH9K_TXQ_USEDEFAULT;		\
33 		qi.tqi_cwmin = ATH9K_TXQ_USEDEFAULT;		\
34 		qi.tqi_cwmax = ATH9K_TXQ_USEDEFAULT;		\
35 		qi.tqi_physCompBuf = 0;				\
36 		qi.tqi_qflags = TXQ_FLAG_TXEOLINT_ENABLE |	\
37 			TXQ_FLAG_TXDESCINT_ENABLE;		\
38 	} while (0)
39 
40 int get_hw_qnum(u16 queue, int *hwq_map)
41 {
42 	switch (queue) {
43 	case 0:
44 		return hwq_map[IEEE80211_AC_VO];
45 	case 1:
46 		return hwq_map[IEEE80211_AC_VI];
47 	case 2:
48 		return hwq_map[IEEE80211_AC_BE];
49 	case 3:
50 		return hwq_map[IEEE80211_AC_BK];
51 	default:
52 		return hwq_map[IEEE80211_AC_BE];
53 	}
54 }
55 
56 void ath9k_htc_check_stop_queues(struct ath9k_htc_priv *priv)
57 {
58 	spin_lock_bh(&priv->tx.tx_lock);
59 	priv->tx.queued_cnt++;
60 	if ((priv->tx.queued_cnt >= ATH9K_HTC_TX_THRESHOLD) &&
61 	    !(priv->tx.flags & ATH9K_HTC_OP_TX_QUEUES_STOP)) {
62 		priv->tx.flags |= ATH9K_HTC_OP_TX_QUEUES_STOP;
63 		ieee80211_stop_queues(priv->hw);
64 	}
65 	spin_unlock_bh(&priv->tx.tx_lock);
66 }
67 
68 void ath9k_htc_check_wake_queues(struct ath9k_htc_priv *priv)
69 {
70 	spin_lock_bh(&priv->tx.tx_lock);
71 	if ((priv->tx.queued_cnt < ATH9K_HTC_TX_THRESHOLD) &&
72 	    (priv->tx.flags & ATH9K_HTC_OP_TX_QUEUES_STOP)) {
73 		priv->tx.flags &= ~ATH9K_HTC_OP_TX_QUEUES_STOP;
74 		ieee80211_wake_queues(priv->hw);
75 	}
76 	spin_unlock_bh(&priv->tx.tx_lock);
77 }
78 
79 int ath9k_htc_tx_get_slot(struct ath9k_htc_priv *priv)
80 {
81 	int slot;
82 
83 	spin_lock_bh(&priv->tx.tx_lock);
84 	slot = find_first_zero_bit(priv->tx.tx_slot, MAX_TX_BUF_NUM);
85 	if (slot >= MAX_TX_BUF_NUM) {
86 		spin_unlock_bh(&priv->tx.tx_lock);
87 		return -ENOBUFS;
88 	}
89 	__set_bit(slot, priv->tx.tx_slot);
90 	spin_unlock_bh(&priv->tx.tx_lock);
91 
92 	return slot;
93 }
94 
95 void ath9k_htc_tx_clear_slot(struct ath9k_htc_priv *priv, int slot)
96 {
97 	spin_lock_bh(&priv->tx.tx_lock);
98 	__clear_bit(slot, priv->tx.tx_slot);
99 	spin_unlock_bh(&priv->tx.tx_lock);
100 }
101 
102 static inline enum htc_endpoint_id get_htc_epid(struct ath9k_htc_priv *priv,
103 						u16 qnum)
104 {
105 	enum htc_endpoint_id epid;
106 
107 	switch (qnum) {
108 	case 0:
109 		TX_QSTAT_INC(IEEE80211_AC_VO);
110 		epid = priv->data_vo_ep;
111 		break;
112 	case 1:
113 		TX_QSTAT_INC(IEEE80211_AC_VI);
114 		epid = priv->data_vi_ep;
115 		break;
116 	case 2:
117 		TX_QSTAT_INC(IEEE80211_AC_BE);
118 		epid = priv->data_be_ep;
119 		break;
120 	case 3:
121 	default:
122 		TX_QSTAT_INC(IEEE80211_AC_BK);
123 		epid = priv->data_bk_ep;
124 		break;
125 	}
126 
127 	return epid;
128 }
129 
130 static inline struct sk_buff_head*
131 get_htc_epid_queue(struct ath9k_htc_priv *priv, u8 epid)
132 {
133 	struct ath_common *common = ath9k_hw_common(priv->ah);
134 	struct sk_buff_head *epid_queue = NULL;
135 
136 	if (epid == priv->mgmt_ep)
137 		epid_queue = &priv->tx.mgmt_ep_queue;
138 	else if (epid == priv->cab_ep)
139 		epid_queue = &priv->tx.cab_ep_queue;
140 	else if (epid == priv->data_be_ep)
141 		epid_queue = &priv->tx.data_be_queue;
142 	else if (epid == priv->data_bk_ep)
143 		epid_queue = &priv->tx.data_bk_queue;
144 	else if (epid == priv->data_vi_ep)
145 		epid_queue = &priv->tx.data_vi_queue;
146 	else if (epid == priv->data_vo_ep)
147 		epid_queue = &priv->tx.data_vo_queue;
148 	else
149 		ath_err(common, "Invalid EPID: %d\n", epid);
150 
151 	return epid_queue;
152 }
153 
154 /*
155  * Removes the driver header and returns the TX slot number
156  */
157 static inline int strip_drv_header(struct ath9k_htc_priv *priv,
158 				   struct sk_buff *skb)
159 {
160 	struct ath_common *common = ath9k_hw_common(priv->ah);
161 	struct ath9k_htc_tx_ctl *tx_ctl;
162 	int slot;
163 
164 	tx_ctl = HTC_SKB_CB(skb);
165 
166 	if (tx_ctl->epid == priv->mgmt_ep) {
167 		struct tx_mgmt_hdr *tx_mhdr =
168 			(struct tx_mgmt_hdr *)skb->data;
169 		slot = tx_mhdr->cookie;
170 		skb_pull(skb, sizeof(struct tx_mgmt_hdr));
171 	} else if ((tx_ctl->epid == priv->data_bk_ep) ||
172 		   (tx_ctl->epid == priv->data_be_ep) ||
173 		   (tx_ctl->epid == priv->data_vi_ep) ||
174 		   (tx_ctl->epid == priv->data_vo_ep) ||
175 		   (tx_ctl->epid == priv->cab_ep)) {
176 		struct tx_frame_hdr *tx_fhdr =
177 			(struct tx_frame_hdr *)skb->data;
178 		slot = tx_fhdr->cookie;
179 		skb_pull(skb, sizeof(struct tx_frame_hdr));
180 	} else {
181 		ath_err(common, "Unsupported EPID: %d\n", tx_ctl->epid);
182 		slot = -EINVAL;
183 	}
184 
185 	return slot;
186 }
187 
188 int ath_htc_txq_update(struct ath9k_htc_priv *priv, int qnum,
189 		       struct ath9k_tx_queue_info *qinfo)
190 {
191 	struct ath_hw *ah = priv->ah;
192 	int error = 0;
193 	struct ath9k_tx_queue_info qi;
194 
195 	ath9k_hw_get_txq_props(ah, qnum, &qi);
196 
197 	qi.tqi_aifs = qinfo->tqi_aifs;
198 	qi.tqi_cwmin = qinfo->tqi_cwmin / 2; /* XXX */
199 	qi.tqi_cwmax = qinfo->tqi_cwmax;
200 	qi.tqi_burstTime = qinfo->tqi_burstTime;
201 	qi.tqi_readyTime = qinfo->tqi_readyTime;
202 
203 	if (!ath9k_hw_set_txq_props(ah, qnum, &qi)) {
204 		ath_err(ath9k_hw_common(ah),
205 			"Unable to update hardware queue %u!\n", qnum);
206 		error = -EIO;
207 	} else {
208 		ath9k_hw_resettxqueue(ah, qnum);
209 	}
210 
211 	return error;
212 }
213 
214 static void ath9k_htc_tx_mgmt(struct ath9k_htc_priv *priv,
215 			      struct ath9k_htc_vif *avp,
216 			      struct sk_buff *skb,
217 			      u8 sta_idx, u8 vif_idx, u8 slot)
218 {
219 	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
220 	struct ieee80211_mgmt *mgmt;
221 	struct ieee80211_hdr *hdr;
222 	struct tx_mgmt_hdr mgmt_hdr;
223 	struct ath9k_htc_tx_ctl *tx_ctl;
224 	u8 *tx_fhdr;
225 
226 	tx_ctl = HTC_SKB_CB(skb);
227 	hdr = (struct ieee80211_hdr *) skb->data;
228 
229 	memset(tx_ctl, 0, sizeof(*tx_ctl));
230 	memset(&mgmt_hdr, 0, sizeof(struct tx_mgmt_hdr));
231 
232 	/*
233 	 * Set the TSF adjust value for probe response
234 	 * frame also.
235 	 */
236 	if (avp && unlikely(ieee80211_is_probe_resp(hdr->frame_control))) {
237 		mgmt = (struct ieee80211_mgmt *)skb->data;
238 		mgmt->u.probe_resp.timestamp = avp->tsfadjust;
239 	}
240 
241 	tx_ctl->type = ATH9K_HTC_MGMT;
242 
243 	mgmt_hdr.node_idx = sta_idx;
244 	mgmt_hdr.vif_idx = vif_idx;
245 	mgmt_hdr.tidno = 0;
246 	mgmt_hdr.flags = 0;
247 	mgmt_hdr.cookie = slot;
248 
249 	mgmt_hdr.key_type = ath9k_cmn_get_hw_crypto_keytype(skb);
250 	if (mgmt_hdr.key_type == ATH9K_KEY_TYPE_CLEAR)
251 		mgmt_hdr.keyix = (u8) ATH9K_TXKEYIX_INVALID;
252 	else
253 		mgmt_hdr.keyix = tx_info->control.hw_key->hw_key_idx;
254 
255 	tx_fhdr = skb_push(skb, sizeof(mgmt_hdr));
256 	memcpy(tx_fhdr, (u8 *) &mgmt_hdr, sizeof(mgmt_hdr));
257 	tx_ctl->epid = priv->mgmt_ep;
258 }
259 
260 static void ath9k_htc_tx_data(struct ath9k_htc_priv *priv,
261 			      struct ieee80211_vif *vif,
262 			      struct sk_buff *skb,
263 			      u8 sta_idx, u8 vif_idx, u8 slot,
264 			      bool is_cab)
265 {
266 	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
267 	struct ieee80211_hdr *hdr;
268 	struct ath9k_htc_tx_ctl *tx_ctl;
269 	struct tx_frame_hdr tx_hdr;
270 	u32 flags = 0;
271 	u8 *qc, *tx_fhdr;
272 	u16 qnum;
273 
274 	tx_ctl = HTC_SKB_CB(skb);
275 	hdr = (struct ieee80211_hdr *) skb->data;
276 
277 	memset(tx_ctl, 0, sizeof(*tx_ctl));
278 	memset(&tx_hdr, 0, sizeof(struct tx_frame_hdr));
279 
280 	tx_hdr.node_idx = sta_idx;
281 	tx_hdr.vif_idx = vif_idx;
282 	tx_hdr.cookie = slot;
283 
284 	/*
285 	 * This is a bit redundant but it helps to get
286 	 * the per-packet index quickly when draining the
287 	 * TX queue in the HIF layer. Otherwise we would
288 	 * have to parse the packet contents ...
289 	 */
290 	tx_ctl->sta_idx = sta_idx;
291 
292 	if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
293 		tx_ctl->type = ATH9K_HTC_AMPDU;
294 		tx_hdr.data_type = ATH9K_HTC_AMPDU;
295 	} else {
296 		tx_ctl->type = ATH9K_HTC_NORMAL;
297 		tx_hdr.data_type = ATH9K_HTC_NORMAL;
298 	}
299 
300 	if (ieee80211_is_data_qos(hdr->frame_control)) {
301 		qc = ieee80211_get_qos_ctl(hdr);
302 		tx_hdr.tidno = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
303 	}
304 
305 	/* Check for RTS protection */
306 	if (priv->hw->wiphy->rts_threshold != (u32) -1)
307 		if (skb->len > priv->hw->wiphy->rts_threshold)
308 			flags |= ATH9K_HTC_TX_RTSCTS;
309 
310 	/* CTS-to-self */
311 	if (!(flags & ATH9K_HTC_TX_RTSCTS) &&
312 	    (vif && vif->bss_conf.use_cts_prot))
313 		flags |= ATH9K_HTC_TX_CTSONLY;
314 
315 	tx_hdr.flags = cpu_to_be32(flags);
316 	tx_hdr.key_type = ath9k_cmn_get_hw_crypto_keytype(skb);
317 	if (tx_hdr.key_type == ATH9K_KEY_TYPE_CLEAR)
318 		tx_hdr.keyix = (u8) ATH9K_TXKEYIX_INVALID;
319 	else
320 		tx_hdr.keyix = tx_info->control.hw_key->hw_key_idx;
321 
322 	tx_fhdr = skb_push(skb, sizeof(tx_hdr));
323 	memcpy(tx_fhdr, (u8 *) &tx_hdr, sizeof(tx_hdr));
324 
325 	if (is_cab) {
326 		CAB_STAT_INC;
327 		tx_ctl->epid = priv->cab_ep;
328 		return;
329 	}
330 
331 	qnum = skb_get_queue_mapping(skb);
332 	tx_ctl->epid = get_htc_epid(priv, qnum);
333 }
334 
335 int ath9k_htc_tx_start(struct ath9k_htc_priv *priv,
336 		       struct ieee80211_sta *sta,
337 		       struct sk_buff *skb,
338 		       u8 slot, bool is_cab)
339 {
340 	struct ieee80211_hdr *hdr;
341 	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
342 	struct ieee80211_vif *vif = tx_info->control.vif;
343 	struct ath9k_htc_sta *ista;
344 	struct ath9k_htc_vif *avp = NULL;
345 	u8 sta_idx, vif_idx;
346 
347 	hdr = (struct ieee80211_hdr *) skb->data;
348 
349 	/*
350 	 * Find out on which interface this packet has to be
351 	 * sent out.
352 	 */
353 	if (vif) {
354 		avp = (struct ath9k_htc_vif *) vif->drv_priv;
355 		vif_idx = avp->index;
356 	} else {
357 		if (!priv->ah->is_monitoring) {
358 			ath_dbg(ath9k_hw_common(priv->ah), XMIT,
359 				"VIF is null, but no monitor interface !\n");
360 			return -EINVAL;
361 		}
362 
363 		vif_idx = priv->mon_vif_idx;
364 	}
365 
366 	/*
367 	 * Find out which station this packet is destined for.
368 	 */
369 	if (sta) {
370 		ista = (struct ath9k_htc_sta *) sta->drv_priv;
371 		sta_idx = ista->index;
372 	} else {
373 		sta_idx = priv->vif_sta_pos[vif_idx];
374 	}
375 
376 	if (ieee80211_is_data(hdr->frame_control))
377 		ath9k_htc_tx_data(priv, vif, skb,
378 				  sta_idx, vif_idx, slot, is_cab);
379 	else
380 		ath9k_htc_tx_mgmt(priv, avp, skb,
381 				  sta_idx, vif_idx, slot);
382 
383 
384 	return htc_send(priv->htc, skb);
385 }
386 
387 static inline bool __ath9k_htc_check_tx_aggr(struct ath9k_htc_priv *priv,
388 					     struct ath9k_htc_sta *ista, u8 tid)
389 {
390 	bool ret = false;
391 
392 	spin_lock_bh(&priv->tx.tx_lock);
393 	if ((tid < ATH9K_HTC_MAX_TID) && (ista->tid_state[tid] == AGGR_STOP))
394 		ret = true;
395 	spin_unlock_bh(&priv->tx.tx_lock);
396 
397 	return ret;
398 }
399 
400 static void ath9k_htc_check_tx_aggr(struct ath9k_htc_priv *priv,
401 				    struct ieee80211_vif *vif,
402 				    struct sk_buff *skb)
403 {
404 	struct ieee80211_sta *sta;
405 	struct ieee80211_hdr *hdr;
406 	__le16 fc;
407 
408 	hdr = (struct ieee80211_hdr *) skb->data;
409 	fc = hdr->frame_control;
410 
411 	rcu_read_lock();
412 
413 	sta = ieee80211_find_sta(vif, hdr->addr1);
414 	if (!sta) {
415 		rcu_read_unlock();
416 		return;
417 	}
418 
419 	if (sta && conf_is_ht(&priv->hw->conf) &&
420 	    !(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
421 		if (ieee80211_is_data_qos(fc)) {
422 			u8 *qc, tid;
423 			struct ath9k_htc_sta *ista;
424 
425 			qc = ieee80211_get_qos_ctl(hdr);
426 			tid = qc[0] & 0xf;
427 			ista = (struct ath9k_htc_sta *)sta->drv_priv;
428 			if (__ath9k_htc_check_tx_aggr(priv, ista, tid)) {
429 				ieee80211_start_tx_ba_session(sta, tid, 0);
430 				spin_lock_bh(&priv->tx.tx_lock);
431 				ista->tid_state[tid] = AGGR_PROGRESS;
432 				spin_unlock_bh(&priv->tx.tx_lock);
433 			}
434 		}
435 	}
436 
437 	rcu_read_unlock();
438 }
439 
440 static void ath9k_htc_tx_process(struct ath9k_htc_priv *priv,
441 				 struct sk_buff *skb,
442 				 struct __wmi_event_txstatus *txs)
443 {
444 	struct ieee80211_vif *vif;
445 	struct ath9k_htc_tx_ctl *tx_ctl;
446 	struct ieee80211_tx_info *tx_info;
447 	struct ieee80211_tx_rate *rate;
448 	struct ieee80211_conf *cur_conf = &priv->hw->conf;
449 	bool txok;
450 	int slot;
451 	int hdrlen, padsize;
452 
453 	slot = strip_drv_header(priv, skb);
454 	if (slot < 0) {
455 		dev_kfree_skb_any(skb);
456 		return;
457 	}
458 
459 	tx_ctl = HTC_SKB_CB(skb);
460 	txok = tx_ctl->txok;
461 	tx_info = IEEE80211_SKB_CB(skb);
462 	vif = tx_info->control.vif;
463 	rate = &tx_info->status.rates[0];
464 
465 	memset(&tx_info->status, 0, sizeof(tx_info->status));
466 
467 	/*
468 	 * URB submission failed for this frame, it never reached
469 	 * the target.
470 	 */
471 	if (!txok || !vif || !txs)
472 		goto send_mac80211;
473 
474 	if (txs->ts_flags & ATH9K_HTC_TXSTAT_ACK)
475 		tx_info->flags |= IEEE80211_TX_STAT_ACK;
476 
477 	if (txs->ts_flags & ATH9K_HTC_TXSTAT_FILT)
478 		tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
479 
480 	if (txs->ts_flags & ATH9K_HTC_TXSTAT_RTC_CTS)
481 		rate->flags |= IEEE80211_TX_RC_USE_RTS_CTS;
482 
483 	rate->count = 1;
484 	rate->idx = MS(txs->ts_rate, ATH9K_HTC_TXSTAT_RATE);
485 
486 	if (txs->ts_flags & ATH9K_HTC_TXSTAT_MCS) {
487 		rate->flags |= IEEE80211_TX_RC_MCS;
488 
489 		if (txs->ts_flags & ATH9K_HTC_TXSTAT_CW40)
490 			rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
491 		if (txs->ts_flags & ATH9K_HTC_TXSTAT_SGI)
492 			rate->flags |= IEEE80211_TX_RC_SHORT_GI;
493 	} else {
494 		if (cur_conf->chandef.chan->band == IEEE80211_BAND_5GHZ)
495 			rate->idx += 4; /* No CCK rates */
496 	}
497 
498 	ath9k_htc_check_tx_aggr(priv, vif, skb);
499 
500 send_mac80211:
501 	spin_lock_bh(&priv->tx.tx_lock);
502 	if (WARN_ON(--priv->tx.queued_cnt < 0))
503 		priv->tx.queued_cnt = 0;
504 	spin_unlock_bh(&priv->tx.tx_lock);
505 
506 	ath9k_htc_tx_clear_slot(priv, slot);
507 
508 	/* Remove padding before handing frame back to mac80211 */
509 	hdrlen = ieee80211_get_hdrlen_from_skb(skb);
510 
511 	padsize = hdrlen & 3;
512 	if (padsize && skb->len > hdrlen + padsize) {
513 		memmove(skb->data + padsize, skb->data, hdrlen);
514 		skb_pull(skb, padsize);
515 	}
516 
517 	/* Send status to mac80211 */
518 	ieee80211_tx_status(priv->hw, skb);
519 }
520 
521 static inline void ath9k_htc_tx_drainq(struct ath9k_htc_priv *priv,
522 				       struct sk_buff_head *queue)
523 {
524 	struct sk_buff *skb;
525 
526 	while ((skb = skb_dequeue(queue)) != NULL) {
527 		ath9k_htc_tx_process(priv, skb, NULL);
528 	}
529 }
530 
531 void ath9k_htc_tx_drain(struct ath9k_htc_priv *priv)
532 {
533 	struct ath9k_htc_tx_event *event, *tmp;
534 
535 	spin_lock_bh(&priv->tx.tx_lock);
536 	priv->tx.flags |= ATH9K_HTC_OP_TX_DRAIN;
537 	spin_unlock_bh(&priv->tx.tx_lock);
538 
539 	/*
540 	 * Ensure that all pending TX frames are flushed,
541 	 * and that the TX completion/failed tasklets is killed.
542 	 */
543 	htc_stop(priv->htc);
544 	tasklet_kill(&priv->wmi->wmi_event_tasklet);
545 	tasklet_kill(&priv->tx_failed_tasklet);
546 
547 	ath9k_htc_tx_drainq(priv, &priv->tx.mgmt_ep_queue);
548 	ath9k_htc_tx_drainq(priv, &priv->tx.cab_ep_queue);
549 	ath9k_htc_tx_drainq(priv, &priv->tx.data_be_queue);
550 	ath9k_htc_tx_drainq(priv, &priv->tx.data_bk_queue);
551 	ath9k_htc_tx_drainq(priv, &priv->tx.data_vi_queue);
552 	ath9k_htc_tx_drainq(priv, &priv->tx.data_vo_queue);
553 	ath9k_htc_tx_drainq(priv, &priv->tx.tx_failed);
554 
555 	/*
556 	 * The TX cleanup timer has already been killed.
557 	 */
558 	spin_lock_bh(&priv->wmi->event_lock);
559 	list_for_each_entry_safe(event, tmp, &priv->wmi->pending_tx_events, list) {
560 		list_del(&event->list);
561 		kfree(event);
562 	}
563 	spin_unlock_bh(&priv->wmi->event_lock);
564 
565 	spin_lock_bh(&priv->tx.tx_lock);
566 	priv->tx.flags &= ~ATH9K_HTC_OP_TX_DRAIN;
567 	spin_unlock_bh(&priv->tx.tx_lock);
568 }
569 
570 void ath9k_tx_failed_tasklet(unsigned long data)
571 {
572 	struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *)data;
573 
574 	spin_lock_bh(&priv->tx.tx_lock);
575 	if (priv->tx.flags & ATH9K_HTC_OP_TX_DRAIN) {
576 		spin_unlock_bh(&priv->tx.tx_lock);
577 		return;
578 	}
579 	spin_unlock_bh(&priv->tx.tx_lock);
580 
581 	ath9k_htc_tx_drainq(priv, &priv->tx.tx_failed);
582 }
583 
584 static inline bool check_cookie(struct ath9k_htc_priv *priv,
585 				struct sk_buff *skb,
586 				u8 cookie, u8 epid)
587 {
588 	u8 fcookie = 0;
589 
590 	if (epid == priv->mgmt_ep) {
591 		struct tx_mgmt_hdr *hdr;
592 		hdr = (struct tx_mgmt_hdr *) skb->data;
593 		fcookie = hdr->cookie;
594 	} else if ((epid == priv->data_bk_ep) ||
595 		   (epid == priv->data_be_ep) ||
596 		   (epid == priv->data_vi_ep) ||
597 		   (epid == priv->data_vo_ep) ||
598 		   (epid == priv->cab_ep)) {
599 		struct tx_frame_hdr *hdr;
600 		hdr = (struct tx_frame_hdr *) skb->data;
601 		fcookie = hdr->cookie;
602 	}
603 
604 	if (fcookie == cookie)
605 		return true;
606 
607 	return false;
608 }
609 
610 static struct sk_buff* ath9k_htc_tx_get_packet(struct ath9k_htc_priv *priv,
611 					       struct __wmi_event_txstatus *txs)
612 {
613 	struct ath_common *common = ath9k_hw_common(priv->ah);
614 	struct sk_buff_head *epid_queue;
615 	struct sk_buff *skb, *tmp;
616 	unsigned long flags;
617 	u8 epid = MS(txs->ts_rate, ATH9K_HTC_TXSTAT_EPID);
618 
619 	epid_queue = get_htc_epid_queue(priv, epid);
620 	if (!epid_queue)
621 		return NULL;
622 
623 	spin_lock_irqsave(&epid_queue->lock, flags);
624 	skb_queue_walk_safe(epid_queue, skb, tmp) {
625 		if (check_cookie(priv, skb, txs->cookie, epid)) {
626 			__skb_unlink(skb, epid_queue);
627 			spin_unlock_irqrestore(&epid_queue->lock, flags);
628 			return skb;
629 		}
630 	}
631 	spin_unlock_irqrestore(&epid_queue->lock, flags);
632 
633 	ath_dbg(common, XMIT, "No matching packet for cookie: %d, epid: %d\n",
634 		txs->cookie, epid);
635 
636 	return NULL;
637 }
638 
639 void ath9k_htc_txstatus(struct ath9k_htc_priv *priv, void *wmi_event)
640 {
641 	struct wmi_event_txstatus *txs = (struct wmi_event_txstatus *)wmi_event;
642 	struct __wmi_event_txstatus *__txs;
643 	struct sk_buff *skb;
644 	struct ath9k_htc_tx_event *tx_pend;
645 	int i;
646 
647 	for (i = 0; i < txs->cnt; i++) {
648 		WARN_ON(txs->cnt > HTC_MAX_TX_STATUS);
649 
650 		__txs = &txs->txstatus[i];
651 
652 		skb = ath9k_htc_tx_get_packet(priv, __txs);
653 		if (!skb) {
654 			/*
655 			 * Store this event, so that the TX cleanup
656 			 * routine can check later for the needed packet.
657 			 */
658 			tx_pend = kzalloc(sizeof(struct ath9k_htc_tx_event),
659 					  GFP_ATOMIC);
660 			if (!tx_pend)
661 				continue;
662 
663 			memcpy(&tx_pend->txs, __txs,
664 			       sizeof(struct __wmi_event_txstatus));
665 
666 			spin_lock(&priv->wmi->event_lock);
667 			list_add_tail(&tx_pend->list,
668 				      &priv->wmi->pending_tx_events);
669 			spin_unlock(&priv->wmi->event_lock);
670 
671 			continue;
672 		}
673 
674 		ath9k_htc_tx_process(priv, skb, __txs);
675 	}
676 
677 	/* Wake TX queues if needed */
678 	ath9k_htc_check_wake_queues(priv);
679 }
680 
681 void ath9k_htc_txep(void *drv_priv, struct sk_buff *skb,
682 		    enum htc_endpoint_id ep_id, bool txok)
683 {
684 	struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) drv_priv;
685 	struct ath9k_htc_tx_ctl *tx_ctl;
686 	struct sk_buff_head *epid_queue;
687 
688 	tx_ctl = HTC_SKB_CB(skb);
689 	tx_ctl->txok = txok;
690 	tx_ctl->timestamp = jiffies;
691 
692 	if (!txok) {
693 		skb_queue_tail(&priv->tx.tx_failed, skb);
694 		tasklet_schedule(&priv->tx_failed_tasklet);
695 		return;
696 	}
697 
698 	epid_queue = get_htc_epid_queue(priv, ep_id);
699 	if (!epid_queue) {
700 		dev_kfree_skb_any(skb);
701 		return;
702 	}
703 
704 	skb_queue_tail(epid_queue, skb);
705 }
706 
707 static inline bool check_packet(struct ath9k_htc_priv *priv, struct sk_buff *skb)
708 {
709 	struct ath_common *common = ath9k_hw_common(priv->ah);
710 	struct ath9k_htc_tx_ctl *tx_ctl;
711 
712 	tx_ctl = HTC_SKB_CB(skb);
713 
714 	if (time_after(jiffies,
715 		       tx_ctl->timestamp +
716 		       msecs_to_jiffies(ATH9K_HTC_TX_TIMEOUT_INTERVAL))) {
717 		ath_dbg(common, XMIT, "Dropping a packet due to TX timeout\n");
718 		return true;
719 	}
720 
721 	return false;
722 }
723 
724 static void ath9k_htc_tx_cleanup_queue(struct ath9k_htc_priv *priv,
725 				       struct sk_buff_head *epid_queue)
726 {
727 	bool process = false;
728 	unsigned long flags;
729 	struct sk_buff *skb, *tmp;
730 	struct sk_buff_head queue;
731 
732 	skb_queue_head_init(&queue);
733 
734 	spin_lock_irqsave(&epid_queue->lock, flags);
735 	skb_queue_walk_safe(epid_queue, skb, tmp) {
736 		if (check_packet(priv, skb)) {
737 			__skb_unlink(skb, epid_queue);
738 			__skb_queue_tail(&queue, skb);
739 			process = true;
740 		}
741 	}
742 	spin_unlock_irqrestore(&epid_queue->lock, flags);
743 
744 	if (process) {
745 		skb_queue_walk_safe(&queue, skb, tmp) {
746 			__skb_unlink(skb, &queue);
747 			ath9k_htc_tx_process(priv, skb, NULL);
748 		}
749 	}
750 }
751 
752 void ath9k_htc_tx_cleanup_timer(unsigned long data)
753 {
754 	struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) data;
755 	struct ath_common *common = ath9k_hw_common(priv->ah);
756 	struct ath9k_htc_tx_event *event, *tmp;
757 	struct sk_buff *skb;
758 
759 	spin_lock(&priv->wmi->event_lock);
760 	list_for_each_entry_safe(event, tmp, &priv->wmi->pending_tx_events, list) {
761 
762 		skb = ath9k_htc_tx_get_packet(priv, &event->txs);
763 		if (skb) {
764 			ath_dbg(common, XMIT,
765 				"Found packet for cookie: %d, epid: %d\n",
766 				event->txs.cookie,
767 				MS(event->txs.ts_rate, ATH9K_HTC_TXSTAT_EPID));
768 
769 			ath9k_htc_tx_process(priv, skb, &event->txs);
770 			list_del(&event->list);
771 			kfree(event);
772 			continue;
773 		}
774 
775 		if (++event->count >= ATH9K_HTC_TX_TIMEOUT_COUNT) {
776 			list_del(&event->list);
777 			kfree(event);
778 		}
779 	}
780 	spin_unlock(&priv->wmi->event_lock);
781 
782 	/*
783 	 * Check if status-pending packets have to be cleaned up.
784 	 */
785 	ath9k_htc_tx_cleanup_queue(priv, &priv->tx.mgmt_ep_queue);
786 	ath9k_htc_tx_cleanup_queue(priv, &priv->tx.cab_ep_queue);
787 	ath9k_htc_tx_cleanup_queue(priv, &priv->tx.data_be_queue);
788 	ath9k_htc_tx_cleanup_queue(priv, &priv->tx.data_bk_queue);
789 	ath9k_htc_tx_cleanup_queue(priv, &priv->tx.data_vi_queue);
790 	ath9k_htc_tx_cleanup_queue(priv, &priv->tx.data_vo_queue);
791 
792 	/* Wake TX queues if needed */
793 	ath9k_htc_check_wake_queues(priv);
794 
795 	mod_timer(&priv->tx.cleanup_timer,
796 		  jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));
797 }
798 
799 int ath9k_tx_init(struct ath9k_htc_priv *priv)
800 {
801 	skb_queue_head_init(&priv->tx.mgmt_ep_queue);
802 	skb_queue_head_init(&priv->tx.cab_ep_queue);
803 	skb_queue_head_init(&priv->tx.data_be_queue);
804 	skb_queue_head_init(&priv->tx.data_bk_queue);
805 	skb_queue_head_init(&priv->tx.data_vi_queue);
806 	skb_queue_head_init(&priv->tx.data_vo_queue);
807 	skb_queue_head_init(&priv->tx.tx_failed);
808 	return 0;
809 }
810 
811 void ath9k_tx_cleanup(struct ath9k_htc_priv *priv)
812 {
813 
814 }
815 
816 bool ath9k_htc_txq_setup(struct ath9k_htc_priv *priv, int subtype)
817 {
818 	struct ath_hw *ah = priv->ah;
819 	struct ath_common *common = ath9k_hw_common(ah);
820 	struct ath9k_tx_queue_info qi;
821 	int qnum;
822 
823 	memset(&qi, 0, sizeof(qi));
824 	ATH9K_HTC_INIT_TXQ(subtype);
825 
826 	qnum = ath9k_hw_setuptxqueue(priv->ah, ATH9K_TX_QUEUE_DATA, &qi);
827 	if (qnum == -1)
828 		return false;
829 
830 	if (qnum >= ARRAY_SIZE(priv->hwq_map)) {
831 		ath_err(common, "qnum %u out of range, max %zu!\n",
832 			qnum, ARRAY_SIZE(priv->hwq_map));
833 		ath9k_hw_releasetxqueue(ah, qnum);
834 		return false;
835 	}
836 
837 	priv->hwq_map[subtype] = qnum;
838 	return true;
839 }
840 
841 int ath9k_htc_cabq_setup(struct ath9k_htc_priv *priv)
842 {
843 	struct ath9k_tx_queue_info qi;
844 
845 	memset(&qi, 0, sizeof(qi));
846 	ATH9K_HTC_INIT_TXQ(0);
847 
848 	return ath9k_hw_setuptxqueue(priv->ah, ATH9K_TX_QUEUE_CAB, &qi);
849 }
850 
851 /******/
852 /* RX */
853 /******/
854 
855 /*
856  * Calculate the RX filter to be set in the HW.
857  */
858 u32 ath9k_htc_calcrxfilter(struct ath9k_htc_priv *priv)
859 {
860 #define	RX_FILTER_PRESERVE (ATH9K_RX_FILTER_PHYERR | ATH9K_RX_FILTER_PHYRADAR)
861 
862 	struct ath_hw *ah = priv->ah;
863 	u32 rfilt;
864 
865 	rfilt = (ath9k_hw_getrxfilter(ah) & RX_FILTER_PRESERVE)
866 		| ATH9K_RX_FILTER_UCAST | ATH9K_RX_FILTER_BCAST
867 		| ATH9K_RX_FILTER_MCAST;
868 
869 	if (priv->rxfilter & FIF_PROBE_REQ)
870 		rfilt |= ATH9K_RX_FILTER_PROBEREQ;
871 
872 	/*
873 	 * Set promiscuous mode when FIF_PROMISC_IN_BSS is enabled for station
874 	 * mode interface or when in monitor mode. AP mode does not need this
875 	 * since it receives all in-BSS frames anyway.
876 	 */
877 	if (((ah->opmode != NL80211_IFTYPE_AP) &&
878 	     (priv->rxfilter & FIF_PROMISC_IN_BSS)) ||
879 	    ah->is_monitoring)
880 		rfilt |= ATH9K_RX_FILTER_PROM;
881 
882 	if (priv->rxfilter & FIF_CONTROL)
883 		rfilt |= ATH9K_RX_FILTER_CONTROL;
884 
885 	if ((ah->opmode == NL80211_IFTYPE_STATION) &&
886 	    (priv->nvifs <= 1) &&
887 	    !(priv->rxfilter & FIF_BCN_PRBRESP_PROMISC))
888 		rfilt |= ATH9K_RX_FILTER_MYBEACON;
889 	else
890 		rfilt |= ATH9K_RX_FILTER_BEACON;
891 
892 	if (conf_is_ht(&priv->hw->conf)) {
893 		rfilt |= ATH9K_RX_FILTER_COMP_BAR;
894 		rfilt |= ATH9K_RX_FILTER_UNCOMP_BA_BAR;
895 	}
896 
897 	if (priv->rxfilter & FIF_PSPOLL)
898 		rfilt |= ATH9K_RX_FILTER_PSPOLL;
899 
900 	if (priv->nvifs > 1 || priv->rxfilter & FIF_OTHER_BSS)
901 		rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
902 
903 	return rfilt;
904 
905 #undef RX_FILTER_PRESERVE
906 }
907 
908 /*
909  * Recv initialization for opmode change.
910  */
911 static void ath9k_htc_opmode_init(struct ath9k_htc_priv *priv)
912 {
913 	struct ath_hw *ah = priv->ah;
914 	u32 rfilt, mfilt[2];
915 
916 	/* configure rx filter */
917 	rfilt = ath9k_htc_calcrxfilter(priv);
918 	ath9k_hw_setrxfilter(ah, rfilt);
919 
920 	/* calculate and install multicast filter */
921 	mfilt[0] = mfilt[1] = ~0;
922 	ath9k_hw_setmcastfilter(ah, mfilt[0], mfilt[1]);
923 }
924 
925 void ath9k_host_rx_init(struct ath9k_htc_priv *priv)
926 {
927 	ath9k_hw_rxena(priv->ah);
928 	ath9k_htc_opmode_init(priv);
929 	ath9k_hw_startpcureceive(priv->ah, test_bit(OP_SCANNING, &priv->op_flags));
930 	priv->rx.last_rssi = ATH_RSSI_DUMMY_MARKER;
931 }
932 
933 static void ath9k_process_rate(struct ieee80211_hw *hw,
934 			       struct ieee80211_rx_status *rxs,
935 			       u8 rx_rate, u8 rs_flags)
936 {
937 	struct ieee80211_supported_band *sband;
938 	enum ieee80211_band band;
939 	unsigned int i = 0;
940 
941 	if (rx_rate & 0x80) {
942 		/* HT rate */
943 		rxs->flag |= RX_FLAG_HT;
944 		if (rs_flags & ATH9K_RX_2040)
945 			rxs->flag |= RX_FLAG_40MHZ;
946 		if (rs_flags & ATH9K_RX_GI)
947 			rxs->flag |= RX_FLAG_SHORT_GI;
948 		rxs->rate_idx = rx_rate & 0x7f;
949 		return;
950 	}
951 
952 	band = hw->conf.chandef.chan->band;
953 	sband = hw->wiphy->bands[band];
954 
955 	for (i = 0; i < sband->n_bitrates; i++) {
956 		if (sband->bitrates[i].hw_value == rx_rate) {
957 			rxs->rate_idx = i;
958 			return;
959 		}
960 		if (sband->bitrates[i].hw_value_short == rx_rate) {
961 			rxs->rate_idx = i;
962 			rxs->flag |= RX_FLAG_SHORTPRE;
963 			return;
964 		}
965 	}
966 
967 }
968 
969 static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
970 			     struct ath9k_htc_rxbuf *rxbuf,
971 			     struct ieee80211_rx_status *rx_status)
972 
973 {
974 	struct ieee80211_hdr *hdr;
975 	struct ieee80211_hw *hw = priv->hw;
976 	struct sk_buff *skb = rxbuf->skb;
977 	struct ath_common *common = ath9k_hw_common(priv->ah);
978 	struct ath_htc_rx_status *rxstatus;
979 	int hdrlen, padsize;
980 	int last_rssi = ATH_RSSI_DUMMY_MARKER;
981 	__le16 fc;
982 
983 	if (skb->len < HTC_RX_FRAME_HEADER_SIZE) {
984 		ath_err(common, "Corrupted RX frame, dropping (len: %d)\n",
985 			skb->len);
986 		goto rx_next;
987 	}
988 
989 	rxstatus = (struct ath_htc_rx_status *)skb->data;
990 
991 	if (be16_to_cpu(rxstatus->rs_datalen) -
992 	    (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0) {
993 		ath_err(common,
994 			"Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n",
995 			rxstatus->rs_datalen, skb->len);
996 		goto rx_next;
997 	}
998 
999 	ath9k_htc_err_stat_rx(priv, rxstatus);
1000 
1001 	/* Get the RX status information */
1002 	memcpy(&rxbuf->rxstatus, rxstatus, HTC_RX_FRAME_HEADER_SIZE);
1003 	skb_pull(skb, HTC_RX_FRAME_HEADER_SIZE);
1004 
1005 	hdr = (struct ieee80211_hdr *)skb->data;
1006 	fc = hdr->frame_control;
1007 	hdrlen = ieee80211_get_hdrlen_from_skb(skb);
1008 
1009 	padsize = hdrlen & 3;
1010 	if (padsize && skb->len >= hdrlen+padsize+FCS_LEN) {
1011 		memmove(skb->data + padsize, skb->data, hdrlen);
1012 		skb_pull(skb, padsize);
1013 	}
1014 
1015 	memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
1016 
1017 	if (rxbuf->rxstatus.rs_status != 0) {
1018 		if (rxbuf->rxstatus.rs_status & ATH9K_RXERR_CRC)
1019 			rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
1020 		if (rxbuf->rxstatus.rs_status & ATH9K_RXERR_PHY)
1021 			goto rx_next;
1022 
1023 		if (rxbuf->rxstatus.rs_status & ATH9K_RXERR_DECRYPT) {
1024 			/* FIXME */
1025 		} else if (rxbuf->rxstatus.rs_status & ATH9K_RXERR_MIC) {
1026 			if (ieee80211_is_ctl(fc))
1027 				/*
1028 				 * Sometimes, we get invalid
1029 				 * MIC failures on valid control frames.
1030 				 * Remove these mic errors.
1031 				 */
1032 				rxbuf->rxstatus.rs_status &= ~ATH9K_RXERR_MIC;
1033 			else
1034 				rx_status->flag |= RX_FLAG_MMIC_ERROR;
1035 		}
1036 
1037 		/*
1038 		 * Reject error frames with the exception of
1039 		 * decryption and MIC failures. For monitor mode,
1040 		 * we also ignore the CRC error.
1041 		 */
1042 		if (priv->ah->opmode == NL80211_IFTYPE_MONITOR) {
1043 			if (rxbuf->rxstatus.rs_status &
1044 			    ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC |
1045 			      ATH9K_RXERR_CRC))
1046 				goto rx_next;
1047 		} else {
1048 			if (rxbuf->rxstatus.rs_status &
1049 			    ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC)) {
1050 				goto rx_next;
1051 			}
1052 		}
1053 	}
1054 
1055 	if (!(rxbuf->rxstatus.rs_status & ATH9K_RXERR_DECRYPT)) {
1056 		u8 keyix;
1057 		keyix = rxbuf->rxstatus.rs_keyix;
1058 		if (keyix != ATH9K_RXKEYIX_INVALID) {
1059 			rx_status->flag |= RX_FLAG_DECRYPTED;
1060 		} else if (ieee80211_has_protected(fc) &&
1061 			   skb->len >= hdrlen + 4) {
1062 			keyix = skb->data[hdrlen + 3] >> 6;
1063 			if (test_bit(keyix, common->keymap))
1064 				rx_status->flag |= RX_FLAG_DECRYPTED;
1065 		}
1066 	}
1067 
1068 	ath9k_process_rate(hw, rx_status, rxbuf->rxstatus.rs_rate,
1069 			   rxbuf->rxstatus.rs_flags);
1070 
1071 	if (rxbuf->rxstatus.rs_rssi != ATH9K_RSSI_BAD &&
1072 	    !rxbuf->rxstatus.rs_moreaggr)
1073 		ATH_RSSI_LPF(priv->rx.last_rssi,
1074 			     rxbuf->rxstatus.rs_rssi);
1075 
1076 	last_rssi = priv->rx.last_rssi;
1077 
1078 	if (ieee80211_is_beacon(hdr->frame_control) &&
1079 	    !is_zero_ether_addr(common->curbssid) &&
1080 	    ether_addr_equal(hdr->addr3, common->curbssid)) {
1081 		s8 rssi = rxbuf->rxstatus.rs_rssi;
1082 
1083 		if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
1084 			rssi = ATH_EP_RND(last_rssi, ATH_RSSI_EP_MULTIPLIER);
1085 
1086 		if (rssi < 0)
1087 			rssi = 0;
1088 
1089 		priv->ah->stats.avgbrssi = rssi;
1090 	}
1091 
1092 	rx_status->mactime = be64_to_cpu(rxbuf->rxstatus.rs_tstamp);
1093 	rx_status->band = hw->conf.chandef.chan->band;
1094 	rx_status->freq = hw->conf.chandef.chan->center_freq;
1095 	rx_status->signal =  rxbuf->rxstatus.rs_rssi + ATH_DEFAULT_NOISE_FLOOR;
1096 	rx_status->antenna = rxbuf->rxstatus.rs_antenna;
1097 	rx_status->flag |= RX_FLAG_MACTIME_END;
1098 
1099 	return true;
1100 
1101 rx_next:
1102 	return false;
1103 }
1104 
1105 /*
1106  * FIXME: Handle FLUSH later on.
1107  */
1108 void ath9k_rx_tasklet(unsigned long data)
1109 {
1110 	struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *)data;
1111 	struct ath9k_htc_rxbuf *rxbuf = NULL, *tmp_buf = NULL;
1112 	struct ieee80211_rx_status rx_status;
1113 	struct sk_buff *skb;
1114 	unsigned long flags;
1115 	struct ieee80211_hdr *hdr;
1116 
1117 	do {
1118 		spin_lock_irqsave(&priv->rx.rxbuflock, flags);
1119 		list_for_each_entry(tmp_buf, &priv->rx.rxbuf, list) {
1120 			if (tmp_buf->in_process) {
1121 				rxbuf = tmp_buf;
1122 				break;
1123 			}
1124 		}
1125 
1126 		if (rxbuf == NULL) {
1127 			spin_unlock_irqrestore(&priv->rx.rxbuflock, flags);
1128 			break;
1129 		}
1130 
1131 		if (!rxbuf->skb)
1132 			goto requeue;
1133 
1134 		if (!ath9k_rx_prepare(priv, rxbuf, &rx_status)) {
1135 			dev_kfree_skb_any(rxbuf->skb);
1136 			goto requeue;
1137 		}
1138 
1139 		memcpy(IEEE80211_SKB_RXCB(rxbuf->skb), &rx_status,
1140 		       sizeof(struct ieee80211_rx_status));
1141 		skb = rxbuf->skb;
1142 		hdr = (struct ieee80211_hdr *) skb->data;
1143 
1144 		if (ieee80211_is_beacon(hdr->frame_control) && priv->ps_enabled)
1145 				ieee80211_queue_work(priv->hw, &priv->ps_work);
1146 
1147 		spin_unlock_irqrestore(&priv->rx.rxbuflock, flags);
1148 
1149 		ieee80211_rx(priv->hw, skb);
1150 
1151 		spin_lock_irqsave(&priv->rx.rxbuflock, flags);
1152 requeue:
1153 		rxbuf->in_process = false;
1154 		rxbuf->skb = NULL;
1155 		list_move_tail(&rxbuf->list, &priv->rx.rxbuf);
1156 		rxbuf = NULL;
1157 		spin_unlock_irqrestore(&priv->rx.rxbuflock, flags);
1158 	} while (1);
1159 
1160 }
1161 
1162 void ath9k_htc_rxep(void *drv_priv, struct sk_buff *skb,
1163 		    enum htc_endpoint_id ep_id)
1164 {
1165 	struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *)drv_priv;
1166 	struct ath_hw *ah = priv->ah;
1167 	struct ath_common *common = ath9k_hw_common(ah);
1168 	struct ath9k_htc_rxbuf *rxbuf = NULL, *tmp_buf = NULL;
1169 
1170 	spin_lock(&priv->rx.rxbuflock);
1171 	list_for_each_entry(tmp_buf, &priv->rx.rxbuf, list) {
1172 		if (!tmp_buf->in_process) {
1173 			rxbuf = tmp_buf;
1174 			break;
1175 		}
1176 	}
1177 	spin_unlock(&priv->rx.rxbuflock);
1178 
1179 	if (rxbuf == NULL) {
1180 		ath_dbg(common, ANY, "No free RX buffer\n");
1181 		goto err;
1182 	}
1183 
1184 	spin_lock(&priv->rx.rxbuflock);
1185 	rxbuf->skb = skb;
1186 	rxbuf->in_process = true;
1187 	spin_unlock(&priv->rx.rxbuflock);
1188 
1189 	tasklet_schedule(&priv->rx_tasklet);
1190 	return;
1191 err:
1192 	dev_kfree_skb_any(skb);
1193 }
1194 
1195 /* FIXME: Locking for cleanup/init */
1196 
1197 void ath9k_rx_cleanup(struct ath9k_htc_priv *priv)
1198 {
1199 	struct ath9k_htc_rxbuf *rxbuf, *tbuf;
1200 
1201 	list_for_each_entry_safe(rxbuf, tbuf, &priv->rx.rxbuf, list) {
1202 		list_del(&rxbuf->list);
1203 		if (rxbuf->skb)
1204 			dev_kfree_skb_any(rxbuf->skb);
1205 		kfree(rxbuf);
1206 	}
1207 }
1208 
1209 int ath9k_rx_init(struct ath9k_htc_priv *priv)
1210 {
1211 	int i = 0;
1212 
1213 	INIT_LIST_HEAD(&priv->rx.rxbuf);
1214 	spin_lock_init(&priv->rx.rxbuflock);
1215 
1216 	for (i = 0; i < ATH9K_HTC_RXBUF; i++) {
1217 		struct ath9k_htc_rxbuf *rxbuf =
1218 			kzalloc(sizeof(struct ath9k_htc_rxbuf), GFP_KERNEL);
1219 		if (rxbuf == NULL)
1220 			goto err;
1221 
1222 		list_add_tail(&rxbuf->list, &priv->rx.rxbuf);
1223 	}
1224 
1225 	return 0;
1226 
1227 err:
1228 	ath9k_rx_cleanup(priv);
1229 	return -ENOMEM;
1230 }
1231