1 /*
2  * Atheros CARL9170 driver
3  *
4  * mac80211 interaction code
5  *
6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
7  * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License as published by
11  * the Free Software Foundation; either version 2 of the License, or
12  * (at your option) any later version.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License
20  * along with this program; see the file COPYING.  If not, see
21  * http://www.gnu.org/licenses/.
22  *
23  * This file incorporates work covered by the following copyright and
24  * permission notice:
25  *    Copyright (c) 2007-2008 Atheros Communications, Inc.
26  *
27  *    Permission to use, copy, modify, and/or distribute this software for any
28  *    purpose with or without fee is hereby granted, provided that the above
29  *    copyright notice and this permission notice appear in all copies.
30  *
31  *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
32  *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
33  *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
34  *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
35  *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
36  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
37  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
38  */
39 
40 #include <linux/init.h>
41 #include <linux/slab.h>
42 #include <linux/module.h>
43 #include <linux/etherdevice.h>
44 #include <linux/random.h>
45 #include <net/mac80211.h>
46 #include <net/cfg80211.h>
47 #include "hw.h"
48 #include "carl9170.h"
49 #include "cmd.h"
50 
51 static bool modparam_nohwcrypt;
52 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
53 MODULE_PARM_DESC(nohwcrypt, "Disable hardware crypto offload.");
54 
55 int modparam_noht;
56 module_param_named(noht, modparam_noht, int, S_IRUGO);
57 MODULE_PARM_DESC(noht, "Disable MPDU aggregation.");
58 
59 #define RATE(_bitrate, _hw_rate, _txpidx, _flags) {	\
60 	.bitrate	= (_bitrate),			\
61 	.flags		= (_flags),			\
62 	.hw_value	= (_hw_rate) | (_txpidx) << 4,	\
63 }
64 
65 struct ieee80211_rate __carl9170_ratetable[] = {
66 	RATE(10, 0, 0, 0),
67 	RATE(20, 1, 1, IEEE80211_RATE_SHORT_PREAMBLE),
68 	RATE(55, 2, 2, IEEE80211_RATE_SHORT_PREAMBLE),
69 	RATE(110, 3, 3, IEEE80211_RATE_SHORT_PREAMBLE),
70 	RATE(60, 0xb, 0, 0),
71 	RATE(90, 0xf, 0, 0),
72 	RATE(120, 0xa, 0, 0),
73 	RATE(180, 0xe, 0, 0),
74 	RATE(240, 0x9, 0, 0),
75 	RATE(360, 0xd, 1, 0),
76 	RATE(480, 0x8, 2, 0),
77 	RATE(540, 0xc, 3, 0),
78 };
79 #undef RATE
80 
81 #define carl9170_g_ratetable	(__carl9170_ratetable + 0)
82 #define carl9170_g_ratetable_size	12
83 #define carl9170_a_ratetable	(__carl9170_ratetable + 4)
84 #define carl9170_a_ratetable_size	8
85 
86 /*
87  * NB: The hw_value is used as an index into the carl9170_phy_freq_params
88  *     array in phy.c so that we don't have to do frequency lookups!
89  */
90 #define CHAN(_freq, _idx) {		\
91 	.center_freq	= (_freq),	\
92 	.hw_value	= (_idx),	\
93 	.max_power	= 18, /* XXX */	\
94 }
95 
96 static struct ieee80211_channel carl9170_2ghz_chantable[] = {
97 	CHAN(2412,  0),
98 	CHAN(2417,  1),
99 	CHAN(2422,  2),
100 	CHAN(2427,  3),
101 	CHAN(2432,  4),
102 	CHAN(2437,  5),
103 	CHAN(2442,  6),
104 	CHAN(2447,  7),
105 	CHAN(2452,  8),
106 	CHAN(2457,  9),
107 	CHAN(2462, 10),
108 	CHAN(2467, 11),
109 	CHAN(2472, 12),
110 	CHAN(2484, 13),
111 };
112 
113 static struct ieee80211_channel carl9170_5ghz_chantable[] = {
114 	CHAN(4920, 14),
115 	CHAN(4940, 15),
116 	CHAN(4960, 16),
117 	CHAN(4980, 17),
118 	CHAN(5040, 18),
119 	CHAN(5060, 19),
120 	CHAN(5080, 20),
121 	CHAN(5180, 21),
122 	CHAN(5200, 22),
123 	CHAN(5220, 23),
124 	CHAN(5240, 24),
125 	CHAN(5260, 25),
126 	CHAN(5280, 26),
127 	CHAN(5300, 27),
128 	CHAN(5320, 28),
129 	CHAN(5500, 29),
130 	CHAN(5520, 30),
131 	CHAN(5540, 31),
132 	CHAN(5560, 32),
133 	CHAN(5580, 33),
134 	CHAN(5600, 34),
135 	CHAN(5620, 35),
136 	CHAN(5640, 36),
137 	CHAN(5660, 37),
138 	CHAN(5680, 38),
139 	CHAN(5700, 39),
140 	CHAN(5745, 40),
141 	CHAN(5765, 41),
142 	CHAN(5785, 42),
143 	CHAN(5805, 43),
144 	CHAN(5825, 44),
145 	CHAN(5170, 45),
146 	CHAN(5190, 46),
147 	CHAN(5210, 47),
148 	CHAN(5230, 48),
149 };
150 #undef CHAN
151 
152 #define CARL9170_HT_CAP							\
153 {									\
154 	.ht_supported	= true,						\
155 	.cap		= IEEE80211_HT_CAP_MAX_AMSDU |			\
156 			  IEEE80211_HT_CAP_SUP_WIDTH_20_40 |		\
157 			  IEEE80211_HT_CAP_SGI_40 |			\
158 			  IEEE80211_HT_CAP_DSSSCCK40 |			\
159 			  IEEE80211_HT_CAP_SM_PS,			\
160 	.ampdu_factor	= IEEE80211_HT_MAX_AMPDU_64K,			\
161 	.ampdu_density	= IEEE80211_HT_MPDU_DENSITY_8,			\
162 	.mcs		= {						\
163 		.rx_mask = { 0xff, 0xff, 0, 0, 0x1, 0, 0, 0, 0, 0, },	\
164 		.rx_highest = cpu_to_le16(300),				\
165 		.tx_params = IEEE80211_HT_MCS_TX_DEFINED,		\
166 	},								\
167 }
168 
169 static struct ieee80211_supported_band carl9170_band_2GHz = {
170 	.channels	= carl9170_2ghz_chantable,
171 	.n_channels	= ARRAY_SIZE(carl9170_2ghz_chantable),
172 	.bitrates	= carl9170_g_ratetable,
173 	.n_bitrates	= carl9170_g_ratetable_size,
174 	.ht_cap		= CARL9170_HT_CAP,
175 };
176 
177 static struct ieee80211_supported_band carl9170_band_5GHz = {
178 	.channels	= carl9170_5ghz_chantable,
179 	.n_channels	= ARRAY_SIZE(carl9170_5ghz_chantable),
180 	.bitrates	= carl9170_a_ratetable,
181 	.n_bitrates	= carl9170_a_ratetable_size,
182 	.ht_cap		= CARL9170_HT_CAP,
183 };
184 
185 static void carl9170_ampdu_gc(struct ar9170 *ar)
186 {
187 	struct carl9170_sta_tid *tid_info;
188 	LIST_HEAD(tid_gc);
189 
190 	rcu_read_lock();
191 	list_for_each_entry_rcu(tid_info, &ar->tx_ampdu_list, list) {
192 		spin_lock_bh(&ar->tx_ampdu_list_lock);
193 		if (tid_info->state == CARL9170_TID_STATE_SHUTDOWN) {
194 			tid_info->state = CARL9170_TID_STATE_KILLED;
195 			list_del_rcu(&tid_info->list);
196 			ar->tx_ampdu_list_len--;
197 			list_add_tail(&tid_info->tmp_list, &tid_gc);
198 		}
199 		spin_unlock_bh(&ar->tx_ampdu_list_lock);
200 
201 	}
202 	rcu_assign_pointer(ar->tx_ampdu_iter, tid_info);
203 	rcu_read_unlock();
204 
205 	synchronize_rcu();
206 
207 	while (!list_empty(&tid_gc)) {
208 		struct sk_buff *skb;
209 		tid_info = list_first_entry(&tid_gc, struct carl9170_sta_tid,
210 					    tmp_list);
211 
212 		while ((skb = __skb_dequeue(&tid_info->queue)))
213 			carl9170_tx_status(ar, skb, false);
214 
215 		list_del_init(&tid_info->tmp_list);
216 		kfree(tid_info);
217 	}
218 }
219 
220 static void carl9170_flush(struct ar9170 *ar, bool drop_queued)
221 {
222 	if (drop_queued) {
223 		int i;
224 
225 		/*
226 		 * We can only drop frames which have not been uploaded
227 		 * to the device yet.
228 		 */
229 
230 		for (i = 0; i < ar->hw->queues; i++) {
231 			struct sk_buff *skb;
232 
233 			while ((skb = skb_dequeue(&ar->tx_pending[i]))) {
234 				struct ieee80211_tx_info *info;
235 
236 				info = IEEE80211_SKB_CB(skb);
237 				if (info->flags & IEEE80211_TX_CTL_AMPDU)
238 					atomic_dec(&ar->tx_ampdu_upload);
239 
240 				carl9170_tx_status(ar, skb, false);
241 			}
242 		}
243 	}
244 
245 	/* Wait for all other outstanding frames to timeout. */
246 	if (atomic_read(&ar->tx_total_queued))
247 		WARN_ON(wait_for_completion_timeout(&ar->tx_flush, HZ) == 0);
248 }
249 
250 static void carl9170_flush_ba(struct ar9170 *ar)
251 {
252 	struct sk_buff_head free;
253 	struct carl9170_sta_tid *tid_info;
254 	struct sk_buff *skb;
255 
256 	__skb_queue_head_init(&free);
257 
258 	rcu_read_lock();
259 	spin_lock_bh(&ar->tx_ampdu_list_lock);
260 	list_for_each_entry_rcu(tid_info, &ar->tx_ampdu_list, list) {
261 		if (tid_info->state > CARL9170_TID_STATE_SUSPEND) {
262 			tid_info->state = CARL9170_TID_STATE_SUSPEND;
263 
264 			spin_lock(&tid_info->lock);
265 			while ((skb = __skb_dequeue(&tid_info->queue)))
266 				__skb_queue_tail(&free, skb);
267 			spin_unlock(&tid_info->lock);
268 		}
269 	}
270 	spin_unlock_bh(&ar->tx_ampdu_list_lock);
271 	rcu_read_unlock();
272 
273 	while ((skb = __skb_dequeue(&free)))
274 		carl9170_tx_status(ar, skb, false);
275 }
276 
277 static void carl9170_zap_queues(struct ar9170 *ar)
278 {
279 	struct carl9170_vif_info *cvif;
280 	unsigned int i;
281 
282 	carl9170_ampdu_gc(ar);
283 
284 	carl9170_flush_ba(ar);
285 	carl9170_flush(ar, true);
286 
287 	for (i = 0; i < ar->hw->queues; i++) {
288 		spin_lock_bh(&ar->tx_status[i].lock);
289 		while (!skb_queue_empty(&ar->tx_status[i])) {
290 			struct sk_buff *skb;
291 
292 			skb = skb_peek(&ar->tx_status[i]);
293 			carl9170_tx_get_skb(skb);
294 			spin_unlock_bh(&ar->tx_status[i].lock);
295 			carl9170_tx_drop(ar, skb);
296 			spin_lock_bh(&ar->tx_status[i].lock);
297 			carl9170_tx_put_skb(skb);
298 		}
299 		spin_unlock_bh(&ar->tx_status[i].lock);
300 	}
301 
302 	BUILD_BUG_ON(CARL9170_NUM_TX_LIMIT_SOFT < 1);
303 	BUILD_BUG_ON(CARL9170_NUM_TX_LIMIT_HARD < CARL9170_NUM_TX_LIMIT_SOFT);
304 	BUILD_BUG_ON(CARL9170_NUM_TX_LIMIT_HARD >= CARL9170_BAW_BITS);
305 
306 	/* reinitialize queues statistics */
307 	memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
308 	for (i = 0; i < ar->hw->queues; i++)
309 		ar->tx_stats[i].limit = CARL9170_NUM_TX_LIMIT_HARD;
310 
311 	for (i = 0; i < DIV_ROUND_UP(ar->fw.mem_blocks, BITS_PER_LONG); i++)
312 		ar->mem_bitmap[i] = 0;
313 
314 	rcu_read_lock();
315 	list_for_each_entry_rcu(cvif, &ar->vif_list, list) {
316 		spin_lock_bh(&ar->beacon_lock);
317 		dev_kfree_skb_any(cvif->beacon);
318 		cvif->beacon = NULL;
319 		spin_unlock_bh(&ar->beacon_lock);
320 	}
321 	rcu_read_unlock();
322 
323 	atomic_set(&ar->tx_ampdu_upload, 0);
324 	atomic_set(&ar->tx_ampdu_scheduler, 0);
325 	atomic_set(&ar->tx_total_pending, 0);
326 	atomic_set(&ar->tx_total_queued, 0);
327 	atomic_set(&ar->mem_free_blocks, ar->fw.mem_blocks);
328 }
329 
330 #define CARL9170_FILL_QUEUE(queue, ai_fs, cwmin, cwmax, _txop)		\
331 do {									\
332 	queue.aifs = ai_fs;						\
333 	queue.cw_min = cwmin;						\
334 	queue.cw_max = cwmax;						\
335 	queue.txop = _txop;						\
336 } while (0)
337 
338 static int carl9170_op_start(struct ieee80211_hw *hw)
339 {
340 	struct ar9170 *ar = hw->priv;
341 	int err, i;
342 
343 	mutex_lock(&ar->mutex);
344 
345 	carl9170_zap_queues(ar);
346 
347 	/* reset QoS defaults */
348 	CARL9170_FILL_QUEUE(ar->edcf[AR9170_TXQ_VO], 2, 3,     7, 47);
349 	CARL9170_FILL_QUEUE(ar->edcf[AR9170_TXQ_VI], 2, 7,    15, 94);
350 	CARL9170_FILL_QUEUE(ar->edcf[AR9170_TXQ_BE], 3, 15, 1023,  0);
351 	CARL9170_FILL_QUEUE(ar->edcf[AR9170_TXQ_BK], 7, 15, 1023,  0);
352 	CARL9170_FILL_QUEUE(ar->edcf[AR9170_TXQ_SPECIAL], 2, 3, 7, 0);
353 
354 	ar->current_factor = ar->current_density = -1;
355 	/* "The first key is unique." */
356 	ar->usedkeys = 1;
357 	ar->filter_state = 0;
358 	ar->ps.last_action = jiffies;
359 	ar->ps.last_slept = jiffies;
360 	ar->erp_mode = CARL9170_ERP_AUTO;
361 	ar->rx_software_decryption = false;
362 	ar->disable_offload = false;
363 
364 	for (i = 0; i < ar->hw->queues; i++) {
365 		ar->queue_stop_timeout[i] = jiffies;
366 		ar->max_queue_stop_timeout[i] = 0;
367 	}
368 
369 	atomic_set(&ar->mem_allocs, 0);
370 
371 	err = carl9170_usb_open(ar);
372 	if (err)
373 		goto out;
374 
375 	err = carl9170_init_mac(ar);
376 	if (err)
377 		goto out;
378 
379 	err = carl9170_set_qos(ar);
380 	if (err)
381 		goto out;
382 
383 	if (ar->fw.rx_filter) {
384 		err = carl9170_rx_filter(ar, CARL9170_RX_FILTER_OTHER_RA |
385 			CARL9170_RX_FILTER_CTL_OTHER | CARL9170_RX_FILTER_BAD);
386 		if (err)
387 			goto out;
388 	}
389 
390 	err = carl9170_write_reg(ar, AR9170_MAC_REG_DMA_TRIGGER,
391 				 AR9170_DMA_TRIGGER_RXQ);
392 	if (err)
393 		goto out;
394 
395 	/* Clear key-cache */
396 	for (i = 0; i < AR9170_CAM_MAX_USER + 4; i++) {
397 		err = carl9170_upload_key(ar, i, NULL, AR9170_ENC_ALG_NONE,
398 					  0, NULL, 0);
399 		if (err)
400 			goto out;
401 
402 		err = carl9170_upload_key(ar, i, NULL, AR9170_ENC_ALG_NONE,
403 					  1, NULL, 0);
404 		if (err)
405 			goto out;
406 
407 		if (i < AR9170_CAM_MAX_USER) {
408 			err = carl9170_disable_key(ar, i);
409 			if (err)
410 				goto out;
411 		}
412 	}
413 
414 	carl9170_set_state_when(ar, CARL9170_IDLE, CARL9170_STARTED);
415 
416 	ieee80211_queue_delayed_work(ar->hw, &ar->stat_work,
417 		round_jiffies(msecs_to_jiffies(CARL9170_STAT_WORK)));
418 
419 	ieee80211_wake_queues(ar->hw);
420 	err = 0;
421 
422 out:
423 	mutex_unlock(&ar->mutex);
424 	return err;
425 }
426 
427 static void carl9170_cancel_worker(struct ar9170 *ar)
428 {
429 	cancel_delayed_work_sync(&ar->stat_work);
430 	cancel_delayed_work_sync(&ar->tx_janitor);
431 #ifdef CONFIG_CARL9170_LEDS
432 	cancel_delayed_work_sync(&ar->led_work);
433 #endif /* CONFIG_CARL9170_LEDS */
434 	cancel_work_sync(&ar->ps_work);
435 	cancel_work_sync(&ar->ping_work);
436 	cancel_work_sync(&ar->ampdu_work);
437 }
438 
439 static void carl9170_op_stop(struct ieee80211_hw *hw)
440 {
441 	struct ar9170 *ar = hw->priv;
442 
443 	carl9170_set_state_when(ar, CARL9170_STARTED, CARL9170_IDLE);
444 
445 	ieee80211_stop_queues(ar->hw);
446 
447 	mutex_lock(&ar->mutex);
448 	if (IS_ACCEPTING_CMD(ar)) {
449 		RCU_INIT_POINTER(ar->beacon_iter, NULL);
450 
451 		carl9170_led_set_state(ar, 0);
452 
453 		/* stop DMA */
454 		carl9170_write_reg(ar, AR9170_MAC_REG_DMA_TRIGGER, 0);
455 		carl9170_usb_stop(ar);
456 	}
457 
458 	carl9170_zap_queues(ar);
459 	mutex_unlock(&ar->mutex);
460 
461 	carl9170_cancel_worker(ar);
462 }
463 
464 static void carl9170_restart_work(struct work_struct *work)
465 {
466 	struct ar9170 *ar = container_of(work, struct ar9170,
467 					 restart_work);
468 	int err;
469 
470 	ar->usedkeys = 0;
471 	ar->filter_state = 0;
472 	carl9170_cancel_worker(ar);
473 
474 	mutex_lock(&ar->mutex);
475 	err = carl9170_usb_restart(ar);
476 	if (net_ratelimit()) {
477 		if (err) {
478 			dev_err(&ar->udev->dev, "Failed to restart device "
479 				" (%d).\n", err);
480 		 } else {
481 			dev_info(&ar->udev->dev, "device restarted "
482 				 "successfully.\n");
483 		}
484 	}
485 
486 	carl9170_zap_queues(ar);
487 	mutex_unlock(&ar->mutex);
488 	if (!err) {
489 		ar->restart_counter++;
490 		atomic_set(&ar->pending_restarts, 0);
491 
492 		ieee80211_restart_hw(ar->hw);
493 	} else {
494 		/*
495 		 * The reset was unsuccessful and the device seems to
496 		 * be dead. But there's still one option: a low-level
497 		 * usb subsystem reset...
498 		 */
499 
500 		carl9170_usb_reset(ar);
501 	}
502 }
503 
504 void carl9170_restart(struct ar9170 *ar, const enum carl9170_restart_reasons r)
505 {
506 	carl9170_set_state_when(ar, CARL9170_STARTED, CARL9170_IDLE);
507 
508 	/*
509 	 * Sometimes, an error can trigger several different reset events.
510 	 * By ignoring these *surplus* reset events, the device won't be
511 	 * killed again, right after it has recovered.
512 	 */
513 	if (atomic_inc_return(&ar->pending_restarts) > 1) {
514 		dev_dbg(&ar->udev->dev, "ignoring restart (%d)\n", r);
515 		return;
516 	}
517 
518 	ieee80211_stop_queues(ar->hw);
519 
520 	dev_err(&ar->udev->dev, "restart device (%d)\n", r);
521 
522 	if (!WARN_ON(r == CARL9170_RR_NO_REASON) ||
523 	    !WARN_ON(r >= __CARL9170_RR_LAST))
524 		ar->last_reason = r;
525 
526 	if (!ar->registered)
527 		return;
528 
529 	if (IS_ACCEPTING_CMD(ar) && !ar->needs_full_reset)
530 		ieee80211_queue_work(ar->hw, &ar->restart_work);
531 	else
532 		carl9170_usb_reset(ar);
533 
534 	/*
535 	 * At this point, the device instance might have vanished/disabled.
536 	 * So, don't put any code which access the ar9170 struct
537 	 * without proper protection.
538 	 */
539 }
540 
541 static void carl9170_ping_work(struct work_struct *work)
542 {
543 	struct ar9170 *ar = container_of(work, struct ar9170, ping_work);
544 	int err;
545 
546 	if (!IS_STARTED(ar))
547 		return;
548 
549 	mutex_lock(&ar->mutex);
550 	err = carl9170_echo_test(ar, 0xdeadbeef);
551 	if (err)
552 		carl9170_restart(ar, CARL9170_RR_UNRESPONSIVE_DEVICE);
553 	mutex_unlock(&ar->mutex);
554 }
555 
556 static int carl9170_init_interface(struct ar9170 *ar,
557 				   struct ieee80211_vif *vif)
558 {
559 	struct ath_common *common = &ar->common;
560 	int err;
561 
562 	if (!vif) {
563 		WARN_ON_ONCE(IS_STARTED(ar));
564 		return 0;
565 	}
566 
567 	memcpy(common->macaddr, vif->addr, ETH_ALEN);
568 
569 	if (modparam_nohwcrypt ||
570 	    ((vif->type != NL80211_IFTYPE_STATION) &&
571 	     (vif->type != NL80211_IFTYPE_AP))) {
572 		ar->rx_software_decryption = true;
573 		ar->disable_offload = true;
574 	}
575 
576 	err = carl9170_set_operating_mode(ar);
577 	return err;
578 }
579 
580 static int carl9170_op_add_interface(struct ieee80211_hw *hw,
581 				     struct ieee80211_vif *vif)
582 {
583 	struct carl9170_vif_info *vif_priv = (void *) vif->drv_priv;
584 	struct ieee80211_vif *main_vif;
585 	struct ar9170 *ar = hw->priv;
586 	int vif_id = -1, err = 0;
587 
588 	mutex_lock(&ar->mutex);
589 	rcu_read_lock();
590 	if (vif_priv->active) {
591 		/*
592 		 * Skip the interface structure initialization,
593 		 * if the vif survived the _restart call.
594 		 */
595 		vif_id = vif_priv->id;
596 		vif_priv->enable_beacon = false;
597 
598 		spin_lock_bh(&ar->beacon_lock);
599 		dev_kfree_skb_any(vif_priv->beacon);
600 		vif_priv->beacon = NULL;
601 		spin_unlock_bh(&ar->beacon_lock);
602 
603 		goto init;
604 	}
605 
606 	main_vif = carl9170_get_main_vif(ar);
607 
608 	if (main_vif) {
609 		switch (main_vif->type) {
610 		case NL80211_IFTYPE_STATION:
611 			if (vif->type == NL80211_IFTYPE_STATION)
612 				break;
613 
614 			err = -EBUSY;
615 			rcu_read_unlock();
616 
617 			goto unlock;
618 
619 		case NL80211_IFTYPE_AP:
620 			if ((vif->type == NL80211_IFTYPE_STATION) ||
621 			    (vif->type == NL80211_IFTYPE_WDS) ||
622 			    (vif->type == NL80211_IFTYPE_AP))
623 				break;
624 
625 			err = -EBUSY;
626 			rcu_read_unlock();
627 			goto unlock;
628 
629 		default:
630 			rcu_read_unlock();
631 			goto unlock;
632 		}
633 	}
634 
635 	vif_id = bitmap_find_free_region(&ar->vif_bitmap, ar->fw.vif_num, 0);
636 
637 	if (vif_id < 0) {
638 		rcu_read_unlock();
639 
640 		err = -ENOSPC;
641 		goto unlock;
642 	}
643 
644 	BUG_ON(ar->vif_priv[vif_id].id != vif_id);
645 
646 	vif_priv->active = true;
647 	vif_priv->id = vif_id;
648 	vif_priv->enable_beacon = false;
649 	ar->vifs++;
650 	list_add_tail_rcu(&vif_priv->list, &ar->vif_list);
651 	rcu_assign_pointer(ar->vif_priv[vif_id].vif, vif);
652 
653 init:
654 	if (carl9170_get_main_vif(ar) == vif) {
655 		rcu_assign_pointer(ar->beacon_iter, vif_priv);
656 		rcu_read_unlock();
657 
658 		err = carl9170_init_interface(ar, vif);
659 		if (err)
660 			goto unlock;
661 	} else {
662 		rcu_read_unlock();
663 		err = carl9170_mod_virtual_mac(ar, vif_id, vif->addr);
664 
665 		if (err)
666 			goto unlock;
667 	}
668 
669 	if (ar->fw.tx_seq_table) {
670 		err = carl9170_write_reg(ar, ar->fw.tx_seq_table + vif_id * 4,
671 					 0);
672 		if (err)
673 			goto unlock;
674 	}
675 
676 unlock:
677 	if (err && (vif_id >= 0)) {
678 		vif_priv->active = false;
679 		bitmap_release_region(&ar->vif_bitmap, vif_id, 0);
680 		ar->vifs--;
681 		RCU_INIT_POINTER(ar->vif_priv[vif_id].vif, NULL);
682 		list_del_rcu(&vif_priv->list);
683 		mutex_unlock(&ar->mutex);
684 		synchronize_rcu();
685 	} else {
686 		if (ar->vifs > 1)
687 			ar->ps.off_override |= PS_OFF_VIF;
688 
689 		mutex_unlock(&ar->mutex);
690 	}
691 
692 	return err;
693 }
694 
695 static void carl9170_op_remove_interface(struct ieee80211_hw *hw,
696 					 struct ieee80211_vif *vif)
697 {
698 	struct carl9170_vif_info *vif_priv = (void *) vif->drv_priv;
699 	struct ieee80211_vif *main_vif;
700 	struct ar9170 *ar = hw->priv;
701 	unsigned int id;
702 
703 	mutex_lock(&ar->mutex);
704 
705 	if (WARN_ON_ONCE(!vif_priv->active))
706 		goto unlock;
707 
708 	ar->vifs--;
709 
710 	rcu_read_lock();
711 	main_vif = carl9170_get_main_vif(ar);
712 
713 	id = vif_priv->id;
714 
715 	vif_priv->active = false;
716 	WARN_ON(vif_priv->enable_beacon);
717 	vif_priv->enable_beacon = false;
718 	list_del_rcu(&vif_priv->list);
719 	RCU_INIT_POINTER(ar->vif_priv[id].vif, NULL);
720 
721 	if (vif == main_vif) {
722 		rcu_read_unlock();
723 
724 		if (ar->vifs) {
725 			WARN_ON(carl9170_init_interface(ar,
726 					carl9170_get_main_vif(ar)));
727 		} else {
728 			carl9170_set_operating_mode(ar);
729 		}
730 	} else {
731 		rcu_read_unlock();
732 
733 		WARN_ON(carl9170_mod_virtual_mac(ar, id, NULL));
734 	}
735 
736 	carl9170_update_beacon(ar, false);
737 	carl9170_flush_cab(ar, id);
738 
739 	spin_lock_bh(&ar->beacon_lock);
740 	dev_kfree_skb_any(vif_priv->beacon);
741 	vif_priv->beacon = NULL;
742 	spin_unlock_bh(&ar->beacon_lock);
743 
744 	bitmap_release_region(&ar->vif_bitmap, id, 0);
745 
746 	carl9170_set_beacon_timers(ar);
747 
748 	if (ar->vifs == 1)
749 		ar->ps.off_override &= ~PS_OFF_VIF;
750 
751 unlock:
752 	mutex_unlock(&ar->mutex);
753 
754 	synchronize_rcu();
755 }
756 
757 void carl9170_ps_check(struct ar9170 *ar)
758 {
759 	ieee80211_queue_work(ar->hw, &ar->ps_work);
760 }
761 
762 /* caller must hold ar->mutex */
763 static int carl9170_ps_update(struct ar9170 *ar)
764 {
765 	bool ps = false;
766 	int err = 0;
767 
768 	if (!ar->ps.off_override)
769 		ps = (ar->hw->conf.flags & IEEE80211_CONF_PS);
770 
771 	if (ps != ar->ps.state) {
772 		err = carl9170_powersave(ar, ps);
773 		if (err)
774 			return err;
775 
776 		if (ar->ps.state && !ps) {
777 			ar->ps.sleep_ms = jiffies_to_msecs(jiffies -
778 				ar->ps.last_action);
779 		}
780 
781 		if (ps)
782 			ar->ps.last_slept = jiffies;
783 
784 		ar->ps.last_action = jiffies;
785 		ar->ps.state = ps;
786 	}
787 
788 	return 0;
789 }
790 
791 static void carl9170_ps_work(struct work_struct *work)
792 {
793 	struct ar9170 *ar = container_of(work, struct ar9170,
794 					 ps_work);
795 	mutex_lock(&ar->mutex);
796 	if (IS_STARTED(ar))
797 		WARN_ON_ONCE(carl9170_ps_update(ar) != 0);
798 	mutex_unlock(&ar->mutex);
799 }
800 
801 static int carl9170_update_survey(struct ar9170 *ar, bool flush, bool noise)
802 {
803 	int err;
804 
805 	if (noise) {
806 		err = carl9170_get_noisefloor(ar);
807 		if (err)
808 			return err;
809 	}
810 
811 	if (ar->fw.hw_counters) {
812 		err = carl9170_collect_tally(ar);
813 		if (err)
814 			return err;
815 	}
816 
817 	if (flush)
818 		memset(&ar->tally, 0, sizeof(ar->tally));
819 
820 	return 0;
821 }
822 
823 static void carl9170_stat_work(struct work_struct *work)
824 {
825 	struct ar9170 *ar = container_of(work, struct ar9170, stat_work.work);
826 	int err;
827 
828 	mutex_lock(&ar->mutex);
829 	err = carl9170_update_survey(ar, false, true);
830 	mutex_unlock(&ar->mutex);
831 
832 	if (err)
833 		return;
834 
835 	ieee80211_queue_delayed_work(ar->hw, &ar->stat_work,
836 		round_jiffies(msecs_to_jiffies(CARL9170_STAT_WORK)));
837 }
838 
839 static int carl9170_op_config(struct ieee80211_hw *hw, u32 changed)
840 {
841 	struct ar9170 *ar = hw->priv;
842 	int err = 0;
843 
844 	mutex_lock(&ar->mutex);
845 	if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
846 		/* TODO */
847 		err = 0;
848 	}
849 
850 	if (changed & IEEE80211_CONF_CHANGE_PS) {
851 		err = carl9170_ps_update(ar);
852 		if (err)
853 			goto out;
854 	}
855 
856 	if (changed & IEEE80211_CONF_CHANGE_SMPS) {
857 		/* TODO */
858 		err = 0;
859 	}
860 
861 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
862 		/* adjust slot time for 5 GHz */
863 		err = carl9170_set_slot_time(ar);
864 		if (err)
865 			goto out;
866 
867 		err = carl9170_update_survey(ar, true, false);
868 		if (err)
869 			goto out;
870 
871 		err = carl9170_set_channel(ar, hw->conf.channel,
872 			hw->conf.channel_type, CARL9170_RFI_NONE);
873 		if (err)
874 			goto out;
875 
876 		err = carl9170_update_survey(ar, false, true);
877 		if (err)
878 			goto out;
879 
880 		err = carl9170_set_dyn_sifs_ack(ar);
881 		if (err)
882 			goto out;
883 
884 		err = carl9170_set_rts_cts_rate(ar);
885 		if (err)
886 			goto out;
887 	}
888 
889 	if (changed & IEEE80211_CONF_CHANGE_POWER) {
890 		err = carl9170_set_mac_tpc(ar, ar->hw->conf.channel);
891 		if (err)
892 			goto out;
893 	}
894 
895 out:
896 	mutex_unlock(&ar->mutex);
897 	return err;
898 }
899 
900 static u64 carl9170_op_prepare_multicast(struct ieee80211_hw *hw,
901 					 struct netdev_hw_addr_list *mc_list)
902 {
903 	struct netdev_hw_addr *ha;
904 	u64 mchash;
905 
906 	/* always get broadcast frames */
907 	mchash = 1ULL << (0xff >> 2);
908 
909 	netdev_hw_addr_list_for_each(ha, mc_list)
910 		mchash |= 1ULL << (ha->addr[5] >> 2);
911 
912 	return mchash;
913 }
914 
915 static void carl9170_op_configure_filter(struct ieee80211_hw *hw,
916 					 unsigned int changed_flags,
917 					 unsigned int *new_flags,
918 					 u64 multicast)
919 {
920 	struct ar9170 *ar = hw->priv;
921 
922 	/* mask supported flags */
923 	*new_flags &= FIF_ALLMULTI | ar->rx_filter_caps;
924 
925 	if (!IS_ACCEPTING_CMD(ar))
926 		return;
927 
928 	mutex_lock(&ar->mutex);
929 
930 	ar->filter_state = *new_flags;
931 	/*
932 	 * We can support more by setting the sniffer bit and
933 	 * then checking the error flags, later.
934 	 */
935 
936 	if (*new_flags & FIF_ALLMULTI)
937 		multicast = ~0ULL;
938 
939 	if (multicast != ar->cur_mc_hash)
940 		WARN_ON(carl9170_update_multicast(ar, multicast));
941 
942 	if (changed_flags & (FIF_OTHER_BSS | FIF_PROMISC_IN_BSS)) {
943 		ar->sniffer_enabled = !!(*new_flags &
944 			(FIF_OTHER_BSS | FIF_PROMISC_IN_BSS));
945 
946 		WARN_ON(carl9170_set_operating_mode(ar));
947 	}
948 
949 	if (ar->fw.rx_filter && changed_flags & ar->rx_filter_caps) {
950 		u32 rx_filter = 0;
951 
952 		if (!ar->fw.ba_filter)
953 			rx_filter |= CARL9170_RX_FILTER_CTL_OTHER;
954 
955 		if (!(*new_flags & (FIF_FCSFAIL | FIF_PLCPFAIL)))
956 			rx_filter |= CARL9170_RX_FILTER_BAD;
957 
958 		if (!(*new_flags & FIF_CONTROL))
959 			rx_filter |= CARL9170_RX_FILTER_CTL_OTHER;
960 
961 		if (!(*new_flags & FIF_PSPOLL))
962 			rx_filter |= CARL9170_RX_FILTER_CTL_PSPOLL;
963 
964 		if (!(*new_flags & (FIF_OTHER_BSS | FIF_PROMISC_IN_BSS))) {
965 			rx_filter |= CARL9170_RX_FILTER_OTHER_RA;
966 			rx_filter |= CARL9170_RX_FILTER_DECRY_FAIL;
967 		}
968 
969 		WARN_ON(carl9170_rx_filter(ar, rx_filter));
970 	}
971 
972 	mutex_unlock(&ar->mutex);
973 }
974 
975 
976 static void carl9170_op_bss_info_changed(struct ieee80211_hw *hw,
977 					 struct ieee80211_vif *vif,
978 					 struct ieee80211_bss_conf *bss_conf,
979 					 u32 changed)
980 {
981 	struct ar9170 *ar = hw->priv;
982 	struct ath_common *common = &ar->common;
983 	int err = 0;
984 	struct carl9170_vif_info *vif_priv;
985 	struct ieee80211_vif *main_vif;
986 
987 	mutex_lock(&ar->mutex);
988 	vif_priv = (void *) vif->drv_priv;
989 	main_vif = carl9170_get_main_vif(ar);
990 	if (WARN_ON(!main_vif))
991 		goto out;
992 
993 	if (changed & BSS_CHANGED_BEACON_ENABLED) {
994 		struct carl9170_vif_info *iter;
995 		int i = 0;
996 
997 		vif_priv->enable_beacon = bss_conf->enable_beacon;
998 		rcu_read_lock();
999 		list_for_each_entry_rcu(iter, &ar->vif_list, list) {
1000 			if (iter->active && iter->enable_beacon)
1001 				i++;
1002 
1003 		}
1004 		rcu_read_unlock();
1005 
1006 		ar->beacon_enabled = i;
1007 	}
1008 
1009 	if (changed & BSS_CHANGED_BEACON) {
1010 		err = carl9170_update_beacon(ar, false);
1011 		if (err)
1012 			goto out;
1013 	}
1014 
1015 	if (changed & (BSS_CHANGED_BEACON_ENABLED | BSS_CHANGED_BEACON |
1016 		       BSS_CHANGED_BEACON_INT)) {
1017 
1018 		if (main_vif != vif) {
1019 			bss_conf->beacon_int = main_vif->bss_conf.beacon_int;
1020 			bss_conf->dtim_period = main_vif->bss_conf.dtim_period;
1021 		}
1022 
1023 		/*
1024 		 * Therefore a hard limit for the broadcast traffic should
1025 		 * prevent false alarms.
1026 		 */
1027 		if (vif->type != NL80211_IFTYPE_STATION &&
1028 		    (bss_conf->beacon_int * bss_conf->dtim_period >=
1029 		     (CARL9170_QUEUE_STUCK_TIMEOUT / 2))) {
1030 			err = -EINVAL;
1031 			goto out;
1032 		}
1033 
1034 		err = carl9170_set_beacon_timers(ar);
1035 		if (err)
1036 			goto out;
1037 	}
1038 
1039 	if (changed & BSS_CHANGED_HT) {
1040 		/* TODO */
1041 		err = 0;
1042 		if (err)
1043 			goto out;
1044 	}
1045 
1046 	if (main_vif != vif)
1047 		goto out;
1048 
1049 	/*
1050 	 * The following settings can only be changed by the
1051 	 * master interface.
1052 	 */
1053 
1054 	if (changed & BSS_CHANGED_BSSID) {
1055 		memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
1056 		err = carl9170_set_operating_mode(ar);
1057 		if (err)
1058 			goto out;
1059 	}
1060 
1061 	if (changed & BSS_CHANGED_ASSOC) {
1062 		ar->common.curaid = bss_conf->aid;
1063 		err = carl9170_set_beacon_timers(ar);
1064 		if (err)
1065 			goto out;
1066 	}
1067 
1068 	if (changed & BSS_CHANGED_ERP_SLOT) {
1069 		err = carl9170_set_slot_time(ar);
1070 		if (err)
1071 			goto out;
1072 	}
1073 
1074 	if (changed & BSS_CHANGED_BASIC_RATES) {
1075 		err = carl9170_set_mac_rates(ar);
1076 		if (err)
1077 			goto out;
1078 	}
1079 
1080 out:
1081 	WARN_ON_ONCE(err && IS_STARTED(ar));
1082 	mutex_unlock(&ar->mutex);
1083 }
1084 
1085 static u64 carl9170_op_get_tsf(struct ieee80211_hw *hw,
1086 			       struct ieee80211_vif *vif)
1087 {
1088 	struct ar9170 *ar = hw->priv;
1089 	struct carl9170_tsf_rsp tsf;
1090 	int err;
1091 
1092 	mutex_lock(&ar->mutex);
1093 	err = carl9170_exec_cmd(ar, CARL9170_CMD_READ_TSF,
1094 				0, NULL, sizeof(tsf), &tsf);
1095 	mutex_unlock(&ar->mutex);
1096 	if (WARN_ON(err))
1097 		return 0;
1098 
1099 	return le64_to_cpu(tsf.tsf_64);
1100 }
1101 
1102 static int carl9170_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
1103 			       struct ieee80211_vif *vif,
1104 			       struct ieee80211_sta *sta,
1105 			       struct ieee80211_key_conf *key)
1106 {
1107 	struct ar9170 *ar = hw->priv;
1108 	int err = 0, i;
1109 	u8 ktype;
1110 
1111 	if (ar->disable_offload || !vif)
1112 		return -EOPNOTSUPP;
1113 
1114 	/*
1115 	 * We have to fall back to software encryption, whenever
1116 	 * the user choose to participates in an IBSS or is connected
1117 	 * to more than one network.
1118 	 *
1119 	 * This is very unfortunate, because some machines cannot handle
1120 	 * the high througput speed in 802.11n networks.
1121 	 */
1122 
1123 	if (!is_main_vif(ar, vif)) {
1124 		mutex_lock(&ar->mutex);
1125 		goto err_softw;
1126 	}
1127 
1128 	/*
1129 	 * While the hardware supports *catch-all* key, for offloading
1130 	 * group-key en-/de-cryption. The way of how the hardware
1131 	 * decides which keyId maps to which key, remains a mystery...
1132 	 */
1133 	if ((vif->type != NL80211_IFTYPE_STATION &&
1134 	     vif->type != NL80211_IFTYPE_ADHOC) &&
1135 	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
1136 		return -EOPNOTSUPP;
1137 
1138 	switch (key->cipher) {
1139 	case WLAN_CIPHER_SUITE_WEP40:
1140 		ktype = AR9170_ENC_ALG_WEP64;
1141 		break;
1142 	case WLAN_CIPHER_SUITE_WEP104:
1143 		ktype = AR9170_ENC_ALG_WEP128;
1144 		break;
1145 	case WLAN_CIPHER_SUITE_TKIP:
1146 		ktype = AR9170_ENC_ALG_TKIP;
1147 		break;
1148 	case WLAN_CIPHER_SUITE_CCMP:
1149 		ktype = AR9170_ENC_ALG_AESCCMP;
1150 		break;
1151 	default:
1152 		return -EOPNOTSUPP;
1153 	}
1154 
1155 	mutex_lock(&ar->mutex);
1156 	if (cmd == SET_KEY) {
1157 		if (!IS_STARTED(ar)) {
1158 			err = -EOPNOTSUPP;
1159 			goto out;
1160 		}
1161 
1162 		if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
1163 			sta = NULL;
1164 
1165 			i = 64 + key->keyidx;
1166 		} else {
1167 			for (i = 0; i < 64; i++)
1168 				if (!(ar->usedkeys & BIT(i)))
1169 					break;
1170 			if (i == 64)
1171 				goto err_softw;
1172 		}
1173 
1174 		key->hw_key_idx = i;
1175 
1176 		err = carl9170_upload_key(ar, i, sta ? sta->addr : NULL,
1177 					  ktype, 0, key->key,
1178 					  min_t(u8, 16, key->keylen));
1179 		if (err)
1180 			goto out;
1181 
1182 		if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
1183 			err = carl9170_upload_key(ar, i, sta ? sta->addr :
1184 						  NULL, ktype, 1,
1185 						  key->key + 16, 16);
1186 			if (err)
1187 				goto out;
1188 
1189 			/*
1190 			 * hardware is not capable generating MMIC
1191 			 * of fragmented frames!
1192 			 */
1193 			key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
1194 		}
1195 
1196 		if (i < 64)
1197 			ar->usedkeys |= BIT(i);
1198 
1199 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
1200 	} else {
1201 		if (!IS_STARTED(ar)) {
1202 			/* The device is gone... together with the key ;-) */
1203 			err = 0;
1204 			goto out;
1205 		}
1206 
1207 		if (key->hw_key_idx < 64) {
1208 			ar->usedkeys &= ~BIT(key->hw_key_idx);
1209 		} else {
1210 			err = carl9170_upload_key(ar, key->hw_key_idx, NULL,
1211 						  AR9170_ENC_ALG_NONE, 0,
1212 						  NULL, 0);
1213 			if (err)
1214 				goto out;
1215 
1216 			if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
1217 				err = carl9170_upload_key(ar, key->hw_key_idx,
1218 							  NULL,
1219 							  AR9170_ENC_ALG_NONE,
1220 							  1, NULL, 0);
1221 				if (err)
1222 					goto out;
1223 			}
1224 
1225 		}
1226 
1227 		err = carl9170_disable_key(ar, key->hw_key_idx);
1228 		if (err)
1229 			goto out;
1230 	}
1231 
1232 out:
1233 	mutex_unlock(&ar->mutex);
1234 	return err;
1235 
1236 err_softw:
1237 	if (!ar->rx_software_decryption) {
1238 		ar->rx_software_decryption = true;
1239 		carl9170_set_operating_mode(ar);
1240 	}
1241 	mutex_unlock(&ar->mutex);
1242 	return -ENOSPC;
1243 }
1244 
1245 static int carl9170_op_sta_add(struct ieee80211_hw *hw,
1246 			       struct ieee80211_vif *vif,
1247 			       struct ieee80211_sta *sta)
1248 {
1249 	struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
1250 	unsigned int i;
1251 
1252 	atomic_set(&sta_info->pending_frames, 0);
1253 
1254 	if (sta->ht_cap.ht_supported) {
1255 		if (sta->ht_cap.ampdu_density > 6) {
1256 			/*
1257 			 * HW does support 16us AMPDU density.
1258 			 * No HT-Xmit for station.
1259 			 */
1260 
1261 			return 0;
1262 		}
1263 
1264 		for (i = 0; i < CARL9170_NUM_TID; i++)
1265 			RCU_INIT_POINTER(sta_info->agg[i], NULL);
1266 
1267 		sta_info->ampdu_max_len = 1 << (3 + sta->ht_cap.ampdu_factor);
1268 		sta_info->ht_sta = true;
1269 	}
1270 
1271 	return 0;
1272 }
1273 
1274 static int carl9170_op_sta_remove(struct ieee80211_hw *hw,
1275 				struct ieee80211_vif *vif,
1276 				struct ieee80211_sta *sta)
1277 {
1278 	struct ar9170 *ar = hw->priv;
1279 	struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
1280 	unsigned int i;
1281 	bool cleanup = false;
1282 
1283 	if (sta->ht_cap.ht_supported) {
1284 
1285 		sta_info->ht_sta = false;
1286 
1287 		rcu_read_lock();
1288 		for (i = 0; i < CARL9170_NUM_TID; i++) {
1289 			struct carl9170_sta_tid *tid_info;
1290 
1291 			tid_info = rcu_dereference(sta_info->agg[i]);
1292 			RCU_INIT_POINTER(sta_info->agg[i], NULL);
1293 
1294 			if (!tid_info)
1295 				continue;
1296 
1297 			spin_lock_bh(&ar->tx_ampdu_list_lock);
1298 			if (tid_info->state > CARL9170_TID_STATE_SHUTDOWN)
1299 				tid_info->state = CARL9170_TID_STATE_SHUTDOWN;
1300 			spin_unlock_bh(&ar->tx_ampdu_list_lock);
1301 			cleanup = true;
1302 		}
1303 		rcu_read_unlock();
1304 
1305 		if (cleanup)
1306 			carl9170_ampdu_gc(ar);
1307 	}
1308 
1309 	return 0;
1310 }
1311 
1312 static int carl9170_op_conf_tx(struct ieee80211_hw *hw,
1313 			       struct ieee80211_vif *vif, u16 queue,
1314 			       const struct ieee80211_tx_queue_params *param)
1315 {
1316 	struct ar9170 *ar = hw->priv;
1317 	int ret;
1318 
1319 	mutex_lock(&ar->mutex);
1320 	if (queue < ar->hw->queues) {
1321 		memcpy(&ar->edcf[ar9170_qmap[queue]], param, sizeof(*param));
1322 		ret = carl9170_set_qos(ar);
1323 	} else {
1324 		ret = -EINVAL;
1325 	}
1326 
1327 	mutex_unlock(&ar->mutex);
1328 	return ret;
1329 }
1330 
1331 static void carl9170_ampdu_work(struct work_struct *work)
1332 {
1333 	struct ar9170 *ar = container_of(work, struct ar9170,
1334 					 ampdu_work);
1335 
1336 	if (!IS_STARTED(ar))
1337 		return;
1338 
1339 	mutex_lock(&ar->mutex);
1340 	carl9170_ampdu_gc(ar);
1341 	mutex_unlock(&ar->mutex);
1342 }
1343 
1344 static int carl9170_op_ampdu_action(struct ieee80211_hw *hw,
1345 				    struct ieee80211_vif *vif,
1346 				    enum ieee80211_ampdu_mlme_action action,
1347 				    struct ieee80211_sta *sta,
1348 				    u16 tid, u16 *ssn, u8 buf_size)
1349 {
1350 	struct ar9170 *ar = hw->priv;
1351 	struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
1352 	struct carl9170_sta_tid *tid_info;
1353 
1354 	if (modparam_noht)
1355 		return -EOPNOTSUPP;
1356 
1357 	switch (action) {
1358 	case IEEE80211_AMPDU_TX_START:
1359 		if (!sta_info->ht_sta)
1360 			return -EOPNOTSUPP;
1361 
1362 		rcu_read_lock();
1363 		if (rcu_dereference(sta_info->agg[tid])) {
1364 			rcu_read_unlock();
1365 			return -EBUSY;
1366 		}
1367 
1368 		tid_info = kzalloc(sizeof(struct carl9170_sta_tid),
1369 				   GFP_ATOMIC);
1370 		if (!tid_info) {
1371 			rcu_read_unlock();
1372 			return -ENOMEM;
1373 		}
1374 
1375 		tid_info->hsn = tid_info->bsn = tid_info->snx = (*ssn);
1376 		tid_info->state = CARL9170_TID_STATE_PROGRESS;
1377 		tid_info->tid = tid;
1378 		tid_info->max = sta_info->ampdu_max_len;
1379 
1380 		INIT_LIST_HEAD(&tid_info->list);
1381 		INIT_LIST_HEAD(&tid_info->tmp_list);
1382 		skb_queue_head_init(&tid_info->queue);
1383 		spin_lock_init(&tid_info->lock);
1384 
1385 		spin_lock_bh(&ar->tx_ampdu_list_lock);
1386 		ar->tx_ampdu_list_len++;
1387 		list_add_tail_rcu(&tid_info->list, &ar->tx_ampdu_list);
1388 		rcu_assign_pointer(sta_info->agg[tid], tid_info);
1389 		spin_unlock_bh(&ar->tx_ampdu_list_lock);
1390 		rcu_read_unlock();
1391 
1392 		ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
1393 		break;
1394 
1395 	case IEEE80211_AMPDU_TX_STOP:
1396 		rcu_read_lock();
1397 		tid_info = rcu_dereference(sta_info->agg[tid]);
1398 		if (tid_info) {
1399 			spin_lock_bh(&ar->tx_ampdu_list_lock);
1400 			if (tid_info->state > CARL9170_TID_STATE_SHUTDOWN)
1401 				tid_info->state = CARL9170_TID_STATE_SHUTDOWN;
1402 			spin_unlock_bh(&ar->tx_ampdu_list_lock);
1403 		}
1404 
1405 		RCU_INIT_POINTER(sta_info->agg[tid], NULL);
1406 		rcu_read_unlock();
1407 
1408 		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
1409 		ieee80211_queue_work(ar->hw, &ar->ampdu_work);
1410 		break;
1411 
1412 	case IEEE80211_AMPDU_TX_OPERATIONAL:
1413 		rcu_read_lock();
1414 		tid_info = rcu_dereference(sta_info->agg[tid]);
1415 
1416 		sta_info->stats[tid].clear = true;
1417 		sta_info->stats[tid].req = false;
1418 
1419 		if (tid_info) {
1420 			bitmap_zero(tid_info->bitmap, CARL9170_BAW_SIZE);
1421 			tid_info->state = CARL9170_TID_STATE_IDLE;
1422 		}
1423 		rcu_read_unlock();
1424 
1425 		if (WARN_ON_ONCE(!tid_info))
1426 			return -EFAULT;
1427 
1428 		break;
1429 
1430 	case IEEE80211_AMPDU_RX_START:
1431 	case IEEE80211_AMPDU_RX_STOP:
1432 		/* Handled by hardware */
1433 		break;
1434 
1435 	default:
1436 		return -EOPNOTSUPP;
1437 	}
1438 
1439 	return 0;
1440 }
1441 
1442 #ifdef CONFIG_CARL9170_WPC
1443 static int carl9170_register_wps_button(struct ar9170 *ar)
1444 {
1445 	struct input_dev *input;
1446 	int err;
1447 
1448 	if (!(ar->features & CARL9170_WPS_BUTTON))
1449 		return 0;
1450 
1451 	input = input_allocate_device();
1452 	if (!input)
1453 		return -ENOMEM;
1454 
1455 	snprintf(ar->wps.name, sizeof(ar->wps.name), "%s WPS Button",
1456 		 wiphy_name(ar->hw->wiphy));
1457 
1458 	snprintf(ar->wps.phys, sizeof(ar->wps.phys),
1459 		 "ieee80211/%s/input0", wiphy_name(ar->hw->wiphy));
1460 
1461 	input->name = ar->wps.name;
1462 	input->phys = ar->wps.phys;
1463 	input->id.bustype = BUS_USB;
1464 	input->dev.parent = &ar->hw->wiphy->dev;
1465 
1466 	input_set_capability(input, EV_KEY, KEY_WPS_BUTTON);
1467 
1468 	err = input_register_device(input);
1469 	if (err) {
1470 		input_free_device(input);
1471 		return err;
1472 	}
1473 
1474 	ar->wps.pbc = input;
1475 	return 0;
1476 }
1477 #endif /* CONFIG_CARL9170_WPC */
1478 
1479 #ifdef CONFIG_CARL9170_HWRNG
1480 static int carl9170_rng_get(struct ar9170 *ar)
1481 {
1482 
1483 #define RW	(CARL9170_MAX_CMD_PAYLOAD_LEN / sizeof(u32))
1484 #define RB	(CARL9170_MAX_CMD_PAYLOAD_LEN)
1485 
1486 	static const __le32 rng_load[RW] = {
1487 		[0 ... (RW - 1)] = cpu_to_le32(AR9170_RAND_REG_NUM)};
1488 
1489 	u32 buf[RW];
1490 
1491 	unsigned int i, off = 0, transfer, count;
1492 	int err;
1493 
1494 	BUILD_BUG_ON(RB > CARL9170_MAX_CMD_PAYLOAD_LEN);
1495 
1496 	if (!IS_ACCEPTING_CMD(ar) || !ar->rng.initialized)
1497 		return -EAGAIN;
1498 
1499 	count = ARRAY_SIZE(ar->rng.cache);
1500 	while (count) {
1501 		err = carl9170_exec_cmd(ar, CARL9170_CMD_RREG,
1502 					RB, (u8 *) rng_load,
1503 					RB, (u8 *) buf);
1504 		if (err)
1505 			return err;
1506 
1507 		transfer = min_t(unsigned int, count, RW);
1508 		for (i = 0; i < transfer; i++)
1509 			ar->rng.cache[off + i] = buf[i];
1510 
1511 		off += transfer;
1512 		count -= transfer;
1513 	}
1514 
1515 	ar->rng.cache_idx = 0;
1516 
1517 #undef RW
1518 #undef RB
1519 	return 0;
1520 }
1521 
1522 static int carl9170_rng_read(struct hwrng *rng, u32 *data)
1523 {
1524 	struct ar9170 *ar = (struct ar9170 *)rng->priv;
1525 	int ret = -EIO;
1526 
1527 	mutex_lock(&ar->mutex);
1528 	if (ar->rng.cache_idx >= ARRAY_SIZE(ar->rng.cache)) {
1529 		ret = carl9170_rng_get(ar);
1530 		if (ret) {
1531 			mutex_unlock(&ar->mutex);
1532 			return ret;
1533 		}
1534 	}
1535 
1536 	*data = ar->rng.cache[ar->rng.cache_idx++];
1537 	mutex_unlock(&ar->mutex);
1538 
1539 	return sizeof(u16);
1540 }
1541 
1542 static void carl9170_unregister_hwrng(struct ar9170 *ar)
1543 {
1544 	if (ar->rng.initialized) {
1545 		hwrng_unregister(&ar->rng.rng);
1546 		ar->rng.initialized = false;
1547 	}
1548 }
1549 
1550 static int carl9170_register_hwrng(struct ar9170 *ar)
1551 {
1552 	int err;
1553 
1554 	snprintf(ar->rng.name, ARRAY_SIZE(ar->rng.name),
1555 		 "%s_%s", KBUILD_MODNAME, wiphy_name(ar->hw->wiphy));
1556 	ar->rng.rng.name = ar->rng.name;
1557 	ar->rng.rng.data_read = carl9170_rng_read;
1558 	ar->rng.rng.priv = (unsigned long)ar;
1559 
1560 	if (WARN_ON(ar->rng.initialized))
1561 		return -EALREADY;
1562 
1563 	err = hwrng_register(&ar->rng.rng);
1564 	if (err) {
1565 		dev_err(&ar->udev->dev, "Failed to register the random "
1566 			"number generator (%d)\n", err);
1567 		return err;
1568 	}
1569 
1570 	ar->rng.initialized = true;
1571 
1572 	err = carl9170_rng_get(ar);
1573 	if (err) {
1574 		carl9170_unregister_hwrng(ar);
1575 		return err;
1576 	}
1577 
1578 	return 0;
1579 }
1580 #endif /* CONFIG_CARL9170_HWRNG */
1581 
1582 static int carl9170_op_get_survey(struct ieee80211_hw *hw, int idx,
1583 				struct survey_info *survey)
1584 {
1585 	struct ar9170 *ar = hw->priv;
1586 	struct ieee80211_channel *chan;
1587 	struct ieee80211_supported_band *band;
1588 	int err, b, i;
1589 
1590 	chan = ar->channel;
1591 	if (!chan)
1592 		return -ENODEV;
1593 
1594 	if (idx == chan->hw_value) {
1595 		mutex_lock(&ar->mutex);
1596 		err = carl9170_update_survey(ar, false, true);
1597 		mutex_unlock(&ar->mutex);
1598 		if (err)
1599 			return err;
1600 	}
1601 
1602 	for (b = 0; b < IEEE80211_NUM_BANDS; b++) {
1603 		band = ar->hw->wiphy->bands[b];
1604 
1605 		if (!band)
1606 			continue;
1607 
1608 		for (i = 0; i < band->n_channels; i++) {
1609 			if (band->channels[i].hw_value == idx) {
1610 				chan = &band->channels[i];
1611 				goto found;
1612 			}
1613 		}
1614 	}
1615 	return -ENOENT;
1616 
1617 found:
1618 	memcpy(survey, &ar->survey[idx], sizeof(*survey));
1619 
1620 	survey->channel = chan;
1621 	survey->filled = SURVEY_INFO_NOISE_DBM;
1622 
1623 	if (ar->channel == chan)
1624 		survey->filled |= SURVEY_INFO_IN_USE;
1625 
1626 	if (ar->fw.hw_counters) {
1627 		survey->filled |= SURVEY_INFO_CHANNEL_TIME |
1628 				  SURVEY_INFO_CHANNEL_TIME_BUSY |
1629 				  SURVEY_INFO_CHANNEL_TIME_TX;
1630 	}
1631 
1632 	return 0;
1633 }
1634 
1635 static void carl9170_op_flush(struct ieee80211_hw *hw, bool drop)
1636 {
1637 	struct ar9170 *ar = hw->priv;
1638 	unsigned int vid;
1639 
1640 	mutex_lock(&ar->mutex);
1641 	for_each_set_bit(vid, &ar->vif_bitmap, ar->fw.vif_num)
1642 		carl9170_flush_cab(ar, vid);
1643 
1644 	carl9170_flush(ar, drop);
1645 	mutex_unlock(&ar->mutex);
1646 }
1647 
1648 static int carl9170_op_get_stats(struct ieee80211_hw *hw,
1649 				 struct ieee80211_low_level_stats *stats)
1650 {
1651 	struct ar9170 *ar = hw->priv;
1652 
1653 	memset(stats, 0, sizeof(*stats));
1654 	stats->dot11ACKFailureCount = ar->tx_ack_failures;
1655 	stats->dot11FCSErrorCount = ar->tx_fcs_errors;
1656 	return 0;
1657 }
1658 
1659 static void carl9170_op_sta_notify(struct ieee80211_hw *hw,
1660 				   struct ieee80211_vif *vif,
1661 				   enum sta_notify_cmd cmd,
1662 				   struct ieee80211_sta *sta)
1663 {
1664 	struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
1665 
1666 	switch (cmd) {
1667 	case STA_NOTIFY_SLEEP:
1668 		sta_info->sleeping = true;
1669 		if (atomic_read(&sta_info->pending_frames))
1670 			ieee80211_sta_block_awake(hw, sta, true);
1671 		break;
1672 
1673 	case STA_NOTIFY_AWAKE:
1674 		sta_info->sleeping = false;
1675 		break;
1676 	}
1677 }
1678 
1679 static bool carl9170_tx_frames_pending(struct ieee80211_hw *hw)
1680 {
1681 	struct ar9170 *ar = hw->priv;
1682 
1683 	return !!atomic_read(&ar->tx_total_queued);
1684 }
1685 
1686 static const struct ieee80211_ops carl9170_ops = {
1687 	.start			= carl9170_op_start,
1688 	.stop			= carl9170_op_stop,
1689 	.tx			= carl9170_op_tx,
1690 	.flush			= carl9170_op_flush,
1691 	.add_interface		= carl9170_op_add_interface,
1692 	.remove_interface	= carl9170_op_remove_interface,
1693 	.config			= carl9170_op_config,
1694 	.prepare_multicast	= carl9170_op_prepare_multicast,
1695 	.configure_filter	= carl9170_op_configure_filter,
1696 	.conf_tx		= carl9170_op_conf_tx,
1697 	.bss_info_changed	= carl9170_op_bss_info_changed,
1698 	.get_tsf		= carl9170_op_get_tsf,
1699 	.set_key		= carl9170_op_set_key,
1700 	.sta_add		= carl9170_op_sta_add,
1701 	.sta_remove		= carl9170_op_sta_remove,
1702 	.sta_notify		= carl9170_op_sta_notify,
1703 	.get_survey		= carl9170_op_get_survey,
1704 	.get_stats		= carl9170_op_get_stats,
1705 	.ampdu_action		= carl9170_op_ampdu_action,
1706 	.tx_frames_pending	= carl9170_tx_frames_pending,
1707 };
1708 
1709 void *carl9170_alloc(size_t priv_size)
1710 {
1711 	struct ieee80211_hw *hw;
1712 	struct ar9170 *ar;
1713 	struct sk_buff *skb;
1714 	int i;
1715 
1716 	/*
1717 	 * this buffer is used for rx stream reconstruction.
1718 	 * Under heavy load this device (or the transport layer?)
1719 	 * tends to split the streams into separate rx descriptors.
1720 	 */
1721 
1722 	skb = __dev_alloc_skb(AR9170_RX_STREAM_MAX_SIZE, GFP_KERNEL);
1723 	if (!skb)
1724 		goto err_nomem;
1725 
1726 	hw = ieee80211_alloc_hw(priv_size, &carl9170_ops);
1727 	if (!hw)
1728 		goto err_nomem;
1729 
1730 	ar = hw->priv;
1731 	ar->hw = hw;
1732 	ar->rx_failover = skb;
1733 
1734 	memset(&ar->rx_plcp, 0, sizeof(struct ar9170_rx_head));
1735 	ar->rx_has_plcp = false;
1736 
1737 	/*
1738 	 * Here's a hidden pitfall!
1739 	 *
1740 	 * All 4 AC queues work perfectly well under _legacy_ operation.
1741 	 * However as soon as aggregation is enabled, the traffic flow
1742 	 * gets very bumpy. Therefore we have to _switch_ to a
1743 	 * software AC with a single HW queue.
1744 	 */
1745 	hw->queues = __AR9170_NUM_TXQ;
1746 
1747 	mutex_init(&ar->mutex);
1748 	spin_lock_init(&ar->beacon_lock);
1749 	spin_lock_init(&ar->cmd_lock);
1750 	spin_lock_init(&ar->tx_stats_lock);
1751 	spin_lock_init(&ar->tx_ampdu_list_lock);
1752 	spin_lock_init(&ar->mem_lock);
1753 	spin_lock_init(&ar->state_lock);
1754 	atomic_set(&ar->pending_restarts, 0);
1755 	ar->vifs = 0;
1756 	for (i = 0; i < ar->hw->queues; i++) {
1757 		skb_queue_head_init(&ar->tx_status[i]);
1758 		skb_queue_head_init(&ar->tx_pending[i]);
1759 
1760 		INIT_LIST_HEAD(&ar->bar_list[i]);
1761 		spin_lock_init(&ar->bar_list_lock[i]);
1762 	}
1763 	INIT_WORK(&ar->ps_work, carl9170_ps_work);
1764 	INIT_WORK(&ar->ping_work, carl9170_ping_work);
1765 	INIT_WORK(&ar->restart_work, carl9170_restart_work);
1766 	INIT_WORK(&ar->ampdu_work, carl9170_ampdu_work);
1767 	INIT_DELAYED_WORK(&ar->stat_work, carl9170_stat_work);
1768 	INIT_DELAYED_WORK(&ar->tx_janitor, carl9170_tx_janitor);
1769 	INIT_LIST_HEAD(&ar->tx_ampdu_list);
1770 	rcu_assign_pointer(ar->tx_ampdu_iter,
1771 			   (struct carl9170_sta_tid *) &ar->tx_ampdu_list);
1772 
1773 	bitmap_zero(&ar->vif_bitmap, ar->fw.vif_num);
1774 	INIT_LIST_HEAD(&ar->vif_list);
1775 	init_completion(&ar->tx_flush);
1776 
1777 	/* firmware decides which modes we support */
1778 	hw->wiphy->interface_modes = 0;
1779 
1780 	hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
1781 		     IEEE80211_HW_REPORTS_TX_ACK_STATUS |
1782 		     IEEE80211_HW_SUPPORTS_PS |
1783 		     IEEE80211_HW_PS_NULLFUNC_STACK |
1784 		     IEEE80211_HW_NEED_DTIM_PERIOD |
1785 		     IEEE80211_HW_SIGNAL_DBM;
1786 
1787 	if (!modparam_noht) {
1788 		/*
1789 		 * see the comment above, why we allow the user
1790 		 * to disable HT by a module parameter.
1791 		 */
1792 		hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
1793 	}
1794 
1795 	hw->extra_tx_headroom = sizeof(struct _carl9170_tx_superframe);
1796 	hw->sta_data_size = sizeof(struct carl9170_sta_info);
1797 	hw->vif_data_size = sizeof(struct carl9170_vif_info);
1798 
1799 	hw->max_rates = CARL9170_TX_MAX_RATES;
1800 	hw->max_rate_tries = CARL9170_TX_USER_RATE_TRIES;
1801 
1802 	for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
1803 		ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
1804 
1805 	hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
1806 
1807 	/* As IBSS Encryption is software-based, IBSS RSN is supported. */
1808 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
1809 	return ar;
1810 
1811 err_nomem:
1812 	kfree_skb(skb);
1813 	return ERR_PTR(-ENOMEM);
1814 }
1815 
1816 static int carl9170_read_eeprom(struct ar9170 *ar)
1817 {
1818 #define RW	8	/* number of words to read at once */
1819 #define RB	(sizeof(u32) * RW)
1820 	u8 *eeprom = (void *)&ar->eeprom;
1821 	__le32 offsets[RW];
1822 	int i, j, err;
1823 
1824 	BUILD_BUG_ON(sizeof(ar->eeprom) & 3);
1825 
1826 	BUILD_BUG_ON(RB > CARL9170_MAX_CMD_LEN - 4);
1827 #ifndef __CHECKER__
1828 	/* don't want to handle trailing remains */
1829 	BUILD_BUG_ON(sizeof(ar->eeprom) % RB);
1830 #endif
1831 
1832 	for (i = 0; i < sizeof(ar->eeprom) / RB; i++) {
1833 		for (j = 0; j < RW; j++)
1834 			offsets[j] = cpu_to_le32(AR9170_EEPROM_START +
1835 						 RB * i + 4 * j);
1836 
1837 		err = carl9170_exec_cmd(ar, CARL9170_CMD_RREG,
1838 					RB, (u8 *) &offsets,
1839 					RB, eeprom + RB * i);
1840 		if (err)
1841 			return err;
1842 	}
1843 
1844 #undef RW
1845 #undef RB
1846 	return 0;
1847 }
1848 
1849 static int carl9170_parse_eeprom(struct ar9170 *ar)
1850 {
1851 	struct ath_regulatory *regulatory = &ar->common.regulatory;
1852 	unsigned int rx_streams, tx_streams, tx_params = 0;
1853 	int bands = 0;
1854 	int chans = 0;
1855 
1856 	if (ar->eeprom.length == cpu_to_le16(0xffff))
1857 		return -ENODATA;
1858 
1859 	rx_streams = hweight8(ar->eeprom.rx_mask);
1860 	tx_streams = hweight8(ar->eeprom.tx_mask);
1861 
1862 	if (rx_streams != tx_streams) {
1863 		tx_params = IEEE80211_HT_MCS_TX_RX_DIFF;
1864 
1865 		WARN_ON(!(tx_streams >= 1 && tx_streams <=
1866 			IEEE80211_HT_MCS_TX_MAX_STREAMS));
1867 
1868 		tx_params = (tx_streams - 1) <<
1869 			    IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
1870 
1871 		carl9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params;
1872 		carl9170_band_5GHz.ht_cap.mcs.tx_params |= tx_params;
1873 	}
1874 
1875 	if (ar->eeprom.operating_flags & AR9170_OPFLAG_2GHZ) {
1876 		ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
1877 			&carl9170_band_2GHz;
1878 		chans += carl9170_band_2GHz.n_channels;
1879 		bands++;
1880 	}
1881 	if (ar->eeprom.operating_flags & AR9170_OPFLAG_5GHZ) {
1882 		ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
1883 			&carl9170_band_5GHz;
1884 		chans += carl9170_band_5GHz.n_channels;
1885 		bands++;
1886 	}
1887 
1888 	if (!bands)
1889 		return -EINVAL;
1890 
1891 	ar->survey = kzalloc(sizeof(struct survey_info) * chans, GFP_KERNEL);
1892 	if (!ar->survey)
1893 		return -ENOMEM;
1894 	ar->num_channels = chans;
1895 
1896 	/*
1897 	 * I measured this, a bandswitch takes roughly
1898 	 * 135 ms and a frequency switch about 80.
1899 	 *
1900 	 * FIXME: measure these values again once EEPROM settings
1901 	 *	  are used, that will influence them!
1902 	 */
1903 	if (bands == 2)
1904 		ar->hw->channel_change_time = 135 * 1000;
1905 	else
1906 		ar->hw->channel_change_time = 80 * 1000;
1907 
1908 	regulatory->current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
1909 
1910 	/* second part of wiphy init */
1911 	SET_IEEE80211_PERM_ADDR(ar->hw, ar->eeprom.mac_address);
1912 
1913 	return 0;
1914 }
1915 
1916 static int carl9170_reg_notifier(struct wiphy *wiphy,
1917 				 struct regulatory_request *request)
1918 {
1919 	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
1920 	struct ar9170 *ar = hw->priv;
1921 
1922 	return ath_reg_notifier_apply(wiphy, request, &ar->common.regulatory);
1923 }
1924 
1925 int carl9170_register(struct ar9170 *ar)
1926 {
1927 	struct ath_regulatory *regulatory = &ar->common.regulatory;
1928 	int err = 0, i;
1929 
1930 	if (WARN_ON(ar->mem_bitmap))
1931 		return -EINVAL;
1932 
1933 	ar->mem_bitmap = kzalloc(roundup(ar->fw.mem_blocks, BITS_PER_LONG) *
1934 				 sizeof(unsigned long), GFP_KERNEL);
1935 
1936 	if (!ar->mem_bitmap)
1937 		return -ENOMEM;
1938 
1939 	/* try to read EEPROM, init MAC addr */
1940 	err = carl9170_read_eeprom(ar);
1941 	if (err)
1942 		return err;
1943 
1944 	err = carl9170_parse_eeprom(ar);
1945 	if (err)
1946 		return err;
1947 
1948 	err = ath_regd_init(regulatory, ar->hw->wiphy,
1949 			    carl9170_reg_notifier);
1950 	if (err)
1951 		return err;
1952 
1953 	if (modparam_noht) {
1954 		carl9170_band_2GHz.ht_cap.ht_supported = false;
1955 		carl9170_band_5GHz.ht_cap.ht_supported = false;
1956 	}
1957 
1958 	for (i = 0; i < ar->fw.vif_num; i++) {
1959 		ar->vif_priv[i].id = i;
1960 		ar->vif_priv[i].vif = NULL;
1961 	}
1962 
1963 	err = ieee80211_register_hw(ar->hw);
1964 	if (err)
1965 		return err;
1966 
1967 	/* mac80211 interface is now registered */
1968 	ar->registered = true;
1969 
1970 	if (!ath_is_world_regd(regulatory))
1971 		regulatory_hint(ar->hw->wiphy, regulatory->alpha2);
1972 
1973 #ifdef CONFIG_CARL9170_DEBUGFS
1974 	carl9170_debugfs_register(ar);
1975 #endif /* CONFIG_CARL9170_DEBUGFS */
1976 
1977 	err = carl9170_led_init(ar);
1978 	if (err)
1979 		goto err_unreg;
1980 
1981 #ifdef CONFIG_CARL9170_LEDS
1982 	err = carl9170_led_register(ar);
1983 	if (err)
1984 		goto err_unreg;
1985 #endif /* CONFIG_CARL9170_LEDS */
1986 
1987 #ifdef CONFIG_CARL9170_WPC
1988 	err = carl9170_register_wps_button(ar);
1989 	if (err)
1990 		goto err_unreg;
1991 #endif /* CONFIG_CARL9170_WPC */
1992 
1993 #ifdef CONFIG_CARL9170_HWRNG
1994 	err = carl9170_register_hwrng(ar);
1995 	if (err)
1996 		goto err_unreg;
1997 #endif /* CONFIG_CARL9170_HWRNG */
1998 
1999 	dev_info(&ar->udev->dev, "Atheros AR9170 is registered as '%s'\n",
2000 		 wiphy_name(ar->hw->wiphy));
2001 
2002 	return 0;
2003 
2004 err_unreg:
2005 	carl9170_unregister(ar);
2006 	return err;
2007 }
2008 
2009 void carl9170_unregister(struct ar9170 *ar)
2010 {
2011 	if (!ar->registered)
2012 		return;
2013 
2014 	ar->registered = false;
2015 
2016 #ifdef CONFIG_CARL9170_LEDS
2017 	carl9170_led_unregister(ar);
2018 #endif /* CONFIG_CARL9170_LEDS */
2019 
2020 #ifdef CONFIG_CARL9170_DEBUGFS
2021 	carl9170_debugfs_unregister(ar);
2022 #endif /* CONFIG_CARL9170_DEBUGFS */
2023 
2024 #ifdef CONFIG_CARL9170_WPC
2025 	if (ar->wps.pbc) {
2026 		input_unregister_device(ar->wps.pbc);
2027 		ar->wps.pbc = NULL;
2028 	}
2029 #endif /* CONFIG_CARL9170_WPC */
2030 
2031 #ifdef CONFIG_CARL9170_HWRNG
2032 	carl9170_unregister_hwrng(ar);
2033 #endif /* CONFIG_CARL9170_HWRNG */
2034 
2035 	carl9170_cancel_worker(ar);
2036 	cancel_work_sync(&ar->restart_work);
2037 
2038 	ieee80211_unregister_hw(ar->hw);
2039 }
2040 
2041 void carl9170_free(struct ar9170 *ar)
2042 {
2043 	WARN_ON(ar->registered);
2044 	WARN_ON(IS_INITIALIZED(ar));
2045 
2046 	kfree_skb(ar->rx_failover);
2047 	ar->rx_failover = NULL;
2048 
2049 	kfree(ar->mem_bitmap);
2050 	ar->mem_bitmap = NULL;
2051 
2052 	kfree(ar->survey);
2053 	ar->survey = NULL;
2054 
2055 	mutex_destroy(&ar->mutex);
2056 
2057 	ieee80211_free_hw(ar->hw);
2058 }
2059