1 /*
2  * Common code for mac80211 Prism54 drivers
3  *
4  * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
5  * Copyright (c) 2007-2009, Christian Lamparter <chunkeey@web.de>
6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
7  *
8  * Based on:
9  * - the islsm (softmac prism54) driver, which is:
10  *   Copyright 2004-2006 Jean-Baptiste Note <jbnote@gmail.com>, et al.
11  * - stlc45xx driver
12  *   Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies).
13  *
14  * This program is free software; you can redistribute it and/or modify
15  * it under the terms of the GNU General Public License version 2 as
16  * published by the Free Software Foundation.
17  */
18 
19 #include <linux/export.h>
20 #include <linux/firmware.h>
21 #include <linux/etherdevice.h>
22 #include <asm/div64.h>
23 
24 #include <net/mac80211.h>
25 
26 #include "p54.h"
27 #include "lmac.h"
28 
29 #ifdef P54_MM_DEBUG
30 static void p54_dump_tx_queue(struct p54_common *priv)
31 {
32 	unsigned long flags;
33 	struct ieee80211_tx_info *info;
34 	struct p54_tx_info *range;
35 	struct sk_buff *skb;
36 	struct p54_hdr *hdr;
37 	unsigned int i = 0;
38 	u32 prev_addr;
39 	u32 largest_hole = 0, free;
40 
41 	spin_lock_irqsave(&priv->tx_queue.lock, flags);
42 	wiphy_debug(priv->hw->wiphy, "/ --- tx queue dump (%d entries) ---\n",
43 		    skb_queue_len(&priv->tx_queue));
44 
45 	prev_addr = priv->rx_start;
46 	skb_queue_walk(&priv->tx_queue, skb) {
47 		info = IEEE80211_SKB_CB(skb);
48 		range = (void *) info->rate_driver_data;
49 		hdr = (void *) skb->data;
50 
51 		free = range->start_addr - prev_addr;
52 		wiphy_debug(priv->hw->wiphy,
53 			    "| [%02d] => [skb:%p skb_len:0x%04x "
54 			    "hdr:{flags:%02x len:%04x req_id:%04x type:%02x} "
55 			    "mem:{start:%04x end:%04x, free:%d}]\n",
56 			    i++, skb, skb->len,
57 			    le16_to_cpu(hdr->flags), le16_to_cpu(hdr->len),
58 			    le32_to_cpu(hdr->req_id), le16_to_cpu(hdr->type),
59 			    range->start_addr, range->end_addr, free);
60 
61 		prev_addr = range->end_addr;
62 		largest_hole = max(largest_hole, free);
63 	}
64 	free = priv->rx_end - prev_addr;
65 	largest_hole = max(largest_hole, free);
66 	wiphy_debug(priv->hw->wiphy,
67 		    "\\ --- [free: %d], largest free block: %d ---\n",
68 		    free, largest_hole);
69 	spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
70 }
71 #endif /* P54_MM_DEBUG */
72 
73 /*
74  * So, the firmware is somewhat stupid and doesn't know what places in its
75  * memory incoming data should go to. By poking around in the firmware, we
76  * can find some unused memory to upload our packets to. However, data that we
77  * want the card to TX needs to stay intact until the card has told us that
78  * it is done with it. This function finds empty places we can upload to and
79  * marks allocated areas as reserved if necessary. p54_find_and_unlink_skb or
80  * p54_free_skb frees allocated areas.
81  */
82 static int p54_assign_address(struct p54_common *priv, struct sk_buff *skb)
83 {
84 	struct sk_buff *entry, *target_skb = NULL;
85 	struct ieee80211_tx_info *info;
86 	struct p54_tx_info *range;
87 	struct p54_hdr *data = (void *) skb->data;
88 	unsigned long flags;
89 	u32 last_addr = priv->rx_start;
90 	u32 target_addr = priv->rx_start;
91 	u16 len = priv->headroom + skb->len + priv->tailroom + 3;
92 
93 	info = IEEE80211_SKB_CB(skb);
94 	range = (void *) info->rate_driver_data;
95 	len = (range->extra_len + len) & ~0x3;
96 
97 	spin_lock_irqsave(&priv->tx_queue.lock, flags);
98 	if (unlikely(skb_queue_len(&priv->tx_queue) == 32)) {
99 		/*
100 		 * The tx_queue is now really full.
101 		 *
102 		 * TODO: check if the device has crashed and reset it.
103 		 */
104 		spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
105 		return -EBUSY;
106 	}
107 
108 	skb_queue_walk(&priv->tx_queue, entry) {
109 		u32 hole_size;
110 		info = IEEE80211_SKB_CB(entry);
111 		range = (void *) info->rate_driver_data;
112 		hole_size = range->start_addr - last_addr;
113 
114 		if (!target_skb && hole_size >= len) {
115 			target_skb = entry->prev;
116 			hole_size -= len;
117 			target_addr = last_addr;
118 			break;
119 		}
120 		last_addr = range->end_addr;
121 	}
122 	if (unlikely(!target_skb)) {
123 		if (priv->rx_end - last_addr >= len) {
124 			target_skb = priv->tx_queue.prev;
125 			if (!skb_queue_empty(&priv->tx_queue)) {
126 				info = IEEE80211_SKB_CB(target_skb);
127 				range = (void *)info->rate_driver_data;
128 				target_addr = range->end_addr;
129 			}
130 		} else {
131 			spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
132 			return -ENOSPC;
133 		}
134 	}
135 
136 	info = IEEE80211_SKB_CB(skb);
137 	range = (void *) info->rate_driver_data;
138 	range->start_addr = target_addr;
139 	range->end_addr = target_addr + len;
140 	data->req_id = cpu_to_le32(target_addr + priv->headroom);
141 	if (IS_DATA_FRAME(skb) &&
142 	    unlikely(GET_HW_QUEUE(skb) == P54_QUEUE_BEACON))
143 		priv->beacon_req_id = data->req_id;
144 
145 	__skb_queue_after(&priv->tx_queue, target_skb, skb);
146 	spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
147 	return 0;
148 }
149 
150 static void p54_tx_pending(struct p54_common *priv)
151 {
152 	struct sk_buff *skb;
153 	int ret;
154 
155 	skb = skb_dequeue(&priv->tx_pending);
156 	if (unlikely(!skb))
157 		return ;
158 
159 	ret = p54_assign_address(priv, skb);
160 	if (unlikely(ret))
161 		skb_queue_head(&priv->tx_pending, skb);
162 	else
163 		priv->tx(priv->hw, skb);
164 }
165 
166 static void p54_wake_queues(struct p54_common *priv)
167 {
168 	unsigned long flags;
169 	unsigned int i;
170 
171 	if (unlikely(priv->mode == NL80211_IFTYPE_UNSPECIFIED))
172 		return ;
173 
174 	p54_tx_pending(priv);
175 
176 	spin_lock_irqsave(&priv->tx_stats_lock, flags);
177 	for (i = 0; i < priv->hw->queues; i++) {
178 		if (priv->tx_stats[i + P54_QUEUE_DATA].len <
179 		    priv->tx_stats[i + P54_QUEUE_DATA].limit)
180 			ieee80211_wake_queue(priv->hw, i);
181 	}
182 	spin_unlock_irqrestore(&priv->tx_stats_lock, flags);
183 }
184 
185 static int p54_tx_qos_accounting_alloc(struct p54_common *priv,
186 				       struct sk_buff *skb,
187 				       const u16 p54_queue)
188 {
189 	struct p54_tx_queue_stats *queue;
190 	unsigned long flags;
191 
192 	if (WARN_ON(p54_queue >= P54_QUEUE_NUM))
193 		return -EINVAL;
194 
195 	queue = &priv->tx_stats[p54_queue];
196 
197 	spin_lock_irqsave(&priv->tx_stats_lock, flags);
198 	if (unlikely(queue->len >= queue->limit && IS_QOS_QUEUE(p54_queue))) {
199 		spin_unlock_irqrestore(&priv->tx_stats_lock, flags);
200 		return -ENOSPC;
201 	}
202 
203 	queue->len++;
204 	queue->count++;
205 
206 	if (unlikely(queue->len == queue->limit && IS_QOS_QUEUE(p54_queue))) {
207 		u16 ac_queue = p54_queue - P54_QUEUE_DATA;
208 		ieee80211_stop_queue(priv->hw, ac_queue);
209 	}
210 
211 	spin_unlock_irqrestore(&priv->tx_stats_lock, flags);
212 	return 0;
213 }
214 
215 static void p54_tx_qos_accounting_free(struct p54_common *priv,
216 				       struct sk_buff *skb)
217 {
218 	if (IS_DATA_FRAME(skb)) {
219 		unsigned long flags;
220 
221 		spin_lock_irqsave(&priv->tx_stats_lock, flags);
222 		priv->tx_stats[GET_HW_QUEUE(skb)].len--;
223 		spin_unlock_irqrestore(&priv->tx_stats_lock, flags);
224 
225 		if (unlikely(GET_HW_QUEUE(skb) == P54_QUEUE_BEACON)) {
226 			if (priv->beacon_req_id == GET_REQ_ID(skb)) {
227 				/* this is the  active beacon set anymore */
228 				priv->beacon_req_id = 0;
229 			}
230 			complete(&priv->beacon_comp);
231 		}
232 	}
233 	p54_wake_queues(priv);
234 }
235 
236 void p54_free_skb(struct ieee80211_hw *dev, struct sk_buff *skb)
237 {
238 	struct p54_common *priv = dev->priv;
239 	if (unlikely(!skb))
240 		return ;
241 
242 	skb_unlink(skb, &priv->tx_queue);
243 	p54_tx_qos_accounting_free(priv, skb);
244 	ieee80211_free_txskb(dev, skb);
245 }
246 EXPORT_SYMBOL_GPL(p54_free_skb);
247 
248 static struct sk_buff *p54_find_and_unlink_skb(struct p54_common *priv,
249 					       const __le32 req_id)
250 {
251 	struct sk_buff *entry;
252 	unsigned long flags;
253 
254 	spin_lock_irqsave(&priv->tx_queue.lock, flags);
255 	skb_queue_walk(&priv->tx_queue, entry) {
256 		struct p54_hdr *hdr = (struct p54_hdr *) entry->data;
257 
258 		if (hdr->req_id == req_id) {
259 			__skb_unlink(entry, &priv->tx_queue);
260 			spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
261 			p54_tx_qos_accounting_free(priv, entry);
262 			return entry;
263 		}
264 	}
265 	spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
266 	return NULL;
267 }
268 
269 void p54_tx(struct p54_common *priv, struct sk_buff *skb)
270 {
271 	skb_queue_tail(&priv->tx_pending, skb);
272 	p54_tx_pending(priv);
273 }
274 
275 static int p54_rssi_to_dbm(struct p54_common *priv, int rssi)
276 {
277 	if (priv->rxhw != 5) {
278 		return ((rssi * priv->cur_rssi->mul) / 64 +
279 			 priv->cur_rssi->add) / 4;
280 	} else {
281 		/*
282 		 * TODO: find the correct formula
283 		 */
284 		return rssi / 2 - 110;
285 	}
286 }
287 
288 /*
289  * Even if the firmware is capable of dealing with incoming traffic,
290  * while dozing, we have to prepared in case mac80211 uses PS-POLL
291  * to retrieve outstanding frames from our AP.
292  * (see comment in net/mac80211/mlme.c @ line 1993)
293  */
294 static void p54_pspoll_workaround(struct p54_common *priv, struct sk_buff *skb)
295 {
296 	struct ieee80211_hdr *hdr = (void *) skb->data;
297 	struct ieee80211_tim_ie *tim_ie;
298 	u8 *tim;
299 	u8 tim_len;
300 	bool new_psm;
301 
302 	/* only beacons have a TIM IE */
303 	if (!ieee80211_is_beacon(hdr->frame_control))
304 		return;
305 
306 	if (!priv->aid)
307 		return;
308 
309 	/* only consider beacons from the associated BSSID */
310 	if (!ether_addr_equal_64bits(hdr->addr3, priv->bssid))
311 		return;
312 
313 	tim = p54_find_ie(skb, WLAN_EID_TIM);
314 	if (!tim)
315 		return;
316 
317 	tim_len = tim[1];
318 	tim_ie = (struct ieee80211_tim_ie *) &tim[2];
319 
320 	new_psm = ieee80211_check_tim(tim_ie, tim_len, priv->aid);
321 	if (new_psm != priv->powersave_override) {
322 		priv->powersave_override = new_psm;
323 		p54_set_ps(priv);
324 	}
325 }
326 
327 static int p54_rx_data(struct p54_common *priv, struct sk_buff *skb)
328 {
329 	struct p54_rx_data *hdr = (struct p54_rx_data *) skb->data;
330 	struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
331 	u16 freq = le16_to_cpu(hdr->freq);
332 	size_t header_len = sizeof(*hdr);
333 	u32 tsf32;
334 	u8 rate = hdr->rate & 0xf;
335 
336 	/*
337 	 * If the device is in a unspecified state we have to
338 	 * ignore all data frames. Else we could end up with a
339 	 * nasty crash.
340 	 */
341 	if (unlikely(priv->mode == NL80211_IFTYPE_UNSPECIFIED))
342 		return 0;
343 
344 	if (!(hdr->flags & cpu_to_le16(P54_HDR_FLAG_DATA_IN_FCS_GOOD)))
345 		return 0;
346 
347 	if (hdr->decrypt_status == P54_DECRYPT_OK)
348 		rx_status->flag |= RX_FLAG_DECRYPTED;
349 	if ((hdr->decrypt_status == P54_DECRYPT_FAIL_MICHAEL) ||
350 	    (hdr->decrypt_status == P54_DECRYPT_FAIL_TKIP))
351 		rx_status->flag |= RX_FLAG_MMIC_ERROR;
352 
353 	rx_status->signal = p54_rssi_to_dbm(priv, hdr->rssi);
354 	if (hdr->rate & 0x10)
355 		rx_status->flag |= RX_FLAG_SHORTPRE;
356 	if (priv->hw->conf.chandef.chan->band == IEEE80211_BAND_5GHZ)
357 		rx_status->rate_idx = (rate < 4) ? 0 : rate - 4;
358 	else
359 		rx_status->rate_idx = rate;
360 
361 	rx_status->freq = freq;
362 	rx_status->band =  priv->hw->conf.chandef.chan->band;
363 	rx_status->antenna = hdr->antenna;
364 
365 	tsf32 = le32_to_cpu(hdr->tsf32);
366 	if (tsf32 < priv->tsf_low32)
367 		priv->tsf_high32++;
368 	rx_status->mactime = ((u64)priv->tsf_high32) << 32 | tsf32;
369 	priv->tsf_low32 = tsf32;
370 
371 	/* LMAC API Page 10/29 - s_lm_data_in - clock
372 	 * "usec accurate timestamp of hardware clock
373 	 * at end of frame (before OFDM SIFS EOF padding"
374 	 */
375 	rx_status->flag |= RX_FLAG_MACTIME_END;
376 
377 	if (hdr->flags & cpu_to_le16(P54_HDR_FLAG_DATA_ALIGN))
378 		header_len += hdr->align[0];
379 
380 	skb_pull(skb, header_len);
381 	skb_trim(skb, le16_to_cpu(hdr->len));
382 	if (unlikely(priv->hw->conf.flags & IEEE80211_CONF_PS))
383 		p54_pspoll_workaround(priv, skb);
384 
385 	ieee80211_rx_irqsafe(priv->hw, skb);
386 
387 	ieee80211_queue_delayed_work(priv->hw, &priv->work,
388 			   msecs_to_jiffies(P54_STATISTICS_UPDATE));
389 
390 	return -1;
391 }
392 
393 static void p54_rx_frame_sent(struct p54_common *priv, struct sk_buff *skb)
394 {
395 	struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
396 	struct p54_frame_sent *payload = (struct p54_frame_sent *) hdr->data;
397 	struct ieee80211_tx_info *info;
398 	struct p54_hdr *entry_hdr;
399 	struct p54_tx_data *entry_data;
400 	struct sk_buff *entry;
401 	unsigned int pad = 0, frame_len;
402 	int count, idx;
403 
404 	entry = p54_find_and_unlink_skb(priv, hdr->req_id);
405 	if (unlikely(!entry))
406 		return ;
407 
408 	frame_len = entry->len;
409 	info = IEEE80211_SKB_CB(entry);
410 	entry_hdr = (struct p54_hdr *) entry->data;
411 	entry_data = (struct p54_tx_data *) entry_hdr->data;
412 	priv->stats.dot11ACKFailureCount += payload->tries - 1;
413 
414 	/*
415 	 * Frames in P54_QUEUE_FWSCAN and P54_QUEUE_BEACON are
416 	 * generated by the driver. Therefore tx_status is bogus
417 	 * and we don't want to confuse the mac80211 stack.
418 	 */
419 	if (unlikely(entry_data->hw_queue < P54_QUEUE_FWSCAN)) {
420 		dev_kfree_skb_any(entry);
421 		return ;
422 	}
423 
424 	/*
425 	 * Clear manually, ieee80211_tx_info_clear_status would
426 	 * clear the counts too and we need them.
427 	 */
428 	memset(&info->status.ack_signal, 0,
429 	       sizeof(struct ieee80211_tx_info) -
430 	       offsetof(struct ieee80211_tx_info, status.ack_signal));
431 	BUILD_BUG_ON(offsetof(struct ieee80211_tx_info,
432 			      status.ack_signal) != 20);
433 
434 	if (entry_hdr->flags & cpu_to_le16(P54_HDR_FLAG_DATA_ALIGN))
435 		pad = entry_data->align[0];
436 
437 	/* walk through the rates array and adjust the counts */
438 	count = payload->tries;
439 	for (idx = 0; idx < 4; idx++) {
440 		if (count >= info->status.rates[idx].count) {
441 			count -= info->status.rates[idx].count;
442 		} else if (count > 0) {
443 			info->status.rates[idx].count = count;
444 			count = 0;
445 		} else {
446 			info->status.rates[idx].idx = -1;
447 			info->status.rates[idx].count = 0;
448 		}
449 	}
450 
451 	if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
452 	     !(payload->status & P54_TX_FAILED))
453 		info->flags |= IEEE80211_TX_STAT_ACK;
454 	if (payload->status & P54_TX_PSM_CANCELLED)
455 		info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
456 	info->status.ack_signal = p54_rssi_to_dbm(priv,
457 						  (int)payload->ack_rssi);
458 
459 	/* Undo all changes to the frame. */
460 	switch (entry_data->key_type) {
461 	case P54_CRYPTO_TKIPMICHAEL: {
462 		u8 *iv = (u8 *)(entry_data->align + pad +
463 				entry_data->crypt_offset);
464 
465 		/* Restore the original TKIP IV. */
466 		iv[2] = iv[0];
467 		iv[0] = iv[1];
468 		iv[1] = (iv[0] | 0x20) & 0x7f;	/* WEPSeed - 8.3.2.2 */
469 
470 		frame_len -= 12; /* remove TKIP_MMIC + TKIP_ICV */
471 		break;
472 		}
473 	case P54_CRYPTO_AESCCMP:
474 		frame_len -= 8; /* remove CCMP_MIC */
475 		break;
476 	case P54_CRYPTO_WEP:
477 		frame_len -= 4; /* remove WEP_ICV */
478 		break;
479 	}
480 
481 	skb_trim(entry, frame_len);
482 	skb_pull(entry, sizeof(*hdr) + pad + sizeof(*entry_data));
483 	ieee80211_tx_status_irqsafe(priv->hw, entry);
484 }
485 
486 static void p54_rx_eeprom_readback(struct p54_common *priv,
487 				   struct sk_buff *skb)
488 {
489 	struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
490 	struct p54_eeprom_lm86 *eeprom = (struct p54_eeprom_lm86 *) hdr->data;
491 	struct sk_buff *tmp;
492 
493 	if (!priv->eeprom)
494 		return ;
495 
496 	if (priv->fw_var >= 0x509) {
497 		memcpy(priv->eeprom, eeprom->v2.data,
498 		       le16_to_cpu(eeprom->v2.len));
499 	} else {
500 		memcpy(priv->eeprom, eeprom->v1.data,
501 		       le16_to_cpu(eeprom->v1.len));
502 	}
503 
504 	priv->eeprom = NULL;
505 	tmp = p54_find_and_unlink_skb(priv, hdr->req_id);
506 	dev_kfree_skb_any(tmp);
507 	complete(&priv->eeprom_comp);
508 }
509 
510 static void p54_rx_stats(struct p54_common *priv, struct sk_buff *skb)
511 {
512 	struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
513 	struct p54_statistics *stats = (struct p54_statistics *) hdr->data;
514 	struct sk_buff *tmp;
515 	struct ieee80211_channel *chan;
516 	unsigned int i, rssi, tx, cca, dtime, dtotal, dcca, dtx, drssi, unit;
517 	u32 tsf32;
518 
519 	if (unlikely(priv->mode == NL80211_IFTYPE_UNSPECIFIED))
520 		return ;
521 
522 	tsf32 = le32_to_cpu(stats->tsf32);
523 	if (tsf32 < priv->tsf_low32)
524 		priv->tsf_high32++;
525 	priv->tsf_low32 = tsf32;
526 
527 	priv->stats.dot11RTSFailureCount = le32_to_cpu(stats->rts_fail);
528 	priv->stats.dot11RTSSuccessCount = le32_to_cpu(stats->rts_success);
529 	priv->stats.dot11FCSErrorCount = le32_to_cpu(stats->rx_bad_fcs);
530 
531 	priv->noise = p54_rssi_to_dbm(priv, le32_to_cpu(stats->noise));
532 
533 	/*
534 	 * STSW450X LMAC API page 26 - 3.8 Statistics
535 	 * "The exact measurement period can be derived from the
536 	 * timestamp member".
537 	 */
538 	dtime = tsf32 - priv->survey_raw.timestamp;
539 
540 	/*
541 	 * STSW450X LMAC API page 26 - 3.8.1 Noise histogram
542 	 * The LMAC samples RSSI, CCA and transmit state at regular
543 	 * periods (typically 8 times per 1k [as in 1024] usec).
544 	 */
545 	cca = le32_to_cpu(stats->sample_cca);
546 	tx = le32_to_cpu(stats->sample_tx);
547 	rssi = 0;
548 	for (i = 0; i < ARRAY_SIZE(stats->sample_noise); i++)
549 		rssi += le32_to_cpu(stats->sample_noise[i]);
550 
551 	dcca = cca - priv->survey_raw.cached_cca;
552 	drssi = rssi - priv->survey_raw.cached_rssi;
553 	dtx = tx - priv->survey_raw.cached_tx;
554 	dtotal = dcca + drssi + dtx;
555 
556 	/*
557 	 * update statistics when more than a second is over since the
558 	 * last call, or when a update is badly needed.
559 	 */
560 	if (dtotal && (priv->update_stats || dtime >= USEC_PER_SEC) &&
561 	    dtime >= dtotal) {
562 		priv->survey_raw.timestamp = tsf32;
563 		priv->update_stats = false;
564 		unit = dtime / dtotal;
565 
566 		if (dcca) {
567 			priv->survey_raw.cca += dcca * unit;
568 			priv->survey_raw.cached_cca = cca;
569 		}
570 		if (dtx) {
571 			priv->survey_raw.tx += dtx * unit;
572 			priv->survey_raw.cached_tx = tx;
573 		}
574 		if (drssi) {
575 			priv->survey_raw.rssi += drssi * unit;
576 			priv->survey_raw.cached_rssi = rssi;
577 		}
578 
579 		/* 1024 usec / 8 times = 128 usec / time */
580 		if (!(priv->phy_ps || priv->phy_idle))
581 			priv->survey_raw.active += dtotal * unit;
582 		else
583 			priv->survey_raw.active += (dcca + dtx) * unit;
584 	}
585 
586 	chan = priv->curchan;
587 	if (chan) {
588 		struct survey_info *survey = &priv->survey[chan->hw_value];
589 		survey->noise = clamp(priv->noise, -128, 127);
590 		survey->time = priv->survey_raw.active;
591 		survey->time_tx = priv->survey_raw.tx;
592 		survey->time_busy = priv->survey_raw.tx +
593 			priv->survey_raw.cca;
594 		do_div(survey->time, 1024);
595 		do_div(survey->time_tx, 1024);
596 		do_div(survey->time_busy, 1024);
597 	}
598 
599 	tmp = p54_find_and_unlink_skb(priv, hdr->req_id);
600 	dev_kfree_skb_any(tmp);
601 	complete(&priv->stat_comp);
602 }
603 
604 static void p54_rx_trap(struct p54_common *priv, struct sk_buff *skb)
605 {
606 	struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
607 	struct p54_trap *trap = (struct p54_trap *) hdr->data;
608 	u16 event = le16_to_cpu(trap->event);
609 	u16 freq = le16_to_cpu(trap->frequency);
610 
611 	switch (event) {
612 	case P54_TRAP_BEACON_TX:
613 		break;
614 	case P54_TRAP_RADAR:
615 		wiphy_info(priv->hw->wiphy, "radar (freq:%d MHz)\n", freq);
616 		break;
617 	case P54_TRAP_NO_BEACON:
618 		if (priv->vif)
619 			ieee80211_beacon_loss(priv->vif);
620 		break;
621 	case P54_TRAP_SCAN:
622 		break;
623 	case P54_TRAP_TBTT:
624 		break;
625 	case P54_TRAP_TIMER:
626 		break;
627 	case P54_TRAP_FAA_RADIO_OFF:
628 		wiphy_rfkill_set_hw_state(priv->hw->wiphy, true);
629 		break;
630 	case P54_TRAP_FAA_RADIO_ON:
631 		wiphy_rfkill_set_hw_state(priv->hw->wiphy, false);
632 		break;
633 	default:
634 		wiphy_info(priv->hw->wiphy, "received event:%x freq:%d\n",
635 			   event, freq);
636 		break;
637 	}
638 }
639 
640 static int p54_rx_control(struct p54_common *priv, struct sk_buff *skb)
641 {
642 	struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
643 
644 	switch (le16_to_cpu(hdr->type)) {
645 	case P54_CONTROL_TYPE_TXDONE:
646 		p54_rx_frame_sent(priv, skb);
647 		break;
648 	case P54_CONTROL_TYPE_TRAP:
649 		p54_rx_trap(priv, skb);
650 		break;
651 	case P54_CONTROL_TYPE_BBP:
652 		break;
653 	case P54_CONTROL_TYPE_STAT_READBACK:
654 		p54_rx_stats(priv, skb);
655 		break;
656 	case P54_CONTROL_TYPE_EEPROM_READBACK:
657 		p54_rx_eeprom_readback(priv, skb);
658 		break;
659 	default:
660 		wiphy_debug(priv->hw->wiphy,
661 			    "not handling 0x%02x type control frame\n",
662 			    le16_to_cpu(hdr->type));
663 		break;
664 	}
665 	return 0;
666 }
667 
668 /* returns zero if skb can be reused */
669 int p54_rx(struct ieee80211_hw *dev, struct sk_buff *skb)
670 {
671 	struct p54_common *priv = dev->priv;
672 	u16 type = le16_to_cpu(*((__le16 *)skb->data));
673 
674 	if (type & P54_HDR_FLAG_CONTROL)
675 		return p54_rx_control(priv, skb);
676 	else
677 		return p54_rx_data(priv, skb);
678 }
679 EXPORT_SYMBOL_GPL(p54_rx);
680 
681 static void p54_tx_80211_header(struct p54_common *priv, struct sk_buff *skb,
682 				struct ieee80211_tx_info *info,
683 				struct ieee80211_sta *sta,
684 				u8 *queue, u32 *extra_len, u16 *flags, u16 *aid,
685 				bool *burst_possible)
686 {
687 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
688 
689 	if (ieee80211_is_data_qos(hdr->frame_control))
690 		*burst_possible = true;
691 	else
692 		*burst_possible = false;
693 
694 	if (!(info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
695 		*flags |= P54_HDR_FLAG_DATA_OUT_SEQNR;
696 
697 	if (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER)
698 		*flags |= P54_HDR_FLAG_DATA_OUT_NOCANCEL;
699 
700 	if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
701 		*flags |= P54_HDR_FLAG_DATA_OUT_NOCANCEL;
702 
703 	*queue = skb_get_queue_mapping(skb) + P54_QUEUE_DATA;
704 
705 	switch (priv->mode) {
706 	case NL80211_IFTYPE_MONITOR:
707 		/*
708 		 * We have to set P54_HDR_FLAG_DATA_OUT_PROMISC for
709 		 * every frame in promiscuous/monitor mode.
710 		 * see STSW45x0C LMAC API - page 12.
711 		 */
712 		*aid = 0;
713 		*flags |= P54_HDR_FLAG_DATA_OUT_PROMISC;
714 		break;
715 	case NL80211_IFTYPE_STATION:
716 		*aid = 1;
717 		break;
718 	case NL80211_IFTYPE_AP:
719 	case NL80211_IFTYPE_ADHOC:
720 	case NL80211_IFTYPE_MESH_POINT:
721 		if (info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) {
722 			*aid = 0;
723 			*queue = P54_QUEUE_CAB;
724 			return;
725 		}
726 
727 		if (unlikely(ieee80211_is_mgmt(hdr->frame_control))) {
728 			if (ieee80211_is_probe_resp(hdr->frame_control)) {
729 				*aid = 0;
730 				*flags |= P54_HDR_FLAG_DATA_OUT_TIMESTAMP |
731 					  P54_HDR_FLAG_DATA_OUT_NOCANCEL;
732 				return;
733 			} else if (ieee80211_is_beacon(hdr->frame_control)) {
734 				*aid = 0;
735 
736 				if (info->flags & IEEE80211_TX_CTL_INJECTED) {
737 					/*
738 					 * Injecting beacons on top of a AP is
739 					 * not a good idea... nevertheless,
740 					 * it should be doable.
741 					 */
742 
743 					return;
744 				}
745 
746 				*flags |= P54_HDR_FLAG_DATA_OUT_TIMESTAMP;
747 				*queue = P54_QUEUE_BEACON;
748 				*extra_len = IEEE80211_MAX_TIM_LEN;
749 				return;
750 			}
751 		}
752 
753 		if (sta)
754 			*aid = sta->aid;
755 		break;
756 	}
757 }
758 
759 static u8 p54_convert_algo(u32 cipher)
760 {
761 	switch (cipher) {
762 	case WLAN_CIPHER_SUITE_WEP40:
763 	case WLAN_CIPHER_SUITE_WEP104:
764 		return P54_CRYPTO_WEP;
765 	case WLAN_CIPHER_SUITE_TKIP:
766 		return P54_CRYPTO_TKIPMICHAEL;
767 	case WLAN_CIPHER_SUITE_CCMP:
768 		return P54_CRYPTO_AESCCMP;
769 	default:
770 		return 0;
771 	}
772 }
773 
774 void p54_tx_80211(struct ieee80211_hw *dev,
775 		  struct ieee80211_tx_control *control,
776 		  struct sk_buff *skb)
777 {
778 	struct p54_common *priv = dev->priv;
779 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
780 	struct p54_tx_info *p54info;
781 	struct p54_hdr *hdr;
782 	struct p54_tx_data *txhdr;
783 	unsigned int padding, len, extra_len = 0;
784 	int i, j, ridx;
785 	u16 hdr_flags = 0, aid = 0;
786 	u8 rate, queue = 0, crypt_offset = 0;
787 	u8 cts_rate = 0x20;
788 	u8 rc_flags;
789 	u8 calculated_tries[4];
790 	u8 nrates = 0, nremaining = 8;
791 	bool burst_allowed = false;
792 
793 	p54_tx_80211_header(priv, skb, info, control->sta, &queue, &extra_len,
794 			    &hdr_flags, &aid, &burst_allowed);
795 
796 	if (p54_tx_qos_accounting_alloc(priv, skb, queue)) {
797 		ieee80211_free_txskb(dev, skb);
798 		return;
799 	}
800 
801 	padding = (unsigned long)(skb->data - (sizeof(*hdr) + sizeof(*txhdr))) & 3;
802 	len = skb->len;
803 
804 	if (info->control.hw_key) {
805 		crypt_offset = ieee80211_get_hdrlen_from_skb(skb);
806 		if (info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP) {
807 			u8 *iv = (u8 *)(skb->data + crypt_offset);
808 			/*
809 			 * The firmware excepts that the IV has to have
810 			 * this special format
811 			 */
812 			iv[1] = iv[0];
813 			iv[0] = iv[2];
814 			iv[2] = 0;
815 		}
816 	}
817 
818 	txhdr = (struct p54_tx_data *) skb_push(skb, sizeof(*txhdr) + padding);
819 	hdr = (struct p54_hdr *) skb_push(skb, sizeof(*hdr));
820 
821 	if (padding)
822 		hdr_flags |= P54_HDR_FLAG_DATA_ALIGN;
823 	hdr->type = cpu_to_le16(aid);
824 	hdr->rts_tries = info->control.rates[0].count;
825 
826 	/*
827 	 * we register the rates in perfect order, and
828 	 * RTS/CTS won't happen on 5 GHz
829 	 */
830 	cts_rate = info->control.rts_cts_rate_idx;
831 
832 	memset(&txhdr->rateset, 0, sizeof(txhdr->rateset));
833 
834 	/* see how many rates got used */
835 	for (i = 0; i < dev->max_rates; i++) {
836 		if (info->control.rates[i].idx < 0)
837 			break;
838 		nrates++;
839 	}
840 
841 	/* limit tries to 8/nrates per rate */
842 	for (i = 0; i < nrates; i++) {
843 		/*
844 		 * The magic expression here is equivalent to 8/nrates for
845 		 * all values that matter, but avoids division and jumps.
846 		 * Note that nrates can only take the values 1 through 4.
847 		 */
848 		calculated_tries[i] = min_t(int, ((15 >> nrates) | 1) + 1,
849 						 info->control.rates[i].count);
850 		nremaining -= calculated_tries[i];
851 	}
852 
853 	/* if there are tries left, distribute from back to front */
854 	for (i = nrates - 1; nremaining > 0 && i >= 0; i--) {
855 		int tmp = info->control.rates[i].count - calculated_tries[i];
856 
857 		if (tmp <= 0)
858 			continue;
859 		/* RC requested more tries at this rate */
860 
861 		tmp = min_t(int, tmp, nremaining);
862 		calculated_tries[i] += tmp;
863 		nremaining -= tmp;
864 	}
865 
866 	ridx = 0;
867 	for (i = 0; i < nrates && ridx < 8; i++) {
868 		/* we register the rates in perfect order */
869 		rate = info->control.rates[i].idx;
870 		if (info->band == IEEE80211_BAND_5GHZ)
871 			rate += 4;
872 
873 		/* store the count we actually calculated for TX status */
874 		info->control.rates[i].count = calculated_tries[i];
875 
876 		rc_flags = info->control.rates[i].flags;
877 		if (rc_flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE) {
878 			rate |= 0x10;
879 			cts_rate |= 0x10;
880 		}
881 		if (rc_flags & IEEE80211_TX_RC_USE_RTS_CTS) {
882 			burst_allowed = false;
883 			rate |= 0x40;
884 		} else if (rc_flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
885 			rate |= 0x20;
886 			burst_allowed = false;
887 		}
888 		for (j = 0; j < calculated_tries[i] && ridx < 8; j++) {
889 			txhdr->rateset[ridx] = rate;
890 			ridx++;
891 		}
892 	}
893 
894 	if (burst_allowed)
895 		hdr_flags |= P54_HDR_FLAG_DATA_OUT_BURST;
896 
897 	/* TODO: enable bursting */
898 	hdr->flags = cpu_to_le16(hdr_flags);
899 	hdr->tries = ridx;
900 	txhdr->rts_rate_idx = 0;
901 	if (info->control.hw_key) {
902 		txhdr->key_type = p54_convert_algo(info->control.hw_key->cipher);
903 		txhdr->key_len = min((u8)16, info->control.hw_key->keylen);
904 		memcpy(txhdr->key, info->control.hw_key->key, txhdr->key_len);
905 		if (info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP) {
906 			/* reserve space for the MIC key */
907 			len += 8;
908 			memcpy(skb_put(skb, 8), &(info->control.hw_key->key
909 				[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY]), 8);
910 		}
911 		/* reserve some space for ICV */
912 		len += info->control.hw_key->icv_len;
913 		memset(skb_put(skb, info->control.hw_key->icv_len), 0,
914 		       info->control.hw_key->icv_len);
915 	} else {
916 		txhdr->key_type = 0;
917 		txhdr->key_len = 0;
918 	}
919 	txhdr->crypt_offset = crypt_offset;
920 	txhdr->hw_queue = queue;
921 	txhdr->backlog = priv->tx_stats[queue].len - 1;
922 	memset(txhdr->durations, 0, sizeof(txhdr->durations));
923 	txhdr->tx_antenna = 2 & priv->tx_diversity_mask;
924 	if (priv->rxhw == 5) {
925 		txhdr->longbow.cts_rate = cts_rate;
926 		txhdr->longbow.output_power = cpu_to_le16(priv->output_power);
927 	} else {
928 		txhdr->normal.output_power = priv->output_power;
929 		txhdr->normal.cts_rate = cts_rate;
930 	}
931 	if (padding)
932 		txhdr->align[0] = padding;
933 
934 	hdr->len = cpu_to_le16(len);
935 	/* modifies skb->cb and with it info, so must be last! */
936 	p54info = (void *) info->rate_driver_data;
937 	p54info->extra_len = extra_len;
938 
939 	p54_tx(priv, skb);
940 }
941