1 /*
2  * drivers/net/wireless/mwl8k.c
3  * Driver for Marvell TOPDOG 802.11 Wireless cards
4  *
5  * Copyright (C) 2008, 2009, 2010 Marvell Semiconductor Inc.
6  *
7  * This file is licensed under the terms of the GNU General Public
8  * License version 2.  This program is licensed "as is" without any
9  * warranty of any kind, whether express or implied.
10  */
11 
12 #include <linux/interrupt.h>
13 #include <linux/module.h>
14 #include <linux/kernel.h>
15 #include <linux/sched.h>
16 #include <linux/spinlock.h>
17 #include <linux/list.h>
18 #include <linux/pci.h>
19 #include <linux/delay.h>
20 #include <linux/completion.h>
21 #include <linux/etherdevice.h>
22 #include <linux/slab.h>
23 #include <net/mac80211.h>
24 #include <linux/moduleparam.h>
25 #include <linux/firmware.h>
26 #include <linux/workqueue.h>
27 
28 #define MWL8K_DESC	"Marvell TOPDOG(R) 802.11 Wireless Network Driver"
29 #define MWL8K_NAME	KBUILD_MODNAME
30 #define MWL8K_VERSION	"0.13"
31 
32 /* Module parameters */
33 static bool ap_mode_default;
34 module_param(ap_mode_default, bool, 0);
35 MODULE_PARM_DESC(ap_mode_default,
36 		 "Set to 1 to make ap mode the default instead of sta mode");
37 
38 /* Register definitions */
39 #define MWL8K_HIU_GEN_PTR			0x00000c10
40 #define  MWL8K_MODE_STA				 0x0000005a
41 #define  MWL8K_MODE_AP				 0x000000a5
42 #define MWL8K_HIU_INT_CODE			0x00000c14
43 #define  MWL8K_FWSTA_READY			 0xf0f1f2f4
44 #define  MWL8K_FWAP_READY			 0xf1f2f4a5
45 #define  MWL8K_INT_CODE_CMD_FINISHED		 0x00000005
46 #define MWL8K_HIU_SCRATCH			0x00000c40
47 
48 /* Host->device communications */
49 #define MWL8K_HIU_H2A_INTERRUPT_EVENTS		0x00000c18
50 #define MWL8K_HIU_H2A_INTERRUPT_STATUS		0x00000c1c
51 #define MWL8K_HIU_H2A_INTERRUPT_MASK		0x00000c20
52 #define MWL8K_HIU_H2A_INTERRUPT_CLEAR_SEL	0x00000c24
53 #define MWL8K_HIU_H2A_INTERRUPT_STATUS_MASK	0x00000c28
54 #define  MWL8K_H2A_INT_DUMMY			 (1 << 20)
55 #define  MWL8K_H2A_INT_RESET			 (1 << 15)
56 #define  MWL8K_H2A_INT_DOORBELL			 (1 << 1)
57 #define  MWL8K_H2A_INT_PPA_READY		 (1 << 0)
58 
59 /* Device->host communications */
60 #define MWL8K_HIU_A2H_INTERRUPT_EVENTS		0x00000c2c
61 #define MWL8K_HIU_A2H_INTERRUPT_STATUS		0x00000c30
62 #define MWL8K_HIU_A2H_INTERRUPT_MASK		0x00000c34
63 #define MWL8K_HIU_A2H_INTERRUPT_CLEAR_SEL	0x00000c38
64 #define MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK	0x00000c3c
65 #define  MWL8K_A2H_INT_DUMMY			 (1 << 20)
66 #define  MWL8K_A2H_INT_BA_WATCHDOG		 (1 << 14)
67 #define  MWL8K_A2H_INT_CHNL_SWITCHED		 (1 << 11)
68 #define  MWL8K_A2H_INT_QUEUE_EMPTY		 (1 << 10)
69 #define  MWL8K_A2H_INT_RADAR_DETECT		 (1 << 7)
70 #define  MWL8K_A2H_INT_RADIO_ON			 (1 << 6)
71 #define  MWL8K_A2H_INT_RADIO_OFF		 (1 << 5)
72 #define  MWL8K_A2H_INT_MAC_EVENT		 (1 << 3)
73 #define  MWL8K_A2H_INT_OPC_DONE			 (1 << 2)
74 #define  MWL8K_A2H_INT_RX_READY			 (1 << 1)
75 #define  MWL8K_A2H_INT_TX_DONE			 (1 << 0)
76 
77 /* HW micro second timer register
78  * located at offset 0xA600. This
79  * will be used to timestamp tx
80  * packets.
81  */
82 
83 #define	MWL8K_HW_TIMER_REGISTER			0x0000a600
84 #define BBU_RXRDY_CNT_REG			0x0000a860
85 #define NOK_CCA_CNT_REG				0x0000a6a0
86 #define BBU_AVG_NOISE_VAL			0x67
87 
88 #define MWL8K_A2H_EVENTS	(MWL8K_A2H_INT_DUMMY | \
89 				 MWL8K_A2H_INT_CHNL_SWITCHED | \
90 				 MWL8K_A2H_INT_QUEUE_EMPTY | \
91 				 MWL8K_A2H_INT_RADAR_DETECT | \
92 				 MWL8K_A2H_INT_RADIO_ON | \
93 				 MWL8K_A2H_INT_RADIO_OFF | \
94 				 MWL8K_A2H_INT_MAC_EVENT | \
95 				 MWL8K_A2H_INT_OPC_DONE | \
96 				 MWL8K_A2H_INT_RX_READY | \
97 				 MWL8K_A2H_INT_TX_DONE | \
98 				 MWL8K_A2H_INT_BA_WATCHDOG)
99 
100 #define MWL8K_RX_QUEUES		1
101 #define MWL8K_TX_WMM_QUEUES	4
102 #define MWL8K_MAX_AMPDU_QUEUES	8
103 #define MWL8K_MAX_TX_QUEUES	(MWL8K_TX_WMM_QUEUES + MWL8K_MAX_AMPDU_QUEUES)
104 #define mwl8k_tx_queues(priv)	(MWL8K_TX_WMM_QUEUES + (priv)->num_ampdu_queues)
105 
106 /* txpriorities are mapped with hw queues.
107  * Each hw queue has a txpriority.
108  */
109 #define TOTAL_HW_TX_QUEUES	8
110 
111 /* Each HW queue can have one AMPDU stream.
112  * But, because one of the hw queue is reserved,
113  * maximum AMPDU queues that can be created are
114  * one short of total tx queues.
115  */
116 #define MWL8K_NUM_AMPDU_STREAMS	(TOTAL_HW_TX_QUEUES - 1)
117 
118 #define MWL8K_NUM_CHANS 18
119 
120 struct rxd_ops {
121 	int rxd_size;
122 	void (*rxd_init)(void *rxd, dma_addr_t next_dma_addr);
123 	void (*rxd_refill)(void *rxd, dma_addr_t addr, int len);
124 	int (*rxd_process)(void *rxd, struct ieee80211_rx_status *status,
125 			   __le16 *qos, s8 *noise);
126 };
127 
128 struct mwl8k_device_info {
129 	char *part_name;
130 	char *helper_image;
131 	char *fw_image_sta;
132 	char *fw_image_ap;
133 	struct rxd_ops *ap_rxd_ops;
134 	u32 fw_api_ap;
135 };
136 
137 struct mwl8k_rx_queue {
138 	int rxd_count;
139 
140 	/* hw receives here */
141 	int head;
142 
143 	/* refill descs here */
144 	int tail;
145 
146 	void *rxd;
147 	dma_addr_t rxd_dma;
148 	struct {
149 		struct sk_buff *skb;
150 		DEFINE_DMA_UNMAP_ADDR(dma);
151 	} *buf;
152 };
153 
154 struct mwl8k_tx_queue {
155 	/* hw transmits here */
156 	int head;
157 
158 	/* sw appends here */
159 	int tail;
160 
161 	unsigned int len;
162 	struct mwl8k_tx_desc *txd;
163 	dma_addr_t txd_dma;
164 	struct sk_buff **skb;
165 };
166 
167 enum {
168 	AMPDU_NO_STREAM,
169 	AMPDU_STREAM_NEW,
170 	AMPDU_STREAM_IN_PROGRESS,
171 	AMPDU_STREAM_ACTIVE,
172 };
173 
174 struct mwl8k_ampdu_stream {
175 	struct ieee80211_sta *sta;
176 	u8 tid;
177 	u8 state;
178 	u8 idx;
179 };
180 
181 struct mwl8k_priv {
182 	struct ieee80211_hw *hw;
183 	struct pci_dev *pdev;
184 	int irq;
185 
186 	struct mwl8k_device_info *device_info;
187 
188 	void __iomem *sram;
189 	void __iomem *regs;
190 
191 	/* firmware */
192 	const struct firmware *fw_helper;
193 	const struct firmware *fw_ucode;
194 
195 	/* hardware/firmware parameters */
196 	bool ap_fw;
197 	struct rxd_ops *rxd_ops;
198 	struct ieee80211_supported_band band_24;
199 	struct ieee80211_channel channels_24[14];
200 	struct ieee80211_rate rates_24[13];
201 	struct ieee80211_supported_band band_50;
202 	struct ieee80211_channel channels_50[9];
203 	struct ieee80211_rate rates_50[8];
204 	u32 ap_macids_supported;
205 	u32 sta_macids_supported;
206 
207 	/* Ampdu stream information */
208 	u8 num_ampdu_queues;
209 	spinlock_t stream_lock;
210 	struct mwl8k_ampdu_stream ampdu[MWL8K_MAX_AMPDU_QUEUES];
211 	struct work_struct watchdog_ba_handle;
212 
213 	/* firmware access */
214 	struct mutex fw_mutex;
215 	struct task_struct *fw_mutex_owner;
216 	struct task_struct *hw_restart_owner;
217 	int fw_mutex_depth;
218 	struct completion *hostcmd_wait;
219 
220 	atomic_t watchdog_event_pending;
221 
222 	/* lock held over TX and TX reap */
223 	spinlock_t tx_lock;
224 
225 	/* TX quiesce completion, protected by fw_mutex and tx_lock */
226 	struct completion *tx_wait;
227 
228 	/* List of interfaces.  */
229 	u32 macids_used;
230 	struct list_head vif_list;
231 
232 	/* power management status cookie from firmware */
233 	u32 *cookie;
234 	dma_addr_t cookie_dma;
235 
236 	u16 num_mcaddrs;
237 	u8 hw_rev;
238 	u32 fw_rev;
239 	u32 caps;
240 
241 	/*
242 	 * Running count of TX packets in flight, to avoid
243 	 * iterating over the transmit rings each time.
244 	 */
245 	int pending_tx_pkts;
246 
247 	struct mwl8k_rx_queue rxq[MWL8K_RX_QUEUES];
248 	struct mwl8k_tx_queue txq[MWL8K_MAX_TX_QUEUES];
249 	u32 txq_offset[MWL8K_MAX_TX_QUEUES];
250 
251 	bool radio_on;
252 	bool radio_short_preamble;
253 	bool sniffer_enabled;
254 	bool wmm_enabled;
255 
256 	/* XXX need to convert this to handle multiple interfaces */
257 	bool capture_beacon;
258 	u8 capture_bssid[ETH_ALEN];
259 	struct sk_buff *beacon_skb;
260 
261 	/*
262 	 * This FJ worker has to be global as it is scheduled from the
263 	 * RX handler.  At this point we don't know which interface it
264 	 * belongs to until the list of bssids waiting to complete join
265 	 * is checked.
266 	 */
267 	struct work_struct finalize_join_worker;
268 
269 	/* Tasklet to perform TX reclaim.  */
270 	struct tasklet_struct poll_tx_task;
271 
272 	/* Tasklet to perform RX.  */
273 	struct tasklet_struct poll_rx_task;
274 
275 	/* Most recently reported noise in dBm */
276 	s8 noise;
277 
278 	/*
279 	 * preserve the queue configurations so they can be restored if/when
280 	 * the firmware image is swapped.
281 	 */
282 	struct ieee80211_tx_queue_params wmm_params[MWL8K_TX_WMM_QUEUES];
283 
284 	/* To perform the task of reloading the firmware */
285 	struct work_struct fw_reload;
286 	bool hw_restart_in_progress;
287 
288 	/* async firmware loading state */
289 	unsigned fw_state;
290 	char *fw_pref;
291 	char *fw_alt;
292 	bool is_8764;
293 	struct completion firmware_loading_complete;
294 
295 	/* bitmap of running BSSes */
296 	u32 running_bsses;
297 
298 	/* ACS related */
299 	bool sw_scan_start;
300 	struct ieee80211_channel *acs_chan;
301 	unsigned long channel_time;
302 	struct survey_info survey[MWL8K_NUM_CHANS];
303 };
304 
305 #define MAX_WEP_KEY_LEN         13
306 #define NUM_WEP_KEYS            4
307 
308 /* Per interface specific private data */
309 struct mwl8k_vif {
310 	struct list_head list;
311 	struct ieee80211_vif *vif;
312 
313 	/* Firmware macid for this vif.  */
314 	int macid;
315 
316 	/* Non AMPDU sequence number assigned by driver.  */
317 	u16 seqno;
318 
319 	/* Saved WEP keys */
320 	struct {
321 		u8 enabled;
322 		u8 key[sizeof(struct ieee80211_key_conf) + MAX_WEP_KEY_LEN];
323 	} wep_key_conf[NUM_WEP_KEYS];
324 
325 	/* BSSID */
326 	u8 bssid[ETH_ALEN];
327 
328 	/* A flag to indicate is HW crypto is enabled for this bssid */
329 	bool is_hw_crypto_enabled;
330 };
331 #define MWL8K_VIF(_vif) ((struct mwl8k_vif *)&((_vif)->drv_priv))
332 #define IEEE80211_KEY_CONF(_u8) ((struct ieee80211_key_conf *)(_u8))
333 
334 struct tx_traffic_info {
335 	u32 start_time;
336 	u32 pkts;
337 };
338 
339 #define MWL8K_MAX_TID 8
340 struct mwl8k_sta {
341 	/* Index into station database. Returned by UPDATE_STADB.  */
342 	u8 peer_id;
343 	u8 is_ampdu_allowed;
344 	struct tx_traffic_info tx_stats[MWL8K_MAX_TID];
345 };
346 #define MWL8K_STA(_sta) ((struct mwl8k_sta *)&((_sta)->drv_priv))
347 
348 static const struct ieee80211_channel mwl8k_channels_24[] = {
349 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2412, .hw_value = 1, },
350 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2417, .hw_value = 2, },
351 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2422, .hw_value = 3, },
352 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2427, .hw_value = 4, },
353 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2432, .hw_value = 5, },
354 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2437, .hw_value = 6, },
355 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2442, .hw_value = 7, },
356 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2447, .hw_value = 8, },
357 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2452, .hw_value = 9, },
358 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2457, .hw_value = 10, },
359 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2462, .hw_value = 11, },
360 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2467, .hw_value = 12, },
361 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2472, .hw_value = 13, },
362 	{ .band = NL80211_BAND_2GHZ, .center_freq = 2484, .hw_value = 14, },
363 };
364 
365 static const struct ieee80211_rate mwl8k_rates_24[] = {
366 	{ .bitrate = 10, .hw_value = 2, },
367 	{ .bitrate = 20, .hw_value = 4, },
368 	{ .bitrate = 55, .hw_value = 11, },
369 	{ .bitrate = 110, .hw_value = 22, },
370 	{ .bitrate = 220, .hw_value = 44, },
371 	{ .bitrate = 60, .hw_value = 12, },
372 	{ .bitrate = 90, .hw_value = 18, },
373 	{ .bitrate = 120, .hw_value = 24, },
374 	{ .bitrate = 180, .hw_value = 36, },
375 	{ .bitrate = 240, .hw_value = 48, },
376 	{ .bitrate = 360, .hw_value = 72, },
377 	{ .bitrate = 480, .hw_value = 96, },
378 	{ .bitrate = 540, .hw_value = 108, },
379 };
380 
381 static const struct ieee80211_channel mwl8k_channels_50[] = {
382 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5180, .hw_value = 36, },
383 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5200, .hw_value = 40, },
384 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5220, .hw_value = 44, },
385 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5240, .hw_value = 48, },
386 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5745, .hw_value = 149, },
387 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5765, .hw_value = 153, },
388 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5785, .hw_value = 157, },
389 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5805, .hw_value = 161, },
390 	{ .band = NL80211_BAND_5GHZ, .center_freq = 5825, .hw_value = 165, },
391 };
392 
393 static const struct ieee80211_rate mwl8k_rates_50[] = {
394 	{ .bitrate = 60, .hw_value = 12, },
395 	{ .bitrate = 90, .hw_value = 18, },
396 	{ .bitrate = 120, .hw_value = 24, },
397 	{ .bitrate = 180, .hw_value = 36, },
398 	{ .bitrate = 240, .hw_value = 48, },
399 	{ .bitrate = 360, .hw_value = 72, },
400 	{ .bitrate = 480, .hw_value = 96, },
401 	{ .bitrate = 540, .hw_value = 108, },
402 };
403 
404 /* Set or get info from Firmware */
405 #define MWL8K_CMD_GET			0x0000
406 #define MWL8K_CMD_SET			0x0001
407 #define MWL8K_CMD_SET_LIST		0x0002
408 
409 /* Firmware command codes */
410 #define MWL8K_CMD_CODE_DNLD		0x0001
411 #define MWL8K_CMD_GET_HW_SPEC		0x0003
412 #define MWL8K_CMD_SET_HW_SPEC		0x0004
413 #define MWL8K_CMD_MAC_MULTICAST_ADR	0x0010
414 #define MWL8K_CMD_GET_STAT		0x0014
415 #define MWL8K_CMD_BBP_REG_ACCESS	0x001a
416 #define MWL8K_CMD_RADIO_CONTROL		0x001c
417 #define MWL8K_CMD_RF_TX_POWER		0x001e
418 #define MWL8K_CMD_TX_POWER		0x001f
419 #define MWL8K_CMD_RF_ANTENNA		0x0020
420 #define MWL8K_CMD_SET_BEACON		0x0100		/* per-vif */
421 #define MWL8K_CMD_SET_PRE_SCAN		0x0107
422 #define MWL8K_CMD_SET_POST_SCAN		0x0108
423 #define MWL8K_CMD_SET_RF_CHANNEL	0x010a
424 #define MWL8K_CMD_SET_AID		0x010d
425 #define MWL8K_CMD_SET_RATE		0x0110
426 #define MWL8K_CMD_SET_FINALIZE_JOIN	0x0111
427 #define MWL8K_CMD_RTS_THRESHOLD		0x0113
428 #define MWL8K_CMD_SET_SLOT		0x0114
429 #define MWL8K_CMD_SET_EDCA_PARAMS	0x0115
430 #define MWL8K_CMD_SET_WMM_MODE		0x0123
431 #define MWL8K_CMD_MIMO_CONFIG		0x0125
432 #define MWL8K_CMD_USE_FIXED_RATE	0x0126
433 #define MWL8K_CMD_ENABLE_SNIFFER	0x0150
434 #define MWL8K_CMD_SET_MAC_ADDR		0x0202		/* per-vif */
435 #define MWL8K_CMD_SET_RATEADAPT_MODE	0x0203
436 #define MWL8K_CMD_GET_WATCHDOG_BITMAP	0x0205
437 #define MWL8K_CMD_DEL_MAC_ADDR		0x0206		/* per-vif */
438 #define MWL8K_CMD_BSS_START		0x1100		/* per-vif */
439 #define MWL8K_CMD_SET_NEW_STN		0x1111		/* per-vif */
440 #define MWL8K_CMD_UPDATE_ENCRYPTION	0x1122		/* per-vif */
441 #define MWL8K_CMD_UPDATE_STADB		0x1123
442 #define MWL8K_CMD_BASTREAM		0x1125
443 
444 #define MWL8K_LEGACY_5G_RATE_OFFSET \
445 	(ARRAY_SIZE(mwl8k_rates_24) - ARRAY_SIZE(mwl8k_rates_50))
446 
447 static const char *mwl8k_cmd_name(__le16 cmd, char *buf, int bufsize)
448 {
449 	u16 command = le16_to_cpu(cmd);
450 
451 #define MWL8K_CMDNAME(x)	case MWL8K_CMD_##x: do {\
452 					snprintf(buf, bufsize, "%s", #x);\
453 					return buf;\
454 					} while (0)
455 	switch (command & ~0x8000) {
456 		MWL8K_CMDNAME(CODE_DNLD);
457 		MWL8K_CMDNAME(GET_HW_SPEC);
458 		MWL8K_CMDNAME(SET_HW_SPEC);
459 		MWL8K_CMDNAME(MAC_MULTICAST_ADR);
460 		MWL8K_CMDNAME(GET_STAT);
461 		MWL8K_CMDNAME(RADIO_CONTROL);
462 		MWL8K_CMDNAME(RF_TX_POWER);
463 		MWL8K_CMDNAME(TX_POWER);
464 		MWL8K_CMDNAME(RF_ANTENNA);
465 		MWL8K_CMDNAME(SET_BEACON);
466 		MWL8K_CMDNAME(SET_PRE_SCAN);
467 		MWL8K_CMDNAME(SET_POST_SCAN);
468 		MWL8K_CMDNAME(SET_RF_CHANNEL);
469 		MWL8K_CMDNAME(SET_AID);
470 		MWL8K_CMDNAME(SET_RATE);
471 		MWL8K_CMDNAME(SET_FINALIZE_JOIN);
472 		MWL8K_CMDNAME(RTS_THRESHOLD);
473 		MWL8K_CMDNAME(SET_SLOT);
474 		MWL8K_CMDNAME(SET_EDCA_PARAMS);
475 		MWL8K_CMDNAME(SET_WMM_MODE);
476 		MWL8K_CMDNAME(MIMO_CONFIG);
477 		MWL8K_CMDNAME(USE_FIXED_RATE);
478 		MWL8K_CMDNAME(ENABLE_SNIFFER);
479 		MWL8K_CMDNAME(SET_MAC_ADDR);
480 		MWL8K_CMDNAME(SET_RATEADAPT_MODE);
481 		MWL8K_CMDNAME(BSS_START);
482 		MWL8K_CMDNAME(SET_NEW_STN);
483 		MWL8K_CMDNAME(UPDATE_ENCRYPTION);
484 		MWL8K_CMDNAME(UPDATE_STADB);
485 		MWL8K_CMDNAME(BASTREAM);
486 		MWL8K_CMDNAME(GET_WATCHDOG_BITMAP);
487 	default:
488 		snprintf(buf, bufsize, "0x%x", cmd);
489 	}
490 #undef MWL8K_CMDNAME
491 
492 	return buf;
493 }
494 
495 /* Hardware and firmware reset */
496 static void mwl8k_hw_reset(struct mwl8k_priv *priv)
497 {
498 	iowrite32(MWL8K_H2A_INT_RESET,
499 		priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
500 	iowrite32(MWL8K_H2A_INT_RESET,
501 		priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
502 	msleep(20);
503 }
504 
505 /* Release fw image */
506 static void mwl8k_release_fw(const struct firmware **fw)
507 {
508 	if (*fw == NULL)
509 		return;
510 	release_firmware(*fw);
511 	*fw = NULL;
512 }
513 
514 static void mwl8k_release_firmware(struct mwl8k_priv *priv)
515 {
516 	mwl8k_release_fw(&priv->fw_ucode);
517 	mwl8k_release_fw(&priv->fw_helper);
518 }
519 
520 /* states for asynchronous f/w loading */
521 static void mwl8k_fw_state_machine(const struct firmware *fw, void *context);
522 enum {
523 	FW_STATE_INIT = 0,
524 	FW_STATE_LOADING_PREF,
525 	FW_STATE_LOADING_ALT,
526 	FW_STATE_ERROR,
527 };
528 
529 /* Request fw image */
530 static int mwl8k_request_fw(struct mwl8k_priv *priv,
531 			    const char *fname, const struct firmware **fw,
532 			    bool nowait)
533 {
534 	/* release current image */
535 	if (*fw != NULL)
536 		mwl8k_release_fw(fw);
537 
538 	if (nowait)
539 		return request_firmware_nowait(THIS_MODULE, 1, fname,
540 					       &priv->pdev->dev, GFP_KERNEL,
541 					       priv, mwl8k_fw_state_machine);
542 	else
543 		return request_firmware(fw, fname, &priv->pdev->dev);
544 }
545 
546 static int mwl8k_request_firmware(struct mwl8k_priv *priv, char *fw_image,
547 				  bool nowait)
548 {
549 	struct mwl8k_device_info *di = priv->device_info;
550 	int rc;
551 
552 	if (di->helper_image != NULL) {
553 		if (nowait)
554 			rc = mwl8k_request_fw(priv, di->helper_image,
555 					      &priv->fw_helper, true);
556 		else
557 			rc = mwl8k_request_fw(priv, di->helper_image,
558 					      &priv->fw_helper, false);
559 		if (rc)
560 			printk(KERN_ERR "%s: Error requesting helper fw %s\n",
561 			       pci_name(priv->pdev), di->helper_image);
562 
563 		if (rc || nowait)
564 			return rc;
565 	}
566 
567 	if (nowait) {
568 		/*
569 		 * if we get here, no helper image is needed.  Skip the
570 		 * FW_STATE_INIT state.
571 		 */
572 		priv->fw_state = FW_STATE_LOADING_PREF;
573 		rc = mwl8k_request_fw(priv, fw_image,
574 				      &priv->fw_ucode,
575 				      true);
576 	} else
577 		rc = mwl8k_request_fw(priv, fw_image,
578 				      &priv->fw_ucode, false);
579 	if (rc) {
580 		printk(KERN_ERR "%s: Error requesting firmware file %s\n",
581 		       pci_name(priv->pdev), fw_image);
582 		mwl8k_release_fw(&priv->fw_helper);
583 		return rc;
584 	}
585 
586 	return 0;
587 }
588 
589 struct mwl8k_cmd_pkt {
590 	__le16	code;
591 	__le16	length;
592 	__u8	seq_num;
593 	__u8	macid;
594 	__le16	result;
595 	char	payload[0];
596 } __packed;
597 
598 /*
599  * Firmware loading.
600  */
601 static int
602 mwl8k_send_fw_load_cmd(struct mwl8k_priv *priv, void *data, int length)
603 {
604 	void __iomem *regs = priv->regs;
605 	dma_addr_t dma_addr;
606 	int loops;
607 
608 	dma_addr = pci_map_single(priv->pdev, data, length, PCI_DMA_TODEVICE);
609 	if (pci_dma_mapping_error(priv->pdev, dma_addr))
610 		return -ENOMEM;
611 
612 	iowrite32(dma_addr, regs + MWL8K_HIU_GEN_PTR);
613 	iowrite32(0, regs + MWL8K_HIU_INT_CODE);
614 	iowrite32(MWL8K_H2A_INT_DOORBELL,
615 		regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
616 	iowrite32(MWL8K_H2A_INT_DUMMY,
617 		regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
618 
619 	loops = 1000;
620 	do {
621 		u32 int_code;
622 		if (priv->is_8764) {
623 			int_code = ioread32(regs +
624 					    MWL8K_HIU_H2A_INTERRUPT_STATUS);
625 			if (int_code == 0)
626 				break;
627 		} else {
628 			int_code = ioread32(regs + MWL8K_HIU_INT_CODE);
629 			if (int_code == MWL8K_INT_CODE_CMD_FINISHED) {
630 				iowrite32(0, regs + MWL8K_HIU_INT_CODE);
631 				break;
632 			}
633 		}
634 		cond_resched();
635 		udelay(1);
636 	} while (--loops);
637 
638 	pci_unmap_single(priv->pdev, dma_addr, length, PCI_DMA_TODEVICE);
639 
640 	return loops ? 0 : -ETIMEDOUT;
641 }
642 
643 static int mwl8k_load_fw_image(struct mwl8k_priv *priv,
644 				const u8 *data, size_t length)
645 {
646 	struct mwl8k_cmd_pkt *cmd;
647 	int done;
648 	int rc = 0;
649 
650 	cmd = kmalloc(sizeof(*cmd) + 256, GFP_KERNEL);
651 	if (cmd == NULL)
652 		return -ENOMEM;
653 
654 	cmd->code = cpu_to_le16(MWL8K_CMD_CODE_DNLD);
655 	cmd->seq_num = 0;
656 	cmd->macid = 0;
657 	cmd->result = 0;
658 
659 	done = 0;
660 	while (length) {
661 		int block_size = length > 256 ? 256 : length;
662 
663 		memcpy(cmd->payload, data + done, block_size);
664 		cmd->length = cpu_to_le16(block_size);
665 
666 		rc = mwl8k_send_fw_load_cmd(priv, cmd,
667 						sizeof(*cmd) + block_size);
668 		if (rc)
669 			break;
670 
671 		done += block_size;
672 		length -= block_size;
673 	}
674 
675 	if (!rc) {
676 		cmd->length = 0;
677 		rc = mwl8k_send_fw_load_cmd(priv, cmd, sizeof(*cmd));
678 	}
679 
680 	kfree(cmd);
681 
682 	return rc;
683 }
684 
685 static int mwl8k_feed_fw_image(struct mwl8k_priv *priv,
686 				const u8 *data, size_t length)
687 {
688 	unsigned char *buffer;
689 	int may_continue, rc = 0;
690 	u32 done, prev_block_size;
691 
692 	buffer = kmalloc(1024, GFP_KERNEL);
693 	if (buffer == NULL)
694 		return -ENOMEM;
695 
696 	done = 0;
697 	prev_block_size = 0;
698 	may_continue = 1000;
699 	while (may_continue > 0) {
700 		u32 block_size;
701 
702 		block_size = ioread32(priv->regs + MWL8K_HIU_SCRATCH);
703 		if (block_size & 1) {
704 			block_size &= ~1;
705 			may_continue--;
706 		} else {
707 			done += prev_block_size;
708 			length -= prev_block_size;
709 		}
710 
711 		if (block_size > 1024 || block_size > length) {
712 			rc = -EOVERFLOW;
713 			break;
714 		}
715 
716 		if (length == 0) {
717 			rc = 0;
718 			break;
719 		}
720 
721 		if (block_size == 0) {
722 			rc = -EPROTO;
723 			may_continue--;
724 			udelay(1);
725 			continue;
726 		}
727 
728 		prev_block_size = block_size;
729 		memcpy(buffer, data + done, block_size);
730 
731 		rc = mwl8k_send_fw_load_cmd(priv, buffer, block_size);
732 		if (rc)
733 			break;
734 	}
735 
736 	if (!rc && length != 0)
737 		rc = -EREMOTEIO;
738 
739 	kfree(buffer);
740 
741 	return rc;
742 }
743 
744 static int mwl8k_load_firmware(struct ieee80211_hw *hw)
745 {
746 	struct mwl8k_priv *priv = hw->priv;
747 	const struct firmware *fw = priv->fw_ucode;
748 	int rc;
749 	int loops;
750 
751 	if (!memcmp(fw->data, "\x01\x00\x00\x00", 4) && !priv->is_8764) {
752 		const struct firmware *helper = priv->fw_helper;
753 
754 		if (helper == NULL) {
755 			printk(KERN_ERR "%s: helper image needed but none "
756 			       "given\n", pci_name(priv->pdev));
757 			return -EINVAL;
758 		}
759 
760 		rc = mwl8k_load_fw_image(priv, helper->data, helper->size);
761 		if (rc) {
762 			printk(KERN_ERR "%s: unable to load firmware "
763 			       "helper image\n", pci_name(priv->pdev));
764 			return rc;
765 		}
766 		msleep(20);
767 
768 		rc = mwl8k_feed_fw_image(priv, fw->data, fw->size);
769 	} else {
770 		if (priv->is_8764)
771 			rc = mwl8k_feed_fw_image(priv, fw->data, fw->size);
772 		else
773 			rc = mwl8k_load_fw_image(priv, fw->data, fw->size);
774 	}
775 
776 	if (rc) {
777 		printk(KERN_ERR "%s: unable to load firmware image\n",
778 		       pci_name(priv->pdev));
779 		return rc;
780 	}
781 
782 	iowrite32(MWL8K_MODE_STA, priv->regs + MWL8K_HIU_GEN_PTR);
783 
784 	loops = 500000;
785 	do {
786 		u32 ready_code;
787 
788 		ready_code = ioread32(priv->regs + MWL8K_HIU_INT_CODE);
789 		if (ready_code == MWL8K_FWAP_READY) {
790 			priv->ap_fw = true;
791 			break;
792 		} else if (ready_code == MWL8K_FWSTA_READY) {
793 			priv->ap_fw = false;
794 			break;
795 		}
796 
797 		cond_resched();
798 		udelay(1);
799 	} while (--loops);
800 
801 	return loops ? 0 : -ETIMEDOUT;
802 }
803 
804 
805 /* DMA header used by firmware and hardware.  */
806 struct mwl8k_dma_data {
807 	__le16 fwlen;
808 	struct ieee80211_hdr wh;
809 	char data[0];
810 } __packed;
811 
812 /* Routines to add/remove DMA header from skb.  */
813 static inline void mwl8k_remove_dma_header(struct sk_buff *skb, __le16 qos)
814 {
815 	struct mwl8k_dma_data *tr;
816 	int hdrlen;
817 
818 	tr = (struct mwl8k_dma_data *)skb->data;
819 	hdrlen = ieee80211_hdrlen(tr->wh.frame_control);
820 
821 	if (hdrlen != sizeof(tr->wh)) {
822 		if (ieee80211_is_data_qos(tr->wh.frame_control)) {
823 			memmove(tr->data - hdrlen, &tr->wh, hdrlen - 2);
824 			*((__le16 *)(tr->data - 2)) = qos;
825 		} else {
826 			memmove(tr->data - hdrlen, &tr->wh, hdrlen);
827 		}
828 	}
829 
830 	if (hdrlen != sizeof(*tr))
831 		skb_pull(skb, sizeof(*tr) - hdrlen);
832 }
833 
834 #define REDUCED_TX_HEADROOM	8
835 
836 static void
837 mwl8k_add_dma_header(struct mwl8k_priv *priv, struct sk_buff *skb,
838 						int head_pad, int tail_pad)
839 {
840 	struct ieee80211_hdr *wh;
841 	int hdrlen;
842 	int reqd_hdrlen;
843 	struct mwl8k_dma_data *tr;
844 
845 	/*
846 	 * Add a firmware DMA header; the firmware requires that we
847 	 * present a 2-byte payload length followed by a 4-address
848 	 * header (without QoS field), followed (optionally) by any
849 	 * WEP/ExtIV header (but only filled in for CCMP).
850 	 */
851 	wh = (struct ieee80211_hdr *)skb->data;
852 
853 	hdrlen = ieee80211_hdrlen(wh->frame_control);
854 
855 	/*
856 	 * Check if skb_resize is required because of
857 	 * tx_headroom adjustment.
858 	 */
859 	if (priv->ap_fw && (hdrlen < (sizeof(struct ieee80211_cts)
860 						+ REDUCED_TX_HEADROOM))) {
861 		if (pskb_expand_head(skb, REDUCED_TX_HEADROOM, 0, GFP_ATOMIC)) {
862 
863 			wiphy_err(priv->hw->wiphy,
864 					"Failed to reallocate TX buffer\n");
865 			return;
866 		}
867 		skb->truesize += REDUCED_TX_HEADROOM;
868 	}
869 
870 	reqd_hdrlen = sizeof(*tr) + head_pad;
871 
872 	if (hdrlen != reqd_hdrlen)
873 		skb_push(skb, reqd_hdrlen - hdrlen);
874 
875 	if (ieee80211_is_data_qos(wh->frame_control))
876 		hdrlen -= IEEE80211_QOS_CTL_LEN;
877 
878 	tr = (struct mwl8k_dma_data *)skb->data;
879 	if (wh != &tr->wh)
880 		memmove(&tr->wh, wh, hdrlen);
881 	if (hdrlen != sizeof(tr->wh))
882 		memset(((void *)&tr->wh) + hdrlen, 0, sizeof(tr->wh) - hdrlen);
883 
884 	/*
885 	 * Firmware length is the length of the fully formed "802.11
886 	 * payload".  That is, everything except for the 802.11 header.
887 	 * This includes all crypto material including the MIC.
888 	 */
889 	tr->fwlen = cpu_to_le16(skb->len - sizeof(*tr) + tail_pad);
890 }
891 
892 static void mwl8k_encapsulate_tx_frame(struct mwl8k_priv *priv,
893 		struct sk_buff *skb)
894 {
895 	struct ieee80211_hdr *wh;
896 	struct ieee80211_tx_info *tx_info;
897 	struct ieee80211_key_conf *key_conf;
898 	int data_pad;
899 	int head_pad = 0;
900 
901 	wh = (struct ieee80211_hdr *)skb->data;
902 
903 	tx_info = IEEE80211_SKB_CB(skb);
904 
905 	key_conf = NULL;
906 	if (ieee80211_is_data(wh->frame_control))
907 		key_conf = tx_info->control.hw_key;
908 
909 	/*
910 	 * Make sure the packet header is in the DMA header format (4-address
911 	 * without QoS), and add head & tail padding when HW crypto is enabled.
912 	 *
913 	 * We have the following trailer padding requirements:
914 	 * - WEP: 4 trailer bytes (ICV)
915 	 * - TKIP: 12 trailer bytes (8 MIC + 4 ICV)
916 	 * - CCMP: 8 trailer bytes (MIC)
917 	 */
918 	data_pad = 0;
919 	if (key_conf != NULL) {
920 		head_pad = key_conf->iv_len;
921 		switch (key_conf->cipher) {
922 		case WLAN_CIPHER_SUITE_WEP40:
923 		case WLAN_CIPHER_SUITE_WEP104:
924 			data_pad = 4;
925 			break;
926 		case WLAN_CIPHER_SUITE_TKIP:
927 			data_pad = 12;
928 			break;
929 		case WLAN_CIPHER_SUITE_CCMP:
930 			data_pad = 8;
931 			break;
932 		}
933 	}
934 	mwl8k_add_dma_header(priv, skb, head_pad, data_pad);
935 }
936 
937 /*
938  * Packet reception for 88w8366/88w8764 AP firmware.
939  */
940 struct mwl8k_rxd_ap {
941 	__le16 pkt_len;
942 	__u8 sq2;
943 	__u8 rate;
944 	__le32 pkt_phys_addr;
945 	__le32 next_rxd_phys_addr;
946 	__le16 qos_control;
947 	__le16 htsig2;
948 	__le32 hw_rssi_info;
949 	__le32 hw_noise_floor_info;
950 	__u8 noise_floor;
951 	__u8 pad0[3];
952 	__u8 rssi;
953 	__u8 rx_status;
954 	__u8 channel;
955 	__u8 rx_ctrl;
956 } __packed;
957 
958 #define MWL8K_AP_RATE_INFO_MCS_FORMAT		0x80
959 #define MWL8K_AP_RATE_INFO_40MHZ		0x40
960 #define MWL8K_AP_RATE_INFO_RATEID(x)		((x) & 0x3f)
961 
962 #define MWL8K_AP_RX_CTRL_OWNED_BY_HOST		0x80
963 
964 /* 8366/8764 AP rx_status bits */
965 #define MWL8K_AP_RXSTAT_DECRYPT_ERR_MASK		0x80
966 #define MWL8K_AP_RXSTAT_GENERAL_DECRYPT_ERR		0xFF
967 #define MWL8K_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR		0x02
968 #define MWL8K_AP_RXSTAT_WEP_DECRYPT_ICV_ERR		0x04
969 #define MWL8K_AP_RXSTAT_TKIP_DECRYPT_ICV_ERR		0x08
970 
971 static void mwl8k_rxd_ap_init(void *_rxd, dma_addr_t next_dma_addr)
972 {
973 	struct mwl8k_rxd_ap *rxd = _rxd;
974 
975 	rxd->next_rxd_phys_addr = cpu_to_le32(next_dma_addr);
976 	rxd->rx_ctrl = MWL8K_AP_RX_CTRL_OWNED_BY_HOST;
977 }
978 
979 static void mwl8k_rxd_ap_refill(void *_rxd, dma_addr_t addr, int len)
980 {
981 	struct mwl8k_rxd_ap *rxd = _rxd;
982 
983 	rxd->pkt_len = cpu_to_le16(len);
984 	rxd->pkt_phys_addr = cpu_to_le32(addr);
985 	wmb();
986 	rxd->rx_ctrl = 0;
987 }
988 
989 static int
990 mwl8k_rxd_ap_process(void *_rxd, struct ieee80211_rx_status *status,
991 		     __le16 *qos, s8 *noise)
992 {
993 	struct mwl8k_rxd_ap *rxd = _rxd;
994 
995 	if (!(rxd->rx_ctrl & MWL8K_AP_RX_CTRL_OWNED_BY_HOST))
996 		return -1;
997 	rmb();
998 
999 	memset(status, 0, sizeof(*status));
1000 
1001 	status->signal = -rxd->rssi;
1002 	*noise = -rxd->noise_floor;
1003 
1004 	if (rxd->rate & MWL8K_AP_RATE_INFO_MCS_FORMAT) {
1005 		status->encoding = RX_ENC_HT;
1006 		if (rxd->rate & MWL8K_AP_RATE_INFO_40MHZ)
1007 			status->bw = RATE_INFO_BW_40;
1008 		status->rate_idx = MWL8K_AP_RATE_INFO_RATEID(rxd->rate);
1009 	} else {
1010 		int i;
1011 
1012 		for (i = 0; i < ARRAY_SIZE(mwl8k_rates_24); i++) {
1013 			if (mwl8k_rates_24[i].hw_value == rxd->rate) {
1014 				status->rate_idx = i;
1015 				break;
1016 			}
1017 		}
1018 	}
1019 
1020 	if (rxd->channel > 14) {
1021 		status->band = NL80211_BAND_5GHZ;
1022 		if (!(status->encoding == RX_ENC_HT) &&
1023 		    status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
1024 			status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
1025 	} else {
1026 		status->band = NL80211_BAND_2GHZ;
1027 	}
1028 	status->freq = ieee80211_channel_to_frequency(rxd->channel,
1029 						      status->band);
1030 
1031 	*qos = rxd->qos_control;
1032 
1033 	if ((rxd->rx_status != MWL8K_AP_RXSTAT_GENERAL_DECRYPT_ERR) &&
1034 	    (rxd->rx_status & MWL8K_AP_RXSTAT_DECRYPT_ERR_MASK) &&
1035 	    (rxd->rx_status & MWL8K_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR))
1036 		status->flag |= RX_FLAG_MMIC_ERROR;
1037 
1038 	return le16_to_cpu(rxd->pkt_len);
1039 }
1040 
1041 static struct rxd_ops rxd_ap_ops = {
1042 	.rxd_size	= sizeof(struct mwl8k_rxd_ap),
1043 	.rxd_init	= mwl8k_rxd_ap_init,
1044 	.rxd_refill	= mwl8k_rxd_ap_refill,
1045 	.rxd_process	= mwl8k_rxd_ap_process,
1046 };
1047 
1048 /*
1049  * Packet reception for STA firmware.
1050  */
1051 struct mwl8k_rxd_sta {
1052 	__le16 pkt_len;
1053 	__u8 link_quality;
1054 	__u8 noise_level;
1055 	__le32 pkt_phys_addr;
1056 	__le32 next_rxd_phys_addr;
1057 	__le16 qos_control;
1058 	__le16 rate_info;
1059 	__le32 pad0[4];
1060 	__u8 rssi;
1061 	__u8 channel;
1062 	__le16 pad1;
1063 	__u8 rx_ctrl;
1064 	__u8 rx_status;
1065 	__u8 pad2[2];
1066 } __packed;
1067 
1068 #define MWL8K_STA_RATE_INFO_SHORTPRE		0x8000
1069 #define MWL8K_STA_RATE_INFO_ANTSELECT(x)	(((x) >> 11) & 0x3)
1070 #define MWL8K_STA_RATE_INFO_RATEID(x)		(((x) >> 3) & 0x3f)
1071 #define MWL8K_STA_RATE_INFO_40MHZ		0x0004
1072 #define MWL8K_STA_RATE_INFO_SHORTGI		0x0002
1073 #define MWL8K_STA_RATE_INFO_MCS_FORMAT		0x0001
1074 
1075 #define MWL8K_STA_RX_CTRL_OWNED_BY_HOST		0x02
1076 #define MWL8K_STA_RX_CTRL_DECRYPT_ERROR		0x04
1077 /* ICV=0 or MIC=1 */
1078 #define MWL8K_STA_RX_CTRL_DEC_ERR_TYPE		0x08
1079 /* Key is uploaded only in failure case */
1080 #define MWL8K_STA_RX_CTRL_KEY_INDEX			0x30
1081 
1082 static void mwl8k_rxd_sta_init(void *_rxd, dma_addr_t next_dma_addr)
1083 {
1084 	struct mwl8k_rxd_sta *rxd = _rxd;
1085 
1086 	rxd->next_rxd_phys_addr = cpu_to_le32(next_dma_addr);
1087 	rxd->rx_ctrl = MWL8K_STA_RX_CTRL_OWNED_BY_HOST;
1088 }
1089 
1090 static void mwl8k_rxd_sta_refill(void *_rxd, dma_addr_t addr, int len)
1091 {
1092 	struct mwl8k_rxd_sta *rxd = _rxd;
1093 
1094 	rxd->pkt_len = cpu_to_le16(len);
1095 	rxd->pkt_phys_addr = cpu_to_le32(addr);
1096 	wmb();
1097 	rxd->rx_ctrl = 0;
1098 }
1099 
1100 static int
1101 mwl8k_rxd_sta_process(void *_rxd, struct ieee80211_rx_status *status,
1102 		       __le16 *qos, s8 *noise)
1103 {
1104 	struct mwl8k_rxd_sta *rxd = _rxd;
1105 	u16 rate_info;
1106 
1107 	if (!(rxd->rx_ctrl & MWL8K_STA_RX_CTRL_OWNED_BY_HOST))
1108 		return -1;
1109 	rmb();
1110 
1111 	rate_info = le16_to_cpu(rxd->rate_info);
1112 
1113 	memset(status, 0, sizeof(*status));
1114 
1115 	status->signal = -rxd->rssi;
1116 	*noise = -rxd->noise_level;
1117 	status->antenna = MWL8K_STA_RATE_INFO_ANTSELECT(rate_info);
1118 	status->rate_idx = MWL8K_STA_RATE_INFO_RATEID(rate_info);
1119 
1120 	if (rate_info & MWL8K_STA_RATE_INFO_SHORTPRE)
1121 		status->enc_flags |= RX_ENC_FLAG_SHORTPRE;
1122 	if (rate_info & MWL8K_STA_RATE_INFO_40MHZ)
1123 		status->bw = RATE_INFO_BW_40;
1124 	if (rate_info & MWL8K_STA_RATE_INFO_SHORTGI)
1125 		status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
1126 	if (rate_info & MWL8K_STA_RATE_INFO_MCS_FORMAT)
1127 		status->encoding = RX_ENC_HT;
1128 
1129 	if (rxd->channel > 14) {
1130 		status->band = NL80211_BAND_5GHZ;
1131 		if (!(status->encoding == RX_ENC_HT) &&
1132 		    status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
1133 			status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
1134 	} else {
1135 		status->band = NL80211_BAND_2GHZ;
1136 	}
1137 	status->freq = ieee80211_channel_to_frequency(rxd->channel,
1138 						      status->band);
1139 
1140 	*qos = rxd->qos_control;
1141 	if ((rxd->rx_ctrl & MWL8K_STA_RX_CTRL_DECRYPT_ERROR) &&
1142 	    (rxd->rx_ctrl & MWL8K_STA_RX_CTRL_DEC_ERR_TYPE))
1143 		status->flag |= RX_FLAG_MMIC_ERROR;
1144 
1145 	return le16_to_cpu(rxd->pkt_len);
1146 }
1147 
1148 static struct rxd_ops rxd_sta_ops = {
1149 	.rxd_size	= sizeof(struct mwl8k_rxd_sta),
1150 	.rxd_init	= mwl8k_rxd_sta_init,
1151 	.rxd_refill	= mwl8k_rxd_sta_refill,
1152 	.rxd_process	= mwl8k_rxd_sta_process,
1153 };
1154 
1155 
1156 #define MWL8K_RX_DESCS		256
1157 #define MWL8K_RX_MAXSZ		3800
1158 
1159 static int mwl8k_rxq_init(struct ieee80211_hw *hw, int index)
1160 {
1161 	struct mwl8k_priv *priv = hw->priv;
1162 	struct mwl8k_rx_queue *rxq = priv->rxq + index;
1163 	int size;
1164 	int i;
1165 
1166 	rxq->rxd_count = 0;
1167 	rxq->head = 0;
1168 	rxq->tail = 0;
1169 
1170 	size = MWL8K_RX_DESCS * priv->rxd_ops->rxd_size;
1171 
1172 	rxq->rxd = pci_zalloc_consistent(priv->pdev, size, &rxq->rxd_dma);
1173 	if (rxq->rxd == NULL) {
1174 		wiphy_err(hw->wiphy, "failed to alloc RX descriptors\n");
1175 		return -ENOMEM;
1176 	}
1177 
1178 	rxq->buf = kcalloc(MWL8K_RX_DESCS, sizeof(*rxq->buf), GFP_KERNEL);
1179 	if (rxq->buf == NULL) {
1180 		pci_free_consistent(priv->pdev, size, rxq->rxd, rxq->rxd_dma);
1181 		return -ENOMEM;
1182 	}
1183 
1184 	for (i = 0; i < MWL8K_RX_DESCS; i++) {
1185 		int desc_size;
1186 		void *rxd;
1187 		int nexti;
1188 		dma_addr_t next_dma_addr;
1189 
1190 		desc_size = priv->rxd_ops->rxd_size;
1191 		rxd = rxq->rxd + (i * priv->rxd_ops->rxd_size);
1192 
1193 		nexti = i + 1;
1194 		if (nexti == MWL8K_RX_DESCS)
1195 			nexti = 0;
1196 		next_dma_addr = rxq->rxd_dma + (nexti * desc_size);
1197 
1198 		priv->rxd_ops->rxd_init(rxd, next_dma_addr);
1199 	}
1200 
1201 	return 0;
1202 }
1203 
1204 static int rxq_refill(struct ieee80211_hw *hw, int index, int limit)
1205 {
1206 	struct mwl8k_priv *priv = hw->priv;
1207 	struct mwl8k_rx_queue *rxq = priv->rxq + index;
1208 	int refilled;
1209 
1210 	refilled = 0;
1211 	while (rxq->rxd_count < MWL8K_RX_DESCS && limit--) {
1212 		struct sk_buff *skb;
1213 		dma_addr_t addr;
1214 		int rx;
1215 		void *rxd;
1216 
1217 		skb = dev_alloc_skb(MWL8K_RX_MAXSZ);
1218 		if (skb == NULL)
1219 			break;
1220 
1221 		addr = pci_map_single(priv->pdev, skb->data,
1222 				      MWL8K_RX_MAXSZ, DMA_FROM_DEVICE);
1223 
1224 		rxq->rxd_count++;
1225 		rx = rxq->tail++;
1226 		if (rxq->tail == MWL8K_RX_DESCS)
1227 			rxq->tail = 0;
1228 		rxq->buf[rx].skb = skb;
1229 		dma_unmap_addr_set(&rxq->buf[rx], dma, addr);
1230 
1231 		rxd = rxq->rxd + (rx * priv->rxd_ops->rxd_size);
1232 		priv->rxd_ops->rxd_refill(rxd, addr, MWL8K_RX_MAXSZ);
1233 
1234 		refilled++;
1235 	}
1236 
1237 	return refilled;
1238 }
1239 
1240 /* Must be called only when the card's reception is completely halted */
1241 static void mwl8k_rxq_deinit(struct ieee80211_hw *hw, int index)
1242 {
1243 	struct mwl8k_priv *priv = hw->priv;
1244 	struct mwl8k_rx_queue *rxq = priv->rxq + index;
1245 	int i;
1246 
1247 	if (rxq->rxd == NULL)
1248 		return;
1249 
1250 	for (i = 0; i < MWL8K_RX_DESCS; i++) {
1251 		if (rxq->buf[i].skb != NULL) {
1252 			pci_unmap_single(priv->pdev,
1253 					 dma_unmap_addr(&rxq->buf[i], dma),
1254 					 MWL8K_RX_MAXSZ, PCI_DMA_FROMDEVICE);
1255 			dma_unmap_addr_set(&rxq->buf[i], dma, 0);
1256 
1257 			kfree_skb(rxq->buf[i].skb);
1258 			rxq->buf[i].skb = NULL;
1259 		}
1260 	}
1261 
1262 	kfree(rxq->buf);
1263 	rxq->buf = NULL;
1264 
1265 	pci_free_consistent(priv->pdev,
1266 			    MWL8K_RX_DESCS * priv->rxd_ops->rxd_size,
1267 			    rxq->rxd, rxq->rxd_dma);
1268 	rxq->rxd = NULL;
1269 }
1270 
1271 
1272 /*
1273  * Scan a list of BSSIDs to process for finalize join.
1274  * Allows for extension to process multiple BSSIDs.
1275  */
1276 static inline int
1277 mwl8k_capture_bssid(struct mwl8k_priv *priv, struct ieee80211_hdr *wh)
1278 {
1279 	return priv->capture_beacon &&
1280 		ieee80211_is_beacon(wh->frame_control) &&
1281 		ether_addr_equal_64bits(wh->addr3, priv->capture_bssid);
1282 }
1283 
1284 static inline void mwl8k_save_beacon(struct ieee80211_hw *hw,
1285 				     struct sk_buff *skb)
1286 {
1287 	struct mwl8k_priv *priv = hw->priv;
1288 
1289 	priv->capture_beacon = false;
1290 	eth_zero_addr(priv->capture_bssid);
1291 
1292 	/*
1293 	 * Use GFP_ATOMIC as rxq_process is called from
1294 	 * the primary interrupt handler, memory allocation call
1295 	 * must not sleep.
1296 	 */
1297 	priv->beacon_skb = skb_copy(skb, GFP_ATOMIC);
1298 	if (priv->beacon_skb != NULL)
1299 		ieee80211_queue_work(hw, &priv->finalize_join_worker);
1300 }
1301 
1302 static inline struct mwl8k_vif *mwl8k_find_vif_bss(struct list_head *vif_list,
1303 						   u8 *bssid)
1304 {
1305 	struct mwl8k_vif *mwl8k_vif;
1306 
1307 	list_for_each_entry(mwl8k_vif,
1308 			    vif_list, list) {
1309 		if (memcmp(bssid, mwl8k_vif->bssid,
1310 			   ETH_ALEN) == 0)
1311 			return mwl8k_vif;
1312 	}
1313 
1314 	return NULL;
1315 }
1316 
1317 static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
1318 {
1319 	struct mwl8k_priv *priv = hw->priv;
1320 	struct mwl8k_vif *mwl8k_vif = NULL;
1321 	struct mwl8k_rx_queue *rxq = priv->rxq + index;
1322 	int processed;
1323 
1324 	processed = 0;
1325 	while (rxq->rxd_count && limit--) {
1326 		struct sk_buff *skb;
1327 		void *rxd;
1328 		int pkt_len;
1329 		struct ieee80211_rx_status status;
1330 		struct ieee80211_hdr *wh;
1331 		__le16 qos;
1332 
1333 		skb = rxq->buf[rxq->head].skb;
1334 		if (skb == NULL)
1335 			break;
1336 
1337 		rxd = rxq->rxd + (rxq->head * priv->rxd_ops->rxd_size);
1338 
1339 		pkt_len = priv->rxd_ops->rxd_process(rxd, &status, &qos,
1340 							&priv->noise);
1341 		if (pkt_len < 0)
1342 			break;
1343 
1344 		rxq->buf[rxq->head].skb = NULL;
1345 
1346 		pci_unmap_single(priv->pdev,
1347 				 dma_unmap_addr(&rxq->buf[rxq->head], dma),
1348 				 MWL8K_RX_MAXSZ, PCI_DMA_FROMDEVICE);
1349 		dma_unmap_addr_set(&rxq->buf[rxq->head], dma, 0);
1350 
1351 		rxq->head++;
1352 		if (rxq->head == MWL8K_RX_DESCS)
1353 			rxq->head = 0;
1354 
1355 		rxq->rxd_count--;
1356 
1357 		wh = &((struct mwl8k_dma_data *)skb->data)->wh;
1358 
1359 		/*
1360 		 * Check for a pending join operation.  Save a
1361 		 * copy of the beacon and schedule a tasklet to
1362 		 * send a FINALIZE_JOIN command to the firmware.
1363 		 */
1364 		if (mwl8k_capture_bssid(priv, (void *)skb->data))
1365 			mwl8k_save_beacon(hw, skb);
1366 
1367 		if (ieee80211_has_protected(wh->frame_control)) {
1368 
1369 			/* Check if hw crypto has been enabled for
1370 			 * this bss. If yes, set the status flags
1371 			 * accordingly
1372 			 */
1373 			mwl8k_vif = mwl8k_find_vif_bss(&priv->vif_list,
1374 								wh->addr1);
1375 
1376 			if (mwl8k_vif != NULL &&
1377 			    mwl8k_vif->is_hw_crypto_enabled) {
1378 				/*
1379 				 * When MMIC ERROR is encountered
1380 				 * by the firmware, payload is
1381 				 * dropped and only 32 bytes of
1382 				 * mwl8k Firmware header is sent
1383 				 * to the host.
1384 				 *
1385 				 * We need to add four bytes of
1386 				 * key information.  In it
1387 				 * MAC80211 expects keyidx set to
1388 				 * 0 for triggering Counter
1389 				 * Measure of MMIC failure.
1390 				 */
1391 				if (status.flag & RX_FLAG_MMIC_ERROR) {
1392 					struct mwl8k_dma_data *tr;
1393 					tr = (struct mwl8k_dma_data *)skb->data;
1394 					memset((void *)&(tr->data), 0, 4);
1395 					pkt_len += 4;
1396 				}
1397 
1398 				if (!ieee80211_is_auth(wh->frame_control))
1399 					status.flag |= RX_FLAG_IV_STRIPPED |
1400 						       RX_FLAG_DECRYPTED |
1401 						       RX_FLAG_MMIC_STRIPPED;
1402 			}
1403 		}
1404 
1405 		skb_put(skb, pkt_len);
1406 		mwl8k_remove_dma_header(skb, qos);
1407 		memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
1408 		ieee80211_rx_irqsafe(hw, skb);
1409 
1410 		processed++;
1411 	}
1412 
1413 	return processed;
1414 }
1415 
1416 
1417 /*
1418  * Packet transmission.
1419  */
1420 
1421 #define MWL8K_TXD_STATUS_OK			0x00000001
1422 #define MWL8K_TXD_STATUS_OK_RETRY		0x00000002
1423 #define MWL8K_TXD_STATUS_OK_MORE_RETRY		0x00000004
1424 #define MWL8K_TXD_STATUS_MULTICAST_TX		0x00000008
1425 #define MWL8K_TXD_STATUS_FW_OWNED		0x80000000
1426 
1427 #define MWL8K_QOS_QLEN_UNSPEC			0xff00
1428 #define MWL8K_QOS_ACK_POLICY_MASK		0x0060
1429 #define MWL8K_QOS_ACK_POLICY_NORMAL		0x0000
1430 #define MWL8K_QOS_ACK_POLICY_BLOCKACK		0x0060
1431 #define MWL8K_QOS_EOSP				0x0010
1432 
1433 struct mwl8k_tx_desc {
1434 	__le32 status;
1435 	__u8 data_rate;
1436 	__u8 tx_priority;
1437 	__le16 qos_control;
1438 	__le32 pkt_phys_addr;
1439 	__le16 pkt_len;
1440 	__u8 dest_MAC_addr[ETH_ALEN];
1441 	__le32 next_txd_phys_addr;
1442 	__le32 timestamp;
1443 	__le16 rate_info;
1444 	__u8 peer_id;
1445 	__u8 tx_frag_cnt;
1446 } __packed;
1447 
1448 #define MWL8K_TX_DESCS		128
1449 
1450 static int mwl8k_txq_init(struct ieee80211_hw *hw, int index)
1451 {
1452 	struct mwl8k_priv *priv = hw->priv;
1453 	struct mwl8k_tx_queue *txq = priv->txq + index;
1454 	int size;
1455 	int i;
1456 
1457 	txq->len = 0;
1458 	txq->head = 0;
1459 	txq->tail = 0;
1460 
1461 	size = MWL8K_TX_DESCS * sizeof(struct mwl8k_tx_desc);
1462 
1463 	txq->txd = pci_zalloc_consistent(priv->pdev, size, &txq->txd_dma);
1464 	if (txq->txd == NULL) {
1465 		wiphy_err(hw->wiphy, "failed to alloc TX descriptors\n");
1466 		return -ENOMEM;
1467 	}
1468 
1469 	txq->skb = kcalloc(MWL8K_TX_DESCS, sizeof(*txq->skb), GFP_KERNEL);
1470 	if (txq->skb == NULL) {
1471 		pci_free_consistent(priv->pdev, size, txq->txd, txq->txd_dma);
1472 		return -ENOMEM;
1473 	}
1474 
1475 	for (i = 0; i < MWL8K_TX_DESCS; i++) {
1476 		struct mwl8k_tx_desc *tx_desc;
1477 		int nexti;
1478 
1479 		tx_desc = txq->txd + i;
1480 		nexti = (i + 1) % MWL8K_TX_DESCS;
1481 
1482 		tx_desc->status = 0;
1483 		tx_desc->next_txd_phys_addr =
1484 			cpu_to_le32(txq->txd_dma + nexti * sizeof(*tx_desc));
1485 	}
1486 
1487 	return 0;
1488 }
1489 
1490 static inline void mwl8k_tx_start(struct mwl8k_priv *priv)
1491 {
1492 	iowrite32(MWL8K_H2A_INT_PPA_READY,
1493 		priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
1494 	iowrite32(MWL8K_H2A_INT_DUMMY,
1495 		priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
1496 	ioread32(priv->regs + MWL8K_HIU_INT_CODE);
1497 }
1498 
1499 static void mwl8k_dump_tx_rings(struct ieee80211_hw *hw)
1500 {
1501 	struct mwl8k_priv *priv = hw->priv;
1502 	int i;
1503 
1504 	for (i = 0; i < mwl8k_tx_queues(priv); i++) {
1505 		struct mwl8k_tx_queue *txq = priv->txq + i;
1506 		int fw_owned = 0;
1507 		int drv_owned = 0;
1508 		int unused = 0;
1509 		int desc;
1510 
1511 		for (desc = 0; desc < MWL8K_TX_DESCS; desc++) {
1512 			struct mwl8k_tx_desc *tx_desc = txq->txd + desc;
1513 			u32 status;
1514 
1515 			status = le32_to_cpu(tx_desc->status);
1516 			if (status & MWL8K_TXD_STATUS_FW_OWNED)
1517 				fw_owned++;
1518 			else
1519 				drv_owned++;
1520 
1521 			if (tx_desc->pkt_len == 0)
1522 				unused++;
1523 		}
1524 
1525 		wiphy_err(hw->wiphy,
1526 			  "txq[%d] len=%d head=%d tail=%d "
1527 			  "fw_owned=%d drv_owned=%d unused=%d\n",
1528 			  i,
1529 			  txq->len, txq->head, txq->tail,
1530 			  fw_owned, drv_owned, unused);
1531 	}
1532 }
1533 
1534 /*
1535  * Must be called with priv->fw_mutex held and tx queues stopped.
1536  */
1537 #define MWL8K_TX_WAIT_TIMEOUT_MS	5000
1538 
1539 static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
1540 {
1541 	struct mwl8k_priv *priv = hw->priv;
1542 	DECLARE_COMPLETION_ONSTACK(tx_wait);
1543 	int retry;
1544 	int rc;
1545 
1546 	might_sleep();
1547 
1548 	/* Since fw restart is in progress, allow only the firmware
1549 	 * commands from the restart code and block the other
1550 	 * commands since they are going to fail in any case since
1551 	 * the firmware has crashed
1552 	 */
1553 	if (priv->hw_restart_in_progress) {
1554 		if (priv->hw_restart_owner == current)
1555 			return 0;
1556 		else
1557 			return -EBUSY;
1558 	}
1559 
1560 	if (atomic_read(&priv->watchdog_event_pending))
1561 		return 0;
1562 
1563 	/*
1564 	 * The TX queues are stopped at this point, so this test
1565 	 * doesn't need to take ->tx_lock.
1566 	 */
1567 	if (!priv->pending_tx_pkts)
1568 		return 0;
1569 
1570 	retry = 1;
1571 	rc = 0;
1572 
1573 	spin_lock_bh(&priv->tx_lock);
1574 	priv->tx_wait = &tx_wait;
1575 	while (!rc) {
1576 		int oldcount;
1577 		unsigned long timeout;
1578 
1579 		oldcount = priv->pending_tx_pkts;
1580 
1581 		spin_unlock_bh(&priv->tx_lock);
1582 		timeout = wait_for_completion_timeout(&tx_wait,
1583 			    msecs_to_jiffies(MWL8K_TX_WAIT_TIMEOUT_MS));
1584 
1585 		if (atomic_read(&priv->watchdog_event_pending)) {
1586 			spin_lock_bh(&priv->tx_lock);
1587 			priv->tx_wait = NULL;
1588 			spin_unlock_bh(&priv->tx_lock);
1589 			return 0;
1590 		}
1591 
1592 		spin_lock_bh(&priv->tx_lock);
1593 
1594 		if (timeout || !priv->pending_tx_pkts) {
1595 			WARN_ON(priv->pending_tx_pkts);
1596 			if (retry)
1597 				wiphy_notice(hw->wiphy, "tx rings drained\n");
1598 			break;
1599 		}
1600 
1601 		if (retry) {
1602 			mwl8k_tx_start(priv);
1603 			retry = 0;
1604 			continue;
1605 		}
1606 
1607 		if (priv->pending_tx_pkts < oldcount) {
1608 			wiphy_notice(hw->wiphy,
1609 				     "waiting for tx rings to drain (%d -> %d pkts)\n",
1610 				     oldcount, priv->pending_tx_pkts);
1611 			retry = 1;
1612 			continue;
1613 		}
1614 
1615 		priv->tx_wait = NULL;
1616 
1617 		wiphy_err(hw->wiphy, "tx rings stuck for %d ms\n",
1618 			  MWL8K_TX_WAIT_TIMEOUT_MS);
1619 		mwl8k_dump_tx_rings(hw);
1620 		priv->hw_restart_in_progress = true;
1621 		ieee80211_queue_work(hw, &priv->fw_reload);
1622 
1623 		rc = -ETIMEDOUT;
1624 	}
1625 	priv->tx_wait = NULL;
1626 	spin_unlock_bh(&priv->tx_lock);
1627 
1628 	return rc;
1629 }
1630 
1631 #define MWL8K_TXD_SUCCESS(status)				\
1632 	((status) & (MWL8K_TXD_STATUS_OK |			\
1633 		     MWL8K_TXD_STATUS_OK_RETRY |		\
1634 		     MWL8K_TXD_STATUS_OK_MORE_RETRY))
1635 
1636 static int mwl8k_tid_queue_mapping(u8 tid)
1637 {
1638 	BUG_ON(tid > 7);
1639 
1640 	switch (tid) {
1641 	case 0:
1642 	case 3:
1643 		return IEEE80211_AC_BE;
1644 	case 1:
1645 	case 2:
1646 		return IEEE80211_AC_BK;
1647 	case 4:
1648 	case 5:
1649 		return IEEE80211_AC_VI;
1650 	case 6:
1651 	case 7:
1652 		return IEEE80211_AC_VO;
1653 	default:
1654 		return -1;
1655 	}
1656 }
1657 
1658 /* The firmware will fill in the rate information
1659  * for each packet that gets queued in the hardware
1660  * and these macros will interpret that info.
1661  */
1662 
1663 #define RI_FORMAT(a)		  (a & 0x0001)
1664 #define RI_RATE_ID_MCS(a)	 ((a & 0x01f8) >> 3)
1665 
1666 static int
1667 mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
1668 {
1669 	struct mwl8k_priv *priv = hw->priv;
1670 	struct mwl8k_tx_queue *txq = priv->txq + index;
1671 	int processed;
1672 
1673 	processed = 0;
1674 	while (txq->len > 0 && limit--) {
1675 		int tx;
1676 		struct mwl8k_tx_desc *tx_desc;
1677 		unsigned long addr;
1678 		int size;
1679 		struct sk_buff *skb;
1680 		struct ieee80211_tx_info *info;
1681 		u32 status;
1682 		struct ieee80211_sta *sta;
1683 		struct mwl8k_sta *sta_info = NULL;
1684 		u16 rate_info;
1685 		struct ieee80211_hdr *wh;
1686 
1687 		tx = txq->head;
1688 		tx_desc = txq->txd + tx;
1689 
1690 		status = le32_to_cpu(tx_desc->status);
1691 
1692 		if (status & MWL8K_TXD_STATUS_FW_OWNED) {
1693 			if (!force)
1694 				break;
1695 			tx_desc->status &=
1696 				~cpu_to_le32(MWL8K_TXD_STATUS_FW_OWNED);
1697 		}
1698 
1699 		txq->head = (tx + 1) % MWL8K_TX_DESCS;
1700 		BUG_ON(txq->len == 0);
1701 		txq->len--;
1702 		priv->pending_tx_pkts--;
1703 
1704 		addr = le32_to_cpu(tx_desc->pkt_phys_addr);
1705 		size = le16_to_cpu(tx_desc->pkt_len);
1706 		skb = txq->skb[tx];
1707 		txq->skb[tx] = NULL;
1708 
1709 		BUG_ON(skb == NULL);
1710 		pci_unmap_single(priv->pdev, addr, size, PCI_DMA_TODEVICE);
1711 
1712 		mwl8k_remove_dma_header(skb, tx_desc->qos_control);
1713 
1714 		wh = (struct ieee80211_hdr *) skb->data;
1715 
1716 		/* Mark descriptor as unused */
1717 		tx_desc->pkt_phys_addr = 0;
1718 		tx_desc->pkt_len = 0;
1719 
1720 		info = IEEE80211_SKB_CB(skb);
1721 		if (ieee80211_is_data(wh->frame_control)) {
1722 			rcu_read_lock();
1723 			sta = ieee80211_find_sta_by_ifaddr(hw, wh->addr1,
1724 							   wh->addr2);
1725 			if (sta) {
1726 				sta_info = MWL8K_STA(sta);
1727 				BUG_ON(sta_info == NULL);
1728 				rate_info = le16_to_cpu(tx_desc->rate_info);
1729 				/* If rate is < 6.5 Mpbs for an ht station
1730 				 * do not form an ampdu. If the station is a
1731 				 * legacy station (format = 0), do not form an
1732 				 * ampdu
1733 				 */
1734 				if (RI_RATE_ID_MCS(rate_info) < 1 ||
1735 				    RI_FORMAT(rate_info) == 0) {
1736 					sta_info->is_ampdu_allowed = false;
1737 				} else {
1738 					sta_info->is_ampdu_allowed = true;
1739 				}
1740 			}
1741 			rcu_read_unlock();
1742 		}
1743 
1744 		ieee80211_tx_info_clear_status(info);
1745 
1746 		/* Rate control is happening in the firmware.
1747 		 * Ensure no tx rate is being reported.
1748 		 */
1749 		info->status.rates[0].idx = -1;
1750 		info->status.rates[0].count = 1;
1751 
1752 		if (MWL8K_TXD_SUCCESS(status))
1753 			info->flags |= IEEE80211_TX_STAT_ACK;
1754 
1755 		ieee80211_tx_status_irqsafe(hw, skb);
1756 
1757 		processed++;
1758 	}
1759 
1760 	return processed;
1761 }
1762 
1763 /* must be called only when the card's transmit is completely halted */
1764 static void mwl8k_txq_deinit(struct ieee80211_hw *hw, int index)
1765 {
1766 	struct mwl8k_priv *priv = hw->priv;
1767 	struct mwl8k_tx_queue *txq = priv->txq + index;
1768 
1769 	if (txq->txd == NULL)
1770 		return;
1771 
1772 	mwl8k_txq_reclaim(hw, index, INT_MAX, 1);
1773 
1774 	kfree(txq->skb);
1775 	txq->skb = NULL;
1776 
1777 	pci_free_consistent(priv->pdev,
1778 			    MWL8K_TX_DESCS * sizeof(struct mwl8k_tx_desc),
1779 			    txq->txd, txq->txd_dma);
1780 	txq->txd = NULL;
1781 }
1782 
1783 /* caller must hold priv->stream_lock when calling the stream functions */
1784 static struct mwl8k_ampdu_stream *
1785 mwl8k_add_stream(struct ieee80211_hw *hw, struct ieee80211_sta *sta, u8 tid)
1786 {
1787 	struct mwl8k_ampdu_stream *stream;
1788 	struct mwl8k_priv *priv = hw->priv;
1789 	int i;
1790 
1791 	for (i = 0; i < MWL8K_NUM_AMPDU_STREAMS; i++) {
1792 		stream = &priv->ampdu[i];
1793 		if (stream->state == AMPDU_NO_STREAM) {
1794 			stream->sta = sta;
1795 			stream->state = AMPDU_STREAM_NEW;
1796 			stream->tid = tid;
1797 			stream->idx = i;
1798 			wiphy_debug(hw->wiphy, "Added a new stream for %pM %d",
1799 				    sta->addr, tid);
1800 			return stream;
1801 		}
1802 	}
1803 	return NULL;
1804 }
1805 
1806 static int
1807 mwl8k_start_stream(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream)
1808 {
1809 	int ret;
1810 
1811 	/* if the stream has already been started, don't start it again */
1812 	if (stream->state != AMPDU_STREAM_NEW)
1813 		return 0;
1814 	ret = ieee80211_start_tx_ba_session(stream->sta, stream->tid, 0);
1815 	if (ret)
1816 		wiphy_debug(hw->wiphy, "Failed to start stream for %pM %d: "
1817 			    "%d\n", stream->sta->addr, stream->tid, ret);
1818 	else
1819 		wiphy_debug(hw->wiphy, "Started stream for %pM %d\n",
1820 			    stream->sta->addr, stream->tid);
1821 	return ret;
1822 }
1823 
1824 static void
1825 mwl8k_remove_stream(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream)
1826 {
1827 	wiphy_debug(hw->wiphy, "Remove stream for %pM %d\n", stream->sta->addr,
1828 		    stream->tid);
1829 	memset(stream, 0, sizeof(*stream));
1830 }
1831 
1832 static struct mwl8k_ampdu_stream *
1833 mwl8k_lookup_stream(struct ieee80211_hw *hw, u8 *addr, u8 tid)
1834 {
1835 	struct mwl8k_priv *priv = hw->priv;
1836 	int i;
1837 
1838 	for (i = 0; i < MWL8K_NUM_AMPDU_STREAMS; i++) {
1839 		struct mwl8k_ampdu_stream *stream;
1840 		stream = &priv->ampdu[i];
1841 		if (stream->state == AMPDU_NO_STREAM)
1842 			continue;
1843 		if (!memcmp(stream->sta->addr, addr, ETH_ALEN) &&
1844 		    stream->tid == tid)
1845 			return stream;
1846 	}
1847 	return NULL;
1848 }
1849 
1850 #define MWL8K_AMPDU_PACKET_THRESHOLD 64
1851 static inline bool mwl8k_ampdu_allowed(struct ieee80211_sta *sta, u8 tid)
1852 {
1853 	struct mwl8k_sta *sta_info = MWL8K_STA(sta);
1854 	struct tx_traffic_info *tx_stats;
1855 
1856 	BUG_ON(tid >= MWL8K_MAX_TID);
1857 	tx_stats = &sta_info->tx_stats[tid];
1858 
1859 	return sta_info->is_ampdu_allowed &&
1860 		tx_stats->pkts > MWL8K_AMPDU_PACKET_THRESHOLD;
1861 }
1862 
1863 static inline void mwl8k_tx_count_packet(struct ieee80211_sta *sta, u8 tid)
1864 {
1865 	struct mwl8k_sta *sta_info = MWL8K_STA(sta);
1866 	struct tx_traffic_info *tx_stats;
1867 
1868 	BUG_ON(tid >= MWL8K_MAX_TID);
1869 	tx_stats = &sta_info->tx_stats[tid];
1870 
1871 	if (tx_stats->start_time == 0)
1872 		tx_stats->start_time = jiffies;
1873 
1874 	/* reset the packet count after each second elapses.  If the number of
1875 	 * packets ever exceeds the ampdu_min_traffic threshold, we will allow
1876 	 * an ampdu stream to be started.
1877 	 */
1878 	if (jiffies - tx_stats->start_time > HZ) {
1879 		tx_stats->pkts = 0;
1880 		tx_stats->start_time = 0;
1881 	} else
1882 		tx_stats->pkts++;
1883 }
1884 
1885 /* The hardware ampdu queues start from 5.
1886  * txpriorities for ampdu queues are
1887  * 5 6 7 0 1 2 3 4 ie., queue 5 is highest
1888  * and queue 3 is lowest (queue 4 is reserved)
1889  */
1890 #define BA_QUEUE		5
1891 
1892 static void
1893 mwl8k_txq_xmit(struct ieee80211_hw *hw,
1894 	       int index,
1895 	       struct ieee80211_sta *sta,
1896 	       struct sk_buff *skb)
1897 {
1898 	struct mwl8k_priv *priv = hw->priv;
1899 	struct ieee80211_tx_info *tx_info;
1900 	struct mwl8k_vif *mwl8k_vif;
1901 	struct ieee80211_hdr *wh;
1902 	struct mwl8k_tx_queue *txq;
1903 	struct mwl8k_tx_desc *tx;
1904 	dma_addr_t dma;
1905 	u32 txstatus;
1906 	u8 txdatarate;
1907 	u16 qos;
1908 	int txpriority;
1909 	u8 tid = 0;
1910 	struct mwl8k_ampdu_stream *stream = NULL;
1911 	bool start_ba_session = false;
1912 	bool mgmtframe = false;
1913 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
1914 	bool eapol_frame = false;
1915 
1916 	wh = (struct ieee80211_hdr *)skb->data;
1917 	if (ieee80211_is_data_qos(wh->frame_control))
1918 		qos = le16_to_cpu(*((__le16 *)ieee80211_get_qos_ctl(wh)));
1919 	else
1920 		qos = 0;
1921 
1922 	if (skb->protocol == cpu_to_be16(ETH_P_PAE))
1923 		eapol_frame = true;
1924 
1925 	if (ieee80211_is_mgmt(wh->frame_control))
1926 		mgmtframe = true;
1927 
1928 	if (priv->ap_fw)
1929 		mwl8k_encapsulate_tx_frame(priv, skb);
1930 	else
1931 		mwl8k_add_dma_header(priv, skb, 0, 0);
1932 
1933 	wh = &((struct mwl8k_dma_data *)skb->data)->wh;
1934 
1935 	tx_info = IEEE80211_SKB_CB(skb);
1936 	mwl8k_vif = MWL8K_VIF(tx_info->control.vif);
1937 
1938 	if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
1939 		wh->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
1940 		wh->seq_ctrl |= cpu_to_le16(mwl8k_vif->seqno);
1941 		mwl8k_vif->seqno += 0x10;
1942 	}
1943 
1944 	/* Setup firmware control bit fields for each frame type.  */
1945 	txstatus = 0;
1946 	txdatarate = 0;
1947 	if (ieee80211_is_mgmt(wh->frame_control) ||
1948 	    ieee80211_is_ctl(wh->frame_control)) {
1949 		txdatarate = 0;
1950 		qos |= MWL8K_QOS_QLEN_UNSPEC | MWL8K_QOS_EOSP;
1951 	} else if (ieee80211_is_data(wh->frame_control)) {
1952 		txdatarate = 1;
1953 		if (is_multicast_ether_addr(wh->addr1))
1954 			txstatus |= MWL8K_TXD_STATUS_MULTICAST_TX;
1955 
1956 		qos &= ~MWL8K_QOS_ACK_POLICY_MASK;
1957 		if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
1958 			qos |= MWL8K_QOS_ACK_POLICY_BLOCKACK;
1959 		else
1960 			qos |= MWL8K_QOS_ACK_POLICY_NORMAL;
1961 	}
1962 
1963 	/* Queue ADDBA request in the respective data queue.  While setting up
1964 	 * the ampdu stream, mac80211 queues further packets for that
1965 	 * particular ra/tid pair.  However, packets piled up in the hardware
1966 	 * for that ra/tid pair will still go out. ADDBA request and the
1967 	 * related data packets going out from different queues asynchronously
1968 	 * will cause a shift in the receiver window which might result in
1969 	 * ampdu packets getting dropped at the receiver after the stream has
1970 	 * been setup.
1971 	 */
1972 	if (unlikely(ieee80211_is_action(wh->frame_control) &&
1973 	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&
1974 	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ &&
1975 	    priv->ap_fw)) {
1976 		u16 capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
1977 		tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
1978 		index = mwl8k_tid_queue_mapping(tid);
1979 	}
1980 
1981 	txpriority = index;
1982 
1983 	if (priv->ap_fw && sta && sta->ht_cap.ht_supported && !eapol_frame &&
1984 	    ieee80211_is_data_qos(wh->frame_control)) {
1985 		tid = qos & 0xf;
1986 		mwl8k_tx_count_packet(sta, tid);
1987 		spin_lock(&priv->stream_lock);
1988 		stream = mwl8k_lookup_stream(hw, sta->addr, tid);
1989 		if (stream != NULL) {
1990 			if (stream->state == AMPDU_STREAM_ACTIVE) {
1991 				WARN_ON(!(qos & MWL8K_QOS_ACK_POLICY_BLOCKACK));
1992 				txpriority = (BA_QUEUE + stream->idx) %
1993 					     TOTAL_HW_TX_QUEUES;
1994 				if (stream->idx <= 1)
1995 					index = stream->idx +
1996 						MWL8K_TX_WMM_QUEUES;
1997 
1998 			} else if (stream->state == AMPDU_STREAM_NEW) {
1999 				/* We get here if the driver sends us packets
2000 				 * after we've initiated a stream, but before
2001 				 * our ampdu_action routine has been called
2002 				 * with IEEE80211_AMPDU_TX_START to get the SSN
2003 				 * for the ADDBA request.  So this packet can
2004 				 * go out with no risk of sequence number
2005 				 * mismatch.  No special handling is required.
2006 				 */
2007 			} else {
2008 				/* Drop packets that would go out after the
2009 				 * ADDBA request was sent but before the ADDBA
2010 				 * response is received.  If we don't do this,
2011 				 * the recipient would probably receive it
2012 				 * after the ADDBA request with SSN 0.  This
2013 				 * will cause the recipient's BA receive window
2014 				 * to shift, which would cause the subsequent
2015 				 * packets in the BA stream to be discarded.
2016 				 * mac80211 queues our packets for us in this
2017 				 * case, so this is really just a safety check.
2018 				 */
2019 				wiphy_warn(hw->wiphy,
2020 					   "Cannot send packet while ADDBA "
2021 					   "dialog is underway.\n");
2022 				spin_unlock(&priv->stream_lock);
2023 				dev_kfree_skb(skb);
2024 				return;
2025 			}
2026 		} else {
2027 			/* Defer calling mwl8k_start_stream so that the current
2028 			 * skb can go out before the ADDBA request.  This
2029 			 * prevents sequence number mismatch at the recepient
2030 			 * as described above.
2031 			 */
2032 			if (mwl8k_ampdu_allowed(sta, tid)) {
2033 				stream = mwl8k_add_stream(hw, sta, tid);
2034 				if (stream != NULL)
2035 					start_ba_session = true;
2036 			}
2037 		}
2038 		spin_unlock(&priv->stream_lock);
2039 	} else {
2040 		qos &= ~MWL8K_QOS_ACK_POLICY_MASK;
2041 		qos |= MWL8K_QOS_ACK_POLICY_NORMAL;
2042 	}
2043 
2044 	dma = pci_map_single(priv->pdev, skb->data,
2045 				skb->len, PCI_DMA_TODEVICE);
2046 
2047 	if (pci_dma_mapping_error(priv->pdev, dma)) {
2048 		wiphy_debug(hw->wiphy,
2049 			    "failed to dma map skb, dropping TX frame.\n");
2050 		if (start_ba_session) {
2051 			spin_lock(&priv->stream_lock);
2052 			mwl8k_remove_stream(hw, stream);
2053 			spin_unlock(&priv->stream_lock);
2054 		}
2055 		dev_kfree_skb(skb);
2056 		return;
2057 	}
2058 
2059 	spin_lock_bh(&priv->tx_lock);
2060 
2061 	txq = priv->txq + index;
2062 
2063 	/* Mgmt frames that go out frequently are probe
2064 	 * responses. Other mgmt frames got out relatively
2065 	 * infrequently. Hence reserve 2 buffers so that
2066 	 * other mgmt frames do not get dropped due to an
2067 	 * already queued probe response in one of the
2068 	 * reserved buffers.
2069 	 */
2070 
2071 	if (txq->len >= MWL8K_TX_DESCS - 2) {
2072 		if (!mgmtframe || txq->len == MWL8K_TX_DESCS) {
2073 			if (start_ba_session) {
2074 				spin_lock(&priv->stream_lock);
2075 				mwl8k_remove_stream(hw, stream);
2076 				spin_unlock(&priv->stream_lock);
2077 			}
2078 			mwl8k_tx_start(priv);
2079 			spin_unlock_bh(&priv->tx_lock);
2080 			pci_unmap_single(priv->pdev, dma, skb->len,
2081 					 PCI_DMA_TODEVICE);
2082 			dev_kfree_skb(skb);
2083 			return;
2084 		}
2085 	}
2086 
2087 	BUG_ON(txq->skb[txq->tail] != NULL);
2088 	txq->skb[txq->tail] = skb;
2089 
2090 	tx = txq->txd + txq->tail;
2091 	tx->data_rate = txdatarate;
2092 	tx->tx_priority = txpriority;
2093 	tx->qos_control = cpu_to_le16(qos);
2094 	tx->pkt_phys_addr = cpu_to_le32(dma);
2095 	tx->pkt_len = cpu_to_le16(skb->len);
2096 	tx->rate_info = 0;
2097 	if (!priv->ap_fw && sta != NULL)
2098 		tx->peer_id = MWL8K_STA(sta)->peer_id;
2099 	else
2100 		tx->peer_id = 0;
2101 
2102 	if (priv->ap_fw && ieee80211_is_data(wh->frame_control) && !eapol_frame)
2103 		tx->timestamp = cpu_to_le32(ioread32(priv->regs +
2104 						MWL8K_HW_TIMER_REGISTER));
2105 	else
2106 		tx->timestamp = 0;
2107 
2108 	wmb();
2109 	tx->status = cpu_to_le32(MWL8K_TXD_STATUS_FW_OWNED | txstatus);
2110 
2111 	txq->len++;
2112 	priv->pending_tx_pkts++;
2113 
2114 	txq->tail++;
2115 	if (txq->tail == MWL8K_TX_DESCS)
2116 		txq->tail = 0;
2117 
2118 	mwl8k_tx_start(priv);
2119 
2120 	spin_unlock_bh(&priv->tx_lock);
2121 
2122 	/* Initiate the ampdu session here */
2123 	if (start_ba_session) {
2124 		spin_lock(&priv->stream_lock);
2125 		if (mwl8k_start_stream(hw, stream))
2126 			mwl8k_remove_stream(hw, stream);
2127 		spin_unlock(&priv->stream_lock);
2128 	}
2129 }
2130 
2131 
2132 /*
2133  * Firmware access.
2134  *
2135  * We have the following requirements for issuing firmware commands:
2136  * - Some commands require that the packet transmit path is idle when
2137  *   the command is issued.  (For simplicity, we'll just quiesce the
2138  *   transmit path for every command.)
2139  * - There are certain sequences of commands that need to be issued to
2140  *   the hardware sequentially, with no other intervening commands.
2141  *
2142  * This leads to an implementation of a "firmware lock" as a mutex that
2143  * can be taken recursively, and which is taken by both the low-level
2144  * command submission function (mwl8k_post_cmd) as well as any users of
2145  * that function that require issuing of an atomic sequence of commands,
2146  * and quiesces the transmit path whenever it's taken.
2147  */
2148 static int mwl8k_fw_lock(struct ieee80211_hw *hw)
2149 {
2150 	struct mwl8k_priv *priv = hw->priv;
2151 
2152 	if (priv->fw_mutex_owner != current) {
2153 		int rc;
2154 
2155 		mutex_lock(&priv->fw_mutex);
2156 		ieee80211_stop_queues(hw);
2157 
2158 		rc = mwl8k_tx_wait_empty(hw);
2159 		if (rc) {
2160 			if (!priv->hw_restart_in_progress)
2161 				ieee80211_wake_queues(hw);
2162 
2163 			mutex_unlock(&priv->fw_mutex);
2164 
2165 			return rc;
2166 		}
2167 
2168 		priv->fw_mutex_owner = current;
2169 	}
2170 
2171 	priv->fw_mutex_depth++;
2172 
2173 	return 0;
2174 }
2175 
2176 static void mwl8k_fw_unlock(struct ieee80211_hw *hw)
2177 {
2178 	struct mwl8k_priv *priv = hw->priv;
2179 
2180 	if (!--priv->fw_mutex_depth) {
2181 		if (!priv->hw_restart_in_progress)
2182 			ieee80211_wake_queues(hw);
2183 
2184 		priv->fw_mutex_owner = NULL;
2185 		mutex_unlock(&priv->fw_mutex);
2186 	}
2187 }
2188 
2189 static void mwl8k_enable_bsses(struct ieee80211_hw *hw, bool enable,
2190 			       u32 bitmap);
2191 
2192 /*
2193  * Command processing.
2194  */
2195 
2196 /* Timeout firmware commands after 10s */
2197 #define MWL8K_CMD_TIMEOUT_MS	10000
2198 
2199 static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
2200 {
2201 	DECLARE_COMPLETION_ONSTACK(cmd_wait);
2202 	struct mwl8k_priv *priv = hw->priv;
2203 	void __iomem *regs = priv->regs;
2204 	dma_addr_t dma_addr;
2205 	unsigned int dma_size;
2206 	int rc;
2207 	unsigned long timeout = 0;
2208 	u8 buf[32];
2209 	u32 bitmap = 0;
2210 
2211 	wiphy_dbg(hw->wiphy, "Posting %s [%d]\n",
2212 		  mwl8k_cmd_name(cmd->code, buf, sizeof(buf)), cmd->macid);
2213 
2214 	/* Before posting firmware commands that could change the hardware
2215 	 * characteristics, make sure that all BSSes are stopped temporary.
2216 	 * Enable these stopped BSSes after completion of the commands
2217 	 */
2218 
2219 	rc = mwl8k_fw_lock(hw);
2220 	if (rc)
2221 		return rc;
2222 
2223 	if (priv->ap_fw && priv->running_bsses) {
2224 		switch (le16_to_cpu(cmd->code)) {
2225 		case MWL8K_CMD_SET_RF_CHANNEL:
2226 		case MWL8K_CMD_RADIO_CONTROL:
2227 		case MWL8K_CMD_RF_TX_POWER:
2228 		case MWL8K_CMD_TX_POWER:
2229 		case MWL8K_CMD_RF_ANTENNA:
2230 		case MWL8K_CMD_RTS_THRESHOLD:
2231 		case MWL8K_CMD_MIMO_CONFIG:
2232 			bitmap = priv->running_bsses;
2233 			mwl8k_enable_bsses(hw, false, bitmap);
2234 			break;
2235 		}
2236 	}
2237 
2238 	cmd->result = (__force __le16) 0xffff;
2239 	dma_size = le16_to_cpu(cmd->length);
2240 	dma_addr = pci_map_single(priv->pdev, cmd, dma_size,
2241 				  PCI_DMA_BIDIRECTIONAL);
2242 	if (pci_dma_mapping_error(priv->pdev, dma_addr)) {
2243 		rc = -ENOMEM;
2244 		goto exit;
2245 	}
2246 
2247 	priv->hostcmd_wait = &cmd_wait;
2248 	iowrite32(dma_addr, regs + MWL8K_HIU_GEN_PTR);
2249 	iowrite32(MWL8K_H2A_INT_DOORBELL,
2250 		regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
2251 	iowrite32(MWL8K_H2A_INT_DUMMY,
2252 		regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
2253 
2254 	timeout = wait_for_completion_timeout(&cmd_wait,
2255 				msecs_to_jiffies(MWL8K_CMD_TIMEOUT_MS));
2256 
2257 	priv->hostcmd_wait = NULL;
2258 
2259 
2260 	pci_unmap_single(priv->pdev, dma_addr, dma_size,
2261 					PCI_DMA_BIDIRECTIONAL);
2262 
2263 	if (!timeout) {
2264 		wiphy_err(hw->wiphy, "Command %s timeout after %u ms\n",
2265 			  mwl8k_cmd_name(cmd->code, buf, sizeof(buf)),
2266 			  MWL8K_CMD_TIMEOUT_MS);
2267 		rc = -ETIMEDOUT;
2268 	} else {
2269 		int ms;
2270 
2271 		ms = MWL8K_CMD_TIMEOUT_MS - jiffies_to_msecs(timeout);
2272 
2273 		rc = cmd->result ? -EINVAL : 0;
2274 		if (rc)
2275 			wiphy_err(hw->wiphy, "Command %s error 0x%x\n",
2276 				  mwl8k_cmd_name(cmd->code, buf, sizeof(buf)),
2277 				  le16_to_cpu(cmd->result));
2278 		else if (ms > 2000)
2279 			wiphy_notice(hw->wiphy, "Command %s took %d ms\n",
2280 				     mwl8k_cmd_name(cmd->code,
2281 						    buf, sizeof(buf)),
2282 				     ms);
2283 	}
2284 
2285 exit:
2286 	if (bitmap)
2287 		mwl8k_enable_bsses(hw, true, bitmap);
2288 
2289 	mwl8k_fw_unlock(hw);
2290 
2291 	return rc;
2292 }
2293 
2294 static int mwl8k_post_pervif_cmd(struct ieee80211_hw *hw,
2295 				 struct ieee80211_vif *vif,
2296 				 struct mwl8k_cmd_pkt *cmd)
2297 {
2298 	if (vif != NULL)
2299 		cmd->macid = MWL8K_VIF(vif)->macid;
2300 	return mwl8k_post_cmd(hw, cmd);
2301 }
2302 
2303 /*
2304  * Setup code shared between STA and AP firmware images.
2305  */
2306 static void mwl8k_setup_2ghz_band(struct ieee80211_hw *hw)
2307 {
2308 	struct mwl8k_priv *priv = hw->priv;
2309 
2310 	BUILD_BUG_ON(sizeof(priv->channels_24) != sizeof(mwl8k_channels_24));
2311 	memcpy(priv->channels_24, mwl8k_channels_24, sizeof(mwl8k_channels_24));
2312 
2313 	BUILD_BUG_ON(sizeof(priv->rates_24) != sizeof(mwl8k_rates_24));
2314 	memcpy(priv->rates_24, mwl8k_rates_24, sizeof(mwl8k_rates_24));
2315 
2316 	priv->band_24.band = NL80211_BAND_2GHZ;
2317 	priv->band_24.channels = priv->channels_24;
2318 	priv->band_24.n_channels = ARRAY_SIZE(mwl8k_channels_24);
2319 	priv->band_24.bitrates = priv->rates_24;
2320 	priv->band_24.n_bitrates = ARRAY_SIZE(mwl8k_rates_24);
2321 
2322 	hw->wiphy->bands[NL80211_BAND_2GHZ] = &priv->band_24;
2323 }
2324 
2325 static void mwl8k_setup_5ghz_band(struct ieee80211_hw *hw)
2326 {
2327 	struct mwl8k_priv *priv = hw->priv;
2328 
2329 	BUILD_BUG_ON(sizeof(priv->channels_50) != sizeof(mwl8k_channels_50));
2330 	memcpy(priv->channels_50, mwl8k_channels_50, sizeof(mwl8k_channels_50));
2331 
2332 	BUILD_BUG_ON(sizeof(priv->rates_50) != sizeof(mwl8k_rates_50));
2333 	memcpy(priv->rates_50, mwl8k_rates_50, sizeof(mwl8k_rates_50));
2334 
2335 	priv->band_50.band = NL80211_BAND_5GHZ;
2336 	priv->band_50.channels = priv->channels_50;
2337 	priv->band_50.n_channels = ARRAY_SIZE(mwl8k_channels_50);
2338 	priv->band_50.bitrates = priv->rates_50;
2339 	priv->band_50.n_bitrates = ARRAY_SIZE(mwl8k_rates_50);
2340 
2341 	hw->wiphy->bands[NL80211_BAND_5GHZ] = &priv->band_50;
2342 }
2343 
2344 /*
2345  * CMD_GET_HW_SPEC (STA version).
2346  */
2347 struct mwl8k_cmd_get_hw_spec_sta {
2348 	struct mwl8k_cmd_pkt header;
2349 	__u8 hw_rev;
2350 	__u8 host_interface;
2351 	__le16 num_mcaddrs;
2352 	__u8 perm_addr[ETH_ALEN];
2353 	__le16 region_code;
2354 	__le32 fw_rev;
2355 	__le32 ps_cookie;
2356 	__le32 caps;
2357 	__u8 mcs_bitmap[16];
2358 	__le32 rx_queue_ptr;
2359 	__le32 num_tx_queues;
2360 	__le32 tx_queue_ptrs[MWL8K_TX_WMM_QUEUES];
2361 	__le32 caps2;
2362 	__le32 num_tx_desc_per_queue;
2363 	__le32 total_rxd;
2364 } __packed;
2365 
2366 #define MWL8K_CAP_MAX_AMSDU		0x20000000
2367 #define MWL8K_CAP_GREENFIELD		0x08000000
2368 #define MWL8K_CAP_AMPDU			0x04000000
2369 #define MWL8K_CAP_RX_STBC		0x01000000
2370 #define MWL8K_CAP_TX_STBC		0x00800000
2371 #define MWL8K_CAP_SHORTGI_40MHZ		0x00400000
2372 #define MWL8K_CAP_SHORTGI_20MHZ		0x00200000
2373 #define MWL8K_CAP_RX_ANTENNA_MASK	0x000e0000
2374 #define MWL8K_CAP_TX_ANTENNA_MASK	0x0001c000
2375 #define MWL8K_CAP_DELAY_BA		0x00003000
2376 #define MWL8K_CAP_MIMO			0x00000200
2377 #define MWL8K_CAP_40MHZ			0x00000100
2378 #define MWL8K_CAP_BAND_MASK		0x00000007
2379 #define MWL8K_CAP_5GHZ			0x00000004
2380 #define MWL8K_CAP_2GHZ4			0x00000001
2381 
2382 static void
2383 mwl8k_set_ht_caps(struct ieee80211_hw *hw,
2384 		  struct ieee80211_supported_band *band, u32 cap)
2385 {
2386 	int rx_streams;
2387 	int tx_streams;
2388 
2389 	band->ht_cap.ht_supported = 1;
2390 
2391 	if (cap & MWL8K_CAP_MAX_AMSDU)
2392 		band->ht_cap.cap |= IEEE80211_HT_CAP_MAX_AMSDU;
2393 	if (cap & MWL8K_CAP_GREENFIELD)
2394 		band->ht_cap.cap |= IEEE80211_HT_CAP_GRN_FLD;
2395 	if (cap & MWL8K_CAP_AMPDU) {
2396 		ieee80211_hw_set(hw, AMPDU_AGGREGATION);
2397 		band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
2398 		band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_NONE;
2399 	}
2400 	if (cap & MWL8K_CAP_RX_STBC)
2401 		band->ht_cap.cap |= IEEE80211_HT_CAP_RX_STBC;
2402 	if (cap & MWL8K_CAP_TX_STBC)
2403 		band->ht_cap.cap |= IEEE80211_HT_CAP_TX_STBC;
2404 	if (cap & MWL8K_CAP_SHORTGI_40MHZ)
2405 		band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
2406 	if (cap & MWL8K_CAP_SHORTGI_20MHZ)
2407 		band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
2408 	if (cap & MWL8K_CAP_DELAY_BA)
2409 		band->ht_cap.cap |= IEEE80211_HT_CAP_DELAY_BA;
2410 	if (cap & MWL8K_CAP_40MHZ)
2411 		band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
2412 
2413 	rx_streams = hweight32(cap & MWL8K_CAP_RX_ANTENNA_MASK);
2414 	tx_streams = hweight32(cap & MWL8K_CAP_TX_ANTENNA_MASK);
2415 
2416 	band->ht_cap.mcs.rx_mask[0] = 0xff;
2417 	if (rx_streams >= 2)
2418 		band->ht_cap.mcs.rx_mask[1] = 0xff;
2419 	if (rx_streams >= 3)
2420 		band->ht_cap.mcs.rx_mask[2] = 0xff;
2421 	band->ht_cap.mcs.rx_mask[4] = 0x01;
2422 	band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
2423 
2424 	if (rx_streams != tx_streams) {
2425 		band->ht_cap.mcs.tx_params |= IEEE80211_HT_MCS_TX_RX_DIFF;
2426 		band->ht_cap.mcs.tx_params |= (tx_streams - 1) <<
2427 				IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
2428 	}
2429 }
2430 
2431 static void
2432 mwl8k_set_caps(struct ieee80211_hw *hw, u32 caps)
2433 {
2434 	struct mwl8k_priv *priv = hw->priv;
2435 
2436 	if (priv->caps)
2437 		return;
2438 
2439 	if ((caps & MWL8K_CAP_2GHZ4) || !(caps & MWL8K_CAP_BAND_MASK)) {
2440 		mwl8k_setup_2ghz_band(hw);
2441 		if (caps & MWL8K_CAP_MIMO)
2442 			mwl8k_set_ht_caps(hw, &priv->band_24, caps);
2443 	}
2444 
2445 	if (caps & MWL8K_CAP_5GHZ) {
2446 		mwl8k_setup_5ghz_band(hw);
2447 		if (caps & MWL8K_CAP_MIMO)
2448 			mwl8k_set_ht_caps(hw, &priv->band_50, caps);
2449 	}
2450 
2451 	priv->caps = caps;
2452 }
2453 
2454 static int mwl8k_cmd_get_hw_spec_sta(struct ieee80211_hw *hw)
2455 {
2456 	struct mwl8k_priv *priv = hw->priv;
2457 	struct mwl8k_cmd_get_hw_spec_sta *cmd;
2458 	int rc;
2459 	int i;
2460 
2461 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2462 	if (cmd == NULL)
2463 		return -ENOMEM;
2464 
2465 	cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_HW_SPEC);
2466 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2467 
2468 	memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
2469 	cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
2470 	cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rxd_dma);
2471 	cmd->num_tx_queues = cpu_to_le32(mwl8k_tx_queues(priv));
2472 	for (i = 0; i < mwl8k_tx_queues(priv); i++)
2473 		cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[i].txd_dma);
2474 	cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
2475 	cmd->total_rxd = cpu_to_le32(MWL8K_RX_DESCS);
2476 
2477 	rc = mwl8k_post_cmd(hw, &cmd->header);
2478 
2479 	if (!rc) {
2480 		SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
2481 		priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
2482 		priv->fw_rev = le32_to_cpu(cmd->fw_rev);
2483 		priv->hw_rev = cmd->hw_rev;
2484 		mwl8k_set_caps(hw, le32_to_cpu(cmd->caps));
2485 		priv->ap_macids_supported = 0x00000000;
2486 		priv->sta_macids_supported = 0x00000001;
2487 	}
2488 
2489 	kfree(cmd);
2490 	return rc;
2491 }
2492 
2493 /*
2494  * CMD_GET_HW_SPEC (AP version).
2495  */
2496 struct mwl8k_cmd_get_hw_spec_ap {
2497 	struct mwl8k_cmd_pkt header;
2498 	__u8 hw_rev;
2499 	__u8 host_interface;
2500 	__le16 num_wcb;
2501 	__le16 num_mcaddrs;
2502 	__u8 perm_addr[ETH_ALEN];
2503 	__le16 region_code;
2504 	__le16 num_antenna;
2505 	__le32 fw_rev;
2506 	__le32 wcbbase0;
2507 	__le32 rxwrptr;
2508 	__le32 rxrdptr;
2509 	__le32 ps_cookie;
2510 	__le32 wcbbase1;
2511 	__le32 wcbbase2;
2512 	__le32 wcbbase3;
2513 	__le32 fw_api_version;
2514 	__le32 caps;
2515 	__le32 num_of_ampdu_queues;
2516 	__le32 wcbbase_ampdu[MWL8K_MAX_AMPDU_QUEUES];
2517 } __packed;
2518 
2519 static int mwl8k_cmd_get_hw_spec_ap(struct ieee80211_hw *hw)
2520 {
2521 	struct mwl8k_priv *priv = hw->priv;
2522 	struct mwl8k_cmd_get_hw_spec_ap *cmd;
2523 	int rc, i;
2524 	u32 api_version;
2525 
2526 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2527 	if (cmd == NULL)
2528 		return -ENOMEM;
2529 
2530 	cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_HW_SPEC);
2531 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2532 
2533 	memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
2534 	cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
2535 
2536 	rc = mwl8k_post_cmd(hw, &cmd->header);
2537 
2538 	if (!rc) {
2539 		int off;
2540 
2541 		api_version = le32_to_cpu(cmd->fw_api_version);
2542 		if (priv->device_info->fw_api_ap != api_version) {
2543 			printk(KERN_ERR "%s: Unsupported fw API version for %s."
2544 			       "  Expected %d got %d.\n", MWL8K_NAME,
2545 			       priv->device_info->part_name,
2546 			       priv->device_info->fw_api_ap,
2547 			       api_version);
2548 			rc = -EINVAL;
2549 			goto done;
2550 		}
2551 		SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
2552 		priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
2553 		priv->fw_rev = le32_to_cpu(cmd->fw_rev);
2554 		priv->hw_rev = cmd->hw_rev;
2555 		mwl8k_set_caps(hw, le32_to_cpu(cmd->caps));
2556 		priv->ap_macids_supported = 0x000000ff;
2557 		priv->sta_macids_supported = 0x00000100;
2558 		priv->num_ampdu_queues = le32_to_cpu(cmd->num_of_ampdu_queues);
2559 		if (priv->num_ampdu_queues > MWL8K_MAX_AMPDU_QUEUES) {
2560 			wiphy_warn(hw->wiphy, "fw reported %d ampdu queues"
2561 				   " but we only support %d.\n",
2562 				   priv->num_ampdu_queues,
2563 				   MWL8K_MAX_AMPDU_QUEUES);
2564 			priv->num_ampdu_queues = MWL8K_MAX_AMPDU_QUEUES;
2565 		}
2566 		off = le32_to_cpu(cmd->rxwrptr) & 0xffff;
2567 		iowrite32(priv->rxq[0].rxd_dma, priv->sram + off);
2568 
2569 		off = le32_to_cpu(cmd->rxrdptr) & 0xffff;
2570 		iowrite32(priv->rxq[0].rxd_dma, priv->sram + off);
2571 
2572 		priv->txq_offset[0] = le32_to_cpu(cmd->wcbbase0) & 0xffff;
2573 		priv->txq_offset[1] = le32_to_cpu(cmd->wcbbase1) & 0xffff;
2574 		priv->txq_offset[2] = le32_to_cpu(cmd->wcbbase2) & 0xffff;
2575 		priv->txq_offset[3] = le32_to_cpu(cmd->wcbbase3) & 0xffff;
2576 
2577 		for (i = 0; i < priv->num_ampdu_queues; i++)
2578 			priv->txq_offset[i + MWL8K_TX_WMM_QUEUES] =
2579 				le32_to_cpu(cmd->wcbbase_ampdu[i]) & 0xffff;
2580 	}
2581 
2582 done:
2583 	kfree(cmd);
2584 	return rc;
2585 }
2586 
2587 /*
2588  * CMD_SET_HW_SPEC.
2589  */
2590 struct mwl8k_cmd_set_hw_spec {
2591 	struct mwl8k_cmd_pkt header;
2592 	__u8 hw_rev;
2593 	__u8 host_interface;
2594 	__le16 num_mcaddrs;
2595 	__u8 perm_addr[ETH_ALEN];
2596 	__le16 region_code;
2597 	__le32 fw_rev;
2598 	__le32 ps_cookie;
2599 	__le32 caps;
2600 	__le32 rx_queue_ptr;
2601 	__le32 num_tx_queues;
2602 	__le32 tx_queue_ptrs[MWL8K_MAX_TX_QUEUES];
2603 	__le32 flags;
2604 	__le32 num_tx_desc_per_queue;
2605 	__le32 total_rxd;
2606 } __packed;
2607 
2608 /* If enabled, MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY will cause
2609  * packets to expire 500 ms after the timestamp in the tx descriptor.  That is,
2610  * the packets that are queued for more than 500ms, will be dropped in the
2611  * hardware. This helps minimizing the issues caused due to head-of-line
2612  * blocking where a slow client can hog the bandwidth and affect traffic to a
2613  * faster client.
2614  */
2615 #define MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY	0x00000400
2616 #define MWL8K_SET_HW_SPEC_FLAG_GENERATE_CCMP_HDR	0x00000200
2617 #define MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT		0x00000080
2618 #define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP	0x00000020
2619 #define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON		0x00000010
2620 
2621 static int mwl8k_cmd_set_hw_spec(struct ieee80211_hw *hw)
2622 {
2623 	struct mwl8k_priv *priv = hw->priv;
2624 	struct mwl8k_cmd_set_hw_spec *cmd;
2625 	int rc;
2626 	int i;
2627 
2628 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2629 	if (cmd == NULL)
2630 		return -ENOMEM;
2631 
2632 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_HW_SPEC);
2633 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2634 
2635 	cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
2636 	cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rxd_dma);
2637 	cmd->num_tx_queues = cpu_to_le32(mwl8k_tx_queues(priv));
2638 
2639 	/*
2640 	 * Mac80211 stack has Q0 as highest priority and Q3 as lowest in
2641 	 * that order. Firmware has Q3 as highest priority and Q0 as lowest
2642 	 * in that order. Map Q3 of mac80211 to Q0 of firmware so that the
2643 	 * priority is interpreted the right way in firmware.
2644 	 */
2645 	for (i = 0; i < mwl8k_tx_queues(priv); i++) {
2646 		int j = mwl8k_tx_queues(priv) - 1 - i;
2647 		cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[j].txd_dma);
2648 	}
2649 
2650 	cmd->flags = cpu_to_le32(MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT |
2651 				 MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP |
2652 				 MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON |
2653 				 MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY |
2654 				 MWL8K_SET_HW_SPEC_FLAG_GENERATE_CCMP_HDR);
2655 	cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
2656 	cmd->total_rxd = cpu_to_le32(MWL8K_RX_DESCS);
2657 
2658 	rc = mwl8k_post_cmd(hw, &cmd->header);
2659 	kfree(cmd);
2660 
2661 	return rc;
2662 }
2663 
2664 /*
2665  * CMD_MAC_MULTICAST_ADR.
2666  */
2667 struct mwl8k_cmd_mac_multicast_adr {
2668 	struct mwl8k_cmd_pkt header;
2669 	__le16 action;
2670 	__le16 numaddr;
2671 	__u8 addr[0][ETH_ALEN];
2672 };
2673 
2674 #define MWL8K_ENABLE_RX_DIRECTED	0x0001
2675 #define MWL8K_ENABLE_RX_MULTICAST	0x0002
2676 #define MWL8K_ENABLE_RX_ALL_MULTICAST	0x0004
2677 #define MWL8K_ENABLE_RX_BROADCAST	0x0008
2678 
2679 static struct mwl8k_cmd_pkt *
2680 __mwl8k_cmd_mac_multicast_adr(struct ieee80211_hw *hw, int allmulti,
2681 			      struct netdev_hw_addr_list *mc_list)
2682 {
2683 	struct mwl8k_priv *priv = hw->priv;
2684 	struct mwl8k_cmd_mac_multicast_adr *cmd;
2685 	int size;
2686 	int mc_count = 0;
2687 
2688 	if (mc_list)
2689 		mc_count = netdev_hw_addr_list_count(mc_list);
2690 
2691 	if (allmulti || mc_count > priv->num_mcaddrs) {
2692 		allmulti = 1;
2693 		mc_count = 0;
2694 	}
2695 
2696 	size = sizeof(*cmd) + mc_count * ETH_ALEN;
2697 
2698 	cmd = kzalloc(size, GFP_ATOMIC);
2699 	if (cmd == NULL)
2700 		return NULL;
2701 
2702 	cmd->header.code = cpu_to_le16(MWL8K_CMD_MAC_MULTICAST_ADR);
2703 	cmd->header.length = cpu_to_le16(size);
2704 	cmd->action = cpu_to_le16(MWL8K_ENABLE_RX_DIRECTED |
2705 				  MWL8K_ENABLE_RX_BROADCAST);
2706 
2707 	if (allmulti) {
2708 		cmd->action |= cpu_to_le16(MWL8K_ENABLE_RX_ALL_MULTICAST);
2709 	} else if (mc_count) {
2710 		struct netdev_hw_addr *ha;
2711 		int i = 0;
2712 
2713 		cmd->action |= cpu_to_le16(MWL8K_ENABLE_RX_MULTICAST);
2714 		cmd->numaddr = cpu_to_le16(mc_count);
2715 		netdev_hw_addr_list_for_each(ha, mc_list) {
2716 			memcpy(cmd->addr[i], ha->addr, ETH_ALEN);
2717 		}
2718 	}
2719 
2720 	return &cmd->header;
2721 }
2722 
2723 /*
2724  * CMD_GET_STAT.
2725  */
2726 struct mwl8k_cmd_get_stat {
2727 	struct mwl8k_cmd_pkt header;
2728 	__le32 stats[64];
2729 } __packed;
2730 
2731 #define MWL8K_STAT_ACK_FAILURE	9
2732 #define MWL8K_STAT_RTS_FAILURE	12
2733 #define MWL8K_STAT_FCS_ERROR	24
2734 #define MWL8K_STAT_RTS_SUCCESS	11
2735 
2736 static int mwl8k_cmd_get_stat(struct ieee80211_hw *hw,
2737 			      struct ieee80211_low_level_stats *stats)
2738 {
2739 	struct mwl8k_cmd_get_stat *cmd;
2740 	int rc;
2741 
2742 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2743 	if (cmd == NULL)
2744 		return -ENOMEM;
2745 
2746 	cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_STAT);
2747 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2748 
2749 	rc = mwl8k_post_cmd(hw, &cmd->header);
2750 	if (!rc) {
2751 		stats->dot11ACKFailureCount =
2752 			le32_to_cpu(cmd->stats[MWL8K_STAT_ACK_FAILURE]);
2753 		stats->dot11RTSFailureCount =
2754 			le32_to_cpu(cmd->stats[MWL8K_STAT_RTS_FAILURE]);
2755 		stats->dot11FCSErrorCount =
2756 			le32_to_cpu(cmd->stats[MWL8K_STAT_FCS_ERROR]);
2757 		stats->dot11RTSSuccessCount =
2758 			le32_to_cpu(cmd->stats[MWL8K_STAT_RTS_SUCCESS]);
2759 	}
2760 	kfree(cmd);
2761 
2762 	return rc;
2763 }
2764 
2765 /*
2766  * CMD_RADIO_CONTROL.
2767  */
2768 struct mwl8k_cmd_radio_control {
2769 	struct mwl8k_cmd_pkt header;
2770 	__le16 action;
2771 	__le16 control;
2772 	__le16 radio_on;
2773 } __packed;
2774 
2775 static int
2776 mwl8k_cmd_radio_control(struct ieee80211_hw *hw, bool enable, bool force)
2777 {
2778 	struct mwl8k_priv *priv = hw->priv;
2779 	struct mwl8k_cmd_radio_control *cmd;
2780 	int rc;
2781 
2782 	if (enable == priv->radio_on && !force)
2783 		return 0;
2784 
2785 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2786 	if (cmd == NULL)
2787 		return -ENOMEM;
2788 
2789 	cmd->header.code = cpu_to_le16(MWL8K_CMD_RADIO_CONTROL);
2790 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2791 	cmd->action = cpu_to_le16(MWL8K_CMD_SET);
2792 	cmd->control = cpu_to_le16(priv->radio_short_preamble ? 3 : 1);
2793 	cmd->radio_on = cpu_to_le16(enable ? 0x0001 : 0x0000);
2794 
2795 	rc = mwl8k_post_cmd(hw, &cmd->header);
2796 	kfree(cmd);
2797 
2798 	if (!rc)
2799 		priv->radio_on = enable;
2800 
2801 	return rc;
2802 }
2803 
2804 static int mwl8k_cmd_radio_disable(struct ieee80211_hw *hw)
2805 {
2806 	return mwl8k_cmd_radio_control(hw, 0, 0);
2807 }
2808 
2809 static int mwl8k_cmd_radio_enable(struct ieee80211_hw *hw)
2810 {
2811 	return mwl8k_cmd_radio_control(hw, 1, 0);
2812 }
2813 
2814 static int
2815 mwl8k_set_radio_preamble(struct ieee80211_hw *hw, bool short_preamble)
2816 {
2817 	struct mwl8k_priv *priv = hw->priv;
2818 
2819 	priv->radio_short_preamble = short_preamble;
2820 
2821 	return mwl8k_cmd_radio_control(hw, 1, 1);
2822 }
2823 
2824 /*
2825  * CMD_RF_TX_POWER.
2826  */
2827 #define MWL8K_RF_TX_POWER_LEVEL_TOTAL	8
2828 
2829 struct mwl8k_cmd_rf_tx_power {
2830 	struct mwl8k_cmd_pkt header;
2831 	__le16 action;
2832 	__le16 support_level;
2833 	__le16 current_level;
2834 	__le16 reserved;
2835 	__le16 power_level_list[MWL8K_RF_TX_POWER_LEVEL_TOTAL];
2836 } __packed;
2837 
2838 static int mwl8k_cmd_rf_tx_power(struct ieee80211_hw *hw, int dBm)
2839 {
2840 	struct mwl8k_cmd_rf_tx_power *cmd;
2841 	int rc;
2842 
2843 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2844 	if (cmd == NULL)
2845 		return -ENOMEM;
2846 
2847 	cmd->header.code = cpu_to_le16(MWL8K_CMD_RF_TX_POWER);
2848 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2849 	cmd->action = cpu_to_le16(MWL8K_CMD_SET);
2850 	cmd->support_level = cpu_to_le16(dBm);
2851 
2852 	rc = mwl8k_post_cmd(hw, &cmd->header);
2853 	kfree(cmd);
2854 
2855 	return rc;
2856 }
2857 
2858 /*
2859  * CMD_TX_POWER.
2860  */
2861 #define MWL8K_TX_POWER_LEVEL_TOTAL      12
2862 
2863 struct mwl8k_cmd_tx_power {
2864 	struct mwl8k_cmd_pkt header;
2865 	__le16 action;
2866 	__le16 band;
2867 	__le16 channel;
2868 	__le16 bw;
2869 	__le16 sub_ch;
2870 	__le16 power_level_list[MWL8K_TX_POWER_LEVEL_TOTAL];
2871 } __packed;
2872 
2873 static int mwl8k_cmd_tx_power(struct ieee80211_hw *hw,
2874 				     struct ieee80211_conf *conf,
2875 				     unsigned short pwr)
2876 {
2877 	struct ieee80211_channel *channel = conf->chandef.chan;
2878 	enum nl80211_channel_type channel_type =
2879 		cfg80211_get_chandef_type(&conf->chandef);
2880 	struct mwl8k_cmd_tx_power *cmd;
2881 	int rc;
2882 	int i;
2883 
2884 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2885 	if (cmd == NULL)
2886 		return -ENOMEM;
2887 
2888 	cmd->header.code = cpu_to_le16(MWL8K_CMD_TX_POWER);
2889 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2890 	cmd->action = cpu_to_le16(MWL8K_CMD_SET_LIST);
2891 
2892 	if (channel->band == NL80211_BAND_2GHZ)
2893 		cmd->band = cpu_to_le16(0x1);
2894 	else if (channel->band == NL80211_BAND_5GHZ)
2895 		cmd->band = cpu_to_le16(0x4);
2896 
2897 	cmd->channel = cpu_to_le16(channel->hw_value);
2898 
2899 	if (channel_type == NL80211_CHAN_NO_HT ||
2900 	    channel_type == NL80211_CHAN_HT20) {
2901 		cmd->bw = cpu_to_le16(0x2);
2902 	} else {
2903 		cmd->bw = cpu_to_le16(0x4);
2904 		if (channel_type == NL80211_CHAN_HT40MINUS)
2905 			cmd->sub_ch = cpu_to_le16(0x3);
2906 		else if (channel_type == NL80211_CHAN_HT40PLUS)
2907 			cmd->sub_ch = cpu_to_le16(0x1);
2908 	}
2909 
2910 	for (i = 0; i < MWL8K_TX_POWER_LEVEL_TOTAL; i++)
2911 		cmd->power_level_list[i] = cpu_to_le16(pwr);
2912 
2913 	rc = mwl8k_post_cmd(hw, &cmd->header);
2914 	kfree(cmd);
2915 
2916 	return rc;
2917 }
2918 
2919 /*
2920  * CMD_RF_ANTENNA.
2921  */
2922 struct mwl8k_cmd_rf_antenna {
2923 	struct mwl8k_cmd_pkt header;
2924 	__le16 antenna;
2925 	__le16 mode;
2926 } __packed;
2927 
2928 #define MWL8K_RF_ANTENNA_RX		1
2929 #define MWL8K_RF_ANTENNA_TX		2
2930 
2931 static int
2932 mwl8k_cmd_rf_antenna(struct ieee80211_hw *hw, int antenna, int mask)
2933 {
2934 	struct mwl8k_cmd_rf_antenna *cmd;
2935 	int rc;
2936 
2937 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2938 	if (cmd == NULL)
2939 		return -ENOMEM;
2940 
2941 	cmd->header.code = cpu_to_le16(MWL8K_CMD_RF_ANTENNA);
2942 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
2943 	cmd->antenna = cpu_to_le16(antenna);
2944 	cmd->mode = cpu_to_le16(mask);
2945 
2946 	rc = mwl8k_post_cmd(hw, &cmd->header);
2947 	kfree(cmd);
2948 
2949 	return rc;
2950 }
2951 
2952 /*
2953  * CMD_SET_BEACON.
2954  */
2955 struct mwl8k_cmd_set_beacon {
2956 	struct mwl8k_cmd_pkt header;
2957 	__le16 beacon_len;
2958 	__u8 beacon[0];
2959 };
2960 
2961 static int mwl8k_cmd_set_beacon(struct ieee80211_hw *hw,
2962 				struct ieee80211_vif *vif, u8 *beacon, int len)
2963 {
2964 	struct mwl8k_cmd_set_beacon *cmd;
2965 	int rc;
2966 
2967 	cmd = kzalloc(sizeof(*cmd) + len, GFP_KERNEL);
2968 	if (cmd == NULL)
2969 		return -ENOMEM;
2970 
2971 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_BEACON);
2972 	cmd->header.length = cpu_to_le16(sizeof(*cmd) + len);
2973 	cmd->beacon_len = cpu_to_le16(len);
2974 	memcpy(cmd->beacon, beacon, len);
2975 
2976 	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
2977 	kfree(cmd);
2978 
2979 	return rc;
2980 }
2981 
2982 /*
2983  * CMD_SET_PRE_SCAN.
2984  */
2985 struct mwl8k_cmd_set_pre_scan {
2986 	struct mwl8k_cmd_pkt header;
2987 } __packed;
2988 
2989 static int mwl8k_cmd_set_pre_scan(struct ieee80211_hw *hw)
2990 {
2991 	struct mwl8k_cmd_set_pre_scan *cmd;
2992 	int rc;
2993 
2994 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
2995 	if (cmd == NULL)
2996 		return -ENOMEM;
2997 
2998 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_PRE_SCAN);
2999 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3000 
3001 	rc = mwl8k_post_cmd(hw, &cmd->header);
3002 	kfree(cmd);
3003 
3004 	return rc;
3005 }
3006 
3007 /*
3008  * CMD_BBP_REG_ACCESS.
3009  */
3010 struct mwl8k_cmd_bbp_reg_access {
3011 	struct mwl8k_cmd_pkt header;
3012 	__le16 action;
3013 	__le16 offset;
3014 	u8 value;
3015 	u8 rsrv[3];
3016 } __packed;
3017 
3018 static int
3019 mwl8k_cmd_bbp_reg_access(struct ieee80211_hw *hw,
3020 			 u16 action,
3021 			 u16 offset,
3022 			 u8 *value)
3023 {
3024 	struct mwl8k_cmd_bbp_reg_access *cmd;
3025 	int rc;
3026 
3027 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3028 	if (cmd == NULL)
3029 		return -ENOMEM;
3030 
3031 	cmd->header.code = cpu_to_le16(MWL8K_CMD_BBP_REG_ACCESS);
3032 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3033 	cmd->action = cpu_to_le16(action);
3034 	cmd->offset = cpu_to_le16(offset);
3035 
3036 	rc = mwl8k_post_cmd(hw, &cmd->header);
3037 
3038 	if (!rc)
3039 		*value = cmd->value;
3040 	else
3041 		*value = 0;
3042 
3043 	kfree(cmd);
3044 
3045 	return rc;
3046 }
3047 
3048 /*
3049  * CMD_SET_POST_SCAN.
3050  */
3051 struct mwl8k_cmd_set_post_scan {
3052 	struct mwl8k_cmd_pkt header;
3053 	__le32 isibss;
3054 	__u8 bssid[ETH_ALEN];
3055 } __packed;
3056 
3057 static int
3058 mwl8k_cmd_set_post_scan(struct ieee80211_hw *hw, const __u8 *mac)
3059 {
3060 	struct mwl8k_cmd_set_post_scan *cmd;
3061 	int rc;
3062 
3063 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3064 	if (cmd == NULL)
3065 		return -ENOMEM;
3066 
3067 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_POST_SCAN);
3068 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3069 	cmd->isibss = 0;
3070 	memcpy(cmd->bssid, mac, ETH_ALEN);
3071 
3072 	rc = mwl8k_post_cmd(hw, &cmd->header);
3073 	kfree(cmd);
3074 
3075 	return rc;
3076 }
3077 
3078 static int freq_to_idx(struct mwl8k_priv *priv, int freq)
3079 {
3080 	struct ieee80211_supported_band *sband;
3081 	int band, ch, idx = 0;
3082 
3083 	for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
3084 		sband = priv->hw->wiphy->bands[band];
3085 		if (!sband)
3086 			continue;
3087 
3088 		for (ch = 0; ch < sband->n_channels; ch++, idx++)
3089 			if (sband->channels[ch].center_freq == freq)
3090 				goto exit;
3091 	}
3092 
3093 exit:
3094 	return idx;
3095 }
3096 
3097 static void mwl8k_update_survey(struct mwl8k_priv *priv,
3098 				struct ieee80211_channel *channel)
3099 {
3100 	u32 cca_cnt, rx_rdy;
3101 	s8 nf = 0, idx;
3102 	struct survey_info *survey;
3103 
3104 	idx = freq_to_idx(priv, priv->acs_chan->center_freq);
3105 	if (idx >= MWL8K_NUM_CHANS) {
3106 		wiphy_err(priv->hw->wiphy, "Failed to update survey\n");
3107 		return;
3108 	}
3109 
3110 	survey = &priv->survey[idx];
3111 
3112 	cca_cnt = ioread32(priv->regs + NOK_CCA_CNT_REG);
3113 	cca_cnt /= 1000; /* uSecs to mSecs */
3114 	survey->time_busy = (u64) cca_cnt;
3115 
3116 	rx_rdy = ioread32(priv->regs + BBU_RXRDY_CNT_REG);
3117 	rx_rdy /= 1000; /* uSecs to mSecs */
3118 	survey->time_rx = (u64) rx_rdy;
3119 
3120 	priv->channel_time = jiffies - priv->channel_time;
3121 	survey->time = jiffies_to_msecs(priv->channel_time);
3122 
3123 	survey->channel = channel;
3124 
3125 	mwl8k_cmd_bbp_reg_access(priv->hw, 0, BBU_AVG_NOISE_VAL, &nf);
3126 
3127 	/* Make sure sign is negative else ACS  at hostapd fails */
3128 	survey->noise = nf * -1;
3129 
3130 	survey->filled = SURVEY_INFO_NOISE_DBM |
3131 			 SURVEY_INFO_TIME |
3132 			 SURVEY_INFO_TIME_BUSY |
3133 			 SURVEY_INFO_TIME_RX;
3134 }
3135 
3136 /*
3137  * CMD_SET_RF_CHANNEL.
3138  */
3139 struct mwl8k_cmd_set_rf_channel {
3140 	struct mwl8k_cmd_pkt header;
3141 	__le16 action;
3142 	__u8 current_channel;
3143 	__le32 channel_flags;
3144 } __packed;
3145 
3146 static int mwl8k_cmd_set_rf_channel(struct ieee80211_hw *hw,
3147 				    struct ieee80211_conf *conf)
3148 {
3149 	struct ieee80211_channel *channel = conf->chandef.chan;
3150 	enum nl80211_channel_type channel_type =
3151 		cfg80211_get_chandef_type(&conf->chandef);
3152 	struct mwl8k_cmd_set_rf_channel *cmd;
3153 	struct mwl8k_priv *priv = hw->priv;
3154 	int rc;
3155 
3156 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3157 	if (cmd == NULL)
3158 		return -ENOMEM;
3159 
3160 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RF_CHANNEL);
3161 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3162 	cmd->action = cpu_to_le16(MWL8K_CMD_SET);
3163 	cmd->current_channel = channel->hw_value;
3164 
3165 	if (channel->band == NL80211_BAND_2GHZ)
3166 		cmd->channel_flags |= cpu_to_le32(0x00000001);
3167 	else if (channel->band == NL80211_BAND_5GHZ)
3168 		cmd->channel_flags |= cpu_to_le32(0x00000004);
3169 
3170 	if (!priv->sw_scan_start) {
3171 		if (channel_type == NL80211_CHAN_NO_HT ||
3172 		    channel_type == NL80211_CHAN_HT20)
3173 			cmd->channel_flags |= cpu_to_le32(0x00000080);
3174 		else if (channel_type == NL80211_CHAN_HT40MINUS)
3175 			cmd->channel_flags |= cpu_to_le32(0x000001900);
3176 		else if (channel_type == NL80211_CHAN_HT40PLUS)
3177 			cmd->channel_flags |= cpu_to_le32(0x000000900);
3178 	} else {
3179 		cmd->channel_flags |= cpu_to_le32(0x00000080);
3180 	}
3181 
3182 	if (priv->sw_scan_start) {
3183 		/* Store current channel stats
3184 		 * before switching to newer one.
3185 		 * This will be processed only for AP fw.
3186 		 */
3187 		if (priv->channel_time != 0)
3188 			mwl8k_update_survey(priv, priv->acs_chan);
3189 
3190 		priv->channel_time = jiffies;
3191 		priv->acs_chan =  channel;
3192 	}
3193 
3194 	rc = mwl8k_post_cmd(hw, &cmd->header);
3195 	kfree(cmd);
3196 
3197 	return rc;
3198 }
3199 
3200 /*
3201  * CMD_SET_AID.
3202  */
3203 #define MWL8K_FRAME_PROT_DISABLED			0x00
3204 #define MWL8K_FRAME_PROT_11G				0x07
3205 #define MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY		0x02
3206 #define MWL8K_FRAME_PROT_11N_HT_ALL			0x06
3207 
3208 struct mwl8k_cmd_update_set_aid {
3209 	struct	mwl8k_cmd_pkt header;
3210 	__le16	aid;
3211 
3212 	 /* AP's MAC address (BSSID) */
3213 	__u8	bssid[ETH_ALEN];
3214 	__le16	protection_mode;
3215 	__u8	supp_rates[14];
3216 } __packed;
3217 
3218 static void legacy_rate_mask_to_array(u8 *rates, u32 mask)
3219 {
3220 	int i;
3221 	int j;
3222 
3223 	/*
3224 	 * Clear nonstandard rate 4.
3225 	 */
3226 	mask &= 0x1fef;
3227 
3228 	for (i = 0, j = 0; i < 13; i++) {
3229 		if (mask & (1 << i))
3230 			rates[j++] = mwl8k_rates_24[i].hw_value;
3231 	}
3232 }
3233 
3234 static int
3235 mwl8k_cmd_set_aid(struct ieee80211_hw *hw,
3236 		  struct ieee80211_vif *vif, u32 legacy_rate_mask)
3237 {
3238 	struct mwl8k_cmd_update_set_aid *cmd;
3239 	u16 prot_mode;
3240 	int rc;
3241 
3242 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3243 	if (cmd == NULL)
3244 		return -ENOMEM;
3245 
3246 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_AID);
3247 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3248 	cmd->aid = cpu_to_le16(vif->bss_conf.aid);
3249 	memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
3250 
3251 	if (vif->bss_conf.use_cts_prot) {
3252 		prot_mode = MWL8K_FRAME_PROT_11G;
3253 	} else {
3254 		switch (vif->bss_conf.ht_operation_mode &
3255 			IEEE80211_HT_OP_MODE_PROTECTION) {
3256 		case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
3257 			prot_mode = MWL8K_FRAME_PROT_11N_HT_40MHZ_ONLY;
3258 			break;
3259 		case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
3260 			prot_mode = MWL8K_FRAME_PROT_11N_HT_ALL;
3261 			break;
3262 		default:
3263 			prot_mode = MWL8K_FRAME_PROT_DISABLED;
3264 			break;
3265 		}
3266 	}
3267 	cmd->protection_mode = cpu_to_le16(prot_mode);
3268 
3269 	legacy_rate_mask_to_array(cmd->supp_rates, legacy_rate_mask);
3270 
3271 	rc = mwl8k_post_cmd(hw, &cmd->header);
3272 	kfree(cmd);
3273 
3274 	return rc;
3275 }
3276 
3277 /*
3278  * CMD_SET_RATE.
3279  */
3280 struct mwl8k_cmd_set_rate {
3281 	struct	mwl8k_cmd_pkt header;
3282 	__u8	legacy_rates[14];
3283 
3284 	/* Bitmap for supported MCS codes.  */
3285 	__u8	mcs_set[16];
3286 	__u8	reserved[16];
3287 } __packed;
3288 
3289 static int
3290 mwl8k_cmd_set_rate(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
3291 		   u32 legacy_rate_mask, u8 *mcs_rates)
3292 {
3293 	struct mwl8k_cmd_set_rate *cmd;
3294 	int rc;
3295 
3296 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3297 	if (cmd == NULL)
3298 		return -ENOMEM;
3299 
3300 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATE);
3301 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3302 	legacy_rate_mask_to_array(cmd->legacy_rates, legacy_rate_mask);
3303 	memcpy(cmd->mcs_set, mcs_rates, 16);
3304 
3305 	rc = mwl8k_post_cmd(hw, &cmd->header);
3306 	kfree(cmd);
3307 
3308 	return rc;
3309 }
3310 
3311 /*
3312  * CMD_FINALIZE_JOIN.
3313  */
3314 #define MWL8K_FJ_BEACON_MAXLEN	128
3315 
3316 struct mwl8k_cmd_finalize_join {
3317 	struct mwl8k_cmd_pkt header;
3318 	__le32 sleep_interval;	/* Number of beacon periods to sleep */
3319 	__u8 beacon_data[MWL8K_FJ_BEACON_MAXLEN];
3320 } __packed;
3321 
3322 static int mwl8k_cmd_finalize_join(struct ieee80211_hw *hw, void *frame,
3323 				   int framelen, int dtim)
3324 {
3325 	struct mwl8k_cmd_finalize_join *cmd;
3326 	struct ieee80211_mgmt *payload = frame;
3327 	int payload_len;
3328 	int rc;
3329 
3330 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3331 	if (cmd == NULL)
3332 		return -ENOMEM;
3333 
3334 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_FINALIZE_JOIN);
3335 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3336 	cmd->sleep_interval = cpu_to_le32(dtim ? dtim : 1);
3337 
3338 	payload_len = framelen - ieee80211_hdrlen(payload->frame_control);
3339 	if (payload_len < 0)
3340 		payload_len = 0;
3341 	else if (payload_len > MWL8K_FJ_BEACON_MAXLEN)
3342 		payload_len = MWL8K_FJ_BEACON_MAXLEN;
3343 
3344 	memcpy(cmd->beacon_data, &payload->u.beacon, payload_len);
3345 
3346 	rc = mwl8k_post_cmd(hw, &cmd->header);
3347 	kfree(cmd);
3348 
3349 	return rc;
3350 }
3351 
3352 /*
3353  * CMD_SET_RTS_THRESHOLD.
3354  */
3355 struct mwl8k_cmd_set_rts_threshold {
3356 	struct mwl8k_cmd_pkt header;
3357 	__le16 action;
3358 	__le16 threshold;
3359 } __packed;
3360 
3361 static int
3362 mwl8k_cmd_set_rts_threshold(struct ieee80211_hw *hw, int rts_thresh)
3363 {
3364 	struct mwl8k_cmd_set_rts_threshold *cmd;
3365 	int rc;
3366 
3367 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3368 	if (cmd == NULL)
3369 		return -ENOMEM;
3370 
3371 	cmd->header.code = cpu_to_le16(MWL8K_CMD_RTS_THRESHOLD);
3372 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3373 	cmd->action = cpu_to_le16(MWL8K_CMD_SET);
3374 	cmd->threshold = cpu_to_le16(rts_thresh);
3375 
3376 	rc = mwl8k_post_cmd(hw, &cmd->header);
3377 	kfree(cmd);
3378 
3379 	return rc;
3380 }
3381 
3382 /*
3383  * CMD_SET_SLOT.
3384  */
3385 struct mwl8k_cmd_set_slot {
3386 	struct mwl8k_cmd_pkt header;
3387 	__le16 action;
3388 	__u8 short_slot;
3389 } __packed;
3390 
3391 static int mwl8k_cmd_set_slot(struct ieee80211_hw *hw, bool short_slot_time)
3392 {
3393 	struct mwl8k_cmd_set_slot *cmd;
3394 	int rc;
3395 
3396 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3397 	if (cmd == NULL)
3398 		return -ENOMEM;
3399 
3400 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_SLOT);
3401 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3402 	cmd->action = cpu_to_le16(MWL8K_CMD_SET);
3403 	cmd->short_slot = short_slot_time;
3404 
3405 	rc = mwl8k_post_cmd(hw, &cmd->header);
3406 	kfree(cmd);
3407 
3408 	return rc;
3409 }
3410 
3411 /*
3412  * CMD_SET_EDCA_PARAMS.
3413  */
3414 struct mwl8k_cmd_set_edca_params {
3415 	struct mwl8k_cmd_pkt header;
3416 
3417 	/* See MWL8K_SET_EDCA_XXX below */
3418 	__le16 action;
3419 
3420 	/* TX opportunity in units of 32 us */
3421 	__le16 txop;
3422 
3423 	union {
3424 		struct {
3425 			/* Log exponent of max contention period: 0...15 */
3426 			__le32 log_cw_max;
3427 
3428 			/* Log exponent of min contention period: 0...15 */
3429 			__le32 log_cw_min;
3430 
3431 			/* Adaptive interframe spacing in units of 32us */
3432 			__u8 aifs;
3433 
3434 			/* TX queue to configure */
3435 			__u8 txq;
3436 		} ap;
3437 		struct {
3438 			/* Log exponent of max contention period: 0...15 */
3439 			__u8 log_cw_max;
3440 
3441 			/* Log exponent of min contention period: 0...15 */
3442 			__u8 log_cw_min;
3443 
3444 			/* Adaptive interframe spacing in units of 32us */
3445 			__u8 aifs;
3446 
3447 			/* TX queue to configure */
3448 			__u8 txq;
3449 		} sta;
3450 	};
3451 } __packed;
3452 
3453 #define MWL8K_SET_EDCA_CW	0x01
3454 #define MWL8K_SET_EDCA_TXOP	0x02
3455 #define MWL8K_SET_EDCA_AIFS	0x04
3456 
3457 #define MWL8K_SET_EDCA_ALL	(MWL8K_SET_EDCA_CW | \
3458 				 MWL8K_SET_EDCA_TXOP | \
3459 				 MWL8K_SET_EDCA_AIFS)
3460 
3461 static int
3462 mwl8k_cmd_set_edca_params(struct ieee80211_hw *hw, __u8 qnum,
3463 			  __u16 cw_min, __u16 cw_max,
3464 			  __u8 aifs, __u16 txop)
3465 {
3466 	struct mwl8k_priv *priv = hw->priv;
3467 	struct mwl8k_cmd_set_edca_params *cmd;
3468 	int rc;
3469 
3470 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3471 	if (cmd == NULL)
3472 		return -ENOMEM;
3473 
3474 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_EDCA_PARAMS);
3475 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3476 	cmd->action = cpu_to_le16(MWL8K_SET_EDCA_ALL);
3477 	cmd->txop = cpu_to_le16(txop);
3478 	if (priv->ap_fw) {
3479 		cmd->ap.log_cw_max = cpu_to_le32(ilog2(cw_max + 1));
3480 		cmd->ap.log_cw_min = cpu_to_le32(ilog2(cw_min + 1));
3481 		cmd->ap.aifs = aifs;
3482 		cmd->ap.txq = qnum;
3483 	} else {
3484 		cmd->sta.log_cw_max = (u8)ilog2(cw_max + 1);
3485 		cmd->sta.log_cw_min = (u8)ilog2(cw_min + 1);
3486 		cmd->sta.aifs = aifs;
3487 		cmd->sta.txq = qnum;
3488 	}
3489 
3490 	rc = mwl8k_post_cmd(hw, &cmd->header);
3491 	kfree(cmd);
3492 
3493 	return rc;
3494 }
3495 
3496 /*
3497  * CMD_SET_WMM_MODE.
3498  */
3499 struct mwl8k_cmd_set_wmm_mode {
3500 	struct mwl8k_cmd_pkt header;
3501 	__le16 action;
3502 } __packed;
3503 
3504 static int mwl8k_cmd_set_wmm_mode(struct ieee80211_hw *hw, bool enable)
3505 {
3506 	struct mwl8k_priv *priv = hw->priv;
3507 	struct mwl8k_cmd_set_wmm_mode *cmd;
3508 	int rc;
3509 
3510 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3511 	if (cmd == NULL)
3512 		return -ENOMEM;
3513 
3514 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_WMM_MODE);
3515 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3516 	cmd->action = cpu_to_le16(!!enable);
3517 
3518 	rc = mwl8k_post_cmd(hw, &cmd->header);
3519 	kfree(cmd);
3520 
3521 	if (!rc)
3522 		priv->wmm_enabled = enable;
3523 
3524 	return rc;
3525 }
3526 
3527 /*
3528  * CMD_MIMO_CONFIG.
3529  */
3530 struct mwl8k_cmd_mimo_config {
3531 	struct mwl8k_cmd_pkt header;
3532 	__le32 action;
3533 	__u8 rx_antenna_map;
3534 	__u8 tx_antenna_map;
3535 } __packed;
3536 
3537 static int mwl8k_cmd_mimo_config(struct ieee80211_hw *hw, __u8 rx, __u8 tx)
3538 {
3539 	struct mwl8k_cmd_mimo_config *cmd;
3540 	int rc;
3541 
3542 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3543 	if (cmd == NULL)
3544 		return -ENOMEM;
3545 
3546 	cmd->header.code = cpu_to_le16(MWL8K_CMD_MIMO_CONFIG);
3547 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3548 	cmd->action = cpu_to_le32((u32)MWL8K_CMD_SET);
3549 	cmd->rx_antenna_map = rx;
3550 	cmd->tx_antenna_map = tx;
3551 
3552 	rc = mwl8k_post_cmd(hw, &cmd->header);
3553 	kfree(cmd);
3554 
3555 	return rc;
3556 }
3557 
3558 /*
3559  * CMD_USE_FIXED_RATE (STA version).
3560  */
3561 struct mwl8k_cmd_use_fixed_rate_sta {
3562 	struct mwl8k_cmd_pkt header;
3563 	__le32 action;
3564 	__le32 allow_rate_drop;
3565 	__le32 num_rates;
3566 	struct {
3567 		__le32 is_ht_rate;
3568 		__le32 enable_retry;
3569 		__le32 rate;
3570 		__le32 retry_count;
3571 	} rate_entry[8];
3572 	__le32 rate_type;
3573 	__le32 reserved1;
3574 	__le32 reserved2;
3575 } __packed;
3576 
3577 #define MWL8K_USE_AUTO_RATE	0x0002
3578 #define MWL8K_UCAST_RATE	0
3579 
3580 static int mwl8k_cmd_use_fixed_rate_sta(struct ieee80211_hw *hw)
3581 {
3582 	struct mwl8k_cmd_use_fixed_rate_sta *cmd;
3583 	int rc;
3584 
3585 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3586 	if (cmd == NULL)
3587 		return -ENOMEM;
3588 
3589 	cmd->header.code = cpu_to_le16(MWL8K_CMD_USE_FIXED_RATE);
3590 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3591 	cmd->action = cpu_to_le32(MWL8K_USE_AUTO_RATE);
3592 	cmd->rate_type = cpu_to_le32(MWL8K_UCAST_RATE);
3593 
3594 	rc = mwl8k_post_cmd(hw, &cmd->header);
3595 	kfree(cmd);
3596 
3597 	return rc;
3598 }
3599 
3600 /*
3601  * CMD_USE_FIXED_RATE (AP version).
3602  */
3603 struct mwl8k_cmd_use_fixed_rate_ap {
3604 	struct mwl8k_cmd_pkt header;
3605 	__le32 action;
3606 	__le32 allow_rate_drop;
3607 	__le32 num_rates;
3608 	struct mwl8k_rate_entry_ap {
3609 		__le32 is_ht_rate;
3610 		__le32 enable_retry;
3611 		__le32 rate;
3612 		__le32 retry_count;
3613 	} rate_entry[4];
3614 	u8 multicast_rate;
3615 	u8 multicast_rate_type;
3616 	u8 management_rate;
3617 } __packed;
3618 
3619 static int
3620 mwl8k_cmd_use_fixed_rate_ap(struct ieee80211_hw *hw, int mcast, int mgmt)
3621 {
3622 	struct mwl8k_cmd_use_fixed_rate_ap *cmd;
3623 	int rc;
3624 
3625 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3626 	if (cmd == NULL)
3627 		return -ENOMEM;
3628 
3629 	cmd->header.code = cpu_to_le16(MWL8K_CMD_USE_FIXED_RATE);
3630 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3631 	cmd->action = cpu_to_le32(MWL8K_USE_AUTO_RATE);
3632 	cmd->multicast_rate = mcast;
3633 	cmd->management_rate = mgmt;
3634 
3635 	rc = mwl8k_post_cmd(hw, &cmd->header);
3636 	kfree(cmd);
3637 
3638 	return rc;
3639 }
3640 
3641 /*
3642  * CMD_ENABLE_SNIFFER.
3643  */
3644 struct mwl8k_cmd_enable_sniffer {
3645 	struct mwl8k_cmd_pkt header;
3646 	__le32 action;
3647 } __packed;
3648 
3649 static int mwl8k_cmd_enable_sniffer(struct ieee80211_hw *hw, bool enable)
3650 {
3651 	struct mwl8k_cmd_enable_sniffer *cmd;
3652 	int rc;
3653 
3654 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3655 	if (cmd == NULL)
3656 		return -ENOMEM;
3657 
3658 	cmd->header.code = cpu_to_le16(MWL8K_CMD_ENABLE_SNIFFER);
3659 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3660 	cmd->action = cpu_to_le32(!!enable);
3661 
3662 	rc = mwl8k_post_cmd(hw, &cmd->header);
3663 	kfree(cmd);
3664 
3665 	return rc;
3666 }
3667 
3668 struct mwl8k_cmd_update_mac_addr {
3669 	struct mwl8k_cmd_pkt header;
3670 	union {
3671 		struct {
3672 			__le16 mac_type;
3673 			__u8 mac_addr[ETH_ALEN];
3674 		} mbss;
3675 		__u8 mac_addr[ETH_ALEN];
3676 	};
3677 } __packed;
3678 
3679 #define MWL8K_MAC_TYPE_PRIMARY_CLIENT		0
3680 #define MWL8K_MAC_TYPE_SECONDARY_CLIENT		1
3681 #define MWL8K_MAC_TYPE_PRIMARY_AP		2
3682 #define MWL8K_MAC_TYPE_SECONDARY_AP		3
3683 
3684 static int mwl8k_cmd_update_mac_addr(struct ieee80211_hw *hw,
3685 				  struct ieee80211_vif *vif, u8 *mac, bool set)
3686 {
3687 	struct mwl8k_priv *priv = hw->priv;
3688 	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
3689 	struct mwl8k_cmd_update_mac_addr *cmd;
3690 	int mac_type;
3691 	int rc;
3692 
3693 	mac_type = MWL8K_MAC_TYPE_PRIMARY_AP;
3694 	if (vif != NULL && vif->type == NL80211_IFTYPE_STATION) {
3695 		if (mwl8k_vif->macid + 1 == ffs(priv->sta_macids_supported))
3696 			if (priv->ap_fw)
3697 				mac_type = MWL8K_MAC_TYPE_SECONDARY_CLIENT;
3698 			else
3699 				mac_type = MWL8K_MAC_TYPE_PRIMARY_CLIENT;
3700 		else
3701 			mac_type = MWL8K_MAC_TYPE_SECONDARY_CLIENT;
3702 	} else if (vif != NULL && vif->type == NL80211_IFTYPE_AP) {
3703 		if (mwl8k_vif->macid + 1 == ffs(priv->ap_macids_supported))
3704 			mac_type = MWL8K_MAC_TYPE_PRIMARY_AP;
3705 		else
3706 			mac_type = MWL8K_MAC_TYPE_SECONDARY_AP;
3707 	}
3708 
3709 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3710 	if (cmd == NULL)
3711 		return -ENOMEM;
3712 
3713 	if (set)
3714 		cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_MAC_ADDR);
3715 	else
3716 		cmd->header.code = cpu_to_le16(MWL8K_CMD_DEL_MAC_ADDR);
3717 
3718 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3719 	if (priv->ap_fw) {
3720 		cmd->mbss.mac_type = cpu_to_le16(mac_type);
3721 		memcpy(cmd->mbss.mac_addr, mac, ETH_ALEN);
3722 	} else {
3723 		memcpy(cmd->mac_addr, mac, ETH_ALEN);
3724 	}
3725 
3726 	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3727 	kfree(cmd);
3728 
3729 	return rc;
3730 }
3731 
3732 /*
3733  * MWL8K_CMD_SET_MAC_ADDR.
3734  */
3735 static inline int mwl8k_cmd_set_mac_addr(struct ieee80211_hw *hw,
3736 				  struct ieee80211_vif *vif, u8 *mac)
3737 {
3738 	return mwl8k_cmd_update_mac_addr(hw, vif, mac, true);
3739 }
3740 
3741 /*
3742  * MWL8K_CMD_DEL_MAC_ADDR.
3743  */
3744 static inline int mwl8k_cmd_del_mac_addr(struct ieee80211_hw *hw,
3745 				  struct ieee80211_vif *vif, u8 *mac)
3746 {
3747 	return mwl8k_cmd_update_mac_addr(hw, vif, mac, false);
3748 }
3749 
3750 /*
3751  * CMD_SET_RATEADAPT_MODE.
3752  */
3753 struct mwl8k_cmd_set_rate_adapt_mode {
3754 	struct mwl8k_cmd_pkt header;
3755 	__le16 action;
3756 	__le16 mode;
3757 } __packed;
3758 
3759 static int mwl8k_cmd_set_rateadapt_mode(struct ieee80211_hw *hw, __u16 mode)
3760 {
3761 	struct mwl8k_cmd_set_rate_adapt_mode *cmd;
3762 	int rc;
3763 
3764 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3765 	if (cmd == NULL)
3766 		return -ENOMEM;
3767 
3768 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_RATEADAPT_MODE);
3769 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3770 	cmd->action = cpu_to_le16(MWL8K_CMD_SET);
3771 	cmd->mode = cpu_to_le16(mode);
3772 
3773 	rc = mwl8k_post_cmd(hw, &cmd->header);
3774 	kfree(cmd);
3775 
3776 	return rc;
3777 }
3778 
3779 /*
3780  * CMD_GET_WATCHDOG_BITMAP.
3781  */
3782 struct mwl8k_cmd_get_watchdog_bitmap {
3783 	struct mwl8k_cmd_pkt header;
3784 	u8	bitmap;
3785 } __packed;
3786 
3787 static int mwl8k_cmd_get_watchdog_bitmap(struct ieee80211_hw *hw, u8 *bitmap)
3788 {
3789 	struct mwl8k_cmd_get_watchdog_bitmap *cmd;
3790 	int rc;
3791 
3792 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3793 	if (cmd == NULL)
3794 		return -ENOMEM;
3795 
3796 	cmd->header.code = cpu_to_le16(MWL8K_CMD_GET_WATCHDOG_BITMAP);
3797 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3798 
3799 	rc = mwl8k_post_cmd(hw, &cmd->header);
3800 	if (!rc)
3801 		*bitmap = cmd->bitmap;
3802 
3803 	kfree(cmd);
3804 
3805 	return rc;
3806 }
3807 
3808 #define MWL8K_WMM_QUEUE_NUMBER	3
3809 
3810 static void mwl8k_destroy_ba(struct ieee80211_hw *hw,
3811 			     u8 idx);
3812 
3813 static void mwl8k_watchdog_ba_events(struct work_struct *work)
3814 {
3815 	int rc;
3816 	u8 bitmap = 0, stream_index;
3817 	struct mwl8k_ampdu_stream *streams;
3818 	struct mwl8k_priv *priv =
3819 		container_of(work, struct mwl8k_priv, watchdog_ba_handle);
3820 	struct ieee80211_hw *hw = priv->hw;
3821 	int i;
3822 	u32 status = 0;
3823 
3824 	mwl8k_fw_lock(hw);
3825 
3826 	rc = mwl8k_cmd_get_watchdog_bitmap(priv->hw, &bitmap);
3827 	if (rc)
3828 		goto done;
3829 
3830 	spin_lock(&priv->stream_lock);
3831 
3832 	/* the bitmap is the hw queue number.  Map it to the ampdu queue. */
3833 	for (i = 0; i < TOTAL_HW_TX_QUEUES; i++) {
3834 		if (bitmap & (1 << i)) {
3835 			stream_index = (i + MWL8K_WMM_QUEUE_NUMBER) %
3836 				       TOTAL_HW_TX_QUEUES;
3837 			streams = &priv->ampdu[stream_index];
3838 			if (streams->state == AMPDU_STREAM_ACTIVE) {
3839 				ieee80211_stop_tx_ba_session(streams->sta,
3840 							     streams->tid);
3841 				spin_unlock(&priv->stream_lock);
3842 				mwl8k_destroy_ba(hw, stream_index);
3843 				spin_lock(&priv->stream_lock);
3844 			}
3845 		}
3846 	}
3847 
3848 	spin_unlock(&priv->stream_lock);
3849 done:
3850 	atomic_dec(&priv->watchdog_event_pending);
3851 	status = ioread32(priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
3852 	iowrite32((status | MWL8K_A2H_INT_BA_WATCHDOG),
3853 		  priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
3854 	mwl8k_fw_unlock(hw);
3855 	return;
3856 }
3857 
3858 
3859 /*
3860  * CMD_BSS_START.
3861  */
3862 struct mwl8k_cmd_bss_start {
3863 	struct mwl8k_cmd_pkt header;
3864 	__le32 enable;
3865 } __packed;
3866 
3867 static int mwl8k_cmd_bss_start(struct ieee80211_hw *hw,
3868 			       struct ieee80211_vif *vif, int enable)
3869 {
3870 	struct mwl8k_cmd_bss_start *cmd;
3871 	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
3872 	struct mwl8k_priv *priv = hw->priv;
3873 	int rc;
3874 
3875 	if (enable && (priv->running_bsses & (1 << mwl8k_vif->macid)))
3876 		return 0;
3877 
3878 	if (!enable && !(priv->running_bsses & (1 << mwl8k_vif->macid)))
3879 		return 0;
3880 
3881 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3882 	if (cmd == NULL)
3883 		return -ENOMEM;
3884 
3885 	cmd->header.code = cpu_to_le16(MWL8K_CMD_BSS_START);
3886 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3887 	cmd->enable = cpu_to_le32(enable);
3888 
3889 	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3890 	kfree(cmd);
3891 
3892 	if (!rc) {
3893 		if (enable)
3894 			priv->running_bsses |= (1 << mwl8k_vif->macid);
3895 		else
3896 			priv->running_bsses &= ~(1 << mwl8k_vif->macid);
3897 	}
3898 	return rc;
3899 }
3900 
3901 static void mwl8k_enable_bsses(struct ieee80211_hw *hw, bool enable, u32 bitmap)
3902 {
3903 	struct mwl8k_priv *priv = hw->priv;
3904 	struct mwl8k_vif *mwl8k_vif, *tmp_vif;
3905 	struct ieee80211_vif *vif;
3906 
3907 	list_for_each_entry_safe(mwl8k_vif, tmp_vif, &priv->vif_list, list) {
3908 		vif = mwl8k_vif->vif;
3909 
3910 		if (!(bitmap & (1 << mwl8k_vif->macid)))
3911 			continue;
3912 
3913 		if (vif->type == NL80211_IFTYPE_AP)
3914 			mwl8k_cmd_bss_start(hw, vif, enable);
3915 	}
3916 }
3917 /*
3918  * CMD_BASTREAM.
3919  */
3920 
3921 /*
3922  * UPSTREAM is tx direction
3923  */
3924 #define BASTREAM_FLAG_DIRECTION_UPSTREAM	0x00
3925 #define BASTREAM_FLAG_IMMEDIATE_TYPE		0x01
3926 
3927 enum ba_stream_action_type {
3928 	MWL8K_BA_CREATE,
3929 	MWL8K_BA_UPDATE,
3930 	MWL8K_BA_DESTROY,
3931 	MWL8K_BA_FLUSH,
3932 	MWL8K_BA_CHECK,
3933 };
3934 
3935 
3936 struct mwl8k_create_ba_stream {
3937 	__le32	flags;
3938 	__le32	idle_thrs;
3939 	__le32	bar_thrs;
3940 	__le32	window_size;
3941 	u8	peer_mac_addr[6];
3942 	u8	dialog_token;
3943 	u8	tid;
3944 	u8	queue_id;
3945 	u8	param_info;
3946 	__le32	ba_context;
3947 	u8	reset_seq_no_flag;
3948 	__le16	curr_seq_no;
3949 	u8	sta_src_mac_addr[6];
3950 } __packed;
3951 
3952 struct mwl8k_destroy_ba_stream {
3953 	__le32	flags;
3954 	__le32	ba_context;
3955 } __packed;
3956 
3957 struct mwl8k_cmd_bastream {
3958 	struct mwl8k_cmd_pkt	header;
3959 	__le32	action;
3960 	union {
3961 		struct mwl8k_create_ba_stream	create_params;
3962 		struct mwl8k_destroy_ba_stream	destroy_params;
3963 	};
3964 } __packed;
3965 
3966 static int
3967 mwl8k_check_ba(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream,
3968 	       struct ieee80211_vif *vif)
3969 {
3970 	struct mwl8k_cmd_bastream *cmd;
3971 	int rc;
3972 
3973 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
3974 	if (cmd == NULL)
3975 		return -ENOMEM;
3976 
3977 	cmd->header.code = cpu_to_le16(MWL8K_CMD_BASTREAM);
3978 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
3979 
3980 	cmd->action = cpu_to_le32(MWL8K_BA_CHECK);
3981 
3982 	cmd->create_params.queue_id = stream->idx;
3983 	memcpy(&cmd->create_params.peer_mac_addr[0], stream->sta->addr,
3984 	       ETH_ALEN);
3985 	cmd->create_params.tid = stream->tid;
3986 
3987 	cmd->create_params.flags =
3988 		cpu_to_le32(BASTREAM_FLAG_IMMEDIATE_TYPE) |
3989 		cpu_to_le32(BASTREAM_FLAG_DIRECTION_UPSTREAM);
3990 
3991 	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
3992 
3993 	kfree(cmd);
3994 
3995 	return rc;
3996 }
3997 
3998 static int
3999 mwl8k_create_ba(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream,
4000 		u8 buf_size, struct ieee80211_vif *vif)
4001 {
4002 	struct mwl8k_cmd_bastream *cmd;
4003 	int rc;
4004 
4005 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4006 	if (cmd == NULL)
4007 		return -ENOMEM;
4008 
4009 
4010 	cmd->header.code = cpu_to_le16(MWL8K_CMD_BASTREAM);
4011 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
4012 
4013 	cmd->action = cpu_to_le32(MWL8K_BA_CREATE);
4014 
4015 	cmd->create_params.bar_thrs = cpu_to_le32((u32)buf_size);
4016 	cmd->create_params.window_size = cpu_to_le32((u32)buf_size);
4017 	cmd->create_params.queue_id = stream->idx;
4018 
4019 	memcpy(cmd->create_params.peer_mac_addr, stream->sta->addr, ETH_ALEN);
4020 	cmd->create_params.tid = stream->tid;
4021 	cmd->create_params.curr_seq_no = cpu_to_le16(0);
4022 	cmd->create_params.reset_seq_no_flag = 1;
4023 
4024 	cmd->create_params.param_info =
4025 		(stream->sta->ht_cap.ampdu_factor &
4026 		 IEEE80211_HT_AMPDU_PARM_FACTOR) |
4027 		((stream->sta->ht_cap.ampdu_density << 2) &
4028 		 IEEE80211_HT_AMPDU_PARM_DENSITY);
4029 
4030 	cmd->create_params.flags =
4031 		cpu_to_le32(BASTREAM_FLAG_IMMEDIATE_TYPE |
4032 					BASTREAM_FLAG_DIRECTION_UPSTREAM);
4033 
4034 	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
4035 
4036 	wiphy_debug(hw->wiphy, "Created a BA stream for %pM : tid %d\n",
4037 		stream->sta->addr, stream->tid);
4038 	kfree(cmd);
4039 
4040 	return rc;
4041 }
4042 
4043 static void mwl8k_destroy_ba(struct ieee80211_hw *hw,
4044 			     u8 idx)
4045 {
4046 	struct mwl8k_cmd_bastream *cmd;
4047 
4048 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4049 	if (cmd == NULL)
4050 		return;
4051 
4052 	cmd->header.code = cpu_to_le16(MWL8K_CMD_BASTREAM);
4053 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
4054 	cmd->action = cpu_to_le32(MWL8K_BA_DESTROY);
4055 
4056 	cmd->destroy_params.ba_context = cpu_to_le32(idx);
4057 	mwl8k_post_cmd(hw, &cmd->header);
4058 
4059 	wiphy_debug(hw->wiphy, "Deleted BA stream index %d\n", idx);
4060 
4061 	kfree(cmd);
4062 }
4063 
4064 /*
4065  * CMD_SET_NEW_STN.
4066  */
4067 struct mwl8k_cmd_set_new_stn {
4068 	struct mwl8k_cmd_pkt header;
4069 	__le16 aid;
4070 	__u8 mac_addr[6];
4071 	__le16 stn_id;
4072 	__le16 action;
4073 	__le16 rsvd;
4074 	__le32 legacy_rates;
4075 	__u8 ht_rates[4];
4076 	__le16 cap_info;
4077 	__le16 ht_capabilities_info;
4078 	__u8 mac_ht_param_info;
4079 	__u8 rev;
4080 	__u8 control_channel;
4081 	__u8 add_channel;
4082 	__le16 op_mode;
4083 	__le16 stbc;
4084 	__u8 add_qos_info;
4085 	__u8 is_qos_sta;
4086 	__le32 fw_sta_ptr;
4087 } __packed;
4088 
4089 #define MWL8K_STA_ACTION_ADD		0
4090 #define MWL8K_STA_ACTION_REMOVE		2
4091 
4092 static int mwl8k_cmd_set_new_stn_add(struct ieee80211_hw *hw,
4093 				     struct ieee80211_vif *vif,
4094 				     struct ieee80211_sta *sta)
4095 {
4096 	struct mwl8k_cmd_set_new_stn *cmd;
4097 	u32 rates;
4098 	int rc;
4099 
4100 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4101 	if (cmd == NULL)
4102 		return -ENOMEM;
4103 
4104 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_NEW_STN);
4105 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
4106 	cmd->aid = cpu_to_le16(sta->aid);
4107 	memcpy(cmd->mac_addr, sta->addr, ETH_ALEN);
4108 	cmd->stn_id = cpu_to_le16(sta->aid);
4109 	cmd->action = cpu_to_le16(MWL8K_STA_ACTION_ADD);
4110 	if (hw->conf.chandef.chan->band == NL80211_BAND_2GHZ)
4111 		rates = sta->supp_rates[NL80211_BAND_2GHZ];
4112 	else
4113 		rates = sta->supp_rates[NL80211_BAND_5GHZ] << 5;
4114 	cmd->legacy_rates = cpu_to_le32(rates);
4115 	if (sta->ht_cap.ht_supported) {
4116 		cmd->ht_rates[0] = sta->ht_cap.mcs.rx_mask[0];
4117 		cmd->ht_rates[1] = sta->ht_cap.mcs.rx_mask[1];
4118 		cmd->ht_rates[2] = sta->ht_cap.mcs.rx_mask[2];
4119 		cmd->ht_rates[3] = sta->ht_cap.mcs.rx_mask[3];
4120 		cmd->ht_capabilities_info = cpu_to_le16(sta->ht_cap.cap);
4121 		cmd->mac_ht_param_info = (sta->ht_cap.ampdu_factor & 3) |
4122 			((sta->ht_cap.ampdu_density & 7) << 2);
4123 		cmd->is_qos_sta = 1;
4124 	}
4125 
4126 	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
4127 	kfree(cmd);
4128 
4129 	return rc;
4130 }
4131 
4132 static int mwl8k_cmd_set_new_stn_add_self(struct ieee80211_hw *hw,
4133 					  struct ieee80211_vif *vif)
4134 {
4135 	struct mwl8k_cmd_set_new_stn *cmd;
4136 	int rc;
4137 
4138 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4139 	if (cmd == NULL)
4140 		return -ENOMEM;
4141 
4142 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_NEW_STN);
4143 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
4144 	memcpy(cmd->mac_addr, vif->addr, ETH_ALEN);
4145 
4146 	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
4147 	kfree(cmd);
4148 
4149 	return rc;
4150 }
4151 
4152 static int mwl8k_cmd_set_new_stn_del(struct ieee80211_hw *hw,
4153 				     struct ieee80211_vif *vif, u8 *addr)
4154 {
4155 	struct mwl8k_cmd_set_new_stn *cmd;
4156 	struct mwl8k_priv *priv = hw->priv;
4157 	int rc, i;
4158 	u8 idx;
4159 
4160 	spin_lock(&priv->stream_lock);
4161 	/* Destroy any active ampdu streams for this sta */
4162 	for (i = 0; i < MWL8K_NUM_AMPDU_STREAMS; i++) {
4163 		struct mwl8k_ampdu_stream *s;
4164 		s = &priv->ampdu[i];
4165 		if (s->state != AMPDU_NO_STREAM) {
4166 			if (memcmp(s->sta->addr, addr, ETH_ALEN) == 0) {
4167 				if (s->state == AMPDU_STREAM_ACTIVE) {
4168 					idx = s->idx;
4169 					spin_unlock(&priv->stream_lock);
4170 					mwl8k_destroy_ba(hw, idx);
4171 					spin_lock(&priv->stream_lock);
4172 				} else if (s->state == AMPDU_STREAM_NEW) {
4173 					mwl8k_remove_stream(hw, s);
4174 				}
4175 			}
4176 		}
4177 	}
4178 
4179 	spin_unlock(&priv->stream_lock);
4180 
4181 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4182 	if (cmd == NULL)
4183 		return -ENOMEM;
4184 
4185 	cmd->header.code = cpu_to_le16(MWL8K_CMD_SET_NEW_STN);
4186 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
4187 	memcpy(cmd->mac_addr, addr, ETH_ALEN);
4188 	cmd->action = cpu_to_le16(MWL8K_STA_ACTION_REMOVE);
4189 
4190 	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
4191 	kfree(cmd);
4192 
4193 	return rc;
4194 }
4195 
4196 /*
4197  * CMD_UPDATE_ENCRYPTION.
4198  */
4199 
4200 #define MAX_ENCR_KEY_LENGTH	16
4201 #define MIC_KEY_LENGTH		8
4202 
4203 struct mwl8k_cmd_update_encryption {
4204 	struct mwl8k_cmd_pkt header;
4205 
4206 	__le32 action;
4207 	__le32 reserved;
4208 	__u8 mac_addr[6];
4209 	__u8 encr_type;
4210 
4211 } __packed;
4212 
4213 struct mwl8k_cmd_set_key {
4214 	struct mwl8k_cmd_pkt header;
4215 
4216 	__le32 action;
4217 	__le32 reserved;
4218 	__le16 length;
4219 	__le16 key_type_id;
4220 	__le32 key_info;
4221 	__le32 key_id;
4222 	__le16 key_len;
4223 	__u8 key_material[MAX_ENCR_KEY_LENGTH];
4224 	__u8 tkip_tx_mic_key[MIC_KEY_LENGTH];
4225 	__u8 tkip_rx_mic_key[MIC_KEY_LENGTH];
4226 	__le16 tkip_rsc_low;
4227 	__le32 tkip_rsc_high;
4228 	__le16 tkip_tsc_low;
4229 	__le32 tkip_tsc_high;
4230 	__u8 mac_addr[6];
4231 } __packed;
4232 
4233 enum {
4234 	MWL8K_ENCR_ENABLE,
4235 	MWL8K_ENCR_SET_KEY,
4236 	MWL8K_ENCR_REMOVE_KEY,
4237 	MWL8K_ENCR_SET_GROUP_KEY,
4238 };
4239 
4240 #define MWL8K_UPDATE_ENCRYPTION_TYPE_WEP	0
4241 #define MWL8K_UPDATE_ENCRYPTION_TYPE_DISABLE	1
4242 #define MWL8K_UPDATE_ENCRYPTION_TYPE_TKIP	4
4243 #define MWL8K_UPDATE_ENCRYPTION_TYPE_MIXED	7
4244 #define MWL8K_UPDATE_ENCRYPTION_TYPE_AES	8
4245 
4246 enum {
4247 	MWL8K_ALG_WEP,
4248 	MWL8K_ALG_TKIP,
4249 	MWL8K_ALG_CCMP,
4250 };
4251 
4252 #define MWL8K_KEY_FLAG_TXGROUPKEY	0x00000004
4253 #define MWL8K_KEY_FLAG_PAIRWISE		0x00000008
4254 #define MWL8K_KEY_FLAG_TSC_VALID	0x00000040
4255 #define MWL8K_KEY_FLAG_WEP_TXKEY	0x01000000
4256 #define MWL8K_KEY_FLAG_MICKEY_VALID	0x02000000
4257 
4258 static int mwl8k_cmd_update_encryption_enable(struct ieee80211_hw *hw,
4259 					      struct ieee80211_vif *vif,
4260 					      u8 *addr,
4261 					      u8 encr_type)
4262 {
4263 	struct mwl8k_cmd_update_encryption *cmd;
4264 	int rc;
4265 
4266 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4267 	if (cmd == NULL)
4268 		return -ENOMEM;
4269 
4270 	cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_ENCRYPTION);
4271 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
4272 	cmd->action = cpu_to_le32(MWL8K_ENCR_ENABLE);
4273 	memcpy(cmd->mac_addr, addr, ETH_ALEN);
4274 	cmd->encr_type = encr_type;
4275 
4276 	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
4277 	kfree(cmd);
4278 
4279 	return rc;
4280 }
4281 
4282 static int mwl8k_encryption_set_cmd_info(struct mwl8k_cmd_set_key *cmd,
4283 						u8 *addr,
4284 						struct ieee80211_key_conf *key)
4285 {
4286 	cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_ENCRYPTION);
4287 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
4288 	cmd->length = cpu_to_le16(sizeof(*cmd) -
4289 				offsetof(struct mwl8k_cmd_set_key, length));
4290 	cmd->key_id = cpu_to_le32(key->keyidx);
4291 	cmd->key_len = cpu_to_le16(key->keylen);
4292 	memcpy(cmd->mac_addr, addr, ETH_ALEN);
4293 
4294 	switch (key->cipher) {
4295 	case WLAN_CIPHER_SUITE_WEP40:
4296 	case WLAN_CIPHER_SUITE_WEP104:
4297 		cmd->key_type_id = cpu_to_le16(MWL8K_ALG_WEP);
4298 		if (key->keyidx == 0)
4299 			cmd->key_info =	cpu_to_le32(MWL8K_KEY_FLAG_WEP_TXKEY);
4300 
4301 		break;
4302 	case WLAN_CIPHER_SUITE_TKIP:
4303 		cmd->key_type_id = cpu_to_le16(MWL8K_ALG_TKIP);
4304 		cmd->key_info =	(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
4305 			? cpu_to_le32(MWL8K_KEY_FLAG_PAIRWISE)
4306 			: cpu_to_le32(MWL8K_KEY_FLAG_TXGROUPKEY);
4307 		cmd->key_info |= cpu_to_le32(MWL8K_KEY_FLAG_MICKEY_VALID
4308 						| MWL8K_KEY_FLAG_TSC_VALID);
4309 		break;
4310 	case WLAN_CIPHER_SUITE_CCMP:
4311 		cmd->key_type_id = cpu_to_le16(MWL8K_ALG_CCMP);
4312 		cmd->key_info =	(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
4313 			? cpu_to_le32(MWL8K_KEY_FLAG_PAIRWISE)
4314 			: cpu_to_le32(MWL8K_KEY_FLAG_TXGROUPKEY);
4315 		break;
4316 	default:
4317 		return -ENOTSUPP;
4318 	}
4319 
4320 	return 0;
4321 }
4322 
4323 static int mwl8k_cmd_encryption_set_key(struct ieee80211_hw *hw,
4324 						struct ieee80211_vif *vif,
4325 						u8 *addr,
4326 						struct ieee80211_key_conf *key)
4327 {
4328 	struct mwl8k_cmd_set_key *cmd;
4329 	int rc;
4330 	int keymlen;
4331 	u32 action;
4332 	u8 idx;
4333 	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
4334 
4335 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4336 	if (cmd == NULL)
4337 		return -ENOMEM;
4338 
4339 	rc = mwl8k_encryption_set_cmd_info(cmd, addr, key);
4340 	if (rc < 0)
4341 		goto done;
4342 
4343 	idx = key->keyidx;
4344 
4345 	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
4346 		action = MWL8K_ENCR_SET_KEY;
4347 	else
4348 		action = MWL8K_ENCR_SET_GROUP_KEY;
4349 
4350 	switch (key->cipher) {
4351 	case WLAN_CIPHER_SUITE_WEP40:
4352 	case WLAN_CIPHER_SUITE_WEP104:
4353 		if (!mwl8k_vif->wep_key_conf[idx].enabled) {
4354 			memcpy(mwl8k_vif->wep_key_conf[idx].key, key,
4355 						sizeof(*key) + key->keylen);
4356 			mwl8k_vif->wep_key_conf[idx].enabled = 1;
4357 		}
4358 
4359 		keymlen = key->keylen;
4360 		action = MWL8K_ENCR_SET_KEY;
4361 		break;
4362 	case WLAN_CIPHER_SUITE_TKIP:
4363 		keymlen = MAX_ENCR_KEY_LENGTH + 2 * MIC_KEY_LENGTH;
4364 		break;
4365 	case WLAN_CIPHER_SUITE_CCMP:
4366 		keymlen = key->keylen;
4367 		break;
4368 	default:
4369 		rc = -ENOTSUPP;
4370 		goto done;
4371 	}
4372 
4373 	memcpy(cmd->key_material, key->key, keymlen);
4374 	cmd->action = cpu_to_le32(action);
4375 
4376 	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
4377 done:
4378 	kfree(cmd);
4379 
4380 	return rc;
4381 }
4382 
4383 static int mwl8k_cmd_encryption_remove_key(struct ieee80211_hw *hw,
4384 						struct ieee80211_vif *vif,
4385 						u8 *addr,
4386 						struct ieee80211_key_conf *key)
4387 {
4388 	struct mwl8k_cmd_set_key *cmd;
4389 	int rc;
4390 	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
4391 
4392 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4393 	if (cmd == NULL)
4394 		return -ENOMEM;
4395 
4396 	rc = mwl8k_encryption_set_cmd_info(cmd, addr, key);
4397 	if (rc < 0)
4398 		goto done;
4399 
4400 	if (key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
4401 			key->cipher == WLAN_CIPHER_SUITE_WEP104)
4402 		mwl8k_vif->wep_key_conf[key->keyidx].enabled = 0;
4403 
4404 	cmd->action = cpu_to_le32(MWL8K_ENCR_REMOVE_KEY);
4405 
4406 	rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
4407 done:
4408 	kfree(cmd);
4409 
4410 	return rc;
4411 }
4412 
4413 static int mwl8k_set_key(struct ieee80211_hw *hw,
4414 			 enum set_key_cmd cmd_param,
4415 			 struct ieee80211_vif *vif,
4416 			 struct ieee80211_sta *sta,
4417 			 struct ieee80211_key_conf *key)
4418 {
4419 	int rc = 0;
4420 	u8 encr_type;
4421 	u8 *addr;
4422 	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
4423 	struct mwl8k_priv *priv = hw->priv;
4424 
4425 	if (vif->type == NL80211_IFTYPE_STATION && !priv->ap_fw)
4426 		return -EOPNOTSUPP;
4427 
4428 	if (sta == NULL)
4429 		addr = vif->addr;
4430 	else
4431 		addr = sta->addr;
4432 
4433 	if (cmd_param == SET_KEY) {
4434 		rc = mwl8k_cmd_encryption_set_key(hw, vif, addr, key);
4435 		if (rc)
4436 			goto out;
4437 
4438 		if ((key->cipher == WLAN_CIPHER_SUITE_WEP40)
4439 				|| (key->cipher == WLAN_CIPHER_SUITE_WEP104))
4440 			encr_type = MWL8K_UPDATE_ENCRYPTION_TYPE_WEP;
4441 		else
4442 			encr_type = MWL8K_UPDATE_ENCRYPTION_TYPE_MIXED;
4443 
4444 		rc = mwl8k_cmd_update_encryption_enable(hw, vif, addr,
4445 								encr_type);
4446 		if (rc)
4447 			goto out;
4448 
4449 		mwl8k_vif->is_hw_crypto_enabled = true;
4450 
4451 	} else {
4452 		rc = mwl8k_cmd_encryption_remove_key(hw, vif, addr, key);
4453 
4454 		if (rc)
4455 			goto out;
4456 	}
4457 out:
4458 	return rc;
4459 }
4460 
4461 /*
4462  * CMD_UPDATE_STADB.
4463  */
4464 struct ewc_ht_info {
4465 	__le16	control1;
4466 	__le16	control2;
4467 	__le16	control3;
4468 } __packed;
4469 
4470 struct peer_capability_info {
4471 	/* Peer type - AP vs. STA.  */
4472 	__u8	peer_type;
4473 
4474 	/* Basic 802.11 capabilities from assoc resp.  */
4475 	__le16	basic_caps;
4476 
4477 	/* Set if peer supports 802.11n high throughput (HT).  */
4478 	__u8	ht_support;
4479 
4480 	/* Valid if HT is supported.  */
4481 	__le16	ht_caps;
4482 	__u8	extended_ht_caps;
4483 	struct ewc_ht_info	ewc_info;
4484 
4485 	/* Legacy rate table. Intersection of our rates and peer rates.  */
4486 	__u8	legacy_rates[12];
4487 
4488 	/* HT rate table. Intersection of our rates and peer rates.  */
4489 	__u8	ht_rates[16];
4490 	__u8	pad[16];
4491 
4492 	/* If set, interoperability mode, no proprietary extensions.  */
4493 	__u8	interop;
4494 	__u8	pad2;
4495 	__u8	station_id;
4496 	__le16	amsdu_enabled;
4497 } __packed;
4498 
4499 struct mwl8k_cmd_update_stadb {
4500 	struct mwl8k_cmd_pkt header;
4501 
4502 	/* See STADB_ACTION_TYPE */
4503 	__le32	action;
4504 
4505 	/* Peer MAC address */
4506 	__u8	peer_addr[ETH_ALEN];
4507 
4508 	__le32	reserved;
4509 
4510 	/* Peer info - valid during add/update.  */
4511 	struct peer_capability_info	peer_info;
4512 } __packed;
4513 
4514 #define MWL8K_STA_DB_MODIFY_ENTRY	1
4515 #define MWL8K_STA_DB_DEL_ENTRY		2
4516 
4517 /* Peer Entry flags - used to define the type of the peer node */
4518 #define MWL8K_PEER_TYPE_ACCESSPOINT	2
4519 
4520 static int mwl8k_cmd_update_stadb_add(struct ieee80211_hw *hw,
4521 				      struct ieee80211_vif *vif,
4522 				      struct ieee80211_sta *sta)
4523 {
4524 	struct mwl8k_cmd_update_stadb *cmd;
4525 	struct peer_capability_info *p;
4526 	u32 rates;
4527 	int rc;
4528 
4529 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4530 	if (cmd == NULL)
4531 		return -ENOMEM;
4532 
4533 	cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_STADB);
4534 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
4535 	cmd->action = cpu_to_le32(MWL8K_STA_DB_MODIFY_ENTRY);
4536 	memcpy(cmd->peer_addr, sta->addr, ETH_ALEN);
4537 
4538 	p = &cmd->peer_info;
4539 	p->peer_type = MWL8K_PEER_TYPE_ACCESSPOINT;
4540 	p->basic_caps = cpu_to_le16(vif->bss_conf.assoc_capability);
4541 	p->ht_support = sta->ht_cap.ht_supported;
4542 	p->ht_caps = cpu_to_le16(sta->ht_cap.cap);
4543 	p->extended_ht_caps = (sta->ht_cap.ampdu_factor & 3) |
4544 		((sta->ht_cap.ampdu_density & 7) << 2);
4545 	if (hw->conf.chandef.chan->band == NL80211_BAND_2GHZ)
4546 		rates = sta->supp_rates[NL80211_BAND_2GHZ];
4547 	else
4548 		rates = sta->supp_rates[NL80211_BAND_5GHZ] << 5;
4549 	legacy_rate_mask_to_array(p->legacy_rates, rates);
4550 	memcpy(p->ht_rates, sta->ht_cap.mcs.rx_mask, 16);
4551 	p->interop = 1;
4552 	p->amsdu_enabled = 0;
4553 
4554 	rc = mwl8k_post_cmd(hw, &cmd->header);
4555 	if (!rc)
4556 		rc = p->station_id;
4557 	kfree(cmd);
4558 
4559 	return rc;
4560 }
4561 
4562 static int mwl8k_cmd_update_stadb_del(struct ieee80211_hw *hw,
4563 				      struct ieee80211_vif *vif, u8 *addr)
4564 {
4565 	struct mwl8k_cmd_update_stadb *cmd;
4566 	int rc;
4567 
4568 	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
4569 	if (cmd == NULL)
4570 		return -ENOMEM;
4571 
4572 	cmd->header.code = cpu_to_le16(MWL8K_CMD_UPDATE_STADB);
4573 	cmd->header.length = cpu_to_le16(sizeof(*cmd));
4574 	cmd->action = cpu_to_le32(MWL8K_STA_DB_DEL_ENTRY);
4575 	memcpy(cmd->peer_addr, addr, ETH_ALEN);
4576 
4577 	rc = mwl8k_post_cmd(hw, &cmd->header);
4578 	kfree(cmd);
4579 
4580 	return rc;
4581 }
4582 
4583 
4584 /*
4585  * Interrupt handling.
4586  */
4587 static irqreturn_t mwl8k_interrupt(int irq, void *dev_id)
4588 {
4589 	struct ieee80211_hw *hw = dev_id;
4590 	struct mwl8k_priv *priv = hw->priv;
4591 	u32 status;
4592 
4593 	status = ioread32(priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
4594 	if (!status)
4595 		return IRQ_NONE;
4596 
4597 	if (status & MWL8K_A2H_INT_TX_DONE) {
4598 		status &= ~MWL8K_A2H_INT_TX_DONE;
4599 		tasklet_schedule(&priv->poll_tx_task);
4600 	}
4601 
4602 	if (status & MWL8K_A2H_INT_RX_READY) {
4603 		status &= ~MWL8K_A2H_INT_RX_READY;
4604 		tasklet_schedule(&priv->poll_rx_task);
4605 	}
4606 
4607 	if (status & MWL8K_A2H_INT_BA_WATCHDOG) {
4608 		iowrite32(~MWL8K_A2H_INT_BA_WATCHDOG,
4609 			  priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
4610 
4611 		atomic_inc(&priv->watchdog_event_pending);
4612 		status &= ~MWL8K_A2H_INT_BA_WATCHDOG;
4613 		ieee80211_queue_work(hw, &priv->watchdog_ba_handle);
4614 	}
4615 
4616 	if (status)
4617 		iowrite32(~status, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
4618 
4619 	if (status & MWL8K_A2H_INT_OPC_DONE) {
4620 		if (priv->hostcmd_wait != NULL)
4621 			complete(priv->hostcmd_wait);
4622 	}
4623 
4624 	if (status & MWL8K_A2H_INT_QUEUE_EMPTY) {
4625 		if (!mutex_is_locked(&priv->fw_mutex) &&
4626 		    priv->radio_on && priv->pending_tx_pkts)
4627 			mwl8k_tx_start(priv);
4628 	}
4629 
4630 	return IRQ_HANDLED;
4631 }
4632 
4633 static void mwl8k_tx_poll(unsigned long data)
4634 {
4635 	struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
4636 	struct mwl8k_priv *priv = hw->priv;
4637 	int limit;
4638 	int i;
4639 
4640 	limit = 32;
4641 
4642 	spin_lock(&priv->tx_lock);
4643 
4644 	for (i = 0; i < mwl8k_tx_queues(priv); i++)
4645 		limit -= mwl8k_txq_reclaim(hw, i, limit, 0);
4646 
4647 	if (!priv->pending_tx_pkts && priv->tx_wait != NULL) {
4648 		complete(priv->tx_wait);
4649 		priv->tx_wait = NULL;
4650 	}
4651 
4652 	spin_unlock(&priv->tx_lock);
4653 
4654 	if (limit) {
4655 		writel(~MWL8K_A2H_INT_TX_DONE,
4656 		       priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
4657 	} else {
4658 		tasklet_schedule(&priv->poll_tx_task);
4659 	}
4660 }
4661 
4662 static void mwl8k_rx_poll(unsigned long data)
4663 {
4664 	struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
4665 	struct mwl8k_priv *priv = hw->priv;
4666 	int limit;
4667 
4668 	limit = 32;
4669 	limit -= rxq_process(hw, 0, limit);
4670 	limit -= rxq_refill(hw, 0, limit);
4671 
4672 	if (limit) {
4673 		writel(~MWL8K_A2H_INT_RX_READY,
4674 		       priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
4675 	} else {
4676 		tasklet_schedule(&priv->poll_rx_task);
4677 	}
4678 }
4679 
4680 
4681 /*
4682  * Core driver operations.
4683  */
4684 static void mwl8k_tx(struct ieee80211_hw *hw,
4685 		     struct ieee80211_tx_control *control,
4686 		     struct sk_buff *skb)
4687 {
4688 	struct mwl8k_priv *priv = hw->priv;
4689 	int index = skb_get_queue_mapping(skb);
4690 
4691 	if (!priv->radio_on) {
4692 		wiphy_debug(hw->wiphy,
4693 			    "dropped TX frame since radio disabled\n");
4694 		dev_kfree_skb(skb);
4695 		return;
4696 	}
4697 
4698 	mwl8k_txq_xmit(hw, index, control->sta, skb);
4699 }
4700 
4701 static int mwl8k_start(struct ieee80211_hw *hw)
4702 {
4703 	struct mwl8k_priv *priv = hw->priv;
4704 	int rc;
4705 
4706 	rc = request_irq(priv->pdev->irq, mwl8k_interrupt,
4707 			 IRQF_SHARED, MWL8K_NAME, hw);
4708 	if (rc) {
4709 		priv->irq = -1;
4710 		wiphy_err(hw->wiphy, "failed to register IRQ handler\n");
4711 		return -EIO;
4712 	}
4713 	priv->irq = priv->pdev->irq;
4714 
4715 	/* Enable TX reclaim and RX tasklets.  */
4716 	tasklet_enable(&priv->poll_tx_task);
4717 	tasklet_enable(&priv->poll_rx_task);
4718 
4719 	/* Enable interrupts */
4720 	iowrite32(MWL8K_A2H_EVENTS, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
4721 	iowrite32(MWL8K_A2H_EVENTS,
4722 		  priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
4723 
4724 	rc = mwl8k_fw_lock(hw);
4725 	if (!rc) {
4726 		rc = mwl8k_cmd_radio_enable(hw);
4727 
4728 		if (!priv->ap_fw) {
4729 			if (!rc)
4730 				rc = mwl8k_cmd_enable_sniffer(hw, 0);
4731 
4732 			if (!rc)
4733 				rc = mwl8k_cmd_set_pre_scan(hw);
4734 
4735 			if (!rc)
4736 				rc = mwl8k_cmd_set_post_scan(hw,
4737 						"\x00\x00\x00\x00\x00\x00");
4738 		}
4739 
4740 		if (!rc)
4741 			rc = mwl8k_cmd_set_rateadapt_mode(hw, 0);
4742 
4743 		if (!rc)
4744 			rc = mwl8k_cmd_set_wmm_mode(hw, 0);
4745 
4746 		mwl8k_fw_unlock(hw);
4747 	}
4748 
4749 	if (rc) {
4750 		iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
4751 		free_irq(priv->pdev->irq, hw);
4752 		priv->irq = -1;
4753 		tasklet_disable(&priv->poll_tx_task);
4754 		tasklet_disable(&priv->poll_rx_task);
4755 	} else {
4756 		ieee80211_wake_queues(hw);
4757 	}
4758 
4759 	return rc;
4760 }
4761 
4762 static void mwl8k_stop(struct ieee80211_hw *hw)
4763 {
4764 	struct mwl8k_priv *priv = hw->priv;
4765 	int i;
4766 
4767 	if (!priv->hw_restart_in_progress)
4768 		mwl8k_cmd_radio_disable(hw);
4769 
4770 	ieee80211_stop_queues(hw);
4771 
4772 	/* Disable interrupts */
4773 	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
4774 	if (priv->irq != -1) {
4775 		free_irq(priv->pdev->irq, hw);
4776 		priv->irq = -1;
4777 	}
4778 
4779 	/* Stop finalize join worker */
4780 	cancel_work_sync(&priv->finalize_join_worker);
4781 	cancel_work_sync(&priv->watchdog_ba_handle);
4782 	if (priv->beacon_skb != NULL)
4783 		dev_kfree_skb(priv->beacon_skb);
4784 
4785 	/* Stop TX reclaim and RX tasklets.  */
4786 	tasklet_disable(&priv->poll_tx_task);
4787 	tasklet_disable(&priv->poll_rx_task);
4788 
4789 	/* Return all skbs to mac80211 */
4790 	for (i = 0; i < mwl8k_tx_queues(priv); i++)
4791 		mwl8k_txq_reclaim(hw, i, INT_MAX, 1);
4792 }
4793 
4794 static int mwl8k_reload_firmware(struct ieee80211_hw *hw, char *fw_image);
4795 
4796 static int mwl8k_add_interface(struct ieee80211_hw *hw,
4797 			       struct ieee80211_vif *vif)
4798 {
4799 	struct mwl8k_priv *priv = hw->priv;
4800 	struct mwl8k_vif *mwl8k_vif;
4801 	u32 macids_supported;
4802 	int macid, rc;
4803 	struct mwl8k_device_info *di;
4804 
4805 	/*
4806 	 * Reject interface creation if sniffer mode is active, as
4807 	 * STA operation is mutually exclusive with hardware sniffer
4808 	 * mode.  (Sniffer mode is only used on STA firmware.)
4809 	 */
4810 	if (priv->sniffer_enabled) {
4811 		wiphy_info(hw->wiphy,
4812 			   "unable to create STA interface because sniffer mode is enabled\n");
4813 		return -EINVAL;
4814 	}
4815 
4816 	di = priv->device_info;
4817 	switch (vif->type) {
4818 	case NL80211_IFTYPE_AP:
4819 		if (!priv->ap_fw && di->fw_image_ap) {
4820 			/* we must load the ap fw to meet this request */
4821 			if (!list_empty(&priv->vif_list))
4822 				return -EBUSY;
4823 			rc = mwl8k_reload_firmware(hw, di->fw_image_ap);
4824 			if (rc)
4825 				return rc;
4826 		}
4827 		macids_supported = priv->ap_macids_supported;
4828 		break;
4829 	case NL80211_IFTYPE_STATION:
4830 		if (priv->ap_fw && di->fw_image_sta) {
4831 			if (!list_empty(&priv->vif_list)) {
4832 				wiphy_warn(hw->wiphy, "AP interface is running.\n"
4833 					   "Adding STA interface for WDS");
4834 			} else {
4835 				/* we must load the sta fw to
4836 				 * meet this request.
4837 				 */
4838 				rc = mwl8k_reload_firmware(hw,
4839 							   di->fw_image_sta);
4840 				if (rc)
4841 					return rc;
4842 			}
4843 		}
4844 		macids_supported = priv->sta_macids_supported;
4845 		break;
4846 	default:
4847 		return -EINVAL;
4848 	}
4849 
4850 	macid = ffs(macids_supported & ~priv->macids_used);
4851 	if (!macid--)
4852 		return -EBUSY;
4853 
4854 	/* Setup driver private area. */
4855 	mwl8k_vif = MWL8K_VIF(vif);
4856 	memset(mwl8k_vif, 0, sizeof(*mwl8k_vif));
4857 	mwl8k_vif->vif = vif;
4858 	mwl8k_vif->macid = macid;
4859 	mwl8k_vif->seqno = 0;
4860 	memcpy(mwl8k_vif->bssid, vif->addr, ETH_ALEN);
4861 	mwl8k_vif->is_hw_crypto_enabled = false;
4862 
4863 	/* Set the mac address.  */
4864 	mwl8k_cmd_set_mac_addr(hw, vif, vif->addr);
4865 
4866 	if (vif->type == NL80211_IFTYPE_AP)
4867 		mwl8k_cmd_set_new_stn_add_self(hw, vif);
4868 
4869 	priv->macids_used |= 1 << mwl8k_vif->macid;
4870 	list_add_tail(&mwl8k_vif->list, &priv->vif_list);
4871 
4872 	return 0;
4873 }
4874 
4875 static void mwl8k_remove_vif(struct mwl8k_priv *priv, struct mwl8k_vif *vif)
4876 {
4877 	/* Has ieee80211_restart_hw re-added the removed interfaces? */
4878 	if (!priv->macids_used)
4879 		return;
4880 
4881 	priv->macids_used &= ~(1 << vif->macid);
4882 	list_del(&vif->list);
4883 }
4884 
4885 static void mwl8k_remove_interface(struct ieee80211_hw *hw,
4886 				   struct ieee80211_vif *vif)
4887 {
4888 	struct mwl8k_priv *priv = hw->priv;
4889 	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
4890 
4891 	if (vif->type == NL80211_IFTYPE_AP)
4892 		mwl8k_cmd_set_new_stn_del(hw, vif, vif->addr);
4893 
4894 	mwl8k_cmd_del_mac_addr(hw, vif, vif->addr);
4895 
4896 	mwl8k_remove_vif(priv, mwl8k_vif);
4897 }
4898 
4899 static void mwl8k_hw_restart_work(struct work_struct *work)
4900 {
4901 	struct mwl8k_priv *priv =
4902 		container_of(work, struct mwl8k_priv, fw_reload);
4903 	struct ieee80211_hw *hw = priv->hw;
4904 	struct mwl8k_device_info *di;
4905 	int rc;
4906 
4907 	/* If some command is waiting for a response, clear it */
4908 	if (priv->hostcmd_wait != NULL) {
4909 		complete(priv->hostcmd_wait);
4910 		priv->hostcmd_wait = NULL;
4911 	}
4912 
4913 	priv->hw_restart_owner = current;
4914 	di = priv->device_info;
4915 	mwl8k_fw_lock(hw);
4916 
4917 	if (priv->ap_fw)
4918 		rc = mwl8k_reload_firmware(hw, di->fw_image_ap);
4919 	else
4920 		rc = mwl8k_reload_firmware(hw, di->fw_image_sta);
4921 
4922 	if (rc)
4923 		goto fail;
4924 
4925 	priv->hw_restart_owner = NULL;
4926 	priv->hw_restart_in_progress = false;
4927 
4928 	/*
4929 	 * This unlock will wake up the queues and
4930 	 * also opens the command path for other
4931 	 * commands
4932 	 */
4933 	mwl8k_fw_unlock(hw);
4934 
4935 	ieee80211_restart_hw(hw);
4936 
4937 	wiphy_err(hw->wiphy, "Firmware restarted successfully\n");
4938 
4939 	return;
4940 fail:
4941 	mwl8k_fw_unlock(hw);
4942 
4943 	wiphy_err(hw->wiphy, "Firmware restart failed\n");
4944 }
4945 
4946 static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
4947 {
4948 	struct ieee80211_conf *conf = &hw->conf;
4949 	struct mwl8k_priv *priv = hw->priv;
4950 	int rc;
4951 
4952 	rc = mwl8k_fw_lock(hw);
4953 	if (rc)
4954 		return rc;
4955 
4956 	if (conf->flags & IEEE80211_CONF_IDLE)
4957 		rc = mwl8k_cmd_radio_disable(hw);
4958 	else
4959 		rc = mwl8k_cmd_radio_enable(hw);
4960 	if (rc)
4961 		goto out;
4962 
4963 	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
4964 		rc = mwl8k_cmd_set_rf_channel(hw, conf);
4965 		if (rc)
4966 			goto out;
4967 	}
4968 
4969 	if (conf->power_level > 18)
4970 		conf->power_level = 18;
4971 
4972 	if (priv->ap_fw) {
4973 
4974 		if (conf->flags & IEEE80211_CONF_CHANGE_POWER) {
4975 			rc = mwl8k_cmd_tx_power(hw, conf, conf->power_level);
4976 			if (rc)
4977 				goto out;
4978 		}
4979 
4980 
4981 	} else {
4982 		rc = mwl8k_cmd_rf_tx_power(hw, conf->power_level);
4983 		if (rc)
4984 			goto out;
4985 		rc = mwl8k_cmd_mimo_config(hw, 0x7, 0x7);
4986 	}
4987 
4988 out:
4989 	mwl8k_fw_unlock(hw);
4990 
4991 	return rc;
4992 }
4993 
4994 static void
4995 mwl8k_bss_info_changed_sta(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
4996 			   struct ieee80211_bss_conf *info, u32 changed)
4997 {
4998 	struct mwl8k_priv *priv = hw->priv;
4999 	u32 ap_legacy_rates = 0;
5000 	u8 ap_mcs_rates[16];
5001 	int rc;
5002 
5003 	if (mwl8k_fw_lock(hw))
5004 		return;
5005 
5006 	/*
5007 	 * No need to capture a beacon if we're no longer associated.
5008 	 */
5009 	if ((changed & BSS_CHANGED_ASSOC) && !vif->bss_conf.assoc)
5010 		priv->capture_beacon = false;
5011 
5012 	/*
5013 	 * Get the AP's legacy and MCS rates.
5014 	 */
5015 	if (vif->bss_conf.assoc) {
5016 		struct ieee80211_sta *ap;
5017 
5018 		rcu_read_lock();
5019 
5020 		ap = ieee80211_find_sta(vif, vif->bss_conf.bssid);
5021 		if (ap == NULL) {
5022 			rcu_read_unlock();
5023 			goto out;
5024 		}
5025 
5026 		if (hw->conf.chandef.chan->band == NL80211_BAND_2GHZ) {
5027 			ap_legacy_rates = ap->supp_rates[NL80211_BAND_2GHZ];
5028 		} else {
5029 			ap_legacy_rates =
5030 				ap->supp_rates[NL80211_BAND_5GHZ] << 5;
5031 		}
5032 		memcpy(ap_mcs_rates, ap->ht_cap.mcs.rx_mask, 16);
5033 
5034 		rcu_read_unlock();
5035 
5036 		if (changed & BSS_CHANGED_ASSOC) {
5037 			if (!priv->ap_fw) {
5038 				rc = mwl8k_cmd_set_rate(hw, vif,
5039 							ap_legacy_rates,
5040 							ap_mcs_rates);
5041 				if (rc)
5042 					goto out;
5043 
5044 				rc = mwl8k_cmd_use_fixed_rate_sta(hw);
5045 				if (rc)
5046 					goto out;
5047 			} else {
5048 				int idx;
5049 				int rate;
5050 
5051 				/* Use AP firmware specific rate command.
5052 				 */
5053 				idx = ffs(vif->bss_conf.basic_rates);
5054 				if (idx)
5055 					idx--;
5056 
5057 				if (hw->conf.chandef.chan->band ==
5058 				    NL80211_BAND_2GHZ)
5059 					rate = mwl8k_rates_24[idx].hw_value;
5060 				else
5061 					rate = mwl8k_rates_50[idx].hw_value;
5062 
5063 				mwl8k_cmd_use_fixed_rate_ap(hw, rate, rate);
5064 			}
5065 		}
5066 	}
5067 
5068 	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
5069 		rc = mwl8k_set_radio_preamble(hw,
5070 				vif->bss_conf.use_short_preamble);
5071 		if (rc)
5072 			goto out;
5073 	}
5074 
5075 	if ((changed & BSS_CHANGED_ERP_SLOT) && !priv->ap_fw)  {
5076 		rc = mwl8k_cmd_set_slot(hw, vif->bss_conf.use_short_slot);
5077 		if (rc)
5078 			goto out;
5079 	}
5080 
5081 	if (vif->bss_conf.assoc && !priv->ap_fw &&
5082 	    (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_ERP_CTS_PROT |
5083 			BSS_CHANGED_HT))) {
5084 		rc = mwl8k_cmd_set_aid(hw, vif, ap_legacy_rates);
5085 		if (rc)
5086 			goto out;
5087 	}
5088 
5089 	if (vif->bss_conf.assoc &&
5090 	    (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_BEACON_INT))) {
5091 		/*
5092 		 * Finalize the join.  Tell rx handler to process
5093 		 * next beacon from our BSSID.
5094 		 */
5095 		memcpy(priv->capture_bssid, vif->bss_conf.bssid, ETH_ALEN);
5096 		priv->capture_beacon = true;
5097 	}
5098 
5099 out:
5100 	mwl8k_fw_unlock(hw);
5101 }
5102 
5103 static void
5104 mwl8k_bss_info_changed_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
5105 			  struct ieee80211_bss_conf *info, u32 changed)
5106 {
5107 	int rc;
5108 
5109 	if (mwl8k_fw_lock(hw))
5110 		return;
5111 
5112 	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
5113 		rc = mwl8k_set_radio_preamble(hw,
5114 				vif->bss_conf.use_short_preamble);
5115 		if (rc)
5116 			goto out;
5117 	}
5118 
5119 	if (changed & BSS_CHANGED_BASIC_RATES) {
5120 		int idx;
5121 		int rate;
5122 
5123 		/*
5124 		 * Use lowest supported basic rate for multicasts
5125 		 * and management frames (such as probe responses --
5126 		 * beacons will always go out at 1 Mb/s).
5127 		 */
5128 		idx = ffs(vif->bss_conf.basic_rates);
5129 		if (idx)
5130 			idx--;
5131 
5132 		if (hw->conf.chandef.chan->band == NL80211_BAND_2GHZ)
5133 			rate = mwl8k_rates_24[idx].hw_value;
5134 		else
5135 			rate = mwl8k_rates_50[idx].hw_value;
5136 
5137 		mwl8k_cmd_use_fixed_rate_ap(hw, rate, rate);
5138 	}
5139 
5140 	if (changed & (BSS_CHANGED_BEACON_INT | BSS_CHANGED_BEACON)) {
5141 		struct sk_buff *skb;
5142 
5143 		skb = ieee80211_beacon_get(hw, vif);
5144 		if (skb != NULL) {
5145 			mwl8k_cmd_set_beacon(hw, vif, skb->data, skb->len);
5146 			kfree_skb(skb);
5147 		}
5148 	}
5149 
5150 	if (changed & BSS_CHANGED_BEACON_ENABLED)
5151 		mwl8k_cmd_bss_start(hw, vif, info->enable_beacon);
5152 
5153 out:
5154 	mwl8k_fw_unlock(hw);
5155 }
5156 
5157 static void
5158 mwl8k_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
5159 		       struct ieee80211_bss_conf *info, u32 changed)
5160 {
5161 	if (vif->type == NL80211_IFTYPE_STATION)
5162 		mwl8k_bss_info_changed_sta(hw, vif, info, changed);
5163 	if (vif->type == NL80211_IFTYPE_AP)
5164 		mwl8k_bss_info_changed_ap(hw, vif, info, changed);
5165 }
5166 
5167 static u64 mwl8k_prepare_multicast(struct ieee80211_hw *hw,
5168 				   struct netdev_hw_addr_list *mc_list)
5169 {
5170 	struct mwl8k_cmd_pkt *cmd;
5171 
5172 	/*
5173 	 * Synthesize and return a command packet that programs the
5174 	 * hardware multicast address filter.  At this point we don't
5175 	 * know whether FIF_ALLMULTI is being requested, but if it is,
5176 	 * we'll end up throwing this packet away and creating a new
5177 	 * one in mwl8k_configure_filter().
5178 	 */
5179 	cmd = __mwl8k_cmd_mac_multicast_adr(hw, 0, mc_list);
5180 
5181 	return (unsigned long)cmd;
5182 }
5183 
5184 static int
5185 mwl8k_configure_filter_sniffer(struct ieee80211_hw *hw,
5186 			       unsigned int changed_flags,
5187 			       unsigned int *total_flags)
5188 {
5189 	struct mwl8k_priv *priv = hw->priv;
5190 
5191 	/*
5192 	 * Hardware sniffer mode is mutually exclusive with STA
5193 	 * operation, so refuse to enable sniffer mode if a STA
5194 	 * interface is active.
5195 	 */
5196 	if (!list_empty(&priv->vif_list)) {
5197 		if (net_ratelimit())
5198 			wiphy_info(hw->wiphy,
5199 				   "not enabling sniffer mode because STA interface is active\n");
5200 		return 0;
5201 	}
5202 
5203 	if (!priv->sniffer_enabled) {
5204 		if (mwl8k_cmd_enable_sniffer(hw, 1))
5205 			return 0;
5206 		priv->sniffer_enabled = true;
5207 	}
5208 
5209 	*total_flags &=	FIF_ALLMULTI |
5210 			FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL |
5211 			FIF_OTHER_BSS;
5212 
5213 	return 1;
5214 }
5215 
5216 static struct mwl8k_vif *mwl8k_first_vif(struct mwl8k_priv *priv)
5217 {
5218 	if (!list_empty(&priv->vif_list))
5219 		return list_entry(priv->vif_list.next, struct mwl8k_vif, list);
5220 
5221 	return NULL;
5222 }
5223 
5224 static void mwl8k_configure_filter(struct ieee80211_hw *hw,
5225 				   unsigned int changed_flags,
5226 				   unsigned int *total_flags,
5227 				   u64 multicast)
5228 {
5229 	struct mwl8k_priv *priv = hw->priv;
5230 	struct mwl8k_cmd_pkt *cmd = (void *)(unsigned long)multicast;
5231 
5232 	/*
5233 	 * AP firmware doesn't allow fine-grained control over
5234 	 * the receive filter.
5235 	 */
5236 	if (priv->ap_fw) {
5237 		*total_flags &= FIF_ALLMULTI | FIF_BCN_PRBRESP_PROMISC;
5238 		kfree(cmd);
5239 		return;
5240 	}
5241 
5242 	/*
5243 	 * Enable hardware sniffer mode if FIF_CONTROL or
5244 	 * FIF_OTHER_BSS is requested.
5245 	 */
5246 	if (*total_flags & (FIF_CONTROL | FIF_OTHER_BSS) &&
5247 	    mwl8k_configure_filter_sniffer(hw, changed_flags, total_flags)) {
5248 		kfree(cmd);
5249 		return;
5250 	}
5251 
5252 	/* Clear unsupported feature flags */
5253 	*total_flags &= FIF_ALLMULTI | FIF_BCN_PRBRESP_PROMISC;
5254 
5255 	if (mwl8k_fw_lock(hw)) {
5256 		kfree(cmd);
5257 		return;
5258 	}
5259 
5260 	if (priv->sniffer_enabled) {
5261 		mwl8k_cmd_enable_sniffer(hw, 0);
5262 		priv->sniffer_enabled = false;
5263 	}
5264 
5265 	if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
5266 		if (*total_flags & FIF_BCN_PRBRESP_PROMISC) {
5267 			/*
5268 			 * Disable the BSS filter.
5269 			 */
5270 			mwl8k_cmd_set_pre_scan(hw);
5271 		} else {
5272 			struct mwl8k_vif *mwl8k_vif;
5273 			const u8 *bssid;
5274 
5275 			/*
5276 			 * Enable the BSS filter.
5277 			 *
5278 			 * If there is an active STA interface, use that
5279 			 * interface's BSSID, otherwise use a dummy one
5280 			 * (where the OUI part needs to be nonzero for
5281 			 * the BSSID to be accepted by POST_SCAN).
5282 			 */
5283 			mwl8k_vif = mwl8k_first_vif(priv);
5284 			if (mwl8k_vif != NULL)
5285 				bssid = mwl8k_vif->vif->bss_conf.bssid;
5286 			else
5287 				bssid = "\x01\x00\x00\x00\x00\x00";
5288 
5289 			mwl8k_cmd_set_post_scan(hw, bssid);
5290 		}
5291 	}
5292 
5293 	/*
5294 	 * If FIF_ALLMULTI is being requested, throw away the command
5295 	 * packet that ->prepare_multicast() built and replace it with
5296 	 * a command packet that enables reception of all multicast
5297 	 * packets.
5298 	 */
5299 	if (*total_flags & FIF_ALLMULTI) {
5300 		kfree(cmd);
5301 		cmd = __mwl8k_cmd_mac_multicast_adr(hw, 1, NULL);
5302 	}
5303 
5304 	if (cmd != NULL) {
5305 		mwl8k_post_cmd(hw, cmd);
5306 		kfree(cmd);
5307 	}
5308 
5309 	mwl8k_fw_unlock(hw);
5310 }
5311 
5312 static int mwl8k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
5313 {
5314 	return mwl8k_cmd_set_rts_threshold(hw, value);
5315 }
5316 
5317 static int mwl8k_sta_remove(struct ieee80211_hw *hw,
5318 			    struct ieee80211_vif *vif,
5319 			    struct ieee80211_sta *sta)
5320 {
5321 	struct mwl8k_priv *priv = hw->priv;
5322 
5323 	if (priv->ap_fw)
5324 		return mwl8k_cmd_set_new_stn_del(hw, vif, sta->addr);
5325 	else
5326 		return mwl8k_cmd_update_stadb_del(hw, vif, sta->addr);
5327 }
5328 
5329 static int mwl8k_sta_add(struct ieee80211_hw *hw,
5330 			 struct ieee80211_vif *vif,
5331 			 struct ieee80211_sta *sta)
5332 {
5333 	struct mwl8k_priv *priv = hw->priv;
5334 	int ret;
5335 	int i;
5336 	struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
5337 	struct ieee80211_key_conf *key;
5338 
5339 	if (!priv->ap_fw) {
5340 		ret = mwl8k_cmd_update_stadb_add(hw, vif, sta);
5341 		if (ret >= 0) {
5342 			MWL8K_STA(sta)->peer_id = ret;
5343 			if (sta->ht_cap.ht_supported)
5344 				MWL8K_STA(sta)->is_ampdu_allowed = true;
5345 			ret = 0;
5346 		}
5347 
5348 	} else {
5349 		ret = mwl8k_cmd_set_new_stn_add(hw, vif, sta);
5350 	}
5351 
5352 	for (i = 0; i < NUM_WEP_KEYS; i++) {
5353 		key = IEEE80211_KEY_CONF(mwl8k_vif->wep_key_conf[i].key);
5354 		if (mwl8k_vif->wep_key_conf[i].enabled)
5355 			mwl8k_set_key(hw, SET_KEY, vif, sta, key);
5356 	}
5357 	return ret;
5358 }
5359 
5360 static int mwl8k_conf_tx(struct ieee80211_hw *hw,
5361 			 struct ieee80211_vif *vif, u16 queue,
5362 			 const struct ieee80211_tx_queue_params *params)
5363 {
5364 	struct mwl8k_priv *priv = hw->priv;
5365 	int rc;
5366 
5367 	rc = mwl8k_fw_lock(hw);
5368 	if (!rc) {
5369 		BUG_ON(queue > MWL8K_TX_WMM_QUEUES - 1);
5370 		memcpy(&priv->wmm_params[queue], params, sizeof(*params));
5371 
5372 		if (!priv->wmm_enabled)
5373 			rc = mwl8k_cmd_set_wmm_mode(hw, 1);
5374 
5375 		if (!rc) {
5376 			int q = MWL8K_TX_WMM_QUEUES - 1 - queue;
5377 			rc = mwl8k_cmd_set_edca_params(hw, q,
5378 						       params->cw_min,
5379 						       params->cw_max,
5380 						       params->aifs,
5381 						       params->txop);
5382 		}
5383 
5384 		mwl8k_fw_unlock(hw);
5385 	}
5386 
5387 	return rc;
5388 }
5389 
5390 static int mwl8k_get_stats(struct ieee80211_hw *hw,
5391 			   struct ieee80211_low_level_stats *stats)
5392 {
5393 	return mwl8k_cmd_get_stat(hw, stats);
5394 }
5395 
5396 static int mwl8k_get_survey(struct ieee80211_hw *hw, int idx,
5397 				struct survey_info *survey)
5398 {
5399 	struct mwl8k_priv *priv = hw->priv;
5400 	struct ieee80211_conf *conf = &hw->conf;
5401 	struct ieee80211_supported_band *sband;
5402 
5403 	if (priv->ap_fw) {
5404 		sband = hw->wiphy->bands[NL80211_BAND_2GHZ];
5405 
5406 		if (sband && idx >= sband->n_channels) {
5407 			idx -= sband->n_channels;
5408 			sband = NULL;
5409 		}
5410 
5411 		if (!sband)
5412 			sband = hw->wiphy->bands[NL80211_BAND_5GHZ];
5413 
5414 		if (!sband || idx >= sband->n_channels)
5415 			return -ENOENT;
5416 
5417 		memcpy(survey, &priv->survey[idx], sizeof(*survey));
5418 		survey->channel = &sband->channels[idx];
5419 
5420 		return 0;
5421 	}
5422 
5423 	if (idx != 0)
5424 		return -ENOENT;
5425 
5426 	survey->channel = conf->chandef.chan;
5427 	survey->filled = SURVEY_INFO_NOISE_DBM;
5428 	survey->noise = priv->noise;
5429 
5430 	return 0;
5431 }
5432 
5433 #define MAX_AMPDU_ATTEMPTS 5
5434 
5435 static int
5436 mwl8k_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
5437 		   struct ieee80211_ampdu_params *params)
5438 {
5439 	struct ieee80211_sta *sta = params->sta;
5440 	enum ieee80211_ampdu_mlme_action action = params->action;
5441 	u16 tid = params->tid;
5442 	u16 *ssn = &params->ssn;
5443 	u8 buf_size = params->buf_size;
5444 	int i, rc = 0;
5445 	struct mwl8k_priv *priv = hw->priv;
5446 	struct mwl8k_ampdu_stream *stream;
5447 	u8 *addr = sta->addr, idx;
5448 	struct mwl8k_sta *sta_info = MWL8K_STA(sta);
5449 
5450 	if (!ieee80211_hw_check(hw, AMPDU_AGGREGATION))
5451 		return -ENOTSUPP;
5452 
5453 	spin_lock(&priv->stream_lock);
5454 	stream = mwl8k_lookup_stream(hw, addr, tid);
5455 
5456 	switch (action) {
5457 	case IEEE80211_AMPDU_RX_START:
5458 	case IEEE80211_AMPDU_RX_STOP:
5459 		break;
5460 	case IEEE80211_AMPDU_TX_START:
5461 		/* By the time we get here the hw queues may contain outgoing
5462 		 * packets for this RA/TID that are not part of this BA
5463 		 * session.  The hw will assign sequence numbers to these
5464 		 * packets as they go out.  So if we query the hw for its next
5465 		 * sequence number and use that for the SSN here, it may end up
5466 		 * being wrong, which will lead to sequence number mismatch at
5467 		 * the recipient.  To avoid this, we reset the sequence number
5468 		 * to O for the first MPDU in this BA stream.
5469 		 */
5470 		*ssn = 0;
5471 		if (stream == NULL) {
5472 			/* This means that somebody outside this driver called
5473 			 * ieee80211_start_tx_ba_session.  This is unexpected
5474 			 * because we do our own rate control.  Just warn and
5475 			 * move on.
5476 			 */
5477 			wiphy_warn(hw->wiphy, "Unexpected call to %s.  "
5478 				   "Proceeding anyway.\n", __func__);
5479 			stream = mwl8k_add_stream(hw, sta, tid);
5480 		}
5481 		if (stream == NULL) {
5482 			wiphy_debug(hw->wiphy, "no free AMPDU streams\n");
5483 			rc = -EBUSY;
5484 			break;
5485 		}
5486 		stream->state = AMPDU_STREAM_IN_PROGRESS;
5487 
5488 		/* Release the lock before we do the time consuming stuff */
5489 		spin_unlock(&priv->stream_lock);
5490 		for (i = 0; i < MAX_AMPDU_ATTEMPTS; i++) {
5491 
5492 			/* Check if link is still valid */
5493 			if (!sta_info->is_ampdu_allowed) {
5494 				spin_lock(&priv->stream_lock);
5495 				mwl8k_remove_stream(hw, stream);
5496 				spin_unlock(&priv->stream_lock);
5497 				return -EBUSY;
5498 			}
5499 
5500 			rc = mwl8k_check_ba(hw, stream, vif);
5501 
5502 			/* If HW restart is in progress mwl8k_post_cmd will
5503 			 * return -EBUSY. Avoid retrying mwl8k_check_ba in
5504 			 * such cases
5505 			 */
5506 			if (!rc || rc == -EBUSY)
5507 				break;
5508 			/*
5509 			 * HW queues take time to be flushed, give them
5510 			 * sufficient time
5511 			 */
5512 
5513 			msleep(1000);
5514 		}
5515 		spin_lock(&priv->stream_lock);
5516 		if (rc) {
5517 			wiphy_err(hw->wiphy, "Stream for tid %d busy after %d"
5518 				" attempts\n", tid, MAX_AMPDU_ATTEMPTS);
5519 			mwl8k_remove_stream(hw, stream);
5520 			rc = -EBUSY;
5521 			break;
5522 		}
5523 		rc = IEEE80211_AMPDU_TX_START_IMMEDIATE;
5524 		break;
5525 	case IEEE80211_AMPDU_TX_STOP_CONT:
5526 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
5527 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
5528 		if (stream) {
5529 			if (stream->state == AMPDU_STREAM_ACTIVE) {
5530 				idx = stream->idx;
5531 				spin_unlock(&priv->stream_lock);
5532 				mwl8k_destroy_ba(hw, idx);
5533 				spin_lock(&priv->stream_lock);
5534 			}
5535 			mwl8k_remove_stream(hw, stream);
5536 		}
5537 		ieee80211_stop_tx_ba_cb_irqsafe(vif, addr, tid);
5538 		break;
5539 	case IEEE80211_AMPDU_TX_OPERATIONAL:
5540 		BUG_ON(stream == NULL);
5541 		BUG_ON(stream->state != AMPDU_STREAM_IN_PROGRESS);
5542 		spin_unlock(&priv->stream_lock);
5543 		rc = mwl8k_create_ba(hw, stream, buf_size, vif);
5544 		spin_lock(&priv->stream_lock);
5545 		if (!rc)
5546 			stream->state = AMPDU_STREAM_ACTIVE;
5547 		else {
5548 			idx = stream->idx;
5549 			spin_unlock(&priv->stream_lock);
5550 			mwl8k_destroy_ba(hw, idx);
5551 			spin_lock(&priv->stream_lock);
5552 			wiphy_debug(hw->wiphy,
5553 				"Failed adding stream for sta %pM tid %d\n",
5554 				addr, tid);
5555 			mwl8k_remove_stream(hw, stream);
5556 		}
5557 		break;
5558 
5559 	default:
5560 		rc = -ENOTSUPP;
5561 	}
5562 
5563 	spin_unlock(&priv->stream_lock);
5564 	return rc;
5565 }
5566 
5567 static void mwl8k_sw_scan_start(struct ieee80211_hw *hw,
5568 				struct ieee80211_vif *vif,
5569 				const u8 *mac_addr)
5570 {
5571 	struct mwl8k_priv *priv = hw->priv;
5572 	u8 tmp;
5573 
5574 	if (!priv->ap_fw)
5575 		return;
5576 
5577 	/* clear all stats */
5578 	priv->channel_time = 0;
5579 	ioread32(priv->regs + BBU_RXRDY_CNT_REG);
5580 	ioread32(priv->regs + NOK_CCA_CNT_REG);
5581 	mwl8k_cmd_bbp_reg_access(priv->hw, 0, BBU_AVG_NOISE_VAL, &tmp);
5582 
5583 	priv->sw_scan_start = true;
5584 }
5585 
5586 static void mwl8k_sw_scan_complete(struct ieee80211_hw *hw,
5587 				   struct ieee80211_vif *vif)
5588 {
5589 	struct mwl8k_priv *priv = hw->priv;
5590 	u8 tmp;
5591 
5592 	if (!priv->ap_fw)
5593 		return;
5594 
5595 	priv->sw_scan_start = false;
5596 
5597 	/* clear all stats */
5598 	priv->channel_time = 0;
5599 	ioread32(priv->regs + BBU_RXRDY_CNT_REG);
5600 	ioread32(priv->regs + NOK_CCA_CNT_REG);
5601 	mwl8k_cmd_bbp_reg_access(priv->hw, 0, BBU_AVG_NOISE_VAL, &tmp);
5602 }
5603 
5604 static const struct ieee80211_ops mwl8k_ops = {
5605 	.tx			= mwl8k_tx,
5606 	.start			= mwl8k_start,
5607 	.stop			= mwl8k_stop,
5608 	.add_interface		= mwl8k_add_interface,
5609 	.remove_interface	= mwl8k_remove_interface,
5610 	.config			= mwl8k_config,
5611 	.bss_info_changed	= mwl8k_bss_info_changed,
5612 	.prepare_multicast	= mwl8k_prepare_multicast,
5613 	.configure_filter	= mwl8k_configure_filter,
5614 	.set_key                = mwl8k_set_key,
5615 	.set_rts_threshold	= mwl8k_set_rts_threshold,
5616 	.sta_add		= mwl8k_sta_add,
5617 	.sta_remove		= mwl8k_sta_remove,
5618 	.conf_tx		= mwl8k_conf_tx,
5619 	.get_stats		= mwl8k_get_stats,
5620 	.get_survey		= mwl8k_get_survey,
5621 	.ampdu_action		= mwl8k_ampdu_action,
5622 	.sw_scan_start		= mwl8k_sw_scan_start,
5623 	.sw_scan_complete	= mwl8k_sw_scan_complete,
5624 };
5625 
5626 static void mwl8k_finalize_join_worker(struct work_struct *work)
5627 {
5628 	struct mwl8k_priv *priv =
5629 		container_of(work, struct mwl8k_priv, finalize_join_worker);
5630 	struct sk_buff *skb = priv->beacon_skb;
5631 	struct ieee80211_mgmt *mgmt = (void *)skb->data;
5632 	int len = skb->len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
5633 	const u8 *tim = cfg80211_find_ie(WLAN_EID_TIM,
5634 					 mgmt->u.beacon.variable, len);
5635 	int dtim_period = 1;
5636 
5637 	if (tim && tim[1] >= 2)
5638 		dtim_period = tim[3];
5639 
5640 	mwl8k_cmd_finalize_join(priv->hw, skb->data, skb->len, dtim_period);
5641 
5642 	dev_kfree_skb(skb);
5643 	priv->beacon_skb = NULL;
5644 }
5645 
5646 enum {
5647 	MWL8363 = 0,
5648 	MWL8687,
5649 	MWL8366,
5650 	MWL8764,
5651 };
5652 
5653 #define MWL8K_8366_AP_FW_API 3
5654 #define _MWL8K_8366_AP_FW(api) "mwl8k/fmimage_8366_ap-" #api ".fw"
5655 #define MWL8K_8366_AP_FW(api) _MWL8K_8366_AP_FW(api)
5656 
5657 #define MWL8K_8764_AP_FW_API 1
5658 #define _MWL8K_8764_AP_FW(api) "mwl8k/fmimage_8764_ap-" #api ".fw"
5659 #define MWL8K_8764_AP_FW(api) _MWL8K_8764_AP_FW(api)
5660 
5661 static struct mwl8k_device_info mwl8k_info_tbl[] = {
5662 	[MWL8363] = {
5663 		.part_name	= "88w8363",
5664 		.helper_image	= "mwl8k/helper_8363.fw",
5665 		.fw_image_sta	= "mwl8k/fmimage_8363.fw",
5666 	},
5667 	[MWL8687] = {
5668 		.part_name	= "88w8687",
5669 		.helper_image	= "mwl8k/helper_8687.fw",
5670 		.fw_image_sta	= "mwl8k/fmimage_8687.fw",
5671 	},
5672 	[MWL8366] = {
5673 		.part_name	= "88w8366",
5674 		.helper_image	= "mwl8k/helper_8366.fw",
5675 		.fw_image_sta	= "mwl8k/fmimage_8366.fw",
5676 		.fw_image_ap	= MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API),
5677 		.fw_api_ap	= MWL8K_8366_AP_FW_API,
5678 		.ap_rxd_ops	= &rxd_ap_ops,
5679 	},
5680 	[MWL8764] = {
5681 		.part_name	= "88w8764",
5682 		.fw_image_ap	= MWL8K_8764_AP_FW(MWL8K_8764_AP_FW_API),
5683 		.fw_api_ap	= MWL8K_8764_AP_FW_API,
5684 		.ap_rxd_ops	= &rxd_ap_ops,
5685 	},
5686 };
5687 
5688 MODULE_FIRMWARE("mwl8k/helper_8363.fw");
5689 MODULE_FIRMWARE("mwl8k/fmimage_8363.fw");
5690 MODULE_FIRMWARE("mwl8k/helper_8687.fw");
5691 MODULE_FIRMWARE("mwl8k/fmimage_8687.fw");
5692 MODULE_FIRMWARE("mwl8k/helper_8366.fw");
5693 MODULE_FIRMWARE("mwl8k/fmimage_8366.fw");
5694 MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
5695 
5696 static const struct pci_device_id mwl8k_pci_id_table[] = {
5697 	{ PCI_VDEVICE(MARVELL, 0x2a0a), .driver_data = MWL8363, },
5698 	{ PCI_VDEVICE(MARVELL, 0x2a0c), .driver_data = MWL8363, },
5699 	{ PCI_VDEVICE(MARVELL, 0x2a24), .driver_data = MWL8363, },
5700 	{ PCI_VDEVICE(MARVELL, 0x2a2b), .driver_data = MWL8687, },
5701 	{ PCI_VDEVICE(MARVELL, 0x2a30), .driver_data = MWL8687, },
5702 	{ PCI_VDEVICE(MARVELL, 0x2a40), .driver_data = MWL8366, },
5703 	{ PCI_VDEVICE(MARVELL, 0x2a41), .driver_data = MWL8366, },
5704 	{ PCI_VDEVICE(MARVELL, 0x2a42), .driver_data = MWL8366, },
5705 	{ PCI_VDEVICE(MARVELL, 0x2a43), .driver_data = MWL8366, },
5706 	{ PCI_VDEVICE(MARVELL, 0x2b36), .driver_data = MWL8764, },
5707 	{ },
5708 };
5709 MODULE_DEVICE_TABLE(pci, mwl8k_pci_id_table);
5710 
5711 static int mwl8k_request_alt_fw(struct mwl8k_priv *priv)
5712 {
5713 	int rc;
5714 	printk(KERN_ERR "%s: Error requesting preferred fw %s.\n"
5715 	       "Trying alternative firmware %s\n", pci_name(priv->pdev),
5716 	       priv->fw_pref, priv->fw_alt);
5717 	rc = mwl8k_request_fw(priv, priv->fw_alt, &priv->fw_ucode, true);
5718 	if (rc) {
5719 		printk(KERN_ERR "%s: Error requesting alt fw %s\n",
5720 		       pci_name(priv->pdev), priv->fw_alt);
5721 		return rc;
5722 	}
5723 	return 0;
5724 }
5725 
5726 static int mwl8k_firmware_load_success(struct mwl8k_priv *priv);
5727 static void mwl8k_fw_state_machine(const struct firmware *fw, void *context)
5728 {
5729 	struct mwl8k_priv *priv = context;
5730 	struct mwl8k_device_info *di = priv->device_info;
5731 	int rc;
5732 
5733 	switch (priv->fw_state) {
5734 	case FW_STATE_INIT:
5735 		if (!fw) {
5736 			printk(KERN_ERR "%s: Error requesting helper fw %s\n",
5737 			       pci_name(priv->pdev), di->helper_image);
5738 			goto fail;
5739 		}
5740 		priv->fw_helper = fw;
5741 		rc = mwl8k_request_fw(priv, priv->fw_pref, &priv->fw_ucode,
5742 				      true);
5743 		if (rc && priv->fw_alt) {
5744 			rc = mwl8k_request_alt_fw(priv);
5745 			if (rc)
5746 				goto fail;
5747 			priv->fw_state = FW_STATE_LOADING_ALT;
5748 		} else if (rc)
5749 			goto fail;
5750 		else
5751 			priv->fw_state = FW_STATE_LOADING_PREF;
5752 		break;
5753 
5754 	case FW_STATE_LOADING_PREF:
5755 		if (!fw) {
5756 			if (priv->fw_alt) {
5757 				rc = mwl8k_request_alt_fw(priv);
5758 				if (rc)
5759 					goto fail;
5760 				priv->fw_state = FW_STATE_LOADING_ALT;
5761 			} else
5762 				goto fail;
5763 		} else {
5764 			priv->fw_ucode = fw;
5765 			rc = mwl8k_firmware_load_success(priv);
5766 			if (rc)
5767 				goto fail;
5768 			else
5769 				complete(&priv->firmware_loading_complete);
5770 		}
5771 		break;
5772 
5773 	case FW_STATE_LOADING_ALT:
5774 		if (!fw) {
5775 			printk(KERN_ERR "%s: Error requesting alt fw %s\n",
5776 			       pci_name(priv->pdev), di->helper_image);
5777 			goto fail;
5778 		}
5779 		priv->fw_ucode = fw;
5780 		rc = mwl8k_firmware_load_success(priv);
5781 		if (rc)
5782 			goto fail;
5783 		else
5784 			complete(&priv->firmware_loading_complete);
5785 		break;
5786 
5787 	default:
5788 		printk(KERN_ERR "%s: Unexpected firmware loading state: %d\n",
5789 		       MWL8K_NAME, priv->fw_state);
5790 		BUG_ON(1);
5791 	}
5792 
5793 	return;
5794 
5795 fail:
5796 	priv->fw_state = FW_STATE_ERROR;
5797 	complete(&priv->firmware_loading_complete);
5798 	device_release_driver(&priv->pdev->dev);
5799 	mwl8k_release_firmware(priv);
5800 }
5801 
5802 #define MAX_RESTART_ATTEMPTS 1
5803 static int mwl8k_init_firmware(struct ieee80211_hw *hw, char *fw_image,
5804 			       bool nowait)
5805 {
5806 	struct mwl8k_priv *priv = hw->priv;
5807 	int rc;
5808 	int count = MAX_RESTART_ATTEMPTS;
5809 
5810 retry:
5811 	/* Reset firmware and hardware */
5812 	mwl8k_hw_reset(priv);
5813 
5814 	/* Ask userland hotplug daemon for the device firmware */
5815 	rc = mwl8k_request_firmware(priv, fw_image, nowait);
5816 	if (rc) {
5817 		wiphy_err(hw->wiphy, "Firmware files not found\n");
5818 		return rc;
5819 	}
5820 
5821 	if (nowait)
5822 		return rc;
5823 
5824 	/* Load firmware into hardware */
5825 	rc = mwl8k_load_firmware(hw);
5826 	if (rc)
5827 		wiphy_err(hw->wiphy, "Cannot start firmware\n");
5828 
5829 	/* Reclaim memory once firmware is successfully loaded */
5830 	mwl8k_release_firmware(priv);
5831 
5832 	if (rc && count) {
5833 		/* FW did not start successfully;
5834 		 * lets try one more time
5835 		 */
5836 		count--;
5837 		wiphy_err(hw->wiphy, "Trying to reload the firmware again\n");
5838 		msleep(20);
5839 		goto retry;
5840 	}
5841 
5842 	return rc;
5843 }
5844 
5845 static int mwl8k_init_txqs(struct ieee80211_hw *hw)
5846 {
5847 	struct mwl8k_priv *priv = hw->priv;
5848 	int rc = 0;
5849 	int i;
5850 
5851 	for (i = 0; i < mwl8k_tx_queues(priv); i++) {
5852 		rc = mwl8k_txq_init(hw, i);
5853 		if (rc)
5854 			break;
5855 		if (priv->ap_fw)
5856 			iowrite32(priv->txq[i].txd_dma,
5857 				  priv->sram + priv->txq_offset[i]);
5858 	}
5859 	return rc;
5860 }
5861 
5862 /* initialize hw after successfully loading a firmware image */
5863 static int mwl8k_probe_hw(struct ieee80211_hw *hw)
5864 {
5865 	struct mwl8k_priv *priv = hw->priv;
5866 	int rc = 0;
5867 	int i;
5868 
5869 	if (priv->ap_fw) {
5870 		priv->rxd_ops = priv->device_info->ap_rxd_ops;
5871 		if (priv->rxd_ops == NULL) {
5872 			wiphy_err(hw->wiphy,
5873 				  "Driver does not have AP firmware image support for this hardware\n");
5874 			rc = -ENOENT;
5875 			goto err_stop_firmware;
5876 		}
5877 	} else {
5878 		priv->rxd_ops = &rxd_sta_ops;
5879 	}
5880 
5881 	priv->sniffer_enabled = false;
5882 	priv->wmm_enabled = false;
5883 	priv->pending_tx_pkts = 0;
5884 	atomic_set(&priv->watchdog_event_pending, 0);
5885 
5886 	rc = mwl8k_rxq_init(hw, 0);
5887 	if (rc)
5888 		goto err_stop_firmware;
5889 	rxq_refill(hw, 0, INT_MAX);
5890 
5891 	/* For the sta firmware, we need to know the dma addresses of tx queues
5892 	 * before sending MWL8K_CMD_GET_HW_SPEC.  So we must initialize them
5893 	 * prior to issuing this command.  But for the AP case, we learn the
5894 	 * total number of queues from the result CMD_GET_HW_SPEC, so for this
5895 	 * case we must initialize the tx queues after.
5896 	 */
5897 	priv->num_ampdu_queues = 0;
5898 	if (!priv->ap_fw) {
5899 		rc = mwl8k_init_txqs(hw);
5900 		if (rc)
5901 			goto err_free_queues;
5902 	}
5903 
5904 	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
5905 	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
5906 	iowrite32(MWL8K_A2H_INT_TX_DONE|MWL8K_A2H_INT_RX_READY|
5907 		  MWL8K_A2H_INT_BA_WATCHDOG,
5908 		  priv->regs + MWL8K_HIU_A2H_INTERRUPT_CLEAR_SEL);
5909 	iowrite32(MWL8K_A2H_INT_OPC_DONE,
5910 		  priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
5911 
5912 	rc = request_irq(priv->pdev->irq, mwl8k_interrupt,
5913 			 IRQF_SHARED, MWL8K_NAME, hw);
5914 	if (rc) {
5915 		wiphy_err(hw->wiphy, "failed to register IRQ handler\n");
5916 		goto err_free_queues;
5917 	}
5918 
5919 	/*
5920 	 * When hw restart is requested,
5921 	 * mac80211 will take care of clearing
5922 	 * the ampdu streams, so do not clear
5923 	 * the ampdu state here
5924 	 */
5925 	if (!priv->hw_restart_in_progress)
5926 		memset(priv->ampdu, 0, sizeof(priv->ampdu));
5927 
5928 	/*
5929 	 * Temporarily enable interrupts.  Initial firmware host
5930 	 * commands use interrupts and avoid polling.  Disable
5931 	 * interrupts when done.
5932 	 */
5933 	iowrite32(MWL8K_A2H_EVENTS, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
5934 
5935 	/* Get config data, mac addrs etc */
5936 	if (priv->ap_fw) {
5937 		rc = mwl8k_cmd_get_hw_spec_ap(hw);
5938 		if (!rc)
5939 			rc = mwl8k_init_txqs(hw);
5940 		if (!rc)
5941 			rc = mwl8k_cmd_set_hw_spec(hw);
5942 	} else {
5943 		rc = mwl8k_cmd_get_hw_spec_sta(hw);
5944 	}
5945 	if (rc) {
5946 		wiphy_err(hw->wiphy, "Cannot initialise firmware\n");
5947 		goto err_free_irq;
5948 	}
5949 
5950 	/* Turn radio off */
5951 	rc = mwl8k_cmd_radio_disable(hw);
5952 	if (rc) {
5953 		wiphy_err(hw->wiphy, "Cannot disable\n");
5954 		goto err_free_irq;
5955 	}
5956 
5957 	/* Clear MAC address */
5958 	rc = mwl8k_cmd_set_mac_addr(hw, NULL, "\x00\x00\x00\x00\x00\x00");
5959 	if (rc) {
5960 		wiphy_err(hw->wiphy, "Cannot clear MAC address\n");
5961 		goto err_free_irq;
5962 	}
5963 
5964 	/* Configure Antennas */
5965 	rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_RX, 0x3);
5966 	if (rc)
5967 		wiphy_warn(hw->wiphy, "failed to set # of RX antennas");
5968 	rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_TX, 0x7);
5969 	if (rc)
5970 		wiphy_warn(hw->wiphy, "failed to set # of TX antennas");
5971 
5972 
5973 	/* Disable interrupts */
5974 	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
5975 	free_irq(priv->pdev->irq, hw);
5976 
5977 	wiphy_info(hw->wiphy, "%s v%d, %pm, %s firmware %u.%u.%u.%u\n",
5978 		   priv->device_info->part_name,
5979 		   priv->hw_rev, hw->wiphy->perm_addr,
5980 		   priv->ap_fw ? "AP" : "STA",
5981 		   (priv->fw_rev >> 24) & 0xff, (priv->fw_rev >> 16) & 0xff,
5982 		   (priv->fw_rev >> 8) & 0xff, priv->fw_rev & 0xff);
5983 
5984 	return 0;
5985 
5986 err_free_irq:
5987 	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
5988 	free_irq(priv->pdev->irq, hw);
5989 
5990 err_free_queues:
5991 	for (i = 0; i < mwl8k_tx_queues(priv); i++)
5992 		mwl8k_txq_deinit(hw, i);
5993 	mwl8k_rxq_deinit(hw, 0);
5994 
5995 err_stop_firmware:
5996 	mwl8k_hw_reset(priv);
5997 
5998 	return rc;
5999 }
6000 
6001 /*
6002  * invoke mwl8k_reload_firmware to change the firmware image after the device
6003  * has already been registered
6004  */
6005 static int mwl8k_reload_firmware(struct ieee80211_hw *hw, char *fw_image)
6006 {
6007 	int i, rc = 0;
6008 	struct mwl8k_priv *priv = hw->priv;
6009 	struct mwl8k_vif *vif, *tmp_vif;
6010 
6011 	mwl8k_stop(hw);
6012 	mwl8k_rxq_deinit(hw, 0);
6013 
6014 	/*
6015 	 * All the existing interfaces are re-added by the ieee80211_reconfig;
6016 	 * which means driver should remove existing interfaces before calling
6017 	 * ieee80211_restart_hw
6018 	 */
6019 	if (priv->hw_restart_in_progress)
6020 		list_for_each_entry_safe(vif, tmp_vif, &priv->vif_list, list)
6021 			mwl8k_remove_vif(priv, vif);
6022 
6023 	for (i = 0; i < mwl8k_tx_queues(priv); i++)
6024 		mwl8k_txq_deinit(hw, i);
6025 
6026 	rc = mwl8k_init_firmware(hw, fw_image, false);
6027 	if (rc)
6028 		goto fail;
6029 
6030 	rc = mwl8k_probe_hw(hw);
6031 	if (rc)
6032 		goto fail;
6033 
6034 	if (priv->hw_restart_in_progress)
6035 		return rc;
6036 
6037 	rc = mwl8k_start(hw);
6038 	if (rc)
6039 		goto fail;
6040 
6041 	rc = mwl8k_config(hw, ~0);
6042 	if (rc)
6043 		goto fail;
6044 
6045 	for (i = 0; i < MWL8K_TX_WMM_QUEUES; i++) {
6046 		rc = mwl8k_conf_tx(hw, NULL, i, &priv->wmm_params[i]);
6047 		if (rc)
6048 			goto fail;
6049 	}
6050 
6051 	return rc;
6052 
6053 fail:
6054 	printk(KERN_WARNING "mwl8k: Failed to reload firmware image.\n");
6055 	return rc;
6056 }
6057 
6058 static const struct ieee80211_iface_limit ap_if_limits[] = {
6059 	{ .max = 8,	.types = BIT(NL80211_IFTYPE_AP) },
6060 	{ .max = 1,	.types = BIT(NL80211_IFTYPE_STATION) },
6061 };
6062 
6063 static const struct ieee80211_iface_combination ap_if_comb = {
6064 	.limits = ap_if_limits,
6065 	.n_limits = ARRAY_SIZE(ap_if_limits),
6066 	.max_interfaces = 8,
6067 	.num_different_channels = 1,
6068 };
6069 
6070 
6071 static int mwl8k_firmware_load_success(struct mwl8k_priv *priv)
6072 {
6073 	struct ieee80211_hw *hw = priv->hw;
6074 	int i, rc;
6075 
6076 	rc = mwl8k_load_firmware(hw);
6077 	mwl8k_release_firmware(priv);
6078 	if (rc) {
6079 		wiphy_err(hw->wiphy, "Cannot start firmware\n");
6080 		return rc;
6081 	}
6082 
6083 	/*
6084 	 * Extra headroom is the size of the required DMA header
6085 	 * minus the size of the smallest 802.11 frame (CTS frame).
6086 	 */
6087 	hw->extra_tx_headroom =
6088 		sizeof(struct mwl8k_dma_data) - sizeof(struct ieee80211_cts);
6089 
6090 	hw->extra_tx_headroom -= priv->ap_fw ? REDUCED_TX_HEADROOM : 0;
6091 
6092 	hw->queues = MWL8K_TX_WMM_QUEUES;
6093 
6094 	/* Set rssi values to dBm */
6095 	ieee80211_hw_set(hw, SIGNAL_DBM);
6096 	ieee80211_hw_set(hw, HAS_RATE_CONTROL);
6097 
6098 	/*
6099 	 * Ask mac80211 to not to trigger PS mode
6100 	 * based on PM bit of incoming frames.
6101 	 */
6102 	if (priv->ap_fw)
6103 		ieee80211_hw_set(hw, AP_LINK_PS);
6104 
6105 	hw->vif_data_size = sizeof(struct mwl8k_vif);
6106 	hw->sta_data_size = sizeof(struct mwl8k_sta);
6107 
6108 	priv->macids_used = 0;
6109 	INIT_LIST_HEAD(&priv->vif_list);
6110 
6111 	/* Set default radio state and preamble */
6112 	priv->radio_on = false;
6113 	priv->radio_short_preamble = false;
6114 
6115 	/* Finalize join worker */
6116 	INIT_WORK(&priv->finalize_join_worker, mwl8k_finalize_join_worker);
6117 	/* Handle watchdog ba events */
6118 	INIT_WORK(&priv->watchdog_ba_handle, mwl8k_watchdog_ba_events);
6119 	/* To reload the firmware if it crashes */
6120 	INIT_WORK(&priv->fw_reload, mwl8k_hw_restart_work);
6121 
6122 	/* TX reclaim and RX tasklets.  */
6123 	tasklet_init(&priv->poll_tx_task, mwl8k_tx_poll, (unsigned long)hw);
6124 	tasklet_disable(&priv->poll_tx_task);
6125 	tasklet_init(&priv->poll_rx_task, mwl8k_rx_poll, (unsigned long)hw);
6126 	tasklet_disable(&priv->poll_rx_task);
6127 
6128 	/* Power management cookie */
6129 	priv->cookie = pci_alloc_consistent(priv->pdev, 4, &priv->cookie_dma);
6130 	if (priv->cookie == NULL)
6131 		return -ENOMEM;
6132 
6133 	mutex_init(&priv->fw_mutex);
6134 	priv->fw_mutex_owner = NULL;
6135 	priv->fw_mutex_depth = 0;
6136 	priv->hostcmd_wait = NULL;
6137 
6138 	spin_lock_init(&priv->tx_lock);
6139 
6140 	spin_lock_init(&priv->stream_lock);
6141 
6142 	priv->tx_wait = NULL;
6143 
6144 	rc = mwl8k_probe_hw(hw);
6145 	if (rc)
6146 		goto err_free_cookie;
6147 
6148 	hw->wiphy->interface_modes = 0;
6149 
6150 	if (priv->ap_macids_supported || priv->device_info->fw_image_ap) {
6151 		hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP);
6152 		hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_STATION);
6153 		hw->wiphy->iface_combinations = &ap_if_comb;
6154 		hw->wiphy->n_iface_combinations = 1;
6155 	}
6156 
6157 	if (priv->sta_macids_supported || priv->device_info->fw_image_sta)
6158 		hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_STATION);
6159 
6160 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
6161 
6162 	rc = ieee80211_register_hw(hw);
6163 	if (rc) {
6164 		wiphy_err(hw->wiphy, "Cannot register device\n");
6165 		goto err_unprobe_hw;
6166 	}
6167 
6168 	return 0;
6169 
6170 err_unprobe_hw:
6171 	for (i = 0; i < mwl8k_tx_queues(priv); i++)
6172 		mwl8k_txq_deinit(hw, i);
6173 	mwl8k_rxq_deinit(hw, 0);
6174 
6175 err_free_cookie:
6176 	if (priv->cookie != NULL)
6177 		pci_free_consistent(priv->pdev, 4,
6178 				priv->cookie, priv->cookie_dma);
6179 
6180 	return rc;
6181 }
6182 static int mwl8k_probe(struct pci_dev *pdev,
6183 				 const struct pci_device_id *id)
6184 {
6185 	static int printed_version;
6186 	struct ieee80211_hw *hw;
6187 	struct mwl8k_priv *priv;
6188 	struct mwl8k_device_info *di;
6189 	int rc;
6190 
6191 	if (!printed_version) {
6192 		printk(KERN_INFO "%s version %s\n", MWL8K_DESC, MWL8K_VERSION);
6193 		printed_version = 1;
6194 	}
6195 
6196 
6197 	rc = pci_enable_device(pdev);
6198 	if (rc) {
6199 		printk(KERN_ERR "%s: Cannot enable new PCI device\n",
6200 		       MWL8K_NAME);
6201 		return rc;
6202 	}
6203 
6204 	rc = pci_request_regions(pdev, MWL8K_NAME);
6205 	if (rc) {
6206 		printk(KERN_ERR "%s: Cannot obtain PCI resources\n",
6207 		       MWL8K_NAME);
6208 		goto err_disable_device;
6209 	}
6210 
6211 	pci_set_master(pdev);
6212 
6213 
6214 	hw = ieee80211_alloc_hw(sizeof(*priv), &mwl8k_ops);
6215 	if (hw == NULL) {
6216 		printk(KERN_ERR "%s: ieee80211 alloc failed\n", MWL8K_NAME);
6217 		rc = -ENOMEM;
6218 		goto err_free_reg;
6219 	}
6220 
6221 	SET_IEEE80211_DEV(hw, &pdev->dev);
6222 	pci_set_drvdata(pdev, hw);
6223 
6224 	priv = hw->priv;
6225 	priv->hw = hw;
6226 	priv->pdev = pdev;
6227 	priv->device_info = &mwl8k_info_tbl[id->driver_data];
6228 
6229 	if (id->driver_data == MWL8764)
6230 		priv->is_8764 = true;
6231 
6232 	priv->sram = pci_iomap(pdev, 0, 0x10000);
6233 	if (priv->sram == NULL) {
6234 		wiphy_err(hw->wiphy, "Cannot map device SRAM\n");
6235 		rc = -EIO;
6236 		goto err_iounmap;
6237 	}
6238 
6239 	/*
6240 	 * If BAR0 is a 32 bit BAR, the register BAR will be BAR1.
6241 	 * If BAR0 is a 64 bit BAR, the register BAR will be BAR2.
6242 	 */
6243 	priv->regs = pci_iomap(pdev, 1, 0x10000);
6244 	if (priv->regs == NULL) {
6245 		priv->regs = pci_iomap(pdev, 2, 0x10000);
6246 		if (priv->regs == NULL) {
6247 			wiphy_err(hw->wiphy, "Cannot map device registers\n");
6248 			rc = -EIO;
6249 			goto err_iounmap;
6250 		}
6251 	}
6252 
6253 	/*
6254 	 * Choose the initial fw image depending on user input.  If a second
6255 	 * image is available, make it the alternative image that will be
6256 	 * loaded if the first one fails.
6257 	 */
6258 	init_completion(&priv->firmware_loading_complete);
6259 	di = priv->device_info;
6260 	if (ap_mode_default && di->fw_image_ap) {
6261 		priv->fw_pref = di->fw_image_ap;
6262 		priv->fw_alt = di->fw_image_sta;
6263 	} else if (!ap_mode_default && di->fw_image_sta) {
6264 		priv->fw_pref = di->fw_image_sta;
6265 		priv->fw_alt = di->fw_image_ap;
6266 	} else if (ap_mode_default && !di->fw_image_ap && di->fw_image_sta) {
6267 		printk(KERN_WARNING "AP fw is unavailable.  Using STA fw.");
6268 		priv->fw_pref = di->fw_image_sta;
6269 	} else if (!ap_mode_default && !di->fw_image_sta && di->fw_image_ap) {
6270 		printk(KERN_WARNING "STA fw is unavailable.  Using AP fw.");
6271 		priv->fw_pref = di->fw_image_ap;
6272 	}
6273 	rc = mwl8k_init_firmware(hw, priv->fw_pref, true);
6274 	if (rc)
6275 		goto err_stop_firmware;
6276 
6277 	priv->hw_restart_in_progress = false;
6278 
6279 	priv->running_bsses = 0;
6280 
6281 	return rc;
6282 
6283 err_stop_firmware:
6284 	mwl8k_hw_reset(priv);
6285 
6286 err_iounmap:
6287 	if (priv->regs != NULL)
6288 		pci_iounmap(pdev, priv->regs);
6289 
6290 	if (priv->sram != NULL)
6291 		pci_iounmap(pdev, priv->sram);
6292 
6293 	ieee80211_free_hw(hw);
6294 
6295 err_free_reg:
6296 	pci_release_regions(pdev);
6297 
6298 err_disable_device:
6299 	pci_disable_device(pdev);
6300 
6301 	return rc;
6302 }
6303 
6304 static void mwl8k_remove(struct pci_dev *pdev)
6305 {
6306 	struct ieee80211_hw *hw = pci_get_drvdata(pdev);
6307 	struct mwl8k_priv *priv;
6308 	int i;
6309 
6310 	if (hw == NULL)
6311 		return;
6312 	priv = hw->priv;
6313 
6314 	wait_for_completion(&priv->firmware_loading_complete);
6315 
6316 	if (priv->fw_state == FW_STATE_ERROR) {
6317 		mwl8k_hw_reset(priv);
6318 		goto unmap;
6319 	}
6320 
6321 	ieee80211_stop_queues(hw);
6322 
6323 	ieee80211_unregister_hw(hw);
6324 
6325 	/* Remove TX reclaim and RX tasklets.  */
6326 	tasklet_kill(&priv->poll_tx_task);
6327 	tasklet_kill(&priv->poll_rx_task);
6328 
6329 	/* Stop hardware */
6330 	mwl8k_hw_reset(priv);
6331 
6332 	/* Return all skbs to mac80211 */
6333 	for (i = 0; i < mwl8k_tx_queues(priv); i++)
6334 		mwl8k_txq_reclaim(hw, i, INT_MAX, 1);
6335 
6336 	for (i = 0; i < mwl8k_tx_queues(priv); i++)
6337 		mwl8k_txq_deinit(hw, i);
6338 
6339 	mwl8k_rxq_deinit(hw, 0);
6340 
6341 	pci_free_consistent(priv->pdev, 4, priv->cookie, priv->cookie_dma);
6342 
6343 unmap:
6344 	pci_iounmap(pdev, priv->regs);
6345 	pci_iounmap(pdev, priv->sram);
6346 	ieee80211_free_hw(hw);
6347 	pci_release_regions(pdev);
6348 	pci_disable_device(pdev);
6349 }
6350 
6351 static struct pci_driver mwl8k_driver = {
6352 	.name		= MWL8K_NAME,
6353 	.id_table	= mwl8k_pci_id_table,
6354 	.probe		= mwl8k_probe,
6355 	.remove		= mwl8k_remove,
6356 };
6357 
6358 module_pci_driver(mwl8k_driver);
6359 
6360 MODULE_DESCRIPTION(MWL8K_DESC);
6361 MODULE_VERSION(MWL8K_VERSION);
6362 MODULE_AUTHOR("Lennert Buytenhek <buytenh@marvell.com>");
6363 MODULE_LICENSE("GPL");
6364