1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* ZD1211 USB-WLAN driver for Linux
3  *
4  * Copyright (C) 2005-2007 Ulrich Kunitz <kune@deine-taler.de>
5  * Copyright (C) 2006-2007 Daniel Drake <dsd@gentoo.org>
6  * Copyright (C) 2006-2007 Michael Wu <flamingice@sourmilk.net>
7  * Copyright (C) 2007-2008 Luis R. Rodriguez <mcgrof@winlab.rutgers.edu>
8  */
9 
10 #include <linux/netdevice.h>
11 #include <linux/etherdevice.h>
12 #include <linux/slab.h>
13 #include <linux/usb.h>
14 #include <linux/jiffies.h>
15 #include <net/ieee80211_radiotap.h>
16 
17 #include "zd_def.h"
18 #include "zd_chip.h"
19 #include "zd_mac.h"
20 #include "zd_rf.h"
21 
22 struct zd_reg_alpha2_map {
23 	u32 reg;
24 	char alpha2[2];
25 };
26 
27 static struct zd_reg_alpha2_map reg_alpha2_map[] = {
28 	{ ZD_REGDOMAIN_FCC, "US" },
29 	{ ZD_REGDOMAIN_IC, "CA" },
30 	{ ZD_REGDOMAIN_ETSI, "DE" }, /* Generic ETSI, use most restrictive */
31 	{ ZD_REGDOMAIN_JAPAN, "JP" },
32 	{ ZD_REGDOMAIN_JAPAN_2, "JP" },
33 	{ ZD_REGDOMAIN_JAPAN_3, "JP" },
34 	{ ZD_REGDOMAIN_SPAIN, "ES" },
35 	{ ZD_REGDOMAIN_FRANCE, "FR" },
36 };
37 
38 /* This table contains the hardware specific values for the modulation rates. */
39 static const struct ieee80211_rate zd_rates[] = {
40 	{ .bitrate = 10,
41 	  .hw_value = ZD_CCK_RATE_1M, },
42 	{ .bitrate = 20,
43 	  .hw_value = ZD_CCK_RATE_2M,
44 	  .hw_value_short = ZD_CCK_RATE_2M | ZD_CCK_PREA_SHORT,
45 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
46 	{ .bitrate = 55,
47 	  .hw_value = ZD_CCK_RATE_5_5M,
48 	  .hw_value_short = ZD_CCK_RATE_5_5M | ZD_CCK_PREA_SHORT,
49 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
50 	{ .bitrate = 110,
51 	  .hw_value = ZD_CCK_RATE_11M,
52 	  .hw_value_short = ZD_CCK_RATE_11M | ZD_CCK_PREA_SHORT,
53 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
54 	{ .bitrate = 60,
55 	  .hw_value = ZD_OFDM_RATE_6M,
56 	  .flags = 0 },
57 	{ .bitrate = 90,
58 	  .hw_value = ZD_OFDM_RATE_9M,
59 	  .flags = 0 },
60 	{ .bitrate = 120,
61 	  .hw_value = ZD_OFDM_RATE_12M,
62 	  .flags = 0 },
63 	{ .bitrate = 180,
64 	  .hw_value = ZD_OFDM_RATE_18M,
65 	  .flags = 0 },
66 	{ .bitrate = 240,
67 	  .hw_value = ZD_OFDM_RATE_24M,
68 	  .flags = 0 },
69 	{ .bitrate = 360,
70 	  .hw_value = ZD_OFDM_RATE_36M,
71 	  .flags = 0 },
72 	{ .bitrate = 480,
73 	  .hw_value = ZD_OFDM_RATE_48M,
74 	  .flags = 0 },
75 	{ .bitrate = 540,
76 	  .hw_value = ZD_OFDM_RATE_54M,
77 	  .flags = 0 },
78 };
79 
80 /*
81  * Zydas retry rates table. Each line is listed in the same order as
82  * in zd_rates[] and contains all the rate used when a packet is sent
83  * starting with a given rates. Let's consider an example :
84  *
85  * "11 Mbits : 4, 3, 2, 1, 0" means :
86  * - packet is sent using 4 different rates
87  * - 1st rate is index 3 (ie 11 Mbits)
88  * - 2nd rate is index 2 (ie 5.5 Mbits)
89  * - 3rd rate is index 1 (ie 2 Mbits)
90  * - 4th rate is index 0 (ie 1 Mbits)
91  */
92 
93 static const struct tx_retry_rate zd_retry_rates[] = {
94 	{ /*  1 Mbits */	1, { 0 }},
95 	{ /*  2 Mbits */	2, { 1,  0 }},
96 	{ /*  5.5 Mbits */	3, { 2,  1, 0 }},
97 	{ /* 11 Mbits */	4, { 3,  2, 1, 0 }},
98 	{ /*  6 Mbits */	5, { 4,  3, 2, 1, 0 }},
99 	{ /*  9 Mbits */	6, { 5,  4, 3, 2, 1, 0}},
100 	{ /* 12 Mbits */	5, { 6,  3, 2, 1, 0 }},
101 	{ /* 18 Mbits */	6, { 7,  6, 3, 2, 1, 0 }},
102 	{ /* 24 Mbits */	6, { 8,  6, 3, 2, 1, 0 }},
103 	{ /* 36 Mbits */	7, { 9,  8, 6, 3, 2, 1, 0 }},
104 	{ /* 48 Mbits */	8, {10,  9, 8, 6, 3, 2, 1, 0 }},
105 	{ /* 54 Mbits */	9, {11, 10, 9, 8, 6, 3, 2, 1, 0 }}
106 };
107 
108 static const struct ieee80211_channel zd_channels[] = {
109 	{ .center_freq = 2412, .hw_value = 1 },
110 	{ .center_freq = 2417, .hw_value = 2 },
111 	{ .center_freq = 2422, .hw_value = 3 },
112 	{ .center_freq = 2427, .hw_value = 4 },
113 	{ .center_freq = 2432, .hw_value = 5 },
114 	{ .center_freq = 2437, .hw_value = 6 },
115 	{ .center_freq = 2442, .hw_value = 7 },
116 	{ .center_freq = 2447, .hw_value = 8 },
117 	{ .center_freq = 2452, .hw_value = 9 },
118 	{ .center_freq = 2457, .hw_value = 10 },
119 	{ .center_freq = 2462, .hw_value = 11 },
120 	{ .center_freq = 2467, .hw_value = 12 },
121 	{ .center_freq = 2472, .hw_value = 13 },
122 	{ .center_freq = 2484, .hw_value = 14 },
123 };
124 
125 static void housekeeping_init(struct zd_mac *mac);
126 static void housekeeping_enable(struct zd_mac *mac);
127 static void housekeeping_disable(struct zd_mac *mac);
128 static void beacon_init(struct zd_mac *mac);
129 static void beacon_enable(struct zd_mac *mac);
130 static void beacon_disable(struct zd_mac *mac);
131 static void set_rts_cts(struct zd_mac *mac, unsigned int short_preamble);
132 static int zd_mac_config_beacon(struct ieee80211_hw *hw,
133 				struct sk_buff *beacon, bool in_intr);
134 
135 static int zd_reg2alpha2(u8 regdomain, char *alpha2)
136 {
137 	unsigned int i;
138 	struct zd_reg_alpha2_map *reg_map;
139 	for (i = 0; i < ARRAY_SIZE(reg_alpha2_map); i++) {
140 		reg_map = &reg_alpha2_map[i];
141 		if (regdomain == reg_map->reg) {
142 			alpha2[0] = reg_map->alpha2[0];
143 			alpha2[1] = reg_map->alpha2[1];
144 			return 0;
145 		}
146 	}
147 	return 1;
148 }
149 
150 static int zd_check_signal(struct ieee80211_hw *hw, int signal)
151 {
152 	struct zd_mac *mac = zd_hw_mac(hw);
153 
154 	dev_dbg_f_cond(zd_mac_dev(mac), signal < 0 || signal > 100,
155 			"%s: signal value from device not in range 0..100, "
156 			"but %d.\n", __func__, signal);
157 
158 	if (signal < 0)
159 		signal = 0;
160 	else if (signal > 100)
161 		signal = 100;
162 
163 	return signal;
164 }
165 
166 int zd_mac_preinit_hw(struct ieee80211_hw *hw)
167 {
168 	int r;
169 	u8 addr[ETH_ALEN];
170 	struct zd_mac *mac = zd_hw_mac(hw);
171 
172 	r = zd_chip_read_mac_addr_fw(&mac->chip, addr);
173 	if (r)
174 		return r;
175 
176 	SET_IEEE80211_PERM_ADDR(hw, addr);
177 
178 	return 0;
179 }
180 
181 int zd_mac_init_hw(struct ieee80211_hw *hw)
182 {
183 	int r;
184 	struct zd_mac *mac = zd_hw_mac(hw);
185 	struct zd_chip *chip = &mac->chip;
186 	char alpha2[2];
187 	u8 default_regdomain;
188 
189 	r = zd_chip_enable_int(chip);
190 	if (r)
191 		goto out;
192 	r = zd_chip_init_hw(chip);
193 	if (r)
194 		goto disable_int;
195 
196 	ZD_ASSERT(!irqs_disabled());
197 
198 	r = zd_read_regdomain(chip, &default_regdomain);
199 	if (r)
200 		goto disable_int;
201 	spin_lock_irq(&mac->lock);
202 	mac->regdomain = mac->default_regdomain = default_regdomain;
203 	spin_unlock_irq(&mac->lock);
204 
205 	/* We must inform the device that we are doing encryption/decryption in
206 	 * software at the moment. */
207 	r = zd_set_encryption_type(chip, ENC_SNIFFER);
208 	if (r)
209 		goto disable_int;
210 
211 	r = zd_reg2alpha2(mac->regdomain, alpha2);
212 	if (r)
213 		goto disable_int;
214 
215 	r = regulatory_hint(hw->wiphy, alpha2);
216 disable_int:
217 	zd_chip_disable_int(chip);
218 out:
219 	return r;
220 }
221 
222 void zd_mac_clear(struct zd_mac *mac)
223 {
224 	flush_workqueue(zd_workqueue);
225 	zd_chip_clear(&mac->chip);
226 	ZD_MEMCLEAR(mac, sizeof(struct zd_mac));
227 }
228 
229 static int set_rx_filter(struct zd_mac *mac)
230 {
231 	unsigned long flags;
232 	u32 filter = STA_RX_FILTER;
233 
234 	spin_lock_irqsave(&mac->lock, flags);
235 	if (mac->pass_ctrl)
236 		filter |= RX_FILTER_CTRL;
237 	spin_unlock_irqrestore(&mac->lock, flags);
238 
239 	return zd_iowrite32(&mac->chip, CR_RX_FILTER, filter);
240 }
241 
242 static int set_mac_and_bssid(struct zd_mac *mac)
243 {
244 	int r;
245 
246 	if (!mac->vif)
247 		return -1;
248 
249 	r = zd_write_mac_addr(&mac->chip, mac->vif->addr);
250 	if (r)
251 		return r;
252 
253 	/* Vendor driver after setting MAC either sets BSSID for AP or
254 	 * filter for other modes.
255 	 */
256 	if (mac->type != NL80211_IFTYPE_AP)
257 		return set_rx_filter(mac);
258 	else
259 		return zd_write_bssid(&mac->chip, mac->vif->addr);
260 }
261 
262 static int set_mc_hash(struct zd_mac *mac)
263 {
264 	struct zd_mc_hash hash;
265 	zd_mc_clear(&hash);
266 	return zd_chip_set_multicast_hash(&mac->chip, &hash);
267 }
268 
269 int zd_op_start(struct ieee80211_hw *hw)
270 {
271 	struct zd_mac *mac = zd_hw_mac(hw);
272 	struct zd_chip *chip = &mac->chip;
273 	struct zd_usb *usb = &chip->usb;
274 	int r;
275 
276 	if (!usb->initialized) {
277 		r = zd_usb_init_hw(usb);
278 		if (r)
279 			goto out;
280 	}
281 
282 	r = zd_chip_enable_int(chip);
283 	if (r < 0)
284 		goto out;
285 
286 	r = zd_chip_set_basic_rates(chip, CR_RATES_80211B | CR_RATES_80211G);
287 	if (r < 0)
288 		goto disable_int;
289 	r = set_rx_filter(mac);
290 	if (r)
291 		goto disable_int;
292 	r = set_mc_hash(mac);
293 	if (r)
294 		goto disable_int;
295 
296 	/* Wait after setting the multicast hash table and powering on
297 	 * the radio otherwise interface bring up will fail. This matches
298 	 * what the vendor driver did.
299 	 */
300 	msleep(10);
301 
302 	r = zd_chip_switch_radio_on(chip);
303 	if (r < 0) {
304 		dev_err(zd_chip_dev(chip),
305 			"%s: failed to set radio on\n", __func__);
306 		goto disable_int;
307 	}
308 	r = zd_chip_enable_rxtx(chip);
309 	if (r < 0)
310 		goto disable_radio;
311 	r = zd_chip_enable_hwint(chip);
312 	if (r < 0)
313 		goto disable_rxtx;
314 
315 	housekeeping_enable(mac);
316 	beacon_enable(mac);
317 	set_bit(ZD_DEVICE_RUNNING, &mac->flags);
318 	return 0;
319 disable_rxtx:
320 	zd_chip_disable_rxtx(chip);
321 disable_radio:
322 	zd_chip_switch_radio_off(chip);
323 disable_int:
324 	zd_chip_disable_int(chip);
325 out:
326 	return r;
327 }
328 
329 void zd_op_stop(struct ieee80211_hw *hw)
330 {
331 	struct zd_mac *mac = zd_hw_mac(hw);
332 	struct zd_chip *chip = &mac->chip;
333 	struct sk_buff *skb;
334 	struct sk_buff_head *ack_wait_queue = &mac->ack_wait_queue;
335 
336 	clear_bit(ZD_DEVICE_RUNNING, &mac->flags);
337 
338 	/* The order here deliberately is a little different from the open()
339 	 * method, since we need to make sure there is no opportunity for RX
340 	 * frames to be processed by mac80211 after we have stopped it.
341 	 */
342 
343 	zd_chip_disable_rxtx(chip);
344 	beacon_disable(mac);
345 	housekeeping_disable(mac);
346 	flush_workqueue(zd_workqueue);
347 
348 	zd_chip_disable_hwint(chip);
349 	zd_chip_switch_radio_off(chip);
350 	zd_chip_disable_int(chip);
351 
352 
353 	while ((skb = skb_dequeue(ack_wait_queue)))
354 		dev_kfree_skb_any(skb);
355 }
356 
357 int zd_restore_settings(struct zd_mac *mac)
358 {
359 	struct sk_buff *beacon;
360 	struct zd_mc_hash multicast_hash;
361 	unsigned int short_preamble;
362 	int r, beacon_interval, beacon_period;
363 	u8 channel;
364 
365 	dev_dbg_f(zd_mac_dev(mac), "\n");
366 
367 	spin_lock_irq(&mac->lock);
368 	multicast_hash = mac->multicast_hash;
369 	short_preamble = mac->short_preamble;
370 	beacon_interval = mac->beacon.interval;
371 	beacon_period = mac->beacon.period;
372 	channel = mac->channel;
373 	spin_unlock_irq(&mac->lock);
374 
375 	r = set_mac_and_bssid(mac);
376 	if (r < 0) {
377 		dev_dbg_f(zd_mac_dev(mac), "set_mac_and_bssid failed, %d\n", r);
378 		return r;
379 	}
380 
381 	r = zd_chip_set_channel(&mac->chip, channel);
382 	if (r < 0) {
383 		dev_dbg_f(zd_mac_dev(mac), "zd_chip_set_channel failed, %d\n",
384 			  r);
385 		return r;
386 	}
387 
388 	set_rts_cts(mac, short_preamble);
389 
390 	r = zd_chip_set_multicast_hash(&mac->chip, &multicast_hash);
391 	if (r < 0) {
392 		dev_dbg_f(zd_mac_dev(mac),
393 			  "zd_chip_set_multicast_hash failed, %d\n", r);
394 		return r;
395 	}
396 
397 	if (mac->type == NL80211_IFTYPE_MESH_POINT ||
398 	    mac->type == NL80211_IFTYPE_ADHOC ||
399 	    mac->type == NL80211_IFTYPE_AP) {
400 		if (mac->vif != NULL) {
401 			beacon = ieee80211_beacon_get(mac->hw, mac->vif, 0);
402 			if (beacon)
403 				zd_mac_config_beacon(mac->hw, beacon, false);
404 		}
405 
406 		zd_set_beacon_interval(&mac->chip, beacon_interval,
407 					beacon_period, mac->type);
408 
409 		spin_lock_irq(&mac->lock);
410 		mac->beacon.last_update = jiffies;
411 		spin_unlock_irq(&mac->lock);
412 	}
413 
414 	return 0;
415 }
416 
417 /**
418  * zd_mac_tx_status - reports tx status of a packet if required
419  * @hw: a &struct ieee80211_hw pointer
420  * @skb: a sk-buffer
421  * @ackssi: ACK signal strength
422  * @tx_status: success and/or retry
423  *
424  * This information calls ieee80211_tx_status_irqsafe() if required by the
425  * control information. It copies the control information into the status
426  * information.
427  *
428  * If no status information has been requested, the skb is freed.
429  */
430 static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
431 		      int ackssi, struct tx_status *tx_status)
432 {
433 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
434 	int i;
435 	int success = 1, retry = 1;
436 	int first_idx;
437 	const struct tx_retry_rate *retries;
438 
439 	ieee80211_tx_info_clear_status(info);
440 
441 	if (tx_status) {
442 		success = !tx_status->failure;
443 		retry = tx_status->retry + success;
444 	}
445 
446 	if (success) {
447 		/* success */
448 		info->flags |= IEEE80211_TX_STAT_ACK;
449 	} else {
450 		/* failure */
451 		info->flags &= ~IEEE80211_TX_STAT_ACK;
452 	}
453 
454 	first_idx = info->status.rates[0].idx;
455 	ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
456 	retries = &zd_retry_rates[first_idx];
457 	ZD_ASSERT(1 <= retry && retry <= retries->count);
458 
459 	info->status.rates[0].idx = retries->rate[0];
460 	info->status.rates[0].count = 1; // (retry > 1 ? 2 : 1);
461 
462 	for (i=1; i<IEEE80211_TX_MAX_RATES-1 && i<retry; i++) {
463 		info->status.rates[i].idx = retries->rate[i];
464 		info->status.rates[i].count = 1; // ((i==retry-1) && success ? 1:2);
465 	}
466 	for (; i<IEEE80211_TX_MAX_RATES && i<retry; i++) {
467 		info->status.rates[i].idx = retries->rate[retry - 1];
468 		info->status.rates[i].count = 1; // (success ? 1:2);
469 	}
470 	if (i<IEEE80211_TX_MAX_RATES)
471 		info->status.rates[i].idx = -1; /* terminate */
472 
473 	info->status.ack_signal = zd_check_signal(hw, ackssi);
474 	ieee80211_tx_status_irqsafe(hw, skb);
475 }
476 
477 /**
478  * zd_mac_tx_failed - callback for failed frames
479  * @urb: pointer to the urb structure
480  *
481  * This function is called if a frame couldn't be successfully
482  * transferred. The first frame from the tx queue, will be selected and
483  * reported as error to the upper layers.
484  */
485 void zd_mac_tx_failed(struct urb *urb)
486 {
487 	struct ieee80211_hw * hw = zd_usb_to_hw(urb->context);
488 	struct zd_mac *mac = zd_hw_mac(hw);
489 	struct sk_buff_head *q = &mac->ack_wait_queue;
490 	struct sk_buff *skb;
491 	struct tx_status *tx_status = (struct tx_status *)urb->transfer_buffer;
492 	unsigned long flags;
493 	int success = !tx_status->failure;
494 	int retry = tx_status->retry + success;
495 	int found = 0;
496 	int i, position = 0;
497 
498 	spin_lock_irqsave(&q->lock, flags);
499 
500 	skb_queue_walk(q, skb) {
501 		struct ieee80211_hdr *tx_hdr;
502 		struct ieee80211_tx_info *info;
503 		int first_idx, final_idx;
504 		const struct tx_retry_rate *retries;
505 		u8 final_rate;
506 
507 		position ++;
508 
509 		/* if the hardware reports a failure and we had a 802.11 ACK
510 		 * pending, then we skip the first skb when searching for a
511 		 * matching frame */
512 		if (tx_status->failure && mac->ack_pending &&
513 		    skb_queue_is_first(q, skb)) {
514 			continue;
515 		}
516 
517 		tx_hdr = (struct ieee80211_hdr *)skb->data;
518 
519 		/* we skip all frames not matching the reported destination */
520 		if (unlikely(!ether_addr_equal(tx_hdr->addr1, tx_status->mac)))
521 			continue;
522 
523 		/* we skip all frames not matching the reported final rate */
524 
525 		info = IEEE80211_SKB_CB(skb);
526 		first_idx = info->status.rates[0].idx;
527 		ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
528 		retries = &zd_retry_rates[first_idx];
529 		if (retry <= 0 || retry > retries->count)
530 			continue;
531 
532 		final_idx = retries->rate[retry - 1];
533 		final_rate = zd_rates[final_idx].hw_value;
534 
535 		if (final_rate != tx_status->rate) {
536 			continue;
537 		}
538 
539 		found = 1;
540 		break;
541 	}
542 
543 	if (found) {
544 		for (i=1; i<=position; i++) {
545 			skb = __skb_dequeue(q);
546 			zd_mac_tx_status(hw, skb,
547 					 mac->ack_pending ? mac->ack_signal : 0,
548 					 i == position ? tx_status : NULL);
549 			mac->ack_pending = 0;
550 		}
551 	}
552 
553 	spin_unlock_irqrestore(&q->lock, flags);
554 }
555 
556 /**
557  * zd_mac_tx_to_dev - callback for USB layer
558  * @skb: a &sk_buff pointer
559  * @error: error value, 0 if transmission successful
560  *
561  * Informs the MAC layer that the frame has successfully transferred to the
562  * device. If an ACK is required and the transfer to the device has been
563  * successful, the packets are put on the @ack_wait_queue with
564  * the control set removed.
565  */
566 void zd_mac_tx_to_dev(struct sk_buff *skb, int error)
567 {
568 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
569 	struct ieee80211_hw *hw = info->rate_driver_data[0];
570 	struct zd_mac *mac = zd_hw_mac(hw);
571 
572 	ieee80211_tx_info_clear_status(info);
573 
574 	skb_pull(skb, sizeof(struct zd_ctrlset));
575 	if (unlikely(error ||
576 	    (info->flags & IEEE80211_TX_CTL_NO_ACK))) {
577 		/*
578 		 * FIXME : do we need to fill in anything ?
579 		 */
580 		ieee80211_tx_status_irqsafe(hw, skb);
581 	} else {
582 		struct sk_buff_head *q = &mac->ack_wait_queue;
583 
584 		skb_queue_tail(q, skb);
585 		while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS) {
586 			zd_mac_tx_status(hw, skb_dequeue(q),
587 					 mac->ack_pending ? mac->ack_signal : 0,
588 					 NULL);
589 			mac->ack_pending = 0;
590 		}
591 	}
592 }
593 
594 static int zd_calc_tx_length_us(u8 *service, u8 zd_rate, u16 tx_length)
595 {
596 	/* ZD_PURE_RATE() must be used to remove the modulation type flag of
597 	 * the zd-rate values.
598 	 */
599 	static const u8 rate_divisor[] = {
600 		[ZD_PURE_RATE(ZD_CCK_RATE_1M)]   =  1,
601 		[ZD_PURE_RATE(ZD_CCK_RATE_2M)]	 =  2,
602 		/* Bits must be doubled. */
603 		[ZD_PURE_RATE(ZD_CCK_RATE_5_5M)] = 11,
604 		[ZD_PURE_RATE(ZD_CCK_RATE_11M)]	 = 11,
605 		[ZD_PURE_RATE(ZD_OFDM_RATE_6M)]  =  6,
606 		[ZD_PURE_RATE(ZD_OFDM_RATE_9M)]  =  9,
607 		[ZD_PURE_RATE(ZD_OFDM_RATE_12M)] = 12,
608 		[ZD_PURE_RATE(ZD_OFDM_RATE_18M)] = 18,
609 		[ZD_PURE_RATE(ZD_OFDM_RATE_24M)] = 24,
610 		[ZD_PURE_RATE(ZD_OFDM_RATE_36M)] = 36,
611 		[ZD_PURE_RATE(ZD_OFDM_RATE_48M)] = 48,
612 		[ZD_PURE_RATE(ZD_OFDM_RATE_54M)] = 54,
613 	};
614 
615 	u32 bits = (u32)tx_length * 8;
616 	u32 divisor;
617 
618 	divisor = rate_divisor[ZD_PURE_RATE(zd_rate)];
619 	if (divisor == 0)
620 		return -EINVAL;
621 
622 	switch (zd_rate) {
623 	case ZD_CCK_RATE_5_5M:
624 		bits = (2*bits) + 10; /* round up to the next integer */
625 		break;
626 	case ZD_CCK_RATE_11M:
627 		if (service) {
628 			u32 t = bits % 11;
629 			*service &= ~ZD_PLCP_SERVICE_LENGTH_EXTENSION;
630 			if (0 < t && t <= 3) {
631 				*service |= ZD_PLCP_SERVICE_LENGTH_EXTENSION;
632 			}
633 		}
634 		bits += 10; /* round up to the next integer */
635 		break;
636 	}
637 
638 	return bits/divisor;
639 }
640 
641 static void cs_set_control(struct zd_mac *mac, struct zd_ctrlset *cs,
642 	                   struct ieee80211_hdr *header,
643 	                   struct ieee80211_tx_info *info)
644 {
645 	/*
646 	 * CONTROL TODO:
647 	 * - if backoff needed, enable bit 0
648 	 * - if burst (backoff not needed) disable bit 0
649 	 */
650 
651 	cs->control = 0;
652 
653 	/* First fragment */
654 	if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
655 		cs->control |= ZD_CS_NEED_RANDOM_BACKOFF;
656 
657 	/* No ACK expected (multicast, etc.) */
658 	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
659 		cs->control |= ZD_CS_NO_ACK;
660 
661 	/* PS-POLL */
662 	if (ieee80211_is_pspoll(header->frame_control))
663 		cs->control |= ZD_CS_PS_POLL_FRAME;
664 
665 	if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
666 		cs->control |= ZD_CS_RTS;
667 
668 	if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
669 		cs->control |= ZD_CS_SELF_CTS;
670 
671 	/* FIXME: Management frame? */
672 }
673 
674 static bool zd_mac_match_cur_beacon(struct zd_mac *mac, struct sk_buff *beacon)
675 {
676 	if (!mac->beacon.cur_beacon)
677 		return false;
678 
679 	if (mac->beacon.cur_beacon->len != beacon->len)
680 		return false;
681 
682 	return !memcmp(beacon->data, mac->beacon.cur_beacon->data, beacon->len);
683 }
684 
685 static void zd_mac_free_cur_beacon_locked(struct zd_mac *mac)
686 {
687 	ZD_ASSERT(mutex_is_locked(&mac->chip.mutex));
688 
689 	kfree_skb(mac->beacon.cur_beacon);
690 	mac->beacon.cur_beacon = NULL;
691 }
692 
693 static void zd_mac_free_cur_beacon(struct zd_mac *mac)
694 {
695 	mutex_lock(&mac->chip.mutex);
696 	zd_mac_free_cur_beacon_locked(mac);
697 	mutex_unlock(&mac->chip.mutex);
698 }
699 
700 static int zd_mac_config_beacon(struct ieee80211_hw *hw, struct sk_buff *beacon,
701 				bool in_intr)
702 {
703 	struct zd_mac *mac = zd_hw_mac(hw);
704 	int r, ret, num_cmds, req_pos = 0;
705 	u32 tmp, j = 0;
706 	/* 4 more bytes for tail CRC */
707 	u32 full_len = beacon->len + 4;
708 	unsigned long end_jiffies, message_jiffies;
709 	struct zd_ioreq32 *ioreqs;
710 
711 	mutex_lock(&mac->chip.mutex);
712 
713 	/* Check if hw already has this beacon. */
714 	if (zd_mac_match_cur_beacon(mac, beacon)) {
715 		r = 0;
716 		goto out_nofree;
717 	}
718 
719 	/* Alloc memory for full beacon write at once. */
720 	num_cmds = 1 + zd_chip_is_zd1211b(&mac->chip) + full_len;
721 	ioreqs = kmalloc_array(num_cmds, sizeof(struct zd_ioreq32),
722 			       GFP_KERNEL);
723 	if (!ioreqs) {
724 		r = -ENOMEM;
725 		goto out_nofree;
726 	}
727 
728 	r = zd_iowrite32_locked(&mac->chip, 0, CR_BCN_FIFO_SEMAPHORE);
729 	if (r < 0)
730 		goto out;
731 	r = zd_ioread32_locked(&mac->chip, &tmp, CR_BCN_FIFO_SEMAPHORE);
732 	if (r < 0)
733 		goto release_sema;
734 	if (in_intr && tmp & 0x2) {
735 		r = -EBUSY;
736 		goto release_sema;
737 	}
738 
739 	end_jiffies = jiffies + HZ / 2; /*~500ms*/
740 	message_jiffies = jiffies + HZ / 10; /*~100ms*/
741 	while (tmp & 0x2) {
742 		r = zd_ioread32_locked(&mac->chip, &tmp, CR_BCN_FIFO_SEMAPHORE);
743 		if (r < 0)
744 			goto release_sema;
745 		if (time_is_before_eq_jiffies(message_jiffies)) {
746 			message_jiffies = jiffies + HZ / 10;
747 			dev_err(zd_mac_dev(mac),
748 					"CR_BCN_FIFO_SEMAPHORE not ready\n");
749 			if (time_is_before_eq_jiffies(end_jiffies))  {
750 				dev_err(zd_mac_dev(mac),
751 						"Giving up beacon config.\n");
752 				r = -ETIMEDOUT;
753 				goto reset_device;
754 			}
755 		}
756 		msleep(20);
757 	}
758 
759 	ioreqs[req_pos].addr = CR_BCN_FIFO;
760 	ioreqs[req_pos].value = full_len - 1;
761 	req_pos++;
762 	if (zd_chip_is_zd1211b(&mac->chip)) {
763 		ioreqs[req_pos].addr = CR_BCN_LENGTH;
764 		ioreqs[req_pos].value = full_len - 1;
765 		req_pos++;
766 	}
767 
768 	for (j = 0 ; j < beacon->len; j++) {
769 		ioreqs[req_pos].addr = CR_BCN_FIFO;
770 		ioreqs[req_pos].value = *((u8 *)(beacon->data + j));
771 		req_pos++;
772 	}
773 
774 	for (j = 0; j < 4; j++) {
775 		ioreqs[req_pos].addr = CR_BCN_FIFO;
776 		ioreqs[req_pos].value = 0x0;
777 		req_pos++;
778 	}
779 
780 	BUG_ON(req_pos != num_cmds);
781 
782 	r = zd_iowrite32a_locked(&mac->chip, ioreqs, num_cmds);
783 
784 release_sema:
785 	/*
786 	 * Try very hard to release device beacon semaphore, as otherwise
787 	 * device/driver can be left in unusable state.
788 	 */
789 	end_jiffies = jiffies + HZ / 2; /*~500ms*/
790 	ret = zd_iowrite32_locked(&mac->chip, 1, CR_BCN_FIFO_SEMAPHORE);
791 	while (ret < 0) {
792 		if (in_intr || time_is_before_eq_jiffies(end_jiffies)) {
793 			ret = -ETIMEDOUT;
794 			break;
795 		}
796 
797 		msleep(20);
798 		ret = zd_iowrite32_locked(&mac->chip, 1, CR_BCN_FIFO_SEMAPHORE);
799 	}
800 
801 	if (ret < 0)
802 		dev_err(zd_mac_dev(mac), "Could not release "
803 					 "CR_BCN_FIFO_SEMAPHORE!\n");
804 	if (r < 0 || ret < 0) {
805 		if (r >= 0)
806 			r = ret;
807 
808 		/* We don't know if beacon was written successfully or not,
809 		 * so clear current. */
810 		zd_mac_free_cur_beacon_locked(mac);
811 
812 		goto out;
813 	}
814 
815 	/* Beacon has now been written successfully, update current. */
816 	zd_mac_free_cur_beacon_locked(mac);
817 	mac->beacon.cur_beacon = beacon;
818 	beacon = NULL;
819 
820 	/* 802.11b/g 2.4G CCK 1Mb
821 	 * 802.11a, not yet implemented, uses different values (see GPL vendor
822 	 * driver)
823 	 */
824 	r = zd_iowrite32_locked(&mac->chip, 0x00000400 | (full_len << 19),
825 				CR_BCN_PLCP_CFG);
826 out:
827 	kfree(ioreqs);
828 out_nofree:
829 	kfree_skb(beacon);
830 	mutex_unlock(&mac->chip.mutex);
831 
832 	return r;
833 
834 reset_device:
835 	zd_mac_free_cur_beacon_locked(mac);
836 	kfree_skb(beacon);
837 
838 	mutex_unlock(&mac->chip.mutex);
839 	kfree(ioreqs);
840 
841 	/* semaphore stuck, reset device to avoid fw freeze later */
842 	dev_warn(zd_mac_dev(mac), "CR_BCN_FIFO_SEMAPHORE stuck, "
843 				  "resetting device...");
844 	usb_queue_reset_device(mac->chip.usb.intf);
845 
846 	return r;
847 }
848 
849 static int fill_ctrlset(struct zd_mac *mac,
850 			struct sk_buff *skb)
851 {
852 	int r;
853 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
854 	unsigned int frag_len = skb->len + FCS_LEN;
855 	unsigned int packet_length;
856 	struct ieee80211_rate *txrate;
857 	struct zd_ctrlset *cs = skb_push(skb, sizeof(struct zd_ctrlset));
858 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
859 
860 	ZD_ASSERT(frag_len <= 0xffff);
861 
862 	/*
863 	 * Firmware computes the duration itself (for all frames except PSPoll)
864 	 * and needs the field set to 0 at input, otherwise firmware messes up
865 	 * duration_id and sets bits 14 and 15 on.
866 	 */
867 	if (!ieee80211_is_pspoll(hdr->frame_control))
868 		hdr->duration_id = 0;
869 
870 	txrate = ieee80211_get_tx_rate(mac->hw, info);
871 
872 	cs->modulation = txrate->hw_value;
873 	if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
874 		cs->modulation = txrate->hw_value_short;
875 
876 	cs->tx_length = cpu_to_le16(frag_len);
877 
878 	cs_set_control(mac, cs, hdr, info);
879 
880 	packet_length = frag_len + sizeof(struct zd_ctrlset) + 10;
881 	ZD_ASSERT(packet_length <= 0xffff);
882 	/* ZD1211B: Computing the length difference this way, gives us
883 	 * flexibility to compute the packet length.
884 	 */
885 	cs->packet_length = cpu_to_le16(zd_chip_is_zd1211b(&mac->chip) ?
886 			packet_length - frag_len : packet_length);
887 
888 	/*
889 	 * CURRENT LENGTH:
890 	 * - transmit frame length in microseconds
891 	 * - seems to be derived from frame length
892 	 * - see Cal_Us_Service() in zdinlinef.h
893 	 * - if macp->bTxBurstEnable is enabled, then multiply by 4
894 	 *  - bTxBurstEnable is never set in the vendor driver
895 	 *
896 	 * SERVICE:
897 	 * - "for PLCP configuration"
898 	 * - always 0 except in some situations at 802.11b 11M
899 	 * - see line 53 of zdinlinef.h
900 	 */
901 	cs->service = 0;
902 	r = zd_calc_tx_length_us(&cs->service, ZD_RATE(cs->modulation),
903 		                 le16_to_cpu(cs->tx_length));
904 	if (r < 0)
905 		return r;
906 	cs->current_length = cpu_to_le16(r);
907 	cs->next_frame_length = 0;
908 
909 	return 0;
910 }
911 
912 /**
913  * zd_op_tx - transmits a network frame to the device
914  *
915  * @hw: a &struct ieee80211_hw pointer
916  * @control: the control structure
917  * @skb: socket buffer
918  *
919  * This function transmit an IEEE 802.11 network frame to the device. The
920  * control block of the skbuff will be initialized. If necessary the incoming
921  * mac80211 queues will be stopped.
922  */
923 static void zd_op_tx(struct ieee80211_hw *hw,
924 		     struct ieee80211_tx_control *control,
925 		     struct sk_buff *skb)
926 {
927 	struct zd_mac *mac = zd_hw_mac(hw);
928 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
929 	int r;
930 
931 	r = fill_ctrlset(mac, skb);
932 	if (r)
933 		goto fail;
934 
935 	info->rate_driver_data[0] = hw;
936 
937 	r = zd_usb_tx(&mac->chip.usb, skb);
938 	if (r)
939 		goto fail;
940 	return;
941 
942 fail:
943 	dev_kfree_skb(skb);
944 }
945 
946 /**
947  * filter_ack - filters incoming packets for acknowledgements
948  * @hw: a &struct ieee80211_hw pointer
949  * @rx_hdr: received header
950  * @stats: the status for the received packet
951  *
952  * This functions looks for ACK packets and tries to match them with the
953  * frames in the tx queue. If a match is found the frame will be dequeued and
954  * the upper layers is informed about the successful transmission. If
955  * mac80211 queues have been stopped and the number of frames still to be
956  * transmitted is low the queues will be opened again.
957  *
958  * Returns 1 if the frame was an ACK, 0 if it was ignored.
959  */
960 static int filter_ack(struct ieee80211_hw *hw, struct ieee80211_hdr *rx_hdr,
961 		      struct ieee80211_rx_status *stats)
962 {
963 	struct zd_mac *mac = zd_hw_mac(hw);
964 	struct sk_buff *skb;
965 	struct sk_buff_head *q;
966 	unsigned long flags;
967 	int found = 0;
968 	int i, position = 0;
969 
970 	if (!ieee80211_is_ack(rx_hdr->frame_control))
971 		return 0;
972 
973 	q = &mac->ack_wait_queue;
974 	spin_lock_irqsave(&q->lock, flags);
975 	skb_queue_walk(q, skb) {
976 		struct ieee80211_hdr *tx_hdr;
977 
978 		position ++;
979 
980 		if (mac->ack_pending && skb_queue_is_first(q, skb))
981 		    continue;
982 
983 		tx_hdr = (struct ieee80211_hdr *)skb->data;
984 		if (likely(ether_addr_equal(tx_hdr->addr2, rx_hdr->addr1)))
985 		{
986 			found = 1;
987 			break;
988 		}
989 	}
990 
991 	if (found) {
992 		for (i=1; i<position; i++) {
993 			skb = __skb_dequeue(q);
994 			zd_mac_tx_status(hw, skb,
995 					 mac->ack_pending ? mac->ack_signal : 0,
996 					 NULL);
997 			mac->ack_pending = 0;
998 		}
999 
1000 		mac->ack_pending = 1;
1001 		mac->ack_signal = stats->signal;
1002 
1003 		/* Prevent pending tx-packet on AP-mode */
1004 		if (mac->type == NL80211_IFTYPE_AP) {
1005 			skb = __skb_dequeue(q);
1006 			zd_mac_tx_status(hw, skb, mac->ack_signal, NULL);
1007 			mac->ack_pending = 0;
1008 		}
1009 	}
1010 
1011 	spin_unlock_irqrestore(&q->lock, flags);
1012 	return 1;
1013 }
1014 
1015 int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
1016 {
1017 	struct zd_mac *mac = zd_hw_mac(hw);
1018 	struct ieee80211_rx_status stats;
1019 	const struct rx_status *status;
1020 	struct sk_buff *skb;
1021 	int bad_frame = 0;
1022 	__le16 fc;
1023 	int need_padding;
1024 	int i;
1025 	u8 rate;
1026 
1027 	if (length < ZD_PLCP_HEADER_SIZE + 10 /* IEEE80211_1ADDR_LEN */ +
1028 	             FCS_LEN + sizeof(struct rx_status))
1029 		return -EINVAL;
1030 
1031 	memset(&stats, 0, sizeof(stats));
1032 
1033 	/* Note about pass_failed_fcs and pass_ctrl access below:
1034 	 * mac locking intentionally omitted here, as this is the only unlocked
1035 	 * reader and the only writer is configure_filter. Plus, if there were
1036 	 * any races accessing these variables, it wouldn't really matter.
1037 	 * If mac80211 ever provides a way for us to access filter flags
1038 	 * from outside configure_filter, we could improve on this. Also, this
1039 	 * situation may change once we implement some kind of DMA-into-skb
1040 	 * RX path. */
1041 
1042 	/* Caller has to ensure that length >= sizeof(struct rx_status). */
1043 	status = (struct rx_status *)
1044 		(buffer + (length - sizeof(struct rx_status)));
1045 	if (status->frame_status & ZD_RX_ERROR) {
1046 		if (mac->pass_failed_fcs &&
1047 				(status->frame_status & ZD_RX_CRC32_ERROR)) {
1048 			stats.flag |= RX_FLAG_FAILED_FCS_CRC;
1049 			bad_frame = 1;
1050 		} else {
1051 			return -EINVAL;
1052 		}
1053 	}
1054 
1055 	stats.freq = zd_channels[_zd_chip_get_channel(&mac->chip) - 1].center_freq;
1056 	stats.band = NL80211_BAND_2GHZ;
1057 	stats.signal = zd_check_signal(hw, status->signal_strength);
1058 
1059 	rate = zd_rx_rate(buffer, status);
1060 
1061 	/* todo: return index in the big switches in zd_rx_rate instead */
1062 	for (i = 0; i < mac->band.n_bitrates; i++)
1063 		if (rate == mac->band.bitrates[i].hw_value)
1064 			stats.rate_idx = i;
1065 
1066 	length -= ZD_PLCP_HEADER_SIZE + sizeof(struct rx_status);
1067 	buffer += ZD_PLCP_HEADER_SIZE;
1068 
1069 	/* Except for bad frames, filter each frame to see if it is an ACK, in
1070 	 * which case our internal TX tracking is updated. Normally we then
1071 	 * bail here as there's no need to pass ACKs on up to the stack, but
1072 	 * there is also the case where the stack has requested us to pass
1073 	 * control frames on up (pass_ctrl) which we must consider. */
1074 	if (!bad_frame &&
1075 			filter_ack(hw, (struct ieee80211_hdr *)buffer, &stats)
1076 			&& !mac->pass_ctrl)
1077 		return 0;
1078 
1079 	fc = get_unaligned((__le16*)buffer);
1080 	need_padding = ieee80211_is_data_qos(fc) ^ ieee80211_has_a4(fc);
1081 
1082 	skb = dev_alloc_skb(length + (need_padding ? 2 : 0));
1083 	if (skb == NULL)
1084 		return -ENOMEM;
1085 	if (need_padding) {
1086 		/* Make sure the payload data is 4 byte aligned. */
1087 		skb_reserve(skb, 2);
1088 	}
1089 
1090 	/* FIXME : could we avoid this big memcpy ? */
1091 	skb_put_data(skb, buffer, length);
1092 
1093 	memcpy(IEEE80211_SKB_RXCB(skb), &stats, sizeof(stats));
1094 	ieee80211_rx_irqsafe(hw, skb);
1095 	return 0;
1096 }
1097 
1098 static int zd_op_add_interface(struct ieee80211_hw *hw,
1099 				struct ieee80211_vif *vif)
1100 {
1101 	struct zd_mac *mac = zd_hw_mac(hw);
1102 
1103 	/* using NL80211_IFTYPE_UNSPECIFIED to indicate no mode selected */
1104 	if (mac->type != NL80211_IFTYPE_UNSPECIFIED)
1105 		return -EOPNOTSUPP;
1106 
1107 	switch (vif->type) {
1108 	case NL80211_IFTYPE_MONITOR:
1109 	case NL80211_IFTYPE_MESH_POINT:
1110 	case NL80211_IFTYPE_STATION:
1111 	case NL80211_IFTYPE_ADHOC:
1112 	case NL80211_IFTYPE_AP:
1113 		mac->type = vif->type;
1114 		break;
1115 	default:
1116 		return -EOPNOTSUPP;
1117 	}
1118 
1119 	mac->vif = vif;
1120 
1121 	return set_mac_and_bssid(mac);
1122 }
1123 
1124 static void zd_op_remove_interface(struct ieee80211_hw *hw,
1125 				    struct ieee80211_vif *vif)
1126 {
1127 	struct zd_mac *mac = zd_hw_mac(hw);
1128 	mac->type = NL80211_IFTYPE_UNSPECIFIED;
1129 	mac->vif = NULL;
1130 	zd_set_beacon_interval(&mac->chip, 0, 0, NL80211_IFTYPE_UNSPECIFIED);
1131 	zd_write_mac_addr(&mac->chip, NULL);
1132 
1133 	zd_mac_free_cur_beacon(mac);
1134 }
1135 
1136 static int zd_op_config(struct ieee80211_hw *hw, u32 changed)
1137 {
1138 	struct zd_mac *mac = zd_hw_mac(hw);
1139 	struct ieee80211_conf *conf = &hw->conf;
1140 
1141 	spin_lock_irq(&mac->lock);
1142 	mac->channel = conf->chandef.chan->hw_value;
1143 	spin_unlock_irq(&mac->lock);
1144 
1145 	return zd_chip_set_channel(&mac->chip, conf->chandef.chan->hw_value);
1146 }
1147 
1148 static void zd_beacon_done(struct zd_mac *mac)
1149 {
1150 	struct sk_buff *skb, *beacon;
1151 
1152 	if (!test_bit(ZD_DEVICE_RUNNING, &mac->flags))
1153 		return;
1154 	if (!mac->vif || mac->vif->type != NL80211_IFTYPE_AP)
1155 		return;
1156 
1157 	/*
1158 	 * Send out buffered broad- and multicast frames.
1159 	 */
1160 	while (!ieee80211_queue_stopped(mac->hw, 0)) {
1161 		skb = ieee80211_get_buffered_bc(mac->hw, mac->vif);
1162 		if (!skb)
1163 			break;
1164 		zd_op_tx(mac->hw, NULL, skb);
1165 	}
1166 
1167 	/*
1168 	 * Fetch next beacon so that tim_count is updated.
1169 	 */
1170 	beacon = ieee80211_beacon_get(mac->hw, mac->vif, 0);
1171 	if (beacon)
1172 		zd_mac_config_beacon(mac->hw, beacon, true);
1173 
1174 	spin_lock_irq(&mac->lock);
1175 	mac->beacon.last_update = jiffies;
1176 	spin_unlock_irq(&mac->lock);
1177 }
1178 
1179 static void zd_process_intr(struct work_struct *work)
1180 {
1181 	u16 int_status;
1182 	unsigned long flags;
1183 	struct zd_mac *mac = container_of(work, struct zd_mac, process_intr);
1184 
1185 	spin_lock_irqsave(&mac->lock, flags);
1186 	int_status = le16_to_cpu(*(__le16 *)(mac->intr_buffer + 4));
1187 	spin_unlock_irqrestore(&mac->lock, flags);
1188 
1189 	if (int_status & INT_CFG_NEXT_BCN) {
1190 		/*dev_dbg_f_limit(zd_mac_dev(mac), "INT_CFG_NEXT_BCN\n");*/
1191 		zd_beacon_done(mac);
1192 	} else {
1193 		dev_dbg_f(zd_mac_dev(mac), "Unsupported interrupt\n");
1194 	}
1195 
1196 	zd_chip_enable_hwint(&mac->chip);
1197 }
1198 
1199 
1200 static u64 zd_op_prepare_multicast(struct ieee80211_hw *hw,
1201 				   struct netdev_hw_addr_list *mc_list)
1202 {
1203 	struct zd_mac *mac = zd_hw_mac(hw);
1204 	struct zd_mc_hash hash;
1205 	struct netdev_hw_addr *ha;
1206 
1207 	zd_mc_clear(&hash);
1208 
1209 	netdev_hw_addr_list_for_each(ha, mc_list) {
1210 		dev_dbg_f(zd_mac_dev(mac), "mc addr %pM\n", ha->addr);
1211 		zd_mc_add_addr(&hash, ha->addr);
1212 	}
1213 
1214 	return hash.low | ((u64)hash.high << 32);
1215 }
1216 
1217 #define SUPPORTED_FIF_FLAGS \
1218 	(FIF_ALLMULTI | FIF_FCSFAIL | FIF_CONTROL | \
1219 	FIF_OTHER_BSS | FIF_BCN_PRBRESP_PROMISC)
1220 static void zd_op_configure_filter(struct ieee80211_hw *hw,
1221 			unsigned int changed_flags,
1222 			unsigned int *new_flags,
1223 			u64 multicast)
1224 {
1225 	struct zd_mc_hash hash = {
1226 		.low = multicast,
1227 		.high = multicast >> 32,
1228 	};
1229 	struct zd_mac *mac = zd_hw_mac(hw);
1230 	unsigned long flags;
1231 	int r;
1232 
1233 	/* Only deal with supported flags */
1234 	changed_flags &= SUPPORTED_FIF_FLAGS;
1235 	*new_flags &= SUPPORTED_FIF_FLAGS;
1236 
1237 	/*
1238 	 * If multicast parameter (as returned by zd_op_prepare_multicast)
1239 	 * has changed, no bit in changed_flags is set. To handle this
1240 	 * situation, we do not return if changed_flags is 0. If we do so,
1241 	 * we will have some issue with IPv6 which uses multicast for link
1242 	 * layer address resolution.
1243 	 */
1244 	if (*new_flags & FIF_ALLMULTI)
1245 		zd_mc_add_all(&hash);
1246 
1247 	spin_lock_irqsave(&mac->lock, flags);
1248 	mac->pass_failed_fcs = !!(*new_flags & FIF_FCSFAIL);
1249 	mac->pass_ctrl = !!(*new_flags & FIF_CONTROL);
1250 	mac->multicast_hash = hash;
1251 	spin_unlock_irqrestore(&mac->lock, flags);
1252 
1253 	zd_chip_set_multicast_hash(&mac->chip, &hash);
1254 
1255 	if (changed_flags & FIF_CONTROL) {
1256 		r = set_rx_filter(mac);
1257 		if (r)
1258 			dev_err(zd_mac_dev(mac), "set_rx_filter error %d\n", r);
1259 	}
1260 
1261 	/* no handling required for FIF_OTHER_BSS as we don't currently
1262 	 * do BSSID filtering */
1263 	/* FIXME: in future it would be nice to enable the probe response
1264 	 * filter (so that the driver doesn't see them) until
1265 	 * FIF_BCN_PRBRESP_PROMISC is set. however due to atomicity here, we'd
1266 	 * have to schedule work to enable prbresp reception, which might
1267 	 * happen too late. For now we'll just listen and forward them all the
1268 	 * time. */
1269 }
1270 
1271 static void set_rts_cts(struct zd_mac *mac, unsigned int short_preamble)
1272 {
1273 	mutex_lock(&mac->chip.mutex);
1274 	zd_chip_set_rts_cts_rate_locked(&mac->chip, short_preamble);
1275 	mutex_unlock(&mac->chip.mutex);
1276 }
1277 
1278 static void zd_op_bss_info_changed(struct ieee80211_hw *hw,
1279 				   struct ieee80211_vif *vif,
1280 				   struct ieee80211_bss_conf *bss_conf,
1281 				   u64 changes)
1282 {
1283 	struct zd_mac *mac = zd_hw_mac(hw);
1284 	int associated;
1285 
1286 	dev_dbg_f(zd_mac_dev(mac), "changes: %llx\n", changes);
1287 
1288 	if (mac->type == NL80211_IFTYPE_MESH_POINT ||
1289 	    mac->type == NL80211_IFTYPE_ADHOC ||
1290 	    mac->type == NL80211_IFTYPE_AP) {
1291 		associated = true;
1292 		if (changes & BSS_CHANGED_BEACON) {
1293 			struct sk_buff *beacon = ieee80211_beacon_get(hw, vif,
1294 								      0);
1295 
1296 			if (beacon) {
1297 				zd_chip_disable_hwint(&mac->chip);
1298 				zd_mac_config_beacon(hw, beacon, false);
1299 				zd_chip_enable_hwint(&mac->chip);
1300 			}
1301 		}
1302 
1303 		if (changes & BSS_CHANGED_BEACON_ENABLED) {
1304 			u16 interval = 0;
1305 			u8 period = 0;
1306 
1307 			if (bss_conf->enable_beacon) {
1308 				period = bss_conf->dtim_period;
1309 				interval = bss_conf->beacon_int;
1310 			}
1311 
1312 			spin_lock_irq(&mac->lock);
1313 			mac->beacon.period = period;
1314 			mac->beacon.interval = interval;
1315 			mac->beacon.last_update = jiffies;
1316 			spin_unlock_irq(&mac->lock);
1317 
1318 			zd_set_beacon_interval(&mac->chip, interval, period,
1319 					       mac->type);
1320 		}
1321 	} else
1322 		associated = is_valid_ether_addr(bss_conf->bssid);
1323 
1324 	spin_lock_irq(&mac->lock);
1325 	mac->associated = associated;
1326 	spin_unlock_irq(&mac->lock);
1327 
1328 	/* TODO: do hardware bssid filtering */
1329 
1330 	if (changes & BSS_CHANGED_ERP_PREAMBLE) {
1331 		spin_lock_irq(&mac->lock);
1332 		mac->short_preamble = bss_conf->use_short_preamble;
1333 		spin_unlock_irq(&mac->lock);
1334 
1335 		set_rts_cts(mac, bss_conf->use_short_preamble);
1336 	}
1337 }
1338 
1339 static u64 zd_op_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
1340 {
1341 	struct zd_mac *mac = zd_hw_mac(hw);
1342 	return zd_chip_get_tsf(&mac->chip);
1343 }
1344 
1345 static const struct ieee80211_ops zd_ops = {
1346 	.tx			= zd_op_tx,
1347 	.wake_tx_queue		= ieee80211_handle_wake_tx_queue,
1348 	.start			= zd_op_start,
1349 	.stop			= zd_op_stop,
1350 	.add_interface		= zd_op_add_interface,
1351 	.remove_interface	= zd_op_remove_interface,
1352 	.config			= zd_op_config,
1353 	.prepare_multicast	= zd_op_prepare_multicast,
1354 	.configure_filter	= zd_op_configure_filter,
1355 	.bss_info_changed	= zd_op_bss_info_changed,
1356 	.get_tsf		= zd_op_get_tsf,
1357 };
1358 
1359 struct ieee80211_hw *zd_mac_alloc_hw(struct usb_interface *intf)
1360 {
1361 	struct zd_mac *mac;
1362 	struct ieee80211_hw *hw;
1363 
1364 	hw = ieee80211_alloc_hw(sizeof(struct zd_mac), &zd_ops);
1365 	if (!hw) {
1366 		dev_dbg_f(&intf->dev, "out of memory\n");
1367 		return NULL;
1368 	}
1369 
1370 	mac = zd_hw_mac(hw);
1371 
1372 	memset(mac, 0, sizeof(*mac));
1373 	spin_lock_init(&mac->lock);
1374 	mac->hw = hw;
1375 
1376 	mac->type = NL80211_IFTYPE_UNSPECIFIED;
1377 
1378 	memcpy(mac->channels, zd_channels, sizeof(zd_channels));
1379 	memcpy(mac->rates, zd_rates, sizeof(zd_rates));
1380 	mac->band.n_bitrates = ARRAY_SIZE(zd_rates);
1381 	mac->band.bitrates = mac->rates;
1382 	mac->band.n_channels = ARRAY_SIZE(zd_channels);
1383 	mac->band.channels = mac->channels;
1384 
1385 	hw->wiphy->bands[NL80211_BAND_2GHZ] = &mac->band;
1386 
1387 	ieee80211_hw_set(hw, MFP_CAPABLE);
1388 	ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
1389 	ieee80211_hw_set(hw, RX_INCLUDES_FCS);
1390 	ieee80211_hw_set(hw, SIGNAL_UNSPEC);
1391 
1392 	hw->wiphy->interface_modes =
1393 		BIT(NL80211_IFTYPE_MESH_POINT) |
1394 		BIT(NL80211_IFTYPE_STATION) |
1395 		BIT(NL80211_IFTYPE_ADHOC) |
1396 		BIT(NL80211_IFTYPE_AP);
1397 
1398 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
1399 
1400 	hw->max_signal = 100;
1401 	hw->queues = 1;
1402 	hw->extra_tx_headroom = sizeof(struct zd_ctrlset);
1403 
1404 	/*
1405 	 * Tell mac80211 that we support multi rate retries
1406 	 */
1407 	hw->max_rates = IEEE80211_TX_MAX_RATES;
1408 	hw->max_rate_tries = 18;	/* 9 rates * 2 retries/rate */
1409 
1410 	skb_queue_head_init(&mac->ack_wait_queue);
1411 	mac->ack_pending = 0;
1412 
1413 	zd_chip_init(&mac->chip, hw, intf);
1414 	housekeeping_init(mac);
1415 	beacon_init(mac);
1416 	INIT_WORK(&mac->process_intr, zd_process_intr);
1417 
1418 	SET_IEEE80211_DEV(hw, &intf->dev);
1419 	return hw;
1420 }
1421 
1422 #define BEACON_WATCHDOG_DELAY round_jiffies_relative(HZ)
1423 
1424 static void beacon_watchdog_handler(struct work_struct *work)
1425 {
1426 	struct zd_mac *mac =
1427 		container_of(work, struct zd_mac, beacon.watchdog_work.work);
1428 	struct sk_buff *beacon;
1429 	unsigned long timeout;
1430 	int interval, period;
1431 
1432 	if (!test_bit(ZD_DEVICE_RUNNING, &mac->flags))
1433 		goto rearm;
1434 	if (mac->type != NL80211_IFTYPE_AP || !mac->vif)
1435 		goto rearm;
1436 
1437 	spin_lock_irq(&mac->lock);
1438 	interval = mac->beacon.interval;
1439 	period = mac->beacon.period;
1440 	timeout = mac->beacon.last_update +
1441 			msecs_to_jiffies(interval * 1024 / 1000) * 3;
1442 	spin_unlock_irq(&mac->lock);
1443 
1444 	if (interval > 0 && time_is_before_jiffies(timeout)) {
1445 		dev_dbg_f(zd_mac_dev(mac), "beacon interrupt stalled, "
1446 					   "restarting. "
1447 					   "(interval: %d, dtim: %d)\n",
1448 					   interval, period);
1449 
1450 		zd_chip_disable_hwint(&mac->chip);
1451 
1452 		beacon = ieee80211_beacon_get(mac->hw, mac->vif, 0);
1453 		if (beacon) {
1454 			zd_mac_free_cur_beacon(mac);
1455 
1456 			zd_mac_config_beacon(mac->hw, beacon, false);
1457 		}
1458 
1459 		zd_set_beacon_interval(&mac->chip, interval, period, mac->type);
1460 
1461 		zd_chip_enable_hwint(&mac->chip);
1462 
1463 		spin_lock_irq(&mac->lock);
1464 		mac->beacon.last_update = jiffies;
1465 		spin_unlock_irq(&mac->lock);
1466 	}
1467 
1468 rearm:
1469 	queue_delayed_work(zd_workqueue, &mac->beacon.watchdog_work,
1470 			   BEACON_WATCHDOG_DELAY);
1471 }
1472 
1473 static void beacon_init(struct zd_mac *mac)
1474 {
1475 	INIT_DELAYED_WORK(&mac->beacon.watchdog_work, beacon_watchdog_handler);
1476 }
1477 
1478 static void beacon_enable(struct zd_mac *mac)
1479 {
1480 	dev_dbg_f(zd_mac_dev(mac), "\n");
1481 
1482 	mac->beacon.last_update = jiffies;
1483 	queue_delayed_work(zd_workqueue, &mac->beacon.watchdog_work,
1484 			   BEACON_WATCHDOG_DELAY);
1485 }
1486 
1487 static void beacon_disable(struct zd_mac *mac)
1488 {
1489 	dev_dbg_f(zd_mac_dev(mac), "\n");
1490 	cancel_delayed_work_sync(&mac->beacon.watchdog_work);
1491 
1492 	zd_mac_free_cur_beacon(mac);
1493 }
1494 
1495 #define LINK_LED_WORK_DELAY HZ
1496 
1497 static void link_led_handler(struct work_struct *work)
1498 {
1499 	struct zd_mac *mac =
1500 		container_of(work, struct zd_mac, housekeeping.link_led_work.work);
1501 	struct zd_chip *chip = &mac->chip;
1502 	int is_associated;
1503 	int r;
1504 
1505 	if (!test_bit(ZD_DEVICE_RUNNING, &mac->flags))
1506 		goto requeue;
1507 
1508 	spin_lock_irq(&mac->lock);
1509 	is_associated = mac->associated;
1510 	spin_unlock_irq(&mac->lock);
1511 
1512 	r = zd_chip_control_leds(chip,
1513 		                 is_associated ? ZD_LED_ASSOCIATED : ZD_LED_SCANNING);
1514 	if (r)
1515 		dev_dbg_f(zd_mac_dev(mac), "zd_chip_control_leds error %d\n", r);
1516 
1517 requeue:
1518 	queue_delayed_work(zd_workqueue, &mac->housekeeping.link_led_work,
1519 		           LINK_LED_WORK_DELAY);
1520 }
1521 
1522 static void housekeeping_init(struct zd_mac *mac)
1523 {
1524 	INIT_DELAYED_WORK(&mac->housekeeping.link_led_work, link_led_handler);
1525 }
1526 
1527 static void housekeeping_enable(struct zd_mac *mac)
1528 {
1529 	dev_dbg_f(zd_mac_dev(mac), "\n");
1530 	queue_delayed_work(zd_workqueue, &mac->housekeeping.link_led_work,
1531 			   0);
1532 }
1533 
1534 static void housekeeping_disable(struct zd_mac *mac)
1535 {
1536 	dev_dbg_f(zd_mac_dev(mac), "\n");
1537 	cancel_delayed_work_sync(&mac->housekeeping.link_led_work);
1538 	zd_chip_control_leds(&mac->chip, ZD_LED_OFF);
1539 }
1540