1 /* ZD1211 USB-WLAN driver for Linux
2  *
3  * Copyright (C) 2005-2007 Ulrich Kunitz <kune@deine-taler.de>
4  * Copyright (C) 2006-2007 Daniel Drake <dsd@gentoo.org>
5  * Copyright (C) 2006-2007 Michael Wu <flamingice@sourmilk.net>
6  * Copyright (C) 2007-2008 Luis R. Rodriguez <mcgrof@winlab.rutgers.edu>
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
20  */
21 
22 #include <linux/netdevice.h>
23 #include <linux/etherdevice.h>
24 #include <linux/slab.h>
25 #include <linux/usb.h>
26 #include <linux/jiffies.h>
27 #include <net/ieee80211_radiotap.h>
28 
29 #include "zd_def.h"
30 #include "zd_chip.h"
31 #include "zd_mac.h"
32 #include "zd_rf.h"
33 
34 struct zd_reg_alpha2_map {
35 	u32 reg;
36 	char alpha2[2];
37 };
38 
39 static struct zd_reg_alpha2_map reg_alpha2_map[] = {
40 	{ ZD_REGDOMAIN_FCC, "US" },
41 	{ ZD_REGDOMAIN_IC, "CA" },
42 	{ ZD_REGDOMAIN_ETSI, "DE" }, /* Generic ETSI, use most restrictive */
43 	{ ZD_REGDOMAIN_JAPAN, "JP" },
44 	{ ZD_REGDOMAIN_JAPAN_2, "JP" },
45 	{ ZD_REGDOMAIN_JAPAN_3, "JP" },
46 	{ ZD_REGDOMAIN_SPAIN, "ES" },
47 	{ ZD_REGDOMAIN_FRANCE, "FR" },
48 };
49 
50 /* This table contains the hardware specific values for the modulation rates. */
51 static const struct ieee80211_rate zd_rates[] = {
52 	{ .bitrate = 10,
53 	  .hw_value = ZD_CCK_RATE_1M, },
54 	{ .bitrate = 20,
55 	  .hw_value = ZD_CCK_RATE_2M,
56 	  .hw_value_short = ZD_CCK_RATE_2M | ZD_CCK_PREA_SHORT,
57 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
58 	{ .bitrate = 55,
59 	  .hw_value = ZD_CCK_RATE_5_5M,
60 	  .hw_value_short = ZD_CCK_RATE_5_5M | ZD_CCK_PREA_SHORT,
61 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
62 	{ .bitrate = 110,
63 	  .hw_value = ZD_CCK_RATE_11M,
64 	  .hw_value_short = ZD_CCK_RATE_11M | ZD_CCK_PREA_SHORT,
65 	  .flags = IEEE80211_RATE_SHORT_PREAMBLE },
66 	{ .bitrate = 60,
67 	  .hw_value = ZD_OFDM_RATE_6M,
68 	  .flags = 0 },
69 	{ .bitrate = 90,
70 	  .hw_value = ZD_OFDM_RATE_9M,
71 	  .flags = 0 },
72 	{ .bitrate = 120,
73 	  .hw_value = ZD_OFDM_RATE_12M,
74 	  .flags = 0 },
75 	{ .bitrate = 180,
76 	  .hw_value = ZD_OFDM_RATE_18M,
77 	  .flags = 0 },
78 	{ .bitrate = 240,
79 	  .hw_value = ZD_OFDM_RATE_24M,
80 	  .flags = 0 },
81 	{ .bitrate = 360,
82 	  .hw_value = ZD_OFDM_RATE_36M,
83 	  .flags = 0 },
84 	{ .bitrate = 480,
85 	  .hw_value = ZD_OFDM_RATE_48M,
86 	  .flags = 0 },
87 	{ .bitrate = 540,
88 	  .hw_value = ZD_OFDM_RATE_54M,
89 	  .flags = 0 },
90 };
91 
92 /*
93  * Zydas retry rates table. Each line is listed in the same order as
94  * in zd_rates[] and contains all the rate used when a packet is sent
95  * starting with a given rates. Let's consider an example :
96  *
97  * "11 Mbits : 4, 3, 2, 1, 0" means :
98  * - packet is sent using 4 different rates
99  * - 1st rate is index 3 (ie 11 Mbits)
100  * - 2nd rate is index 2 (ie 5.5 Mbits)
101  * - 3rd rate is index 1 (ie 2 Mbits)
102  * - 4th rate is index 0 (ie 1 Mbits)
103  */
104 
105 static const struct tx_retry_rate zd_retry_rates[] = {
106 	{ /*  1 Mbits */	1, { 0 }},
107 	{ /*  2 Mbits */	2, { 1,  0 }},
108 	{ /*  5.5 Mbits */	3, { 2,  1, 0 }},
109 	{ /* 11 Mbits */	4, { 3,  2, 1, 0 }},
110 	{ /*  6 Mbits */	5, { 4,  3, 2, 1, 0 }},
111 	{ /*  9 Mbits */	6, { 5,  4, 3, 2, 1, 0}},
112 	{ /* 12 Mbits */	5, { 6,  3, 2, 1, 0 }},
113 	{ /* 18 Mbits */	6, { 7,  6, 3, 2, 1, 0 }},
114 	{ /* 24 Mbits */	6, { 8,  6, 3, 2, 1, 0 }},
115 	{ /* 36 Mbits */	7, { 9,  8, 6, 3, 2, 1, 0 }},
116 	{ /* 48 Mbits */	8, {10,  9, 8, 6, 3, 2, 1, 0 }},
117 	{ /* 54 Mbits */	9, {11, 10, 9, 8, 6, 3, 2, 1, 0 }}
118 };
119 
120 static const struct ieee80211_channel zd_channels[] = {
121 	{ .center_freq = 2412, .hw_value = 1 },
122 	{ .center_freq = 2417, .hw_value = 2 },
123 	{ .center_freq = 2422, .hw_value = 3 },
124 	{ .center_freq = 2427, .hw_value = 4 },
125 	{ .center_freq = 2432, .hw_value = 5 },
126 	{ .center_freq = 2437, .hw_value = 6 },
127 	{ .center_freq = 2442, .hw_value = 7 },
128 	{ .center_freq = 2447, .hw_value = 8 },
129 	{ .center_freq = 2452, .hw_value = 9 },
130 	{ .center_freq = 2457, .hw_value = 10 },
131 	{ .center_freq = 2462, .hw_value = 11 },
132 	{ .center_freq = 2467, .hw_value = 12 },
133 	{ .center_freq = 2472, .hw_value = 13 },
134 	{ .center_freq = 2484, .hw_value = 14 },
135 };
136 
137 static void housekeeping_init(struct zd_mac *mac);
138 static void housekeeping_enable(struct zd_mac *mac);
139 static void housekeeping_disable(struct zd_mac *mac);
140 static void beacon_init(struct zd_mac *mac);
141 static void beacon_enable(struct zd_mac *mac);
142 static void beacon_disable(struct zd_mac *mac);
143 static void set_rts_cts(struct zd_mac *mac, unsigned int short_preamble);
144 static int zd_mac_config_beacon(struct ieee80211_hw *hw,
145 				struct sk_buff *beacon, bool in_intr);
146 
147 static int zd_reg2alpha2(u8 regdomain, char *alpha2)
148 {
149 	unsigned int i;
150 	struct zd_reg_alpha2_map *reg_map;
151 	for (i = 0; i < ARRAY_SIZE(reg_alpha2_map); i++) {
152 		reg_map = &reg_alpha2_map[i];
153 		if (regdomain == reg_map->reg) {
154 			alpha2[0] = reg_map->alpha2[0];
155 			alpha2[1] = reg_map->alpha2[1];
156 			return 0;
157 		}
158 	}
159 	return 1;
160 }
161 
162 static int zd_check_signal(struct ieee80211_hw *hw, int signal)
163 {
164 	struct zd_mac *mac = zd_hw_mac(hw);
165 
166 	dev_dbg_f_cond(zd_mac_dev(mac), signal < 0 || signal > 100,
167 			"%s: signal value from device not in range 0..100, "
168 			"but %d.\n", __func__, signal);
169 
170 	if (signal < 0)
171 		signal = 0;
172 	else if (signal > 100)
173 		signal = 100;
174 
175 	return signal;
176 }
177 
178 int zd_mac_preinit_hw(struct ieee80211_hw *hw)
179 {
180 	int r;
181 	u8 addr[ETH_ALEN];
182 	struct zd_mac *mac = zd_hw_mac(hw);
183 
184 	r = zd_chip_read_mac_addr_fw(&mac->chip, addr);
185 	if (r)
186 		return r;
187 
188 	SET_IEEE80211_PERM_ADDR(hw, addr);
189 
190 	return 0;
191 }
192 
193 int zd_mac_init_hw(struct ieee80211_hw *hw)
194 {
195 	int r;
196 	struct zd_mac *mac = zd_hw_mac(hw);
197 	struct zd_chip *chip = &mac->chip;
198 	char alpha2[2];
199 	u8 default_regdomain;
200 
201 	r = zd_chip_enable_int(chip);
202 	if (r)
203 		goto out;
204 	r = zd_chip_init_hw(chip);
205 	if (r)
206 		goto disable_int;
207 
208 	ZD_ASSERT(!irqs_disabled());
209 
210 	r = zd_read_regdomain(chip, &default_regdomain);
211 	if (r)
212 		goto disable_int;
213 	spin_lock_irq(&mac->lock);
214 	mac->regdomain = mac->default_regdomain = default_regdomain;
215 	spin_unlock_irq(&mac->lock);
216 
217 	/* We must inform the device that we are doing encryption/decryption in
218 	 * software at the moment. */
219 	r = zd_set_encryption_type(chip, ENC_SNIFFER);
220 	if (r)
221 		goto disable_int;
222 
223 	r = zd_reg2alpha2(mac->regdomain, alpha2);
224 	if (r)
225 		goto disable_int;
226 
227 	r = regulatory_hint(hw->wiphy, alpha2);
228 disable_int:
229 	zd_chip_disable_int(chip);
230 out:
231 	return r;
232 }
233 
234 void zd_mac_clear(struct zd_mac *mac)
235 {
236 	flush_workqueue(zd_workqueue);
237 	zd_chip_clear(&mac->chip);
238 	lockdep_assert_held(&mac->lock);
239 	ZD_MEMCLEAR(mac, sizeof(struct zd_mac));
240 }
241 
242 static int set_rx_filter(struct zd_mac *mac)
243 {
244 	unsigned long flags;
245 	u32 filter = STA_RX_FILTER;
246 
247 	spin_lock_irqsave(&mac->lock, flags);
248 	if (mac->pass_ctrl)
249 		filter |= RX_FILTER_CTRL;
250 	spin_unlock_irqrestore(&mac->lock, flags);
251 
252 	return zd_iowrite32(&mac->chip, CR_RX_FILTER, filter);
253 }
254 
255 static int set_mac_and_bssid(struct zd_mac *mac)
256 {
257 	int r;
258 
259 	if (!mac->vif)
260 		return -1;
261 
262 	r = zd_write_mac_addr(&mac->chip, mac->vif->addr);
263 	if (r)
264 		return r;
265 
266 	/* Vendor driver after setting MAC either sets BSSID for AP or
267 	 * filter for other modes.
268 	 */
269 	if (mac->type != NL80211_IFTYPE_AP)
270 		return set_rx_filter(mac);
271 	else
272 		return zd_write_bssid(&mac->chip, mac->vif->addr);
273 }
274 
275 static int set_mc_hash(struct zd_mac *mac)
276 {
277 	struct zd_mc_hash hash;
278 	zd_mc_clear(&hash);
279 	return zd_chip_set_multicast_hash(&mac->chip, &hash);
280 }
281 
282 int zd_op_start(struct ieee80211_hw *hw)
283 {
284 	struct zd_mac *mac = zd_hw_mac(hw);
285 	struct zd_chip *chip = &mac->chip;
286 	struct zd_usb *usb = &chip->usb;
287 	int r;
288 
289 	if (!usb->initialized) {
290 		r = zd_usb_init_hw(usb);
291 		if (r)
292 			goto out;
293 	}
294 
295 	r = zd_chip_enable_int(chip);
296 	if (r < 0)
297 		goto out;
298 
299 	r = zd_chip_set_basic_rates(chip, CR_RATES_80211B | CR_RATES_80211G);
300 	if (r < 0)
301 		goto disable_int;
302 	r = set_rx_filter(mac);
303 	if (r)
304 		goto disable_int;
305 	r = set_mc_hash(mac);
306 	if (r)
307 		goto disable_int;
308 
309 	/* Wait after setting the multicast hash table and powering on
310 	 * the radio otherwise interface bring up will fail. This matches
311 	 * what the vendor driver did.
312 	 */
313 	msleep(10);
314 
315 	r = zd_chip_switch_radio_on(chip);
316 	if (r < 0) {
317 		dev_err(zd_chip_dev(chip),
318 			"%s: failed to set radio on\n", __func__);
319 		goto disable_int;
320 	}
321 	r = zd_chip_enable_rxtx(chip);
322 	if (r < 0)
323 		goto disable_radio;
324 	r = zd_chip_enable_hwint(chip);
325 	if (r < 0)
326 		goto disable_rxtx;
327 
328 	housekeeping_enable(mac);
329 	beacon_enable(mac);
330 	set_bit(ZD_DEVICE_RUNNING, &mac->flags);
331 	return 0;
332 disable_rxtx:
333 	zd_chip_disable_rxtx(chip);
334 disable_radio:
335 	zd_chip_switch_radio_off(chip);
336 disable_int:
337 	zd_chip_disable_int(chip);
338 out:
339 	return r;
340 }
341 
342 void zd_op_stop(struct ieee80211_hw *hw)
343 {
344 	struct zd_mac *mac = zd_hw_mac(hw);
345 	struct zd_chip *chip = &mac->chip;
346 	struct sk_buff *skb;
347 	struct sk_buff_head *ack_wait_queue = &mac->ack_wait_queue;
348 
349 	clear_bit(ZD_DEVICE_RUNNING, &mac->flags);
350 
351 	/* The order here deliberately is a little different from the open()
352 	 * method, since we need to make sure there is no opportunity for RX
353 	 * frames to be processed by mac80211 after we have stopped it.
354 	 */
355 
356 	zd_chip_disable_rxtx(chip);
357 	beacon_disable(mac);
358 	housekeeping_disable(mac);
359 	flush_workqueue(zd_workqueue);
360 
361 	zd_chip_disable_hwint(chip);
362 	zd_chip_switch_radio_off(chip);
363 	zd_chip_disable_int(chip);
364 
365 
366 	while ((skb = skb_dequeue(ack_wait_queue)))
367 		dev_kfree_skb_any(skb);
368 }
369 
370 int zd_restore_settings(struct zd_mac *mac)
371 {
372 	struct sk_buff *beacon;
373 	struct zd_mc_hash multicast_hash;
374 	unsigned int short_preamble;
375 	int r, beacon_interval, beacon_period;
376 	u8 channel;
377 
378 	dev_dbg_f(zd_mac_dev(mac), "\n");
379 
380 	spin_lock_irq(&mac->lock);
381 	multicast_hash = mac->multicast_hash;
382 	short_preamble = mac->short_preamble;
383 	beacon_interval = mac->beacon.interval;
384 	beacon_period = mac->beacon.period;
385 	channel = mac->channel;
386 	spin_unlock_irq(&mac->lock);
387 
388 	r = set_mac_and_bssid(mac);
389 	if (r < 0) {
390 		dev_dbg_f(zd_mac_dev(mac), "set_mac_and_bssid failed, %d\n", r);
391 		return r;
392 	}
393 
394 	r = zd_chip_set_channel(&mac->chip, channel);
395 	if (r < 0) {
396 		dev_dbg_f(zd_mac_dev(mac), "zd_chip_set_channel failed, %d\n",
397 			  r);
398 		return r;
399 	}
400 
401 	set_rts_cts(mac, short_preamble);
402 
403 	r = zd_chip_set_multicast_hash(&mac->chip, &multicast_hash);
404 	if (r < 0) {
405 		dev_dbg_f(zd_mac_dev(mac),
406 			  "zd_chip_set_multicast_hash failed, %d\n", r);
407 		return r;
408 	}
409 
410 	if (mac->type == NL80211_IFTYPE_MESH_POINT ||
411 	    mac->type == NL80211_IFTYPE_ADHOC ||
412 	    mac->type == NL80211_IFTYPE_AP) {
413 		if (mac->vif != NULL) {
414 			beacon = ieee80211_beacon_get(mac->hw, mac->vif);
415 			if (beacon)
416 				zd_mac_config_beacon(mac->hw, beacon, false);
417 		}
418 
419 		zd_set_beacon_interval(&mac->chip, beacon_interval,
420 					beacon_period, mac->type);
421 
422 		spin_lock_irq(&mac->lock);
423 		mac->beacon.last_update = jiffies;
424 		spin_unlock_irq(&mac->lock);
425 	}
426 
427 	return 0;
428 }
429 
430 /**
431  * zd_mac_tx_status - reports tx status of a packet if required
432  * @hw - a &struct ieee80211_hw pointer
433  * @skb - a sk-buffer
434  * @flags: extra flags to set in the TX status info
435  * @ackssi: ACK signal strength
436  * @success - True for successful transmission of the frame
437  *
438  * This information calls ieee80211_tx_status_irqsafe() if required by the
439  * control information. It copies the control information into the status
440  * information.
441  *
442  * If no status information has been requested, the skb is freed.
443  */
444 static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
445 		      int ackssi, struct tx_status *tx_status)
446 {
447 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
448 	int i;
449 	int success = 1, retry = 1;
450 	int first_idx;
451 	const struct tx_retry_rate *retries;
452 
453 	ieee80211_tx_info_clear_status(info);
454 
455 	if (tx_status) {
456 		success = !tx_status->failure;
457 		retry = tx_status->retry + success;
458 	}
459 
460 	if (success) {
461 		/* success */
462 		info->flags |= IEEE80211_TX_STAT_ACK;
463 	} else {
464 		/* failure */
465 		info->flags &= ~IEEE80211_TX_STAT_ACK;
466 	}
467 
468 	first_idx = info->status.rates[0].idx;
469 	ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
470 	retries = &zd_retry_rates[first_idx];
471 	ZD_ASSERT(1 <= retry && retry <= retries->count);
472 
473 	info->status.rates[0].idx = retries->rate[0];
474 	info->status.rates[0].count = 1; // (retry > 1 ? 2 : 1);
475 
476 	for (i=1; i<IEEE80211_TX_MAX_RATES-1 && i<retry; i++) {
477 		info->status.rates[i].idx = retries->rate[i];
478 		info->status.rates[i].count = 1; // ((i==retry-1) && success ? 1:2);
479 	}
480 	for (; i<IEEE80211_TX_MAX_RATES && i<retry; i++) {
481 		info->status.rates[i].idx = retries->rate[retry - 1];
482 		info->status.rates[i].count = 1; // (success ? 1:2);
483 	}
484 	if (i<IEEE80211_TX_MAX_RATES)
485 		info->status.rates[i].idx = -1; /* terminate */
486 
487 	info->status.ack_signal = zd_check_signal(hw, ackssi);
488 	ieee80211_tx_status_irqsafe(hw, skb);
489 }
490 
491 /**
492  * zd_mac_tx_failed - callback for failed frames
493  * @dev: the mac80211 wireless device
494  *
495  * This function is called if a frame couldn't be successfully
496  * transferred. The first frame from the tx queue, will be selected and
497  * reported as error to the upper layers.
498  */
499 void zd_mac_tx_failed(struct urb *urb)
500 {
501 	struct ieee80211_hw * hw = zd_usb_to_hw(urb->context);
502 	struct zd_mac *mac = zd_hw_mac(hw);
503 	struct sk_buff_head *q = &mac->ack_wait_queue;
504 	struct sk_buff *skb;
505 	struct tx_status *tx_status = (struct tx_status *)urb->transfer_buffer;
506 	unsigned long flags;
507 	int success = !tx_status->failure;
508 	int retry = tx_status->retry + success;
509 	int found = 0;
510 	int i, position = 0;
511 
512 	spin_lock_irqsave(&q->lock, flags);
513 
514 	skb_queue_walk(q, skb) {
515 		struct ieee80211_hdr *tx_hdr;
516 		struct ieee80211_tx_info *info;
517 		int first_idx, final_idx;
518 		const struct tx_retry_rate *retries;
519 		u8 final_rate;
520 
521 		position ++;
522 
523 		/* if the hardware reports a failure and we had a 802.11 ACK
524 		 * pending, then we skip the first skb when searching for a
525 		 * matching frame */
526 		if (tx_status->failure && mac->ack_pending &&
527 		    skb_queue_is_first(q, skb)) {
528 			continue;
529 		}
530 
531 		tx_hdr = (struct ieee80211_hdr *)skb->data;
532 
533 		/* we skip all frames not matching the reported destination */
534 		if (unlikely(!ether_addr_equal(tx_hdr->addr1, tx_status->mac)))
535 			continue;
536 
537 		/* we skip all frames not matching the reported final rate */
538 
539 		info = IEEE80211_SKB_CB(skb);
540 		first_idx = info->status.rates[0].idx;
541 		ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
542 		retries = &zd_retry_rates[first_idx];
543 		if (retry <= 0 || retry > retries->count)
544 			continue;
545 
546 		final_idx = retries->rate[retry - 1];
547 		final_rate = zd_rates[final_idx].hw_value;
548 
549 		if (final_rate != tx_status->rate) {
550 			continue;
551 		}
552 
553 		found = 1;
554 		break;
555 	}
556 
557 	if (found) {
558 		for (i=1; i<=position; i++) {
559 			skb = __skb_dequeue(q);
560 			zd_mac_tx_status(hw, skb,
561 					 mac->ack_pending ? mac->ack_signal : 0,
562 					 i == position ? tx_status : NULL);
563 			mac->ack_pending = 0;
564 		}
565 	}
566 
567 	spin_unlock_irqrestore(&q->lock, flags);
568 }
569 
570 /**
571  * zd_mac_tx_to_dev - callback for USB layer
572  * @skb: a &sk_buff pointer
573  * @error: error value, 0 if transmission successful
574  *
575  * Informs the MAC layer that the frame has successfully transferred to the
576  * device. If an ACK is required and the transfer to the device has been
577  * successful, the packets are put on the @ack_wait_queue with
578  * the control set removed.
579  */
580 void zd_mac_tx_to_dev(struct sk_buff *skb, int error)
581 {
582 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
583 	struct ieee80211_hw *hw = info->rate_driver_data[0];
584 	struct zd_mac *mac = zd_hw_mac(hw);
585 
586 	ieee80211_tx_info_clear_status(info);
587 
588 	skb_pull(skb, sizeof(struct zd_ctrlset));
589 	if (unlikely(error ||
590 	    (info->flags & IEEE80211_TX_CTL_NO_ACK))) {
591 		/*
592 		 * FIXME : do we need to fill in anything ?
593 		 */
594 		ieee80211_tx_status_irqsafe(hw, skb);
595 	} else {
596 		struct sk_buff_head *q = &mac->ack_wait_queue;
597 
598 		skb_queue_tail(q, skb);
599 		while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS) {
600 			zd_mac_tx_status(hw, skb_dequeue(q),
601 					 mac->ack_pending ? mac->ack_signal : 0,
602 					 NULL);
603 			mac->ack_pending = 0;
604 		}
605 	}
606 }
607 
608 static int zd_calc_tx_length_us(u8 *service, u8 zd_rate, u16 tx_length)
609 {
610 	/* ZD_PURE_RATE() must be used to remove the modulation type flag of
611 	 * the zd-rate values.
612 	 */
613 	static const u8 rate_divisor[] = {
614 		[ZD_PURE_RATE(ZD_CCK_RATE_1M)]   =  1,
615 		[ZD_PURE_RATE(ZD_CCK_RATE_2M)]	 =  2,
616 		/* Bits must be doubled. */
617 		[ZD_PURE_RATE(ZD_CCK_RATE_5_5M)] = 11,
618 		[ZD_PURE_RATE(ZD_CCK_RATE_11M)]	 = 11,
619 		[ZD_PURE_RATE(ZD_OFDM_RATE_6M)]  =  6,
620 		[ZD_PURE_RATE(ZD_OFDM_RATE_9M)]  =  9,
621 		[ZD_PURE_RATE(ZD_OFDM_RATE_12M)] = 12,
622 		[ZD_PURE_RATE(ZD_OFDM_RATE_18M)] = 18,
623 		[ZD_PURE_RATE(ZD_OFDM_RATE_24M)] = 24,
624 		[ZD_PURE_RATE(ZD_OFDM_RATE_36M)] = 36,
625 		[ZD_PURE_RATE(ZD_OFDM_RATE_48M)] = 48,
626 		[ZD_PURE_RATE(ZD_OFDM_RATE_54M)] = 54,
627 	};
628 
629 	u32 bits = (u32)tx_length * 8;
630 	u32 divisor;
631 
632 	divisor = rate_divisor[ZD_PURE_RATE(zd_rate)];
633 	if (divisor == 0)
634 		return -EINVAL;
635 
636 	switch (zd_rate) {
637 	case ZD_CCK_RATE_5_5M:
638 		bits = (2*bits) + 10; /* round up to the next integer */
639 		break;
640 	case ZD_CCK_RATE_11M:
641 		if (service) {
642 			u32 t = bits % 11;
643 			*service &= ~ZD_PLCP_SERVICE_LENGTH_EXTENSION;
644 			if (0 < t && t <= 3) {
645 				*service |= ZD_PLCP_SERVICE_LENGTH_EXTENSION;
646 			}
647 		}
648 		bits += 10; /* round up to the next integer */
649 		break;
650 	}
651 
652 	return bits/divisor;
653 }
654 
655 static void cs_set_control(struct zd_mac *mac, struct zd_ctrlset *cs,
656 	                   struct ieee80211_hdr *header,
657 	                   struct ieee80211_tx_info *info)
658 {
659 	/*
660 	 * CONTROL TODO:
661 	 * - if backoff needed, enable bit 0
662 	 * - if burst (backoff not needed) disable bit 0
663 	 */
664 
665 	cs->control = 0;
666 
667 	/* First fragment */
668 	if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
669 		cs->control |= ZD_CS_NEED_RANDOM_BACKOFF;
670 
671 	/* No ACK expected (multicast, etc.) */
672 	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
673 		cs->control |= ZD_CS_NO_ACK;
674 
675 	/* PS-POLL */
676 	if (ieee80211_is_pspoll(header->frame_control))
677 		cs->control |= ZD_CS_PS_POLL_FRAME;
678 
679 	if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
680 		cs->control |= ZD_CS_RTS;
681 
682 	if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
683 		cs->control |= ZD_CS_SELF_CTS;
684 
685 	/* FIXME: Management frame? */
686 }
687 
688 static bool zd_mac_match_cur_beacon(struct zd_mac *mac, struct sk_buff *beacon)
689 {
690 	if (!mac->beacon.cur_beacon)
691 		return false;
692 
693 	if (mac->beacon.cur_beacon->len != beacon->len)
694 		return false;
695 
696 	return !memcmp(beacon->data, mac->beacon.cur_beacon->data, beacon->len);
697 }
698 
699 static void zd_mac_free_cur_beacon_locked(struct zd_mac *mac)
700 {
701 	ZD_ASSERT(mutex_is_locked(&mac->chip.mutex));
702 
703 	kfree_skb(mac->beacon.cur_beacon);
704 	mac->beacon.cur_beacon = NULL;
705 }
706 
707 static void zd_mac_free_cur_beacon(struct zd_mac *mac)
708 {
709 	mutex_lock(&mac->chip.mutex);
710 	zd_mac_free_cur_beacon_locked(mac);
711 	mutex_unlock(&mac->chip.mutex);
712 }
713 
714 static int zd_mac_config_beacon(struct ieee80211_hw *hw, struct sk_buff *beacon,
715 				bool in_intr)
716 {
717 	struct zd_mac *mac = zd_hw_mac(hw);
718 	int r, ret, num_cmds, req_pos = 0;
719 	u32 tmp, j = 0;
720 	/* 4 more bytes for tail CRC */
721 	u32 full_len = beacon->len + 4;
722 	unsigned long end_jiffies, message_jiffies;
723 	struct zd_ioreq32 *ioreqs;
724 
725 	mutex_lock(&mac->chip.mutex);
726 
727 	/* Check if hw already has this beacon. */
728 	if (zd_mac_match_cur_beacon(mac, beacon)) {
729 		r = 0;
730 		goto out_nofree;
731 	}
732 
733 	/* Alloc memory for full beacon write at once. */
734 	num_cmds = 1 + zd_chip_is_zd1211b(&mac->chip) + full_len;
735 	ioreqs = kmalloc_array(num_cmds, sizeof(struct zd_ioreq32),
736 			       GFP_KERNEL);
737 	if (!ioreqs) {
738 		r = -ENOMEM;
739 		goto out_nofree;
740 	}
741 
742 	r = zd_iowrite32_locked(&mac->chip, 0, CR_BCN_FIFO_SEMAPHORE);
743 	if (r < 0)
744 		goto out;
745 	r = zd_ioread32_locked(&mac->chip, &tmp, CR_BCN_FIFO_SEMAPHORE);
746 	if (r < 0)
747 		goto release_sema;
748 	if (in_intr && tmp & 0x2) {
749 		r = -EBUSY;
750 		goto release_sema;
751 	}
752 
753 	end_jiffies = jiffies + HZ / 2; /*~500ms*/
754 	message_jiffies = jiffies + HZ / 10; /*~100ms*/
755 	while (tmp & 0x2) {
756 		r = zd_ioread32_locked(&mac->chip, &tmp, CR_BCN_FIFO_SEMAPHORE);
757 		if (r < 0)
758 			goto release_sema;
759 		if (time_is_before_eq_jiffies(message_jiffies)) {
760 			message_jiffies = jiffies + HZ / 10;
761 			dev_err(zd_mac_dev(mac),
762 					"CR_BCN_FIFO_SEMAPHORE not ready\n");
763 			if (time_is_before_eq_jiffies(end_jiffies))  {
764 				dev_err(zd_mac_dev(mac),
765 						"Giving up beacon config.\n");
766 				r = -ETIMEDOUT;
767 				goto reset_device;
768 			}
769 		}
770 		msleep(20);
771 	}
772 
773 	ioreqs[req_pos].addr = CR_BCN_FIFO;
774 	ioreqs[req_pos].value = full_len - 1;
775 	req_pos++;
776 	if (zd_chip_is_zd1211b(&mac->chip)) {
777 		ioreqs[req_pos].addr = CR_BCN_LENGTH;
778 		ioreqs[req_pos].value = full_len - 1;
779 		req_pos++;
780 	}
781 
782 	for (j = 0 ; j < beacon->len; j++) {
783 		ioreqs[req_pos].addr = CR_BCN_FIFO;
784 		ioreqs[req_pos].value = *((u8 *)(beacon->data + j));
785 		req_pos++;
786 	}
787 
788 	for (j = 0; j < 4; j++) {
789 		ioreqs[req_pos].addr = CR_BCN_FIFO;
790 		ioreqs[req_pos].value = 0x0;
791 		req_pos++;
792 	}
793 
794 	BUG_ON(req_pos != num_cmds);
795 
796 	r = zd_iowrite32a_locked(&mac->chip, ioreqs, num_cmds);
797 
798 release_sema:
799 	/*
800 	 * Try very hard to release device beacon semaphore, as otherwise
801 	 * device/driver can be left in unusable state.
802 	 */
803 	end_jiffies = jiffies + HZ / 2; /*~500ms*/
804 	ret = zd_iowrite32_locked(&mac->chip, 1, CR_BCN_FIFO_SEMAPHORE);
805 	while (ret < 0) {
806 		if (in_intr || time_is_before_eq_jiffies(end_jiffies)) {
807 			ret = -ETIMEDOUT;
808 			break;
809 		}
810 
811 		msleep(20);
812 		ret = zd_iowrite32_locked(&mac->chip, 1, CR_BCN_FIFO_SEMAPHORE);
813 	}
814 
815 	if (ret < 0)
816 		dev_err(zd_mac_dev(mac), "Could not release "
817 					 "CR_BCN_FIFO_SEMAPHORE!\n");
818 	if (r < 0 || ret < 0) {
819 		if (r >= 0)
820 			r = ret;
821 
822 		/* We don't know if beacon was written successfully or not,
823 		 * so clear current. */
824 		zd_mac_free_cur_beacon_locked(mac);
825 
826 		goto out;
827 	}
828 
829 	/* Beacon has now been written successfully, update current. */
830 	zd_mac_free_cur_beacon_locked(mac);
831 	mac->beacon.cur_beacon = beacon;
832 	beacon = NULL;
833 
834 	/* 802.11b/g 2.4G CCK 1Mb
835 	 * 802.11a, not yet implemented, uses different values (see GPL vendor
836 	 * driver)
837 	 */
838 	r = zd_iowrite32_locked(&mac->chip, 0x00000400 | (full_len << 19),
839 				CR_BCN_PLCP_CFG);
840 out:
841 	kfree(ioreqs);
842 out_nofree:
843 	kfree_skb(beacon);
844 	mutex_unlock(&mac->chip.mutex);
845 
846 	return r;
847 
848 reset_device:
849 	zd_mac_free_cur_beacon_locked(mac);
850 	kfree_skb(beacon);
851 
852 	mutex_unlock(&mac->chip.mutex);
853 	kfree(ioreqs);
854 
855 	/* semaphore stuck, reset device to avoid fw freeze later */
856 	dev_warn(zd_mac_dev(mac), "CR_BCN_FIFO_SEMAPHORE stuck, "
857 				  "resetting device...");
858 	usb_queue_reset_device(mac->chip.usb.intf);
859 
860 	return r;
861 }
862 
863 static int fill_ctrlset(struct zd_mac *mac,
864 			struct sk_buff *skb)
865 {
866 	int r;
867 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
868 	unsigned int frag_len = skb->len + FCS_LEN;
869 	unsigned int packet_length;
870 	struct ieee80211_rate *txrate;
871 	struct zd_ctrlset *cs = skb_push(skb, sizeof(struct zd_ctrlset));
872 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
873 
874 	ZD_ASSERT(frag_len <= 0xffff);
875 
876 	/*
877 	 * Firmware computes the duration itself (for all frames except PSPoll)
878 	 * and needs the field set to 0 at input, otherwise firmware messes up
879 	 * duration_id and sets bits 14 and 15 on.
880 	 */
881 	if (!ieee80211_is_pspoll(hdr->frame_control))
882 		hdr->duration_id = 0;
883 
884 	txrate = ieee80211_get_tx_rate(mac->hw, info);
885 
886 	cs->modulation = txrate->hw_value;
887 	if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
888 		cs->modulation = txrate->hw_value_short;
889 
890 	cs->tx_length = cpu_to_le16(frag_len);
891 
892 	cs_set_control(mac, cs, hdr, info);
893 
894 	packet_length = frag_len + sizeof(struct zd_ctrlset) + 10;
895 	ZD_ASSERT(packet_length <= 0xffff);
896 	/* ZD1211B: Computing the length difference this way, gives us
897 	 * flexibility to compute the packet length.
898 	 */
899 	cs->packet_length = cpu_to_le16(zd_chip_is_zd1211b(&mac->chip) ?
900 			packet_length - frag_len : packet_length);
901 
902 	/*
903 	 * CURRENT LENGTH:
904 	 * - transmit frame length in microseconds
905 	 * - seems to be derived from frame length
906 	 * - see Cal_Us_Service() in zdinlinef.h
907 	 * - if macp->bTxBurstEnable is enabled, then multiply by 4
908 	 *  - bTxBurstEnable is never set in the vendor driver
909 	 *
910 	 * SERVICE:
911 	 * - "for PLCP configuration"
912 	 * - always 0 except in some situations at 802.11b 11M
913 	 * - see line 53 of zdinlinef.h
914 	 */
915 	cs->service = 0;
916 	r = zd_calc_tx_length_us(&cs->service, ZD_RATE(cs->modulation),
917 		                 le16_to_cpu(cs->tx_length));
918 	if (r < 0)
919 		return r;
920 	cs->current_length = cpu_to_le16(r);
921 	cs->next_frame_length = 0;
922 
923 	return 0;
924 }
925 
926 /**
927  * zd_op_tx - transmits a network frame to the device
928  *
929  * @dev: mac80211 hardware device
930  * @skb: socket buffer
931  * @control: the control structure
932  *
933  * This function transmit an IEEE 802.11 network frame to the device. The
934  * control block of the skbuff will be initialized. If necessary the incoming
935  * mac80211 queues will be stopped.
936  */
937 static void zd_op_tx(struct ieee80211_hw *hw,
938 		     struct ieee80211_tx_control *control,
939 		     struct sk_buff *skb)
940 {
941 	struct zd_mac *mac = zd_hw_mac(hw);
942 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
943 	int r;
944 
945 	r = fill_ctrlset(mac, skb);
946 	if (r)
947 		goto fail;
948 
949 	info->rate_driver_data[0] = hw;
950 
951 	r = zd_usb_tx(&mac->chip.usb, skb);
952 	if (r)
953 		goto fail;
954 	return;
955 
956 fail:
957 	dev_kfree_skb(skb);
958 }
959 
960 /**
961  * filter_ack - filters incoming packets for acknowledgements
962  * @dev: the mac80211 device
963  * @rx_hdr: received header
964  * @stats: the status for the received packet
965  *
966  * This functions looks for ACK packets and tries to match them with the
967  * frames in the tx queue. If a match is found the frame will be dequeued and
968  * the upper layers is informed about the successful transmission. If
969  * mac80211 queues have been stopped and the number of frames still to be
970  * transmitted is low the queues will be opened again.
971  *
972  * Returns 1 if the frame was an ACK, 0 if it was ignored.
973  */
974 static int filter_ack(struct ieee80211_hw *hw, struct ieee80211_hdr *rx_hdr,
975 		      struct ieee80211_rx_status *stats)
976 {
977 	struct zd_mac *mac = zd_hw_mac(hw);
978 	struct sk_buff *skb;
979 	struct sk_buff_head *q;
980 	unsigned long flags;
981 	int found = 0;
982 	int i, position = 0;
983 
984 	if (!ieee80211_is_ack(rx_hdr->frame_control))
985 		return 0;
986 
987 	q = &mac->ack_wait_queue;
988 	spin_lock_irqsave(&q->lock, flags);
989 	skb_queue_walk(q, skb) {
990 		struct ieee80211_hdr *tx_hdr;
991 
992 		position ++;
993 
994 		if (mac->ack_pending && skb_queue_is_first(q, skb))
995 		    continue;
996 
997 		tx_hdr = (struct ieee80211_hdr *)skb->data;
998 		if (likely(ether_addr_equal(tx_hdr->addr2, rx_hdr->addr1)))
999 		{
1000 			found = 1;
1001 			break;
1002 		}
1003 	}
1004 
1005 	if (found) {
1006 		for (i=1; i<position; i++) {
1007 			skb = __skb_dequeue(q);
1008 			zd_mac_tx_status(hw, skb,
1009 					 mac->ack_pending ? mac->ack_signal : 0,
1010 					 NULL);
1011 			mac->ack_pending = 0;
1012 		}
1013 
1014 		mac->ack_pending = 1;
1015 		mac->ack_signal = stats->signal;
1016 
1017 		/* Prevent pending tx-packet on AP-mode */
1018 		if (mac->type == NL80211_IFTYPE_AP) {
1019 			skb = __skb_dequeue(q);
1020 			zd_mac_tx_status(hw, skb, mac->ack_signal, NULL);
1021 			mac->ack_pending = 0;
1022 		}
1023 	}
1024 
1025 	spin_unlock_irqrestore(&q->lock, flags);
1026 	return 1;
1027 }
1028 
1029 int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
1030 {
1031 	struct zd_mac *mac = zd_hw_mac(hw);
1032 	struct ieee80211_rx_status stats;
1033 	const struct rx_status *status;
1034 	struct sk_buff *skb;
1035 	int bad_frame = 0;
1036 	__le16 fc;
1037 	int need_padding;
1038 	int i;
1039 	u8 rate;
1040 
1041 	if (length < ZD_PLCP_HEADER_SIZE + 10 /* IEEE80211_1ADDR_LEN */ +
1042 	             FCS_LEN + sizeof(struct rx_status))
1043 		return -EINVAL;
1044 
1045 	memset(&stats, 0, sizeof(stats));
1046 
1047 	/* Note about pass_failed_fcs and pass_ctrl access below:
1048 	 * mac locking intentionally omitted here, as this is the only unlocked
1049 	 * reader and the only writer is configure_filter. Plus, if there were
1050 	 * any races accessing these variables, it wouldn't really matter.
1051 	 * If mac80211 ever provides a way for us to access filter flags
1052 	 * from outside configure_filter, we could improve on this. Also, this
1053 	 * situation may change once we implement some kind of DMA-into-skb
1054 	 * RX path. */
1055 
1056 	/* Caller has to ensure that length >= sizeof(struct rx_status). */
1057 	status = (struct rx_status *)
1058 		(buffer + (length - sizeof(struct rx_status)));
1059 	if (status->frame_status & ZD_RX_ERROR) {
1060 		if (mac->pass_failed_fcs &&
1061 				(status->frame_status & ZD_RX_CRC32_ERROR)) {
1062 			stats.flag |= RX_FLAG_FAILED_FCS_CRC;
1063 			bad_frame = 1;
1064 		} else {
1065 			return -EINVAL;
1066 		}
1067 	}
1068 
1069 	stats.freq = zd_channels[_zd_chip_get_channel(&mac->chip) - 1].center_freq;
1070 	stats.band = NL80211_BAND_2GHZ;
1071 	stats.signal = zd_check_signal(hw, status->signal_strength);
1072 
1073 	rate = zd_rx_rate(buffer, status);
1074 
1075 	/* todo: return index in the big switches in zd_rx_rate instead */
1076 	for (i = 0; i < mac->band.n_bitrates; i++)
1077 		if (rate == mac->band.bitrates[i].hw_value)
1078 			stats.rate_idx = i;
1079 
1080 	length -= ZD_PLCP_HEADER_SIZE + sizeof(struct rx_status);
1081 	buffer += ZD_PLCP_HEADER_SIZE;
1082 
1083 	/* Except for bad frames, filter each frame to see if it is an ACK, in
1084 	 * which case our internal TX tracking is updated. Normally we then
1085 	 * bail here as there's no need to pass ACKs on up to the stack, but
1086 	 * there is also the case where the stack has requested us to pass
1087 	 * control frames on up (pass_ctrl) which we must consider. */
1088 	if (!bad_frame &&
1089 			filter_ack(hw, (struct ieee80211_hdr *)buffer, &stats)
1090 			&& !mac->pass_ctrl)
1091 		return 0;
1092 
1093 	fc = get_unaligned((__le16*)buffer);
1094 	need_padding = ieee80211_is_data_qos(fc) ^ ieee80211_has_a4(fc);
1095 
1096 	skb = dev_alloc_skb(length + (need_padding ? 2 : 0));
1097 	if (skb == NULL)
1098 		return -ENOMEM;
1099 	if (need_padding) {
1100 		/* Make sure the payload data is 4 byte aligned. */
1101 		skb_reserve(skb, 2);
1102 	}
1103 
1104 	/* FIXME : could we avoid this big memcpy ? */
1105 	skb_put_data(skb, buffer, length);
1106 
1107 	memcpy(IEEE80211_SKB_RXCB(skb), &stats, sizeof(stats));
1108 	ieee80211_rx_irqsafe(hw, skb);
1109 	return 0;
1110 }
1111 
1112 static int zd_op_add_interface(struct ieee80211_hw *hw,
1113 				struct ieee80211_vif *vif)
1114 {
1115 	struct zd_mac *mac = zd_hw_mac(hw);
1116 
1117 	/* using NL80211_IFTYPE_UNSPECIFIED to indicate no mode selected */
1118 	if (mac->type != NL80211_IFTYPE_UNSPECIFIED)
1119 		return -EOPNOTSUPP;
1120 
1121 	switch (vif->type) {
1122 	case NL80211_IFTYPE_MONITOR:
1123 	case NL80211_IFTYPE_MESH_POINT:
1124 	case NL80211_IFTYPE_STATION:
1125 	case NL80211_IFTYPE_ADHOC:
1126 	case NL80211_IFTYPE_AP:
1127 		mac->type = vif->type;
1128 		break;
1129 	default:
1130 		return -EOPNOTSUPP;
1131 	}
1132 
1133 	mac->vif = vif;
1134 
1135 	return set_mac_and_bssid(mac);
1136 }
1137 
1138 static void zd_op_remove_interface(struct ieee80211_hw *hw,
1139 				    struct ieee80211_vif *vif)
1140 {
1141 	struct zd_mac *mac = zd_hw_mac(hw);
1142 	mac->type = NL80211_IFTYPE_UNSPECIFIED;
1143 	mac->vif = NULL;
1144 	zd_set_beacon_interval(&mac->chip, 0, 0, NL80211_IFTYPE_UNSPECIFIED);
1145 	zd_write_mac_addr(&mac->chip, NULL);
1146 
1147 	zd_mac_free_cur_beacon(mac);
1148 }
1149 
1150 static int zd_op_config(struct ieee80211_hw *hw, u32 changed)
1151 {
1152 	struct zd_mac *mac = zd_hw_mac(hw);
1153 	struct ieee80211_conf *conf = &hw->conf;
1154 
1155 	spin_lock_irq(&mac->lock);
1156 	mac->channel = conf->chandef.chan->hw_value;
1157 	spin_unlock_irq(&mac->lock);
1158 
1159 	return zd_chip_set_channel(&mac->chip, conf->chandef.chan->hw_value);
1160 }
1161 
1162 static void zd_beacon_done(struct zd_mac *mac)
1163 {
1164 	struct sk_buff *skb, *beacon;
1165 
1166 	if (!test_bit(ZD_DEVICE_RUNNING, &mac->flags))
1167 		return;
1168 	if (!mac->vif || mac->vif->type != NL80211_IFTYPE_AP)
1169 		return;
1170 
1171 	/*
1172 	 * Send out buffered broad- and multicast frames.
1173 	 */
1174 	while (!ieee80211_queue_stopped(mac->hw, 0)) {
1175 		skb = ieee80211_get_buffered_bc(mac->hw, mac->vif);
1176 		if (!skb)
1177 			break;
1178 		zd_op_tx(mac->hw, NULL, skb);
1179 	}
1180 
1181 	/*
1182 	 * Fetch next beacon so that tim_count is updated.
1183 	 */
1184 	beacon = ieee80211_beacon_get(mac->hw, mac->vif);
1185 	if (beacon)
1186 		zd_mac_config_beacon(mac->hw, beacon, true);
1187 
1188 	spin_lock_irq(&mac->lock);
1189 	mac->beacon.last_update = jiffies;
1190 	spin_unlock_irq(&mac->lock);
1191 }
1192 
1193 static void zd_process_intr(struct work_struct *work)
1194 {
1195 	u16 int_status;
1196 	unsigned long flags;
1197 	struct zd_mac *mac = container_of(work, struct zd_mac, process_intr);
1198 
1199 	spin_lock_irqsave(&mac->lock, flags);
1200 	int_status = le16_to_cpu(*(__le16 *)(mac->intr_buffer + 4));
1201 	spin_unlock_irqrestore(&mac->lock, flags);
1202 
1203 	if (int_status & INT_CFG_NEXT_BCN) {
1204 		/*dev_dbg_f_limit(zd_mac_dev(mac), "INT_CFG_NEXT_BCN\n");*/
1205 		zd_beacon_done(mac);
1206 	} else {
1207 		dev_dbg_f(zd_mac_dev(mac), "Unsupported interrupt\n");
1208 	}
1209 
1210 	zd_chip_enable_hwint(&mac->chip);
1211 }
1212 
1213 
1214 static u64 zd_op_prepare_multicast(struct ieee80211_hw *hw,
1215 				   struct netdev_hw_addr_list *mc_list)
1216 {
1217 	struct zd_mac *mac = zd_hw_mac(hw);
1218 	struct zd_mc_hash hash;
1219 	struct netdev_hw_addr *ha;
1220 
1221 	zd_mc_clear(&hash);
1222 
1223 	netdev_hw_addr_list_for_each(ha, mc_list) {
1224 		dev_dbg_f(zd_mac_dev(mac), "mc addr %pM\n", ha->addr);
1225 		zd_mc_add_addr(&hash, ha->addr);
1226 	}
1227 
1228 	return hash.low | ((u64)hash.high << 32);
1229 }
1230 
1231 #define SUPPORTED_FIF_FLAGS \
1232 	(FIF_ALLMULTI | FIF_FCSFAIL | FIF_CONTROL | \
1233 	FIF_OTHER_BSS | FIF_BCN_PRBRESP_PROMISC)
1234 static void zd_op_configure_filter(struct ieee80211_hw *hw,
1235 			unsigned int changed_flags,
1236 			unsigned int *new_flags,
1237 			u64 multicast)
1238 {
1239 	struct zd_mc_hash hash = {
1240 		.low = multicast,
1241 		.high = multicast >> 32,
1242 	};
1243 	struct zd_mac *mac = zd_hw_mac(hw);
1244 	unsigned long flags;
1245 	int r;
1246 
1247 	/* Only deal with supported flags */
1248 	changed_flags &= SUPPORTED_FIF_FLAGS;
1249 	*new_flags &= SUPPORTED_FIF_FLAGS;
1250 
1251 	/*
1252 	 * If multicast parameter (as returned by zd_op_prepare_multicast)
1253 	 * has changed, no bit in changed_flags is set. To handle this
1254 	 * situation, we do not return if changed_flags is 0. If we do so,
1255 	 * we will have some issue with IPv6 which uses multicast for link
1256 	 * layer address resolution.
1257 	 */
1258 	if (*new_flags & FIF_ALLMULTI)
1259 		zd_mc_add_all(&hash);
1260 
1261 	spin_lock_irqsave(&mac->lock, flags);
1262 	mac->pass_failed_fcs = !!(*new_flags & FIF_FCSFAIL);
1263 	mac->pass_ctrl = !!(*new_flags & FIF_CONTROL);
1264 	mac->multicast_hash = hash;
1265 	spin_unlock_irqrestore(&mac->lock, flags);
1266 
1267 	zd_chip_set_multicast_hash(&mac->chip, &hash);
1268 
1269 	if (changed_flags & FIF_CONTROL) {
1270 		r = set_rx_filter(mac);
1271 		if (r)
1272 			dev_err(zd_mac_dev(mac), "set_rx_filter error %d\n", r);
1273 	}
1274 
1275 	/* no handling required for FIF_OTHER_BSS as we don't currently
1276 	 * do BSSID filtering */
1277 	/* FIXME: in future it would be nice to enable the probe response
1278 	 * filter (so that the driver doesn't see them) until
1279 	 * FIF_BCN_PRBRESP_PROMISC is set. however due to atomicity here, we'd
1280 	 * have to schedule work to enable prbresp reception, which might
1281 	 * happen too late. For now we'll just listen and forward them all the
1282 	 * time. */
1283 }
1284 
1285 static void set_rts_cts(struct zd_mac *mac, unsigned int short_preamble)
1286 {
1287 	mutex_lock(&mac->chip.mutex);
1288 	zd_chip_set_rts_cts_rate_locked(&mac->chip, short_preamble);
1289 	mutex_unlock(&mac->chip.mutex);
1290 }
1291 
1292 static void zd_op_bss_info_changed(struct ieee80211_hw *hw,
1293 				   struct ieee80211_vif *vif,
1294 				   struct ieee80211_bss_conf *bss_conf,
1295 				   u32 changes)
1296 {
1297 	struct zd_mac *mac = zd_hw_mac(hw);
1298 	int associated;
1299 
1300 	dev_dbg_f(zd_mac_dev(mac), "changes: %x\n", changes);
1301 
1302 	if (mac->type == NL80211_IFTYPE_MESH_POINT ||
1303 	    mac->type == NL80211_IFTYPE_ADHOC ||
1304 	    mac->type == NL80211_IFTYPE_AP) {
1305 		associated = true;
1306 		if (changes & BSS_CHANGED_BEACON) {
1307 			struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
1308 
1309 			if (beacon) {
1310 				zd_chip_disable_hwint(&mac->chip);
1311 				zd_mac_config_beacon(hw, beacon, false);
1312 				zd_chip_enable_hwint(&mac->chip);
1313 			}
1314 		}
1315 
1316 		if (changes & BSS_CHANGED_BEACON_ENABLED) {
1317 			u16 interval = 0;
1318 			u8 period = 0;
1319 
1320 			if (bss_conf->enable_beacon) {
1321 				period = bss_conf->dtim_period;
1322 				interval = bss_conf->beacon_int;
1323 			}
1324 
1325 			spin_lock_irq(&mac->lock);
1326 			mac->beacon.period = period;
1327 			mac->beacon.interval = interval;
1328 			mac->beacon.last_update = jiffies;
1329 			spin_unlock_irq(&mac->lock);
1330 
1331 			zd_set_beacon_interval(&mac->chip, interval, period,
1332 					       mac->type);
1333 		}
1334 	} else
1335 		associated = is_valid_ether_addr(bss_conf->bssid);
1336 
1337 	spin_lock_irq(&mac->lock);
1338 	mac->associated = associated;
1339 	spin_unlock_irq(&mac->lock);
1340 
1341 	/* TODO: do hardware bssid filtering */
1342 
1343 	if (changes & BSS_CHANGED_ERP_PREAMBLE) {
1344 		spin_lock_irq(&mac->lock);
1345 		mac->short_preamble = bss_conf->use_short_preamble;
1346 		spin_unlock_irq(&mac->lock);
1347 
1348 		set_rts_cts(mac, bss_conf->use_short_preamble);
1349 	}
1350 }
1351 
1352 static u64 zd_op_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
1353 {
1354 	struct zd_mac *mac = zd_hw_mac(hw);
1355 	return zd_chip_get_tsf(&mac->chip);
1356 }
1357 
1358 static const struct ieee80211_ops zd_ops = {
1359 	.tx			= zd_op_tx,
1360 	.start			= zd_op_start,
1361 	.stop			= zd_op_stop,
1362 	.add_interface		= zd_op_add_interface,
1363 	.remove_interface	= zd_op_remove_interface,
1364 	.config			= zd_op_config,
1365 	.prepare_multicast	= zd_op_prepare_multicast,
1366 	.configure_filter	= zd_op_configure_filter,
1367 	.bss_info_changed	= zd_op_bss_info_changed,
1368 	.get_tsf		= zd_op_get_tsf,
1369 };
1370 
1371 struct ieee80211_hw *zd_mac_alloc_hw(struct usb_interface *intf)
1372 {
1373 	struct zd_mac *mac;
1374 	struct ieee80211_hw *hw;
1375 
1376 	hw = ieee80211_alloc_hw(sizeof(struct zd_mac), &zd_ops);
1377 	if (!hw) {
1378 		dev_dbg_f(&intf->dev, "out of memory\n");
1379 		return NULL;
1380 	}
1381 
1382 	mac = zd_hw_mac(hw);
1383 
1384 	memset(mac, 0, sizeof(*mac));
1385 	spin_lock_init(&mac->lock);
1386 	mac->hw = hw;
1387 
1388 	mac->type = NL80211_IFTYPE_UNSPECIFIED;
1389 
1390 	memcpy(mac->channels, zd_channels, sizeof(zd_channels));
1391 	memcpy(mac->rates, zd_rates, sizeof(zd_rates));
1392 	mac->band.n_bitrates = ARRAY_SIZE(zd_rates);
1393 	mac->band.bitrates = mac->rates;
1394 	mac->band.n_channels = ARRAY_SIZE(zd_channels);
1395 	mac->band.channels = mac->channels;
1396 
1397 	hw->wiphy->bands[NL80211_BAND_2GHZ] = &mac->band;
1398 
1399 	ieee80211_hw_set(hw, MFP_CAPABLE);
1400 	ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
1401 	ieee80211_hw_set(hw, RX_INCLUDES_FCS);
1402 	ieee80211_hw_set(hw, SIGNAL_UNSPEC);
1403 
1404 	hw->wiphy->interface_modes =
1405 		BIT(NL80211_IFTYPE_MESH_POINT) |
1406 		BIT(NL80211_IFTYPE_STATION) |
1407 		BIT(NL80211_IFTYPE_ADHOC) |
1408 		BIT(NL80211_IFTYPE_AP);
1409 
1410 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
1411 
1412 	hw->max_signal = 100;
1413 	hw->queues = 1;
1414 	hw->extra_tx_headroom = sizeof(struct zd_ctrlset);
1415 
1416 	/*
1417 	 * Tell mac80211 that we support multi rate retries
1418 	 */
1419 	hw->max_rates = IEEE80211_TX_MAX_RATES;
1420 	hw->max_rate_tries = 18;	/* 9 rates * 2 retries/rate */
1421 
1422 	skb_queue_head_init(&mac->ack_wait_queue);
1423 	mac->ack_pending = 0;
1424 
1425 	zd_chip_init(&mac->chip, hw, intf);
1426 	housekeeping_init(mac);
1427 	beacon_init(mac);
1428 	INIT_WORK(&mac->process_intr, zd_process_intr);
1429 
1430 	SET_IEEE80211_DEV(hw, &intf->dev);
1431 	return hw;
1432 }
1433 
1434 #define BEACON_WATCHDOG_DELAY round_jiffies_relative(HZ)
1435 
1436 static void beacon_watchdog_handler(struct work_struct *work)
1437 {
1438 	struct zd_mac *mac =
1439 		container_of(work, struct zd_mac, beacon.watchdog_work.work);
1440 	struct sk_buff *beacon;
1441 	unsigned long timeout;
1442 	int interval, period;
1443 
1444 	if (!test_bit(ZD_DEVICE_RUNNING, &mac->flags))
1445 		goto rearm;
1446 	if (mac->type != NL80211_IFTYPE_AP || !mac->vif)
1447 		goto rearm;
1448 
1449 	spin_lock_irq(&mac->lock);
1450 	interval = mac->beacon.interval;
1451 	period = mac->beacon.period;
1452 	timeout = mac->beacon.last_update +
1453 			msecs_to_jiffies(interval * 1024 / 1000) * 3;
1454 	spin_unlock_irq(&mac->lock);
1455 
1456 	if (interval > 0 && time_is_before_jiffies(timeout)) {
1457 		dev_dbg_f(zd_mac_dev(mac), "beacon interrupt stalled, "
1458 					   "restarting. "
1459 					   "(interval: %d, dtim: %d)\n",
1460 					   interval, period);
1461 
1462 		zd_chip_disable_hwint(&mac->chip);
1463 
1464 		beacon = ieee80211_beacon_get(mac->hw, mac->vif);
1465 		if (beacon) {
1466 			zd_mac_free_cur_beacon(mac);
1467 
1468 			zd_mac_config_beacon(mac->hw, beacon, false);
1469 		}
1470 
1471 		zd_set_beacon_interval(&mac->chip, interval, period, mac->type);
1472 
1473 		zd_chip_enable_hwint(&mac->chip);
1474 
1475 		spin_lock_irq(&mac->lock);
1476 		mac->beacon.last_update = jiffies;
1477 		spin_unlock_irq(&mac->lock);
1478 	}
1479 
1480 rearm:
1481 	queue_delayed_work(zd_workqueue, &mac->beacon.watchdog_work,
1482 			   BEACON_WATCHDOG_DELAY);
1483 }
1484 
1485 static void beacon_init(struct zd_mac *mac)
1486 {
1487 	INIT_DELAYED_WORK(&mac->beacon.watchdog_work, beacon_watchdog_handler);
1488 }
1489 
1490 static void beacon_enable(struct zd_mac *mac)
1491 {
1492 	dev_dbg_f(zd_mac_dev(mac), "\n");
1493 
1494 	mac->beacon.last_update = jiffies;
1495 	queue_delayed_work(zd_workqueue, &mac->beacon.watchdog_work,
1496 			   BEACON_WATCHDOG_DELAY);
1497 }
1498 
1499 static void beacon_disable(struct zd_mac *mac)
1500 {
1501 	dev_dbg_f(zd_mac_dev(mac), "\n");
1502 	cancel_delayed_work_sync(&mac->beacon.watchdog_work);
1503 
1504 	zd_mac_free_cur_beacon(mac);
1505 }
1506 
1507 #define LINK_LED_WORK_DELAY HZ
1508 
1509 static void link_led_handler(struct work_struct *work)
1510 {
1511 	struct zd_mac *mac =
1512 		container_of(work, struct zd_mac, housekeeping.link_led_work.work);
1513 	struct zd_chip *chip = &mac->chip;
1514 	int is_associated;
1515 	int r;
1516 
1517 	if (!test_bit(ZD_DEVICE_RUNNING, &mac->flags))
1518 		goto requeue;
1519 
1520 	spin_lock_irq(&mac->lock);
1521 	is_associated = mac->associated;
1522 	spin_unlock_irq(&mac->lock);
1523 
1524 	r = zd_chip_control_leds(chip,
1525 		                 is_associated ? ZD_LED_ASSOCIATED : ZD_LED_SCANNING);
1526 	if (r)
1527 		dev_dbg_f(zd_mac_dev(mac), "zd_chip_control_leds error %d\n", r);
1528 
1529 requeue:
1530 	queue_delayed_work(zd_workqueue, &mac->housekeeping.link_led_work,
1531 		           LINK_LED_WORK_DELAY);
1532 }
1533 
1534 static void housekeeping_init(struct zd_mac *mac)
1535 {
1536 	INIT_DELAYED_WORK(&mac->housekeeping.link_led_work, link_led_handler);
1537 }
1538 
1539 static void housekeeping_enable(struct zd_mac *mac)
1540 {
1541 	dev_dbg_f(zd_mac_dev(mac), "\n");
1542 	queue_delayed_work(zd_workqueue, &mac->housekeeping.link_led_work,
1543 			   0);
1544 }
1545 
1546 static void housekeeping_disable(struct zd_mac *mac)
1547 {
1548 	dev_dbg_f(zd_mac_dev(mac), "\n");
1549 	cancel_delayed_work_sync(&mac->housekeeping.link_led_work);
1550 	zd_chip_control_leds(&mac->chip, ZD_LED_OFF);
1551 }
1552