]> git.openfabrics.org - ~shefty/rdma-dev.git/blob - drivers/net/wireless/iwlegacy/common.c
iwlegacy: checkpatch.pl fixes
[~shefty/rdma-dev.git] / drivers / net / wireless / iwlegacy / common.c
1 /******************************************************************************
2  *
3  * GPL LICENSE SUMMARY
4  *
5  * Copyright(c) 2008 - 2011 Intel Corporation. All rights reserved.
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of version 2 of the GNU General Public License as
9  * published by the Free Software Foundation.
10  *
11  * This program is distributed in the hope that it will be useful, but
12  * WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, write to the Free Software
18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
19  * USA
20  *
21  * The full GNU General Public License is included in this distribution
22  * in the file called LICENSE.GPL.
23  *
24  * Contact Information:
25  *  Intel Linux Wireless <ilw@linux.intel.com>
26  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
27  *****************************************************************************/
28
29 #include <linux/kernel.h>
30 #include <linux/module.h>
31 #include <linux/etherdevice.h>
32 #include <linux/sched.h>
33 #include <linux/slab.h>
34 #include <linux/types.h>
35 #include <linux/lockdep.h>
36 #include <linux/init.h>
37 #include <linux/pci.h>
38 #include <linux/dma-mapping.h>
39 #include <linux/delay.h>
40 #include <linux/skbuff.h>
41 #include <net/mac80211.h>
42
43 #include "common.h"
44
45 const char *
46 il_get_cmd_string(u8 cmd)
47 {
48         switch (cmd) {
49                 IL_CMD(N_ALIVE);
50                 IL_CMD(N_ERROR);
51                 IL_CMD(C_RXON);
52                 IL_CMD(C_RXON_ASSOC);
53                 IL_CMD(C_QOS_PARAM);
54                 IL_CMD(C_RXON_TIMING);
55                 IL_CMD(C_ADD_STA);
56                 IL_CMD(C_REM_STA);
57                 IL_CMD(C_WEPKEY);
58                 IL_CMD(N_3945_RX);
59                 IL_CMD(C_TX);
60                 IL_CMD(C_RATE_SCALE);
61                 IL_CMD(C_LEDS);
62                 IL_CMD(C_TX_LINK_QUALITY_CMD);
63                 IL_CMD(C_CHANNEL_SWITCH);
64                 IL_CMD(N_CHANNEL_SWITCH);
65                 IL_CMD(C_SPECTRUM_MEASUREMENT);
66                 IL_CMD(N_SPECTRUM_MEASUREMENT);
67                 IL_CMD(C_POWER_TBL);
68                 IL_CMD(N_PM_SLEEP);
69                 IL_CMD(N_PM_DEBUG_STATS);
70                 IL_CMD(C_SCAN);
71                 IL_CMD(C_SCAN_ABORT);
72                 IL_CMD(N_SCAN_START);
73                 IL_CMD(N_SCAN_RESULTS);
74                 IL_CMD(N_SCAN_COMPLETE);
75                 IL_CMD(N_BEACON);
76                 IL_CMD(C_TX_BEACON);
77                 IL_CMD(C_TX_PWR_TBL);
78                 IL_CMD(C_BT_CONFIG);
79                 IL_CMD(C_STATS);
80                 IL_CMD(N_STATS);
81                 IL_CMD(N_CARD_STATE);
82                 IL_CMD(N_MISSED_BEACONS);
83                 IL_CMD(C_CT_KILL_CONFIG);
84                 IL_CMD(C_SENSITIVITY);
85                 IL_CMD(C_PHY_CALIBRATION);
86                 IL_CMD(N_RX_PHY);
87                 IL_CMD(N_RX_MPDU);
88                 IL_CMD(N_RX);
89                 IL_CMD(N_COMPRESSED_BA);
90         default:
91                 return "UNKNOWN";
92
93         }
94 }
95 EXPORT_SYMBOL(il_get_cmd_string);
96
97 #define HOST_COMPLETE_TIMEOUT (HZ / 2)
98
99 static void
100 il_generic_cmd_callback(struct il_priv *il, struct il_device_cmd *cmd,
101                         struct il_rx_pkt *pkt)
102 {
103         if (pkt->hdr.flags & IL_CMD_FAILED_MSK) {
104                 IL_ERR("Bad return from %s (0x%08X)\n",
105                        il_get_cmd_string(cmd->hdr.cmd), pkt->hdr.flags);
106                 return;
107         }
108 #ifdef CONFIG_IWLEGACY_DEBUG
109         switch (cmd->hdr.cmd) {
110         case C_TX_LINK_QUALITY_CMD:
111         case C_SENSITIVITY:
112                 D_HC_DUMP("back from %s (0x%08X)\n",
113                           il_get_cmd_string(cmd->hdr.cmd), pkt->hdr.flags);
114                 break;
115         default:
116                 D_HC("back from %s (0x%08X)\n", il_get_cmd_string(cmd->hdr.cmd),
117                      pkt->hdr.flags);
118         }
119 #endif
120 }
121
122 static int
123 il_send_cmd_async(struct il_priv *il, struct il_host_cmd *cmd)
124 {
125         int ret;
126
127         BUG_ON(!(cmd->flags & CMD_ASYNC));
128
129         /* An asynchronous command can not expect an SKB to be set. */
130         BUG_ON(cmd->flags & CMD_WANT_SKB);
131
132         /* Assign a generic callback if one is not provided */
133         if (!cmd->callback)
134                 cmd->callback = il_generic_cmd_callback;
135
136         if (test_bit(S_EXIT_PENDING, &il->status))
137                 return -EBUSY;
138
139         ret = il_enqueue_hcmd(il, cmd);
140         if (ret < 0) {
141                 IL_ERR("Error sending %s: enqueue_hcmd failed: %d\n",
142                        il_get_cmd_string(cmd->id), ret);
143                 return ret;
144         }
145         return 0;
146 }
147
148 int
149 il_send_cmd_sync(struct il_priv *il, struct il_host_cmd *cmd)
150 {
151         int cmd_idx;
152         int ret;
153
154         lockdep_assert_held(&il->mutex);
155
156         BUG_ON(cmd->flags & CMD_ASYNC);
157
158         /* A synchronous command can not have a callback set. */
159         BUG_ON(cmd->callback);
160
161         D_INFO("Attempting to send sync command %s\n",
162                il_get_cmd_string(cmd->id));
163
164         set_bit(S_HCMD_ACTIVE, &il->status);
165         D_INFO("Setting HCMD_ACTIVE for command %s\n",
166                il_get_cmd_string(cmd->id));
167
168         cmd_idx = il_enqueue_hcmd(il, cmd);
169         if (cmd_idx < 0) {
170                 ret = cmd_idx;
171                 IL_ERR("Error sending %s: enqueue_hcmd failed: %d\n",
172                        il_get_cmd_string(cmd->id), ret);
173                 goto out;
174         }
175
176         ret = wait_event_timeout(il->wait_command_queue,
177                                  !test_bit(S_HCMD_ACTIVE, &il->status),
178                                  HOST_COMPLETE_TIMEOUT);
179         if (!ret) {
180                 if (test_bit(S_HCMD_ACTIVE, &il->status)) {
181                         IL_ERR("Error sending %s: time out after %dms.\n",
182                                il_get_cmd_string(cmd->id),
183                                jiffies_to_msecs(HOST_COMPLETE_TIMEOUT));
184
185                         clear_bit(S_HCMD_ACTIVE, &il->status);
186                         D_INFO("Clearing HCMD_ACTIVE for command %s\n",
187                                il_get_cmd_string(cmd->id));
188                         ret = -ETIMEDOUT;
189                         goto cancel;
190                 }
191         }
192
193         if (test_bit(S_RF_KILL_HW, &il->status)) {
194                 IL_ERR("Command %s aborted: RF KILL Switch\n",
195                        il_get_cmd_string(cmd->id));
196                 ret = -ECANCELED;
197                 goto fail;
198         }
199         if (test_bit(S_FW_ERROR, &il->status)) {
200                 IL_ERR("Command %s failed: FW Error\n",
201                        il_get_cmd_string(cmd->id));
202                 ret = -EIO;
203                 goto fail;
204         }
205         if ((cmd->flags & CMD_WANT_SKB) && !cmd->reply_page) {
206                 IL_ERR("Error: Response NULL in '%s'\n",
207                        il_get_cmd_string(cmd->id));
208                 ret = -EIO;
209                 goto cancel;
210         }
211
212         ret = 0;
213         goto out;
214
215 cancel:
216         if (cmd->flags & CMD_WANT_SKB) {
217                 /*
218                  * Cancel the CMD_WANT_SKB flag for the cmd in the
219                  * TX cmd queue. Otherwise in case the cmd comes
220                  * in later, it will possibly set an invalid
221                  * address (cmd->meta.source).
222                  */
223                 il->txq[il->cmd_queue].meta[cmd_idx].flags &= ~CMD_WANT_SKB;
224         }
225 fail:
226         if (cmd->reply_page) {
227                 il_free_pages(il, cmd->reply_page);
228                 cmd->reply_page = 0;
229         }
230 out:
231         return ret;
232 }
233 EXPORT_SYMBOL(il_send_cmd_sync);
234
235 int
236 il_send_cmd(struct il_priv *il, struct il_host_cmd *cmd)
237 {
238         if (cmd->flags & CMD_ASYNC)
239                 return il_send_cmd_async(il, cmd);
240
241         return il_send_cmd_sync(il, cmd);
242 }
243 EXPORT_SYMBOL(il_send_cmd);
244
245 int
246 il_send_cmd_pdu(struct il_priv *il, u8 id, u16 len, const void *data)
247 {
248         struct il_host_cmd cmd = {
249                 .id = id,
250                 .len = len,
251                 .data = data,
252         };
253
254         return il_send_cmd_sync(il, &cmd);
255 }
256 EXPORT_SYMBOL(il_send_cmd_pdu);
257
258 int
259 il_send_cmd_pdu_async(struct il_priv *il, u8 id, u16 len, const void *data,
260                       void (*callback) (struct il_priv *il,
261                                         struct il_device_cmd *cmd,
262                                         struct il_rx_pkt *pkt))
263 {
264         struct il_host_cmd cmd = {
265                 .id = id,
266                 .len = len,
267                 .data = data,
268         };
269
270         cmd.flags |= CMD_ASYNC;
271         cmd.callback = callback;
272
273         return il_send_cmd_async(il, &cmd);
274 }
275 EXPORT_SYMBOL(il_send_cmd_pdu_async);
276
277 /* default: IL_LED_BLINK(0) using blinking idx table */
278 static int led_mode;
279 module_param(led_mode, int, S_IRUGO);
280 MODULE_PARM_DESC(led_mode,
281                  "0=system default, " "1=On(RF On)/Off(RF Off), 2=blinking");
282
283 /* Throughput           OFF time(ms)    ON time (ms)
284  *      >300                    25              25
285  *      >200 to 300             40              40
286  *      >100 to 200             55              55
287  *      >70 to 100              65              65
288  *      >50 to 70               75              75
289  *      >20 to 50               85              85
290  *      >10 to 20               95              95
291  *      >5 to 10                110             110
292  *      >1 to 5                 130             130
293  *      >0 to 1                 167             167
294  *      <=0                                     SOLID ON
295  */
296 static const struct ieee80211_tpt_blink il_blink[] = {
297         {.throughput = 0,               .blink_time = 334},
298         {.throughput = 1 * 1024 - 1,    .blink_time = 260},
299         {.throughput = 5 * 1024 - 1,    .blink_time = 220},
300         {.throughput = 10 * 1024 - 1,   .blink_time = 190},
301         {.throughput = 20 * 1024 - 1,   .blink_time = 170},
302         {.throughput = 50 * 1024 - 1,   .blink_time = 150},
303         {.throughput = 70 * 1024 - 1,   .blink_time = 130},
304         {.throughput = 100 * 1024 - 1,  .blink_time = 110},
305         {.throughput = 200 * 1024 - 1,  .blink_time = 80},
306         {.throughput = 300 * 1024 - 1,  .blink_time = 50},
307 };
308
309 /*
310  * Adjust led blink rate to compensate on a MAC Clock difference on every HW
311  * Led blink rate analysis showed an average deviation of 0% on 3945,
312  * 5% on 4965 HW.
313  * Need to compensate on the led on/off time per HW according to the deviation
314  * to achieve the desired led frequency
315  * The calculation is: (100-averageDeviation)/100 * blinkTime
316  * For code efficiency the calculation will be:
317  *     compensation = (100 - averageDeviation) * 64 / 100
318  *     NewBlinkTime = (compensation * BlinkTime) / 64
319  */
320 static inline u8
321 il_blink_compensation(struct il_priv *il, u8 time, u16 compensation)
322 {
323         if (!compensation) {
324                 IL_ERR("undefined blink compensation: "
325                        "use pre-defined blinking time\n");
326                 return time;
327         }
328
329         return (u8) ((time * compensation) >> 6);
330 }
331
332 /* Set led pattern command */
333 static int
334 il_led_cmd(struct il_priv *il, unsigned long on, unsigned long off)
335 {
336         struct il_led_cmd led_cmd = {
337                 .id = IL_LED_LINK,
338                 .interval = IL_DEF_LED_INTRVL
339         };
340         int ret;
341
342         if (!test_bit(S_READY, &il->status))
343                 return -EBUSY;
344
345         if (il->blink_on == on && il->blink_off == off)
346                 return 0;
347
348         if (off == 0) {
349                 /* led is SOLID_ON */
350                 on = IL_LED_SOLID;
351         }
352
353         D_LED("Led blink time compensation=%u\n",
354               il->cfg->base_params->led_compensation);
355         led_cmd.on =
356             il_blink_compensation(il, on,
357                                   il->cfg->base_params->led_compensation);
358         led_cmd.off =
359             il_blink_compensation(il, off,
360                                   il->cfg->base_params->led_compensation);
361
362         ret = il->cfg->ops->led->cmd(il, &led_cmd);
363         if (!ret) {
364                 il->blink_on = on;
365                 il->blink_off = off;
366         }
367         return ret;
368 }
369
370 static void
371 il_led_brightness_set(struct led_classdev *led_cdev,
372                       enum led_brightness brightness)
373 {
374         struct il_priv *il = container_of(led_cdev, struct il_priv, led);
375         unsigned long on = 0;
376
377         if (brightness > 0)
378                 on = IL_LED_SOLID;
379
380         il_led_cmd(il, on, 0);
381 }
382
383 static int
384 il_led_blink_set(struct led_classdev *led_cdev, unsigned long *delay_on,
385                  unsigned long *delay_off)
386 {
387         struct il_priv *il = container_of(led_cdev, struct il_priv, led);
388
389         return il_led_cmd(il, *delay_on, *delay_off);
390 }
391
392 void
393 il_leds_init(struct il_priv *il)
394 {
395         int mode = led_mode;
396         int ret;
397
398         if (mode == IL_LED_DEFAULT)
399                 mode = il->cfg->led_mode;
400
401         il->led.name =
402             kasprintf(GFP_KERNEL, "%s-led", wiphy_name(il->hw->wiphy));
403         il->led.brightness_set = il_led_brightness_set;
404         il->led.blink_set = il_led_blink_set;
405         il->led.max_brightness = 1;
406
407         switch (mode) {
408         case IL_LED_DEFAULT:
409                 WARN_ON(1);
410                 break;
411         case IL_LED_BLINK:
412                 il->led.default_trigger =
413                     ieee80211_create_tpt_led_trigger(il->hw,
414                                                      IEEE80211_TPT_LEDTRIG_FL_CONNECTED,
415                                                      il_blink,
416                                                      ARRAY_SIZE(il_blink));
417                 break;
418         case IL_LED_RF_STATE:
419                 il->led.default_trigger = ieee80211_get_radio_led_name(il->hw);
420                 break;
421         }
422
423         ret = led_classdev_register(&il->pci_dev->dev, &il->led);
424         if (ret) {
425                 kfree(il->led.name);
426                 return;
427         }
428
429         il->led_registered = true;
430 }
431 EXPORT_SYMBOL(il_leds_init);
432
433 void
434 il_leds_exit(struct il_priv *il)
435 {
436         if (!il->led_registered)
437                 return;
438
439         led_classdev_unregister(&il->led);
440         kfree(il->led.name);
441 }
442 EXPORT_SYMBOL(il_leds_exit);
443
444 /************************** EEPROM BANDS ****************************
445  *
446  * The il_eeprom_band definitions below provide the mapping from the
447  * EEPROM contents to the specific channel number supported for each
448  * band.
449  *
450  * For example, il_priv->eeprom.band_3_channels[4] from the band_3
451  * definition below maps to physical channel 42 in the 5.2GHz spectrum.
452  * The specific geography and calibration information for that channel
453  * is contained in the eeprom map itself.
454  *
455  * During init, we copy the eeprom information and channel map
456  * information into il->channel_info_24/52 and il->channel_map_24/52
457  *
458  * channel_map_24/52 provides the idx in the channel_info array for a
459  * given channel.  We have to have two separate maps as there is channel
460  * overlap with the 2.4GHz and 5.2GHz spectrum as seen in band_1 and
461  * band_2
462  *
463  * A value of 0xff stored in the channel_map indicates that the channel
464  * is not supported by the hardware at all.
465  *
466  * A value of 0xfe in the channel_map indicates that the channel is not
467  * valid for Tx with the current hardware.  This means that
468  * while the system can tune and receive on a given channel, it may not
469  * be able to associate or transmit any frames on that
470  * channel.  There is no corresponding channel information for that
471  * entry.
472  *
473  *********************************************************************/
474
475 /* 2.4 GHz */
476 const u8 il_eeprom_band_1[14] = {
477         1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
478 };
479
480 /* 5.2 GHz bands */
481 static const u8 il_eeprom_band_2[] = {  /* 4915-5080MHz */
482         183, 184, 185, 187, 188, 189, 192, 196, 7, 8, 11, 12, 16
483 };
484
485 static const u8 il_eeprom_band_3[] = {  /* 5170-5320MHz */
486         34, 36, 38, 40, 42, 44, 46, 48, 52, 56, 60, 64
487 };
488
489 static const u8 il_eeprom_band_4[] = {  /* 5500-5700MHz */
490         100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140
491 };
492
493 static const u8 il_eeprom_band_5[] = {  /* 5725-5825MHz */
494         145, 149, 153, 157, 161, 165
495 };
496
497 static const u8 il_eeprom_band_6[] = {  /* 2.4 ht40 channel */
498         1, 2, 3, 4, 5, 6, 7
499 };
500
501 static const u8 il_eeprom_band_7[] = {  /* 5.2 ht40 channel */
502         36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157
503 };
504
505 /******************************************************************************
506  *
507  * EEPROM related functions
508  *
509 ******************************************************************************/
510
511 static int
512 il_eeprom_verify_signature(struct il_priv *il)
513 {
514         u32 gp = _il_rd(il, CSR_EEPROM_GP) & CSR_EEPROM_GP_VALID_MSK;
515         int ret = 0;
516
517         D_EEPROM("EEPROM signature=0x%08x\n", gp);
518         switch (gp) {
519         case CSR_EEPROM_GP_GOOD_SIG_EEP_LESS_THAN_4K:
520         case CSR_EEPROM_GP_GOOD_SIG_EEP_MORE_THAN_4K:
521                 break;
522         default:
523                 IL_ERR("bad EEPROM signature," "EEPROM_GP=0x%08x\n", gp);
524                 ret = -ENOENT;
525                 break;
526         }
527         return ret;
528 }
529
530 const u8 *
531 il_eeprom_query_addr(const struct il_priv *il, size_t offset)
532 {
533         BUG_ON(offset >= il->cfg->base_params->eeprom_size);
534         return &il->eeprom[offset];
535 }
536 EXPORT_SYMBOL(il_eeprom_query_addr);
537
538 u16
539 il_eeprom_query16(const struct il_priv *il, size_t offset)
540 {
541         if (!il->eeprom)
542                 return 0;
543         return (u16) il->eeprom[offset] | ((u16) il->eeprom[offset + 1] << 8);
544 }
545 EXPORT_SYMBOL(il_eeprom_query16);
546
547 /**
548  * il_eeprom_init - read EEPROM contents
549  *
550  * Load the EEPROM contents from adapter into il->eeprom
551  *
552  * NOTE:  This routine uses the non-debug IO access functions.
553  */
554 int
555 il_eeprom_init(struct il_priv *il)
556 {
557         __le16 *e;
558         u32 gp = _il_rd(il, CSR_EEPROM_GP);
559         int sz;
560         int ret;
561         u16 addr;
562
563         /* allocate eeprom */
564         sz = il->cfg->base_params->eeprom_size;
565         D_EEPROM("NVM size = %d\n", sz);
566         il->eeprom = kzalloc(sz, GFP_KERNEL);
567         if (!il->eeprom) {
568                 ret = -ENOMEM;
569                 goto alloc_err;
570         }
571         e = (__le16 *) il->eeprom;
572
573         il->cfg->ops->lib->apm_ops.init(il);
574
575         ret = il_eeprom_verify_signature(il);
576         if (ret < 0) {
577                 IL_ERR("EEPROM not found, EEPROM_GP=0x%08x\n", gp);
578                 ret = -ENOENT;
579                 goto err;
580         }
581
582         /* Make sure driver (instead of uCode) is allowed to read EEPROM */
583         ret = il->cfg->ops->lib->eeprom_ops.acquire_semaphore(il);
584         if (ret < 0) {
585                 IL_ERR("Failed to acquire EEPROM semaphore.\n");
586                 ret = -ENOENT;
587                 goto err;
588         }
589
590         /* eeprom is an array of 16bit values */
591         for (addr = 0; addr < sz; addr += sizeof(u16)) {
592                 u32 r;
593
594                 _il_wr(il, CSR_EEPROM_REG,
595                        CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
596
597                 ret =
598                     _il_poll_bit(il, CSR_EEPROM_REG,
599                                  CSR_EEPROM_REG_READ_VALID_MSK,
600                                  CSR_EEPROM_REG_READ_VALID_MSK,
601                                  IL_EEPROM_ACCESS_TIMEOUT);
602                 if (ret < 0) {
603                         IL_ERR("Time out reading EEPROM[%d]\n", addr);
604                         goto done;
605                 }
606                 r = _il_rd(il, CSR_EEPROM_REG);
607                 e[addr / 2] = cpu_to_le16(r >> 16);
608         }
609
610         D_EEPROM("NVM Type: %s, version: 0x%x\n", "EEPROM",
611                  il_eeprom_query16(il, EEPROM_VERSION));
612
613         ret = 0;
614 done:
615         il->cfg->ops->lib->eeprom_ops.release_semaphore(il);
616
617 err:
618         if (ret)
619                 il_eeprom_free(il);
620         /* Reset chip to save power until we load uCode during "up". */
621         il_apm_stop(il);
622 alloc_err:
623         return ret;
624 }
625 EXPORT_SYMBOL(il_eeprom_init);
626
627 void
628 il_eeprom_free(struct il_priv *il)
629 {
630         kfree(il->eeprom);
631         il->eeprom = NULL;
632 }
633 EXPORT_SYMBOL(il_eeprom_free);
634
635 static void
636 il_init_band_reference(const struct il_priv *il, int eep_band,
637                        int *eeprom_ch_count,
638                        const struct il_eeprom_channel **eeprom_ch_info,
639                        const u8 **eeprom_ch_idx)
640 {
641         u32 offset =
642             il->cfg->ops->lib->eeprom_ops.regulatory_bands[eep_band - 1];
643         switch (eep_band) {
644         case 1:         /* 2.4GHz band */
645                 *eeprom_ch_count = ARRAY_SIZE(il_eeprom_band_1);
646                 *eeprom_ch_info =
647                     (struct il_eeprom_channel *)il_eeprom_query_addr(il,
648                                                                      offset);
649                 *eeprom_ch_idx = il_eeprom_band_1;
650                 break;
651         case 2:         /* 4.9GHz band */
652                 *eeprom_ch_count = ARRAY_SIZE(il_eeprom_band_2);
653                 *eeprom_ch_info =
654                     (struct il_eeprom_channel *)il_eeprom_query_addr(il,
655                                                                      offset);
656                 *eeprom_ch_idx = il_eeprom_band_2;
657                 break;
658         case 3:         /* 5.2GHz band */
659                 *eeprom_ch_count = ARRAY_SIZE(il_eeprom_band_3);
660                 *eeprom_ch_info =
661                     (struct il_eeprom_channel *)il_eeprom_query_addr(il,
662                                                                      offset);
663                 *eeprom_ch_idx = il_eeprom_band_3;
664                 break;
665         case 4:         /* 5.5GHz band */
666                 *eeprom_ch_count = ARRAY_SIZE(il_eeprom_band_4);
667                 *eeprom_ch_info =
668                     (struct il_eeprom_channel *)il_eeprom_query_addr(il,
669                                                                      offset);
670                 *eeprom_ch_idx = il_eeprom_band_4;
671                 break;
672         case 5:         /* 5.7GHz band */
673                 *eeprom_ch_count = ARRAY_SIZE(il_eeprom_band_5);
674                 *eeprom_ch_info =
675                     (struct il_eeprom_channel *)il_eeprom_query_addr(il,
676                                                                      offset);
677                 *eeprom_ch_idx = il_eeprom_band_5;
678                 break;
679         case 6:         /* 2.4GHz ht40 channels */
680                 *eeprom_ch_count = ARRAY_SIZE(il_eeprom_band_6);
681                 *eeprom_ch_info =
682                     (struct il_eeprom_channel *)il_eeprom_query_addr(il,
683                                                                      offset);
684                 *eeprom_ch_idx = il_eeprom_band_6;
685                 break;
686         case 7:         /* 5 GHz ht40 channels */
687                 *eeprom_ch_count = ARRAY_SIZE(il_eeprom_band_7);
688                 *eeprom_ch_info =
689                     (struct il_eeprom_channel *)il_eeprom_query_addr(il,
690                                                                      offset);
691                 *eeprom_ch_idx = il_eeprom_band_7;
692                 break;
693         default:
694                 BUG();
695         }
696 }
697
698 #define CHECK_AND_PRINT(x) ((eeprom_ch->flags & EEPROM_CHANNEL_##x) \
699                             ? # x " " : "")
700 /**
701  * il_mod_ht40_chan_info - Copy ht40 channel info into driver's il.
702  *
703  * Does not set up a command, or touch hardware.
704  */
705 static int
706 il_mod_ht40_chan_info(struct il_priv *il, enum ieee80211_band band, u16 channel,
707                       const struct il_eeprom_channel *eeprom_ch,
708                       u8 clear_ht40_extension_channel)
709 {
710         struct il_channel_info *ch_info;
711
712         ch_info =
713             (struct il_channel_info *)il_get_channel_info(il, band, channel);
714
715         if (!il_is_channel_valid(ch_info))
716                 return -1;
717
718         D_EEPROM("HT40 Ch. %d [%sGHz] %s%s%s%s%s(0x%02x %ddBm):"
719                  " Ad-Hoc %ssupported\n", ch_info->channel,
720                  il_is_channel_a_band(ch_info) ? "5.2" : "2.4",
721                  CHECK_AND_PRINT(IBSS), CHECK_AND_PRINT(ACTIVE),
722                  CHECK_AND_PRINT(RADAR), CHECK_AND_PRINT(WIDE),
723                  CHECK_AND_PRINT(DFS), eeprom_ch->flags,
724                  eeprom_ch->max_power_avg,
725                  ((eeprom_ch->flags & EEPROM_CHANNEL_IBSS) &&
726                   !(eeprom_ch->flags & EEPROM_CHANNEL_RADAR)) ? "" : "not ");
727
728         ch_info->ht40_eeprom = *eeprom_ch;
729         ch_info->ht40_max_power_avg = eeprom_ch->max_power_avg;
730         ch_info->ht40_flags = eeprom_ch->flags;
731         if (eeprom_ch->flags & EEPROM_CHANNEL_VALID)
732                 ch_info->ht40_extension_channel &=
733                     ~clear_ht40_extension_channel;
734
735         return 0;
736 }
737
738 #define CHECK_AND_PRINT_I(x) ((eeprom_ch_info[ch].flags & EEPROM_CHANNEL_##x) \
739                             ? # x " " : "")
740
741 /**
742  * il_init_channel_map - Set up driver's info for all possible channels
743  */
744 int
745 il_init_channel_map(struct il_priv *il)
746 {
747         int eeprom_ch_count = 0;
748         const u8 *eeprom_ch_idx = NULL;
749         const struct il_eeprom_channel *eeprom_ch_info = NULL;
750         int band, ch;
751         struct il_channel_info *ch_info;
752
753         if (il->channel_count) {
754                 D_EEPROM("Channel map already initialized.\n");
755                 return 0;
756         }
757
758         D_EEPROM("Initializing regulatory info from EEPROM\n");
759
760         il->channel_count =
761             ARRAY_SIZE(il_eeprom_band_1) + ARRAY_SIZE(il_eeprom_band_2) +
762             ARRAY_SIZE(il_eeprom_band_3) + ARRAY_SIZE(il_eeprom_band_4) +
763             ARRAY_SIZE(il_eeprom_band_5);
764
765         D_EEPROM("Parsing data for %d channels.\n", il->channel_count);
766
767         il->channel_info =
768             kzalloc(sizeof(struct il_channel_info) * il->channel_count,
769                     GFP_KERNEL);
770         if (!il->channel_info) {
771                 IL_ERR("Could not allocate channel_info\n");
772                 il->channel_count = 0;
773                 return -ENOMEM;
774         }
775
776         ch_info = il->channel_info;
777
778         /* Loop through the 5 EEPROM bands adding them in order to the
779          * channel map we maintain (that contains additional information than
780          * what just in the EEPROM) */
781         for (band = 1; band <= 5; band++) {
782
783                 il_init_band_reference(il, band, &eeprom_ch_count,
784                                        &eeprom_ch_info, &eeprom_ch_idx);
785
786                 /* Loop through each band adding each of the channels */
787                 for (ch = 0; ch < eeprom_ch_count; ch++) {
788                         ch_info->channel = eeprom_ch_idx[ch];
789                         ch_info->band =
790                             (band ==
791                              1) ? IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
792
793                         /* permanently store EEPROM's channel regulatory flags
794                          *   and max power in channel info database. */
795                         ch_info->eeprom = eeprom_ch_info[ch];
796
797                         /* Copy the run-time flags so they are there even on
798                          * invalid channels */
799                         ch_info->flags = eeprom_ch_info[ch].flags;
800                         /* First write that ht40 is not enabled, and then enable
801                          * one by one */
802                         ch_info->ht40_extension_channel =
803                             IEEE80211_CHAN_NO_HT40;
804
805                         if (!(il_is_channel_valid(ch_info))) {
806                                 D_EEPROM("Ch. %d Flags %x [%sGHz] - "
807                                          "No traffic\n", ch_info->channel,
808                                          ch_info->flags,
809                                          il_is_channel_a_band(ch_info) ? "5.2" :
810                                          "2.4");
811                                 ch_info++;
812                                 continue;
813                         }
814
815                         /* Initialize regulatory-based run-time data */
816                         ch_info->max_power_avg = ch_info->curr_txpow =
817                             eeprom_ch_info[ch].max_power_avg;
818                         ch_info->scan_power = eeprom_ch_info[ch].max_power_avg;
819                         ch_info->min_power = 0;
820
821                         D_EEPROM("Ch. %d [%sGHz] " "%s%s%s%s%s%s(0x%02x %ddBm):"
822                                  " Ad-Hoc %ssupported\n", ch_info->channel,
823                                  il_is_channel_a_band(ch_info) ? "5.2" : "2.4",
824                                  CHECK_AND_PRINT_I(VALID),
825                                  CHECK_AND_PRINT_I(IBSS),
826                                  CHECK_AND_PRINT_I(ACTIVE),
827                                  CHECK_AND_PRINT_I(RADAR),
828                                  CHECK_AND_PRINT_I(WIDE),
829                                  CHECK_AND_PRINT_I(DFS),
830                                  eeprom_ch_info[ch].flags,
831                                  eeprom_ch_info[ch].max_power_avg,
832                                  ((eeprom_ch_info[ch].
833                                    flags & EEPROM_CHANNEL_IBSS) &&
834                                   !(eeprom_ch_info[ch].
835                                     flags & EEPROM_CHANNEL_RADAR)) ? "" :
836                                  "not ");
837
838                         ch_info++;
839                 }
840         }
841
842         /* Check if we do have HT40 channels */
843         if (il->cfg->ops->lib->eeprom_ops.regulatory_bands[5] ==
844             EEPROM_REGULATORY_BAND_NO_HT40 &&
845             il->cfg->ops->lib->eeprom_ops.regulatory_bands[6] ==
846             EEPROM_REGULATORY_BAND_NO_HT40)
847                 return 0;
848
849         /* Two additional EEPROM bands for 2.4 and 5 GHz HT40 channels */
850         for (band = 6; band <= 7; band++) {
851                 enum ieee80211_band ieeeband;
852
853                 il_init_band_reference(il, band, &eeprom_ch_count,
854                                        &eeprom_ch_info, &eeprom_ch_idx);
855
856                 /* EEPROM band 6 is 2.4, band 7 is 5 GHz */
857                 ieeeband =
858                     (band == 6) ? IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
859
860                 /* Loop through each band adding each of the channels */
861                 for (ch = 0; ch < eeprom_ch_count; ch++) {
862                         /* Set up driver's info for lower half */
863                         il_mod_ht40_chan_info(il, ieeeband, eeprom_ch_idx[ch],
864                                               &eeprom_ch_info[ch],
865                                               IEEE80211_CHAN_NO_HT40PLUS);
866
867                         /* Set up driver's info for upper half */
868                         il_mod_ht40_chan_info(il, ieeeband,
869                                               eeprom_ch_idx[ch] + 4,
870                                               &eeprom_ch_info[ch],
871                                               IEEE80211_CHAN_NO_HT40MINUS);
872                 }
873         }
874
875         return 0;
876 }
877 EXPORT_SYMBOL(il_init_channel_map);
878
879 /*
880  * il_free_channel_map - undo allocations in il_init_channel_map
881  */
882 void
883 il_free_channel_map(struct il_priv *il)
884 {
885         kfree(il->channel_info);
886         il->channel_count = 0;
887 }
888 EXPORT_SYMBOL(il_free_channel_map);
889
890 /**
891  * il_get_channel_info - Find driver's ilate channel info
892  *
893  * Based on band and channel number.
894  */
895 const struct il_channel_info *
896 il_get_channel_info(const struct il_priv *il, enum ieee80211_band band,
897                     u16 channel)
898 {
899         int i;
900
901         switch (band) {
902         case IEEE80211_BAND_5GHZ:
903                 for (i = 14; i < il->channel_count; i++) {
904                         if (il->channel_info[i].channel == channel)
905                                 return &il->channel_info[i];
906                 }
907                 break;
908         case IEEE80211_BAND_2GHZ:
909                 if (channel >= 1 && channel <= 14)
910                         return &il->channel_info[channel - 1];
911                 break;
912         default:
913                 BUG();
914         }
915
916         return NULL;
917 }
918 EXPORT_SYMBOL(il_get_channel_info);
919
920 /*
921  * Setting power level allows the card to go to sleep when not busy.
922  *
923  * We calculate a sleep command based on the required latency, which
924  * we get from mac80211. In order to handle thermal throttling, we can
925  * also use pre-defined power levels.
926  */
927
928 /*
929  * This defines the old power levels. They are still used by default
930  * (level 1) and for thermal throttle (levels 3 through 5)
931  */
932
933 struct il_power_vec_entry {
934         struct il_powertable_cmd cmd;
935         u8 no_dtim;             /* number of skip dtim */
936 };
937
938 static void
939 il_power_sleep_cam_cmd(struct il_priv *il, struct il_powertable_cmd *cmd)
940 {
941         memset(cmd, 0, sizeof(*cmd));
942
943         if (il->power_data.pci_pm)
944                 cmd->flags |= IL_POWER_PCI_PM_MSK;
945
946         D_POWER("Sleep command for CAM\n");
947 }
948
949 static int
950 il_set_power(struct il_priv *il, struct il_powertable_cmd *cmd)
951 {
952         D_POWER("Sending power/sleep command\n");
953         D_POWER("Flags value = 0x%08X\n", cmd->flags);
954         D_POWER("Tx timeout = %u\n", le32_to_cpu(cmd->tx_data_timeout));
955         D_POWER("Rx timeout = %u\n", le32_to_cpu(cmd->rx_data_timeout));
956         D_POWER("Sleep interval vector = { %d , %d , %d , %d , %d }\n",
957                 le32_to_cpu(cmd->sleep_interval[0]),
958                 le32_to_cpu(cmd->sleep_interval[1]),
959                 le32_to_cpu(cmd->sleep_interval[2]),
960                 le32_to_cpu(cmd->sleep_interval[3]),
961                 le32_to_cpu(cmd->sleep_interval[4]));
962
963         return il_send_cmd_pdu(il, C_POWER_TBL,
964                                sizeof(struct il_powertable_cmd), cmd);
965 }
966
967 int
968 il_power_set_mode(struct il_priv *il, struct il_powertable_cmd *cmd, bool force)
969 {
970         int ret;
971         bool update_chains;
972
973         lockdep_assert_held(&il->mutex);
974
975         /* Don't update the RX chain when chain noise calibration is running */
976         update_chains = il->chain_noise_data.state == IL_CHAIN_NOISE_DONE ||
977             il->chain_noise_data.state == IL_CHAIN_NOISE_ALIVE;
978
979         if (!memcmp(&il->power_data.sleep_cmd, cmd, sizeof(*cmd)) && !force)
980                 return 0;
981
982         if (!il_is_ready_rf(il))
983                 return -EIO;
984
985         /* scan complete use sleep_power_next, need to be updated */
986         memcpy(&il->power_data.sleep_cmd_next, cmd, sizeof(*cmd));
987         if (test_bit(S_SCANNING, &il->status) && !force) {
988                 D_INFO("Defer power set mode while scanning\n");
989                 return 0;
990         }
991
992         if (cmd->flags & IL_POWER_DRIVER_ALLOW_SLEEP_MSK)
993                 set_bit(S_POWER_PMI, &il->status);
994
995         ret = il_set_power(il, cmd);
996         if (!ret) {
997                 if (!(cmd->flags & IL_POWER_DRIVER_ALLOW_SLEEP_MSK))
998                         clear_bit(S_POWER_PMI, &il->status);
999
1000                 if (il->cfg->ops->lib->update_chain_flags && update_chains)
1001                         il->cfg->ops->lib->update_chain_flags(il);
1002                 else if (il->cfg->ops->lib->update_chain_flags)
1003                         D_POWER("Cannot update the power, chain noise "
1004                                 "calibration running: %d\n",
1005                                 il->chain_noise_data.state);
1006
1007                 memcpy(&il->power_data.sleep_cmd, cmd, sizeof(*cmd));
1008         } else
1009                 IL_ERR("set power fail, ret = %d", ret);
1010
1011         return ret;
1012 }
1013
1014 int
1015 il_power_update_mode(struct il_priv *il, bool force)
1016 {
1017         struct il_powertable_cmd cmd;
1018
1019         il_power_sleep_cam_cmd(il, &cmd);
1020         return il_power_set_mode(il, &cmd, force);
1021 }
1022 EXPORT_SYMBOL(il_power_update_mode);
1023
1024 /* initialize to default */
1025 void
1026 il_power_initialize(struct il_priv *il)
1027 {
1028         u16 lctl = il_pcie_link_ctl(il);
1029
1030         il->power_data.pci_pm = !(lctl & PCI_CFG_LINK_CTRL_VAL_L0S_EN);
1031
1032         il->power_data.debug_sleep_level_override = -1;
1033
1034         memset(&il->power_data.sleep_cmd, 0, sizeof(il->power_data.sleep_cmd));
1035 }
1036 EXPORT_SYMBOL(il_power_initialize);
1037
1038 /* For active scan, listen ACTIVE_DWELL_TIME (msec) on each channel after
1039  * sending probe req.  This should be set long enough to hear probe responses
1040  * from more than one AP.  */
1041 #define IL_ACTIVE_DWELL_TIME_24    (30) /* all times in msec */
1042 #define IL_ACTIVE_DWELL_TIME_52    (20)
1043
1044 #define IL_ACTIVE_DWELL_FACTOR_24GHZ (3)
1045 #define IL_ACTIVE_DWELL_FACTOR_52GHZ (2)
1046
1047 /* For passive scan, listen PASSIVE_DWELL_TIME (msec) on each channel.
1048  * Must be set longer than active dwell time.
1049  * For the most reliable scan, set > AP beacon interval (typically 100msec). */
1050 #define IL_PASSIVE_DWELL_TIME_24   (20) /* all times in msec */
1051 #define IL_PASSIVE_DWELL_TIME_52   (10)
1052 #define IL_PASSIVE_DWELL_BASE      (100)
1053 #define IL_CHANNEL_TUNE_TIME       5
1054
1055 static int
1056 il_send_scan_abort(struct il_priv *il)
1057 {
1058         int ret;
1059         struct il_rx_pkt *pkt;
1060         struct il_host_cmd cmd = {
1061                 .id = C_SCAN_ABORT,
1062                 .flags = CMD_WANT_SKB,
1063         };
1064
1065         /* Exit instantly with error when device is not ready
1066          * to receive scan abort command or it does not perform
1067          * hardware scan currently */
1068         if (!test_bit(S_READY, &il->status) ||
1069             !test_bit(S_GEO_CONFIGURED, &il->status) ||
1070             !test_bit(S_SCAN_HW, &il->status) ||
1071             test_bit(S_FW_ERROR, &il->status) ||
1072             test_bit(S_EXIT_PENDING, &il->status))
1073                 return -EIO;
1074
1075         ret = il_send_cmd_sync(il, &cmd);
1076         if (ret)
1077                 return ret;
1078
1079         pkt = (struct il_rx_pkt *)cmd.reply_page;
1080         if (pkt->u.status != CAN_ABORT_STATUS) {
1081                 /* The scan abort will return 1 for success or
1082                  * 2 for "failure".  A failure condition can be
1083                  * due to simply not being in an active scan which
1084                  * can occur if we send the scan abort before we
1085                  * the microcode has notified us that a scan is
1086                  * completed. */
1087                 D_SCAN("SCAN_ABORT ret %d.\n", pkt->u.status);
1088                 ret = -EIO;
1089         }
1090
1091         il_free_pages(il, cmd.reply_page);
1092         return ret;
1093 }
1094
1095 static void
1096 il_complete_scan(struct il_priv *il, bool aborted)
1097 {
1098         /* check if scan was requested from mac80211 */
1099         if (il->scan_request) {
1100                 D_SCAN("Complete scan in mac80211\n");
1101                 ieee80211_scan_completed(il->hw, aborted);
1102         }
1103
1104         il->scan_vif = NULL;
1105         il->scan_request = NULL;
1106 }
1107
1108 void
1109 il_force_scan_end(struct il_priv *il)
1110 {
1111         lockdep_assert_held(&il->mutex);
1112
1113         if (!test_bit(S_SCANNING, &il->status)) {
1114                 D_SCAN("Forcing scan end while not scanning\n");
1115                 return;
1116         }
1117
1118         D_SCAN("Forcing scan end\n");
1119         clear_bit(S_SCANNING, &il->status);
1120         clear_bit(S_SCAN_HW, &il->status);
1121         clear_bit(S_SCAN_ABORTING, &il->status);
1122         il_complete_scan(il, true);
1123 }
1124
1125 static void
1126 il_do_scan_abort(struct il_priv *il)
1127 {
1128         int ret;
1129
1130         lockdep_assert_held(&il->mutex);
1131
1132         if (!test_bit(S_SCANNING, &il->status)) {
1133                 D_SCAN("Not performing scan to abort\n");
1134                 return;
1135         }
1136
1137         if (test_and_set_bit(S_SCAN_ABORTING, &il->status)) {
1138                 D_SCAN("Scan abort in progress\n");
1139                 return;
1140         }
1141
1142         ret = il_send_scan_abort(il);
1143         if (ret) {
1144                 D_SCAN("Send scan abort failed %d\n", ret);
1145                 il_force_scan_end(il);
1146         } else
1147                 D_SCAN("Successfully send scan abort\n");
1148 }
1149
1150 /**
1151  * il_scan_cancel - Cancel any currently executing HW scan
1152  */
1153 int
1154 il_scan_cancel(struct il_priv *il)
1155 {
1156         D_SCAN("Queuing abort scan\n");
1157         queue_work(il->workqueue, &il->abort_scan);
1158         return 0;
1159 }
1160 EXPORT_SYMBOL(il_scan_cancel);
1161
1162 /**
1163  * il_scan_cancel_timeout - Cancel any currently executing HW scan
1164  * @ms: amount of time to wait (in milliseconds) for scan to abort
1165  *
1166  */
1167 int
1168 il_scan_cancel_timeout(struct il_priv *il, unsigned long ms)
1169 {
1170         unsigned long timeout = jiffies + msecs_to_jiffies(ms);
1171
1172         lockdep_assert_held(&il->mutex);
1173
1174         D_SCAN("Scan cancel timeout\n");
1175
1176         il_do_scan_abort(il);
1177
1178         while (time_before_eq(jiffies, timeout)) {
1179                 if (!test_bit(S_SCAN_HW, &il->status))
1180                         break;
1181                 msleep(20);
1182         }
1183
1184         return test_bit(S_SCAN_HW, &il->status);
1185 }
1186 EXPORT_SYMBOL(il_scan_cancel_timeout);
1187
1188 /* Service response to C_SCAN (0x80) */
1189 static void
1190 il_hdl_scan(struct il_priv *il, struct il_rx_buf *rxb)
1191 {
1192 #ifdef CONFIG_IWLEGACY_DEBUG
1193         struct il_rx_pkt *pkt = rxb_addr(rxb);
1194         struct il_scanreq_notification *notif =
1195             (struct il_scanreq_notification *)pkt->u.raw;
1196
1197         D_SCAN("Scan request status = 0x%x\n", notif->status);
1198 #endif
1199 }
1200
1201 /* Service N_SCAN_START (0x82) */
1202 static void
1203 il_hdl_scan_start(struct il_priv *il, struct il_rx_buf *rxb)
1204 {
1205         struct il_rx_pkt *pkt = rxb_addr(rxb);
1206         struct il_scanstart_notification *notif =
1207             (struct il_scanstart_notification *)pkt->u.raw;
1208         il->scan_start_tsf = le32_to_cpu(notif->tsf_low);
1209         D_SCAN("Scan start: " "%d [802.11%s] "
1210                "(TSF: 0x%08X:%08X) - %d (beacon timer %u)\n", notif->channel,
1211                notif->band ? "bg" : "a", le32_to_cpu(notif->tsf_high),
1212                le32_to_cpu(notif->tsf_low), notif->status, notif->beacon_timer);
1213 }
1214
1215 /* Service N_SCAN_RESULTS (0x83) */
1216 static void
1217 il_hdl_scan_results(struct il_priv *il, struct il_rx_buf *rxb)
1218 {
1219 #ifdef CONFIG_IWLEGACY_DEBUG
1220         struct il_rx_pkt *pkt = rxb_addr(rxb);
1221         struct il_scanresults_notification *notif =
1222             (struct il_scanresults_notification *)pkt->u.raw;
1223
1224         D_SCAN("Scan ch.res: " "%d [802.11%s] " "(TSF: 0x%08X:%08X) - %d "
1225                "elapsed=%lu usec\n", notif->channel, notif->band ? "bg" : "a",
1226                le32_to_cpu(notif->tsf_high), le32_to_cpu(notif->tsf_low),
1227                le32_to_cpu(notif->stats[0]),
1228                le32_to_cpu(notif->tsf_low) - il->scan_start_tsf);
1229 #endif
1230 }
1231
1232 /* Service N_SCAN_COMPLETE (0x84) */
1233 static void
1234 il_hdl_scan_complete(struct il_priv *il, struct il_rx_buf *rxb)
1235 {
1236
1237 #ifdef CONFIG_IWLEGACY_DEBUG
1238         struct il_rx_pkt *pkt = rxb_addr(rxb);
1239         struct il_scancomplete_notification *scan_notif = (void *)pkt->u.raw;
1240 #endif
1241
1242         D_SCAN("Scan complete: %d channels (TSF 0x%08X:%08X) - %d\n",
1243                scan_notif->scanned_channels, scan_notif->tsf_low,
1244                scan_notif->tsf_high, scan_notif->status);
1245
1246         /* The HW is no longer scanning */
1247         clear_bit(S_SCAN_HW, &il->status);
1248
1249         D_SCAN("Scan on %sGHz took %dms\n",
1250                (il->scan_band == IEEE80211_BAND_2GHZ) ? "2.4" : "5.2",
1251                jiffies_to_msecs(jiffies - il->scan_start));
1252
1253         queue_work(il->workqueue, &il->scan_completed);
1254 }
1255
1256 void
1257 il_setup_rx_scan_handlers(struct il_priv *il)
1258 {
1259         /* scan handlers */
1260         il->handlers[C_SCAN] = il_hdl_scan;
1261         il->handlers[N_SCAN_START] = il_hdl_scan_start;
1262         il->handlers[N_SCAN_RESULTS] = il_hdl_scan_results;
1263         il->handlers[N_SCAN_COMPLETE] = il_hdl_scan_complete;
1264 }
1265 EXPORT_SYMBOL(il_setup_rx_scan_handlers);
1266
1267 inline u16
1268 il_get_active_dwell_time(struct il_priv *il, enum ieee80211_band band,
1269                          u8 n_probes)
1270 {
1271         if (band == IEEE80211_BAND_5GHZ)
1272                 return IL_ACTIVE_DWELL_TIME_52 +
1273                     IL_ACTIVE_DWELL_FACTOR_52GHZ * (n_probes + 1);
1274         else
1275                 return IL_ACTIVE_DWELL_TIME_24 +
1276                     IL_ACTIVE_DWELL_FACTOR_24GHZ * (n_probes + 1);
1277 }
1278 EXPORT_SYMBOL(il_get_active_dwell_time);
1279
1280 u16
1281 il_get_passive_dwell_time(struct il_priv *il, enum ieee80211_band band,
1282                           struct ieee80211_vif *vif)
1283 {
1284         struct il_rxon_context *ctx = &il->ctx;
1285         u16 value;
1286
1287         u16 passive =
1288             (band ==
1289              IEEE80211_BAND_2GHZ) ? IL_PASSIVE_DWELL_BASE +
1290             IL_PASSIVE_DWELL_TIME_24 : IL_PASSIVE_DWELL_BASE +
1291             IL_PASSIVE_DWELL_TIME_52;
1292
1293         if (il_is_any_associated(il)) {
1294                 /*
1295                  * If we're associated, we clamp the maximum passive
1296                  * dwell time to be 98% of the smallest beacon interval
1297                  * (minus 2 * channel tune time)
1298                  */
1299                 value = ctx->vif ? ctx->vif->bss_conf.beacon_int : 0;
1300                 if (value > IL_PASSIVE_DWELL_BASE || !value)
1301                         value = IL_PASSIVE_DWELL_BASE;
1302                 value = (value * 98) / 100 - IL_CHANNEL_TUNE_TIME * 2;
1303                 passive = min(value, passive);
1304         }
1305
1306         return passive;
1307 }
1308 EXPORT_SYMBOL(il_get_passive_dwell_time);
1309
1310 void
1311 il_init_scan_params(struct il_priv *il)
1312 {
1313         u8 ant_idx = fls(il->hw_params.valid_tx_ant) - 1;
1314         if (!il->scan_tx_ant[IEEE80211_BAND_5GHZ])
1315                 il->scan_tx_ant[IEEE80211_BAND_5GHZ] = ant_idx;
1316         if (!il->scan_tx_ant[IEEE80211_BAND_2GHZ])
1317                 il->scan_tx_ant[IEEE80211_BAND_2GHZ] = ant_idx;
1318 }
1319 EXPORT_SYMBOL(il_init_scan_params);
1320
1321 static int
1322 il_scan_initiate(struct il_priv *il, struct ieee80211_vif *vif)
1323 {
1324         int ret;
1325
1326         lockdep_assert_held(&il->mutex);
1327
1328         if (WARN_ON(!il->cfg->ops->utils->request_scan))
1329                 return -EOPNOTSUPP;
1330
1331         cancel_delayed_work(&il->scan_check);
1332
1333         if (!il_is_ready_rf(il)) {
1334                 IL_WARN("Request scan called when driver not ready.\n");
1335                 return -EIO;
1336         }
1337
1338         if (test_bit(S_SCAN_HW, &il->status)) {
1339                 D_SCAN("Multiple concurrent scan requests in parallel.\n");
1340                 return -EBUSY;
1341         }
1342
1343         if (test_bit(S_SCAN_ABORTING, &il->status)) {
1344                 D_SCAN("Scan request while abort pending.\n");
1345                 return -EBUSY;
1346         }
1347
1348         D_SCAN("Starting scan...\n");
1349
1350         set_bit(S_SCANNING, &il->status);
1351         il->scan_start = jiffies;
1352
1353         ret = il->cfg->ops->utils->request_scan(il, vif);
1354         if (ret) {
1355                 clear_bit(S_SCANNING, &il->status);
1356                 return ret;
1357         }
1358
1359         queue_delayed_work(il->workqueue, &il->scan_check,
1360                            IL_SCAN_CHECK_WATCHDOG);
1361
1362         return 0;
1363 }
1364
1365 int
1366 il_mac_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1367                struct cfg80211_scan_request *req)
1368 {
1369         struct il_priv *il = hw->priv;
1370         int ret;
1371
1372         D_MAC80211("enter\n");
1373
1374         if (req->n_channels == 0)
1375                 return -EINVAL;
1376
1377         mutex_lock(&il->mutex);
1378
1379         if (test_bit(S_SCANNING, &il->status)) {
1380                 D_SCAN("Scan already in progress.\n");
1381                 ret = -EAGAIN;
1382                 goto out_unlock;
1383         }
1384
1385         /* mac80211 will only ask for one band at a time */
1386         il->scan_request = req;
1387         il->scan_vif = vif;
1388         il->scan_band = req->channels[0]->band;
1389
1390         ret = il_scan_initiate(il, vif);
1391
1392         D_MAC80211("leave\n");
1393
1394 out_unlock:
1395         mutex_unlock(&il->mutex);
1396
1397         return ret;
1398 }
1399 EXPORT_SYMBOL(il_mac_hw_scan);
1400
1401 static void
1402 il_bg_scan_check(struct work_struct *data)
1403 {
1404         struct il_priv *il =
1405             container_of(data, struct il_priv, scan_check.work);
1406
1407         D_SCAN("Scan check work\n");
1408
1409         /* Since we are here firmware does not finish scan and
1410          * most likely is in bad shape, so we don't bother to
1411          * send abort command, just force scan complete to mac80211 */
1412         mutex_lock(&il->mutex);
1413         il_force_scan_end(il);
1414         mutex_unlock(&il->mutex);
1415 }
1416
1417 /**
1418  * il_fill_probe_req - fill in all required fields and IE for probe request
1419  */
1420
1421 u16
1422 il_fill_probe_req(struct il_priv *il, struct ieee80211_mgmt *frame,
1423                   const u8 *ta, const u8 *ies, int ie_len, int left)
1424 {
1425         int len = 0;
1426         u8 *pos = NULL;
1427
1428         /* Make sure there is enough space for the probe request,
1429          * two mandatory IEs and the data */
1430         left -= 24;
1431         if (left < 0)
1432                 return 0;
1433
1434         frame->frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
1435         memcpy(frame->da, il_bcast_addr, ETH_ALEN);
1436         memcpy(frame->sa, ta, ETH_ALEN);
1437         memcpy(frame->bssid, il_bcast_addr, ETH_ALEN);
1438         frame->seq_ctrl = 0;
1439
1440         len += 24;
1441
1442         /* ...next IE... */
1443         pos = &frame->u.probe_req.variable[0];
1444
1445         /* fill in our indirect SSID IE */
1446         left -= 2;
1447         if (left < 0)
1448                 return 0;
1449         *pos++ = WLAN_EID_SSID;
1450         *pos++ = 0;
1451
1452         len += 2;
1453
1454         if (WARN_ON(left < ie_len))
1455                 return len;
1456
1457         if (ies && ie_len) {
1458                 memcpy(pos, ies, ie_len);
1459                 len += ie_len;
1460         }
1461
1462         return (u16) len;
1463 }
1464 EXPORT_SYMBOL(il_fill_probe_req);
1465
1466 static void
1467 il_bg_abort_scan(struct work_struct *work)
1468 {
1469         struct il_priv *il = container_of(work, struct il_priv, abort_scan);
1470
1471         D_SCAN("Abort scan work\n");
1472
1473         /* We keep scan_check work queued in case when firmware will not
1474          * report back scan completed notification */
1475         mutex_lock(&il->mutex);
1476         il_scan_cancel_timeout(il, 200);
1477         mutex_unlock(&il->mutex);
1478 }
1479
1480 static void
1481 il_bg_scan_completed(struct work_struct *work)
1482 {
1483         struct il_priv *il = container_of(work, struct il_priv, scan_completed);
1484         bool aborted;
1485
1486         D_SCAN("Completed scan.\n");
1487
1488         cancel_delayed_work(&il->scan_check);
1489
1490         mutex_lock(&il->mutex);
1491
1492         aborted = test_and_clear_bit(S_SCAN_ABORTING, &il->status);
1493         if (aborted)
1494                 D_SCAN("Aborted scan completed.\n");
1495
1496         if (!test_and_clear_bit(S_SCANNING, &il->status)) {
1497                 D_SCAN("Scan already completed.\n");
1498                 goto out_settings;
1499         }
1500
1501         il_complete_scan(il, aborted);
1502
1503 out_settings:
1504         /* Can we still talk to firmware ? */
1505         if (!il_is_ready_rf(il))
1506                 goto out;
1507
1508         /*
1509          * We do not commit power settings while scan is pending,
1510          * do it now if the settings changed.
1511          */
1512         il_power_set_mode(il, &il->power_data.sleep_cmd_next, false);
1513         il_set_tx_power(il, il->tx_power_next, false);
1514
1515         il->cfg->ops->utils->post_scan(il);
1516
1517 out:
1518         mutex_unlock(&il->mutex);
1519 }
1520
1521 void
1522 il_setup_scan_deferred_work(struct il_priv *il)
1523 {
1524         INIT_WORK(&il->scan_completed, il_bg_scan_completed);
1525         INIT_WORK(&il->abort_scan, il_bg_abort_scan);
1526         INIT_DELAYED_WORK(&il->scan_check, il_bg_scan_check);
1527 }
1528 EXPORT_SYMBOL(il_setup_scan_deferred_work);
1529
1530 void
1531 il_cancel_scan_deferred_work(struct il_priv *il)
1532 {
1533         cancel_work_sync(&il->abort_scan);
1534         cancel_work_sync(&il->scan_completed);
1535
1536         if (cancel_delayed_work_sync(&il->scan_check)) {
1537                 mutex_lock(&il->mutex);
1538                 il_force_scan_end(il);
1539                 mutex_unlock(&il->mutex);
1540         }
1541 }
1542 EXPORT_SYMBOL(il_cancel_scan_deferred_work);
1543
1544 /* il->sta_lock must be held */
1545 static void
1546 il_sta_ucode_activate(struct il_priv *il, u8 sta_id)
1547 {
1548
1549         if (!(il->stations[sta_id].used & IL_STA_DRIVER_ACTIVE))
1550                 IL_ERR("ACTIVATE a non DRIVER active station id %u addr %pM\n",
1551                        sta_id, il->stations[sta_id].sta.sta.addr);
1552
1553         if (il->stations[sta_id].used & IL_STA_UCODE_ACTIVE) {
1554                 D_ASSOC("STA id %u addr %pM already present"
1555                         " in uCode (according to driver)\n", sta_id,
1556                         il->stations[sta_id].sta.sta.addr);
1557         } else {
1558                 il->stations[sta_id].used |= IL_STA_UCODE_ACTIVE;
1559                 D_ASSOC("Added STA id %u addr %pM to uCode\n", sta_id,
1560                         il->stations[sta_id].sta.sta.addr);
1561         }
1562 }
1563
1564 static int
1565 il_process_add_sta_resp(struct il_priv *il, struct il_addsta_cmd *addsta,
1566                         struct il_rx_pkt *pkt, bool sync)
1567 {
1568         u8 sta_id = addsta->sta.sta_id;
1569         unsigned long flags;
1570         int ret = -EIO;
1571
1572         if (pkt->hdr.flags & IL_CMD_FAILED_MSK) {
1573                 IL_ERR("Bad return from C_ADD_STA (0x%08X)\n", pkt->hdr.flags);
1574                 return ret;
1575         }
1576
1577         D_INFO("Processing response for adding station %u\n", sta_id);
1578
1579         spin_lock_irqsave(&il->sta_lock, flags);
1580
1581         switch (pkt->u.add_sta.status) {
1582         case ADD_STA_SUCCESS_MSK:
1583                 D_INFO("C_ADD_STA PASSED\n");
1584                 il_sta_ucode_activate(il, sta_id);
1585                 ret = 0;
1586                 break;
1587         case ADD_STA_NO_ROOM_IN_TBL:
1588                 IL_ERR("Adding station %d failed, no room in table.\n", sta_id);
1589                 break;
1590         case ADD_STA_NO_BLOCK_ACK_RESOURCE:
1591                 IL_ERR("Adding station %d failed, no block ack resource.\n",
1592                        sta_id);
1593                 break;
1594         case ADD_STA_MODIFY_NON_EXIST_STA:
1595                 IL_ERR("Attempting to modify non-existing station %d\n",
1596                        sta_id);
1597                 break;
1598         default:
1599                 D_ASSOC("Received C_ADD_STA:(0x%08X)\n", pkt->u.add_sta.status);
1600                 break;
1601         }
1602
1603         D_INFO("%s station id %u addr %pM\n",
1604                il->stations[sta_id].sta.mode ==
1605                STA_CONTROL_MODIFY_MSK ? "Modified" : "Added", sta_id,
1606                il->stations[sta_id].sta.sta.addr);
1607
1608         /*
1609          * XXX: The MAC address in the command buffer is often changed from
1610          * the original sent to the device. That is, the MAC address
1611          * written to the command buffer often is not the same MAC address
1612          * read from the command buffer when the command returns. This
1613          * issue has not yet been resolved and this debugging is left to
1614          * observe the problem.
1615          */
1616         D_INFO("%s station according to cmd buffer %pM\n",
1617                il->stations[sta_id].sta.mode ==
1618                STA_CONTROL_MODIFY_MSK ? "Modified" : "Added", addsta->sta.addr);
1619         spin_unlock_irqrestore(&il->sta_lock, flags);
1620
1621         return ret;
1622 }
1623
1624 static void
1625 il_add_sta_callback(struct il_priv *il, struct il_device_cmd *cmd,
1626                     struct il_rx_pkt *pkt)
1627 {
1628         struct il_addsta_cmd *addsta = (struct il_addsta_cmd *)cmd->cmd.payload;
1629
1630         il_process_add_sta_resp(il, addsta, pkt, false);
1631
1632 }
1633
1634 int
1635 il_send_add_sta(struct il_priv *il, struct il_addsta_cmd *sta, u8 flags)
1636 {
1637         struct il_rx_pkt *pkt = NULL;
1638         int ret = 0;
1639         u8 data[sizeof(*sta)];
1640         struct il_host_cmd cmd = {
1641                 .id = C_ADD_STA,
1642                 .flags = flags,
1643                 .data = data,
1644         };
1645         u8 sta_id __maybe_unused = sta->sta.sta_id;
1646
1647         D_INFO("Adding sta %u (%pM) %ssynchronously\n", sta_id, sta->sta.addr,
1648                flags & CMD_ASYNC ? "a" : "");
1649
1650         if (flags & CMD_ASYNC)
1651                 cmd.callback = il_add_sta_callback;
1652         else {
1653                 cmd.flags |= CMD_WANT_SKB;
1654                 might_sleep();
1655         }
1656
1657         cmd.len = il->cfg->ops->utils->build_addsta_hcmd(sta, data);
1658         ret = il_send_cmd(il, &cmd);
1659
1660         if (ret || (flags & CMD_ASYNC))
1661                 return ret;
1662
1663         if (ret == 0) {
1664                 pkt = (struct il_rx_pkt *)cmd.reply_page;
1665                 ret = il_process_add_sta_resp(il, sta, pkt, true);
1666         }
1667         il_free_pages(il, cmd.reply_page);
1668
1669         return ret;
1670 }
1671 EXPORT_SYMBOL(il_send_add_sta);
1672
1673 static void
1674 il_set_ht_add_station(struct il_priv *il, u8 idx, struct ieee80211_sta *sta,
1675                       struct il_rxon_context *ctx)
1676 {
1677         struct ieee80211_sta_ht_cap *sta_ht_inf = &sta->ht_cap;
1678         __le32 sta_flags;
1679         u8 mimo_ps_mode;
1680
1681         if (!sta || !sta_ht_inf->ht_supported)
1682                 goto done;
1683
1684         mimo_ps_mode = (sta_ht_inf->cap & IEEE80211_HT_CAP_SM_PS) >> 2;
1685         D_ASSOC("spatial multiplexing power save mode: %s\n",
1686                 (mimo_ps_mode == WLAN_HT_CAP_SM_PS_STATIC) ? "static" :
1687                 (mimo_ps_mode == WLAN_HT_CAP_SM_PS_DYNAMIC) ? "dynamic" :
1688                 "disabled");
1689
1690         sta_flags = il->stations[idx].sta.station_flags;
1691
1692         sta_flags &= ~(STA_FLG_RTS_MIMO_PROT_MSK | STA_FLG_MIMO_DIS_MSK);
1693
1694         switch (mimo_ps_mode) {
1695         case WLAN_HT_CAP_SM_PS_STATIC:
1696                 sta_flags |= STA_FLG_MIMO_DIS_MSK;
1697                 break;
1698         case WLAN_HT_CAP_SM_PS_DYNAMIC:
1699                 sta_flags |= STA_FLG_RTS_MIMO_PROT_MSK;
1700                 break;
1701         case WLAN_HT_CAP_SM_PS_DISABLED:
1702                 break;
1703         default:
1704                 IL_WARN("Invalid MIMO PS mode %d\n", mimo_ps_mode);
1705                 break;
1706         }
1707
1708         sta_flags |=
1709             cpu_to_le32((u32) sta_ht_inf->
1710                         ampdu_factor << STA_FLG_MAX_AGG_SIZE_POS);
1711
1712         sta_flags |=
1713             cpu_to_le32((u32) sta_ht_inf->
1714                         ampdu_density << STA_FLG_AGG_MPDU_DENSITY_POS);
1715
1716         if (il_is_ht40_tx_allowed(il, ctx, &sta->ht_cap))
1717                 sta_flags |= STA_FLG_HT40_EN_MSK;
1718         else
1719                 sta_flags &= ~STA_FLG_HT40_EN_MSK;
1720
1721         il->stations[idx].sta.station_flags = sta_flags;
1722 done:
1723         return;
1724 }
1725
1726 /**
1727  * il_prep_station - Prepare station information for addition
1728  *
1729  * should be called with sta_lock held
1730  */
1731 u8
1732 il_prep_station(struct il_priv *il, struct il_rxon_context *ctx,
1733                 const u8 *addr, bool is_ap, struct ieee80211_sta *sta)
1734 {
1735         struct il_station_entry *station;
1736         int i;
1737         u8 sta_id = IL_INVALID_STATION;
1738         u16 rate;
1739
1740         if (is_ap)
1741                 sta_id = ctx->ap_sta_id;
1742         else if (is_broadcast_ether_addr(addr))
1743                 sta_id = ctx->bcast_sta_id;
1744         else
1745                 for (i = IL_STA_ID; i < il->hw_params.max_stations; i++) {
1746                         if (!compare_ether_addr
1747                             (il->stations[i].sta.sta.addr, addr)) {
1748                                 sta_id = i;
1749                                 break;
1750                         }
1751
1752                         if (!il->stations[i].used &&
1753                             sta_id == IL_INVALID_STATION)
1754                                 sta_id = i;
1755                 }
1756
1757         /*
1758          * These two conditions have the same outcome, but keep them
1759          * separate
1760          */
1761         if (unlikely(sta_id == IL_INVALID_STATION))
1762                 return sta_id;
1763
1764         /*
1765          * uCode is not able to deal with multiple requests to add a
1766          * station. Keep track if one is in progress so that we do not send
1767          * another.
1768          */
1769         if (il->stations[sta_id].used & IL_STA_UCODE_INPROGRESS) {
1770                 D_INFO("STA %d already in process of being added.\n", sta_id);
1771                 return sta_id;
1772         }
1773
1774         if ((il->stations[sta_id].used & IL_STA_DRIVER_ACTIVE) &&
1775             (il->stations[sta_id].used & IL_STA_UCODE_ACTIVE) &&
1776             !compare_ether_addr(il->stations[sta_id].sta.sta.addr, addr)) {
1777                 D_ASSOC("STA %d (%pM) already added, not adding again.\n",
1778                         sta_id, addr);
1779                 return sta_id;
1780         }
1781
1782         station = &il->stations[sta_id];
1783         station->used = IL_STA_DRIVER_ACTIVE;
1784         D_ASSOC("Add STA to driver ID %d: %pM\n", sta_id, addr);
1785         il->num_stations++;
1786
1787         /* Set up the C_ADD_STA command to send to device */
1788         memset(&station->sta, 0, sizeof(struct il_addsta_cmd));
1789         memcpy(station->sta.sta.addr, addr, ETH_ALEN);
1790         station->sta.mode = 0;
1791         station->sta.sta.sta_id = sta_id;
1792         station->sta.station_flags = ctx->station_flags;
1793         station->ctxid = ctx->ctxid;
1794
1795         if (sta) {
1796                 struct il_station_priv_common *sta_priv;
1797
1798                 sta_priv = (void *)sta->drv_priv;
1799                 sta_priv->ctx = ctx;
1800         }
1801
1802         /*
1803          * OK to call unconditionally, since local stations (IBSS BSSID
1804          * STA and broadcast STA) pass in a NULL sta, and mac80211
1805          * doesn't allow HT IBSS.
1806          */
1807         il_set_ht_add_station(il, sta_id, sta, ctx);
1808
1809         /* 3945 only */
1810         rate = (il->band == IEEE80211_BAND_5GHZ) ? RATE_6M_PLCP : RATE_1M_PLCP;
1811         /* Turn on both antennas for the station... */
1812         station->sta.rate_n_flags = cpu_to_le16(rate | RATE_MCS_ANT_AB_MSK);
1813
1814         return sta_id;
1815
1816 }
1817 EXPORT_SYMBOL_GPL(il_prep_station);
1818
1819 #define STA_WAIT_TIMEOUT (HZ/2)
1820
1821 /**
1822  * il_add_station_common -
1823  */
1824 int
1825 il_add_station_common(struct il_priv *il, struct il_rxon_context *ctx,
1826                       const u8 *addr, bool is_ap, struct ieee80211_sta *sta,
1827                       u8 *sta_id_r)
1828 {
1829         unsigned long flags_spin;
1830         int ret = 0;
1831         u8 sta_id;
1832         struct il_addsta_cmd sta_cmd;
1833
1834         *sta_id_r = 0;
1835         spin_lock_irqsave(&il->sta_lock, flags_spin);
1836         sta_id = il_prep_station(il, ctx, addr, is_ap, sta);
1837         if (sta_id == IL_INVALID_STATION) {
1838                 IL_ERR("Unable to prepare station %pM for addition\n", addr);
1839                 spin_unlock_irqrestore(&il->sta_lock, flags_spin);
1840                 return -EINVAL;
1841         }
1842
1843         /*
1844          * uCode is not able to deal with multiple requests to add a
1845          * station. Keep track if one is in progress so that we do not send
1846          * another.
1847          */
1848         if (il->stations[sta_id].used & IL_STA_UCODE_INPROGRESS) {
1849                 D_INFO("STA %d already in process of being added.\n", sta_id);
1850                 spin_unlock_irqrestore(&il->sta_lock, flags_spin);
1851                 return -EEXIST;
1852         }
1853
1854         if ((il->stations[sta_id].used & IL_STA_DRIVER_ACTIVE) &&
1855             (il->stations[sta_id].used & IL_STA_UCODE_ACTIVE)) {
1856                 D_ASSOC("STA %d (%pM) already added, not adding again.\n",
1857                         sta_id, addr);
1858                 spin_unlock_irqrestore(&il->sta_lock, flags_spin);
1859                 return -EEXIST;
1860         }
1861
1862         il->stations[sta_id].used |= IL_STA_UCODE_INPROGRESS;
1863         memcpy(&sta_cmd, &il->stations[sta_id].sta,
1864                sizeof(struct il_addsta_cmd));
1865         spin_unlock_irqrestore(&il->sta_lock, flags_spin);
1866
1867         /* Add station to device's station table */
1868         ret = il_send_add_sta(il, &sta_cmd, CMD_SYNC);
1869         if (ret) {
1870                 spin_lock_irqsave(&il->sta_lock, flags_spin);
1871                 IL_ERR("Adding station %pM failed.\n",
1872                        il->stations[sta_id].sta.sta.addr);
1873                 il->stations[sta_id].used &= ~IL_STA_DRIVER_ACTIVE;
1874                 il->stations[sta_id].used &= ~IL_STA_UCODE_INPROGRESS;
1875                 spin_unlock_irqrestore(&il->sta_lock, flags_spin);
1876         }
1877         *sta_id_r = sta_id;
1878         return ret;
1879 }
1880 EXPORT_SYMBOL(il_add_station_common);
1881
1882 /**
1883  * il_sta_ucode_deactivate - deactivate ucode status for a station
1884  *
1885  * il->sta_lock must be held
1886  */
1887 static void
1888 il_sta_ucode_deactivate(struct il_priv *il, u8 sta_id)
1889 {
1890         /* Ucode must be active and driver must be non active */
1891         if ((il->stations[sta_id].
1892              used & (IL_STA_UCODE_ACTIVE | IL_STA_DRIVER_ACTIVE)) !=
1893             IL_STA_UCODE_ACTIVE)
1894                 IL_ERR("removed non active STA %u\n", sta_id);
1895
1896         il->stations[sta_id].used &= ~IL_STA_UCODE_ACTIVE;
1897
1898         memset(&il->stations[sta_id], 0, sizeof(struct il_station_entry));
1899         D_ASSOC("Removed STA %u\n", sta_id);
1900 }
1901
1902 static int
1903 il_send_remove_station(struct il_priv *il, const u8 * addr, int sta_id,
1904                        bool temporary)
1905 {
1906         struct il_rx_pkt *pkt;
1907         int ret;
1908
1909         unsigned long flags_spin;
1910         struct il_rem_sta_cmd rm_sta_cmd;
1911
1912         struct il_host_cmd cmd = {
1913                 .id = C_REM_STA,
1914                 .len = sizeof(struct il_rem_sta_cmd),
1915                 .flags = CMD_SYNC,
1916                 .data = &rm_sta_cmd,
1917         };
1918
1919         memset(&rm_sta_cmd, 0, sizeof(rm_sta_cmd));
1920         rm_sta_cmd.num_sta = 1;
1921         memcpy(&rm_sta_cmd.addr, addr, ETH_ALEN);
1922
1923         cmd.flags |= CMD_WANT_SKB;
1924
1925         ret = il_send_cmd(il, &cmd);
1926
1927         if (ret)
1928                 return ret;
1929
1930         pkt = (struct il_rx_pkt *)cmd.reply_page;
1931         if (pkt->hdr.flags & IL_CMD_FAILED_MSK) {
1932                 IL_ERR("Bad return from C_REM_STA (0x%08X)\n", pkt->hdr.flags);
1933                 ret = -EIO;
1934         }
1935
1936         if (!ret) {
1937                 switch (pkt->u.rem_sta.status) {
1938                 case REM_STA_SUCCESS_MSK:
1939                         if (!temporary) {
1940                                 spin_lock_irqsave(&il->sta_lock, flags_spin);
1941                                 il_sta_ucode_deactivate(il, sta_id);
1942                                 spin_unlock_irqrestore(&il->sta_lock,
1943                                                        flags_spin);
1944                         }
1945                         D_ASSOC("C_REM_STA PASSED\n");
1946                         break;
1947                 default:
1948                         ret = -EIO;
1949                         IL_ERR("C_REM_STA failed\n");
1950                         break;
1951                 }
1952         }
1953         il_free_pages(il, cmd.reply_page);
1954
1955         return ret;
1956 }
1957
1958 /**
1959  * il_remove_station - Remove driver's knowledge of station.
1960  */
1961 int
1962 il_remove_station(struct il_priv *il, const u8 sta_id, const u8 * addr)
1963 {
1964         unsigned long flags;
1965
1966         if (!il_is_ready(il)) {
1967                 D_INFO("Unable to remove station %pM, device not ready.\n",
1968                        addr);
1969                 /*
1970                  * It is typical for stations to be removed when we are
1971                  * going down. Return success since device will be down
1972                  * soon anyway
1973                  */
1974                 return 0;
1975         }
1976
1977         D_ASSOC("Removing STA from driver:%d  %pM\n", sta_id, addr);
1978
1979         if (WARN_ON(sta_id == IL_INVALID_STATION))
1980                 return -EINVAL;
1981
1982         spin_lock_irqsave(&il->sta_lock, flags);
1983
1984         if (!(il->stations[sta_id].used & IL_STA_DRIVER_ACTIVE)) {
1985                 D_INFO("Removing %pM but non DRIVER active\n", addr);
1986                 goto out_err;
1987         }
1988
1989         if (!(il->stations[sta_id].used & IL_STA_UCODE_ACTIVE)) {
1990                 D_INFO("Removing %pM but non UCODE active\n", addr);
1991                 goto out_err;
1992         }
1993
1994         if (il->stations[sta_id].used & IL_STA_LOCAL) {
1995                 kfree(il->stations[sta_id].lq);
1996                 il->stations[sta_id].lq = NULL;
1997         }
1998
1999         il->stations[sta_id].used &= ~IL_STA_DRIVER_ACTIVE;
2000
2001         il->num_stations--;
2002
2003         BUG_ON(il->num_stations < 0);
2004
2005         spin_unlock_irqrestore(&il->sta_lock, flags);
2006
2007         return il_send_remove_station(il, addr, sta_id, false);
2008 out_err:
2009         spin_unlock_irqrestore(&il->sta_lock, flags);
2010         return -EINVAL;
2011 }
2012 EXPORT_SYMBOL_GPL(il_remove_station);
2013
2014 /**
2015  * il_clear_ucode_stations - clear ucode station table bits
2016  *
2017  * This function clears all the bits in the driver indicating
2018  * which stations are active in the ucode. Call when something
2019  * other than explicit station management would cause this in
2020  * the ucode, e.g. unassociated RXON.
2021  */
2022 void
2023 il_clear_ucode_stations(struct il_priv *il, struct il_rxon_context *ctx)
2024 {
2025         int i;
2026         unsigned long flags_spin;
2027         bool cleared = false;
2028
2029         D_INFO("Clearing ucode stations in driver\n");
2030
2031         spin_lock_irqsave(&il->sta_lock, flags_spin);
2032         for (i = 0; i < il->hw_params.max_stations; i++) {
2033                 if (ctx && ctx->ctxid != il->stations[i].ctxid)
2034                         continue;
2035
2036                 if (il->stations[i].used & IL_STA_UCODE_ACTIVE) {
2037                         D_INFO("Clearing ucode active for station %d\n", i);
2038                         il->stations[i].used &= ~IL_STA_UCODE_ACTIVE;
2039                         cleared = true;
2040                 }
2041         }
2042         spin_unlock_irqrestore(&il->sta_lock, flags_spin);
2043
2044         if (!cleared)
2045                 D_INFO("No active stations found to be cleared\n");
2046 }
2047 EXPORT_SYMBOL(il_clear_ucode_stations);
2048
2049 /**
2050  * il_restore_stations() - Restore driver known stations to device
2051  *
2052  * All stations considered active by driver, but not present in ucode, is
2053  * restored.
2054  *
2055  * Function sleeps.
2056  */
2057 void
2058 il_restore_stations(struct il_priv *il, struct il_rxon_context *ctx)
2059 {
2060         struct il_addsta_cmd sta_cmd;
2061         struct il_link_quality_cmd lq;
2062         unsigned long flags_spin;
2063         int i;
2064         bool found = false;
2065         int ret;
2066         bool send_lq;
2067
2068         if (!il_is_ready(il)) {
2069                 D_INFO("Not ready yet, not restoring any stations.\n");
2070                 return;
2071         }
2072
2073         D_ASSOC("Restoring all known stations ... start.\n");
2074         spin_lock_irqsave(&il->sta_lock, flags_spin);
2075         for (i = 0; i < il->hw_params.max_stations; i++) {
2076                 if (ctx->ctxid != il->stations[i].ctxid)
2077                         continue;
2078                 if ((il->stations[i].used & IL_STA_DRIVER_ACTIVE) &&
2079                     !(il->stations[i].used & IL_STA_UCODE_ACTIVE)) {
2080                         D_ASSOC("Restoring sta %pM\n",
2081                                 il->stations[i].sta.sta.addr);
2082                         il->stations[i].sta.mode = 0;
2083                         il->stations[i].used |= IL_STA_UCODE_INPROGRESS;
2084                         found = true;
2085                 }
2086         }
2087
2088         for (i = 0; i < il->hw_params.max_stations; i++) {
2089                 if ((il->stations[i].used & IL_STA_UCODE_INPROGRESS)) {
2090                         memcpy(&sta_cmd, &il->stations[i].sta,
2091                                sizeof(struct il_addsta_cmd));
2092                         send_lq = false;
2093                         if (il->stations[i].lq) {
2094                                 memcpy(&lq, il->stations[i].lq,
2095                                        sizeof(struct il_link_quality_cmd));
2096                                 send_lq = true;
2097                         }
2098                         spin_unlock_irqrestore(&il->sta_lock, flags_spin);
2099                         ret = il_send_add_sta(il, &sta_cmd, CMD_SYNC);
2100                         if (ret) {
2101                                 spin_lock_irqsave(&il->sta_lock, flags_spin);
2102                                 IL_ERR("Adding station %pM failed.\n",
2103                                        il->stations[i].sta.sta.addr);
2104                                 il->stations[i].used &= ~IL_STA_DRIVER_ACTIVE;
2105                                 il->stations[i].used &=
2106                                     ~IL_STA_UCODE_INPROGRESS;
2107                                 spin_unlock_irqrestore(&il->sta_lock,
2108                                                        flags_spin);
2109                         }
2110                         /*
2111                          * Rate scaling has already been initialized, send
2112                          * current LQ command
2113                          */
2114                         if (send_lq)
2115                                 il_send_lq_cmd(il, ctx, &lq, CMD_SYNC, true);
2116                         spin_lock_irqsave(&il->sta_lock, flags_spin);
2117                         il->stations[i].used &= ~IL_STA_UCODE_INPROGRESS;
2118                 }
2119         }
2120
2121         spin_unlock_irqrestore(&il->sta_lock, flags_spin);
2122         if (!found)
2123                 D_INFO("Restoring all known stations"
2124                        " .... no stations to be restored.\n");
2125         else
2126                 D_INFO("Restoring all known stations" " .... complete.\n");
2127 }
2128 EXPORT_SYMBOL(il_restore_stations);
2129
2130 int
2131 il_get_free_ucode_key_idx(struct il_priv *il)
2132 {
2133         int i;
2134
2135         for (i = 0; i < il->sta_key_max_num; i++)
2136                 if (!test_and_set_bit(i, &il->ucode_key_table))
2137                         return i;
2138
2139         return WEP_INVALID_OFFSET;
2140 }
2141 EXPORT_SYMBOL(il_get_free_ucode_key_idx);
2142
2143 void
2144 il_dealloc_bcast_stations(struct il_priv *il)
2145 {
2146         unsigned long flags;
2147         int i;
2148
2149         spin_lock_irqsave(&il->sta_lock, flags);
2150         for (i = 0; i < il->hw_params.max_stations; i++) {
2151                 if (!(il->stations[i].used & IL_STA_BCAST))
2152                         continue;
2153
2154                 il->stations[i].used &= ~IL_STA_UCODE_ACTIVE;
2155                 il->num_stations--;
2156                 BUG_ON(il->num_stations < 0);
2157                 kfree(il->stations[i].lq);
2158                 il->stations[i].lq = NULL;
2159         }
2160         spin_unlock_irqrestore(&il->sta_lock, flags);
2161 }
2162 EXPORT_SYMBOL_GPL(il_dealloc_bcast_stations);
2163
2164 #ifdef CONFIG_IWLEGACY_DEBUG
2165 static void
2166 il_dump_lq_cmd(struct il_priv *il, struct il_link_quality_cmd *lq)
2167 {
2168         int i;
2169         D_RATE("lq station id 0x%x\n", lq->sta_id);
2170         D_RATE("lq ant 0x%X 0x%X\n", lq->general_params.single_stream_ant_msk,
2171                lq->general_params.dual_stream_ant_msk);
2172
2173         for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
2174                 D_RATE("lq idx %d 0x%X\n", i, lq->rs_table[i].rate_n_flags);
2175 }
2176 #else
2177 static inline void
2178 il_dump_lq_cmd(struct il_priv *il, struct il_link_quality_cmd *lq)
2179 {
2180 }
2181 #endif
2182
2183 /**
2184  * il_is_lq_table_valid() - Test one aspect of LQ cmd for validity
2185  *
2186  * It sometimes happens when a HT rate has been in use and we
2187  * loose connectivity with AP then mac80211 will first tell us that the
2188  * current channel is not HT anymore before removing the station. In such a
2189  * scenario the RXON flags will be updated to indicate we are not
2190  * communicating HT anymore, but the LQ command may still contain HT rates.
2191  * Test for this to prevent driver from sending LQ command between the time
2192  * RXON flags are updated and when LQ command is updated.
2193  */
2194 static bool
2195 il_is_lq_table_valid(struct il_priv *il, struct il_rxon_context *ctx,
2196                      struct il_link_quality_cmd *lq)
2197 {
2198         int i;
2199
2200         if (ctx->ht.enabled)
2201                 return true;
2202
2203         D_INFO("Channel %u is not an HT channel\n", ctx->active.channel);
2204         for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
2205                 if (le32_to_cpu(lq->rs_table[i].rate_n_flags) & RATE_MCS_HT_MSK) {
2206                         D_INFO("idx %d of LQ expects HT channel\n", i);
2207                         return false;
2208                 }
2209         }
2210         return true;
2211 }
2212
2213 /**
2214  * il_send_lq_cmd() - Send link quality command
2215  * @init: This command is sent as part of station initialization right
2216  *        after station has been added.
2217  *
2218  * The link quality command is sent as the last step of station creation.
2219  * This is the special case in which init is set and we call a callback in
2220  * this case to clear the state indicating that station creation is in
2221  * progress.
2222  */
2223 int
2224 il_send_lq_cmd(struct il_priv *il, struct il_rxon_context *ctx,
2225                struct il_link_quality_cmd *lq, u8 flags, bool init)
2226 {
2227         int ret = 0;
2228         unsigned long flags_spin;
2229
2230         struct il_host_cmd cmd = {
2231                 .id = C_TX_LINK_QUALITY_CMD,
2232                 .len = sizeof(struct il_link_quality_cmd),
2233                 .flags = flags,
2234                 .data = lq,
2235         };
2236
2237         if (WARN_ON(lq->sta_id == IL_INVALID_STATION))
2238                 return -EINVAL;
2239
2240         spin_lock_irqsave(&il->sta_lock, flags_spin);
2241         if (!(il->stations[lq->sta_id].used & IL_STA_DRIVER_ACTIVE)) {
2242                 spin_unlock_irqrestore(&il->sta_lock, flags_spin);
2243                 return -EINVAL;
2244         }
2245         spin_unlock_irqrestore(&il->sta_lock, flags_spin);
2246
2247         il_dump_lq_cmd(il, lq);
2248         BUG_ON(init && (cmd.flags & CMD_ASYNC));
2249
2250         if (il_is_lq_table_valid(il, ctx, lq))
2251                 ret = il_send_cmd(il, &cmd);
2252         else
2253                 ret = -EINVAL;
2254
2255         if (cmd.flags & CMD_ASYNC)
2256                 return ret;
2257
2258         if (init) {
2259                 D_INFO("init LQ command complete,"
2260                        " clearing sta addition status for sta %d\n",
2261                        lq->sta_id);
2262                 spin_lock_irqsave(&il->sta_lock, flags_spin);
2263                 il->stations[lq->sta_id].used &= ~IL_STA_UCODE_INPROGRESS;
2264                 spin_unlock_irqrestore(&il->sta_lock, flags_spin);
2265         }
2266         return ret;
2267 }
2268 EXPORT_SYMBOL(il_send_lq_cmd);
2269
2270 int
2271 il_mac_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2272                   struct ieee80211_sta *sta)
2273 {
2274         struct il_priv *il = hw->priv;
2275         struct il_station_priv_common *sta_common = (void *)sta->drv_priv;
2276         int ret;
2277
2278         D_INFO("received request to remove station %pM\n", sta->addr);
2279         mutex_lock(&il->mutex);
2280         D_INFO("proceeding to remove station %pM\n", sta->addr);
2281         ret = il_remove_station(il, sta_common->sta_id, sta->addr);
2282         if (ret)
2283                 IL_ERR("Error removing station %pM\n", sta->addr);
2284         mutex_unlock(&il->mutex);
2285         return ret;
2286 }
2287 EXPORT_SYMBOL(il_mac_sta_remove);
2288
2289 /************************** RX-FUNCTIONS ****************************/
2290 /*
2291  * Rx theory of operation
2292  *
2293  * Driver allocates a circular buffer of Receive Buffer Descriptors (RBDs),
2294  * each of which point to Receive Buffers to be filled by the NIC.  These get
2295  * used not only for Rx frames, but for any command response or notification
2296  * from the NIC.  The driver and NIC manage the Rx buffers by means
2297  * of idxes into the circular buffer.
2298  *
2299  * Rx Queue Indexes
2300  * The host/firmware share two idx registers for managing the Rx buffers.
2301  *
2302  * The READ idx maps to the first position that the firmware may be writing
2303  * to -- the driver can read up to (but not including) this position and get
2304  * good data.
2305  * The READ idx is managed by the firmware once the card is enabled.
2306  *
2307  * The WRITE idx maps to the last position the driver has read from -- the
2308  * position preceding WRITE is the last slot the firmware can place a packet.
2309  *
2310  * The queue is empty (no good data) if WRITE = READ - 1, and is full if
2311  * WRITE = READ.
2312  *
2313  * During initialization, the host sets up the READ queue position to the first
2314  * IDX position, and WRITE to the last (READ - 1 wrapped)
2315  *
2316  * When the firmware places a packet in a buffer, it will advance the READ idx
2317  * and fire the RX interrupt.  The driver can then query the READ idx and
2318  * process as many packets as possible, moving the WRITE idx forward as it
2319  * resets the Rx queue buffers with new memory.
2320  *
2321  * The management in the driver is as follows:
2322  * + A list of pre-allocated SKBs is stored in iwl->rxq->rx_free.  When
2323  *   iwl->rxq->free_count drops to or below RX_LOW_WATERMARK, work is scheduled
2324  *   to replenish the iwl->rxq->rx_free.
2325  * + In il_rx_replenish (scheduled) if 'processed' != 'read' then the
2326  *   iwl->rxq is replenished and the READ IDX is updated (updating the
2327  *   'processed' and 'read' driver idxes as well)
2328  * + A received packet is processed and handed to the kernel network stack,
2329  *   detached from the iwl->rxq.  The driver 'processed' idx is updated.
2330  * + The Host/Firmware iwl->rxq is replenished at tasklet time from the rx_free
2331  *   list. If there are no allocated buffers in iwl->rxq->rx_free, the READ
2332  *   IDX is not incremented and iwl->status(RX_STALLED) is set.  If there
2333  *   were enough free buffers and RX_STALLED is set it is cleared.
2334  *
2335  *
2336  * Driver sequence:
2337  *
2338  * il_rx_queue_alloc()   Allocates rx_free
2339  * il_rx_replenish()     Replenishes rx_free list from rx_used, and calls
2340  *                            il_rx_queue_restock
2341  * il_rx_queue_restock() Moves available buffers from rx_free into Rx
2342  *                            queue, updates firmware pointers, and updates
2343  *                            the WRITE idx.  If insufficient rx_free buffers
2344  *                            are available, schedules il_rx_replenish
2345  *
2346  * -- enable interrupts --
2347  * ISR - il_rx()         Detach il_rx_bufs from pool up to the
2348  *                            READ IDX, detaching the SKB from the pool.
2349  *                            Moves the packet buffer from queue to rx_used.
2350  *                            Calls il_rx_queue_restock to refill any empty
2351  *                            slots.
2352  * ...
2353  *
2354  */
2355
2356 /**
2357  * il_rx_queue_space - Return number of free slots available in queue.
2358  */
2359 int
2360 il_rx_queue_space(const struct il_rx_queue *q)
2361 {
2362         int s = q->read - q->write;
2363         if (s <= 0)
2364                 s += RX_QUEUE_SIZE;
2365         /* keep some buffer to not confuse full and empty queue */
2366         s -= 2;
2367         if (s < 0)
2368                 s = 0;
2369         return s;
2370 }
2371 EXPORT_SYMBOL(il_rx_queue_space);
2372
2373 /**
2374  * il_rx_queue_update_write_ptr - Update the write pointer for the RX queue
2375  */
2376 void
2377 il_rx_queue_update_write_ptr(struct il_priv *il, struct il_rx_queue *q)
2378 {
2379         unsigned long flags;
2380         u32 rx_wrt_ptr_reg = il->hw_params.rx_wrt_ptr_reg;
2381         u32 reg;
2382
2383         spin_lock_irqsave(&q->lock, flags);
2384
2385         if (q->need_update == 0)
2386                 goto exit_unlock;
2387
2388         /* If power-saving is in use, make sure device is awake */
2389         if (test_bit(S_POWER_PMI, &il->status)) {
2390                 reg = _il_rd(il, CSR_UCODE_DRV_GP1);
2391
2392                 if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
2393                         D_INFO("Rx queue requesting wakeup," " GP1 = 0x%x\n",
2394                                reg);
2395                         il_set_bit(il, CSR_GP_CNTRL,
2396                                    CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
2397                         goto exit_unlock;
2398                 }
2399
2400                 q->write_actual = (q->write & ~0x7);
2401                 il_wr(il, rx_wrt_ptr_reg, q->write_actual);
2402
2403                 /* Else device is assumed to be awake */
2404         } else {
2405                 /* Device expects a multiple of 8 */
2406                 q->write_actual = (q->write & ~0x7);
2407                 il_wr(il, rx_wrt_ptr_reg, q->write_actual);
2408         }
2409
2410         q->need_update = 0;
2411
2412 exit_unlock:
2413         spin_unlock_irqrestore(&q->lock, flags);
2414 }
2415 EXPORT_SYMBOL(il_rx_queue_update_write_ptr);
2416
2417 int
2418 il_rx_queue_alloc(struct il_priv *il)
2419 {
2420         struct il_rx_queue *rxq = &il->rxq;
2421         struct device *dev = &il->pci_dev->dev;
2422         int i;
2423
2424         spin_lock_init(&rxq->lock);
2425         INIT_LIST_HEAD(&rxq->rx_free);
2426         INIT_LIST_HEAD(&rxq->rx_used);
2427
2428         /* Alloc the circular buffer of Read Buffer Descriptors (RBDs) */
2429         rxq->bd =
2430             dma_alloc_coherent(dev, 4 * RX_QUEUE_SIZE, &rxq->bd_dma,
2431                                GFP_KERNEL);
2432         if (!rxq->bd)
2433                 goto err_bd;
2434
2435         rxq->rb_stts =
2436             dma_alloc_coherent(dev, sizeof(struct il_rb_status),
2437                                &rxq->rb_stts_dma, GFP_KERNEL);
2438         if (!rxq->rb_stts)
2439                 goto err_rb;
2440
2441         /* Fill the rx_used queue with _all_ of the Rx buffers */
2442         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++)
2443                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
2444
2445         /* Set us so that we have processed and used all buffers, but have
2446          * not restocked the Rx queue with fresh buffers */
2447         rxq->read = rxq->write = 0;
2448         rxq->write_actual = 0;
2449         rxq->free_count = 0;
2450         rxq->need_update = 0;
2451         return 0;
2452
2453 err_rb:
2454         dma_free_coherent(&il->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
2455                           rxq->bd_dma);
2456 err_bd:
2457         return -ENOMEM;
2458 }
2459 EXPORT_SYMBOL(il_rx_queue_alloc);
2460
2461 void
2462 il_hdl_spectrum_measurement(struct il_priv *il, struct il_rx_buf *rxb)
2463 {
2464         struct il_rx_pkt *pkt = rxb_addr(rxb);
2465         struct il_spectrum_notification *report = &(pkt->u.spectrum_notif);
2466
2467         if (!report->state) {
2468                 D_11H("Spectrum Measure Notification: Start\n");
2469                 return;
2470         }
2471
2472         memcpy(&il->measure_report, report, sizeof(*report));
2473         il->measurement_status |= MEASUREMENT_READY;
2474 }
2475 EXPORT_SYMBOL(il_hdl_spectrum_measurement);
2476
2477 /*
2478  * returns non-zero if packet should be dropped
2479  */
2480 int
2481 il_set_decrypted_flag(struct il_priv *il, struct ieee80211_hdr *hdr,
2482                       u32 decrypt_res, struct ieee80211_rx_status *stats)
2483 {
2484         u16 fc = le16_to_cpu(hdr->frame_control);
2485
2486         /*
2487          * All contexts have the same setting here due to it being
2488          * a module parameter, so OK to check any context.
2489          */
2490         if (il->ctx.active.filter_flags & RXON_FILTER_DIS_DECRYPT_MSK)
2491                 return 0;
2492
2493         if (!(fc & IEEE80211_FCTL_PROTECTED))
2494                 return 0;
2495
2496         D_RX("decrypt_res:0x%x\n", decrypt_res);
2497         switch (decrypt_res & RX_RES_STATUS_SEC_TYPE_MSK) {
2498         case RX_RES_STATUS_SEC_TYPE_TKIP:
2499                 /* The uCode has got a bad phase 1 Key, pushes the packet.
2500                  * Decryption will be done in SW. */
2501                 if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==
2502                     RX_RES_STATUS_BAD_KEY_TTAK)
2503                         break;
2504
2505         case RX_RES_STATUS_SEC_TYPE_WEP:
2506                 if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==
2507                     RX_RES_STATUS_BAD_ICV_MIC) {
2508                         /* bad ICV, the packet is destroyed since the
2509                          * decryption is inplace, drop it */
2510                         D_RX("Packet destroyed\n");
2511                         return -1;
2512                 }
2513         case RX_RES_STATUS_SEC_TYPE_CCMP:
2514                 if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==
2515                     RX_RES_STATUS_DECRYPT_OK) {
2516                         D_RX("hw decrypt successfully!!!\n");
2517                         stats->flag |= RX_FLAG_DECRYPTED;
2518                 }
2519                 break;
2520
2521         default:
2522                 break;
2523         }
2524         return 0;
2525 }
2526 EXPORT_SYMBOL(il_set_decrypted_flag);
2527
2528 /**
2529  * il_txq_update_write_ptr - Send new write idx to hardware
2530  */
2531 void
2532 il_txq_update_write_ptr(struct il_priv *il, struct il_tx_queue *txq)
2533 {
2534         u32 reg = 0;
2535         int txq_id = txq->q.id;
2536
2537         if (txq->need_update == 0)
2538                 return;
2539
2540         /* if we're trying to save power */
2541         if (test_bit(S_POWER_PMI, &il->status)) {
2542                 /* wake up nic if it's powered down ...
2543                  * uCode will wake up, and interrupt us again, so next
2544                  * time we'll skip this part. */
2545                 reg = _il_rd(il, CSR_UCODE_DRV_GP1);
2546
2547                 if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
2548                         D_INFO("Tx queue %d requesting wakeup," " GP1 = 0x%x\n",
2549                                txq_id, reg);
2550                         il_set_bit(il, CSR_GP_CNTRL,
2551                                    CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
2552                         return;
2553                 }
2554
2555                 il_wr(il, HBUS_TARG_WRPTR, txq->q.write_ptr | (txq_id << 8));
2556
2557                 /*
2558                  * else not in power-save mode,
2559                  * uCode will never sleep when we're
2560                  * trying to tx (during RFKILL, we're not trying to tx).
2561                  */
2562         } else
2563                 _il_wr(il, HBUS_TARG_WRPTR, txq->q.write_ptr | (txq_id << 8));
2564         txq->need_update = 0;
2565 }
2566 EXPORT_SYMBOL(il_txq_update_write_ptr);
2567
2568 /**
2569  * il_tx_queue_unmap -  Unmap any remaining DMA mappings and free skb's
2570  */
2571 void
2572 il_tx_queue_unmap(struct il_priv *il, int txq_id)
2573 {
2574         struct il_tx_queue *txq = &il->txq[txq_id];
2575         struct il_queue *q = &txq->q;
2576
2577         if (q->n_bd == 0)
2578                 return;
2579
2580         while (q->write_ptr != q->read_ptr) {
2581                 il->cfg->ops->lib->txq_free_tfd(il, txq);
2582                 q->read_ptr = il_queue_inc_wrap(q->read_ptr, q->n_bd);
2583         }
2584 }
2585 EXPORT_SYMBOL(il_tx_queue_unmap);
2586
2587 /**
2588  * il_tx_queue_free - Deallocate DMA queue.
2589  * @txq: Transmit queue to deallocate.
2590  *
2591  * Empty queue by removing and destroying all BD's.
2592  * Free all buffers.
2593  * 0-fill, but do not free "txq" descriptor structure.
2594  */
2595 void
2596 il_tx_queue_free(struct il_priv *il, int txq_id)
2597 {
2598         struct il_tx_queue *txq = &il->txq[txq_id];
2599         struct device *dev = &il->pci_dev->dev;
2600         int i;
2601
2602         il_tx_queue_unmap(il, txq_id);
2603
2604         /* De-alloc array of command/tx buffers */
2605         for (i = 0; i < TFD_TX_CMD_SLOTS; i++)
2606                 kfree(txq->cmd[i]);
2607
2608         /* De-alloc circular buffer of TFDs */
2609         if (txq->q.n_bd)
2610                 dma_free_coherent(dev, il->hw_params.tfd_size * txq->q.n_bd,
2611                                   txq->tfds, txq->q.dma_addr);
2612
2613         /* De-alloc array of per-TFD driver data */
2614         kfree(txq->txb);
2615         txq->txb = NULL;
2616
2617         /* deallocate arrays */
2618         kfree(txq->cmd);
2619         kfree(txq->meta);
2620         txq->cmd = NULL;
2621         txq->meta = NULL;
2622
2623         /* 0-fill queue descriptor structure */
2624         memset(txq, 0, sizeof(*txq));
2625 }
2626 EXPORT_SYMBOL(il_tx_queue_free);
2627
2628 /**
2629  * il_cmd_queue_unmap - Unmap any remaining DMA mappings from command queue
2630  */
2631 void
2632 il_cmd_queue_unmap(struct il_priv *il)
2633 {
2634         struct il_tx_queue *txq = &il->txq[il->cmd_queue];
2635         struct il_queue *q = &txq->q;
2636         int i;
2637
2638         if (q->n_bd == 0)
2639                 return;
2640
2641         while (q->read_ptr != q->write_ptr) {
2642                 i = il_get_cmd_idx(q, q->read_ptr, 0);
2643
2644                 if (txq->meta[i].flags & CMD_MAPPED) {
2645                         pci_unmap_single(il->pci_dev,
2646                                          dma_unmap_addr(&txq->meta[i], mapping),
2647                                          dma_unmap_len(&txq->meta[i], len),
2648                                          PCI_DMA_BIDIRECTIONAL);
2649                         txq->meta[i].flags = 0;
2650                 }
2651
2652                 q->read_ptr = il_queue_inc_wrap(q->read_ptr, q->n_bd);
2653         }
2654
2655         i = q->n_win;
2656         if (txq->meta[i].flags & CMD_MAPPED) {
2657                 pci_unmap_single(il->pci_dev,
2658                                  dma_unmap_addr(&txq->meta[i], mapping),
2659                                  dma_unmap_len(&txq->meta[i], len),
2660                                  PCI_DMA_BIDIRECTIONAL);
2661                 txq->meta[i].flags = 0;
2662         }
2663 }
2664 EXPORT_SYMBOL(il_cmd_queue_unmap);
2665
2666 /**
2667  * il_cmd_queue_free - Deallocate DMA queue.
2668  * @txq: Transmit queue to deallocate.
2669  *
2670  * Empty queue by removing and destroying all BD's.
2671  * Free all buffers.
2672  * 0-fill, but do not free "txq" descriptor structure.
2673  */
2674 void
2675 il_cmd_queue_free(struct il_priv *il)
2676 {
2677         struct il_tx_queue *txq = &il->txq[il->cmd_queue];
2678         struct device *dev = &il->pci_dev->dev;
2679         int i;
2680
2681         il_cmd_queue_unmap(il);
2682
2683         /* De-alloc array of command/tx buffers */
2684         for (i = 0; i <= TFD_CMD_SLOTS; i++)
2685                 kfree(txq->cmd[i]);
2686
2687         /* De-alloc circular buffer of TFDs */
2688         if (txq->q.n_bd)
2689                 dma_free_coherent(dev, il->hw_params.tfd_size * txq->q.n_bd,
2690                                   txq->tfds, txq->q.dma_addr);
2691
2692         /* deallocate arrays */
2693         kfree(txq->cmd);
2694         kfree(txq->meta);
2695         txq->cmd = NULL;
2696         txq->meta = NULL;
2697
2698         /* 0-fill queue descriptor structure */
2699         memset(txq, 0, sizeof(*txq));
2700 }
2701 EXPORT_SYMBOL(il_cmd_queue_free);
2702
2703 /*************** DMA-QUEUE-GENERAL-FUNCTIONS  *****
2704  * DMA services
2705  *
2706  * Theory of operation
2707  *
2708  * A Tx or Rx queue resides in host DRAM, and is comprised of a circular buffer
2709  * of buffer descriptors, each of which points to one or more data buffers for
2710  * the device to read from or fill.  Driver and device exchange status of each
2711  * queue via "read" and "write" pointers.  Driver keeps minimum of 2 empty
2712  * entries in each circular buffer, to protect against confusing empty and full
2713  * queue states.
2714  *
2715  * The device reads or writes the data in the queues via the device's several
2716  * DMA/FIFO channels.  Each queue is mapped to a single DMA channel.
2717  *
2718  * For Tx queue, there are low mark and high mark limits. If, after queuing
2719  * the packet for Tx, free space become < low mark, Tx queue stopped. When
2720  * reclaiming packets (on 'tx done IRQ), if free space become > high mark,
2721  * Tx queue resumed.
2722  *
2723  * See more detailed info in 4965.h.
2724  ***************************************************/
2725
2726 int
2727 il_queue_space(const struct il_queue *q)
2728 {
2729         int s = q->read_ptr - q->write_ptr;
2730
2731         if (q->read_ptr > q->write_ptr)
2732                 s -= q->n_bd;
2733
2734         if (s <= 0)
2735                 s += q->n_win;
2736         /* keep some reserve to not confuse empty and full situations */
2737         s -= 2;
2738         if (s < 0)
2739                 s = 0;
2740         return s;
2741 }
2742 EXPORT_SYMBOL(il_queue_space);
2743
2744
2745 /**
2746  * il_queue_init - Initialize queue's high/low-water and read/write idxes
2747  */
2748 static int
2749 il_queue_init(struct il_priv *il, struct il_queue *q, int count, int slots_num,
2750               u32 id)
2751 {
2752         q->n_bd = count;
2753         q->n_win = slots_num;
2754         q->id = id;
2755
2756         /* count must be power-of-two size, otherwise il_queue_inc_wrap
2757          * and il_queue_dec_wrap are broken. */
2758         BUG_ON(!is_power_of_2(count));
2759
2760         /* slots_num must be power-of-two size, otherwise
2761          * il_get_cmd_idx is broken. */
2762         BUG_ON(!is_power_of_2(slots_num));
2763
2764         q->low_mark = q->n_win / 4;
2765         if (q->low_mark < 4)
2766                 q->low_mark = 4;
2767
2768         q->high_mark = q->n_win / 8;
2769         if (q->high_mark < 2)
2770                 q->high_mark = 2;
2771
2772         q->write_ptr = q->read_ptr = 0;
2773
2774         return 0;
2775 }
2776
2777 /**
2778  * il_tx_queue_alloc - Alloc driver data and TFD CB for one Tx/cmd queue
2779  */
2780 static int
2781 il_tx_queue_alloc(struct il_priv *il, struct il_tx_queue *txq, u32 id)
2782 {
2783         struct device *dev = &il->pci_dev->dev;
2784         size_t tfd_sz = il->hw_params.tfd_size * TFD_QUEUE_SIZE_MAX;
2785
2786         /* Driver ilate data, only for Tx (not command) queues,
2787          * not shared with device. */
2788         if (id != il->cmd_queue) {
2789                 txq->txb =
2790                     kzalloc(sizeof(txq->txb[0]) * TFD_QUEUE_SIZE_MAX,
2791                             GFP_KERNEL);
2792                 if (!txq->txb) {
2793                         IL_ERR("kmalloc for auxiliary BD "
2794                                "structures failed\n");
2795                         goto error;
2796                 }
2797         } else {
2798                 txq->txb = NULL;
2799         }
2800
2801         /* Circular buffer of transmit frame descriptors (TFDs),
2802          * shared with device */
2803         txq->tfds =
2804             dma_alloc_coherent(dev, tfd_sz, &txq->q.dma_addr, GFP_KERNEL);
2805         if (!txq->tfds) {
2806                 IL_ERR("pci_alloc_consistent(%zd) failed\n", tfd_sz);
2807                 goto error;
2808         }
2809         txq->q.id = id;
2810
2811         return 0;
2812
2813 error:
2814         kfree(txq->txb);
2815         txq->txb = NULL;
2816
2817         return -ENOMEM;
2818 }
2819
2820 /**
2821  * il_tx_queue_init - Allocate and initialize one tx/cmd queue
2822  */
2823 int
2824 il_tx_queue_init(struct il_priv *il, struct il_tx_queue *txq, int slots_num,
2825                  u32 txq_id)
2826 {
2827         int i, len;
2828         int ret;
2829         int actual_slots = slots_num;
2830
2831         /*
2832          * Alloc buffer array for commands (Tx or other types of commands).
2833          * For the command queue (#4/#9), allocate command space + one big
2834          * command for scan, since scan command is very huge; the system will
2835          * not have two scans at the same time, so only one is needed.
2836          * For normal Tx queues (all other queues), no super-size command
2837          * space is needed.
2838          */
2839         if (txq_id == il->cmd_queue)
2840                 actual_slots++;
2841
2842         txq->meta =
2843             kzalloc(sizeof(struct il_cmd_meta) * actual_slots, GFP_KERNEL);
2844         txq->cmd =
2845             kzalloc(sizeof(struct il_device_cmd *) * actual_slots, GFP_KERNEL);
2846
2847         if (!txq->meta || !txq->cmd)
2848                 goto out_free_arrays;
2849
2850         len = sizeof(struct il_device_cmd);
2851         for (i = 0; i < actual_slots; i++) {
2852                 /* only happens for cmd queue */
2853                 if (i == slots_num)
2854                         len = IL_MAX_CMD_SIZE;
2855
2856                 txq->cmd[i] = kmalloc(len, GFP_KERNEL);
2857                 if (!txq->cmd[i])
2858                         goto err;
2859         }
2860
2861         /* Alloc driver data array and TFD circular buffer */
2862         ret = il_tx_queue_alloc(il, txq, txq_id);
2863         if (ret)
2864                 goto err;
2865
2866         txq->need_update = 0;
2867
2868         /*
2869          * For the default queues 0-3, set up the swq_id
2870          * already -- all others need to get one later
2871          * (if they need one at all).
2872          */
2873         if (txq_id < 4)
2874                 il_set_swq_id(txq, txq_id, txq_id);
2875
2876         /* TFD_QUEUE_SIZE_MAX must be power-of-two size, otherwise
2877          * il_queue_inc_wrap and il_queue_dec_wrap are broken. */
2878         BUILD_BUG_ON(TFD_QUEUE_SIZE_MAX & (TFD_QUEUE_SIZE_MAX - 1));
2879
2880         /* Initialize queue's high/low-water marks, and head/tail idxes */
2881         il_queue_init(il, &txq->q, TFD_QUEUE_SIZE_MAX, slots_num, txq_id);
2882
2883         /* Tell device where to find queue */
2884         il->cfg->ops->lib->txq_init(il, txq);
2885
2886         return 0;
2887 err:
2888         for (i = 0; i < actual_slots; i++)
2889                 kfree(txq->cmd[i]);
2890 out_free_arrays:
2891         kfree(txq->meta);
2892         kfree(txq->cmd);
2893
2894         return -ENOMEM;
2895 }
2896 EXPORT_SYMBOL(il_tx_queue_init);
2897
2898 void
2899 il_tx_queue_reset(struct il_priv *il, struct il_tx_queue *txq, int slots_num,
2900                   u32 txq_id)
2901 {
2902         int actual_slots = slots_num;
2903
2904         if (txq_id == il->cmd_queue)
2905                 actual_slots++;
2906
2907         memset(txq->meta, 0, sizeof(struct il_cmd_meta) * actual_slots);
2908
2909         txq->need_update = 0;
2910
2911         /* Initialize queue's high/low-water marks, and head/tail idxes */
2912         il_queue_init(il, &txq->q, TFD_QUEUE_SIZE_MAX, slots_num, txq_id);
2913
2914         /* Tell device where to find queue */
2915         il->cfg->ops->lib->txq_init(il, txq);
2916 }
2917 EXPORT_SYMBOL(il_tx_queue_reset);
2918
2919 /*************** HOST COMMAND QUEUE FUNCTIONS   *****/
2920
2921 /**
2922  * il_enqueue_hcmd - enqueue a uCode command
2923  * @il: device ilate data point
2924  * @cmd: a point to the ucode command structure
2925  *
2926  * The function returns < 0 values to indicate the operation is
2927  * failed. On success, it turns the idx (> 0) of command in the
2928  * command queue.
2929  */
2930 int
2931 il_enqueue_hcmd(struct il_priv *il, struct il_host_cmd *cmd)
2932 {
2933         struct il_tx_queue *txq = &il->txq[il->cmd_queue];
2934         struct il_queue *q = &txq->q;
2935         struct il_device_cmd *out_cmd;
2936         struct il_cmd_meta *out_meta;
2937         dma_addr_t phys_addr;
2938         unsigned long flags;
2939         int len;
2940         u32 idx;
2941         u16 fix_size;
2942
2943         cmd->len = il->cfg->ops->utils->get_hcmd_size(cmd->id, cmd->len);
2944         fix_size = (u16) (cmd->len + sizeof(out_cmd->hdr));
2945
2946         /* If any of the command structures end up being larger than
2947          * the TFD_MAX_PAYLOAD_SIZE, and it sent as a 'small' command then
2948          * we will need to increase the size of the TFD entries
2949          * Also, check to see if command buffer should not exceed the size
2950          * of device_cmd and max_cmd_size. */
2951         BUG_ON((fix_size > TFD_MAX_PAYLOAD_SIZE) &&
2952                !(cmd->flags & CMD_SIZE_HUGE));
2953         BUG_ON(fix_size > IL_MAX_CMD_SIZE);
2954
2955         if (il_is_rfkill(il) || il_is_ctkill(il)) {
2956                 IL_WARN("Not sending command - %s KILL\n",
2957                         il_is_rfkill(il) ? "RF" : "CT");
2958                 return -EIO;
2959         }
2960
2961         spin_lock_irqsave(&il->hcmd_lock, flags);
2962
2963         if (il_queue_space(q) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) {
2964                 spin_unlock_irqrestore(&il->hcmd_lock, flags);
2965
2966                 IL_ERR("Restarting adapter due to command queue full\n");
2967                 queue_work(il->workqueue, &il->restart);
2968                 return -ENOSPC;
2969         }
2970
2971         idx = il_get_cmd_idx(q, q->write_ptr, cmd->flags & CMD_SIZE_HUGE);
2972         out_cmd = txq->cmd[idx];
2973         out_meta = &txq->meta[idx];
2974
2975         if (WARN_ON(out_meta->flags & CMD_MAPPED)) {
2976                 spin_unlock_irqrestore(&il->hcmd_lock, flags);
2977                 return -ENOSPC;
2978         }
2979
2980         memset(out_meta, 0, sizeof(*out_meta)); /* re-initialize to NULL */
2981         out_meta->flags = cmd->flags | CMD_MAPPED;
2982         if (cmd->flags & CMD_WANT_SKB)
2983                 out_meta->source = cmd;
2984         if (cmd->flags & CMD_ASYNC)
2985                 out_meta->callback = cmd->callback;
2986
2987         out_cmd->hdr.cmd = cmd->id;
2988         memcpy(&out_cmd->cmd.payload, cmd->data, cmd->len);
2989
2990         /* At this point, the out_cmd now has all of the incoming cmd
2991          * information */
2992
2993         out_cmd->hdr.flags = 0;
2994         out_cmd->hdr.sequence =
2995             cpu_to_le16(QUEUE_TO_SEQ(il->cmd_queue) | IDX_TO_SEQ(q->write_ptr));
2996         if (cmd->flags & CMD_SIZE_HUGE)
2997                 out_cmd->hdr.sequence |= SEQ_HUGE_FRAME;
2998         len = sizeof(struct il_device_cmd);
2999         if (idx == TFD_CMD_SLOTS)
3000                 len = IL_MAX_CMD_SIZE;
3001
3002 #ifdef CONFIG_IWLEGACY_DEBUG
3003         switch (out_cmd->hdr.cmd) {
3004         case C_TX_LINK_QUALITY_CMD:
3005         case C_SENSITIVITY:
3006                 D_HC_DUMP("Sending command %s (#%x), seq: 0x%04X, "
3007                           "%d bytes at %d[%d]:%d\n",
3008                           il_get_cmd_string(out_cmd->hdr.cmd), out_cmd->hdr.cmd,
3009                           le16_to_cpu(out_cmd->hdr.sequence), fix_size,
3010                           q->write_ptr, idx, il->cmd_queue);
3011                 break;
3012         default:
3013                 D_HC("Sending command %s (#%x), seq: 0x%04X, "
3014                      "%d bytes at %d[%d]:%d\n",
3015                      il_get_cmd_string(out_cmd->hdr.cmd), out_cmd->hdr.cmd,
3016                      le16_to_cpu(out_cmd->hdr.sequence), fix_size, q->write_ptr,
3017                      idx, il->cmd_queue);
3018         }
3019 #endif
3020         txq->need_update = 1;
3021
3022         if (il->cfg->ops->lib->txq_update_byte_cnt_tbl)
3023                 /* Set up entry in queue's byte count circular buffer */
3024                 il->cfg->ops->lib->txq_update_byte_cnt_tbl(il, txq, 0);
3025
3026         phys_addr =
3027             pci_map_single(il->pci_dev, &out_cmd->hdr, fix_size,
3028                            PCI_DMA_BIDIRECTIONAL);
3029         dma_unmap_addr_set(out_meta, mapping, phys_addr);
3030         dma_unmap_len_set(out_meta, len, fix_size);
3031
3032         il->cfg->ops->lib->txq_attach_buf_to_tfd(il, txq, phys_addr, fix_size,
3033                                                  1, U32_PAD(cmd->len));
3034
3035         /* Increment and update queue's write idx */
3036         q->write_ptr = il_queue_inc_wrap(q->write_ptr, q->n_bd);
3037         il_txq_update_write_ptr(il, txq);
3038
3039         spin_unlock_irqrestore(&il->hcmd_lock, flags);
3040         return idx;
3041 }
3042
3043 /**
3044  * il_hcmd_queue_reclaim - Reclaim TX command queue entries already Tx'd
3045  *
3046  * When FW advances 'R' idx, all entries between old and new 'R' idx
3047  * need to be reclaimed. As result, some free space forms.  If there is
3048  * enough free space (> low mark), wake the stack that feeds us.
3049  */
3050 static void
3051 il_hcmd_queue_reclaim(struct il_priv *il, int txq_id, int idx, int cmd_idx)
3052 {
3053         struct il_tx_queue *txq = &il->txq[txq_id];
3054         struct il_queue *q = &txq->q;
3055         int nfreed = 0;
3056
3057         if (idx >= q->n_bd || il_queue_used(q, idx) == 0) {
3058                 IL_ERR("Read idx for DMA queue txq id (%d), idx %d, "
3059                        "is out of range [0-%d] %d %d.\n", txq_id, idx, q->n_bd,
3060                        q->write_ptr, q->read_ptr);
3061                 return;
3062         }
3063
3064         for (idx = il_queue_inc_wrap(idx, q->n_bd); q->read_ptr != idx;
3065              q->read_ptr = il_queue_inc_wrap(q->read_ptr, q->n_bd)) {
3066
3067                 if (nfreed++ > 0) {
3068                         IL_ERR("HCMD skipped: idx (%d) %d %d\n", idx,
3069                                q->write_ptr, q->read_ptr);
3070                         queue_work(il->workqueue, &il->restart);
3071                 }
3072
3073         }
3074 }
3075
3076 /**
3077  * il_tx_cmd_complete - Pull unused buffers off the queue and reclaim them
3078  * @rxb: Rx buffer to reclaim
3079  *
3080  * If an Rx buffer has an async callback associated with it the callback
3081  * will be executed.  The attached skb (if present) will only be freed
3082  * if the callback returns 1
3083  */
3084 void
3085 il_tx_cmd_complete(struct il_priv *il, struct il_rx_buf *rxb)
3086 {
3087         struct il_rx_pkt *pkt = rxb_addr(rxb);
3088         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
3089         int txq_id = SEQ_TO_QUEUE(sequence);
3090         int idx = SEQ_TO_IDX(sequence);
3091         int cmd_idx;
3092         bool huge = !!(pkt->hdr.sequence & SEQ_HUGE_FRAME);
3093         struct il_device_cmd *cmd;
3094         struct il_cmd_meta *meta;
3095         struct il_tx_queue *txq = &il->txq[il->cmd_queue];
3096         unsigned long flags;
3097
3098         /* If a Tx command is being handled and it isn't in the actual
3099          * command queue then there a command routing bug has been introduced
3100          * in the queue management code. */
3101         if (WARN
3102             (txq_id != il->cmd_queue,
3103              "wrong command queue %d (should be %d), sequence 0x%X readp=%d writep=%d\n",
3104              txq_id, il->cmd_queue, sequence, il->txq[il->cmd_queue].q.read_ptr,
3105              il->txq[il->cmd_queue].q.write_ptr)) {
3106                 il_print_hex_error(il, pkt, 32);
3107                 return;
3108         }
3109
3110         cmd_idx = il_get_cmd_idx(&txq->q, idx, huge);
3111         cmd = txq->cmd[cmd_idx];
3112         meta = &txq->meta[cmd_idx];
3113
3114         txq->time_stamp = jiffies;
3115
3116         pci_unmap_single(il->pci_dev, dma_unmap_addr(meta, mapping),
3117                          dma_unmap_len(meta, len), PCI_DMA_BIDIRECTIONAL);
3118
3119         /* Input error checking is done when commands are added to queue. */
3120         if (meta->flags & CMD_WANT_SKB) {
3121                 meta->source->reply_page = (unsigned long)rxb_addr(rxb);
3122                 rxb->page = NULL;
3123         } else if (meta->callback)
3124                 meta->callback(il, cmd, pkt);
3125
3126         spin_lock_irqsave(&il->hcmd_lock, flags);
3127
3128         il_hcmd_queue_reclaim(il, txq_id, idx, cmd_idx);
3129
3130         if (!(meta->flags & CMD_ASYNC)) {
3131                 clear_bit(S_HCMD_ACTIVE, &il->status);
3132                 D_INFO("Clearing HCMD_ACTIVE for command %s\n",
3133                        il_get_cmd_string(cmd->hdr.cmd));
3134                 wake_up(&il->wait_command_queue);
3135         }
3136
3137         /* Mark as unmapped */
3138         meta->flags = 0;
3139
3140         spin_unlock_irqrestore(&il->hcmd_lock, flags);
3141 }
3142 EXPORT_SYMBOL(il_tx_cmd_complete);
3143
3144 MODULE_DESCRIPTION("iwl-legacy: common functions for 3945 and 4965");
3145 MODULE_VERSION(IWLWIFI_VERSION);
3146 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
3147 MODULE_LICENSE("GPL");
3148
3149 /*
3150  * set bt_coex_active to true, uCode will do kill/defer
3151  * every time the priority line is asserted (BT is sending signals on the
3152  * priority line in the PCIx).
3153  * set bt_coex_active to false, uCode will ignore the BT activity and
3154  * perform the normal operation
3155  *
3156  * User might experience transmit issue on some platform due to WiFi/BT
3157  * co-exist problem. The possible behaviors are:
3158  *   Able to scan and finding all the available AP
3159  *   Not able to associate with any AP
3160  * On those platforms, WiFi communication can be restored by set
3161  * "bt_coex_active" module parameter to "false"
3162  *
3163  * default: bt_coex_active = true (BT_COEX_ENABLE)
3164  */
3165 static bool bt_coex_active = true;
3166 module_param(bt_coex_active, bool, S_IRUGO);
3167 MODULE_PARM_DESC(bt_coex_active, "enable wifi/bluetooth co-exist");
3168
3169 u32 il_debug_level;
3170 EXPORT_SYMBOL(il_debug_level);
3171
3172 const u8 il_bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
3173 EXPORT_SYMBOL(il_bcast_addr);
3174
3175 /* This function both allocates and initializes hw and il. */
3176 struct ieee80211_hw *
3177 il_alloc_all(struct il_cfg *cfg)
3178 {
3179         struct il_priv *il;
3180         /* mac80211 allocates memory for this device instance, including
3181          *   space for this driver's ilate structure */
3182         struct ieee80211_hw *hw;
3183
3184         hw = ieee80211_alloc_hw(sizeof(struct il_priv),
3185                                 cfg->ops->ieee80211_ops);
3186         if (hw == NULL) {
3187                 pr_err("%s: Can not allocate network device\n", cfg->name);
3188                 goto out;
3189         }
3190
3191         il = hw->priv;
3192         il->hw = hw;
3193
3194 out:
3195         return hw;
3196 }
3197 EXPORT_SYMBOL(il_alloc_all);
3198
3199 #define MAX_BIT_RATE_40_MHZ 150 /* Mbps */
3200 #define MAX_BIT_RATE_20_MHZ 72  /* Mbps */
3201 static void
3202 il_init_ht_hw_capab(const struct il_priv *il,
3203                     struct ieee80211_sta_ht_cap *ht_info,
3204                     enum ieee80211_band band)
3205 {
3206         u16 max_bit_rate = 0;
3207         u8 rx_chains_num = il->hw_params.rx_chains_num;
3208         u8 tx_chains_num = il->hw_params.tx_chains_num;
3209
3210         ht_info->cap = 0;
3211         memset(&ht_info->mcs, 0, sizeof(ht_info->mcs));
3212
3213         ht_info->ht_supported = true;
3214
3215         ht_info->cap |= IEEE80211_HT_CAP_SGI_20;
3216         max_bit_rate = MAX_BIT_RATE_20_MHZ;
3217         if (il->hw_params.ht40_channel & BIT(band)) {
3218                 ht_info->cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
3219                 ht_info->cap |= IEEE80211_HT_CAP_SGI_40;
3220                 ht_info->mcs.rx_mask[4] = 0x01;
3221                 max_bit_rate = MAX_BIT_RATE_40_MHZ;
3222         }
3223
3224         if (il->cfg->mod_params->amsdu_size_8K)
3225                 ht_info->cap |= IEEE80211_HT_CAP_MAX_AMSDU;
3226
3227         ht_info->ampdu_factor = CFG_HT_RX_AMPDU_FACTOR_DEF;
3228         ht_info->ampdu_density = CFG_HT_MPDU_DENSITY_DEF;
3229
3230         ht_info->mcs.rx_mask[0] = 0xFF;
3231         if (rx_chains_num >= 2)
3232                 ht_info->mcs.rx_mask[1] = 0xFF;
3233         if (rx_chains_num >= 3)
3234                 ht_info->mcs.rx_mask[2] = 0xFF;
3235
3236         /* Highest supported Rx data rate */
3237         max_bit_rate *= rx_chains_num;
3238         WARN_ON(max_bit_rate & ~IEEE80211_HT_MCS_RX_HIGHEST_MASK);
3239         ht_info->mcs.rx_highest = cpu_to_le16(max_bit_rate);
3240
3241         /* Tx MCS capabilities */
3242         ht_info->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
3243         if (tx_chains_num != rx_chains_num) {
3244                 ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_RX_DIFF;
3245                 ht_info->mcs.tx_params |=
3246                     ((tx_chains_num -
3247                       1) << IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT);
3248         }
3249 }