carlfw/src/wlantx.c

   1 /*
   2  * carl9170 firmware - used by the ar9170 wireless device
   3  *
   4  * WLAN transmit and tx status
   5  *
   6  * Copyright (c) 2000-2005 ZyDAS Technology Corporation
   7  * Copyright (c) 2007-2009 Atheros Communications, Inc.
   8  * Copyright    2009    Johannes Berg <johannes@sipsolutions.net>
   9  * Copyright 2009-2012  Christian Lamparter <chunkeey@googlemail.com>
  10  *
  11  * This program is free software; you can redistribute it and/or modify
  12  * it under the terms of the GNU General Public License as published by
  13  * the Free Software Foundation; either version 2 of the License, or
  14  * (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License along
  22  * with this program; If not, see <http://www.gnu.org/licenses/>.
  23  */
  24
  25 #include "carl9170.h"
  26 #include "shared/phy.h"
  27 #include "hostif.h"
  28 #include "timer.h"
  29 #include "wl.h"
  30 #include "printf.h"
  31 #include "rf.h"
  32 #include "linux/ieee80211.h"
  33 #include "wol.h"
  34
  35 static void wlan_txunstuck(unsigned int qidx)
  36 {
  37         struct dma_queue *queue = &fw.wlan.tx_queue[qidx];
  38         struct dma_desc *iter;
  39
  40         /*
  41          * walk up to the last descriptor which hasn't been
  42          * processed by the hardware before it bailed out
  43          * due to a TX error.
  44          * Note: if there was no more "pending" frame
  45          * in the queue, it iter will be on the
  46          *    queue->terminator (which is fine)
  47          */
  48         __for_each_desc_bits(iter, queue, AR9170_OWN_BITS_SW);
  49
  50         set_wlan_txq_dma_addr(qidx, ((uint32_t) iter) | 1);
  51         wlan_trigger(BIT(qidx));
  52 }
  53
  54 #ifdef CONFIG_CARL9170FW_DMA_QUEUE_BUMP
  55 static void wlan_txupdate(unsigned int qidx)
  56 {
  57         struct dma_queue *queue = &fw.wlan.tx_queue[qidx];
  58         struct dma_desc *iter;
  59         /* comment in wlan_txunstuck applies here too. */
  60         __for_each_desc_bits(iter, queue, AR9170_OWN_BITS_SW);
  61
  62         set_wlan_txq_dma_addr(qidx, ((uint32_t) iter));
  63         wlan_trigger(BIT(qidx));
  64 }
  65
  66 void wlan_dma_bump(unsigned int qidx)
  67 {
  68         unsigned int offset = qidx;
  69         uint32_t status, trigger;
  70
  71         status = get(AR9170_MAC_REG_DMA_STATUS) >> 12;
  72         trigger = get(AR9170_MAC_REG_DMA_TRIGGER) >> 12;
  73
  74         while (offset != 0) {
  75                 status >>= 4;
  76                 trigger >>= 4;
  77                 offset--;
  78         }
  79
  80         status &= 0xf;
  81         trigger &= 0xf;
  82
  83         if ((trigger == 0xa) && (status == 0x8)) {
  84                 DBG("UNSTUCK");
  85                 wlan_txunstuck(qidx);
  86         } else {
  87                 DBG("UPDATE");
  88                 wlan_txupdate(qidx);
  89         }
  90 }
  91 #else
  92 void wlan_dma_bump(unsigned int __unused qidx)
  93 {
  94 }
  95 #endif /* CONFIG_CARL9170FW_DMA_QUEUE_BUMP */
  96
  97 void wlan_send_buffered_tx_status(void)
  98 {
  99         unsigned int len;
 100
 101         while (fw.wlan.tx_status_pending) {
 102                 len = min((unsigned int)fw.wlan.tx_status_pending,
 103                           CARL9170_RSP_TX_STATUS_NUM);
 104                 len = min(len, CARL9170_TX_STATUS_NUM - fw.wlan.tx_status_head_idx);
 105
 106                 /*
 107                  * rather than memcpy each individual request into a large buffer,
 108                  * we _splice_ them all together.
 109                  *
 110                  * The only downside is however that we have to be careful around
 111                  * the edges of the tx_status_cache.
 112                  *
 113                  * Note:
 114                  * Each tx_status is about 2 bytes. However every command package
 115                  * must have a size which is a multiple of 4.
 116                  */
 117
 118                 send_cmd_to_host((len * sizeof(struct carl9170_tx_status) + 3) & ~3,
 119                                  CARL9170_RSP_TXCOMP, len, (void *)
 120                                  &fw.wlan.tx_status_cache[fw.wlan.tx_status_head_idx]);
 121
 122                 fw.wlan.tx_status_pending -= len;
 123                 fw.wlan.tx_status_head_idx += len;
 124                 fw.wlan.tx_status_head_idx %= CARL9170_TX_STATUS_NUM;
 125         }
 126 }
 127
 128 static struct carl9170_tx_status *wlan_get_tx_status_buffer(void)
 129 {
 130         struct carl9170_tx_status *tmp;
 131
 132         tmp = &fw.wlan.tx_status_cache[fw.wlan.tx_status_tail_idx++];
 133         fw.wlan.tx_status_tail_idx %= CARL9170_TX_STATUS_NUM;
 134
 135         if (fw.wlan.tx_status_pending == CARL9170_TX_STATUS_NUM)
 136                 wlan_send_buffered_tx_status();
 137
 138         fw.wlan.tx_status_pending++;
 139
 140         return tmp;
 141 }
 142
 143 /* generate _aggregated_ tx_status for the host */
 144 void wlan_tx_complete(struct carl9170_tx_superframe *super,
 145                       bool txs)
 146 {
 147         struct carl9170_tx_status *status;
 148
 149         status = wlan_get_tx_status_buffer();
 150
 151         /*
 152          * The *unique* cookie and AC_ID is used by the driver for
 153          * frame lookup.
 154          */
 155         status->cookie = super->s.cookie;
 156         status->queue = super->s.queue;
 157         super->s.cookie = 0;
 158
 159         /*
 160          * This field holds the number of tries of the rate in
 161          * the rate index field (rix).
 162          */
 163         status->rix = super->s.rix;
 164         status->tries = super->s.cnt;
 165         status->success = (txs) ? 1 : 0;
 166 }
 167
 168 static bool wlan_tx_consume_retry(struct carl9170_tx_superframe *super)
 169 {
 170         /* check if this was the last possible retry with this rate */
 171         if (unlikely(super->s.cnt >= super->s.ri[super->s.rix].tries)) {
 172                 /* end of the road - indicate tx failure */
 173                 if (unlikely(super->s.rix == CARL9170_TX_MAX_RETRY_RATES))
 174                         return false;
 175
 176                 /* check if there are alternative rates available */
 177                 if (!super->s.rr[super->s.rix].set)
 178                         return false;
 179
 180                 /* try next retry rate */
 181                 super->f.hdr.phy.set = super->s.rr[super->s.rix].set;
 182
 183                 /* finally - mark the old rate as USED */
 184                 super->s.rix++;
 185
 186                 /* update MAC flags */
 187                 super->f.hdr.mac.erp_prot = super->s.ri[super->s.rix].erp_prot;
 188                 super->f.hdr.mac.ampdu = super->s.ri[super->s.rix].ampdu;
 189
 190                 /* reinitialize try counter */
 191                 super->s.cnt = 1;
 192         } else {
 193                 /* just increase retry counter */
 194                 super->s.cnt++;
 195         }
 196
 197         return true;
 198 }
 199
 200 static inline u16 get_tid(struct ieee80211_hdr *hdr)
 201 {
 202         return (ieee80211_get_qos_ctl(hdr))[0] & IEEE80211_QOS_CTL_TID_MASK;
 203 }
 204
 205 /* This function will only work on uint32_t-aligned pointers! */
 206 static bool same_hdr(const void *_d0, const void *_d1)
 207 {
 208         const uint32_t *d0 = _d0;
 209         const uint32_t *d1 = _d1;
 210
 211         /* BUG_ON((unsigned long)d0 & 3 || (unsigned long)d1 & 3)) */
 212         return !((d0[0] ^ d1[0]) |                      /* FC + DU */
 213                  (d0[1] ^ d1[1]) |                      /* addr1 */
 214                  (d0[2] ^ d1[2]) | (d0[3] ^ d1[3]) |    /* addr2 + addr3 */
 215                  (d0[4] ^ d1[4]));                      /* addr3 */
 216 }
 217
 218 static inline bool same_aggr(struct ieee80211_hdr *a, struct ieee80211_hdr *b)
 219 {
 220         return (get_tid(a) == get_tid(b)) || same_hdr(a, b);
 221 }
 222
 223 static void wlan_tx_ampdu_reset(unsigned int qidx)
 224 {
 225         fw.wlan.ampdu_prev[qidx] = NULL;
 226 }
 227
 228 static void wlan_tx_ampdu_end(unsigned int qidx)
 229 {
 230         struct carl9170_tx_superframe *ht_prev = fw.wlan.ampdu_prev[qidx];
 231
 232         if (ht_prev)
 233                 ht_prev->f.hdr.mac.ba_end = 1;
 234
 235         wlan_tx_ampdu_reset(qidx);
 236 }
 237
 238 static void wlan_tx_ampdu(struct carl9170_tx_superframe *super)
 239 {
 240         unsigned int qidx = super->s.queue;
 241         struct carl9170_tx_superframe *ht_prev = fw.wlan.ampdu_prev[qidx];
 242
 243         if (super->f.hdr.mac.ampdu) {
 244                 if (ht_prev &&
 245                     !same_aggr(&super->f.data.i3e, &ht_prev->f.data.i3e))
 246                         ht_prev->f.hdr.mac.ba_end = 1;
 247                 else
 248                         super->f.hdr.mac.ba_end = 0;
 249
 250                 fw.wlan.ampdu_prev[qidx] = super;
 251         } else {
 252                 wlan_tx_ampdu_end(qidx);
 253         }
 254 }
 255
 256 /* for all tries */
 257 static void __wlan_tx(struct dma_desc *desc)
 258 {
 259         struct carl9170_tx_superframe *super = get_super(desc);
 260
 261         if (unlikely(super->s.fill_in_tsf)) {
 262                 struct ieee80211_mgmt *mgmt = (void *) &super->f.data.i3e;
 263                 uint32_t *tsf = (uint32_t *) &mgmt->u.probe_resp.timestamp;
 264
 265                 /*
 266                  * Truth be told: this is a hack.
 267                  *
 268                  * The *real* TSF is definitely going to be higher/older.
 269                  * But this hardware emulation code is head and shoulders
 270                  * above anything a driver can possibly do.
 271                  *
 272                  * (even, if it's got an accurate atomic clock source).
 273                  */
 274
 275                 read_tsf(tsf);
 276         }
 277
 278         wlan_tx_ampdu(super);
 279
 280 #if (defined CONFIG_CARL9170FW_DEBUG) && (defined CONFIG_CARL9170FW_RADIO_FUNCTIONS)
 281         BUG_ON(fw.phy.psm.state != CARL9170_PSM_WAKE);
 282 #endif /* CONFIG_CARL9170FW_DEBUG && CONFIG_CARL9170FW_RADIO_FUNCTIONS */
 283
 284         /* insert desc into the right queue */
 285         dma_put(&fw.wlan.tx_queue[super->s.queue], desc);
 286 }
 287
 288 static void wlan_assign_seq(struct ieee80211_hdr *hdr, unsigned int vif)
 289 {
 290         hdr->seq_ctrl &= cpu_to_le16(~IEEE80211_SCTL_SEQ);
 291         hdr->seq_ctrl |= cpu_to_le16(fw.wlan.sequence[vif]);
 292
 293         if (ieee80211_is_first_frag(hdr->seq_ctrl))
 294                 fw.wlan.sequence[vif] += 0x10;
 295 }
 296
 297 /* prepares frame for the first transmission */
 298 static void _wlan_tx(struct dma_desc *desc)
 299 {
 300         struct carl9170_tx_superframe *super = get_super(desc);
 301
 302         if (unlikely(super->s.assign_seq))
 303                 wlan_assign_seq(&super->f.data.i3e, super->s.vif_id);
 304
 305         if (unlikely(super->s.ampdu_commit_density)) {
 306                 set(AR9170_MAC_REG_AMPDU_DENSITY,
 307                     MOD_VAL(AR9170_MAC_AMPDU_DENSITY,
 308                             get(AR9170_MAC_REG_AMPDU_DENSITY),
 309                             super->s.ampdu_density));
 310         }
 311
 312         if (unlikely(super->s.ampdu_commit_factor)) {
 313                 set(AR9170_MAC_REG_AMPDU_FACTOR,
 314                     MOD_VAL(AR9170_MAC_AMPDU_FACTOR,
 315                             get(AR9170_MAC_REG_AMPDU_FACTOR),
 316                             8 << super->s.ampdu_factor));
 317         }
 318 }
 319
 320 /* propagate transmission status back to the driver */
 321 static bool wlan_tx_status(struct dma_queue *queue,
 322                            struct dma_desc *desc)
 323 {
 324         struct carl9170_tx_superframe *super = get_super(desc);
 325         unsigned int qidx = super->s.queue;
 326         bool txfail = false, success;
 327
 328         success = true;
 329
 330         /* update hangcheck */
 331         fw.wlan.last_super_num[qidx] = 0;
 332
 333         /*
 334          * Note:
 335          * There could be a corner case when the TXFAIL is set
 336          * even though the frame was properly ACKed by the peer:
 337          *   a BlockAckReq with the immediate policy will cause
 338          *   the receiving peer to produce a BlockACK unfortunately
 339          *   the MAC in this chip seems to be expecting a legacy
 340          *   ACK and marks the BAR as failed!
 341          */
 342
 343         if (!!(desc->ctrl & AR9170_CTRL_FAIL)) {
 344                 txfail = !!(desc->ctrl & AR9170_CTRL_TXFAIL);
 345
 346                 /* reset retry indicator flags */
 347                 desc->ctrl &= ~(AR9170_CTRL_TXFAIL | AR9170_CTRL_BAFAIL);
 348
 349                 /*
 350                  * Note: wlan_tx_consume_retry will override the old
 351                  * phy [CCK,OFDM, HT, BW20/40, MCS...] and mac vectors
 352                  * [AMPDU,RTS/CTS,...] therefore be careful when they
 353                  * are used.
 354                  */
 355                 if (wlan_tx_consume_retry(super)) {
 356                         /*
 357                          * retry for simple and aggregated 802.11 frames.
 358                          *
 359                          * Note: We must not mess up the original frame
 360                          * order.
 361                          */
 362
 363                         if (!super->f.hdr.mac.ampdu) {
 364                                 /*
 365                                  * 802.11 - 7.1.3.1.5.
 366                                  * set "Retry Field" for consecutive attempts
 367                                  *
 368                                  * Note: For AMPDU see:
 369                                  * 802.11n 9.9.1.6 "Retransmit Procedures"
 370                                  */
 371                                 super->f.data.i3e.frame_control |=
 372                                         cpu_to_le16(IEEE80211_FCTL_RETRY);
 373                         }
 374
 375                         if (txfail) {
 376                                 /* Normal TX Failure */
 377
 378                                 /* demise descriptor ownership back to the hardware */
 379                                 dma_rearm(desc);
 380
 381                                 /*
 382                                  * And this will get the queue going again.
 383                                  * To understand why: you have to get the HW
 384                                  * specs... But sadly I never saw them.
 385                                  */
 386                                 wlan_txunstuck(qidx);
 387
 388                                 /* abort cycle - this is necessary due to HW design */
 389                                 goto out;
 390                         } else {
 391                                 /* (HT-) BlockACK failure */
 392
 393                                 /*
 394                                  * Unlink the failed attempt and put it into
 395                                  * the retry queue. The caller routine must
 396                                  * be aware of this so the frames don't get lost.
 397                                  */
 398
 399 #ifndef CONFIG_CARL9170FW_DEBUG
 400                                 dma_unlink_head(queue);
 401 #else /* CONFIG_CARL9170FW_DEBUG */
 402                                 BUG_ON(dma_unlink_head(queue) != desc);
 403 #endif /* CONFIG_CARL9170FW_DEBUG */
 404                                 dma_put(&fw.wlan.tx_retry, desc);
 405                                 goto out;
 406                         }
 407                 } else {
 408                         /* out of frame attempts - discard frame */
 409                         success = false;
 410                 }
 411         }
 412
 413 #ifndef CONFIG_CARL9170FW_DEBUG
 414         dma_unlink_head(queue);
 415 #else /* CONFIG_CARL9170FW_DEBUG */
 416         BUG_ON(dma_unlink_head(queue) != desc);
 417 #endif /* CONFIG_CARL9170FW_DEBUG */
 418         if (txfail) {
 419                 /*
 420                  * Issue the queue bump,
 421                  * We need to do this in case this was the frame's last
 422                  * possible retry attempt and it unfortunately: it failed.
 423                  */
 424
 425                 wlan_txunstuck(qidx);
 426         }
 427
 428         unhide_super(desc);
 429
 430         if (unlikely(super == fw.wlan.fw_desc_data)) {
 431                 fw.wlan.fw_desc = desc;
 432                 fw.wlan.fw_desc_available = 1;
 433
 434                 if (fw.wlan.fw_desc_callback)
 435                         fw.wlan.fw_desc_callback(super, success);
 436
 437                 goto out;
 438         }
 439
 440         if (unlikely(super->s.cab))
 441                 fw.wlan.cab_queue_len[super->s.vif_id]--;
 442
 443         wlan_tx_complete(super, success);
 444
 445         if (ieee80211_is_back_req(super->f.data.i3e.frame_control)) {
 446                 fw.wlan.queued_bar--;
 447         }
 448
 449         /* recycle freed descriptors */
 450         dma_reclaim(&fw.pta.down_queue, desc);
 451         down_trigger();
 452 out:
 453         /*
 454          * if we encounter a frame which run out of (normal)
 455          * tx retries we have to stop too.
 456          */
 457         return !txfail;
 458 }
 459
 460 void handle_wlan_tx_completion(void)
 461 {
 462         struct dma_desc *desc;
 463         int i;
 464
 465         for (i = AR9170_TXQ_SPECIAL; i >= AR9170_TXQ0; i--) {
 466                 __while_desc_bits(desc, &fw.wlan.tx_queue[i], AR9170_OWN_BITS_SW) {
 467                         if (!wlan_tx_status(&fw.wlan.tx_queue[i], desc)) {
 468                                 /* termination requested. */
 469                                 break;
 470                         }
 471                 }
 472
 473                 wlan_tx_ampdu_reset(i);
 474
 475                 for_each_desc(desc, &fw.wlan.tx_retry)
 476                         __wlan_tx(desc);
 477
 478                 wlan_tx_ampdu_end(i);
 479                 if (!queue_empty(&fw.wlan.tx_queue[i]))
 480                         wlan_trigger(BIT(i));
 481         }
 482 }
 483
 484 void __hot wlan_tx(struct dma_desc *desc)
 485 {
 486         struct carl9170_tx_superframe *super = DESC_PAYLOAD(desc);
 487
 488         if (ieee80211_is_back_req(super->f.data.i3e.frame_control)) {
 489                 fw.wlan.queued_bar++;
 490         }
 491
 492         /* initialize rate control struct */
 493         super->s.rix = 0;
 494         super->s.cnt = 1;
 495         hide_super(desc);
 496
 497         if (unlikely(super->s.cab)) {
 498                 fw.wlan.cab_queue_len[super->s.vif_id]++;
 499                 dma_put(&fw.wlan.cab_queue[super->s.vif_id], desc);
 500                 return;
 501         }
 502
 503         _wlan_tx(desc);
 504         __wlan_tx(desc);
 505         wlan_trigger(BIT(super->s.queue));
 506 }
 507
 508 void wlan_tx_fw(struct carl9170_tx_superdesc *super, fw_desc_callback_t cb)
 509 {
 510         if (!fw.wlan.fw_desc_available)
 511                 return;
 512
 513         fw.wlan.fw_desc_available = 0;
 514
 515         /* Format BlockAck */
 516         fw.wlan.fw_desc->ctrl = AR9170_CTRL_FS_BIT | AR9170_CTRL_LS_BIT;
 517         fw.wlan.fw_desc->status = AR9170_OWN_BITS_SW;
 518
 519         fw.wlan.fw_desc->totalLen = fw.wlan.fw_desc->dataSize = super->len;
 520         fw.wlan.fw_desc_data = fw.wlan.fw_desc->dataAddr = super;
 521         fw.wlan.fw_desc->nextAddr = fw.wlan.fw_desc->lastAddr =
 522                 fw.wlan.fw_desc;
 523         fw.wlan.fw_desc_callback = cb;
 524         wlan_tx(fw.wlan.fw_desc);
 525 }
 526
 527 void wlan_send_buffered_ba(void)
 528 {
 529         struct carl9170_tx_ba_superframe *baf = &dma_mem.reserved.ba.ba;
 530         struct ieee80211_ba *ba = (struct ieee80211_ba *) &baf->f.ba;
 531         struct carl9170_bar_ctx *ctx;
 532
 533         if (likely(!fw.wlan.queued_ba))
 534                 return;
 535
 536         /* there's no point to continue when the ba_desc is not available. */
 537         if (!fw.wlan.fw_desc_available)
 538                 return;
 539
 540         ctx = &fw.wlan.ba_cache[fw.wlan.ba_head_idx];
 541         fw.wlan.ba_head_idx++;
 542         fw.wlan.ba_head_idx %= CONFIG_CARL9170FW_BACK_REQS_NUM;
 543         fw.wlan.queued_ba--;
 544
 545         baf->s.len = sizeof(struct carl9170_tx_superdesc) +
 546                      sizeof(struct ar9170_tx_hwdesc) +
 547                      sizeof(struct ieee80211_ba);
 548         baf->s.ri[0].tries = 1;
 549         baf->s.cookie = 0;
 550         baf->s.queue = AR9170_TXQ_VO;
 551         baf->f.hdr.length = sizeof(struct ieee80211_ba) + FCS_LEN;
 552
 553         baf->f.hdr.mac.no_ack = 1;
 554
 555         baf->f.hdr.phy.modulation = 1; /* OFDM */
 556         baf->f.hdr.phy.tx_power = 34; /* 17 dBm */
 557         baf->f.hdr.phy.chains = 1;
 558         baf->f.hdr.phy.mcs = AR9170_TXRX_PHY_RATE_OFDM_6M;
 559
 560         /* format outgoing BA */
 561         ba->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_BACK);
 562         ba->duration = cpu_to_le16(0);
 563
 564         /* the BAR contains all necessary MACs. All we need is to swap them */
 565         memcpy(ba->ra, ctx->ta, 6);
 566         memcpy(ba->ta, ctx->ra, 6);
 567
 568         /*
 569          * Unfortunately, we cannot look into the hardware's scoreboard.
 570          * Therefore we have to proceed as described in 802.11n 9.10.7.5
 571          * and send a null BlockAck.
 572          */
 573         memset(ba->bitmap, 0x0, sizeof(ba->bitmap));
 574
 575         /*
 576          * Both, the original firmare and ath9k set the NO ACK flag in
 577          * the BA Ack Policy subfield.
 578          */
 579         ba->control = ctx->control | cpu_to_le16(1);
 580         ba->start_seq_num = ctx->start_seq_num;
 581         wlan_tx_fw(&baf->s, NULL);
 582 }
 583
 584 void wlan_cab_flush_queue(const unsigned int vif)
 585 {
 586         struct dma_queue *cab_queue = &fw.wlan.cab_queue[vif];
 587         struct dma_desc *desc;
 588
 589         /* move queued frames into the main tx queues */
 590         for_each_desc(desc, cab_queue) {
 591                 struct carl9170_tx_superframe *super = get_super(desc);
 592                 if (!queue_empty(cab_queue)) {
 593                         /*
 594                          * Set MOREDATA flag for all,
 595                          * but the last queued frame.
 596                          * see: 802.11-2007 11.2.1.5 f)
 597                          *
 598                          * This is actually the reason to why
 599                          * we need to prevent the reentry.
 600                          */
 601
 602                         super->f.data.i3e.frame_control |=
 603                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
 604                 } else {
 605                         super->f.data.i3e.frame_control &=
 606                                 cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
 607                 }
 608
 609                 /* ready to roll! */
 610                 _wlan_tx(desc);
 611                 __wlan_tx(desc);
 612                 wlan_trigger(BIT(super->s.queue));
 613         }
 614 }
 615
 616 static uint8_t *beacon_find_ie(uint8_t ie, void *addr,
 617                                const unsigned int len)
 618 {
 619         struct ieee80211_mgmt *mgmt = addr;
 620         uint8_t *pos, *end;
 621
 622         pos = mgmt->u.beacon.variable;
 623         end = (uint8_t *) ((unsigned long)mgmt + (len - FCS_LEN));
 624         while (pos < end) {
 625                 if (pos + 2 + pos[1] > end)
 626                         return NULL;
 627
 628                 if (pos[0] == ie)
 629                         return pos;
 630
 631                 pos += pos[1] + 2;
 632         }
 633
 634         return NULL;
 635 }
 636
 637 void wlan_modify_beacon(const unsigned int vif,
 638         const unsigned int addr, const unsigned int len)
 639 {
 640         uint8_t *_ie;
 641         struct ieee80211_tim_ie *ie;
 642
 643         _ie = beacon_find_ie(WLAN_EID_TIM, (void *)addr, len);
 644         if (likely(_ie)) {
 645                 ie = (struct ieee80211_tim_ie *) &_ie[2];
 646
 647                 if (!queue_empty(&fw.wlan.cab_queue[vif]) && (ie->dtim_count == 0)) {
 648                         /* schedule DTIM transfer */
 649                         fw.wlan.cab_flush_trigger[vif] = CARL9170_CAB_TRIGGER_ARMED;
 650                 } else if ((fw.wlan.cab_queue_len[vif] == 0) && (fw.wlan.cab_flush_trigger[vif])) {
 651                         /* undo all chances to the beacon structure */
 652                         ie->bitmap_ctrl &= ~0x1;
 653                         fw.wlan.cab_flush_trigger[vif] = CARL9170_CAB_TRIGGER_EMPTY;
 654                 }
 655
 656                 /* Triggered by CARL9170_CAB_TRIGGER_ARMED || CARL9170_CAB_TRIGGER_DEFER */
 657                 if (fw.wlan.cab_flush_trigger[vif]) {
 658                         /* Set the almighty Multicast Traffic Indication Bit. */
 659                         ie->bitmap_ctrl |= 0x1;
 660                 }
 661         }
 662
 663         /*
 664          * Ideally, the sequence number should be assigned by the TX arbiter
 665          * hardware. But AFAIK that's not possible, so we have to go for the
 666          * next best thing and write it into the beacon fifo during the open
 667          * beacon update window.
 668          */
 669
 670         wlan_assign_seq((struct ieee80211_hdr *)addr, vif);
 671 }
 672
 673 void wlan_send_buffered_cab(void)
 674 {
 675         unsigned int i;
 676
 677         for (i = 0; i < CARL9170_INTF_NUM; i++) {
 678                 if (unlikely(fw.wlan.cab_flush_trigger[i] == CARL9170_CAB_TRIGGER_ARMED)) {
 679                         /*
 680                          * This is hardcoded into carl9170usb driver.
 681                          *
 682                          * The driver must set the PRETBTT event to beacon_interval -
 683                          * CARL9170_PRETBTT_KUS (usually 6) Kus.
 684                          *
 685                          * But still, we can only do so much about 802.11-2007 9.3.2.1 &
 686                          * 11.2.1.6. Let's hope the current solution is adequate enough.
 687                          */
 688
 689                         if (is_after_msecs(fw.wlan.cab_flush_time, (CARL9170_TBTT_DELTA))) {
 690                                 wlan_cab_flush_queue(i);
 691
 692                                 /*
 693                                  * This prevents the code from sending new BC/MC frames
 694                                  * which were queued after the previous buffered traffic
 695                                  * has been sent out... They will have to wait until the
 696                                  * next DTIM beacon comes along.
 697                                  */
 698                                 fw.wlan.cab_flush_trigger[i] = CARL9170_CAB_TRIGGER_DEFER;
 699                         }
 700                 }
 701
 702         }
 703 }