It is not safe to use the skb->cb area for both the rxd and
skb_frame_desc data at the same time, while they occupy an overlapping
piece of memory. This can lead to hard to trace crashes as pointers
within skb_frame_desc are pointing into nowhere, or the rxd data is
overwritten with non-sense.

Fix it by copying the rxd to a small buffer on the stack.
Signed-off-by: NGertjan van Wingerde <gwingerde@kpnplanet.nl>
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When rt2x00pci will be switched over to dynamically mapped skb's
instead of statically allocated DMA buffers, it no longer can handle
alignment of RX packets in a copy step, and needs to implement the
same scheme as rt2x00usb does.

In order to make the patch on dynamically mapped skb's smaller,
already centralize the alignment handling into rt2x00lib. This allows
us to move more code in rt2x00lib, and thus remove code duplication
between rt2x00usb and rt2x00pci.
Signed-off-by: NGertjan van Wingerde <gwingerde@kpnplanet.nl>
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The data and data_len fields aren't really necessary in struct
skb_frame_desc, as they can be deduced from the skb itself.
Signed-off-by: NGertjan van Wingerde <gwingerde@kpnplanet.nl>
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

TX queues shouldn't be kicked after each frame that is put into the
queue.  This could cause problems during RTS and CTS-to-self as well
as with fragmentation. In all those cases you want all frames to be
send out in a single burst. Off course we shouldn't let the queue fill
up entirely, thus we introduce a 10% threshold which, when reached,
will force the frames to be send out regardless of the frame.

In addition we should prevent queues to become full in such a way
that the tx() handler can fail. Instead of stopping the queue when
it is full, we should stop it when it is below the threshold.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The write_tx_data functions in rt2x00pci and rt2x00usb have
a lot in common. This moves that duplicate code into
rt2x00queue_write_tx_frame().
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

rt2x00usb_kick_tx_queue() will loop over all entries
within the INDEX_DONE->INDEX range and kick each entry
which is pending to be kicked. This makes the kick_tx_queue
approach work the same as with the PCI drivers which
will allow for more code generalisation into rt2x00lib.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

rt2x00usb doesn't need the TX descriptor in the TX done path.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch converts mac80211 and all drivers to have transmit
information and status in skb->cb rather than allocating extra
memory for it and copying all the data around. To make it fit,
a union is used where only data that is necessary for all steps
is kept outside of the union.

A number of fixes were done by Ivo, as well as the rt2x00 part
of this patch.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

With the pending removal of the tx_control structure
we can merge the RX and TX entry private data structure
in advance. This will temporarily increase the required
memory for the queue, but that overhead will only be limited.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Split rt2x00lib_write_tx_desc() up into a TX descriptor initializor
and TX descriptor writer.

This split is required to properly allow mac80211 to move its
tx_control structure into the skb->cb array.
The rt2x00queue_create_tx_descriptor() function will read all tx control
information and convert it into a rt2x00 TX descriptor information structure.
After that function is complete, we have all information we needed from the
tx control structure and are free to start writing into the skb->cb array
for our own purposes.
rt2x00queue_write_tx_descriptor() will be in charge of really sending
the TX descriptor to the hardware and kicking the TX queue.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Due to usage of memmove() in rt2x00usb the descriptor can become
corrupted because it is being overwritten by the data part.
Overall having the descriptor in front of the frame is a bad idea,
we can however use the skb->cb array for this task, since that
contains more then enough room to hold the entire descriptor and
preserve the information long enough.

After this we can also cleanup the alignment code a bit to make it
work a bit more flexible to allow for all kinds of odd header lengths.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The tx_status enumeration was broken since the introduction
of rt61pci. That driver uses different values to report the
status of the tx action.
This would lead to frames that were reported as success but
actually failed to be send out, or frames that were neither
successfull or failure which were reported as failure.

Fix this by change the TX status reporting and more explicitely
check for failure or success. Note that a third possibility is
added "unknown". Not all hardware (USB) can report the actual
TX status, for rt61pci some frames will receive this status
because the TXdone handler is never called for those frames.
This unknown will now be handled as neither success or failure,
so we no longer increment the failure counter while this conclusion
could not be determined from the real status of the frame.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add some helper macro's to help determining the
the timeout for USB register access.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Use the rt2x00 queue enumeration as much as possible,
removing the usage of the mac80211 queue numbering
wherever it is possible.

This makes it easier for mac80211 to change it queue
identification scheme without having to deal with
big changes in the rt2x00 code.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When fixing up the packet alignment, if we had to add 2 bytes to the front of
the skb we need to remember to take them off the end afterwards. This fixes
reception of encrypted packets which were otherwise failing with an invalid
ICV.
Signed-off-by: NAdam Baker <linux@baker-net.org.uk>
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

In the TX path, the driver didn't copy the TX control data structure. Thus, it
was invalid in the TX done handler, causing serious trouble and misbehaviour.
Signed-off-by: NMattias Nissler <mattias.nissler@gmx.de>
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Some architectures give problems when reading
RX frame descriptor words when the descriptor
is not aligned on a 4 byte boundrary.

Due to optimalizations for the ieee80211 payload
4 byte alignment, it is no longer guarenteed
that the descriptor is placed on the 4 byte
boundrary (In fact, for rt73usb it is absolutely
never aligned to 4 bytes, for rt2500usb it depends
on the length of the payload).

This will copy the descriptor to a 4 byte aligned
location before it is read for the first time.
This will also move the payload data alignment
in rt2x00usb (instead of inside the driver) where
it has always belonged.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The async vendor requests are a ugly hack which is not working correctly.
The proper fix for the scheduling while atomic issue is finding out why
we can't use led classes for USB drivers and fix that.

Just replace all async calls with the regular ones and print an
error for the disallowed LED configuration attempts. That will
help in determining which led class is causing the problem.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This adds a new flag for the skb_frame_desc structure which is used to tag
rts/cts frames that are generated by the driver. Through the tag we can
recognize frames we have generated ourselves, so we don't report their tx
status to mac80211.

This patch is based on the original patch by
Mattias Nissler <mattias.nissler@gmx.de>.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When the radio is being disabled we should also
kill the guardian urb which could still be pending
in the device.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

skbdesc->data_len was not initialized correctly
in rt2x00pci, rt2x00usb, rt2500usb and rt73usb.

The value was set to queue->data_size which
means that the incorrect frame size was pased
to the upper layers.

Correctly base the value on either the skb->len,
or the rx frame size passed to the driver by the
device.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The csr_cache and csr_addr pointers are both the same size
and they are never used both by the same driver. This makes
them a nice candidate for an union.
We could merge into 1 pointer, but that would either upset sparse,
or require a lot of __force casts.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add kerneldoc for vendor request functions in rt2x00usb.
Add asynchroneous vendor request function in rt2x00usb.

With the availability of the asynchroneuous vendor request
we can now enable LED class support for rt2500usb and rt73usb.
Since LED handling is not important, it doesn't really matter
if a register call fails (This solution is better then no
LED class support at all).
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This introduces a big queue handling overhaul, this also
renames "ring" to "queues".

Move queue handling into rt2x00queue.c and the matching header,
use Kerneldoc to improve rt2x00 library documentation.

Access to the queues is now protected under a spinlock, this
to prevent race conditions which could corrupt the indexing
system of the queue.

Each queue entry allocates x bytes for driver/device specific data,
this cleans up the queue structure significantly and improves
code readability.

rt2500usb no longer needs 2 entries in the beacon queue to correctly
send out the guardian byte. This is now handled in the entry specific
structure.

rt61 and rt73 now use the correct descriptor size for beacon frames,
since this data is written into the registers not the entire TXD
descriptor was used but instead of a subset of it named TXINFO.

Finally this also fixes numerous other bugs related to incorrect
beacon handling or beacon related code.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

rt2500usb and rt73usb data and desc pointer initialization
was incorrect because it was using uninitialized variables
to determine the length.

In addition rt2500usb used skb_pull and removed the ieee80211
from each received frame instead of using skb_trim to remove
the device descriptor from the frame.

Finally this also fixes the descriptor override when 4 byte
aligning occured. We still need a completely valid descriptor
when using the TX/RX dumping capabilities in debugfs.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

rt2500usb and rt73usb store the descriptor in different
places. This means we should move the initialization of
the 2 pointers to the driver callback function fill_rxdone().
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Prior to enabling the radio rt2x00lib should go through all
rings and for each entry should call the callback function
init_txentry() and init_rxentry().
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Apparently it was possible that ieee80211_stop_queue() was not full while
NETDEV_TX_BUSY was being reported back. I think that is what causing the WARN_ON().
This moves all calls to ieee80211_stop_queue() in rt2x00mac.c where it is easier
to determine if the queue should be halted.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This adds TX/RX frame dumping capabilities through debugfs.
The intention is that with this approach debugging of rt2x00 is
simplified since _all_ frames going in and out of the device
are send to debugfs as well along with additional information
like the hardware descriptor.

Based on the patch by Mattias Nissler.
Mattias also has some tools that will make the dumped frames
available to wireshark: http://www-user.rhrk.uni-kl.de/~nissler/rt2x00/Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Use the skb->cb field to add a frame description that can be used
to transfer information passed each rt2x00 layer. This reduces the
required arguments for rt2x00lib_write_tx_desc().
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

DRV_NAME was always set to the KBUILD_MODNAME value,
lets clean everything up by removing DRV_NAME and just
use KBUILD_MODNAME directly.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

There is a buffer, csr_cache which is used to hold copies of data being passed
to the USB stack which can get corrupted if multiple threads attempt to access
CSR registers simultaneously. There is also the possibility if multiple
threads try to access BBP or RF registers for the multiple USB operations
needed to get interleaved leading to incorrect results. This patch introduces
a mutex to prevent such simultaneous access. The interleaved access problem
may also affect the PCI devices but if so that will be handled in a follow-up
patch.
Signed-off-by: NAdam Baker <linux@baker-net.org.uk>
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Coverty indicated that data_desc with a single
element array is bad coding style. This removes
the structure and forces everybody to use __le32.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Some register accesses need rt2x00dev to be non-const
they all need modifying so the prototype is consistent.
Signed-off-by: NAdam Baker <linux@baker-net.org.uk>
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

As Johannes Berg indicated, the NET_IP_ALIGN doesn't
need to be used for ieee80211 frames. This means we
can simplify the alignment calculation to just
use the result of the header size modulus 4 as frame
alignment.

Furthermore we shouldn't use NET_IP_ALIGN in rt2x00usb
because it could be 0 on some architectures and we absolutely
need to have 2 bytes reserved for possible aligning.

Signed-off-by: Ivo van Doorn<IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Check the size of the ieee80211 header during rxdone
and make sure the data behind the ieee80211 header
is placed on a 4 byte boundary.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The usb max packet size won't change during the
device's presence. We should store it in a
variable inside rt2x00dev and use that.
This should also fix a division error when the
device is being hot-unplugged while a frame is
being send out.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The TX datalen must always be converted to a value rt73 and rt2500usb
understand. Both require to use a different size then skb->len.
First off this is required because the descriptor must be added,
but the second is because the value must be a multiple of either 2 or 4,
and it should not be a multiple of the USB packetmax
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>