drivers/net/wireless/brcm80211/brcmsmac/main.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  18
  19 #include <linux/pci_ids.h>
  20 #include <linux/if_ether.h>
  21 #include <net/cfg80211.h>
  22 #include <net/mac80211.h>
  23 #include <brcm_hw_ids.h>
  24 #include <aiutils.h>
  25 #include <chipcommon.h>
  26 #include "rate.h"
  27 #include "scb.h"
  28 #include "phy/phy_hal.h"
  29 #include "channel.h"
  30 #include "antsel.h"
  31 #include "stf.h"
  32 #include "ampdu.h"
  33 #include "mac80211_if.h"
  34 #include "ucode_loader.h"
  35 #include "main.h"
  36 #include "soc.h"
  37 #include "dma.h"
  38 #include "debug.h"
  39 #include "brcms_trace_events.h"
  40
  41 /* watchdog timer, in unit of ms */
  42 #define TIMER_INTERVAL_WATCHDOG         1000
  43 /* radio monitor timer, in unit of ms */
  44 #define TIMER_INTERVAL_RADIOCHK         800
  45
  46 /* beacon interval, in unit of 1024TU */
  47 #define BEACON_INTERVAL_DEFAULT         100
  48
  49 /* n-mode support capability */
  50 /* 2x2 includes both 1x1 & 2x2 devices
  51  * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
  52  * control it independently
  53  */
  54 #define WL_11N_2x2                      1
  55 #define WL_11N_3x3                      3
  56 #define WL_11N_4x4                      4
  57
  58 #define EDCF_ACI_MASK                   0x60
  59 #define EDCF_ACI_SHIFT                  5
  60 #define EDCF_ECWMIN_MASK                0x0f
  61 #define EDCF_ECWMAX_SHIFT               4
  62 #define EDCF_AIFSN_MASK                 0x0f
  63 #define EDCF_AIFSN_MAX                  15
  64 #define EDCF_ECWMAX_MASK                0xf0
  65
  66 #define EDCF_AC_BE_TXOP_STA             0x0000
  67 #define EDCF_AC_BK_TXOP_STA             0x0000
  68 #define EDCF_AC_VO_ACI_STA              0x62
  69 #define EDCF_AC_VO_ECW_STA              0x32
  70 #define EDCF_AC_VI_ACI_STA              0x42
  71 #define EDCF_AC_VI_ECW_STA              0x43
  72 #define EDCF_AC_BK_ECW_STA              0xA4
  73 #define EDCF_AC_VI_TXOP_STA             0x005e
  74 #define EDCF_AC_VO_TXOP_STA             0x002f
  75 #define EDCF_AC_BE_ACI_STA              0x03
  76 #define EDCF_AC_BE_ECW_STA              0xA4
  77 #define EDCF_AC_BK_ACI_STA              0x27
  78 #define EDCF_AC_VO_TXOP_AP              0x002f
  79
  80 #define EDCF_TXOP2USEC(txop)            ((txop) << 5)
  81 #define EDCF_ECW2CW(exp)                ((1 << (exp)) - 1)
  82
  83 #define APHY_SYMBOL_TIME                4
  84 #define APHY_PREAMBLE_TIME              16
  85 #define APHY_SIGNAL_TIME                4
  86 #define APHY_SIFS_TIME                  16
  87 #define APHY_SERVICE_NBITS              16
  88 #define APHY_TAIL_NBITS                 6
  89 #define BPHY_SIFS_TIME                  10
  90 #define BPHY_PLCP_SHORT_TIME            96
  91
  92 #define PREN_PREAMBLE                   24
  93 #define PREN_MM_EXT                     12
  94 #define PREN_PREAMBLE_EXT               4
  95
  96 #define DOT11_MAC_HDR_LEN               24
  97 #define DOT11_ACK_LEN                   10
  98 #define DOT11_BA_LEN                    4
  99 #define DOT11_OFDM_SIGNAL_EXTENSION     6
 100 #define DOT11_MIN_FRAG_LEN              256
 101 #define DOT11_RTS_LEN                   16
 102 #define DOT11_CTS_LEN                   10
 103 #define DOT11_BA_BITMAP_LEN             128
 104 #define DOT11_MIN_BEACON_PERIOD         1
 105 #define DOT11_MAX_BEACON_PERIOD         0xFFFF
 106 #define DOT11_MAXNUMFRAGS               16
 107 #define DOT11_MAX_FRAG_LEN              2346
 108
 109 #define BPHY_PLCP_TIME                  192
 110 #define RIFS_11N_TIME                   2
 111
 112 /* length of the BCN template area */
 113 #define BCN_TMPL_LEN                    512
 114
 115 /* brcms_bss_info flag bit values */
 116 #define BRCMS_BSS_HT                    0x0020  /* BSS is HT (MIMO) capable */
 117
 118 /* chip rx buffer offset */
 119 #define BRCMS_HWRXOFF                   38
 120
 121 /* rfdisable delay timer 500 ms, runs of ALP clock */
 122 #define RFDISABLE_DEFAULT               10000000
 123
 124 #define BRCMS_TEMPSENSE_PERIOD          10      /* 10 second timeout */
 125
 126 /* synthpu_dly times in us */
 127 #define SYNTHPU_DLY_APHY_US             3700
 128 #define SYNTHPU_DLY_BPHY_US             1050
 129 #define SYNTHPU_DLY_NPHY_US             2048
 130 #define SYNTHPU_DLY_LPPHY_US            300
 131
 132 #define ANTCNT                          10      /* vanilla M_MAX_ANTCNT val */
 133
 134 /* Per-AC retry limit register definitions; uses defs.h bitfield macros */
 135 #define EDCF_SHORT_S                    0
 136 #define EDCF_SFB_S                      4
 137 #define EDCF_LONG_S                     8
 138 #define EDCF_LFB_S                      12
 139 #define EDCF_SHORT_M                    BITFIELD_MASK(4)
 140 #define EDCF_SFB_M                      BITFIELD_MASK(4)
 141 #define EDCF_LONG_M                     BITFIELD_MASK(4)
 142 #define EDCF_LFB_M                      BITFIELD_MASK(4)
 143
 144 #define RETRY_SHORT_DEF                 7       /* Default Short retry Limit */
 145 #define RETRY_SHORT_MAX                 255     /* Maximum Short retry Limit */
 146 #define RETRY_LONG_DEF                  4       /* Default Long retry count */
 147 #define RETRY_SHORT_FB                  3       /* Short count for fb rate */
 148 #define RETRY_LONG_FB                   2       /* Long count for fb rate */
 149
 150 #define APHY_CWMIN                      15
 151 #define PHY_CWMAX                       1023
 152
 153 #define EDCF_AIFSN_MIN                  1
 154
 155 #define FRAGNUM_MASK                    0xF
 156
 157 #define APHY_SLOT_TIME                  9
 158 #define BPHY_SLOT_TIME                  20
 159
 160 #define WL_SPURAVOID_OFF                0
 161 #define WL_SPURAVOID_ON1                1
 162 #define WL_SPURAVOID_ON2                2
 163
 164 /* invalid core flags, use the saved coreflags */
 165 #define BRCMS_USE_COREFLAGS             0xffffffff
 166
 167 /* values for PLCPHdr_override */
 168 #define BRCMS_PLCP_AUTO                 -1
 169 #define BRCMS_PLCP_SHORT                0
 170 #define BRCMS_PLCP_LONG                 1
 171
 172 /* values for g_protection_override and n_protection_override */
 173 #define BRCMS_PROTECTION_AUTO           -1
 174 #define BRCMS_PROTECTION_OFF            0
 175 #define BRCMS_PROTECTION_ON             1
 176 #define BRCMS_PROTECTION_MMHDR_ONLY     2
 177 #define BRCMS_PROTECTION_CTS_ONLY       3
 178
 179 /* values for g_protection_control and n_protection_control */
 180 #define BRCMS_PROTECTION_CTL_OFF        0
 181 #define BRCMS_PROTECTION_CTL_LOCAL      1
 182 #define BRCMS_PROTECTION_CTL_OVERLAP    2
 183
 184 /* values for n_protection */
 185 #define BRCMS_N_PROTECTION_OFF          0
 186 #define BRCMS_N_PROTECTION_OPTIONAL     1
 187 #define BRCMS_N_PROTECTION_20IN40       2
 188 #define BRCMS_N_PROTECTION_MIXEDMODE    3
 189
 190 /* values for band specific 40MHz capabilities */
 191 #define BRCMS_N_BW_20ALL                0
 192 #define BRCMS_N_BW_40ALL                1
 193 #define BRCMS_N_BW_20IN2G_40IN5G        2
 194
 195 /* bitflags for SGI support (sgi_rx iovar) */
 196 #define BRCMS_N_SGI_20                  0x01
 197 #define BRCMS_N_SGI_40                  0x02
 198
 199 /* defines used by the nrate iovar */
 200 /* MSC in use,indicates b0-6 holds an mcs */
 201 #define NRATE_MCS_INUSE                 0x00000080
 202 /* rate/mcs value */
 203 #define NRATE_RATE_MASK                 0x0000007f
 204 /* stf mode mask: siso, cdd, stbc, sdm */
 205 #define NRATE_STF_MASK                  0x0000ff00
 206 /* stf mode shift */
 207 #define NRATE_STF_SHIFT                 8
 208 /* bit indicate to override mcs only */
 209 #define NRATE_OVERRIDE_MCS_ONLY         0x40000000
 210 #define NRATE_SGI_MASK                  0x00800000      /* sgi mode */
 211 #define NRATE_SGI_SHIFT                 23              /* sgi mode */
 212 #define NRATE_LDPC_CODING               0x00400000      /* adv coding in use */
 213 #define NRATE_LDPC_SHIFT                22              /* ldpc shift */
 214
 215 #define NRATE_STF_SISO                  0               /* stf mode SISO */
 216 #define NRATE_STF_CDD                   1               /* stf mode CDD */
 217 #define NRATE_STF_STBC                  2               /* stf mode STBC */
 218 #define NRATE_STF_SDM                   3               /* stf mode SDM */
 219
 220 #define MAX_DMA_SEGS                    4
 221
 222 /* # of entries in Tx FIFO */
 223 #define NTXD                            64
 224 /* Max # of entries in Rx FIFO based on 4kb page size */
 225 #define NRXD                            256
 226
 227 /* Amount of headroom to leave in Tx FIFO */
 228 #define TX_HEADROOM                     4
 229
 230 /* try to keep this # rbufs posted to the chip */
 231 #define NRXBUFPOST                      32
 232
 233 /* max # frames to process in brcms_c_recv() */
 234 #define RXBND                           8
 235 /* max # tx status to process in wlc_txstatus() */
 236 #define TXSBND                          8
 237
 238 /* brcmu_format_flags() bit description structure */
 239 struct brcms_c_bit_desc {
 240         u32 bit;
 241         const char *name;
 242 };
 243
 244 /*
 245  * The following table lists the buffer memory allocated to xmt fifos in HW.
 246  * the size is in units of 256bytes(one block), total size is HW dependent
 247  * ucode has default fifo partition, sw can overwrite if necessary
 248  *
 249  * This is documented in twiki under the topic UcodeTxFifo. Please ensure
 250  * the twiki is updated before making changes.
 251  */
 252
 253 /* Starting corerev for the fifo size table */
 254 #define XMTFIFOTBL_STARTREV     17
 255
 256 struct d11init {
 257         __le16 addr;
 258         __le16 size;
 259         __le32 value;
 260 };
 261
 262 struct edcf_acparam {
 263         u8 ACI;
 264         u8 ECW;
 265         u16 TXOP;
 266 } __packed;
 267
 268 /* debug/trace */
 269 uint brcm_msg_level;
 270
 271 /* TX FIFO number to WME/802.1E Access Category */
 272 static const u8 wme_fifo2ac[] = {
 273         IEEE80211_AC_BK,
 274         IEEE80211_AC_BE,
 275         IEEE80211_AC_VI,
 276         IEEE80211_AC_VO,
 277         IEEE80211_AC_BE,
 278         IEEE80211_AC_BE
 279 };
 280
 281 /* ieee80211 Access Category to TX FIFO number */
 282 static const u8 wme_ac2fifo[] = {
 283         TX_AC_VO_FIFO,
 284         TX_AC_VI_FIFO,
 285         TX_AC_BE_FIFO,
 286         TX_AC_BK_FIFO
 287 };
 288
 289 static const u16 xmtfifo_sz[][NFIFO] = {
 290         /* corerev 17: 5120, 49152, 49152, 5376, 4352, 1280 */
 291         {20, 192, 192, 21, 17, 5},
 292         /* corerev 18: */
 293         {0, 0, 0, 0, 0, 0},
 294         /* corerev 19: */
 295         {0, 0, 0, 0, 0, 0},
 296         /* corerev 20: 5120, 49152, 49152, 5376, 4352, 1280 */
 297         {20, 192, 192, 21, 17, 5},
 298         /* corerev 21: 2304, 14848, 5632, 3584, 3584, 1280 */
 299         {9, 58, 22, 14, 14, 5},
 300         /* corerev 22: 5120, 49152, 49152, 5376, 4352, 1280 */
 301         {20, 192, 192, 21, 17, 5},
 302         /* corerev 23: 5120, 49152, 49152, 5376, 4352, 1280 */
 303         {20, 192, 192, 21, 17, 5},
 304         /* corerev 24: 2304, 14848, 5632, 3584, 3584, 1280 */
 305         {9, 58, 22, 14, 14, 5},
 306         /* corerev 25: */
 307         {0, 0, 0, 0, 0, 0},
 308         /* corerev 26: */
 309         {0, 0, 0, 0, 0, 0},
 310         /* corerev 27: */
 311         {0, 0, 0, 0, 0, 0},
 312         /* corerev 28: 2304, 14848, 5632, 3584, 3584, 1280 */
 313         {9, 58, 22, 14, 14, 5},
 314 };
 315
 316 #ifdef DEBUG
 317 static const char * const fifo_names[] = {
 318         "AC_BK", "AC_BE", "AC_VI", "AC_VO", "BCMC", "ATIM" };
 319 #else
 320 static const char fifo_names[6][0];
 321 #endif
 322
 323 #ifdef DEBUG
 324 /* pointer to most recently allocated wl/wlc */
 325 static struct brcms_c_info *wlc_info_dbg = (struct brcms_c_info *) (NULL);
 326 #endif
 327
 328 /* Mapping of ieee80211 AC numbers to tx fifos */
 329 static const u8 ac_to_fifo_mapping[IEEE80211_NUM_ACS] = {
 330         [IEEE80211_AC_VO]       = TX_AC_VO_FIFO,
 331         [IEEE80211_AC_VI]       = TX_AC_VI_FIFO,
 332         [IEEE80211_AC_BE]       = TX_AC_BE_FIFO,
 333         [IEEE80211_AC_BK]       = TX_AC_BK_FIFO,
 334 };
 335
 336 /* Mapping of tx fifos to ieee80211 AC numbers */
 337 static const u8 fifo_to_ac_mapping[IEEE80211_NUM_ACS] = {
 338         [TX_AC_BK_FIFO] = IEEE80211_AC_BK,
 339         [TX_AC_BE_FIFO] = IEEE80211_AC_BE,
 340         [TX_AC_VI_FIFO] = IEEE80211_AC_VI,
 341         [TX_AC_VO_FIFO] = IEEE80211_AC_VO,
 342 };
 343
 344 static u8 brcms_ac_to_fifo(u8 ac)
 345 {
 346         if (ac >= ARRAY_SIZE(ac_to_fifo_mapping))
 347                 return TX_AC_BE_FIFO;
 348         return ac_to_fifo_mapping[ac];
 349 }
 350
 351 static u8 brcms_fifo_to_ac(u8 fifo)
 352 {
 353         if (fifo >= ARRAY_SIZE(fifo_to_ac_mapping))
 354                 return IEEE80211_AC_BE;
 355         return fifo_to_ac_mapping[fifo];
 356 }
 357
 358 /* Find basic rate for a given rate */
 359 static u8 brcms_basic_rate(struct brcms_c_info *wlc, u32 rspec)
 360 {
 361         if (is_mcs_rate(rspec))
 362                 return wlc->band->basic_rate[mcs_table[rspec & RSPEC_RATE_MASK]
 363                        .leg_ofdm];
 364         return wlc->band->basic_rate[rspec & RSPEC_RATE_MASK];
 365 }
 366
 367 static u16 frametype(u32 rspec, u8 mimoframe)
 368 {
 369         if (is_mcs_rate(rspec))
 370                 return mimoframe;
 371         return is_cck_rate(rspec) ? FT_CCK : FT_OFDM;
 372 }
 373
 374 /* currently the best mechanism for determining SIFS is the band in use */
 375 static u16 get_sifs(struct brcms_band *band)
 376 {
 377         return band->bandtype == BRCM_BAND_5G ? APHY_SIFS_TIME :
 378                                  BPHY_SIFS_TIME;
 379 }
 380
 381 /*
 382  * Detect Card removed.
 383  * Even checking an sbconfig register read will not false trigger when the core
 384  * is in reset it breaks CF address mechanism. Accessing gphy phyversion will
 385  * cause SB error if aphy is in reset on 4306B0-DB. Need a simple accessible
 386  * reg with fixed 0/1 pattern (some platforms return all 0).
 387  * If clocks are present, call the sb routine which will figure out if the
 388  * device is removed.
 389  */
 390 static bool brcms_deviceremoved(struct brcms_c_info *wlc)
 391 {
 392         u32 macctrl;
 393
 394         if (!wlc->hw->clk)
 395                 return ai_deviceremoved(wlc->hw->sih);
 396         macctrl = bcma_read32(wlc->hw->d11core,
 397                               D11REGOFFS(maccontrol));
 398         return (macctrl & (MCTL_PSM_JMP_0 | MCTL_IHR_EN)) != MCTL_IHR_EN;
 399 }
 400
 401 /* sum the individual fifo tx pending packet counts */
 402 static int brcms_txpktpendtot(struct brcms_c_info *wlc)
 403 {
 404         int i;
 405         int pending = 0;
 406
 407         for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
 408                 if (wlc->hw->di[i])
 409                         pending += dma_txpending(wlc->hw->di[i]);
 410         return pending;
 411 }
 412
 413 static bool brcms_is_mband_unlocked(struct brcms_c_info *wlc)
 414 {
 415         return wlc->pub->_nbands > 1 && !wlc->bandlocked;
 416 }
 417
 418 static int brcms_chspec_bw(u16 chanspec)
 419 {
 420         if (CHSPEC_IS40(chanspec))
 421                 return BRCMS_40_MHZ;
 422         if (CHSPEC_IS20(chanspec))
 423                 return BRCMS_20_MHZ;
 424
 425         return BRCMS_10_MHZ;
 426 }
 427
 428 static void brcms_c_bsscfg_mfree(struct brcms_bss_cfg *cfg)
 429 {
 430         if (cfg == NULL)
 431                 return;
 432
 433         kfree(cfg->current_bss);
 434         kfree(cfg);
 435 }
 436
 437 static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
 438 {
 439         if (wlc == NULL)
 440                 return;
 441
 442         brcms_c_bsscfg_mfree(wlc->bsscfg);
 443         kfree(wlc->pub);
 444         kfree(wlc->modulecb);
 445         kfree(wlc->default_bss);
 446         kfree(wlc->protection);
 447         kfree(wlc->stf);
 448         kfree(wlc->bandstate[0]);
 449         kfree(wlc->corestate->macstat_snapshot);
 450         kfree(wlc->corestate);
 451         kfree(wlc->hw->bandstate[0]);
 452         kfree(wlc->hw);
 453
 454         /* free the wlc */
 455         kfree(wlc);
 456         wlc = NULL;
 457 }
 458
 459 static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
 460 {
 461         struct brcms_bss_cfg *cfg;
 462
 463         cfg = kzalloc(sizeof(struct brcms_bss_cfg), GFP_ATOMIC);
 464         if (cfg == NULL)
 465                 goto fail;
 466
 467         cfg->current_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
 468         if (cfg->current_bss == NULL)
 469                 goto fail;
 470
 471         return cfg;
 472
 473  fail:
 474         brcms_c_bsscfg_mfree(cfg);
 475         return NULL;
 476 }
 477
 478 static struct brcms_c_info *
 479 brcms_c_attach_malloc(uint unit, uint *err, uint devid)
 480 {
 481         struct brcms_c_info *wlc;
 482
 483         wlc = kzalloc(sizeof(struct brcms_c_info), GFP_ATOMIC);
 484         if (wlc == NULL) {
 485                 *err = 1002;
 486                 goto fail;
 487         }
 488
 489         /* allocate struct brcms_c_pub state structure */
 490         wlc->pub = kzalloc(sizeof(struct brcms_pub), GFP_ATOMIC);
 491         if (wlc->pub == NULL) {
 492                 *err = 1003;
 493                 goto fail;
 494         }
 495         wlc->pub->wlc = wlc;
 496
 497         /* allocate struct brcms_hardware state structure */
 498
 499         wlc->hw = kzalloc(sizeof(struct brcms_hardware), GFP_ATOMIC);
 500         if (wlc->hw == NULL) {
 501                 *err = 1005;
 502                 goto fail;
 503         }
 504         wlc->hw->wlc = wlc;
 505
 506         wlc->hw->bandstate[0] =
 507                 kzalloc(sizeof(struct brcms_hw_band) * MAXBANDS, GFP_ATOMIC);
 508         if (wlc->hw->bandstate[0] == NULL) {
 509                 *err = 1006;
 510                 goto fail;
 511         } else {
 512                 int i;
 513
 514                 for (i = 1; i < MAXBANDS; i++)
 515                         wlc->hw->bandstate[i] = (struct brcms_hw_band *)
 516                             ((unsigned long)wlc->hw->bandstate[0] +
 517                              (sizeof(struct brcms_hw_band) * i));
 518         }
 519
 520         wlc->modulecb =
 521                 kzalloc(sizeof(struct modulecb) * BRCMS_MAXMODULES, GFP_ATOMIC);
 522         if (wlc->modulecb == NULL) {
 523                 *err = 1009;
 524                 goto fail;
 525         }
 526
 527         wlc->default_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
 528         if (wlc->default_bss == NULL) {
 529                 *err = 1010;
 530                 goto fail;
 531         }
 532
 533         wlc->bsscfg = brcms_c_bsscfg_malloc(unit);
 534         if (wlc->bsscfg == NULL) {
 535                 *err = 1011;
 536                 goto fail;
 537         }
 538
 539         wlc->protection = kzalloc(sizeof(struct brcms_protection),
 540                                   GFP_ATOMIC);
 541         if (wlc->protection == NULL) {
 542                 *err = 1016;
 543                 goto fail;
 544         }
 545
 546         wlc->stf = kzalloc(sizeof(struct brcms_stf), GFP_ATOMIC);
 547         if (wlc->stf == NULL) {
 548                 *err = 1017;
 549                 goto fail;
 550         }
 551
 552         wlc->bandstate[0] =
 553                 kzalloc(sizeof(struct brcms_band)*MAXBANDS, GFP_ATOMIC);
 554         if (wlc->bandstate[0] == NULL) {
 555                 *err = 1025;
 556                 goto fail;
 557         } else {
 558                 int i;
 559
 560                 for (i = 1; i < MAXBANDS; i++)
 561                         wlc->bandstate[i] = (struct brcms_band *)
 562                                 ((unsigned long)wlc->bandstate[0]
 563                                 + (sizeof(struct brcms_band)*i));
 564         }
 565
 566         wlc->corestate = kzalloc(sizeof(struct brcms_core), GFP_ATOMIC);
 567         if (wlc->corestate == NULL) {
 568                 *err = 1026;
 569                 goto fail;
 570         }
 571
 572         wlc->corestate->macstat_snapshot =
 573                 kzalloc(sizeof(struct macstat), GFP_ATOMIC);
 574         if (wlc->corestate->macstat_snapshot == NULL) {
 575                 *err = 1027;
 576                 goto fail;
 577         }
 578
 579         return wlc;
 580
 581  fail:
 582         brcms_c_detach_mfree(wlc);
 583         return NULL;
 584 }
 585
 586 /*
 587  * Update the slot timing for standard 11b/g (20us slots)
 588  * or shortslot 11g (9us slots)
 589  * The PSM needs to be suspended for this call.
 590  */
 591 static void brcms_b_update_slot_timing(struct brcms_hardware *wlc_hw,
 592                                         bool shortslot)
 593 {
 594         struct bcma_device *core = wlc_hw->d11core;
 595
 596         if (shortslot) {
 597                 /* 11g short slot: 11a timing */
 598                 bcma_write16(core, D11REGOFFS(ifs_slot), 0x0207);
 599                 brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, APHY_SLOT_TIME);
 600         } else {
 601                 /* 11g long slot: 11b timing */
 602                 bcma_write16(core, D11REGOFFS(ifs_slot), 0x0212);
 603                 brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, BPHY_SLOT_TIME);
 604         }
 605 }
 606
 607 /*
 608  * calculate frame duration of a given rate and length, return
 609  * time in usec unit
 610  */
 611 static uint brcms_c_calc_frame_time(struct brcms_c_info *wlc, u32 ratespec,
 612                                     u8 preamble_type, uint mac_len)
 613 {
 614         uint nsyms, dur = 0, Ndps, kNdps;
 615         uint rate = rspec2rate(ratespec);
 616
 617         if (rate == 0) {
 618                 brcms_err(wlc->hw->d11core, "wl%d: WAR: using rate of 1 mbps\n",
 619                           wlc->pub->unit);
 620                 rate = BRCM_RATE_1M;
 621         }
 622
 623         if (is_mcs_rate(ratespec)) {
 624                 uint mcs = ratespec & RSPEC_RATE_MASK;
 625                 int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
 626
 627                 dur = PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
 628                 if (preamble_type == BRCMS_MM_PREAMBLE)
 629                         dur += PREN_MM_EXT;
 630                 /* 1000Ndbps = kbps * 4 */
 631                 kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
 632                                    rspec_issgi(ratespec)) * 4;
 633
 634                 if (rspec_stc(ratespec) == 0)
 635                         nsyms =
 636                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
 637                                   APHY_TAIL_NBITS) * 1000, kNdps);
 638                 else
 639                         /* STBC needs to have even number of symbols */
 640                         nsyms =
 641                             2 *
 642                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
 643                                   APHY_TAIL_NBITS) * 1000, 2 * kNdps);
 644
 645                 dur += APHY_SYMBOL_TIME * nsyms;
 646                 if (wlc->band->bandtype == BRCM_BAND_2G)
 647                         dur += DOT11_OFDM_SIGNAL_EXTENSION;
 648         } else if (is_ofdm_rate(rate)) {
 649                 dur = APHY_PREAMBLE_TIME;
 650                 dur += APHY_SIGNAL_TIME;
 651                 /* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
 652                 Ndps = rate * 2;
 653                 /* NSyms = CEILING((SERVICE + 8*NBytes + TAIL) / Ndbps) */
 654                 nsyms =
 655                     CEIL((APHY_SERVICE_NBITS + 8 * mac_len + APHY_TAIL_NBITS),
 656                          Ndps);
 657                 dur += APHY_SYMBOL_TIME * nsyms;
 658                 if (wlc->band->bandtype == BRCM_BAND_2G)
 659                         dur += DOT11_OFDM_SIGNAL_EXTENSION;
 660         } else {
 661                 /*
 662                  * calc # bits * 2 so factor of 2 in rate (1/2 mbps)
 663                  * will divide out
 664                  */
 665                 mac_len = mac_len * 8 * 2;
 666                 /* calc ceiling of bits/rate = microseconds of air time */
 667                 dur = (mac_len + rate - 1) / rate;
 668                 if (preamble_type & BRCMS_SHORT_PREAMBLE)
 669                         dur += BPHY_PLCP_SHORT_TIME;
 670                 else
 671                         dur += BPHY_PLCP_TIME;
 672         }
 673         return dur;
 674 }
 675
 676 static void brcms_c_write_inits(struct brcms_hardware *wlc_hw,
 677                                 const struct d11init *inits)
 678 {
 679         struct bcma_device *core = wlc_hw->d11core;
 680         int i;
 681         uint offset;
 682         u16 size;
 683         u32 value;
 684
 685         brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
 686
 687         for (i = 0; inits[i].addr != cpu_to_le16(0xffff); i++) {
 688                 size = le16_to_cpu(inits[i].size);
 689                 offset = le16_to_cpu(inits[i].addr);
 690                 value = le32_to_cpu(inits[i].value);
 691                 if (size == 2)
 692                         bcma_write16(core, offset, value);
 693                 else if (size == 4)
 694                         bcma_write32(core, offset, value);
 695                 else
 696                         break;
 697         }
 698 }
 699
 700 static void brcms_c_write_mhf(struct brcms_hardware *wlc_hw, u16 *mhfs)
 701 {
 702         u8 idx;
 703         u16 addr[] = {
 704                 M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
 705                 M_HOST_FLAGS5
 706         };
 707
 708         for (idx = 0; idx < MHFMAX; idx++)
 709                 brcms_b_write_shm(wlc_hw, addr[idx], mhfs[idx]);
 710 }
 711
 712 static void brcms_c_ucode_bsinit(struct brcms_hardware *wlc_hw)
 713 {
 714         struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
 715
 716         /* init microcode host flags */
 717         brcms_c_write_mhf(wlc_hw, wlc_hw->band->mhfs);
 718
 719         /* do band-specific ucode IHR, SHM, and SCR inits */
 720         if (D11REV_IS(wlc_hw->corerev, 23)) {
 721                 if (BRCMS_ISNPHY(wlc_hw->band))
 722                         brcms_c_write_inits(wlc_hw, ucode->d11n0bsinitvals16);
 723                 else
 724                         brcms_err(wlc_hw->d11core,
 725                                   "%s: wl%d: unsupported phy in corerev %d\n",
 726                                   __func__, wlc_hw->unit,
 727                                   wlc_hw->corerev);
 728         } else {
 729                 if (D11REV_IS(wlc_hw->corerev, 24)) {
 730                         if (BRCMS_ISLCNPHY(wlc_hw->band))
 731                                 brcms_c_write_inits(wlc_hw,
 732                                                     ucode->d11lcn0bsinitvals24);
 733                         else
 734                                 brcms_err(wlc_hw->d11core,
 735                                           "%s: wl%d: unsupported phy in core rev %d\n",
 736                                           __func__, wlc_hw->unit,
 737                                           wlc_hw->corerev);
 738                 } else {
 739                         brcms_err(wlc_hw->d11core,
 740                                   "%s: wl%d: unsupported corerev %d\n",
 741                                   __func__, wlc_hw->unit, wlc_hw->corerev);
 742                 }
 743         }
 744 }
 745
 746 static void brcms_b_core_ioctl(struct brcms_hardware *wlc_hw, u32 m, u32 v)
 747 {
 748         struct bcma_device *core = wlc_hw->d11core;
 749         u32 ioctl = bcma_aread32(core, BCMA_IOCTL) & ~m;
 750
 751         bcma_awrite32(core, BCMA_IOCTL, ioctl | v);
 752 }
 753
 754 static void brcms_b_core_phy_clk(struct brcms_hardware *wlc_hw, bool clk)
 755 {
 756         brcms_dbg_info(wlc_hw->d11core, "wl%d: clk %d\n", wlc_hw->unit, clk);
 757
 758         wlc_hw->phyclk = clk;
 759
 760         if (OFF == clk) {       /* clear gmode bit, put phy into reset */
 761
 762                 brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC | SICF_GMODE),
 763                                    (SICF_PRST | SICF_FGC));
 764                 udelay(1);
 765                 brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_PRST);
 766                 udelay(1);
 767
 768         } else {                /* take phy out of reset */
 769
 770                 brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_FGC);
 771                 udelay(1);
 772                 brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
 773                 udelay(1);
 774
 775         }
 776 }
 777
 778 /* low-level band switch utility routine */
 779 static void brcms_c_setxband(struct brcms_hardware *wlc_hw, uint bandunit)
 780 {
 781         brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
 782                            bandunit);
 783
 784         wlc_hw->band = wlc_hw->bandstate[bandunit];
 785
 786         /*
 787          * BMAC_NOTE:
 788          *   until we eliminate need for wlc->band refs in low level code
 789          */
 790         wlc_hw->wlc->band = wlc_hw->wlc->bandstate[bandunit];
 791
 792         /* set gmode core flag */
 793         if (wlc_hw->sbclk && !wlc_hw->noreset) {
 794                 u32 gmode = 0;
 795
 796                 if (bandunit == 0)
 797                         gmode = SICF_GMODE;
 798
 799                 brcms_b_core_ioctl(wlc_hw, SICF_GMODE, gmode);
 800         }
 801 }
 802
 803 /* switch to new band but leave it inactive */
 804 static u32 brcms_c_setband_inact(struct brcms_c_info *wlc, uint bandunit)
 805 {
 806         struct brcms_hardware *wlc_hw = wlc->hw;
 807         u32 macintmask;
 808         u32 macctrl;
 809
 810         brcms_dbg_mac80211(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
 811         macctrl = bcma_read32(wlc_hw->d11core,
 812                               D11REGOFFS(maccontrol));
 813         WARN_ON((macctrl & MCTL_EN_MAC) != 0);
 814
 815         /* disable interrupts */
 816         macintmask = brcms_intrsoff(wlc->wl);
 817
 818         /* radio off */
 819         wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
 820
 821         brcms_b_core_phy_clk(wlc_hw, OFF);
 822
 823         brcms_c_setxband(wlc_hw, bandunit);
 824
 825         return macintmask;
 826 }
 827
 828 /* process an individual struct tx_status */
 829 static bool
 830 brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
 831 {
 832         struct sk_buff *p = NULL;
 833         uint queue = NFIFO;
 834         struct dma_pub *dma = NULL;
 835         struct d11txh *txh = NULL;
 836         struct scb *scb = NULL;
 837         bool free_pdu;
 838         int tx_rts, tx_frame_count, tx_rts_count;
 839         uint totlen, supr_status;
 840         bool lastframe;
 841         struct ieee80211_hdr *h;
 842         u16 mcl;
 843         struct ieee80211_tx_info *tx_info;
 844         struct ieee80211_tx_rate *txrate;
 845         int i;
 846         bool fatal = true;
 847
 848         trace_brcms_txstatus(&wlc->hw->d11core->dev, txs->framelen,
 849                              txs->frameid, txs->status, txs->lasttxtime,
 850                              txs->sequence, txs->phyerr, txs->ackphyrxsh);
 851
 852         /* discard intermediate indications for ucode with one legitimate case:
 853          *   e.g. if "useRTS" is set. ucode did a successful rts/cts exchange,
 854          *   but the subsequent tx of DATA failed. so it will start rts/cts
 855          *   from the beginning (resetting the rts transmission count)
 856          */
 857         if (!(txs->status & TX_STATUS_AMPDU)
 858             && (txs->status & TX_STATUS_INTERMEDIATE)) {
 859                 brcms_dbg_tx(wlc->hw->d11core, "INTERMEDIATE but not AMPDU\n");
 860                 fatal = false;
 861                 goto out;
 862         }
 863
 864         queue = txs->frameid & TXFID_QUEUE_MASK;
 865         if (queue >= NFIFO) {
 866                 brcms_err(wlc->hw->d11core, "queue %u >= NFIFO\n", queue);
 867                 goto out;
 868         }
 869
 870         dma = wlc->hw->di[queue];
 871
 872         p = dma_getnexttxp(wlc->hw->di[queue], DMA_RANGE_TRANSMITTED);
 873         if (p == NULL) {
 874                 brcms_err(wlc->hw->d11core, "dma_getnexttxp returned null!\n");
 875                 goto out;
 876         }
 877
 878         txh = (struct d11txh *) (p->data);
 879         mcl = le16_to_cpu(txh->MacTxControlLow);
 880
 881         if (txs->phyerr)
 882                 brcms_err(wlc->hw->d11core, "phyerr 0x%x, rate 0x%x\n",
 883                           txs->phyerr, txh->MainRates);
 884
 885         if (txs->frameid != le16_to_cpu(txh->TxFrameID)) {
 886                 brcms_err(wlc->hw->d11core, "frameid != txh->TxFrameID\n");
 887                 goto out;
 888         }
 889         tx_info = IEEE80211_SKB_CB(p);
 890         h = (struct ieee80211_hdr *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN);
 891
 892         if (tx_info->rate_driver_data[0])
 893                 scb = &wlc->pri_scb;
 894
 895         if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
 896                 brcms_c_ampdu_dotxstatus(wlc->ampdu, scb, p, txs);
 897                 fatal = false;
 898                 goto out;
 899         }
 900
 901         /*
 902          * brcms_c_ampdu_dotxstatus() will trace tx descriptors for AMPDU
 903          * frames; this traces them for the rest.
 904          */
 905         trace_brcms_txdesc(&wlc->hw->d11core->dev, txh, sizeof(*txh));
 906
 907         supr_status = txs->status & TX_STATUS_SUPR_MASK;
 908         if (supr_status == TX_STATUS_SUPR_BADCH) {
 909                 unsigned xfts = le16_to_cpu(txh->XtraFrameTypes);
 910                 brcms_dbg_tx(wlc->hw->d11core,
 911                              "Pkt tx suppressed, dest chan %u, current %d\n",
 912                              (xfts >> XFTS_CHANNEL_SHIFT) & 0xff,
 913                              CHSPEC_CHANNEL(wlc->default_bss->chanspec));
 914         }
 915
 916         tx_rts = le16_to_cpu(txh->MacTxControlLow) & TXC_SENDRTS;
 917         tx_frame_count =
 918             (txs->status & TX_STATUS_FRM_RTX_MASK) >> TX_STATUS_FRM_RTX_SHIFT;
 919         tx_rts_count =
 920             (txs->status & TX_STATUS_RTS_RTX_MASK) >> TX_STATUS_RTS_RTX_SHIFT;
 921
 922         lastframe = !ieee80211_has_morefrags(h->frame_control);
 923
 924         if (!lastframe) {
 925                 brcms_err(wlc->hw->d11core, "Not last frame!\n");
 926         } else {
 927                 /*
 928                  * Set information to be consumed by Minstrel ht.
 929                  *
 930                  * The "fallback limit" is the number of tx attempts a given
 931                  * MPDU is sent at the "primary" rate. Tx attempts beyond that
 932                  * limit are sent at the "secondary" rate.
 933                  * A 'short frame' does not exceed RTS treshold.
 934                  */
 935                 u16 sfbl,       /* Short Frame Rate Fallback Limit */
 936                     lfbl,       /* Long Frame Rate Fallback Limit */
 937                     fbl;
 938
 939                 if (queue < IEEE80211_NUM_ACS) {
 940                         sfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
 941                                       EDCF_SFB);
 942                         lfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
 943                                       EDCF_LFB);
 944                 } else {
 945                         sfbl = wlc->SFBL;
 946                         lfbl = wlc->LFBL;
 947                 }
 948
 949                 txrate = tx_info->status.rates;
 950                 if (txrate[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
 951                         fbl = lfbl;
 952                 else
 953                         fbl = sfbl;
 954
 955                 ieee80211_tx_info_clear_status(tx_info);
 956
 957                 if ((tx_frame_count > fbl) && (txrate[1].idx >= 0)) {
 958                         /*
 959                          * rate selection requested a fallback rate
 960                          * and we used it
 961                          */
 962                         txrate[0].count = fbl;
 963                         txrate[1].count = tx_frame_count - fbl;
 964                 } else {
 965                         /*
 966                          * rate selection did not request fallback rate, or
 967                          * we didn't need it
 968                          */
 969                         txrate[0].count = tx_frame_count;
 970                         /*
 971                          * rc80211_minstrel.c:minstrel_tx_status() expects
 972                          * unused rates to be marked with idx = -1
 973                          */
 974                         txrate[1].idx = -1;
 975                         txrate[1].count = 0;
 976                 }
 977
 978                 /* clear the rest of the rates */
 979                 for (i = 2; i < IEEE80211_TX_MAX_RATES; i++) {
 980                         txrate[i].idx = -1;
 981                         txrate[i].count = 0;
 982                 }
 983
 984                 if (txs->status & TX_STATUS_ACK_RCV)
 985                         tx_info->flags |= IEEE80211_TX_STAT_ACK;
 986         }
 987
 988         totlen = p->len;
 989         free_pdu = true;
 990
 991         if (lastframe) {
 992                 /* remove PLCP & Broadcom tx descriptor header */
 993                 skb_pull(p, D11_PHY_HDR_LEN);
 994                 skb_pull(p, D11_TXH_LEN);
 995                 ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw, p);
 996         } else {
 997                 brcms_err(wlc->hw->d11core,
 998                           "%s: Not last frame => not calling tx_status\n",
 999                           __func__);
1000         }
1001
1002         fatal = false;
1003
1004  out:
1005         if (fatal) {
1006                 if (txh)
1007                         trace_brcms_txdesc(&wlc->hw->d11core->dev, txh,
1008                                            sizeof(*txh));
1009                 if (p)
1010                         brcmu_pkt_buf_free_skb(p);
1011         }
1012
1013         if (dma && queue < NFIFO) {
1014                 u16 ac_queue = brcms_fifo_to_ac(queue);
1015                 if (dma->txavail > TX_HEADROOM && queue < TX_BCMC_FIFO &&
1016                     ieee80211_queue_stopped(wlc->pub->ieee_hw, ac_queue))
1017                         ieee80211_wake_queue(wlc->pub->ieee_hw, ac_queue);
1018                 dma_kick_tx(dma);
1019         }
1020
1021         return fatal;
1022 }
1023
1024 /* process tx completion events in BMAC
1025  * Return true if more tx status need to be processed. false otherwise.
1026  */
1027 static bool
1028 brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
1029 {
1030         bool morepending = false;
1031         struct bcma_device *core;
1032         struct tx_status txstatus, *txs;
1033         u32 s1, s2;
1034         uint n = 0;
1035         /*
1036          * Param 'max_tx_num' indicates max. # tx status to process before
1037          * break out.
1038          */
1039         uint max_tx_num = bound ? TXSBND : -1;
1040
1041         txs = &txstatus;
1042         core = wlc_hw->d11core;
1043         *fatal = false;
1044         s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
1045         while (!(*fatal)
1046                && (s1 & TXS_V)) {
1047                 /* !give others some time to run! */
1048                 if (n >= max_tx_num) {
1049                         morepending = true;
1050                         break;
1051                 }
1052
1053                 if (s1 == 0xffffffff) {
1054                         brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
1055                                   __func__);
1056                         *fatal = true;
1057                         return false;
1058                 }
1059                 s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
1060
1061                 txs->status = s1 & TXS_STATUS_MASK;
1062                 txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
1063                 txs->sequence = s2 & TXS_SEQ_MASK;
1064                 txs->phyerr = (s2 & TXS_PTX_MASK) >> TXS_PTX_SHIFT;
1065                 txs->lasttxtime = 0;
1066
1067                 *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
1068
1069                 s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
1070                 n++;
1071         }
1072
1073         if (*fatal)
1074                 return false;
1075
1076         return morepending;
1077 }
1078
1079 static void brcms_c_tbtt(struct brcms_c_info *wlc)
1080 {
1081         if (!wlc->bsscfg->BSS)
1082                 /*
1083                  * DirFrmQ is now valid...defer setting until end
1084                  * of ATIM window
1085                  */
1086                 wlc->qvalid |= MCMD_DIRFRMQVAL;
1087 }
1088
1089 /* set initial host flags value */
1090 static void
1091 brcms_c_mhfdef(struct brcms_c_info *wlc, u16 *mhfs, u16 mhf2_init)
1092 {
1093         struct brcms_hardware *wlc_hw = wlc->hw;
1094
1095         memset(mhfs, 0, MHFMAX * sizeof(u16));
1096
1097         mhfs[MHF2] |= mhf2_init;
1098
1099         /* prohibit use of slowclock on multifunction boards */
1100         if (wlc_hw->boardflags & BFL_NOPLLDOWN)
1101                 mhfs[MHF1] |= MHF1_FORCEFASTCLK;
1102
1103         if (BRCMS_ISNPHY(wlc_hw->band) && NREV_LT(wlc_hw->band->phyrev, 2)) {
1104                 mhfs[MHF2] |= MHF2_NPHY40MHZ_WAR;
1105                 mhfs[MHF1] |= MHF1_IQSWAP_WAR;
1106         }
1107 }
1108
1109 static uint
1110 dmareg(uint direction, uint fifonum)
1111 {
1112         if (direction == DMA_TX)
1113                 return offsetof(struct d11regs, fifo64regs[fifonum].dmaxmt);
1114         return offsetof(struct d11regs, fifo64regs[fifonum].dmarcv);
1115 }
1116
1117 static bool brcms_b_attach_dmapio(struct brcms_c_info *wlc, uint j, bool wme)
1118 {
1119         uint i;
1120         char name[8];
1121         /*
1122          * ucode host flag 2 needed for pio mode, independent of band and fifo
1123          */
1124         u16 pio_mhf2 = 0;
1125         struct brcms_hardware *wlc_hw = wlc->hw;
1126         uint unit = wlc_hw->unit;
1127
1128         /* name and offsets for dma_attach */
1129         snprintf(name, sizeof(name), "wl%d", unit);
1130
1131         if (wlc_hw->di[0] == NULL) {    /* Init FIFOs */
1132                 int dma_attach_err = 0;
1133
1134                 /*
1135                  * FIFO 0
1136                  * TX: TX_AC_BK_FIFO (TX AC Background data packets)
1137                  * RX: RX_FIFO (RX data packets)
1138                  */
1139                 wlc_hw->di[0] = dma_attach(name, wlc,
1140                                            (wme ? dmareg(DMA_TX, 0) : 0),
1141                                            dmareg(DMA_RX, 0),
1142                                            (wme ? NTXD : 0), NRXD,
1143                                            RXBUFSZ, -1, NRXBUFPOST,
1144                                            BRCMS_HWRXOFF);
1145                 dma_attach_err |= (NULL == wlc_hw->di[0]);
1146
1147                 /*
1148                  * FIFO 1
1149                  * TX: TX_AC_BE_FIFO (TX AC Best-Effort data packets)
1150                  *   (legacy) TX_DATA_FIFO (TX data packets)
1151                  * RX: UNUSED
1152                  */
1153                 wlc_hw->di[1] = dma_attach(name, wlc,
1154                                            dmareg(DMA_TX, 1), 0,
1155                                            NTXD, 0, 0, -1, 0, 0);
1156                 dma_attach_err |= (NULL == wlc_hw->di[1]);
1157
1158                 /*
1159                  * FIFO 2
1160                  * TX: TX_AC_VI_FIFO (TX AC Video data packets)
1161                  * RX: UNUSED
1162                  */
1163                 wlc_hw->di[2] = dma_attach(name, wlc,
1164                                            dmareg(DMA_TX, 2), 0,
1165                                            NTXD, 0, 0, -1, 0, 0);
1166                 dma_attach_err |= (NULL == wlc_hw->di[2]);
1167                 /*
1168                  * FIFO 3
1169                  * TX: TX_AC_VO_FIFO (TX AC Voice data packets)
1170                  *   (legacy) TX_CTL_FIFO (TX control & mgmt packets)
1171                  */
1172                 wlc_hw->di[3] = dma_attach(name, wlc,
1173                                            dmareg(DMA_TX, 3),
1174                                            0, NTXD, 0, 0, -1,
1175                                            0, 0);
1176                 dma_attach_err |= (NULL == wlc_hw->di[3]);
1177 /* Cleaner to leave this as if with AP defined */
1178
1179                 if (dma_attach_err) {
1180                         brcms_err(wlc_hw->d11core,
1181                                   "wl%d: wlc_attach: dma_attach failed\n",
1182                                   unit);
1183                         return false;
1184                 }
1185
1186                 /* get pointer to dma engine tx flow control variable */
1187                 for (i = 0; i < NFIFO; i++)
1188                         if (wlc_hw->di[i])
1189                                 wlc_hw->txavail[i] =
1190                                     (uint *) dma_getvar(wlc_hw->di[i],
1191                                                         "&txavail");
1192         }
1193
1194         /* initial ucode host flags */
1195         brcms_c_mhfdef(wlc, wlc_hw->band->mhfs, pio_mhf2);
1196
1197         return true;
1198 }
1199
1200 static void brcms_b_detach_dmapio(struct brcms_hardware *wlc_hw)
1201 {
1202         uint j;
1203
1204         for (j = 0; j < NFIFO; j++) {
1205                 if (wlc_hw->di[j]) {
1206                         dma_detach(wlc_hw->di[j]);
1207                         wlc_hw->di[j] = NULL;
1208                 }
1209         }
1210 }
1211
1212 /*
1213  * Initialize brcms_c_info default values ...
1214  * may get overrides later in this function
1215  *  BMAC_NOTES, move low out and resolve the dangling ones
1216  */
1217 static void brcms_b_info_init(struct brcms_hardware *wlc_hw)
1218 {
1219         struct brcms_c_info *wlc = wlc_hw->wlc;
1220
1221         /* set default sw macintmask value */
1222         wlc->defmacintmask = DEF_MACINTMASK;
1223
1224         /* various 802.11g modes */
1225         wlc_hw->shortslot = false;
1226
1227         wlc_hw->SFBL = RETRY_SHORT_FB;
1228         wlc_hw->LFBL = RETRY_LONG_FB;
1229
1230         /* default mac retry limits */
1231         wlc_hw->SRL = RETRY_SHORT_DEF;
1232         wlc_hw->LRL = RETRY_LONG_DEF;
1233         wlc_hw->chanspec = ch20mhz_chspec(1);
1234 }
1235
1236 static void brcms_b_wait_for_wake(struct brcms_hardware *wlc_hw)
1237 {
1238         /* delay before first read of ucode state */
1239         udelay(40);
1240
1241         /* wait until ucode is no longer asleep */
1242         SPINWAIT((brcms_b_read_shm(wlc_hw, M_UCODE_DBGST) ==
1243                   DBGST_ASLEEP), wlc_hw->wlc->fastpwrup_dly);
1244 }
1245
1246 /* control chip clock to save power, enable dynamic clock or force fast clock */
1247 static void brcms_b_clkctl_clk(struct brcms_hardware *wlc_hw, enum bcma_clkmode mode)
1248 {
1249         if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU) {
1250                 /* new chips with PMU, CCS_FORCEHT will distribute the HT clock
1251                  * on backplane, but mac core will still run on ALP(not HT) when
1252                  * it enters powersave mode, which means the FCA bit may not be
1253                  * set. Should wakeup mac if driver wants it to run on HT.
1254                  */
1255
1256                 if (wlc_hw->clk) {
1257                         if (mode == BCMA_CLKMODE_FAST) {
1258                                 bcma_set32(wlc_hw->d11core,
1259                                            D11REGOFFS(clk_ctl_st),
1260                                            CCS_FORCEHT);
1261
1262                                 udelay(64);
1263
1264                                 SPINWAIT(
1265                                     ((bcma_read32(wlc_hw->d11core,
1266                                       D11REGOFFS(clk_ctl_st)) &
1267                                       CCS_HTAVAIL) == 0),
1268                                       PMU_MAX_TRANSITION_DLY);
1269                                 WARN_ON(!(bcma_read32(wlc_hw->d11core,
1270                                         D11REGOFFS(clk_ctl_st)) &
1271                                         CCS_HTAVAIL));
1272                         } else {
1273                                 if ((ai_get_pmurev(wlc_hw->sih) == 0) &&
1274                                     (bcma_read32(wlc_hw->d11core,
1275                                         D11REGOFFS(clk_ctl_st)) &
1276                                         (CCS_FORCEHT | CCS_HTAREQ)))
1277                                         SPINWAIT(
1278                                             ((bcma_read32(wlc_hw->d11core,
1279                                               offsetof(struct d11regs,
1280                                                        clk_ctl_st)) &
1281                                               CCS_HTAVAIL) == 0),
1282                                               PMU_MAX_TRANSITION_DLY);
1283                                 bcma_mask32(wlc_hw->d11core,
1284                                         D11REGOFFS(clk_ctl_st),
1285                                         ~CCS_FORCEHT);
1286                         }
1287                 }
1288                 wlc_hw->forcefastclk = (mode == BCMA_CLKMODE_FAST);
1289         } else {
1290
1291                 /* old chips w/o PMU, force HT through cc,
1292                  * then use FCA to verify mac is running fast clock
1293                  */
1294
1295                 wlc_hw->forcefastclk = ai_clkctl_cc(wlc_hw->sih, mode);
1296
1297                 /* check fast clock is available (if core is not in reset) */
1298                 if (wlc_hw->forcefastclk && wlc_hw->clk)
1299                         WARN_ON(!(bcma_aread32(wlc_hw->d11core, BCMA_IOST) &
1300                                   SISF_FCLKA));
1301
1302                 /*
1303                  * keep the ucode wake bit on if forcefastclk is on since we
1304                  * do not want ucode to put us back to slow clock when it dozes
1305                  * for PM mode. Code below matches the wake override bit with
1306                  * current forcefastclk state. Only setting bit in wake_override
1307                  * instead of waking ucode immediately since old code had this
1308                  * behavior. Older code set wlc->forcefastclk but only had the
1309                  * wake happen if the wakup_ucode work (protected by an up
1310                  * check) was executed just below.
1311                  */
1312                 if (wlc_hw->forcefastclk)
1313                         mboolset(wlc_hw->wake_override,
1314                                  BRCMS_WAKE_OVERRIDE_FORCEFAST);
1315                 else
1316                         mboolclr(wlc_hw->wake_override,
1317                                  BRCMS_WAKE_OVERRIDE_FORCEFAST);
1318         }
1319 }
1320
1321 /* set or clear ucode host flag bits
1322  * it has an optimization for no-change write
1323  * it only writes through shared memory when the core has clock;
1324  * pre-CLK changes should use wlc_write_mhf to get around the optimization
1325  *
1326  *
1327  * bands values are: BRCM_BAND_AUTO <--- Current band only
1328  *                   BRCM_BAND_5G   <--- 5G band only
1329  *                   BRCM_BAND_2G   <--- 2G band only
1330  *                   BRCM_BAND_ALL  <--- All bands
1331  */
1332 void
1333 brcms_b_mhf(struct brcms_hardware *wlc_hw, u8 idx, u16 mask, u16 val,
1334              int bands)
1335 {
1336         u16 save;
1337         u16 addr[MHFMAX] = {
1338                 M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
1339                 M_HOST_FLAGS5
1340         };
1341         struct brcms_hw_band *band;
1342
1343         if ((val & ~mask) || idx >= MHFMAX)
1344                 return; /* error condition */
1345
1346         switch (bands) {
1347                 /* Current band only or all bands,
1348                  * then set the band to current band
1349                  */
1350         case BRCM_BAND_AUTO:
1351         case BRCM_BAND_ALL:
1352                 band = wlc_hw->band;
1353                 break;
1354         case BRCM_BAND_5G:
1355                 band = wlc_hw->bandstate[BAND_5G_INDEX];
1356                 break;
1357         case BRCM_BAND_2G:
1358                 band = wlc_hw->bandstate[BAND_2G_INDEX];
1359                 break;
1360         default:
1361                 band = NULL;    /* error condition */
1362         }
1363
1364         if (band) {
1365                 save = band->mhfs[idx];
1366                 band->mhfs[idx] = (band->mhfs[idx] & ~mask) | val;
1367
1368                 /* optimization: only write through if changed, and
1369                  * changed band is the current band
1370                  */
1371                 if (wlc_hw->clk && (band->mhfs[idx] != save)
1372                     && (band == wlc_hw->band))
1373                         brcms_b_write_shm(wlc_hw, addr[idx],
1374                                            (u16) band->mhfs[idx]);
1375         }
1376
1377         if (bands == BRCM_BAND_ALL) {
1378                 wlc_hw->bandstate[0]->mhfs[idx] =
1379                     (wlc_hw->bandstate[0]->mhfs[idx] & ~mask) | val;
1380                 wlc_hw->bandstate[1]->mhfs[idx] =
1381                     (wlc_hw->bandstate[1]->mhfs[idx] & ~mask) | val;
1382         }
1383 }
1384
1385 /* set the maccontrol register to desired reset state and
1386  * initialize the sw cache of the register
1387  */
1388 static void brcms_c_mctrl_reset(struct brcms_hardware *wlc_hw)
1389 {
1390         /* IHR accesses are always enabled, PSM disabled, HPS off and WAKE on */
1391         wlc_hw->maccontrol = 0;
1392         wlc_hw->suspended_fifos = 0;
1393         wlc_hw->wake_override = 0;
1394         wlc_hw->mute_override = 0;
1395         brcms_b_mctrl(wlc_hw, ~0, MCTL_IHR_EN | MCTL_WAKE);
1396 }
1397
1398 /*
1399  * write the software state of maccontrol and
1400  * overrides to the maccontrol register
1401  */
1402 static void brcms_c_mctrl_write(struct brcms_hardware *wlc_hw)
1403 {
1404         u32 maccontrol = wlc_hw->maccontrol;
1405
1406         /* OR in the wake bit if overridden */
1407         if (wlc_hw->wake_override)
1408                 maccontrol |= MCTL_WAKE;
1409
1410         /* set AP and INFRA bits for mute if needed */
1411         if (wlc_hw->mute_override) {
1412                 maccontrol &= ~(MCTL_AP);
1413                 maccontrol |= MCTL_INFRA;
1414         }
1415
1416         bcma_write32(wlc_hw->d11core, D11REGOFFS(maccontrol),
1417                      maccontrol);
1418 }
1419
1420 /* set or clear maccontrol bits */
1421 void brcms_b_mctrl(struct brcms_hardware *wlc_hw, u32 mask, u32 val)
1422 {
1423         u32 maccontrol;
1424         u32 new_maccontrol;
1425
1426         if (val & ~mask)
1427                 return; /* error condition */
1428         maccontrol = wlc_hw->maccontrol;
1429         new_maccontrol = (maccontrol & ~mask) | val;
1430
1431         /* if the new maccontrol value is the same as the old, nothing to do */
1432         if (new_maccontrol == maccontrol)
1433                 return;
1434
1435         /* something changed, cache the new value */
1436         wlc_hw->maccontrol = new_maccontrol;
1437
1438         /* write the new values with overrides applied */
1439         brcms_c_mctrl_write(wlc_hw);
1440 }
1441
1442 void brcms_c_ucode_wake_override_set(struct brcms_hardware *wlc_hw,
1443                                  u32 override_bit)
1444 {
1445         if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE)) {
1446                 mboolset(wlc_hw->wake_override, override_bit);
1447                 return;
1448         }
1449
1450         mboolset(wlc_hw->wake_override, override_bit);
1451
1452         brcms_c_mctrl_write(wlc_hw);
1453         brcms_b_wait_for_wake(wlc_hw);
1454 }
1455
1456 void brcms_c_ucode_wake_override_clear(struct brcms_hardware *wlc_hw,
1457                                    u32 override_bit)
1458 {
1459         mboolclr(wlc_hw->wake_override, override_bit);
1460
1461         if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE))
1462                 return;
1463
1464         brcms_c_mctrl_write(wlc_hw);
1465 }
1466
1467 /* When driver needs ucode to stop beaconing, it has to make sure that
1468  * MCTL_AP is clear and MCTL_INFRA is set
1469  * Mode           MCTL_AP        MCTL_INFRA
1470  * AP                1              1
1471  * STA               0              1 <--- This will ensure no beacons
1472  * IBSS              0              0
1473  */
1474 static void brcms_c_ucode_mute_override_set(struct brcms_hardware *wlc_hw)
1475 {
1476         wlc_hw->mute_override = 1;
1477
1478         /* if maccontrol already has AP == 0 and INFRA == 1 without this
1479          * override, then there is no change to write
1480          */
1481         if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1482                 return;
1483
1484         brcms_c_mctrl_write(wlc_hw);
1485 }
1486
1487 /* Clear the override on AP and INFRA bits */
1488 static void brcms_c_ucode_mute_override_clear(struct brcms_hardware *wlc_hw)
1489 {
1490         if (wlc_hw->mute_override == 0)
1491                 return;
1492
1493         wlc_hw->mute_override = 0;
1494
1495         /* if maccontrol already has AP == 0 and INFRA == 1 without this
1496          * override, then there is no change to write
1497          */
1498         if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1499                 return;
1500
1501         brcms_c_mctrl_write(wlc_hw);
1502 }
1503
1504 /*
1505  * Write a MAC address to the given match reg offset in the RXE match engine.
1506  */
1507 static void
1508 brcms_b_set_addrmatch(struct brcms_hardware *wlc_hw, int match_reg_offset,
1509                        const u8 *addr)
1510 {
1511         struct bcma_device *core = wlc_hw->d11core;
1512         u16 mac_l;
1513         u16 mac_m;
1514         u16 mac_h;
1515
1516         brcms_dbg_rx(core, "wl%d: brcms_b_set_addrmatch\n", wlc_hw->unit);
1517
1518         mac_l = addr[0] | (addr[1] << 8);
1519         mac_m = addr[2] | (addr[3] << 8);
1520         mac_h = addr[4] | (addr[5] << 8);
1521
1522         /* enter the MAC addr into the RXE match registers */
1523         bcma_write16(core, D11REGOFFS(rcm_ctl),
1524                      RCM_INC_DATA | match_reg_offset);
1525         bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_l);
1526         bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_m);
1527         bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_h);
1528 }
1529
1530 void
1531 brcms_b_write_template_ram(struct brcms_hardware *wlc_hw, int offset, int len,
1532                             void *buf)
1533 {
1534         struct bcma_device *core = wlc_hw->d11core;
1535         u32 word;
1536         __le32 word_le;
1537         __be32 word_be;
1538         bool be_bit;
1539         brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
1540
1541         bcma_write32(core, D11REGOFFS(tplatewrptr), offset);
1542
1543         /* if MCTL_BIGEND bit set in mac control register,
1544          * the chip swaps data in fifo, as well as data in
1545          * template ram
1546          */
1547         be_bit = (bcma_read32(core, D11REGOFFS(maccontrol)) & MCTL_BIGEND) != 0;
1548
1549         while (len > 0) {
1550                 memcpy(&word, buf, sizeof(u32));
1551
1552                 if (be_bit) {
1553                         word_be = cpu_to_be32(word);
1554                         word = *(u32 *)&word_be;
1555                 } else {
1556                         word_le = cpu_to_le32(word);
1557                         word = *(u32 *)&word_le;
1558                 }
1559
1560                 bcma_write32(core, D11REGOFFS(tplatewrdata), word);
1561
1562                 buf = (u8 *) buf + sizeof(u32);
1563                 len -= sizeof(u32);
1564         }
1565 }
1566
1567 static void brcms_b_set_cwmin(struct brcms_hardware *wlc_hw, u16 newmin)
1568 {
1569         wlc_hw->band->CWmin = newmin;
1570
1571         bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1572                      OBJADDR_SCR_SEL | S_DOT11_CWMIN);
1573         (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1574         bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmin);
1575 }
1576
1577 static void brcms_b_set_cwmax(struct brcms_hardware *wlc_hw, u16 newmax)
1578 {
1579         wlc_hw->band->CWmax = newmax;
1580
1581         bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1582                      OBJADDR_SCR_SEL | S_DOT11_CWMAX);
1583         (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1584         bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmax);
1585 }
1586
1587 void brcms_b_bw_set(struct brcms_hardware *wlc_hw, u16 bw)
1588 {
1589         bool fastclk;
1590
1591         /* request FAST clock if not on */
1592         fastclk = wlc_hw->forcefastclk;
1593         if (!fastclk)
1594                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
1595
1596         wlc_phy_bw_state_set(wlc_hw->band->pi, bw);
1597
1598         brcms_b_phy_reset(wlc_hw);
1599         wlc_phy_init(wlc_hw->band->pi, wlc_phy_chanspec_get(wlc_hw->band->pi));
1600
1601         /* restore the clk */
1602         if (!fastclk)
1603                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
1604 }
1605
1606 static void brcms_b_upd_synthpu(struct brcms_hardware *wlc_hw)
1607 {
1608         u16 v;
1609         struct brcms_c_info *wlc = wlc_hw->wlc;
1610         /* update SYNTHPU_DLY */
1611
1612         if (BRCMS_ISLCNPHY(wlc->band))
1613                 v = SYNTHPU_DLY_LPPHY_US;
1614         else if (BRCMS_ISNPHY(wlc->band) && (NREV_GE(wlc->band->phyrev, 3)))
1615                 v = SYNTHPU_DLY_NPHY_US;
1616         else
1617                 v = SYNTHPU_DLY_BPHY_US;
1618
1619         brcms_b_write_shm(wlc_hw, M_SYNTHPU_DLY, v);
1620 }
1621
1622 static void brcms_c_ucode_txant_set(struct brcms_hardware *wlc_hw)
1623 {
1624         u16 phyctl;
1625         u16 phytxant = wlc_hw->bmac_phytxant;
1626         u16 mask = PHY_TXC_ANT_MASK;
1627
1628         /* set the Probe Response frame phy control word */
1629         phyctl = brcms_b_read_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS);
1630         phyctl = (phyctl & ~mask) | phytxant;
1631         brcms_b_write_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS, phyctl);
1632
1633         /* set the Response (ACK/CTS) frame phy control word */
1634         phyctl = brcms_b_read_shm(wlc_hw, M_RSP_PCTLWD);
1635         phyctl = (phyctl & ~mask) | phytxant;
1636         brcms_b_write_shm(wlc_hw, M_RSP_PCTLWD, phyctl);
1637 }
1638
1639 static u16 brcms_b_ofdm_ratetable_offset(struct brcms_hardware *wlc_hw,
1640                                          u8 rate)
1641 {
1642         uint i;
1643         u8 plcp_rate = 0;
1644         struct plcp_signal_rate_lookup {
1645                 u8 rate;
1646                 u8 signal_rate;
1647         };
1648         /* OFDM RATE sub-field of PLCP SIGNAL field, per 802.11 sec 17.3.4.1 */
1649         const struct plcp_signal_rate_lookup rate_lookup[] = {
1650                 {BRCM_RATE_6M, 0xB},
1651                 {BRCM_RATE_9M, 0xF},
1652                 {BRCM_RATE_12M, 0xA},
1653                 {BRCM_RATE_18M, 0xE},
1654                 {BRCM_RATE_24M, 0x9},
1655                 {BRCM_RATE_36M, 0xD},
1656                 {BRCM_RATE_48M, 0x8},
1657                 {BRCM_RATE_54M, 0xC}
1658         };
1659
1660         for (i = 0; i < ARRAY_SIZE(rate_lookup); i++) {
1661                 if (rate == rate_lookup[i].rate) {
1662                         plcp_rate = rate_lookup[i].signal_rate;
1663                         break;
1664                 }
1665         }
1666
1667         /* Find the SHM pointer to the rate table entry by looking in the
1668          * Direct-map Table
1669          */
1670         return 2 * brcms_b_read_shm(wlc_hw, M_RT_DIRMAP_A + (plcp_rate * 2));
1671 }
1672
1673 static void brcms_upd_ofdm_pctl1_table(struct brcms_hardware *wlc_hw)
1674 {
1675         u8 rate;
1676         u8 rates[8] = {
1677                 BRCM_RATE_6M, BRCM_RATE_9M, BRCM_RATE_12M, BRCM_RATE_18M,
1678                 BRCM_RATE_24M, BRCM_RATE_36M, BRCM_RATE_48M, BRCM_RATE_54M
1679         };
1680         u16 entry_ptr;
1681         u16 pctl1;
1682         uint i;
1683
1684         if (!BRCMS_PHY_11N_CAP(wlc_hw->band))
1685                 return;
1686
1687         /* walk the phy rate table and update the entries */
1688         for (i = 0; i < ARRAY_SIZE(rates); i++) {
1689                 rate = rates[i];
1690
1691                 entry_ptr = brcms_b_ofdm_ratetable_offset(wlc_hw, rate);
1692
1693                 /* read the SHM Rate Table entry OFDM PCTL1 values */
1694                 pctl1 =
1695                     brcms_b_read_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS);
1696
1697                 /* modify the value */
1698                 pctl1 &= ~PHY_TXC1_MODE_MASK;
1699                 pctl1 |= (wlc_hw->hw_stf_ss_opmode << PHY_TXC1_MODE_SHIFT);
1700
1701                 /* Update the SHM Rate Table entry OFDM PCTL1 values */
1702                 brcms_b_write_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS,
1703                                    pctl1);
1704         }
1705 }
1706
1707 /* band-specific init */
1708 static void brcms_b_bsinit(struct brcms_c_info *wlc, u16 chanspec)
1709 {
1710         struct brcms_hardware *wlc_hw = wlc->hw;
1711
1712         brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
1713                            wlc_hw->band->bandunit);
1714
1715         brcms_c_ucode_bsinit(wlc_hw);
1716
1717         wlc_phy_init(wlc_hw->band->pi, chanspec);
1718
1719         brcms_c_ucode_txant_set(wlc_hw);
1720
1721         /*
1722          * cwmin is band-specific, update hardware
1723          * with value for current band
1724          */
1725         brcms_b_set_cwmin(wlc_hw, wlc_hw->band->CWmin);
1726         brcms_b_set_cwmax(wlc_hw, wlc_hw->band->CWmax);
1727
1728         brcms_b_update_slot_timing(wlc_hw,
1729                                    wlc_hw->band->bandtype == BRCM_BAND_5G ?
1730                                    true : wlc_hw->shortslot);
1731
1732         /* write phytype and phyvers */
1733         brcms_b_write_shm(wlc_hw, M_PHYTYPE, (u16) wlc_hw->band->phytype);
1734         brcms_b_write_shm(wlc_hw, M_PHYVER, (u16) wlc_hw->band->phyrev);
1735
1736         /*
1737          * initialize the txphyctl1 rate table since
1738          * shmem is shared between bands
1739          */
1740         brcms_upd_ofdm_pctl1_table(wlc_hw);
1741
1742         brcms_b_upd_synthpu(wlc_hw);
1743 }
1744
1745 /* Perform a soft reset of the PHY PLL */
1746 void brcms_b_core_phypll_reset(struct brcms_hardware *wlc_hw)
1747 {
1748         ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_addr),
1749                   ~0, 0);
1750         udelay(1);
1751         ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1752                   0x4, 0);
1753         udelay(1);
1754         ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1755                   0x4, 4);
1756         udelay(1);
1757         ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1758                   0x4, 0);
1759         udelay(1);
1760 }
1761
1762 /* light way to turn on phy clock without reset for NPHY only
1763  *  refer to brcms_b_core_phy_clk for full version
1764  */
1765 void brcms_b_phyclk_fgc(struct brcms_hardware *wlc_hw, bool clk)
1766 {
1767         /* support(necessary for NPHY and HYPHY) only */
1768         if (!BRCMS_ISNPHY(wlc_hw->band))
1769                 return;
1770
1771         if (ON == clk)
1772                 brcms_b_core_ioctl(wlc_hw, SICF_FGC, SICF_FGC);
1773         else
1774                 brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
1775
1776 }
1777
1778 void brcms_b_macphyclk_set(struct brcms_hardware *wlc_hw, bool clk)
1779 {
1780         if (ON == clk)
1781                 brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, SICF_MPCLKE);
1782         else
1783                 brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, 0);
1784 }
1785
1786 void brcms_b_phy_reset(struct brcms_hardware *wlc_hw)
1787 {
1788         struct brcms_phy_pub *pih = wlc_hw->band->pi;
1789         u32 phy_bw_clkbits;
1790         bool phy_in_reset = false;
1791
1792         brcms_dbg_info(wlc_hw->d11core, "wl%d: reset phy\n", wlc_hw->unit);
1793
1794         if (pih == NULL)
1795                 return;
1796
1797         phy_bw_clkbits = wlc_phy_clk_bwbits(wlc_hw->band->pi);
1798
1799         /* Specific reset sequence required for NPHY rev 3 and 4 */
1800         if (BRCMS_ISNPHY(wlc_hw->band) && NREV_GE(wlc_hw->band->phyrev, 3) &&
1801             NREV_LE(wlc_hw->band->phyrev, 4)) {
1802                 /* Set the PHY bandwidth */
1803                 brcms_b_core_ioctl(wlc_hw, SICF_BWMASK, phy_bw_clkbits);
1804
1805                 udelay(1);
1806
1807                 /* Perform a soft reset of the PHY PLL */
1808                 brcms_b_core_phypll_reset(wlc_hw);
1809
1810                 /* reset the PHY */
1811                 brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_PCLKE),
1812                                    (SICF_PRST | SICF_PCLKE));
1813                 phy_in_reset = true;
1814         } else {
1815                 brcms_b_core_ioctl(wlc_hw,
1816                                    (SICF_PRST | SICF_PCLKE | SICF_BWMASK),
1817                                    (SICF_PRST | SICF_PCLKE | phy_bw_clkbits));
1818         }
1819
1820         udelay(2);
1821         brcms_b_core_phy_clk(wlc_hw, ON);
1822
1823         if (pih)
1824                 wlc_phy_anacore(pih, ON);
1825 }
1826
1827 /* switch to and initialize new band */
1828 static void brcms_b_setband(struct brcms_hardware *wlc_hw, uint bandunit,
1829                             u16 chanspec) {
1830         struct brcms_c_info *wlc = wlc_hw->wlc;
1831         u32 macintmask;
1832
1833         /* Enable the d11 core before accessing it */
1834         if (!bcma_core_is_enabled(wlc_hw->d11core)) {
1835                 bcma_core_enable(wlc_hw->d11core, 0);
1836                 brcms_c_mctrl_reset(wlc_hw);
1837         }
1838
1839         macintmask = brcms_c_setband_inact(wlc, bandunit);
1840
1841         if (!wlc_hw->up)
1842                 return;
1843
1844         brcms_b_core_phy_clk(wlc_hw, ON);
1845
1846         /* band-specific initializations */
1847         brcms_b_bsinit(wlc, chanspec);
1848
1849         /*
1850          * If there are any pending software interrupt bits,
1851          * then replace these with a harmless nonzero value
1852          * so brcms_c_dpc() will re-enable interrupts when done.
1853          */
1854         if (wlc->macintstatus)
1855                 wlc->macintstatus = MI_DMAINT;
1856
1857         /* restore macintmask */
1858         brcms_intrsrestore(wlc->wl, macintmask);
1859
1860         /* ucode should still be suspended.. */
1861         WARN_ON((bcma_read32(wlc_hw->d11core, D11REGOFFS(maccontrol)) &
1862                  MCTL_EN_MAC) != 0);
1863 }
1864
1865 static bool brcms_c_isgoodchip(struct brcms_hardware *wlc_hw)
1866 {
1867
1868         /* reject unsupported corerev */
1869         if (!CONF_HAS(D11CONF, wlc_hw->corerev)) {
1870                 wiphy_err(wlc_hw->wlc->wiphy, "unsupported core rev %d\n",
1871                           wlc_hw->corerev);
1872                 return false;
1873         }
1874
1875         return true;
1876 }
1877
1878 /* Validate some board info parameters */
1879 static bool brcms_c_validboardtype(struct brcms_hardware *wlc_hw)
1880 {
1881         uint boardrev = wlc_hw->boardrev;
1882
1883         /* 4 bits each for board type, major, minor, and tiny version */
1884         uint brt = (boardrev & 0xf000) >> 12;
1885         uint b0 = (boardrev & 0xf00) >> 8;
1886         uint b1 = (boardrev & 0xf0) >> 4;
1887         uint b2 = boardrev & 0xf;
1888
1889         /* voards from other vendors are always considered valid */
1890         if (ai_get_boardvendor(wlc_hw->sih) != PCI_VENDOR_ID_BROADCOM)
1891                 return true;
1892
1893         /* do some boardrev sanity checks when boardvendor is Broadcom */
1894         if (boardrev == 0)
1895                 return false;
1896
1897         if (boardrev <= 0xff)
1898                 return true;
1899
1900         if ((brt > 2) || (brt == 0) || (b0 > 9) || (b0 == 0) || (b1 > 9)
1901                 || (b2 > 9))
1902                 return false;
1903
1904         return true;
1905 }
1906
1907 static void brcms_c_get_macaddr(struct brcms_hardware *wlc_hw, u8 etheraddr[ETH_ALEN])
1908 {
1909         struct ssb_sprom *sprom = &wlc_hw->d11core->bus->sprom;
1910
1911         /* If macaddr exists, use it (Sromrev4, CIS, ...). */
1912         if (!is_zero_ether_addr(sprom->il0mac)) {
1913                 memcpy(etheraddr, sprom->il0mac, 6);
1914                 return;
1915         }
1916
1917         if (wlc_hw->_nbands > 1)
1918                 memcpy(etheraddr, sprom->et1mac, 6);
1919         else
1920                 memcpy(etheraddr, sprom->il0mac, 6);
1921 }
1922
1923 /* power both the pll and external oscillator on/off */
1924 static void brcms_b_xtal(struct brcms_hardware *wlc_hw, bool want)
1925 {
1926         brcms_dbg_info(wlc_hw->d11core, "wl%d: want %d\n", wlc_hw->unit, want);
1927
1928         /*
1929          * dont power down if plldown is false or
1930          * we must poll hw radio disable
1931          */
1932         if (!want && wlc_hw->pllreq)
1933                 return;
1934
1935         wlc_hw->sbclk = want;
1936         if (!wlc_hw->sbclk) {
1937                 wlc_hw->clk = false;
1938                 if (wlc_hw->band && wlc_hw->band->pi)
1939                         wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
1940         }
1941 }
1942
1943 /*
1944  * Return true if radio is disabled, otherwise false.
1945  * hw radio disable signal is an external pin, users activate it asynchronously
1946  * this function could be called when driver is down and w/o clock
1947  * it operates on different registers depending on corerev and boardflag.
1948  */
1949 static bool brcms_b_radio_read_hwdisabled(struct brcms_hardware *wlc_hw)
1950 {
1951         bool v, clk, xtal;
1952         u32 flags = 0;
1953
1954         xtal = wlc_hw->sbclk;
1955         if (!xtal)
1956                 brcms_b_xtal(wlc_hw, ON);
1957
1958         /* may need to take core out of reset first */
1959         clk = wlc_hw->clk;
1960         if (!clk) {
1961                 /*
1962                  * mac no longer enables phyclk automatically when driver
1963                  * accesses phyreg throughput mac. This can be skipped since
1964                  * only mac reg is accessed below
1965                  */
1966                 if (D11REV_GE(wlc_hw->corerev, 18))
1967                         flags |= SICF_PCLKE;
1968
1969                 /*
1970                  * TODO: test suspend/resume
1971                  *
1972                  * AI chip doesn't restore bar0win2 on
1973                  * hibernation/resume, need sw fixup
1974                  */
1975
1976                 bcma_core_enable(wlc_hw->d11core, flags);
1977                 brcms_c_mctrl_reset(wlc_hw);
1978         }
1979
1980         v = ((bcma_read32(wlc_hw->d11core,
1981                           D11REGOFFS(phydebug)) & PDBG_RFD) != 0);
1982
1983         /* put core back into reset */
1984         if (!clk)
1985                 bcma_core_disable(wlc_hw->d11core, 0);
1986
1987         if (!xtal)
1988                 brcms_b_xtal(wlc_hw, OFF);
1989
1990         return v;
1991 }
1992
1993 static bool wlc_dma_rxreset(struct brcms_hardware *wlc_hw, uint fifo)
1994 {
1995         struct dma_pub *di = wlc_hw->di[fifo];
1996         return dma_rxreset(di);
1997 }
1998
1999 /* d11 core reset
2000  *   ensure fask clock during reset
2001  *   reset dma
2002  *   reset d11(out of reset)
2003  *   reset phy(out of reset)
2004  *   clear software macintstatus for fresh new start
2005  * one testing hack wlc_hw->noreset will bypass the d11/phy reset
2006  */
2007 void brcms_b_corereset(struct brcms_hardware *wlc_hw, u32 flags)
2008 {
2009         uint i;
2010         bool fastclk;
2011
2012         if (flags == BRCMS_USE_COREFLAGS)
2013                 flags = (wlc_hw->band->pi ? wlc_hw->band->core_flags : 0);
2014
2015         brcms_dbg_info(wlc_hw->d11core, "wl%d: core reset\n", wlc_hw->unit);
2016
2017         /* request FAST clock if not on  */
2018         fastclk = wlc_hw->forcefastclk;
2019         if (!fastclk)
2020                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2021
2022         /* reset the dma engines except first time thru */
2023         if (bcma_core_is_enabled(wlc_hw->d11core)) {
2024                 for (i = 0; i < NFIFO; i++)
2025                         if ((wlc_hw->di[i]) && (!dma_txreset(wlc_hw->di[i])))
2026                                 brcms_err(wlc_hw->d11core, "wl%d: %s: "
2027                                           "dma_txreset[%d]: cannot stop dma\n",
2028                                            wlc_hw->unit, __func__, i);
2029
2030                 if ((wlc_hw->di[RX_FIFO])
2031                     && (!wlc_dma_rxreset(wlc_hw, RX_FIFO)))
2032                         brcms_err(wlc_hw->d11core, "wl%d: %s: dma_rxreset"
2033                                   "[%d]: cannot stop dma\n",
2034                                   wlc_hw->unit, __func__, RX_FIFO);
2035         }
2036         /* if noreset, just stop the psm and return */
2037         if (wlc_hw->noreset) {
2038                 wlc_hw->wlc->macintstatus = 0;  /* skip wl_dpc after down */
2039                 brcms_b_mctrl(wlc_hw, MCTL_PSM_RUN | MCTL_EN_MAC, 0);
2040                 return;
2041         }
2042
2043         /*
2044          * mac no longer enables phyclk automatically when driver accesses
2045          * phyreg throughput mac, AND phy_reset is skipped at early stage when
2046          * band->pi is invalid. need to enable PHY CLK
2047          */
2048         if (D11REV_GE(wlc_hw->corerev, 18))
2049                 flags |= SICF_PCLKE;
2050
2051         /*
2052          * reset the core
2053          * In chips with PMU, the fastclk request goes through d11 core
2054          * reg 0x1e0, which is cleared by the core_reset. have to re-request it.
2055          *
2056          * This adds some delay and we can optimize it by also requesting
2057          * fastclk through chipcommon during this period if necessary. But
2058          * that has to work coordinate with other driver like mips/arm since
2059          * they may touch chipcommon as well.
2060          */
2061         wlc_hw->clk = false;
2062         bcma_core_enable(wlc_hw->d11core, flags);
2063         wlc_hw->clk = true;
2064         if (wlc_hw->band && wlc_hw->band->pi)
2065                 wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, true);
2066
2067         brcms_c_mctrl_reset(wlc_hw);
2068
2069         if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU)
2070                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2071
2072         brcms_b_phy_reset(wlc_hw);
2073
2074         /* turn on PHY_PLL */
2075         brcms_b_core_phypll_ctl(wlc_hw, true);
2076
2077         /* clear sw intstatus */
2078         wlc_hw->wlc->macintstatus = 0;
2079
2080         /* restore the clk setting */
2081         if (!fastclk)
2082                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
2083 }
2084
2085 /* txfifo sizes needs to be modified(increased) since the newer cores
2086  * have more memory.
2087  */
2088 static void brcms_b_corerev_fifofixup(struct brcms_hardware *wlc_hw)
2089 {
2090         struct bcma_device *core = wlc_hw->d11core;
2091         u16 fifo_nu;
2092         u16 txfifo_startblk = TXFIFO_START_BLK, txfifo_endblk;
2093         u16 txfifo_def, txfifo_def1;
2094         u16 txfifo_cmd;
2095
2096         /* tx fifos start at TXFIFO_START_BLK from the Base address */
2097         txfifo_startblk = TXFIFO_START_BLK;
2098
2099         /* sequence of operations:  reset fifo, set fifo size, reset fifo */
2100         for (fifo_nu = 0; fifo_nu < NFIFO; fifo_nu++) {
2101
2102                 txfifo_endblk = txfifo_startblk + wlc_hw->xmtfifo_sz[fifo_nu];
2103                 txfifo_def = (txfifo_startblk & 0xff) |
2104                     (((txfifo_endblk - 1) & 0xff) << TXFIFO_FIFOTOP_SHIFT);
2105                 txfifo_def1 = ((txfifo_startblk >> 8) & 0x1) |
2106                     ((((txfifo_endblk -
2107                         1) >> 8) & 0x1) << TXFIFO_FIFOTOP_SHIFT);
2108                 txfifo_cmd =
2109                     TXFIFOCMD_RESET_MASK | (fifo_nu << TXFIFOCMD_FIFOSEL_SHIFT);
2110
2111                 bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2112                 bcma_write16(core, D11REGOFFS(xmtfifodef), txfifo_def);
2113                 bcma_write16(core, D11REGOFFS(xmtfifodef1), txfifo_def1);
2114
2115                 bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2116
2117                 txfifo_startblk += wlc_hw->xmtfifo_sz[fifo_nu];
2118         }
2119         /*
2120          * need to propagate to shm location to be in sync since ucode/hw won't
2121          * do this
2122          */
2123         brcms_b_write_shm(wlc_hw, M_FIFOSIZE0,
2124                            wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]);
2125         brcms_b_write_shm(wlc_hw, M_FIFOSIZE1,
2126                            wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]);
2127         brcms_b_write_shm(wlc_hw, M_FIFOSIZE2,
2128                            ((wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO] << 8) | wlc_hw->
2129                             xmtfifo_sz[TX_AC_BK_FIFO]));
2130         brcms_b_write_shm(wlc_hw, M_FIFOSIZE3,
2131                            ((wlc_hw->xmtfifo_sz[TX_ATIM_FIFO] << 8) | wlc_hw->
2132                             xmtfifo_sz[TX_BCMC_FIFO]));
2133 }
2134
2135 /* This function is used for changing the tsf frac register
2136  * If spur avoidance mode is off, the mac freq will be 80/120/160Mhz
2137  * If spur avoidance mode is on1, the mac freq will be 82/123/164Mhz
2138  * If spur avoidance mode is on2, the mac freq will be 84/126/168Mhz
2139  * HTPHY Formula is 2^26/freq(MHz) e.g.
2140  * For spuron2 - 126MHz -> 2^26/126 = 532610.0
2141  *  - 532610 = 0x82082 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x2082
2142  * For spuron: 123MHz -> 2^26/123    = 545600.5
2143  *  - 545601 = 0x85341 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x5341
2144  * For spur off: 120MHz -> 2^26/120    = 559240.5
2145  *  - 559241 = 0x88889 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x8889
2146  */
2147
2148 void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode)
2149 {
2150         struct bcma_device *core = wlc_hw->d11core;
2151
2152         if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43224) ||
2153             (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225)) {
2154                 if (spurmode == WL_SPURAVOID_ON2) {     /* 126Mhz */
2155                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x2082);
2156                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2157                 } else if (spurmode == WL_SPURAVOID_ON1) {      /* 123Mhz */
2158                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x5341);
2159                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2160                 } else {        /* 120Mhz */
2161                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x8889);
2162                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2163                 }
2164         } else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2165                 if (spurmode == WL_SPURAVOID_ON1) {     /* 82Mhz */
2166                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x7CE0);
2167                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2168                 } else {        /* 80Mhz */
2169                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0xCCCD);
2170                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2171                 }
2172         }
2173 }
2174
2175 /* Initialize GPIOs that are controlled by D11 core */
2176 static void brcms_c_gpio_init(struct brcms_c_info *wlc)
2177 {
2178         struct brcms_hardware *wlc_hw = wlc->hw;
2179         u32 gc, gm;
2180
2181         /* use GPIO select 0 to get all gpio signals from the gpio out reg */
2182         brcms_b_mctrl(wlc_hw, MCTL_GPOUT_SEL_MASK, 0);
2183
2184         /*
2185          * Common GPIO setup:
2186          *      G0 = LED 0 = WLAN Activity
2187          *      G1 = LED 1 = WLAN 2.4 GHz Radio State
2188          *      G2 = LED 2 = WLAN 5 GHz Radio State
2189          *      G4 = radio disable input (HI enabled, LO disabled)
2190          */
2191
2192         gc = gm = 0;
2193
2194         /* Allocate GPIOs for mimo antenna diversity feature */
2195         if (wlc_hw->antsel_type == ANTSEL_2x3) {
2196                 /* Enable antenna diversity, use 2x3 mode */
2197                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2198                              MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2199                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE,
2200                              MHF3_ANTSEL_MODE, BRCM_BAND_ALL);
2201
2202                 /* init superswitch control */
2203                 wlc_phy_antsel_init(wlc_hw->band->pi, false);
2204
2205         } else if (wlc_hw->antsel_type == ANTSEL_2x4) {
2206                 gm |= gc |= (BOARD_GPIO_12 | BOARD_GPIO_13);
2207                 /*
2208                  * The board itself is powered by these GPIOs
2209                  * (when not sending pattern) so set them high
2210                  */
2211                 bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_oe),
2212                            (BOARD_GPIO_12 | BOARD_GPIO_13));
2213                 bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_out),
2214                            (BOARD_GPIO_12 | BOARD_GPIO_13));
2215
2216                 /* Enable antenna diversity, use 2x4 mode */
2217                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2218                              MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2219                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE, 0,
2220                              BRCM_BAND_ALL);
2221
2222                 /* Configure the desired clock to be 4Mhz */
2223                 brcms_b_write_shm(wlc_hw, M_ANTSEL_CLKDIV,
2224                                    ANTSEL_CLKDIV_4MHZ);
2225         }
2226
2227         /*
2228          * gpio 9 controls the PA. ucode is responsible
2229          * for wiggling out and oe
2230          */
2231         if (wlc_hw->boardflags & BFL_PACTRL)
2232                 gm |= gc |= BOARD_GPIO_PACTRL;
2233
2234         /* apply to gpiocontrol register */
2235         bcma_chipco_gpio_control(&wlc_hw->d11core->bus->drv_cc, gm, gc);
2236 }
2237
2238 static void brcms_ucode_write(struct brcms_hardware *wlc_hw,
2239                               const __le32 ucode[], const size_t nbytes)
2240 {
2241         struct bcma_device *core = wlc_hw->d11core;
2242         uint i;
2243         uint count;
2244
2245         brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
2246
2247         count = (nbytes / sizeof(u32));
2248
2249         bcma_write32(core, D11REGOFFS(objaddr),
2250                      OBJADDR_AUTO_INC | OBJADDR_UCM_SEL);
2251         (void)bcma_read32(core, D11REGOFFS(objaddr));
2252         for (i = 0; i < count; i++)
2253                 bcma_write32(core, D11REGOFFS(objdata), le32_to_cpu(ucode[i]));
2254
2255 }
2256
2257 static void brcms_ucode_download(struct brcms_hardware *wlc_hw)
2258 {
2259         struct brcms_c_info *wlc;
2260         struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
2261
2262         wlc = wlc_hw->wlc;
2263
2264         if (wlc_hw->ucode_loaded)
2265                 return;
2266
2267         if (D11REV_IS(wlc_hw->corerev, 23)) {
2268                 if (BRCMS_ISNPHY(wlc_hw->band)) {
2269                         brcms_ucode_write(wlc_hw, ucode->bcm43xx_16_mimo,
2270                                           ucode->bcm43xx_16_mimosz);
2271                         wlc_hw->ucode_loaded = true;
2272                 } else
2273                         brcms_err(wlc_hw->d11core,
2274                                   "%s: wl%d: unsupported phy in corerev %d\n",
2275                                   __func__, wlc_hw->unit, wlc_hw->corerev);
2276         } else if (D11REV_IS(wlc_hw->corerev, 24)) {
2277                 if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2278                         brcms_ucode_write(wlc_hw, ucode->bcm43xx_24_lcn,
2279                                           ucode->bcm43xx_24_lcnsz);
2280                         wlc_hw->ucode_loaded = true;
2281                 } else {
2282                         brcms_err(wlc_hw->d11core,
2283                                   "%s: wl%d: unsupported phy in corerev %d\n",
2284                                   __func__, wlc_hw->unit, wlc_hw->corerev);
2285                 }
2286         }
2287 }
2288
2289 void brcms_b_txant_set(struct brcms_hardware *wlc_hw, u16 phytxant)
2290 {
2291         /* update sw state */
2292         wlc_hw->bmac_phytxant = phytxant;
2293
2294         /* push to ucode if up */
2295         if (!wlc_hw->up)
2296                 return;
2297         brcms_c_ucode_txant_set(wlc_hw);
2298
2299 }
2300
2301 u16 brcms_b_get_txant(struct brcms_hardware *wlc_hw)
2302 {
2303         return (u16) wlc_hw->wlc->stf->txant;
2304 }
2305
2306 void brcms_b_antsel_type_set(struct brcms_hardware *wlc_hw, u8 antsel_type)
2307 {
2308         wlc_hw->antsel_type = antsel_type;
2309
2310         /* Update the antsel type for phy module to use */
2311         wlc_phy_antsel_type_set(wlc_hw->band->pi, antsel_type);
2312 }
2313
2314 static void brcms_b_fifoerrors(struct brcms_hardware *wlc_hw)
2315 {
2316         bool fatal = false;
2317         uint unit;
2318         uint intstatus, idx;
2319         struct bcma_device *core = wlc_hw->d11core;
2320
2321         unit = wlc_hw->unit;
2322
2323         for (idx = 0; idx < NFIFO; idx++) {
2324                 /* read intstatus register and ignore any non-error bits */
2325                 intstatus =
2326                         bcma_read32(core,
2327                                     D11REGOFFS(intctrlregs[idx].intstatus)) &
2328                         I_ERRORS;
2329                 if (!intstatus)
2330                         continue;
2331
2332                 brcms_dbg_int(core, "wl%d: intstatus%d 0x%x\n",
2333                               unit, idx, intstatus);
2334
2335                 if (intstatus & I_RO) {
2336                         brcms_err(core, "wl%d: fifo %d: receive fifo "
2337                                   "overflow\n", unit, idx);
2338                         fatal = true;
2339                 }
2340
2341                 if (intstatus & I_PC) {
2342                         brcms_err(core, "wl%d: fifo %d: descriptor error\n",
2343                                   unit, idx);
2344                         fatal = true;
2345                 }
2346
2347                 if (intstatus & I_PD) {
2348                         brcms_err(core, "wl%d: fifo %d: data error\n", unit,
2349                                   idx);
2350                         fatal = true;
2351                 }
2352
2353                 if (intstatus & I_DE) {
2354                         brcms_err(core, "wl%d: fifo %d: descriptor protocol "
2355                                   "error\n", unit, idx);
2356                         fatal = true;
2357                 }
2358
2359                 if (intstatus & I_RU)
2360                         brcms_err(core, "wl%d: fifo %d: receive descriptor "
2361                                   "underflow\n", idx, unit);
2362
2363                 if (intstatus & I_XU) {
2364                         brcms_err(core, "wl%d: fifo %d: transmit fifo "
2365                                   "underflow\n", idx, unit);
2366                         fatal = true;
2367                 }
2368
2369                 if (fatal) {
2370                         brcms_fatal_error(wlc_hw->wlc->wl); /* big hammer */
2371                         break;
2372                 } else
2373                         bcma_write32(core,
2374                                      D11REGOFFS(intctrlregs[idx].intstatus),
2375                                      intstatus);
2376         }
2377 }
2378
2379 void brcms_c_intrson(struct brcms_c_info *wlc)
2380 {
2381         struct brcms_hardware *wlc_hw = wlc->hw;
2382         wlc->macintmask = wlc->defmacintmask;
2383         bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2384 }
2385
2386 u32 brcms_c_intrsoff(struct brcms_c_info *wlc)
2387 {
2388         struct brcms_hardware *wlc_hw = wlc->hw;
2389         u32 macintmask;
2390
2391         if (!wlc_hw->clk)
2392                 return 0;
2393
2394         macintmask = wlc->macintmask;   /* isr can still happen */
2395
2396         bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), 0);
2397         (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(macintmask));
2398         udelay(1);              /* ensure int line is no longer driven */
2399         wlc->macintmask = 0;
2400
2401         /* return previous macintmask; resolve race between us and our isr */
2402         return wlc->macintstatus ? 0 : macintmask;
2403 }
2404
2405 void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask)
2406 {
2407         struct brcms_hardware *wlc_hw = wlc->hw;
2408         if (!wlc_hw->clk)
2409                 return;
2410
2411         wlc->macintmask = macintmask;
2412         bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2413 }
2414
2415 /* assumes that the d11 MAC is enabled */
2416 static void brcms_b_tx_fifo_suspend(struct brcms_hardware *wlc_hw,
2417                                     uint tx_fifo)
2418 {
2419         u8 fifo = 1 << tx_fifo;
2420
2421         /* Two clients of this code, 11h Quiet period and scanning. */
2422
2423         /* only suspend if not already suspended */
2424         if ((wlc_hw->suspended_fifos & fifo) == fifo)
2425                 return;
2426
2427         /* force the core awake only if not already */
2428         if (wlc_hw->suspended_fifos == 0)
2429                 brcms_c_ucode_wake_override_set(wlc_hw,
2430                                                 BRCMS_WAKE_OVERRIDE_TXFIFO);
2431
2432         wlc_hw->suspended_fifos |= fifo;
2433
2434         if (wlc_hw->di[tx_fifo]) {
2435                 /*
2436                  * Suspending AMPDU transmissions in the middle can cause
2437                  * underflow which may result in mismatch between ucode and
2438                  * driver so suspend the mac before suspending the FIFO
2439                  */
2440                 if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2441                         brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
2442
2443                 dma_txsuspend(wlc_hw->di[tx_fifo]);
2444
2445                 if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2446                         brcms_c_enable_mac(wlc_hw->wlc);
2447         }
2448 }
2449
2450 static void brcms_b_tx_fifo_resume(struct brcms_hardware *wlc_hw,
2451                                    uint tx_fifo)
2452 {
2453         /* BMAC_NOTE: BRCMS_TX_FIFO_ENAB is done in brcms_c_dpc() for DMA case
2454          * but need to be done here for PIO otherwise the watchdog will catch
2455          * the inconsistency and fire
2456          */
2457         /* Two clients of this code, 11h Quiet period and scanning. */
2458         if (wlc_hw->di[tx_fifo])
2459                 dma_txresume(wlc_hw->di[tx_fifo]);
2460
2461         /* allow core to sleep again */
2462         if (wlc_hw->suspended_fifos == 0)
2463                 return;
2464         else {
2465                 wlc_hw->suspended_fifos &= ~(1 << tx_fifo);
2466                 if (wlc_hw->suspended_fifos == 0)
2467                         brcms_c_ucode_wake_override_clear(wlc_hw,
2468                                                 BRCMS_WAKE_OVERRIDE_TXFIFO);
2469         }
2470 }
2471
2472 /* precondition: requires the mac core to be enabled */
2473 static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
2474 {
2475         static const u8 null_ether_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
2476
2477         if (mute_tx) {
2478                 /* suspend tx fifos */
2479                 brcms_b_tx_fifo_suspend(wlc_hw, TX_DATA_FIFO);
2480                 brcms_b_tx_fifo_suspend(wlc_hw, TX_CTL_FIFO);
2481                 brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_BK_FIFO);
2482                 brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_VI_FIFO);
2483
2484                 /* zero the address match register so we do not send ACKs */
2485                 brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET,
2486                                        null_ether_addr);
2487         } else {
2488                 /* resume tx fifos */
2489                 brcms_b_tx_fifo_resume(wlc_hw, TX_DATA_FIFO);
2490                 brcms_b_tx_fifo_resume(wlc_hw, TX_CTL_FIFO);
2491                 brcms_b_tx_fifo_resume(wlc_hw, TX_AC_BK_FIFO);
2492                 brcms_b_tx_fifo_resume(wlc_hw, TX_AC_VI_FIFO);
2493
2494                 /* Restore address */
2495                 brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET,
2496                                        wlc_hw->etheraddr);
2497         }
2498
2499         wlc_phy_mute_upd(wlc_hw->band->pi, mute_tx, 0);
2500
2501         if (mute_tx)
2502                 brcms_c_ucode_mute_override_set(wlc_hw);
2503         else
2504                 brcms_c_ucode_mute_override_clear(wlc_hw);
2505 }
2506
2507 void
2508 brcms_c_mute(struct brcms_c_info *wlc, bool mute_tx)
2509 {
2510         brcms_b_mute(wlc->hw, mute_tx);
2511 }
2512
2513 /*
2514  * Read and clear macintmask and macintstatus and intstatus registers.
2515  * This routine should be called with interrupts off
2516  * Return:
2517  *   -1 if brcms_deviceremoved(wlc) evaluates to true;
2518  *   0 if the interrupt is not for us, or we are in some special cases;
2519  *   device interrupt status bits otherwise.
2520  */
2521 static inline u32 wlc_intstatus(struct brcms_c_info *wlc, bool in_isr)
2522 {
2523         struct brcms_hardware *wlc_hw = wlc->hw;
2524         struct bcma_device *core = wlc_hw->d11core;
2525         u32 macintstatus, mask;
2526
2527         /* macintstatus includes a DMA interrupt summary bit */
2528         macintstatus = bcma_read32(core, D11REGOFFS(macintstatus));
2529         mask = in_isr ? wlc->macintmask : wlc->defmacintmask;
2530
2531         trace_brcms_macintstatus(&core->dev, in_isr, macintstatus, mask);
2532
2533         /* detect cardbus removed, in power down(suspend) and in reset */
2534         if (brcms_deviceremoved(wlc))
2535                 return -1;
2536
2537         /* brcms_deviceremoved() succeeds even when the core is still resetting,
2538          * handle that case here.
2539          */
2540         if (macintstatus == 0xffffffff)
2541                 return 0;
2542
2543         /* defer unsolicited interrupts */
2544         macintstatus &= mask;
2545
2546         /* if not for us */
2547         if (macintstatus == 0)
2548                 return 0;
2549
2550         /* turn off the interrupts */
2551         bcma_write32(core, D11REGOFFS(macintmask), 0);
2552         (void)bcma_read32(core, D11REGOFFS(macintmask));
2553         wlc->macintmask = 0;
2554
2555         /* clear device interrupts */
2556         bcma_write32(core, D11REGOFFS(macintstatus), macintstatus);
2557
2558         /* MI_DMAINT is indication of non-zero intstatus */
2559         if (macintstatus & MI_DMAINT)
2560                 /*
2561                  * only fifo interrupt enabled is I_RI in
2562                  * RX_FIFO. If MI_DMAINT is set, assume it
2563                  * is set and clear the interrupt.
2564                  */
2565                 bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intstatus),
2566                              DEF_RXINTMASK);
2567
2568         return macintstatus;
2569 }
2570
2571 /* Update wlc->macintstatus and wlc->intstatus[]. */
2572 /* Return true if they are updated successfully. false otherwise */
2573 bool brcms_c_intrsupd(struct brcms_c_info *wlc)
2574 {
2575         u32 macintstatus;
2576
2577         /* read and clear macintstatus and intstatus registers */
2578         macintstatus = wlc_intstatus(wlc, false);
2579
2580         /* device is removed */
2581         if (macintstatus == 0xffffffff)
2582                 return false;
2583
2584         /* update interrupt status in software */
2585         wlc->macintstatus |= macintstatus;
2586
2587         return true;
2588 }
2589
2590 /*
2591  * First-level interrupt processing.
2592  * Return true if this was our interrupt
2593  * and if further brcms_c_dpc() processing is required,
2594  * false otherwise.
2595  */
2596 bool brcms_c_isr(struct brcms_c_info *wlc)
2597 {
2598         struct brcms_hardware *wlc_hw = wlc->hw;
2599         u32 macintstatus;
2600
2601         if (!wlc_hw->up || !wlc->macintmask)
2602                 return false;
2603
2604         /* read and clear macintstatus and intstatus registers */
2605         macintstatus = wlc_intstatus(wlc, true);
2606
2607         if (macintstatus == 0xffffffff) {
2608                 brcms_err(wlc_hw->d11core,
2609                           "DEVICEREMOVED detected in the ISR code path\n");
2610                 return false;
2611         }
2612
2613         /* it is not for us */
2614         if (macintstatus == 0)
2615                 return false;
2616
2617         /* save interrupt status bits */
2618         wlc->macintstatus = macintstatus;
2619
2620         return true;
2621
2622 }
2623
2624 void brcms_c_suspend_mac_and_wait(struct brcms_c_info *wlc)
2625 {
2626         struct brcms_hardware *wlc_hw = wlc->hw;
2627         struct bcma_device *core = wlc_hw->d11core;
2628         u32 mc, mi;
2629
2630         brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2631                            wlc_hw->band->bandunit);
2632
2633         /*
2634          * Track overlapping suspend requests
2635          */
2636         wlc_hw->mac_suspend_depth++;
2637         if (wlc_hw->mac_suspend_depth > 1)
2638                 return;
2639
2640         /* force the core awake */
2641         brcms_c_ucode_wake_override_set(wlc_hw, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2642
2643         mc = bcma_read32(core, D11REGOFFS(maccontrol));
2644
2645         if (mc == 0xffffffff) {
2646                 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2647                           __func__);
2648                 brcms_down(wlc->wl);
2649                 return;
2650         }
2651         WARN_ON(mc & MCTL_PSM_JMP_0);
2652         WARN_ON(!(mc & MCTL_PSM_RUN));
2653         WARN_ON(!(mc & MCTL_EN_MAC));
2654
2655         mi = bcma_read32(core, D11REGOFFS(macintstatus));
2656         if (mi == 0xffffffff) {
2657                 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2658                           __func__);
2659                 brcms_down(wlc->wl);
2660                 return;
2661         }
2662         WARN_ON(mi & MI_MACSSPNDD);
2663
2664         brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, 0);
2665
2666         SPINWAIT(!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD),
2667                  BRCMS_MAX_MAC_SUSPEND);
2668
2669         if (!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD)) {
2670                 brcms_err(core, "wl%d: wlc_suspend_mac_and_wait: waited %d uS"
2671                           " and MI_MACSSPNDD is still not on.\n",
2672                           wlc_hw->unit, BRCMS_MAX_MAC_SUSPEND);
2673                 brcms_err(core, "wl%d: psmdebug 0x%08x, phydebug 0x%08x, "
2674                           "psm_brc 0x%04x\n", wlc_hw->unit,
2675                           bcma_read32(core, D11REGOFFS(psmdebug)),
2676                           bcma_read32(core, D11REGOFFS(phydebug)),
2677                           bcma_read16(core, D11REGOFFS(psm_brc)));
2678         }
2679
2680         mc = bcma_read32(core, D11REGOFFS(maccontrol));
2681         if (mc == 0xffffffff) {
2682                 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2683                           __func__);
2684                 brcms_down(wlc->wl);
2685                 return;
2686         }
2687         WARN_ON(mc & MCTL_PSM_JMP_0);
2688         WARN_ON(!(mc & MCTL_PSM_RUN));
2689         WARN_ON(mc & MCTL_EN_MAC);
2690 }
2691
2692 void brcms_c_enable_mac(struct brcms_c_info *wlc)
2693 {
2694         struct brcms_hardware *wlc_hw = wlc->hw;
2695         struct bcma_device *core = wlc_hw->d11core;
2696         u32 mc, mi;
2697
2698         brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2699                            wlc->band->bandunit);
2700
2701         /*
2702          * Track overlapping suspend requests
2703          */
2704         wlc_hw->mac_suspend_depth--;
2705         if (wlc_hw->mac_suspend_depth > 0)
2706                 return;
2707
2708         mc = bcma_read32(core, D11REGOFFS(maccontrol));
2709         WARN_ON(mc & MCTL_PSM_JMP_0);
2710         WARN_ON(mc & MCTL_EN_MAC);
2711         WARN_ON(!(mc & MCTL_PSM_RUN));
2712
2713         brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, MCTL_EN_MAC);
2714         bcma_write32(core, D11REGOFFS(macintstatus), MI_MACSSPNDD);
2715
2716         mc = bcma_read32(core, D11REGOFFS(maccontrol));
2717         WARN_ON(mc & MCTL_PSM_JMP_0);
2718         WARN_ON(!(mc & MCTL_EN_MAC));
2719         WARN_ON(!(mc & MCTL_PSM_RUN));
2720
2721         mi = bcma_read32(core, D11REGOFFS(macintstatus));
2722         WARN_ON(mi & MI_MACSSPNDD);
2723
2724         brcms_c_ucode_wake_override_clear(wlc_hw,
2725                                           BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2726 }
2727
2728 void brcms_b_band_stf_ss_set(struct brcms_hardware *wlc_hw, u8 stf_mode)
2729 {
2730         wlc_hw->hw_stf_ss_opmode = stf_mode;
2731
2732         if (wlc_hw->clk)
2733                 brcms_upd_ofdm_pctl1_table(wlc_hw);
2734 }
2735
2736 static bool brcms_b_validate_chip_access(struct brcms_hardware *wlc_hw)
2737 {
2738         struct bcma_device *core = wlc_hw->d11core;
2739         u32 w, val;
2740         struct wiphy *wiphy = wlc_hw->wlc->wiphy;
2741
2742         /* Validate dchip register access */
2743
2744         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2745         (void)bcma_read32(core, D11REGOFFS(objaddr));
2746         w = bcma_read32(core, D11REGOFFS(objdata));
2747
2748         /* Can we write and read back a 32bit register? */
2749         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2750         (void)bcma_read32(core, D11REGOFFS(objaddr));
2751         bcma_write32(core, D11REGOFFS(objdata), (u32) 0xaa5555aa);
2752
2753         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2754         (void)bcma_read32(core, D11REGOFFS(objaddr));
2755         val = bcma_read32(core, D11REGOFFS(objdata));
2756         if (val != (u32) 0xaa5555aa) {
2757                 wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2758                           "expected 0xaa5555aa\n", wlc_hw->unit, val);
2759                 return false;
2760         }
2761
2762         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2763         (void)bcma_read32(core, D11REGOFFS(objaddr));
2764         bcma_write32(core, D11REGOFFS(objdata), (u32) 0x55aaaa55);
2765
2766         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2767         (void)bcma_read32(core, D11REGOFFS(objaddr));
2768         val = bcma_read32(core, D11REGOFFS(objdata));
2769         if (val != (u32) 0x55aaaa55) {
2770                 wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2771                           "expected 0x55aaaa55\n", wlc_hw->unit, val);
2772                 return false;
2773         }
2774
2775         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2776         (void)bcma_read32(core, D11REGOFFS(objaddr));
2777         bcma_write32(core, D11REGOFFS(objdata), w);
2778
2779         /* clear CFPStart */
2780         bcma_write32(core, D11REGOFFS(tsf_cfpstart), 0);
2781
2782         w = bcma_read32(core, D11REGOFFS(maccontrol));
2783         if ((w != (MCTL_IHR_EN | MCTL_WAKE)) &&
2784             (w != (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE))) {
2785                 wiphy_err(wiphy, "wl%d: validate_chip_access: maccontrol = "
2786                           "0x%x, expected 0x%x or 0x%x\n", wlc_hw->unit, w,
2787                           (MCTL_IHR_EN | MCTL_WAKE),
2788                           (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE));
2789                 return false;
2790         }
2791
2792         return true;
2793 }
2794
2795 #define PHYPLL_WAIT_US  100000
2796
2797 void brcms_b_core_phypll_ctl(struct brcms_hardware *wlc_hw, bool on)
2798 {
2799         struct bcma_device *core = wlc_hw->d11core;
2800         u32 tmp;
2801
2802         brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
2803
2804         tmp = 0;
2805
2806         if (on) {
2807                 if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
2808                         bcma_set32(core, D11REGOFFS(clk_ctl_st),
2809                                    CCS_ERSRC_REQ_HT |
2810                                    CCS_ERSRC_REQ_D11PLL |
2811                                    CCS_ERSRC_REQ_PHYPLL);
2812                         SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2813                                   CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT,
2814                                  PHYPLL_WAIT_US);
2815
2816                         tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2817                         if ((tmp & CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT)
2818                                 brcms_err(core, "%s: turn on PHY PLL failed\n",
2819                                           __func__);
2820                 } else {
2821                         bcma_set32(core, D11REGOFFS(clk_ctl_st),
2822                                    tmp | CCS_ERSRC_REQ_D11PLL |
2823                                    CCS_ERSRC_REQ_PHYPLL);
2824                         SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2825                                   (CCS_ERSRC_AVAIL_D11PLL |
2826                                    CCS_ERSRC_AVAIL_PHYPLL)) !=
2827                                  (CCS_ERSRC_AVAIL_D11PLL |
2828                                   CCS_ERSRC_AVAIL_PHYPLL), PHYPLL_WAIT_US);
2829
2830                         tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2831                         if ((tmp &
2832                              (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2833                             !=
2834                             (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2835                                 brcms_err(core, "%s: turn on PHY PLL failed\n",
2836                                           __func__);
2837                 }
2838         } else {
2839                 /*
2840                  * Since the PLL may be shared, other cores can still
2841                  * be requesting it; so we'll deassert the request but
2842                  * not wait for status to comply.
2843                  */
2844                 bcma_mask32(core, D11REGOFFS(clk_ctl_st),
2845                             ~CCS_ERSRC_REQ_PHYPLL);
2846                 (void)bcma_read32(core, D11REGOFFS(clk_ctl_st));
2847         }
2848 }
2849
2850 static void brcms_c_coredisable(struct brcms_hardware *wlc_hw)
2851 {
2852         bool dev_gone;
2853
2854         brcms_dbg_info(wlc_hw->d11core, "wl%d: disable core\n", wlc_hw->unit);
2855
2856         dev_gone = brcms_deviceremoved(wlc_hw->wlc);
2857
2858         if (dev_gone)
2859                 return;
2860
2861         if (wlc_hw->noreset)
2862                 return;
2863
2864         /* radio off */
2865         wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
2866
2867         /* turn off analog core */
2868         wlc_phy_anacore(wlc_hw->band->pi, OFF);
2869
2870         /* turn off PHYPLL to save power */
2871         brcms_b_core_phypll_ctl(wlc_hw, false);
2872
2873         wlc_hw->clk = false;
2874         bcma_core_disable(wlc_hw->d11core, 0);
2875         wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
2876 }
2877
2878 static void brcms_c_flushqueues(struct brcms_c_info *wlc)
2879 {
2880         struct brcms_hardware *wlc_hw = wlc->hw;
2881         uint i;
2882
2883         /* free any posted tx packets */
2884         for (i = 0; i < NFIFO; i++) {
2885                 if (wlc_hw->di[i]) {
2886                         dma_txreclaim(wlc_hw->di[i], DMA_RANGE_ALL);
2887                         if (i < TX_BCMC_FIFO)
2888                                 ieee80211_wake_queue(wlc->pub->ieee_hw,
2889                                                      brcms_fifo_to_ac(i));
2890                 }
2891         }
2892
2893         /* free any posted rx packets */
2894         dma_rxreclaim(wlc_hw->di[RX_FIFO]);
2895 }
2896
2897 static u16
2898 brcms_b_read_objmem(struct brcms_hardware *wlc_hw, uint offset, u32 sel)
2899 {
2900         struct bcma_device *core = wlc_hw->d11core;
2901         u16 objoff = D11REGOFFS(objdata);
2902
2903         bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2904         (void)bcma_read32(core, D11REGOFFS(objaddr));
2905         if (offset & 2)
2906                 objoff += 2;
2907
2908         return bcma_read16(core, objoff);
2909 }
2910
2911 static void
2912 brcms_b_write_objmem(struct brcms_hardware *wlc_hw, uint offset, u16 v,
2913                      u32 sel)
2914 {
2915         struct bcma_device *core = wlc_hw->d11core;
2916         u16 objoff = D11REGOFFS(objdata);
2917
2918         bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2919         (void)bcma_read32(core, D11REGOFFS(objaddr));
2920         if (offset & 2)
2921                 objoff += 2;
2922
2923         bcma_write16(core, objoff, v);
2924 }
2925
2926 /*
2927  * Read a single u16 from shared memory.
2928  * SHM 'offset' needs to be an even address
2929  */
2930 u16 brcms_b_read_shm(struct brcms_hardware *wlc_hw, uint offset)
2931 {
2932         return brcms_b_read_objmem(wlc_hw, offset, OBJADDR_SHM_SEL);
2933 }
2934
2935 /*
2936  * Write a single u16 to shared memory.
2937  * SHM 'offset' needs to be an even address
2938  */
2939 void brcms_b_write_shm(struct brcms_hardware *wlc_hw, uint offset, u16 v)
2940 {
2941         brcms_b_write_objmem(wlc_hw, offset, v, OBJADDR_SHM_SEL);
2942 }
2943
2944 /*
2945  * Copy a buffer to shared memory of specified type .
2946  * SHM 'offset' needs to be an even address and
2947  * Buffer length 'len' must be an even number of bytes
2948  * 'sel' selects the type of memory
2949  */
2950 void
2951 brcms_b_copyto_objmem(struct brcms_hardware *wlc_hw, uint offset,
2952                       const void *buf, int len, u32 sel)
2953 {
2954         u16 v;
2955         const u8 *p = (const u8 *)buf;
2956         int i;
2957
2958         if (len <= 0 || (offset & 1) || (len & 1))
2959                 return;
2960
2961         for (i = 0; i < len; i += 2) {
2962                 v = p[i] | (p[i + 1] << 8);
2963                 brcms_b_write_objmem(wlc_hw, offset + i, v, sel);
2964         }
2965 }
2966
2967 /*
2968  * Copy a piece of shared memory of specified type to a buffer .
2969  * SHM 'offset' needs to be an even address and
2970  * Buffer length 'len' must be an even number of bytes
2971  * 'sel' selects the type of memory
2972  */
2973 void
2974 brcms_b_copyfrom_objmem(struct brcms_hardware *wlc_hw, uint offset, void *buf,
2975                          int len, u32 sel)
2976 {
2977         u16 v;
2978         u8 *p = (u8 *) buf;
2979         int i;
2980
2981         if (len <= 0 || (offset & 1) || (len & 1))
2982                 return;
2983
2984         for (i = 0; i < len; i += 2) {
2985                 v = brcms_b_read_objmem(wlc_hw, offset + i, sel);
2986                 p[i] = v & 0xFF;
2987                 p[i + 1] = (v >> 8) & 0xFF;
2988         }
2989 }
2990
2991 /* Copy a buffer to shared memory.
2992  * SHM 'offset' needs to be an even address and
2993  * Buffer length 'len' must be an even number of bytes
2994  */
2995 static void brcms_c_copyto_shm(struct brcms_c_info *wlc, uint offset,
2996                         const void *buf, int len)
2997 {
2998         brcms_b_copyto_objmem(wlc->hw, offset, buf, len, OBJADDR_SHM_SEL);
2999 }
3000
3001 static void brcms_b_retrylimit_upd(struct brcms_hardware *wlc_hw,
3002                                    u16 SRL, u16 LRL)
3003 {
3004         wlc_hw->SRL = SRL;
3005         wlc_hw->LRL = LRL;
3006
3007         /* write retry limit to SCR, shouldn't need to suspend */
3008         if (wlc_hw->up) {
3009                 bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3010                              OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3011                 (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3012                 bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->SRL);
3013                 bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3014                              OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3015                 (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3016                 bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->LRL);
3017         }
3018 }
3019
3020 static void brcms_b_pllreq(struct brcms_hardware *wlc_hw, bool set, u32 req_bit)
3021 {
3022         if (set) {
3023                 if (mboolisset(wlc_hw->pllreq, req_bit))
3024                         return;
3025
3026                 mboolset(wlc_hw->pllreq, req_bit);
3027
3028                 if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3029                         if (!wlc_hw->sbclk)
3030                                 brcms_b_xtal(wlc_hw, ON);
3031                 }
3032         } else {
3033                 if (!mboolisset(wlc_hw->pllreq, req_bit))
3034                         return;
3035
3036                 mboolclr(wlc_hw->pllreq, req_bit);
3037
3038                 if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3039                         if (wlc_hw->sbclk)
3040                                 brcms_b_xtal(wlc_hw, OFF);
3041                 }
3042         }
3043 }
3044
3045 static void brcms_b_antsel_set(struct brcms_hardware *wlc_hw, u32 antsel_avail)
3046 {
3047         wlc_hw->antsel_avail = antsel_avail;
3048 }
3049
3050 /*
3051  * conditions under which the PM bit should be set in outgoing frames
3052  * and STAY_AWAKE is meaningful
3053  */
3054 static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
3055 {
3056         struct brcms_bss_cfg *cfg = wlc->bsscfg;
3057
3058         /* disallow PS when one of the following global conditions meets */
3059         if (!wlc->pub->associated)
3060                 return false;
3061
3062         /* disallow PS when one of these meets when not scanning */
3063         if (wlc->filter_flags & FIF_PROMISC_IN_BSS)
3064                 return false;
3065
3066         if (cfg->associated) {
3067                 /*
3068                  * disallow PS when one of the following
3069                  * bsscfg specific conditions meets
3070                  */
3071                 if (!cfg->BSS)
3072                         return false;
3073
3074                 return false;
3075         }
3076
3077         return true;
3078 }
3079
3080 static void brcms_c_statsupd(struct brcms_c_info *wlc)
3081 {
3082         int i;
3083         struct macstat macstats;
3084 #ifdef DEBUG
3085         u16 delta;
3086         u16 rxf0ovfl;
3087         u16 txfunfl[NFIFO];
3088 #endif                          /* DEBUG */
3089
3090         /* if driver down, make no sense to update stats */
3091         if (!wlc->pub->up)
3092                 return;
3093
3094 #ifdef DEBUG
3095         /* save last rx fifo 0 overflow count */
3096         rxf0ovfl = wlc->core->macstat_snapshot->rxf0ovfl;
3097
3098         /* save last tx fifo  underflow count */
3099         for (i = 0; i < NFIFO; i++)
3100                 txfunfl[i] = wlc->core->macstat_snapshot->txfunfl[i];
3101 #endif                          /* DEBUG */
3102
3103         /* Read mac stats from contiguous shared memory */
3104         brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, &macstats,
3105                                 sizeof(struct macstat), OBJADDR_SHM_SEL);
3106
3107 #ifdef DEBUG
3108         /* check for rx fifo 0 overflow */
3109         delta = (u16) (wlc->core->macstat_snapshot->rxf0ovfl - rxf0ovfl);
3110         if (delta)
3111                 brcms_err(wlc->hw->d11core, "wl%d: %u rx fifo 0 overflows!\n",
3112                           wlc->pub->unit, delta);
3113
3114         /* check for tx fifo underflows */
3115         for (i = 0; i < NFIFO; i++) {
3116                 delta =
3117                     (u16) (wlc->core->macstat_snapshot->txfunfl[i] -
3118                               txfunfl[i]);
3119                 if (delta)
3120                         brcms_err(wlc->hw->d11core,
3121                                   "wl%d: %u tx fifo %d underflows!\n",
3122                                   wlc->pub->unit, delta, i);
3123         }
3124 #endif                          /* DEBUG */
3125
3126         /* merge counters from dma module */
3127         for (i = 0; i < NFIFO; i++) {
3128                 if (wlc->hw->di[i])
3129                         dma_counterreset(wlc->hw->di[i]);
3130         }
3131 }
3132
3133 static void brcms_b_reset(struct brcms_hardware *wlc_hw)
3134 {
3135         /* reset the core */
3136         if (!brcms_deviceremoved(wlc_hw->wlc))
3137                 brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
3138
3139         /* purge the dma rings */
3140         brcms_c_flushqueues(wlc_hw->wlc);
3141 }
3142
3143 void brcms_c_reset(struct brcms_c_info *wlc)
3144 {
3145         brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
3146
3147         /* slurp up hw mac counters before core reset */
3148         brcms_c_statsupd(wlc);
3149
3150         /* reset our snapshot of macstat counters */
3151         memset((char *)wlc->core->macstat_snapshot, 0,
3152                 sizeof(struct macstat));
3153
3154         brcms_b_reset(wlc->hw);
3155 }
3156
3157 void brcms_c_init_scb(struct scb *scb)
3158 {
3159         int i;
3160
3161         memset(scb, 0, sizeof(struct scb));
3162         scb->flags = SCB_WMECAP | SCB_HTCAP;
3163         for (i = 0; i < NUMPRIO; i++) {
3164                 scb->seqnum[i] = 0;
3165                 scb->seqctl[i] = 0xFFFF;
3166         }
3167
3168         scb->seqctl_nonqos = 0xFFFF;
3169         scb->magic = SCB_MAGIC;
3170 }
3171
3172 /* d11 core init
3173  *   reset PSM
3174  *   download ucode/PCM
3175  *   let ucode run to suspended
3176  *   download ucode inits
3177  *   config other core registers
3178  *   init dma
3179  */
3180 static void brcms_b_coreinit(struct brcms_c_info *wlc)
3181 {
3182         struct brcms_hardware *wlc_hw = wlc->hw;
3183         struct bcma_device *core = wlc_hw->d11core;
3184         u32 sflags;
3185         u32 bcnint_us;
3186         uint i = 0;
3187         bool fifosz_fixup = false;
3188         int err = 0;
3189         u16 buf[NFIFO];
3190         struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
3191
3192         brcms_dbg_info(core, "wl%d: core init\n", wlc_hw->unit);
3193
3194         /* reset PSM */
3195         brcms_b_mctrl(wlc_hw, ~0, (MCTL_IHR_EN | MCTL_PSM_JMP_0 | MCTL_WAKE));
3196
3197         brcms_ucode_download(wlc_hw);
3198         /*
3199          * FIFOSZ fixup. driver wants to controls the fifo allocation.
3200          */
3201         fifosz_fixup = true;
3202
3203         /* let the PSM run to the suspended state, set mode to BSS STA */
3204         bcma_write32(core, D11REGOFFS(macintstatus), -1);
3205         brcms_b_mctrl(wlc_hw, ~0,
3206                        (MCTL_IHR_EN | MCTL_INFRA | MCTL_PSM_RUN | MCTL_WAKE));
3207
3208         /* wait for ucode to self-suspend after auto-init */
3209         SPINWAIT(((bcma_read32(core, D11REGOFFS(macintstatus)) &
3210                    MI_MACSSPNDD) == 0), 1000 * 1000);
3211         if ((bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD) == 0)
3212                 brcms_err(core, "wl%d: wlc_coreinit: ucode did not self-"
3213                           "suspend!\n", wlc_hw->unit);
3214
3215         brcms_c_gpio_init(wlc);
3216
3217         sflags = bcma_aread32(core, BCMA_IOST);
3218
3219         if (D11REV_IS(wlc_hw->corerev, 23)) {
3220                 if (BRCMS_ISNPHY(wlc_hw->band))
3221                         brcms_c_write_inits(wlc_hw, ucode->d11n0initvals16);
3222                 else
3223                         brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3224                                   " %d\n", __func__, wlc_hw->unit,
3225                                   wlc_hw->corerev);
3226         } else if (D11REV_IS(wlc_hw->corerev, 24)) {
3227                 if (BRCMS_ISLCNPHY(wlc_hw->band))
3228                         brcms_c_write_inits(wlc_hw, ucode->d11lcn0initvals24);
3229                 else
3230                         brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3231                                   " %d\n", __func__, wlc_hw->unit,
3232                                   wlc_hw->corerev);
3233         } else {
3234                 brcms_err(core, "%s: wl%d: unsupported corerev %d\n",
3235                           __func__, wlc_hw->unit, wlc_hw->corerev);
3236         }
3237
3238         /* For old ucode, txfifo sizes needs to be modified(increased) */
3239         if (fifosz_fixup)
3240                 brcms_b_corerev_fifofixup(wlc_hw);
3241
3242         /* check txfifo allocations match between ucode and driver */
3243         buf[TX_AC_BE_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE0);
3244         if (buf[TX_AC_BE_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]) {
3245                 i = TX_AC_BE_FIFO;
3246                 err = -1;
3247         }
3248         buf[TX_AC_VI_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE1);
3249         if (buf[TX_AC_VI_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]) {
3250                 i = TX_AC_VI_FIFO;
3251                 err = -1;
3252         }
3253         buf[TX_AC_BK_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE2);
3254         buf[TX_AC_VO_FIFO] = (buf[TX_AC_BK_FIFO] >> 8) & 0xff;
3255         buf[TX_AC_BK_FIFO] &= 0xff;
3256         if (buf[TX_AC_BK_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BK_FIFO]) {
3257                 i = TX_AC_BK_FIFO;
3258                 err = -1;
3259         }
3260         if (buf[TX_AC_VO_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO]) {
3261                 i = TX_AC_VO_FIFO;
3262                 err = -1;
3263         }
3264         buf[TX_BCMC_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE3);
3265         buf[TX_ATIM_FIFO] = (buf[TX_BCMC_FIFO] >> 8) & 0xff;
3266         buf[TX_BCMC_FIFO] &= 0xff;
3267         if (buf[TX_BCMC_FIFO] != wlc_hw->xmtfifo_sz[TX_BCMC_FIFO]) {
3268                 i = TX_BCMC_FIFO;
3269                 err = -1;
3270         }
3271         if (buf[TX_ATIM_FIFO] != wlc_hw->xmtfifo_sz[TX_ATIM_FIFO]) {
3272                 i = TX_ATIM_FIFO;
3273                 err = -1;
3274         }
3275         if (err != 0)
3276                 brcms_err(core, "wlc_coreinit: txfifo mismatch: ucode size %d"
3277                           " driver size %d index %d\n", buf[i],
3278                           wlc_hw->xmtfifo_sz[i], i);
3279
3280         /* make sure we can still talk to the mac */
3281         WARN_ON(bcma_read32(core, D11REGOFFS(maccontrol)) == 0xffffffff);
3282
3283         /* band-specific inits done by wlc_bsinit() */
3284
3285         /* Set up frame burst size and antenna swap threshold init values */
3286         brcms_b_write_shm(wlc_hw, M_MBURST_SIZE, MAXTXFRAMEBURST);
3287         brcms_b_write_shm(wlc_hw, M_MAX_ANTCNT, ANTCNT);
3288
3289         /* enable one rx interrupt per received frame */
3290         bcma_write32(core, D11REGOFFS(intrcvlazy[0]), (1 << IRL_FC_SHIFT));
3291
3292         /* set the station mode (BSS STA) */
3293         brcms_b_mctrl(wlc_hw,
3294                        (MCTL_INFRA | MCTL_DISCARD_PMQ | MCTL_AP),
3295                        (MCTL_INFRA | MCTL_DISCARD_PMQ));
3296
3297         /* set up Beacon interval */
3298         bcnint_us = 0x8000 << 10;
3299         bcma_write32(core, D11REGOFFS(tsf_cfprep),
3300                      (bcnint_us << CFPREP_CBI_SHIFT));
3301         bcma_write32(core, D11REGOFFS(tsf_cfpstart), bcnint_us);
3302         bcma_write32(core, D11REGOFFS(macintstatus), MI_GP1);
3303
3304         /* write interrupt mask */
3305         bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intmask),
3306                      DEF_RXINTMASK);
3307
3308         /* allow the MAC to control the PHY clock (dynamic on/off) */
3309         brcms_b_macphyclk_set(wlc_hw, ON);
3310
3311         /* program dynamic clock control fast powerup delay register */
3312         wlc->fastpwrup_dly = ai_clkctl_fast_pwrup_delay(wlc_hw->sih);
3313         bcma_write16(core, D11REGOFFS(scc_fastpwrup_dly), wlc->fastpwrup_dly);
3314
3315         /* tell the ucode the corerev */
3316         brcms_b_write_shm(wlc_hw, M_MACHW_VER, (u16) wlc_hw->corerev);
3317
3318         /* tell the ucode MAC capabilities */
3319         brcms_b_write_shm(wlc_hw, M_MACHW_CAP_L,
3320                            (u16) (wlc_hw->machwcap & 0xffff));
3321         brcms_b_write_shm(wlc_hw, M_MACHW_CAP_H,
3322                            (u16) ((wlc_hw->
3323                                       machwcap >> 16) & 0xffff));
3324
3325         /* write retry limits to SCR, this done after PSM init */
3326         bcma_write32(core, D11REGOFFS(objaddr),
3327                      OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3328         (void)bcma_read32(core, D11REGOFFS(objaddr));
3329         bcma_write32(core, D11REGOFFS(objdata), wlc_hw->SRL);
3330         bcma_write32(core, D11REGOFFS(objaddr),
3331                      OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3332         (void)bcma_read32(core, D11REGOFFS(objaddr));
3333         bcma_write32(core, D11REGOFFS(objdata), wlc_hw->LRL);
3334
3335         /* write rate fallback retry limits */
3336         brcms_b_write_shm(wlc_hw, M_SFRMTXCNTFBRTHSD, wlc_hw->SFBL);
3337         brcms_b_write_shm(wlc_hw, M_LFRMTXCNTFBRTHSD, wlc_hw->LFBL);
3338
3339         bcma_mask16(core, D11REGOFFS(ifs_ctl), 0x0FFF);
3340         bcma_write16(core, D11REGOFFS(ifs_aifsn), EDCF_AIFSN_MIN);
3341
3342         /* init the tx dma engines */
3343         for (i = 0; i < NFIFO; i++) {
3344                 if (wlc_hw->di[i])
3345                         dma_txinit(wlc_hw->di[i]);
3346         }
3347
3348         /* init the rx dma engine(s) and post receive buffers */
3349         dma_rxinit(wlc_hw->di[RX_FIFO]);
3350         dma_rxfill(wlc_hw->di[RX_FIFO]);
3351 }
3352
3353 void
3354 static brcms_b_init(struct brcms_hardware *wlc_hw, u16 chanspec) {
3355         u32 macintmask;
3356         bool fastclk;
3357         struct brcms_c_info *wlc = wlc_hw->wlc;
3358
3359         /* request FAST clock if not on */
3360         fastclk = wlc_hw->forcefastclk;
3361         if (!fastclk)
3362                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
3363
3364         /* disable interrupts */
3365         macintmask = brcms_intrsoff(wlc->wl);
3366
3367         /* set up the specified band and chanspec */
3368         brcms_c_setxband(wlc_hw, chspec_bandunit(chanspec));
3369         wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3370
3371         /* do one-time phy inits and calibration */
3372         wlc_phy_cal_init(wlc_hw->band->pi);
3373
3374         /* core-specific initialization */
3375         brcms_b_coreinit(wlc);
3376
3377         /* band-specific inits */
3378         brcms_b_bsinit(wlc, chanspec);
3379
3380         /* restore macintmask */
3381         brcms_intrsrestore(wlc->wl, macintmask);
3382
3383         /* seed wake_override with BRCMS_WAKE_OVERRIDE_MACSUSPEND since the mac
3384          * is suspended and brcms_c_enable_mac() will clear this override bit.
3385          */
3386         mboolset(wlc_hw->wake_override, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
3387
3388         /*
3389          * initialize mac_suspend_depth to 1 to match ucode
3390          * initial suspended state
3391          */
3392         wlc_hw->mac_suspend_depth = 1;
3393
3394         /* restore the clk */
3395         if (!fastclk)
3396                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
3397 }
3398
3399 static void brcms_c_set_phy_chanspec(struct brcms_c_info *wlc,
3400                                      u16 chanspec)
3401 {
3402         /* Save our copy of the chanspec */
3403         wlc->chanspec = chanspec;
3404
3405         /* Set the chanspec and power limits for this locale */
3406         brcms_c_channel_set_chanspec(wlc->cmi, chanspec, BRCMS_TXPWR_MAX);
3407
3408         if (wlc->stf->ss_algosel_auto)
3409                 brcms_c_stf_ss_algo_channel_get(wlc, &wlc->stf->ss_algo_channel,
3410                                             chanspec);
3411
3412         brcms_c_stf_ss_update(wlc, wlc->band);
3413 }
3414
3415 static void
3416 brcms_default_rateset(struct brcms_c_info *wlc, struct brcms_c_rateset *rs)
3417 {
3418         brcms_c_rateset_default(rs, NULL, wlc->band->phytype,
3419                 wlc->band->bandtype, false, BRCMS_RATE_MASK_FULL,
3420                 (bool) (wlc->pub->_n_enab & SUPPORT_11N),
3421                 brcms_chspec_bw(wlc->default_bss->chanspec),
3422                 wlc->stf->txstreams);
3423 }
3424
3425 /* derive wlc->band->basic_rate[] table from 'rateset' */
3426 static void brcms_c_rate_lookup_init(struct brcms_c_info *wlc,
3427                               struct brcms_c_rateset *rateset)
3428 {
3429         u8 rate;
3430         u8 mandatory;
3431         u8 cck_basic = 0;
3432         u8 ofdm_basic = 0;
3433         u8 *br = wlc->band->basic_rate;
3434         uint i;
3435
3436         /* incoming rates are in 500kbps units as in 802.11 Supported Rates */
3437         memset(br, 0, BRCM_MAXRATE + 1);
3438
3439         /* For each basic rate in the rates list, make an entry in the
3440          * best basic lookup.
3441          */
3442         for (i = 0; i < rateset->count; i++) {
3443                 /* only make an entry for a basic rate */
3444                 if (!(rateset->rates[i] & BRCMS_RATE_FLAG))
3445                         continue;
3446
3447                 /* mask off basic bit */
3448                 rate = (rateset->rates[i] & BRCMS_RATE_MASK);
3449
3450                 if (rate > BRCM_MAXRATE) {
3451                         brcms_err(wlc->hw->d11core, "brcms_c_rate_lookup_init: "
3452                                   "invalid rate 0x%X in rate set\n",
3453                                   rateset->rates[i]);
3454                         continue;
3455                 }
3456
3457                 br[rate] = rate;
3458         }
3459
3460         /* The rate lookup table now has non-zero entries for each
3461          * basic rate, equal to the basic rate: br[basicN] = basicN
3462          *
3463          * To look up the best basic rate corresponding to any
3464          * particular rate, code can use the basic_rate table
3465          * like this
3466          *
3467          * basic_rate = wlc->band->basic_rate[tx_rate]
3468          *
3469          * Make sure there is a best basic rate entry for
3470          * every rate by walking up the table from low rates
3471          * to high, filling in holes in the lookup table
3472          */
3473
3474         for (i = 0; i < wlc->band->hw_rateset.count; i++) {
3475                 rate = wlc->band->hw_rateset.rates[i];
3476
3477                 if (br[rate] != 0) {
3478                         /* This rate is a basic rate.
3479                          * Keep track of the best basic rate so far by
3480                          * modulation type.
3481                          */
3482                         if (is_ofdm_rate(rate))
3483                                 ofdm_basic = rate;
3484                         else
3485                                 cck_basic = rate;
3486
3487                         continue;
3488                 }
3489
3490                 /* This rate is not a basic rate so figure out the
3491                  * best basic rate less than this rate and fill in
3492                  * the hole in the table
3493                  */
3494
3495                 br[rate] = is_ofdm_rate(rate) ? ofdm_basic : cck_basic;
3496
3497                 if (br[rate] != 0)
3498                         continue;
3499
3500                 if (is_ofdm_rate(rate)) {
3501                         /*
3502                          * In 11g and 11a, the OFDM mandatory rates
3503                          * are 6, 12, and 24 Mbps
3504                          */
3505                         if (rate >= BRCM_RATE_24M)
3506                                 mandatory = BRCM_RATE_24M;
3507                         else if (rate >= BRCM_RATE_12M)
3508                                 mandatory = BRCM_RATE_12M;
3509                         else
3510                                 mandatory = BRCM_RATE_6M;
3511                 } else {
3512                         /* In 11b, all CCK rates are mandatory 1 - 11 Mbps */
3513                         mandatory = rate;
3514                 }
3515
3516                 br[rate] = mandatory;
3517         }
3518 }
3519
3520 static void brcms_c_bandinit_ordered(struct brcms_c_info *wlc,
3521                                      u16 chanspec)
3522 {
3523         struct brcms_c_rateset default_rateset;
3524         uint parkband;
3525         uint i, band_order[2];
3526
3527         /*
3528          * We might have been bandlocked during down and the chip
3529          * power-cycled (hibernate). Figure out the right band to park on
3530          */
3531         if (wlc->bandlocked || wlc->pub->_nbands == 1) {
3532                 /* updated in brcms_c_bandlock() */
3533                 parkband = wlc->band->bandunit;
3534                 band_order[0] = band_order[1] = parkband;
3535         } else {
3536                 /* park on the band of the specified chanspec */
3537                 parkband = chspec_bandunit(chanspec);
3538
3539                 /* order so that parkband initialize last */
3540                 band_order[0] = parkband ^ 1;
3541                 band_order[1] = parkband;
3542         }
3543
3544         /* make each band operational, software state init */
3545         for (i = 0; i < wlc->pub->_nbands; i++) {
3546                 uint j = band_order[i];
3547
3548                 wlc->band = wlc->bandstate[j];
3549
3550                 brcms_default_rateset(wlc, &default_rateset);
3551
3552                 /* fill in hw_rate */
3553                 brcms_c_rateset_filter(&default_rateset, &wlc->band->hw_rateset,
3554                                    false, BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
3555                                    (bool) (wlc->pub->_n_enab & SUPPORT_11N));
3556
3557                 /* init basic rate lookup */
3558                 brcms_c_rate_lookup_init(wlc, &default_rateset);
3559         }
3560
3561         /* sync up phy/radio chanspec */
3562         brcms_c_set_phy_chanspec(wlc, chanspec);
3563 }
3564
3565 /*
3566  * Set or clear filtering related maccontrol bits based on
3567  * specified filter flags
3568  */
3569 void brcms_c_mac_promisc(struct brcms_c_info *wlc, uint filter_flags)
3570 {
3571         u32 promisc_bits = 0;
3572
3573         wlc->filter_flags = filter_flags;
3574
3575         if (filter_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS))
3576                 promisc_bits |= MCTL_PROMISC;
3577
3578         if (filter_flags & FIF_BCN_PRBRESP_PROMISC)
3579                 promisc_bits |= MCTL_BCNS_PROMISC;
3580
3581         if (filter_flags & FIF_FCSFAIL)
3582                 promisc_bits |= MCTL_KEEPBADFCS;
3583
3584         if (filter_flags & (FIF_CONTROL | FIF_PSPOLL))
3585                 promisc_bits |= MCTL_KEEPCONTROL;
3586
3587         brcms_b_mctrl(wlc->hw,
3588                 MCTL_PROMISC | MCTL_BCNS_PROMISC |
3589                 MCTL_KEEPCONTROL | MCTL_KEEPBADFCS,
3590                 promisc_bits);
3591 }
3592
3593 /*
3594  * ucode, hwmac update
3595  *    Channel dependent updates for ucode and hw
3596  */
3597 static void brcms_c_ucode_mac_upd(struct brcms_c_info *wlc)
3598 {
3599         /* enable or disable any active IBSSs depending on whether or not
3600          * we are on the home channel
3601          */
3602         if (wlc->home_chanspec == wlc_phy_chanspec_get(wlc->band->pi)) {
3603                 if (wlc->pub->associated) {
3604                         /*
3605                          * BMAC_NOTE: This is something that should be fixed
3606                          * in ucode inits. I think that the ucode inits set
3607                          * up the bcn templates and shm values with a bogus
3608                          * beacon. This should not be done in the inits. If
3609                          * ucode needs to set up a beacon for testing, the
3610                          * test routines should write it down, not expect the
3611                          * inits to populate a bogus beacon.
3612                          */
3613                         if (BRCMS_PHY_11N_CAP(wlc->band))
3614                                 brcms_b_write_shm(wlc->hw,
3615                                                 M_BCN_TXTSF_OFFSET, 0);
3616                 }
3617         } else {
3618                 /* disable an active IBSS if we are not on the home channel */
3619         }
3620 }
3621
3622 static void brcms_c_write_rate_shm(struct brcms_c_info *wlc, u8 rate,
3623                                    u8 basic_rate)
3624 {
3625         u8 phy_rate, index;
3626         u8 basic_phy_rate, basic_index;
3627         u16 dir_table, basic_table;
3628         u16 basic_ptr;
3629
3630         /* Shared memory address for the table we are reading */
3631         dir_table = is_ofdm_rate(basic_rate) ? M_RT_DIRMAP_A : M_RT_DIRMAP_B;
3632
3633         /* Shared memory address for the table we are writing */
3634         basic_table = is_ofdm_rate(rate) ? M_RT_BBRSMAP_A : M_RT_BBRSMAP_B;
3635
3636         /*
3637          * for a given rate, the LS-nibble of the PLCP SIGNAL field is
3638          * the index into the rate table.
3639          */
3640         phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
3641         basic_phy_rate = rate_info[basic_rate] & BRCMS_RATE_MASK;
3642         index = phy_rate & 0xf;
3643         basic_index = basic_phy_rate & 0xf;
3644
3645         /* Find the SHM pointer to the ACK rate entry by looking in the
3646          * Direct-map Table
3647          */
3648         basic_ptr = brcms_b_read_shm(wlc->hw, (dir_table + basic_index * 2));
3649
3650         /* Update the SHM BSS-basic-rate-set mapping table with the pointer
3651          * to the correct basic rate for the given incoming rate
3652          */
3653         brcms_b_write_shm(wlc->hw, (basic_table + index * 2), basic_ptr);
3654 }
3655
3656 static const struct brcms_c_rateset *
3657 brcms_c_rateset_get_hwrs(struct brcms_c_info *wlc)
3658 {
3659         const struct brcms_c_rateset *rs_dflt;
3660
3661         if (BRCMS_PHY_11N_CAP(wlc->band)) {
3662                 if (wlc->band->bandtype == BRCM_BAND_5G)
3663                         rs_dflt = &ofdm_mimo_rates;
3664                 else
3665                         rs_dflt = &cck_ofdm_mimo_rates;
3666         } else if (wlc->band->gmode)
3667                 rs_dflt = &cck_ofdm_rates;
3668         else
3669                 rs_dflt = &cck_rates;
3670
3671         return rs_dflt;
3672 }
3673
3674 static void brcms_c_set_ratetable(struct brcms_c_info *wlc)
3675 {
3676         const struct brcms_c_rateset *rs_dflt;
3677         struct brcms_c_rateset rs;
3678         u8 rate, basic_rate;
3679         uint i;
3680
3681         rs_dflt = brcms_c_rateset_get_hwrs(wlc);
3682
3683         brcms_c_rateset_copy(rs_dflt, &rs);
3684         brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
3685
3686         /* walk the phy rate table and update SHM basic rate lookup table */
3687         for (i = 0; i < rs.count; i++) {
3688                 rate = rs.rates[i] & BRCMS_RATE_MASK;
3689
3690                 /* for a given rate brcms_basic_rate returns the rate at
3691                  * which a response ACK/CTS should be sent.
3692                  */
3693                 basic_rate = brcms_basic_rate(wlc, rate);
3694                 if (basic_rate == 0)
3695                         /* This should only happen if we are using a
3696                          * restricted rateset.
3697                          */
3698                         basic_rate = rs.rates[0] & BRCMS_RATE_MASK;
3699
3700                 brcms_c_write_rate_shm(wlc, rate, basic_rate);
3701         }
3702 }
3703
3704 /* band-specific init */
3705 static void brcms_c_bsinit(struct brcms_c_info *wlc)
3706 {
3707         brcms_dbg_info(wlc->hw->d11core, "wl%d: bandunit %d\n",
3708                        wlc->pub->unit, wlc->band->bandunit);
3709
3710         /* write ucode ACK/CTS rate table */
3711         brcms_c_set_ratetable(wlc);
3712
3713         /* update some band specific mac configuration */
3714         brcms_c_ucode_mac_upd(wlc);
3715
3716         /* init antenna selection */
3717         brcms_c_antsel_init(wlc->asi);
3718
3719 }
3720
3721 /* formula:  IDLE_BUSY_RATIO_X_16 = (100-duty_cycle)/duty_cycle*16 */
3722 static int
3723 brcms_c_duty_cycle_set(struct brcms_c_info *wlc, int duty_cycle, bool isOFDM,
3724                    bool writeToShm)
3725 {
3726         int idle_busy_ratio_x_16 = 0;
3727         uint offset =
3728             isOFDM ? M_TX_IDLE_BUSY_RATIO_X_16_OFDM :
3729             M_TX_IDLE_BUSY_RATIO_X_16_CCK;
3730         if (duty_cycle > 100 || duty_cycle < 0) {
3731                 brcms_err(wlc->hw->d11core,
3732                           "wl%d:  duty cycle value off limit\n",
3733                           wlc->pub->unit);
3734                 return -EINVAL;
3735         }
3736         if (duty_cycle)
3737                 idle_busy_ratio_x_16 = (100 - duty_cycle) * 16 / duty_cycle;
3738         /* Only write to shared memory  when wl is up */
3739         if (writeToShm)
3740                 brcms_b_write_shm(wlc->hw, offset, (u16) idle_busy_ratio_x_16);
3741
3742         if (isOFDM)
3743                 wlc->tx_duty_cycle_ofdm = (u16) duty_cycle;
3744         else
3745                 wlc->tx_duty_cycle_cck = (u16) duty_cycle;
3746
3747         return 0;
3748 }
3749
3750 /* push sw hps and wake state through hardware */
3751 static void brcms_c_set_ps_ctrl(struct brcms_c_info *wlc)
3752 {
3753         u32 v1, v2;
3754         bool hps;
3755         bool awake_before;
3756
3757         hps = brcms_c_ps_allowed(wlc);
3758
3759         brcms_dbg_mac80211(wlc->hw->d11core, "wl%d: hps %d\n", wlc->pub->unit,
3760                            hps);
3761
3762         v1 = bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
3763         v2 = MCTL_WAKE;
3764         if (hps)
3765                 v2 |= MCTL_HPS;
3766
3767         brcms_b_mctrl(wlc->hw, MCTL_WAKE | MCTL_HPS, v2);
3768
3769         awake_before = ((v1 & MCTL_WAKE) || ((v1 & MCTL_HPS) == 0));
3770
3771         if (!awake_before)
3772                 brcms_b_wait_for_wake(wlc->hw);
3773 }
3774
3775 /*
3776  * Write this BSS config's MAC address to core.
3777  * Updates RXE match engine.
3778  */
3779 static int brcms_c_set_mac(struct brcms_bss_cfg *bsscfg)
3780 {
3781         int err = 0;
3782         struct brcms_c_info *wlc = bsscfg->wlc;
3783
3784         /* enter the MAC addr into the RXE match registers */
3785         brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, bsscfg->cur_etheraddr);
3786
3787         brcms_c_ampdu_macaddr_upd(wlc);
3788
3789         return err;
3790 }
3791
3792 /* Write the BSS config's BSSID address to core (set_bssid in d11procs.tcl).
3793  * Updates RXE match engine.
3794  */
3795 static void brcms_c_set_bssid(struct brcms_bss_cfg *bsscfg)
3796 {
3797         /* we need to update BSSID in RXE match registers */
3798         brcms_c_set_addrmatch(bsscfg->wlc, RCM_BSSID_OFFSET, bsscfg->BSSID);
3799 }
3800
3801 static void brcms_b_set_shortslot(struct brcms_hardware *wlc_hw, bool shortslot)
3802 {
3803         wlc_hw->shortslot = shortslot;
3804
3805         if (wlc_hw->band->bandtype == BRCM_BAND_2G && wlc_hw->up) {
3806                 brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
3807                 brcms_b_update_slot_timing(wlc_hw, shortslot);
3808                 brcms_c_enable_mac(wlc_hw->wlc);
3809         }
3810 }
3811
3812 /*
3813  * Suspend the the MAC and update the slot timing
3814  * for standard 11b/g (20us slots) or shortslot 11g (9us slots).
3815  */
3816 static void brcms_c_switch_shortslot(struct brcms_c_info *wlc, bool shortslot)
3817 {
3818         /* use the override if it is set */
3819         if (wlc->shortslot_override != BRCMS_SHORTSLOT_AUTO)
3820                 shortslot = (wlc->shortslot_override == BRCMS_SHORTSLOT_ON);
3821
3822         if (wlc->shortslot == shortslot)
3823                 return;
3824
3825         wlc->shortslot = shortslot;
3826
3827         brcms_b_set_shortslot(wlc->hw, shortslot);
3828 }
3829
3830 static void brcms_c_set_home_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3831 {
3832         if (wlc->home_chanspec != chanspec) {
3833                 wlc->home_chanspec = chanspec;
3834
3835                 if (wlc->bsscfg->associated)
3836                         wlc->bsscfg->current_bss->chanspec = chanspec;
3837         }
3838 }
3839
3840 void
3841 brcms_b_set_chanspec(struct brcms_hardware *wlc_hw, u16 chanspec,
3842                       bool mute_tx, struct txpwr_limits *txpwr)
3843 {
3844         uint bandunit;
3845
3846         brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: 0x%x\n", wlc_hw->unit,
3847                            chanspec);
3848
3849         wlc_hw->chanspec = chanspec;
3850
3851         /* Switch bands if necessary */
3852         if (wlc_hw->_nbands > 1) {
3853                 bandunit = chspec_bandunit(chanspec);
3854                 if (wlc_hw->band->bandunit != bandunit) {
3855                         /* brcms_b_setband disables other bandunit,
3856                          *  use light band switch if not up yet
3857                          */
3858                         if (wlc_hw->up) {
3859                                 wlc_phy_chanspec_radio_set(wlc_hw->
3860                                                            bandstate[bandunit]->
3861                                                            pi, chanspec);
3862                                 brcms_b_setband(wlc_hw, bandunit, chanspec);
3863                         } else {
3864                                 brcms_c_setxband(wlc_hw, bandunit);
3865                         }
3866                 }
3867         }
3868
3869         wlc_phy_initcal_enable(wlc_hw->band->pi, !mute_tx);
3870
3871         if (!wlc_hw->up) {
3872                 if (wlc_hw->clk)
3873                         wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr,
3874                                                   chanspec);
3875                 wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3876         } else {
3877                 wlc_phy_chanspec_set(wlc_hw->band->pi, chanspec);
3878                 wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr, chanspec);
3879
3880                 /* Update muting of the channel */
3881                 brcms_b_mute(wlc_hw, mute_tx);
3882         }
3883 }
3884
3885 /* switch to and initialize new band */
3886 static void brcms_c_setband(struct brcms_c_info *wlc,
3887                                            uint bandunit)
3888 {
3889         wlc->band = wlc->bandstate[bandunit];
3890
3891         if (!wlc->pub->up)
3892                 return;
3893
3894         /* wait for at least one beacon before entering sleeping state */
3895         brcms_c_set_ps_ctrl(wlc);
3896
3897         /* band-specific initializations */
3898         brcms_c_bsinit(wlc);
3899 }
3900
3901 static void brcms_c_set_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3902 {
3903         uint bandunit;
3904         bool switchband = false;
3905         u16 old_chanspec = wlc->chanspec;
3906
3907         if (!brcms_c_valid_chanspec_db(wlc->cmi, chanspec)) {
3908                 brcms_err(wlc->hw->d11core, "wl%d: %s: Bad channel %d\n",
3909                           wlc->pub->unit, __func__, CHSPEC_CHANNEL(chanspec));
3910                 return;
3911         }
3912
3913         /* Switch bands if necessary */
3914         if (wlc->pub->_nbands > 1) {
3915                 bandunit = chspec_bandunit(chanspec);
3916                 if (wlc->band->bandunit != bandunit || wlc->bandinit_pending) {
3917                         switchband = true;
3918                         if (wlc->bandlocked) {
3919                                 brcms_err(wlc->hw->d11core,
3920                                           "wl%d: %s: chspec %d band is locked!\n",
3921                                           wlc->pub->unit, __func__,
3922                                           CHSPEC_CHANNEL(chanspec));
3923                                 return;
3924                         }
3925                         /*
3926                          * should the setband call come after the
3927                          * brcms_b_chanspec() ? if the setband updates
3928                          * (brcms_c_bsinit) use low level calls to inspect and
3929                          * set state, the state inspected may be from the wrong
3930                          * band, or the following brcms_b_set_chanspec() may
3931                          * undo the work.
3932                          */
3933                         brcms_c_setband(wlc, bandunit);
3934                 }
3935         }
3936
3937         /* sync up phy/radio chanspec */
3938         brcms_c_set_phy_chanspec(wlc, chanspec);
3939
3940         /* init antenna selection */
3941         if (brcms_chspec_bw(old_chanspec) != brcms_chspec_bw(chanspec)) {
3942                 brcms_c_antsel_init(wlc->asi);
3943
3944                 /* Fix the hardware rateset based on bw.
3945                  * Mainly add MCS32 for 40Mhz, remove MCS 32 for 20Mhz
3946                  */
3947                 brcms_c_rateset_bw_mcs_filter(&wlc->band->hw_rateset,
3948                         wlc->band->mimo_cap_40 ? brcms_chspec_bw(chanspec) : 0);
3949         }
3950
3951         /* update some mac configuration since chanspec changed */
3952         brcms_c_ucode_mac_upd(wlc);
3953 }
3954
3955 /*
3956  * This function changes the phytxctl for beacon based on current
3957  * beacon ratespec AND txant setting as per this table:
3958  *  ratespec     CCK            ant = wlc->stf->txant
3959  *              OFDM            ant = 3
3960  */
3961 void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc,
3962                                        u32 bcn_rspec)
3963 {
3964         u16 phyctl;
3965         u16 phytxant = wlc->stf->phytxant;
3966         u16 mask = PHY_TXC_ANT_MASK;
3967
3968         /* for non-siso rates or default setting, use the available chains */
3969         if (BRCMS_PHY_11N_CAP(wlc->band))
3970                 phytxant = brcms_c_stf_phytxchain_sel(wlc, bcn_rspec);
3971
3972         phyctl = brcms_b_read_shm(wlc->hw, M_BCN_PCTLWD);
3973         phyctl = (phyctl & ~mask) | phytxant;
3974         brcms_b_write_shm(wlc->hw, M_BCN_PCTLWD, phyctl);
3975 }
3976
3977 /*
3978  * centralized protection config change function to simplify debugging, no
3979  * consistency checking this should be called only on changes to avoid overhead
3980  * in periodic function
3981  */
3982 void brcms_c_protection_upd(struct brcms_c_info *wlc, uint idx, int val)
3983 {
3984         /*
3985          * Cannot use brcms_dbg_* here because this function is called
3986          * before wlc is sufficiently initialized.
3987          */
3988         BCMMSG(wlc->wiphy, "idx %d, val %d\n", idx, val);
3989
3990         switch (idx) {
3991         case BRCMS_PROT_G_SPEC:
3992                 wlc->protection->_g = (bool) val;
3993                 break;
3994         case BRCMS_PROT_G_OVR:
3995                 wlc->protection->g_override = (s8) val;
3996                 break;
3997         case BRCMS_PROT_G_USER:
3998                 wlc->protection->gmode_user = (u8) val;
3999                 break;
4000         case BRCMS_PROT_OVERLAP:
4001                 wlc->protection->overlap = (s8) val;
4002                 break;
4003         case BRCMS_PROT_N_USER:
4004                 wlc->protection->nmode_user = (s8) val;
4005                 break;
4006         case BRCMS_PROT_N_CFG:
4007                 wlc->protection->n_cfg = (s8) val;
4008                 break;
4009         case BRCMS_PROT_N_CFG_OVR:
4010                 wlc->protection->n_cfg_override = (s8) val;
4011                 break;
4012         case BRCMS_PROT_N_NONGF:
4013                 wlc->protection->nongf = (bool) val;
4014                 break;
4015         case BRCMS_PROT_N_NONGF_OVR:
4016                 wlc->protection->nongf_override = (s8) val;
4017                 break;
4018         case BRCMS_PROT_N_PAM_OVR:
4019                 wlc->protection->n_pam_override = (s8) val;
4020                 break;
4021         case BRCMS_PROT_N_OBSS:
4022                 wlc->protection->n_obss = (bool) val;
4023                 break;
4024
4025         default:
4026                 break;
4027         }
4028
4029 }
4030
4031 static void brcms_c_ht_update_sgi_rx(struct brcms_c_info *wlc, int val)
4032 {
4033         if (wlc->pub->up) {
4034                 brcms_c_update_beacon(wlc);
4035                 brcms_c_update_probe_resp(wlc, true);
4036         }
4037 }
4038
4039 static void brcms_c_ht_update_ldpc(struct brcms_c_info *wlc, s8 val)
4040 {
4041         wlc->stf->ldpc = val;
4042
4043         if (wlc->pub->up) {
4044                 brcms_c_update_beacon(wlc);
4045                 brcms_c_update_probe_resp(wlc, true);
4046                 wlc_phy_ldpc_override_set(wlc->band->pi, (val ? true : false));
4047         }
4048 }
4049
4050 void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
4051                        const struct ieee80211_tx_queue_params *params,
4052                        bool suspend)
4053 {
4054         int i;
4055         struct shm_acparams acp_shm;
4056         u16 *shm_entry;
4057
4058         /* Only apply params if the core is out of reset and has clocks */
4059         if (!wlc->clk) {
4060                 brcms_err(wlc->hw->d11core, "wl%d: %s : no-clock\n",
4061                           wlc->pub->unit, __func__);
4062                 return;
4063         }
4064
4065         memset((char *)&acp_shm, 0, sizeof(struct shm_acparams));
4066         /* fill in shm ac params struct */
4067         acp_shm.txop = params->txop;
4068         /* convert from units of 32us to us for ucode */
4069         wlc->edcf_txop[aci & 0x3] = acp_shm.txop =
4070             EDCF_TXOP2USEC(acp_shm.txop);
4071         acp_shm.aifs = (params->aifs & EDCF_AIFSN_MASK);
4072
4073         if (aci == IEEE80211_AC_VI && acp_shm.txop == 0
4074             && acp_shm.aifs < EDCF_AIFSN_MAX)
4075                 acp_shm.aifs++;
4076
4077         if (acp_shm.aifs < EDCF_AIFSN_MIN
4078             || acp_shm.aifs > EDCF_AIFSN_MAX) {
4079                 brcms_err(wlc->hw->d11core, "wl%d: edcf_setparams: bad "
4080                           "aifs %d\n", wlc->pub->unit, acp_shm.aifs);
4081         } else {
4082                 acp_shm.cwmin = params->cw_min;
4083                 acp_shm.cwmax = params->cw_max;
4084                 acp_shm.cwcur = acp_shm.cwmin;
4085                 acp_shm.bslots =
4086                         bcma_read16(wlc->hw->d11core, D11REGOFFS(tsf_random)) &
4087                         acp_shm.cwcur;
4088                 acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
4089                 /* Indicate the new params to the ucode */
4090                 acp_shm.status = brcms_b_read_shm(wlc->hw, (M_EDCF_QINFO +
4091                                                   wme_ac2fifo[aci] *
4092                                                   M_EDCF_QLEN +
4093                                                   M_EDCF_STATUS_OFF));
4094                 acp_shm.status |= WME_STATUS_NEWAC;
4095
4096                 /* Fill in shm acparam table */
4097                 shm_entry = (u16 *) &acp_shm;
4098                 for (i = 0; i < (int)sizeof(struct shm_acparams); i += 2)
4099                         brcms_b_write_shm(wlc->hw,
4100                                           M_EDCF_QINFO +
4101                                           wme_ac2fifo[aci] * M_EDCF_QLEN + i,
4102                                           *shm_entry++);
4103         }
4104
4105         if (suspend) {
4106                 brcms_c_suspend_mac_and_wait(wlc);
4107                 brcms_c_enable_mac(wlc);
4108         }
4109 }
4110
4111 static void brcms_c_edcf_setparams(struct brcms_c_info *wlc, bool suspend)
4112 {
4113         u16 aci;
4114         int i_ac;
4115         struct ieee80211_tx_queue_params txq_pars;
4116         static const struct edcf_acparam default_edcf_acparams[] = {
4117                  {EDCF_AC_BE_ACI_STA, EDCF_AC_BE_ECW_STA, EDCF_AC_BE_TXOP_STA},
4118                  {EDCF_AC_BK_ACI_STA, EDCF_AC_BK_ECW_STA, EDCF_AC_BK_TXOP_STA},
4119                  {EDCF_AC_VI_ACI_STA, EDCF_AC_VI_ECW_STA, EDCF_AC_VI_TXOP_STA},
4120                  {EDCF_AC_VO_ACI_STA, EDCF_AC_VO_ECW_STA, EDCF_AC_VO_TXOP_STA}
4121         }; /* ucode needs these parameters during its initialization */
4122         const struct edcf_acparam *edcf_acp = &default_edcf_acparams[0];
4123
4124         for (i_ac = 0; i_ac < IEEE80211_NUM_ACS; i_ac++, edcf_acp++) {
4125                 /* find out which ac this set of params applies to */
4126                 aci = (edcf_acp->ACI & EDCF_ACI_MASK) >> EDCF_ACI_SHIFT;
4127
4128                 /* fill in shm ac params struct */
4129                 txq_pars.txop = edcf_acp->TXOP;
4130                 txq_pars.aifs = edcf_acp->ACI;
4131
4132                 /* CWmin = 2^(ECWmin) - 1 */
4133                 txq_pars.cw_min = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
4134                 /* CWmax = 2^(ECWmax) - 1 */
4135                 txq_pars.cw_max = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
4136                                             >> EDCF_ECWMAX_SHIFT);
4137                 brcms_c_wme_setparams(wlc, aci, &txq_pars, suspend);
4138         }
4139
4140         if (suspend) {
4141                 brcms_c_suspend_mac_and_wait(wlc);
4142                 brcms_c_enable_mac(wlc);
4143         }
4144 }
4145
4146 static void brcms_c_radio_monitor_start(struct brcms_c_info *wlc)
4147 {
4148         /* Don't start the timer if HWRADIO feature is disabled */
4149         if (wlc->radio_monitor)
4150                 return;
4151
4152         wlc->radio_monitor = true;
4153         brcms_b_pllreq(wlc->hw, true, BRCMS_PLLREQ_RADIO_MON);
4154         brcms_add_timer(wlc->radio_timer, TIMER_INTERVAL_RADIOCHK, true);
4155 }
4156
4157 static bool brcms_c_radio_monitor_stop(struct brcms_c_info *wlc)
4158 {
4159         if (!wlc->radio_monitor)
4160                 return true;
4161
4162         wlc->radio_monitor = false;
4163         brcms_b_pllreq(wlc->hw, false, BRCMS_PLLREQ_RADIO_MON);
4164         return brcms_del_timer(wlc->radio_timer);
4165 }
4166
4167 /* read hwdisable state and propagate to wlc flag */
4168 static void brcms_c_radio_hwdisable_upd(struct brcms_c_info *wlc)
4169 {
4170         if (wlc->pub->hw_off)
4171                 return;
4172
4173         if (brcms_b_radio_read_hwdisabled(wlc->hw))
4174                 mboolset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4175         else
4176                 mboolclr(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4177 }
4178
4179 /* update hwradio status and return it */
4180 bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc)
4181 {
4182         brcms_c_radio_hwdisable_upd(wlc);
4183
4184         return mboolisset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE) ?
4185                         true : false;
4186 }
4187
4188 /* periodical query hw radio button while driver is "down" */
4189 static void brcms_c_radio_timer(void *arg)
4190 {
4191         struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4192
4193         if (brcms_deviceremoved(wlc)) {
4194                 brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4195                           wlc->pub->unit, __func__);
4196                 brcms_down(wlc->wl);
4197                 return;
4198         }
4199
4200         brcms_c_radio_hwdisable_upd(wlc);
4201 }
4202
4203 /* common low-level watchdog code */
4204 static void brcms_b_watchdog(struct brcms_c_info *wlc)
4205 {
4206         struct brcms_hardware *wlc_hw = wlc->hw;
4207
4208         if (!wlc_hw->up)
4209                 return;
4210
4211         /* increment second count */
4212         wlc_hw->now++;
4213
4214         /* Check for FIFO error interrupts */
4215         brcms_b_fifoerrors(wlc_hw);
4216
4217         /* make sure RX dma has buffers */
4218         dma_rxfill(wlc->hw->di[RX_FIFO]);
4219
4220         wlc_phy_watchdog(wlc_hw->band->pi);
4221 }
4222
4223 /* common watchdog code */
4224 static void brcms_c_watchdog(struct brcms_c_info *wlc)
4225 {
4226         brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
4227
4228         if (!wlc->pub->up)
4229                 return;
4230
4231         if (brcms_deviceremoved(wlc)) {
4232                 brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4233                           wlc->pub->unit, __func__);
4234                 brcms_down(wlc->wl);
4235                 return;
4236         }
4237
4238         /* increment second count */
4239         wlc->pub->now++;
4240
4241         brcms_c_radio_hwdisable_upd(wlc);
4242         /* if radio is disable, driver may be down, quit here */
4243         if (wlc->pub->radio_disabled)
4244                 return;
4245
4246         brcms_b_watchdog(wlc);
4247
4248         /*
4249          * occasionally sample mac stat counters to
4250          * detect 16-bit counter wrap
4251          */
4252         if ((wlc->pub->now % SW_TIMER_MAC_STAT_UPD) == 0)
4253                 brcms_c_statsupd(wlc);
4254
4255         if (BRCMS_ISNPHY(wlc->band) &&
4256             ((wlc->pub->now - wlc->tempsense_lasttime) >=
4257              BRCMS_TEMPSENSE_PERIOD)) {
4258                 wlc->tempsense_lasttime = wlc->pub->now;
4259                 brcms_c_tempsense_upd(wlc);
4260         }
4261 }
4262
4263 static void brcms_c_watchdog_by_timer(void *arg)
4264 {
4265         struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4266
4267         brcms_c_watchdog(wlc);
4268 }
4269
4270 static bool brcms_c_timers_init(struct brcms_c_info *wlc, int unit)
4271 {
4272         wlc->wdtimer = brcms_init_timer(wlc->wl, brcms_c_watchdog_by_timer,
4273                 wlc, "watchdog");
4274         if (!wlc->wdtimer) {
4275                 wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for wdtimer "
4276                           "failed\n", unit);
4277                 goto fail;
4278         }
4279
4280         wlc->radio_timer = brcms_init_timer(wlc->wl, brcms_c_radio_timer,
4281                 wlc, "radio");
4282         if (!wlc->radio_timer) {
4283                 wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for radio_timer "
4284                           "failed\n", unit);
4285                 goto fail;
4286         }
4287
4288         return true;
4289
4290  fail:
4291         return false;
4292 }
4293
4294 /*
4295  * Initialize brcms_c_info default values ...
4296  * may get overrides later in this function
4297  */
4298 static void brcms_c_info_init(struct brcms_c_info *wlc, int unit)
4299 {
4300         int i;
4301
4302         /* Save our copy of the chanspec */
4303         wlc->chanspec = ch20mhz_chspec(1);
4304
4305         /* various 802.11g modes */
4306         wlc->shortslot = false;
4307         wlc->shortslot_override = BRCMS_SHORTSLOT_AUTO;
4308
4309         brcms_c_protection_upd(wlc, BRCMS_PROT_G_OVR, BRCMS_PROTECTION_AUTO);
4310         brcms_c_protection_upd(wlc, BRCMS_PROT_G_SPEC, false);
4311
4312         brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG_OVR,
4313                                BRCMS_PROTECTION_AUTO);
4314         brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG, BRCMS_N_PROTECTION_OFF);
4315         brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF_OVR,
4316                                BRCMS_PROTECTION_AUTO);
4317         brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF, false);
4318         brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, AUTO);
4319
4320         brcms_c_protection_upd(wlc, BRCMS_PROT_OVERLAP,
4321                                BRCMS_PROTECTION_CTL_OVERLAP);
4322
4323         /* 802.11g draft 4.0 NonERP elt advertisement */
4324         wlc->include_legacy_erp = true;
4325
4326         wlc->stf->ant_rx_ovr = ANT_RX_DIV_DEF;
4327         wlc->stf->txant = ANT_TX_DEF;
4328
4329         wlc->prb_resp_timeout = BRCMS_PRB_RESP_TIMEOUT;
4330
4331         wlc->usr_fragthresh = DOT11_DEFAULT_FRAG_LEN;
4332         for (i = 0; i < NFIFO; i++)
4333                 wlc->fragthresh[i] = DOT11_DEFAULT_FRAG_LEN;
4334         wlc->RTSThresh = DOT11_DEFAULT_RTS_LEN;
4335
4336         /* default rate fallback retry limits */
4337         wlc->SFBL = RETRY_SHORT_FB;
4338         wlc->LFBL = RETRY_LONG_FB;
4339
4340         /* default mac retry limits */
4341         wlc->SRL = RETRY_SHORT_DEF;
4342         wlc->LRL = RETRY_LONG_DEF;
4343
4344         /* WME QoS mode is Auto by default */
4345         wlc->pub->_ampdu = AMPDU_AGG_HOST;
4346         wlc->pub->bcmerror = 0;
4347 }
4348
4349 static uint brcms_c_attach_module(struct brcms_c_info *wlc)
4350 {
4351         uint err = 0;
4352         uint unit;
4353         unit = wlc->pub->unit;
4354
4355         wlc->asi = brcms_c_antsel_attach(wlc);
4356         if (wlc->asi == NULL) {
4357                 wiphy_err(wlc->wiphy, "wl%d: attach: antsel_attach "
4358                           "failed\n", unit);
4359                 err = 44;
4360                 goto fail;
4361         }
4362
4363         wlc->ampdu = brcms_c_ampdu_attach(wlc);
4364         if (wlc->ampdu == NULL) {
4365                 wiphy_err(wlc->wiphy, "wl%d: attach: ampdu_attach "
4366                           "failed\n", unit);
4367                 err = 50;
4368                 goto fail;
4369         }
4370
4371         if ((brcms_c_stf_attach(wlc) != 0)) {
4372                 wiphy_err(wlc->wiphy, "wl%d: attach: stf_attach "
4373                           "failed\n", unit);
4374                 err = 68;
4375                 goto fail;
4376         }
4377  fail:
4378         return err;
4379 }
4380
4381 struct brcms_pub *brcms_c_pub(struct brcms_c_info *wlc)
4382 {
4383         return wlc->pub;
4384 }
4385
4386 /* low level attach
4387  *    run backplane attach, init nvram
4388  *    run phy attach
4389  *    initialize software state for each core and band
4390  *    put the whole chip in reset(driver down state), no clock
4391  */
4392 static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
4393                           uint unit, bool piomode)
4394 {
4395         struct brcms_hardware *wlc_hw;
4396         uint err = 0;
4397         uint j;
4398         bool wme = false;
4399         struct shared_phy_params sha_params;
4400         struct wiphy *wiphy = wlc->wiphy;
4401         struct pci_dev *pcidev = core->bus->host_pci;
4402         struct ssb_sprom *sprom = &core->bus->sprom;
4403
4404         if (core->bus->hosttype == BCMA_HOSTTYPE_PCI)
4405                 brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4406                                pcidev->vendor,
4407                                pcidev->device);
4408         else
4409                 brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4410                                core->bus->boardinfo.vendor,
4411                                core->bus->boardinfo.type);
4412
4413         wme = true;
4414
4415         wlc_hw = wlc->hw;
4416         wlc_hw->wlc = wlc;
4417         wlc_hw->unit = unit;
4418         wlc_hw->band = wlc_hw->bandstate[0];
4419         wlc_hw->_piomode = piomode;
4420
4421         /* populate struct brcms_hardware with default values  */
4422         brcms_b_info_init(wlc_hw);
4423
4424         /*
4425          * Do the hardware portion of the attach. Also initialize software
4426          * state that depends on the particular hardware we are running.
4427          */
4428         wlc_hw->sih = ai_attach(core->bus);
4429         if (wlc_hw->sih == NULL) {
4430                 wiphy_err(wiphy, "wl%d: brcms_b_attach: si_attach failed\n",
4431                           unit);
4432                 err = 11;
4433                 goto fail;
4434         }
4435
4436         /* verify again the device is supported */
4437         if (!brcms_c_chipmatch(core)) {
4438                 wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported device\n",
4439                          unit);
4440                 err = 12;
4441                 goto fail;
4442         }
4443
4444         if (core->bus->hosttype == BCMA_HOSTTYPE_PCI) {
4445                 wlc_hw->vendorid = pcidev->vendor;
4446                 wlc_hw->deviceid = pcidev->device;
4447         } else {
4448                 wlc_hw->vendorid = core->bus->boardinfo.vendor;
4449                 wlc_hw->deviceid = core->bus->boardinfo.type;
4450         }
4451
4452         wlc_hw->d11core = core;
4453         wlc_hw->corerev = core->id.rev;
4454
4455         /* validate chip, chiprev and corerev */
4456         if (!brcms_c_isgoodchip(wlc_hw)) {
4457                 err = 13;
4458                 goto fail;
4459         }
4460
4461         /* initialize power control registers */
4462         ai_clkctl_init(wlc_hw->sih);
4463
4464         /* request fastclock and force fastclock for the rest of attach
4465          * bring the d11 core out of reset.
4466          *   For PMU chips, the first wlc_clkctl_clk is no-op since core-clk
4467          *   is still false; But it will be called again inside wlc_corereset,
4468          *   after d11 is out of reset.
4469          */
4470         brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4471         brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4472
4473         if (!brcms_b_validate_chip_access(wlc_hw)) {
4474                 wiphy_err(wiphy, "wl%d: brcms_b_attach: validate_chip_access "
4475                         "failed\n", unit);
4476                 err = 14;
4477                 goto fail;
4478         }
4479
4480         /* get the board rev, used just below */
4481         j = sprom->board_rev;
4482         /* promote srom boardrev of 0xFF to 1 */
4483         if (j == BOARDREV_PROMOTABLE)
4484                 j = BOARDREV_PROMOTED;
4485         wlc_hw->boardrev = (u16) j;
4486         if (!brcms_c_validboardtype(wlc_hw)) {
4487                 wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported Broadcom "
4488                           "board type (0x%x)" " or revision level (0x%x)\n",
4489                           unit, ai_get_boardtype(wlc_hw->sih),
4490                           wlc_hw->boardrev);
4491                 err = 15;
4492                 goto fail;
4493         }
4494         wlc_hw->sromrev = sprom->revision;
4495         wlc_hw->boardflags = sprom->boardflags_lo + (sprom->boardflags_hi << 16);
4496         wlc_hw->boardflags2 = sprom->boardflags2_lo + (sprom->boardflags2_hi << 16);
4497
4498         if (wlc_hw->boardflags & BFL_NOPLLDOWN)
4499                 brcms_b_pllreq(wlc_hw, true, BRCMS_PLLREQ_SHARED);
4500
4501         /* check device id(srom, nvram etc.) to set bands */
4502         if (wlc_hw->deviceid == BCM43224_D11N_ID ||
4503             wlc_hw->deviceid == BCM43224_D11N_ID_VEN1)
4504                 /* Dualband boards */
4505                 wlc_hw->_nbands = 2;
4506         else
4507                 wlc_hw->_nbands = 1;
4508
4509         if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225))
4510                 wlc_hw->_nbands = 1;
4511
4512         /* BMAC_NOTE: remove init of pub values when brcms_c_attach()
4513          * unconditionally does the init of these values
4514          */
4515         wlc->vendorid = wlc_hw->vendorid;
4516         wlc->deviceid = wlc_hw->deviceid;
4517         wlc->pub->sih = wlc_hw->sih;
4518         wlc->pub->corerev = wlc_hw->corerev;
4519         wlc->pub->sromrev = wlc_hw->sromrev;
4520         wlc->pub->boardrev = wlc_hw->boardrev;
4521         wlc->pub->boardflags = wlc_hw->boardflags;
4522         wlc->pub->boardflags2 = wlc_hw->boardflags2;
4523         wlc->pub->_nbands = wlc_hw->_nbands;
4524
4525         wlc_hw->physhim = wlc_phy_shim_attach(wlc_hw, wlc->wl, wlc);
4526
4527         if (wlc_hw->physhim == NULL) {
4528                 wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_shim_attach "
4529                         "failed\n", unit);
4530                 err = 25;
4531                 goto fail;
4532         }
4533
4534         /* pass all the parameters to wlc_phy_shared_attach in one struct */
4535         sha_params.sih = wlc_hw->sih;
4536         sha_params.physhim = wlc_hw->physhim;
4537         sha_params.unit = unit;
4538         sha_params.corerev = wlc_hw->corerev;
4539         sha_params.vid = wlc_hw->vendorid;
4540         sha_params.did = wlc_hw->deviceid;
4541         sha_params.chip = ai_get_chip_id(wlc_hw->sih);
4542         sha_params.chiprev = ai_get_chiprev(wlc_hw->sih);
4543         sha_params.chippkg = ai_get_chippkg(wlc_hw->sih);
4544         sha_params.sromrev = wlc_hw->sromrev;
4545         sha_params.boardtype = ai_get_boardtype(wlc_hw->sih);
4546         sha_params.boardrev = wlc_hw->boardrev;
4547         sha_params.boardflags = wlc_hw->boardflags;
4548         sha_params.boardflags2 = wlc_hw->boardflags2;
4549
4550         /* alloc and save pointer to shared phy state area */
4551         wlc_hw->phy_sh = wlc_phy_shared_attach(&sha_params);
4552         if (!wlc_hw->phy_sh) {
4553                 err = 16;
4554                 goto fail;
4555         }
4556
4557         /* initialize software state for each core and band */
4558         for (j = 0; j < wlc_hw->_nbands; j++) {
4559                 /*
4560                  * band0 is always 2.4Ghz
4561                  * band1, if present, is 5Ghz
4562                  */
4563
4564                 brcms_c_setxband(wlc_hw, j);
4565
4566                 wlc_hw->band->bandunit = j;
4567                 wlc_hw->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4568                 wlc->band->bandunit = j;
4569                 wlc->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4570                 wlc->core->coreidx = core->core_index;
4571
4572                 wlc_hw->machwcap = bcma_read32(core, D11REGOFFS(machwcap));
4573                 wlc_hw->machwcap_backup = wlc_hw->machwcap;
4574
4575                 /* init tx fifo size */
4576                 WARN_ON((wlc_hw->corerev - XMTFIFOTBL_STARTREV) < 0 ||
4577                         (wlc_hw->corerev - XMTFIFOTBL_STARTREV) >
4578                                 ARRAY_SIZE(xmtfifo_sz));
4579                 wlc_hw->xmtfifo_sz =
4580                     xmtfifo_sz[(wlc_hw->corerev - XMTFIFOTBL_STARTREV)];
4581                 WARN_ON(!wlc_hw->xmtfifo_sz[0]);
4582
4583                 /* Get a phy for this band */
4584                 wlc_hw->band->pi =
4585                         wlc_phy_attach(wlc_hw->phy_sh, core,
4586                                        wlc_hw->band->bandtype,
4587                                        wlc->wiphy);
4588                 if (wlc_hw->band->pi == NULL) {
4589                         wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_"
4590                                   "attach failed\n", unit);
4591                         err = 17;
4592                         goto fail;
4593                 }
4594
4595                 wlc_phy_machwcap_set(wlc_hw->band->pi, wlc_hw->machwcap);
4596
4597                 wlc_phy_get_phyversion(wlc_hw->band->pi, &wlc_hw->band->phytype,
4598                                        &wlc_hw->band->phyrev,
4599                                        &wlc_hw->band->radioid,
4600                                        &wlc_hw->band->radiorev);
4601                 wlc_hw->band->abgphy_encore =
4602                     wlc_phy_get_encore(wlc_hw->band->pi);
4603                 wlc->band->abgphy_encore = wlc_phy_get_encore(wlc_hw->band->pi);
4604                 wlc_hw->band->core_flags =
4605                     wlc_phy_get_coreflags(wlc_hw->band->pi);
4606
4607                 /* verify good phy_type & supported phy revision */
4608                 if (BRCMS_ISNPHY(wlc_hw->band)) {
4609                         if (NCONF_HAS(wlc_hw->band->phyrev))
4610                                 goto good_phy;
4611                         else
4612                                 goto bad_phy;
4613                 } else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
4614                         if (LCNCONF_HAS(wlc_hw->band->phyrev))
4615                                 goto good_phy;
4616                         else
4617                                 goto bad_phy;
4618                 } else {
4619  bad_phy:
4620                         wiphy_err(wiphy, "wl%d: brcms_b_attach: unsupported "
4621                                   "phy type/rev (%d/%d)\n", unit,
4622                                   wlc_hw->band->phytype, wlc_hw->band->phyrev);
4623                         err = 18;
4624                         goto fail;
4625                 }
4626
4627  good_phy:
4628                 /*
4629                  * BMAC_NOTE: wlc->band->pi should not be set below and should
4630                  * be done in the high level attach. However we can not make
4631                  * that change until all low level access is changed to
4632                  * wlc_hw->band->pi. Instead do the wlc->band->pi init below,
4633                  * keeping wlc_hw->band->pi as well for incremental update of
4634                  * low level fns, and cut over low only init when all fns
4635                  * updated.
4636                  */
4637                 wlc->band->pi = wlc_hw->band->pi;
4638                 wlc->band->phytype = wlc_hw->band->phytype;
4639                 wlc->band->phyrev = wlc_hw->band->phyrev;
4640                 wlc->band->radioid = wlc_hw->band->radioid;
4641                 wlc->band->radiorev = wlc_hw->band->radiorev;
4642
4643                 /* default contention windows size limits */
4644                 wlc_hw->band->CWmin = APHY_CWMIN;
4645                 wlc_hw->band->CWmax = PHY_CWMAX;
4646
4647                 if (!brcms_b_attach_dmapio(wlc, j, wme)) {
4648                         err = 19;
4649                         goto fail;
4650                 }
4651         }
4652
4653         /* disable core to match driver "down" state */
4654         brcms_c_coredisable(wlc_hw);
4655
4656         /* Match driver "down" state */
4657         ai_pci_down(wlc_hw->sih);
4658
4659         /* turn off pll and xtal to match driver "down" state */
4660         brcms_b_xtal(wlc_hw, OFF);
4661
4662         /* *******************************************************************
4663          * The hardware is in the DOWN state at this point. D11 core
4664          * or cores are in reset with clocks off, and the board PLLs
4665          * are off if possible.
4666          *
4667          * Beyond this point, wlc->sbclk == false and chip registers
4668          * should not be touched.
4669          *********************************************************************
4670          */
4671
4672         /* init etheraddr state variables */
4673         brcms_c_get_macaddr(wlc_hw, wlc_hw->etheraddr);
4674
4675         if (is_broadcast_ether_addr(wlc_hw->etheraddr) ||
4676             is_zero_ether_addr(wlc_hw->etheraddr)) {
4677                 wiphy_err(wiphy, "wl%d: brcms_b_attach: bad macaddr\n",
4678                           unit);
4679                 err = 22;
4680                 goto fail;
4681         }
4682
4683         brcms_dbg_info(wlc_hw->d11core, "deviceid 0x%x nbands %d board 0x%x\n",
4684                        wlc_hw->deviceid, wlc_hw->_nbands,
4685                        ai_get_boardtype(wlc_hw->sih));
4686
4687         return err;
4688
4689  fail:
4690         wiphy_err(wiphy, "wl%d: brcms_b_attach: failed with err %d\n", unit,
4691                   err);
4692         return err;
4693 }
4694
4695 static void brcms_c_attach_antgain_init(struct brcms_c_info *wlc)
4696 {
4697         uint unit;
4698         unit = wlc->pub->unit;
4699
4700         if ((wlc->band->antgain == -1) && (wlc->pub->sromrev == 1)) {
4701                 /* default antenna gain for srom rev 1 is 2 dBm (8 qdbm) */
4702                 wlc->band->antgain = 8;
4703         } else if (wlc->band->antgain == -1) {
4704                 wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
4705                           " srom, using 2dB\n", unit, __func__);
4706                 wlc->band->antgain = 8;
4707         } else {
4708                 s8 gain, fract;
4709                 /* Older sroms specified gain in whole dbm only.  In order
4710                  * be able to specify qdbm granularity and remain backward
4711                  * compatible the whole dbms are now encoded in only
4712                  * low 6 bits and remaining qdbms are encoded in the hi 2 bits.
4713                  * 6 bit signed number ranges from -32 - 31.
4714                  *
4715                  * Examples:
4716                  * 0x1 = 1 db,
4717                  * 0xc1 = 1.75 db (1 + 3 quarters),
4718                  * 0x3f = -1 (-1 + 0 quarters),
4719                  * 0x7f = -.75 (-1 + 1 quarters) = -3 qdbm.
4720                  * 0xbf = -.50 (-1 + 2 quarters) = -2 qdbm.
4721                  */
4722                 gain = wlc->band->antgain & 0x3f;
4723                 gain <<= 2;     /* Sign extend */
4724                 gain >>= 2;
4725                 fract = (wlc->band->antgain & 0xc0) >> 6;
4726                 wlc->band->antgain = 4 * gain + fract;
4727         }
4728 }
4729
4730 static bool brcms_c_attach_stf_ant_init(struct brcms_c_info *wlc)
4731 {
4732         int aa;
4733         uint unit;
4734         int bandtype;
4735         struct ssb_sprom *sprom = &wlc->hw->d11core->bus->sprom;
4736
4737         unit = wlc->pub->unit;
4738         bandtype = wlc->band->bandtype;
4739
4740         /* get antennas available */
4741         if (bandtype == BRCM_BAND_5G)
4742                 aa = sprom->ant_available_a;
4743         else
4744                 aa = sprom->ant_available_bg;
4745
4746         if ((aa < 1) || (aa > 15)) {
4747                 wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
4748                           " srom (0x%x), using 3\n", unit, __func__, aa);
4749                 aa = 3;
4750         }
4751
4752         /* reset the defaults if we have a single antenna */
4753         if (aa == 1) {
4754                 wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_0;
4755                 wlc->stf->txant = ANT_TX_FORCE_0;
4756         } else if (aa == 2) {
4757                 wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_1;
4758                 wlc->stf->txant = ANT_TX_FORCE_1;
4759         } else {
4760         }
4761
4762         /* Compute Antenna Gain */
4763         if (bandtype == BRCM_BAND_5G)
4764                 wlc->band->antgain = sprom->antenna_gain.a1;
4765         else
4766                 wlc->band->antgain = sprom->antenna_gain.a0;
4767
4768         brcms_c_attach_antgain_init(wlc);
4769
4770         return true;
4771 }
4772
4773 static void brcms_c_bss_default_init(struct brcms_c_info *wlc)
4774 {
4775         u16 chanspec;
4776         struct brcms_band *band;
4777         struct brcms_bss_info *bi = wlc->default_bss;
4778
4779         /* init default and target BSS with some sane initial values */
4780         memset((char *)(bi), 0, sizeof(struct brcms_bss_info));
4781         bi->beacon_period = BEACON_INTERVAL_DEFAULT;
4782
4783         /* fill the default channel as the first valid channel
4784          * starting from the 2G channels
4785          */
4786         chanspec = ch20mhz_chspec(1);
4787         wlc->home_chanspec = bi->chanspec = chanspec;
4788
4789         /* find the band of our default channel */
4790         band = wlc->band;
4791         if (wlc->pub->_nbands > 1 &&
4792             band->bandunit != chspec_bandunit(chanspec))
4793                 band = wlc->bandstate[OTHERBANDUNIT(wlc)];
4794
4795         /* init bss rates to the band specific default rate set */
4796         brcms_c_rateset_default(&bi->rateset, NULL, band->phytype,
4797                 band->bandtype, false, BRCMS_RATE_MASK_FULL,
4798                 (bool) (wlc->pub->_n_enab & SUPPORT_11N),
4799                 brcms_chspec_bw(chanspec), wlc->stf->txstreams);
4800
4801         if (wlc->pub->_n_enab & SUPPORT_11N)
4802                 bi->flags |= BRCMS_BSS_HT;
4803 }
4804
4805 static void brcms_c_update_mimo_band_bwcap(struct brcms_c_info *wlc, u8 bwcap)
4806 {
4807         uint i;
4808         struct brcms_band *band;
4809
4810         for (i = 0; i < wlc->pub->_nbands; i++) {
4811                 band = wlc->bandstate[i];
4812                 if (band->bandtype == BRCM_BAND_5G) {
4813                         if ((bwcap == BRCMS_N_BW_40ALL)
4814                             || (bwcap == BRCMS_N_BW_20IN2G_40IN5G))
4815                                 band->mimo_cap_40 = true;
4816                         else
4817                                 band->mimo_cap_40 = false;
4818                 } else {
4819                         if (bwcap == BRCMS_N_BW_40ALL)
4820                                 band->mimo_cap_40 = true;
4821                         else
4822                                 band->mimo_cap_40 = false;
4823                 }
4824         }
4825 }
4826
4827 static void brcms_c_timers_deinit(struct brcms_c_info *wlc)
4828 {
4829         /* free timer state */
4830         if (wlc->wdtimer) {
4831                 brcms_free_timer(wlc->wdtimer);
4832                 wlc->wdtimer = NULL;
4833         }
4834         if (wlc->radio_timer) {
4835                 brcms_free_timer(wlc->radio_timer);
4836                 wlc->radio_timer = NULL;
4837         }
4838 }
4839
4840 static void brcms_c_detach_module(struct brcms_c_info *wlc)
4841 {
4842         if (wlc->asi) {
4843                 brcms_c_antsel_detach(wlc->asi);
4844                 wlc->asi = NULL;
4845         }
4846
4847         if (wlc->ampdu) {
4848                 brcms_c_ampdu_detach(wlc->ampdu);
4849                 wlc->ampdu = NULL;
4850         }
4851
4852         brcms_c_stf_detach(wlc);
4853 }
4854
4855 /*
4856  * low level detach
4857  */
4858 static int brcms_b_detach(struct brcms_c_info *wlc)
4859 {
4860         uint i;
4861         struct brcms_hw_band *band;
4862         struct brcms_hardware *wlc_hw = wlc->hw;
4863         int callbacks;
4864
4865         callbacks = 0;
4866
4867         brcms_b_detach_dmapio(wlc_hw);
4868
4869         band = wlc_hw->band;
4870         for (i = 0; i < wlc_hw->_nbands; i++) {
4871                 if (band->pi) {
4872                         /* Detach this band's phy */
4873                         wlc_phy_detach(band->pi);
4874                         band->pi = NULL;
4875                 }
4876                 band = wlc_hw->bandstate[OTHERBANDUNIT(wlc)];
4877         }
4878
4879         /* Free shared phy state */
4880         kfree(wlc_hw->phy_sh);
4881
4882         wlc_phy_shim_detach(wlc_hw->physhim);
4883
4884         if (wlc_hw->sih) {
4885                 ai_detach(wlc_hw->sih);
4886                 wlc_hw->sih = NULL;
4887         }
4888
4889         return callbacks;
4890
4891 }
4892
4893 /*
4894  * Return a count of the number of driver callbacks still pending.
4895  *
4896  * General policy is that brcms_c_detach can only dealloc/free software states.
4897  * It can NOT touch hardware registers since the d11core may be in reset and
4898  * clock may not be available.
4899  * One exception is sb register access, which is possible if crystal is turned
4900  * on after "down" state, driver should avoid software timer with the exception
4901  * of radio_monitor.
4902  */
4903 uint brcms_c_detach(struct brcms_c_info *wlc)
4904 {
4905         uint callbacks = 0;
4906
4907         if (wlc == NULL)
4908                 return 0;
4909
4910         callbacks += brcms_b_detach(wlc);
4911
4912         /* delete software timers */
4913         if (!brcms_c_radio_monitor_stop(wlc))
4914                 callbacks++;
4915
4916         brcms_c_channel_mgr_detach(wlc->cmi);
4917
4918         brcms_c_timers_deinit(wlc);
4919
4920         brcms_c_detach_module(wlc);
4921
4922         brcms_c_detach_mfree(wlc);
4923         return callbacks;
4924 }
4925
4926 /* update state that depends on the current value of "ap" */
4927 static void brcms_c_ap_upd(struct brcms_c_info *wlc)
4928 {
4929         /* STA-BSS; short capable */
4930         wlc->PLCPHdr_override = BRCMS_PLCP_SHORT;
4931 }
4932
4933 /* Initialize just the hardware when coming out of POR or S3/S5 system states */
4934 static void brcms_b_hw_up(struct brcms_hardware *wlc_hw)
4935 {
4936         if (wlc_hw->wlc->pub->hw_up)
4937                 return;
4938
4939         brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4940
4941         /*
4942          * Enable pll and xtal, initialize the power control registers,
4943          * and force fastclock for the remainder of brcms_c_up().
4944          */
4945         brcms_b_xtal(wlc_hw, ON);
4946         ai_clkctl_init(wlc_hw->sih);
4947         brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4948
4949         /*
4950          * TODO: test suspend/resume
4951          *
4952          * AI chip doesn't restore bar0win2 on
4953          * hibernation/resume, need sw fixup
4954          */
4955
4956         /*
4957          * Inform phy that a POR reset has occurred so
4958          * it does a complete phy init
4959          */
4960         wlc_phy_por_inform(wlc_hw->band->pi);
4961
4962         wlc_hw->ucode_loaded = false;
4963         wlc_hw->wlc->pub->hw_up = true;
4964
4965         if ((wlc_hw->boardflags & BFL_FEM)
4966             && (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
4967                 if (!
4968                     (wlc_hw->boardrev >= 0x1250
4969                      && (wlc_hw->boardflags & BFL_FEM_BT)))
4970                         ai_epa_4313war(wlc_hw->sih);
4971         }
4972 }
4973
4974 static int brcms_b_up_prep(struct brcms_hardware *wlc_hw)
4975 {
4976         brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4977
4978         /*
4979          * Enable pll and xtal, initialize the power control registers,
4980          * and force fastclock for the remainder of brcms_c_up().
4981          */
4982         brcms_b_xtal(wlc_hw, ON);
4983         ai_clkctl_init(wlc_hw->sih);
4984         brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4985
4986         /*
4987          * Configure pci/pcmcia here instead of in brcms_c_attach()
4988          * to allow mfg hotswap:  down, hotswap (chip power cycle), up.
4989          */
4990         bcma_core_pci_irq_ctl(&wlc_hw->d11core->bus->drv_pci[0], wlc_hw->d11core,
4991                               true);
4992
4993         /*
4994          * Need to read the hwradio status here to cover the case where the
4995          * system is loaded with the hw radio disabled. We do not want to
4996          * bring the driver up in this case.
4997          */
4998         if (brcms_b_radio_read_hwdisabled(wlc_hw)) {
4999                 /* put SB PCI in down state again */
5000                 ai_pci_down(wlc_hw->sih);
5001                 brcms_b_xtal(wlc_hw, OFF);
5002                 return -ENOMEDIUM;
5003         }
5004
5005         ai_pci_up(wlc_hw->sih);
5006
5007         /* reset the d11 core */
5008         brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
5009
5010         return 0;
5011 }
5012
5013 static int brcms_b_up_finish(struct brcms_hardware *wlc_hw)
5014 {
5015         wlc_hw->up = true;
5016         wlc_phy_hw_state_upd(wlc_hw->band->pi, true);
5017
5018         /* FULLY enable dynamic power control and d11 core interrupt */
5019         brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
5020         brcms_intrson(wlc_hw->wlc->wl);
5021         return 0;
5022 }
5023
5024 /*
5025  * Write WME tunable parameters for retransmit/max rate
5026  * from wlc struct to ucode
5027  */
5028 static void brcms_c_wme_retries_write(struct brcms_c_info *wlc)
5029 {
5030         int ac;
5031
5032         /* Need clock to do this */
5033         if (!wlc->clk)
5034                 return;
5035
5036         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
5037                 brcms_b_write_shm(wlc->hw, M_AC_TXLMT_ADDR(ac),
5038                                   wlc->wme_retries[ac]);
5039 }
5040
5041 /* make interface operational */
5042 int brcms_c_up(struct brcms_c_info *wlc)
5043 {
5044         struct ieee80211_channel *ch;
5045
5046         brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5047
5048         /* HW is turned off so don't try to access it */
5049         if (wlc->pub->hw_off || brcms_deviceremoved(wlc))
5050                 return -ENOMEDIUM;
5051
5052         if (!wlc->pub->hw_up) {
5053                 brcms_b_hw_up(wlc->hw);
5054                 wlc->pub->hw_up = true;
5055         }
5056
5057         if ((wlc->pub->boardflags & BFL_FEM)
5058             && (ai_get_chip_id(wlc->hw->sih) == BCMA_CHIP_ID_BCM4313)) {
5059                 if (wlc->pub->boardrev >= 0x1250
5060                     && (wlc->pub->boardflags & BFL_FEM_BT))
5061                         brcms_b_mhf(wlc->hw, MHF5, MHF5_4313_GPIOCTRL,
5062                                 MHF5_4313_GPIOCTRL, BRCM_BAND_ALL);
5063                 else
5064                         brcms_b_mhf(wlc->hw, MHF4, MHF4_EXTPA_ENABLE,
5065                                     MHF4_EXTPA_ENABLE, BRCM_BAND_ALL);
5066         }
5067
5068         /*
5069          * Need to read the hwradio status here to cover the case where the
5070          * system is loaded with the hw radio disabled. We do not want to bring
5071          * the driver up in this case. If radio is disabled, abort up, lower
5072          * power, start radio timer and return 0(for NDIS) don't call
5073          * radio_update to avoid looping brcms_c_up.
5074          *
5075          * brcms_b_up_prep() returns either 0 or -BCME_RADIOOFF only
5076          */
5077         if (!wlc->pub->radio_disabled) {
5078                 int status = brcms_b_up_prep(wlc->hw);
5079                 if (status == -ENOMEDIUM) {
5080                         if (!mboolisset
5081                             (wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE)) {
5082                                 struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
5083                                 mboolset(wlc->pub->radio_disabled,
5084                                          WL_RADIO_HW_DISABLE);
5085
5086                                 if (bsscfg->enable && bsscfg->BSS)
5087                                         brcms_err(wlc->hw->d11core,
5088                                                   "wl%d: up: rfdisable -> "
5089                                                   "bsscfg_disable()\n",
5090                                                    wlc->pub->unit);
5091                         }
5092                 }
5093         }
5094
5095         if (wlc->pub->radio_disabled) {
5096                 brcms_c_radio_monitor_start(wlc);
5097                 return 0;
5098         }
5099
5100         /* brcms_b_up_prep has done brcms_c_corereset(). so clk is on, set it */
5101         wlc->clk = true;
5102
5103         brcms_c_radio_monitor_stop(wlc);
5104
5105         /* Set EDCF hostflags */
5106         brcms_b_mhf(wlc->hw, MHF1, MHF1_EDCF, MHF1_EDCF, BRCM_BAND_ALL);
5107
5108         brcms_init(wlc->wl);
5109         wlc->pub->up = true;
5110
5111         if (wlc->bandinit_pending) {
5112                 ch = wlc->pub->ieee_hw->conf.channel;
5113                 brcms_c_suspend_mac_and_wait(wlc);
5114                 brcms_c_set_chanspec(wlc, ch20mhz_chspec(ch->hw_value));
5115                 wlc->bandinit_pending = false;
5116                 brcms_c_enable_mac(wlc);
5117         }
5118
5119         brcms_b_up_finish(wlc->hw);
5120
5121         /* Program the TX wme params with the current settings */
5122         brcms_c_wme_retries_write(wlc);
5123
5124         /* start one second watchdog timer */
5125         brcms_add_timer(wlc->wdtimer, TIMER_INTERVAL_WATCHDOG, true);
5126         wlc->WDarmed = true;
5127
5128         /* ensure antenna config is up to date */
5129         brcms_c_stf_phy_txant_upd(wlc);
5130         /* ensure LDPC config is in sync */
5131         brcms_c_ht_update_ldpc(wlc, wlc->stf->ldpc);
5132
5133         return 0;
5134 }
5135
5136 static uint brcms_c_down_del_timer(struct brcms_c_info *wlc)
5137 {
5138         uint callbacks = 0;
5139
5140         return callbacks;
5141 }
5142
5143 static int brcms_b_bmac_down_prep(struct brcms_hardware *wlc_hw)
5144 {
5145         bool dev_gone;
5146         uint callbacks = 0;
5147
5148         if (!wlc_hw->up)
5149                 return callbacks;
5150
5151         dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5152
5153         /* disable interrupts */
5154         if (dev_gone)
5155                 wlc_hw->wlc->macintmask = 0;
5156         else {
5157                 /* now disable interrupts */
5158                 brcms_intrsoff(wlc_hw->wlc->wl);
5159
5160                 /* ensure we're running on the pll clock again */
5161                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
5162         }
5163         /* down phy at the last of this stage */
5164         callbacks += wlc_phy_down(wlc_hw->band->pi);
5165
5166         return callbacks;
5167 }
5168
5169 static int brcms_b_down_finish(struct brcms_hardware *wlc_hw)
5170 {
5171         uint callbacks = 0;
5172         bool dev_gone;
5173
5174         if (!wlc_hw->up)
5175                 return callbacks;
5176
5177         wlc_hw->up = false;
5178         wlc_phy_hw_state_upd(wlc_hw->band->pi, false);
5179
5180         dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5181
5182         if (dev_gone) {
5183                 wlc_hw->sbclk = false;
5184                 wlc_hw->clk = false;
5185                 wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
5186
5187                 /* reclaim any posted packets */
5188                 brcms_c_flushqueues(wlc_hw->wlc);
5189         } else {
5190
5191                 /* Reset and disable the core */
5192                 if (bcma_core_is_enabled(wlc_hw->d11core)) {
5193                         if (bcma_read32(wlc_hw->d11core,
5194                                         D11REGOFFS(maccontrol)) & MCTL_EN_MAC)
5195                                 brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
5196                         callbacks += brcms_reset(wlc_hw->wlc->wl);
5197                         brcms_c_coredisable(wlc_hw);
5198                 }
5199
5200                 /* turn off primary xtal and pll */
5201                 if (!wlc_hw->noreset) {
5202                         ai_pci_down(wlc_hw->sih);
5203                         brcms_b_xtal(wlc_hw, OFF);
5204                 }
5205         }
5206
5207         return callbacks;
5208 }
5209
5210 /*
5211  * Mark the interface nonoperational, stop the software mechanisms,
5212  * disable the hardware, free any transient buffer state.
5213  * Return a count of the number of driver callbacks still pending.
5214  */
5215 uint brcms_c_down(struct brcms_c_info *wlc)
5216 {
5217
5218         uint callbacks = 0;
5219         int i;
5220         bool dev_gone = false;
5221
5222         brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5223
5224         /* check if we are already in the going down path */
5225         if (wlc->going_down) {
5226                 brcms_err(wlc->hw->d11core,
5227                           "wl%d: %s: Driver going down so return\n",
5228                           wlc->pub->unit, __func__);
5229                 return 0;
5230         }
5231         if (!wlc->pub->up)
5232                 return callbacks;
5233
5234         wlc->going_down = true;
5235
5236         callbacks += brcms_b_bmac_down_prep(wlc->hw);
5237
5238         dev_gone = brcms_deviceremoved(wlc);
5239
5240         /* Call any registered down handlers */
5241         for (i = 0; i < BRCMS_MAXMODULES; i++) {
5242                 if (wlc->modulecb[i].down_fn)
5243                         callbacks +=
5244                             wlc->modulecb[i].down_fn(wlc->modulecb[i].hdl);
5245         }
5246
5247         /* cancel the watchdog timer */
5248         if (wlc->WDarmed) {
5249                 if (!brcms_del_timer(wlc->wdtimer))
5250                         callbacks++;
5251                 wlc->WDarmed = false;
5252         }
5253         /* cancel all other timers */
5254         callbacks += brcms_c_down_del_timer(wlc);
5255
5256         wlc->pub->up = false;
5257
5258         wlc_phy_mute_upd(wlc->band->pi, false, PHY_MUTE_ALL);
5259
5260         callbacks += brcms_b_down_finish(wlc->hw);
5261
5262         /* brcms_b_down_finish has done brcms_c_coredisable(). so clk is off */
5263         wlc->clk = false;
5264
5265         wlc->going_down = false;
5266         return callbacks;
5267 }
5268
5269 /* Set the current gmode configuration */
5270 int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config)
5271 {
5272         int ret = 0;
5273         uint i;
5274         struct brcms_c_rateset rs;
5275         /* Default to 54g Auto */
5276         /* Advertise and use shortslot (-1/0/1 Auto/Off/On) */
5277         s8 shortslot = BRCMS_SHORTSLOT_AUTO;
5278         bool shortslot_restrict = false; /* Restrict association to stations
5279                                           * that support shortslot
5280                                           */
5281         bool ofdm_basic = false;        /* Make 6, 12, and 24 basic rates */
5282         /* Advertise and use short preambles (-1/0/1 Auto/Off/On) */
5283         int preamble = BRCMS_PLCP_LONG;
5284         bool preamble_restrict = false; /* Restrict association to stations
5285                                          * that support short preambles
5286                                          */
5287         struct brcms_band *band;
5288
5289         /* if N-support is enabled, allow Gmode set as long as requested
5290          * Gmode is not GMODE_LEGACY_B
5291          */
5292         if ((wlc->pub->_n_enab & SUPPORT_11N) && gmode == GMODE_LEGACY_B)
5293                 return -ENOTSUPP;
5294
5295         /* verify that we are dealing with 2G band and grab the band pointer */
5296         if (wlc->band->bandtype == BRCM_BAND_2G)
5297                 band = wlc->band;
5298         else if ((wlc->pub->_nbands > 1) &&
5299                  (wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype == BRCM_BAND_2G))
5300                 band = wlc->bandstate[OTHERBANDUNIT(wlc)];
5301         else
5302                 return -EINVAL;
5303
5304         /* update configuration value */
5305         if (config)
5306                 brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER, gmode);
5307
5308         /* Clear rateset override */
5309         memset(&rs, 0, sizeof(struct brcms_c_rateset));
5310
5311         switch (gmode) {
5312         case GMODE_LEGACY_B:
5313                 shortslot = BRCMS_SHORTSLOT_OFF;
5314                 brcms_c_rateset_copy(&gphy_legacy_rates, &rs);
5315
5316                 break;
5317
5318         case GMODE_LRS:
5319                 break;
5320
5321         case GMODE_AUTO:
5322                 /* Accept defaults */
5323                 break;
5324
5325         case GMODE_ONLY:
5326                 ofdm_basic = true;
5327                 preamble = BRCMS_PLCP_SHORT;
5328                 preamble_restrict = true;
5329                 break;
5330
5331         case GMODE_PERFORMANCE:
5332                 shortslot = BRCMS_SHORTSLOT_ON;
5333                 shortslot_restrict = true;
5334                 ofdm_basic = true;
5335                 preamble = BRCMS_PLCP_SHORT;
5336                 preamble_restrict = true;
5337                 break;
5338
5339         default:
5340                 /* Error */
5341                 brcms_err(wlc->hw->d11core, "wl%d: %s: invalid gmode %d\n",
5342                           wlc->pub->unit, __func__, gmode);
5343                 return -ENOTSUPP;
5344         }
5345
5346         band->gmode = gmode;
5347
5348         wlc->shortslot_override = shortslot;
5349
5350         /* Use the default 11g rateset */
5351         if (!rs.count)
5352                 brcms_c_rateset_copy(&cck_ofdm_rates, &rs);
5353
5354         if (ofdm_basic) {
5355                 for (i = 0; i < rs.count; i++) {
5356                         if (rs.rates[i] == BRCM_RATE_6M
5357                             || rs.rates[i] == BRCM_RATE_12M
5358                             || rs.rates[i] == BRCM_RATE_24M)
5359                                 rs.rates[i] |= BRCMS_RATE_FLAG;
5360                 }
5361         }
5362
5363         /* Set default bss rateset */
5364         wlc->default_bss->rateset.count = rs.count;
5365         memcpy(wlc->default_bss->rateset.rates, rs.rates,
5366                sizeof(wlc->default_bss->rateset.rates));
5367
5368         return ret;
5369 }
5370
5371 int brcms_c_set_nmode(struct brcms_c_info *wlc)
5372 {
5373         uint i;
5374         s32 nmode = AUTO;
5375
5376         if (wlc->stf->txstreams == WL_11N_3x3)
5377                 nmode = WL_11N_3x3;
5378         else
5379                 nmode = WL_11N_2x2;
5380
5381         /* force GMODE_AUTO if NMODE is ON */
5382         brcms_c_set_gmode(wlc, GMODE_AUTO, true);
5383         if (nmode == WL_11N_3x3)
5384                 wlc->pub->_n_enab = SUPPORT_HT;
5385         else
5386                 wlc->pub->_n_enab = SUPPORT_11N;
5387         wlc->default_bss->flags |= BRCMS_BSS_HT;
5388         /* add the mcs rates to the default and hw ratesets */
5389         brcms_c_rateset_mcs_build(&wlc->default_bss->rateset,
5390                               wlc->stf->txstreams);
5391         for (i = 0; i < wlc->pub->_nbands; i++)
5392                 memcpy(wlc->bandstate[i]->hw_rateset.mcs,
5393                        wlc->default_bss->rateset.mcs, MCSSET_LEN);
5394
5395         return 0;
5396 }
5397
5398 static int
5399 brcms_c_set_internal_rateset(struct brcms_c_info *wlc,
5400                              struct brcms_c_rateset *rs_arg)
5401 {
5402         struct brcms_c_rateset rs, new;
5403         uint bandunit;
5404
5405         memcpy(&rs, rs_arg, sizeof(struct brcms_c_rateset));
5406
5407         /* check for bad count value */
5408         if ((rs.count == 0) || (rs.count > BRCMS_NUMRATES))
5409                 return -EINVAL;
5410
5411         /* try the current band */
5412         bandunit = wlc->band->bandunit;
5413         memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5414         if (brcms_c_rate_hwrs_filter_sort_validate
5415             (&new, &wlc->bandstate[bandunit]->hw_rateset, true,
5416              wlc->stf->txstreams))
5417                 goto good;
5418
5419         /* try the other band */
5420         if (brcms_is_mband_unlocked(wlc)) {
5421                 bandunit = OTHERBANDUNIT(wlc);
5422                 memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5423                 if (brcms_c_rate_hwrs_filter_sort_validate(&new,
5424                                                        &wlc->
5425                                                        bandstate[bandunit]->
5426                                                        hw_rateset, true,
5427                                                        wlc->stf->txstreams))
5428                         goto good;
5429         }
5430
5431         return -EBADE;
5432
5433  good:
5434         /* apply new rateset */
5435         memcpy(&wlc->default_bss->rateset, &new,
5436                sizeof(struct brcms_c_rateset));
5437         memcpy(&wlc->bandstate[bandunit]->defrateset, &new,
5438                sizeof(struct brcms_c_rateset));
5439         return 0;
5440 }
5441
5442 static void brcms_c_ofdm_rateset_war(struct brcms_c_info *wlc)
5443 {
5444         u8 r;
5445         bool war = false;
5446
5447         if (wlc->bsscfg->associated)
5448                 r = wlc->bsscfg->current_bss->rateset.rates[0];
5449         else
5450                 r = wlc->default_bss->rateset.rates[0];
5451
5452         wlc_phy_ofdm_rateset_war(wlc->band->pi, war);
5453 }
5454
5455 int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel)
5456 {
5457         u16 chspec = ch20mhz_chspec(channel);
5458
5459         if (channel < 0 || channel > MAXCHANNEL)
5460                 return -EINVAL;
5461
5462         if (!brcms_c_valid_chanspec_db(wlc->cmi, chspec))
5463                 return -EINVAL;
5464
5465
5466         if (!wlc->pub->up && brcms_is_mband_unlocked(wlc)) {
5467                 if (wlc->band->bandunit != chspec_bandunit(chspec))
5468                         wlc->bandinit_pending = true;
5469                 else
5470                         wlc->bandinit_pending = false;
5471         }
5472
5473         wlc->default_bss->chanspec = chspec;
5474         /* brcms_c_BSSinit() will sanitize the rateset before
5475          * using it.. */
5476         if (wlc->pub->up && (wlc_phy_chanspec_get(wlc->band->pi) != chspec)) {
5477                 brcms_c_set_home_chanspec(wlc, chspec);
5478                 brcms_c_suspend_mac_and_wait(wlc);
5479                 brcms_c_set_chanspec(wlc, chspec);
5480                 brcms_c_enable_mac(wlc);
5481         }
5482         return 0;
5483 }
5484
5485 int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl)
5486 {
5487         int ac;
5488
5489         if (srl < 1 || srl > RETRY_SHORT_MAX ||
5490             lrl < 1 || lrl > RETRY_SHORT_MAX)
5491                 return -EINVAL;
5492
5493         wlc->SRL = srl;
5494         wlc->LRL = lrl;
5495
5496         brcms_b_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
5497
5498         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
5499                 wlc->wme_retries[ac] =  SFIELD(wlc->wme_retries[ac],
5500                                                EDCF_SHORT,  wlc->SRL);
5501                 wlc->wme_retries[ac] =  SFIELD(wlc->wme_retries[ac],
5502                                                EDCF_LONG, wlc->LRL);
5503         }
5504         brcms_c_wme_retries_write(wlc);
5505
5506         return 0;
5507 }
5508
5509 void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
5510                                  struct brcm_rateset *currs)
5511 {
5512         struct brcms_c_rateset *rs;
5513
5514         if (wlc->pub->associated)
5515                 rs = &wlc->bsscfg->current_bss->rateset;
5516         else
5517                 rs = &wlc->default_bss->rateset;
5518
5519         /* Copy only legacy rateset section */
5520         currs->count = rs->count;
5521         memcpy(&currs->rates, &rs->rates, rs->count);
5522 }
5523
5524 int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
5525 {
5526         struct brcms_c_rateset internal_rs;
5527         int bcmerror;
5528
5529         if (rs->count > BRCMS_NUMRATES)
5530                 return -ENOBUFS;
5531
5532         memset(&internal_rs, 0, sizeof(struct brcms_c_rateset));
5533
5534         /* Copy only legacy rateset section */
5535         internal_rs.count = rs->count;
5536         memcpy(&internal_rs.rates, &rs->rates, internal_rs.count);
5537
5538         /* merge rateset coming in with the current mcsset */
5539         if (wlc->pub->_n_enab & SUPPORT_11N) {
5540                 struct brcms_bss_info *mcsset_bss;
5541                 if (wlc->bsscfg->associated)
5542                         mcsset_bss = wlc->bsscfg->current_bss;
5543                 else
5544                         mcsset_bss = wlc->default_bss;
5545                 memcpy(internal_rs.mcs, &mcsset_bss->rateset.mcs[0],
5546                        MCSSET_LEN);
5547         }
5548
5549         bcmerror = brcms_c_set_internal_rateset(wlc, &internal_rs);
5550         if (!bcmerror)
5551                 brcms_c_ofdm_rateset_war(wlc);
5552
5553         return bcmerror;
5554 }
5555
5556 int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
5557 {
5558         if (period < DOT11_MIN_BEACON_PERIOD ||
5559             period > DOT11_MAX_BEACON_PERIOD)
5560                 return -EINVAL;
5561
5562         wlc->default_bss->beacon_period = period;
5563         return 0;
5564 }
5565
5566 u16 brcms_c_get_phy_type(struct brcms_c_info *wlc, int phyidx)
5567 {
5568         return wlc->band->phytype;
5569 }
5570
5571 void brcms_c_set_shortslot_override(struct brcms_c_info *wlc, s8 sslot_override)
5572 {
5573         wlc->shortslot_override = sslot_override;
5574
5575         /*
5576          * shortslot is an 11g feature, so no more work if we are
5577          * currently on the 5G band
5578          */
5579         if (wlc->band->bandtype == BRCM_BAND_5G)
5580                 return;
5581
5582         if (wlc->pub->up && wlc->pub->associated) {
5583                 /* let watchdog or beacon processing update shortslot */
5584         } else if (wlc->pub->up) {
5585                 /* unassociated shortslot is off */
5586                 brcms_c_switch_shortslot(wlc, false);
5587         } else {
5588                 /* driver is down, so just update the brcms_c_info
5589                  * value */
5590                 if (wlc->shortslot_override == BRCMS_SHORTSLOT_AUTO)
5591                         wlc->shortslot = false;
5592                 else
5593                         wlc->shortslot =
5594                             (wlc->shortslot_override ==
5595                              BRCMS_SHORTSLOT_ON);
5596         }
5597 }
5598
5599 /*
5600  * register watchdog and down handlers.
5601  */
5602 int brcms_c_module_register(struct brcms_pub *pub,
5603                             const char *name, struct brcms_info *hdl,
5604                             int (*d_fn)(void *handle))
5605 {
5606         struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5607         int i;
5608
5609         /* find an empty entry and just add, no duplication check! */
5610         for (i = 0; i < BRCMS_MAXMODULES; i++) {
5611                 if (wlc->modulecb[i].name[0] == '\0') {
5612                         strncpy(wlc->modulecb[i].name, name,
5613                                 sizeof(wlc->modulecb[i].name) - 1);
5614                         wlc->modulecb[i].hdl = hdl;
5615                         wlc->modulecb[i].down_fn = d_fn;
5616                         return 0;
5617                 }
5618         }
5619
5620         return -ENOSR;
5621 }
5622
5623 /* unregister module callbacks */
5624 int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
5625                               struct brcms_info *hdl)
5626 {
5627         struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5628         int i;
5629
5630         if (wlc == NULL)
5631                 return -ENODATA;
5632
5633         for (i = 0; i < BRCMS_MAXMODULES; i++) {
5634                 if (!strcmp(wlc->modulecb[i].name, name) &&
5635                     (wlc->modulecb[i].hdl == hdl)) {
5636                         memset(&wlc->modulecb[i], 0, sizeof(struct modulecb));
5637                         return 0;
5638                 }
5639         }
5640
5641         /* table not found! */
5642         return -ENODATA;
5643 }
5644
5645 static bool brcms_c_chipmatch_pci(struct bcma_device *core)
5646 {
5647         struct pci_dev *pcidev = core->bus->host_pci;
5648         u16 vendor = pcidev->vendor;
5649         u16 device = pcidev->device;
5650
5651         if (vendor != PCI_VENDOR_ID_BROADCOM) {
5652                 pr_err("unknown vendor id %04x\n", vendor);
5653                 return false;
5654         }
5655
5656         if (device == BCM43224_D11N_ID_VEN1)
5657                 return true;
5658         if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
5659                 return true;
5660         if (device == BCM4313_D11N2G_ID)
5661                 return true;
5662         if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
5663                 return true;
5664
5665         pr_err("unknown device id %04x\n", device);
5666         return false;
5667 }
5668
5669 static bool brcms_c_chipmatch_soc(struct bcma_device *core)
5670 {
5671         struct bcma_chipinfo *chipinfo = &core->bus->chipinfo;
5672
5673         if (chipinfo->id == BCMA_CHIP_ID_BCM4716)
5674                 return true;
5675
5676         pr_err("unknown chip id %04x\n", chipinfo->id);
5677         return false;
5678 }
5679
5680 bool brcms_c_chipmatch(struct bcma_device *core)
5681 {
5682         switch (core->bus->hosttype) {
5683         case BCMA_HOSTTYPE_PCI:
5684                 return brcms_c_chipmatch_pci(core);
5685         case BCMA_HOSTTYPE_SOC:
5686                 return brcms_c_chipmatch_soc(core);
5687         default:
5688                 pr_err("unknown host type: %i\n", core->bus->hosttype);
5689                 return false;
5690         }
5691 }
5692
5693 u16 brcms_b_rate_shm_offset(struct brcms_hardware *wlc_hw, u8 rate)
5694 {
5695         u16 table_ptr;
5696         u8 phy_rate, index;
5697
5698         /* get the phy specific rate encoding for the PLCP SIGNAL field */
5699         if (is_ofdm_rate(rate))
5700                 table_ptr = M_RT_DIRMAP_A;
5701         else
5702                 table_ptr = M_RT_DIRMAP_B;
5703
5704         /* for a given rate, the LS-nibble of the PLCP SIGNAL field is
5705          * the index into the rate table.
5706          */
5707         phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
5708         index = phy_rate & 0xf;
5709
5710         /* Find the SHM pointer to the rate table entry by looking in the
5711          * Direct-map Table
5712          */
5713         return 2 * brcms_b_read_shm(wlc_hw, table_ptr + (index * 2));
5714 }
5715
5716 /*
5717  * bcmc_fid_generate:
5718  * Generate frame ID for a BCMC packet.  The frag field is not used
5719  * for MC frames so is used as part of the sequence number.
5720  */
5721 static inline u16
5722 bcmc_fid_generate(struct brcms_c_info *wlc, struct brcms_bss_cfg *bsscfg,
5723                   struct d11txh *txh)
5724 {
5725         u16 frameid;
5726
5727         frameid = le16_to_cpu(txh->TxFrameID) & ~(TXFID_SEQ_MASK |
5728                                                   TXFID_QUEUE_MASK);
5729         frameid |=
5730             (((wlc->
5731                mc_fid_counter++) << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
5732             TX_BCMC_FIFO;
5733
5734         return frameid;
5735 }
5736
5737 static uint
5738 brcms_c_calc_ack_time(struct brcms_c_info *wlc, u32 rspec,
5739                       u8 preamble_type)
5740 {
5741         uint dur = 0;
5742
5743         /*
5744          * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5745          * is less than or equal to the rate of the immediately previous
5746          * frame in the FES
5747          */
5748         rspec = brcms_basic_rate(wlc, rspec);
5749         /* ACK frame len == 14 == 2(fc) + 2(dur) + 6(ra) + 4(fcs) */
5750         dur =
5751             brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5752                                 (DOT11_ACK_LEN + FCS_LEN));
5753         return dur;
5754 }
5755
5756 static uint
5757 brcms_c_calc_cts_time(struct brcms_c_info *wlc, u32 rspec,
5758                       u8 preamble_type)
5759 {
5760         return brcms_c_calc_ack_time(wlc, rspec, preamble_type);
5761 }
5762
5763 static uint
5764 brcms_c_calc_ba_time(struct brcms_c_info *wlc, u32 rspec,
5765                      u8 preamble_type)
5766 {
5767         /*
5768          * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5769          * is less than or equal to the rate of the immediately previous
5770          * frame in the FES
5771          */
5772         rspec = brcms_basic_rate(wlc, rspec);
5773         /* BA len == 32 == 16(ctl hdr) + 4(ba len) + 8(bitmap) + 4(fcs) */
5774         return brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5775                                    (DOT11_BA_LEN + DOT11_BA_BITMAP_LEN +
5776                                     FCS_LEN));
5777 }
5778
5779 /* brcms_c_compute_frame_dur()
5780  *
5781  * Calculate the 802.11 MAC header DUR field for MPDU
5782  * DUR for a single frame = 1 SIFS + 1 ACK
5783  * DUR for a frame with following frags = 3 SIFS + 2 ACK + next frag time
5784  *
5785  * rate                 MPDU rate in unit of 500kbps
5786  * next_frag_len        next MPDU length in bytes
5787  * preamble_type        use short/GF or long/MM PLCP header
5788  */
5789 static u16
5790 brcms_c_compute_frame_dur(struct brcms_c_info *wlc, u32 rate,
5791                       u8 preamble_type, uint next_frag_len)
5792 {
5793         u16 dur, sifs;
5794
5795         sifs = get_sifs(wlc->band);
5796
5797         dur = sifs;
5798         dur += (u16) brcms_c_calc_ack_time(wlc, rate, preamble_type);
5799
5800         if (next_frag_len) {
5801                 /* Double the current DUR to get 2 SIFS + 2 ACKs */
5802                 dur *= 2;
5803                 /* add another SIFS and the frag time */
5804                 dur += sifs;
5805                 dur +=
5806                     (u16) brcms_c_calc_frame_time(wlc, rate, preamble_type,
5807                                                  next_frag_len);
5808         }
5809         return dur;
5810 }
5811
5812 /* The opposite of brcms_c_calc_frame_time */
5813 static uint
5814 brcms_c_calc_frame_len(struct brcms_c_info *wlc, u32 ratespec,
5815                    u8 preamble_type, uint dur)
5816 {
5817         uint nsyms, mac_len, Ndps, kNdps;
5818         uint rate = rspec2rate(ratespec);
5819
5820         if (is_mcs_rate(ratespec)) {
5821                 uint mcs = ratespec & RSPEC_RATE_MASK;
5822                 int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
5823                 dur -= PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
5824                 /* payload calculation matches that of regular ofdm */
5825                 if (wlc->band->bandtype == BRCM_BAND_2G)
5826                         dur -= DOT11_OFDM_SIGNAL_EXTENSION;
5827                 /* kNdbps = kbps * 4 */
5828                 kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
5829                                    rspec_issgi(ratespec)) * 4;
5830                 nsyms = dur / APHY_SYMBOL_TIME;
5831                 mac_len =
5832                     ((nsyms * kNdps) -
5833                      ((APHY_SERVICE_NBITS + APHY_TAIL_NBITS) * 1000)) / 8000;
5834         } else if (is_ofdm_rate(ratespec)) {
5835                 dur -= APHY_PREAMBLE_TIME;
5836                 dur -= APHY_SIGNAL_TIME;
5837                 /* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
5838                 Ndps = rate * 2;
5839                 nsyms = dur / APHY_SYMBOL_TIME;
5840                 mac_len =
5841                     ((nsyms * Ndps) -
5842                      (APHY_SERVICE_NBITS + APHY_TAIL_NBITS)) / 8;
5843         } else {
5844                 if (preamble_type & BRCMS_SHORT_PREAMBLE)
5845                         dur -= BPHY_PLCP_SHORT_TIME;
5846                 else
5847                         dur -= BPHY_PLCP_TIME;
5848                 mac_len = dur * rate;
5849                 /* divide out factor of 2 in rate (1/2 mbps) */
5850                 mac_len = mac_len / 8 / 2;
5851         }
5852         return mac_len;
5853 }
5854
5855 /*
5856  * Return true if the specified rate is supported by the specified band.
5857  * BRCM_BAND_AUTO indicates the current band.
5858  */
5859 static bool brcms_c_valid_rate(struct brcms_c_info *wlc, u32 rspec, int band,
5860                     bool verbose)
5861 {
5862         struct brcms_c_rateset *hw_rateset;
5863         uint i;
5864
5865         if ((band == BRCM_BAND_AUTO) || (band == wlc->band->bandtype))
5866                 hw_rateset = &wlc->band->hw_rateset;
5867         else if (wlc->pub->_nbands > 1)
5868                 hw_rateset = &wlc->bandstate[OTHERBANDUNIT(wlc)]->hw_rateset;
5869         else
5870                 /* other band specified and we are a single band device */
5871                 return false;
5872
5873         /* check if this is a mimo rate */
5874         if (is_mcs_rate(rspec)) {
5875                 if ((rspec & RSPEC_RATE_MASK) >= MCS_TABLE_SIZE)
5876                         goto error;
5877
5878                 return isset(hw_rateset->mcs, (rspec & RSPEC_RATE_MASK));
5879         }
5880
5881         for (i = 0; i < hw_rateset->count; i++)
5882                 if (hw_rateset->rates[i] == rspec2rate(rspec))
5883                         return true;
5884  error:
5885         if (verbose)
5886                 brcms_err(wlc->hw->d11core, "wl%d: valid_rate: rate spec 0x%x "
5887                           "not in hw_rateset\n", wlc->pub->unit, rspec);
5888
5889         return false;
5890 }
5891
5892 static u32
5893 mac80211_wlc_set_nrate(struct brcms_c_info *wlc, struct brcms_band *cur_band,
5894                        u32 int_val)
5895 {
5896         struct bcma_device *core = wlc->hw->d11core;
5897         u8 stf = (int_val & NRATE_STF_MASK) >> NRATE_STF_SHIFT;
5898         u8 rate = int_val & NRATE_RATE_MASK;
5899         u32 rspec;
5900         bool ismcs = ((int_val & NRATE_MCS_INUSE) == NRATE_MCS_INUSE);
5901         bool issgi = ((int_val & NRATE_SGI_MASK) >> NRATE_SGI_SHIFT);
5902         bool override_mcs_only = ((int_val & NRATE_OVERRIDE_MCS_ONLY)
5903                                   == NRATE_OVERRIDE_MCS_ONLY);
5904         int bcmerror = 0;
5905
5906         if (!ismcs)
5907                 return (u32) rate;
5908
5909         /* validate the combination of rate/mcs/stf is allowed */
5910         if ((wlc->pub->_n_enab & SUPPORT_11N) && ismcs) {
5911                 /* mcs only allowed when nmode */
5912                 if (stf > PHY_TXC1_MODE_SDM) {
5913                         brcms_err(core, "wl%d: %s: Invalid stf\n",
5914                                   wlc->pub->unit, __func__);
5915                         bcmerror = -EINVAL;
5916                         goto done;
5917                 }
5918
5919                 /* mcs 32 is a special case, DUP mode 40 only */
5920                 if (rate == 32) {
5921                         if (!CHSPEC_IS40(wlc->home_chanspec) ||
5922                             ((stf != PHY_TXC1_MODE_SISO)
5923                              && (stf != PHY_TXC1_MODE_CDD))) {
5924                                 brcms_err(core, "wl%d: %s: Invalid mcs 32\n",
5925                                           wlc->pub->unit, __func__);
5926                                 bcmerror = -EINVAL;
5927                                 goto done;
5928                         }
5929                         /* mcs > 7 must use stf SDM */
5930                 } else if (rate > HIGHEST_SINGLE_STREAM_MCS) {
5931                         /* mcs > 7 must use stf SDM */
5932                         if (stf != PHY_TXC1_MODE_SDM) {
5933                                 brcms_dbg_mac80211(core, "wl%d: enabling "
5934                                                    "SDM mode for mcs %d\n",
5935                                                    wlc->pub->unit, rate);
5936                                 stf = PHY_TXC1_MODE_SDM;
5937                         }
5938                 } else {
5939                         /*
5940                          * MCS 0-7 may use SISO, CDD, and for
5941                          * phy_rev >= 3 STBC
5942                          */
5943                         if ((stf > PHY_TXC1_MODE_STBC) ||
5944                             (!BRCMS_STBC_CAP_PHY(wlc)
5945                              && (stf == PHY_TXC1_MODE_STBC))) {
5946                                 brcms_err(core, "wl%d: %s: Invalid STBC\n",
5947                                           wlc->pub->unit, __func__);
5948                                 bcmerror = -EINVAL;
5949                                 goto done;
5950                         }
5951                 }
5952         } else if (is_ofdm_rate(rate)) {
5953                 if ((stf != PHY_TXC1_MODE_CDD) && (stf != PHY_TXC1_MODE_SISO)) {
5954                         brcms_err(core, "wl%d: %s: Invalid OFDM\n",
5955                                   wlc->pub->unit, __func__);
5956                         bcmerror = -EINVAL;
5957                         goto done;
5958                 }
5959         } else if (is_cck_rate(rate)) {
5960                 if ((cur_band->bandtype != BRCM_BAND_2G)
5961                     || (stf != PHY_TXC1_MODE_SISO)) {
5962                         brcms_err(core, "wl%d: %s: Invalid CCK\n",
5963                                   wlc->pub->unit, __func__);
5964                         bcmerror = -EINVAL;
5965                         goto done;
5966                 }
5967         } else {
5968                 brcms_err(core, "wl%d: %s: Unknown rate type\n",
5969                           wlc->pub->unit, __func__);
5970                 bcmerror = -EINVAL;
5971                 goto done;
5972         }
5973         /* make sure multiple antennae are available for non-siso rates */
5974         if ((stf != PHY_TXC1_MODE_SISO) && (wlc->stf->txstreams == 1)) {
5975                 brcms_err(core, "wl%d: %s: SISO antenna but !SISO "
5976                           "request\n", wlc->pub->unit, __func__);
5977                 bcmerror = -EINVAL;
5978                 goto done;
5979         }
5980
5981         rspec = rate;
5982         if (ismcs) {
5983                 rspec |= RSPEC_MIMORATE;
5984                 /* For STBC populate the STC field of the ratespec */
5985                 if (stf == PHY_TXC1_MODE_STBC) {
5986                         u8 stc;
5987                         stc = 1;        /* Nss for single stream is always 1 */
5988                         rspec |= (stc << RSPEC_STC_SHIFT);
5989                 }
5990         }
5991
5992         rspec |= (stf << RSPEC_STF_SHIFT);
5993
5994         if (override_mcs_only)
5995                 rspec |= RSPEC_OVERRIDE_MCS_ONLY;
5996
5997         if (issgi)
5998                 rspec |= RSPEC_SHORT_GI;
5999
6000         if ((rate != 0)
6001             && !brcms_c_valid_rate(wlc, rspec, cur_band->bandtype, true))
6002                 return rate;
6003
6004         return rspec;
6005 done:
6006         return rate;
6007 }
6008
6009 /*
6010  * Compute PLCP, but only requires actual rate and length of pkt.
6011  * Rate is given in the driver standard multiple of 500 kbps.
6012  * le is set for 11 Mbps rate if necessary.
6013  * Broken out for PRQ.
6014  */
6015
6016 static void brcms_c_cck_plcp_set(struct brcms_c_info *wlc, int rate_500,
6017                              uint length, u8 *plcp)
6018 {
6019         u16 usec = 0;
6020         u8 le = 0;
6021
6022         switch (rate_500) {
6023         case BRCM_RATE_1M:
6024                 usec = length << 3;
6025                 break;
6026         case BRCM_RATE_2M:
6027                 usec = length << 2;
6028                 break;
6029         case BRCM_RATE_5M5:
6030                 usec = (length << 4) / 11;
6031                 if ((length << 4) - (usec * 11) > 0)
6032                         usec++;
6033                 break;
6034         case BRCM_RATE_11M:
6035                 usec = (length << 3) / 11;
6036                 if ((length << 3) - (usec * 11) > 0) {
6037                         usec++;
6038                         if ((usec * 11) - (length << 3) >= 8)
6039                                 le = D11B_PLCP_SIGNAL_LE;
6040                 }
6041                 break;
6042
6043         default:
6044                 brcms_err(wlc->hw->d11core,
6045                           "brcms_c_cck_plcp_set: unsupported rate %d\n",
6046                           rate_500);
6047                 rate_500 = BRCM_RATE_1M;
6048                 usec = length << 3;
6049                 break;
6050         }
6051         /* PLCP signal byte */
6052         plcp[0] = rate_500 * 5; /* r (500kbps) * 5 == r (100kbps) */
6053         /* PLCP service byte */
6054         plcp[1] = (u8) (le | D11B_PLCP_SIGNAL_LOCKED);
6055         /* PLCP length u16, little endian */
6056         plcp[2] = usec & 0xff;
6057         plcp[3] = (usec >> 8) & 0xff;
6058         /* PLCP CRC16 */
6059         plcp[4] = 0;
6060         plcp[5] = 0;
6061 }
6062
6063 /* Rate: 802.11 rate code, length: PSDU length in octets */
6064 static void brcms_c_compute_mimo_plcp(u32 rspec, uint length, u8 *plcp)
6065 {
6066         u8 mcs = (u8) (rspec & RSPEC_RATE_MASK);
6067         plcp[0] = mcs;
6068         if (rspec_is40mhz(rspec) || (mcs == 32))
6069                 plcp[0] |= MIMO_PLCP_40MHZ;
6070         BRCMS_SET_MIMO_PLCP_LEN(plcp, length);
6071         plcp[3] = rspec_mimoplcp3(rspec); /* rspec already holds this byte */
6072         plcp[3] |= 0x7; /* set smoothing, not sounding ppdu & reserved */
6073         plcp[4] = 0; /* number of extension spatial streams bit 0 & 1 */
6074         plcp[5] = 0;
6075 }
6076
6077 /* Rate: 802.11 rate code, length: PSDU length in octets */
6078 static void
6079 brcms_c_compute_ofdm_plcp(u32 rspec, u32 length, u8 *plcp)
6080 {
6081         u8 rate_signal;
6082         u32 tmp = 0;
6083         int rate = rspec2rate(rspec);
6084
6085         /*
6086          * encode rate per 802.11a-1999 sec 17.3.4.1, with lsb
6087          * transmitted first
6088          */
6089         rate_signal = rate_info[rate] & BRCMS_RATE_MASK;
6090         memset(plcp, 0, D11_PHY_HDR_LEN);
6091         D11A_PHY_HDR_SRATE((struct ofdm_phy_hdr *) plcp, rate_signal);
6092
6093         tmp = (length & 0xfff) << 5;
6094         plcp[2] |= (tmp >> 16) & 0xff;
6095         plcp[1] |= (tmp >> 8) & 0xff;
6096         plcp[0] |= tmp & 0xff;
6097 }
6098
6099 /* Rate: 802.11 rate code, length: PSDU length in octets */
6100 static void brcms_c_compute_cck_plcp(struct brcms_c_info *wlc, u32 rspec,
6101                                  uint length, u8 *plcp)
6102 {
6103         int rate = rspec2rate(rspec);
6104
6105         brcms_c_cck_plcp_set(wlc, rate, length, plcp);
6106 }
6107
6108 static void
6109 brcms_c_compute_plcp(struct brcms_c_info *wlc, u32 rspec,
6110                      uint length, u8 *plcp)
6111 {
6112         if (is_mcs_rate(rspec))
6113                 brcms_c_compute_mimo_plcp(rspec, length, plcp);
6114         else if (is_ofdm_rate(rspec))
6115                 brcms_c_compute_ofdm_plcp(rspec, length, plcp);
6116         else
6117                 brcms_c_compute_cck_plcp(wlc, rspec, length, plcp);
6118 }
6119
6120 /* brcms_c_compute_rtscts_dur()
6121  *
6122  * Calculate the 802.11 MAC header DUR field for an RTS or CTS frame
6123  * DUR for normal RTS/CTS w/ frame = 3 SIFS + 1 CTS + next frame time + 1 ACK
6124  * DUR for CTS-TO-SELF w/ frame    = 2 SIFS         + next frame time + 1 ACK
6125  *
6126  * cts                  cts-to-self or rts/cts
6127  * rts_rate             rts or cts rate in unit of 500kbps
6128  * rate                 next MPDU rate in unit of 500kbps
6129  * frame_len            next MPDU frame length in bytes
6130  */
6131 u16
6132 brcms_c_compute_rtscts_dur(struct brcms_c_info *wlc, bool cts_only,
6133                            u32 rts_rate,
6134                            u32 frame_rate, u8 rts_preamble_type,
6135                            u8 frame_preamble_type, uint frame_len, bool ba)
6136 {
6137         u16 dur, sifs;
6138
6139         sifs = get_sifs(wlc->band);
6140
6141         if (!cts_only) {
6142                 /* RTS/CTS */
6143                 dur = 3 * sifs;
6144                 dur +=
6145                     (u16) brcms_c_calc_cts_time(wlc, rts_rate,
6146                                                rts_preamble_type);
6147         } else {
6148                 /* CTS-TO-SELF */
6149                 dur = 2 * sifs;
6150         }
6151
6152         dur +=
6153             (u16) brcms_c_calc_frame_time(wlc, frame_rate, frame_preamble_type,
6154                                          frame_len);
6155         if (ba)
6156                 dur +=
6157                     (u16) brcms_c_calc_ba_time(wlc, frame_rate,
6158                                               BRCMS_SHORT_PREAMBLE);
6159         else
6160                 dur +=
6161                     (u16) brcms_c_calc_ack_time(wlc, frame_rate,
6162                                                frame_preamble_type);
6163         return dur;
6164 }
6165
6166 static u16 brcms_c_phytxctl1_calc(struct brcms_c_info *wlc, u32 rspec)
6167 {
6168         u16 phyctl1 = 0;
6169         u16 bw;
6170
6171         if (BRCMS_ISLCNPHY(wlc->band)) {
6172                 bw = PHY_TXC1_BW_20MHZ;
6173         } else {
6174                 bw = rspec_get_bw(rspec);
6175                 /* 10Mhz is not supported yet */
6176                 if (bw < PHY_TXC1_BW_20MHZ) {
6177                         brcms_err(wlc->hw->d11core, "phytxctl1_calc: bw %d is "
6178                                   "not supported yet, set to 20L\n", bw);
6179                         bw = PHY_TXC1_BW_20MHZ;
6180                 }
6181         }
6182
6183         if (is_mcs_rate(rspec)) {
6184                 uint mcs = rspec & RSPEC_RATE_MASK;
6185
6186                 /* bw, stf, coding-type is part of rspec_phytxbyte2 returns */
6187                 phyctl1 = rspec_phytxbyte2(rspec);
6188                 /* set the upper byte of phyctl1 */
6189                 phyctl1 |= (mcs_table[mcs].tx_phy_ctl3 << 8);
6190         } else if (is_cck_rate(rspec) && !BRCMS_ISLCNPHY(wlc->band)
6191                    && !BRCMS_ISSSLPNPHY(wlc->band)) {
6192                 /*
6193                  * In CCK mode LPPHY overloads OFDM Modulation bits with CCK
6194                  * Data Rate. Eventually MIMOPHY would also be converted to
6195                  * this format
6196                  */
6197                 /* 0 = 1Mbps; 1 = 2Mbps; 2 = 5.5Mbps; 3 = 11Mbps */
6198                 phyctl1 = (bw | (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6199         } else {                /* legacy OFDM/CCK */
6200                 s16 phycfg;
6201                 /* get the phyctl byte from rate phycfg table */
6202                 phycfg = brcms_c_rate_legacy_phyctl(rspec2rate(rspec));
6203                 if (phycfg == -1) {
6204                         brcms_err(wlc->hw->d11core, "phytxctl1_calc: wrong "
6205                                   "legacy OFDM/CCK rate\n");
6206                         phycfg = 0;
6207                 }
6208                 /* set the upper byte of phyctl1 */
6209                 phyctl1 =
6210                     (bw | (phycfg << 8) |
6211                      (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6212         }
6213         return phyctl1;
6214 }
6215
6216 /*
6217  * Add struct d11txh, struct cck_phy_hdr.
6218  *
6219  * 'p' data must start with 802.11 MAC header
6220  * 'p' must allow enough bytes of local headers to be "pushed" onto the packet
6221  *
6222  * headroom == D11_PHY_HDR_LEN + D11_TXH_LEN (D11_TXH_LEN is now 104 bytes)
6223  *
6224  */
6225 static u16
6226 brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
6227                      struct sk_buff *p, struct scb *scb, uint frag,
6228                      uint nfrags, uint queue, uint next_frag_len)
6229 {
6230         struct ieee80211_hdr *h;
6231         struct d11txh *txh;
6232         u8 *plcp, plcp_fallback[D11_PHY_HDR_LEN];
6233         int len, phylen, rts_phylen;
6234         u16 mch, phyctl, xfts, mainrates;
6235         u16 seq = 0, mcl = 0, status = 0, frameid = 0;
6236         u32 rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6237         u32 rts_rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6238         bool use_rts = false;
6239         bool use_cts = false;
6240         bool use_rifs = false;
6241         bool short_preamble[2] = { false, false };
6242         u8 preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6243         u8 rts_preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6244         u8 *rts_plcp, rts_plcp_fallback[D11_PHY_HDR_LEN];
6245         struct ieee80211_rts *rts = NULL;
6246         bool qos;
6247         uint ac;
6248         bool hwtkmic = false;
6249         u16 mimo_ctlchbw = PHY_TXC1_BW_20MHZ;
6250 #define ANTCFG_NONE 0xFF
6251         u8 antcfg = ANTCFG_NONE;
6252         u8 fbantcfg = ANTCFG_NONE;
6253         uint phyctl1_stf = 0;
6254         u16 durid = 0;
6255         struct ieee80211_tx_rate *txrate[2];
6256         int k;
6257         struct ieee80211_tx_info *tx_info;
6258         bool is_mcs;
6259         u16 mimo_txbw;
6260         u8 mimo_preamble_type;
6261
6262         /* locate 802.11 MAC header */
6263         h = (struct ieee80211_hdr *)(p->data);
6264         qos = ieee80211_is_data_qos(h->frame_control);
6265
6266         /* compute length of frame in bytes for use in PLCP computations */
6267         len = p->len;
6268         phylen = len + FCS_LEN;
6269
6270         /* Get tx_info */
6271         tx_info = IEEE80211_SKB_CB(p);
6272
6273         /* add PLCP */
6274         plcp = skb_push(p, D11_PHY_HDR_LEN);
6275
6276         /* add Broadcom tx descriptor header */
6277         txh = (struct d11txh *) skb_push(p, D11_TXH_LEN);
6278         memset(txh, 0, D11_TXH_LEN);
6279
6280         /* setup frameid */
6281         if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
6282                 /* non-AP STA should never use BCMC queue */
6283                 if (queue == TX_BCMC_FIFO) {
6284                         brcms_err(wlc->hw->d11core,
6285                                   "wl%d: %s: ASSERT queue == TX_BCMC!\n",
6286                                   wlc->pub->unit, __func__);
6287                         frameid = bcmc_fid_generate(wlc, NULL, txh);
6288                 } else {
6289                         /* Increment the counter for first fragment */
6290                         if (tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
6291                                 scb->seqnum[p->priority]++;
6292
6293                         /* extract fragment number from frame first */
6294                         seq = le16_to_cpu(h->seq_ctrl) & FRAGNUM_MASK;
6295                         seq |= (scb->seqnum[p->priority] << SEQNUM_SHIFT);
6296                         h->seq_ctrl = cpu_to_le16(seq);
6297
6298                         frameid = ((seq << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
6299                             (queue & TXFID_QUEUE_MASK);
6300                 }
6301         }
6302         frameid |= queue & TXFID_QUEUE_MASK;
6303
6304         /* set the ignpmq bit for all pkts tx'd in PS mode and for beacons */
6305         if (ieee80211_is_beacon(h->frame_control))
6306                 mcl |= TXC_IGNOREPMQ;
6307
6308         txrate[0] = tx_info->control.rates;
6309         txrate[1] = txrate[0] + 1;
6310
6311         /*
6312          * if rate control algorithm didn't give us a fallback
6313          * rate, use the primary rate
6314          */
6315         if (txrate[1]->idx < 0)
6316                 txrate[1] = txrate[0];
6317
6318         for (k = 0; k < hw->max_rates; k++) {
6319                 is_mcs = txrate[k]->flags & IEEE80211_TX_RC_MCS ? true : false;
6320                 if (!is_mcs) {
6321                         if ((txrate[k]->idx >= 0)
6322                             && (txrate[k]->idx <
6323                                 hw->wiphy->bands[tx_info->band]->n_bitrates)) {
6324                                 rspec[k] =
6325                                     hw->wiphy->bands[tx_info->band]->
6326                                     bitrates[txrate[k]->idx].hw_value;
6327                                 short_preamble[k] =
6328                                     txrate[k]->
6329                                     flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ?
6330                                     true : false;
6331                         } else {
6332                                 rspec[k] = BRCM_RATE_1M;
6333                         }
6334                 } else {
6335                         rspec[k] = mac80211_wlc_set_nrate(wlc, wlc->band,
6336                                         NRATE_MCS_INUSE | txrate[k]->idx);
6337                 }
6338
6339                 /*
6340                  * Currently only support same setting for primay and
6341                  * fallback rates. Unify flags for each rate into a
6342                  * single value for the frame
6343                  */
6344                 use_rts |=
6345                     txrate[k]->
6346                     flags & IEEE80211_TX_RC_USE_RTS_CTS ? true : false;
6347                 use_cts |=
6348                     txrate[k]->
6349                     flags & IEEE80211_TX_RC_USE_CTS_PROTECT ? true : false;
6350
6351
6352                 /*
6353                  * (1) RATE:
6354                  *   determine and validate primary rate
6355                  *   and fallback rates
6356                  */
6357                 if (!rspec_active(rspec[k])) {
6358                         rspec[k] = BRCM_RATE_1M;
6359                 } else {
6360                         if (!is_multicast_ether_addr(h->addr1)) {
6361                                 /* set tx antenna config */
6362                                 brcms_c_antsel_antcfg_get(wlc->asi, false,
6363                                         false, 0, 0, &antcfg, &fbantcfg);
6364                         }
6365                 }
6366         }
6367
6368         phyctl1_stf = wlc->stf->ss_opmode;
6369
6370         if (wlc->pub->_n_enab & SUPPORT_11N) {
6371                 for (k = 0; k < hw->max_rates; k++) {
6372                         /*
6373                          * apply siso/cdd to single stream mcs's or ofdm
6374                          * if rspec is auto selected
6375                          */
6376                         if (((is_mcs_rate(rspec[k]) &&
6377                               is_single_stream(rspec[k] & RSPEC_RATE_MASK)) ||
6378                              is_ofdm_rate(rspec[k]))
6379                             && ((rspec[k] & RSPEC_OVERRIDE_MCS_ONLY)
6380                                 || !(rspec[k] & RSPEC_OVERRIDE))) {
6381                                 rspec[k] &= ~(RSPEC_STF_MASK | RSPEC_STC_MASK);
6382
6383                                 /* For SISO MCS use STBC if possible */
6384                                 if (is_mcs_rate(rspec[k])
6385                                     && BRCMS_STF_SS_STBC_TX(wlc, scb)) {
6386                                         u8 stc;
6387
6388                                         /* Nss for single stream is always 1 */
6389                                         stc = 1;
6390                                         rspec[k] |= (PHY_TXC1_MODE_STBC <<
6391                                                         RSPEC_STF_SHIFT) |
6392                                                     (stc << RSPEC_STC_SHIFT);
6393                                 } else
6394                                         rspec[k] |=
6395                                             (phyctl1_stf << RSPEC_STF_SHIFT);
6396                         }
6397
6398                         /*
6399                          * Is the phy configured to use 40MHZ frames? If
6400                          * so then pick the desired txbw
6401                          */
6402                         if (brcms_chspec_bw(wlc->chanspec) == BRCMS_40_MHZ) {
6403                                 /* default txbw is 20in40 SB */
6404                                 mimo_ctlchbw = mimo_txbw =
6405                                    CHSPEC_SB_UPPER(wlc_phy_chanspec_get(
6406                                                                  wlc->band->pi))
6407                                    ? PHY_TXC1_BW_20MHZ_UP : PHY_TXC1_BW_20MHZ;
6408
6409                                 if (is_mcs_rate(rspec[k])) {
6410                                         /* mcs 32 must be 40b/w DUP */
6411                                         if ((rspec[k] & RSPEC_RATE_MASK)
6412                                             == 32) {
6413                                                 mimo_txbw =
6414                                                     PHY_TXC1_BW_40MHZ_DUP;
6415                                                 /* use override */
6416                                         } else if (wlc->mimo_40txbw != AUTO)
6417                                                 mimo_txbw = wlc->mimo_40txbw;
6418                                         /* else check if dst is using 40 Mhz */
6419                                         else if (scb->flags & SCB_IS40)
6420                                                 mimo_txbw = PHY_TXC1_BW_40MHZ;
6421                                 } else if (is_ofdm_rate(rspec[k])) {
6422                                         if (wlc->ofdm_40txbw != AUTO)
6423                                                 mimo_txbw = wlc->ofdm_40txbw;
6424                                 } else if (wlc->cck_40txbw != AUTO) {
6425                                         mimo_txbw = wlc->cck_40txbw;
6426                                 }
6427                         } else {
6428                                 /*
6429                                  * mcs32 is 40 b/w only.
6430                                  * This is possible for probe packets on
6431                                  * a STA during SCAN
6432                                  */
6433                                 if ((rspec[k] & RSPEC_RATE_MASK) == 32)
6434                                         /* mcs 0 */
6435                                         rspec[k] = RSPEC_MIMORATE;
6436
6437                                 mimo_txbw = PHY_TXC1_BW_20MHZ;
6438                         }
6439
6440                         /* Set channel width */
6441                         rspec[k] &= ~RSPEC_BW_MASK;
6442                         if ((k == 0) || ((k > 0) && is_mcs_rate(rspec[k])))
6443                                 rspec[k] |= (mimo_txbw << RSPEC_BW_SHIFT);
6444                         else
6445                                 rspec[k] |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
6446
6447                         /* Disable short GI, not supported yet */
6448                         rspec[k] &= ~RSPEC_SHORT_GI;
6449
6450                         mimo_preamble_type = BRCMS_MM_PREAMBLE;
6451                         if (txrate[k]->flags & IEEE80211_TX_RC_GREEN_FIELD)
6452                                 mimo_preamble_type = BRCMS_GF_PREAMBLE;
6453
6454                         if ((txrate[k]->flags & IEEE80211_TX_RC_MCS)
6455                             && (!is_mcs_rate(rspec[k]))) {
6456                                 brcms_err(wlc->hw->d11core,
6457                                           "wl%d: %s: IEEE80211_TX_"
6458                                           "RC_MCS != is_mcs_rate(rspec)\n",
6459                                           wlc->pub->unit, __func__);
6460                         }
6461
6462                         if (is_mcs_rate(rspec[k])) {
6463                                 preamble_type[k] = mimo_preamble_type;
6464
6465                                 /*
6466                                  * if SGI is selected, then forced mm
6467                                  * for single stream
6468                                  */
6469                                 if ((rspec[k] & RSPEC_SHORT_GI)
6470                                     && is_single_stream(rspec[k] &
6471                                                         RSPEC_RATE_MASK))
6472                                         preamble_type[k] = BRCMS_MM_PREAMBLE;
6473                         }
6474
6475                         /* should be better conditionalized */
6476                         if (!is_mcs_rate(rspec[0])
6477                             && (tx_info->control.rates[0].
6478                                 flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
6479                                 preamble_type[k] = BRCMS_SHORT_PREAMBLE;
6480                 }
6481         } else {
6482                 for (k = 0; k < hw->max_rates; k++) {
6483                         /* Set ctrlchbw as 20Mhz */
6484                         rspec[k] &= ~RSPEC_BW_MASK;
6485                         rspec[k] |= (PHY_TXC1_BW_20MHZ << RSPEC_BW_SHIFT);
6486
6487                         /* for nphy, stf of ofdm frames must follow policies */
6488                         if (BRCMS_ISNPHY(wlc->band) && is_ofdm_rate(rspec[k])) {
6489                                 rspec[k] &= ~RSPEC_STF_MASK;
6490                                 rspec[k] |= phyctl1_stf << RSPEC_STF_SHIFT;
6491                         }
6492                 }
6493         }
6494
6495         /* Reset these for use with AMPDU's */
6496         txrate[0]->count = 0;
6497         txrate[1]->count = 0;
6498
6499         /* (2) PROTECTION, may change rspec */
6500         if ((ieee80211_is_data(h->frame_control) ||
6501             ieee80211_is_mgmt(h->frame_control)) &&
6502             (phylen > wlc->RTSThresh) && !is_multicast_ether_addr(h->addr1))
6503                 use_rts = true;
6504
6505         /* (3) PLCP: determine PLCP header and MAC duration,
6506          * fill struct d11txh */
6507         brcms_c_compute_plcp(wlc, rspec[0], phylen, plcp);
6508         brcms_c_compute_plcp(wlc, rspec[1], phylen, plcp_fallback);
6509         memcpy(&txh->FragPLCPFallback,
6510                plcp_fallback, sizeof(txh->FragPLCPFallback));
6511
6512         /* Length field now put in CCK FBR CRC field */
6513         if (is_cck_rate(rspec[1])) {
6514                 txh->FragPLCPFallback[4] = phylen & 0xff;
6515                 txh->FragPLCPFallback[5] = (phylen & 0xff00) >> 8;
6516         }
6517
6518         /* MIMO-RATE: need validation ?? */
6519         mainrates = is_ofdm_rate(rspec[0]) ?
6520                         D11A_PHY_HDR_GRATE((struct ofdm_phy_hdr *) plcp) :
6521                         plcp[0];
6522
6523         /* DUR field for main rate */
6524         if (!ieee80211_is_pspoll(h->frame_control) &&
6525             !is_multicast_ether_addr(h->addr1) && !use_rifs) {
6526                 durid =
6527                     brcms_c_compute_frame_dur(wlc, rspec[0], preamble_type[0],
6528                                           next_frag_len);
6529                 h->duration_id = cpu_to_le16(durid);
6530         } else if (use_rifs) {
6531                 /* NAV protect to end of next max packet size */
6532                 durid =
6533                     (u16) brcms_c_calc_frame_time(wlc, rspec[0],
6534                                                  preamble_type[0],
6535                                                  DOT11_MAX_FRAG_LEN);
6536                 durid += RIFS_11N_TIME;
6537                 h->duration_id = cpu_to_le16(durid);
6538         }
6539
6540         /* DUR field for fallback rate */
6541         if (ieee80211_is_pspoll(h->frame_control))
6542                 txh->FragDurFallback = h->duration_id;
6543         else if (is_multicast_ether_addr(h->addr1) || use_rifs)
6544                 txh->FragDurFallback = 0;
6545         else {
6546                 durid = brcms_c_compute_frame_dur(wlc, rspec[1],
6547                                               preamble_type[1], next_frag_len);
6548                 txh->FragDurFallback = cpu_to_le16(durid);
6549         }
6550
6551         /* (4) MAC-HDR: MacTxControlLow */
6552         if (frag == 0)
6553                 mcl |= TXC_STARTMSDU;
6554
6555         if (!is_multicast_ether_addr(h->addr1))
6556                 mcl |= TXC_IMMEDACK;
6557
6558         if (wlc->band->bandtype == BRCM_BAND_5G)
6559                 mcl |= TXC_FREQBAND_5G;
6560
6561         if (CHSPEC_IS40(wlc_phy_chanspec_get(wlc->band->pi)))
6562                 mcl |= TXC_BW_40;
6563
6564         /* set AMIC bit if using hardware TKIP MIC */
6565         if (hwtkmic)
6566                 mcl |= TXC_AMIC;
6567
6568         txh->MacTxControlLow = cpu_to_le16(mcl);
6569
6570         /* MacTxControlHigh */
6571         mch = 0;
6572
6573         /* Set fallback rate preamble type */
6574         if ((preamble_type[1] == BRCMS_SHORT_PREAMBLE) ||
6575             (preamble_type[1] == BRCMS_GF_PREAMBLE)) {
6576                 if (rspec2rate(rspec[1]) != BRCM_RATE_1M)
6577                         mch |= TXC_PREAMBLE_DATA_FB_SHORT;
6578         }
6579
6580         /* MacFrameControl */
6581         memcpy(&txh->MacFrameControl, &h->frame_control, sizeof(u16));
6582         txh->TxFesTimeNormal = cpu_to_le16(0);
6583
6584         txh->TxFesTimeFallback = cpu_to_le16(0);
6585
6586         /* TxFrameRA */
6587         memcpy(&txh->TxFrameRA, &h->addr1, ETH_ALEN);
6588
6589         /* TxFrameID */
6590         txh->TxFrameID = cpu_to_le16(frameid);
6591
6592         /*
6593          * TxStatus, Note the case of recreating the first frag of a suppressed
6594          * frame then we may need to reset the retry cnt's via the status reg
6595          */
6596         txh->TxStatus = cpu_to_le16(status);
6597
6598         /*
6599          * extra fields for ucode AMPDU aggregation, the new fields are added to
6600          * the END of previous structure so that it's compatible in driver.
6601          */
6602         txh->MaxNMpdus = cpu_to_le16(0);
6603         txh->MaxABytes_MRT = cpu_to_le16(0);
6604         txh->MaxABytes_FBR = cpu_to_le16(0);
6605         txh->MinMBytes = cpu_to_le16(0);
6606
6607         /* (5) RTS/CTS: determine RTS/CTS PLCP header and MAC duration,
6608          * furnish struct d11txh */
6609         /* RTS PLCP header and RTS frame */
6610         if (use_rts || use_cts) {
6611                 if (use_rts && use_cts)
6612                         use_cts = false;
6613
6614                 for (k = 0; k < 2; k++) {
6615                         rts_rspec[k] = brcms_c_rspec_to_rts_rspec(wlc, rspec[k],
6616                                                               false,
6617                                                               mimo_ctlchbw);
6618                 }
6619
6620                 if (!is_ofdm_rate(rts_rspec[0]) &&
6621                     !((rspec2rate(rts_rspec[0]) == BRCM_RATE_1M) ||
6622                       (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6623                         rts_preamble_type[0] = BRCMS_SHORT_PREAMBLE;
6624                         mch |= TXC_PREAMBLE_RTS_MAIN_SHORT;
6625                 }
6626
6627                 if (!is_ofdm_rate(rts_rspec[1]) &&
6628                     !((rspec2rate(rts_rspec[1]) == BRCM_RATE_1M) ||
6629                       (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6630                         rts_preamble_type[1] = BRCMS_SHORT_PREAMBLE;
6631                         mch |= TXC_PREAMBLE_RTS_FB_SHORT;
6632                 }
6633
6634                 /* RTS/CTS additions to MacTxControlLow */
6635                 if (use_cts) {
6636                         txh->MacTxControlLow |= cpu_to_le16(TXC_SENDCTS);
6637                 } else {
6638                         txh->MacTxControlLow |= cpu_to_le16(TXC_SENDRTS);
6639                         txh->MacTxControlLow |= cpu_to_le16(TXC_LONGFRAME);
6640                 }
6641
6642                 /* RTS PLCP header */
6643                 rts_plcp = txh->RTSPhyHeader;
6644                 if (use_cts)
6645                         rts_phylen = DOT11_CTS_LEN + FCS_LEN;
6646                 else
6647                         rts_phylen = DOT11_RTS_LEN + FCS_LEN;
6648
6649                 brcms_c_compute_plcp(wlc, rts_rspec[0], rts_phylen, rts_plcp);
6650
6651                 /* fallback rate version of RTS PLCP header */
6652                 brcms_c_compute_plcp(wlc, rts_rspec[1], rts_phylen,
6653                                  rts_plcp_fallback);
6654                 memcpy(&txh->RTSPLCPFallback, rts_plcp_fallback,
6655                        sizeof(txh->RTSPLCPFallback));
6656
6657                 /* RTS frame fields... */
6658                 rts = (struct ieee80211_rts *)&txh->rts_frame;
6659
6660                 durid = brcms_c_compute_rtscts_dur(wlc, use_cts, rts_rspec[0],
6661                                                rspec[0], rts_preamble_type[0],
6662                                                preamble_type[0], phylen, false);
6663                 rts->duration = cpu_to_le16(durid);
6664                 /* fallback rate version of RTS DUR field */
6665                 durid = brcms_c_compute_rtscts_dur(wlc, use_cts,
6666                                                rts_rspec[1], rspec[1],
6667                                                rts_preamble_type[1],
6668                                                preamble_type[1], phylen, false);
6669                 txh->RTSDurFallback = cpu_to_le16(durid);
6670
6671                 if (use_cts) {
6672                         rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6673                                                          IEEE80211_STYPE_CTS);
6674
6675                         memcpy(&rts->ra, &h->addr2, ETH_ALEN);
6676                 } else {
6677                         rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6678                                                          IEEE80211_STYPE_RTS);
6679
6680                         memcpy(&rts->ra, &h->addr1, 2 * ETH_ALEN);
6681                 }
6682
6683                 /* mainrate
6684                  *    low 8 bits: main frag rate/mcs,
6685                  *    high 8 bits: rts/cts rate/mcs
6686                  */
6687                 mainrates |= (is_ofdm_rate(rts_rspec[0]) ?
6688                                 D11A_PHY_HDR_GRATE(
6689                                         (struct ofdm_phy_hdr *) rts_plcp) :
6690                                 rts_plcp[0]) << 8;
6691         } else {
6692                 memset((char *)txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
6693                 memset((char *)&txh->rts_frame, 0,
6694                         sizeof(struct ieee80211_rts));
6695                 memset((char *)txh->RTSPLCPFallback, 0,
6696                       sizeof(txh->RTSPLCPFallback));
6697                 txh->RTSDurFallback = 0;
6698         }
6699
6700 #ifdef SUPPORT_40MHZ
6701         /* add null delimiter count */
6702         if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && is_mcs_rate(rspec))
6703                 txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM] =
6704                    brcm_c_ampdu_null_delim_cnt(wlc->ampdu, scb, rspec, phylen);
6705
6706 #endif
6707
6708         /*
6709          * Now that RTS/RTS FB preamble types are updated, write
6710          * the final value
6711          */
6712         txh->MacTxControlHigh = cpu_to_le16(mch);
6713
6714         /*
6715          * MainRates (both the rts and frag plcp rates have
6716          * been calculated now)
6717          */
6718         txh->MainRates = cpu_to_le16(mainrates);
6719
6720         /* XtraFrameTypes */
6721         xfts = frametype(rspec[1], wlc->mimoft);
6722         xfts |= (frametype(rts_rspec[0], wlc->mimoft) << XFTS_RTS_FT_SHIFT);
6723         xfts |= (frametype(rts_rspec[1], wlc->mimoft) << XFTS_FBRRTS_FT_SHIFT);
6724         xfts |= CHSPEC_CHANNEL(wlc_phy_chanspec_get(wlc->band->pi)) <<
6725                                                              XFTS_CHANNEL_SHIFT;
6726         txh->XtraFrameTypes = cpu_to_le16(xfts);
6727
6728         /* PhyTxControlWord */
6729         phyctl = frametype(rspec[0], wlc->mimoft);
6730         if ((preamble_type[0] == BRCMS_SHORT_PREAMBLE) ||
6731             (preamble_type[0] == BRCMS_GF_PREAMBLE)) {
6732                 if (rspec2rate(rspec[0]) != BRCM_RATE_1M)
6733                         phyctl |= PHY_TXC_SHORT_HDR;
6734         }
6735
6736         /* phytxant is properly bit shifted */
6737         phyctl |= brcms_c_stf_d11hdrs_phyctl_txant(wlc, rspec[0]);
6738         txh->PhyTxControlWord = cpu_to_le16(phyctl);
6739
6740         /* PhyTxControlWord_1 */
6741         if (BRCMS_PHY_11N_CAP(wlc->band)) {
6742                 u16 phyctl1 = 0;
6743
6744                 phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[0]);
6745                 txh->PhyTxControlWord_1 = cpu_to_le16(phyctl1);
6746                 phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[1]);
6747                 txh->PhyTxControlWord_1_Fbr = cpu_to_le16(phyctl1);
6748
6749                 if (use_rts || use_cts) {
6750                         phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[0]);
6751                         txh->PhyTxControlWord_1_Rts = cpu_to_le16(phyctl1);
6752                         phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[1]);
6753                         txh->PhyTxControlWord_1_FbrRts = cpu_to_le16(phyctl1);
6754                 }
6755
6756                 /*
6757                  * For mcs frames, if mixedmode(overloaded with long preamble)
6758                  * is going to be set, fill in non-zero MModeLen and/or
6759                  * MModeFbrLen it will be unnecessary if they are separated
6760                  */
6761                 if (is_mcs_rate(rspec[0]) &&
6762                     (preamble_type[0] == BRCMS_MM_PREAMBLE)) {
6763                         u16 mmodelen =
6764                             brcms_c_calc_lsig_len(wlc, rspec[0], phylen);
6765                         txh->MModeLen = cpu_to_le16(mmodelen);
6766                 }
6767
6768                 if (is_mcs_rate(rspec[1]) &&
6769                     (preamble_type[1] == BRCMS_MM_PREAMBLE)) {
6770                         u16 mmodefbrlen =
6771                             brcms_c_calc_lsig_len(wlc, rspec[1], phylen);
6772                         txh->MModeFbrLen = cpu_to_le16(mmodefbrlen);
6773                 }
6774         }
6775
6776         ac = skb_get_queue_mapping(p);
6777         if ((scb->flags & SCB_WMECAP) && qos && wlc->edcf_txop[ac]) {
6778                 uint frag_dur, dur, dur_fallback;
6779
6780                 /* WME: Update TXOP threshold */
6781                 if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU) && frag == 0) {
6782                         frag_dur =
6783                             brcms_c_calc_frame_time(wlc, rspec[0],
6784                                         preamble_type[0], phylen);
6785
6786                         if (rts) {
6787                                 /* 1 RTS or CTS-to-self frame */
6788                                 dur =
6789                                     brcms_c_calc_cts_time(wlc, rts_rspec[0],
6790                                                       rts_preamble_type[0]);
6791                                 dur_fallback =
6792                                     brcms_c_calc_cts_time(wlc, rts_rspec[1],
6793                                                       rts_preamble_type[1]);
6794                                 /* (SIFS + CTS) + SIFS + frame + SIFS + ACK */
6795                                 dur += le16_to_cpu(rts->duration);
6796                                 dur_fallback +=
6797                                         le16_to_cpu(txh->RTSDurFallback);
6798                         } else if (use_rifs) {
6799                                 dur = frag_dur;
6800                                 dur_fallback = 0;
6801                         } else {
6802                                 /* frame + SIFS + ACK */
6803                                 dur = frag_dur;
6804                                 dur +=
6805                                     brcms_c_compute_frame_dur(wlc, rspec[0],
6806                                                           preamble_type[0], 0);
6807
6808                                 dur_fallback =
6809                                     brcms_c_calc_frame_time(wlc, rspec[1],
6810                                                         preamble_type[1],
6811                                                         phylen);
6812                                 dur_fallback +=
6813                                     brcms_c_compute_frame_dur(wlc, rspec[1],
6814                                                           preamble_type[1], 0);
6815                         }
6816                         /* NEED to set TxFesTimeNormal (hard) */
6817                         txh->TxFesTimeNormal = cpu_to_le16((u16) dur);
6818                         /*
6819                          * NEED to set fallback rate version of
6820                          * TxFesTimeNormal (hard)
6821                          */
6822                         txh->TxFesTimeFallback =
6823                                 cpu_to_le16((u16) dur_fallback);
6824
6825                         /*
6826                          * update txop byte threshold (txop minus intraframe
6827                          * overhead)
6828                          */
6829                         if (wlc->edcf_txop[ac] >= (dur - frag_dur)) {
6830                                 uint newfragthresh;
6831
6832                                 newfragthresh =
6833                                     brcms_c_calc_frame_len(wlc,
6834                                         rspec[0], preamble_type[0],
6835                                         (wlc->edcf_txop[ac] -
6836                                                 (dur - frag_dur)));
6837                                 /* range bound the fragthreshold */
6838                                 if (newfragthresh < DOT11_MIN_FRAG_LEN)
6839                                         newfragthresh =
6840                                             DOT11_MIN_FRAG_LEN;
6841                                 else if (newfragthresh >
6842                                          wlc->usr_fragthresh)
6843                                         newfragthresh =
6844                                             wlc->usr_fragthresh;
6845                                 /* update the fragthresh and do txc update */
6846                                 if (wlc->fragthresh[queue] !=
6847                                     (u16) newfragthresh)
6848                                         wlc->fragthresh[queue] =
6849                                             (u16) newfragthresh;
6850                         } else {
6851                                 brcms_err(wlc->hw->d11core,
6852                                           "wl%d: %s txop invalid "
6853                                           "for rate %d\n",
6854                                           wlc->pub->unit, fifo_names[queue],
6855                                           rspec2rate(rspec[0]));
6856                         }
6857
6858                         if (dur > wlc->edcf_txop[ac])
6859                                 brcms_err(wlc->hw->d11core,
6860                                           "wl%d: %s: %s txop "
6861                                           "exceeded phylen %d/%d dur %d/%d\n",
6862                                           wlc->pub->unit, __func__,
6863                                           fifo_names[queue],
6864                                           phylen, wlc->fragthresh[queue],
6865                                           dur, wlc->edcf_txop[ac]);
6866                 }
6867         }
6868
6869         return 0;
6870 }
6871
6872 static int brcms_c_tx(struct brcms_c_info *wlc, struct sk_buff *skb)
6873 {
6874         struct dma_pub *dma;
6875         int fifo, ret = -ENOSPC;
6876         struct d11txh *txh;
6877         u16 frameid = INVALIDFID;
6878
6879         fifo = brcms_ac_to_fifo(skb_get_queue_mapping(skb));
6880         dma = wlc->hw->di[fifo];
6881         txh = (struct d11txh *)(skb->data);
6882
6883         if (dma->txavail == 0) {
6884                 /*
6885                  * We sometimes get a frame from mac80211 after stopping
6886                  * the queues. This only ever seems to be a single frame
6887                  * and is seems likely to be a race. TX_HEADROOM should
6888                  * ensure that we have enough space to handle these stray
6889                  * packets, so warn if there isn't. If we're out of space
6890                  * in the tx ring and the tx queue isn't stopped then
6891                  * we've really got a bug; warn loudly if that happens.
6892                  */
6893                 brcms_warn(wlc->hw->d11core,
6894                            "Received frame for tx with no space in DMA ring\n");
6895                 WARN_ON(!ieee80211_queue_stopped(wlc->pub->ieee_hw,
6896                                                  skb_get_queue_mapping(skb)));
6897                 return -ENOSPC;
6898         }
6899
6900         /* When a BC/MC frame is being committed to the BCMC fifo
6901          * via DMA (NOT PIO), update ucode or BSS info as appropriate.
6902          */
6903         if (fifo == TX_BCMC_FIFO)
6904                 frameid = le16_to_cpu(txh->TxFrameID);
6905
6906         /* Commit BCMC sequence number in the SHM frame ID location */
6907         if (frameid != INVALIDFID) {
6908                 /*
6909                  * To inform the ucode of the last mcast frame posted
6910                  * so that it can clear moredata bit
6911                  */
6912                 brcms_b_write_shm(wlc->hw, M_BCMC_FID, frameid);
6913         }
6914
6915         ret = brcms_c_txfifo(wlc, fifo, skb);
6916         /*
6917          * The only reason for brcms_c_txfifo to fail is because
6918          * there weren't any DMA descriptors, but we've already
6919          * checked for that. So if it does fail yell loudly.
6920          */
6921         WARN_ON_ONCE(ret);
6922
6923         return ret;
6924 }
6925
6926 bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
6927                               struct ieee80211_hw *hw)
6928 {
6929         uint fifo;
6930         struct scb *scb = &wlc->pri_scb;
6931
6932         fifo = brcms_ac_to_fifo(skb_get_queue_mapping(sdu));
6933         brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0);
6934         if (!brcms_c_tx(wlc, sdu))
6935                 return true;
6936
6937         /* packet discarded */
6938         dev_kfree_skb_any(sdu);
6939         return false;
6940 }
6941
6942 int
6943 brcms_c_txfifo(struct brcms_c_info *wlc, uint fifo, struct sk_buff *p)
6944 {
6945         struct dma_pub *dma = wlc->hw->di[fifo];
6946         int ret;
6947         u16 queue;
6948
6949         ret = dma_txfast(wlc, dma, p);
6950         if (ret < 0)
6951                 wiphy_err(wlc->wiphy, "txfifo: fatal, toss frames !!!\n");
6952
6953         /*
6954          * Stop queue if DMA ring is full. Reserve some free descriptors,
6955          * as we sometimes receive a frame from mac80211 after the queues
6956          * are stopped.
6957          */
6958         queue = skb_get_queue_mapping(p);
6959         if (dma->txavail <= TX_HEADROOM && fifo < TX_BCMC_FIFO &&
6960             !ieee80211_queue_stopped(wlc->pub->ieee_hw, queue))
6961                 ieee80211_stop_queue(wlc->pub->ieee_hw, queue);
6962
6963         return ret;
6964 }
6965
6966 u32
6967 brcms_c_rspec_to_rts_rspec(struct brcms_c_info *wlc, u32 rspec,
6968                            bool use_rspec, u16 mimo_ctlchbw)
6969 {
6970         u32 rts_rspec = 0;
6971
6972         if (use_rspec)
6973                 /* use frame rate as rts rate */
6974                 rts_rspec = rspec;
6975         else if (wlc->band->gmode && wlc->protection->_g && !is_cck_rate(rspec))
6976                 /* Use 11Mbps as the g protection RTS target rate and fallback.
6977                  * Use the brcms_basic_rate() lookup to find the best basic rate
6978                  * under the target in case 11 Mbps is not Basic.
6979                  * 6 and 9 Mbps are not usually selected by rate selection, but
6980                  * even if the OFDM rate we are protecting is 6 or 9 Mbps, 11
6981                  * is more robust.
6982                  */
6983                 rts_rspec = brcms_basic_rate(wlc, BRCM_RATE_11M);
6984         else
6985                 /* calculate RTS rate and fallback rate based on the frame rate
6986                  * RTS must be sent at a basic rate since it is a
6987                  * control frame, sec 9.6 of 802.11 spec
6988                  */
6989                 rts_rspec = brcms_basic_rate(wlc, rspec);
6990
6991         if (BRCMS_PHY_11N_CAP(wlc->band)) {
6992                 /* set rts txbw to correct side band */
6993                 rts_rspec &= ~RSPEC_BW_MASK;
6994
6995                 /*
6996                  * if rspec/rspec_fallback is 40MHz, then send RTS on both
6997                  * 20MHz channel (DUP), otherwise send RTS on control channel
6998                  */
6999                 if (rspec_is40mhz(rspec) && !is_cck_rate(rts_rspec))
7000                         rts_rspec |= (PHY_TXC1_BW_40MHZ_DUP << RSPEC_BW_SHIFT);
7001                 else
7002                         rts_rspec |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
7003
7004                 /* pick siso/cdd as default for ofdm */
7005                 if (is_ofdm_rate(rts_rspec)) {
7006                         rts_rspec &= ~RSPEC_STF_MASK;
7007                         rts_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
7008                 }
7009         }
7010         return rts_rspec;
7011 }
7012
7013 /* Update beacon listen interval in shared memory */
7014 static void brcms_c_bcn_li_upd(struct brcms_c_info *wlc)
7015 {
7016         /* wake up every DTIM is the default */
7017         if (wlc->bcn_li_dtim == 1)
7018                 brcms_b_write_shm(wlc->hw, M_BCN_LI, 0);
7019         else
7020                 brcms_b_write_shm(wlc->hw, M_BCN_LI,
7021                               (wlc->bcn_li_dtim << 8) | wlc->bcn_li_bcn);
7022 }
7023
7024 static void
7025 brcms_b_read_tsf(struct brcms_hardware *wlc_hw, u32 *tsf_l_ptr,
7026                   u32 *tsf_h_ptr)
7027 {
7028         struct bcma_device *core = wlc_hw->d11core;
7029
7030         /* read the tsf timer low, then high to get an atomic read */
7031         *tsf_l_ptr = bcma_read32(core, D11REGOFFS(tsf_timerlow));
7032         *tsf_h_ptr = bcma_read32(core, D11REGOFFS(tsf_timerhigh));
7033 }
7034
7035 /*
7036  * recover 64bit TSF value from the 16bit TSF value in the rx header
7037  * given the assumption that the TSF passed in header is within 65ms
7038  * of the current tsf.
7039  *
7040  * 6       5       4       4       3       2       1
7041  * 3.......6.......8.......0.......2.......4.......6.......8......0
7042  * |<---------- tsf_h ----------->||<--- tsf_l -->||<-RxTSFTime ->|
7043  *
7044  * The RxTSFTime are the lowest 16 bits and provided by the ucode. The
7045  * tsf_l is filled in by brcms_b_recv, which is done earlier in the
7046  * receive call sequence after rx interrupt. Only the higher 16 bits
7047  * are used. Finally, the tsf_h is read from the tsf register.
7048  */
7049 static u64 brcms_c_recover_tsf64(struct brcms_c_info *wlc,
7050                                  struct d11rxhdr *rxh)
7051 {
7052         u32 tsf_h, tsf_l;
7053         u16 rx_tsf_0_15, rx_tsf_16_31;
7054
7055         brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7056
7057         rx_tsf_16_31 = (u16)(tsf_l >> 16);
7058         rx_tsf_0_15 = rxh->RxTSFTime;
7059
7060         /*
7061          * a greater tsf time indicates the low 16 bits of
7062          * tsf_l wrapped, so decrement the high 16 bits.
7063          */
7064         if ((u16)tsf_l < rx_tsf_0_15) {
7065                 rx_tsf_16_31 -= 1;
7066                 if (rx_tsf_16_31 == 0xffff)
7067                         tsf_h -= 1;
7068         }
7069
7070         return ((u64)tsf_h << 32) | (((u32)rx_tsf_16_31 << 16) + rx_tsf_0_15);
7071 }
7072
7073 static void
7074 prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7075                      struct sk_buff *p,
7076                      struct ieee80211_rx_status *rx_status)
7077 {
7078         int preamble;
7079         int channel;
7080         u32 rspec;
7081         unsigned char *plcp;
7082
7083         /* fill in TSF and flag its presence */
7084         rx_status->mactime = brcms_c_recover_tsf64(wlc, rxh);
7085         rx_status->flag |= RX_FLAG_MACTIME_START;
7086
7087         channel = BRCMS_CHAN_CHANNEL(rxh->RxChan);
7088
7089         rx_status->band =
7090                 channel > 14 ? IEEE80211_BAND_5GHZ : IEEE80211_BAND_2GHZ;
7091         rx_status->freq =
7092                 ieee80211_channel_to_frequency(channel, rx_status->band);
7093
7094         rx_status->signal = wlc_phy_rssi_compute(wlc->hw->band->pi, rxh);
7095
7096         /* noise */
7097         /* qual */
7098         rx_status->antenna =
7099                 (rxh->PhyRxStatus_0 & PRXS0_RXANT_UPSUBBAND) ? 1 : 0;
7100
7101         plcp = p->data;
7102
7103         rspec = brcms_c_compute_rspec(rxh, plcp);
7104         if (is_mcs_rate(rspec)) {
7105                 rx_status->rate_idx = rspec & RSPEC_RATE_MASK;
7106                 rx_status->flag |= RX_FLAG_HT;
7107                 if (rspec_is40mhz(rspec))
7108                         rx_status->flag |= RX_FLAG_40MHZ;
7109         } else {
7110                 switch (rspec2rate(rspec)) {
7111                 case BRCM_RATE_1M:
7112                         rx_status->rate_idx = 0;
7113                         break;
7114                 case BRCM_RATE_2M:
7115                         rx_status->rate_idx = 1;
7116                         break;
7117                 case BRCM_RATE_5M5:
7118                         rx_status->rate_idx = 2;
7119                         break;
7120                 case BRCM_RATE_11M:
7121                         rx_status->rate_idx = 3;
7122                         break;
7123                 case BRCM_RATE_6M:
7124                         rx_status->rate_idx = 4;
7125                         break;
7126                 case BRCM_RATE_9M:
7127                         rx_status->rate_idx = 5;
7128                         break;
7129                 case BRCM_RATE_12M:
7130                         rx_status->rate_idx = 6;
7131                         break;
7132                 case BRCM_RATE_18M:
7133                         rx_status->rate_idx = 7;
7134                         break;
7135                 case BRCM_RATE_24M:
7136                         rx_status->rate_idx = 8;
7137                         break;
7138                 case BRCM_RATE_36M:
7139                         rx_status->rate_idx = 9;
7140                         break;
7141                 case BRCM_RATE_48M:
7142                         rx_status->rate_idx = 10;
7143                         break;
7144                 case BRCM_RATE_54M:
7145                         rx_status->rate_idx = 11;
7146                         break;
7147                 default:
7148                         brcms_err(wlc->hw->d11core,
7149                                   "%s: Unknown rate\n", __func__);
7150                 }
7151
7152                 /*
7153                  * For 5GHz, we should decrease the index as it is
7154                  * a subset of the 2.4G rates. See bitrates field
7155                  * of brcms_band_5GHz_nphy (in mac80211_if.c).
7156                  */
7157                 if (rx_status->band == IEEE80211_BAND_5GHZ)
7158                         rx_status->rate_idx -= BRCMS_LEGACY_5G_RATE_OFFSET;
7159
7160                 /* Determine short preamble and rate_idx */
7161                 preamble = 0;
7162                 if (is_cck_rate(rspec)) {
7163                         if (rxh->PhyRxStatus_0 & PRXS0_SHORTH)
7164                                 rx_status->flag |= RX_FLAG_SHORTPRE;
7165                 } else if (is_ofdm_rate(rspec)) {
7166                         rx_status->flag |= RX_FLAG_SHORTPRE;
7167                 } else {
7168                         brcms_err(wlc->hw->d11core, "%s: Unknown modulation\n",
7169                                   __func__);
7170                 }
7171         }
7172
7173         if (plcp3_issgi(plcp[3]))
7174                 rx_status->flag |= RX_FLAG_SHORT_GI;
7175
7176         if (rxh->RxStatus1 & RXS_DECERR) {
7177                 rx_status->flag |= RX_FLAG_FAILED_PLCP_CRC;
7178                 brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_PLCP_CRC\n",
7179                           __func__);
7180         }
7181         if (rxh->RxStatus1 & RXS_FCSERR) {
7182                 rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
7183                 brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_FCS_CRC\n",
7184                           __func__);
7185         }
7186 }
7187
7188 static void
7189 brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7190                 struct sk_buff *p)
7191 {
7192         int len_mpdu;
7193         struct ieee80211_rx_status rx_status;
7194         struct ieee80211_hdr *hdr;
7195
7196         memset(&rx_status, 0, sizeof(rx_status));
7197         prep_mac80211_status(wlc, rxh, p, &rx_status);
7198
7199         /* mac header+body length, exclude CRC and plcp header */
7200         len_mpdu = p->len - D11_PHY_HDR_LEN - FCS_LEN;
7201         skb_pull(p, D11_PHY_HDR_LEN);
7202         __skb_trim(p, len_mpdu);
7203
7204         /* unmute transmit */
7205         if (wlc->hw->suspended_fifos) {
7206                 hdr = (struct ieee80211_hdr *)p->data;
7207                 if (ieee80211_is_beacon(hdr->frame_control))
7208                         brcms_b_mute(wlc->hw, false);
7209         }
7210
7211         memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
7212         ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
7213 }
7214
7215 /* calculate frame duration for Mixed-mode L-SIG spoofing, return
7216  * number of bytes goes in the length field
7217  *
7218  * Formula given by HT PHY Spec v 1.13
7219  *   len = 3(nsyms + nstream + 3) - 3
7220  */
7221 u16
7222 brcms_c_calc_lsig_len(struct brcms_c_info *wlc, u32 ratespec,
7223                       uint mac_len)
7224 {
7225         uint nsyms, len = 0, kNdps;
7226
7227         if (is_mcs_rate(ratespec)) {
7228                 uint mcs = ratespec & RSPEC_RATE_MASK;
7229                 int tot_streams = (mcs_2_txstreams(mcs) + 1) +
7230                                   rspec_stc(ratespec);
7231
7232                 /*
7233                  * the payload duration calculation matches that
7234                  * of regular ofdm
7235                  */
7236                 /* 1000Ndbps = kbps * 4 */
7237                 kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
7238                                    rspec_issgi(ratespec)) * 4;
7239
7240                 if (rspec_stc(ratespec) == 0)
7241                         nsyms =
7242                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7243                                   APHY_TAIL_NBITS) * 1000, kNdps);
7244                 else
7245                         /* STBC needs to have even number of symbols */
7246                         nsyms =
7247                             2 *
7248                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7249                                   APHY_TAIL_NBITS) * 1000, 2 * kNdps);
7250
7251                 /* (+3) account for HT-SIG(2) and HT-STF(1) */
7252                 nsyms += (tot_streams + 3);
7253                 /*
7254                  * 3 bytes/symbol @ legacy 6Mbps rate
7255                  * (-3) excluding service bits and tail bits
7256                  */
7257                 len = (3 * nsyms) - 3;
7258         }
7259
7260         return (u16) len;
7261 }
7262
7263 static void
7264 brcms_c_mod_prb_rsp_rate_table(struct brcms_c_info *wlc, uint frame_len)
7265 {
7266         const struct brcms_c_rateset *rs_dflt;
7267         struct brcms_c_rateset rs;
7268         u8 rate;
7269         u16 entry_ptr;
7270         u8 plcp[D11_PHY_HDR_LEN];
7271         u16 dur, sifs;
7272         uint i;
7273
7274         sifs = get_sifs(wlc->band);
7275
7276         rs_dflt = brcms_c_rateset_get_hwrs(wlc);
7277
7278         brcms_c_rateset_copy(rs_dflt, &rs);
7279         brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
7280
7281         /*
7282          * walk the phy rate table and update MAC core SHM
7283          * basic rate table entries
7284          */
7285         for (i = 0; i < rs.count; i++) {
7286                 rate = rs.rates[i] & BRCMS_RATE_MASK;
7287
7288                 entry_ptr = brcms_b_rate_shm_offset(wlc->hw, rate);
7289
7290                 /* Calculate the Probe Response PLCP for the given rate */
7291                 brcms_c_compute_plcp(wlc, rate, frame_len, plcp);
7292
7293                 /*
7294                  * Calculate the duration of the Probe Response
7295                  * frame plus SIFS for the MAC
7296                  */
7297                 dur = (u16) brcms_c_calc_frame_time(wlc, rate,
7298                                                 BRCMS_LONG_PREAMBLE, frame_len);
7299                 dur += sifs;
7300
7301                 /* Update the SHM Rate Table entry Probe Response values */
7302                 brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS,
7303                               (u16) (plcp[0] + (plcp[1] << 8)));
7304                 brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS + 2,
7305                               (u16) (plcp[2] + (plcp[3] << 8)));
7306                 brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_DUR_POS, dur);
7307         }
7308 }
7309
7310 /*      Max buffering needed for beacon template/prb resp template is 142 bytes.
7311  *
7312  *      PLCP header is 6 bytes.
7313  *      802.11 A3 header is 24 bytes.
7314  *      Max beacon frame body template length is 112 bytes.
7315  *      Max probe resp frame body template length is 110 bytes.
7316  *
7317  *      *len on input contains the max length of the packet available.
7318  *
7319  *      The *len value is set to the number of bytes in buf used, and starts
7320  *      with the PLCP and included up to, but not including, the 4 byte FCS.
7321  */
7322 static void
7323 brcms_c_bcn_prb_template(struct brcms_c_info *wlc, u16 type,
7324                          u32 bcn_rspec,
7325                          struct brcms_bss_cfg *cfg, u16 *buf, int *len)
7326 {
7327         static const u8 ether_bcast[ETH_ALEN] = {255, 255, 255, 255, 255, 255};
7328         struct cck_phy_hdr *plcp;
7329         struct ieee80211_mgmt *h;
7330         int hdr_len, body_len;
7331
7332         hdr_len = D11_PHY_HDR_LEN + DOT11_MAC_HDR_LEN;
7333
7334         /* calc buffer size provided for frame body */
7335         body_len = *len - hdr_len;
7336         /* return actual size */
7337         *len = hdr_len + body_len;
7338
7339         /* format PHY and MAC headers */
7340         memset((char *)buf, 0, hdr_len);
7341
7342         plcp = (struct cck_phy_hdr *) buf;
7343
7344         /*
7345          * PLCP for Probe Response frames are filled in from
7346          * core's rate table
7347          */
7348         if (type == IEEE80211_STYPE_BEACON)
7349                 /* fill in PLCP */
7350                 brcms_c_compute_plcp(wlc, bcn_rspec,
7351                                  (DOT11_MAC_HDR_LEN + body_len + FCS_LEN),
7352                                  (u8 *) plcp);
7353
7354         /* "Regular" and 16 MBSS but not for 4 MBSS */
7355         /* Update the phytxctl for the beacon based on the rspec */
7356         brcms_c_beacon_phytxctl_txant_upd(wlc, bcn_rspec);
7357
7358         h = (struct ieee80211_mgmt *)&plcp[1];
7359
7360         /* fill in 802.11 header */
7361         h->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | type);
7362
7363         /* DUR is 0 for multicast bcn, or filled in by MAC for prb resp */
7364         /* A1 filled in by MAC for prb resp, broadcast for bcn */
7365         if (type == IEEE80211_STYPE_BEACON)
7366                 memcpy(&h->da, &ether_bcast, ETH_ALEN);
7367         memcpy(&h->sa, &cfg->cur_etheraddr, ETH_ALEN);
7368         memcpy(&h->bssid, &cfg->BSSID, ETH_ALEN);
7369
7370         /* SEQ filled in by MAC */
7371 }
7372
7373 int brcms_c_get_header_len(void)
7374 {
7375         return TXOFF;
7376 }
7377
7378 /*
7379  * Update all beacons for the system.
7380  */
7381 void brcms_c_update_beacon(struct brcms_c_info *wlc)
7382 {
7383         struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7384
7385         if (bsscfg->up && !bsscfg->BSS)
7386                 /* Clear the soft intmask */
7387                 wlc->defmacintmask &= ~MI_BCNTPL;
7388 }
7389
7390 /* Write ssid into shared memory */
7391 static void
7392 brcms_c_shm_ssid_upd(struct brcms_c_info *wlc, struct brcms_bss_cfg *cfg)
7393 {
7394         u8 *ssidptr = cfg->SSID;
7395         u16 base = M_SSID;
7396         u8 ssidbuf[IEEE80211_MAX_SSID_LEN];
7397
7398         /* padding the ssid with zero and copy it into shm */
7399         memset(ssidbuf, 0, IEEE80211_MAX_SSID_LEN);
7400         memcpy(ssidbuf, ssidptr, cfg->SSID_len);
7401
7402         brcms_c_copyto_shm(wlc, base, ssidbuf, IEEE80211_MAX_SSID_LEN);
7403         brcms_b_write_shm(wlc->hw, M_SSIDLEN, (u16) cfg->SSID_len);
7404 }
7405
7406 static void
7407 brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
7408                               struct brcms_bss_cfg *cfg,
7409                               bool suspend)
7410 {
7411         u16 prb_resp[BCN_TMPL_LEN / 2];
7412         int len = BCN_TMPL_LEN;
7413
7414         /*
7415          * write the probe response to hardware, or save in
7416          * the config structure
7417          */
7418
7419         /* create the probe response template */
7420         brcms_c_bcn_prb_template(wlc, IEEE80211_STYPE_PROBE_RESP, 0,
7421                                  cfg, prb_resp, &len);
7422
7423         if (suspend)
7424                 brcms_c_suspend_mac_and_wait(wlc);
7425
7426         /* write the probe response into the template region */
7427         brcms_b_write_template_ram(wlc->hw, T_PRS_TPL_BASE,
7428                                     (len + 3) & ~3, prb_resp);
7429
7430         /* write the length of the probe response frame (+PLCP/-FCS) */
7431         brcms_b_write_shm(wlc->hw, M_PRB_RESP_FRM_LEN, (u16) len);
7432
7433         /* write the SSID and SSID length */
7434         brcms_c_shm_ssid_upd(wlc, cfg);
7435
7436         /*
7437          * Write PLCP headers and durations for probe response frames
7438          * at all rates. Use the actual frame length covered by the
7439          * PLCP header for the call to brcms_c_mod_prb_rsp_rate_table()
7440          * by subtracting the PLCP len and adding the FCS.
7441          */
7442         len += (-D11_PHY_HDR_LEN + FCS_LEN);
7443         brcms_c_mod_prb_rsp_rate_table(wlc, (u16) len);
7444
7445         if (suspend)
7446                 brcms_c_enable_mac(wlc);
7447 }
7448
7449 void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
7450 {
7451         struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7452
7453         /* update AP or IBSS probe responses */
7454         if (bsscfg->up && !bsscfg->BSS)
7455                 brcms_c_bss_update_probe_resp(wlc, bsscfg, suspend);
7456 }
7457
7458 int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo,
7459                            uint *blocks)
7460 {
7461         if (fifo >= NFIFO)
7462                 return -EINVAL;
7463
7464         *blocks = wlc_hw->xmtfifo_sz[fifo];
7465
7466         return 0;
7467 }
7468
7469 void
7470 brcms_c_set_addrmatch(struct brcms_c_info *wlc, int match_reg_offset,
7471                   const u8 *addr)
7472 {
7473         brcms_b_set_addrmatch(wlc->hw, match_reg_offset, addr);
7474         if (match_reg_offset == RCM_BSSID_OFFSET)
7475                 memcpy(wlc->bsscfg->BSSID, addr, ETH_ALEN);
7476 }
7477
7478 /*
7479  * Flag 'scan in progress' to withhold dynamic phy calibration
7480  */
7481 void brcms_c_scan_start(struct brcms_c_info *wlc)
7482 {
7483         wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, true);
7484 }
7485
7486 void brcms_c_scan_stop(struct brcms_c_info *wlc)
7487 {
7488         wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, false);
7489 }
7490
7491 void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state)
7492 {
7493         wlc->pub->associated = state;
7494         wlc->bsscfg->associated = state;
7495 }
7496
7497 /*
7498  * When a remote STA/AP is removed by Mac80211, or when it can no longer accept
7499  * AMPDU traffic, packets pending in hardware have to be invalidated so that
7500  * when later on hardware releases them, they can be handled appropriately.
7501  */
7502 void brcms_c_inval_dma_pkts(struct brcms_hardware *hw,
7503                                struct ieee80211_sta *sta,
7504                                void (*dma_callback_fn))
7505 {
7506         struct dma_pub *dmah;
7507         int i;
7508         for (i = 0; i < NFIFO; i++) {
7509                 dmah = hw->di[i];
7510                 if (dmah != NULL)
7511                         dma_walk_packets(dmah, dma_callback_fn, sta);
7512         }
7513 }
7514
7515 int brcms_c_get_curband(struct brcms_c_info *wlc)
7516 {
7517         return wlc->band->bandunit;
7518 }
7519
7520 void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop)
7521 {
7522         int timeout = 20;
7523         int i;
7524
7525         /* Kick DMA to send any pending AMPDU */
7526         for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
7527                 if (wlc->hw->di[i])
7528                         dma_txflush(wlc->hw->di[i]);
7529
7530         /* wait for queue and DMA fifos to run dry */
7531         while (brcms_txpktpendtot(wlc) > 0) {
7532                 brcms_msleep(wlc->wl, 1);
7533
7534                 if (--timeout == 0)
7535                         break;
7536         }
7537
7538         WARN_ON_ONCE(timeout == 0);
7539 }
7540
7541 void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
7542 {
7543         wlc->bcn_li_bcn = interval;
7544         if (wlc->pub->up)
7545                 brcms_c_bcn_li_upd(wlc);
7546 }
7547
7548 int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr)
7549 {
7550         uint qdbm;
7551
7552         /* Remove override bit and clip to max qdbm value */
7553         qdbm = min_t(uint, txpwr * BRCMS_TXPWR_DB_FACTOR, 0xff);
7554         return wlc_phy_txpower_set(wlc->band->pi, qdbm, false);
7555 }
7556
7557 int brcms_c_get_tx_power(struct brcms_c_info *wlc)
7558 {
7559         uint qdbm;
7560         bool override;
7561
7562         wlc_phy_txpower_get(wlc->band->pi, &qdbm, &override);
7563
7564         /* Return qdbm units */
7565         return (int)(qdbm / BRCMS_TXPWR_DB_FACTOR);
7566 }
7567
7568 /* Process received frames */
7569 /*
7570  * Return true if more frames need to be processed. false otherwise.
7571  * Param 'bound' indicates max. # frames to process before break out.
7572  */
7573 static void brcms_c_recv(struct brcms_c_info *wlc, struct sk_buff *p)
7574 {
7575         struct d11rxhdr *rxh;
7576         struct ieee80211_hdr *h;
7577         uint len;
7578         bool is_amsdu;
7579
7580         /* frame starts with rxhdr */
7581         rxh = (struct d11rxhdr *) (p->data);
7582
7583         /* strip off rxhdr */
7584         skb_pull(p, BRCMS_HWRXOFF);
7585
7586         /* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU subframes */
7587         if (rxh->RxStatus1 & RXS_PBPRES) {
7588                 if (p->len < 2) {
7589                         brcms_err(wlc->hw->d11core,
7590                                   "wl%d: recv: rcvd runt of len %d\n",
7591                                   wlc->pub->unit, p->len);
7592                         goto toss;
7593                 }
7594                 skb_pull(p, 2);
7595         }
7596
7597         h = (struct ieee80211_hdr *)(p->data + D11_PHY_HDR_LEN);
7598         len = p->len;
7599
7600         if (rxh->RxStatus1 & RXS_FCSERR) {
7601                 if (!(wlc->filter_flags & FIF_FCSFAIL))
7602                         goto toss;
7603         }
7604
7605         /* check received pkt has at least frame control field */
7606         if (len < D11_PHY_HDR_LEN + sizeof(h->frame_control))
7607                 goto toss;
7608
7609         /* not supporting A-MSDU */
7610         is_amsdu = rxh->RxStatus2 & RXS_AMSDU_MASK;
7611         if (is_amsdu)
7612                 goto toss;
7613
7614         brcms_c_recvctl(wlc, rxh, p);
7615         return;
7616
7617  toss:
7618         brcmu_pkt_buf_free_skb(p);
7619 }
7620
7621 /* Process received frames */
7622 /*
7623  * Return true if more frames need to be processed. false otherwise.
7624  * Param 'bound' indicates max. # frames to process before break out.
7625  */
7626 static bool
7627 brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
7628 {
7629         struct sk_buff *p;
7630         struct sk_buff *next = NULL;
7631         struct sk_buff_head recv_frames;
7632
7633         uint n = 0;
7634         uint bound_limit = bound ? RXBND : -1;
7635         bool morepending;
7636
7637         skb_queue_head_init(&recv_frames);
7638
7639         /* gather received frames */
7640         do {
7641                 /* !give others some time to run! */
7642                 if (n >= bound_limit)
7643                         break;
7644
7645                 morepending = dma_rx(wlc_hw->di[fifo], &recv_frames);
7646                 n++;
7647         } while (morepending);
7648
7649         /* post more rbufs */
7650         dma_rxfill(wlc_hw->di[fifo]);
7651
7652         /* process each frame */
7653         skb_queue_walk_safe(&recv_frames, p, next) {
7654                 struct d11rxhdr_le *rxh_le;
7655                 struct d11rxhdr *rxh;
7656
7657                 skb_unlink(p, &recv_frames);
7658                 rxh_le = (struct d11rxhdr_le *)p->data;
7659                 rxh = (struct d11rxhdr *)p->data;
7660
7661                 /* fixup rx header endianness */
7662                 rxh->RxFrameSize = le16_to_cpu(rxh_le->RxFrameSize);
7663                 rxh->PhyRxStatus_0 = le16_to_cpu(rxh_le->PhyRxStatus_0);
7664                 rxh->PhyRxStatus_1 = le16_to_cpu(rxh_le->PhyRxStatus_1);
7665                 rxh->PhyRxStatus_2 = le16_to_cpu(rxh_le->PhyRxStatus_2);
7666                 rxh->PhyRxStatus_3 = le16_to_cpu(rxh_le->PhyRxStatus_3);
7667                 rxh->PhyRxStatus_4 = le16_to_cpu(rxh_le->PhyRxStatus_4);
7668                 rxh->PhyRxStatus_5 = le16_to_cpu(rxh_le->PhyRxStatus_5);
7669                 rxh->RxStatus1 = le16_to_cpu(rxh_le->RxStatus1);
7670                 rxh->RxStatus2 = le16_to_cpu(rxh_le->RxStatus2);
7671                 rxh->RxTSFTime = le16_to_cpu(rxh_le->RxTSFTime);
7672                 rxh->RxChan = le16_to_cpu(rxh_le->RxChan);
7673
7674                 brcms_c_recv(wlc_hw->wlc, p);
7675         }
7676
7677         return morepending;
7678 }
7679
7680 /* second-level interrupt processing
7681  *   Return true if another dpc needs to be re-scheduled. false otherwise.
7682  *   Param 'bounded' indicates if applicable loops should be bounded.
7683  */
7684 bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded)
7685 {
7686         u32 macintstatus;
7687         struct brcms_hardware *wlc_hw = wlc->hw;
7688         struct bcma_device *core = wlc_hw->d11core;
7689
7690         if (brcms_deviceremoved(wlc)) {
7691                 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
7692                           __func__);
7693                 brcms_down(wlc->wl);
7694                 return false;
7695         }
7696
7697         /* grab and clear the saved software intstatus bits */
7698         macintstatus = wlc->macintstatus;
7699         wlc->macintstatus = 0;
7700
7701         brcms_dbg_int(core, "wl%d: macintstatus 0x%x\n",
7702                       wlc_hw->unit, macintstatus);
7703
7704         WARN_ON(macintstatus & MI_PRQ); /* PRQ Interrupt in non-MBSS */
7705
7706         /* tx status */
7707         if (macintstatus & MI_TFS) {
7708                 bool fatal;
7709                 if (brcms_b_txstatus(wlc->hw, bounded, &fatal))
7710                         wlc->macintstatus |= MI_TFS;
7711                 if (fatal) {
7712                         brcms_err(core, "MI_TFS: fatal\n");
7713                         goto fatal;
7714                 }
7715         }
7716
7717         if (macintstatus & (MI_TBTT | MI_DTIM_TBTT))
7718                 brcms_c_tbtt(wlc);
7719
7720         /* ATIM window end */
7721         if (macintstatus & MI_ATIMWINEND) {
7722                 brcms_dbg_info(core, "end of ATIM window\n");
7723                 bcma_set32(core, D11REGOFFS(maccommand), wlc->qvalid);
7724                 wlc->qvalid = 0;
7725         }
7726
7727         /*
7728          * received data or control frame, MI_DMAINT is
7729          * indication of RX_FIFO interrupt
7730          */
7731         if (macintstatus & MI_DMAINT)
7732                 if (brcms_b_recv(wlc_hw, RX_FIFO, bounded))
7733                         wlc->macintstatus |= MI_DMAINT;
7734
7735         /* noise sample collected */
7736         if (macintstatus & MI_BG_NOISE)
7737                 wlc_phy_noise_sample_intr(wlc_hw->band->pi);
7738
7739         if (macintstatus & MI_GP0) {
7740                 brcms_err(core, "wl%d: PSM microcode watchdog fired at %d "
7741                           "(seconds). Resetting.\n", wlc_hw->unit, wlc_hw->now);
7742
7743                 printk_once("%s : PSM Watchdog, chipid 0x%x, chiprev 0x%x\n",
7744                             __func__, ai_get_chip_id(wlc_hw->sih),
7745                             ai_get_chiprev(wlc_hw->sih));
7746                 brcms_fatal_error(wlc_hw->wlc->wl);
7747         }
7748
7749         /* gptimer timeout */
7750         if (macintstatus & MI_TO)
7751                 bcma_write32(core, D11REGOFFS(gptimer), 0);
7752
7753         if (macintstatus & MI_RFDISABLE) {
7754                 brcms_dbg_info(core, "wl%d: BMAC Detected a change on the"
7755                                " RF Disable Input\n", wlc_hw->unit);
7756                 brcms_rfkill_set_hw_state(wlc->wl);
7757         }
7758
7759         /* it isn't done and needs to be resched if macintstatus is non-zero */
7760         return wlc->macintstatus != 0;
7761
7762  fatal:
7763         brcms_fatal_error(wlc_hw->wlc->wl);
7764         return wlc->macintstatus != 0;
7765 }
7766
7767 void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx)
7768 {
7769         struct bcma_device *core = wlc->hw->d11core;
7770         struct ieee80211_channel *ch = wlc->pub->ieee_hw->conf.channel;
7771         u16 chanspec;
7772
7773         brcms_dbg_info(core, "wl%d\n", wlc->pub->unit);
7774
7775         chanspec = ch20mhz_chspec(ch->hw_value);
7776
7777         brcms_b_init(wlc->hw, chanspec);
7778
7779         /* update beacon listen interval */
7780         brcms_c_bcn_li_upd(wlc);
7781
7782         /* write ethernet address to core */
7783         brcms_c_set_mac(wlc->bsscfg);
7784         brcms_c_set_bssid(wlc->bsscfg);
7785
7786         /* Update tsf_cfprep if associated and up */
7787         if (wlc->pub->associated && wlc->bsscfg->up) {
7788                 u32 bi;
7789
7790                 /* get beacon period and convert to uS */
7791                 bi = wlc->bsscfg->current_bss->beacon_period << 10;
7792                 /*
7793                  * update since init path would reset
7794                  * to default value
7795                  */
7796                 bcma_write32(core, D11REGOFFS(tsf_cfprep),
7797                              bi << CFPREP_CBI_SHIFT);
7798
7799                 /* Update maccontrol PM related bits */
7800                 brcms_c_set_ps_ctrl(wlc);
7801         }
7802
7803         brcms_c_bandinit_ordered(wlc, chanspec);
7804
7805         /* init probe response timeout */
7806         brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
7807
7808         /* init max burst txop (framebursting) */
7809         brcms_b_write_shm(wlc->hw, M_MBURST_TXOP,
7810                       (wlc->
7811                        _rifs ? (EDCF_AC_VO_TXOP_AP << 5) : MAXFRAMEBURST_TXOP));
7812
7813         /* initialize maximum allowed duty cycle */
7814         brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_ofdm, true, true);
7815         brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_cck, false, true);
7816
7817         /*
7818          * Update some shared memory locations related to
7819          * max AMPDU size allowed to received
7820          */
7821         brcms_c_ampdu_shm_upd(wlc->ampdu);
7822
7823         /* band-specific inits */
7824         brcms_c_bsinit(wlc);
7825
7826         /* Enable EDCF mode (while the MAC is suspended) */
7827         bcma_set16(core, D11REGOFFS(ifs_ctl), IFS_USEEDCF);
7828         brcms_c_edcf_setparams(wlc, false);
7829
7830         /* read the ucode version if we have not yet done so */
7831         if (wlc->ucode_rev == 0) {
7832                 wlc->ucode_rev =
7833                     brcms_b_read_shm(wlc->hw, M_BOM_REV_MAJOR) << NBITS(u16);
7834                 wlc->ucode_rev |= brcms_b_read_shm(wlc->hw, M_BOM_REV_MINOR);
7835         }
7836
7837         /* ..now really unleash hell (allow the MAC out of suspend) */
7838         brcms_c_enable_mac(wlc);
7839
7840         /* suspend the tx fifos and mute the phy for preism cac time */
7841         if (mute_tx)
7842                 brcms_b_mute(wlc->hw, true);
7843
7844         /* enable the RF Disable Delay timer */
7845         bcma_write32(core, D11REGOFFS(rfdisabledly), RFDISABLE_DEFAULT);
7846
7847         /*
7848          * Initialize WME parameters; if they haven't been set by some other
7849          * mechanism (IOVar, etc) then read them from the hardware.
7850          */
7851         if (GFIELD(wlc->wme_retries[0], EDCF_SHORT) == 0) {
7852                 /* Uninitialized; read from HW */
7853                 int ac;
7854
7855                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
7856                         wlc->wme_retries[ac] =
7857                             brcms_b_read_shm(wlc->hw, M_AC_TXLMT_ADDR(ac));
7858         }
7859 }
7860
7861 /*
7862  * The common driver entry routine. Error codes should be unique
7863  */
7864 struct brcms_c_info *
7865 brcms_c_attach(struct brcms_info *wl, struct bcma_device *core, uint unit,
7866                bool piomode, uint *perr)
7867 {
7868         struct brcms_c_info *wlc;
7869         uint err = 0;
7870         uint i, j;
7871         struct brcms_pub *pub;
7872
7873         /* allocate struct brcms_c_info state and its substructures */
7874         wlc = brcms_c_attach_malloc(unit, &err, 0);
7875         if (wlc == NULL)
7876                 goto fail;
7877         wlc->wiphy = wl->wiphy;
7878         pub = wlc->pub;
7879
7880 #if defined(DEBUG)
7881         wlc_info_dbg = wlc;
7882 #endif
7883
7884         wlc->band = wlc->bandstate[0];
7885         wlc->core = wlc->corestate;
7886         wlc->wl = wl;
7887         pub->unit = unit;
7888         pub->_piomode = piomode;
7889         wlc->bandinit_pending = false;
7890
7891         /* populate struct brcms_c_info with default values  */
7892         brcms_c_info_init(wlc, unit);
7893
7894         /* update sta/ap related parameters */
7895         brcms_c_ap_upd(wlc);
7896
7897         /*
7898          * low level attach steps(all hw accesses go
7899          * inside, no more in rest of the attach)
7900          */
7901         err = brcms_b_attach(wlc, core, unit, piomode);
7902         if (err)
7903                 goto fail;
7904
7905         brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, OFF);
7906
7907         pub->phy_11ncapable = BRCMS_PHY_11N_CAP(wlc->band);
7908
7909         /* disable allowed duty cycle */
7910         wlc->tx_duty_cycle_ofdm = 0;
7911         wlc->tx_duty_cycle_cck = 0;
7912
7913         brcms_c_stf_phy_chain_calc(wlc);
7914
7915         /* txchain 1: txant 0, txchain 2: txant 1 */
7916         if (BRCMS_ISNPHY(wlc->band) && (wlc->stf->txstreams == 1))
7917                 wlc->stf->txant = wlc->stf->hw_txchain - 1;
7918
7919         /* push to BMAC driver */
7920         wlc_phy_stf_chain_init(wlc->band->pi, wlc->stf->hw_txchain,
7921                                wlc->stf->hw_rxchain);
7922
7923         /* pull up some info resulting from the low attach */
7924         for (i = 0; i < NFIFO; i++)
7925                 wlc->core->txavail[i] = wlc->hw->txavail[i];
7926
7927         memcpy(&wlc->perm_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
7928         memcpy(&pub->cur_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
7929
7930         for (j = 0; j < wlc->pub->_nbands; j++) {
7931                 wlc->band = wlc->bandstate[j];
7932
7933                 if (!brcms_c_attach_stf_ant_init(wlc)) {
7934                         err = 24;
7935                         goto fail;
7936                 }
7937
7938                 /* default contention windows size limits */
7939                 wlc->band->CWmin = APHY_CWMIN;
7940                 wlc->band->CWmax = PHY_CWMAX;
7941
7942                 /* init gmode value */
7943                 if (wlc->band->bandtype == BRCM_BAND_2G) {
7944                         wlc->band->gmode = GMODE_AUTO;
7945                         brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER,
7946                                            wlc->band->gmode);
7947                 }
7948
7949                 /* init _n_enab supported mode */
7950                 if (BRCMS_PHY_11N_CAP(wlc->band)) {
7951                         pub->_n_enab = SUPPORT_11N;
7952                         brcms_c_protection_upd(wlc, BRCMS_PROT_N_USER,
7953                                                    ((pub->_n_enab ==
7954                                                      SUPPORT_11N) ? WL_11N_2x2 :
7955                                                     WL_11N_3x3));
7956                 }
7957
7958                 /* init per-band default rateset, depend on band->gmode */
7959                 brcms_default_rateset(wlc, &wlc->band->defrateset);
7960
7961                 /* fill in hw_rateset */
7962                 brcms_c_rateset_filter(&wlc->band->defrateset,
7963                                    &wlc->band->hw_rateset, false,
7964                                    BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
7965                                    (bool) (wlc->pub->_n_enab & SUPPORT_11N));
7966         }
7967
7968         /*
7969          * update antenna config due to
7970          * wlc->stf->txant/txchain/ant_rx_ovr change
7971          */
7972         brcms_c_stf_phy_txant_upd(wlc);
7973
7974         /* attach each modules */
7975         err = brcms_c_attach_module(wlc);
7976         if (err != 0)
7977                 goto fail;
7978
7979         if (!brcms_c_timers_init(wlc, unit)) {
7980                 wiphy_err(wl->wiphy, "wl%d: %s: init_timer failed\n", unit,
7981                           __func__);
7982                 err = 32;
7983                 goto fail;
7984         }
7985
7986         /* depend on rateset, gmode */
7987         wlc->cmi = brcms_c_channel_mgr_attach(wlc);
7988         if (!wlc->cmi) {
7989                 wiphy_err(wl->wiphy, "wl%d: %s: channel_mgr_attach failed"
7990                           "\n", unit, __func__);
7991                 err = 33;
7992                 goto fail;
7993         }
7994
7995         /* init default when all parameters are ready, i.e. ->rateset */
7996         brcms_c_bss_default_init(wlc);
7997
7998         /*
7999          * Complete the wlc default state initializations..
8000          */
8001
8002         wlc->bsscfg->wlc = wlc;
8003
8004         wlc->mimoft = FT_HT;
8005         wlc->mimo_40txbw = AUTO;
8006         wlc->ofdm_40txbw = AUTO;
8007         wlc->cck_40txbw = AUTO;
8008         brcms_c_update_mimo_band_bwcap(wlc, BRCMS_N_BW_20IN2G_40IN5G);
8009
8010         /* Set default values of SGI */
8011         if (BRCMS_SGI_CAP_PHY(wlc)) {
8012                 brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8013                                                BRCMS_N_SGI_40));
8014         } else if (BRCMS_ISSSLPNPHY(wlc->band)) {
8015                 brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8016                                                BRCMS_N_SGI_40));
8017         } else {
8018                 brcms_c_ht_update_sgi_rx(wlc, 0);
8019         }
8020
8021         brcms_b_antsel_set(wlc->hw, wlc->asi->antsel_avail);
8022
8023         if (perr)
8024                 *perr = 0;
8025
8026         return wlc;
8027
8028  fail:
8029         wiphy_err(wl->wiphy, "wl%d: %s: failed with err %d\n",
8030                   unit, __func__, err);
8031         if (wlc)
8032                 brcms_c_detach(wlc);
8033
8034         if (perr)
8035                 *perr = err;
8036         return NULL;
8037 }