drivers/net/wireless/brcm80211/brcmsmac/main.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  * Copyright (c) 2013 Hauke Mehrtens <hauke@hauke-m.de>
   4  *
   5  * Permission to use, copy, modify, and/or distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  12  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  14  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  15  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19
  20 #include <linux/pci_ids.h>
  21 #include <linux/if_ether.h>
  22 #include <net/cfg80211.h>
  23 #include <net/mac80211.h>
  24 #include <brcm_hw_ids.h>
  25 #include <aiutils.h>
  26 #include <chipcommon.h>
  27 #include "rate.h"
  28 #include "scb.h"
  29 #include "phy/phy_hal.h"
  30 #include "channel.h"
  31 #include "antsel.h"
  32 #include "stf.h"
  33 #include "ampdu.h"
  34 #include "mac80211_if.h"
  35 #include "ucode_loader.h"
  36 #include "main.h"
  37 #include "soc.h"
  38 #include "dma.h"
  39 #include "debug.h"
  40 #include "brcms_trace_events.h"
  41
  42 /* watchdog timer, in unit of ms */
  43 #define TIMER_INTERVAL_WATCHDOG         1000
  44 /* radio monitor timer, in unit of ms */
  45 #define TIMER_INTERVAL_RADIOCHK         800
  46
  47 /* beacon interval, in unit of 1024TU */
  48 #define BEACON_INTERVAL_DEFAULT         100
  49
  50 /* n-mode support capability */
  51 /* 2x2 includes both 1x1 & 2x2 devices
  52  * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
  53  * control it independently
  54  */
  55 #define WL_11N_2x2                      1
  56 #define WL_11N_3x3                      3
  57 #define WL_11N_4x4                      4
  58
  59 #define EDCF_ACI_MASK                   0x60
  60 #define EDCF_ACI_SHIFT                  5
  61 #define EDCF_ECWMIN_MASK                0x0f
  62 #define EDCF_ECWMAX_SHIFT               4
  63 #define EDCF_AIFSN_MASK                 0x0f
  64 #define EDCF_AIFSN_MAX                  15
  65 #define EDCF_ECWMAX_MASK                0xf0
  66
  67 #define EDCF_AC_BE_TXOP_STA             0x0000
  68 #define EDCF_AC_BK_TXOP_STA             0x0000
  69 #define EDCF_AC_VO_ACI_STA              0x62
  70 #define EDCF_AC_VO_ECW_STA              0x32
  71 #define EDCF_AC_VI_ACI_STA              0x42
  72 #define EDCF_AC_VI_ECW_STA              0x43
  73 #define EDCF_AC_BK_ECW_STA              0xA4
  74 #define EDCF_AC_VI_TXOP_STA             0x005e
  75 #define EDCF_AC_VO_TXOP_STA             0x002f
  76 #define EDCF_AC_BE_ACI_STA              0x03
  77 #define EDCF_AC_BE_ECW_STA              0xA4
  78 #define EDCF_AC_BK_ACI_STA              0x27
  79 #define EDCF_AC_VO_TXOP_AP              0x002f
  80
  81 #define EDCF_TXOP2USEC(txop)            ((txop) << 5)
  82 #define EDCF_ECW2CW(exp)                ((1 << (exp)) - 1)
  83
  84 #define APHY_SYMBOL_TIME                4
  85 #define APHY_PREAMBLE_TIME              16
  86 #define APHY_SIGNAL_TIME                4
  87 #define APHY_SIFS_TIME                  16
  88 #define APHY_SERVICE_NBITS              16
  89 #define APHY_TAIL_NBITS                 6
  90 #define BPHY_SIFS_TIME                  10
  91 #define BPHY_PLCP_SHORT_TIME            96
  92
  93 #define PREN_PREAMBLE                   24
  94 #define PREN_MM_EXT                     12
  95 #define PREN_PREAMBLE_EXT               4
  96
  97 #define DOT11_MAC_HDR_LEN               24
  98 #define DOT11_ACK_LEN                   10
  99 #define DOT11_BA_LEN                    4
 100 #define DOT11_OFDM_SIGNAL_EXTENSION     6
 101 #define DOT11_MIN_FRAG_LEN              256
 102 #define DOT11_RTS_LEN                   16
 103 #define DOT11_CTS_LEN                   10
 104 #define DOT11_BA_BITMAP_LEN             128
 105 #define DOT11_MAXNUMFRAGS               16
 106 #define DOT11_MAX_FRAG_LEN              2346
 107
 108 #define BPHY_PLCP_TIME                  192
 109 #define RIFS_11N_TIME                   2
 110
 111 /* length of the BCN template area */
 112 #define BCN_TMPL_LEN                    512
 113
 114 /* brcms_bss_info flag bit values */
 115 #define BRCMS_BSS_HT                    0x0020  /* BSS is HT (MIMO) capable */
 116
 117 /* chip rx buffer offset */
 118 #define BRCMS_HWRXOFF                   38
 119
 120 /* rfdisable delay timer 500 ms, runs of ALP clock */
 121 #define RFDISABLE_DEFAULT               10000000
 122
 123 #define BRCMS_TEMPSENSE_PERIOD          10      /* 10 second timeout */
 124
 125 /* synthpu_dly times in us */
 126 #define SYNTHPU_DLY_APHY_US             3700
 127 #define SYNTHPU_DLY_BPHY_US             1050
 128 #define SYNTHPU_DLY_NPHY_US             2048
 129 #define SYNTHPU_DLY_LPPHY_US            300
 130
 131 #define ANTCNT                          10      /* vanilla M_MAX_ANTCNT val */
 132
 133 /* Per-AC retry limit register definitions; uses defs.h bitfield macros */
 134 #define EDCF_SHORT_S                    0
 135 #define EDCF_SFB_S                      4
 136 #define EDCF_LONG_S                     8
 137 #define EDCF_LFB_S                      12
 138 #define EDCF_SHORT_M                    BITFIELD_MASK(4)
 139 #define EDCF_SFB_M                      BITFIELD_MASK(4)
 140 #define EDCF_LONG_M                     BITFIELD_MASK(4)
 141 #define EDCF_LFB_M                      BITFIELD_MASK(4)
 142
 143 #define RETRY_SHORT_DEF                 7       /* Default Short retry Limit */
 144 #define RETRY_SHORT_MAX                 255     /* Maximum Short retry Limit */
 145 #define RETRY_LONG_DEF                  4       /* Default Long retry count */
 146 #define RETRY_SHORT_FB                  3       /* Short count for fb rate */
 147 #define RETRY_LONG_FB                   2       /* Long count for fb rate */
 148
 149 #define APHY_CWMIN                      15
 150 #define PHY_CWMAX                       1023
 151
 152 #define EDCF_AIFSN_MIN                  1
 153
 154 #define FRAGNUM_MASK                    0xF
 155
 156 #define APHY_SLOT_TIME                  9
 157 #define BPHY_SLOT_TIME                  20
 158
 159 #define WL_SPURAVOID_OFF                0
 160 #define WL_SPURAVOID_ON1                1
 161 #define WL_SPURAVOID_ON2                2
 162
 163 /* invalid core flags, use the saved coreflags */
 164 #define BRCMS_USE_COREFLAGS             0xffffffff
 165
 166 /* values for PLCPHdr_override */
 167 #define BRCMS_PLCP_AUTO                 -1
 168 #define BRCMS_PLCP_SHORT                0
 169 #define BRCMS_PLCP_LONG                 1
 170
 171 /* values for g_protection_override and n_protection_override */
 172 #define BRCMS_PROTECTION_AUTO           -1
 173 #define BRCMS_PROTECTION_OFF            0
 174 #define BRCMS_PROTECTION_ON             1
 175 #define BRCMS_PROTECTION_MMHDR_ONLY     2
 176 #define BRCMS_PROTECTION_CTS_ONLY       3
 177
 178 /* values for g_protection_control and n_protection_control */
 179 #define BRCMS_PROTECTION_CTL_OFF        0
 180 #define BRCMS_PROTECTION_CTL_LOCAL      1
 181 #define BRCMS_PROTECTION_CTL_OVERLAP    2
 182
 183 /* values for n_protection */
 184 #define BRCMS_N_PROTECTION_OFF          0
 185 #define BRCMS_N_PROTECTION_OPTIONAL     1
 186 #define BRCMS_N_PROTECTION_20IN40       2
 187 #define BRCMS_N_PROTECTION_MIXEDMODE    3
 188
 189 /* values for band specific 40MHz capabilities */
 190 #define BRCMS_N_BW_20ALL                0
 191 #define BRCMS_N_BW_40ALL                1
 192 #define BRCMS_N_BW_20IN2G_40IN5G        2
 193
 194 /* bitflags for SGI support (sgi_rx iovar) */
 195 #define BRCMS_N_SGI_20                  0x01
 196 #define BRCMS_N_SGI_40                  0x02
 197
 198 /* defines used by the nrate iovar */
 199 /* MSC in use,indicates b0-6 holds an mcs */
 200 #define NRATE_MCS_INUSE                 0x00000080
 201 /* rate/mcs value */
 202 #define NRATE_RATE_MASK                 0x0000007f
 203 /* stf mode mask: siso, cdd, stbc, sdm */
 204 #define NRATE_STF_MASK                  0x0000ff00
 205 /* stf mode shift */
 206 #define NRATE_STF_SHIFT                 8
 207 /* bit indicate to override mcs only */
 208 #define NRATE_OVERRIDE_MCS_ONLY         0x40000000
 209 #define NRATE_SGI_MASK                  0x00800000      /* sgi mode */
 210 #define NRATE_SGI_SHIFT                 23              /* sgi mode */
 211 #define NRATE_LDPC_CODING               0x00400000      /* adv coding in use */
 212 #define NRATE_LDPC_SHIFT                22              /* ldpc shift */
 213
 214 #define NRATE_STF_SISO                  0               /* stf mode SISO */
 215 #define NRATE_STF_CDD                   1               /* stf mode CDD */
 216 #define NRATE_STF_STBC                  2               /* stf mode STBC */
 217 #define NRATE_STF_SDM                   3               /* stf mode SDM */
 218
 219 #define MAX_DMA_SEGS                    4
 220
 221 /* # of entries in Tx FIFO */
 222 #define NTXD                            64
 223 /* Max # of entries in Rx FIFO based on 4kb page size */
 224 #define NRXD                            256
 225
 226 /* Amount of headroom to leave in Tx FIFO */
 227 #define TX_HEADROOM                     4
 228
 229 /* try to keep this # rbufs posted to the chip */
 230 #define NRXBUFPOST                      32
 231
 232 /* max # frames to process in brcms_c_recv() */
 233 #define RXBND                           8
 234 /* max # tx status to process in wlc_txstatus() */
 235 #define TXSBND                          8
 236
 237 /* brcmu_format_flags() bit description structure */
 238 struct brcms_c_bit_desc {
 239         u32 bit;
 240         const char *name;
 241 };
 242
 243 /*
 244  * The following table lists the buffer memory allocated to xmt fifos in HW.
 245  * the size is in units of 256bytes(one block), total size is HW dependent
 246  * ucode has default fifo partition, sw can overwrite if necessary
 247  *
 248  * This is documented in twiki under the topic UcodeTxFifo. Please ensure
 249  * the twiki is updated before making changes.
 250  */
 251
 252 /* Starting corerev for the fifo size table */
 253 #define XMTFIFOTBL_STARTREV     17
 254
 255 struct d11init {
 256         __le16 addr;
 257         __le16 size;
 258         __le32 value;
 259 };
 260
 261 struct edcf_acparam {
 262         u8 ACI;
 263         u8 ECW;
 264         u16 TXOP;
 265 } __packed;
 266
 267 /* debug/trace */
 268 uint brcm_msg_level;
 269
 270 /* TX FIFO number to WME/802.1E Access Category */
 271 static const u8 wme_fifo2ac[] = {
 272         IEEE80211_AC_BK,
 273         IEEE80211_AC_BE,
 274         IEEE80211_AC_VI,
 275         IEEE80211_AC_VO,
 276         IEEE80211_AC_BE,
 277         IEEE80211_AC_BE
 278 };
 279
 280 /* ieee80211 Access Category to TX FIFO number */
 281 static const u8 wme_ac2fifo[] = {
 282         TX_AC_VO_FIFO,
 283         TX_AC_VI_FIFO,
 284         TX_AC_BE_FIFO,
 285         TX_AC_BK_FIFO
 286 };
 287
 288 static const u16 xmtfifo_sz[][NFIFO] = {
 289         /* corerev 17: 5120, 49152, 49152, 5376, 4352, 1280 */
 290         {20, 192, 192, 21, 17, 5},
 291         /* corerev 18: */
 292         {0, 0, 0, 0, 0, 0},
 293         /* corerev 19: */
 294         {0, 0, 0, 0, 0, 0},
 295         /* corerev 20: 5120, 49152, 49152, 5376, 4352, 1280 */
 296         {20, 192, 192, 21, 17, 5},
 297         /* corerev 21: 2304, 14848, 5632, 3584, 3584, 1280 */
 298         {9, 58, 22, 14, 14, 5},
 299         /* corerev 22: 5120, 49152, 49152, 5376, 4352, 1280 */
 300         {20, 192, 192, 21, 17, 5},
 301         /* corerev 23: 5120, 49152, 49152, 5376, 4352, 1280 */
 302         {20, 192, 192, 21, 17, 5},
 303         /* corerev 24: 2304, 14848, 5632, 3584, 3584, 1280 */
 304         {9, 58, 22, 14, 14, 5},
 305         /* corerev 25: */
 306         {0, 0, 0, 0, 0, 0},
 307         /* corerev 26: */
 308         {0, 0, 0, 0, 0, 0},
 309         /* corerev 27: */
 310         {0, 0, 0, 0, 0, 0},
 311         /* corerev 28: 2304, 14848, 5632, 3584, 3584, 1280 */
 312         {9, 58, 22, 14, 14, 5},
 313 };
 314
 315 #ifdef DEBUG
 316 static const char * const fifo_names[] = {
 317         "AC_BK", "AC_BE", "AC_VI", "AC_VO", "BCMC", "ATIM" };
 318 #else
 319 static const char fifo_names[6][0];
 320 #endif
 321
 322 #ifdef DEBUG
 323 /* pointer to most recently allocated wl/wlc */
 324 static struct brcms_c_info *wlc_info_dbg = (struct brcms_c_info *) (NULL);
 325 #endif
 326
 327 /* Mapping of ieee80211 AC numbers to tx fifos */
 328 static const u8 ac_to_fifo_mapping[IEEE80211_NUM_ACS] = {
 329         [IEEE80211_AC_VO]       = TX_AC_VO_FIFO,
 330         [IEEE80211_AC_VI]       = TX_AC_VI_FIFO,
 331         [IEEE80211_AC_BE]       = TX_AC_BE_FIFO,
 332         [IEEE80211_AC_BK]       = TX_AC_BK_FIFO,
 333 };
 334
 335 /* Mapping of tx fifos to ieee80211 AC numbers */
 336 static const u8 fifo_to_ac_mapping[IEEE80211_NUM_ACS] = {
 337         [TX_AC_BK_FIFO] = IEEE80211_AC_BK,
 338         [TX_AC_BE_FIFO] = IEEE80211_AC_BE,
 339         [TX_AC_VI_FIFO] = IEEE80211_AC_VI,
 340         [TX_AC_VO_FIFO] = IEEE80211_AC_VO,
 341 };
 342
 343 static u8 brcms_ac_to_fifo(u8 ac)
 344 {
 345         if (ac >= ARRAY_SIZE(ac_to_fifo_mapping))
 346                 return TX_AC_BE_FIFO;
 347         return ac_to_fifo_mapping[ac];
 348 }
 349
 350 static u8 brcms_fifo_to_ac(u8 fifo)
 351 {
 352         if (fifo >= ARRAY_SIZE(fifo_to_ac_mapping))
 353                 return IEEE80211_AC_BE;
 354         return fifo_to_ac_mapping[fifo];
 355 }
 356
 357 /* Find basic rate for a given rate */
 358 static u8 brcms_basic_rate(struct brcms_c_info *wlc, u32 rspec)
 359 {
 360         if (is_mcs_rate(rspec))
 361                 return wlc->band->basic_rate[mcs_table[rspec & RSPEC_RATE_MASK]
 362                        .leg_ofdm];
 363         return wlc->band->basic_rate[rspec & RSPEC_RATE_MASK];
 364 }
 365
 366 static u16 frametype(u32 rspec, u8 mimoframe)
 367 {
 368         if (is_mcs_rate(rspec))
 369                 return mimoframe;
 370         return is_cck_rate(rspec) ? FT_CCK : FT_OFDM;
 371 }
 372
 373 /* currently the best mechanism for determining SIFS is the band in use */
 374 static u16 get_sifs(struct brcms_band *band)
 375 {
 376         return band->bandtype == BRCM_BAND_5G ? APHY_SIFS_TIME :
 377                                  BPHY_SIFS_TIME;
 378 }
 379
 380 /*
 381  * Detect Card removed.
 382  * Even checking an sbconfig register read will not false trigger when the core
 383  * is in reset it breaks CF address mechanism. Accessing gphy phyversion will
 384  * cause SB error if aphy is in reset on 4306B0-DB. Need a simple accessible
 385  * reg with fixed 0/1 pattern (some platforms return all 0).
 386  * If clocks are present, call the sb routine which will figure out if the
 387  * device is removed.
 388  */
 389 static bool brcms_deviceremoved(struct brcms_c_info *wlc)
 390 {
 391         u32 macctrl;
 392
 393         if (!wlc->hw->clk)
 394                 return ai_deviceremoved(wlc->hw->sih);
 395         macctrl = bcma_read32(wlc->hw->d11core,
 396                               D11REGOFFS(maccontrol));
 397         return (macctrl & (MCTL_PSM_JMP_0 | MCTL_IHR_EN)) != MCTL_IHR_EN;
 398 }
 399
 400 /* sum the individual fifo tx pending packet counts */
 401 static int brcms_txpktpendtot(struct brcms_c_info *wlc)
 402 {
 403         int i;
 404         int pending = 0;
 405
 406         for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
 407                 if (wlc->hw->di[i])
 408                         pending += dma_txpending(wlc->hw->di[i]);
 409         return pending;
 410 }
 411
 412 static bool brcms_is_mband_unlocked(struct brcms_c_info *wlc)
 413 {
 414         return wlc->pub->_nbands > 1 && !wlc->bandlocked;
 415 }
 416
 417 static int brcms_chspec_bw(u16 chanspec)
 418 {
 419         if (CHSPEC_IS40(chanspec))
 420                 return BRCMS_40_MHZ;
 421         if (CHSPEC_IS20(chanspec))
 422                 return BRCMS_20_MHZ;
 423
 424         return BRCMS_10_MHZ;
 425 }
 426
 427 static void brcms_c_bsscfg_mfree(struct brcms_bss_cfg *cfg)
 428 {
 429         if (cfg == NULL)
 430                 return;
 431
 432         kfree(cfg->current_bss);
 433         kfree(cfg);
 434 }
 435
 436 static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
 437 {
 438         if (wlc == NULL)
 439                 return;
 440
 441         brcms_c_bsscfg_mfree(wlc->bsscfg);
 442         kfree(wlc->pub);
 443         kfree(wlc->modulecb);
 444         kfree(wlc->default_bss);
 445         kfree(wlc->protection);
 446         kfree(wlc->stf);
 447         kfree(wlc->bandstate[0]);
 448         kfree(wlc->corestate->macstat_snapshot);
 449         kfree(wlc->corestate);
 450         kfree(wlc->hw->bandstate[0]);
 451         kfree(wlc->hw);
 452         if (wlc->beacon)
 453                 dev_kfree_skb_any(wlc->beacon);
 454         if (wlc->probe_resp)
 455                 dev_kfree_skb_any(wlc->probe_resp);
 456
 457         /* free the wlc */
 458         kfree(wlc);
 459         wlc = NULL;
 460 }
 461
 462 static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
 463 {
 464         struct brcms_bss_cfg *cfg;
 465
 466         cfg = kzalloc(sizeof(struct brcms_bss_cfg), GFP_ATOMIC);
 467         if (cfg == NULL)
 468                 goto fail;
 469
 470         cfg->current_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
 471         if (cfg->current_bss == NULL)
 472                 goto fail;
 473
 474         return cfg;
 475
 476  fail:
 477         brcms_c_bsscfg_mfree(cfg);
 478         return NULL;
 479 }
 480
 481 static struct brcms_c_info *
 482 brcms_c_attach_malloc(uint unit, uint *err, uint devid)
 483 {
 484         struct brcms_c_info *wlc;
 485
 486         wlc = kzalloc(sizeof(struct brcms_c_info), GFP_ATOMIC);
 487         if (wlc == NULL) {
 488                 *err = 1002;
 489                 goto fail;
 490         }
 491
 492         /* allocate struct brcms_c_pub state structure */
 493         wlc->pub = kzalloc(sizeof(struct brcms_pub), GFP_ATOMIC);
 494         if (wlc->pub == NULL) {
 495                 *err = 1003;
 496                 goto fail;
 497         }
 498         wlc->pub->wlc = wlc;
 499
 500         /* allocate struct brcms_hardware state structure */
 501
 502         wlc->hw = kzalloc(sizeof(struct brcms_hardware), GFP_ATOMIC);
 503         if (wlc->hw == NULL) {
 504                 *err = 1005;
 505                 goto fail;
 506         }
 507         wlc->hw->wlc = wlc;
 508
 509         wlc->hw->bandstate[0] =
 510                 kzalloc(sizeof(struct brcms_hw_band) * MAXBANDS, GFP_ATOMIC);
 511         if (wlc->hw->bandstate[0] == NULL) {
 512                 *err = 1006;
 513                 goto fail;
 514         } else {
 515                 int i;
 516
 517                 for (i = 1; i < MAXBANDS; i++)
 518                         wlc->hw->bandstate[i] = (struct brcms_hw_band *)
 519                             ((unsigned long)wlc->hw->bandstate[0] +
 520                              (sizeof(struct brcms_hw_band) * i));
 521         }
 522
 523         wlc->modulecb =
 524                 kzalloc(sizeof(struct modulecb) * BRCMS_MAXMODULES, GFP_ATOMIC);
 525         if (wlc->modulecb == NULL) {
 526                 *err = 1009;
 527                 goto fail;
 528         }
 529
 530         wlc->default_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
 531         if (wlc->default_bss == NULL) {
 532                 *err = 1010;
 533                 goto fail;
 534         }
 535
 536         wlc->bsscfg = brcms_c_bsscfg_malloc(unit);
 537         if (wlc->bsscfg == NULL) {
 538                 *err = 1011;
 539                 goto fail;
 540         }
 541
 542         wlc->protection = kzalloc(sizeof(struct brcms_protection),
 543                                   GFP_ATOMIC);
 544         if (wlc->protection == NULL) {
 545                 *err = 1016;
 546                 goto fail;
 547         }
 548
 549         wlc->stf = kzalloc(sizeof(struct brcms_stf), GFP_ATOMIC);
 550         if (wlc->stf == NULL) {
 551                 *err = 1017;
 552                 goto fail;
 553         }
 554
 555         wlc->bandstate[0] =
 556                 kzalloc(sizeof(struct brcms_band)*MAXBANDS, GFP_ATOMIC);
 557         if (wlc->bandstate[0] == NULL) {
 558                 *err = 1025;
 559                 goto fail;
 560         } else {
 561                 int i;
 562
 563                 for (i = 1; i < MAXBANDS; i++)
 564                         wlc->bandstate[i] = (struct brcms_band *)
 565                                 ((unsigned long)wlc->bandstate[0]
 566                                 + (sizeof(struct brcms_band)*i));
 567         }
 568
 569         wlc->corestate = kzalloc(sizeof(struct brcms_core), GFP_ATOMIC);
 570         if (wlc->corestate == NULL) {
 571                 *err = 1026;
 572                 goto fail;
 573         }
 574
 575         wlc->corestate->macstat_snapshot =
 576                 kzalloc(sizeof(struct macstat), GFP_ATOMIC);
 577         if (wlc->corestate->macstat_snapshot == NULL) {
 578                 *err = 1027;
 579                 goto fail;
 580         }
 581
 582         return wlc;
 583
 584  fail:
 585         brcms_c_detach_mfree(wlc);
 586         return NULL;
 587 }
 588
 589 /*
 590  * Update the slot timing for standard 11b/g (20us slots)
 591  * or shortslot 11g (9us slots)
 592  * The PSM needs to be suspended for this call.
 593  */
 594 static void brcms_b_update_slot_timing(struct brcms_hardware *wlc_hw,
 595                                         bool shortslot)
 596 {
 597         struct bcma_device *core = wlc_hw->d11core;
 598
 599         if (shortslot) {
 600                 /* 11g short slot: 11a timing */
 601                 bcma_write16(core, D11REGOFFS(ifs_slot), 0x0207);
 602                 brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, APHY_SLOT_TIME);
 603         } else {
 604                 /* 11g long slot: 11b timing */
 605                 bcma_write16(core, D11REGOFFS(ifs_slot), 0x0212);
 606                 brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, BPHY_SLOT_TIME);
 607         }
 608 }
 609
 610 /*
 611  * calculate frame duration of a given rate and length, return
 612  * time in usec unit
 613  */
 614 static uint brcms_c_calc_frame_time(struct brcms_c_info *wlc, u32 ratespec,
 615                                     u8 preamble_type, uint mac_len)
 616 {
 617         uint nsyms, dur = 0, Ndps, kNdps;
 618         uint rate = rspec2rate(ratespec);
 619
 620         if (rate == 0) {
 621                 brcms_err(wlc->hw->d11core, "wl%d: WAR: using rate of 1 mbps\n",
 622                           wlc->pub->unit);
 623                 rate = BRCM_RATE_1M;
 624         }
 625
 626         if (is_mcs_rate(ratespec)) {
 627                 uint mcs = ratespec & RSPEC_RATE_MASK;
 628                 int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
 629
 630                 dur = PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
 631                 if (preamble_type == BRCMS_MM_PREAMBLE)
 632                         dur += PREN_MM_EXT;
 633                 /* 1000Ndbps = kbps * 4 */
 634                 kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
 635                                    rspec_issgi(ratespec)) * 4;
 636
 637                 if (rspec_stc(ratespec) == 0)
 638                         nsyms =
 639                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
 640                                   APHY_TAIL_NBITS) * 1000, kNdps);
 641                 else
 642                         /* STBC needs to have even number of symbols */
 643                         nsyms =
 644                             2 *
 645                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
 646                                   APHY_TAIL_NBITS) * 1000, 2 * kNdps);
 647
 648                 dur += APHY_SYMBOL_TIME * nsyms;
 649                 if (wlc->band->bandtype == BRCM_BAND_2G)
 650                         dur += DOT11_OFDM_SIGNAL_EXTENSION;
 651         } else if (is_ofdm_rate(rate)) {
 652                 dur = APHY_PREAMBLE_TIME;
 653                 dur += APHY_SIGNAL_TIME;
 654                 /* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
 655                 Ndps = rate * 2;
 656                 /* NSyms = CEILING((SERVICE + 8*NBytes + TAIL) / Ndbps) */
 657                 nsyms =
 658                     CEIL((APHY_SERVICE_NBITS + 8 * mac_len + APHY_TAIL_NBITS),
 659                          Ndps);
 660                 dur += APHY_SYMBOL_TIME * nsyms;
 661                 if (wlc->band->bandtype == BRCM_BAND_2G)
 662                         dur += DOT11_OFDM_SIGNAL_EXTENSION;
 663         } else {
 664                 /*
 665                  * calc # bits * 2 so factor of 2 in rate (1/2 mbps)
 666                  * will divide out
 667                  */
 668                 mac_len = mac_len * 8 * 2;
 669                 /* calc ceiling of bits/rate = microseconds of air time */
 670                 dur = (mac_len + rate - 1) / rate;
 671                 if (preamble_type & BRCMS_SHORT_PREAMBLE)
 672                         dur += BPHY_PLCP_SHORT_TIME;
 673                 else
 674                         dur += BPHY_PLCP_TIME;
 675         }
 676         return dur;
 677 }
 678
 679 static void brcms_c_write_inits(struct brcms_hardware *wlc_hw,
 680                                 const struct d11init *inits)
 681 {
 682         struct bcma_device *core = wlc_hw->d11core;
 683         int i;
 684         uint offset;
 685         u16 size;
 686         u32 value;
 687
 688         brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
 689
 690         for (i = 0; inits[i].addr != cpu_to_le16(0xffff); i++) {
 691                 size = le16_to_cpu(inits[i].size);
 692                 offset = le16_to_cpu(inits[i].addr);
 693                 value = le32_to_cpu(inits[i].value);
 694                 if (size == 2)
 695                         bcma_write16(core, offset, value);
 696                 else if (size == 4)
 697                         bcma_write32(core, offset, value);
 698                 else
 699                         break;
 700         }
 701 }
 702
 703 static void brcms_c_write_mhf(struct brcms_hardware *wlc_hw, u16 *mhfs)
 704 {
 705         u8 idx;
 706         u16 addr[] = {
 707                 M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
 708                 M_HOST_FLAGS5
 709         };
 710
 711         for (idx = 0; idx < MHFMAX; idx++)
 712                 brcms_b_write_shm(wlc_hw, addr[idx], mhfs[idx]);
 713 }
 714
 715 static void brcms_c_ucode_bsinit(struct brcms_hardware *wlc_hw)
 716 {
 717         struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
 718
 719         /* init microcode host flags */
 720         brcms_c_write_mhf(wlc_hw, wlc_hw->band->mhfs);
 721
 722         /* do band-specific ucode IHR, SHM, and SCR inits */
 723         if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
 724                 if (BRCMS_ISNPHY(wlc_hw->band))
 725                         brcms_c_write_inits(wlc_hw, ucode->d11n0bsinitvals16);
 726                 else
 727                         brcms_err(wlc_hw->d11core,
 728                                   "%s: wl%d: unsupported phy in corerev %d\n",
 729                                   __func__, wlc_hw->unit,
 730                                   wlc_hw->corerev);
 731         } else {
 732                 if (D11REV_IS(wlc_hw->corerev, 24)) {
 733                         if (BRCMS_ISLCNPHY(wlc_hw->band))
 734                                 brcms_c_write_inits(wlc_hw,
 735                                                     ucode->d11lcn0bsinitvals24);
 736                         else
 737                                 brcms_err(wlc_hw->d11core,
 738                                           "%s: wl%d: unsupported phy in core rev %d\n",
 739                                           __func__, wlc_hw->unit,
 740                                           wlc_hw->corerev);
 741                 } else {
 742                         brcms_err(wlc_hw->d11core,
 743                                   "%s: wl%d: unsupported corerev %d\n",
 744                                   __func__, wlc_hw->unit, wlc_hw->corerev);
 745                 }
 746         }
 747 }
 748
 749 static void brcms_b_core_ioctl(struct brcms_hardware *wlc_hw, u32 m, u32 v)
 750 {
 751         struct bcma_device *core = wlc_hw->d11core;
 752         u32 ioctl = bcma_aread32(core, BCMA_IOCTL) & ~m;
 753
 754         bcma_awrite32(core, BCMA_IOCTL, ioctl | v);
 755 }
 756
 757 static void brcms_b_core_phy_clk(struct brcms_hardware *wlc_hw, bool clk)
 758 {
 759         brcms_dbg_info(wlc_hw->d11core, "wl%d: clk %d\n", wlc_hw->unit, clk);
 760
 761         wlc_hw->phyclk = clk;
 762
 763         if (OFF == clk) {       /* clear gmode bit, put phy into reset */
 764
 765                 brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC | SICF_GMODE),
 766                                    (SICF_PRST | SICF_FGC));
 767                 udelay(1);
 768                 brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_PRST);
 769                 udelay(1);
 770
 771         } else {                /* take phy out of reset */
 772
 773                 brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_FGC);
 774                 udelay(1);
 775                 brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
 776                 udelay(1);
 777
 778         }
 779 }
 780
 781 /* low-level band switch utility routine */
 782 static void brcms_c_setxband(struct brcms_hardware *wlc_hw, uint bandunit)
 783 {
 784         brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
 785                            bandunit);
 786
 787         wlc_hw->band = wlc_hw->bandstate[bandunit];
 788
 789         /*
 790          * BMAC_NOTE:
 791          *   until we eliminate need for wlc->band refs in low level code
 792          */
 793         wlc_hw->wlc->band = wlc_hw->wlc->bandstate[bandunit];
 794
 795         /* set gmode core flag */
 796         if (wlc_hw->sbclk && !wlc_hw->noreset) {
 797                 u32 gmode = 0;
 798
 799                 if (bandunit == 0)
 800                         gmode = SICF_GMODE;
 801
 802                 brcms_b_core_ioctl(wlc_hw, SICF_GMODE, gmode);
 803         }
 804 }
 805
 806 /* switch to new band but leave it inactive */
 807 static u32 brcms_c_setband_inact(struct brcms_c_info *wlc, uint bandunit)
 808 {
 809         struct brcms_hardware *wlc_hw = wlc->hw;
 810         u32 macintmask;
 811         u32 macctrl;
 812
 813         brcms_dbg_mac80211(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
 814         macctrl = bcma_read32(wlc_hw->d11core,
 815                               D11REGOFFS(maccontrol));
 816         WARN_ON((macctrl & MCTL_EN_MAC) != 0);
 817
 818         /* disable interrupts */
 819         macintmask = brcms_intrsoff(wlc->wl);
 820
 821         /* radio off */
 822         wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
 823
 824         brcms_b_core_phy_clk(wlc_hw, OFF);
 825
 826         brcms_c_setxband(wlc_hw, bandunit);
 827
 828         return macintmask;
 829 }
 830
 831 /* process an individual struct tx_status */
 832 static bool
 833 brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
 834 {
 835         struct sk_buff *p = NULL;
 836         uint queue = NFIFO;
 837         struct dma_pub *dma = NULL;
 838         struct d11txh *txh = NULL;
 839         struct scb *scb = NULL;
 840         bool free_pdu;
 841         int tx_rts, tx_frame_count, tx_rts_count;
 842         uint totlen, supr_status;
 843         bool lastframe;
 844         struct ieee80211_hdr *h;
 845         u16 mcl;
 846         struct ieee80211_tx_info *tx_info;
 847         struct ieee80211_tx_rate *txrate;
 848         int i;
 849         bool fatal = true;
 850
 851         trace_brcms_txstatus(&wlc->hw->d11core->dev, txs->framelen,
 852                              txs->frameid, txs->status, txs->lasttxtime,
 853                              txs->sequence, txs->phyerr, txs->ackphyrxsh);
 854
 855         /* discard intermediate indications for ucode with one legitimate case:
 856          *   e.g. if "useRTS" is set. ucode did a successful rts/cts exchange,
 857          *   but the subsequent tx of DATA failed. so it will start rts/cts
 858          *   from the beginning (resetting the rts transmission count)
 859          */
 860         if (!(txs->status & TX_STATUS_AMPDU)
 861             && (txs->status & TX_STATUS_INTERMEDIATE)) {
 862                 brcms_dbg_tx(wlc->hw->d11core, "INTERMEDIATE but not AMPDU\n");
 863                 fatal = false;
 864                 goto out;
 865         }
 866
 867         queue = txs->frameid & TXFID_QUEUE_MASK;
 868         if (queue >= NFIFO) {
 869                 brcms_err(wlc->hw->d11core, "queue %u >= NFIFO\n", queue);
 870                 goto out;
 871         }
 872
 873         dma = wlc->hw->di[queue];
 874
 875         p = dma_getnexttxp(wlc->hw->di[queue], DMA_RANGE_TRANSMITTED);
 876         if (p == NULL) {
 877                 brcms_err(wlc->hw->d11core, "dma_getnexttxp returned null!\n");
 878                 goto out;
 879         }
 880
 881         txh = (struct d11txh *) (p->data);
 882         mcl = le16_to_cpu(txh->MacTxControlLow);
 883
 884         if (txs->phyerr)
 885                 brcms_err(wlc->hw->d11core, "phyerr 0x%x, rate 0x%x\n",
 886                           txs->phyerr, txh->MainRates);
 887
 888         if (txs->frameid != le16_to_cpu(txh->TxFrameID)) {
 889                 brcms_err(wlc->hw->d11core, "frameid != txh->TxFrameID\n");
 890                 goto out;
 891         }
 892         tx_info = IEEE80211_SKB_CB(p);
 893         h = (struct ieee80211_hdr *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN);
 894
 895         if (tx_info->rate_driver_data[0])
 896                 scb = &wlc->pri_scb;
 897
 898         if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
 899                 brcms_c_ampdu_dotxstatus(wlc->ampdu, scb, p, txs);
 900                 fatal = false;
 901                 goto out;
 902         }
 903
 904         /*
 905          * brcms_c_ampdu_dotxstatus() will trace tx descriptors for AMPDU
 906          * frames; this traces them for the rest.
 907          */
 908         trace_brcms_txdesc(&wlc->hw->d11core->dev, txh, sizeof(*txh));
 909
 910         supr_status = txs->status & TX_STATUS_SUPR_MASK;
 911         if (supr_status == TX_STATUS_SUPR_BADCH) {
 912                 unsigned xfts = le16_to_cpu(txh->XtraFrameTypes);
 913                 brcms_dbg_tx(wlc->hw->d11core,
 914                              "Pkt tx suppressed, dest chan %u, current %d\n",
 915                              (xfts >> XFTS_CHANNEL_SHIFT) & 0xff,
 916                              CHSPEC_CHANNEL(wlc->default_bss->chanspec));
 917         }
 918
 919         tx_rts = le16_to_cpu(txh->MacTxControlLow) & TXC_SENDRTS;
 920         tx_frame_count =
 921             (txs->status & TX_STATUS_FRM_RTX_MASK) >> TX_STATUS_FRM_RTX_SHIFT;
 922         tx_rts_count =
 923             (txs->status & TX_STATUS_RTS_RTX_MASK) >> TX_STATUS_RTS_RTX_SHIFT;
 924
 925         lastframe = !ieee80211_has_morefrags(h->frame_control);
 926
 927         if (!lastframe) {
 928                 brcms_err(wlc->hw->d11core, "Not last frame!\n");
 929         } else {
 930                 /*
 931                  * Set information to be consumed by Minstrel ht.
 932                  *
 933                  * The "fallback limit" is the number of tx attempts a given
 934                  * MPDU is sent at the "primary" rate. Tx attempts beyond that
 935                  * limit are sent at the "secondary" rate.
 936                  * A 'short frame' does not exceed RTS treshold.
 937                  */
 938                 u16 sfbl,       /* Short Frame Rate Fallback Limit */
 939                     lfbl,       /* Long Frame Rate Fallback Limit */
 940                     fbl;
 941
 942                 if (queue < IEEE80211_NUM_ACS) {
 943                         sfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
 944                                       EDCF_SFB);
 945                         lfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
 946                                       EDCF_LFB);
 947                 } else {
 948                         sfbl = wlc->SFBL;
 949                         lfbl = wlc->LFBL;
 950                 }
 951
 952                 txrate = tx_info->status.rates;
 953                 if (txrate[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
 954                         fbl = lfbl;
 955                 else
 956                         fbl = sfbl;
 957
 958                 ieee80211_tx_info_clear_status(tx_info);
 959
 960                 if ((tx_frame_count > fbl) && (txrate[1].idx >= 0)) {
 961                         /*
 962                          * rate selection requested a fallback rate
 963                          * and we used it
 964                          */
 965                         txrate[0].count = fbl;
 966                         txrate[1].count = tx_frame_count - fbl;
 967                 } else {
 968                         /*
 969                          * rate selection did not request fallback rate, or
 970                          * we didn't need it
 971                          */
 972                         txrate[0].count = tx_frame_count;
 973                         /*
 974                          * rc80211_minstrel.c:minstrel_tx_status() expects
 975                          * unused rates to be marked with idx = -1
 976                          */
 977                         txrate[1].idx = -1;
 978                         txrate[1].count = 0;
 979                 }
 980
 981                 /* clear the rest of the rates */
 982                 for (i = 2; i < IEEE80211_TX_MAX_RATES; i++) {
 983                         txrate[i].idx = -1;
 984                         txrate[i].count = 0;
 985                 }
 986
 987                 if (txs->status & TX_STATUS_ACK_RCV)
 988                         tx_info->flags |= IEEE80211_TX_STAT_ACK;
 989         }
 990
 991         totlen = p->len;
 992         free_pdu = true;
 993
 994         if (lastframe) {
 995                 /* remove PLCP & Broadcom tx descriptor header */
 996                 skb_pull(p, D11_PHY_HDR_LEN);
 997                 skb_pull(p, D11_TXH_LEN);
 998                 ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw, p);
 999         } else {
1000                 brcms_err(wlc->hw->d11core,
1001                           "%s: Not last frame => not calling tx_status\n",
1002                           __func__);
1003         }
1004
1005         fatal = false;
1006
1007  out:
1008         if (fatal) {
1009                 if (txh)
1010                         trace_brcms_txdesc(&wlc->hw->d11core->dev, txh,
1011                                            sizeof(*txh));
1012                 if (p)
1013                         brcmu_pkt_buf_free_skb(p);
1014         }
1015
1016         if (dma && queue < NFIFO) {
1017                 u16 ac_queue = brcms_fifo_to_ac(queue);
1018                 if (dma->txavail > TX_HEADROOM && queue < TX_BCMC_FIFO &&
1019                     ieee80211_queue_stopped(wlc->pub->ieee_hw, ac_queue))
1020                         ieee80211_wake_queue(wlc->pub->ieee_hw, ac_queue);
1021                 dma_kick_tx(dma);
1022         }
1023
1024         return fatal;
1025 }
1026
1027 /* process tx completion events in BMAC
1028  * Return true if more tx status need to be processed. false otherwise.
1029  */
1030 static bool
1031 brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
1032 {
1033         struct bcma_device *core;
1034         struct tx_status txstatus, *txs;
1035         u32 s1, s2;
1036         uint n = 0;
1037         /*
1038          * Param 'max_tx_num' indicates max. # tx status to process before
1039          * break out.
1040          */
1041         uint max_tx_num = bound ? TXSBND : -1;
1042
1043         txs = &txstatus;
1044         core = wlc_hw->d11core;
1045         *fatal = false;
1046
1047         while (n < max_tx_num) {
1048                 s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
1049                 if (s1 == 0xffffffff) {
1050                         brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
1051                                   __func__);
1052                         *fatal = true;
1053                         return false;
1054                 }
1055                 /* only process when valid */
1056                 if (!(s1 & TXS_V))
1057                         break;
1058
1059                 s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
1060                 txs->status = s1 & TXS_STATUS_MASK;
1061                 txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
1062                 txs->sequence = s2 & TXS_SEQ_MASK;
1063                 txs->phyerr = (s2 & TXS_PTX_MASK) >> TXS_PTX_SHIFT;
1064                 txs->lasttxtime = 0;
1065
1066                 *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
1067                 if (*fatal == true)
1068                         return false;
1069                 n++;
1070         }
1071
1072         return n >= max_tx_num;
1073 }
1074
1075 static void brcms_c_tbtt(struct brcms_c_info *wlc)
1076 {
1077         if (wlc->bsscfg->type == BRCMS_TYPE_ADHOC)
1078                 /*
1079                  * DirFrmQ is now valid...defer setting until end
1080                  * of ATIM window
1081                  */
1082                 wlc->qvalid |= MCMD_DIRFRMQVAL;
1083 }
1084
1085 /* set initial host flags value */
1086 static void
1087 brcms_c_mhfdef(struct brcms_c_info *wlc, u16 *mhfs, u16 mhf2_init)
1088 {
1089         struct brcms_hardware *wlc_hw = wlc->hw;
1090
1091         memset(mhfs, 0, MHFMAX * sizeof(u16));
1092
1093         mhfs[MHF2] |= mhf2_init;
1094
1095         /* prohibit use of slowclock on multifunction boards */
1096         if (wlc_hw->boardflags & BFL_NOPLLDOWN)
1097                 mhfs[MHF1] |= MHF1_FORCEFASTCLK;
1098
1099         if (BRCMS_ISNPHY(wlc_hw->band) && NREV_LT(wlc_hw->band->phyrev, 2)) {
1100                 mhfs[MHF2] |= MHF2_NPHY40MHZ_WAR;
1101                 mhfs[MHF1] |= MHF1_IQSWAP_WAR;
1102         }
1103 }
1104
1105 static uint
1106 dmareg(uint direction, uint fifonum)
1107 {
1108         if (direction == DMA_TX)
1109                 return offsetof(struct d11regs, fifo64regs[fifonum].dmaxmt);
1110         return offsetof(struct d11regs, fifo64regs[fifonum].dmarcv);
1111 }
1112
1113 static bool brcms_b_attach_dmapio(struct brcms_c_info *wlc, uint j, bool wme)
1114 {
1115         uint i;
1116         char name[8];
1117         /*
1118          * ucode host flag 2 needed for pio mode, independent of band and fifo
1119          */
1120         u16 pio_mhf2 = 0;
1121         struct brcms_hardware *wlc_hw = wlc->hw;
1122         uint unit = wlc_hw->unit;
1123
1124         /* name and offsets for dma_attach */
1125         snprintf(name, sizeof(name), "wl%d", unit);
1126
1127         if (wlc_hw->di[0] == NULL) {    /* Init FIFOs */
1128                 int dma_attach_err = 0;
1129
1130                 /*
1131                  * FIFO 0
1132                  * TX: TX_AC_BK_FIFO (TX AC Background data packets)
1133                  * RX: RX_FIFO (RX data packets)
1134                  */
1135                 wlc_hw->di[0] = dma_attach(name, wlc,
1136                                            (wme ? dmareg(DMA_TX, 0) : 0),
1137                                            dmareg(DMA_RX, 0),
1138                                            (wme ? NTXD : 0), NRXD,
1139                                            RXBUFSZ, -1, NRXBUFPOST,
1140                                            BRCMS_HWRXOFF);
1141                 dma_attach_err |= (NULL == wlc_hw->di[0]);
1142
1143                 /*
1144                  * FIFO 1
1145                  * TX: TX_AC_BE_FIFO (TX AC Best-Effort data packets)
1146                  *   (legacy) TX_DATA_FIFO (TX data packets)
1147                  * RX: UNUSED
1148                  */
1149                 wlc_hw->di[1] = dma_attach(name, wlc,
1150                                            dmareg(DMA_TX, 1), 0,
1151                                            NTXD, 0, 0, -1, 0, 0);
1152                 dma_attach_err |= (NULL == wlc_hw->di[1]);
1153
1154                 /*
1155                  * FIFO 2
1156                  * TX: TX_AC_VI_FIFO (TX AC Video data packets)
1157                  * RX: UNUSED
1158                  */
1159                 wlc_hw->di[2] = dma_attach(name, wlc,
1160                                            dmareg(DMA_TX, 2), 0,
1161                                            NTXD, 0, 0, -1, 0, 0);
1162                 dma_attach_err |= (NULL == wlc_hw->di[2]);
1163                 /*
1164                  * FIFO 3
1165                  * TX: TX_AC_VO_FIFO (TX AC Voice data packets)
1166                  *   (legacy) TX_CTL_FIFO (TX control & mgmt packets)
1167                  */
1168                 wlc_hw->di[3] = dma_attach(name, wlc,
1169                                            dmareg(DMA_TX, 3),
1170                                            0, NTXD, 0, 0, -1,
1171                                            0, 0);
1172                 dma_attach_err |= (NULL == wlc_hw->di[3]);
1173 /* Cleaner to leave this as if with AP defined */
1174
1175                 if (dma_attach_err) {
1176                         brcms_err(wlc_hw->d11core,
1177                                   "wl%d: wlc_attach: dma_attach failed\n",
1178                                   unit);
1179                         return false;
1180                 }
1181
1182                 /* get pointer to dma engine tx flow control variable */
1183                 for (i = 0; i < NFIFO; i++)
1184                         if (wlc_hw->di[i])
1185                                 wlc_hw->txavail[i] =
1186                                     (uint *) dma_getvar(wlc_hw->di[i],
1187                                                         "&txavail");
1188         }
1189
1190         /* initial ucode host flags */
1191         brcms_c_mhfdef(wlc, wlc_hw->band->mhfs, pio_mhf2);
1192
1193         return true;
1194 }
1195
1196 static void brcms_b_detach_dmapio(struct brcms_hardware *wlc_hw)
1197 {
1198         uint j;
1199
1200         for (j = 0; j < NFIFO; j++) {
1201                 if (wlc_hw->di[j]) {
1202                         dma_detach(wlc_hw->di[j]);
1203                         wlc_hw->di[j] = NULL;
1204                 }
1205         }
1206 }
1207
1208 /*
1209  * Initialize brcms_c_info default values ...
1210  * may get overrides later in this function
1211  *  BMAC_NOTES, move low out and resolve the dangling ones
1212  */
1213 static void brcms_b_info_init(struct brcms_hardware *wlc_hw)
1214 {
1215         struct brcms_c_info *wlc = wlc_hw->wlc;
1216
1217         /* set default sw macintmask value */
1218         wlc->defmacintmask = DEF_MACINTMASK;
1219
1220         /* various 802.11g modes */
1221         wlc_hw->shortslot = false;
1222
1223         wlc_hw->SFBL = RETRY_SHORT_FB;
1224         wlc_hw->LFBL = RETRY_LONG_FB;
1225
1226         /* default mac retry limits */
1227         wlc_hw->SRL = RETRY_SHORT_DEF;
1228         wlc_hw->LRL = RETRY_LONG_DEF;
1229         wlc_hw->chanspec = ch20mhz_chspec(1);
1230 }
1231
1232 static void brcms_b_wait_for_wake(struct brcms_hardware *wlc_hw)
1233 {
1234         /* delay before first read of ucode state */
1235         udelay(40);
1236
1237         /* wait until ucode is no longer asleep */
1238         SPINWAIT((brcms_b_read_shm(wlc_hw, M_UCODE_DBGST) ==
1239                   DBGST_ASLEEP), wlc_hw->wlc->fastpwrup_dly);
1240 }
1241
1242 /* control chip clock to save power, enable dynamic clock or force fast clock */
1243 static void brcms_b_clkctl_clk(struct brcms_hardware *wlc_hw, enum bcma_clkmode mode)
1244 {
1245         if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU) {
1246                 /* new chips with PMU, CCS_FORCEHT will distribute the HT clock
1247                  * on backplane, but mac core will still run on ALP(not HT) when
1248                  * it enters powersave mode, which means the FCA bit may not be
1249                  * set. Should wakeup mac if driver wants it to run on HT.
1250                  */
1251
1252                 if (wlc_hw->clk) {
1253                         if (mode == BCMA_CLKMODE_FAST) {
1254                                 bcma_set32(wlc_hw->d11core,
1255                                            D11REGOFFS(clk_ctl_st),
1256                                            CCS_FORCEHT);
1257
1258                                 udelay(64);
1259
1260                                 SPINWAIT(
1261                                     ((bcma_read32(wlc_hw->d11core,
1262                                       D11REGOFFS(clk_ctl_st)) &
1263                                       CCS_HTAVAIL) == 0),
1264                                       PMU_MAX_TRANSITION_DLY);
1265                                 WARN_ON(!(bcma_read32(wlc_hw->d11core,
1266                                         D11REGOFFS(clk_ctl_st)) &
1267                                         CCS_HTAVAIL));
1268                         } else {
1269                                 if ((ai_get_pmurev(wlc_hw->sih) == 0) &&
1270                                     (bcma_read32(wlc_hw->d11core,
1271                                         D11REGOFFS(clk_ctl_st)) &
1272                                         (CCS_FORCEHT | CCS_HTAREQ)))
1273                                         SPINWAIT(
1274                                             ((bcma_read32(wlc_hw->d11core,
1275                                               offsetof(struct d11regs,
1276                                                        clk_ctl_st)) &
1277                                               CCS_HTAVAIL) == 0),
1278                                               PMU_MAX_TRANSITION_DLY);
1279                                 bcma_mask32(wlc_hw->d11core,
1280                                         D11REGOFFS(clk_ctl_st),
1281                                         ~CCS_FORCEHT);
1282                         }
1283                 }
1284                 wlc_hw->forcefastclk = (mode == BCMA_CLKMODE_FAST);
1285         } else {
1286
1287                 /* old chips w/o PMU, force HT through cc,
1288                  * then use FCA to verify mac is running fast clock
1289                  */
1290
1291                 wlc_hw->forcefastclk = ai_clkctl_cc(wlc_hw->sih, mode);
1292
1293                 /* check fast clock is available (if core is not in reset) */
1294                 if (wlc_hw->forcefastclk && wlc_hw->clk)
1295                         WARN_ON(!(bcma_aread32(wlc_hw->d11core, BCMA_IOST) &
1296                                   SISF_FCLKA));
1297
1298                 /*
1299                  * keep the ucode wake bit on if forcefastclk is on since we
1300                  * do not want ucode to put us back to slow clock when it dozes
1301                  * for PM mode. Code below matches the wake override bit with
1302                  * current forcefastclk state. Only setting bit in wake_override
1303                  * instead of waking ucode immediately since old code had this
1304                  * behavior. Older code set wlc->forcefastclk but only had the
1305                  * wake happen if the wakup_ucode work (protected by an up
1306                  * check) was executed just below.
1307                  */
1308                 if (wlc_hw->forcefastclk)
1309                         mboolset(wlc_hw->wake_override,
1310                                  BRCMS_WAKE_OVERRIDE_FORCEFAST);
1311                 else
1312                         mboolclr(wlc_hw->wake_override,
1313                                  BRCMS_WAKE_OVERRIDE_FORCEFAST);
1314         }
1315 }
1316
1317 /* set or clear ucode host flag bits
1318  * it has an optimization for no-change write
1319  * it only writes through shared memory when the core has clock;
1320  * pre-CLK changes should use wlc_write_mhf to get around the optimization
1321  *
1322  *
1323  * bands values are: BRCM_BAND_AUTO <--- Current band only
1324  *                   BRCM_BAND_5G   <--- 5G band only
1325  *                   BRCM_BAND_2G   <--- 2G band only
1326  *                   BRCM_BAND_ALL  <--- All bands
1327  */
1328 void
1329 brcms_b_mhf(struct brcms_hardware *wlc_hw, u8 idx, u16 mask, u16 val,
1330              int bands)
1331 {
1332         u16 save;
1333         u16 addr[MHFMAX] = {
1334                 M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
1335                 M_HOST_FLAGS5
1336         };
1337         struct brcms_hw_band *band;
1338
1339         if ((val & ~mask) || idx >= MHFMAX)
1340                 return; /* error condition */
1341
1342         switch (bands) {
1343                 /* Current band only or all bands,
1344                  * then set the band to current band
1345                  */
1346         case BRCM_BAND_AUTO:
1347         case BRCM_BAND_ALL:
1348                 band = wlc_hw->band;
1349                 break;
1350         case BRCM_BAND_5G:
1351                 band = wlc_hw->bandstate[BAND_5G_INDEX];
1352                 break;
1353         case BRCM_BAND_2G:
1354                 band = wlc_hw->bandstate[BAND_2G_INDEX];
1355                 break;
1356         default:
1357                 band = NULL;    /* error condition */
1358         }
1359
1360         if (band) {
1361                 save = band->mhfs[idx];
1362                 band->mhfs[idx] = (band->mhfs[idx] & ~mask) | val;
1363
1364                 /* optimization: only write through if changed, and
1365                  * changed band is the current band
1366                  */
1367                 if (wlc_hw->clk && (band->mhfs[idx] != save)
1368                     && (band == wlc_hw->band))
1369                         brcms_b_write_shm(wlc_hw, addr[idx],
1370                                            (u16) band->mhfs[idx]);
1371         }
1372
1373         if (bands == BRCM_BAND_ALL) {
1374                 wlc_hw->bandstate[0]->mhfs[idx] =
1375                     (wlc_hw->bandstate[0]->mhfs[idx] & ~mask) | val;
1376                 wlc_hw->bandstate[1]->mhfs[idx] =
1377                     (wlc_hw->bandstate[1]->mhfs[idx] & ~mask) | val;
1378         }
1379 }
1380
1381 /* set the maccontrol register to desired reset state and
1382  * initialize the sw cache of the register
1383  */
1384 static void brcms_c_mctrl_reset(struct brcms_hardware *wlc_hw)
1385 {
1386         /* IHR accesses are always enabled, PSM disabled, HPS off and WAKE on */
1387         wlc_hw->maccontrol = 0;
1388         wlc_hw->suspended_fifos = 0;
1389         wlc_hw->wake_override = 0;
1390         wlc_hw->mute_override = 0;
1391         brcms_b_mctrl(wlc_hw, ~0, MCTL_IHR_EN | MCTL_WAKE);
1392 }
1393
1394 /*
1395  * write the software state of maccontrol and
1396  * overrides to the maccontrol register
1397  */
1398 static void brcms_c_mctrl_write(struct brcms_hardware *wlc_hw)
1399 {
1400         u32 maccontrol = wlc_hw->maccontrol;
1401
1402         /* OR in the wake bit if overridden */
1403         if (wlc_hw->wake_override)
1404                 maccontrol |= MCTL_WAKE;
1405
1406         /* set AP and INFRA bits for mute if needed */
1407         if (wlc_hw->mute_override) {
1408                 maccontrol &= ~(MCTL_AP);
1409                 maccontrol |= MCTL_INFRA;
1410         }
1411
1412         bcma_write32(wlc_hw->d11core, D11REGOFFS(maccontrol),
1413                      maccontrol);
1414 }
1415
1416 /* set or clear maccontrol bits */
1417 void brcms_b_mctrl(struct brcms_hardware *wlc_hw, u32 mask, u32 val)
1418 {
1419         u32 maccontrol;
1420         u32 new_maccontrol;
1421
1422         if (val & ~mask)
1423                 return; /* error condition */
1424         maccontrol = wlc_hw->maccontrol;
1425         new_maccontrol = (maccontrol & ~mask) | val;
1426
1427         /* if the new maccontrol value is the same as the old, nothing to do */
1428         if (new_maccontrol == maccontrol)
1429                 return;
1430
1431         /* something changed, cache the new value */
1432         wlc_hw->maccontrol = new_maccontrol;
1433
1434         /* write the new values with overrides applied */
1435         brcms_c_mctrl_write(wlc_hw);
1436 }
1437
1438 void brcms_c_ucode_wake_override_set(struct brcms_hardware *wlc_hw,
1439                                  u32 override_bit)
1440 {
1441         if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE)) {
1442                 mboolset(wlc_hw->wake_override, override_bit);
1443                 return;
1444         }
1445
1446         mboolset(wlc_hw->wake_override, override_bit);
1447
1448         brcms_c_mctrl_write(wlc_hw);
1449         brcms_b_wait_for_wake(wlc_hw);
1450 }
1451
1452 void brcms_c_ucode_wake_override_clear(struct brcms_hardware *wlc_hw,
1453                                    u32 override_bit)
1454 {
1455         mboolclr(wlc_hw->wake_override, override_bit);
1456
1457         if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE))
1458                 return;
1459
1460         brcms_c_mctrl_write(wlc_hw);
1461 }
1462
1463 /* When driver needs ucode to stop beaconing, it has to make sure that
1464  * MCTL_AP is clear and MCTL_INFRA is set
1465  * Mode           MCTL_AP        MCTL_INFRA
1466  * AP                1              1
1467  * STA               0              1 <--- This will ensure no beacons
1468  * IBSS              0              0
1469  */
1470 static void brcms_c_ucode_mute_override_set(struct brcms_hardware *wlc_hw)
1471 {
1472         wlc_hw->mute_override = 1;
1473
1474         /* if maccontrol already has AP == 0 and INFRA == 1 without this
1475          * override, then there is no change to write
1476          */
1477         if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1478                 return;
1479
1480         brcms_c_mctrl_write(wlc_hw);
1481 }
1482
1483 /* Clear the override on AP and INFRA bits */
1484 static void brcms_c_ucode_mute_override_clear(struct brcms_hardware *wlc_hw)
1485 {
1486         if (wlc_hw->mute_override == 0)
1487                 return;
1488
1489         wlc_hw->mute_override = 0;
1490
1491         /* if maccontrol already has AP == 0 and INFRA == 1 without this
1492          * override, then there is no change to write
1493          */
1494         if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1495                 return;
1496
1497         brcms_c_mctrl_write(wlc_hw);
1498 }
1499
1500 /*
1501  * Write a MAC address to the given match reg offset in the RXE match engine.
1502  */
1503 static void
1504 brcms_b_set_addrmatch(struct brcms_hardware *wlc_hw, int match_reg_offset,
1505                        const u8 *addr)
1506 {
1507         struct bcma_device *core = wlc_hw->d11core;
1508         u16 mac_l;
1509         u16 mac_m;
1510         u16 mac_h;
1511
1512         brcms_dbg_rx(core, "wl%d: brcms_b_set_addrmatch\n", wlc_hw->unit);
1513
1514         mac_l = addr[0] | (addr[1] << 8);
1515         mac_m = addr[2] | (addr[3] << 8);
1516         mac_h = addr[4] | (addr[5] << 8);
1517
1518         /* enter the MAC addr into the RXE match registers */
1519         bcma_write16(core, D11REGOFFS(rcm_ctl),
1520                      RCM_INC_DATA | match_reg_offset);
1521         bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_l);
1522         bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_m);
1523         bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_h);
1524 }
1525
1526 void
1527 brcms_b_write_template_ram(struct brcms_hardware *wlc_hw, int offset, int len,
1528                             void *buf)
1529 {
1530         struct bcma_device *core = wlc_hw->d11core;
1531         u32 word;
1532         __le32 word_le;
1533         __be32 word_be;
1534         bool be_bit;
1535         brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
1536
1537         bcma_write32(core, D11REGOFFS(tplatewrptr), offset);
1538
1539         /* if MCTL_BIGEND bit set in mac control register,
1540          * the chip swaps data in fifo, as well as data in
1541          * template ram
1542          */
1543         be_bit = (bcma_read32(core, D11REGOFFS(maccontrol)) & MCTL_BIGEND) != 0;
1544
1545         while (len > 0) {
1546                 memcpy(&word, buf, sizeof(u32));
1547
1548                 if (be_bit) {
1549                         word_be = cpu_to_be32(word);
1550                         word = *(u32 *)&word_be;
1551                 } else {
1552                         word_le = cpu_to_le32(word);
1553                         word = *(u32 *)&word_le;
1554                 }
1555
1556                 bcma_write32(core, D11REGOFFS(tplatewrdata), word);
1557
1558                 buf = (u8 *) buf + sizeof(u32);
1559                 len -= sizeof(u32);
1560         }
1561 }
1562
1563 static void brcms_b_set_cwmin(struct brcms_hardware *wlc_hw, u16 newmin)
1564 {
1565         wlc_hw->band->CWmin = newmin;
1566
1567         bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1568                      OBJADDR_SCR_SEL | S_DOT11_CWMIN);
1569         (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1570         bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmin);
1571 }
1572
1573 static void brcms_b_set_cwmax(struct brcms_hardware *wlc_hw, u16 newmax)
1574 {
1575         wlc_hw->band->CWmax = newmax;
1576
1577         bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1578                      OBJADDR_SCR_SEL | S_DOT11_CWMAX);
1579         (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1580         bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmax);
1581 }
1582
1583 void brcms_b_bw_set(struct brcms_hardware *wlc_hw, u16 bw)
1584 {
1585         bool fastclk;
1586
1587         /* request FAST clock if not on */
1588         fastclk = wlc_hw->forcefastclk;
1589         if (!fastclk)
1590                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
1591
1592         wlc_phy_bw_state_set(wlc_hw->band->pi, bw);
1593
1594         brcms_b_phy_reset(wlc_hw);
1595         wlc_phy_init(wlc_hw->band->pi, wlc_phy_chanspec_get(wlc_hw->band->pi));
1596
1597         /* restore the clk */
1598         if (!fastclk)
1599                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
1600 }
1601
1602 static void brcms_b_upd_synthpu(struct brcms_hardware *wlc_hw)
1603 {
1604         u16 v;
1605         struct brcms_c_info *wlc = wlc_hw->wlc;
1606         /* update SYNTHPU_DLY */
1607
1608         if (BRCMS_ISLCNPHY(wlc->band))
1609                 v = SYNTHPU_DLY_LPPHY_US;
1610         else if (BRCMS_ISNPHY(wlc->band) && (NREV_GE(wlc->band->phyrev, 3)))
1611                 v = SYNTHPU_DLY_NPHY_US;
1612         else
1613                 v = SYNTHPU_DLY_BPHY_US;
1614
1615         brcms_b_write_shm(wlc_hw, M_SYNTHPU_DLY, v);
1616 }
1617
1618 static void brcms_c_ucode_txant_set(struct brcms_hardware *wlc_hw)
1619 {
1620         u16 phyctl;
1621         u16 phytxant = wlc_hw->bmac_phytxant;
1622         u16 mask = PHY_TXC_ANT_MASK;
1623
1624         /* set the Probe Response frame phy control word */
1625         phyctl = brcms_b_read_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS);
1626         phyctl = (phyctl & ~mask) | phytxant;
1627         brcms_b_write_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS, phyctl);
1628
1629         /* set the Response (ACK/CTS) frame phy control word */
1630         phyctl = brcms_b_read_shm(wlc_hw, M_RSP_PCTLWD);
1631         phyctl = (phyctl & ~mask) | phytxant;
1632         brcms_b_write_shm(wlc_hw, M_RSP_PCTLWD, phyctl);
1633 }
1634
1635 static u16 brcms_b_ofdm_ratetable_offset(struct brcms_hardware *wlc_hw,
1636                                          u8 rate)
1637 {
1638         uint i;
1639         u8 plcp_rate = 0;
1640         struct plcp_signal_rate_lookup {
1641                 u8 rate;
1642                 u8 signal_rate;
1643         };
1644         /* OFDM RATE sub-field of PLCP SIGNAL field, per 802.11 sec 17.3.4.1 */
1645         const struct plcp_signal_rate_lookup rate_lookup[] = {
1646                 {BRCM_RATE_6M, 0xB},
1647                 {BRCM_RATE_9M, 0xF},
1648                 {BRCM_RATE_12M, 0xA},
1649                 {BRCM_RATE_18M, 0xE},
1650                 {BRCM_RATE_24M, 0x9},
1651                 {BRCM_RATE_36M, 0xD},
1652                 {BRCM_RATE_48M, 0x8},
1653                 {BRCM_RATE_54M, 0xC}
1654         };
1655
1656         for (i = 0; i < ARRAY_SIZE(rate_lookup); i++) {
1657                 if (rate == rate_lookup[i].rate) {
1658                         plcp_rate = rate_lookup[i].signal_rate;
1659                         break;
1660                 }
1661         }
1662
1663         /* Find the SHM pointer to the rate table entry by looking in the
1664          * Direct-map Table
1665          */
1666         return 2 * brcms_b_read_shm(wlc_hw, M_RT_DIRMAP_A + (plcp_rate * 2));
1667 }
1668
1669 static void brcms_upd_ofdm_pctl1_table(struct brcms_hardware *wlc_hw)
1670 {
1671         u8 rate;
1672         u8 rates[8] = {
1673                 BRCM_RATE_6M, BRCM_RATE_9M, BRCM_RATE_12M, BRCM_RATE_18M,
1674                 BRCM_RATE_24M, BRCM_RATE_36M, BRCM_RATE_48M, BRCM_RATE_54M
1675         };
1676         u16 entry_ptr;
1677         u16 pctl1;
1678         uint i;
1679
1680         if (!BRCMS_PHY_11N_CAP(wlc_hw->band))
1681                 return;
1682
1683         /* walk the phy rate table and update the entries */
1684         for (i = 0; i < ARRAY_SIZE(rates); i++) {
1685                 rate = rates[i];
1686
1687                 entry_ptr = brcms_b_ofdm_ratetable_offset(wlc_hw, rate);
1688
1689                 /* read the SHM Rate Table entry OFDM PCTL1 values */
1690                 pctl1 =
1691                     brcms_b_read_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS);
1692
1693                 /* modify the value */
1694                 pctl1 &= ~PHY_TXC1_MODE_MASK;
1695                 pctl1 |= (wlc_hw->hw_stf_ss_opmode << PHY_TXC1_MODE_SHIFT);
1696
1697                 /* Update the SHM Rate Table entry OFDM PCTL1 values */
1698                 brcms_b_write_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS,
1699                                    pctl1);
1700         }
1701 }
1702
1703 /* band-specific init */
1704 static void brcms_b_bsinit(struct brcms_c_info *wlc, u16 chanspec)
1705 {
1706         struct brcms_hardware *wlc_hw = wlc->hw;
1707
1708         brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
1709                            wlc_hw->band->bandunit);
1710
1711         brcms_c_ucode_bsinit(wlc_hw);
1712
1713         wlc_phy_init(wlc_hw->band->pi, chanspec);
1714
1715         brcms_c_ucode_txant_set(wlc_hw);
1716
1717         /*
1718          * cwmin is band-specific, update hardware
1719          * with value for current band
1720          */
1721         brcms_b_set_cwmin(wlc_hw, wlc_hw->band->CWmin);
1722         brcms_b_set_cwmax(wlc_hw, wlc_hw->band->CWmax);
1723
1724         brcms_b_update_slot_timing(wlc_hw,
1725                                    wlc_hw->band->bandtype == BRCM_BAND_5G ?
1726                                    true : wlc_hw->shortslot);
1727
1728         /* write phytype and phyvers */
1729         brcms_b_write_shm(wlc_hw, M_PHYTYPE, (u16) wlc_hw->band->phytype);
1730         brcms_b_write_shm(wlc_hw, M_PHYVER, (u16) wlc_hw->band->phyrev);
1731
1732         /*
1733          * initialize the txphyctl1 rate table since
1734          * shmem is shared between bands
1735          */
1736         brcms_upd_ofdm_pctl1_table(wlc_hw);
1737
1738         brcms_b_upd_synthpu(wlc_hw);
1739 }
1740
1741 /* Perform a soft reset of the PHY PLL */
1742 void brcms_b_core_phypll_reset(struct brcms_hardware *wlc_hw)
1743 {
1744         ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_addr),
1745                   ~0, 0);
1746         udelay(1);
1747         ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1748                   0x4, 0);
1749         udelay(1);
1750         ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1751                   0x4, 4);
1752         udelay(1);
1753         ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1754                   0x4, 0);
1755         udelay(1);
1756 }
1757
1758 /* light way to turn on phy clock without reset for NPHY only
1759  *  refer to brcms_b_core_phy_clk for full version
1760  */
1761 void brcms_b_phyclk_fgc(struct brcms_hardware *wlc_hw, bool clk)
1762 {
1763         /* support(necessary for NPHY and HYPHY) only */
1764         if (!BRCMS_ISNPHY(wlc_hw->band))
1765                 return;
1766
1767         if (ON == clk)
1768                 brcms_b_core_ioctl(wlc_hw, SICF_FGC, SICF_FGC);
1769         else
1770                 brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
1771
1772 }
1773
1774 void brcms_b_macphyclk_set(struct brcms_hardware *wlc_hw, bool clk)
1775 {
1776         if (ON == clk)
1777                 brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, SICF_MPCLKE);
1778         else
1779                 brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, 0);
1780 }
1781
1782 void brcms_b_phy_reset(struct brcms_hardware *wlc_hw)
1783 {
1784         struct brcms_phy_pub *pih = wlc_hw->band->pi;
1785         u32 phy_bw_clkbits;
1786         bool phy_in_reset = false;
1787
1788         brcms_dbg_info(wlc_hw->d11core, "wl%d: reset phy\n", wlc_hw->unit);
1789
1790         if (pih == NULL)
1791                 return;
1792
1793         phy_bw_clkbits = wlc_phy_clk_bwbits(wlc_hw->band->pi);
1794
1795         /* Specific reset sequence required for NPHY rev 3 and 4 */
1796         if (BRCMS_ISNPHY(wlc_hw->band) && NREV_GE(wlc_hw->band->phyrev, 3) &&
1797             NREV_LE(wlc_hw->band->phyrev, 4)) {
1798                 /* Set the PHY bandwidth */
1799                 brcms_b_core_ioctl(wlc_hw, SICF_BWMASK, phy_bw_clkbits);
1800
1801                 udelay(1);
1802
1803                 /* Perform a soft reset of the PHY PLL */
1804                 brcms_b_core_phypll_reset(wlc_hw);
1805
1806                 /* reset the PHY */
1807                 brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_PCLKE),
1808                                    (SICF_PRST | SICF_PCLKE));
1809                 phy_in_reset = true;
1810         } else {
1811                 brcms_b_core_ioctl(wlc_hw,
1812                                    (SICF_PRST | SICF_PCLKE | SICF_BWMASK),
1813                                    (SICF_PRST | SICF_PCLKE | phy_bw_clkbits));
1814         }
1815
1816         udelay(2);
1817         brcms_b_core_phy_clk(wlc_hw, ON);
1818
1819         if (pih)
1820                 wlc_phy_anacore(pih, ON);
1821 }
1822
1823 /* switch to and initialize new band */
1824 static void brcms_b_setband(struct brcms_hardware *wlc_hw, uint bandunit,
1825                             u16 chanspec) {
1826         struct brcms_c_info *wlc = wlc_hw->wlc;
1827         u32 macintmask;
1828
1829         /* Enable the d11 core before accessing it */
1830         if (!bcma_core_is_enabled(wlc_hw->d11core)) {
1831                 bcma_core_enable(wlc_hw->d11core, 0);
1832                 brcms_c_mctrl_reset(wlc_hw);
1833         }
1834
1835         macintmask = brcms_c_setband_inact(wlc, bandunit);
1836
1837         if (!wlc_hw->up)
1838                 return;
1839
1840         brcms_b_core_phy_clk(wlc_hw, ON);
1841
1842         /* band-specific initializations */
1843         brcms_b_bsinit(wlc, chanspec);
1844
1845         /*
1846          * If there are any pending software interrupt bits,
1847          * then replace these with a harmless nonzero value
1848          * so brcms_c_dpc() will re-enable interrupts when done.
1849          */
1850         if (wlc->macintstatus)
1851                 wlc->macintstatus = MI_DMAINT;
1852
1853         /* restore macintmask */
1854         brcms_intrsrestore(wlc->wl, macintmask);
1855
1856         /* ucode should still be suspended.. */
1857         WARN_ON((bcma_read32(wlc_hw->d11core, D11REGOFFS(maccontrol)) &
1858                  MCTL_EN_MAC) != 0);
1859 }
1860
1861 static bool brcms_c_isgoodchip(struct brcms_hardware *wlc_hw)
1862 {
1863
1864         /* reject unsupported corerev */
1865         if (!CONF_HAS(D11CONF, wlc_hw->corerev)) {
1866                 wiphy_err(wlc_hw->wlc->wiphy, "unsupported core rev %d\n",
1867                           wlc_hw->corerev);
1868                 return false;
1869         }
1870
1871         return true;
1872 }
1873
1874 /* Validate some board info parameters */
1875 static bool brcms_c_validboardtype(struct brcms_hardware *wlc_hw)
1876 {
1877         uint boardrev = wlc_hw->boardrev;
1878
1879         /* 4 bits each for board type, major, minor, and tiny version */
1880         uint brt = (boardrev & 0xf000) >> 12;
1881         uint b0 = (boardrev & 0xf00) >> 8;
1882         uint b1 = (boardrev & 0xf0) >> 4;
1883         uint b2 = boardrev & 0xf;
1884
1885         /* voards from other vendors are always considered valid */
1886         if (ai_get_boardvendor(wlc_hw->sih) != PCI_VENDOR_ID_BROADCOM)
1887                 return true;
1888
1889         /* do some boardrev sanity checks when boardvendor is Broadcom */
1890         if (boardrev == 0)
1891                 return false;
1892
1893         if (boardrev <= 0xff)
1894                 return true;
1895
1896         if ((brt > 2) || (brt == 0) || (b0 > 9) || (b0 == 0) || (b1 > 9)
1897                 || (b2 > 9))
1898                 return false;
1899
1900         return true;
1901 }
1902
1903 static void brcms_c_get_macaddr(struct brcms_hardware *wlc_hw, u8 etheraddr[ETH_ALEN])
1904 {
1905         struct ssb_sprom *sprom = &wlc_hw->d11core->bus->sprom;
1906
1907         /* If macaddr exists, use it (Sromrev4, CIS, ...). */
1908         if (!is_zero_ether_addr(sprom->il0mac)) {
1909                 memcpy(etheraddr, sprom->il0mac, 6);
1910                 return;
1911         }
1912
1913         if (wlc_hw->_nbands > 1)
1914                 memcpy(etheraddr, sprom->et1mac, 6);
1915         else
1916                 memcpy(etheraddr, sprom->il0mac, 6);
1917 }
1918
1919 /* power both the pll and external oscillator on/off */
1920 static void brcms_b_xtal(struct brcms_hardware *wlc_hw, bool want)
1921 {
1922         brcms_dbg_info(wlc_hw->d11core, "wl%d: want %d\n", wlc_hw->unit, want);
1923
1924         /*
1925          * dont power down if plldown is false or
1926          * we must poll hw radio disable
1927          */
1928         if (!want && wlc_hw->pllreq)
1929                 return;
1930
1931         wlc_hw->sbclk = want;
1932         if (!wlc_hw->sbclk) {
1933                 wlc_hw->clk = false;
1934                 if (wlc_hw->band && wlc_hw->band->pi)
1935                         wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
1936         }
1937 }
1938
1939 /*
1940  * Return true if radio is disabled, otherwise false.
1941  * hw radio disable signal is an external pin, users activate it asynchronously
1942  * this function could be called when driver is down and w/o clock
1943  * it operates on different registers depending on corerev and boardflag.
1944  */
1945 static bool brcms_b_radio_read_hwdisabled(struct brcms_hardware *wlc_hw)
1946 {
1947         bool v, clk, xtal;
1948         u32 flags = 0;
1949
1950         xtal = wlc_hw->sbclk;
1951         if (!xtal)
1952                 brcms_b_xtal(wlc_hw, ON);
1953
1954         /* may need to take core out of reset first */
1955         clk = wlc_hw->clk;
1956         if (!clk) {
1957                 /*
1958                  * mac no longer enables phyclk automatically when driver
1959                  * accesses phyreg throughput mac. This can be skipped since
1960                  * only mac reg is accessed below
1961                  */
1962                 if (D11REV_GE(wlc_hw->corerev, 18))
1963                         flags |= SICF_PCLKE;
1964
1965                 /*
1966                  * TODO: test suspend/resume
1967                  *
1968                  * AI chip doesn't restore bar0win2 on
1969                  * hibernation/resume, need sw fixup
1970                  */
1971
1972                 bcma_core_enable(wlc_hw->d11core, flags);
1973                 brcms_c_mctrl_reset(wlc_hw);
1974         }
1975
1976         v = ((bcma_read32(wlc_hw->d11core,
1977                           D11REGOFFS(phydebug)) & PDBG_RFD) != 0);
1978
1979         /* put core back into reset */
1980         if (!clk)
1981                 bcma_core_disable(wlc_hw->d11core, 0);
1982
1983         if (!xtal)
1984                 brcms_b_xtal(wlc_hw, OFF);
1985
1986         return v;
1987 }
1988
1989 static bool wlc_dma_rxreset(struct brcms_hardware *wlc_hw, uint fifo)
1990 {
1991         struct dma_pub *di = wlc_hw->di[fifo];
1992         return dma_rxreset(di);
1993 }
1994
1995 /* d11 core reset
1996  *   ensure fask clock during reset
1997  *   reset dma
1998  *   reset d11(out of reset)
1999  *   reset phy(out of reset)
2000  *   clear software macintstatus for fresh new start
2001  * one testing hack wlc_hw->noreset will bypass the d11/phy reset
2002  */
2003 void brcms_b_corereset(struct brcms_hardware *wlc_hw, u32 flags)
2004 {
2005         uint i;
2006         bool fastclk;
2007
2008         if (flags == BRCMS_USE_COREFLAGS)
2009                 flags = (wlc_hw->band->pi ? wlc_hw->band->core_flags : 0);
2010
2011         brcms_dbg_info(wlc_hw->d11core, "wl%d: core reset\n", wlc_hw->unit);
2012
2013         /* request FAST clock if not on  */
2014         fastclk = wlc_hw->forcefastclk;
2015         if (!fastclk)
2016                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2017
2018         /* reset the dma engines except first time thru */
2019         if (bcma_core_is_enabled(wlc_hw->d11core)) {
2020                 for (i = 0; i < NFIFO; i++)
2021                         if ((wlc_hw->di[i]) && (!dma_txreset(wlc_hw->di[i])))
2022                                 brcms_err(wlc_hw->d11core, "wl%d: %s: "
2023                                           "dma_txreset[%d]: cannot stop dma\n",
2024                                            wlc_hw->unit, __func__, i);
2025
2026                 if ((wlc_hw->di[RX_FIFO])
2027                     && (!wlc_dma_rxreset(wlc_hw, RX_FIFO)))
2028                         brcms_err(wlc_hw->d11core, "wl%d: %s: dma_rxreset"
2029                                   "[%d]: cannot stop dma\n",
2030                                   wlc_hw->unit, __func__, RX_FIFO);
2031         }
2032         /* if noreset, just stop the psm and return */
2033         if (wlc_hw->noreset) {
2034                 wlc_hw->wlc->macintstatus = 0;  /* skip wl_dpc after down */
2035                 brcms_b_mctrl(wlc_hw, MCTL_PSM_RUN | MCTL_EN_MAC, 0);
2036                 return;
2037         }
2038
2039         /*
2040          * mac no longer enables phyclk automatically when driver accesses
2041          * phyreg throughput mac, AND phy_reset is skipped at early stage when
2042          * band->pi is invalid. need to enable PHY CLK
2043          */
2044         if (D11REV_GE(wlc_hw->corerev, 18))
2045                 flags |= SICF_PCLKE;
2046
2047         /*
2048          * reset the core
2049          * In chips with PMU, the fastclk request goes through d11 core
2050          * reg 0x1e0, which is cleared by the core_reset. have to re-request it.
2051          *
2052          * This adds some delay and we can optimize it by also requesting
2053          * fastclk through chipcommon during this period if necessary. But
2054          * that has to work coordinate with other driver like mips/arm since
2055          * they may touch chipcommon as well.
2056          */
2057         wlc_hw->clk = false;
2058         bcma_core_enable(wlc_hw->d11core, flags);
2059         wlc_hw->clk = true;
2060         if (wlc_hw->band && wlc_hw->band->pi)
2061                 wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, true);
2062
2063         brcms_c_mctrl_reset(wlc_hw);
2064
2065         if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU)
2066                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2067
2068         brcms_b_phy_reset(wlc_hw);
2069
2070         /* turn on PHY_PLL */
2071         brcms_b_core_phypll_ctl(wlc_hw, true);
2072
2073         /* clear sw intstatus */
2074         wlc_hw->wlc->macintstatus = 0;
2075
2076         /* restore the clk setting */
2077         if (!fastclk)
2078                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
2079 }
2080
2081 /* txfifo sizes needs to be modified(increased) since the newer cores
2082  * have more memory.
2083  */
2084 static void brcms_b_corerev_fifofixup(struct brcms_hardware *wlc_hw)
2085 {
2086         struct bcma_device *core = wlc_hw->d11core;
2087         u16 fifo_nu;
2088         u16 txfifo_startblk = TXFIFO_START_BLK, txfifo_endblk;
2089         u16 txfifo_def, txfifo_def1;
2090         u16 txfifo_cmd;
2091
2092         /* tx fifos start at TXFIFO_START_BLK from the Base address */
2093         txfifo_startblk = TXFIFO_START_BLK;
2094
2095         /* sequence of operations:  reset fifo, set fifo size, reset fifo */
2096         for (fifo_nu = 0; fifo_nu < NFIFO; fifo_nu++) {
2097
2098                 txfifo_endblk = txfifo_startblk + wlc_hw->xmtfifo_sz[fifo_nu];
2099                 txfifo_def = (txfifo_startblk & 0xff) |
2100                     (((txfifo_endblk - 1) & 0xff) << TXFIFO_FIFOTOP_SHIFT);
2101                 txfifo_def1 = ((txfifo_startblk >> 8) & 0x1) |
2102                     ((((txfifo_endblk -
2103                         1) >> 8) & 0x1) << TXFIFO_FIFOTOP_SHIFT);
2104                 txfifo_cmd =
2105                     TXFIFOCMD_RESET_MASK | (fifo_nu << TXFIFOCMD_FIFOSEL_SHIFT);
2106
2107                 bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2108                 bcma_write16(core, D11REGOFFS(xmtfifodef), txfifo_def);
2109                 bcma_write16(core, D11REGOFFS(xmtfifodef1), txfifo_def1);
2110
2111                 bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2112
2113                 txfifo_startblk += wlc_hw->xmtfifo_sz[fifo_nu];
2114         }
2115         /*
2116          * need to propagate to shm location to be in sync since ucode/hw won't
2117          * do this
2118          */
2119         brcms_b_write_shm(wlc_hw, M_FIFOSIZE0,
2120                            wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]);
2121         brcms_b_write_shm(wlc_hw, M_FIFOSIZE1,
2122                            wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]);
2123         brcms_b_write_shm(wlc_hw, M_FIFOSIZE2,
2124                            ((wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO] << 8) | wlc_hw->
2125                             xmtfifo_sz[TX_AC_BK_FIFO]));
2126         brcms_b_write_shm(wlc_hw, M_FIFOSIZE3,
2127                            ((wlc_hw->xmtfifo_sz[TX_ATIM_FIFO] << 8) | wlc_hw->
2128                             xmtfifo_sz[TX_BCMC_FIFO]));
2129 }
2130
2131 /* This function is used for changing the tsf frac register
2132  * If spur avoidance mode is off, the mac freq will be 80/120/160Mhz
2133  * If spur avoidance mode is on1, the mac freq will be 82/123/164Mhz
2134  * If spur avoidance mode is on2, the mac freq will be 84/126/168Mhz
2135  * HTPHY Formula is 2^26/freq(MHz) e.g.
2136  * For spuron2 - 126MHz -> 2^26/126 = 532610.0
2137  *  - 532610 = 0x82082 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x2082
2138  * For spuron: 123MHz -> 2^26/123    = 545600.5
2139  *  - 545601 = 0x85341 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x5341
2140  * For spur off: 120MHz -> 2^26/120    = 559240.5
2141  *  - 559241 = 0x88889 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x8889
2142  */
2143
2144 void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode)
2145 {
2146         struct bcma_device *core = wlc_hw->d11core;
2147
2148         if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43224) ||
2149             (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225)) {
2150                 if (spurmode == WL_SPURAVOID_ON2) {     /* 126Mhz */
2151                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x2082);
2152                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2153                 } else if (spurmode == WL_SPURAVOID_ON1) {      /* 123Mhz */
2154                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x5341);
2155                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2156                 } else {        /* 120Mhz */
2157                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x8889);
2158                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2159                 }
2160         } else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2161                 if (spurmode == WL_SPURAVOID_ON1) {     /* 82Mhz */
2162                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x7CE0);
2163                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2164                 } else {        /* 80Mhz */
2165                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0xCCCD);
2166                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2167                 }
2168         }
2169 }
2170
2171 void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr)
2172 {
2173         memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2174         wlc->bsscfg->type = BRCMS_TYPE_STATION;
2175 }
2176
2177 /* Initialize GPIOs that are controlled by D11 core */
2178 static void brcms_c_gpio_init(struct brcms_c_info *wlc)
2179 {
2180         struct brcms_hardware *wlc_hw = wlc->hw;
2181         u32 gc, gm;
2182
2183         /* use GPIO select 0 to get all gpio signals from the gpio out reg */
2184         brcms_b_mctrl(wlc_hw, MCTL_GPOUT_SEL_MASK, 0);
2185
2186         /*
2187          * Common GPIO setup:
2188          *      G0 = LED 0 = WLAN Activity
2189          *      G1 = LED 1 = WLAN 2.4 GHz Radio State
2190          *      G2 = LED 2 = WLAN 5 GHz Radio State
2191          *      G4 = radio disable input (HI enabled, LO disabled)
2192          */
2193
2194         gc = gm = 0;
2195
2196         /* Allocate GPIOs for mimo antenna diversity feature */
2197         if (wlc_hw->antsel_type == ANTSEL_2x3) {
2198                 /* Enable antenna diversity, use 2x3 mode */
2199                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2200                              MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2201                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE,
2202                              MHF3_ANTSEL_MODE, BRCM_BAND_ALL);
2203
2204                 /* init superswitch control */
2205                 wlc_phy_antsel_init(wlc_hw->band->pi, false);
2206
2207         } else if (wlc_hw->antsel_type == ANTSEL_2x4) {
2208                 gm |= gc |= (BOARD_GPIO_12 | BOARD_GPIO_13);
2209                 /*
2210                  * The board itself is powered by these GPIOs
2211                  * (when not sending pattern) so set them high
2212                  */
2213                 bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_oe),
2214                            (BOARD_GPIO_12 | BOARD_GPIO_13));
2215                 bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_out),
2216                            (BOARD_GPIO_12 | BOARD_GPIO_13));
2217
2218                 /* Enable antenna diversity, use 2x4 mode */
2219                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2220                              MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2221                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE, 0,
2222                              BRCM_BAND_ALL);
2223
2224                 /* Configure the desired clock to be 4Mhz */
2225                 brcms_b_write_shm(wlc_hw, M_ANTSEL_CLKDIV,
2226                                    ANTSEL_CLKDIV_4MHZ);
2227         }
2228
2229         /*
2230          * gpio 9 controls the PA. ucode is responsible
2231          * for wiggling out and oe
2232          */
2233         if (wlc_hw->boardflags & BFL_PACTRL)
2234                 gm |= gc |= BOARD_GPIO_PACTRL;
2235
2236         /* apply to gpiocontrol register */
2237         bcma_chipco_gpio_control(&wlc_hw->d11core->bus->drv_cc, gm, gc);
2238 }
2239
2240 static void brcms_ucode_write(struct brcms_hardware *wlc_hw,
2241                               const __le32 ucode[], const size_t nbytes)
2242 {
2243         struct bcma_device *core = wlc_hw->d11core;
2244         uint i;
2245         uint count;
2246
2247         brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
2248
2249         count = (nbytes / sizeof(u32));
2250
2251         bcma_write32(core, D11REGOFFS(objaddr),
2252                      OBJADDR_AUTO_INC | OBJADDR_UCM_SEL);
2253         (void)bcma_read32(core, D11REGOFFS(objaddr));
2254         for (i = 0; i < count; i++)
2255                 bcma_write32(core, D11REGOFFS(objdata), le32_to_cpu(ucode[i]));
2256
2257 }
2258
2259 static void brcms_ucode_download(struct brcms_hardware *wlc_hw)
2260 {
2261         struct brcms_c_info *wlc;
2262         struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
2263
2264         wlc = wlc_hw->wlc;
2265
2266         if (wlc_hw->ucode_loaded)
2267                 return;
2268
2269         if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
2270                 if (BRCMS_ISNPHY(wlc_hw->band)) {
2271                         brcms_ucode_write(wlc_hw, ucode->bcm43xx_16_mimo,
2272                                           ucode->bcm43xx_16_mimosz);
2273                         wlc_hw->ucode_loaded = true;
2274                 } else
2275                         brcms_err(wlc_hw->d11core,
2276                                   "%s: wl%d: unsupported phy in corerev %d\n",
2277                                   __func__, wlc_hw->unit, wlc_hw->corerev);
2278         } else if (D11REV_IS(wlc_hw->corerev, 24)) {
2279                 if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2280                         brcms_ucode_write(wlc_hw, ucode->bcm43xx_24_lcn,
2281                                           ucode->bcm43xx_24_lcnsz);
2282                         wlc_hw->ucode_loaded = true;
2283                 } else {
2284                         brcms_err(wlc_hw->d11core,
2285                                   "%s: wl%d: unsupported phy in corerev %d\n",
2286                                   __func__, wlc_hw->unit, wlc_hw->corerev);
2287                 }
2288         }
2289 }
2290
2291 void brcms_b_txant_set(struct brcms_hardware *wlc_hw, u16 phytxant)
2292 {
2293         /* update sw state */
2294         wlc_hw->bmac_phytxant = phytxant;
2295
2296         /* push to ucode if up */
2297         if (!wlc_hw->up)
2298                 return;
2299         brcms_c_ucode_txant_set(wlc_hw);
2300
2301 }
2302
2303 u16 brcms_b_get_txant(struct brcms_hardware *wlc_hw)
2304 {
2305         return (u16) wlc_hw->wlc->stf->txant;
2306 }
2307
2308 void brcms_b_antsel_type_set(struct brcms_hardware *wlc_hw, u8 antsel_type)
2309 {
2310         wlc_hw->antsel_type = antsel_type;
2311
2312         /* Update the antsel type for phy module to use */
2313         wlc_phy_antsel_type_set(wlc_hw->band->pi, antsel_type);
2314 }
2315
2316 static void brcms_b_fifoerrors(struct brcms_hardware *wlc_hw)
2317 {
2318         bool fatal = false;
2319         uint unit;
2320         uint intstatus, idx;
2321         struct bcma_device *core = wlc_hw->d11core;
2322
2323         unit = wlc_hw->unit;
2324
2325         for (idx = 0; idx < NFIFO; idx++) {
2326                 /* read intstatus register and ignore any non-error bits */
2327                 intstatus =
2328                         bcma_read32(core,
2329                                     D11REGOFFS(intctrlregs[idx].intstatus)) &
2330                         I_ERRORS;
2331                 if (!intstatus)
2332                         continue;
2333
2334                 brcms_dbg_int(core, "wl%d: intstatus%d 0x%x\n",
2335                               unit, idx, intstatus);
2336
2337                 if (intstatus & I_RO) {
2338                         brcms_err(core, "wl%d: fifo %d: receive fifo "
2339                                   "overflow\n", unit, idx);
2340                         fatal = true;
2341                 }
2342
2343                 if (intstatus & I_PC) {
2344                         brcms_err(core, "wl%d: fifo %d: descriptor error\n",
2345                                   unit, idx);
2346                         fatal = true;
2347                 }
2348
2349                 if (intstatus & I_PD) {
2350                         brcms_err(core, "wl%d: fifo %d: data error\n", unit,
2351                                   idx);
2352                         fatal = true;
2353                 }
2354
2355                 if (intstatus & I_DE) {
2356                         brcms_err(core, "wl%d: fifo %d: descriptor protocol "
2357                                   "error\n", unit, idx);
2358                         fatal = true;
2359                 }
2360
2361                 if (intstatus & I_RU)
2362                         brcms_err(core, "wl%d: fifo %d: receive descriptor "
2363                                   "underflow\n", idx, unit);
2364
2365                 if (intstatus & I_XU) {
2366                         brcms_err(core, "wl%d: fifo %d: transmit fifo "
2367                                   "underflow\n", idx, unit);
2368                         fatal = true;
2369                 }
2370
2371                 if (fatal) {
2372                         brcms_fatal_error(wlc_hw->wlc->wl); /* big hammer */
2373                         break;
2374                 } else
2375                         bcma_write32(core,
2376                                      D11REGOFFS(intctrlregs[idx].intstatus),
2377                                      intstatus);
2378         }
2379 }
2380
2381 void brcms_c_intrson(struct brcms_c_info *wlc)
2382 {
2383         struct brcms_hardware *wlc_hw = wlc->hw;
2384         wlc->macintmask = wlc->defmacintmask;
2385         bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2386 }
2387
2388 u32 brcms_c_intrsoff(struct brcms_c_info *wlc)
2389 {
2390         struct brcms_hardware *wlc_hw = wlc->hw;
2391         u32 macintmask;
2392
2393         if (!wlc_hw->clk)
2394                 return 0;
2395
2396         macintmask = wlc->macintmask;   /* isr can still happen */
2397
2398         bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), 0);
2399         (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(macintmask));
2400         udelay(1);              /* ensure int line is no longer driven */
2401         wlc->macintmask = 0;
2402
2403         /* return previous macintmask; resolve race between us and our isr */
2404         return wlc->macintstatus ? 0 : macintmask;
2405 }
2406
2407 void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask)
2408 {
2409         struct brcms_hardware *wlc_hw = wlc->hw;
2410         if (!wlc_hw->clk)
2411                 return;
2412
2413         wlc->macintmask = macintmask;
2414         bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2415 }
2416
2417 /* assumes that the d11 MAC is enabled */
2418 static void brcms_b_tx_fifo_suspend(struct brcms_hardware *wlc_hw,
2419                                     uint tx_fifo)
2420 {
2421         u8 fifo = 1 << tx_fifo;
2422
2423         /* Two clients of this code, 11h Quiet period and scanning. */
2424
2425         /* only suspend if not already suspended */
2426         if ((wlc_hw->suspended_fifos & fifo) == fifo)
2427                 return;
2428
2429         /* force the core awake only if not already */
2430         if (wlc_hw->suspended_fifos == 0)
2431                 brcms_c_ucode_wake_override_set(wlc_hw,
2432                                                 BRCMS_WAKE_OVERRIDE_TXFIFO);
2433
2434         wlc_hw->suspended_fifos |= fifo;
2435
2436         if (wlc_hw->di[tx_fifo]) {
2437                 /*
2438                  * Suspending AMPDU transmissions in the middle can cause
2439                  * underflow which may result in mismatch between ucode and
2440                  * driver so suspend the mac before suspending the FIFO
2441                  */
2442                 if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2443                         brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
2444
2445                 dma_txsuspend(wlc_hw->di[tx_fifo]);
2446
2447                 if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2448                         brcms_c_enable_mac(wlc_hw->wlc);
2449         }
2450 }
2451
2452 static void brcms_b_tx_fifo_resume(struct brcms_hardware *wlc_hw,
2453                                    uint tx_fifo)
2454 {
2455         /* BMAC_NOTE: BRCMS_TX_FIFO_ENAB is done in brcms_c_dpc() for DMA case
2456          * but need to be done here for PIO otherwise the watchdog will catch
2457          * the inconsistency and fire
2458          */
2459         /* Two clients of this code, 11h Quiet period and scanning. */
2460         if (wlc_hw->di[tx_fifo])
2461                 dma_txresume(wlc_hw->di[tx_fifo]);
2462
2463         /* allow core to sleep again */
2464         if (wlc_hw->suspended_fifos == 0)
2465                 return;
2466         else {
2467                 wlc_hw->suspended_fifos &= ~(1 << tx_fifo);
2468                 if (wlc_hw->suspended_fifos == 0)
2469                         brcms_c_ucode_wake_override_clear(wlc_hw,
2470                                                 BRCMS_WAKE_OVERRIDE_TXFIFO);
2471         }
2472 }
2473
2474 /* precondition: requires the mac core to be enabled */
2475 static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
2476 {
2477         static const u8 null_ether_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
2478         u8 *ethaddr = wlc_hw->wlc->pub->cur_etheraddr;
2479
2480         if (mute_tx) {
2481                 /* suspend tx fifos */
2482                 brcms_b_tx_fifo_suspend(wlc_hw, TX_DATA_FIFO);
2483                 brcms_b_tx_fifo_suspend(wlc_hw, TX_CTL_FIFO);
2484                 brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_BK_FIFO);
2485                 brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_VI_FIFO);
2486
2487                 /* zero the address match register so we do not send ACKs */
2488                 brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, null_ether_addr);
2489         } else {
2490                 /* resume tx fifos */
2491                 brcms_b_tx_fifo_resume(wlc_hw, TX_DATA_FIFO);
2492                 brcms_b_tx_fifo_resume(wlc_hw, TX_CTL_FIFO);
2493                 brcms_b_tx_fifo_resume(wlc_hw, TX_AC_BK_FIFO);
2494                 brcms_b_tx_fifo_resume(wlc_hw, TX_AC_VI_FIFO);
2495
2496                 /* Restore address */
2497                 brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, ethaddr);
2498         }
2499
2500         wlc_phy_mute_upd(wlc_hw->band->pi, mute_tx, 0);
2501
2502         if (mute_tx)
2503                 brcms_c_ucode_mute_override_set(wlc_hw);
2504         else
2505                 brcms_c_ucode_mute_override_clear(wlc_hw);
2506 }
2507
2508 void
2509 brcms_c_mute(struct brcms_c_info *wlc, bool mute_tx)
2510 {
2511         brcms_b_mute(wlc->hw, mute_tx);
2512 }
2513
2514 /*
2515  * Read and clear macintmask and macintstatus and intstatus registers.
2516  * This routine should be called with interrupts off
2517  * Return:
2518  *   -1 if brcms_deviceremoved(wlc) evaluates to true;
2519  *   0 if the interrupt is not for us, or we are in some special cases;
2520  *   device interrupt status bits otherwise.
2521  */
2522 static inline u32 wlc_intstatus(struct brcms_c_info *wlc, bool in_isr)
2523 {
2524         struct brcms_hardware *wlc_hw = wlc->hw;
2525         struct bcma_device *core = wlc_hw->d11core;
2526         u32 macintstatus, mask;
2527
2528         /* macintstatus includes a DMA interrupt summary bit */
2529         macintstatus = bcma_read32(core, D11REGOFFS(macintstatus));
2530         mask = in_isr ? wlc->macintmask : wlc->defmacintmask;
2531
2532         trace_brcms_macintstatus(&core->dev, in_isr, macintstatus, mask);
2533
2534         /* detect cardbus removed, in power down(suspend) and in reset */
2535         if (brcms_deviceremoved(wlc))
2536                 return -1;
2537
2538         /* brcms_deviceremoved() succeeds even when the core is still resetting,
2539          * handle that case here.
2540          */
2541         if (macintstatus == 0xffffffff)
2542                 return 0;
2543
2544         /* defer unsolicited interrupts */
2545         macintstatus &= mask;
2546
2547         /* if not for us */
2548         if (macintstatus == 0)
2549                 return 0;
2550
2551         /* turn off the interrupts */
2552         bcma_write32(core, D11REGOFFS(macintmask), 0);
2553         (void)bcma_read32(core, D11REGOFFS(macintmask));
2554         wlc->macintmask = 0;
2555
2556         /* clear device interrupts */
2557         bcma_write32(core, D11REGOFFS(macintstatus), macintstatus);
2558
2559         /* MI_DMAINT is indication of non-zero intstatus */
2560         if (macintstatus & MI_DMAINT)
2561                 /*
2562                  * only fifo interrupt enabled is I_RI in
2563                  * RX_FIFO. If MI_DMAINT is set, assume it
2564                  * is set and clear the interrupt.
2565                  */
2566                 bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intstatus),
2567                              DEF_RXINTMASK);
2568
2569         return macintstatus;
2570 }
2571
2572 /* Update wlc->macintstatus and wlc->intstatus[]. */
2573 /* Return true if they are updated successfully. false otherwise */
2574 bool brcms_c_intrsupd(struct brcms_c_info *wlc)
2575 {
2576         u32 macintstatus;
2577
2578         /* read and clear macintstatus and intstatus registers */
2579         macintstatus = wlc_intstatus(wlc, false);
2580
2581         /* device is removed */
2582         if (macintstatus == 0xffffffff)
2583                 return false;
2584
2585         /* update interrupt status in software */
2586         wlc->macintstatus |= macintstatus;
2587
2588         return true;
2589 }
2590
2591 /*
2592  * First-level interrupt processing.
2593  * Return true if this was our interrupt
2594  * and if further brcms_c_dpc() processing is required,
2595  * false otherwise.
2596  */
2597 bool brcms_c_isr(struct brcms_c_info *wlc)
2598 {
2599         struct brcms_hardware *wlc_hw = wlc->hw;
2600         u32 macintstatus;
2601
2602         if (!wlc_hw->up || !wlc->macintmask)
2603                 return false;
2604
2605         /* read and clear macintstatus and intstatus registers */
2606         macintstatus = wlc_intstatus(wlc, true);
2607
2608         if (macintstatus == 0xffffffff) {
2609                 brcms_err(wlc_hw->d11core,
2610                           "DEVICEREMOVED detected in the ISR code path\n");
2611                 return false;
2612         }
2613
2614         /* it is not for us */
2615         if (macintstatus == 0)
2616                 return false;
2617
2618         /* save interrupt status bits */
2619         wlc->macintstatus = macintstatus;
2620
2621         return true;
2622
2623 }
2624
2625 void brcms_c_suspend_mac_and_wait(struct brcms_c_info *wlc)
2626 {
2627         struct brcms_hardware *wlc_hw = wlc->hw;
2628         struct bcma_device *core = wlc_hw->d11core;
2629         u32 mc, mi;
2630
2631         brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2632                            wlc_hw->band->bandunit);
2633
2634         /*
2635          * Track overlapping suspend requests
2636          */
2637         wlc_hw->mac_suspend_depth++;
2638         if (wlc_hw->mac_suspend_depth > 1)
2639                 return;
2640
2641         /* force the core awake */
2642         brcms_c_ucode_wake_override_set(wlc_hw, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2643
2644         mc = bcma_read32(core, D11REGOFFS(maccontrol));
2645
2646         if (mc == 0xffffffff) {
2647                 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2648                           __func__);
2649                 brcms_down(wlc->wl);
2650                 return;
2651         }
2652         WARN_ON(mc & MCTL_PSM_JMP_0);
2653         WARN_ON(!(mc & MCTL_PSM_RUN));
2654         WARN_ON(!(mc & MCTL_EN_MAC));
2655
2656         mi = bcma_read32(core, D11REGOFFS(macintstatus));
2657         if (mi == 0xffffffff) {
2658                 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2659                           __func__);
2660                 brcms_down(wlc->wl);
2661                 return;
2662         }
2663         WARN_ON(mi & MI_MACSSPNDD);
2664
2665         brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, 0);
2666
2667         SPINWAIT(!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD),
2668                  BRCMS_MAX_MAC_SUSPEND);
2669
2670         if (!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD)) {
2671                 brcms_err(core, "wl%d: wlc_suspend_mac_and_wait: waited %d uS"
2672                           " and MI_MACSSPNDD is still not on.\n",
2673                           wlc_hw->unit, BRCMS_MAX_MAC_SUSPEND);
2674                 brcms_err(core, "wl%d: psmdebug 0x%08x, phydebug 0x%08x, "
2675                           "psm_brc 0x%04x\n", wlc_hw->unit,
2676                           bcma_read32(core, D11REGOFFS(psmdebug)),
2677                           bcma_read32(core, D11REGOFFS(phydebug)),
2678                           bcma_read16(core, D11REGOFFS(psm_brc)));
2679         }
2680
2681         mc = bcma_read32(core, D11REGOFFS(maccontrol));
2682         if (mc == 0xffffffff) {
2683                 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2684                           __func__);
2685                 brcms_down(wlc->wl);
2686                 return;
2687         }
2688         WARN_ON(mc & MCTL_PSM_JMP_0);
2689         WARN_ON(!(mc & MCTL_PSM_RUN));
2690         WARN_ON(mc & MCTL_EN_MAC);
2691 }
2692
2693 void brcms_c_enable_mac(struct brcms_c_info *wlc)
2694 {
2695         struct brcms_hardware *wlc_hw = wlc->hw;
2696         struct bcma_device *core = wlc_hw->d11core;
2697         u32 mc, mi;
2698
2699         brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2700                            wlc->band->bandunit);
2701
2702         /*
2703          * Track overlapping suspend requests
2704          */
2705         wlc_hw->mac_suspend_depth--;
2706         if (wlc_hw->mac_suspend_depth > 0)
2707                 return;
2708
2709         mc = bcma_read32(core, D11REGOFFS(maccontrol));
2710         WARN_ON(mc & MCTL_PSM_JMP_0);
2711         WARN_ON(mc & MCTL_EN_MAC);
2712         WARN_ON(!(mc & MCTL_PSM_RUN));
2713
2714         brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, MCTL_EN_MAC);
2715         bcma_write32(core, D11REGOFFS(macintstatus), MI_MACSSPNDD);
2716
2717         mc = bcma_read32(core, D11REGOFFS(maccontrol));
2718         WARN_ON(mc & MCTL_PSM_JMP_0);
2719         WARN_ON(!(mc & MCTL_EN_MAC));
2720         WARN_ON(!(mc & MCTL_PSM_RUN));
2721
2722         mi = bcma_read32(core, D11REGOFFS(macintstatus));
2723         WARN_ON(mi & MI_MACSSPNDD);
2724
2725         brcms_c_ucode_wake_override_clear(wlc_hw,
2726                                           BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2727 }
2728
2729 void brcms_b_band_stf_ss_set(struct brcms_hardware *wlc_hw, u8 stf_mode)
2730 {
2731         wlc_hw->hw_stf_ss_opmode = stf_mode;
2732
2733         if (wlc_hw->clk)
2734                 brcms_upd_ofdm_pctl1_table(wlc_hw);
2735 }
2736
2737 static bool brcms_b_validate_chip_access(struct brcms_hardware *wlc_hw)
2738 {
2739         struct bcma_device *core = wlc_hw->d11core;
2740         u32 w, val;
2741         struct wiphy *wiphy = wlc_hw->wlc->wiphy;
2742
2743         /* Validate dchip register access */
2744
2745         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2746         (void)bcma_read32(core, D11REGOFFS(objaddr));
2747         w = bcma_read32(core, D11REGOFFS(objdata));
2748
2749         /* Can we write and read back a 32bit register? */
2750         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2751         (void)bcma_read32(core, D11REGOFFS(objaddr));
2752         bcma_write32(core, D11REGOFFS(objdata), (u32) 0xaa5555aa);
2753
2754         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2755         (void)bcma_read32(core, D11REGOFFS(objaddr));
2756         val = bcma_read32(core, D11REGOFFS(objdata));
2757         if (val != (u32) 0xaa5555aa) {
2758                 wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2759                           "expected 0xaa5555aa\n", wlc_hw->unit, val);
2760                 return false;
2761         }
2762
2763         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2764         (void)bcma_read32(core, D11REGOFFS(objaddr));
2765         bcma_write32(core, D11REGOFFS(objdata), (u32) 0x55aaaa55);
2766
2767         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2768         (void)bcma_read32(core, D11REGOFFS(objaddr));
2769         val = bcma_read32(core, D11REGOFFS(objdata));
2770         if (val != (u32) 0x55aaaa55) {
2771                 wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2772                           "expected 0x55aaaa55\n", wlc_hw->unit, val);
2773                 return false;
2774         }
2775
2776         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2777         (void)bcma_read32(core, D11REGOFFS(objaddr));
2778         bcma_write32(core, D11REGOFFS(objdata), w);
2779
2780         /* clear CFPStart */
2781         bcma_write32(core, D11REGOFFS(tsf_cfpstart), 0);
2782
2783         w = bcma_read32(core, D11REGOFFS(maccontrol));
2784         if ((w != (MCTL_IHR_EN | MCTL_WAKE)) &&
2785             (w != (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE))) {
2786                 wiphy_err(wiphy, "wl%d: validate_chip_access: maccontrol = "
2787                           "0x%x, expected 0x%x or 0x%x\n", wlc_hw->unit, w,
2788                           (MCTL_IHR_EN | MCTL_WAKE),
2789                           (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE));
2790                 return false;
2791         }
2792
2793         return true;
2794 }
2795
2796 #define PHYPLL_WAIT_US  100000
2797
2798 void brcms_b_core_phypll_ctl(struct brcms_hardware *wlc_hw, bool on)
2799 {
2800         struct bcma_device *core = wlc_hw->d11core;
2801         u32 tmp;
2802
2803         brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
2804
2805         tmp = 0;
2806
2807         if (on) {
2808                 if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
2809                         bcma_set32(core, D11REGOFFS(clk_ctl_st),
2810                                    CCS_ERSRC_REQ_HT |
2811                                    CCS_ERSRC_REQ_D11PLL |
2812                                    CCS_ERSRC_REQ_PHYPLL);
2813                         SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2814                                   CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT,
2815                                  PHYPLL_WAIT_US);
2816
2817                         tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2818                         if ((tmp & CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT)
2819                                 brcms_err(core, "%s: turn on PHY PLL failed\n",
2820                                           __func__);
2821                 } else {
2822                         bcma_set32(core, D11REGOFFS(clk_ctl_st),
2823                                    tmp | CCS_ERSRC_REQ_D11PLL |
2824                                    CCS_ERSRC_REQ_PHYPLL);
2825                         SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2826                                   (CCS_ERSRC_AVAIL_D11PLL |
2827                                    CCS_ERSRC_AVAIL_PHYPLL)) !=
2828                                  (CCS_ERSRC_AVAIL_D11PLL |
2829                                   CCS_ERSRC_AVAIL_PHYPLL), PHYPLL_WAIT_US);
2830
2831                         tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2832                         if ((tmp &
2833                              (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2834                             !=
2835                             (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2836                                 brcms_err(core, "%s: turn on PHY PLL failed\n",
2837                                           __func__);
2838                 }
2839         } else {
2840                 /*
2841                  * Since the PLL may be shared, other cores can still
2842                  * be requesting it; so we'll deassert the request but
2843                  * not wait for status to comply.
2844                  */
2845                 bcma_mask32(core, D11REGOFFS(clk_ctl_st),
2846                             ~CCS_ERSRC_REQ_PHYPLL);
2847                 (void)bcma_read32(core, D11REGOFFS(clk_ctl_st));
2848         }
2849 }
2850
2851 static void brcms_c_coredisable(struct brcms_hardware *wlc_hw)
2852 {
2853         bool dev_gone;
2854
2855         brcms_dbg_info(wlc_hw->d11core, "wl%d: disable core\n", wlc_hw->unit);
2856
2857         dev_gone = brcms_deviceremoved(wlc_hw->wlc);
2858
2859         if (dev_gone)
2860                 return;
2861
2862         if (wlc_hw->noreset)
2863                 return;
2864
2865         /* radio off */
2866         wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
2867
2868         /* turn off analog core */
2869         wlc_phy_anacore(wlc_hw->band->pi, OFF);
2870
2871         /* turn off PHYPLL to save power */
2872         brcms_b_core_phypll_ctl(wlc_hw, false);
2873
2874         wlc_hw->clk = false;
2875         bcma_core_disable(wlc_hw->d11core, 0);
2876         wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
2877 }
2878
2879 static void brcms_c_flushqueues(struct brcms_c_info *wlc)
2880 {
2881         struct brcms_hardware *wlc_hw = wlc->hw;
2882         uint i;
2883
2884         /* free any posted tx packets */
2885         for (i = 0; i < NFIFO; i++) {
2886                 if (wlc_hw->di[i]) {
2887                         dma_txreclaim(wlc_hw->di[i], DMA_RANGE_ALL);
2888                         if (i < TX_BCMC_FIFO)
2889                                 ieee80211_wake_queue(wlc->pub->ieee_hw,
2890                                                      brcms_fifo_to_ac(i));
2891                 }
2892         }
2893
2894         /* free any posted rx packets */
2895         dma_rxreclaim(wlc_hw->di[RX_FIFO]);
2896 }
2897
2898 static u16
2899 brcms_b_read_objmem(struct brcms_hardware *wlc_hw, uint offset, u32 sel)
2900 {
2901         struct bcma_device *core = wlc_hw->d11core;
2902         u16 objoff = D11REGOFFS(objdata);
2903
2904         bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2905         (void)bcma_read32(core, D11REGOFFS(objaddr));
2906         if (offset & 2)
2907                 objoff += 2;
2908
2909         return bcma_read16(core, objoff);
2910 }
2911
2912 static void
2913 brcms_b_write_objmem(struct brcms_hardware *wlc_hw, uint offset, u16 v,
2914                      u32 sel)
2915 {
2916         struct bcma_device *core = wlc_hw->d11core;
2917         u16 objoff = D11REGOFFS(objdata);
2918
2919         bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2920         (void)bcma_read32(core, D11REGOFFS(objaddr));
2921         if (offset & 2)
2922                 objoff += 2;
2923
2924         bcma_wflush16(core, objoff, v);
2925 }
2926
2927 /*
2928  * Read a single u16 from shared memory.
2929  * SHM 'offset' needs to be an even address
2930  */
2931 u16 brcms_b_read_shm(struct brcms_hardware *wlc_hw, uint offset)
2932 {
2933         return brcms_b_read_objmem(wlc_hw, offset, OBJADDR_SHM_SEL);
2934 }
2935
2936 /*
2937  * Write a single u16 to shared memory.
2938  * SHM 'offset' needs to be an even address
2939  */
2940 void brcms_b_write_shm(struct brcms_hardware *wlc_hw, uint offset, u16 v)
2941 {
2942         brcms_b_write_objmem(wlc_hw, offset, v, OBJADDR_SHM_SEL);
2943 }
2944
2945 /*
2946  * Copy a buffer to shared memory of specified type .
2947  * SHM 'offset' needs to be an even address and
2948  * Buffer length 'len' must be an even number of bytes
2949  * 'sel' selects the type of memory
2950  */
2951 void
2952 brcms_b_copyto_objmem(struct brcms_hardware *wlc_hw, uint offset,
2953                       const void *buf, int len, u32 sel)
2954 {
2955         u16 v;
2956         const u8 *p = (const u8 *)buf;
2957         int i;
2958
2959         if (len <= 0 || (offset & 1) || (len & 1))
2960                 return;
2961
2962         for (i = 0; i < len; i += 2) {
2963                 v = p[i] | (p[i + 1] << 8);
2964                 brcms_b_write_objmem(wlc_hw, offset + i, v, sel);
2965         }
2966 }
2967
2968 /*
2969  * Copy a piece of shared memory of specified type to a buffer .
2970  * SHM 'offset' needs to be an even address and
2971  * Buffer length 'len' must be an even number of bytes
2972  * 'sel' selects the type of memory
2973  */
2974 void
2975 brcms_b_copyfrom_objmem(struct brcms_hardware *wlc_hw, uint offset, void *buf,
2976                          int len, u32 sel)
2977 {
2978         u16 v;
2979         u8 *p = (u8 *) buf;
2980         int i;
2981
2982         if (len <= 0 || (offset & 1) || (len & 1))
2983                 return;
2984
2985         for (i = 0; i < len; i += 2) {
2986                 v = brcms_b_read_objmem(wlc_hw, offset + i, sel);
2987                 p[i] = v & 0xFF;
2988                 p[i + 1] = (v >> 8) & 0xFF;
2989         }
2990 }
2991
2992 /* Copy a buffer to shared memory.
2993  * SHM 'offset' needs to be an even address and
2994  * Buffer length 'len' must be an even number of bytes
2995  */
2996 static void brcms_c_copyto_shm(struct brcms_c_info *wlc, uint offset,
2997                         const void *buf, int len)
2998 {
2999         brcms_b_copyto_objmem(wlc->hw, offset, buf, len, OBJADDR_SHM_SEL);
3000 }
3001
3002 static void brcms_b_retrylimit_upd(struct brcms_hardware *wlc_hw,
3003                                    u16 SRL, u16 LRL)
3004 {
3005         wlc_hw->SRL = SRL;
3006         wlc_hw->LRL = LRL;
3007
3008         /* write retry limit to SCR, shouldn't need to suspend */
3009         if (wlc_hw->up) {
3010                 bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3011                              OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3012                 (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3013                 bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->SRL);
3014                 bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3015                              OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3016                 (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3017                 bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->LRL);
3018         }
3019 }
3020
3021 static void brcms_b_pllreq(struct brcms_hardware *wlc_hw, bool set, u32 req_bit)
3022 {
3023         if (set) {
3024                 if (mboolisset(wlc_hw->pllreq, req_bit))
3025                         return;
3026
3027                 mboolset(wlc_hw->pllreq, req_bit);
3028
3029                 if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3030                         if (!wlc_hw->sbclk)
3031                                 brcms_b_xtal(wlc_hw, ON);
3032                 }
3033         } else {
3034                 if (!mboolisset(wlc_hw->pllreq, req_bit))
3035                         return;
3036
3037                 mboolclr(wlc_hw->pllreq, req_bit);
3038
3039                 if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3040                         if (wlc_hw->sbclk)
3041                                 brcms_b_xtal(wlc_hw, OFF);
3042                 }
3043         }
3044 }
3045
3046 static void brcms_b_antsel_set(struct brcms_hardware *wlc_hw, u32 antsel_avail)
3047 {
3048         wlc_hw->antsel_avail = antsel_avail;
3049 }
3050
3051 /*
3052  * conditions under which the PM bit should be set in outgoing frames
3053  * and STAY_AWAKE is meaningful
3054  */
3055 static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
3056 {
3057         /* disallow PS when one of the following global conditions meets */
3058         if (!wlc->pub->associated)
3059                 return false;
3060
3061         /* disallow PS when one of these meets when not scanning */
3062         if (wlc->filter_flags & FIF_PROMISC_IN_BSS)
3063                 return false;
3064
3065         return true;
3066 }
3067
3068 static void brcms_c_statsupd(struct brcms_c_info *wlc)
3069 {
3070         int i;
3071         struct macstat macstats;
3072 #ifdef DEBUG
3073         u16 delta;
3074         u16 rxf0ovfl;
3075         u16 txfunfl[NFIFO];
3076 #endif                          /* DEBUG */
3077
3078         /* if driver down, make no sense to update stats */
3079         if (!wlc->pub->up)
3080                 return;
3081
3082 #ifdef DEBUG
3083         /* save last rx fifo 0 overflow count */
3084         rxf0ovfl = wlc->core->macstat_snapshot->rxf0ovfl;
3085
3086         /* save last tx fifo  underflow count */
3087         for (i = 0; i < NFIFO; i++)
3088                 txfunfl[i] = wlc->core->macstat_snapshot->txfunfl[i];
3089 #endif                          /* DEBUG */
3090
3091         /* Read mac stats from contiguous shared memory */
3092         brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, &macstats,
3093                                 sizeof(struct macstat), OBJADDR_SHM_SEL);
3094
3095 #ifdef DEBUG
3096         /* check for rx fifo 0 overflow */
3097         delta = (u16) (wlc->core->macstat_snapshot->rxf0ovfl - rxf0ovfl);
3098         if (delta)
3099                 brcms_err(wlc->hw->d11core, "wl%d: %u rx fifo 0 overflows!\n",
3100                           wlc->pub->unit, delta);
3101
3102         /* check for tx fifo underflows */
3103         for (i = 0; i < NFIFO; i++) {
3104                 delta =
3105                     (u16) (wlc->core->macstat_snapshot->txfunfl[i] -
3106                               txfunfl[i]);
3107                 if (delta)
3108                         brcms_err(wlc->hw->d11core,
3109                                   "wl%d: %u tx fifo %d underflows!\n",
3110                                   wlc->pub->unit, delta, i);
3111         }
3112 #endif                          /* DEBUG */
3113
3114         /* merge counters from dma module */
3115         for (i = 0; i < NFIFO; i++) {
3116                 if (wlc->hw->di[i])
3117                         dma_counterreset(wlc->hw->di[i]);
3118         }
3119 }
3120
3121 static void brcms_b_reset(struct brcms_hardware *wlc_hw)
3122 {
3123         /* reset the core */
3124         if (!brcms_deviceremoved(wlc_hw->wlc))
3125                 brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
3126
3127         /* purge the dma rings */
3128         brcms_c_flushqueues(wlc_hw->wlc);
3129 }
3130
3131 void brcms_c_reset(struct brcms_c_info *wlc)
3132 {
3133         brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
3134
3135         /* slurp up hw mac counters before core reset */
3136         brcms_c_statsupd(wlc);
3137
3138         /* reset our snapshot of macstat counters */
3139         memset(wlc->core->macstat_snapshot, 0, sizeof(struct macstat));
3140
3141         brcms_b_reset(wlc->hw);
3142 }
3143
3144 void brcms_c_init_scb(struct scb *scb)
3145 {
3146         int i;
3147
3148         memset(scb, 0, sizeof(struct scb));
3149         scb->flags = SCB_WMECAP | SCB_HTCAP;
3150         for (i = 0; i < NUMPRIO; i++) {
3151                 scb->seqnum[i] = 0;
3152                 scb->seqctl[i] = 0xFFFF;
3153         }
3154
3155         scb->seqctl_nonqos = 0xFFFF;
3156         scb->magic = SCB_MAGIC;
3157 }
3158
3159 /* d11 core init
3160  *   reset PSM
3161  *   download ucode/PCM
3162  *   let ucode run to suspended
3163  *   download ucode inits
3164  *   config other core registers
3165  *   init dma
3166  */
3167 static void brcms_b_coreinit(struct brcms_c_info *wlc)
3168 {
3169         struct brcms_hardware *wlc_hw = wlc->hw;
3170         struct bcma_device *core = wlc_hw->d11core;
3171         u32 sflags;
3172         u32 bcnint_us;
3173         uint i = 0;
3174         bool fifosz_fixup = false;
3175         int err = 0;
3176         u16 buf[NFIFO];
3177         struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
3178
3179         brcms_dbg_info(core, "wl%d: core init\n", wlc_hw->unit);
3180
3181         /* reset PSM */
3182         brcms_b_mctrl(wlc_hw, ~0, (MCTL_IHR_EN | MCTL_PSM_JMP_0 | MCTL_WAKE));
3183
3184         brcms_ucode_download(wlc_hw);
3185         /*
3186          * FIFOSZ fixup. driver wants to controls the fifo allocation.
3187          */
3188         fifosz_fixup = true;
3189
3190         /* let the PSM run to the suspended state, set mode to BSS STA */
3191         bcma_write32(core, D11REGOFFS(macintstatus), -1);
3192         brcms_b_mctrl(wlc_hw, ~0,
3193                        (MCTL_IHR_EN | MCTL_INFRA | MCTL_PSM_RUN | MCTL_WAKE));
3194
3195         /* wait for ucode to self-suspend after auto-init */
3196         SPINWAIT(((bcma_read32(core, D11REGOFFS(macintstatus)) &
3197                    MI_MACSSPNDD) == 0), 1000 * 1000);
3198         if ((bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD) == 0)
3199                 brcms_err(core, "wl%d: wlc_coreinit: ucode did not self-"
3200                           "suspend!\n", wlc_hw->unit);
3201
3202         brcms_c_gpio_init(wlc);
3203
3204         sflags = bcma_aread32(core, BCMA_IOST);
3205
3206         if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
3207                 if (BRCMS_ISNPHY(wlc_hw->band))
3208                         brcms_c_write_inits(wlc_hw, ucode->d11n0initvals16);
3209                 else
3210                         brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3211                                   " %d\n", __func__, wlc_hw->unit,
3212                                   wlc_hw->corerev);
3213         } else if (D11REV_IS(wlc_hw->corerev, 24)) {
3214                 if (BRCMS_ISLCNPHY(wlc_hw->band))
3215                         brcms_c_write_inits(wlc_hw, ucode->d11lcn0initvals24);
3216                 else
3217                         brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3218                                   " %d\n", __func__, wlc_hw->unit,
3219                                   wlc_hw->corerev);
3220         } else {
3221                 brcms_err(core, "%s: wl%d: unsupported corerev %d\n",
3222                           __func__, wlc_hw->unit, wlc_hw->corerev);
3223         }
3224
3225         /* For old ucode, txfifo sizes needs to be modified(increased) */
3226         if (fifosz_fixup)
3227                 brcms_b_corerev_fifofixup(wlc_hw);
3228
3229         /* check txfifo allocations match between ucode and driver */
3230         buf[TX_AC_BE_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE0);
3231         if (buf[TX_AC_BE_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]) {
3232                 i = TX_AC_BE_FIFO;
3233                 err = -1;
3234         }
3235         buf[TX_AC_VI_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE1);
3236         if (buf[TX_AC_VI_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]) {
3237                 i = TX_AC_VI_FIFO;
3238                 err = -1;
3239         }
3240         buf[TX_AC_BK_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE2);
3241         buf[TX_AC_VO_FIFO] = (buf[TX_AC_BK_FIFO] >> 8) & 0xff;
3242         buf[TX_AC_BK_FIFO] &= 0xff;
3243         if (buf[TX_AC_BK_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BK_FIFO]) {
3244                 i = TX_AC_BK_FIFO;
3245                 err = -1;
3246         }
3247         if (buf[TX_AC_VO_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO]) {
3248                 i = TX_AC_VO_FIFO;
3249                 err = -1;
3250         }
3251         buf[TX_BCMC_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE3);
3252         buf[TX_ATIM_FIFO] = (buf[TX_BCMC_FIFO] >> 8) & 0xff;
3253         buf[TX_BCMC_FIFO] &= 0xff;
3254         if (buf[TX_BCMC_FIFO] != wlc_hw->xmtfifo_sz[TX_BCMC_FIFO]) {
3255                 i = TX_BCMC_FIFO;
3256                 err = -1;
3257         }
3258         if (buf[TX_ATIM_FIFO] != wlc_hw->xmtfifo_sz[TX_ATIM_FIFO]) {
3259                 i = TX_ATIM_FIFO;
3260                 err = -1;
3261         }
3262         if (err != 0)
3263                 brcms_err(core, "wlc_coreinit: txfifo mismatch: ucode size %d"
3264                           " driver size %d index %d\n", buf[i],
3265                           wlc_hw->xmtfifo_sz[i], i);
3266
3267         /* make sure we can still talk to the mac */
3268         WARN_ON(bcma_read32(core, D11REGOFFS(maccontrol)) == 0xffffffff);
3269
3270         /* band-specific inits done by wlc_bsinit() */
3271
3272         /* Set up frame burst size and antenna swap threshold init values */
3273         brcms_b_write_shm(wlc_hw, M_MBURST_SIZE, MAXTXFRAMEBURST);
3274         brcms_b_write_shm(wlc_hw, M_MAX_ANTCNT, ANTCNT);
3275
3276         /* enable one rx interrupt per received frame */
3277         bcma_write32(core, D11REGOFFS(intrcvlazy[0]), (1 << IRL_FC_SHIFT));
3278
3279         /* set the station mode (BSS STA) */
3280         brcms_b_mctrl(wlc_hw,
3281                        (MCTL_INFRA | MCTL_DISCARD_PMQ | MCTL_AP),
3282                        (MCTL_INFRA | MCTL_DISCARD_PMQ));
3283
3284         /* set up Beacon interval */
3285         bcnint_us = 0x8000 << 10;
3286         bcma_write32(core, D11REGOFFS(tsf_cfprep),
3287                      (bcnint_us << CFPREP_CBI_SHIFT));
3288         bcma_write32(core, D11REGOFFS(tsf_cfpstart), bcnint_us);
3289         bcma_write32(core, D11REGOFFS(macintstatus), MI_GP1);
3290
3291         /* write interrupt mask */
3292         bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intmask),
3293                      DEF_RXINTMASK);
3294
3295         /* allow the MAC to control the PHY clock (dynamic on/off) */
3296         brcms_b_macphyclk_set(wlc_hw, ON);
3297
3298         /* program dynamic clock control fast powerup delay register */
3299         wlc->fastpwrup_dly = ai_clkctl_fast_pwrup_delay(wlc_hw->sih);
3300         bcma_write16(core, D11REGOFFS(scc_fastpwrup_dly), wlc->fastpwrup_dly);
3301
3302         /* tell the ucode the corerev */
3303         brcms_b_write_shm(wlc_hw, M_MACHW_VER, (u16) wlc_hw->corerev);
3304
3305         /* tell the ucode MAC capabilities */
3306         brcms_b_write_shm(wlc_hw, M_MACHW_CAP_L,
3307                            (u16) (wlc_hw->machwcap & 0xffff));
3308         brcms_b_write_shm(wlc_hw, M_MACHW_CAP_H,
3309                            (u16) ((wlc_hw->
3310                                       machwcap >> 16) & 0xffff));
3311
3312         /* write retry limits to SCR, this done after PSM init */
3313         bcma_write32(core, D11REGOFFS(objaddr),
3314                      OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3315         (void)bcma_read32(core, D11REGOFFS(objaddr));
3316         bcma_write32(core, D11REGOFFS(objdata), wlc_hw->SRL);
3317         bcma_write32(core, D11REGOFFS(objaddr),
3318                      OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3319         (void)bcma_read32(core, D11REGOFFS(objaddr));
3320         bcma_write32(core, D11REGOFFS(objdata), wlc_hw->LRL);
3321
3322         /* write rate fallback retry limits */
3323         brcms_b_write_shm(wlc_hw, M_SFRMTXCNTFBRTHSD, wlc_hw->SFBL);
3324         brcms_b_write_shm(wlc_hw, M_LFRMTXCNTFBRTHSD, wlc_hw->LFBL);
3325
3326         bcma_mask16(core, D11REGOFFS(ifs_ctl), 0x0FFF);
3327         bcma_write16(core, D11REGOFFS(ifs_aifsn), EDCF_AIFSN_MIN);
3328
3329         /* init the tx dma engines */
3330         for (i = 0; i < NFIFO; i++) {
3331                 if (wlc_hw->di[i])
3332                         dma_txinit(wlc_hw->di[i]);
3333         }
3334
3335         /* init the rx dma engine(s) and post receive buffers */
3336         dma_rxinit(wlc_hw->di[RX_FIFO]);
3337         dma_rxfill(wlc_hw->di[RX_FIFO]);
3338 }
3339
3340 void
3341 static brcms_b_init(struct brcms_hardware *wlc_hw, u16 chanspec) {
3342         u32 macintmask;
3343         bool fastclk;
3344         struct brcms_c_info *wlc = wlc_hw->wlc;
3345
3346         /* request FAST clock if not on */
3347         fastclk = wlc_hw->forcefastclk;
3348         if (!fastclk)
3349                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
3350
3351         /* disable interrupts */
3352         macintmask = brcms_intrsoff(wlc->wl);
3353
3354         /* set up the specified band and chanspec */
3355         brcms_c_setxband(wlc_hw, chspec_bandunit(chanspec));
3356         wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3357
3358         /* do one-time phy inits and calibration */
3359         wlc_phy_cal_init(wlc_hw->band->pi);
3360
3361         /* core-specific initialization */
3362         brcms_b_coreinit(wlc);
3363
3364         /* band-specific inits */
3365         brcms_b_bsinit(wlc, chanspec);
3366
3367         /* restore macintmask */
3368         brcms_intrsrestore(wlc->wl, macintmask);
3369
3370         /* seed wake_override with BRCMS_WAKE_OVERRIDE_MACSUSPEND since the mac
3371          * is suspended and brcms_c_enable_mac() will clear this override bit.
3372          */
3373         mboolset(wlc_hw->wake_override, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
3374
3375         /*
3376          * initialize mac_suspend_depth to 1 to match ucode
3377          * initial suspended state
3378          */
3379         wlc_hw->mac_suspend_depth = 1;
3380
3381         /* restore the clk */
3382         if (!fastclk)
3383                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
3384 }
3385
3386 static void brcms_c_set_phy_chanspec(struct brcms_c_info *wlc,
3387                                      u16 chanspec)
3388 {
3389         /* Save our copy of the chanspec */
3390         wlc->chanspec = chanspec;
3391
3392         /* Set the chanspec and power limits for this locale */
3393         brcms_c_channel_set_chanspec(wlc->cmi, chanspec, BRCMS_TXPWR_MAX);
3394
3395         if (wlc->stf->ss_algosel_auto)
3396                 brcms_c_stf_ss_algo_channel_get(wlc, &wlc->stf->ss_algo_channel,
3397                                             chanspec);
3398
3399         brcms_c_stf_ss_update(wlc, wlc->band);
3400 }
3401
3402 static void
3403 brcms_default_rateset(struct brcms_c_info *wlc, struct brcms_c_rateset *rs)
3404 {
3405         brcms_c_rateset_default(rs, NULL, wlc->band->phytype,
3406                 wlc->band->bandtype, false, BRCMS_RATE_MASK_FULL,
3407                 (bool) (wlc->pub->_n_enab & SUPPORT_11N),
3408                 brcms_chspec_bw(wlc->default_bss->chanspec),
3409                 wlc->stf->txstreams);
3410 }
3411
3412 /* derive wlc->band->basic_rate[] table from 'rateset' */
3413 static void brcms_c_rate_lookup_init(struct brcms_c_info *wlc,
3414                               struct brcms_c_rateset *rateset)
3415 {
3416         u8 rate;
3417         u8 mandatory;
3418         u8 cck_basic = 0;
3419         u8 ofdm_basic = 0;
3420         u8 *br = wlc->band->basic_rate;
3421         uint i;
3422
3423         /* incoming rates are in 500kbps units as in 802.11 Supported Rates */
3424         memset(br, 0, BRCM_MAXRATE + 1);
3425
3426         /* For each basic rate in the rates list, make an entry in the
3427          * best basic lookup.
3428          */
3429         for (i = 0; i < rateset->count; i++) {
3430                 /* only make an entry for a basic rate */
3431                 if (!(rateset->rates[i] & BRCMS_RATE_FLAG))
3432                         continue;
3433
3434                 /* mask off basic bit */
3435                 rate = (rateset->rates[i] & BRCMS_RATE_MASK);
3436
3437                 if (rate > BRCM_MAXRATE) {
3438                         brcms_err(wlc->hw->d11core, "brcms_c_rate_lookup_init: "
3439                                   "invalid rate 0x%X in rate set\n",
3440                                   rateset->rates[i]);
3441                         continue;
3442                 }
3443
3444                 br[rate] = rate;
3445         }
3446
3447         /* The rate lookup table now has non-zero entries for each
3448          * basic rate, equal to the basic rate: br[basicN] = basicN
3449          *
3450          * To look up the best basic rate corresponding to any
3451          * particular rate, code can use the basic_rate table
3452          * like this
3453          *
3454          * basic_rate = wlc->band->basic_rate[tx_rate]
3455          *
3456          * Make sure there is a best basic rate entry for
3457          * every rate by walking up the table from low rates
3458          * to high, filling in holes in the lookup table
3459          */
3460
3461         for (i = 0; i < wlc->band->hw_rateset.count; i++) {
3462                 rate = wlc->band->hw_rateset.rates[i];
3463
3464                 if (br[rate] != 0) {
3465                         /* This rate is a basic rate.
3466                          * Keep track of the best basic rate so far by
3467                          * modulation type.
3468                          */
3469                         if (is_ofdm_rate(rate))
3470                                 ofdm_basic = rate;
3471                         else
3472                                 cck_basic = rate;
3473
3474                         continue;
3475                 }
3476
3477                 /* This rate is not a basic rate so figure out the
3478                  * best basic rate less than this rate and fill in
3479                  * the hole in the table
3480                  */
3481
3482                 br[rate] = is_ofdm_rate(rate) ? ofdm_basic : cck_basic;
3483
3484                 if (br[rate] != 0)
3485                         continue;
3486
3487                 if (is_ofdm_rate(rate)) {
3488                         /*
3489                          * In 11g and 11a, the OFDM mandatory rates
3490                          * are 6, 12, and 24 Mbps
3491                          */
3492                         if (rate >= BRCM_RATE_24M)
3493                                 mandatory = BRCM_RATE_24M;
3494                         else if (rate >= BRCM_RATE_12M)
3495                                 mandatory = BRCM_RATE_12M;
3496                         else
3497                                 mandatory = BRCM_RATE_6M;
3498                 } else {
3499                         /* In 11b, all CCK rates are mandatory 1 - 11 Mbps */
3500                         mandatory = rate;
3501                 }
3502
3503                 br[rate] = mandatory;
3504         }
3505 }
3506
3507 static void brcms_c_bandinit_ordered(struct brcms_c_info *wlc,
3508                                      u16 chanspec)
3509 {
3510         struct brcms_c_rateset default_rateset;
3511         uint parkband;
3512         uint i, band_order[2];
3513
3514         /*
3515          * We might have been bandlocked during down and the chip
3516          * power-cycled (hibernate). Figure out the right band to park on
3517          */
3518         if (wlc->bandlocked || wlc->pub->_nbands == 1) {
3519                 /* updated in brcms_c_bandlock() */
3520                 parkband = wlc->band->bandunit;
3521                 band_order[0] = band_order[1] = parkband;
3522         } else {
3523                 /* park on the band of the specified chanspec */
3524                 parkband = chspec_bandunit(chanspec);
3525
3526                 /* order so that parkband initialize last */
3527                 band_order[0] = parkband ^ 1;
3528                 band_order[1] = parkband;
3529         }
3530
3531         /* make each band operational, software state init */
3532         for (i = 0; i < wlc->pub->_nbands; i++) {
3533                 uint j = band_order[i];
3534
3535                 wlc->band = wlc->bandstate[j];
3536
3537                 brcms_default_rateset(wlc, &default_rateset);
3538
3539                 /* fill in hw_rate */
3540                 brcms_c_rateset_filter(&default_rateset, &wlc->band->hw_rateset,
3541                                    false, BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
3542                                    (bool) (wlc->pub->_n_enab & SUPPORT_11N));
3543
3544                 /* init basic rate lookup */
3545                 brcms_c_rate_lookup_init(wlc, &default_rateset);
3546         }
3547
3548         /* sync up phy/radio chanspec */
3549         brcms_c_set_phy_chanspec(wlc, chanspec);
3550 }
3551
3552 /*
3553  * Set or clear filtering related maccontrol bits based on
3554  * specified filter flags
3555  */
3556 void brcms_c_mac_promisc(struct brcms_c_info *wlc, uint filter_flags)
3557 {
3558         u32 promisc_bits = 0;
3559
3560         wlc->filter_flags = filter_flags;
3561
3562         if (filter_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS))
3563                 promisc_bits |= MCTL_PROMISC;
3564
3565         if (filter_flags & FIF_BCN_PRBRESP_PROMISC)
3566                 promisc_bits |= MCTL_BCNS_PROMISC;
3567
3568         if (filter_flags & FIF_FCSFAIL)
3569                 promisc_bits |= MCTL_KEEPBADFCS;
3570
3571         if (filter_flags & (FIF_CONTROL | FIF_PSPOLL))
3572                 promisc_bits |= MCTL_KEEPCONTROL;
3573
3574         brcms_b_mctrl(wlc->hw,
3575                 MCTL_PROMISC | MCTL_BCNS_PROMISC |
3576                 MCTL_KEEPCONTROL | MCTL_KEEPBADFCS,
3577                 promisc_bits);
3578 }
3579
3580 /*
3581  * ucode, hwmac update
3582  *    Channel dependent updates for ucode and hw
3583  */
3584 static void brcms_c_ucode_mac_upd(struct brcms_c_info *wlc)
3585 {
3586         /* enable or disable any active IBSSs depending on whether or not
3587          * we are on the home channel
3588          */
3589         if (wlc->home_chanspec == wlc_phy_chanspec_get(wlc->band->pi)) {
3590                 if (wlc->pub->associated) {
3591                         /*
3592                          * BMAC_NOTE: This is something that should be fixed
3593                          * in ucode inits. I think that the ucode inits set
3594                          * up the bcn templates and shm values with a bogus
3595                          * beacon. This should not be done in the inits. If
3596                          * ucode needs to set up a beacon for testing, the
3597                          * test routines should write it down, not expect the
3598                          * inits to populate a bogus beacon.
3599                          */
3600                         if (BRCMS_PHY_11N_CAP(wlc->band))
3601                                 brcms_b_write_shm(wlc->hw,
3602                                                 M_BCN_TXTSF_OFFSET, 0);
3603                 }
3604         } else {
3605                 /* disable an active IBSS if we are not on the home channel */
3606         }
3607 }
3608
3609 static void brcms_c_write_rate_shm(struct brcms_c_info *wlc, u8 rate,
3610                                    u8 basic_rate)
3611 {
3612         u8 phy_rate, index;
3613         u8 basic_phy_rate, basic_index;
3614         u16 dir_table, basic_table;
3615         u16 basic_ptr;
3616
3617         /* Shared memory address for the table we are reading */
3618         dir_table = is_ofdm_rate(basic_rate) ? M_RT_DIRMAP_A : M_RT_DIRMAP_B;
3619
3620         /* Shared memory address for the table we are writing */
3621         basic_table = is_ofdm_rate(rate) ? M_RT_BBRSMAP_A : M_RT_BBRSMAP_B;
3622
3623         /*
3624          * for a given rate, the LS-nibble of the PLCP SIGNAL field is
3625          * the index into the rate table.
3626          */
3627         phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
3628         basic_phy_rate = rate_info[basic_rate] & BRCMS_RATE_MASK;
3629         index = phy_rate & 0xf;
3630         basic_index = basic_phy_rate & 0xf;
3631
3632         /* Find the SHM pointer to the ACK rate entry by looking in the
3633          * Direct-map Table
3634          */
3635         basic_ptr = brcms_b_read_shm(wlc->hw, (dir_table + basic_index * 2));
3636
3637         /* Update the SHM BSS-basic-rate-set mapping table with the pointer
3638          * to the correct basic rate for the given incoming rate
3639          */
3640         brcms_b_write_shm(wlc->hw, (basic_table + index * 2), basic_ptr);
3641 }
3642
3643 static const struct brcms_c_rateset *
3644 brcms_c_rateset_get_hwrs(struct brcms_c_info *wlc)
3645 {
3646         const struct brcms_c_rateset *rs_dflt;
3647
3648         if (BRCMS_PHY_11N_CAP(wlc->band)) {
3649                 if (wlc->band->bandtype == BRCM_BAND_5G)
3650                         rs_dflt = &ofdm_mimo_rates;
3651                 else
3652                         rs_dflt = &cck_ofdm_mimo_rates;
3653         } else if (wlc->band->gmode)
3654                 rs_dflt = &cck_ofdm_rates;
3655         else
3656                 rs_dflt = &cck_rates;
3657
3658         return rs_dflt;
3659 }
3660
3661 static void brcms_c_set_ratetable(struct brcms_c_info *wlc)
3662 {
3663         const struct brcms_c_rateset *rs_dflt;
3664         struct brcms_c_rateset rs;
3665         u8 rate, basic_rate;
3666         uint i;
3667
3668         rs_dflt = brcms_c_rateset_get_hwrs(wlc);
3669
3670         brcms_c_rateset_copy(rs_dflt, &rs);
3671         brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
3672
3673         /* walk the phy rate table and update SHM basic rate lookup table */
3674         for (i = 0; i < rs.count; i++) {
3675                 rate = rs.rates[i] & BRCMS_RATE_MASK;
3676
3677                 /* for a given rate brcms_basic_rate returns the rate at
3678                  * which a response ACK/CTS should be sent.
3679                  */
3680                 basic_rate = brcms_basic_rate(wlc, rate);
3681                 if (basic_rate == 0)
3682                         /* This should only happen if we are using a
3683                          * restricted rateset.
3684                          */
3685                         basic_rate = rs.rates[0] & BRCMS_RATE_MASK;
3686
3687                 brcms_c_write_rate_shm(wlc, rate, basic_rate);
3688         }
3689 }
3690
3691 /* band-specific init */
3692 static void brcms_c_bsinit(struct brcms_c_info *wlc)
3693 {
3694         brcms_dbg_info(wlc->hw->d11core, "wl%d: bandunit %d\n",
3695                        wlc->pub->unit, wlc->band->bandunit);
3696
3697         /* write ucode ACK/CTS rate table */
3698         brcms_c_set_ratetable(wlc);
3699
3700         /* update some band specific mac configuration */
3701         brcms_c_ucode_mac_upd(wlc);
3702
3703         /* init antenna selection */
3704         brcms_c_antsel_init(wlc->asi);
3705
3706 }
3707
3708 /* formula:  IDLE_BUSY_RATIO_X_16 = (100-duty_cycle)/duty_cycle*16 */
3709 static int
3710 brcms_c_duty_cycle_set(struct brcms_c_info *wlc, int duty_cycle, bool isOFDM,
3711                    bool writeToShm)
3712 {
3713         int idle_busy_ratio_x_16 = 0;
3714         uint offset =
3715             isOFDM ? M_TX_IDLE_BUSY_RATIO_X_16_OFDM :
3716             M_TX_IDLE_BUSY_RATIO_X_16_CCK;
3717         if (duty_cycle > 100 || duty_cycle < 0) {
3718                 brcms_err(wlc->hw->d11core,
3719                           "wl%d:  duty cycle value off limit\n",
3720                           wlc->pub->unit);
3721                 return -EINVAL;
3722         }
3723         if (duty_cycle)
3724                 idle_busy_ratio_x_16 = (100 - duty_cycle) * 16 / duty_cycle;
3725         /* Only write to shared memory  when wl is up */
3726         if (writeToShm)
3727                 brcms_b_write_shm(wlc->hw, offset, (u16) idle_busy_ratio_x_16);
3728
3729         if (isOFDM)
3730                 wlc->tx_duty_cycle_ofdm = (u16) duty_cycle;
3731         else
3732                 wlc->tx_duty_cycle_cck = (u16) duty_cycle;
3733
3734         return 0;
3735 }
3736
3737 /* push sw hps and wake state through hardware */
3738 static void brcms_c_set_ps_ctrl(struct brcms_c_info *wlc)
3739 {
3740         u32 v1, v2;
3741         bool hps;
3742         bool awake_before;
3743
3744         hps = brcms_c_ps_allowed(wlc);
3745
3746         brcms_dbg_mac80211(wlc->hw->d11core, "wl%d: hps %d\n", wlc->pub->unit,
3747                            hps);
3748
3749         v1 = bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
3750         v2 = MCTL_WAKE;
3751         if (hps)
3752                 v2 |= MCTL_HPS;
3753
3754         brcms_b_mctrl(wlc->hw, MCTL_WAKE | MCTL_HPS, v2);
3755
3756         awake_before = ((v1 & MCTL_WAKE) || ((v1 & MCTL_HPS) == 0));
3757
3758         if (!awake_before)
3759                 brcms_b_wait_for_wake(wlc->hw);
3760 }
3761
3762 /*
3763  * Write this BSS config's MAC address to core.
3764  * Updates RXE match engine.
3765  */
3766 static int brcms_c_set_mac(struct brcms_bss_cfg *bsscfg)
3767 {
3768         int err = 0;
3769         struct brcms_c_info *wlc = bsscfg->wlc;
3770
3771         /* enter the MAC addr into the RXE match registers */
3772         brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, wlc->pub->cur_etheraddr);
3773
3774         brcms_c_ampdu_macaddr_upd(wlc);
3775
3776         return err;
3777 }
3778
3779 /* Write the BSS config's BSSID address to core (set_bssid in d11procs.tcl).
3780  * Updates RXE match engine.
3781  */
3782 static void brcms_c_set_bssid(struct brcms_bss_cfg *bsscfg)
3783 {
3784         /* we need to update BSSID in RXE match registers */
3785         brcms_c_set_addrmatch(bsscfg->wlc, RCM_BSSID_OFFSET, bsscfg->BSSID);
3786 }
3787
3788 void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid, size_t ssid_len)
3789 {
3790         u8 len = min_t(u8, sizeof(wlc->bsscfg->SSID), ssid_len);
3791         memset(wlc->bsscfg->SSID, 0, sizeof(wlc->bsscfg->SSID));
3792
3793         memcpy(wlc->bsscfg->SSID, ssid, len);
3794         wlc->bsscfg->SSID_len = len;
3795 }
3796
3797 static void brcms_b_set_shortslot(struct brcms_hardware *wlc_hw, bool shortslot)
3798 {
3799         wlc_hw->shortslot = shortslot;
3800
3801         if (wlc_hw->band->bandtype == BRCM_BAND_2G && wlc_hw->up) {
3802                 brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
3803                 brcms_b_update_slot_timing(wlc_hw, shortslot);
3804                 brcms_c_enable_mac(wlc_hw->wlc);
3805         }
3806 }
3807
3808 /*
3809  * Suspend the the MAC and update the slot timing
3810  * for standard 11b/g (20us slots) or shortslot 11g (9us slots).
3811  */
3812 static void brcms_c_switch_shortslot(struct brcms_c_info *wlc, bool shortslot)
3813 {
3814         /* use the override if it is set */
3815         if (wlc->shortslot_override != BRCMS_SHORTSLOT_AUTO)
3816                 shortslot = (wlc->shortslot_override == BRCMS_SHORTSLOT_ON);
3817
3818         if (wlc->shortslot == shortslot)
3819                 return;
3820
3821         wlc->shortslot = shortslot;
3822
3823         brcms_b_set_shortslot(wlc->hw, shortslot);
3824 }
3825
3826 static void brcms_c_set_home_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3827 {
3828         if (wlc->home_chanspec != chanspec) {
3829                 wlc->home_chanspec = chanspec;
3830
3831                 if (wlc->pub->associated)
3832                         wlc->bsscfg->current_bss->chanspec = chanspec;
3833         }
3834 }
3835
3836 void
3837 brcms_b_set_chanspec(struct brcms_hardware *wlc_hw, u16 chanspec,
3838                       bool mute_tx, struct txpwr_limits *txpwr)
3839 {
3840         uint bandunit;
3841
3842         brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: 0x%x\n", wlc_hw->unit,
3843                            chanspec);
3844
3845         wlc_hw->chanspec = chanspec;
3846
3847         /* Switch bands if necessary */
3848         if (wlc_hw->_nbands > 1) {
3849                 bandunit = chspec_bandunit(chanspec);
3850                 if (wlc_hw->band->bandunit != bandunit) {
3851                         /* brcms_b_setband disables other bandunit,
3852                          *  use light band switch if not up yet
3853                          */
3854                         if (wlc_hw->up) {
3855                                 wlc_phy_chanspec_radio_set(wlc_hw->
3856                                                            bandstate[bandunit]->
3857                                                            pi, chanspec);
3858                                 brcms_b_setband(wlc_hw, bandunit, chanspec);
3859                         } else {
3860                                 brcms_c_setxband(wlc_hw, bandunit);
3861                         }
3862                 }
3863         }
3864
3865         wlc_phy_initcal_enable(wlc_hw->band->pi, !mute_tx);
3866
3867         if (!wlc_hw->up) {
3868                 if (wlc_hw->clk)
3869                         wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr,
3870                                                   chanspec);
3871                 wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3872         } else {
3873                 wlc_phy_chanspec_set(wlc_hw->band->pi, chanspec);
3874                 wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr, chanspec);
3875
3876                 /* Update muting of the channel */
3877                 brcms_b_mute(wlc_hw, mute_tx);
3878         }
3879 }
3880
3881 /* switch to and initialize new band */
3882 static void brcms_c_setband(struct brcms_c_info *wlc,
3883                                            uint bandunit)
3884 {
3885         wlc->band = wlc->bandstate[bandunit];
3886
3887         if (!wlc->pub->up)
3888                 return;
3889
3890         /* wait for at least one beacon before entering sleeping state */
3891         brcms_c_set_ps_ctrl(wlc);
3892
3893         /* band-specific initializations */
3894         brcms_c_bsinit(wlc);
3895 }
3896
3897 static void brcms_c_set_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3898 {
3899         uint bandunit;
3900         bool switchband = false;
3901         u16 old_chanspec = wlc->chanspec;
3902
3903         if (!brcms_c_valid_chanspec_db(wlc->cmi, chanspec)) {
3904                 brcms_err(wlc->hw->d11core, "wl%d: %s: Bad channel %d\n",
3905                           wlc->pub->unit, __func__, CHSPEC_CHANNEL(chanspec));
3906                 return;
3907         }
3908
3909         /* Switch bands if necessary */
3910         if (wlc->pub->_nbands > 1) {
3911                 bandunit = chspec_bandunit(chanspec);
3912                 if (wlc->band->bandunit != bandunit || wlc->bandinit_pending) {
3913                         switchband = true;
3914                         if (wlc->bandlocked) {
3915                                 brcms_err(wlc->hw->d11core,
3916                                           "wl%d: %s: chspec %d band is locked!\n",
3917                                           wlc->pub->unit, __func__,
3918                                           CHSPEC_CHANNEL(chanspec));
3919                                 return;
3920                         }
3921                         /*
3922                          * should the setband call come after the
3923                          * brcms_b_chanspec() ? if the setband updates
3924                          * (brcms_c_bsinit) use low level calls to inspect and
3925                          * set state, the state inspected may be from the wrong
3926                          * band, or the following brcms_b_set_chanspec() may
3927                          * undo the work.
3928                          */
3929                         brcms_c_setband(wlc, bandunit);
3930                 }
3931         }
3932
3933         /* sync up phy/radio chanspec */
3934         brcms_c_set_phy_chanspec(wlc, chanspec);
3935
3936         /* init antenna selection */
3937         if (brcms_chspec_bw(old_chanspec) != brcms_chspec_bw(chanspec)) {
3938                 brcms_c_antsel_init(wlc->asi);
3939
3940                 /* Fix the hardware rateset based on bw.
3941                  * Mainly add MCS32 for 40Mhz, remove MCS 32 for 20Mhz
3942                  */
3943                 brcms_c_rateset_bw_mcs_filter(&wlc->band->hw_rateset,
3944                         wlc->band->mimo_cap_40 ? brcms_chspec_bw(chanspec) : 0);
3945         }
3946
3947         /* update some mac configuration since chanspec changed */
3948         brcms_c_ucode_mac_upd(wlc);
3949 }
3950
3951 /*
3952  * This function changes the phytxctl for beacon based on current
3953  * beacon ratespec AND txant setting as per this table:
3954  *  ratespec     CCK            ant = wlc->stf->txant
3955  *              OFDM            ant = 3
3956  */
3957 void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc,
3958                                        u32 bcn_rspec)
3959 {
3960         u16 phyctl;
3961         u16 phytxant = wlc->stf->phytxant;
3962         u16 mask = PHY_TXC_ANT_MASK;
3963
3964         /* for non-siso rates or default setting, use the available chains */
3965         if (BRCMS_PHY_11N_CAP(wlc->band))
3966                 phytxant = brcms_c_stf_phytxchain_sel(wlc, bcn_rspec);
3967
3968         phyctl = brcms_b_read_shm(wlc->hw, M_BCN_PCTLWD);
3969         phyctl = (phyctl & ~mask) | phytxant;
3970         brcms_b_write_shm(wlc->hw, M_BCN_PCTLWD, phyctl);
3971 }
3972
3973 /*
3974  * centralized protection config change function to simplify debugging, no
3975  * consistency checking this should be called only on changes to avoid overhead
3976  * in periodic function
3977  */
3978 void brcms_c_protection_upd(struct brcms_c_info *wlc, uint idx, int val)
3979 {
3980         /*
3981          * Cannot use brcms_dbg_* here because this function is called
3982          * before wlc is sufficiently initialized.
3983          */
3984         BCMMSG(wlc->wiphy, "idx %d, val %d\n", idx, val);
3985
3986         switch (idx) {
3987         case BRCMS_PROT_G_SPEC:
3988                 wlc->protection->_g = (bool) val;
3989                 break;
3990         case BRCMS_PROT_G_OVR:
3991                 wlc->protection->g_override = (s8) val;
3992                 break;
3993         case BRCMS_PROT_G_USER:
3994                 wlc->protection->gmode_user = (u8) val;
3995                 break;
3996         case BRCMS_PROT_OVERLAP:
3997                 wlc->protection->overlap = (s8) val;
3998                 break;
3999         case BRCMS_PROT_N_USER:
4000                 wlc->protection->nmode_user = (s8) val;
4001                 break;
4002         case BRCMS_PROT_N_CFG:
4003                 wlc->protection->n_cfg = (s8) val;
4004                 break;
4005         case BRCMS_PROT_N_CFG_OVR:
4006                 wlc->protection->n_cfg_override = (s8) val;
4007                 break;
4008         case BRCMS_PROT_N_NONGF:
4009                 wlc->protection->nongf = (bool) val;
4010                 break;
4011         case BRCMS_PROT_N_NONGF_OVR:
4012                 wlc->protection->nongf_override = (s8) val;
4013                 break;
4014         case BRCMS_PROT_N_PAM_OVR:
4015                 wlc->protection->n_pam_override = (s8) val;
4016                 break;
4017         case BRCMS_PROT_N_OBSS:
4018                 wlc->protection->n_obss = (bool) val;
4019                 break;
4020
4021         default:
4022                 break;
4023         }
4024
4025 }
4026
4027 static void brcms_c_ht_update_sgi_rx(struct brcms_c_info *wlc, int val)
4028 {
4029         if (wlc->pub->up) {
4030                 brcms_c_update_beacon(wlc);
4031                 brcms_c_update_probe_resp(wlc, true);
4032         }
4033 }
4034
4035 static void brcms_c_ht_update_ldpc(struct brcms_c_info *wlc, s8 val)
4036 {
4037         wlc->stf->ldpc = val;
4038
4039         if (wlc->pub->up) {
4040                 brcms_c_update_beacon(wlc);
4041                 brcms_c_update_probe_resp(wlc, true);
4042                 wlc_phy_ldpc_override_set(wlc->band->pi, (val ? true : false));
4043         }
4044 }
4045
4046 void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
4047                        const struct ieee80211_tx_queue_params *params,
4048                        bool suspend)
4049 {
4050         int i;
4051         struct shm_acparams acp_shm;
4052         u16 *shm_entry;
4053
4054         /* Only apply params if the core is out of reset and has clocks */
4055         if (!wlc->clk) {
4056                 brcms_err(wlc->hw->d11core, "wl%d: %s : no-clock\n",
4057                           wlc->pub->unit, __func__);
4058                 return;
4059         }
4060
4061         memset(&acp_shm, 0, sizeof(struct shm_acparams));
4062         /* fill in shm ac params struct */
4063         acp_shm.txop = params->txop;
4064         /* convert from units of 32us to us for ucode */
4065         wlc->edcf_txop[aci & 0x3] = acp_shm.txop =
4066             EDCF_TXOP2USEC(acp_shm.txop);
4067         acp_shm.aifs = (params->aifs & EDCF_AIFSN_MASK);
4068
4069         if (aci == IEEE80211_AC_VI && acp_shm.txop == 0
4070             && acp_shm.aifs < EDCF_AIFSN_MAX)
4071                 acp_shm.aifs++;
4072
4073         if (acp_shm.aifs < EDCF_AIFSN_MIN
4074             || acp_shm.aifs > EDCF_AIFSN_MAX) {
4075                 brcms_err(wlc->hw->d11core, "wl%d: edcf_setparams: bad "
4076                           "aifs %d\n", wlc->pub->unit, acp_shm.aifs);
4077         } else {
4078                 acp_shm.cwmin = params->cw_min;
4079                 acp_shm.cwmax = params->cw_max;
4080                 acp_shm.cwcur = acp_shm.cwmin;
4081                 acp_shm.bslots =
4082                         bcma_read16(wlc->hw->d11core, D11REGOFFS(tsf_random)) &
4083                         acp_shm.cwcur;
4084                 acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
4085                 /* Indicate the new params to the ucode */
4086                 acp_shm.status = brcms_b_read_shm(wlc->hw, (M_EDCF_QINFO +
4087                                                   wme_ac2fifo[aci] *
4088                                                   M_EDCF_QLEN +
4089                                                   M_EDCF_STATUS_OFF));
4090                 acp_shm.status |= WME_STATUS_NEWAC;
4091
4092                 /* Fill in shm acparam table */
4093                 shm_entry = (u16 *) &acp_shm;
4094                 for (i = 0; i < (int)sizeof(struct shm_acparams); i += 2)
4095                         brcms_b_write_shm(wlc->hw,
4096                                           M_EDCF_QINFO +
4097                                           wme_ac2fifo[aci] * M_EDCF_QLEN + i,
4098                                           *shm_entry++);
4099         }
4100
4101         if (suspend)
4102                 brcms_c_suspend_mac_and_wait(wlc);
4103
4104         brcms_c_update_beacon(wlc);
4105         brcms_c_update_probe_resp(wlc, false);
4106
4107         if (suspend)
4108                 brcms_c_enable_mac(wlc);
4109 }
4110
4111 static void brcms_c_edcf_setparams(struct brcms_c_info *wlc, bool suspend)
4112 {
4113         u16 aci;
4114         int i_ac;
4115         struct ieee80211_tx_queue_params txq_pars;
4116         static const struct edcf_acparam default_edcf_acparams[] = {
4117                  {EDCF_AC_BE_ACI_STA, EDCF_AC_BE_ECW_STA, EDCF_AC_BE_TXOP_STA},
4118                  {EDCF_AC_BK_ACI_STA, EDCF_AC_BK_ECW_STA, EDCF_AC_BK_TXOP_STA},
4119                  {EDCF_AC_VI_ACI_STA, EDCF_AC_VI_ECW_STA, EDCF_AC_VI_TXOP_STA},
4120                  {EDCF_AC_VO_ACI_STA, EDCF_AC_VO_ECW_STA, EDCF_AC_VO_TXOP_STA}
4121         }; /* ucode needs these parameters during its initialization */
4122         const struct edcf_acparam *edcf_acp = &default_edcf_acparams[0];
4123
4124         for (i_ac = 0; i_ac < IEEE80211_NUM_ACS; i_ac++, edcf_acp++) {
4125                 /* find out which ac this set of params applies to */
4126                 aci = (edcf_acp->ACI & EDCF_ACI_MASK) >> EDCF_ACI_SHIFT;
4127
4128                 /* fill in shm ac params struct */
4129                 txq_pars.txop = edcf_acp->TXOP;
4130                 txq_pars.aifs = edcf_acp->ACI;
4131
4132                 /* CWmin = 2^(ECWmin) - 1 */
4133                 txq_pars.cw_min = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
4134                 /* CWmax = 2^(ECWmax) - 1 */
4135                 txq_pars.cw_max = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
4136                                             >> EDCF_ECWMAX_SHIFT);
4137                 brcms_c_wme_setparams(wlc, aci, &txq_pars, suspend);
4138         }
4139
4140         if (suspend) {
4141                 brcms_c_suspend_mac_and_wait(wlc);
4142                 brcms_c_enable_mac(wlc);
4143         }
4144 }
4145
4146 static void brcms_c_radio_monitor_start(struct brcms_c_info *wlc)
4147 {
4148         /* Don't start the timer if HWRADIO feature is disabled */
4149         if (wlc->radio_monitor)
4150                 return;
4151
4152         wlc->radio_monitor = true;
4153         brcms_b_pllreq(wlc->hw, true, BRCMS_PLLREQ_RADIO_MON);
4154         brcms_add_timer(wlc->radio_timer, TIMER_INTERVAL_RADIOCHK, true);
4155 }
4156
4157 static bool brcms_c_radio_monitor_stop(struct brcms_c_info *wlc)
4158 {
4159         if (!wlc->radio_monitor)
4160                 return true;
4161
4162         wlc->radio_monitor = false;
4163         brcms_b_pllreq(wlc->hw, false, BRCMS_PLLREQ_RADIO_MON);
4164         return brcms_del_timer(wlc->radio_timer);
4165 }
4166
4167 /* read hwdisable state and propagate to wlc flag */
4168 static void brcms_c_radio_hwdisable_upd(struct brcms_c_info *wlc)
4169 {
4170         if (wlc->pub->hw_off)
4171                 return;
4172
4173         if (brcms_b_radio_read_hwdisabled(wlc->hw))
4174                 mboolset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4175         else
4176                 mboolclr(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4177 }
4178
4179 /* update hwradio status and return it */
4180 bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc)
4181 {
4182         brcms_c_radio_hwdisable_upd(wlc);
4183
4184         return mboolisset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE) ?
4185                         true : false;
4186 }
4187
4188 /* periodical query hw radio button while driver is "down" */
4189 static void brcms_c_radio_timer(void *arg)
4190 {
4191         struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4192
4193         if (brcms_deviceremoved(wlc)) {
4194                 brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4195                           wlc->pub->unit, __func__);
4196                 brcms_down(wlc->wl);
4197                 return;
4198         }
4199
4200         brcms_c_radio_hwdisable_upd(wlc);
4201 }
4202
4203 /* common low-level watchdog code */
4204 static void brcms_b_watchdog(struct brcms_c_info *wlc)
4205 {
4206         struct brcms_hardware *wlc_hw = wlc->hw;
4207
4208         if (!wlc_hw->up)
4209                 return;
4210
4211         /* increment second count */
4212         wlc_hw->now++;
4213
4214         /* Check for FIFO error interrupts */
4215         brcms_b_fifoerrors(wlc_hw);
4216
4217         /* make sure RX dma has buffers */
4218         dma_rxfill(wlc->hw->di[RX_FIFO]);
4219
4220         wlc_phy_watchdog(wlc_hw->band->pi);
4221 }
4222
4223 /* common watchdog code */
4224 static void brcms_c_watchdog(struct brcms_c_info *wlc)
4225 {
4226         brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
4227
4228         if (!wlc->pub->up)
4229                 return;
4230
4231         if (brcms_deviceremoved(wlc)) {
4232                 brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4233                           wlc->pub->unit, __func__);
4234                 brcms_down(wlc->wl);
4235                 return;
4236         }
4237
4238         /* increment second count */
4239         wlc->pub->now++;
4240
4241         brcms_c_radio_hwdisable_upd(wlc);
4242         /* if radio is disable, driver may be down, quit here */
4243         if (wlc->pub->radio_disabled)
4244                 return;
4245
4246         brcms_b_watchdog(wlc);
4247
4248         /*
4249          * occasionally sample mac stat counters to
4250          * detect 16-bit counter wrap
4251          */
4252         if ((wlc->pub->now % SW_TIMER_MAC_STAT_UPD) == 0)
4253                 brcms_c_statsupd(wlc);
4254
4255         if (BRCMS_ISNPHY(wlc->band) &&
4256             ((wlc->pub->now - wlc->tempsense_lasttime) >=
4257              BRCMS_TEMPSENSE_PERIOD)) {
4258                 wlc->tempsense_lasttime = wlc->pub->now;
4259                 brcms_c_tempsense_upd(wlc);
4260         }
4261 }
4262
4263 static void brcms_c_watchdog_by_timer(void *arg)
4264 {
4265         struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4266
4267         brcms_c_watchdog(wlc);
4268 }
4269
4270 static bool brcms_c_timers_init(struct brcms_c_info *wlc, int unit)
4271 {
4272         wlc->wdtimer = brcms_init_timer(wlc->wl, brcms_c_watchdog_by_timer,
4273                 wlc, "watchdog");
4274         if (!wlc->wdtimer) {
4275                 wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for wdtimer "
4276                           "failed\n", unit);
4277                 goto fail;
4278         }
4279
4280         wlc->radio_timer = brcms_init_timer(wlc->wl, brcms_c_radio_timer,
4281                 wlc, "radio");
4282         if (!wlc->radio_timer) {
4283                 wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for radio_timer "
4284                           "failed\n", unit);
4285                 goto fail;
4286         }
4287
4288         return true;
4289
4290  fail:
4291         return false;
4292 }
4293
4294 /*
4295  * Initialize brcms_c_info default values ...
4296  * may get overrides later in this function
4297  */
4298 static void brcms_c_info_init(struct brcms_c_info *wlc, int unit)
4299 {
4300         int i;
4301
4302         /* Save our copy of the chanspec */
4303         wlc->chanspec = ch20mhz_chspec(1);
4304
4305         /* various 802.11g modes */
4306         wlc->shortslot = false;
4307         wlc->shortslot_override = BRCMS_SHORTSLOT_AUTO;
4308
4309         brcms_c_protection_upd(wlc, BRCMS_PROT_G_OVR, BRCMS_PROTECTION_AUTO);
4310         brcms_c_protection_upd(wlc, BRCMS_PROT_G_SPEC, false);
4311
4312         brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG_OVR,
4313                                BRCMS_PROTECTION_AUTO);
4314         brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG, BRCMS_N_PROTECTION_OFF);
4315         brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF_OVR,
4316                                BRCMS_PROTECTION_AUTO);
4317         brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF, false);
4318         brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, AUTO);
4319
4320         brcms_c_protection_upd(wlc, BRCMS_PROT_OVERLAP,
4321                                BRCMS_PROTECTION_CTL_OVERLAP);
4322
4323         /* 802.11g draft 4.0 NonERP elt advertisement */
4324         wlc->include_legacy_erp = true;
4325
4326         wlc->stf->ant_rx_ovr = ANT_RX_DIV_DEF;
4327         wlc->stf->txant = ANT_TX_DEF;
4328
4329         wlc->prb_resp_timeout = BRCMS_PRB_RESP_TIMEOUT;
4330
4331         wlc->usr_fragthresh = DOT11_DEFAULT_FRAG_LEN;
4332         for (i = 0; i < NFIFO; i++)
4333                 wlc->fragthresh[i] = DOT11_DEFAULT_FRAG_LEN;
4334         wlc->RTSThresh = DOT11_DEFAULT_RTS_LEN;
4335
4336         /* default rate fallback retry limits */
4337         wlc->SFBL = RETRY_SHORT_FB;
4338         wlc->LFBL = RETRY_LONG_FB;
4339
4340         /* default mac retry limits */
4341         wlc->SRL = RETRY_SHORT_DEF;
4342         wlc->LRL = RETRY_LONG_DEF;
4343
4344         /* WME QoS mode is Auto by default */
4345         wlc->pub->_ampdu = AMPDU_AGG_HOST;
4346 }
4347
4348 static uint brcms_c_attach_module(struct brcms_c_info *wlc)
4349 {
4350         uint err = 0;
4351         uint unit;
4352         unit = wlc->pub->unit;
4353
4354         wlc->asi = brcms_c_antsel_attach(wlc);
4355         if (wlc->asi == NULL) {
4356                 wiphy_err(wlc->wiphy, "wl%d: attach: antsel_attach "
4357                           "failed\n", unit);
4358                 err = 44;
4359                 goto fail;
4360         }
4361
4362         wlc->ampdu = brcms_c_ampdu_attach(wlc);
4363         if (wlc->ampdu == NULL) {
4364                 wiphy_err(wlc->wiphy, "wl%d: attach: ampdu_attach "
4365                           "failed\n", unit);
4366                 err = 50;
4367                 goto fail;
4368         }
4369
4370         if ((brcms_c_stf_attach(wlc) != 0)) {
4371                 wiphy_err(wlc->wiphy, "wl%d: attach: stf_attach "
4372                           "failed\n", unit);
4373                 err = 68;
4374                 goto fail;
4375         }
4376  fail:
4377         return err;
4378 }
4379
4380 struct brcms_pub *brcms_c_pub(struct brcms_c_info *wlc)
4381 {
4382         return wlc->pub;
4383 }
4384
4385 /* low level attach
4386  *    run backplane attach, init nvram
4387  *    run phy attach
4388  *    initialize software state for each core and band
4389  *    put the whole chip in reset(driver down state), no clock
4390  */
4391 static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
4392                           uint unit, bool piomode)
4393 {
4394         struct brcms_hardware *wlc_hw;
4395         uint err = 0;
4396         uint j;
4397         bool wme = false;
4398         struct shared_phy_params sha_params;
4399         struct wiphy *wiphy = wlc->wiphy;
4400         struct pci_dev *pcidev = core->bus->host_pci;
4401         struct ssb_sprom *sprom = &core->bus->sprom;
4402
4403         if (core->bus->hosttype == BCMA_HOSTTYPE_PCI)
4404                 brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4405                                pcidev->vendor,
4406                                pcidev->device);
4407         else
4408                 brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4409                                core->bus->boardinfo.vendor,
4410                                core->bus->boardinfo.type);
4411
4412         wme = true;
4413
4414         wlc_hw = wlc->hw;
4415         wlc_hw->wlc = wlc;
4416         wlc_hw->unit = unit;
4417         wlc_hw->band = wlc_hw->bandstate[0];
4418         wlc_hw->_piomode = piomode;
4419
4420         /* populate struct brcms_hardware with default values  */
4421         brcms_b_info_init(wlc_hw);
4422
4423         /*
4424          * Do the hardware portion of the attach. Also initialize software
4425          * state that depends on the particular hardware we are running.
4426          */
4427         wlc_hw->sih = ai_attach(core->bus);
4428         if (wlc_hw->sih == NULL) {
4429                 wiphy_err(wiphy, "wl%d: brcms_b_attach: si_attach failed\n",
4430                           unit);
4431                 err = 11;
4432                 goto fail;
4433         }
4434
4435         /* verify again the device is supported */
4436         if (!brcms_c_chipmatch(core)) {
4437                 wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported device\n",
4438                          unit);
4439                 err = 12;
4440                 goto fail;
4441         }
4442
4443         if (core->bus->hosttype == BCMA_HOSTTYPE_PCI) {
4444                 wlc_hw->vendorid = pcidev->vendor;
4445                 wlc_hw->deviceid = pcidev->device;
4446         } else {
4447                 wlc_hw->vendorid = core->bus->boardinfo.vendor;
4448                 wlc_hw->deviceid = core->bus->boardinfo.type;
4449         }
4450
4451         wlc_hw->d11core = core;
4452         wlc_hw->corerev = core->id.rev;
4453
4454         /* validate chip, chiprev and corerev */
4455         if (!brcms_c_isgoodchip(wlc_hw)) {
4456                 err = 13;
4457                 goto fail;
4458         }
4459
4460         /* initialize power control registers */
4461         ai_clkctl_init(wlc_hw->sih);
4462
4463         /* request fastclock and force fastclock for the rest of attach
4464          * bring the d11 core out of reset.
4465          *   For PMU chips, the first wlc_clkctl_clk is no-op since core-clk
4466          *   is still false; But it will be called again inside wlc_corereset,
4467          *   after d11 is out of reset.
4468          */
4469         brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4470         brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4471
4472         if (!brcms_b_validate_chip_access(wlc_hw)) {
4473                 wiphy_err(wiphy, "wl%d: brcms_b_attach: validate_chip_access "
4474                         "failed\n", unit);
4475                 err = 14;
4476                 goto fail;
4477         }
4478
4479         /* get the board rev, used just below */
4480         j = sprom->board_rev;
4481         /* promote srom boardrev of 0xFF to 1 */
4482         if (j == BOARDREV_PROMOTABLE)
4483                 j = BOARDREV_PROMOTED;
4484         wlc_hw->boardrev = (u16) j;
4485         if (!brcms_c_validboardtype(wlc_hw)) {
4486                 wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported Broadcom "
4487                           "board type (0x%x)" " or revision level (0x%x)\n",
4488                           unit, ai_get_boardtype(wlc_hw->sih),
4489                           wlc_hw->boardrev);
4490                 err = 15;
4491                 goto fail;
4492         }
4493         wlc_hw->sromrev = sprom->revision;
4494         wlc_hw->boardflags = sprom->boardflags_lo + (sprom->boardflags_hi << 16);
4495         wlc_hw->boardflags2 = sprom->boardflags2_lo + (sprom->boardflags2_hi << 16);
4496
4497         if (wlc_hw->boardflags & BFL_NOPLLDOWN)
4498                 brcms_b_pllreq(wlc_hw, true, BRCMS_PLLREQ_SHARED);
4499
4500         /* check device id(srom, nvram etc.) to set bands */
4501         if (wlc_hw->deviceid == BCM43224_D11N_ID ||
4502             wlc_hw->deviceid == BCM43224_D11N_ID_VEN1 ||
4503             wlc_hw->deviceid == BCM43224_CHIP_ID)
4504                 /* Dualband boards */
4505                 wlc_hw->_nbands = 2;
4506         else
4507                 wlc_hw->_nbands = 1;
4508
4509         if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225))
4510                 wlc_hw->_nbands = 1;
4511
4512         /* BMAC_NOTE: remove init of pub values when brcms_c_attach()
4513          * unconditionally does the init of these values
4514          */
4515         wlc->vendorid = wlc_hw->vendorid;
4516         wlc->deviceid = wlc_hw->deviceid;
4517         wlc->pub->sih = wlc_hw->sih;
4518         wlc->pub->corerev = wlc_hw->corerev;
4519         wlc->pub->sromrev = wlc_hw->sromrev;
4520         wlc->pub->boardrev = wlc_hw->boardrev;
4521         wlc->pub->boardflags = wlc_hw->boardflags;
4522         wlc->pub->boardflags2 = wlc_hw->boardflags2;
4523         wlc->pub->_nbands = wlc_hw->_nbands;
4524
4525         wlc_hw->physhim = wlc_phy_shim_attach(wlc_hw, wlc->wl, wlc);
4526
4527         if (wlc_hw->physhim == NULL) {
4528                 wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_shim_attach "
4529                         "failed\n", unit);
4530                 err = 25;
4531                 goto fail;
4532         }
4533
4534         /* pass all the parameters to wlc_phy_shared_attach in one struct */
4535         sha_params.sih = wlc_hw->sih;
4536         sha_params.physhim = wlc_hw->physhim;
4537         sha_params.unit = unit;
4538         sha_params.corerev = wlc_hw->corerev;
4539         sha_params.vid = wlc_hw->vendorid;
4540         sha_params.did = wlc_hw->deviceid;
4541         sha_params.chip = ai_get_chip_id(wlc_hw->sih);
4542         sha_params.chiprev = ai_get_chiprev(wlc_hw->sih);
4543         sha_params.chippkg = ai_get_chippkg(wlc_hw->sih);
4544         sha_params.sromrev = wlc_hw->sromrev;
4545         sha_params.boardtype = ai_get_boardtype(wlc_hw->sih);
4546         sha_params.boardrev = wlc_hw->boardrev;
4547         sha_params.boardflags = wlc_hw->boardflags;
4548         sha_params.boardflags2 = wlc_hw->boardflags2;
4549
4550         /* alloc and save pointer to shared phy state area */
4551         wlc_hw->phy_sh = wlc_phy_shared_attach(&sha_params);
4552         if (!wlc_hw->phy_sh) {
4553                 err = 16;
4554                 goto fail;
4555         }
4556
4557         /* initialize software state for each core and band */
4558         for (j = 0; j < wlc_hw->_nbands; j++) {
4559                 /*
4560                  * band0 is always 2.4Ghz
4561                  * band1, if present, is 5Ghz
4562                  */
4563
4564                 brcms_c_setxband(wlc_hw, j);
4565
4566                 wlc_hw->band->bandunit = j;
4567                 wlc_hw->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4568                 wlc->band->bandunit = j;
4569                 wlc->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4570                 wlc->core->coreidx = core->core_index;
4571
4572                 wlc_hw->machwcap = bcma_read32(core, D11REGOFFS(machwcap));
4573                 wlc_hw->machwcap_backup = wlc_hw->machwcap;
4574
4575                 /* init tx fifo size */
4576                 WARN_ON((wlc_hw->corerev - XMTFIFOTBL_STARTREV) < 0 ||
4577                         (wlc_hw->corerev - XMTFIFOTBL_STARTREV) >
4578                                 ARRAY_SIZE(xmtfifo_sz));
4579                 wlc_hw->xmtfifo_sz =
4580                     xmtfifo_sz[(wlc_hw->corerev - XMTFIFOTBL_STARTREV)];
4581                 WARN_ON(!wlc_hw->xmtfifo_sz[0]);
4582
4583                 /* Get a phy for this band */
4584                 wlc_hw->band->pi =
4585                         wlc_phy_attach(wlc_hw->phy_sh, core,
4586                                        wlc_hw->band->bandtype,
4587                                        wlc->wiphy);
4588                 if (wlc_hw->band->pi == NULL) {
4589                         wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_"
4590                                   "attach failed\n", unit);
4591                         err = 17;
4592                         goto fail;
4593                 }
4594
4595                 wlc_phy_machwcap_set(wlc_hw->band->pi, wlc_hw->machwcap);
4596
4597                 wlc_phy_get_phyversion(wlc_hw->band->pi, &wlc_hw->band->phytype,
4598                                        &wlc_hw->band->phyrev,
4599                                        &wlc_hw->band->radioid,
4600                                        &wlc_hw->band->radiorev);
4601                 wlc_hw->band->abgphy_encore =
4602                     wlc_phy_get_encore(wlc_hw->band->pi);
4603                 wlc->band->abgphy_encore = wlc_phy_get_encore(wlc_hw->band->pi);
4604                 wlc_hw->band->core_flags =
4605                     wlc_phy_get_coreflags(wlc_hw->band->pi);
4606
4607                 /* verify good phy_type & supported phy revision */
4608                 if (BRCMS_ISNPHY(wlc_hw->band)) {
4609                         if (NCONF_HAS(wlc_hw->band->phyrev))
4610                                 goto good_phy;
4611                         else
4612                                 goto bad_phy;
4613                 } else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
4614                         if (LCNCONF_HAS(wlc_hw->band->phyrev))
4615                                 goto good_phy;
4616                         else
4617                                 goto bad_phy;
4618                 } else {
4619  bad_phy:
4620                         wiphy_err(wiphy, "wl%d: brcms_b_attach: unsupported "
4621                                   "phy type/rev (%d/%d)\n", unit,
4622                                   wlc_hw->band->phytype, wlc_hw->band->phyrev);
4623                         err = 18;
4624                         goto fail;
4625                 }
4626
4627  good_phy:
4628                 /*
4629                  * BMAC_NOTE: wlc->band->pi should not be set below and should
4630                  * be done in the high level attach. However we can not make
4631                  * that change until all low level access is changed to
4632                  * wlc_hw->band->pi. Instead do the wlc->band->pi init below,
4633                  * keeping wlc_hw->band->pi as well for incremental update of
4634                  * low level fns, and cut over low only init when all fns
4635                  * updated.
4636                  */
4637                 wlc->band->pi = wlc_hw->band->pi;
4638                 wlc->band->phytype = wlc_hw->band->phytype;
4639                 wlc->band->phyrev = wlc_hw->band->phyrev;
4640                 wlc->band->radioid = wlc_hw->band->radioid;
4641                 wlc->band->radiorev = wlc_hw->band->radiorev;
4642
4643                 /* default contention windows size limits */
4644                 wlc_hw->band->CWmin = APHY_CWMIN;
4645                 wlc_hw->band->CWmax = PHY_CWMAX;
4646
4647                 if (!brcms_b_attach_dmapio(wlc, j, wme)) {
4648                         err = 19;
4649                         goto fail;
4650                 }
4651         }
4652
4653         /* disable core to match driver "down" state */
4654         brcms_c_coredisable(wlc_hw);
4655
4656         /* Match driver "down" state */
4657         ai_pci_down(wlc_hw->sih);
4658
4659         /* turn off pll and xtal to match driver "down" state */
4660         brcms_b_xtal(wlc_hw, OFF);
4661
4662         /* *******************************************************************
4663          * The hardware is in the DOWN state at this point. D11 core
4664          * or cores are in reset with clocks off, and the board PLLs
4665          * are off if possible.
4666          *
4667          * Beyond this point, wlc->sbclk == false and chip registers
4668          * should not be touched.
4669          *********************************************************************
4670          */
4671
4672         /* init etheraddr state variables */
4673         brcms_c_get_macaddr(wlc_hw, wlc_hw->etheraddr);
4674
4675         if (is_broadcast_ether_addr(wlc_hw->etheraddr) ||
4676             is_zero_ether_addr(wlc_hw->etheraddr)) {
4677                 wiphy_err(wiphy, "wl%d: brcms_b_attach: bad macaddr\n",
4678                           unit);
4679                 err = 22;
4680                 goto fail;
4681         }
4682
4683         brcms_dbg_info(wlc_hw->d11core, "deviceid 0x%x nbands %d board 0x%x\n",
4684                        wlc_hw->deviceid, wlc_hw->_nbands,
4685                        ai_get_boardtype(wlc_hw->sih));
4686
4687         return err;
4688
4689  fail:
4690         wiphy_err(wiphy, "wl%d: brcms_b_attach: failed with err %d\n", unit,
4691                   err);
4692         return err;
4693 }
4694
4695 static void brcms_c_attach_antgain_init(struct brcms_c_info *wlc)
4696 {
4697         uint unit;
4698         unit = wlc->pub->unit;
4699
4700         if ((wlc->band->antgain == -1) && (wlc->pub->sromrev == 1)) {
4701                 /* default antenna gain for srom rev 1 is 2 dBm (8 qdbm) */
4702                 wlc->band->antgain = 8;
4703         } else if (wlc->band->antgain == -1) {
4704                 wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
4705                           " srom, using 2dB\n", unit, __func__);
4706                 wlc->band->antgain = 8;
4707         } else {
4708                 s8 gain, fract;
4709                 /* Older sroms specified gain in whole dbm only.  In order
4710                  * be able to specify qdbm granularity and remain backward
4711                  * compatible the whole dbms are now encoded in only
4712                  * low 6 bits and remaining qdbms are encoded in the hi 2 bits.
4713                  * 6 bit signed number ranges from -32 - 31.
4714                  *
4715                  * Examples:
4716                  * 0x1 = 1 db,
4717                  * 0xc1 = 1.75 db (1 + 3 quarters),
4718                  * 0x3f = -1 (-1 + 0 quarters),
4719                  * 0x7f = -.75 (-1 + 1 quarters) = -3 qdbm.
4720                  * 0xbf = -.50 (-1 + 2 quarters) = -2 qdbm.
4721                  */
4722                 gain = wlc->band->antgain & 0x3f;
4723                 gain <<= 2;     /* Sign extend */
4724                 gain >>= 2;
4725                 fract = (wlc->band->antgain & 0xc0) >> 6;
4726                 wlc->band->antgain = 4 * gain + fract;
4727         }
4728 }
4729
4730 static bool brcms_c_attach_stf_ant_init(struct brcms_c_info *wlc)
4731 {
4732         int aa;
4733         uint unit;
4734         int bandtype;
4735         struct ssb_sprom *sprom = &wlc->hw->d11core->bus->sprom;
4736
4737         unit = wlc->pub->unit;
4738         bandtype = wlc->band->bandtype;
4739
4740         /* get antennas available */
4741         if (bandtype == BRCM_BAND_5G)
4742                 aa = sprom->ant_available_a;
4743         else
4744                 aa = sprom->ant_available_bg;
4745
4746         if ((aa < 1) || (aa > 15)) {
4747                 wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
4748                           " srom (0x%x), using 3\n", unit, __func__, aa);
4749                 aa = 3;
4750         }
4751
4752         /* reset the defaults if we have a single antenna */
4753         if (aa == 1) {
4754                 wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_0;
4755                 wlc->stf->txant = ANT_TX_FORCE_0;
4756         } else if (aa == 2) {
4757                 wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_1;
4758                 wlc->stf->txant = ANT_TX_FORCE_1;
4759         } else {
4760         }
4761
4762         /* Compute Antenna Gain */
4763         if (bandtype == BRCM_BAND_5G)
4764                 wlc->band->antgain = sprom->antenna_gain.a1;
4765         else
4766                 wlc->band->antgain = sprom->antenna_gain.a0;
4767
4768         brcms_c_attach_antgain_init(wlc);
4769
4770         return true;
4771 }
4772
4773 static void brcms_c_bss_default_init(struct brcms_c_info *wlc)
4774 {
4775         u16 chanspec;
4776         struct brcms_band *band;
4777         struct brcms_bss_info *bi = wlc->default_bss;
4778
4779         /* init default and target BSS with some sane initial values */
4780         memset(bi, 0, sizeof(*bi));
4781         bi->beacon_period = BEACON_INTERVAL_DEFAULT;
4782
4783         /* fill the default channel as the first valid channel
4784          * starting from the 2G channels
4785          */
4786         chanspec = ch20mhz_chspec(1);
4787         wlc->home_chanspec = bi->chanspec = chanspec;
4788
4789         /* find the band of our default channel */
4790         band = wlc->band;
4791         if (wlc->pub->_nbands > 1 &&
4792             band->bandunit != chspec_bandunit(chanspec))
4793                 band = wlc->bandstate[OTHERBANDUNIT(wlc)];
4794
4795         /* init bss rates to the band specific default rate set */
4796         brcms_c_rateset_default(&bi->rateset, NULL, band->phytype,
4797                 band->bandtype, false, BRCMS_RATE_MASK_FULL,
4798                 (bool) (wlc->pub->_n_enab & SUPPORT_11N),
4799                 brcms_chspec_bw(chanspec), wlc->stf->txstreams);
4800
4801         if (wlc->pub->_n_enab & SUPPORT_11N)
4802                 bi->flags |= BRCMS_BSS_HT;
4803 }
4804
4805 static void brcms_c_update_mimo_band_bwcap(struct brcms_c_info *wlc, u8 bwcap)
4806 {
4807         uint i;
4808         struct brcms_band *band;
4809
4810         for (i = 0; i < wlc->pub->_nbands; i++) {
4811                 band = wlc->bandstate[i];
4812                 if (band->bandtype == BRCM_BAND_5G) {
4813                         if ((bwcap == BRCMS_N_BW_40ALL)
4814                             || (bwcap == BRCMS_N_BW_20IN2G_40IN5G))
4815                                 band->mimo_cap_40 = true;
4816                         else
4817                                 band->mimo_cap_40 = false;
4818                 } else {
4819                         if (bwcap == BRCMS_N_BW_40ALL)
4820                                 band->mimo_cap_40 = true;
4821                         else
4822                                 band->mimo_cap_40 = false;
4823                 }
4824         }
4825 }
4826
4827 static void brcms_c_timers_deinit(struct brcms_c_info *wlc)
4828 {
4829         /* free timer state */
4830         if (wlc->wdtimer) {
4831                 brcms_free_timer(wlc->wdtimer);
4832                 wlc->wdtimer = NULL;
4833         }
4834         if (wlc->radio_timer) {
4835                 brcms_free_timer(wlc->radio_timer);
4836                 wlc->radio_timer = NULL;
4837         }
4838 }
4839
4840 static void brcms_c_detach_module(struct brcms_c_info *wlc)
4841 {
4842         if (wlc->asi) {
4843                 brcms_c_antsel_detach(wlc->asi);
4844                 wlc->asi = NULL;
4845         }
4846
4847         if (wlc->ampdu) {
4848                 brcms_c_ampdu_detach(wlc->ampdu);
4849                 wlc->ampdu = NULL;
4850         }
4851
4852         brcms_c_stf_detach(wlc);
4853 }
4854
4855 /*
4856  * low level detach
4857  */
4858 static int brcms_b_detach(struct brcms_c_info *wlc)
4859 {
4860         uint i;
4861         struct brcms_hw_band *band;
4862         struct brcms_hardware *wlc_hw = wlc->hw;
4863         int callbacks;
4864
4865         callbacks = 0;
4866
4867         brcms_b_detach_dmapio(wlc_hw);
4868
4869         band = wlc_hw->band;
4870         for (i = 0; i < wlc_hw->_nbands; i++) {
4871                 if (band->pi) {
4872                         /* Detach this band's phy */
4873                         wlc_phy_detach(band->pi);
4874                         band->pi = NULL;
4875                 }
4876                 band = wlc_hw->bandstate[OTHERBANDUNIT(wlc)];
4877         }
4878
4879         /* Free shared phy state */
4880         kfree(wlc_hw->phy_sh);
4881
4882         wlc_phy_shim_detach(wlc_hw->physhim);
4883
4884         if (wlc_hw->sih) {
4885                 ai_detach(wlc_hw->sih);
4886                 wlc_hw->sih = NULL;
4887         }
4888
4889         return callbacks;
4890
4891 }
4892
4893 /*
4894  * Return a count of the number of driver callbacks still pending.
4895  *
4896  * General policy is that brcms_c_detach can only dealloc/free software states.
4897  * It can NOT touch hardware registers since the d11core may be in reset and
4898  * clock may not be available.
4899  * One exception is sb register access, which is possible if crystal is turned
4900  * on after "down" state, driver should avoid software timer with the exception
4901  * of radio_monitor.
4902  */
4903 uint brcms_c_detach(struct brcms_c_info *wlc)
4904 {
4905         uint callbacks = 0;
4906
4907         if (wlc == NULL)
4908                 return 0;
4909
4910         callbacks += brcms_b_detach(wlc);
4911
4912         /* delete software timers */
4913         if (!brcms_c_radio_monitor_stop(wlc))
4914                 callbacks++;
4915
4916         brcms_c_channel_mgr_detach(wlc->cmi);
4917
4918         brcms_c_timers_deinit(wlc);
4919
4920         brcms_c_detach_module(wlc);
4921
4922         brcms_c_detach_mfree(wlc);
4923         return callbacks;
4924 }
4925
4926 /* update state that depends on the current value of "ap" */
4927 static void brcms_c_ap_upd(struct brcms_c_info *wlc)
4928 {
4929         /* STA-BSS; short capable */
4930         wlc->PLCPHdr_override = BRCMS_PLCP_SHORT;
4931 }
4932
4933 /* Initialize just the hardware when coming out of POR or S3/S5 system states */
4934 static void brcms_b_hw_up(struct brcms_hardware *wlc_hw)
4935 {
4936         if (wlc_hw->wlc->pub->hw_up)
4937                 return;
4938
4939         brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4940
4941         /*
4942          * Enable pll and xtal, initialize the power control registers,
4943          * and force fastclock for the remainder of brcms_c_up().
4944          */
4945         brcms_b_xtal(wlc_hw, ON);
4946         ai_clkctl_init(wlc_hw->sih);
4947         brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4948
4949         /*
4950          * TODO: test suspend/resume
4951          *
4952          * AI chip doesn't restore bar0win2 on
4953          * hibernation/resume, need sw fixup
4954          */
4955
4956         /*
4957          * Inform phy that a POR reset has occurred so
4958          * it does a complete phy init
4959          */
4960         wlc_phy_por_inform(wlc_hw->band->pi);
4961
4962         wlc_hw->ucode_loaded = false;
4963         wlc_hw->wlc->pub->hw_up = true;
4964
4965         if ((wlc_hw->boardflags & BFL_FEM)
4966             && (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
4967                 if (!
4968                     (wlc_hw->boardrev >= 0x1250
4969                      && (wlc_hw->boardflags & BFL_FEM_BT)))
4970                         ai_epa_4313war(wlc_hw->sih);
4971         }
4972 }
4973
4974 static int brcms_b_up_prep(struct brcms_hardware *wlc_hw)
4975 {
4976         brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4977
4978         /*
4979          * Enable pll and xtal, initialize the power control registers,
4980          * and force fastclock for the remainder of brcms_c_up().
4981          */
4982         brcms_b_xtal(wlc_hw, ON);
4983         ai_clkctl_init(wlc_hw->sih);
4984         brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4985
4986         /*
4987          * Configure pci/pcmcia here instead of in brcms_c_attach()
4988          * to allow mfg hotswap:  down, hotswap (chip power cycle), up.
4989          */
4990         bcma_core_pci_irq_ctl(&wlc_hw->d11core->bus->drv_pci[0], wlc_hw->d11core,
4991                               true);
4992
4993         /*
4994          * Need to read the hwradio status here to cover the case where the
4995          * system is loaded with the hw radio disabled. We do not want to
4996          * bring the driver up in this case.
4997          */
4998         if (brcms_b_radio_read_hwdisabled(wlc_hw)) {
4999                 /* put SB PCI in down state again */
5000                 ai_pci_down(wlc_hw->sih);
5001                 brcms_b_xtal(wlc_hw, OFF);
5002                 return -ENOMEDIUM;
5003         }
5004
5005         ai_pci_up(wlc_hw->sih);
5006
5007         /* reset the d11 core */
5008         brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
5009
5010         return 0;
5011 }
5012
5013 static int brcms_b_up_finish(struct brcms_hardware *wlc_hw)
5014 {
5015         wlc_hw->up = true;
5016         wlc_phy_hw_state_upd(wlc_hw->band->pi, true);
5017
5018         /* FULLY enable dynamic power control and d11 core interrupt */
5019         brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
5020         brcms_intrson(wlc_hw->wlc->wl);
5021         return 0;
5022 }
5023
5024 /*
5025  * Write WME tunable parameters for retransmit/max rate
5026  * from wlc struct to ucode
5027  */
5028 static void brcms_c_wme_retries_write(struct brcms_c_info *wlc)
5029 {
5030         int ac;
5031
5032         /* Need clock to do this */
5033         if (!wlc->clk)
5034                 return;
5035
5036         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
5037                 brcms_b_write_shm(wlc->hw, M_AC_TXLMT_ADDR(ac),
5038                                   wlc->wme_retries[ac]);
5039 }
5040
5041 /* make interface operational */
5042 int brcms_c_up(struct brcms_c_info *wlc)
5043 {
5044         struct ieee80211_channel *ch;
5045
5046         brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5047
5048         /* HW is turned off so don't try to access it */
5049         if (wlc->pub->hw_off || brcms_deviceremoved(wlc))
5050                 return -ENOMEDIUM;
5051
5052         if (!wlc->pub->hw_up) {
5053                 brcms_b_hw_up(wlc->hw);
5054                 wlc->pub->hw_up = true;
5055         }
5056
5057         if ((wlc->pub->boardflags & BFL_FEM)
5058             && (ai_get_chip_id(wlc->hw->sih) == BCMA_CHIP_ID_BCM4313)) {
5059                 if (wlc->pub->boardrev >= 0x1250
5060                     && (wlc->pub->boardflags & BFL_FEM_BT))
5061                         brcms_b_mhf(wlc->hw, MHF5, MHF5_4313_GPIOCTRL,
5062                                 MHF5_4313_GPIOCTRL, BRCM_BAND_ALL);
5063                 else
5064                         brcms_b_mhf(wlc->hw, MHF4, MHF4_EXTPA_ENABLE,
5065                                     MHF4_EXTPA_ENABLE, BRCM_BAND_ALL);
5066         }
5067
5068         /*
5069          * Need to read the hwradio status here to cover the case where the
5070          * system is loaded with the hw radio disabled. We do not want to bring
5071          * the driver up in this case. If radio is disabled, abort up, lower
5072          * power, start radio timer and return 0(for NDIS) don't call
5073          * radio_update to avoid looping brcms_c_up.
5074          *
5075          * brcms_b_up_prep() returns either 0 or -BCME_RADIOOFF only
5076          */
5077         if (!wlc->pub->radio_disabled) {
5078                 int status = brcms_b_up_prep(wlc->hw);
5079                 if (status == -ENOMEDIUM) {
5080                         if (!mboolisset
5081                             (wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE)) {
5082                                 struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
5083                                 mboolset(wlc->pub->radio_disabled,
5084                                          WL_RADIO_HW_DISABLE);
5085                                 if (bsscfg->type == BRCMS_TYPE_STATION ||
5086                                     bsscfg->type == BRCMS_TYPE_ADHOC)
5087                                         brcms_err(wlc->hw->d11core,
5088                                                   "wl%d: up: rfdisable -> "
5089                                                   "bsscfg_disable()\n",
5090                                                    wlc->pub->unit);
5091                         }
5092                 }
5093         }
5094
5095         if (wlc->pub->radio_disabled) {
5096                 brcms_c_radio_monitor_start(wlc);
5097                 return 0;
5098         }
5099
5100         /* brcms_b_up_prep has done brcms_c_corereset(). so clk is on, set it */
5101         wlc->clk = true;
5102
5103         brcms_c_radio_monitor_stop(wlc);
5104
5105         /* Set EDCF hostflags */
5106         brcms_b_mhf(wlc->hw, MHF1, MHF1_EDCF, MHF1_EDCF, BRCM_BAND_ALL);
5107
5108         brcms_init(wlc->wl);
5109         wlc->pub->up = true;
5110
5111         if (wlc->bandinit_pending) {
5112                 ch = wlc->pub->ieee_hw->conf.channel;
5113                 brcms_c_suspend_mac_and_wait(wlc);
5114                 brcms_c_set_chanspec(wlc, ch20mhz_chspec(ch->hw_value));
5115                 wlc->bandinit_pending = false;
5116                 brcms_c_enable_mac(wlc);
5117         }
5118
5119         brcms_b_up_finish(wlc->hw);
5120
5121         /* Program the TX wme params with the current settings */
5122         brcms_c_wme_retries_write(wlc);
5123
5124         /* start one second watchdog timer */
5125         brcms_add_timer(wlc->wdtimer, TIMER_INTERVAL_WATCHDOG, true);
5126         wlc->WDarmed = true;
5127
5128         /* ensure antenna config is up to date */
5129         brcms_c_stf_phy_txant_upd(wlc);
5130         /* ensure LDPC config is in sync */
5131         brcms_c_ht_update_ldpc(wlc, wlc->stf->ldpc);
5132
5133         return 0;
5134 }
5135
5136 static uint brcms_c_down_del_timer(struct brcms_c_info *wlc)
5137 {
5138         uint callbacks = 0;
5139
5140         return callbacks;
5141 }
5142
5143 static int brcms_b_bmac_down_prep(struct brcms_hardware *wlc_hw)
5144 {
5145         bool dev_gone;
5146         uint callbacks = 0;
5147
5148         if (!wlc_hw->up)
5149                 return callbacks;
5150
5151         dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5152
5153         /* disable interrupts */
5154         if (dev_gone)
5155                 wlc_hw->wlc->macintmask = 0;
5156         else {
5157                 /* now disable interrupts */
5158                 brcms_intrsoff(wlc_hw->wlc->wl);
5159
5160                 /* ensure we're running on the pll clock again */
5161                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
5162         }
5163         /* down phy at the last of this stage */
5164         callbacks += wlc_phy_down(wlc_hw->band->pi);
5165
5166         return callbacks;
5167 }
5168
5169 static int brcms_b_down_finish(struct brcms_hardware *wlc_hw)
5170 {
5171         uint callbacks = 0;
5172         bool dev_gone;
5173
5174         if (!wlc_hw->up)
5175                 return callbacks;
5176
5177         wlc_hw->up = false;
5178         wlc_phy_hw_state_upd(wlc_hw->band->pi, false);
5179
5180         dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5181
5182         if (dev_gone) {
5183                 wlc_hw->sbclk = false;
5184                 wlc_hw->clk = false;
5185                 wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
5186
5187                 /* reclaim any posted packets */
5188                 brcms_c_flushqueues(wlc_hw->wlc);
5189         } else {
5190
5191                 /* Reset and disable the core */
5192                 if (bcma_core_is_enabled(wlc_hw->d11core)) {
5193                         if (bcma_read32(wlc_hw->d11core,
5194                                         D11REGOFFS(maccontrol)) & MCTL_EN_MAC)
5195                                 brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
5196                         callbacks += brcms_reset(wlc_hw->wlc->wl);
5197                         brcms_c_coredisable(wlc_hw);
5198                 }
5199
5200                 /* turn off primary xtal and pll */
5201                 if (!wlc_hw->noreset) {
5202                         ai_pci_down(wlc_hw->sih);
5203                         brcms_b_xtal(wlc_hw, OFF);
5204                 }
5205         }
5206
5207         return callbacks;
5208 }
5209
5210 /*
5211  * Mark the interface nonoperational, stop the software mechanisms,
5212  * disable the hardware, free any transient buffer state.
5213  * Return a count of the number of driver callbacks still pending.
5214  */
5215 uint brcms_c_down(struct brcms_c_info *wlc)
5216 {
5217
5218         uint callbacks = 0;
5219         int i;
5220         bool dev_gone = false;
5221
5222         brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5223
5224         /* check if we are already in the going down path */
5225         if (wlc->going_down) {
5226                 brcms_err(wlc->hw->d11core,
5227                           "wl%d: %s: Driver going down so return\n",
5228                           wlc->pub->unit, __func__);
5229                 return 0;
5230         }
5231         if (!wlc->pub->up)
5232                 return callbacks;
5233
5234         wlc->going_down = true;
5235
5236         callbacks += brcms_b_bmac_down_prep(wlc->hw);
5237
5238         dev_gone = brcms_deviceremoved(wlc);
5239
5240         /* Call any registered down handlers */
5241         for (i = 0; i < BRCMS_MAXMODULES; i++) {
5242                 if (wlc->modulecb[i].down_fn)
5243                         callbacks +=
5244                             wlc->modulecb[i].down_fn(wlc->modulecb[i].hdl);
5245         }
5246
5247         /* cancel the watchdog timer */
5248         if (wlc->WDarmed) {
5249                 if (!brcms_del_timer(wlc->wdtimer))
5250                         callbacks++;
5251                 wlc->WDarmed = false;
5252         }
5253         /* cancel all other timers */
5254         callbacks += brcms_c_down_del_timer(wlc);
5255
5256         wlc->pub->up = false;
5257
5258         wlc_phy_mute_upd(wlc->band->pi, false, PHY_MUTE_ALL);
5259
5260         callbacks += brcms_b_down_finish(wlc->hw);
5261
5262         /* brcms_b_down_finish has done brcms_c_coredisable(). so clk is off */
5263         wlc->clk = false;
5264
5265         wlc->going_down = false;
5266         return callbacks;
5267 }
5268
5269 /* Set the current gmode configuration */
5270 int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config)
5271 {
5272         int ret = 0;
5273         uint i;
5274         struct brcms_c_rateset rs;
5275         /* Default to 54g Auto */
5276         /* Advertise and use shortslot (-1/0/1 Auto/Off/On) */
5277         s8 shortslot = BRCMS_SHORTSLOT_AUTO;
5278         bool shortslot_restrict = false; /* Restrict association to stations
5279                                           * that support shortslot
5280                                           */
5281         bool ofdm_basic = false;        /* Make 6, 12, and 24 basic rates */
5282         /* Advertise and use short preambles (-1/0/1 Auto/Off/On) */
5283         int preamble = BRCMS_PLCP_LONG;
5284         bool preamble_restrict = false; /* Restrict association to stations
5285                                          * that support short preambles
5286                                          */
5287         struct brcms_band *band;
5288
5289         /* if N-support is enabled, allow Gmode set as long as requested
5290          * Gmode is not GMODE_LEGACY_B
5291          */
5292         if ((wlc->pub->_n_enab & SUPPORT_11N) && gmode == GMODE_LEGACY_B)
5293                 return -ENOTSUPP;
5294
5295         /* verify that we are dealing with 2G band and grab the band pointer */
5296         if (wlc->band->bandtype == BRCM_BAND_2G)
5297                 band = wlc->band;
5298         else if ((wlc->pub->_nbands > 1) &&
5299                  (wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype == BRCM_BAND_2G))
5300                 band = wlc->bandstate[OTHERBANDUNIT(wlc)];
5301         else
5302                 return -EINVAL;
5303
5304         /* update configuration value */
5305         if (config)
5306                 brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER, gmode);
5307
5308         /* Clear rateset override */
5309         memset(&rs, 0, sizeof(rs));
5310
5311         switch (gmode) {
5312         case GMODE_LEGACY_B:
5313                 shortslot = BRCMS_SHORTSLOT_OFF;
5314                 brcms_c_rateset_copy(&gphy_legacy_rates, &rs);
5315
5316                 break;
5317
5318         case GMODE_LRS:
5319                 break;
5320
5321         case GMODE_AUTO:
5322                 /* Accept defaults */
5323                 break;
5324
5325         case GMODE_ONLY:
5326                 ofdm_basic = true;
5327                 preamble = BRCMS_PLCP_SHORT;
5328                 preamble_restrict = true;
5329                 break;
5330
5331         case GMODE_PERFORMANCE:
5332                 shortslot = BRCMS_SHORTSLOT_ON;
5333                 shortslot_restrict = true;
5334                 ofdm_basic = true;
5335                 preamble = BRCMS_PLCP_SHORT;
5336                 preamble_restrict = true;
5337                 break;
5338
5339         default:
5340                 /* Error */
5341                 brcms_err(wlc->hw->d11core, "wl%d: %s: invalid gmode %d\n",
5342                           wlc->pub->unit, __func__, gmode);
5343                 return -ENOTSUPP;
5344         }
5345
5346         band->gmode = gmode;
5347
5348         wlc->shortslot_override = shortslot;
5349
5350         /* Use the default 11g rateset */
5351         if (!rs.count)
5352                 brcms_c_rateset_copy(&cck_ofdm_rates, &rs);
5353
5354         if (ofdm_basic) {
5355                 for (i = 0; i < rs.count; i++) {
5356                         if (rs.rates[i] == BRCM_RATE_6M
5357                             || rs.rates[i] == BRCM_RATE_12M
5358                             || rs.rates[i] == BRCM_RATE_24M)
5359                                 rs.rates[i] |= BRCMS_RATE_FLAG;
5360                 }
5361         }
5362
5363         /* Set default bss rateset */
5364         wlc->default_bss->rateset.count = rs.count;
5365         memcpy(wlc->default_bss->rateset.rates, rs.rates,
5366                sizeof(wlc->default_bss->rateset.rates));
5367
5368         return ret;
5369 }
5370
5371 int brcms_c_set_nmode(struct brcms_c_info *wlc)
5372 {
5373         uint i;
5374         s32 nmode = AUTO;
5375
5376         if (wlc->stf->txstreams == WL_11N_3x3)
5377                 nmode = WL_11N_3x3;
5378         else
5379                 nmode = WL_11N_2x2;
5380
5381         /* force GMODE_AUTO if NMODE is ON */
5382         brcms_c_set_gmode(wlc, GMODE_AUTO, true);
5383         if (nmode == WL_11N_3x3)
5384                 wlc->pub->_n_enab = SUPPORT_HT;
5385         else
5386                 wlc->pub->_n_enab = SUPPORT_11N;
5387         wlc->default_bss->flags |= BRCMS_BSS_HT;
5388         /* add the mcs rates to the default and hw ratesets */
5389         brcms_c_rateset_mcs_build(&wlc->default_bss->rateset,
5390                               wlc->stf->txstreams);
5391         for (i = 0; i < wlc->pub->_nbands; i++)
5392                 memcpy(wlc->bandstate[i]->hw_rateset.mcs,
5393                        wlc->default_bss->rateset.mcs, MCSSET_LEN);
5394
5395         return 0;
5396 }
5397
5398 static int
5399 brcms_c_set_internal_rateset(struct brcms_c_info *wlc,
5400                              struct brcms_c_rateset *rs_arg)
5401 {
5402         struct brcms_c_rateset rs, new;
5403         uint bandunit;
5404
5405         memcpy(&rs, rs_arg, sizeof(struct brcms_c_rateset));
5406
5407         /* check for bad count value */
5408         if ((rs.count == 0) || (rs.count > BRCMS_NUMRATES))
5409                 return -EINVAL;
5410
5411         /* try the current band */
5412         bandunit = wlc->band->bandunit;
5413         memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5414         if (brcms_c_rate_hwrs_filter_sort_validate
5415             (&new, &wlc->bandstate[bandunit]->hw_rateset, true,
5416              wlc->stf->txstreams))
5417                 goto good;
5418
5419         /* try the other band */
5420         if (brcms_is_mband_unlocked(wlc)) {
5421                 bandunit = OTHERBANDUNIT(wlc);
5422                 memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5423                 if (brcms_c_rate_hwrs_filter_sort_validate(&new,
5424                                                        &wlc->
5425                                                        bandstate[bandunit]->
5426                                                        hw_rateset, true,
5427                                                        wlc->stf->txstreams))
5428                         goto good;
5429         }
5430
5431         return -EBADE;
5432
5433  good:
5434         /* apply new rateset */
5435         memcpy(&wlc->default_bss->rateset, &new,
5436                sizeof(struct brcms_c_rateset));
5437         memcpy(&wlc->bandstate[bandunit]->defrateset, &new,
5438                sizeof(struct brcms_c_rateset));
5439         return 0;
5440 }
5441
5442 static void brcms_c_ofdm_rateset_war(struct brcms_c_info *wlc)
5443 {
5444         u8 r;
5445         bool war = false;
5446
5447         if (wlc->pub->associated)
5448                 r = wlc->bsscfg->current_bss->rateset.rates[0];
5449         else
5450                 r = wlc->default_bss->rateset.rates[0];
5451
5452         wlc_phy_ofdm_rateset_war(wlc->band->pi, war);
5453 }
5454
5455 int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel)
5456 {
5457         u16 chspec = ch20mhz_chspec(channel);
5458
5459         if (channel < 0 || channel > MAXCHANNEL)
5460                 return -EINVAL;
5461
5462         if (!brcms_c_valid_chanspec_db(wlc->cmi, chspec))
5463                 return -EINVAL;
5464
5465
5466         if (!wlc->pub->up && brcms_is_mband_unlocked(wlc)) {
5467                 if (wlc->band->bandunit != chspec_bandunit(chspec))
5468                         wlc->bandinit_pending = true;
5469                 else
5470                         wlc->bandinit_pending = false;
5471         }
5472
5473         wlc->default_bss->chanspec = chspec;
5474         /* brcms_c_BSSinit() will sanitize the rateset before
5475          * using it.. */
5476         if (wlc->pub->up && (wlc_phy_chanspec_get(wlc->band->pi) != chspec)) {
5477                 brcms_c_set_home_chanspec(wlc, chspec);
5478                 brcms_c_suspend_mac_and_wait(wlc);
5479                 brcms_c_set_chanspec(wlc, chspec);
5480                 brcms_c_enable_mac(wlc);
5481         }
5482         return 0;
5483 }
5484
5485 int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl)
5486 {
5487         int ac;
5488
5489         if (srl < 1 || srl > RETRY_SHORT_MAX ||
5490             lrl < 1 || lrl > RETRY_SHORT_MAX)
5491                 return -EINVAL;
5492
5493         wlc->SRL = srl;
5494         wlc->LRL = lrl;
5495
5496         brcms_b_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
5497
5498         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
5499                 wlc->wme_retries[ac] =  SFIELD(wlc->wme_retries[ac],
5500                                                EDCF_SHORT,  wlc->SRL);
5501                 wlc->wme_retries[ac] =  SFIELD(wlc->wme_retries[ac],
5502                                                EDCF_LONG, wlc->LRL);
5503         }
5504         brcms_c_wme_retries_write(wlc);
5505
5506         return 0;
5507 }
5508
5509 void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
5510                                  struct brcm_rateset *currs)
5511 {
5512         struct brcms_c_rateset *rs;
5513
5514         if (wlc->pub->associated)
5515                 rs = &wlc->bsscfg->current_bss->rateset;
5516         else
5517                 rs = &wlc->default_bss->rateset;
5518
5519         /* Copy only legacy rateset section */
5520         currs->count = rs->count;
5521         memcpy(&currs->rates, &rs->rates, rs->count);
5522 }
5523
5524 int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
5525 {
5526         struct brcms_c_rateset internal_rs;
5527         int bcmerror;
5528
5529         if (rs->count > BRCMS_NUMRATES)
5530                 return -ENOBUFS;
5531
5532         memset(&internal_rs, 0, sizeof(internal_rs));
5533
5534         /* Copy only legacy rateset section */
5535         internal_rs.count = rs->count;
5536         memcpy(&internal_rs.rates, &rs->rates, internal_rs.count);
5537
5538         /* merge rateset coming in with the current mcsset */
5539         if (wlc->pub->_n_enab & SUPPORT_11N) {
5540                 struct brcms_bss_info *mcsset_bss;
5541                 if (wlc->pub->associated)
5542                         mcsset_bss = wlc->bsscfg->current_bss;
5543                 else
5544                         mcsset_bss = wlc->default_bss;
5545                 memcpy(internal_rs.mcs, &mcsset_bss->rateset.mcs[0],
5546                        MCSSET_LEN);
5547         }
5548
5549         bcmerror = brcms_c_set_internal_rateset(wlc, &internal_rs);
5550         if (!bcmerror)
5551                 brcms_c_ofdm_rateset_war(wlc);
5552
5553         return bcmerror;
5554 }
5555
5556 static void brcms_c_time_lock(struct brcms_c_info *wlc)
5557 {
5558         bcma_set32(wlc->hw->d11core, D11REGOFFS(maccontrol), MCTL_TBTTHOLD);
5559         /* Commit the write */
5560         bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
5561 }
5562
5563 static void brcms_c_time_unlock(struct brcms_c_info *wlc)
5564 {
5565         bcma_mask32(wlc->hw->d11core, D11REGOFFS(maccontrol), ~MCTL_TBTTHOLD);
5566         /* Commit the write */
5567         bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
5568 }
5569
5570 int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
5571 {
5572         u32 bcnint_us;
5573
5574         if (period == 0)
5575                 return -EINVAL;
5576
5577         wlc->default_bss->beacon_period = period;
5578
5579         bcnint_us = period << 10;
5580         brcms_c_time_lock(wlc);
5581         bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfprep),
5582                      (bcnint_us << CFPREP_CBI_SHIFT));
5583         bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfpstart), bcnint_us);
5584         brcms_c_time_unlock(wlc);
5585
5586         return 0;
5587 }
5588
5589 u16 brcms_c_get_phy_type(struct brcms_c_info *wlc, int phyidx)
5590 {
5591         return wlc->band->phytype;
5592 }
5593
5594 void brcms_c_set_shortslot_override(struct brcms_c_info *wlc, s8 sslot_override)
5595 {
5596         wlc->shortslot_override = sslot_override;
5597
5598         /*
5599          * shortslot is an 11g feature, so no more work if we are
5600          * currently on the 5G band
5601          */
5602         if (wlc->band->bandtype == BRCM_BAND_5G)
5603                 return;
5604
5605         if (wlc->pub->up && wlc->pub->associated) {
5606                 /* let watchdog or beacon processing update shortslot */
5607         } else if (wlc->pub->up) {
5608                 /* unassociated shortslot is off */
5609                 brcms_c_switch_shortslot(wlc, false);
5610         } else {
5611                 /* driver is down, so just update the brcms_c_info
5612                  * value */
5613                 if (wlc->shortslot_override == BRCMS_SHORTSLOT_AUTO)
5614                         wlc->shortslot = false;
5615                 else
5616                         wlc->shortslot =
5617                             (wlc->shortslot_override ==
5618                              BRCMS_SHORTSLOT_ON);
5619         }
5620 }
5621
5622 /*
5623  * register watchdog and down handlers.
5624  */
5625 int brcms_c_module_register(struct brcms_pub *pub,
5626                             const char *name, struct brcms_info *hdl,
5627                             int (*d_fn)(void *handle))
5628 {
5629         struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5630         int i;
5631
5632         /* find an empty entry and just add, no duplication check! */
5633         for (i = 0; i < BRCMS_MAXMODULES; i++) {
5634                 if (wlc->modulecb[i].name[0] == '\0') {
5635                         strncpy(wlc->modulecb[i].name, name,
5636                                 sizeof(wlc->modulecb[i].name) - 1);
5637                         wlc->modulecb[i].hdl = hdl;
5638                         wlc->modulecb[i].down_fn = d_fn;
5639                         return 0;
5640                 }
5641         }
5642
5643         return -ENOSR;
5644 }
5645
5646 /* unregister module callbacks */
5647 int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
5648                               struct brcms_info *hdl)
5649 {
5650         struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5651         int i;
5652
5653         if (wlc == NULL)
5654                 return -ENODATA;
5655
5656         for (i = 0; i < BRCMS_MAXMODULES; i++) {
5657                 if (!strcmp(wlc->modulecb[i].name, name) &&
5658                     (wlc->modulecb[i].hdl == hdl)) {
5659                         memset(&wlc->modulecb[i], 0, sizeof(wlc->modulecb[i]));
5660                         return 0;
5661                 }
5662         }
5663
5664         /* table not found! */
5665         return -ENODATA;
5666 }
5667
5668 static bool brcms_c_chipmatch_pci(struct bcma_device *core)
5669 {
5670         struct pci_dev *pcidev = core->bus->host_pci;
5671         u16 vendor = pcidev->vendor;
5672         u16 device = pcidev->device;
5673
5674         if (vendor != PCI_VENDOR_ID_BROADCOM) {
5675                 pr_err("unknown vendor id %04x\n", vendor);
5676                 return false;
5677         }
5678
5679         if (device == BCM43224_D11N_ID_VEN1 || device == BCM43224_CHIP_ID)
5680                 return true;
5681         if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
5682                 return true;
5683         if (device == BCM4313_D11N2G_ID)
5684                 return true;
5685         if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
5686                 return true;
5687
5688         pr_err("unknown device id %04x\n", device);
5689         return false;
5690 }
5691
5692 static bool brcms_c_chipmatch_soc(struct bcma_device *core)
5693 {
5694         struct bcma_chipinfo *chipinfo = &core->bus->chipinfo;
5695
5696         if (chipinfo->id == BCMA_CHIP_ID_BCM4716)
5697                 return true;
5698
5699         pr_err("unknown chip id %04x\n", chipinfo->id);
5700         return false;
5701 }
5702
5703 bool brcms_c_chipmatch(struct bcma_device *core)
5704 {
5705         switch (core->bus->hosttype) {
5706         case BCMA_HOSTTYPE_PCI:
5707                 return brcms_c_chipmatch_pci(core);
5708         case BCMA_HOSTTYPE_SOC:
5709                 return brcms_c_chipmatch_soc(core);
5710         default:
5711                 pr_err("unknown host type: %i\n", core->bus->hosttype);
5712                 return false;
5713         }
5714 }
5715
5716 u16 brcms_b_rate_shm_offset(struct brcms_hardware *wlc_hw, u8 rate)
5717 {
5718         u16 table_ptr;
5719         u8 phy_rate, index;
5720
5721         /* get the phy specific rate encoding for the PLCP SIGNAL field */
5722         if (is_ofdm_rate(rate))
5723                 table_ptr = M_RT_DIRMAP_A;
5724         else
5725                 table_ptr = M_RT_DIRMAP_B;
5726
5727         /* for a given rate, the LS-nibble of the PLCP SIGNAL field is
5728          * the index into the rate table.
5729          */
5730         phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
5731         index = phy_rate & 0xf;
5732
5733         /* Find the SHM pointer to the rate table entry by looking in the
5734          * Direct-map Table
5735          */
5736         return 2 * brcms_b_read_shm(wlc_hw, table_ptr + (index * 2));
5737 }
5738
5739 /*
5740  * bcmc_fid_generate:
5741  * Generate frame ID for a BCMC packet.  The frag field is not used
5742  * for MC frames so is used as part of the sequence number.
5743  */
5744 static inline u16
5745 bcmc_fid_generate(struct brcms_c_info *wlc, struct brcms_bss_cfg *bsscfg,
5746                   struct d11txh *txh)
5747 {
5748         u16 frameid;
5749
5750         frameid = le16_to_cpu(txh->TxFrameID) & ~(TXFID_SEQ_MASK |
5751                                                   TXFID_QUEUE_MASK);
5752         frameid |=
5753             (((wlc->
5754                mc_fid_counter++) << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
5755             TX_BCMC_FIFO;
5756
5757         return frameid;
5758 }
5759
5760 static uint
5761 brcms_c_calc_ack_time(struct brcms_c_info *wlc, u32 rspec,
5762                       u8 preamble_type)
5763 {
5764         uint dur = 0;
5765
5766         /*
5767          * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5768          * is less than or equal to the rate of the immediately previous
5769          * frame in the FES
5770          */
5771         rspec = brcms_basic_rate(wlc, rspec);
5772         /* ACK frame len == 14 == 2(fc) + 2(dur) + 6(ra) + 4(fcs) */
5773         dur =
5774             brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5775                                 (DOT11_ACK_LEN + FCS_LEN));
5776         return dur;
5777 }
5778
5779 static uint
5780 brcms_c_calc_cts_time(struct brcms_c_info *wlc, u32 rspec,
5781                       u8 preamble_type)
5782 {
5783         return brcms_c_calc_ack_time(wlc, rspec, preamble_type);
5784 }
5785
5786 static uint
5787 brcms_c_calc_ba_time(struct brcms_c_info *wlc, u32 rspec,
5788                      u8 preamble_type)
5789 {
5790         /*
5791          * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5792          * is less than or equal to the rate of the immediately previous
5793          * frame in the FES
5794          */
5795         rspec = brcms_basic_rate(wlc, rspec);
5796         /* BA len == 32 == 16(ctl hdr) + 4(ba len) + 8(bitmap) + 4(fcs) */
5797         return brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5798                                    (DOT11_BA_LEN + DOT11_BA_BITMAP_LEN +
5799                                     FCS_LEN));
5800 }
5801
5802 /* brcms_c_compute_frame_dur()
5803  *
5804  * Calculate the 802.11 MAC header DUR field for MPDU
5805  * DUR for a single frame = 1 SIFS + 1 ACK
5806  * DUR for a frame with following frags = 3 SIFS + 2 ACK + next frag time
5807  *
5808  * rate                 MPDU rate in unit of 500kbps
5809  * next_frag_len        next MPDU length in bytes
5810  * preamble_type        use short/GF or long/MM PLCP header
5811  */
5812 static u16
5813 brcms_c_compute_frame_dur(struct brcms_c_info *wlc, u32 rate,
5814                       u8 preamble_type, uint next_frag_len)
5815 {
5816         u16 dur, sifs;
5817
5818         sifs = get_sifs(wlc->band);
5819
5820         dur = sifs;
5821         dur += (u16) brcms_c_calc_ack_time(wlc, rate, preamble_type);
5822
5823         if (next_frag_len) {
5824                 /* Double the current DUR to get 2 SIFS + 2 ACKs */
5825                 dur *= 2;
5826                 /* add another SIFS and the frag time */
5827                 dur += sifs;
5828                 dur +=
5829                     (u16) brcms_c_calc_frame_time(wlc, rate, preamble_type,
5830                                                  next_frag_len);
5831         }
5832         return dur;
5833 }
5834
5835 /* The opposite of brcms_c_calc_frame_time */
5836 static uint
5837 brcms_c_calc_frame_len(struct brcms_c_info *wlc, u32 ratespec,
5838                    u8 preamble_type, uint dur)
5839 {
5840         uint nsyms, mac_len, Ndps, kNdps;
5841         uint rate = rspec2rate(ratespec);
5842
5843         if (is_mcs_rate(ratespec)) {
5844                 uint mcs = ratespec & RSPEC_RATE_MASK;
5845                 int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
5846                 dur -= PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
5847                 /* payload calculation matches that of regular ofdm */
5848                 if (wlc->band->bandtype == BRCM_BAND_2G)
5849                         dur -= DOT11_OFDM_SIGNAL_EXTENSION;
5850                 /* kNdbps = kbps * 4 */
5851                 kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
5852                                    rspec_issgi(ratespec)) * 4;
5853                 nsyms = dur / APHY_SYMBOL_TIME;
5854                 mac_len =
5855                     ((nsyms * kNdps) -
5856                      ((APHY_SERVICE_NBITS + APHY_TAIL_NBITS) * 1000)) / 8000;
5857         } else if (is_ofdm_rate(ratespec)) {
5858                 dur -= APHY_PREAMBLE_TIME;
5859                 dur -= APHY_SIGNAL_TIME;
5860                 /* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
5861                 Ndps = rate * 2;
5862                 nsyms = dur / APHY_SYMBOL_TIME;
5863                 mac_len =
5864                     ((nsyms * Ndps) -
5865                      (APHY_SERVICE_NBITS + APHY_TAIL_NBITS)) / 8;
5866         } else {
5867                 if (preamble_type & BRCMS_SHORT_PREAMBLE)
5868                         dur -= BPHY_PLCP_SHORT_TIME;
5869                 else
5870                         dur -= BPHY_PLCP_TIME;
5871                 mac_len = dur * rate;
5872                 /* divide out factor of 2 in rate (1/2 mbps) */
5873                 mac_len = mac_len / 8 / 2;
5874         }
5875         return mac_len;
5876 }
5877
5878 /*
5879  * Return true if the specified rate is supported by the specified band.
5880  * BRCM_BAND_AUTO indicates the current band.
5881  */
5882 static bool brcms_c_valid_rate(struct brcms_c_info *wlc, u32 rspec, int band,
5883                     bool verbose)
5884 {
5885         struct brcms_c_rateset *hw_rateset;
5886         uint i;
5887
5888         if ((band == BRCM_BAND_AUTO) || (band == wlc->band->bandtype))
5889                 hw_rateset = &wlc->band->hw_rateset;
5890         else if (wlc->pub->_nbands > 1)
5891                 hw_rateset = &wlc->bandstate[OTHERBANDUNIT(wlc)]->hw_rateset;
5892         else
5893                 /* other band specified and we are a single band device */
5894                 return false;
5895
5896         /* check if this is a mimo rate */
5897         if (is_mcs_rate(rspec)) {
5898                 if ((rspec & RSPEC_RATE_MASK) >= MCS_TABLE_SIZE)
5899                         goto error;
5900
5901                 return isset(hw_rateset->mcs, (rspec & RSPEC_RATE_MASK));
5902         }
5903
5904         for (i = 0; i < hw_rateset->count; i++)
5905                 if (hw_rateset->rates[i] == rspec2rate(rspec))
5906                         return true;
5907  error:
5908         if (verbose)
5909                 brcms_err(wlc->hw->d11core, "wl%d: valid_rate: rate spec 0x%x "
5910                           "not in hw_rateset\n", wlc->pub->unit, rspec);
5911
5912         return false;
5913 }
5914
5915 static u32
5916 mac80211_wlc_set_nrate(struct brcms_c_info *wlc, struct brcms_band *cur_band,
5917                        u32 int_val)
5918 {
5919         struct bcma_device *core = wlc->hw->d11core;
5920         u8 stf = (int_val & NRATE_STF_MASK) >> NRATE_STF_SHIFT;
5921         u8 rate = int_val & NRATE_RATE_MASK;
5922         u32 rspec;
5923         bool ismcs = ((int_val & NRATE_MCS_INUSE) == NRATE_MCS_INUSE);
5924         bool issgi = ((int_val & NRATE_SGI_MASK) >> NRATE_SGI_SHIFT);
5925         bool override_mcs_only = ((int_val & NRATE_OVERRIDE_MCS_ONLY)
5926                                   == NRATE_OVERRIDE_MCS_ONLY);
5927         int bcmerror = 0;
5928
5929         if (!ismcs)
5930                 return (u32) rate;
5931
5932         /* validate the combination of rate/mcs/stf is allowed */
5933         if ((wlc->pub->_n_enab & SUPPORT_11N) && ismcs) {
5934                 /* mcs only allowed when nmode */
5935                 if (stf > PHY_TXC1_MODE_SDM) {
5936                         brcms_err(core, "wl%d: %s: Invalid stf\n",
5937                                   wlc->pub->unit, __func__);
5938                         bcmerror = -EINVAL;
5939                         goto done;
5940                 }
5941
5942                 /* mcs 32 is a special case, DUP mode 40 only */
5943                 if (rate == 32) {
5944                         if (!CHSPEC_IS40(wlc->home_chanspec) ||
5945                             ((stf != PHY_TXC1_MODE_SISO)
5946                              && (stf != PHY_TXC1_MODE_CDD))) {
5947                                 brcms_err(core, "wl%d: %s: Invalid mcs 32\n",
5948                                           wlc->pub->unit, __func__);
5949                                 bcmerror = -EINVAL;
5950                                 goto done;
5951                         }
5952                         /* mcs > 7 must use stf SDM */
5953                 } else if (rate > HIGHEST_SINGLE_STREAM_MCS) {
5954                         /* mcs > 7 must use stf SDM */
5955                         if (stf != PHY_TXC1_MODE_SDM) {
5956                                 brcms_dbg_mac80211(core, "wl%d: enabling "
5957                                                    "SDM mode for mcs %d\n",
5958                                                    wlc->pub->unit, rate);
5959                                 stf = PHY_TXC1_MODE_SDM;
5960                         }
5961                 } else {
5962                         /*
5963                          * MCS 0-7 may use SISO, CDD, and for
5964                          * phy_rev >= 3 STBC
5965                          */
5966                         if ((stf > PHY_TXC1_MODE_STBC) ||
5967                             (!BRCMS_STBC_CAP_PHY(wlc)
5968                              && (stf == PHY_TXC1_MODE_STBC))) {
5969                                 brcms_err(core, "wl%d: %s: Invalid STBC\n",
5970                                           wlc->pub->unit, __func__);
5971                                 bcmerror = -EINVAL;
5972                                 goto done;
5973                         }
5974                 }
5975         } else if (is_ofdm_rate(rate)) {
5976                 if ((stf != PHY_TXC1_MODE_CDD) && (stf != PHY_TXC1_MODE_SISO)) {
5977                         brcms_err(core, "wl%d: %s: Invalid OFDM\n",
5978                                   wlc->pub->unit, __func__);
5979                         bcmerror = -EINVAL;
5980                         goto done;
5981                 }
5982         } else if (is_cck_rate(rate)) {
5983                 if ((cur_band->bandtype != BRCM_BAND_2G)
5984                     || (stf != PHY_TXC1_MODE_SISO)) {
5985                         brcms_err(core, "wl%d: %s: Invalid CCK\n",
5986                                   wlc->pub->unit, __func__);
5987                         bcmerror = -EINVAL;
5988                         goto done;
5989                 }
5990         } else {
5991                 brcms_err(core, "wl%d: %s: Unknown rate type\n",
5992                           wlc->pub->unit, __func__);
5993                 bcmerror = -EINVAL;
5994                 goto done;
5995         }
5996         /* make sure multiple antennae are available for non-siso rates */
5997         if ((stf != PHY_TXC1_MODE_SISO) && (wlc->stf->txstreams == 1)) {
5998                 brcms_err(core, "wl%d: %s: SISO antenna but !SISO "
5999                           "request\n", wlc->pub->unit, __func__);
6000                 bcmerror = -EINVAL;
6001                 goto done;
6002         }
6003
6004         rspec = rate;
6005         if (ismcs) {
6006                 rspec |= RSPEC_MIMORATE;
6007                 /* For STBC populate the STC field of the ratespec */
6008                 if (stf == PHY_TXC1_MODE_STBC) {
6009                         u8 stc;
6010                         stc = 1;        /* Nss for single stream is always 1 */
6011                         rspec |= (stc << RSPEC_STC_SHIFT);
6012                 }
6013         }
6014
6015         rspec |= (stf << RSPEC_STF_SHIFT);
6016
6017         if (override_mcs_only)
6018                 rspec |= RSPEC_OVERRIDE_MCS_ONLY;
6019
6020         if (issgi)
6021                 rspec |= RSPEC_SHORT_GI;
6022
6023         if ((rate != 0)
6024             && !brcms_c_valid_rate(wlc, rspec, cur_band->bandtype, true))
6025                 return rate;
6026
6027         return rspec;
6028 done:
6029         return rate;
6030 }
6031
6032 /*
6033  * Compute PLCP, but only requires actual rate and length of pkt.
6034  * Rate is given in the driver standard multiple of 500 kbps.
6035  * le is set for 11 Mbps rate if necessary.
6036  * Broken out for PRQ.
6037  */
6038
6039 static void brcms_c_cck_plcp_set(struct brcms_c_info *wlc, int rate_500,
6040                              uint length, u8 *plcp)
6041 {
6042         u16 usec = 0;
6043         u8 le = 0;
6044
6045         switch (rate_500) {
6046         case BRCM_RATE_1M:
6047                 usec = length << 3;
6048                 break;
6049         case BRCM_RATE_2M:
6050                 usec = length << 2;
6051                 break;
6052         case BRCM_RATE_5M5:
6053                 usec = (length << 4) / 11;
6054                 if ((length << 4) - (usec * 11) > 0)
6055                         usec++;
6056                 break;
6057         case BRCM_RATE_11M:
6058                 usec = (length << 3) / 11;
6059                 if ((length << 3) - (usec * 11) > 0) {
6060                         usec++;
6061                         if ((usec * 11) - (length << 3) >= 8)
6062                                 le = D11B_PLCP_SIGNAL_LE;
6063                 }
6064                 break;
6065
6066         default:
6067                 brcms_err(wlc->hw->d11core,
6068                           "brcms_c_cck_plcp_set: unsupported rate %d\n",
6069                           rate_500);
6070                 rate_500 = BRCM_RATE_1M;
6071                 usec = length << 3;
6072                 break;
6073         }
6074         /* PLCP signal byte */
6075         plcp[0] = rate_500 * 5; /* r (500kbps) * 5 == r (100kbps) */
6076         /* PLCP service byte */
6077         plcp[1] = (u8) (le | D11B_PLCP_SIGNAL_LOCKED);
6078         /* PLCP length u16, little endian */
6079         plcp[2] = usec & 0xff;
6080         plcp[3] = (usec >> 8) & 0xff;
6081         /* PLCP CRC16 */
6082         plcp[4] = 0;
6083         plcp[5] = 0;
6084 }
6085
6086 /* Rate: 802.11 rate code, length: PSDU length in octets */
6087 static void brcms_c_compute_mimo_plcp(u32 rspec, uint length, u8 *plcp)
6088 {
6089         u8 mcs = (u8) (rspec & RSPEC_RATE_MASK);
6090         plcp[0] = mcs;
6091         if (rspec_is40mhz(rspec) || (mcs == 32))
6092                 plcp[0] |= MIMO_PLCP_40MHZ;
6093         BRCMS_SET_MIMO_PLCP_LEN(plcp, length);
6094         plcp[3] = rspec_mimoplcp3(rspec); /* rspec already holds this byte */
6095         plcp[3] |= 0x7; /* set smoothing, not sounding ppdu & reserved */
6096         plcp[4] = 0; /* number of extension spatial streams bit 0 & 1 */
6097         plcp[5] = 0;
6098 }
6099
6100 /* Rate: 802.11 rate code, length: PSDU length in octets */
6101 static void
6102 brcms_c_compute_ofdm_plcp(u32 rspec, u32 length, u8 *plcp)
6103 {
6104         u8 rate_signal;
6105         u32 tmp = 0;
6106         int rate = rspec2rate(rspec);
6107
6108         /*
6109          * encode rate per 802.11a-1999 sec 17.3.4.1, with lsb
6110          * transmitted first
6111          */
6112         rate_signal = rate_info[rate] & BRCMS_RATE_MASK;
6113         memset(plcp, 0, D11_PHY_HDR_LEN);
6114         D11A_PHY_HDR_SRATE((struct ofdm_phy_hdr *) plcp, rate_signal);
6115
6116         tmp = (length & 0xfff) << 5;
6117         plcp[2] |= (tmp >> 16) & 0xff;
6118         plcp[1] |= (tmp >> 8) & 0xff;
6119         plcp[0] |= tmp & 0xff;
6120 }
6121
6122 /* Rate: 802.11 rate code, length: PSDU length in octets */
6123 static void brcms_c_compute_cck_plcp(struct brcms_c_info *wlc, u32 rspec,
6124                                  uint length, u8 *plcp)
6125 {
6126         int rate = rspec2rate(rspec);
6127
6128         brcms_c_cck_plcp_set(wlc, rate, length, plcp);
6129 }
6130
6131 static void
6132 brcms_c_compute_plcp(struct brcms_c_info *wlc, u32 rspec,
6133                      uint length, u8 *plcp)
6134 {
6135         if (is_mcs_rate(rspec))
6136                 brcms_c_compute_mimo_plcp(rspec, length, plcp);
6137         else if (is_ofdm_rate(rspec))
6138                 brcms_c_compute_ofdm_plcp(rspec, length, plcp);
6139         else
6140                 brcms_c_compute_cck_plcp(wlc, rspec, length, plcp);
6141 }
6142
6143 /* brcms_c_compute_rtscts_dur()
6144  *
6145  * Calculate the 802.11 MAC header DUR field for an RTS or CTS frame
6146  * DUR for normal RTS/CTS w/ frame = 3 SIFS + 1 CTS + next frame time + 1 ACK
6147  * DUR for CTS-TO-SELF w/ frame    = 2 SIFS         + next frame time + 1 ACK
6148  *
6149  * cts                  cts-to-self or rts/cts
6150  * rts_rate             rts or cts rate in unit of 500kbps
6151  * rate                 next MPDU rate in unit of 500kbps
6152  * frame_len            next MPDU frame length in bytes
6153  */
6154 u16
6155 brcms_c_compute_rtscts_dur(struct brcms_c_info *wlc, bool cts_only,
6156                            u32 rts_rate,
6157                            u32 frame_rate, u8 rts_preamble_type,
6158                            u8 frame_preamble_type, uint frame_len, bool ba)
6159 {
6160         u16 dur, sifs;
6161
6162         sifs = get_sifs(wlc->band);
6163
6164         if (!cts_only) {
6165                 /* RTS/CTS */
6166                 dur = 3 * sifs;
6167                 dur +=
6168                     (u16) brcms_c_calc_cts_time(wlc, rts_rate,
6169                                                rts_preamble_type);
6170         } else {
6171                 /* CTS-TO-SELF */
6172                 dur = 2 * sifs;
6173         }
6174
6175         dur +=
6176             (u16) brcms_c_calc_frame_time(wlc, frame_rate, frame_preamble_type,
6177                                          frame_len);
6178         if (ba)
6179                 dur +=
6180                     (u16) brcms_c_calc_ba_time(wlc, frame_rate,
6181                                               BRCMS_SHORT_PREAMBLE);
6182         else
6183                 dur +=
6184                     (u16) brcms_c_calc_ack_time(wlc, frame_rate,
6185                                                frame_preamble_type);
6186         return dur;
6187 }
6188
6189 static u16 brcms_c_phytxctl1_calc(struct brcms_c_info *wlc, u32 rspec)
6190 {
6191         u16 phyctl1 = 0;
6192         u16 bw;
6193
6194         if (BRCMS_ISLCNPHY(wlc->band)) {
6195                 bw = PHY_TXC1_BW_20MHZ;
6196         } else {
6197                 bw = rspec_get_bw(rspec);
6198                 /* 10Mhz is not supported yet */
6199                 if (bw < PHY_TXC1_BW_20MHZ) {
6200                         brcms_err(wlc->hw->d11core, "phytxctl1_calc: bw %d is "
6201                                   "not supported yet, set to 20L\n", bw);
6202                         bw = PHY_TXC1_BW_20MHZ;
6203                 }
6204         }
6205
6206         if (is_mcs_rate(rspec)) {
6207                 uint mcs = rspec & RSPEC_RATE_MASK;
6208
6209                 /* bw, stf, coding-type is part of rspec_phytxbyte2 returns */
6210                 phyctl1 = rspec_phytxbyte2(rspec);
6211                 /* set the upper byte of phyctl1 */
6212                 phyctl1 |= (mcs_table[mcs].tx_phy_ctl3 << 8);
6213         } else if (is_cck_rate(rspec) && !BRCMS_ISLCNPHY(wlc->band)
6214                    && !BRCMS_ISSSLPNPHY(wlc->band)) {
6215                 /*
6216                  * In CCK mode LPPHY overloads OFDM Modulation bits with CCK
6217                  * Data Rate. Eventually MIMOPHY would also be converted to
6218                  * this format
6219                  */
6220                 /* 0 = 1Mbps; 1 = 2Mbps; 2 = 5.5Mbps; 3 = 11Mbps */
6221                 phyctl1 = (bw | (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6222         } else {                /* legacy OFDM/CCK */
6223                 s16 phycfg;
6224                 /* get the phyctl byte from rate phycfg table */
6225                 phycfg = brcms_c_rate_legacy_phyctl(rspec2rate(rspec));
6226                 if (phycfg == -1) {
6227                         brcms_err(wlc->hw->d11core, "phytxctl1_calc: wrong "
6228                                   "legacy OFDM/CCK rate\n");
6229                         phycfg = 0;
6230                 }
6231                 /* set the upper byte of phyctl1 */
6232                 phyctl1 =
6233                     (bw | (phycfg << 8) |
6234                      (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6235         }
6236         return phyctl1;
6237 }
6238
6239 /*
6240  * Add struct d11txh, struct cck_phy_hdr.
6241  *
6242  * 'p' data must start with 802.11 MAC header
6243  * 'p' must allow enough bytes of local headers to be "pushed" onto the packet
6244  *
6245  * headroom == D11_PHY_HDR_LEN + D11_TXH_LEN (D11_TXH_LEN is now 104 bytes)
6246  *
6247  */
6248 static u16
6249 brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
6250                      struct sk_buff *p, struct scb *scb, uint frag,
6251                      uint nfrags, uint queue, uint next_frag_len)
6252 {
6253         struct ieee80211_hdr *h;
6254         struct d11txh *txh;
6255         u8 *plcp, plcp_fallback[D11_PHY_HDR_LEN];
6256         int len, phylen, rts_phylen;
6257         u16 mch, phyctl, xfts, mainrates;
6258         u16 seq = 0, mcl = 0, status = 0, frameid = 0;
6259         u32 rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6260         u32 rts_rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6261         bool use_rts = false;
6262         bool use_cts = false;
6263         bool use_rifs = false;
6264         bool short_preamble[2] = { false, false };
6265         u8 preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6266         u8 rts_preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6267         u8 *rts_plcp, rts_plcp_fallback[D11_PHY_HDR_LEN];
6268         struct ieee80211_rts *rts = NULL;
6269         bool qos;
6270         uint ac;
6271         bool hwtkmic = false;
6272         u16 mimo_ctlchbw = PHY_TXC1_BW_20MHZ;
6273 #define ANTCFG_NONE 0xFF
6274         u8 antcfg = ANTCFG_NONE;
6275         u8 fbantcfg = ANTCFG_NONE;
6276         uint phyctl1_stf = 0;
6277         u16 durid = 0;
6278         struct ieee80211_tx_rate *txrate[2];
6279         int k;
6280         struct ieee80211_tx_info *tx_info;
6281         bool is_mcs;
6282         u16 mimo_txbw;
6283         u8 mimo_preamble_type;
6284
6285         /* locate 802.11 MAC header */
6286         h = (struct ieee80211_hdr *)(p->data);
6287         qos = ieee80211_is_data_qos(h->frame_control);
6288
6289         /* compute length of frame in bytes for use in PLCP computations */
6290         len = p->len;
6291         phylen = len + FCS_LEN;
6292
6293         /* Get tx_info */
6294         tx_info = IEEE80211_SKB_CB(p);
6295
6296         /* add PLCP */
6297         plcp = skb_push(p, D11_PHY_HDR_LEN);
6298
6299         /* add Broadcom tx descriptor header */
6300         txh = (struct d11txh *) skb_push(p, D11_TXH_LEN);
6301         memset(txh, 0, D11_TXH_LEN);
6302
6303         /* setup frameid */
6304         if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
6305                 /* non-AP STA should never use BCMC queue */
6306                 if (queue == TX_BCMC_FIFO) {
6307                         brcms_err(wlc->hw->d11core,
6308                                   "wl%d: %s: ASSERT queue == TX_BCMC!\n",
6309                                   wlc->pub->unit, __func__);
6310                         frameid = bcmc_fid_generate(wlc, NULL, txh);
6311                 } else {
6312                         /* Increment the counter for first fragment */
6313                         if (tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
6314                                 scb->seqnum[p->priority]++;
6315
6316                         /* extract fragment number from frame first */
6317                         seq = le16_to_cpu(h->seq_ctrl) & FRAGNUM_MASK;
6318                         seq |= (scb->seqnum[p->priority] << SEQNUM_SHIFT);
6319                         h->seq_ctrl = cpu_to_le16(seq);
6320
6321                         frameid = ((seq << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
6322                             (queue & TXFID_QUEUE_MASK);
6323                 }
6324         }
6325         frameid |= queue & TXFID_QUEUE_MASK;
6326
6327         /* set the ignpmq bit for all pkts tx'd in PS mode and for beacons */
6328         if (ieee80211_is_beacon(h->frame_control))
6329                 mcl |= TXC_IGNOREPMQ;
6330
6331         txrate[0] = tx_info->control.rates;
6332         txrate[1] = txrate[0] + 1;
6333
6334         /*
6335          * if rate control algorithm didn't give us a fallback
6336          * rate, use the primary rate
6337          */
6338         if (txrate[1]->idx < 0)
6339                 txrate[1] = txrate[0];
6340
6341         for (k = 0; k < hw->max_rates; k++) {
6342                 is_mcs = txrate[k]->flags & IEEE80211_TX_RC_MCS ? true : false;
6343                 if (!is_mcs) {
6344                         if ((txrate[k]->idx >= 0)
6345                             && (txrate[k]->idx <
6346                                 hw->wiphy->bands[tx_info->band]->n_bitrates)) {
6347                                 rspec[k] =
6348                                     hw->wiphy->bands[tx_info->band]->
6349                                     bitrates[txrate[k]->idx].hw_value;
6350                                 short_preamble[k] =
6351                                     txrate[k]->
6352                                     flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ?
6353                                     true : false;
6354                         } else {
6355                                 rspec[k] = BRCM_RATE_1M;
6356                         }
6357                 } else {
6358                         rspec[k] = mac80211_wlc_set_nrate(wlc, wlc->band,
6359                                         NRATE_MCS_INUSE | txrate[k]->idx);
6360                 }
6361
6362                 /*
6363                  * Currently only support same setting for primay and
6364                  * fallback rates. Unify flags for each rate into a
6365                  * single value for the frame
6366                  */
6367                 use_rts |=
6368                     txrate[k]->
6369                     flags & IEEE80211_TX_RC_USE_RTS_CTS ? true : false;
6370                 use_cts |=
6371                     txrate[k]->
6372                     flags & IEEE80211_TX_RC_USE_CTS_PROTECT ? true : false;
6373
6374
6375                 /*
6376                  * (1) RATE:
6377                  *   determine and validate primary rate
6378                  *   and fallback rates
6379                  */
6380                 if (!rspec_active(rspec[k])) {
6381                         rspec[k] = BRCM_RATE_1M;
6382                 } else {
6383                         if (!is_multicast_ether_addr(h->addr1)) {
6384                                 /* set tx antenna config */
6385                                 brcms_c_antsel_antcfg_get(wlc->asi, false,
6386                                         false, 0, 0, &antcfg, &fbantcfg);
6387                         }
6388                 }
6389         }
6390
6391         phyctl1_stf = wlc->stf->ss_opmode;
6392
6393         if (wlc->pub->_n_enab & SUPPORT_11N) {
6394                 for (k = 0; k < hw->max_rates; k++) {
6395                         /*
6396                          * apply siso/cdd to single stream mcs's or ofdm
6397                          * if rspec is auto selected
6398                          */
6399                         if (((is_mcs_rate(rspec[k]) &&
6400                               is_single_stream(rspec[k] & RSPEC_RATE_MASK)) ||
6401                              is_ofdm_rate(rspec[k]))
6402                             && ((rspec[k] & RSPEC_OVERRIDE_MCS_ONLY)
6403                                 || !(rspec[k] & RSPEC_OVERRIDE))) {
6404                                 rspec[k] &= ~(RSPEC_STF_MASK | RSPEC_STC_MASK);
6405
6406                                 /* For SISO MCS use STBC if possible */
6407                                 if (is_mcs_rate(rspec[k])
6408                                     && BRCMS_STF_SS_STBC_TX(wlc, scb)) {
6409                                         u8 stc;
6410
6411                                         /* Nss for single stream is always 1 */
6412                                         stc = 1;
6413                                         rspec[k] |= (PHY_TXC1_MODE_STBC <<
6414                                                         RSPEC_STF_SHIFT) |
6415                                                     (stc << RSPEC_STC_SHIFT);
6416                                 } else
6417                                         rspec[k] |=
6418                                             (phyctl1_stf << RSPEC_STF_SHIFT);
6419                         }
6420
6421                         /*
6422                          * Is the phy configured to use 40MHZ frames? If
6423                          * so then pick the desired txbw
6424                          */
6425                         if (brcms_chspec_bw(wlc->chanspec) == BRCMS_40_MHZ) {
6426                                 /* default txbw is 20in40 SB */
6427                                 mimo_ctlchbw = mimo_txbw =
6428                                    CHSPEC_SB_UPPER(wlc_phy_chanspec_get(
6429                                                                  wlc->band->pi))
6430                                    ? PHY_TXC1_BW_20MHZ_UP : PHY_TXC1_BW_20MHZ;
6431
6432                                 if (is_mcs_rate(rspec[k])) {
6433                                         /* mcs 32 must be 40b/w DUP */
6434                                         if ((rspec[k] & RSPEC_RATE_MASK)
6435                                             == 32) {
6436                                                 mimo_txbw =
6437                                                     PHY_TXC1_BW_40MHZ_DUP;
6438                                                 /* use override */
6439                                         } else if (wlc->mimo_40txbw != AUTO)
6440                                                 mimo_txbw = wlc->mimo_40txbw;
6441                                         /* else check if dst is using 40 Mhz */
6442                                         else if (scb->flags & SCB_IS40)
6443                                                 mimo_txbw = PHY_TXC1_BW_40MHZ;
6444                                 } else if (is_ofdm_rate(rspec[k])) {
6445                                         if (wlc->ofdm_40txbw != AUTO)
6446                                                 mimo_txbw = wlc->ofdm_40txbw;
6447                                 } else if (wlc->cck_40txbw != AUTO) {
6448                                         mimo_txbw = wlc->cck_40txbw;
6449                                 }
6450                         } else {
6451                                 /*
6452                                  * mcs32 is 40 b/w only.
6453                                  * This is possible for probe packets on
6454                                  * a STA during SCAN
6455                                  */
6456                                 if ((rspec[k] & RSPEC_RATE_MASK) == 32)
6457                                         /* mcs 0 */
6458                                         rspec[k] = RSPEC_MIMORATE;
6459
6460                                 mimo_txbw = PHY_TXC1_BW_20MHZ;
6461                         }
6462
6463                         /* Set channel width */
6464                         rspec[k] &= ~RSPEC_BW_MASK;
6465                         if ((k == 0) || ((k > 0) && is_mcs_rate(rspec[k])))
6466                                 rspec[k] |= (mimo_txbw << RSPEC_BW_SHIFT);
6467                         else
6468                                 rspec[k] |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
6469
6470                         /* Disable short GI, not supported yet */
6471                         rspec[k] &= ~RSPEC_SHORT_GI;
6472
6473                         mimo_preamble_type = BRCMS_MM_PREAMBLE;
6474                         if (txrate[k]->flags & IEEE80211_TX_RC_GREEN_FIELD)
6475                                 mimo_preamble_type = BRCMS_GF_PREAMBLE;
6476
6477                         if ((txrate[k]->flags & IEEE80211_TX_RC_MCS)
6478                             && (!is_mcs_rate(rspec[k]))) {
6479                                 brcms_warn(wlc->hw->d11core,
6480                                            "wl%d: %s: IEEE80211_TX_RC_MCS != is_mcs_rate(rspec)\n",
6481                                            wlc->pub->unit, __func__);
6482                         }
6483
6484                         if (is_mcs_rate(rspec[k])) {
6485                                 preamble_type[k] = mimo_preamble_type;
6486
6487                                 /*
6488                                  * if SGI is selected, then forced mm
6489                                  * for single stream
6490                                  */
6491                                 if ((rspec[k] & RSPEC_SHORT_GI)
6492                                     && is_single_stream(rspec[k] &
6493                                                         RSPEC_RATE_MASK))
6494                                         preamble_type[k] = BRCMS_MM_PREAMBLE;
6495                         }
6496
6497                         /* should be better conditionalized */
6498                         if (!is_mcs_rate(rspec[0])
6499                             && (tx_info->control.rates[0].
6500                                 flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
6501                                 preamble_type[k] = BRCMS_SHORT_PREAMBLE;
6502                 }
6503         } else {
6504                 for (k = 0; k < hw->max_rates; k++) {
6505                         /* Set ctrlchbw as 20Mhz */
6506                         rspec[k] &= ~RSPEC_BW_MASK;
6507                         rspec[k] |= (PHY_TXC1_BW_20MHZ << RSPEC_BW_SHIFT);
6508
6509                         /* for nphy, stf of ofdm frames must follow policies */
6510                         if (BRCMS_ISNPHY(wlc->band) && is_ofdm_rate(rspec[k])) {
6511                                 rspec[k] &= ~RSPEC_STF_MASK;
6512                                 rspec[k] |= phyctl1_stf << RSPEC_STF_SHIFT;
6513                         }
6514                 }
6515         }
6516
6517         /* Reset these for use with AMPDU's */
6518         txrate[0]->count = 0;
6519         txrate[1]->count = 0;
6520
6521         /* (2) PROTECTION, may change rspec */
6522         if ((ieee80211_is_data(h->frame_control) ||
6523             ieee80211_is_mgmt(h->frame_control)) &&
6524             (phylen > wlc->RTSThresh) && !is_multicast_ether_addr(h->addr1))
6525                 use_rts = true;
6526
6527         /* (3) PLCP: determine PLCP header and MAC duration,
6528          * fill struct d11txh */
6529         brcms_c_compute_plcp(wlc, rspec[0], phylen, plcp);
6530         brcms_c_compute_plcp(wlc, rspec[1], phylen, plcp_fallback);
6531         memcpy(&txh->FragPLCPFallback,
6532                plcp_fallback, sizeof(txh->FragPLCPFallback));
6533
6534         /* Length field now put in CCK FBR CRC field */
6535         if (is_cck_rate(rspec[1])) {
6536                 txh->FragPLCPFallback[4] = phylen & 0xff;
6537                 txh->FragPLCPFallback[5] = (phylen & 0xff00) >> 8;
6538         }
6539
6540         /* MIMO-RATE: need validation ?? */
6541         mainrates = is_ofdm_rate(rspec[0]) ?
6542                         D11A_PHY_HDR_GRATE((struct ofdm_phy_hdr *) plcp) :
6543                         plcp[0];
6544
6545         /* DUR field for main rate */
6546         if (!ieee80211_is_pspoll(h->frame_control) &&
6547             !is_multicast_ether_addr(h->addr1) && !use_rifs) {
6548                 durid =
6549                     brcms_c_compute_frame_dur(wlc, rspec[0], preamble_type[0],
6550                                           next_frag_len);
6551                 h->duration_id = cpu_to_le16(durid);
6552         } else if (use_rifs) {
6553                 /* NAV protect to end of next max packet size */
6554                 durid =
6555                     (u16) brcms_c_calc_frame_time(wlc, rspec[0],
6556                                                  preamble_type[0],
6557                                                  DOT11_MAX_FRAG_LEN);
6558                 durid += RIFS_11N_TIME;
6559                 h->duration_id = cpu_to_le16(durid);
6560         }
6561
6562         /* DUR field for fallback rate */
6563         if (ieee80211_is_pspoll(h->frame_control))
6564                 txh->FragDurFallback = h->duration_id;
6565         else if (is_multicast_ether_addr(h->addr1) || use_rifs)
6566                 txh->FragDurFallback = 0;
6567         else {
6568                 durid = brcms_c_compute_frame_dur(wlc, rspec[1],
6569                                               preamble_type[1], next_frag_len);
6570                 txh->FragDurFallback = cpu_to_le16(durid);
6571         }
6572
6573         /* (4) MAC-HDR: MacTxControlLow */
6574         if (frag == 0)
6575                 mcl |= TXC_STARTMSDU;
6576
6577         if (!is_multicast_ether_addr(h->addr1))
6578                 mcl |= TXC_IMMEDACK;
6579
6580         if (wlc->band->bandtype == BRCM_BAND_5G)
6581                 mcl |= TXC_FREQBAND_5G;
6582
6583         if (CHSPEC_IS40(wlc_phy_chanspec_get(wlc->band->pi)))
6584                 mcl |= TXC_BW_40;
6585
6586         /* set AMIC bit if using hardware TKIP MIC */
6587         if (hwtkmic)
6588                 mcl |= TXC_AMIC;
6589
6590         txh->MacTxControlLow = cpu_to_le16(mcl);
6591
6592         /* MacTxControlHigh */
6593         mch = 0;
6594
6595         /* Set fallback rate preamble type */
6596         if ((preamble_type[1] == BRCMS_SHORT_PREAMBLE) ||
6597             (preamble_type[1] == BRCMS_GF_PREAMBLE)) {
6598                 if (rspec2rate(rspec[1]) != BRCM_RATE_1M)
6599                         mch |= TXC_PREAMBLE_DATA_FB_SHORT;
6600         }
6601
6602         /* MacFrameControl */
6603         memcpy(&txh->MacFrameControl, &h->frame_control, sizeof(u16));
6604         txh->TxFesTimeNormal = cpu_to_le16(0);
6605
6606         txh->TxFesTimeFallback = cpu_to_le16(0);
6607
6608         /* TxFrameRA */
6609         memcpy(&txh->TxFrameRA, &h->addr1, ETH_ALEN);
6610
6611         /* TxFrameID */
6612         txh->TxFrameID = cpu_to_le16(frameid);
6613
6614         /*
6615          * TxStatus, Note the case of recreating the first frag of a suppressed
6616          * frame then we may need to reset the retry cnt's via the status reg
6617          */
6618         txh->TxStatus = cpu_to_le16(status);
6619
6620         /*
6621          * extra fields for ucode AMPDU aggregation, the new fields are added to
6622          * the END of previous structure so that it's compatible in driver.
6623          */
6624         txh->MaxNMpdus = cpu_to_le16(0);
6625         txh->MaxABytes_MRT = cpu_to_le16(0);
6626         txh->MaxABytes_FBR = cpu_to_le16(0);
6627         txh->MinMBytes = cpu_to_le16(0);
6628
6629         /* (5) RTS/CTS: determine RTS/CTS PLCP header and MAC duration,
6630          * furnish struct d11txh */
6631         /* RTS PLCP header and RTS frame */
6632         if (use_rts || use_cts) {
6633                 if (use_rts && use_cts)
6634                         use_cts = false;
6635
6636                 for (k = 0; k < 2; k++) {
6637                         rts_rspec[k] = brcms_c_rspec_to_rts_rspec(wlc, rspec[k],
6638                                                               false,
6639                                                               mimo_ctlchbw);
6640                 }
6641
6642                 if (!is_ofdm_rate(rts_rspec[0]) &&
6643                     !((rspec2rate(rts_rspec[0]) == BRCM_RATE_1M) ||
6644                       (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6645                         rts_preamble_type[0] = BRCMS_SHORT_PREAMBLE;
6646                         mch |= TXC_PREAMBLE_RTS_MAIN_SHORT;
6647                 }
6648
6649                 if (!is_ofdm_rate(rts_rspec[1]) &&
6650                     !((rspec2rate(rts_rspec[1]) == BRCM_RATE_1M) ||
6651                       (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6652                         rts_preamble_type[1] = BRCMS_SHORT_PREAMBLE;
6653                         mch |= TXC_PREAMBLE_RTS_FB_SHORT;
6654                 }
6655
6656                 /* RTS/CTS additions to MacTxControlLow */
6657                 if (use_cts) {
6658                         txh->MacTxControlLow |= cpu_to_le16(TXC_SENDCTS);
6659                 } else {
6660                         txh->MacTxControlLow |= cpu_to_le16(TXC_SENDRTS);
6661                         txh->MacTxControlLow |= cpu_to_le16(TXC_LONGFRAME);
6662                 }
6663
6664                 /* RTS PLCP header */
6665                 rts_plcp = txh->RTSPhyHeader;
6666                 if (use_cts)
6667                         rts_phylen = DOT11_CTS_LEN + FCS_LEN;
6668                 else
6669                         rts_phylen = DOT11_RTS_LEN + FCS_LEN;
6670
6671                 brcms_c_compute_plcp(wlc, rts_rspec[0], rts_phylen, rts_plcp);
6672
6673                 /* fallback rate version of RTS PLCP header */
6674                 brcms_c_compute_plcp(wlc, rts_rspec[1], rts_phylen,
6675                                  rts_plcp_fallback);
6676                 memcpy(&txh->RTSPLCPFallback, rts_plcp_fallback,
6677                        sizeof(txh->RTSPLCPFallback));
6678
6679                 /* RTS frame fields... */
6680                 rts = (struct ieee80211_rts *)&txh->rts_frame;
6681
6682                 durid = brcms_c_compute_rtscts_dur(wlc, use_cts, rts_rspec[0],
6683                                                rspec[0], rts_preamble_type[0],
6684                                                preamble_type[0], phylen, false);
6685                 rts->duration = cpu_to_le16(durid);
6686                 /* fallback rate version of RTS DUR field */
6687                 durid = brcms_c_compute_rtscts_dur(wlc, use_cts,
6688                                                rts_rspec[1], rspec[1],
6689                                                rts_preamble_type[1],
6690                                                preamble_type[1], phylen, false);
6691                 txh->RTSDurFallback = cpu_to_le16(durid);
6692
6693                 if (use_cts) {
6694                         rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6695                                                          IEEE80211_STYPE_CTS);
6696
6697                         memcpy(&rts->ra, &h->addr2, ETH_ALEN);
6698                 } else {
6699                         rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6700                                                          IEEE80211_STYPE_RTS);
6701
6702                         memcpy(&rts->ra, &h->addr1, 2 * ETH_ALEN);
6703                 }
6704
6705                 /* mainrate
6706                  *    low 8 bits: main frag rate/mcs,
6707                  *    high 8 bits: rts/cts rate/mcs
6708                  */
6709                 mainrates |= (is_ofdm_rate(rts_rspec[0]) ?
6710                                 D11A_PHY_HDR_GRATE(
6711                                         (struct ofdm_phy_hdr *) rts_plcp) :
6712                                 rts_plcp[0]) << 8;
6713         } else {
6714                 memset(txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
6715                 memset(&txh->rts_frame, 0, sizeof(struct ieee80211_rts));
6716                 memset(txh->RTSPLCPFallback, 0, sizeof(txh->RTSPLCPFallback));
6717                 txh->RTSDurFallback = 0;
6718         }
6719
6720 #ifdef SUPPORT_40MHZ
6721         /* add null delimiter count */
6722         if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && is_mcs_rate(rspec))
6723                 txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM] =
6724                    brcm_c_ampdu_null_delim_cnt(wlc->ampdu, scb, rspec, phylen);
6725
6726 #endif
6727
6728         /*
6729          * Now that RTS/RTS FB preamble types are updated, write
6730          * the final value
6731          */
6732         txh->MacTxControlHigh = cpu_to_le16(mch);
6733
6734         /*
6735          * MainRates (both the rts and frag plcp rates have
6736          * been calculated now)
6737          */
6738         txh->MainRates = cpu_to_le16(mainrates);
6739
6740         /* XtraFrameTypes */
6741         xfts = frametype(rspec[1], wlc->mimoft);
6742         xfts |= (frametype(rts_rspec[0], wlc->mimoft) << XFTS_RTS_FT_SHIFT);
6743         xfts |= (frametype(rts_rspec[1], wlc->mimoft) << XFTS_FBRRTS_FT_SHIFT);
6744         xfts |= CHSPEC_CHANNEL(wlc_phy_chanspec_get(wlc->band->pi)) <<
6745                                                              XFTS_CHANNEL_SHIFT;
6746         txh->XtraFrameTypes = cpu_to_le16(xfts);
6747
6748         /* PhyTxControlWord */
6749         phyctl = frametype(rspec[0], wlc->mimoft);
6750         if ((preamble_type[0] == BRCMS_SHORT_PREAMBLE) ||
6751             (preamble_type[0] == BRCMS_GF_PREAMBLE)) {
6752                 if (rspec2rate(rspec[0]) != BRCM_RATE_1M)
6753                         phyctl |= PHY_TXC_SHORT_HDR;
6754         }
6755
6756         /* phytxant is properly bit shifted */
6757         phyctl |= brcms_c_stf_d11hdrs_phyctl_txant(wlc, rspec[0]);
6758         txh->PhyTxControlWord = cpu_to_le16(phyctl);
6759
6760         /* PhyTxControlWord_1 */
6761         if (BRCMS_PHY_11N_CAP(wlc->band)) {
6762                 u16 phyctl1 = 0;
6763
6764                 phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[0]);
6765                 txh->PhyTxControlWord_1 = cpu_to_le16(phyctl1);
6766                 phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[1]);
6767                 txh->PhyTxControlWord_1_Fbr = cpu_to_le16(phyctl1);
6768
6769                 if (use_rts || use_cts) {
6770                         phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[0]);
6771                         txh->PhyTxControlWord_1_Rts = cpu_to_le16(phyctl1);
6772                         phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[1]);
6773                         txh->PhyTxControlWord_1_FbrRts = cpu_to_le16(phyctl1);
6774                 }
6775
6776                 /*
6777                  * For mcs frames, if mixedmode(overloaded with long preamble)
6778                  * is going to be set, fill in non-zero MModeLen and/or
6779                  * MModeFbrLen it will be unnecessary if they are separated
6780                  */
6781                 if (is_mcs_rate(rspec[0]) &&
6782                     (preamble_type[0] == BRCMS_MM_PREAMBLE)) {
6783                         u16 mmodelen =
6784                             brcms_c_calc_lsig_len(wlc, rspec[0], phylen);
6785                         txh->MModeLen = cpu_to_le16(mmodelen);
6786                 }
6787
6788                 if (is_mcs_rate(rspec[1]) &&
6789                     (preamble_type[1] == BRCMS_MM_PREAMBLE)) {
6790                         u16 mmodefbrlen =
6791                             brcms_c_calc_lsig_len(wlc, rspec[1], phylen);
6792                         txh->MModeFbrLen = cpu_to_le16(mmodefbrlen);
6793                 }
6794         }
6795
6796         ac = skb_get_queue_mapping(p);
6797         if ((scb->flags & SCB_WMECAP) && qos && wlc->edcf_txop[ac]) {
6798                 uint frag_dur, dur, dur_fallback;
6799
6800                 /* WME: Update TXOP threshold */
6801                 if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU) && frag == 0) {
6802                         frag_dur =
6803                             brcms_c_calc_frame_time(wlc, rspec[0],
6804                                         preamble_type[0], phylen);
6805
6806                         if (rts) {
6807                                 /* 1 RTS or CTS-to-self frame */
6808                                 dur =
6809                                     brcms_c_calc_cts_time(wlc, rts_rspec[0],
6810                                                       rts_preamble_type[0]);
6811                                 dur_fallback =
6812                                     brcms_c_calc_cts_time(wlc, rts_rspec[1],
6813                                                       rts_preamble_type[1]);
6814                                 /* (SIFS + CTS) + SIFS + frame + SIFS + ACK */
6815                                 dur += le16_to_cpu(rts->duration);
6816                                 dur_fallback +=
6817                                         le16_to_cpu(txh->RTSDurFallback);
6818                         } else if (use_rifs) {
6819                                 dur = frag_dur;
6820                                 dur_fallback = 0;
6821                         } else {
6822                                 /* frame + SIFS + ACK */
6823                                 dur = frag_dur;
6824                                 dur +=
6825                                     brcms_c_compute_frame_dur(wlc, rspec[0],
6826                                                           preamble_type[0], 0);
6827
6828                                 dur_fallback =
6829                                     brcms_c_calc_frame_time(wlc, rspec[1],
6830                                                         preamble_type[1],
6831                                                         phylen);
6832                                 dur_fallback +=
6833                                     brcms_c_compute_frame_dur(wlc, rspec[1],
6834                                                           preamble_type[1], 0);
6835                         }
6836                         /* NEED to set TxFesTimeNormal (hard) */
6837                         txh->TxFesTimeNormal = cpu_to_le16((u16) dur);
6838                         /*
6839                          * NEED to set fallback rate version of
6840                          * TxFesTimeNormal (hard)
6841                          */
6842                         txh->TxFesTimeFallback =
6843                                 cpu_to_le16((u16) dur_fallback);
6844
6845                         /*
6846                          * update txop byte threshold (txop minus intraframe
6847                          * overhead)
6848                          */
6849                         if (wlc->edcf_txop[ac] >= (dur - frag_dur)) {
6850                                 uint newfragthresh;
6851
6852                                 newfragthresh =
6853                                     brcms_c_calc_frame_len(wlc,
6854                                         rspec[0], preamble_type[0],
6855                                         (wlc->edcf_txop[ac] -
6856                                                 (dur - frag_dur)));
6857                                 /* range bound the fragthreshold */
6858                                 if (newfragthresh < DOT11_MIN_FRAG_LEN)
6859                                         newfragthresh =
6860                                             DOT11_MIN_FRAG_LEN;
6861                                 else if (newfragthresh >
6862                                          wlc->usr_fragthresh)
6863                                         newfragthresh =
6864                                             wlc->usr_fragthresh;
6865                                 /* update the fragthresh and do txc update */
6866                                 if (wlc->fragthresh[queue] !=
6867                                     (u16) newfragthresh)
6868                                         wlc->fragthresh[queue] =
6869                                             (u16) newfragthresh;
6870                         } else {
6871                                 brcms_warn(wlc->hw->d11core,
6872                                            "wl%d: %s txop invalid for rate %d\n",
6873                                            wlc->pub->unit, fifo_names[queue],
6874                                            rspec2rate(rspec[0]));
6875                         }
6876
6877                         if (dur > wlc->edcf_txop[ac])
6878                                 brcms_warn(wlc->hw->d11core,
6879                                            "wl%d: %s: %s txop exceeded phylen %d/%d dur %d/%d\n",
6880                                            wlc->pub->unit, __func__,
6881                                            fifo_names[queue],
6882                                            phylen, wlc->fragthresh[queue],
6883                                            dur, wlc->edcf_txop[ac]);
6884                 }
6885         }
6886
6887         return 0;
6888 }
6889
6890 static int brcms_c_tx(struct brcms_c_info *wlc, struct sk_buff *skb)
6891 {
6892         struct dma_pub *dma;
6893         int fifo, ret = -ENOSPC;
6894         struct d11txh *txh;
6895         u16 frameid = INVALIDFID;
6896
6897         fifo = brcms_ac_to_fifo(skb_get_queue_mapping(skb));
6898         dma = wlc->hw->di[fifo];
6899         txh = (struct d11txh *)(skb->data);
6900
6901         if (dma->txavail == 0) {
6902                 /*
6903                  * We sometimes get a frame from mac80211 after stopping
6904                  * the queues. This only ever seems to be a single frame
6905                  * and is seems likely to be a race. TX_HEADROOM should
6906                  * ensure that we have enough space to handle these stray
6907                  * packets, so warn if there isn't. If we're out of space
6908                  * in the tx ring and the tx queue isn't stopped then
6909                  * we've really got a bug; warn loudly if that happens.
6910                  */
6911                 brcms_warn(wlc->hw->d11core,
6912                            "Received frame for tx with no space in DMA ring\n");
6913                 WARN_ON(!ieee80211_queue_stopped(wlc->pub->ieee_hw,
6914                                                  skb_get_queue_mapping(skb)));
6915                 return -ENOSPC;
6916         }
6917
6918         /* When a BC/MC frame is being committed to the BCMC fifo
6919          * via DMA (NOT PIO), update ucode or BSS info as appropriate.
6920          */
6921         if (fifo == TX_BCMC_FIFO)
6922                 frameid = le16_to_cpu(txh->TxFrameID);
6923
6924         /* Commit BCMC sequence number in the SHM frame ID location */
6925         if (frameid != INVALIDFID) {
6926                 /*
6927                  * To inform the ucode of the last mcast frame posted
6928                  * so that it can clear moredata bit
6929                  */
6930                 brcms_b_write_shm(wlc->hw, M_BCMC_FID, frameid);
6931         }
6932
6933         ret = brcms_c_txfifo(wlc, fifo, skb);
6934         /*
6935          * The only reason for brcms_c_txfifo to fail is because
6936          * there weren't any DMA descriptors, but we've already
6937          * checked for that. So if it does fail yell loudly.
6938          */
6939         WARN_ON_ONCE(ret);
6940
6941         return ret;
6942 }
6943
6944 bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
6945                               struct ieee80211_hw *hw)
6946 {
6947         uint fifo;
6948         struct scb *scb = &wlc->pri_scb;
6949
6950         fifo = brcms_ac_to_fifo(skb_get_queue_mapping(sdu));
6951         brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0);
6952         if (!brcms_c_tx(wlc, sdu))
6953                 return true;
6954
6955         /* packet discarded */
6956         dev_kfree_skb_any(sdu);
6957         return false;
6958 }
6959
6960 int
6961 brcms_c_txfifo(struct brcms_c_info *wlc, uint fifo, struct sk_buff *p)
6962 {
6963         struct dma_pub *dma = wlc->hw->di[fifo];
6964         int ret;
6965         u16 queue;
6966
6967         ret = dma_txfast(wlc, dma, p);
6968         if (ret < 0)
6969                 wiphy_err(wlc->wiphy, "txfifo: fatal, toss frames !!!\n");
6970
6971         /*
6972          * Stop queue if DMA ring is full. Reserve some free descriptors,
6973          * as we sometimes receive a frame from mac80211 after the queues
6974          * are stopped.
6975          */
6976         queue = skb_get_queue_mapping(p);
6977         if (dma->txavail <= TX_HEADROOM && fifo < TX_BCMC_FIFO &&
6978             !ieee80211_queue_stopped(wlc->pub->ieee_hw, queue))
6979                 ieee80211_stop_queue(wlc->pub->ieee_hw, queue);
6980
6981         return ret;
6982 }
6983
6984 u32
6985 brcms_c_rspec_to_rts_rspec(struct brcms_c_info *wlc, u32 rspec,
6986                            bool use_rspec, u16 mimo_ctlchbw)
6987 {
6988         u32 rts_rspec = 0;
6989
6990         if (use_rspec)
6991                 /* use frame rate as rts rate */
6992                 rts_rspec = rspec;
6993         else if (wlc->band->gmode && wlc->protection->_g && !is_cck_rate(rspec))
6994                 /* Use 11Mbps as the g protection RTS target rate and fallback.
6995                  * Use the brcms_basic_rate() lookup to find the best basic rate
6996                  * under the target in case 11 Mbps is not Basic.
6997                  * 6 and 9 Mbps are not usually selected by rate selection, but
6998                  * even if the OFDM rate we are protecting is 6 or 9 Mbps, 11
6999                  * is more robust.
7000                  */
7001                 rts_rspec = brcms_basic_rate(wlc, BRCM_RATE_11M);
7002         else
7003                 /* calculate RTS rate and fallback rate based on the frame rate
7004                  * RTS must be sent at a basic rate since it is a
7005                  * control frame, sec 9.6 of 802.11 spec
7006                  */
7007                 rts_rspec = brcms_basic_rate(wlc, rspec);
7008
7009         if (BRCMS_PHY_11N_CAP(wlc->band)) {
7010                 /* set rts txbw to correct side band */
7011                 rts_rspec &= ~RSPEC_BW_MASK;
7012
7013                 /*
7014                  * if rspec/rspec_fallback is 40MHz, then send RTS on both
7015                  * 20MHz channel (DUP), otherwise send RTS on control channel
7016                  */
7017                 if (rspec_is40mhz(rspec) && !is_cck_rate(rts_rspec))
7018                         rts_rspec |= (PHY_TXC1_BW_40MHZ_DUP << RSPEC_BW_SHIFT);
7019                 else
7020                         rts_rspec |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
7021
7022                 /* pick siso/cdd as default for ofdm */
7023                 if (is_ofdm_rate(rts_rspec)) {
7024                         rts_rspec &= ~RSPEC_STF_MASK;
7025                         rts_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
7026                 }
7027         }
7028         return rts_rspec;
7029 }
7030
7031 /* Update beacon listen interval in shared memory */
7032 static void brcms_c_bcn_li_upd(struct brcms_c_info *wlc)
7033 {
7034         /* wake up every DTIM is the default */
7035         if (wlc->bcn_li_dtim == 1)
7036                 brcms_b_write_shm(wlc->hw, M_BCN_LI, 0);
7037         else
7038                 brcms_b_write_shm(wlc->hw, M_BCN_LI,
7039                               (wlc->bcn_li_dtim << 8) | wlc->bcn_li_bcn);
7040 }
7041
7042 static void
7043 brcms_b_read_tsf(struct brcms_hardware *wlc_hw, u32 *tsf_l_ptr,
7044                   u32 *tsf_h_ptr)
7045 {
7046         struct bcma_device *core = wlc_hw->d11core;
7047
7048         /* read the tsf timer low, then high to get an atomic read */
7049         *tsf_l_ptr = bcma_read32(core, D11REGOFFS(tsf_timerlow));
7050         *tsf_h_ptr = bcma_read32(core, D11REGOFFS(tsf_timerhigh));
7051 }
7052
7053 /*
7054  * recover 64bit TSF value from the 16bit TSF value in the rx header
7055  * given the assumption that the TSF passed in header is within 65ms
7056  * of the current tsf.
7057  *
7058  * 6       5       4       4       3       2       1
7059  * 3.......6.......8.......0.......2.......4.......6.......8......0
7060  * |<---------- tsf_h ----------->||<--- tsf_l -->||<-RxTSFTime ->|
7061  *
7062  * The RxTSFTime are the lowest 16 bits and provided by the ucode. The
7063  * tsf_l is filled in by brcms_b_recv, which is done earlier in the
7064  * receive call sequence after rx interrupt. Only the higher 16 bits
7065  * are used. Finally, the tsf_h is read from the tsf register.
7066  */
7067 static u64 brcms_c_recover_tsf64(struct brcms_c_info *wlc,
7068                                  struct d11rxhdr *rxh)
7069 {
7070         u32 tsf_h, tsf_l;
7071         u16 rx_tsf_0_15, rx_tsf_16_31;
7072
7073         brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7074
7075         rx_tsf_16_31 = (u16)(tsf_l >> 16);
7076         rx_tsf_0_15 = rxh->RxTSFTime;
7077
7078         /*
7079          * a greater tsf time indicates the low 16 bits of
7080          * tsf_l wrapped, so decrement the high 16 bits.
7081          */
7082         if ((u16)tsf_l < rx_tsf_0_15) {
7083                 rx_tsf_16_31 -= 1;
7084                 if (rx_tsf_16_31 == 0xffff)
7085                         tsf_h -= 1;
7086         }
7087
7088         return ((u64)tsf_h << 32) | (((u32)rx_tsf_16_31 << 16) + rx_tsf_0_15);
7089 }
7090
7091 static void
7092 prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7093                      struct sk_buff *p,
7094                      struct ieee80211_rx_status *rx_status)
7095 {
7096         int preamble;
7097         int channel;
7098         u32 rspec;
7099         unsigned char *plcp;
7100
7101         /* fill in TSF and flag its presence */
7102         rx_status->mactime = brcms_c_recover_tsf64(wlc, rxh);
7103         rx_status->flag |= RX_FLAG_MACTIME_START;
7104
7105         channel = BRCMS_CHAN_CHANNEL(rxh->RxChan);
7106
7107         rx_status->band =
7108                 channel > 14 ? IEEE80211_BAND_5GHZ : IEEE80211_BAND_2GHZ;
7109         rx_status->freq =
7110                 ieee80211_channel_to_frequency(channel, rx_status->band);
7111
7112         rx_status->signal = wlc_phy_rssi_compute(wlc->hw->band->pi, rxh);
7113
7114         /* noise */
7115         /* qual */
7116         rx_status->antenna =
7117                 (rxh->PhyRxStatus_0 & PRXS0_RXANT_UPSUBBAND) ? 1 : 0;
7118
7119         plcp = p->data;
7120
7121         rspec = brcms_c_compute_rspec(rxh, plcp);
7122         if (is_mcs_rate(rspec)) {
7123                 rx_status->rate_idx = rspec & RSPEC_RATE_MASK;
7124                 rx_status->flag |= RX_FLAG_HT;
7125                 if (rspec_is40mhz(rspec))
7126                         rx_status->flag |= RX_FLAG_40MHZ;
7127         } else {
7128                 switch (rspec2rate(rspec)) {
7129                 case BRCM_RATE_1M:
7130                         rx_status->rate_idx = 0;
7131                         break;
7132                 case BRCM_RATE_2M:
7133                         rx_status->rate_idx = 1;
7134                         break;
7135                 case BRCM_RATE_5M5:
7136                         rx_status->rate_idx = 2;
7137                         break;
7138                 case BRCM_RATE_11M:
7139                         rx_status->rate_idx = 3;
7140                         break;
7141                 case BRCM_RATE_6M:
7142                         rx_status->rate_idx = 4;
7143                         break;
7144                 case BRCM_RATE_9M:
7145                         rx_status->rate_idx = 5;
7146                         break;
7147                 case BRCM_RATE_12M:
7148                         rx_status->rate_idx = 6;
7149                         break;
7150                 case BRCM_RATE_18M:
7151                         rx_status->rate_idx = 7;
7152                         break;
7153                 case BRCM_RATE_24M:
7154                         rx_status->rate_idx = 8;
7155                         break;
7156                 case BRCM_RATE_36M:
7157                         rx_status->rate_idx = 9;
7158                         break;
7159                 case BRCM_RATE_48M:
7160                         rx_status->rate_idx = 10;
7161                         break;
7162                 case BRCM_RATE_54M:
7163                         rx_status->rate_idx = 11;
7164                         break;
7165                 default:
7166                         brcms_err(wlc->hw->d11core,
7167                                   "%s: Unknown rate\n", __func__);
7168                 }
7169
7170                 /*
7171                  * For 5GHz, we should decrease the index as it is
7172                  * a subset of the 2.4G rates. See bitrates field
7173                  * of brcms_band_5GHz_nphy (in mac80211_if.c).
7174                  */
7175                 if (rx_status->band == IEEE80211_BAND_5GHZ)
7176                         rx_status->rate_idx -= BRCMS_LEGACY_5G_RATE_OFFSET;
7177
7178                 /* Determine short preamble and rate_idx */
7179                 preamble = 0;
7180                 if (is_cck_rate(rspec)) {
7181                         if (rxh->PhyRxStatus_0 & PRXS0_SHORTH)
7182                                 rx_status->flag |= RX_FLAG_SHORTPRE;
7183                 } else if (is_ofdm_rate(rspec)) {
7184                         rx_status->flag |= RX_FLAG_SHORTPRE;
7185                 } else {
7186                         brcms_err(wlc->hw->d11core, "%s: Unknown modulation\n",
7187                                   __func__);
7188                 }
7189         }
7190
7191         if (plcp3_issgi(plcp[3]))
7192                 rx_status->flag |= RX_FLAG_SHORT_GI;
7193
7194         if (rxh->RxStatus1 & RXS_DECERR) {
7195                 rx_status->flag |= RX_FLAG_FAILED_PLCP_CRC;
7196                 brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_PLCP_CRC\n",
7197                           __func__);
7198         }
7199         if (rxh->RxStatus1 & RXS_FCSERR) {
7200                 rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
7201                 brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_FCS_CRC\n",
7202                           __func__);
7203         }
7204 }
7205
7206 static void
7207 brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7208                 struct sk_buff *p)
7209 {
7210         int len_mpdu;
7211         struct ieee80211_rx_status rx_status;
7212         struct ieee80211_hdr *hdr;
7213
7214         memset(&rx_status, 0, sizeof(rx_status));
7215         prep_mac80211_status(wlc, rxh, p, &rx_status);
7216
7217         /* mac header+body length, exclude CRC and plcp header */
7218         len_mpdu = p->len - D11_PHY_HDR_LEN - FCS_LEN;
7219         skb_pull(p, D11_PHY_HDR_LEN);
7220         __skb_trim(p, len_mpdu);
7221
7222         /* unmute transmit */
7223         if (wlc->hw->suspended_fifos) {
7224                 hdr = (struct ieee80211_hdr *)p->data;
7225                 if (ieee80211_is_beacon(hdr->frame_control))
7226                         brcms_b_mute(wlc->hw, false);
7227         }
7228
7229         memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
7230         ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
7231 }
7232
7233 /* calculate frame duration for Mixed-mode L-SIG spoofing, return
7234  * number of bytes goes in the length field
7235  *
7236  * Formula given by HT PHY Spec v 1.13
7237  *   len = 3(nsyms + nstream + 3) - 3
7238  */
7239 u16
7240 brcms_c_calc_lsig_len(struct brcms_c_info *wlc, u32 ratespec,
7241                       uint mac_len)
7242 {
7243         uint nsyms, len = 0, kNdps;
7244
7245         if (is_mcs_rate(ratespec)) {
7246                 uint mcs = ratespec & RSPEC_RATE_MASK;
7247                 int tot_streams = (mcs_2_txstreams(mcs) + 1) +
7248                                   rspec_stc(ratespec);
7249
7250                 /*
7251                  * the payload duration calculation matches that
7252                  * of regular ofdm
7253                  */
7254                 /* 1000Ndbps = kbps * 4 */
7255                 kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
7256                                    rspec_issgi(ratespec)) * 4;
7257
7258                 if (rspec_stc(ratespec) == 0)
7259                         nsyms =
7260                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7261                                   APHY_TAIL_NBITS) * 1000, kNdps);
7262                 else
7263                         /* STBC needs to have even number of symbols */
7264                         nsyms =
7265                             2 *
7266                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7267                                   APHY_TAIL_NBITS) * 1000, 2 * kNdps);
7268
7269                 /* (+3) account for HT-SIG(2) and HT-STF(1) */
7270                 nsyms += (tot_streams + 3);
7271                 /*
7272                  * 3 bytes/symbol @ legacy 6Mbps rate
7273                  * (-3) excluding service bits and tail bits
7274                  */
7275                 len = (3 * nsyms) - 3;
7276         }
7277
7278         return (u16) len;
7279 }
7280
7281 static void
7282 brcms_c_mod_prb_rsp_rate_table(struct brcms_c_info *wlc, uint frame_len)
7283 {
7284         const struct brcms_c_rateset *rs_dflt;
7285         struct brcms_c_rateset rs;
7286         u8 rate;
7287         u16 entry_ptr;
7288         u8 plcp[D11_PHY_HDR_LEN];
7289         u16 dur, sifs;
7290         uint i;
7291
7292         sifs = get_sifs(wlc->band);
7293
7294         rs_dflt = brcms_c_rateset_get_hwrs(wlc);
7295
7296         brcms_c_rateset_copy(rs_dflt, &rs);
7297         brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
7298
7299         /*
7300          * walk the phy rate table and update MAC core SHM
7301          * basic rate table entries
7302          */
7303         for (i = 0; i < rs.count; i++) {
7304                 rate = rs.rates[i] & BRCMS_RATE_MASK;
7305
7306                 entry_ptr = brcms_b_rate_shm_offset(wlc->hw, rate);
7307
7308                 /* Calculate the Probe Response PLCP for the given rate */
7309                 brcms_c_compute_plcp(wlc, rate, frame_len, plcp);
7310
7311                 /*
7312                  * Calculate the duration of the Probe Response
7313                  * frame plus SIFS for the MAC
7314                  */
7315                 dur = (u16) brcms_c_calc_frame_time(wlc, rate,
7316                                                 BRCMS_LONG_PREAMBLE, frame_len);
7317                 dur += sifs;
7318
7319                 /* Update the SHM Rate Table entry Probe Response values */
7320                 brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS,
7321                               (u16) (plcp[0] + (plcp[1] << 8)));
7322                 brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS + 2,
7323                               (u16) (plcp[2] + (plcp[3] << 8)));
7324                 brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_DUR_POS, dur);
7325         }
7326 }
7327
7328 int brcms_c_get_header_len(void)
7329 {
7330         return TXOFF;
7331 }
7332
7333 static void brcms_c_beacon_write(struct brcms_c_info *wlc,
7334                                  struct sk_buff *beacon, u16 tim_offset,
7335                                  u16 dtim_period, bool bcn0, bool bcn1)
7336 {
7337         size_t len;
7338         struct ieee80211_tx_info *tx_info;
7339         struct brcms_hardware *wlc_hw = wlc->hw;
7340         struct ieee80211_hw *ieee_hw = brcms_c_pub(wlc)->ieee_hw;
7341
7342         /* Get tx_info */
7343         tx_info = IEEE80211_SKB_CB(beacon);
7344
7345         len = min_t(size_t, beacon->len, BCN_TMPL_LEN);
7346         wlc->bcn_rspec = ieee80211_get_tx_rate(ieee_hw, tx_info)->hw_value;
7347
7348         brcms_c_compute_plcp(wlc, wlc->bcn_rspec,
7349                              len + FCS_LEN - D11_PHY_HDR_LEN, beacon->data);
7350
7351         /* "Regular" and 16 MBSS but not for 4 MBSS */
7352         /* Update the phytxctl for the beacon based on the rspec */
7353         brcms_c_beacon_phytxctl_txant_upd(wlc, wlc->bcn_rspec);
7354
7355         if (bcn0) {
7356                 /* write the probe response into the template region */
7357                 brcms_b_write_template_ram(wlc_hw, T_BCN0_TPL_BASE,
7358                                             (len + 3) & ~3, beacon->data);
7359
7360                 /* write beacon length to SCR */
7361                 brcms_b_write_shm(wlc_hw, M_BCN0_FRM_BYTESZ, (u16) len);
7362         }
7363         if (bcn1) {
7364                 /* write the probe response into the template region */
7365                 brcms_b_write_template_ram(wlc_hw, T_BCN1_TPL_BASE,
7366                                             (len + 3) & ~3, beacon->data);
7367
7368                 /* write beacon length to SCR */
7369                 brcms_b_write_shm(wlc_hw, M_BCN1_FRM_BYTESZ, (u16) len);
7370         }
7371
7372         if (tim_offset != 0) {
7373                 brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
7374                                   tim_offset + D11B_PHY_HDR_LEN);
7375                 brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, dtim_period);
7376         } else {
7377                 brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
7378                                   len + D11B_PHY_HDR_LEN);
7379                 brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, 0);
7380         }
7381 }
7382
7383 static void brcms_c_update_beacon_hw(struct brcms_c_info *wlc,
7384                                      struct sk_buff *beacon, u16 tim_offset,
7385                                      u16 dtim_period)
7386 {
7387         struct brcms_hardware *wlc_hw = wlc->hw;
7388         struct bcma_device *core = wlc_hw->d11core;
7389
7390         /* Hardware beaconing for this config */
7391         u32 both_valid = MCMD_BCN0VLD | MCMD_BCN1VLD;
7392
7393         /* Check if both templates are in use, if so sched. an interrupt
7394          *      that will call back into this routine
7395          */
7396         if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid)
7397                 /* clear any previous status */
7398                 bcma_write32(core, D11REGOFFS(macintstatus), MI_BCNTPL);
7399
7400         if (wlc->beacon_template_virgin) {
7401                 wlc->beacon_template_virgin = false;
7402                 brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
7403                                      true);
7404                 /* mark beacon0 valid */
7405                 bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
7406                 return;
7407         }
7408
7409         /* Check that after scheduling the interrupt both of the
7410          *      templates are still busy. if not clear the int. & remask
7411          */
7412         if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid) {
7413                 wlc->defmacintmask |= MI_BCNTPL;
7414                 return;
7415         }
7416
7417         if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN0VLD)) {
7418                 brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
7419                                      false);
7420                 /* mark beacon0 valid */
7421                 bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
7422                 return;
7423         }
7424         if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN1VLD)) {
7425                 brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period,
7426                                      false, true);
7427                 /* mark beacon0 valid */
7428                 bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN1VLD);
7429                 return;
7430         }
7431         return;
7432 }
7433
7434 /*
7435  * Update all beacons for the system.
7436  */
7437 void brcms_c_update_beacon(struct brcms_c_info *wlc)
7438 {
7439         struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7440
7441         if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
7442                              bsscfg->type == BRCMS_TYPE_ADHOC)) {
7443                 /* Clear the soft intmask */
7444                 wlc->defmacintmask &= ~MI_BCNTPL;
7445                 if (!wlc->beacon)
7446                         return;
7447                 brcms_c_update_beacon_hw(wlc, wlc->beacon,
7448                                          wlc->beacon_tim_offset,
7449                                          wlc->beacon_dtim_period);
7450         }
7451 }
7452
7453 void brcms_c_set_new_beacon(struct brcms_c_info *wlc, struct sk_buff *beacon,
7454                             u16 tim_offset, u16 dtim_period)
7455 {
7456         if (!beacon)
7457                 return;
7458         if (wlc->beacon)
7459                 dev_kfree_skb_any(wlc->beacon);
7460         wlc->beacon = beacon;
7461
7462         /* add PLCP */
7463         skb_push(wlc->beacon, D11_PHY_HDR_LEN);
7464         wlc->beacon_tim_offset = tim_offset;
7465         wlc->beacon_dtim_period = dtim_period;
7466         brcms_c_update_beacon(wlc);
7467 }
7468
7469 void brcms_c_set_new_probe_resp(struct brcms_c_info *wlc,
7470                                 struct sk_buff *probe_resp)
7471 {
7472         if (!probe_resp)
7473                 return;
7474         if (wlc->probe_resp)
7475                 dev_kfree_skb_any(wlc->probe_resp);
7476         wlc->probe_resp = probe_resp;
7477
7478         /* add PLCP */
7479         skb_push(wlc->probe_resp, D11_PHY_HDR_LEN);
7480         brcms_c_update_probe_resp(wlc, false);
7481 }
7482
7483 /* Write ssid into shared memory */
7484 static void
7485 brcms_c_shm_ssid_upd(struct brcms_c_info *wlc, struct brcms_bss_cfg *cfg)
7486 {
7487         u8 *ssidptr = cfg->SSID;
7488         u16 base = M_SSID;
7489         u8 ssidbuf[IEEE80211_MAX_SSID_LEN];
7490
7491         /* padding the ssid with zero and copy it into shm */
7492         memset(ssidbuf, 0, IEEE80211_MAX_SSID_LEN);
7493         memcpy(ssidbuf, ssidptr, cfg->SSID_len);
7494
7495         brcms_c_copyto_shm(wlc, base, ssidbuf, IEEE80211_MAX_SSID_LEN);
7496         brcms_b_write_shm(wlc->hw, M_SSIDLEN, (u16) cfg->SSID_len);
7497 }
7498
7499 static void
7500 brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
7501                               struct brcms_bss_cfg *cfg,
7502                               struct sk_buff *probe_resp,
7503                               bool suspend)
7504 {
7505         int len;
7506
7507         len = min_t(size_t, probe_resp->len, BCN_TMPL_LEN);
7508
7509         if (suspend)
7510                 brcms_c_suspend_mac_and_wait(wlc);
7511
7512         /* write the probe response into the template region */
7513         brcms_b_write_template_ram(wlc->hw, T_PRS_TPL_BASE,
7514                                     (len + 3) & ~3, probe_resp->data);
7515
7516         /* write the length of the probe response frame (+PLCP/-FCS) */
7517         brcms_b_write_shm(wlc->hw, M_PRB_RESP_FRM_LEN, (u16) len);
7518
7519         /* write the SSID and SSID length */
7520         brcms_c_shm_ssid_upd(wlc, cfg);
7521
7522         /*
7523          * Write PLCP headers and durations for probe response frames
7524          * at all rates. Use the actual frame length covered by the
7525          * PLCP header for the call to brcms_c_mod_prb_rsp_rate_table()
7526          * by subtracting the PLCP len and adding the FCS.
7527          */
7528         brcms_c_mod_prb_rsp_rate_table(wlc,
7529                                       (u16)len + FCS_LEN - D11_PHY_HDR_LEN);
7530
7531         if (suspend)
7532                 brcms_c_enable_mac(wlc);
7533 }
7534
7535 void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
7536 {
7537         struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7538
7539         /* update AP or IBSS probe responses */
7540         if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
7541                              bsscfg->type == BRCMS_TYPE_ADHOC)) {
7542                 if (!wlc->probe_resp)
7543                         return;
7544                 brcms_c_bss_update_probe_resp(wlc, bsscfg, wlc->probe_resp,
7545                                               suspend);
7546         }
7547 }
7548
7549 int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo,
7550                            uint *blocks)
7551 {
7552         if (fifo >= NFIFO)
7553                 return -EINVAL;
7554
7555         *blocks = wlc_hw->xmtfifo_sz[fifo];
7556
7557         return 0;
7558 }
7559
7560 void
7561 brcms_c_set_addrmatch(struct brcms_c_info *wlc, int match_reg_offset,
7562                   const u8 *addr)
7563 {
7564         brcms_b_set_addrmatch(wlc->hw, match_reg_offset, addr);
7565         if (match_reg_offset == RCM_BSSID_OFFSET)
7566                 memcpy(wlc->bsscfg->BSSID, addr, ETH_ALEN);
7567 }
7568
7569 /*
7570  * Flag 'scan in progress' to withhold dynamic phy calibration
7571  */
7572 void brcms_c_scan_start(struct brcms_c_info *wlc)
7573 {
7574         wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, true);
7575 }
7576
7577 void brcms_c_scan_stop(struct brcms_c_info *wlc)
7578 {
7579         wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, false);
7580 }
7581
7582 void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state)
7583 {
7584         wlc->pub->associated = state;
7585 }
7586
7587 /*
7588  * When a remote STA/AP is removed by Mac80211, or when it can no longer accept
7589  * AMPDU traffic, packets pending in hardware have to be invalidated so that
7590  * when later on hardware releases them, they can be handled appropriately.
7591  */
7592 void brcms_c_inval_dma_pkts(struct brcms_hardware *hw,
7593                                struct ieee80211_sta *sta,
7594                                void (*dma_callback_fn))
7595 {
7596         struct dma_pub *dmah;
7597         int i;
7598         for (i = 0; i < NFIFO; i++) {
7599                 dmah = hw->di[i];
7600                 if (dmah != NULL)
7601                         dma_walk_packets(dmah, dma_callback_fn, sta);
7602         }
7603 }
7604
7605 int brcms_c_get_curband(struct brcms_c_info *wlc)
7606 {
7607         return wlc->band->bandunit;
7608 }
7609
7610 bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc)
7611 {
7612         int i;
7613
7614         /* Kick DMA to send any pending AMPDU */
7615         for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
7616                 if (wlc->hw->di[i])
7617                         dma_kick_tx(wlc->hw->di[i]);
7618
7619         return !brcms_txpktpendtot(wlc);
7620 }
7621
7622 void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
7623 {
7624         wlc->bcn_li_bcn = interval;
7625         if (wlc->pub->up)
7626                 brcms_c_bcn_li_upd(wlc);
7627 }
7628
7629 u64 brcms_c_tsf_get(struct brcms_c_info *wlc)
7630 {
7631         u32 tsf_h, tsf_l;
7632         u64 tsf;
7633
7634         brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7635
7636         tsf = tsf_h;
7637         tsf <<= 32;
7638         tsf |= tsf_l;
7639
7640         return tsf;
7641 }
7642
7643 void brcms_c_tsf_set(struct brcms_c_info *wlc, u64 tsf)
7644 {
7645         u32 tsf_h, tsf_l;
7646
7647         brcms_c_time_lock(wlc);
7648
7649         tsf_l = tsf;
7650         tsf_h = (tsf >> 32);
7651
7652         /* read the tsf timer low, then high to get an atomic read */
7653         bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerlow), tsf_l);
7654         bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerhigh), tsf_h);
7655
7656         brcms_c_time_unlock(wlc);
7657 }
7658
7659 int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr)
7660 {
7661         uint qdbm;
7662
7663         /* Remove override bit and clip to max qdbm value */
7664         qdbm = min_t(uint, txpwr * BRCMS_TXPWR_DB_FACTOR, 0xff);
7665         return wlc_phy_txpower_set(wlc->band->pi, qdbm, false);
7666 }
7667
7668 int brcms_c_get_tx_power(struct brcms_c_info *wlc)
7669 {
7670         uint qdbm;
7671         bool override;
7672
7673         wlc_phy_txpower_get(wlc->band->pi, &qdbm, &override);
7674
7675         /* Return qdbm units */
7676         return (int)(qdbm / BRCMS_TXPWR_DB_FACTOR);
7677 }
7678
7679 /* Process received frames */
7680 /*
7681  * Return true if more frames need to be processed. false otherwise.
7682  * Param 'bound' indicates max. # frames to process before break out.
7683  */
7684 static void brcms_c_recv(struct brcms_c_info *wlc, struct sk_buff *p)
7685 {
7686         struct d11rxhdr *rxh;
7687         struct ieee80211_hdr *h;
7688         uint len;
7689         bool is_amsdu;
7690
7691         /* frame starts with rxhdr */
7692         rxh = (struct d11rxhdr *) (p->data);
7693
7694         /* strip off rxhdr */
7695         skb_pull(p, BRCMS_HWRXOFF);
7696
7697         /* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU subframes */
7698         if (rxh->RxStatus1 & RXS_PBPRES) {
7699                 if (p->len < 2) {
7700                         brcms_err(wlc->hw->d11core,
7701                                   "wl%d: recv: rcvd runt of len %d\n",
7702                                   wlc->pub->unit, p->len);
7703                         goto toss;
7704                 }
7705                 skb_pull(p, 2);
7706         }
7707
7708         h = (struct ieee80211_hdr *)(p->data + D11_PHY_HDR_LEN);
7709         len = p->len;
7710
7711         if (rxh->RxStatus1 & RXS_FCSERR) {
7712                 if (!(wlc->filter_flags & FIF_FCSFAIL))
7713                         goto toss;
7714         }
7715
7716         /* check received pkt has at least frame control field */
7717         if (len < D11_PHY_HDR_LEN + sizeof(h->frame_control))
7718                 goto toss;
7719
7720         /* not supporting A-MSDU */
7721         is_amsdu = rxh->RxStatus2 & RXS_AMSDU_MASK;
7722         if (is_amsdu)
7723                 goto toss;
7724
7725         brcms_c_recvctl(wlc, rxh, p);
7726         return;
7727
7728  toss:
7729         brcmu_pkt_buf_free_skb(p);
7730 }
7731
7732 /* Process received frames */
7733 /*
7734  * Return true if more frames need to be processed. false otherwise.
7735  * Param 'bound' indicates max. # frames to process before break out.
7736  */
7737 static bool
7738 brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
7739 {
7740         struct sk_buff *p;
7741         struct sk_buff *next = NULL;
7742         struct sk_buff_head recv_frames;
7743
7744         uint n = 0;
7745         uint bound_limit = bound ? RXBND : -1;
7746         bool morepending = false;
7747
7748         skb_queue_head_init(&recv_frames);
7749
7750         /* gather received frames */
7751         do {
7752                 /* !give others some time to run! */
7753                 if (n >= bound_limit)
7754                         break;
7755
7756                 morepending = dma_rx(wlc_hw->di[fifo], &recv_frames);
7757                 n++;
7758         } while (morepending);
7759
7760         /* post more rbufs */
7761         dma_rxfill(wlc_hw->di[fifo]);
7762
7763         /* process each frame */
7764         skb_queue_walk_safe(&recv_frames, p, next) {
7765                 struct d11rxhdr_le *rxh_le;
7766                 struct d11rxhdr *rxh;
7767
7768                 skb_unlink(p, &recv_frames);
7769                 rxh_le = (struct d11rxhdr_le *)p->data;
7770                 rxh = (struct d11rxhdr *)p->data;
7771
7772                 /* fixup rx header endianness */
7773                 rxh->RxFrameSize = le16_to_cpu(rxh_le->RxFrameSize);
7774                 rxh->PhyRxStatus_0 = le16_to_cpu(rxh_le->PhyRxStatus_0);
7775                 rxh->PhyRxStatus_1 = le16_to_cpu(rxh_le->PhyRxStatus_1);
7776                 rxh->PhyRxStatus_2 = le16_to_cpu(rxh_le->PhyRxStatus_2);
7777                 rxh->PhyRxStatus_3 = le16_to_cpu(rxh_le->PhyRxStatus_3);
7778                 rxh->PhyRxStatus_4 = le16_to_cpu(rxh_le->PhyRxStatus_4);
7779                 rxh->PhyRxStatus_5 = le16_to_cpu(rxh_le->PhyRxStatus_5);
7780                 rxh->RxStatus1 = le16_to_cpu(rxh_le->RxStatus1);
7781                 rxh->RxStatus2 = le16_to_cpu(rxh_le->RxStatus2);
7782                 rxh->RxTSFTime = le16_to_cpu(rxh_le->RxTSFTime);
7783                 rxh->RxChan = le16_to_cpu(rxh_le->RxChan);
7784
7785                 brcms_c_recv(wlc_hw->wlc, p);
7786         }
7787
7788         return morepending;
7789 }
7790
7791 /* second-level interrupt processing
7792  *   Return true if another dpc needs to be re-scheduled. false otherwise.
7793  *   Param 'bounded' indicates if applicable loops should be bounded.
7794  */
7795 bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded)
7796 {
7797         u32 macintstatus;
7798         struct brcms_hardware *wlc_hw = wlc->hw;
7799         struct bcma_device *core = wlc_hw->d11core;
7800
7801         if (brcms_deviceremoved(wlc)) {
7802                 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
7803                           __func__);
7804                 brcms_down(wlc->wl);
7805                 return false;
7806         }
7807
7808         /* grab and clear the saved software intstatus bits */
7809         macintstatus = wlc->macintstatus;
7810         wlc->macintstatus = 0;
7811
7812         brcms_dbg_int(core, "wl%d: macintstatus 0x%x\n",
7813                       wlc_hw->unit, macintstatus);
7814
7815         WARN_ON(macintstatus & MI_PRQ); /* PRQ Interrupt in non-MBSS */
7816
7817         /* tx status */
7818         if (macintstatus & MI_TFS) {
7819                 bool fatal;
7820                 if (brcms_b_txstatus(wlc->hw, bounded, &fatal))
7821                         wlc->macintstatus |= MI_TFS;
7822                 if (fatal) {
7823                         brcms_err(core, "MI_TFS: fatal\n");
7824                         goto fatal;
7825                 }
7826         }
7827
7828         if (macintstatus & (MI_TBTT | MI_DTIM_TBTT))
7829                 brcms_c_tbtt(wlc);
7830
7831         /* ATIM window end */
7832         if (macintstatus & MI_ATIMWINEND) {
7833                 brcms_dbg_info(core, "end of ATIM window\n");
7834                 bcma_set32(core, D11REGOFFS(maccommand), wlc->qvalid);
7835                 wlc->qvalid = 0;
7836         }
7837
7838         /*
7839          * received data or control frame, MI_DMAINT is
7840          * indication of RX_FIFO interrupt
7841          */
7842         if (macintstatus & MI_DMAINT)
7843                 if (brcms_b_recv(wlc_hw, RX_FIFO, bounded))
7844                         wlc->macintstatus |= MI_DMAINT;
7845
7846         /* noise sample collected */
7847         if (macintstatus & MI_BG_NOISE)
7848                 wlc_phy_noise_sample_intr(wlc_hw->band->pi);
7849
7850         if (macintstatus & MI_GP0) {
7851                 brcms_err(core, "wl%d: PSM microcode watchdog fired at %d "
7852                           "(seconds). Resetting.\n", wlc_hw->unit, wlc_hw->now);
7853
7854                 printk_once("%s : PSM Watchdog, chipid 0x%x, chiprev 0x%x\n",
7855                             __func__, ai_get_chip_id(wlc_hw->sih),
7856                             ai_get_chiprev(wlc_hw->sih));
7857                 brcms_fatal_error(wlc_hw->wlc->wl);
7858         }
7859
7860         /* gptimer timeout */
7861         if (macintstatus & MI_TO)
7862                 bcma_write32(core, D11REGOFFS(gptimer), 0);
7863
7864         if (macintstatus & MI_RFDISABLE) {
7865                 brcms_dbg_info(core, "wl%d: BMAC Detected a change on the"
7866                                " RF Disable Input\n", wlc_hw->unit);
7867                 brcms_rfkill_set_hw_state(wlc->wl);
7868         }
7869
7870         /* BCN template is available */
7871         if (macintstatus & MI_BCNTPL)
7872                 brcms_c_update_beacon(wlc);
7873
7874         /* it isn't done and needs to be resched if macintstatus is non-zero */
7875         return wlc->macintstatus != 0;
7876
7877  fatal:
7878         brcms_fatal_error(wlc_hw->wlc->wl);
7879         return wlc->macintstatus != 0;
7880 }
7881
7882 void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx)
7883 {
7884         struct bcma_device *core = wlc->hw->d11core;
7885         struct ieee80211_channel *ch = wlc->pub->ieee_hw->conf.channel;
7886         u16 chanspec;
7887
7888         brcms_dbg_info(core, "wl%d\n", wlc->pub->unit);
7889
7890         chanspec = ch20mhz_chspec(ch->hw_value);
7891
7892         brcms_b_init(wlc->hw, chanspec);
7893
7894         /* update beacon listen interval */
7895         brcms_c_bcn_li_upd(wlc);
7896
7897         /* write ethernet address to core */
7898         brcms_c_set_mac(wlc->bsscfg);
7899         brcms_c_set_bssid(wlc->bsscfg);
7900
7901         /* Update tsf_cfprep if associated and up */
7902         if (wlc->pub->associated && wlc->pub->up) {
7903                 u32 bi;
7904
7905                 /* get beacon period and convert to uS */
7906                 bi = wlc->bsscfg->current_bss->beacon_period << 10;
7907                 /*
7908                  * update since init path would reset
7909                  * to default value
7910                  */
7911                 bcma_write32(core, D11REGOFFS(tsf_cfprep),
7912                              bi << CFPREP_CBI_SHIFT);
7913
7914                 /* Update maccontrol PM related bits */
7915                 brcms_c_set_ps_ctrl(wlc);
7916         }
7917
7918         brcms_c_bandinit_ordered(wlc, chanspec);
7919
7920         /* init probe response timeout */
7921         brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
7922
7923         /* init max burst txop (framebursting) */
7924         brcms_b_write_shm(wlc->hw, M_MBURST_TXOP,
7925                       (wlc->
7926                        _rifs ? (EDCF_AC_VO_TXOP_AP << 5) : MAXFRAMEBURST_TXOP));
7927
7928         /* initialize maximum allowed duty cycle */
7929         brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_ofdm, true, true);
7930         brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_cck, false, true);
7931
7932         /*
7933          * Update some shared memory locations related to
7934          * max AMPDU size allowed to received
7935          */
7936         brcms_c_ampdu_shm_upd(wlc->ampdu);
7937
7938         /* band-specific inits */
7939         brcms_c_bsinit(wlc);
7940
7941         /* Enable EDCF mode (while the MAC is suspended) */
7942         bcma_set16(core, D11REGOFFS(ifs_ctl), IFS_USEEDCF);
7943         brcms_c_edcf_setparams(wlc, false);
7944
7945         /* read the ucode version if we have not yet done so */
7946         if (wlc->ucode_rev == 0) {
7947                 u16 rev;
7948                 u16 patch;
7949
7950                 rev = brcms_b_read_shm(wlc->hw, M_BOM_REV_MAJOR);
7951                 patch = brcms_b_read_shm(wlc->hw, M_BOM_REV_MINOR);
7952                 wlc->ucode_rev = (rev << NBITS(u16)) | patch;
7953                 snprintf(wlc->wiphy->fw_version,
7954                          sizeof(wlc->wiphy->fw_version), "%u.%u", rev, patch);
7955         }
7956
7957         /* ..now really unleash hell (allow the MAC out of suspend) */
7958         brcms_c_enable_mac(wlc);
7959
7960         /* suspend the tx fifos and mute the phy for preism cac time */
7961         if (mute_tx)
7962                 brcms_b_mute(wlc->hw, true);
7963
7964         /* enable the RF Disable Delay timer */
7965         bcma_write32(core, D11REGOFFS(rfdisabledly), RFDISABLE_DEFAULT);
7966
7967         /*
7968          * Initialize WME parameters; if they haven't been set by some other
7969          * mechanism (IOVar, etc) then read them from the hardware.
7970          */
7971         if (GFIELD(wlc->wme_retries[0], EDCF_SHORT) == 0) {
7972                 /* Uninitialized; read from HW */
7973                 int ac;
7974
7975                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
7976                         wlc->wme_retries[ac] =
7977                             brcms_b_read_shm(wlc->hw, M_AC_TXLMT_ADDR(ac));
7978         }
7979 }
7980
7981 /*
7982  * The common driver entry routine. Error codes should be unique
7983  */
7984 struct brcms_c_info *
7985 brcms_c_attach(struct brcms_info *wl, struct bcma_device *core, uint unit,
7986                bool piomode, uint *perr)
7987 {
7988         struct brcms_c_info *wlc;
7989         uint err = 0;
7990         uint i, j;
7991         struct brcms_pub *pub;
7992
7993         /* allocate struct brcms_c_info state and its substructures */
7994         wlc = brcms_c_attach_malloc(unit, &err, 0);
7995         if (wlc == NULL)
7996                 goto fail;
7997         wlc->wiphy = wl->wiphy;
7998         pub = wlc->pub;
7999
8000 #if defined(DEBUG)
8001         wlc_info_dbg = wlc;
8002 #endif
8003
8004         wlc->band = wlc->bandstate[0];
8005         wlc->core = wlc->corestate;
8006         wlc->wl = wl;
8007         pub->unit = unit;
8008         pub->_piomode = piomode;
8009         wlc->bandinit_pending = false;
8010         wlc->beacon_template_virgin = true;
8011
8012         /* populate struct brcms_c_info with default values  */
8013         brcms_c_info_init(wlc, unit);
8014
8015         /* update sta/ap related parameters */
8016         brcms_c_ap_upd(wlc);
8017
8018         /*
8019          * low level attach steps(all hw accesses go
8020          * inside, no more in rest of the attach)
8021          */
8022         err = brcms_b_attach(wlc, core, unit, piomode);
8023         if (err)
8024                 goto fail;
8025
8026         brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, OFF);
8027
8028         pub->phy_11ncapable = BRCMS_PHY_11N_CAP(wlc->band);
8029
8030         /* disable allowed duty cycle */
8031         wlc->tx_duty_cycle_ofdm = 0;
8032         wlc->tx_duty_cycle_cck = 0;
8033
8034         brcms_c_stf_phy_chain_calc(wlc);
8035
8036         /* txchain 1: txant 0, txchain 2: txant 1 */
8037         if (BRCMS_ISNPHY(wlc->band) && (wlc->stf->txstreams == 1))
8038                 wlc->stf->txant = wlc->stf->hw_txchain - 1;
8039
8040         /* push to BMAC driver */
8041         wlc_phy_stf_chain_init(wlc->band->pi, wlc->stf->hw_txchain,
8042                                wlc->stf->hw_rxchain);
8043
8044         /* pull up some info resulting from the low attach */
8045         for (i = 0; i < NFIFO; i++)
8046                 wlc->core->txavail[i] = wlc->hw->txavail[i];
8047
8048         memcpy(&wlc->perm_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
8049         memcpy(&pub->cur_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
8050
8051         for (j = 0; j < wlc->pub->_nbands; j++) {
8052                 wlc->band = wlc->bandstate[j];
8053
8054                 if (!brcms_c_attach_stf_ant_init(wlc)) {
8055                         err = 24;
8056                         goto fail;
8057                 }
8058
8059                 /* default contention windows size limits */
8060                 wlc->band->CWmin = APHY_CWMIN;
8061                 wlc->band->CWmax = PHY_CWMAX;
8062
8063                 /* init gmode value */
8064                 if (wlc->band->bandtype == BRCM_BAND_2G) {
8065                         wlc->band->gmode = GMODE_AUTO;
8066                         brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER,
8067                                            wlc->band->gmode);
8068                 }
8069
8070                 /* init _n_enab supported mode */
8071                 if (BRCMS_PHY_11N_CAP(wlc->band)) {
8072                         pub->_n_enab = SUPPORT_11N;
8073                         brcms_c_protection_upd(wlc, BRCMS_PROT_N_USER,
8074                                                    ((pub->_n_enab ==
8075                                                      SUPPORT_11N) ? WL_11N_2x2 :
8076                                                     WL_11N_3x3));
8077                 }
8078
8079                 /* init per-band default rateset, depend on band->gmode */
8080                 brcms_default_rateset(wlc, &wlc->band->defrateset);
8081
8082                 /* fill in hw_rateset */
8083                 brcms_c_rateset_filter(&wlc->band->defrateset,
8084                                    &wlc->band->hw_rateset, false,
8085                                    BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
8086                                    (bool) (wlc->pub->_n_enab & SUPPORT_11N));
8087         }
8088
8089         /*
8090          * update antenna config due to
8091          * wlc->stf->txant/txchain/ant_rx_ovr change
8092          */
8093         brcms_c_stf_phy_txant_upd(wlc);
8094
8095         /* attach each modules */
8096         err = brcms_c_attach_module(wlc);
8097         if (err != 0)
8098                 goto fail;
8099
8100         if (!brcms_c_timers_init(wlc, unit)) {
8101                 wiphy_err(wl->wiphy, "wl%d: %s: init_timer failed\n", unit,
8102                           __func__);
8103                 err = 32;
8104                 goto fail;
8105         }
8106
8107         /* depend on rateset, gmode */
8108         wlc->cmi = brcms_c_channel_mgr_attach(wlc);
8109         if (!wlc->cmi) {
8110                 wiphy_err(wl->wiphy, "wl%d: %s: channel_mgr_attach failed"
8111                           "\n", unit, __func__);
8112                 err = 33;
8113                 goto fail;
8114         }
8115
8116         /* init default when all parameters are ready, i.e. ->rateset */
8117         brcms_c_bss_default_init(wlc);
8118
8119         /*
8120          * Complete the wlc default state initializations..
8121          */
8122
8123         wlc->bsscfg->wlc = wlc;
8124
8125         wlc->mimoft = FT_HT;
8126         wlc->mimo_40txbw = AUTO;
8127         wlc->ofdm_40txbw = AUTO;
8128         wlc->cck_40txbw = AUTO;
8129         brcms_c_update_mimo_band_bwcap(wlc, BRCMS_N_BW_20IN2G_40IN5G);
8130
8131         /* Set default values of SGI */
8132         if (BRCMS_SGI_CAP_PHY(wlc)) {
8133                 brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8134                                                BRCMS_N_SGI_40));
8135         } else if (BRCMS_ISSSLPNPHY(wlc->band)) {
8136                 brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8137                                                BRCMS_N_SGI_40));
8138         } else {
8139                 brcms_c_ht_update_sgi_rx(wlc, 0);
8140         }
8141
8142         brcms_b_antsel_set(wlc->hw, wlc->asi->antsel_avail);
8143
8144         if (perr)
8145                 *perr = 0;
8146
8147         return wlc;
8148
8149  fail:
8150         wiphy_err(wl->wiphy, "wl%d: %s: failed with err %d\n",
8151                   unit, __func__, err);
8152         if (wlc)
8153                 brcms_c_detach(wlc);
8154
8155         if (perr)
8156                 *perr = err;
8157         return NULL;
8158 }