drivers/net/wireless/brcm80211/brcmsmac/main.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  18
  19 #include <linux/pci_ids.h>
  20 #include <linux/if_ether.h>
  21 #include <net/cfg80211.h>
  22 #include <net/mac80211.h>
  23 #include <brcm_hw_ids.h>
  24 #include <aiutils.h>
  25 #include <chipcommon.h>
  26 #include "rate.h"
  27 #include "scb.h"
  28 #include "phy/phy_hal.h"
  29 #include "channel.h"
  30 #include "antsel.h"
  31 #include "stf.h"
  32 #include "ampdu.h"
  33 #include "mac80211_if.h"
  34 #include "ucode_loader.h"
  35 #include "main.h"
  36 #include "soc.h"
  37 #include "dma.h"
  38 #include "debug.h"
  39 #include "brcms_trace_events.h"
  40
  41 /* watchdog timer, in unit of ms */
  42 #define TIMER_INTERVAL_WATCHDOG         1000
  43 /* radio monitor timer, in unit of ms */
  44 #define TIMER_INTERVAL_RADIOCHK         800
  45
  46 /* beacon interval, in unit of 1024TU */
  47 #define BEACON_INTERVAL_DEFAULT         100
  48
  49 /* n-mode support capability */
  50 /* 2x2 includes both 1x1 & 2x2 devices
  51  * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
  52  * control it independently
  53  */
  54 #define WL_11N_2x2                      1
  55 #define WL_11N_3x3                      3
  56 #define WL_11N_4x4                      4
  57
  58 #define EDCF_ACI_MASK                   0x60
  59 #define EDCF_ACI_SHIFT                  5
  60 #define EDCF_ECWMIN_MASK                0x0f
  61 #define EDCF_ECWMAX_SHIFT               4
  62 #define EDCF_AIFSN_MASK                 0x0f
  63 #define EDCF_AIFSN_MAX                  15
  64 #define EDCF_ECWMAX_MASK                0xf0
  65
  66 #define EDCF_AC_BE_TXOP_STA             0x0000
  67 #define EDCF_AC_BK_TXOP_STA             0x0000
  68 #define EDCF_AC_VO_ACI_STA              0x62
  69 #define EDCF_AC_VO_ECW_STA              0x32
  70 #define EDCF_AC_VI_ACI_STA              0x42
  71 #define EDCF_AC_VI_ECW_STA              0x43
  72 #define EDCF_AC_BK_ECW_STA              0xA4
  73 #define EDCF_AC_VI_TXOP_STA             0x005e
  74 #define EDCF_AC_VO_TXOP_STA             0x002f
  75 #define EDCF_AC_BE_ACI_STA              0x03
  76 #define EDCF_AC_BE_ECW_STA              0xA4
  77 #define EDCF_AC_BK_ACI_STA              0x27
  78 #define EDCF_AC_VO_TXOP_AP              0x002f
  79
  80 #define EDCF_TXOP2USEC(txop)            ((txop) << 5)
  81 #define EDCF_ECW2CW(exp)                ((1 << (exp)) - 1)
  82
  83 #define APHY_SYMBOL_TIME                4
  84 #define APHY_PREAMBLE_TIME              16
  85 #define APHY_SIGNAL_TIME                4
  86 #define APHY_SIFS_TIME                  16
  87 #define APHY_SERVICE_NBITS              16
  88 #define APHY_TAIL_NBITS                 6
  89 #define BPHY_SIFS_TIME                  10
  90 #define BPHY_PLCP_SHORT_TIME            96
  91
  92 #define PREN_PREAMBLE                   24
  93 #define PREN_MM_EXT                     12
  94 #define PREN_PREAMBLE_EXT               4
  95
  96 #define DOT11_MAC_HDR_LEN               24
  97 #define DOT11_ACK_LEN                   10
  98 #define DOT11_BA_LEN                    4
  99 #define DOT11_OFDM_SIGNAL_EXTENSION     6
 100 #define DOT11_MIN_FRAG_LEN              256
 101 #define DOT11_RTS_LEN                   16
 102 #define DOT11_CTS_LEN                   10
 103 #define DOT11_BA_BITMAP_LEN             128
 104 #define DOT11_MAXNUMFRAGS               16
 105 #define DOT11_MAX_FRAG_LEN              2346
 106
 107 #define BPHY_PLCP_TIME                  192
 108 #define RIFS_11N_TIME                   2
 109
 110 /* length of the BCN template area */
 111 #define BCN_TMPL_LEN                    512
 112
 113 /* brcms_bss_info flag bit values */
 114 #define BRCMS_BSS_HT                    0x0020  /* BSS is HT (MIMO) capable */
 115
 116 /* chip rx buffer offset */
 117 #define BRCMS_HWRXOFF                   38
 118
 119 /* rfdisable delay timer 500 ms, runs of ALP clock */
 120 #define RFDISABLE_DEFAULT               10000000
 121
 122 #define BRCMS_TEMPSENSE_PERIOD          10      /* 10 second timeout */
 123
 124 /* synthpu_dly times in us */
 125 #define SYNTHPU_DLY_APHY_US             3700
 126 #define SYNTHPU_DLY_BPHY_US             1050
 127 #define SYNTHPU_DLY_NPHY_US             2048
 128 #define SYNTHPU_DLY_LPPHY_US            300
 129
 130 #define ANTCNT                          10      /* vanilla M_MAX_ANTCNT val */
 131
 132 /* Per-AC retry limit register definitions; uses defs.h bitfield macros */
 133 #define EDCF_SHORT_S                    0
 134 #define EDCF_SFB_S                      4
 135 #define EDCF_LONG_S                     8
 136 #define EDCF_LFB_S                      12
 137 #define EDCF_SHORT_M                    BITFIELD_MASK(4)
 138 #define EDCF_SFB_M                      BITFIELD_MASK(4)
 139 #define EDCF_LONG_M                     BITFIELD_MASK(4)
 140 #define EDCF_LFB_M                      BITFIELD_MASK(4)
 141
 142 #define RETRY_SHORT_DEF                 7       /* Default Short retry Limit */
 143 #define RETRY_SHORT_MAX                 255     /* Maximum Short retry Limit */
 144 #define RETRY_LONG_DEF                  4       /* Default Long retry count */
 145 #define RETRY_SHORT_FB                  3       /* Short count for fb rate */
 146 #define RETRY_LONG_FB                   2       /* Long count for fb rate */
 147
 148 #define APHY_CWMIN                      15
 149 #define PHY_CWMAX                       1023
 150
 151 #define EDCF_AIFSN_MIN                  1
 152
 153 #define FRAGNUM_MASK                    0xF
 154
 155 #define APHY_SLOT_TIME                  9
 156 #define BPHY_SLOT_TIME                  20
 157
 158 #define WL_SPURAVOID_OFF                0
 159 #define WL_SPURAVOID_ON1                1
 160 #define WL_SPURAVOID_ON2                2
 161
 162 /* invalid core flags, use the saved coreflags */
 163 #define BRCMS_USE_COREFLAGS             0xffffffff
 164
 165 /* values for PLCPHdr_override */
 166 #define BRCMS_PLCP_AUTO                 -1
 167 #define BRCMS_PLCP_SHORT                0
 168 #define BRCMS_PLCP_LONG                 1
 169
 170 /* values for g_protection_override and n_protection_override */
 171 #define BRCMS_PROTECTION_AUTO           -1
 172 #define BRCMS_PROTECTION_OFF            0
 173 #define BRCMS_PROTECTION_ON             1
 174 #define BRCMS_PROTECTION_MMHDR_ONLY     2
 175 #define BRCMS_PROTECTION_CTS_ONLY       3
 176
 177 /* values for g_protection_control and n_protection_control */
 178 #define BRCMS_PROTECTION_CTL_OFF        0
 179 #define BRCMS_PROTECTION_CTL_LOCAL      1
 180 #define BRCMS_PROTECTION_CTL_OVERLAP    2
 181
 182 /* values for n_protection */
 183 #define BRCMS_N_PROTECTION_OFF          0
 184 #define BRCMS_N_PROTECTION_OPTIONAL     1
 185 #define BRCMS_N_PROTECTION_20IN40       2
 186 #define BRCMS_N_PROTECTION_MIXEDMODE    3
 187
 188 /* values for band specific 40MHz capabilities */
 189 #define BRCMS_N_BW_20ALL                0
 190 #define BRCMS_N_BW_40ALL                1
 191 #define BRCMS_N_BW_20IN2G_40IN5G        2
 192
 193 /* bitflags for SGI support (sgi_rx iovar) */
 194 #define BRCMS_N_SGI_20                  0x01
 195 #define BRCMS_N_SGI_40                  0x02
 196
 197 /* defines used by the nrate iovar */
 198 /* MSC in use,indicates b0-6 holds an mcs */
 199 #define NRATE_MCS_INUSE                 0x00000080
 200 /* rate/mcs value */
 201 #define NRATE_RATE_MASK                 0x0000007f
 202 /* stf mode mask: siso, cdd, stbc, sdm */
 203 #define NRATE_STF_MASK                  0x0000ff00
 204 /* stf mode shift */
 205 #define NRATE_STF_SHIFT                 8
 206 /* bit indicate to override mcs only */
 207 #define NRATE_OVERRIDE_MCS_ONLY         0x40000000
 208 #define NRATE_SGI_MASK                  0x00800000      /* sgi mode */
 209 #define NRATE_SGI_SHIFT                 23              /* sgi mode */
 210 #define NRATE_LDPC_CODING               0x00400000      /* adv coding in use */
 211 #define NRATE_LDPC_SHIFT                22              /* ldpc shift */
 212
 213 #define NRATE_STF_SISO                  0               /* stf mode SISO */
 214 #define NRATE_STF_CDD                   1               /* stf mode CDD */
 215 #define NRATE_STF_STBC                  2               /* stf mode STBC */
 216 #define NRATE_STF_SDM                   3               /* stf mode SDM */
 217
 218 #define MAX_DMA_SEGS                    4
 219
 220 /* # of entries in Tx FIFO */
 221 #define NTXD                            64
 222 /* Max # of entries in Rx FIFO based on 4kb page size */
 223 #define NRXD                            256
 224
 225 /* Amount of headroom to leave in Tx FIFO */
 226 #define TX_HEADROOM                     4
 227
 228 /* try to keep this # rbufs posted to the chip */
 229 #define NRXBUFPOST                      32
 230
 231 /* max # frames to process in brcms_c_recv() */
 232 #define RXBND                           8
 233 /* max # tx status to process in wlc_txstatus() */
 234 #define TXSBND                          8
 235
 236 /* brcmu_format_flags() bit description structure */
 237 struct brcms_c_bit_desc {
 238         u32 bit;
 239         const char *name;
 240 };
 241
 242 /*
 243  * The following table lists the buffer memory allocated to xmt fifos in HW.
 244  * the size is in units of 256bytes(one block), total size is HW dependent
 245  * ucode has default fifo partition, sw can overwrite if necessary
 246  *
 247  * This is documented in twiki under the topic UcodeTxFifo. Please ensure
 248  * the twiki is updated before making changes.
 249  */
 250
 251 /* Starting corerev for the fifo size table */
 252 #define XMTFIFOTBL_STARTREV     17
 253
 254 struct d11init {
 255         __le16 addr;
 256         __le16 size;
 257         __le32 value;
 258 };
 259
 260 struct edcf_acparam {
 261         u8 ACI;
 262         u8 ECW;
 263         u16 TXOP;
 264 } __packed;
 265
 266 /* debug/trace */
 267 uint brcm_msg_level;
 268
 269 /* TX FIFO number to WME/802.1E Access Category */
 270 static const u8 wme_fifo2ac[] = {
 271         IEEE80211_AC_BK,
 272         IEEE80211_AC_BE,
 273         IEEE80211_AC_VI,
 274         IEEE80211_AC_VO,
 275         IEEE80211_AC_BE,
 276         IEEE80211_AC_BE
 277 };
 278
 279 /* ieee80211 Access Category to TX FIFO number */
 280 static const u8 wme_ac2fifo[] = {
 281         TX_AC_VO_FIFO,
 282         TX_AC_VI_FIFO,
 283         TX_AC_BE_FIFO,
 284         TX_AC_BK_FIFO
 285 };
 286
 287 static const u16 xmtfifo_sz[][NFIFO] = {
 288         /* corerev 17: 5120, 49152, 49152, 5376, 4352, 1280 */
 289         {20, 192, 192, 21, 17, 5},
 290         /* corerev 18: */
 291         {0, 0, 0, 0, 0, 0},
 292         /* corerev 19: */
 293         {0, 0, 0, 0, 0, 0},
 294         /* corerev 20: 5120, 49152, 49152, 5376, 4352, 1280 */
 295         {20, 192, 192, 21, 17, 5},
 296         /* corerev 21: 2304, 14848, 5632, 3584, 3584, 1280 */
 297         {9, 58, 22, 14, 14, 5},
 298         /* corerev 22: 5120, 49152, 49152, 5376, 4352, 1280 */
 299         {20, 192, 192, 21, 17, 5},
 300         /* corerev 23: 5120, 49152, 49152, 5376, 4352, 1280 */
 301         {20, 192, 192, 21, 17, 5},
 302         /* corerev 24: 2304, 14848, 5632, 3584, 3584, 1280 */
 303         {9, 58, 22, 14, 14, 5},
 304         /* corerev 25: */
 305         {0, 0, 0, 0, 0, 0},
 306         /* corerev 26: */
 307         {0, 0, 0, 0, 0, 0},
 308         /* corerev 27: */
 309         {0, 0, 0, 0, 0, 0},
 310         /* corerev 28: 2304, 14848, 5632, 3584, 3584, 1280 */
 311         {9, 58, 22, 14, 14, 5},
 312 };
 313
 314 #ifdef DEBUG
 315 static const char * const fifo_names[] = {
 316         "AC_BK", "AC_BE", "AC_VI", "AC_VO", "BCMC", "ATIM" };
 317 #else
 318 static const char fifo_names[6][0];
 319 #endif
 320
 321 #ifdef DEBUG
 322 /* pointer to most recently allocated wl/wlc */
 323 static struct brcms_c_info *wlc_info_dbg = (struct brcms_c_info *) (NULL);
 324 #endif
 325
 326 /* Mapping of ieee80211 AC numbers to tx fifos */
 327 static const u8 ac_to_fifo_mapping[IEEE80211_NUM_ACS] = {
 328         [IEEE80211_AC_VO]       = TX_AC_VO_FIFO,
 329         [IEEE80211_AC_VI]       = TX_AC_VI_FIFO,
 330         [IEEE80211_AC_BE]       = TX_AC_BE_FIFO,
 331         [IEEE80211_AC_BK]       = TX_AC_BK_FIFO,
 332 };
 333
 334 /* Mapping of tx fifos to ieee80211 AC numbers */
 335 static const u8 fifo_to_ac_mapping[IEEE80211_NUM_ACS] = {
 336         [TX_AC_BK_FIFO] = IEEE80211_AC_BK,
 337         [TX_AC_BE_FIFO] = IEEE80211_AC_BE,
 338         [TX_AC_VI_FIFO] = IEEE80211_AC_VI,
 339         [TX_AC_VO_FIFO] = IEEE80211_AC_VO,
 340 };
 341
 342 static u8 brcms_ac_to_fifo(u8 ac)
 343 {
 344         if (ac >= ARRAY_SIZE(ac_to_fifo_mapping))
 345                 return TX_AC_BE_FIFO;
 346         return ac_to_fifo_mapping[ac];
 347 }
 348
 349 static u8 brcms_fifo_to_ac(u8 fifo)
 350 {
 351         if (fifo >= ARRAY_SIZE(fifo_to_ac_mapping))
 352                 return IEEE80211_AC_BE;
 353         return fifo_to_ac_mapping[fifo];
 354 }
 355
 356 /* Find basic rate for a given rate */
 357 static u8 brcms_basic_rate(struct brcms_c_info *wlc, u32 rspec)
 358 {
 359         if (is_mcs_rate(rspec))
 360                 return wlc->band->basic_rate[mcs_table[rspec & RSPEC_RATE_MASK]
 361                        .leg_ofdm];
 362         return wlc->band->basic_rate[rspec & RSPEC_RATE_MASK];
 363 }
 364
 365 static u16 frametype(u32 rspec, u8 mimoframe)
 366 {
 367         if (is_mcs_rate(rspec))
 368                 return mimoframe;
 369         return is_cck_rate(rspec) ? FT_CCK : FT_OFDM;
 370 }
 371
 372 /* currently the best mechanism for determining SIFS is the band in use */
 373 static u16 get_sifs(struct brcms_band *band)
 374 {
 375         return band->bandtype == BRCM_BAND_5G ? APHY_SIFS_TIME :
 376                                  BPHY_SIFS_TIME;
 377 }
 378
 379 /*
 380  * Detect Card removed.
 381  * Even checking an sbconfig register read will not false trigger when the core
 382  * is in reset it breaks CF address mechanism. Accessing gphy phyversion will
 383  * cause SB error if aphy is in reset on 4306B0-DB. Need a simple accessible
 384  * reg with fixed 0/1 pattern (some platforms return all 0).
 385  * If clocks are present, call the sb routine which will figure out if the
 386  * device is removed.
 387  */
 388 static bool brcms_deviceremoved(struct brcms_c_info *wlc)
 389 {
 390         u32 macctrl;
 391
 392         if (!wlc->hw->clk)
 393                 return ai_deviceremoved(wlc->hw->sih);
 394         macctrl = bcma_read32(wlc->hw->d11core,
 395                               D11REGOFFS(maccontrol));
 396         return (macctrl & (MCTL_PSM_JMP_0 | MCTL_IHR_EN)) != MCTL_IHR_EN;
 397 }
 398
 399 /* sum the individual fifo tx pending packet counts */
 400 static int brcms_txpktpendtot(struct brcms_c_info *wlc)
 401 {
 402         int i;
 403         int pending = 0;
 404
 405         for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
 406                 if (wlc->hw->di[i])
 407                         pending += dma_txpending(wlc->hw->di[i]);
 408         return pending;
 409 }
 410
 411 static bool brcms_is_mband_unlocked(struct brcms_c_info *wlc)
 412 {
 413         return wlc->pub->_nbands > 1 && !wlc->bandlocked;
 414 }
 415
 416 static int brcms_chspec_bw(u16 chanspec)
 417 {
 418         if (CHSPEC_IS40(chanspec))
 419                 return BRCMS_40_MHZ;
 420         if (CHSPEC_IS20(chanspec))
 421                 return BRCMS_20_MHZ;
 422
 423         return BRCMS_10_MHZ;
 424 }
 425
 426 static void brcms_c_bsscfg_mfree(struct brcms_bss_cfg *cfg)
 427 {
 428         if (cfg == NULL)
 429                 return;
 430
 431         kfree(cfg->current_bss);
 432         kfree(cfg);
 433 }
 434
 435 static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
 436 {
 437         if (wlc == NULL)
 438                 return;
 439
 440         brcms_c_bsscfg_mfree(wlc->bsscfg);
 441         kfree(wlc->pub);
 442         kfree(wlc->modulecb);
 443         kfree(wlc->default_bss);
 444         kfree(wlc->protection);
 445         kfree(wlc->stf);
 446         kfree(wlc->bandstate[0]);
 447         kfree(wlc->corestate->macstat_snapshot);
 448         kfree(wlc->corestate);
 449         kfree(wlc->hw->bandstate[0]);
 450         kfree(wlc->hw);
 451
 452         /* free the wlc */
 453         kfree(wlc);
 454         wlc = NULL;
 455 }
 456
 457 static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
 458 {
 459         struct brcms_bss_cfg *cfg;
 460
 461         cfg = kzalloc(sizeof(struct brcms_bss_cfg), GFP_ATOMIC);
 462         if (cfg == NULL)
 463                 goto fail;
 464
 465         cfg->current_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
 466         if (cfg->current_bss == NULL)
 467                 goto fail;
 468
 469         return cfg;
 470
 471  fail:
 472         brcms_c_bsscfg_mfree(cfg);
 473         return NULL;
 474 }
 475
 476 static struct brcms_c_info *
 477 brcms_c_attach_malloc(uint unit, uint *err, uint devid)
 478 {
 479         struct brcms_c_info *wlc;
 480
 481         wlc = kzalloc(sizeof(struct brcms_c_info), GFP_ATOMIC);
 482         if (wlc == NULL) {
 483                 *err = 1002;
 484                 goto fail;
 485         }
 486
 487         /* allocate struct brcms_c_pub state structure */
 488         wlc->pub = kzalloc(sizeof(struct brcms_pub), GFP_ATOMIC);
 489         if (wlc->pub == NULL) {
 490                 *err = 1003;
 491                 goto fail;
 492         }
 493         wlc->pub->wlc = wlc;
 494
 495         /* allocate struct brcms_hardware state structure */
 496
 497         wlc->hw = kzalloc(sizeof(struct brcms_hardware), GFP_ATOMIC);
 498         if (wlc->hw == NULL) {
 499                 *err = 1005;
 500                 goto fail;
 501         }
 502         wlc->hw->wlc = wlc;
 503
 504         wlc->hw->bandstate[0] =
 505                 kzalloc(sizeof(struct brcms_hw_band) * MAXBANDS, GFP_ATOMIC);
 506         if (wlc->hw->bandstate[0] == NULL) {
 507                 *err = 1006;
 508                 goto fail;
 509         } else {
 510                 int i;
 511
 512                 for (i = 1; i < MAXBANDS; i++)
 513                         wlc->hw->bandstate[i] = (struct brcms_hw_band *)
 514                             ((unsigned long)wlc->hw->bandstate[0] +
 515                              (sizeof(struct brcms_hw_band) * i));
 516         }
 517
 518         wlc->modulecb =
 519                 kzalloc(sizeof(struct modulecb) * BRCMS_MAXMODULES, GFP_ATOMIC);
 520         if (wlc->modulecb == NULL) {
 521                 *err = 1009;
 522                 goto fail;
 523         }
 524
 525         wlc->default_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
 526         if (wlc->default_bss == NULL) {
 527                 *err = 1010;
 528                 goto fail;
 529         }
 530
 531         wlc->bsscfg = brcms_c_bsscfg_malloc(unit);
 532         if (wlc->bsscfg == NULL) {
 533                 *err = 1011;
 534                 goto fail;
 535         }
 536
 537         wlc->protection = kzalloc(sizeof(struct brcms_protection),
 538                                   GFP_ATOMIC);
 539         if (wlc->protection == NULL) {
 540                 *err = 1016;
 541                 goto fail;
 542         }
 543
 544         wlc->stf = kzalloc(sizeof(struct brcms_stf), GFP_ATOMIC);
 545         if (wlc->stf == NULL) {
 546                 *err = 1017;
 547                 goto fail;
 548         }
 549
 550         wlc->bandstate[0] =
 551                 kzalloc(sizeof(struct brcms_band)*MAXBANDS, GFP_ATOMIC);
 552         if (wlc->bandstate[0] == NULL) {
 553                 *err = 1025;
 554                 goto fail;
 555         } else {
 556                 int i;
 557
 558                 for (i = 1; i < MAXBANDS; i++)
 559                         wlc->bandstate[i] = (struct brcms_band *)
 560                                 ((unsigned long)wlc->bandstate[0]
 561                                 + (sizeof(struct brcms_band)*i));
 562         }
 563
 564         wlc->corestate = kzalloc(sizeof(struct brcms_core), GFP_ATOMIC);
 565         if (wlc->corestate == NULL) {
 566                 *err = 1026;
 567                 goto fail;
 568         }
 569
 570         wlc->corestate->macstat_snapshot =
 571                 kzalloc(sizeof(struct macstat), GFP_ATOMIC);
 572         if (wlc->corestate->macstat_snapshot == NULL) {
 573                 *err = 1027;
 574                 goto fail;
 575         }
 576
 577         return wlc;
 578
 579  fail:
 580         brcms_c_detach_mfree(wlc);
 581         return NULL;
 582 }
 583
 584 /*
 585  * Update the slot timing for standard 11b/g (20us slots)
 586  * or shortslot 11g (9us slots)
 587  * The PSM needs to be suspended for this call.
 588  */
 589 static void brcms_b_update_slot_timing(struct brcms_hardware *wlc_hw,
 590                                         bool shortslot)
 591 {
 592         struct bcma_device *core = wlc_hw->d11core;
 593
 594         if (shortslot) {
 595                 /* 11g short slot: 11a timing */
 596                 bcma_write16(core, D11REGOFFS(ifs_slot), 0x0207);
 597                 brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, APHY_SLOT_TIME);
 598         } else {
 599                 /* 11g long slot: 11b timing */
 600                 bcma_write16(core, D11REGOFFS(ifs_slot), 0x0212);
 601                 brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, BPHY_SLOT_TIME);
 602         }
 603 }
 604
 605 /*
 606  * calculate frame duration of a given rate and length, return
 607  * time in usec unit
 608  */
 609 static uint brcms_c_calc_frame_time(struct brcms_c_info *wlc, u32 ratespec,
 610                                     u8 preamble_type, uint mac_len)
 611 {
 612         uint nsyms, dur = 0, Ndps, kNdps;
 613         uint rate = rspec2rate(ratespec);
 614
 615         if (rate == 0) {
 616                 brcms_err(wlc->hw->d11core, "wl%d: WAR: using rate of 1 mbps\n",
 617                           wlc->pub->unit);
 618                 rate = BRCM_RATE_1M;
 619         }
 620
 621         if (is_mcs_rate(ratespec)) {
 622                 uint mcs = ratespec & RSPEC_RATE_MASK;
 623                 int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
 624
 625                 dur = PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
 626                 if (preamble_type == BRCMS_MM_PREAMBLE)
 627                         dur += PREN_MM_EXT;
 628                 /* 1000Ndbps = kbps * 4 */
 629                 kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
 630                                    rspec_issgi(ratespec)) * 4;
 631
 632                 if (rspec_stc(ratespec) == 0)
 633                         nsyms =
 634                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
 635                                   APHY_TAIL_NBITS) * 1000, kNdps);
 636                 else
 637                         /* STBC needs to have even number of symbols */
 638                         nsyms =
 639                             2 *
 640                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
 641                                   APHY_TAIL_NBITS) * 1000, 2 * kNdps);
 642
 643                 dur += APHY_SYMBOL_TIME * nsyms;
 644                 if (wlc->band->bandtype == BRCM_BAND_2G)
 645                         dur += DOT11_OFDM_SIGNAL_EXTENSION;
 646         } else if (is_ofdm_rate(rate)) {
 647                 dur = APHY_PREAMBLE_TIME;
 648                 dur += APHY_SIGNAL_TIME;
 649                 /* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
 650                 Ndps = rate * 2;
 651                 /* NSyms = CEILING((SERVICE + 8*NBytes + TAIL) / Ndbps) */
 652                 nsyms =
 653                     CEIL((APHY_SERVICE_NBITS + 8 * mac_len + APHY_TAIL_NBITS),
 654                          Ndps);
 655                 dur += APHY_SYMBOL_TIME * nsyms;
 656                 if (wlc->band->bandtype == BRCM_BAND_2G)
 657                         dur += DOT11_OFDM_SIGNAL_EXTENSION;
 658         } else {
 659                 /*
 660                  * calc # bits * 2 so factor of 2 in rate (1/2 mbps)
 661                  * will divide out
 662                  */
 663                 mac_len = mac_len * 8 * 2;
 664                 /* calc ceiling of bits/rate = microseconds of air time */
 665                 dur = (mac_len + rate - 1) / rate;
 666                 if (preamble_type & BRCMS_SHORT_PREAMBLE)
 667                         dur += BPHY_PLCP_SHORT_TIME;
 668                 else
 669                         dur += BPHY_PLCP_TIME;
 670         }
 671         return dur;
 672 }
 673
 674 static void brcms_c_write_inits(struct brcms_hardware *wlc_hw,
 675                                 const struct d11init *inits)
 676 {
 677         struct bcma_device *core = wlc_hw->d11core;
 678         int i;
 679         uint offset;
 680         u16 size;
 681         u32 value;
 682
 683         brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
 684
 685         for (i = 0; inits[i].addr != cpu_to_le16(0xffff); i++) {
 686                 size = le16_to_cpu(inits[i].size);
 687                 offset = le16_to_cpu(inits[i].addr);
 688                 value = le32_to_cpu(inits[i].value);
 689                 if (size == 2)
 690                         bcma_write16(core, offset, value);
 691                 else if (size == 4)
 692                         bcma_write32(core, offset, value);
 693                 else
 694                         break;
 695         }
 696 }
 697
 698 static void brcms_c_write_mhf(struct brcms_hardware *wlc_hw, u16 *mhfs)
 699 {
 700         u8 idx;
 701         u16 addr[] = {
 702                 M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
 703                 M_HOST_FLAGS5
 704         };
 705
 706         for (idx = 0; idx < MHFMAX; idx++)
 707                 brcms_b_write_shm(wlc_hw, addr[idx], mhfs[idx]);
 708 }
 709
 710 static void brcms_c_ucode_bsinit(struct brcms_hardware *wlc_hw)
 711 {
 712         struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
 713
 714         /* init microcode host flags */
 715         brcms_c_write_mhf(wlc_hw, wlc_hw->band->mhfs);
 716
 717         /* do band-specific ucode IHR, SHM, and SCR inits */
 718         if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
 719                 if (BRCMS_ISNPHY(wlc_hw->band))
 720                         brcms_c_write_inits(wlc_hw, ucode->d11n0bsinitvals16);
 721                 else
 722                         brcms_err(wlc_hw->d11core,
 723                                   "%s: wl%d: unsupported phy in corerev %d\n",
 724                                   __func__, wlc_hw->unit,
 725                                   wlc_hw->corerev);
 726         } else {
 727                 if (D11REV_IS(wlc_hw->corerev, 24)) {
 728                         if (BRCMS_ISLCNPHY(wlc_hw->band))
 729                                 brcms_c_write_inits(wlc_hw,
 730                                                     ucode->d11lcn0bsinitvals24);
 731                         else
 732                                 brcms_err(wlc_hw->d11core,
 733                                           "%s: wl%d: unsupported phy in core rev %d\n",
 734                                           __func__, wlc_hw->unit,
 735                                           wlc_hw->corerev);
 736                 } else {
 737                         brcms_err(wlc_hw->d11core,
 738                                   "%s: wl%d: unsupported corerev %d\n",
 739                                   __func__, wlc_hw->unit, wlc_hw->corerev);
 740                 }
 741         }
 742 }
 743
 744 static void brcms_b_core_ioctl(struct brcms_hardware *wlc_hw, u32 m, u32 v)
 745 {
 746         struct bcma_device *core = wlc_hw->d11core;
 747         u32 ioctl = bcma_aread32(core, BCMA_IOCTL) & ~m;
 748
 749         bcma_awrite32(core, BCMA_IOCTL, ioctl | v);
 750 }
 751
 752 static void brcms_b_core_phy_clk(struct brcms_hardware *wlc_hw, bool clk)
 753 {
 754         brcms_dbg_info(wlc_hw->d11core, "wl%d: clk %d\n", wlc_hw->unit, clk);
 755
 756         wlc_hw->phyclk = clk;
 757
 758         if (OFF == clk) {       /* clear gmode bit, put phy into reset */
 759
 760                 brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC | SICF_GMODE),
 761                                    (SICF_PRST | SICF_FGC));
 762                 udelay(1);
 763                 brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_PRST);
 764                 udelay(1);
 765
 766         } else {                /* take phy out of reset */
 767
 768                 brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_FGC);
 769                 udelay(1);
 770                 brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
 771                 udelay(1);
 772
 773         }
 774 }
 775
 776 /* low-level band switch utility routine */
 777 static void brcms_c_setxband(struct brcms_hardware *wlc_hw, uint bandunit)
 778 {
 779         brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
 780                            bandunit);
 781
 782         wlc_hw->band = wlc_hw->bandstate[bandunit];
 783
 784         /*
 785          * BMAC_NOTE:
 786          *   until we eliminate need for wlc->band refs in low level code
 787          */
 788         wlc_hw->wlc->band = wlc_hw->wlc->bandstate[bandunit];
 789
 790         /* set gmode core flag */
 791         if (wlc_hw->sbclk && !wlc_hw->noreset) {
 792                 u32 gmode = 0;
 793
 794                 if (bandunit == 0)
 795                         gmode = SICF_GMODE;
 796
 797                 brcms_b_core_ioctl(wlc_hw, SICF_GMODE, gmode);
 798         }
 799 }
 800
 801 /* switch to new band but leave it inactive */
 802 static u32 brcms_c_setband_inact(struct brcms_c_info *wlc, uint bandunit)
 803 {
 804         struct brcms_hardware *wlc_hw = wlc->hw;
 805         u32 macintmask;
 806         u32 macctrl;
 807
 808         brcms_dbg_mac80211(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
 809         macctrl = bcma_read32(wlc_hw->d11core,
 810                               D11REGOFFS(maccontrol));
 811         WARN_ON((macctrl & MCTL_EN_MAC) != 0);
 812
 813         /* disable interrupts */
 814         macintmask = brcms_intrsoff(wlc->wl);
 815
 816         /* radio off */
 817         wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
 818
 819         brcms_b_core_phy_clk(wlc_hw, OFF);
 820
 821         brcms_c_setxband(wlc_hw, bandunit);
 822
 823         return macintmask;
 824 }
 825
 826 /* process an individual struct tx_status */
 827 static bool
 828 brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
 829 {
 830         struct sk_buff *p = NULL;
 831         uint queue = NFIFO;
 832         struct dma_pub *dma = NULL;
 833         struct d11txh *txh = NULL;
 834         struct scb *scb = NULL;
 835         bool free_pdu;
 836         int tx_rts, tx_frame_count, tx_rts_count;
 837         uint totlen, supr_status;
 838         bool lastframe;
 839         struct ieee80211_hdr *h;
 840         u16 mcl;
 841         struct ieee80211_tx_info *tx_info;
 842         struct ieee80211_tx_rate *txrate;
 843         int i;
 844         bool fatal = true;
 845
 846         trace_brcms_txstatus(&wlc->hw->d11core->dev, txs->framelen,
 847                              txs->frameid, txs->status, txs->lasttxtime,
 848                              txs->sequence, txs->phyerr, txs->ackphyrxsh);
 849
 850         /* discard intermediate indications for ucode with one legitimate case:
 851          *   e.g. if "useRTS" is set. ucode did a successful rts/cts exchange,
 852          *   but the subsequent tx of DATA failed. so it will start rts/cts
 853          *   from the beginning (resetting the rts transmission count)
 854          */
 855         if (!(txs->status & TX_STATUS_AMPDU)
 856             && (txs->status & TX_STATUS_INTERMEDIATE)) {
 857                 brcms_dbg_tx(wlc->hw->d11core, "INTERMEDIATE but not AMPDU\n");
 858                 fatal = false;
 859                 goto out;
 860         }
 861
 862         queue = txs->frameid & TXFID_QUEUE_MASK;
 863         if (queue >= NFIFO) {
 864                 brcms_err(wlc->hw->d11core, "queue %u >= NFIFO\n", queue);
 865                 goto out;
 866         }
 867
 868         dma = wlc->hw->di[queue];
 869
 870         p = dma_getnexttxp(wlc->hw->di[queue], DMA_RANGE_TRANSMITTED);
 871         if (p == NULL) {
 872                 brcms_err(wlc->hw->d11core, "dma_getnexttxp returned null!\n");
 873                 goto out;
 874         }
 875
 876         txh = (struct d11txh *) (p->data);
 877         mcl = le16_to_cpu(txh->MacTxControlLow);
 878
 879         if (txs->phyerr)
 880                 brcms_err(wlc->hw->d11core, "phyerr 0x%x, rate 0x%x\n",
 881                           txs->phyerr, txh->MainRates);
 882
 883         if (txs->frameid != le16_to_cpu(txh->TxFrameID)) {
 884                 brcms_err(wlc->hw->d11core, "frameid != txh->TxFrameID\n");
 885                 goto out;
 886         }
 887         tx_info = IEEE80211_SKB_CB(p);
 888         h = (struct ieee80211_hdr *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN);
 889
 890         if (tx_info->rate_driver_data[0])
 891                 scb = &wlc->pri_scb;
 892
 893         if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
 894                 brcms_c_ampdu_dotxstatus(wlc->ampdu, scb, p, txs);
 895                 fatal = false;
 896                 goto out;
 897         }
 898
 899         /*
 900          * brcms_c_ampdu_dotxstatus() will trace tx descriptors for AMPDU
 901          * frames; this traces them for the rest.
 902          */
 903         trace_brcms_txdesc(&wlc->hw->d11core->dev, txh, sizeof(*txh));
 904
 905         supr_status = txs->status & TX_STATUS_SUPR_MASK;
 906         if (supr_status == TX_STATUS_SUPR_BADCH) {
 907                 unsigned xfts = le16_to_cpu(txh->XtraFrameTypes);
 908                 brcms_dbg_tx(wlc->hw->d11core,
 909                              "Pkt tx suppressed, dest chan %u, current %d\n",
 910                              (xfts >> XFTS_CHANNEL_SHIFT) & 0xff,
 911                              CHSPEC_CHANNEL(wlc->default_bss->chanspec));
 912         }
 913
 914         tx_rts = le16_to_cpu(txh->MacTxControlLow) & TXC_SENDRTS;
 915         tx_frame_count =
 916             (txs->status & TX_STATUS_FRM_RTX_MASK) >> TX_STATUS_FRM_RTX_SHIFT;
 917         tx_rts_count =
 918             (txs->status & TX_STATUS_RTS_RTX_MASK) >> TX_STATUS_RTS_RTX_SHIFT;
 919
 920         lastframe = !ieee80211_has_morefrags(h->frame_control);
 921
 922         if (!lastframe) {
 923                 brcms_err(wlc->hw->d11core, "Not last frame!\n");
 924         } else {
 925                 /*
 926                  * Set information to be consumed by Minstrel ht.
 927                  *
 928                  * The "fallback limit" is the number of tx attempts a given
 929                  * MPDU is sent at the "primary" rate. Tx attempts beyond that
 930                  * limit are sent at the "secondary" rate.
 931                  * A 'short frame' does not exceed RTS treshold.
 932                  */
 933                 u16 sfbl,       /* Short Frame Rate Fallback Limit */
 934                     lfbl,       /* Long Frame Rate Fallback Limit */
 935                     fbl;
 936
 937                 if (queue < IEEE80211_NUM_ACS) {
 938                         sfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
 939                                       EDCF_SFB);
 940                         lfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
 941                                       EDCF_LFB);
 942                 } else {
 943                         sfbl = wlc->SFBL;
 944                         lfbl = wlc->LFBL;
 945                 }
 946
 947                 txrate = tx_info->status.rates;
 948                 if (txrate[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
 949                         fbl = lfbl;
 950                 else
 951                         fbl = sfbl;
 952
 953                 ieee80211_tx_info_clear_status(tx_info);
 954
 955                 if ((tx_frame_count > fbl) && (txrate[1].idx >= 0)) {
 956                         /*
 957                          * rate selection requested a fallback rate
 958                          * and we used it
 959                          */
 960                         txrate[0].count = fbl;
 961                         txrate[1].count = tx_frame_count - fbl;
 962                 } else {
 963                         /*
 964                          * rate selection did not request fallback rate, or
 965                          * we didn't need it
 966                          */
 967                         txrate[0].count = tx_frame_count;
 968                         /*
 969                          * rc80211_minstrel.c:minstrel_tx_status() expects
 970                          * unused rates to be marked with idx = -1
 971                          */
 972                         txrate[1].idx = -1;
 973                         txrate[1].count = 0;
 974                 }
 975
 976                 /* clear the rest of the rates */
 977                 for (i = 2; i < IEEE80211_TX_MAX_RATES; i++) {
 978                         txrate[i].idx = -1;
 979                         txrate[i].count = 0;
 980                 }
 981
 982                 if (txs->status & TX_STATUS_ACK_RCV)
 983                         tx_info->flags |= IEEE80211_TX_STAT_ACK;
 984         }
 985
 986         totlen = p->len;
 987         free_pdu = true;
 988
 989         if (lastframe) {
 990                 /* remove PLCP & Broadcom tx descriptor header */
 991                 skb_pull(p, D11_PHY_HDR_LEN);
 992                 skb_pull(p, D11_TXH_LEN);
 993                 ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw, p);
 994         } else {
 995                 brcms_err(wlc->hw->d11core,
 996                           "%s: Not last frame => not calling tx_status\n",
 997                           __func__);
 998         }
 999
1000         fatal = false;
1001
1002  out:
1003         if (fatal) {
1004                 if (txh)
1005                         trace_brcms_txdesc(&wlc->hw->d11core->dev, txh,
1006                                            sizeof(*txh));
1007                 if (p)
1008                         brcmu_pkt_buf_free_skb(p);
1009         }
1010
1011         if (dma && queue < NFIFO) {
1012                 u16 ac_queue = brcms_fifo_to_ac(queue);
1013                 if (dma->txavail > TX_HEADROOM && queue < TX_BCMC_FIFO &&
1014                     ieee80211_queue_stopped(wlc->pub->ieee_hw, ac_queue))
1015                         ieee80211_wake_queue(wlc->pub->ieee_hw, ac_queue);
1016                 dma_kick_tx(dma);
1017         }
1018
1019         return fatal;
1020 }
1021
1022 /* process tx completion events in BMAC
1023  * Return true if more tx status need to be processed. false otherwise.
1024  */
1025 static bool
1026 brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
1027 {
1028         struct bcma_device *core;
1029         struct tx_status txstatus, *txs;
1030         u32 s1, s2;
1031         uint n = 0;
1032         /*
1033          * Param 'max_tx_num' indicates max. # tx status to process before
1034          * break out.
1035          */
1036         uint max_tx_num = bound ? TXSBND : -1;
1037
1038         txs = &txstatus;
1039         core = wlc_hw->d11core;
1040         *fatal = false;
1041
1042         while (n < max_tx_num) {
1043                 s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
1044                 if (s1 == 0xffffffff) {
1045                         brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
1046                                   __func__);
1047                         *fatal = true;
1048                         return false;
1049                 }
1050                 /* only process when valid */
1051                 if (!(s1 & TXS_V))
1052                         break;
1053
1054                 s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
1055                 txs->status = s1 & TXS_STATUS_MASK;
1056                 txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
1057                 txs->sequence = s2 & TXS_SEQ_MASK;
1058                 txs->phyerr = (s2 & TXS_PTX_MASK) >> TXS_PTX_SHIFT;
1059                 txs->lasttxtime = 0;
1060
1061                 *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
1062                 if (*fatal == true)
1063                         return false;
1064                 n++;
1065         }
1066
1067         return n >= max_tx_num;
1068 }
1069
1070 static void brcms_c_tbtt(struct brcms_c_info *wlc)
1071 {
1072         if (wlc->bsscfg->type == BRCMS_TYPE_ADHOC)
1073                 /*
1074                  * DirFrmQ is now valid...defer setting until end
1075                  * of ATIM window
1076                  */
1077                 wlc->qvalid |= MCMD_DIRFRMQVAL;
1078 }
1079
1080 /* set initial host flags value */
1081 static void
1082 brcms_c_mhfdef(struct brcms_c_info *wlc, u16 *mhfs, u16 mhf2_init)
1083 {
1084         struct brcms_hardware *wlc_hw = wlc->hw;
1085
1086         memset(mhfs, 0, MHFMAX * sizeof(u16));
1087
1088         mhfs[MHF2] |= mhf2_init;
1089
1090         /* prohibit use of slowclock on multifunction boards */
1091         if (wlc_hw->boardflags & BFL_NOPLLDOWN)
1092                 mhfs[MHF1] |= MHF1_FORCEFASTCLK;
1093
1094         if (BRCMS_ISNPHY(wlc_hw->band) && NREV_LT(wlc_hw->band->phyrev, 2)) {
1095                 mhfs[MHF2] |= MHF2_NPHY40MHZ_WAR;
1096                 mhfs[MHF1] |= MHF1_IQSWAP_WAR;
1097         }
1098 }
1099
1100 static uint
1101 dmareg(uint direction, uint fifonum)
1102 {
1103         if (direction == DMA_TX)
1104                 return offsetof(struct d11regs, fifo64regs[fifonum].dmaxmt);
1105         return offsetof(struct d11regs, fifo64regs[fifonum].dmarcv);
1106 }
1107
1108 static bool brcms_b_attach_dmapio(struct brcms_c_info *wlc, uint j, bool wme)
1109 {
1110         uint i;
1111         char name[8];
1112         /*
1113          * ucode host flag 2 needed for pio mode, independent of band and fifo
1114          */
1115         u16 pio_mhf2 = 0;
1116         struct brcms_hardware *wlc_hw = wlc->hw;
1117         uint unit = wlc_hw->unit;
1118
1119         /* name and offsets for dma_attach */
1120         snprintf(name, sizeof(name), "wl%d", unit);
1121
1122         if (wlc_hw->di[0] == NULL) {    /* Init FIFOs */
1123                 int dma_attach_err = 0;
1124
1125                 /*
1126                  * FIFO 0
1127                  * TX: TX_AC_BK_FIFO (TX AC Background data packets)
1128                  * RX: RX_FIFO (RX data packets)
1129                  */
1130                 wlc_hw->di[0] = dma_attach(name, wlc,
1131                                            (wme ? dmareg(DMA_TX, 0) : 0),
1132                                            dmareg(DMA_RX, 0),
1133                                            (wme ? NTXD : 0), NRXD,
1134                                            RXBUFSZ, -1, NRXBUFPOST,
1135                                            BRCMS_HWRXOFF);
1136                 dma_attach_err |= (NULL == wlc_hw->di[0]);
1137
1138                 /*
1139                  * FIFO 1
1140                  * TX: TX_AC_BE_FIFO (TX AC Best-Effort data packets)
1141                  *   (legacy) TX_DATA_FIFO (TX data packets)
1142                  * RX: UNUSED
1143                  */
1144                 wlc_hw->di[1] = dma_attach(name, wlc,
1145                                            dmareg(DMA_TX, 1), 0,
1146                                            NTXD, 0, 0, -1, 0, 0);
1147                 dma_attach_err |= (NULL == wlc_hw->di[1]);
1148
1149                 /*
1150                  * FIFO 2
1151                  * TX: TX_AC_VI_FIFO (TX AC Video data packets)
1152                  * RX: UNUSED
1153                  */
1154                 wlc_hw->di[2] = dma_attach(name, wlc,
1155                                            dmareg(DMA_TX, 2), 0,
1156                                            NTXD, 0, 0, -1, 0, 0);
1157                 dma_attach_err |= (NULL == wlc_hw->di[2]);
1158                 /*
1159                  * FIFO 3
1160                  * TX: TX_AC_VO_FIFO (TX AC Voice data packets)
1161                  *   (legacy) TX_CTL_FIFO (TX control & mgmt packets)
1162                  */
1163                 wlc_hw->di[3] = dma_attach(name, wlc,
1164                                            dmareg(DMA_TX, 3),
1165                                            0, NTXD, 0, 0, -1,
1166                                            0, 0);
1167                 dma_attach_err |= (NULL == wlc_hw->di[3]);
1168 /* Cleaner to leave this as if with AP defined */
1169
1170                 if (dma_attach_err) {
1171                         brcms_err(wlc_hw->d11core,
1172                                   "wl%d: wlc_attach: dma_attach failed\n",
1173                                   unit);
1174                         return false;
1175                 }
1176
1177                 /* get pointer to dma engine tx flow control variable */
1178                 for (i = 0; i < NFIFO; i++)
1179                         if (wlc_hw->di[i])
1180                                 wlc_hw->txavail[i] =
1181                                     (uint *) dma_getvar(wlc_hw->di[i],
1182                                                         "&txavail");
1183         }
1184
1185         /* initial ucode host flags */
1186         brcms_c_mhfdef(wlc, wlc_hw->band->mhfs, pio_mhf2);
1187
1188         return true;
1189 }
1190
1191 static void brcms_b_detach_dmapio(struct brcms_hardware *wlc_hw)
1192 {
1193         uint j;
1194
1195         for (j = 0; j < NFIFO; j++) {
1196                 if (wlc_hw->di[j]) {
1197                         dma_detach(wlc_hw->di[j]);
1198                         wlc_hw->di[j] = NULL;
1199                 }
1200         }
1201 }
1202
1203 /*
1204  * Initialize brcms_c_info default values ...
1205  * may get overrides later in this function
1206  *  BMAC_NOTES, move low out and resolve the dangling ones
1207  */
1208 static void brcms_b_info_init(struct brcms_hardware *wlc_hw)
1209 {
1210         struct brcms_c_info *wlc = wlc_hw->wlc;
1211
1212         /* set default sw macintmask value */
1213         wlc->defmacintmask = DEF_MACINTMASK;
1214
1215         /* various 802.11g modes */
1216         wlc_hw->shortslot = false;
1217
1218         wlc_hw->SFBL = RETRY_SHORT_FB;
1219         wlc_hw->LFBL = RETRY_LONG_FB;
1220
1221         /* default mac retry limits */
1222         wlc_hw->SRL = RETRY_SHORT_DEF;
1223         wlc_hw->LRL = RETRY_LONG_DEF;
1224         wlc_hw->chanspec = ch20mhz_chspec(1);
1225 }
1226
1227 static void brcms_b_wait_for_wake(struct brcms_hardware *wlc_hw)
1228 {
1229         /* delay before first read of ucode state */
1230         udelay(40);
1231
1232         /* wait until ucode is no longer asleep */
1233         SPINWAIT((brcms_b_read_shm(wlc_hw, M_UCODE_DBGST) ==
1234                   DBGST_ASLEEP), wlc_hw->wlc->fastpwrup_dly);
1235 }
1236
1237 /* control chip clock to save power, enable dynamic clock or force fast clock */
1238 static void brcms_b_clkctl_clk(struct brcms_hardware *wlc_hw, enum bcma_clkmode mode)
1239 {
1240         if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU) {
1241                 /* new chips with PMU, CCS_FORCEHT will distribute the HT clock
1242                  * on backplane, but mac core will still run on ALP(not HT) when
1243                  * it enters powersave mode, which means the FCA bit may not be
1244                  * set. Should wakeup mac if driver wants it to run on HT.
1245                  */
1246
1247                 if (wlc_hw->clk) {
1248                         if (mode == BCMA_CLKMODE_FAST) {
1249                                 bcma_set32(wlc_hw->d11core,
1250                                            D11REGOFFS(clk_ctl_st),
1251                                            CCS_FORCEHT);
1252
1253                                 udelay(64);
1254
1255                                 SPINWAIT(
1256                                     ((bcma_read32(wlc_hw->d11core,
1257                                       D11REGOFFS(clk_ctl_st)) &
1258                                       CCS_HTAVAIL) == 0),
1259                                       PMU_MAX_TRANSITION_DLY);
1260                                 WARN_ON(!(bcma_read32(wlc_hw->d11core,
1261                                         D11REGOFFS(clk_ctl_st)) &
1262                                         CCS_HTAVAIL));
1263                         } else {
1264                                 if ((ai_get_pmurev(wlc_hw->sih) == 0) &&
1265                                     (bcma_read32(wlc_hw->d11core,
1266                                         D11REGOFFS(clk_ctl_st)) &
1267                                         (CCS_FORCEHT | CCS_HTAREQ)))
1268                                         SPINWAIT(
1269                                             ((bcma_read32(wlc_hw->d11core,
1270                                               offsetof(struct d11regs,
1271                                                        clk_ctl_st)) &
1272                                               CCS_HTAVAIL) == 0),
1273                                               PMU_MAX_TRANSITION_DLY);
1274                                 bcma_mask32(wlc_hw->d11core,
1275                                         D11REGOFFS(clk_ctl_st),
1276                                         ~CCS_FORCEHT);
1277                         }
1278                 }
1279                 wlc_hw->forcefastclk = (mode == BCMA_CLKMODE_FAST);
1280         } else {
1281
1282                 /* old chips w/o PMU, force HT through cc,
1283                  * then use FCA to verify mac is running fast clock
1284                  */
1285
1286                 wlc_hw->forcefastclk = ai_clkctl_cc(wlc_hw->sih, mode);
1287
1288                 /* check fast clock is available (if core is not in reset) */
1289                 if (wlc_hw->forcefastclk && wlc_hw->clk)
1290                         WARN_ON(!(bcma_aread32(wlc_hw->d11core, BCMA_IOST) &
1291                                   SISF_FCLKA));
1292
1293                 /*
1294                  * keep the ucode wake bit on if forcefastclk is on since we
1295                  * do not want ucode to put us back to slow clock when it dozes
1296                  * for PM mode. Code below matches the wake override bit with
1297                  * current forcefastclk state. Only setting bit in wake_override
1298                  * instead of waking ucode immediately since old code had this
1299                  * behavior. Older code set wlc->forcefastclk but only had the
1300                  * wake happen if the wakup_ucode work (protected by an up
1301                  * check) was executed just below.
1302                  */
1303                 if (wlc_hw->forcefastclk)
1304                         mboolset(wlc_hw->wake_override,
1305                                  BRCMS_WAKE_OVERRIDE_FORCEFAST);
1306                 else
1307                         mboolclr(wlc_hw->wake_override,
1308                                  BRCMS_WAKE_OVERRIDE_FORCEFAST);
1309         }
1310 }
1311
1312 /* set or clear ucode host flag bits
1313  * it has an optimization for no-change write
1314  * it only writes through shared memory when the core has clock;
1315  * pre-CLK changes should use wlc_write_mhf to get around the optimization
1316  *
1317  *
1318  * bands values are: BRCM_BAND_AUTO <--- Current band only
1319  *                   BRCM_BAND_5G   <--- 5G band only
1320  *                   BRCM_BAND_2G   <--- 2G band only
1321  *                   BRCM_BAND_ALL  <--- All bands
1322  */
1323 void
1324 brcms_b_mhf(struct brcms_hardware *wlc_hw, u8 idx, u16 mask, u16 val,
1325              int bands)
1326 {
1327         u16 save;
1328         u16 addr[MHFMAX] = {
1329                 M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
1330                 M_HOST_FLAGS5
1331         };
1332         struct brcms_hw_band *band;
1333
1334         if ((val & ~mask) || idx >= MHFMAX)
1335                 return; /* error condition */
1336
1337         switch (bands) {
1338                 /* Current band only or all bands,
1339                  * then set the band to current band
1340                  */
1341         case BRCM_BAND_AUTO:
1342         case BRCM_BAND_ALL:
1343                 band = wlc_hw->band;
1344                 break;
1345         case BRCM_BAND_5G:
1346                 band = wlc_hw->bandstate[BAND_5G_INDEX];
1347                 break;
1348         case BRCM_BAND_2G:
1349                 band = wlc_hw->bandstate[BAND_2G_INDEX];
1350                 break;
1351         default:
1352                 band = NULL;    /* error condition */
1353         }
1354
1355         if (band) {
1356                 save = band->mhfs[idx];
1357                 band->mhfs[idx] = (band->mhfs[idx] & ~mask) | val;
1358
1359                 /* optimization: only write through if changed, and
1360                  * changed band is the current band
1361                  */
1362                 if (wlc_hw->clk && (band->mhfs[idx] != save)
1363                     && (band == wlc_hw->band))
1364                         brcms_b_write_shm(wlc_hw, addr[idx],
1365                                            (u16) band->mhfs[idx]);
1366         }
1367
1368         if (bands == BRCM_BAND_ALL) {
1369                 wlc_hw->bandstate[0]->mhfs[idx] =
1370                     (wlc_hw->bandstate[0]->mhfs[idx] & ~mask) | val;
1371                 wlc_hw->bandstate[1]->mhfs[idx] =
1372                     (wlc_hw->bandstate[1]->mhfs[idx] & ~mask) | val;
1373         }
1374 }
1375
1376 /* set the maccontrol register to desired reset state and
1377  * initialize the sw cache of the register
1378  */
1379 static void brcms_c_mctrl_reset(struct brcms_hardware *wlc_hw)
1380 {
1381         /* IHR accesses are always enabled, PSM disabled, HPS off and WAKE on */
1382         wlc_hw->maccontrol = 0;
1383         wlc_hw->suspended_fifos = 0;
1384         wlc_hw->wake_override = 0;
1385         wlc_hw->mute_override = 0;
1386         brcms_b_mctrl(wlc_hw, ~0, MCTL_IHR_EN | MCTL_WAKE);
1387 }
1388
1389 /*
1390  * write the software state of maccontrol and
1391  * overrides to the maccontrol register
1392  */
1393 static void brcms_c_mctrl_write(struct brcms_hardware *wlc_hw)
1394 {
1395         u32 maccontrol = wlc_hw->maccontrol;
1396
1397         /* OR in the wake bit if overridden */
1398         if (wlc_hw->wake_override)
1399                 maccontrol |= MCTL_WAKE;
1400
1401         /* set AP and INFRA bits for mute if needed */
1402         if (wlc_hw->mute_override) {
1403                 maccontrol &= ~(MCTL_AP);
1404                 maccontrol |= MCTL_INFRA;
1405         }
1406
1407         bcma_write32(wlc_hw->d11core, D11REGOFFS(maccontrol),
1408                      maccontrol);
1409 }
1410
1411 /* set or clear maccontrol bits */
1412 void brcms_b_mctrl(struct brcms_hardware *wlc_hw, u32 mask, u32 val)
1413 {
1414         u32 maccontrol;
1415         u32 new_maccontrol;
1416
1417         if (val & ~mask)
1418                 return; /* error condition */
1419         maccontrol = wlc_hw->maccontrol;
1420         new_maccontrol = (maccontrol & ~mask) | val;
1421
1422         /* if the new maccontrol value is the same as the old, nothing to do */
1423         if (new_maccontrol == maccontrol)
1424                 return;
1425
1426         /* something changed, cache the new value */
1427         wlc_hw->maccontrol = new_maccontrol;
1428
1429         /* write the new values with overrides applied */
1430         brcms_c_mctrl_write(wlc_hw);
1431 }
1432
1433 void brcms_c_ucode_wake_override_set(struct brcms_hardware *wlc_hw,
1434                                  u32 override_bit)
1435 {
1436         if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE)) {
1437                 mboolset(wlc_hw->wake_override, override_bit);
1438                 return;
1439         }
1440
1441         mboolset(wlc_hw->wake_override, override_bit);
1442
1443         brcms_c_mctrl_write(wlc_hw);
1444         brcms_b_wait_for_wake(wlc_hw);
1445 }
1446
1447 void brcms_c_ucode_wake_override_clear(struct brcms_hardware *wlc_hw,
1448                                    u32 override_bit)
1449 {
1450         mboolclr(wlc_hw->wake_override, override_bit);
1451
1452         if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE))
1453                 return;
1454
1455         brcms_c_mctrl_write(wlc_hw);
1456 }
1457
1458 /* When driver needs ucode to stop beaconing, it has to make sure that
1459  * MCTL_AP is clear and MCTL_INFRA is set
1460  * Mode           MCTL_AP        MCTL_INFRA
1461  * AP                1              1
1462  * STA               0              1 <--- This will ensure no beacons
1463  * IBSS              0              0
1464  */
1465 static void brcms_c_ucode_mute_override_set(struct brcms_hardware *wlc_hw)
1466 {
1467         wlc_hw->mute_override = 1;
1468
1469         /* if maccontrol already has AP == 0 and INFRA == 1 without this
1470          * override, then there is no change to write
1471          */
1472         if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1473                 return;
1474
1475         brcms_c_mctrl_write(wlc_hw);
1476 }
1477
1478 /* Clear the override on AP and INFRA bits */
1479 static void brcms_c_ucode_mute_override_clear(struct brcms_hardware *wlc_hw)
1480 {
1481         if (wlc_hw->mute_override == 0)
1482                 return;
1483
1484         wlc_hw->mute_override = 0;
1485
1486         /* if maccontrol already has AP == 0 and INFRA == 1 without this
1487          * override, then there is no change to write
1488          */
1489         if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1490                 return;
1491
1492         brcms_c_mctrl_write(wlc_hw);
1493 }
1494
1495 /*
1496  * Write a MAC address to the given match reg offset in the RXE match engine.
1497  */
1498 static void
1499 brcms_b_set_addrmatch(struct brcms_hardware *wlc_hw, int match_reg_offset,
1500                        const u8 *addr)
1501 {
1502         struct bcma_device *core = wlc_hw->d11core;
1503         u16 mac_l;
1504         u16 mac_m;
1505         u16 mac_h;
1506
1507         brcms_dbg_rx(core, "wl%d: brcms_b_set_addrmatch\n", wlc_hw->unit);
1508
1509         mac_l = addr[0] | (addr[1] << 8);
1510         mac_m = addr[2] | (addr[3] << 8);
1511         mac_h = addr[4] | (addr[5] << 8);
1512
1513         /* enter the MAC addr into the RXE match registers */
1514         bcma_write16(core, D11REGOFFS(rcm_ctl),
1515                      RCM_INC_DATA | match_reg_offset);
1516         bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_l);
1517         bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_m);
1518         bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_h);
1519 }
1520
1521 void
1522 brcms_b_write_template_ram(struct brcms_hardware *wlc_hw, int offset, int len,
1523                             void *buf)
1524 {
1525         struct bcma_device *core = wlc_hw->d11core;
1526         u32 word;
1527         __le32 word_le;
1528         __be32 word_be;
1529         bool be_bit;
1530         brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
1531
1532         bcma_write32(core, D11REGOFFS(tplatewrptr), offset);
1533
1534         /* if MCTL_BIGEND bit set in mac control register,
1535          * the chip swaps data in fifo, as well as data in
1536          * template ram
1537          */
1538         be_bit = (bcma_read32(core, D11REGOFFS(maccontrol)) & MCTL_BIGEND) != 0;
1539
1540         while (len > 0) {
1541                 memcpy(&word, buf, sizeof(u32));
1542
1543                 if (be_bit) {
1544                         word_be = cpu_to_be32(word);
1545                         word = *(u32 *)&word_be;
1546                 } else {
1547                         word_le = cpu_to_le32(word);
1548                         word = *(u32 *)&word_le;
1549                 }
1550
1551                 bcma_write32(core, D11REGOFFS(tplatewrdata), word);
1552
1553                 buf = (u8 *) buf + sizeof(u32);
1554                 len -= sizeof(u32);
1555         }
1556 }
1557
1558 static void brcms_b_set_cwmin(struct brcms_hardware *wlc_hw, u16 newmin)
1559 {
1560         wlc_hw->band->CWmin = newmin;
1561
1562         bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1563                      OBJADDR_SCR_SEL | S_DOT11_CWMIN);
1564         (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1565         bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmin);
1566 }
1567
1568 static void brcms_b_set_cwmax(struct brcms_hardware *wlc_hw, u16 newmax)
1569 {
1570         wlc_hw->band->CWmax = newmax;
1571
1572         bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1573                      OBJADDR_SCR_SEL | S_DOT11_CWMAX);
1574         (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1575         bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmax);
1576 }
1577
1578 void brcms_b_bw_set(struct brcms_hardware *wlc_hw, u16 bw)
1579 {
1580         bool fastclk;
1581
1582         /* request FAST clock if not on */
1583         fastclk = wlc_hw->forcefastclk;
1584         if (!fastclk)
1585                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
1586
1587         wlc_phy_bw_state_set(wlc_hw->band->pi, bw);
1588
1589         brcms_b_phy_reset(wlc_hw);
1590         wlc_phy_init(wlc_hw->band->pi, wlc_phy_chanspec_get(wlc_hw->band->pi));
1591
1592         /* restore the clk */
1593         if (!fastclk)
1594                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
1595 }
1596
1597 static void brcms_b_upd_synthpu(struct brcms_hardware *wlc_hw)
1598 {
1599         u16 v;
1600         struct brcms_c_info *wlc = wlc_hw->wlc;
1601         /* update SYNTHPU_DLY */
1602
1603         if (BRCMS_ISLCNPHY(wlc->band))
1604                 v = SYNTHPU_DLY_LPPHY_US;
1605         else if (BRCMS_ISNPHY(wlc->band) && (NREV_GE(wlc->band->phyrev, 3)))
1606                 v = SYNTHPU_DLY_NPHY_US;
1607         else
1608                 v = SYNTHPU_DLY_BPHY_US;
1609
1610         brcms_b_write_shm(wlc_hw, M_SYNTHPU_DLY, v);
1611 }
1612
1613 static void brcms_c_ucode_txant_set(struct brcms_hardware *wlc_hw)
1614 {
1615         u16 phyctl;
1616         u16 phytxant = wlc_hw->bmac_phytxant;
1617         u16 mask = PHY_TXC_ANT_MASK;
1618
1619         /* set the Probe Response frame phy control word */
1620         phyctl = brcms_b_read_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS);
1621         phyctl = (phyctl & ~mask) | phytxant;
1622         brcms_b_write_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS, phyctl);
1623
1624         /* set the Response (ACK/CTS) frame phy control word */
1625         phyctl = brcms_b_read_shm(wlc_hw, M_RSP_PCTLWD);
1626         phyctl = (phyctl & ~mask) | phytxant;
1627         brcms_b_write_shm(wlc_hw, M_RSP_PCTLWD, phyctl);
1628 }
1629
1630 static u16 brcms_b_ofdm_ratetable_offset(struct brcms_hardware *wlc_hw,
1631                                          u8 rate)
1632 {
1633         uint i;
1634         u8 plcp_rate = 0;
1635         struct plcp_signal_rate_lookup {
1636                 u8 rate;
1637                 u8 signal_rate;
1638         };
1639         /* OFDM RATE sub-field of PLCP SIGNAL field, per 802.11 sec 17.3.4.1 */
1640         const struct plcp_signal_rate_lookup rate_lookup[] = {
1641                 {BRCM_RATE_6M, 0xB},
1642                 {BRCM_RATE_9M, 0xF},
1643                 {BRCM_RATE_12M, 0xA},
1644                 {BRCM_RATE_18M, 0xE},
1645                 {BRCM_RATE_24M, 0x9},
1646                 {BRCM_RATE_36M, 0xD},
1647                 {BRCM_RATE_48M, 0x8},
1648                 {BRCM_RATE_54M, 0xC}
1649         };
1650
1651         for (i = 0; i < ARRAY_SIZE(rate_lookup); i++) {
1652                 if (rate == rate_lookup[i].rate) {
1653                         plcp_rate = rate_lookup[i].signal_rate;
1654                         break;
1655                 }
1656         }
1657
1658         /* Find the SHM pointer to the rate table entry by looking in the
1659          * Direct-map Table
1660          */
1661         return 2 * brcms_b_read_shm(wlc_hw, M_RT_DIRMAP_A + (plcp_rate * 2));
1662 }
1663
1664 static void brcms_upd_ofdm_pctl1_table(struct brcms_hardware *wlc_hw)
1665 {
1666         u8 rate;
1667         u8 rates[8] = {
1668                 BRCM_RATE_6M, BRCM_RATE_9M, BRCM_RATE_12M, BRCM_RATE_18M,
1669                 BRCM_RATE_24M, BRCM_RATE_36M, BRCM_RATE_48M, BRCM_RATE_54M
1670         };
1671         u16 entry_ptr;
1672         u16 pctl1;
1673         uint i;
1674
1675         if (!BRCMS_PHY_11N_CAP(wlc_hw->band))
1676                 return;
1677
1678         /* walk the phy rate table and update the entries */
1679         for (i = 0; i < ARRAY_SIZE(rates); i++) {
1680                 rate = rates[i];
1681
1682                 entry_ptr = brcms_b_ofdm_ratetable_offset(wlc_hw, rate);
1683
1684                 /* read the SHM Rate Table entry OFDM PCTL1 values */
1685                 pctl1 =
1686                     brcms_b_read_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS);
1687
1688                 /* modify the value */
1689                 pctl1 &= ~PHY_TXC1_MODE_MASK;
1690                 pctl1 |= (wlc_hw->hw_stf_ss_opmode << PHY_TXC1_MODE_SHIFT);
1691
1692                 /* Update the SHM Rate Table entry OFDM PCTL1 values */
1693                 brcms_b_write_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS,
1694                                    pctl1);
1695         }
1696 }
1697
1698 /* band-specific init */
1699 static void brcms_b_bsinit(struct brcms_c_info *wlc, u16 chanspec)
1700 {
1701         struct brcms_hardware *wlc_hw = wlc->hw;
1702
1703         brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
1704                            wlc_hw->band->bandunit);
1705
1706         brcms_c_ucode_bsinit(wlc_hw);
1707
1708         wlc_phy_init(wlc_hw->band->pi, chanspec);
1709
1710         brcms_c_ucode_txant_set(wlc_hw);
1711
1712         /*
1713          * cwmin is band-specific, update hardware
1714          * with value for current band
1715          */
1716         brcms_b_set_cwmin(wlc_hw, wlc_hw->band->CWmin);
1717         brcms_b_set_cwmax(wlc_hw, wlc_hw->band->CWmax);
1718
1719         brcms_b_update_slot_timing(wlc_hw,
1720                                    wlc_hw->band->bandtype == BRCM_BAND_5G ?
1721                                    true : wlc_hw->shortslot);
1722
1723         /* write phytype and phyvers */
1724         brcms_b_write_shm(wlc_hw, M_PHYTYPE, (u16) wlc_hw->band->phytype);
1725         brcms_b_write_shm(wlc_hw, M_PHYVER, (u16) wlc_hw->band->phyrev);
1726
1727         /*
1728          * initialize the txphyctl1 rate table since
1729          * shmem is shared between bands
1730          */
1731         brcms_upd_ofdm_pctl1_table(wlc_hw);
1732
1733         brcms_b_upd_synthpu(wlc_hw);
1734 }
1735
1736 /* Perform a soft reset of the PHY PLL */
1737 void brcms_b_core_phypll_reset(struct brcms_hardware *wlc_hw)
1738 {
1739         ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_addr),
1740                   ~0, 0);
1741         udelay(1);
1742         ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1743                   0x4, 0);
1744         udelay(1);
1745         ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1746                   0x4, 4);
1747         udelay(1);
1748         ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1749                   0x4, 0);
1750         udelay(1);
1751 }
1752
1753 /* light way to turn on phy clock without reset for NPHY only
1754  *  refer to brcms_b_core_phy_clk for full version
1755  */
1756 void brcms_b_phyclk_fgc(struct brcms_hardware *wlc_hw, bool clk)
1757 {
1758         /* support(necessary for NPHY and HYPHY) only */
1759         if (!BRCMS_ISNPHY(wlc_hw->band))
1760                 return;
1761
1762         if (ON == clk)
1763                 brcms_b_core_ioctl(wlc_hw, SICF_FGC, SICF_FGC);
1764         else
1765                 brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
1766
1767 }
1768
1769 void brcms_b_macphyclk_set(struct brcms_hardware *wlc_hw, bool clk)
1770 {
1771         if (ON == clk)
1772                 brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, SICF_MPCLKE);
1773         else
1774                 brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, 0);
1775 }
1776
1777 void brcms_b_phy_reset(struct brcms_hardware *wlc_hw)
1778 {
1779         struct brcms_phy_pub *pih = wlc_hw->band->pi;
1780         u32 phy_bw_clkbits;
1781         bool phy_in_reset = false;
1782
1783         brcms_dbg_info(wlc_hw->d11core, "wl%d: reset phy\n", wlc_hw->unit);
1784
1785         if (pih == NULL)
1786                 return;
1787
1788         phy_bw_clkbits = wlc_phy_clk_bwbits(wlc_hw->band->pi);
1789
1790         /* Specific reset sequence required for NPHY rev 3 and 4 */
1791         if (BRCMS_ISNPHY(wlc_hw->band) && NREV_GE(wlc_hw->band->phyrev, 3) &&
1792             NREV_LE(wlc_hw->band->phyrev, 4)) {
1793                 /* Set the PHY bandwidth */
1794                 brcms_b_core_ioctl(wlc_hw, SICF_BWMASK, phy_bw_clkbits);
1795
1796                 udelay(1);
1797
1798                 /* Perform a soft reset of the PHY PLL */
1799                 brcms_b_core_phypll_reset(wlc_hw);
1800
1801                 /* reset the PHY */
1802                 brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_PCLKE),
1803                                    (SICF_PRST | SICF_PCLKE));
1804                 phy_in_reset = true;
1805         } else {
1806                 brcms_b_core_ioctl(wlc_hw,
1807                                    (SICF_PRST | SICF_PCLKE | SICF_BWMASK),
1808                                    (SICF_PRST | SICF_PCLKE | phy_bw_clkbits));
1809         }
1810
1811         udelay(2);
1812         brcms_b_core_phy_clk(wlc_hw, ON);
1813
1814         if (pih)
1815                 wlc_phy_anacore(pih, ON);
1816 }
1817
1818 /* switch to and initialize new band */
1819 static void brcms_b_setband(struct brcms_hardware *wlc_hw, uint bandunit,
1820                             u16 chanspec) {
1821         struct brcms_c_info *wlc = wlc_hw->wlc;
1822         u32 macintmask;
1823
1824         /* Enable the d11 core before accessing it */
1825         if (!bcma_core_is_enabled(wlc_hw->d11core)) {
1826                 bcma_core_enable(wlc_hw->d11core, 0);
1827                 brcms_c_mctrl_reset(wlc_hw);
1828         }
1829
1830         macintmask = brcms_c_setband_inact(wlc, bandunit);
1831
1832         if (!wlc_hw->up)
1833                 return;
1834
1835         brcms_b_core_phy_clk(wlc_hw, ON);
1836
1837         /* band-specific initializations */
1838         brcms_b_bsinit(wlc, chanspec);
1839
1840         /*
1841          * If there are any pending software interrupt bits,
1842          * then replace these with a harmless nonzero value
1843          * so brcms_c_dpc() will re-enable interrupts when done.
1844          */
1845         if (wlc->macintstatus)
1846                 wlc->macintstatus = MI_DMAINT;
1847
1848         /* restore macintmask */
1849         brcms_intrsrestore(wlc->wl, macintmask);
1850
1851         /* ucode should still be suspended.. */
1852         WARN_ON((bcma_read32(wlc_hw->d11core, D11REGOFFS(maccontrol)) &
1853                  MCTL_EN_MAC) != 0);
1854 }
1855
1856 static bool brcms_c_isgoodchip(struct brcms_hardware *wlc_hw)
1857 {
1858
1859         /* reject unsupported corerev */
1860         if (!CONF_HAS(D11CONF, wlc_hw->corerev)) {
1861                 wiphy_err(wlc_hw->wlc->wiphy, "unsupported core rev %d\n",
1862                           wlc_hw->corerev);
1863                 return false;
1864         }
1865
1866         return true;
1867 }
1868
1869 /* Validate some board info parameters */
1870 static bool brcms_c_validboardtype(struct brcms_hardware *wlc_hw)
1871 {
1872         uint boardrev = wlc_hw->boardrev;
1873
1874         /* 4 bits each for board type, major, minor, and tiny version */
1875         uint brt = (boardrev & 0xf000) >> 12;
1876         uint b0 = (boardrev & 0xf00) >> 8;
1877         uint b1 = (boardrev & 0xf0) >> 4;
1878         uint b2 = boardrev & 0xf;
1879
1880         /* voards from other vendors are always considered valid */
1881         if (ai_get_boardvendor(wlc_hw->sih) != PCI_VENDOR_ID_BROADCOM)
1882                 return true;
1883
1884         /* do some boardrev sanity checks when boardvendor is Broadcom */
1885         if (boardrev == 0)
1886                 return false;
1887
1888         if (boardrev <= 0xff)
1889                 return true;
1890
1891         if ((brt > 2) || (brt == 0) || (b0 > 9) || (b0 == 0) || (b1 > 9)
1892                 || (b2 > 9))
1893                 return false;
1894
1895         return true;
1896 }
1897
1898 static void brcms_c_get_macaddr(struct brcms_hardware *wlc_hw, u8 etheraddr[ETH_ALEN])
1899 {
1900         struct ssb_sprom *sprom = &wlc_hw->d11core->bus->sprom;
1901
1902         /* If macaddr exists, use it (Sromrev4, CIS, ...). */
1903         if (!is_zero_ether_addr(sprom->il0mac)) {
1904                 memcpy(etheraddr, sprom->il0mac, 6);
1905                 return;
1906         }
1907
1908         if (wlc_hw->_nbands > 1)
1909                 memcpy(etheraddr, sprom->et1mac, 6);
1910         else
1911                 memcpy(etheraddr, sprom->il0mac, 6);
1912 }
1913
1914 /* power both the pll and external oscillator on/off */
1915 static void brcms_b_xtal(struct brcms_hardware *wlc_hw, bool want)
1916 {
1917         brcms_dbg_info(wlc_hw->d11core, "wl%d: want %d\n", wlc_hw->unit, want);
1918
1919         /*
1920          * dont power down if plldown is false or
1921          * we must poll hw radio disable
1922          */
1923         if (!want && wlc_hw->pllreq)
1924                 return;
1925
1926         wlc_hw->sbclk = want;
1927         if (!wlc_hw->sbclk) {
1928                 wlc_hw->clk = false;
1929                 if (wlc_hw->band && wlc_hw->band->pi)
1930                         wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
1931         }
1932 }
1933
1934 /*
1935  * Return true if radio is disabled, otherwise false.
1936  * hw radio disable signal is an external pin, users activate it asynchronously
1937  * this function could be called when driver is down and w/o clock
1938  * it operates on different registers depending on corerev and boardflag.
1939  */
1940 static bool brcms_b_radio_read_hwdisabled(struct brcms_hardware *wlc_hw)
1941 {
1942         bool v, clk, xtal;
1943         u32 flags = 0;
1944
1945         xtal = wlc_hw->sbclk;
1946         if (!xtal)
1947                 brcms_b_xtal(wlc_hw, ON);
1948
1949         /* may need to take core out of reset first */
1950         clk = wlc_hw->clk;
1951         if (!clk) {
1952                 /*
1953                  * mac no longer enables phyclk automatically when driver
1954                  * accesses phyreg throughput mac. This can be skipped since
1955                  * only mac reg is accessed below
1956                  */
1957                 if (D11REV_GE(wlc_hw->corerev, 18))
1958                         flags |= SICF_PCLKE;
1959
1960                 /*
1961                  * TODO: test suspend/resume
1962                  *
1963                  * AI chip doesn't restore bar0win2 on
1964                  * hibernation/resume, need sw fixup
1965                  */
1966
1967                 bcma_core_enable(wlc_hw->d11core, flags);
1968                 brcms_c_mctrl_reset(wlc_hw);
1969         }
1970
1971         v = ((bcma_read32(wlc_hw->d11core,
1972                           D11REGOFFS(phydebug)) & PDBG_RFD) != 0);
1973
1974         /* put core back into reset */
1975         if (!clk)
1976                 bcma_core_disable(wlc_hw->d11core, 0);
1977
1978         if (!xtal)
1979                 brcms_b_xtal(wlc_hw, OFF);
1980
1981         return v;
1982 }
1983
1984 static bool wlc_dma_rxreset(struct brcms_hardware *wlc_hw, uint fifo)
1985 {
1986         struct dma_pub *di = wlc_hw->di[fifo];
1987         return dma_rxreset(di);
1988 }
1989
1990 /* d11 core reset
1991  *   ensure fask clock during reset
1992  *   reset dma
1993  *   reset d11(out of reset)
1994  *   reset phy(out of reset)
1995  *   clear software macintstatus for fresh new start
1996  * one testing hack wlc_hw->noreset will bypass the d11/phy reset
1997  */
1998 void brcms_b_corereset(struct brcms_hardware *wlc_hw, u32 flags)
1999 {
2000         uint i;
2001         bool fastclk;
2002
2003         if (flags == BRCMS_USE_COREFLAGS)
2004                 flags = (wlc_hw->band->pi ? wlc_hw->band->core_flags : 0);
2005
2006         brcms_dbg_info(wlc_hw->d11core, "wl%d: core reset\n", wlc_hw->unit);
2007
2008         /* request FAST clock if not on  */
2009         fastclk = wlc_hw->forcefastclk;
2010         if (!fastclk)
2011                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2012
2013         /* reset the dma engines except first time thru */
2014         if (bcma_core_is_enabled(wlc_hw->d11core)) {
2015                 for (i = 0; i < NFIFO; i++)
2016                         if ((wlc_hw->di[i]) && (!dma_txreset(wlc_hw->di[i])))
2017                                 brcms_err(wlc_hw->d11core, "wl%d: %s: "
2018                                           "dma_txreset[%d]: cannot stop dma\n",
2019                                            wlc_hw->unit, __func__, i);
2020
2021                 if ((wlc_hw->di[RX_FIFO])
2022                     && (!wlc_dma_rxreset(wlc_hw, RX_FIFO)))
2023                         brcms_err(wlc_hw->d11core, "wl%d: %s: dma_rxreset"
2024                                   "[%d]: cannot stop dma\n",
2025                                   wlc_hw->unit, __func__, RX_FIFO);
2026         }
2027         /* if noreset, just stop the psm and return */
2028         if (wlc_hw->noreset) {
2029                 wlc_hw->wlc->macintstatus = 0;  /* skip wl_dpc after down */
2030                 brcms_b_mctrl(wlc_hw, MCTL_PSM_RUN | MCTL_EN_MAC, 0);
2031                 return;
2032         }
2033
2034         /*
2035          * mac no longer enables phyclk automatically when driver accesses
2036          * phyreg throughput mac, AND phy_reset is skipped at early stage when
2037          * band->pi is invalid. need to enable PHY CLK
2038          */
2039         if (D11REV_GE(wlc_hw->corerev, 18))
2040                 flags |= SICF_PCLKE;
2041
2042         /*
2043          * reset the core
2044          * In chips with PMU, the fastclk request goes through d11 core
2045          * reg 0x1e0, which is cleared by the core_reset. have to re-request it.
2046          *
2047          * This adds some delay and we can optimize it by also requesting
2048          * fastclk through chipcommon during this period if necessary. But
2049          * that has to work coordinate with other driver like mips/arm since
2050          * they may touch chipcommon as well.
2051          */
2052         wlc_hw->clk = false;
2053         bcma_core_enable(wlc_hw->d11core, flags);
2054         wlc_hw->clk = true;
2055         if (wlc_hw->band && wlc_hw->band->pi)
2056                 wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, true);
2057
2058         brcms_c_mctrl_reset(wlc_hw);
2059
2060         if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU)
2061                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2062
2063         brcms_b_phy_reset(wlc_hw);
2064
2065         /* turn on PHY_PLL */
2066         brcms_b_core_phypll_ctl(wlc_hw, true);
2067
2068         /* clear sw intstatus */
2069         wlc_hw->wlc->macintstatus = 0;
2070
2071         /* restore the clk setting */
2072         if (!fastclk)
2073                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
2074 }
2075
2076 /* txfifo sizes needs to be modified(increased) since the newer cores
2077  * have more memory.
2078  */
2079 static void brcms_b_corerev_fifofixup(struct brcms_hardware *wlc_hw)
2080 {
2081         struct bcma_device *core = wlc_hw->d11core;
2082         u16 fifo_nu;
2083         u16 txfifo_startblk = TXFIFO_START_BLK, txfifo_endblk;
2084         u16 txfifo_def, txfifo_def1;
2085         u16 txfifo_cmd;
2086
2087         /* tx fifos start at TXFIFO_START_BLK from the Base address */
2088         txfifo_startblk = TXFIFO_START_BLK;
2089
2090         /* sequence of operations:  reset fifo, set fifo size, reset fifo */
2091         for (fifo_nu = 0; fifo_nu < NFIFO; fifo_nu++) {
2092
2093                 txfifo_endblk = txfifo_startblk + wlc_hw->xmtfifo_sz[fifo_nu];
2094                 txfifo_def = (txfifo_startblk & 0xff) |
2095                     (((txfifo_endblk - 1) & 0xff) << TXFIFO_FIFOTOP_SHIFT);
2096                 txfifo_def1 = ((txfifo_startblk >> 8) & 0x1) |
2097                     ((((txfifo_endblk -
2098                         1) >> 8) & 0x1) << TXFIFO_FIFOTOP_SHIFT);
2099                 txfifo_cmd =
2100                     TXFIFOCMD_RESET_MASK | (fifo_nu << TXFIFOCMD_FIFOSEL_SHIFT);
2101
2102                 bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2103                 bcma_write16(core, D11REGOFFS(xmtfifodef), txfifo_def);
2104                 bcma_write16(core, D11REGOFFS(xmtfifodef1), txfifo_def1);
2105
2106                 bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2107
2108                 txfifo_startblk += wlc_hw->xmtfifo_sz[fifo_nu];
2109         }
2110         /*
2111          * need to propagate to shm location to be in sync since ucode/hw won't
2112          * do this
2113          */
2114         brcms_b_write_shm(wlc_hw, M_FIFOSIZE0,
2115                            wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]);
2116         brcms_b_write_shm(wlc_hw, M_FIFOSIZE1,
2117                            wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]);
2118         brcms_b_write_shm(wlc_hw, M_FIFOSIZE2,
2119                            ((wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO] << 8) | wlc_hw->
2120                             xmtfifo_sz[TX_AC_BK_FIFO]));
2121         brcms_b_write_shm(wlc_hw, M_FIFOSIZE3,
2122                            ((wlc_hw->xmtfifo_sz[TX_ATIM_FIFO] << 8) | wlc_hw->
2123                             xmtfifo_sz[TX_BCMC_FIFO]));
2124 }
2125
2126 /* This function is used for changing the tsf frac register
2127  * If spur avoidance mode is off, the mac freq will be 80/120/160Mhz
2128  * If spur avoidance mode is on1, the mac freq will be 82/123/164Mhz
2129  * If spur avoidance mode is on2, the mac freq will be 84/126/168Mhz
2130  * HTPHY Formula is 2^26/freq(MHz) e.g.
2131  * For spuron2 - 126MHz -> 2^26/126 = 532610.0
2132  *  - 532610 = 0x82082 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x2082
2133  * For spuron: 123MHz -> 2^26/123    = 545600.5
2134  *  - 545601 = 0x85341 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x5341
2135  * For spur off: 120MHz -> 2^26/120    = 559240.5
2136  *  - 559241 = 0x88889 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x8889
2137  */
2138
2139 void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode)
2140 {
2141         struct bcma_device *core = wlc_hw->d11core;
2142
2143         if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43224) ||
2144             (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225)) {
2145                 if (spurmode == WL_SPURAVOID_ON2) {     /* 126Mhz */
2146                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x2082);
2147                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2148                 } else if (spurmode == WL_SPURAVOID_ON1) {      /* 123Mhz */
2149                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x5341);
2150                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2151                 } else {        /* 120Mhz */
2152                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x8889);
2153                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2154                 }
2155         } else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2156                 if (spurmode == WL_SPURAVOID_ON1) {     /* 82Mhz */
2157                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x7CE0);
2158                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2159                 } else {        /* 80Mhz */
2160                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0xCCCD);
2161                         bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2162                 }
2163         }
2164 }
2165
2166 void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr)
2167 {
2168         memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2169         wlc->bsscfg->type = BRCMS_TYPE_STATION;
2170 }
2171
2172 /* Initialize GPIOs that are controlled by D11 core */
2173 static void brcms_c_gpio_init(struct brcms_c_info *wlc)
2174 {
2175         struct brcms_hardware *wlc_hw = wlc->hw;
2176         u32 gc, gm;
2177
2178         /* use GPIO select 0 to get all gpio signals from the gpio out reg */
2179         brcms_b_mctrl(wlc_hw, MCTL_GPOUT_SEL_MASK, 0);
2180
2181         /*
2182          * Common GPIO setup:
2183          *      G0 = LED 0 = WLAN Activity
2184          *      G1 = LED 1 = WLAN 2.4 GHz Radio State
2185          *      G2 = LED 2 = WLAN 5 GHz Radio State
2186          *      G4 = radio disable input (HI enabled, LO disabled)
2187          */
2188
2189         gc = gm = 0;
2190
2191         /* Allocate GPIOs for mimo antenna diversity feature */
2192         if (wlc_hw->antsel_type == ANTSEL_2x3) {
2193                 /* Enable antenna diversity, use 2x3 mode */
2194                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2195                              MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2196                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE,
2197                              MHF3_ANTSEL_MODE, BRCM_BAND_ALL);
2198
2199                 /* init superswitch control */
2200                 wlc_phy_antsel_init(wlc_hw->band->pi, false);
2201
2202         } else if (wlc_hw->antsel_type == ANTSEL_2x4) {
2203                 gm |= gc |= (BOARD_GPIO_12 | BOARD_GPIO_13);
2204                 /*
2205                  * The board itself is powered by these GPIOs
2206                  * (when not sending pattern) so set them high
2207                  */
2208                 bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_oe),
2209                            (BOARD_GPIO_12 | BOARD_GPIO_13));
2210                 bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_out),
2211                            (BOARD_GPIO_12 | BOARD_GPIO_13));
2212
2213                 /* Enable antenna diversity, use 2x4 mode */
2214                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2215                              MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2216                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE, 0,
2217                              BRCM_BAND_ALL);
2218
2219                 /* Configure the desired clock to be 4Mhz */
2220                 brcms_b_write_shm(wlc_hw, M_ANTSEL_CLKDIV,
2221                                    ANTSEL_CLKDIV_4MHZ);
2222         }
2223
2224         /*
2225          * gpio 9 controls the PA. ucode is responsible
2226          * for wiggling out and oe
2227          */
2228         if (wlc_hw->boardflags & BFL_PACTRL)
2229                 gm |= gc |= BOARD_GPIO_PACTRL;
2230
2231         /* apply to gpiocontrol register */
2232         bcma_chipco_gpio_control(&wlc_hw->d11core->bus->drv_cc, gm, gc);
2233 }
2234
2235 static void brcms_ucode_write(struct brcms_hardware *wlc_hw,
2236                               const __le32 ucode[], const size_t nbytes)
2237 {
2238         struct bcma_device *core = wlc_hw->d11core;
2239         uint i;
2240         uint count;
2241
2242         brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
2243
2244         count = (nbytes / sizeof(u32));
2245
2246         bcma_write32(core, D11REGOFFS(objaddr),
2247                      OBJADDR_AUTO_INC | OBJADDR_UCM_SEL);
2248         (void)bcma_read32(core, D11REGOFFS(objaddr));
2249         for (i = 0; i < count; i++)
2250                 bcma_write32(core, D11REGOFFS(objdata), le32_to_cpu(ucode[i]));
2251
2252 }
2253
2254 static void brcms_ucode_download(struct brcms_hardware *wlc_hw)
2255 {
2256         struct brcms_c_info *wlc;
2257         struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
2258
2259         wlc = wlc_hw->wlc;
2260
2261         if (wlc_hw->ucode_loaded)
2262                 return;
2263
2264         if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
2265                 if (BRCMS_ISNPHY(wlc_hw->band)) {
2266                         brcms_ucode_write(wlc_hw, ucode->bcm43xx_16_mimo,
2267                                           ucode->bcm43xx_16_mimosz);
2268                         wlc_hw->ucode_loaded = true;
2269                 } else
2270                         brcms_err(wlc_hw->d11core,
2271                                   "%s: wl%d: unsupported phy in corerev %d\n",
2272                                   __func__, wlc_hw->unit, wlc_hw->corerev);
2273         } else if (D11REV_IS(wlc_hw->corerev, 24)) {
2274                 if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2275                         brcms_ucode_write(wlc_hw, ucode->bcm43xx_24_lcn,
2276                                           ucode->bcm43xx_24_lcnsz);
2277                         wlc_hw->ucode_loaded = true;
2278                 } else {
2279                         brcms_err(wlc_hw->d11core,
2280                                   "%s: wl%d: unsupported phy in corerev %d\n",
2281                                   __func__, wlc_hw->unit, wlc_hw->corerev);
2282                 }
2283         }
2284 }
2285
2286 void brcms_b_txant_set(struct brcms_hardware *wlc_hw, u16 phytxant)
2287 {
2288         /* update sw state */
2289         wlc_hw->bmac_phytxant = phytxant;
2290
2291         /* push to ucode if up */
2292         if (!wlc_hw->up)
2293                 return;
2294         brcms_c_ucode_txant_set(wlc_hw);
2295
2296 }
2297
2298 u16 brcms_b_get_txant(struct brcms_hardware *wlc_hw)
2299 {
2300         return (u16) wlc_hw->wlc->stf->txant;
2301 }
2302
2303 void brcms_b_antsel_type_set(struct brcms_hardware *wlc_hw, u8 antsel_type)
2304 {
2305         wlc_hw->antsel_type = antsel_type;
2306
2307         /* Update the antsel type for phy module to use */
2308         wlc_phy_antsel_type_set(wlc_hw->band->pi, antsel_type);
2309 }
2310
2311 static void brcms_b_fifoerrors(struct brcms_hardware *wlc_hw)
2312 {
2313         bool fatal = false;
2314         uint unit;
2315         uint intstatus, idx;
2316         struct bcma_device *core = wlc_hw->d11core;
2317
2318         unit = wlc_hw->unit;
2319
2320         for (idx = 0; idx < NFIFO; idx++) {
2321                 /* read intstatus register and ignore any non-error bits */
2322                 intstatus =
2323                         bcma_read32(core,
2324                                     D11REGOFFS(intctrlregs[idx].intstatus)) &
2325                         I_ERRORS;
2326                 if (!intstatus)
2327                         continue;
2328
2329                 brcms_dbg_int(core, "wl%d: intstatus%d 0x%x\n",
2330                               unit, idx, intstatus);
2331
2332                 if (intstatus & I_RO) {
2333                         brcms_err(core, "wl%d: fifo %d: receive fifo "
2334                                   "overflow\n", unit, idx);
2335                         fatal = true;
2336                 }
2337
2338                 if (intstatus & I_PC) {
2339                         brcms_err(core, "wl%d: fifo %d: descriptor error\n",
2340                                   unit, idx);
2341                         fatal = true;
2342                 }
2343
2344                 if (intstatus & I_PD) {
2345                         brcms_err(core, "wl%d: fifo %d: data error\n", unit,
2346                                   idx);
2347                         fatal = true;
2348                 }
2349
2350                 if (intstatus & I_DE) {
2351                         brcms_err(core, "wl%d: fifo %d: descriptor protocol "
2352                                   "error\n", unit, idx);
2353                         fatal = true;
2354                 }
2355
2356                 if (intstatus & I_RU)
2357                         brcms_err(core, "wl%d: fifo %d: receive descriptor "
2358                                   "underflow\n", idx, unit);
2359
2360                 if (intstatus & I_XU) {
2361                         brcms_err(core, "wl%d: fifo %d: transmit fifo "
2362                                   "underflow\n", idx, unit);
2363                         fatal = true;
2364                 }
2365
2366                 if (fatal) {
2367                         brcms_fatal_error(wlc_hw->wlc->wl); /* big hammer */
2368                         break;
2369                 } else
2370                         bcma_write32(core,
2371                                      D11REGOFFS(intctrlregs[idx].intstatus),
2372                                      intstatus);
2373         }
2374 }
2375
2376 void brcms_c_intrson(struct brcms_c_info *wlc)
2377 {
2378         struct brcms_hardware *wlc_hw = wlc->hw;
2379         wlc->macintmask = wlc->defmacintmask;
2380         bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2381 }
2382
2383 u32 brcms_c_intrsoff(struct brcms_c_info *wlc)
2384 {
2385         struct brcms_hardware *wlc_hw = wlc->hw;
2386         u32 macintmask;
2387
2388         if (!wlc_hw->clk)
2389                 return 0;
2390
2391         macintmask = wlc->macintmask;   /* isr can still happen */
2392
2393         bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), 0);
2394         (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(macintmask));
2395         udelay(1);              /* ensure int line is no longer driven */
2396         wlc->macintmask = 0;
2397
2398         /* return previous macintmask; resolve race between us and our isr */
2399         return wlc->macintstatus ? 0 : macintmask;
2400 }
2401
2402 void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask)
2403 {
2404         struct brcms_hardware *wlc_hw = wlc->hw;
2405         if (!wlc_hw->clk)
2406                 return;
2407
2408         wlc->macintmask = macintmask;
2409         bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2410 }
2411
2412 /* assumes that the d11 MAC is enabled */
2413 static void brcms_b_tx_fifo_suspend(struct brcms_hardware *wlc_hw,
2414                                     uint tx_fifo)
2415 {
2416         u8 fifo = 1 << tx_fifo;
2417
2418         /* Two clients of this code, 11h Quiet period and scanning. */
2419
2420         /* only suspend if not already suspended */
2421         if ((wlc_hw->suspended_fifos & fifo) == fifo)
2422                 return;
2423
2424         /* force the core awake only if not already */
2425         if (wlc_hw->suspended_fifos == 0)
2426                 brcms_c_ucode_wake_override_set(wlc_hw,
2427                                                 BRCMS_WAKE_OVERRIDE_TXFIFO);
2428
2429         wlc_hw->suspended_fifos |= fifo;
2430
2431         if (wlc_hw->di[tx_fifo]) {
2432                 /*
2433                  * Suspending AMPDU transmissions in the middle can cause
2434                  * underflow which may result in mismatch between ucode and
2435                  * driver so suspend the mac before suspending the FIFO
2436                  */
2437                 if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2438                         brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
2439
2440                 dma_txsuspend(wlc_hw->di[tx_fifo]);
2441
2442                 if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2443                         brcms_c_enable_mac(wlc_hw->wlc);
2444         }
2445 }
2446
2447 static void brcms_b_tx_fifo_resume(struct brcms_hardware *wlc_hw,
2448                                    uint tx_fifo)
2449 {
2450         /* BMAC_NOTE: BRCMS_TX_FIFO_ENAB is done in brcms_c_dpc() for DMA case
2451          * but need to be done here for PIO otherwise the watchdog will catch
2452          * the inconsistency and fire
2453          */
2454         /* Two clients of this code, 11h Quiet period and scanning. */
2455         if (wlc_hw->di[tx_fifo])
2456                 dma_txresume(wlc_hw->di[tx_fifo]);
2457
2458         /* allow core to sleep again */
2459         if (wlc_hw->suspended_fifos == 0)
2460                 return;
2461         else {
2462                 wlc_hw->suspended_fifos &= ~(1 << tx_fifo);
2463                 if (wlc_hw->suspended_fifos == 0)
2464                         brcms_c_ucode_wake_override_clear(wlc_hw,
2465                                                 BRCMS_WAKE_OVERRIDE_TXFIFO);
2466         }
2467 }
2468
2469 /* precondition: requires the mac core to be enabled */
2470 static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
2471 {
2472         static const u8 null_ether_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
2473         u8 *ethaddr = wlc_hw->wlc->pub->cur_etheraddr;
2474
2475         if (mute_tx) {
2476                 /* suspend tx fifos */
2477                 brcms_b_tx_fifo_suspend(wlc_hw, TX_DATA_FIFO);
2478                 brcms_b_tx_fifo_suspend(wlc_hw, TX_CTL_FIFO);
2479                 brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_BK_FIFO);
2480                 brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_VI_FIFO);
2481
2482                 /* zero the address match register so we do not send ACKs */
2483                 brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, null_ether_addr);
2484         } else {
2485                 /* resume tx fifos */
2486                 brcms_b_tx_fifo_resume(wlc_hw, TX_DATA_FIFO);
2487                 brcms_b_tx_fifo_resume(wlc_hw, TX_CTL_FIFO);
2488                 brcms_b_tx_fifo_resume(wlc_hw, TX_AC_BK_FIFO);
2489                 brcms_b_tx_fifo_resume(wlc_hw, TX_AC_VI_FIFO);
2490
2491                 /* Restore address */
2492                 brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, ethaddr);
2493         }
2494
2495         wlc_phy_mute_upd(wlc_hw->band->pi, mute_tx, 0);
2496
2497         if (mute_tx)
2498                 brcms_c_ucode_mute_override_set(wlc_hw);
2499         else
2500                 brcms_c_ucode_mute_override_clear(wlc_hw);
2501 }
2502
2503 void
2504 brcms_c_mute(struct brcms_c_info *wlc, bool mute_tx)
2505 {
2506         brcms_b_mute(wlc->hw, mute_tx);
2507 }
2508
2509 /*
2510  * Read and clear macintmask and macintstatus and intstatus registers.
2511  * This routine should be called with interrupts off
2512  * Return:
2513  *   -1 if brcms_deviceremoved(wlc) evaluates to true;
2514  *   0 if the interrupt is not for us, or we are in some special cases;
2515  *   device interrupt status bits otherwise.
2516  */
2517 static inline u32 wlc_intstatus(struct brcms_c_info *wlc, bool in_isr)
2518 {
2519         struct brcms_hardware *wlc_hw = wlc->hw;
2520         struct bcma_device *core = wlc_hw->d11core;
2521         u32 macintstatus, mask;
2522
2523         /* macintstatus includes a DMA interrupt summary bit */
2524         macintstatus = bcma_read32(core, D11REGOFFS(macintstatus));
2525         mask = in_isr ? wlc->macintmask : wlc->defmacintmask;
2526
2527         trace_brcms_macintstatus(&core->dev, in_isr, macintstatus, mask);
2528
2529         /* detect cardbus removed, in power down(suspend) and in reset */
2530         if (brcms_deviceremoved(wlc))
2531                 return -1;
2532
2533         /* brcms_deviceremoved() succeeds even when the core is still resetting,
2534          * handle that case here.
2535          */
2536         if (macintstatus == 0xffffffff)
2537                 return 0;
2538
2539         /* defer unsolicited interrupts */
2540         macintstatus &= mask;
2541
2542         /* if not for us */
2543         if (macintstatus == 0)
2544                 return 0;
2545
2546         /* turn off the interrupts */
2547         bcma_write32(core, D11REGOFFS(macintmask), 0);
2548         (void)bcma_read32(core, D11REGOFFS(macintmask));
2549         wlc->macintmask = 0;
2550
2551         /* clear device interrupts */
2552         bcma_write32(core, D11REGOFFS(macintstatus), macintstatus);
2553
2554         /* MI_DMAINT is indication of non-zero intstatus */
2555         if (macintstatus & MI_DMAINT)
2556                 /*
2557                  * only fifo interrupt enabled is I_RI in
2558                  * RX_FIFO. If MI_DMAINT is set, assume it
2559                  * is set and clear the interrupt.
2560                  */
2561                 bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intstatus),
2562                              DEF_RXINTMASK);
2563
2564         return macintstatus;
2565 }
2566
2567 /* Update wlc->macintstatus and wlc->intstatus[]. */
2568 /* Return true if they are updated successfully. false otherwise */
2569 bool brcms_c_intrsupd(struct brcms_c_info *wlc)
2570 {
2571         u32 macintstatus;
2572
2573         /* read and clear macintstatus and intstatus registers */
2574         macintstatus = wlc_intstatus(wlc, false);
2575
2576         /* device is removed */
2577         if (macintstatus == 0xffffffff)
2578                 return false;
2579
2580         /* update interrupt status in software */
2581         wlc->macintstatus |= macintstatus;
2582
2583         return true;
2584 }
2585
2586 /*
2587  * First-level interrupt processing.
2588  * Return true if this was our interrupt
2589  * and if further brcms_c_dpc() processing is required,
2590  * false otherwise.
2591  */
2592 bool brcms_c_isr(struct brcms_c_info *wlc)
2593 {
2594         struct brcms_hardware *wlc_hw = wlc->hw;
2595         u32 macintstatus;
2596
2597         if (!wlc_hw->up || !wlc->macintmask)
2598                 return false;
2599
2600         /* read and clear macintstatus and intstatus registers */
2601         macintstatus = wlc_intstatus(wlc, true);
2602
2603         if (macintstatus == 0xffffffff) {
2604                 brcms_err(wlc_hw->d11core,
2605                           "DEVICEREMOVED detected in the ISR code path\n");
2606                 return false;
2607         }
2608
2609         /* it is not for us */
2610         if (macintstatus == 0)
2611                 return false;
2612
2613         /* save interrupt status bits */
2614         wlc->macintstatus = macintstatus;
2615
2616         return true;
2617
2618 }
2619
2620 void brcms_c_suspend_mac_and_wait(struct brcms_c_info *wlc)
2621 {
2622         struct brcms_hardware *wlc_hw = wlc->hw;
2623         struct bcma_device *core = wlc_hw->d11core;
2624         u32 mc, mi;
2625
2626         brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2627                            wlc_hw->band->bandunit);
2628
2629         /*
2630          * Track overlapping suspend requests
2631          */
2632         wlc_hw->mac_suspend_depth++;
2633         if (wlc_hw->mac_suspend_depth > 1)
2634                 return;
2635
2636         /* force the core awake */
2637         brcms_c_ucode_wake_override_set(wlc_hw, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2638
2639         mc = bcma_read32(core, D11REGOFFS(maccontrol));
2640
2641         if (mc == 0xffffffff) {
2642                 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2643                           __func__);
2644                 brcms_down(wlc->wl);
2645                 return;
2646         }
2647         WARN_ON(mc & MCTL_PSM_JMP_0);
2648         WARN_ON(!(mc & MCTL_PSM_RUN));
2649         WARN_ON(!(mc & MCTL_EN_MAC));
2650
2651         mi = bcma_read32(core, D11REGOFFS(macintstatus));
2652         if (mi == 0xffffffff) {
2653                 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2654                           __func__);
2655                 brcms_down(wlc->wl);
2656                 return;
2657         }
2658         WARN_ON(mi & MI_MACSSPNDD);
2659
2660         brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, 0);
2661
2662         SPINWAIT(!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD),
2663                  BRCMS_MAX_MAC_SUSPEND);
2664
2665         if (!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD)) {
2666                 brcms_err(core, "wl%d: wlc_suspend_mac_and_wait: waited %d uS"
2667                           " and MI_MACSSPNDD is still not on.\n",
2668                           wlc_hw->unit, BRCMS_MAX_MAC_SUSPEND);
2669                 brcms_err(core, "wl%d: psmdebug 0x%08x, phydebug 0x%08x, "
2670                           "psm_brc 0x%04x\n", wlc_hw->unit,
2671                           bcma_read32(core, D11REGOFFS(psmdebug)),
2672                           bcma_read32(core, D11REGOFFS(phydebug)),
2673                           bcma_read16(core, D11REGOFFS(psm_brc)));
2674         }
2675
2676         mc = bcma_read32(core, D11REGOFFS(maccontrol));
2677         if (mc == 0xffffffff) {
2678                 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2679                           __func__);
2680                 brcms_down(wlc->wl);
2681                 return;
2682         }
2683         WARN_ON(mc & MCTL_PSM_JMP_0);
2684         WARN_ON(!(mc & MCTL_PSM_RUN));
2685         WARN_ON(mc & MCTL_EN_MAC);
2686 }
2687
2688 void brcms_c_enable_mac(struct brcms_c_info *wlc)
2689 {
2690         struct brcms_hardware *wlc_hw = wlc->hw;
2691         struct bcma_device *core = wlc_hw->d11core;
2692         u32 mc, mi;
2693
2694         brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2695                            wlc->band->bandunit);
2696
2697         /*
2698          * Track overlapping suspend requests
2699          */
2700         wlc_hw->mac_suspend_depth--;
2701         if (wlc_hw->mac_suspend_depth > 0)
2702                 return;
2703
2704         mc = bcma_read32(core, D11REGOFFS(maccontrol));
2705         WARN_ON(mc & MCTL_PSM_JMP_0);
2706         WARN_ON(mc & MCTL_EN_MAC);
2707         WARN_ON(!(mc & MCTL_PSM_RUN));
2708
2709         brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, MCTL_EN_MAC);
2710         bcma_write32(core, D11REGOFFS(macintstatus), MI_MACSSPNDD);
2711
2712         mc = bcma_read32(core, D11REGOFFS(maccontrol));
2713         WARN_ON(mc & MCTL_PSM_JMP_0);
2714         WARN_ON(!(mc & MCTL_EN_MAC));
2715         WARN_ON(!(mc & MCTL_PSM_RUN));
2716
2717         mi = bcma_read32(core, D11REGOFFS(macintstatus));
2718         WARN_ON(mi & MI_MACSSPNDD);
2719
2720         brcms_c_ucode_wake_override_clear(wlc_hw,
2721                                           BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2722 }
2723
2724 void brcms_b_band_stf_ss_set(struct brcms_hardware *wlc_hw, u8 stf_mode)
2725 {
2726         wlc_hw->hw_stf_ss_opmode = stf_mode;
2727
2728         if (wlc_hw->clk)
2729                 brcms_upd_ofdm_pctl1_table(wlc_hw);
2730 }
2731
2732 static bool brcms_b_validate_chip_access(struct brcms_hardware *wlc_hw)
2733 {
2734         struct bcma_device *core = wlc_hw->d11core;
2735         u32 w, val;
2736         struct wiphy *wiphy = wlc_hw->wlc->wiphy;
2737
2738         /* Validate dchip register access */
2739
2740         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2741         (void)bcma_read32(core, D11REGOFFS(objaddr));
2742         w = bcma_read32(core, D11REGOFFS(objdata));
2743
2744         /* Can we write and read back a 32bit register? */
2745         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2746         (void)bcma_read32(core, D11REGOFFS(objaddr));
2747         bcma_write32(core, D11REGOFFS(objdata), (u32) 0xaa5555aa);
2748
2749         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2750         (void)bcma_read32(core, D11REGOFFS(objaddr));
2751         val = bcma_read32(core, D11REGOFFS(objdata));
2752         if (val != (u32) 0xaa5555aa) {
2753                 wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2754                           "expected 0xaa5555aa\n", wlc_hw->unit, val);
2755                 return false;
2756         }
2757
2758         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2759         (void)bcma_read32(core, D11REGOFFS(objaddr));
2760         bcma_write32(core, D11REGOFFS(objdata), (u32) 0x55aaaa55);
2761
2762         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2763         (void)bcma_read32(core, D11REGOFFS(objaddr));
2764         val = bcma_read32(core, D11REGOFFS(objdata));
2765         if (val != (u32) 0x55aaaa55) {
2766                 wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2767                           "expected 0x55aaaa55\n", wlc_hw->unit, val);
2768                 return false;
2769         }
2770
2771         bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2772         (void)bcma_read32(core, D11REGOFFS(objaddr));
2773         bcma_write32(core, D11REGOFFS(objdata), w);
2774
2775         /* clear CFPStart */
2776         bcma_write32(core, D11REGOFFS(tsf_cfpstart), 0);
2777
2778         w = bcma_read32(core, D11REGOFFS(maccontrol));
2779         if ((w != (MCTL_IHR_EN | MCTL_WAKE)) &&
2780             (w != (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE))) {
2781                 wiphy_err(wiphy, "wl%d: validate_chip_access: maccontrol = "
2782                           "0x%x, expected 0x%x or 0x%x\n", wlc_hw->unit, w,
2783                           (MCTL_IHR_EN | MCTL_WAKE),
2784                           (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE));
2785                 return false;
2786         }
2787
2788         return true;
2789 }
2790
2791 #define PHYPLL_WAIT_US  100000
2792
2793 void brcms_b_core_phypll_ctl(struct brcms_hardware *wlc_hw, bool on)
2794 {
2795         struct bcma_device *core = wlc_hw->d11core;
2796         u32 tmp;
2797
2798         brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
2799
2800         tmp = 0;
2801
2802         if (on) {
2803                 if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
2804                         bcma_set32(core, D11REGOFFS(clk_ctl_st),
2805                                    CCS_ERSRC_REQ_HT |
2806                                    CCS_ERSRC_REQ_D11PLL |
2807                                    CCS_ERSRC_REQ_PHYPLL);
2808                         SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2809                                   CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT,
2810                                  PHYPLL_WAIT_US);
2811
2812                         tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2813                         if ((tmp & CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT)
2814                                 brcms_err(core, "%s: turn on PHY PLL failed\n",
2815                                           __func__);
2816                 } else {
2817                         bcma_set32(core, D11REGOFFS(clk_ctl_st),
2818                                    tmp | CCS_ERSRC_REQ_D11PLL |
2819                                    CCS_ERSRC_REQ_PHYPLL);
2820                         SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2821                                   (CCS_ERSRC_AVAIL_D11PLL |
2822                                    CCS_ERSRC_AVAIL_PHYPLL)) !=
2823                                  (CCS_ERSRC_AVAIL_D11PLL |
2824                                   CCS_ERSRC_AVAIL_PHYPLL), PHYPLL_WAIT_US);
2825
2826                         tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2827                         if ((tmp &
2828                              (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2829                             !=
2830                             (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2831                                 brcms_err(core, "%s: turn on PHY PLL failed\n",
2832                                           __func__);
2833                 }
2834         } else {
2835                 /*
2836                  * Since the PLL may be shared, other cores can still
2837                  * be requesting it; so we'll deassert the request but
2838                  * not wait for status to comply.
2839                  */
2840                 bcma_mask32(core, D11REGOFFS(clk_ctl_st),
2841                             ~CCS_ERSRC_REQ_PHYPLL);
2842                 (void)bcma_read32(core, D11REGOFFS(clk_ctl_st));
2843         }
2844 }
2845
2846 static void brcms_c_coredisable(struct brcms_hardware *wlc_hw)
2847 {
2848         bool dev_gone;
2849
2850         brcms_dbg_info(wlc_hw->d11core, "wl%d: disable core\n", wlc_hw->unit);
2851
2852         dev_gone = brcms_deviceremoved(wlc_hw->wlc);
2853
2854         if (dev_gone)
2855                 return;
2856
2857         if (wlc_hw->noreset)
2858                 return;
2859
2860         /* radio off */
2861         wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
2862
2863         /* turn off analog core */
2864         wlc_phy_anacore(wlc_hw->band->pi, OFF);
2865
2866         /* turn off PHYPLL to save power */
2867         brcms_b_core_phypll_ctl(wlc_hw, false);
2868
2869         wlc_hw->clk = false;
2870         bcma_core_disable(wlc_hw->d11core, 0);
2871         wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
2872 }
2873
2874 static void brcms_c_flushqueues(struct brcms_c_info *wlc)
2875 {
2876         struct brcms_hardware *wlc_hw = wlc->hw;
2877         uint i;
2878
2879         /* free any posted tx packets */
2880         for (i = 0; i < NFIFO; i++) {
2881                 if (wlc_hw->di[i]) {
2882                         dma_txreclaim(wlc_hw->di[i], DMA_RANGE_ALL);
2883                         if (i < TX_BCMC_FIFO)
2884                                 ieee80211_wake_queue(wlc->pub->ieee_hw,
2885                                                      brcms_fifo_to_ac(i));
2886                 }
2887         }
2888
2889         /* free any posted rx packets */
2890         dma_rxreclaim(wlc_hw->di[RX_FIFO]);
2891 }
2892
2893 static u16
2894 brcms_b_read_objmem(struct brcms_hardware *wlc_hw, uint offset, u32 sel)
2895 {
2896         struct bcma_device *core = wlc_hw->d11core;
2897         u16 objoff = D11REGOFFS(objdata);
2898
2899         bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2900         (void)bcma_read32(core, D11REGOFFS(objaddr));
2901         if (offset & 2)
2902                 objoff += 2;
2903
2904         return bcma_read16(core, objoff);
2905 }
2906
2907 static void
2908 brcms_b_write_objmem(struct brcms_hardware *wlc_hw, uint offset, u16 v,
2909                      u32 sel)
2910 {
2911         struct bcma_device *core = wlc_hw->d11core;
2912         u16 objoff = D11REGOFFS(objdata);
2913
2914         bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2915         (void)bcma_read32(core, D11REGOFFS(objaddr));
2916         if (offset & 2)
2917                 objoff += 2;
2918
2919         bcma_wflush16(core, objoff, v);
2920 }
2921
2922 /*
2923  * Read a single u16 from shared memory.
2924  * SHM 'offset' needs to be an even address
2925  */
2926 u16 brcms_b_read_shm(struct brcms_hardware *wlc_hw, uint offset)
2927 {
2928         return brcms_b_read_objmem(wlc_hw, offset, OBJADDR_SHM_SEL);
2929 }
2930
2931 /*
2932  * Write a single u16 to shared memory.
2933  * SHM 'offset' needs to be an even address
2934  */
2935 void brcms_b_write_shm(struct brcms_hardware *wlc_hw, uint offset, u16 v)
2936 {
2937         brcms_b_write_objmem(wlc_hw, offset, v, OBJADDR_SHM_SEL);
2938 }
2939
2940 /*
2941  * Copy a buffer to shared memory of specified type .
2942  * SHM 'offset' needs to be an even address and
2943  * Buffer length 'len' must be an even number of bytes
2944  * 'sel' selects the type of memory
2945  */
2946 void
2947 brcms_b_copyto_objmem(struct brcms_hardware *wlc_hw, uint offset,
2948                       const void *buf, int len, u32 sel)
2949 {
2950         u16 v;
2951         const u8 *p = (const u8 *)buf;
2952         int i;
2953
2954         if (len <= 0 || (offset & 1) || (len & 1))
2955                 return;
2956
2957         for (i = 0; i < len; i += 2) {
2958                 v = p[i] | (p[i + 1] << 8);
2959                 brcms_b_write_objmem(wlc_hw, offset + i, v, sel);
2960         }
2961 }
2962
2963 /*
2964  * Copy a piece of shared memory of specified type to a buffer .
2965  * SHM 'offset' needs to be an even address and
2966  * Buffer length 'len' must be an even number of bytes
2967  * 'sel' selects the type of memory
2968  */
2969 void
2970 brcms_b_copyfrom_objmem(struct brcms_hardware *wlc_hw, uint offset, void *buf,
2971                          int len, u32 sel)
2972 {
2973         u16 v;
2974         u8 *p = (u8 *) buf;
2975         int i;
2976
2977         if (len <= 0 || (offset & 1) || (len & 1))
2978                 return;
2979
2980         for (i = 0; i < len; i += 2) {
2981                 v = brcms_b_read_objmem(wlc_hw, offset + i, sel);
2982                 p[i] = v & 0xFF;
2983                 p[i + 1] = (v >> 8) & 0xFF;
2984         }
2985 }
2986
2987 /* Copy a buffer to shared memory.
2988  * SHM 'offset' needs to be an even address and
2989  * Buffer length 'len' must be an even number of bytes
2990  */
2991 static void brcms_c_copyto_shm(struct brcms_c_info *wlc, uint offset,
2992                         const void *buf, int len)
2993 {
2994         brcms_b_copyto_objmem(wlc->hw, offset, buf, len, OBJADDR_SHM_SEL);
2995 }
2996
2997 static void brcms_b_retrylimit_upd(struct brcms_hardware *wlc_hw,
2998                                    u16 SRL, u16 LRL)
2999 {
3000         wlc_hw->SRL = SRL;
3001         wlc_hw->LRL = LRL;
3002
3003         /* write retry limit to SCR, shouldn't need to suspend */
3004         if (wlc_hw->up) {
3005                 bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3006                              OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3007                 (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3008                 bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->SRL);
3009                 bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3010                              OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3011                 (void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3012                 bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->LRL);
3013         }
3014 }
3015
3016 static void brcms_b_pllreq(struct brcms_hardware *wlc_hw, bool set, u32 req_bit)
3017 {
3018         if (set) {
3019                 if (mboolisset(wlc_hw->pllreq, req_bit))
3020                         return;
3021
3022                 mboolset(wlc_hw->pllreq, req_bit);
3023
3024                 if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3025                         if (!wlc_hw->sbclk)
3026                                 brcms_b_xtal(wlc_hw, ON);
3027                 }
3028         } else {
3029                 if (!mboolisset(wlc_hw->pllreq, req_bit))
3030                         return;
3031
3032                 mboolclr(wlc_hw->pllreq, req_bit);
3033
3034                 if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3035                         if (wlc_hw->sbclk)
3036                                 brcms_b_xtal(wlc_hw, OFF);
3037                 }
3038         }
3039 }
3040
3041 static void brcms_b_antsel_set(struct brcms_hardware *wlc_hw, u32 antsel_avail)
3042 {
3043         wlc_hw->antsel_avail = antsel_avail;
3044 }
3045
3046 /*
3047  * conditions under which the PM bit should be set in outgoing frames
3048  * and STAY_AWAKE is meaningful
3049  */
3050 static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
3051 {
3052         /* disallow PS when one of the following global conditions meets */
3053         if (!wlc->pub->associated)
3054                 return false;
3055
3056         /* disallow PS when one of these meets when not scanning */
3057         if (wlc->filter_flags & FIF_PROMISC_IN_BSS)
3058                 return false;
3059
3060         return true;
3061 }
3062
3063 static void brcms_c_statsupd(struct brcms_c_info *wlc)
3064 {
3065         int i;
3066         struct macstat macstats;
3067 #ifdef DEBUG
3068         u16 delta;
3069         u16 rxf0ovfl;
3070         u16 txfunfl[NFIFO];
3071 #endif                          /* DEBUG */
3072
3073         /* if driver down, make no sense to update stats */
3074         if (!wlc->pub->up)
3075                 return;
3076
3077 #ifdef DEBUG
3078         /* save last rx fifo 0 overflow count */
3079         rxf0ovfl = wlc->core->macstat_snapshot->rxf0ovfl;
3080
3081         /* save last tx fifo  underflow count */
3082         for (i = 0; i < NFIFO; i++)
3083                 txfunfl[i] = wlc->core->macstat_snapshot->txfunfl[i];
3084 #endif                          /* DEBUG */
3085
3086         /* Read mac stats from contiguous shared memory */
3087         brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, &macstats,
3088                                 sizeof(struct macstat), OBJADDR_SHM_SEL);
3089
3090 #ifdef DEBUG
3091         /* check for rx fifo 0 overflow */
3092         delta = (u16) (wlc->core->macstat_snapshot->rxf0ovfl - rxf0ovfl);
3093         if (delta)
3094                 brcms_err(wlc->hw->d11core, "wl%d: %u rx fifo 0 overflows!\n",
3095                           wlc->pub->unit, delta);
3096
3097         /* check for tx fifo underflows */
3098         for (i = 0; i < NFIFO; i++) {
3099                 delta =
3100                     (u16) (wlc->core->macstat_snapshot->txfunfl[i] -
3101                               txfunfl[i]);
3102                 if (delta)
3103                         brcms_err(wlc->hw->d11core,
3104                                   "wl%d: %u tx fifo %d underflows!\n",
3105                                   wlc->pub->unit, delta, i);
3106         }
3107 #endif                          /* DEBUG */
3108
3109         /* merge counters from dma module */
3110         for (i = 0; i < NFIFO; i++) {
3111                 if (wlc->hw->di[i])
3112                         dma_counterreset(wlc->hw->di[i]);
3113         }
3114 }
3115
3116 static void brcms_b_reset(struct brcms_hardware *wlc_hw)
3117 {
3118         /* reset the core */
3119         if (!brcms_deviceremoved(wlc_hw->wlc))
3120                 brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
3121
3122         /* purge the dma rings */
3123         brcms_c_flushqueues(wlc_hw->wlc);
3124 }
3125
3126 void brcms_c_reset(struct brcms_c_info *wlc)
3127 {
3128         brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
3129
3130         /* slurp up hw mac counters before core reset */
3131         brcms_c_statsupd(wlc);
3132
3133         /* reset our snapshot of macstat counters */
3134         memset(wlc->core->macstat_snapshot, 0, sizeof(struct macstat));
3135
3136         brcms_b_reset(wlc->hw);
3137 }
3138
3139 void brcms_c_init_scb(struct scb *scb)
3140 {
3141         int i;
3142
3143         memset(scb, 0, sizeof(struct scb));
3144         scb->flags = SCB_WMECAP | SCB_HTCAP;
3145         for (i = 0; i < NUMPRIO; i++) {
3146                 scb->seqnum[i] = 0;
3147                 scb->seqctl[i] = 0xFFFF;
3148         }
3149
3150         scb->seqctl_nonqos = 0xFFFF;
3151         scb->magic = SCB_MAGIC;
3152 }
3153
3154 /* d11 core init
3155  *   reset PSM
3156  *   download ucode/PCM
3157  *   let ucode run to suspended
3158  *   download ucode inits
3159  *   config other core registers
3160  *   init dma
3161  */
3162 static void brcms_b_coreinit(struct brcms_c_info *wlc)
3163 {
3164         struct brcms_hardware *wlc_hw = wlc->hw;
3165         struct bcma_device *core = wlc_hw->d11core;
3166         u32 sflags;
3167         u32 bcnint_us;
3168         uint i = 0;
3169         bool fifosz_fixup = false;
3170         int err = 0;
3171         u16 buf[NFIFO];
3172         struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
3173
3174         brcms_dbg_info(core, "wl%d: core init\n", wlc_hw->unit);
3175
3176         /* reset PSM */
3177         brcms_b_mctrl(wlc_hw, ~0, (MCTL_IHR_EN | MCTL_PSM_JMP_0 | MCTL_WAKE));
3178
3179         brcms_ucode_download(wlc_hw);
3180         /*
3181          * FIFOSZ fixup. driver wants to controls the fifo allocation.
3182          */
3183         fifosz_fixup = true;
3184
3185         /* let the PSM run to the suspended state, set mode to BSS STA */
3186         bcma_write32(core, D11REGOFFS(macintstatus), -1);
3187         brcms_b_mctrl(wlc_hw, ~0,
3188                        (MCTL_IHR_EN | MCTL_INFRA | MCTL_PSM_RUN | MCTL_WAKE));
3189
3190         /* wait for ucode to self-suspend after auto-init */
3191         SPINWAIT(((bcma_read32(core, D11REGOFFS(macintstatus)) &
3192                    MI_MACSSPNDD) == 0), 1000 * 1000);
3193         if ((bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD) == 0)
3194                 brcms_err(core, "wl%d: wlc_coreinit: ucode did not self-"
3195                           "suspend!\n", wlc_hw->unit);
3196
3197         brcms_c_gpio_init(wlc);
3198
3199         sflags = bcma_aread32(core, BCMA_IOST);
3200
3201         if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
3202                 if (BRCMS_ISNPHY(wlc_hw->band))
3203                         brcms_c_write_inits(wlc_hw, ucode->d11n0initvals16);
3204                 else
3205                         brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3206                                   " %d\n", __func__, wlc_hw->unit,
3207                                   wlc_hw->corerev);
3208         } else if (D11REV_IS(wlc_hw->corerev, 24)) {
3209                 if (BRCMS_ISLCNPHY(wlc_hw->band))
3210                         brcms_c_write_inits(wlc_hw, ucode->d11lcn0initvals24);
3211                 else
3212                         brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3213                                   " %d\n", __func__, wlc_hw->unit,
3214                                   wlc_hw->corerev);
3215         } else {
3216                 brcms_err(core, "%s: wl%d: unsupported corerev %d\n",
3217                           __func__, wlc_hw->unit, wlc_hw->corerev);
3218         }
3219
3220         /* For old ucode, txfifo sizes needs to be modified(increased) */
3221         if (fifosz_fixup)
3222                 brcms_b_corerev_fifofixup(wlc_hw);
3223
3224         /* check txfifo allocations match between ucode and driver */
3225         buf[TX_AC_BE_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE0);
3226         if (buf[TX_AC_BE_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]) {
3227                 i = TX_AC_BE_FIFO;
3228                 err = -1;
3229         }
3230         buf[TX_AC_VI_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE1);
3231         if (buf[TX_AC_VI_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]) {
3232                 i = TX_AC_VI_FIFO;
3233                 err = -1;
3234         }
3235         buf[TX_AC_BK_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE2);
3236         buf[TX_AC_VO_FIFO] = (buf[TX_AC_BK_FIFO] >> 8) & 0xff;
3237         buf[TX_AC_BK_FIFO] &= 0xff;
3238         if (buf[TX_AC_BK_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BK_FIFO]) {
3239                 i = TX_AC_BK_FIFO;
3240                 err = -1;
3241         }
3242         if (buf[TX_AC_VO_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO]) {
3243                 i = TX_AC_VO_FIFO;
3244                 err = -1;
3245         }
3246         buf[TX_BCMC_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE3);
3247         buf[TX_ATIM_FIFO] = (buf[TX_BCMC_FIFO] >> 8) & 0xff;
3248         buf[TX_BCMC_FIFO] &= 0xff;
3249         if (buf[TX_BCMC_FIFO] != wlc_hw->xmtfifo_sz[TX_BCMC_FIFO]) {
3250                 i = TX_BCMC_FIFO;
3251                 err = -1;
3252         }
3253         if (buf[TX_ATIM_FIFO] != wlc_hw->xmtfifo_sz[TX_ATIM_FIFO]) {
3254                 i = TX_ATIM_FIFO;
3255                 err = -1;
3256         }
3257         if (err != 0)
3258                 brcms_err(core, "wlc_coreinit: txfifo mismatch: ucode size %d"
3259                           " driver size %d index %d\n", buf[i],
3260                           wlc_hw->xmtfifo_sz[i], i);
3261
3262         /* make sure we can still talk to the mac */
3263         WARN_ON(bcma_read32(core, D11REGOFFS(maccontrol)) == 0xffffffff);
3264
3265         /* band-specific inits done by wlc_bsinit() */
3266
3267         /* Set up frame burst size and antenna swap threshold init values */
3268         brcms_b_write_shm(wlc_hw, M_MBURST_SIZE, MAXTXFRAMEBURST);
3269         brcms_b_write_shm(wlc_hw, M_MAX_ANTCNT, ANTCNT);
3270
3271         /* enable one rx interrupt per received frame */
3272         bcma_write32(core, D11REGOFFS(intrcvlazy[0]), (1 << IRL_FC_SHIFT));
3273
3274         /* set the station mode (BSS STA) */
3275         brcms_b_mctrl(wlc_hw,
3276                        (MCTL_INFRA | MCTL_DISCARD_PMQ | MCTL_AP),
3277                        (MCTL_INFRA | MCTL_DISCARD_PMQ));
3278
3279         /* set up Beacon interval */
3280         bcnint_us = 0x8000 << 10;
3281         bcma_write32(core, D11REGOFFS(tsf_cfprep),
3282                      (bcnint_us << CFPREP_CBI_SHIFT));
3283         bcma_write32(core, D11REGOFFS(tsf_cfpstart), bcnint_us);
3284         bcma_write32(core, D11REGOFFS(macintstatus), MI_GP1);
3285
3286         /* write interrupt mask */
3287         bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intmask),
3288                      DEF_RXINTMASK);
3289
3290         /* allow the MAC to control the PHY clock (dynamic on/off) */
3291         brcms_b_macphyclk_set(wlc_hw, ON);
3292
3293         /* program dynamic clock control fast powerup delay register */
3294         wlc->fastpwrup_dly = ai_clkctl_fast_pwrup_delay(wlc_hw->sih);
3295         bcma_write16(core, D11REGOFFS(scc_fastpwrup_dly), wlc->fastpwrup_dly);
3296
3297         /* tell the ucode the corerev */
3298         brcms_b_write_shm(wlc_hw, M_MACHW_VER, (u16) wlc_hw->corerev);
3299
3300         /* tell the ucode MAC capabilities */
3301         brcms_b_write_shm(wlc_hw, M_MACHW_CAP_L,
3302                            (u16) (wlc_hw->machwcap & 0xffff));
3303         brcms_b_write_shm(wlc_hw, M_MACHW_CAP_H,
3304                            (u16) ((wlc_hw->
3305                                       machwcap >> 16) & 0xffff));
3306
3307         /* write retry limits to SCR, this done after PSM init */
3308         bcma_write32(core, D11REGOFFS(objaddr),
3309                      OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3310         (void)bcma_read32(core, D11REGOFFS(objaddr));
3311         bcma_write32(core, D11REGOFFS(objdata), wlc_hw->SRL);
3312         bcma_write32(core, D11REGOFFS(objaddr),
3313                      OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3314         (void)bcma_read32(core, D11REGOFFS(objaddr));
3315         bcma_write32(core, D11REGOFFS(objdata), wlc_hw->LRL);
3316
3317         /* write rate fallback retry limits */
3318         brcms_b_write_shm(wlc_hw, M_SFRMTXCNTFBRTHSD, wlc_hw->SFBL);
3319         brcms_b_write_shm(wlc_hw, M_LFRMTXCNTFBRTHSD, wlc_hw->LFBL);
3320
3321         bcma_mask16(core, D11REGOFFS(ifs_ctl), 0x0FFF);
3322         bcma_write16(core, D11REGOFFS(ifs_aifsn), EDCF_AIFSN_MIN);
3323
3324         /* init the tx dma engines */
3325         for (i = 0; i < NFIFO; i++) {
3326                 if (wlc_hw->di[i])
3327                         dma_txinit(wlc_hw->di[i]);
3328         }
3329
3330         /* init the rx dma engine(s) and post receive buffers */
3331         dma_rxinit(wlc_hw->di[RX_FIFO]);
3332         dma_rxfill(wlc_hw->di[RX_FIFO]);
3333 }
3334
3335 void
3336 static brcms_b_init(struct brcms_hardware *wlc_hw, u16 chanspec) {
3337         u32 macintmask;
3338         bool fastclk;
3339         struct brcms_c_info *wlc = wlc_hw->wlc;
3340
3341         /* request FAST clock if not on */
3342         fastclk = wlc_hw->forcefastclk;
3343         if (!fastclk)
3344                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
3345
3346         /* disable interrupts */
3347         macintmask = brcms_intrsoff(wlc->wl);
3348
3349         /* set up the specified band and chanspec */
3350         brcms_c_setxband(wlc_hw, chspec_bandunit(chanspec));
3351         wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3352
3353         /* do one-time phy inits and calibration */
3354         wlc_phy_cal_init(wlc_hw->band->pi);
3355
3356         /* core-specific initialization */
3357         brcms_b_coreinit(wlc);
3358
3359         /* band-specific inits */
3360         brcms_b_bsinit(wlc, chanspec);
3361
3362         /* restore macintmask */
3363         brcms_intrsrestore(wlc->wl, macintmask);
3364
3365         /* seed wake_override with BRCMS_WAKE_OVERRIDE_MACSUSPEND since the mac
3366          * is suspended and brcms_c_enable_mac() will clear this override bit.
3367          */
3368         mboolset(wlc_hw->wake_override, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
3369
3370         /*
3371          * initialize mac_suspend_depth to 1 to match ucode
3372          * initial suspended state
3373          */
3374         wlc_hw->mac_suspend_depth = 1;
3375
3376         /* restore the clk */
3377         if (!fastclk)
3378                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
3379 }
3380
3381 static void brcms_c_set_phy_chanspec(struct brcms_c_info *wlc,
3382                                      u16 chanspec)
3383 {
3384         /* Save our copy of the chanspec */
3385         wlc->chanspec = chanspec;
3386
3387         /* Set the chanspec and power limits for this locale */
3388         brcms_c_channel_set_chanspec(wlc->cmi, chanspec, BRCMS_TXPWR_MAX);
3389
3390         if (wlc->stf->ss_algosel_auto)
3391                 brcms_c_stf_ss_algo_channel_get(wlc, &wlc->stf->ss_algo_channel,
3392                                             chanspec);
3393
3394         brcms_c_stf_ss_update(wlc, wlc->band);
3395 }
3396
3397 static void
3398 brcms_default_rateset(struct brcms_c_info *wlc, struct brcms_c_rateset *rs)
3399 {
3400         brcms_c_rateset_default(rs, NULL, wlc->band->phytype,
3401                 wlc->band->bandtype, false, BRCMS_RATE_MASK_FULL,
3402                 (bool) (wlc->pub->_n_enab & SUPPORT_11N),
3403                 brcms_chspec_bw(wlc->default_bss->chanspec),
3404                 wlc->stf->txstreams);
3405 }
3406
3407 /* derive wlc->band->basic_rate[] table from 'rateset' */
3408 static void brcms_c_rate_lookup_init(struct brcms_c_info *wlc,
3409                               struct brcms_c_rateset *rateset)
3410 {
3411         u8 rate;
3412         u8 mandatory;
3413         u8 cck_basic = 0;
3414         u8 ofdm_basic = 0;
3415         u8 *br = wlc->band->basic_rate;
3416         uint i;
3417
3418         /* incoming rates are in 500kbps units as in 802.11 Supported Rates */
3419         memset(br, 0, BRCM_MAXRATE + 1);
3420
3421         /* For each basic rate in the rates list, make an entry in the
3422          * best basic lookup.
3423          */
3424         for (i = 0; i < rateset->count; i++) {
3425                 /* only make an entry for a basic rate */
3426                 if (!(rateset->rates[i] & BRCMS_RATE_FLAG))
3427                         continue;
3428
3429                 /* mask off basic bit */
3430                 rate = (rateset->rates[i] & BRCMS_RATE_MASK);
3431
3432                 if (rate > BRCM_MAXRATE) {
3433                         brcms_err(wlc->hw->d11core, "brcms_c_rate_lookup_init: "
3434                                   "invalid rate 0x%X in rate set\n",
3435                                   rateset->rates[i]);
3436                         continue;
3437                 }
3438
3439                 br[rate] = rate;
3440         }
3441
3442         /* The rate lookup table now has non-zero entries for each
3443          * basic rate, equal to the basic rate: br[basicN] = basicN
3444          *
3445          * To look up the best basic rate corresponding to any
3446          * particular rate, code can use the basic_rate table
3447          * like this
3448          *
3449          * basic_rate = wlc->band->basic_rate[tx_rate]
3450          *
3451          * Make sure there is a best basic rate entry for
3452          * every rate by walking up the table from low rates
3453          * to high, filling in holes in the lookup table
3454          */
3455
3456         for (i = 0; i < wlc->band->hw_rateset.count; i++) {
3457                 rate = wlc->band->hw_rateset.rates[i];
3458
3459                 if (br[rate] != 0) {
3460                         /* This rate is a basic rate.
3461                          * Keep track of the best basic rate so far by
3462                          * modulation type.
3463                          */
3464                         if (is_ofdm_rate(rate))
3465                                 ofdm_basic = rate;
3466                         else
3467                                 cck_basic = rate;
3468
3469                         continue;
3470                 }
3471
3472                 /* This rate is not a basic rate so figure out the
3473                  * best basic rate less than this rate and fill in
3474                  * the hole in the table
3475                  */
3476
3477                 br[rate] = is_ofdm_rate(rate) ? ofdm_basic : cck_basic;
3478
3479                 if (br[rate] != 0)
3480                         continue;
3481
3482                 if (is_ofdm_rate(rate)) {
3483                         /*
3484                          * In 11g and 11a, the OFDM mandatory rates
3485                          * are 6, 12, and 24 Mbps
3486                          */
3487                         if (rate >= BRCM_RATE_24M)
3488                                 mandatory = BRCM_RATE_24M;
3489                         else if (rate >= BRCM_RATE_12M)
3490                                 mandatory = BRCM_RATE_12M;
3491                         else
3492                                 mandatory = BRCM_RATE_6M;
3493                 } else {
3494                         /* In 11b, all CCK rates are mandatory 1 - 11 Mbps */
3495                         mandatory = rate;
3496                 }
3497
3498                 br[rate] = mandatory;
3499         }
3500 }
3501
3502 static void brcms_c_bandinit_ordered(struct brcms_c_info *wlc,
3503                                      u16 chanspec)
3504 {
3505         struct brcms_c_rateset default_rateset;
3506         uint parkband;
3507         uint i, band_order[2];
3508
3509         /*
3510          * We might have been bandlocked during down and the chip
3511          * power-cycled (hibernate). Figure out the right band to park on
3512          */
3513         if (wlc->bandlocked || wlc->pub->_nbands == 1) {
3514                 /* updated in brcms_c_bandlock() */
3515                 parkband = wlc->band->bandunit;
3516                 band_order[0] = band_order[1] = parkband;
3517         } else {
3518                 /* park on the band of the specified chanspec */
3519                 parkband = chspec_bandunit(chanspec);
3520
3521                 /* order so that parkband initialize last */
3522                 band_order[0] = parkband ^ 1;
3523                 band_order[1] = parkband;
3524         }
3525
3526         /* make each band operational, software state init */
3527         for (i = 0; i < wlc->pub->_nbands; i++) {
3528                 uint j = band_order[i];
3529
3530                 wlc->band = wlc->bandstate[j];
3531
3532                 brcms_default_rateset(wlc, &default_rateset);
3533
3534                 /* fill in hw_rate */
3535                 brcms_c_rateset_filter(&default_rateset, &wlc->band->hw_rateset,
3536                                    false, BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
3537                                    (bool) (wlc->pub->_n_enab & SUPPORT_11N));
3538
3539                 /* init basic rate lookup */
3540                 brcms_c_rate_lookup_init(wlc, &default_rateset);
3541         }
3542
3543         /* sync up phy/radio chanspec */
3544         brcms_c_set_phy_chanspec(wlc, chanspec);
3545 }
3546
3547 /*
3548  * Set or clear filtering related maccontrol bits based on
3549  * specified filter flags
3550  */
3551 void brcms_c_mac_promisc(struct brcms_c_info *wlc, uint filter_flags)
3552 {
3553         u32 promisc_bits = 0;
3554
3555         wlc->filter_flags = filter_flags;
3556
3557         if (filter_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS))
3558                 promisc_bits |= MCTL_PROMISC;
3559
3560         if (filter_flags & FIF_BCN_PRBRESP_PROMISC)
3561                 promisc_bits |= MCTL_BCNS_PROMISC;
3562
3563         if (filter_flags & FIF_FCSFAIL)
3564                 promisc_bits |= MCTL_KEEPBADFCS;
3565
3566         if (filter_flags & (FIF_CONTROL | FIF_PSPOLL))
3567                 promisc_bits |= MCTL_KEEPCONTROL;
3568
3569         brcms_b_mctrl(wlc->hw,
3570                 MCTL_PROMISC | MCTL_BCNS_PROMISC |
3571                 MCTL_KEEPCONTROL | MCTL_KEEPBADFCS,
3572                 promisc_bits);
3573 }
3574
3575 /*
3576  * ucode, hwmac update
3577  *    Channel dependent updates for ucode and hw
3578  */
3579 static void brcms_c_ucode_mac_upd(struct brcms_c_info *wlc)
3580 {
3581         /* enable or disable any active IBSSs depending on whether or not
3582          * we are on the home channel
3583          */
3584         if (wlc->home_chanspec == wlc_phy_chanspec_get(wlc->band->pi)) {
3585                 if (wlc->pub->associated) {
3586                         /*
3587                          * BMAC_NOTE: This is something that should be fixed
3588                          * in ucode inits. I think that the ucode inits set
3589                          * up the bcn templates and shm values with a bogus
3590                          * beacon. This should not be done in the inits. If
3591                          * ucode needs to set up a beacon for testing, the
3592                          * test routines should write it down, not expect the
3593                          * inits to populate a bogus beacon.
3594                          */
3595                         if (BRCMS_PHY_11N_CAP(wlc->band))
3596                                 brcms_b_write_shm(wlc->hw,
3597                                                 M_BCN_TXTSF_OFFSET, 0);
3598                 }
3599         } else {
3600                 /* disable an active IBSS if we are not on the home channel */
3601         }
3602 }
3603
3604 static void brcms_c_write_rate_shm(struct brcms_c_info *wlc, u8 rate,
3605                                    u8 basic_rate)
3606 {
3607         u8 phy_rate, index;
3608         u8 basic_phy_rate, basic_index;
3609         u16 dir_table, basic_table;
3610         u16 basic_ptr;
3611
3612         /* Shared memory address for the table we are reading */
3613         dir_table = is_ofdm_rate(basic_rate) ? M_RT_DIRMAP_A : M_RT_DIRMAP_B;
3614
3615         /* Shared memory address for the table we are writing */
3616         basic_table = is_ofdm_rate(rate) ? M_RT_BBRSMAP_A : M_RT_BBRSMAP_B;
3617
3618         /*
3619          * for a given rate, the LS-nibble of the PLCP SIGNAL field is
3620          * the index into the rate table.
3621          */
3622         phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
3623         basic_phy_rate = rate_info[basic_rate] & BRCMS_RATE_MASK;
3624         index = phy_rate & 0xf;
3625         basic_index = basic_phy_rate & 0xf;
3626
3627         /* Find the SHM pointer to the ACK rate entry by looking in the
3628          * Direct-map Table
3629          */
3630         basic_ptr = brcms_b_read_shm(wlc->hw, (dir_table + basic_index * 2));
3631
3632         /* Update the SHM BSS-basic-rate-set mapping table with the pointer
3633          * to the correct basic rate for the given incoming rate
3634          */
3635         brcms_b_write_shm(wlc->hw, (basic_table + index * 2), basic_ptr);
3636 }
3637
3638 static const struct brcms_c_rateset *
3639 brcms_c_rateset_get_hwrs(struct brcms_c_info *wlc)
3640 {
3641         const struct brcms_c_rateset *rs_dflt;
3642
3643         if (BRCMS_PHY_11N_CAP(wlc->band)) {
3644                 if (wlc->band->bandtype == BRCM_BAND_5G)
3645                         rs_dflt = &ofdm_mimo_rates;
3646                 else
3647                         rs_dflt = &cck_ofdm_mimo_rates;
3648         } else if (wlc->band->gmode)
3649                 rs_dflt = &cck_ofdm_rates;
3650         else
3651                 rs_dflt = &cck_rates;
3652
3653         return rs_dflt;
3654 }
3655
3656 static void brcms_c_set_ratetable(struct brcms_c_info *wlc)
3657 {
3658         const struct brcms_c_rateset *rs_dflt;
3659         struct brcms_c_rateset rs;
3660         u8 rate, basic_rate;
3661         uint i;
3662
3663         rs_dflt = brcms_c_rateset_get_hwrs(wlc);
3664
3665         brcms_c_rateset_copy(rs_dflt, &rs);
3666         brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
3667
3668         /* walk the phy rate table and update SHM basic rate lookup table */
3669         for (i = 0; i < rs.count; i++) {
3670                 rate = rs.rates[i] & BRCMS_RATE_MASK;
3671
3672                 /* for a given rate brcms_basic_rate returns the rate at
3673                  * which a response ACK/CTS should be sent.
3674                  */
3675                 basic_rate = brcms_basic_rate(wlc, rate);
3676                 if (basic_rate == 0)
3677                         /* This should only happen if we are using a
3678                          * restricted rateset.
3679                          */
3680                         basic_rate = rs.rates[0] & BRCMS_RATE_MASK;
3681
3682                 brcms_c_write_rate_shm(wlc, rate, basic_rate);
3683         }
3684 }
3685
3686 /* band-specific init */
3687 static void brcms_c_bsinit(struct brcms_c_info *wlc)
3688 {
3689         brcms_dbg_info(wlc->hw->d11core, "wl%d: bandunit %d\n",
3690                        wlc->pub->unit, wlc->band->bandunit);
3691
3692         /* write ucode ACK/CTS rate table */
3693         brcms_c_set_ratetable(wlc);
3694
3695         /* update some band specific mac configuration */
3696         brcms_c_ucode_mac_upd(wlc);
3697
3698         /* init antenna selection */
3699         brcms_c_antsel_init(wlc->asi);
3700
3701 }
3702
3703 /* formula:  IDLE_BUSY_RATIO_X_16 = (100-duty_cycle)/duty_cycle*16 */
3704 static int
3705 brcms_c_duty_cycle_set(struct brcms_c_info *wlc, int duty_cycle, bool isOFDM,
3706                    bool writeToShm)
3707 {
3708         int idle_busy_ratio_x_16 = 0;
3709         uint offset =
3710             isOFDM ? M_TX_IDLE_BUSY_RATIO_X_16_OFDM :
3711             M_TX_IDLE_BUSY_RATIO_X_16_CCK;
3712         if (duty_cycle > 100 || duty_cycle < 0) {
3713                 brcms_err(wlc->hw->d11core,
3714                           "wl%d:  duty cycle value off limit\n",
3715                           wlc->pub->unit);
3716                 return -EINVAL;
3717         }
3718         if (duty_cycle)
3719                 idle_busy_ratio_x_16 = (100 - duty_cycle) * 16 / duty_cycle;
3720         /* Only write to shared memory  when wl is up */
3721         if (writeToShm)
3722                 brcms_b_write_shm(wlc->hw, offset, (u16) idle_busy_ratio_x_16);
3723
3724         if (isOFDM)
3725                 wlc->tx_duty_cycle_ofdm = (u16) duty_cycle;
3726         else
3727                 wlc->tx_duty_cycle_cck = (u16) duty_cycle;
3728
3729         return 0;
3730 }
3731
3732 /* push sw hps and wake state through hardware */
3733 static void brcms_c_set_ps_ctrl(struct brcms_c_info *wlc)
3734 {
3735         u32 v1, v2;
3736         bool hps;
3737         bool awake_before;
3738
3739         hps = brcms_c_ps_allowed(wlc);
3740
3741         brcms_dbg_mac80211(wlc->hw->d11core, "wl%d: hps %d\n", wlc->pub->unit,
3742                            hps);
3743
3744         v1 = bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
3745         v2 = MCTL_WAKE;
3746         if (hps)
3747                 v2 |= MCTL_HPS;
3748
3749         brcms_b_mctrl(wlc->hw, MCTL_WAKE | MCTL_HPS, v2);
3750
3751         awake_before = ((v1 & MCTL_WAKE) || ((v1 & MCTL_HPS) == 0));
3752
3753         if (!awake_before)
3754                 brcms_b_wait_for_wake(wlc->hw);
3755 }
3756
3757 /*
3758  * Write this BSS config's MAC address to core.
3759  * Updates RXE match engine.
3760  */
3761 static int brcms_c_set_mac(struct brcms_bss_cfg *bsscfg)
3762 {
3763         int err = 0;
3764         struct brcms_c_info *wlc = bsscfg->wlc;
3765
3766         /* enter the MAC addr into the RXE match registers */
3767         brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, wlc->pub->cur_etheraddr);
3768
3769         brcms_c_ampdu_macaddr_upd(wlc);
3770
3771         return err;
3772 }
3773
3774 /* Write the BSS config's BSSID address to core (set_bssid in d11procs.tcl).
3775  * Updates RXE match engine.
3776  */
3777 static void brcms_c_set_bssid(struct brcms_bss_cfg *bsscfg)
3778 {
3779         /* we need to update BSSID in RXE match registers */
3780         brcms_c_set_addrmatch(bsscfg->wlc, RCM_BSSID_OFFSET, bsscfg->BSSID);
3781 }
3782
3783 static void brcms_b_set_shortslot(struct brcms_hardware *wlc_hw, bool shortslot)
3784 {
3785         wlc_hw->shortslot = shortslot;
3786
3787         if (wlc_hw->band->bandtype == BRCM_BAND_2G && wlc_hw->up) {
3788                 brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
3789                 brcms_b_update_slot_timing(wlc_hw, shortslot);
3790                 brcms_c_enable_mac(wlc_hw->wlc);
3791         }
3792 }
3793
3794 /*
3795  * Suspend the the MAC and update the slot timing
3796  * for standard 11b/g (20us slots) or shortslot 11g (9us slots).
3797  */
3798 static void brcms_c_switch_shortslot(struct brcms_c_info *wlc, bool shortslot)
3799 {
3800         /* use the override if it is set */
3801         if (wlc->shortslot_override != BRCMS_SHORTSLOT_AUTO)
3802                 shortslot = (wlc->shortslot_override == BRCMS_SHORTSLOT_ON);
3803
3804         if (wlc->shortslot == shortslot)
3805                 return;
3806
3807         wlc->shortslot = shortslot;
3808
3809         brcms_b_set_shortslot(wlc->hw, shortslot);
3810 }
3811
3812 static void brcms_c_set_home_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3813 {
3814         if (wlc->home_chanspec != chanspec) {
3815                 wlc->home_chanspec = chanspec;
3816
3817                 if (wlc->pub->associated)
3818                         wlc->bsscfg->current_bss->chanspec = chanspec;
3819         }
3820 }
3821
3822 void
3823 brcms_b_set_chanspec(struct brcms_hardware *wlc_hw, u16 chanspec,
3824                       bool mute_tx, struct txpwr_limits *txpwr)
3825 {
3826         uint bandunit;
3827
3828         brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: 0x%x\n", wlc_hw->unit,
3829                            chanspec);
3830
3831         wlc_hw->chanspec = chanspec;
3832
3833         /* Switch bands if necessary */
3834         if (wlc_hw->_nbands > 1) {
3835                 bandunit = chspec_bandunit(chanspec);
3836                 if (wlc_hw->band->bandunit != bandunit) {
3837                         /* brcms_b_setband disables other bandunit,
3838                          *  use light band switch if not up yet
3839                          */
3840                         if (wlc_hw->up) {
3841                                 wlc_phy_chanspec_radio_set(wlc_hw->
3842                                                            bandstate[bandunit]->
3843                                                            pi, chanspec);
3844                                 brcms_b_setband(wlc_hw, bandunit, chanspec);
3845                         } else {
3846                                 brcms_c_setxband(wlc_hw, bandunit);
3847                         }
3848                 }
3849         }
3850
3851         wlc_phy_initcal_enable(wlc_hw->band->pi, !mute_tx);
3852
3853         if (!wlc_hw->up) {
3854                 if (wlc_hw->clk)
3855                         wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr,
3856                                                   chanspec);
3857                 wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3858         } else {
3859                 wlc_phy_chanspec_set(wlc_hw->band->pi, chanspec);
3860                 wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr, chanspec);
3861
3862                 /* Update muting of the channel */
3863                 brcms_b_mute(wlc_hw, mute_tx);
3864         }
3865 }
3866
3867 /* switch to and initialize new band */
3868 static void brcms_c_setband(struct brcms_c_info *wlc,
3869                                            uint bandunit)
3870 {
3871         wlc->band = wlc->bandstate[bandunit];
3872
3873         if (!wlc->pub->up)
3874                 return;
3875
3876         /* wait for at least one beacon before entering sleeping state */
3877         brcms_c_set_ps_ctrl(wlc);
3878
3879         /* band-specific initializations */
3880         brcms_c_bsinit(wlc);
3881 }
3882
3883 static void brcms_c_set_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3884 {
3885         uint bandunit;
3886         bool switchband = false;
3887         u16 old_chanspec = wlc->chanspec;
3888
3889         if (!brcms_c_valid_chanspec_db(wlc->cmi, chanspec)) {
3890                 brcms_err(wlc->hw->d11core, "wl%d: %s: Bad channel %d\n",
3891                           wlc->pub->unit, __func__, CHSPEC_CHANNEL(chanspec));
3892                 return;
3893         }
3894
3895         /* Switch bands if necessary */
3896         if (wlc->pub->_nbands > 1) {
3897                 bandunit = chspec_bandunit(chanspec);
3898                 if (wlc->band->bandunit != bandunit || wlc->bandinit_pending) {
3899                         switchband = true;
3900                         if (wlc->bandlocked) {
3901                                 brcms_err(wlc->hw->d11core,
3902                                           "wl%d: %s: chspec %d band is locked!\n",
3903                                           wlc->pub->unit, __func__,
3904                                           CHSPEC_CHANNEL(chanspec));
3905                                 return;
3906                         }
3907                         /*
3908                          * should the setband call come after the
3909                          * brcms_b_chanspec() ? if the setband updates
3910                          * (brcms_c_bsinit) use low level calls to inspect and
3911                          * set state, the state inspected may be from the wrong
3912                          * band, or the following brcms_b_set_chanspec() may
3913                          * undo the work.
3914                          */
3915                         brcms_c_setband(wlc, bandunit);
3916                 }
3917         }
3918
3919         /* sync up phy/radio chanspec */
3920         brcms_c_set_phy_chanspec(wlc, chanspec);
3921
3922         /* init antenna selection */
3923         if (brcms_chspec_bw(old_chanspec) != brcms_chspec_bw(chanspec)) {
3924                 brcms_c_antsel_init(wlc->asi);
3925
3926                 /* Fix the hardware rateset based on bw.
3927                  * Mainly add MCS32 for 40Mhz, remove MCS 32 for 20Mhz
3928                  */
3929                 brcms_c_rateset_bw_mcs_filter(&wlc->band->hw_rateset,
3930                         wlc->band->mimo_cap_40 ? brcms_chspec_bw(chanspec) : 0);
3931         }
3932
3933         /* update some mac configuration since chanspec changed */
3934         brcms_c_ucode_mac_upd(wlc);
3935 }
3936
3937 /*
3938  * This function changes the phytxctl for beacon based on current
3939  * beacon ratespec AND txant setting as per this table:
3940  *  ratespec     CCK            ant = wlc->stf->txant
3941  *              OFDM            ant = 3
3942  */
3943 void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc,
3944                                        u32 bcn_rspec)
3945 {
3946         u16 phyctl;
3947         u16 phytxant = wlc->stf->phytxant;
3948         u16 mask = PHY_TXC_ANT_MASK;
3949
3950         /* for non-siso rates or default setting, use the available chains */
3951         if (BRCMS_PHY_11N_CAP(wlc->band))
3952                 phytxant = brcms_c_stf_phytxchain_sel(wlc, bcn_rspec);
3953
3954         phyctl = brcms_b_read_shm(wlc->hw, M_BCN_PCTLWD);
3955         phyctl = (phyctl & ~mask) | phytxant;
3956         brcms_b_write_shm(wlc->hw, M_BCN_PCTLWD, phyctl);
3957 }
3958
3959 /*
3960  * centralized protection config change function to simplify debugging, no
3961  * consistency checking this should be called only on changes to avoid overhead
3962  * in periodic function
3963  */
3964 void brcms_c_protection_upd(struct brcms_c_info *wlc, uint idx, int val)
3965 {
3966         /*
3967          * Cannot use brcms_dbg_* here because this function is called
3968          * before wlc is sufficiently initialized.
3969          */
3970         BCMMSG(wlc->wiphy, "idx %d, val %d\n", idx, val);
3971
3972         switch (idx) {
3973         case BRCMS_PROT_G_SPEC:
3974                 wlc->protection->_g = (bool) val;
3975                 break;
3976         case BRCMS_PROT_G_OVR:
3977                 wlc->protection->g_override = (s8) val;
3978                 break;
3979         case BRCMS_PROT_G_USER:
3980                 wlc->protection->gmode_user = (u8) val;
3981                 break;
3982         case BRCMS_PROT_OVERLAP:
3983                 wlc->protection->overlap = (s8) val;
3984                 break;
3985         case BRCMS_PROT_N_USER:
3986                 wlc->protection->nmode_user = (s8) val;
3987                 break;
3988         case BRCMS_PROT_N_CFG:
3989                 wlc->protection->n_cfg = (s8) val;
3990                 break;
3991         case BRCMS_PROT_N_CFG_OVR:
3992                 wlc->protection->n_cfg_override = (s8) val;
3993                 break;
3994         case BRCMS_PROT_N_NONGF:
3995                 wlc->protection->nongf = (bool) val;
3996                 break;
3997         case BRCMS_PROT_N_NONGF_OVR:
3998                 wlc->protection->nongf_override = (s8) val;
3999                 break;
4000         case BRCMS_PROT_N_PAM_OVR:
4001                 wlc->protection->n_pam_override = (s8) val;
4002                 break;
4003         case BRCMS_PROT_N_OBSS:
4004                 wlc->protection->n_obss = (bool) val;
4005                 break;
4006
4007         default:
4008                 break;
4009         }
4010
4011 }
4012
4013 static void brcms_c_ht_update_sgi_rx(struct brcms_c_info *wlc, int val)
4014 {
4015         if (wlc->pub->up) {
4016                 brcms_c_update_beacon(wlc);
4017                 brcms_c_update_probe_resp(wlc, true);
4018         }
4019 }
4020
4021 static void brcms_c_ht_update_ldpc(struct brcms_c_info *wlc, s8 val)
4022 {
4023         wlc->stf->ldpc = val;
4024
4025         if (wlc->pub->up) {
4026                 brcms_c_update_beacon(wlc);
4027                 brcms_c_update_probe_resp(wlc, true);
4028                 wlc_phy_ldpc_override_set(wlc->band->pi, (val ? true : false));
4029         }
4030 }
4031
4032 void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
4033                        const struct ieee80211_tx_queue_params *params,
4034                        bool suspend)
4035 {
4036         int i;
4037         struct shm_acparams acp_shm;
4038         u16 *shm_entry;
4039
4040         /* Only apply params if the core is out of reset and has clocks */
4041         if (!wlc->clk) {
4042                 brcms_err(wlc->hw->d11core, "wl%d: %s : no-clock\n",
4043                           wlc->pub->unit, __func__);
4044                 return;
4045         }
4046
4047         memset(&acp_shm, 0, sizeof(struct shm_acparams));
4048         /* fill in shm ac params struct */
4049         acp_shm.txop = params->txop;
4050         /* convert from units of 32us to us for ucode */
4051         wlc->edcf_txop[aci & 0x3] = acp_shm.txop =
4052             EDCF_TXOP2USEC(acp_shm.txop);
4053         acp_shm.aifs = (params->aifs & EDCF_AIFSN_MASK);
4054
4055         if (aci == IEEE80211_AC_VI && acp_shm.txop == 0
4056             && acp_shm.aifs < EDCF_AIFSN_MAX)
4057                 acp_shm.aifs++;
4058
4059         if (acp_shm.aifs < EDCF_AIFSN_MIN
4060             || acp_shm.aifs > EDCF_AIFSN_MAX) {
4061                 brcms_err(wlc->hw->d11core, "wl%d: edcf_setparams: bad "
4062                           "aifs %d\n", wlc->pub->unit, acp_shm.aifs);
4063         } else {
4064                 acp_shm.cwmin = params->cw_min;
4065                 acp_shm.cwmax = params->cw_max;
4066                 acp_shm.cwcur = acp_shm.cwmin;
4067                 acp_shm.bslots =
4068                         bcma_read16(wlc->hw->d11core, D11REGOFFS(tsf_random)) &
4069                         acp_shm.cwcur;
4070                 acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
4071                 /* Indicate the new params to the ucode */
4072                 acp_shm.status = brcms_b_read_shm(wlc->hw, (M_EDCF_QINFO +
4073                                                   wme_ac2fifo[aci] *
4074                                                   M_EDCF_QLEN +
4075                                                   M_EDCF_STATUS_OFF));
4076                 acp_shm.status |= WME_STATUS_NEWAC;
4077
4078                 /* Fill in shm acparam table */
4079                 shm_entry = (u16 *) &acp_shm;
4080                 for (i = 0; i < (int)sizeof(struct shm_acparams); i += 2)
4081                         brcms_b_write_shm(wlc->hw,
4082                                           M_EDCF_QINFO +
4083                                           wme_ac2fifo[aci] * M_EDCF_QLEN + i,
4084                                           *shm_entry++);
4085         }
4086
4087         if (suspend) {
4088                 brcms_c_suspend_mac_and_wait(wlc);
4089                 brcms_c_enable_mac(wlc);
4090         }
4091 }
4092
4093 static void brcms_c_edcf_setparams(struct brcms_c_info *wlc, bool suspend)
4094 {
4095         u16 aci;
4096         int i_ac;
4097         struct ieee80211_tx_queue_params txq_pars;
4098         static const struct edcf_acparam default_edcf_acparams[] = {
4099                  {EDCF_AC_BE_ACI_STA, EDCF_AC_BE_ECW_STA, EDCF_AC_BE_TXOP_STA},
4100                  {EDCF_AC_BK_ACI_STA, EDCF_AC_BK_ECW_STA, EDCF_AC_BK_TXOP_STA},
4101                  {EDCF_AC_VI_ACI_STA, EDCF_AC_VI_ECW_STA, EDCF_AC_VI_TXOP_STA},
4102                  {EDCF_AC_VO_ACI_STA, EDCF_AC_VO_ECW_STA, EDCF_AC_VO_TXOP_STA}
4103         }; /* ucode needs these parameters during its initialization */
4104         const struct edcf_acparam *edcf_acp = &default_edcf_acparams[0];
4105
4106         for (i_ac = 0; i_ac < IEEE80211_NUM_ACS; i_ac++, edcf_acp++) {
4107                 /* find out which ac this set of params applies to */
4108                 aci = (edcf_acp->ACI & EDCF_ACI_MASK) >> EDCF_ACI_SHIFT;
4109
4110                 /* fill in shm ac params struct */
4111                 txq_pars.txop = edcf_acp->TXOP;
4112                 txq_pars.aifs = edcf_acp->ACI;
4113
4114                 /* CWmin = 2^(ECWmin) - 1 */
4115                 txq_pars.cw_min = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
4116                 /* CWmax = 2^(ECWmax) - 1 */
4117                 txq_pars.cw_max = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
4118                                             >> EDCF_ECWMAX_SHIFT);
4119                 brcms_c_wme_setparams(wlc, aci, &txq_pars, suspend);
4120         }
4121
4122         if (suspend) {
4123                 brcms_c_suspend_mac_and_wait(wlc);
4124                 brcms_c_enable_mac(wlc);
4125         }
4126 }
4127
4128 static void brcms_c_radio_monitor_start(struct brcms_c_info *wlc)
4129 {
4130         /* Don't start the timer if HWRADIO feature is disabled */
4131         if (wlc->radio_monitor)
4132                 return;
4133
4134         wlc->radio_monitor = true;
4135         brcms_b_pllreq(wlc->hw, true, BRCMS_PLLREQ_RADIO_MON);
4136         brcms_add_timer(wlc->radio_timer, TIMER_INTERVAL_RADIOCHK, true);
4137 }
4138
4139 static bool brcms_c_radio_monitor_stop(struct brcms_c_info *wlc)
4140 {
4141         if (!wlc->radio_monitor)
4142                 return true;
4143
4144         wlc->radio_monitor = false;
4145         brcms_b_pllreq(wlc->hw, false, BRCMS_PLLREQ_RADIO_MON);
4146         return brcms_del_timer(wlc->radio_timer);
4147 }
4148
4149 /* read hwdisable state and propagate to wlc flag */
4150 static void brcms_c_radio_hwdisable_upd(struct brcms_c_info *wlc)
4151 {
4152         if (wlc->pub->hw_off)
4153                 return;
4154
4155         if (brcms_b_radio_read_hwdisabled(wlc->hw))
4156                 mboolset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4157         else
4158                 mboolclr(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4159 }
4160
4161 /* update hwradio status and return it */
4162 bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc)
4163 {
4164         brcms_c_radio_hwdisable_upd(wlc);
4165
4166         return mboolisset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE) ?
4167                         true : false;
4168 }
4169
4170 /* periodical query hw radio button while driver is "down" */
4171 static void brcms_c_radio_timer(void *arg)
4172 {
4173         struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4174
4175         if (brcms_deviceremoved(wlc)) {
4176                 brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4177                           wlc->pub->unit, __func__);
4178                 brcms_down(wlc->wl);
4179                 return;
4180         }
4181
4182         brcms_c_radio_hwdisable_upd(wlc);
4183 }
4184
4185 /* common low-level watchdog code */
4186 static void brcms_b_watchdog(struct brcms_c_info *wlc)
4187 {
4188         struct brcms_hardware *wlc_hw = wlc->hw;
4189
4190         if (!wlc_hw->up)
4191                 return;
4192
4193         /* increment second count */
4194         wlc_hw->now++;
4195
4196         /* Check for FIFO error interrupts */
4197         brcms_b_fifoerrors(wlc_hw);
4198
4199         /* make sure RX dma has buffers */
4200         dma_rxfill(wlc->hw->di[RX_FIFO]);
4201
4202         wlc_phy_watchdog(wlc_hw->band->pi);
4203 }
4204
4205 /* common watchdog code */
4206 static void brcms_c_watchdog(struct brcms_c_info *wlc)
4207 {
4208         brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
4209
4210         if (!wlc->pub->up)
4211                 return;
4212
4213         if (brcms_deviceremoved(wlc)) {
4214                 brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4215                           wlc->pub->unit, __func__);
4216                 brcms_down(wlc->wl);
4217                 return;
4218         }
4219
4220         /* increment second count */
4221         wlc->pub->now++;
4222
4223         brcms_c_radio_hwdisable_upd(wlc);
4224         /* if radio is disable, driver may be down, quit here */
4225         if (wlc->pub->radio_disabled)
4226                 return;
4227
4228         brcms_b_watchdog(wlc);
4229
4230         /*
4231          * occasionally sample mac stat counters to
4232          * detect 16-bit counter wrap
4233          */
4234         if ((wlc->pub->now % SW_TIMER_MAC_STAT_UPD) == 0)
4235                 brcms_c_statsupd(wlc);
4236
4237         if (BRCMS_ISNPHY(wlc->band) &&
4238             ((wlc->pub->now - wlc->tempsense_lasttime) >=
4239              BRCMS_TEMPSENSE_PERIOD)) {
4240                 wlc->tempsense_lasttime = wlc->pub->now;
4241                 brcms_c_tempsense_upd(wlc);
4242         }
4243 }
4244
4245 static void brcms_c_watchdog_by_timer(void *arg)
4246 {
4247         struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4248
4249         brcms_c_watchdog(wlc);
4250 }
4251
4252 static bool brcms_c_timers_init(struct brcms_c_info *wlc, int unit)
4253 {
4254         wlc->wdtimer = brcms_init_timer(wlc->wl, brcms_c_watchdog_by_timer,
4255                 wlc, "watchdog");
4256         if (!wlc->wdtimer) {
4257                 wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for wdtimer "
4258                           "failed\n", unit);
4259                 goto fail;
4260         }
4261
4262         wlc->radio_timer = brcms_init_timer(wlc->wl, brcms_c_radio_timer,
4263                 wlc, "radio");
4264         if (!wlc->radio_timer) {
4265                 wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for radio_timer "
4266                           "failed\n", unit);
4267                 goto fail;
4268         }
4269
4270         return true;
4271
4272  fail:
4273         return false;
4274 }
4275
4276 /*
4277  * Initialize brcms_c_info default values ...
4278  * may get overrides later in this function
4279  */
4280 static void brcms_c_info_init(struct brcms_c_info *wlc, int unit)
4281 {
4282         int i;
4283
4284         /* Save our copy of the chanspec */
4285         wlc->chanspec = ch20mhz_chspec(1);
4286
4287         /* various 802.11g modes */
4288         wlc->shortslot = false;
4289         wlc->shortslot_override = BRCMS_SHORTSLOT_AUTO;
4290
4291         brcms_c_protection_upd(wlc, BRCMS_PROT_G_OVR, BRCMS_PROTECTION_AUTO);
4292         brcms_c_protection_upd(wlc, BRCMS_PROT_G_SPEC, false);
4293
4294         brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG_OVR,
4295                                BRCMS_PROTECTION_AUTO);
4296         brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG, BRCMS_N_PROTECTION_OFF);
4297         brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF_OVR,
4298                                BRCMS_PROTECTION_AUTO);
4299         brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF, false);
4300         brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, AUTO);
4301
4302         brcms_c_protection_upd(wlc, BRCMS_PROT_OVERLAP,
4303                                BRCMS_PROTECTION_CTL_OVERLAP);
4304
4305         /* 802.11g draft 4.0 NonERP elt advertisement */
4306         wlc->include_legacy_erp = true;
4307
4308         wlc->stf->ant_rx_ovr = ANT_RX_DIV_DEF;
4309         wlc->stf->txant = ANT_TX_DEF;
4310
4311         wlc->prb_resp_timeout = BRCMS_PRB_RESP_TIMEOUT;
4312
4313         wlc->usr_fragthresh = DOT11_DEFAULT_FRAG_LEN;
4314         for (i = 0; i < NFIFO; i++)
4315                 wlc->fragthresh[i] = DOT11_DEFAULT_FRAG_LEN;
4316         wlc->RTSThresh = DOT11_DEFAULT_RTS_LEN;
4317
4318         /* default rate fallback retry limits */
4319         wlc->SFBL = RETRY_SHORT_FB;
4320         wlc->LFBL = RETRY_LONG_FB;
4321
4322         /* default mac retry limits */
4323         wlc->SRL = RETRY_SHORT_DEF;
4324         wlc->LRL = RETRY_LONG_DEF;
4325
4326         /* WME QoS mode is Auto by default */
4327         wlc->pub->_ampdu = AMPDU_AGG_HOST;
4328 }
4329
4330 static uint brcms_c_attach_module(struct brcms_c_info *wlc)
4331 {
4332         uint err = 0;
4333         uint unit;
4334         unit = wlc->pub->unit;
4335
4336         wlc->asi = brcms_c_antsel_attach(wlc);
4337         if (wlc->asi == NULL) {
4338                 wiphy_err(wlc->wiphy, "wl%d: attach: antsel_attach "
4339                           "failed\n", unit);
4340                 err = 44;
4341                 goto fail;
4342         }
4343
4344         wlc->ampdu = brcms_c_ampdu_attach(wlc);
4345         if (wlc->ampdu == NULL) {
4346                 wiphy_err(wlc->wiphy, "wl%d: attach: ampdu_attach "
4347                           "failed\n", unit);
4348                 err = 50;
4349                 goto fail;
4350         }
4351
4352         if ((brcms_c_stf_attach(wlc) != 0)) {
4353                 wiphy_err(wlc->wiphy, "wl%d: attach: stf_attach "
4354                           "failed\n", unit);
4355                 err = 68;
4356                 goto fail;
4357         }
4358  fail:
4359         return err;
4360 }
4361
4362 struct brcms_pub *brcms_c_pub(struct brcms_c_info *wlc)
4363 {
4364         return wlc->pub;
4365 }
4366
4367 /* low level attach
4368  *    run backplane attach, init nvram
4369  *    run phy attach
4370  *    initialize software state for each core and band
4371  *    put the whole chip in reset(driver down state), no clock
4372  */
4373 static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
4374                           uint unit, bool piomode)
4375 {
4376         struct brcms_hardware *wlc_hw;
4377         uint err = 0;
4378         uint j;
4379         bool wme = false;
4380         struct shared_phy_params sha_params;
4381         struct wiphy *wiphy = wlc->wiphy;
4382         struct pci_dev *pcidev = core->bus->host_pci;
4383         struct ssb_sprom *sprom = &core->bus->sprom;
4384
4385         if (core->bus->hosttype == BCMA_HOSTTYPE_PCI)
4386                 brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4387                                pcidev->vendor,
4388                                pcidev->device);
4389         else
4390                 brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4391                                core->bus->boardinfo.vendor,
4392                                core->bus->boardinfo.type);
4393
4394         wme = true;
4395
4396         wlc_hw = wlc->hw;
4397         wlc_hw->wlc = wlc;
4398         wlc_hw->unit = unit;
4399         wlc_hw->band = wlc_hw->bandstate[0];
4400         wlc_hw->_piomode = piomode;
4401
4402         /* populate struct brcms_hardware with default values  */
4403         brcms_b_info_init(wlc_hw);
4404
4405         /*
4406          * Do the hardware portion of the attach. Also initialize software
4407          * state that depends on the particular hardware we are running.
4408          */
4409         wlc_hw->sih = ai_attach(core->bus);
4410         if (wlc_hw->sih == NULL) {
4411                 wiphy_err(wiphy, "wl%d: brcms_b_attach: si_attach failed\n",
4412                           unit);
4413                 err = 11;
4414                 goto fail;
4415         }
4416
4417         /* verify again the device is supported */
4418         if (!brcms_c_chipmatch(core)) {
4419                 wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported device\n",
4420                          unit);
4421                 err = 12;
4422                 goto fail;
4423         }
4424
4425         if (core->bus->hosttype == BCMA_HOSTTYPE_PCI) {
4426                 wlc_hw->vendorid = pcidev->vendor;
4427                 wlc_hw->deviceid = pcidev->device;
4428         } else {
4429                 wlc_hw->vendorid = core->bus->boardinfo.vendor;
4430                 wlc_hw->deviceid = core->bus->boardinfo.type;
4431         }
4432
4433         wlc_hw->d11core = core;
4434         wlc_hw->corerev = core->id.rev;
4435
4436         /* validate chip, chiprev and corerev */
4437         if (!brcms_c_isgoodchip(wlc_hw)) {
4438                 err = 13;
4439                 goto fail;
4440         }
4441
4442         /* initialize power control registers */
4443         ai_clkctl_init(wlc_hw->sih);
4444
4445         /* request fastclock and force fastclock for the rest of attach
4446          * bring the d11 core out of reset.
4447          *   For PMU chips, the first wlc_clkctl_clk is no-op since core-clk
4448          *   is still false; But it will be called again inside wlc_corereset,
4449          *   after d11 is out of reset.
4450          */
4451         brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4452         brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4453
4454         if (!brcms_b_validate_chip_access(wlc_hw)) {
4455                 wiphy_err(wiphy, "wl%d: brcms_b_attach: validate_chip_access "
4456                         "failed\n", unit);
4457                 err = 14;
4458                 goto fail;
4459         }
4460
4461         /* get the board rev, used just below */
4462         j = sprom->board_rev;
4463         /* promote srom boardrev of 0xFF to 1 */
4464         if (j == BOARDREV_PROMOTABLE)
4465                 j = BOARDREV_PROMOTED;
4466         wlc_hw->boardrev = (u16) j;
4467         if (!brcms_c_validboardtype(wlc_hw)) {
4468                 wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported Broadcom "
4469                           "board type (0x%x)" " or revision level (0x%x)\n",
4470                           unit, ai_get_boardtype(wlc_hw->sih),
4471                           wlc_hw->boardrev);
4472                 err = 15;
4473                 goto fail;
4474         }
4475         wlc_hw->sromrev = sprom->revision;
4476         wlc_hw->boardflags = sprom->boardflags_lo + (sprom->boardflags_hi << 16);
4477         wlc_hw->boardflags2 = sprom->boardflags2_lo + (sprom->boardflags2_hi << 16);
4478
4479         if (wlc_hw->boardflags & BFL_NOPLLDOWN)
4480                 brcms_b_pllreq(wlc_hw, true, BRCMS_PLLREQ_SHARED);
4481
4482         /* check device id(srom, nvram etc.) to set bands */
4483         if (wlc_hw->deviceid == BCM43224_D11N_ID ||
4484             wlc_hw->deviceid == BCM43224_D11N_ID_VEN1 ||
4485             wlc_hw->deviceid == BCM43224_CHIP_ID)
4486                 /* Dualband boards */
4487                 wlc_hw->_nbands = 2;
4488         else
4489                 wlc_hw->_nbands = 1;
4490
4491         if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225))
4492                 wlc_hw->_nbands = 1;
4493
4494         /* BMAC_NOTE: remove init of pub values when brcms_c_attach()
4495          * unconditionally does the init of these values
4496          */
4497         wlc->vendorid = wlc_hw->vendorid;
4498         wlc->deviceid = wlc_hw->deviceid;
4499         wlc->pub->sih = wlc_hw->sih;
4500         wlc->pub->corerev = wlc_hw->corerev;
4501         wlc->pub->sromrev = wlc_hw->sromrev;
4502         wlc->pub->boardrev = wlc_hw->boardrev;
4503         wlc->pub->boardflags = wlc_hw->boardflags;
4504         wlc->pub->boardflags2 = wlc_hw->boardflags2;
4505         wlc->pub->_nbands = wlc_hw->_nbands;
4506
4507         wlc_hw->physhim = wlc_phy_shim_attach(wlc_hw, wlc->wl, wlc);
4508
4509         if (wlc_hw->physhim == NULL) {
4510                 wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_shim_attach "
4511                         "failed\n", unit);
4512                 err = 25;
4513                 goto fail;
4514         }
4515
4516         /* pass all the parameters to wlc_phy_shared_attach in one struct */
4517         sha_params.sih = wlc_hw->sih;
4518         sha_params.physhim = wlc_hw->physhim;
4519         sha_params.unit = unit;
4520         sha_params.corerev = wlc_hw->corerev;
4521         sha_params.vid = wlc_hw->vendorid;
4522         sha_params.did = wlc_hw->deviceid;
4523         sha_params.chip = ai_get_chip_id(wlc_hw->sih);
4524         sha_params.chiprev = ai_get_chiprev(wlc_hw->sih);
4525         sha_params.chippkg = ai_get_chippkg(wlc_hw->sih);
4526         sha_params.sromrev = wlc_hw->sromrev;
4527         sha_params.boardtype = ai_get_boardtype(wlc_hw->sih);
4528         sha_params.boardrev = wlc_hw->boardrev;
4529         sha_params.boardflags = wlc_hw->boardflags;
4530         sha_params.boardflags2 = wlc_hw->boardflags2;
4531
4532         /* alloc and save pointer to shared phy state area */
4533         wlc_hw->phy_sh = wlc_phy_shared_attach(&sha_params);
4534         if (!wlc_hw->phy_sh) {
4535                 err = 16;
4536                 goto fail;
4537         }
4538
4539         /* initialize software state for each core and band */
4540         for (j = 0; j < wlc_hw->_nbands; j++) {
4541                 /*
4542                  * band0 is always 2.4Ghz
4543                  * band1, if present, is 5Ghz
4544                  */
4545
4546                 brcms_c_setxband(wlc_hw, j);
4547
4548                 wlc_hw->band->bandunit = j;
4549                 wlc_hw->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4550                 wlc->band->bandunit = j;
4551                 wlc->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4552                 wlc->core->coreidx = core->core_index;
4553
4554                 wlc_hw->machwcap = bcma_read32(core, D11REGOFFS(machwcap));
4555                 wlc_hw->machwcap_backup = wlc_hw->machwcap;
4556
4557                 /* init tx fifo size */
4558                 WARN_ON((wlc_hw->corerev - XMTFIFOTBL_STARTREV) < 0 ||
4559                         (wlc_hw->corerev - XMTFIFOTBL_STARTREV) >
4560                                 ARRAY_SIZE(xmtfifo_sz));
4561                 wlc_hw->xmtfifo_sz =
4562                     xmtfifo_sz[(wlc_hw->corerev - XMTFIFOTBL_STARTREV)];
4563                 WARN_ON(!wlc_hw->xmtfifo_sz[0]);
4564
4565                 /* Get a phy for this band */
4566                 wlc_hw->band->pi =
4567                         wlc_phy_attach(wlc_hw->phy_sh, core,
4568                                        wlc_hw->band->bandtype,
4569                                        wlc->wiphy);
4570                 if (wlc_hw->band->pi == NULL) {
4571                         wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_"
4572                                   "attach failed\n", unit);
4573                         err = 17;
4574                         goto fail;
4575                 }
4576
4577                 wlc_phy_machwcap_set(wlc_hw->band->pi, wlc_hw->machwcap);
4578
4579                 wlc_phy_get_phyversion(wlc_hw->band->pi, &wlc_hw->band->phytype,
4580                                        &wlc_hw->band->phyrev,
4581                                        &wlc_hw->band->radioid,
4582                                        &wlc_hw->band->radiorev);
4583                 wlc_hw->band->abgphy_encore =
4584                     wlc_phy_get_encore(wlc_hw->band->pi);
4585                 wlc->band->abgphy_encore = wlc_phy_get_encore(wlc_hw->band->pi);
4586                 wlc_hw->band->core_flags =
4587                     wlc_phy_get_coreflags(wlc_hw->band->pi);
4588
4589                 /* verify good phy_type & supported phy revision */
4590                 if (BRCMS_ISNPHY(wlc_hw->band)) {
4591                         if (NCONF_HAS(wlc_hw->band->phyrev))
4592                                 goto good_phy;
4593                         else
4594                                 goto bad_phy;
4595                 } else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
4596                         if (LCNCONF_HAS(wlc_hw->band->phyrev))
4597                                 goto good_phy;
4598                         else
4599                                 goto bad_phy;
4600                 } else {
4601  bad_phy:
4602                         wiphy_err(wiphy, "wl%d: brcms_b_attach: unsupported "
4603                                   "phy type/rev (%d/%d)\n", unit,
4604                                   wlc_hw->band->phytype, wlc_hw->band->phyrev);
4605                         err = 18;
4606                         goto fail;
4607                 }
4608
4609  good_phy:
4610                 /*
4611                  * BMAC_NOTE: wlc->band->pi should not be set below and should
4612                  * be done in the high level attach. However we can not make
4613                  * that change until all low level access is changed to
4614                  * wlc_hw->band->pi. Instead do the wlc->band->pi init below,
4615                  * keeping wlc_hw->band->pi as well for incremental update of
4616                  * low level fns, and cut over low only init when all fns
4617                  * updated.
4618                  */
4619                 wlc->band->pi = wlc_hw->band->pi;
4620                 wlc->band->phytype = wlc_hw->band->phytype;
4621                 wlc->band->phyrev = wlc_hw->band->phyrev;
4622                 wlc->band->radioid = wlc_hw->band->radioid;
4623                 wlc->band->radiorev = wlc_hw->band->radiorev;
4624
4625                 /* default contention windows size limits */
4626                 wlc_hw->band->CWmin = APHY_CWMIN;
4627                 wlc_hw->band->CWmax = PHY_CWMAX;
4628
4629                 if (!brcms_b_attach_dmapio(wlc, j, wme)) {
4630                         err = 19;
4631                         goto fail;
4632                 }
4633         }
4634
4635         /* disable core to match driver "down" state */
4636         brcms_c_coredisable(wlc_hw);
4637
4638         /* Match driver "down" state */
4639         ai_pci_down(wlc_hw->sih);
4640
4641         /* turn off pll and xtal to match driver "down" state */
4642         brcms_b_xtal(wlc_hw, OFF);
4643
4644         /* *******************************************************************
4645          * The hardware is in the DOWN state at this point. D11 core
4646          * or cores are in reset with clocks off, and the board PLLs
4647          * are off if possible.
4648          *
4649          * Beyond this point, wlc->sbclk == false and chip registers
4650          * should not be touched.
4651          *********************************************************************
4652          */
4653
4654         /* init etheraddr state variables */
4655         brcms_c_get_macaddr(wlc_hw, wlc_hw->etheraddr);
4656
4657         if (is_broadcast_ether_addr(wlc_hw->etheraddr) ||
4658             is_zero_ether_addr(wlc_hw->etheraddr)) {
4659                 wiphy_err(wiphy, "wl%d: brcms_b_attach: bad macaddr\n",
4660                           unit);
4661                 err = 22;
4662                 goto fail;
4663         }
4664
4665         brcms_dbg_info(wlc_hw->d11core, "deviceid 0x%x nbands %d board 0x%x\n",
4666                        wlc_hw->deviceid, wlc_hw->_nbands,
4667                        ai_get_boardtype(wlc_hw->sih));
4668
4669         return err;
4670
4671  fail:
4672         wiphy_err(wiphy, "wl%d: brcms_b_attach: failed with err %d\n", unit,
4673                   err);
4674         return err;
4675 }
4676
4677 static void brcms_c_attach_antgain_init(struct brcms_c_info *wlc)
4678 {
4679         uint unit;
4680         unit = wlc->pub->unit;
4681
4682         if ((wlc->band->antgain == -1) && (wlc->pub->sromrev == 1)) {
4683                 /* default antenna gain for srom rev 1 is 2 dBm (8 qdbm) */
4684                 wlc->band->antgain = 8;
4685         } else if (wlc->band->antgain == -1) {
4686                 wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
4687                           " srom, using 2dB\n", unit, __func__);
4688                 wlc->band->antgain = 8;
4689         } else {
4690                 s8 gain, fract;
4691                 /* Older sroms specified gain in whole dbm only.  In order
4692                  * be able to specify qdbm granularity and remain backward
4693                  * compatible the whole dbms are now encoded in only
4694                  * low 6 bits and remaining qdbms are encoded in the hi 2 bits.
4695                  * 6 bit signed number ranges from -32 - 31.
4696                  *
4697                  * Examples:
4698                  * 0x1 = 1 db,
4699                  * 0xc1 = 1.75 db (1 + 3 quarters),
4700                  * 0x3f = -1 (-1 + 0 quarters),
4701                  * 0x7f = -.75 (-1 + 1 quarters) = -3 qdbm.
4702                  * 0xbf = -.50 (-1 + 2 quarters) = -2 qdbm.
4703                  */
4704                 gain = wlc->band->antgain & 0x3f;
4705                 gain <<= 2;     /* Sign extend */
4706                 gain >>= 2;
4707                 fract = (wlc->band->antgain & 0xc0) >> 6;
4708                 wlc->band->antgain = 4 * gain + fract;
4709         }
4710 }
4711
4712 static bool brcms_c_attach_stf_ant_init(struct brcms_c_info *wlc)
4713 {
4714         int aa;
4715         uint unit;
4716         int bandtype;
4717         struct ssb_sprom *sprom = &wlc->hw->d11core->bus->sprom;
4718
4719         unit = wlc->pub->unit;
4720         bandtype = wlc->band->bandtype;
4721
4722         /* get antennas available */
4723         if (bandtype == BRCM_BAND_5G)
4724                 aa = sprom->ant_available_a;
4725         else
4726                 aa = sprom->ant_available_bg;
4727
4728         if ((aa < 1) || (aa > 15)) {
4729                 wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
4730                           " srom (0x%x), using 3\n", unit, __func__, aa);
4731                 aa = 3;
4732         }
4733
4734         /* reset the defaults if we have a single antenna */
4735         if (aa == 1) {
4736                 wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_0;
4737                 wlc->stf->txant = ANT_TX_FORCE_0;
4738         } else if (aa == 2) {
4739                 wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_1;
4740                 wlc->stf->txant = ANT_TX_FORCE_1;
4741         } else {
4742         }
4743
4744         /* Compute Antenna Gain */
4745         if (bandtype == BRCM_BAND_5G)
4746                 wlc->band->antgain = sprom->antenna_gain.a1;
4747         else
4748                 wlc->band->antgain = sprom->antenna_gain.a0;
4749
4750         brcms_c_attach_antgain_init(wlc);
4751
4752         return true;
4753 }
4754
4755 static void brcms_c_bss_default_init(struct brcms_c_info *wlc)
4756 {
4757         u16 chanspec;
4758         struct brcms_band *band;
4759         struct brcms_bss_info *bi = wlc->default_bss;
4760
4761         /* init default and target BSS with some sane initial values */
4762         memset(bi, 0, sizeof(*bi));
4763         bi->beacon_period = BEACON_INTERVAL_DEFAULT;
4764
4765         /* fill the default channel as the first valid channel
4766          * starting from the 2G channels
4767          */
4768         chanspec = ch20mhz_chspec(1);
4769         wlc->home_chanspec = bi->chanspec = chanspec;
4770
4771         /* find the band of our default channel */
4772         band = wlc->band;
4773         if (wlc->pub->_nbands > 1 &&
4774             band->bandunit != chspec_bandunit(chanspec))
4775                 band = wlc->bandstate[OTHERBANDUNIT(wlc)];
4776
4777         /* init bss rates to the band specific default rate set */
4778         brcms_c_rateset_default(&bi->rateset, NULL, band->phytype,
4779                 band->bandtype, false, BRCMS_RATE_MASK_FULL,
4780                 (bool) (wlc->pub->_n_enab & SUPPORT_11N),
4781                 brcms_chspec_bw(chanspec), wlc->stf->txstreams);
4782
4783         if (wlc->pub->_n_enab & SUPPORT_11N)
4784                 bi->flags |= BRCMS_BSS_HT;
4785 }
4786
4787 static void brcms_c_update_mimo_band_bwcap(struct brcms_c_info *wlc, u8 bwcap)
4788 {
4789         uint i;
4790         struct brcms_band *band;
4791
4792         for (i = 0; i < wlc->pub->_nbands; i++) {
4793                 band = wlc->bandstate[i];
4794                 if (band->bandtype == BRCM_BAND_5G) {
4795                         if ((bwcap == BRCMS_N_BW_40ALL)
4796                             || (bwcap == BRCMS_N_BW_20IN2G_40IN5G))
4797                                 band->mimo_cap_40 = true;
4798                         else
4799                                 band->mimo_cap_40 = false;
4800                 } else {
4801                         if (bwcap == BRCMS_N_BW_40ALL)
4802                                 band->mimo_cap_40 = true;
4803                         else
4804                                 band->mimo_cap_40 = false;
4805                 }
4806         }
4807 }
4808
4809 static void brcms_c_timers_deinit(struct brcms_c_info *wlc)
4810 {
4811         /* free timer state */
4812         if (wlc->wdtimer) {
4813                 brcms_free_timer(wlc->wdtimer);
4814                 wlc->wdtimer = NULL;
4815         }
4816         if (wlc->radio_timer) {
4817                 brcms_free_timer(wlc->radio_timer);
4818                 wlc->radio_timer = NULL;
4819         }
4820 }
4821
4822 static void brcms_c_detach_module(struct brcms_c_info *wlc)
4823 {
4824         if (wlc->asi) {
4825                 brcms_c_antsel_detach(wlc->asi);
4826                 wlc->asi = NULL;
4827         }
4828
4829         if (wlc->ampdu) {
4830                 brcms_c_ampdu_detach(wlc->ampdu);
4831                 wlc->ampdu = NULL;
4832         }
4833
4834         brcms_c_stf_detach(wlc);
4835 }
4836
4837 /*
4838  * low level detach
4839  */
4840 static int brcms_b_detach(struct brcms_c_info *wlc)
4841 {
4842         uint i;
4843         struct brcms_hw_band *band;
4844         struct brcms_hardware *wlc_hw = wlc->hw;
4845         int callbacks;
4846
4847         callbacks = 0;
4848
4849         brcms_b_detach_dmapio(wlc_hw);
4850
4851         band = wlc_hw->band;
4852         for (i = 0; i < wlc_hw->_nbands; i++) {
4853                 if (band->pi) {
4854                         /* Detach this band's phy */
4855                         wlc_phy_detach(band->pi);
4856                         band->pi = NULL;
4857                 }
4858                 band = wlc_hw->bandstate[OTHERBANDUNIT(wlc)];
4859         }
4860
4861         /* Free shared phy state */
4862         kfree(wlc_hw->phy_sh);
4863
4864         wlc_phy_shim_detach(wlc_hw->physhim);
4865
4866         if (wlc_hw->sih) {
4867                 ai_detach(wlc_hw->sih);
4868                 wlc_hw->sih = NULL;
4869         }
4870
4871         return callbacks;
4872
4873 }
4874
4875 /*
4876  * Return a count of the number of driver callbacks still pending.
4877  *
4878  * General policy is that brcms_c_detach can only dealloc/free software states.
4879  * It can NOT touch hardware registers since the d11core may be in reset and
4880  * clock may not be available.
4881  * One exception is sb register access, which is possible if crystal is turned
4882  * on after "down" state, driver should avoid software timer with the exception
4883  * of radio_monitor.
4884  */
4885 uint brcms_c_detach(struct brcms_c_info *wlc)
4886 {
4887         uint callbacks = 0;
4888
4889         if (wlc == NULL)
4890                 return 0;
4891
4892         callbacks += brcms_b_detach(wlc);
4893
4894         /* delete software timers */
4895         if (!brcms_c_radio_monitor_stop(wlc))
4896                 callbacks++;
4897
4898         brcms_c_channel_mgr_detach(wlc->cmi);
4899
4900         brcms_c_timers_deinit(wlc);
4901
4902         brcms_c_detach_module(wlc);
4903
4904         brcms_c_detach_mfree(wlc);
4905         return callbacks;
4906 }
4907
4908 /* update state that depends on the current value of "ap" */
4909 static void brcms_c_ap_upd(struct brcms_c_info *wlc)
4910 {
4911         /* STA-BSS; short capable */
4912         wlc->PLCPHdr_override = BRCMS_PLCP_SHORT;
4913 }
4914
4915 /* Initialize just the hardware when coming out of POR or S3/S5 system states */
4916 static void brcms_b_hw_up(struct brcms_hardware *wlc_hw)
4917 {
4918         if (wlc_hw->wlc->pub->hw_up)
4919                 return;
4920
4921         brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4922
4923         /*
4924          * Enable pll and xtal, initialize the power control registers,
4925          * and force fastclock for the remainder of brcms_c_up().
4926          */
4927         brcms_b_xtal(wlc_hw, ON);
4928         ai_clkctl_init(wlc_hw->sih);
4929         brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4930
4931         /*
4932          * TODO: test suspend/resume
4933          *
4934          * AI chip doesn't restore bar0win2 on
4935          * hibernation/resume, need sw fixup
4936          */
4937
4938         /*
4939          * Inform phy that a POR reset has occurred so
4940          * it does a complete phy init
4941          */
4942         wlc_phy_por_inform(wlc_hw->band->pi);
4943
4944         wlc_hw->ucode_loaded = false;
4945         wlc_hw->wlc->pub->hw_up = true;
4946
4947         if ((wlc_hw->boardflags & BFL_FEM)
4948             && (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
4949                 if (!
4950                     (wlc_hw->boardrev >= 0x1250
4951                      && (wlc_hw->boardflags & BFL_FEM_BT)))
4952                         ai_epa_4313war(wlc_hw->sih);
4953         }
4954 }
4955
4956 static int brcms_b_up_prep(struct brcms_hardware *wlc_hw)
4957 {
4958         brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4959
4960         /*
4961          * Enable pll and xtal, initialize the power control registers,
4962          * and force fastclock for the remainder of brcms_c_up().
4963          */
4964         brcms_b_xtal(wlc_hw, ON);
4965         ai_clkctl_init(wlc_hw->sih);
4966         brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4967
4968         /*
4969          * Configure pci/pcmcia here instead of in brcms_c_attach()
4970          * to allow mfg hotswap:  down, hotswap (chip power cycle), up.
4971          */
4972         bcma_core_pci_irq_ctl(&wlc_hw->d11core->bus->drv_pci[0], wlc_hw->d11core,
4973                               true);
4974
4975         /*
4976          * Need to read the hwradio status here to cover the case where the
4977          * system is loaded with the hw radio disabled. We do not want to
4978          * bring the driver up in this case.
4979          */
4980         if (brcms_b_radio_read_hwdisabled(wlc_hw)) {
4981                 /* put SB PCI in down state again */
4982                 ai_pci_down(wlc_hw->sih);
4983                 brcms_b_xtal(wlc_hw, OFF);
4984                 return -ENOMEDIUM;
4985         }
4986
4987         ai_pci_up(wlc_hw->sih);
4988
4989         /* reset the d11 core */
4990         brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4991
4992         return 0;
4993 }
4994
4995 static int brcms_b_up_finish(struct brcms_hardware *wlc_hw)
4996 {
4997         wlc_hw->up = true;
4998         wlc_phy_hw_state_upd(wlc_hw->band->pi, true);
4999
5000         /* FULLY enable dynamic power control and d11 core interrupt */
5001         brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
5002         brcms_intrson(wlc_hw->wlc->wl);
5003         return 0;
5004 }
5005
5006 /*
5007  * Write WME tunable parameters for retransmit/max rate
5008  * from wlc struct to ucode
5009  */
5010 static void brcms_c_wme_retries_write(struct brcms_c_info *wlc)
5011 {
5012         int ac;
5013
5014         /* Need clock to do this */
5015         if (!wlc->clk)
5016                 return;
5017
5018         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
5019                 brcms_b_write_shm(wlc->hw, M_AC_TXLMT_ADDR(ac),
5020                                   wlc->wme_retries[ac]);
5021 }
5022
5023 /* make interface operational */
5024 int brcms_c_up(struct brcms_c_info *wlc)
5025 {
5026         struct ieee80211_channel *ch;
5027
5028         brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5029
5030         /* HW is turned off so don't try to access it */
5031         if (wlc->pub->hw_off || brcms_deviceremoved(wlc))
5032                 return -ENOMEDIUM;
5033
5034         if (!wlc->pub->hw_up) {
5035                 brcms_b_hw_up(wlc->hw);
5036                 wlc->pub->hw_up = true;
5037         }
5038
5039         if ((wlc->pub->boardflags & BFL_FEM)
5040             && (ai_get_chip_id(wlc->hw->sih) == BCMA_CHIP_ID_BCM4313)) {
5041                 if (wlc->pub->boardrev >= 0x1250
5042                     && (wlc->pub->boardflags & BFL_FEM_BT))
5043                         brcms_b_mhf(wlc->hw, MHF5, MHF5_4313_GPIOCTRL,
5044                                 MHF5_4313_GPIOCTRL, BRCM_BAND_ALL);
5045                 else
5046                         brcms_b_mhf(wlc->hw, MHF4, MHF4_EXTPA_ENABLE,
5047                                     MHF4_EXTPA_ENABLE, BRCM_BAND_ALL);
5048         }
5049
5050         /*
5051          * Need to read the hwradio status here to cover the case where the
5052          * system is loaded with the hw radio disabled. We do not want to bring
5053          * the driver up in this case. If radio is disabled, abort up, lower
5054          * power, start radio timer and return 0(for NDIS) don't call
5055          * radio_update to avoid looping brcms_c_up.
5056          *
5057          * brcms_b_up_prep() returns either 0 or -BCME_RADIOOFF only
5058          */
5059         if (!wlc->pub->radio_disabled) {
5060                 int status = brcms_b_up_prep(wlc->hw);
5061                 if (status == -ENOMEDIUM) {
5062                         if (!mboolisset
5063                             (wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE)) {
5064                                 struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
5065                                 mboolset(wlc->pub->radio_disabled,
5066                                          WL_RADIO_HW_DISABLE);
5067                                 if (bsscfg->type == BRCMS_TYPE_STATION ||
5068                                     bsscfg->type == BRCMS_TYPE_ADHOC)
5069                                         brcms_err(wlc->hw->d11core,
5070                                                   "wl%d: up: rfdisable -> "
5071                                                   "bsscfg_disable()\n",
5072                                                    wlc->pub->unit);
5073                         }
5074                 }
5075         }
5076
5077         if (wlc->pub->radio_disabled) {
5078                 brcms_c_radio_monitor_start(wlc);
5079                 return 0;
5080         }
5081
5082         /* brcms_b_up_prep has done brcms_c_corereset(). so clk is on, set it */
5083         wlc->clk = true;
5084
5085         brcms_c_radio_monitor_stop(wlc);
5086
5087         /* Set EDCF hostflags */
5088         brcms_b_mhf(wlc->hw, MHF1, MHF1_EDCF, MHF1_EDCF, BRCM_BAND_ALL);
5089
5090         brcms_init(wlc->wl);
5091         wlc->pub->up = true;
5092
5093         if (wlc->bandinit_pending) {
5094                 ch = wlc->pub->ieee_hw->conf.channel;
5095                 brcms_c_suspend_mac_and_wait(wlc);
5096                 brcms_c_set_chanspec(wlc, ch20mhz_chspec(ch->hw_value));
5097                 wlc->bandinit_pending = false;
5098                 brcms_c_enable_mac(wlc);
5099         }
5100
5101         brcms_b_up_finish(wlc->hw);
5102
5103         /* Program the TX wme params with the current settings */
5104         brcms_c_wme_retries_write(wlc);
5105
5106         /* start one second watchdog timer */
5107         brcms_add_timer(wlc->wdtimer, TIMER_INTERVAL_WATCHDOG, true);
5108         wlc->WDarmed = true;
5109
5110         /* ensure antenna config is up to date */
5111         brcms_c_stf_phy_txant_upd(wlc);
5112         /* ensure LDPC config is in sync */
5113         brcms_c_ht_update_ldpc(wlc, wlc->stf->ldpc);
5114
5115         return 0;
5116 }
5117
5118 static uint brcms_c_down_del_timer(struct brcms_c_info *wlc)
5119 {
5120         uint callbacks = 0;
5121
5122         return callbacks;
5123 }
5124
5125 static int brcms_b_bmac_down_prep(struct brcms_hardware *wlc_hw)
5126 {
5127         bool dev_gone;
5128         uint callbacks = 0;
5129
5130         if (!wlc_hw->up)
5131                 return callbacks;
5132
5133         dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5134
5135         /* disable interrupts */
5136         if (dev_gone)
5137                 wlc_hw->wlc->macintmask = 0;
5138         else {
5139                 /* now disable interrupts */
5140                 brcms_intrsoff(wlc_hw->wlc->wl);
5141
5142                 /* ensure we're running on the pll clock again */
5143                 brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
5144         }
5145         /* down phy at the last of this stage */
5146         callbacks += wlc_phy_down(wlc_hw->band->pi);
5147
5148         return callbacks;
5149 }
5150
5151 static int brcms_b_down_finish(struct brcms_hardware *wlc_hw)
5152 {
5153         uint callbacks = 0;
5154         bool dev_gone;
5155
5156         if (!wlc_hw->up)
5157                 return callbacks;
5158
5159         wlc_hw->up = false;
5160         wlc_phy_hw_state_upd(wlc_hw->band->pi, false);
5161
5162         dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5163
5164         if (dev_gone) {
5165                 wlc_hw->sbclk = false;
5166                 wlc_hw->clk = false;
5167                 wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
5168
5169                 /* reclaim any posted packets */
5170                 brcms_c_flushqueues(wlc_hw->wlc);
5171         } else {
5172
5173                 /* Reset and disable the core */
5174                 if (bcma_core_is_enabled(wlc_hw->d11core)) {
5175                         if (bcma_read32(wlc_hw->d11core,
5176                                         D11REGOFFS(maccontrol)) & MCTL_EN_MAC)
5177                                 brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
5178                         callbacks += brcms_reset(wlc_hw->wlc->wl);
5179                         brcms_c_coredisable(wlc_hw);
5180                 }
5181
5182                 /* turn off primary xtal and pll */
5183                 if (!wlc_hw->noreset) {
5184                         ai_pci_down(wlc_hw->sih);
5185                         brcms_b_xtal(wlc_hw, OFF);
5186                 }
5187         }
5188
5189         return callbacks;
5190 }
5191
5192 /*
5193  * Mark the interface nonoperational, stop the software mechanisms,
5194  * disable the hardware, free any transient buffer state.
5195  * Return a count of the number of driver callbacks still pending.
5196  */
5197 uint brcms_c_down(struct brcms_c_info *wlc)
5198 {
5199
5200         uint callbacks = 0;
5201         int i;
5202         bool dev_gone = false;
5203
5204         brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5205
5206         /* check if we are already in the going down path */
5207         if (wlc->going_down) {
5208                 brcms_err(wlc->hw->d11core,
5209                           "wl%d: %s: Driver going down so return\n",
5210                           wlc->pub->unit, __func__);
5211                 return 0;
5212         }
5213         if (!wlc->pub->up)
5214                 return callbacks;
5215
5216         wlc->going_down = true;
5217
5218         callbacks += brcms_b_bmac_down_prep(wlc->hw);
5219
5220         dev_gone = brcms_deviceremoved(wlc);
5221
5222         /* Call any registered down handlers */
5223         for (i = 0; i < BRCMS_MAXMODULES; i++) {
5224                 if (wlc->modulecb[i].down_fn)
5225                         callbacks +=
5226                             wlc->modulecb[i].down_fn(wlc->modulecb[i].hdl);
5227         }
5228
5229         /* cancel the watchdog timer */
5230         if (wlc->WDarmed) {
5231                 if (!brcms_del_timer(wlc->wdtimer))
5232                         callbacks++;
5233                 wlc->WDarmed = false;
5234         }
5235         /* cancel all other timers */
5236         callbacks += brcms_c_down_del_timer(wlc);
5237
5238         wlc->pub->up = false;
5239
5240         wlc_phy_mute_upd(wlc->band->pi, false, PHY_MUTE_ALL);
5241
5242         callbacks += brcms_b_down_finish(wlc->hw);
5243
5244         /* brcms_b_down_finish has done brcms_c_coredisable(). so clk is off */
5245         wlc->clk = false;
5246
5247         wlc->going_down = false;
5248         return callbacks;
5249 }
5250
5251 /* Set the current gmode configuration */
5252 int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config)
5253 {
5254         int ret = 0;
5255         uint i;
5256         struct brcms_c_rateset rs;
5257         /* Default to 54g Auto */
5258         /* Advertise and use shortslot (-1/0/1 Auto/Off/On) */
5259         s8 shortslot = BRCMS_SHORTSLOT_AUTO;
5260         bool shortslot_restrict = false; /* Restrict association to stations
5261                                           * that support shortslot
5262                                           */
5263         bool ofdm_basic = false;        /* Make 6, 12, and 24 basic rates */
5264         /* Advertise and use short preambles (-1/0/1 Auto/Off/On) */
5265         int preamble = BRCMS_PLCP_LONG;
5266         bool preamble_restrict = false; /* Restrict association to stations
5267                                          * that support short preambles
5268                                          */
5269         struct brcms_band *band;
5270
5271         /* if N-support is enabled, allow Gmode set as long as requested
5272          * Gmode is not GMODE_LEGACY_B
5273          */
5274         if ((wlc->pub->_n_enab & SUPPORT_11N) && gmode == GMODE_LEGACY_B)
5275                 return -ENOTSUPP;
5276
5277         /* verify that we are dealing with 2G band and grab the band pointer */
5278         if (wlc->band->bandtype == BRCM_BAND_2G)
5279                 band = wlc->band;
5280         else if ((wlc->pub->_nbands > 1) &&
5281                  (wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype == BRCM_BAND_2G))
5282                 band = wlc->bandstate[OTHERBANDUNIT(wlc)];
5283         else
5284                 return -EINVAL;
5285
5286         /* update configuration value */
5287         if (config)
5288                 brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER, gmode);
5289
5290         /* Clear rateset override */
5291         memset(&rs, 0, sizeof(rs));
5292
5293         switch (gmode) {
5294         case GMODE_LEGACY_B:
5295                 shortslot = BRCMS_SHORTSLOT_OFF;
5296                 brcms_c_rateset_copy(&gphy_legacy_rates, &rs);
5297
5298                 break;
5299
5300         case GMODE_LRS:
5301                 break;
5302
5303         case GMODE_AUTO:
5304                 /* Accept defaults */
5305                 break;
5306
5307         case GMODE_ONLY:
5308                 ofdm_basic = true;
5309                 preamble = BRCMS_PLCP_SHORT;
5310                 preamble_restrict = true;
5311                 break;
5312
5313         case GMODE_PERFORMANCE:
5314                 shortslot = BRCMS_SHORTSLOT_ON;
5315                 shortslot_restrict = true;
5316                 ofdm_basic = true;
5317                 preamble = BRCMS_PLCP_SHORT;
5318                 preamble_restrict = true;
5319                 break;
5320
5321         default:
5322                 /* Error */
5323                 brcms_err(wlc->hw->d11core, "wl%d: %s: invalid gmode %d\n",
5324                           wlc->pub->unit, __func__, gmode);
5325                 return -ENOTSUPP;
5326         }
5327
5328         band->gmode = gmode;
5329
5330         wlc->shortslot_override = shortslot;
5331
5332         /* Use the default 11g rateset */
5333         if (!rs.count)
5334                 brcms_c_rateset_copy(&cck_ofdm_rates, &rs);
5335
5336         if (ofdm_basic) {
5337                 for (i = 0; i < rs.count; i++) {
5338                         if (rs.rates[i] == BRCM_RATE_6M
5339                             || rs.rates[i] == BRCM_RATE_12M
5340                             || rs.rates[i] == BRCM_RATE_24M)
5341                                 rs.rates[i] |= BRCMS_RATE_FLAG;
5342                 }
5343         }
5344
5345         /* Set default bss rateset */
5346         wlc->default_bss->rateset.count = rs.count;
5347         memcpy(wlc->default_bss->rateset.rates, rs.rates,
5348                sizeof(wlc->default_bss->rateset.rates));
5349
5350         return ret;
5351 }
5352
5353 int brcms_c_set_nmode(struct brcms_c_info *wlc)
5354 {
5355         uint i;
5356         s32 nmode = AUTO;
5357
5358         if (wlc->stf->txstreams == WL_11N_3x3)
5359                 nmode = WL_11N_3x3;
5360         else
5361                 nmode = WL_11N_2x2;
5362
5363         /* force GMODE_AUTO if NMODE is ON */
5364         brcms_c_set_gmode(wlc, GMODE_AUTO, true);
5365         if (nmode == WL_11N_3x3)
5366                 wlc->pub->_n_enab = SUPPORT_HT;
5367         else
5368                 wlc->pub->_n_enab = SUPPORT_11N;
5369         wlc->default_bss->flags |= BRCMS_BSS_HT;
5370         /* add the mcs rates to the default and hw ratesets */
5371         brcms_c_rateset_mcs_build(&wlc->default_bss->rateset,
5372                               wlc->stf->txstreams);
5373         for (i = 0; i < wlc->pub->_nbands; i++)
5374                 memcpy(wlc->bandstate[i]->hw_rateset.mcs,
5375                        wlc->default_bss->rateset.mcs, MCSSET_LEN);
5376
5377         return 0;
5378 }
5379
5380 static int
5381 brcms_c_set_internal_rateset(struct brcms_c_info *wlc,
5382                              struct brcms_c_rateset *rs_arg)
5383 {
5384         struct brcms_c_rateset rs, new;
5385         uint bandunit;
5386
5387         memcpy(&rs, rs_arg, sizeof(struct brcms_c_rateset));
5388
5389         /* check for bad count value */
5390         if ((rs.count == 0) || (rs.count > BRCMS_NUMRATES))
5391                 return -EINVAL;
5392
5393         /* try the current band */
5394         bandunit = wlc->band->bandunit;
5395         memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5396         if (brcms_c_rate_hwrs_filter_sort_validate
5397             (&new, &wlc->bandstate[bandunit]->hw_rateset, true,
5398              wlc->stf->txstreams))
5399                 goto good;
5400
5401         /* try the other band */
5402         if (brcms_is_mband_unlocked(wlc)) {
5403                 bandunit = OTHERBANDUNIT(wlc);
5404                 memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5405                 if (brcms_c_rate_hwrs_filter_sort_validate(&new,
5406                                                        &wlc->
5407                                                        bandstate[bandunit]->
5408                                                        hw_rateset, true,
5409                                                        wlc->stf->txstreams))
5410                         goto good;
5411         }
5412
5413         return -EBADE;
5414
5415  good:
5416         /* apply new rateset */
5417         memcpy(&wlc->default_bss->rateset, &new,
5418                sizeof(struct brcms_c_rateset));
5419         memcpy(&wlc->bandstate[bandunit]->defrateset, &new,
5420                sizeof(struct brcms_c_rateset));
5421         return 0;
5422 }
5423
5424 static void brcms_c_ofdm_rateset_war(struct brcms_c_info *wlc)
5425 {
5426         u8 r;
5427         bool war = false;
5428
5429         if (wlc->pub->associated)
5430                 r = wlc->bsscfg->current_bss->rateset.rates[0];
5431         else
5432                 r = wlc->default_bss->rateset.rates[0];
5433
5434         wlc_phy_ofdm_rateset_war(wlc->band->pi, war);
5435 }
5436
5437 int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel)
5438 {
5439         u16 chspec = ch20mhz_chspec(channel);
5440
5441         if (channel < 0 || channel > MAXCHANNEL)
5442                 return -EINVAL;
5443
5444         if (!brcms_c_valid_chanspec_db(wlc->cmi, chspec))
5445                 return -EINVAL;
5446
5447
5448         if (!wlc->pub->up && brcms_is_mband_unlocked(wlc)) {
5449                 if (wlc->band->bandunit != chspec_bandunit(chspec))
5450                         wlc->bandinit_pending = true;
5451                 else
5452                         wlc->bandinit_pending = false;
5453         }
5454
5455         wlc->default_bss->chanspec = chspec;
5456         /* brcms_c_BSSinit() will sanitize the rateset before
5457          * using it.. */
5458         if (wlc->pub->up && (wlc_phy_chanspec_get(wlc->band->pi) != chspec)) {
5459                 brcms_c_set_home_chanspec(wlc, chspec);
5460                 brcms_c_suspend_mac_and_wait(wlc);
5461                 brcms_c_set_chanspec(wlc, chspec);
5462                 brcms_c_enable_mac(wlc);
5463         }
5464         return 0;
5465 }
5466
5467 int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl)
5468 {
5469         int ac;
5470
5471         if (srl < 1 || srl > RETRY_SHORT_MAX ||
5472             lrl < 1 || lrl > RETRY_SHORT_MAX)
5473                 return -EINVAL;
5474
5475         wlc->SRL = srl;
5476         wlc->LRL = lrl;
5477
5478         brcms_b_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
5479
5480         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
5481                 wlc->wme_retries[ac] =  SFIELD(wlc->wme_retries[ac],
5482                                                EDCF_SHORT,  wlc->SRL);
5483                 wlc->wme_retries[ac] =  SFIELD(wlc->wme_retries[ac],
5484                                                EDCF_LONG, wlc->LRL);
5485         }
5486         brcms_c_wme_retries_write(wlc);
5487
5488         return 0;
5489 }
5490
5491 void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
5492                                  struct brcm_rateset *currs)
5493 {
5494         struct brcms_c_rateset *rs;
5495
5496         if (wlc->pub->associated)
5497                 rs = &wlc->bsscfg->current_bss->rateset;
5498         else
5499                 rs = &wlc->default_bss->rateset;
5500
5501         /* Copy only legacy rateset section */
5502         currs->count = rs->count;
5503         memcpy(&currs->rates, &rs->rates, rs->count);
5504 }
5505
5506 int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
5507 {
5508         struct brcms_c_rateset internal_rs;
5509         int bcmerror;
5510
5511         if (rs->count > BRCMS_NUMRATES)
5512                 return -ENOBUFS;
5513
5514         memset(&internal_rs, 0, sizeof(internal_rs));
5515
5516         /* Copy only legacy rateset section */
5517         internal_rs.count = rs->count;
5518         memcpy(&internal_rs.rates, &rs->rates, internal_rs.count);
5519
5520         /* merge rateset coming in with the current mcsset */
5521         if (wlc->pub->_n_enab & SUPPORT_11N) {
5522                 struct brcms_bss_info *mcsset_bss;
5523                 if (wlc->pub->associated)
5524                         mcsset_bss = wlc->bsscfg->current_bss;
5525                 else
5526                         mcsset_bss = wlc->default_bss;
5527                 memcpy(internal_rs.mcs, &mcsset_bss->rateset.mcs[0],
5528                        MCSSET_LEN);
5529         }
5530
5531         bcmerror = brcms_c_set_internal_rateset(wlc, &internal_rs);
5532         if (!bcmerror)
5533                 brcms_c_ofdm_rateset_war(wlc);
5534
5535         return bcmerror;
5536 }
5537
5538 static void brcms_c_time_lock(struct brcms_c_info *wlc)
5539 {
5540         bcma_set32(wlc->hw->d11core, D11REGOFFS(maccontrol), MCTL_TBTTHOLD);
5541         /* Commit the write */
5542         bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
5543 }
5544
5545 static void brcms_c_time_unlock(struct brcms_c_info *wlc)
5546 {
5547         bcma_mask32(wlc->hw->d11core, D11REGOFFS(maccontrol), ~MCTL_TBTTHOLD);
5548         /* Commit the write */
5549         bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
5550 }
5551
5552 int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
5553 {
5554         u32 bcnint_us;
5555
5556         if (period == 0)
5557                 return -EINVAL;
5558
5559         wlc->default_bss->beacon_period = period;
5560
5561         bcnint_us = period << 10;
5562         brcms_c_time_lock(wlc);
5563         bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfprep),
5564                      (bcnint_us << CFPREP_CBI_SHIFT));
5565         bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfpstart), bcnint_us);
5566         brcms_c_time_unlock(wlc);
5567
5568         return 0;
5569 }
5570
5571 u16 brcms_c_get_phy_type(struct brcms_c_info *wlc, int phyidx)
5572 {
5573         return wlc->band->phytype;
5574 }
5575
5576 void brcms_c_set_shortslot_override(struct brcms_c_info *wlc, s8 sslot_override)
5577 {
5578         wlc->shortslot_override = sslot_override;
5579
5580         /*
5581          * shortslot is an 11g feature, so no more work if we are
5582          * currently on the 5G band
5583          */
5584         if (wlc->band->bandtype == BRCM_BAND_5G)
5585                 return;
5586
5587         if (wlc->pub->up && wlc->pub->associated) {
5588                 /* let watchdog or beacon processing update shortslot */
5589         } else if (wlc->pub->up) {
5590                 /* unassociated shortslot is off */
5591                 brcms_c_switch_shortslot(wlc, false);
5592         } else {
5593                 /* driver is down, so just update the brcms_c_info
5594                  * value */
5595                 if (wlc->shortslot_override == BRCMS_SHORTSLOT_AUTO)
5596                         wlc->shortslot = false;
5597                 else
5598                         wlc->shortslot =
5599                             (wlc->shortslot_override ==
5600                              BRCMS_SHORTSLOT_ON);
5601         }
5602 }
5603
5604 /*
5605  * register watchdog and down handlers.
5606  */
5607 int brcms_c_module_register(struct brcms_pub *pub,
5608                             const char *name, struct brcms_info *hdl,
5609                             int (*d_fn)(void *handle))
5610 {
5611         struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5612         int i;
5613
5614         /* find an empty entry and just add, no duplication check! */
5615         for (i = 0; i < BRCMS_MAXMODULES; i++) {
5616                 if (wlc->modulecb[i].name[0] == '\0') {
5617                         strncpy(wlc->modulecb[i].name, name,
5618                                 sizeof(wlc->modulecb[i].name) - 1);
5619                         wlc->modulecb[i].hdl = hdl;
5620                         wlc->modulecb[i].down_fn = d_fn;
5621                         return 0;
5622                 }
5623         }
5624
5625         return -ENOSR;
5626 }
5627
5628 /* unregister module callbacks */
5629 int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
5630                               struct brcms_info *hdl)
5631 {
5632         struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5633         int i;
5634
5635         if (wlc == NULL)
5636                 return -ENODATA;
5637
5638         for (i = 0; i < BRCMS_MAXMODULES; i++) {
5639                 if (!strcmp(wlc->modulecb[i].name, name) &&
5640                     (wlc->modulecb[i].hdl == hdl)) {
5641                         memset(&wlc->modulecb[i], 0, sizeof(wlc->modulecb[i]));
5642                         return 0;
5643                 }
5644         }
5645
5646         /* table not found! */
5647         return -ENODATA;
5648 }
5649
5650 static bool brcms_c_chipmatch_pci(struct bcma_device *core)
5651 {
5652         struct pci_dev *pcidev = core->bus->host_pci;
5653         u16 vendor = pcidev->vendor;
5654         u16 device = pcidev->device;
5655
5656         if (vendor != PCI_VENDOR_ID_BROADCOM) {
5657                 pr_err("unknown vendor id %04x\n", vendor);
5658                 return false;
5659         }
5660
5661         if (device == BCM43224_D11N_ID_VEN1 || device == BCM43224_CHIP_ID)
5662                 return true;
5663         if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
5664                 return true;
5665         if (device == BCM4313_D11N2G_ID)
5666                 return true;
5667         if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
5668                 return true;
5669
5670         pr_err("unknown device id %04x\n", device);
5671         return false;
5672 }
5673
5674 static bool brcms_c_chipmatch_soc(struct bcma_device *core)
5675 {
5676         struct bcma_chipinfo *chipinfo = &core->bus->chipinfo;
5677
5678         if (chipinfo->id == BCMA_CHIP_ID_BCM4716)
5679                 return true;
5680
5681         pr_err("unknown chip id %04x\n", chipinfo->id);
5682         return false;
5683 }
5684
5685 bool brcms_c_chipmatch(struct bcma_device *core)
5686 {
5687         switch (core->bus->hosttype) {
5688         case BCMA_HOSTTYPE_PCI:
5689                 return brcms_c_chipmatch_pci(core);
5690         case BCMA_HOSTTYPE_SOC:
5691                 return brcms_c_chipmatch_soc(core);
5692         default:
5693                 pr_err("unknown host type: %i\n", core->bus->hosttype);
5694                 return false;
5695         }
5696 }
5697
5698 u16 brcms_b_rate_shm_offset(struct brcms_hardware *wlc_hw, u8 rate)
5699 {
5700         u16 table_ptr;
5701         u8 phy_rate, index;
5702
5703         /* get the phy specific rate encoding for the PLCP SIGNAL field */
5704         if (is_ofdm_rate(rate))
5705                 table_ptr = M_RT_DIRMAP_A;
5706         else
5707                 table_ptr = M_RT_DIRMAP_B;
5708
5709         /* for a given rate, the LS-nibble of the PLCP SIGNAL field is
5710          * the index into the rate table.
5711          */
5712         phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
5713         index = phy_rate & 0xf;
5714
5715         /* Find the SHM pointer to the rate table entry by looking in the
5716          * Direct-map Table
5717          */
5718         return 2 * brcms_b_read_shm(wlc_hw, table_ptr + (index * 2));
5719 }
5720
5721 /*
5722  * bcmc_fid_generate:
5723  * Generate frame ID for a BCMC packet.  The frag field is not used
5724  * for MC frames so is used as part of the sequence number.
5725  */
5726 static inline u16
5727 bcmc_fid_generate(struct brcms_c_info *wlc, struct brcms_bss_cfg *bsscfg,
5728                   struct d11txh *txh)
5729 {
5730         u16 frameid;
5731
5732         frameid = le16_to_cpu(txh->TxFrameID) & ~(TXFID_SEQ_MASK |
5733                                                   TXFID_QUEUE_MASK);
5734         frameid |=
5735             (((wlc->
5736                mc_fid_counter++) << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
5737             TX_BCMC_FIFO;
5738
5739         return frameid;
5740 }
5741
5742 static uint
5743 brcms_c_calc_ack_time(struct brcms_c_info *wlc, u32 rspec,
5744                       u8 preamble_type)
5745 {
5746         uint dur = 0;
5747
5748         /*
5749          * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5750          * is less than or equal to the rate of the immediately previous
5751          * frame in the FES
5752          */
5753         rspec = brcms_basic_rate(wlc, rspec);
5754         /* ACK frame len == 14 == 2(fc) + 2(dur) + 6(ra) + 4(fcs) */
5755         dur =
5756             brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5757                                 (DOT11_ACK_LEN + FCS_LEN));
5758         return dur;
5759 }
5760
5761 static uint
5762 brcms_c_calc_cts_time(struct brcms_c_info *wlc, u32 rspec,
5763                       u8 preamble_type)
5764 {
5765         return brcms_c_calc_ack_time(wlc, rspec, preamble_type);
5766 }
5767
5768 static uint
5769 brcms_c_calc_ba_time(struct brcms_c_info *wlc, u32 rspec,
5770                      u8 preamble_type)
5771 {
5772         /*
5773          * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5774          * is less than or equal to the rate of the immediately previous
5775          * frame in the FES
5776          */
5777         rspec = brcms_basic_rate(wlc, rspec);
5778         /* BA len == 32 == 16(ctl hdr) + 4(ba len) + 8(bitmap) + 4(fcs) */
5779         return brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5780                                    (DOT11_BA_LEN + DOT11_BA_BITMAP_LEN +
5781                                     FCS_LEN));
5782 }
5783
5784 /* brcms_c_compute_frame_dur()
5785  *
5786  * Calculate the 802.11 MAC header DUR field for MPDU
5787  * DUR for a single frame = 1 SIFS + 1 ACK
5788  * DUR for a frame with following frags = 3 SIFS + 2 ACK + next frag time
5789  *
5790  * rate                 MPDU rate in unit of 500kbps
5791  * next_frag_len        next MPDU length in bytes
5792  * preamble_type        use short/GF or long/MM PLCP header
5793  */
5794 static u16
5795 brcms_c_compute_frame_dur(struct brcms_c_info *wlc, u32 rate,
5796                       u8 preamble_type, uint next_frag_len)
5797 {
5798         u16 dur, sifs;
5799
5800         sifs = get_sifs(wlc->band);
5801
5802         dur = sifs;
5803         dur += (u16) brcms_c_calc_ack_time(wlc, rate, preamble_type);
5804
5805         if (next_frag_len) {
5806                 /* Double the current DUR to get 2 SIFS + 2 ACKs */
5807                 dur *= 2;
5808                 /* add another SIFS and the frag time */
5809                 dur += sifs;
5810                 dur +=
5811                     (u16) brcms_c_calc_frame_time(wlc, rate, preamble_type,
5812                                                  next_frag_len);
5813         }
5814         return dur;
5815 }
5816
5817 /* The opposite of brcms_c_calc_frame_time */
5818 static uint
5819 brcms_c_calc_frame_len(struct brcms_c_info *wlc, u32 ratespec,
5820                    u8 preamble_type, uint dur)
5821 {
5822         uint nsyms, mac_len, Ndps, kNdps;
5823         uint rate = rspec2rate(ratespec);
5824
5825         if (is_mcs_rate(ratespec)) {
5826                 uint mcs = ratespec & RSPEC_RATE_MASK;
5827                 int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
5828                 dur -= PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
5829                 /* payload calculation matches that of regular ofdm */
5830                 if (wlc->band->bandtype == BRCM_BAND_2G)
5831                         dur -= DOT11_OFDM_SIGNAL_EXTENSION;
5832                 /* kNdbps = kbps * 4 */
5833                 kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
5834                                    rspec_issgi(ratespec)) * 4;
5835                 nsyms = dur / APHY_SYMBOL_TIME;
5836                 mac_len =
5837                     ((nsyms * kNdps) -
5838                      ((APHY_SERVICE_NBITS + APHY_TAIL_NBITS) * 1000)) / 8000;
5839         } else if (is_ofdm_rate(ratespec)) {
5840                 dur -= APHY_PREAMBLE_TIME;
5841                 dur -= APHY_SIGNAL_TIME;
5842                 /* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
5843                 Ndps = rate * 2;
5844                 nsyms = dur / APHY_SYMBOL_TIME;
5845                 mac_len =
5846                     ((nsyms * Ndps) -
5847                      (APHY_SERVICE_NBITS + APHY_TAIL_NBITS)) / 8;
5848         } else {
5849                 if (preamble_type & BRCMS_SHORT_PREAMBLE)
5850                         dur -= BPHY_PLCP_SHORT_TIME;
5851                 else
5852                         dur -= BPHY_PLCP_TIME;
5853                 mac_len = dur * rate;
5854                 /* divide out factor of 2 in rate (1/2 mbps) */
5855                 mac_len = mac_len / 8 / 2;
5856         }
5857         return mac_len;
5858 }
5859
5860 /*
5861  * Return true if the specified rate is supported by the specified band.
5862  * BRCM_BAND_AUTO indicates the current band.
5863  */
5864 static bool brcms_c_valid_rate(struct brcms_c_info *wlc, u32 rspec, int band,
5865                     bool verbose)
5866 {
5867         struct brcms_c_rateset *hw_rateset;
5868         uint i;
5869
5870         if ((band == BRCM_BAND_AUTO) || (band == wlc->band->bandtype))
5871                 hw_rateset = &wlc->band->hw_rateset;
5872         else if (wlc->pub->_nbands > 1)
5873                 hw_rateset = &wlc->bandstate[OTHERBANDUNIT(wlc)]->hw_rateset;
5874         else
5875                 /* other band specified and we are a single band device */
5876                 return false;
5877
5878         /* check if this is a mimo rate */
5879         if (is_mcs_rate(rspec)) {
5880                 if ((rspec & RSPEC_RATE_MASK) >= MCS_TABLE_SIZE)
5881                         goto error;
5882
5883                 return isset(hw_rateset->mcs, (rspec & RSPEC_RATE_MASK));
5884         }
5885
5886         for (i = 0; i < hw_rateset->count; i++)
5887                 if (hw_rateset->rates[i] == rspec2rate(rspec))
5888                         return true;
5889  error:
5890         if (verbose)
5891                 brcms_err(wlc->hw->d11core, "wl%d: valid_rate: rate spec 0x%x "
5892                           "not in hw_rateset\n", wlc->pub->unit, rspec);
5893
5894         return false;
5895 }
5896
5897 static u32
5898 mac80211_wlc_set_nrate(struct brcms_c_info *wlc, struct brcms_band *cur_band,
5899                        u32 int_val)
5900 {
5901         struct bcma_device *core = wlc->hw->d11core;
5902         u8 stf = (int_val & NRATE_STF_MASK) >> NRATE_STF_SHIFT;
5903         u8 rate = int_val & NRATE_RATE_MASK;
5904         u32 rspec;
5905         bool ismcs = ((int_val & NRATE_MCS_INUSE) == NRATE_MCS_INUSE);
5906         bool issgi = ((int_val & NRATE_SGI_MASK) >> NRATE_SGI_SHIFT);
5907         bool override_mcs_only = ((int_val & NRATE_OVERRIDE_MCS_ONLY)
5908                                   == NRATE_OVERRIDE_MCS_ONLY);
5909         int bcmerror = 0;
5910
5911         if (!ismcs)
5912                 return (u32) rate;
5913
5914         /* validate the combination of rate/mcs/stf is allowed */
5915         if ((wlc->pub->_n_enab & SUPPORT_11N) && ismcs) {
5916                 /* mcs only allowed when nmode */
5917                 if (stf > PHY_TXC1_MODE_SDM) {
5918                         brcms_err(core, "wl%d: %s: Invalid stf\n",
5919                                   wlc->pub->unit, __func__);
5920                         bcmerror = -EINVAL;
5921                         goto done;
5922                 }
5923
5924                 /* mcs 32 is a special case, DUP mode 40 only */
5925                 if (rate == 32) {
5926                         if (!CHSPEC_IS40(wlc->home_chanspec) ||
5927                             ((stf != PHY_TXC1_MODE_SISO)
5928                              && (stf != PHY_TXC1_MODE_CDD))) {
5929                                 brcms_err(core, "wl%d: %s: Invalid mcs 32\n",
5930                                           wlc->pub->unit, __func__);
5931                                 bcmerror = -EINVAL;
5932                                 goto done;
5933                         }
5934                         /* mcs > 7 must use stf SDM */
5935                 } else if (rate > HIGHEST_SINGLE_STREAM_MCS) {
5936                         /* mcs > 7 must use stf SDM */
5937                         if (stf != PHY_TXC1_MODE_SDM) {
5938                                 brcms_dbg_mac80211(core, "wl%d: enabling "
5939                                                    "SDM mode for mcs %d\n",
5940                                                    wlc->pub->unit, rate);
5941                                 stf = PHY_TXC1_MODE_SDM;
5942                         }
5943                 } else {
5944                         /*
5945                          * MCS 0-7 may use SISO, CDD, and for
5946                          * phy_rev >= 3 STBC
5947                          */
5948                         if ((stf > PHY_TXC1_MODE_STBC) ||
5949                             (!BRCMS_STBC_CAP_PHY(wlc)
5950                              && (stf == PHY_TXC1_MODE_STBC))) {
5951                                 brcms_err(core, "wl%d: %s: Invalid STBC\n",
5952                                           wlc->pub->unit, __func__);
5953                                 bcmerror = -EINVAL;
5954                                 goto done;
5955                         }
5956                 }
5957         } else if (is_ofdm_rate(rate)) {
5958                 if ((stf != PHY_TXC1_MODE_CDD) && (stf != PHY_TXC1_MODE_SISO)) {
5959                         brcms_err(core, "wl%d: %s: Invalid OFDM\n",
5960                                   wlc->pub->unit, __func__);
5961                         bcmerror = -EINVAL;
5962                         goto done;
5963                 }
5964         } else if (is_cck_rate(rate)) {
5965                 if ((cur_band->bandtype != BRCM_BAND_2G)
5966                     || (stf != PHY_TXC1_MODE_SISO)) {
5967                         brcms_err(core, "wl%d: %s: Invalid CCK\n",
5968                                   wlc->pub->unit, __func__);
5969                         bcmerror = -EINVAL;
5970                         goto done;
5971                 }
5972         } else {
5973                 brcms_err(core, "wl%d: %s: Unknown rate type\n",
5974                           wlc->pub->unit, __func__);
5975                 bcmerror = -EINVAL;
5976                 goto done;
5977         }
5978         /* make sure multiple antennae are available for non-siso rates */
5979         if ((stf != PHY_TXC1_MODE_SISO) && (wlc->stf->txstreams == 1)) {
5980                 brcms_err(core, "wl%d: %s: SISO antenna but !SISO "
5981                           "request\n", wlc->pub->unit, __func__);
5982                 bcmerror = -EINVAL;
5983                 goto done;
5984         }
5985
5986         rspec = rate;
5987         if (ismcs) {
5988                 rspec |= RSPEC_MIMORATE;
5989                 /* For STBC populate the STC field of the ratespec */
5990                 if (stf == PHY_TXC1_MODE_STBC) {
5991                         u8 stc;
5992                         stc = 1;        /* Nss for single stream is always 1 */
5993                         rspec |= (stc << RSPEC_STC_SHIFT);
5994                 }
5995         }
5996
5997         rspec |= (stf << RSPEC_STF_SHIFT);
5998
5999         if (override_mcs_only)
6000                 rspec |= RSPEC_OVERRIDE_MCS_ONLY;
6001
6002         if (issgi)
6003                 rspec |= RSPEC_SHORT_GI;
6004
6005         if ((rate != 0)
6006             && !brcms_c_valid_rate(wlc, rspec, cur_band->bandtype, true))
6007                 return rate;
6008
6009         return rspec;
6010 done:
6011         return rate;
6012 }
6013
6014 /*
6015  * Compute PLCP, but only requires actual rate and length of pkt.
6016  * Rate is given in the driver standard multiple of 500 kbps.
6017  * le is set for 11 Mbps rate if necessary.
6018  * Broken out for PRQ.
6019  */
6020
6021 static void brcms_c_cck_plcp_set(struct brcms_c_info *wlc, int rate_500,
6022                              uint length, u8 *plcp)
6023 {
6024         u16 usec = 0;
6025         u8 le = 0;
6026
6027         switch (rate_500) {
6028         case BRCM_RATE_1M:
6029                 usec = length << 3;
6030                 break;
6031         case BRCM_RATE_2M:
6032                 usec = length << 2;
6033                 break;
6034         case BRCM_RATE_5M5:
6035                 usec = (length << 4) / 11;
6036                 if ((length << 4) - (usec * 11) > 0)
6037                         usec++;
6038                 break;
6039         case BRCM_RATE_11M:
6040                 usec = (length << 3) / 11;
6041                 if ((length << 3) - (usec * 11) > 0) {
6042                         usec++;
6043                         if ((usec * 11) - (length << 3) >= 8)
6044                                 le = D11B_PLCP_SIGNAL_LE;
6045                 }
6046                 break;
6047
6048         default:
6049                 brcms_err(wlc->hw->d11core,
6050                           "brcms_c_cck_plcp_set: unsupported rate %d\n",
6051                           rate_500);
6052                 rate_500 = BRCM_RATE_1M;
6053                 usec = length << 3;
6054                 break;
6055         }
6056         /* PLCP signal byte */
6057         plcp[0] = rate_500 * 5; /* r (500kbps) * 5 == r (100kbps) */
6058         /* PLCP service byte */
6059         plcp[1] = (u8) (le | D11B_PLCP_SIGNAL_LOCKED);
6060         /* PLCP length u16, little endian */
6061         plcp[2] = usec & 0xff;
6062         plcp[3] = (usec >> 8) & 0xff;
6063         /* PLCP CRC16 */
6064         plcp[4] = 0;
6065         plcp[5] = 0;
6066 }
6067
6068 /* Rate: 802.11 rate code, length: PSDU length in octets */
6069 static void brcms_c_compute_mimo_plcp(u32 rspec, uint length, u8 *plcp)
6070 {
6071         u8 mcs = (u8) (rspec & RSPEC_RATE_MASK);
6072         plcp[0] = mcs;
6073         if (rspec_is40mhz(rspec) || (mcs == 32))
6074                 plcp[0] |= MIMO_PLCP_40MHZ;
6075         BRCMS_SET_MIMO_PLCP_LEN(plcp, length);
6076         plcp[3] = rspec_mimoplcp3(rspec); /* rspec already holds this byte */
6077         plcp[3] |= 0x7; /* set smoothing, not sounding ppdu & reserved */
6078         plcp[4] = 0; /* number of extension spatial streams bit 0 & 1 */
6079         plcp[5] = 0;
6080 }
6081
6082 /* Rate: 802.11 rate code, length: PSDU length in octets */
6083 static void
6084 brcms_c_compute_ofdm_plcp(u32 rspec, u32 length, u8 *plcp)
6085 {
6086         u8 rate_signal;
6087         u32 tmp = 0;
6088         int rate = rspec2rate(rspec);
6089
6090         /*
6091          * encode rate per 802.11a-1999 sec 17.3.4.1, with lsb
6092          * transmitted first
6093          */
6094         rate_signal = rate_info[rate] & BRCMS_RATE_MASK;
6095         memset(plcp, 0, D11_PHY_HDR_LEN);
6096         D11A_PHY_HDR_SRATE((struct ofdm_phy_hdr *) plcp, rate_signal);
6097
6098         tmp = (length & 0xfff) << 5;
6099         plcp[2] |= (tmp >> 16) & 0xff;
6100         plcp[1] |= (tmp >> 8) & 0xff;
6101         plcp[0] |= tmp & 0xff;
6102 }
6103
6104 /* Rate: 802.11 rate code, length: PSDU length in octets */
6105 static void brcms_c_compute_cck_plcp(struct brcms_c_info *wlc, u32 rspec,
6106                                  uint length, u8 *plcp)
6107 {
6108         int rate = rspec2rate(rspec);
6109
6110         brcms_c_cck_plcp_set(wlc, rate, length, plcp);
6111 }
6112
6113 static void
6114 brcms_c_compute_plcp(struct brcms_c_info *wlc, u32 rspec,
6115                      uint length, u8 *plcp)
6116 {
6117         if (is_mcs_rate(rspec))
6118                 brcms_c_compute_mimo_plcp(rspec, length, plcp);
6119         else if (is_ofdm_rate(rspec))
6120                 brcms_c_compute_ofdm_plcp(rspec, length, plcp);
6121         else
6122                 brcms_c_compute_cck_plcp(wlc, rspec, length, plcp);
6123 }
6124
6125 /* brcms_c_compute_rtscts_dur()
6126  *
6127  * Calculate the 802.11 MAC header DUR field for an RTS or CTS frame
6128  * DUR for normal RTS/CTS w/ frame = 3 SIFS + 1 CTS + next frame time + 1 ACK
6129  * DUR for CTS-TO-SELF w/ frame    = 2 SIFS         + next frame time + 1 ACK
6130  *
6131  * cts                  cts-to-self or rts/cts
6132  * rts_rate             rts or cts rate in unit of 500kbps
6133  * rate                 next MPDU rate in unit of 500kbps
6134  * frame_len            next MPDU frame length in bytes
6135  */
6136 u16
6137 brcms_c_compute_rtscts_dur(struct brcms_c_info *wlc, bool cts_only,
6138                            u32 rts_rate,
6139                            u32 frame_rate, u8 rts_preamble_type,
6140                            u8 frame_preamble_type, uint frame_len, bool ba)
6141 {
6142         u16 dur, sifs;
6143
6144         sifs = get_sifs(wlc->band);
6145
6146         if (!cts_only) {
6147                 /* RTS/CTS */
6148                 dur = 3 * sifs;
6149                 dur +=
6150                     (u16) brcms_c_calc_cts_time(wlc, rts_rate,
6151                                                rts_preamble_type);
6152         } else {
6153                 /* CTS-TO-SELF */
6154                 dur = 2 * sifs;
6155         }
6156
6157         dur +=
6158             (u16) brcms_c_calc_frame_time(wlc, frame_rate, frame_preamble_type,
6159                                          frame_len);
6160         if (ba)
6161                 dur +=
6162                     (u16) brcms_c_calc_ba_time(wlc, frame_rate,
6163                                               BRCMS_SHORT_PREAMBLE);
6164         else
6165                 dur +=
6166                     (u16) brcms_c_calc_ack_time(wlc, frame_rate,
6167                                                frame_preamble_type);
6168         return dur;
6169 }
6170
6171 static u16 brcms_c_phytxctl1_calc(struct brcms_c_info *wlc, u32 rspec)
6172 {
6173         u16 phyctl1 = 0;
6174         u16 bw;
6175
6176         if (BRCMS_ISLCNPHY(wlc->band)) {
6177                 bw = PHY_TXC1_BW_20MHZ;
6178         } else {
6179                 bw = rspec_get_bw(rspec);
6180                 /* 10Mhz is not supported yet */
6181                 if (bw < PHY_TXC1_BW_20MHZ) {
6182                         brcms_err(wlc->hw->d11core, "phytxctl1_calc: bw %d is "
6183                                   "not supported yet, set to 20L\n", bw);
6184                         bw = PHY_TXC1_BW_20MHZ;
6185                 }
6186         }
6187
6188         if (is_mcs_rate(rspec)) {
6189                 uint mcs = rspec & RSPEC_RATE_MASK;
6190
6191                 /* bw, stf, coding-type is part of rspec_phytxbyte2 returns */
6192                 phyctl1 = rspec_phytxbyte2(rspec);
6193                 /* set the upper byte of phyctl1 */
6194                 phyctl1 |= (mcs_table[mcs].tx_phy_ctl3 << 8);
6195         } else if (is_cck_rate(rspec) && !BRCMS_ISLCNPHY(wlc->band)
6196                    && !BRCMS_ISSSLPNPHY(wlc->band)) {
6197                 /*
6198                  * In CCK mode LPPHY overloads OFDM Modulation bits with CCK
6199                  * Data Rate. Eventually MIMOPHY would also be converted to
6200                  * this format
6201                  */
6202                 /* 0 = 1Mbps; 1 = 2Mbps; 2 = 5.5Mbps; 3 = 11Mbps */
6203                 phyctl1 = (bw | (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6204         } else {                /* legacy OFDM/CCK */
6205                 s16 phycfg;
6206                 /* get the phyctl byte from rate phycfg table */
6207                 phycfg = brcms_c_rate_legacy_phyctl(rspec2rate(rspec));
6208                 if (phycfg == -1) {
6209                         brcms_err(wlc->hw->d11core, "phytxctl1_calc: wrong "
6210                                   "legacy OFDM/CCK rate\n");
6211                         phycfg = 0;
6212                 }
6213                 /* set the upper byte of phyctl1 */
6214                 phyctl1 =
6215                     (bw | (phycfg << 8) |
6216                      (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6217         }
6218         return phyctl1;
6219 }
6220
6221 /*
6222  * Add struct d11txh, struct cck_phy_hdr.
6223  *
6224  * 'p' data must start with 802.11 MAC header
6225  * 'p' must allow enough bytes of local headers to be "pushed" onto the packet
6226  *
6227  * headroom == D11_PHY_HDR_LEN + D11_TXH_LEN (D11_TXH_LEN is now 104 bytes)
6228  *
6229  */
6230 static u16
6231 brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
6232                      struct sk_buff *p, struct scb *scb, uint frag,
6233                      uint nfrags, uint queue, uint next_frag_len)
6234 {
6235         struct ieee80211_hdr *h;
6236         struct d11txh *txh;
6237         u8 *plcp, plcp_fallback[D11_PHY_HDR_LEN];
6238         int len, phylen, rts_phylen;
6239         u16 mch, phyctl, xfts, mainrates;
6240         u16 seq = 0, mcl = 0, status = 0, frameid = 0;
6241         u32 rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6242         u32 rts_rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6243         bool use_rts = false;
6244         bool use_cts = false;
6245         bool use_rifs = false;
6246         bool short_preamble[2] = { false, false };
6247         u8 preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6248         u8 rts_preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6249         u8 *rts_plcp, rts_plcp_fallback[D11_PHY_HDR_LEN];
6250         struct ieee80211_rts *rts = NULL;
6251         bool qos;
6252         uint ac;
6253         bool hwtkmic = false;
6254         u16 mimo_ctlchbw = PHY_TXC1_BW_20MHZ;
6255 #define ANTCFG_NONE 0xFF
6256         u8 antcfg = ANTCFG_NONE;
6257         u8 fbantcfg = ANTCFG_NONE;
6258         uint phyctl1_stf = 0;
6259         u16 durid = 0;
6260         struct ieee80211_tx_rate *txrate[2];
6261         int k;
6262         struct ieee80211_tx_info *tx_info;
6263         bool is_mcs;
6264         u16 mimo_txbw;
6265         u8 mimo_preamble_type;
6266
6267         /* locate 802.11 MAC header */
6268         h = (struct ieee80211_hdr *)(p->data);
6269         qos = ieee80211_is_data_qos(h->frame_control);
6270
6271         /* compute length of frame in bytes for use in PLCP computations */
6272         len = p->len;
6273         phylen = len + FCS_LEN;
6274
6275         /* Get tx_info */
6276         tx_info = IEEE80211_SKB_CB(p);
6277
6278         /* add PLCP */
6279         plcp = skb_push(p, D11_PHY_HDR_LEN);
6280
6281         /* add Broadcom tx descriptor header */
6282         txh = (struct d11txh *) skb_push(p, D11_TXH_LEN);
6283         memset(txh, 0, D11_TXH_LEN);
6284
6285         /* setup frameid */
6286         if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
6287                 /* non-AP STA should never use BCMC queue */
6288                 if (queue == TX_BCMC_FIFO) {
6289                         brcms_err(wlc->hw->d11core,
6290                                   "wl%d: %s: ASSERT queue == TX_BCMC!\n",
6291                                   wlc->pub->unit, __func__);
6292                         frameid = bcmc_fid_generate(wlc, NULL, txh);
6293                 } else {
6294                         /* Increment the counter for first fragment */
6295                         if (tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
6296                                 scb->seqnum[p->priority]++;
6297
6298                         /* extract fragment number from frame first */
6299                         seq = le16_to_cpu(h->seq_ctrl) & FRAGNUM_MASK;
6300                         seq |= (scb->seqnum[p->priority] << SEQNUM_SHIFT);
6301                         h->seq_ctrl = cpu_to_le16(seq);
6302
6303                         frameid = ((seq << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
6304                             (queue & TXFID_QUEUE_MASK);
6305                 }
6306         }
6307         frameid |= queue & TXFID_QUEUE_MASK;
6308
6309         /* set the ignpmq bit for all pkts tx'd in PS mode and for beacons */
6310         if (ieee80211_is_beacon(h->frame_control))
6311                 mcl |= TXC_IGNOREPMQ;
6312
6313         txrate[0] = tx_info->control.rates;
6314         txrate[1] = txrate[0] + 1;
6315
6316         /*
6317          * if rate control algorithm didn't give us a fallback
6318          * rate, use the primary rate
6319          */
6320         if (txrate[1]->idx < 0)
6321                 txrate[1] = txrate[0];
6322
6323         for (k = 0; k < hw->max_rates; k++) {
6324                 is_mcs = txrate[k]->flags & IEEE80211_TX_RC_MCS ? true : false;
6325                 if (!is_mcs) {
6326                         if ((txrate[k]->idx >= 0)
6327                             && (txrate[k]->idx <
6328                                 hw->wiphy->bands[tx_info->band]->n_bitrates)) {
6329                                 rspec[k] =
6330                                     hw->wiphy->bands[tx_info->band]->
6331                                     bitrates[txrate[k]->idx].hw_value;
6332                                 short_preamble[k] =
6333                                     txrate[k]->
6334                                     flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ?
6335                                     true : false;
6336                         } else {
6337                                 rspec[k] = BRCM_RATE_1M;
6338                         }
6339                 } else {
6340                         rspec[k] = mac80211_wlc_set_nrate(wlc, wlc->band,
6341                                         NRATE_MCS_INUSE | txrate[k]->idx);
6342                 }
6343
6344                 /*
6345                  * Currently only support same setting for primay and
6346                  * fallback rates. Unify flags for each rate into a
6347                  * single value for the frame
6348                  */
6349                 use_rts |=
6350                     txrate[k]->
6351                     flags & IEEE80211_TX_RC_USE_RTS_CTS ? true : false;
6352                 use_cts |=
6353                     txrate[k]->
6354                     flags & IEEE80211_TX_RC_USE_CTS_PROTECT ? true : false;
6355
6356
6357                 /*
6358                  * (1) RATE:
6359                  *   determine and validate primary rate
6360                  *   and fallback rates
6361                  */
6362                 if (!rspec_active(rspec[k])) {
6363                         rspec[k] = BRCM_RATE_1M;
6364                 } else {
6365                         if (!is_multicast_ether_addr(h->addr1)) {
6366                                 /* set tx antenna config */
6367                                 brcms_c_antsel_antcfg_get(wlc->asi, false,
6368                                         false, 0, 0, &antcfg, &fbantcfg);
6369                         }
6370                 }
6371         }
6372
6373         phyctl1_stf = wlc->stf->ss_opmode;
6374
6375         if (wlc->pub->_n_enab & SUPPORT_11N) {
6376                 for (k = 0; k < hw->max_rates; k++) {
6377                         /*
6378                          * apply siso/cdd to single stream mcs's or ofdm
6379                          * if rspec is auto selected
6380                          */
6381                         if (((is_mcs_rate(rspec[k]) &&
6382                               is_single_stream(rspec[k] & RSPEC_RATE_MASK)) ||
6383                              is_ofdm_rate(rspec[k]))
6384                             && ((rspec[k] & RSPEC_OVERRIDE_MCS_ONLY)
6385                                 || !(rspec[k] & RSPEC_OVERRIDE))) {
6386                                 rspec[k] &= ~(RSPEC_STF_MASK | RSPEC_STC_MASK);
6387
6388                                 /* For SISO MCS use STBC if possible */
6389                                 if (is_mcs_rate(rspec[k])
6390                                     && BRCMS_STF_SS_STBC_TX(wlc, scb)) {
6391                                         u8 stc;
6392
6393                                         /* Nss for single stream is always 1 */
6394                                         stc = 1;
6395                                         rspec[k] |= (PHY_TXC1_MODE_STBC <<
6396                                                         RSPEC_STF_SHIFT) |
6397                                                     (stc << RSPEC_STC_SHIFT);
6398                                 } else
6399                                         rspec[k] |=
6400                                             (phyctl1_stf << RSPEC_STF_SHIFT);
6401                         }
6402
6403                         /*
6404                          * Is the phy configured to use 40MHZ frames? If
6405                          * so then pick the desired txbw
6406                          */
6407                         if (brcms_chspec_bw(wlc->chanspec) == BRCMS_40_MHZ) {
6408                                 /* default txbw is 20in40 SB */
6409                                 mimo_ctlchbw = mimo_txbw =
6410                                    CHSPEC_SB_UPPER(wlc_phy_chanspec_get(
6411                                                                  wlc->band->pi))
6412                                    ? PHY_TXC1_BW_20MHZ_UP : PHY_TXC1_BW_20MHZ;
6413
6414                                 if (is_mcs_rate(rspec[k])) {
6415                                         /* mcs 32 must be 40b/w DUP */
6416                                         if ((rspec[k] & RSPEC_RATE_MASK)
6417                                             == 32) {
6418                                                 mimo_txbw =
6419                                                     PHY_TXC1_BW_40MHZ_DUP;
6420                                                 /* use override */
6421                                         } else if (wlc->mimo_40txbw != AUTO)
6422                                                 mimo_txbw = wlc->mimo_40txbw;
6423                                         /* else check if dst is using 40 Mhz */
6424                                         else if (scb->flags & SCB_IS40)
6425                                                 mimo_txbw = PHY_TXC1_BW_40MHZ;
6426                                 } else if (is_ofdm_rate(rspec[k])) {
6427                                         if (wlc->ofdm_40txbw != AUTO)
6428                                                 mimo_txbw = wlc->ofdm_40txbw;
6429                                 } else if (wlc->cck_40txbw != AUTO) {
6430                                         mimo_txbw = wlc->cck_40txbw;
6431                                 }
6432                         } else {
6433                                 /*
6434                                  * mcs32 is 40 b/w only.
6435                                  * This is possible for probe packets on
6436                                  * a STA during SCAN
6437                                  */
6438                                 if ((rspec[k] & RSPEC_RATE_MASK) == 32)
6439                                         /* mcs 0 */
6440                                         rspec[k] = RSPEC_MIMORATE;
6441
6442                                 mimo_txbw = PHY_TXC1_BW_20MHZ;
6443                         }
6444
6445                         /* Set channel width */
6446                         rspec[k] &= ~RSPEC_BW_MASK;
6447                         if ((k == 0) || ((k > 0) && is_mcs_rate(rspec[k])))
6448                                 rspec[k] |= (mimo_txbw << RSPEC_BW_SHIFT);
6449                         else
6450                                 rspec[k] |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
6451
6452                         /* Disable short GI, not supported yet */
6453                         rspec[k] &= ~RSPEC_SHORT_GI;
6454
6455                         mimo_preamble_type = BRCMS_MM_PREAMBLE;
6456                         if (txrate[k]->flags & IEEE80211_TX_RC_GREEN_FIELD)
6457                                 mimo_preamble_type = BRCMS_GF_PREAMBLE;
6458
6459                         if ((txrate[k]->flags & IEEE80211_TX_RC_MCS)
6460                             && (!is_mcs_rate(rspec[k]))) {
6461                                 brcms_warn(wlc->hw->d11core,
6462                                            "wl%d: %s: IEEE80211_TX_RC_MCS != is_mcs_rate(rspec)\n",
6463                                            wlc->pub->unit, __func__);
6464                         }
6465
6466                         if (is_mcs_rate(rspec[k])) {
6467                                 preamble_type[k] = mimo_preamble_type;
6468
6469                                 /*
6470                                  * if SGI is selected, then forced mm
6471                                  * for single stream
6472                                  */
6473                                 if ((rspec[k] & RSPEC_SHORT_GI)
6474                                     && is_single_stream(rspec[k] &
6475                                                         RSPEC_RATE_MASK))
6476                                         preamble_type[k] = BRCMS_MM_PREAMBLE;
6477                         }
6478
6479                         /* should be better conditionalized */
6480                         if (!is_mcs_rate(rspec[0])
6481                             && (tx_info->control.rates[0].
6482                                 flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
6483                                 preamble_type[k] = BRCMS_SHORT_PREAMBLE;
6484                 }
6485         } else {
6486                 for (k = 0; k < hw->max_rates; k++) {
6487                         /* Set ctrlchbw as 20Mhz */
6488                         rspec[k] &= ~RSPEC_BW_MASK;
6489                         rspec[k] |= (PHY_TXC1_BW_20MHZ << RSPEC_BW_SHIFT);
6490
6491                         /* for nphy, stf of ofdm frames must follow policies */
6492                         if (BRCMS_ISNPHY(wlc->band) && is_ofdm_rate(rspec[k])) {
6493                                 rspec[k] &= ~RSPEC_STF_MASK;
6494                                 rspec[k] |= phyctl1_stf << RSPEC_STF_SHIFT;
6495                         }
6496                 }
6497         }
6498
6499         /* Reset these for use with AMPDU's */
6500         txrate[0]->count = 0;
6501         txrate[1]->count = 0;
6502
6503         /* (2) PROTECTION, may change rspec */
6504         if ((ieee80211_is_data(h->frame_control) ||
6505             ieee80211_is_mgmt(h->frame_control)) &&
6506             (phylen > wlc->RTSThresh) && !is_multicast_ether_addr(h->addr1))
6507                 use_rts = true;
6508
6509         /* (3) PLCP: determine PLCP header and MAC duration,
6510          * fill struct d11txh */
6511         brcms_c_compute_plcp(wlc, rspec[0], phylen, plcp);
6512         brcms_c_compute_plcp(wlc, rspec[1], phylen, plcp_fallback);
6513         memcpy(&txh->FragPLCPFallback,
6514                plcp_fallback, sizeof(txh->FragPLCPFallback));
6515
6516         /* Length field now put in CCK FBR CRC field */
6517         if (is_cck_rate(rspec[1])) {
6518                 txh->FragPLCPFallback[4] = phylen & 0xff;
6519                 txh->FragPLCPFallback[5] = (phylen & 0xff00) >> 8;
6520         }
6521
6522         /* MIMO-RATE: need validation ?? */
6523         mainrates = is_ofdm_rate(rspec[0]) ?
6524                         D11A_PHY_HDR_GRATE((struct ofdm_phy_hdr *) plcp) :
6525                         plcp[0];
6526
6527         /* DUR field for main rate */
6528         if (!ieee80211_is_pspoll(h->frame_control) &&
6529             !is_multicast_ether_addr(h->addr1) && !use_rifs) {
6530                 durid =
6531                     brcms_c_compute_frame_dur(wlc, rspec[0], preamble_type[0],
6532                                           next_frag_len);
6533                 h->duration_id = cpu_to_le16(durid);
6534         } else if (use_rifs) {
6535                 /* NAV protect to end of next max packet size */
6536                 durid =
6537                     (u16) brcms_c_calc_frame_time(wlc, rspec[0],
6538                                                  preamble_type[0],
6539                                                  DOT11_MAX_FRAG_LEN);
6540                 durid += RIFS_11N_TIME;
6541                 h->duration_id = cpu_to_le16(durid);
6542         }
6543
6544         /* DUR field for fallback rate */
6545         if (ieee80211_is_pspoll(h->frame_control))
6546                 txh->FragDurFallback = h->duration_id;
6547         else if (is_multicast_ether_addr(h->addr1) || use_rifs)
6548                 txh->FragDurFallback = 0;
6549         else {
6550                 durid = brcms_c_compute_frame_dur(wlc, rspec[1],
6551                                               preamble_type[1], next_frag_len);
6552                 txh->FragDurFallback = cpu_to_le16(durid);
6553         }
6554
6555         /* (4) MAC-HDR: MacTxControlLow */
6556         if (frag == 0)
6557                 mcl |= TXC_STARTMSDU;
6558
6559         if (!is_multicast_ether_addr(h->addr1))
6560                 mcl |= TXC_IMMEDACK;
6561
6562         if (wlc->band->bandtype == BRCM_BAND_5G)
6563                 mcl |= TXC_FREQBAND_5G;
6564
6565         if (CHSPEC_IS40(wlc_phy_chanspec_get(wlc->band->pi)))
6566                 mcl |= TXC_BW_40;
6567
6568         /* set AMIC bit if using hardware TKIP MIC */
6569         if (hwtkmic)
6570                 mcl |= TXC_AMIC;
6571
6572         txh->MacTxControlLow = cpu_to_le16(mcl);
6573
6574         /* MacTxControlHigh */
6575         mch = 0;
6576
6577         /* Set fallback rate preamble type */
6578         if ((preamble_type[1] == BRCMS_SHORT_PREAMBLE) ||
6579             (preamble_type[1] == BRCMS_GF_PREAMBLE)) {
6580                 if (rspec2rate(rspec[1]) != BRCM_RATE_1M)
6581                         mch |= TXC_PREAMBLE_DATA_FB_SHORT;
6582         }
6583
6584         /* MacFrameControl */
6585         memcpy(&txh->MacFrameControl, &h->frame_control, sizeof(u16));
6586         txh->TxFesTimeNormal = cpu_to_le16(0);
6587
6588         txh->TxFesTimeFallback = cpu_to_le16(0);
6589
6590         /* TxFrameRA */
6591         memcpy(&txh->TxFrameRA, &h->addr1, ETH_ALEN);
6592
6593         /* TxFrameID */
6594         txh->TxFrameID = cpu_to_le16(frameid);
6595
6596         /*
6597          * TxStatus, Note the case of recreating the first frag of a suppressed
6598          * frame then we may need to reset the retry cnt's via the status reg
6599          */
6600         txh->TxStatus = cpu_to_le16(status);
6601
6602         /*
6603          * extra fields for ucode AMPDU aggregation, the new fields are added to
6604          * the END of previous structure so that it's compatible in driver.
6605          */
6606         txh->MaxNMpdus = cpu_to_le16(0);
6607         txh->MaxABytes_MRT = cpu_to_le16(0);
6608         txh->MaxABytes_FBR = cpu_to_le16(0);
6609         txh->MinMBytes = cpu_to_le16(0);
6610
6611         /* (5) RTS/CTS: determine RTS/CTS PLCP header and MAC duration,
6612          * furnish struct d11txh */
6613         /* RTS PLCP header and RTS frame */
6614         if (use_rts || use_cts) {
6615                 if (use_rts && use_cts)
6616                         use_cts = false;
6617
6618                 for (k = 0; k < 2; k++) {
6619                         rts_rspec[k] = brcms_c_rspec_to_rts_rspec(wlc, rspec[k],
6620                                                               false,
6621                                                               mimo_ctlchbw);
6622                 }
6623
6624                 if (!is_ofdm_rate(rts_rspec[0]) &&
6625                     !((rspec2rate(rts_rspec[0]) == BRCM_RATE_1M) ||
6626                       (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6627                         rts_preamble_type[0] = BRCMS_SHORT_PREAMBLE;
6628                         mch |= TXC_PREAMBLE_RTS_MAIN_SHORT;
6629                 }
6630
6631                 if (!is_ofdm_rate(rts_rspec[1]) &&
6632                     !((rspec2rate(rts_rspec[1]) == BRCM_RATE_1M) ||
6633                       (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6634                         rts_preamble_type[1] = BRCMS_SHORT_PREAMBLE;
6635                         mch |= TXC_PREAMBLE_RTS_FB_SHORT;
6636                 }
6637
6638                 /* RTS/CTS additions to MacTxControlLow */
6639                 if (use_cts) {
6640                         txh->MacTxControlLow |= cpu_to_le16(TXC_SENDCTS);
6641                 } else {
6642                         txh->MacTxControlLow |= cpu_to_le16(TXC_SENDRTS);
6643                         txh->MacTxControlLow |= cpu_to_le16(TXC_LONGFRAME);
6644                 }
6645
6646                 /* RTS PLCP header */
6647                 rts_plcp = txh->RTSPhyHeader;
6648                 if (use_cts)
6649                         rts_phylen = DOT11_CTS_LEN + FCS_LEN;
6650                 else
6651                         rts_phylen = DOT11_RTS_LEN + FCS_LEN;
6652
6653                 brcms_c_compute_plcp(wlc, rts_rspec[0], rts_phylen, rts_plcp);
6654
6655                 /* fallback rate version of RTS PLCP header */
6656                 brcms_c_compute_plcp(wlc, rts_rspec[1], rts_phylen,
6657                                  rts_plcp_fallback);
6658                 memcpy(&txh->RTSPLCPFallback, rts_plcp_fallback,
6659                        sizeof(txh->RTSPLCPFallback));
6660
6661                 /* RTS frame fields... */
6662                 rts = (struct ieee80211_rts *)&txh->rts_frame;
6663
6664                 durid = brcms_c_compute_rtscts_dur(wlc, use_cts, rts_rspec[0],
6665                                                rspec[0], rts_preamble_type[0],
6666                                                preamble_type[0], phylen, false);
6667                 rts->duration = cpu_to_le16(durid);
6668                 /* fallback rate version of RTS DUR field */
6669                 durid = brcms_c_compute_rtscts_dur(wlc, use_cts,
6670                                                rts_rspec[1], rspec[1],
6671                                                rts_preamble_type[1],
6672                                                preamble_type[1], phylen, false);
6673                 txh->RTSDurFallback = cpu_to_le16(durid);
6674
6675                 if (use_cts) {
6676                         rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6677                                                          IEEE80211_STYPE_CTS);
6678
6679                         memcpy(&rts->ra, &h->addr2, ETH_ALEN);
6680                 } else {
6681                         rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6682                                                          IEEE80211_STYPE_RTS);
6683
6684                         memcpy(&rts->ra, &h->addr1, 2 * ETH_ALEN);
6685                 }
6686
6687                 /* mainrate
6688                  *    low 8 bits: main frag rate/mcs,
6689                  *    high 8 bits: rts/cts rate/mcs
6690                  */
6691                 mainrates |= (is_ofdm_rate(rts_rspec[0]) ?
6692                                 D11A_PHY_HDR_GRATE(
6693                                         (struct ofdm_phy_hdr *) rts_plcp) :
6694                                 rts_plcp[0]) << 8;
6695         } else {
6696                 memset(txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
6697                 memset(&txh->rts_frame, 0, sizeof(struct ieee80211_rts));
6698                 memset(txh->RTSPLCPFallback, 0, sizeof(txh->RTSPLCPFallback));
6699                 txh->RTSDurFallback = 0;
6700         }
6701
6702 #ifdef SUPPORT_40MHZ
6703         /* add null delimiter count */
6704         if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && is_mcs_rate(rspec))
6705                 txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM] =
6706                    brcm_c_ampdu_null_delim_cnt(wlc->ampdu, scb, rspec, phylen);
6707
6708 #endif
6709
6710         /*
6711          * Now that RTS/RTS FB preamble types are updated, write
6712          * the final value
6713          */
6714         txh->MacTxControlHigh = cpu_to_le16(mch);
6715
6716         /*
6717          * MainRates (both the rts and frag plcp rates have
6718          * been calculated now)
6719          */
6720         txh->MainRates = cpu_to_le16(mainrates);
6721
6722         /* XtraFrameTypes */
6723         xfts = frametype(rspec[1], wlc->mimoft);
6724         xfts |= (frametype(rts_rspec[0], wlc->mimoft) << XFTS_RTS_FT_SHIFT);
6725         xfts |= (frametype(rts_rspec[1], wlc->mimoft) << XFTS_FBRRTS_FT_SHIFT);
6726         xfts |= CHSPEC_CHANNEL(wlc_phy_chanspec_get(wlc->band->pi)) <<
6727                                                              XFTS_CHANNEL_SHIFT;
6728         txh->XtraFrameTypes = cpu_to_le16(xfts);
6729
6730         /* PhyTxControlWord */
6731         phyctl = frametype(rspec[0], wlc->mimoft);
6732         if ((preamble_type[0] == BRCMS_SHORT_PREAMBLE) ||
6733             (preamble_type[0] == BRCMS_GF_PREAMBLE)) {
6734                 if (rspec2rate(rspec[0]) != BRCM_RATE_1M)
6735                         phyctl |= PHY_TXC_SHORT_HDR;
6736         }
6737
6738         /* phytxant is properly bit shifted */
6739         phyctl |= brcms_c_stf_d11hdrs_phyctl_txant(wlc, rspec[0]);
6740         txh->PhyTxControlWord = cpu_to_le16(phyctl);
6741
6742         /* PhyTxControlWord_1 */
6743         if (BRCMS_PHY_11N_CAP(wlc->band)) {
6744                 u16 phyctl1 = 0;
6745
6746                 phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[0]);
6747                 txh->PhyTxControlWord_1 = cpu_to_le16(phyctl1);
6748                 phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[1]);
6749                 txh->PhyTxControlWord_1_Fbr = cpu_to_le16(phyctl1);
6750
6751                 if (use_rts || use_cts) {
6752                         phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[0]);
6753                         txh->PhyTxControlWord_1_Rts = cpu_to_le16(phyctl1);
6754                         phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[1]);
6755                         txh->PhyTxControlWord_1_FbrRts = cpu_to_le16(phyctl1);
6756                 }
6757
6758                 /*
6759                  * For mcs frames, if mixedmode(overloaded with long preamble)
6760                  * is going to be set, fill in non-zero MModeLen and/or
6761                  * MModeFbrLen it will be unnecessary if they are separated
6762                  */
6763                 if (is_mcs_rate(rspec[0]) &&
6764                     (preamble_type[0] == BRCMS_MM_PREAMBLE)) {
6765                         u16 mmodelen =
6766                             brcms_c_calc_lsig_len(wlc, rspec[0], phylen);
6767                         txh->MModeLen = cpu_to_le16(mmodelen);
6768                 }
6769
6770                 if (is_mcs_rate(rspec[1]) &&
6771                     (preamble_type[1] == BRCMS_MM_PREAMBLE)) {
6772                         u16 mmodefbrlen =
6773                             brcms_c_calc_lsig_len(wlc, rspec[1], phylen);
6774                         txh->MModeFbrLen = cpu_to_le16(mmodefbrlen);
6775                 }
6776         }
6777
6778         ac = skb_get_queue_mapping(p);
6779         if ((scb->flags & SCB_WMECAP) && qos && wlc->edcf_txop[ac]) {
6780                 uint frag_dur, dur, dur_fallback;
6781
6782                 /* WME: Update TXOP threshold */
6783                 if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU) && frag == 0) {
6784                         frag_dur =
6785                             brcms_c_calc_frame_time(wlc, rspec[0],
6786                                         preamble_type[0], phylen);
6787
6788                         if (rts) {
6789                                 /* 1 RTS or CTS-to-self frame */
6790                                 dur =
6791                                     brcms_c_calc_cts_time(wlc, rts_rspec[0],
6792                                                       rts_preamble_type[0]);
6793                                 dur_fallback =
6794                                     brcms_c_calc_cts_time(wlc, rts_rspec[1],
6795                                                       rts_preamble_type[1]);
6796                                 /* (SIFS + CTS) + SIFS + frame + SIFS + ACK */
6797                                 dur += le16_to_cpu(rts->duration);
6798                                 dur_fallback +=
6799                                         le16_to_cpu(txh->RTSDurFallback);
6800                         } else if (use_rifs) {
6801                                 dur = frag_dur;
6802                                 dur_fallback = 0;
6803                         } else {
6804                                 /* frame + SIFS + ACK */
6805                                 dur = frag_dur;
6806                                 dur +=
6807                                     brcms_c_compute_frame_dur(wlc, rspec[0],
6808                                                           preamble_type[0], 0);
6809
6810                                 dur_fallback =
6811                                     brcms_c_calc_frame_time(wlc, rspec[1],
6812                                                         preamble_type[1],
6813                                                         phylen);
6814                                 dur_fallback +=
6815                                     brcms_c_compute_frame_dur(wlc, rspec[1],
6816                                                           preamble_type[1], 0);
6817                         }
6818                         /* NEED to set TxFesTimeNormal (hard) */
6819                         txh->TxFesTimeNormal = cpu_to_le16((u16) dur);
6820                         /*
6821                          * NEED to set fallback rate version of
6822                          * TxFesTimeNormal (hard)
6823                          */
6824                         txh->TxFesTimeFallback =
6825                                 cpu_to_le16((u16) dur_fallback);
6826
6827                         /*
6828                          * update txop byte threshold (txop minus intraframe
6829                          * overhead)
6830                          */
6831                         if (wlc->edcf_txop[ac] >= (dur - frag_dur)) {
6832                                 uint newfragthresh;
6833
6834                                 newfragthresh =
6835                                     brcms_c_calc_frame_len(wlc,
6836                                         rspec[0], preamble_type[0],
6837                                         (wlc->edcf_txop[ac] -
6838                                                 (dur - frag_dur)));
6839                                 /* range bound the fragthreshold */
6840                                 if (newfragthresh < DOT11_MIN_FRAG_LEN)
6841                                         newfragthresh =
6842                                             DOT11_MIN_FRAG_LEN;
6843                                 else if (newfragthresh >
6844                                          wlc->usr_fragthresh)
6845                                         newfragthresh =
6846                                             wlc->usr_fragthresh;
6847                                 /* update the fragthresh and do txc update */
6848                                 if (wlc->fragthresh[queue] !=
6849                                     (u16) newfragthresh)
6850                                         wlc->fragthresh[queue] =
6851                                             (u16) newfragthresh;
6852                         } else {
6853                                 brcms_warn(wlc->hw->d11core,
6854                                            "wl%d: %s txop invalid for rate %d\n",
6855                                            wlc->pub->unit, fifo_names[queue],
6856                                            rspec2rate(rspec[0]));
6857                         }
6858
6859                         if (dur > wlc->edcf_txop[ac])
6860                                 brcms_warn(wlc->hw->d11core,
6861                                            "wl%d: %s: %s txop exceeded phylen %d/%d dur %d/%d\n",
6862                                            wlc->pub->unit, __func__,
6863                                            fifo_names[queue],
6864                                            phylen, wlc->fragthresh[queue],
6865                                            dur, wlc->edcf_txop[ac]);
6866                 }
6867         }
6868
6869         return 0;
6870 }
6871
6872 static int brcms_c_tx(struct brcms_c_info *wlc, struct sk_buff *skb)
6873 {
6874         struct dma_pub *dma;
6875         int fifo, ret = -ENOSPC;
6876         struct d11txh *txh;
6877         u16 frameid = INVALIDFID;
6878
6879         fifo = brcms_ac_to_fifo(skb_get_queue_mapping(skb));
6880         dma = wlc->hw->di[fifo];
6881         txh = (struct d11txh *)(skb->data);
6882
6883         if (dma->txavail == 0) {
6884                 /*
6885                  * We sometimes get a frame from mac80211 after stopping
6886                  * the queues. This only ever seems to be a single frame
6887                  * and is seems likely to be a race. TX_HEADROOM should
6888                  * ensure that we have enough space to handle these stray
6889                  * packets, so warn if there isn't. If we're out of space
6890                  * in the tx ring and the tx queue isn't stopped then
6891                  * we've really got a bug; warn loudly if that happens.
6892                  */
6893                 brcms_warn(wlc->hw->d11core,
6894                            "Received frame for tx with no space in DMA ring\n");
6895                 WARN_ON(!ieee80211_queue_stopped(wlc->pub->ieee_hw,
6896                                                  skb_get_queue_mapping(skb)));
6897                 return -ENOSPC;
6898         }
6899
6900         /* When a BC/MC frame is being committed to the BCMC fifo
6901          * via DMA (NOT PIO), update ucode or BSS info as appropriate.
6902          */
6903         if (fifo == TX_BCMC_FIFO)
6904                 frameid = le16_to_cpu(txh->TxFrameID);
6905
6906         /* Commit BCMC sequence number in the SHM frame ID location */
6907         if (frameid != INVALIDFID) {
6908                 /*
6909                  * To inform the ucode of the last mcast frame posted
6910                  * so that it can clear moredata bit
6911                  */
6912                 brcms_b_write_shm(wlc->hw, M_BCMC_FID, frameid);
6913         }
6914
6915         ret = brcms_c_txfifo(wlc, fifo, skb);
6916         /*
6917          * The only reason for brcms_c_txfifo to fail is because
6918          * there weren't any DMA descriptors, but we've already
6919          * checked for that. So if it does fail yell loudly.
6920          */
6921         WARN_ON_ONCE(ret);
6922
6923         return ret;
6924 }
6925
6926 bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
6927                               struct ieee80211_hw *hw)
6928 {
6929         uint fifo;
6930         struct scb *scb = &wlc->pri_scb;
6931
6932         fifo = brcms_ac_to_fifo(skb_get_queue_mapping(sdu));
6933         brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0);
6934         if (!brcms_c_tx(wlc, sdu))
6935                 return true;
6936
6937         /* packet discarded */
6938         dev_kfree_skb_any(sdu);
6939         return false;
6940 }
6941
6942 int
6943 brcms_c_txfifo(struct brcms_c_info *wlc, uint fifo, struct sk_buff *p)
6944 {
6945         struct dma_pub *dma = wlc->hw->di[fifo];
6946         int ret;
6947         u16 queue;
6948
6949         ret = dma_txfast(wlc, dma, p);
6950         if (ret < 0)
6951                 wiphy_err(wlc->wiphy, "txfifo: fatal, toss frames !!!\n");
6952
6953         /*
6954          * Stop queue if DMA ring is full. Reserve some free descriptors,
6955          * as we sometimes receive a frame from mac80211 after the queues
6956          * are stopped.
6957          */
6958         queue = skb_get_queue_mapping(p);
6959         if (dma->txavail <= TX_HEADROOM && fifo < TX_BCMC_FIFO &&
6960             !ieee80211_queue_stopped(wlc->pub->ieee_hw, queue))
6961                 ieee80211_stop_queue(wlc->pub->ieee_hw, queue);
6962
6963         return ret;
6964 }
6965
6966 u32
6967 brcms_c_rspec_to_rts_rspec(struct brcms_c_info *wlc, u32 rspec,
6968                            bool use_rspec, u16 mimo_ctlchbw)
6969 {
6970         u32 rts_rspec = 0;
6971
6972         if (use_rspec)
6973                 /* use frame rate as rts rate */
6974                 rts_rspec = rspec;
6975         else if (wlc->band->gmode && wlc->protection->_g && !is_cck_rate(rspec))
6976                 /* Use 11Mbps as the g protection RTS target rate and fallback.
6977                  * Use the brcms_basic_rate() lookup to find the best basic rate
6978                  * under the target in case 11 Mbps is not Basic.
6979                  * 6 and 9 Mbps are not usually selected by rate selection, but
6980                  * even if the OFDM rate we are protecting is 6 or 9 Mbps, 11
6981                  * is more robust.
6982                  */
6983                 rts_rspec = brcms_basic_rate(wlc, BRCM_RATE_11M);
6984         else
6985                 /* calculate RTS rate and fallback rate based on the frame rate
6986                  * RTS must be sent at a basic rate since it is a
6987                  * control frame, sec 9.6 of 802.11 spec
6988                  */
6989                 rts_rspec = brcms_basic_rate(wlc, rspec);
6990
6991         if (BRCMS_PHY_11N_CAP(wlc->band)) {
6992                 /* set rts txbw to correct side band */
6993                 rts_rspec &= ~RSPEC_BW_MASK;
6994
6995                 /*
6996                  * if rspec/rspec_fallback is 40MHz, then send RTS on both
6997                  * 20MHz channel (DUP), otherwise send RTS on control channel
6998                  */
6999                 if (rspec_is40mhz(rspec) && !is_cck_rate(rts_rspec))
7000                         rts_rspec |= (PHY_TXC1_BW_40MHZ_DUP << RSPEC_BW_SHIFT);
7001                 else
7002                         rts_rspec |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
7003
7004                 /* pick siso/cdd as default for ofdm */
7005                 if (is_ofdm_rate(rts_rspec)) {
7006                         rts_rspec &= ~RSPEC_STF_MASK;
7007                         rts_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
7008                 }
7009         }
7010         return rts_rspec;
7011 }
7012
7013 /* Update beacon listen interval in shared memory */
7014 static void brcms_c_bcn_li_upd(struct brcms_c_info *wlc)
7015 {
7016         /* wake up every DTIM is the default */
7017         if (wlc->bcn_li_dtim == 1)
7018                 brcms_b_write_shm(wlc->hw, M_BCN_LI, 0);
7019         else
7020                 brcms_b_write_shm(wlc->hw, M_BCN_LI,
7021                               (wlc->bcn_li_dtim << 8) | wlc->bcn_li_bcn);
7022 }
7023
7024 static void
7025 brcms_b_read_tsf(struct brcms_hardware *wlc_hw, u32 *tsf_l_ptr,
7026                   u32 *tsf_h_ptr)
7027 {
7028         struct bcma_device *core = wlc_hw->d11core;
7029
7030         /* read the tsf timer low, then high to get an atomic read */
7031         *tsf_l_ptr = bcma_read32(core, D11REGOFFS(tsf_timerlow));
7032         *tsf_h_ptr = bcma_read32(core, D11REGOFFS(tsf_timerhigh));
7033 }
7034
7035 /*
7036  * recover 64bit TSF value from the 16bit TSF value in the rx header
7037  * given the assumption that the TSF passed in header is within 65ms
7038  * of the current tsf.
7039  *
7040  * 6       5       4       4       3       2       1
7041  * 3.......6.......8.......0.......2.......4.......6.......8......0
7042  * |<---------- tsf_h ----------->||<--- tsf_l -->||<-RxTSFTime ->|
7043  *
7044  * The RxTSFTime are the lowest 16 bits and provided by the ucode. The
7045  * tsf_l is filled in by brcms_b_recv, which is done earlier in the
7046  * receive call sequence after rx interrupt. Only the higher 16 bits
7047  * are used. Finally, the tsf_h is read from the tsf register.
7048  */
7049 static u64 brcms_c_recover_tsf64(struct brcms_c_info *wlc,
7050                                  struct d11rxhdr *rxh)
7051 {
7052         u32 tsf_h, tsf_l;
7053         u16 rx_tsf_0_15, rx_tsf_16_31;
7054
7055         brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7056
7057         rx_tsf_16_31 = (u16)(tsf_l >> 16);
7058         rx_tsf_0_15 = rxh->RxTSFTime;
7059
7060         /*
7061          * a greater tsf time indicates the low 16 bits of
7062          * tsf_l wrapped, so decrement the high 16 bits.
7063          */
7064         if ((u16)tsf_l < rx_tsf_0_15) {
7065                 rx_tsf_16_31 -= 1;
7066                 if (rx_tsf_16_31 == 0xffff)
7067                         tsf_h -= 1;
7068         }
7069
7070         return ((u64)tsf_h << 32) | (((u32)rx_tsf_16_31 << 16) + rx_tsf_0_15);
7071 }
7072
7073 static void
7074 prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7075                      struct sk_buff *p,
7076                      struct ieee80211_rx_status *rx_status)
7077 {
7078         int preamble;
7079         int channel;
7080         u32 rspec;
7081         unsigned char *plcp;
7082
7083         /* fill in TSF and flag its presence */
7084         rx_status->mactime = brcms_c_recover_tsf64(wlc, rxh);
7085         rx_status->flag |= RX_FLAG_MACTIME_START;
7086
7087         channel = BRCMS_CHAN_CHANNEL(rxh->RxChan);
7088
7089         rx_status->band =
7090                 channel > 14 ? IEEE80211_BAND_5GHZ : IEEE80211_BAND_2GHZ;
7091         rx_status->freq =
7092                 ieee80211_channel_to_frequency(channel, rx_status->band);
7093
7094         rx_status->signal = wlc_phy_rssi_compute(wlc->hw->band->pi, rxh);
7095
7096         /* noise */
7097         /* qual */
7098         rx_status->antenna =
7099                 (rxh->PhyRxStatus_0 & PRXS0_RXANT_UPSUBBAND) ? 1 : 0;
7100
7101         plcp = p->data;
7102
7103         rspec = brcms_c_compute_rspec(rxh, plcp);
7104         if (is_mcs_rate(rspec)) {
7105                 rx_status->rate_idx = rspec & RSPEC_RATE_MASK;
7106                 rx_status->flag |= RX_FLAG_HT;
7107                 if (rspec_is40mhz(rspec))
7108                         rx_status->flag |= RX_FLAG_40MHZ;
7109         } else {
7110                 switch (rspec2rate(rspec)) {
7111                 case BRCM_RATE_1M:
7112                         rx_status->rate_idx = 0;
7113                         break;
7114                 case BRCM_RATE_2M:
7115                         rx_status->rate_idx = 1;
7116                         break;
7117                 case BRCM_RATE_5M5:
7118                         rx_status->rate_idx = 2;
7119                         break;
7120                 case BRCM_RATE_11M:
7121                         rx_status->rate_idx = 3;
7122                         break;
7123                 case BRCM_RATE_6M:
7124                         rx_status->rate_idx = 4;
7125                         break;
7126                 case BRCM_RATE_9M:
7127                         rx_status->rate_idx = 5;
7128                         break;
7129                 case BRCM_RATE_12M:
7130                         rx_status->rate_idx = 6;
7131                         break;
7132                 case BRCM_RATE_18M:
7133                         rx_status->rate_idx = 7;
7134                         break;
7135                 case BRCM_RATE_24M:
7136                         rx_status->rate_idx = 8;
7137                         break;
7138                 case BRCM_RATE_36M:
7139                         rx_status->rate_idx = 9;
7140                         break;
7141                 case BRCM_RATE_48M:
7142                         rx_status->rate_idx = 10;
7143                         break;
7144                 case BRCM_RATE_54M:
7145                         rx_status->rate_idx = 11;
7146                         break;
7147                 default:
7148                         brcms_err(wlc->hw->d11core,
7149                                   "%s: Unknown rate\n", __func__);
7150                 }
7151
7152                 /*
7153                  * For 5GHz, we should decrease the index as it is
7154                  * a subset of the 2.4G rates. See bitrates field
7155                  * of brcms_band_5GHz_nphy (in mac80211_if.c).
7156                  */
7157                 if (rx_status->band == IEEE80211_BAND_5GHZ)
7158                         rx_status->rate_idx -= BRCMS_LEGACY_5G_RATE_OFFSET;
7159
7160                 /* Determine short preamble and rate_idx */
7161                 preamble = 0;
7162                 if (is_cck_rate(rspec)) {
7163                         if (rxh->PhyRxStatus_0 & PRXS0_SHORTH)
7164                                 rx_status->flag |= RX_FLAG_SHORTPRE;
7165                 } else if (is_ofdm_rate(rspec)) {
7166                         rx_status->flag |= RX_FLAG_SHORTPRE;
7167                 } else {
7168                         brcms_err(wlc->hw->d11core, "%s: Unknown modulation\n",
7169                                   __func__);
7170                 }
7171         }
7172
7173         if (plcp3_issgi(plcp[3]))
7174                 rx_status->flag |= RX_FLAG_SHORT_GI;
7175
7176         if (rxh->RxStatus1 & RXS_DECERR) {
7177                 rx_status->flag |= RX_FLAG_FAILED_PLCP_CRC;
7178                 brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_PLCP_CRC\n",
7179                           __func__);
7180         }
7181         if (rxh->RxStatus1 & RXS_FCSERR) {
7182                 rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
7183                 brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_FCS_CRC\n",
7184                           __func__);
7185         }
7186 }
7187
7188 static void
7189 brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7190                 struct sk_buff *p)
7191 {
7192         int len_mpdu;
7193         struct ieee80211_rx_status rx_status;
7194         struct ieee80211_hdr *hdr;
7195
7196         memset(&rx_status, 0, sizeof(rx_status));
7197         prep_mac80211_status(wlc, rxh, p, &rx_status);
7198
7199         /* mac header+body length, exclude CRC and plcp header */
7200         len_mpdu = p->len - D11_PHY_HDR_LEN - FCS_LEN;
7201         skb_pull(p, D11_PHY_HDR_LEN);
7202         __skb_trim(p, len_mpdu);
7203
7204         /* unmute transmit */
7205         if (wlc->hw->suspended_fifos) {
7206                 hdr = (struct ieee80211_hdr *)p->data;
7207                 if (ieee80211_is_beacon(hdr->frame_control))
7208                         brcms_b_mute(wlc->hw, false);
7209         }
7210
7211         memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
7212         ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
7213 }
7214
7215 /* calculate frame duration for Mixed-mode L-SIG spoofing, return
7216  * number of bytes goes in the length field
7217  *
7218  * Formula given by HT PHY Spec v 1.13
7219  *   len = 3(nsyms + nstream + 3) - 3
7220  */
7221 u16
7222 brcms_c_calc_lsig_len(struct brcms_c_info *wlc, u32 ratespec,
7223                       uint mac_len)
7224 {
7225         uint nsyms, len = 0, kNdps;
7226
7227         if (is_mcs_rate(ratespec)) {
7228                 uint mcs = ratespec & RSPEC_RATE_MASK;
7229                 int tot_streams = (mcs_2_txstreams(mcs) + 1) +
7230                                   rspec_stc(ratespec);
7231
7232                 /*
7233                  * the payload duration calculation matches that
7234                  * of regular ofdm
7235                  */
7236                 /* 1000Ndbps = kbps * 4 */
7237                 kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
7238                                    rspec_issgi(ratespec)) * 4;
7239
7240                 if (rspec_stc(ratespec) == 0)
7241                         nsyms =
7242                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7243                                   APHY_TAIL_NBITS) * 1000, kNdps);
7244                 else
7245                         /* STBC needs to have even number of symbols */
7246                         nsyms =
7247                             2 *
7248                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7249                                   APHY_TAIL_NBITS) * 1000, 2 * kNdps);
7250
7251                 /* (+3) account for HT-SIG(2) and HT-STF(1) */
7252                 nsyms += (tot_streams + 3);
7253                 /*
7254                  * 3 bytes/symbol @ legacy 6Mbps rate
7255                  * (-3) excluding service bits and tail bits
7256                  */
7257                 len = (3 * nsyms) - 3;
7258         }
7259
7260         return (u16) len;
7261 }
7262
7263 static void
7264 brcms_c_mod_prb_rsp_rate_table(struct brcms_c_info *wlc, uint frame_len)
7265 {
7266         const struct brcms_c_rateset *rs_dflt;
7267         struct brcms_c_rateset rs;
7268         u8 rate;
7269         u16 entry_ptr;
7270         u8 plcp[D11_PHY_HDR_LEN];
7271         u16 dur, sifs;
7272         uint i;
7273
7274         sifs = get_sifs(wlc->band);
7275
7276         rs_dflt = brcms_c_rateset_get_hwrs(wlc);
7277
7278         brcms_c_rateset_copy(rs_dflt, &rs);
7279         brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
7280
7281         /*
7282          * walk the phy rate table and update MAC core SHM
7283          * basic rate table entries
7284          */
7285         for (i = 0; i < rs.count; i++) {
7286                 rate = rs.rates[i] & BRCMS_RATE_MASK;
7287
7288                 entry_ptr = brcms_b_rate_shm_offset(wlc->hw, rate);
7289
7290                 /* Calculate the Probe Response PLCP for the given rate */
7291                 brcms_c_compute_plcp(wlc, rate, frame_len, plcp);
7292
7293                 /*
7294                  * Calculate the duration of the Probe Response
7295                  * frame plus SIFS for the MAC
7296                  */
7297                 dur = (u16) brcms_c_calc_frame_time(wlc, rate,
7298                                                 BRCMS_LONG_PREAMBLE, frame_len);
7299                 dur += sifs;
7300
7301                 /* Update the SHM Rate Table entry Probe Response values */
7302                 brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS,
7303                               (u16) (plcp[0] + (plcp[1] << 8)));
7304                 brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS + 2,
7305                               (u16) (plcp[2] + (plcp[3] << 8)));
7306                 brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_DUR_POS, dur);
7307         }
7308 }
7309
7310 /*      Max buffering needed for beacon template/prb resp template is 142 bytes.
7311  *
7312  *      PLCP header is 6 bytes.
7313  *      802.11 A3 header is 24 bytes.
7314  *      Max beacon frame body template length is 112 bytes.
7315  *      Max probe resp frame body template length is 110 bytes.
7316  *
7317  *      *len on input contains the max length of the packet available.
7318  *
7319  *      The *len value is set to the number of bytes in buf used, and starts
7320  *      with the PLCP and included up to, but not including, the 4 byte FCS.
7321  */
7322 static void
7323 brcms_c_bcn_prb_template(struct brcms_c_info *wlc, u16 type,
7324                          u32 bcn_rspec,
7325                          struct brcms_bss_cfg *cfg, u16 *buf, int *len)
7326 {
7327         static const u8 ether_bcast[ETH_ALEN] = {255, 255, 255, 255, 255, 255};
7328         struct cck_phy_hdr *plcp;
7329         struct ieee80211_mgmt *h;
7330         int hdr_len, body_len;
7331
7332         hdr_len = D11_PHY_HDR_LEN + DOT11_MAC_HDR_LEN;
7333
7334         /* calc buffer size provided for frame body */
7335         body_len = *len - hdr_len;
7336         /* return actual size */
7337         *len = hdr_len + body_len;
7338
7339         /* format PHY and MAC headers */
7340         memset(buf, 0, hdr_len);
7341
7342         plcp = (struct cck_phy_hdr *) buf;
7343
7344         /*
7345          * PLCP for Probe Response frames are filled in from
7346          * core's rate table
7347          */
7348         if (type == IEEE80211_STYPE_BEACON)
7349                 /* fill in PLCP */
7350                 brcms_c_compute_plcp(wlc, bcn_rspec,
7351                                  (DOT11_MAC_HDR_LEN + body_len + FCS_LEN),
7352                                  (u8 *) plcp);
7353
7354         /* "Regular" and 16 MBSS but not for 4 MBSS */
7355         /* Update the phytxctl for the beacon based on the rspec */
7356         brcms_c_beacon_phytxctl_txant_upd(wlc, bcn_rspec);
7357
7358         h = (struct ieee80211_mgmt *)&plcp[1];
7359
7360         /* fill in 802.11 header */
7361         h->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | type);
7362
7363         /* DUR is 0 for multicast bcn, or filled in by MAC for prb resp */
7364         /* A1 filled in by MAC for prb resp, broadcast for bcn */
7365         if (type == IEEE80211_STYPE_BEACON)
7366                 memcpy(&h->da, &ether_bcast, ETH_ALEN);
7367         memcpy(&h->sa, &wlc->pub->cur_etheraddr, ETH_ALEN);
7368         memcpy(&h->bssid, &cfg->BSSID, ETH_ALEN);
7369
7370         /* SEQ filled in by MAC */
7371 }
7372
7373 int brcms_c_get_header_len(void)
7374 {
7375         return TXOFF;
7376 }
7377
7378 /*
7379  * Update all beacons for the system.
7380  */
7381 void brcms_c_update_beacon(struct brcms_c_info *wlc)
7382 {
7383         struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7384
7385         if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
7386                              bsscfg->type == BRCMS_TYPE_ADHOC))
7387                 /* Clear the soft intmask */
7388                 wlc->defmacintmask &= ~MI_BCNTPL;
7389 }
7390
7391 /* Write ssid into shared memory */
7392 static void
7393 brcms_c_shm_ssid_upd(struct brcms_c_info *wlc, struct brcms_bss_cfg *cfg)
7394 {
7395         u8 *ssidptr = cfg->SSID;
7396         u16 base = M_SSID;
7397         u8 ssidbuf[IEEE80211_MAX_SSID_LEN];
7398
7399         /* padding the ssid with zero and copy it into shm */
7400         memset(ssidbuf, 0, IEEE80211_MAX_SSID_LEN);
7401         memcpy(ssidbuf, ssidptr, cfg->SSID_len);
7402
7403         brcms_c_copyto_shm(wlc, base, ssidbuf, IEEE80211_MAX_SSID_LEN);
7404         brcms_b_write_shm(wlc->hw, M_SSIDLEN, (u16) cfg->SSID_len);
7405 }
7406
7407 static void
7408 brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
7409                               struct brcms_bss_cfg *cfg,
7410                               bool suspend)
7411 {
7412         u16 *prb_resp;
7413         int len = BCN_TMPL_LEN;
7414
7415         prb_resp = kmalloc(BCN_TMPL_LEN, GFP_ATOMIC);
7416         if (!prb_resp)
7417                 return;
7418
7419         /*
7420          * write the probe response to hardware, or save in
7421          * the config structure
7422          */
7423
7424         /* create the probe response template */
7425         brcms_c_bcn_prb_template(wlc, IEEE80211_STYPE_PROBE_RESP, 0,
7426                                  cfg, prb_resp, &len);
7427
7428         if (suspend)
7429                 brcms_c_suspend_mac_and_wait(wlc);
7430
7431         /* write the probe response into the template region */
7432         brcms_b_write_template_ram(wlc->hw, T_PRS_TPL_BASE,
7433                                     (len + 3) & ~3, prb_resp);
7434
7435         /* write the length of the probe response frame (+PLCP/-FCS) */
7436         brcms_b_write_shm(wlc->hw, M_PRB_RESP_FRM_LEN, (u16) len);
7437
7438         /* write the SSID and SSID length */
7439         brcms_c_shm_ssid_upd(wlc, cfg);
7440
7441         /*
7442          * Write PLCP headers and durations for probe response frames
7443          * at all rates. Use the actual frame length covered by the
7444          * PLCP header for the call to brcms_c_mod_prb_rsp_rate_table()
7445          * by subtracting the PLCP len and adding the FCS.
7446          */
7447         len += (-D11_PHY_HDR_LEN + FCS_LEN);
7448         brcms_c_mod_prb_rsp_rate_table(wlc, (u16) len);
7449
7450         if (suspend)
7451                 brcms_c_enable_mac(wlc);
7452
7453         kfree(prb_resp);
7454 }
7455
7456 void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
7457 {
7458         struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7459
7460         /* update AP or IBSS probe responses */
7461         if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
7462                              bsscfg->type == BRCMS_TYPE_ADHOC))
7463                 brcms_c_bss_update_probe_resp(wlc, bsscfg, suspend);
7464 }
7465
7466 int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo,
7467                            uint *blocks)
7468 {
7469         if (fifo >= NFIFO)
7470                 return -EINVAL;
7471
7472         *blocks = wlc_hw->xmtfifo_sz[fifo];
7473
7474         return 0;
7475 }
7476
7477 void
7478 brcms_c_set_addrmatch(struct brcms_c_info *wlc, int match_reg_offset,
7479                   const u8 *addr)
7480 {
7481         brcms_b_set_addrmatch(wlc->hw, match_reg_offset, addr);
7482         if (match_reg_offset == RCM_BSSID_OFFSET)
7483                 memcpy(wlc->bsscfg->BSSID, addr, ETH_ALEN);
7484 }
7485
7486 /*
7487  * Flag 'scan in progress' to withhold dynamic phy calibration
7488  */
7489 void brcms_c_scan_start(struct brcms_c_info *wlc)
7490 {
7491         wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, true);
7492 }
7493
7494 void brcms_c_scan_stop(struct brcms_c_info *wlc)
7495 {
7496         wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, false);
7497 }
7498
7499 void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state)
7500 {
7501         wlc->pub->associated = state;
7502 }
7503
7504 /*
7505  * When a remote STA/AP is removed by Mac80211, or when it can no longer accept
7506  * AMPDU traffic, packets pending in hardware have to be invalidated so that
7507  * when later on hardware releases them, they can be handled appropriately.
7508  */
7509 void brcms_c_inval_dma_pkts(struct brcms_hardware *hw,
7510                                struct ieee80211_sta *sta,
7511                                void (*dma_callback_fn))
7512 {
7513         struct dma_pub *dmah;
7514         int i;
7515         for (i = 0; i < NFIFO; i++) {
7516                 dmah = hw->di[i];
7517                 if (dmah != NULL)
7518                         dma_walk_packets(dmah, dma_callback_fn, sta);
7519         }
7520 }
7521
7522 int brcms_c_get_curband(struct brcms_c_info *wlc)
7523 {
7524         return wlc->band->bandunit;
7525 }
7526
7527 bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc)
7528 {
7529         int i;
7530
7531         /* Kick DMA to send any pending AMPDU */
7532         for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
7533                 if (wlc->hw->di[i])
7534                         dma_kick_tx(wlc->hw->di[i]);
7535
7536         return !brcms_txpktpendtot(wlc);
7537 }
7538
7539 void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
7540 {
7541         wlc->bcn_li_bcn = interval;
7542         if (wlc->pub->up)
7543                 brcms_c_bcn_li_upd(wlc);
7544 }
7545
7546 u64 brcms_c_tsf_get(struct brcms_c_info *wlc)
7547 {
7548         u32 tsf_h, tsf_l;
7549         u64 tsf;
7550
7551         brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7552
7553         tsf = tsf_h;
7554         tsf <<= 32;
7555         tsf |= tsf_l;
7556
7557         return tsf;
7558 }
7559
7560 void brcms_c_tsf_set(struct brcms_c_info *wlc, u64 tsf)
7561 {
7562         u32 tsf_h, tsf_l;
7563
7564         brcms_c_time_lock(wlc);
7565
7566         tsf_l = tsf;
7567         tsf_h = (tsf >> 32);
7568
7569         /* read the tsf timer low, then high to get an atomic read */
7570         bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerlow), tsf_l);
7571         bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerhigh), tsf_h);
7572
7573         brcms_c_time_unlock(wlc);
7574 }
7575
7576 int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr)
7577 {
7578         uint qdbm;
7579
7580         /* Remove override bit and clip to max qdbm value */
7581         qdbm = min_t(uint, txpwr * BRCMS_TXPWR_DB_FACTOR, 0xff);
7582         return wlc_phy_txpower_set(wlc->band->pi, qdbm, false);
7583 }
7584
7585 int brcms_c_get_tx_power(struct brcms_c_info *wlc)
7586 {
7587         uint qdbm;
7588         bool override;
7589
7590         wlc_phy_txpower_get(wlc->band->pi, &qdbm, &override);
7591
7592         /* Return qdbm units */
7593         return (int)(qdbm / BRCMS_TXPWR_DB_FACTOR);
7594 }
7595
7596 /* Process received frames */
7597 /*
7598  * Return true if more frames need to be processed. false otherwise.
7599  * Param 'bound' indicates max. # frames to process before break out.
7600  */
7601 static void brcms_c_recv(struct brcms_c_info *wlc, struct sk_buff *p)
7602 {
7603         struct d11rxhdr *rxh;
7604         struct ieee80211_hdr *h;
7605         uint len;
7606         bool is_amsdu;
7607
7608         /* frame starts with rxhdr */
7609         rxh = (struct d11rxhdr *) (p->data);
7610
7611         /* strip off rxhdr */
7612         skb_pull(p, BRCMS_HWRXOFF);
7613
7614         /* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU subframes */
7615         if (rxh->RxStatus1 & RXS_PBPRES) {
7616                 if (p->len < 2) {
7617                         brcms_err(wlc->hw->d11core,
7618                                   "wl%d: recv: rcvd runt of len %d\n",
7619                                   wlc->pub->unit, p->len);
7620                         goto toss;
7621                 }
7622                 skb_pull(p, 2);
7623         }
7624
7625         h = (struct ieee80211_hdr *)(p->data + D11_PHY_HDR_LEN);
7626         len = p->len;
7627
7628         if (rxh->RxStatus1 & RXS_FCSERR) {
7629                 if (!(wlc->filter_flags & FIF_FCSFAIL))
7630                         goto toss;
7631         }
7632
7633         /* check received pkt has at least frame control field */
7634         if (len < D11_PHY_HDR_LEN + sizeof(h->frame_control))
7635                 goto toss;
7636
7637         /* not supporting A-MSDU */
7638         is_amsdu = rxh->RxStatus2 & RXS_AMSDU_MASK;
7639         if (is_amsdu)
7640                 goto toss;
7641
7642         brcms_c_recvctl(wlc, rxh, p);
7643         return;
7644
7645  toss:
7646         brcmu_pkt_buf_free_skb(p);
7647 }
7648
7649 /* Process received frames */
7650 /*
7651  * Return true if more frames need to be processed. false otherwise.
7652  * Param 'bound' indicates max. # frames to process before break out.
7653  */
7654 static bool
7655 brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
7656 {
7657         struct sk_buff *p;
7658         struct sk_buff *next = NULL;
7659         struct sk_buff_head recv_frames;
7660
7661         uint n = 0;
7662         uint bound_limit = bound ? RXBND : -1;
7663         bool morepending = false;
7664
7665         skb_queue_head_init(&recv_frames);
7666
7667         /* gather received frames */
7668         do {
7669                 /* !give others some time to run! */
7670                 if (n >= bound_limit)
7671                         break;
7672
7673                 morepending = dma_rx(wlc_hw->di[fifo], &recv_frames);
7674                 n++;
7675         } while (morepending);
7676
7677         /* post more rbufs */
7678         dma_rxfill(wlc_hw->di[fifo]);
7679
7680         /* process each frame */
7681         skb_queue_walk_safe(&recv_frames, p, next) {
7682                 struct d11rxhdr_le *rxh_le;
7683                 struct d11rxhdr *rxh;
7684
7685                 skb_unlink(p, &recv_frames);
7686                 rxh_le = (struct d11rxhdr_le *)p->data;
7687                 rxh = (struct d11rxhdr *)p->data;
7688
7689                 /* fixup rx header endianness */
7690                 rxh->RxFrameSize = le16_to_cpu(rxh_le->RxFrameSize);
7691                 rxh->PhyRxStatus_0 = le16_to_cpu(rxh_le->PhyRxStatus_0);
7692                 rxh->PhyRxStatus_1 = le16_to_cpu(rxh_le->PhyRxStatus_1);
7693                 rxh->PhyRxStatus_2 = le16_to_cpu(rxh_le->PhyRxStatus_2);
7694                 rxh->PhyRxStatus_3 = le16_to_cpu(rxh_le->PhyRxStatus_3);
7695                 rxh->PhyRxStatus_4 = le16_to_cpu(rxh_le->PhyRxStatus_4);
7696                 rxh->PhyRxStatus_5 = le16_to_cpu(rxh_le->PhyRxStatus_5);
7697                 rxh->RxStatus1 = le16_to_cpu(rxh_le->RxStatus1);
7698                 rxh->RxStatus2 = le16_to_cpu(rxh_le->RxStatus2);
7699                 rxh->RxTSFTime = le16_to_cpu(rxh_le->RxTSFTime);
7700                 rxh->RxChan = le16_to_cpu(rxh_le->RxChan);
7701
7702                 brcms_c_recv(wlc_hw->wlc, p);
7703         }
7704
7705         return morepending;
7706 }
7707
7708 /* second-level interrupt processing
7709  *   Return true if another dpc needs to be re-scheduled. false otherwise.
7710  *   Param 'bounded' indicates if applicable loops should be bounded.
7711  */
7712 bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded)
7713 {
7714         u32 macintstatus;
7715         struct brcms_hardware *wlc_hw = wlc->hw;
7716         struct bcma_device *core = wlc_hw->d11core;
7717
7718         if (brcms_deviceremoved(wlc)) {
7719                 brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
7720                           __func__);
7721                 brcms_down(wlc->wl);
7722                 return false;
7723         }
7724
7725         /* grab and clear the saved software intstatus bits */
7726         macintstatus = wlc->macintstatus;
7727         wlc->macintstatus = 0;
7728
7729         brcms_dbg_int(core, "wl%d: macintstatus 0x%x\n",
7730                       wlc_hw->unit, macintstatus);
7731
7732         WARN_ON(macintstatus & MI_PRQ); /* PRQ Interrupt in non-MBSS */
7733
7734         /* tx status */
7735         if (macintstatus & MI_TFS) {
7736                 bool fatal;
7737                 if (brcms_b_txstatus(wlc->hw, bounded, &fatal))
7738                         wlc->macintstatus |= MI_TFS;
7739                 if (fatal) {
7740                         brcms_err(core, "MI_TFS: fatal\n");
7741                         goto fatal;
7742                 }
7743         }
7744
7745         if (macintstatus & (MI_TBTT | MI_DTIM_TBTT))
7746                 brcms_c_tbtt(wlc);
7747
7748         /* ATIM window end */
7749         if (macintstatus & MI_ATIMWINEND) {
7750                 brcms_dbg_info(core, "end of ATIM window\n");
7751                 bcma_set32(core, D11REGOFFS(maccommand), wlc->qvalid);
7752                 wlc->qvalid = 0;
7753         }
7754
7755         /*
7756          * received data or control frame, MI_DMAINT is
7757          * indication of RX_FIFO interrupt
7758          */
7759         if (macintstatus & MI_DMAINT)
7760                 if (brcms_b_recv(wlc_hw, RX_FIFO, bounded))
7761                         wlc->macintstatus |= MI_DMAINT;
7762
7763         /* noise sample collected */
7764         if (macintstatus & MI_BG_NOISE)
7765                 wlc_phy_noise_sample_intr(wlc_hw->band->pi);
7766
7767         if (macintstatus & MI_GP0) {
7768                 brcms_err(core, "wl%d: PSM microcode watchdog fired at %d "
7769                           "(seconds). Resetting.\n", wlc_hw->unit, wlc_hw->now);
7770
7771                 printk_once("%s : PSM Watchdog, chipid 0x%x, chiprev 0x%x\n",
7772                             __func__, ai_get_chip_id(wlc_hw->sih),
7773                             ai_get_chiprev(wlc_hw->sih));
7774                 brcms_fatal_error(wlc_hw->wlc->wl);
7775         }
7776
7777         /* gptimer timeout */
7778         if (macintstatus & MI_TO)
7779                 bcma_write32(core, D11REGOFFS(gptimer), 0);
7780
7781         if (macintstatus & MI_RFDISABLE) {
7782                 brcms_dbg_info(core, "wl%d: BMAC Detected a change on the"
7783                                " RF Disable Input\n", wlc_hw->unit);
7784                 brcms_rfkill_set_hw_state(wlc->wl);
7785         }
7786
7787         /* it isn't done and needs to be resched if macintstatus is non-zero */
7788         return wlc->macintstatus != 0;
7789
7790  fatal:
7791         brcms_fatal_error(wlc_hw->wlc->wl);
7792         return wlc->macintstatus != 0;
7793 }
7794
7795 void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx)
7796 {
7797         struct bcma_device *core = wlc->hw->d11core;
7798         struct ieee80211_channel *ch = wlc->pub->ieee_hw->conf.channel;
7799         u16 chanspec;
7800
7801         brcms_dbg_info(core, "wl%d\n", wlc->pub->unit);
7802
7803         chanspec = ch20mhz_chspec(ch->hw_value);
7804
7805         brcms_b_init(wlc->hw, chanspec);
7806
7807         /* update beacon listen interval */
7808         brcms_c_bcn_li_upd(wlc);
7809
7810         /* write ethernet address to core */
7811         brcms_c_set_mac(wlc->bsscfg);
7812         brcms_c_set_bssid(wlc->bsscfg);
7813
7814         /* Update tsf_cfprep if associated and up */
7815         if (wlc->pub->associated && wlc->pub->up) {
7816                 u32 bi;
7817
7818                 /* get beacon period and convert to uS */
7819                 bi = wlc->bsscfg->current_bss->beacon_period << 10;
7820                 /*
7821                  * update since init path would reset
7822                  * to default value
7823                  */
7824                 bcma_write32(core, D11REGOFFS(tsf_cfprep),
7825                              bi << CFPREP_CBI_SHIFT);
7826
7827                 /* Update maccontrol PM related bits */
7828                 brcms_c_set_ps_ctrl(wlc);
7829         }
7830
7831         brcms_c_bandinit_ordered(wlc, chanspec);
7832
7833         /* init probe response timeout */
7834         brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
7835
7836         /* init max burst txop (framebursting) */
7837         brcms_b_write_shm(wlc->hw, M_MBURST_TXOP,
7838                       (wlc->
7839                        _rifs ? (EDCF_AC_VO_TXOP_AP << 5) : MAXFRAMEBURST_TXOP));
7840
7841         /* initialize maximum allowed duty cycle */
7842         brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_ofdm, true, true);
7843         brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_cck, false, true);
7844
7845         /*
7846          * Update some shared memory locations related to
7847          * max AMPDU size allowed to received
7848          */
7849         brcms_c_ampdu_shm_upd(wlc->ampdu);
7850
7851         /* band-specific inits */
7852         brcms_c_bsinit(wlc);
7853
7854         /* Enable EDCF mode (while the MAC is suspended) */
7855         bcma_set16(core, D11REGOFFS(ifs_ctl), IFS_USEEDCF);
7856         brcms_c_edcf_setparams(wlc, false);
7857
7858         /* read the ucode version if we have not yet done so */
7859         if (wlc->ucode_rev == 0) {
7860                 u16 rev;
7861                 u16 patch;
7862
7863                 rev = brcms_b_read_shm(wlc->hw, M_BOM_REV_MAJOR);
7864                 patch = brcms_b_read_shm(wlc->hw, M_BOM_REV_MINOR);
7865                 wlc->ucode_rev = (rev << NBITS(u16)) | patch;
7866                 snprintf(wlc->wiphy->fw_version,
7867                          sizeof(wlc->wiphy->fw_version), "%u.%u", rev, patch);
7868         }
7869
7870         /* ..now really unleash hell (allow the MAC out of suspend) */
7871         brcms_c_enable_mac(wlc);
7872
7873         /* suspend the tx fifos and mute the phy for preism cac time */
7874         if (mute_tx)
7875                 brcms_b_mute(wlc->hw, true);
7876
7877         /* enable the RF Disable Delay timer */
7878         bcma_write32(core, D11REGOFFS(rfdisabledly), RFDISABLE_DEFAULT);
7879
7880         /*
7881          * Initialize WME parameters; if they haven't been set by some other
7882          * mechanism (IOVar, etc) then read them from the hardware.
7883          */
7884         if (GFIELD(wlc->wme_retries[0], EDCF_SHORT) == 0) {
7885                 /* Uninitialized; read from HW */
7886                 int ac;
7887
7888                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
7889                         wlc->wme_retries[ac] =
7890                             brcms_b_read_shm(wlc->hw, M_AC_TXLMT_ADDR(ac));
7891         }
7892 }
7893
7894 /*
7895  * The common driver entry routine. Error codes should be unique
7896  */
7897 struct brcms_c_info *
7898 brcms_c_attach(struct brcms_info *wl, struct bcma_device *core, uint unit,
7899                bool piomode, uint *perr)
7900 {
7901         struct brcms_c_info *wlc;
7902         uint err = 0;
7903         uint i, j;
7904         struct brcms_pub *pub;
7905
7906         /* allocate struct brcms_c_info state and its substructures */
7907         wlc = brcms_c_attach_malloc(unit, &err, 0);
7908         if (wlc == NULL)
7909                 goto fail;
7910         wlc->wiphy = wl->wiphy;
7911         pub = wlc->pub;
7912
7913 #if defined(DEBUG)
7914         wlc_info_dbg = wlc;
7915 #endif
7916
7917         wlc->band = wlc->bandstate[0];
7918         wlc->core = wlc->corestate;
7919         wlc->wl = wl;
7920         pub->unit = unit;
7921         pub->_piomode = piomode;
7922         wlc->bandinit_pending = false;
7923
7924         /* populate struct brcms_c_info with default values  */
7925         brcms_c_info_init(wlc, unit);
7926
7927         /* update sta/ap related parameters */
7928         brcms_c_ap_upd(wlc);
7929
7930         /*
7931          * low level attach steps(all hw accesses go
7932          * inside, no more in rest of the attach)
7933          */
7934         err = brcms_b_attach(wlc, core, unit, piomode);
7935         if (err)
7936                 goto fail;
7937
7938         brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, OFF);
7939
7940         pub->phy_11ncapable = BRCMS_PHY_11N_CAP(wlc->band);
7941
7942         /* disable allowed duty cycle */
7943         wlc->tx_duty_cycle_ofdm = 0;
7944         wlc->tx_duty_cycle_cck = 0;
7945
7946         brcms_c_stf_phy_chain_calc(wlc);
7947
7948         /* txchain 1: txant 0, txchain 2: txant 1 */
7949         if (BRCMS_ISNPHY(wlc->band) && (wlc->stf->txstreams == 1))
7950                 wlc->stf->txant = wlc->stf->hw_txchain - 1;
7951
7952         /* push to BMAC driver */
7953         wlc_phy_stf_chain_init(wlc->band->pi, wlc->stf->hw_txchain,
7954                                wlc->stf->hw_rxchain);
7955
7956         /* pull up some info resulting from the low attach */
7957         for (i = 0; i < NFIFO; i++)
7958                 wlc->core->txavail[i] = wlc->hw->txavail[i];
7959
7960         memcpy(&wlc->perm_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
7961         memcpy(&pub->cur_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
7962
7963         for (j = 0; j < wlc->pub->_nbands; j++) {
7964                 wlc->band = wlc->bandstate[j];
7965
7966                 if (!brcms_c_attach_stf_ant_init(wlc)) {
7967                         err = 24;
7968                         goto fail;
7969                 }
7970
7971                 /* default contention windows size limits */
7972                 wlc->band->CWmin = APHY_CWMIN;
7973                 wlc->band->CWmax = PHY_CWMAX;
7974
7975                 /* init gmode value */
7976                 if (wlc->band->bandtype == BRCM_BAND_2G) {
7977                         wlc->band->gmode = GMODE_AUTO;
7978                         brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER,
7979                                            wlc->band->gmode);
7980                 }
7981
7982                 /* init _n_enab supported mode */
7983                 if (BRCMS_PHY_11N_CAP(wlc->band)) {
7984                         pub->_n_enab = SUPPORT_11N;
7985                         brcms_c_protection_upd(wlc, BRCMS_PROT_N_USER,
7986                                                    ((pub->_n_enab ==
7987                                                      SUPPORT_11N) ? WL_11N_2x2 :
7988                                                     WL_11N_3x3));
7989                 }
7990
7991                 /* init per-band default rateset, depend on band->gmode */
7992                 brcms_default_rateset(wlc, &wlc->band->defrateset);
7993
7994                 /* fill in hw_rateset */
7995                 brcms_c_rateset_filter(&wlc->band->defrateset,
7996                                    &wlc->band->hw_rateset, false,
7997                                    BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
7998                                    (bool) (wlc->pub->_n_enab & SUPPORT_11N));
7999         }
8000
8001         /*
8002          * update antenna config due to
8003          * wlc->stf->txant/txchain/ant_rx_ovr change
8004          */
8005         brcms_c_stf_phy_txant_upd(wlc);
8006
8007         /* attach each modules */
8008         err = brcms_c_attach_module(wlc);
8009         if (err != 0)
8010                 goto fail;
8011
8012         if (!brcms_c_timers_init(wlc, unit)) {
8013                 wiphy_err(wl->wiphy, "wl%d: %s: init_timer failed\n", unit,
8014                           __func__);
8015                 err = 32;
8016                 goto fail;
8017         }
8018
8019         /* depend on rateset, gmode */
8020         wlc->cmi = brcms_c_channel_mgr_attach(wlc);
8021         if (!wlc->cmi) {
8022                 wiphy_err(wl->wiphy, "wl%d: %s: channel_mgr_attach failed"
8023                           "\n", unit, __func__);
8024                 err = 33;
8025                 goto fail;
8026         }
8027
8028         /* init default when all parameters are ready, i.e. ->rateset */
8029         brcms_c_bss_default_init(wlc);
8030
8031         /*
8032          * Complete the wlc default state initializations..
8033          */
8034
8035         wlc->bsscfg->wlc = wlc;
8036
8037         wlc->mimoft = FT_HT;
8038         wlc->mimo_40txbw = AUTO;
8039         wlc->ofdm_40txbw = AUTO;
8040         wlc->cck_40txbw = AUTO;
8041         brcms_c_update_mimo_band_bwcap(wlc, BRCMS_N_BW_20IN2G_40IN5G);
8042
8043         /* Set default values of SGI */
8044         if (BRCMS_SGI_CAP_PHY(wlc)) {
8045                 brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8046                                                BRCMS_N_SGI_40));
8047         } else if (BRCMS_ISSSLPNPHY(wlc->band)) {
8048                 brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8049                                                BRCMS_N_SGI_40));
8050         } else {
8051                 brcms_c_ht_update_sgi_rx(wlc, 0);
8052         }
8053
8054         brcms_b_antsel_set(wlc->hw, wlc->asi->antsel_avail);
8055
8056         if (perr)
8057                 *perr = 0;
8058
8059         return wlc;
8060
8061  fail:
8062         wiphy_err(wl->wiphy, "wl%d: %s: failed with err %d\n",
8063                   unit, __func__, err);
8064         if (wlc)
8065                 brcms_c_detach(wlc);
8066
8067         if (perr)
8068                 *perr = err;
8069         return NULL;
8070 }