1/*
2 * Copyright (c) 2010 Broadcom Corporation
3 * Copyright (c) 2013 Hauke Mehrtens <hauke@hauke-m.de>
4 *
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
12 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
14 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
15 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
19
20#include <linux/pci_ids.h>
21#include <linux/if_ether.h>
22#include <net/cfg80211.h>
23#include <net/mac80211.h>
24#include <brcm_hw_ids.h>
25#include <aiutils.h>
26#include <chipcommon.h>
27#include "rate.h"
28#include "scb.h"
29#include "phy/phy_hal.h"
30#include "channel.h"
31#include "antsel.h"
32#include "stf.h"
33#include "ampdu.h"
34#include "mac80211_if.h"
35#include "ucode_loader.h"
36#include "main.h"
37#include "soc.h"
38#include "dma.h"
39#include "debug.h"
40#include "brcms_trace_events.h"
41
42/* watchdog timer, in unit of ms */
43#define TIMER_INTERVAL_WATCHDOG		1000
44/* radio monitor timer, in unit of ms */
45#define TIMER_INTERVAL_RADIOCHK		800
46
47/* beacon interval, in unit of 1024TU */
48#define BEACON_INTERVAL_DEFAULT		100
49
50/* n-mode support capability */
51/* 2x2 includes both 1x1 & 2x2 devices
52 * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
53 * control it independently
54 */
55#define WL_11N_2x2			1
56#define WL_11N_3x3			3
57#define WL_11N_4x4			4
58
59#define EDCF_ACI_MASK			0x60
60#define EDCF_ACI_SHIFT			5
61#define EDCF_ECWMIN_MASK		0x0f
62#define EDCF_ECWMAX_SHIFT		4
63#define EDCF_AIFSN_MASK			0x0f
64#define EDCF_AIFSN_MAX			15
65#define EDCF_ECWMAX_MASK		0xf0
66
67#define EDCF_AC_BE_TXOP_STA		0x0000
68#define EDCF_AC_BK_TXOP_STA		0x0000
69#define EDCF_AC_VO_ACI_STA		0x62
70#define EDCF_AC_VO_ECW_STA		0x32
71#define EDCF_AC_VI_ACI_STA		0x42
72#define EDCF_AC_VI_ECW_STA		0x43
73#define EDCF_AC_BK_ECW_STA		0xA4
74#define EDCF_AC_VI_TXOP_STA		0x005e
75#define EDCF_AC_VO_TXOP_STA		0x002f
76#define EDCF_AC_BE_ACI_STA		0x03
77#define EDCF_AC_BE_ECW_STA		0xA4
78#define EDCF_AC_BK_ACI_STA		0x27
79#define EDCF_AC_VO_TXOP_AP		0x002f
80
81#define EDCF_TXOP2USEC(txop)		((txop) << 5)
82#define EDCF_ECW2CW(exp)		((1 << (exp)) - 1)
83
84#define APHY_SYMBOL_TIME		4
85#define APHY_PREAMBLE_TIME		16
86#define APHY_SIGNAL_TIME		4
87#define APHY_SIFS_TIME			16
88#define APHY_SERVICE_NBITS		16
89#define APHY_TAIL_NBITS			6
90#define BPHY_SIFS_TIME			10
91#define BPHY_PLCP_SHORT_TIME		96
92
93#define PREN_PREAMBLE			24
94#define PREN_MM_EXT			12
95#define PREN_PREAMBLE_EXT		4
96
97#define DOT11_MAC_HDR_LEN		24
98#define DOT11_ACK_LEN			10
99#define DOT11_BA_LEN			4
100#define DOT11_OFDM_SIGNAL_EXTENSION	6
101#define DOT11_MIN_FRAG_LEN		256
102#define DOT11_RTS_LEN			16
103#define DOT11_CTS_LEN			10
104#define DOT11_BA_BITMAP_LEN		128
105#define DOT11_MAXNUMFRAGS		16
106#define DOT11_MAX_FRAG_LEN		2346
107
108#define BPHY_PLCP_TIME			192
109#define RIFS_11N_TIME			2
110
111/* length of the BCN template area */
112#define BCN_TMPL_LEN			512
113
114/* brcms_bss_info flag bit values */
115#define BRCMS_BSS_HT			0x0020	/* BSS is HT (MIMO) capable */
116
117/* chip rx buffer offset */
118#define BRCMS_HWRXOFF			38
119
120/* rfdisable delay timer 500 ms, runs of ALP clock */
121#define RFDISABLE_DEFAULT		10000000
122
123#define BRCMS_TEMPSENSE_PERIOD		10	/* 10 second timeout */
124
125/* synthpu_dly times in us */
126#define SYNTHPU_DLY_APHY_US		3700
127#define SYNTHPU_DLY_BPHY_US		1050
128#define SYNTHPU_DLY_NPHY_US		2048
129#define SYNTHPU_DLY_LPPHY_US		300
130
131#define ANTCNT				10	/* vanilla M_MAX_ANTCNT val */
132
133/* Per-AC retry limit register definitions; uses defs.h bitfield macros */
134#define EDCF_SHORT_S			0
135#define EDCF_SFB_S			4
136#define EDCF_LONG_S			8
137#define EDCF_LFB_S			12
138#define EDCF_SHORT_M			BITFIELD_MASK(4)
139#define EDCF_SFB_M			BITFIELD_MASK(4)
140#define EDCF_LONG_M			BITFIELD_MASK(4)
141#define EDCF_LFB_M			BITFIELD_MASK(4)
142
143#define RETRY_SHORT_DEF			7	/* Default Short retry Limit */
144#define RETRY_SHORT_MAX			255	/* Maximum Short retry Limit */
145#define RETRY_LONG_DEF			4	/* Default Long retry count */
146#define RETRY_SHORT_FB			3	/* Short count for fb rate */
147#define RETRY_LONG_FB			2	/* Long count for fb rate */
148
149#define APHY_CWMIN			15
150#define PHY_CWMAX			1023
151
152#define EDCF_AIFSN_MIN			1
153
154#define FRAGNUM_MASK			0xF
155
156#define APHY_SLOT_TIME			9
157#define BPHY_SLOT_TIME			20
158
159#define WL_SPURAVOID_OFF		0
160#define WL_SPURAVOID_ON1		1
161#define WL_SPURAVOID_ON2		2
162
163/* invalid core flags, use the saved coreflags */
164#define BRCMS_USE_COREFLAGS		0xffffffff
165
166/* values for PLCPHdr_override */
167#define BRCMS_PLCP_AUTO			-1
168#define BRCMS_PLCP_SHORT		0
169#define BRCMS_PLCP_LONG			1
170
171/* values for g_protection_override and n_protection_override */
172#define BRCMS_PROTECTION_AUTO		-1
173#define BRCMS_PROTECTION_OFF		0
174#define BRCMS_PROTECTION_ON		1
175#define BRCMS_PROTECTION_MMHDR_ONLY	2
176#define BRCMS_PROTECTION_CTS_ONLY	3
177
178/* values for g_protection_control and n_protection_control */
179#define BRCMS_PROTECTION_CTL_OFF	0
180#define BRCMS_PROTECTION_CTL_LOCAL	1
181#define BRCMS_PROTECTION_CTL_OVERLAP	2
182
183/* values for n_protection */
184#define BRCMS_N_PROTECTION_OFF		0
185#define BRCMS_N_PROTECTION_OPTIONAL	1
186#define BRCMS_N_PROTECTION_20IN40	2
187#define BRCMS_N_PROTECTION_MIXEDMODE	3
188
189/* values for band specific 40MHz capabilities */
190#define BRCMS_N_BW_20ALL		0
191#define BRCMS_N_BW_40ALL		1
192#define BRCMS_N_BW_20IN2G_40IN5G	2
193
194/* bitflags for SGI support (sgi_rx iovar) */
195#define BRCMS_N_SGI_20			0x01
196#define BRCMS_N_SGI_40			0x02
197
198/* defines used by the nrate iovar */
199/* MSC in use,indicates b0-6 holds an mcs */
200#define NRATE_MCS_INUSE			0x00000080
201/* rate/mcs value */
202#define NRATE_RATE_MASK			0x0000007f
203/* stf mode mask: siso, cdd, stbc, sdm */
204#define NRATE_STF_MASK			0x0000ff00
205/* stf mode shift */
206#define NRATE_STF_SHIFT			8
207/* bit indicate to override mcs only */
208#define NRATE_OVERRIDE_MCS_ONLY		0x40000000
209#define NRATE_SGI_MASK			0x00800000	/* sgi mode */
210#define NRATE_SGI_SHIFT			23		/* sgi mode */
211#define NRATE_LDPC_CODING		0x00400000	/* adv coding in use */
212#define NRATE_LDPC_SHIFT		22		/* ldpc shift */
213
214#define NRATE_STF_SISO			0		/* stf mode SISO */
215#define NRATE_STF_CDD			1		/* stf mode CDD */
216#define NRATE_STF_STBC			2		/* stf mode STBC */
217#define NRATE_STF_SDM			3		/* stf mode SDM */
218
219#define MAX_DMA_SEGS			4
220
221/* # of entries in Tx FIFO */
222#define NTXD				64
223/* Max # of entries in Rx FIFO based on 4kb page size */
224#define NRXD				256
225
226/* Amount of headroom to leave in Tx FIFO */
227#define TX_HEADROOM			4
228
229/* try to keep this # rbufs posted to the chip */
230#define NRXBUFPOST			32
231
232/* max # frames to process in brcms_c_recv() */
233#define RXBND				8
234/* max # tx status to process in wlc_txstatus() */
235#define TXSBND				8
236
237/* brcmu_format_flags() bit description structure */
238struct brcms_c_bit_desc {
239	u32 bit;
240	const char *name;
241};
242
243/*
244 * The following table lists the buffer memory allocated to xmt fifos in HW.
245 * the size is in units of 256bytes(one block), total size is HW dependent
246 * ucode has default fifo partition, sw can overwrite if necessary
247 *
248 * This is documented in twiki under the topic UcodeTxFifo. Please ensure
249 * the twiki is updated before making changes.
250 */
251
252/* Starting corerev for the fifo size table */
253#define XMTFIFOTBL_STARTREV	17
254
255struct d11init {
256	__le16 addr;
257	__le16 size;
258	__le32 value;
259};
260
261struct edcf_acparam {
262	u8 ACI;
263	u8 ECW;
264	u16 TXOP;
265} __packed;
266
267/* debug/trace */
268uint brcm_msg_level;
269
270/* TX FIFO number to WME/802.1E Access Category */
271static const u8 wme_fifo2ac[] = {
272	IEEE80211_AC_BK,
273	IEEE80211_AC_BE,
274	IEEE80211_AC_VI,
275	IEEE80211_AC_VO,
276	IEEE80211_AC_BE,
277	IEEE80211_AC_BE
278};
279
280/* ieee80211 Access Category to TX FIFO number */
281static const u8 wme_ac2fifo[] = {
282	TX_AC_VO_FIFO,
283	TX_AC_VI_FIFO,
284	TX_AC_BE_FIFO,
285	TX_AC_BK_FIFO
286};
287
288static const u16 xmtfifo_sz[][NFIFO] = {
289	/* corerev 17: 5120, 49152, 49152, 5376, 4352, 1280 */
290	{20, 192, 192, 21, 17, 5},
291	/* corerev 18: */
292	{0, 0, 0, 0, 0, 0},
293	/* corerev 19: */
294	{0, 0, 0, 0, 0, 0},
295	/* corerev 20: 5120, 49152, 49152, 5376, 4352, 1280 */
296	{20, 192, 192, 21, 17, 5},
297	/* corerev 21: 2304, 14848, 5632, 3584, 3584, 1280 */
298	{9, 58, 22, 14, 14, 5},
299	/* corerev 22: 5120, 49152, 49152, 5376, 4352, 1280 */
300	{20, 192, 192, 21, 17, 5},
301	/* corerev 23: 5120, 49152, 49152, 5376, 4352, 1280 */
302	{20, 192, 192, 21, 17, 5},
303	/* corerev 24: 2304, 14848, 5632, 3584, 3584, 1280 */
304	{9, 58, 22, 14, 14, 5},
305	/* corerev 25: */
306	{0, 0, 0, 0, 0, 0},
307	/* corerev 26: */
308	{0, 0, 0, 0, 0, 0},
309	/* corerev 27: */
310	{0, 0, 0, 0, 0, 0},
311	/* corerev 28: 2304, 14848, 5632, 3584, 3584, 1280 */
312	{9, 58, 22, 14, 14, 5},
313};
314
315#ifdef DEBUG
316static const char * const fifo_names[] = {
317	"AC_BK", "AC_BE", "AC_VI", "AC_VO", "BCMC", "ATIM" };
318#else
319static const char fifo_names[6][1];
320#endif
321
322#ifdef DEBUG
323/* pointer to most recently allocated wl/wlc */
324static struct brcms_c_info *wlc_info_dbg = (struct brcms_c_info *) (NULL);
325#endif
326
327/* Mapping of ieee80211 AC numbers to tx fifos */
328static const u8 ac_to_fifo_mapping[IEEE80211_NUM_ACS] = {
329	[IEEE80211_AC_VO]	= TX_AC_VO_FIFO,
330	[IEEE80211_AC_VI]	= TX_AC_VI_FIFO,
331	[IEEE80211_AC_BE]	= TX_AC_BE_FIFO,
332	[IEEE80211_AC_BK]	= TX_AC_BK_FIFO,
333};
334
335/* Mapping of tx fifos to ieee80211 AC numbers */
336static const u8 fifo_to_ac_mapping[IEEE80211_NUM_ACS] = {
337	[TX_AC_BK_FIFO]	= IEEE80211_AC_BK,
338	[TX_AC_BE_FIFO]	= IEEE80211_AC_BE,
339	[TX_AC_VI_FIFO]	= IEEE80211_AC_VI,
340	[TX_AC_VO_FIFO]	= IEEE80211_AC_VO,
341};
342
343static u8 brcms_ac_to_fifo(u8 ac)
344{
345	if (ac >= ARRAY_SIZE(ac_to_fifo_mapping))
346		return TX_AC_BE_FIFO;
347	return ac_to_fifo_mapping[ac];
348}
349
350static u8 brcms_fifo_to_ac(u8 fifo)
351{
352	if (fifo >= ARRAY_SIZE(fifo_to_ac_mapping))
353		return IEEE80211_AC_BE;
354	return fifo_to_ac_mapping[fifo];
355}
356
357/* Find basic rate for a given rate */
358static u8 brcms_basic_rate(struct brcms_c_info *wlc, u32 rspec)
359{
360	if (is_mcs_rate(rspec))
361		return wlc->band->basic_rate[mcs_table[rspec & RSPEC_RATE_MASK]
362		       .leg_ofdm];
363	return wlc->band->basic_rate[rspec & RSPEC_RATE_MASK];
364}
365
366static u16 frametype(u32 rspec, u8 mimoframe)
367{
368	if (is_mcs_rate(rspec))
369		return mimoframe;
370	return is_cck_rate(rspec) ? FT_CCK : FT_OFDM;
371}
372
373/* currently the best mechanism for determining SIFS is the band in use */
374static u16 get_sifs(struct brcms_band *band)
375{
376	return band->bandtype == BRCM_BAND_5G ? APHY_SIFS_TIME :
377				 BPHY_SIFS_TIME;
378}
379
380/*
381 * Detect Card removed.
382 * Even checking an sbconfig register read will not false trigger when the core
383 * is in reset it breaks CF address mechanism. Accessing gphy phyversion will
384 * cause SB error if aphy is in reset on 4306B0-DB. Need a simple accessible
385 * reg with fixed 0/1 pattern (some platforms return all 0).
386 * If clocks are present, call the sb routine which will figure out if the
387 * device is removed.
388 */
389static bool brcms_deviceremoved(struct brcms_c_info *wlc)
390{
391	u32 macctrl;
392
393	if (!wlc->hw->clk)
394		return ai_deviceremoved(wlc->hw->sih);
395	macctrl = bcma_read32(wlc->hw->d11core,
396			      D11REGOFFS(maccontrol));
397	return (macctrl & (MCTL_PSM_JMP_0 | MCTL_IHR_EN)) != MCTL_IHR_EN;
398}
399
400/* sum the individual fifo tx pending packet counts */
401static int brcms_txpktpendtot(struct brcms_c_info *wlc)
402{
403	int i;
404	int pending = 0;
405
406	for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
407		if (wlc->hw->di[i])
408			pending += dma_txpending(wlc->hw->di[i]);
409	return pending;
410}
411
412static bool brcms_is_mband_unlocked(struct brcms_c_info *wlc)
413{
414	return wlc->pub->_nbands > 1 && !wlc->bandlocked;
415}
416
417static int brcms_chspec_bw(u16 chanspec)
418{
419	if (CHSPEC_IS40(chanspec))
420		return BRCMS_40_MHZ;
421	if (CHSPEC_IS20(chanspec))
422		return BRCMS_20_MHZ;
423
424	return BRCMS_10_MHZ;
425}
426
427static void brcms_c_bsscfg_mfree(struct brcms_bss_cfg *cfg)
428{
429	if (cfg == NULL)
430		return;
431
432	kfree(cfg->current_bss);
433	kfree(cfg);
434}
435
436static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
437{
438	if (wlc == NULL)
439		return;
440
441	brcms_c_bsscfg_mfree(wlc->bsscfg);
442	kfree(wlc->pub);
443	kfree(wlc->modulecb);
444	kfree(wlc->default_bss);
445	kfree(wlc->protection);
446	kfree(wlc->stf);
447	kfree(wlc->bandstate[0]);
448	if (wlc->corestate)
449		kfree(wlc->corestate->macstat_snapshot);
450	kfree(wlc->corestate);
451	if (wlc->hw)
452		kfree(wlc->hw->bandstate[0]);
453	kfree(wlc->hw);
454	if (wlc->beacon)
455		dev_kfree_skb_any(wlc->beacon);
456	if (wlc->probe_resp)
457		dev_kfree_skb_any(wlc->probe_resp);
458
459	kfree(wlc);
460}
461
462static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
463{
464	struct brcms_bss_cfg *cfg;
465
466	cfg = kzalloc(sizeof(struct brcms_bss_cfg), GFP_ATOMIC);
467	if (cfg == NULL)
468		goto fail;
469
470	cfg->current_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
471	if (cfg->current_bss == NULL)
472		goto fail;
473
474	return cfg;
475
476 fail:
477	brcms_c_bsscfg_mfree(cfg);
478	return NULL;
479}
480
481static struct brcms_c_info *
482brcms_c_attach_malloc(uint unit, uint *err, uint devid)
483{
484	struct brcms_c_info *wlc;
485
486	wlc = kzalloc(sizeof(struct brcms_c_info), GFP_ATOMIC);
487	if (wlc == NULL) {
488		*err = 1002;
489		goto fail;
490	}
491
492	/* allocate struct brcms_c_pub state structure */
493	wlc->pub = kzalloc(sizeof(struct brcms_pub), GFP_ATOMIC);
494	if (wlc->pub == NULL) {
495		*err = 1003;
496		goto fail;
497	}
498	wlc->pub->wlc = wlc;
499
500	/* allocate struct brcms_hardware state structure */
501
502	wlc->hw = kzalloc(sizeof(struct brcms_hardware), GFP_ATOMIC);
503	if (wlc->hw == NULL) {
504		*err = 1005;
505		goto fail;
506	}
507	wlc->hw->wlc = wlc;
508
509	wlc->hw->bandstate[0] =
510		kzalloc(sizeof(struct brcms_hw_band) * MAXBANDS, GFP_ATOMIC);
511	if (wlc->hw->bandstate[0] == NULL) {
512		*err = 1006;
513		goto fail;
514	} else {
515		int i;
516
517		for (i = 1; i < MAXBANDS; i++)
518			wlc->hw->bandstate[i] = (struct brcms_hw_band *)
519			    ((unsigned long)wlc->hw->bandstate[0] +
520			     (sizeof(struct brcms_hw_band) * i));
521	}
522
523	wlc->modulecb =
524		kzalloc(sizeof(struct modulecb) * BRCMS_MAXMODULES, GFP_ATOMIC);
525	if (wlc->modulecb == NULL) {
526		*err = 1009;
527		goto fail;
528	}
529
530	wlc->default_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
531	if (wlc->default_bss == NULL) {
532		*err = 1010;
533		goto fail;
534	}
535
536	wlc->bsscfg = brcms_c_bsscfg_malloc(unit);
537	if (wlc->bsscfg == NULL) {
538		*err = 1011;
539		goto fail;
540	}
541
542	wlc->protection = kzalloc(sizeof(struct brcms_protection),
543				  GFP_ATOMIC);
544	if (wlc->protection == NULL) {
545		*err = 1016;
546		goto fail;
547	}
548
549	wlc->stf = kzalloc(sizeof(struct brcms_stf), GFP_ATOMIC);
550	if (wlc->stf == NULL) {
551		*err = 1017;
552		goto fail;
553	}
554
555	wlc->bandstate[0] =
556		kzalloc(sizeof(struct brcms_band)*MAXBANDS, GFP_ATOMIC);
557	if (wlc->bandstate[0] == NULL) {
558		*err = 1025;
559		goto fail;
560	} else {
561		int i;
562
563		for (i = 1; i < MAXBANDS; i++)
564			wlc->bandstate[i] = (struct brcms_band *)
565				((unsigned long)wlc->bandstate[0]
566				+ (sizeof(struct brcms_band)*i));
567	}
568
569	wlc->corestate = kzalloc(sizeof(struct brcms_core), GFP_ATOMIC);
570	if (wlc->corestate == NULL) {
571		*err = 1026;
572		goto fail;
573	}
574
575	wlc->corestate->macstat_snapshot =
576		kzalloc(sizeof(struct macstat), GFP_ATOMIC);
577	if (wlc->corestate->macstat_snapshot == NULL) {
578		*err = 1027;
579		goto fail;
580	}
581
582	return wlc;
583
584 fail:
585	brcms_c_detach_mfree(wlc);
586	return NULL;
587}
588
589/*
590 * Update the slot timing for standard 11b/g (20us slots)
591 * or shortslot 11g (9us slots)
592 * The PSM needs to be suspended for this call.
593 */
594static void brcms_b_update_slot_timing(struct brcms_hardware *wlc_hw,
595					bool shortslot)
596{
597	struct bcma_device *core = wlc_hw->d11core;
598
599	if (shortslot) {
600		/* 11g short slot: 11a timing */
601		bcma_write16(core, D11REGOFFS(ifs_slot), 0x0207);
602		brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, APHY_SLOT_TIME);
603	} else {
604		/* 11g long slot: 11b timing */
605		bcma_write16(core, D11REGOFFS(ifs_slot), 0x0212);
606		brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, BPHY_SLOT_TIME);
607	}
608}
609
610/*
611 * calculate frame duration of a given rate and length, return
612 * time in usec unit
613 */
614static uint brcms_c_calc_frame_time(struct brcms_c_info *wlc, u32 ratespec,
615				    u8 preamble_type, uint mac_len)
616{
617	uint nsyms, dur = 0, Ndps, kNdps;
618	uint rate = rspec2rate(ratespec);
619
620	if (rate == 0) {
621		brcms_err(wlc->hw->d11core, "wl%d: WAR: using rate of 1 mbps\n",
622			  wlc->pub->unit);
623		rate = BRCM_RATE_1M;
624	}
625
626	if (is_mcs_rate(ratespec)) {
627		uint mcs = ratespec & RSPEC_RATE_MASK;
628		int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
629
630		dur = PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
631		if (preamble_type == BRCMS_MM_PREAMBLE)
632			dur += PREN_MM_EXT;
633		/* 1000Ndbps = kbps * 4 */
634		kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
635				   rspec_issgi(ratespec)) * 4;
636
637		if (rspec_stc(ratespec) == 0)
638			nsyms =
639			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
640				  APHY_TAIL_NBITS) * 1000, kNdps);
641		else
642			/* STBC needs to have even number of symbols */
643			nsyms =
644			    2 *
645			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
646				  APHY_TAIL_NBITS) * 1000, 2 * kNdps);
647
648		dur += APHY_SYMBOL_TIME * nsyms;
649		if (wlc->band->bandtype == BRCM_BAND_2G)
650			dur += DOT11_OFDM_SIGNAL_EXTENSION;
651	} else if (is_ofdm_rate(rate)) {
652		dur = APHY_PREAMBLE_TIME;
653		dur += APHY_SIGNAL_TIME;
654		/* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
655		Ndps = rate * 2;
656		/* NSyms = CEILING((SERVICE + 8*NBytes + TAIL) / Ndbps) */
657		nsyms =
658		    CEIL((APHY_SERVICE_NBITS + 8 * mac_len + APHY_TAIL_NBITS),
659			 Ndps);
660		dur += APHY_SYMBOL_TIME * nsyms;
661		if (wlc->band->bandtype == BRCM_BAND_2G)
662			dur += DOT11_OFDM_SIGNAL_EXTENSION;
663	} else {
664		/*
665		 * calc # bits * 2 so factor of 2 in rate (1/2 mbps)
666		 * will divide out
667		 */
668		mac_len = mac_len * 8 * 2;
669		/* calc ceiling of bits/rate = microseconds of air time */
670		dur = (mac_len + rate - 1) / rate;
671		if (preamble_type & BRCMS_SHORT_PREAMBLE)
672			dur += BPHY_PLCP_SHORT_TIME;
673		else
674			dur += BPHY_PLCP_TIME;
675	}
676	return dur;
677}
678
679static void brcms_c_write_inits(struct brcms_hardware *wlc_hw,
680				const struct d11init *inits)
681{
682	struct bcma_device *core = wlc_hw->d11core;
683	int i;
684	uint offset;
685	u16 size;
686	u32 value;
687
688	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
689
690	for (i = 0; inits[i].addr != cpu_to_le16(0xffff); i++) {
691		size = le16_to_cpu(inits[i].size);
692		offset = le16_to_cpu(inits[i].addr);
693		value = le32_to_cpu(inits[i].value);
694		if (size == 2)
695			bcma_write16(core, offset, value);
696		else if (size == 4)
697			bcma_write32(core, offset, value);
698		else
699			break;
700	}
701}
702
703static void brcms_c_write_mhf(struct brcms_hardware *wlc_hw, u16 *mhfs)
704{
705	u8 idx;
706	u16 addr[] = {
707		M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
708		M_HOST_FLAGS5
709	};
710
711	for (idx = 0; idx < MHFMAX; idx++)
712		brcms_b_write_shm(wlc_hw, addr[idx], mhfs[idx]);
713}
714
715static void brcms_c_ucode_bsinit(struct brcms_hardware *wlc_hw)
716{
717	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
718
719	/* init microcode host flags */
720	brcms_c_write_mhf(wlc_hw, wlc_hw->band->mhfs);
721
722	/* do band-specific ucode IHR, SHM, and SCR inits */
723	if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
724		if (BRCMS_ISNPHY(wlc_hw->band))
725			brcms_c_write_inits(wlc_hw, ucode->d11n0bsinitvals16);
726		else
727			brcms_err(wlc_hw->d11core,
728				  "%s: wl%d: unsupported phy in corerev %d\n",
729				  __func__, wlc_hw->unit,
730				  wlc_hw->corerev);
731	} else {
732		if (D11REV_IS(wlc_hw->corerev, 24)) {
733			if (BRCMS_ISLCNPHY(wlc_hw->band))
734				brcms_c_write_inits(wlc_hw,
735						    ucode->d11lcn0bsinitvals24);
736			else
737				brcms_err(wlc_hw->d11core,
738					  "%s: wl%d: unsupported phy in core rev %d\n",
739					  __func__, wlc_hw->unit,
740					  wlc_hw->corerev);
741		} else {
742			brcms_err(wlc_hw->d11core,
743				  "%s: wl%d: unsupported corerev %d\n",
744				  __func__, wlc_hw->unit, wlc_hw->corerev);
745		}
746	}
747}
748
749static void brcms_b_core_ioctl(struct brcms_hardware *wlc_hw, u32 m, u32 v)
750{
751	struct bcma_device *core = wlc_hw->d11core;
752	u32 ioctl = bcma_aread32(core, BCMA_IOCTL) & ~m;
753
754	bcma_awrite32(core, BCMA_IOCTL, ioctl | v);
755}
756
757static void brcms_b_core_phy_clk(struct brcms_hardware *wlc_hw, bool clk)
758{
759	brcms_dbg_info(wlc_hw->d11core, "wl%d: clk %d\n", wlc_hw->unit, clk);
760
761	wlc_hw->phyclk = clk;
762
763	if (OFF == clk) {	/* clear gmode bit, put phy into reset */
764
765		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC | SICF_GMODE),
766				   (SICF_PRST | SICF_FGC));
767		udelay(1);
768		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_PRST);
769		udelay(1);
770
771	} else {		/* take phy out of reset */
772
773		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_FGC);
774		udelay(1);
775		brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
776		udelay(1);
777
778	}
779}
780
781/* low-level band switch utility routine */
782static void brcms_c_setxband(struct brcms_hardware *wlc_hw, uint bandunit)
783{
784	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
785			   bandunit);
786
787	wlc_hw->band = wlc_hw->bandstate[bandunit];
788
789	/*
790	 * BMAC_NOTE:
791	 *   until we eliminate need for wlc->band refs in low level code
792	 */
793	wlc_hw->wlc->band = wlc_hw->wlc->bandstate[bandunit];
794
795	/* set gmode core flag */
796	if (wlc_hw->sbclk && !wlc_hw->noreset) {
797		u32 gmode = 0;
798
799		if (bandunit == 0)
800			gmode = SICF_GMODE;
801
802		brcms_b_core_ioctl(wlc_hw, SICF_GMODE, gmode);
803	}
804}
805
806/* switch to new band but leave it inactive */
807static u32 brcms_c_setband_inact(struct brcms_c_info *wlc, uint bandunit)
808{
809	struct brcms_hardware *wlc_hw = wlc->hw;
810	u32 macintmask;
811	u32 macctrl;
812
813	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
814	macctrl = bcma_read32(wlc_hw->d11core,
815			      D11REGOFFS(maccontrol));
816	WARN_ON((macctrl & MCTL_EN_MAC) != 0);
817
818	/* disable interrupts */
819	macintmask = brcms_intrsoff(wlc->wl);
820
821	/* radio off */
822	wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
823
824	brcms_b_core_phy_clk(wlc_hw, OFF);
825
826	brcms_c_setxband(wlc_hw, bandunit);
827
828	return macintmask;
829}
830
831/* process an individual struct tx_status */
832static bool
833brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
834{
835	struct sk_buff *p = NULL;
836	uint queue = NFIFO;
837	struct dma_pub *dma = NULL;
838	struct d11txh *txh = NULL;
839	struct scb *scb = NULL;
840	bool free_pdu;
841	int tx_rts, tx_frame_count, tx_rts_count;
842	uint totlen, supr_status;
843	bool lastframe;
844	struct ieee80211_hdr *h;
845	u16 mcl;
846	struct ieee80211_tx_info *tx_info;
847	struct ieee80211_tx_rate *txrate;
848	int i;
849	bool fatal = true;
850
851	trace_brcms_txstatus(&wlc->hw->d11core->dev, txs->framelen,
852			     txs->frameid, txs->status, txs->lasttxtime,
853			     txs->sequence, txs->phyerr, txs->ackphyrxsh);
854
855	/* discard intermediate indications for ucode with one legitimate case:
856	 *   e.g. if "useRTS" is set. ucode did a successful rts/cts exchange,
857	 *   but the subsequent tx of DATA failed. so it will start rts/cts
858	 *   from the beginning (resetting the rts transmission count)
859	 */
860	if (!(txs->status & TX_STATUS_AMPDU)
861	    && (txs->status & TX_STATUS_INTERMEDIATE)) {
862		brcms_dbg_tx(wlc->hw->d11core, "INTERMEDIATE but not AMPDU\n");
863		fatal = false;
864		goto out;
865	}
866
867	queue = txs->frameid & TXFID_QUEUE_MASK;
868	if (queue >= NFIFO) {
869		brcms_err(wlc->hw->d11core, "queue %u >= NFIFO\n", queue);
870		goto out;
871	}
872
873	dma = wlc->hw->di[queue];
874
875	p = dma_getnexttxp(wlc->hw->di[queue], DMA_RANGE_TRANSMITTED);
876	if (p == NULL) {
877		brcms_err(wlc->hw->d11core, "dma_getnexttxp returned null!\n");
878		goto out;
879	}
880
881	txh = (struct d11txh *) (p->data);
882	mcl = le16_to_cpu(txh->MacTxControlLow);
883
884	if (txs->phyerr)
885		brcms_dbg_tx(wlc->hw->d11core, "phyerr 0x%x, rate 0x%x\n",
886			     txs->phyerr, txh->MainRates);
887
888	if (txs->frameid != le16_to_cpu(txh->TxFrameID)) {
889		brcms_err(wlc->hw->d11core, "frameid != txh->TxFrameID\n");
890		goto out;
891	}
892	tx_info = IEEE80211_SKB_CB(p);
893	h = (struct ieee80211_hdr *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN);
894
895	if (tx_info->rate_driver_data[0])
896		scb = &wlc->pri_scb;
897
898	if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
899		brcms_c_ampdu_dotxstatus(wlc->ampdu, scb, p, txs);
900		fatal = false;
901		goto out;
902	}
903
904	/*
905	 * brcms_c_ampdu_dotxstatus() will trace tx descriptors for AMPDU
906	 * frames; this traces them for the rest.
907	 */
908	trace_brcms_txdesc(&wlc->hw->d11core->dev, txh, sizeof(*txh));
909
910	supr_status = txs->status & TX_STATUS_SUPR_MASK;
911	if (supr_status == TX_STATUS_SUPR_BADCH) {
912		unsigned xfts = le16_to_cpu(txh->XtraFrameTypes);
913		brcms_dbg_tx(wlc->hw->d11core,
914			     "Pkt tx suppressed, dest chan %u, current %d\n",
915			     (xfts >> XFTS_CHANNEL_SHIFT) & 0xff,
916			     CHSPEC_CHANNEL(wlc->default_bss->chanspec));
917	}
918
919	tx_rts = le16_to_cpu(txh->MacTxControlLow) & TXC_SENDRTS;
920	tx_frame_count =
921	    (txs->status & TX_STATUS_FRM_RTX_MASK) >> TX_STATUS_FRM_RTX_SHIFT;
922	tx_rts_count =
923	    (txs->status & TX_STATUS_RTS_RTX_MASK) >> TX_STATUS_RTS_RTX_SHIFT;
924
925	lastframe = !ieee80211_has_morefrags(h->frame_control);
926
927	if (!lastframe) {
928		brcms_err(wlc->hw->d11core, "Not last frame!\n");
929	} else {
930		/*
931		 * Set information to be consumed by Minstrel ht.
932		 *
933		 * The "fallback limit" is the number of tx attempts a given
934		 * MPDU is sent at the "primary" rate. Tx attempts beyond that
935		 * limit are sent at the "secondary" rate.
936		 * A 'short frame' does not exceed RTS treshold.
937		 */
938		u16 sfbl,	/* Short Frame Rate Fallback Limit */
939		    lfbl,	/* Long Frame Rate Fallback Limit */
940		    fbl;
941
942		if (queue < IEEE80211_NUM_ACS) {
943			sfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
944				      EDCF_SFB);
945			lfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
946				      EDCF_LFB);
947		} else {
948			sfbl = wlc->SFBL;
949			lfbl = wlc->LFBL;
950		}
951
952		txrate = tx_info->status.rates;
953		if (txrate[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
954			fbl = lfbl;
955		else
956			fbl = sfbl;
957
958		ieee80211_tx_info_clear_status(tx_info);
959
960		if ((tx_frame_count > fbl) && (txrate[1].idx >= 0)) {
961			/*
962			 * rate selection requested a fallback rate
963			 * and we used it
964			 */
965			txrate[0].count = fbl;
966			txrate[1].count = tx_frame_count - fbl;
967		} else {
968			/*
969			 * rate selection did not request fallback rate, or
970			 * we didn't need it
971			 */
972			txrate[0].count = tx_frame_count;
973			/*
974			 * rc80211_minstrel.c:minstrel_tx_status() expects
975			 * unused rates to be marked with idx = -1
976			 */
977			txrate[1].idx = -1;
978			txrate[1].count = 0;
979		}
980
981		/* clear the rest of the rates */
982		for (i = 2; i < IEEE80211_TX_MAX_RATES; i++) {
983			txrate[i].idx = -1;
984			txrate[i].count = 0;
985		}
986
987		if (txs->status & TX_STATUS_ACK_RCV)
988			tx_info->flags |= IEEE80211_TX_STAT_ACK;
989	}
990
991	totlen = p->len;
992	free_pdu = true;
993
994	if (lastframe) {
995		/* remove PLCP & Broadcom tx descriptor header */
996		skb_pull(p, D11_PHY_HDR_LEN);
997		skb_pull(p, D11_TXH_LEN);
998		ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw, p);
999	} else {
1000		brcms_err(wlc->hw->d11core,
1001			  "%s: Not last frame => not calling tx_status\n",
1002			  __func__);
1003	}
1004
1005	fatal = false;
1006
1007 out:
1008	if (fatal) {
1009		if (txh)
1010			trace_brcms_txdesc(&wlc->hw->d11core->dev, txh,
1011					   sizeof(*txh));
1012		brcmu_pkt_buf_free_skb(p);
1013	}
1014
1015	if (dma && queue < NFIFO) {
1016		u16 ac_queue = brcms_fifo_to_ac(queue);
1017		if (dma->txavail > TX_HEADROOM && queue < TX_BCMC_FIFO &&
1018		    ieee80211_queue_stopped(wlc->pub->ieee_hw, ac_queue))
1019			ieee80211_wake_queue(wlc->pub->ieee_hw, ac_queue);
1020		dma_kick_tx(dma);
1021	}
1022
1023	return fatal;
1024}
1025
1026/* process tx completion events in BMAC
1027 * Return true if more tx status need to be processed. false otherwise.
1028 */
1029static bool
1030brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
1031{
1032	struct bcma_device *core;
1033	struct tx_status txstatus, *txs;
1034	u32 s1, s2;
1035	uint n = 0;
1036	/*
1037	 * Param 'max_tx_num' indicates max. # tx status to process before
1038	 * break out.
1039	 */
1040	uint max_tx_num = bound ? TXSBND : -1;
1041
1042	txs = &txstatus;
1043	core = wlc_hw->d11core;
1044	*fatal = false;
1045
1046	while (n < max_tx_num) {
1047		s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
1048		if (s1 == 0xffffffff) {
1049			brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
1050				  __func__);
1051			*fatal = true;
1052			return false;
1053		}
1054		/* only process when valid */
1055		if (!(s1 & TXS_V))
1056			break;
1057
1058		s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
1059		txs->status = s1 & TXS_STATUS_MASK;
1060		txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
1061		txs->sequence = s2 & TXS_SEQ_MASK;
1062		txs->phyerr = (s2 & TXS_PTX_MASK) >> TXS_PTX_SHIFT;
1063		txs->lasttxtime = 0;
1064
1065		*fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
1066		if (*fatal == true)
1067			return false;
1068		n++;
1069	}
1070
1071	return n >= max_tx_num;
1072}
1073
1074static void brcms_c_tbtt(struct brcms_c_info *wlc)
1075{
1076	if (wlc->bsscfg->type == BRCMS_TYPE_ADHOC)
1077		/*
1078		 * DirFrmQ is now valid...defer setting until end
1079		 * of ATIM window
1080		 */
1081		wlc->qvalid |= MCMD_DIRFRMQVAL;
1082}
1083
1084/* set initial host flags value */
1085static void
1086brcms_c_mhfdef(struct brcms_c_info *wlc, u16 *mhfs, u16 mhf2_init)
1087{
1088	struct brcms_hardware *wlc_hw = wlc->hw;
1089
1090	memset(mhfs, 0, MHFMAX * sizeof(u16));
1091
1092	mhfs[MHF2] |= mhf2_init;
1093
1094	/* prohibit use of slowclock on multifunction boards */
1095	if (wlc_hw->boardflags & BFL_NOPLLDOWN)
1096		mhfs[MHF1] |= MHF1_FORCEFASTCLK;
1097
1098	if (BRCMS_ISNPHY(wlc_hw->band) && NREV_LT(wlc_hw->band->phyrev, 2)) {
1099		mhfs[MHF2] |= MHF2_NPHY40MHZ_WAR;
1100		mhfs[MHF1] |= MHF1_IQSWAP_WAR;
1101	}
1102}
1103
1104static uint
1105dmareg(uint direction, uint fifonum)
1106{
1107	if (direction == DMA_TX)
1108		return offsetof(struct d11regs, fifo64regs[fifonum].dmaxmt);
1109	return offsetof(struct d11regs, fifo64regs[fifonum].dmarcv);
1110}
1111
1112static bool brcms_b_attach_dmapio(struct brcms_c_info *wlc, uint j, bool wme)
1113{
1114	uint i;
1115	char name[8];
1116	/*
1117	 * ucode host flag 2 needed for pio mode, independent of band and fifo
1118	 */
1119	u16 pio_mhf2 = 0;
1120	struct brcms_hardware *wlc_hw = wlc->hw;
1121	uint unit = wlc_hw->unit;
1122
1123	/* name and offsets for dma_attach */
1124	snprintf(name, sizeof(name), "wl%d", unit);
1125
1126	if (wlc_hw->di[0] == NULL) {	/* Init FIFOs */
1127		int dma_attach_err = 0;
1128
1129		/*
1130		 * FIFO 0
1131		 * TX: TX_AC_BK_FIFO (TX AC Background data packets)
1132		 * RX: RX_FIFO (RX data packets)
1133		 */
1134		wlc_hw->di[0] = dma_attach(name, wlc,
1135					   (wme ? dmareg(DMA_TX, 0) : 0),
1136					   dmareg(DMA_RX, 0),
1137					   (wme ? NTXD : 0), NRXD,
1138					   RXBUFSZ, -1, NRXBUFPOST,
1139					   BRCMS_HWRXOFF);
1140		dma_attach_err |= (NULL == wlc_hw->di[0]);
1141
1142		/*
1143		 * FIFO 1
1144		 * TX: TX_AC_BE_FIFO (TX AC Best-Effort data packets)
1145		 *   (legacy) TX_DATA_FIFO (TX data packets)
1146		 * RX: UNUSED
1147		 */
1148		wlc_hw->di[1] = dma_attach(name, wlc,
1149					   dmareg(DMA_TX, 1), 0,
1150					   NTXD, 0, 0, -1, 0, 0);
1151		dma_attach_err |= (NULL == wlc_hw->di[1]);
1152
1153		/*
1154		 * FIFO 2
1155		 * TX: TX_AC_VI_FIFO (TX AC Video data packets)
1156		 * RX: UNUSED
1157		 */
1158		wlc_hw->di[2] = dma_attach(name, wlc,
1159					   dmareg(DMA_TX, 2), 0,
1160					   NTXD, 0, 0, -1, 0, 0);
1161		dma_attach_err |= (NULL == wlc_hw->di[2]);
1162		/*
1163		 * FIFO 3
1164		 * TX: TX_AC_VO_FIFO (TX AC Voice data packets)
1165		 *   (legacy) TX_CTL_FIFO (TX control & mgmt packets)
1166		 */
1167		wlc_hw->di[3] = dma_attach(name, wlc,
1168					   dmareg(DMA_TX, 3),
1169					   0, NTXD, 0, 0, -1,
1170					   0, 0);
1171		dma_attach_err |= (NULL == wlc_hw->di[3]);
1172/* Cleaner to leave this as if with AP defined */
1173
1174		if (dma_attach_err) {
1175			brcms_err(wlc_hw->d11core,
1176				  "wl%d: wlc_attach: dma_attach failed\n",
1177				  unit);
1178			return false;
1179		}
1180
1181		/* get pointer to dma engine tx flow control variable */
1182		for (i = 0; i < NFIFO; i++)
1183			if (wlc_hw->di[i])
1184				wlc_hw->txavail[i] =
1185				    (uint *) dma_getvar(wlc_hw->di[i],
1186							"&txavail");
1187	}
1188
1189	/* initial ucode host flags */
1190	brcms_c_mhfdef(wlc, wlc_hw->band->mhfs, pio_mhf2);
1191
1192	return true;
1193}
1194
1195static void brcms_b_detach_dmapio(struct brcms_hardware *wlc_hw)
1196{
1197	uint j;
1198
1199	for (j = 0; j < NFIFO; j++) {
1200		if (wlc_hw->di[j]) {
1201			dma_detach(wlc_hw->di[j]);
1202			wlc_hw->di[j] = NULL;
1203		}
1204	}
1205}
1206
1207/*
1208 * Initialize brcms_c_info default values ...
1209 * may get overrides later in this function
1210 *  BMAC_NOTES, move low out and resolve the dangling ones
1211 */
1212static void brcms_b_info_init(struct brcms_hardware *wlc_hw)
1213{
1214	struct brcms_c_info *wlc = wlc_hw->wlc;
1215
1216	/* set default sw macintmask value */
1217	wlc->defmacintmask = DEF_MACINTMASK;
1218
1219	/* various 802.11g modes */
1220	wlc_hw->shortslot = false;
1221
1222	wlc_hw->SFBL = RETRY_SHORT_FB;
1223	wlc_hw->LFBL = RETRY_LONG_FB;
1224
1225	/* default mac retry limits */
1226	wlc_hw->SRL = RETRY_SHORT_DEF;
1227	wlc_hw->LRL = RETRY_LONG_DEF;
1228	wlc_hw->chanspec = ch20mhz_chspec(1);
1229}
1230
1231static void brcms_b_wait_for_wake(struct brcms_hardware *wlc_hw)
1232{
1233	/* delay before first read of ucode state */
1234	udelay(40);
1235
1236	/* wait until ucode is no longer asleep */
1237	SPINWAIT((brcms_b_read_shm(wlc_hw, M_UCODE_DBGST) ==
1238		  DBGST_ASLEEP), wlc_hw->wlc->fastpwrup_dly);
1239}
1240
1241/* control chip clock to save power, enable dynamic clock or force fast clock */
1242static void brcms_b_clkctl_clk(struct brcms_hardware *wlc_hw, enum bcma_clkmode mode)
1243{
1244	if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU) {
1245		/* new chips with PMU, CCS_FORCEHT will distribute the HT clock
1246		 * on backplane, but mac core will still run on ALP(not HT) when
1247		 * it enters powersave mode, which means the FCA bit may not be
1248		 * set. Should wakeup mac if driver wants it to run on HT.
1249		 */
1250
1251		if (wlc_hw->clk) {
1252			if (mode == BCMA_CLKMODE_FAST) {
1253				bcma_set32(wlc_hw->d11core,
1254					   D11REGOFFS(clk_ctl_st),
1255					   CCS_FORCEHT);
1256
1257				udelay(64);
1258
1259				SPINWAIT(
1260				    ((bcma_read32(wlc_hw->d11core,
1261				      D11REGOFFS(clk_ctl_st)) &
1262				      CCS_HTAVAIL) == 0),
1263				      PMU_MAX_TRANSITION_DLY);
1264				WARN_ON(!(bcma_read32(wlc_hw->d11core,
1265					D11REGOFFS(clk_ctl_st)) &
1266					CCS_HTAVAIL));
1267			} else {
1268				if ((ai_get_pmurev(wlc_hw->sih) == 0) &&
1269				    (bcma_read32(wlc_hw->d11core,
1270					D11REGOFFS(clk_ctl_st)) &
1271					(CCS_FORCEHT | CCS_HTAREQ)))
1272					SPINWAIT(
1273					    ((bcma_read32(wlc_hw->d11core,
1274					      offsetof(struct d11regs,
1275						       clk_ctl_st)) &
1276					      CCS_HTAVAIL) == 0),
1277					      PMU_MAX_TRANSITION_DLY);
1278				bcma_mask32(wlc_hw->d11core,
1279					D11REGOFFS(clk_ctl_st),
1280					~CCS_FORCEHT);
1281			}
1282		}
1283		wlc_hw->forcefastclk = (mode == BCMA_CLKMODE_FAST);
1284	} else {
1285
1286		/* old chips w/o PMU, force HT through cc,
1287		 * then use FCA to verify mac is running fast clock
1288		 */
1289
1290		wlc_hw->forcefastclk = ai_clkctl_cc(wlc_hw->sih, mode);
1291
1292		/* check fast clock is available (if core is not in reset) */
1293		if (wlc_hw->forcefastclk && wlc_hw->clk)
1294			WARN_ON(!(bcma_aread32(wlc_hw->d11core, BCMA_IOST) &
1295				  SISF_FCLKA));
1296
1297		/*
1298		 * keep the ucode wake bit on if forcefastclk is on since we
1299		 * do not want ucode to put us back to slow clock when it dozes
1300		 * for PM mode. Code below matches the wake override bit with
1301		 * current forcefastclk state. Only setting bit in wake_override
1302		 * instead of waking ucode immediately since old code had this
1303		 * behavior. Older code set wlc->forcefastclk but only had the
1304		 * wake happen if the wakup_ucode work (protected by an up
1305		 * check) was executed just below.
1306		 */
1307		if (wlc_hw->forcefastclk)
1308			mboolset(wlc_hw->wake_override,
1309				 BRCMS_WAKE_OVERRIDE_FORCEFAST);
1310		else
1311			mboolclr(wlc_hw->wake_override,
1312				 BRCMS_WAKE_OVERRIDE_FORCEFAST);
1313	}
1314}
1315
1316/* set or clear ucode host flag bits
1317 * it has an optimization for no-change write
1318 * it only writes through shared memory when the core has clock;
1319 * pre-CLK changes should use wlc_write_mhf to get around the optimization
1320 *
1321 *
1322 * bands values are: BRCM_BAND_AUTO <--- Current band only
1323 *                   BRCM_BAND_5G   <--- 5G band only
1324 *                   BRCM_BAND_2G   <--- 2G band only
1325 *                   BRCM_BAND_ALL  <--- All bands
1326 */
1327void
1328brcms_b_mhf(struct brcms_hardware *wlc_hw, u8 idx, u16 mask, u16 val,
1329	     int bands)
1330{
1331	u16 save;
1332	u16 addr[MHFMAX] = {
1333		M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
1334		M_HOST_FLAGS5
1335	};
1336	struct brcms_hw_band *band;
1337
1338	if ((val & ~mask) || idx >= MHFMAX)
1339		return; /* error condition */
1340
1341	switch (bands) {
1342		/* Current band only or all bands,
1343		 * then set the band to current band
1344		 */
1345	case BRCM_BAND_AUTO:
1346	case BRCM_BAND_ALL:
1347		band = wlc_hw->band;
1348		break;
1349	case BRCM_BAND_5G:
1350		band = wlc_hw->bandstate[BAND_5G_INDEX];
1351		break;
1352	case BRCM_BAND_2G:
1353		band = wlc_hw->bandstate[BAND_2G_INDEX];
1354		break;
1355	default:
1356		band = NULL;	/* error condition */
1357	}
1358
1359	if (band) {
1360		save = band->mhfs[idx];
1361		band->mhfs[idx] = (band->mhfs[idx] & ~mask) | val;
1362
1363		/* optimization: only write through if changed, and
1364		 * changed band is the current band
1365		 */
1366		if (wlc_hw->clk && (band->mhfs[idx] != save)
1367		    && (band == wlc_hw->band))
1368			brcms_b_write_shm(wlc_hw, addr[idx],
1369					   (u16) band->mhfs[idx]);
1370	}
1371
1372	if (bands == BRCM_BAND_ALL) {
1373		wlc_hw->bandstate[0]->mhfs[idx] =
1374		    (wlc_hw->bandstate[0]->mhfs[idx] & ~mask) | val;
1375		wlc_hw->bandstate[1]->mhfs[idx] =
1376		    (wlc_hw->bandstate[1]->mhfs[idx] & ~mask) | val;
1377	}
1378}
1379
1380/* set the maccontrol register to desired reset state and
1381 * initialize the sw cache of the register
1382 */
1383static void brcms_c_mctrl_reset(struct brcms_hardware *wlc_hw)
1384{
1385	/* IHR accesses are always enabled, PSM disabled, HPS off and WAKE on */
1386	wlc_hw->maccontrol = 0;
1387	wlc_hw->suspended_fifos = 0;
1388	wlc_hw->wake_override = 0;
1389	wlc_hw->mute_override = 0;
1390	brcms_b_mctrl(wlc_hw, ~0, MCTL_IHR_EN | MCTL_WAKE);
1391}
1392
1393/*
1394 * write the software state of maccontrol and
1395 * overrides to the maccontrol register
1396 */
1397static void brcms_c_mctrl_write(struct brcms_hardware *wlc_hw)
1398{
1399	u32 maccontrol = wlc_hw->maccontrol;
1400
1401	/* OR in the wake bit if overridden */
1402	if (wlc_hw->wake_override)
1403		maccontrol |= MCTL_WAKE;
1404
1405	/* set AP and INFRA bits for mute if needed */
1406	if (wlc_hw->mute_override) {
1407		maccontrol &= ~(MCTL_AP);
1408		maccontrol |= MCTL_INFRA;
1409	}
1410
1411	bcma_write32(wlc_hw->d11core, D11REGOFFS(maccontrol),
1412		     maccontrol);
1413}
1414
1415/* set or clear maccontrol bits */
1416void brcms_b_mctrl(struct brcms_hardware *wlc_hw, u32 mask, u32 val)
1417{
1418	u32 maccontrol;
1419	u32 new_maccontrol;
1420
1421	if (val & ~mask)
1422		return; /* error condition */
1423	maccontrol = wlc_hw->maccontrol;
1424	new_maccontrol = (maccontrol & ~mask) | val;
1425
1426	/* if the new maccontrol value is the same as the old, nothing to do */
1427	if (new_maccontrol == maccontrol)
1428		return;
1429
1430	/* something changed, cache the new value */
1431	wlc_hw->maccontrol = new_maccontrol;
1432
1433	/* write the new values with overrides applied */
1434	brcms_c_mctrl_write(wlc_hw);
1435}
1436
1437void brcms_c_ucode_wake_override_set(struct brcms_hardware *wlc_hw,
1438				 u32 override_bit)
1439{
1440	if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE)) {
1441		mboolset(wlc_hw->wake_override, override_bit);
1442		return;
1443	}
1444
1445	mboolset(wlc_hw->wake_override, override_bit);
1446
1447	brcms_c_mctrl_write(wlc_hw);
1448	brcms_b_wait_for_wake(wlc_hw);
1449}
1450
1451void brcms_c_ucode_wake_override_clear(struct brcms_hardware *wlc_hw,
1452				   u32 override_bit)
1453{
1454	mboolclr(wlc_hw->wake_override, override_bit);
1455
1456	if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE))
1457		return;
1458
1459	brcms_c_mctrl_write(wlc_hw);
1460}
1461
1462/* When driver needs ucode to stop beaconing, it has to make sure that
1463 * MCTL_AP is clear and MCTL_INFRA is set
1464 * Mode           MCTL_AP        MCTL_INFRA
1465 * AP                1              1
1466 * STA               0              1 <--- This will ensure no beacons
1467 * IBSS              0              0
1468 */
1469static void brcms_c_ucode_mute_override_set(struct brcms_hardware *wlc_hw)
1470{
1471	wlc_hw->mute_override = 1;
1472
1473	/* if maccontrol already has AP == 0 and INFRA == 1 without this
1474	 * override, then there is no change to write
1475	 */
1476	if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1477		return;
1478
1479	brcms_c_mctrl_write(wlc_hw);
1480}
1481
1482/* Clear the override on AP and INFRA bits */
1483static void brcms_c_ucode_mute_override_clear(struct brcms_hardware *wlc_hw)
1484{
1485	if (wlc_hw->mute_override == 0)
1486		return;
1487
1488	wlc_hw->mute_override = 0;
1489
1490	/* if maccontrol already has AP == 0 and INFRA == 1 without this
1491	 * override, then there is no change to write
1492	 */
1493	if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1494		return;
1495
1496	brcms_c_mctrl_write(wlc_hw);
1497}
1498
1499/*
1500 * Write a MAC address to the given match reg offset in the RXE match engine.
1501 */
1502static void
1503brcms_b_set_addrmatch(struct brcms_hardware *wlc_hw, int match_reg_offset,
1504		       const u8 *addr)
1505{
1506	struct bcma_device *core = wlc_hw->d11core;
1507	u16 mac_l;
1508	u16 mac_m;
1509	u16 mac_h;
1510
1511	brcms_dbg_rx(core, "wl%d: brcms_b_set_addrmatch\n", wlc_hw->unit);
1512
1513	mac_l = addr[0] | (addr[1] << 8);
1514	mac_m = addr[2] | (addr[3] << 8);
1515	mac_h = addr[4] | (addr[5] << 8);
1516
1517	/* enter the MAC addr into the RXE match registers */
1518	bcma_write16(core, D11REGOFFS(rcm_ctl),
1519		     RCM_INC_DATA | match_reg_offset);
1520	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_l);
1521	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_m);
1522	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_h);
1523}
1524
1525void
1526brcms_b_write_template_ram(struct brcms_hardware *wlc_hw, int offset, int len,
1527			    void *buf)
1528{
1529	struct bcma_device *core = wlc_hw->d11core;
1530	u32 word;
1531	__le32 word_le;
1532	__be32 word_be;
1533	bool be_bit;
1534	brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
1535
1536	bcma_write32(core, D11REGOFFS(tplatewrptr), offset);
1537
1538	/* if MCTL_BIGEND bit set in mac control register,
1539	 * the chip swaps data in fifo, as well as data in
1540	 * template ram
1541	 */
1542	be_bit = (bcma_read32(core, D11REGOFFS(maccontrol)) & MCTL_BIGEND) != 0;
1543
1544	while (len > 0) {
1545		memcpy(&word, buf, sizeof(u32));
1546
1547		if (be_bit) {
1548			word_be = cpu_to_be32(word);
1549			word = *(u32 *)&word_be;
1550		} else {
1551			word_le = cpu_to_le32(word);
1552			word = *(u32 *)&word_le;
1553		}
1554
1555		bcma_write32(core, D11REGOFFS(tplatewrdata), word);
1556
1557		buf = (u8 *) buf + sizeof(u32);
1558		len -= sizeof(u32);
1559	}
1560}
1561
1562static void brcms_b_set_cwmin(struct brcms_hardware *wlc_hw, u16 newmin)
1563{
1564	wlc_hw->band->CWmin = newmin;
1565
1566	bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1567		     OBJADDR_SCR_SEL | S_DOT11_CWMIN);
1568	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1569	bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmin);
1570}
1571
1572static void brcms_b_set_cwmax(struct brcms_hardware *wlc_hw, u16 newmax)
1573{
1574	wlc_hw->band->CWmax = newmax;
1575
1576	bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1577		     OBJADDR_SCR_SEL | S_DOT11_CWMAX);
1578	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1579	bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmax);
1580}
1581
1582void brcms_b_bw_set(struct brcms_hardware *wlc_hw, u16 bw)
1583{
1584	bool fastclk;
1585
1586	/* request FAST clock if not on */
1587	fastclk = wlc_hw->forcefastclk;
1588	if (!fastclk)
1589		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
1590
1591	wlc_phy_bw_state_set(wlc_hw->band->pi, bw);
1592
1593	brcms_b_phy_reset(wlc_hw);
1594	wlc_phy_init(wlc_hw->band->pi, wlc_phy_chanspec_get(wlc_hw->band->pi));
1595
1596	/* restore the clk */
1597	if (!fastclk)
1598		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
1599}
1600
1601static void brcms_b_upd_synthpu(struct brcms_hardware *wlc_hw)
1602{
1603	u16 v;
1604	struct brcms_c_info *wlc = wlc_hw->wlc;
1605	/* update SYNTHPU_DLY */
1606
1607	if (BRCMS_ISLCNPHY(wlc->band))
1608		v = SYNTHPU_DLY_LPPHY_US;
1609	else if (BRCMS_ISNPHY(wlc->band) && (NREV_GE(wlc->band->phyrev, 3)))
1610		v = SYNTHPU_DLY_NPHY_US;
1611	else
1612		v = SYNTHPU_DLY_BPHY_US;
1613
1614	brcms_b_write_shm(wlc_hw, M_SYNTHPU_DLY, v);
1615}
1616
1617static void brcms_c_ucode_txant_set(struct brcms_hardware *wlc_hw)
1618{
1619	u16 phyctl;
1620	u16 phytxant = wlc_hw->bmac_phytxant;
1621	u16 mask = PHY_TXC_ANT_MASK;
1622
1623	/* set the Probe Response frame phy control word */
1624	phyctl = brcms_b_read_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS);
1625	phyctl = (phyctl & ~mask) | phytxant;
1626	brcms_b_write_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS, phyctl);
1627
1628	/* set the Response (ACK/CTS) frame phy control word */
1629	phyctl = brcms_b_read_shm(wlc_hw, M_RSP_PCTLWD);
1630	phyctl = (phyctl & ~mask) | phytxant;
1631	brcms_b_write_shm(wlc_hw, M_RSP_PCTLWD, phyctl);
1632}
1633
1634static u16 brcms_b_ofdm_ratetable_offset(struct brcms_hardware *wlc_hw,
1635					 u8 rate)
1636{
1637	uint i;
1638	u8 plcp_rate = 0;
1639	struct plcp_signal_rate_lookup {
1640		u8 rate;
1641		u8 signal_rate;
1642	};
1643	/* OFDM RATE sub-field of PLCP SIGNAL field, per 802.11 sec 17.3.4.1 */
1644	const struct plcp_signal_rate_lookup rate_lookup[] = {
1645		{BRCM_RATE_6M, 0xB},
1646		{BRCM_RATE_9M, 0xF},
1647		{BRCM_RATE_12M, 0xA},
1648		{BRCM_RATE_18M, 0xE},
1649		{BRCM_RATE_24M, 0x9},
1650		{BRCM_RATE_36M, 0xD},
1651		{BRCM_RATE_48M, 0x8},
1652		{BRCM_RATE_54M, 0xC}
1653	};
1654
1655	for (i = 0; i < ARRAY_SIZE(rate_lookup); i++) {
1656		if (rate == rate_lookup[i].rate) {
1657			plcp_rate = rate_lookup[i].signal_rate;
1658			break;
1659		}
1660	}
1661
1662	/* Find the SHM pointer to the rate table entry by looking in the
1663	 * Direct-map Table
1664	 */
1665	return 2 * brcms_b_read_shm(wlc_hw, M_RT_DIRMAP_A + (plcp_rate * 2));
1666}
1667
1668static void brcms_upd_ofdm_pctl1_table(struct brcms_hardware *wlc_hw)
1669{
1670	u8 rate;
1671	u8 rates[8] = {
1672		BRCM_RATE_6M, BRCM_RATE_9M, BRCM_RATE_12M, BRCM_RATE_18M,
1673		BRCM_RATE_24M, BRCM_RATE_36M, BRCM_RATE_48M, BRCM_RATE_54M
1674	};
1675	u16 entry_ptr;
1676	u16 pctl1;
1677	uint i;
1678
1679	if (!BRCMS_PHY_11N_CAP(wlc_hw->band))
1680		return;
1681
1682	/* walk the phy rate table and update the entries */
1683	for (i = 0; i < ARRAY_SIZE(rates); i++) {
1684		rate = rates[i];
1685
1686		entry_ptr = brcms_b_ofdm_ratetable_offset(wlc_hw, rate);
1687
1688		/* read the SHM Rate Table entry OFDM PCTL1 values */
1689		pctl1 =
1690		    brcms_b_read_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS);
1691
1692		/* modify the value */
1693		pctl1 &= ~PHY_TXC1_MODE_MASK;
1694		pctl1 |= (wlc_hw->hw_stf_ss_opmode << PHY_TXC1_MODE_SHIFT);
1695
1696		/* Update the SHM Rate Table entry OFDM PCTL1 values */
1697		brcms_b_write_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS,
1698				   pctl1);
1699	}
1700}
1701
1702/* band-specific init */
1703static void brcms_b_bsinit(struct brcms_c_info *wlc, u16 chanspec)
1704{
1705	struct brcms_hardware *wlc_hw = wlc->hw;
1706
1707	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
1708			   wlc_hw->band->bandunit);
1709
1710	brcms_c_ucode_bsinit(wlc_hw);
1711
1712	wlc_phy_init(wlc_hw->band->pi, chanspec);
1713
1714	brcms_c_ucode_txant_set(wlc_hw);
1715
1716	/*
1717	 * cwmin is band-specific, update hardware
1718	 * with value for current band
1719	 */
1720	brcms_b_set_cwmin(wlc_hw, wlc_hw->band->CWmin);
1721	brcms_b_set_cwmax(wlc_hw, wlc_hw->band->CWmax);
1722
1723	brcms_b_update_slot_timing(wlc_hw,
1724				   wlc_hw->band->bandtype == BRCM_BAND_5G ?
1725				   true : wlc_hw->shortslot);
1726
1727	/* write phytype and phyvers */
1728	brcms_b_write_shm(wlc_hw, M_PHYTYPE, (u16) wlc_hw->band->phytype);
1729	brcms_b_write_shm(wlc_hw, M_PHYVER, (u16) wlc_hw->band->phyrev);
1730
1731	/*
1732	 * initialize the txphyctl1 rate table since
1733	 * shmem is shared between bands
1734	 */
1735	brcms_upd_ofdm_pctl1_table(wlc_hw);
1736
1737	brcms_b_upd_synthpu(wlc_hw);
1738}
1739
1740/* Perform a soft reset of the PHY PLL */
1741void brcms_b_core_phypll_reset(struct brcms_hardware *wlc_hw)
1742{
1743	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_addr),
1744		  ~0, 0);
1745	udelay(1);
1746	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1747		  0x4, 0);
1748	udelay(1);
1749	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1750		  0x4, 4);
1751	udelay(1);
1752	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1753		  0x4, 0);
1754	udelay(1);
1755}
1756
1757/* light way to turn on phy clock without reset for NPHY only
1758 *  refer to brcms_b_core_phy_clk for full version
1759 */
1760void brcms_b_phyclk_fgc(struct brcms_hardware *wlc_hw, bool clk)
1761{
1762	/* support(necessary for NPHY and HYPHY) only */
1763	if (!BRCMS_ISNPHY(wlc_hw->band))
1764		return;
1765
1766	if (ON == clk)
1767		brcms_b_core_ioctl(wlc_hw, SICF_FGC, SICF_FGC);
1768	else
1769		brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
1770
1771}
1772
1773void brcms_b_macphyclk_set(struct brcms_hardware *wlc_hw, bool clk)
1774{
1775	if (ON == clk)
1776		brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, SICF_MPCLKE);
1777	else
1778		brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, 0);
1779}
1780
1781void brcms_b_phy_reset(struct brcms_hardware *wlc_hw)
1782{
1783	struct brcms_phy_pub *pih = wlc_hw->band->pi;
1784	u32 phy_bw_clkbits;
1785	bool phy_in_reset = false;
1786
1787	brcms_dbg_info(wlc_hw->d11core, "wl%d: reset phy\n", wlc_hw->unit);
1788
1789	if (pih == NULL)
1790		return;
1791
1792	phy_bw_clkbits = wlc_phy_clk_bwbits(wlc_hw->band->pi);
1793
1794	/* Specific reset sequence required for NPHY rev 3 and 4 */
1795	if (BRCMS_ISNPHY(wlc_hw->band) && NREV_GE(wlc_hw->band->phyrev, 3) &&
1796	    NREV_LE(wlc_hw->band->phyrev, 4)) {
1797		/* Set the PHY bandwidth */
1798		brcms_b_core_ioctl(wlc_hw, SICF_BWMASK, phy_bw_clkbits);
1799
1800		udelay(1);
1801
1802		/* Perform a soft reset of the PHY PLL */
1803		brcms_b_core_phypll_reset(wlc_hw);
1804
1805		/* reset the PHY */
1806		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_PCLKE),
1807				   (SICF_PRST | SICF_PCLKE));
1808		phy_in_reset = true;
1809	} else {
1810		brcms_b_core_ioctl(wlc_hw,
1811				   (SICF_PRST | SICF_PCLKE | SICF_BWMASK),
1812				   (SICF_PRST | SICF_PCLKE | phy_bw_clkbits));
1813	}
1814
1815	udelay(2);
1816	brcms_b_core_phy_clk(wlc_hw, ON);
1817
1818	if (pih)
1819		wlc_phy_anacore(pih, ON);
1820}
1821
1822/* switch to and initialize new band */
1823static void brcms_b_setband(struct brcms_hardware *wlc_hw, uint bandunit,
1824			    u16 chanspec) {
1825	struct brcms_c_info *wlc = wlc_hw->wlc;
1826	u32 macintmask;
1827
1828	/* Enable the d11 core before accessing it */
1829	if (!bcma_core_is_enabled(wlc_hw->d11core)) {
1830		bcma_core_enable(wlc_hw->d11core, 0);
1831		brcms_c_mctrl_reset(wlc_hw);
1832	}
1833
1834	macintmask = brcms_c_setband_inact(wlc, bandunit);
1835
1836	if (!wlc_hw->up)
1837		return;
1838
1839	brcms_b_core_phy_clk(wlc_hw, ON);
1840
1841	/* band-specific initializations */
1842	brcms_b_bsinit(wlc, chanspec);
1843
1844	/*
1845	 * If there are any pending software interrupt bits,
1846	 * then replace these with a harmless nonzero value
1847	 * so brcms_c_dpc() will re-enable interrupts when done.
1848	 */
1849	if (wlc->macintstatus)
1850		wlc->macintstatus = MI_DMAINT;
1851
1852	/* restore macintmask */
1853	brcms_intrsrestore(wlc->wl, macintmask);
1854
1855	/* ucode should still be suspended.. */
1856	WARN_ON((bcma_read32(wlc_hw->d11core, D11REGOFFS(maccontrol)) &
1857		 MCTL_EN_MAC) != 0);
1858}
1859
1860static bool brcms_c_isgoodchip(struct brcms_hardware *wlc_hw)
1861{
1862
1863	/* reject unsupported corerev */
1864	if (!CONF_HAS(D11CONF, wlc_hw->corerev)) {
1865		wiphy_err(wlc_hw->wlc->wiphy, "unsupported core rev %d\n",
1866			  wlc_hw->corerev);
1867		return false;
1868	}
1869
1870	return true;
1871}
1872
1873/* Validate some board info parameters */
1874static bool brcms_c_validboardtype(struct brcms_hardware *wlc_hw)
1875{
1876	uint boardrev = wlc_hw->boardrev;
1877
1878	/* 4 bits each for board type, major, minor, and tiny version */
1879	uint brt = (boardrev & 0xf000) >> 12;
1880	uint b0 = (boardrev & 0xf00) >> 8;
1881	uint b1 = (boardrev & 0xf0) >> 4;
1882	uint b2 = boardrev & 0xf;
1883
1884	/* voards from other vendors are always considered valid */
1885	if (ai_get_boardvendor(wlc_hw->sih) != PCI_VENDOR_ID_BROADCOM)
1886		return true;
1887
1888	/* do some boardrev sanity checks when boardvendor is Broadcom */
1889	if (boardrev == 0)
1890		return false;
1891
1892	if (boardrev <= 0xff)
1893		return true;
1894
1895	if ((brt > 2) || (brt == 0) || (b0 > 9) || (b0 == 0) || (b1 > 9)
1896		|| (b2 > 9))
1897		return false;
1898
1899	return true;
1900}
1901
1902static void brcms_c_get_macaddr(struct brcms_hardware *wlc_hw, u8 etheraddr[ETH_ALEN])
1903{
1904	struct ssb_sprom *sprom = &wlc_hw->d11core->bus->sprom;
1905
1906	/* If macaddr exists, use it (Sromrev4, CIS, ...). */
1907	if (!is_zero_ether_addr(sprom->il0mac)) {
1908		memcpy(etheraddr, sprom->il0mac, ETH_ALEN);
1909		return;
1910	}
1911
1912	if (wlc_hw->_nbands > 1)
1913		memcpy(etheraddr, sprom->et1mac, ETH_ALEN);
1914	else
1915		memcpy(etheraddr, sprom->il0mac, ETH_ALEN);
1916}
1917
1918/* power both the pll and external oscillator on/off */
1919static void brcms_b_xtal(struct brcms_hardware *wlc_hw, bool want)
1920{
1921	brcms_dbg_info(wlc_hw->d11core, "wl%d: want %d\n", wlc_hw->unit, want);
1922
1923	/*
1924	 * dont power down if plldown is false or
1925	 * we must poll hw radio disable
1926	 */
1927	if (!want && wlc_hw->pllreq)
1928		return;
1929
1930	wlc_hw->sbclk = want;
1931	if (!wlc_hw->sbclk) {
1932		wlc_hw->clk = false;
1933		if (wlc_hw->band && wlc_hw->band->pi)
1934			wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
1935	}
1936}
1937
1938/*
1939 * Return true if radio is disabled, otherwise false.
1940 * hw radio disable signal is an external pin, users activate it asynchronously
1941 * this function could be called when driver is down and w/o clock
1942 * it operates on different registers depending on corerev and boardflag.
1943 */
1944static bool brcms_b_radio_read_hwdisabled(struct brcms_hardware *wlc_hw)
1945{
1946	bool v, clk, xtal;
1947	u32 flags = 0;
1948
1949	xtal = wlc_hw->sbclk;
1950	if (!xtal)
1951		brcms_b_xtal(wlc_hw, ON);
1952
1953	/* may need to take core out of reset first */
1954	clk = wlc_hw->clk;
1955	if (!clk) {
1956		/*
1957		 * mac no longer enables phyclk automatically when driver
1958		 * accesses phyreg throughput mac. This can be skipped since
1959		 * only mac reg is accessed below
1960		 */
1961		if (D11REV_GE(wlc_hw->corerev, 18))
1962			flags |= SICF_PCLKE;
1963
1964		/*
1965		 * TODO: test suspend/resume
1966		 *
1967		 * AI chip doesn't restore bar0win2 on
1968		 * hibernation/resume, need sw fixup
1969		 */
1970
1971		bcma_core_enable(wlc_hw->d11core, flags);
1972		brcms_c_mctrl_reset(wlc_hw);
1973	}
1974
1975	v = ((bcma_read32(wlc_hw->d11core,
1976			  D11REGOFFS(phydebug)) & PDBG_RFD) != 0);
1977
1978	/* put core back into reset */
1979	if (!clk)
1980		bcma_core_disable(wlc_hw->d11core, 0);
1981
1982	if (!xtal)
1983		brcms_b_xtal(wlc_hw, OFF);
1984
1985	return v;
1986}
1987
1988static bool wlc_dma_rxreset(struct brcms_hardware *wlc_hw, uint fifo)
1989{
1990	struct dma_pub *di = wlc_hw->di[fifo];
1991	return dma_rxreset(di);
1992}
1993
1994/* d11 core reset
1995 *   ensure fask clock during reset
1996 *   reset dma
1997 *   reset d11(out of reset)
1998 *   reset phy(out of reset)
1999 *   clear software macintstatus for fresh new start
2000 * one testing hack wlc_hw->noreset will bypass the d11/phy reset
2001 */
2002void brcms_b_corereset(struct brcms_hardware *wlc_hw, u32 flags)
2003{
2004	uint i;
2005	bool fastclk;
2006
2007	if (flags == BRCMS_USE_COREFLAGS)
2008		flags = (wlc_hw->band->pi ? wlc_hw->band->core_flags : 0);
2009
2010	brcms_dbg_info(wlc_hw->d11core, "wl%d: core reset\n", wlc_hw->unit);
2011
2012	/* request FAST clock if not on  */
2013	fastclk = wlc_hw->forcefastclk;
2014	if (!fastclk)
2015		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2016
2017	/* reset the dma engines except first time thru */
2018	if (bcma_core_is_enabled(wlc_hw->d11core)) {
2019		for (i = 0; i < NFIFO; i++)
2020			if ((wlc_hw->di[i]) && (!dma_txreset(wlc_hw->di[i])))
2021				brcms_err(wlc_hw->d11core, "wl%d: %s: "
2022					  "dma_txreset[%d]: cannot stop dma\n",
2023					   wlc_hw->unit, __func__, i);
2024
2025		if ((wlc_hw->di[RX_FIFO])
2026		    && (!wlc_dma_rxreset(wlc_hw, RX_FIFO)))
2027			brcms_err(wlc_hw->d11core, "wl%d: %s: dma_rxreset"
2028				  "[%d]: cannot stop dma\n",
2029				  wlc_hw->unit, __func__, RX_FIFO);
2030	}
2031	/* if noreset, just stop the psm and return */
2032	if (wlc_hw->noreset) {
2033		wlc_hw->wlc->macintstatus = 0;	/* skip wl_dpc after down */
2034		brcms_b_mctrl(wlc_hw, MCTL_PSM_RUN | MCTL_EN_MAC, 0);
2035		return;
2036	}
2037
2038	/*
2039	 * mac no longer enables phyclk automatically when driver accesses
2040	 * phyreg throughput mac, AND phy_reset is skipped at early stage when
2041	 * band->pi is invalid. need to enable PHY CLK
2042	 */
2043	if (D11REV_GE(wlc_hw->corerev, 18))
2044		flags |= SICF_PCLKE;
2045
2046	/*
2047	 * reset the core
2048	 * In chips with PMU, the fastclk request goes through d11 core
2049	 * reg 0x1e0, which is cleared by the core_reset. have to re-request it.
2050	 *
2051	 * This adds some delay and we can optimize it by also requesting
2052	 * fastclk through chipcommon during this period if necessary. But
2053	 * that has to work coordinate with other driver like mips/arm since
2054	 * they may touch chipcommon as well.
2055	 */
2056	wlc_hw->clk = false;
2057	bcma_core_enable(wlc_hw->d11core, flags);
2058	wlc_hw->clk = true;
2059	if (wlc_hw->band && wlc_hw->band->pi)
2060		wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, true);
2061
2062	brcms_c_mctrl_reset(wlc_hw);
2063
2064	if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU)
2065		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2066
2067	brcms_b_phy_reset(wlc_hw);
2068
2069	/* turn on PHY_PLL */
2070	brcms_b_core_phypll_ctl(wlc_hw, true);
2071
2072	/* clear sw intstatus */
2073	wlc_hw->wlc->macintstatus = 0;
2074
2075	/* restore the clk setting */
2076	if (!fastclk)
2077		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
2078}
2079
2080/* txfifo sizes needs to be modified(increased) since the newer cores
2081 * have more memory.
2082 */
2083static void brcms_b_corerev_fifofixup(struct brcms_hardware *wlc_hw)
2084{
2085	struct bcma_device *core = wlc_hw->d11core;
2086	u16 fifo_nu;
2087	u16 txfifo_startblk = TXFIFO_START_BLK, txfifo_endblk;
2088	u16 txfifo_def, txfifo_def1;
2089	u16 txfifo_cmd;
2090
2091	/* tx fifos start at TXFIFO_START_BLK from the Base address */
2092	txfifo_startblk = TXFIFO_START_BLK;
2093
2094	/* sequence of operations:  reset fifo, set fifo size, reset fifo */
2095	for (fifo_nu = 0; fifo_nu < NFIFO; fifo_nu++) {
2096
2097		txfifo_endblk = txfifo_startblk + wlc_hw->xmtfifo_sz[fifo_nu];
2098		txfifo_def = (txfifo_startblk & 0xff) |
2099		    (((txfifo_endblk - 1) & 0xff) << TXFIFO_FIFOTOP_SHIFT);
2100		txfifo_def1 = ((txfifo_startblk >> 8) & 0x1) |
2101		    ((((txfifo_endblk -
2102			1) >> 8) & 0x1) << TXFIFO_FIFOTOP_SHIFT);
2103		txfifo_cmd =
2104		    TXFIFOCMD_RESET_MASK | (fifo_nu << TXFIFOCMD_FIFOSEL_SHIFT);
2105
2106		bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2107		bcma_write16(core, D11REGOFFS(xmtfifodef), txfifo_def);
2108		bcma_write16(core, D11REGOFFS(xmtfifodef1), txfifo_def1);
2109
2110		bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2111
2112		txfifo_startblk += wlc_hw->xmtfifo_sz[fifo_nu];
2113	}
2114	/*
2115	 * need to propagate to shm location to be in sync since ucode/hw won't
2116	 * do this
2117	 */
2118	brcms_b_write_shm(wlc_hw, M_FIFOSIZE0,
2119			   wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]);
2120	brcms_b_write_shm(wlc_hw, M_FIFOSIZE1,
2121			   wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]);
2122	brcms_b_write_shm(wlc_hw, M_FIFOSIZE2,
2123			   ((wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO] << 8) | wlc_hw->
2124			    xmtfifo_sz[TX_AC_BK_FIFO]));
2125	brcms_b_write_shm(wlc_hw, M_FIFOSIZE3,
2126			   ((wlc_hw->xmtfifo_sz[TX_ATIM_FIFO] << 8) | wlc_hw->
2127			    xmtfifo_sz[TX_BCMC_FIFO]));
2128}
2129
2130/* This function is used for changing the tsf frac register
2131 * If spur avoidance mode is off, the mac freq will be 80/120/160Mhz
2132 * If spur avoidance mode is on1, the mac freq will be 82/123/164Mhz
2133 * If spur avoidance mode is on2, the mac freq will be 84/126/168Mhz
2134 * HTPHY Formula is 2^26/freq(MHz) e.g.
2135 * For spuron2 - 126MHz -> 2^26/126 = 532610.0
2136 *  - 532610 = 0x82082 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x2082
2137 * For spuron: 123MHz -> 2^26/123    = 545600.5
2138 *  - 545601 = 0x85341 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x5341
2139 * For spur off: 120MHz -> 2^26/120    = 559240.5
2140 *  - 559241 = 0x88889 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x8889
2141 */
2142
2143void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode)
2144{
2145	struct bcma_device *core = wlc_hw->d11core;
2146
2147	if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43224) ||
2148	    (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225)) {
2149		if (spurmode == WL_SPURAVOID_ON2) {	/* 126Mhz */
2150			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x2082);
2151			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2152		} else if (spurmode == WL_SPURAVOID_ON1) {	/* 123Mhz */
2153			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x5341);
2154			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2155		} else {	/* 120Mhz */
2156			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x8889);
2157			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2158		}
2159	} else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2160		if (spurmode == WL_SPURAVOID_ON1) {	/* 82Mhz */
2161			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x7CE0);
2162			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2163		} else {	/* 80Mhz */
2164			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0xCCCD);
2165			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2166		}
2167	}
2168}
2169
2170void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr)
2171{
2172	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2173	wlc->bsscfg->type = BRCMS_TYPE_STATION;
2174}
2175
2176void brcms_c_start_ap(struct brcms_c_info *wlc, u8 *addr, const u8 *bssid,
2177		      u8 *ssid, size_t ssid_len)
2178{
2179	brcms_c_set_ssid(wlc, ssid, ssid_len);
2180
2181	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2182	memcpy(wlc->bsscfg->BSSID, bssid, sizeof(wlc->bsscfg->BSSID));
2183	wlc->bsscfg->type = BRCMS_TYPE_AP;
2184
2185	brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, MCTL_AP | MCTL_INFRA);
2186}
2187
2188void brcms_c_start_adhoc(struct brcms_c_info *wlc, u8 *addr)
2189{
2190	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2191	wlc->bsscfg->type = BRCMS_TYPE_ADHOC;
2192
2193	brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, 0);
2194}
2195
2196/* Initialize GPIOs that are controlled by D11 core */
2197static void brcms_c_gpio_init(struct brcms_c_info *wlc)
2198{
2199	struct brcms_hardware *wlc_hw = wlc->hw;
2200	u32 gc, gm;
2201
2202	/* use GPIO select 0 to get all gpio signals from the gpio out reg */
2203	brcms_b_mctrl(wlc_hw, MCTL_GPOUT_SEL_MASK, 0);
2204
2205	/*
2206	 * Common GPIO setup:
2207	 *      G0 = LED 0 = WLAN Activity
2208	 *      G1 = LED 1 = WLAN 2.4 GHz Radio State
2209	 *      G2 = LED 2 = WLAN 5 GHz Radio State
2210	 *      G4 = radio disable input (HI enabled, LO disabled)
2211	 */
2212
2213	gc = gm = 0;
2214
2215	/* Allocate GPIOs for mimo antenna diversity feature */
2216	if (wlc_hw->antsel_type == ANTSEL_2x3) {
2217		/* Enable antenna diversity, use 2x3 mode */
2218		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2219			     MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2220		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE,
2221			     MHF3_ANTSEL_MODE, BRCM_BAND_ALL);
2222
2223		/* init superswitch control */
2224		wlc_phy_antsel_init(wlc_hw->band->pi, false);
2225
2226	} else if (wlc_hw->antsel_type == ANTSEL_2x4) {
2227		gm |= gc |= (BOARD_GPIO_12 | BOARD_GPIO_13);
2228		/*
2229		 * The board itself is powered by these GPIOs
2230		 * (when not sending pattern) so set them high
2231		 */
2232		bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_oe),
2233			   (BOARD_GPIO_12 | BOARD_GPIO_13));
2234		bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_out),
2235			   (BOARD_GPIO_12 | BOARD_GPIO_13));
2236
2237		/* Enable antenna diversity, use 2x4 mode */
2238		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2239			     MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2240		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE, 0,
2241			     BRCM_BAND_ALL);
2242
2243		/* Configure the desired clock to be 4Mhz */
2244		brcms_b_write_shm(wlc_hw, M_ANTSEL_CLKDIV,
2245				   ANTSEL_CLKDIV_4MHZ);
2246	}
2247
2248	/*
2249	 * gpio 9 controls the PA. ucode is responsible
2250	 * for wiggling out and oe
2251	 */
2252	if (wlc_hw->boardflags & BFL_PACTRL)
2253		gm |= gc |= BOARD_GPIO_PACTRL;
2254
2255	/* apply to gpiocontrol register */
2256	bcma_chipco_gpio_control(&wlc_hw->d11core->bus->drv_cc, gm, gc);
2257}
2258
2259static void brcms_ucode_write(struct brcms_hardware *wlc_hw,
2260			      const __le32 ucode[], const size_t nbytes)
2261{
2262	struct bcma_device *core = wlc_hw->d11core;
2263	uint i;
2264	uint count;
2265
2266	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
2267
2268	count = (nbytes / sizeof(u32));
2269
2270	bcma_write32(core, D11REGOFFS(objaddr),
2271		     OBJADDR_AUTO_INC | OBJADDR_UCM_SEL);
2272	(void)bcma_read32(core, D11REGOFFS(objaddr));
2273	for (i = 0; i < count; i++)
2274		bcma_write32(core, D11REGOFFS(objdata), le32_to_cpu(ucode[i]));
2275
2276}
2277
2278static void brcms_ucode_download(struct brcms_hardware *wlc_hw)
2279{
2280	struct brcms_c_info *wlc;
2281	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
2282
2283	wlc = wlc_hw->wlc;
2284
2285	if (wlc_hw->ucode_loaded)
2286		return;
2287
2288	if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
2289		if (BRCMS_ISNPHY(wlc_hw->band)) {
2290			brcms_ucode_write(wlc_hw, ucode->bcm43xx_16_mimo,
2291					  ucode->bcm43xx_16_mimosz);
2292			wlc_hw->ucode_loaded = true;
2293		} else
2294			brcms_err(wlc_hw->d11core,
2295				  "%s: wl%d: unsupported phy in corerev %d\n",
2296				  __func__, wlc_hw->unit, wlc_hw->corerev);
2297	} else if (D11REV_IS(wlc_hw->corerev, 24)) {
2298		if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2299			brcms_ucode_write(wlc_hw, ucode->bcm43xx_24_lcn,
2300					  ucode->bcm43xx_24_lcnsz);
2301			wlc_hw->ucode_loaded = true;
2302		} else {
2303			brcms_err(wlc_hw->d11core,
2304				  "%s: wl%d: unsupported phy in corerev %d\n",
2305				  __func__, wlc_hw->unit, wlc_hw->corerev);
2306		}
2307	}
2308}
2309
2310void brcms_b_txant_set(struct brcms_hardware *wlc_hw, u16 phytxant)
2311{
2312	/* update sw state */
2313	wlc_hw->bmac_phytxant = phytxant;
2314
2315	/* push to ucode if up */
2316	if (!wlc_hw->up)
2317		return;
2318	brcms_c_ucode_txant_set(wlc_hw);
2319
2320}
2321
2322u16 brcms_b_get_txant(struct brcms_hardware *wlc_hw)
2323{
2324	return (u16) wlc_hw->wlc->stf->txant;
2325}
2326
2327void brcms_b_antsel_type_set(struct brcms_hardware *wlc_hw, u8 antsel_type)
2328{
2329	wlc_hw->antsel_type = antsel_type;
2330
2331	/* Update the antsel type for phy module to use */
2332	wlc_phy_antsel_type_set(wlc_hw->band->pi, antsel_type);
2333}
2334
2335static void brcms_b_fifoerrors(struct brcms_hardware *wlc_hw)
2336{
2337	bool fatal = false;
2338	uint unit;
2339	uint intstatus, idx;
2340	struct bcma_device *core = wlc_hw->d11core;
2341
2342	unit = wlc_hw->unit;
2343
2344	for (idx = 0; idx < NFIFO; idx++) {
2345		/* read intstatus register and ignore any non-error bits */
2346		intstatus =
2347			bcma_read32(core,
2348				    D11REGOFFS(intctrlregs[idx].intstatus)) &
2349			I_ERRORS;
2350		if (!intstatus)
2351			continue;
2352
2353		brcms_dbg_int(core, "wl%d: intstatus%d 0x%x\n",
2354			      unit, idx, intstatus);
2355
2356		if (intstatus & I_RO) {
2357			brcms_err(core, "wl%d: fifo %d: receive fifo "
2358				  "overflow\n", unit, idx);
2359			fatal = true;
2360		}
2361
2362		if (intstatus & I_PC) {
2363			brcms_err(core, "wl%d: fifo %d: descriptor error\n",
2364				  unit, idx);
2365			fatal = true;
2366		}
2367
2368		if (intstatus & I_PD) {
2369			brcms_err(core, "wl%d: fifo %d: data error\n", unit,
2370				  idx);
2371			fatal = true;
2372		}
2373
2374		if (intstatus & I_DE) {
2375			brcms_err(core, "wl%d: fifo %d: descriptor protocol "
2376				  "error\n", unit, idx);
2377			fatal = true;
2378		}
2379
2380		if (intstatus & I_RU)
2381			brcms_err(core, "wl%d: fifo %d: receive descriptor "
2382				  "underflow\n", idx, unit);
2383
2384		if (intstatus & I_XU) {
2385			brcms_err(core, "wl%d: fifo %d: transmit fifo "
2386				  "underflow\n", idx, unit);
2387			fatal = true;
2388		}
2389
2390		if (fatal) {
2391			brcms_fatal_error(wlc_hw->wlc->wl); /* big hammer */
2392			break;
2393		} else
2394			bcma_write32(core,
2395				     D11REGOFFS(intctrlregs[idx].intstatus),
2396				     intstatus);
2397	}
2398}
2399
2400void brcms_c_intrson(struct brcms_c_info *wlc)
2401{
2402	struct brcms_hardware *wlc_hw = wlc->hw;
2403	wlc->macintmask = wlc->defmacintmask;
2404	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2405}
2406
2407u32 brcms_c_intrsoff(struct brcms_c_info *wlc)
2408{
2409	struct brcms_hardware *wlc_hw = wlc->hw;
2410	u32 macintmask;
2411
2412	if (!wlc_hw->clk)
2413		return 0;
2414
2415	macintmask = wlc->macintmask;	/* isr can still happen */
2416
2417	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), 0);
2418	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(macintmask));
2419	udelay(1);		/* ensure int line is no longer driven */
2420	wlc->macintmask = 0;
2421
2422	/* return previous macintmask; resolve race between us and our isr */
2423	return wlc->macintstatus ? 0 : macintmask;
2424}
2425
2426void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask)
2427{
2428	struct brcms_hardware *wlc_hw = wlc->hw;
2429	if (!wlc_hw->clk)
2430		return;
2431
2432	wlc->macintmask = macintmask;
2433	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2434}
2435
2436/* assumes that the d11 MAC is enabled */
2437static void brcms_b_tx_fifo_suspend(struct brcms_hardware *wlc_hw,
2438				    uint tx_fifo)
2439{
2440	u8 fifo = 1 << tx_fifo;
2441
2442	/* Two clients of this code, 11h Quiet period and scanning. */
2443
2444	/* only suspend if not already suspended */
2445	if ((wlc_hw->suspended_fifos & fifo) == fifo)
2446		return;
2447
2448	/* force the core awake only if not already */
2449	if (wlc_hw->suspended_fifos == 0)
2450		brcms_c_ucode_wake_override_set(wlc_hw,
2451						BRCMS_WAKE_OVERRIDE_TXFIFO);
2452
2453	wlc_hw->suspended_fifos |= fifo;
2454
2455	if (wlc_hw->di[tx_fifo]) {
2456		/*
2457		 * Suspending AMPDU transmissions in the middle can cause
2458		 * underflow which may result in mismatch between ucode and
2459		 * driver so suspend the mac before suspending the FIFO
2460		 */
2461		if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2462			brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
2463
2464		dma_txsuspend(wlc_hw->di[tx_fifo]);
2465
2466		if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2467			brcms_c_enable_mac(wlc_hw->wlc);
2468	}
2469}
2470
2471static void brcms_b_tx_fifo_resume(struct brcms_hardware *wlc_hw,
2472				   uint tx_fifo)
2473{
2474	/* BMAC_NOTE: BRCMS_TX_FIFO_ENAB is done in brcms_c_dpc() for DMA case
2475	 * but need to be done here for PIO otherwise the watchdog will catch
2476	 * the inconsistency and fire
2477	 */
2478	/* Two clients of this code, 11h Quiet period and scanning. */
2479	if (wlc_hw->di[tx_fifo])
2480		dma_txresume(wlc_hw->di[tx_fifo]);
2481
2482	/* allow core to sleep again */
2483	if (wlc_hw->suspended_fifos == 0)
2484		return;
2485	else {
2486		wlc_hw->suspended_fifos &= ~(1 << tx_fifo);
2487		if (wlc_hw->suspended_fifos == 0)
2488			brcms_c_ucode_wake_override_clear(wlc_hw,
2489						BRCMS_WAKE_OVERRIDE_TXFIFO);
2490	}
2491}
2492
2493/* precondition: requires the mac core to be enabled */
2494static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
2495{
2496	static const u8 null_ether_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
2497	u8 *ethaddr = wlc_hw->wlc->pub->cur_etheraddr;
2498
2499	if (mute_tx) {
2500		/* suspend tx fifos */
2501		brcms_b_tx_fifo_suspend(wlc_hw, TX_DATA_FIFO);
2502		brcms_b_tx_fifo_suspend(wlc_hw, TX_CTL_FIFO);
2503		brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_BK_FIFO);
2504		brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_VI_FIFO);
2505
2506		/* zero the address match register so we do not send ACKs */
2507		brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, null_ether_addr);
2508	} else {
2509		/* resume tx fifos */
2510		brcms_b_tx_fifo_resume(wlc_hw, TX_DATA_FIFO);
2511		brcms_b_tx_fifo_resume(wlc_hw, TX_CTL_FIFO);
2512		brcms_b_tx_fifo_resume(wlc_hw, TX_AC_BK_FIFO);
2513		brcms_b_tx_fifo_resume(wlc_hw, TX_AC_VI_FIFO);
2514
2515		/* Restore address */
2516		brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, ethaddr);
2517	}
2518
2519	wlc_phy_mute_upd(wlc_hw->band->pi, mute_tx, 0);
2520
2521	if (mute_tx)
2522		brcms_c_ucode_mute_override_set(wlc_hw);
2523	else
2524		brcms_c_ucode_mute_override_clear(wlc_hw);
2525}
2526
2527void
2528brcms_c_mute(struct brcms_c_info *wlc, bool mute_tx)
2529{
2530	brcms_b_mute(wlc->hw, mute_tx);
2531}
2532
2533/*
2534 * Read and clear macintmask and macintstatus and intstatus registers.
2535 * This routine should be called with interrupts off
2536 * Return:
2537 *   -1 if brcms_deviceremoved(wlc) evaluates to true;
2538 *   0 if the interrupt is not for us, or we are in some special cases;
2539 *   device interrupt status bits otherwise.
2540 */
2541static inline u32 wlc_intstatus(struct brcms_c_info *wlc, bool in_isr)
2542{
2543	struct brcms_hardware *wlc_hw = wlc->hw;
2544	struct bcma_device *core = wlc_hw->d11core;
2545	u32 macintstatus, mask;
2546
2547	/* macintstatus includes a DMA interrupt summary bit */
2548	macintstatus = bcma_read32(core, D11REGOFFS(macintstatus));
2549	mask = in_isr ? wlc->macintmask : wlc->defmacintmask;
2550
2551	trace_brcms_macintstatus(&core->dev, in_isr, macintstatus, mask);
2552
2553	/* detect cardbus removed, in power down(suspend) and in reset */
2554	if (brcms_deviceremoved(wlc))
2555		return -1;
2556
2557	/* brcms_deviceremoved() succeeds even when the core is still resetting,
2558	 * handle that case here.
2559	 */
2560	if (macintstatus == 0xffffffff)
2561		return 0;
2562
2563	/* defer unsolicited interrupts */
2564	macintstatus &= mask;
2565
2566	/* if not for us */
2567	if (macintstatus == 0)
2568		return 0;
2569
2570	/* turn off the interrupts */
2571	bcma_write32(core, D11REGOFFS(macintmask), 0);
2572	(void)bcma_read32(core, D11REGOFFS(macintmask));
2573	wlc->macintmask = 0;
2574
2575	/* clear device interrupts */
2576	bcma_write32(core, D11REGOFFS(macintstatus), macintstatus);
2577
2578	/* MI_DMAINT is indication of non-zero intstatus */
2579	if (macintstatus & MI_DMAINT)
2580		/*
2581		 * only fifo interrupt enabled is I_RI in
2582		 * RX_FIFO. If MI_DMAINT is set, assume it
2583		 * is set and clear the interrupt.
2584		 */
2585		bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intstatus),
2586			     DEF_RXINTMASK);
2587
2588	return macintstatus;
2589}
2590
2591/* Update wlc->macintstatus and wlc->intstatus[]. */
2592/* Return true if they are updated successfully. false otherwise */
2593bool brcms_c_intrsupd(struct brcms_c_info *wlc)
2594{
2595	u32 macintstatus;
2596
2597	/* read and clear macintstatus and intstatus registers */
2598	macintstatus = wlc_intstatus(wlc, false);
2599
2600	/* device is removed */
2601	if (macintstatus == 0xffffffff)
2602		return false;
2603
2604	/* update interrupt status in software */
2605	wlc->macintstatus |= macintstatus;
2606
2607	return true;
2608}
2609
2610/*
2611 * First-level interrupt processing.
2612 * Return true if this was our interrupt
2613 * and if further brcms_c_dpc() processing is required,
2614 * false otherwise.
2615 */
2616bool brcms_c_isr(struct brcms_c_info *wlc)
2617{
2618	struct brcms_hardware *wlc_hw = wlc->hw;
2619	u32 macintstatus;
2620
2621	if (!wlc_hw->up || !wlc->macintmask)
2622		return false;
2623
2624	/* read and clear macintstatus and intstatus registers */
2625	macintstatus = wlc_intstatus(wlc, true);
2626
2627	if (macintstatus == 0xffffffff) {
2628		brcms_err(wlc_hw->d11core,
2629			  "DEVICEREMOVED detected in the ISR code path\n");
2630		return false;
2631	}
2632
2633	/* it is not for us */
2634	if (macintstatus == 0)
2635		return false;
2636
2637	/* save interrupt status bits */
2638	wlc->macintstatus = macintstatus;
2639
2640	return true;
2641
2642}
2643
2644void brcms_c_suspend_mac_and_wait(struct brcms_c_info *wlc)
2645{
2646	struct brcms_hardware *wlc_hw = wlc->hw;
2647	struct bcma_device *core = wlc_hw->d11core;
2648	u32 mc, mi;
2649
2650	brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2651			   wlc_hw->band->bandunit);
2652
2653	/*
2654	 * Track overlapping suspend requests
2655	 */
2656	wlc_hw->mac_suspend_depth++;
2657	if (wlc_hw->mac_suspend_depth > 1)
2658		return;
2659
2660	/* force the core awake */
2661	brcms_c_ucode_wake_override_set(wlc_hw, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2662
2663	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2664
2665	if (mc == 0xffffffff) {
2666		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2667			  __func__);
2668		brcms_down(wlc->wl);
2669		return;
2670	}
2671	WARN_ON(mc & MCTL_PSM_JMP_0);
2672	WARN_ON(!(mc & MCTL_PSM_RUN));
2673	WARN_ON(!(mc & MCTL_EN_MAC));
2674
2675	mi = bcma_read32(core, D11REGOFFS(macintstatus));
2676	if (mi == 0xffffffff) {
2677		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2678			  __func__);
2679		brcms_down(wlc->wl);
2680		return;
2681	}
2682	WARN_ON(mi & MI_MACSSPNDD);
2683
2684	brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, 0);
2685
2686	SPINWAIT(!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD),
2687		 BRCMS_MAX_MAC_SUSPEND);
2688
2689	if (!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD)) {
2690		brcms_err(core, "wl%d: wlc_suspend_mac_and_wait: waited %d uS"
2691			  " and MI_MACSSPNDD is still not on.\n",
2692			  wlc_hw->unit, BRCMS_MAX_MAC_SUSPEND);
2693		brcms_err(core, "wl%d: psmdebug 0x%08x, phydebug 0x%08x, "
2694			  "psm_brc 0x%04x\n", wlc_hw->unit,
2695			  bcma_read32(core, D11REGOFFS(psmdebug)),
2696			  bcma_read32(core, D11REGOFFS(phydebug)),
2697			  bcma_read16(core, D11REGOFFS(psm_brc)));
2698	}
2699
2700	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2701	if (mc == 0xffffffff) {
2702		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2703			  __func__);
2704		brcms_down(wlc->wl);
2705		return;
2706	}
2707	WARN_ON(mc & MCTL_PSM_JMP_0);
2708	WARN_ON(!(mc & MCTL_PSM_RUN));
2709	WARN_ON(mc & MCTL_EN_MAC);
2710}
2711
2712void brcms_c_enable_mac(struct brcms_c_info *wlc)
2713{
2714	struct brcms_hardware *wlc_hw = wlc->hw;
2715	struct bcma_device *core = wlc_hw->d11core;
2716	u32 mc, mi;
2717
2718	brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2719			   wlc->band->bandunit);
2720
2721	/*
2722	 * Track overlapping suspend requests
2723	 */
2724	wlc_hw->mac_suspend_depth--;
2725	if (wlc_hw->mac_suspend_depth > 0)
2726		return;
2727
2728	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2729	WARN_ON(mc & MCTL_PSM_JMP_0);
2730	WARN_ON(mc & MCTL_EN_MAC);
2731	WARN_ON(!(mc & MCTL_PSM_RUN));
2732
2733	brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, MCTL_EN_MAC);
2734	bcma_write32(core, D11REGOFFS(macintstatus), MI_MACSSPNDD);
2735
2736	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2737	WARN_ON(mc & MCTL_PSM_JMP_0);
2738	WARN_ON(!(mc & MCTL_EN_MAC));
2739	WARN_ON(!(mc & MCTL_PSM_RUN));
2740
2741	mi = bcma_read32(core, D11REGOFFS(macintstatus));
2742	WARN_ON(mi & MI_MACSSPNDD);
2743
2744	brcms_c_ucode_wake_override_clear(wlc_hw,
2745					  BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2746}
2747
2748void brcms_b_band_stf_ss_set(struct brcms_hardware *wlc_hw, u8 stf_mode)
2749{
2750	wlc_hw->hw_stf_ss_opmode = stf_mode;
2751
2752	if (wlc_hw->clk)
2753		brcms_upd_ofdm_pctl1_table(wlc_hw);
2754}
2755
2756static bool brcms_b_validate_chip_access(struct brcms_hardware *wlc_hw)
2757{
2758	struct bcma_device *core = wlc_hw->d11core;
2759	u32 w, val;
2760	struct wiphy *wiphy = wlc_hw->wlc->wiphy;
2761
2762	/* Validate dchip register access */
2763
2764	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2765	(void)bcma_read32(core, D11REGOFFS(objaddr));
2766	w = bcma_read32(core, D11REGOFFS(objdata));
2767
2768	/* Can we write and read back a 32bit register? */
2769	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2770	(void)bcma_read32(core, D11REGOFFS(objaddr));
2771	bcma_write32(core, D11REGOFFS(objdata), (u32) 0xaa5555aa);
2772
2773	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2774	(void)bcma_read32(core, D11REGOFFS(objaddr));
2775	val = bcma_read32(core, D11REGOFFS(objdata));
2776	if (val != (u32) 0xaa5555aa) {
2777		wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2778			  "expected 0xaa5555aa\n", wlc_hw->unit, val);
2779		return false;
2780	}
2781
2782	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2783	(void)bcma_read32(core, D11REGOFFS(objaddr));
2784	bcma_write32(core, D11REGOFFS(objdata), (u32) 0x55aaaa55);
2785
2786	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2787	(void)bcma_read32(core, D11REGOFFS(objaddr));
2788	val = bcma_read32(core, D11REGOFFS(objdata));
2789	if (val != (u32) 0x55aaaa55) {
2790		wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2791			  "expected 0x55aaaa55\n", wlc_hw->unit, val);
2792		return false;
2793	}
2794
2795	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2796	(void)bcma_read32(core, D11REGOFFS(objaddr));
2797	bcma_write32(core, D11REGOFFS(objdata), w);
2798
2799	/* clear CFPStart */
2800	bcma_write32(core, D11REGOFFS(tsf_cfpstart), 0);
2801
2802	w = bcma_read32(core, D11REGOFFS(maccontrol));
2803	if ((w != (MCTL_IHR_EN | MCTL_WAKE)) &&
2804	    (w != (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE))) {
2805		wiphy_err(wiphy, "wl%d: validate_chip_access: maccontrol = "
2806			  "0x%x, expected 0x%x or 0x%x\n", wlc_hw->unit, w,
2807			  (MCTL_IHR_EN | MCTL_WAKE),
2808			  (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE));
2809		return false;
2810	}
2811
2812	return true;
2813}
2814
2815#define PHYPLL_WAIT_US	100000
2816
2817void brcms_b_core_phypll_ctl(struct brcms_hardware *wlc_hw, bool on)
2818{
2819	struct bcma_device *core = wlc_hw->d11core;
2820	u32 tmp;
2821
2822	brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
2823
2824	tmp = 0;
2825
2826	if (on) {
2827		if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
2828			bcma_set32(core, D11REGOFFS(clk_ctl_st),
2829				   CCS_ERSRC_REQ_HT |
2830				   CCS_ERSRC_REQ_D11PLL |
2831				   CCS_ERSRC_REQ_PHYPLL);
2832			SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2833				  CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT,
2834				 PHYPLL_WAIT_US);
2835
2836			tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2837			if ((tmp & CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT)
2838				brcms_err(core, "%s: turn on PHY PLL failed\n",
2839					  __func__);
2840		} else {
2841			bcma_set32(core, D11REGOFFS(clk_ctl_st),
2842				   tmp | CCS_ERSRC_REQ_D11PLL |
2843				   CCS_ERSRC_REQ_PHYPLL);
2844			SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2845				  (CCS_ERSRC_AVAIL_D11PLL |
2846				   CCS_ERSRC_AVAIL_PHYPLL)) !=
2847				 (CCS_ERSRC_AVAIL_D11PLL |
2848				  CCS_ERSRC_AVAIL_PHYPLL), PHYPLL_WAIT_US);
2849
2850			tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2851			if ((tmp &
2852			     (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2853			    !=
2854			    (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2855				brcms_err(core, "%s: turn on PHY PLL failed\n",
2856					  __func__);
2857		}
2858	} else {
2859		/*
2860		 * Since the PLL may be shared, other cores can still
2861		 * be requesting it; so we'll deassert the request but
2862		 * not wait for status to comply.
2863		 */
2864		bcma_mask32(core, D11REGOFFS(clk_ctl_st),
2865			    ~CCS_ERSRC_REQ_PHYPLL);
2866		(void)bcma_read32(core, D11REGOFFS(clk_ctl_st));
2867	}
2868}
2869
2870static void brcms_c_coredisable(struct brcms_hardware *wlc_hw)
2871{
2872	bool dev_gone;
2873
2874	brcms_dbg_info(wlc_hw->d11core, "wl%d: disable core\n", wlc_hw->unit);
2875
2876	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
2877
2878	if (dev_gone)
2879		return;
2880
2881	if (wlc_hw->noreset)
2882		return;
2883
2884	/* radio off */
2885	wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
2886
2887	/* turn off analog core */
2888	wlc_phy_anacore(wlc_hw->band->pi, OFF);
2889
2890	/* turn off PHYPLL to save power */
2891	brcms_b_core_phypll_ctl(wlc_hw, false);
2892
2893	wlc_hw->clk = false;
2894	bcma_core_disable(wlc_hw->d11core, 0);
2895	wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
2896}
2897
2898static void brcms_c_flushqueues(struct brcms_c_info *wlc)
2899{
2900	struct brcms_hardware *wlc_hw = wlc->hw;
2901	uint i;
2902
2903	/* free any posted tx packets */
2904	for (i = 0; i < NFIFO; i++) {
2905		if (wlc_hw->di[i]) {
2906			dma_txreclaim(wlc_hw->di[i], DMA_RANGE_ALL);
2907			if (i < TX_BCMC_FIFO)
2908				ieee80211_wake_queue(wlc->pub->ieee_hw,
2909						     brcms_fifo_to_ac(i));
2910		}
2911	}
2912
2913	/* free any posted rx packets */
2914	dma_rxreclaim(wlc_hw->di[RX_FIFO]);
2915}
2916
2917static u16
2918brcms_b_read_objmem(struct brcms_hardware *wlc_hw, uint offset, u32 sel)
2919{
2920	struct bcma_device *core = wlc_hw->d11core;
2921	u16 objoff = D11REGOFFS(objdata);
2922
2923	bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2924	(void)bcma_read32(core, D11REGOFFS(objaddr));
2925	if (offset & 2)
2926		objoff += 2;
2927
2928	return bcma_read16(core, objoff);
2929}
2930
2931static void
2932brcms_b_write_objmem(struct brcms_hardware *wlc_hw, uint offset, u16 v,
2933		     u32 sel)
2934{
2935	struct bcma_device *core = wlc_hw->d11core;
2936	u16 objoff = D11REGOFFS(objdata);
2937
2938	bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2939	(void)bcma_read32(core, D11REGOFFS(objaddr));
2940	if (offset & 2)
2941		objoff += 2;
2942
2943	bcma_wflush16(core, objoff, v);
2944}
2945
2946/*
2947 * Read a single u16 from shared memory.
2948 * SHM 'offset' needs to be an even address
2949 */
2950u16 brcms_b_read_shm(struct brcms_hardware *wlc_hw, uint offset)
2951{
2952	return brcms_b_read_objmem(wlc_hw, offset, OBJADDR_SHM_SEL);
2953}
2954
2955/*
2956 * Write a single u16 to shared memory.
2957 * SHM 'offset' needs to be an even address
2958 */
2959void brcms_b_write_shm(struct brcms_hardware *wlc_hw, uint offset, u16 v)
2960{
2961	brcms_b_write_objmem(wlc_hw, offset, v, OBJADDR_SHM_SEL);
2962}
2963
2964/*
2965 * Copy a buffer to shared memory of specified type .
2966 * SHM 'offset' needs to be an even address and
2967 * Buffer length 'len' must be an even number of bytes
2968 * 'sel' selects the type of memory
2969 */
2970void
2971brcms_b_copyto_objmem(struct brcms_hardware *wlc_hw, uint offset,
2972		      const void *buf, int len, u32 sel)
2973{
2974	u16 v;
2975	const u8 *p = (const u8 *)buf;
2976	int i;
2977
2978	if (len <= 0 || (offset & 1) || (len & 1))
2979		return;
2980
2981	for (i = 0; i < len; i += 2) {
2982		v = p[i] | (p[i + 1] << 8);
2983		brcms_b_write_objmem(wlc_hw, offset + i, v, sel);
2984	}
2985}
2986
2987/*
2988 * Copy a piece of shared memory of specified type to a buffer .
2989 * SHM 'offset' needs to be an even address and
2990 * Buffer length 'len' must be an even number of bytes
2991 * 'sel' selects the type of memory
2992 */
2993void
2994brcms_b_copyfrom_objmem(struct brcms_hardware *wlc_hw, uint offset, void *buf,
2995			 int len, u32 sel)
2996{
2997	u16 v;
2998	u8 *p = (u8 *) buf;
2999	int i;
3000
3001	if (len <= 0 || (offset & 1) || (len & 1))
3002		return;
3003
3004	for (i = 0; i < len; i += 2) {
3005		v = brcms_b_read_objmem(wlc_hw, offset + i, sel);
3006		p[i] = v & 0xFF;
3007		p[i + 1] = (v >> 8) & 0xFF;
3008	}
3009}
3010
3011/* Copy a buffer to shared memory.
3012 * SHM 'offset' needs to be an even address and
3013 * Buffer length 'len' must be an even number of bytes
3014 */
3015static void brcms_c_copyto_shm(struct brcms_c_info *wlc, uint offset,
3016			const void *buf, int len)
3017{
3018	brcms_b_copyto_objmem(wlc->hw, offset, buf, len, OBJADDR_SHM_SEL);
3019}
3020
3021static void brcms_b_retrylimit_upd(struct brcms_hardware *wlc_hw,
3022				   u16 SRL, u16 LRL)
3023{
3024	wlc_hw->SRL = SRL;
3025	wlc_hw->LRL = LRL;
3026
3027	/* write retry limit to SCR, shouldn't need to suspend */
3028	if (wlc_hw->up) {
3029		bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3030			     OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3031		(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3032		bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->SRL);
3033		bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3034			     OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3035		(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3036		bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->LRL);
3037	}
3038}
3039
3040static void brcms_b_pllreq(struct brcms_hardware *wlc_hw, bool set, u32 req_bit)
3041{
3042	if (set) {
3043		if (mboolisset(wlc_hw->pllreq, req_bit))
3044			return;
3045
3046		mboolset(wlc_hw->pllreq, req_bit);
3047
3048		if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3049			if (!wlc_hw->sbclk)
3050				brcms_b_xtal(wlc_hw, ON);
3051		}
3052	} else {
3053		if (!mboolisset(wlc_hw->pllreq, req_bit))
3054			return;
3055
3056		mboolclr(wlc_hw->pllreq, req_bit);
3057
3058		if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3059			if (wlc_hw->sbclk)
3060				brcms_b_xtal(wlc_hw, OFF);
3061		}
3062	}
3063}
3064
3065static void brcms_b_antsel_set(struct brcms_hardware *wlc_hw, u32 antsel_avail)
3066{
3067	wlc_hw->antsel_avail = antsel_avail;
3068}
3069
3070/*
3071 * conditions under which the PM bit should be set in outgoing frames
3072 * and STAY_AWAKE is meaningful
3073 */
3074static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
3075{
3076	/* not supporting PS so always return false for now */
3077	return false;
3078}
3079
3080static void brcms_c_statsupd(struct brcms_c_info *wlc)
3081{
3082	int i;
3083	struct macstat *macstats;
3084#ifdef DEBUG
3085	u16 delta;
3086	u16 rxf0ovfl;
3087	u16 txfunfl[NFIFO];
3088#endif				/* DEBUG */
3089
3090	/* if driver down, make no sense to update stats */
3091	if (!wlc->pub->up)
3092		return;
3093
3094	macstats = wlc->core->macstat_snapshot;
3095
3096#ifdef DEBUG
3097	/* save last rx fifo 0 overflow count */
3098	rxf0ovfl = macstats->rxf0ovfl;
3099
3100	/* save last tx fifo  underflow count */
3101	for (i = 0; i < NFIFO; i++)
3102		txfunfl[i] = macstats->txfunfl[i];
3103#endif				/* DEBUG */
3104
3105	/* Read mac stats from contiguous shared memory */
3106	brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, macstats,
3107				sizeof(*macstats), OBJADDR_SHM_SEL);
3108
3109#ifdef DEBUG
3110	/* check for rx fifo 0 overflow */
3111	delta = (u16)(macstats->rxf0ovfl - rxf0ovfl);
3112	if (delta)
3113		brcms_err(wlc->hw->d11core, "wl%d: %u rx fifo 0 overflows!\n",
3114			  wlc->pub->unit, delta);
3115
3116	/* check for tx fifo underflows */
3117	for (i = 0; i < NFIFO; i++) {
3118		delta = macstats->txfunfl[i] - txfunfl[i];
3119		if (delta)
3120			brcms_err(wlc->hw->d11core,
3121				  "wl%d: %u tx fifo %d underflows!\n",
3122				  wlc->pub->unit, delta, i);
3123	}
3124#endif				/* DEBUG */
3125
3126	/* merge counters from dma module */
3127	for (i = 0; i < NFIFO; i++) {
3128		if (wlc->hw->di[i])
3129			dma_counterreset(wlc->hw->di[i]);
3130	}
3131}
3132
3133static void brcms_b_reset(struct brcms_hardware *wlc_hw)
3134{
3135	/* reset the core */
3136	if (!brcms_deviceremoved(wlc_hw->wlc))
3137		brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
3138
3139	/* purge the dma rings */
3140	brcms_c_flushqueues(wlc_hw->wlc);
3141}
3142
3143void brcms_c_reset(struct brcms_c_info *wlc)
3144{
3145	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
3146
3147	/* slurp up hw mac counters before core reset */
3148	brcms_c_statsupd(wlc);
3149
3150	/* reset our snapshot of macstat counters */
3151	memset(wlc->core->macstat_snapshot, 0, sizeof(struct macstat));
3152
3153	brcms_b_reset(wlc->hw);
3154}
3155
3156void brcms_c_init_scb(struct scb *scb)
3157{
3158	int i;
3159
3160	memset(scb, 0, sizeof(struct scb));
3161	scb->flags = SCB_WMECAP | SCB_HTCAP;
3162	for (i = 0; i < NUMPRIO; i++) {
3163		scb->seqnum[i] = 0;
3164		scb->seqctl[i] = 0xFFFF;
3165	}
3166
3167	scb->seqctl_nonqos = 0xFFFF;
3168	scb->magic = SCB_MAGIC;
3169}
3170
3171/* d11 core init
3172 *   reset PSM
3173 *   download ucode/PCM
3174 *   let ucode run to suspended
3175 *   download ucode inits
3176 *   config other core registers
3177 *   init dma
3178 */
3179static void brcms_b_coreinit(struct brcms_c_info *wlc)
3180{
3181	struct brcms_hardware *wlc_hw = wlc->hw;
3182	struct bcma_device *core = wlc_hw->d11core;
3183	u32 sflags;
3184	u32 bcnint_us;
3185	uint i = 0;
3186	bool fifosz_fixup = false;
3187	int err = 0;
3188	u16 buf[NFIFO];
3189	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
3190
3191	brcms_dbg_info(core, "wl%d: core init\n", wlc_hw->unit);
3192
3193	/* reset PSM */
3194	brcms_b_mctrl(wlc_hw, ~0, (MCTL_IHR_EN | MCTL_PSM_JMP_0 | MCTL_WAKE));
3195
3196	brcms_ucode_download(wlc_hw);
3197	/*
3198	 * FIFOSZ fixup. driver wants to controls the fifo allocation.
3199	 */
3200	fifosz_fixup = true;
3201
3202	/* let the PSM run to the suspended state, set mode to BSS STA */
3203	bcma_write32(core, D11REGOFFS(macintstatus), -1);
3204	brcms_b_mctrl(wlc_hw, ~0,
3205		       (MCTL_IHR_EN | MCTL_INFRA | MCTL_PSM_RUN | MCTL_WAKE));
3206
3207	/* wait for ucode to self-suspend after auto-init */
3208	SPINWAIT(((bcma_read32(core, D11REGOFFS(macintstatus)) &
3209		   MI_MACSSPNDD) == 0), 1000 * 1000);
3210	if ((bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD) == 0)
3211		brcms_err(core, "wl%d: wlc_coreinit: ucode did not self-"
3212			  "suspend!\n", wlc_hw->unit);
3213
3214	brcms_c_gpio_init(wlc);
3215
3216	sflags = bcma_aread32(core, BCMA_IOST);
3217
3218	if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
3219		if (BRCMS_ISNPHY(wlc_hw->band))
3220			brcms_c_write_inits(wlc_hw, ucode->d11n0initvals16);
3221		else
3222			brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3223				  " %d\n", __func__, wlc_hw->unit,
3224				  wlc_hw->corerev);
3225	} else if (D11REV_IS(wlc_hw->corerev, 24)) {
3226		if (BRCMS_ISLCNPHY(wlc_hw->band))
3227			brcms_c_write_inits(wlc_hw, ucode->d11lcn0initvals24);
3228		else
3229			brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3230				  " %d\n", __func__, wlc_hw->unit,
3231				  wlc_hw->corerev);
3232	} else {
3233		brcms_err(core, "%s: wl%d: unsupported corerev %d\n",
3234			  __func__, wlc_hw->unit, wlc_hw->corerev);
3235	}
3236
3237	/* For old ucode, txfifo sizes needs to be modified(increased) */
3238	if (fifosz_fixup)
3239		brcms_b_corerev_fifofixup(wlc_hw);
3240
3241	/* check txfifo allocations match between ucode and driver */
3242	buf[TX_AC_BE_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE0);
3243	if (buf[TX_AC_BE_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]) {
3244		i = TX_AC_BE_FIFO;
3245		err = -1;
3246	}
3247	buf[TX_AC_VI_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE1);
3248	if (buf[TX_AC_VI_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]) {
3249		i = TX_AC_VI_FIFO;
3250		err = -1;
3251	}
3252	buf[TX_AC_BK_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE2);
3253	buf[TX_AC_VO_FIFO] = (buf[TX_AC_BK_FIFO] >> 8) & 0xff;
3254	buf[TX_AC_BK_FIFO] &= 0xff;
3255	if (buf[TX_AC_BK_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BK_FIFO]) {
3256		i = TX_AC_BK_FIFO;
3257		err = -1;
3258	}
3259	if (buf[TX_AC_VO_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO]) {
3260		i = TX_AC_VO_FIFO;
3261		err = -1;
3262	}
3263	buf[TX_BCMC_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE3);
3264	buf[TX_ATIM_FIFO] = (buf[TX_BCMC_FIFO] >> 8) & 0xff;
3265	buf[TX_BCMC_FIFO] &= 0xff;
3266	if (buf[TX_BCMC_FIFO] != wlc_hw->xmtfifo_sz[TX_BCMC_FIFO]) {
3267		i = TX_BCMC_FIFO;
3268		err = -1;
3269	}
3270	if (buf[TX_ATIM_FIFO] != wlc_hw->xmtfifo_sz[TX_ATIM_FIFO]) {
3271		i = TX_ATIM_FIFO;
3272		err = -1;
3273	}
3274	if (err != 0)
3275		brcms_err(core, "wlc_coreinit: txfifo mismatch: ucode size %d"
3276			  " driver size %d index %d\n", buf[i],
3277			  wlc_hw->xmtfifo_sz[i], i);
3278
3279	/* make sure we can still talk to the mac */
3280	WARN_ON(bcma_read32(core, D11REGOFFS(maccontrol)) == 0xffffffff);
3281
3282	/* band-specific inits done by wlc_bsinit() */
3283
3284	/* Set up frame burst size and antenna swap threshold init values */
3285	brcms_b_write_shm(wlc_hw, M_MBURST_SIZE, MAXTXFRAMEBURST);
3286	brcms_b_write_shm(wlc_hw, M_MAX_ANTCNT, ANTCNT);
3287
3288	/* enable one rx interrupt per received frame */
3289	bcma_write32(core, D11REGOFFS(intrcvlazy[0]), (1 << IRL_FC_SHIFT));
3290
3291	/* set the station mode (BSS STA) */
3292	brcms_b_mctrl(wlc_hw,
3293		       (MCTL_INFRA | MCTL_DISCARD_PMQ | MCTL_AP),
3294		       (MCTL_INFRA | MCTL_DISCARD_PMQ));
3295
3296	/* set up Beacon interval */
3297	bcnint_us = 0x8000 << 10;
3298	bcma_write32(core, D11REGOFFS(tsf_cfprep),
3299		     (bcnint_us << CFPREP_CBI_SHIFT));
3300	bcma_write32(core, D11REGOFFS(tsf_cfpstart), bcnint_us);
3301	bcma_write32(core, D11REGOFFS(macintstatus), MI_GP1);
3302
3303	/* write interrupt mask */
3304	bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intmask),
3305		     DEF_RXINTMASK);
3306
3307	/* allow the MAC to control the PHY clock (dynamic on/off) */
3308	brcms_b_macphyclk_set(wlc_hw, ON);
3309
3310	/* program dynamic clock control fast powerup delay register */
3311	wlc->fastpwrup_dly = ai_clkctl_fast_pwrup_delay(wlc_hw->sih);
3312	bcma_write16(core, D11REGOFFS(scc_fastpwrup_dly), wlc->fastpwrup_dly);
3313
3314	/* tell the ucode the corerev */
3315	brcms_b_write_shm(wlc_hw, M_MACHW_VER, (u16) wlc_hw->corerev);
3316
3317	/* tell the ucode MAC capabilities */
3318	brcms_b_write_shm(wlc_hw, M_MACHW_CAP_L,
3319			   (u16) (wlc_hw->machwcap & 0xffff));
3320	brcms_b_write_shm(wlc_hw, M_MACHW_CAP_H,
3321			   (u16) ((wlc_hw->
3322				      machwcap >> 16) & 0xffff));
3323
3324	/* write retry limits to SCR, this done after PSM init */
3325	bcma_write32(core, D11REGOFFS(objaddr),
3326		     OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3327	(void)bcma_read32(core, D11REGOFFS(objaddr));
3328	bcma_write32(core, D11REGOFFS(objdata), wlc_hw->SRL);
3329	bcma_write32(core, D11REGOFFS(objaddr),
3330		     OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3331	(void)bcma_read32(core, D11REGOFFS(objaddr));
3332	bcma_write32(core, D11REGOFFS(objdata), wlc_hw->LRL);
3333
3334	/* write rate fallback retry limits */
3335	brcms_b_write_shm(wlc_hw, M_SFRMTXCNTFBRTHSD, wlc_hw->SFBL);
3336	brcms_b_write_shm(wlc_hw, M_LFRMTXCNTFBRTHSD, wlc_hw->LFBL);
3337
3338	bcma_mask16(core, D11REGOFFS(ifs_ctl), 0x0FFF);
3339	bcma_write16(core, D11REGOFFS(ifs_aifsn), EDCF_AIFSN_MIN);
3340
3341	/* init the tx dma engines */
3342	for (i = 0; i < NFIFO; i++) {
3343		if (wlc_hw->di[i])
3344			dma_txinit(wlc_hw->di[i]);
3345	}
3346
3347	/* init the rx dma engine(s) and post receive buffers */
3348	dma_rxinit(wlc_hw->di[RX_FIFO]);
3349	dma_rxfill(wlc_hw->di[RX_FIFO]);
3350}
3351
3352void
3353static brcms_b_init(struct brcms_hardware *wlc_hw, u16 chanspec) {
3354	u32 macintmask;
3355	bool fastclk;
3356	struct brcms_c_info *wlc = wlc_hw->wlc;
3357
3358	/* request FAST clock if not on */
3359	fastclk = wlc_hw->forcefastclk;
3360	if (!fastclk)
3361		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
3362
3363	/* disable interrupts */
3364	macintmask = brcms_intrsoff(wlc->wl);
3365
3366	/* set up the specified band and chanspec */
3367	brcms_c_setxband(wlc_hw, chspec_bandunit(chanspec));
3368	wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3369
3370	/* do one-time phy inits and calibration */
3371	wlc_phy_cal_init(wlc_hw->band->pi);
3372
3373	/* core-specific initialization */
3374	brcms_b_coreinit(wlc);
3375
3376	/* band-specific inits */
3377	brcms_b_bsinit(wlc, chanspec);
3378
3379	/* restore macintmask */
3380	brcms_intrsrestore(wlc->wl, macintmask);
3381
3382	/* seed wake_override with BRCMS_WAKE_OVERRIDE_MACSUSPEND since the mac
3383	 * is suspended and brcms_c_enable_mac() will clear this override bit.
3384	 */
3385	mboolset(wlc_hw->wake_override, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
3386
3387	/*
3388	 * initialize mac_suspend_depth to 1 to match ucode
3389	 * initial suspended state
3390	 */
3391	wlc_hw->mac_suspend_depth = 1;
3392
3393	/* restore the clk */
3394	if (!fastclk)
3395		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
3396}
3397
3398static void brcms_c_set_phy_chanspec(struct brcms_c_info *wlc,
3399				     u16 chanspec)
3400{
3401	/* Save our copy of the chanspec */
3402	wlc->chanspec = chanspec;
3403
3404	/* Set the chanspec and power limits for this locale */
3405	brcms_c_channel_set_chanspec(wlc->cmi, chanspec, BRCMS_TXPWR_MAX);
3406
3407	if (wlc->stf->ss_algosel_auto)
3408		brcms_c_stf_ss_algo_channel_get(wlc, &wlc->stf->ss_algo_channel,
3409					    chanspec);
3410
3411	brcms_c_stf_ss_update(wlc, wlc->band);
3412}
3413
3414static void
3415brcms_default_rateset(struct brcms_c_info *wlc, struct brcms_c_rateset *rs)
3416{
3417	brcms_c_rateset_default(rs, NULL, wlc->band->phytype,
3418		wlc->band->bandtype, false, BRCMS_RATE_MASK_FULL,
3419		(bool) (wlc->pub->_n_enab & SUPPORT_11N),
3420		brcms_chspec_bw(wlc->default_bss->chanspec),
3421		wlc->stf->txstreams);
3422}
3423
3424/* derive wlc->band->basic_rate[] table from 'rateset' */
3425static void brcms_c_rate_lookup_init(struct brcms_c_info *wlc,
3426			      struct brcms_c_rateset *rateset)
3427{
3428	u8 rate;
3429	u8 mandatory;
3430	u8 cck_basic = 0;
3431	u8 ofdm_basic = 0;
3432	u8 *br = wlc->band->basic_rate;
3433	uint i;
3434
3435	/* incoming rates are in 500kbps units as in 802.11 Supported Rates */
3436	memset(br, 0, BRCM_MAXRATE + 1);
3437
3438	/* For each basic rate in the rates list, make an entry in the
3439	 * best basic lookup.
3440	 */
3441	for (i = 0; i < rateset->count; i++) {
3442		/* only make an entry for a basic rate */
3443		if (!(rateset->rates[i] & BRCMS_RATE_FLAG))
3444			continue;
3445
3446		/* mask off basic bit */
3447		rate = (rateset->rates[i] & BRCMS_RATE_MASK);
3448
3449		if (rate > BRCM_MAXRATE) {
3450			brcms_err(wlc->hw->d11core, "brcms_c_rate_lookup_init: "
3451				  "invalid rate 0x%X in rate set\n",
3452				  rateset->rates[i]);
3453			continue;
3454		}
3455
3456		br[rate] = rate;
3457	}
3458
3459	/* The rate lookup table now has non-zero entries for each
3460	 * basic rate, equal to the basic rate: br[basicN] = basicN
3461	 *
3462	 * To look up the best basic rate corresponding to any
3463	 * particular rate, code can use the basic_rate table
3464	 * like this
3465	 *
3466	 * basic_rate = wlc->band->basic_rate[tx_rate]
3467	 *
3468	 * Make sure there is a best basic rate entry for
3469	 * every rate by walking up the table from low rates
3470	 * to high, filling in holes in the lookup table
3471	 */
3472
3473	for (i = 0; i < wlc->band->hw_rateset.count; i++) {
3474		rate = wlc->band->hw_rateset.rates[i];
3475
3476		if (br[rate] != 0) {
3477			/* This rate is a basic rate.
3478			 * Keep track of the best basic rate so far by
3479			 * modulation type.
3480			 */
3481			if (is_ofdm_rate(rate))
3482				ofdm_basic = rate;
3483			else
3484				cck_basic = rate;
3485
3486			continue;
3487		}
3488
3489		/* This rate is not a basic rate so figure out the
3490		 * best basic rate less than this rate and fill in
3491		 * the hole in the table
3492		 */
3493
3494		br[rate] = is_ofdm_rate(rate) ? ofdm_basic : cck_basic;
3495
3496		if (br[rate] != 0)
3497			continue;
3498
3499		if (is_ofdm_rate(rate)) {
3500			/*
3501			 * In 11g and 11a, the OFDM mandatory rates
3502			 * are 6, 12, and 24 Mbps
3503			 */
3504			if (rate >= BRCM_RATE_24M)
3505				mandatory = BRCM_RATE_24M;
3506			else if (rate >= BRCM_RATE_12M)
3507				mandatory = BRCM_RATE_12M;
3508			else
3509				mandatory = BRCM_RATE_6M;
3510		} else {
3511			/* In 11b, all CCK rates are mandatory 1 - 11 Mbps */
3512			mandatory = rate;
3513		}
3514
3515		br[rate] = mandatory;
3516	}
3517}
3518
3519static void brcms_c_bandinit_ordered(struct brcms_c_info *wlc,
3520				     u16 chanspec)
3521{
3522	struct brcms_c_rateset default_rateset;
3523	uint parkband;
3524	uint i, band_order[2];
3525
3526	/*
3527	 * We might have been bandlocked during down and the chip
3528	 * power-cycled (hibernate). Figure out the right band to park on
3529	 */
3530	if (wlc->bandlocked || wlc->pub->_nbands == 1) {
3531		/* updated in brcms_c_bandlock() */
3532		parkband = wlc->band->bandunit;
3533		band_order[0] = band_order[1] = parkband;
3534	} else {
3535		/* park on the band of the specified chanspec */
3536		parkband = chspec_bandunit(chanspec);
3537
3538		/* order so that parkband initialize last */
3539		band_order[0] = parkband ^ 1;
3540		band_order[1] = parkband;
3541	}
3542
3543	/* make each band operational, software state init */
3544	for (i = 0; i < wlc->pub->_nbands; i++) {
3545		uint j = band_order[i];
3546
3547		wlc->band = wlc->bandstate[j];
3548
3549		brcms_default_rateset(wlc, &default_rateset);
3550
3551		/* fill in hw_rate */
3552		brcms_c_rateset_filter(&default_rateset, &wlc->band->hw_rateset,
3553				   false, BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
3554				   (bool) (wlc->pub->_n_enab & SUPPORT_11N));
3555
3556		/* init basic rate lookup */
3557		brcms_c_rate_lookup_init(wlc, &default_rateset);
3558	}
3559
3560	/* sync up phy/radio chanspec */
3561	brcms_c_set_phy_chanspec(wlc, chanspec);
3562}
3563
3564/*
3565 * Set or clear filtering related maccontrol bits based on
3566 * specified filter flags
3567 */
3568void brcms_c_mac_promisc(struct brcms_c_info *wlc, uint filter_flags)
3569{
3570	u32 promisc_bits = 0;
3571
3572	wlc->filter_flags = filter_flags;
3573
3574	if (filter_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS))
3575		promisc_bits |= MCTL_PROMISC;
3576
3577	if (filter_flags & FIF_BCN_PRBRESP_PROMISC)
3578		promisc_bits |= MCTL_BCNS_PROMISC;
3579
3580	if (filter_flags & FIF_FCSFAIL)
3581		promisc_bits |= MCTL_KEEPBADFCS;
3582
3583	if (filter_flags & (FIF_CONTROL | FIF_PSPOLL))
3584		promisc_bits |= MCTL_KEEPCONTROL;
3585
3586	brcms_b_mctrl(wlc->hw,
3587		MCTL_PROMISC | MCTL_BCNS_PROMISC |
3588		MCTL_KEEPCONTROL | MCTL_KEEPBADFCS,
3589		promisc_bits);
3590}
3591
3592/*
3593 * ucode, hwmac update
3594 *    Channel dependent updates for ucode and hw
3595 */
3596static void brcms_c_ucode_mac_upd(struct brcms_c_info *wlc)
3597{
3598	/* enable or disable any active IBSSs depending on whether or not
3599	 * we are on the home channel
3600	 */
3601	if (wlc->home_chanspec == wlc_phy_chanspec_get(wlc->band->pi)) {
3602		if (wlc->pub->associated) {
3603			/*
3604			 * BMAC_NOTE: This is something that should be fixed
3605			 * in ucode inits. I think that the ucode inits set
3606			 * up the bcn templates and shm values with a bogus
3607			 * beacon. This should not be done in the inits. If
3608			 * ucode needs to set up a beacon for testing, the
3609			 * test routines should write it down, not expect the
3610			 * inits to populate a bogus beacon.
3611			 */
3612			if (BRCMS_PHY_11N_CAP(wlc->band))
3613				brcms_b_write_shm(wlc->hw,
3614						M_BCN_TXTSF_OFFSET, 0);
3615		}
3616	} else {
3617		/* disable an active IBSS if we are not on the home channel */
3618	}
3619}
3620
3621static void brcms_c_write_rate_shm(struct brcms_c_info *wlc, u8 rate,
3622				   u8 basic_rate)
3623{
3624	u8 phy_rate, index;
3625	u8 basic_phy_rate, basic_index;
3626	u16 dir_table, basic_table;
3627	u16 basic_ptr;
3628
3629	/* Shared memory address for the table we are reading */
3630	dir_table = is_ofdm_rate(basic_rate) ? M_RT_DIRMAP_A : M_RT_DIRMAP_B;
3631
3632	/* Shared memory address for the table we are writing */
3633	basic_table = is_ofdm_rate(rate) ? M_RT_BBRSMAP_A : M_RT_BBRSMAP_B;
3634
3635	/*
3636	 * for a given rate, the LS-nibble of the PLCP SIGNAL field is
3637	 * the index into the rate table.
3638	 */
3639	phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
3640	basic_phy_rate = rate_info[basic_rate] & BRCMS_RATE_MASK;
3641	index = phy_rate & 0xf;
3642	basic_index = basic_phy_rate & 0xf;
3643
3644	/* Find the SHM pointer to the ACK rate entry by looking in the
3645	 * Direct-map Table
3646	 */
3647	basic_ptr = brcms_b_read_shm(wlc->hw, (dir_table + basic_index * 2));
3648
3649	/* Update the SHM BSS-basic-rate-set mapping table with the pointer
3650	 * to the correct basic rate for the given incoming rate
3651	 */
3652	brcms_b_write_shm(wlc->hw, (basic_table + index * 2), basic_ptr);
3653}
3654
3655static const struct brcms_c_rateset *
3656brcms_c_rateset_get_hwrs(struct brcms_c_info *wlc)
3657{
3658	const struct brcms_c_rateset *rs_dflt;
3659
3660	if (BRCMS_PHY_11N_CAP(wlc->band)) {
3661		if (wlc->band->bandtype == BRCM_BAND_5G)
3662			rs_dflt = &ofdm_mimo_rates;
3663		else
3664			rs_dflt = &cck_ofdm_mimo_rates;
3665	} else if (wlc->band->gmode)
3666		rs_dflt = &cck_ofdm_rates;
3667	else
3668		rs_dflt = &cck_rates;
3669
3670	return rs_dflt;
3671}
3672
3673static void brcms_c_set_ratetable(struct brcms_c_info *wlc)
3674{
3675	const struct brcms_c_rateset *rs_dflt;
3676	struct brcms_c_rateset rs;
3677	u8 rate, basic_rate;
3678	uint i;
3679
3680	rs_dflt = brcms_c_rateset_get_hwrs(wlc);
3681
3682	brcms_c_rateset_copy(rs_dflt, &rs);
3683	brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
3684
3685	/* walk the phy rate table and update SHM basic rate lookup table */
3686	for (i = 0; i < rs.count; i++) {
3687		rate = rs.rates[i] & BRCMS_RATE_MASK;
3688
3689		/* for a given rate brcms_basic_rate returns the rate at
3690		 * which a response ACK/CTS should be sent.
3691		 */
3692		basic_rate = brcms_basic_rate(wlc, rate);
3693		if (basic_rate == 0)
3694			/* This should only happen if we are using a
3695			 * restricted rateset.
3696			 */
3697			basic_rate = rs.rates[0] & BRCMS_RATE_MASK;
3698
3699		brcms_c_write_rate_shm(wlc, rate, basic_rate);
3700	}
3701}
3702
3703/* band-specific init */
3704static void brcms_c_bsinit(struct brcms_c_info *wlc)
3705{
3706	brcms_dbg_info(wlc->hw->d11core, "wl%d: bandunit %d\n",
3707		       wlc->pub->unit, wlc->band->bandunit);
3708
3709	/* write ucode ACK/CTS rate table */
3710	brcms_c_set_ratetable(wlc);
3711
3712	/* update some band specific mac configuration */
3713	brcms_c_ucode_mac_upd(wlc);
3714
3715	/* init antenna selection */
3716	brcms_c_antsel_init(wlc->asi);
3717
3718}
3719
3720/* formula:  IDLE_BUSY_RATIO_X_16 = (100-duty_cycle)/duty_cycle*16 */
3721static int
3722brcms_c_duty_cycle_set(struct brcms_c_info *wlc, int duty_cycle, bool isOFDM,
3723		   bool writeToShm)
3724{
3725	int idle_busy_ratio_x_16 = 0;
3726	uint offset =
3727	    isOFDM ? M_TX_IDLE_BUSY_RATIO_X_16_OFDM :
3728	    M_TX_IDLE_BUSY_RATIO_X_16_CCK;
3729	if (duty_cycle > 100 || duty_cycle < 0) {
3730		brcms_err(wlc->hw->d11core,
3731			  "wl%d:  duty cycle value off limit\n",
3732			  wlc->pub->unit);
3733		return -EINVAL;
3734	}
3735	if (duty_cycle)
3736		idle_busy_ratio_x_16 = (100 - duty_cycle) * 16 / duty_cycle;
3737	/* Only write to shared memory  when wl is up */
3738	if (writeToShm)
3739		brcms_b_write_shm(wlc->hw, offset, (u16) idle_busy_ratio_x_16);
3740
3741	if (isOFDM)
3742		wlc->tx_duty_cycle_ofdm = (u16) duty_cycle;
3743	else
3744		wlc->tx_duty_cycle_cck = (u16) duty_cycle;
3745
3746	return 0;
3747}
3748
3749/* push sw hps and wake state through hardware */
3750static void brcms_c_set_ps_ctrl(struct brcms_c_info *wlc)
3751{
3752	u32 v1, v2;
3753	bool hps;
3754	bool awake_before;
3755
3756	hps = brcms_c_ps_allowed(wlc);
3757
3758	brcms_dbg_mac80211(wlc->hw->d11core, "wl%d: hps %d\n", wlc->pub->unit,
3759			   hps);
3760
3761	v1 = bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
3762	v2 = MCTL_WAKE;
3763	if (hps)
3764		v2 |= MCTL_HPS;
3765
3766	brcms_b_mctrl(wlc->hw, MCTL_WAKE | MCTL_HPS, v2);
3767
3768	awake_before = ((v1 & MCTL_WAKE) || ((v1 & MCTL_HPS) == 0));
3769
3770	if (!awake_before)
3771		brcms_b_wait_for_wake(wlc->hw);
3772}
3773
3774/*
3775 * Write this BSS config's MAC address to core.
3776 * Updates RXE match engine.
3777 */
3778static int brcms_c_set_mac(struct brcms_bss_cfg *bsscfg)
3779{
3780	int err = 0;
3781	struct brcms_c_info *wlc = bsscfg->wlc;
3782
3783	/* enter the MAC addr into the RXE match registers */
3784	brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, wlc->pub->cur_etheraddr);
3785
3786	brcms_c_ampdu_macaddr_upd(wlc);
3787
3788	return err;
3789}
3790
3791/* Write the BSS config's BSSID address to core (set_bssid in d11procs.tcl).
3792 * Updates RXE match engine.
3793 */
3794static void brcms_c_set_bssid(struct brcms_bss_cfg *bsscfg)
3795{
3796	/* we need to update BSSID in RXE match registers */
3797	brcms_c_set_addrmatch(bsscfg->wlc, RCM_BSSID_OFFSET, bsscfg->BSSID);
3798}
3799
3800void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid, size_t ssid_len)
3801{
3802	u8 len = min_t(u8, sizeof(wlc->bsscfg->SSID), ssid_len);
3803	memset(wlc->bsscfg->SSID, 0, sizeof(wlc->bsscfg->SSID));
3804
3805	memcpy(wlc->bsscfg->SSID, ssid, len);
3806	wlc->bsscfg->SSID_len = len;
3807}
3808
3809static void brcms_b_set_shortslot(struct brcms_hardware *wlc_hw, bool shortslot)
3810{
3811	wlc_hw->shortslot = shortslot;
3812
3813	if (wlc_hw->band->bandtype == BRCM_BAND_2G && wlc_hw->up) {
3814		brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
3815		brcms_b_update_slot_timing(wlc_hw, shortslot);
3816		brcms_c_enable_mac(wlc_hw->wlc);
3817	}
3818}
3819
3820/*
3821 * Suspend the the MAC and update the slot timing
3822 * for standard 11b/g (20us slots) or shortslot 11g (9us slots).
3823 */
3824static void brcms_c_switch_shortslot(struct brcms_c_info *wlc, bool shortslot)
3825{
3826	/* use the override if it is set */
3827	if (wlc->shortslot_override != BRCMS_SHORTSLOT_AUTO)
3828		shortslot = (wlc->shortslot_override == BRCMS_SHORTSLOT_ON);
3829
3830	if (wlc->shortslot == shortslot)
3831		return;
3832
3833	wlc->shortslot = shortslot;
3834
3835	brcms_b_set_shortslot(wlc->hw, shortslot);
3836}
3837
3838static void brcms_c_set_home_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3839{
3840	if (wlc->home_chanspec != chanspec) {
3841		wlc->home_chanspec = chanspec;
3842
3843		if (wlc->pub->associated)
3844			wlc->bsscfg->current_bss->chanspec = chanspec;
3845	}
3846}
3847
3848void
3849brcms_b_set_chanspec(struct brcms_hardware *wlc_hw, u16 chanspec,
3850		      bool mute_tx, struct txpwr_limits *txpwr)
3851{
3852	uint bandunit;
3853
3854	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: 0x%x\n", wlc_hw->unit,
3855			   chanspec);
3856
3857	wlc_hw->chanspec = chanspec;
3858
3859	/* Switch bands if necessary */
3860	if (wlc_hw->_nbands > 1) {
3861		bandunit = chspec_bandunit(chanspec);
3862		if (wlc_hw->band->bandunit != bandunit) {
3863			/* brcms_b_setband disables other bandunit,
3864			 *  use light band switch if not up yet
3865			 */
3866			if (wlc_hw->up) {
3867				wlc_phy_chanspec_radio_set(wlc_hw->
3868							   bandstate[bandunit]->
3869							   pi, chanspec);
3870				brcms_b_setband(wlc_hw, bandunit, chanspec);
3871			} else {
3872				brcms_c_setxband(wlc_hw, bandunit);
3873			}
3874		}
3875	}
3876
3877	wlc_phy_initcal_enable(wlc_hw->band->pi, !mute_tx);
3878
3879	if (!wlc_hw->up) {
3880		if (wlc_hw->clk)
3881			wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr,
3882						  chanspec);
3883		wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3884	} else {
3885		wlc_phy_chanspec_set(wlc_hw->band->pi, chanspec);
3886		wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr, chanspec);
3887
3888		/* Update muting of the channel */
3889		brcms_b_mute(wlc_hw, mute_tx);
3890	}
3891}
3892
3893/* switch to and initialize new band */
3894static void brcms_c_setband(struct brcms_c_info *wlc,
3895					   uint bandunit)
3896{
3897	wlc->band = wlc->bandstate[bandunit];
3898
3899	if (!wlc->pub->up)
3900		return;
3901
3902	/* wait for at least one beacon before entering sleeping state */
3903	brcms_c_set_ps_ctrl(wlc);
3904
3905	/* band-specific initializations */
3906	brcms_c_bsinit(wlc);
3907}
3908
3909static void brcms_c_set_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3910{
3911	uint bandunit;
3912	bool switchband = false;
3913	u16 old_chanspec = wlc->chanspec;
3914
3915	if (!brcms_c_valid_chanspec_db(wlc->cmi, chanspec)) {
3916		brcms_err(wlc->hw->d11core, "wl%d: %s: Bad channel %d\n",
3917			  wlc->pub->unit, __func__, CHSPEC_CHANNEL(chanspec));
3918		return;
3919	}
3920
3921	/* Switch bands if necessary */
3922	if (wlc->pub->_nbands > 1) {
3923		bandunit = chspec_bandunit(chanspec);
3924		if (wlc->band->bandunit != bandunit || wlc->bandinit_pending) {
3925			switchband = true;
3926			if (wlc->bandlocked) {
3927				brcms_err(wlc->hw->d11core,
3928					  "wl%d: %s: chspec %d band is locked!\n",
3929					  wlc->pub->unit, __func__,
3930					  CHSPEC_CHANNEL(chanspec));
3931				return;
3932			}
3933			/*
3934			 * should the setband call come after the
3935			 * brcms_b_chanspec() ? if the setband updates
3936			 * (brcms_c_bsinit) use low level calls to inspect and
3937			 * set state, the state inspected may be from the wrong
3938			 * band, or the following brcms_b_set_chanspec() may
3939			 * undo the work.
3940			 */
3941			brcms_c_setband(wlc, bandunit);
3942		}
3943	}
3944
3945	/* sync up phy/radio chanspec */
3946	brcms_c_set_phy_chanspec(wlc, chanspec);
3947
3948	/* init antenna selection */
3949	if (brcms_chspec_bw(old_chanspec) != brcms_chspec_bw(chanspec)) {
3950		brcms_c_antsel_init(wlc->asi);
3951
3952		/* Fix the hardware rateset based on bw.
3953		 * Mainly add MCS32 for 40Mhz, remove MCS 32 for 20Mhz
3954		 */
3955		brcms_c_rateset_bw_mcs_filter(&wlc->band->hw_rateset,
3956			wlc->band->mimo_cap_40 ? brcms_chspec_bw(chanspec) : 0);
3957	}
3958
3959	/* update some mac configuration since chanspec changed */
3960	brcms_c_ucode_mac_upd(wlc);
3961}
3962
3963/*
3964 * This function changes the phytxctl for beacon based on current
3965 * beacon ratespec AND txant setting as per this table:
3966 *  ratespec     CCK		ant = wlc->stf->txant
3967 *		OFDM		ant = 3
3968 */
3969void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc,
3970				       u32 bcn_rspec)
3971{
3972	u16 phyctl;
3973	u16 phytxant = wlc->stf->phytxant;
3974	u16 mask = PHY_TXC_ANT_MASK;
3975
3976	/* for non-siso rates or default setting, use the available chains */
3977	if (BRCMS_PHY_11N_CAP(wlc->band))
3978		phytxant = brcms_c_stf_phytxchain_sel(wlc, bcn_rspec);
3979
3980	phyctl = brcms_b_read_shm(wlc->hw, M_BCN_PCTLWD);
3981	phyctl = (phyctl & ~mask) | phytxant;
3982	brcms_b_write_shm(wlc->hw, M_BCN_PCTLWD, phyctl);
3983}
3984
3985/*
3986 * centralized protection config change function to simplify debugging, no
3987 * consistency checking this should be called only on changes to avoid overhead
3988 * in periodic function
3989 */
3990void brcms_c_protection_upd(struct brcms_c_info *wlc, uint idx, int val)
3991{
3992	/*
3993	 * Cannot use brcms_dbg_* here because this function is called
3994	 * before wlc is sufficiently initialized.
3995	 */
3996	BCMMSG(wlc->wiphy, "idx %d, val %d\n", idx, val);
3997
3998	switch (idx) {
3999	case BRCMS_PROT_G_SPEC:
4000		wlc->protection->_g = (bool) val;
4001		break;
4002	case BRCMS_PROT_G_OVR:
4003		wlc->protection->g_override = (s8) val;
4004		break;
4005	case BRCMS_PROT_G_USER:
4006		wlc->protection->gmode_user = (u8) val;
4007		break;
4008	case BRCMS_PROT_OVERLAP:
4009		wlc->protection->overlap = (s8) val;
4010		break;
4011	case BRCMS_PROT_N_USER:
4012		wlc->protection->nmode_user = (s8) val;
4013		break;
4014	case BRCMS_PROT_N_CFG:
4015		wlc->protection->n_cfg = (s8) val;
4016		break;
4017	case BRCMS_PROT_N_CFG_OVR:
4018		wlc->protection->n_cfg_override = (s8) val;
4019		break;
4020	case BRCMS_PROT_N_NONGF:
4021		wlc->protection->nongf = (bool) val;
4022		break;
4023	case BRCMS_PROT_N_NONGF_OVR:
4024		wlc->protection->nongf_override = (s8) val;
4025		break;
4026	case BRCMS_PROT_N_PAM_OVR:
4027		wlc->protection->n_pam_override = (s8) val;
4028		break;
4029	case BRCMS_PROT_N_OBSS:
4030		wlc->protection->n_obss = (bool) val;
4031		break;
4032
4033	default:
4034		break;
4035	}
4036
4037}
4038
4039static void brcms_c_ht_update_sgi_rx(struct brcms_c_info *wlc, int val)
4040{
4041	if (wlc->pub->up) {
4042		brcms_c_update_beacon(wlc);
4043		brcms_c_update_probe_resp(wlc, true);
4044	}
4045}
4046
4047static void brcms_c_ht_update_ldpc(struct brcms_c_info *wlc, s8 val)
4048{
4049	wlc->stf->ldpc = val;
4050
4051	if (wlc->pub->up) {
4052		brcms_c_update_beacon(wlc);
4053		brcms_c_update_probe_resp(wlc, true);
4054		wlc_phy_ldpc_override_set(wlc->band->pi, (val ? true : false));
4055	}
4056}
4057
4058void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
4059		       const struct ieee80211_tx_queue_params *params,
4060		       bool suspend)
4061{
4062	int i;
4063	struct shm_acparams acp_shm;
4064	u16 *shm_entry;
4065
4066	/* Only apply params if the core is out of reset and has clocks */
4067	if (!wlc->clk) {
4068		brcms_err(wlc->hw->d11core, "wl%d: %s : no-clock\n",
4069			  wlc->pub->unit, __func__);
4070		return;
4071	}
4072
4073	memset(&acp_shm, 0, sizeof(struct shm_acparams));
4074	/* fill in shm ac params struct */
4075	acp_shm.txop = params->txop;
4076	/* convert from units of 32us to us for ucode */
4077	wlc->edcf_txop[aci & 0x3] = acp_shm.txop =
4078	    EDCF_TXOP2USEC(acp_shm.txop);
4079	acp_shm.aifs = (params->aifs & EDCF_AIFSN_MASK);
4080
4081	if (aci == IEEE80211_AC_VI && acp_shm.txop == 0
4082	    && acp_shm.aifs < EDCF_AIFSN_MAX)
4083		acp_shm.aifs++;
4084
4085	if (acp_shm.aifs < EDCF_AIFSN_MIN
4086	    || acp_shm.aifs > EDCF_AIFSN_MAX) {
4087		brcms_err(wlc->hw->d11core, "wl%d: edcf_setparams: bad "
4088			  "aifs %d\n", wlc->pub->unit, acp_shm.aifs);
4089	} else {
4090		acp_shm.cwmin = params->cw_min;
4091		acp_shm.cwmax = params->cw_max;
4092		acp_shm.cwcur = acp_shm.cwmin;
4093		acp_shm.bslots =
4094			bcma_read16(wlc->hw->d11core, D11REGOFFS(tsf_random)) &
4095			acp_shm.cwcur;
4096		acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
4097		/* Indicate the new params to the ucode */
4098		acp_shm.status = brcms_b_read_shm(wlc->hw, (M_EDCF_QINFO +
4099						  wme_ac2fifo[aci] *
4100						  M_EDCF_QLEN +
4101						  M_EDCF_STATUS_OFF));
4102		acp_shm.status |= WME_STATUS_NEWAC;
4103
4104		/* Fill in shm acparam table */
4105		shm_entry = (u16 *) &acp_shm;
4106		for (i = 0; i < (int)sizeof(struct shm_acparams); i += 2)
4107			brcms_b_write_shm(wlc->hw,
4108					  M_EDCF_QINFO +
4109					  wme_ac2fifo[aci] * M_EDCF_QLEN + i,
4110					  *shm_entry++);
4111	}
4112
4113	if (suspend)
4114		brcms_c_suspend_mac_and_wait(wlc);
4115
4116	brcms_c_update_beacon(wlc);
4117	brcms_c_update_probe_resp(wlc, false);
4118
4119	if (suspend)
4120		brcms_c_enable_mac(wlc);
4121}
4122
4123static void brcms_c_edcf_setparams(struct brcms_c_info *wlc, bool suspend)
4124{
4125	u16 aci;
4126	int i_ac;
4127	struct ieee80211_tx_queue_params txq_pars;
4128	static const struct edcf_acparam default_edcf_acparams[] = {
4129		 {EDCF_AC_BE_ACI_STA, EDCF_AC_BE_ECW_STA, EDCF_AC_BE_TXOP_STA},
4130		 {EDCF_AC_BK_ACI_STA, EDCF_AC_BK_ECW_STA, EDCF_AC_BK_TXOP_STA},
4131		 {EDCF_AC_VI_ACI_STA, EDCF_AC_VI_ECW_STA, EDCF_AC_VI_TXOP_STA},
4132		 {EDCF_AC_VO_ACI_STA, EDCF_AC_VO_ECW_STA, EDCF_AC_VO_TXOP_STA}
4133	}; /* ucode needs these parameters during its initialization */
4134	const struct edcf_acparam *edcf_acp = &default_edcf_acparams[0];
4135
4136	for (i_ac = 0; i_ac < IEEE80211_NUM_ACS; i_ac++, edcf_acp++) {
4137		/* find out which ac this set of params applies to */
4138		aci = (edcf_acp->ACI & EDCF_ACI_MASK) >> EDCF_ACI_SHIFT;
4139
4140		/* fill in shm ac params struct */
4141		txq_pars.txop = edcf_acp->TXOP;
4142		txq_pars.aifs = edcf_acp->ACI;
4143
4144		/* CWmin = 2^(ECWmin) - 1 */
4145		txq_pars.cw_min = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
4146		/* CWmax = 2^(ECWmax) - 1 */
4147		txq_pars.cw_max = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
4148					    >> EDCF_ECWMAX_SHIFT);
4149		brcms_c_wme_setparams(wlc, aci, &txq_pars, suspend);
4150	}
4151
4152	if (suspend) {
4153		brcms_c_suspend_mac_and_wait(wlc);
4154		brcms_c_enable_mac(wlc);
4155	}
4156}
4157
4158static void brcms_c_radio_monitor_start(struct brcms_c_info *wlc)
4159{
4160	/* Don't start the timer if HWRADIO feature is disabled */
4161	if (wlc->radio_monitor)
4162		return;
4163
4164	wlc->radio_monitor = true;
4165	brcms_b_pllreq(wlc->hw, true, BRCMS_PLLREQ_RADIO_MON);
4166	brcms_add_timer(wlc->radio_timer, TIMER_INTERVAL_RADIOCHK, true);
4167}
4168
4169static bool brcms_c_radio_monitor_stop(struct brcms_c_info *wlc)
4170{
4171	if (!wlc->radio_monitor)
4172		return true;
4173
4174	wlc->radio_monitor = false;
4175	brcms_b_pllreq(wlc->hw, false, BRCMS_PLLREQ_RADIO_MON);
4176	return brcms_del_timer(wlc->radio_timer);
4177}
4178
4179/* read hwdisable state and propagate to wlc flag */
4180static void brcms_c_radio_hwdisable_upd(struct brcms_c_info *wlc)
4181{
4182	if (wlc->pub->hw_off)
4183		return;
4184
4185	if (brcms_b_radio_read_hwdisabled(wlc->hw))
4186		mboolset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4187	else
4188		mboolclr(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4189}
4190
4191/* update hwradio status and return it */
4192bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc)
4193{
4194	brcms_c_radio_hwdisable_upd(wlc);
4195
4196	return mboolisset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE) ?
4197			true : false;
4198}
4199
4200/* periodical query hw radio button while driver is "down" */
4201static void brcms_c_radio_timer(void *arg)
4202{
4203	struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4204
4205	if (brcms_deviceremoved(wlc)) {
4206		brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4207			  wlc->pub->unit, __func__);
4208		brcms_down(wlc->wl);
4209		return;
4210	}
4211
4212	brcms_c_radio_hwdisable_upd(wlc);
4213}
4214
4215/* common low-level watchdog code */
4216static void brcms_b_watchdog(struct brcms_c_info *wlc)
4217{
4218	struct brcms_hardware *wlc_hw = wlc->hw;
4219
4220	if (!wlc_hw->up)
4221		return;
4222
4223	/* increment second count */
4224	wlc_hw->now++;
4225
4226	/* Check for FIFO error interrupts */
4227	brcms_b_fifoerrors(wlc_hw);
4228
4229	/* make sure RX dma has buffers */
4230	dma_rxfill(wlc->hw->di[RX_FIFO]);
4231
4232	wlc_phy_watchdog(wlc_hw->band->pi);
4233}
4234
4235/* common watchdog code */
4236static void brcms_c_watchdog(struct brcms_c_info *wlc)
4237{
4238	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
4239
4240	if (!wlc->pub->up)
4241		return;
4242
4243	if (brcms_deviceremoved(wlc)) {
4244		brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4245			  wlc->pub->unit, __func__);
4246		brcms_down(wlc->wl);
4247		return;
4248	}
4249
4250	/* increment second count */
4251	wlc->pub->now++;
4252
4253	brcms_c_radio_hwdisable_upd(wlc);
4254	/* if radio is disable, driver may be down, quit here */
4255	if (wlc->pub->radio_disabled)
4256		return;
4257
4258	brcms_b_watchdog(wlc);
4259
4260	/*
4261	 * occasionally sample mac stat counters to
4262	 * detect 16-bit counter wrap
4263	 */
4264	if ((wlc->pub->now % SW_TIMER_MAC_STAT_UPD) == 0)
4265		brcms_c_statsupd(wlc);
4266
4267	if (BRCMS_ISNPHY(wlc->band) &&
4268	    ((wlc->pub->now - wlc->tempsense_lasttime) >=
4269	     BRCMS_TEMPSENSE_PERIOD)) {
4270		wlc->tempsense_lasttime = wlc->pub->now;
4271		brcms_c_tempsense_upd(wlc);
4272	}
4273}
4274
4275static void brcms_c_watchdog_by_timer(void *arg)
4276{
4277	struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4278
4279	brcms_c_watchdog(wlc);
4280}
4281
4282static bool brcms_c_timers_init(struct brcms_c_info *wlc, int unit)
4283{
4284	wlc->wdtimer = brcms_init_timer(wlc->wl, brcms_c_watchdog_by_timer,
4285		wlc, "watchdog");
4286	if (!wlc->wdtimer) {
4287		wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for wdtimer "
4288			  "failed\n", unit);
4289		goto fail;
4290	}
4291
4292	wlc->radio_timer = brcms_init_timer(wlc->wl, brcms_c_radio_timer,
4293		wlc, "radio");
4294	if (!wlc->radio_timer) {
4295		wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for radio_timer "
4296			  "failed\n", unit);
4297		goto fail;
4298	}
4299
4300	return true;
4301
4302 fail:
4303	return false;
4304}
4305
4306/*
4307 * Initialize brcms_c_info default values ...
4308 * may get overrides later in this function
4309 */
4310static void brcms_c_info_init(struct brcms_c_info *wlc, int unit)
4311{
4312	int i;
4313
4314	/* Save our copy of the chanspec */
4315	wlc->chanspec = ch20mhz_chspec(1);
4316
4317	/* various 802.11g modes */
4318	wlc->shortslot = false;
4319	wlc->shortslot_override = BRCMS_SHORTSLOT_AUTO;
4320
4321	brcms_c_protection_upd(wlc, BRCMS_PROT_G_OVR, BRCMS_PROTECTION_AUTO);
4322	brcms_c_protection_upd(wlc, BRCMS_PROT_G_SPEC, false);
4323
4324	brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG_OVR,
4325			       BRCMS_PROTECTION_AUTO);
4326	brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG, BRCMS_N_PROTECTION_OFF);
4327	brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF_OVR,
4328			       BRCMS_PROTECTION_AUTO);
4329	brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF, false);
4330	brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, AUTO);
4331
4332	brcms_c_protection_upd(wlc, BRCMS_PROT_OVERLAP,
4333			       BRCMS_PROTECTION_CTL_OVERLAP);
4334
4335	/* 802.11g draft 4.0 NonERP elt advertisement */
4336	wlc->include_legacy_erp = true;
4337
4338	wlc->stf->ant_rx_ovr = ANT_RX_DIV_DEF;
4339	wlc->stf->txant = ANT_TX_DEF;
4340
4341	wlc->prb_resp_timeout = BRCMS_PRB_RESP_TIMEOUT;
4342
4343	wlc->usr_fragthresh = DOT11_DEFAULT_FRAG_LEN;
4344	for (i = 0; i < NFIFO; i++)
4345		wlc->fragthresh[i] = DOT11_DEFAULT_FRAG_LEN;
4346	wlc->RTSThresh = DOT11_DEFAULT_RTS_LEN;
4347
4348	/* default rate fallback retry limits */
4349	wlc->SFBL = RETRY_SHORT_FB;
4350	wlc->LFBL = RETRY_LONG_FB;
4351
4352	/* default mac retry limits */
4353	wlc->SRL = RETRY_SHORT_DEF;
4354	wlc->LRL = RETRY_LONG_DEF;
4355
4356	/* WME QoS mode is Auto by default */
4357	wlc->pub->_ampdu = AMPDU_AGG_HOST;
4358}
4359
4360static uint brcms_c_attach_module(struct brcms_c_info *wlc)
4361{
4362	uint err = 0;
4363	uint unit;
4364	unit = wlc->pub->unit;
4365
4366	wlc->asi = brcms_c_antsel_attach(wlc);
4367	if (wlc->asi == NULL) {
4368		wiphy_err(wlc->wiphy, "wl%d: attach: antsel_attach "
4369			  "failed\n", unit);
4370		err = 44;
4371		goto fail;
4372	}
4373
4374	wlc->ampdu = brcms_c_ampdu_attach(wlc);
4375	if (wlc->ampdu == NULL) {
4376		wiphy_err(wlc->wiphy, "wl%d: attach: ampdu_attach "
4377			  "failed\n", unit);
4378		err = 50;
4379		goto fail;
4380	}
4381
4382	if ((brcms_c_stf_attach(wlc) != 0)) {
4383		wiphy_err(wlc->wiphy, "wl%d: attach: stf_attach "
4384			  "failed\n", unit);
4385		err = 68;
4386		goto fail;
4387	}
4388 fail:
4389	return err;
4390}
4391
4392struct brcms_pub *brcms_c_pub(struct brcms_c_info *wlc)
4393{
4394	return wlc->pub;
4395}
4396
4397/* low level attach
4398 *    run backplane attach, init nvram
4399 *    run phy attach
4400 *    initialize software state for each core and band
4401 *    put the whole chip in reset(driver down state), no clock
4402 */
4403static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
4404			  uint unit, bool piomode)
4405{
4406	struct brcms_hardware *wlc_hw;
4407	uint err = 0;
4408	uint j;
4409	bool wme = false;
4410	struct shared_phy_params sha_params;
4411	struct wiphy *wiphy = wlc->wiphy;
4412	struct pci_dev *pcidev = core->bus->host_pci;
4413	struct ssb_sprom *sprom = &core->bus->sprom;
4414
4415	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI)
4416		brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4417			       pcidev->vendor,
4418			       pcidev->device);
4419	else
4420		brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4421			       core->bus->boardinfo.vendor,
4422			       core->bus->boardinfo.type);
4423
4424	wme = true;
4425
4426	wlc_hw = wlc->hw;
4427	wlc_hw->wlc = wlc;
4428	wlc_hw->unit = unit;
4429	wlc_hw->band = wlc_hw->bandstate[0];
4430	wlc_hw->_piomode = piomode;
4431
4432	/* populate struct brcms_hardware with default values  */
4433	brcms_b_info_init(wlc_hw);
4434
4435	/*
4436	 * Do the hardware portion of the attach. Also initialize software
4437	 * state that depends on the particular hardware we are running.
4438	 */
4439	wlc_hw->sih = ai_attach(core->bus);
4440	if (wlc_hw->sih == NULL) {
4441		wiphy_err(wiphy, "wl%d: brcms_b_attach: si_attach failed\n",
4442			  unit);
4443		err = 11;
4444		goto fail;
4445	}
4446
4447	/* verify again the device is supported */
4448	if (!brcms_c_chipmatch(core)) {
4449		wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported device\n",
4450			 unit);
4451		err = 12;
4452		goto fail;
4453	}
4454
4455	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI) {
4456		wlc_hw->vendorid = pcidev->vendor;
4457		wlc_hw->deviceid = pcidev->device;
4458	} else {
4459		wlc_hw->vendorid = core->bus->boardinfo.vendor;
4460		wlc_hw->deviceid = core->bus->boardinfo.type;
4461	}
4462
4463	wlc_hw->d11core = core;
4464	wlc_hw->corerev = core->id.rev;
4465
4466	/* validate chip, chiprev and corerev */
4467	if (!brcms_c_isgoodchip(wlc_hw)) {
4468		err = 13;
4469		goto fail;
4470	}
4471
4472	/* initialize power control registers */
4473	ai_clkctl_init(wlc_hw->sih);
4474
4475	/* request fastclock and force fastclock for the rest of attach
4476	 * bring the d11 core out of reset.
4477	 *   For PMU chips, the first wlc_clkctl_clk is no-op since core-clk
4478	 *   is still false; But it will be called again inside wlc_corereset,
4479	 *   after d11 is out of reset.
4480	 */
4481	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4482	brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4483
4484	if (!brcms_b_validate_chip_access(wlc_hw)) {
4485		wiphy_err(wiphy, "wl%d: brcms_b_attach: validate_chip_access "
4486			"failed\n", unit);
4487		err = 14;
4488		goto fail;
4489	}
4490
4491	/* get the board rev, used just below */
4492	j = sprom->board_rev;
4493	/* promote srom boardrev of 0xFF to 1 */
4494	if (j == BOARDREV_PROMOTABLE)
4495		j = BOARDREV_PROMOTED;
4496	wlc_hw->boardrev = (u16) j;
4497	if (!brcms_c_validboardtype(wlc_hw)) {
4498		wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported Broadcom "
4499			  "board type (0x%x)" " or revision level (0x%x)\n",
4500			  unit, ai_get_boardtype(wlc_hw->sih),
4501			  wlc_hw->boardrev);
4502		err = 15;
4503		goto fail;
4504	}
4505	wlc_hw->sromrev = sprom->revision;
4506	wlc_hw->boardflags = sprom->boardflags_lo + (sprom->boardflags_hi << 16);
4507	wlc_hw->boardflags2 = sprom->boardflags2_lo + (sprom->boardflags2_hi << 16);
4508
4509	if (wlc_hw->boardflags & BFL_NOPLLDOWN)
4510		brcms_b_pllreq(wlc_hw, true, BRCMS_PLLREQ_SHARED);
4511
4512	/* check device id(srom, nvram etc.) to set bands */
4513	if (wlc_hw->deviceid == BCM43224_D11N_ID ||
4514	    wlc_hw->deviceid == BCM43224_D11N_ID_VEN1 ||
4515	    wlc_hw->deviceid == BCM43224_CHIP_ID)
4516		/* Dualband boards */
4517		wlc_hw->_nbands = 2;
4518	else
4519		wlc_hw->_nbands = 1;
4520
4521	if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225))
4522		wlc_hw->_nbands = 1;
4523
4524	/* BMAC_NOTE: remove init of pub values when brcms_c_attach()
4525	 * unconditionally does the init of these values
4526	 */
4527	wlc->vendorid = wlc_hw->vendorid;
4528	wlc->deviceid = wlc_hw->deviceid;
4529	wlc->pub->sih = wlc_hw->sih;
4530	wlc->pub->corerev = wlc_hw->corerev;
4531	wlc->pub->sromrev = wlc_hw->sromrev;
4532	wlc->pub->boardrev = wlc_hw->boardrev;
4533	wlc->pub->boardflags = wlc_hw->boardflags;
4534	wlc->pub->boardflags2 = wlc_hw->boardflags2;
4535	wlc->pub->_nbands = wlc_hw->_nbands;
4536
4537	wlc_hw->physhim = wlc_phy_shim_attach(wlc_hw, wlc->wl, wlc);
4538
4539	if (wlc_hw->physhim == NULL) {
4540		wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_shim_attach "
4541			"failed\n", unit);
4542		err = 25;
4543		goto fail;
4544	}
4545
4546	/* pass all the parameters to wlc_phy_shared_attach in one struct */
4547	sha_params.sih = wlc_hw->sih;
4548	sha_params.physhim = wlc_hw->physhim;
4549	sha_params.unit = unit;
4550	sha_params.corerev = wlc_hw->corerev;
4551	sha_params.vid = wlc_hw->vendorid;
4552	sha_params.did = wlc_hw->deviceid;
4553	sha_params.chip = ai_get_chip_id(wlc_hw->sih);
4554	sha_params.chiprev = ai_get_chiprev(wlc_hw->sih);
4555	sha_params.chippkg = ai_get_chippkg(wlc_hw->sih);
4556	sha_params.sromrev = wlc_hw->sromrev;
4557	sha_params.boardtype = ai_get_boardtype(wlc_hw->sih);
4558	sha_params.boardrev = wlc_hw->boardrev;
4559	sha_params.boardflags = wlc_hw->boardflags;
4560	sha_params.boardflags2 = wlc_hw->boardflags2;
4561
4562	/* alloc and save pointer to shared phy state area */
4563	wlc_hw->phy_sh = wlc_phy_shared_attach(&sha_params);
4564	if (!wlc_hw->phy_sh) {
4565		err = 16;
4566		goto fail;
4567	}
4568
4569	/* initialize software state for each core and band */
4570	for (j = 0; j < wlc_hw->_nbands; j++) {
4571		/*
4572		 * band0 is always 2.4Ghz
4573		 * band1, if present, is 5Ghz
4574		 */
4575
4576		brcms_c_setxband(wlc_hw, j);
4577
4578		wlc_hw->band->bandunit = j;
4579		wlc_hw->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4580		wlc->band->bandunit = j;
4581		wlc->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4582		wlc->core->coreidx = core->core_index;
4583
4584		wlc_hw->machwcap = bcma_read32(core, D11REGOFFS(machwcap));
4585		wlc_hw->machwcap_backup = wlc_hw->machwcap;
4586
4587		/* init tx fifo size */
4588		WARN_ON((wlc_hw->corerev - XMTFIFOTBL_STARTREV) < 0 ||
4589			(wlc_hw->corerev - XMTFIFOTBL_STARTREV) >
4590				ARRAY_SIZE(xmtfifo_sz));
4591		wlc_hw->xmtfifo_sz =
4592		    xmtfifo_sz[(wlc_hw->corerev - XMTFIFOTBL_STARTREV)];
4593		WARN_ON(!wlc_hw->xmtfifo_sz[0]);
4594
4595		/* Get a phy for this band */
4596		wlc_hw->band->pi =
4597			wlc_phy_attach(wlc_hw->phy_sh, core,
4598				       wlc_hw->band->bandtype,
4599				       wlc->wiphy);
4600		if (wlc_hw->band->pi == NULL) {
4601			wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_"
4602				  "attach failed\n", unit);
4603			err = 17;
4604			goto fail;
4605		}
4606
4607		wlc_phy_machwcap_set(wlc_hw->band->pi, wlc_hw->machwcap);
4608
4609		wlc_phy_get_phyversion(wlc_hw->band->pi, &wlc_hw->band->phytype,
4610				       &wlc_hw->band->phyrev,
4611				       &wlc_hw->band->radioid,
4612				       &wlc_hw->band->radiorev);
4613		wlc_hw->band->abgphy_encore =
4614		    wlc_phy_get_encore(wlc_hw->band->pi);
4615		wlc->band->abgphy_encore = wlc_phy_get_encore(wlc_hw->band->pi);
4616		wlc_hw->band->core_flags =
4617		    wlc_phy_get_coreflags(wlc_hw->band->pi);
4618
4619		/* verify good phy_type & supported phy revision */
4620		if (BRCMS_ISNPHY(wlc_hw->band)) {
4621			if (NCONF_HAS(wlc_hw->band->phyrev))
4622				goto good_phy;
4623			else
4624				goto bad_phy;
4625		} else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
4626			if (LCNCONF_HAS(wlc_hw->band->phyrev))
4627				goto good_phy;
4628			else
4629				goto bad_phy;
4630		} else {
4631 bad_phy:
4632			wiphy_err(wiphy, "wl%d: brcms_b_attach: unsupported "
4633				  "phy type/rev (%d/%d)\n", unit,
4634				  wlc_hw->band->phytype, wlc_hw->band->phyrev);
4635			err = 18;
4636			goto fail;
4637		}
4638
4639 good_phy:
4640		/*
4641		 * BMAC_NOTE: wlc->band->pi should not be set below and should
4642		 * be done in the high level attach. However we can not make
4643		 * that change until all low level access is changed to
4644		 * wlc_hw->band->pi. Instead do the wlc->band->pi init below,
4645		 * keeping wlc_hw->band->pi as well for incremental update of
4646		 * low level fns, and cut over low only init when all fns
4647		 * updated.
4648		 */
4649		wlc->band->pi = wlc_hw->band->pi;
4650		wlc->band->phytype = wlc_hw->band->phytype;
4651		wlc->band->phyrev = wlc_hw->band->phyrev;
4652		wlc->band->radioid = wlc_hw->band->radioid;
4653		wlc->band->radiorev = wlc_hw->band->radiorev;
4654		brcms_dbg_info(core, "wl%d: phy %u/%u radio %x/%u\n", unit,
4655			       wlc->band->phytype, wlc->band->phyrev,
4656			       wlc->band->radioid, wlc->band->radiorev);
4657		/* default contention windows size limits */
4658		wlc_hw->band->CWmin = APHY_CWMIN;
4659		wlc_hw->band->CWmax = PHY_CWMAX;
4660
4661		if (!brcms_b_attach_dmapio(wlc, j, wme)) {
4662			err = 19;
4663			goto fail;
4664		}
4665	}
4666
4667	/* disable core to match driver "down" state */
4668	brcms_c_coredisable(wlc_hw);
4669
4670	/* Match driver "down" state */
4671	bcma_host_pci_down(wlc_hw->d11core->bus);
4672
4673	/* turn off pll and xtal to match driver "down" state */
4674	brcms_b_xtal(wlc_hw, OFF);
4675
4676	/* *******************************************************************
4677	 * The hardware is in the DOWN state at this point. D11 core
4678	 * or cores are in reset with clocks off, and the board PLLs
4679	 * are off if possible.
4680	 *
4681	 * Beyond this point, wlc->sbclk == false and chip registers
4682	 * should not be touched.
4683	 *********************************************************************
4684	 */
4685
4686	/* init etheraddr state variables */
4687	brcms_c_get_macaddr(wlc_hw, wlc_hw->etheraddr);
4688
4689	if (is_broadcast_ether_addr(wlc_hw->etheraddr) ||
4690	    is_zero_ether_addr(wlc_hw->etheraddr)) {
4691		wiphy_err(wiphy, "wl%d: brcms_b_attach: bad macaddr\n",
4692			  unit);
4693		err = 22;
4694		goto fail;
4695	}
4696
4697	brcms_dbg_info(wlc_hw->d11core, "deviceid 0x%x nbands %d board 0x%x\n",
4698		       wlc_hw->deviceid, wlc_hw->_nbands,
4699		       ai_get_boardtype(wlc_hw->sih));
4700
4701	return err;
4702
4703 fail:
4704	wiphy_err(wiphy, "wl%d: brcms_b_attach: failed with err %d\n", unit,
4705		  err);
4706	return err;
4707}
4708
4709static bool brcms_c_attach_stf_ant_init(struct brcms_c_info *wlc)
4710{
4711	int aa;
4712	uint unit;
4713	int bandtype;
4714	struct ssb_sprom *sprom = &wlc->hw->d11core->bus->sprom;
4715
4716	unit = wlc->pub->unit;
4717	bandtype = wlc->band->bandtype;
4718
4719	/* get antennas available */
4720	if (bandtype == BRCM_BAND_5G)
4721		aa = sprom->ant_available_a;
4722	else
4723		aa = sprom->ant_available_bg;
4724
4725	if ((aa < 1) || (aa > 15)) {
4726		wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
4727			  " srom (0x%x), using 3\n", unit, __func__, aa);
4728		aa = 3;
4729	}
4730
4731	/* reset the defaults if we have a single antenna */
4732	if (aa == 1) {
4733		wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_0;
4734		wlc->stf->txant = ANT_TX_FORCE_0;
4735	} else if (aa == 2) {
4736		wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_1;
4737		wlc->stf->txant = ANT_TX_FORCE_1;
4738	} else {
4739	}
4740
4741	/* Compute Antenna Gain */
4742	if (bandtype == BRCM_BAND_5G)
4743		wlc->band->antgain = sprom->antenna_gain.a1;
4744	else
4745		wlc->band->antgain = sprom->antenna_gain.a0;
4746
4747	return true;
4748}
4749
4750static void brcms_c_bss_default_init(struct brcms_c_info *wlc)
4751{
4752	u16 chanspec;
4753	struct brcms_band *band;
4754	struct brcms_bss_info *bi = wlc->default_bss;
4755
4756	/* init default and target BSS with some sane initial values */
4757	memset(bi, 0, sizeof(*bi));
4758	bi->beacon_period = BEACON_INTERVAL_DEFAULT;
4759
4760	/* fill the default channel as the first valid channel
4761	 * starting from the 2G channels
4762	 */
4763	chanspec = ch20mhz_chspec(1);
4764	wlc->home_chanspec = bi->chanspec = chanspec;
4765
4766	/* find the band of our default channel */
4767	band = wlc->band;
4768	if (wlc->pub->_nbands > 1 &&
4769	    band->bandunit != chspec_bandunit(chanspec))
4770		band = wlc->bandstate[OTHERBANDUNIT(wlc)];
4771
4772	/* init bss rates to the band specific default rate set */
4773	brcms_c_rateset_default(&bi->rateset, NULL, band->phytype,
4774		band->bandtype, false, BRCMS_RATE_MASK_FULL,
4775		(bool) (wlc->pub->_n_enab & SUPPORT_11N),
4776		brcms_chspec_bw(chanspec), wlc->stf->txstreams);
4777
4778	if (wlc->pub->_n_enab & SUPPORT_11N)
4779		bi->flags |= BRCMS_BSS_HT;
4780}
4781
4782static void brcms_c_update_mimo_band_bwcap(struct brcms_c_info *wlc, u8 bwcap)
4783{
4784	uint i;
4785	struct brcms_band *band;
4786
4787	for (i = 0; i < wlc->pub->_nbands; i++) {
4788		band = wlc->bandstate[i];
4789		if (band->bandtype == BRCM_BAND_5G) {
4790			if ((bwcap == BRCMS_N_BW_40ALL)
4791			    || (bwcap == BRCMS_N_BW_20IN2G_40IN5G))
4792				band->mimo_cap_40 = true;
4793			else
4794				band->mimo_cap_40 = false;
4795		} else {
4796			if (bwcap == BRCMS_N_BW_40ALL)
4797				band->mimo_cap_40 = true;
4798			else
4799				band->mimo_cap_40 = false;
4800		}
4801	}
4802}
4803
4804static void brcms_c_timers_deinit(struct brcms_c_info *wlc)
4805{
4806	/* free timer state */
4807	if (wlc->wdtimer) {
4808		brcms_free_timer(wlc->wdtimer);
4809		wlc->wdtimer = NULL;
4810	}
4811	if (wlc->radio_timer) {
4812		brcms_free_timer(wlc->radio_timer);
4813		wlc->radio_timer = NULL;
4814	}
4815}
4816
4817static void brcms_c_detach_module(struct brcms_c_info *wlc)
4818{
4819	if (wlc->asi) {
4820		brcms_c_antsel_detach(wlc->asi);
4821		wlc->asi = NULL;
4822	}
4823
4824	if (wlc->ampdu) {
4825		brcms_c_ampdu_detach(wlc->ampdu);
4826		wlc->ampdu = NULL;
4827	}
4828
4829	brcms_c_stf_detach(wlc);
4830}
4831
4832/*
4833 * low level detach
4834 */
4835static void brcms_b_detach(struct brcms_c_info *wlc)
4836{
4837	uint i;
4838	struct brcms_hw_band *band;
4839	struct brcms_hardware *wlc_hw = wlc->hw;
4840
4841	brcms_b_detach_dmapio(wlc_hw);
4842
4843	band = wlc_hw->band;
4844	for (i = 0; i < wlc_hw->_nbands; i++) {
4845		if (band->pi) {
4846			/* Detach this band's phy */
4847			wlc_phy_detach(band->pi);
4848			band->pi = NULL;
4849		}
4850		band = wlc_hw->bandstate[OTHERBANDUNIT(wlc)];
4851	}
4852
4853	/* Free shared phy state */
4854	kfree(wlc_hw->phy_sh);
4855
4856	wlc_phy_shim_detach(wlc_hw->physhim);
4857
4858	if (wlc_hw->sih) {
4859		ai_detach(wlc_hw->sih);
4860		wlc_hw->sih = NULL;
4861	}
4862}
4863
4864/*
4865 * Return a count of the number of driver callbacks still pending.
4866 *
4867 * General policy is that brcms_c_detach can only dealloc/free software states.
4868 * It can NOT touch hardware registers since the d11core may be in reset and
4869 * clock may not be available.
4870 * One exception is sb register access, which is possible if crystal is turned
4871 * on after "down" state, driver should avoid software timer with the exception
4872 * of radio_monitor.
4873 */
4874uint brcms_c_detach(struct brcms_c_info *wlc)
4875{
4876	uint callbacks;
4877
4878	if (wlc == NULL)
4879		return 0;
4880
4881	brcms_b_detach(wlc);
4882
4883	/* delete software timers */
4884	callbacks = 0;
4885	if (!brcms_c_radio_monitor_stop(wlc))
4886		callbacks++;
4887
4888	brcms_c_channel_mgr_detach(wlc->cmi);
4889
4890	brcms_c_timers_deinit(wlc);
4891
4892	brcms_c_detach_module(wlc);
4893
4894	brcms_c_detach_mfree(wlc);
4895	return callbacks;
4896}
4897
4898/* update state that depends on the current value of "ap" */
4899static void brcms_c_ap_upd(struct brcms_c_info *wlc)
4900{
4901	/* STA-BSS; short capable */
4902	wlc->PLCPHdr_override = BRCMS_PLCP_SHORT;
4903}
4904
4905/* Initialize just the hardware when coming out of POR or S3/S5 system states */
4906static void brcms_b_hw_up(struct brcms_hardware *wlc_hw)
4907{
4908	if (wlc_hw->wlc->pub->hw_up)
4909		return;
4910
4911	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4912
4913	/*
4914	 * Enable pll and xtal, initialize the power control registers,
4915	 * and force fastclock for the remainder of brcms_c_up().
4916	 */
4917	brcms_b_xtal(wlc_hw, ON);
4918	ai_clkctl_init(wlc_hw->sih);
4919	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4920
4921	/*
4922	 * TODO: test suspend/resume
4923	 *
4924	 * AI chip doesn't restore bar0win2 on
4925	 * hibernation/resume, need sw fixup
4926	 */
4927
4928	/*
4929	 * Inform phy that a POR reset has occurred so
4930	 * it does a complete phy init
4931	 */
4932	wlc_phy_por_inform(wlc_hw->band->pi);
4933
4934	wlc_hw->ucode_loaded = false;
4935	wlc_hw->wlc->pub->hw_up = true;
4936
4937	if ((wlc_hw->boardflags & BFL_FEM)
4938	    && (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
4939		if (!
4940		    (wlc_hw->boardrev >= 0x1250
4941		     && (wlc_hw->boardflags & BFL_FEM_BT)))
4942			ai_epa_4313war(wlc_hw->sih);
4943	}
4944}
4945
4946static int brcms_b_up_prep(struct brcms_hardware *wlc_hw)
4947{
4948	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4949
4950	/*
4951	 * Enable pll and xtal, initialize the power control registers,
4952	 * and force fastclock for the remainder of brcms_c_up().
4953	 */
4954	brcms_b_xtal(wlc_hw, ON);
4955	ai_clkctl_init(wlc_hw->sih);
4956	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4957
4958	/*
4959	 * Configure pci/pcmcia here instead of in brcms_c_attach()
4960	 * to allow mfg hotswap:  down, hotswap (chip power cycle), up.
4961	 */
4962	bcma_host_pci_irq_ctl(wlc_hw->d11core->bus, wlc_hw->d11core,
4963			      true);
4964
4965	/*
4966	 * Need to read the hwradio status here to cover the case where the
4967	 * system is loaded with the hw radio disabled. We do not want to
4968	 * bring the driver up in this case.
4969	 */
4970	if (brcms_b_radio_read_hwdisabled(wlc_hw)) {
4971		/* put SB PCI in down state again */
4972		bcma_host_pci_down(wlc_hw->d11core->bus);
4973		brcms_b_xtal(wlc_hw, OFF);
4974		return -ENOMEDIUM;
4975	}
4976
4977	bcma_host_pci_up(wlc_hw->d11core->bus);
4978
4979	/* reset the d11 core */
4980	brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4981
4982	return 0;
4983}
4984
4985static int brcms_b_up_finish(struct brcms_hardware *wlc_hw)
4986{
4987	wlc_hw->up = true;
4988	wlc_phy_hw_state_upd(wlc_hw->band->pi, true);
4989
4990	/* FULLY enable dynamic power control and d11 core interrupt */
4991	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
4992	brcms_intrson(wlc_hw->wlc->wl);
4993	return 0;
4994}
4995
4996/*
4997 * Write WME tunable parameters for retransmit/max rate
4998 * from wlc struct to ucode
4999 */
5000static void brcms_c_wme_retries_write(struct brcms_c_info *wlc)
5001{
5002	int ac;
5003
5004	/* Need clock to do this */
5005	if (!wlc->clk)
5006		return;
5007
5008	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
5009		brcms_b_write_shm(wlc->hw, M_AC_TXLMT_ADDR(ac),
5010				  wlc->wme_retries[ac]);
5011}
5012
5013/* make interface operational */
5014int brcms_c_up(struct brcms_c_info *wlc)
5015{
5016	struct ieee80211_channel *ch;
5017
5018	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5019
5020	/* HW is turned off so don't try to access it */
5021	if (wlc->pub->hw_off || brcms_deviceremoved(wlc))
5022		return -ENOMEDIUM;
5023
5024	if (!wlc->pub->hw_up) {
5025		brcms_b_hw_up(wlc->hw);
5026		wlc->pub->hw_up = true;
5027	}
5028
5029	if ((wlc->pub->boardflags & BFL_FEM)
5030	    && (ai_get_chip_id(wlc->hw->sih) == BCMA_CHIP_ID_BCM4313)) {
5031		if (wlc->pub->boardrev >= 0x1250
5032		    && (wlc->pub->boardflags & BFL_FEM_BT))
5033			brcms_b_mhf(wlc->hw, MHF5, MHF5_4313_GPIOCTRL,
5034				MHF5_4313_GPIOCTRL, BRCM_BAND_ALL);
5035		else
5036			brcms_b_mhf(wlc->hw, MHF4, MHF4_EXTPA_ENABLE,
5037				    MHF4_EXTPA_ENABLE, BRCM_BAND_ALL);
5038	}
5039
5040	/*
5041	 * Need to read the hwradio status here to cover the case where the
5042	 * system is loaded with the hw radio disabled. We do not want to bring
5043	 * the driver up in this case. If radio is disabled, abort up, lower
5044	 * power, start radio timer and return 0(for NDIS) don't call
5045	 * radio_update to avoid looping brcms_c_up.
5046	 *
5047	 * brcms_b_up_prep() returns either 0 or -BCME_RADIOOFF only
5048	 */
5049	if (!wlc->pub->radio_disabled) {
5050		int status = brcms_b_up_prep(wlc->hw);
5051		if (status == -ENOMEDIUM) {
5052			if (!mboolisset
5053			    (wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE)) {
5054				struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
5055				mboolset(wlc->pub->radio_disabled,
5056					 WL_RADIO_HW_DISABLE);
5057				if (bsscfg->type == BRCMS_TYPE_STATION ||
5058				    bsscfg->type == BRCMS_TYPE_ADHOC)
5059					brcms_err(wlc->hw->d11core,
5060						  "wl%d: up: rfdisable -> "
5061						  "bsscfg_disable()\n",
5062						   wlc->pub->unit);
5063			}
5064		}
5065	}
5066
5067	if (wlc->pub->radio_disabled) {
5068		brcms_c_radio_monitor_start(wlc);
5069		return 0;
5070	}
5071
5072	/* brcms_b_up_prep has done brcms_c_corereset(). so clk is on, set it */
5073	wlc->clk = true;
5074
5075	brcms_c_radio_monitor_stop(wlc);
5076
5077	/* Set EDCF hostflags */
5078	brcms_b_mhf(wlc->hw, MHF1, MHF1_EDCF, MHF1_EDCF, BRCM_BAND_ALL);
5079
5080	brcms_init(wlc->wl);
5081	wlc->pub->up = true;
5082
5083	if (wlc->bandinit_pending) {
5084		ch = wlc->pub->ieee_hw->conf.chandef.chan;
5085		brcms_c_suspend_mac_and_wait(wlc);
5086		brcms_c_set_chanspec(wlc, ch20mhz_chspec(ch->hw_value));
5087		wlc->bandinit_pending = false;
5088		brcms_c_enable_mac(wlc);
5089	}
5090
5091	brcms_b_up_finish(wlc->hw);
5092
5093	/* Program the TX wme params with the current settings */
5094	brcms_c_wme_retries_write(wlc);
5095
5096	/* start one second watchdog timer */
5097	brcms_add_timer(wlc->wdtimer, TIMER_INTERVAL_WATCHDOG, true);
5098	wlc->WDarmed = true;
5099
5100	/* ensure antenna config is up to date */
5101	brcms_c_stf_phy_txant_upd(wlc);
5102	/* ensure LDPC config is in sync */
5103	brcms_c_ht_update_ldpc(wlc, wlc->stf->ldpc);
5104
5105	return 0;
5106}
5107
5108static uint brcms_c_down_del_timer(struct brcms_c_info *wlc)
5109{
5110	uint callbacks = 0;
5111
5112	return callbacks;
5113}
5114
5115static int brcms_b_bmac_down_prep(struct brcms_hardware *wlc_hw)
5116{
5117	bool dev_gone;
5118	uint callbacks = 0;
5119
5120	if (!wlc_hw->up)
5121		return callbacks;
5122
5123	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5124
5125	/* disable interrupts */
5126	if (dev_gone)
5127		wlc_hw->wlc->macintmask = 0;
5128	else {
5129		/* now disable interrupts */
5130		brcms_intrsoff(wlc_hw->wlc->wl);
5131
5132		/* ensure we're running on the pll clock again */
5133		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
5134	}
5135	/* down phy at the last of this stage */
5136	callbacks += wlc_phy_down(wlc_hw->band->pi);
5137
5138	return callbacks;
5139}
5140
5141static int brcms_b_down_finish(struct brcms_hardware *wlc_hw)
5142{
5143	uint callbacks = 0;
5144	bool dev_gone;
5145
5146	if (!wlc_hw->up)
5147		return callbacks;
5148
5149	wlc_hw->up = false;
5150	wlc_phy_hw_state_upd(wlc_hw->band->pi, false);
5151
5152	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5153
5154	if (dev_gone) {
5155		wlc_hw->sbclk = false;
5156		wlc_hw->clk = false;
5157		wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
5158
5159		/* reclaim any posted packets */
5160		brcms_c_flushqueues(wlc_hw->wlc);
5161	} else {
5162
5163		/* Reset and disable the core */
5164		if (bcma_core_is_enabled(wlc_hw->d11core)) {
5165			if (bcma_read32(wlc_hw->d11core,
5166					D11REGOFFS(maccontrol)) & MCTL_EN_MAC)
5167				brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
5168			callbacks += brcms_reset(wlc_hw->wlc->wl);
5169			brcms_c_coredisable(wlc_hw);
5170		}
5171
5172		/* turn off primary xtal and pll */
5173		if (!wlc_hw->noreset) {
5174			bcma_host_pci_down(wlc_hw->d11core->bus);
5175			brcms_b_xtal(wlc_hw, OFF);
5176		}
5177	}
5178
5179	return callbacks;
5180}
5181
5182/*
5183 * Mark the interface nonoperational, stop the software mechanisms,
5184 * disable the hardware, free any transient buffer state.
5185 * Return a count of the number of driver callbacks still pending.
5186 */
5187uint brcms_c_down(struct brcms_c_info *wlc)
5188{
5189
5190	uint callbacks = 0;
5191	int i;
5192	bool dev_gone = false;
5193
5194	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5195
5196	/* check if we are already in the going down path */
5197	if (wlc->going_down) {
5198		brcms_err(wlc->hw->d11core,
5199			  "wl%d: %s: Driver going down so return\n",
5200			  wlc->pub->unit, __func__);
5201		return 0;
5202	}
5203	if (!wlc->pub->up)
5204		return callbacks;
5205
5206	wlc->going_down = true;
5207
5208	callbacks += brcms_b_bmac_down_prep(wlc->hw);
5209
5210	dev_gone = brcms_deviceremoved(wlc);
5211
5212	/* Call any registered down handlers */
5213	for (i = 0; i < BRCMS_MAXMODULES; i++) {
5214		if (wlc->modulecb[i].down_fn)
5215			callbacks +=
5216			    wlc->modulecb[i].down_fn(wlc->modulecb[i].hdl);
5217	}
5218
5219	/* cancel the watchdog timer */
5220	if (wlc->WDarmed) {
5221		if (!brcms_del_timer(wlc->wdtimer))
5222			callbacks++;
5223		wlc->WDarmed = false;
5224	}
5225	/* cancel all other timers */
5226	callbacks += brcms_c_down_del_timer(wlc);
5227
5228	wlc->pub->up = false;
5229
5230	wlc_phy_mute_upd(wlc->band->pi, false, PHY_MUTE_ALL);
5231
5232	callbacks += brcms_b_down_finish(wlc->hw);
5233
5234	/* brcms_b_down_finish has done brcms_c_coredisable(). so clk is off */
5235	wlc->clk = false;
5236
5237	wlc->going_down = false;
5238	return callbacks;
5239}
5240
5241/* Set the current gmode configuration */
5242int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config)
5243{
5244	int ret = 0;
5245	uint i;
5246	struct brcms_c_rateset rs;
5247	/* Default to 54g Auto */
5248	/* Advertise and use shortslot (-1/0/1 Auto/Off/On) */
5249	s8 shortslot = BRCMS_SHORTSLOT_AUTO;
5250	bool shortslot_restrict = false; /* Restrict association to stations
5251					  * that support shortslot
5252					  */
5253	bool ofdm_basic = false;	/* Make 6, 12, and 24 basic rates */
5254	/* Advertise and use short preambles (-1/0/1 Auto/Off/On) */
5255	int preamble = BRCMS_PLCP_LONG;
5256	bool preamble_restrict = false;	/* Restrict association to stations
5257					 * that support short preambles
5258					 */
5259	struct brcms_band *band;
5260
5261	/* if N-support is enabled, allow Gmode set as long as requested
5262	 * Gmode is not GMODE_LEGACY_B
5263	 */
5264	if ((wlc->pub->_n_enab & SUPPORT_11N) && gmode == GMODE_LEGACY_B)
5265		return -ENOTSUPP;
5266
5267	/* verify that we are dealing with 2G band and grab the band pointer */
5268	if (wlc->band->bandtype == BRCM_BAND_2G)
5269		band = wlc->band;
5270	else if ((wlc->pub->_nbands > 1) &&
5271		 (wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype == BRCM_BAND_2G))
5272		band = wlc->bandstate[OTHERBANDUNIT(wlc)];
5273	else
5274		return -EINVAL;
5275
5276	/* update configuration value */
5277	if (config)
5278		brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER, gmode);
5279
5280	/* Clear rateset override */
5281	memset(&rs, 0, sizeof(rs));
5282
5283	switch (gmode) {
5284	case GMODE_LEGACY_B:
5285		shortslot = BRCMS_SHORTSLOT_OFF;
5286		brcms_c_rateset_copy(&gphy_legacy_rates, &rs);
5287
5288		break;
5289
5290	case GMODE_LRS:
5291		break;
5292
5293	case GMODE_AUTO:
5294		/* Accept defaults */
5295		break;
5296
5297	case GMODE_ONLY:
5298		ofdm_basic = true;
5299		preamble = BRCMS_PLCP_SHORT;
5300		preamble_restrict = true;
5301		break;
5302
5303	case GMODE_PERFORMANCE:
5304		shortslot = BRCMS_SHORTSLOT_ON;
5305		shortslot_restrict = true;
5306		ofdm_basic = true;
5307		preamble = BRCMS_PLCP_SHORT;
5308		preamble_restrict = true;
5309		break;
5310
5311	default:
5312		/* Error */
5313		brcms_err(wlc->hw->d11core, "wl%d: %s: invalid gmode %d\n",
5314			  wlc->pub->unit, __func__, gmode);
5315		return -ENOTSUPP;
5316	}
5317
5318	band->gmode = gmode;
5319
5320	wlc->shortslot_override = shortslot;
5321
5322	/* Use the default 11g rateset */
5323	if (!rs.count)
5324		brcms_c_rateset_copy(&cck_ofdm_rates, &rs);
5325
5326	if (ofdm_basic) {
5327		for (i = 0; i < rs.count; i++) {
5328			if (rs.rates[i] == BRCM_RATE_6M
5329			    || rs.rates[i] == BRCM_RATE_12M
5330			    || rs.rates[i] == BRCM_RATE_24M)
5331				rs.rates[i] |= BRCMS_RATE_FLAG;
5332		}
5333	}
5334
5335	/* Set default bss rateset */
5336	wlc->default_bss->rateset.count = rs.count;
5337	memcpy(wlc->default_bss->rateset.rates, rs.rates,
5338	       sizeof(wlc->default_bss->rateset.rates));
5339
5340	return ret;
5341}
5342
5343int brcms_c_set_nmode(struct brcms_c_info *wlc)
5344{
5345	uint i;
5346	s32 nmode = AUTO;
5347
5348	if (wlc->stf->txstreams == WL_11N_3x3)
5349		nmode = WL_11N_3x3;
5350	else
5351		nmode = WL_11N_2x2;
5352
5353	/* force GMODE_AUTO if NMODE is ON */
5354	brcms_c_set_gmode(wlc, GMODE_AUTO, true);
5355	if (nmode == WL_11N_3x3)
5356		wlc->pub->_n_enab = SUPPORT_HT;
5357	else
5358		wlc->pub->_n_enab = SUPPORT_11N;
5359	wlc->default_bss->flags |= BRCMS_BSS_HT;
5360	/* add the mcs rates to the default and hw ratesets */
5361	brcms_c_rateset_mcs_build(&wlc->default_bss->rateset,
5362			      wlc->stf->txstreams);
5363	for (i = 0; i < wlc->pub->_nbands; i++)
5364		memcpy(wlc->bandstate[i]->hw_rateset.mcs,
5365		       wlc->default_bss->rateset.mcs, MCSSET_LEN);
5366
5367	return 0;
5368}
5369
5370static int
5371brcms_c_set_internal_rateset(struct brcms_c_info *wlc,
5372			     struct brcms_c_rateset *rs_arg)
5373{
5374	struct brcms_c_rateset rs, new;
5375	uint bandunit;
5376
5377	memcpy(&rs, rs_arg, sizeof(struct brcms_c_rateset));
5378
5379	/* check for bad count value */
5380	if ((rs.count == 0) || (rs.count > BRCMS_NUMRATES))
5381		return -EINVAL;
5382
5383	/* try the current band */
5384	bandunit = wlc->band->bandunit;
5385	memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5386	if (brcms_c_rate_hwrs_filter_sort_validate
5387	    (&new, &wlc->bandstate[bandunit]->hw_rateset, true,
5388	     wlc->stf->txstreams))
5389		goto good;
5390
5391	/* try the other band */
5392	if (brcms_is_mband_unlocked(wlc)) {
5393		bandunit = OTHERBANDUNIT(wlc);
5394		memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5395		if (brcms_c_rate_hwrs_filter_sort_validate(&new,
5396						       &wlc->
5397						       bandstate[bandunit]->
5398						       hw_rateset, true,
5399						       wlc->stf->txstreams))
5400			goto good;
5401	}
5402
5403	return -EBADE;
5404
5405 good:
5406	/* apply new rateset */
5407	memcpy(&wlc->default_bss->rateset, &new,
5408	       sizeof(struct brcms_c_rateset));
5409	memcpy(&wlc->bandstate[bandunit]->defrateset, &new,
5410	       sizeof(struct brcms_c_rateset));
5411	return 0;
5412}
5413
5414static void brcms_c_ofdm_rateset_war(struct brcms_c_info *wlc)
5415{
5416	u8 r;
5417	bool war = false;
5418
5419	if (wlc->pub->associated)
5420		r = wlc->bsscfg->current_bss->rateset.rates[0];
5421	else
5422		r = wlc->default_bss->rateset.rates[0];
5423
5424	wlc_phy_ofdm_rateset_war(wlc->band->pi, war);
5425}
5426
5427int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel)
5428{
5429	u16 chspec = ch20mhz_chspec(channel);
5430
5431	if (channel < 0 || channel > MAXCHANNEL)
5432		return -EINVAL;
5433
5434	if (!brcms_c_valid_chanspec_db(wlc->cmi, chspec))
5435		return -EINVAL;
5436
5437
5438	if (!wlc->pub->up && brcms_is_mband_unlocked(wlc)) {
5439		if (wlc->band->bandunit != chspec_bandunit(chspec))
5440			wlc->bandinit_pending = true;
5441		else
5442			wlc->bandinit_pending = false;
5443	}
5444
5445	wlc->default_bss->chanspec = chspec;
5446	/* brcms_c_BSSinit() will sanitize the rateset before
5447	 * using it.. */
5448	if (wlc->pub->up && (wlc_phy_chanspec_get(wlc->band->pi) != chspec)) {
5449		brcms_c_set_home_chanspec(wlc, chspec);
5450		brcms_c_suspend_mac_and_wait(wlc);
5451		brcms_c_set_chanspec(wlc, chspec);
5452		brcms_c_enable_mac(wlc);
5453	}
5454	return 0;
5455}
5456
5457int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl)
5458{
5459	int ac;
5460
5461	if (srl < 1 || srl > RETRY_SHORT_MAX ||
5462	    lrl < 1 || lrl > RETRY_SHORT_MAX)
5463		return -EINVAL;
5464
5465	wlc->SRL = srl;
5466	wlc->LRL = lrl;
5467
5468	brcms_b_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
5469
5470	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
5471		wlc->wme_retries[ac] =	SFIELD(wlc->wme_retries[ac],
5472					       EDCF_SHORT,  wlc->SRL);
5473		wlc->wme_retries[ac] =	SFIELD(wlc->wme_retries[ac],
5474					       EDCF_LONG, wlc->LRL);
5475	}
5476	brcms_c_wme_retries_write(wlc);
5477
5478	return 0;
5479}
5480
5481void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
5482				 struct brcm_rateset *currs)
5483{
5484	struct brcms_c_rateset *rs;
5485
5486	if (wlc->pub->associated)
5487		rs = &wlc->bsscfg->current_bss->rateset;
5488	else
5489		rs = &wlc->default_bss->rateset;
5490
5491	/* Copy only legacy rateset section */
5492	currs->count = rs->count;
5493	memcpy(&currs->rates, &rs->rates, rs->count);
5494}
5495
5496int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
5497{
5498	struct brcms_c_rateset internal_rs;
5499	int bcmerror;
5500
5501	if (rs->count > BRCMS_NUMRATES)
5502		return -ENOBUFS;
5503
5504	memset(&internal_rs, 0, sizeof(internal_rs));
5505
5506	/* Copy only legacy rateset section */
5507	internal_rs.count = rs->count;
5508	memcpy(&internal_rs.rates, &rs->rates, internal_rs.count);
5509
5510	/* merge rateset coming in with the current mcsset */
5511	if (wlc->pub->_n_enab & SUPPORT_11N) {
5512		struct brcms_bss_info *mcsset_bss;
5513		if (wlc->pub->associated)
5514			mcsset_bss = wlc->bsscfg->current_bss;
5515		else
5516			mcsset_bss = wlc->default_bss;
5517		memcpy(internal_rs.mcs, &mcsset_bss->rateset.mcs[0],
5518		       MCSSET_LEN);
5519	}
5520
5521	bcmerror = brcms_c_set_internal_rateset(wlc, &internal_rs);
5522	if (!bcmerror)
5523		brcms_c_ofdm_rateset_war(wlc);
5524
5525	return bcmerror;
5526}
5527
5528static void brcms_c_time_lock(struct brcms_c_info *wlc)
5529{
5530	bcma_set32(wlc->hw->d11core, D11REGOFFS(maccontrol), MCTL_TBTTHOLD);
5531	/* Commit the write */
5532	bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
5533}
5534
5535static void brcms_c_time_unlock(struct brcms_c_info *wlc)
5536{
5537	bcma_mask32(wlc->hw->d11core, D11REGOFFS(maccontrol), ~MCTL_TBTTHOLD);
5538	/* Commit the write */
5539	bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
5540}
5541
5542int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
5543{
5544	u32 bcnint_us;
5545
5546	if (period == 0)
5547		return -EINVAL;
5548
5549	wlc->default_bss->beacon_period = period;
5550
5551	bcnint_us = period << 10;
5552	brcms_c_time_lock(wlc);
5553	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfprep),
5554		     (bcnint_us << CFPREP_CBI_SHIFT));
5555	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfpstart), bcnint_us);
5556	brcms_c_time_unlock(wlc);
5557
5558	return 0;
5559}
5560
5561u16 brcms_c_get_phy_type(struct brcms_c_info *wlc, int phyidx)
5562{
5563	return wlc->band->phytype;
5564}
5565
5566void brcms_c_set_shortslot_override(struct brcms_c_info *wlc, s8 sslot_override)
5567{
5568	wlc->shortslot_override = sslot_override;
5569
5570	/*
5571	 * shortslot is an 11g feature, so no more work if we are
5572	 * currently on the 5G band
5573	 */
5574	if (wlc->band->bandtype == BRCM_BAND_5G)
5575		return;
5576
5577	if (wlc->pub->up && wlc->pub->associated) {
5578		/* let watchdog or beacon processing update shortslot */
5579	} else if (wlc->pub->up) {
5580		/* unassociated shortslot is off */
5581		brcms_c_switch_shortslot(wlc, false);
5582	} else {
5583		/* driver is down, so just update the brcms_c_info
5584		 * value */
5585		if (wlc->shortslot_override == BRCMS_SHORTSLOT_AUTO)
5586			wlc->shortslot = false;
5587		else
5588			wlc->shortslot =
5589			    (wlc->shortslot_override ==
5590			     BRCMS_SHORTSLOT_ON);
5591	}
5592}
5593
5594/*
5595 * register watchdog and down handlers.
5596 */
5597int brcms_c_module_register(struct brcms_pub *pub,
5598			    const char *name, struct brcms_info *hdl,
5599			    int (*d_fn)(void *handle))
5600{
5601	struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5602	int i;
5603
5604	/* find an empty entry and just add, no duplication check! */
5605	for (i = 0; i < BRCMS_MAXMODULES; i++) {
5606		if (wlc->modulecb[i].name[0] == '\0') {
5607			strncpy(wlc->modulecb[i].name, name,
5608				sizeof(wlc->modulecb[i].name) - 1);
5609			wlc->modulecb[i].hdl = hdl;
5610			wlc->modulecb[i].down_fn = d_fn;
5611			return 0;
5612		}
5613	}
5614
5615	return -ENOSR;
5616}
5617
5618/* unregister module callbacks */
5619int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
5620			      struct brcms_info *hdl)
5621{
5622	struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5623	int i;
5624
5625	if (wlc == NULL)
5626		return -ENODATA;
5627
5628	for (i = 0; i < BRCMS_MAXMODULES; i++) {
5629		if (!strcmp(wlc->modulecb[i].name, name) &&
5630		    (wlc->modulecb[i].hdl == hdl)) {
5631			memset(&wlc->modulecb[i], 0, sizeof(wlc->modulecb[i]));
5632			return 0;
5633		}
5634	}
5635
5636	/* table not found! */
5637	return -ENODATA;
5638}
5639
5640static bool brcms_c_chipmatch_pci(struct bcma_device *core)
5641{
5642	struct pci_dev *pcidev = core->bus->host_pci;
5643	u16 vendor = pcidev->vendor;
5644	u16 device = pcidev->device;
5645
5646	if (vendor != PCI_VENDOR_ID_BROADCOM) {
5647		pr_err("unknown vendor id %04x\n", vendor);
5648		return false;
5649	}
5650
5651	if (device == BCM43224_D11N_ID_VEN1 || device == BCM43224_CHIP_ID)
5652		return true;
5653	if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
5654		return true;
5655	if (device == BCM4313_D11N2G_ID || device == BCM4313_CHIP_ID)
5656		return true;
5657	if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
5658		return true;
5659
5660	pr_err("unknown device id %04x\n", device);
5661	return false;
5662}
5663
5664static bool brcms_c_chipmatch_soc(struct bcma_device *core)
5665{
5666	struct bcma_chipinfo *chipinfo = &core->bus->chipinfo;
5667
5668	if (chipinfo->id == BCMA_CHIP_ID_BCM4716)
5669		return true;
5670
5671	pr_err("unknown chip id %04x\n", chipinfo->id);
5672	return false;
5673}
5674
5675bool brcms_c_chipmatch(struct bcma_device *core)
5676{
5677	switch (core->bus->hosttype) {
5678	case BCMA_HOSTTYPE_PCI:
5679		return brcms_c_chipmatch_pci(core);
5680	case BCMA_HOSTTYPE_SOC:
5681		return brcms_c_chipmatch_soc(core);
5682	default:
5683		pr_err("unknown host type: %i\n", core->bus->hosttype);
5684		return false;
5685	}
5686}
5687
5688u16 brcms_b_rate_shm_offset(struct brcms_hardware *wlc_hw, u8 rate)
5689{
5690	u16 table_ptr;
5691	u8 phy_rate, index;
5692
5693	/* get the phy specific rate encoding for the PLCP SIGNAL field */
5694	if (is_ofdm_rate(rate))
5695		table_ptr = M_RT_DIRMAP_A;
5696	else
5697		table_ptr = M_RT_DIRMAP_B;
5698
5699	/* for a given rate, the LS-nibble of the PLCP SIGNAL field is
5700	 * the index into the rate table.
5701	 */
5702	phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
5703	index = phy_rate & 0xf;
5704
5705	/* Find the SHM pointer to the rate table entry by looking in the
5706	 * Direct-map Table
5707	 */
5708	return 2 * brcms_b_read_shm(wlc_hw, table_ptr + (index * 2));
5709}
5710
5711/*
5712 * bcmc_fid_generate:
5713 * Generate frame ID for a BCMC packet.  The frag field is not used
5714 * for MC frames so is used as part of the sequence number.
5715 */
5716static inline u16
5717bcmc_fid_generate(struct brcms_c_info *wlc, struct brcms_bss_cfg *bsscfg,
5718		  struct d11txh *txh)
5719{
5720	u16 frameid;
5721
5722	frameid = le16_to_cpu(txh->TxFrameID) & ~(TXFID_SEQ_MASK |
5723						  TXFID_QUEUE_MASK);
5724	frameid |=
5725	    (((wlc->
5726	       mc_fid_counter++) << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
5727	    TX_BCMC_FIFO;
5728
5729	return frameid;
5730}
5731
5732static uint
5733brcms_c_calc_ack_time(struct brcms_c_info *wlc, u32 rspec,
5734		      u8 preamble_type)
5735{
5736	uint dur = 0;
5737
5738	/*
5739	 * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5740	 * is less than or equal to the rate of the immediately previous
5741	 * frame in the FES
5742	 */
5743	rspec = brcms_basic_rate(wlc, rspec);
5744	/* ACK frame len == 14 == 2(fc) + 2(dur) + 6(ra) + 4(fcs) */
5745	dur =
5746	    brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5747				(DOT11_ACK_LEN + FCS_LEN));
5748	return dur;
5749}
5750
5751static uint
5752brcms_c_calc_cts_time(struct brcms_c_info *wlc, u32 rspec,
5753		      u8 preamble_type)
5754{
5755	return brcms_c_calc_ack_time(wlc, rspec, preamble_type);
5756}
5757
5758static uint
5759brcms_c_calc_ba_time(struct brcms_c_info *wlc, u32 rspec,
5760		     u8 preamble_type)
5761{
5762	/*
5763	 * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5764	 * is less than or equal to the rate of the immediately previous
5765	 * frame in the FES
5766	 */
5767	rspec = brcms_basic_rate(wlc, rspec);
5768	/* BA len == 32 == 16(ctl hdr) + 4(ba len) + 8(bitmap) + 4(fcs) */
5769	return brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5770				   (DOT11_BA_LEN + DOT11_BA_BITMAP_LEN +
5771				    FCS_LEN));
5772}
5773
5774/* brcms_c_compute_frame_dur()
5775 *
5776 * Calculate the 802.11 MAC header DUR field for MPDU
5777 * DUR for a single frame = 1 SIFS + 1 ACK
5778 * DUR for a frame with following frags = 3 SIFS + 2 ACK + next frag time
5779 *
5780 * rate			MPDU rate in unit of 500kbps
5781 * next_frag_len	next MPDU length in bytes
5782 * preamble_type	use short/GF or long/MM PLCP header
5783 */
5784static u16
5785brcms_c_compute_frame_dur(struct brcms_c_info *wlc, u32 rate,
5786		      u8 preamble_type, uint next_frag_len)
5787{
5788	u16 dur, sifs;
5789
5790	sifs = get_sifs(wlc->band);
5791
5792	dur = sifs;
5793	dur += (u16) brcms_c_calc_ack_time(wlc, rate, preamble_type);
5794
5795	if (next_frag_len) {
5796		/* Double the current DUR to get 2 SIFS + 2 ACKs */
5797		dur *= 2;
5798		/* add another SIFS and the frag time */
5799		dur += sifs;
5800		dur +=
5801		    (u16) brcms_c_calc_frame_time(wlc, rate, preamble_type,
5802						 next_frag_len);
5803	}
5804	return dur;
5805}
5806
5807/* The opposite of brcms_c_calc_frame_time */
5808static uint
5809brcms_c_calc_frame_len(struct brcms_c_info *wlc, u32 ratespec,
5810		   u8 preamble_type, uint dur)
5811{
5812	uint nsyms, mac_len, Ndps, kNdps;
5813	uint rate = rspec2rate(ratespec);
5814
5815	if (is_mcs_rate(ratespec)) {
5816		uint mcs = ratespec & RSPEC_RATE_MASK;
5817		int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
5818		dur -= PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
5819		/* payload calculation matches that of regular ofdm */
5820		if (wlc->band->bandtype == BRCM_BAND_2G)
5821			dur -= DOT11_OFDM_SIGNAL_EXTENSION;
5822		/* kNdbps = kbps * 4 */
5823		kNdps =	mcs_2_rate(mcs, rspec_is40mhz(ratespec),
5824				   rspec_issgi(ratespec)) * 4;
5825		nsyms = dur / APHY_SYMBOL_TIME;
5826		mac_len =
5827		    ((nsyms * kNdps) -
5828		     ((APHY_SERVICE_NBITS + APHY_TAIL_NBITS) * 1000)) / 8000;
5829	} else if (is_ofdm_rate(ratespec)) {
5830		dur -= APHY_PREAMBLE_TIME;
5831		dur -= APHY_SIGNAL_TIME;
5832		/* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
5833		Ndps = rate * 2;
5834		nsyms = dur / APHY_SYMBOL_TIME;
5835		mac_len =
5836		    ((nsyms * Ndps) -
5837		     (APHY_SERVICE_NBITS + APHY_TAIL_NBITS)) / 8;
5838	} else {
5839		if (preamble_type & BRCMS_SHORT_PREAMBLE)
5840			dur -= BPHY_PLCP_SHORT_TIME;
5841		else
5842			dur -= BPHY_PLCP_TIME;
5843		mac_len = dur * rate;
5844		/* divide out factor of 2 in rate (1/2 mbps) */
5845		mac_len = mac_len / 8 / 2;
5846	}
5847	return mac_len;
5848}
5849
5850/*
5851 * Return true if the specified rate is supported by the specified band.
5852 * BRCM_BAND_AUTO indicates the current band.
5853 */
5854static bool brcms_c_valid_rate(struct brcms_c_info *wlc, u32 rspec, int band,
5855		    bool verbose)
5856{
5857	struct brcms_c_rateset *hw_rateset;
5858	uint i;
5859
5860	if ((band == BRCM_BAND_AUTO) || (band == wlc->band->bandtype))
5861		hw_rateset = &wlc->band->hw_rateset;
5862	else if (wlc->pub->_nbands > 1)
5863		hw_rateset = &wlc->bandstate[OTHERBANDUNIT(wlc)]->hw_rateset;
5864	else
5865		/* other band specified and we are a single band device */
5866		return false;
5867
5868	/* check if this is a mimo rate */
5869	if (is_mcs_rate(rspec)) {
5870		if ((rspec & RSPEC_RATE_MASK) >= MCS_TABLE_SIZE)
5871			goto error;
5872
5873		return isset(hw_rateset->mcs, (rspec & RSPEC_RATE_MASK));
5874	}
5875
5876	for (i = 0; i < hw_rateset->count; i++)
5877		if (hw_rateset->rates[i] == rspec2rate(rspec))
5878			return true;
5879 error:
5880	if (verbose)
5881		brcms_err(wlc->hw->d11core, "wl%d: valid_rate: rate spec 0x%x "
5882			  "not in hw_rateset\n", wlc->pub->unit, rspec);
5883
5884	return false;
5885}
5886
5887static u32
5888mac80211_wlc_set_nrate(struct brcms_c_info *wlc, struct brcms_band *cur_band,
5889		       u32 int_val)
5890{
5891	struct bcma_device *core = wlc->hw->d11core;
5892	u8 stf = (int_val & NRATE_STF_MASK) >> NRATE_STF_SHIFT;
5893	u8 rate = int_val & NRATE_RATE_MASK;
5894	u32 rspec;
5895	bool ismcs = ((int_val & NRATE_MCS_INUSE) == NRATE_MCS_INUSE);
5896	bool issgi = ((int_val & NRATE_SGI_MASK) >> NRATE_SGI_SHIFT);
5897	bool override_mcs_only = ((int_val & NRATE_OVERRIDE_MCS_ONLY)
5898				  == NRATE_OVERRIDE_MCS_ONLY);
5899	int bcmerror = 0;
5900
5901	if (!ismcs)
5902		return (u32) rate;
5903
5904	/* validate the combination of rate/mcs/stf is allowed */
5905	if ((wlc->pub->_n_enab & SUPPORT_11N) && ismcs) {
5906		/* mcs only allowed when nmode */
5907		if (stf > PHY_TXC1_MODE_SDM) {
5908			brcms_err(core, "wl%d: %s: Invalid stf\n",
5909				  wlc->pub->unit, __func__);
5910			bcmerror = -EINVAL;
5911			goto done;
5912		}
5913
5914		/* mcs 32 is a special case, DUP mode 40 only */
5915		if (rate == 32) {
5916			if (!CHSPEC_IS40(wlc->home_chanspec) ||
5917			    ((stf != PHY_TXC1_MODE_SISO)
5918			     && (stf != PHY_TXC1_MODE_CDD))) {
5919				brcms_err(core, "wl%d: %s: Invalid mcs 32\n",
5920					  wlc->pub->unit, __func__);
5921				bcmerror = -EINVAL;
5922				goto done;
5923			}
5924			/* mcs > 7 must use stf SDM */
5925		} else if (rate > HIGHEST_SINGLE_STREAM_MCS) {
5926			/* mcs > 7 must use stf SDM */
5927			if (stf != PHY_TXC1_MODE_SDM) {
5928				brcms_dbg_mac80211(core, "wl%d: enabling "
5929						   "SDM mode for mcs %d\n",
5930						   wlc->pub->unit, rate);
5931				stf = PHY_TXC1_MODE_SDM;
5932			}
5933		} else {
5934			/*
5935			 * MCS 0-7 may use SISO, CDD, and for
5936			 * phy_rev >= 3 STBC
5937			 */
5938			if ((stf > PHY_TXC1_MODE_STBC) ||
5939			    (!BRCMS_STBC_CAP_PHY(wlc)
5940			     && (stf == PHY_TXC1_MODE_STBC))) {
5941				brcms_err(core, "wl%d: %s: Invalid STBC\n",
5942					  wlc->pub->unit, __func__);
5943				bcmerror = -EINVAL;
5944				goto done;
5945			}
5946		}
5947	} else if (is_ofdm_rate(rate)) {
5948		if ((stf != PHY_TXC1_MODE_CDD) && (stf != PHY_TXC1_MODE_SISO)) {
5949			brcms_err(core, "wl%d: %s: Invalid OFDM\n",
5950				  wlc->pub->unit, __func__);
5951			bcmerror = -EINVAL;
5952			goto done;
5953		}
5954	} else if (is_cck_rate(rate)) {
5955		if ((cur_band->bandtype != BRCM_BAND_2G)
5956		    || (stf != PHY_TXC1_MODE_SISO)) {
5957			brcms_err(core, "wl%d: %s: Invalid CCK\n",
5958				  wlc->pub->unit, __func__);
5959			bcmerror = -EINVAL;
5960			goto done;
5961		}
5962	} else {
5963		brcms_err(core, "wl%d: %s: Unknown rate type\n",
5964			  wlc->pub->unit, __func__);
5965		bcmerror = -EINVAL;
5966		goto done;
5967	}
5968	/* make sure multiple antennae are available for non-siso rates */
5969	if ((stf != PHY_TXC1_MODE_SISO) && (wlc->stf->txstreams == 1)) {
5970		brcms_err(core, "wl%d: %s: SISO antenna but !SISO "
5971			  "request\n", wlc->pub->unit, __func__);
5972		bcmerror = -EINVAL;
5973		goto done;
5974	}
5975
5976	rspec = rate;
5977	if (ismcs) {
5978		rspec |= RSPEC_MIMORATE;
5979		/* For STBC populate the STC field of the ratespec */
5980		if (stf == PHY_TXC1_MODE_STBC) {
5981			u8 stc;
5982			stc = 1;	/* Nss for single stream is always 1 */
5983			rspec |= (stc << RSPEC_STC_SHIFT);
5984		}
5985	}
5986
5987	rspec |= (stf << RSPEC_STF_SHIFT);
5988
5989	if (override_mcs_only)
5990		rspec |= RSPEC_OVERRIDE_MCS_ONLY;
5991
5992	if (issgi)
5993		rspec |= RSPEC_SHORT_GI;
5994
5995	if ((rate != 0)
5996	    && !brcms_c_valid_rate(wlc, rspec, cur_band->bandtype, true))
5997		return rate;
5998
5999	return rspec;
6000done:
6001	return rate;
6002}
6003
6004/*
6005 * Compute PLCP, but only requires actual rate and length of pkt.
6006 * Rate is given in the driver standard multiple of 500 kbps.
6007 * le is set for 11 Mbps rate if necessary.
6008 * Broken out for PRQ.
6009 */
6010
6011static void brcms_c_cck_plcp_set(struct brcms_c_info *wlc, int rate_500,
6012			     uint length, u8 *plcp)
6013{
6014	u16 usec = 0;
6015	u8 le = 0;
6016
6017	switch (rate_500) {
6018	case BRCM_RATE_1M:
6019		usec = length << 3;
6020		break;
6021	case BRCM_RATE_2M:
6022		usec = length << 2;
6023		break;
6024	case BRCM_RATE_5M5:
6025		usec = (length << 4) / 11;
6026		if ((length << 4) - (usec * 11) > 0)
6027			usec++;
6028		break;
6029	case BRCM_RATE_11M:
6030		usec = (length << 3) / 11;
6031		if ((length << 3) - (usec * 11) > 0) {
6032			usec++;
6033			if ((usec * 11) - (length << 3) >= 8)
6034				le = D11B_PLCP_SIGNAL_LE;
6035		}
6036		break;
6037
6038	default:
6039		brcms_err(wlc->hw->d11core,
6040			  "brcms_c_cck_plcp_set: unsupported rate %d\n",
6041			  rate_500);
6042		rate_500 = BRCM_RATE_1M;
6043		usec = length << 3;
6044		break;
6045	}
6046	/* PLCP signal byte */
6047	plcp[0] = rate_500 * 5;	/* r (500kbps) * 5 == r (100kbps) */
6048	/* PLCP service byte */
6049	plcp[1] = (u8) (le | D11B_PLCP_SIGNAL_LOCKED);
6050	/* PLCP length u16, little endian */
6051	plcp[2] = usec & 0xff;
6052	plcp[3] = (usec >> 8) & 0xff;
6053	/* PLCP CRC16 */
6054	plcp[4] = 0;
6055	plcp[5] = 0;
6056}
6057
6058/* Rate: 802.11 rate code, length: PSDU length in octets */
6059static void brcms_c_compute_mimo_plcp(u32 rspec, uint length, u8 *plcp)
6060{
6061	u8 mcs = (u8) (rspec & RSPEC_RATE_MASK);
6062	plcp[0] = mcs;
6063	if (rspec_is40mhz(rspec) || (mcs == 32))
6064		plcp[0] |= MIMO_PLCP_40MHZ;
6065	BRCMS_SET_MIMO_PLCP_LEN(plcp, length);
6066	plcp[3] = rspec_mimoplcp3(rspec); /* rspec already holds this byte */
6067	plcp[3] |= 0x7; /* set smoothing, not sounding ppdu & reserved */
6068	plcp[4] = 0; /* number of extension spatial streams bit 0 & 1 */
6069	plcp[5] = 0;
6070}
6071
6072/* Rate: 802.11 rate code, length: PSDU length in octets */
6073static void
6074brcms_c_compute_ofdm_plcp(u32 rspec, u32 length, u8 *plcp)
6075{
6076	u8 rate_signal;
6077	u32 tmp = 0;
6078	int rate = rspec2rate(rspec);
6079
6080	/*
6081	 * encode rate per 802.11a-1999 sec 17.3.4.1, with lsb
6082	 * transmitted first
6083	 */
6084	rate_signal = rate_info[rate] & BRCMS_RATE_MASK;
6085	memset(plcp, 0, D11_PHY_HDR_LEN);
6086	D11A_PHY_HDR_SRATE((struct ofdm_phy_hdr *) plcp, rate_signal);
6087
6088	tmp = (length & 0xfff) << 5;
6089	plcp[2] |= (tmp >> 16) & 0xff;
6090	plcp[1] |= (tmp >> 8) & 0xff;
6091	plcp[0] |= tmp & 0xff;
6092}
6093
6094/* Rate: 802.11 rate code, length: PSDU length in octets */
6095static void brcms_c_compute_cck_plcp(struct brcms_c_info *wlc, u32 rspec,
6096				 uint length, u8 *plcp)
6097{
6098	int rate = rspec2rate(rspec);
6099
6100	brcms_c_cck_plcp_set(wlc, rate, length, plcp);
6101}
6102
6103static void
6104brcms_c_compute_plcp(struct brcms_c_info *wlc, u32 rspec,
6105		     uint length, u8 *plcp)
6106{
6107	if (is_mcs_rate(rspec))
6108		brcms_c_compute_mimo_plcp(rspec, length, plcp);
6109	else if (is_ofdm_rate(rspec))
6110		brcms_c_compute_ofdm_plcp(rspec, length, plcp);
6111	else
6112		brcms_c_compute_cck_plcp(wlc, rspec, length, plcp);
6113}
6114
6115/* brcms_c_compute_rtscts_dur()
6116 *
6117 * Calculate the 802.11 MAC header DUR field for an RTS or CTS frame
6118 * DUR for normal RTS/CTS w/ frame = 3 SIFS + 1 CTS + next frame time + 1 ACK
6119 * DUR for CTS-TO-SELF w/ frame    = 2 SIFS         + next frame time + 1 ACK
6120 *
6121 * cts			cts-to-self or rts/cts
6122 * rts_rate		rts or cts rate in unit of 500kbps
6123 * rate			next MPDU rate in unit of 500kbps
6124 * frame_len		next MPDU frame length in bytes
6125 */
6126u16
6127brcms_c_compute_rtscts_dur(struct brcms_c_info *wlc, bool cts_only,
6128			   u32 rts_rate,
6129			   u32 frame_rate, u8 rts_preamble_type,
6130			   u8 frame_preamble_type, uint frame_len, bool ba)
6131{
6132	u16 dur, sifs;
6133
6134	sifs = get_sifs(wlc->band);
6135
6136	if (!cts_only) {
6137		/* RTS/CTS */
6138		dur = 3 * sifs;
6139		dur +=
6140		    (u16) brcms_c_calc_cts_time(wlc, rts_rate,
6141					       rts_preamble_type);
6142	} else {
6143		/* CTS-TO-SELF */
6144		dur = 2 * sifs;
6145	}
6146
6147	dur +=
6148	    (u16) brcms_c_calc_frame_time(wlc, frame_rate, frame_preamble_type,
6149					 frame_len);
6150	if (ba)
6151		dur +=
6152		    (u16) brcms_c_calc_ba_time(wlc, frame_rate,
6153					      BRCMS_SHORT_PREAMBLE);
6154	else
6155		dur +=
6156		    (u16) brcms_c_calc_ack_time(wlc, frame_rate,
6157					       frame_preamble_type);
6158	return dur;
6159}
6160
6161static u16 brcms_c_phytxctl1_calc(struct brcms_c_info *wlc, u32 rspec)
6162{
6163	u16 phyctl1 = 0;
6164	u16 bw;
6165
6166	if (BRCMS_ISLCNPHY(wlc->band)) {
6167		bw = PHY_TXC1_BW_20MHZ;
6168	} else {
6169		bw = rspec_get_bw(rspec);
6170		/* 10Mhz is not supported yet */
6171		if (bw < PHY_TXC1_BW_20MHZ) {
6172			brcms_err(wlc->hw->d11core, "phytxctl1_calc: bw %d is "
6173				  "not supported yet, set to 20L\n", bw);
6174			bw = PHY_TXC1_BW_20MHZ;
6175		}
6176	}
6177
6178	if (is_mcs_rate(rspec)) {
6179		uint mcs = rspec & RSPEC_RATE_MASK;
6180
6181		/* bw, stf, coding-type is part of rspec_phytxbyte2 returns */
6182		phyctl1 = rspec_phytxbyte2(rspec);
6183		/* set the upper byte of phyctl1 */
6184		phyctl1 |= (mcs_table[mcs].tx_phy_ctl3 << 8);
6185	} else if (is_cck_rate(rspec) && !BRCMS_ISLCNPHY(wlc->band)
6186		   && !BRCMS_ISSSLPNPHY(wlc->band)) {
6187		/*
6188		 * In CCK mode LPPHY overloads OFDM Modulation bits with CCK
6189		 * Data Rate. Eventually MIMOPHY would also be converted to
6190		 * this format
6191		 */
6192		/* 0 = 1Mbps; 1 = 2Mbps; 2 = 5.5Mbps; 3 = 11Mbps */
6193		phyctl1 = (bw | (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6194	} else {		/* legacy OFDM/CCK */
6195		s16 phycfg;
6196		/* get the phyctl byte from rate phycfg table */
6197		phycfg = brcms_c_rate_legacy_phyctl(rspec2rate(rspec));
6198		if (phycfg == -1) {
6199			brcms_err(wlc->hw->d11core, "phytxctl1_calc: wrong "
6200				  "legacy OFDM/CCK rate\n");
6201			phycfg = 0;
6202		}
6203		/* set the upper byte of phyctl1 */
6204		phyctl1 =
6205		    (bw | (phycfg << 8) |
6206		     (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6207	}
6208	return phyctl1;
6209}
6210
6211/*
6212 * Add struct d11txh, struct cck_phy_hdr.
6213 *
6214 * 'p' data must start with 802.11 MAC header
6215 * 'p' must allow enough bytes of local headers to be "pushed" onto the packet
6216 *
6217 * headroom == D11_PHY_HDR_LEN + D11_TXH_LEN (D11_TXH_LEN is now 104 bytes)
6218 *
6219 */
6220static u16
6221brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
6222		     struct sk_buff *p, struct scb *scb, uint frag,
6223		     uint nfrags, uint queue, uint next_frag_len)
6224{
6225	struct ieee80211_hdr *h;
6226	struct d11txh *txh;
6227	u8 *plcp, plcp_fallback[D11_PHY_HDR_LEN];
6228	int len, phylen, rts_phylen;
6229	u16 mch, phyctl, xfts, mainrates;
6230	u16 seq = 0, mcl = 0, status = 0, frameid = 0;
6231	u32 rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6232	u32 rts_rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6233	bool use_rts = false;
6234	bool use_cts = false;
6235	bool use_rifs = false;
6236	bool short_preamble[2] = { false, false };
6237	u8 preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6238	u8 rts_preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6239	u8 *rts_plcp, rts_plcp_fallback[D11_PHY_HDR_LEN];
6240	struct ieee80211_rts *rts = NULL;
6241	bool qos;
6242	uint ac;
6243	bool hwtkmic = false;
6244	u16 mimo_ctlchbw = PHY_TXC1_BW_20MHZ;
6245#define ANTCFG_NONE 0xFF
6246	u8 antcfg = ANTCFG_NONE;
6247	u8 fbantcfg = ANTCFG_NONE;
6248	uint phyctl1_stf = 0;
6249	u16 durid = 0;
6250	struct ieee80211_tx_rate *txrate[2];
6251	int k;
6252	struct ieee80211_tx_info *tx_info;
6253	bool is_mcs;
6254	u16 mimo_txbw;
6255	u8 mimo_preamble_type;
6256
6257	/* locate 802.11 MAC header */
6258	h = (struct ieee80211_hdr *)(p->data);
6259	qos = ieee80211_is_data_qos(h->frame_control);
6260
6261	/* compute length of frame in bytes for use in PLCP computations */
6262	len = p->len;
6263	phylen = len + FCS_LEN;
6264
6265	/* Get tx_info */
6266	tx_info = IEEE80211_SKB_CB(p);
6267
6268	/* add PLCP */
6269	plcp = skb_push(p, D11_PHY_HDR_LEN);
6270
6271	/* add Broadcom tx descriptor header */
6272	txh = (struct d11txh *) skb_push(p, D11_TXH_LEN);
6273	memset(txh, 0, D11_TXH_LEN);
6274
6275	/* setup frameid */
6276	if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
6277		/* non-AP STA should never use BCMC queue */
6278		if (queue == TX_BCMC_FIFO) {
6279			brcms_err(wlc->hw->d11core,
6280				  "wl%d: %s: ASSERT queue == TX_BCMC!\n",
6281				  wlc->pub->unit, __func__);
6282			frameid = bcmc_fid_generate(wlc, NULL, txh);
6283		} else {
6284			/* Increment the counter for first fragment */
6285			if (tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
6286				scb->seqnum[p->priority]++;
6287
6288			/* extract fragment number from frame first */
6289			seq = le16_to_cpu(h->seq_ctrl) & FRAGNUM_MASK;
6290			seq |= (scb->seqnum[p->priority] << SEQNUM_SHIFT);
6291			h->seq_ctrl = cpu_to_le16(seq);
6292
6293			frameid = ((seq << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
6294			    (queue & TXFID_QUEUE_MASK);
6295		}
6296	}
6297	frameid |= queue & TXFID_QUEUE_MASK;
6298
6299	/* set the ignpmq bit for all pkts tx'd in PS mode and for beacons */
6300	if (ieee80211_is_beacon(h->frame_control))
6301		mcl |= TXC_IGNOREPMQ;
6302
6303	txrate[0] = tx_info->control.rates;
6304	txrate[1] = txrate[0] + 1;
6305
6306	/*
6307	 * if rate control algorithm didn't give us a fallback
6308	 * rate, use the primary rate
6309	 */
6310	if (txrate[1]->idx < 0)
6311		txrate[1] = txrate[0];
6312
6313	for (k = 0; k < hw->max_rates; k++) {
6314		is_mcs = txrate[k]->flags & IEEE80211_TX_RC_MCS ? true : false;
6315		if (!is_mcs) {
6316			if ((txrate[k]->idx >= 0)
6317			    && (txrate[k]->idx <
6318				hw->wiphy->bands[tx_info->band]->n_bitrates)) {
6319				rspec[k] =
6320				    hw->wiphy->bands[tx_info->band]->
6321				    bitrates[txrate[k]->idx].hw_value;
6322				short_preamble[k] =
6323				    txrate[k]->
6324				    flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ?
6325				    true : false;
6326			} else {
6327				rspec[k] = BRCM_RATE_1M;
6328			}
6329		} else {
6330			rspec[k] = mac80211_wlc_set_nrate(wlc, wlc->band,
6331					NRATE_MCS_INUSE | txrate[k]->idx);
6332		}
6333
6334		/*
6335		 * Currently only support same setting for primay and
6336		 * fallback rates. Unify flags for each rate into a
6337		 * single value for the frame
6338		 */
6339		use_rts |=
6340		    txrate[k]->
6341		    flags & IEEE80211_TX_RC_USE_RTS_CTS ? true : false;
6342		use_cts |=
6343		    txrate[k]->
6344		    flags & IEEE80211_TX_RC_USE_CTS_PROTECT ? true : false;
6345
6346
6347		/*
6348		 * (1) RATE:
6349		 *   determine and validate primary rate
6350		 *   and fallback rates
6351		 */
6352		if (!rspec_active(rspec[k])) {
6353			rspec[k] = BRCM_RATE_1M;
6354		} else {
6355			if (!is_multicast_ether_addr(h->addr1)) {
6356				/* set tx antenna config */
6357				brcms_c_antsel_antcfg_get(wlc->asi, false,
6358					false, 0, 0, &antcfg, &fbantcfg);
6359			}
6360		}
6361	}
6362
6363	phyctl1_stf = wlc->stf->ss_opmode;
6364
6365	if (wlc->pub->_n_enab & SUPPORT_11N) {
6366		for (k = 0; k < hw->max_rates; k++) {
6367			/*
6368			 * apply siso/cdd to single stream mcs's or ofdm
6369			 * if rspec is auto selected
6370			 */
6371			if (((is_mcs_rate(rspec[k]) &&
6372			      is_single_stream(rspec[k] & RSPEC_RATE_MASK)) ||
6373			     is_ofdm_rate(rspec[k]))
6374			    && ((rspec[k] & RSPEC_OVERRIDE_MCS_ONLY)
6375				|| !(rspec[k] & RSPEC_OVERRIDE))) {
6376				rspec[k] &= ~(RSPEC_STF_MASK | RSPEC_STC_MASK);
6377
6378				/* For SISO MCS use STBC if possible */
6379				if (is_mcs_rate(rspec[k])
6380				    && BRCMS_STF_SS_STBC_TX(wlc, scb)) {
6381					u8 stc;
6382
6383					/* Nss for single stream is always 1 */
6384					stc = 1;
6385					rspec[k] |= (PHY_TXC1_MODE_STBC <<
6386							RSPEC_STF_SHIFT) |
6387						    (stc << RSPEC_STC_SHIFT);
6388				} else
6389					rspec[k] |=
6390					    (phyctl1_stf << RSPEC_STF_SHIFT);
6391			}
6392
6393			/*
6394			 * Is the phy configured to use 40MHZ frames? If
6395			 * so then pick the desired txbw
6396			 */
6397			if (brcms_chspec_bw(wlc->chanspec) == BRCMS_40_MHZ) {
6398				/* default txbw is 20in40 SB */
6399				mimo_ctlchbw = mimo_txbw =
6400				   CHSPEC_SB_UPPER(wlc_phy_chanspec_get(
6401								 wlc->band->pi))
6402				   ? PHY_TXC1_BW_20MHZ_UP : PHY_TXC1_BW_20MHZ;
6403
6404				if (is_mcs_rate(rspec[k])) {
6405					/* mcs 32 must be 40b/w DUP */
6406					if ((rspec[k] & RSPEC_RATE_MASK)
6407					    == 32) {
6408						mimo_txbw =
6409						    PHY_TXC1_BW_40MHZ_DUP;
6410						/* use override */
6411					} else if (wlc->mimo_40txbw != AUTO)
6412						mimo_txbw = wlc->mimo_40txbw;
6413					/* else check if dst is using 40 Mhz */
6414					else if (scb->flags & SCB_IS40)
6415						mimo_txbw = PHY_TXC1_BW_40MHZ;
6416				} else if (is_ofdm_rate(rspec[k])) {
6417					if (wlc->ofdm_40txbw != AUTO)
6418						mimo_txbw = wlc->ofdm_40txbw;
6419				} else if (wlc->cck_40txbw != AUTO) {
6420					mimo_txbw = wlc->cck_40txbw;
6421				}
6422			} else {
6423				/*
6424				 * mcs32 is 40 b/w only.
6425				 * This is possible for probe packets on
6426				 * a STA during SCAN
6427				 */
6428				if ((rspec[k] & RSPEC_RATE_MASK) == 32)
6429					/* mcs 0 */
6430					rspec[k] = RSPEC_MIMORATE;
6431
6432				mimo_txbw = PHY_TXC1_BW_20MHZ;
6433			}
6434
6435			/* Set channel width */
6436			rspec[k] &= ~RSPEC_BW_MASK;
6437			if ((k == 0) || ((k > 0) && is_mcs_rate(rspec[k])))
6438				rspec[k] |= (mimo_txbw << RSPEC_BW_SHIFT);
6439			else
6440				rspec[k] |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
6441
6442			/* Disable short GI, not supported yet */
6443			rspec[k] &= ~RSPEC_SHORT_GI;
6444
6445			mimo_preamble_type = BRCMS_MM_PREAMBLE;
6446			if (txrate[k]->flags & IEEE80211_TX_RC_GREEN_FIELD)
6447				mimo_preamble_type = BRCMS_GF_PREAMBLE;
6448
6449			if ((txrate[k]->flags & IEEE80211_TX_RC_MCS)
6450			    && (!is_mcs_rate(rspec[k]))) {
6451				brcms_warn(wlc->hw->d11core,
6452					   "wl%d: %s: IEEE80211_TX_RC_MCS != is_mcs_rate(rspec)\n",
6453					   wlc->pub->unit, __func__);
6454			}
6455
6456			if (is_mcs_rate(rspec[k])) {
6457				preamble_type[k] = mimo_preamble_type;
6458
6459				/*
6460				 * if SGI is selected, then forced mm
6461				 * for single stream
6462				 */
6463				if ((rspec[k] & RSPEC_SHORT_GI)
6464				    && is_single_stream(rspec[k] &
6465							RSPEC_RATE_MASK))
6466					preamble_type[k] = BRCMS_MM_PREAMBLE;
6467			}
6468
6469			/* should be better conditionalized */
6470			if (!is_mcs_rate(rspec[0])
6471			    && (tx_info->control.rates[0].
6472				flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
6473				preamble_type[k] = BRCMS_SHORT_PREAMBLE;
6474		}
6475	} else {
6476		for (k = 0; k < hw->max_rates; k++) {
6477			/* Set ctrlchbw as 20Mhz */
6478			rspec[k] &= ~RSPEC_BW_MASK;
6479			rspec[k] |= (PHY_TXC1_BW_20MHZ << RSPEC_BW_SHIFT);
6480
6481			/* for nphy, stf of ofdm frames must follow policies */
6482			if (BRCMS_ISNPHY(wlc->band) && is_ofdm_rate(rspec[k])) {
6483				rspec[k] &= ~RSPEC_STF_MASK;
6484				rspec[k] |= phyctl1_stf << RSPEC_STF_SHIFT;
6485			}
6486		}
6487	}
6488
6489	/* Reset these for use with AMPDU's */
6490	txrate[0]->count = 0;
6491	txrate[1]->count = 0;
6492
6493	/* (2) PROTECTION, may change rspec */
6494	if ((ieee80211_is_data(h->frame_control) ||
6495	    ieee80211_is_mgmt(h->frame_control)) &&
6496	    (phylen > wlc->RTSThresh) && !is_multicast_ether_addr(h->addr1))
6497		use_rts = true;
6498
6499	/* (3) PLCP: determine PLCP header and MAC duration,
6500	 * fill struct d11txh */
6501	brcms_c_compute_plcp(wlc, rspec[0], phylen, plcp);
6502	brcms_c_compute_plcp(wlc, rspec[1], phylen, plcp_fallback);
6503	memcpy(&txh->FragPLCPFallback,
6504	       plcp_fallback, sizeof(txh->FragPLCPFallback));
6505
6506	/* Length field now put in CCK FBR CRC field */
6507	if (is_cck_rate(rspec[1])) {
6508		txh->FragPLCPFallback[4] = phylen & 0xff;
6509		txh->FragPLCPFallback[5] = (phylen & 0xff00) >> 8;
6510	}
6511
6512	/* MIMO-RATE: need validation ?? */
6513	mainrates = is_ofdm_rate(rspec[0]) ?
6514			D11A_PHY_HDR_GRATE((struct ofdm_phy_hdr *) plcp) :
6515			plcp[0];
6516
6517	/* DUR field for main rate */
6518	if (!ieee80211_is_pspoll(h->frame_control) &&
6519	    !is_multicast_ether_addr(h->addr1) && !use_rifs) {
6520		durid =
6521		    brcms_c_compute_frame_dur(wlc, rspec[0], preamble_type[0],
6522					  next_frag_len);
6523		h->duration_id = cpu_to_le16(durid);
6524	} else if (use_rifs) {
6525		/* NAV protect to end of next max packet size */
6526		durid =
6527		    (u16) brcms_c_calc_frame_time(wlc, rspec[0],
6528						 preamble_type[0],
6529						 DOT11_MAX_FRAG_LEN);
6530		durid += RIFS_11N_TIME;
6531		h->duration_id = cpu_to_le16(durid);
6532	}
6533
6534	/* DUR field for fallback rate */
6535	if (ieee80211_is_pspoll(h->frame_control))
6536		txh->FragDurFallback = h->duration_id;
6537	else if (is_multicast_ether_addr(h->addr1) || use_rifs)
6538		txh->FragDurFallback = 0;
6539	else {
6540		durid = brcms_c_compute_frame_dur(wlc, rspec[1],
6541					      preamble_type[1], next_frag_len);
6542		txh->FragDurFallback = cpu_to_le16(durid);
6543	}
6544
6545	/* (4) MAC-HDR: MacTxControlLow */
6546	if (frag == 0)
6547		mcl |= TXC_STARTMSDU;
6548
6549	if (!is_multicast_ether_addr(h->addr1))
6550		mcl |= TXC_IMMEDACK;
6551
6552	if (wlc->band->bandtype == BRCM_BAND_5G)
6553		mcl |= TXC_FREQBAND_5G;
6554
6555	if (CHSPEC_IS40(wlc_phy_chanspec_get(wlc->band->pi)))
6556		mcl |= TXC_BW_40;
6557
6558	/* set AMIC bit if using hardware TKIP MIC */
6559	if (hwtkmic)
6560		mcl |= TXC_AMIC;
6561
6562	txh->MacTxControlLow = cpu_to_le16(mcl);
6563
6564	/* MacTxControlHigh */
6565	mch = 0;
6566
6567	/* Set fallback rate preamble type */
6568	if ((preamble_type[1] == BRCMS_SHORT_PREAMBLE) ||
6569	    (preamble_type[1] == BRCMS_GF_PREAMBLE)) {
6570		if (rspec2rate(rspec[1]) != BRCM_RATE_1M)
6571			mch |= TXC_PREAMBLE_DATA_FB_SHORT;
6572	}
6573
6574	/* MacFrameControl */
6575	memcpy(&txh->MacFrameControl, &h->frame_control, sizeof(u16));
6576	txh->TxFesTimeNormal = cpu_to_le16(0);
6577
6578	txh->TxFesTimeFallback = cpu_to_le16(0);
6579
6580	/* TxFrameRA */
6581	memcpy(&txh->TxFrameRA, &h->addr1, ETH_ALEN);
6582
6583	/* TxFrameID */
6584	txh->TxFrameID = cpu_to_le16(frameid);
6585
6586	/*
6587	 * TxStatus, Note the case of recreating the first frag of a suppressed
6588	 * frame then we may need to reset the retry cnt's via the status reg
6589	 */
6590	txh->TxStatus = cpu_to_le16(status);
6591
6592	/*
6593	 * extra fields for ucode AMPDU aggregation, the new fields are added to
6594	 * the END of previous structure so that it's compatible in driver.
6595	 */
6596	txh->MaxNMpdus = cpu_to_le16(0);
6597	txh->MaxABytes_MRT = cpu_to_le16(0);
6598	txh->MaxABytes_FBR = cpu_to_le16(0);
6599	txh->MinMBytes = cpu_to_le16(0);
6600
6601	/* (5) RTS/CTS: determine RTS/CTS PLCP header and MAC duration,
6602	 * furnish struct d11txh */
6603	/* RTS PLCP header and RTS frame */
6604	if (use_rts || use_cts) {
6605		if (use_rts && use_cts)
6606			use_cts = false;
6607
6608		for (k = 0; k < 2; k++) {
6609			rts_rspec[k] = brcms_c_rspec_to_rts_rspec(wlc, rspec[k],
6610							      false,
6611							      mimo_ctlchbw);
6612		}
6613
6614		if (!is_ofdm_rate(rts_rspec[0]) &&
6615		    !((rspec2rate(rts_rspec[0]) == BRCM_RATE_1M) ||
6616		      (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6617			rts_preamble_type[0] = BRCMS_SHORT_PREAMBLE;
6618			mch |= TXC_PREAMBLE_RTS_MAIN_SHORT;
6619		}
6620
6621		if (!is_ofdm_rate(rts_rspec[1]) &&
6622		    !((rspec2rate(rts_rspec[1]) == BRCM_RATE_1M) ||
6623		      (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6624			rts_preamble_type[1] = BRCMS_SHORT_PREAMBLE;
6625			mch |= TXC_PREAMBLE_RTS_FB_SHORT;
6626		}
6627
6628		/* RTS/CTS additions to MacTxControlLow */
6629		if (use_cts) {
6630			txh->MacTxControlLow |= cpu_to_le16(TXC_SENDCTS);
6631		} else {
6632			txh->MacTxControlLow |= cpu_to_le16(TXC_SENDRTS);
6633			txh->MacTxControlLow |= cpu_to_le16(TXC_LONGFRAME);
6634		}
6635
6636		/* RTS PLCP header */
6637		rts_plcp = txh->RTSPhyHeader;
6638		if (use_cts)
6639			rts_phylen = DOT11_CTS_LEN + FCS_LEN;
6640		else
6641			rts_phylen = DOT11_RTS_LEN + FCS_LEN;
6642
6643		brcms_c_compute_plcp(wlc, rts_rspec[0], rts_phylen, rts_plcp);
6644
6645		/* fallback rate version of RTS PLCP header */
6646		brcms_c_compute_plcp(wlc, rts_rspec[1], rts_phylen,
6647				 rts_plcp_fallback);
6648		memcpy(&txh->RTSPLCPFallback, rts_plcp_fallback,
6649		       sizeof(txh->RTSPLCPFallback));
6650
6651		/* RTS frame fields... */
6652		rts = (struct ieee80211_rts *)&txh->rts_frame;
6653
6654		durid = brcms_c_compute_rtscts_dur(wlc, use_cts, rts_rspec[0],
6655					       rspec[0], rts_preamble_type[0],
6656					       preamble_type[0], phylen, false);
6657		rts->duration = cpu_to_le16(durid);
6658		/* fallback rate version of RTS DUR field */
6659		durid = brcms_c_compute_rtscts_dur(wlc, use_cts,
6660					       rts_rspec[1], rspec[1],
6661					       rts_preamble_type[1],
6662					       preamble_type[1], phylen, false);
6663		txh->RTSDurFallback = cpu_to_le16(durid);
6664
6665		if (use_cts) {
6666			rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6667							 IEEE80211_STYPE_CTS);
6668
6669			memcpy(&rts->ra, &h->addr2, ETH_ALEN);
6670		} else {
6671			rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6672							 IEEE80211_STYPE_RTS);
6673
6674			memcpy(&rts->ra, &h->addr1, 2 * ETH_ALEN);
6675		}
6676
6677		/* mainrate
6678		 *    low 8 bits: main frag rate/mcs,
6679		 *    high 8 bits: rts/cts rate/mcs
6680		 */
6681		mainrates |= (is_ofdm_rate(rts_rspec[0]) ?
6682				D11A_PHY_HDR_GRATE(
6683					(struct ofdm_phy_hdr *) rts_plcp) :
6684				rts_plcp[0]) << 8;
6685	} else {
6686		memset(txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
6687		memset(&txh->rts_frame, 0, sizeof(struct ieee80211_rts));
6688		memset(txh->RTSPLCPFallback, 0, sizeof(txh->RTSPLCPFallback));
6689		txh->RTSDurFallback = 0;
6690	}
6691
6692#ifdef SUPPORT_40MHZ
6693	/* add null delimiter count */
6694	if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && is_mcs_rate(rspec))
6695		txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM] =
6696		   brcm_c_ampdu_null_delim_cnt(wlc->ampdu, scb, rspec, phylen);
6697
6698#endif
6699
6700	/*
6701	 * Now that RTS/RTS FB preamble types are updated, write
6702	 * the final value
6703	 */
6704	txh->MacTxControlHigh = cpu_to_le16(mch);
6705
6706	/*
6707	 * MainRates (both the rts and frag plcp rates have
6708	 * been calculated now)
6709	 */
6710	txh->MainRates = cpu_to_le16(mainrates);
6711
6712	/* XtraFrameTypes */
6713	xfts = frametype(rspec[1], wlc->mimoft);
6714	xfts |= (frametype(rts_rspec[0], wlc->mimoft) << XFTS_RTS_FT_SHIFT);
6715	xfts |= (frametype(rts_rspec[1], wlc->mimoft) << XFTS_FBRRTS_FT_SHIFT);
6716	xfts |= CHSPEC_CHANNEL(wlc_phy_chanspec_get(wlc->band->pi)) <<
6717							     XFTS_CHANNEL_SHIFT;
6718	txh->XtraFrameTypes = cpu_to_le16(xfts);
6719
6720	/* PhyTxControlWord */
6721	phyctl = frametype(rspec[0], wlc->mimoft);
6722	if ((preamble_type[0] == BRCMS_SHORT_PREAMBLE) ||
6723	    (preamble_type[0] == BRCMS_GF_PREAMBLE)) {
6724		if (rspec2rate(rspec[0]) != BRCM_RATE_1M)
6725			phyctl |= PHY_TXC_SHORT_HDR;
6726	}
6727
6728	/* phytxant is properly bit shifted */
6729	phyctl |= brcms_c_stf_d11hdrs_phyctl_txant(wlc, rspec[0]);
6730	txh->PhyTxControlWord = cpu_to_le16(phyctl);
6731
6732	/* PhyTxControlWord_1 */
6733	if (BRCMS_PHY_11N_CAP(wlc->band)) {
6734		u16 phyctl1 = 0;
6735
6736		phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[0]);
6737		txh->PhyTxControlWord_1 = cpu_to_le16(phyctl1);
6738		phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[1]);
6739		txh->PhyTxControlWord_1_Fbr = cpu_to_le16(phyctl1);
6740
6741		if (use_rts || use_cts) {
6742			phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[0]);
6743			txh->PhyTxControlWord_1_Rts = cpu_to_le16(phyctl1);
6744			phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[1]);
6745			txh->PhyTxControlWord_1_FbrRts = cpu_to_le16(phyctl1);
6746		}
6747
6748		/*
6749		 * For mcs frames, if mixedmode(overloaded with long preamble)
6750		 * is going to be set, fill in non-zero MModeLen and/or
6751		 * MModeFbrLen it will be unnecessary if they are separated
6752		 */
6753		if (is_mcs_rate(rspec[0]) &&
6754		    (preamble_type[0] == BRCMS_MM_PREAMBLE)) {
6755			u16 mmodelen =
6756			    brcms_c_calc_lsig_len(wlc, rspec[0], phylen);
6757			txh->MModeLen = cpu_to_le16(mmodelen);
6758		}
6759
6760		if (is_mcs_rate(rspec[1]) &&
6761		    (preamble_type[1] == BRCMS_MM_PREAMBLE)) {
6762			u16 mmodefbrlen =
6763			    brcms_c_calc_lsig_len(wlc, rspec[1], phylen);
6764			txh->MModeFbrLen = cpu_to_le16(mmodefbrlen);
6765		}
6766	}
6767
6768	ac = skb_get_queue_mapping(p);
6769	if ((scb->flags & SCB_WMECAP) && qos && wlc->edcf_txop[ac]) {
6770		uint frag_dur, dur, dur_fallback;
6771
6772		/* WME: Update TXOP threshold */
6773		if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU) && frag == 0) {
6774			frag_dur =
6775			    brcms_c_calc_frame_time(wlc, rspec[0],
6776					preamble_type[0], phylen);
6777
6778			if (rts) {
6779				/* 1 RTS or CTS-to-self frame */
6780				dur =
6781				    brcms_c_calc_cts_time(wlc, rts_rspec[0],
6782						      rts_preamble_type[0]);
6783				dur_fallback =
6784				    brcms_c_calc_cts_time(wlc, rts_rspec[1],
6785						      rts_preamble_type[1]);
6786				/* (SIFS + CTS) + SIFS + frame + SIFS + ACK */
6787				dur += le16_to_cpu(rts->duration);
6788				dur_fallback +=
6789					le16_to_cpu(txh->RTSDurFallback);
6790			} else if (use_rifs) {
6791				dur = frag_dur;
6792				dur_fallback = 0;
6793			} else {
6794				/* frame + SIFS + ACK */
6795				dur = frag_dur;
6796				dur +=
6797				    brcms_c_compute_frame_dur(wlc, rspec[0],
6798							  preamble_type[0], 0);
6799
6800				dur_fallback =
6801				    brcms_c_calc_frame_time(wlc, rspec[1],
6802							preamble_type[1],
6803							phylen);
6804				dur_fallback +=
6805				    brcms_c_compute_frame_dur(wlc, rspec[1],
6806							  preamble_type[1], 0);
6807			}
6808			/* NEED to set TxFesTimeNormal (hard) */
6809			txh->TxFesTimeNormal = cpu_to_le16((u16) dur);
6810			/*
6811			 * NEED to set fallback rate version of
6812			 * TxFesTimeNormal (hard)
6813			 */
6814			txh->TxFesTimeFallback =
6815				cpu_to_le16((u16) dur_fallback);
6816
6817			/*
6818			 * update txop byte threshold (txop minus intraframe
6819			 * overhead)
6820			 */
6821			if (wlc->edcf_txop[ac] >= (dur - frag_dur)) {
6822				uint newfragthresh;
6823
6824				newfragthresh =
6825				    brcms_c_calc_frame_len(wlc,
6826					rspec[0], preamble_type[0],
6827					(wlc->edcf_txop[ac] -
6828						(dur - frag_dur)));
6829				/* range bound the fragthreshold */
6830				if (newfragthresh < DOT11_MIN_FRAG_LEN)
6831					newfragthresh =
6832					    DOT11_MIN_FRAG_LEN;
6833				else if (newfragthresh >
6834					 wlc->usr_fragthresh)
6835					newfragthresh =
6836					    wlc->usr_fragthresh;
6837				/* update the fragthresh and do txc update */
6838				if (wlc->fragthresh[queue] !=
6839				    (u16) newfragthresh)
6840					wlc->fragthresh[queue] =
6841					    (u16) newfragthresh;
6842			} else {
6843				brcms_warn(wlc->hw->d11core,
6844					   "wl%d: %s txop invalid for rate %d\n",
6845					   wlc->pub->unit, fifo_names[queue],
6846					   rspec2rate(rspec[0]));
6847			}
6848
6849			if (dur > wlc->edcf_txop[ac])
6850				brcms_warn(wlc->hw->d11core,
6851					   "wl%d: %s: %s txop exceeded phylen %d/%d dur %d/%d\n",
6852					   wlc->pub->unit, __func__,
6853					   fifo_names[queue],
6854					   phylen, wlc->fragthresh[queue],
6855					   dur, wlc->edcf_txop[ac]);
6856		}
6857	}
6858
6859	return 0;
6860}
6861
6862static int brcms_c_tx(struct brcms_c_info *wlc, struct sk_buff *skb)
6863{
6864	struct dma_pub *dma;
6865	int fifo, ret = -ENOSPC;
6866	struct d11txh *txh;
6867	u16 frameid = INVALIDFID;
6868
6869	fifo = brcms_ac_to_fifo(skb_get_queue_mapping(skb));
6870	dma = wlc->hw->di[fifo];
6871	txh = (struct d11txh *)(skb->data);
6872
6873	if (dma->txavail == 0) {
6874		/*
6875		 * We sometimes get a frame from mac80211 after stopping
6876		 * the queues. This only ever seems to be a single frame
6877		 * and is seems likely to be a race. TX_HEADROOM should
6878		 * ensure that we have enough space to handle these stray
6879		 * packets, so warn if there isn't. If we're out of space
6880		 * in the tx ring and the tx queue isn't stopped then
6881		 * we've really got a bug; warn loudly if that happens.
6882		 */
6883		brcms_warn(wlc->hw->d11core,
6884			   "Received frame for tx with no space in DMA ring\n");
6885		WARN_ON(!ieee80211_queue_stopped(wlc->pub->ieee_hw,
6886						 skb_get_queue_mapping(skb)));
6887		return -ENOSPC;
6888	}
6889
6890	/* When a BC/MC frame is being committed to the BCMC fifo
6891	 * via DMA (NOT PIO), update ucode or BSS info as appropriate.
6892	 */
6893	if (fifo == TX_BCMC_FIFO)
6894		frameid = le16_to_cpu(txh->TxFrameID);
6895
6896	/* Commit BCMC sequence number in the SHM frame ID location */
6897	if (frameid != INVALIDFID) {
6898		/*
6899		 * To inform the ucode of the last mcast frame posted
6900		 * so that it can clear moredata bit
6901		 */
6902		brcms_b_write_shm(wlc->hw, M_BCMC_FID, frameid);
6903	}
6904
6905	ret = brcms_c_txfifo(wlc, fifo, skb);
6906	/*
6907	 * The only reason for brcms_c_txfifo to fail is because
6908	 * there weren't any DMA descriptors, but we've already
6909	 * checked for that. So if it does fail yell loudly.
6910	 */
6911	WARN_ON_ONCE(ret);
6912
6913	return ret;
6914}
6915
6916bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
6917			      struct ieee80211_hw *hw)
6918{
6919	uint fifo;
6920	struct scb *scb = &wlc->pri_scb;
6921
6922	fifo = brcms_ac_to_fifo(skb_get_queue_mapping(sdu));
6923	brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0);
6924	if (!brcms_c_tx(wlc, sdu))
6925		return true;
6926
6927	/* packet discarded */
6928	dev_kfree_skb_any(sdu);
6929	return false;
6930}
6931
6932int
6933brcms_c_txfifo(struct brcms_c_info *wlc, uint fifo, struct sk_buff *p)
6934{
6935	struct dma_pub *dma = wlc->hw->di[fifo];
6936	int ret;
6937	u16 queue;
6938
6939	ret = dma_txfast(wlc, dma, p);
6940	if (ret	< 0)
6941		wiphy_err(wlc->wiphy, "txfifo: fatal, toss frames !!!\n");
6942
6943	/*
6944	 * Stop queue if DMA ring is full. Reserve some free descriptors,
6945	 * as we sometimes receive a frame from mac80211 after the queues
6946	 * are stopped.
6947	 */
6948	queue = skb_get_queue_mapping(p);
6949	if (dma->txavail <= TX_HEADROOM && fifo < TX_BCMC_FIFO &&
6950	    !ieee80211_queue_stopped(wlc->pub->ieee_hw, queue))
6951		ieee80211_stop_queue(wlc->pub->ieee_hw, queue);
6952
6953	return ret;
6954}
6955
6956u32
6957brcms_c_rspec_to_rts_rspec(struct brcms_c_info *wlc, u32 rspec,
6958			   bool use_rspec, u16 mimo_ctlchbw)
6959{
6960	u32 rts_rspec = 0;
6961
6962	if (use_rspec)
6963		/* use frame rate as rts rate */
6964		rts_rspec = rspec;
6965	else if (wlc->band->gmode && wlc->protection->_g && !is_cck_rate(rspec))
6966		/* Use 11Mbps as the g protection RTS target rate and fallback.
6967		 * Use the brcms_basic_rate() lookup to find the best basic rate
6968		 * under the target in case 11 Mbps is not Basic.
6969		 * 6 and 9 Mbps are not usually selected by rate selection, but
6970		 * even if the OFDM rate we are protecting is 6 or 9 Mbps, 11
6971		 * is more robust.
6972		 */
6973		rts_rspec = brcms_basic_rate(wlc, BRCM_RATE_11M);
6974	else
6975		/* calculate RTS rate and fallback rate based on the frame rate
6976		 * RTS must be sent at a basic rate since it is a
6977		 * control frame, sec 9.6 of 802.11 spec
6978		 */
6979		rts_rspec = brcms_basic_rate(wlc, rspec);
6980
6981	if (BRCMS_PHY_11N_CAP(wlc->band)) {
6982		/* set rts txbw to correct side band */
6983		rts_rspec &= ~RSPEC_BW_MASK;
6984
6985		/*
6986		 * if rspec/rspec_fallback is 40MHz, then send RTS on both
6987		 * 20MHz channel (DUP), otherwise send RTS on control channel
6988		 */
6989		if (rspec_is40mhz(rspec) && !is_cck_rate(rts_rspec))
6990			rts_rspec |= (PHY_TXC1_BW_40MHZ_DUP << RSPEC_BW_SHIFT);
6991		else
6992			rts_rspec |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
6993
6994		/* pick siso/cdd as default for ofdm */
6995		if (is_ofdm_rate(rts_rspec)) {
6996			rts_rspec &= ~RSPEC_STF_MASK;
6997			rts_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
6998		}
6999	}
7000	return rts_rspec;
7001}
7002
7003/* Update beacon listen interval in shared memory */
7004static void brcms_c_bcn_li_upd(struct brcms_c_info *wlc)
7005{
7006	/* wake up every DTIM is the default */
7007	if (wlc->bcn_li_dtim == 1)
7008		brcms_b_write_shm(wlc->hw, M_BCN_LI, 0);
7009	else
7010		brcms_b_write_shm(wlc->hw, M_BCN_LI,
7011			      (wlc->bcn_li_dtim << 8) | wlc->bcn_li_bcn);
7012}
7013
7014static void
7015brcms_b_read_tsf(struct brcms_hardware *wlc_hw, u32 *tsf_l_ptr,
7016		  u32 *tsf_h_ptr)
7017{
7018	struct bcma_device *core = wlc_hw->d11core;
7019
7020	/* read the tsf timer low, then high to get an atomic read */
7021	*tsf_l_ptr = bcma_read32(core, D11REGOFFS(tsf_timerlow));
7022	*tsf_h_ptr = bcma_read32(core, D11REGOFFS(tsf_timerhigh));
7023}
7024
7025/*
7026 * recover 64bit TSF value from the 16bit TSF value in the rx header
7027 * given the assumption that the TSF passed in header is within 65ms
7028 * of the current tsf.
7029 *
7030 * 6       5       4       4       3       2       1
7031 * 3.......6.......8.......0.......2.......4.......6.......8......0
7032 * |<---------- tsf_h ----------->||<--- tsf_l -->||<-RxTSFTime ->|
7033 *
7034 * The RxTSFTime are the lowest 16 bits and provided by the ucode. The
7035 * tsf_l is filled in by brcms_b_recv, which is done earlier in the
7036 * receive call sequence after rx interrupt. Only the higher 16 bits
7037 * are used. Finally, the tsf_h is read from the tsf register.
7038 */
7039static u64 brcms_c_recover_tsf64(struct brcms_c_info *wlc,
7040				 struct d11rxhdr *rxh)
7041{
7042	u32 tsf_h, tsf_l;
7043	u16 rx_tsf_0_15, rx_tsf_16_31;
7044
7045	brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7046
7047	rx_tsf_16_31 = (u16)(tsf_l >> 16);
7048	rx_tsf_0_15 = rxh->RxTSFTime;
7049
7050	/*
7051	 * a greater tsf time indicates the low 16 bits of
7052	 * tsf_l wrapped, so decrement the high 16 bits.
7053	 */
7054	if ((u16)tsf_l < rx_tsf_0_15) {
7055		rx_tsf_16_31 -= 1;
7056		if (rx_tsf_16_31 == 0xffff)
7057			tsf_h -= 1;
7058	}
7059
7060	return ((u64)tsf_h << 32) | (((u32)rx_tsf_16_31 << 16) + rx_tsf_0_15);
7061}
7062
7063static void
7064prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7065		     struct sk_buff *p,
7066		     struct ieee80211_rx_status *rx_status)
7067{
7068	int channel;
7069	u32 rspec;
7070	unsigned char *plcp;
7071
7072	/* fill in TSF and flag its presence */
7073	rx_status->mactime = brcms_c_recover_tsf64(wlc, rxh);
7074	rx_status->flag |= RX_FLAG_MACTIME_START;
7075
7076	channel = BRCMS_CHAN_CHANNEL(rxh->RxChan);
7077
7078	rx_status->band =
7079		channel > 14 ? IEEE80211_BAND_5GHZ : IEEE80211_BAND_2GHZ;
7080	rx_status->freq =
7081		ieee80211_channel_to_frequency(channel, rx_status->band);
7082
7083	rx_status->signal = wlc_phy_rssi_compute(wlc->hw->band->pi, rxh);
7084
7085	/* noise */
7086	/* qual */
7087	rx_status->antenna =
7088		(rxh->PhyRxStatus_0 & PRXS0_RXANT_UPSUBBAND) ? 1 : 0;
7089
7090	plcp = p->data;
7091
7092	rspec = brcms_c_compute_rspec(rxh, plcp);
7093	if (is_mcs_rate(rspec)) {
7094		rx_status->rate_idx = rspec & RSPEC_RATE_MASK;
7095		rx_status->flag |= RX_FLAG_HT;
7096		if (rspec_is40mhz(rspec))
7097			rx_status->flag |= RX_FLAG_40MHZ;
7098	} else {
7099		switch (rspec2rate(rspec)) {
7100		case BRCM_RATE_1M:
7101			rx_status->rate_idx = 0;
7102			break;
7103		case BRCM_RATE_2M:
7104			rx_status->rate_idx = 1;
7105			break;
7106		case BRCM_RATE_5M5:
7107			rx_status->rate_idx = 2;
7108			break;
7109		case BRCM_RATE_11M:
7110			rx_status->rate_idx = 3;
7111			break;
7112		case BRCM_RATE_6M:
7113			rx_status->rate_idx = 4;
7114			break;
7115		case BRCM_RATE_9M:
7116			rx_status->rate_idx = 5;
7117			break;
7118		case BRCM_RATE_12M:
7119			rx_status->rate_idx = 6;
7120			break;
7121		case BRCM_RATE_18M:
7122			rx_status->rate_idx = 7;
7123			break;
7124		case BRCM_RATE_24M:
7125			rx_status->rate_idx = 8;
7126			break;
7127		case BRCM_RATE_36M:
7128			rx_status->rate_idx = 9;
7129			break;
7130		case BRCM_RATE_48M:
7131			rx_status->rate_idx = 10;
7132			break;
7133		case BRCM_RATE_54M:
7134			rx_status->rate_idx = 11;
7135			break;
7136		default:
7137			brcms_err(wlc->hw->d11core,
7138				  "%s: Unknown rate\n", __func__);
7139		}
7140
7141		/*
7142		 * For 5GHz, we should decrease the index as it is
7143		 * a subset of the 2.4G rates. See bitrates field
7144		 * of brcms_band_5GHz_nphy (in mac80211_if.c).
7145		 */
7146		if (rx_status->band == IEEE80211_BAND_5GHZ)
7147			rx_status->rate_idx -= BRCMS_LEGACY_5G_RATE_OFFSET;
7148
7149		/* Determine short preamble and rate_idx */
7150		if (is_cck_rate(rspec)) {
7151			if (rxh->PhyRxStatus_0 & PRXS0_SHORTH)
7152				rx_status->flag |= RX_FLAG_SHORTPRE;
7153		} else if (is_ofdm_rate(rspec)) {
7154			rx_status->flag |= RX_FLAG_SHORTPRE;
7155		} else {
7156			brcms_err(wlc->hw->d11core, "%s: Unknown modulation\n",
7157				  __func__);
7158		}
7159	}
7160
7161	if (plcp3_issgi(plcp[3]))
7162		rx_status->flag |= RX_FLAG_SHORT_GI;
7163
7164	if (rxh->RxStatus1 & RXS_DECERR) {
7165		rx_status->flag |= RX_FLAG_FAILED_PLCP_CRC;
7166		brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_PLCP_CRC\n",
7167			  __func__);
7168	}
7169	if (rxh->RxStatus1 & RXS_FCSERR) {
7170		rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
7171		brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_FCS_CRC\n",
7172			  __func__);
7173	}
7174}
7175
7176static void
7177brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7178		struct sk_buff *p)
7179{
7180	int len_mpdu;
7181	struct ieee80211_rx_status rx_status;
7182	struct ieee80211_hdr *hdr;
7183
7184	memset(&rx_status, 0, sizeof(rx_status));
7185	prep_mac80211_status(wlc, rxh, p, &rx_status);
7186
7187	/* mac header+body length, exclude CRC and plcp header */
7188	len_mpdu = p->len - D11_PHY_HDR_LEN - FCS_LEN;
7189	skb_pull(p, D11_PHY_HDR_LEN);
7190	__skb_trim(p, len_mpdu);
7191
7192	/* unmute transmit */
7193	if (wlc->hw->suspended_fifos) {
7194		hdr = (struct ieee80211_hdr *)p->data;
7195		if (ieee80211_is_beacon(hdr->frame_control))
7196			brcms_b_mute(wlc->hw, false);
7197	}
7198
7199	memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
7200	ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
7201}
7202
7203/* calculate frame duration for Mixed-mode L-SIG spoofing, return
7204 * number of bytes goes in the length field
7205 *
7206 * Formula given by HT PHY Spec v 1.13
7207 *   len = 3(nsyms + nstream + 3) - 3
7208 */
7209u16
7210brcms_c_calc_lsig_len(struct brcms_c_info *wlc, u32 ratespec,
7211		      uint mac_len)
7212{
7213	uint nsyms, len = 0, kNdps;
7214
7215	if (is_mcs_rate(ratespec)) {
7216		uint mcs = ratespec & RSPEC_RATE_MASK;
7217		int tot_streams = (mcs_2_txstreams(mcs) + 1) +
7218				  rspec_stc(ratespec);
7219
7220		/*
7221		 * the payload duration calculation matches that
7222		 * of regular ofdm
7223		 */
7224		/* 1000Ndbps = kbps * 4 */
7225		kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
7226				   rspec_issgi(ratespec)) * 4;
7227
7228		if (rspec_stc(ratespec) == 0)
7229			nsyms =
7230			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7231				  APHY_TAIL_NBITS) * 1000, kNdps);
7232		else
7233			/* STBC needs to have even number of symbols */
7234			nsyms =
7235			    2 *
7236			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7237				  APHY_TAIL_NBITS) * 1000, 2 * kNdps);
7238
7239		/* (+3) account for HT-SIG(2) and HT-STF(1) */
7240		nsyms += (tot_streams + 3);
7241		/*
7242		 * 3 bytes/symbol @ legacy 6Mbps rate
7243		 * (-3) excluding service bits and tail bits
7244		 */
7245		len = (3 * nsyms) - 3;
7246	}
7247
7248	return (u16) len;
7249}
7250
7251static void
7252brcms_c_mod_prb_rsp_rate_table(struct brcms_c_info *wlc, uint frame_len)
7253{
7254	const struct brcms_c_rateset *rs_dflt;
7255	struct brcms_c_rateset rs;
7256	u8 rate;
7257	u16 entry_ptr;
7258	u8 plcp[D11_PHY_HDR_LEN];
7259	u16 dur, sifs;
7260	uint i;
7261
7262	sifs = get_sifs(wlc->band);
7263
7264	rs_dflt = brcms_c_rateset_get_hwrs(wlc);
7265
7266	brcms_c_rateset_copy(rs_dflt, &rs);
7267	brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
7268
7269	/*
7270	 * walk the phy rate table and update MAC core SHM
7271	 * basic rate table entries
7272	 */
7273	for (i = 0; i < rs.count; i++) {
7274		rate = rs.rates[i] & BRCMS_RATE_MASK;
7275
7276		entry_ptr = brcms_b_rate_shm_offset(wlc->hw, rate);
7277
7278		/* Calculate the Probe Response PLCP for the given rate */
7279		brcms_c_compute_plcp(wlc, rate, frame_len, plcp);
7280
7281		/*
7282		 * Calculate the duration of the Probe Response
7283		 * frame plus SIFS for the MAC
7284		 */
7285		dur = (u16) brcms_c_calc_frame_time(wlc, rate,
7286						BRCMS_LONG_PREAMBLE, frame_len);
7287		dur += sifs;
7288
7289		/* Update the SHM Rate Table entry Probe Response values */
7290		brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS,
7291			      (u16) (plcp[0] + (plcp[1] << 8)));
7292		brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS + 2,
7293			      (u16) (plcp[2] + (plcp[3] << 8)));
7294		brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_DUR_POS, dur);
7295	}
7296}
7297
7298int brcms_c_get_header_len(void)
7299{
7300	return TXOFF;
7301}
7302
7303static void brcms_c_beacon_write(struct brcms_c_info *wlc,
7304				 struct sk_buff *beacon, u16 tim_offset,
7305				 u16 dtim_period, bool bcn0, bool bcn1)
7306{
7307	size_t len;
7308	struct ieee80211_tx_info *tx_info;
7309	struct brcms_hardware *wlc_hw = wlc->hw;
7310	struct ieee80211_hw *ieee_hw = brcms_c_pub(wlc)->ieee_hw;
7311
7312	/* Get tx_info */
7313	tx_info = IEEE80211_SKB_CB(beacon);
7314
7315	len = min_t(size_t, beacon->len, BCN_TMPL_LEN);
7316	wlc->bcn_rspec = ieee80211_get_tx_rate(ieee_hw, tx_info)->hw_value;
7317
7318	brcms_c_compute_plcp(wlc, wlc->bcn_rspec,
7319			     len + FCS_LEN - D11_PHY_HDR_LEN, beacon->data);
7320
7321	/* "Regular" and 16 MBSS but not for 4 MBSS */
7322	/* Update the phytxctl for the beacon based on the rspec */
7323	brcms_c_beacon_phytxctl_txant_upd(wlc, wlc->bcn_rspec);
7324
7325	if (bcn0) {
7326		/* write the probe response into the template region */
7327		brcms_b_write_template_ram(wlc_hw, T_BCN0_TPL_BASE,
7328					    (len + 3) & ~3, beacon->data);
7329
7330		/* write beacon length to SCR */
7331		brcms_b_write_shm(wlc_hw, M_BCN0_FRM_BYTESZ, (u16) len);
7332	}
7333	if (bcn1) {
7334		/* write the probe response into the template region */
7335		brcms_b_write_template_ram(wlc_hw, T_BCN1_TPL_BASE,
7336					    (len + 3) & ~3, beacon->data);
7337
7338		/* write beacon length to SCR */
7339		brcms_b_write_shm(wlc_hw, M_BCN1_FRM_BYTESZ, (u16) len);
7340	}
7341
7342	if (tim_offset != 0) {
7343		brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
7344				  tim_offset + D11B_PHY_HDR_LEN);
7345		brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, dtim_period);
7346	} else {
7347		brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
7348				  len + D11B_PHY_HDR_LEN);
7349		brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, 0);
7350	}
7351}
7352
7353static void brcms_c_update_beacon_hw(struct brcms_c_info *wlc,
7354				     struct sk_buff *beacon, u16 tim_offset,
7355				     u16 dtim_period)
7356{
7357	struct brcms_hardware *wlc_hw = wlc->hw;
7358	struct bcma_device *core = wlc_hw->d11core;
7359
7360	/* Hardware beaconing for this config */
7361	u32 both_valid = MCMD_BCN0VLD | MCMD_BCN1VLD;
7362
7363	/* Check if both templates are in use, if so sched. an interrupt
7364	 *      that will call back into this routine
7365	 */
7366	if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid)
7367		/* clear any previous status */
7368		bcma_write32(core, D11REGOFFS(macintstatus), MI_BCNTPL);
7369
7370	if (wlc->beacon_template_virgin) {
7371		wlc->beacon_template_virgin = false;
7372		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
7373				     true);
7374		/* mark beacon0 valid */
7375		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
7376		return;
7377	}
7378
7379	/* Check that after scheduling the interrupt both of the
7380	 *      templates are still busy. if not clear the int. & remask
7381	 */
7382	if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid) {
7383		wlc->defmacintmask |= MI_BCNTPL;
7384		return;
7385	}
7386
7387	if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN0VLD)) {
7388		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
7389				     false);
7390		/* mark beacon0 valid */
7391		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
7392		return;
7393	}
7394	if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN1VLD)) {
7395		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period,
7396				     false, true);
7397		/* mark beacon0 valid */
7398		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN1VLD);
7399		return;
7400	}
7401	return;
7402}
7403
7404/*
7405 * Update all beacons for the system.
7406 */
7407void brcms_c_update_beacon(struct brcms_c_info *wlc)
7408{
7409	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7410
7411	if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
7412			     bsscfg->type == BRCMS_TYPE_ADHOC)) {
7413		/* Clear the soft intmask */
7414		wlc->defmacintmask &= ~MI_BCNTPL;
7415		if (!wlc->beacon)
7416			return;
7417		brcms_c_update_beacon_hw(wlc, wlc->beacon,
7418					 wlc->beacon_tim_offset,
7419					 wlc->beacon_dtim_period);
7420	}
7421}
7422
7423void brcms_c_set_new_beacon(struct brcms_c_info *wlc, struct sk_buff *beacon,
7424			    u16 tim_offset, u16 dtim_period)
7425{
7426	if (!beacon)
7427		return;
7428	if (wlc->beacon)
7429		dev_kfree_skb_any(wlc->beacon);
7430	wlc->beacon = beacon;
7431
7432	/* add PLCP */
7433	skb_push(wlc->beacon, D11_PHY_HDR_LEN);
7434	wlc->beacon_tim_offset = tim_offset;
7435	wlc->beacon_dtim_period = dtim_period;
7436	brcms_c_update_beacon(wlc);
7437}
7438
7439void brcms_c_set_new_probe_resp(struct brcms_c_info *wlc,
7440				struct sk_buff *probe_resp)
7441{
7442	if (!probe_resp)
7443		return;
7444	if (wlc->probe_resp)
7445		dev_kfree_skb_any(wlc->probe_resp);
7446	wlc->probe_resp = probe_resp;
7447
7448	/* add PLCP */
7449	skb_push(wlc->probe_resp, D11_PHY_HDR_LEN);
7450	brcms_c_update_probe_resp(wlc, false);
7451}
7452
7453void brcms_c_enable_probe_resp(struct brcms_c_info *wlc, bool enable)
7454{
7455	/*
7456	 * prevent ucode from sending probe responses by setting the timeout
7457	 * to 1, it can not send it in that time frame.
7458	 */
7459	wlc->prb_resp_timeout = enable ? BRCMS_PRB_RESP_TIMEOUT : 1;
7460	brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
7461	/* TODO: if (enable) => also deactivate receiving of probe request */
7462}
7463
7464/* Write ssid into shared memory */
7465static void
7466brcms_c_shm_ssid_upd(struct brcms_c_info *wlc, struct brcms_bss_cfg *cfg)
7467{
7468	u8 *ssidptr = cfg->SSID;
7469	u16 base = M_SSID;
7470	u8 ssidbuf[IEEE80211_MAX_SSID_LEN];
7471
7472	/* padding the ssid with zero and copy it into shm */
7473	memset(ssidbuf, 0, IEEE80211_MAX_SSID_LEN);
7474	memcpy(ssidbuf, ssidptr, cfg->SSID_len);
7475
7476	brcms_c_copyto_shm(wlc, base, ssidbuf, IEEE80211_MAX_SSID_LEN);
7477	brcms_b_write_shm(wlc->hw, M_SSIDLEN, (u16) cfg->SSID_len);
7478}
7479
7480static void
7481brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
7482			      struct brcms_bss_cfg *cfg,
7483			      struct sk_buff *probe_resp,
7484			      bool suspend)
7485{
7486	int len;
7487
7488	len = min_t(size_t, probe_resp->len, BCN_TMPL_LEN);
7489
7490	if (suspend)
7491		brcms_c_suspend_mac_and_wait(wlc);
7492
7493	/* write the probe response into the template region */
7494	brcms_b_write_template_ram(wlc->hw, T_PRS_TPL_BASE,
7495				    (len + 3) & ~3, probe_resp->data);
7496
7497	/* write the length of the probe response frame (+PLCP/-FCS) */
7498	brcms_b_write_shm(wlc->hw, M_PRB_RESP_FRM_LEN, (u16) len);
7499
7500	/* write the SSID and SSID length */
7501	brcms_c_shm_ssid_upd(wlc, cfg);
7502
7503	/*
7504	 * Write PLCP headers and durations for probe response frames
7505	 * at all rates. Use the actual frame length covered by the
7506	 * PLCP header for the call to brcms_c_mod_prb_rsp_rate_table()
7507	 * by subtracting the PLCP len and adding the FCS.
7508	 */
7509	brcms_c_mod_prb_rsp_rate_table(wlc,
7510				      (u16)len + FCS_LEN - D11_PHY_HDR_LEN);
7511
7512	if (suspend)
7513		brcms_c_enable_mac(wlc);
7514}
7515
7516void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
7517{
7518	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7519
7520	/* update AP or IBSS probe responses */
7521	if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
7522			     bsscfg->type == BRCMS_TYPE_ADHOC)) {
7523		if (!wlc->probe_resp)
7524			return;
7525		brcms_c_bss_update_probe_resp(wlc, bsscfg, wlc->probe_resp,
7526					      suspend);
7527	}
7528}
7529
7530int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo,
7531			   uint *blocks)
7532{
7533	if (fifo >= NFIFO)
7534		return -EINVAL;
7535
7536	*blocks = wlc_hw->xmtfifo_sz[fifo];
7537
7538	return 0;
7539}
7540
7541void
7542brcms_c_set_addrmatch(struct brcms_c_info *wlc, int match_reg_offset,
7543		  const u8 *addr)
7544{
7545	brcms_b_set_addrmatch(wlc->hw, match_reg_offset, addr);
7546	if (match_reg_offset == RCM_BSSID_OFFSET)
7547		memcpy(wlc->bsscfg->BSSID, addr, ETH_ALEN);
7548}
7549
7550/*
7551 * Flag 'scan in progress' to withhold dynamic phy calibration
7552 */
7553void brcms_c_scan_start(struct brcms_c_info *wlc)
7554{
7555	wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, true);
7556}
7557
7558void brcms_c_scan_stop(struct brcms_c_info *wlc)
7559{
7560	wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, false);
7561}
7562
7563void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state)
7564{
7565	wlc->pub->associated = state;
7566}
7567
7568/*
7569 * When a remote STA/AP is removed by Mac80211, or when it can no longer accept
7570 * AMPDU traffic, packets pending in hardware have to be invalidated so that
7571 * when later on hardware releases them, they can be handled appropriately.
7572 */
7573void brcms_c_inval_dma_pkts(struct brcms_hardware *hw,
7574			       struct ieee80211_sta *sta,
7575			       void (*dma_callback_fn))
7576{
7577	struct dma_pub *dmah;
7578	int i;
7579	for (i = 0; i < NFIFO; i++) {
7580		dmah = hw->di[i];
7581		if (dmah != NULL)
7582			dma_walk_packets(dmah, dma_callback_fn, sta);
7583	}
7584}
7585
7586int brcms_c_get_curband(struct brcms_c_info *wlc)
7587{
7588	return wlc->band->bandunit;
7589}
7590
7591bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc)
7592{
7593	int i;
7594
7595	/* Kick DMA to send any pending AMPDU */
7596	for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
7597		if (wlc->hw->di[i])
7598			dma_kick_tx(wlc->hw->di[i]);
7599
7600	return !brcms_txpktpendtot(wlc);
7601}
7602
7603void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
7604{
7605	wlc->bcn_li_bcn = interval;
7606	if (wlc->pub->up)
7607		brcms_c_bcn_li_upd(wlc);
7608}
7609
7610u64 brcms_c_tsf_get(struct brcms_c_info *wlc)
7611{
7612	u32 tsf_h, tsf_l;
7613	u64 tsf;
7614
7615	brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7616
7617	tsf = tsf_h;
7618	tsf <<= 32;
7619	tsf |= tsf_l;
7620
7621	return tsf;
7622}
7623
7624void brcms_c_tsf_set(struct brcms_c_info *wlc, u64 tsf)
7625{
7626	u32 tsf_h, tsf_l;
7627
7628	brcms_c_time_lock(wlc);
7629
7630	tsf_l = tsf;
7631	tsf_h = (tsf >> 32);
7632
7633	/* read the tsf timer low, then high to get an atomic read */
7634	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerlow), tsf_l);
7635	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerhigh), tsf_h);
7636
7637	brcms_c_time_unlock(wlc);
7638}
7639
7640int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr)
7641{
7642	uint qdbm;
7643
7644	/* Remove override bit and clip to max qdbm value */
7645	qdbm = min_t(uint, txpwr * BRCMS_TXPWR_DB_FACTOR, 0xff);
7646	return wlc_phy_txpower_set(wlc->band->pi, qdbm, false);
7647}
7648
7649int brcms_c_get_tx_power(struct brcms_c_info *wlc)
7650{
7651	uint qdbm;
7652	bool override;
7653
7654	wlc_phy_txpower_get(wlc->band->pi, &qdbm, &override);
7655
7656	/* Return qdbm units */
7657	return (int)(qdbm / BRCMS_TXPWR_DB_FACTOR);
7658}
7659
7660/* Process received frames */
7661/*
7662 * Return true if more frames need to be processed. false otherwise.
7663 * Param 'bound' indicates max. # frames to process before break out.
7664 */
7665static void brcms_c_recv(struct brcms_c_info *wlc, struct sk_buff *p)
7666{
7667	struct d11rxhdr *rxh;
7668	struct ieee80211_hdr *h;
7669	uint len;
7670	bool is_amsdu;
7671
7672	/* frame starts with rxhdr */
7673	rxh = (struct d11rxhdr *) (p->data);
7674
7675	/* strip off rxhdr */
7676	skb_pull(p, BRCMS_HWRXOFF);
7677
7678	/* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU subframes */
7679	if (rxh->RxStatus1 & RXS_PBPRES) {
7680		if (p->len < 2) {
7681			brcms_err(wlc->hw->d11core,
7682				  "wl%d: recv: rcvd runt of len %d\n",
7683				  wlc->pub->unit, p->len);
7684			goto toss;
7685		}
7686		skb_pull(p, 2);
7687	}
7688
7689	h = (struct ieee80211_hdr *)(p->data + D11_PHY_HDR_LEN);
7690	len = p->len;
7691
7692	if (rxh->RxStatus1 & RXS_FCSERR) {
7693		if (!(wlc->filter_flags & FIF_FCSFAIL))
7694			goto toss;
7695	}
7696
7697	/* check received pkt has at least frame control field */
7698	if (len < D11_PHY_HDR_LEN + sizeof(h->frame_control))
7699		goto toss;
7700
7701	/* not supporting A-MSDU */
7702	is_amsdu = rxh->RxStatus2 & RXS_AMSDU_MASK;
7703	if (is_amsdu)
7704		goto toss;
7705
7706	brcms_c_recvctl(wlc, rxh, p);
7707	return;
7708
7709 toss:
7710	brcmu_pkt_buf_free_skb(p);
7711}
7712
7713/* Process received frames */
7714/*
7715 * Return true if more frames need to be processed. false otherwise.
7716 * Param 'bound' indicates max. # frames to process before break out.
7717 */
7718static bool
7719brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
7720{
7721	struct sk_buff *p;
7722	struct sk_buff *next = NULL;
7723	struct sk_buff_head recv_frames;
7724
7725	uint n = 0;
7726	uint bound_limit = bound ? RXBND : -1;
7727	bool morepending = false;
7728
7729	skb_queue_head_init(&recv_frames);
7730
7731	/* gather received frames */
7732	do {
7733		/* !give others some time to run! */
7734		if (n >= bound_limit)
7735			break;
7736
7737		morepending = dma_rx(wlc_hw->di[fifo], &recv_frames);
7738		n++;
7739	} while (morepending);
7740
7741	/* post more rbufs */
7742	dma_rxfill(wlc_hw->di[fifo]);
7743
7744	/* process each frame */
7745	skb_queue_walk_safe(&recv_frames, p, next) {
7746		struct d11rxhdr_le *rxh_le;
7747		struct d11rxhdr *rxh;
7748
7749		skb_unlink(p, &recv_frames);
7750		rxh_le = (struct d11rxhdr_le *)p->data;
7751		rxh = (struct d11rxhdr *)p->data;
7752
7753		/* fixup rx header endianness */
7754		rxh->RxFrameSize = le16_to_cpu(rxh_le->RxFrameSize);
7755		rxh->PhyRxStatus_0 = le16_to_cpu(rxh_le->PhyRxStatus_0);
7756		rxh->PhyRxStatus_1 = le16_to_cpu(rxh_le->PhyRxStatus_1);
7757		rxh->PhyRxStatus_2 = le16_to_cpu(rxh_le->PhyRxStatus_2);
7758		rxh->PhyRxStatus_3 = le16_to_cpu(rxh_le->PhyRxStatus_3);
7759		rxh->PhyRxStatus_4 = le16_to_cpu(rxh_le->PhyRxStatus_4);
7760		rxh->PhyRxStatus_5 = le16_to_cpu(rxh_le->PhyRxStatus_5);
7761		rxh->RxStatus1 = le16_to_cpu(rxh_le->RxStatus1);
7762		rxh->RxStatus2 = le16_to_cpu(rxh_le->RxStatus2);
7763		rxh->RxTSFTime = le16_to_cpu(rxh_le->RxTSFTime);
7764		rxh->RxChan = le16_to_cpu(rxh_le->RxChan);
7765
7766		brcms_c_recv(wlc_hw->wlc, p);
7767	}
7768
7769	return morepending;
7770}
7771
7772/* second-level interrupt processing
7773 *   Return true if another dpc needs to be re-scheduled. false otherwise.
7774 *   Param 'bounded' indicates if applicable loops should be bounded.
7775 */
7776bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded)
7777{
7778	u32 macintstatus;
7779	struct brcms_hardware *wlc_hw = wlc->hw;
7780	struct bcma_device *core = wlc_hw->d11core;
7781
7782	if (brcms_deviceremoved(wlc)) {
7783		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
7784			  __func__);
7785		brcms_down(wlc->wl);
7786		return false;
7787	}
7788
7789	/* grab and clear the saved software intstatus bits */
7790	macintstatus = wlc->macintstatus;
7791	wlc->macintstatus = 0;
7792
7793	brcms_dbg_int(core, "wl%d: macintstatus 0x%x\n",
7794		      wlc_hw->unit, macintstatus);
7795
7796	WARN_ON(macintstatus & MI_PRQ); /* PRQ Interrupt in non-MBSS */
7797
7798	/* tx status */
7799	if (macintstatus & MI_TFS) {
7800		bool fatal;
7801		if (brcms_b_txstatus(wlc->hw, bounded, &fatal))
7802			wlc->macintstatus |= MI_TFS;
7803		if (fatal) {
7804			brcms_err(core, "MI_TFS: fatal\n");
7805			goto fatal;
7806		}
7807	}
7808
7809	if (macintstatus & (MI_TBTT | MI_DTIM_TBTT))
7810		brcms_c_tbtt(wlc);
7811
7812	/* ATIM window end */
7813	if (macintstatus & MI_ATIMWINEND) {
7814		brcms_dbg_info(core, "end of ATIM window\n");
7815		bcma_set32(core, D11REGOFFS(maccommand), wlc->qvalid);
7816		wlc->qvalid = 0;
7817	}
7818
7819	/*
7820	 * received data or control frame, MI_DMAINT is
7821	 * indication of RX_FIFO interrupt
7822	 */
7823	if (macintstatus & MI_DMAINT)
7824		if (brcms_b_recv(wlc_hw, RX_FIFO, bounded))
7825			wlc->macintstatus |= MI_DMAINT;
7826
7827	/* noise sample collected */
7828	if (macintstatus & MI_BG_NOISE)
7829		wlc_phy_noise_sample_intr(wlc_hw->band->pi);
7830
7831	if (macintstatus & MI_GP0) {
7832		brcms_err(core, "wl%d: PSM microcode watchdog fired at %d "
7833			  "(seconds). Resetting.\n", wlc_hw->unit, wlc_hw->now);
7834
7835		printk_once("%s : PSM Watchdog, chipid 0x%x, chiprev 0x%x\n",
7836			    __func__, ai_get_chip_id(wlc_hw->sih),
7837			    ai_get_chiprev(wlc_hw->sih));
7838		brcms_fatal_error(wlc_hw->wlc->wl);
7839	}
7840
7841	/* gptimer timeout */
7842	if (macintstatus & MI_TO)
7843		bcma_write32(core, D11REGOFFS(gptimer), 0);
7844
7845	if (macintstatus & MI_RFDISABLE) {
7846		brcms_dbg_info(core, "wl%d: BMAC Detected a change on the"
7847			       " RF Disable Input\n", wlc_hw->unit);
7848		brcms_rfkill_set_hw_state(wlc->wl);
7849	}
7850
7851	/* BCN template is available */
7852	if (macintstatus & MI_BCNTPL)
7853		brcms_c_update_beacon(wlc);
7854
7855	/* it isn't done and needs to be resched if macintstatus is non-zero */
7856	return wlc->macintstatus != 0;
7857
7858 fatal:
7859	brcms_fatal_error(wlc_hw->wlc->wl);
7860	return wlc->macintstatus != 0;
7861}
7862
7863void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx)
7864{
7865	struct bcma_device *core = wlc->hw->d11core;
7866	struct ieee80211_channel *ch = wlc->pub->ieee_hw->conf.chandef.chan;
7867	u16 chanspec;
7868
7869	brcms_dbg_info(core, "wl%d\n", wlc->pub->unit);
7870
7871	chanspec = ch20mhz_chspec(ch->hw_value);
7872
7873	brcms_b_init(wlc->hw, chanspec);
7874
7875	/* update beacon listen interval */
7876	brcms_c_bcn_li_upd(wlc);
7877
7878	/* write ethernet address to core */
7879	brcms_c_set_mac(wlc->bsscfg);
7880	brcms_c_set_bssid(wlc->bsscfg);
7881
7882	/* Update tsf_cfprep if associated and up */
7883	if (wlc->pub->associated && wlc->pub->up) {
7884		u32 bi;
7885
7886		/* get beacon period and convert to uS */
7887		bi = wlc->bsscfg->current_bss->beacon_period << 10;
7888		/*
7889		 * update since init path would reset
7890		 * to default value
7891		 */
7892		bcma_write32(core, D11REGOFFS(tsf_cfprep),
7893			     bi << CFPREP_CBI_SHIFT);
7894
7895		/* Update maccontrol PM related bits */
7896		brcms_c_set_ps_ctrl(wlc);
7897	}
7898
7899	brcms_c_bandinit_ordered(wlc, chanspec);
7900
7901	/* init probe response timeout */
7902	brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
7903
7904	/* init max burst txop (framebursting) */
7905	brcms_b_write_shm(wlc->hw, M_MBURST_TXOP,
7906		      (wlc->
7907		       _rifs ? (EDCF_AC_VO_TXOP_AP << 5) : MAXFRAMEBURST_TXOP));
7908
7909	/* initialize maximum allowed duty cycle */
7910	brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_ofdm, true, true);
7911	brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_cck, false, true);
7912
7913	/*
7914	 * Update some shared memory locations related to
7915	 * max AMPDU size allowed to received
7916	 */
7917	brcms_c_ampdu_shm_upd(wlc->ampdu);
7918
7919	/* band-specific inits */
7920	brcms_c_bsinit(wlc);
7921
7922	/* Enable EDCF mode (while the MAC is suspended) */
7923	bcma_set16(core, D11REGOFFS(ifs_ctl), IFS_USEEDCF);
7924	brcms_c_edcf_setparams(wlc, false);
7925
7926	/* read the ucode version if we have not yet done so */
7927	if (wlc->ucode_rev == 0) {
7928		u16 rev;
7929		u16 patch;
7930
7931		rev = brcms_b_read_shm(wlc->hw, M_BOM_REV_MAJOR);
7932		patch = brcms_b_read_shm(wlc->hw, M_BOM_REV_MINOR);
7933		wlc->ucode_rev = (rev << NBITS(u16)) | patch;
7934		snprintf(wlc->wiphy->fw_version,
7935			 sizeof(wlc->wiphy->fw_version), "%u.%u", rev, patch);
7936	}
7937
7938	/* ..now really unleash hell (allow the MAC out of suspend) */
7939	brcms_c_enable_mac(wlc);
7940
7941	/* suspend the tx fifos and mute the phy for preism cac time */
7942	if (mute_tx)
7943		brcms_b_mute(wlc->hw, true);
7944
7945	/* enable the RF Disable Delay timer */
7946	bcma_write32(core, D11REGOFFS(rfdisabledly), RFDISABLE_DEFAULT);
7947
7948	/*
7949	 * Initialize WME parameters; if they haven't been set by some other
7950	 * mechanism (IOVar, etc) then read them from the hardware.
7951	 */
7952	if (GFIELD(wlc->wme_retries[0], EDCF_SHORT) == 0) {
7953		/* Uninitialized; read from HW */
7954		int ac;
7955
7956		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
7957			wlc->wme_retries[ac] =
7958			    brcms_b_read_shm(wlc->hw, M_AC_TXLMT_ADDR(ac));
7959	}
7960}
7961
7962/*
7963 * The common driver entry routine. Error codes should be unique
7964 */
7965struct brcms_c_info *
7966brcms_c_attach(struct brcms_info *wl, struct bcma_device *core, uint unit,
7967	       bool piomode, uint *perr)
7968{
7969	struct brcms_c_info *wlc;
7970	uint err = 0;
7971	uint i, j;
7972	struct brcms_pub *pub;
7973
7974	/* allocate struct brcms_c_info state and its substructures */
7975	wlc = brcms_c_attach_malloc(unit, &err, 0);
7976	if (wlc == NULL)
7977		goto fail;
7978	wlc->wiphy = wl->wiphy;
7979	pub = wlc->pub;
7980
7981#if defined(DEBUG)
7982	wlc_info_dbg = wlc;
7983#endif
7984
7985	wlc->band = wlc->bandstate[0];
7986	wlc->core = wlc->corestate;
7987	wlc->wl = wl;
7988	pub->unit = unit;
7989	pub->_piomode = piomode;
7990	wlc->bandinit_pending = false;
7991	wlc->beacon_template_virgin = true;
7992
7993	/* populate struct brcms_c_info with default values  */
7994	brcms_c_info_init(wlc, unit);
7995
7996	/* update sta/ap related parameters */
7997	brcms_c_ap_upd(wlc);
7998
7999	/*
8000	 * low level attach steps(all hw accesses go
8001	 * inside, no more in rest of the attach)
8002	 */
8003	err = brcms_b_attach(wlc, core, unit, piomode);
8004	if (err)
8005		goto fail;
8006
8007	brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, OFF);
8008
8009	pub->phy_11ncapable = BRCMS_PHY_11N_CAP(wlc->band);
8010
8011	/* disable allowed duty cycle */
8012	wlc->tx_duty_cycle_ofdm = 0;
8013	wlc->tx_duty_cycle_cck = 0;
8014
8015	brcms_c_stf_phy_chain_calc(wlc);
8016
8017	/* txchain 1: txant 0, txchain 2: txant 1 */
8018	if (BRCMS_ISNPHY(wlc->band) && (wlc->stf->txstreams == 1))
8019		wlc->stf->txant = wlc->stf->hw_txchain - 1;
8020
8021	/* push to BMAC driver */
8022	wlc_phy_stf_chain_init(wlc->band->pi, wlc->stf->hw_txchain,
8023			       wlc->stf->hw_rxchain);
8024
8025	/* pull up some info resulting from the low attach */
8026	for (i = 0; i < NFIFO; i++)
8027		wlc->core->txavail[i] = wlc->hw->txavail[i];
8028
8029	memcpy(&wlc->perm_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
8030	memcpy(&pub->cur_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
8031
8032	for (j = 0; j < wlc->pub->_nbands; j++) {
8033		wlc->band = wlc->bandstate[j];
8034
8035		if (!brcms_c_attach_stf_ant_init(wlc)) {
8036			err = 24;
8037			goto fail;
8038		}
8039
8040		/* default contention windows size limits */
8041		wlc->band->CWmin = APHY_CWMIN;
8042		wlc->band->CWmax = PHY_CWMAX;
8043
8044		/* init gmode value */
8045		if (wlc->band->bandtype == BRCM_BAND_2G) {
8046			wlc->band->gmode = GMODE_AUTO;
8047			brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER,
8048					   wlc->band->gmode);
8049		}
8050
8051		/* init _n_enab supported mode */
8052		if (BRCMS_PHY_11N_CAP(wlc->band)) {
8053			pub->_n_enab = SUPPORT_11N;
8054			brcms_c_protection_upd(wlc, BRCMS_PROT_N_USER,
8055						   ((pub->_n_enab ==
8056						     SUPPORT_11N) ? WL_11N_2x2 :
8057						    WL_11N_3x3));
8058		}
8059
8060		/* init per-band default rateset, depend on band->gmode */
8061		brcms_default_rateset(wlc, &wlc->band->defrateset);
8062
8063		/* fill in hw_rateset */
8064		brcms_c_rateset_filter(&wlc->band->defrateset,
8065				   &wlc->band->hw_rateset, false,
8066				   BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
8067				   (bool) (wlc->pub->_n_enab & SUPPORT_11N));
8068	}
8069
8070	/*
8071	 * update antenna config due to
8072	 * wlc->stf->txant/txchain/ant_rx_ovr change
8073	 */
8074	brcms_c_stf_phy_txant_upd(wlc);
8075
8076	/* attach each modules */
8077	err = brcms_c_attach_module(wlc);
8078	if (err != 0)
8079		goto fail;
8080
8081	if (!brcms_c_timers_init(wlc, unit)) {
8082		wiphy_err(wl->wiphy, "wl%d: %s: init_timer failed\n", unit,
8083			  __func__);
8084		err = 32;
8085		goto fail;
8086	}
8087
8088	/* depend on rateset, gmode */
8089	wlc->cmi = brcms_c_channel_mgr_attach(wlc);
8090	if (!wlc->cmi) {
8091		wiphy_err(wl->wiphy, "wl%d: %s: channel_mgr_attach failed"
8092			  "\n", unit, __func__);
8093		err = 33;
8094		goto fail;
8095	}
8096
8097	/* init default when all parameters are ready, i.e. ->rateset */
8098	brcms_c_bss_default_init(wlc);
8099
8100	/*
8101	 * Complete the wlc default state initializations..
8102	 */
8103
8104	wlc->bsscfg->wlc = wlc;
8105
8106	wlc->mimoft = FT_HT;
8107	wlc->mimo_40txbw = AUTO;
8108	wlc->ofdm_40txbw = AUTO;
8109	wlc->cck_40txbw = AUTO;
8110	brcms_c_update_mimo_band_bwcap(wlc, BRCMS_N_BW_20IN2G_40IN5G);
8111
8112	/* Set default values of SGI */
8113	if (BRCMS_SGI_CAP_PHY(wlc)) {
8114		brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8115					       BRCMS_N_SGI_40));
8116	} else if (BRCMS_ISSSLPNPHY(wlc->band)) {
8117		brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8118					       BRCMS_N_SGI_40));
8119	} else {
8120		brcms_c_ht_update_sgi_rx(wlc, 0);
8121	}
8122
8123	brcms_b_antsel_set(wlc->hw, wlc->asi->antsel_avail);
8124
8125	if (perr)
8126		*perr = 0;
8127
8128	return wlc;
8129
8130 fail:
8131	wiphy_err(wl->wiphy, "wl%d: %s: failed with err %d\n",
8132		  unit, __func__, err);
8133	if (wlc)
8134		brcms_c_detach(wlc);
8135
8136	if (perr)
8137		*perr = err;
8138	return NULL;
8139}
8140