drivers/net/wireless/brcm80211/brcmsmac/main.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/pci_ids.h>
  18 #include <linux/if_ether.h>
  19 #include <net/mac80211.h>
  20 #include <brcm_hw_ids.h>
  21 #include <aiutils.h>
  22 #include <chipcommon.h>
  23 #include "rate.h"
  24 #include "scb.h"
  25 #include "phy/phy_hal.h"
  26 #include "channel.h"
  27 #include "antsel.h"
  28 #include "stf.h"
  29 #include "ampdu.h"
  30 #include "mac80211_if.h"
  31 #include "ucode_loader.h"
  32 #include "main.h"
  33 #include "soc.h"
  34
  35 /*
  36  * Indication for txflowcontrol that all priority bits in
  37  * TXQ_STOP_FOR_PRIOFC_MASK are to be considered.
  38  */
  39 #define ALLPRIO                         -1
  40
  41 /* watchdog timer, in unit of ms */
  42 #define TIMER_INTERVAL_WATCHDOG         1000
  43 /* radio monitor timer, in unit of ms */
  44 #define TIMER_INTERVAL_RADIOCHK         800
  45
  46 /* beacon interval, in unit of 1024TU */
  47 #define BEACON_INTERVAL_DEFAULT         100
  48
  49 /* n-mode support capability */
  50 /* 2x2 includes both 1x1 & 2x2 devices
  51  * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
  52  * control it independently
  53  */
  54 #define WL_11N_2x2                      1
  55 #define WL_11N_3x3                      3
  56 #define WL_11N_4x4                      4
  57
  58 #define EDCF_ACI_MASK                   0x60
  59 #define EDCF_ACI_SHIFT                  5
  60 #define EDCF_ECWMIN_MASK                0x0f
  61 #define EDCF_ECWMAX_SHIFT               4
  62 #define EDCF_AIFSN_MASK                 0x0f
  63 #define EDCF_AIFSN_MAX                  15
  64 #define EDCF_ECWMAX_MASK                0xf0
  65
  66 #define EDCF_AC_BE_TXOP_STA             0x0000
  67 #define EDCF_AC_BK_TXOP_STA             0x0000
  68 #define EDCF_AC_VO_ACI_STA              0x62
  69 #define EDCF_AC_VO_ECW_STA              0x32
  70 #define EDCF_AC_VI_ACI_STA              0x42
  71 #define EDCF_AC_VI_ECW_STA              0x43
  72 #define EDCF_AC_BK_ECW_STA              0xA4
  73 #define EDCF_AC_VI_TXOP_STA             0x005e
  74 #define EDCF_AC_VO_TXOP_STA             0x002f
  75 #define EDCF_AC_BE_ACI_STA              0x03
  76 #define EDCF_AC_BE_ECW_STA              0xA4
  77 #define EDCF_AC_BK_ACI_STA              0x27
  78 #define EDCF_AC_VO_TXOP_AP              0x002f
  79
  80 #define EDCF_TXOP2USEC(txop)            ((txop) << 5)
  81 #define EDCF_ECW2CW(exp)                ((1 << (exp)) - 1)
  82
  83 #define APHY_SYMBOL_TIME                4
  84 #define APHY_PREAMBLE_TIME              16
  85 #define APHY_SIGNAL_TIME                4
  86 #define APHY_SIFS_TIME                  16
  87 #define APHY_SERVICE_NBITS              16
  88 #define APHY_TAIL_NBITS                 6
  89 #define BPHY_SIFS_TIME                  10
  90 #define BPHY_PLCP_SHORT_TIME            96
  91
  92 #define PREN_PREAMBLE                   24
  93 #define PREN_MM_EXT                     12
  94 #define PREN_PREAMBLE_EXT               4
  95
  96 #define DOT11_MAC_HDR_LEN               24
  97 #define DOT11_ACK_LEN                   10
  98 #define DOT11_BA_LEN                    4
  99 #define DOT11_OFDM_SIGNAL_EXTENSION     6
 100 #define DOT11_MIN_FRAG_LEN              256
 101 #define DOT11_RTS_LEN                   16
 102 #define DOT11_CTS_LEN                   10
 103 #define DOT11_BA_BITMAP_LEN             128
 104 #define DOT11_MIN_BEACON_PERIOD         1
 105 #define DOT11_MAX_BEACON_PERIOD         0xFFFF
 106 #define DOT11_MAXNUMFRAGS               16
 107 #define DOT11_MAX_FRAG_LEN              2346
 108
 109 #define BPHY_PLCP_TIME                  192
 110 #define RIFS_11N_TIME                   2
 111
 112 #define AC_BE                           0
 113 #define AC_BK                           1
 114 #define AC_VI                           2
 115 #define AC_VO                           3
 116
 117 /* length of the BCN template area */
 118 #define BCN_TMPL_LEN                    512
 119
 120 /* brcms_bss_info flag bit values */
 121 #define BRCMS_BSS_HT                    0x0020  /* BSS is HT (MIMO) capable */
 122
 123 /* chip rx buffer offset */
 124 #define BRCMS_HWRXOFF                   38
 125
 126 /* rfdisable delay timer 500 ms, runs of ALP clock */
 127 #define RFDISABLE_DEFAULT               10000000
 128
 129 #define BRCMS_TEMPSENSE_PERIOD          10      /* 10 second timeout */
 130
 131 /* precedences numbers for wlc queues. These are twice as may levels as
 132  * 802.1D priorities.
 133  * Odd numbers are used for HI priority traffic at same precedence levels
 134  * These constants are used ONLY by wlc_prio2prec_map.  Do not use them
 135  * elsewhere.
 136  */
 137 #define _BRCMS_PREC_NONE                0       /* None = - */
 138 #define _BRCMS_PREC_BK                  2       /* BK - Background */
 139 #define _BRCMS_PREC_BE                  4       /* BE - Best-effort */
 140 #define _BRCMS_PREC_EE                  6       /* EE - Excellent-effort */
 141 #define _BRCMS_PREC_CL                  8       /* CL - Controlled Load */
 142 #define _BRCMS_PREC_VI                  10      /* Vi - Video */
 143 #define _BRCMS_PREC_VO                  12      /* Vo - Voice */
 144 #define _BRCMS_PREC_NC                  14      /* NC - Network Control */
 145
 146 /* synthpu_dly times in us */
 147 #define SYNTHPU_DLY_APHY_US             3700
 148 #define SYNTHPU_DLY_BPHY_US             1050
 149 #define SYNTHPU_DLY_NPHY_US             2048
 150 #define SYNTHPU_DLY_LPPHY_US            300
 151
 152 #define ANTCNT                          10      /* vanilla M_MAX_ANTCNT val */
 153
 154 /* Per-AC retry limit register definitions; uses defs.h bitfield macros */
 155 #define EDCF_SHORT_S                    0
 156 #define EDCF_SFB_S                      4
 157 #define EDCF_LONG_S                     8
 158 #define EDCF_LFB_S                      12
 159 #define EDCF_SHORT_M                    BITFIELD_MASK(4)
 160 #define EDCF_SFB_M                      BITFIELD_MASK(4)
 161 #define EDCF_LONG_M                     BITFIELD_MASK(4)
 162 #define EDCF_LFB_M                      BITFIELD_MASK(4)
 163
 164 #define RETRY_SHORT_DEF                 7       /* Default Short retry Limit */
 165 #define RETRY_SHORT_MAX                 255     /* Maximum Short retry Limit */
 166 #define RETRY_LONG_DEF                  4       /* Default Long retry count */
 167 #define RETRY_SHORT_FB                  3       /* Short count for fb rate */
 168 #define RETRY_LONG_FB                   2       /* Long count for fb rate */
 169
 170 #define APHY_CWMIN                      15
 171 #define PHY_CWMAX                       1023
 172
 173 #define EDCF_AIFSN_MIN                  1
 174
 175 #define FRAGNUM_MASK                    0xF
 176
 177 #define APHY_SLOT_TIME                  9
 178 #define BPHY_SLOT_TIME                  20
 179
 180 #define WL_SPURAVOID_OFF                0
 181 #define WL_SPURAVOID_ON1                1
 182 #define WL_SPURAVOID_ON2                2
 183
 184 /* invalid core flags, use the saved coreflags */
 185 #define BRCMS_USE_COREFLAGS             0xffffffff
 186
 187 /* values for PLCPHdr_override */
 188 #define BRCMS_PLCP_AUTO                 -1
 189 #define BRCMS_PLCP_SHORT                0
 190 #define BRCMS_PLCP_LONG                 1
 191
 192 /* values for g_protection_override and n_protection_override */
 193 #define BRCMS_PROTECTION_AUTO           -1
 194 #define BRCMS_PROTECTION_OFF            0
 195 #define BRCMS_PROTECTION_ON             1
 196 #define BRCMS_PROTECTION_MMHDR_ONLY     2
 197 #define BRCMS_PROTECTION_CTS_ONLY       3
 198
 199 /* values for g_protection_control and n_protection_control */
 200 #define BRCMS_PROTECTION_CTL_OFF        0
 201 #define BRCMS_PROTECTION_CTL_LOCAL      1
 202 #define BRCMS_PROTECTION_CTL_OVERLAP    2
 203
 204 /* values for n_protection */
 205 #define BRCMS_N_PROTECTION_OFF          0
 206 #define BRCMS_N_PROTECTION_OPTIONAL     1
 207 #define BRCMS_N_PROTECTION_20IN40       2
 208 #define BRCMS_N_PROTECTION_MIXEDMODE    3
 209
 210 /* values for band specific 40MHz capabilities */
 211 #define BRCMS_N_BW_20ALL                0
 212 #define BRCMS_N_BW_40ALL                1
 213 #define BRCMS_N_BW_20IN2G_40IN5G        2
 214
 215 /* bitflags for SGI support (sgi_rx iovar) */
 216 #define BRCMS_N_SGI_20                  0x01
 217 #define BRCMS_N_SGI_40                  0x02
 218
 219 /* defines used by the nrate iovar */
 220 /* MSC in use,indicates b0-6 holds an mcs */
 221 #define NRATE_MCS_INUSE                 0x00000080
 222 /* rate/mcs value */
 223 #define NRATE_RATE_MASK                 0x0000007f
 224 /* stf mode mask: siso, cdd, stbc, sdm */
 225 #define NRATE_STF_MASK                  0x0000ff00
 226 /* stf mode shift */
 227 #define NRATE_STF_SHIFT                 8
 228 /* bit indicate to override mcs only */
 229 #define NRATE_OVERRIDE_MCS_ONLY         0x40000000
 230 #define NRATE_SGI_MASK                  0x00800000      /* sgi mode */
 231 #define NRATE_SGI_SHIFT                 23              /* sgi mode */
 232 #define NRATE_LDPC_CODING               0x00400000      /* adv coding in use */
 233 #define NRATE_LDPC_SHIFT                22              /* ldpc shift */
 234
 235 #define NRATE_STF_SISO                  0               /* stf mode SISO */
 236 #define NRATE_STF_CDD                   1               /* stf mode CDD */
 237 #define NRATE_STF_STBC                  2               /* stf mode STBC */
 238 #define NRATE_STF_SDM                   3               /* stf mode SDM */
 239
 240 #define MAX_DMA_SEGS                    4
 241
 242 /* Max # of entries in Tx FIFO based on 4kb page size */
 243 #define NTXD                            256
 244 /* Max # of entries in Rx FIFO based on 4kb page size */
 245 #define NRXD                            256
 246
 247 /* try to keep this # rbufs posted to the chip */
 248 #define NRXBUFPOST                      32
 249
 250 /* data msg txq hiwat mark */
 251 #define BRCMS_DATAHIWAT                 50
 252
 253 /* max # frames to process in brcms_c_recv() */
 254 #define RXBND                           8
 255 /* max # tx status to process in wlc_txstatus() */
 256 #define TXSBND                          8
 257
 258 /* brcmu_format_flags() bit description structure */
 259 struct brcms_c_bit_desc {
 260         u32 bit;
 261         const char *name;
 262 };
 263
 264 /*
 265  * The following table lists the buffer memory allocated to xmt fifos in HW.
 266  * the size is in units of 256bytes(one block), total size is HW dependent
 267  * ucode has default fifo partition, sw can overwrite if necessary
 268  *
 269  * This is documented in twiki under the topic UcodeTxFifo. Please ensure
 270  * the twiki is updated before making changes.
 271  */
 272
 273 /* Starting corerev for the fifo size table */
 274 #define XMTFIFOTBL_STARTREV     20
 275
 276 struct d11init {
 277         __le16 addr;
 278         __le16 size;
 279         __le32 value;
 280 };
 281
 282 struct edcf_acparam {
 283         u8 ACI;
 284         u8 ECW;
 285         u16 TXOP;
 286 } __packed;
 287
 288 const u8 prio2fifo[NUMPRIO] = {
 289         TX_AC_BE_FIFO,          /* 0    BE      AC_BE   Best Effort */
 290         TX_AC_BK_FIFO,          /* 1    BK      AC_BK   Background */
 291         TX_AC_BK_FIFO,          /* 2    --      AC_BK   Background */
 292         TX_AC_BE_FIFO,          /* 3    EE      AC_BE   Best Effort */
 293         TX_AC_VI_FIFO,          /* 4    CL      AC_VI   Video */
 294         TX_AC_VI_FIFO,          /* 5    VI      AC_VI   Video */
 295         TX_AC_VO_FIFO,          /* 6    VO      AC_VO   Voice */
 296         TX_AC_VO_FIFO           /* 7    NC      AC_VO   Voice */
 297 };
 298
 299 /* debug/trace */
 300 uint brcm_msg_level =
 301 #if defined(BCMDBG)
 302         LOG_ERROR_VAL;
 303 #else
 304         0;
 305 #endif                          /* BCMDBG */
 306
 307 /* TX FIFO number to WME/802.1E Access Category */
 308 static const u8 wme_fifo2ac[] = { AC_BK, AC_BE, AC_VI, AC_VO, AC_BE, AC_BE };
 309
 310 /* WME/802.1E Access Category to TX FIFO number */
 311 static const u8 wme_ac2fifo[] = { 1, 0, 2, 3 };
 312
 313 /* 802.1D Priority to precedence queue mapping */
 314 const u8 wlc_prio2prec_map[] = {
 315         _BRCMS_PREC_BE,         /* 0 BE - Best-effort */
 316         _BRCMS_PREC_BK,         /* 1 BK - Background */
 317         _BRCMS_PREC_NONE,               /* 2 None = - */
 318         _BRCMS_PREC_EE,         /* 3 EE - Excellent-effort */
 319         _BRCMS_PREC_CL,         /* 4 CL - Controlled Load */
 320         _BRCMS_PREC_VI,         /* 5 Vi - Video */
 321         _BRCMS_PREC_VO,         /* 6 Vo - Voice */
 322         _BRCMS_PREC_NC,         /* 7 NC - Network Control */
 323 };
 324
 325 static const u16 xmtfifo_sz[][NFIFO] = {
 326         /* corerev 20: 5120, 49152, 49152, 5376, 4352, 1280 */
 327         {20, 192, 192, 21, 17, 5},
 328         /* corerev 21: 2304, 14848, 5632, 3584, 3584, 1280 */
 329         {9, 58, 22, 14, 14, 5},
 330         /* corerev 22: 5120, 49152, 49152, 5376, 4352, 1280 */
 331         {20, 192, 192, 21, 17, 5},
 332         /* corerev 23: 5120, 49152, 49152, 5376, 4352, 1280 */
 333         {20, 192, 192, 21, 17, 5},
 334         /* corerev 24: 2304, 14848, 5632, 3584, 3584, 1280 */
 335         {9, 58, 22, 14, 14, 5},
 336 };
 337
 338 #ifdef BCMDBG
 339 static const char * const fifo_names[] = {
 340         "AC_BK", "AC_BE", "AC_VI", "AC_VO", "BCMC", "ATIM" };
 341 #else
 342 static const char fifo_names[6][0];
 343 #endif
 344
 345 #ifdef BCMDBG
 346 /* pointer to most recently allocated wl/wlc */
 347 static struct brcms_c_info *wlc_info_dbg = (struct brcms_c_info *) (NULL);
 348 #endif
 349
 350 /* Find basic rate for a given rate */
 351 static u8 brcms_basic_rate(struct brcms_c_info *wlc, u32 rspec)
 352 {
 353         if (is_mcs_rate(rspec))
 354                 return wlc->band->basic_rate[mcs_table[rspec & RSPEC_RATE_MASK]
 355                        .leg_ofdm];
 356         return wlc->band->basic_rate[rspec & RSPEC_RATE_MASK];
 357 }
 358
 359 static u16 frametype(u32 rspec, u8 mimoframe)
 360 {
 361         if (is_mcs_rate(rspec))
 362                 return mimoframe;
 363         return is_cck_rate(rspec) ? FT_CCK : FT_OFDM;
 364 }
 365
 366 /* currently the best mechanism for determining SIFS is the band in use */
 367 static u16 get_sifs(struct brcms_band *band)
 368 {
 369         return band->bandtype == BRCM_BAND_5G ? APHY_SIFS_TIME :
 370                                  BPHY_SIFS_TIME;
 371 }
 372
 373 /*
 374  * Detect Card removed.
 375  * Even checking an sbconfig register read will not false trigger when the core
 376  * is in reset it breaks CF address mechanism. Accessing gphy phyversion will
 377  * cause SB error if aphy is in reset on 4306B0-DB. Need a simple accessible
 378  * reg with fixed 0/1 pattern (some platforms return all 0).
 379  * If clocks are present, call the sb routine which will figure out if the
 380  * device is removed.
 381  */
 382 static bool brcms_deviceremoved(struct brcms_c_info *wlc)
 383 {
 384         if (!wlc->hw->clk)
 385                 return ai_deviceremoved(wlc->hw->sih);
 386         return (R_REG(&wlc->hw->regs->maccontrol) &
 387                 (MCTL_PSM_JMP_0 | MCTL_IHR_EN)) != MCTL_IHR_EN;
 388 }
 389
 390 /* sum the individual fifo tx pending packet counts */
 391 static s16 brcms_txpktpendtot(struct brcms_c_info *wlc)
 392 {
 393         return wlc->core->txpktpend[0] + wlc->core->txpktpend[1] +
 394                wlc->core->txpktpend[2] + wlc->core->txpktpend[3];
 395 }
 396
 397 static bool brcms_is_mband_unlocked(struct brcms_c_info *wlc)
 398 {
 399         return wlc->pub->_nbands > 1 && !wlc->bandlocked;
 400 }
 401
 402 static int brcms_chspec_bw(u16 chanspec)
 403 {
 404         if (CHSPEC_IS40(chanspec))
 405                 return BRCMS_40_MHZ;
 406         if (CHSPEC_IS20(chanspec))
 407                 return BRCMS_20_MHZ;
 408
 409         return BRCMS_10_MHZ;
 410 }
 411
 412 static void brcms_c_bsscfg_mfree(struct brcms_bss_cfg *cfg)
 413 {
 414         if (cfg == NULL)
 415                 return;
 416
 417         kfree(cfg->current_bss);
 418         kfree(cfg);
 419 }
 420
 421 static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
 422 {
 423         if (wlc == NULL)
 424                 return;
 425
 426         brcms_c_bsscfg_mfree(wlc->bsscfg);
 427         kfree(wlc->pub);
 428         kfree(wlc->modulecb);
 429         kfree(wlc->default_bss);
 430         kfree(wlc->protection);
 431         kfree(wlc->stf);
 432         kfree(wlc->bandstate[0]);
 433         kfree(wlc->corestate->macstat_snapshot);
 434         kfree(wlc->corestate);
 435         kfree(wlc->hw->bandstate[0]);
 436         kfree(wlc->hw);
 437
 438         /* free the wlc */
 439         kfree(wlc);
 440         wlc = NULL;
 441 }
 442
 443 static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
 444 {
 445         struct brcms_bss_cfg *cfg;
 446
 447         cfg = kzalloc(sizeof(struct brcms_bss_cfg), GFP_ATOMIC);
 448         if (cfg == NULL)
 449                 goto fail;
 450
 451         cfg->current_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
 452         if (cfg->current_bss == NULL)
 453                 goto fail;
 454
 455         return cfg;
 456
 457  fail:
 458         brcms_c_bsscfg_mfree(cfg);
 459         return NULL;
 460 }
 461
 462 static struct brcms_c_info *
 463 brcms_c_attach_malloc(uint unit, uint *err, uint devid)
 464 {
 465         struct brcms_c_info *wlc;
 466
 467         wlc = kzalloc(sizeof(struct brcms_c_info), GFP_ATOMIC);
 468         if (wlc == NULL) {
 469                 *err = 1002;
 470                 goto fail;
 471         }
 472
 473         /* allocate struct brcms_c_pub state structure */
 474         wlc->pub = kzalloc(sizeof(struct brcms_pub), GFP_ATOMIC);
 475         if (wlc->pub == NULL) {
 476                 *err = 1003;
 477                 goto fail;
 478         }
 479         wlc->pub->wlc = wlc;
 480
 481         /* allocate struct brcms_hardware state structure */
 482
 483         wlc->hw = kzalloc(sizeof(struct brcms_hardware), GFP_ATOMIC);
 484         if (wlc->hw == NULL) {
 485                 *err = 1005;
 486                 goto fail;
 487         }
 488         wlc->hw->wlc = wlc;
 489
 490         wlc->hw->bandstate[0] =
 491                 kzalloc(sizeof(struct brcms_hw_band) * MAXBANDS, GFP_ATOMIC);
 492         if (wlc->hw->bandstate[0] == NULL) {
 493                 *err = 1006;
 494                 goto fail;
 495         } else {
 496                 int i;
 497
 498                 for (i = 1; i < MAXBANDS; i++)
 499                         wlc->hw->bandstate[i] = (struct brcms_hw_band *)
 500                             ((unsigned long)wlc->hw->bandstate[0] +
 501                              (sizeof(struct brcms_hw_band) * i));
 502         }
 503
 504         wlc->modulecb =
 505                 kzalloc(sizeof(struct modulecb) * BRCMS_MAXMODULES, GFP_ATOMIC);
 506         if (wlc->modulecb == NULL) {
 507                 *err = 1009;
 508                 goto fail;
 509         }
 510
 511         wlc->default_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
 512         if (wlc->default_bss == NULL) {
 513                 *err = 1010;
 514                 goto fail;
 515         }
 516
 517         wlc->bsscfg = brcms_c_bsscfg_malloc(unit);
 518         if (wlc->bsscfg == NULL) {
 519                 *err = 1011;
 520                 goto fail;
 521         }
 522
 523         wlc->protection = kzalloc(sizeof(struct brcms_protection),
 524                                   GFP_ATOMIC);
 525         if (wlc->protection == NULL) {
 526                 *err = 1016;
 527                 goto fail;
 528         }
 529
 530         wlc->stf = kzalloc(sizeof(struct brcms_stf), GFP_ATOMIC);
 531         if (wlc->stf == NULL) {
 532                 *err = 1017;
 533                 goto fail;
 534         }
 535
 536         wlc->bandstate[0] =
 537                 kzalloc(sizeof(struct brcms_band)*MAXBANDS, GFP_ATOMIC);
 538         if (wlc->bandstate[0] == NULL) {
 539                 *err = 1025;
 540                 goto fail;
 541         } else {
 542                 int i;
 543
 544                 for (i = 1; i < MAXBANDS; i++)
 545                         wlc->bandstate[i] = (struct brcms_band *)
 546                                 ((unsigned long)wlc->bandstate[0]
 547                                 + (sizeof(struct brcms_band)*i));
 548         }
 549
 550         wlc->corestate = kzalloc(sizeof(struct brcms_core), GFP_ATOMIC);
 551         if (wlc->corestate == NULL) {
 552                 *err = 1026;
 553                 goto fail;
 554         }
 555
 556         wlc->corestate->macstat_snapshot =
 557                 kzalloc(sizeof(struct macstat), GFP_ATOMIC);
 558         if (wlc->corestate->macstat_snapshot == NULL) {
 559                 *err = 1027;
 560                 goto fail;
 561         }
 562
 563         return wlc;
 564
 565  fail:
 566         brcms_c_detach_mfree(wlc);
 567         return NULL;
 568 }
 569
 570 /*
 571  * Update the slot timing for standard 11b/g (20us slots)
 572  * or shortslot 11g (9us slots)
 573  * The PSM needs to be suspended for this call.
 574  */
 575 static void brcms_b_update_slot_timing(struct brcms_hardware *wlc_hw,
 576                                         bool shortslot)
 577 {
 578         struct d11regs __iomem *regs;
 579
 580         regs = wlc_hw->regs;
 581
 582         if (shortslot) {
 583                 /* 11g short slot: 11a timing */
 584                 W_REG(&regs->ifs_slot, 0x0207); /* APHY_SLOT_TIME */
 585                 brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, APHY_SLOT_TIME);
 586         } else {
 587                 /* 11g long slot: 11b timing */
 588                 W_REG(&regs->ifs_slot, 0x0212); /* BPHY_SLOT_TIME */
 589                 brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, BPHY_SLOT_TIME);
 590         }
 591 }
 592
 593 /*
 594  * calculate frame duration of a given rate and length, return
 595  * time in usec unit
 596  */
 597 static uint brcms_c_calc_frame_time(struct brcms_c_info *wlc, u32 ratespec,
 598                                     u8 preamble_type, uint mac_len)
 599 {
 600         uint nsyms, dur = 0, Ndps, kNdps;
 601         uint rate = rspec2rate(ratespec);
 602
 603         if (rate == 0) {
 604                 wiphy_err(wlc->wiphy, "wl%d: WAR: using rate of 1 mbps\n",
 605                           wlc->pub->unit);
 606                 rate = BRCM_RATE_1M;
 607         }
 608
 609         BCMMSG(wlc->wiphy, "wl%d: rspec 0x%x, preamble_type %d, len%d\n",
 610                  wlc->pub->unit, ratespec, preamble_type, mac_len);
 611
 612         if (is_mcs_rate(ratespec)) {
 613                 uint mcs = ratespec & RSPEC_RATE_MASK;
 614                 int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
 615
 616                 dur = PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
 617                 if (preamble_type == BRCMS_MM_PREAMBLE)
 618                         dur += PREN_MM_EXT;
 619                 /* 1000Ndbps = kbps * 4 */
 620                 kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
 621                                    rspec_issgi(ratespec)) * 4;
 622
 623                 if (rspec_stc(ratespec) == 0)
 624                         nsyms =
 625                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
 626                                   APHY_TAIL_NBITS) * 1000, kNdps);
 627                 else
 628                         /* STBC needs to have even number of symbols */
 629                         nsyms =
 630                             2 *
 631                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
 632                                   APHY_TAIL_NBITS) * 1000, 2 * kNdps);
 633
 634                 dur += APHY_SYMBOL_TIME * nsyms;
 635                 if (wlc->band->bandtype == BRCM_BAND_2G)
 636                         dur += DOT11_OFDM_SIGNAL_EXTENSION;
 637         } else if (is_ofdm_rate(rate)) {
 638                 dur = APHY_PREAMBLE_TIME;
 639                 dur += APHY_SIGNAL_TIME;
 640                 /* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
 641                 Ndps = rate * 2;
 642                 /* NSyms = CEILING((SERVICE + 8*NBytes + TAIL) / Ndbps) */
 643                 nsyms =
 644                     CEIL((APHY_SERVICE_NBITS + 8 * mac_len + APHY_TAIL_NBITS),
 645                          Ndps);
 646                 dur += APHY_SYMBOL_TIME * nsyms;
 647                 if (wlc->band->bandtype == BRCM_BAND_2G)
 648                         dur += DOT11_OFDM_SIGNAL_EXTENSION;
 649         } else {
 650                 /*
 651                  * calc # bits * 2 so factor of 2 in rate (1/2 mbps)
 652                  * will divide out
 653                  */
 654                 mac_len = mac_len * 8 * 2;
 655                 /* calc ceiling of bits/rate = microseconds of air time */
 656                 dur = (mac_len + rate - 1) / rate;
 657                 if (preamble_type & BRCMS_SHORT_PREAMBLE)
 658                         dur += BPHY_PLCP_SHORT_TIME;
 659                 else
 660                         dur += BPHY_PLCP_TIME;
 661         }
 662         return dur;
 663 }
 664
 665 static void brcms_c_write_inits(struct brcms_hardware *wlc_hw,
 666                                 const struct d11init *inits)
 667 {
 668         int i;
 669         u8 __iomem *base;
 670         u8 __iomem *addr;
 671         u16 size;
 672         u32 value;
 673
 674         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
 675
 676         base = (u8 __iomem *)wlc_hw->regs;
 677
 678         for (i = 0; inits[i].addr != cpu_to_le16(0xffff); i++) {
 679                 size = le16_to_cpu(inits[i].size);
 680                 addr = base + le16_to_cpu(inits[i].addr);
 681                 value = le32_to_cpu(inits[i].value);
 682                 if (size == 2)
 683                         W_REG((u16 __iomem *)addr, value);
 684                 else if (size == 4)
 685                         W_REG((u32 __iomem *)addr, value);
 686                 else
 687                         break;
 688         }
 689 }
 690
 691 static void brcms_c_write_mhf(struct brcms_hardware *wlc_hw, u16 *mhfs)
 692 {
 693         u8 idx;
 694         u16 addr[] = {
 695                 M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
 696                 M_HOST_FLAGS5
 697         };
 698
 699         for (idx = 0; idx < MHFMAX; idx++)
 700                 brcms_b_write_shm(wlc_hw, addr[idx], mhfs[idx]);
 701 }
 702
 703 static void brcms_c_ucode_bsinit(struct brcms_hardware *wlc_hw)
 704 {
 705         struct wiphy *wiphy = wlc_hw->wlc->wiphy;
 706         struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
 707
 708         /* init microcode host flags */
 709         brcms_c_write_mhf(wlc_hw, wlc_hw->band->mhfs);
 710
 711         /* do band-specific ucode IHR, SHM, and SCR inits */
 712         if (D11REV_IS(wlc_hw->corerev, 23)) {
 713                 if (BRCMS_ISNPHY(wlc_hw->band))
 714                         brcms_c_write_inits(wlc_hw, ucode->d11n0bsinitvals16);
 715                 else
 716                         wiphy_err(wiphy, "%s: wl%d: unsupported phy in corerev"
 717                                   " %d\n", __func__, wlc_hw->unit,
 718                                   wlc_hw->corerev);
 719         } else {
 720                 if (D11REV_IS(wlc_hw->corerev, 24)) {
 721                         if (BRCMS_ISLCNPHY(wlc_hw->band))
 722                                 brcms_c_write_inits(wlc_hw,
 723                                                     ucode->d11lcn0bsinitvals24);
 724                         else
 725                                 wiphy_err(wiphy, "%s: wl%d: unsupported phy in"
 726                                           " core rev %d\n", __func__,
 727                                           wlc_hw->unit, wlc_hw->corerev);
 728                 } else {
 729                         wiphy_err(wiphy, "%s: wl%d: unsupported corerev %d\n",
 730                                 __func__, wlc_hw->unit, wlc_hw->corerev);
 731                 }
 732         }
 733 }
 734
 735 static void brcms_b_core_phy_clk(struct brcms_hardware *wlc_hw, bool clk)
 736 {
 737         BCMMSG(wlc_hw->wlc->wiphy, "wl%d: clk %d\n", wlc_hw->unit, clk);
 738
 739         wlc_hw->phyclk = clk;
 740
 741         if (OFF == clk) {       /* clear gmode bit, put phy into reset */
 742
 743                 ai_core_cflags(wlc_hw->sih, (SICF_PRST | SICF_FGC | SICF_GMODE),
 744                                (SICF_PRST | SICF_FGC));
 745                 udelay(1);
 746                 ai_core_cflags(wlc_hw->sih, (SICF_PRST | SICF_FGC), SICF_PRST);
 747                 udelay(1);
 748
 749         } else {                /* take phy out of reset */
 750
 751                 ai_core_cflags(wlc_hw->sih, (SICF_PRST | SICF_FGC), SICF_FGC);
 752                 udelay(1);
 753                 ai_core_cflags(wlc_hw->sih, (SICF_FGC), 0);
 754                 udelay(1);
 755
 756         }
 757 }
 758
 759 /* low-level band switch utility routine */
 760 static void brcms_c_setxband(struct brcms_hardware *wlc_hw, uint bandunit)
 761 {
 762         BCMMSG(wlc_hw->wlc->wiphy, "wl%d: bandunit %d\n", wlc_hw->unit,
 763                 bandunit);
 764
 765         wlc_hw->band = wlc_hw->bandstate[bandunit];
 766
 767         /*
 768          * BMAC_NOTE:
 769          *   until we eliminate need for wlc->band refs in low level code
 770          */
 771         wlc_hw->wlc->band = wlc_hw->wlc->bandstate[bandunit];
 772
 773         /* set gmode core flag */
 774         if (wlc_hw->sbclk && !wlc_hw->noreset)
 775                 ai_core_cflags(wlc_hw->sih, SICF_GMODE,
 776                                ((bandunit == 0) ? SICF_GMODE : 0));
 777 }
 778
 779 /* switch to new band but leave it inactive */
 780 static u32 brcms_c_setband_inact(struct brcms_c_info *wlc, uint bandunit)
 781 {
 782         struct brcms_hardware *wlc_hw = wlc->hw;
 783         u32 macintmask;
 784
 785         BCMMSG(wlc->wiphy, "wl%d\n", wlc_hw->unit);
 786
 787         WARN_ON((R_REG(&wlc_hw->regs->maccontrol) & MCTL_EN_MAC) != 0);
 788
 789         /* disable interrupts */
 790         macintmask = brcms_intrsoff(wlc->wl);
 791
 792         /* radio off */
 793         wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
 794
 795         brcms_b_core_phy_clk(wlc_hw, OFF);
 796
 797         brcms_c_setxband(wlc_hw, bandunit);
 798
 799         return macintmask;
 800 }
 801
 802 /* process an individual struct tx_status */
 803 static bool
 804 brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
 805 {
 806         struct sk_buff *p;
 807         uint queue;
 808         struct d11txh *txh;
 809         struct scb *scb = NULL;
 810         bool free_pdu;
 811         int tx_rts, tx_frame_count, tx_rts_count;
 812         uint totlen, supr_status;
 813         bool lastframe;
 814         struct ieee80211_hdr *h;
 815         u16 mcl;
 816         struct ieee80211_tx_info *tx_info;
 817         struct ieee80211_tx_rate *txrate;
 818         int i;
 819
 820         /* discard intermediate indications for ucode with one legitimate case:
 821          *   e.g. if "useRTS" is set. ucode did a successful rts/cts exchange,
 822          *   but the subsequent tx of DATA failed. so it will start rts/cts
 823          *   from the beginning (resetting the rts transmission count)
 824          */
 825         if (!(txs->status & TX_STATUS_AMPDU)
 826             && (txs->status & TX_STATUS_INTERMEDIATE)) {
 827                 wiphy_err(wlc->wiphy, "%s: INTERMEDIATE but not AMPDU\n",
 828                           __func__);
 829                 return false;
 830         }
 831
 832         queue = txs->frameid & TXFID_QUEUE_MASK;
 833         if (queue >= NFIFO) {
 834                 p = NULL;
 835                 goto fatal;
 836         }
 837
 838         p = dma_getnexttxp(wlc->hw->di[queue], DMA_RANGE_TRANSMITTED);
 839         if (p == NULL)
 840                 goto fatal;
 841
 842         txh = (struct d11txh *) (p->data);
 843         mcl = le16_to_cpu(txh->MacTxControlLow);
 844
 845         if (txs->phyerr) {
 846                 if (brcm_msg_level & LOG_ERROR_VAL) {
 847                         wiphy_err(wlc->wiphy, "phyerr 0x%x, rate 0x%x\n",
 848                                   txs->phyerr, txh->MainRates);
 849                         brcms_c_print_txdesc(txh);
 850                 }
 851                 brcms_c_print_txstatus(txs);
 852         }
 853
 854         if (txs->frameid != le16_to_cpu(txh->TxFrameID))
 855                 goto fatal;
 856         tx_info = IEEE80211_SKB_CB(p);
 857         h = (struct ieee80211_hdr *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN);
 858
 859         if (tx_info->control.sta)
 860                 scb = &wlc->pri_scb;
 861
 862         if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
 863                 brcms_c_ampdu_dotxstatus(wlc->ampdu, scb, p, txs);
 864                 return false;
 865         }
 866
 867         supr_status = txs->status & TX_STATUS_SUPR_MASK;
 868         if (supr_status == TX_STATUS_SUPR_BADCH)
 869                 BCMMSG(wlc->wiphy,
 870                        "%s: Pkt tx suppressed, possibly channel %d\n",
 871                        __func__, CHSPEC_CHANNEL(wlc->default_bss->chanspec));
 872
 873         tx_rts = le16_to_cpu(txh->MacTxControlLow) & TXC_SENDRTS;
 874         tx_frame_count =
 875             (txs->status & TX_STATUS_FRM_RTX_MASK) >> TX_STATUS_FRM_RTX_SHIFT;
 876         tx_rts_count =
 877             (txs->status & TX_STATUS_RTS_RTX_MASK) >> TX_STATUS_RTS_RTX_SHIFT;
 878
 879         lastframe = !ieee80211_has_morefrags(h->frame_control);
 880
 881         if (!lastframe) {
 882                 wiphy_err(wlc->wiphy, "Not last frame!\n");
 883         } else {
 884                 /*
 885                  * Set information to be consumed by Minstrel ht.
 886                  *
 887                  * The "fallback limit" is the number of tx attempts a given
 888                  * MPDU is sent at the "primary" rate. Tx attempts beyond that
 889                  * limit are sent at the "secondary" rate.
 890                  * A 'short frame' does not exceed RTS treshold.
 891                  */
 892                 u16 sfbl,       /* Short Frame Rate Fallback Limit */
 893                     lfbl,       /* Long Frame Rate Fallback Limit */
 894                     fbl;
 895
 896                 if (queue < AC_COUNT) {
 897                         sfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
 898                                       EDCF_SFB);
 899                         lfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
 900                                       EDCF_LFB);
 901                 } else {
 902                         sfbl = wlc->SFBL;
 903                         lfbl = wlc->LFBL;
 904                 }
 905
 906                 txrate = tx_info->status.rates;
 907                 if (txrate[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
 908                         fbl = lfbl;
 909                 else
 910                         fbl = sfbl;
 911
 912                 ieee80211_tx_info_clear_status(tx_info);
 913
 914                 if ((tx_frame_count > fbl) && (txrate[1].idx >= 0)) {
 915                         /*
 916                          * rate selection requested a fallback rate
 917                          * and we used it
 918                          */
 919                         txrate[0].count = fbl;
 920                         txrate[1].count = tx_frame_count - fbl;
 921                 } else {
 922                         /*
 923                          * rate selection did not request fallback rate, or
 924                          * we didn't need it
 925                          */
 926                         txrate[0].count = tx_frame_count;
 927                         /*
 928                          * rc80211_minstrel.c:minstrel_tx_status() expects
 929                          * unused rates to be marked with idx = -1
 930                          */
 931                         txrate[1].idx = -1;
 932                         txrate[1].count = 0;
 933                 }
 934
 935                 /* clear the rest of the rates */
 936                 for (i = 2; i < IEEE80211_TX_MAX_RATES; i++) {
 937                         txrate[i].idx = -1;
 938                         txrate[i].count = 0;
 939                 }
 940
 941                 if (txs->status & TX_STATUS_ACK_RCV)
 942                         tx_info->flags |= IEEE80211_TX_STAT_ACK;
 943         }
 944
 945         totlen = brcmu_pkttotlen(p);
 946         free_pdu = true;
 947
 948         brcms_c_txfifo_complete(wlc, queue, 1);
 949
 950         if (lastframe) {
 951                 p->next = NULL;
 952                 p->prev = NULL;
 953                 /* remove PLCP & Broadcom tx descriptor header */
 954                 skb_pull(p, D11_PHY_HDR_LEN);
 955                 skb_pull(p, D11_TXH_LEN);
 956                 ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw, p);
 957         } else {
 958                 wiphy_err(wlc->wiphy, "%s: Not last frame => not calling "
 959                           "tx_status\n", __func__);
 960         }
 961
 962         return false;
 963
 964  fatal:
 965         if (p)
 966                 brcmu_pkt_buf_free_skb(p);
 967
 968         return true;
 969
 970 }
 971
 972 /* process tx completion events in BMAC
 973  * Return true if more tx status need to be processed. false otherwise.
 974  */
 975 static bool
 976 brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
 977 {
 978         bool morepending = false;
 979         struct brcms_c_info *wlc = wlc_hw->wlc;
 980         struct d11regs __iomem *regs;
 981         struct tx_status txstatus, *txs;
 982         u32 s1, s2;
 983         uint n = 0;
 984         /*
 985          * Param 'max_tx_num' indicates max. # tx status to process before
 986          * break out.
 987          */
 988         uint max_tx_num = bound ? TXSBND : -1;
 989
 990         BCMMSG(wlc->wiphy, "wl%d\n", wlc_hw->unit);
 991
 992         txs = &txstatus;
 993         regs = wlc_hw->regs;
 994         *fatal = false;
 995         while (!(*fatal)
 996                && (s1 = R_REG(&regs->frmtxstatus)) & TXS_V) {
 997
 998                 if (s1 == 0xffffffff) {
 999                         wiphy_err(wlc->wiphy, "wl%d: %s: dead chip\n",
1000                                 wlc_hw->unit, __func__);
1001                         return morepending;
1002                 }
1003
1004                 s2 = R_REG(&regs->frmtxstatus2);
1005
1006                 txs->status = s1 & TXS_STATUS_MASK;
1007                 txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
1008                 txs->sequence = s2 & TXS_SEQ_MASK;
1009                 txs->phyerr = (s2 & TXS_PTX_MASK) >> TXS_PTX_SHIFT;
1010                 txs->lasttxtime = 0;
1011
1012                 *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
1013
1014                 /* !give others some time to run! */
1015                 if (++n >= max_tx_num)
1016                         break;
1017         }
1018
1019         if (*fatal)
1020                 return 0;
1021
1022         if (n >= max_tx_num)
1023                 morepending = true;
1024
1025         if (!pktq_empty(&wlc->pkt_queue->q))
1026                 brcms_c_send_q(wlc);
1027
1028         return morepending;
1029 }
1030
1031 static void brcms_c_tbtt(struct brcms_c_info *wlc)
1032 {
1033         if (!wlc->bsscfg->BSS)
1034                 /*
1035                  * DirFrmQ is now valid...defer setting until end
1036                  * of ATIM window
1037                  */
1038                 wlc->qvalid |= MCMD_DIRFRMQVAL;
1039 }
1040
1041 /* set initial host flags value */
1042 static void
1043 brcms_c_mhfdef(struct brcms_c_info *wlc, u16 *mhfs, u16 mhf2_init)
1044 {
1045         struct brcms_hardware *wlc_hw = wlc->hw;
1046
1047         memset(mhfs, 0, MHFMAX * sizeof(u16));
1048
1049         mhfs[MHF2] |= mhf2_init;
1050
1051         /* prohibit use of slowclock on multifunction boards */
1052         if (wlc_hw->boardflags & BFL_NOPLLDOWN)
1053                 mhfs[MHF1] |= MHF1_FORCEFASTCLK;
1054
1055         if (BRCMS_ISNPHY(wlc_hw->band) && NREV_LT(wlc_hw->band->phyrev, 2)) {
1056                 mhfs[MHF2] |= MHF2_NPHY40MHZ_WAR;
1057                 mhfs[MHF1] |= MHF1_IQSWAP_WAR;
1058         }
1059 }
1060
1061 static struct dma64regs __iomem *
1062 dmareg(struct brcms_hardware *hw, uint direction, uint fifonum)
1063 {
1064         if (direction == DMA_TX)
1065                 return &(hw->regs->fifo64regs[fifonum].dmaxmt);
1066         return &(hw->regs->fifo64regs[fifonum].dmarcv);
1067 }
1068
1069 static bool brcms_b_attach_dmapio(struct brcms_c_info *wlc, uint j, bool wme)
1070 {
1071         uint i;
1072         char name[8];
1073         /*
1074          * ucode host flag 2 needed for pio mode, independent of band and fifo
1075          */
1076         u16 pio_mhf2 = 0;
1077         struct brcms_hardware *wlc_hw = wlc->hw;
1078         uint unit = wlc_hw->unit;
1079         struct wiphy *wiphy = wlc->wiphy;
1080
1081         /* name and offsets for dma_attach */
1082         snprintf(name, sizeof(name), "wl%d", unit);
1083
1084         if (wlc_hw->di[0] == NULL) {    /* Init FIFOs */
1085                 int dma_attach_err = 0;
1086
1087                 /*
1088                  * FIFO 0
1089                  * TX: TX_AC_BK_FIFO (TX AC Background data packets)
1090                  * RX: RX_FIFO (RX data packets)
1091                  */
1092                 wlc_hw->di[0] = dma_attach(name, wlc_hw->sih,
1093                                            (wme ? dmareg(wlc_hw, DMA_TX, 0) :
1094                                             NULL), dmareg(wlc_hw, DMA_RX, 0),
1095                                            (wme ? NTXD : 0), NRXD,
1096                                            RXBUFSZ, -1, NRXBUFPOST,
1097                                            BRCMS_HWRXOFF, &brcm_msg_level);
1098                 dma_attach_err |= (NULL == wlc_hw->di[0]);
1099
1100                 /*
1101                  * FIFO 1
1102                  * TX: TX_AC_BE_FIFO (TX AC Best-Effort data packets)
1103                  *   (legacy) TX_DATA_FIFO (TX data packets)
1104                  * RX: UNUSED
1105                  */
1106                 wlc_hw->di[1] = dma_attach(name, wlc_hw->sih,
1107                                            dmareg(wlc_hw, DMA_TX, 1), NULL,
1108                                            NTXD, 0, 0, -1, 0, 0,
1109                                            &brcm_msg_level);
1110                 dma_attach_err |= (NULL == wlc_hw->di[1]);
1111
1112                 /*
1113                  * FIFO 2
1114                  * TX: TX_AC_VI_FIFO (TX AC Video data packets)
1115                  * RX: UNUSED
1116                  */
1117                 wlc_hw->di[2] = dma_attach(name, wlc_hw->sih,
1118                                            dmareg(wlc_hw, DMA_TX, 2), NULL,
1119                                            NTXD, 0, 0, -1, 0, 0,
1120                                            &brcm_msg_level);
1121                 dma_attach_err |= (NULL == wlc_hw->di[2]);
1122                 /*
1123                  * FIFO 3
1124                  * TX: TX_AC_VO_FIFO (TX AC Voice data packets)
1125                  *   (legacy) TX_CTL_FIFO (TX control & mgmt packets)
1126                  */
1127                 wlc_hw->di[3] = dma_attach(name, wlc_hw->sih,
1128                                            dmareg(wlc_hw, DMA_TX, 3),
1129                                            NULL, NTXD, 0, 0, -1,
1130                                            0, 0, &brcm_msg_level);
1131                 dma_attach_err |= (NULL == wlc_hw->di[3]);
1132 /* Cleaner to leave this as if with AP defined */
1133
1134                 if (dma_attach_err) {
1135                         wiphy_err(wiphy, "wl%d: wlc_attach: dma_attach failed"
1136                                   "\n", unit);
1137                         return false;
1138                 }
1139
1140                 /* get pointer to dma engine tx flow control variable */
1141                 for (i = 0; i < NFIFO; i++)
1142                         if (wlc_hw->di[i])
1143                                 wlc_hw->txavail[i] =
1144                                     (uint *) dma_getvar(wlc_hw->di[i],
1145                                                         "&txavail");
1146         }
1147
1148         /* initial ucode host flags */
1149         brcms_c_mhfdef(wlc, wlc_hw->band->mhfs, pio_mhf2);
1150
1151         return true;
1152 }
1153
1154 static void brcms_b_detach_dmapio(struct brcms_hardware *wlc_hw)
1155 {
1156         uint j;
1157
1158         for (j = 0; j < NFIFO; j++) {
1159                 if (wlc_hw->di[j]) {
1160                         dma_detach(wlc_hw->di[j]);
1161                         wlc_hw->di[j] = NULL;
1162                 }
1163         }
1164 }
1165
1166 /*
1167  * Initialize brcms_c_info default values ...
1168  * may get overrides later in this function
1169  *  BMAC_NOTES, move low out and resolve the dangling ones
1170  */
1171 static void brcms_b_info_init(struct brcms_hardware *wlc_hw)
1172 {
1173         struct brcms_c_info *wlc = wlc_hw->wlc;
1174
1175         /* set default sw macintmask value */
1176         wlc->defmacintmask = DEF_MACINTMASK;
1177
1178         /* various 802.11g modes */
1179         wlc_hw->shortslot = false;
1180
1181         wlc_hw->SFBL = RETRY_SHORT_FB;
1182         wlc_hw->LFBL = RETRY_LONG_FB;
1183
1184         /* default mac retry limits */
1185         wlc_hw->SRL = RETRY_SHORT_DEF;
1186         wlc_hw->LRL = RETRY_LONG_DEF;
1187         wlc_hw->chanspec = ch20mhz_chspec(1);
1188 }
1189
1190 static void brcms_b_wait_for_wake(struct brcms_hardware *wlc_hw)
1191 {
1192         /* delay before first read of ucode state */
1193         udelay(40);
1194
1195         /* wait until ucode is no longer asleep */
1196         SPINWAIT((brcms_b_read_shm(wlc_hw, M_UCODE_DBGST) ==
1197                   DBGST_ASLEEP), wlc_hw->wlc->fastpwrup_dly);
1198 }
1199
1200 /* control chip clock to save power, enable dynamic clock or force fast clock */
1201 static void brcms_b_clkctl_clk(struct brcms_hardware *wlc_hw, uint mode)
1202 {
1203         if (wlc_hw->sih->cccaps & CC_CAP_PMU) {
1204                 /* new chips with PMU, CCS_FORCEHT will distribute the HT clock
1205                  * on backplane, but mac core will still run on ALP(not HT) when
1206                  * it enters powersave mode, which means the FCA bit may not be
1207                  * set. Should wakeup mac if driver wants it to run on HT.
1208                  */
1209
1210                 if (wlc_hw->clk) {
1211                         if (mode == CLK_FAST) {
1212                                 OR_REG(&wlc_hw->regs->clk_ctl_st,
1213                                        CCS_FORCEHT);
1214
1215                                 udelay(64);
1216
1217                                 SPINWAIT(((R_REG
1218                                            (&wlc_hw->regs->
1219                                             clk_ctl_st) & CCS_HTAVAIL) == 0),
1220                                          PMU_MAX_TRANSITION_DLY);
1221                                 WARN_ON(!(R_REG
1222                                           (&wlc_hw->regs->
1223                                            clk_ctl_st) & CCS_HTAVAIL));
1224                         } else {
1225                                 if ((wlc_hw->sih->pmurev == 0) &&
1226                                     (R_REG
1227                                      (&wlc_hw->regs->
1228                                       clk_ctl_st) & (CCS_FORCEHT | CCS_HTAREQ)))
1229                                         SPINWAIT(((R_REG
1230                                                    (&wlc_hw->regs->
1231                                                     clk_ctl_st) & CCS_HTAVAIL)
1232                                                   == 0),
1233                                                  PMU_MAX_TRANSITION_DLY);
1234                                 AND_REG(&wlc_hw->regs->clk_ctl_st,
1235                                         ~CCS_FORCEHT);
1236                         }
1237                 }
1238                 wlc_hw->forcefastclk = (mode == CLK_FAST);
1239         } else {
1240
1241                 /* old chips w/o PMU, force HT through cc,
1242                  * then use FCA to verify mac is running fast clock
1243                  */
1244
1245                 wlc_hw->forcefastclk = ai_clkctl_cc(wlc_hw->sih, mode);
1246
1247                 /* check fast clock is available (if core is not in reset) */
1248                 if (wlc_hw->forcefastclk && wlc_hw->clk)
1249                         WARN_ON(!(ai_core_sflags(wlc_hw->sih, 0, 0) &
1250                                   SISF_FCLKA));
1251
1252                 /*
1253                  * keep the ucode wake bit on if forcefastclk is on since we
1254                  * do not want ucode to put us back to slow clock when it dozes
1255                  * for PM mode. Code below matches the wake override bit with
1256                  * current forcefastclk state. Only setting bit in wake_override
1257                  * instead of waking ucode immediately since old code had this
1258                  * behavior. Older code set wlc->forcefastclk but only had the
1259                  * wake happen if the wakup_ucode work (protected by an up
1260                  * check) was executed just below.
1261                  */
1262                 if (wlc_hw->forcefastclk)
1263                         mboolset(wlc_hw->wake_override,
1264                                  BRCMS_WAKE_OVERRIDE_FORCEFAST);
1265                 else
1266                         mboolclr(wlc_hw->wake_override,
1267                                  BRCMS_WAKE_OVERRIDE_FORCEFAST);
1268         }
1269 }
1270
1271 /* set or clear ucode host flag bits
1272  * it has an optimization for no-change write
1273  * it only writes through shared memory when the core has clock;
1274  * pre-CLK changes should use wlc_write_mhf to get around the optimization
1275  *
1276  *
1277  * bands values are: BRCM_BAND_AUTO <--- Current band only
1278  *                   BRCM_BAND_5G   <--- 5G band only
1279  *                   BRCM_BAND_2G   <--- 2G band only
1280  *                   BRCM_BAND_ALL  <--- All bands
1281  */
1282 void
1283 brcms_b_mhf(struct brcms_hardware *wlc_hw, u8 idx, u16 mask, u16 val,
1284              int bands)
1285 {
1286         u16 save;
1287         u16 addr[MHFMAX] = {
1288                 M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
1289                 M_HOST_FLAGS5
1290         };
1291         struct brcms_hw_band *band;
1292
1293         if ((val & ~mask) || idx >= MHFMAX)
1294                 return; /* error condition */
1295
1296         switch (bands) {
1297                 /* Current band only or all bands,
1298                  * then set the band to current band
1299                  */
1300         case BRCM_BAND_AUTO:
1301         case BRCM_BAND_ALL:
1302                 band = wlc_hw->band;
1303                 break;
1304         case BRCM_BAND_5G:
1305                 band = wlc_hw->bandstate[BAND_5G_INDEX];
1306                 break;
1307         case BRCM_BAND_2G:
1308                 band = wlc_hw->bandstate[BAND_2G_INDEX];
1309                 break;
1310         default:
1311                 band = NULL;    /* error condition */
1312         }
1313
1314         if (band) {
1315                 save = band->mhfs[idx];
1316                 band->mhfs[idx] = (band->mhfs[idx] & ~mask) | val;
1317
1318                 /* optimization: only write through if changed, and
1319                  * changed band is the current band
1320                  */
1321                 if (wlc_hw->clk && (band->mhfs[idx] != save)
1322                     && (band == wlc_hw->band))
1323                         brcms_b_write_shm(wlc_hw, addr[idx],
1324                                            (u16) band->mhfs[idx]);
1325         }
1326
1327         if (bands == BRCM_BAND_ALL) {
1328                 wlc_hw->bandstate[0]->mhfs[idx] =
1329                     (wlc_hw->bandstate[0]->mhfs[idx] & ~mask) | val;
1330                 wlc_hw->bandstate[1]->mhfs[idx] =
1331                     (wlc_hw->bandstate[1]->mhfs[idx] & ~mask) | val;
1332         }
1333 }
1334
1335 /* set the maccontrol register to desired reset state and
1336  * initialize the sw cache of the register
1337  */
1338 static void brcms_c_mctrl_reset(struct brcms_hardware *wlc_hw)
1339 {
1340         /* IHR accesses are always enabled, PSM disabled, HPS off and WAKE on */
1341         wlc_hw->maccontrol = 0;
1342         wlc_hw->suspended_fifos = 0;
1343         wlc_hw->wake_override = 0;
1344         wlc_hw->mute_override = 0;
1345         brcms_b_mctrl(wlc_hw, ~0, MCTL_IHR_EN | MCTL_WAKE);
1346 }
1347
1348 /*
1349  * write the software state of maccontrol and
1350  * overrides to the maccontrol register
1351  */
1352 static void brcms_c_mctrl_write(struct brcms_hardware *wlc_hw)
1353 {
1354         u32 maccontrol = wlc_hw->maccontrol;
1355
1356         /* OR in the wake bit if overridden */
1357         if (wlc_hw->wake_override)
1358                 maccontrol |= MCTL_WAKE;
1359
1360         /* set AP and INFRA bits for mute if needed */
1361         if (wlc_hw->mute_override) {
1362                 maccontrol &= ~(MCTL_AP);
1363                 maccontrol |= MCTL_INFRA;
1364         }
1365
1366         W_REG(&wlc_hw->regs->maccontrol, maccontrol);
1367 }
1368
1369 /* set or clear maccontrol bits */
1370 void brcms_b_mctrl(struct brcms_hardware *wlc_hw, u32 mask, u32 val)
1371 {
1372         u32 maccontrol;
1373         u32 new_maccontrol;
1374
1375         if (val & ~mask)
1376                 return; /* error condition */
1377         maccontrol = wlc_hw->maccontrol;
1378         new_maccontrol = (maccontrol & ~mask) | val;
1379
1380         /* if the new maccontrol value is the same as the old, nothing to do */
1381         if (new_maccontrol == maccontrol)
1382                 return;
1383
1384         /* something changed, cache the new value */
1385         wlc_hw->maccontrol = new_maccontrol;
1386
1387         /* write the new values with overrides applied */
1388         brcms_c_mctrl_write(wlc_hw);
1389 }
1390
1391 void brcms_c_ucode_wake_override_set(struct brcms_hardware *wlc_hw,
1392                                  u32 override_bit)
1393 {
1394         if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE)) {
1395                 mboolset(wlc_hw->wake_override, override_bit);
1396                 return;
1397         }
1398
1399         mboolset(wlc_hw->wake_override, override_bit);
1400
1401         brcms_c_mctrl_write(wlc_hw);
1402         brcms_b_wait_for_wake(wlc_hw);
1403 }
1404
1405 void brcms_c_ucode_wake_override_clear(struct brcms_hardware *wlc_hw,
1406                                    u32 override_bit)
1407 {
1408         mboolclr(wlc_hw->wake_override, override_bit);
1409
1410         if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE))
1411                 return;
1412
1413         brcms_c_mctrl_write(wlc_hw);
1414 }
1415
1416 /* When driver needs ucode to stop beaconing, it has to make sure that
1417  * MCTL_AP is clear and MCTL_INFRA is set
1418  * Mode           MCTL_AP        MCTL_INFRA
1419  * AP                1              1
1420  * STA               0              1 <--- This will ensure no beacons
1421  * IBSS              0              0
1422  */
1423 static void brcms_c_ucode_mute_override_set(struct brcms_hardware *wlc_hw)
1424 {
1425         wlc_hw->mute_override = 1;
1426
1427         /* if maccontrol already has AP == 0 and INFRA == 1 without this
1428          * override, then there is no change to write
1429          */
1430         if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1431                 return;
1432
1433         brcms_c_mctrl_write(wlc_hw);
1434 }
1435
1436 /* Clear the override on AP and INFRA bits */
1437 static void brcms_c_ucode_mute_override_clear(struct brcms_hardware *wlc_hw)
1438 {
1439         if (wlc_hw->mute_override == 0)
1440                 return;
1441
1442         wlc_hw->mute_override = 0;
1443
1444         /* if maccontrol already has AP == 0 and INFRA == 1 without this
1445          * override, then there is no change to write
1446          */
1447         if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1448                 return;
1449
1450         brcms_c_mctrl_write(wlc_hw);
1451 }
1452
1453 /*
1454  * Write a MAC address to the given match reg offset in the RXE match engine.
1455  */
1456 static void
1457 brcms_b_set_addrmatch(struct brcms_hardware *wlc_hw, int match_reg_offset,
1458                        const u8 *addr)
1459 {
1460         struct d11regs __iomem *regs;
1461         u16 mac_l;
1462         u16 mac_m;
1463         u16 mac_h;
1464
1465         BCMMSG(wlc_hw->wlc->wiphy, "wl%d: brcms_b_set_addrmatch\n",
1466                  wlc_hw->unit);
1467
1468         regs = wlc_hw->regs;
1469         mac_l = addr[0] | (addr[1] << 8);
1470         mac_m = addr[2] | (addr[3] << 8);
1471         mac_h = addr[4] | (addr[5] << 8);
1472
1473         /* enter the MAC addr into the RXE match registers */
1474         W_REG(&regs->rcm_ctl, RCM_INC_DATA | match_reg_offset);
1475         W_REG(&regs->rcm_mat_data, mac_l);
1476         W_REG(&regs->rcm_mat_data, mac_m);
1477         W_REG(&regs->rcm_mat_data, mac_h);
1478
1479 }
1480
1481 void
1482 brcms_b_write_template_ram(struct brcms_hardware *wlc_hw, int offset, int len,
1483                             void *buf)
1484 {
1485         struct d11regs __iomem *regs;
1486         u32 word;
1487         __le32 word_le;
1488         __be32 word_be;
1489         bool be_bit;
1490         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
1491
1492         regs = wlc_hw->regs;
1493         W_REG(&regs->tplatewrptr, offset);
1494
1495         /* if MCTL_BIGEND bit set in mac control register,
1496          * the chip swaps data in fifo, as well as data in
1497          * template ram
1498          */
1499         be_bit = (R_REG(&regs->maccontrol) & MCTL_BIGEND) != 0;
1500
1501         while (len > 0) {
1502                 memcpy(&word, buf, sizeof(u32));
1503
1504                 if (be_bit) {
1505                         word_be = cpu_to_be32(word);
1506                         word = *(u32 *)&word_be;
1507                 } else {
1508                         word_le = cpu_to_le32(word);
1509                         word = *(u32 *)&word_le;
1510                 }
1511
1512                 W_REG(&regs->tplatewrdata, word);
1513
1514                 buf = (u8 *) buf + sizeof(u32);
1515                 len -= sizeof(u32);
1516         }
1517 }
1518
1519 static void brcms_b_set_cwmin(struct brcms_hardware *wlc_hw, u16 newmin)
1520 {
1521         wlc_hw->band->CWmin = newmin;
1522
1523         W_REG(&wlc_hw->regs->objaddr, OBJADDR_SCR_SEL | S_DOT11_CWMIN);
1524         (void)R_REG(&wlc_hw->regs->objaddr);
1525         W_REG(&wlc_hw->regs->objdata, newmin);
1526 }
1527
1528 static void brcms_b_set_cwmax(struct brcms_hardware *wlc_hw, u16 newmax)
1529 {
1530         wlc_hw->band->CWmax = newmax;
1531
1532         W_REG(&wlc_hw->regs->objaddr, OBJADDR_SCR_SEL | S_DOT11_CWMAX);
1533         (void)R_REG(&wlc_hw->regs->objaddr);
1534         W_REG(&wlc_hw->regs->objdata, newmax);
1535 }
1536
1537 void brcms_b_bw_set(struct brcms_hardware *wlc_hw, u16 bw)
1538 {
1539         bool fastclk;
1540
1541         /* request FAST clock if not on */
1542         fastclk = wlc_hw->forcefastclk;
1543         if (!fastclk)
1544                 brcms_b_clkctl_clk(wlc_hw, CLK_FAST);
1545
1546         wlc_phy_bw_state_set(wlc_hw->band->pi, bw);
1547
1548         brcms_b_phy_reset(wlc_hw);
1549         wlc_phy_init(wlc_hw->band->pi, wlc_phy_chanspec_get(wlc_hw->band->pi));
1550
1551         /* restore the clk */
1552         if (!fastclk)
1553                 brcms_b_clkctl_clk(wlc_hw, CLK_DYNAMIC);
1554 }
1555
1556 static void brcms_b_upd_synthpu(struct brcms_hardware *wlc_hw)
1557 {
1558         u16 v;
1559         struct brcms_c_info *wlc = wlc_hw->wlc;
1560         /* update SYNTHPU_DLY */
1561
1562         if (BRCMS_ISLCNPHY(wlc->band))
1563                 v = SYNTHPU_DLY_LPPHY_US;
1564         else if (BRCMS_ISNPHY(wlc->band) && (NREV_GE(wlc->band->phyrev, 3)))
1565                 v = SYNTHPU_DLY_NPHY_US;
1566         else
1567                 v = SYNTHPU_DLY_BPHY_US;
1568
1569         brcms_b_write_shm(wlc_hw, M_SYNTHPU_DLY, v);
1570 }
1571
1572 static void brcms_c_ucode_txant_set(struct brcms_hardware *wlc_hw)
1573 {
1574         u16 phyctl;
1575         u16 phytxant = wlc_hw->bmac_phytxant;
1576         u16 mask = PHY_TXC_ANT_MASK;
1577
1578         /* set the Probe Response frame phy control word */
1579         phyctl = brcms_b_read_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS);
1580         phyctl = (phyctl & ~mask) | phytxant;
1581         brcms_b_write_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS, phyctl);
1582
1583         /* set the Response (ACK/CTS) frame phy control word */
1584         phyctl = brcms_b_read_shm(wlc_hw, M_RSP_PCTLWD);
1585         phyctl = (phyctl & ~mask) | phytxant;
1586         brcms_b_write_shm(wlc_hw, M_RSP_PCTLWD, phyctl);
1587 }
1588
1589 static u16 brcms_b_ofdm_ratetable_offset(struct brcms_hardware *wlc_hw,
1590                                          u8 rate)
1591 {
1592         uint i;
1593         u8 plcp_rate = 0;
1594         struct plcp_signal_rate_lookup {
1595                 u8 rate;
1596                 u8 signal_rate;
1597         };
1598         /* OFDM RATE sub-field of PLCP SIGNAL field, per 802.11 sec 17.3.4.1 */
1599         const struct plcp_signal_rate_lookup rate_lookup[] = {
1600                 {BRCM_RATE_6M, 0xB},
1601                 {BRCM_RATE_9M, 0xF},
1602                 {BRCM_RATE_12M, 0xA},
1603                 {BRCM_RATE_18M, 0xE},
1604                 {BRCM_RATE_24M, 0x9},
1605                 {BRCM_RATE_36M, 0xD},
1606                 {BRCM_RATE_48M, 0x8},
1607                 {BRCM_RATE_54M, 0xC}
1608         };
1609
1610         for (i = 0; i < ARRAY_SIZE(rate_lookup); i++) {
1611                 if (rate == rate_lookup[i].rate) {
1612                         plcp_rate = rate_lookup[i].signal_rate;
1613                         break;
1614                 }
1615         }
1616
1617         /* Find the SHM pointer to the rate table entry by looking in the
1618          * Direct-map Table
1619          */
1620         return 2 * brcms_b_read_shm(wlc_hw, M_RT_DIRMAP_A + (plcp_rate * 2));
1621 }
1622
1623 static void brcms_upd_ofdm_pctl1_table(struct brcms_hardware *wlc_hw)
1624 {
1625         u8 rate;
1626         u8 rates[8] = {
1627                 BRCM_RATE_6M, BRCM_RATE_9M, BRCM_RATE_12M, BRCM_RATE_18M,
1628                 BRCM_RATE_24M, BRCM_RATE_36M, BRCM_RATE_48M, BRCM_RATE_54M
1629         };
1630         u16 entry_ptr;
1631         u16 pctl1;
1632         uint i;
1633
1634         if (!BRCMS_PHY_11N_CAP(wlc_hw->band))
1635                 return;
1636
1637         /* walk the phy rate table and update the entries */
1638         for (i = 0; i < ARRAY_SIZE(rates); i++) {
1639                 rate = rates[i];
1640
1641                 entry_ptr = brcms_b_ofdm_ratetable_offset(wlc_hw, rate);
1642
1643                 /* read the SHM Rate Table entry OFDM PCTL1 values */
1644                 pctl1 =
1645                     brcms_b_read_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS);
1646
1647                 /* modify the value */
1648                 pctl1 &= ~PHY_TXC1_MODE_MASK;
1649                 pctl1 |= (wlc_hw->hw_stf_ss_opmode << PHY_TXC1_MODE_SHIFT);
1650
1651                 /* Update the SHM Rate Table entry OFDM PCTL1 values */
1652                 brcms_b_write_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS,
1653                                    pctl1);
1654         }
1655 }
1656
1657 /* band-specific init */
1658 static void brcms_b_bsinit(struct brcms_c_info *wlc, u16 chanspec)
1659 {
1660         struct brcms_hardware *wlc_hw = wlc->hw;
1661
1662         BCMMSG(wlc->wiphy, "wl%d: bandunit %d\n", wlc_hw->unit,
1663                 wlc_hw->band->bandunit);
1664
1665         brcms_c_ucode_bsinit(wlc_hw);
1666
1667         wlc_phy_init(wlc_hw->band->pi, chanspec);
1668
1669         brcms_c_ucode_txant_set(wlc_hw);
1670
1671         /*
1672          * cwmin is band-specific, update hardware
1673          * with value for current band
1674          */
1675         brcms_b_set_cwmin(wlc_hw, wlc_hw->band->CWmin);
1676         brcms_b_set_cwmax(wlc_hw, wlc_hw->band->CWmax);
1677
1678         brcms_b_update_slot_timing(wlc_hw,
1679                                    wlc_hw->band->bandtype == BRCM_BAND_5G ?
1680                                    true : wlc_hw->shortslot);
1681
1682         /* write phytype and phyvers */
1683         brcms_b_write_shm(wlc_hw, M_PHYTYPE, (u16) wlc_hw->band->phytype);
1684         brcms_b_write_shm(wlc_hw, M_PHYVER, (u16) wlc_hw->band->phyrev);
1685
1686         /*
1687          * initialize the txphyctl1 rate table since
1688          * shmem is shared between bands
1689          */
1690         brcms_upd_ofdm_pctl1_table(wlc_hw);
1691
1692         brcms_b_upd_synthpu(wlc_hw);
1693 }
1694
1695 /* Perform a soft reset of the PHY PLL */
1696 void brcms_b_core_phypll_reset(struct brcms_hardware *wlc_hw)
1697 {
1698         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
1699
1700         ai_corereg(wlc_hw->sih, SI_CC_IDX,
1701                    offsetof(struct chipcregs, chipcontrol_addr), ~0, 0);
1702         udelay(1);
1703         ai_corereg(wlc_hw->sih, SI_CC_IDX,
1704                    offsetof(struct chipcregs, chipcontrol_data), 0x4, 0);
1705         udelay(1);
1706         ai_corereg(wlc_hw->sih, SI_CC_IDX,
1707                    offsetof(struct chipcregs, chipcontrol_data), 0x4, 4);
1708         udelay(1);
1709         ai_corereg(wlc_hw->sih, SI_CC_IDX,
1710                    offsetof(struct chipcregs, chipcontrol_data), 0x4, 0);
1711         udelay(1);
1712 }
1713
1714 /* light way to turn on phy clock without reset for NPHY only
1715  *  refer to brcms_b_core_phy_clk for full version
1716  */
1717 void brcms_b_phyclk_fgc(struct brcms_hardware *wlc_hw, bool clk)
1718 {
1719         /* support(necessary for NPHY and HYPHY) only */
1720         if (!BRCMS_ISNPHY(wlc_hw->band))
1721                 return;
1722
1723         if (ON == clk)
1724                 ai_core_cflags(wlc_hw->sih, SICF_FGC, SICF_FGC);
1725         else
1726                 ai_core_cflags(wlc_hw->sih, SICF_FGC, 0);
1727
1728 }
1729
1730 void brcms_b_macphyclk_set(struct brcms_hardware *wlc_hw, bool clk)
1731 {
1732         if (ON == clk)
1733                 ai_core_cflags(wlc_hw->sih, SICF_MPCLKE, SICF_MPCLKE);
1734         else
1735                 ai_core_cflags(wlc_hw->sih, SICF_MPCLKE, 0);
1736 }
1737
1738 void brcms_b_phy_reset(struct brcms_hardware *wlc_hw)
1739 {
1740         struct brcms_phy_pub *pih = wlc_hw->band->pi;
1741         u32 phy_bw_clkbits;
1742         bool phy_in_reset = false;
1743
1744         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
1745
1746         if (pih == NULL)
1747                 return;
1748
1749         phy_bw_clkbits = wlc_phy_clk_bwbits(wlc_hw->band->pi);
1750
1751         /* Specific reset sequence required for NPHY rev 3 and 4 */
1752         if (BRCMS_ISNPHY(wlc_hw->band) && NREV_GE(wlc_hw->band->phyrev, 3) &&
1753             NREV_LE(wlc_hw->band->phyrev, 4)) {
1754                 /* Set the PHY bandwidth */
1755                 ai_core_cflags(wlc_hw->sih, SICF_BWMASK, phy_bw_clkbits);
1756
1757                 udelay(1);
1758
1759                 /* Perform a soft reset of the PHY PLL */
1760                 brcms_b_core_phypll_reset(wlc_hw);
1761
1762                 /* reset the PHY */
1763                 ai_core_cflags(wlc_hw->sih, (SICF_PRST | SICF_PCLKE),
1764                                (SICF_PRST | SICF_PCLKE));
1765                 phy_in_reset = true;
1766         } else {
1767                 ai_core_cflags(wlc_hw->sih,
1768                                (SICF_PRST | SICF_PCLKE | SICF_BWMASK),
1769                                (SICF_PRST | SICF_PCLKE | phy_bw_clkbits));
1770         }
1771
1772         udelay(2);
1773         brcms_b_core_phy_clk(wlc_hw, ON);
1774
1775         if (pih)
1776                 wlc_phy_anacore(pih, ON);
1777 }
1778
1779 /* switch to and initialize new band */
1780 static void brcms_b_setband(struct brcms_hardware *wlc_hw, uint bandunit,
1781                             u16 chanspec) {
1782         struct brcms_c_info *wlc = wlc_hw->wlc;
1783         u32 macintmask;
1784
1785         /* Enable the d11 core before accessing it */
1786         if (!ai_iscoreup(wlc_hw->sih)) {
1787                 ai_core_reset(wlc_hw->sih, 0, 0);
1788                 brcms_c_mctrl_reset(wlc_hw);
1789         }
1790
1791         macintmask = brcms_c_setband_inact(wlc, bandunit);
1792
1793         if (!wlc_hw->up)
1794                 return;
1795
1796         brcms_b_core_phy_clk(wlc_hw, ON);
1797
1798         /* band-specific initializations */
1799         brcms_b_bsinit(wlc, chanspec);
1800
1801         /*
1802          * If there are any pending software interrupt bits,
1803          * then replace these with a harmless nonzero value
1804          * so brcms_c_dpc() will re-enable interrupts when done.
1805          */
1806         if (wlc->macintstatus)
1807                 wlc->macintstatus = MI_DMAINT;
1808
1809         /* restore macintmask */
1810         brcms_intrsrestore(wlc->wl, macintmask);
1811
1812         /* ucode should still be suspended.. */
1813         WARN_ON((R_REG(&wlc_hw->regs->maccontrol) & MCTL_EN_MAC) != 0);
1814 }
1815
1816 static bool brcms_c_isgoodchip(struct brcms_hardware *wlc_hw)
1817 {
1818
1819         /* reject unsupported corerev */
1820         if (!CONF_HAS(D11CONF, wlc_hw->corerev)) {
1821                 wiphy_err(wlc_hw->wlc->wiphy, "unsupported core rev %d\n",
1822                           wlc_hw->corerev);
1823                 return false;
1824         }
1825
1826         return true;
1827 }
1828
1829 /* Validate some board info parameters */
1830 static bool brcms_c_validboardtype(struct brcms_hardware *wlc_hw)
1831 {
1832         uint boardrev = wlc_hw->boardrev;
1833
1834         /* 4 bits each for board type, major, minor, and tiny version */
1835         uint brt = (boardrev & 0xf000) >> 12;
1836         uint b0 = (boardrev & 0xf00) >> 8;
1837         uint b1 = (boardrev & 0xf0) >> 4;
1838         uint b2 = boardrev & 0xf;
1839
1840         /* voards from other vendors are always considered valid */
1841         if (wlc_hw->sih->boardvendor != PCI_VENDOR_ID_BROADCOM)
1842                 return true;
1843
1844         /* do some boardrev sanity checks when boardvendor is Broadcom */
1845         if (boardrev == 0)
1846                 return false;
1847
1848         if (boardrev <= 0xff)
1849                 return true;
1850
1851         if ((brt > 2) || (brt == 0) || (b0 > 9) || (b0 == 0) || (b1 > 9)
1852                 || (b2 > 9))
1853                 return false;
1854
1855         return true;
1856 }
1857
1858 static char *brcms_c_get_macaddr(struct brcms_hardware *wlc_hw)
1859 {
1860         enum brcms_srom_id var_id = BRCMS_SROM_MACADDR;
1861         char *macaddr;
1862
1863         /* If macaddr exists, use it (Sromrev4, CIS, ...). */
1864         macaddr = getvar(wlc_hw->sih, var_id);
1865         if (macaddr != NULL)
1866                 return macaddr;
1867
1868         if (wlc_hw->_nbands > 1)
1869                 var_id = BRCMS_SROM_ET1MACADDR;
1870         else
1871                 var_id = BRCMS_SROM_IL0MACADDR;
1872
1873         macaddr = getvar(wlc_hw->sih, var_id);
1874         if (macaddr == NULL)
1875                 wiphy_err(wlc_hw->wlc->wiphy, "wl%d: wlc_get_macaddr: macaddr "
1876                           "getvar(%d) not found\n", wlc_hw->unit, var_id);
1877
1878         return macaddr;
1879 }
1880
1881 /* power both the pll and external oscillator on/off */
1882 static void brcms_b_xtal(struct brcms_hardware *wlc_hw, bool want)
1883 {
1884         BCMMSG(wlc_hw->wlc->wiphy, "wl%d: want %d\n", wlc_hw->unit, want);
1885
1886         /*
1887          * dont power down if plldown is false or
1888          * we must poll hw radio disable
1889          */
1890         if (!want && wlc_hw->pllreq)
1891                 return;
1892
1893         if (wlc_hw->sih)
1894                 ai_clkctl_xtal(wlc_hw->sih, XTAL | PLL, want);
1895
1896         wlc_hw->sbclk = want;
1897         if (!wlc_hw->sbclk) {
1898                 wlc_hw->clk = false;
1899                 if (wlc_hw->band && wlc_hw->band->pi)
1900                         wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
1901         }
1902 }
1903
1904 /*
1905  * Return true if radio is disabled, otherwise false.
1906  * hw radio disable signal is an external pin, users activate it asynchronously
1907  * this function could be called when driver is down and w/o clock
1908  * it operates on different registers depending on corerev and boardflag.
1909  */
1910 static bool brcms_b_radio_read_hwdisabled(struct brcms_hardware *wlc_hw)
1911 {
1912         bool v, clk, xtal;
1913         u32 resetbits = 0, flags = 0;
1914
1915         xtal = wlc_hw->sbclk;
1916         if (!xtal)
1917                 brcms_b_xtal(wlc_hw, ON);
1918
1919         /* may need to take core out of reset first */
1920         clk = wlc_hw->clk;
1921         if (!clk) {
1922                 /*
1923                  * mac no longer enables phyclk automatically when driver
1924                  * accesses phyreg throughput mac. This can be skipped since
1925                  * only mac reg is accessed below
1926                  */
1927                 flags |= SICF_PCLKE;
1928
1929                 /*
1930                  * AI chip doesn't restore bar0win2 on
1931                  * hibernation/resume, need sw fixup
1932                  */
1933                 if ((wlc_hw->sih->chip == BCM43224_CHIP_ID) ||
1934                     (wlc_hw->sih->chip == BCM43225_CHIP_ID))
1935                         wlc_hw->regs = (struct d11regs __iomem *)
1936                                         ai_setcore(wlc_hw->sih, D11_CORE_ID, 0);
1937                 ai_core_reset(wlc_hw->sih, flags, resetbits);
1938                 brcms_c_mctrl_reset(wlc_hw);
1939         }
1940
1941         v = ((R_REG(&wlc_hw->regs->phydebug) & PDBG_RFD) != 0);
1942
1943         /* put core back into reset */
1944         if (!clk)
1945                 ai_core_disable(wlc_hw->sih, 0);
1946
1947         if (!xtal)
1948                 brcms_b_xtal(wlc_hw, OFF);
1949
1950         return v;
1951 }
1952
1953 static bool wlc_dma_rxreset(struct brcms_hardware *wlc_hw, uint fifo)
1954 {
1955         struct dma_pub *di = wlc_hw->di[fifo];
1956         return dma_rxreset(di);
1957 }
1958
1959 /* d11 core reset
1960  *   ensure fask clock during reset
1961  *   reset dma
1962  *   reset d11(out of reset)
1963  *   reset phy(out of reset)
1964  *   clear software macintstatus for fresh new start
1965  * one testing hack wlc_hw->noreset will bypass the d11/phy reset
1966  */
1967 void brcms_b_corereset(struct brcms_hardware *wlc_hw, u32 flags)
1968 {
1969         struct d11regs __iomem *regs;
1970         uint i;
1971         bool fastclk;
1972         u32 resetbits = 0;
1973
1974         if (flags == BRCMS_USE_COREFLAGS)
1975                 flags = (wlc_hw->band->pi ? wlc_hw->band->core_flags : 0);
1976
1977         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
1978
1979         regs = wlc_hw->regs;
1980
1981         /* request FAST clock if not on  */
1982         fastclk = wlc_hw->forcefastclk;
1983         if (!fastclk)
1984                 brcms_b_clkctl_clk(wlc_hw, CLK_FAST);
1985
1986         /* reset the dma engines except first time thru */
1987         if (ai_iscoreup(wlc_hw->sih)) {
1988                 for (i = 0; i < NFIFO; i++)
1989                         if ((wlc_hw->di[i]) && (!dma_txreset(wlc_hw->di[i])))
1990                                 wiphy_err(wlc_hw->wlc->wiphy, "wl%d: %s: "
1991                                           "dma_txreset[%d]: cannot stop dma\n",
1992                                            wlc_hw->unit, __func__, i);
1993
1994                 if ((wlc_hw->di[RX_FIFO])
1995                     && (!wlc_dma_rxreset(wlc_hw, RX_FIFO)))
1996                         wiphy_err(wlc_hw->wlc->wiphy, "wl%d: %s: dma_rxreset"
1997                                   "[%d]: cannot stop dma\n",
1998                                   wlc_hw->unit, __func__, RX_FIFO);
1999         }
2000         /* if noreset, just stop the psm and return */
2001         if (wlc_hw->noreset) {
2002                 wlc_hw->wlc->macintstatus = 0;  /* skip wl_dpc after down */
2003                 brcms_b_mctrl(wlc_hw, MCTL_PSM_RUN | MCTL_EN_MAC, 0);
2004                 return;
2005         }
2006
2007         /*
2008          * mac no longer enables phyclk automatically when driver accesses
2009          * phyreg throughput mac, AND phy_reset is skipped at early stage when
2010          * band->pi is invalid. need to enable PHY CLK
2011          */
2012         flags |= SICF_PCLKE;
2013
2014         /*
2015          * reset the core
2016          * In chips with PMU, the fastclk request goes through d11 core
2017          * reg 0x1e0, which is cleared by the core_reset. have to re-request it.
2018          *
2019          * This adds some delay and we can optimize it by also requesting
2020          * fastclk through chipcommon during this period if necessary. But
2021          * that has to work coordinate with other driver like mips/arm since
2022          * they may touch chipcommon as well.
2023          */
2024         wlc_hw->clk = false;
2025         ai_core_reset(wlc_hw->sih, flags, resetbits);
2026         wlc_hw->clk = true;
2027         if (wlc_hw->band && wlc_hw->band->pi)
2028                 wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, true);
2029
2030         brcms_c_mctrl_reset(wlc_hw);
2031
2032         if (wlc_hw->sih->cccaps & CC_CAP_PMU)
2033                 brcms_b_clkctl_clk(wlc_hw, CLK_FAST);
2034
2035         brcms_b_phy_reset(wlc_hw);
2036
2037         /* turn on PHY_PLL */
2038         brcms_b_core_phypll_ctl(wlc_hw, true);
2039
2040         /* clear sw intstatus */
2041         wlc_hw->wlc->macintstatus = 0;
2042
2043         /* restore the clk setting */
2044         if (!fastclk)
2045                 brcms_b_clkctl_clk(wlc_hw, CLK_DYNAMIC);
2046 }
2047
2048 /* txfifo sizes needs to be modified(increased) since the newer cores
2049  * have more memory.
2050  */
2051 static void brcms_b_corerev_fifofixup(struct brcms_hardware *wlc_hw)
2052 {
2053         struct d11regs __iomem *regs = wlc_hw->regs;
2054         u16 fifo_nu;
2055         u16 txfifo_startblk = TXFIFO_START_BLK, txfifo_endblk;
2056         u16 txfifo_def, txfifo_def1;
2057         u16 txfifo_cmd;
2058
2059         /* tx fifos start at TXFIFO_START_BLK from the Base address */
2060         txfifo_startblk = TXFIFO_START_BLK;
2061
2062         /* sequence of operations:  reset fifo, set fifo size, reset fifo */
2063         for (fifo_nu = 0; fifo_nu < NFIFO; fifo_nu++) {
2064
2065                 txfifo_endblk = txfifo_startblk + wlc_hw->xmtfifo_sz[fifo_nu];
2066                 txfifo_def = (txfifo_startblk & 0xff) |
2067                     (((txfifo_endblk - 1) & 0xff) << TXFIFO_FIFOTOP_SHIFT);
2068                 txfifo_def1 = ((txfifo_startblk >> 8) & 0x1) |
2069                     ((((txfifo_endblk -
2070                         1) >> 8) & 0x1) << TXFIFO_FIFOTOP_SHIFT);
2071                 txfifo_cmd =
2072                     TXFIFOCMD_RESET_MASK | (fifo_nu << TXFIFOCMD_FIFOSEL_SHIFT);
2073
2074                 W_REG(&regs->xmtfifocmd, txfifo_cmd);
2075                 W_REG(&regs->xmtfifodef, txfifo_def);
2076                 W_REG(&regs->xmtfifodef1, txfifo_def1);
2077
2078                 W_REG(&regs->xmtfifocmd, txfifo_cmd);
2079
2080                 txfifo_startblk += wlc_hw->xmtfifo_sz[fifo_nu];
2081         }
2082         /*
2083          * need to propagate to shm location to be in sync since ucode/hw won't
2084          * do this
2085          */
2086         brcms_b_write_shm(wlc_hw, M_FIFOSIZE0,
2087                            wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]);
2088         brcms_b_write_shm(wlc_hw, M_FIFOSIZE1,
2089                            wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]);
2090         brcms_b_write_shm(wlc_hw, M_FIFOSIZE2,
2091                            ((wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO] << 8) | wlc_hw->
2092                             xmtfifo_sz[TX_AC_BK_FIFO]));
2093         brcms_b_write_shm(wlc_hw, M_FIFOSIZE3,
2094                            ((wlc_hw->xmtfifo_sz[TX_ATIM_FIFO] << 8) | wlc_hw->
2095                             xmtfifo_sz[TX_BCMC_FIFO]));
2096 }
2097
2098 /* This function is used for changing the tsf frac register
2099  * If spur avoidance mode is off, the mac freq will be 80/120/160Mhz
2100  * If spur avoidance mode is on1, the mac freq will be 82/123/164Mhz
2101  * If spur avoidance mode is on2, the mac freq will be 84/126/168Mhz
2102  * HTPHY Formula is 2^26/freq(MHz) e.g.
2103  * For spuron2 - 126MHz -> 2^26/126 = 532610.0
2104  *  - 532610 = 0x82082 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x2082
2105  * For spuron: 123MHz -> 2^26/123    = 545600.5
2106  *  - 545601 = 0x85341 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x5341
2107  * For spur off: 120MHz -> 2^26/120    = 559240.5
2108  *  - 559241 = 0x88889 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x8889
2109  */
2110
2111 void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode)
2112 {
2113         struct d11regs __iomem *regs = wlc_hw->regs;
2114
2115         if ((wlc_hw->sih->chip == BCM43224_CHIP_ID) ||
2116             (wlc_hw->sih->chip == BCM43225_CHIP_ID)) {
2117                 if (spurmode == WL_SPURAVOID_ON2) {     /* 126Mhz */
2118                         W_REG(&regs->tsf_clk_frac_l, 0x2082);
2119                         W_REG(&regs->tsf_clk_frac_h, 0x8);
2120                 } else if (spurmode == WL_SPURAVOID_ON1) {      /* 123Mhz */
2121                         W_REG(&regs->tsf_clk_frac_l, 0x5341);
2122                         W_REG(&regs->tsf_clk_frac_h, 0x8);
2123                 } else {        /* 120Mhz */
2124                         W_REG(&regs->tsf_clk_frac_l, 0x8889);
2125                         W_REG(&regs->tsf_clk_frac_h, 0x8);
2126                 }
2127         } else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2128                 if (spurmode == WL_SPURAVOID_ON1) {     /* 82Mhz */
2129                         W_REG(&regs->tsf_clk_frac_l, 0x7CE0);
2130                         W_REG(&regs->tsf_clk_frac_h, 0xC);
2131                 } else {        /* 80Mhz */
2132                         W_REG(&regs->tsf_clk_frac_l, 0xCCCD);
2133                         W_REG(&regs->tsf_clk_frac_h, 0xC);
2134                 }
2135         }
2136 }
2137
2138 /* Initialize GPIOs that are controlled by D11 core */
2139 static void brcms_c_gpio_init(struct brcms_c_info *wlc)
2140 {
2141         struct brcms_hardware *wlc_hw = wlc->hw;
2142         struct d11regs __iomem *regs;
2143         u32 gc, gm;
2144
2145         regs = wlc_hw->regs;
2146
2147         /* use GPIO select 0 to get all gpio signals from the gpio out reg */
2148         brcms_b_mctrl(wlc_hw, MCTL_GPOUT_SEL_MASK, 0);
2149
2150         /*
2151          * Common GPIO setup:
2152          *      G0 = LED 0 = WLAN Activity
2153          *      G1 = LED 1 = WLAN 2.4 GHz Radio State
2154          *      G2 = LED 2 = WLAN 5 GHz Radio State
2155          *      G4 = radio disable input (HI enabled, LO disabled)
2156          */
2157
2158         gc = gm = 0;
2159
2160         /* Allocate GPIOs for mimo antenna diversity feature */
2161         if (wlc_hw->antsel_type == ANTSEL_2x3) {
2162                 /* Enable antenna diversity, use 2x3 mode */
2163                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2164                              MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2165                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE,
2166                              MHF3_ANTSEL_MODE, BRCM_BAND_ALL);
2167
2168                 /* init superswitch control */
2169                 wlc_phy_antsel_init(wlc_hw->band->pi, false);
2170
2171         } else if (wlc_hw->antsel_type == ANTSEL_2x4) {
2172                 gm |= gc |= (BOARD_GPIO_12 | BOARD_GPIO_13);
2173                 /*
2174                  * The board itself is powered by these GPIOs
2175                  * (when not sending pattern) so set them high
2176                  */
2177                 OR_REG(&regs->psm_gpio_oe,
2178                        (BOARD_GPIO_12 | BOARD_GPIO_13));
2179                 OR_REG(&regs->psm_gpio_out,
2180                        (BOARD_GPIO_12 | BOARD_GPIO_13));
2181
2182                 /* Enable antenna diversity, use 2x4 mode */
2183                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2184                              MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2185                 brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE, 0,
2186                              BRCM_BAND_ALL);
2187
2188                 /* Configure the desired clock to be 4Mhz */
2189                 brcms_b_write_shm(wlc_hw, M_ANTSEL_CLKDIV,
2190                                    ANTSEL_CLKDIV_4MHZ);
2191         }
2192
2193         /*
2194          * gpio 9 controls the PA. ucode is responsible
2195          * for wiggling out and oe
2196          */
2197         if (wlc_hw->boardflags & BFL_PACTRL)
2198                 gm |= gc |= BOARD_GPIO_PACTRL;
2199
2200         /* apply to gpiocontrol register */
2201         ai_gpiocontrol(wlc_hw->sih, gm, gc, GPIO_DRV_PRIORITY);
2202 }
2203
2204 static void brcms_ucode_write(struct brcms_hardware *wlc_hw,
2205                               const __le32 ucode[], const size_t nbytes)
2206 {
2207         struct d11regs __iomem *regs = wlc_hw->regs;
2208         uint i;
2209         uint count;
2210
2211         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
2212
2213         count = (nbytes / sizeof(u32));
2214
2215         W_REG(&regs->objaddr, (OBJADDR_AUTO_INC | OBJADDR_UCM_SEL));
2216         (void)R_REG(&regs->objaddr);
2217         for (i = 0; i < count; i++)
2218                 W_REG(&regs->objdata, le32_to_cpu(ucode[i]));
2219
2220 }
2221
2222 static void brcms_ucode_download(struct brcms_hardware *wlc_hw)
2223 {
2224         struct brcms_c_info *wlc;
2225         struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
2226
2227         wlc = wlc_hw->wlc;
2228
2229         if (wlc_hw->ucode_loaded)
2230                 return;
2231
2232         if (D11REV_IS(wlc_hw->corerev, 23)) {
2233                 if (BRCMS_ISNPHY(wlc_hw->band)) {
2234                         brcms_ucode_write(wlc_hw, ucode->bcm43xx_16_mimo,
2235                                           ucode->bcm43xx_16_mimosz);
2236                         wlc_hw->ucode_loaded = true;
2237                 } else
2238                         wiphy_err(wlc->wiphy, "%s: wl%d: unsupported phy in "
2239                                   "corerev %d\n",
2240                                   __func__, wlc_hw->unit, wlc_hw->corerev);
2241         } else if (D11REV_IS(wlc_hw->corerev, 24)) {
2242                 if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2243                         brcms_ucode_write(wlc_hw, ucode->bcm43xx_24_lcn,
2244                                           ucode->bcm43xx_24_lcnsz);
2245                         wlc_hw->ucode_loaded = true;
2246                 } else {
2247                         wiphy_err(wlc->wiphy, "%s: wl%d: unsupported phy in "
2248                                   "corerev %d\n",
2249                                   __func__, wlc_hw->unit, wlc_hw->corerev);
2250                 }
2251         }
2252 }
2253
2254 void brcms_b_txant_set(struct brcms_hardware *wlc_hw, u16 phytxant)
2255 {
2256         /* update sw state */
2257         wlc_hw->bmac_phytxant = phytxant;
2258
2259         /* push to ucode if up */
2260         if (!wlc_hw->up)
2261                 return;
2262         brcms_c_ucode_txant_set(wlc_hw);
2263
2264 }
2265
2266 u16 brcms_b_get_txant(struct brcms_hardware *wlc_hw)
2267 {
2268         return (u16) wlc_hw->wlc->stf->txant;
2269 }
2270
2271 void brcms_b_antsel_type_set(struct brcms_hardware *wlc_hw, u8 antsel_type)
2272 {
2273         wlc_hw->antsel_type = antsel_type;
2274
2275         /* Update the antsel type for phy module to use */
2276         wlc_phy_antsel_type_set(wlc_hw->band->pi, antsel_type);
2277 }
2278
2279 static void brcms_b_fifoerrors(struct brcms_hardware *wlc_hw)
2280 {
2281         bool fatal = false;
2282         uint unit;
2283         uint intstatus, idx;
2284         struct d11regs __iomem *regs = wlc_hw->regs;
2285         struct wiphy *wiphy = wlc_hw->wlc->wiphy;
2286
2287         unit = wlc_hw->unit;
2288
2289         for (idx = 0; idx < NFIFO; idx++) {
2290                 /* read intstatus register and ignore any non-error bits */
2291                 intstatus =
2292                     R_REG(&regs->intctrlregs[idx].intstatus) & I_ERRORS;
2293                 if (!intstatus)
2294                         continue;
2295
2296                 BCMMSG(wlc_hw->wlc->wiphy, "wl%d: intstatus%d 0x%x\n",
2297                         unit, idx, intstatus);
2298
2299                 if (intstatus & I_RO) {
2300                         wiphy_err(wiphy, "wl%d: fifo %d: receive fifo "
2301                                   "overflow\n", unit, idx);
2302                         fatal = true;
2303                 }
2304
2305                 if (intstatus & I_PC) {
2306                         wiphy_err(wiphy, "wl%d: fifo %d: descriptor error\n",
2307                                  unit, idx);
2308                         fatal = true;
2309                 }
2310
2311                 if (intstatus & I_PD) {
2312                         wiphy_err(wiphy, "wl%d: fifo %d: data error\n", unit,
2313                                   idx);
2314                         fatal = true;
2315                 }
2316
2317                 if (intstatus & I_DE) {
2318                         wiphy_err(wiphy, "wl%d: fifo %d: descriptor protocol "
2319                                   "error\n", unit, idx);
2320                         fatal = true;
2321                 }
2322
2323                 if (intstatus & I_RU)
2324                         wiphy_err(wiphy, "wl%d: fifo %d: receive descriptor "
2325                                   "underflow\n", idx, unit);
2326
2327                 if (intstatus & I_XU) {
2328                         wiphy_err(wiphy, "wl%d: fifo %d: transmit fifo "
2329                                   "underflow\n", idx, unit);
2330                         fatal = true;
2331                 }
2332
2333                 if (fatal) {
2334                         brcms_fatal_error(wlc_hw->wlc->wl); /* big hammer */
2335                         break;
2336                 } else
2337                         W_REG(&regs->intctrlregs[idx].intstatus,
2338                               intstatus);
2339         }
2340 }
2341
2342 void brcms_c_intrson(struct brcms_c_info *wlc)
2343 {
2344         struct brcms_hardware *wlc_hw = wlc->hw;
2345         wlc->macintmask = wlc->defmacintmask;
2346         W_REG(&wlc_hw->regs->macintmask, wlc->macintmask);
2347 }
2348
2349 /*
2350  * callback for siutils.c, which has only wlc handler, no wl they both check
2351  * up, not only because there is no need to off/restore d11 interrupt but also
2352  * because per-port code may require sync with valid interrupt.
2353  */
2354 static u32 brcms_c_wlintrsoff(struct brcms_c_info *wlc)
2355 {
2356         if (!wlc->hw->up)
2357                 return 0;
2358
2359         return brcms_intrsoff(wlc->wl);
2360 }
2361
2362 static void brcms_c_wlintrsrestore(struct brcms_c_info *wlc, u32 macintmask)
2363 {
2364         if (!wlc->hw->up)
2365                 return;
2366
2367         brcms_intrsrestore(wlc->wl, macintmask);
2368 }
2369
2370 u32 brcms_c_intrsoff(struct brcms_c_info *wlc)
2371 {
2372         struct brcms_hardware *wlc_hw = wlc->hw;
2373         u32 macintmask;
2374
2375         if (!wlc_hw->clk)
2376                 return 0;
2377
2378         macintmask = wlc->macintmask;   /* isr can still happen */
2379
2380         W_REG(&wlc_hw->regs->macintmask, 0);
2381         (void)R_REG(&wlc_hw->regs->macintmask); /* sync readback */
2382         udelay(1);              /* ensure int line is no longer driven */
2383         wlc->macintmask = 0;
2384
2385         /* return previous macintmask; resolve race between us and our isr */
2386         return wlc->macintstatus ? 0 : macintmask;
2387 }
2388
2389 void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask)
2390 {
2391         struct brcms_hardware *wlc_hw = wlc->hw;
2392         if (!wlc_hw->clk)
2393                 return;
2394
2395         wlc->macintmask = macintmask;
2396         W_REG(&wlc_hw->regs->macintmask, wlc->macintmask);
2397 }
2398
2399 static void brcms_b_tx_fifo_suspend(struct brcms_hardware *wlc_hw,
2400                                     uint tx_fifo)
2401 {
2402         u8 fifo = 1 << tx_fifo;
2403
2404         /* Two clients of this code, 11h Quiet period and scanning. */
2405
2406         /* only suspend if not already suspended */
2407         if ((wlc_hw->suspended_fifos & fifo) == fifo)
2408                 return;
2409
2410         /* force the core awake only if not already */
2411         if (wlc_hw->suspended_fifos == 0)
2412                 brcms_c_ucode_wake_override_set(wlc_hw,
2413                                                 BRCMS_WAKE_OVERRIDE_TXFIFO);
2414
2415         wlc_hw->suspended_fifos |= fifo;
2416
2417         if (wlc_hw->di[tx_fifo]) {
2418                 /*
2419                  * Suspending AMPDU transmissions in the middle can cause
2420                  * underflow which may result in mismatch between ucode and
2421                  * driver so suspend the mac before suspending the FIFO
2422                  */
2423                 if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2424                         brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
2425
2426                 dma_txsuspend(wlc_hw->di[tx_fifo]);
2427
2428                 if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2429                         brcms_c_enable_mac(wlc_hw->wlc);
2430         }
2431 }
2432
2433 static void brcms_b_tx_fifo_resume(struct brcms_hardware *wlc_hw,
2434                                    uint tx_fifo)
2435 {
2436         /* BMAC_NOTE: BRCMS_TX_FIFO_ENAB is done in brcms_c_dpc() for DMA case
2437          * but need to be done here for PIO otherwise the watchdog will catch
2438          * the inconsistency and fire
2439          */
2440         /* Two clients of this code, 11h Quiet period and scanning. */
2441         if (wlc_hw->di[tx_fifo])
2442                 dma_txresume(wlc_hw->di[tx_fifo]);
2443
2444         /* allow core to sleep again */
2445         if (wlc_hw->suspended_fifos == 0)
2446                 return;
2447         else {
2448                 wlc_hw->suspended_fifos &= ~(1 << tx_fifo);
2449                 if (wlc_hw->suspended_fifos == 0)
2450                         brcms_c_ucode_wake_override_clear(wlc_hw,
2451                                                 BRCMS_WAKE_OVERRIDE_TXFIFO);
2452         }
2453 }
2454
2455 static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool on, u32 flags)
2456 {
2457         static const u8 null_ether_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
2458
2459         if (on) {
2460                 /* suspend tx fifos */
2461                 brcms_b_tx_fifo_suspend(wlc_hw, TX_DATA_FIFO);
2462                 brcms_b_tx_fifo_suspend(wlc_hw, TX_CTL_FIFO);
2463                 brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_BK_FIFO);
2464                 brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_VI_FIFO);
2465
2466                 /* zero the address match register so we do not send ACKs */
2467                 brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET,
2468                                        null_ether_addr);
2469         } else {
2470                 /* resume tx fifos */
2471                 brcms_b_tx_fifo_resume(wlc_hw, TX_DATA_FIFO);
2472                 brcms_b_tx_fifo_resume(wlc_hw, TX_CTL_FIFO);
2473                 brcms_b_tx_fifo_resume(wlc_hw, TX_AC_BK_FIFO);
2474                 brcms_b_tx_fifo_resume(wlc_hw, TX_AC_VI_FIFO);
2475
2476                 /* Restore address */
2477                 brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET,
2478                                        wlc_hw->etheraddr);
2479         }
2480
2481         wlc_phy_mute_upd(wlc_hw->band->pi, on, flags);
2482
2483         if (on)
2484                 brcms_c_ucode_mute_override_set(wlc_hw);
2485         else
2486                 brcms_c_ucode_mute_override_clear(wlc_hw);
2487 }
2488
2489 /*
2490  * Read and clear macintmask and macintstatus and intstatus registers.
2491  * This routine should be called with interrupts off
2492  * Return:
2493  *   -1 if brcms_deviceremoved(wlc) evaluates to true;
2494  *   0 if the interrupt is not for us, or we are in some special cases;
2495  *   device interrupt status bits otherwise.
2496  */
2497 static inline u32 wlc_intstatus(struct brcms_c_info *wlc, bool in_isr)
2498 {
2499         struct brcms_hardware *wlc_hw = wlc->hw;
2500         struct d11regs __iomem *regs = wlc_hw->regs;
2501         u32 macintstatus;
2502
2503         /* macintstatus includes a DMA interrupt summary bit */
2504         macintstatus = R_REG(&regs->macintstatus);
2505
2506         BCMMSG(wlc->wiphy, "wl%d: macintstatus: 0x%x\n", wlc_hw->unit,
2507                  macintstatus);
2508
2509         /* detect cardbus removed, in power down(suspend) and in reset */
2510         if (brcms_deviceremoved(wlc))
2511                 return -1;
2512
2513         /* brcms_deviceremoved() succeeds even when the core is still resetting,
2514          * handle that case here.
2515          */
2516         if (macintstatus == 0xffffffff)
2517                 return 0;
2518
2519         /* defer unsolicited interrupts */
2520         macintstatus &= (in_isr ? wlc->macintmask : wlc->defmacintmask);
2521
2522         /* if not for us */
2523         if (macintstatus == 0)
2524                 return 0;
2525
2526         /* interrupts are already turned off for CFE build
2527          * Caution: For CFE Turning off the interrupts again has some undesired
2528          * consequences
2529          */
2530         /* turn off the interrupts */
2531         W_REG(&regs->macintmask, 0);
2532         (void)R_REG(&regs->macintmask); /* sync readback */
2533         wlc->macintmask = 0;
2534
2535         /* clear device interrupts */
2536         W_REG(&regs->macintstatus, macintstatus);
2537
2538         /* MI_DMAINT is indication of non-zero intstatus */
2539         if (macintstatus & MI_DMAINT)
2540                 /*
2541                  * only fifo interrupt enabled is I_RI in
2542                  * RX_FIFO. If MI_DMAINT is set, assume it
2543                  * is set and clear the interrupt.
2544                  */
2545                 W_REG(&regs->intctrlregs[RX_FIFO].intstatus,
2546                       DEF_RXINTMASK);
2547
2548         return macintstatus;
2549 }
2550
2551 /* Update wlc->macintstatus and wlc->intstatus[]. */
2552 /* Return true if they are updated successfully. false otherwise */
2553 bool brcms_c_intrsupd(struct brcms_c_info *wlc)
2554 {
2555         u32 macintstatus;
2556
2557         /* read and clear macintstatus and intstatus registers */
2558         macintstatus = wlc_intstatus(wlc, false);
2559
2560         /* device is removed */
2561         if (macintstatus == 0xffffffff)
2562                 return false;
2563
2564         /* update interrupt status in software */
2565         wlc->macintstatus |= macintstatus;
2566
2567         return true;
2568 }
2569
2570 /*
2571  * First-level interrupt processing.
2572  * Return true if this was our interrupt, false otherwise.
2573  * *wantdpc will be set to true if further brcms_c_dpc() processing is required,
2574  * false otherwise.
2575  */
2576 bool brcms_c_isr(struct brcms_c_info *wlc, bool *wantdpc)
2577 {
2578         struct brcms_hardware *wlc_hw = wlc->hw;
2579         u32 macintstatus;
2580
2581         *wantdpc = false;
2582
2583         if (!wlc_hw->up || !wlc->macintmask)
2584                 return false;
2585
2586         /* read and clear macintstatus and intstatus registers */
2587         macintstatus = wlc_intstatus(wlc, true);
2588
2589         if (macintstatus == 0xffffffff)
2590                 wiphy_err(wlc->wiphy, "DEVICEREMOVED detected in the ISR code"
2591                           " path\n");
2592
2593         /* it is not for us */
2594         if (macintstatus == 0)
2595                 return false;
2596
2597         *wantdpc = true;
2598
2599         /* save interrupt status bits */
2600         wlc->macintstatus = macintstatus;
2601
2602         return true;
2603
2604 }
2605
2606 void brcms_c_suspend_mac_and_wait(struct brcms_c_info *wlc)
2607 {
2608         struct brcms_hardware *wlc_hw = wlc->hw;
2609         struct d11regs __iomem *regs = wlc_hw->regs;
2610         u32 mc, mi;
2611         struct wiphy *wiphy = wlc->wiphy;
2612
2613         BCMMSG(wlc->wiphy, "wl%d: bandunit %d\n", wlc_hw->unit,
2614                 wlc_hw->band->bandunit);
2615
2616         /*
2617          * Track overlapping suspend requests
2618          */
2619         wlc_hw->mac_suspend_depth++;
2620         if (wlc_hw->mac_suspend_depth > 1)
2621                 return;
2622
2623         /* force the core awake */
2624         brcms_c_ucode_wake_override_set(wlc_hw, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2625
2626         mc = R_REG(&regs->maccontrol);
2627
2628         if (mc == 0xffffffff) {
2629                 wiphy_err(wiphy, "wl%d: %s: dead chip\n", wlc_hw->unit,
2630                           __func__);
2631                 brcms_down(wlc->wl);
2632                 return;
2633         }
2634         WARN_ON(mc & MCTL_PSM_JMP_0);
2635         WARN_ON(!(mc & MCTL_PSM_RUN));
2636         WARN_ON(!(mc & MCTL_EN_MAC));
2637
2638         mi = R_REG(&regs->macintstatus);
2639         if (mi == 0xffffffff) {
2640                 wiphy_err(wiphy, "wl%d: %s: dead chip\n", wlc_hw->unit,
2641                           __func__);
2642                 brcms_down(wlc->wl);
2643                 return;
2644         }
2645         WARN_ON(mi & MI_MACSSPNDD);
2646
2647         brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, 0);
2648
2649         SPINWAIT(!(R_REG(&regs->macintstatus) & MI_MACSSPNDD),
2650                  BRCMS_MAX_MAC_SUSPEND);
2651
2652         if (!(R_REG(&regs->macintstatus) & MI_MACSSPNDD)) {
2653                 wiphy_err(wiphy, "wl%d: wlc_suspend_mac_and_wait: waited %d uS"
2654                           " and MI_MACSSPNDD is still not on.\n",
2655                           wlc_hw->unit, BRCMS_MAX_MAC_SUSPEND);
2656                 wiphy_err(wiphy, "wl%d: psmdebug 0x%08x, phydebug 0x%08x, "
2657                           "psm_brc 0x%04x\n", wlc_hw->unit,
2658                           R_REG(&regs->psmdebug),
2659                           R_REG(&regs->phydebug),
2660                           R_REG(&regs->psm_brc));
2661         }
2662
2663         mc = R_REG(&regs->maccontrol);
2664         if (mc == 0xffffffff) {
2665                 wiphy_err(wiphy, "wl%d: %s: dead chip\n", wlc_hw->unit,
2666                           __func__);
2667                 brcms_down(wlc->wl);
2668                 return;
2669         }
2670         WARN_ON(mc & MCTL_PSM_JMP_0);
2671         WARN_ON(!(mc & MCTL_PSM_RUN));
2672         WARN_ON(mc & MCTL_EN_MAC);
2673 }
2674
2675 void brcms_c_enable_mac(struct brcms_c_info *wlc)
2676 {
2677         struct brcms_hardware *wlc_hw = wlc->hw;
2678         struct d11regs __iomem *regs = wlc_hw->regs;
2679         u32 mc, mi;
2680
2681         BCMMSG(wlc->wiphy, "wl%d: bandunit %d\n", wlc_hw->unit,
2682                 wlc->band->bandunit);
2683
2684         /*
2685          * Track overlapping suspend requests
2686          */
2687         wlc_hw->mac_suspend_depth--;
2688         if (wlc_hw->mac_suspend_depth > 0)
2689                 return;
2690
2691         mc = R_REG(&regs->maccontrol);
2692         WARN_ON(mc & MCTL_PSM_JMP_0);
2693         WARN_ON(mc & MCTL_EN_MAC);
2694         WARN_ON(!(mc & MCTL_PSM_RUN));
2695
2696         brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, MCTL_EN_MAC);
2697         W_REG(&regs->macintstatus, MI_MACSSPNDD);
2698
2699         mc = R_REG(&regs->maccontrol);
2700         WARN_ON(mc & MCTL_PSM_JMP_0);
2701         WARN_ON(!(mc & MCTL_EN_MAC));
2702         WARN_ON(!(mc & MCTL_PSM_RUN));
2703
2704         mi = R_REG(&regs->macintstatus);
2705         WARN_ON(mi & MI_MACSSPNDD);
2706
2707         brcms_c_ucode_wake_override_clear(wlc_hw,
2708                                           BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2709 }
2710
2711 void brcms_b_band_stf_ss_set(struct brcms_hardware *wlc_hw, u8 stf_mode)
2712 {
2713         wlc_hw->hw_stf_ss_opmode = stf_mode;
2714
2715         if (wlc_hw->clk)
2716                 brcms_upd_ofdm_pctl1_table(wlc_hw);
2717 }
2718
2719 static bool brcms_b_validate_chip_access(struct brcms_hardware *wlc_hw)
2720 {
2721         struct d11regs __iomem *regs;
2722         u32 w, val;
2723         struct wiphy *wiphy = wlc_hw->wlc->wiphy;
2724
2725         BCMMSG(wiphy, "wl%d\n", wlc_hw->unit);
2726
2727         regs = wlc_hw->regs;
2728
2729         /* Validate dchip register access */
2730
2731         W_REG(&regs->objaddr, OBJADDR_SHM_SEL | 0);
2732         (void)R_REG(&regs->objaddr);
2733         w = R_REG(&regs->objdata);
2734
2735         /* Can we write and read back a 32bit register? */
2736         W_REG(&regs->objaddr, OBJADDR_SHM_SEL | 0);
2737         (void)R_REG(&regs->objaddr);
2738         W_REG(&regs->objdata, (u32) 0xaa5555aa);
2739
2740         W_REG(&regs->objaddr, OBJADDR_SHM_SEL | 0);
2741         (void)R_REG(&regs->objaddr);
2742         val = R_REG(&regs->objdata);
2743         if (val != (u32) 0xaa5555aa) {
2744                 wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2745                           "expected 0xaa5555aa\n", wlc_hw->unit, val);
2746                 return false;
2747         }
2748
2749         W_REG(&regs->objaddr, OBJADDR_SHM_SEL | 0);
2750         (void)R_REG(&regs->objaddr);
2751         W_REG(&regs->objdata, (u32) 0x55aaaa55);
2752
2753         W_REG(&regs->objaddr, OBJADDR_SHM_SEL | 0);
2754         (void)R_REG(&regs->objaddr);
2755         val = R_REG(&regs->objdata);
2756         if (val != (u32) 0x55aaaa55) {
2757                 wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2758                           "expected 0x55aaaa55\n", wlc_hw->unit, val);
2759                 return false;
2760         }
2761
2762         W_REG(&regs->objaddr, OBJADDR_SHM_SEL | 0);
2763         (void)R_REG(&regs->objaddr);
2764         W_REG(&regs->objdata, w);
2765
2766         /* clear CFPStart */
2767         W_REG(&regs->tsf_cfpstart, 0);
2768
2769         w = R_REG(&regs->maccontrol);
2770         if ((w != (MCTL_IHR_EN | MCTL_WAKE)) &&
2771             (w != (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE))) {
2772                 wiphy_err(wiphy, "wl%d: validate_chip_access: maccontrol = "
2773                           "0x%x, expected 0x%x or 0x%x\n", wlc_hw->unit, w,
2774                           (MCTL_IHR_EN | MCTL_WAKE),
2775                           (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE));
2776                 return false;
2777         }
2778
2779         return true;
2780 }
2781
2782 #define PHYPLL_WAIT_US  100000
2783
2784 void brcms_b_core_phypll_ctl(struct brcms_hardware *wlc_hw, bool on)
2785 {
2786         struct d11regs __iomem *regs;
2787         u32 tmp;
2788
2789         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
2790
2791         tmp = 0;
2792         regs = wlc_hw->regs;
2793
2794         if (on) {
2795                 if ((wlc_hw->sih->chip == BCM4313_CHIP_ID)) {
2796                         OR_REG(&regs->clk_ctl_st,
2797                                (CCS_ERSRC_REQ_HT | CCS_ERSRC_REQ_D11PLL |
2798                                 CCS_ERSRC_REQ_PHYPLL));
2799                         SPINWAIT((R_REG(&regs->clk_ctl_st) &
2800                                   (CCS_ERSRC_AVAIL_HT)) != (CCS_ERSRC_AVAIL_HT),
2801                                  PHYPLL_WAIT_US);
2802
2803                         tmp = R_REG(&regs->clk_ctl_st);
2804                         if ((tmp & (CCS_ERSRC_AVAIL_HT)) !=
2805                             (CCS_ERSRC_AVAIL_HT))
2806                                 wiphy_err(wlc_hw->wlc->wiphy, "%s: turn on PHY"
2807                                           " PLL failed\n", __func__);
2808                 } else {
2809                         OR_REG(&regs->clk_ctl_st,
2810                                (CCS_ERSRC_REQ_D11PLL | CCS_ERSRC_REQ_PHYPLL));
2811                         SPINWAIT((R_REG(&regs->clk_ctl_st) &
2812                                   (CCS_ERSRC_AVAIL_D11PLL |
2813                                    CCS_ERSRC_AVAIL_PHYPLL)) !=
2814                                  (CCS_ERSRC_AVAIL_D11PLL |
2815                                   CCS_ERSRC_AVAIL_PHYPLL), PHYPLL_WAIT_US);
2816
2817                         tmp = R_REG(&regs->clk_ctl_st);
2818                         if ((tmp &
2819                              (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2820                             !=
2821                             (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2822                                 wiphy_err(wlc_hw->wlc->wiphy, "%s: turn on "
2823                                           "PHY PLL failed\n", __func__);
2824                 }
2825         } else {
2826                 /*
2827                  * Since the PLL may be shared, other cores can still
2828                  * be requesting it; so we'll deassert the request but
2829                  * not wait for status to comply.
2830                  */
2831                 AND_REG(&regs->clk_ctl_st, ~CCS_ERSRC_REQ_PHYPLL);
2832                 tmp = R_REG(&regs->clk_ctl_st);
2833         }
2834 }
2835
2836 static void brcms_c_coredisable(struct brcms_hardware *wlc_hw)
2837 {
2838         bool dev_gone;
2839
2840         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
2841
2842         dev_gone = brcms_deviceremoved(wlc_hw->wlc);
2843
2844         if (dev_gone)
2845                 return;
2846
2847         if (wlc_hw->noreset)
2848                 return;
2849
2850         /* radio off */
2851         wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
2852
2853         /* turn off analog core */
2854         wlc_phy_anacore(wlc_hw->band->pi, OFF);
2855
2856         /* turn off PHYPLL to save power */
2857         brcms_b_core_phypll_ctl(wlc_hw, false);
2858
2859         wlc_hw->clk = false;
2860         ai_core_disable(wlc_hw->sih, 0);
2861         wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
2862 }
2863
2864 static void brcms_c_flushqueues(struct brcms_c_info *wlc)
2865 {
2866         struct brcms_hardware *wlc_hw = wlc->hw;
2867         uint i;
2868
2869         /* free any posted tx packets */
2870         for (i = 0; i < NFIFO; i++)
2871                 if (wlc_hw->di[i]) {
2872                         dma_txreclaim(wlc_hw->di[i], DMA_RANGE_ALL);
2873                         wlc->core->txpktpend[i] = 0;
2874                         BCMMSG(wlc->wiphy, "pktpend fifo %d clrd\n", i);
2875                 }
2876
2877         /* free any posted rx packets */
2878         dma_rxreclaim(wlc_hw->di[RX_FIFO]);
2879 }
2880
2881 static u16
2882 brcms_b_read_objmem(struct brcms_hardware *wlc_hw, uint offset, u32 sel)
2883 {
2884         struct d11regs __iomem *regs = wlc_hw->regs;
2885         u16 __iomem *objdata_lo = (u16 __iomem *)&regs->objdata;
2886         u16 __iomem *objdata_hi = objdata_lo + 1;
2887         u16 v;
2888
2889         W_REG(&regs->objaddr, sel | (offset >> 2));
2890         (void)R_REG(&regs->objaddr);
2891         if (offset & 2)
2892                 v = R_REG(objdata_hi);
2893         else
2894                 v = R_REG(objdata_lo);
2895
2896         return v;
2897 }
2898
2899 static void
2900 brcms_b_write_objmem(struct brcms_hardware *wlc_hw, uint offset, u16 v,
2901                      u32 sel)
2902 {
2903         struct d11regs __iomem *regs = wlc_hw->regs;
2904         u16 __iomem *objdata_lo = (u16 __iomem *)&regs->objdata;
2905         u16 __iomem *objdata_hi = objdata_lo + 1;
2906
2907         W_REG(&regs->objaddr, sel | (offset >> 2));
2908         (void)R_REG(&regs->objaddr);
2909         if (offset & 2)
2910                 W_REG(objdata_hi, v);
2911         else
2912                 W_REG(objdata_lo, v);
2913 }
2914
2915 /*
2916  * Read a single u16 from shared memory.
2917  * SHM 'offset' needs to be an even address
2918  */
2919 u16 brcms_b_read_shm(struct brcms_hardware *wlc_hw, uint offset)
2920 {
2921         return brcms_b_read_objmem(wlc_hw, offset, OBJADDR_SHM_SEL);
2922 }
2923
2924 /*
2925  * Write a single u16 to shared memory.
2926  * SHM 'offset' needs to be an even address
2927  */
2928 void brcms_b_write_shm(struct brcms_hardware *wlc_hw, uint offset, u16 v)
2929 {
2930         brcms_b_write_objmem(wlc_hw, offset, v, OBJADDR_SHM_SEL);
2931 }
2932
2933 /*
2934  * Copy a buffer to shared memory of specified type .
2935  * SHM 'offset' needs to be an even address and
2936  * Buffer length 'len' must be an even number of bytes
2937  * 'sel' selects the type of memory
2938  */
2939 void
2940 brcms_b_copyto_objmem(struct brcms_hardware *wlc_hw, uint offset,
2941                       const void *buf, int len, u32 sel)
2942 {
2943         u16 v;
2944         const u8 *p = (const u8 *)buf;
2945         int i;
2946
2947         if (len <= 0 || (offset & 1) || (len & 1))
2948                 return;
2949
2950         for (i = 0; i < len; i += 2) {
2951                 v = p[i] | (p[i + 1] << 8);
2952                 brcms_b_write_objmem(wlc_hw, offset + i, v, sel);
2953         }
2954 }
2955
2956 /*
2957  * Copy a piece of shared memory of specified type to a buffer .
2958  * SHM 'offset' needs to be an even address and
2959  * Buffer length 'len' must be an even number of bytes
2960  * 'sel' selects the type of memory
2961  */
2962 void
2963 brcms_b_copyfrom_objmem(struct brcms_hardware *wlc_hw, uint offset, void *buf,
2964                          int len, u32 sel)
2965 {
2966         u16 v;
2967         u8 *p = (u8 *) buf;
2968         int i;
2969
2970         if (len <= 0 || (offset & 1) || (len & 1))
2971                 return;
2972
2973         for (i = 0; i < len; i += 2) {
2974                 v = brcms_b_read_objmem(wlc_hw, offset + i, sel);
2975                 p[i] = v & 0xFF;
2976                 p[i + 1] = (v >> 8) & 0xFF;
2977         }
2978 }
2979
2980 /* Copy a buffer to shared memory.
2981  * SHM 'offset' needs to be an even address and
2982  * Buffer length 'len' must be an even number of bytes
2983  */
2984 static void brcms_c_copyto_shm(struct brcms_c_info *wlc, uint offset,
2985                         const void *buf, int len)
2986 {
2987         brcms_b_copyto_objmem(wlc->hw, offset, buf, len, OBJADDR_SHM_SEL);
2988 }
2989
2990 static void brcms_b_retrylimit_upd(struct brcms_hardware *wlc_hw,
2991                                    u16 SRL, u16 LRL)
2992 {
2993         wlc_hw->SRL = SRL;
2994         wlc_hw->LRL = LRL;
2995
2996         /* write retry limit to SCR, shouldn't need to suspend */
2997         if (wlc_hw->up) {
2998                 W_REG(&wlc_hw->regs->objaddr,
2999                       OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3000                 (void)R_REG(&wlc_hw->regs->objaddr);
3001                 W_REG(&wlc_hw->regs->objdata, wlc_hw->SRL);
3002                 W_REG(&wlc_hw->regs->objaddr,
3003                       OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3004                 (void)R_REG(&wlc_hw->regs->objaddr);
3005                 W_REG(&wlc_hw->regs->objdata, wlc_hw->LRL);
3006         }
3007 }
3008
3009 static void brcms_b_pllreq(struct brcms_hardware *wlc_hw, bool set, u32 req_bit)
3010 {
3011         if (set) {
3012                 if (mboolisset(wlc_hw->pllreq, req_bit))
3013                         return;
3014
3015                 mboolset(wlc_hw->pllreq, req_bit);
3016
3017                 if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3018                         if (!wlc_hw->sbclk)
3019                                 brcms_b_xtal(wlc_hw, ON);
3020                 }
3021         } else {
3022                 if (!mboolisset(wlc_hw->pllreq, req_bit))
3023                         return;
3024
3025                 mboolclr(wlc_hw->pllreq, req_bit);
3026
3027                 if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3028                         if (wlc_hw->sbclk)
3029                                 brcms_b_xtal(wlc_hw, OFF);
3030                 }
3031         }
3032 }
3033
3034 static void brcms_b_antsel_set(struct brcms_hardware *wlc_hw, u32 antsel_avail)
3035 {
3036         wlc_hw->antsel_avail = antsel_avail;
3037 }
3038
3039 /*
3040  * conditions under which the PM bit should be set in outgoing frames
3041  * and STAY_AWAKE is meaningful
3042  */
3043 static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
3044 {
3045         struct brcms_bss_cfg *cfg = wlc->bsscfg;
3046
3047         /* disallow PS when one of the following global conditions meets */
3048         if (!wlc->pub->associated)
3049                 return false;
3050
3051         /* disallow PS when one of these meets when not scanning */
3052         if (wlc->monitor)
3053                 return false;
3054
3055         if (cfg->associated) {
3056                 /*
3057                  * disallow PS when one of the following
3058                  * bsscfg specific conditions meets
3059                  */
3060                 if (!cfg->BSS)
3061                         return false;
3062
3063                 return false;
3064         }
3065
3066         return true;
3067 }
3068
3069 static void brcms_c_statsupd(struct brcms_c_info *wlc)
3070 {
3071         int i;
3072         struct macstat macstats;
3073 #ifdef BCMDBG
3074         u16 delta;
3075         u16 rxf0ovfl;
3076         u16 txfunfl[NFIFO];
3077 #endif                          /* BCMDBG */
3078
3079         /* if driver down, make no sense to update stats */
3080         if (!wlc->pub->up)
3081                 return;
3082
3083 #ifdef BCMDBG
3084         /* save last rx fifo 0 overflow count */
3085         rxf0ovfl = wlc->core->macstat_snapshot->rxf0ovfl;
3086
3087         /* save last tx fifo  underflow count */
3088         for (i = 0; i < NFIFO; i++)
3089                 txfunfl[i] = wlc->core->macstat_snapshot->txfunfl[i];
3090 #endif                          /* BCMDBG */
3091
3092         /* Read mac stats from contiguous shared memory */
3093         brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, &macstats,
3094                                 sizeof(struct macstat), OBJADDR_SHM_SEL);
3095
3096 #ifdef BCMDBG
3097         /* check for rx fifo 0 overflow */
3098         delta = (u16) (wlc->core->macstat_snapshot->rxf0ovfl - rxf0ovfl);
3099         if (delta)
3100                 wiphy_err(wlc->wiphy, "wl%d: %u rx fifo 0 overflows!\n",
3101                           wlc->pub->unit, delta);
3102
3103         /* check for tx fifo underflows */
3104         for (i = 0; i < NFIFO; i++) {
3105                 delta =
3106                     (u16) (wlc->core->macstat_snapshot->txfunfl[i] -
3107                               txfunfl[i]);
3108                 if (delta)
3109                         wiphy_err(wlc->wiphy, "wl%d: %u tx fifo %d underflows!"
3110                                   "\n", wlc->pub->unit, delta, i);
3111         }
3112 #endif                          /* BCMDBG */
3113
3114         /* merge counters from dma module */
3115         for (i = 0; i < NFIFO; i++) {
3116                 if (wlc->hw->di[i])
3117                         dma_counterreset(wlc->hw->di[i]);
3118         }
3119 }
3120
3121 static void brcms_b_reset(struct brcms_hardware *wlc_hw)
3122 {
3123         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
3124
3125         /* reset the core */
3126         if (!brcms_deviceremoved(wlc_hw->wlc))
3127                 brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
3128
3129         /* purge the dma rings */
3130         brcms_c_flushqueues(wlc_hw->wlc);
3131 }
3132
3133 void brcms_c_reset(struct brcms_c_info *wlc)
3134 {
3135         BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
3136
3137         /* slurp up hw mac counters before core reset */
3138         brcms_c_statsupd(wlc);
3139
3140         /* reset our snapshot of macstat counters */
3141         memset((char *)wlc->core->macstat_snapshot, 0,
3142                 sizeof(struct macstat));
3143
3144         brcms_b_reset(wlc->hw);
3145 }
3146
3147 /* Return the channel the driver should initialize during brcms_c_init.
3148  * the channel may have to be changed from the currently configured channel
3149  * if other configurations are in conflict (bandlocked, 11n mode disabled,
3150  * invalid channel for current country, etc.)
3151  */
3152 static u16 brcms_c_init_chanspec(struct brcms_c_info *wlc)
3153 {
3154         u16 chanspec =
3155             1 | WL_CHANSPEC_BW_20 | WL_CHANSPEC_CTL_SB_NONE |
3156             WL_CHANSPEC_BAND_2G;
3157
3158         return chanspec;
3159 }
3160
3161 void brcms_c_init_scb(struct scb *scb)
3162 {
3163         int i;
3164
3165         memset(scb, 0, sizeof(struct scb));
3166         scb->flags = SCB_WMECAP | SCB_HTCAP;
3167         for (i = 0; i < NUMPRIO; i++) {
3168                 scb->seqnum[i] = 0;
3169                 scb->seqctl[i] = 0xFFFF;
3170         }
3171
3172         scb->seqctl_nonqos = 0xFFFF;
3173         scb->magic = SCB_MAGIC;
3174 }
3175
3176 /* d11 core init
3177  *   reset PSM
3178  *   download ucode/PCM
3179  *   let ucode run to suspended
3180  *   download ucode inits
3181  *   config other core registers
3182  *   init dma
3183  */
3184 static void brcms_b_coreinit(struct brcms_c_info *wlc)
3185 {
3186         struct brcms_hardware *wlc_hw = wlc->hw;
3187         struct d11regs __iomem *regs;
3188         u32 sflags;
3189         uint bcnint_us;
3190         uint i = 0;
3191         bool fifosz_fixup = false;
3192         int err = 0;
3193         u16 buf[NFIFO];
3194         struct wiphy *wiphy = wlc->wiphy;
3195         struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
3196
3197         regs = wlc_hw->regs;
3198
3199         BCMMSG(wlc->wiphy, "wl%d\n", wlc_hw->unit);
3200
3201         /* reset PSM */
3202         brcms_b_mctrl(wlc_hw, ~0, (MCTL_IHR_EN | MCTL_PSM_JMP_0 | MCTL_WAKE));
3203
3204         brcms_ucode_download(wlc_hw);
3205         /*
3206          * FIFOSZ fixup. driver wants to controls the fifo allocation.
3207          */
3208         fifosz_fixup = true;
3209
3210         /* let the PSM run to the suspended state, set mode to BSS STA */
3211         W_REG(&regs->macintstatus, -1);
3212         brcms_b_mctrl(wlc_hw, ~0,
3213                        (MCTL_IHR_EN | MCTL_INFRA | MCTL_PSM_RUN | MCTL_WAKE));
3214
3215         /* wait for ucode to self-suspend after auto-init */
3216         SPINWAIT(((R_REG(&regs->macintstatus) & MI_MACSSPNDD) == 0),
3217                  1000 * 1000);
3218         if ((R_REG(&regs->macintstatus) & MI_MACSSPNDD) == 0)
3219                 wiphy_err(wiphy, "wl%d: wlc_coreinit: ucode did not self-"
3220                           "suspend!\n", wlc_hw->unit);
3221
3222         brcms_c_gpio_init(wlc);
3223
3224         sflags = ai_core_sflags(wlc_hw->sih, 0, 0);
3225
3226         if (D11REV_IS(wlc_hw->corerev, 23)) {
3227                 if (BRCMS_ISNPHY(wlc_hw->band))
3228                         brcms_c_write_inits(wlc_hw, ucode->d11n0initvals16);
3229                 else
3230                         wiphy_err(wiphy, "%s: wl%d: unsupported phy in corerev"
3231                                   " %d\n", __func__, wlc_hw->unit,
3232                                   wlc_hw->corerev);
3233         } else if (D11REV_IS(wlc_hw->corerev, 24)) {
3234                 if (BRCMS_ISLCNPHY(wlc_hw->band))
3235                         brcms_c_write_inits(wlc_hw, ucode->d11lcn0initvals24);
3236                 else
3237                         wiphy_err(wiphy, "%s: wl%d: unsupported phy in corerev"
3238                                   " %d\n", __func__, wlc_hw->unit,
3239                                   wlc_hw->corerev);
3240         } else {
3241                 wiphy_err(wiphy, "%s: wl%d: unsupported corerev %d\n",
3242                           __func__, wlc_hw->unit, wlc_hw->corerev);
3243         }
3244
3245         /* For old ucode, txfifo sizes needs to be modified(increased) */
3246         if (fifosz_fixup == true)
3247                 brcms_b_corerev_fifofixup(wlc_hw);
3248
3249         /* check txfifo allocations match between ucode and driver */
3250         buf[TX_AC_BE_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE0);
3251         if (buf[TX_AC_BE_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]) {
3252                 i = TX_AC_BE_FIFO;
3253                 err = -1;
3254         }
3255         buf[TX_AC_VI_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE1);
3256         if (buf[TX_AC_VI_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]) {
3257                 i = TX_AC_VI_FIFO;
3258                 err = -1;
3259         }
3260         buf[TX_AC_BK_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE2);
3261         buf[TX_AC_VO_FIFO] = (buf[TX_AC_BK_FIFO] >> 8) & 0xff;
3262         buf[TX_AC_BK_FIFO] &= 0xff;
3263         if (buf[TX_AC_BK_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BK_FIFO]) {
3264                 i = TX_AC_BK_FIFO;
3265                 err = -1;
3266         }
3267         if (buf[TX_AC_VO_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO]) {
3268                 i = TX_AC_VO_FIFO;
3269                 err = -1;
3270         }
3271         buf[TX_BCMC_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE3);
3272         buf[TX_ATIM_FIFO] = (buf[TX_BCMC_FIFO] >> 8) & 0xff;
3273         buf[TX_BCMC_FIFO] &= 0xff;
3274         if (buf[TX_BCMC_FIFO] != wlc_hw->xmtfifo_sz[TX_BCMC_FIFO]) {
3275                 i = TX_BCMC_FIFO;
3276                 err = -1;
3277         }
3278         if (buf[TX_ATIM_FIFO] != wlc_hw->xmtfifo_sz[TX_ATIM_FIFO]) {
3279                 i = TX_ATIM_FIFO;
3280                 err = -1;
3281         }
3282         if (err != 0)
3283                 wiphy_err(wiphy, "wlc_coreinit: txfifo mismatch: ucode size %d"
3284                           " driver size %d index %d\n", buf[i],
3285                           wlc_hw->xmtfifo_sz[i], i);
3286
3287         /* make sure we can still talk to the mac */
3288         WARN_ON(R_REG(&regs->maccontrol) == 0xffffffff);
3289
3290         /* band-specific inits done by wlc_bsinit() */
3291
3292         /* Set up frame burst size and antenna swap threshold init values */
3293         brcms_b_write_shm(wlc_hw, M_MBURST_SIZE, MAXTXFRAMEBURST);
3294         brcms_b_write_shm(wlc_hw, M_MAX_ANTCNT, ANTCNT);
3295
3296         /* enable one rx interrupt per received frame */
3297         W_REG(&regs->intrcvlazy[0], (1 << IRL_FC_SHIFT));
3298
3299         /* set the station mode (BSS STA) */
3300         brcms_b_mctrl(wlc_hw,
3301                        (MCTL_INFRA | MCTL_DISCARD_PMQ | MCTL_AP),
3302                        (MCTL_INFRA | MCTL_DISCARD_PMQ));
3303
3304         /* set up Beacon interval */
3305         bcnint_us = 0x8000 << 10;
3306         W_REG(&regs->tsf_cfprep, (bcnint_us << CFPREP_CBI_SHIFT));
3307         W_REG(&regs->tsf_cfpstart, bcnint_us);
3308         W_REG(&regs->macintstatus, MI_GP1);
3309
3310         /* write interrupt mask */
3311         W_REG(&regs->intctrlregs[RX_FIFO].intmask, DEF_RXINTMASK);
3312
3313         /* allow the MAC to control the PHY clock (dynamic on/off) */
3314         brcms_b_macphyclk_set(wlc_hw, ON);
3315
3316         /* program dynamic clock control fast powerup delay register */
3317         wlc->fastpwrup_dly = ai_clkctl_fast_pwrup_delay(wlc_hw->sih);
3318         W_REG(&regs->scc_fastpwrup_dly, wlc->fastpwrup_dly);
3319
3320         /* tell the ucode the corerev */
3321         brcms_b_write_shm(wlc_hw, M_MACHW_VER, (u16) wlc_hw->corerev);
3322
3323         /* tell the ucode MAC capabilities */
3324         brcms_b_write_shm(wlc_hw, M_MACHW_CAP_L,
3325                            (u16) (wlc_hw->machwcap & 0xffff));
3326         brcms_b_write_shm(wlc_hw, M_MACHW_CAP_H,
3327                            (u16) ((wlc_hw->
3328                                       machwcap >> 16) & 0xffff));
3329
3330         /* write retry limits to SCR, this done after PSM init */
3331         W_REG(&regs->objaddr, OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3332         (void)R_REG(&regs->objaddr);
3333         W_REG(&regs->objdata, wlc_hw->SRL);
3334         W_REG(&regs->objaddr, OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3335         (void)R_REG(&regs->objaddr);
3336         W_REG(&regs->objdata, wlc_hw->LRL);
3337
3338         /* write rate fallback retry limits */
3339         brcms_b_write_shm(wlc_hw, M_SFRMTXCNTFBRTHSD, wlc_hw->SFBL);
3340         brcms_b_write_shm(wlc_hw, M_LFRMTXCNTFBRTHSD, wlc_hw->LFBL);
3341
3342         AND_REG(&regs->ifs_ctl, 0x0FFF);
3343         W_REG(&regs->ifs_aifsn, EDCF_AIFSN_MIN);
3344
3345         /* init the tx dma engines */
3346         for (i = 0; i < NFIFO; i++) {
3347                 if (wlc_hw->di[i])
3348                         dma_txinit(wlc_hw->di[i]);
3349         }
3350
3351         /* init the rx dma engine(s) and post receive buffers */
3352         dma_rxinit(wlc_hw->di[RX_FIFO]);
3353         dma_rxfill(wlc_hw->di[RX_FIFO]);
3354 }
3355
3356 void
3357 static brcms_b_init(struct brcms_hardware *wlc_hw, u16 chanspec,
3358                           bool mute) {
3359         u32 macintmask;
3360         bool fastclk;
3361         struct brcms_c_info *wlc = wlc_hw->wlc;
3362
3363         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
3364
3365         /* request FAST clock if not on */
3366         fastclk = wlc_hw->forcefastclk;
3367         if (!fastclk)
3368                 brcms_b_clkctl_clk(wlc_hw, CLK_FAST);
3369
3370         /* disable interrupts */
3371         macintmask = brcms_intrsoff(wlc->wl);
3372
3373         /* set up the specified band and chanspec */
3374         brcms_c_setxband(wlc_hw, chspec_bandunit(chanspec));
3375         wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3376
3377         /* do one-time phy inits and calibration */
3378         wlc_phy_cal_init(wlc_hw->band->pi);
3379
3380         /* core-specific initialization */
3381         brcms_b_coreinit(wlc);
3382
3383         /* suspend the tx fifos and mute the phy for preism cac time */
3384         if (mute)
3385                 brcms_b_mute(wlc_hw, ON, PHY_MUTE_FOR_PREISM);
3386
3387         /* band-specific inits */
3388         brcms_b_bsinit(wlc, chanspec);
3389
3390         /* restore macintmask */
3391         brcms_intrsrestore(wlc->wl, macintmask);
3392
3393         /* seed wake_override with BRCMS_WAKE_OVERRIDE_MACSUSPEND since the mac
3394          * is suspended and brcms_c_enable_mac() will clear this override bit.
3395          */
3396         mboolset(wlc_hw->wake_override, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
3397
3398         /*
3399          * initialize mac_suspend_depth to 1 to match ucode
3400          * initial suspended state
3401          */
3402         wlc_hw->mac_suspend_depth = 1;
3403
3404         /* restore the clk */
3405         if (!fastclk)
3406                 brcms_b_clkctl_clk(wlc_hw, CLK_DYNAMIC);
3407 }
3408
3409 static void brcms_c_set_phy_chanspec(struct brcms_c_info *wlc,
3410                                      u16 chanspec)
3411 {
3412         /* Save our copy of the chanspec */
3413         wlc->chanspec = chanspec;
3414
3415         /* Set the chanspec and power limits for this locale */
3416         brcms_c_channel_set_chanspec(wlc->cmi, chanspec, BRCMS_TXPWR_MAX);
3417
3418         if (wlc->stf->ss_algosel_auto)
3419                 brcms_c_stf_ss_algo_channel_get(wlc, &wlc->stf->ss_algo_channel,
3420                                             chanspec);
3421
3422         brcms_c_stf_ss_update(wlc, wlc->band);
3423 }
3424
3425 static void
3426 brcms_default_rateset(struct brcms_c_info *wlc, struct brcms_c_rateset *rs)
3427 {
3428         brcms_c_rateset_default(rs, NULL, wlc->band->phytype,
3429                 wlc->band->bandtype, false, BRCMS_RATE_MASK_FULL,
3430                 (bool) (wlc->pub->_n_enab & SUPPORT_11N),
3431                 brcms_chspec_bw(wlc->default_bss->chanspec),
3432                 wlc->stf->txstreams);
3433 }
3434
3435 /* derive wlc->band->basic_rate[] table from 'rateset' */
3436 static void brcms_c_rate_lookup_init(struct brcms_c_info *wlc,
3437                               struct brcms_c_rateset *rateset)
3438 {
3439         u8 rate;
3440         u8 mandatory;
3441         u8 cck_basic = 0;
3442         u8 ofdm_basic = 0;
3443         u8 *br = wlc->band->basic_rate;
3444         uint i;
3445
3446         /* incoming rates are in 500kbps units as in 802.11 Supported Rates */
3447         memset(br, 0, BRCM_MAXRATE + 1);
3448
3449         /* For each basic rate in the rates list, make an entry in the
3450          * best basic lookup.
3451          */
3452         for (i = 0; i < rateset->count; i++) {
3453                 /* only make an entry for a basic rate */
3454                 if (!(rateset->rates[i] & BRCMS_RATE_FLAG))
3455                         continue;
3456
3457                 /* mask off basic bit */
3458                 rate = (rateset->rates[i] & BRCMS_RATE_MASK);
3459
3460                 if (rate > BRCM_MAXRATE) {
3461                         wiphy_err(wlc->wiphy, "brcms_c_rate_lookup_init: "
3462                                   "invalid rate 0x%X in rate set\n",
3463                                   rateset->rates[i]);
3464                         continue;
3465                 }
3466
3467                 br[rate] = rate;
3468         }
3469
3470         /* The rate lookup table now has non-zero entries for each
3471          * basic rate, equal to the basic rate: br[basicN] = basicN
3472          *
3473          * To look up the best basic rate corresponding to any
3474          * particular rate, code can use the basic_rate table
3475          * like this
3476          *
3477          * basic_rate = wlc->band->basic_rate[tx_rate]
3478          *
3479          * Make sure there is a best basic rate entry for
3480          * every rate by walking up the table from low rates
3481          * to high, filling in holes in the lookup table
3482          */
3483
3484         for (i = 0; i < wlc->band->hw_rateset.count; i++) {
3485                 rate = wlc->band->hw_rateset.rates[i];
3486
3487                 if (br[rate] != 0) {
3488                         /* This rate is a basic rate.
3489                          * Keep track of the best basic rate so far by
3490                          * modulation type.
3491                          */
3492                         if (is_ofdm_rate(rate))
3493                                 ofdm_basic = rate;
3494                         else
3495                                 cck_basic = rate;
3496
3497                         continue;
3498                 }
3499
3500                 /* This rate is not a basic rate so figure out the
3501                  * best basic rate less than this rate and fill in
3502                  * the hole in the table
3503                  */
3504
3505                 br[rate] = is_ofdm_rate(rate) ? ofdm_basic : cck_basic;
3506
3507                 if (br[rate] != 0)
3508                         continue;
3509
3510                 if (is_ofdm_rate(rate)) {
3511                         /*
3512                          * In 11g and 11a, the OFDM mandatory rates
3513                          * are 6, 12, and 24 Mbps
3514                          */
3515                         if (rate >= BRCM_RATE_24M)
3516                                 mandatory = BRCM_RATE_24M;
3517                         else if (rate >= BRCM_RATE_12M)
3518                                 mandatory = BRCM_RATE_12M;
3519                         else
3520                                 mandatory = BRCM_RATE_6M;
3521                 } else {
3522                         /* In 11b, all CCK rates are mandatory 1 - 11 Mbps */
3523                         mandatory = rate;
3524                 }
3525
3526                 br[rate] = mandatory;
3527         }
3528 }
3529
3530 static void brcms_c_bandinit_ordered(struct brcms_c_info *wlc,
3531                                      u16 chanspec)
3532 {
3533         struct brcms_c_rateset default_rateset;
3534         uint parkband;
3535         uint i, band_order[2];
3536
3537         BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
3538         /*
3539          * We might have been bandlocked during down and the chip
3540          * power-cycled (hibernate). Figure out the right band to park on
3541          */
3542         if (wlc->bandlocked || wlc->pub->_nbands == 1) {
3543                 /* updated in brcms_c_bandlock() */
3544                 parkband = wlc->band->bandunit;
3545                 band_order[0] = band_order[1] = parkband;
3546         } else {
3547                 /* park on the band of the specified chanspec */
3548                 parkband = chspec_bandunit(chanspec);
3549
3550                 /* order so that parkband initialize last */
3551                 band_order[0] = parkband ^ 1;
3552                 band_order[1] = parkband;
3553         }
3554
3555         /* make each band operational, software state init */
3556         for (i = 0; i < wlc->pub->_nbands; i++) {
3557                 uint j = band_order[i];
3558
3559                 wlc->band = wlc->bandstate[j];
3560
3561                 brcms_default_rateset(wlc, &default_rateset);
3562
3563                 /* fill in hw_rate */
3564                 brcms_c_rateset_filter(&default_rateset, &wlc->band->hw_rateset,
3565                                    false, BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
3566                                    (bool) (wlc->pub->_n_enab & SUPPORT_11N));
3567
3568                 /* init basic rate lookup */
3569                 brcms_c_rate_lookup_init(wlc, &default_rateset);
3570         }
3571
3572         /* sync up phy/radio chanspec */
3573         brcms_c_set_phy_chanspec(wlc, chanspec);
3574 }
3575
3576 static void brcms_c_mac_bcn_promisc(struct brcms_c_info *wlc)
3577 {
3578         if (wlc->bcnmisc_monitor)
3579                 brcms_b_mctrl(wlc->hw, MCTL_BCNS_PROMISC, MCTL_BCNS_PROMISC);
3580         else
3581                 brcms_b_mctrl(wlc->hw, MCTL_BCNS_PROMISC, 0);
3582 }
3583
3584 void brcms_c_mac_bcn_promisc_change(struct brcms_c_info *wlc, bool promisc)
3585 {
3586         wlc->bcnmisc_monitor = promisc;
3587         brcms_c_mac_bcn_promisc(wlc);
3588 }
3589
3590 /* set or clear maccontrol bits MCTL_PROMISC and MCTL_KEEPCONTROL */
3591 static void brcms_c_mac_promisc(struct brcms_c_info *wlc)
3592 {
3593         u32 promisc_bits = 0;
3594
3595         /*
3596          * promiscuous mode just sets MCTL_PROMISC
3597          * Note: APs get all BSS traffic without the need to set
3598          * the MCTL_PROMISC bit since all BSS data traffic is
3599          * directed at the AP
3600          */
3601         if (wlc->pub->promisc)
3602                 promisc_bits |= MCTL_PROMISC;
3603
3604         /* monitor mode needs both MCTL_PROMISC and MCTL_KEEPCONTROL
3605          * Note: monitor mode also needs MCTL_BCNS_PROMISC, but that is
3606          * handled in brcms_c_mac_bcn_promisc()
3607          */
3608         if (wlc->monitor)
3609                 promisc_bits |= MCTL_PROMISC | MCTL_KEEPCONTROL;
3610
3611         brcms_b_mctrl(wlc->hw, MCTL_PROMISC | MCTL_KEEPCONTROL, promisc_bits);
3612 }
3613
3614 /*
3615  * ucode, hwmac update
3616  *    Channel dependent updates for ucode and hw
3617  */
3618 static void brcms_c_ucode_mac_upd(struct brcms_c_info *wlc)
3619 {
3620         /* enable or disable any active IBSSs depending on whether or not
3621          * we are on the home channel
3622          */
3623         if (wlc->home_chanspec == wlc_phy_chanspec_get(wlc->band->pi)) {
3624                 if (wlc->pub->associated) {
3625                         /*
3626                          * BMAC_NOTE: This is something that should be fixed
3627                          * in ucode inits. I think that the ucode inits set
3628                          * up the bcn templates and shm values with a bogus
3629                          * beacon. This should not be done in the inits. If
3630                          * ucode needs to set up a beacon for testing, the
3631                          * test routines should write it down, not expect the
3632                          * inits to populate a bogus beacon.
3633                          */
3634                         if (BRCMS_PHY_11N_CAP(wlc->band))
3635                                 brcms_b_write_shm(wlc->hw,
3636                                                 M_BCN_TXTSF_OFFSET, 0);
3637                 }
3638         } else {
3639                 /* disable an active IBSS if we are not on the home channel */
3640         }
3641
3642         /* update the various promisc bits */
3643         brcms_c_mac_bcn_promisc(wlc);
3644         brcms_c_mac_promisc(wlc);
3645 }
3646
3647 static void brcms_c_write_rate_shm(struct brcms_c_info *wlc, u8 rate,
3648                                    u8 basic_rate)
3649 {
3650         u8 phy_rate, index;
3651         u8 basic_phy_rate, basic_index;
3652         u16 dir_table, basic_table;
3653         u16 basic_ptr;
3654
3655         /* Shared memory address for the table we are reading */
3656         dir_table = is_ofdm_rate(basic_rate) ? M_RT_DIRMAP_A : M_RT_DIRMAP_B;
3657
3658         /* Shared memory address for the table we are writing */
3659         basic_table = is_ofdm_rate(rate) ? M_RT_BBRSMAP_A : M_RT_BBRSMAP_B;
3660
3661         /*
3662          * for a given rate, the LS-nibble of the PLCP SIGNAL field is
3663          * the index into the rate table.
3664          */
3665         phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
3666         basic_phy_rate = rate_info[basic_rate] & BRCMS_RATE_MASK;
3667         index = phy_rate & 0xf;
3668         basic_index = basic_phy_rate & 0xf;
3669
3670         /* Find the SHM pointer to the ACK rate entry by looking in the
3671          * Direct-map Table
3672          */
3673         basic_ptr = brcms_b_read_shm(wlc->hw, (dir_table + basic_index * 2));
3674
3675         /* Update the SHM BSS-basic-rate-set mapping table with the pointer
3676          * to the correct basic rate for the given incoming rate
3677          */
3678         brcms_b_write_shm(wlc->hw, (basic_table + index * 2), basic_ptr);
3679 }
3680
3681 static const struct brcms_c_rateset *
3682 brcms_c_rateset_get_hwrs(struct brcms_c_info *wlc)
3683 {
3684         const struct brcms_c_rateset *rs_dflt;
3685
3686         if (BRCMS_PHY_11N_CAP(wlc->band)) {
3687                 if (wlc->band->bandtype == BRCM_BAND_5G)
3688                         rs_dflt = &ofdm_mimo_rates;
3689                 else
3690                         rs_dflt = &cck_ofdm_mimo_rates;
3691         } else if (wlc->band->gmode)
3692                 rs_dflt = &cck_ofdm_rates;
3693         else
3694                 rs_dflt = &cck_rates;
3695
3696         return rs_dflt;
3697 }
3698
3699 static void brcms_c_set_ratetable(struct brcms_c_info *wlc)
3700 {
3701         const struct brcms_c_rateset *rs_dflt;
3702         struct brcms_c_rateset rs;
3703         u8 rate, basic_rate;
3704         uint i;
3705
3706         rs_dflt = brcms_c_rateset_get_hwrs(wlc);
3707
3708         brcms_c_rateset_copy(rs_dflt, &rs);
3709         brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
3710
3711         /* walk the phy rate table and update SHM basic rate lookup table */
3712         for (i = 0; i < rs.count; i++) {
3713                 rate = rs.rates[i] & BRCMS_RATE_MASK;
3714
3715                 /* for a given rate brcms_basic_rate returns the rate at
3716                  * which a response ACK/CTS should be sent.
3717                  */
3718                 basic_rate = brcms_basic_rate(wlc, rate);
3719                 if (basic_rate == 0)
3720                         /* This should only happen if we are using a
3721                          * restricted rateset.
3722                          */
3723                         basic_rate = rs.rates[0] & BRCMS_RATE_MASK;
3724
3725                 brcms_c_write_rate_shm(wlc, rate, basic_rate);
3726         }
3727 }
3728
3729 /* band-specific init */
3730 static void brcms_c_bsinit(struct brcms_c_info *wlc)
3731 {
3732         BCMMSG(wlc->wiphy, "wl%d: bandunit %d\n",
3733                  wlc->pub->unit, wlc->band->bandunit);
3734
3735         /* write ucode ACK/CTS rate table */
3736         brcms_c_set_ratetable(wlc);
3737
3738         /* update some band specific mac configuration */
3739         brcms_c_ucode_mac_upd(wlc);
3740
3741         /* init antenna selection */
3742         brcms_c_antsel_init(wlc->asi);
3743
3744 }
3745
3746 /* formula:  IDLE_BUSY_RATIO_X_16 = (100-duty_cycle)/duty_cycle*16 */
3747 static int
3748 brcms_c_duty_cycle_set(struct brcms_c_info *wlc, int duty_cycle, bool isOFDM,
3749                    bool writeToShm)
3750 {
3751         int idle_busy_ratio_x_16 = 0;
3752         uint offset =
3753             isOFDM ? M_TX_IDLE_BUSY_RATIO_X_16_OFDM :
3754             M_TX_IDLE_BUSY_RATIO_X_16_CCK;
3755         if (duty_cycle > 100 || duty_cycle < 0) {
3756                 wiphy_err(wlc->wiphy, "wl%d:  duty cycle value off limit\n",
3757                           wlc->pub->unit);
3758                 return -EINVAL;
3759         }
3760         if (duty_cycle)
3761                 idle_busy_ratio_x_16 = (100 - duty_cycle) * 16 / duty_cycle;
3762         /* Only write to shared memory  when wl is up */
3763         if (writeToShm)
3764                 brcms_b_write_shm(wlc->hw, offset, (u16) idle_busy_ratio_x_16);
3765
3766         if (isOFDM)
3767                 wlc->tx_duty_cycle_ofdm = (u16) duty_cycle;
3768         else
3769                 wlc->tx_duty_cycle_cck = (u16) duty_cycle;
3770
3771         return 0;
3772 }
3773
3774 /*
3775  * Initialize the base precedence map for dequeueing
3776  * from txq based on WME settings
3777  */
3778 static void brcms_c_tx_prec_map_init(struct brcms_c_info *wlc)
3779 {
3780         wlc->tx_prec_map = BRCMS_PREC_BMP_ALL;
3781         memset(wlc->fifo2prec_map, 0, NFIFO * sizeof(u16));
3782
3783         wlc->fifo2prec_map[TX_AC_BK_FIFO] = BRCMS_PREC_BMP_AC_BK;
3784         wlc->fifo2prec_map[TX_AC_BE_FIFO] = BRCMS_PREC_BMP_AC_BE;
3785         wlc->fifo2prec_map[TX_AC_VI_FIFO] = BRCMS_PREC_BMP_AC_VI;
3786         wlc->fifo2prec_map[TX_AC_VO_FIFO] = BRCMS_PREC_BMP_AC_VO;
3787 }
3788
3789 static void
3790 brcms_c_txflowcontrol_signal(struct brcms_c_info *wlc,
3791                              struct brcms_txq_info *qi, bool on, int prio)
3792 {
3793         /* transmit flowcontrol is not yet implemented */
3794 }
3795
3796 static void brcms_c_txflowcontrol_reset(struct brcms_c_info *wlc)
3797 {
3798         struct brcms_txq_info *qi;
3799
3800         for (qi = wlc->tx_queues; qi != NULL; qi = qi->next) {
3801                 if (qi->stopped) {
3802                         brcms_c_txflowcontrol_signal(wlc, qi, OFF, ALLPRIO);
3803                         qi->stopped = 0;
3804                 }
3805         }
3806 }
3807
3808 /* push sw hps and wake state through hardware */
3809 static void brcms_c_set_ps_ctrl(struct brcms_c_info *wlc)
3810 {
3811         u32 v1, v2;
3812         bool hps;
3813         bool awake_before;
3814
3815         hps = brcms_c_ps_allowed(wlc);
3816
3817         BCMMSG(wlc->wiphy, "wl%d: hps %d\n", wlc->pub->unit, hps);
3818
3819         v1 = R_REG(&wlc->regs->maccontrol);
3820         v2 = MCTL_WAKE;
3821         if (hps)
3822                 v2 |= MCTL_HPS;
3823
3824         brcms_b_mctrl(wlc->hw, MCTL_WAKE | MCTL_HPS, v2);
3825
3826         awake_before = ((v1 & MCTL_WAKE) || ((v1 & MCTL_HPS) == 0));
3827
3828         if (!awake_before)
3829                 brcms_b_wait_for_wake(wlc->hw);
3830 }
3831
3832 /*
3833  * Write this BSS config's MAC address to core.
3834  * Updates RXE match engine.
3835  */
3836 static int brcms_c_set_mac(struct brcms_bss_cfg *bsscfg)
3837 {
3838         int err = 0;
3839         struct brcms_c_info *wlc = bsscfg->wlc;
3840
3841         /* enter the MAC addr into the RXE match registers */
3842         brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, bsscfg->cur_etheraddr);
3843
3844         brcms_c_ampdu_macaddr_upd(wlc);
3845
3846         return err;
3847 }
3848
3849 /* Write the BSS config's BSSID address to core (set_bssid in d11procs.tcl).
3850  * Updates RXE match engine.
3851  */
3852 static void brcms_c_set_bssid(struct brcms_bss_cfg *bsscfg)
3853 {
3854         /* we need to update BSSID in RXE match registers */
3855         brcms_c_set_addrmatch(bsscfg->wlc, RCM_BSSID_OFFSET, bsscfg->BSSID);
3856 }
3857
3858 static void brcms_b_set_shortslot(struct brcms_hardware *wlc_hw, bool shortslot)
3859 {
3860         wlc_hw->shortslot = shortslot;
3861
3862         if (wlc_hw->band->bandtype == BRCM_BAND_2G && wlc_hw->up) {
3863                 brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
3864                 brcms_b_update_slot_timing(wlc_hw, shortslot);
3865                 brcms_c_enable_mac(wlc_hw->wlc);
3866         }
3867 }
3868
3869 /*
3870  * Suspend the the MAC and update the slot timing
3871  * for standard 11b/g (20us slots) or shortslot 11g (9us slots).
3872  */
3873 static void brcms_c_switch_shortslot(struct brcms_c_info *wlc, bool shortslot)
3874 {
3875         /* use the override if it is set */
3876         if (wlc->shortslot_override != BRCMS_SHORTSLOT_AUTO)
3877                 shortslot = (wlc->shortslot_override == BRCMS_SHORTSLOT_ON);
3878
3879         if (wlc->shortslot == shortslot)
3880                 return;
3881
3882         wlc->shortslot = shortslot;
3883
3884         brcms_b_set_shortslot(wlc->hw, shortslot);
3885 }
3886
3887 static void brcms_c_set_home_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3888 {
3889         if (wlc->home_chanspec != chanspec) {
3890                 wlc->home_chanspec = chanspec;
3891
3892                 if (wlc->bsscfg->associated)
3893                         wlc->bsscfg->current_bss->chanspec = chanspec;
3894         }
3895 }
3896
3897 void
3898 brcms_b_set_chanspec(struct brcms_hardware *wlc_hw, u16 chanspec,
3899                       bool mute, struct txpwr_limits *txpwr)
3900 {
3901         uint bandunit;
3902
3903         BCMMSG(wlc_hw->wlc->wiphy, "wl%d: 0x%x\n", wlc_hw->unit, chanspec);
3904
3905         wlc_hw->chanspec = chanspec;
3906
3907         /* Switch bands if necessary */
3908         if (wlc_hw->_nbands > 1) {
3909                 bandunit = chspec_bandunit(chanspec);
3910                 if (wlc_hw->band->bandunit != bandunit) {
3911                         /* brcms_b_setband disables other bandunit,
3912                          *  use light band switch if not up yet
3913                          */
3914                         if (wlc_hw->up) {
3915                                 wlc_phy_chanspec_radio_set(wlc_hw->
3916                                                            bandstate[bandunit]->
3917                                                            pi, chanspec);
3918                                 brcms_b_setband(wlc_hw, bandunit, chanspec);
3919                         } else {
3920                                 brcms_c_setxband(wlc_hw, bandunit);
3921                         }
3922                 }
3923         }
3924
3925         wlc_phy_initcal_enable(wlc_hw->band->pi, !mute);
3926
3927         if (!wlc_hw->up) {
3928                 if (wlc_hw->clk)
3929                         wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr,
3930                                                   chanspec);
3931                 wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3932         } else {
3933                 wlc_phy_chanspec_set(wlc_hw->band->pi, chanspec);
3934                 wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr, chanspec);
3935
3936                 /* Update muting of the channel */
3937                 brcms_b_mute(wlc_hw, mute, 0);
3938         }
3939 }
3940
3941 /* switch to and initialize new band */
3942 static void brcms_c_setband(struct brcms_c_info *wlc,
3943                                            uint bandunit)
3944 {
3945         wlc->band = wlc->bandstate[bandunit];
3946
3947         if (!wlc->pub->up)
3948                 return;
3949
3950         /* wait for at least one beacon before entering sleeping state */
3951         brcms_c_set_ps_ctrl(wlc);
3952
3953         /* band-specific initializations */
3954         brcms_c_bsinit(wlc);
3955 }
3956
3957 static void brcms_c_set_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3958 {
3959         uint bandunit;
3960         bool switchband = false;
3961         u16 old_chanspec = wlc->chanspec;
3962
3963         if (!brcms_c_valid_chanspec_db(wlc->cmi, chanspec)) {
3964                 wiphy_err(wlc->wiphy, "wl%d: %s: Bad channel %d\n",
3965                           wlc->pub->unit, __func__, CHSPEC_CHANNEL(chanspec));
3966                 return;
3967         }
3968
3969         /* Switch bands if necessary */
3970         if (wlc->pub->_nbands > 1) {
3971                 bandunit = chspec_bandunit(chanspec);
3972                 if (wlc->band->bandunit != bandunit || wlc->bandinit_pending) {
3973                         switchband = true;
3974                         if (wlc->bandlocked) {
3975                                 wiphy_err(wlc->wiphy, "wl%d: %s: chspec %d "
3976                                           "band is locked!\n",
3977                                           wlc->pub->unit, __func__,
3978                                           CHSPEC_CHANNEL(chanspec));
3979                                 return;
3980                         }
3981                         /*
3982                          * should the setband call come after the
3983                          * brcms_b_chanspec() ? if the setband updates
3984                          * (brcms_c_bsinit) use low level calls to inspect and
3985                          * set state, the state inspected may be from the wrong
3986                          * band, or the following brcms_b_set_chanspec() may
3987                          * undo the work.
3988                          */
3989                         brcms_c_setband(wlc, bandunit);
3990                 }
3991         }
3992
3993         /* sync up phy/radio chanspec */
3994         brcms_c_set_phy_chanspec(wlc, chanspec);
3995
3996         /* init antenna selection */
3997         if (brcms_chspec_bw(old_chanspec) != brcms_chspec_bw(chanspec)) {
3998                 brcms_c_antsel_init(wlc->asi);
3999
4000                 /* Fix the hardware rateset based on bw.
4001                  * Mainly add MCS32 for 40Mhz, remove MCS 32 for 20Mhz
4002                  */
4003                 brcms_c_rateset_bw_mcs_filter(&wlc->band->hw_rateset,
4004                         wlc->band->mimo_cap_40 ? brcms_chspec_bw(chanspec) : 0);
4005         }
4006
4007         /* update some mac configuration since chanspec changed */
4008         brcms_c_ucode_mac_upd(wlc);
4009 }
4010
4011 /*
4012  * This function changes the phytxctl for beacon based on current
4013  * beacon ratespec AND txant setting as per this table:
4014  *  ratespec     CCK            ant = wlc->stf->txant
4015  *              OFDM            ant = 3
4016  */
4017 void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc,
4018                                        u32 bcn_rspec)
4019 {
4020         u16 phyctl;
4021         u16 phytxant = wlc->stf->phytxant;
4022         u16 mask = PHY_TXC_ANT_MASK;
4023
4024         /* for non-siso rates or default setting, use the available chains */
4025         if (BRCMS_PHY_11N_CAP(wlc->band))
4026                 phytxant = brcms_c_stf_phytxchain_sel(wlc, bcn_rspec);
4027
4028         phyctl = brcms_b_read_shm(wlc->hw, M_BCN_PCTLWD);
4029         phyctl = (phyctl & ~mask) | phytxant;
4030         brcms_b_write_shm(wlc->hw, M_BCN_PCTLWD, phyctl);
4031 }
4032
4033 /*
4034  * centralized protection config change function to simplify debugging, no
4035  * consistency checking this should be called only on changes to avoid overhead
4036  * in periodic function
4037  */
4038 void brcms_c_protection_upd(struct brcms_c_info *wlc, uint idx, int val)
4039 {
4040         BCMMSG(wlc->wiphy, "idx %d, val %d\n", idx, val);
4041
4042         switch (idx) {
4043         case BRCMS_PROT_G_SPEC:
4044                 wlc->protection->_g = (bool) val;
4045                 break;
4046         case BRCMS_PROT_G_OVR:
4047                 wlc->protection->g_override = (s8) val;
4048                 break;
4049         case BRCMS_PROT_G_USER:
4050                 wlc->protection->gmode_user = (u8) val;
4051                 break;
4052         case BRCMS_PROT_OVERLAP:
4053                 wlc->protection->overlap = (s8) val;
4054                 break;
4055         case BRCMS_PROT_N_USER:
4056                 wlc->protection->nmode_user = (s8) val;
4057                 break;
4058         case BRCMS_PROT_N_CFG:
4059                 wlc->protection->n_cfg = (s8) val;
4060                 break;
4061         case BRCMS_PROT_N_CFG_OVR:
4062                 wlc->protection->n_cfg_override = (s8) val;
4063                 break;
4064         case BRCMS_PROT_N_NONGF:
4065                 wlc->protection->nongf = (bool) val;
4066                 break;
4067         case BRCMS_PROT_N_NONGF_OVR:
4068                 wlc->protection->nongf_override = (s8) val;
4069                 break;
4070         case BRCMS_PROT_N_PAM_OVR:
4071                 wlc->protection->n_pam_override = (s8) val;
4072                 break;
4073         case BRCMS_PROT_N_OBSS:
4074                 wlc->protection->n_obss = (bool) val;
4075                 break;
4076
4077         default:
4078                 break;
4079         }
4080
4081 }
4082
4083 static void brcms_c_ht_update_sgi_rx(struct brcms_c_info *wlc, int val)
4084 {
4085         if (wlc->pub->up) {
4086                 brcms_c_update_beacon(wlc);
4087                 brcms_c_update_probe_resp(wlc, true);
4088         }
4089 }
4090
4091 static void brcms_c_ht_update_ldpc(struct brcms_c_info *wlc, s8 val)
4092 {
4093         wlc->stf->ldpc = val;
4094
4095         if (wlc->pub->up) {
4096                 brcms_c_update_beacon(wlc);
4097                 brcms_c_update_probe_resp(wlc, true);
4098                 wlc_phy_ldpc_override_set(wlc->band->pi, (val ? true : false));
4099         }
4100 }
4101
4102 void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
4103                        const struct ieee80211_tx_queue_params *params,
4104                        bool suspend)
4105 {
4106         int i;
4107         struct shm_acparams acp_shm;
4108         u16 *shm_entry;
4109
4110         /* Only apply params if the core is out of reset and has clocks */
4111         if (!wlc->clk) {
4112                 wiphy_err(wlc->wiphy, "wl%d: %s : no-clock\n", wlc->pub->unit,
4113                           __func__);
4114                 return;
4115         }
4116
4117         memset((char *)&acp_shm, 0, sizeof(struct shm_acparams));
4118         /* fill in shm ac params struct */
4119         acp_shm.txop = params->txop;
4120         /* convert from units of 32us to us for ucode */
4121         wlc->edcf_txop[aci & 0x3] = acp_shm.txop =
4122             EDCF_TXOP2USEC(acp_shm.txop);
4123         acp_shm.aifs = (params->aifs & EDCF_AIFSN_MASK);
4124
4125         if (aci == AC_VI && acp_shm.txop == 0
4126             && acp_shm.aifs < EDCF_AIFSN_MAX)
4127                 acp_shm.aifs++;
4128
4129         if (acp_shm.aifs < EDCF_AIFSN_MIN
4130             || acp_shm.aifs > EDCF_AIFSN_MAX) {
4131                 wiphy_err(wlc->wiphy, "wl%d: edcf_setparams: bad "
4132                           "aifs %d\n", wlc->pub->unit, acp_shm.aifs);
4133         } else {
4134                 acp_shm.cwmin = params->cw_min;
4135                 acp_shm.cwmax = params->cw_max;
4136                 acp_shm.cwcur = acp_shm.cwmin;
4137                 acp_shm.bslots =
4138                     R_REG(&wlc->regs->tsf_random) & acp_shm.cwcur;
4139                 acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
4140                 /* Indicate the new params to the ucode */
4141                 acp_shm.status = brcms_b_read_shm(wlc->hw, (M_EDCF_QINFO +
4142                                                   wme_ac2fifo[aci] *
4143                                                   M_EDCF_QLEN +
4144                                                   M_EDCF_STATUS_OFF));
4145                 acp_shm.status |= WME_STATUS_NEWAC;
4146
4147                 /* Fill in shm acparam table */
4148                 shm_entry = (u16 *) &acp_shm;
4149                 for (i = 0; i < (int)sizeof(struct shm_acparams); i += 2)
4150                         brcms_b_write_shm(wlc->hw,
4151                                           M_EDCF_QINFO +
4152                                           wme_ac2fifo[aci] * M_EDCF_QLEN + i,
4153                                           *shm_entry++);
4154         }
4155
4156         if (suspend) {
4157                 brcms_c_suspend_mac_and_wait(wlc);
4158                 brcms_c_enable_mac(wlc);
4159         }
4160 }
4161
4162 static void brcms_c_edcf_setparams(struct brcms_c_info *wlc, bool suspend)
4163 {
4164         u16 aci;
4165         int i_ac;
4166         struct ieee80211_tx_queue_params txq_pars;
4167         static const struct edcf_acparam default_edcf_acparams[] = {
4168                  {EDCF_AC_BE_ACI_STA, EDCF_AC_BE_ECW_STA, EDCF_AC_BE_TXOP_STA},
4169                  {EDCF_AC_BK_ACI_STA, EDCF_AC_BK_ECW_STA, EDCF_AC_BK_TXOP_STA},
4170                  {EDCF_AC_VI_ACI_STA, EDCF_AC_VI_ECW_STA, EDCF_AC_VI_TXOP_STA},
4171                  {EDCF_AC_VO_ACI_STA, EDCF_AC_VO_ECW_STA, EDCF_AC_VO_TXOP_STA}
4172         }; /* ucode needs these parameters during its initialization */
4173         const struct edcf_acparam *edcf_acp = &default_edcf_acparams[0];
4174
4175         for (i_ac = 0; i_ac < AC_COUNT; i_ac++, edcf_acp++) {
4176                 /* find out which ac this set of params applies to */
4177                 aci = (edcf_acp->ACI & EDCF_ACI_MASK) >> EDCF_ACI_SHIFT;
4178
4179                 /* fill in shm ac params struct */
4180                 txq_pars.txop = edcf_acp->TXOP;
4181                 txq_pars.aifs = edcf_acp->ACI;
4182
4183                 /* CWmin = 2^(ECWmin) - 1 */
4184                 txq_pars.cw_min = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
4185                 /* CWmax = 2^(ECWmax) - 1 */
4186                 txq_pars.cw_max = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
4187                                             >> EDCF_ECWMAX_SHIFT);
4188                 brcms_c_wme_setparams(wlc, aci, &txq_pars, suspend);
4189         }
4190
4191         if (suspend) {
4192                 brcms_c_suspend_mac_and_wait(wlc);
4193                 brcms_c_enable_mac(wlc);
4194         }
4195 }
4196
4197 /* maintain LED behavior in down state */
4198 static void brcms_c_down_led_upd(struct brcms_c_info *wlc)
4199 {
4200         /*
4201          * maintain LEDs while in down state, turn on sbclk if
4202          * not available yet. Turn on sbclk if necessary
4203          */
4204         brcms_b_pllreq(wlc->hw, true, BRCMS_PLLREQ_FLIP);
4205         brcms_b_pllreq(wlc->hw, false, BRCMS_PLLREQ_FLIP);
4206 }
4207
4208 static void brcms_c_radio_monitor_start(struct brcms_c_info *wlc)
4209 {
4210         /* Don't start the timer if HWRADIO feature is disabled */
4211         if (wlc->radio_monitor)
4212                 return;
4213
4214         wlc->radio_monitor = true;
4215         brcms_b_pllreq(wlc->hw, true, BRCMS_PLLREQ_RADIO_MON);
4216         brcms_add_timer(wlc->radio_timer, TIMER_INTERVAL_RADIOCHK, true);
4217 }
4218
4219 static void brcms_c_radio_disable(struct brcms_c_info *wlc)
4220 {
4221         if (!wlc->pub->up) {
4222                 brcms_c_down_led_upd(wlc);
4223                 return;
4224         }
4225
4226         brcms_c_radio_monitor_start(wlc);
4227         brcms_down(wlc->wl);
4228 }
4229
4230 static void brcms_c_radio_enable(struct brcms_c_info *wlc)
4231 {
4232         if (wlc->pub->up)
4233                 return;
4234
4235         if (brcms_deviceremoved(wlc))
4236                 return;
4237
4238         brcms_up(wlc->wl);
4239 }
4240
4241 static bool brcms_c_radio_monitor_stop(struct brcms_c_info *wlc)
4242 {
4243         if (!wlc->radio_monitor)
4244                 return true;
4245
4246         wlc->radio_monitor = false;
4247         brcms_b_pllreq(wlc->hw, false, BRCMS_PLLREQ_RADIO_MON);
4248         return brcms_del_timer(wlc->radio_timer);
4249 }
4250
4251 /* read hwdisable state and propagate to wlc flag */
4252 static void brcms_c_radio_hwdisable_upd(struct brcms_c_info *wlc)
4253 {
4254         if (wlc->pub->hw_off)
4255                 return;
4256
4257         if (brcms_b_radio_read_hwdisabled(wlc->hw))
4258                 mboolset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4259         else
4260                 mboolclr(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4261 }
4262
4263 /*
4264  * centralized radio disable/enable function,
4265  * invoke radio enable/disable after updating hwradio status
4266  */
4267 static void brcms_c_radio_upd(struct brcms_c_info *wlc)
4268 {
4269         if (wlc->pub->radio_disabled)
4270                 brcms_c_radio_disable(wlc);
4271         else
4272                 brcms_c_radio_enable(wlc);
4273 }
4274
4275 /* update hwradio status and return it */
4276 bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc)
4277 {
4278         brcms_c_radio_hwdisable_upd(wlc);
4279
4280         return mboolisset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE) ?
4281                         true : false;
4282 }
4283
4284 /* periodical query hw radio button while driver is "down" */
4285 static void brcms_c_radio_timer(void *arg)
4286 {
4287         struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4288
4289         if (brcms_deviceremoved(wlc)) {
4290                 wiphy_err(wlc->wiphy, "wl%d: %s: dead chip\n", wlc->pub->unit,
4291                         __func__);
4292                 brcms_down(wlc->wl);
4293                 return;
4294         }
4295
4296         brcms_c_radio_hwdisable_upd(wlc);
4297         brcms_c_radio_upd(wlc);
4298 }
4299
4300 /* common low-level watchdog code */
4301 static void brcms_b_watchdog(void *arg)
4302 {
4303         struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4304         struct brcms_hardware *wlc_hw = wlc->hw;
4305
4306         BCMMSG(wlc->wiphy, "wl%d\n", wlc_hw->unit);
4307
4308         if (!wlc_hw->up)
4309                 return;
4310
4311         /* increment second count */
4312         wlc_hw->now++;
4313
4314         /* Check for FIFO error interrupts */
4315         brcms_b_fifoerrors(wlc_hw);
4316
4317         /* make sure RX dma has buffers */
4318         dma_rxfill(wlc->hw->di[RX_FIFO]);
4319
4320         wlc_phy_watchdog(wlc_hw->band->pi);
4321 }
4322
4323 static void brcms_c_radio_mon_upd(struct brcms_c_info *wlc)
4324 {
4325         /*
4326          * Stop the radio monitor when the radio is going down.
4327          */
4328         if (!wlc->pub->radio_disabled)
4329                 return;
4330         brcms_c_radio_upd(wlc);
4331         if (!wlc->pub->radio_disabled)
4332                 brcms_c_radio_monitor_stop(wlc);
4333 }
4334
4335 /* common watchdog code */
4336 static void brcms_c_watchdog(void *arg)
4337 {
4338         struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4339
4340         BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
4341
4342         if (!wlc->pub->up)
4343                 return;
4344
4345         if (brcms_deviceremoved(wlc)) {
4346                 wiphy_err(wlc->wiphy, "wl%d: %s: dead chip\n", wlc->pub->unit,
4347                           __func__);
4348                 brcms_down(wlc->wl);
4349                 return;
4350         }
4351
4352         /* increment second count */
4353         wlc->pub->now++;
4354
4355         brcms_c_radio_mon_upd(wlc);
4356         /* radio sync: sw/hw --> radio_disable/radio_enable */
4357         brcms_c_radio_hwdisable_upd(wlc);
4358         brcms_c_radio_upd(wlc);
4359         /* if radio is disable, driver may be down, quit here */
4360         if (wlc->pub->radio_disabled)
4361                 return;
4362
4363         brcms_b_watchdog(wlc);
4364
4365         /*
4366          * occasionally sample mac stat counters to
4367          * detect 16-bit counter wrap
4368          */
4369         if ((wlc->pub->now % SW_TIMER_MAC_STAT_UPD) == 0)
4370                 brcms_c_statsupd(wlc);
4371
4372         if (BRCMS_ISNPHY(wlc->band) &&
4373             ((wlc->pub->now - wlc->tempsense_lasttime) >=
4374              BRCMS_TEMPSENSE_PERIOD)) {
4375                 wlc->tempsense_lasttime = wlc->pub->now;
4376                 brcms_c_tempsense_upd(wlc);
4377         }
4378 }
4379
4380 static void brcms_c_watchdog_by_timer(void *arg)
4381 {
4382         brcms_c_watchdog(arg);
4383 }
4384
4385 static bool brcms_c_timers_init(struct brcms_c_info *wlc, int unit)
4386 {
4387         wlc->wdtimer = brcms_init_timer(wlc->wl, brcms_c_watchdog_by_timer,
4388                 wlc, "watchdog");
4389         if (!wlc->wdtimer) {
4390                 wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for wdtimer "
4391                           "failed\n", unit);
4392                 goto fail;
4393         }
4394
4395         wlc->radio_timer = brcms_init_timer(wlc->wl, brcms_c_radio_timer,
4396                 wlc, "radio");
4397         if (!wlc->radio_timer) {
4398                 wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for radio_timer "
4399                           "failed\n", unit);
4400                 goto fail;
4401         }
4402
4403         return true;
4404
4405  fail:
4406         return false;
4407 }
4408
4409 /*
4410  * Initialize brcms_c_info default values ...
4411  * may get overrides later in this function
4412  */
4413 static void brcms_c_info_init(struct brcms_c_info *wlc, int unit)
4414 {
4415         int i;
4416
4417         /* Save our copy of the chanspec */
4418         wlc->chanspec = ch20mhz_chspec(1);
4419
4420         /* various 802.11g modes */
4421         wlc->shortslot = false;
4422         wlc->shortslot_override = BRCMS_SHORTSLOT_AUTO;
4423
4424         brcms_c_protection_upd(wlc, BRCMS_PROT_G_OVR, BRCMS_PROTECTION_AUTO);
4425         brcms_c_protection_upd(wlc, BRCMS_PROT_G_SPEC, false);
4426
4427         brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG_OVR,
4428                                BRCMS_PROTECTION_AUTO);
4429         brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG, BRCMS_N_PROTECTION_OFF);
4430         brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF_OVR,
4431                                BRCMS_PROTECTION_AUTO);
4432         brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF, false);
4433         brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, AUTO);
4434
4435         brcms_c_protection_upd(wlc, BRCMS_PROT_OVERLAP,
4436                                BRCMS_PROTECTION_CTL_OVERLAP);
4437
4438         /* 802.11g draft 4.0 NonERP elt advertisement */
4439         wlc->include_legacy_erp = true;
4440
4441         wlc->stf->ant_rx_ovr = ANT_RX_DIV_DEF;
4442         wlc->stf->txant = ANT_TX_DEF;
4443
4444         wlc->prb_resp_timeout = BRCMS_PRB_RESP_TIMEOUT;
4445
4446         wlc->usr_fragthresh = DOT11_DEFAULT_FRAG_LEN;
4447         for (i = 0; i < NFIFO; i++)
4448                 wlc->fragthresh[i] = DOT11_DEFAULT_FRAG_LEN;
4449         wlc->RTSThresh = DOT11_DEFAULT_RTS_LEN;
4450
4451         /* default rate fallback retry limits */
4452         wlc->SFBL = RETRY_SHORT_FB;
4453         wlc->LFBL = RETRY_LONG_FB;
4454
4455         /* default mac retry limits */
4456         wlc->SRL = RETRY_SHORT_DEF;
4457         wlc->LRL = RETRY_LONG_DEF;
4458
4459         /* WME QoS mode is Auto by default */
4460         wlc->pub->_ampdu = AMPDU_AGG_HOST;
4461         wlc->pub->bcmerror = 0;
4462 }
4463
4464 static uint brcms_c_attach_module(struct brcms_c_info *wlc)
4465 {
4466         uint err = 0;
4467         uint unit;
4468         unit = wlc->pub->unit;
4469
4470         wlc->asi = brcms_c_antsel_attach(wlc);
4471         if (wlc->asi == NULL) {
4472                 wiphy_err(wlc->wiphy, "wl%d: attach: antsel_attach "
4473                           "failed\n", unit);
4474                 err = 44;
4475                 goto fail;
4476         }
4477
4478         wlc->ampdu = brcms_c_ampdu_attach(wlc);
4479         if (wlc->ampdu == NULL) {
4480                 wiphy_err(wlc->wiphy, "wl%d: attach: ampdu_attach "
4481                           "failed\n", unit);
4482                 err = 50;
4483                 goto fail;
4484         }
4485
4486         if ((brcms_c_stf_attach(wlc) != 0)) {
4487                 wiphy_err(wlc->wiphy, "wl%d: attach: stf_attach "
4488                           "failed\n", unit);
4489                 err = 68;
4490                 goto fail;
4491         }
4492  fail:
4493         return err;
4494 }
4495
4496 struct brcms_pub *brcms_c_pub(struct brcms_c_info *wlc)
4497 {
4498         return wlc->pub;
4499 }
4500
4501 /* low level attach
4502  *    run backplane attach, init nvram
4503  *    run phy attach
4504  *    initialize software state for each core and band
4505  *    put the whole chip in reset(driver down state), no clock
4506  */
4507 static int brcms_b_attach(struct brcms_c_info *wlc, u16 vendor, u16 device,
4508                           uint unit, bool piomode, void __iomem *regsva,
4509                           struct pci_dev *btparam)
4510 {
4511         struct brcms_hardware *wlc_hw;
4512         struct d11regs __iomem *regs;
4513         char *macaddr = NULL;
4514         uint err = 0;
4515         uint j;
4516         bool wme = false;
4517         struct shared_phy_params sha_params;
4518         struct wiphy *wiphy = wlc->wiphy;
4519
4520         BCMMSG(wlc->wiphy, "wl%d: vendor 0x%x device 0x%x\n", unit, vendor,
4521                 device);
4522
4523         wme = true;
4524
4525         wlc_hw = wlc->hw;
4526         wlc_hw->wlc = wlc;
4527         wlc_hw->unit = unit;
4528         wlc_hw->band = wlc_hw->bandstate[0];
4529         wlc_hw->_piomode = piomode;
4530
4531         /* populate struct brcms_hardware with default values  */
4532         brcms_b_info_init(wlc_hw);
4533
4534         /*
4535          * Do the hardware portion of the attach. Also initialize software
4536          * state that depends on the particular hardware we are running.
4537          */
4538         wlc_hw->sih = ai_attach(regsva, btparam);
4539         if (wlc_hw->sih == NULL) {
4540                 wiphy_err(wiphy, "wl%d: brcms_b_attach: si_attach failed\n",
4541                           unit);
4542                 err = 11;
4543                 goto fail;
4544         }
4545
4546         /* verify again the device is supported */
4547         if (!brcms_c_chipmatch(vendor, device)) {
4548                 wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported "
4549                         "vendor/device (0x%x/0x%x)\n",
4550                          unit, vendor, device);
4551                 err = 12;
4552                 goto fail;
4553         }
4554
4555         wlc_hw->vendorid = vendor;
4556         wlc_hw->deviceid = device;
4557
4558         /* set bar0 window to point at D11 core */
4559         wlc_hw->regs = (struct d11regs __iomem *)
4560                                 ai_setcore(wlc_hw->sih, D11_CORE_ID, 0);
4561         wlc_hw->corerev = ai_corerev(wlc_hw->sih);
4562
4563         regs = wlc_hw->regs;
4564
4565         wlc->regs = wlc_hw->regs;
4566
4567         /* validate chip, chiprev and corerev */
4568         if (!brcms_c_isgoodchip(wlc_hw)) {
4569                 err = 13;
4570                 goto fail;
4571         }
4572
4573         /* initialize power control registers */
4574         ai_clkctl_init(wlc_hw->sih);
4575
4576         /* request fastclock and force fastclock for the rest of attach
4577          * bring the d11 core out of reset.
4578          *   For PMU chips, the first wlc_clkctl_clk is no-op since core-clk
4579          *   is still false; But it will be called again inside wlc_corereset,
4580          *   after d11 is out of reset.
4581          */
4582         brcms_b_clkctl_clk(wlc_hw, CLK_FAST);
4583         brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4584
4585         if (!brcms_b_validate_chip_access(wlc_hw)) {
4586                 wiphy_err(wiphy, "wl%d: brcms_b_attach: validate_chip_access "
4587                         "failed\n", unit);
4588                 err = 14;
4589                 goto fail;
4590         }
4591
4592         /* get the board rev, used just below */
4593         j = getintvar(wlc_hw->sih, BRCMS_SROM_BOARDREV);
4594         /* promote srom boardrev of 0xFF to 1 */
4595         if (j == BOARDREV_PROMOTABLE)
4596                 j = BOARDREV_PROMOTED;
4597         wlc_hw->boardrev = (u16) j;
4598         if (!brcms_c_validboardtype(wlc_hw)) {
4599                 wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported Broadcom "
4600                         "board type (0x%x)" " or revision level (0x%x)\n",
4601                          unit, wlc_hw->sih->boardtype, wlc_hw->boardrev);
4602                 err = 15;
4603                 goto fail;
4604         }
4605         wlc_hw->sromrev = (u8) getintvar(wlc_hw->sih, BRCMS_SROM_REV);
4606         wlc_hw->boardflags = (u32) getintvar(wlc_hw->sih,
4607                                              BRCMS_SROM_BOARDFLAGS);
4608         wlc_hw->boardflags2 = (u32) getintvar(wlc_hw->sih,
4609                                               BRCMS_SROM_BOARDFLAGS2);
4610
4611         if (wlc_hw->boardflags & BFL_NOPLLDOWN)
4612                 brcms_b_pllreq(wlc_hw, true, BRCMS_PLLREQ_SHARED);
4613
4614         /* check device id(srom, nvram etc.) to set bands */
4615         if (wlc_hw->deviceid == BCM43224_D11N_ID ||
4616             wlc_hw->deviceid == BCM43224_D11N_ID_VEN1)
4617                 /* Dualband boards */
4618                 wlc_hw->_nbands = 2;
4619         else
4620                 wlc_hw->_nbands = 1;
4621
4622         if ((wlc_hw->sih->chip == BCM43225_CHIP_ID))
4623                 wlc_hw->_nbands = 1;
4624
4625         /* BMAC_NOTE: remove init of pub values when brcms_c_attach()
4626          * unconditionally does the init of these values
4627          */
4628         wlc->vendorid = wlc_hw->vendorid;
4629         wlc->deviceid = wlc_hw->deviceid;
4630         wlc->pub->sih = wlc_hw->sih;
4631         wlc->pub->corerev = wlc_hw->corerev;
4632         wlc->pub->sromrev = wlc_hw->sromrev;
4633         wlc->pub->boardrev = wlc_hw->boardrev;
4634         wlc->pub->boardflags = wlc_hw->boardflags;
4635         wlc->pub->boardflags2 = wlc_hw->boardflags2;
4636         wlc->pub->_nbands = wlc_hw->_nbands;
4637
4638         wlc_hw->physhim = wlc_phy_shim_attach(wlc_hw, wlc->wl, wlc);
4639
4640         if (wlc_hw->physhim == NULL) {
4641                 wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_shim_attach "
4642                         "failed\n", unit);
4643                 err = 25;
4644                 goto fail;
4645         }
4646
4647         /* pass all the parameters to wlc_phy_shared_attach in one struct */
4648         sha_params.sih = wlc_hw->sih;
4649         sha_params.physhim = wlc_hw->physhim;
4650         sha_params.unit = unit;
4651         sha_params.corerev = wlc_hw->corerev;
4652         sha_params.vid = wlc_hw->vendorid;
4653         sha_params.did = wlc_hw->deviceid;
4654         sha_params.chip = wlc_hw->sih->chip;
4655         sha_params.chiprev = wlc_hw->sih->chiprev;
4656         sha_params.chippkg = wlc_hw->sih->chippkg;
4657         sha_params.sromrev = wlc_hw->sromrev;
4658         sha_params.boardtype = wlc_hw->sih->boardtype;
4659         sha_params.boardrev = wlc_hw->boardrev;
4660         sha_params.boardvendor = wlc_hw->sih->boardvendor;
4661         sha_params.boardflags = wlc_hw->boardflags;
4662         sha_params.boardflags2 = wlc_hw->boardflags2;
4663         sha_params.buscorerev = wlc_hw->sih->buscorerev;
4664
4665         /* alloc and save pointer to shared phy state area */
4666         wlc_hw->phy_sh = wlc_phy_shared_attach(&sha_params);
4667         if (!wlc_hw->phy_sh) {
4668                 err = 16;
4669                 goto fail;
4670         }
4671
4672         /* initialize software state for each core and band */
4673         for (j = 0; j < wlc_hw->_nbands; j++) {
4674                 /*
4675                  * band0 is always 2.4Ghz
4676                  * band1, if present, is 5Ghz
4677                  */
4678
4679                 brcms_c_setxband(wlc_hw, j);
4680
4681                 wlc_hw->band->bandunit = j;
4682                 wlc_hw->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4683                 wlc->band->bandunit = j;
4684                 wlc->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4685                 wlc->core->coreidx = ai_coreidx(wlc_hw->sih);
4686
4687                 wlc_hw->machwcap = R_REG(&regs->machwcap);
4688                 wlc_hw->machwcap_backup = wlc_hw->machwcap;
4689
4690                 /* init tx fifo size */
4691                 wlc_hw->xmtfifo_sz =
4692                     xmtfifo_sz[(wlc_hw->corerev - XMTFIFOTBL_STARTREV)];
4693
4694                 /* Get a phy for this band */
4695                 wlc_hw->band->pi =
4696                         wlc_phy_attach(wlc_hw->phy_sh, regs,
4697                                        wlc_hw->band->bandtype,
4698                                        wlc->wiphy);
4699                 if (wlc_hw->band->pi == NULL) {
4700                         wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_"
4701                                   "attach failed\n", unit);
4702                         err = 17;
4703                         goto fail;
4704                 }
4705
4706                 wlc_phy_machwcap_set(wlc_hw->band->pi, wlc_hw->machwcap);
4707
4708                 wlc_phy_get_phyversion(wlc_hw->band->pi, &wlc_hw->band->phytype,
4709                                        &wlc_hw->band->phyrev,
4710                                        &wlc_hw->band->radioid,
4711                                        &wlc_hw->band->radiorev);
4712                 wlc_hw->band->abgphy_encore =
4713                     wlc_phy_get_encore(wlc_hw->band->pi);
4714                 wlc->band->abgphy_encore = wlc_phy_get_encore(wlc_hw->band->pi);
4715                 wlc_hw->band->core_flags =
4716                     wlc_phy_get_coreflags(wlc_hw->band->pi);
4717
4718                 /* verify good phy_type & supported phy revision */
4719                 if (BRCMS_ISNPHY(wlc_hw->band)) {
4720                         if (NCONF_HAS(wlc_hw->band->phyrev))
4721                                 goto good_phy;
4722                         else
4723                                 goto bad_phy;
4724                 } else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
4725                         if (LCNCONF_HAS(wlc_hw->band->phyrev))
4726                                 goto good_phy;
4727                         else
4728                                 goto bad_phy;
4729                 } else {
4730  bad_phy:
4731                         wiphy_err(wiphy, "wl%d: brcms_b_attach: unsupported "
4732                                   "phy type/rev (%d/%d)\n", unit,
4733                                   wlc_hw->band->phytype, wlc_hw->band->phyrev);
4734                         err = 18;
4735                         goto fail;
4736                 }
4737
4738  good_phy:
4739                 /*
4740                  * BMAC_NOTE: wlc->band->pi should not be set below and should
4741                  * be done in the high level attach. However we can not make
4742                  * that change until all low level access is changed to
4743                  * wlc_hw->band->pi. Instead do the wlc->band->pi init below,
4744                  * keeping wlc_hw->band->pi as well for incremental update of
4745                  * low level fns, and cut over low only init when all fns
4746                  * updated.
4747                  */
4748                 wlc->band->pi = wlc_hw->band->pi;
4749                 wlc->band->phytype = wlc_hw->band->phytype;
4750                 wlc->band->phyrev = wlc_hw->band->phyrev;
4751                 wlc->band->radioid = wlc_hw->band->radioid;
4752                 wlc->band->radiorev = wlc_hw->band->radiorev;
4753
4754                 /* default contention windows size limits */
4755                 wlc_hw->band->CWmin = APHY_CWMIN;
4756                 wlc_hw->band->CWmax = PHY_CWMAX;
4757
4758                 if (!brcms_b_attach_dmapio(wlc, j, wme)) {
4759                         err = 19;
4760                         goto fail;
4761                 }
4762         }
4763
4764         /* disable core to match driver "down" state */
4765         brcms_c_coredisable(wlc_hw);
4766
4767         /* Match driver "down" state */
4768         ai_pci_down(wlc_hw->sih);
4769
4770         /* register sb interrupt callback functions */
4771         ai_register_intr_callback(wlc_hw->sih, (void *)brcms_c_wlintrsoff,
4772                                   (void *)brcms_c_wlintrsrestore, NULL, wlc);
4773
4774         /* turn off pll and xtal to match driver "down" state */
4775         brcms_b_xtal(wlc_hw, OFF);
4776
4777         /* *******************************************************************
4778          * The hardware is in the DOWN state at this point. D11 core
4779          * or cores are in reset with clocks off, and the board PLLs
4780          * are off if possible.
4781          *
4782          * Beyond this point, wlc->sbclk == false and chip registers
4783          * should not be touched.
4784          *********************************************************************
4785          */
4786
4787         /* init etheraddr state variables */
4788         macaddr = brcms_c_get_macaddr(wlc_hw);
4789         if (macaddr == NULL) {
4790                 wiphy_err(wiphy, "wl%d: brcms_b_attach: macaddr not found\n",
4791                           unit);
4792                 err = 21;
4793                 goto fail;
4794         }
4795         if (!mac_pton(macaddr, wlc_hw->etheraddr) ||
4796             is_broadcast_ether_addr(wlc_hw->etheraddr) ||
4797             is_zero_ether_addr(wlc_hw->etheraddr)) {
4798                 wiphy_err(wiphy, "wl%d: brcms_b_attach: bad macaddr %s\n",
4799                           unit, macaddr);
4800                 err = 22;
4801                 goto fail;
4802         }
4803
4804         BCMMSG(wlc->wiphy,
4805                  "deviceid 0x%x nbands %d board 0x%x macaddr: %s\n",
4806                  wlc_hw->deviceid, wlc_hw->_nbands,
4807                  wlc_hw->sih->boardtype, macaddr);
4808
4809         return err;
4810
4811  fail:
4812         wiphy_err(wiphy, "wl%d: brcms_b_attach: failed with err %d\n", unit,
4813                   err);
4814         return err;
4815 }
4816
4817 static void brcms_c_attach_antgain_init(struct brcms_c_info *wlc)
4818 {
4819         uint unit;
4820         unit = wlc->pub->unit;
4821
4822         if ((wlc->band->antgain == -1) && (wlc->pub->sromrev == 1)) {
4823                 /* default antenna gain for srom rev 1 is 2 dBm (8 qdbm) */
4824                 wlc->band->antgain = 8;
4825         } else if (wlc->band->antgain == -1) {
4826                 wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
4827                           " srom, using 2dB\n", unit, __func__);
4828                 wlc->band->antgain = 8;
4829         } else {
4830                 s8 gain, fract;
4831                 /* Older sroms specified gain in whole dbm only.  In order
4832                  * be able to specify qdbm granularity and remain backward
4833                  * compatible the whole dbms are now encoded in only
4834                  * low 6 bits and remaining qdbms are encoded in the hi 2 bits.
4835                  * 6 bit signed number ranges from -32 - 31.
4836                  *
4837                  * Examples:
4838                  * 0x1 = 1 db,
4839                  * 0xc1 = 1.75 db (1 + 3 quarters),
4840                  * 0x3f = -1 (-1 + 0 quarters),
4841                  * 0x7f = -.75 (-1 + 1 quarters) = -3 qdbm.
4842                  * 0xbf = -.50 (-1 + 2 quarters) = -2 qdbm.
4843                  */
4844                 gain = wlc->band->antgain & 0x3f;
4845                 gain <<= 2;     /* Sign extend */
4846                 gain >>= 2;
4847                 fract = (wlc->band->antgain & 0xc0) >> 6;
4848                 wlc->band->antgain = 4 * gain + fract;
4849         }
4850 }
4851
4852 static bool brcms_c_attach_stf_ant_init(struct brcms_c_info *wlc)
4853 {
4854         int aa;
4855         uint unit;
4856         int bandtype;
4857         struct si_pub *sih = wlc->hw->sih;
4858
4859         unit = wlc->pub->unit;
4860         bandtype = wlc->band->bandtype;
4861
4862         /* get antennas available */
4863         if (bandtype == BRCM_BAND_5G)
4864                 aa = (s8) getintvar(sih, BRCMS_SROM_AA5G);
4865         else
4866                 aa = (s8) getintvar(sih, BRCMS_SROM_AA2G);
4867
4868         if ((aa < 1) || (aa > 15)) {
4869                 wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
4870                           " srom (0x%x), using 3\n", unit, __func__, aa);
4871                 aa = 3;
4872         }
4873
4874         /* reset the defaults if we have a single antenna */
4875         if (aa == 1) {
4876                 wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_0;
4877                 wlc->stf->txant = ANT_TX_FORCE_0;
4878         } else if (aa == 2) {
4879                 wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_1;
4880                 wlc->stf->txant = ANT_TX_FORCE_1;
4881         } else {
4882         }
4883
4884         /* Compute Antenna Gain */
4885         if (bandtype == BRCM_BAND_5G)
4886                 wlc->band->antgain = (s8) getintvar(sih, BRCMS_SROM_AG1);
4887         else
4888                 wlc->band->antgain = (s8) getintvar(sih, BRCMS_SROM_AG0);
4889
4890         brcms_c_attach_antgain_init(wlc);
4891
4892         return true;
4893 }
4894
4895 static void brcms_c_bss_default_init(struct brcms_c_info *wlc)
4896 {
4897         u16 chanspec;
4898         struct brcms_band *band;
4899         struct brcms_bss_info *bi = wlc->default_bss;
4900
4901         /* init default and target BSS with some sane initial values */
4902         memset((char *)(bi), 0, sizeof(struct brcms_bss_info));
4903         bi->beacon_period = BEACON_INTERVAL_DEFAULT;
4904
4905         /* fill the default channel as the first valid channel
4906          * starting from the 2G channels
4907          */
4908         chanspec = ch20mhz_chspec(1);
4909         wlc->home_chanspec = bi->chanspec = chanspec;
4910
4911         /* find the band of our default channel */
4912         band = wlc->band;
4913         if (wlc->pub->_nbands > 1 &&
4914             band->bandunit != chspec_bandunit(chanspec))
4915                 band = wlc->bandstate[OTHERBANDUNIT(wlc)];
4916
4917         /* init bss rates to the band specific default rate set */
4918         brcms_c_rateset_default(&bi->rateset, NULL, band->phytype,
4919                 band->bandtype, false, BRCMS_RATE_MASK_FULL,
4920                 (bool) (wlc->pub->_n_enab & SUPPORT_11N),
4921                 brcms_chspec_bw(chanspec), wlc->stf->txstreams);
4922
4923         if (wlc->pub->_n_enab & SUPPORT_11N)
4924                 bi->flags |= BRCMS_BSS_HT;
4925 }
4926
4927 static struct brcms_txq_info *brcms_c_txq_alloc(struct brcms_c_info *wlc)
4928 {
4929         struct brcms_txq_info *qi, *p;
4930
4931         qi = kzalloc(sizeof(struct brcms_txq_info), GFP_ATOMIC);
4932         if (qi != NULL) {
4933                 /*
4934                  * Have enough room for control packets along with HI watermark
4935                  * Also, add room to txq for total psq packets if all the SCBs
4936                  * leave PS mode. The watermark for flowcontrol to OS packets
4937                  * will remain the same
4938                  */
4939                 brcmu_pktq_init(&qi->q, BRCMS_PREC_COUNT,
4940                           2 * BRCMS_DATAHIWAT + PKTQ_LEN_DEFAULT);
4941
4942                 /* add this queue to the the global list */
4943                 p = wlc->tx_queues;
4944                 if (p == NULL) {
4945                         wlc->tx_queues = qi;
4946                 } else {
4947                         while (p->next != NULL)
4948                                 p = p->next;
4949                         p->next = qi;
4950                 }
4951         }
4952         return qi;
4953 }
4954
4955 static void brcms_c_txq_free(struct brcms_c_info *wlc,
4956                              struct brcms_txq_info *qi)
4957 {
4958         struct brcms_txq_info *p;
4959
4960         if (qi == NULL)
4961                 return;
4962
4963         /* remove the queue from the linked list */
4964         p = wlc->tx_queues;
4965         if (p == qi)
4966                 wlc->tx_queues = p->next;
4967         else {
4968                 while (p != NULL && p->next != qi)
4969                         p = p->next;
4970                 if (p != NULL)
4971                         p->next = p->next->next;
4972         }
4973
4974         kfree(qi);
4975 }
4976
4977 static void brcms_c_update_mimo_band_bwcap(struct brcms_c_info *wlc, u8 bwcap)
4978 {
4979         uint i;
4980         struct brcms_band *band;
4981
4982         for (i = 0; i < wlc->pub->_nbands; i++) {
4983                 band = wlc->bandstate[i];
4984                 if (band->bandtype == BRCM_BAND_5G) {
4985                         if ((bwcap == BRCMS_N_BW_40ALL)
4986                             || (bwcap == BRCMS_N_BW_20IN2G_40IN5G))
4987                                 band->mimo_cap_40 = true;
4988                         else
4989                                 band->mimo_cap_40 = false;
4990                 } else {
4991                         if (bwcap == BRCMS_N_BW_40ALL)
4992                                 band->mimo_cap_40 = true;
4993                         else
4994                                 band->mimo_cap_40 = false;
4995                 }
4996         }
4997 }
4998
4999 static void brcms_c_timers_deinit(struct brcms_c_info *wlc)
5000 {
5001         /* free timer state */
5002         if (wlc->wdtimer) {
5003                 brcms_free_timer(wlc->wdtimer);
5004                 wlc->wdtimer = NULL;
5005         }
5006         if (wlc->radio_timer) {
5007                 brcms_free_timer(wlc->radio_timer);
5008                 wlc->radio_timer = NULL;
5009         }
5010 }
5011
5012 static void brcms_c_detach_module(struct brcms_c_info *wlc)
5013 {
5014         if (wlc->asi) {
5015                 brcms_c_antsel_detach(wlc->asi);
5016                 wlc->asi = NULL;
5017         }
5018
5019         if (wlc->ampdu) {
5020                 brcms_c_ampdu_detach(wlc->ampdu);
5021                 wlc->ampdu = NULL;
5022         }
5023
5024         brcms_c_stf_detach(wlc);
5025 }
5026
5027 /*
5028  * low level detach
5029  */
5030 static int brcms_b_detach(struct brcms_c_info *wlc)
5031 {
5032         uint i;
5033         struct brcms_hw_band *band;
5034         struct brcms_hardware *wlc_hw = wlc->hw;
5035         int callbacks;
5036
5037         callbacks = 0;
5038
5039         if (wlc_hw->sih) {
5040                 /*
5041                  * detach interrupt sync mechanism since interrupt is disabled
5042                  * and per-port interrupt object may has been freed. this must
5043                  * be done before sb core switch
5044                  */
5045                 ai_deregister_intr_callback(wlc_hw->sih);
5046                 ai_pci_sleep(wlc_hw->sih);
5047         }
5048
5049         brcms_b_detach_dmapio(wlc_hw);
5050
5051         band = wlc_hw->band;
5052         for (i = 0; i < wlc_hw->_nbands; i++) {
5053                 if (band->pi) {
5054                         /* Detach this band's phy */
5055                         wlc_phy_detach(band->pi);
5056                         band->pi = NULL;
5057                 }
5058                 band = wlc_hw->bandstate[OTHERBANDUNIT(wlc)];
5059         }
5060
5061         /* Free shared phy state */
5062         kfree(wlc_hw->phy_sh);
5063
5064         wlc_phy_shim_detach(wlc_hw->physhim);
5065
5066         if (wlc_hw->sih) {
5067                 ai_detach(wlc_hw->sih);
5068                 wlc_hw->sih = NULL;
5069         }
5070
5071         return callbacks;
5072
5073 }
5074
5075 /*
5076  * Return a count of the number of driver callbacks still pending.
5077  *
5078  * General policy is that brcms_c_detach can only dealloc/free software states.
5079  * It can NOT touch hardware registers since the d11core may be in reset and
5080  * clock may not be available.
5081  * One exception is sb register access, which is possible if crystal is turned
5082  * on after "down" state, driver should avoid software timer with the exception
5083  * of radio_monitor.
5084  */
5085 uint brcms_c_detach(struct brcms_c_info *wlc)
5086 {
5087         uint callbacks = 0;
5088
5089         if (wlc == NULL)
5090                 return 0;
5091
5092         BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
5093
5094         callbacks += brcms_b_detach(wlc);
5095
5096         /* delete software timers */
5097         if (!brcms_c_radio_monitor_stop(wlc))
5098                 callbacks++;
5099
5100         brcms_c_channel_mgr_detach(wlc->cmi);
5101
5102         brcms_c_timers_deinit(wlc);
5103
5104         brcms_c_detach_module(wlc);
5105
5106
5107         while (wlc->tx_queues != NULL)
5108                 brcms_c_txq_free(wlc, wlc->tx_queues);
5109
5110         brcms_c_detach_mfree(wlc);
5111         return callbacks;
5112 }
5113
5114 /* update state that depends on the current value of "ap" */
5115 static void brcms_c_ap_upd(struct brcms_c_info *wlc)
5116 {
5117         /* STA-BSS; short capable */
5118         wlc->PLCPHdr_override = BRCMS_PLCP_SHORT;
5119 }
5120
5121 /* Initialize just the hardware when coming out of POR or S3/S5 system states */
5122 static void brcms_b_hw_up(struct brcms_hardware *wlc_hw)
5123 {
5124         if (wlc_hw->wlc->pub->hw_up)
5125                 return;
5126
5127         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
5128
5129         /*
5130          * Enable pll and xtal, initialize the power control registers,
5131          * and force fastclock for the remainder of brcms_c_up().
5132          */
5133         brcms_b_xtal(wlc_hw, ON);
5134         ai_clkctl_init(wlc_hw->sih);
5135         brcms_b_clkctl_clk(wlc_hw, CLK_FAST);
5136
5137         ai_pci_fixcfg(wlc_hw->sih);
5138
5139         /*
5140          * AI chip doesn't restore bar0win2 on
5141          * hibernation/resume, need sw fixup
5142          */
5143         if ((wlc_hw->sih->chip == BCM43224_CHIP_ID) ||
5144             (wlc_hw->sih->chip == BCM43225_CHIP_ID))
5145                 wlc_hw->regs = (struct d11regs __iomem *)
5146                                 ai_setcore(wlc_hw->sih, D11_CORE_ID, 0);
5147
5148         /*
5149          * Inform phy that a POR reset has occurred so
5150          * it does a complete phy init
5151          */
5152         wlc_phy_por_inform(wlc_hw->band->pi);
5153
5154         wlc_hw->ucode_loaded = false;
5155         wlc_hw->wlc->pub->hw_up = true;
5156
5157         if ((wlc_hw->boardflags & BFL_FEM)
5158             && (wlc_hw->sih->chip == BCM4313_CHIP_ID)) {
5159                 if (!
5160                     (wlc_hw->boardrev >= 0x1250
5161                      && (wlc_hw->boardflags & BFL_FEM_BT)))
5162                         ai_epa_4313war(wlc_hw->sih);
5163         }
5164 }
5165
5166 static int brcms_b_up_prep(struct brcms_hardware *wlc_hw)
5167 {
5168         uint coremask;
5169
5170         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
5171
5172         /*
5173          * Enable pll and xtal, initialize the power control registers,
5174          * and force fastclock for the remainder of brcms_c_up().
5175          */
5176         brcms_b_xtal(wlc_hw, ON);
5177         ai_clkctl_init(wlc_hw->sih);
5178         brcms_b_clkctl_clk(wlc_hw, CLK_FAST);
5179
5180         /*
5181          * Configure pci/pcmcia here instead of in brcms_c_attach()
5182          * to allow mfg hotswap:  down, hotswap (chip power cycle), up.
5183          */
5184         coremask = (1 << wlc_hw->wlc->core->coreidx);
5185
5186         ai_pci_setup(wlc_hw->sih, coremask);
5187
5188         /*
5189          * Need to read the hwradio status here to cover the case where the
5190          * system is loaded with the hw radio disabled. We do not want to
5191          * bring the driver up in this case.
5192          */
5193         if (brcms_b_radio_read_hwdisabled(wlc_hw)) {
5194                 /* put SB PCI in down state again */
5195                 ai_pci_down(wlc_hw->sih);
5196                 brcms_b_xtal(wlc_hw, OFF);
5197                 return -ENOMEDIUM;
5198         }
5199
5200         ai_pci_up(wlc_hw->sih);
5201
5202         /* reset the d11 core */
5203         brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
5204
5205         return 0;
5206 }
5207
5208 static int brcms_b_up_finish(struct brcms_hardware *wlc_hw)
5209 {
5210         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
5211
5212         wlc_hw->up = true;
5213         wlc_phy_hw_state_upd(wlc_hw->band->pi, true);
5214
5215         /* FULLY enable dynamic power control and d11 core interrupt */
5216         brcms_b_clkctl_clk(wlc_hw, CLK_DYNAMIC);
5217         brcms_intrson(wlc_hw->wlc->wl);
5218         return 0;
5219 }
5220
5221 /*
5222  * Write WME tunable parameters for retransmit/max rate
5223  * from wlc struct to ucode
5224  */
5225 static void brcms_c_wme_retries_write(struct brcms_c_info *wlc)
5226 {
5227         int ac;
5228
5229         /* Need clock to do this */
5230         if (!wlc->clk)
5231                 return;
5232
5233         for (ac = 0; ac < AC_COUNT; ac++)
5234                 brcms_b_write_shm(wlc->hw, M_AC_TXLMT_ADDR(ac),
5235                                   wlc->wme_retries[ac]);
5236 }
5237
5238 /* make interface operational */
5239 int brcms_c_up(struct brcms_c_info *wlc)
5240 {
5241         BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
5242
5243         /* HW is turned off so don't try to access it */
5244         if (wlc->pub->hw_off || brcms_deviceremoved(wlc))
5245                 return -ENOMEDIUM;
5246
5247         if (!wlc->pub->hw_up) {
5248                 brcms_b_hw_up(wlc->hw);
5249                 wlc->pub->hw_up = true;
5250         }
5251
5252         if ((wlc->pub->boardflags & BFL_FEM)
5253             && (wlc->pub->sih->chip == BCM4313_CHIP_ID)) {
5254                 if (wlc->pub->boardrev >= 0x1250
5255                     && (wlc->pub->boardflags & BFL_FEM_BT))
5256                         brcms_b_mhf(wlc->hw, MHF5, MHF5_4313_GPIOCTRL,
5257                                 MHF5_4313_GPIOCTRL, BRCM_BAND_ALL);
5258                 else
5259                         brcms_b_mhf(wlc->hw, MHF4, MHF4_EXTPA_ENABLE,
5260                                     MHF4_EXTPA_ENABLE, BRCM_BAND_ALL);
5261         }
5262
5263         /*
5264          * Need to read the hwradio status here to cover the case where the
5265          * system is loaded with the hw radio disabled. We do not want to bring
5266          * the driver up in this case. If radio is disabled, abort up, lower
5267          * power, start radio timer and return 0(for NDIS) don't call
5268          * radio_update to avoid looping brcms_c_up.
5269          *
5270          * brcms_b_up_prep() returns either 0 or -BCME_RADIOOFF only
5271          */
5272         if (!wlc->pub->radio_disabled) {
5273                 int status = brcms_b_up_prep(wlc->hw);
5274                 if (status == -ENOMEDIUM) {
5275                         if (!mboolisset
5276                             (wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE)) {
5277                                 struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
5278                                 mboolset(wlc->pub->radio_disabled,
5279                                          WL_RADIO_HW_DISABLE);
5280
5281                                 if (bsscfg->enable && bsscfg->BSS)
5282                                         wiphy_err(wlc->wiphy, "wl%d: up"
5283                                                   ": rfdisable -> "
5284                                                   "bsscfg_disable()\n",
5285                                                    wlc->pub->unit);
5286                         }
5287                 }
5288         }
5289
5290         if (wlc->pub->radio_disabled) {
5291                 brcms_c_radio_monitor_start(wlc);
5292                 return 0;
5293         }
5294
5295         /* brcms_b_up_prep has done brcms_c_corereset(). so clk is on, set it */
5296         wlc->clk = true;
5297
5298         brcms_c_radio_monitor_stop(wlc);
5299
5300         /* Set EDCF hostflags */
5301         brcms_b_mhf(wlc->hw, MHF1, MHF1_EDCF, MHF1_EDCF, BRCM_BAND_ALL);
5302
5303         brcms_init(wlc->wl);
5304         wlc->pub->up = true;
5305
5306         if (wlc->bandinit_pending) {
5307                 brcms_c_suspend_mac_and_wait(wlc);
5308                 brcms_c_set_chanspec(wlc, wlc->default_bss->chanspec);
5309                 wlc->bandinit_pending = false;
5310                 brcms_c_enable_mac(wlc);
5311         }
5312
5313         brcms_b_up_finish(wlc->hw);
5314
5315         /* Program the TX wme params with the current settings */
5316         brcms_c_wme_retries_write(wlc);
5317
5318         /* start one second watchdog timer */
5319         brcms_add_timer(wlc->wdtimer, TIMER_INTERVAL_WATCHDOG, true);
5320         wlc->WDarmed = true;
5321
5322         /* ensure antenna config is up to date */
5323         brcms_c_stf_phy_txant_upd(wlc);
5324         /* ensure LDPC config is in sync */
5325         brcms_c_ht_update_ldpc(wlc, wlc->stf->ldpc);
5326
5327         return 0;
5328 }
5329
5330 static uint brcms_c_down_del_timer(struct brcms_c_info *wlc)
5331 {
5332         uint callbacks = 0;
5333
5334         return callbacks;
5335 }
5336
5337 static int brcms_b_bmac_down_prep(struct brcms_hardware *wlc_hw)
5338 {
5339         bool dev_gone;
5340         uint callbacks = 0;
5341
5342         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
5343
5344         if (!wlc_hw->up)
5345                 return callbacks;
5346
5347         dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5348
5349         /* disable interrupts */
5350         if (dev_gone)
5351                 wlc_hw->wlc->macintmask = 0;
5352         else {
5353                 /* now disable interrupts */
5354                 brcms_intrsoff(wlc_hw->wlc->wl);
5355
5356                 /* ensure we're running on the pll clock again */
5357                 brcms_b_clkctl_clk(wlc_hw, CLK_FAST);
5358         }
5359         /* down phy at the last of this stage */
5360         callbacks += wlc_phy_down(wlc_hw->band->pi);
5361
5362         return callbacks;
5363 }
5364
5365 static int brcms_b_down_finish(struct brcms_hardware *wlc_hw)
5366 {
5367         uint callbacks = 0;
5368         bool dev_gone;
5369
5370         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
5371
5372         if (!wlc_hw->up)
5373                 return callbacks;
5374
5375         wlc_hw->up = false;
5376         wlc_phy_hw_state_upd(wlc_hw->band->pi, false);
5377
5378         dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5379
5380         if (dev_gone) {
5381                 wlc_hw->sbclk = false;
5382                 wlc_hw->clk = false;
5383                 wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
5384
5385                 /* reclaim any posted packets */
5386                 brcms_c_flushqueues(wlc_hw->wlc);
5387         } else {
5388
5389                 /* Reset and disable the core */
5390                 if (ai_iscoreup(wlc_hw->sih)) {
5391                         if (R_REG(&wlc_hw->regs->maccontrol) &
5392                             MCTL_EN_MAC)
5393                                 brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
5394                         callbacks += brcms_reset(wlc_hw->wlc->wl);
5395                         brcms_c_coredisable(wlc_hw);
5396                 }
5397
5398                 /* turn off primary xtal and pll */
5399                 if (!wlc_hw->noreset) {
5400                         ai_pci_down(wlc_hw->sih);
5401                         brcms_b_xtal(wlc_hw, OFF);
5402                 }
5403         }
5404
5405         return callbacks;
5406 }
5407
5408 /*
5409  * Mark the interface nonoperational, stop the software mechanisms,
5410  * disable the hardware, free any transient buffer state.
5411  * Return a count of the number of driver callbacks still pending.
5412  */
5413 uint brcms_c_down(struct brcms_c_info *wlc)
5414 {
5415
5416         uint callbacks = 0;
5417         int i;
5418         bool dev_gone = false;
5419         struct brcms_txq_info *qi;
5420
5421         BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
5422
5423         /* check if we are already in the going down path */
5424         if (wlc->going_down) {
5425                 wiphy_err(wlc->wiphy, "wl%d: %s: Driver going down so return"
5426                           "\n", wlc->pub->unit, __func__);
5427                 return 0;
5428         }
5429         if (!wlc->pub->up)
5430                 return callbacks;
5431
5432         wlc->going_down = true;
5433
5434         callbacks += brcms_b_bmac_down_prep(wlc->hw);
5435
5436         dev_gone = brcms_deviceremoved(wlc);
5437
5438         /* Call any registered down handlers */
5439         for (i = 0; i < BRCMS_MAXMODULES; i++) {
5440                 if (wlc->modulecb[i].down_fn)
5441                         callbacks +=
5442                             wlc->modulecb[i].down_fn(wlc->modulecb[i].hdl);
5443         }
5444
5445         /* cancel the watchdog timer */
5446         if (wlc->WDarmed) {
5447                 if (!brcms_del_timer(wlc->wdtimer))
5448                         callbacks++;
5449                 wlc->WDarmed = false;
5450         }
5451         /* cancel all other timers */
5452         callbacks += brcms_c_down_del_timer(wlc);
5453
5454         wlc->pub->up = false;
5455
5456         wlc_phy_mute_upd(wlc->band->pi, false, PHY_MUTE_ALL);
5457
5458         /* clear txq flow control */
5459         brcms_c_txflowcontrol_reset(wlc);
5460
5461         /* flush tx queues */
5462         for (qi = wlc->tx_queues; qi != NULL; qi = qi->next)
5463                 brcmu_pktq_flush(&qi->q, true, NULL, NULL);
5464
5465         callbacks += brcms_b_down_finish(wlc->hw);
5466
5467         /* brcms_b_down_finish has done brcms_c_coredisable(). so clk is off */
5468         wlc->clk = false;
5469
5470         wlc->going_down = false;
5471         return callbacks;
5472 }
5473
5474 /* Set the current gmode configuration */
5475 int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config)
5476 {
5477         int ret = 0;
5478         uint i;
5479         struct brcms_c_rateset rs;
5480         /* Default to 54g Auto */
5481         /* Advertise and use shortslot (-1/0/1 Auto/Off/On) */
5482         s8 shortslot = BRCMS_SHORTSLOT_AUTO;
5483         bool shortslot_restrict = false; /* Restrict association to stations
5484                                           * that support shortslot
5485                                           */
5486         bool ofdm_basic = false;        /* Make 6, 12, and 24 basic rates */
5487         /* Advertise and use short preambles (-1/0/1 Auto/Off/On) */
5488         int preamble = BRCMS_PLCP_LONG;
5489         bool preamble_restrict = false; /* Restrict association to stations
5490                                          * that support short preambles
5491                                          */
5492         struct brcms_band *band;
5493
5494         /* if N-support is enabled, allow Gmode set as long as requested
5495          * Gmode is not GMODE_LEGACY_B
5496          */
5497         if ((wlc->pub->_n_enab & SUPPORT_11N) && gmode == GMODE_LEGACY_B)
5498                 return -ENOTSUPP;
5499
5500         /* verify that we are dealing with 2G band and grab the band pointer */
5501         if (wlc->band->bandtype == BRCM_BAND_2G)
5502                 band = wlc->band;
5503         else if ((wlc->pub->_nbands > 1) &&
5504                  (wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype == BRCM_BAND_2G))
5505                 band = wlc->bandstate[OTHERBANDUNIT(wlc)];
5506         else
5507                 return -EINVAL;
5508
5509         /* Legacy or bust when no OFDM is supported by regulatory */
5510         if ((brcms_c_channel_locale_flags_in_band(wlc->cmi, band->bandunit) &
5511              BRCMS_NO_OFDM) && (gmode != GMODE_LEGACY_B))
5512                 return -EINVAL;
5513
5514         /* update configuration value */
5515         if (config == true)
5516                 brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER, gmode);
5517
5518         /* Clear rateset override */
5519         memset(&rs, 0, sizeof(struct brcms_c_rateset));
5520
5521         switch (gmode) {
5522         case GMODE_LEGACY_B:
5523                 shortslot = BRCMS_SHORTSLOT_OFF;
5524                 brcms_c_rateset_copy(&gphy_legacy_rates, &rs);
5525
5526                 break;
5527
5528         case GMODE_LRS:
5529                 break;
5530
5531         case GMODE_AUTO:
5532                 /* Accept defaults */
5533                 break;
5534
5535         case GMODE_ONLY:
5536                 ofdm_basic = true;
5537                 preamble = BRCMS_PLCP_SHORT;
5538                 preamble_restrict = true;
5539                 break;
5540
5541         case GMODE_PERFORMANCE:
5542                 shortslot = BRCMS_SHORTSLOT_ON;
5543                 shortslot_restrict = true;
5544                 ofdm_basic = true;
5545                 preamble = BRCMS_PLCP_SHORT;
5546                 preamble_restrict = true;
5547                 break;
5548
5549         default:
5550                 /* Error */
5551                 wiphy_err(wlc->wiphy, "wl%d: %s: invalid gmode %d\n",
5552                           wlc->pub->unit, __func__, gmode);
5553                 return -ENOTSUPP;
5554         }
5555
5556         band->gmode = gmode;
5557
5558         wlc->shortslot_override = shortslot;
5559
5560         /* Use the default 11g rateset */
5561         if (!rs.count)
5562                 brcms_c_rateset_copy(&cck_ofdm_rates, &rs);
5563
5564         if (ofdm_basic) {
5565                 for (i = 0; i < rs.count; i++) {
5566                         if (rs.rates[i] == BRCM_RATE_6M
5567                             || rs.rates[i] == BRCM_RATE_12M
5568                             || rs.rates[i] == BRCM_RATE_24M)
5569                                 rs.rates[i] |= BRCMS_RATE_FLAG;
5570                 }
5571         }
5572
5573         /* Set default bss rateset */
5574         wlc->default_bss->rateset.count = rs.count;
5575         memcpy(wlc->default_bss->rateset.rates, rs.rates,
5576                sizeof(wlc->default_bss->rateset.rates));
5577
5578         return ret;
5579 }
5580
5581 int brcms_c_set_nmode(struct brcms_c_info *wlc)
5582 {
5583         uint i;
5584         s32 nmode = AUTO;
5585
5586         if (wlc->stf->txstreams == WL_11N_3x3)
5587                 nmode = WL_11N_3x3;
5588         else
5589                 nmode = WL_11N_2x2;
5590
5591         /* force GMODE_AUTO if NMODE is ON */
5592         brcms_c_set_gmode(wlc, GMODE_AUTO, true);
5593         if (nmode == WL_11N_3x3)
5594                 wlc->pub->_n_enab = SUPPORT_HT;
5595         else
5596                 wlc->pub->_n_enab = SUPPORT_11N;
5597         wlc->default_bss->flags |= BRCMS_BSS_HT;
5598         /* add the mcs rates to the default and hw ratesets */
5599         brcms_c_rateset_mcs_build(&wlc->default_bss->rateset,
5600                               wlc->stf->txstreams);
5601         for (i = 0; i < wlc->pub->_nbands; i++)
5602                 memcpy(wlc->bandstate[i]->hw_rateset.mcs,
5603                        wlc->default_bss->rateset.mcs, MCSSET_LEN);
5604
5605         return 0;
5606 }
5607
5608 static int
5609 brcms_c_set_internal_rateset(struct brcms_c_info *wlc,
5610                              struct brcms_c_rateset *rs_arg)
5611 {
5612         struct brcms_c_rateset rs, new;
5613         uint bandunit;
5614
5615         memcpy(&rs, rs_arg, sizeof(struct brcms_c_rateset));
5616
5617         /* check for bad count value */
5618         if ((rs.count == 0) || (rs.count > BRCMS_NUMRATES))
5619                 return -EINVAL;
5620
5621         /* try the current band */
5622         bandunit = wlc->band->bandunit;
5623         memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5624         if (brcms_c_rate_hwrs_filter_sort_validate
5625             (&new, &wlc->bandstate[bandunit]->hw_rateset, true,
5626              wlc->stf->txstreams))
5627                 goto good;
5628
5629         /* try the other band */
5630         if (brcms_is_mband_unlocked(wlc)) {
5631                 bandunit = OTHERBANDUNIT(wlc);
5632                 memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5633                 if (brcms_c_rate_hwrs_filter_sort_validate(&new,
5634                                                        &wlc->
5635                                                        bandstate[bandunit]->
5636                                                        hw_rateset, true,
5637                                                        wlc->stf->txstreams))
5638                         goto good;
5639         }
5640
5641         return -EBADE;
5642
5643  good:
5644         /* apply new rateset */
5645         memcpy(&wlc->default_bss->rateset, &new,
5646                sizeof(struct brcms_c_rateset));
5647         memcpy(&wlc->bandstate[bandunit]->defrateset, &new,
5648                sizeof(struct brcms_c_rateset));
5649         return 0;
5650 }
5651
5652 static void brcms_c_ofdm_rateset_war(struct brcms_c_info *wlc)
5653 {
5654         u8 r;
5655         bool war = false;
5656
5657         if (wlc->bsscfg->associated)
5658                 r = wlc->bsscfg->current_bss->rateset.rates[0];
5659         else
5660                 r = wlc->default_bss->rateset.rates[0];
5661
5662         wlc_phy_ofdm_rateset_war(wlc->band->pi, war);
5663 }
5664
5665 int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel)
5666 {
5667         u16 chspec = ch20mhz_chspec(channel);
5668
5669         if (channel < 0 || channel > MAXCHANNEL)
5670                 return -EINVAL;
5671
5672         if (!brcms_c_valid_chanspec_db(wlc->cmi, chspec))
5673                 return -EINVAL;
5674
5675
5676         if (!wlc->pub->up && brcms_is_mband_unlocked(wlc)) {
5677                 if (wlc->band->bandunit != chspec_bandunit(chspec))
5678                         wlc->bandinit_pending = true;
5679                 else
5680                         wlc->bandinit_pending = false;
5681         }
5682
5683         wlc->default_bss->chanspec = chspec;
5684         /* brcms_c_BSSinit() will sanitize the rateset before
5685          * using it.. */
5686         if (wlc->pub->up && (wlc_phy_chanspec_get(wlc->band->pi) != chspec)) {
5687                 brcms_c_set_home_chanspec(wlc, chspec);
5688                 brcms_c_suspend_mac_and_wait(wlc);
5689                 brcms_c_set_chanspec(wlc, chspec);
5690                 brcms_c_enable_mac(wlc);
5691         }
5692         return 0;
5693 }
5694
5695 int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl)
5696 {
5697         int ac;
5698
5699         if (srl < 1 || srl > RETRY_SHORT_MAX ||
5700             lrl < 1 || lrl > RETRY_SHORT_MAX)
5701                 return -EINVAL;
5702
5703         wlc->SRL = srl;
5704         wlc->LRL = lrl;
5705
5706         brcms_b_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
5707
5708         for (ac = 0; ac < AC_COUNT; ac++) {
5709                 wlc->wme_retries[ac] =  SFIELD(wlc->wme_retries[ac],
5710                                                EDCF_SHORT,  wlc->SRL);
5711                 wlc->wme_retries[ac] =  SFIELD(wlc->wme_retries[ac],
5712                                                EDCF_LONG, wlc->LRL);
5713         }
5714         brcms_c_wme_retries_write(wlc);
5715
5716         return 0;
5717 }
5718
5719 void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
5720                                  struct brcm_rateset *currs)
5721 {
5722         struct brcms_c_rateset *rs;
5723
5724         if (wlc->pub->associated)
5725                 rs = &wlc->bsscfg->current_bss->rateset;
5726         else
5727                 rs = &wlc->default_bss->rateset;
5728
5729         /* Copy only legacy rateset section */
5730         currs->count = rs->count;
5731         memcpy(&currs->rates, &rs->rates, rs->count);
5732 }
5733
5734 int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
5735 {
5736         struct brcms_c_rateset internal_rs;
5737         int bcmerror;
5738
5739         if (rs->count > BRCMS_NUMRATES)
5740                 return -ENOBUFS;
5741
5742         memset(&internal_rs, 0, sizeof(struct brcms_c_rateset));
5743
5744         /* Copy only legacy rateset section */
5745         internal_rs.count = rs->count;
5746         memcpy(&internal_rs.rates, &rs->rates, internal_rs.count);
5747
5748         /* merge rateset coming in with the current mcsset */
5749         if (wlc->pub->_n_enab & SUPPORT_11N) {
5750                 struct brcms_bss_info *mcsset_bss;
5751                 if (wlc->bsscfg->associated)
5752                         mcsset_bss = wlc->bsscfg->current_bss;
5753                 else
5754                         mcsset_bss = wlc->default_bss;
5755                 memcpy(internal_rs.mcs, &mcsset_bss->rateset.mcs[0],
5756                        MCSSET_LEN);
5757         }
5758
5759         bcmerror = brcms_c_set_internal_rateset(wlc, &internal_rs);
5760         if (!bcmerror)
5761                 brcms_c_ofdm_rateset_war(wlc);
5762
5763         return bcmerror;
5764 }
5765
5766 int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
5767 {
5768         if (period < DOT11_MIN_BEACON_PERIOD ||
5769             period > DOT11_MAX_BEACON_PERIOD)
5770                 return -EINVAL;
5771
5772         wlc->default_bss->beacon_period = period;
5773         return 0;
5774 }
5775
5776 u16 brcms_c_get_phy_type(struct brcms_c_info *wlc, int phyidx)
5777 {
5778         return wlc->band->phytype;
5779 }
5780
5781 void brcms_c_set_shortslot_override(struct brcms_c_info *wlc, s8 sslot_override)
5782 {
5783         wlc->shortslot_override = sslot_override;
5784
5785         /*
5786          * shortslot is an 11g feature, so no more work if we are
5787          * currently on the 5G band
5788          */
5789         if (wlc->band->bandtype == BRCM_BAND_5G)
5790                 return;
5791
5792         if (wlc->pub->up && wlc->pub->associated) {
5793                 /* let watchdog or beacon processing update shortslot */
5794         } else if (wlc->pub->up) {
5795                 /* unassociated shortslot is off */
5796                 brcms_c_switch_shortslot(wlc, false);
5797         } else {
5798                 /* driver is down, so just update the brcms_c_info
5799                  * value */
5800                 if (wlc->shortslot_override == BRCMS_SHORTSLOT_AUTO)
5801                         wlc->shortslot = false;
5802                 else
5803                         wlc->shortslot =
5804                             (wlc->shortslot_override ==
5805                              BRCMS_SHORTSLOT_ON);
5806         }
5807 }
5808
5809 /*
5810  * register watchdog and down handlers.
5811  */
5812 int brcms_c_module_register(struct brcms_pub *pub,
5813                             const char *name, struct brcms_info *hdl,
5814                             int (*d_fn)(void *handle))
5815 {
5816         struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5817         int i;
5818
5819         /* find an empty entry and just add, no duplication check! */
5820         for (i = 0; i < BRCMS_MAXMODULES; i++) {
5821                 if (wlc->modulecb[i].name[0] == '\0') {
5822                         strncpy(wlc->modulecb[i].name, name,
5823                                 sizeof(wlc->modulecb[i].name) - 1);
5824                         wlc->modulecb[i].hdl = hdl;
5825                         wlc->modulecb[i].down_fn = d_fn;
5826                         return 0;
5827                 }
5828         }
5829
5830         return -ENOSR;
5831 }
5832
5833 /* unregister module callbacks */
5834 int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
5835                               struct brcms_info *hdl)
5836 {
5837         struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5838         int i;
5839
5840         if (wlc == NULL)
5841                 return -ENODATA;
5842
5843         for (i = 0; i < BRCMS_MAXMODULES; i++) {
5844                 if (!strcmp(wlc->modulecb[i].name, name) &&
5845                     (wlc->modulecb[i].hdl == hdl)) {
5846                         memset(&wlc->modulecb[i], 0, sizeof(struct modulecb));
5847                         return 0;
5848                 }
5849         }
5850
5851         /* table not found! */
5852         return -ENODATA;
5853 }
5854
5855 #ifdef BCMDBG
5856 static const char * const supr_reason[] = {
5857         "None", "PMQ Entry", "Flush request",
5858         "Previous frag failure", "Channel mismatch",
5859         "Lifetime Expiry", "Underflow"
5860 };
5861
5862 static void brcms_c_print_txs_status(u16 s)
5863 {
5864         printk(KERN_DEBUG "[15:12]  %d  frame attempts\n",
5865                (s & TX_STATUS_FRM_RTX_MASK) >> TX_STATUS_FRM_RTX_SHIFT);
5866         printk(KERN_DEBUG " [11:8]  %d  rts attempts\n",
5867                (s & TX_STATUS_RTS_RTX_MASK) >> TX_STATUS_RTS_RTX_SHIFT);
5868         printk(KERN_DEBUG "    [7]  %d  PM mode indicated\n",
5869                ((s & TX_STATUS_PMINDCTD) ? 1 : 0));
5870         printk(KERN_DEBUG "    [6]  %d  intermediate status\n",
5871                ((s & TX_STATUS_INTERMEDIATE) ? 1 : 0));
5872         printk(KERN_DEBUG "    [5]  %d  AMPDU\n",
5873                (s & TX_STATUS_AMPDU) ? 1 : 0);
5874         printk(KERN_DEBUG "  [4:2]  %d  Frame Suppressed Reason (%s)\n",
5875                ((s & TX_STATUS_SUPR_MASK) >> TX_STATUS_SUPR_SHIFT),
5876                supr_reason[(s & TX_STATUS_SUPR_MASK) >> TX_STATUS_SUPR_SHIFT]);
5877         printk(KERN_DEBUG "    [1]  %d  acked\n",
5878                ((s & TX_STATUS_ACK_RCV) ? 1 : 0));
5879 }
5880 #endif                          /* BCMDBG */
5881
5882 void brcms_c_print_txstatus(struct tx_status *txs)
5883 {
5884 #if defined(BCMDBG)
5885         u16 s = txs->status;
5886         u16 ackphyrxsh = txs->ackphyrxsh;
5887
5888         printk(KERN_DEBUG "\ntxpkt (MPDU) Complete\n");
5889
5890         printk(KERN_DEBUG "FrameID: %04x   ", txs->frameid);
5891         printk(KERN_DEBUG "TxStatus: %04x", s);
5892         printk(KERN_DEBUG "\n");
5893
5894         brcms_c_print_txs_status(s);
5895
5896         printk(KERN_DEBUG "LastTxTime: %04x ", txs->lasttxtime);
5897         printk(KERN_DEBUG "Seq: %04x ", txs->sequence);
5898         printk(KERN_DEBUG "PHYTxStatus: %04x ", txs->phyerr);
5899         printk(KERN_DEBUG "RxAckRSSI: %04x ",
5900                (ackphyrxsh & PRXS1_JSSI_MASK) >> PRXS1_JSSI_SHIFT);
5901         printk(KERN_DEBUG "RxAckSQ: %04x",
5902                (ackphyrxsh & PRXS1_SQ_MASK) >> PRXS1_SQ_SHIFT);
5903         printk(KERN_DEBUG "\n");
5904 #endif                          /* defined(BCMDBG) */
5905 }
5906
5907 bool brcms_c_chipmatch(u16 vendor, u16 device)
5908 {
5909         if (vendor != PCI_VENDOR_ID_BROADCOM) {
5910                 pr_err("chipmatch: unknown vendor id %04x\n", vendor);
5911                 return false;
5912         }
5913
5914         if (device == BCM43224_D11N_ID_VEN1)
5915                 return true;
5916         if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
5917                 return true;
5918         if (device == BCM4313_D11N2G_ID)
5919                 return true;
5920         if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
5921                 return true;
5922
5923         pr_err("chipmatch: unknown device id %04x\n", device);
5924         return false;
5925 }
5926
5927 #if defined(BCMDBG)
5928 void brcms_c_print_txdesc(struct d11txh *txh)
5929 {
5930         u16 mtcl = le16_to_cpu(txh->MacTxControlLow);
5931         u16 mtch = le16_to_cpu(txh->MacTxControlHigh);
5932         u16 mfc = le16_to_cpu(txh->MacFrameControl);
5933         u16 tfest = le16_to_cpu(txh->TxFesTimeNormal);
5934         u16 ptcw = le16_to_cpu(txh->PhyTxControlWord);
5935         u16 ptcw_1 = le16_to_cpu(txh->PhyTxControlWord_1);
5936         u16 ptcw_1_Fbr = le16_to_cpu(txh->PhyTxControlWord_1_Fbr);
5937         u16 ptcw_1_Rts = le16_to_cpu(txh->PhyTxControlWord_1_Rts);
5938         u16 ptcw_1_FbrRts = le16_to_cpu(txh->PhyTxControlWord_1_FbrRts);
5939         u16 mainrates = le16_to_cpu(txh->MainRates);
5940         u16 xtraft = le16_to_cpu(txh->XtraFrameTypes);
5941         u8 *iv = txh->IV;
5942         u8 *ra = txh->TxFrameRA;
5943         u16 tfestfb = le16_to_cpu(txh->TxFesTimeFallback);
5944         u8 *rtspfb = txh->RTSPLCPFallback;
5945         u16 rtsdfb = le16_to_cpu(txh->RTSDurFallback);
5946         u8 *fragpfb = txh->FragPLCPFallback;
5947         u16 fragdfb = le16_to_cpu(txh->FragDurFallback);
5948         u16 mmodelen = le16_to_cpu(txh->MModeLen);
5949         u16 mmodefbrlen = le16_to_cpu(txh->MModeFbrLen);
5950         u16 tfid = le16_to_cpu(txh->TxFrameID);
5951         u16 txs = le16_to_cpu(txh->TxStatus);
5952         u16 mnmpdu = le16_to_cpu(txh->MaxNMpdus);
5953         u16 mabyte = le16_to_cpu(txh->MaxABytes_MRT);
5954         u16 mabyte_f = le16_to_cpu(txh->MaxABytes_FBR);
5955         u16 mmbyte = le16_to_cpu(txh->MinMBytes);
5956
5957         u8 *rtsph = txh->RTSPhyHeader;
5958         struct ieee80211_rts rts = txh->rts_frame;
5959
5960         /* add plcp header along with txh descriptor */
5961         printk(KERN_DEBUG "Raw TxDesc + plcp header:\n");
5962         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
5963                              txh, sizeof(struct d11txh) + 48);
5964
5965         printk(KERN_DEBUG "TxCtlLow: %04x ", mtcl);
5966         printk(KERN_DEBUG "TxCtlHigh: %04x ", mtch);
5967         printk(KERN_DEBUG "FC: %04x ", mfc);
5968         printk(KERN_DEBUG "FES Time: %04x\n", tfest);
5969         printk(KERN_DEBUG "PhyCtl: %04x%s ", ptcw,
5970                (ptcw & PHY_TXC_SHORT_HDR) ? " short" : "");
5971         printk(KERN_DEBUG "PhyCtl_1: %04x ", ptcw_1);
5972         printk(KERN_DEBUG "PhyCtl_1_Fbr: %04x\n", ptcw_1_Fbr);
5973         printk(KERN_DEBUG "PhyCtl_1_Rts: %04x ", ptcw_1_Rts);
5974         printk(KERN_DEBUG "PhyCtl_1_Fbr_Rts: %04x\n", ptcw_1_FbrRts);
5975         printk(KERN_DEBUG "MainRates: %04x ", mainrates);
5976         printk(KERN_DEBUG "XtraFrameTypes: %04x ", xtraft);
5977         printk(KERN_DEBUG "\n");
5978
5979         print_hex_dump_bytes("SecIV:", DUMP_PREFIX_OFFSET, iv, sizeof(txh->IV));
5980         print_hex_dump_bytes("RA:", DUMP_PREFIX_OFFSET,
5981                              ra, sizeof(txh->TxFrameRA));
5982
5983         printk(KERN_DEBUG "Fb FES Time: %04x ", tfestfb);
5984         print_hex_dump_bytes("Fb RTS PLCP:", DUMP_PREFIX_OFFSET,
5985                              rtspfb, sizeof(txh->RTSPLCPFallback));
5986         printk(KERN_DEBUG "RTS DUR: %04x ", rtsdfb);
5987         print_hex_dump_bytes("PLCP:", DUMP_PREFIX_OFFSET,
5988                              fragpfb, sizeof(txh->FragPLCPFallback));
5989         printk(KERN_DEBUG "DUR: %04x", fragdfb);
5990         printk(KERN_DEBUG "\n");
5991
5992         printk(KERN_DEBUG "MModeLen: %04x ", mmodelen);
5993         printk(KERN_DEBUG "MModeFbrLen: %04x\n", mmodefbrlen);
5994
5995         printk(KERN_DEBUG "FrameID:     %04x\n", tfid);
5996         printk(KERN_DEBUG "TxStatus:    %04x\n", txs);
5997
5998         printk(KERN_DEBUG "MaxNumMpdu:  %04x\n", mnmpdu);
5999         printk(KERN_DEBUG "MaxAggbyte:  %04x\n", mabyte);
6000         printk(KERN_DEBUG "MaxAggbyte_fb:  %04x\n", mabyte_f);
6001         printk(KERN_DEBUG "MinByte:     %04x\n", mmbyte);
6002
6003         print_hex_dump_bytes("RTS PLCP:", DUMP_PREFIX_OFFSET,
6004                              rtsph, sizeof(txh->RTSPhyHeader));
6005         print_hex_dump_bytes("RTS Frame:", DUMP_PREFIX_OFFSET,
6006                              (u8 *)&rts, sizeof(txh->rts_frame));
6007         printk(KERN_DEBUG "\n");
6008 }
6009 #endif                          /* defined(BCMDBG) */
6010
6011 #if defined(BCMDBG)
6012 static int
6013 brcms_c_format_flags(const struct brcms_c_bit_desc *bd, u32 flags, char *buf,
6014                      int len)
6015 {
6016         int i;
6017         char *p = buf;
6018         char hexstr[16];
6019         int slen = 0, nlen = 0;
6020         u32 bit;
6021         const char *name;
6022
6023         if (len < 2 || !buf)
6024                 return 0;
6025
6026         buf[0] = '\0';
6027
6028         for (i = 0; flags != 0; i++) {
6029                 bit = bd[i].bit;
6030                 name = bd[i].name;
6031                 if (bit == 0 && flags != 0) {
6032                         /* print any unnamed bits */
6033                         snprintf(hexstr, 16, "0x%X", flags);
6034                         name = hexstr;
6035                         flags = 0;      /* exit loop */
6036                 } else if ((flags & bit) == 0)
6037                         continue;
6038                 flags &= ~bit;
6039                 nlen = strlen(name);
6040                 slen += nlen;
6041                 /* count btwn flag space */
6042                 if (flags != 0)
6043                         slen += 1;
6044                 /* need NULL char as well */
6045                 if (len <= slen)
6046                         break;
6047                 /* copy NULL char but don't count it */
6048                 strncpy(p, name, nlen + 1);
6049                 p += nlen;
6050                 /* copy btwn flag space and NULL char */
6051                 if (flags != 0)
6052                         p += snprintf(p, 2, " ");
6053                 len -= slen;
6054         }
6055
6056         /* indicate the str was too short */
6057         if (flags != 0) {
6058                 if (len < 2)
6059                         p -= 2 - len;   /* overwrite last char */
6060                 p += snprintf(p, 2, ">");
6061         }
6062
6063         return (int)(p - buf);
6064 }
6065 #endif                          /* defined(BCMDBG) */
6066
6067 #if defined(BCMDBG)
6068 void brcms_c_print_rxh(struct d11rxhdr *rxh)
6069 {
6070         u16 len = rxh->RxFrameSize;
6071         u16 phystatus_0 = rxh->PhyRxStatus_0;
6072         u16 phystatus_1 = rxh->PhyRxStatus_1;
6073         u16 phystatus_2 = rxh->PhyRxStatus_2;
6074         u16 phystatus_3 = rxh->PhyRxStatus_3;
6075         u16 macstatus1 = rxh->RxStatus1;
6076         u16 macstatus2 = rxh->RxStatus2;
6077         char flagstr[64];
6078         char lenbuf[20];
6079         static const struct brcms_c_bit_desc macstat_flags[] = {
6080                 {RXS_FCSERR, "FCSErr"},
6081                 {RXS_RESPFRAMETX, "Reply"},
6082                 {RXS_PBPRES, "PADDING"},
6083                 {RXS_DECATMPT, "DeCr"},
6084                 {RXS_DECERR, "DeCrErr"},
6085                 {RXS_BCNSENT, "Bcn"},
6086                 {0, NULL}
6087         };
6088
6089         printk(KERN_DEBUG "Raw RxDesc:\n");
6090         print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, rxh,
6091                              sizeof(struct d11rxhdr));
6092
6093         brcms_c_format_flags(macstat_flags, macstatus1, flagstr, 64);
6094
6095         snprintf(lenbuf, sizeof(lenbuf), "0x%x", len);
6096
6097         printk(KERN_DEBUG "RxFrameSize:     %6s (%d)%s\n", lenbuf, len,
6098                (rxh->PhyRxStatus_0 & PRXS0_SHORTH) ? " short preamble" : "");
6099         printk(KERN_DEBUG "RxPHYStatus:     %04x %04x %04x %04x\n",
6100                phystatus_0, phystatus_1, phystatus_2, phystatus_3);
6101         printk(KERN_DEBUG "RxMACStatus:     %x %s\n", macstatus1, flagstr);
6102         printk(KERN_DEBUG "RXMACaggtype:    %x\n",
6103                (macstatus2 & RXS_AGGTYPE_MASK));
6104         printk(KERN_DEBUG "RxTSFTime:       %04x\n", rxh->RxTSFTime);
6105 }
6106 #endif                          /* defined(BCMDBG) */
6107
6108 u16 brcms_b_rate_shm_offset(struct brcms_hardware *wlc_hw, u8 rate)
6109 {
6110         u16 table_ptr;
6111         u8 phy_rate, index;
6112
6113         /* get the phy specific rate encoding for the PLCP SIGNAL field */
6114         if (is_ofdm_rate(rate))
6115                 table_ptr = M_RT_DIRMAP_A;
6116         else
6117                 table_ptr = M_RT_DIRMAP_B;
6118
6119         /* for a given rate, the LS-nibble of the PLCP SIGNAL field is
6120          * the index into the rate table.
6121          */
6122         phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
6123         index = phy_rate & 0xf;
6124
6125         /* Find the SHM pointer to the rate table entry by looking in the
6126          * Direct-map Table
6127          */
6128         return 2 * brcms_b_read_shm(wlc_hw, table_ptr + (index * 2));
6129 }
6130
6131 static bool
6132 brcms_c_prec_enq_head(struct brcms_c_info *wlc, struct pktq *q,
6133                       struct sk_buff *pkt, int prec, bool head)
6134 {
6135         struct sk_buff *p;
6136         int eprec = -1;         /* precedence to evict from */
6137
6138         /* Determine precedence from which to evict packet, if any */
6139         if (pktq_pfull(q, prec))
6140                 eprec = prec;
6141         else if (pktq_full(q)) {
6142                 p = brcmu_pktq_peek_tail(q, &eprec);
6143                 if (eprec > prec) {
6144                         wiphy_err(wlc->wiphy, "%s: Failing: eprec %d > prec %d"
6145                                   "\n", __func__, eprec, prec);
6146                         return false;
6147                 }
6148         }
6149
6150         /* Evict if needed */
6151         if (eprec >= 0) {
6152                 bool discard_oldest;
6153
6154                 discard_oldest = ac_bitmap_tst(0, eprec);
6155
6156                 /* Refuse newer packet unless configured to discard oldest */
6157                 if (eprec == prec && !discard_oldest) {
6158                         wiphy_err(wlc->wiphy, "%s: No where to go, prec == %d"
6159                                   "\n", __func__, prec);
6160                         return false;
6161                 }
6162
6163                 /* Evict packet according to discard policy */
6164                 p = discard_oldest ? brcmu_pktq_pdeq(q, eprec) :
6165                         brcmu_pktq_pdeq_tail(q, eprec);
6166                 brcmu_pkt_buf_free_skb(p);
6167         }
6168
6169         /* Enqueue */
6170         if (head)
6171                 p = brcmu_pktq_penq_head(q, prec, pkt);
6172         else
6173                 p = brcmu_pktq_penq(q, prec, pkt);
6174
6175         return true;
6176 }
6177
6178 /*
6179  * Attempts to queue a packet onto a multiple-precedence queue,
6180  * if necessary evicting a lower precedence packet from the queue.
6181  *
6182  * 'prec' is the precedence number that has already been mapped
6183  * from the packet priority.
6184  *
6185  * Returns true if packet consumed (queued), false if not.
6186  */
6187 static bool brcms_c_prec_enq(struct brcms_c_info *wlc, struct pktq *q,
6188                       struct sk_buff *pkt, int prec)
6189 {
6190         return brcms_c_prec_enq_head(wlc, q, pkt, prec, false);
6191 }
6192
6193 void brcms_c_txq_enq(struct brcms_c_info *wlc, struct scb *scb,
6194                      struct sk_buff *sdu, uint prec)
6195 {
6196         struct brcms_txq_info *qi = wlc->pkt_queue;     /* Check me */
6197         struct pktq *q = &qi->q;
6198         int prio;
6199
6200         prio = sdu->priority;
6201
6202         if (!brcms_c_prec_enq(wlc, q, sdu, prec)) {
6203                 /*
6204                  * we might hit this condtion in case
6205                  * packet flooding from mac80211 stack
6206                  */
6207                 brcmu_pkt_buf_free_skb(sdu);
6208         }
6209 }
6210
6211 /*
6212  * bcmc_fid_generate:
6213  * Generate frame ID for a BCMC packet.  The frag field is not used
6214  * for MC frames so is used as part of the sequence number.
6215  */
6216 static inline u16
6217 bcmc_fid_generate(struct brcms_c_info *wlc, struct brcms_bss_cfg *bsscfg,
6218                   struct d11txh *txh)
6219 {
6220         u16 frameid;
6221
6222         frameid = le16_to_cpu(txh->TxFrameID) & ~(TXFID_SEQ_MASK |
6223                                                   TXFID_QUEUE_MASK);
6224         frameid |=
6225             (((wlc->
6226                mc_fid_counter++) << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
6227             TX_BCMC_FIFO;
6228
6229         return frameid;
6230 }
6231
6232 static uint
6233 brcms_c_calc_ack_time(struct brcms_c_info *wlc, u32 rspec,
6234                       u8 preamble_type)
6235 {
6236         uint dur = 0;
6237
6238         BCMMSG(wlc->wiphy, "wl%d: rspec 0x%x, preamble_type %d\n",
6239                 wlc->pub->unit, rspec, preamble_type);
6240         /*
6241          * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
6242          * is less than or equal to the rate of the immediately previous
6243          * frame in the FES
6244          */
6245         rspec = brcms_basic_rate(wlc, rspec);
6246         /* ACK frame len == 14 == 2(fc) + 2(dur) + 6(ra) + 4(fcs) */
6247         dur =
6248             brcms_c_calc_frame_time(wlc, rspec, preamble_type,
6249                                 (DOT11_ACK_LEN + FCS_LEN));
6250         return dur;
6251 }
6252
6253 static uint
6254 brcms_c_calc_cts_time(struct brcms_c_info *wlc, u32 rspec,
6255                       u8 preamble_type)
6256 {
6257         BCMMSG(wlc->wiphy, "wl%d: ratespec 0x%x, preamble_type %d\n",
6258                 wlc->pub->unit, rspec, preamble_type);
6259         return brcms_c_calc_ack_time(wlc, rspec, preamble_type);
6260 }
6261
6262 static uint
6263 brcms_c_calc_ba_time(struct brcms_c_info *wlc, u32 rspec,
6264                      u8 preamble_type)
6265 {
6266         BCMMSG(wlc->wiphy, "wl%d: rspec 0x%x, "
6267                  "preamble_type %d\n", wlc->pub->unit, rspec, preamble_type);
6268         /*
6269          * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
6270          * is less than or equal to the rate of the immediately previous
6271          * frame in the FES
6272          */
6273         rspec = brcms_basic_rate(wlc, rspec);
6274         /* BA len == 32 == 16(ctl hdr) + 4(ba len) + 8(bitmap) + 4(fcs) */
6275         return brcms_c_calc_frame_time(wlc, rspec, preamble_type,
6276                                    (DOT11_BA_LEN + DOT11_BA_BITMAP_LEN +
6277                                     FCS_LEN));
6278 }
6279
6280 /* brcms_c_compute_frame_dur()
6281  *
6282  * Calculate the 802.11 MAC header DUR field for MPDU
6283  * DUR for a single frame = 1 SIFS + 1 ACK
6284  * DUR for a frame with following frags = 3 SIFS + 2 ACK + next frag time
6285  *
6286  * rate                 MPDU rate in unit of 500kbps
6287  * next_frag_len        next MPDU length in bytes
6288  * preamble_type        use short/GF or long/MM PLCP header
6289  */
6290 static u16
6291 brcms_c_compute_frame_dur(struct brcms_c_info *wlc, u32 rate,
6292                       u8 preamble_type, uint next_frag_len)
6293 {
6294         u16 dur, sifs;
6295
6296         sifs = get_sifs(wlc->band);
6297
6298         dur = sifs;
6299         dur += (u16) brcms_c_calc_ack_time(wlc, rate, preamble_type);
6300
6301         if (next_frag_len) {
6302                 /* Double the current DUR to get 2 SIFS + 2 ACKs */
6303                 dur *= 2;
6304                 /* add another SIFS and the frag time */
6305                 dur += sifs;
6306                 dur +=
6307                     (u16) brcms_c_calc_frame_time(wlc, rate, preamble_type,
6308                                                  next_frag_len);
6309         }
6310         return dur;
6311 }
6312
6313 /* The opposite of brcms_c_calc_frame_time */
6314 static uint
6315 brcms_c_calc_frame_len(struct brcms_c_info *wlc, u32 ratespec,
6316                    u8 preamble_type, uint dur)
6317 {
6318         uint nsyms, mac_len, Ndps, kNdps;
6319         uint rate = rspec2rate(ratespec);
6320
6321         BCMMSG(wlc->wiphy, "wl%d: rspec 0x%x, preamble_type %d, dur %d\n",
6322                  wlc->pub->unit, ratespec, preamble_type, dur);
6323
6324         if (is_mcs_rate(ratespec)) {
6325                 uint mcs = ratespec & RSPEC_RATE_MASK;
6326                 int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
6327                 dur -= PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
6328                 /* payload calculation matches that of regular ofdm */
6329                 if (wlc->band->bandtype == BRCM_BAND_2G)
6330                         dur -= DOT11_OFDM_SIGNAL_EXTENSION;
6331                 /* kNdbps = kbps * 4 */
6332                 kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
6333                                    rspec_issgi(ratespec)) * 4;
6334                 nsyms = dur / APHY_SYMBOL_TIME;
6335                 mac_len =
6336                     ((nsyms * kNdps) -
6337                      ((APHY_SERVICE_NBITS + APHY_TAIL_NBITS) * 1000)) / 8000;
6338         } else if (is_ofdm_rate(ratespec)) {
6339                 dur -= APHY_PREAMBLE_TIME;
6340                 dur -= APHY_SIGNAL_TIME;
6341                 /* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
6342                 Ndps = rate * 2;
6343                 nsyms = dur / APHY_SYMBOL_TIME;
6344                 mac_len =
6345                     ((nsyms * Ndps) -
6346                      (APHY_SERVICE_NBITS + APHY_TAIL_NBITS)) / 8;
6347         } else {
6348                 if (preamble_type & BRCMS_SHORT_PREAMBLE)
6349                         dur -= BPHY_PLCP_SHORT_TIME;
6350                 else
6351                         dur -= BPHY_PLCP_TIME;
6352                 mac_len = dur * rate;
6353                 /* divide out factor of 2 in rate (1/2 mbps) */
6354                 mac_len = mac_len / 8 / 2;
6355         }
6356         return mac_len;
6357 }
6358
6359 /*
6360  * Return true if the specified rate is supported by the specified band.
6361  * BRCM_BAND_AUTO indicates the current band.
6362  */
6363 static bool brcms_c_valid_rate(struct brcms_c_info *wlc, u32 rspec, int band,
6364                     bool verbose)
6365 {
6366         struct brcms_c_rateset *hw_rateset;
6367         uint i;
6368
6369         if ((band == BRCM_BAND_AUTO) || (band == wlc->band->bandtype))
6370                 hw_rateset = &wlc->band->hw_rateset;
6371         else if (wlc->pub->_nbands > 1)
6372                 hw_rateset = &wlc->bandstate[OTHERBANDUNIT(wlc)]->hw_rateset;
6373         else
6374                 /* other band specified and we are a single band device */
6375                 return false;
6376
6377         /* check if this is a mimo rate */
6378         if (is_mcs_rate(rspec)) {
6379                 if ((rspec & RSPEC_RATE_MASK) >= MCS_TABLE_SIZE)
6380                         goto error;
6381
6382                 return isset(hw_rateset->mcs, (rspec & RSPEC_RATE_MASK));
6383         }
6384
6385         for (i = 0; i < hw_rateset->count; i++)
6386                 if (hw_rateset->rates[i] == rspec2rate(rspec))
6387                         return true;
6388  error:
6389         if (verbose)
6390                 wiphy_err(wlc->wiphy, "wl%d: valid_rate: rate spec 0x%x "
6391                           "not in hw_rateset\n", wlc->pub->unit, rspec);
6392
6393         return false;
6394 }
6395
6396 static u32
6397 mac80211_wlc_set_nrate(struct brcms_c_info *wlc, struct brcms_band *cur_band,
6398                        u32 int_val)
6399 {
6400         u8 stf = (int_val & NRATE_STF_MASK) >> NRATE_STF_SHIFT;
6401         u8 rate = int_val & NRATE_RATE_MASK;
6402         u32 rspec;
6403         bool ismcs = ((int_val & NRATE_MCS_INUSE) == NRATE_MCS_INUSE);
6404         bool issgi = ((int_val & NRATE_SGI_MASK) >> NRATE_SGI_SHIFT);
6405         bool override_mcs_only = ((int_val & NRATE_OVERRIDE_MCS_ONLY)
6406                                   == NRATE_OVERRIDE_MCS_ONLY);
6407         int bcmerror = 0;
6408
6409         if (!ismcs)
6410                 return (u32) rate;
6411
6412         /* validate the combination of rate/mcs/stf is allowed */
6413         if ((wlc->pub->_n_enab & SUPPORT_11N) && ismcs) {
6414                 /* mcs only allowed when nmode */
6415                 if (stf > PHY_TXC1_MODE_SDM) {
6416                         wiphy_err(wlc->wiphy, "wl%d: %s: Invalid stf\n",
6417                                   wlc->pub->unit, __func__);
6418                         bcmerror = -EINVAL;
6419                         goto done;
6420                 }
6421
6422                 /* mcs 32 is a special case, DUP mode 40 only */
6423                 if (rate == 32) {
6424                         if (!CHSPEC_IS40(wlc->home_chanspec) ||
6425                             ((stf != PHY_TXC1_MODE_SISO)
6426                              && (stf != PHY_TXC1_MODE_CDD))) {
6427                                 wiphy_err(wlc->wiphy, "wl%d: %s: Invalid mcs "
6428                                           "32\n", wlc->pub->unit, __func__);
6429                                 bcmerror = -EINVAL;
6430                                 goto done;
6431                         }
6432                         /* mcs > 7 must use stf SDM */
6433                 } else if (rate > HIGHEST_SINGLE_STREAM_MCS) {
6434                         /* mcs > 7 must use stf SDM */
6435                         if (stf != PHY_TXC1_MODE_SDM) {
6436                                 BCMMSG(wlc->wiphy, "wl%d: enabling "
6437                                        "SDM mode for mcs %d\n",
6438                                        wlc->pub->unit, rate);
6439                                 stf = PHY_TXC1_MODE_SDM;
6440                         }
6441                 } else {
6442                         /*
6443                          * MCS 0-7 may use SISO, CDD, and for
6444                          * phy_rev >= 3 STBC
6445                          */
6446                         if ((stf > PHY_TXC1_MODE_STBC) ||
6447                             (!BRCMS_STBC_CAP_PHY(wlc)
6448                              && (stf == PHY_TXC1_MODE_STBC))) {
6449                                 wiphy_err(wlc->wiphy, "wl%d: %s: Invalid STBC"
6450                                           "\n", wlc->pub->unit, __func__);
6451                                 bcmerror = -EINVAL;
6452                                 goto done;
6453                         }
6454                 }
6455         } else if (is_ofdm_rate(rate)) {
6456                 if ((stf != PHY_TXC1_MODE_CDD) && (stf != PHY_TXC1_MODE_SISO)) {
6457                         wiphy_err(wlc->wiphy, "wl%d: %s: Invalid OFDM\n",
6458                                   wlc->pub->unit, __func__);
6459                         bcmerror = -EINVAL;
6460                         goto done;
6461                 }
6462         } else if (is_cck_rate(rate)) {
6463                 if ((cur_band->bandtype != BRCM_BAND_2G)
6464                     || (stf != PHY_TXC1_MODE_SISO)) {
6465                         wiphy_err(wlc->wiphy, "wl%d: %s: Invalid CCK\n",
6466                                   wlc->pub->unit, __func__);
6467                         bcmerror = -EINVAL;
6468                         goto done;
6469                 }
6470         } else {
6471                 wiphy_err(wlc->wiphy, "wl%d: %s: Unknown rate type\n",
6472                           wlc->pub->unit, __func__);
6473                 bcmerror = -EINVAL;
6474                 goto done;
6475         }
6476         /* make sure multiple antennae are available for non-siso rates */
6477         if ((stf != PHY_TXC1_MODE_SISO) && (wlc->stf->txstreams == 1)) {
6478                 wiphy_err(wlc->wiphy, "wl%d: %s: SISO antenna but !SISO "
6479                           "request\n", wlc->pub->unit, __func__);
6480                 bcmerror = -EINVAL;
6481                 goto done;
6482         }
6483
6484         rspec = rate;
6485         if (ismcs) {
6486                 rspec |= RSPEC_MIMORATE;
6487                 /* For STBC populate the STC field of the ratespec */
6488                 if (stf == PHY_TXC1_MODE_STBC) {
6489                         u8 stc;
6490                         stc = 1;        /* Nss for single stream is always 1 */
6491                         rspec |= (stc << RSPEC_STC_SHIFT);
6492                 }
6493         }
6494
6495         rspec |= (stf << RSPEC_STF_SHIFT);
6496
6497         if (override_mcs_only)
6498                 rspec |= RSPEC_OVERRIDE_MCS_ONLY;
6499
6500         if (issgi)
6501                 rspec |= RSPEC_SHORT_GI;
6502
6503         if ((rate != 0)
6504             && !brcms_c_valid_rate(wlc, rspec, cur_band->bandtype, true))
6505                 return rate;
6506
6507         return rspec;
6508 done:
6509         return rate;
6510 }
6511
6512 /*
6513  * Compute PLCP, but only requires actual rate and length of pkt.
6514  * Rate is given in the driver standard multiple of 500 kbps.
6515  * le is set for 11 Mbps rate if necessary.
6516  * Broken out for PRQ.
6517  */
6518
6519 static void brcms_c_cck_plcp_set(struct brcms_c_info *wlc, int rate_500,
6520                              uint length, u8 *plcp)
6521 {
6522         u16 usec = 0;
6523         u8 le = 0;
6524
6525         switch (rate_500) {
6526         case BRCM_RATE_1M:
6527                 usec = length << 3;
6528                 break;
6529         case BRCM_RATE_2M:
6530                 usec = length << 2;
6531                 break;
6532         case BRCM_RATE_5M5:
6533                 usec = (length << 4) / 11;
6534                 if ((length << 4) - (usec * 11) > 0)
6535                         usec++;
6536                 break;
6537         case BRCM_RATE_11M:
6538                 usec = (length << 3) / 11;
6539                 if ((length << 3) - (usec * 11) > 0) {
6540                         usec++;
6541                         if ((usec * 11) - (length << 3) >= 8)
6542                                 le = D11B_PLCP_SIGNAL_LE;
6543                 }
6544                 break;
6545
6546         default:
6547                 wiphy_err(wlc->wiphy,
6548                           "brcms_c_cck_plcp_set: unsupported rate %d\n",
6549                           rate_500);
6550                 rate_500 = BRCM_RATE_1M;
6551                 usec = length << 3;
6552                 break;
6553         }
6554         /* PLCP signal byte */
6555         plcp[0] = rate_500 * 5; /* r (500kbps) * 5 == r (100kbps) */
6556         /* PLCP service byte */
6557         plcp[1] = (u8) (le | D11B_PLCP_SIGNAL_LOCKED);
6558         /* PLCP length u16, little endian */
6559         plcp[2] = usec & 0xff;
6560         plcp[3] = (usec >> 8) & 0xff;
6561         /* PLCP CRC16 */
6562         plcp[4] = 0;
6563         plcp[5] = 0;
6564 }
6565
6566 /* Rate: 802.11 rate code, length: PSDU length in octets */
6567 static void brcms_c_compute_mimo_plcp(u32 rspec, uint length, u8 *plcp)
6568 {
6569         u8 mcs = (u8) (rspec & RSPEC_RATE_MASK);
6570         plcp[0] = mcs;
6571         if (rspec_is40mhz(rspec) || (mcs == 32))
6572                 plcp[0] |= MIMO_PLCP_40MHZ;
6573         BRCMS_SET_MIMO_PLCP_LEN(plcp, length);
6574         plcp[3] = rspec_mimoplcp3(rspec); /* rspec already holds this byte */
6575         plcp[3] |= 0x7; /* set smoothing, not sounding ppdu & reserved */
6576         plcp[4] = 0; /* number of extension spatial streams bit 0 & 1 */
6577         plcp[5] = 0;
6578 }
6579
6580 /* Rate: 802.11 rate code, length: PSDU length in octets */
6581 static void
6582 brcms_c_compute_ofdm_plcp(u32 rspec, u32 length, u8 *plcp)
6583 {
6584         u8 rate_signal;
6585         u32 tmp = 0;
6586         int rate = rspec2rate(rspec);
6587
6588         /*
6589          * encode rate per 802.11a-1999 sec 17.3.4.1, with lsb
6590          * transmitted first
6591          */
6592         rate_signal = rate_info[rate] & BRCMS_RATE_MASK;
6593         memset(plcp, 0, D11_PHY_HDR_LEN);
6594         D11A_PHY_HDR_SRATE((struct ofdm_phy_hdr *) plcp, rate_signal);
6595
6596         tmp = (length & 0xfff) << 5;
6597         plcp[2] |= (tmp >> 16) & 0xff;
6598         plcp[1] |= (tmp >> 8) & 0xff;
6599         plcp[0] |= tmp & 0xff;
6600 }
6601
6602 /* Rate: 802.11 rate code, length: PSDU length in octets */
6603 static void brcms_c_compute_cck_plcp(struct brcms_c_info *wlc, u32 rspec,
6604                                  uint length, u8 *plcp)
6605 {
6606         int rate = rspec2rate(rspec);
6607
6608         brcms_c_cck_plcp_set(wlc, rate, length, plcp);
6609 }
6610
6611 static void
6612 brcms_c_compute_plcp(struct brcms_c_info *wlc, u32 rspec,
6613                      uint length, u8 *plcp)
6614 {
6615         if (is_mcs_rate(rspec))
6616                 brcms_c_compute_mimo_plcp(rspec, length, plcp);
6617         else if (is_ofdm_rate(rspec))
6618                 brcms_c_compute_ofdm_plcp(rspec, length, plcp);
6619         else
6620                 brcms_c_compute_cck_plcp(wlc, rspec, length, plcp);
6621 }
6622
6623 /* brcms_c_compute_rtscts_dur()
6624  *
6625  * Calculate the 802.11 MAC header DUR field for an RTS or CTS frame
6626  * DUR for normal RTS/CTS w/ frame = 3 SIFS + 1 CTS + next frame time + 1 ACK
6627  * DUR for CTS-TO-SELF w/ frame    = 2 SIFS         + next frame time + 1 ACK
6628  *
6629  * cts                  cts-to-self or rts/cts
6630  * rts_rate             rts or cts rate in unit of 500kbps
6631  * rate                 next MPDU rate in unit of 500kbps
6632  * frame_len            next MPDU frame length in bytes
6633  */
6634 u16
6635 brcms_c_compute_rtscts_dur(struct brcms_c_info *wlc, bool cts_only,
6636                            u32 rts_rate,
6637                            u32 frame_rate, u8 rts_preamble_type,
6638                            u8 frame_preamble_type, uint frame_len, bool ba)
6639 {
6640         u16 dur, sifs;
6641
6642         sifs = get_sifs(wlc->band);
6643
6644         if (!cts_only) {
6645                 /* RTS/CTS */
6646                 dur = 3 * sifs;
6647                 dur +=
6648                     (u16) brcms_c_calc_cts_time(wlc, rts_rate,
6649                                                rts_preamble_type);
6650         } else {
6651                 /* CTS-TO-SELF */
6652                 dur = 2 * sifs;
6653         }
6654
6655         dur +=
6656             (u16) brcms_c_calc_frame_time(wlc, frame_rate, frame_preamble_type,
6657                                          frame_len);
6658         if (ba)
6659                 dur +=
6660                     (u16) brcms_c_calc_ba_time(wlc, frame_rate,
6661                                               BRCMS_SHORT_PREAMBLE);
6662         else
6663                 dur +=
6664                     (u16) brcms_c_calc_ack_time(wlc, frame_rate,
6665                                                frame_preamble_type);
6666         return dur;
6667 }
6668
6669 static u16 brcms_c_phytxctl1_calc(struct brcms_c_info *wlc, u32 rspec)
6670 {
6671         u16 phyctl1 = 0;
6672         u16 bw;
6673
6674         if (BRCMS_ISLCNPHY(wlc->band)) {
6675                 bw = PHY_TXC1_BW_20MHZ;
6676         } else {
6677                 bw = rspec_get_bw(rspec);
6678                 /* 10Mhz is not supported yet */
6679                 if (bw < PHY_TXC1_BW_20MHZ) {
6680                         wiphy_err(wlc->wiphy, "phytxctl1_calc: bw %d is "
6681                                   "not supported yet, set to 20L\n", bw);
6682                         bw = PHY_TXC1_BW_20MHZ;
6683                 }
6684         }
6685
6686         if (is_mcs_rate(rspec)) {
6687                 uint mcs = rspec & RSPEC_RATE_MASK;
6688
6689                 /* bw, stf, coding-type is part of rspec_phytxbyte2 returns */
6690                 phyctl1 = rspec_phytxbyte2(rspec);
6691                 /* set the upper byte of phyctl1 */
6692                 phyctl1 |= (mcs_table[mcs].tx_phy_ctl3 << 8);
6693         } else if (is_cck_rate(rspec) && !BRCMS_ISLCNPHY(wlc->band)
6694                    && !BRCMS_ISSSLPNPHY(wlc->band)) {
6695                 /*
6696                  * In CCK mode LPPHY overloads OFDM Modulation bits with CCK
6697                  * Data Rate. Eventually MIMOPHY would also be converted to
6698                  * this format
6699                  */
6700                 /* 0 = 1Mbps; 1 = 2Mbps; 2 = 5.5Mbps; 3 = 11Mbps */
6701                 phyctl1 = (bw | (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6702         } else {                /* legacy OFDM/CCK */
6703                 s16 phycfg;
6704                 /* get the phyctl byte from rate phycfg table */
6705                 phycfg = brcms_c_rate_legacy_phyctl(rspec2rate(rspec));
6706                 if (phycfg == -1) {
6707                         wiphy_err(wlc->wiphy, "phytxctl1_calc: wrong "
6708                                   "legacy OFDM/CCK rate\n");
6709                         phycfg = 0;
6710                 }
6711                 /* set the upper byte of phyctl1 */
6712                 phyctl1 =
6713                     (bw | (phycfg << 8) |
6714                      (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6715         }
6716         return phyctl1;
6717 }
6718
6719 /*
6720  * Add struct d11txh, struct cck_phy_hdr.
6721  *
6722  * 'p' data must start with 802.11 MAC header
6723  * 'p' must allow enough bytes of local headers to be "pushed" onto the packet
6724  *
6725  * headroom == D11_PHY_HDR_LEN + D11_TXH_LEN (D11_TXH_LEN is now 104 bytes)
6726  *
6727  */
6728 static u16
6729 brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
6730                      struct sk_buff *p, struct scb *scb, uint frag,
6731                      uint nfrags, uint queue, uint next_frag_len)
6732 {
6733         struct ieee80211_hdr *h;
6734         struct d11txh *txh;
6735         u8 *plcp, plcp_fallback[D11_PHY_HDR_LEN];
6736         int len, phylen, rts_phylen;
6737         u16 mch, phyctl, xfts, mainrates;
6738         u16 seq = 0, mcl = 0, status = 0, frameid = 0;
6739         u32 rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6740         u32 rts_rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6741         bool use_rts = false;
6742         bool use_cts = false;
6743         bool use_rifs = false;
6744         bool short_preamble[2] = { false, false };
6745         u8 preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6746         u8 rts_preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6747         u8 *rts_plcp, rts_plcp_fallback[D11_PHY_HDR_LEN];
6748         struct ieee80211_rts *rts = NULL;
6749         bool qos;
6750         uint ac;
6751         bool hwtkmic = false;
6752         u16 mimo_ctlchbw = PHY_TXC1_BW_20MHZ;
6753 #define ANTCFG_NONE 0xFF
6754         u8 antcfg = ANTCFG_NONE;
6755         u8 fbantcfg = ANTCFG_NONE;
6756         uint phyctl1_stf = 0;
6757         u16 durid = 0;
6758         struct ieee80211_tx_rate *txrate[2];
6759         int k;
6760         struct ieee80211_tx_info *tx_info;
6761         bool is_mcs;
6762         u16 mimo_txbw;
6763         u8 mimo_preamble_type;
6764
6765         /* locate 802.11 MAC header */
6766         h = (struct ieee80211_hdr *)(p->data);
6767         qos = ieee80211_is_data_qos(h->frame_control);
6768
6769         /* compute length of frame in bytes for use in PLCP computations */
6770         len = brcmu_pkttotlen(p);
6771         phylen = len + FCS_LEN;
6772
6773         /* Get tx_info */
6774         tx_info = IEEE80211_SKB_CB(p);
6775
6776         /* add PLCP */
6777         plcp = skb_push(p, D11_PHY_HDR_LEN);
6778
6779         /* add Broadcom tx descriptor header */
6780         txh = (struct d11txh *) skb_push(p, D11_TXH_LEN);
6781         memset(txh, 0, D11_TXH_LEN);
6782
6783         /* setup frameid */
6784         if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
6785                 /* non-AP STA should never use BCMC queue */
6786                 if (queue == TX_BCMC_FIFO) {
6787                         wiphy_err(wlc->wiphy, "wl%d: %s: ASSERT queue == "
6788                                   "TX_BCMC!\n", wlc->pub->unit, __func__);
6789                         frameid = bcmc_fid_generate(wlc, NULL, txh);
6790                 } else {
6791                         /* Increment the counter for first fragment */
6792                         if (tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
6793                                 scb->seqnum[p->priority]++;
6794
6795                         /* extract fragment number from frame first */
6796                         seq = le16_to_cpu(h->seq_ctrl) & FRAGNUM_MASK;
6797                         seq |= (scb->seqnum[p->priority] << SEQNUM_SHIFT);
6798                         h->seq_ctrl = cpu_to_le16(seq);
6799
6800                         frameid = ((seq << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
6801                             (queue & TXFID_QUEUE_MASK);
6802                 }
6803         }
6804         frameid |= queue & TXFID_QUEUE_MASK;
6805
6806         /* set the ignpmq bit for all pkts tx'd in PS mode and for beacons */
6807         if (ieee80211_is_beacon(h->frame_control))
6808                 mcl |= TXC_IGNOREPMQ;
6809
6810         txrate[0] = tx_info->control.rates;
6811         txrate[1] = txrate[0] + 1;
6812
6813         /*
6814          * if rate control algorithm didn't give us a fallback
6815          * rate, use the primary rate
6816          */
6817         if (txrate[1]->idx < 0)
6818                 txrate[1] = txrate[0];
6819
6820         for (k = 0; k < hw->max_rates; k++) {
6821                 is_mcs = txrate[k]->flags & IEEE80211_TX_RC_MCS ? true : false;
6822                 if (!is_mcs) {
6823                         if ((txrate[k]->idx >= 0)
6824                             && (txrate[k]->idx <
6825                                 hw->wiphy->bands[tx_info->band]->n_bitrates)) {
6826                                 rspec[k] =
6827                                     hw->wiphy->bands[tx_info->band]->
6828                                     bitrates[txrate[k]->idx].hw_value;
6829                                 short_preamble[k] =
6830                                     txrate[k]->
6831                                     flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ?
6832                                     true : false;
6833                         } else {
6834                                 rspec[k] = BRCM_RATE_1M;
6835                         }
6836                 } else {
6837                         rspec[k] = mac80211_wlc_set_nrate(wlc, wlc->band,
6838                                         NRATE_MCS_INUSE | txrate[k]->idx);
6839                 }
6840
6841                 /*
6842                  * Currently only support same setting for primay and
6843                  * fallback rates. Unify flags for each rate into a
6844                  * single value for the frame
6845                  */
6846                 use_rts |=
6847                     txrate[k]->
6848                     flags & IEEE80211_TX_RC_USE_RTS_CTS ? true : false;
6849                 use_cts |=
6850                     txrate[k]->
6851                     flags & IEEE80211_TX_RC_USE_CTS_PROTECT ? true : false;
6852
6853
6854                 /*
6855                  * (1) RATE:
6856                  *   determine and validate primary rate
6857                  *   and fallback rates
6858                  */
6859                 if (!rspec_active(rspec[k])) {
6860                         rspec[k] = BRCM_RATE_1M;
6861                 } else {
6862                         if (!is_multicast_ether_addr(h->addr1)) {
6863                                 /* set tx antenna config */
6864                                 brcms_c_antsel_antcfg_get(wlc->asi, false,
6865                                         false, 0, 0, &antcfg, &fbantcfg);
6866                         }
6867                 }
6868         }
6869
6870         phyctl1_stf = wlc->stf->ss_opmode;
6871
6872         if (wlc->pub->_n_enab & SUPPORT_11N) {
6873                 for (k = 0; k < hw->max_rates; k++) {
6874                         /*
6875                          * apply siso/cdd to single stream mcs's or ofdm
6876                          * if rspec is auto selected
6877                          */
6878                         if (((is_mcs_rate(rspec[k]) &&
6879                               is_single_stream(rspec[k] & RSPEC_RATE_MASK)) ||
6880                              is_ofdm_rate(rspec[k]))
6881                             && ((rspec[k] & RSPEC_OVERRIDE_MCS_ONLY)
6882                                 || !(rspec[k] & RSPEC_OVERRIDE))) {
6883                                 rspec[k] &= ~(RSPEC_STF_MASK | RSPEC_STC_MASK);
6884
6885                                 /* For SISO MCS use STBC if possible */
6886                                 if (is_mcs_rate(rspec[k])
6887                                     && BRCMS_STF_SS_STBC_TX(wlc, scb)) {
6888                                         u8 stc;
6889
6890                                         /* Nss for single stream is always 1 */
6891                                         stc = 1;
6892                                         rspec[k] |= (PHY_TXC1_MODE_STBC <<
6893                                                         RSPEC_STF_SHIFT) |
6894                                                     (stc << RSPEC_STC_SHIFT);
6895                                 } else
6896                                         rspec[k] |=
6897                                             (phyctl1_stf << RSPEC_STF_SHIFT);
6898                         }
6899
6900                         /*
6901                          * Is the phy configured to use 40MHZ frames? If
6902                          * so then pick the desired txbw
6903                          */
6904                         if (brcms_chspec_bw(wlc->chanspec) == BRCMS_40_MHZ) {
6905                                 /* default txbw is 20in40 SB */
6906                                 mimo_ctlchbw = mimo_txbw =
6907                                    CHSPEC_SB_UPPER(wlc_phy_chanspec_get(
6908                                                                  wlc->band->pi))
6909                                    ? PHY_TXC1_BW_20MHZ_UP : PHY_TXC1_BW_20MHZ;
6910
6911                                 if (is_mcs_rate(rspec[k])) {
6912                                         /* mcs 32 must be 40b/w DUP */
6913                                         if ((rspec[k] & RSPEC_RATE_MASK)
6914                                             == 32) {
6915                                                 mimo_txbw =
6916                                                     PHY_TXC1_BW_40MHZ_DUP;
6917                                                 /* use override */
6918                                         } else if (wlc->mimo_40txbw != AUTO)
6919                                                 mimo_txbw = wlc->mimo_40txbw;
6920                                         /* else check if dst is using 40 Mhz */
6921                                         else if (scb->flags & SCB_IS40)
6922                                                 mimo_txbw = PHY_TXC1_BW_40MHZ;
6923                                 } else if (is_ofdm_rate(rspec[k])) {
6924                                         if (wlc->ofdm_40txbw != AUTO)
6925                                                 mimo_txbw = wlc->ofdm_40txbw;
6926                                 } else if (wlc->cck_40txbw != AUTO) {
6927                                         mimo_txbw = wlc->cck_40txbw;
6928                                 }
6929                         } else {
6930                                 /*
6931                                  * mcs32 is 40 b/w only.
6932                                  * This is possible for probe packets on
6933                                  * a STA during SCAN
6934                                  */
6935                                 if ((rspec[k] & RSPEC_RATE_MASK) == 32)
6936                                         /* mcs 0 */
6937                                         rspec[k] = RSPEC_MIMORATE;
6938
6939                                 mimo_txbw = PHY_TXC1_BW_20MHZ;
6940                         }
6941
6942                         /* Set channel width */
6943                         rspec[k] &= ~RSPEC_BW_MASK;
6944                         if ((k == 0) || ((k > 0) && is_mcs_rate(rspec[k])))
6945                                 rspec[k] |= (mimo_txbw << RSPEC_BW_SHIFT);
6946                         else
6947                                 rspec[k] |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
6948
6949                         /* Disable short GI, not supported yet */
6950                         rspec[k] &= ~RSPEC_SHORT_GI;
6951
6952                         mimo_preamble_type = BRCMS_MM_PREAMBLE;
6953                         if (txrate[k]->flags & IEEE80211_TX_RC_GREEN_FIELD)
6954                                 mimo_preamble_type = BRCMS_GF_PREAMBLE;
6955
6956                         if ((txrate[k]->flags & IEEE80211_TX_RC_MCS)
6957                             && (!is_mcs_rate(rspec[k]))) {
6958                                 wiphy_err(wlc->wiphy, "wl%d: %s: IEEE80211_TX_"
6959                                           "RC_MCS != is_mcs_rate(rspec)\n",
6960                                           wlc->pub->unit, __func__);
6961                         }
6962
6963                         if (is_mcs_rate(rspec[k])) {
6964                                 preamble_type[k] = mimo_preamble_type;
6965
6966                                 /*
6967                                  * if SGI is selected, then forced mm
6968                                  * for single stream
6969                                  */
6970                                 if ((rspec[k] & RSPEC_SHORT_GI)
6971                                     && is_single_stream(rspec[k] &
6972                                                         RSPEC_RATE_MASK))
6973                                         preamble_type[k] = BRCMS_MM_PREAMBLE;
6974                         }
6975
6976                         /* should be better conditionalized */
6977                         if (!is_mcs_rate(rspec[0])
6978                             && (tx_info->control.rates[0].
6979                                 flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
6980                                 preamble_type[k] = BRCMS_SHORT_PREAMBLE;
6981                 }
6982         } else {
6983                 for (k = 0; k < hw->max_rates; k++) {
6984                         /* Set ctrlchbw as 20Mhz */
6985                         rspec[k] &= ~RSPEC_BW_MASK;
6986                         rspec[k] |= (PHY_TXC1_BW_20MHZ << RSPEC_BW_SHIFT);
6987
6988                         /* for nphy, stf of ofdm frames must follow policies */
6989                         if (BRCMS_ISNPHY(wlc->band) && is_ofdm_rate(rspec[k])) {
6990                                 rspec[k] &= ~RSPEC_STF_MASK;
6991                                 rspec[k] |= phyctl1_stf << RSPEC_STF_SHIFT;
6992                         }
6993                 }
6994         }
6995
6996         /* Reset these for use with AMPDU's */
6997         txrate[0]->count = 0;
6998         txrate[1]->count = 0;
6999
7000         /* (2) PROTECTION, may change rspec */
7001         if ((ieee80211_is_data(h->frame_control) ||
7002             ieee80211_is_mgmt(h->frame_control)) &&
7003             (phylen > wlc->RTSThresh) && !is_multicast_ether_addr(h->addr1))
7004                 use_rts = true;
7005
7006         /* (3) PLCP: determine PLCP header and MAC duration,
7007          * fill struct d11txh */
7008         brcms_c_compute_plcp(wlc, rspec[0], phylen, plcp);
7009         brcms_c_compute_plcp(wlc, rspec[1], phylen, plcp_fallback);
7010         memcpy(&txh->FragPLCPFallback,
7011                plcp_fallback, sizeof(txh->FragPLCPFallback));
7012
7013         /* Length field now put in CCK FBR CRC field */
7014         if (is_cck_rate(rspec[1])) {
7015                 txh->FragPLCPFallback[4] = phylen & 0xff;
7016                 txh->FragPLCPFallback[5] = (phylen & 0xff00) >> 8;
7017         }
7018
7019         /* MIMO-RATE: need validation ?? */
7020         mainrates = is_ofdm_rate(rspec[0]) ?
7021                         D11A_PHY_HDR_GRATE((struct ofdm_phy_hdr *) plcp) :
7022                         plcp[0];
7023
7024         /* DUR field for main rate */
7025         if (!ieee80211_is_pspoll(h->frame_control) &&
7026             !is_multicast_ether_addr(h->addr1) && !use_rifs) {
7027                 durid =
7028                     brcms_c_compute_frame_dur(wlc, rspec[0], preamble_type[0],
7029                                           next_frag_len);
7030                 h->duration_id = cpu_to_le16(durid);
7031         } else if (use_rifs) {
7032                 /* NAV protect to end of next max packet size */
7033                 durid =
7034                     (u16) brcms_c_calc_frame_time(wlc, rspec[0],
7035                                                  preamble_type[0],
7036                                                  DOT11_MAX_FRAG_LEN);
7037                 durid += RIFS_11N_TIME;
7038                 h->duration_id = cpu_to_le16(durid);
7039         }
7040
7041         /* DUR field for fallback rate */
7042         if (ieee80211_is_pspoll(h->frame_control))
7043                 txh->FragDurFallback = h->duration_id;
7044         else if (is_multicast_ether_addr(h->addr1) || use_rifs)
7045                 txh->FragDurFallback = 0;
7046         else {
7047                 durid = brcms_c_compute_frame_dur(wlc, rspec[1],
7048                                               preamble_type[1], next_frag_len);
7049                 txh->FragDurFallback = cpu_to_le16(durid);
7050         }
7051
7052         /* (4) MAC-HDR: MacTxControlLow */
7053         if (frag == 0)
7054                 mcl |= TXC_STARTMSDU;
7055
7056         if (!is_multicast_ether_addr(h->addr1))
7057                 mcl |= TXC_IMMEDACK;
7058
7059         if (wlc->band->bandtype == BRCM_BAND_5G)
7060                 mcl |= TXC_FREQBAND_5G;
7061
7062         if (CHSPEC_IS40(wlc_phy_chanspec_get(wlc->band->pi)))
7063                 mcl |= TXC_BW_40;
7064
7065         /* set AMIC bit if using hardware TKIP MIC */
7066         if (hwtkmic)
7067                 mcl |= TXC_AMIC;
7068
7069         txh->MacTxControlLow = cpu_to_le16(mcl);
7070
7071         /* MacTxControlHigh */
7072         mch = 0;
7073
7074         /* Set fallback rate preamble type */
7075         if ((preamble_type[1] == BRCMS_SHORT_PREAMBLE) ||
7076             (preamble_type[1] == BRCMS_GF_PREAMBLE)) {
7077                 if (rspec2rate(rspec[1]) != BRCM_RATE_1M)
7078                         mch |= TXC_PREAMBLE_DATA_FB_SHORT;
7079         }
7080
7081         /* MacFrameControl */
7082         memcpy(&txh->MacFrameControl, &h->frame_control, sizeof(u16));
7083         txh->TxFesTimeNormal = cpu_to_le16(0);
7084
7085         txh->TxFesTimeFallback = cpu_to_le16(0);
7086
7087         /* TxFrameRA */
7088         memcpy(&txh->TxFrameRA, &h->addr1, ETH_ALEN);
7089
7090         /* TxFrameID */
7091         txh->TxFrameID = cpu_to_le16(frameid);
7092
7093         /*
7094          * TxStatus, Note the case of recreating the first frag of a suppressed
7095          * frame then we may need to reset the retry cnt's via the status reg
7096          */
7097         txh->TxStatus = cpu_to_le16(status);
7098
7099         /*
7100          * extra fields for ucode AMPDU aggregation, the new fields are added to
7101          * the END of previous structure so that it's compatible in driver.
7102          */
7103         txh->MaxNMpdus = cpu_to_le16(0);
7104         txh->MaxABytes_MRT = cpu_to_le16(0);
7105         txh->MaxABytes_FBR = cpu_to_le16(0);
7106         txh->MinMBytes = cpu_to_le16(0);
7107
7108         /* (5) RTS/CTS: determine RTS/CTS PLCP header and MAC duration,
7109          * furnish struct d11txh */
7110         /* RTS PLCP header and RTS frame */
7111         if (use_rts || use_cts) {
7112                 if (use_rts && use_cts)
7113                         use_cts = false;
7114
7115                 for (k = 0; k < 2; k++) {
7116                         rts_rspec[k] = brcms_c_rspec_to_rts_rspec(wlc, rspec[k],
7117                                                               false,
7118                                                               mimo_ctlchbw);
7119                 }
7120
7121                 if (!is_ofdm_rate(rts_rspec[0]) &&
7122                     !((rspec2rate(rts_rspec[0]) == BRCM_RATE_1M) ||
7123                       (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
7124                         rts_preamble_type[0] = BRCMS_SHORT_PREAMBLE;
7125                         mch |= TXC_PREAMBLE_RTS_MAIN_SHORT;
7126                 }
7127
7128                 if (!is_ofdm_rate(rts_rspec[1]) &&
7129                     !((rspec2rate(rts_rspec[1]) == BRCM_RATE_1M) ||
7130                       (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
7131                         rts_preamble_type[1] = BRCMS_SHORT_PREAMBLE;
7132                         mch |= TXC_PREAMBLE_RTS_FB_SHORT;
7133                 }
7134
7135                 /* RTS/CTS additions to MacTxControlLow */
7136                 if (use_cts) {
7137                         txh->MacTxControlLow |= cpu_to_le16(TXC_SENDCTS);
7138                 } else {
7139                         txh->MacTxControlLow |= cpu_to_le16(TXC_SENDRTS);
7140                         txh->MacTxControlLow |= cpu_to_le16(TXC_LONGFRAME);
7141                 }
7142
7143                 /* RTS PLCP header */
7144                 rts_plcp = txh->RTSPhyHeader;
7145                 if (use_cts)
7146                         rts_phylen = DOT11_CTS_LEN + FCS_LEN;
7147                 else
7148                         rts_phylen = DOT11_RTS_LEN + FCS_LEN;
7149
7150                 brcms_c_compute_plcp(wlc, rts_rspec[0], rts_phylen, rts_plcp);
7151
7152                 /* fallback rate version of RTS PLCP header */
7153                 brcms_c_compute_plcp(wlc, rts_rspec[1], rts_phylen,
7154                                  rts_plcp_fallback);
7155                 memcpy(&txh->RTSPLCPFallback, rts_plcp_fallback,
7156                        sizeof(txh->RTSPLCPFallback));
7157
7158                 /* RTS frame fields... */
7159                 rts = (struct ieee80211_rts *)&txh->rts_frame;
7160
7161                 durid = brcms_c_compute_rtscts_dur(wlc, use_cts, rts_rspec[0],
7162                                                rspec[0], rts_preamble_type[0],
7163                                                preamble_type[0], phylen, false);
7164                 rts->duration = cpu_to_le16(durid);
7165                 /* fallback rate version of RTS DUR field */
7166                 durid = brcms_c_compute_rtscts_dur(wlc, use_cts,
7167                                                rts_rspec[1], rspec[1],
7168                                                rts_preamble_type[1],
7169                                                preamble_type[1], phylen, false);
7170                 txh->RTSDurFallback = cpu_to_le16(durid);
7171
7172                 if (use_cts) {
7173                         rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
7174                                                          IEEE80211_STYPE_CTS);
7175
7176                         memcpy(&rts->ra, &h->addr2, ETH_ALEN);
7177                 } else {
7178                         rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
7179                                                          IEEE80211_STYPE_RTS);
7180
7181                         memcpy(&rts->ra, &h->addr1, 2 * ETH_ALEN);
7182                 }
7183
7184                 /* mainrate
7185                  *    low 8 bits: main frag rate/mcs,
7186                  *    high 8 bits: rts/cts rate/mcs
7187                  */
7188                 mainrates |= (is_ofdm_rate(rts_rspec[0]) ?
7189                                 D11A_PHY_HDR_GRATE(
7190                                         (struct ofdm_phy_hdr *) rts_plcp) :
7191                                 rts_plcp[0]) << 8;
7192         } else {
7193                 memset((char *)txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
7194                 memset((char *)&txh->rts_frame, 0,
7195                         sizeof(struct ieee80211_rts));
7196                 memset((char *)txh->RTSPLCPFallback, 0,
7197                       sizeof(txh->RTSPLCPFallback));
7198                 txh->RTSDurFallback = 0;
7199         }
7200
7201 #ifdef SUPPORT_40MHZ
7202         /* add null delimiter count */
7203         if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && is_mcs_rate(rspec))
7204                 txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM] =
7205                    brcm_c_ampdu_null_delim_cnt(wlc->ampdu, scb, rspec, phylen);
7206
7207 #endif
7208
7209         /*
7210          * Now that RTS/RTS FB preamble types are updated, write
7211          * the final value
7212          */
7213         txh->MacTxControlHigh = cpu_to_le16(mch);
7214
7215         /*
7216          * MainRates (both the rts and frag plcp rates have
7217          * been calculated now)
7218          */
7219         txh->MainRates = cpu_to_le16(mainrates);
7220
7221         /* XtraFrameTypes */
7222         xfts = frametype(rspec[1], wlc->mimoft);
7223         xfts |= (frametype(rts_rspec[0], wlc->mimoft) << XFTS_RTS_FT_SHIFT);
7224         xfts |= (frametype(rts_rspec[1], wlc->mimoft) << XFTS_FBRRTS_FT_SHIFT);
7225         xfts |= CHSPEC_CHANNEL(wlc_phy_chanspec_get(wlc->band->pi)) <<
7226                                                              XFTS_CHANNEL_SHIFT;
7227         txh->XtraFrameTypes = cpu_to_le16(xfts);
7228
7229         /* PhyTxControlWord */
7230         phyctl = frametype(rspec[0], wlc->mimoft);
7231         if ((preamble_type[0] == BRCMS_SHORT_PREAMBLE) ||
7232             (preamble_type[0] == BRCMS_GF_PREAMBLE)) {
7233                 if (rspec2rate(rspec[0]) != BRCM_RATE_1M)
7234                         phyctl |= PHY_TXC_SHORT_HDR;
7235         }
7236
7237         /* phytxant is properly bit shifted */
7238         phyctl |= brcms_c_stf_d11hdrs_phyctl_txant(wlc, rspec[0]);
7239         txh->PhyTxControlWord = cpu_to_le16(phyctl);
7240
7241         /* PhyTxControlWord_1 */
7242         if (BRCMS_PHY_11N_CAP(wlc->band)) {
7243                 u16 phyctl1 = 0;
7244
7245                 phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[0]);
7246                 txh->PhyTxControlWord_1 = cpu_to_le16(phyctl1);
7247                 phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[1]);
7248                 txh->PhyTxControlWord_1_Fbr = cpu_to_le16(phyctl1);
7249
7250                 if (use_rts || use_cts) {
7251                         phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[0]);
7252                         txh->PhyTxControlWord_1_Rts = cpu_to_le16(phyctl1);
7253                         phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[1]);
7254                         txh->PhyTxControlWord_1_FbrRts = cpu_to_le16(phyctl1);
7255                 }
7256
7257                 /*
7258                  * For mcs frames, if mixedmode(overloaded with long preamble)
7259                  * is going to be set, fill in non-zero MModeLen and/or
7260                  * MModeFbrLen it will be unnecessary if they are separated
7261                  */
7262                 if (is_mcs_rate(rspec[0]) &&
7263                     (preamble_type[0] == BRCMS_MM_PREAMBLE)) {
7264                         u16 mmodelen =
7265                             brcms_c_calc_lsig_len(wlc, rspec[0], phylen);
7266                         txh->MModeLen = cpu_to_le16(mmodelen);
7267                 }
7268
7269                 if (is_mcs_rate(rspec[1]) &&
7270                     (preamble_type[1] == BRCMS_MM_PREAMBLE)) {
7271                         u16 mmodefbrlen =
7272                             brcms_c_calc_lsig_len(wlc, rspec[1], phylen);
7273                         txh->MModeFbrLen = cpu_to_le16(mmodefbrlen);
7274                 }
7275         }
7276
7277         ac = skb_get_queue_mapping(p);
7278         if ((scb->flags & SCB_WMECAP) && qos && wlc->edcf_txop[ac]) {
7279                 uint frag_dur, dur, dur_fallback;
7280
7281                 /* WME: Update TXOP threshold */
7282                 if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU) && frag == 0) {
7283                         frag_dur =
7284                             brcms_c_calc_frame_time(wlc, rspec[0],
7285                                         preamble_type[0], phylen);
7286
7287                         if (rts) {
7288                                 /* 1 RTS or CTS-to-self frame */
7289                                 dur =
7290                                     brcms_c_calc_cts_time(wlc, rts_rspec[0],
7291                                                       rts_preamble_type[0]);
7292                                 dur_fallback =
7293                                     brcms_c_calc_cts_time(wlc, rts_rspec[1],
7294                                                       rts_preamble_type[1]);
7295                                 /* (SIFS + CTS) + SIFS + frame + SIFS + ACK */
7296                                 dur += le16_to_cpu(rts->duration);
7297                                 dur_fallback +=
7298                                         le16_to_cpu(txh->RTSDurFallback);
7299                         } else if (use_rifs) {
7300                                 dur = frag_dur;
7301                                 dur_fallback = 0;
7302                         } else {
7303                                 /* frame + SIFS + ACK */
7304                                 dur = frag_dur;
7305                                 dur +=
7306                                     brcms_c_compute_frame_dur(wlc, rspec[0],
7307                                                           preamble_type[0], 0);
7308
7309                                 dur_fallback =
7310                                     brcms_c_calc_frame_time(wlc, rspec[1],
7311                                                         preamble_type[1],
7312                                                         phylen);
7313                                 dur_fallback +=
7314                                     brcms_c_compute_frame_dur(wlc, rspec[1],
7315                                                           preamble_type[1], 0);
7316                         }
7317                         /* NEED to set TxFesTimeNormal (hard) */
7318                         txh->TxFesTimeNormal = cpu_to_le16((u16) dur);
7319                         /*
7320                          * NEED to set fallback rate version of
7321                          * TxFesTimeNormal (hard)
7322                          */
7323                         txh->TxFesTimeFallback =
7324                                 cpu_to_le16((u16) dur_fallback);
7325
7326                         /*
7327                          * update txop byte threshold (txop minus intraframe
7328                          * overhead)
7329                          */
7330                         if (wlc->edcf_txop[ac] >= (dur - frag_dur)) {
7331                                 uint newfragthresh;
7332
7333                                 newfragthresh =
7334                                     brcms_c_calc_frame_len(wlc,
7335                                         rspec[0], preamble_type[0],
7336                                         (wlc->edcf_txop[ac] -
7337                                                 (dur - frag_dur)));
7338                                 /* range bound the fragthreshold */
7339                                 if (newfragthresh < DOT11_MIN_FRAG_LEN)
7340                                         newfragthresh =
7341                                             DOT11_MIN_FRAG_LEN;
7342                                 else if (newfragthresh >
7343                                          wlc->usr_fragthresh)
7344                                         newfragthresh =
7345                                             wlc->usr_fragthresh;
7346                                 /* update the fragthresh and do txc update */
7347                                 if (wlc->fragthresh[queue] !=
7348                                     (u16) newfragthresh)
7349                                         wlc->fragthresh[queue] =
7350                                             (u16) newfragthresh;
7351                         } else {
7352                                 wiphy_err(wlc->wiphy, "wl%d: %s txop invalid "
7353                                           "for rate %d\n",
7354                                           wlc->pub->unit, fifo_names[queue],
7355                                           rspec2rate(rspec[0]));
7356                         }
7357
7358                         if (dur > wlc->edcf_txop[ac])
7359                                 wiphy_err(wlc->wiphy, "wl%d: %s: %s txop "
7360                                           "exceeded phylen %d/%d dur %d/%d\n",
7361                                           wlc->pub->unit, __func__,
7362                                           fifo_names[queue],
7363                                           phylen, wlc->fragthresh[queue],
7364                                           dur, wlc->edcf_txop[ac]);
7365                 }
7366         }
7367
7368         return 0;
7369 }
7370
7371 void brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
7372                               struct ieee80211_hw *hw)
7373 {
7374         u8 prio;
7375         uint fifo;
7376         struct scb *scb = &wlc->pri_scb;
7377         struct ieee80211_hdr *d11_header = (struct ieee80211_hdr *)(sdu->data);
7378
7379         /*
7380          * 802.11 standard requires management traffic
7381          * to go at highest priority
7382          */
7383         prio = ieee80211_is_data(d11_header->frame_control) ? sdu->priority :
7384                 MAXPRIO;
7385         fifo = prio2fifo[prio];
7386         if (brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0))
7387                 return;
7388         brcms_c_txq_enq(wlc, scb, sdu, BRCMS_PRIO_TO_PREC(prio));
7389         brcms_c_send_q(wlc);
7390 }
7391
7392 void brcms_c_send_q(struct brcms_c_info *wlc)
7393 {
7394         struct sk_buff *pkt[DOT11_MAXNUMFRAGS];
7395         int prec;
7396         u16 prec_map;
7397         int err = 0, i, count;
7398         uint fifo;
7399         struct brcms_txq_info *qi = wlc->pkt_queue;
7400         struct pktq *q = &qi->q;
7401         struct ieee80211_tx_info *tx_info;
7402
7403         prec_map = wlc->tx_prec_map;
7404
7405         /* Send all the enq'd pkts that we can.
7406          * Dequeue packets with precedence with empty HW fifo only
7407          */
7408         while (prec_map && (pkt[0] = brcmu_pktq_mdeq(q, prec_map, &prec))) {
7409                 tx_info = IEEE80211_SKB_CB(pkt[0]);
7410                 if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
7411                         err = brcms_c_sendampdu(wlc->ampdu, qi, pkt, prec);
7412                 } else {
7413                         count = 1;
7414                         err = brcms_c_prep_pdu(wlc, pkt[0], &fifo);
7415                         if (!err) {
7416                                 for (i = 0; i < count; i++)
7417                                         brcms_c_txfifo(wlc, fifo, pkt[i], true,
7418                                                        1);
7419                         }
7420                 }
7421
7422                 if (err == -EBUSY) {
7423                         brcmu_pktq_penq_head(q, prec, pkt[0]);
7424                         /*
7425                          * If send failed due to any other reason than a
7426                          * change in HW FIFO condition, quit. Otherwise,
7427                          * read the new prec_map!
7428                          */
7429                         if (prec_map == wlc->tx_prec_map)
7430                                 break;
7431                         prec_map = wlc->tx_prec_map;
7432                 }
7433         }
7434 }
7435
7436 void
7437 brcms_c_txfifo(struct brcms_c_info *wlc, uint fifo, struct sk_buff *p,
7438                bool commit, s8 txpktpend)
7439 {
7440         u16 frameid = INVALIDFID;
7441         struct d11txh *txh;
7442
7443         txh = (struct d11txh *) (p->data);
7444
7445         /* When a BC/MC frame is being committed to the BCMC fifo
7446          * via DMA (NOT PIO), update ucode or BSS info as appropriate.
7447          */
7448         if (fifo == TX_BCMC_FIFO)
7449                 frameid = le16_to_cpu(txh->TxFrameID);
7450
7451         /*
7452          * Bump up pending count for if not using rpc. If rpc is
7453          * used, this will be handled in brcms_b_txfifo()
7454          */
7455         if (commit) {
7456                 wlc->core->txpktpend[fifo] += txpktpend;
7457                 BCMMSG(wlc->wiphy, "pktpend inc %d to %d\n",
7458                          txpktpend, wlc->core->txpktpend[fifo]);
7459         }
7460
7461         /* Commit BCMC sequence number in the SHM frame ID location */
7462         if (frameid != INVALIDFID) {
7463                 /*
7464                  * To inform the ucode of the last mcast frame posted
7465                  * so that it can clear moredata bit
7466                  */
7467                 brcms_b_write_shm(wlc->hw, M_BCMC_FID, frameid);
7468         }
7469
7470         if (dma_txfast(wlc->hw->di[fifo], p, commit) < 0)
7471                 wiphy_err(wlc->wiphy, "txfifo: fatal, toss frames !!!\n");
7472 }
7473
7474 u32
7475 brcms_c_rspec_to_rts_rspec(struct brcms_c_info *wlc, u32 rspec,
7476                            bool use_rspec, u16 mimo_ctlchbw)
7477 {
7478         u32 rts_rspec = 0;
7479
7480         if (use_rspec)
7481                 /* use frame rate as rts rate */
7482                 rts_rspec = rspec;
7483         else if (wlc->band->gmode && wlc->protection->_g && !is_cck_rate(rspec))
7484                 /* Use 11Mbps as the g protection RTS target rate and fallback.
7485                  * Use the brcms_basic_rate() lookup to find the best basic rate
7486                  * under the target in case 11 Mbps is not Basic.
7487                  * 6 and 9 Mbps are not usually selected by rate selection, but
7488                  * even if the OFDM rate we are protecting is 6 or 9 Mbps, 11
7489                  * is more robust.
7490                  */
7491                 rts_rspec = brcms_basic_rate(wlc, BRCM_RATE_11M);
7492         else
7493                 /* calculate RTS rate and fallback rate based on the frame rate
7494                  * RTS must be sent at a basic rate since it is a
7495                  * control frame, sec 9.6 of 802.11 spec
7496                  */
7497                 rts_rspec = brcms_basic_rate(wlc, rspec);
7498
7499         if (BRCMS_PHY_11N_CAP(wlc->band)) {
7500                 /* set rts txbw to correct side band */
7501                 rts_rspec &= ~RSPEC_BW_MASK;
7502
7503                 /*
7504                  * if rspec/rspec_fallback is 40MHz, then send RTS on both
7505                  * 20MHz channel (DUP), otherwise send RTS on control channel
7506                  */
7507                 if (rspec_is40mhz(rspec) && !is_cck_rate(rts_rspec))
7508                         rts_rspec |= (PHY_TXC1_BW_40MHZ_DUP << RSPEC_BW_SHIFT);
7509                 else
7510                         rts_rspec |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
7511
7512                 /* pick siso/cdd as default for ofdm */
7513                 if (is_ofdm_rate(rts_rspec)) {
7514                         rts_rspec &= ~RSPEC_STF_MASK;
7515                         rts_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
7516                 }
7517         }
7518         return rts_rspec;
7519 }
7520
7521 void
7522 brcms_c_txfifo_complete(struct brcms_c_info *wlc, uint fifo, s8 txpktpend)
7523 {
7524         wlc->core->txpktpend[fifo] -= txpktpend;
7525         BCMMSG(wlc->wiphy, "pktpend dec %d to %d\n", txpktpend,
7526                wlc->core->txpktpend[fifo]);
7527
7528         /* There is more room; mark precedences related to this FIFO sendable */
7529         wlc->tx_prec_map |= wlc->fifo2prec_map[fifo];
7530
7531         /* figure out which bsscfg is being worked on... */
7532 }
7533
7534 /* Update beacon listen interval in shared memory */
7535 static void brcms_c_bcn_li_upd(struct brcms_c_info *wlc)
7536 {
7537         /* wake up every DTIM is the default */
7538         if (wlc->bcn_li_dtim == 1)
7539                 brcms_b_write_shm(wlc->hw, M_BCN_LI, 0);
7540         else
7541                 brcms_b_write_shm(wlc->hw, M_BCN_LI,
7542                               (wlc->bcn_li_dtim << 8) | wlc->bcn_li_bcn);
7543 }
7544
7545 static void
7546 brcms_b_read_tsf(struct brcms_hardware *wlc_hw, u32 *tsf_l_ptr,
7547                   u32 *tsf_h_ptr)
7548 {
7549         struct d11regs __iomem *regs = wlc_hw->regs;
7550
7551         /* read the tsf timer low, then high to get an atomic read */
7552         *tsf_l_ptr = R_REG(&regs->tsf_timerlow);
7553         *tsf_h_ptr = R_REG(&regs->tsf_timerhigh);
7554 }
7555
7556 /*
7557  * recover 64bit TSF value from the 16bit TSF value in the rx header
7558  * given the assumption that the TSF passed in header is within 65ms
7559  * of the current tsf.
7560  *
7561  * 6       5       4       4       3       2       1
7562  * 3.......6.......8.......0.......2.......4.......6.......8......0
7563  * |<---------- tsf_h ----------->||<--- tsf_l -->||<-RxTSFTime ->|
7564  *
7565  * The RxTSFTime are the lowest 16 bits and provided by the ucode. The
7566  * tsf_l is filled in by brcms_b_recv, which is done earlier in the
7567  * receive call sequence after rx interrupt. Only the higher 16 bits
7568  * are used. Finally, the tsf_h is read from the tsf register.
7569  */
7570 static u64 brcms_c_recover_tsf64(struct brcms_c_info *wlc,
7571                                  struct d11rxhdr *rxh)
7572 {
7573         u32 tsf_h, tsf_l;
7574         u16 rx_tsf_0_15, rx_tsf_16_31;
7575
7576         brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7577
7578         rx_tsf_16_31 = (u16)(tsf_l >> 16);
7579         rx_tsf_0_15 = rxh->RxTSFTime;
7580
7581         /*
7582          * a greater tsf time indicates the low 16 bits of
7583          * tsf_l wrapped, so decrement the high 16 bits.
7584          */
7585         if ((u16)tsf_l < rx_tsf_0_15) {
7586                 rx_tsf_16_31 -= 1;
7587                 if (rx_tsf_16_31 == 0xffff)
7588                         tsf_h -= 1;
7589         }
7590
7591         return ((u64)tsf_h << 32) | (((u32)rx_tsf_16_31 << 16) + rx_tsf_0_15);
7592 }
7593
7594 static void
7595 prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7596                      struct sk_buff *p,
7597                      struct ieee80211_rx_status *rx_status)
7598 {
7599         int preamble;
7600         int channel;
7601         u32 rspec;
7602         unsigned char *plcp;
7603
7604         /* fill in TSF and flag its presence */
7605         rx_status->mactime = brcms_c_recover_tsf64(wlc, rxh);
7606         rx_status->flag |= RX_FLAG_MACTIME_MPDU;
7607
7608         channel = BRCMS_CHAN_CHANNEL(rxh->RxChan);
7609
7610         if (channel > 14) {
7611                 rx_status->band = IEEE80211_BAND_5GHZ;
7612                 rx_status->freq = ieee80211_ofdm_chan_to_freq(
7613                                         WF_CHAN_FACTOR_5_G/2, channel);
7614
7615         } else {
7616                 rx_status->band = IEEE80211_BAND_2GHZ;
7617                 rx_status->freq = ieee80211_dsss_chan_to_freq(channel);
7618         }
7619
7620         rx_status->signal = wlc_phy_rssi_compute(wlc->hw->band->pi, rxh);
7621
7622         /* noise */
7623         /* qual */
7624         rx_status->antenna =
7625                 (rxh->PhyRxStatus_0 & PRXS0_RXANT_UPSUBBAND) ? 1 : 0;
7626
7627         plcp = p->data;
7628
7629         rspec = brcms_c_compute_rspec(rxh, plcp);
7630         if (is_mcs_rate(rspec)) {
7631                 rx_status->rate_idx = rspec & RSPEC_RATE_MASK;
7632                 rx_status->flag |= RX_FLAG_HT;
7633                 if (rspec_is40mhz(rspec))
7634                         rx_status->flag |= RX_FLAG_40MHZ;
7635         } else {
7636                 switch (rspec2rate(rspec)) {
7637                 case BRCM_RATE_1M:
7638                         rx_status->rate_idx = 0;
7639                         break;
7640                 case BRCM_RATE_2M:
7641                         rx_status->rate_idx = 1;
7642                         break;
7643                 case BRCM_RATE_5M5:
7644                         rx_status->rate_idx = 2;
7645                         break;
7646                 case BRCM_RATE_11M:
7647                         rx_status->rate_idx = 3;
7648                         break;
7649                 case BRCM_RATE_6M:
7650                         rx_status->rate_idx = 4;
7651                         break;
7652                 case BRCM_RATE_9M:
7653                         rx_status->rate_idx = 5;
7654                         break;
7655                 case BRCM_RATE_12M:
7656                         rx_status->rate_idx = 6;
7657                         break;
7658                 case BRCM_RATE_18M:
7659                         rx_status->rate_idx = 7;
7660                         break;
7661                 case BRCM_RATE_24M:
7662                         rx_status->rate_idx = 8;
7663                         break;
7664                 case BRCM_RATE_36M:
7665                         rx_status->rate_idx = 9;
7666                         break;
7667                 case BRCM_RATE_48M:
7668                         rx_status->rate_idx = 10;
7669                         break;
7670                 case BRCM_RATE_54M:
7671                         rx_status->rate_idx = 11;
7672                         break;
7673                 default:
7674                         wiphy_err(wlc->wiphy, "%s: Unknown rate\n", __func__);
7675                 }
7676
7677                 /*
7678                  * For 5GHz, we should decrease the index as it is
7679                  * a subset of the 2.4G rates. See bitrates field
7680                  * of brcms_band_5GHz_nphy (in mac80211_if.c).
7681                  */
7682                 if (rx_status->band == IEEE80211_BAND_5GHZ)
7683                         rx_status->rate_idx -= BRCMS_LEGACY_5G_RATE_OFFSET;
7684
7685                 /* Determine short preamble and rate_idx */
7686                 preamble = 0;
7687                 if (is_cck_rate(rspec)) {
7688                         if (rxh->PhyRxStatus_0 & PRXS0_SHORTH)
7689                                 rx_status->flag |= RX_FLAG_SHORTPRE;
7690                 } else if (is_ofdm_rate(rspec)) {
7691                         rx_status->flag |= RX_FLAG_SHORTPRE;
7692                 } else {
7693                         wiphy_err(wlc->wiphy, "%s: Unknown modulation\n",
7694                                   __func__);
7695                 }
7696         }
7697
7698         if (plcp3_issgi(plcp[3]))
7699                 rx_status->flag |= RX_FLAG_SHORT_GI;
7700
7701         if (rxh->RxStatus1 & RXS_DECERR) {
7702                 rx_status->flag |= RX_FLAG_FAILED_PLCP_CRC;
7703                 wiphy_err(wlc->wiphy, "%s:  RX_FLAG_FAILED_PLCP_CRC\n",
7704                           __func__);
7705         }
7706         if (rxh->RxStatus1 & RXS_FCSERR) {
7707                 rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
7708                 wiphy_err(wlc->wiphy, "%s:  RX_FLAG_FAILED_FCS_CRC\n",
7709                           __func__);
7710         }
7711 }
7712
7713 static void
7714 brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7715                 struct sk_buff *p)
7716 {
7717         int len_mpdu;
7718         struct ieee80211_rx_status rx_status;
7719
7720         memset(&rx_status, 0, sizeof(rx_status));
7721         prep_mac80211_status(wlc, rxh, p, &rx_status);
7722
7723         /* mac header+body length, exclude CRC and plcp header */
7724         len_mpdu = p->len - D11_PHY_HDR_LEN - FCS_LEN;
7725         skb_pull(p, D11_PHY_HDR_LEN);
7726         __skb_trim(p, len_mpdu);
7727
7728         memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
7729         ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
7730 }
7731
7732 /* calculate frame duration for Mixed-mode L-SIG spoofing, return
7733  * number of bytes goes in the length field
7734  *
7735  * Formula given by HT PHY Spec v 1.13
7736  *   len = 3(nsyms + nstream + 3) - 3
7737  */
7738 u16
7739 brcms_c_calc_lsig_len(struct brcms_c_info *wlc, u32 ratespec,
7740                       uint mac_len)
7741 {
7742         uint nsyms, len = 0, kNdps;
7743
7744         BCMMSG(wlc->wiphy, "wl%d: rate %d, len%d\n",
7745                  wlc->pub->unit, rspec2rate(ratespec), mac_len);
7746
7747         if (is_mcs_rate(ratespec)) {
7748                 uint mcs = ratespec & RSPEC_RATE_MASK;
7749                 int tot_streams = (mcs_2_txstreams(mcs) + 1) +
7750                                   rspec_stc(ratespec);
7751
7752                 /*
7753                  * the payload duration calculation matches that
7754                  * of regular ofdm
7755                  */
7756                 /* 1000Ndbps = kbps * 4 */
7757                 kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
7758                                    rspec_issgi(ratespec)) * 4;
7759
7760                 if (rspec_stc(ratespec) == 0)
7761                         nsyms =
7762                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7763                                   APHY_TAIL_NBITS) * 1000, kNdps);
7764                 else
7765                         /* STBC needs to have even number of symbols */
7766                         nsyms =
7767                             2 *
7768                             CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7769                                   APHY_TAIL_NBITS) * 1000, 2 * kNdps);
7770
7771                 /* (+3) account for HT-SIG(2) and HT-STF(1) */
7772                 nsyms += (tot_streams + 3);
7773                 /*
7774                  * 3 bytes/symbol @ legacy 6Mbps rate
7775                  * (-3) excluding service bits and tail bits
7776                  */
7777                 len = (3 * nsyms) - 3;
7778         }
7779
7780         return (u16) len;
7781 }
7782
7783 static void
7784 brcms_c_mod_prb_rsp_rate_table(struct brcms_c_info *wlc, uint frame_len)
7785 {
7786         const struct brcms_c_rateset *rs_dflt;
7787         struct brcms_c_rateset rs;
7788         u8 rate;
7789         u16 entry_ptr;
7790         u8 plcp[D11_PHY_HDR_LEN];
7791         u16 dur, sifs;
7792         uint i;
7793
7794         sifs = get_sifs(wlc->band);
7795
7796         rs_dflt = brcms_c_rateset_get_hwrs(wlc);
7797
7798         brcms_c_rateset_copy(rs_dflt, &rs);
7799         brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
7800
7801         /*
7802          * walk the phy rate table and update MAC core SHM
7803          * basic rate table entries
7804          */
7805         for (i = 0; i < rs.count; i++) {
7806                 rate = rs.rates[i] & BRCMS_RATE_MASK;
7807
7808                 entry_ptr = brcms_b_rate_shm_offset(wlc->hw, rate);
7809
7810                 /* Calculate the Probe Response PLCP for the given rate */
7811                 brcms_c_compute_plcp(wlc, rate, frame_len, plcp);
7812
7813                 /*
7814                  * Calculate the duration of the Probe Response
7815                  * frame plus SIFS for the MAC
7816                  */
7817                 dur = (u16) brcms_c_calc_frame_time(wlc, rate,
7818                                                 BRCMS_LONG_PREAMBLE, frame_len);
7819                 dur += sifs;
7820
7821                 /* Update the SHM Rate Table entry Probe Response values */
7822                 brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS,
7823                               (u16) (plcp[0] + (plcp[1] << 8)));
7824                 brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS + 2,
7825                               (u16) (plcp[2] + (plcp[3] << 8)));
7826                 brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_DUR_POS, dur);
7827         }
7828 }
7829
7830 /*      Max buffering needed for beacon template/prb resp template is 142 bytes.
7831  *
7832  *      PLCP header is 6 bytes.
7833  *      802.11 A3 header is 24 bytes.
7834  *      Max beacon frame body template length is 112 bytes.
7835  *      Max probe resp frame body template length is 110 bytes.
7836  *
7837  *      *len on input contains the max length of the packet available.
7838  *
7839  *      The *len value is set to the number of bytes in buf used, and starts
7840  *      with the PLCP and included up to, but not including, the 4 byte FCS.
7841  */
7842 static void
7843 brcms_c_bcn_prb_template(struct brcms_c_info *wlc, u16 type,
7844                          u32 bcn_rspec,
7845                          struct brcms_bss_cfg *cfg, u16 *buf, int *len)
7846 {
7847         static const u8 ether_bcast[ETH_ALEN] = {255, 255, 255, 255, 255, 255};
7848         struct cck_phy_hdr *plcp;
7849         struct ieee80211_mgmt *h;
7850         int hdr_len, body_len;
7851
7852         hdr_len = D11_PHY_HDR_LEN + DOT11_MAC_HDR_LEN;
7853
7854         /* calc buffer size provided for frame body */
7855         body_len = *len - hdr_len;
7856         /* return actual size */
7857         *len = hdr_len + body_len;
7858
7859         /* format PHY and MAC headers */
7860         memset((char *)buf, 0, hdr_len);
7861
7862         plcp = (struct cck_phy_hdr *) buf;
7863
7864         /*
7865          * PLCP for Probe Response frames are filled in from
7866          * core's rate table
7867          */
7868         if (type == IEEE80211_STYPE_BEACON)
7869                 /* fill in PLCP */
7870                 brcms_c_compute_plcp(wlc, bcn_rspec,
7871                                  (DOT11_MAC_HDR_LEN + body_len + FCS_LEN),
7872                                  (u8 *) plcp);
7873
7874         /* "Regular" and 16 MBSS but not for 4 MBSS */
7875         /* Update the phytxctl for the beacon based on the rspec */
7876         brcms_c_beacon_phytxctl_txant_upd(wlc, bcn_rspec);
7877
7878         h = (struct ieee80211_mgmt *)&plcp[1];
7879
7880         /* fill in 802.11 header */
7881         h->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | type);
7882
7883         /* DUR is 0 for multicast bcn, or filled in by MAC for prb resp */
7884         /* A1 filled in by MAC for prb resp, broadcast for bcn */
7885         if (type == IEEE80211_STYPE_BEACON)
7886                 memcpy(&h->da, &ether_bcast, ETH_ALEN);
7887         memcpy(&h->sa, &cfg->cur_etheraddr, ETH_ALEN);
7888         memcpy(&h->bssid, &cfg->BSSID, ETH_ALEN);
7889
7890         /* SEQ filled in by MAC */
7891 }
7892
7893 int brcms_c_get_header_len(void)
7894 {
7895         return TXOFF;
7896 }
7897
7898 /*
7899  * Update all beacons for the system.
7900  */
7901 void brcms_c_update_beacon(struct brcms_c_info *wlc)
7902 {
7903         struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7904
7905         if (bsscfg->up && !bsscfg->BSS)
7906                 /* Clear the soft intmask */
7907                 wlc->defmacintmask &= ~MI_BCNTPL;
7908 }
7909
7910 /* Write ssid into shared memory */
7911 static void
7912 brcms_c_shm_ssid_upd(struct brcms_c_info *wlc, struct brcms_bss_cfg *cfg)
7913 {
7914         u8 *ssidptr = cfg->SSID;
7915         u16 base = M_SSID;
7916         u8 ssidbuf[IEEE80211_MAX_SSID_LEN];
7917
7918         /* padding the ssid with zero and copy it into shm */
7919         memset(ssidbuf, 0, IEEE80211_MAX_SSID_LEN);
7920         memcpy(ssidbuf, ssidptr, cfg->SSID_len);
7921
7922         brcms_c_copyto_shm(wlc, base, ssidbuf, IEEE80211_MAX_SSID_LEN);
7923         brcms_b_write_shm(wlc->hw, M_SSIDLEN, (u16) cfg->SSID_len);
7924 }
7925
7926 static void
7927 brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
7928                               struct brcms_bss_cfg *cfg,
7929                               bool suspend)
7930 {
7931         u16 prb_resp[BCN_TMPL_LEN / 2];
7932         int len = BCN_TMPL_LEN;
7933
7934         /*
7935          * write the probe response to hardware, or save in
7936          * the config structure
7937          */
7938
7939         /* create the probe response template */
7940         brcms_c_bcn_prb_template(wlc, IEEE80211_STYPE_PROBE_RESP, 0,
7941                                  cfg, prb_resp, &len);
7942
7943         if (suspend)
7944                 brcms_c_suspend_mac_and_wait(wlc);
7945
7946         /* write the probe response into the template region */
7947         brcms_b_write_template_ram(wlc->hw, T_PRS_TPL_BASE,
7948                                     (len + 3) & ~3, prb_resp);
7949
7950         /* write the length of the probe response frame (+PLCP/-FCS) */
7951         brcms_b_write_shm(wlc->hw, M_PRB_RESP_FRM_LEN, (u16) len);
7952
7953         /* write the SSID and SSID length */
7954         brcms_c_shm_ssid_upd(wlc, cfg);
7955
7956         /*
7957          * Write PLCP headers and durations for probe response frames
7958          * at all rates. Use the actual frame length covered by the
7959          * PLCP header for the call to brcms_c_mod_prb_rsp_rate_table()
7960          * by subtracting the PLCP len and adding the FCS.
7961          */
7962         len += (-D11_PHY_HDR_LEN + FCS_LEN);
7963         brcms_c_mod_prb_rsp_rate_table(wlc, (u16) len);
7964
7965         if (suspend)
7966                 brcms_c_enable_mac(wlc);
7967 }
7968
7969 void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
7970 {
7971         struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7972
7973         /* update AP or IBSS probe responses */
7974         if (bsscfg->up && !bsscfg->BSS)
7975                 brcms_c_bss_update_probe_resp(wlc, bsscfg, suspend);
7976 }
7977
7978 /* prepares pdu for transmission. returns BCM error codes */
7979 int brcms_c_prep_pdu(struct brcms_c_info *wlc, struct sk_buff *pdu, uint *fifop)
7980 {
7981         uint fifo;
7982         struct d11txh *txh;
7983         struct ieee80211_hdr *h;
7984         struct scb *scb;
7985
7986         txh = (struct d11txh *) (pdu->data);
7987         h = (struct ieee80211_hdr *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN);
7988
7989         /* get the pkt queue info. This was put at brcms_c_sendctl or
7990          * brcms_c_send for PDU */
7991         fifo = le16_to_cpu(txh->TxFrameID) & TXFID_QUEUE_MASK;
7992
7993         scb = NULL;
7994
7995         *fifop = fifo;
7996
7997         /* return if insufficient dma resources */
7998         if (*wlc->core->txavail[fifo] < MAX_DMA_SEGS) {
7999                 /* Mark precedences related to this FIFO, unsendable */
8000                 /* A fifo is full. Clear precedences related to that FIFO */
8001                 wlc->tx_prec_map &= ~(wlc->fifo2prec_map[fifo]);
8002                 return -EBUSY;
8003         }
8004         return 0;
8005 }
8006
8007 int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo,
8008                            uint *blocks)
8009 {
8010         if (fifo >= NFIFO)
8011                 return -EINVAL;
8012
8013         *blocks = wlc_hw->xmtfifo_sz[fifo];
8014
8015         return 0;
8016 }
8017
8018 void
8019 brcms_c_set_addrmatch(struct brcms_c_info *wlc, int match_reg_offset,
8020                   const u8 *addr)
8021 {
8022         brcms_b_set_addrmatch(wlc->hw, match_reg_offset, addr);
8023         if (match_reg_offset == RCM_BSSID_OFFSET)
8024                 memcpy(wlc->bsscfg->BSSID, addr, ETH_ALEN);
8025 }
8026
8027 /*
8028  * Flag 'scan in progress' to withhold dynamic phy calibration
8029  */
8030 void brcms_c_scan_start(struct brcms_c_info *wlc)
8031 {
8032         wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, true);
8033 }
8034
8035 void brcms_c_scan_stop(struct brcms_c_info *wlc)
8036 {
8037         wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, false);
8038 }
8039
8040 void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state)
8041 {
8042         wlc->pub->associated = state;
8043         wlc->bsscfg->associated = state;
8044 }
8045
8046 /*
8047  * When a remote STA/AP is removed by Mac80211, or when it can no longer accept
8048  * AMPDU traffic, packets pending in hardware have to be invalidated so that
8049  * when later on hardware releases them, they can be handled appropriately.
8050  */
8051 void brcms_c_inval_dma_pkts(struct brcms_hardware *hw,
8052                                struct ieee80211_sta *sta,
8053                                void (*dma_callback_fn))
8054 {
8055         struct dma_pub *dmah;
8056         int i;
8057         for (i = 0; i < NFIFO; i++) {
8058                 dmah = hw->di[i];
8059                 if (dmah != NULL)
8060                         dma_walk_packets(dmah, dma_callback_fn, sta);
8061         }
8062 }
8063
8064 int brcms_c_get_curband(struct brcms_c_info *wlc)
8065 {
8066         return wlc->band->bandunit;
8067 }
8068
8069 void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop)
8070 {
8071         /* flush packet queue when requested */
8072         if (drop)
8073                 brcmu_pktq_flush(&wlc->pkt_queue->q, false, NULL, NULL);
8074
8075         /* wait for queue and DMA fifos to run dry */
8076         while (!pktq_empty(&wlc->pkt_queue->q) || brcms_txpktpendtot(wlc) > 0)
8077                 brcms_msleep(wlc->wl, 1);
8078 }
8079
8080 void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
8081 {
8082         wlc->bcn_li_bcn = interval;
8083         if (wlc->pub->up)
8084                 brcms_c_bcn_li_upd(wlc);
8085 }
8086
8087 int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr)
8088 {
8089         uint qdbm;
8090
8091         /* Remove override bit and clip to max qdbm value */
8092         qdbm = min_t(uint, txpwr * BRCMS_TXPWR_DB_FACTOR, 0xff);
8093         return wlc_phy_txpower_set(wlc->band->pi, qdbm, false);
8094 }
8095
8096 int brcms_c_get_tx_power(struct brcms_c_info *wlc)
8097 {
8098         uint qdbm;
8099         bool override;
8100
8101         wlc_phy_txpower_get(wlc->band->pi, &qdbm, &override);
8102
8103         /* Return qdbm units */
8104         return (int)(qdbm / BRCMS_TXPWR_DB_FACTOR);
8105 }
8106
8107 void brcms_c_set_radio_mon(struct brcms_c_info *wlc)
8108 {
8109         brcms_c_radio_mon_upd(wlc);
8110 }
8111
8112 /* Process received frames */
8113 /*
8114  * Return true if more frames need to be processed. false otherwise.
8115  * Param 'bound' indicates max. # frames to process before break out.
8116  */
8117 static void brcms_c_recv(struct brcms_c_info *wlc, struct sk_buff *p)
8118 {
8119         struct d11rxhdr *rxh;
8120         struct ieee80211_hdr *h;
8121         uint len;
8122         bool is_amsdu;
8123
8124         BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
8125
8126         /* frame starts with rxhdr */
8127         rxh = (struct d11rxhdr *) (p->data);
8128
8129         /* strip off rxhdr */
8130         skb_pull(p, BRCMS_HWRXOFF);
8131
8132         /* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU subframes */
8133         if (rxh->RxStatus1 & RXS_PBPRES) {
8134                 if (p->len < 2) {
8135                         wiphy_err(wlc->wiphy, "wl%d: recv: rcvd runt of "
8136                                   "len %d\n", wlc->pub->unit, p->len);
8137                         goto toss;
8138                 }
8139                 skb_pull(p, 2);
8140         }
8141
8142         h = (struct ieee80211_hdr *)(p->data + D11_PHY_HDR_LEN);
8143         len = p->len;
8144
8145         if (rxh->RxStatus1 & RXS_FCSERR) {
8146                 if (wlc->pub->mac80211_state & MAC80211_PROMISC_BCNS) {
8147                         wiphy_err(wlc->wiphy, "FCSERR while scanning******* -"
8148                                   " tossing\n");
8149                         goto toss;
8150                 } else {
8151                         wiphy_err(wlc->wiphy, "RCSERR!!!\n");
8152                         goto toss;
8153                 }
8154         }
8155
8156         /* check received pkt has at least frame control field */
8157         if (len < D11_PHY_HDR_LEN + sizeof(h->frame_control))
8158                 goto toss;
8159
8160         /* not supporting A-MSDU */
8161         is_amsdu = rxh->RxStatus2 & RXS_AMSDU_MASK;
8162         if (is_amsdu)
8163                 goto toss;
8164
8165         brcms_c_recvctl(wlc, rxh, p);
8166         return;
8167
8168  toss:
8169         brcmu_pkt_buf_free_skb(p);
8170 }
8171
8172 /* Process received frames */
8173 /*
8174  * Return true if more frames need to be processed. false otherwise.
8175  * Param 'bound' indicates max. # frames to process before break out.
8176  */
8177 static bool
8178 brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
8179 {
8180         struct sk_buff *p;
8181         struct sk_buff *head = NULL;
8182         struct sk_buff *tail = NULL;
8183         uint n = 0;
8184         uint bound_limit = bound ? RXBND : -1;
8185
8186         BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
8187         /* gather received frames */
8188         while ((p = dma_rx(wlc_hw->di[fifo]))) {
8189
8190                 if (!tail)
8191                         head = tail = p;
8192                 else {
8193                         tail->prev = p;
8194                         tail = p;
8195                 }
8196
8197                 /* !give others some time to run! */
8198                 if (++n >= bound_limit)
8199                         break;
8200         }
8201
8202         /* post more rbufs */
8203         dma_rxfill(wlc_hw->di[fifo]);
8204
8205         /* process each frame */
8206         while ((p = head) != NULL) {
8207                 struct d11rxhdr_le *rxh_le;
8208                 struct d11rxhdr *rxh;
8209                 head = head->prev;
8210                 p->prev = NULL;
8211
8212                 rxh_le = (struct d11rxhdr_le *)p->data;
8213                 rxh = (struct d11rxhdr *)p->data;
8214
8215                 /* fixup rx header endianness */
8216                 rxh->RxFrameSize = le16_to_cpu(rxh_le->RxFrameSize);
8217                 rxh->PhyRxStatus_0 = le16_to_cpu(rxh_le->PhyRxStatus_0);
8218                 rxh->PhyRxStatus_1 = le16_to_cpu(rxh_le->PhyRxStatus_1);
8219                 rxh->PhyRxStatus_2 = le16_to_cpu(rxh_le->PhyRxStatus_2);
8220                 rxh->PhyRxStatus_3 = le16_to_cpu(rxh_le->PhyRxStatus_3);
8221                 rxh->PhyRxStatus_4 = le16_to_cpu(rxh_le->PhyRxStatus_4);
8222                 rxh->PhyRxStatus_5 = le16_to_cpu(rxh_le->PhyRxStatus_5);
8223                 rxh->RxStatus1 = le16_to_cpu(rxh_le->RxStatus1);
8224                 rxh->RxStatus2 = le16_to_cpu(rxh_le->RxStatus2);
8225                 rxh->RxTSFTime = le16_to_cpu(rxh_le->RxTSFTime);
8226                 rxh->RxChan = le16_to_cpu(rxh_le->RxChan);
8227
8228                 brcms_c_recv(wlc_hw->wlc, p);
8229         }
8230
8231         return n >= bound_limit;
8232 }
8233
8234 /* second-level interrupt processing
8235  *   Return true if another dpc needs to be re-scheduled. false otherwise.
8236  *   Param 'bounded' indicates if applicable loops should be bounded.
8237  */
8238 bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded)
8239 {
8240         u32 macintstatus;
8241         struct brcms_hardware *wlc_hw = wlc->hw;
8242         struct d11regs __iomem *regs = wlc_hw->regs;
8243         struct wiphy *wiphy = wlc->wiphy;
8244
8245         if (brcms_deviceremoved(wlc)) {
8246                 wiphy_err(wiphy, "wl%d: %s: dead chip\n", wlc_hw->unit,
8247                           __func__);
8248                 brcms_down(wlc->wl);
8249                 return false;
8250         }
8251
8252         /* grab and clear the saved software intstatus bits */
8253         macintstatus = wlc->macintstatus;
8254         wlc->macintstatus = 0;
8255
8256         BCMMSG(wlc->wiphy, "wl%d: macintstatus 0x%x\n",
8257                wlc_hw->unit, macintstatus);
8258
8259         WARN_ON(macintstatus & MI_PRQ); /* PRQ Interrupt in non-MBSS */
8260
8261         /* tx status */
8262         if (macintstatus & MI_TFS) {
8263                 bool fatal;
8264                 if (brcms_b_txstatus(wlc->hw, bounded, &fatal))
8265                         wlc->macintstatus |= MI_TFS;
8266                 if (fatal) {
8267                         wiphy_err(wiphy, "MI_TFS: fatal\n");
8268                         goto fatal;
8269                 }
8270         }
8271
8272         if (macintstatus & (MI_TBTT | MI_DTIM_TBTT))
8273                 brcms_c_tbtt(wlc);
8274
8275         /* ATIM window end */
8276         if (macintstatus & MI_ATIMWINEND) {
8277                 BCMMSG(wlc->wiphy, "end of ATIM window\n");
8278                 OR_REG(&regs->maccommand, wlc->qvalid);
8279                 wlc->qvalid = 0;
8280         }
8281
8282         /*
8283          * received data or control frame, MI_DMAINT is
8284          * indication of RX_FIFO interrupt
8285          */
8286         if (macintstatus & MI_DMAINT)
8287                 if (brcms_b_recv(wlc_hw, RX_FIFO, bounded))
8288                         wlc->macintstatus |= MI_DMAINT;
8289
8290         /* noise sample collected */
8291         if (macintstatus & MI_BG_NOISE)
8292                 wlc_phy_noise_sample_intr(wlc_hw->band->pi);
8293
8294         if (macintstatus & MI_GP0) {
8295                 wiphy_err(wiphy, "wl%d: PSM microcode watchdog fired at %d "
8296                         "(seconds). Resetting.\n", wlc_hw->unit, wlc_hw->now);
8297
8298                 printk_once("%s : PSM Watchdog, chipid 0x%x, chiprev 0x%x\n",
8299                                         __func__, wlc_hw->sih->chip,
8300                                         wlc_hw->sih->chiprev);
8301                 brcms_fatal_error(wlc_hw->wlc->wl);
8302         }
8303
8304         /* gptimer timeout */
8305         if (macintstatus & MI_TO)
8306                 W_REG(&regs->gptimer, 0);
8307
8308         if (macintstatus & MI_RFDISABLE) {
8309                 BCMMSG(wlc->wiphy, "wl%d: BMAC Detected a change on the"
8310                        " RF Disable Input\n", wlc_hw->unit);
8311                 brcms_rfkill_set_hw_state(wlc->wl);
8312         }
8313
8314         /* send any enq'd tx packets. Just makes sure to jump start tx */
8315         if (!pktq_empty(&wlc->pkt_queue->q))
8316                 brcms_c_send_q(wlc);
8317
8318         /* it isn't done and needs to be resched if macintstatus is non-zero */
8319         return wlc->macintstatus != 0;
8320
8321  fatal:
8322         brcms_fatal_error(wlc_hw->wlc->wl);
8323         return wlc->macintstatus != 0;
8324 }
8325
8326 void brcms_c_init(struct brcms_c_info *wlc)
8327 {
8328         struct d11regs __iomem *regs;
8329         u16 chanspec;
8330         bool mute = false;
8331
8332         BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
8333
8334         regs = wlc->regs;
8335
8336         /*
8337          * This will happen if a big-hammer was executed. In
8338          * that case, we want to go back to the channel that
8339          * we were on and not new channel
8340          */
8341         if (wlc->pub->associated)
8342                 chanspec = wlc->home_chanspec;
8343         else
8344                 chanspec = brcms_c_init_chanspec(wlc);
8345
8346         brcms_b_init(wlc->hw, chanspec, mute);
8347
8348         /* update beacon listen interval */
8349         brcms_c_bcn_li_upd(wlc);
8350
8351         /* write ethernet address to core */
8352         brcms_c_set_mac(wlc->bsscfg);
8353         brcms_c_set_bssid(wlc->bsscfg);
8354
8355         /* Update tsf_cfprep if associated and up */
8356         if (wlc->pub->associated && wlc->bsscfg->up) {
8357                 u32 bi;
8358
8359                 /* get beacon period and convert to uS */
8360                 bi = wlc->bsscfg->current_bss->beacon_period << 10;
8361                 /*
8362                  * update since init path would reset
8363                  * to default value
8364                  */
8365                 W_REG(&regs->tsf_cfprep,
8366                       (bi << CFPREP_CBI_SHIFT));
8367
8368                 /* Update maccontrol PM related bits */
8369                 brcms_c_set_ps_ctrl(wlc);
8370         }
8371
8372         brcms_c_bandinit_ordered(wlc, chanspec);
8373
8374         /* init probe response timeout */
8375         brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
8376
8377         /* init max burst txop (framebursting) */
8378         brcms_b_write_shm(wlc->hw, M_MBURST_TXOP,
8379                       (wlc->
8380                        _rifs ? (EDCF_AC_VO_TXOP_AP << 5) : MAXFRAMEBURST_TXOP));
8381
8382         /* initialize maximum allowed duty cycle */
8383         brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_ofdm, true, true);
8384         brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_cck, false, true);
8385
8386         /*
8387          * Update some shared memory locations related to
8388          * max AMPDU size allowed to received
8389          */
8390         brcms_c_ampdu_shm_upd(wlc->ampdu);
8391
8392         /* band-specific inits */
8393         brcms_c_bsinit(wlc);
8394
8395         /* Enable EDCF mode (while the MAC is suspended) */
8396         OR_REG(&regs->ifs_ctl, IFS_USEEDCF);
8397         brcms_c_edcf_setparams(wlc, false);
8398
8399         /* Init precedence maps for empty FIFOs */
8400         brcms_c_tx_prec_map_init(wlc);
8401
8402         /* read the ucode version if we have not yet done so */
8403         if (wlc->ucode_rev == 0) {
8404                 wlc->ucode_rev =
8405                     brcms_b_read_shm(wlc->hw, M_BOM_REV_MAJOR) << NBITS(u16);
8406                 wlc->ucode_rev |= brcms_b_read_shm(wlc->hw, M_BOM_REV_MINOR);
8407         }
8408
8409         /* ..now really unleash hell (allow the MAC out of suspend) */
8410         brcms_c_enable_mac(wlc);
8411
8412         /* clear tx flow control */
8413         brcms_c_txflowcontrol_reset(wlc);
8414
8415         /* enable the RF Disable Delay timer */
8416         W_REG(&wlc->regs->rfdisabledly, RFDISABLE_DEFAULT);
8417
8418         /*
8419          * Initialize WME parameters; if they haven't been set by some other
8420          * mechanism (IOVar, etc) then read them from the hardware.
8421          */
8422         if (GFIELD(wlc->wme_retries[0], EDCF_SHORT) == 0) {
8423                 /* Uninitialized; read from HW */
8424                 int ac;
8425
8426                 for (ac = 0; ac < AC_COUNT; ac++)
8427                         wlc->wme_retries[ac] =
8428                             brcms_b_read_shm(wlc->hw, M_AC_TXLMT_ADDR(ac));
8429         }
8430 }
8431
8432 /*
8433  * The common driver entry routine. Error codes should be unique
8434  */
8435 struct brcms_c_info *
8436 brcms_c_attach(struct brcms_info *wl, u16 vendor, u16 device, uint unit,
8437                bool piomode, void __iomem *regsva, struct pci_dev *btparam,
8438                uint *perr)
8439 {
8440         struct brcms_c_info *wlc;
8441         uint err = 0;
8442         uint i, j;
8443         struct brcms_pub *pub;
8444
8445         /* allocate struct brcms_c_info state and its substructures */
8446         wlc = (struct brcms_c_info *) brcms_c_attach_malloc(unit, &err, device);
8447         if (wlc == NULL)
8448                 goto fail;
8449         wlc->wiphy = wl->wiphy;
8450         pub = wlc->pub;
8451
8452 #if defined(BCMDBG)
8453         wlc_info_dbg = wlc;
8454 #endif
8455
8456         wlc->band = wlc->bandstate[0];
8457         wlc->core = wlc->corestate;
8458         wlc->wl = wl;
8459         pub->unit = unit;
8460         pub->_piomode = piomode;
8461         wlc->bandinit_pending = false;
8462
8463         /* populate struct brcms_c_info with default values  */
8464         brcms_c_info_init(wlc, unit);
8465
8466         /* update sta/ap related parameters */
8467         brcms_c_ap_upd(wlc);
8468
8469         /*
8470          * low level attach steps(all hw accesses go
8471          * inside, no more in rest of the attach)
8472          */
8473         err = brcms_b_attach(wlc, vendor, device, unit, piomode, regsva,
8474                              btparam);
8475         if (err)
8476                 goto fail;
8477
8478         brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, OFF);
8479
8480         pub->phy_11ncapable = BRCMS_PHY_11N_CAP(wlc->band);
8481
8482         /* disable allowed duty cycle */
8483         wlc->tx_duty_cycle_ofdm = 0;
8484         wlc->tx_duty_cycle_cck = 0;
8485
8486         brcms_c_stf_phy_chain_calc(wlc);
8487
8488         /* txchain 1: txant 0, txchain 2: txant 1 */
8489         if (BRCMS_ISNPHY(wlc->band) && (wlc->stf->txstreams == 1))
8490                 wlc->stf->txant = wlc->stf->hw_txchain - 1;
8491
8492         /* push to BMAC driver */
8493         wlc_phy_stf_chain_init(wlc->band->pi, wlc->stf->hw_txchain,
8494                                wlc->stf->hw_rxchain);
8495
8496         /* pull up some info resulting from the low attach */
8497         for (i = 0; i < NFIFO; i++)
8498                 wlc->core->txavail[i] = wlc->hw->txavail[i];
8499
8500         memcpy(&wlc->perm_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
8501         memcpy(&pub->cur_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
8502
8503         for (j = 0; j < wlc->pub->_nbands; j++) {
8504                 wlc->band = wlc->bandstate[j];
8505
8506                 if (!brcms_c_attach_stf_ant_init(wlc)) {
8507                         err = 24;
8508                         goto fail;
8509                 }
8510
8511                 /* default contention windows size limits */
8512                 wlc->band->CWmin = APHY_CWMIN;
8513                 wlc->band->CWmax = PHY_CWMAX;
8514
8515                 /* init gmode value */
8516                 if (wlc->band->bandtype == BRCM_BAND_2G) {
8517                         wlc->band->gmode = GMODE_AUTO;
8518                         brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER,
8519                                            wlc->band->gmode);
8520                 }
8521
8522                 /* init _n_enab supported mode */
8523                 if (BRCMS_PHY_11N_CAP(wlc->band)) {
8524                         pub->_n_enab = SUPPORT_11N;
8525                         brcms_c_protection_upd(wlc, BRCMS_PROT_N_USER,
8526                                                    ((pub->_n_enab ==
8527                                                      SUPPORT_11N) ? WL_11N_2x2 :
8528                                                     WL_11N_3x3));
8529                 }
8530
8531                 /* init per-band default rateset, depend on band->gmode */
8532                 brcms_default_rateset(wlc, &wlc->band->defrateset);
8533
8534                 /* fill in hw_rateset */
8535                 brcms_c_rateset_filter(&wlc->band->defrateset,
8536                                    &wlc->band->hw_rateset, false,
8537                                    BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
8538                                    (bool) (wlc->pub->_n_enab & SUPPORT_11N));
8539         }
8540
8541         /*
8542          * update antenna config due to
8543          * wlc->stf->txant/txchain/ant_rx_ovr change
8544          */
8545         brcms_c_stf_phy_txant_upd(wlc);
8546
8547         /* attach each modules */
8548         err = brcms_c_attach_module(wlc);
8549         if (err != 0)
8550                 goto fail;
8551
8552         if (!brcms_c_timers_init(wlc, unit)) {
8553                 wiphy_err(wl->wiphy, "wl%d: %s: init_timer failed\n", unit,
8554                           __func__);
8555                 err = 32;
8556                 goto fail;
8557         }
8558
8559         /* depend on rateset, gmode */
8560         wlc->cmi = brcms_c_channel_mgr_attach(wlc);
8561         if (!wlc->cmi) {
8562                 wiphy_err(wl->wiphy, "wl%d: %s: channel_mgr_attach failed"
8563                           "\n", unit, __func__);
8564                 err = 33;
8565                 goto fail;
8566         }
8567
8568         /* init default when all parameters are ready, i.e. ->rateset */
8569         brcms_c_bss_default_init(wlc);
8570
8571         /*
8572          * Complete the wlc default state initializations..
8573          */
8574
8575         /* allocate our initial queue */
8576         wlc->pkt_queue = brcms_c_txq_alloc(wlc);
8577         if (wlc->pkt_queue == NULL) {
8578                 wiphy_err(wl->wiphy, "wl%d: %s: failed to malloc tx queue\n",
8579                           unit, __func__);
8580                 err = 100;
8581                 goto fail;
8582         }
8583
8584         wlc->bsscfg->wlc = wlc;
8585
8586         wlc->mimoft = FT_HT;
8587         wlc->mimo_40txbw = AUTO;
8588         wlc->ofdm_40txbw = AUTO;
8589         wlc->cck_40txbw = AUTO;
8590         brcms_c_update_mimo_band_bwcap(wlc, BRCMS_N_BW_20IN2G_40IN5G);
8591
8592         /* Set default values of SGI */
8593         if (BRCMS_SGI_CAP_PHY(wlc)) {
8594                 brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8595                                                BRCMS_N_SGI_40));
8596         } else if (BRCMS_ISSSLPNPHY(wlc->band)) {
8597                 brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8598                                                BRCMS_N_SGI_40));
8599         } else {
8600                 brcms_c_ht_update_sgi_rx(wlc, 0);
8601         }
8602
8603         brcms_c_radio_mon_upd(wlc);
8604         brcms_b_antsel_set(wlc->hw, wlc->asi->antsel_avail);
8605
8606         if (perr)
8607                 *perr = 0;
8608
8609         return wlc;
8610
8611  fail:
8612         wiphy_err(wl->wiphy, "wl%d: %s: failed with err %d\n",
8613                   unit, __func__, err);
8614         if (wlc)
8615                 brcms_c_detach(wlc);
8616
8617         if (perr)
8618                 *perr = err;
8619         return NULL;
8620 }