1 /*
2  * Copyright (c) 2010 Broadcom Corporation
3  * Copyright (c) 2013 Hauke Mehrtens <hauke@hauke-m.de>
4  *
5  * Permission to use, copy, modify, and/or distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
12  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
14  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
15  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
19 
20 #include <linux/pci_ids.h>
21 #include <linux/if_ether.h>
22 #include <net/cfg80211.h>
23 #include <net/mac80211.h>
24 #include <brcm_hw_ids.h>
25 #include <aiutils.h>
26 #include <chipcommon.h>
27 #include "rate.h"
28 #include "scb.h"
29 #include "phy/phy_hal.h"
30 #include "channel.h"
31 #include "antsel.h"
32 #include "stf.h"
33 #include "ampdu.h"
34 #include "mac80211_if.h"
35 #include "ucode_loader.h"
36 #include "main.h"
37 #include "soc.h"
38 #include "dma.h"
39 #include "debug.h"
40 #include "brcms_trace_events.h"
41 
42 /* watchdog timer, in unit of ms */
43 #define TIMER_INTERVAL_WATCHDOG		1000
44 /* radio monitor timer, in unit of ms */
45 #define TIMER_INTERVAL_RADIOCHK		800
46 
47 /* beacon interval, in unit of 1024TU */
48 #define BEACON_INTERVAL_DEFAULT		100
49 
50 /* n-mode support capability */
51 /* 2x2 includes both 1x1 & 2x2 devices
52  * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
53  * control it independently
54  */
55 #define WL_11N_2x2			1
56 #define WL_11N_3x3			3
57 #define WL_11N_4x4			4
58 
59 #define EDCF_ACI_MASK			0x60
60 #define EDCF_ACI_SHIFT			5
61 #define EDCF_ECWMIN_MASK		0x0f
62 #define EDCF_ECWMAX_SHIFT		4
63 #define EDCF_AIFSN_MASK			0x0f
64 #define EDCF_AIFSN_MAX			15
65 #define EDCF_ECWMAX_MASK		0xf0
66 
67 #define EDCF_AC_BE_TXOP_STA		0x0000
68 #define EDCF_AC_BK_TXOP_STA		0x0000
69 #define EDCF_AC_VO_ACI_STA		0x62
70 #define EDCF_AC_VO_ECW_STA		0x32
71 #define EDCF_AC_VI_ACI_STA		0x42
72 #define EDCF_AC_VI_ECW_STA		0x43
73 #define EDCF_AC_BK_ECW_STA		0xA4
74 #define EDCF_AC_VI_TXOP_STA		0x005e
75 #define EDCF_AC_VO_TXOP_STA		0x002f
76 #define EDCF_AC_BE_ACI_STA		0x03
77 #define EDCF_AC_BE_ECW_STA		0xA4
78 #define EDCF_AC_BK_ACI_STA		0x27
79 #define EDCF_AC_VO_TXOP_AP		0x002f
80 
81 #define EDCF_TXOP2USEC(txop)		((txop) << 5)
82 #define EDCF_ECW2CW(exp)		((1 << (exp)) - 1)
83 
84 #define APHY_SYMBOL_TIME		4
85 #define APHY_PREAMBLE_TIME		16
86 #define APHY_SIGNAL_TIME		4
87 #define APHY_SIFS_TIME			16
88 #define APHY_SERVICE_NBITS		16
89 #define APHY_TAIL_NBITS			6
90 #define BPHY_SIFS_TIME			10
91 #define BPHY_PLCP_SHORT_TIME		96
92 
93 #define PREN_PREAMBLE			24
94 #define PREN_MM_EXT			12
95 #define PREN_PREAMBLE_EXT		4
96 
97 #define DOT11_MAC_HDR_LEN		24
98 #define DOT11_ACK_LEN			10
99 #define DOT11_BA_LEN			4
100 #define DOT11_OFDM_SIGNAL_EXTENSION	6
101 #define DOT11_MIN_FRAG_LEN		256
102 #define DOT11_RTS_LEN			16
103 #define DOT11_CTS_LEN			10
104 #define DOT11_BA_BITMAP_LEN		128
105 #define DOT11_MAXNUMFRAGS		16
106 #define DOT11_MAX_FRAG_LEN		2346
107 
108 #define BPHY_PLCP_TIME			192
109 #define RIFS_11N_TIME			2
110 
111 /* length of the BCN template area */
112 #define BCN_TMPL_LEN			512
113 
114 /* brcms_bss_info flag bit values */
115 #define BRCMS_BSS_HT			0x0020	/* BSS is HT (MIMO) capable */
116 
117 /* chip rx buffer offset */
118 #define BRCMS_HWRXOFF			38
119 
120 /* rfdisable delay timer 500 ms, runs of ALP clock */
121 #define RFDISABLE_DEFAULT		10000000
122 
123 #define BRCMS_TEMPSENSE_PERIOD		10	/* 10 second timeout */
124 
125 /* synthpu_dly times in us */
126 #define SYNTHPU_DLY_APHY_US		3700
127 #define SYNTHPU_DLY_BPHY_US		1050
128 #define SYNTHPU_DLY_NPHY_US		2048
129 #define SYNTHPU_DLY_LPPHY_US		300
130 
131 #define ANTCNT				10	/* vanilla M_MAX_ANTCNT val */
132 
133 /* Per-AC retry limit register definitions; uses defs.h bitfield macros */
134 #define EDCF_SHORT_S			0
135 #define EDCF_SFB_S			4
136 #define EDCF_LONG_S			8
137 #define EDCF_LFB_S			12
138 #define EDCF_SHORT_M			BITFIELD_MASK(4)
139 #define EDCF_SFB_M			BITFIELD_MASK(4)
140 #define EDCF_LONG_M			BITFIELD_MASK(4)
141 #define EDCF_LFB_M			BITFIELD_MASK(4)
142 
143 #define RETRY_SHORT_DEF			7	/* Default Short retry Limit */
144 #define RETRY_SHORT_MAX			255	/* Maximum Short retry Limit */
145 #define RETRY_LONG_DEF			4	/* Default Long retry count */
146 #define RETRY_SHORT_FB			3	/* Short count for fb rate */
147 #define RETRY_LONG_FB			2	/* Long count for fb rate */
148 
149 #define APHY_CWMIN			15
150 #define PHY_CWMAX			1023
151 
152 #define EDCF_AIFSN_MIN			1
153 
154 #define FRAGNUM_MASK			0xF
155 
156 #define APHY_SLOT_TIME			9
157 #define BPHY_SLOT_TIME			20
158 
159 #define WL_SPURAVOID_OFF		0
160 #define WL_SPURAVOID_ON1		1
161 #define WL_SPURAVOID_ON2		2
162 
163 /* invalid core flags, use the saved coreflags */
164 #define BRCMS_USE_COREFLAGS		0xffffffff
165 
166 /* values for PLCPHdr_override */
167 #define BRCMS_PLCP_AUTO			-1
168 #define BRCMS_PLCP_SHORT		0
169 #define BRCMS_PLCP_LONG			1
170 
171 /* values for g_protection_override and n_protection_override */
172 #define BRCMS_PROTECTION_AUTO		-1
173 #define BRCMS_PROTECTION_OFF		0
174 #define BRCMS_PROTECTION_ON		1
175 #define BRCMS_PROTECTION_MMHDR_ONLY	2
176 #define BRCMS_PROTECTION_CTS_ONLY	3
177 
178 /* values for g_protection_control and n_protection_control */
179 #define BRCMS_PROTECTION_CTL_OFF	0
180 #define BRCMS_PROTECTION_CTL_LOCAL	1
181 #define BRCMS_PROTECTION_CTL_OVERLAP	2
182 
183 /* values for n_protection */
184 #define BRCMS_N_PROTECTION_OFF		0
185 #define BRCMS_N_PROTECTION_OPTIONAL	1
186 #define BRCMS_N_PROTECTION_20IN40	2
187 #define BRCMS_N_PROTECTION_MIXEDMODE	3
188 
189 /* values for band specific 40MHz capabilities */
190 #define BRCMS_N_BW_20ALL		0
191 #define BRCMS_N_BW_40ALL		1
192 #define BRCMS_N_BW_20IN2G_40IN5G	2
193 
194 /* bitflags for SGI support (sgi_rx iovar) */
195 #define BRCMS_N_SGI_20			0x01
196 #define BRCMS_N_SGI_40			0x02
197 
198 /* defines used by the nrate iovar */
199 /* MSC in use,indicates b0-6 holds an mcs */
200 #define NRATE_MCS_INUSE			0x00000080
201 /* rate/mcs value */
202 #define NRATE_RATE_MASK			0x0000007f
203 /* stf mode mask: siso, cdd, stbc, sdm */
204 #define NRATE_STF_MASK			0x0000ff00
205 /* stf mode shift */
206 #define NRATE_STF_SHIFT			8
207 /* bit indicate to override mcs only */
208 #define NRATE_OVERRIDE_MCS_ONLY		0x40000000
209 #define NRATE_SGI_MASK			0x00800000	/* sgi mode */
210 #define NRATE_SGI_SHIFT			23		/* sgi mode */
211 #define NRATE_LDPC_CODING		0x00400000	/* adv coding in use */
212 #define NRATE_LDPC_SHIFT		22		/* ldpc shift */
213 
214 #define NRATE_STF_SISO			0		/* stf mode SISO */
215 #define NRATE_STF_CDD			1		/* stf mode CDD */
216 #define NRATE_STF_STBC			2		/* stf mode STBC */
217 #define NRATE_STF_SDM			3		/* stf mode SDM */
218 
219 #define MAX_DMA_SEGS			4
220 
221 /* # of entries in Tx FIFO */
222 #define NTXD				64
223 /* Max # of entries in Rx FIFO based on 4kb page size */
224 #define NRXD				256
225 
226 /* Amount of headroom to leave in Tx FIFO */
227 #define TX_HEADROOM			4
228 
229 /* try to keep this # rbufs posted to the chip */
230 #define NRXBUFPOST			32
231 
232 /* max # frames to process in brcms_c_recv() */
233 #define RXBND				8
234 /* max # tx status to process in wlc_txstatus() */
235 #define TXSBND				8
236 
237 /* brcmu_format_flags() bit description structure */
238 struct brcms_c_bit_desc {
239 	u32 bit;
240 	const char *name;
241 };
242 
243 /*
244  * The following table lists the buffer memory allocated to xmt fifos in HW.
245  * the size is in units of 256bytes(one block), total size is HW dependent
246  * ucode has default fifo partition, sw can overwrite if necessary
247  *
248  * This is documented in twiki under the topic UcodeTxFifo. Please ensure
249  * the twiki is updated before making changes.
250  */
251 
252 /* Starting corerev for the fifo size table */
253 #define XMTFIFOTBL_STARTREV	17
254 
255 struct d11init {
256 	__le16 addr;
257 	__le16 size;
258 	__le32 value;
259 };
260 
261 struct edcf_acparam {
262 	u8 ACI;
263 	u8 ECW;
264 	u16 TXOP;
265 } __packed;
266 
267 /* debug/trace */
268 uint brcm_msg_level;
269 
270 /* TX FIFO number to WME/802.1E Access Category */
271 static const u8 wme_fifo2ac[] = {
272 	IEEE80211_AC_BK,
273 	IEEE80211_AC_BE,
274 	IEEE80211_AC_VI,
275 	IEEE80211_AC_VO,
276 	IEEE80211_AC_BE,
277 	IEEE80211_AC_BE
278 };
279 
280 /* ieee80211 Access Category to TX FIFO number */
281 static const u8 wme_ac2fifo[] = {
282 	TX_AC_VO_FIFO,
283 	TX_AC_VI_FIFO,
284 	TX_AC_BE_FIFO,
285 	TX_AC_BK_FIFO
286 };
287 
288 static const u16 xmtfifo_sz[][NFIFO] = {
289 	/* corerev 17: 5120, 49152, 49152, 5376, 4352, 1280 */
290 	{20, 192, 192, 21, 17, 5},
291 	/* corerev 18: */
292 	{0, 0, 0, 0, 0, 0},
293 	/* corerev 19: */
294 	{0, 0, 0, 0, 0, 0},
295 	/* corerev 20: 5120, 49152, 49152, 5376, 4352, 1280 */
296 	{20, 192, 192, 21, 17, 5},
297 	/* corerev 21: 2304, 14848, 5632, 3584, 3584, 1280 */
298 	{9, 58, 22, 14, 14, 5},
299 	/* corerev 22: 5120, 49152, 49152, 5376, 4352, 1280 */
300 	{20, 192, 192, 21, 17, 5},
301 	/* corerev 23: 5120, 49152, 49152, 5376, 4352, 1280 */
302 	{20, 192, 192, 21, 17, 5},
303 	/* corerev 24: 2304, 14848, 5632, 3584, 3584, 1280 */
304 	{9, 58, 22, 14, 14, 5},
305 	/* corerev 25: */
306 	{0, 0, 0, 0, 0, 0},
307 	/* corerev 26: */
308 	{0, 0, 0, 0, 0, 0},
309 	/* corerev 27: */
310 	{0, 0, 0, 0, 0, 0},
311 	/* corerev 28: 2304, 14848, 5632, 3584, 3584, 1280 */
312 	{9, 58, 22, 14, 14, 5},
313 };
314 
315 #ifdef DEBUG
316 static const char * const fifo_names[] = {
317 	"AC_BK", "AC_BE", "AC_VI", "AC_VO", "BCMC", "ATIM" };
318 #else
319 static const char fifo_names[6][1];
320 #endif
321 
322 #ifdef DEBUG
323 /* pointer to most recently allocated wl/wlc */
324 static struct brcms_c_info *wlc_info_dbg = (struct brcms_c_info *) (NULL);
325 #endif
326 
327 /* Mapping of ieee80211 AC numbers to tx fifos */
328 static const u8 ac_to_fifo_mapping[IEEE80211_NUM_ACS] = {
329 	[IEEE80211_AC_VO]	= TX_AC_VO_FIFO,
330 	[IEEE80211_AC_VI]	= TX_AC_VI_FIFO,
331 	[IEEE80211_AC_BE]	= TX_AC_BE_FIFO,
332 	[IEEE80211_AC_BK]	= TX_AC_BK_FIFO,
333 };
334 
335 /* Mapping of tx fifos to ieee80211 AC numbers */
336 static const u8 fifo_to_ac_mapping[IEEE80211_NUM_ACS] = {
337 	[TX_AC_BK_FIFO]	= IEEE80211_AC_BK,
338 	[TX_AC_BE_FIFO]	= IEEE80211_AC_BE,
339 	[TX_AC_VI_FIFO]	= IEEE80211_AC_VI,
340 	[TX_AC_VO_FIFO]	= IEEE80211_AC_VO,
341 };
342 
343 static u8 brcms_ac_to_fifo(u8 ac)
344 {
345 	if (ac >= ARRAY_SIZE(ac_to_fifo_mapping))
346 		return TX_AC_BE_FIFO;
347 	return ac_to_fifo_mapping[ac];
348 }
349 
350 static u8 brcms_fifo_to_ac(u8 fifo)
351 {
352 	if (fifo >= ARRAY_SIZE(fifo_to_ac_mapping))
353 		return IEEE80211_AC_BE;
354 	return fifo_to_ac_mapping[fifo];
355 }
356 
357 /* Find basic rate for a given rate */
358 static u8 brcms_basic_rate(struct brcms_c_info *wlc, u32 rspec)
359 {
360 	if (is_mcs_rate(rspec))
361 		return wlc->band->basic_rate[mcs_table[rspec & RSPEC_RATE_MASK]
362 		       .leg_ofdm];
363 	return wlc->band->basic_rate[rspec & RSPEC_RATE_MASK];
364 }
365 
366 static u16 frametype(u32 rspec, u8 mimoframe)
367 {
368 	if (is_mcs_rate(rspec))
369 		return mimoframe;
370 	return is_cck_rate(rspec) ? FT_CCK : FT_OFDM;
371 }
372 
373 /* currently the best mechanism for determining SIFS is the band in use */
374 static u16 get_sifs(struct brcms_band *band)
375 {
376 	return band->bandtype == BRCM_BAND_5G ? APHY_SIFS_TIME :
377 				 BPHY_SIFS_TIME;
378 }
379 
380 /*
381  * Detect Card removed.
382  * Even checking an sbconfig register read will not false trigger when the core
383  * is in reset it breaks CF address mechanism. Accessing gphy phyversion will
384  * cause SB error if aphy is in reset on 4306B0-DB. Need a simple accessible
385  * reg with fixed 0/1 pattern (some platforms return all 0).
386  * If clocks are present, call the sb routine which will figure out if the
387  * device is removed.
388  */
389 static bool brcms_deviceremoved(struct brcms_c_info *wlc)
390 {
391 	u32 macctrl;
392 
393 	if (!wlc->hw->clk)
394 		return ai_deviceremoved(wlc->hw->sih);
395 	macctrl = bcma_read32(wlc->hw->d11core,
396 			      D11REGOFFS(maccontrol));
397 	return (macctrl & (MCTL_PSM_JMP_0 | MCTL_IHR_EN)) != MCTL_IHR_EN;
398 }
399 
400 /* sum the individual fifo tx pending packet counts */
401 static int brcms_txpktpendtot(struct brcms_c_info *wlc)
402 {
403 	int i;
404 	int pending = 0;
405 
406 	for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
407 		if (wlc->hw->di[i])
408 			pending += dma_txpending(wlc->hw->di[i]);
409 	return pending;
410 }
411 
412 static bool brcms_is_mband_unlocked(struct brcms_c_info *wlc)
413 {
414 	return wlc->pub->_nbands > 1 && !wlc->bandlocked;
415 }
416 
417 static int brcms_chspec_bw(u16 chanspec)
418 {
419 	if (CHSPEC_IS40(chanspec))
420 		return BRCMS_40_MHZ;
421 	if (CHSPEC_IS20(chanspec))
422 		return BRCMS_20_MHZ;
423 
424 	return BRCMS_10_MHZ;
425 }
426 
427 static void brcms_c_bsscfg_mfree(struct brcms_bss_cfg *cfg)
428 {
429 	if (cfg == NULL)
430 		return;
431 
432 	kfree(cfg->current_bss);
433 	kfree(cfg);
434 }
435 
436 static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
437 {
438 	if (wlc == NULL)
439 		return;
440 
441 	brcms_c_bsscfg_mfree(wlc->bsscfg);
442 	kfree(wlc->pub);
443 	kfree(wlc->modulecb);
444 	kfree(wlc->default_bss);
445 	kfree(wlc->protection);
446 	kfree(wlc->stf);
447 	kfree(wlc->bandstate[0]);
448 	if (wlc->corestate)
449 		kfree(wlc->corestate->macstat_snapshot);
450 	kfree(wlc->corestate);
451 	if (wlc->hw)
452 		kfree(wlc->hw->bandstate[0]);
453 	kfree(wlc->hw);
454 	if (wlc->beacon)
455 		dev_kfree_skb_any(wlc->beacon);
456 	if (wlc->probe_resp)
457 		dev_kfree_skb_any(wlc->probe_resp);
458 
459 	kfree(wlc);
460 }
461 
462 static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
463 {
464 	struct brcms_bss_cfg *cfg;
465 
466 	cfg = kzalloc(sizeof(struct brcms_bss_cfg), GFP_ATOMIC);
467 	if (cfg == NULL)
468 		goto fail;
469 
470 	cfg->current_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
471 	if (cfg->current_bss == NULL)
472 		goto fail;
473 
474 	return cfg;
475 
476  fail:
477 	brcms_c_bsscfg_mfree(cfg);
478 	return NULL;
479 }
480 
481 static struct brcms_c_info *
482 brcms_c_attach_malloc(uint unit, uint *err, uint devid)
483 {
484 	struct brcms_c_info *wlc;
485 
486 	wlc = kzalloc(sizeof(struct brcms_c_info), GFP_ATOMIC);
487 	if (wlc == NULL) {
488 		*err = 1002;
489 		goto fail;
490 	}
491 
492 	/* allocate struct brcms_c_pub state structure */
493 	wlc->pub = kzalloc(sizeof(struct brcms_pub), GFP_ATOMIC);
494 	if (wlc->pub == NULL) {
495 		*err = 1003;
496 		goto fail;
497 	}
498 	wlc->pub->wlc = wlc;
499 
500 	/* allocate struct brcms_hardware state structure */
501 
502 	wlc->hw = kzalloc(sizeof(struct brcms_hardware), GFP_ATOMIC);
503 	if (wlc->hw == NULL) {
504 		*err = 1005;
505 		goto fail;
506 	}
507 	wlc->hw->wlc = wlc;
508 
509 	wlc->hw->bandstate[0] =
510 		kcalloc(MAXBANDS, sizeof(struct brcms_hw_band), GFP_ATOMIC);
511 	if (wlc->hw->bandstate[0] == NULL) {
512 		*err = 1006;
513 		goto fail;
514 	} else {
515 		int i;
516 
517 		for (i = 1; i < MAXBANDS; i++)
518 			wlc->hw->bandstate[i] = (struct brcms_hw_band *)
519 			    ((unsigned long)wlc->hw->bandstate[0] +
520 			     (sizeof(struct brcms_hw_band) * i));
521 	}
522 
523 	wlc->modulecb =
524 		kcalloc(BRCMS_MAXMODULES, sizeof(struct modulecb),
525 			GFP_ATOMIC);
526 	if (wlc->modulecb == NULL) {
527 		*err = 1009;
528 		goto fail;
529 	}
530 
531 	wlc->default_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
532 	if (wlc->default_bss == NULL) {
533 		*err = 1010;
534 		goto fail;
535 	}
536 
537 	wlc->bsscfg = brcms_c_bsscfg_malloc(unit);
538 	if (wlc->bsscfg == NULL) {
539 		*err = 1011;
540 		goto fail;
541 	}
542 
543 	wlc->protection = kzalloc(sizeof(struct brcms_protection),
544 				  GFP_ATOMIC);
545 	if (wlc->protection == NULL) {
546 		*err = 1016;
547 		goto fail;
548 	}
549 
550 	wlc->stf = kzalloc(sizeof(struct brcms_stf), GFP_ATOMIC);
551 	if (wlc->stf == NULL) {
552 		*err = 1017;
553 		goto fail;
554 	}
555 
556 	wlc->bandstate[0] =
557 		kcalloc(MAXBANDS, sizeof(struct brcms_band), GFP_ATOMIC);
558 	if (wlc->bandstate[0] == NULL) {
559 		*err = 1025;
560 		goto fail;
561 	} else {
562 		int i;
563 
564 		for (i = 1; i < MAXBANDS; i++)
565 			wlc->bandstate[i] = (struct brcms_band *)
566 				((unsigned long)wlc->bandstate[0]
567 				+ (sizeof(struct brcms_band)*i));
568 	}
569 
570 	wlc->corestate = kzalloc(sizeof(struct brcms_core), GFP_ATOMIC);
571 	if (wlc->corestate == NULL) {
572 		*err = 1026;
573 		goto fail;
574 	}
575 
576 	wlc->corestate->macstat_snapshot =
577 		kzalloc(sizeof(struct macstat), GFP_ATOMIC);
578 	if (wlc->corestate->macstat_snapshot == NULL) {
579 		*err = 1027;
580 		goto fail;
581 	}
582 
583 	return wlc;
584 
585  fail:
586 	brcms_c_detach_mfree(wlc);
587 	return NULL;
588 }
589 
590 /*
591  * Update the slot timing for standard 11b/g (20us slots)
592  * or shortslot 11g (9us slots)
593  * The PSM needs to be suspended for this call.
594  */
595 static void brcms_b_update_slot_timing(struct brcms_hardware *wlc_hw,
596 					bool shortslot)
597 {
598 	struct bcma_device *core = wlc_hw->d11core;
599 
600 	if (shortslot) {
601 		/* 11g short slot: 11a timing */
602 		bcma_write16(core, D11REGOFFS(ifs_slot), 0x0207);
603 		brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, APHY_SLOT_TIME);
604 	} else {
605 		/* 11g long slot: 11b timing */
606 		bcma_write16(core, D11REGOFFS(ifs_slot), 0x0212);
607 		brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, BPHY_SLOT_TIME);
608 	}
609 }
610 
611 /*
612  * calculate frame duration of a given rate and length, return
613  * time in usec unit
614  */
615 static uint brcms_c_calc_frame_time(struct brcms_c_info *wlc, u32 ratespec,
616 				    u8 preamble_type, uint mac_len)
617 {
618 	uint nsyms, dur = 0, Ndps, kNdps;
619 	uint rate = rspec2rate(ratespec);
620 
621 	if (rate == 0) {
622 		brcms_err(wlc->hw->d11core, "wl%d: WAR: using rate of 1 mbps\n",
623 			  wlc->pub->unit);
624 		rate = BRCM_RATE_1M;
625 	}
626 
627 	if (is_mcs_rate(ratespec)) {
628 		uint mcs = ratespec & RSPEC_RATE_MASK;
629 		int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
630 
631 		dur = PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
632 		if (preamble_type == BRCMS_MM_PREAMBLE)
633 			dur += PREN_MM_EXT;
634 		/* 1000Ndbps = kbps * 4 */
635 		kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
636 				   rspec_issgi(ratespec)) * 4;
637 
638 		if (rspec_stc(ratespec) == 0)
639 			nsyms =
640 			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
641 				  APHY_TAIL_NBITS) * 1000, kNdps);
642 		else
643 			/* STBC needs to have even number of symbols */
644 			nsyms =
645 			    2 *
646 			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
647 				  APHY_TAIL_NBITS) * 1000, 2 * kNdps);
648 
649 		dur += APHY_SYMBOL_TIME * nsyms;
650 		if (wlc->band->bandtype == BRCM_BAND_2G)
651 			dur += DOT11_OFDM_SIGNAL_EXTENSION;
652 	} else if (is_ofdm_rate(rate)) {
653 		dur = APHY_PREAMBLE_TIME;
654 		dur += APHY_SIGNAL_TIME;
655 		/* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
656 		Ndps = rate * 2;
657 		/* NSyms = CEILING((SERVICE + 8*NBytes + TAIL) / Ndbps) */
658 		nsyms =
659 		    CEIL((APHY_SERVICE_NBITS + 8 * mac_len + APHY_TAIL_NBITS),
660 			 Ndps);
661 		dur += APHY_SYMBOL_TIME * nsyms;
662 		if (wlc->band->bandtype == BRCM_BAND_2G)
663 			dur += DOT11_OFDM_SIGNAL_EXTENSION;
664 	} else {
665 		/*
666 		 * calc # bits * 2 so factor of 2 in rate (1/2 mbps)
667 		 * will divide out
668 		 */
669 		mac_len = mac_len * 8 * 2;
670 		/* calc ceiling of bits/rate = microseconds of air time */
671 		dur = (mac_len + rate - 1) / rate;
672 		if (preamble_type & BRCMS_SHORT_PREAMBLE)
673 			dur += BPHY_PLCP_SHORT_TIME;
674 		else
675 			dur += BPHY_PLCP_TIME;
676 	}
677 	return dur;
678 }
679 
680 static void brcms_c_write_inits(struct brcms_hardware *wlc_hw,
681 				const struct d11init *inits)
682 {
683 	struct bcma_device *core = wlc_hw->d11core;
684 	int i;
685 	uint offset;
686 	u16 size;
687 	u32 value;
688 
689 	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
690 
691 	for (i = 0; inits[i].addr != cpu_to_le16(0xffff); i++) {
692 		size = le16_to_cpu(inits[i].size);
693 		offset = le16_to_cpu(inits[i].addr);
694 		value = le32_to_cpu(inits[i].value);
695 		if (size == 2)
696 			bcma_write16(core, offset, value);
697 		else if (size == 4)
698 			bcma_write32(core, offset, value);
699 		else
700 			break;
701 	}
702 }
703 
704 static void brcms_c_write_mhf(struct brcms_hardware *wlc_hw, u16 *mhfs)
705 {
706 	u8 idx;
707 	u16 addr[] = {
708 		M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
709 		M_HOST_FLAGS5
710 	};
711 
712 	for (idx = 0; idx < MHFMAX; idx++)
713 		brcms_b_write_shm(wlc_hw, addr[idx], mhfs[idx]);
714 }
715 
716 static void brcms_c_ucode_bsinit(struct brcms_hardware *wlc_hw)
717 {
718 	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
719 
720 	/* init microcode host flags */
721 	brcms_c_write_mhf(wlc_hw, wlc_hw->band->mhfs);
722 
723 	/* do band-specific ucode IHR, SHM, and SCR inits */
724 	if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
725 		if (BRCMS_ISNPHY(wlc_hw->band))
726 			brcms_c_write_inits(wlc_hw, ucode->d11n0bsinitvals16);
727 		else
728 			brcms_err(wlc_hw->d11core,
729 				  "%s: wl%d: unsupported phy in corerev %d\n",
730 				  __func__, wlc_hw->unit,
731 				  wlc_hw->corerev);
732 	} else {
733 		if (D11REV_IS(wlc_hw->corerev, 24)) {
734 			if (BRCMS_ISLCNPHY(wlc_hw->band))
735 				brcms_c_write_inits(wlc_hw,
736 						    ucode->d11lcn0bsinitvals24);
737 			else
738 				brcms_err(wlc_hw->d11core,
739 					  "%s: wl%d: unsupported phy in core rev %d\n",
740 					  __func__, wlc_hw->unit,
741 					  wlc_hw->corerev);
742 		} else {
743 			brcms_err(wlc_hw->d11core,
744 				  "%s: wl%d: unsupported corerev %d\n",
745 				  __func__, wlc_hw->unit, wlc_hw->corerev);
746 		}
747 	}
748 }
749 
750 static void brcms_b_core_ioctl(struct brcms_hardware *wlc_hw, u32 m, u32 v)
751 {
752 	struct bcma_device *core = wlc_hw->d11core;
753 	u32 ioctl = bcma_aread32(core, BCMA_IOCTL) & ~m;
754 
755 	bcma_awrite32(core, BCMA_IOCTL, ioctl | v);
756 }
757 
758 static void brcms_b_core_phy_clk(struct brcms_hardware *wlc_hw, bool clk)
759 {
760 	brcms_dbg_info(wlc_hw->d11core, "wl%d: clk %d\n", wlc_hw->unit, clk);
761 
762 	wlc_hw->phyclk = clk;
763 
764 	if (OFF == clk) {	/* clear gmode bit, put phy into reset */
765 
766 		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC | SICF_GMODE),
767 				   (SICF_PRST | SICF_FGC));
768 		udelay(1);
769 		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_PRST);
770 		udelay(1);
771 
772 	} else {		/* take phy out of reset */
773 
774 		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_FGC);
775 		udelay(1);
776 		brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
777 		udelay(1);
778 
779 	}
780 }
781 
782 /* low-level band switch utility routine */
783 static void brcms_c_setxband(struct brcms_hardware *wlc_hw, uint bandunit)
784 {
785 	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
786 			   bandunit);
787 
788 	wlc_hw->band = wlc_hw->bandstate[bandunit];
789 
790 	/*
791 	 * BMAC_NOTE:
792 	 *   until we eliminate need for wlc->band refs in low level code
793 	 */
794 	wlc_hw->wlc->band = wlc_hw->wlc->bandstate[bandunit];
795 
796 	/* set gmode core flag */
797 	if (wlc_hw->sbclk && !wlc_hw->noreset) {
798 		u32 gmode = 0;
799 
800 		if (bandunit == 0)
801 			gmode = SICF_GMODE;
802 
803 		brcms_b_core_ioctl(wlc_hw, SICF_GMODE, gmode);
804 	}
805 }
806 
807 /* switch to new band but leave it inactive */
808 static u32 brcms_c_setband_inact(struct brcms_c_info *wlc, uint bandunit)
809 {
810 	struct brcms_hardware *wlc_hw = wlc->hw;
811 	u32 macintmask;
812 	u32 macctrl;
813 
814 	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
815 	macctrl = bcma_read32(wlc_hw->d11core,
816 			      D11REGOFFS(maccontrol));
817 	WARN_ON((macctrl & MCTL_EN_MAC) != 0);
818 
819 	/* disable interrupts */
820 	macintmask = brcms_intrsoff(wlc->wl);
821 
822 	/* radio off */
823 	wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
824 
825 	brcms_b_core_phy_clk(wlc_hw, OFF);
826 
827 	brcms_c_setxband(wlc_hw, bandunit);
828 
829 	return macintmask;
830 }
831 
832 /* process an individual struct tx_status */
833 static bool
834 brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
835 {
836 	struct sk_buff *p = NULL;
837 	uint queue = NFIFO;
838 	struct dma_pub *dma = NULL;
839 	struct d11txh *txh = NULL;
840 	struct scb *scb = NULL;
841 	int tx_frame_count;
842 	uint supr_status;
843 	bool lastframe;
844 	struct ieee80211_hdr *h;
845 	u16 mcl;
846 	struct ieee80211_tx_info *tx_info;
847 	struct ieee80211_tx_rate *txrate;
848 	int i;
849 	bool fatal = true;
850 
851 	trace_brcms_txstatus(&wlc->hw->d11core->dev, txs->framelen,
852 			     txs->frameid, txs->status, txs->lasttxtime,
853 			     txs->sequence, txs->phyerr, txs->ackphyrxsh);
854 
855 	/* discard intermediate indications for ucode with one legitimate case:
856 	 *   e.g. if "useRTS" is set. ucode did a successful rts/cts exchange,
857 	 *   but the subsequent tx of DATA failed. so it will start rts/cts
858 	 *   from the beginning (resetting the rts transmission count)
859 	 */
860 	if (!(txs->status & TX_STATUS_AMPDU)
861 	    && (txs->status & TX_STATUS_INTERMEDIATE)) {
862 		brcms_dbg_tx(wlc->hw->d11core, "INTERMEDIATE but not AMPDU\n");
863 		fatal = false;
864 		goto out;
865 	}
866 
867 	queue = txs->frameid & TXFID_QUEUE_MASK;
868 	if (queue >= NFIFO) {
869 		brcms_err(wlc->hw->d11core, "queue %u >= NFIFO\n", queue);
870 		goto out;
871 	}
872 
873 	dma = wlc->hw->di[queue];
874 
875 	p = dma_getnexttxp(wlc->hw->di[queue], DMA_RANGE_TRANSMITTED);
876 	if (p == NULL) {
877 		brcms_err(wlc->hw->d11core, "dma_getnexttxp returned null!\n");
878 		goto out;
879 	}
880 
881 	txh = (struct d11txh *) (p->data);
882 	mcl = le16_to_cpu(txh->MacTxControlLow);
883 
884 	if (txs->phyerr)
885 		brcms_dbg_tx(wlc->hw->d11core, "phyerr 0x%x, rate 0x%x\n",
886 			     txs->phyerr, txh->MainRates);
887 
888 	if (txs->frameid != le16_to_cpu(txh->TxFrameID)) {
889 		brcms_err(wlc->hw->d11core, "frameid != txh->TxFrameID\n");
890 		goto out;
891 	}
892 	tx_info = IEEE80211_SKB_CB(p);
893 	h = (struct ieee80211_hdr *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN);
894 
895 	if (tx_info->rate_driver_data[0])
896 		scb = &wlc->pri_scb;
897 
898 	if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
899 		brcms_c_ampdu_dotxstatus(wlc->ampdu, scb, p, txs);
900 		fatal = false;
901 		goto out;
902 	}
903 
904 	/*
905 	 * brcms_c_ampdu_dotxstatus() will trace tx descriptors for AMPDU
906 	 * frames; this traces them for the rest.
907 	 */
908 	trace_brcms_txdesc(&wlc->hw->d11core->dev, txh, sizeof(*txh));
909 
910 	supr_status = txs->status & TX_STATUS_SUPR_MASK;
911 	if (supr_status == TX_STATUS_SUPR_BADCH) {
912 		unsigned xfts = le16_to_cpu(txh->XtraFrameTypes);
913 		brcms_dbg_tx(wlc->hw->d11core,
914 			     "Pkt tx suppressed, dest chan %u, current %d\n",
915 			     (xfts >> XFTS_CHANNEL_SHIFT) & 0xff,
916 			     CHSPEC_CHANNEL(wlc->default_bss->chanspec));
917 	}
918 
919 	tx_frame_count =
920 	    (txs->status & TX_STATUS_FRM_RTX_MASK) >> TX_STATUS_FRM_RTX_SHIFT;
921 
922 	lastframe = !ieee80211_has_morefrags(h->frame_control);
923 
924 	if (!lastframe) {
925 		brcms_err(wlc->hw->d11core, "Not last frame!\n");
926 	} else {
927 		/*
928 		 * Set information to be consumed by Minstrel ht.
929 		 *
930 		 * The "fallback limit" is the number of tx attempts a given
931 		 * MPDU is sent at the "primary" rate. Tx attempts beyond that
932 		 * limit are sent at the "secondary" rate.
933 		 * A 'short frame' does not exceed RTS treshold.
934 		 */
935 		u16 sfbl,	/* Short Frame Rate Fallback Limit */
936 		    lfbl,	/* Long Frame Rate Fallback Limit */
937 		    fbl;
938 
939 		if (queue < IEEE80211_NUM_ACS) {
940 			sfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
941 				      EDCF_SFB);
942 			lfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
943 				      EDCF_LFB);
944 		} else {
945 			sfbl = wlc->SFBL;
946 			lfbl = wlc->LFBL;
947 		}
948 
949 		txrate = tx_info->status.rates;
950 		if (txrate[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
951 			fbl = lfbl;
952 		else
953 			fbl = sfbl;
954 
955 		ieee80211_tx_info_clear_status(tx_info);
956 
957 		if ((tx_frame_count > fbl) && (txrate[1].idx >= 0)) {
958 			/*
959 			 * rate selection requested a fallback rate
960 			 * and we used it
961 			 */
962 			txrate[0].count = fbl;
963 			txrate[1].count = tx_frame_count - fbl;
964 		} else {
965 			/*
966 			 * rate selection did not request fallback rate, or
967 			 * we didn't need it
968 			 */
969 			txrate[0].count = tx_frame_count;
970 			/*
971 			 * rc80211_minstrel.c:minstrel_tx_status() expects
972 			 * unused rates to be marked with idx = -1
973 			 */
974 			txrate[1].idx = -1;
975 			txrate[1].count = 0;
976 		}
977 
978 		/* clear the rest of the rates */
979 		for (i = 2; i < IEEE80211_TX_MAX_RATES; i++) {
980 			txrate[i].idx = -1;
981 			txrate[i].count = 0;
982 		}
983 
984 		if (txs->status & TX_STATUS_ACK_RCV)
985 			tx_info->flags |= IEEE80211_TX_STAT_ACK;
986 	}
987 
988 	if (lastframe) {
989 		/* remove PLCP & Broadcom tx descriptor header */
990 		skb_pull(p, D11_PHY_HDR_LEN);
991 		skb_pull(p, D11_TXH_LEN);
992 		ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw, p);
993 	} else {
994 		brcms_err(wlc->hw->d11core,
995 			  "%s: Not last frame => not calling tx_status\n",
996 			  __func__);
997 	}
998 
999 	fatal = false;
1000 
1001  out:
1002 	if (fatal) {
1003 		if (txh)
1004 			trace_brcms_txdesc(&wlc->hw->d11core->dev, txh,
1005 					   sizeof(*txh));
1006 		brcmu_pkt_buf_free_skb(p);
1007 	}
1008 
1009 	if (dma && queue < NFIFO) {
1010 		u16 ac_queue = brcms_fifo_to_ac(queue);
1011 		if (dma->txavail > TX_HEADROOM && queue < TX_BCMC_FIFO &&
1012 		    ieee80211_queue_stopped(wlc->pub->ieee_hw, ac_queue))
1013 			ieee80211_wake_queue(wlc->pub->ieee_hw, ac_queue);
1014 		dma_kick_tx(dma);
1015 	}
1016 
1017 	return fatal;
1018 }
1019 
1020 /* process tx completion events in BMAC
1021  * Return true if more tx status need to be processed. false otherwise.
1022  */
1023 static bool
1024 brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
1025 {
1026 	struct bcma_device *core;
1027 	struct tx_status txstatus, *txs;
1028 	u32 s1, s2;
1029 	uint n = 0;
1030 	/*
1031 	 * Param 'max_tx_num' indicates max. # tx status to process before
1032 	 * break out.
1033 	 */
1034 	uint max_tx_num = bound ? TXSBND : -1;
1035 
1036 	txs = &txstatus;
1037 	core = wlc_hw->d11core;
1038 	*fatal = false;
1039 
1040 	while (n < max_tx_num) {
1041 		s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
1042 		if (s1 == 0xffffffff) {
1043 			brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
1044 				  __func__);
1045 			*fatal = true;
1046 			return false;
1047 		}
1048 		/* only process when valid */
1049 		if (!(s1 & TXS_V))
1050 			break;
1051 
1052 		s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
1053 		txs->status = s1 & TXS_STATUS_MASK;
1054 		txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
1055 		txs->sequence = s2 & TXS_SEQ_MASK;
1056 		txs->phyerr = (s2 & TXS_PTX_MASK) >> TXS_PTX_SHIFT;
1057 		txs->lasttxtime = 0;
1058 
1059 		*fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
1060 		if (*fatal == true)
1061 			return false;
1062 		n++;
1063 	}
1064 
1065 	return n >= max_tx_num;
1066 }
1067 
1068 static void brcms_c_tbtt(struct brcms_c_info *wlc)
1069 {
1070 	if (wlc->bsscfg->type == BRCMS_TYPE_ADHOC)
1071 		/*
1072 		 * DirFrmQ is now valid...defer setting until end
1073 		 * of ATIM window
1074 		 */
1075 		wlc->qvalid |= MCMD_DIRFRMQVAL;
1076 }
1077 
1078 /* set initial host flags value */
1079 static void
1080 brcms_c_mhfdef(struct brcms_c_info *wlc, u16 *mhfs, u16 mhf2_init)
1081 {
1082 	struct brcms_hardware *wlc_hw = wlc->hw;
1083 
1084 	memset(mhfs, 0, MHFMAX * sizeof(u16));
1085 
1086 	mhfs[MHF2] |= mhf2_init;
1087 
1088 	/* prohibit use of slowclock on multifunction boards */
1089 	if (wlc_hw->boardflags & BFL_NOPLLDOWN)
1090 		mhfs[MHF1] |= MHF1_FORCEFASTCLK;
1091 
1092 	if (BRCMS_ISNPHY(wlc_hw->band) && NREV_LT(wlc_hw->band->phyrev, 2)) {
1093 		mhfs[MHF2] |= MHF2_NPHY40MHZ_WAR;
1094 		mhfs[MHF1] |= MHF1_IQSWAP_WAR;
1095 	}
1096 }
1097 
1098 static uint
1099 dmareg(uint direction, uint fifonum)
1100 {
1101 	if (direction == DMA_TX)
1102 		return offsetof(struct d11regs, fifo64regs[fifonum].dmaxmt);
1103 	return offsetof(struct d11regs, fifo64regs[fifonum].dmarcv);
1104 }
1105 
1106 static bool brcms_b_attach_dmapio(struct brcms_c_info *wlc, uint j, bool wme)
1107 {
1108 	uint i;
1109 	char name[8];
1110 	/*
1111 	 * ucode host flag 2 needed for pio mode, independent of band and fifo
1112 	 */
1113 	u16 pio_mhf2 = 0;
1114 	struct brcms_hardware *wlc_hw = wlc->hw;
1115 	uint unit = wlc_hw->unit;
1116 
1117 	/* name and offsets for dma_attach */
1118 	snprintf(name, sizeof(name), "wl%d", unit);
1119 
1120 	if (wlc_hw->di[0] == NULL) {	/* Init FIFOs */
1121 		int dma_attach_err = 0;
1122 
1123 		/*
1124 		 * FIFO 0
1125 		 * TX: TX_AC_BK_FIFO (TX AC Background data packets)
1126 		 * RX: RX_FIFO (RX data packets)
1127 		 */
1128 		wlc_hw->di[0] = dma_attach(name, wlc,
1129 					   (wme ? dmareg(DMA_TX, 0) : 0),
1130 					   dmareg(DMA_RX, 0),
1131 					   (wme ? NTXD : 0), NRXD,
1132 					   RXBUFSZ, -1, NRXBUFPOST,
1133 					   BRCMS_HWRXOFF);
1134 		dma_attach_err |= (NULL == wlc_hw->di[0]);
1135 
1136 		/*
1137 		 * FIFO 1
1138 		 * TX: TX_AC_BE_FIFO (TX AC Best-Effort data packets)
1139 		 *   (legacy) TX_DATA_FIFO (TX data packets)
1140 		 * RX: UNUSED
1141 		 */
1142 		wlc_hw->di[1] = dma_attach(name, wlc,
1143 					   dmareg(DMA_TX, 1), 0,
1144 					   NTXD, 0, 0, -1, 0, 0);
1145 		dma_attach_err |= (NULL == wlc_hw->di[1]);
1146 
1147 		/*
1148 		 * FIFO 2
1149 		 * TX: TX_AC_VI_FIFO (TX AC Video data packets)
1150 		 * RX: UNUSED
1151 		 */
1152 		wlc_hw->di[2] = dma_attach(name, wlc,
1153 					   dmareg(DMA_TX, 2), 0,
1154 					   NTXD, 0, 0, -1, 0, 0);
1155 		dma_attach_err |= (NULL == wlc_hw->di[2]);
1156 		/*
1157 		 * FIFO 3
1158 		 * TX: TX_AC_VO_FIFO (TX AC Voice data packets)
1159 		 *   (legacy) TX_CTL_FIFO (TX control & mgmt packets)
1160 		 */
1161 		wlc_hw->di[3] = dma_attach(name, wlc,
1162 					   dmareg(DMA_TX, 3),
1163 					   0, NTXD, 0, 0, -1,
1164 					   0, 0);
1165 		dma_attach_err |= (NULL == wlc_hw->di[3]);
1166 /* Cleaner to leave this as if with AP defined */
1167 
1168 		if (dma_attach_err) {
1169 			brcms_err(wlc_hw->d11core,
1170 				  "wl%d: wlc_attach: dma_attach failed\n",
1171 				  unit);
1172 			return false;
1173 		}
1174 
1175 		/* get pointer to dma engine tx flow control variable */
1176 		for (i = 0; i < NFIFO; i++)
1177 			if (wlc_hw->di[i])
1178 				wlc_hw->txavail[i] =
1179 				    (uint *) dma_getvar(wlc_hw->di[i],
1180 							"&txavail");
1181 	}
1182 
1183 	/* initial ucode host flags */
1184 	brcms_c_mhfdef(wlc, wlc_hw->band->mhfs, pio_mhf2);
1185 
1186 	return true;
1187 }
1188 
1189 static void brcms_b_detach_dmapio(struct brcms_hardware *wlc_hw)
1190 {
1191 	uint j;
1192 
1193 	for (j = 0; j < NFIFO; j++) {
1194 		if (wlc_hw->di[j]) {
1195 			dma_detach(wlc_hw->di[j]);
1196 			wlc_hw->di[j] = NULL;
1197 		}
1198 	}
1199 }
1200 
1201 /*
1202  * Initialize brcms_c_info default values ...
1203  * may get overrides later in this function
1204  *  BMAC_NOTES, move low out and resolve the dangling ones
1205  */
1206 static void brcms_b_info_init(struct brcms_hardware *wlc_hw)
1207 {
1208 	struct brcms_c_info *wlc = wlc_hw->wlc;
1209 
1210 	/* set default sw macintmask value */
1211 	wlc->defmacintmask = DEF_MACINTMASK;
1212 
1213 	/* various 802.11g modes */
1214 	wlc_hw->shortslot = false;
1215 
1216 	wlc_hw->SFBL = RETRY_SHORT_FB;
1217 	wlc_hw->LFBL = RETRY_LONG_FB;
1218 
1219 	/* default mac retry limits */
1220 	wlc_hw->SRL = RETRY_SHORT_DEF;
1221 	wlc_hw->LRL = RETRY_LONG_DEF;
1222 	wlc_hw->chanspec = ch20mhz_chspec(1);
1223 }
1224 
1225 static void brcms_b_wait_for_wake(struct brcms_hardware *wlc_hw)
1226 {
1227 	/* delay before first read of ucode state */
1228 	udelay(40);
1229 
1230 	/* wait until ucode is no longer asleep */
1231 	SPINWAIT((brcms_b_read_shm(wlc_hw, M_UCODE_DBGST) ==
1232 		  DBGST_ASLEEP), wlc_hw->wlc->fastpwrup_dly);
1233 }
1234 
1235 /* control chip clock to save power, enable dynamic clock or force fast clock */
1236 static void brcms_b_clkctl_clk(struct brcms_hardware *wlc_hw, enum bcma_clkmode mode)
1237 {
1238 	if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU) {
1239 		/* new chips with PMU, CCS_FORCEHT will distribute the HT clock
1240 		 * on backplane, but mac core will still run on ALP(not HT) when
1241 		 * it enters powersave mode, which means the FCA bit may not be
1242 		 * set. Should wakeup mac if driver wants it to run on HT.
1243 		 */
1244 
1245 		if (wlc_hw->clk) {
1246 			if (mode == BCMA_CLKMODE_FAST) {
1247 				bcma_set32(wlc_hw->d11core,
1248 					   D11REGOFFS(clk_ctl_st),
1249 					   CCS_FORCEHT);
1250 
1251 				udelay(64);
1252 
1253 				SPINWAIT(
1254 				    ((bcma_read32(wlc_hw->d11core,
1255 				      D11REGOFFS(clk_ctl_st)) &
1256 				      CCS_HTAVAIL) == 0),
1257 				      PMU_MAX_TRANSITION_DLY);
1258 				WARN_ON(!(bcma_read32(wlc_hw->d11core,
1259 					D11REGOFFS(clk_ctl_st)) &
1260 					CCS_HTAVAIL));
1261 			} else {
1262 				if ((ai_get_pmurev(wlc_hw->sih) == 0) &&
1263 				    (bcma_read32(wlc_hw->d11core,
1264 					D11REGOFFS(clk_ctl_st)) &
1265 					(CCS_FORCEHT | CCS_HTAREQ)))
1266 					SPINWAIT(
1267 					    ((bcma_read32(wlc_hw->d11core,
1268 					      offsetof(struct d11regs,
1269 						       clk_ctl_st)) &
1270 					      CCS_HTAVAIL) == 0),
1271 					      PMU_MAX_TRANSITION_DLY);
1272 				bcma_mask32(wlc_hw->d11core,
1273 					D11REGOFFS(clk_ctl_st),
1274 					~CCS_FORCEHT);
1275 			}
1276 		}
1277 		wlc_hw->forcefastclk = (mode == BCMA_CLKMODE_FAST);
1278 	} else {
1279 
1280 		/* old chips w/o PMU, force HT through cc,
1281 		 * then use FCA to verify mac is running fast clock
1282 		 */
1283 
1284 		wlc_hw->forcefastclk = ai_clkctl_cc(wlc_hw->sih, mode);
1285 
1286 		/* check fast clock is available (if core is not in reset) */
1287 		if (wlc_hw->forcefastclk && wlc_hw->clk)
1288 			WARN_ON(!(bcma_aread32(wlc_hw->d11core, BCMA_IOST) &
1289 				  SISF_FCLKA));
1290 
1291 		/*
1292 		 * keep the ucode wake bit on if forcefastclk is on since we
1293 		 * do not want ucode to put us back to slow clock when it dozes
1294 		 * for PM mode. Code below matches the wake override bit with
1295 		 * current forcefastclk state. Only setting bit in wake_override
1296 		 * instead of waking ucode immediately since old code had this
1297 		 * behavior. Older code set wlc->forcefastclk but only had the
1298 		 * wake happen if the wakup_ucode work (protected by an up
1299 		 * check) was executed just below.
1300 		 */
1301 		if (wlc_hw->forcefastclk)
1302 			mboolset(wlc_hw->wake_override,
1303 				 BRCMS_WAKE_OVERRIDE_FORCEFAST);
1304 		else
1305 			mboolclr(wlc_hw->wake_override,
1306 				 BRCMS_WAKE_OVERRIDE_FORCEFAST);
1307 	}
1308 }
1309 
1310 /* set or clear ucode host flag bits
1311  * it has an optimization for no-change write
1312  * it only writes through shared memory when the core has clock;
1313  * pre-CLK changes should use wlc_write_mhf to get around the optimization
1314  *
1315  *
1316  * bands values are: BRCM_BAND_AUTO <--- Current band only
1317  *                   BRCM_BAND_5G   <--- 5G band only
1318  *                   BRCM_BAND_2G   <--- 2G band only
1319  *                   BRCM_BAND_ALL  <--- All bands
1320  */
1321 void
1322 brcms_b_mhf(struct brcms_hardware *wlc_hw, u8 idx, u16 mask, u16 val,
1323 	     int bands)
1324 {
1325 	u16 save;
1326 	u16 addr[MHFMAX] = {
1327 		M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
1328 		M_HOST_FLAGS5
1329 	};
1330 	struct brcms_hw_band *band;
1331 
1332 	if ((val & ~mask) || idx >= MHFMAX)
1333 		return; /* error condition */
1334 
1335 	switch (bands) {
1336 		/* Current band only or all bands,
1337 		 * then set the band to current band
1338 		 */
1339 	case BRCM_BAND_AUTO:
1340 	case BRCM_BAND_ALL:
1341 		band = wlc_hw->band;
1342 		break;
1343 	case BRCM_BAND_5G:
1344 		band = wlc_hw->bandstate[BAND_5G_INDEX];
1345 		break;
1346 	case BRCM_BAND_2G:
1347 		band = wlc_hw->bandstate[BAND_2G_INDEX];
1348 		break;
1349 	default:
1350 		band = NULL;	/* error condition */
1351 	}
1352 
1353 	if (band) {
1354 		save = band->mhfs[idx];
1355 		band->mhfs[idx] = (band->mhfs[idx] & ~mask) | val;
1356 
1357 		/* optimization: only write through if changed, and
1358 		 * changed band is the current band
1359 		 */
1360 		if (wlc_hw->clk && (band->mhfs[idx] != save)
1361 		    && (band == wlc_hw->band))
1362 			brcms_b_write_shm(wlc_hw, addr[idx],
1363 					   (u16) band->mhfs[idx]);
1364 	}
1365 
1366 	if (bands == BRCM_BAND_ALL) {
1367 		wlc_hw->bandstate[0]->mhfs[idx] =
1368 		    (wlc_hw->bandstate[0]->mhfs[idx] & ~mask) | val;
1369 		wlc_hw->bandstate[1]->mhfs[idx] =
1370 		    (wlc_hw->bandstate[1]->mhfs[idx] & ~mask) | val;
1371 	}
1372 }
1373 
1374 /* set the maccontrol register to desired reset state and
1375  * initialize the sw cache of the register
1376  */
1377 static void brcms_c_mctrl_reset(struct brcms_hardware *wlc_hw)
1378 {
1379 	/* IHR accesses are always enabled, PSM disabled, HPS off and WAKE on */
1380 	wlc_hw->maccontrol = 0;
1381 	wlc_hw->suspended_fifos = 0;
1382 	wlc_hw->wake_override = 0;
1383 	wlc_hw->mute_override = 0;
1384 	brcms_b_mctrl(wlc_hw, ~0, MCTL_IHR_EN | MCTL_WAKE);
1385 }
1386 
1387 /*
1388  * write the software state of maccontrol and
1389  * overrides to the maccontrol register
1390  */
1391 static void brcms_c_mctrl_write(struct brcms_hardware *wlc_hw)
1392 {
1393 	u32 maccontrol = wlc_hw->maccontrol;
1394 
1395 	/* OR in the wake bit if overridden */
1396 	if (wlc_hw->wake_override)
1397 		maccontrol |= MCTL_WAKE;
1398 
1399 	/* set AP and INFRA bits for mute if needed */
1400 	if (wlc_hw->mute_override) {
1401 		maccontrol &= ~(MCTL_AP);
1402 		maccontrol |= MCTL_INFRA;
1403 	}
1404 
1405 	bcma_write32(wlc_hw->d11core, D11REGOFFS(maccontrol),
1406 		     maccontrol);
1407 }
1408 
1409 /* set or clear maccontrol bits */
1410 void brcms_b_mctrl(struct brcms_hardware *wlc_hw, u32 mask, u32 val)
1411 {
1412 	u32 maccontrol;
1413 	u32 new_maccontrol;
1414 
1415 	if (val & ~mask)
1416 		return; /* error condition */
1417 	maccontrol = wlc_hw->maccontrol;
1418 	new_maccontrol = (maccontrol & ~mask) | val;
1419 
1420 	/* if the new maccontrol value is the same as the old, nothing to do */
1421 	if (new_maccontrol == maccontrol)
1422 		return;
1423 
1424 	/* something changed, cache the new value */
1425 	wlc_hw->maccontrol = new_maccontrol;
1426 
1427 	/* write the new values with overrides applied */
1428 	brcms_c_mctrl_write(wlc_hw);
1429 }
1430 
1431 void brcms_c_ucode_wake_override_set(struct brcms_hardware *wlc_hw,
1432 				 u32 override_bit)
1433 {
1434 	if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE)) {
1435 		mboolset(wlc_hw->wake_override, override_bit);
1436 		return;
1437 	}
1438 
1439 	mboolset(wlc_hw->wake_override, override_bit);
1440 
1441 	brcms_c_mctrl_write(wlc_hw);
1442 	brcms_b_wait_for_wake(wlc_hw);
1443 }
1444 
1445 void brcms_c_ucode_wake_override_clear(struct brcms_hardware *wlc_hw,
1446 				   u32 override_bit)
1447 {
1448 	mboolclr(wlc_hw->wake_override, override_bit);
1449 
1450 	if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE))
1451 		return;
1452 
1453 	brcms_c_mctrl_write(wlc_hw);
1454 }
1455 
1456 /* When driver needs ucode to stop beaconing, it has to make sure that
1457  * MCTL_AP is clear and MCTL_INFRA is set
1458  * Mode           MCTL_AP        MCTL_INFRA
1459  * AP                1              1
1460  * STA               0              1 <--- This will ensure no beacons
1461  * IBSS              0              0
1462  */
1463 static void brcms_c_ucode_mute_override_set(struct brcms_hardware *wlc_hw)
1464 {
1465 	wlc_hw->mute_override = 1;
1466 
1467 	/* if maccontrol already has AP == 0 and INFRA == 1 without this
1468 	 * override, then there is no change to write
1469 	 */
1470 	if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1471 		return;
1472 
1473 	brcms_c_mctrl_write(wlc_hw);
1474 }
1475 
1476 /* Clear the override on AP and INFRA bits */
1477 static void brcms_c_ucode_mute_override_clear(struct brcms_hardware *wlc_hw)
1478 {
1479 	if (wlc_hw->mute_override == 0)
1480 		return;
1481 
1482 	wlc_hw->mute_override = 0;
1483 
1484 	/* if maccontrol already has AP == 0 and INFRA == 1 without this
1485 	 * override, then there is no change to write
1486 	 */
1487 	if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1488 		return;
1489 
1490 	brcms_c_mctrl_write(wlc_hw);
1491 }
1492 
1493 /*
1494  * Write a MAC address to the given match reg offset in the RXE match engine.
1495  */
1496 static void
1497 brcms_b_set_addrmatch(struct brcms_hardware *wlc_hw, int match_reg_offset,
1498 		       const u8 *addr)
1499 {
1500 	struct bcma_device *core = wlc_hw->d11core;
1501 	u16 mac_l;
1502 	u16 mac_m;
1503 	u16 mac_h;
1504 
1505 	brcms_dbg_rx(core, "wl%d: brcms_b_set_addrmatch\n", wlc_hw->unit);
1506 
1507 	mac_l = addr[0] | (addr[1] << 8);
1508 	mac_m = addr[2] | (addr[3] << 8);
1509 	mac_h = addr[4] | (addr[5] << 8);
1510 
1511 	/* enter the MAC addr into the RXE match registers */
1512 	bcma_write16(core, D11REGOFFS(rcm_ctl),
1513 		     RCM_INC_DATA | match_reg_offset);
1514 	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_l);
1515 	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_m);
1516 	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_h);
1517 }
1518 
1519 void
1520 brcms_b_write_template_ram(struct brcms_hardware *wlc_hw, int offset, int len,
1521 			    void *buf)
1522 {
1523 	struct bcma_device *core = wlc_hw->d11core;
1524 	u32 word;
1525 	__le32 word_le;
1526 	__be32 word_be;
1527 	bool be_bit;
1528 	brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
1529 
1530 	bcma_write32(core, D11REGOFFS(tplatewrptr), offset);
1531 
1532 	/* if MCTL_BIGEND bit set in mac control register,
1533 	 * the chip swaps data in fifo, as well as data in
1534 	 * template ram
1535 	 */
1536 	be_bit = (bcma_read32(core, D11REGOFFS(maccontrol)) & MCTL_BIGEND) != 0;
1537 
1538 	while (len > 0) {
1539 		memcpy(&word, buf, sizeof(u32));
1540 
1541 		if (be_bit) {
1542 			word_be = cpu_to_be32(word);
1543 			word = *(u32 *)&word_be;
1544 		} else {
1545 			word_le = cpu_to_le32(word);
1546 			word = *(u32 *)&word_le;
1547 		}
1548 
1549 		bcma_write32(core, D11REGOFFS(tplatewrdata), word);
1550 
1551 		buf = (u8 *) buf + sizeof(u32);
1552 		len -= sizeof(u32);
1553 	}
1554 }
1555 
1556 static void brcms_b_set_cwmin(struct brcms_hardware *wlc_hw, u16 newmin)
1557 {
1558 	wlc_hw->band->CWmin = newmin;
1559 
1560 	bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1561 		     OBJADDR_SCR_SEL | S_DOT11_CWMIN);
1562 	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1563 	bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmin);
1564 }
1565 
1566 static void brcms_b_set_cwmax(struct brcms_hardware *wlc_hw, u16 newmax)
1567 {
1568 	wlc_hw->band->CWmax = newmax;
1569 
1570 	bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1571 		     OBJADDR_SCR_SEL | S_DOT11_CWMAX);
1572 	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1573 	bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmax);
1574 }
1575 
1576 void brcms_b_bw_set(struct brcms_hardware *wlc_hw, u16 bw)
1577 {
1578 	bool fastclk;
1579 
1580 	/* request FAST clock if not on */
1581 	fastclk = wlc_hw->forcefastclk;
1582 	if (!fastclk)
1583 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
1584 
1585 	wlc_phy_bw_state_set(wlc_hw->band->pi, bw);
1586 
1587 	brcms_b_phy_reset(wlc_hw);
1588 	wlc_phy_init(wlc_hw->band->pi, wlc_phy_chanspec_get(wlc_hw->band->pi));
1589 
1590 	/* restore the clk */
1591 	if (!fastclk)
1592 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
1593 }
1594 
1595 static void brcms_b_upd_synthpu(struct brcms_hardware *wlc_hw)
1596 {
1597 	u16 v;
1598 	struct brcms_c_info *wlc = wlc_hw->wlc;
1599 	/* update SYNTHPU_DLY */
1600 
1601 	if (BRCMS_ISLCNPHY(wlc->band))
1602 		v = SYNTHPU_DLY_LPPHY_US;
1603 	else if (BRCMS_ISNPHY(wlc->band) && (NREV_GE(wlc->band->phyrev, 3)))
1604 		v = SYNTHPU_DLY_NPHY_US;
1605 	else
1606 		v = SYNTHPU_DLY_BPHY_US;
1607 
1608 	brcms_b_write_shm(wlc_hw, M_SYNTHPU_DLY, v);
1609 }
1610 
1611 static void brcms_c_ucode_txant_set(struct brcms_hardware *wlc_hw)
1612 {
1613 	u16 phyctl;
1614 	u16 phytxant = wlc_hw->bmac_phytxant;
1615 	u16 mask = PHY_TXC_ANT_MASK;
1616 
1617 	/* set the Probe Response frame phy control word */
1618 	phyctl = brcms_b_read_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS);
1619 	phyctl = (phyctl & ~mask) | phytxant;
1620 	brcms_b_write_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS, phyctl);
1621 
1622 	/* set the Response (ACK/CTS) frame phy control word */
1623 	phyctl = brcms_b_read_shm(wlc_hw, M_RSP_PCTLWD);
1624 	phyctl = (phyctl & ~mask) | phytxant;
1625 	brcms_b_write_shm(wlc_hw, M_RSP_PCTLWD, phyctl);
1626 }
1627 
1628 static u16 brcms_b_ofdm_ratetable_offset(struct brcms_hardware *wlc_hw,
1629 					 u8 rate)
1630 {
1631 	uint i;
1632 	u8 plcp_rate = 0;
1633 	struct plcp_signal_rate_lookup {
1634 		u8 rate;
1635 		u8 signal_rate;
1636 	};
1637 	/* OFDM RATE sub-field of PLCP SIGNAL field, per 802.11 sec 17.3.4.1 */
1638 	const struct plcp_signal_rate_lookup rate_lookup[] = {
1639 		{BRCM_RATE_6M, 0xB},
1640 		{BRCM_RATE_9M, 0xF},
1641 		{BRCM_RATE_12M, 0xA},
1642 		{BRCM_RATE_18M, 0xE},
1643 		{BRCM_RATE_24M, 0x9},
1644 		{BRCM_RATE_36M, 0xD},
1645 		{BRCM_RATE_48M, 0x8},
1646 		{BRCM_RATE_54M, 0xC}
1647 	};
1648 
1649 	for (i = 0; i < ARRAY_SIZE(rate_lookup); i++) {
1650 		if (rate == rate_lookup[i].rate) {
1651 			plcp_rate = rate_lookup[i].signal_rate;
1652 			break;
1653 		}
1654 	}
1655 
1656 	/* Find the SHM pointer to the rate table entry by looking in the
1657 	 * Direct-map Table
1658 	 */
1659 	return 2 * brcms_b_read_shm(wlc_hw, M_RT_DIRMAP_A + (plcp_rate * 2));
1660 }
1661 
1662 static void brcms_upd_ofdm_pctl1_table(struct brcms_hardware *wlc_hw)
1663 {
1664 	u8 rate;
1665 	u8 rates[8] = {
1666 		BRCM_RATE_6M, BRCM_RATE_9M, BRCM_RATE_12M, BRCM_RATE_18M,
1667 		BRCM_RATE_24M, BRCM_RATE_36M, BRCM_RATE_48M, BRCM_RATE_54M
1668 	};
1669 	u16 entry_ptr;
1670 	u16 pctl1;
1671 	uint i;
1672 
1673 	if (!BRCMS_PHY_11N_CAP(wlc_hw->band))
1674 		return;
1675 
1676 	/* walk the phy rate table and update the entries */
1677 	for (i = 0; i < ARRAY_SIZE(rates); i++) {
1678 		rate = rates[i];
1679 
1680 		entry_ptr = brcms_b_ofdm_ratetable_offset(wlc_hw, rate);
1681 
1682 		/* read the SHM Rate Table entry OFDM PCTL1 values */
1683 		pctl1 =
1684 		    brcms_b_read_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS);
1685 
1686 		/* modify the value */
1687 		pctl1 &= ~PHY_TXC1_MODE_MASK;
1688 		pctl1 |= (wlc_hw->hw_stf_ss_opmode << PHY_TXC1_MODE_SHIFT);
1689 
1690 		/* Update the SHM Rate Table entry OFDM PCTL1 values */
1691 		brcms_b_write_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS,
1692 				   pctl1);
1693 	}
1694 }
1695 
1696 /* band-specific init */
1697 static void brcms_b_bsinit(struct brcms_c_info *wlc, u16 chanspec)
1698 {
1699 	struct brcms_hardware *wlc_hw = wlc->hw;
1700 
1701 	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
1702 			   wlc_hw->band->bandunit);
1703 
1704 	brcms_c_ucode_bsinit(wlc_hw);
1705 
1706 	wlc_phy_init(wlc_hw->band->pi, chanspec);
1707 
1708 	brcms_c_ucode_txant_set(wlc_hw);
1709 
1710 	/*
1711 	 * cwmin is band-specific, update hardware
1712 	 * with value for current band
1713 	 */
1714 	brcms_b_set_cwmin(wlc_hw, wlc_hw->band->CWmin);
1715 	brcms_b_set_cwmax(wlc_hw, wlc_hw->band->CWmax);
1716 
1717 	brcms_b_update_slot_timing(wlc_hw,
1718 				   wlc_hw->band->bandtype == BRCM_BAND_5G ?
1719 				   true : wlc_hw->shortslot);
1720 
1721 	/* write phytype and phyvers */
1722 	brcms_b_write_shm(wlc_hw, M_PHYTYPE, (u16) wlc_hw->band->phytype);
1723 	brcms_b_write_shm(wlc_hw, M_PHYVER, (u16) wlc_hw->band->phyrev);
1724 
1725 	/*
1726 	 * initialize the txphyctl1 rate table since
1727 	 * shmem is shared between bands
1728 	 */
1729 	brcms_upd_ofdm_pctl1_table(wlc_hw);
1730 
1731 	brcms_b_upd_synthpu(wlc_hw);
1732 }
1733 
1734 /* Perform a soft reset of the PHY PLL */
1735 void brcms_b_core_phypll_reset(struct brcms_hardware *wlc_hw)
1736 {
1737 	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_addr),
1738 		  ~0, 0);
1739 	udelay(1);
1740 	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1741 		  0x4, 0);
1742 	udelay(1);
1743 	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1744 		  0x4, 4);
1745 	udelay(1);
1746 	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1747 		  0x4, 0);
1748 	udelay(1);
1749 }
1750 
1751 /* light way to turn on phy clock without reset for NPHY only
1752  *  refer to brcms_b_core_phy_clk for full version
1753  */
1754 void brcms_b_phyclk_fgc(struct brcms_hardware *wlc_hw, bool clk)
1755 {
1756 	/* support(necessary for NPHY and HYPHY) only */
1757 	if (!BRCMS_ISNPHY(wlc_hw->band))
1758 		return;
1759 
1760 	if (ON == clk)
1761 		brcms_b_core_ioctl(wlc_hw, SICF_FGC, SICF_FGC);
1762 	else
1763 		brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
1764 
1765 }
1766 
1767 void brcms_b_macphyclk_set(struct brcms_hardware *wlc_hw, bool clk)
1768 {
1769 	if (ON == clk)
1770 		brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, SICF_MPCLKE);
1771 	else
1772 		brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, 0);
1773 }
1774 
1775 void brcms_b_phy_reset(struct brcms_hardware *wlc_hw)
1776 {
1777 	struct brcms_phy_pub *pih = wlc_hw->band->pi;
1778 	u32 phy_bw_clkbits;
1779 	bool phy_in_reset = false;
1780 
1781 	brcms_dbg_info(wlc_hw->d11core, "wl%d: reset phy\n", wlc_hw->unit);
1782 
1783 	if (pih == NULL)
1784 		return;
1785 
1786 	phy_bw_clkbits = wlc_phy_clk_bwbits(wlc_hw->band->pi);
1787 
1788 	/* Specific reset sequence required for NPHY rev 3 and 4 */
1789 	if (BRCMS_ISNPHY(wlc_hw->band) && NREV_GE(wlc_hw->band->phyrev, 3) &&
1790 	    NREV_LE(wlc_hw->band->phyrev, 4)) {
1791 		/* Set the PHY bandwidth */
1792 		brcms_b_core_ioctl(wlc_hw, SICF_BWMASK, phy_bw_clkbits);
1793 
1794 		udelay(1);
1795 
1796 		/* Perform a soft reset of the PHY PLL */
1797 		brcms_b_core_phypll_reset(wlc_hw);
1798 
1799 		/* reset the PHY */
1800 		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_PCLKE),
1801 				   (SICF_PRST | SICF_PCLKE));
1802 		phy_in_reset = true;
1803 	} else {
1804 		brcms_b_core_ioctl(wlc_hw,
1805 				   (SICF_PRST | SICF_PCLKE | SICF_BWMASK),
1806 				   (SICF_PRST | SICF_PCLKE | phy_bw_clkbits));
1807 	}
1808 
1809 	udelay(2);
1810 	brcms_b_core_phy_clk(wlc_hw, ON);
1811 
1812 	wlc_phy_anacore(pih, ON);
1813 }
1814 
1815 /* switch to and initialize new band */
1816 static void brcms_b_setband(struct brcms_hardware *wlc_hw, uint bandunit,
1817 			    u16 chanspec) {
1818 	struct brcms_c_info *wlc = wlc_hw->wlc;
1819 	u32 macintmask;
1820 
1821 	/* Enable the d11 core before accessing it */
1822 	if (!bcma_core_is_enabled(wlc_hw->d11core)) {
1823 		bcma_core_enable(wlc_hw->d11core, 0);
1824 		brcms_c_mctrl_reset(wlc_hw);
1825 	}
1826 
1827 	macintmask = brcms_c_setband_inact(wlc, bandunit);
1828 
1829 	if (!wlc_hw->up)
1830 		return;
1831 
1832 	brcms_b_core_phy_clk(wlc_hw, ON);
1833 
1834 	/* band-specific initializations */
1835 	brcms_b_bsinit(wlc, chanspec);
1836 
1837 	/*
1838 	 * If there are any pending software interrupt bits,
1839 	 * then replace these with a harmless nonzero value
1840 	 * so brcms_c_dpc() will re-enable interrupts when done.
1841 	 */
1842 	if (wlc->macintstatus)
1843 		wlc->macintstatus = MI_DMAINT;
1844 
1845 	/* restore macintmask */
1846 	brcms_intrsrestore(wlc->wl, macintmask);
1847 
1848 	/* ucode should still be suspended.. */
1849 	WARN_ON((bcma_read32(wlc_hw->d11core, D11REGOFFS(maccontrol)) &
1850 		 MCTL_EN_MAC) != 0);
1851 }
1852 
1853 static bool brcms_c_isgoodchip(struct brcms_hardware *wlc_hw)
1854 {
1855 
1856 	/* reject unsupported corerev */
1857 	if (!CONF_HAS(D11CONF, wlc_hw->corerev)) {
1858 		wiphy_err(wlc_hw->wlc->wiphy, "unsupported core rev %d\n",
1859 			  wlc_hw->corerev);
1860 		return false;
1861 	}
1862 
1863 	return true;
1864 }
1865 
1866 /* Validate some board info parameters */
1867 static bool brcms_c_validboardtype(struct brcms_hardware *wlc_hw)
1868 {
1869 	uint boardrev = wlc_hw->boardrev;
1870 
1871 	/* 4 bits each for board type, major, minor, and tiny version */
1872 	uint brt = (boardrev & 0xf000) >> 12;
1873 	uint b0 = (boardrev & 0xf00) >> 8;
1874 	uint b1 = (boardrev & 0xf0) >> 4;
1875 	uint b2 = boardrev & 0xf;
1876 
1877 	/* voards from other vendors are always considered valid */
1878 	if (ai_get_boardvendor(wlc_hw->sih) != PCI_VENDOR_ID_BROADCOM)
1879 		return true;
1880 
1881 	/* do some boardrev sanity checks when boardvendor is Broadcom */
1882 	if (boardrev == 0)
1883 		return false;
1884 
1885 	if (boardrev <= 0xff)
1886 		return true;
1887 
1888 	if ((brt > 2) || (brt == 0) || (b0 > 9) || (b0 == 0) || (b1 > 9)
1889 		|| (b2 > 9))
1890 		return false;
1891 
1892 	return true;
1893 }
1894 
1895 static void brcms_c_get_macaddr(struct brcms_hardware *wlc_hw, u8 etheraddr[ETH_ALEN])
1896 {
1897 	struct ssb_sprom *sprom = &wlc_hw->d11core->bus->sprom;
1898 
1899 	/* If macaddr exists, use it (Sromrev4, CIS, ...). */
1900 	if (!is_zero_ether_addr(sprom->il0mac)) {
1901 		memcpy(etheraddr, sprom->il0mac, ETH_ALEN);
1902 		return;
1903 	}
1904 
1905 	if (wlc_hw->_nbands > 1)
1906 		memcpy(etheraddr, sprom->et1mac, ETH_ALEN);
1907 	else
1908 		memcpy(etheraddr, sprom->il0mac, ETH_ALEN);
1909 }
1910 
1911 /* power both the pll and external oscillator on/off */
1912 static void brcms_b_xtal(struct brcms_hardware *wlc_hw, bool want)
1913 {
1914 	brcms_dbg_info(wlc_hw->d11core, "wl%d: want %d\n", wlc_hw->unit, want);
1915 
1916 	/*
1917 	 * dont power down if plldown is false or
1918 	 * we must poll hw radio disable
1919 	 */
1920 	if (!want && wlc_hw->pllreq)
1921 		return;
1922 
1923 	wlc_hw->sbclk = want;
1924 	if (!wlc_hw->sbclk) {
1925 		wlc_hw->clk = false;
1926 		if (wlc_hw->band && wlc_hw->band->pi)
1927 			wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
1928 	}
1929 }
1930 
1931 /*
1932  * Return true if radio is disabled, otherwise false.
1933  * hw radio disable signal is an external pin, users activate it asynchronously
1934  * this function could be called when driver is down and w/o clock
1935  * it operates on different registers depending on corerev and boardflag.
1936  */
1937 static bool brcms_b_radio_read_hwdisabled(struct brcms_hardware *wlc_hw)
1938 {
1939 	bool v, clk, xtal;
1940 	u32 flags = 0;
1941 
1942 	xtal = wlc_hw->sbclk;
1943 	if (!xtal)
1944 		brcms_b_xtal(wlc_hw, ON);
1945 
1946 	/* may need to take core out of reset first */
1947 	clk = wlc_hw->clk;
1948 	if (!clk) {
1949 		/*
1950 		 * mac no longer enables phyclk automatically when driver
1951 		 * accesses phyreg throughput mac. This can be skipped since
1952 		 * only mac reg is accessed below
1953 		 */
1954 		if (D11REV_GE(wlc_hw->corerev, 18))
1955 			flags |= SICF_PCLKE;
1956 
1957 		/*
1958 		 * TODO: test suspend/resume
1959 		 *
1960 		 * AI chip doesn't restore bar0win2 on
1961 		 * hibernation/resume, need sw fixup
1962 		 */
1963 
1964 		bcma_core_enable(wlc_hw->d11core, flags);
1965 		brcms_c_mctrl_reset(wlc_hw);
1966 	}
1967 
1968 	v = ((bcma_read32(wlc_hw->d11core,
1969 			  D11REGOFFS(phydebug)) & PDBG_RFD) != 0);
1970 
1971 	/* put core back into reset */
1972 	if (!clk)
1973 		bcma_core_disable(wlc_hw->d11core, 0);
1974 
1975 	if (!xtal)
1976 		brcms_b_xtal(wlc_hw, OFF);
1977 
1978 	return v;
1979 }
1980 
1981 static bool wlc_dma_rxreset(struct brcms_hardware *wlc_hw, uint fifo)
1982 {
1983 	struct dma_pub *di = wlc_hw->di[fifo];
1984 	return dma_rxreset(di);
1985 }
1986 
1987 /* d11 core reset
1988  *   ensure fask clock during reset
1989  *   reset dma
1990  *   reset d11(out of reset)
1991  *   reset phy(out of reset)
1992  *   clear software macintstatus for fresh new start
1993  * one testing hack wlc_hw->noreset will bypass the d11/phy reset
1994  */
1995 void brcms_b_corereset(struct brcms_hardware *wlc_hw, u32 flags)
1996 {
1997 	uint i;
1998 	bool fastclk;
1999 
2000 	if (flags == BRCMS_USE_COREFLAGS)
2001 		flags = (wlc_hw->band->pi ? wlc_hw->band->core_flags : 0);
2002 
2003 	brcms_dbg_info(wlc_hw->d11core, "wl%d: core reset\n", wlc_hw->unit);
2004 
2005 	/* request FAST clock if not on  */
2006 	fastclk = wlc_hw->forcefastclk;
2007 	if (!fastclk)
2008 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2009 
2010 	/* reset the dma engines except first time thru */
2011 	if (bcma_core_is_enabled(wlc_hw->d11core)) {
2012 		for (i = 0; i < NFIFO; i++)
2013 			if ((wlc_hw->di[i]) && (!dma_txreset(wlc_hw->di[i])))
2014 				brcms_err(wlc_hw->d11core, "wl%d: %s: "
2015 					  "dma_txreset[%d]: cannot stop dma\n",
2016 					   wlc_hw->unit, __func__, i);
2017 
2018 		if ((wlc_hw->di[RX_FIFO])
2019 		    && (!wlc_dma_rxreset(wlc_hw, RX_FIFO)))
2020 			brcms_err(wlc_hw->d11core, "wl%d: %s: dma_rxreset"
2021 				  "[%d]: cannot stop dma\n",
2022 				  wlc_hw->unit, __func__, RX_FIFO);
2023 	}
2024 	/* if noreset, just stop the psm and return */
2025 	if (wlc_hw->noreset) {
2026 		wlc_hw->wlc->macintstatus = 0;	/* skip wl_dpc after down */
2027 		brcms_b_mctrl(wlc_hw, MCTL_PSM_RUN | MCTL_EN_MAC, 0);
2028 		return;
2029 	}
2030 
2031 	/*
2032 	 * mac no longer enables phyclk automatically when driver accesses
2033 	 * phyreg throughput mac, AND phy_reset is skipped at early stage when
2034 	 * band->pi is invalid. need to enable PHY CLK
2035 	 */
2036 	if (D11REV_GE(wlc_hw->corerev, 18))
2037 		flags |= SICF_PCLKE;
2038 
2039 	/*
2040 	 * reset the core
2041 	 * In chips with PMU, the fastclk request goes through d11 core
2042 	 * reg 0x1e0, which is cleared by the core_reset. have to re-request it.
2043 	 *
2044 	 * This adds some delay and we can optimize it by also requesting
2045 	 * fastclk through chipcommon during this period if necessary. But
2046 	 * that has to work coordinate with other driver like mips/arm since
2047 	 * they may touch chipcommon as well.
2048 	 */
2049 	wlc_hw->clk = false;
2050 	bcma_core_enable(wlc_hw->d11core, flags);
2051 	wlc_hw->clk = true;
2052 	if (wlc_hw->band && wlc_hw->band->pi)
2053 		wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, true);
2054 
2055 	brcms_c_mctrl_reset(wlc_hw);
2056 
2057 	if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU)
2058 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2059 
2060 	brcms_b_phy_reset(wlc_hw);
2061 
2062 	/* turn on PHY_PLL */
2063 	brcms_b_core_phypll_ctl(wlc_hw, true);
2064 
2065 	/* clear sw intstatus */
2066 	wlc_hw->wlc->macintstatus = 0;
2067 
2068 	/* restore the clk setting */
2069 	if (!fastclk)
2070 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
2071 }
2072 
2073 /* txfifo sizes needs to be modified(increased) since the newer cores
2074  * have more memory.
2075  */
2076 static void brcms_b_corerev_fifofixup(struct brcms_hardware *wlc_hw)
2077 {
2078 	struct bcma_device *core = wlc_hw->d11core;
2079 	u16 fifo_nu;
2080 	u16 txfifo_startblk = TXFIFO_START_BLK, txfifo_endblk;
2081 	u16 txfifo_def, txfifo_def1;
2082 	u16 txfifo_cmd;
2083 
2084 	/* tx fifos start at TXFIFO_START_BLK from the Base address */
2085 	txfifo_startblk = TXFIFO_START_BLK;
2086 
2087 	/* sequence of operations:  reset fifo, set fifo size, reset fifo */
2088 	for (fifo_nu = 0; fifo_nu < NFIFO; fifo_nu++) {
2089 
2090 		txfifo_endblk = txfifo_startblk + wlc_hw->xmtfifo_sz[fifo_nu];
2091 		txfifo_def = (txfifo_startblk & 0xff) |
2092 		    (((txfifo_endblk - 1) & 0xff) << TXFIFO_FIFOTOP_SHIFT);
2093 		txfifo_def1 = ((txfifo_startblk >> 8) & 0x1) |
2094 		    ((((txfifo_endblk -
2095 			1) >> 8) & 0x1) << TXFIFO_FIFOTOP_SHIFT);
2096 		txfifo_cmd =
2097 		    TXFIFOCMD_RESET_MASK | (fifo_nu << TXFIFOCMD_FIFOSEL_SHIFT);
2098 
2099 		bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2100 		bcma_write16(core, D11REGOFFS(xmtfifodef), txfifo_def);
2101 		bcma_write16(core, D11REGOFFS(xmtfifodef1), txfifo_def1);
2102 
2103 		bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2104 
2105 		txfifo_startblk += wlc_hw->xmtfifo_sz[fifo_nu];
2106 	}
2107 	/*
2108 	 * need to propagate to shm location to be in sync since ucode/hw won't
2109 	 * do this
2110 	 */
2111 	brcms_b_write_shm(wlc_hw, M_FIFOSIZE0,
2112 			   wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]);
2113 	brcms_b_write_shm(wlc_hw, M_FIFOSIZE1,
2114 			   wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]);
2115 	brcms_b_write_shm(wlc_hw, M_FIFOSIZE2,
2116 			   ((wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO] << 8) | wlc_hw->
2117 			    xmtfifo_sz[TX_AC_BK_FIFO]));
2118 	brcms_b_write_shm(wlc_hw, M_FIFOSIZE3,
2119 			   ((wlc_hw->xmtfifo_sz[TX_ATIM_FIFO] << 8) | wlc_hw->
2120 			    xmtfifo_sz[TX_BCMC_FIFO]));
2121 }
2122 
2123 /* This function is used for changing the tsf frac register
2124  * If spur avoidance mode is off, the mac freq will be 80/120/160Mhz
2125  * If spur avoidance mode is on1, the mac freq will be 82/123/164Mhz
2126  * If spur avoidance mode is on2, the mac freq will be 84/126/168Mhz
2127  * HTPHY Formula is 2^26/freq(MHz) e.g.
2128  * For spuron2 - 126MHz -> 2^26/126 = 532610.0
2129  *  - 532610 = 0x82082 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x2082
2130  * For spuron: 123MHz -> 2^26/123    = 545600.5
2131  *  - 545601 = 0x85341 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x5341
2132  * For spur off: 120MHz -> 2^26/120    = 559240.5
2133  *  - 559241 = 0x88889 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x8889
2134  */
2135 
2136 void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode)
2137 {
2138 	struct bcma_device *core = wlc_hw->d11core;
2139 
2140 	if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43224) ||
2141 	    (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225)) {
2142 		if (spurmode == WL_SPURAVOID_ON2) {	/* 126Mhz */
2143 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x2082);
2144 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2145 		} else if (spurmode == WL_SPURAVOID_ON1) {	/* 123Mhz */
2146 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x5341);
2147 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2148 		} else {	/* 120Mhz */
2149 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x8889);
2150 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2151 		}
2152 	} else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2153 		if (spurmode == WL_SPURAVOID_ON1) {	/* 82Mhz */
2154 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x7CE0);
2155 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2156 		} else {	/* 80Mhz */
2157 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0xCCCD);
2158 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2159 		}
2160 	}
2161 }
2162 
2163 void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr)
2164 {
2165 	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2166 	wlc->bsscfg->type = BRCMS_TYPE_STATION;
2167 }
2168 
2169 void brcms_c_start_ap(struct brcms_c_info *wlc, u8 *addr, const u8 *bssid,
2170 		      u8 *ssid, size_t ssid_len)
2171 {
2172 	brcms_c_set_ssid(wlc, ssid, ssid_len);
2173 
2174 	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2175 	memcpy(wlc->bsscfg->BSSID, bssid, sizeof(wlc->bsscfg->BSSID));
2176 	wlc->bsscfg->type = BRCMS_TYPE_AP;
2177 
2178 	brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, MCTL_AP | MCTL_INFRA);
2179 }
2180 
2181 void brcms_c_start_adhoc(struct brcms_c_info *wlc, u8 *addr)
2182 {
2183 	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2184 	wlc->bsscfg->type = BRCMS_TYPE_ADHOC;
2185 
2186 	brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, 0);
2187 }
2188 
2189 /* Initialize GPIOs that are controlled by D11 core */
2190 static void brcms_c_gpio_init(struct brcms_c_info *wlc)
2191 {
2192 	struct brcms_hardware *wlc_hw = wlc->hw;
2193 	u32 gc, gm;
2194 
2195 	/* use GPIO select 0 to get all gpio signals from the gpio out reg */
2196 	brcms_b_mctrl(wlc_hw, MCTL_GPOUT_SEL_MASK, 0);
2197 
2198 	/*
2199 	 * Common GPIO setup:
2200 	 *      G0 = LED 0 = WLAN Activity
2201 	 *      G1 = LED 1 = WLAN 2.4 GHz Radio State
2202 	 *      G2 = LED 2 = WLAN 5 GHz Radio State
2203 	 *      G4 = radio disable input (HI enabled, LO disabled)
2204 	 */
2205 
2206 	gc = gm = 0;
2207 
2208 	/* Allocate GPIOs for mimo antenna diversity feature */
2209 	if (wlc_hw->antsel_type == ANTSEL_2x3) {
2210 		/* Enable antenna diversity, use 2x3 mode */
2211 		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2212 			     MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2213 		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE,
2214 			     MHF3_ANTSEL_MODE, BRCM_BAND_ALL);
2215 
2216 		/* init superswitch control */
2217 		wlc_phy_antsel_init(wlc_hw->band->pi, false);
2218 
2219 	} else if (wlc_hw->antsel_type == ANTSEL_2x4) {
2220 		gm |= gc |= (BOARD_GPIO_12 | BOARD_GPIO_13);
2221 		/*
2222 		 * The board itself is powered by these GPIOs
2223 		 * (when not sending pattern) so set them high
2224 		 */
2225 		bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_oe),
2226 			   (BOARD_GPIO_12 | BOARD_GPIO_13));
2227 		bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_out),
2228 			   (BOARD_GPIO_12 | BOARD_GPIO_13));
2229 
2230 		/* Enable antenna diversity, use 2x4 mode */
2231 		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2232 			     MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2233 		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE, 0,
2234 			     BRCM_BAND_ALL);
2235 
2236 		/* Configure the desired clock to be 4Mhz */
2237 		brcms_b_write_shm(wlc_hw, M_ANTSEL_CLKDIV,
2238 				   ANTSEL_CLKDIV_4MHZ);
2239 	}
2240 
2241 	/*
2242 	 * gpio 9 controls the PA. ucode is responsible
2243 	 * for wiggling out and oe
2244 	 */
2245 	if (wlc_hw->boardflags & BFL_PACTRL)
2246 		gm |= gc |= BOARD_GPIO_PACTRL;
2247 
2248 	/* apply to gpiocontrol register */
2249 	bcma_chipco_gpio_control(&wlc_hw->d11core->bus->drv_cc, gm, gc);
2250 }
2251 
2252 static void brcms_ucode_write(struct brcms_hardware *wlc_hw,
2253 			      const __le32 ucode[], const size_t nbytes)
2254 {
2255 	struct bcma_device *core = wlc_hw->d11core;
2256 	uint i;
2257 	uint count;
2258 
2259 	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
2260 
2261 	count = (nbytes / sizeof(u32));
2262 
2263 	bcma_write32(core, D11REGOFFS(objaddr),
2264 		     OBJADDR_AUTO_INC | OBJADDR_UCM_SEL);
2265 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2266 	for (i = 0; i < count; i++)
2267 		bcma_write32(core, D11REGOFFS(objdata), le32_to_cpu(ucode[i]));
2268 
2269 }
2270 
2271 static void brcms_ucode_download(struct brcms_hardware *wlc_hw)
2272 {
2273 	struct brcms_c_info *wlc;
2274 	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
2275 
2276 	wlc = wlc_hw->wlc;
2277 
2278 	if (wlc_hw->ucode_loaded)
2279 		return;
2280 
2281 	if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
2282 		if (BRCMS_ISNPHY(wlc_hw->band)) {
2283 			brcms_ucode_write(wlc_hw, ucode->bcm43xx_16_mimo,
2284 					  ucode->bcm43xx_16_mimosz);
2285 			wlc_hw->ucode_loaded = true;
2286 		} else
2287 			brcms_err(wlc_hw->d11core,
2288 				  "%s: wl%d: unsupported phy in corerev %d\n",
2289 				  __func__, wlc_hw->unit, wlc_hw->corerev);
2290 	} else if (D11REV_IS(wlc_hw->corerev, 24)) {
2291 		if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2292 			brcms_ucode_write(wlc_hw, ucode->bcm43xx_24_lcn,
2293 					  ucode->bcm43xx_24_lcnsz);
2294 			wlc_hw->ucode_loaded = true;
2295 		} else {
2296 			brcms_err(wlc_hw->d11core,
2297 				  "%s: wl%d: unsupported phy in corerev %d\n",
2298 				  __func__, wlc_hw->unit, wlc_hw->corerev);
2299 		}
2300 	}
2301 }
2302 
2303 void brcms_b_txant_set(struct brcms_hardware *wlc_hw, u16 phytxant)
2304 {
2305 	/* update sw state */
2306 	wlc_hw->bmac_phytxant = phytxant;
2307 
2308 	/* push to ucode if up */
2309 	if (!wlc_hw->up)
2310 		return;
2311 	brcms_c_ucode_txant_set(wlc_hw);
2312 
2313 }
2314 
2315 u16 brcms_b_get_txant(struct brcms_hardware *wlc_hw)
2316 {
2317 	return (u16) wlc_hw->wlc->stf->txant;
2318 }
2319 
2320 void brcms_b_antsel_type_set(struct brcms_hardware *wlc_hw, u8 antsel_type)
2321 {
2322 	wlc_hw->antsel_type = antsel_type;
2323 
2324 	/* Update the antsel type for phy module to use */
2325 	wlc_phy_antsel_type_set(wlc_hw->band->pi, antsel_type);
2326 }
2327 
2328 static void brcms_b_fifoerrors(struct brcms_hardware *wlc_hw)
2329 {
2330 	bool fatal = false;
2331 	uint unit;
2332 	uint intstatus, idx;
2333 	struct bcma_device *core = wlc_hw->d11core;
2334 
2335 	unit = wlc_hw->unit;
2336 
2337 	for (idx = 0; idx < NFIFO; idx++) {
2338 		/* read intstatus register and ignore any non-error bits */
2339 		intstatus =
2340 			bcma_read32(core,
2341 				    D11REGOFFS(intctrlregs[idx].intstatus)) &
2342 			I_ERRORS;
2343 		if (!intstatus)
2344 			continue;
2345 
2346 		brcms_dbg_int(core, "wl%d: intstatus%d 0x%x\n",
2347 			      unit, idx, intstatus);
2348 
2349 		if (intstatus & I_RO) {
2350 			brcms_err(core, "wl%d: fifo %d: receive fifo "
2351 				  "overflow\n", unit, idx);
2352 			fatal = true;
2353 		}
2354 
2355 		if (intstatus & I_PC) {
2356 			brcms_err(core, "wl%d: fifo %d: descriptor error\n",
2357 				  unit, idx);
2358 			fatal = true;
2359 		}
2360 
2361 		if (intstatus & I_PD) {
2362 			brcms_err(core, "wl%d: fifo %d: data error\n", unit,
2363 				  idx);
2364 			fatal = true;
2365 		}
2366 
2367 		if (intstatus & I_DE) {
2368 			brcms_err(core, "wl%d: fifo %d: descriptor protocol "
2369 				  "error\n", unit, idx);
2370 			fatal = true;
2371 		}
2372 
2373 		if (intstatus & I_RU)
2374 			brcms_err(core, "wl%d: fifo %d: receive descriptor "
2375 				  "underflow\n", idx, unit);
2376 
2377 		if (intstatus & I_XU) {
2378 			brcms_err(core, "wl%d: fifo %d: transmit fifo "
2379 				  "underflow\n", idx, unit);
2380 			fatal = true;
2381 		}
2382 
2383 		if (fatal) {
2384 			brcms_fatal_error(wlc_hw->wlc->wl); /* big hammer */
2385 			break;
2386 		} else
2387 			bcma_write32(core,
2388 				     D11REGOFFS(intctrlregs[idx].intstatus),
2389 				     intstatus);
2390 	}
2391 }
2392 
2393 void brcms_c_intrson(struct brcms_c_info *wlc)
2394 {
2395 	struct brcms_hardware *wlc_hw = wlc->hw;
2396 	wlc->macintmask = wlc->defmacintmask;
2397 	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2398 }
2399 
2400 u32 brcms_c_intrsoff(struct brcms_c_info *wlc)
2401 {
2402 	struct brcms_hardware *wlc_hw = wlc->hw;
2403 	u32 macintmask;
2404 
2405 	if (!wlc_hw->clk)
2406 		return 0;
2407 
2408 	macintmask = wlc->macintmask;	/* isr can still happen */
2409 
2410 	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), 0);
2411 	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(macintmask));
2412 	udelay(1);		/* ensure int line is no longer driven */
2413 	wlc->macintmask = 0;
2414 
2415 	/* return previous macintmask; resolve race between us and our isr */
2416 	return wlc->macintstatus ? 0 : macintmask;
2417 }
2418 
2419 void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask)
2420 {
2421 	struct brcms_hardware *wlc_hw = wlc->hw;
2422 	if (!wlc_hw->clk)
2423 		return;
2424 
2425 	wlc->macintmask = macintmask;
2426 	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2427 }
2428 
2429 /* assumes that the d11 MAC is enabled */
2430 static void brcms_b_tx_fifo_suspend(struct brcms_hardware *wlc_hw,
2431 				    uint tx_fifo)
2432 {
2433 	u8 fifo = 1 << tx_fifo;
2434 
2435 	/* Two clients of this code, 11h Quiet period and scanning. */
2436 
2437 	/* only suspend if not already suspended */
2438 	if ((wlc_hw->suspended_fifos & fifo) == fifo)
2439 		return;
2440 
2441 	/* force the core awake only if not already */
2442 	if (wlc_hw->suspended_fifos == 0)
2443 		brcms_c_ucode_wake_override_set(wlc_hw,
2444 						BRCMS_WAKE_OVERRIDE_TXFIFO);
2445 
2446 	wlc_hw->suspended_fifos |= fifo;
2447 
2448 	if (wlc_hw->di[tx_fifo]) {
2449 		/*
2450 		 * Suspending AMPDU transmissions in the middle can cause
2451 		 * underflow which may result in mismatch between ucode and
2452 		 * driver so suspend the mac before suspending the FIFO
2453 		 */
2454 		if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2455 			brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
2456 
2457 		dma_txsuspend(wlc_hw->di[tx_fifo]);
2458 
2459 		if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2460 			brcms_c_enable_mac(wlc_hw->wlc);
2461 	}
2462 }
2463 
2464 static void brcms_b_tx_fifo_resume(struct brcms_hardware *wlc_hw,
2465 				   uint tx_fifo)
2466 {
2467 	/* BMAC_NOTE: BRCMS_TX_FIFO_ENAB is done in brcms_c_dpc() for DMA case
2468 	 * but need to be done here for PIO otherwise the watchdog will catch
2469 	 * the inconsistency and fire
2470 	 */
2471 	/* Two clients of this code, 11h Quiet period and scanning. */
2472 	if (wlc_hw->di[tx_fifo])
2473 		dma_txresume(wlc_hw->di[tx_fifo]);
2474 
2475 	/* allow core to sleep again */
2476 	if (wlc_hw->suspended_fifos == 0)
2477 		return;
2478 	else {
2479 		wlc_hw->suspended_fifos &= ~(1 << tx_fifo);
2480 		if (wlc_hw->suspended_fifos == 0)
2481 			brcms_c_ucode_wake_override_clear(wlc_hw,
2482 						BRCMS_WAKE_OVERRIDE_TXFIFO);
2483 	}
2484 }
2485 
2486 /* precondition: requires the mac core to be enabled */
2487 static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
2488 {
2489 	static const u8 null_ether_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
2490 	u8 *ethaddr = wlc_hw->wlc->pub->cur_etheraddr;
2491 
2492 	if (mute_tx) {
2493 		/* suspend tx fifos */
2494 		brcms_b_tx_fifo_suspend(wlc_hw, TX_DATA_FIFO);
2495 		brcms_b_tx_fifo_suspend(wlc_hw, TX_CTL_FIFO);
2496 		brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_BK_FIFO);
2497 		brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_VI_FIFO);
2498 
2499 		/* zero the address match register so we do not send ACKs */
2500 		brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, null_ether_addr);
2501 	} else {
2502 		/* resume tx fifos */
2503 		brcms_b_tx_fifo_resume(wlc_hw, TX_DATA_FIFO);
2504 		brcms_b_tx_fifo_resume(wlc_hw, TX_CTL_FIFO);
2505 		brcms_b_tx_fifo_resume(wlc_hw, TX_AC_BK_FIFO);
2506 		brcms_b_tx_fifo_resume(wlc_hw, TX_AC_VI_FIFO);
2507 
2508 		/* Restore address */
2509 		brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, ethaddr);
2510 	}
2511 
2512 	wlc_phy_mute_upd(wlc_hw->band->pi, mute_tx, 0);
2513 
2514 	if (mute_tx)
2515 		brcms_c_ucode_mute_override_set(wlc_hw);
2516 	else
2517 		brcms_c_ucode_mute_override_clear(wlc_hw);
2518 }
2519 
2520 void
2521 brcms_c_mute(struct brcms_c_info *wlc, bool mute_tx)
2522 {
2523 	brcms_b_mute(wlc->hw, mute_tx);
2524 }
2525 
2526 /*
2527  * Read and clear macintmask and macintstatus and intstatus registers.
2528  * This routine should be called with interrupts off
2529  * Return:
2530  *   -1 if brcms_deviceremoved(wlc) evaluates to true;
2531  *   0 if the interrupt is not for us, or we are in some special cases;
2532  *   device interrupt status bits otherwise.
2533  */
2534 static inline u32 wlc_intstatus(struct brcms_c_info *wlc, bool in_isr)
2535 {
2536 	struct brcms_hardware *wlc_hw = wlc->hw;
2537 	struct bcma_device *core = wlc_hw->d11core;
2538 	u32 macintstatus, mask;
2539 
2540 	/* macintstatus includes a DMA interrupt summary bit */
2541 	macintstatus = bcma_read32(core, D11REGOFFS(macintstatus));
2542 	mask = in_isr ? wlc->macintmask : wlc->defmacintmask;
2543 
2544 	trace_brcms_macintstatus(&core->dev, in_isr, macintstatus, mask);
2545 
2546 	/* detect cardbus removed, in power down(suspend) and in reset */
2547 	if (brcms_deviceremoved(wlc))
2548 		return -1;
2549 
2550 	/* brcms_deviceremoved() succeeds even when the core is still resetting,
2551 	 * handle that case here.
2552 	 */
2553 	if (macintstatus == 0xffffffff)
2554 		return 0;
2555 
2556 	/* defer unsolicited interrupts */
2557 	macintstatus &= mask;
2558 
2559 	/* if not for us */
2560 	if (macintstatus == 0)
2561 		return 0;
2562 
2563 	/* turn off the interrupts */
2564 	bcma_write32(core, D11REGOFFS(macintmask), 0);
2565 	(void)bcma_read32(core, D11REGOFFS(macintmask));
2566 	wlc->macintmask = 0;
2567 
2568 	/* clear device interrupts */
2569 	bcma_write32(core, D11REGOFFS(macintstatus), macintstatus);
2570 
2571 	/* MI_DMAINT is indication of non-zero intstatus */
2572 	if (macintstatus & MI_DMAINT)
2573 		/*
2574 		 * only fifo interrupt enabled is I_RI in
2575 		 * RX_FIFO. If MI_DMAINT is set, assume it
2576 		 * is set and clear the interrupt.
2577 		 */
2578 		bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intstatus),
2579 			     DEF_RXINTMASK);
2580 
2581 	return macintstatus;
2582 }
2583 
2584 /* Update wlc->macintstatus and wlc->intstatus[]. */
2585 /* Return true if they are updated successfully. false otherwise */
2586 bool brcms_c_intrsupd(struct brcms_c_info *wlc)
2587 {
2588 	u32 macintstatus;
2589 
2590 	/* read and clear macintstatus and intstatus registers */
2591 	macintstatus = wlc_intstatus(wlc, false);
2592 
2593 	/* device is removed */
2594 	if (macintstatus == 0xffffffff)
2595 		return false;
2596 
2597 	/* update interrupt status in software */
2598 	wlc->macintstatus |= macintstatus;
2599 
2600 	return true;
2601 }
2602 
2603 /*
2604  * First-level interrupt processing.
2605  * Return true if this was our interrupt
2606  * and if further brcms_c_dpc() processing is required,
2607  * false otherwise.
2608  */
2609 bool brcms_c_isr(struct brcms_c_info *wlc)
2610 {
2611 	struct brcms_hardware *wlc_hw = wlc->hw;
2612 	u32 macintstatus;
2613 
2614 	if (!wlc_hw->up || !wlc->macintmask)
2615 		return false;
2616 
2617 	/* read and clear macintstatus and intstatus registers */
2618 	macintstatus = wlc_intstatus(wlc, true);
2619 
2620 	if (macintstatus == 0xffffffff) {
2621 		brcms_err(wlc_hw->d11core,
2622 			  "DEVICEREMOVED detected in the ISR code path\n");
2623 		return false;
2624 	}
2625 
2626 	/* it is not for us */
2627 	if (macintstatus == 0)
2628 		return false;
2629 
2630 	/* save interrupt status bits */
2631 	wlc->macintstatus = macintstatus;
2632 
2633 	return true;
2634 
2635 }
2636 
2637 void brcms_c_suspend_mac_and_wait(struct brcms_c_info *wlc)
2638 {
2639 	struct brcms_hardware *wlc_hw = wlc->hw;
2640 	struct bcma_device *core = wlc_hw->d11core;
2641 	u32 mc, mi;
2642 
2643 	brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2644 			   wlc_hw->band->bandunit);
2645 
2646 	/*
2647 	 * Track overlapping suspend requests
2648 	 */
2649 	wlc_hw->mac_suspend_depth++;
2650 	if (wlc_hw->mac_suspend_depth > 1)
2651 		return;
2652 
2653 	/* force the core awake */
2654 	brcms_c_ucode_wake_override_set(wlc_hw, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2655 
2656 	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2657 
2658 	if (mc == 0xffffffff) {
2659 		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2660 			  __func__);
2661 		brcms_down(wlc->wl);
2662 		return;
2663 	}
2664 	WARN_ON(mc & MCTL_PSM_JMP_0);
2665 	WARN_ON(!(mc & MCTL_PSM_RUN));
2666 	WARN_ON(!(mc & MCTL_EN_MAC));
2667 
2668 	mi = bcma_read32(core, D11REGOFFS(macintstatus));
2669 	if (mi == 0xffffffff) {
2670 		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2671 			  __func__);
2672 		brcms_down(wlc->wl);
2673 		return;
2674 	}
2675 	WARN_ON(mi & MI_MACSSPNDD);
2676 
2677 	brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, 0);
2678 
2679 	SPINWAIT(!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD),
2680 		 BRCMS_MAX_MAC_SUSPEND);
2681 
2682 	if (!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD)) {
2683 		brcms_err(core, "wl%d: wlc_suspend_mac_and_wait: waited %d uS"
2684 			  " and MI_MACSSPNDD is still not on.\n",
2685 			  wlc_hw->unit, BRCMS_MAX_MAC_SUSPEND);
2686 		brcms_err(core, "wl%d: psmdebug 0x%08x, phydebug 0x%08x, "
2687 			  "psm_brc 0x%04x\n", wlc_hw->unit,
2688 			  bcma_read32(core, D11REGOFFS(psmdebug)),
2689 			  bcma_read32(core, D11REGOFFS(phydebug)),
2690 			  bcma_read16(core, D11REGOFFS(psm_brc)));
2691 	}
2692 
2693 	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2694 	if (mc == 0xffffffff) {
2695 		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2696 			  __func__);
2697 		brcms_down(wlc->wl);
2698 		return;
2699 	}
2700 	WARN_ON(mc & MCTL_PSM_JMP_0);
2701 	WARN_ON(!(mc & MCTL_PSM_RUN));
2702 	WARN_ON(mc & MCTL_EN_MAC);
2703 }
2704 
2705 void brcms_c_enable_mac(struct brcms_c_info *wlc)
2706 {
2707 	struct brcms_hardware *wlc_hw = wlc->hw;
2708 	struct bcma_device *core = wlc_hw->d11core;
2709 	u32 mc, mi;
2710 
2711 	brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2712 			   wlc->band->bandunit);
2713 
2714 	/*
2715 	 * Track overlapping suspend requests
2716 	 */
2717 	wlc_hw->mac_suspend_depth--;
2718 	if (wlc_hw->mac_suspend_depth > 0)
2719 		return;
2720 
2721 	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2722 	WARN_ON(mc & MCTL_PSM_JMP_0);
2723 	WARN_ON(mc & MCTL_EN_MAC);
2724 	WARN_ON(!(mc & MCTL_PSM_RUN));
2725 
2726 	brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, MCTL_EN_MAC);
2727 	bcma_write32(core, D11REGOFFS(macintstatus), MI_MACSSPNDD);
2728 
2729 	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2730 	WARN_ON(mc & MCTL_PSM_JMP_0);
2731 	WARN_ON(!(mc & MCTL_EN_MAC));
2732 	WARN_ON(!(mc & MCTL_PSM_RUN));
2733 
2734 	mi = bcma_read32(core, D11REGOFFS(macintstatus));
2735 	WARN_ON(mi & MI_MACSSPNDD);
2736 
2737 	brcms_c_ucode_wake_override_clear(wlc_hw,
2738 					  BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2739 }
2740 
2741 void brcms_b_band_stf_ss_set(struct brcms_hardware *wlc_hw, u8 stf_mode)
2742 {
2743 	wlc_hw->hw_stf_ss_opmode = stf_mode;
2744 
2745 	if (wlc_hw->clk)
2746 		brcms_upd_ofdm_pctl1_table(wlc_hw);
2747 }
2748 
2749 static bool brcms_b_validate_chip_access(struct brcms_hardware *wlc_hw)
2750 {
2751 	struct bcma_device *core = wlc_hw->d11core;
2752 	u32 w, val;
2753 	struct wiphy *wiphy = wlc_hw->wlc->wiphy;
2754 
2755 	/* Validate dchip register access */
2756 
2757 	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2758 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2759 	w = bcma_read32(core, D11REGOFFS(objdata));
2760 
2761 	/* Can we write and read back a 32bit register? */
2762 	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2763 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2764 	bcma_write32(core, D11REGOFFS(objdata), (u32) 0xaa5555aa);
2765 
2766 	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2767 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2768 	val = bcma_read32(core, D11REGOFFS(objdata));
2769 	if (val != (u32) 0xaa5555aa) {
2770 		wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2771 			  "expected 0xaa5555aa\n", wlc_hw->unit, val);
2772 		return false;
2773 	}
2774 
2775 	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2776 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2777 	bcma_write32(core, D11REGOFFS(objdata), (u32) 0x55aaaa55);
2778 
2779 	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2780 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2781 	val = bcma_read32(core, D11REGOFFS(objdata));
2782 	if (val != (u32) 0x55aaaa55) {
2783 		wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2784 			  "expected 0x55aaaa55\n", wlc_hw->unit, val);
2785 		return false;
2786 	}
2787 
2788 	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2789 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2790 	bcma_write32(core, D11REGOFFS(objdata), w);
2791 
2792 	/* clear CFPStart */
2793 	bcma_write32(core, D11REGOFFS(tsf_cfpstart), 0);
2794 
2795 	w = bcma_read32(core, D11REGOFFS(maccontrol));
2796 	if ((w != (MCTL_IHR_EN | MCTL_WAKE)) &&
2797 	    (w != (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE))) {
2798 		wiphy_err(wiphy, "wl%d: validate_chip_access: maccontrol = "
2799 			  "0x%x, expected 0x%x or 0x%x\n", wlc_hw->unit, w,
2800 			  (MCTL_IHR_EN | MCTL_WAKE),
2801 			  (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE));
2802 		return false;
2803 	}
2804 
2805 	return true;
2806 }
2807 
2808 #define PHYPLL_WAIT_US	100000
2809 
2810 void brcms_b_core_phypll_ctl(struct brcms_hardware *wlc_hw, bool on)
2811 {
2812 	struct bcma_device *core = wlc_hw->d11core;
2813 	u32 tmp;
2814 
2815 	brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
2816 
2817 	tmp = 0;
2818 
2819 	if (on) {
2820 		if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
2821 			bcma_set32(core, D11REGOFFS(clk_ctl_st),
2822 				   CCS_ERSRC_REQ_HT |
2823 				   CCS_ERSRC_REQ_D11PLL |
2824 				   CCS_ERSRC_REQ_PHYPLL);
2825 			SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2826 				  CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT,
2827 				 PHYPLL_WAIT_US);
2828 
2829 			tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2830 			if ((tmp & CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT)
2831 				brcms_err(core, "%s: turn on PHY PLL failed\n",
2832 					  __func__);
2833 		} else {
2834 			bcma_set32(core, D11REGOFFS(clk_ctl_st),
2835 				   tmp | CCS_ERSRC_REQ_D11PLL |
2836 				   CCS_ERSRC_REQ_PHYPLL);
2837 			SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2838 				  (CCS_ERSRC_AVAIL_D11PLL |
2839 				   CCS_ERSRC_AVAIL_PHYPLL)) !=
2840 				 (CCS_ERSRC_AVAIL_D11PLL |
2841 				  CCS_ERSRC_AVAIL_PHYPLL), PHYPLL_WAIT_US);
2842 
2843 			tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2844 			if ((tmp &
2845 			     (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2846 			    !=
2847 			    (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2848 				brcms_err(core, "%s: turn on PHY PLL failed\n",
2849 					  __func__);
2850 		}
2851 	} else {
2852 		/*
2853 		 * Since the PLL may be shared, other cores can still
2854 		 * be requesting it; so we'll deassert the request but
2855 		 * not wait for status to comply.
2856 		 */
2857 		bcma_mask32(core, D11REGOFFS(clk_ctl_st),
2858 			    ~CCS_ERSRC_REQ_PHYPLL);
2859 		(void)bcma_read32(core, D11REGOFFS(clk_ctl_st));
2860 	}
2861 }
2862 
2863 static void brcms_c_coredisable(struct brcms_hardware *wlc_hw)
2864 {
2865 	bool dev_gone;
2866 
2867 	brcms_dbg_info(wlc_hw->d11core, "wl%d: disable core\n", wlc_hw->unit);
2868 
2869 	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
2870 
2871 	if (dev_gone)
2872 		return;
2873 
2874 	if (wlc_hw->noreset)
2875 		return;
2876 
2877 	/* radio off */
2878 	wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
2879 
2880 	/* turn off analog core */
2881 	wlc_phy_anacore(wlc_hw->band->pi, OFF);
2882 
2883 	/* turn off PHYPLL to save power */
2884 	brcms_b_core_phypll_ctl(wlc_hw, false);
2885 
2886 	wlc_hw->clk = false;
2887 	bcma_core_disable(wlc_hw->d11core, 0);
2888 	wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
2889 }
2890 
2891 static void brcms_c_flushqueues(struct brcms_c_info *wlc)
2892 {
2893 	struct brcms_hardware *wlc_hw = wlc->hw;
2894 	uint i;
2895 
2896 	/* free any posted tx packets */
2897 	for (i = 0; i < NFIFO; i++) {
2898 		if (wlc_hw->di[i]) {
2899 			dma_txreclaim(wlc_hw->di[i], DMA_RANGE_ALL);
2900 			if (i < TX_BCMC_FIFO)
2901 				ieee80211_wake_queue(wlc->pub->ieee_hw,
2902 						     brcms_fifo_to_ac(i));
2903 		}
2904 	}
2905 
2906 	/* free any posted rx packets */
2907 	dma_rxreclaim(wlc_hw->di[RX_FIFO]);
2908 }
2909 
2910 static u16
2911 brcms_b_read_objmem(struct brcms_hardware *wlc_hw, uint offset, u32 sel)
2912 {
2913 	struct bcma_device *core = wlc_hw->d11core;
2914 	u16 objoff = D11REGOFFS(objdata);
2915 
2916 	bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2917 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2918 	if (offset & 2)
2919 		objoff += 2;
2920 
2921 	return bcma_read16(core, objoff);
2922 }
2923 
2924 static void
2925 brcms_b_write_objmem(struct brcms_hardware *wlc_hw, uint offset, u16 v,
2926 		     u32 sel)
2927 {
2928 	struct bcma_device *core = wlc_hw->d11core;
2929 	u16 objoff = D11REGOFFS(objdata);
2930 
2931 	bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2932 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2933 	if (offset & 2)
2934 		objoff += 2;
2935 
2936 	bcma_wflush16(core, objoff, v);
2937 }
2938 
2939 /*
2940  * Read a single u16 from shared memory.
2941  * SHM 'offset' needs to be an even address
2942  */
2943 u16 brcms_b_read_shm(struct brcms_hardware *wlc_hw, uint offset)
2944 {
2945 	return brcms_b_read_objmem(wlc_hw, offset, OBJADDR_SHM_SEL);
2946 }
2947 
2948 /*
2949  * Write a single u16 to shared memory.
2950  * SHM 'offset' needs to be an even address
2951  */
2952 void brcms_b_write_shm(struct brcms_hardware *wlc_hw, uint offset, u16 v)
2953 {
2954 	brcms_b_write_objmem(wlc_hw, offset, v, OBJADDR_SHM_SEL);
2955 }
2956 
2957 /*
2958  * Copy a buffer to shared memory of specified type .
2959  * SHM 'offset' needs to be an even address and
2960  * Buffer length 'len' must be an even number of bytes
2961  * 'sel' selects the type of memory
2962  */
2963 void
2964 brcms_b_copyto_objmem(struct brcms_hardware *wlc_hw, uint offset,
2965 		      const void *buf, int len, u32 sel)
2966 {
2967 	u16 v;
2968 	const u8 *p = (const u8 *)buf;
2969 	int i;
2970 
2971 	if (len <= 0 || (offset & 1) || (len & 1))
2972 		return;
2973 
2974 	for (i = 0; i < len; i += 2) {
2975 		v = p[i] | (p[i + 1] << 8);
2976 		brcms_b_write_objmem(wlc_hw, offset + i, v, sel);
2977 	}
2978 }
2979 
2980 /*
2981  * Copy a piece of shared memory of specified type to a buffer .
2982  * SHM 'offset' needs to be an even address and
2983  * Buffer length 'len' must be an even number of bytes
2984  * 'sel' selects the type of memory
2985  */
2986 void
2987 brcms_b_copyfrom_objmem(struct brcms_hardware *wlc_hw, uint offset, void *buf,
2988 			 int len, u32 sel)
2989 {
2990 	u16 v;
2991 	u8 *p = (u8 *) buf;
2992 	int i;
2993 
2994 	if (len <= 0 || (offset & 1) || (len & 1))
2995 		return;
2996 
2997 	for (i = 0; i < len; i += 2) {
2998 		v = brcms_b_read_objmem(wlc_hw, offset + i, sel);
2999 		p[i] = v & 0xFF;
3000 		p[i + 1] = (v >> 8) & 0xFF;
3001 	}
3002 }
3003 
3004 /* Copy a buffer to shared memory.
3005  * SHM 'offset' needs to be an even address and
3006  * Buffer length 'len' must be an even number of bytes
3007  */
3008 static void brcms_c_copyto_shm(struct brcms_c_info *wlc, uint offset,
3009 			const void *buf, int len)
3010 {
3011 	brcms_b_copyto_objmem(wlc->hw, offset, buf, len, OBJADDR_SHM_SEL);
3012 }
3013 
3014 static void brcms_b_retrylimit_upd(struct brcms_hardware *wlc_hw,
3015 				   u16 SRL, u16 LRL)
3016 {
3017 	wlc_hw->SRL = SRL;
3018 	wlc_hw->LRL = LRL;
3019 
3020 	/* write retry limit to SCR, shouldn't need to suspend */
3021 	if (wlc_hw->up) {
3022 		bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3023 			     OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3024 		(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3025 		bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->SRL);
3026 		bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3027 			     OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3028 		(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3029 		bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->LRL);
3030 	}
3031 }
3032 
3033 static void brcms_b_pllreq(struct brcms_hardware *wlc_hw, bool set, u32 req_bit)
3034 {
3035 	if (set) {
3036 		if (mboolisset(wlc_hw->pllreq, req_bit))
3037 			return;
3038 
3039 		mboolset(wlc_hw->pllreq, req_bit);
3040 
3041 		if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3042 			if (!wlc_hw->sbclk)
3043 				brcms_b_xtal(wlc_hw, ON);
3044 		}
3045 	} else {
3046 		if (!mboolisset(wlc_hw->pllreq, req_bit))
3047 			return;
3048 
3049 		mboolclr(wlc_hw->pllreq, req_bit);
3050 
3051 		if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3052 			if (wlc_hw->sbclk)
3053 				brcms_b_xtal(wlc_hw, OFF);
3054 		}
3055 	}
3056 }
3057 
3058 static void brcms_b_antsel_set(struct brcms_hardware *wlc_hw, u32 antsel_avail)
3059 {
3060 	wlc_hw->antsel_avail = antsel_avail;
3061 }
3062 
3063 /*
3064  * conditions under which the PM bit should be set in outgoing frames
3065  * and STAY_AWAKE is meaningful
3066  */
3067 static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
3068 {
3069 	/* not supporting PS so always return false for now */
3070 	return false;
3071 }
3072 
3073 static void brcms_c_statsupd(struct brcms_c_info *wlc)
3074 {
3075 	int i;
3076 	struct macstat *macstats;
3077 #ifdef DEBUG
3078 	u16 delta;
3079 	u16 rxf0ovfl;
3080 	u16 txfunfl[NFIFO];
3081 #endif				/* DEBUG */
3082 
3083 	/* if driver down, make no sense to update stats */
3084 	if (!wlc->pub->up)
3085 		return;
3086 
3087 	macstats = wlc->core->macstat_snapshot;
3088 
3089 #ifdef DEBUG
3090 	/* save last rx fifo 0 overflow count */
3091 	rxf0ovfl = macstats->rxf0ovfl;
3092 
3093 	/* save last tx fifo  underflow count */
3094 	for (i = 0; i < NFIFO; i++)
3095 		txfunfl[i] = macstats->txfunfl[i];
3096 #endif				/* DEBUG */
3097 
3098 	/* Read mac stats from contiguous shared memory */
3099 	brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, macstats,
3100 				sizeof(*macstats), OBJADDR_SHM_SEL);
3101 
3102 #ifdef DEBUG
3103 	/* check for rx fifo 0 overflow */
3104 	delta = (u16)(macstats->rxf0ovfl - rxf0ovfl);
3105 	if (delta)
3106 		brcms_err(wlc->hw->d11core, "wl%d: %u rx fifo 0 overflows!\n",
3107 			  wlc->pub->unit, delta);
3108 
3109 	/* check for tx fifo underflows */
3110 	for (i = 0; i < NFIFO; i++) {
3111 		delta = macstats->txfunfl[i] - txfunfl[i];
3112 		if (delta)
3113 			brcms_err(wlc->hw->d11core,
3114 				  "wl%d: %u tx fifo %d underflows!\n",
3115 				  wlc->pub->unit, delta, i);
3116 	}
3117 #endif				/* DEBUG */
3118 
3119 	/* merge counters from dma module */
3120 	for (i = 0; i < NFIFO; i++) {
3121 		if (wlc->hw->di[i])
3122 			dma_counterreset(wlc->hw->di[i]);
3123 	}
3124 }
3125 
3126 static void brcms_b_reset(struct brcms_hardware *wlc_hw)
3127 {
3128 	/* reset the core */
3129 	if (!brcms_deviceremoved(wlc_hw->wlc))
3130 		brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
3131 
3132 	/* purge the dma rings */
3133 	brcms_c_flushqueues(wlc_hw->wlc);
3134 }
3135 
3136 void brcms_c_reset(struct brcms_c_info *wlc)
3137 {
3138 	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
3139 
3140 	/* slurp up hw mac counters before core reset */
3141 	brcms_c_statsupd(wlc);
3142 
3143 	/* reset our snapshot of macstat counters */
3144 	memset(wlc->core->macstat_snapshot, 0, sizeof(struct macstat));
3145 
3146 	brcms_b_reset(wlc->hw);
3147 }
3148 
3149 void brcms_c_init_scb(struct scb *scb)
3150 {
3151 	int i;
3152 
3153 	memset(scb, 0, sizeof(struct scb));
3154 	scb->flags = SCB_WMECAP | SCB_HTCAP;
3155 	for (i = 0; i < NUMPRIO; i++) {
3156 		scb->seqnum[i] = 0;
3157 		scb->seqctl[i] = 0xFFFF;
3158 	}
3159 
3160 	scb->seqctl_nonqos = 0xFFFF;
3161 	scb->magic = SCB_MAGIC;
3162 }
3163 
3164 /* d11 core init
3165  *   reset PSM
3166  *   download ucode/PCM
3167  *   let ucode run to suspended
3168  *   download ucode inits
3169  *   config other core registers
3170  *   init dma
3171  */
3172 static void brcms_b_coreinit(struct brcms_c_info *wlc)
3173 {
3174 	struct brcms_hardware *wlc_hw = wlc->hw;
3175 	struct bcma_device *core = wlc_hw->d11core;
3176 	u32 sflags;
3177 	u32 bcnint_us;
3178 	uint i = 0;
3179 	bool fifosz_fixup = false;
3180 	int err = 0;
3181 	u16 buf[NFIFO];
3182 	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
3183 
3184 	brcms_dbg_info(core, "wl%d: core init\n", wlc_hw->unit);
3185 
3186 	/* reset PSM */
3187 	brcms_b_mctrl(wlc_hw, ~0, (MCTL_IHR_EN | MCTL_PSM_JMP_0 | MCTL_WAKE));
3188 
3189 	brcms_ucode_download(wlc_hw);
3190 	/*
3191 	 * FIFOSZ fixup. driver wants to controls the fifo allocation.
3192 	 */
3193 	fifosz_fixup = true;
3194 
3195 	/* let the PSM run to the suspended state, set mode to BSS STA */
3196 	bcma_write32(core, D11REGOFFS(macintstatus), -1);
3197 	brcms_b_mctrl(wlc_hw, ~0,
3198 		       (MCTL_IHR_EN | MCTL_INFRA | MCTL_PSM_RUN | MCTL_WAKE));
3199 
3200 	/* wait for ucode to self-suspend after auto-init */
3201 	SPINWAIT(((bcma_read32(core, D11REGOFFS(macintstatus)) &
3202 		   MI_MACSSPNDD) == 0), 1000 * 1000);
3203 	if ((bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD) == 0)
3204 		brcms_err(core, "wl%d: wlc_coreinit: ucode did not self-"
3205 			  "suspend!\n", wlc_hw->unit);
3206 
3207 	brcms_c_gpio_init(wlc);
3208 
3209 	sflags = bcma_aread32(core, BCMA_IOST);
3210 
3211 	if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
3212 		if (BRCMS_ISNPHY(wlc_hw->band))
3213 			brcms_c_write_inits(wlc_hw, ucode->d11n0initvals16);
3214 		else
3215 			brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3216 				  " %d\n", __func__, wlc_hw->unit,
3217 				  wlc_hw->corerev);
3218 	} else if (D11REV_IS(wlc_hw->corerev, 24)) {
3219 		if (BRCMS_ISLCNPHY(wlc_hw->band))
3220 			brcms_c_write_inits(wlc_hw, ucode->d11lcn0initvals24);
3221 		else
3222 			brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3223 				  " %d\n", __func__, wlc_hw->unit,
3224 				  wlc_hw->corerev);
3225 	} else {
3226 		brcms_err(core, "%s: wl%d: unsupported corerev %d\n",
3227 			  __func__, wlc_hw->unit, wlc_hw->corerev);
3228 	}
3229 
3230 	/* For old ucode, txfifo sizes needs to be modified(increased) */
3231 	if (fifosz_fixup)
3232 		brcms_b_corerev_fifofixup(wlc_hw);
3233 
3234 	/* check txfifo allocations match between ucode and driver */
3235 	buf[TX_AC_BE_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE0);
3236 	if (buf[TX_AC_BE_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]) {
3237 		i = TX_AC_BE_FIFO;
3238 		err = -1;
3239 	}
3240 	buf[TX_AC_VI_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE1);
3241 	if (buf[TX_AC_VI_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]) {
3242 		i = TX_AC_VI_FIFO;
3243 		err = -1;
3244 	}
3245 	buf[TX_AC_BK_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE2);
3246 	buf[TX_AC_VO_FIFO] = (buf[TX_AC_BK_FIFO] >> 8) & 0xff;
3247 	buf[TX_AC_BK_FIFO] &= 0xff;
3248 	if (buf[TX_AC_BK_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BK_FIFO]) {
3249 		i = TX_AC_BK_FIFO;
3250 		err = -1;
3251 	}
3252 	if (buf[TX_AC_VO_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO]) {
3253 		i = TX_AC_VO_FIFO;
3254 		err = -1;
3255 	}
3256 	buf[TX_BCMC_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE3);
3257 	buf[TX_ATIM_FIFO] = (buf[TX_BCMC_FIFO] >> 8) & 0xff;
3258 	buf[TX_BCMC_FIFO] &= 0xff;
3259 	if (buf[TX_BCMC_FIFO] != wlc_hw->xmtfifo_sz[TX_BCMC_FIFO]) {
3260 		i = TX_BCMC_FIFO;
3261 		err = -1;
3262 	}
3263 	if (buf[TX_ATIM_FIFO] != wlc_hw->xmtfifo_sz[TX_ATIM_FIFO]) {
3264 		i = TX_ATIM_FIFO;
3265 		err = -1;
3266 	}
3267 	if (err != 0)
3268 		brcms_err(core, "wlc_coreinit: txfifo mismatch: ucode size %d"
3269 			  " driver size %d index %d\n", buf[i],
3270 			  wlc_hw->xmtfifo_sz[i], i);
3271 
3272 	/* make sure we can still talk to the mac */
3273 	WARN_ON(bcma_read32(core, D11REGOFFS(maccontrol)) == 0xffffffff);
3274 
3275 	/* band-specific inits done by wlc_bsinit() */
3276 
3277 	/* Set up frame burst size and antenna swap threshold init values */
3278 	brcms_b_write_shm(wlc_hw, M_MBURST_SIZE, MAXTXFRAMEBURST);
3279 	brcms_b_write_shm(wlc_hw, M_MAX_ANTCNT, ANTCNT);
3280 
3281 	/* enable one rx interrupt per received frame */
3282 	bcma_write32(core, D11REGOFFS(intrcvlazy[0]), (1 << IRL_FC_SHIFT));
3283 
3284 	/* set the station mode (BSS STA) */
3285 	brcms_b_mctrl(wlc_hw,
3286 		       (MCTL_INFRA | MCTL_DISCARD_PMQ | MCTL_AP),
3287 		       (MCTL_INFRA | MCTL_DISCARD_PMQ));
3288 
3289 	/* set up Beacon interval */
3290 	bcnint_us = 0x8000 << 10;
3291 	bcma_write32(core, D11REGOFFS(tsf_cfprep),
3292 		     (bcnint_us << CFPREP_CBI_SHIFT));
3293 	bcma_write32(core, D11REGOFFS(tsf_cfpstart), bcnint_us);
3294 	bcma_write32(core, D11REGOFFS(macintstatus), MI_GP1);
3295 
3296 	/* write interrupt mask */
3297 	bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intmask),
3298 		     DEF_RXINTMASK);
3299 
3300 	/* allow the MAC to control the PHY clock (dynamic on/off) */
3301 	brcms_b_macphyclk_set(wlc_hw, ON);
3302 
3303 	/* program dynamic clock control fast powerup delay register */
3304 	wlc->fastpwrup_dly = ai_clkctl_fast_pwrup_delay(wlc_hw->sih);
3305 	bcma_write16(core, D11REGOFFS(scc_fastpwrup_dly), wlc->fastpwrup_dly);
3306 
3307 	/* tell the ucode the corerev */
3308 	brcms_b_write_shm(wlc_hw, M_MACHW_VER, (u16) wlc_hw->corerev);
3309 
3310 	/* tell the ucode MAC capabilities */
3311 	brcms_b_write_shm(wlc_hw, M_MACHW_CAP_L,
3312 			   (u16) (wlc_hw->machwcap & 0xffff));
3313 	brcms_b_write_shm(wlc_hw, M_MACHW_CAP_H,
3314 			   (u16) ((wlc_hw->
3315 				      machwcap >> 16) & 0xffff));
3316 
3317 	/* write retry limits to SCR, this done after PSM init */
3318 	bcma_write32(core, D11REGOFFS(objaddr),
3319 		     OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3320 	(void)bcma_read32(core, D11REGOFFS(objaddr));
3321 	bcma_write32(core, D11REGOFFS(objdata), wlc_hw->SRL);
3322 	bcma_write32(core, D11REGOFFS(objaddr),
3323 		     OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3324 	(void)bcma_read32(core, D11REGOFFS(objaddr));
3325 	bcma_write32(core, D11REGOFFS(objdata), wlc_hw->LRL);
3326 
3327 	/* write rate fallback retry limits */
3328 	brcms_b_write_shm(wlc_hw, M_SFRMTXCNTFBRTHSD, wlc_hw->SFBL);
3329 	brcms_b_write_shm(wlc_hw, M_LFRMTXCNTFBRTHSD, wlc_hw->LFBL);
3330 
3331 	bcma_mask16(core, D11REGOFFS(ifs_ctl), 0x0FFF);
3332 	bcma_write16(core, D11REGOFFS(ifs_aifsn), EDCF_AIFSN_MIN);
3333 
3334 	/* init the tx dma engines */
3335 	for (i = 0; i < NFIFO; i++) {
3336 		if (wlc_hw->di[i])
3337 			dma_txinit(wlc_hw->di[i]);
3338 	}
3339 
3340 	/* init the rx dma engine(s) and post receive buffers */
3341 	dma_rxinit(wlc_hw->di[RX_FIFO]);
3342 	dma_rxfill(wlc_hw->di[RX_FIFO]);
3343 }
3344 
3345 static void brcms_b_init(struct brcms_hardware *wlc_hw, u16 chanspec)
3346 {
3347 	u32 macintmask;
3348 	bool fastclk;
3349 	struct brcms_c_info *wlc = wlc_hw->wlc;
3350 
3351 	/* request FAST clock if not on */
3352 	fastclk = wlc_hw->forcefastclk;
3353 	if (!fastclk)
3354 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
3355 
3356 	/* disable interrupts */
3357 	macintmask = brcms_intrsoff(wlc->wl);
3358 
3359 	/* set up the specified band and chanspec */
3360 	brcms_c_setxband(wlc_hw, chspec_bandunit(chanspec));
3361 	wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3362 
3363 	/* do one-time phy inits and calibration */
3364 	wlc_phy_cal_init(wlc_hw->band->pi);
3365 
3366 	/* core-specific initialization */
3367 	brcms_b_coreinit(wlc);
3368 
3369 	/* band-specific inits */
3370 	brcms_b_bsinit(wlc, chanspec);
3371 
3372 	/* restore macintmask */
3373 	brcms_intrsrestore(wlc->wl, macintmask);
3374 
3375 	/* seed wake_override with BRCMS_WAKE_OVERRIDE_MACSUSPEND since the mac
3376 	 * is suspended and brcms_c_enable_mac() will clear this override bit.
3377 	 */
3378 	mboolset(wlc_hw->wake_override, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
3379 
3380 	/*
3381 	 * initialize mac_suspend_depth to 1 to match ucode
3382 	 * initial suspended state
3383 	 */
3384 	wlc_hw->mac_suspend_depth = 1;
3385 
3386 	/* restore the clk */
3387 	if (!fastclk)
3388 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
3389 }
3390 
3391 static void brcms_c_set_phy_chanspec(struct brcms_c_info *wlc,
3392 				     u16 chanspec)
3393 {
3394 	/* Save our copy of the chanspec */
3395 	wlc->chanspec = chanspec;
3396 
3397 	/* Set the chanspec and power limits for this locale */
3398 	brcms_c_channel_set_chanspec(wlc->cmi, chanspec, BRCMS_TXPWR_MAX);
3399 
3400 	if (wlc->stf->ss_algosel_auto)
3401 		brcms_c_stf_ss_algo_channel_get(wlc, &wlc->stf->ss_algo_channel,
3402 					    chanspec);
3403 
3404 	brcms_c_stf_ss_update(wlc, wlc->band);
3405 }
3406 
3407 static void
3408 brcms_default_rateset(struct brcms_c_info *wlc, struct brcms_c_rateset *rs)
3409 {
3410 	brcms_c_rateset_default(rs, NULL, wlc->band->phytype,
3411 		wlc->band->bandtype, false, BRCMS_RATE_MASK_FULL,
3412 		(bool) (wlc->pub->_n_enab & SUPPORT_11N),
3413 		brcms_chspec_bw(wlc->default_bss->chanspec),
3414 		wlc->stf->txstreams);
3415 }
3416 
3417 /* derive wlc->band->basic_rate[] table from 'rateset' */
3418 static void brcms_c_rate_lookup_init(struct brcms_c_info *wlc,
3419 			      struct brcms_c_rateset *rateset)
3420 {
3421 	u8 rate;
3422 	u8 mandatory;
3423 	u8 cck_basic = 0;
3424 	u8 ofdm_basic = 0;
3425 	u8 *br = wlc->band->basic_rate;
3426 	uint i;
3427 
3428 	/* incoming rates are in 500kbps units as in 802.11 Supported Rates */
3429 	memset(br, 0, BRCM_MAXRATE + 1);
3430 
3431 	/* For each basic rate in the rates list, make an entry in the
3432 	 * best basic lookup.
3433 	 */
3434 	for (i = 0; i < rateset->count; i++) {
3435 		/* only make an entry for a basic rate */
3436 		if (!(rateset->rates[i] & BRCMS_RATE_FLAG))
3437 			continue;
3438 
3439 		/* mask off basic bit */
3440 		rate = (rateset->rates[i] & BRCMS_RATE_MASK);
3441 
3442 		if (rate > BRCM_MAXRATE) {
3443 			brcms_err(wlc->hw->d11core, "brcms_c_rate_lookup_init: "
3444 				  "invalid rate 0x%X in rate set\n",
3445 				  rateset->rates[i]);
3446 			continue;
3447 		}
3448 
3449 		br[rate] = rate;
3450 	}
3451 
3452 	/* The rate lookup table now has non-zero entries for each
3453 	 * basic rate, equal to the basic rate: br[basicN] = basicN
3454 	 *
3455 	 * To look up the best basic rate corresponding to any
3456 	 * particular rate, code can use the basic_rate table
3457 	 * like this
3458 	 *
3459 	 * basic_rate = wlc->band->basic_rate[tx_rate]
3460 	 *
3461 	 * Make sure there is a best basic rate entry for
3462 	 * every rate by walking up the table from low rates
3463 	 * to high, filling in holes in the lookup table
3464 	 */
3465 
3466 	for (i = 0; i < wlc->band->hw_rateset.count; i++) {
3467 		rate = wlc->band->hw_rateset.rates[i];
3468 
3469 		if (br[rate] != 0) {
3470 			/* This rate is a basic rate.
3471 			 * Keep track of the best basic rate so far by
3472 			 * modulation type.
3473 			 */
3474 			if (is_ofdm_rate(rate))
3475 				ofdm_basic = rate;
3476 			else
3477 				cck_basic = rate;
3478 
3479 			continue;
3480 		}
3481 
3482 		/* This rate is not a basic rate so figure out the
3483 		 * best basic rate less than this rate and fill in
3484 		 * the hole in the table
3485 		 */
3486 
3487 		br[rate] = is_ofdm_rate(rate) ? ofdm_basic : cck_basic;
3488 
3489 		if (br[rate] != 0)
3490 			continue;
3491 
3492 		if (is_ofdm_rate(rate)) {
3493 			/*
3494 			 * In 11g and 11a, the OFDM mandatory rates
3495 			 * are 6, 12, and 24 Mbps
3496 			 */
3497 			if (rate >= BRCM_RATE_24M)
3498 				mandatory = BRCM_RATE_24M;
3499 			else if (rate >= BRCM_RATE_12M)
3500 				mandatory = BRCM_RATE_12M;
3501 			else
3502 				mandatory = BRCM_RATE_6M;
3503 		} else {
3504 			/* In 11b, all CCK rates are mandatory 1 - 11 Mbps */
3505 			mandatory = rate;
3506 		}
3507 
3508 		br[rate] = mandatory;
3509 	}
3510 }
3511 
3512 static void brcms_c_bandinit_ordered(struct brcms_c_info *wlc,
3513 				     u16 chanspec)
3514 {
3515 	struct brcms_c_rateset default_rateset;
3516 	uint parkband;
3517 	uint i, band_order[2];
3518 
3519 	/*
3520 	 * We might have been bandlocked during down and the chip
3521 	 * power-cycled (hibernate). Figure out the right band to park on
3522 	 */
3523 	if (wlc->bandlocked || wlc->pub->_nbands == 1) {
3524 		/* updated in brcms_c_bandlock() */
3525 		parkband = wlc->band->bandunit;
3526 		band_order[0] = band_order[1] = parkband;
3527 	} else {
3528 		/* park on the band of the specified chanspec */
3529 		parkband = chspec_bandunit(chanspec);
3530 
3531 		/* order so that parkband initialize last */
3532 		band_order[0] = parkband ^ 1;
3533 		band_order[1] = parkband;
3534 	}
3535 
3536 	/* make each band operational, software state init */
3537 	for (i = 0; i < wlc->pub->_nbands; i++) {
3538 		uint j = band_order[i];
3539 
3540 		wlc->band = wlc->bandstate[j];
3541 
3542 		brcms_default_rateset(wlc, &default_rateset);
3543 
3544 		/* fill in hw_rate */
3545 		brcms_c_rateset_filter(&default_rateset, &wlc->band->hw_rateset,
3546 				   false, BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
3547 				   (bool) (wlc->pub->_n_enab & SUPPORT_11N));
3548 
3549 		/* init basic rate lookup */
3550 		brcms_c_rate_lookup_init(wlc, &default_rateset);
3551 	}
3552 
3553 	/* sync up phy/radio chanspec */
3554 	brcms_c_set_phy_chanspec(wlc, chanspec);
3555 }
3556 
3557 /*
3558  * Set or clear filtering related maccontrol bits based on
3559  * specified filter flags
3560  */
3561 void brcms_c_mac_promisc(struct brcms_c_info *wlc, uint filter_flags)
3562 {
3563 	u32 promisc_bits = 0;
3564 
3565 	wlc->filter_flags = filter_flags;
3566 
3567 	if (filter_flags & FIF_OTHER_BSS)
3568 		promisc_bits |= MCTL_PROMISC;
3569 
3570 	if (filter_flags & FIF_BCN_PRBRESP_PROMISC)
3571 		promisc_bits |= MCTL_BCNS_PROMISC;
3572 
3573 	if (filter_flags & FIF_FCSFAIL)
3574 		promisc_bits |= MCTL_KEEPBADFCS;
3575 
3576 	if (filter_flags & (FIF_CONTROL | FIF_PSPOLL))
3577 		promisc_bits |= MCTL_KEEPCONTROL;
3578 
3579 	brcms_b_mctrl(wlc->hw,
3580 		MCTL_PROMISC | MCTL_BCNS_PROMISC |
3581 		MCTL_KEEPCONTROL | MCTL_KEEPBADFCS,
3582 		promisc_bits);
3583 }
3584 
3585 /*
3586  * ucode, hwmac update
3587  *    Channel dependent updates for ucode and hw
3588  */
3589 static void brcms_c_ucode_mac_upd(struct brcms_c_info *wlc)
3590 {
3591 	/* enable or disable any active IBSSs depending on whether or not
3592 	 * we are on the home channel
3593 	 */
3594 	if (wlc->home_chanspec == wlc_phy_chanspec_get(wlc->band->pi)) {
3595 		if (wlc->pub->associated) {
3596 			/*
3597 			 * BMAC_NOTE: This is something that should be fixed
3598 			 * in ucode inits. I think that the ucode inits set
3599 			 * up the bcn templates and shm values with a bogus
3600 			 * beacon. This should not be done in the inits. If
3601 			 * ucode needs to set up a beacon for testing, the
3602 			 * test routines should write it down, not expect the
3603 			 * inits to populate a bogus beacon.
3604 			 */
3605 			if (BRCMS_PHY_11N_CAP(wlc->band))
3606 				brcms_b_write_shm(wlc->hw,
3607 						M_BCN_TXTSF_OFFSET, 0);
3608 		}
3609 	} else {
3610 		/* disable an active IBSS if we are not on the home channel */
3611 	}
3612 }
3613 
3614 static void brcms_c_write_rate_shm(struct brcms_c_info *wlc, u8 rate,
3615 				   u8 basic_rate)
3616 {
3617 	u8 phy_rate, index;
3618 	u8 basic_phy_rate, basic_index;
3619 	u16 dir_table, basic_table;
3620 	u16 basic_ptr;
3621 
3622 	/* Shared memory address for the table we are reading */
3623 	dir_table = is_ofdm_rate(basic_rate) ? M_RT_DIRMAP_A : M_RT_DIRMAP_B;
3624 
3625 	/* Shared memory address for the table we are writing */
3626 	basic_table = is_ofdm_rate(rate) ? M_RT_BBRSMAP_A : M_RT_BBRSMAP_B;
3627 
3628 	/*
3629 	 * for a given rate, the LS-nibble of the PLCP SIGNAL field is
3630 	 * the index into the rate table.
3631 	 */
3632 	phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
3633 	basic_phy_rate = rate_info[basic_rate] & BRCMS_RATE_MASK;
3634 	index = phy_rate & 0xf;
3635 	basic_index = basic_phy_rate & 0xf;
3636 
3637 	/* Find the SHM pointer to the ACK rate entry by looking in the
3638 	 * Direct-map Table
3639 	 */
3640 	basic_ptr = brcms_b_read_shm(wlc->hw, (dir_table + basic_index * 2));
3641 
3642 	/* Update the SHM BSS-basic-rate-set mapping table with the pointer
3643 	 * to the correct basic rate for the given incoming rate
3644 	 */
3645 	brcms_b_write_shm(wlc->hw, (basic_table + index * 2), basic_ptr);
3646 }
3647 
3648 static const struct brcms_c_rateset *
3649 brcms_c_rateset_get_hwrs(struct brcms_c_info *wlc)
3650 {
3651 	const struct brcms_c_rateset *rs_dflt;
3652 
3653 	if (BRCMS_PHY_11N_CAP(wlc->band)) {
3654 		if (wlc->band->bandtype == BRCM_BAND_5G)
3655 			rs_dflt = &ofdm_mimo_rates;
3656 		else
3657 			rs_dflt = &cck_ofdm_mimo_rates;
3658 	} else if (wlc->band->gmode)
3659 		rs_dflt = &cck_ofdm_rates;
3660 	else
3661 		rs_dflt = &cck_rates;
3662 
3663 	return rs_dflt;
3664 }
3665 
3666 static void brcms_c_set_ratetable(struct brcms_c_info *wlc)
3667 {
3668 	const struct brcms_c_rateset *rs_dflt;
3669 	struct brcms_c_rateset rs;
3670 	u8 rate, basic_rate;
3671 	uint i;
3672 
3673 	rs_dflt = brcms_c_rateset_get_hwrs(wlc);
3674 
3675 	brcms_c_rateset_copy(rs_dflt, &rs);
3676 	brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
3677 
3678 	/* walk the phy rate table and update SHM basic rate lookup table */
3679 	for (i = 0; i < rs.count; i++) {
3680 		rate = rs.rates[i] & BRCMS_RATE_MASK;
3681 
3682 		/* for a given rate brcms_basic_rate returns the rate at
3683 		 * which a response ACK/CTS should be sent.
3684 		 */
3685 		basic_rate = brcms_basic_rate(wlc, rate);
3686 		if (basic_rate == 0)
3687 			/* This should only happen if we are using a
3688 			 * restricted rateset.
3689 			 */
3690 			basic_rate = rs.rates[0] & BRCMS_RATE_MASK;
3691 
3692 		brcms_c_write_rate_shm(wlc, rate, basic_rate);
3693 	}
3694 }
3695 
3696 /* band-specific init */
3697 static void brcms_c_bsinit(struct brcms_c_info *wlc)
3698 {
3699 	brcms_dbg_info(wlc->hw->d11core, "wl%d: bandunit %d\n",
3700 		       wlc->pub->unit, wlc->band->bandunit);
3701 
3702 	/* write ucode ACK/CTS rate table */
3703 	brcms_c_set_ratetable(wlc);
3704 
3705 	/* update some band specific mac configuration */
3706 	brcms_c_ucode_mac_upd(wlc);
3707 
3708 	/* init antenna selection */
3709 	brcms_c_antsel_init(wlc->asi);
3710 
3711 }
3712 
3713 /* formula:  IDLE_BUSY_RATIO_X_16 = (100-duty_cycle)/duty_cycle*16 */
3714 static int
3715 brcms_c_duty_cycle_set(struct brcms_c_info *wlc, int duty_cycle, bool isOFDM,
3716 		   bool writeToShm)
3717 {
3718 	int idle_busy_ratio_x_16 = 0;
3719 	uint offset =
3720 	    isOFDM ? M_TX_IDLE_BUSY_RATIO_X_16_OFDM :
3721 	    M_TX_IDLE_BUSY_RATIO_X_16_CCK;
3722 	if (duty_cycle > 100 || duty_cycle < 0) {
3723 		brcms_err(wlc->hw->d11core,
3724 			  "wl%d:  duty cycle value off limit\n",
3725 			  wlc->pub->unit);
3726 		return -EINVAL;
3727 	}
3728 	if (duty_cycle)
3729 		idle_busy_ratio_x_16 = (100 - duty_cycle) * 16 / duty_cycle;
3730 	/* Only write to shared memory  when wl is up */
3731 	if (writeToShm)
3732 		brcms_b_write_shm(wlc->hw, offset, (u16) idle_busy_ratio_x_16);
3733 
3734 	if (isOFDM)
3735 		wlc->tx_duty_cycle_ofdm = (u16) duty_cycle;
3736 	else
3737 		wlc->tx_duty_cycle_cck = (u16) duty_cycle;
3738 
3739 	return 0;
3740 }
3741 
3742 /* push sw hps and wake state through hardware */
3743 static void brcms_c_set_ps_ctrl(struct brcms_c_info *wlc)
3744 {
3745 	u32 v1, v2;
3746 	bool hps;
3747 	bool awake_before;
3748 
3749 	hps = brcms_c_ps_allowed(wlc);
3750 
3751 	brcms_dbg_mac80211(wlc->hw->d11core, "wl%d: hps %d\n", wlc->pub->unit,
3752 			   hps);
3753 
3754 	v1 = bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
3755 	v2 = MCTL_WAKE;
3756 	if (hps)
3757 		v2 |= MCTL_HPS;
3758 
3759 	brcms_b_mctrl(wlc->hw, MCTL_WAKE | MCTL_HPS, v2);
3760 
3761 	awake_before = ((v1 & MCTL_WAKE) || ((v1 & MCTL_HPS) == 0));
3762 
3763 	if (!awake_before)
3764 		brcms_b_wait_for_wake(wlc->hw);
3765 }
3766 
3767 /*
3768  * Write this BSS config's MAC address to core.
3769  * Updates RXE match engine.
3770  */
3771 static int brcms_c_set_mac(struct brcms_bss_cfg *bsscfg)
3772 {
3773 	int err = 0;
3774 	struct brcms_c_info *wlc = bsscfg->wlc;
3775 
3776 	/* enter the MAC addr into the RXE match registers */
3777 	brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, wlc->pub->cur_etheraddr);
3778 
3779 	brcms_c_ampdu_macaddr_upd(wlc);
3780 
3781 	return err;
3782 }
3783 
3784 /* Write the BSS config's BSSID address to core (set_bssid in d11procs.tcl).
3785  * Updates RXE match engine.
3786  */
3787 static void brcms_c_set_bssid(struct brcms_bss_cfg *bsscfg)
3788 {
3789 	/* we need to update BSSID in RXE match registers */
3790 	brcms_c_set_addrmatch(bsscfg->wlc, RCM_BSSID_OFFSET, bsscfg->BSSID);
3791 }
3792 
3793 void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid, size_t ssid_len)
3794 {
3795 	u8 len = min_t(u8, sizeof(wlc->bsscfg->SSID), ssid_len);
3796 	memset(wlc->bsscfg->SSID, 0, sizeof(wlc->bsscfg->SSID));
3797 
3798 	memcpy(wlc->bsscfg->SSID, ssid, len);
3799 	wlc->bsscfg->SSID_len = len;
3800 }
3801 
3802 static void brcms_b_set_shortslot(struct brcms_hardware *wlc_hw, bool shortslot)
3803 {
3804 	wlc_hw->shortslot = shortslot;
3805 
3806 	if (wlc_hw->band->bandtype == BRCM_BAND_2G && wlc_hw->up) {
3807 		brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
3808 		brcms_b_update_slot_timing(wlc_hw, shortslot);
3809 		brcms_c_enable_mac(wlc_hw->wlc);
3810 	}
3811 }
3812 
3813 /*
3814  * Suspend the the MAC and update the slot timing
3815  * for standard 11b/g (20us slots) or shortslot 11g (9us slots).
3816  */
3817 static void brcms_c_switch_shortslot(struct brcms_c_info *wlc, bool shortslot)
3818 {
3819 	/* use the override if it is set */
3820 	if (wlc->shortslot_override != BRCMS_SHORTSLOT_AUTO)
3821 		shortslot = (wlc->shortslot_override == BRCMS_SHORTSLOT_ON);
3822 
3823 	if (wlc->shortslot == shortslot)
3824 		return;
3825 
3826 	wlc->shortslot = shortslot;
3827 
3828 	brcms_b_set_shortslot(wlc->hw, shortslot);
3829 }
3830 
3831 static void brcms_c_set_home_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3832 {
3833 	if (wlc->home_chanspec != chanspec) {
3834 		wlc->home_chanspec = chanspec;
3835 
3836 		if (wlc->pub->associated)
3837 			wlc->bsscfg->current_bss->chanspec = chanspec;
3838 	}
3839 }
3840 
3841 void
3842 brcms_b_set_chanspec(struct brcms_hardware *wlc_hw, u16 chanspec,
3843 		      bool mute_tx, struct txpwr_limits *txpwr)
3844 {
3845 	uint bandunit;
3846 
3847 	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: 0x%x\n", wlc_hw->unit,
3848 			   chanspec);
3849 
3850 	wlc_hw->chanspec = chanspec;
3851 
3852 	/* Switch bands if necessary */
3853 	if (wlc_hw->_nbands > 1) {
3854 		bandunit = chspec_bandunit(chanspec);
3855 		if (wlc_hw->band->bandunit != bandunit) {
3856 			/* brcms_b_setband disables other bandunit,
3857 			 *  use light band switch if not up yet
3858 			 */
3859 			if (wlc_hw->up) {
3860 				wlc_phy_chanspec_radio_set(wlc_hw->
3861 							   bandstate[bandunit]->
3862 							   pi, chanspec);
3863 				brcms_b_setband(wlc_hw, bandunit, chanspec);
3864 			} else {
3865 				brcms_c_setxband(wlc_hw, bandunit);
3866 			}
3867 		}
3868 	}
3869 
3870 	wlc_phy_initcal_enable(wlc_hw->band->pi, !mute_tx);
3871 
3872 	if (!wlc_hw->up) {
3873 		if (wlc_hw->clk)
3874 			wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr,
3875 						  chanspec);
3876 		wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3877 	} else {
3878 		wlc_phy_chanspec_set(wlc_hw->band->pi, chanspec);
3879 		wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr, chanspec);
3880 
3881 		/* Update muting of the channel */
3882 		brcms_b_mute(wlc_hw, mute_tx);
3883 	}
3884 }
3885 
3886 /* switch to and initialize new band */
3887 static void brcms_c_setband(struct brcms_c_info *wlc,
3888 					   uint bandunit)
3889 {
3890 	wlc->band = wlc->bandstate[bandunit];
3891 
3892 	if (!wlc->pub->up)
3893 		return;
3894 
3895 	/* wait for at least one beacon before entering sleeping state */
3896 	brcms_c_set_ps_ctrl(wlc);
3897 
3898 	/* band-specific initializations */
3899 	brcms_c_bsinit(wlc);
3900 }
3901 
3902 static void brcms_c_set_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3903 {
3904 	uint bandunit;
3905 	bool switchband = false;
3906 	u16 old_chanspec = wlc->chanspec;
3907 
3908 	if (!brcms_c_valid_chanspec_db(wlc->cmi, chanspec)) {
3909 		brcms_err(wlc->hw->d11core, "wl%d: %s: Bad channel %d\n",
3910 			  wlc->pub->unit, __func__, CHSPEC_CHANNEL(chanspec));
3911 		return;
3912 	}
3913 
3914 	/* Switch bands if necessary */
3915 	if (wlc->pub->_nbands > 1) {
3916 		bandunit = chspec_bandunit(chanspec);
3917 		if (wlc->band->bandunit != bandunit || wlc->bandinit_pending) {
3918 			switchband = true;
3919 			if (wlc->bandlocked) {
3920 				brcms_err(wlc->hw->d11core,
3921 					  "wl%d: %s: chspec %d band is locked!\n",
3922 					  wlc->pub->unit, __func__,
3923 					  CHSPEC_CHANNEL(chanspec));
3924 				return;
3925 			}
3926 			/*
3927 			 * should the setband call come after the
3928 			 * brcms_b_chanspec() ? if the setband updates
3929 			 * (brcms_c_bsinit) use low level calls to inspect and
3930 			 * set state, the state inspected may be from the wrong
3931 			 * band, or the following brcms_b_set_chanspec() may
3932 			 * undo the work.
3933 			 */
3934 			brcms_c_setband(wlc, bandunit);
3935 		}
3936 	}
3937 
3938 	/* sync up phy/radio chanspec */
3939 	brcms_c_set_phy_chanspec(wlc, chanspec);
3940 
3941 	/* init antenna selection */
3942 	if (brcms_chspec_bw(old_chanspec) != brcms_chspec_bw(chanspec)) {
3943 		brcms_c_antsel_init(wlc->asi);
3944 
3945 		/* Fix the hardware rateset based on bw.
3946 		 * Mainly add MCS32 for 40Mhz, remove MCS 32 for 20Mhz
3947 		 */
3948 		brcms_c_rateset_bw_mcs_filter(&wlc->band->hw_rateset,
3949 			wlc->band->mimo_cap_40 ? brcms_chspec_bw(chanspec) : 0);
3950 	}
3951 
3952 	/* update some mac configuration since chanspec changed */
3953 	brcms_c_ucode_mac_upd(wlc);
3954 }
3955 
3956 /*
3957  * This function changes the phytxctl for beacon based on current
3958  * beacon ratespec AND txant setting as per this table:
3959  *  ratespec     CCK		ant = wlc->stf->txant
3960  *		OFDM		ant = 3
3961  */
3962 void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc,
3963 				       u32 bcn_rspec)
3964 {
3965 	u16 phyctl;
3966 	u16 phytxant = wlc->stf->phytxant;
3967 	u16 mask = PHY_TXC_ANT_MASK;
3968 
3969 	/* for non-siso rates or default setting, use the available chains */
3970 	if (BRCMS_PHY_11N_CAP(wlc->band))
3971 		phytxant = brcms_c_stf_phytxchain_sel(wlc, bcn_rspec);
3972 
3973 	phyctl = brcms_b_read_shm(wlc->hw, M_BCN_PCTLWD);
3974 	phyctl = (phyctl & ~mask) | phytxant;
3975 	brcms_b_write_shm(wlc->hw, M_BCN_PCTLWD, phyctl);
3976 }
3977 
3978 /*
3979  * centralized protection config change function to simplify debugging, no
3980  * consistency checking this should be called only on changes to avoid overhead
3981  * in periodic function
3982  */
3983 void brcms_c_protection_upd(struct brcms_c_info *wlc, uint idx, int val)
3984 {
3985 	/*
3986 	 * Cannot use brcms_dbg_* here because this function is called
3987 	 * before wlc is sufficiently initialized.
3988 	 */
3989 	BCMMSG(wlc->wiphy, "idx %d, val %d\n", idx, val);
3990 
3991 	switch (idx) {
3992 	case BRCMS_PROT_G_SPEC:
3993 		wlc->protection->_g = (bool) val;
3994 		break;
3995 	case BRCMS_PROT_G_OVR:
3996 		wlc->protection->g_override = (s8) val;
3997 		break;
3998 	case BRCMS_PROT_G_USER:
3999 		wlc->protection->gmode_user = (u8) val;
4000 		break;
4001 	case BRCMS_PROT_OVERLAP:
4002 		wlc->protection->overlap = (s8) val;
4003 		break;
4004 	case BRCMS_PROT_N_USER:
4005 		wlc->protection->nmode_user = (s8) val;
4006 		break;
4007 	case BRCMS_PROT_N_CFG:
4008 		wlc->protection->n_cfg = (s8) val;
4009 		break;
4010 	case BRCMS_PROT_N_CFG_OVR:
4011 		wlc->protection->n_cfg_override = (s8) val;
4012 		break;
4013 	case BRCMS_PROT_N_NONGF:
4014 		wlc->protection->nongf = (bool) val;
4015 		break;
4016 	case BRCMS_PROT_N_NONGF_OVR:
4017 		wlc->protection->nongf_override = (s8) val;
4018 		break;
4019 	case BRCMS_PROT_N_PAM_OVR:
4020 		wlc->protection->n_pam_override = (s8) val;
4021 		break;
4022 	case BRCMS_PROT_N_OBSS:
4023 		wlc->protection->n_obss = (bool) val;
4024 		break;
4025 
4026 	default:
4027 		break;
4028 	}
4029 
4030 }
4031 
4032 static void brcms_c_ht_update_sgi_rx(struct brcms_c_info *wlc, int val)
4033 {
4034 	if (wlc->pub->up) {
4035 		brcms_c_update_beacon(wlc);
4036 		brcms_c_update_probe_resp(wlc, true);
4037 	}
4038 }
4039 
4040 static void brcms_c_ht_update_ldpc(struct brcms_c_info *wlc, s8 val)
4041 {
4042 	wlc->stf->ldpc = val;
4043 
4044 	if (wlc->pub->up) {
4045 		brcms_c_update_beacon(wlc);
4046 		brcms_c_update_probe_resp(wlc, true);
4047 		wlc_phy_ldpc_override_set(wlc->band->pi, (val ? true : false));
4048 	}
4049 }
4050 
4051 void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
4052 		       const struct ieee80211_tx_queue_params *params,
4053 		       bool suspend)
4054 {
4055 	int i;
4056 	struct shm_acparams acp_shm;
4057 	u16 *shm_entry;
4058 
4059 	/* Only apply params if the core is out of reset and has clocks */
4060 	if (!wlc->clk) {
4061 		brcms_err(wlc->hw->d11core, "wl%d: %s : no-clock\n",
4062 			  wlc->pub->unit, __func__);
4063 		return;
4064 	}
4065 
4066 	memset(&acp_shm, 0, sizeof(struct shm_acparams));
4067 	/* fill in shm ac params struct */
4068 	acp_shm.txop = params->txop;
4069 	/* convert from units of 32us to us for ucode */
4070 	wlc->edcf_txop[aci & 0x3] = acp_shm.txop =
4071 	    EDCF_TXOP2USEC(acp_shm.txop);
4072 	acp_shm.aifs = (params->aifs & EDCF_AIFSN_MASK);
4073 
4074 	if (aci == IEEE80211_AC_VI && acp_shm.txop == 0
4075 	    && acp_shm.aifs < EDCF_AIFSN_MAX)
4076 		acp_shm.aifs++;
4077 
4078 	if (acp_shm.aifs < EDCF_AIFSN_MIN
4079 	    || acp_shm.aifs > EDCF_AIFSN_MAX) {
4080 		brcms_err(wlc->hw->d11core, "wl%d: edcf_setparams: bad "
4081 			  "aifs %d\n", wlc->pub->unit, acp_shm.aifs);
4082 	} else {
4083 		acp_shm.cwmin = params->cw_min;
4084 		acp_shm.cwmax = params->cw_max;
4085 		acp_shm.cwcur = acp_shm.cwmin;
4086 		acp_shm.bslots =
4087 			bcma_read16(wlc->hw->d11core, D11REGOFFS(tsf_random)) &
4088 			acp_shm.cwcur;
4089 		acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
4090 		/* Indicate the new params to the ucode */
4091 		acp_shm.status = brcms_b_read_shm(wlc->hw, (M_EDCF_QINFO +
4092 						  wme_ac2fifo[aci] *
4093 						  M_EDCF_QLEN +
4094 						  M_EDCF_STATUS_OFF));
4095 		acp_shm.status |= WME_STATUS_NEWAC;
4096 
4097 		/* Fill in shm acparam table */
4098 		shm_entry = (u16 *) &acp_shm;
4099 		for (i = 0; i < (int)sizeof(struct shm_acparams); i += 2)
4100 			brcms_b_write_shm(wlc->hw,
4101 					  M_EDCF_QINFO +
4102 					  wme_ac2fifo[aci] * M_EDCF_QLEN + i,
4103 					  *shm_entry++);
4104 	}
4105 
4106 	if (suspend)
4107 		brcms_c_suspend_mac_and_wait(wlc);
4108 
4109 	brcms_c_update_beacon(wlc);
4110 	brcms_c_update_probe_resp(wlc, false);
4111 
4112 	if (suspend)
4113 		brcms_c_enable_mac(wlc);
4114 }
4115 
4116 static void brcms_c_edcf_setparams(struct brcms_c_info *wlc, bool suspend)
4117 {
4118 	u16 aci;
4119 	int i_ac;
4120 	struct ieee80211_tx_queue_params txq_pars;
4121 	static const struct edcf_acparam default_edcf_acparams[] = {
4122 		 {EDCF_AC_BE_ACI_STA, EDCF_AC_BE_ECW_STA, EDCF_AC_BE_TXOP_STA},
4123 		 {EDCF_AC_BK_ACI_STA, EDCF_AC_BK_ECW_STA, EDCF_AC_BK_TXOP_STA},
4124 		 {EDCF_AC_VI_ACI_STA, EDCF_AC_VI_ECW_STA, EDCF_AC_VI_TXOP_STA},
4125 		 {EDCF_AC_VO_ACI_STA, EDCF_AC_VO_ECW_STA, EDCF_AC_VO_TXOP_STA}
4126 	}; /* ucode needs these parameters during its initialization */
4127 	const struct edcf_acparam *edcf_acp = &default_edcf_acparams[0];
4128 
4129 	for (i_ac = 0; i_ac < IEEE80211_NUM_ACS; i_ac++, edcf_acp++) {
4130 		/* find out which ac this set of params applies to */
4131 		aci = (edcf_acp->ACI & EDCF_ACI_MASK) >> EDCF_ACI_SHIFT;
4132 
4133 		/* fill in shm ac params struct */
4134 		txq_pars.txop = edcf_acp->TXOP;
4135 		txq_pars.aifs = edcf_acp->ACI;
4136 
4137 		/* CWmin = 2^(ECWmin) - 1 */
4138 		txq_pars.cw_min = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
4139 		/* CWmax = 2^(ECWmax) - 1 */
4140 		txq_pars.cw_max = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
4141 					    >> EDCF_ECWMAX_SHIFT);
4142 		brcms_c_wme_setparams(wlc, aci, &txq_pars, suspend);
4143 	}
4144 
4145 	if (suspend) {
4146 		brcms_c_suspend_mac_and_wait(wlc);
4147 		brcms_c_enable_mac(wlc);
4148 	}
4149 }
4150 
4151 static void brcms_c_radio_monitor_start(struct brcms_c_info *wlc)
4152 {
4153 	/* Don't start the timer if HWRADIO feature is disabled */
4154 	if (wlc->radio_monitor)
4155 		return;
4156 
4157 	wlc->radio_monitor = true;
4158 	brcms_b_pllreq(wlc->hw, true, BRCMS_PLLREQ_RADIO_MON);
4159 	brcms_add_timer(wlc->radio_timer, TIMER_INTERVAL_RADIOCHK, true);
4160 }
4161 
4162 static bool brcms_c_radio_monitor_stop(struct brcms_c_info *wlc)
4163 {
4164 	if (!wlc->radio_monitor)
4165 		return true;
4166 
4167 	wlc->radio_monitor = false;
4168 	brcms_b_pllreq(wlc->hw, false, BRCMS_PLLREQ_RADIO_MON);
4169 	return brcms_del_timer(wlc->radio_timer);
4170 }
4171 
4172 /* read hwdisable state and propagate to wlc flag */
4173 static void brcms_c_radio_hwdisable_upd(struct brcms_c_info *wlc)
4174 {
4175 	if (wlc->pub->hw_off)
4176 		return;
4177 
4178 	if (brcms_b_radio_read_hwdisabled(wlc->hw))
4179 		mboolset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4180 	else
4181 		mboolclr(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4182 }
4183 
4184 /* update hwradio status and return it */
4185 bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc)
4186 {
4187 	brcms_c_radio_hwdisable_upd(wlc);
4188 
4189 	return mboolisset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE) ?
4190 			true : false;
4191 }
4192 
4193 /* periodical query hw radio button while driver is "down" */
4194 static void brcms_c_radio_timer(void *arg)
4195 {
4196 	struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4197 
4198 	if (brcms_deviceremoved(wlc)) {
4199 		brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4200 			  wlc->pub->unit, __func__);
4201 		brcms_down(wlc->wl);
4202 		return;
4203 	}
4204 
4205 	brcms_c_radio_hwdisable_upd(wlc);
4206 }
4207 
4208 /* common low-level watchdog code */
4209 static void brcms_b_watchdog(struct brcms_c_info *wlc)
4210 {
4211 	struct brcms_hardware *wlc_hw = wlc->hw;
4212 
4213 	if (!wlc_hw->up)
4214 		return;
4215 
4216 	/* increment second count */
4217 	wlc_hw->now++;
4218 
4219 	/* Check for FIFO error interrupts */
4220 	brcms_b_fifoerrors(wlc_hw);
4221 
4222 	/* make sure RX dma has buffers */
4223 	dma_rxfill(wlc->hw->di[RX_FIFO]);
4224 
4225 	wlc_phy_watchdog(wlc_hw->band->pi);
4226 }
4227 
4228 /* common watchdog code */
4229 static void brcms_c_watchdog(struct brcms_c_info *wlc)
4230 {
4231 	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
4232 
4233 	if (!wlc->pub->up)
4234 		return;
4235 
4236 	if (brcms_deviceremoved(wlc)) {
4237 		brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4238 			  wlc->pub->unit, __func__);
4239 		brcms_down(wlc->wl);
4240 		return;
4241 	}
4242 
4243 	/* increment second count */
4244 	wlc->pub->now++;
4245 
4246 	brcms_c_radio_hwdisable_upd(wlc);
4247 	/* if radio is disable, driver may be down, quit here */
4248 	if (wlc->pub->radio_disabled)
4249 		return;
4250 
4251 	brcms_b_watchdog(wlc);
4252 
4253 	/*
4254 	 * occasionally sample mac stat counters to
4255 	 * detect 16-bit counter wrap
4256 	 */
4257 	if ((wlc->pub->now % SW_TIMER_MAC_STAT_UPD) == 0)
4258 		brcms_c_statsupd(wlc);
4259 
4260 	if (BRCMS_ISNPHY(wlc->band) &&
4261 	    ((wlc->pub->now - wlc->tempsense_lasttime) >=
4262 	     BRCMS_TEMPSENSE_PERIOD)) {
4263 		wlc->tempsense_lasttime = wlc->pub->now;
4264 		brcms_c_tempsense_upd(wlc);
4265 	}
4266 }
4267 
4268 static void brcms_c_watchdog_by_timer(void *arg)
4269 {
4270 	struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4271 
4272 	brcms_c_watchdog(wlc);
4273 }
4274 
4275 static bool brcms_c_timers_init(struct brcms_c_info *wlc, int unit)
4276 {
4277 	wlc->wdtimer = brcms_init_timer(wlc->wl, brcms_c_watchdog_by_timer,
4278 		wlc, "watchdog");
4279 	if (!wlc->wdtimer) {
4280 		wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for wdtimer "
4281 			  "failed\n", unit);
4282 		goto fail;
4283 	}
4284 
4285 	wlc->radio_timer = brcms_init_timer(wlc->wl, brcms_c_radio_timer,
4286 		wlc, "radio");
4287 	if (!wlc->radio_timer) {
4288 		wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for radio_timer "
4289 			  "failed\n", unit);
4290 		goto fail;
4291 	}
4292 
4293 	return true;
4294 
4295  fail:
4296 	return false;
4297 }
4298 
4299 /*
4300  * Initialize brcms_c_info default values ...
4301  * may get overrides later in this function
4302  */
4303 static void brcms_c_info_init(struct brcms_c_info *wlc, int unit)
4304 {
4305 	int i;
4306 
4307 	/* Save our copy of the chanspec */
4308 	wlc->chanspec = ch20mhz_chspec(1);
4309 
4310 	/* various 802.11g modes */
4311 	wlc->shortslot = false;
4312 	wlc->shortslot_override = BRCMS_SHORTSLOT_AUTO;
4313 
4314 	brcms_c_protection_upd(wlc, BRCMS_PROT_G_OVR, BRCMS_PROTECTION_AUTO);
4315 	brcms_c_protection_upd(wlc, BRCMS_PROT_G_SPEC, false);
4316 
4317 	brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG_OVR,
4318 			       BRCMS_PROTECTION_AUTO);
4319 	brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG, BRCMS_N_PROTECTION_OFF);
4320 	brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF_OVR,
4321 			       BRCMS_PROTECTION_AUTO);
4322 	brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF, false);
4323 	brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, AUTO);
4324 
4325 	brcms_c_protection_upd(wlc, BRCMS_PROT_OVERLAP,
4326 			       BRCMS_PROTECTION_CTL_OVERLAP);
4327 
4328 	/* 802.11g draft 4.0 NonERP elt advertisement */
4329 	wlc->include_legacy_erp = true;
4330 
4331 	wlc->stf->ant_rx_ovr = ANT_RX_DIV_DEF;
4332 	wlc->stf->txant = ANT_TX_DEF;
4333 
4334 	wlc->prb_resp_timeout = BRCMS_PRB_RESP_TIMEOUT;
4335 
4336 	wlc->usr_fragthresh = DOT11_DEFAULT_FRAG_LEN;
4337 	for (i = 0; i < NFIFO; i++)
4338 		wlc->fragthresh[i] = DOT11_DEFAULT_FRAG_LEN;
4339 	wlc->RTSThresh = DOT11_DEFAULT_RTS_LEN;
4340 
4341 	/* default rate fallback retry limits */
4342 	wlc->SFBL = RETRY_SHORT_FB;
4343 	wlc->LFBL = RETRY_LONG_FB;
4344 
4345 	/* default mac retry limits */
4346 	wlc->SRL = RETRY_SHORT_DEF;
4347 	wlc->LRL = RETRY_LONG_DEF;
4348 
4349 	/* WME QoS mode is Auto by default */
4350 	wlc->pub->_ampdu = AMPDU_AGG_HOST;
4351 }
4352 
4353 static uint brcms_c_attach_module(struct brcms_c_info *wlc)
4354 {
4355 	uint err = 0;
4356 	uint unit;
4357 	unit = wlc->pub->unit;
4358 
4359 	wlc->asi = brcms_c_antsel_attach(wlc);
4360 	if (wlc->asi == NULL) {
4361 		wiphy_err(wlc->wiphy, "wl%d: attach: antsel_attach "
4362 			  "failed\n", unit);
4363 		err = 44;
4364 		goto fail;
4365 	}
4366 
4367 	wlc->ampdu = brcms_c_ampdu_attach(wlc);
4368 	if (wlc->ampdu == NULL) {
4369 		wiphy_err(wlc->wiphy, "wl%d: attach: ampdu_attach "
4370 			  "failed\n", unit);
4371 		err = 50;
4372 		goto fail;
4373 	}
4374 
4375 	if ((brcms_c_stf_attach(wlc) != 0)) {
4376 		wiphy_err(wlc->wiphy, "wl%d: attach: stf_attach "
4377 			  "failed\n", unit);
4378 		err = 68;
4379 		goto fail;
4380 	}
4381  fail:
4382 	return err;
4383 }
4384 
4385 struct brcms_pub *brcms_c_pub(struct brcms_c_info *wlc)
4386 {
4387 	return wlc->pub;
4388 }
4389 
4390 /* low level attach
4391  *    run backplane attach, init nvram
4392  *    run phy attach
4393  *    initialize software state for each core and band
4394  *    put the whole chip in reset(driver down state), no clock
4395  */
4396 static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
4397 			  uint unit, bool piomode)
4398 {
4399 	struct brcms_hardware *wlc_hw;
4400 	uint err = 0;
4401 	uint j;
4402 	bool wme = false;
4403 	struct shared_phy_params sha_params;
4404 	struct wiphy *wiphy = wlc->wiphy;
4405 	struct pci_dev *pcidev = core->bus->host_pci;
4406 	struct ssb_sprom *sprom = &core->bus->sprom;
4407 
4408 	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI)
4409 		brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4410 			       pcidev->vendor,
4411 			       pcidev->device);
4412 	else
4413 		brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4414 			       core->bus->boardinfo.vendor,
4415 			       core->bus->boardinfo.type);
4416 
4417 	wme = true;
4418 
4419 	wlc_hw = wlc->hw;
4420 	wlc_hw->wlc = wlc;
4421 	wlc_hw->unit = unit;
4422 	wlc_hw->band = wlc_hw->bandstate[0];
4423 	wlc_hw->_piomode = piomode;
4424 
4425 	/* populate struct brcms_hardware with default values  */
4426 	brcms_b_info_init(wlc_hw);
4427 
4428 	/*
4429 	 * Do the hardware portion of the attach. Also initialize software
4430 	 * state that depends on the particular hardware we are running.
4431 	 */
4432 	wlc_hw->sih = ai_attach(core->bus);
4433 	if (wlc_hw->sih == NULL) {
4434 		wiphy_err(wiphy, "wl%d: brcms_b_attach: si_attach failed\n",
4435 			  unit);
4436 		err = 11;
4437 		goto fail;
4438 	}
4439 
4440 	/* verify again the device is supported */
4441 	if (!brcms_c_chipmatch(core)) {
4442 		wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported device\n",
4443 			 unit);
4444 		err = 12;
4445 		goto fail;
4446 	}
4447 
4448 	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI) {
4449 		wlc_hw->vendorid = pcidev->vendor;
4450 		wlc_hw->deviceid = pcidev->device;
4451 	} else {
4452 		wlc_hw->vendorid = core->bus->boardinfo.vendor;
4453 		wlc_hw->deviceid = core->bus->boardinfo.type;
4454 	}
4455 
4456 	wlc_hw->d11core = core;
4457 	wlc_hw->corerev = core->id.rev;
4458 
4459 	/* validate chip, chiprev and corerev */
4460 	if (!brcms_c_isgoodchip(wlc_hw)) {
4461 		err = 13;
4462 		goto fail;
4463 	}
4464 
4465 	/* initialize power control registers */
4466 	ai_clkctl_init(wlc_hw->sih);
4467 
4468 	/* request fastclock and force fastclock for the rest of attach
4469 	 * bring the d11 core out of reset.
4470 	 *   For PMU chips, the first wlc_clkctl_clk is no-op since core-clk
4471 	 *   is still false; But it will be called again inside wlc_corereset,
4472 	 *   after d11 is out of reset.
4473 	 */
4474 	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4475 	brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4476 
4477 	if (!brcms_b_validate_chip_access(wlc_hw)) {
4478 		wiphy_err(wiphy, "wl%d: brcms_b_attach: validate_chip_access "
4479 			"failed\n", unit);
4480 		err = 14;
4481 		goto fail;
4482 	}
4483 
4484 	/* get the board rev, used just below */
4485 	j = sprom->board_rev;
4486 	/* promote srom boardrev of 0xFF to 1 */
4487 	if (j == BOARDREV_PROMOTABLE)
4488 		j = BOARDREV_PROMOTED;
4489 	wlc_hw->boardrev = (u16) j;
4490 	if (!brcms_c_validboardtype(wlc_hw)) {
4491 		wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported Broadcom "
4492 			  "board type (0x%x)" " or revision level (0x%x)\n",
4493 			  unit, ai_get_boardtype(wlc_hw->sih),
4494 			  wlc_hw->boardrev);
4495 		err = 15;
4496 		goto fail;
4497 	}
4498 	wlc_hw->sromrev = sprom->revision;
4499 	wlc_hw->boardflags = sprom->boardflags_lo + (sprom->boardflags_hi << 16);
4500 	wlc_hw->boardflags2 = sprom->boardflags2_lo + (sprom->boardflags2_hi << 16);
4501 
4502 	if (wlc_hw->boardflags & BFL_NOPLLDOWN)
4503 		brcms_b_pllreq(wlc_hw, true, BRCMS_PLLREQ_SHARED);
4504 
4505 	/* check device id(srom, nvram etc.) to set bands */
4506 	if (wlc_hw->deviceid == BCM43224_D11N_ID ||
4507 	    wlc_hw->deviceid == BCM43224_D11N_ID_VEN1 ||
4508 	    wlc_hw->deviceid == BCM43224_CHIP_ID)
4509 		/* Dualband boards */
4510 		wlc_hw->_nbands = 2;
4511 	else
4512 		wlc_hw->_nbands = 1;
4513 
4514 	if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225))
4515 		wlc_hw->_nbands = 1;
4516 
4517 	/* BMAC_NOTE: remove init of pub values when brcms_c_attach()
4518 	 * unconditionally does the init of these values
4519 	 */
4520 	wlc->vendorid = wlc_hw->vendorid;
4521 	wlc->deviceid = wlc_hw->deviceid;
4522 	wlc->pub->sih = wlc_hw->sih;
4523 	wlc->pub->corerev = wlc_hw->corerev;
4524 	wlc->pub->sromrev = wlc_hw->sromrev;
4525 	wlc->pub->boardrev = wlc_hw->boardrev;
4526 	wlc->pub->boardflags = wlc_hw->boardflags;
4527 	wlc->pub->boardflags2 = wlc_hw->boardflags2;
4528 	wlc->pub->_nbands = wlc_hw->_nbands;
4529 
4530 	wlc_hw->physhim = wlc_phy_shim_attach(wlc_hw, wlc->wl, wlc);
4531 
4532 	if (wlc_hw->physhim == NULL) {
4533 		wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_shim_attach "
4534 			"failed\n", unit);
4535 		err = 25;
4536 		goto fail;
4537 	}
4538 
4539 	/* pass all the parameters to wlc_phy_shared_attach in one struct */
4540 	sha_params.sih = wlc_hw->sih;
4541 	sha_params.physhim = wlc_hw->physhim;
4542 	sha_params.unit = unit;
4543 	sha_params.corerev = wlc_hw->corerev;
4544 	sha_params.vid = wlc_hw->vendorid;
4545 	sha_params.did = wlc_hw->deviceid;
4546 	sha_params.chip = ai_get_chip_id(wlc_hw->sih);
4547 	sha_params.chiprev = ai_get_chiprev(wlc_hw->sih);
4548 	sha_params.chippkg = ai_get_chippkg(wlc_hw->sih);
4549 	sha_params.sromrev = wlc_hw->sromrev;
4550 	sha_params.boardtype = ai_get_boardtype(wlc_hw->sih);
4551 	sha_params.boardrev = wlc_hw->boardrev;
4552 	sha_params.boardflags = wlc_hw->boardflags;
4553 	sha_params.boardflags2 = wlc_hw->boardflags2;
4554 
4555 	/* alloc and save pointer to shared phy state area */
4556 	wlc_hw->phy_sh = wlc_phy_shared_attach(&sha_params);
4557 	if (!wlc_hw->phy_sh) {
4558 		err = 16;
4559 		goto fail;
4560 	}
4561 
4562 	/* initialize software state for each core and band */
4563 	for (j = 0; j < wlc_hw->_nbands; j++) {
4564 		/*
4565 		 * band0 is always 2.4Ghz
4566 		 * band1, if present, is 5Ghz
4567 		 */
4568 
4569 		brcms_c_setxband(wlc_hw, j);
4570 
4571 		wlc_hw->band->bandunit = j;
4572 		wlc_hw->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4573 		wlc->band->bandunit = j;
4574 		wlc->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4575 		wlc->core->coreidx = core->core_index;
4576 
4577 		wlc_hw->machwcap = bcma_read32(core, D11REGOFFS(machwcap));
4578 		wlc_hw->machwcap_backup = wlc_hw->machwcap;
4579 
4580 		/* init tx fifo size */
4581 		WARN_ON(wlc_hw->corerev < XMTFIFOTBL_STARTREV ||
4582 			(wlc_hw->corerev - XMTFIFOTBL_STARTREV) >
4583 				ARRAY_SIZE(xmtfifo_sz));
4584 		wlc_hw->xmtfifo_sz =
4585 		    xmtfifo_sz[(wlc_hw->corerev - XMTFIFOTBL_STARTREV)];
4586 		WARN_ON(!wlc_hw->xmtfifo_sz[0]);
4587 
4588 		/* Get a phy for this band */
4589 		wlc_hw->band->pi =
4590 			wlc_phy_attach(wlc_hw->phy_sh, core,
4591 				       wlc_hw->band->bandtype,
4592 				       wlc->wiphy);
4593 		if (wlc_hw->band->pi == NULL) {
4594 			wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_"
4595 				  "attach failed\n", unit);
4596 			err = 17;
4597 			goto fail;
4598 		}
4599 
4600 		wlc_phy_machwcap_set(wlc_hw->band->pi, wlc_hw->machwcap);
4601 
4602 		wlc_phy_get_phyversion(wlc_hw->band->pi, &wlc_hw->band->phytype,
4603 				       &wlc_hw->band->phyrev,
4604 				       &wlc_hw->band->radioid,
4605 				       &wlc_hw->band->radiorev);
4606 		wlc_hw->band->abgphy_encore =
4607 		    wlc_phy_get_encore(wlc_hw->band->pi);
4608 		wlc->band->abgphy_encore = wlc_phy_get_encore(wlc_hw->band->pi);
4609 		wlc_hw->band->core_flags =
4610 		    wlc_phy_get_coreflags(wlc_hw->band->pi);
4611 
4612 		/* verify good phy_type & supported phy revision */
4613 		if (BRCMS_ISNPHY(wlc_hw->band)) {
4614 			if (NCONF_HAS(wlc_hw->band->phyrev))
4615 				goto good_phy;
4616 			else
4617 				goto bad_phy;
4618 		} else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
4619 			if (LCNCONF_HAS(wlc_hw->band->phyrev))
4620 				goto good_phy;
4621 			else
4622 				goto bad_phy;
4623 		} else {
4624  bad_phy:
4625 			wiphy_err(wiphy, "wl%d: brcms_b_attach: unsupported "
4626 				  "phy type/rev (%d/%d)\n", unit,
4627 				  wlc_hw->band->phytype, wlc_hw->band->phyrev);
4628 			err = 18;
4629 			goto fail;
4630 		}
4631 
4632  good_phy:
4633 		/*
4634 		 * BMAC_NOTE: wlc->band->pi should not be set below and should
4635 		 * be done in the high level attach. However we can not make
4636 		 * that change until all low level access is changed to
4637 		 * wlc_hw->band->pi. Instead do the wlc->band->pi init below,
4638 		 * keeping wlc_hw->band->pi as well for incremental update of
4639 		 * low level fns, and cut over low only init when all fns
4640 		 * updated.
4641 		 */
4642 		wlc->band->pi = wlc_hw->band->pi;
4643 		wlc->band->phytype = wlc_hw->band->phytype;
4644 		wlc->band->phyrev = wlc_hw->band->phyrev;
4645 		wlc->band->radioid = wlc_hw->band->radioid;
4646 		wlc->band->radiorev = wlc_hw->band->radiorev;
4647 		brcms_dbg_info(core, "wl%d: phy %u/%u radio %x/%u\n", unit,
4648 			       wlc->band->phytype, wlc->band->phyrev,
4649 			       wlc->band->radioid, wlc->band->radiorev);
4650 		/* default contention windows size limits */
4651 		wlc_hw->band->CWmin = APHY_CWMIN;
4652 		wlc_hw->band->CWmax = PHY_CWMAX;
4653 
4654 		if (!brcms_b_attach_dmapio(wlc, j, wme)) {
4655 			err = 19;
4656 			goto fail;
4657 		}
4658 	}
4659 
4660 	/* disable core to match driver "down" state */
4661 	brcms_c_coredisable(wlc_hw);
4662 
4663 	/* Match driver "down" state */
4664 	bcma_host_pci_down(wlc_hw->d11core->bus);
4665 
4666 	/* turn off pll and xtal to match driver "down" state */
4667 	brcms_b_xtal(wlc_hw, OFF);
4668 
4669 	/* *******************************************************************
4670 	 * The hardware is in the DOWN state at this point. D11 core
4671 	 * or cores are in reset with clocks off, and the board PLLs
4672 	 * are off if possible.
4673 	 *
4674 	 * Beyond this point, wlc->sbclk == false and chip registers
4675 	 * should not be touched.
4676 	 *********************************************************************
4677 	 */
4678 
4679 	/* init etheraddr state variables */
4680 	brcms_c_get_macaddr(wlc_hw, wlc_hw->etheraddr);
4681 
4682 	if (is_broadcast_ether_addr(wlc_hw->etheraddr) ||
4683 	    is_zero_ether_addr(wlc_hw->etheraddr)) {
4684 		wiphy_err(wiphy, "wl%d: brcms_b_attach: bad macaddr\n",
4685 			  unit);
4686 		err = 22;
4687 		goto fail;
4688 	}
4689 
4690 	brcms_dbg_info(wlc_hw->d11core, "deviceid 0x%x nbands %d board 0x%x\n",
4691 		       wlc_hw->deviceid, wlc_hw->_nbands,
4692 		       ai_get_boardtype(wlc_hw->sih));
4693 
4694 	return err;
4695 
4696  fail:
4697 	wiphy_err(wiphy, "wl%d: brcms_b_attach: failed with err %d\n", unit,
4698 		  err);
4699 	return err;
4700 }
4701 
4702 static bool brcms_c_attach_stf_ant_init(struct brcms_c_info *wlc)
4703 {
4704 	int aa;
4705 	uint unit;
4706 	int bandtype;
4707 	struct ssb_sprom *sprom = &wlc->hw->d11core->bus->sprom;
4708 
4709 	unit = wlc->pub->unit;
4710 	bandtype = wlc->band->bandtype;
4711 
4712 	/* get antennas available */
4713 	if (bandtype == BRCM_BAND_5G)
4714 		aa = sprom->ant_available_a;
4715 	else
4716 		aa = sprom->ant_available_bg;
4717 
4718 	if ((aa < 1) || (aa > 15)) {
4719 		wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
4720 			  " srom (0x%x), using 3\n", unit, __func__, aa);
4721 		aa = 3;
4722 	}
4723 
4724 	/* reset the defaults if we have a single antenna */
4725 	if (aa == 1) {
4726 		wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_0;
4727 		wlc->stf->txant = ANT_TX_FORCE_0;
4728 	} else if (aa == 2) {
4729 		wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_1;
4730 		wlc->stf->txant = ANT_TX_FORCE_1;
4731 	} else {
4732 	}
4733 
4734 	/* Compute Antenna Gain */
4735 	if (bandtype == BRCM_BAND_5G)
4736 		wlc->band->antgain = sprom->antenna_gain.a1;
4737 	else
4738 		wlc->band->antgain = sprom->antenna_gain.a0;
4739 
4740 	return true;
4741 }
4742 
4743 static void brcms_c_bss_default_init(struct brcms_c_info *wlc)
4744 {
4745 	u16 chanspec;
4746 	struct brcms_band *band;
4747 	struct brcms_bss_info *bi = wlc->default_bss;
4748 
4749 	/* init default and target BSS with some sane initial values */
4750 	memset(bi, 0, sizeof(*bi));
4751 	bi->beacon_period = BEACON_INTERVAL_DEFAULT;
4752 
4753 	/* fill the default channel as the first valid channel
4754 	 * starting from the 2G channels
4755 	 */
4756 	chanspec = ch20mhz_chspec(1);
4757 	wlc->home_chanspec = bi->chanspec = chanspec;
4758 
4759 	/* find the band of our default channel */
4760 	band = wlc->band;
4761 	if (wlc->pub->_nbands > 1 &&
4762 	    band->bandunit != chspec_bandunit(chanspec))
4763 		band = wlc->bandstate[OTHERBANDUNIT(wlc)];
4764 
4765 	/* init bss rates to the band specific default rate set */
4766 	brcms_c_rateset_default(&bi->rateset, NULL, band->phytype,
4767 		band->bandtype, false, BRCMS_RATE_MASK_FULL,
4768 		(bool) (wlc->pub->_n_enab & SUPPORT_11N),
4769 		brcms_chspec_bw(chanspec), wlc->stf->txstreams);
4770 
4771 	if (wlc->pub->_n_enab & SUPPORT_11N)
4772 		bi->flags |= BRCMS_BSS_HT;
4773 }
4774 
4775 static void brcms_c_update_mimo_band_bwcap(struct brcms_c_info *wlc, u8 bwcap)
4776 {
4777 	uint i;
4778 	struct brcms_band *band;
4779 
4780 	for (i = 0; i < wlc->pub->_nbands; i++) {
4781 		band = wlc->bandstate[i];
4782 		if (band->bandtype == BRCM_BAND_5G) {
4783 			if ((bwcap == BRCMS_N_BW_40ALL)
4784 			    || (bwcap == BRCMS_N_BW_20IN2G_40IN5G))
4785 				band->mimo_cap_40 = true;
4786 			else
4787 				band->mimo_cap_40 = false;
4788 		} else {
4789 			if (bwcap == BRCMS_N_BW_40ALL)
4790 				band->mimo_cap_40 = true;
4791 			else
4792 				band->mimo_cap_40 = false;
4793 		}
4794 	}
4795 }
4796 
4797 static void brcms_c_timers_deinit(struct brcms_c_info *wlc)
4798 {
4799 	/* free timer state */
4800 	if (wlc->wdtimer) {
4801 		brcms_free_timer(wlc->wdtimer);
4802 		wlc->wdtimer = NULL;
4803 	}
4804 	if (wlc->radio_timer) {
4805 		brcms_free_timer(wlc->radio_timer);
4806 		wlc->radio_timer = NULL;
4807 	}
4808 }
4809 
4810 static void brcms_c_detach_module(struct brcms_c_info *wlc)
4811 {
4812 	if (wlc->asi) {
4813 		brcms_c_antsel_detach(wlc->asi);
4814 		wlc->asi = NULL;
4815 	}
4816 
4817 	if (wlc->ampdu) {
4818 		brcms_c_ampdu_detach(wlc->ampdu);
4819 		wlc->ampdu = NULL;
4820 	}
4821 
4822 	brcms_c_stf_detach(wlc);
4823 }
4824 
4825 /*
4826  * low level detach
4827  */
4828 static void brcms_b_detach(struct brcms_c_info *wlc)
4829 {
4830 	uint i;
4831 	struct brcms_hw_band *band;
4832 	struct brcms_hardware *wlc_hw = wlc->hw;
4833 
4834 	brcms_b_detach_dmapio(wlc_hw);
4835 
4836 	band = wlc_hw->band;
4837 	for (i = 0; i < wlc_hw->_nbands; i++) {
4838 		if (band->pi) {
4839 			/* Detach this band's phy */
4840 			wlc_phy_detach(band->pi);
4841 			band->pi = NULL;
4842 		}
4843 		band = wlc_hw->bandstate[OTHERBANDUNIT(wlc)];
4844 	}
4845 
4846 	/* Free shared phy state */
4847 	kfree(wlc_hw->phy_sh);
4848 
4849 	wlc_phy_shim_detach(wlc_hw->physhim);
4850 
4851 	if (wlc_hw->sih) {
4852 		ai_detach(wlc_hw->sih);
4853 		wlc_hw->sih = NULL;
4854 	}
4855 }
4856 
4857 /*
4858  * Return a count of the number of driver callbacks still pending.
4859  *
4860  * General policy is that brcms_c_detach can only dealloc/free software states.
4861  * It can NOT touch hardware registers since the d11core may be in reset and
4862  * clock may not be available.
4863  * One exception is sb register access, which is possible if crystal is turned
4864  * on after "down" state, driver should avoid software timer with the exception
4865  * of radio_monitor.
4866  */
4867 uint brcms_c_detach(struct brcms_c_info *wlc)
4868 {
4869 	uint callbacks;
4870 
4871 	if (wlc == NULL)
4872 		return 0;
4873 
4874 	brcms_b_detach(wlc);
4875 
4876 	/* delete software timers */
4877 	callbacks = 0;
4878 	if (!brcms_c_radio_monitor_stop(wlc))
4879 		callbacks++;
4880 
4881 	brcms_c_channel_mgr_detach(wlc->cmi);
4882 
4883 	brcms_c_timers_deinit(wlc);
4884 
4885 	brcms_c_detach_module(wlc);
4886 
4887 	brcms_c_detach_mfree(wlc);
4888 	return callbacks;
4889 }
4890 
4891 /* update state that depends on the current value of "ap" */
4892 static void brcms_c_ap_upd(struct brcms_c_info *wlc)
4893 {
4894 	/* STA-BSS; short capable */
4895 	wlc->PLCPHdr_override = BRCMS_PLCP_SHORT;
4896 }
4897 
4898 /* Initialize just the hardware when coming out of POR or S3/S5 system states */
4899 static void brcms_b_hw_up(struct brcms_hardware *wlc_hw)
4900 {
4901 	if (wlc_hw->wlc->pub->hw_up)
4902 		return;
4903 
4904 	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4905 
4906 	/*
4907 	 * Enable pll and xtal, initialize the power control registers,
4908 	 * and force fastclock for the remainder of brcms_c_up().
4909 	 */
4910 	brcms_b_xtal(wlc_hw, ON);
4911 	ai_clkctl_init(wlc_hw->sih);
4912 	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4913 
4914 	/*
4915 	 * TODO: test suspend/resume
4916 	 *
4917 	 * AI chip doesn't restore bar0win2 on
4918 	 * hibernation/resume, need sw fixup
4919 	 */
4920 
4921 	/*
4922 	 * Inform phy that a POR reset has occurred so
4923 	 * it does a complete phy init
4924 	 */
4925 	wlc_phy_por_inform(wlc_hw->band->pi);
4926 
4927 	wlc_hw->ucode_loaded = false;
4928 	wlc_hw->wlc->pub->hw_up = true;
4929 
4930 	if ((wlc_hw->boardflags & BFL_FEM)
4931 	    && (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
4932 		if (!
4933 		    (wlc_hw->boardrev >= 0x1250
4934 		     && (wlc_hw->boardflags & BFL_FEM_BT)))
4935 			ai_epa_4313war(wlc_hw->sih);
4936 	}
4937 }
4938 
4939 static int brcms_b_up_prep(struct brcms_hardware *wlc_hw)
4940 {
4941 	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4942 
4943 	/*
4944 	 * Enable pll and xtal, initialize the power control registers,
4945 	 * and force fastclock for the remainder of brcms_c_up().
4946 	 */
4947 	brcms_b_xtal(wlc_hw, ON);
4948 	ai_clkctl_init(wlc_hw->sih);
4949 	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4950 
4951 	/*
4952 	 * Configure pci/pcmcia here instead of in brcms_c_attach()
4953 	 * to allow mfg hotswap:  down, hotswap (chip power cycle), up.
4954 	 */
4955 	bcma_host_pci_irq_ctl(wlc_hw->d11core->bus, wlc_hw->d11core,
4956 			      true);
4957 
4958 	/*
4959 	 * Need to read the hwradio status here to cover the case where the
4960 	 * system is loaded with the hw radio disabled. We do not want to
4961 	 * bring the driver up in this case.
4962 	 */
4963 	if (brcms_b_radio_read_hwdisabled(wlc_hw)) {
4964 		/* put SB PCI in down state again */
4965 		bcma_host_pci_down(wlc_hw->d11core->bus);
4966 		brcms_b_xtal(wlc_hw, OFF);
4967 		return -ENOMEDIUM;
4968 	}
4969 
4970 	bcma_host_pci_up(wlc_hw->d11core->bus);
4971 
4972 	/* reset the d11 core */
4973 	brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4974 
4975 	return 0;
4976 }
4977 
4978 static int brcms_b_up_finish(struct brcms_hardware *wlc_hw)
4979 {
4980 	wlc_hw->up = true;
4981 	wlc_phy_hw_state_upd(wlc_hw->band->pi, true);
4982 
4983 	/* FULLY enable dynamic power control and d11 core interrupt */
4984 	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
4985 	brcms_intrson(wlc_hw->wlc->wl);
4986 	return 0;
4987 }
4988 
4989 /*
4990  * Write WME tunable parameters for retransmit/max rate
4991  * from wlc struct to ucode
4992  */
4993 static void brcms_c_wme_retries_write(struct brcms_c_info *wlc)
4994 {
4995 	int ac;
4996 
4997 	/* Need clock to do this */
4998 	if (!wlc->clk)
4999 		return;
5000 
5001 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
5002 		brcms_b_write_shm(wlc->hw, M_AC_TXLMT_ADDR(ac),
5003 				  wlc->wme_retries[ac]);
5004 }
5005 
5006 /* make interface operational */
5007 int brcms_c_up(struct brcms_c_info *wlc)
5008 {
5009 	struct ieee80211_channel *ch;
5010 
5011 	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5012 
5013 	/* HW is turned off so don't try to access it */
5014 	if (wlc->pub->hw_off || brcms_deviceremoved(wlc))
5015 		return -ENOMEDIUM;
5016 
5017 	if (!wlc->pub->hw_up) {
5018 		brcms_b_hw_up(wlc->hw);
5019 		wlc->pub->hw_up = true;
5020 	}
5021 
5022 	if ((wlc->pub->boardflags & BFL_FEM)
5023 	    && (ai_get_chip_id(wlc->hw->sih) == BCMA_CHIP_ID_BCM4313)) {
5024 		if (wlc->pub->boardrev >= 0x1250
5025 		    && (wlc->pub->boardflags & BFL_FEM_BT))
5026 			brcms_b_mhf(wlc->hw, MHF5, MHF5_4313_GPIOCTRL,
5027 				MHF5_4313_GPIOCTRL, BRCM_BAND_ALL);
5028 		else
5029 			brcms_b_mhf(wlc->hw, MHF4, MHF4_EXTPA_ENABLE,
5030 				    MHF4_EXTPA_ENABLE, BRCM_BAND_ALL);
5031 	}
5032 
5033 	/*
5034 	 * Need to read the hwradio status here to cover the case where the
5035 	 * system is loaded with the hw radio disabled. We do not want to bring
5036 	 * the driver up in this case. If radio is disabled, abort up, lower
5037 	 * power, start radio timer and return 0(for NDIS) don't call
5038 	 * radio_update to avoid looping brcms_c_up.
5039 	 *
5040 	 * brcms_b_up_prep() returns either 0 or -BCME_RADIOOFF only
5041 	 */
5042 	if (!wlc->pub->radio_disabled) {
5043 		int status = brcms_b_up_prep(wlc->hw);
5044 		if (status == -ENOMEDIUM) {
5045 			if (!mboolisset
5046 			    (wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE)) {
5047 				struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
5048 				mboolset(wlc->pub->radio_disabled,
5049 					 WL_RADIO_HW_DISABLE);
5050 				if (bsscfg->type == BRCMS_TYPE_STATION ||
5051 				    bsscfg->type == BRCMS_TYPE_ADHOC)
5052 					brcms_err(wlc->hw->d11core,
5053 						  "wl%d: up: rfdisable -> "
5054 						  "bsscfg_disable()\n",
5055 						   wlc->pub->unit);
5056 			}
5057 		}
5058 	}
5059 
5060 	if (wlc->pub->radio_disabled) {
5061 		brcms_c_radio_monitor_start(wlc);
5062 		return 0;
5063 	}
5064 
5065 	/* brcms_b_up_prep has done brcms_c_corereset(). so clk is on, set it */
5066 	wlc->clk = true;
5067 
5068 	brcms_c_radio_monitor_stop(wlc);
5069 
5070 	/* Set EDCF hostflags */
5071 	brcms_b_mhf(wlc->hw, MHF1, MHF1_EDCF, MHF1_EDCF, BRCM_BAND_ALL);
5072 
5073 	brcms_init(wlc->wl);
5074 	wlc->pub->up = true;
5075 
5076 	if (wlc->bandinit_pending) {
5077 		ch = wlc->pub->ieee_hw->conf.chandef.chan;
5078 		brcms_c_suspend_mac_and_wait(wlc);
5079 		brcms_c_set_chanspec(wlc, ch20mhz_chspec(ch->hw_value));
5080 		wlc->bandinit_pending = false;
5081 		brcms_c_enable_mac(wlc);
5082 	}
5083 
5084 	brcms_b_up_finish(wlc->hw);
5085 
5086 	/* Program the TX wme params with the current settings */
5087 	brcms_c_wme_retries_write(wlc);
5088 
5089 	/* start one second watchdog timer */
5090 	brcms_add_timer(wlc->wdtimer, TIMER_INTERVAL_WATCHDOG, true);
5091 	wlc->WDarmed = true;
5092 
5093 	/* ensure antenna config is up to date */
5094 	brcms_c_stf_phy_txant_upd(wlc);
5095 	/* ensure LDPC config is in sync */
5096 	brcms_c_ht_update_ldpc(wlc, wlc->stf->ldpc);
5097 
5098 	return 0;
5099 }
5100 
5101 static uint brcms_c_down_del_timer(struct brcms_c_info *wlc)
5102 {
5103 	uint callbacks = 0;
5104 
5105 	return callbacks;
5106 }
5107 
5108 static int brcms_b_bmac_down_prep(struct brcms_hardware *wlc_hw)
5109 {
5110 	bool dev_gone;
5111 	uint callbacks = 0;
5112 
5113 	if (!wlc_hw->up)
5114 		return callbacks;
5115 
5116 	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5117 
5118 	/* disable interrupts */
5119 	if (dev_gone)
5120 		wlc_hw->wlc->macintmask = 0;
5121 	else {
5122 		/* now disable interrupts */
5123 		brcms_intrsoff(wlc_hw->wlc->wl);
5124 
5125 		/* ensure we're running on the pll clock again */
5126 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
5127 	}
5128 	/* down phy at the last of this stage */
5129 	callbacks += wlc_phy_down(wlc_hw->band->pi);
5130 
5131 	return callbacks;
5132 }
5133 
5134 static int brcms_b_down_finish(struct brcms_hardware *wlc_hw)
5135 {
5136 	uint callbacks = 0;
5137 	bool dev_gone;
5138 
5139 	if (!wlc_hw->up)
5140 		return callbacks;
5141 
5142 	wlc_hw->up = false;
5143 	wlc_phy_hw_state_upd(wlc_hw->band->pi, false);
5144 
5145 	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5146 
5147 	if (dev_gone) {
5148 		wlc_hw->sbclk = false;
5149 		wlc_hw->clk = false;
5150 		wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
5151 
5152 		/* reclaim any posted packets */
5153 		brcms_c_flushqueues(wlc_hw->wlc);
5154 	} else {
5155 
5156 		/* Reset and disable the core */
5157 		if (bcma_core_is_enabled(wlc_hw->d11core)) {
5158 			if (bcma_read32(wlc_hw->d11core,
5159 					D11REGOFFS(maccontrol)) & MCTL_EN_MAC)
5160 				brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
5161 			callbacks += brcms_reset(wlc_hw->wlc->wl);
5162 			brcms_c_coredisable(wlc_hw);
5163 		}
5164 
5165 		/* turn off primary xtal and pll */
5166 		if (!wlc_hw->noreset) {
5167 			bcma_host_pci_down(wlc_hw->d11core->bus);
5168 			brcms_b_xtal(wlc_hw, OFF);
5169 		}
5170 	}
5171 
5172 	return callbacks;
5173 }
5174 
5175 /*
5176  * Mark the interface nonoperational, stop the software mechanisms,
5177  * disable the hardware, free any transient buffer state.
5178  * Return a count of the number of driver callbacks still pending.
5179  */
5180 uint brcms_c_down(struct brcms_c_info *wlc)
5181 {
5182 
5183 	uint callbacks = 0;
5184 	int i;
5185 	bool dev_gone = false;
5186 
5187 	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5188 
5189 	/* check if we are already in the going down path */
5190 	if (wlc->going_down) {
5191 		brcms_err(wlc->hw->d11core,
5192 			  "wl%d: %s: Driver going down so return\n",
5193 			  wlc->pub->unit, __func__);
5194 		return 0;
5195 	}
5196 	if (!wlc->pub->up)
5197 		return callbacks;
5198 
5199 	wlc->going_down = true;
5200 
5201 	callbacks += brcms_b_bmac_down_prep(wlc->hw);
5202 
5203 	dev_gone = brcms_deviceremoved(wlc);
5204 
5205 	/* Call any registered down handlers */
5206 	for (i = 0; i < BRCMS_MAXMODULES; i++) {
5207 		if (wlc->modulecb[i].down_fn)
5208 			callbacks +=
5209 			    wlc->modulecb[i].down_fn(wlc->modulecb[i].hdl);
5210 	}
5211 
5212 	/* cancel the watchdog timer */
5213 	if (wlc->WDarmed) {
5214 		if (!brcms_del_timer(wlc->wdtimer))
5215 			callbacks++;
5216 		wlc->WDarmed = false;
5217 	}
5218 	/* cancel all other timers */
5219 	callbacks += brcms_c_down_del_timer(wlc);
5220 
5221 	wlc->pub->up = false;
5222 
5223 	wlc_phy_mute_upd(wlc->band->pi, false, PHY_MUTE_ALL);
5224 
5225 	callbacks += brcms_b_down_finish(wlc->hw);
5226 
5227 	/* brcms_b_down_finish has done brcms_c_coredisable(). so clk is off */
5228 	wlc->clk = false;
5229 
5230 	wlc->going_down = false;
5231 	return callbacks;
5232 }
5233 
5234 /* Set the current gmode configuration */
5235 int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config)
5236 {
5237 	int ret = 0;
5238 	uint i;
5239 	struct brcms_c_rateset rs;
5240 	/* Default to 54g Auto */
5241 	/* Advertise and use shortslot (-1/0/1 Auto/Off/On) */
5242 	s8 shortslot = BRCMS_SHORTSLOT_AUTO;
5243 	bool ofdm_basic = false;	/* Make 6, 12, and 24 basic rates */
5244 	struct brcms_band *band;
5245 
5246 	/* if N-support is enabled, allow Gmode set as long as requested
5247 	 * Gmode is not GMODE_LEGACY_B
5248 	 */
5249 	if ((wlc->pub->_n_enab & SUPPORT_11N) && gmode == GMODE_LEGACY_B)
5250 		return -ENOTSUPP;
5251 
5252 	/* verify that we are dealing with 2G band and grab the band pointer */
5253 	if (wlc->band->bandtype == BRCM_BAND_2G)
5254 		band = wlc->band;
5255 	else if ((wlc->pub->_nbands > 1) &&
5256 		 (wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype == BRCM_BAND_2G))
5257 		band = wlc->bandstate[OTHERBANDUNIT(wlc)];
5258 	else
5259 		return -EINVAL;
5260 
5261 	/* update configuration value */
5262 	if (config)
5263 		brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER, gmode);
5264 
5265 	/* Clear rateset override */
5266 	memset(&rs, 0, sizeof(rs));
5267 
5268 	switch (gmode) {
5269 	case GMODE_LEGACY_B:
5270 		shortslot = BRCMS_SHORTSLOT_OFF;
5271 		brcms_c_rateset_copy(&gphy_legacy_rates, &rs);
5272 
5273 		break;
5274 
5275 	case GMODE_LRS:
5276 		break;
5277 
5278 	case GMODE_AUTO:
5279 		/* Accept defaults */
5280 		break;
5281 
5282 	case GMODE_ONLY:
5283 		ofdm_basic = true;
5284 		break;
5285 
5286 	case GMODE_PERFORMANCE:
5287 		shortslot = BRCMS_SHORTSLOT_ON;
5288 		ofdm_basic = true;
5289 		break;
5290 
5291 	default:
5292 		/* Error */
5293 		brcms_err(wlc->hw->d11core, "wl%d: %s: invalid gmode %d\n",
5294 			  wlc->pub->unit, __func__, gmode);
5295 		return -ENOTSUPP;
5296 	}
5297 
5298 	band->gmode = gmode;
5299 
5300 	wlc->shortslot_override = shortslot;
5301 
5302 	/* Use the default 11g rateset */
5303 	if (!rs.count)
5304 		brcms_c_rateset_copy(&cck_ofdm_rates, &rs);
5305 
5306 	if (ofdm_basic) {
5307 		for (i = 0; i < rs.count; i++) {
5308 			if (rs.rates[i] == BRCM_RATE_6M
5309 			    || rs.rates[i] == BRCM_RATE_12M
5310 			    || rs.rates[i] == BRCM_RATE_24M)
5311 				rs.rates[i] |= BRCMS_RATE_FLAG;
5312 		}
5313 	}
5314 
5315 	/* Set default bss rateset */
5316 	wlc->default_bss->rateset.count = rs.count;
5317 	memcpy(wlc->default_bss->rateset.rates, rs.rates,
5318 	       sizeof(wlc->default_bss->rateset.rates));
5319 
5320 	return ret;
5321 }
5322 
5323 int brcms_c_set_nmode(struct brcms_c_info *wlc)
5324 {
5325 	uint i;
5326 	s32 nmode = AUTO;
5327 
5328 	if (wlc->stf->txstreams == WL_11N_3x3)
5329 		nmode = WL_11N_3x3;
5330 	else
5331 		nmode = WL_11N_2x2;
5332 
5333 	/* force GMODE_AUTO if NMODE is ON */
5334 	brcms_c_set_gmode(wlc, GMODE_AUTO, true);
5335 	if (nmode == WL_11N_3x3)
5336 		wlc->pub->_n_enab = SUPPORT_HT;
5337 	else
5338 		wlc->pub->_n_enab = SUPPORT_11N;
5339 	wlc->default_bss->flags |= BRCMS_BSS_HT;
5340 	/* add the mcs rates to the default and hw ratesets */
5341 	brcms_c_rateset_mcs_build(&wlc->default_bss->rateset,
5342 			      wlc->stf->txstreams);
5343 	for (i = 0; i < wlc->pub->_nbands; i++)
5344 		memcpy(wlc->bandstate[i]->hw_rateset.mcs,
5345 		       wlc->default_bss->rateset.mcs, MCSSET_LEN);
5346 
5347 	return 0;
5348 }
5349 
5350 static int
5351 brcms_c_set_internal_rateset(struct brcms_c_info *wlc,
5352 			     struct brcms_c_rateset *rs_arg)
5353 {
5354 	struct brcms_c_rateset rs, new;
5355 	uint bandunit;
5356 
5357 	memcpy(&rs, rs_arg, sizeof(struct brcms_c_rateset));
5358 
5359 	/* check for bad count value */
5360 	if ((rs.count == 0) || (rs.count > BRCMS_NUMRATES))
5361 		return -EINVAL;
5362 
5363 	/* try the current band */
5364 	bandunit = wlc->band->bandunit;
5365 	memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5366 	if (brcms_c_rate_hwrs_filter_sort_validate
5367 	    (&new, &wlc->bandstate[bandunit]->hw_rateset, true,
5368 	     wlc->stf->txstreams))
5369 		goto good;
5370 
5371 	/* try the other band */
5372 	if (brcms_is_mband_unlocked(wlc)) {
5373 		bandunit = OTHERBANDUNIT(wlc);
5374 		memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5375 		if (brcms_c_rate_hwrs_filter_sort_validate(&new,
5376 						       &wlc->
5377 						       bandstate[bandunit]->
5378 						       hw_rateset, true,
5379 						       wlc->stf->txstreams))
5380 			goto good;
5381 	}
5382 
5383 	return -EBADE;
5384 
5385  good:
5386 	/* apply new rateset */
5387 	memcpy(&wlc->default_bss->rateset, &new,
5388 	       sizeof(struct brcms_c_rateset));
5389 	memcpy(&wlc->bandstate[bandunit]->defrateset, &new,
5390 	       sizeof(struct brcms_c_rateset));
5391 	return 0;
5392 }
5393 
5394 static void brcms_c_ofdm_rateset_war(struct brcms_c_info *wlc)
5395 {
5396 	u8 r;
5397 	bool war = false;
5398 
5399 	if (wlc->pub->associated)
5400 		r = wlc->bsscfg->current_bss->rateset.rates[0];
5401 	else
5402 		r = wlc->default_bss->rateset.rates[0];
5403 
5404 	wlc_phy_ofdm_rateset_war(wlc->band->pi, war);
5405 }
5406 
5407 int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel)
5408 {
5409 	u16 chspec = ch20mhz_chspec(channel);
5410 
5411 	if (channel < 0 || channel > MAXCHANNEL)
5412 		return -EINVAL;
5413 
5414 	if (!brcms_c_valid_chanspec_db(wlc->cmi, chspec))
5415 		return -EINVAL;
5416 
5417 
5418 	if (!wlc->pub->up && brcms_is_mband_unlocked(wlc)) {
5419 		if (wlc->band->bandunit != chspec_bandunit(chspec))
5420 			wlc->bandinit_pending = true;
5421 		else
5422 			wlc->bandinit_pending = false;
5423 	}
5424 
5425 	wlc->default_bss->chanspec = chspec;
5426 	/* brcms_c_BSSinit() will sanitize the rateset before
5427 	 * using it.. */
5428 	if (wlc->pub->up && (wlc_phy_chanspec_get(wlc->band->pi) != chspec)) {
5429 		brcms_c_set_home_chanspec(wlc, chspec);
5430 		brcms_c_suspend_mac_and_wait(wlc);
5431 		brcms_c_set_chanspec(wlc, chspec);
5432 		brcms_c_enable_mac(wlc);
5433 	}
5434 	return 0;
5435 }
5436 
5437 int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl)
5438 {
5439 	int ac;
5440 
5441 	if (srl < 1 || srl > RETRY_SHORT_MAX ||
5442 	    lrl < 1 || lrl > RETRY_SHORT_MAX)
5443 		return -EINVAL;
5444 
5445 	wlc->SRL = srl;
5446 	wlc->LRL = lrl;
5447 
5448 	brcms_b_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
5449 
5450 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
5451 		wlc->wme_retries[ac] =	SFIELD(wlc->wme_retries[ac],
5452 					       EDCF_SHORT,  wlc->SRL);
5453 		wlc->wme_retries[ac] =	SFIELD(wlc->wme_retries[ac],
5454 					       EDCF_LONG, wlc->LRL);
5455 	}
5456 	brcms_c_wme_retries_write(wlc);
5457 
5458 	return 0;
5459 }
5460 
5461 void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
5462 				 struct brcm_rateset *currs)
5463 {
5464 	struct brcms_c_rateset *rs;
5465 
5466 	if (wlc->pub->associated)
5467 		rs = &wlc->bsscfg->current_bss->rateset;
5468 	else
5469 		rs = &wlc->default_bss->rateset;
5470 
5471 	/* Copy only legacy rateset section */
5472 	currs->count = rs->count;
5473 	memcpy(&currs->rates, &rs->rates, rs->count);
5474 }
5475 
5476 int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
5477 {
5478 	struct brcms_c_rateset internal_rs;
5479 	int bcmerror;
5480 
5481 	if (rs->count > BRCMS_NUMRATES)
5482 		return -ENOBUFS;
5483 
5484 	memset(&internal_rs, 0, sizeof(internal_rs));
5485 
5486 	/* Copy only legacy rateset section */
5487 	internal_rs.count = rs->count;
5488 	memcpy(&internal_rs.rates, &rs->rates, internal_rs.count);
5489 
5490 	/* merge rateset coming in with the current mcsset */
5491 	if (wlc->pub->_n_enab & SUPPORT_11N) {
5492 		struct brcms_bss_info *mcsset_bss;
5493 		if (wlc->pub->associated)
5494 			mcsset_bss = wlc->bsscfg->current_bss;
5495 		else
5496 			mcsset_bss = wlc->default_bss;
5497 		memcpy(internal_rs.mcs, &mcsset_bss->rateset.mcs[0],
5498 		       MCSSET_LEN);
5499 	}
5500 
5501 	bcmerror = brcms_c_set_internal_rateset(wlc, &internal_rs);
5502 	if (!bcmerror)
5503 		brcms_c_ofdm_rateset_war(wlc);
5504 
5505 	return bcmerror;
5506 }
5507 
5508 static void brcms_c_time_lock(struct brcms_c_info *wlc)
5509 {
5510 	bcma_set32(wlc->hw->d11core, D11REGOFFS(maccontrol), MCTL_TBTTHOLD);
5511 	/* Commit the write */
5512 	bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
5513 }
5514 
5515 static void brcms_c_time_unlock(struct brcms_c_info *wlc)
5516 {
5517 	bcma_mask32(wlc->hw->d11core, D11REGOFFS(maccontrol), ~MCTL_TBTTHOLD);
5518 	/* Commit the write */
5519 	bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
5520 }
5521 
5522 int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
5523 {
5524 	u32 bcnint_us;
5525 
5526 	if (period == 0)
5527 		return -EINVAL;
5528 
5529 	wlc->default_bss->beacon_period = period;
5530 
5531 	bcnint_us = period << 10;
5532 	brcms_c_time_lock(wlc);
5533 	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfprep),
5534 		     (bcnint_us << CFPREP_CBI_SHIFT));
5535 	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfpstart), bcnint_us);
5536 	brcms_c_time_unlock(wlc);
5537 
5538 	return 0;
5539 }
5540 
5541 u16 brcms_c_get_phy_type(struct brcms_c_info *wlc, int phyidx)
5542 {
5543 	return wlc->band->phytype;
5544 }
5545 
5546 void brcms_c_set_shortslot_override(struct brcms_c_info *wlc, s8 sslot_override)
5547 {
5548 	wlc->shortslot_override = sslot_override;
5549 
5550 	/*
5551 	 * shortslot is an 11g feature, so no more work if we are
5552 	 * currently on the 5G band
5553 	 */
5554 	if (wlc->band->bandtype == BRCM_BAND_5G)
5555 		return;
5556 
5557 	if (wlc->pub->up && wlc->pub->associated) {
5558 		/* let watchdog or beacon processing update shortslot */
5559 	} else if (wlc->pub->up) {
5560 		/* unassociated shortslot is off */
5561 		brcms_c_switch_shortslot(wlc, false);
5562 	} else {
5563 		/* driver is down, so just update the brcms_c_info
5564 		 * value */
5565 		if (wlc->shortslot_override == BRCMS_SHORTSLOT_AUTO)
5566 			wlc->shortslot = false;
5567 		else
5568 			wlc->shortslot =
5569 			    (wlc->shortslot_override ==
5570 			     BRCMS_SHORTSLOT_ON);
5571 	}
5572 }
5573 
5574 /*
5575  * register watchdog and down handlers.
5576  */
5577 int brcms_c_module_register(struct brcms_pub *pub,
5578 			    const char *name, struct brcms_info *hdl,
5579 			    int (*d_fn)(void *handle))
5580 {
5581 	struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5582 	int i;
5583 
5584 	/* find an empty entry and just add, no duplication check! */
5585 	for (i = 0; i < BRCMS_MAXMODULES; i++) {
5586 		if (wlc->modulecb[i].name[0] == '\0') {
5587 			strncpy(wlc->modulecb[i].name, name,
5588 				sizeof(wlc->modulecb[i].name) - 1);
5589 			wlc->modulecb[i].hdl = hdl;
5590 			wlc->modulecb[i].down_fn = d_fn;
5591 			return 0;
5592 		}
5593 	}
5594 
5595 	return -ENOSR;
5596 }
5597 
5598 /* unregister module callbacks */
5599 int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
5600 			      struct brcms_info *hdl)
5601 {
5602 	struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5603 	int i;
5604 
5605 	if (wlc == NULL)
5606 		return -ENODATA;
5607 
5608 	for (i = 0; i < BRCMS_MAXMODULES; i++) {
5609 		if (!strcmp(wlc->modulecb[i].name, name) &&
5610 		    (wlc->modulecb[i].hdl == hdl)) {
5611 			memset(&wlc->modulecb[i], 0, sizeof(wlc->modulecb[i]));
5612 			return 0;
5613 		}
5614 	}
5615 
5616 	/* table not found! */
5617 	return -ENODATA;
5618 }
5619 
5620 static bool brcms_c_chipmatch_pci(struct bcma_device *core)
5621 {
5622 	struct pci_dev *pcidev = core->bus->host_pci;
5623 	u16 vendor = pcidev->vendor;
5624 	u16 device = pcidev->device;
5625 
5626 	if (vendor != PCI_VENDOR_ID_BROADCOM) {
5627 		pr_err("unknown vendor id %04x\n", vendor);
5628 		return false;
5629 	}
5630 
5631 	if (device == BCM43224_D11N_ID_VEN1 || device == BCM43224_CHIP_ID)
5632 		return true;
5633 	if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
5634 		return true;
5635 	if (device == BCM4313_D11N2G_ID || device == BCM4313_CHIP_ID)
5636 		return true;
5637 	if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
5638 		return true;
5639 
5640 	pr_err("unknown device id %04x\n", device);
5641 	return false;
5642 }
5643 
5644 static bool brcms_c_chipmatch_soc(struct bcma_device *core)
5645 {
5646 	struct bcma_chipinfo *chipinfo = &core->bus->chipinfo;
5647 
5648 	if (chipinfo->id == BCMA_CHIP_ID_BCM4716)
5649 		return true;
5650 
5651 	pr_err("unknown chip id %04x\n", chipinfo->id);
5652 	return false;
5653 }
5654 
5655 bool brcms_c_chipmatch(struct bcma_device *core)
5656 {
5657 	switch (core->bus->hosttype) {
5658 	case BCMA_HOSTTYPE_PCI:
5659 		return brcms_c_chipmatch_pci(core);
5660 	case BCMA_HOSTTYPE_SOC:
5661 		return brcms_c_chipmatch_soc(core);
5662 	default:
5663 		pr_err("unknown host type: %i\n", core->bus->hosttype);
5664 		return false;
5665 	}
5666 }
5667 
5668 u16 brcms_b_rate_shm_offset(struct brcms_hardware *wlc_hw, u8 rate)
5669 {
5670 	u16 table_ptr;
5671 	u8 phy_rate, index;
5672 
5673 	/* get the phy specific rate encoding for the PLCP SIGNAL field */
5674 	if (is_ofdm_rate(rate))
5675 		table_ptr = M_RT_DIRMAP_A;
5676 	else
5677 		table_ptr = M_RT_DIRMAP_B;
5678 
5679 	/* for a given rate, the LS-nibble of the PLCP SIGNAL field is
5680 	 * the index into the rate table.
5681 	 */
5682 	phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
5683 	index = phy_rate & 0xf;
5684 
5685 	/* Find the SHM pointer to the rate table entry by looking in the
5686 	 * Direct-map Table
5687 	 */
5688 	return 2 * brcms_b_read_shm(wlc_hw, table_ptr + (index * 2));
5689 }
5690 
5691 /*
5692  * bcmc_fid_generate:
5693  * Generate frame ID for a BCMC packet.  The frag field is not used
5694  * for MC frames so is used as part of the sequence number.
5695  */
5696 static inline u16
5697 bcmc_fid_generate(struct brcms_c_info *wlc, struct brcms_bss_cfg *bsscfg,
5698 		  struct d11txh *txh)
5699 {
5700 	u16 frameid;
5701 
5702 	frameid = le16_to_cpu(txh->TxFrameID) & ~(TXFID_SEQ_MASK |
5703 						  TXFID_QUEUE_MASK);
5704 	frameid |=
5705 	    (((wlc->
5706 	       mc_fid_counter++) << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
5707 	    TX_BCMC_FIFO;
5708 
5709 	return frameid;
5710 }
5711 
5712 static uint
5713 brcms_c_calc_ack_time(struct brcms_c_info *wlc, u32 rspec,
5714 		      u8 preamble_type)
5715 {
5716 	uint dur = 0;
5717 
5718 	/*
5719 	 * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5720 	 * is less than or equal to the rate of the immediately previous
5721 	 * frame in the FES
5722 	 */
5723 	rspec = brcms_basic_rate(wlc, rspec);
5724 	/* ACK frame len == 14 == 2(fc) + 2(dur) + 6(ra) + 4(fcs) */
5725 	dur =
5726 	    brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5727 				(DOT11_ACK_LEN + FCS_LEN));
5728 	return dur;
5729 }
5730 
5731 static uint
5732 brcms_c_calc_cts_time(struct brcms_c_info *wlc, u32 rspec,
5733 		      u8 preamble_type)
5734 {
5735 	return brcms_c_calc_ack_time(wlc, rspec, preamble_type);
5736 }
5737 
5738 static uint
5739 brcms_c_calc_ba_time(struct brcms_c_info *wlc, u32 rspec,
5740 		     u8 preamble_type)
5741 {
5742 	/*
5743 	 * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5744 	 * is less than or equal to the rate of the immediately previous
5745 	 * frame in the FES
5746 	 */
5747 	rspec = brcms_basic_rate(wlc, rspec);
5748 	/* BA len == 32 == 16(ctl hdr) + 4(ba len) + 8(bitmap) + 4(fcs) */
5749 	return brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5750 				   (DOT11_BA_LEN + DOT11_BA_BITMAP_LEN +
5751 				    FCS_LEN));
5752 }
5753 
5754 /* brcms_c_compute_frame_dur()
5755  *
5756  * Calculate the 802.11 MAC header DUR field for MPDU
5757  * DUR for a single frame = 1 SIFS + 1 ACK
5758  * DUR for a frame with following frags = 3 SIFS + 2 ACK + next frag time
5759  *
5760  * rate			MPDU rate in unit of 500kbps
5761  * next_frag_len	next MPDU length in bytes
5762  * preamble_type	use short/GF or long/MM PLCP header
5763  */
5764 static u16
5765 brcms_c_compute_frame_dur(struct brcms_c_info *wlc, u32 rate,
5766 		      u8 preamble_type, uint next_frag_len)
5767 {
5768 	u16 dur, sifs;
5769 
5770 	sifs = get_sifs(wlc->band);
5771 
5772 	dur = sifs;
5773 	dur += (u16) brcms_c_calc_ack_time(wlc, rate, preamble_type);
5774 
5775 	if (next_frag_len) {
5776 		/* Double the current DUR to get 2 SIFS + 2 ACKs */
5777 		dur *= 2;
5778 		/* add another SIFS and the frag time */
5779 		dur += sifs;
5780 		dur +=
5781 		    (u16) brcms_c_calc_frame_time(wlc, rate, preamble_type,
5782 						 next_frag_len);
5783 	}
5784 	return dur;
5785 }
5786 
5787 /* The opposite of brcms_c_calc_frame_time */
5788 static uint
5789 brcms_c_calc_frame_len(struct brcms_c_info *wlc, u32 ratespec,
5790 		   u8 preamble_type, uint dur)
5791 {
5792 	uint nsyms, mac_len, Ndps, kNdps;
5793 	uint rate = rspec2rate(ratespec);
5794 
5795 	if (is_mcs_rate(ratespec)) {
5796 		uint mcs = ratespec & RSPEC_RATE_MASK;
5797 		int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
5798 		dur -= PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
5799 		/* payload calculation matches that of regular ofdm */
5800 		if (wlc->band->bandtype == BRCM_BAND_2G)
5801 			dur -= DOT11_OFDM_SIGNAL_EXTENSION;
5802 		/* kNdbps = kbps * 4 */
5803 		kNdps =	mcs_2_rate(mcs, rspec_is40mhz(ratespec),
5804 				   rspec_issgi(ratespec)) * 4;
5805 		nsyms = dur / APHY_SYMBOL_TIME;
5806 		mac_len =
5807 		    ((nsyms * kNdps) -
5808 		     ((APHY_SERVICE_NBITS + APHY_TAIL_NBITS) * 1000)) / 8000;
5809 	} else if (is_ofdm_rate(ratespec)) {
5810 		dur -= APHY_PREAMBLE_TIME;
5811 		dur -= APHY_SIGNAL_TIME;
5812 		/* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
5813 		Ndps = rate * 2;
5814 		nsyms = dur / APHY_SYMBOL_TIME;
5815 		mac_len =
5816 		    ((nsyms * Ndps) -
5817 		     (APHY_SERVICE_NBITS + APHY_TAIL_NBITS)) / 8;
5818 	} else {
5819 		if (preamble_type & BRCMS_SHORT_PREAMBLE)
5820 			dur -= BPHY_PLCP_SHORT_TIME;
5821 		else
5822 			dur -= BPHY_PLCP_TIME;
5823 		mac_len = dur * rate;
5824 		/* divide out factor of 2 in rate (1/2 mbps) */
5825 		mac_len = mac_len / 8 / 2;
5826 	}
5827 	return mac_len;
5828 }
5829 
5830 /*
5831  * Return true if the specified rate is supported by the specified band.
5832  * BRCM_BAND_AUTO indicates the current band.
5833  */
5834 static bool brcms_c_valid_rate(struct brcms_c_info *wlc, u32 rspec, int band,
5835 		    bool verbose)
5836 {
5837 	struct brcms_c_rateset *hw_rateset;
5838 	uint i;
5839 
5840 	if ((band == BRCM_BAND_AUTO) || (band == wlc->band->bandtype))
5841 		hw_rateset = &wlc->band->hw_rateset;
5842 	else if (wlc->pub->_nbands > 1)
5843 		hw_rateset = &wlc->bandstate[OTHERBANDUNIT(wlc)]->hw_rateset;
5844 	else
5845 		/* other band specified and we are a single band device */
5846 		return false;
5847 
5848 	/* check if this is a mimo rate */
5849 	if (is_mcs_rate(rspec)) {
5850 		if ((rspec & RSPEC_RATE_MASK) >= MCS_TABLE_SIZE)
5851 			goto error;
5852 
5853 		return isset(hw_rateset->mcs, (rspec & RSPEC_RATE_MASK));
5854 	}
5855 
5856 	for (i = 0; i < hw_rateset->count; i++)
5857 		if (hw_rateset->rates[i] == rspec2rate(rspec))
5858 			return true;
5859  error:
5860 	if (verbose)
5861 		brcms_err(wlc->hw->d11core, "wl%d: valid_rate: rate spec 0x%x "
5862 			  "not in hw_rateset\n", wlc->pub->unit, rspec);
5863 
5864 	return false;
5865 }
5866 
5867 static u32
5868 mac80211_wlc_set_nrate(struct brcms_c_info *wlc, struct brcms_band *cur_band,
5869 		       u32 int_val)
5870 {
5871 	struct bcma_device *core = wlc->hw->d11core;
5872 	u8 stf = (int_val & NRATE_STF_MASK) >> NRATE_STF_SHIFT;
5873 	u8 rate = int_val & NRATE_RATE_MASK;
5874 	u32 rspec;
5875 	bool ismcs = ((int_val & NRATE_MCS_INUSE) == NRATE_MCS_INUSE);
5876 	bool issgi = ((int_val & NRATE_SGI_MASK) >> NRATE_SGI_SHIFT);
5877 	bool override_mcs_only = ((int_val & NRATE_OVERRIDE_MCS_ONLY)
5878 				  == NRATE_OVERRIDE_MCS_ONLY);
5879 	int bcmerror = 0;
5880 
5881 	if (!ismcs)
5882 		return (u32) rate;
5883 
5884 	/* validate the combination of rate/mcs/stf is allowed */
5885 	if ((wlc->pub->_n_enab & SUPPORT_11N) && ismcs) {
5886 		/* mcs only allowed when nmode */
5887 		if (stf > PHY_TXC1_MODE_SDM) {
5888 			brcms_err(core, "wl%d: %s: Invalid stf\n",
5889 				  wlc->pub->unit, __func__);
5890 			bcmerror = -EINVAL;
5891 			goto done;
5892 		}
5893 
5894 		/* mcs 32 is a special case, DUP mode 40 only */
5895 		if (rate == 32) {
5896 			if (!CHSPEC_IS40(wlc->home_chanspec) ||
5897 			    ((stf != PHY_TXC1_MODE_SISO)
5898 			     && (stf != PHY_TXC1_MODE_CDD))) {
5899 				brcms_err(core, "wl%d: %s: Invalid mcs 32\n",
5900 					  wlc->pub->unit, __func__);
5901 				bcmerror = -EINVAL;
5902 				goto done;
5903 			}
5904 			/* mcs > 7 must use stf SDM */
5905 		} else if (rate > HIGHEST_SINGLE_STREAM_MCS) {
5906 			/* mcs > 7 must use stf SDM */
5907 			if (stf != PHY_TXC1_MODE_SDM) {
5908 				brcms_dbg_mac80211(core, "wl%d: enabling "
5909 						   "SDM mode for mcs %d\n",
5910 						   wlc->pub->unit, rate);
5911 				stf = PHY_TXC1_MODE_SDM;
5912 			}
5913 		} else {
5914 			/*
5915 			 * MCS 0-7 may use SISO, CDD, and for
5916 			 * phy_rev >= 3 STBC
5917 			 */
5918 			if ((stf > PHY_TXC1_MODE_STBC) ||
5919 			    (!BRCMS_STBC_CAP_PHY(wlc)
5920 			     && (stf == PHY_TXC1_MODE_STBC))) {
5921 				brcms_err(core, "wl%d: %s: Invalid STBC\n",
5922 					  wlc->pub->unit, __func__);
5923 				bcmerror = -EINVAL;
5924 				goto done;
5925 			}
5926 		}
5927 	} else if (is_ofdm_rate(rate)) {
5928 		if ((stf != PHY_TXC1_MODE_CDD) && (stf != PHY_TXC1_MODE_SISO)) {
5929 			brcms_err(core, "wl%d: %s: Invalid OFDM\n",
5930 				  wlc->pub->unit, __func__);
5931 			bcmerror = -EINVAL;
5932 			goto done;
5933 		}
5934 	} else if (is_cck_rate(rate)) {
5935 		if ((cur_band->bandtype != BRCM_BAND_2G)
5936 		    || (stf != PHY_TXC1_MODE_SISO)) {
5937 			brcms_err(core, "wl%d: %s: Invalid CCK\n",
5938 				  wlc->pub->unit, __func__);
5939 			bcmerror = -EINVAL;
5940 			goto done;
5941 		}
5942 	} else {
5943 		brcms_err(core, "wl%d: %s: Unknown rate type\n",
5944 			  wlc->pub->unit, __func__);
5945 		bcmerror = -EINVAL;
5946 		goto done;
5947 	}
5948 	/* make sure multiple antennae are available for non-siso rates */
5949 	if ((stf != PHY_TXC1_MODE_SISO) && (wlc->stf->txstreams == 1)) {
5950 		brcms_err(core, "wl%d: %s: SISO antenna but !SISO "
5951 			  "request\n", wlc->pub->unit, __func__);
5952 		bcmerror = -EINVAL;
5953 		goto done;
5954 	}
5955 
5956 	rspec = rate;
5957 	if (ismcs) {
5958 		rspec |= RSPEC_MIMORATE;
5959 		/* For STBC populate the STC field of the ratespec */
5960 		if (stf == PHY_TXC1_MODE_STBC) {
5961 			u8 stc;
5962 			stc = 1;	/* Nss for single stream is always 1 */
5963 			rspec |= (stc << RSPEC_STC_SHIFT);
5964 		}
5965 	}
5966 
5967 	rspec |= (stf << RSPEC_STF_SHIFT);
5968 
5969 	if (override_mcs_only)
5970 		rspec |= RSPEC_OVERRIDE_MCS_ONLY;
5971 
5972 	if (issgi)
5973 		rspec |= RSPEC_SHORT_GI;
5974 
5975 	if ((rate != 0)
5976 	    && !brcms_c_valid_rate(wlc, rspec, cur_band->bandtype, true))
5977 		return rate;
5978 
5979 	return rspec;
5980 done:
5981 	return rate;
5982 }
5983 
5984 /*
5985  * Compute PLCP, but only requires actual rate and length of pkt.
5986  * Rate is given in the driver standard multiple of 500 kbps.
5987  * le is set for 11 Mbps rate if necessary.
5988  * Broken out for PRQ.
5989  */
5990 
5991 static void brcms_c_cck_plcp_set(struct brcms_c_info *wlc, int rate_500,
5992 			     uint length, u8 *plcp)
5993 {
5994 	u16 usec = 0;
5995 	u8 le = 0;
5996 
5997 	switch (rate_500) {
5998 	case BRCM_RATE_1M:
5999 		usec = length << 3;
6000 		break;
6001 	case BRCM_RATE_2M:
6002 		usec = length << 2;
6003 		break;
6004 	case BRCM_RATE_5M5:
6005 		usec = (length << 4) / 11;
6006 		if ((length << 4) - (usec * 11) > 0)
6007 			usec++;
6008 		break;
6009 	case BRCM_RATE_11M:
6010 		usec = (length << 3) / 11;
6011 		if ((length << 3) - (usec * 11) > 0) {
6012 			usec++;
6013 			if ((usec * 11) - (length << 3) >= 8)
6014 				le = D11B_PLCP_SIGNAL_LE;
6015 		}
6016 		break;
6017 
6018 	default:
6019 		brcms_err(wlc->hw->d11core,
6020 			  "brcms_c_cck_plcp_set: unsupported rate %d\n",
6021 			  rate_500);
6022 		rate_500 = BRCM_RATE_1M;
6023 		usec = length << 3;
6024 		break;
6025 	}
6026 	/* PLCP signal byte */
6027 	plcp[0] = rate_500 * 5;	/* r (500kbps) * 5 == r (100kbps) */
6028 	/* PLCP service byte */
6029 	plcp[1] = (u8) (le | D11B_PLCP_SIGNAL_LOCKED);
6030 	/* PLCP length u16, little endian */
6031 	plcp[2] = usec & 0xff;
6032 	plcp[3] = (usec >> 8) & 0xff;
6033 	/* PLCP CRC16 */
6034 	plcp[4] = 0;
6035 	plcp[5] = 0;
6036 }
6037 
6038 /* Rate: 802.11 rate code, length: PSDU length in octets */
6039 static void brcms_c_compute_mimo_plcp(u32 rspec, uint length, u8 *plcp)
6040 {
6041 	u8 mcs = (u8) (rspec & RSPEC_RATE_MASK);
6042 	plcp[0] = mcs;
6043 	if (rspec_is40mhz(rspec) || (mcs == 32))
6044 		plcp[0] |= MIMO_PLCP_40MHZ;
6045 	BRCMS_SET_MIMO_PLCP_LEN(plcp, length);
6046 	plcp[3] = rspec_mimoplcp3(rspec); /* rspec already holds this byte */
6047 	plcp[3] |= 0x7; /* set smoothing, not sounding ppdu & reserved */
6048 	plcp[4] = 0; /* number of extension spatial streams bit 0 & 1 */
6049 	plcp[5] = 0;
6050 }
6051 
6052 /* Rate: 802.11 rate code, length: PSDU length in octets */
6053 static void
6054 brcms_c_compute_ofdm_plcp(u32 rspec, u32 length, u8 *plcp)
6055 {
6056 	u8 rate_signal;
6057 	u32 tmp = 0;
6058 	int rate = rspec2rate(rspec);
6059 
6060 	/*
6061 	 * encode rate per 802.11a-1999 sec 17.3.4.1, with lsb
6062 	 * transmitted first
6063 	 */
6064 	rate_signal = rate_info[rate] & BRCMS_RATE_MASK;
6065 	memset(plcp, 0, D11_PHY_HDR_LEN);
6066 	D11A_PHY_HDR_SRATE((struct ofdm_phy_hdr *) plcp, rate_signal);
6067 
6068 	tmp = (length & 0xfff) << 5;
6069 	plcp[2] |= (tmp >> 16) & 0xff;
6070 	plcp[1] |= (tmp >> 8) & 0xff;
6071 	plcp[0] |= tmp & 0xff;
6072 }
6073 
6074 /* Rate: 802.11 rate code, length: PSDU length in octets */
6075 static void brcms_c_compute_cck_plcp(struct brcms_c_info *wlc, u32 rspec,
6076 				 uint length, u8 *plcp)
6077 {
6078 	int rate = rspec2rate(rspec);
6079 
6080 	brcms_c_cck_plcp_set(wlc, rate, length, plcp);
6081 }
6082 
6083 static void
6084 brcms_c_compute_plcp(struct brcms_c_info *wlc, u32 rspec,
6085 		     uint length, u8 *plcp)
6086 {
6087 	if (is_mcs_rate(rspec))
6088 		brcms_c_compute_mimo_plcp(rspec, length, plcp);
6089 	else if (is_ofdm_rate(rspec))
6090 		brcms_c_compute_ofdm_plcp(rspec, length, plcp);
6091 	else
6092 		brcms_c_compute_cck_plcp(wlc, rspec, length, plcp);
6093 }
6094 
6095 /* brcms_c_compute_rtscts_dur()
6096  *
6097  * Calculate the 802.11 MAC header DUR field for an RTS or CTS frame
6098  * DUR for normal RTS/CTS w/ frame = 3 SIFS + 1 CTS + next frame time + 1 ACK
6099  * DUR for CTS-TO-SELF w/ frame    = 2 SIFS         + next frame time + 1 ACK
6100  *
6101  * cts			cts-to-self or rts/cts
6102  * rts_rate		rts or cts rate in unit of 500kbps
6103  * rate			next MPDU rate in unit of 500kbps
6104  * frame_len		next MPDU frame length in bytes
6105  */
6106 u16
6107 brcms_c_compute_rtscts_dur(struct brcms_c_info *wlc, bool cts_only,
6108 			   u32 rts_rate,
6109 			   u32 frame_rate, u8 rts_preamble_type,
6110 			   u8 frame_preamble_type, uint frame_len, bool ba)
6111 {
6112 	u16 dur, sifs;
6113 
6114 	sifs = get_sifs(wlc->band);
6115 
6116 	if (!cts_only) {
6117 		/* RTS/CTS */
6118 		dur = 3 * sifs;
6119 		dur +=
6120 		    (u16) brcms_c_calc_cts_time(wlc, rts_rate,
6121 					       rts_preamble_type);
6122 	} else {
6123 		/* CTS-TO-SELF */
6124 		dur = 2 * sifs;
6125 	}
6126 
6127 	dur +=
6128 	    (u16) brcms_c_calc_frame_time(wlc, frame_rate, frame_preamble_type,
6129 					 frame_len);
6130 	if (ba)
6131 		dur +=
6132 		    (u16) brcms_c_calc_ba_time(wlc, frame_rate,
6133 					      BRCMS_SHORT_PREAMBLE);
6134 	else
6135 		dur +=
6136 		    (u16) brcms_c_calc_ack_time(wlc, frame_rate,
6137 					       frame_preamble_type);
6138 	return dur;
6139 }
6140 
6141 static u16 brcms_c_phytxctl1_calc(struct brcms_c_info *wlc, u32 rspec)
6142 {
6143 	u16 phyctl1 = 0;
6144 	u16 bw;
6145 
6146 	if (BRCMS_ISLCNPHY(wlc->band)) {
6147 		bw = PHY_TXC1_BW_20MHZ;
6148 	} else {
6149 		bw = rspec_get_bw(rspec);
6150 		/* 10Mhz is not supported yet */
6151 		if (bw < PHY_TXC1_BW_20MHZ) {
6152 			brcms_err(wlc->hw->d11core, "phytxctl1_calc: bw %d is "
6153 				  "not supported yet, set to 20L\n", bw);
6154 			bw = PHY_TXC1_BW_20MHZ;
6155 		}
6156 	}
6157 
6158 	if (is_mcs_rate(rspec)) {
6159 		uint mcs = rspec & RSPEC_RATE_MASK;
6160 
6161 		/* bw, stf, coding-type is part of rspec_phytxbyte2 returns */
6162 		phyctl1 = rspec_phytxbyte2(rspec);
6163 		/* set the upper byte of phyctl1 */
6164 		phyctl1 |= (mcs_table[mcs].tx_phy_ctl3 << 8);
6165 	} else if (is_cck_rate(rspec) && !BRCMS_ISLCNPHY(wlc->band)
6166 		   && !BRCMS_ISSSLPNPHY(wlc->band)) {
6167 		/*
6168 		 * In CCK mode LPPHY overloads OFDM Modulation bits with CCK
6169 		 * Data Rate. Eventually MIMOPHY would also be converted to
6170 		 * this format
6171 		 */
6172 		/* 0 = 1Mbps; 1 = 2Mbps; 2 = 5.5Mbps; 3 = 11Mbps */
6173 		phyctl1 = (bw | (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6174 	} else {		/* legacy OFDM/CCK */
6175 		s16 phycfg;
6176 		/* get the phyctl byte from rate phycfg table */
6177 		phycfg = brcms_c_rate_legacy_phyctl(rspec2rate(rspec));
6178 		if (phycfg == -1) {
6179 			brcms_err(wlc->hw->d11core, "phytxctl1_calc: wrong "
6180 				  "legacy OFDM/CCK rate\n");
6181 			phycfg = 0;
6182 		}
6183 		/* set the upper byte of phyctl1 */
6184 		phyctl1 =
6185 		    (bw | (phycfg << 8) |
6186 		     (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6187 	}
6188 	return phyctl1;
6189 }
6190 
6191 /*
6192  * Add struct d11txh, struct cck_phy_hdr.
6193  *
6194  * 'p' data must start with 802.11 MAC header
6195  * 'p' must allow enough bytes of local headers to be "pushed" onto the packet
6196  *
6197  * headroom == D11_PHY_HDR_LEN + D11_TXH_LEN (D11_TXH_LEN is now 104 bytes)
6198  *
6199  */
6200 static u16
6201 brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
6202 		     struct sk_buff *p, struct scb *scb, uint frag,
6203 		     uint nfrags, uint queue, uint next_frag_len)
6204 {
6205 	struct ieee80211_hdr *h;
6206 	struct d11txh *txh;
6207 	u8 *plcp, plcp_fallback[D11_PHY_HDR_LEN];
6208 	int len, phylen, rts_phylen;
6209 	u16 mch, phyctl, xfts, mainrates;
6210 	u16 seq = 0, mcl = 0, status = 0, frameid = 0;
6211 	u32 rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6212 	u32 rts_rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6213 	bool use_rts = false;
6214 	bool use_cts = false;
6215 	bool use_rifs = false;
6216 	bool short_preamble[2] = { false, false };
6217 	u8 preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6218 	u8 rts_preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6219 	u8 *rts_plcp, rts_plcp_fallback[D11_PHY_HDR_LEN];
6220 	struct ieee80211_rts *rts = NULL;
6221 	bool qos;
6222 	uint ac;
6223 	bool hwtkmic = false;
6224 	u16 mimo_ctlchbw = PHY_TXC1_BW_20MHZ;
6225 #define ANTCFG_NONE 0xFF
6226 	u8 antcfg = ANTCFG_NONE;
6227 	u8 fbantcfg = ANTCFG_NONE;
6228 	uint phyctl1_stf = 0;
6229 	u16 durid = 0;
6230 	struct ieee80211_tx_rate *txrate[2];
6231 	int k;
6232 	struct ieee80211_tx_info *tx_info;
6233 	bool is_mcs;
6234 	u16 mimo_txbw;
6235 	u8 mimo_preamble_type;
6236 
6237 	/* locate 802.11 MAC header */
6238 	h = (struct ieee80211_hdr *)(p->data);
6239 	qos = ieee80211_is_data_qos(h->frame_control);
6240 
6241 	/* compute length of frame in bytes for use in PLCP computations */
6242 	len = p->len;
6243 	phylen = len + FCS_LEN;
6244 
6245 	/* Get tx_info */
6246 	tx_info = IEEE80211_SKB_CB(p);
6247 
6248 	/* add PLCP */
6249 	plcp = skb_push(p, D11_PHY_HDR_LEN);
6250 
6251 	/* add Broadcom tx descriptor header */
6252 	txh = (struct d11txh *) skb_push(p, D11_TXH_LEN);
6253 	memset(txh, 0, D11_TXH_LEN);
6254 
6255 	/* setup frameid */
6256 	if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
6257 		/* non-AP STA should never use BCMC queue */
6258 		if (queue == TX_BCMC_FIFO) {
6259 			brcms_err(wlc->hw->d11core,
6260 				  "wl%d: %s: ASSERT queue == TX_BCMC!\n",
6261 				  wlc->pub->unit, __func__);
6262 			frameid = bcmc_fid_generate(wlc, NULL, txh);
6263 		} else {
6264 			/* Increment the counter for first fragment */
6265 			if (tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
6266 				scb->seqnum[p->priority]++;
6267 
6268 			/* extract fragment number from frame first */
6269 			seq = le16_to_cpu(h->seq_ctrl) & FRAGNUM_MASK;
6270 			seq |= (scb->seqnum[p->priority] << SEQNUM_SHIFT);
6271 			h->seq_ctrl = cpu_to_le16(seq);
6272 
6273 			frameid = ((seq << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
6274 			    (queue & TXFID_QUEUE_MASK);
6275 		}
6276 	}
6277 	frameid |= queue & TXFID_QUEUE_MASK;
6278 
6279 	/* set the ignpmq bit for all pkts tx'd in PS mode and for beacons */
6280 	if (ieee80211_is_beacon(h->frame_control))
6281 		mcl |= TXC_IGNOREPMQ;
6282 
6283 	txrate[0] = tx_info->control.rates;
6284 	txrate[1] = txrate[0] + 1;
6285 
6286 	/*
6287 	 * if rate control algorithm didn't give us a fallback
6288 	 * rate, use the primary rate
6289 	 */
6290 	if (txrate[1]->idx < 0)
6291 		txrate[1] = txrate[0];
6292 
6293 	for (k = 0; k < hw->max_rates; k++) {
6294 		is_mcs = txrate[k]->flags & IEEE80211_TX_RC_MCS ? true : false;
6295 		if (!is_mcs) {
6296 			if ((txrate[k]->idx >= 0)
6297 			    && (txrate[k]->idx <
6298 				hw->wiphy->bands[tx_info->band]->n_bitrates)) {
6299 				rspec[k] =
6300 				    hw->wiphy->bands[tx_info->band]->
6301 				    bitrates[txrate[k]->idx].hw_value;
6302 				short_preamble[k] =
6303 				    txrate[k]->
6304 				    flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ?
6305 				    true : false;
6306 			} else {
6307 				rspec[k] = BRCM_RATE_1M;
6308 			}
6309 		} else {
6310 			rspec[k] = mac80211_wlc_set_nrate(wlc, wlc->band,
6311 					NRATE_MCS_INUSE | txrate[k]->idx);
6312 		}
6313 
6314 		/*
6315 		 * Currently only support same setting for primay and
6316 		 * fallback rates. Unify flags for each rate into a
6317 		 * single value for the frame
6318 		 */
6319 		use_rts |=
6320 		    txrate[k]->
6321 		    flags & IEEE80211_TX_RC_USE_RTS_CTS ? true : false;
6322 		use_cts |=
6323 		    txrate[k]->
6324 		    flags & IEEE80211_TX_RC_USE_CTS_PROTECT ? true : false;
6325 
6326 
6327 		/*
6328 		 * (1) RATE:
6329 		 *   determine and validate primary rate
6330 		 *   and fallback rates
6331 		 */
6332 		if (!rspec_active(rspec[k])) {
6333 			rspec[k] = BRCM_RATE_1M;
6334 		} else {
6335 			if (!is_multicast_ether_addr(h->addr1)) {
6336 				/* set tx antenna config */
6337 				brcms_c_antsel_antcfg_get(wlc->asi, false,
6338 					false, 0, 0, &antcfg, &fbantcfg);
6339 			}
6340 		}
6341 	}
6342 
6343 	phyctl1_stf = wlc->stf->ss_opmode;
6344 
6345 	if (wlc->pub->_n_enab & SUPPORT_11N) {
6346 		for (k = 0; k < hw->max_rates; k++) {
6347 			/*
6348 			 * apply siso/cdd to single stream mcs's or ofdm
6349 			 * if rspec is auto selected
6350 			 */
6351 			if (((is_mcs_rate(rspec[k]) &&
6352 			      is_single_stream(rspec[k] & RSPEC_RATE_MASK)) ||
6353 			     is_ofdm_rate(rspec[k]))
6354 			    && ((rspec[k] & RSPEC_OVERRIDE_MCS_ONLY)
6355 				|| !(rspec[k] & RSPEC_OVERRIDE))) {
6356 				rspec[k] &= ~(RSPEC_STF_MASK | RSPEC_STC_MASK);
6357 
6358 				/* For SISO MCS use STBC if possible */
6359 				if (is_mcs_rate(rspec[k])
6360 				    && BRCMS_STF_SS_STBC_TX(wlc, scb)) {
6361 					u8 stc;
6362 
6363 					/* Nss for single stream is always 1 */
6364 					stc = 1;
6365 					rspec[k] |= (PHY_TXC1_MODE_STBC <<
6366 							RSPEC_STF_SHIFT) |
6367 						    (stc << RSPEC_STC_SHIFT);
6368 				} else
6369 					rspec[k] |=
6370 					    (phyctl1_stf << RSPEC_STF_SHIFT);
6371 			}
6372 
6373 			/*
6374 			 * Is the phy configured to use 40MHZ frames? If
6375 			 * so then pick the desired txbw
6376 			 */
6377 			if (brcms_chspec_bw(wlc->chanspec) == BRCMS_40_MHZ) {
6378 				/* default txbw is 20in40 SB */
6379 				mimo_ctlchbw = mimo_txbw =
6380 				   CHSPEC_SB_UPPER(wlc_phy_chanspec_get(
6381 								 wlc->band->pi))
6382 				   ? PHY_TXC1_BW_20MHZ_UP : PHY_TXC1_BW_20MHZ;
6383 
6384 				if (is_mcs_rate(rspec[k])) {
6385 					/* mcs 32 must be 40b/w DUP */
6386 					if ((rspec[k] & RSPEC_RATE_MASK)
6387 					    == 32) {
6388 						mimo_txbw =
6389 						    PHY_TXC1_BW_40MHZ_DUP;
6390 						/* use override */
6391 					} else if (wlc->mimo_40txbw != AUTO)
6392 						mimo_txbw = wlc->mimo_40txbw;
6393 					/* else check if dst is using 40 Mhz */
6394 					else if (scb->flags & SCB_IS40)
6395 						mimo_txbw = PHY_TXC1_BW_40MHZ;
6396 				} else if (is_ofdm_rate(rspec[k])) {
6397 					if (wlc->ofdm_40txbw != AUTO)
6398 						mimo_txbw = wlc->ofdm_40txbw;
6399 				} else if (wlc->cck_40txbw != AUTO) {
6400 					mimo_txbw = wlc->cck_40txbw;
6401 				}
6402 			} else {
6403 				/*
6404 				 * mcs32 is 40 b/w only.
6405 				 * This is possible for probe packets on
6406 				 * a STA during SCAN
6407 				 */
6408 				if ((rspec[k] & RSPEC_RATE_MASK) == 32)
6409 					/* mcs 0 */
6410 					rspec[k] = RSPEC_MIMORATE;
6411 
6412 				mimo_txbw = PHY_TXC1_BW_20MHZ;
6413 			}
6414 
6415 			/* Set channel width */
6416 			rspec[k] &= ~RSPEC_BW_MASK;
6417 			if ((k == 0) || ((k > 0) && is_mcs_rate(rspec[k])))
6418 				rspec[k] |= (mimo_txbw << RSPEC_BW_SHIFT);
6419 			else
6420 				rspec[k] |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
6421 
6422 			/* Disable short GI, not supported yet */
6423 			rspec[k] &= ~RSPEC_SHORT_GI;
6424 
6425 			mimo_preamble_type = BRCMS_MM_PREAMBLE;
6426 			if (txrate[k]->flags & IEEE80211_TX_RC_GREEN_FIELD)
6427 				mimo_preamble_type = BRCMS_GF_PREAMBLE;
6428 
6429 			if ((txrate[k]->flags & IEEE80211_TX_RC_MCS)
6430 			    && (!is_mcs_rate(rspec[k]))) {
6431 				brcms_warn(wlc->hw->d11core,
6432 					   "wl%d: %s: IEEE80211_TX_RC_MCS != is_mcs_rate(rspec)\n",
6433 					   wlc->pub->unit, __func__);
6434 			}
6435 
6436 			if (is_mcs_rate(rspec[k])) {
6437 				preamble_type[k] = mimo_preamble_type;
6438 
6439 				/*
6440 				 * if SGI is selected, then forced mm
6441 				 * for single stream
6442 				 */
6443 				if ((rspec[k] & RSPEC_SHORT_GI)
6444 				    && is_single_stream(rspec[k] &
6445 							RSPEC_RATE_MASK))
6446 					preamble_type[k] = BRCMS_MM_PREAMBLE;
6447 			}
6448 
6449 			/* should be better conditionalized */
6450 			if (!is_mcs_rate(rspec[0])
6451 			    && (tx_info->control.rates[0].
6452 				flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
6453 				preamble_type[k] = BRCMS_SHORT_PREAMBLE;
6454 		}
6455 	} else {
6456 		for (k = 0; k < hw->max_rates; k++) {
6457 			/* Set ctrlchbw as 20Mhz */
6458 			rspec[k] &= ~RSPEC_BW_MASK;
6459 			rspec[k] |= (PHY_TXC1_BW_20MHZ << RSPEC_BW_SHIFT);
6460 
6461 			/* for nphy, stf of ofdm frames must follow policies */
6462 			if (BRCMS_ISNPHY(wlc->band) && is_ofdm_rate(rspec[k])) {
6463 				rspec[k] &= ~RSPEC_STF_MASK;
6464 				rspec[k] |= phyctl1_stf << RSPEC_STF_SHIFT;
6465 			}
6466 		}
6467 	}
6468 
6469 	/* Reset these for use with AMPDU's */
6470 	txrate[0]->count = 0;
6471 	txrate[1]->count = 0;
6472 
6473 	/* (2) PROTECTION, may change rspec */
6474 	if ((ieee80211_is_data(h->frame_control) ||
6475 	    ieee80211_is_mgmt(h->frame_control)) &&
6476 	    (phylen > wlc->RTSThresh) && !is_multicast_ether_addr(h->addr1))
6477 		use_rts = true;
6478 
6479 	/* (3) PLCP: determine PLCP header and MAC duration,
6480 	 * fill struct d11txh */
6481 	brcms_c_compute_plcp(wlc, rspec[0], phylen, plcp);
6482 	brcms_c_compute_plcp(wlc, rspec[1], phylen, plcp_fallback);
6483 	memcpy(&txh->FragPLCPFallback,
6484 	       plcp_fallback, sizeof(txh->FragPLCPFallback));
6485 
6486 	/* Length field now put in CCK FBR CRC field */
6487 	if (is_cck_rate(rspec[1])) {
6488 		txh->FragPLCPFallback[4] = phylen & 0xff;
6489 		txh->FragPLCPFallback[5] = (phylen & 0xff00) >> 8;
6490 	}
6491 
6492 	/* MIMO-RATE: need validation ?? */
6493 	mainrates = is_ofdm_rate(rspec[0]) ?
6494 			D11A_PHY_HDR_GRATE((struct ofdm_phy_hdr *) plcp) :
6495 			plcp[0];
6496 
6497 	/* DUR field for main rate */
6498 	if (!ieee80211_is_pspoll(h->frame_control) &&
6499 	    !is_multicast_ether_addr(h->addr1) && !use_rifs) {
6500 		durid =
6501 		    brcms_c_compute_frame_dur(wlc, rspec[0], preamble_type[0],
6502 					  next_frag_len);
6503 		h->duration_id = cpu_to_le16(durid);
6504 	} else if (use_rifs) {
6505 		/* NAV protect to end of next max packet size */
6506 		durid =
6507 		    (u16) brcms_c_calc_frame_time(wlc, rspec[0],
6508 						 preamble_type[0],
6509 						 DOT11_MAX_FRAG_LEN);
6510 		durid += RIFS_11N_TIME;
6511 		h->duration_id = cpu_to_le16(durid);
6512 	}
6513 
6514 	/* DUR field for fallback rate */
6515 	if (ieee80211_is_pspoll(h->frame_control))
6516 		txh->FragDurFallback = h->duration_id;
6517 	else if (is_multicast_ether_addr(h->addr1) || use_rifs)
6518 		txh->FragDurFallback = 0;
6519 	else {
6520 		durid = brcms_c_compute_frame_dur(wlc, rspec[1],
6521 					      preamble_type[1], next_frag_len);
6522 		txh->FragDurFallback = cpu_to_le16(durid);
6523 	}
6524 
6525 	/* (4) MAC-HDR: MacTxControlLow */
6526 	if (frag == 0)
6527 		mcl |= TXC_STARTMSDU;
6528 
6529 	if (!is_multicast_ether_addr(h->addr1))
6530 		mcl |= TXC_IMMEDACK;
6531 
6532 	if (wlc->band->bandtype == BRCM_BAND_5G)
6533 		mcl |= TXC_FREQBAND_5G;
6534 
6535 	if (CHSPEC_IS40(wlc_phy_chanspec_get(wlc->band->pi)))
6536 		mcl |= TXC_BW_40;
6537 
6538 	/* set AMIC bit if using hardware TKIP MIC */
6539 	if (hwtkmic)
6540 		mcl |= TXC_AMIC;
6541 
6542 	txh->MacTxControlLow = cpu_to_le16(mcl);
6543 
6544 	/* MacTxControlHigh */
6545 	mch = 0;
6546 
6547 	/* Set fallback rate preamble type */
6548 	if ((preamble_type[1] == BRCMS_SHORT_PREAMBLE) ||
6549 	    (preamble_type[1] == BRCMS_GF_PREAMBLE)) {
6550 		if (rspec2rate(rspec[1]) != BRCM_RATE_1M)
6551 			mch |= TXC_PREAMBLE_DATA_FB_SHORT;
6552 	}
6553 
6554 	/* MacFrameControl */
6555 	memcpy(&txh->MacFrameControl, &h->frame_control, sizeof(u16));
6556 	txh->TxFesTimeNormal = cpu_to_le16(0);
6557 
6558 	txh->TxFesTimeFallback = cpu_to_le16(0);
6559 
6560 	/* TxFrameRA */
6561 	memcpy(&txh->TxFrameRA, &h->addr1, ETH_ALEN);
6562 
6563 	/* TxFrameID */
6564 	txh->TxFrameID = cpu_to_le16(frameid);
6565 
6566 	/*
6567 	 * TxStatus, Note the case of recreating the first frag of a suppressed
6568 	 * frame then we may need to reset the retry cnt's via the status reg
6569 	 */
6570 	txh->TxStatus = cpu_to_le16(status);
6571 
6572 	/*
6573 	 * extra fields for ucode AMPDU aggregation, the new fields are added to
6574 	 * the END of previous structure so that it's compatible in driver.
6575 	 */
6576 	txh->MaxNMpdus = cpu_to_le16(0);
6577 	txh->MaxABytes_MRT = cpu_to_le16(0);
6578 	txh->MaxABytes_FBR = cpu_to_le16(0);
6579 	txh->MinMBytes = cpu_to_le16(0);
6580 
6581 	/* (5) RTS/CTS: determine RTS/CTS PLCP header and MAC duration,
6582 	 * furnish struct d11txh */
6583 	/* RTS PLCP header and RTS frame */
6584 	if (use_rts || use_cts) {
6585 		if (use_rts && use_cts)
6586 			use_cts = false;
6587 
6588 		for (k = 0; k < 2; k++) {
6589 			rts_rspec[k] = brcms_c_rspec_to_rts_rspec(wlc, rspec[k],
6590 							      false,
6591 							      mimo_ctlchbw);
6592 		}
6593 
6594 		if (!is_ofdm_rate(rts_rspec[0]) &&
6595 		    !((rspec2rate(rts_rspec[0]) == BRCM_RATE_1M) ||
6596 		      (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6597 			rts_preamble_type[0] = BRCMS_SHORT_PREAMBLE;
6598 			mch |= TXC_PREAMBLE_RTS_MAIN_SHORT;
6599 		}
6600 
6601 		if (!is_ofdm_rate(rts_rspec[1]) &&
6602 		    !((rspec2rate(rts_rspec[1]) == BRCM_RATE_1M) ||
6603 		      (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6604 			rts_preamble_type[1] = BRCMS_SHORT_PREAMBLE;
6605 			mch |= TXC_PREAMBLE_RTS_FB_SHORT;
6606 		}
6607 
6608 		/* RTS/CTS additions to MacTxControlLow */
6609 		if (use_cts) {
6610 			txh->MacTxControlLow |= cpu_to_le16(TXC_SENDCTS);
6611 		} else {
6612 			txh->MacTxControlLow |= cpu_to_le16(TXC_SENDRTS);
6613 			txh->MacTxControlLow |= cpu_to_le16(TXC_LONGFRAME);
6614 		}
6615 
6616 		/* RTS PLCP header */
6617 		rts_plcp = txh->RTSPhyHeader;
6618 		if (use_cts)
6619 			rts_phylen = DOT11_CTS_LEN + FCS_LEN;
6620 		else
6621 			rts_phylen = DOT11_RTS_LEN + FCS_LEN;
6622 
6623 		brcms_c_compute_plcp(wlc, rts_rspec[0], rts_phylen, rts_plcp);
6624 
6625 		/* fallback rate version of RTS PLCP header */
6626 		brcms_c_compute_plcp(wlc, rts_rspec[1], rts_phylen,
6627 				 rts_plcp_fallback);
6628 		memcpy(&txh->RTSPLCPFallback, rts_plcp_fallback,
6629 		       sizeof(txh->RTSPLCPFallback));
6630 
6631 		/* RTS frame fields... */
6632 		rts = (struct ieee80211_rts *)&txh->rts_frame;
6633 
6634 		durid = brcms_c_compute_rtscts_dur(wlc, use_cts, rts_rspec[0],
6635 					       rspec[0], rts_preamble_type[0],
6636 					       preamble_type[0], phylen, false);
6637 		rts->duration = cpu_to_le16(durid);
6638 		/* fallback rate version of RTS DUR field */
6639 		durid = brcms_c_compute_rtscts_dur(wlc, use_cts,
6640 					       rts_rspec[1], rspec[1],
6641 					       rts_preamble_type[1],
6642 					       preamble_type[1], phylen, false);
6643 		txh->RTSDurFallback = cpu_to_le16(durid);
6644 
6645 		if (use_cts) {
6646 			rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6647 							 IEEE80211_STYPE_CTS);
6648 
6649 			memcpy(&rts->ra, &h->addr2, ETH_ALEN);
6650 		} else {
6651 			rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6652 							 IEEE80211_STYPE_RTS);
6653 
6654 			memcpy(&rts->ra, &h->addr1, 2 * ETH_ALEN);
6655 		}
6656 
6657 		/* mainrate
6658 		 *    low 8 bits: main frag rate/mcs,
6659 		 *    high 8 bits: rts/cts rate/mcs
6660 		 */
6661 		mainrates |= (is_ofdm_rate(rts_rspec[0]) ?
6662 				D11A_PHY_HDR_GRATE(
6663 					(struct ofdm_phy_hdr *) rts_plcp) :
6664 				rts_plcp[0]) << 8;
6665 	} else {
6666 		memset(txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
6667 		memset(&txh->rts_frame, 0, sizeof(struct ieee80211_rts));
6668 		memset(txh->RTSPLCPFallback, 0, sizeof(txh->RTSPLCPFallback));
6669 		txh->RTSDurFallback = 0;
6670 	}
6671 
6672 #ifdef SUPPORT_40MHZ
6673 	/* add null delimiter count */
6674 	if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && is_mcs_rate(rspec))
6675 		txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM] =
6676 		   brcm_c_ampdu_null_delim_cnt(wlc->ampdu, scb, rspec, phylen);
6677 
6678 #endif
6679 
6680 	/*
6681 	 * Now that RTS/RTS FB preamble types are updated, write
6682 	 * the final value
6683 	 */
6684 	txh->MacTxControlHigh = cpu_to_le16(mch);
6685 
6686 	/*
6687 	 * MainRates (both the rts and frag plcp rates have
6688 	 * been calculated now)
6689 	 */
6690 	txh->MainRates = cpu_to_le16(mainrates);
6691 
6692 	/* XtraFrameTypes */
6693 	xfts = frametype(rspec[1], wlc->mimoft);
6694 	xfts |= (frametype(rts_rspec[0], wlc->mimoft) << XFTS_RTS_FT_SHIFT);
6695 	xfts |= (frametype(rts_rspec[1], wlc->mimoft) << XFTS_FBRRTS_FT_SHIFT);
6696 	xfts |= CHSPEC_CHANNEL(wlc_phy_chanspec_get(wlc->band->pi)) <<
6697 							     XFTS_CHANNEL_SHIFT;
6698 	txh->XtraFrameTypes = cpu_to_le16(xfts);
6699 
6700 	/* PhyTxControlWord */
6701 	phyctl = frametype(rspec[0], wlc->mimoft);
6702 	if ((preamble_type[0] == BRCMS_SHORT_PREAMBLE) ||
6703 	    (preamble_type[0] == BRCMS_GF_PREAMBLE)) {
6704 		if (rspec2rate(rspec[0]) != BRCM_RATE_1M)
6705 			phyctl |= PHY_TXC_SHORT_HDR;
6706 	}
6707 
6708 	/* phytxant is properly bit shifted */
6709 	phyctl |= brcms_c_stf_d11hdrs_phyctl_txant(wlc, rspec[0]);
6710 	txh->PhyTxControlWord = cpu_to_le16(phyctl);
6711 
6712 	/* PhyTxControlWord_1 */
6713 	if (BRCMS_PHY_11N_CAP(wlc->band)) {
6714 		u16 phyctl1 = 0;
6715 
6716 		phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[0]);
6717 		txh->PhyTxControlWord_1 = cpu_to_le16(phyctl1);
6718 		phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[1]);
6719 		txh->PhyTxControlWord_1_Fbr = cpu_to_le16(phyctl1);
6720 
6721 		if (use_rts || use_cts) {
6722 			phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[0]);
6723 			txh->PhyTxControlWord_1_Rts = cpu_to_le16(phyctl1);
6724 			phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[1]);
6725 			txh->PhyTxControlWord_1_FbrRts = cpu_to_le16(phyctl1);
6726 		}
6727 
6728 		/*
6729 		 * For mcs frames, if mixedmode(overloaded with long preamble)
6730 		 * is going to be set, fill in non-zero MModeLen and/or
6731 		 * MModeFbrLen it will be unnecessary if they are separated
6732 		 */
6733 		if (is_mcs_rate(rspec[0]) &&
6734 		    (preamble_type[0] == BRCMS_MM_PREAMBLE)) {
6735 			u16 mmodelen =
6736 			    brcms_c_calc_lsig_len(wlc, rspec[0], phylen);
6737 			txh->MModeLen = cpu_to_le16(mmodelen);
6738 		}
6739 
6740 		if (is_mcs_rate(rspec[1]) &&
6741 		    (preamble_type[1] == BRCMS_MM_PREAMBLE)) {
6742 			u16 mmodefbrlen =
6743 			    brcms_c_calc_lsig_len(wlc, rspec[1], phylen);
6744 			txh->MModeFbrLen = cpu_to_le16(mmodefbrlen);
6745 		}
6746 	}
6747 
6748 	ac = skb_get_queue_mapping(p);
6749 	if ((scb->flags & SCB_WMECAP) && qos && wlc->edcf_txop[ac]) {
6750 		uint frag_dur, dur, dur_fallback;
6751 
6752 		/* WME: Update TXOP threshold */
6753 		if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU) && frag == 0) {
6754 			frag_dur =
6755 			    brcms_c_calc_frame_time(wlc, rspec[0],
6756 					preamble_type[0], phylen);
6757 
6758 			if (rts) {
6759 				/* 1 RTS or CTS-to-self frame */
6760 				dur =
6761 				    brcms_c_calc_cts_time(wlc, rts_rspec[0],
6762 						      rts_preamble_type[0]);
6763 				dur_fallback =
6764 				    brcms_c_calc_cts_time(wlc, rts_rspec[1],
6765 						      rts_preamble_type[1]);
6766 				/* (SIFS + CTS) + SIFS + frame + SIFS + ACK */
6767 				dur += le16_to_cpu(rts->duration);
6768 				dur_fallback +=
6769 					le16_to_cpu(txh->RTSDurFallback);
6770 			} else if (use_rifs) {
6771 				dur = frag_dur;
6772 				dur_fallback = 0;
6773 			} else {
6774 				/* frame + SIFS + ACK */
6775 				dur = frag_dur;
6776 				dur +=
6777 				    brcms_c_compute_frame_dur(wlc, rspec[0],
6778 							  preamble_type[0], 0);
6779 
6780 				dur_fallback =
6781 				    brcms_c_calc_frame_time(wlc, rspec[1],
6782 							preamble_type[1],
6783 							phylen);
6784 				dur_fallback +=
6785 				    brcms_c_compute_frame_dur(wlc, rspec[1],
6786 							  preamble_type[1], 0);
6787 			}
6788 			/* NEED to set TxFesTimeNormal (hard) */
6789 			txh->TxFesTimeNormal = cpu_to_le16((u16) dur);
6790 			/*
6791 			 * NEED to set fallback rate version of
6792 			 * TxFesTimeNormal (hard)
6793 			 */
6794 			txh->TxFesTimeFallback =
6795 				cpu_to_le16((u16) dur_fallback);
6796 
6797 			/*
6798 			 * update txop byte threshold (txop minus intraframe
6799 			 * overhead)
6800 			 */
6801 			if (wlc->edcf_txop[ac] >= (dur - frag_dur)) {
6802 				uint newfragthresh;
6803 
6804 				newfragthresh =
6805 				    brcms_c_calc_frame_len(wlc,
6806 					rspec[0], preamble_type[0],
6807 					(wlc->edcf_txop[ac] -
6808 						(dur - frag_dur)));
6809 				/* range bound the fragthreshold */
6810 				if (newfragthresh < DOT11_MIN_FRAG_LEN)
6811 					newfragthresh =
6812 					    DOT11_MIN_FRAG_LEN;
6813 				else if (newfragthresh >
6814 					 wlc->usr_fragthresh)
6815 					newfragthresh =
6816 					    wlc->usr_fragthresh;
6817 				/* update the fragthresh and do txc update */
6818 				if (wlc->fragthresh[queue] !=
6819 				    (u16) newfragthresh)
6820 					wlc->fragthresh[queue] =
6821 					    (u16) newfragthresh;
6822 			} else {
6823 				brcms_warn(wlc->hw->d11core,
6824 					   "wl%d: %s txop invalid for rate %d\n",
6825 					   wlc->pub->unit, fifo_names[queue],
6826 					   rspec2rate(rspec[0]));
6827 			}
6828 
6829 			if (dur > wlc->edcf_txop[ac])
6830 				brcms_warn(wlc->hw->d11core,
6831 					   "wl%d: %s: %s txop exceeded phylen %d/%d dur %d/%d\n",
6832 					   wlc->pub->unit, __func__,
6833 					   fifo_names[queue],
6834 					   phylen, wlc->fragthresh[queue],
6835 					   dur, wlc->edcf_txop[ac]);
6836 		}
6837 	}
6838 
6839 	return 0;
6840 }
6841 
6842 static int brcms_c_tx(struct brcms_c_info *wlc, struct sk_buff *skb)
6843 {
6844 	struct dma_pub *dma;
6845 	int fifo, ret = -ENOSPC;
6846 	struct d11txh *txh;
6847 	u16 frameid = INVALIDFID;
6848 
6849 	fifo = brcms_ac_to_fifo(skb_get_queue_mapping(skb));
6850 	dma = wlc->hw->di[fifo];
6851 	txh = (struct d11txh *)(skb->data);
6852 
6853 	if (dma->txavail == 0) {
6854 		/*
6855 		 * We sometimes get a frame from mac80211 after stopping
6856 		 * the queues. This only ever seems to be a single frame
6857 		 * and is seems likely to be a race. TX_HEADROOM should
6858 		 * ensure that we have enough space to handle these stray
6859 		 * packets, so warn if there isn't. If we're out of space
6860 		 * in the tx ring and the tx queue isn't stopped then
6861 		 * we've really got a bug; warn loudly if that happens.
6862 		 */
6863 		brcms_warn(wlc->hw->d11core,
6864 			   "Received frame for tx with no space in DMA ring\n");
6865 		WARN_ON(!ieee80211_queue_stopped(wlc->pub->ieee_hw,
6866 						 skb_get_queue_mapping(skb)));
6867 		return -ENOSPC;
6868 	}
6869 
6870 	/* When a BC/MC frame is being committed to the BCMC fifo
6871 	 * via DMA (NOT PIO), update ucode or BSS info as appropriate.
6872 	 */
6873 	if (fifo == TX_BCMC_FIFO)
6874 		frameid = le16_to_cpu(txh->TxFrameID);
6875 
6876 	/* Commit BCMC sequence number in the SHM frame ID location */
6877 	if (frameid != INVALIDFID) {
6878 		/*
6879 		 * To inform the ucode of the last mcast frame posted
6880 		 * so that it can clear moredata bit
6881 		 */
6882 		brcms_b_write_shm(wlc->hw, M_BCMC_FID, frameid);
6883 	}
6884 
6885 	ret = brcms_c_txfifo(wlc, fifo, skb);
6886 	/*
6887 	 * The only reason for brcms_c_txfifo to fail is because
6888 	 * there weren't any DMA descriptors, but we've already
6889 	 * checked for that. So if it does fail yell loudly.
6890 	 */
6891 	WARN_ON_ONCE(ret);
6892 
6893 	return ret;
6894 }
6895 
6896 bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
6897 			      struct ieee80211_hw *hw)
6898 {
6899 	uint fifo;
6900 	struct scb *scb = &wlc->pri_scb;
6901 
6902 	fifo = brcms_ac_to_fifo(skb_get_queue_mapping(sdu));
6903 	brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0);
6904 	if (!brcms_c_tx(wlc, sdu))
6905 		return true;
6906 
6907 	/* packet discarded */
6908 	dev_kfree_skb_any(sdu);
6909 	return false;
6910 }
6911 
6912 int
6913 brcms_c_txfifo(struct brcms_c_info *wlc, uint fifo, struct sk_buff *p)
6914 {
6915 	struct dma_pub *dma = wlc->hw->di[fifo];
6916 	int ret;
6917 	u16 queue;
6918 
6919 	ret = dma_txfast(wlc, dma, p);
6920 	if (ret	< 0)
6921 		wiphy_err(wlc->wiphy, "txfifo: fatal, toss frames !!!\n");
6922 
6923 	/*
6924 	 * Stop queue if DMA ring is full. Reserve some free descriptors,
6925 	 * as we sometimes receive a frame from mac80211 after the queues
6926 	 * are stopped.
6927 	 */
6928 	queue = skb_get_queue_mapping(p);
6929 	if (dma->txavail <= TX_HEADROOM && fifo < TX_BCMC_FIFO &&
6930 	    !ieee80211_queue_stopped(wlc->pub->ieee_hw, queue))
6931 		ieee80211_stop_queue(wlc->pub->ieee_hw, queue);
6932 
6933 	return ret;
6934 }
6935 
6936 u32
6937 brcms_c_rspec_to_rts_rspec(struct brcms_c_info *wlc, u32 rspec,
6938 			   bool use_rspec, u16 mimo_ctlchbw)
6939 {
6940 	u32 rts_rspec = 0;
6941 
6942 	if (use_rspec)
6943 		/* use frame rate as rts rate */
6944 		rts_rspec = rspec;
6945 	else if (wlc->band->gmode && wlc->protection->_g && !is_cck_rate(rspec))
6946 		/* Use 11Mbps as the g protection RTS target rate and fallback.
6947 		 * Use the brcms_basic_rate() lookup to find the best basic rate
6948 		 * under the target in case 11 Mbps is not Basic.
6949 		 * 6 and 9 Mbps are not usually selected by rate selection, but
6950 		 * even if the OFDM rate we are protecting is 6 or 9 Mbps, 11
6951 		 * is more robust.
6952 		 */
6953 		rts_rspec = brcms_basic_rate(wlc, BRCM_RATE_11M);
6954 	else
6955 		/* calculate RTS rate and fallback rate based on the frame rate
6956 		 * RTS must be sent at a basic rate since it is a
6957 		 * control frame, sec 9.6 of 802.11 spec
6958 		 */
6959 		rts_rspec = brcms_basic_rate(wlc, rspec);
6960 
6961 	if (BRCMS_PHY_11N_CAP(wlc->band)) {
6962 		/* set rts txbw to correct side band */
6963 		rts_rspec &= ~RSPEC_BW_MASK;
6964 
6965 		/*
6966 		 * if rspec/rspec_fallback is 40MHz, then send RTS on both
6967 		 * 20MHz channel (DUP), otherwise send RTS on control channel
6968 		 */
6969 		if (rspec_is40mhz(rspec) && !is_cck_rate(rts_rspec))
6970 			rts_rspec |= (PHY_TXC1_BW_40MHZ_DUP << RSPEC_BW_SHIFT);
6971 		else
6972 			rts_rspec |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
6973 
6974 		/* pick siso/cdd as default for ofdm */
6975 		if (is_ofdm_rate(rts_rspec)) {
6976 			rts_rspec &= ~RSPEC_STF_MASK;
6977 			rts_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
6978 		}
6979 	}
6980 	return rts_rspec;
6981 }
6982 
6983 /* Update beacon listen interval in shared memory */
6984 static void brcms_c_bcn_li_upd(struct brcms_c_info *wlc)
6985 {
6986 	/* wake up every DTIM is the default */
6987 	if (wlc->bcn_li_dtim == 1)
6988 		brcms_b_write_shm(wlc->hw, M_BCN_LI, 0);
6989 	else
6990 		brcms_b_write_shm(wlc->hw, M_BCN_LI,
6991 			      (wlc->bcn_li_dtim << 8) | wlc->bcn_li_bcn);
6992 }
6993 
6994 static void
6995 brcms_b_read_tsf(struct brcms_hardware *wlc_hw, u32 *tsf_l_ptr,
6996 		  u32 *tsf_h_ptr)
6997 {
6998 	struct bcma_device *core = wlc_hw->d11core;
6999 
7000 	/* read the tsf timer low, then high to get an atomic read */
7001 	*tsf_l_ptr = bcma_read32(core, D11REGOFFS(tsf_timerlow));
7002 	*tsf_h_ptr = bcma_read32(core, D11REGOFFS(tsf_timerhigh));
7003 }
7004 
7005 /*
7006  * recover 64bit TSF value from the 16bit TSF value in the rx header
7007  * given the assumption that the TSF passed in header is within 65ms
7008  * of the current tsf.
7009  *
7010  * 6       5       4       4       3       2       1
7011  * 3.......6.......8.......0.......2.......4.......6.......8......0
7012  * |<---------- tsf_h ----------->||<--- tsf_l -->||<-RxTSFTime ->|
7013  *
7014  * The RxTSFTime are the lowest 16 bits and provided by the ucode. The
7015  * tsf_l is filled in by brcms_b_recv, which is done earlier in the
7016  * receive call sequence after rx interrupt. Only the higher 16 bits
7017  * are used. Finally, the tsf_h is read from the tsf register.
7018  */
7019 static u64 brcms_c_recover_tsf64(struct brcms_c_info *wlc,
7020 				 struct d11rxhdr *rxh)
7021 {
7022 	u32 tsf_h, tsf_l;
7023 	u16 rx_tsf_0_15, rx_tsf_16_31;
7024 
7025 	brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7026 
7027 	rx_tsf_16_31 = (u16)(tsf_l >> 16);
7028 	rx_tsf_0_15 = rxh->RxTSFTime;
7029 
7030 	/*
7031 	 * a greater tsf time indicates the low 16 bits of
7032 	 * tsf_l wrapped, so decrement the high 16 bits.
7033 	 */
7034 	if ((u16)tsf_l < rx_tsf_0_15) {
7035 		rx_tsf_16_31 -= 1;
7036 		if (rx_tsf_16_31 == 0xffff)
7037 			tsf_h -= 1;
7038 	}
7039 
7040 	return ((u64)tsf_h << 32) | (((u32)rx_tsf_16_31 << 16) + rx_tsf_0_15);
7041 }
7042 
7043 static void
7044 prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7045 		     struct sk_buff *p,
7046 		     struct ieee80211_rx_status *rx_status)
7047 {
7048 	int channel;
7049 	u32 rspec;
7050 	unsigned char *plcp;
7051 
7052 	/* fill in TSF and flag its presence */
7053 	rx_status->mactime = brcms_c_recover_tsf64(wlc, rxh);
7054 	rx_status->flag |= RX_FLAG_MACTIME_START;
7055 
7056 	channel = BRCMS_CHAN_CHANNEL(rxh->RxChan);
7057 
7058 	rx_status->band =
7059 		channel > 14 ? NL80211_BAND_5GHZ : NL80211_BAND_2GHZ;
7060 	rx_status->freq =
7061 		ieee80211_channel_to_frequency(channel, rx_status->band);
7062 
7063 	rx_status->signal = wlc_phy_rssi_compute(wlc->hw->band->pi, rxh);
7064 
7065 	/* noise */
7066 	/* qual */
7067 	rx_status->antenna =
7068 		(rxh->PhyRxStatus_0 & PRXS0_RXANT_UPSUBBAND) ? 1 : 0;
7069 
7070 	plcp = p->data;
7071 
7072 	rspec = brcms_c_compute_rspec(rxh, plcp);
7073 	if (is_mcs_rate(rspec)) {
7074 		rx_status->rate_idx = rspec & RSPEC_RATE_MASK;
7075 		rx_status->encoding = RX_ENC_HT;
7076 		if (rspec_is40mhz(rspec))
7077 			rx_status->bw = RATE_INFO_BW_40;
7078 	} else {
7079 		switch (rspec2rate(rspec)) {
7080 		case BRCM_RATE_1M:
7081 			rx_status->rate_idx = 0;
7082 			break;
7083 		case BRCM_RATE_2M:
7084 			rx_status->rate_idx = 1;
7085 			break;
7086 		case BRCM_RATE_5M5:
7087 			rx_status->rate_idx = 2;
7088 			break;
7089 		case BRCM_RATE_11M:
7090 			rx_status->rate_idx = 3;
7091 			break;
7092 		case BRCM_RATE_6M:
7093 			rx_status->rate_idx = 4;
7094 			break;
7095 		case BRCM_RATE_9M:
7096 			rx_status->rate_idx = 5;
7097 			break;
7098 		case BRCM_RATE_12M:
7099 			rx_status->rate_idx = 6;
7100 			break;
7101 		case BRCM_RATE_18M:
7102 			rx_status->rate_idx = 7;
7103 			break;
7104 		case BRCM_RATE_24M:
7105 			rx_status->rate_idx = 8;
7106 			break;
7107 		case BRCM_RATE_36M:
7108 			rx_status->rate_idx = 9;
7109 			break;
7110 		case BRCM_RATE_48M:
7111 			rx_status->rate_idx = 10;
7112 			break;
7113 		case BRCM_RATE_54M:
7114 			rx_status->rate_idx = 11;
7115 			break;
7116 		default:
7117 			brcms_err(wlc->hw->d11core,
7118 				  "%s: Unknown rate\n", __func__);
7119 		}
7120 
7121 		/*
7122 		 * For 5GHz, we should decrease the index as it is
7123 		 * a subset of the 2.4G rates. See bitrates field
7124 		 * of brcms_band_5GHz_nphy (in mac80211_if.c).
7125 		 */
7126 		if (rx_status->band == NL80211_BAND_5GHZ)
7127 			rx_status->rate_idx -= BRCMS_LEGACY_5G_RATE_OFFSET;
7128 
7129 		/* Determine short preamble and rate_idx */
7130 		if (is_cck_rate(rspec)) {
7131 			if (rxh->PhyRxStatus_0 & PRXS0_SHORTH)
7132 				rx_status->enc_flags |= RX_ENC_FLAG_SHORTPRE;
7133 		} else if (is_ofdm_rate(rspec)) {
7134 			rx_status->enc_flags |= RX_ENC_FLAG_SHORTPRE;
7135 		} else {
7136 			brcms_err(wlc->hw->d11core, "%s: Unknown modulation\n",
7137 				  __func__);
7138 		}
7139 	}
7140 
7141 	if (plcp3_issgi(plcp[3]))
7142 		rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
7143 
7144 	if (rxh->RxStatus1 & RXS_DECERR) {
7145 		rx_status->flag |= RX_FLAG_FAILED_PLCP_CRC;
7146 		brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_PLCP_CRC\n",
7147 			  __func__);
7148 	}
7149 	if (rxh->RxStatus1 & RXS_FCSERR) {
7150 		rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
7151 		brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_FCS_CRC\n",
7152 			  __func__);
7153 	}
7154 }
7155 
7156 static void
7157 brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7158 		struct sk_buff *p)
7159 {
7160 	int len_mpdu;
7161 	struct ieee80211_rx_status rx_status;
7162 	struct ieee80211_hdr *hdr;
7163 
7164 	memset(&rx_status, 0, sizeof(rx_status));
7165 	prep_mac80211_status(wlc, rxh, p, &rx_status);
7166 
7167 	/* mac header+body length, exclude CRC and plcp header */
7168 	len_mpdu = p->len - D11_PHY_HDR_LEN - FCS_LEN;
7169 	skb_pull(p, D11_PHY_HDR_LEN);
7170 	__skb_trim(p, len_mpdu);
7171 
7172 	/* unmute transmit */
7173 	if (wlc->hw->suspended_fifos) {
7174 		hdr = (struct ieee80211_hdr *)p->data;
7175 		if (ieee80211_is_beacon(hdr->frame_control))
7176 			brcms_b_mute(wlc->hw, false);
7177 	}
7178 
7179 	memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
7180 	ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
7181 }
7182 
7183 /* calculate frame duration for Mixed-mode L-SIG spoofing, return
7184  * number of bytes goes in the length field
7185  *
7186  * Formula given by HT PHY Spec v 1.13
7187  *   len = 3(nsyms + nstream + 3) - 3
7188  */
7189 u16
7190 brcms_c_calc_lsig_len(struct brcms_c_info *wlc, u32 ratespec,
7191 		      uint mac_len)
7192 {
7193 	uint nsyms, len = 0, kNdps;
7194 
7195 	if (is_mcs_rate(ratespec)) {
7196 		uint mcs = ratespec & RSPEC_RATE_MASK;
7197 		int tot_streams = (mcs_2_txstreams(mcs) + 1) +
7198 				  rspec_stc(ratespec);
7199 
7200 		/*
7201 		 * the payload duration calculation matches that
7202 		 * of regular ofdm
7203 		 */
7204 		/* 1000Ndbps = kbps * 4 */
7205 		kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
7206 				   rspec_issgi(ratespec)) * 4;
7207 
7208 		if (rspec_stc(ratespec) == 0)
7209 			nsyms =
7210 			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7211 				  APHY_TAIL_NBITS) * 1000, kNdps);
7212 		else
7213 			/* STBC needs to have even number of symbols */
7214 			nsyms =
7215 			    2 *
7216 			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7217 				  APHY_TAIL_NBITS) * 1000, 2 * kNdps);
7218 
7219 		/* (+3) account for HT-SIG(2) and HT-STF(1) */
7220 		nsyms += (tot_streams + 3);
7221 		/*
7222 		 * 3 bytes/symbol @ legacy 6Mbps rate
7223 		 * (-3) excluding service bits and tail bits
7224 		 */
7225 		len = (3 * nsyms) - 3;
7226 	}
7227 
7228 	return (u16) len;
7229 }
7230 
7231 static void
7232 brcms_c_mod_prb_rsp_rate_table(struct brcms_c_info *wlc, uint frame_len)
7233 {
7234 	const struct brcms_c_rateset *rs_dflt;
7235 	struct brcms_c_rateset rs;
7236 	u8 rate;
7237 	u16 entry_ptr;
7238 	u8 plcp[D11_PHY_HDR_LEN];
7239 	u16 dur, sifs;
7240 	uint i;
7241 
7242 	sifs = get_sifs(wlc->band);
7243 
7244 	rs_dflt = brcms_c_rateset_get_hwrs(wlc);
7245 
7246 	brcms_c_rateset_copy(rs_dflt, &rs);
7247 	brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
7248 
7249 	/*
7250 	 * walk the phy rate table and update MAC core SHM
7251 	 * basic rate table entries
7252 	 */
7253 	for (i = 0; i < rs.count; i++) {
7254 		rate = rs.rates[i] & BRCMS_RATE_MASK;
7255 
7256 		entry_ptr = brcms_b_rate_shm_offset(wlc->hw, rate);
7257 
7258 		/* Calculate the Probe Response PLCP for the given rate */
7259 		brcms_c_compute_plcp(wlc, rate, frame_len, plcp);
7260 
7261 		/*
7262 		 * Calculate the duration of the Probe Response
7263 		 * frame plus SIFS for the MAC
7264 		 */
7265 		dur = (u16) brcms_c_calc_frame_time(wlc, rate,
7266 						BRCMS_LONG_PREAMBLE, frame_len);
7267 		dur += sifs;
7268 
7269 		/* Update the SHM Rate Table entry Probe Response values */
7270 		brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS,
7271 			      (u16) (plcp[0] + (plcp[1] << 8)));
7272 		brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS + 2,
7273 			      (u16) (plcp[2] + (plcp[3] << 8)));
7274 		brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_DUR_POS, dur);
7275 	}
7276 }
7277 
7278 int brcms_c_get_header_len(void)
7279 {
7280 	return TXOFF;
7281 }
7282 
7283 static void brcms_c_beacon_write(struct brcms_c_info *wlc,
7284 				 struct sk_buff *beacon, u16 tim_offset,
7285 				 u16 dtim_period, bool bcn0, bool bcn1)
7286 {
7287 	size_t len;
7288 	struct ieee80211_tx_info *tx_info;
7289 	struct brcms_hardware *wlc_hw = wlc->hw;
7290 	struct ieee80211_hw *ieee_hw = brcms_c_pub(wlc)->ieee_hw;
7291 
7292 	/* Get tx_info */
7293 	tx_info = IEEE80211_SKB_CB(beacon);
7294 
7295 	len = min_t(size_t, beacon->len, BCN_TMPL_LEN);
7296 	wlc->bcn_rspec = ieee80211_get_tx_rate(ieee_hw, tx_info)->hw_value;
7297 
7298 	brcms_c_compute_plcp(wlc, wlc->bcn_rspec,
7299 			     len + FCS_LEN - D11_PHY_HDR_LEN, beacon->data);
7300 
7301 	/* "Regular" and 16 MBSS but not for 4 MBSS */
7302 	/* Update the phytxctl for the beacon based on the rspec */
7303 	brcms_c_beacon_phytxctl_txant_upd(wlc, wlc->bcn_rspec);
7304 
7305 	if (bcn0) {
7306 		/* write the probe response into the template region */
7307 		brcms_b_write_template_ram(wlc_hw, T_BCN0_TPL_BASE,
7308 					    (len + 3) & ~3, beacon->data);
7309 
7310 		/* write beacon length to SCR */
7311 		brcms_b_write_shm(wlc_hw, M_BCN0_FRM_BYTESZ, (u16) len);
7312 	}
7313 	if (bcn1) {
7314 		/* write the probe response into the template region */
7315 		brcms_b_write_template_ram(wlc_hw, T_BCN1_TPL_BASE,
7316 					    (len + 3) & ~3, beacon->data);
7317 
7318 		/* write beacon length to SCR */
7319 		brcms_b_write_shm(wlc_hw, M_BCN1_FRM_BYTESZ, (u16) len);
7320 	}
7321 
7322 	if (tim_offset != 0) {
7323 		brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
7324 				  tim_offset + D11B_PHY_HDR_LEN);
7325 		brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, dtim_period);
7326 	} else {
7327 		brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
7328 				  len + D11B_PHY_HDR_LEN);
7329 		brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, 0);
7330 	}
7331 }
7332 
7333 static void brcms_c_update_beacon_hw(struct brcms_c_info *wlc,
7334 				     struct sk_buff *beacon, u16 tim_offset,
7335 				     u16 dtim_period)
7336 {
7337 	struct brcms_hardware *wlc_hw = wlc->hw;
7338 	struct bcma_device *core = wlc_hw->d11core;
7339 
7340 	/* Hardware beaconing for this config */
7341 	u32 both_valid = MCMD_BCN0VLD | MCMD_BCN1VLD;
7342 
7343 	/* Check if both templates are in use, if so sched. an interrupt
7344 	 *      that will call back into this routine
7345 	 */
7346 	if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid)
7347 		/* clear any previous status */
7348 		bcma_write32(core, D11REGOFFS(macintstatus), MI_BCNTPL);
7349 
7350 	if (wlc->beacon_template_virgin) {
7351 		wlc->beacon_template_virgin = false;
7352 		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
7353 				     true);
7354 		/* mark beacon0 valid */
7355 		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
7356 		return;
7357 	}
7358 
7359 	/* Check that after scheduling the interrupt both of the
7360 	 *      templates are still busy. if not clear the int. & remask
7361 	 */
7362 	if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid) {
7363 		wlc->defmacintmask |= MI_BCNTPL;
7364 		return;
7365 	}
7366 
7367 	if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN0VLD)) {
7368 		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
7369 				     false);
7370 		/* mark beacon0 valid */
7371 		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
7372 		return;
7373 	}
7374 	if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN1VLD)) {
7375 		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period,
7376 				     false, true);
7377 		/* mark beacon0 valid */
7378 		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN1VLD);
7379 	}
7380 }
7381 
7382 /*
7383  * Update all beacons for the system.
7384  */
7385 void brcms_c_update_beacon(struct brcms_c_info *wlc)
7386 {
7387 	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7388 
7389 	if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
7390 			     bsscfg->type == BRCMS_TYPE_ADHOC)) {
7391 		/* Clear the soft intmask */
7392 		wlc->defmacintmask &= ~MI_BCNTPL;
7393 		if (!wlc->beacon)
7394 			return;
7395 		brcms_c_update_beacon_hw(wlc, wlc->beacon,
7396 					 wlc->beacon_tim_offset,
7397 					 wlc->beacon_dtim_period);
7398 	}
7399 }
7400 
7401 void brcms_c_set_new_beacon(struct brcms_c_info *wlc, struct sk_buff *beacon,
7402 			    u16 tim_offset, u16 dtim_period)
7403 {
7404 	if (!beacon)
7405 		return;
7406 	if (wlc->beacon)
7407 		dev_kfree_skb_any(wlc->beacon);
7408 	wlc->beacon = beacon;
7409 
7410 	/* add PLCP */
7411 	skb_push(wlc->beacon, D11_PHY_HDR_LEN);
7412 	wlc->beacon_tim_offset = tim_offset;
7413 	wlc->beacon_dtim_period = dtim_period;
7414 	brcms_c_update_beacon(wlc);
7415 }
7416 
7417 void brcms_c_set_new_probe_resp(struct brcms_c_info *wlc,
7418 				struct sk_buff *probe_resp)
7419 {
7420 	if (!probe_resp)
7421 		return;
7422 	if (wlc->probe_resp)
7423 		dev_kfree_skb_any(wlc->probe_resp);
7424 	wlc->probe_resp = probe_resp;
7425 
7426 	/* add PLCP */
7427 	skb_push(wlc->probe_resp, D11_PHY_HDR_LEN);
7428 	brcms_c_update_probe_resp(wlc, false);
7429 }
7430 
7431 void brcms_c_enable_probe_resp(struct brcms_c_info *wlc, bool enable)
7432 {
7433 	/*
7434 	 * prevent ucode from sending probe responses by setting the timeout
7435 	 * to 1, it can not send it in that time frame.
7436 	 */
7437 	wlc->prb_resp_timeout = enable ? BRCMS_PRB_RESP_TIMEOUT : 1;
7438 	brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
7439 	/* TODO: if (enable) => also deactivate receiving of probe request */
7440 }
7441 
7442 /* Write ssid into shared memory */
7443 static void
7444 brcms_c_shm_ssid_upd(struct brcms_c_info *wlc, struct brcms_bss_cfg *cfg)
7445 {
7446 	u8 *ssidptr = cfg->SSID;
7447 	u16 base = M_SSID;
7448 	u8 ssidbuf[IEEE80211_MAX_SSID_LEN];
7449 
7450 	/* padding the ssid with zero and copy it into shm */
7451 	memset(ssidbuf, 0, IEEE80211_MAX_SSID_LEN);
7452 	memcpy(ssidbuf, ssidptr, cfg->SSID_len);
7453 
7454 	brcms_c_copyto_shm(wlc, base, ssidbuf, IEEE80211_MAX_SSID_LEN);
7455 	brcms_b_write_shm(wlc->hw, M_SSIDLEN, (u16) cfg->SSID_len);
7456 }
7457 
7458 static void
7459 brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
7460 			      struct brcms_bss_cfg *cfg,
7461 			      struct sk_buff *probe_resp,
7462 			      bool suspend)
7463 {
7464 	int len;
7465 
7466 	len = min_t(size_t, probe_resp->len, BCN_TMPL_LEN);
7467 
7468 	if (suspend)
7469 		brcms_c_suspend_mac_and_wait(wlc);
7470 
7471 	/* write the probe response into the template region */
7472 	brcms_b_write_template_ram(wlc->hw, T_PRS_TPL_BASE,
7473 				    (len + 3) & ~3, probe_resp->data);
7474 
7475 	/* write the length of the probe response frame (+PLCP/-FCS) */
7476 	brcms_b_write_shm(wlc->hw, M_PRB_RESP_FRM_LEN, (u16) len);
7477 
7478 	/* write the SSID and SSID length */
7479 	brcms_c_shm_ssid_upd(wlc, cfg);
7480 
7481 	/*
7482 	 * Write PLCP headers and durations for probe response frames
7483 	 * at all rates. Use the actual frame length covered by the
7484 	 * PLCP header for the call to brcms_c_mod_prb_rsp_rate_table()
7485 	 * by subtracting the PLCP len and adding the FCS.
7486 	 */
7487 	brcms_c_mod_prb_rsp_rate_table(wlc,
7488 				      (u16)len + FCS_LEN - D11_PHY_HDR_LEN);
7489 
7490 	if (suspend)
7491 		brcms_c_enable_mac(wlc);
7492 }
7493 
7494 void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
7495 {
7496 	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7497 
7498 	/* update AP or IBSS probe responses */
7499 	if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
7500 			     bsscfg->type == BRCMS_TYPE_ADHOC)) {
7501 		if (!wlc->probe_resp)
7502 			return;
7503 		brcms_c_bss_update_probe_resp(wlc, bsscfg, wlc->probe_resp,
7504 					      suspend);
7505 	}
7506 }
7507 
7508 int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo,
7509 			   uint *blocks)
7510 {
7511 	if (fifo >= NFIFO)
7512 		return -EINVAL;
7513 
7514 	*blocks = wlc_hw->xmtfifo_sz[fifo];
7515 
7516 	return 0;
7517 }
7518 
7519 void
7520 brcms_c_set_addrmatch(struct brcms_c_info *wlc, int match_reg_offset,
7521 		  const u8 *addr)
7522 {
7523 	brcms_b_set_addrmatch(wlc->hw, match_reg_offset, addr);
7524 	if (match_reg_offset == RCM_BSSID_OFFSET)
7525 		memcpy(wlc->bsscfg->BSSID, addr, ETH_ALEN);
7526 }
7527 
7528 /*
7529  * Flag 'scan in progress' to withhold dynamic phy calibration
7530  */
7531 void brcms_c_scan_start(struct brcms_c_info *wlc)
7532 {
7533 	wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, true);
7534 }
7535 
7536 void brcms_c_scan_stop(struct brcms_c_info *wlc)
7537 {
7538 	wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, false);
7539 }
7540 
7541 void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state)
7542 {
7543 	wlc->pub->associated = state;
7544 }
7545 
7546 /*
7547  * When a remote STA/AP is removed by Mac80211, or when it can no longer accept
7548  * AMPDU traffic, packets pending in hardware have to be invalidated so that
7549  * when later on hardware releases them, they can be handled appropriately.
7550  */
7551 void brcms_c_inval_dma_pkts(struct brcms_hardware *hw,
7552 			       struct ieee80211_sta *sta,
7553 			       void (*dma_callback_fn))
7554 {
7555 	struct dma_pub *dmah;
7556 	int i;
7557 	for (i = 0; i < NFIFO; i++) {
7558 		dmah = hw->di[i];
7559 		if (dmah != NULL)
7560 			dma_walk_packets(dmah, dma_callback_fn, sta);
7561 	}
7562 }
7563 
7564 int brcms_c_get_curband(struct brcms_c_info *wlc)
7565 {
7566 	return wlc->band->bandunit;
7567 }
7568 
7569 bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc)
7570 {
7571 	int i;
7572 
7573 	/* Kick DMA to send any pending AMPDU */
7574 	for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
7575 		if (wlc->hw->di[i])
7576 			dma_kick_tx(wlc->hw->di[i]);
7577 
7578 	return !brcms_txpktpendtot(wlc);
7579 }
7580 
7581 void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
7582 {
7583 	wlc->bcn_li_bcn = interval;
7584 	if (wlc->pub->up)
7585 		brcms_c_bcn_li_upd(wlc);
7586 }
7587 
7588 u64 brcms_c_tsf_get(struct brcms_c_info *wlc)
7589 {
7590 	u32 tsf_h, tsf_l;
7591 	u64 tsf;
7592 
7593 	brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7594 
7595 	tsf = tsf_h;
7596 	tsf <<= 32;
7597 	tsf |= tsf_l;
7598 
7599 	return tsf;
7600 }
7601 
7602 void brcms_c_tsf_set(struct brcms_c_info *wlc, u64 tsf)
7603 {
7604 	u32 tsf_h, tsf_l;
7605 
7606 	brcms_c_time_lock(wlc);
7607 
7608 	tsf_l = tsf;
7609 	tsf_h = (tsf >> 32);
7610 
7611 	/* read the tsf timer low, then high to get an atomic read */
7612 	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerlow), tsf_l);
7613 	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerhigh), tsf_h);
7614 
7615 	brcms_c_time_unlock(wlc);
7616 }
7617 
7618 int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr)
7619 {
7620 	uint qdbm;
7621 
7622 	/* Remove override bit and clip to max qdbm value */
7623 	qdbm = min_t(uint, txpwr * BRCMS_TXPWR_DB_FACTOR, 0xff);
7624 	return wlc_phy_txpower_set(wlc->band->pi, qdbm, false);
7625 }
7626 
7627 int brcms_c_get_tx_power(struct brcms_c_info *wlc)
7628 {
7629 	uint qdbm;
7630 	bool override;
7631 
7632 	wlc_phy_txpower_get(wlc->band->pi, &qdbm, &override);
7633 
7634 	/* Return qdbm units */
7635 	return (int)(qdbm / BRCMS_TXPWR_DB_FACTOR);
7636 }
7637 
7638 /* Process received frames */
7639 /*
7640  * Return true if more frames need to be processed. false otherwise.
7641  * Param 'bound' indicates max. # frames to process before break out.
7642  */
7643 static void brcms_c_recv(struct brcms_c_info *wlc, struct sk_buff *p)
7644 {
7645 	struct d11rxhdr *rxh;
7646 	struct ieee80211_hdr *h;
7647 	uint len;
7648 	bool is_amsdu;
7649 
7650 	/* frame starts with rxhdr */
7651 	rxh = (struct d11rxhdr *) (p->data);
7652 
7653 	/* strip off rxhdr */
7654 	skb_pull(p, BRCMS_HWRXOFF);
7655 
7656 	/* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU subframes */
7657 	if (rxh->RxStatus1 & RXS_PBPRES) {
7658 		if (p->len < 2) {
7659 			brcms_err(wlc->hw->d11core,
7660 				  "wl%d: recv: rcvd runt of len %d\n",
7661 				  wlc->pub->unit, p->len);
7662 			goto toss;
7663 		}
7664 		skb_pull(p, 2);
7665 	}
7666 
7667 	h = (struct ieee80211_hdr *)(p->data + D11_PHY_HDR_LEN);
7668 	len = p->len;
7669 
7670 	if (rxh->RxStatus1 & RXS_FCSERR) {
7671 		if (!(wlc->filter_flags & FIF_FCSFAIL))
7672 			goto toss;
7673 	}
7674 
7675 	/* check received pkt has at least frame control field */
7676 	if (len < D11_PHY_HDR_LEN + sizeof(h->frame_control))
7677 		goto toss;
7678 
7679 	/* not supporting A-MSDU */
7680 	is_amsdu = rxh->RxStatus2 & RXS_AMSDU_MASK;
7681 	if (is_amsdu)
7682 		goto toss;
7683 
7684 	brcms_c_recvctl(wlc, rxh, p);
7685 	return;
7686 
7687  toss:
7688 	brcmu_pkt_buf_free_skb(p);
7689 }
7690 
7691 /* Process received frames */
7692 /*
7693  * Return true if more frames need to be processed. false otherwise.
7694  * Param 'bound' indicates max. # frames to process before break out.
7695  */
7696 static bool
7697 brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
7698 {
7699 	struct sk_buff *p;
7700 	struct sk_buff *next = NULL;
7701 	struct sk_buff_head recv_frames;
7702 
7703 	uint n = 0;
7704 	uint bound_limit = bound ? RXBND : -1;
7705 	bool morepending = false;
7706 
7707 	skb_queue_head_init(&recv_frames);
7708 
7709 	/* gather received frames */
7710 	do {
7711 		/* !give others some time to run! */
7712 		if (n >= bound_limit)
7713 			break;
7714 
7715 		morepending = dma_rx(wlc_hw->di[fifo], &recv_frames);
7716 		n++;
7717 	} while (morepending);
7718 
7719 	/* post more rbufs */
7720 	dma_rxfill(wlc_hw->di[fifo]);
7721 
7722 	/* process each frame */
7723 	skb_queue_walk_safe(&recv_frames, p, next) {
7724 		struct d11rxhdr_le *rxh_le;
7725 		struct d11rxhdr *rxh;
7726 
7727 		skb_unlink(p, &recv_frames);
7728 		rxh_le = (struct d11rxhdr_le *)p->data;
7729 		rxh = (struct d11rxhdr *)p->data;
7730 
7731 		/* fixup rx header endianness */
7732 		rxh->RxFrameSize = le16_to_cpu(rxh_le->RxFrameSize);
7733 		rxh->PhyRxStatus_0 = le16_to_cpu(rxh_le->PhyRxStatus_0);
7734 		rxh->PhyRxStatus_1 = le16_to_cpu(rxh_le->PhyRxStatus_1);
7735 		rxh->PhyRxStatus_2 = le16_to_cpu(rxh_le->PhyRxStatus_2);
7736 		rxh->PhyRxStatus_3 = le16_to_cpu(rxh_le->PhyRxStatus_3);
7737 		rxh->PhyRxStatus_4 = le16_to_cpu(rxh_le->PhyRxStatus_4);
7738 		rxh->PhyRxStatus_5 = le16_to_cpu(rxh_le->PhyRxStatus_5);
7739 		rxh->RxStatus1 = le16_to_cpu(rxh_le->RxStatus1);
7740 		rxh->RxStatus2 = le16_to_cpu(rxh_le->RxStatus2);
7741 		rxh->RxTSFTime = le16_to_cpu(rxh_le->RxTSFTime);
7742 		rxh->RxChan = le16_to_cpu(rxh_le->RxChan);
7743 
7744 		brcms_c_recv(wlc_hw->wlc, p);
7745 	}
7746 
7747 	return morepending;
7748 }
7749 
7750 /* second-level interrupt processing
7751  *   Return true if another dpc needs to be re-scheduled. false otherwise.
7752  *   Param 'bounded' indicates if applicable loops should be bounded.
7753  */
7754 bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded)
7755 {
7756 	u32 macintstatus;
7757 	struct brcms_hardware *wlc_hw = wlc->hw;
7758 	struct bcma_device *core = wlc_hw->d11core;
7759 
7760 	if (brcms_deviceremoved(wlc)) {
7761 		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
7762 			  __func__);
7763 		brcms_down(wlc->wl);
7764 		return false;
7765 	}
7766 
7767 	/* grab and clear the saved software intstatus bits */
7768 	macintstatus = wlc->macintstatus;
7769 	wlc->macintstatus = 0;
7770 
7771 	brcms_dbg_int(core, "wl%d: macintstatus 0x%x\n",
7772 		      wlc_hw->unit, macintstatus);
7773 
7774 	WARN_ON(macintstatus & MI_PRQ); /* PRQ Interrupt in non-MBSS */
7775 
7776 	/* tx status */
7777 	if (macintstatus & MI_TFS) {
7778 		bool fatal;
7779 		if (brcms_b_txstatus(wlc->hw, bounded, &fatal))
7780 			wlc->macintstatus |= MI_TFS;
7781 		if (fatal) {
7782 			brcms_err(core, "MI_TFS: fatal\n");
7783 			goto fatal;
7784 		}
7785 	}
7786 
7787 	if (macintstatus & (MI_TBTT | MI_DTIM_TBTT))
7788 		brcms_c_tbtt(wlc);
7789 
7790 	/* ATIM window end */
7791 	if (macintstatus & MI_ATIMWINEND) {
7792 		brcms_dbg_info(core, "end of ATIM window\n");
7793 		bcma_set32(core, D11REGOFFS(maccommand), wlc->qvalid);
7794 		wlc->qvalid = 0;
7795 	}
7796 
7797 	/*
7798 	 * received data or control frame, MI_DMAINT is
7799 	 * indication of RX_FIFO interrupt
7800 	 */
7801 	if (macintstatus & MI_DMAINT)
7802 		if (brcms_b_recv(wlc_hw, RX_FIFO, bounded))
7803 			wlc->macintstatus |= MI_DMAINT;
7804 
7805 	/* noise sample collected */
7806 	if (macintstatus & MI_BG_NOISE)
7807 		wlc_phy_noise_sample_intr(wlc_hw->band->pi);
7808 
7809 	if (macintstatus & MI_GP0) {
7810 		brcms_err(core, "wl%d: PSM microcode watchdog fired at %d "
7811 			  "(seconds). Resetting.\n", wlc_hw->unit, wlc_hw->now);
7812 
7813 		printk_once("%s : PSM Watchdog, chipid 0x%x, chiprev 0x%x\n",
7814 			    __func__, ai_get_chip_id(wlc_hw->sih),
7815 			    ai_get_chiprev(wlc_hw->sih));
7816 		brcms_fatal_error(wlc_hw->wlc->wl);
7817 	}
7818 
7819 	/* gptimer timeout */
7820 	if (macintstatus & MI_TO)
7821 		bcma_write32(core, D11REGOFFS(gptimer), 0);
7822 
7823 	if (macintstatus & MI_RFDISABLE) {
7824 		brcms_dbg_info(core, "wl%d: BMAC Detected a change on the"
7825 			       " RF Disable Input\n", wlc_hw->unit);
7826 		brcms_rfkill_set_hw_state(wlc->wl);
7827 	}
7828 
7829 	/* BCN template is available */
7830 	if (macintstatus & MI_BCNTPL)
7831 		brcms_c_update_beacon(wlc);
7832 
7833 	/* it isn't done and needs to be resched if macintstatus is non-zero */
7834 	return wlc->macintstatus != 0;
7835 
7836  fatal:
7837 	brcms_fatal_error(wlc_hw->wlc->wl);
7838 	return wlc->macintstatus != 0;
7839 }
7840 
7841 void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx)
7842 {
7843 	struct bcma_device *core = wlc->hw->d11core;
7844 	struct ieee80211_channel *ch = wlc->pub->ieee_hw->conf.chandef.chan;
7845 	u16 chanspec;
7846 
7847 	brcms_dbg_info(core, "wl%d\n", wlc->pub->unit);
7848 
7849 	chanspec = ch20mhz_chspec(ch->hw_value);
7850 
7851 	brcms_b_init(wlc->hw, chanspec);
7852 
7853 	/* update beacon listen interval */
7854 	brcms_c_bcn_li_upd(wlc);
7855 
7856 	/* write ethernet address to core */
7857 	brcms_c_set_mac(wlc->bsscfg);
7858 	brcms_c_set_bssid(wlc->bsscfg);
7859 
7860 	/* Update tsf_cfprep if associated and up */
7861 	if (wlc->pub->associated && wlc->pub->up) {
7862 		u32 bi;
7863 
7864 		/* get beacon period and convert to uS */
7865 		bi = wlc->bsscfg->current_bss->beacon_period << 10;
7866 		/*
7867 		 * update since init path would reset
7868 		 * to default value
7869 		 */
7870 		bcma_write32(core, D11REGOFFS(tsf_cfprep),
7871 			     bi << CFPREP_CBI_SHIFT);
7872 
7873 		/* Update maccontrol PM related bits */
7874 		brcms_c_set_ps_ctrl(wlc);
7875 	}
7876 
7877 	brcms_c_bandinit_ordered(wlc, chanspec);
7878 
7879 	/* init probe response timeout */
7880 	brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
7881 
7882 	/* init max burst txop (framebursting) */
7883 	brcms_b_write_shm(wlc->hw, M_MBURST_TXOP,
7884 		      (wlc->
7885 		       _rifs ? (EDCF_AC_VO_TXOP_AP << 5) : MAXFRAMEBURST_TXOP));
7886 
7887 	/* initialize maximum allowed duty cycle */
7888 	brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_ofdm, true, true);
7889 	brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_cck, false, true);
7890 
7891 	/*
7892 	 * Update some shared memory locations related to
7893 	 * max AMPDU size allowed to received
7894 	 */
7895 	brcms_c_ampdu_shm_upd(wlc->ampdu);
7896 
7897 	/* band-specific inits */
7898 	brcms_c_bsinit(wlc);
7899 
7900 	/* Enable EDCF mode (while the MAC is suspended) */
7901 	bcma_set16(core, D11REGOFFS(ifs_ctl), IFS_USEEDCF);
7902 	brcms_c_edcf_setparams(wlc, false);
7903 
7904 	/* read the ucode version if we have not yet done so */
7905 	if (wlc->ucode_rev == 0) {
7906 		u16 rev;
7907 		u16 patch;
7908 
7909 		rev = brcms_b_read_shm(wlc->hw, M_BOM_REV_MAJOR);
7910 		patch = brcms_b_read_shm(wlc->hw, M_BOM_REV_MINOR);
7911 		wlc->ucode_rev = (rev << NBITS(u16)) | patch;
7912 		snprintf(wlc->wiphy->fw_version,
7913 			 sizeof(wlc->wiphy->fw_version), "%u.%u", rev, patch);
7914 	}
7915 
7916 	/* ..now really unleash hell (allow the MAC out of suspend) */
7917 	brcms_c_enable_mac(wlc);
7918 
7919 	/* suspend the tx fifos and mute the phy for preism cac time */
7920 	if (mute_tx)
7921 		brcms_b_mute(wlc->hw, true);
7922 
7923 	/* enable the RF Disable Delay timer */
7924 	bcma_write32(core, D11REGOFFS(rfdisabledly), RFDISABLE_DEFAULT);
7925 
7926 	/*
7927 	 * Initialize WME parameters; if they haven't been set by some other
7928 	 * mechanism (IOVar, etc) then read them from the hardware.
7929 	 */
7930 	if (GFIELD(wlc->wme_retries[0], EDCF_SHORT) == 0) {
7931 		/* Uninitialized; read from HW */
7932 		int ac;
7933 
7934 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
7935 			wlc->wme_retries[ac] =
7936 			    brcms_b_read_shm(wlc->hw, M_AC_TXLMT_ADDR(ac));
7937 	}
7938 }
7939 
7940 /*
7941  * The common driver entry routine. Error codes should be unique
7942  */
7943 struct brcms_c_info *
7944 brcms_c_attach(struct brcms_info *wl, struct bcma_device *core, uint unit,
7945 	       bool piomode, uint *perr)
7946 {
7947 	struct brcms_c_info *wlc;
7948 	uint err = 0;
7949 	uint i, j;
7950 	struct brcms_pub *pub;
7951 
7952 	/* allocate struct brcms_c_info state and its substructures */
7953 	wlc = brcms_c_attach_malloc(unit, &err, 0);
7954 	if (wlc == NULL)
7955 		goto fail;
7956 	wlc->wiphy = wl->wiphy;
7957 	pub = wlc->pub;
7958 
7959 #if defined(DEBUG)
7960 	wlc_info_dbg = wlc;
7961 #endif
7962 
7963 	wlc->band = wlc->bandstate[0];
7964 	wlc->core = wlc->corestate;
7965 	wlc->wl = wl;
7966 	pub->unit = unit;
7967 	pub->_piomode = piomode;
7968 	wlc->bandinit_pending = false;
7969 	wlc->beacon_template_virgin = true;
7970 
7971 	/* populate struct brcms_c_info with default values  */
7972 	brcms_c_info_init(wlc, unit);
7973 
7974 	/* update sta/ap related parameters */
7975 	brcms_c_ap_upd(wlc);
7976 
7977 	/*
7978 	 * low level attach steps(all hw accesses go
7979 	 * inside, no more in rest of the attach)
7980 	 */
7981 	err = brcms_b_attach(wlc, core, unit, piomode);
7982 	if (err)
7983 		goto fail;
7984 
7985 	brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, OFF);
7986 
7987 	pub->phy_11ncapable = BRCMS_PHY_11N_CAP(wlc->band);
7988 
7989 	/* disable allowed duty cycle */
7990 	wlc->tx_duty_cycle_ofdm = 0;
7991 	wlc->tx_duty_cycle_cck = 0;
7992 
7993 	brcms_c_stf_phy_chain_calc(wlc);
7994 
7995 	/* txchain 1: txant 0, txchain 2: txant 1 */
7996 	if (BRCMS_ISNPHY(wlc->band) && (wlc->stf->txstreams == 1))
7997 		wlc->stf->txant = wlc->stf->hw_txchain - 1;
7998 
7999 	/* push to BMAC driver */
8000 	wlc_phy_stf_chain_init(wlc->band->pi, wlc->stf->hw_txchain,
8001 			       wlc->stf->hw_rxchain);
8002 
8003 	/* pull up some info resulting from the low attach */
8004 	for (i = 0; i < NFIFO; i++)
8005 		wlc->core->txavail[i] = wlc->hw->txavail[i];
8006 
8007 	memcpy(&wlc->perm_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
8008 	memcpy(&pub->cur_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
8009 
8010 	for (j = 0; j < wlc->pub->_nbands; j++) {
8011 		wlc->band = wlc->bandstate[j];
8012 
8013 		if (!brcms_c_attach_stf_ant_init(wlc)) {
8014 			err = 24;
8015 			goto fail;
8016 		}
8017 
8018 		/* default contention windows size limits */
8019 		wlc->band->CWmin = APHY_CWMIN;
8020 		wlc->band->CWmax = PHY_CWMAX;
8021 
8022 		/* init gmode value */
8023 		if (wlc->band->bandtype == BRCM_BAND_2G) {
8024 			wlc->band->gmode = GMODE_AUTO;
8025 			brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER,
8026 					   wlc->band->gmode);
8027 		}
8028 
8029 		/* init _n_enab supported mode */
8030 		if (BRCMS_PHY_11N_CAP(wlc->band)) {
8031 			pub->_n_enab = SUPPORT_11N;
8032 			brcms_c_protection_upd(wlc, BRCMS_PROT_N_USER,
8033 						   ((pub->_n_enab ==
8034 						     SUPPORT_11N) ? WL_11N_2x2 :
8035 						    WL_11N_3x3));
8036 		}
8037 
8038 		/* init per-band default rateset, depend on band->gmode */
8039 		brcms_default_rateset(wlc, &wlc->band->defrateset);
8040 
8041 		/* fill in hw_rateset */
8042 		brcms_c_rateset_filter(&wlc->band->defrateset,
8043 				   &wlc->band->hw_rateset, false,
8044 				   BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
8045 				   (bool) (wlc->pub->_n_enab & SUPPORT_11N));
8046 	}
8047 
8048 	/*
8049 	 * update antenna config due to
8050 	 * wlc->stf->txant/txchain/ant_rx_ovr change
8051 	 */
8052 	brcms_c_stf_phy_txant_upd(wlc);
8053 
8054 	/* attach each modules */
8055 	err = brcms_c_attach_module(wlc);
8056 	if (err != 0)
8057 		goto fail;
8058 
8059 	if (!brcms_c_timers_init(wlc, unit)) {
8060 		wiphy_err(wl->wiphy, "wl%d: %s: init_timer failed\n", unit,
8061 			  __func__);
8062 		err = 32;
8063 		goto fail;
8064 	}
8065 
8066 	/* depend on rateset, gmode */
8067 	wlc->cmi = brcms_c_channel_mgr_attach(wlc);
8068 	if (!wlc->cmi) {
8069 		wiphy_err(wl->wiphy, "wl%d: %s: channel_mgr_attach failed"
8070 			  "\n", unit, __func__);
8071 		err = 33;
8072 		goto fail;
8073 	}
8074 
8075 	/* init default when all parameters are ready, i.e. ->rateset */
8076 	brcms_c_bss_default_init(wlc);
8077 
8078 	/*
8079 	 * Complete the wlc default state initializations..
8080 	 */
8081 
8082 	wlc->bsscfg->wlc = wlc;
8083 
8084 	wlc->mimoft = FT_HT;
8085 	wlc->mimo_40txbw = AUTO;
8086 	wlc->ofdm_40txbw = AUTO;
8087 	wlc->cck_40txbw = AUTO;
8088 	brcms_c_update_mimo_band_bwcap(wlc, BRCMS_N_BW_20IN2G_40IN5G);
8089 
8090 	/* Set default values of SGI */
8091 	if (BRCMS_SGI_CAP_PHY(wlc)) {
8092 		brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8093 					       BRCMS_N_SGI_40));
8094 	} else if (BRCMS_ISSSLPNPHY(wlc->band)) {
8095 		brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8096 					       BRCMS_N_SGI_40));
8097 	} else {
8098 		brcms_c_ht_update_sgi_rx(wlc, 0);
8099 	}
8100 
8101 	brcms_b_antsel_set(wlc->hw, wlc->asi->antsel_avail);
8102 
8103 	if (perr)
8104 		*perr = 0;
8105 
8106 	return wlc;
8107 
8108  fail:
8109 	wiphy_err(wl->wiphy, "wl%d: %s: failed with err %d\n",
8110 		  unit, __func__, err);
8111 	if (wlc)
8112 		brcms_c_detach(wlc);
8113 
8114 	if (perr)
8115 		*perr = err;
8116 	return NULL;
8117 }
8118