1/*
2 * Copyright (c) 2010 Broadcom Corporation
3 * Copyright (c) 2013 Hauke Mehrtens <hauke@hauke-m.de>
4 *
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
12 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
14 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
15 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
19
20#include <linux/pci_ids.h>
21#include <linux/if_ether.h>
22#include <net/cfg80211.h>
23#include <net/mac80211.h>
24#include <brcm_hw_ids.h>
25#include <aiutils.h>
26#include <chipcommon.h>
27#include "rate.h"
28#include "scb.h"
29#include "phy/phy_hal.h"
30#include "channel.h"
31#include "antsel.h"
32#include "stf.h"
33#include "ampdu.h"
34#include "mac80211_if.h"
35#include "ucode_loader.h"
36#include "main.h"
37#include "soc.h"
38#include "dma.h"
39#include "debug.h"
40#include "brcms_trace_events.h"
41
42/* watchdog timer, in unit of ms */
43#define TIMER_INTERVAL_WATCHDOG		1000
44/* radio monitor timer, in unit of ms */
45#define TIMER_INTERVAL_RADIOCHK		800
46
47/* beacon interval, in unit of 1024TU */
48#define BEACON_INTERVAL_DEFAULT		100
49
50/* n-mode support capability */
51/* 2x2 includes both 1x1 & 2x2 devices
52 * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
53 * control it independently
54 */
55#define WL_11N_2x2			1
56#define WL_11N_3x3			3
57#define WL_11N_4x4			4
58
59#define EDCF_ACI_MASK			0x60
60#define EDCF_ACI_SHIFT			5
61#define EDCF_ECWMIN_MASK		0x0f
62#define EDCF_ECWMAX_SHIFT		4
63#define EDCF_AIFSN_MASK			0x0f
64#define EDCF_AIFSN_MAX			15
65#define EDCF_ECWMAX_MASK		0xf0
66
67#define EDCF_AC_BE_TXOP_STA		0x0000
68#define EDCF_AC_BK_TXOP_STA		0x0000
69#define EDCF_AC_VO_ACI_STA		0x62
70#define EDCF_AC_VO_ECW_STA		0x32
71#define EDCF_AC_VI_ACI_STA		0x42
72#define EDCF_AC_VI_ECW_STA		0x43
73#define EDCF_AC_BK_ECW_STA		0xA4
74#define EDCF_AC_VI_TXOP_STA		0x005e
75#define EDCF_AC_VO_TXOP_STA		0x002f
76#define EDCF_AC_BE_ACI_STA		0x03
77#define EDCF_AC_BE_ECW_STA		0xA4
78#define EDCF_AC_BK_ACI_STA		0x27
79#define EDCF_AC_VO_TXOP_AP		0x002f
80
81#define EDCF_TXOP2USEC(txop)		((txop) << 5)
82#define EDCF_ECW2CW(exp)		((1 << (exp)) - 1)
83
84#define APHY_SYMBOL_TIME		4
85#define APHY_PREAMBLE_TIME		16
86#define APHY_SIGNAL_TIME		4
87#define APHY_SIFS_TIME			16
88#define APHY_SERVICE_NBITS		16
89#define APHY_TAIL_NBITS			6
90#define BPHY_SIFS_TIME			10
91#define BPHY_PLCP_SHORT_TIME		96
92
93#define PREN_PREAMBLE			24
94#define PREN_MM_EXT			12
95#define PREN_PREAMBLE_EXT		4
96
97#define DOT11_MAC_HDR_LEN		24
98#define DOT11_ACK_LEN			10
99#define DOT11_BA_LEN			4
100#define DOT11_OFDM_SIGNAL_EXTENSION	6
101#define DOT11_MIN_FRAG_LEN		256
102#define DOT11_RTS_LEN			16
103#define DOT11_CTS_LEN			10
104#define DOT11_BA_BITMAP_LEN		128
105#define DOT11_MAXNUMFRAGS		16
106#define DOT11_MAX_FRAG_LEN		2346
107
108#define BPHY_PLCP_TIME			192
109#define RIFS_11N_TIME			2
110
111/* length of the BCN template area */
112#define BCN_TMPL_LEN			512
113
114/* brcms_bss_info flag bit values */
115#define BRCMS_BSS_HT			0x0020	/* BSS is HT (MIMO) capable */
116
117/* chip rx buffer offset */
118#define BRCMS_HWRXOFF			38
119
120/* rfdisable delay timer 500 ms, runs of ALP clock */
121#define RFDISABLE_DEFAULT		10000000
122
123#define BRCMS_TEMPSENSE_PERIOD		10	/* 10 second timeout */
124
125/* synthpu_dly times in us */
126#define SYNTHPU_DLY_APHY_US		3700
127#define SYNTHPU_DLY_BPHY_US		1050
128#define SYNTHPU_DLY_NPHY_US		2048
129#define SYNTHPU_DLY_LPPHY_US		300
130
131#define ANTCNT				10	/* vanilla M_MAX_ANTCNT val */
132
133/* Per-AC retry limit register definitions; uses defs.h bitfield macros */
134#define EDCF_SHORT_S			0
135#define EDCF_SFB_S			4
136#define EDCF_LONG_S			8
137#define EDCF_LFB_S			12
138#define EDCF_SHORT_M			BITFIELD_MASK(4)
139#define EDCF_SFB_M			BITFIELD_MASK(4)
140#define EDCF_LONG_M			BITFIELD_MASK(4)
141#define EDCF_LFB_M			BITFIELD_MASK(4)
142
143#define RETRY_SHORT_DEF			7	/* Default Short retry Limit */
144#define RETRY_SHORT_MAX			255	/* Maximum Short retry Limit */
145#define RETRY_LONG_DEF			4	/* Default Long retry count */
146#define RETRY_SHORT_FB			3	/* Short count for fb rate */
147#define RETRY_LONG_FB			2	/* Long count for fb rate */
148
149#define APHY_CWMIN			15
150#define PHY_CWMAX			1023
151
152#define EDCF_AIFSN_MIN			1
153
154#define FRAGNUM_MASK			0xF
155
156#define APHY_SLOT_TIME			9
157#define BPHY_SLOT_TIME			20
158
159#define WL_SPURAVOID_OFF		0
160#define WL_SPURAVOID_ON1		1
161#define WL_SPURAVOID_ON2		2
162
163/* invalid core flags, use the saved coreflags */
164#define BRCMS_USE_COREFLAGS		0xffffffff
165
166/* values for PLCPHdr_override */
167#define BRCMS_PLCP_AUTO			-1
168#define BRCMS_PLCP_SHORT		0
169#define BRCMS_PLCP_LONG			1
170
171/* values for g_protection_override and n_protection_override */
172#define BRCMS_PROTECTION_AUTO		-1
173#define BRCMS_PROTECTION_OFF		0
174#define BRCMS_PROTECTION_ON		1
175#define BRCMS_PROTECTION_MMHDR_ONLY	2
176#define BRCMS_PROTECTION_CTS_ONLY	3
177
178/* values for g_protection_control and n_protection_control */
179#define BRCMS_PROTECTION_CTL_OFF	0
180#define BRCMS_PROTECTION_CTL_LOCAL	1
181#define BRCMS_PROTECTION_CTL_OVERLAP	2
182
183/* values for n_protection */
184#define BRCMS_N_PROTECTION_OFF		0
185#define BRCMS_N_PROTECTION_OPTIONAL	1
186#define BRCMS_N_PROTECTION_20IN40	2
187#define BRCMS_N_PROTECTION_MIXEDMODE	3
188
189/* values for band specific 40MHz capabilities */
190#define BRCMS_N_BW_20ALL		0
191#define BRCMS_N_BW_40ALL		1
192#define BRCMS_N_BW_20IN2G_40IN5G	2
193
194/* bitflags for SGI support (sgi_rx iovar) */
195#define BRCMS_N_SGI_20			0x01
196#define BRCMS_N_SGI_40			0x02
197
198/* defines used by the nrate iovar */
199/* MSC in use,indicates b0-6 holds an mcs */
200#define NRATE_MCS_INUSE			0x00000080
201/* rate/mcs value */
202#define NRATE_RATE_MASK			0x0000007f
203/* stf mode mask: siso, cdd, stbc, sdm */
204#define NRATE_STF_MASK			0x0000ff00
205/* stf mode shift */
206#define NRATE_STF_SHIFT			8
207/* bit indicate to override mcs only */
208#define NRATE_OVERRIDE_MCS_ONLY		0x40000000
209#define NRATE_SGI_MASK			0x00800000	/* sgi mode */
210#define NRATE_SGI_SHIFT			23		/* sgi mode */
211#define NRATE_LDPC_CODING		0x00400000	/* adv coding in use */
212#define NRATE_LDPC_SHIFT		22		/* ldpc shift */
213
214#define NRATE_STF_SISO			0		/* stf mode SISO */
215#define NRATE_STF_CDD			1		/* stf mode CDD */
216#define NRATE_STF_STBC			2		/* stf mode STBC */
217#define NRATE_STF_SDM			3		/* stf mode SDM */
218
219#define MAX_DMA_SEGS			4
220
221/* # of entries in Tx FIFO */
222#define NTXD				64
223/* Max # of entries in Rx FIFO based on 4kb page size */
224#define NRXD				256
225
226/* Amount of headroom to leave in Tx FIFO */
227#define TX_HEADROOM			4
228
229/* try to keep this # rbufs posted to the chip */
230#define NRXBUFPOST			32
231
232/* max # frames to process in brcms_c_recv() */
233#define RXBND				8
234/* max # tx status to process in wlc_txstatus() */
235#define TXSBND				8
236
237/* brcmu_format_flags() bit description structure */
238struct brcms_c_bit_desc {
239	u32 bit;
240	const char *name;
241};
242
243/*
244 * The following table lists the buffer memory allocated to xmt fifos in HW.
245 * the size is in units of 256bytes(one block), total size is HW dependent
246 * ucode has default fifo partition, sw can overwrite if necessary
247 *
248 * This is documented in twiki under the topic UcodeTxFifo. Please ensure
249 * the twiki is updated before making changes.
250 */
251
252/* Starting corerev for the fifo size table */
253#define XMTFIFOTBL_STARTREV	17
254
255struct d11init {
256	__le16 addr;
257	__le16 size;
258	__le32 value;
259};
260
261struct edcf_acparam {
262	u8 ACI;
263	u8 ECW;
264	u16 TXOP;
265} __packed;
266
267/* debug/trace */
268uint brcm_msg_level;
269
270/* TX FIFO number to WME/802.1E Access Category */
271static const u8 wme_fifo2ac[] = {
272	IEEE80211_AC_BK,
273	IEEE80211_AC_BE,
274	IEEE80211_AC_VI,
275	IEEE80211_AC_VO,
276	IEEE80211_AC_BE,
277	IEEE80211_AC_BE
278};
279
280/* ieee80211 Access Category to TX FIFO number */
281static const u8 wme_ac2fifo[] = {
282	TX_AC_VO_FIFO,
283	TX_AC_VI_FIFO,
284	TX_AC_BE_FIFO,
285	TX_AC_BK_FIFO
286};
287
288static const u16 xmtfifo_sz[][NFIFO] = {
289	/* corerev 17: 5120, 49152, 49152, 5376, 4352, 1280 */
290	{20, 192, 192, 21, 17, 5},
291	/* corerev 18: */
292	{0, 0, 0, 0, 0, 0},
293	/* corerev 19: */
294	{0, 0, 0, 0, 0, 0},
295	/* corerev 20: 5120, 49152, 49152, 5376, 4352, 1280 */
296	{20, 192, 192, 21, 17, 5},
297	/* corerev 21: 2304, 14848, 5632, 3584, 3584, 1280 */
298	{9, 58, 22, 14, 14, 5},
299	/* corerev 22: 5120, 49152, 49152, 5376, 4352, 1280 */
300	{20, 192, 192, 21, 17, 5},
301	/* corerev 23: 5120, 49152, 49152, 5376, 4352, 1280 */
302	{20, 192, 192, 21, 17, 5},
303	/* corerev 24: 2304, 14848, 5632, 3584, 3584, 1280 */
304	{9, 58, 22, 14, 14, 5},
305	/* corerev 25: */
306	{0, 0, 0, 0, 0, 0},
307	/* corerev 26: */
308	{0, 0, 0, 0, 0, 0},
309	/* corerev 27: */
310	{0, 0, 0, 0, 0, 0},
311	/* corerev 28: 2304, 14848, 5632, 3584, 3584, 1280 */
312	{9, 58, 22, 14, 14, 5},
313};
314
315#ifdef DEBUG
316static const char * const fifo_names[] = {
317	"AC_BK", "AC_BE", "AC_VI", "AC_VO", "BCMC", "ATIM" };
318#else
319static const char fifo_names[6][0];
320#endif
321
322#ifdef DEBUG
323/* pointer to most recently allocated wl/wlc */
324static struct brcms_c_info *wlc_info_dbg = (struct brcms_c_info *) (NULL);
325#endif
326
327/* Mapping of ieee80211 AC numbers to tx fifos */
328static const u8 ac_to_fifo_mapping[IEEE80211_NUM_ACS] = {
329	[IEEE80211_AC_VO]	= TX_AC_VO_FIFO,
330	[IEEE80211_AC_VI]	= TX_AC_VI_FIFO,
331	[IEEE80211_AC_BE]	= TX_AC_BE_FIFO,
332	[IEEE80211_AC_BK]	= TX_AC_BK_FIFO,
333};
334
335/* Mapping of tx fifos to ieee80211 AC numbers */
336static const u8 fifo_to_ac_mapping[IEEE80211_NUM_ACS] = {
337	[TX_AC_BK_FIFO]	= IEEE80211_AC_BK,
338	[TX_AC_BE_FIFO]	= IEEE80211_AC_BE,
339	[TX_AC_VI_FIFO]	= IEEE80211_AC_VI,
340	[TX_AC_VO_FIFO]	= IEEE80211_AC_VO,
341};
342
343static u8 brcms_ac_to_fifo(u8 ac)
344{
345	if (ac >= ARRAY_SIZE(ac_to_fifo_mapping))
346		return TX_AC_BE_FIFO;
347	return ac_to_fifo_mapping[ac];
348}
349
350static u8 brcms_fifo_to_ac(u8 fifo)
351{
352	if (fifo >= ARRAY_SIZE(fifo_to_ac_mapping))
353		return IEEE80211_AC_BE;
354	return fifo_to_ac_mapping[fifo];
355}
356
357/* Find basic rate for a given rate */
358static u8 brcms_basic_rate(struct brcms_c_info *wlc, u32 rspec)
359{
360	if (is_mcs_rate(rspec))
361		return wlc->band->basic_rate[mcs_table[rspec & RSPEC_RATE_MASK]
362		       .leg_ofdm];
363	return wlc->band->basic_rate[rspec & RSPEC_RATE_MASK];
364}
365
366static u16 frametype(u32 rspec, u8 mimoframe)
367{
368	if (is_mcs_rate(rspec))
369		return mimoframe;
370	return is_cck_rate(rspec) ? FT_CCK : FT_OFDM;
371}
372
373/* currently the best mechanism for determining SIFS is the band in use */
374static u16 get_sifs(struct brcms_band *band)
375{
376	return band->bandtype == BRCM_BAND_5G ? APHY_SIFS_TIME :
377				 BPHY_SIFS_TIME;
378}
379
380/*
381 * Detect Card removed.
382 * Even checking an sbconfig register read will not false trigger when the core
383 * is in reset it breaks CF address mechanism. Accessing gphy phyversion will
384 * cause SB error if aphy is in reset on 4306B0-DB. Need a simple accessible
385 * reg with fixed 0/1 pattern (some platforms return all 0).
386 * If clocks are present, call the sb routine which will figure out if the
387 * device is removed.
388 */
389static bool brcms_deviceremoved(struct brcms_c_info *wlc)
390{
391	u32 macctrl;
392
393	if (!wlc->hw->clk)
394		return ai_deviceremoved(wlc->hw->sih);
395	macctrl = bcma_read32(wlc->hw->d11core,
396			      D11REGOFFS(maccontrol));
397	return (macctrl & (MCTL_PSM_JMP_0 | MCTL_IHR_EN)) != MCTL_IHR_EN;
398}
399
400/* sum the individual fifo tx pending packet counts */
401static int brcms_txpktpendtot(struct brcms_c_info *wlc)
402{
403	int i;
404	int pending = 0;
405
406	for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
407		if (wlc->hw->di[i])
408			pending += dma_txpending(wlc->hw->di[i]);
409	return pending;
410}
411
412static bool brcms_is_mband_unlocked(struct brcms_c_info *wlc)
413{
414	return wlc->pub->_nbands > 1 && !wlc->bandlocked;
415}
416
417static int brcms_chspec_bw(u16 chanspec)
418{
419	if (CHSPEC_IS40(chanspec))
420		return BRCMS_40_MHZ;
421	if (CHSPEC_IS20(chanspec))
422		return BRCMS_20_MHZ;
423
424	return BRCMS_10_MHZ;
425}
426
427static void brcms_c_bsscfg_mfree(struct brcms_bss_cfg *cfg)
428{
429	if (cfg == NULL)
430		return;
431
432	kfree(cfg->current_bss);
433	kfree(cfg);
434}
435
436static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
437{
438	if (wlc == NULL)
439		return;
440
441	brcms_c_bsscfg_mfree(wlc->bsscfg);
442	kfree(wlc->pub);
443	kfree(wlc->modulecb);
444	kfree(wlc->default_bss);
445	kfree(wlc->protection);
446	kfree(wlc->stf);
447	kfree(wlc->bandstate[0]);
448	kfree(wlc->corestate->macstat_snapshot);
449	kfree(wlc->corestate);
450	kfree(wlc->hw->bandstate[0]);
451	kfree(wlc->hw);
452	if (wlc->beacon)
453		dev_kfree_skb_any(wlc->beacon);
454	if (wlc->probe_resp)
455		dev_kfree_skb_any(wlc->probe_resp);
456
457	/* free the wlc */
458	kfree(wlc);
459	wlc = NULL;
460}
461
462static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
463{
464	struct brcms_bss_cfg *cfg;
465
466	cfg = kzalloc(sizeof(struct brcms_bss_cfg), GFP_ATOMIC);
467	if (cfg == NULL)
468		goto fail;
469
470	cfg->current_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
471	if (cfg->current_bss == NULL)
472		goto fail;
473
474	return cfg;
475
476 fail:
477	brcms_c_bsscfg_mfree(cfg);
478	return NULL;
479}
480
481static struct brcms_c_info *
482brcms_c_attach_malloc(uint unit, uint *err, uint devid)
483{
484	struct brcms_c_info *wlc;
485
486	wlc = kzalloc(sizeof(struct brcms_c_info), GFP_ATOMIC);
487	if (wlc == NULL) {
488		*err = 1002;
489		goto fail;
490	}
491
492	/* allocate struct brcms_c_pub state structure */
493	wlc->pub = kzalloc(sizeof(struct brcms_pub), GFP_ATOMIC);
494	if (wlc->pub == NULL) {
495		*err = 1003;
496		goto fail;
497	}
498	wlc->pub->wlc = wlc;
499
500	/* allocate struct brcms_hardware state structure */
501
502	wlc->hw = kzalloc(sizeof(struct brcms_hardware), GFP_ATOMIC);
503	if (wlc->hw == NULL) {
504		*err = 1005;
505		goto fail;
506	}
507	wlc->hw->wlc = wlc;
508
509	wlc->hw->bandstate[0] =
510		kzalloc(sizeof(struct brcms_hw_band) * MAXBANDS, GFP_ATOMIC);
511	if (wlc->hw->bandstate[0] == NULL) {
512		*err = 1006;
513		goto fail;
514	} else {
515		int i;
516
517		for (i = 1; i < MAXBANDS; i++)
518			wlc->hw->bandstate[i] = (struct brcms_hw_band *)
519			    ((unsigned long)wlc->hw->bandstate[0] +
520			     (sizeof(struct brcms_hw_band) * i));
521	}
522
523	wlc->modulecb =
524		kzalloc(sizeof(struct modulecb) * BRCMS_MAXMODULES, GFP_ATOMIC);
525	if (wlc->modulecb == NULL) {
526		*err = 1009;
527		goto fail;
528	}
529
530	wlc->default_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
531	if (wlc->default_bss == NULL) {
532		*err = 1010;
533		goto fail;
534	}
535
536	wlc->bsscfg = brcms_c_bsscfg_malloc(unit);
537	if (wlc->bsscfg == NULL) {
538		*err = 1011;
539		goto fail;
540	}
541
542	wlc->protection = kzalloc(sizeof(struct brcms_protection),
543				  GFP_ATOMIC);
544	if (wlc->protection == NULL) {
545		*err = 1016;
546		goto fail;
547	}
548
549	wlc->stf = kzalloc(sizeof(struct brcms_stf), GFP_ATOMIC);
550	if (wlc->stf == NULL) {
551		*err = 1017;
552		goto fail;
553	}
554
555	wlc->bandstate[0] =
556		kzalloc(sizeof(struct brcms_band)*MAXBANDS, GFP_ATOMIC);
557	if (wlc->bandstate[0] == NULL) {
558		*err = 1025;
559		goto fail;
560	} else {
561		int i;
562
563		for (i = 1; i < MAXBANDS; i++)
564			wlc->bandstate[i] = (struct brcms_band *)
565				((unsigned long)wlc->bandstate[0]
566				+ (sizeof(struct brcms_band)*i));
567	}
568
569	wlc->corestate = kzalloc(sizeof(struct brcms_core), GFP_ATOMIC);
570	if (wlc->corestate == NULL) {
571		*err = 1026;
572		goto fail;
573	}
574
575	wlc->corestate->macstat_snapshot =
576		kzalloc(sizeof(struct macstat), GFP_ATOMIC);
577	if (wlc->corestate->macstat_snapshot == NULL) {
578		*err = 1027;
579		goto fail;
580	}
581
582	return wlc;
583
584 fail:
585	brcms_c_detach_mfree(wlc);
586	return NULL;
587}
588
589/*
590 * Update the slot timing for standard 11b/g (20us slots)
591 * or shortslot 11g (9us slots)
592 * The PSM needs to be suspended for this call.
593 */
594static void brcms_b_update_slot_timing(struct brcms_hardware *wlc_hw,
595					bool shortslot)
596{
597	struct bcma_device *core = wlc_hw->d11core;
598
599	if (shortslot) {
600		/* 11g short slot: 11a timing */
601		bcma_write16(core, D11REGOFFS(ifs_slot), 0x0207);
602		brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, APHY_SLOT_TIME);
603	} else {
604		/* 11g long slot: 11b timing */
605		bcma_write16(core, D11REGOFFS(ifs_slot), 0x0212);
606		brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, BPHY_SLOT_TIME);
607	}
608}
609
610/*
611 * calculate frame duration of a given rate and length, return
612 * time in usec unit
613 */
614static uint brcms_c_calc_frame_time(struct brcms_c_info *wlc, u32 ratespec,
615				    u8 preamble_type, uint mac_len)
616{
617	uint nsyms, dur = 0, Ndps, kNdps;
618	uint rate = rspec2rate(ratespec);
619
620	if (rate == 0) {
621		brcms_err(wlc->hw->d11core, "wl%d: WAR: using rate of 1 mbps\n",
622			  wlc->pub->unit);
623		rate = BRCM_RATE_1M;
624	}
625
626	if (is_mcs_rate(ratespec)) {
627		uint mcs = ratespec & RSPEC_RATE_MASK;
628		int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
629
630		dur = PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
631		if (preamble_type == BRCMS_MM_PREAMBLE)
632			dur += PREN_MM_EXT;
633		/* 1000Ndbps = kbps * 4 */
634		kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
635				   rspec_issgi(ratespec)) * 4;
636
637		if (rspec_stc(ratespec) == 0)
638			nsyms =
639			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
640				  APHY_TAIL_NBITS) * 1000, kNdps);
641		else
642			/* STBC needs to have even number of symbols */
643			nsyms =
644			    2 *
645			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
646				  APHY_TAIL_NBITS) * 1000, 2 * kNdps);
647
648		dur += APHY_SYMBOL_TIME * nsyms;
649		if (wlc->band->bandtype == BRCM_BAND_2G)
650			dur += DOT11_OFDM_SIGNAL_EXTENSION;
651	} else if (is_ofdm_rate(rate)) {
652		dur = APHY_PREAMBLE_TIME;
653		dur += APHY_SIGNAL_TIME;
654		/* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
655		Ndps = rate * 2;
656		/* NSyms = CEILING((SERVICE + 8*NBytes + TAIL) / Ndbps) */
657		nsyms =
658		    CEIL((APHY_SERVICE_NBITS + 8 * mac_len + APHY_TAIL_NBITS),
659			 Ndps);
660		dur += APHY_SYMBOL_TIME * nsyms;
661		if (wlc->band->bandtype == BRCM_BAND_2G)
662			dur += DOT11_OFDM_SIGNAL_EXTENSION;
663	} else {
664		/*
665		 * calc # bits * 2 so factor of 2 in rate (1/2 mbps)
666		 * will divide out
667		 */
668		mac_len = mac_len * 8 * 2;
669		/* calc ceiling of bits/rate = microseconds of air time */
670		dur = (mac_len + rate - 1) / rate;
671		if (preamble_type & BRCMS_SHORT_PREAMBLE)
672			dur += BPHY_PLCP_SHORT_TIME;
673		else
674			dur += BPHY_PLCP_TIME;
675	}
676	return dur;
677}
678
679static void brcms_c_write_inits(struct brcms_hardware *wlc_hw,
680				const struct d11init *inits)
681{
682	struct bcma_device *core = wlc_hw->d11core;
683	int i;
684	uint offset;
685	u16 size;
686	u32 value;
687
688	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
689
690	for (i = 0; inits[i].addr != cpu_to_le16(0xffff); i++) {
691		size = le16_to_cpu(inits[i].size);
692		offset = le16_to_cpu(inits[i].addr);
693		value = le32_to_cpu(inits[i].value);
694		if (size == 2)
695			bcma_write16(core, offset, value);
696		else if (size == 4)
697			bcma_write32(core, offset, value);
698		else
699			break;
700	}
701}
702
703static void brcms_c_write_mhf(struct brcms_hardware *wlc_hw, u16 *mhfs)
704{
705	u8 idx;
706	u16 addr[] = {
707		M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
708		M_HOST_FLAGS5
709	};
710
711	for (idx = 0; idx < MHFMAX; idx++)
712		brcms_b_write_shm(wlc_hw, addr[idx], mhfs[idx]);
713}
714
715static void brcms_c_ucode_bsinit(struct brcms_hardware *wlc_hw)
716{
717	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
718
719	/* init microcode host flags */
720	brcms_c_write_mhf(wlc_hw, wlc_hw->band->mhfs);
721
722	/* do band-specific ucode IHR, SHM, and SCR inits */
723	if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
724		if (BRCMS_ISNPHY(wlc_hw->band))
725			brcms_c_write_inits(wlc_hw, ucode->d11n0bsinitvals16);
726		else
727			brcms_err(wlc_hw->d11core,
728				  "%s: wl%d: unsupported phy in corerev %d\n",
729				  __func__, wlc_hw->unit,
730				  wlc_hw->corerev);
731	} else {
732		if (D11REV_IS(wlc_hw->corerev, 24)) {
733			if (BRCMS_ISLCNPHY(wlc_hw->band))
734				brcms_c_write_inits(wlc_hw,
735						    ucode->d11lcn0bsinitvals24);
736			else
737				brcms_err(wlc_hw->d11core,
738					  "%s: wl%d: unsupported phy in core rev %d\n",
739					  __func__, wlc_hw->unit,
740					  wlc_hw->corerev);
741		} else {
742			brcms_err(wlc_hw->d11core,
743				  "%s: wl%d: unsupported corerev %d\n",
744				  __func__, wlc_hw->unit, wlc_hw->corerev);
745		}
746	}
747}
748
749static void brcms_b_core_ioctl(struct brcms_hardware *wlc_hw, u32 m, u32 v)
750{
751	struct bcma_device *core = wlc_hw->d11core;
752	u32 ioctl = bcma_aread32(core, BCMA_IOCTL) & ~m;
753
754	bcma_awrite32(core, BCMA_IOCTL, ioctl | v);
755}
756
757static void brcms_b_core_phy_clk(struct brcms_hardware *wlc_hw, bool clk)
758{
759	brcms_dbg_info(wlc_hw->d11core, "wl%d: clk %d\n", wlc_hw->unit, clk);
760
761	wlc_hw->phyclk = clk;
762
763	if (OFF == clk) {	/* clear gmode bit, put phy into reset */
764
765		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC | SICF_GMODE),
766				   (SICF_PRST | SICF_FGC));
767		udelay(1);
768		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_PRST);
769		udelay(1);
770
771	} else {		/* take phy out of reset */
772
773		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_FGC);
774		udelay(1);
775		brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
776		udelay(1);
777
778	}
779}
780
781/* low-level band switch utility routine */
782static void brcms_c_setxband(struct brcms_hardware *wlc_hw, uint bandunit)
783{
784	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
785			   bandunit);
786
787	wlc_hw->band = wlc_hw->bandstate[bandunit];
788
789	/*
790	 * BMAC_NOTE:
791	 *   until we eliminate need for wlc->band refs in low level code
792	 */
793	wlc_hw->wlc->band = wlc_hw->wlc->bandstate[bandunit];
794
795	/* set gmode core flag */
796	if (wlc_hw->sbclk && !wlc_hw->noreset) {
797		u32 gmode = 0;
798
799		if (bandunit == 0)
800			gmode = SICF_GMODE;
801
802		brcms_b_core_ioctl(wlc_hw, SICF_GMODE, gmode);
803	}
804}
805
806/* switch to new band but leave it inactive */
807static u32 brcms_c_setband_inact(struct brcms_c_info *wlc, uint bandunit)
808{
809	struct brcms_hardware *wlc_hw = wlc->hw;
810	u32 macintmask;
811	u32 macctrl;
812
813	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
814	macctrl = bcma_read32(wlc_hw->d11core,
815			      D11REGOFFS(maccontrol));
816	WARN_ON((macctrl & MCTL_EN_MAC) != 0);
817
818	/* disable interrupts */
819	macintmask = brcms_intrsoff(wlc->wl);
820
821	/* radio off */
822	wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
823
824	brcms_b_core_phy_clk(wlc_hw, OFF);
825
826	brcms_c_setxband(wlc_hw, bandunit);
827
828	return macintmask;
829}
830
831/* process an individual struct tx_status */
832static bool
833brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
834{
835	struct sk_buff *p = NULL;
836	uint queue = NFIFO;
837	struct dma_pub *dma = NULL;
838	struct d11txh *txh = NULL;
839	struct scb *scb = NULL;
840	bool free_pdu;
841	int tx_rts, tx_frame_count, tx_rts_count;
842	uint totlen, supr_status;
843	bool lastframe;
844	struct ieee80211_hdr *h;
845	u16 mcl;
846	struct ieee80211_tx_info *tx_info;
847	struct ieee80211_tx_rate *txrate;
848	int i;
849	bool fatal = true;
850
851	trace_brcms_txstatus(&wlc->hw->d11core->dev, txs->framelen,
852			     txs->frameid, txs->status, txs->lasttxtime,
853			     txs->sequence, txs->phyerr, txs->ackphyrxsh);
854
855	/* discard intermediate indications for ucode with one legitimate case:
856	 *   e.g. if "useRTS" is set. ucode did a successful rts/cts exchange,
857	 *   but the subsequent tx of DATA failed. so it will start rts/cts
858	 *   from the beginning (resetting the rts transmission count)
859	 */
860	if (!(txs->status & TX_STATUS_AMPDU)
861	    && (txs->status & TX_STATUS_INTERMEDIATE)) {
862		brcms_dbg_tx(wlc->hw->d11core, "INTERMEDIATE but not AMPDU\n");
863		fatal = false;
864		goto out;
865	}
866
867	queue = txs->frameid & TXFID_QUEUE_MASK;
868	if (queue >= NFIFO) {
869		brcms_err(wlc->hw->d11core, "queue %u >= NFIFO\n", queue);
870		goto out;
871	}
872
873	dma = wlc->hw->di[queue];
874
875	p = dma_getnexttxp(wlc->hw->di[queue], DMA_RANGE_TRANSMITTED);
876	if (p == NULL) {
877		brcms_err(wlc->hw->d11core, "dma_getnexttxp returned null!\n");
878		goto out;
879	}
880
881	txh = (struct d11txh *) (p->data);
882	mcl = le16_to_cpu(txh->MacTxControlLow);
883
884	if (txs->phyerr)
885		brcms_dbg_tx(wlc->hw->d11core, "phyerr 0x%x, rate 0x%x\n",
886			     txs->phyerr, txh->MainRates);
887
888	if (txs->frameid != le16_to_cpu(txh->TxFrameID)) {
889		brcms_err(wlc->hw->d11core, "frameid != txh->TxFrameID\n");
890		goto out;
891	}
892	tx_info = IEEE80211_SKB_CB(p);
893	h = (struct ieee80211_hdr *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN);
894
895	if (tx_info->rate_driver_data[0])
896		scb = &wlc->pri_scb;
897
898	if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
899		brcms_c_ampdu_dotxstatus(wlc->ampdu, scb, p, txs);
900		fatal = false;
901		goto out;
902	}
903
904	/*
905	 * brcms_c_ampdu_dotxstatus() will trace tx descriptors for AMPDU
906	 * frames; this traces them for the rest.
907	 */
908	trace_brcms_txdesc(&wlc->hw->d11core->dev, txh, sizeof(*txh));
909
910	supr_status = txs->status & TX_STATUS_SUPR_MASK;
911	if (supr_status == TX_STATUS_SUPR_BADCH) {
912		unsigned xfts = le16_to_cpu(txh->XtraFrameTypes);
913		brcms_dbg_tx(wlc->hw->d11core,
914			     "Pkt tx suppressed, dest chan %u, current %d\n",
915			     (xfts >> XFTS_CHANNEL_SHIFT) & 0xff,
916			     CHSPEC_CHANNEL(wlc->default_bss->chanspec));
917	}
918
919	tx_rts = le16_to_cpu(txh->MacTxControlLow) & TXC_SENDRTS;
920	tx_frame_count =
921	    (txs->status & TX_STATUS_FRM_RTX_MASK) >> TX_STATUS_FRM_RTX_SHIFT;
922	tx_rts_count =
923	    (txs->status & TX_STATUS_RTS_RTX_MASK) >> TX_STATUS_RTS_RTX_SHIFT;
924
925	lastframe = !ieee80211_has_morefrags(h->frame_control);
926
927	if (!lastframe) {
928		brcms_err(wlc->hw->d11core, "Not last frame!\n");
929	} else {
930		/*
931		 * Set information to be consumed by Minstrel ht.
932		 *
933		 * The "fallback limit" is the number of tx attempts a given
934		 * MPDU is sent at the "primary" rate. Tx attempts beyond that
935		 * limit are sent at the "secondary" rate.
936		 * A 'short frame' does not exceed RTS treshold.
937		 */
938		u16 sfbl,	/* Short Frame Rate Fallback Limit */
939		    lfbl,	/* Long Frame Rate Fallback Limit */
940		    fbl;
941
942		if (queue < IEEE80211_NUM_ACS) {
943			sfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
944				      EDCF_SFB);
945			lfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
946				      EDCF_LFB);
947		} else {
948			sfbl = wlc->SFBL;
949			lfbl = wlc->LFBL;
950		}
951
952		txrate = tx_info->status.rates;
953		if (txrate[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
954			fbl = lfbl;
955		else
956			fbl = sfbl;
957
958		ieee80211_tx_info_clear_status(tx_info);
959
960		if ((tx_frame_count > fbl) && (txrate[1].idx >= 0)) {
961			/*
962			 * rate selection requested a fallback rate
963			 * and we used it
964			 */
965			txrate[0].count = fbl;
966			txrate[1].count = tx_frame_count - fbl;
967		} else {
968			/*
969			 * rate selection did not request fallback rate, or
970			 * we didn't need it
971			 */
972			txrate[0].count = tx_frame_count;
973			/*
974			 * rc80211_minstrel.c:minstrel_tx_status() expects
975			 * unused rates to be marked with idx = -1
976			 */
977			txrate[1].idx = -1;
978			txrate[1].count = 0;
979		}
980
981		/* clear the rest of the rates */
982		for (i = 2; i < IEEE80211_TX_MAX_RATES; i++) {
983			txrate[i].idx = -1;
984			txrate[i].count = 0;
985		}
986
987		if (txs->status & TX_STATUS_ACK_RCV)
988			tx_info->flags |= IEEE80211_TX_STAT_ACK;
989	}
990
991	totlen = p->len;
992	free_pdu = true;
993
994	if (lastframe) {
995		/* remove PLCP & Broadcom tx descriptor header */
996		skb_pull(p, D11_PHY_HDR_LEN);
997		skb_pull(p, D11_TXH_LEN);
998		ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw, p);
999	} else {
1000		brcms_err(wlc->hw->d11core,
1001			  "%s: Not last frame => not calling tx_status\n",
1002			  __func__);
1003	}
1004
1005	fatal = false;
1006
1007 out:
1008	if (fatal) {
1009		if (txh)
1010			trace_brcms_txdesc(&wlc->hw->d11core->dev, txh,
1011					   sizeof(*txh));
1012		if (p)
1013			brcmu_pkt_buf_free_skb(p);
1014	}
1015
1016	if (dma && queue < NFIFO) {
1017		u16 ac_queue = brcms_fifo_to_ac(queue);
1018		if (dma->txavail > TX_HEADROOM && queue < TX_BCMC_FIFO &&
1019		    ieee80211_queue_stopped(wlc->pub->ieee_hw, ac_queue))
1020			ieee80211_wake_queue(wlc->pub->ieee_hw, ac_queue);
1021		dma_kick_tx(dma);
1022	}
1023
1024	return fatal;
1025}
1026
1027/* process tx completion events in BMAC
1028 * Return true if more tx status need to be processed. false otherwise.
1029 */
1030static bool
1031brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
1032{
1033	struct bcma_device *core;
1034	struct tx_status txstatus, *txs;
1035	u32 s1, s2;
1036	uint n = 0;
1037	/*
1038	 * Param 'max_tx_num' indicates max. # tx status to process before
1039	 * break out.
1040	 */
1041	uint max_tx_num = bound ? TXSBND : -1;
1042
1043	txs = &txstatus;
1044	core = wlc_hw->d11core;
1045	*fatal = false;
1046
1047	while (n < max_tx_num) {
1048		s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
1049		if (s1 == 0xffffffff) {
1050			brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
1051				  __func__);
1052			*fatal = true;
1053			return false;
1054		}
1055		/* only process when valid */
1056		if (!(s1 & TXS_V))
1057			break;
1058
1059		s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
1060		txs->status = s1 & TXS_STATUS_MASK;
1061		txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
1062		txs->sequence = s2 & TXS_SEQ_MASK;
1063		txs->phyerr = (s2 & TXS_PTX_MASK) >> TXS_PTX_SHIFT;
1064		txs->lasttxtime = 0;
1065
1066		*fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
1067		if (*fatal == true)
1068			return false;
1069		n++;
1070	}
1071
1072	return n >= max_tx_num;
1073}
1074
1075static void brcms_c_tbtt(struct brcms_c_info *wlc)
1076{
1077	if (wlc->bsscfg->type == BRCMS_TYPE_ADHOC)
1078		/*
1079		 * DirFrmQ is now valid...defer setting until end
1080		 * of ATIM window
1081		 */
1082		wlc->qvalid |= MCMD_DIRFRMQVAL;
1083}
1084
1085/* set initial host flags value */
1086static void
1087brcms_c_mhfdef(struct brcms_c_info *wlc, u16 *mhfs, u16 mhf2_init)
1088{
1089	struct brcms_hardware *wlc_hw = wlc->hw;
1090
1091	memset(mhfs, 0, MHFMAX * sizeof(u16));
1092
1093	mhfs[MHF2] |= mhf2_init;
1094
1095	/* prohibit use of slowclock on multifunction boards */
1096	if (wlc_hw->boardflags & BFL_NOPLLDOWN)
1097		mhfs[MHF1] |= MHF1_FORCEFASTCLK;
1098
1099	if (BRCMS_ISNPHY(wlc_hw->band) && NREV_LT(wlc_hw->band->phyrev, 2)) {
1100		mhfs[MHF2] |= MHF2_NPHY40MHZ_WAR;
1101		mhfs[MHF1] |= MHF1_IQSWAP_WAR;
1102	}
1103}
1104
1105static uint
1106dmareg(uint direction, uint fifonum)
1107{
1108	if (direction == DMA_TX)
1109		return offsetof(struct d11regs, fifo64regs[fifonum].dmaxmt);
1110	return offsetof(struct d11regs, fifo64regs[fifonum].dmarcv);
1111}
1112
1113static bool brcms_b_attach_dmapio(struct brcms_c_info *wlc, uint j, bool wme)
1114{
1115	uint i;
1116	char name[8];
1117	/*
1118	 * ucode host flag 2 needed for pio mode, independent of band and fifo
1119	 */
1120	u16 pio_mhf2 = 0;
1121	struct brcms_hardware *wlc_hw = wlc->hw;
1122	uint unit = wlc_hw->unit;
1123
1124	/* name and offsets for dma_attach */
1125	snprintf(name, sizeof(name), "wl%d", unit);
1126
1127	if (wlc_hw->di[0] == NULL) {	/* Init FIFOs */
1128		int dma_attach_err = 0;
1129
1130		/*
1131		 * FIFO 0
1132		 * TX: TX_AC_BK_FIFO (TX AC Background data packets)
1133		 * RX: RX_FIFO (RX data packets)
1134		 */
1135		wlc_hw->di[0] = dma_attach(name, wlc,
1136					   (wme ? dmareg(DMA_TX, 0) : 0),
1137					   dmareg(DMA_RX, 0),
1138					   (wme ? NTXD : 0), NRXD,
1139					   RXBUFSZ, -1, NRXBUFPOST,
1140					   BRCMS_HWRXOFF);
1141		dma_attach_err |= (NULL == wlc_hw->di[0]);
1142
1143		/*
1144		 * FIFO 1
1145		 * TX: TX_AC_BE_FIFO (TX AC Best-Effort data packets)
1146		 *   (legacy) TX_DATA_FIFO (TX data packets)
1147		 * RX: UNUSED
1148		 */
1149		wlc_hw->di[1] = dma_attach(name, wlc,
1150					   dmareg(DMA_TX, 1), 0,
1151					   NTXD, 0, 0, -1, 0, 0);
1152		dma_attach_err |= (NULL == wlc_hw->di[1]);
1153
1154		/*
1155		 * FIFO 2
1156		 * TX: TX_AC_VI_FIFO (TX AC Video data packets)
1157		 * RX: UNUSED
1158		 */
1159		wlc_hw->di[2] = dma_attach(name, wlc,
1160					   dmareg(DMA_TX, 2), 0,
1161					   NTXD, 0, 0, -1, 0, 0);
1162		dma_attach_err |= (NULL == wlc_hw->di[2]);
1163		/*
1164		 * FIFO 3
1165		 * TX: TX_AC_VO_FIFO (TX AC Voice data packets)
1166		 *   (legacy) TX_CTL_FIFO (TX control & mgmt packets)
1167		 */
1168		wlc_hw->di[3] = dma_attach(name, wlc,
1169					   dmareg(DMA_TX, 3),
1170					   0, NTXD, 0, 0, -1,
1171					   0, 0);
1172		dma_attach_err |= (NULL == wlc_hw->di[3]);
1173/* Cleaner to leave this as if with AP defined */
1174
1175		if (dma_attach_err) {
1176			brcms_err(wlc_hw->d11core,
1177				  "wl%d: wlc_attach: dma_attach failed\n",
1178				  unit);
1179			return false;
1180		}
1181
1182		/* get pointer to dma engine tx flow control variable */
1183		for (i = 0; i < NFIFO; i++)
1184			if (wlc_hw->di[i])
1185				wlc_hw->txavail[i] =
1186				    (uint *) dma_getvar(wlc_hw->di[i],
1187							"&txavail");
1188	}
1189
1190	/* initial ucode host flags */
1191	brcms_c_mhfdef(wlc, wlc_hw->band->mhfs, pio_mhf2);
1192
1193	return true;
1194}
1195
1196static void brcms_b_detach_dmapio(struct brcms_hardware *wlc_hw)
1197{
1198	uint j;
1199
1200	for (j = 0; j < NFIFO; j++) {
1201		if (wlc_hw->di[j]) {
1202			dma_detach(wlc_hw->di[j]);
1203			wlc_hw->di[j] = NULL;
1204		}
1205	}
1206}
1207
1208/*
1209 * Initialize brcms_c_info default values ...
1210 * may get overrides later in this function
1211 *  BMAC_NOTES, move low out and resolve the dangling ones
1212 */
1213static void brcms_b_info_init(struct brcms_hardware *wlc_hw)
1214{
1215	struct brcms_c_info *wlc = wlc_hw->wlc;
1216
1217	/* set default sw macintmask value */
1218	wlc->defmacintmask = DEF_MACINTMASK;
1219
1220	/* various 802.11g modes */
1221	wlc_hw->shortslot = false;
1222
1223	wlc_hw->SFBL = RETRY_SHORT_FB;
1224	wlc_hw->LFBL = RETRY_LONG_FB;
1225
1226	/* default mac retry limits */
1227	wlc_hw->SRL = RETRY_SHORT_DEF;
1228	wlc_hw->LRL = RETRY_LONG_DEF;
1229	wlc_hw->chanspec = ch20mhz_chspec(1);
1230}
1231
1232static void brcms_b_wait_for_wake(struct brcms_hardware *wlc_hw)
1233{
1234	/* delay before first read of ucode state */
1235	udelay(40);
1236
1237	/* wait until ucode is no longer asleep */
1238	SPINWAIT((brcms_b_read_shm(wlc_hw, M_UCODE_DBGST) ==
1239		  DBGST_ASLEEP), wlc_hw->wlc->fastpwrup_dly);
1240}
1241
1242/* control chip clock to save power, enable dynamic clock or force fast clock */
1243static void brcms_b_clkctl_clk(struct brcms_hardware *wlc_hw, enum bcma_clkmode mode)
1244{
1245	if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU) {
1246		/* new chips with PMU, CCS_FORCEHT will distribute the HT clock
1247		 * on backplane, but mac core will still run on ALP(not HT) when
1248		 * it enters powersave mode, which means the FCA bit may not be
1249		 * set. Should wakeup mac if driver wants it to run on HT.
1250		 */
1251
1252		if (wlc_hw->clk) {
1253			if (mode == BCMA_CLKMODE_FAST) {
1254				bcma_set32(wlc_hw->d11core,
1255					   D11REGOFFS(clk_ctl_st),
1256					   CCS_FORCEHT);
1257
1258				udelay(64);
1259
1260				SPINWAIT(
1261				    ((bcma_read32(wlc_hw->d11core,
1262				      D11REGOFFS(clk_ctl_st)) &
1263				      CCS_HTAVAIL) == 0),
1264				      PMU_MAX_TRANSITION_DLY);
1265				WARN_ON(!(bcma_read32(wlc_hw->d11core,
1266					D11REGOFFS(clk_ctl_st)) &
1267					CCS_HTAVAIL));
1268			} else {
1269				if ((ai_get_pmurev(wlc_hw->sih) == 0) &&
1270				    (bcma_read32(wlc_hw->d11core,
1271					D11REGOFFS(clk_ctl_st)) &
1272					(CCS_FORCEHT | CCS_HTAREQ)))
1273					SPINWAIT(
1274					    ((bcma_read32(wlc_hw->d11core,
1275					      offsetof(struct d11regs,
1276						       clk_ctl_st)) &
1277					      CCS_HTAVAIL) == 0),
1278					      PMU_MAX_TRANSITION_DLY);
1279				bcma_mask32(wlc_hw->d11core,
1280					D11REGOFFS(clk_ctl_st),
1281					~CCS_FORCEHT);
1282			}
1283		}
1284		wlc_hw->forcefastclk = (mode == BCMA_CLKMODE_FAST);
1285	} else {
1286
1287		/* old chips w/o PMU, force HT through cc,
1288		 * then use FCA to verify mac is running fast clock
1289		 */
1290
1291		wlc_hw->forcefastclk = ai_clkctl_cc(wlc_hw->sih, mode);
1292
1293		/* check fast clock is available (if core is not in reset) */
1294		if (wlc_hw->forcefastclk && wlc_hw->clk)
1295			WARN_ON(!(bcma_aread32(wlc_hw->d11core, BCMA_IOST) &
1296				  SISF_FCLKA));
1297
1298		/*
1299		 * keep the ucode wake bit on if forcefastclk is on since we
1300		 * do not want ucode to put us back to slow clock when it dozes
1301		 * for PM mode. Code below matches the wake override bit with
1302		 * current forcefastclk state. Only setting bit in wake_override
1303		 * instead of waking ucode immediately since old code had this
1304		 * behavior. Older code set wlc->forcefastclk but only had the
1305		 * wake happen if the wakup_ucode work (protected by an up
1306		 * check) was executed just below.
1307		 */
1308		if (wlc_hw->forcefastclk)
1309			mboolset(wlc_hw->wake_override,
1310				 BRCMS_WAKE_OVERRIDE_FORCEFAST);
1311		else
1312			mboolclr(wlc_hw->wake_override,
1313				 BRCMS_WAKE_OVERRIDE_FORCEFAST);
1314	}
1315}
1316
1317/* set or clear ucode host flag bits
1318 * it has an optimization for no-change write
1319 * it only writes through shared memory when the core has clock;
1320 * pre-CLK changes should use wlc_write_mhf to get around the optimization
1321 *
1322 *
1323 * bands values are: BRCM_BAND_AUTO <--- Current band only
1324 *                   BRCM_BAND_5G   <--- 5G band only
1325 *                   BRCM_BAND_2G   <--- 2G band only
1326 *                   BRCM_BAND_ALL  <--- All bands
1327 */
1328void
1329brcms_b_mhf(struct brcms_hardware *wlc_hw, u8 idx, u16 mask, u16 val,
1330	     int bands)
1331{
1332	u16 save;
1333	u16 addr[MHFMAX] = {
1334		M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
1335		M_HOST_FLAGS5
1336	};
1337	struct brcms_hw_band *band;
1338
1339	if ((val & ~mask) || idx >= MHFMAX)
1340		return; /* error condition */
1341
1342	switch (bands) {
1343		/* Current band only or all bands,
1344		 * then set the band to current band
1345		 */
1346	case BRCM_BAND_AUTO:
1347	case BRCM_BAND_ALL:
1348		band = wlc_hw->band;
1349		break;
1350	case BRCM_BAND_5G:
1351		band = wlc_hw->bandstate[BAND_5G_INDEX];
1352		break;
1353	case BRCM_BAND_2G:
1354		band = wlc_hw->bandstate[BAND_2G_INDEX];
1355		break;
1356	default:
1357		band = NULL;	/* error condition */
1358	}
1359
1360	if (band) {
1361		save = band->mhfs[idx];
1362		band->mhfs[idx] = (band->mhfs[idx] & ~mask) | val;
1363
1364		/* optimization: only write through if changed, and
1365		 * changed band is the current band
1366		 */
1367		if (wlc_hw->clk && (band->mhfs[idx] != save)
1368		    && (band == wlc_hw->band))
1369			brcms_b_write_shm(wlc_hw, addr[idx],
1370					   (u16) band->mhfs[idx]);
1371	}
1372
1373	if (bands == BRCM_BAND_ALL) {
1374		wlc_hw->bandstate[0]->mhfs[idx] =
1375		    (wlc_hw->bandstate[0]->mhfs[idx] & ~mask) | val;
1376		wlc_hw->bandstate[1]->mhfs[idx] =
1377		    (wlc_hw->bandstate[1]->mhfs[idx] & ~mask) | val;
1378	}
1379}
1380
1381/* set the maccontrol register to desired reset state and
1382 * initialize the sw cache of the register
1383 */
1384static void brcms_c_mctrl_reset(struct brcms_hardware *wlc_hw)
1385{
1386	/* IHR accesses are always enabled, PSM disabled, HPS off and WAKE on */
1387	wlc_hw->maccontrol = 0;
1388	wlc_hw->suspended_fifos = 0;
1389	wlc_hw->wake_override = 0;
1390	wlc_hw->mute_override = 0;
1391	brcms_b_mctrl(wlc_hw, ~0, MCTL_IHR_EN | MCTL_WAKE);
1392}
1393
1394/*
1395 * write the software state of maccontrol and
1396 * overrides to the maccontrol register
1397 */
1398static void brcms_c_mctrl_write(struct brcms_hardware *wlc_hw)
1399{
1400	u32 maccontrol = wlc_hw->maccontrol;
1401
1402	/* OR in the wake bit if overridden */
1403	if (wlc_hw->wake_override)
1404		maccontrol |= MCTL_WAKE;
1405
1406	/* set AP and INFRA bits for mute if needed */
1407	if (wlc_hw->mute_override) {
1408		maccontrol &= ~(MCTL_AP);
1409		maccontrol |= MCTL_INFRA;
1410	}
1411
1412	bcma_write32(wlc_hw->d11core, D11REGOFFS(maccontrol),
1413		     maccontrol);
1414}
1415
1416/* set or clear maccontrol bits */
1417void brcms_b_mctrl(struct brcms_hardware *wlc_hw, u32 mask, u32 val)
1418{
1419	u32 maccontrol;
1420	u32 new_maccontrol;
1421
1422	if (val & ~mask)
1423		return; /* error condition */
1424	maccontrol = wlc_hw->maccontrol;
1425	new_maccontrol = (maccontrol & ~mask) | val;
1426
1427	/* if the new maccontrol value is the same as the old, nothing to do */
1428	if (new_maccontrol == maccontrol)
1429		return;
1430
1431	/* something changed, cache the new value */
1432	wlc_hw->maccontrol = new_maccontrol;
1433
1434	/* write the new values with overrides applied */
1435	brcms_c_mctrl_write(wlc_hw);
1436}
1437
1438void brcms_c_ucode_wake_override_set(struct brcms_hardware *wlc_hw,
1439				 u32 override_bit)
1440{
1441	if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE)) {
1442		mboolset(wlc_hw->wake_override, override_bit);
1443		return;
1444	}
1445
1446	mboolset(wlc_hw->wake_override, override_bit);
1447
1448	brcms_c_mctrl_write(wlc_hw);
1449	brcms_b_wait_for_wake(wlc_hw);
1450}
1451
1452void brcms_c_ucode_wake_override_clear(struct brcms_hardware *wlc_hw,
1453				   u32 override_bit)
1454{
1455	mboolclr(wlc_hw->wake_override, override_bit);
1456
1457	if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE))
1458		return;
1459
1460	brcms_c_mctrl_write(wlc_hw);
1461}
1462
1463/* When driver needs ucode to stop beaconing, it has to make sure that
1464 * MCTL_AP is clear and MCTL_INFRA is set
1465 * Mode           MCTL_AP        MCTL_INFRA
1466 * AP                1              1
1467 * STA               0              1 <--- This will ensure no beacons
1468 * IBSS              0              0
1469 */
1470static void brcms_c_ucode_mute_override_set(struct brcms_hardware *wlc_hw)
1471{
1472	wlc_hw->mute_override = 1;
1473
1474	/* if maccontrol already has AP == 0 and INFRA == 1 without this
1475	 * override, then there is no change to write
1476	 */
1477	if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1478		return;
1479
1480	brcms_c_mctrl_write(wlc_hw);
1481}
1482
1483/* Clear the override on AP and INFRA bits */
1484static void brcms_c_ucode_mute_override_clear(struct brcms_hardware *wlc_hw)
1485{
1486	if (wlc_hw->mute_override == 0)
1487		return;
1488
1489	wlc_hw->mute_override = 0;
1490
1491	/* if maccontrol already has AP == 0 and INFRA == 1 without this
1492	 * override, then there is no change to write
1493	 */
1494	if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1495		return;
1496
1497	brcms_c_mctrl_write(wlc_hw);
1498}
1499
1500/*
1501 * Write a MAC address to the given match reg offset in the RXE match engine.
1502 */
1503static void
1504brcms_b_set_addrmatch(struct brcms_hardware *wlc_hw, int match_reg_offset,
1505		       const u8 *addr)
1506{
1507	struct bcma_device *core = wlc_hw->d11core;
1508	u16 mac_l;
1509	u16 mac_m;
1510	u16 mac_h;
1511
1512	brcms_dbg_rx(core, "wl%d: brcms_b_set_addrmatch\n", wlc_hw->unit);
1513
1514	mac_l = addr[0] | (addr[1] << 8);
1515	mac_m = addr[2] | (addr[3] << 8);
1516	mac_h = addr[4] | (addr[5] << 8);
1517
1518	/* enter the MAC addr into the RXE match registers */
1519	bcma_write16(core, D11REGOFFS(rcm_ctl),
1520		     RCM_INC_DATA | match_reg_offset);
1521	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_l);
1522	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_m);
1523	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_h);
1524}
1525
1526void
1527brcms_b_write_template_ram(struct brcms_hardware *wlc_hw, int offset, int len,
1528			    void *buf)
1529{
1530	struct bcma_device *core = wlc_hw->d11core;
1531	u32 word;
1532	__le32 word_le;
1533	__be32 word_be;
1534	bool be_bit;
1535	brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
1536
1537	bcma_write32(core, D11REGOFFS(tplatewrptr), offset);
1538
1539	/* if MCTL_BIGEND bit set in mac control register,
1540	 * the chip swaps data in fifo, as well as data in
1541	 * template ram
1542	 */
1543	be_bit = (bcma_read32(core, D11REGOFFS(maccontrol)) & MCTL_BIGEND) != 0;
1544
1545	while (len > 0) {
1546		memcpy(&word, buf, sizeof(u32));
1547
1548		if (be_bit) {
1549			word_be = cpu_to_be32(word);
1550			word = *(u32 *)&word_be;
1551		} else {
1552			word_le = cpu_to_le32(word);
1553			word = *(u32 *)&word_le;
1554		}
1555
1556		bcma_write32(core, D11REGOFFS(tplatewrdata), word);
1557
1558		buf = (u8 *) buf + sizeof(u32);
1559		len -= sizeof(u32);
1560	}
1561}
1562
1563static void brcms_b_set_cwmin(struct brcms_hardware *wlc_hw, u16 newmin)
1564{
1565	wlc_hw->band->CWmin = newmin;
1566
1567	bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1568		     OBJADDR_SCR_SEL | S_DOT11_CWMIN);
1569	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1570	bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmin);
1571}
1572
1573static void brcms_b_set_cwmax(struct brcms_hardware *wlc_hw, u16 newmax)
1574{
1575	wlc_hw->band->CWmax = newmax;
1576
1577	bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1578		     OBJADDR_SCR_SEL | S_DOT11_CWMAX);
1579	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1580	bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmax);
1581}
1582
1583void brcms_b_bw_set(struct brcms_hardware *wlc_hw, u16 bw)
1584{
1585	bool fastclk;
1586
1587	/* request FAST clock if not on */
1588	fastclk = wlc_hw->forcefastclk;
1589	if (!fastclk)
1590		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
1591
1592	wlc_phy_bw_state_set(wlc_hw->band->pi, bw);
1593
1594	brcms_b_phy_reset(wlc_hw);
1595	wlc_phy_init(wlc_hw->band->pi, wlc_phy_chanspec_get(wlc_hw->band->pi));
1596
1597	/* restore the clk */
1598	if (!fastclk)
1599		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
1600}
1601
1602static void brcms_b_upd_synthpu(struct brcms_hardware *wlc_hw)
1603{
1604	u16 v;
1605	struct brcms_c_info *wlc = wlc_hw->wlc;
1606	/* update SYNTHPU_DLY */
1607
1608	if (BRCMS_ISLCNPHY(wlc->band))
1609		v = SYNTHPU_DLY_LPPHY_US;
1610	else if (BRCMS_ISNPHY(wlc->band) && (NREV_GE(wlc->band->phyrev, 3)))
1611		v = SYNTHPU_DLY_NPHY_US;
1612	else
1613		v = SYNTHPU_DLY_BPHY_US;
1614
1615	brcms_b_write_shm(wlc_hw, M_SYNTHPU_DLY, v);
1616}
1617
1618static void brcms_c_ucode_txant_set(struct brcms_hardware *wlc_hw)
1619{
1620	u16 phyctl;
1621	u16 phytxant = wlc_hw->bmac_phytxant;
1622	u16 mask = PHY_TXC_ANT_MASK;
1623
1624	/* set the Probe Response frame phy control word */
1625	phyctl = brcms_b_read_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS);
1626	phyctl = (phyctl & ~mask) | phytxant;
1627	brcms_b_write_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS, phyctl);
1628
1629	/* set the Response (ACK/CTS) frame phy control word */
1630	phyctl = brcms_b_read_shm(wlc_hw, M_RSP_PCTLWD);
1631	phyctl = (phyctl & ~mask) | phytxant;
1632	brcms_b_write_shm(wlc_hw, M_RSP_PCTLWD, phyctl);
1633}
1634
1635static u16 brcms_b_ofdm_ratetable_offset(struct brcms_hardware *wlc_hw,
1636					 u8 rate)
1637{
1638	uint i;
1639	u8 plcp_rate = 0;
1640	struct plcp_signal_rate_lookup {
1641		u8 rate;
1642		u8 signal_rate;
1643	};
1644	/* OFDM RATE sub-field of PLCP SIGNAL field, per 802.11 sec 17.3.4.1 */
1645	const struct plcp_signal_rate_lookup rate_lookup[] = {
1646		{BRCM_RATE_6M, 0xB},
1647		{BRCM_RATE_9M, 0xF},
1648		{BRCM_RATE_12M, 0xA},
1649		{BRCM_RATE_18M, 0xE},
1650		{BRCM_RATE_24M, 0x9},
1651		{BRCM_RATE_36M, 0xD},
1652		{BRCM_RATE_48M, 0x8},
1653		{BRCM_RATE_54M, 0xC}
1654	};
1655
1656	for (i = 0; i < ARRAY_SIZE(rate_lookup); i++) {
1657		if (rate == rate_lookup[i].rate) {
1658			plcp_rate = rate_lookup[i].signal_rate;
1659			break;
1660		}
1661	}
1662
1663	/* Find the SHM pointer to the rate table entry by looking in the
1664	 * Direct-map Table
1665	 */
1666	return 2 * brcms_b_read_shm(wlc_hw, M_RT_DIRMAP_A + (plcp_rate * 2));
1667}
1668
1669static void brcms_upd_ofdm_pctl1_table(struct brcms_hardware *wlc_hw)
1670{
1671	u8 rate;
1672	u8 rates[8] = {
1673		BRCM_RATE_6M, BRCM_RATE_9M, BRCM_RATE_12M, BRCM_RATE_18M,
1674		BRCM_RATE_24M, BRCM_RATE_36M, BRCM_RATE_48M, BRCM_RATE_54M
1675	};
1676	u16 entry_ptr;
1677	u16 pctl1;
1678	uint i;
1679
1680	if (!BRCMS_PHY_11N_CAP(wlc_hw->band))
1681		return;
1682
1683	/* walk the phy rate table and update the entries */
1684	for (i = 0; i < ARRAY_SIZE(rates); i++) {
1685		rate = rates[i];
1686
1687		entry_ptr = brcms_b_ofdm_ratetable_offset(wlc_hw, rate);
1688
1689		/* read the SHM Rate Table entry OFDM PCTL1 values */
1690		pctl1 =
1691		    brcms_b_read_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS);
1692
1693		/* modify the value */
1694		pctl1 &= ~PHY_TXC1_MODE_MASK;
1695		pctl1 |= (wlc_hw->hw_stf_ss_opmode << PHY_TXC1_MODE_SHIFT);
1696
1697		/* Update the SHM Rate Table entry OFDM PCTL1 values */
1698		brcms_b_write_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS,
1699				   pctl1);
1700	}
1701}
1702
1703/* band-specific init */
1704static void brcms_b_bsinit(struct brcms_c_info *wlc, u16 chanspec)
1705{
1706	struct brcms_hardware *wlc_hw = wlc->hw;
1707
1708	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
1709			   wlc_hw->band->bandunit);
1710
1711	brcms_c_ucode_bsinit(wlc_hw);
1712
1713	wlc_phy_init(wlc_hw->band->pi, chanspec);
1714
1715	brcms_c_ucode_txant_set(wlc_hw);
1716
1717	/*
1718	 * cwmin is band-specific, update hardware
1719	 * with value for current band
1720	 */
1721	brcms_b_set_cwmin(wlc_hw, wlc_hw->band->CWmin);
1722	brcms_b_set_cwmax(wlc_hw, wlc_hw->band->CWmax);
1723
1724	brcms_b_update_slot_timing(wlc_hw,
1725				   wlc_hw->band->bandtype == BRCM_BAND_5G ?
1726				   true : wlc_hw->shortslot);
1727
1728	/* write phytype and phyvers */
1729	brcms_b_write_shm(wlc_hw, M_PHYTYPE, (u16) wlc_hw->band->phytype);
1730	brcms_b_write_shm(wlc_hw, M_PHYVER, (u16) wlc_hw->band->phyrev);
1731
1732	/*
1733	 * initialize the txphyctl1 rate table since
1734	 * shmem is shared between bands
1735	 */
1736	brcms_upd_ofdm_pctl1_table(wlc_hw);
1737
1738	brcms_b_upd_synthpu(wlc_hw);
1739}
1740
1741/* Perform a soft reset of the PHY PLL */
1742void brcms_b_core_phypll_reset(struct brcms_hardware *wlc_hw)
1743{
1744	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_addr),
1745		  ~0, 0);
1746	udelay(1);
1747	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1748		  0x4, 0);
1749	udelay(1);
1750	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1751		  0x4, 4);
1752	udelay(1);
1753	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1754		  0x4, 0);
1755	udelay(1);
1756}
1757
1758/* light way to turn on phy clock without reset for NPHY only
1759 *  refer to brcms_b_core_phy_clk for full version
1760 */
1761void brcms_b_phyclk_fgc(struct brcms_hardware *wlc_hw, bool clk)
1762{
1763	/* support(necessary for NPHY and HYPHY) only */
1764	if (!BRCMS_ISNPHY(wlc_hw->band))
1765		return;
1766
1767	if (ON == clk)
1768		brcms_b_core_ioctl(wlc_hw, SICF_FGC, SICF_FGC);
1769	else
1770		brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
1771
1772}
1773
1774void brcms_b_macphyclk_set(struct brcms_hardware *wlc_hw, bool clk)
1775{
1776	if (ON == clk)
1777		brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, SICF_MPCLKE);
1778	else
1779		brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, 0);
1780}
1781
1782void brcms_b_phy_reset(struct brcms_hardware *wlc_hw)
1783{
1784	struct brcms_phy_pub *pih = wlc_hw->band->pi;
1785	u32 phy_bw_clkbits;
1786	bool phy_in_reset = false;
1787
1788	brcms_dbg_info(wlc_hw->d11core, "wl%d: reset phy\n", wlc_hw->unit);
1789
1790	if (pih == NULL)
1791		return;
1792
1793	phy_bw_clkbits = wlc_phy_clk_bwbits(wlc_hw->band->pi);
1794
1795	/* Specific reset sequence required for NPHY rev 3 and 4 */
1796	if (BRCMS_ISNPHY(wlc_hw->band) && NREV_GE(wlc_hw->band->phyrev, 3) &&
1797	    NREV_LE(wlc_hw->band->phyrev, 4)) {
1798		/* Set the PHY bandwidth */
1799		brcms_b_core_ioctl(wlc_hw, SICF_BWMASK, phy_bw_clkbits);
1800
1801		udelay(1);
1802
1803		/* Perform a soft reset of the PHY PLL */
1804		brcms_b_core_phypll_reset(wlc_hw);
1805
1806		/* reset the PHY */
1807		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_PCLKE),
1808				   (SICF_PRST | SICF_PCLKE));
1809		phy_in_reset = true;
1810	} else {
1811		brcms_b_core_ioctl(wlc_hw,
1812				   (SICF_PRST | SICF_PCLKE | SICF_BWMASK),
1813				   (SICF_PRST | SICF_PCLKE | phy_bw_clkbits));
1814	}
1815
1816	udelay(2);
1817	brcms_b_core_phy_clk(wlc_hw, ON);
1818
1819	if (pih)
1820		wlc_phy_anacore(pih, ON);
1821}
1822
1823/* switch to and initialize new band */
1824static void brcms_b_setband(struct brcms_hardware *wlc_hw, uint bandunit,
1825			    u16 chanspec) {
1826	struct brcms_c_info *wlc = wlc_hw->wlc;
1827	u32 macintmask;
1828
1829	/* Enable the d11 core before accessing it */
1830	if (!bcma_core_is_enabled(wlc_hw->d11core)) {
1831		bcma_core_enable(wlc_hw->d11core, 0);
1832		brcms_c_mctrl_reset(wlc_hw);
1833	}
1834
1835	macintmask = brcms_c_setband_inact(wlc, bandunit);
1836
1837	if (!wlc_hw->up)
1838		return;
1839
1840	brcms_b_core_phy_clk(wlc_hw, ON);
1841
1842	/* band-specific initializations */
1843	brcms_b_bsinit(wlc, chanspec);
1844
1845	/*
1846	 * If there are any pending software interrupt bits,
1847	 * then replace these with a harmless nonzero value
1848	 * so brcms_c_dpc() will re-enable interrupts when done.
1849	 */
1850	if (wlc->macintstatus)
1851		wlc->macintstatus = MI_DMAINT;
1852
1853	/* restore macintmask */
1854	brcms_intrsrestore(wlc->wl, macintmask);
1855
1856	/* ucode should still be suspended.. */
1857	WARN_ON((bcma_read32(wlc_hw->d11core, D11REGOFFS(maccontrol)) &
1858		 MCTL_EN_MAC) != 0);
1859}
1860
1861static bool brcms_c_isgoodchip(struct brcms_hardware *wlc_hw)
1862{
1863
1864	/* reject unsupported corerev */
1865	if (!CONF_HAS(D11CONF, wlc_hw->corerev)) {
1866		wiphy_err(wlc_hw->wlc->wiphy, "unsupported core rev %d\n",
1867			  wlc_hw->corerev);
1868		return false;
1869	}
1870
1871	return true;
1872}
1873
1874/* Validate some board info parameters */
1875static bool brcms_c_validboardtype(struct brcms_hardware *wlc_hw)
1876{
1877	uint boardrev = wlc_hw->boardrev;
1878
1879	/* 4 bits each for board type, major, minor, and tiny version */
1880	uint brt = (boardrev & 0xf000) >> 12;
1881	uint b0 = (boardrev & 0xf00) >> 8;
1882	uint b1 = (boardrev & 0xf0) >> 4;
1883	uint b2 = boardrev & 0xf;
1884
1885	/* voards from other vendors are always considered valid */
1886	if (ai_get_boardvendor(wlc_hw->sih) != PCI_VENDOR_ID_BROADCOM)
1887		return true;
1888
1889	/* do some boardrev sanity checks when boardvendor is Broadcom */
1890	if (boardrev == 0)
1891		return false;
1892
1893	if (boardrev <= 0xff)
1894		return true;
1895
1896	if ((brt > 2) || (brt == 0) || (b0 > 9) || (b0 == 0) || (b1 > 9)
1897		|| (b2 > 9))
1898		return false;
1899
1900	return true;
1901}
1902
1903static void brcms_c_get_macaddr(struct brcms_hardware *wlc_hw, u8 etheraddr[ETH_ALEN])
1904{
1905	struct ssb_sprom *sprom = &wlc_hw->d11core->bus->sprom;
1906
1907	/* If macaddr exists, use it (Sromrev4, CIS, ...). */
1908	if (!is_zero_ether_addr(sprom->il0mac)) {
1909		memcpy(etheraddr, sprom->il0mac, ETH_ALEN);
1910		return;
1911	}
1912
1913	if (wlc_hw->_nbands > 1)
1914		memcpy(etheraddr, sprom->et1mac, ETH_ALEN);
1915	else
1916		memcpy(etheraddr, sprom->il0mac, ETH_ALEN);
1917}
1918
1919/* power both the pll and external oscillator on/off */
1920static void brcms_b_xtal(struct brcms_hardware *wlc_hw, bool want)
1921{
1922	brcms_dbg_info(wlc_hw->d11core, "wl%d: want %d\n", wlc_hw->unit, want);
1923
1924	/*
1925	 * dont power down if plldown is false or
1926	 * we must poll hw radio disable
1927	 */
1928	if (!want && wlc_hw->pllreq)
1929		return;
1930
1931	wlc_hw->sbclk = want;
1932	if (!wlc_hw->sbclk) {
1933		wlc_hw->clk = false;
1934		if (wlc_hw->band && wlc_hw->band->pi)
1935			wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
1936	}
1937}
1938
1939/*
1940 * Return true if radio is disabled, otherwise false.
1941 * hw radio disable signal is an external pin, users activate it asynchronously
1942 * this function could be called when driver is down and w/o clock
1943 * it operates on different registers depending on corerev and boardflag.
1944 */
1945static bool brcms_b_radio_read_hwdisabled(struct brcms_hardware *wlc_hw)
1946{
1947	bool v, clk, xtal;
1948	u32 flags = 0;
1949
1950	xtal = wlc_hw->sbclk;
1951	if (!xtal)
1952		brcms_b_xtal(wlc_hw, ON);
1953
1954	/* may need to take core out of reset first */
1955	clk = wlc_hw->clk;
1956	if (!clk) {
1957		/*
1958		 * mac no longer enables phyclk automatically when driver
1959		 * accesses phyreg throughput mac. This can be skipped since
1960		 * only mac reg is accessed below
1961		 */
1962		if (D11REV_GE(wlc_hw->corerev, 18))
1963			flags |= SICF_PCLKE;
1964
1965		/*
1966		 * TODO: test suspend/resume
1967		 *
1968		 * AI chip doesn't restore bar0win2 on
1969		 * hibernation/resume, need sw fixup
1970		 */
1971
1972		bcma_core_enable(wlc_hw->d11core, flags);
1973		brcms_c_mctrl_reset(wlc_hw);
1974	}
1975
1976	v = ((bcma_read32(wlc_hw->d11core,
1977			  D11REGOFFS(phydebug)) & PDBG_RFD) != 0);
1978
1979	/* put core back into reset */
1980	if (!clk)
1981		bcma_core_disable(wlc_hw->d11core, 0);
1982
1983	if (!xtal)
1984		brcms_b_xtal(wlc_hw, OFF);
1985
1986	return v;
1987}
1988
1989static bool wlc_dma_rxreset(struct brcms_hardware *wlc_hw, uint fifo)
1990{
1991	struct dma_pub *di = wlc_hw->di[fifo];
1992	return dma_rxreset(di);
1993}
1994
1995/* d11 core reset
1996 *   ensure fask clock during reset
1997 *   reset dma
1998 *   reset d11(out of reset)
1999 *   reset phy(out of reset)
2000 *   clear software macintstatus for fresh new start
2001 * one testing hack wlc_hw->noreset will bypass the d11/phy reset
2002 */
2003void brcms_b_corereset(struct brcms_hardware *wlc_hw, u32 flags)
2004{
2005	uint i;
2006	bool fastclk;
2007
2008	if (flags == BRCMS_USE_COREFLAGS)
2009		flags = (wlc_hw->band->pi ? wlc_hw->band->core_flags : 0);
2010
2011	brcms_dbg_info(wlc_hw->d11core, "wl%d: core reset\n", wlc_hw->unit);
2012
2013	/* request FAST clock if not on  */
2014	fastclk = wlc_hw->forcefastclk;
2015	if (!fastclk)
2016		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2017
2018	/* reset the dma engines except first time thru */
2019	if (bcma_core_is_enabled(wlc_hw->d11core)) {
2020		for (i = 0; i < NFIFO; i++)
2021			if ((wlc_hw->di[i]) && (!dma_txreset(wlc_hw->di[i])))
2022				brcms_err(wlc_hw->d11core, "wl%d: %s: "
2023					  "dma_txreset[%d]: cannot stop dma\n",
2024					   wlc_hw->unit, __func__, i);
2025
2026		if ((wlc_hw->di[RX_FIFO])
2027		    && (!wlc_dma_rxreset(wlc_hw, RX_FIFO)))
2028			brcms_err(wlc_hw->d11core, "wl%d: %s: dma_rxreset"
2029				  "[%d]: cannot stop dma\n",
2030				  wlc_hw->unit, __func__, RX_FIFO);
2031	}
2032	/* if noreset, just stop the psm and return */
2033	if (wlc_hw->noreset) {
2034		wlc_hw->wlc->macintstatus = 0;	/* skip wl_dpc after down */
2035		brcms_b_mctrl(wlc_hw, MCTL_PSM_RUN | MCTL_EN_MAC, 0);
2036		return;
2037	}
2038
2039	/*
2040	 * mac no longer enables phyclk automatically when driver accesses
2041	 * phyreg throughput mac, AND phy_reset is skipped at early stage when
2042	 * band->pi is invalid. need to enable PHY CLK
2043	 */
2044	if (D11REV_GE(wlc_hw->corerev, 18))
2045		flags |= SICF_PCLKE;
2046
2047	/*
2048	 * reset the core
2049	 * In chips with PMU, the fastclk request goes through d11 core
2050	 * reg 0x1e0, which is cleared by the core_reset. have to re-request it.
2051	 *
2052	 * This adds some delay and we can optimize it by also requesting
2053	 * fastclk through chipcommon during this period if necessary. But
2054	 * that has to work coordinate with other driver like mips/arm since
2055	 * they may touch chipcommon as well.
2056	 */
2057	wlc_hw->clk = false;
2058	bcma_core_enable(wlc_hw->d11core, flags);
2059	wlc_hw->clk = true;
2060	if (wlc_hw->band && wlc_hw->band->pi)
2061		wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, true);
2062
2063	brcms_c_mctrl_reset(wlc_hw);
2064
2065	if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU)
2066		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2067
2068	brcms_b_phy_reset(wlc_hw);
2069
2070	/* turn on PHY_PLL */
2071	brcms_b_core_phypll_ctl(wlc_hw, true);
2072
2073	/* clear sw intstatus */
2074	wlc_hw->wlc->macintstatus = 0;
2075
2076	/* restore the clk setting */
2077	if (!fastclk)
2078		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
2079}
2080
2081/* txfifo sizes needs to be modified(increased) since the newer cores
2082 * have more memory.
2083 */
2084static void brcms_b_corerev_fifofixup(struct brcms_hardware *wlc_hw)
2085{
2086	struct bcma_device *core = wlc_hw->d11core;
2087	u16 fifo_nu;
2088	u16 txfifo_startblk = TXFIFO_START_BLK, txfifo_endblk;
2089	u16 txfifo_def, txfifo_def1;
2090	u16 txfifo_cmd;
2091
2092	/* tx fifos start at TXFIFO_START_BLK from the Base address */
2093	txfifo_startblk = TXFIFO_START_BLK;
2094
2095	/* sequence of operations:  reset fifo, set fifo size, reset fifo */
2096	for (fifo_nu = 0; fifo_nu < NFIFO; fifo_nu++) {
2097
2098		txfifo_endblk = txfifo_startblk + wlc_hw->xmtfifo_sz[fifo_nu];
2099		txfifo_def = (txfifo_startblk & 0xff) |
2100		    (((txfifo_endblk - 1) & 0xff) << TXFIFO_FIFOTOP_SHIFT);
2101		txfifo_def1 = ((txfifo_startblk >> 8) & 0x1) |
2102		    ((((txfifo_endblk -
2103			1) >> 8) & 0x1) << TXFIFO_FIFOTOP_SHIFT);
2104		txfifo_cmd =
2105		    TXFIFOCMD_RESET_MASK | (fifo_nu << TXFIFOCMD_FIFOSEL_SHIFT);
2106
2107		bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2108		bcma_write16(core, D11REGOFFS(xmtfifodef), txfifo_def);
2109		bcma_write16(core, D11REGOFFS(xmtfifodef1), txfifo_def1);
2110
2111		bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2112
2113		txfifo_startblk += wlc_hw->xmtfifo_sz[fifo_nu];
2114	}
2115	/*
2116	 * need to propagate to shm location to be in sync since ucode/hw won't
2117	 * do this
2118	 */
2119	brcms_b_write_shm(wlc_hw, M_FIFOSIZE0,
2120			   wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]);
2121	brcms_b_write_shm(wlc_hw, M_FIFOSIZE1,
2122			   wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]);
2123	brcms_b_write_shm(wlc_hw, M_FIFOSIZE2,
2124			   ((wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO] << 8) | wlc_hw->
2125			    xmtfifo_sz[TX_AC_BK_FIFO]));
2126	brcms_b_write_shm(wlc_hw, M_FIFOSIZE3,
2127			   ((wlc_hw->xmtfifo_sz[TX_ATIM_FIFO] << 8) | wlc_hw->
2128			    xmtfifo_sz[TX_BCMC_FIFO]));
2129}
2130
2131/* This function is used for changing the tsf frac register
2132 * If spur avoidance mode is off, the mac freq will be 80/120/160Mhz
2133 * If spur avoidance mode is on1, the mac freq will be 82/123/164Mhz
2134 * If spur avoidance mode is on2, the mac freq will be 84/126/168Mhz
2135 * HTPHY Formula is 2^26/freq(MHz) e.g.
2136 * For spuron2 - 126MHz -> 2^26/126 = 532610.0
2137 *  - 532610 = 0x82082 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x2082
2138 * For spuron: 123MHz -> 2^26/123    = 545600.5
2139 *  - 545601 = 0x85341 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x5341
2140 * For spur off: 120MHz -> 2^26/120    = 559240.5
2141 *  - 559241 = 0x88889 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x8889
2142 */
2143
2144void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode)
2145{
2146	struct bcma_device *core = wlc_hw->d11core;
2147
2148	if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43224) ||
2149	    (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225)) {
2150		if (spurmode == WL_SPURAVOID_ON2) {	/* 126Mhz */
2151			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x2082);
2152			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2153		} else if (spurmode == WL_SPURAVOID_ON1) {	/* 123Mhz */
2154			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x5341);
2155			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2156		} else {	/* 120Mhz */
2157			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x8889);
2158			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2159		}
2160	} else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2161		if (spurmode == WL_SPURAVOID_ON1) {	/* 82Mhz */
2162			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x7CE0);
2163			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2164		} else {	/* 80Mhz */
2165			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0xCCCD);
2166			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2167		}
2168	}
2169}
2170
2171void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr)
2172{
2173	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2174	wlc->bsscfg->type = BRCMS_TYPE_STATION;
2175}
2176
2177void brcms_c_start_ap(struct brcms_c_info *wlc, u8 *addr, const u8 *bssid,
2178		      u8 *ssid, size_t ssid_len)
2179{
2180	brcms_c_set_ssid(wlc, ssid, ssid_len);
2181
2182	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2183	memcpy(wlc->bsscfg->BSSID, bssid, sizeof(wlc->bsscfg->BSSID));
2184	wlc->bsscfg->type = BRCMS_TYPE_AP;
2185
2186	brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, MCTL_AP | MCTL_INFRA);
2187}
2188
2189void brcms_c_start_adhoc(struct brcms_c_info *wlc, u8 *addr)
2190{
2191	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2192	wlc->bsscfg->type = BRCMS_TYPE_ADHOC;
2193
2194	brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, 0);
2195}
2196
2197/* Initialize GPIOs that are controlled by D11 core */
2198static void brcms_c_gpio_init(struct brcms_c_info *wlc)
2199{
2200	struct brcms_hardware *wlc_hw = wlc->hw;
2201	u32 gc, gm;
2202
2203	/* use GPIO select 0 to get all gpio signals from the gpio out reg */
2204	brcms_b_mctrl(wlc_hw, MCTL_GPOUT_SEL_MASK, 0);
2205
2206	/*
2207	 * Common GPIO setup:
2208	 *      G0 = LED 0 = WLAN Activity
2209	 *      G1 = LED 1 = WLAN 2.4 GHz Radio State
2210	 *      G2 = LED 2 = WLAN 5 GHz Radio State
2211	 *      G4 = radio disable input (HI enabled, LO disabled)
2212	 */
2213
2214	gc = gm = 0;
2215
2216	/* Allocate GPIOs for mimo antenna diversity feature */
2217	if (wlc_hw->antsel_type == ANTSEL_2x3) {
2218		/* Enable antenna diversity, use 2x3 mode */
2219		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2220			     MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2221		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE,
2222			     MHF3_ANTSEL_MODE, BRCM_BAND_ALL);
2223
2224		/* init superswitch control */
2225		wlc_phy_antsel_init(wlc_hw->band->pi, false);
2226
2227	} else if (wlc_hw->antsel_type == ANTSEL_2x4) {
2228		gm |= gc |= (BOARD_GPIO_12 | BOARD_GPIO_13);
2229		/*
2230		 * The board itself is powered by these GPIOs
2231		 * (when not sending pattern) so set them high
2232		 */
2233		bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_oe),
2234			   (BOARD_GPIO_12 | BOARD_GPIO_13));
2235		bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_out),
2236			   (BOARD_GPIO_12 | BOARD_GPIO_13));
2237
2238		/* Enable antenna diversity, use 2x4 mode */
2239		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2240			     MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2241		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE, 0,
2242			     BRCM_BAND_ALL);
2243
2244		/* Configure the desired clock to be 4Mhz */
2245		brcms_b_write_shm(wlc_hw, M_ANTSEL_CLKDIV,
2246				   ANTSEL_CLKDIV_4MHZ);
2247	}
2248
2249	/*
2250	 * gpio 9 controls the PA. ucode is responsible
2251	 * for wiggling out and oe
2252	 */
2253	if (wlc_hw->boardflags & BFL_PACTRL)
2254		gm |= gc |= BOARD_GPIO_PACTRL;
2255
2256	/* apply to gpiocontrol register */
2257	bcma_chipco_gpio_control(&wlc_hw->d11core->bus->drv_cc, gm, gc);
2258}
2259
2260static void brcms_ucode_write(struct brcms_hardware *wlc_hw,
2261			      const __le32 ucode[], const size_t nbytes)
2262{
2263	struct bcma_device *core = wlc_hw->d11core;
2264	uint i;
2265	uint count;
2266
2267	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
2268
2269	count = (nbytes / sizeof(u32));
2270
2271	bcma_write32(core, D11REGOFFS(objaddr),
2272		     OBJADDR_AUTO_INC | OBJADDR_UCM_SEL);
2273	(void)bcma_read32(core, D11REGOFFS(objaddr));
2274	for (i = 0; i < count; i++)
2275		bcma_write32(core, D11REGOFFS(objdata), le32_to_cpu(ucode[i]));
2276
2277}
2278
2279static void brcms_ucode_download(struct brcms_hardware *wlc_hw)
2280{
2281	struct brcms_c_info *wlc;
2282	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
2283
2284	wlc = wlc_hw->wlc;
2285
2286	if (wlc_hw->ucode_loaded)
2287		return;
2288
2289	if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
2290		if (BRCMS_ISNPHY(wlc_hw->band)) {
2291			brcms_ucode_write(wlc_hw, ucode->bcm43xx_16_mimo,
2292					  ucode->bcm43xx_16_mimosz);
2293			wlc_hw->ucode_loaded = true;
2294		} else
2295			brcms_err(wlc_hw->d11core,
2296				  "%s: wl%d: unsupported phy in corerev %d\n",
2297				  __func__, wlc_hw->unit, wlc_hw->corerev);
2298	} else if (D11REV_IS(wlc_hw->corerev, 24)) {
2299		if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2300			brcms_ucode_write(wlc_hw, ucode->bcm43xx_24_lcn,
2301					  ucode->bcm43xx_24_lcnsz);
2302			wlc_hw->ucode_loaded = true;
2303		} else {
2304			brcms_err(wlc_hw->d11core,
2305				  "%s: wl%d: unsupported phy in corerev %d\n",
2306				  __func__, wlc_hw->unit, wlc_hw->corerev);
2307		}
2308	}
2309}
2310
2311void brcms_b_txant_set(struct brcms_hardware *wlc_hw, u16 phytxant)
2312{
2313	/* update sw state */
2314	wlc_hw->bmac_phytxant = phytxant;
2315
2316	/* push to ucode if up */
2317	if (!wlc_hw->up)
2318		return;
2319	brcms_c_ucode_txant_set(wlc_hw);
2320
2321}
2322
2323u16 brcms_b_get_txant(struct brcms_hardware *wlc_hw)
2324{
2325	return (u16) wlc_hw->wlc->stf->txant;
2326}
2327
2328void brcms_b_antsel_type_set(struct brcms_hardware *wlc_hw, u8 antsel_type)
2329{
2330	wlc_hw->antsel_type = antsel_type;
2331
2332	/* Update the antsel type for phy module to use */
2333	wlc_phy_antsel_type_set(wlc_hw->band->pi, antsel_type);
2334}
2335
2336static void brcms_b_fifoerrors(struct brcms_hardware *wlc_hw)
2337{
2338	bool fatal = false;
2339	uint unit;
2340	uint intstatus, idx;
2341	struct bcma_device *core = wlc_hw->d11core;
2342
2343	unit = wlc_hw->unit;
2344
2345	for (idx = 0; idx < NFIFO; idx++) {
2346		/* read intstatus register and ignore any non-error bits */
2347		intstatus =
2348			bcma_read32(core,
2349				    D11REGOFFS(intctrlregs[idx].intstatus)) &
2350			I_ERRORS;
2351		if (!intstatus)
2352			continue;
2353
2354		brcms_dbg_int(core, "wl%d: intstatus%d 0x%x\n",
2355			      unit, idx, intstatus);
2356
2357		if (intstatus & I_RO) {
2358			brcms_err(core, "wl%d: fifo %d: receive fifo "
2359				  "overflow\n", unit, idx);
2360			fatal = true;
2361		}
2362
2363		if (intstatus & I_PC) {
2364			brcms_err(core, "wl%d: fifo %d: descriptor error\n",
2365				  unit, idx);
2366			fatal = true;
2367		}
2368
2369		if (intstatus & I_PD) {
2370			brcms_err(core, "wl%d: fifo %d: data error\n", unit,
2371				  idx);
2372			fatal = true;
2373		}
2374
2375		if (intstatus & I_DE) {
2376			brcms_err(core, "wl%d: fifo %d: descriptor protocol "
2377				  "error\n", unit, idx);
2378			fatal = true;
2379		}
2380
2381		if (intstatus & I_RU)
2382			brcms_err(core, "wl%d: fifo %d: receive descriptor "
2383				  "underflow\n", idx, unit);
2384
2385		if (intstatus & I_XU) {
2386			brcms_err(core, "wl%d: fifo %d: transmit fifo "
2387				  "underflow\n", idx, unit);
2388			fatal = true;
2389		}
2390
2391		if (fatal) {
2392			brcms_fatal_error(wlc_hw->wlc->wl); /* big hammer */
2393			break;
2394		} else
2395			bcma_write32(core,
2396				     D11REGOFFS(intctrlregs[idx].intstatus),
2397				     intstatus);
2398	}
2399}
2400
2401void brcms_c_intrson(struct brcms_c_info *wlc)
2402{
2403	struct brcms_hardware *wlc_hw = wlc->hw;
2404	wlc->macintmask = wlc->defmacintmask;
2405	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2406}
2407
2408u32 brcms_c_intrsoff(struct brcms_c_info *wlc)
2409{
2410	struct brcms_hardware *wlc_hw = wlc->hw;
2411	u32 macintmask;
2412
2413	if (!wlc_hw->clk)
2414		return 0;
2415
2416	macintmask = wlc->macintmask;	/* isr can still happen */
2417
2418	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), 0);
2419	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(macintmask));
2420	udelay(1);		/* ensure int line is no longer driven */
2421	wlc->macintmask = 0;
2422
2423	/* return previous macintmask; resolve race between us and our isr */
2424	return wlc->macintstatus ? 0 : macintmask;
2425}
2426
2427void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask)
2428{
2429	struct brcms_hardware *wlc_hw = wlc->hw;
2430	if (!wlc_hw->clk)
2431		return;
2432
2433	wlc->macintmask = macintmask;
2434	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2435}
2436
2437/* assumes that the d11 MAC is enabled */
2438static void brcms_b_tx_fifo_suspend(struct brcms_hardware *wlc_hw,
2439				    uint tx_fifo)
2440{
2441	u8 fifo = 1 << tx_fifo;
2442
2443	/* Two clients of this code, 11h Quiet period and scanning. */
2444
2445	/* only suspend if not already suspended */
2446	if ((wlc_hw->suspended_fifos & fifo) == fifo)
2447		return;
2448
2449	/* force the core awake only if not already */
2450	if (wlc_hw->suspended_fifos == 0)
2451		brcms_c_ucode_wake_override_set(wlc_hw,
2452						BRCMS_WAKE_OVERRIDE_TXFIFO);
2453
2454	wlc_hw->suspended_fifos |= fifo;
2455
2456	if (wlc_hw->di[tx_fifo]) {
2457		/*
2458		 * Suspending AMPDU transmissions in the middle can cause
2459		 * underflow which may result in mismatch between ucode and
2460		 * driver so suspend the mac before suspending the FIFO
2461		 */
2462		if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2463			brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
2464
2465		dma_txsuspend(wlc_hw->di[tx_fifo]);
2466
2467		if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2468			brcms_c_enable_mac(wlc_hw->wlc);
2469	}
2470}
2471
2472static void brcms_b_tx_fifo_resume(struct brcms_hardware *wlc_hw,
2473				   uint tx_fifo)
2474{
2475	/* BMAC_NOTE: BRCMS_TX_FIFO_ENAB is done in brcms_c_dpc() for DMA case
2476	 * but need to be done here for PIO otherwise the watchdog will catch
2477	 * the inconsistency and fire
2478	 */
2479	/* Two clients of this code, 11h Quiet period and scanning. */
2480	if (wlc_hw->di[tx_fifo])
2481		dma_txresume(wlc_hw->di[tx_fifo]);
2482
2483	/* allow core to sleep again */
2484	if (wlc_hw->suspended_fifos == 0)
2485		return;
2486	else {
2487		wlc_hw->suspended_fifos &= ~(1 << tx_fifo);
2488		if (wlc_hw->suspended_fifos == 0)
2489			brcms_c_ucode_wake_override_clear(wlc_hw,
2490						BRCMS_WAKE_OVERRIDE_TXFIFO);
2491	}
2492}
2493
2494/* precondition: requires the mac core to be enabled */
2495static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
2496{
2497	static const u8 null_ether_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
2498	u8 *ethaddr = wlc_hw->wlc->pub->cur_etheraddr;
2499
2500	if (mute_tx) {
2501		/* suspend tx fifos */
2502		brcms_b_tx_fifo_suspend(wlc_hw, TX_DATA_FIFO);
2503		brcms_b_tx_fifo_suspend(wlc_hw, TX_CTL_FIFO);
2504		brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_BK_FIFO);
2505		brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_VI_FIFO);
2506
2507		/* zero the address match register so we do not send ACKs */
2508		brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, null_ether_addr);
2509	} else {
2510		/* resume tx fifos */
2511		brcms_b_tx_fifo_resume(wlc_hw, TX_DATA_FIFO);
2512		brcms_b_tx_fifo_resume(wlc_hw, TX_CTL_FIFO);
2513		brcms_b_tx_fifo_resume(wlc_hw, TX_AC_BK_FIFO);
2514		brcms_b_tx_fifo_resume(wlc_hw, TX_AC_VI_FIFO);
2515
2516		/* Restore address */
2517		brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, ethaddr);
2518	}
2519
2520	wlc_phy_mute_upd(wlc_hw->band->pi, mute_tx, 0);
2521
2522	if (mute_tx)
2523		brcms_c_ucode_mute_override_set(wlc_hw);
2524	else
2525		brcms_c_ucode_mute_override_clear(wlc_hw);
2526}
2527
2528void
2529brcms_c_mute(struct brcms_c_info *wlc, bool mute_tx)
2530{
2531	brcms_b_mute(wlc->hw, mute_tx);
2532}
2533
2534/*
2535 * Read and clear macintmask and macintstatus and intstatus registers.
2536 * This routine should be called with interrupts off
2537 * Return:
2538 *   -1 if brcms_deviceremoved(wlc) evaluates to true;
2539 *   0 if the interrupt is not for us, or we are in some special cases;
2540 *   device interrupt status bits otherwise.
2541 */
2542static inline u32 wlc_intstatus(struct brcms_c_info *wlc, bool in_isr)
2543{
2544	struct brcms_hardware *wlc_hw = wlc->hw;
2545	struct bcma_device *core = wlc_hw->d11core;
2546	u32 macintstatus, mask;
2547
2548	/* macintstatus includes a DMA interrupt summary bit */
2549	macintstatus = bcma_read32(core, D11REGOFFS(macintstatus));
2550	mask = in_isr ? wlc->macintmask : wlc->defmacintmask;
2551
2552	trace_brcms_macintstatus(&core->dev, in_isr, macintstatus, mask);
2553
2554	/* detect cardbus removed, in power down(suspend) and in reset */
2555	if (brcms_deviceremoved(wlc))
2556		return -1;
2557
2558	/* brcms_deviceremoved() succeeds even when the core is still resetting,
2559	 * handle that case here.
2560	 */
2561	if (macintstatus == 0xffffffff)
2562		return 0;
2563
2564	/* defer unsolicited interrupts */
2565	macintstatus &= mask;
2566
2567	/* if not for us */
2568	if (macintstatus == 0)
2569		return 0;
2570
2571	/* turn off the interrupts */
2572	bcma_write32(core, D11REGOFFS(macintmask), 0);
2573	(void)bcma_read32(core, D11REGOFFS(macintmask));
2574	wlc->macintmask = 0;
2575
2576	/* clear device interrupts */
2577	bcma_write32(core, D11REGOFFS(macintstatus), macintstatus);
2578
2579	/* MI_DMAINT is indication of non-zero intstatus */
2580	if (macintstatus & MI_DMAINT)
2581		/*
2582		 * only fifo interrupt enabled is I_RI in
2583		 * RX_FIFO. If MI_DMAINT is set, assume it
2584		 * is set and clear the interrupt.
2585		 */
2586		bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intstatus),
2587			     DEF_RXINTMASK);
2588
2589	return macintstatus;
2590}
2591
2592/* Update wlc->macintstatus and wlc->intstatus[]. */
2593/* Return true if they are updated successfully. false otherwise */
2594bool brcms_c_intrsupd(struct brcms_c_info *wlc)
2595{
2596	u32 macintstatus;
2597
2598	/* read and clear macintstatus and intstatus registers */
2599	macintstatus = wlc_intstatus(wlc, false);
2600
2601	/* device is removed */
2602	if (macintstatus == 0xffffffff)
2603		return false;
2604
2605	/* update interrupt status in software */
2606	wlc->macintstatus |= macintstatus;
2607
2608	return true;
2609}
2610
2611/*
2612 * First-level interrupt processing.
2613 * Return true if this was our interrupt
2614 * and if further brcms_c_dpc() processing is required,
2615 * false otherwise.
2616 */
2617bool brcms_c_isr(struct brcms_c_info *wlc)
2618{
2619	struct brcms_hardware *wlc_hw = wlc->hw;
2620	u32 macintstatus;
2621
2622	if (!wlc_hw->up || !wlc->macintmask)
2623		return false;
2624
2625	/* read and clear macintstatus and intstatus registers */
2626	macintstatus = wlc_intstatus(wlc, true);
2627
2628	if (macintstatus == 0xffffffff) {
2629		brcms_err(wlc_hw->d11core,
2630			  "DEVICEREMOVED detected in the ISR code path\n");
2631		return false;
2632	}
2633
2634	/* it is not for us */
2635	if (macintstatus == 0)
2636		return false;
2637
2638	/* save interrupt status bits */
2639	wlc->macintstatus = macintstatus;
2640
2641	return true;
2642
2643}
2644
2645void brcms_c_suspend_mac_and_wait(struct brcms_c_info *wlc)
2646{
2647	struct brcms_hardware *wlc_hw = wlc->hw;
2648	struct bcma_device *core = wlc_hw->d11core;
2649	u32 mc, mi;
2650
2651	brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2652			   wlc_hw->band->bandunit);
2653
2654	/*
2655	 * Track overlapping suspend requests
2656	 */
2657	wlc_hw->mac_suspend_depth++;
2658	if (wlc_hw->mac_suspend_depth > 1)
2659		return;
2660
2661	/* force the core awake */
2662	brcms_c_ucode_wake_override_set(wlc_hw, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2663
2664	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2665
2666	if (mc == 0xffffffff) {
2667		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2668			  __func__);
2669		brcms_down(wlc->wl);
2670		return;
2671	}
2672	WARN_ON(mc & MCTL_PSM_JMP_0);
2673	WARN_ON(!(mc & MCTL_PSM_RUN));
2674	WARN_ON(!(mc & MCTL_EN_MAC));
2675
2676	mi = bcma_read32(core, D11REGOFFS(macintstatus));
2677	if (mi == 0xffffffff) {
2678		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2679			  __func__);
2680		brcms_down(wlc->wl);
2681		return;
2682	}
2683	WARN_ON(mi & MI_MACSSPNDD);
2684
2685	brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, 0);
2686
2687	SPINWAIT(!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD),
2688		 BRCMS_MAX_MAC_SUSPEND);
2689
2690	if (!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD)) {
2691		brcms_err(core, "wl%d: wlc_suspend_mac_and_wait: waited %d uS"
2692			  " and MI_MACSSPNDD is still not on.\n",
2693			  wlc_hw->unit, BRCMS_MAX_MAC_SUSPEND);
2694		brcms_err(core, "wl%d: psmdebug 0x%08x, phydebug 0x%08x, "
2695			  "psm_brc 0x%04x\n", wlc_hw->unit,
2696			  bcma_read32(core, D11REGOFFS(psmdebug)),
2697			  bcma_read32(core, D11REGOFFS(phydebug)),
2698			  bcma_read16(core, D11REGOFFS(psm_brc)));
2699	}
2700
2701	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2702	if (mc == 0xffffffff) {
2703		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2704			  __func__);
2705		brcms_down(wlc->wl);
2706		return;
2707	}
2708	WARN_ON(mc & MCTL_PSM_JMP_0);
2709	WARN_ON(!(mc & MCTL_PSM_RUN));
2710	WARN_ON(mc & MCTL_EN_MAC);
2711}
2712
2713void brcms_c_enable_mac(struct brcms_c_info *wlc)
2714{
2715	struct brcms_hardware *wlc_hw = wlc->hw;
2716	struct bcma_device *core = wlc_hw->d11core;
2717	u32 mc, mi;
2718
2719	brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2720			   wlc->band->bandunit);
2721
2722	/*
2723	 * Track overlapping suspend requests
2724	 */
2725	wlc_hw->mac_suspend_depth--;
2726	if (wlc_hw->mac_suspend_depth > 0)
2727		return;
2728
2729	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2730	WARN_ON(mc & MCTL_PSM_JMP_0);
2731	WARN_ON(mc & MCTL_EN_MAC);
2732	WARN_ON(!(mc & MCTL_PSM_RUN));
2733
2734	brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, MCTL_EN_MAC);
2735	bcma_write32(core, D11REGOFFS(macintstatus), MI_MACSSPNDD);
2736
2737	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2738	WARN_ON(mc & MCTL_PSM_JMP_0);
2739	WARN_ON(!(mc & MCTL_EN_MAC));
2740	WARN_ON(!(mc & MCTL_PSM_RUN));
2741
2742	mi = bcma_read32(core, D11REGOFFS(macintstatus));
2743	WARN_ON(mi & MI_MACSSPNDD);
2744
2745	brcms_c_ucode_wake_override_clear(wlc_hw,
2746					  BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2747}
2748
2749void brcms_b_band_stf_ss_set(struct brcms_hardware *wlc_hw, u8 stf_mode)
2750{
2751	wlc_hw->hw_stf_ss_opmode = stf_mode;
2752
2753	if (wlc_hw->clk)
2754		brcms_upd_ofdm_pctl1_table(wlc_hw);
2755}
2756
2757static bool brcms_b_validate_chip_access(struct brcms_hardware *wlc_hw)
2758{
2759	struct bcma_device *core = wlc_hw->d11core;
2760	u32 w, val;
2761	struct wiphy *wiphy = wlc_hw->wlc->wiphy;
2762
2763	/* Validate dchip register access */
2764
2765	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2766	(void)bcma_read32(core, D11REGOFFS(objaddr));
2767	w = bcma_read32(core, D11REGOFFS(objdata));
2768
2769	/* Can we write and read back a 32bit register? */
2770	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2771	(void)bcma_read32(core, D11REGOFFS(objaddr));
2772	bcma_write32(core, D11REGOFFS(objdata), (u32) 0xaa5555aa);
2773
2774	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2775	(void)bcma_read32(core, D11REGOFFS(objaddr));
2776	val = bcma_read32(core, D11REGOFFS(objdata));
2777	if (val != (u32) 0xaa5555aa) {
2778		wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2779			  "expected 0xaa5555aa\n", wlc_hw->unit, val);
2780		return false;
2781	}
2782
2783	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2784	(void)bcma_read32(core, D11REGOFFS(objaddr));
2785	bcma_write32(core, D11REGOFFS(objdata), (u32) 0x55aaaa55);
2786
2787	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2788	(void)bcma_read32(core, D11REGOFFS(objaddr));
2789	val = bcma_read32(core, D11REGOFFS(objdata));
2790	if (val != (u32) 0x55aaaa55) {
2791		wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2792			  "expected 0x55aaaa55\n", wlc_hw->unit, val);
2793		return false;
2794	}
2795
2796	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2797	(void)bcma_read32(core, D11REGOFFS(objaddr));
2798	bcma_write32(core, D11REGOFFS(objdata), w);
2799
2800	/* clear CFPStart */
2801	bcma_write32(core, D11REGOFFS(tsf_cfpstart), 0);
2802
2803	w = bcma_read32(core, D11REGOFFS(maccontrol));
2804	if ((w != (MCTL_IHR_EN | MCTL_WAKE)) &&
2805	    (w != (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE))) {
2806		wiphy_err(wiphy, "wl%d: validate_chip_access: maccontrol = "
2807			  "0x%x, expected 0x%x or 0x%x\n", wlc_hw->unit, w,
2808			  (MCTL_IHR_EN | MCTL_WAKE),
2809			  (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE));
2810		return false;
2811	}
2812
2813	return true;
2814}
2815
2816#define PHYPLL_WAIT_US	100000
2817
2818void brcms_b_core_phypll_ctl(struct brcms_hardware *wlc_hw, bool on)
2819{
2820	struct bcma_device *core = wlc_hw->d11core;
2821	u32 tmp;
2822
2823	brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
2824
2825	tmp = 0;
2826
2827	if (on) {
2828		if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
2829			bcma_set32(core, D11REGOFFS(clk_ctl_st),
2830				   CCS_ERSRC_REQ_HT |
2831				   CCS_ERSRC_REQ_D11PLL |
2832				   CCS_ERSRC_REQ_PHYPLL);
2833			SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2834				  CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT,
2835				 PHYPLL_WAIT_US);
2836
2837			tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2838			if ((tmp & CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT)
2839				brcms_err(core, "%s: turn on PHY PLL failed\n",
2840					  __func__);
2841		} else {
2842			bcma_set32(core, D11REGOFFS(clk_ctl_st),
2843				   tmp | CCS_ERSRC_REQ_D11PLL |
2844				   CCS_ERSRC_REQ_PHYPLL);
2845			SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2846				  (CCS_ERSRC_AVAIL_D11PLL |
2847				   CCS_ERSRC_AVAIL_PHYPLL)) !=
2848				 (CCS_ERSRC_AVAIL_D11PLL |
2849				  CCS_ERSRC_AVAIL_PHYPLL), PHYPLL_WAIT_US);
2850
2851			tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2852			if ((tmp &
2853			     (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2854			    !=
2855			    (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2856				brcms_err(core, "%s: turn on PHY PLL failed\n",
2857					  __func__);
2858		}
2859	} else {
2860		/*
2861		 * Since the PLL may be shared, other cores can still
2862		 * be requesting it; so we'll deassert the request but
2863		 * not wait for status to comply.
2864		 */
2865		bcma_mask32(core, D11REGOFFS(clk_ctl_st),
2866			    ~CCS_ERSRC_REQ_PHYPLL);
2867		(void)bcma_read32(core, D11REGOFFS(clk_ctl_st));
2868	}
2869}
2870
2871static void brcms_c_coredisable(struct brcms_hardware *wlc_hw)
2872{
2873	bool dev_gone;
2874
2875	brcms_dbg_info(wlc_hw->d11core, "wl%d: disable core\n", wlc_hw->unit);
2876
2877	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
2878
2879	if (dev_gone)
2880		return;
2881
2882	if (wlc_hw->noreset)
2883		return;
2884
2885	/* radio off */
2886	wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
2887
2888	/* turn off analog core */
2889	wlc_phy_anacore(wlc_hw->band->pi, OFF);
2890
2891	/* turn off PHYPLL to save power */
2892	brcms_b_core_phypll_ctl(wlc_hw, false);
2893
2894	wlc_hw->clk = false;
2895	bcma_core_disable(wlc_hw->d11core, 0);
2896	wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
2897}
2898
2899static void brcms_c_flushqueues(struct brcms_c_info *wlc)
2900{
2901	struct brcms_hardware *wlc_hw = wlc->hw;
2902	uint i;
2903
2904	/* free any posted tx packets */
2905	for (i = 0; i < NFIFO; i++) {
2906		if (wlc_hw->di[i]) {
2907			dma_txreclaim(wlc_hw->di[i], DMA_RANGE_ALL);
2908			if (i < TX_BCMC_FIFO)
2909				ieee80211_wake_queue(wlc->pub->ieee_hw,
2910						     brcms_fifo_to_ac(i));
2911		}
2912	}
2913
2914	/* free any posted rx packets */
2915	dma_rxreclaim(wlc_hw->di[RX_FIFO]);
2916}
2917
2918static u16
2919brcms_b_read_objmem(struct brcms_hardware *wlc_hw, uint offset, u32 sel)
2920{
2921	struct bcma_device *core = wlc_hw->d11core;
2922	u16 objoff = D11REGOFFS(objdata);
2923
2924	bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2925	(void)bcma_read32(core, D11REGOFFS(objaddr));
2926	if (offset & 2)
2927		objoff += 2;
2928
2929	return bcma_read16(core, objoff);
2930}
2931
2932static void
2933brcms_b_write_objmem(struct brcms_hardware *wlc_hw, uint offset, u16 v,
2934		     u32 sel)
2935{
2936	struct bcma_device *core = wlc_hw->d11core;
2937	u16 objoff = D11REGOFFS(objdata);
2938
2939	bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2940	(void)bcma_read32(core, D11REGOFFS(objaddr));
2941	if (offset & 2)
2942		objoff += 2;
2943
2944	bcma_wflush16(core, objoff, v);
2945}
2946
2947/*
2948 * Read a single u16 from shared memory.
2949 * SHM 'offset' needs to be an even address
2950 */
2951u16 brcms_b_read_shm(struct brcms_hardware *wlc_hw, uint offset)
2952{
2953	return brcms_b_read_objmem(wlc_hw, offset, OBJADDR_SHM_SEL);
2954}
2955
2956/*
2957 * Write a single u16 to shared memory.
2958 * SHM 'offset' needs to be an even address
2959 */
2960void brcms_b_write_shm(struct brcms_hardware *wlc_hw, uint offset, u16 v)
2961{
2962	brcms_b_write_objmem(wlc_hw, offset, v, OBJADDR_SHM_SEL);
2963}
2964
2965/*
2966 * Copy a buffer to shared memory of specified type .
2967 * SHM 'offset' needs to be an even address and
2968 * Buffer length 'len' must be an even number of bytes
2969 * 'sel' selects the type of memory
2970 */
2971void
2972brcms_b_copyto_objmem(struct brcms_hardware *wlc_hw, uint offset,
2973		      const void *buf, int len, u32 sel)
2974{
2975	u16 v;
2976	const u8 *p = (const u8 *)buf;
2977	int i;
2978
2979	if (len <= 0 || (offset & 1) || (len & 1))
2980		return;
2981
2982	for (i = 0; i < len; i += 2) {
2983		v = p[i] | (p[i + 1] << 8);
2984		brcms_b_write_objmem(wlc_hw, offset + i, v, sel);
2985	}
2986}
2987
2988/*
2989 * Copy a piece of shared memory of specified type to a buffer .
2990 * SHM 'offset' needs to be an even address and
2991 * Buffer length 'len' must be an even number of bytes
2992 * 'sel' selects the type of memory
2993 */
2994void
2995brcms_b_copyfrom_objmem(struct brcms_hardware *wlc_hw, uint offset, void *buf,
2996			 int len, u32 sel)
2997{
2998	u16 v;
2999	u8 *p = (u8 *) buf;
3000	int i;
3001
3002	if (len <= 0 || (offset & 1) || (len & 1))
3003		return;
3004
3005	for (i = 0; i < len; i += 2) {
3006		v = brcms_b_read_objmem(wlc_hw, offset + i, sel);
3007		p[i] = v & 0xFF;
3008		p[i + 1] = (v >> 8) & 0xFF;
3009	}
3010}
3011
3012/* Copy a buffer to shared memory.
3013 * SHM 'offset' needs to be an even address and
3014 * Buffer length 'len' must be an even number of bytes
3015 */
3016static void brcms_c_copyto_shm(struct brcms_c_info *wlc, uint offset,
3017			const void *buf, int len)
3018{
3019	brcms_b_copyto_objmem(wlc->hw, offset, buf, len, OBJADDR_SHM_SEL);
3020}
3021
3022static void brcms_b_retrylimit_upd(struct brcms_hardware *wlc_hw,
3023				   u16 SRL, u16 LRL)
3024{
3025	wlc_hw->SRL = SRL;
3026	wlc_hw->LRL = LRL;
3027
3028	/* write retry limit to SCR, shouldn't need to suspend */
3029	if (wlc_hw->up) {
3030		bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3031			     OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3032		(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3033		bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->SRL);
3034		bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3035			     OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3036		(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3037		bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->LRL);
3038	}
3039}
3040
3041static void brcms_b_pllreq(struct brcms_hardware *wlc_hw, bool set, u32 req_bit)
3042{
3043	if (set) {
3044		if (mboolisset(wlc_hw->pllreq, req_bit))
3045			return;
3046
3047		mboolset(wlc_hw->pllreq, req_bit);
3048
3049		if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3050			if (!wlc_hw->sbclk)
3051				brcms_b_xtal(wlc_hw, ON);
3052		}
3053	} else {
3054		if (!mboolisset(wlc_hw->pllreq, req_bit))
3055			return;
3056
3057		mboolclr(wlc_hw->pllreq, req_bit);
3058
3059		if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3060			if (wlc_hw->sbclk)
3061				brcms_b_xtal(wlc_hw, OFF);
3062		}
3063	}
3064}
3065
3066static void brcms_b_antsel_set(struct brcms_hardware *wlc_hw, u32 antsel_avail)
3067{
3068	wlc_hw->antsel_avail = antsel_avail;
3069}
3070
3071/*
3072 * conditions under which the PM bit should be set in outgoing frames
3073 * and STAY_AWAKE is meaningful
3074 */
3075static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
3076{
3077	/* not supporting PS so always return false for now */
3078	return false;
3079}
3080
3081static void brcms_c_statsupd(struct brcms_c_info *wlc)
3082{
3083	int i;
3084	struct macstat macstats;
3085#ifdef DEBUG
3086	u16 delta;
3087	u16 rxf0ovfl;
3088	u16 txfunfl[NFIFO];
3089#endif				/* DEBUG */
3090
3091	/* if driver down, make no sense to update stats */
3092	if (!wlc->pub->up)
3093		return;
3094
3095#ifdef DEBUG
3096	/* save last rx fifo 0 overflow count */
3097	rxf0ovfl = wlc->core->macstat_snapshot->rxf0ovfl;
3098
3099	/* save last tx fifo  underflow count */
3100	for (i = 0; i < NFIFO; i++)
3101		txfunfl[i] = wlc->core->macstat_snapshot->txfunfl[i];
3102#endif				/* DEBUG */
3103
3104	/* Read mac stats from contiguous shared memory */
3105	brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, &macstats,
3106				sizeof(struct macstat), OBJADDR_SHM_SEL);
3107
3108#ifdef DEBUG
3109	/* check for rx fifo 0 overflow */
3110	delta = (u16) (wlc->core->macstat_snapshot->rxf0ovfl - rxf0ovfl);
3111	if (delta)
3112		brcms_err(wlc->hw->d11core, "wl%d: %u rx fifo 0 overflows!\n",
3113			  wlc->pub->unit, delta);
3114
3115	/* check for tx fifo underflows */
3116	for (i = 0; i < NFIFO; i++) {
3117		delta =
3118		    (u16) (wlc->core->macstat_snapshot->txfunfl[i] -
3119			      txfunfl[i]);
3120		if (delta)
3121			brcms_err(wlc->hw->d11core,
3122				  "wl%d: %u tx fifo %d underflows!\n",
3123				  wlc->pub->unit, delta, i);
3124	}
3125#endif				/* DEBUG */
3126
3127	/* merge counters from dma module */
3128	for (i = 0; i < NFIFO; i++) {
3129		if (wlc->hw->di[i])
3130			dma_counterreset(wlc->hw->di[i]);
3131	}
3132}
3133
3134static void brcms_b_reset(struct brcms_hardware *wlc_hw)
3135{
3136	/* reset the core */
3137	if (!brcms_deviceremoved(wlc_hw->wlc))
3138		brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
3139
3140	/* purge the dma rings */
3141	brcms_c_flushqueues(wlc_hw->wlc);
3142}
3143
3144void brcms_c_reset(struct brcms_c_info *wlc)
3145{
3146	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
3147
3148	/* slurp up hw mac counters before core reset */
3149	brcms_c_statsupd(wlc);
3150
3151	/* reset our snapshot of macstat counters */
3152	memset(wlc->core->macstat_snapshot, 0, sizeof(struct macstat));
3153
3154	brcms_b_reset(wlc->hw);
3155}
3156
3157void brcms_c_init_scb(struct scb *scb)
3158{
3159	int i;
3160
3161	memset(scb, 0, sizeof(struct scb));
3162	scb->flags = SCB_WMECAP | SCB_HTCAP;
3163	for (i = 0; i < NUMPRIO; i++) {
3164		scb->seqnum[i] = 0;
3165		scb->seqctl[i] = 0xFFFF;
3166	}
3167
3168	scb->seqctl_nonqos = 0xFFFF;
3169	scb->magic = SCB_MAGIC;
3170}
3171
3172/* d11 core init
3173 *   reset PSM
3174 *   download ucode/PCM
3175 *   let ucode run to suspended
3176 *   download ucode inits
3177 *   config other core registers
3178 *   init dma
3179 */
3180static void brcms_b_coreinit(struct brcms_c_info *wlc)
3181{
3182	struct brcms_hardware *wlc_hw = wlc->hw;
3183	struct bcma_device *core = wlc_hw->d11core;
3184	u32 sflags;
3185	u32 bcnint_us;
3186	uint i = 0;
3187	bool fifosz_fixup = false;
3188	int err = 0;
3189	u16 buf[NFIFO];
3190	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
3191
3192	brcms_dbg_info(core, "wl%d: core init\n", wlc_hw->unit);
3193
3194	/* reset PSM */
3195	brcms_b_mctrl(wlc_hw, ~0, (MCTL_IHR_EN | MCTL_PSM_JMP_0 | MCTL_WAKE));
3196
3197	brcms_ucode_download(wlc_hw);
3198	/*
3199	 * FIFOSZ fixup. driver wants to controls the fifo allocation.
3200	 */
3201	fifosz_fixup = true;
3202
3203	/* let the PSM run to the suspended state, set mode to BSS STA */
3204	bcma_write32(core, D11REGOFFS(macintstatus), -1);
3205	brcms_b_mctrl(wlc_hw, ~0,
3206		       (MCTL_IHR_EN | MCTL_INFRA | MCTL_PSM_RUN | MCTL_WAKE));
3207
3208	/* wait for ucode to self-suspend after auto-init */
3209	SPINWAIT(((bcma_read32(core, D11REGOFFS(macintstatus)) &
3210		   MI_MACSSPNDD) == 0), 1000 * 1000);
3211	if ((bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD) == 0)
3212		brcms_err(core, "wl%d: wlc_coreinit: ucode did not self-"
3213			  "suspend!\n", wlc_hw->unit);
3214
3215	brcms_c_gpio_init(wlc);
3216
3217	sflags = bcma_aread32(core, BCMA_IOST);
3218
3219	if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
3220		if (BRCMS_ISNPHY(wlc_hw->band))
3221			brcms_c_write_inits(wlc_hw, ucode->d11n0initvals16);
3222		else
3223			brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3224				  " %d\n", __func__, wlc_hw->unit,
3225				  wlc_hw->corerev);
3226	} else if (D11REV_IS(wlc_hw->corerev, 24)) {
3227		if (BRCMS_ISLCNPHY(wlc_hw->band))
3228			brcms_c_write_inits(wlc_hw, ucode->d11lcn0initvals24);
3229		else
3230			brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3231				  " %d\n", __func__, wlc_hw->unit,
3232				  wlc_hw->corerev);
3233	} else {
3234		brcms_err(core, "%s: wl%d: unsupported corerev %d\n",
3235			  __func__, wlc_hw->unit, wlc_hw->corerev);
3236	}
3237
3238	/* For old ucode, txfifo sizes needs to be modified(increased) */
3239	if (fifosz_fixup)
3240		brcms_b_corerev_fifofixup(wlc_hw);
3241
3242	/* check txfifo allocations match between ucode and driver */
3243	buf[TX_AC_BE_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE0);
3244	if (buf[TX_AC_BE_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]) {
3245		i = TX_AC_BE_FIFO;
3246		err = -1;
3247	}
3248	buf[TX_AC_VI_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE1);
3249	if (buf[TX_AC_VI_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]) {
3250		i = TX_AC_VI_FIFO;
3251		err = -1;
3252	}
3253	buf[TX_AC_BK_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE2);
3254	buf[TX_AC_VO_FIFO] = (buf[TX_AC_BK_FIFO] >> 8) & 0xff;
3255	buf[TX_AC_BK_FIFO] &= 0xff;
3256	if (buf[TX_AC_BK_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BK_FIFO]) {
3257		i = TX_AC_BK_FIFO;
3258		err = -1;
3259	}
3260	if (buf[TX_AC_VO_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO]) {
3261		i = TX_AC_VO_FIFO;
3262		err = -1;
3263	}
3264	buf[TX_BCMC_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE3);
3265	buf[TX_ATIM_FIFO] = (buf[TX_BCMC_FIFO] >> 8) & 0xff;
3266	buf[TX_BCMC_FIFO] &= 0xff;
3267	if (buf[TX_BCMC_FIFO] != wlc_hw->xmtfifo_sz[TX_BCMC_FIFO]) {
3268		i = TX_BCMC_FIFO;
3269		err = -1;
3270	}
3271	if (buf[TX_ATIM_FIFO] != wlc_hw->xmtfifo_sz[TX_ATIM_FIFO]) {
3272		i = TX_ATIM_FIFO;
3273		err = -1;
3274	}
3275	if (err != 0)
3276		brcms_err(core, "wlc_coreinit: txfifo mismatch: ucode size %d"
3277			  " driver size %d index %d\n", buf[i],
3278			  wlc_hw->xmtfifo_sz[i], i);
3279
3280	/* make sure we can still talk to the mac */
3281	WARN_ON(bcma_read32(core, D11REGOFFS(maccontrol)) == 0xffffffff);
3282
3283	/* band-specific inits done by wlc_bsinit() */
3284
3285	/* Set up frame burst size and antenna swap threshold init values */
3286	brcms_b_write_shm(wlc_hw, M_MBURST_SIZE, MAXTXFRAMEBURST);
3287	brcms_b_write_shm(wlc_hw, M_MAX_ANTCNT, ANTCNT);
3288
3289	/* enable one rx interrupt per received frame */
3290	bcma_write32(core, D11REGOFFS(intrcvlazy[0]), (1 << IRL_FC_SHIFT));
3291
3292	/* set the station mode (BSS STA) */
3293	brcms_b_mctrl(wlc_hw,
3294		       (MCTL_INFRA | MCTL_DISCARD_PMQ | MCTL_AP),
3295		       (MCTL_INFRA | MCTL_DISCARD_PMQ));
3296
3297	/* set up Beacon interval */
3298	bcnint_us = 0x8000 << 10;
3299	bcma_write32(core, D11REGOFFS(tsf_cfprep),
3300		     (bcnint_us << CFPREP_CBI_SHIFT));
3301	bcma_write32(core, D11REGOFFS(tsf_cfpstart), bcnint_us);
3302	bcma_write32(core, D11REGOFFS(macintstatus), MI_GP1);
3303
3304	/* write interrupt mask */
3305	bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intmask),
3306		     DEF_RXINTMASK);
3307
3308	/* allow the MAC to control the PHY clock (dynamic on/off) */
3309	brcms_b_macphyclk_set(wlc_hw, ON);
3310
3311	/* program dynamic clock control fast powerup delay register */
3312	wlc->fastpwrup_dly = ai_clkctl_fast_pwrup_delay(wlc_hw->sih);
3313	bcma_write16(core, D11REGOFFS(scc_fastpwrup_dly), wlc->fastpwrup_dly);
3314
3315	/* tell the ucode the corerev */
3316	brcms_b_write_shm(wlc_hw, M_MACHW_VER, (u16) wlc_hw->corerev);
3317
3318	/* tell the ucode MAC capabilities */
3319	brcms_b_write_shm(wlc_hw, M_MACHW_CAP_L,
3320			   (u16) (wlc_hw->machwcap & 0xffff));
3321	brcms_b_write_shm(wlc_hw, M_MACHW_CAP_H,
3322			   (u16) ((wlc_hw->
3323				      machwcap >> 16) & 0xffff));
3324
3325	/* write retry limits to SCR, this done after PSM init */
3326	bcma_write32(core, D11REGOFFS(objaddr),
3327		     OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3328	(void)bcma_read32(core, D11REGOFFS(objaddr));
3329	bcma_write32(core, D11REGOFFS(objdata), wlc_hw->SRL);
3330	bcma_write32(core, D11REGOFFS(objaddr),
3331		     OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3332	(void)bcma_read32(core, D11REGOFFS(objaddr));
3333	bcma_write32(core, D11REGOFFS(objdata), wlc_hw->LRL);
3334
3335	/* write rate fallback retry limits */
3336	brcms_b_write_shm(wlc_hw, M_SFRMTXCNTFBRTHSD, wlc_hw->SFBL);
3337	brcms_b_write_shm(wlc_hw, M_LFRMTXCNTFBRTHSD, wlc_hw->LFBL);
3338
3339	bcma_mask16(core, D11REGOFFS(ifs_ctl), 0x0FFF);
3340	bcma_write16(core, D11REGOFFS(ifs_aifsn), EDCF_AIFSN_MIN);
3341
3342	/* init the tx dma engines */
3343	for (i = 0; i < NFIFO; i++) {
3344		if (wlc_hw->di[i])
3345			dma_txinit(wlc_hw->di[i]);
3346	}
3347
3348	/* init the rx dma engine(s) and post receive buffers */
3349	dma_rxinit(wlc_hw->di[RX_FIFO]);
3350	dma_rxfill(wlc_hw->di[RX_FIFO]);
3351}
3352
3353void
3354static brcms_b_init(struct brcms_hardware *wlc_hw, u16 chanspec) {
3355	u32 macintmask;
3356	bool fastclk;
3357	struct brcms_c_info *wlc = wlc_hw->wlc;
3358
3359	/* request FAST clock if not on */
3360	fastclk = wlc_hw->forcefastclk;
3361	if (!fastclk)
3362		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
3363
3364	/* disable interrupts */
3365	macintmask = brcms_intrsoff(wlc->wl);
3366
3367	/* set up the specified band and chanspec */
3368	brcms_c_setxband(wlc_hw, chspec_bandunit(chanspec));
3369	wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3370
3371	/* do one-time phy inits and calibration */
3372	wlc_phy_cal_init(wlc_hw->band->pi);
3373
3374	/* core-specific initialization */
3375	brcms_b_coreinit(wlc);
3376
3377	/* band-specific inits */
3378	brcms_b_bsinit(wlc, chanspec);
3379
3380	/* restore macintmask */
3381	brcms_intrsrestore(wlc->wl, macintmask);
3382
3383	/* seed wake_override with BRCMS_WAKE_OVERRIDE_MACSUSPEND since the mac
3384	 * is suspended and brcms_c_enable_mac() will clear this override bit.
3385	 */
3386	mboolset(wlc_hw->wake_override, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
3387
3388	/*
3389	 * initialize mac_suspend_depth to 1 to match ucode
3390	 * initial suspended state
3391	 */
3392	wlc_hw->mac_suspend_depth = 1;
3393
3394	/* restore the clk */
3395	if (!fastclk)
3396		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
3397}
3398
3399static void brcms_c_set_phy_chanspec(struct brcms_c_info *wlc,
3400				     u16 chanspec)
3401{
3402	/* Save our copy of the chanspec */
3403	wlc->chanspec = chanspec;
3404
3405	/* Set the chanspec and power limits for this locale */
3406	brcms_c_channel_set_chanspec(wlc->cmi, chanspec, BRCMS_TXPWR_MAX);
3407
3408	if (wlc->stf->ss_algosel_auto)
3409		brcms_c_stf_ss_algo_channel_get(wlc, &wlc->stf->ss_algo_channel,
3410					    chanspec);
3411
3412	brcms_c_stf_ss_update(wlc, wlc->band);
3413}
3414
3415static void
3416brcms_default_rateset(struct brcms_c_info *wlc, struct brcms_c_rateset *rs)
3417{
3418	brcms_c_rateset_default(rs, NULL, wlc->band->phytype,
3419		wlc->band->bandtype, false, BRCMS_RATE_MASK_FULL,
3420		(bool) (wlc->pub->_n_enab & SUPPORT_11N),
3421		brcms_chspec_bw(wlc->default_bss->chanspec),
3422		wlc->stf->txstreams);
3423}
3424
3425/* derive wlc->band->basic_rate[] table from 'rateset' */
3426static void brcms_c_rate_lookup_init(struct brcms_c_info *wlc,
3427			      struct brcms_c_rateset *rateset)
3428{
3429	u8 rate;
3430	u8 mandatory;
3431	u8 cck_basic = 0;
3432	u8 ofdm_basic = 0;
3433	u8 *br = wlc->band->basic_rate;
3434	uint i;
3435
3436	/* incoming rates are in 500kbps units as in 802.11 Supported Rates */
3437	memset(br, 0, BRCM_MAXRATE + 1);
3438
3439	/* For each basic rate in the rates list, make an entry in the
3440	 * best basic lookup.
3441	 */
3442	for (i = 0; i < rateset->count; i++) {
3443		/* only make an entry for a basic rate */
3444		if (!(rateset->rates[i] & BRCMS_RATE_FLAG))
3445			continue;
3446
3447		/* mask off basic bit */
3448		rate = (rateset->rates[i] & BRCMS_RATE_MASK);
3449
3450		if (rate > BRCM_MAXRATE) {
3451			brcms_err(wlc->hw->d11core, "brcms_c_rate_lookup_init: "
3452				  "invalid rate 0x%X in rate set\n",
3453				  rateset->rates[i]);
3454			continue;
3455		}
3456
3457		br[rate] = rate;
3458	}
3459
3460	/* The rate lookup table now has non-zero entries for each
3461	 * basic rate, equal to the basic rate: br[basicN] = basicN
3462	 *
3463	 * To look up the best basic rate corresponding to any
3464	 * particular rate, code can use the basic_rate table
3465	 * like this
3466	 *
3467	 * basic_rate = wlc->band->basic_rate[tx_rate]
3468	 *
3469	 * Make sure there is a best basic rate entry for
3470	 * every rate by walking up the table from low rates
3471	 * to high, filling in holes in the lookup table
3472	 */
3473
3474	for (i = 0; i < wlc->band->hw_rateset.count; i++) {
3475		rate = wlc->band->hw_rateset.rates[i];
3476
3477		if (br[rate] != 0) {
3478			/* This rate is a basic rate.
3479			 * Keep track of the best basic rate so far by
3480			 * modulation type.
3481			 */
3482			if (is_ofdm_rate(rate))
3483				ofdm_basic = rate;
3484			else
3485				cck_basic = rate;
3486
3487			continue;
3488		}
3489
3490		/* This rate is not a basic rate so figure out the
3491		 * best basic rate less than this rate and fill in
3492		 * the hole in the table
3493		 */
3494
3495		br[rate] = is_ofdm_rate(rate) ? ofdm_basic : cck_basic;
3496
3497		if (br[rate] != 0)
3498			continue;
3499
3500		if (is_ofdm_rate(rate)) {
3501			/*
3502			 * In 11g and 11a, the OFDM mandatory rates
3503			 * are 6, 12, and 24 Mbps
3504			 */
3505			if (rate >= BRCM_RATE_24M)
3506				mandatory = BRCM_RATE_24M;
3507			else if (rate >= BRCM_RATE_12M)
3508				mandatory = BRCM_RATE_12M;
3509			else
3510				mandatory = BRCM_RATE_6M;
3511		} else {
3512			/* In 11b, all CCK rates are mandatory 1 - 11 Mbps */
3513			mandatory = rate;
3514		}
3515
3516		br[rate] = mandatory;
3517	}
3518}
3519
3520static void brcms_c_bandinit_ordered(struct brcms_c_info *wlc,
3521				     u16 chanspec)
3522{
3523	struct brcms_c_rateset default_rateset;
3524	uint parkband;
3525	uint i, band_order[2];
3526
3527	/*
3528	 * We might have been bandlocked during down and the chip
3529	 * power-cycled (hibernate). Figure out the right band to park on
3530	 */
3531	if (wlc->bandlocked || wlc->pub->_nbands == 1) {
3532		/* updated in brcms_c_bandlock() */
3533		parkband = wlc->band->bandunit;
3534		band_order[0] = band_order[1] = parkband;
3535	} else {
3536		/* park on the band of the specified chanspec */
3537		parkband = chspec_bandunit(chanspec);
3538
3539		/* order so that parkband initialize last */
3540		band_order[0] = parkband ^ 1;
3541		band_order[1] = parkband;
3542	}
3543
3544	/* make each band operational, software state init */
3545	for (i = 0; i < wlc->pub->_nbands; i++) {
3546		uint j = band_order[i];
3547
3548		wlc->band = wlc->bandstate[j];
3549
3550		brcms_default_rateset(wlc, &default_rateset);
3551
3552		/* fill in hw_rate */
3553		brcms_c_rateset_filter(&default_rateset, &wlc->band->hw_rateset,
3554				   false, BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
3555				   (bool) (wlc->pub->_n_enab & SUPPORT_11N));
3556
3557		/* init basic rate lookup */
3558		brcms_c_rate_lookup_init(wlc, &default_rateset);
3559	}
3560
3561	/* sync up phy/radio chanspec */
3562	brcms_c_set_phy_chanspec(wlc, chanspec);
3563}
3564
3565/*
3566 * Set or clear filtering related maccontrol bits based on
3567 * specified filter flags
3568 */
3569void brcms_c_mac_promisc(struct brcms_c_info *wlc, uint filter_flags)
3570{
3571	u32 promisc_bits = 0;
3572
3573	wlc->filter_flags = filter_flags;
3574
3575	if (filter_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS))
3576		promisc_bits |= MCTL_PROMISC;
3577
3578	if (filter_flags & FIF_BCN_PRBRESP_PROMISC)
3579		promisc_bits |= MCTL_BCNS_PROMISC;
3580
3581	if (filter_flags & FIF_FCSFAIL)
3582		promisc_bits |= MCTL_KEEPBADFCS;
3583
3584	if (filter_flags & (FIF_CONTROL | FIF_PSPOLL))
3585		promisc_bits |= MCTL_KEEPCONTROL;
3586
3587	brcms_b_mctrl(wlc->hw,
3588		MCTL_PROMISC | MCTL_BCNS_PROMISC |
3589		MCTL_KEEPCONTROL | MCTL_KEEPBADFCS,
3590		promisc_bits);
3591}
3592
3593/*
3594 * ucode, hwmac update
3595 *    Channel dependent updates for ucode and hw
3596 */
3597static void brcms_c_ucode_mac_upd(struct brcms_c_info *wlc)
3598{
3599	/* enable or disable any active IBSSs depending on whether or not
3600	 * we are on the home channel
3601	 */
3602	if (wlc->home_chanspec == wlc_phy_chanspec_get(wlc->band->pi)) {
3603		if (wlc->pub->associated) {
3604			/*
3605			 * BMAC_NOTE: This is something that should be fixed
3606			 * in ucode inits. I think that the ucode inits set
3607			 * up the bcn templates and shm values with a bogus
3608			 * beacon. This should not be done in the inits. If
3609			 * ucode needs to set up a beacon for testing, the
3610			 * test routines should write it down, not expect the
3611			 * inits to populate a bogus beacon.
3612			 */
3613			if (BRCMS_PHY_11N_CAP(wlc->band))
3614				brcms_b_write_shm(wlc->hw,
3615						M_BCN_TXTSF_OFFSET, 0);
3616		}
3617	} else {
3618		/* disable an active IBSS if we are not on the home channel */
3619	}
3620}
3621
3622static void brcms_c_write_rate_shm(struct brcms_c_info *wlc, u8 rate,
3623				   u8 basic_rate)
3624{
3625	u8 phy_rate, index;
3626	u8 basic_phy_rate, basic_index;
3627	u16 dir_table, basic_table;
3628	u16 basic_ptr;
3629
3630	/* Shared memory address for the table we are reading */
3631	dir_table = is_ofdm_rate(basic_rate) ? M_RT_DIRMAP_A : M_RT_DIRMAP_B;
3632
3633	/* Shared memory address for the table we are writing */
3634	basic_table = is_ofdm_rate(rate) ? M_RT_BBRSMAP_A : M_RT_BBRSMAP_B;
3635
3636	/*
3637	 * for a given rate, the LS-nibble of the PLCP SIGNAL field is
3638	 * the index into the rate table.
3639	 */
3640	phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
3641	basic_phy_rate = rate_info[basic_rate] & BRCMS_RATE_MASK;
3642	index = phy_rate & 0xf;
3643	basic_index = basic_phy_rate & 0xf;
3644
3645	/* Find the SHM pointer to the ACK rate entry by looking in the
3646	 * Direct-map Table
3647	 */
3648	basic_ptr = brcms_b_read_shm(wlc->hw, (dir_table + basic_index * 2));
3649
3650	/* Update the SHM BSS-basic-rate-set mapping table with the pointer
3651	 * to the correct basic rate for the given incoming rate
3652	 */
3653	brcms_b_write_shm(wlc->hw, (basic_table + index * 2), basic_ptr);
3654}
3655
3656static const struct brcms_c_rateset *
3657brcms_c_rateset_get_hwrs(struct brcms_c_info *wlc)
3658{
3659	const struct brcms_c_rateset *rs_dflt;
3660
3661	if (BRCMS_PHY_11N_CAP(wlc->band)) {
3662		if (wlc->band->bandtype == BRCM_BAND_5G)
3663			rs_dflt = &ofdm_mimo_rates;
3664		else
3665			rs_dflt = &cck_ofdm_mimo_rates;
3666	} else if (wlc->band->gmode)
3667		rs_dflt = &cck_ofdm_rates;
3668	else
3669		rs_dflt = &cck_rates;
3670
3671	return rs_dflt;
3672}
3673
3674static void brcms_c_set_ratetable(struct brcms_c_info *wlc)
3675{
3676	const struct brcms_c_rateset *rs_dflt;
3677	struct brcms_c_rateset rs;
3678	u8 rate, basic_rate;
3679	uint i;
3680
3681	rs_dflt = brcms_c_rateset_get_hwrs(wlc);
3682
3683	brcms_c_rateset_copy(rs_dflt, &rs);
3684	brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
3685
3686	/* walk the phy rate table and update SHM basic rate lookup table */
3687	for (i = 0; i < rs.count; i++) {
3688		rate = rs.rates[i] & BRCMS_RATE_MASK;
3689
3690		/* for a given rate brcms_basic_rate returns the rate at
3691		 * which a response ACK/CTS should be sent.
3692		 */
3693		basic_rate = brcms_basic_rate(wlc, rate);
3694		if (basic_rate == 0)
3695			/* This should only happen if we are using a
3696			 * restricted rateset.
3697			 */
3698			basic_rate = rs.rates[0] & BRCMS_RATE_MASK;
3699
3700		brcms_c_write_rate_shm(wlc, rate, basic_rate);
3701	}
3702}
3703
3704/* band-specific init */
3705static void brcms_c_bsinit(struct brcms_c_info *wlc)
3706{
3707	brcms_dbg_info(wlc->hw->d11core, "wl%d: bandunit %d\n",
3708		       wlc->pub->unit, wlc->band->bandunit);
3709
3710	/* write ucode ACK/CTS rate table */
3711	brcms_c_set_ratetable(wlc);
3712
3713	/* update some band specific mac configuration */
3714	brcms_c_ucode_mac_upd(wlc);
3715
3716	/* init antenna selection */
3717	brcms_c_antsel_init(wlc->asi);
3718
3719}
3720
3721/* formula:  IDLE_BUSY_RATIO_X_16 = (100-duty_cycle)/duty_cycle*16 */
3722static int
3723brcms_c_duty_cycle_set(struct brcms_c_info *wlc, int duty_cycle, bool isOFDM,
3724		   bool writeToShm)
3725{
3726	int idle_busy_ratio_x_16 = 0;
3727	uint offset =
3728	    isOFDM ? M_TX_IDLE_BUSY_RATIO_X_16_OFDM :
3729	    M_TX_IDLE_BUSY_RATIO_X_16_CCK;
3730	if (duty_cycle > 100 || duty_cycle < 0) {
3731		brcms_err(wlc->hw->d11core,
3732			  "wl%d:  duty cycle value off limit\n",
3733			  wlc->pub->unit);
3734		return -EINVAL;
3735	}
3736	if (duty_cycle)
3737		idle_busy_ratio_x_16 = (100 - duty_cycle) * 16 / duty_cycle;
3738	/* Only write to shared memory  when wl is up */
3739	if (writeToShm)
3740		brcms_b_write_shm(wlc->hw, offset, (u16) idle_busy_ratio_x_16);
3741
3742	if (isOFDM)
3743		wlc->tx_duty_cycle_ofdm = (u16) duty_cycle;
3744	else
3745		wlc->tx_duty_cycle_cck = (u16) duty_cycle;
3746
3747	return 0;
3748}
3749
3750/* push sw hps and wake state through hardware */
3751static void brcms_c_set_ps_ctrl(struct brcms_c_info *wlc)
3752{
3753	u32 v1, v2;
3754	bool hps;
3755	bool awake_before;
3756
3757	hps = brcms_c_ps_allowed(wlc);
3758
3759	brcms_dbg_mac80211(wlc->hw->d11core, "wl%d: hps %d\n", wlc->pub->unit,
3760			   hps);
3761
3762	v1 = bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
3763	v2 = MCTL_WAKE;
3764	if (hps)
3765		v2 |= MCTL_HPS;
3766
3767	brcms_b_mctrl(wlc->hw, MCTL_WAKE | MCTL_HPS, v2);
3768
3769	awake_before = ((v1 & MCTL_WAKE) || ((v1 & MCTL_HPS) == 0));
3770
3771	if (!awake_before)
3772		brcms_b_wait_for_wake(wlc->hw);
3773}
3774
3775/*
3776 * Write this BSS config's MAC address to core.
3777 * Updates RXE match engine.
3778 */
3779static int brcms_c_set_mac(struct brcms_bss_cfg *bsscfg)
3780{
3781	int err = 0;
3782	struct brcms_c_info *wlc = bsscfg->wlc;
3783
3784	/* enter the MAC addr into the RXE match registers */
3785	brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, wlc->pub->cur_etheraddr);
3786
3787	brcms_c_ampdu_macaddr_upd(wlc);
3788
3789	return err;
3790}
3791
3792/* Write the BSS config's BSSID address to core (set_bssid in d11procs.tcl).
3793 * Updates RXE match engine.
3794 */
3795static void brcms_c_set_bssid(struct brcms_bss_cfg *bsscfg)
3796{
3797	/* we need to update BSSID in RXE match registers */
3798	brcms_c_set_addrmatch(bsscfg->wlc, RCM_BSSID_OFFSET, bsscfg->BSSID);
3799}
3800
3801void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid, size_t ssid_len)
3802{
3803	u8 len = min_t(u8, sizeof(wlc->bsscfg->SSID), ssid_len);
3804	memset(wlc->bsscfg->SSID, 0, sizeof(wlc->bsscfg->SSID));
3805
3806	memcpy(wlc->bsscfg->SSID, ssid, len);
3807	wlc->bsscfg->SSID_len = len;
3808}
3809
3810static void brcms_b_set_shortslot(struct brcms_hardware *wlc_hw, bool shortslot)
3811{
3812	wlc_hw->shortslot = shortslot;
3813
3814	if (wlc_hw->band->bandtype == BRCM_BAND_2G && wlc_hw->up) {
3815		brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
3816		brcms_b_update_slot_timing(wlc_hw, shortslot);
3817		brcms_c_enable_mac(wlc_hw->wlc);
3818	}
3819}
3820
3821/*
3822 * Suspend the the MAC and update the slot timing
3823 * for standard 11b/g (20us slots) or shortslot 11g (9us slots).
3824 */
3825static void brcms_c_switch_shortslot(struct brcms_c_info *wlc, bool shortslot)
3826{
3827	/* use the override if it is set */
3828	if (wlc->shortslot_override != BRCMS_SHORTSLOT_AUTO)
3829		shortslot = (wlc->shortslot_override == BRCMS_SHORTSLOT_ON);
3830
3831	if (wlc->shortslot == shortslot)
3832		return;
3833
3834	wlc->shortslot = shortslot;
3835
3836	brcms_b_set_shortslot(wlc->hw, shortslot);
3837}
3838
3839static void brcms_c_set_home_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3840{
3841	if (wlc->home_chanspec != chanspec) {
3842		wlc->home_chanspec = chanspec;
3843
3844		if (wlc->pub->associated)
3845			wlc->bsscfg->current_bss->chanspec = chanspec;
3846	}
3847}
3848
3849void
3850brcms_b_set_chanspec(struct brcms_hardware *wlc_hw, u16 chanspec,
3851		      bool mute_tx, struct txpwr_limits *txpwr)
3852{
3853	uint bandunit;
3854
3855	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: 0x%x\n", wlc_hw->unit,
3856			   chanspec);
3857
3858	wlc_hw->chanspec = chanspec;
3859
3860	/* Switch bands if necessary */
3861	if (wlc_hw->_nbands > 1) {
3862		bandunit = chspec_bandunit(chanspec);
3863		if (wlc_hw->band->bandunit != bandunit) {
3864			/* brcms_b_setband disables other bandunit,
3865			 *  use light band switch if not up yet
3866			 */
3867			if (wlc_hw->up) {
3868				wlc_phy_chanspec_radio_set(wlc_hw->
3869							   bandstate[bandunit]->
3870							   pi, chanspec);
3871				brcms_b_setband(wlc_hw, bandunit, chanspec);
3872			} else {
3873				brcms_c_setxband(wlc_hw, bandunit);
3874			}
3875		}
3876	}
3877
3878	wlc_phy_initcal_enable(wlc_hw->band->pi, !mute_tx);
3879
3880	if (!wlc_hw->up) {
3881		if (wlc_hw->clk)
3882			wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr,
3883						  chanspec);
3884		wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3885	} else {
3886		wlc_phy_chanspec_set(wlc_hw->band->pi, chanspec);
3887		wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr, chanspec);
3888
3889		/* Update muting of the channel */
3890		brcms_b_mute(wlc_hw, mute_tx);
3891	}
3892}
3893
3894/* switch to and initialize new band */
3895static void brcms_c_setband(struct brcms_c_info *wlc,
3896					   uint bandunit)
3897{
3898	wlc->band = wlc->bandstate[bandunit];
3899
3900	if (!wlc->pub->up)
3901		return;
3902
3903	/* wait for at least one beacon before entering sleeping state */
3904	brcms_c_set_ps_ctrl(wlc);
3905
3906	/* band-specific initializations */
3907	brcms_c_bsinit(wlc);
3908}
3909
3910static void brcms_c_set_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3911{
3912	uint bandunit;
3913	bool switchband = false;
3914	u16 old_chanspec = wlc->chanspec;
3915
3916	if (!brcms_c_valid_chanspec_db(wlc->cmi, chanspec)) {
3917		brcms_err(wlc->hw->d11core, "wl%d: %s: Bad channel %d\n",
3918			  wlc->pub->unit, __func__, CHSPEC_CHANNEL(chanspec));
3919		return;
3920	}
3921
3922	/* Switch bands if necessary */
3923	if (wlc->pub->_nbands > 1) {
3924		bandunit = chspec_bandunit(chanspec);
3925		if (wlc->band->bandunit != bandunit || wlc->bandinit_pending) {
3926			switchband = true;
3927			if (wlc->bandlocked) {
3928				brcms_err(wlc->hw->d11core,
3929					  "wl%d: %s: chspec %d band is locked!\n",
3930					  wlc->pub->unit, __func__,
3931					  CHSPEC_CHANNEL(chanspec));
3932				return;
3933			}
3934			/*
3935			 * should the setband call come after the
3936			 * brcms_b_chanspec() ? if the setband updates
3937			 * (brcms_c_bsinit) use low level calls to inspect and
3938			 * set state, the state inspected may be from the wrong
3939			 * band, or the following brcms_b_set_chanspec() may
3940			 * undo the work.
3941			 */
3942			brcms_c_setband(wlc, bandunit);
3943		}
3944	}
3945
3946	/* sync up phy/radio chanspec */
3947	brcms_c_set_phy_chanspec(wlc, chanspec);
3948
3949	/* init antenna selection */
3950	if (brcms_chspec_bw(old_chanspec) != brcms_chspec_bw(chanspec)) {
3951		brcms_c_antsel_init(wlc->asi);
3952
3953		/* Fix the hardware rateset based on bw.
3954		 * Mainly add MCS32 for 40Mhz, remove MCS 32 for 20Mhz
3955		 */
3956		brcms_c_rateset_bw_mcs_filter(&wlc->band->hw_rateset,
3957			wlc->band->mimo_cap_40 ? brcms_chspec_bw(chanspec) : 0);
3958	}
3959
3960	/* update some mac configuration since chanspec changed */
3961	brcms_c_ucode_mac_upd(wlc);
3962}
3963
3964/*
3965 * This function changes the phytxctl for beacon based on current
3966 * beacon ratespec AND txant setting as per this table:
3967 *  ratespec     CCK		ant = wlc->stf->txant
3968 *		OFDM		ant = 3
3969 */
3970void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc,
3971				       u32 bcn_rspec)
3972{
3973	u16 phyctl;
3974	u16 phytxant = wlc->stf->phytxant;
3975	u16 mask = PHY_TXC_ANT_MASK;
3976
3977	/* for non-siso rates or default setting, use the available chains */
3978	if (BRCMS_PHY_11N_CAP(wlc->band))
3979		phytxant = brcms_c_stf_phytxchain_sel(wlc, bcn_rspec);
3980
3981	phyctl = brcms_b_read_shm(wlc->hw, M_BCN_PCTLWD);
3982	phyctl = (phyctl & ~mask) | phytxant;
3983	brcms_b_write_shm(wlc->hw, M_BCN_PCTLWD, phyctl);
3984}
3985
3986/*
3987 * centralized protection config change function to simplify debugging, no
3988 * consistency checking this should be called only on changes to avoid overhead
3989 * in periodic function
3990 */
3991void brcms_c_protection_upd(struct brcms_c_info *wlc, uint idx, int val)
3992{
3993	/*
3994	 * Cannot use brcms_dbg_* here because this function is called
3995	 * before wlc is sufficiently initialized.
3996	 */
3997	BCMMSG(wlc->wiphy, "idx %d, val %d\n", idx, val);
3998
3999	switch (idx) {
4000	case BRCMS_PROT_G_SPEC:
4001		wlc->protection->_g = (bool) val;
4002		break;
4003	case BRCMS_PROT_G_OVR:
4004		wlc->protection->g_override = (s8) val;
4005		break;
4006	case BRCMS_PROT_G_USER:
4007		wlc->protection->gmode_user = (u8) val;
4008		break;
4009	case BRCMS_PROT_OVERLAP:
4010		wlc->protection->overlap = (s8) val;
4011		break;
4012	case BRCMS_PROT_N_USER:
4013		wlc->protection->nmode_user = (s8) val;
4014		break;
4015	case BRCMS_PROT_N_CFG:
4016		wlc->protection->n_cfg = (s8) val;
4017		break;
4018	case BRCMS_PROT_N_CFG_OVR:
4019		wlc->protection->n_cfg_override = (s8) val;
4020		break;
4021	case BRCMS_PROT_N_NONGF:
4022		wlc->protection->nongf = (bool) val;
4023		break;
4024	case BRCMS_PROT_N_NONGF_OVR:
4025		wlc->protection->nongf_override = (s8) val;
4026		break;
4027	case BRCMS_PROT_N_PAM_OVR:
4028		wlc->protection->n_pam_override = (s8) val;
4029		break;
4030	case BRCMS_PROT_N_OBSS:
4031		wlc->protection->n_obss = (bool) val;
4032		break;
4033
4034	default:
4035		break;
4036	}
4037
4038}
4039
4040static void brcms_c_ht_update_sgi_rx(struct brcms_c_info *wlc, int val)
4041{
4042	if (wlc->pub->up) {
4043		brcms_c_update_beacon(wlc);
4044		brcms_c_update_probe_resp(wlc, true);
4045	}
4046}
4047
4048static void brcms_c_ht_update_ldpc(struct brcms_c_info *wlc, s8 val)
4049{
4050	wlc->stf->ldpc = val;
4051
4052	if (wlc->pub->up) {
4053		brcms_c_update_beacon(wlc);
4054		brcms_c_update_probe_resp(wlc, true);
4055		wlc_phy_ldpc_override_set(wlc->band->pi, (val ? true : false));
4056	}
4057}
4058
4059void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
4060		       const struct ieee80211_tx_queue_params *params,
4061		       bool suspend)
4062{
4063	int i;
4064	struct shm_acparams acp_shm;
4065	u16 *shm_entry;
4066
4067	/* Only apply params if the core is out of reset and has clocks */
4068	if (!wlc->clk) {
4069		brcms_err(wlc->hw->d11core, "wl%d: %s : no-clock\n",
4070			  wlc->pub->unit, __func__);
4071		return;
4072	}
4073
4074	memset(&acp_shm, 0, sizeof(struct shm_acparams));
4075	/* fill in shm ac params struct */
4076	acp_shm.txop = params->txop;
4077	/* convert from units of 32us to us for ucode */
4078	wlc->edcf_txop[aci & 0x3] = acp_shm.txop =
4079	    EDCF_TXOP2USEC(acp_shm.txop);
4080	acp_shm.aifs = (params->aifs & EDCF_AIFSN_MASK);
4081
4082	if (aci == IEEE80211_AC_VI && acp_shm.txop == 0
4083	    && acp_shm.aifs < EDCF_AIFSN_MAX)
4084		acp_shm.aifs++;
4085
4086	if (acp_shm.aifs < EDCF_AIFSN_MIN
4087	    || acp_shm.aifs > EDCF_AIFSN_MAX) {
4088		brcms_err(wlc->hw->d11core, "wl%d: edcf_setparams: bad "
4089			  "aifs %d\n", wlc->pub->unit, acp_shm.aifs);
4090	} else {
4091		acp_shm.cwmin = params->cw_min;
4092		acp_shm.cwmax = params->cw_max;
4093		acp_shm.cwcur = acp_shm.cwmin;
4094		acp_shm.bslots =
4095			bcma_read16(wlc->hw->d11core, D11REGOFFS(tsf_random)) &
4096			acp_shm.cwcur;
4097		acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
4098		/* Indicate the new params to the ucode */
4099		acp_shm.status = brcms_b_read_shm(wlc->hw, (M_EDCF_QINFO +
4100						  wme_ac2fifo[aci] *
4101						  M_EDCF_QLEN +
4102						  M_EDCF_STATUS_OFF));
4103		acp_shm.status |= WME_STATUS_NEWAC;
4104
4105		/* Fill in shm acparam table */
4106		shm_entry = (u16 *) &acp_shm;
4107		for (i = 0; i < (int)sizeof(struct shm_acparams); i += 2)
4108			brcms_b_write_shm(wlc->hw,
4109					  M_EDCF_QINFO +
4110					  wme_ac2fifo[aci] * M_EDCF_QLEN + i,
4111					  *shm_entry++);
4112	}
4113
4114	if (suspend)
4115		brcms_c_suspend_mac_and_wait(wlc);
4116
4117	brcms_c_update_beacon(wlc);
4118	brcms_c_update_probe_resp(wlc, false);
4119
4120	if (suspend)
4121		brcms_c_enable_mac(wlc);
4122}
4123
4124static void brcms_c_edcf_setparams(struct brcms_c_info *wlc, bool suspend)
4125{
4126	u16 aci;
4127	int i_ac;
4128	struct ieee80211_tx_queue_params txq_pars;
4129	static const struct edcf_acparam default_edcf_acparams[] = {
4130		 {EDCF_AC_BE_ACI_STA, EDCF_AC_BE_ECW_STA, EDCF_AC_BE_TXOP_STA},
4131		 {EDCF_AC_BK_ACI_STA, EDCF_AC_BK_ECW_STA, EDCF_AC_BK_TXOP_STA},
4132		 {EDCF_AC_VI_ACI_STA, EDCF_AC_VI_ECW_STA, EDCF_AC_VI_TXOP_STA},
4133		 {EDCF_AC_VO_ACI_STA, EDCF_AC_VO_ECW_STA, EDCF_AC_VO_TXOP_STA}
4134	}; /* ucode needs these parameters during its initialization */
4135	const struct edcf_acparam *edcf_acp = &default_edcf_acparams[0];
4136
4137	for (i_ac = 0; i_ac < IEEE80211_NUM_ACS; i_ac++, edcf_acp++) {
4138		/* find out which ac this set of params applies to */
4139		aci = (edcf_acp->ACI & EDCF_ACI_MASK) >> EDCF_ACI_SHIFT;
4140
4141		/* fill in shm ac params struct */
4142		txq_pars.txop = edcf_acp->TXOP;
4143		txq_pars.aifs = edcf_acp->ACI;
4144
4145		/* CWmin = 2^(ECWmin) - 1 */
4146		txq_pars.cw_min = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
4147		/* CWmax = 2^(ECWmax) - 1 */
4148		txq_pars.cw_max = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
4149					    >> EDCF_ECWMAX_SHIFT);
4150		brcms_c_wme_setparams(wlc, aci, &txq_pars, suspend);
4151	}
4152
4153	if (suspend) {
4154		brcms_c_suspend_mac_and_wait(wlc);
4155		brcms_c_enable_mac(wlc);
4156	}
4157}
4158
4159static void brcms_c_radio_monitor_start(struct brcms_c_info *wlc)
4160{
4161	/* Don't start the timer if HWRADIO feature is disabled */
4162	if (wlc->radio_monitor)
4163		return;
4164
4165	wlc->radio_monitor = true;
4166	brcms_b_pllreq(wlc->hw, true, BRCMS_PLLREQ_RADIO_MON);
4167	brcms_add_timer(wlc->radio_timer, TIMER_INTERVAL_RADIOCHK, true);
4168}
4169
4170static bool brcms_c_radio_monitor_stop(struct brcms_c_info *wlc)
4171{
4172	if (!wlc->radio_monitor)
4173		return true;
4174
4175	wlc->radio_monitor = false;
4176	brcms_b_pllreq(wlc->hw, false, BRCMS_PLLREQ_RADIO_MON);
4177	return brcms_del_timer(wlc->radio_timer);
4178}
4179
4180/* read hwdisable state and propagate to wlc flag */
4181static void brcms_c_radio_hwdisable_upd(struct brcms_c_info *wlc)
4182{
4183	if (wlc->pub->hw_off)
4184		return;
4185
4186	if (brcms_b_radio_read_hwdisabled(wlc->hw))
4187		mboolset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4188	else
4189		mboolclr(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4190}
4191
4192/* update hwradio status and return it */
4193bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc)
4194{
4195	brcms_c_radio_hwdisable_upd(wlc);
4196
4197	return mboolisset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE) ?
4198			true : false;
4199}
4200
4201/* periodical query hw radio button while driver is "down" */
4202static void brcms_c_radio_timer(void *arg)
4203{
4204	struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4205
4206	if (brcms_deviceremoved(wlc)) {
4207		brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4208			  wlc->pub->unit, __func__);
4209		brcms_down(wlc->wl);
4210		return;
4211	}
4212
4213	brcms_c_radio_hwdisable_upd(wlc);
4214}
4215
4216/* common low-level watchdog code */
4217static void brcms_b_watchdog(struct brcms_c_info *wlc)
4218{
4219	struct brcms_hardware *wlc_hw = wlc->hw;
4220
4221	if (!wlc_hw->up)
4222		return;
4223
4224	/* increment second count */
4225	wlc_hw->now++;
4226
4227	/* Check for FIFO error interrupts */
4228	brcms_b_fifoerrors(wlc_hw);
4229
4230	/* make sure RX dma has buffers */
4231	dma_rxfill(wlc->hw->di[RX_FIFO]);
4232
4233	wlc_phy_watchdog(wlc_hw->band->pi);
4234}
4235
4236/* common watchdog code */
4237static void brcms_c_watchdog(struct brcms_c_info *wlc)
4238{
4239	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
4240
4241	if (!wlc->pub->up)
4242		return;
4243
4244	if (brcms_deviceremoved(wlc)) {
4245		brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4246			  wlc->pub->unit, __func__);
4247		brcms_down(wlc->wl);
4248		return;
4249	}
4250
4251	/* increment second count */
4252	wlc->pub->now++;
4253
4254	brcms_c_radio_hwdisable_upd(wlc);
4255	/* if radio is disable, driver may be down, quit here */
4256	if (wlc->pub->radio_disabled)
4257		return;
4258
4259	brcms_b_watchdog(wlc);
4260
4261	/*
4262	 * occasionally sample mac stat counters to
4263	 * detect 16-bit counter wrap
4264	 */
4265	if ((wlc->pub->now % SW_TIMER_MAC_STAT_UPD) == 0)
4266		brcms_c_statsupd(wlc);
4267
4268	if (BRCMS_ISNPHY(wlc->band) &&
4269	    ((wlc->pub->now - wlc->tempsense_lasttime) >=
4270	     BRCMS_TEMPSENSE_PERIOD)) {
4271		wlc->tempsense_lasttime = wlc->pub->now;
4272		brcms_c_tempsense_upd(wlc);
4273	}
4274}
4275
4276static void brcms_c_watchdog_by_timer(void *arg)
4277{
4278	struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4279
4280	brcms_c_watchdog(wlc);
4281}
4282
4283static bool brcms_c_timers_init(struct brcms_c_info *wlc, int unit)
4284{
4285	wlc->wdtimer = brcms_init_timer(wlc->wl, brcms_c_watchdog_by_timer,
4286		wlc, "watchdog");
4287	if (!wlc->wdtimer) {
4288		wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for wdtimer "
4289			  "failed\n", unit);
4290		goto fail;
4291	}
4292
4293	wlc->radio_timer = brcms_init_timer(wlc->wl, brcms_c_radio_timer,
4294		wlc, "radio");
4295	if (!wlc->radio_timer) {
4296		wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for radio_timer "
4297			  "failed\n", unit);
4298		goto fail;
4299	}
4300
4301	return true;
4302
4303 fail:
4304	return false;
4305}
4306
4307/*
4308 * Initialize brcms_c_info default values ...
4309 * may get overrides later in this function
4310 */
4311static void brcms_c_info_init(struct brcms_c_info *wlc, int unit)
4312{
4313	int i;
4314
4315	/* Save our copy of the chanspec */
4316	wlc->chanspec = ch20mhz_chspec(1);
4317
4318	/* various 802.11g modes */
4319	wlc->shortslot = false;
4320	wlc->shortslot_override = BRCMS_SHORTSLOT_AUTO;
4321
4322	brcms_c_protection_upd(wlc, BRCMS_PROT_G_OVR, BRCMS_PROTECTION_AUTO);
4323	brcms_c_protection_upd(wlc, BRCMS_PROT_G_SPEC, false);
4324
4325	brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG_OVR,
4326			       BRCMS_PROTECTION_AUTO);
4327	brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG, BRCMS_N_PROTECTION_OFF);
4328	brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF_OVR,
4329			       BRCMS_PROTECTION_AUTO);
4330	brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF, false);
4331	brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, AUTO);
4332
4333	brcms_c_protection_upd(wlc, BRCMS_PROT_OVERLAP,
4334			       BRCMS_PROTECTION_CTL_OVERLAP);
4335
4336	/* 802.11g draft 4.0 NonERP elt advertisement */
4337	wlc->include_legacy_erp = true;
4338
4339	wlc->stf->ant_rx_ovr = ANT_RX_DIV_DEF;
4340	wlc->stf->txant = ANT_TX_DEF;
4341
4342	wlc->prb_resp_timeout = BRCMS_PRB_RESP_TIMEOUT;
4343
4344	wlc->usr_fragthresh = DOT11_DEFAULT_FRAG_LEN;
4345	for (i = 0; i < NFIFO; i++)
4346		wlc->fragthresh[i] = DOT11_DEFAULT_FRAG_LEN;
4347	wlc->RTSThresh = DOT11_DEFAULT_RTS_LEN;
4348
4349	/* default rate fallback retry limits */
4350	wlc->SFBL = RETRY_SHORT_FB;
4351	wlc->LFBL = RETRY_LONG_FB;
4352
4353	/* default mac retry limits */
4354	wlc->SRL = RETRY_SHORT_DEF;
4355	wlc->LRL = RETRY_LONG_DEF;
4356
4357	/* WME QoS mode is Auto by default */
4358	wlc->pub->_ampdu = AMPDU_AGG_HOST;
4359}
4360
4361static uint brcms_c_attach_module(struct brcms_c_info *wlc)
4362{
4363	uint err = 0;
4364	uint unit;
4365	unit = wlc->pub->unit;
4366
4367	wlc->asi = brcms_c_antsel_attach(wlc);
4368	if (wlc->asi == NULL) {
4369		wiphy_err(wlc->wiphy, "wl%d: attach: antsel_attach "
4370			  "failed\n", unit);
4371		err = 44;
4372		goto fail;
4373	}
4374
4375	wlc->ampdu = brcms_c_ampdu_attach(wlc);
4376	if (wlc->ampdu == NULL) {
4377		wiphy_err(wlc->wiphy, "wl%d: attach: ampdu_attach "
4378			  "failed\n", unit);
4379		err = 50;
4380		goto fail;
4381	}
4382
4383	if ((brcms_c_stf_attach(wlc) != 0)) {
4384		wiphy_err(wlc->wiphy, "wl%d: attach: stf_attach "
4385			  "failed\n", unit);
4386		err = 68;
4387		goto fail;
4388	}
4389 fail:
4390	return err;
4391}
4392
4393struct brcms_pub *brcms_c_pub(struct brcms_c_info *wlc)
4394{
4395	return wlc->pub;
4396}
4397
4398/* low level attach
4399 *    run backplane attach, init nvram
4400 *    run phy attach
4401 *    initialize software state for each core and band
4402 *    put the whole chip in reset(driver down state), no clock
4403 */
4404static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
4405			  uint unit, bool piomode)
4406{
4407	struct brcms_hardware *wlc_hw;
4408	uint err = 0;
4409	uint j;
4410	bool wme = false;
4411	struct shared_phy_params sha_params;
4412	struct wiphy *wiphy = wlc->wiphy;
4413	struct pci_dev *pcidev = core->bus->host_pci;
4414	struct ssb_sprom *sprom = &core->bus->sprom;
4415
4416	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI)
4417		brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4418			       pcidev->vendor,
4419			       pcidev->device);
4420	else
4421		brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4422			       core->bus->boardinfo.vendor,
4423			       core->bus->boardinfo.type);
4424
4425	wme = true;
4426
4427	wlc_hw = wlc->hw;
4428	wlc_hw->wlc = wlc;
4429	wlc_hw->unit = unit;
4430	wlc_hw->band = wlc_hw->bandstate[0];
4431	wlc_hw->_piomode = piomode;
4432
4433	/* populate struct brcms_hardware with default values  */
4434	brcms_b_info_init(wlc_hw);
4435
4436	/*
4437	 * Do the hardware portion of the attach. Also initialize software
4438	 * state that depends on the particular hardware we are running.
4439	 */
4440	wlc_hw->sih = ai_attach(core->bus);
4441	if (wlc_hw->sih == NULL) {
4442		wiphy_err(wiphy, "wl%d: brcms_b_attach: si_attach failed\n",
4443			  unit);
4444		err = 11;
4445		goto fail;
4446	}
4447
4448	/* verify again the device is supported */
4449	if (!brcms_c_chipmatch(core)) {
4450		wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported device\n",
4451			 unit);
4452		err = 12;
4453		goto fail;
4454	}
4455
4456	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI) {
4457		wlc_hw->vendorid = pcidev->vendor;
4458		wlc_hw->deviceid = pcidev->device;
4459	} else {
4460		wlc_hw->vendorid = core->bus->boardinfo.vendor;
4461		wlc_hw->deviceid = core->bus->boardinfo.type;
4462	}
4463
4464	wlc_hw->d11core = core;
4465	wlc_hw->corerev = core->id.rev;
4466
4467	/* validate chip, chiprev and corerev */
4468	if (!brcms_c_isgoodchip(wlc_hw)) {
4469		err = 13;
4470		goto fail;
4471	}
4472
4473	/* initialize power control registers */
4474	ai_clkctl_init(wlc_hw->sih);
4475
4476	/* request fastclock and force fastclock for the rest of attach
4477	 * bring the d11 core out of reset.
4478	 *   For PMU chips, the first wlc_clkctl_clk is no-op since core-clk
4479	 *   is still false; But it will be called again inside wlc_corereset,
4480	 *   after d11 is out of reset.
4481	 */
4482	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4483	brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4484
4485	if (!brcms_b_validate_chip_access(wlc_hw)) {
4486		wiphy_err(wiphy, "wl%d: brcms_b_attach: validate_chip_access "
4487			"failed\n", unit);
4488		err = 14;
4489		goto fail;
4490	}
4491
4492	/* get the board rev, used just below */
4493	j = sprom->board_rev;
4494	/* promote srom boardrev of 0xFF to 1 */
4495	if (j == BOARDREV_PROMOTABLE)
4496		j = BOARDREV_PROMOTED;
4497	wlc_hw->boardrev = (u16) j;
4498	if (!brcms_c_validboardtype(wlc_hw)) {
4499		wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported Broadcom "
4500			  "board type (0x%x)" " or revision level (0x%x)\n",
4501			  unit, ai_get_boardtype(wlc_hw->sih),
4502			  wlc_hw->boardrev);
4503		err = 15;
4504		goto fail;
4505	}
4506	wlc_hw->sromrev = sprom->revision;
4507	wlc_hw->boardflags = sprom->boardflags_lo + (sprom->boardflags_hi << 16);
4508	wlc_hw->boardflags2 = sprom->boardflags2_lo + (sprom->boardflags2_hi << 16);
4509
4510	if (wlc_hw->boardflags & BFL_NOPLLDOWN)
4511		brcms_b_pllreq(wlc_hw, true, BRCMS_PLLREQ_SHARED);
4512
4513	/* check device id(srom, nvram etc.) to set bands */
4514	if (wlc_hw->deviceid == BCM43224_D11N_ID ||
4515	    wlc_hw->deviceid == BCM43224_D11N_ID_VEN1 ||
4516	    wlc_hw->deviceid == BCM43224_CHIP_ID)
4517		/* Dualband boards */
4518		wlc_hw->_nbands = 2;
4519	else
4520		wlc_hw->_nbands = 1;
4521
4522	if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225))
4523		wlc_hw->_nbands = 1;
4524
4525	/* BMAC_NOTE: remove init of pub values when brcms_c_attach()
4526	 * unconditionally does the init of these values
4527	 */
4528	wlc->vendorid = wlc_hw->vendorid;
4529	wlc->deviceid = wlc_hw->deviceid;
4530	wlc->pub->sih = wlc_hw->sih;
4531	wlc->pub->corerev = wlc_hw->corerev;
4532	wlc->pub->sromrev = wlc_hw->sromrev;
4533	wlc->pub->boardrev = wlc_hw->boardrev;
4534	wlc->pub->boardflags = wlc_hw->boardflags;
4535	wlc->pub->boardflags2 = wlc_hw->boardflags2;
4536	wlc->pub->_nbands = wlc_hw->_nbands;
4537
4538	wlc_hw->physhim = wlc_phy_shim_attach(wlc_hw, wlc->wl, wlc);
4539
4540	if (wlc_hw->physhim == NULL) {
4541		wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_shim_attach "
4542			"failed\n", unit);
4543		err = 25;
4544		goto fail;
4545	}
4546
4547	/* pass all the parameters to wlc_phy_shared_attach in one struct */
4548	sha_params.sih = wlc_hw->sih;
4549	sha_params.physhim = wlc_hw->physhim;
4550	sha_params.unit = unit;
4551	sha_params.corerev = wlc_hw->corerev;
4552	sha_params.vid = wlc_hw->vendorid;
4553	sha_params.did = wlc_hw->deviceid;
4554	sha_params.chip = ai_get_chip_id(wlc_hw->sih);
4555	sha_params.chiprev = ai_get_chiprev(wlc_hw->sih);
4556	sha_params.chippkg = ai_get_chippkg(wlc_hw->sih);
4557	sha_params.sromrev = wlc_hw->sromrev;
4558	sha_params.boardtype = ai_get_boardtype(wlc_hw->sih);
4559	sha_params.boardrev = wlc_hw->boardrev;
4560	sha_params.boardflags = wlc_hw->boardflags;
4561	sha_params.boardflags2 = wlc_hw->boardflags2;
4562
4563	/* alloc and save pointer to shared phy state area */
4564	wlc_hw->phy_sh = wlc_phy_shared_attach(&sha_params);
4565	if (!wlc_hw->phy_sh) {
4566		err = 16;
4567		goto fail;
4568	}
4569
4570	/* initialize software state for each core and band */
4571	for (j = 0; j < wlc_hw->_nbands; j++) {
4572		/*
4573		 * band0 is always 2.4Ghz
4574		 * band1, if present, is 5Ghz
4575		 */
4576
4577		brcms_c_setxband(wlc_hw, j);
4578
4579		wlc_hw->band->bandunit = j;
4580		wlc_hw->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4581		wlc->band->bandunit = j;
4582		wlc->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4583		wlc->core->coreidx = core->core_index;
4584
4585		wlc_hw->machwcap = bcma_read32(core, D11REGOFFS(machwcap));
4586		wlc_hw->machwcap_backup = wlc_hw->machwcap;
4587
4588		/* init tx fifo size */
4589		WARN_ON((wlc_hw->corerev - XMTFIFOTBL_STARTREV) < 0 ||
4590			(wlc_hw->corerev - XMTFIFOTBL_STARTREV) >
4591				ARRAY_SIZE(xmtfifo_sz));
4592		wlc_hw->xmtfifo_sz =
4593		    xmtfifo_sz[(wlc_hw->corerev - XMTFIFOTBL_STARTREV)];
4594		WARN_ON(!wlc_hw->xmtfifo_sz[0]);
4595
4596		/* Get a phy for this band */
4597		wlc_hw->band->pi =
4598			wlc_phy_attach(wlc_hw->phy_sh, core,
4599				       wlc_hw->band->bandtype,
4600				       wlc->wiphy);
4601		if (wlc_hw->band->pi == NULL) {
4602			wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_"
4603				  "attach failed\n", unit);
4604			err = 17;
4605			goto fail;
4606		}
4607
4608		wlc_phy_machwcap_set(wlc_hw->band->pi, wlc_hw->machwcap);
4609
4610		wlc_phy_get_phyversion(wlc_hw->band->pi, &wlc_hw->band->phytype,
4611				       &wlc_hw->band->phyrev,
4612				       &wlc_hw->band->radioid,
4613				       &wlc_hw->band->radiorev);
4614		wlc_hw->band->abgphy_encore =
4615		    wlc_phy_get_encore(wlc_hw->band->pi);
4616		wlc->band->abgphy_encore = wlc_phy_get_encore(wlc_hw->band->pi);
4617		wlc_hw->band->core_flags =
4618		    wlc_phy_get_coreflags(wlc_hw->band->pi);
4619
4620		/* verify good phy_type & supported phy revision */
4621		if (BRCMS_ISNPHY(wlc_hw->band)) {
4622			if (NCONF_HAS(wlc_hw->band->phyrev))
4623				goto good_phy;
4624			else
4625				goto bad_phy;
4626		} else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
4627			if (LCNCONF_HAS(wlc_hw->band->phyrev))
4628				goto good_phy;
4629			else
4630				goto bad_phy;
4631		} else {
4632 bad_phy:
4633			wiphy_err(wiphy, "wl%d: brcms_b_attach: unsupported "
4634				  "phy type/rev (%d/%d)\n", unit,
4635				  wlc_hw->band->phytype, wlc_hw->band->phyrev);
4636			err = 18;
4637			goto fail;
4638		}
4639
4640 good_phy:
4641		/*
4642		 * BMAC_NOTE: wlc->band->pi should not be set below and should
4643		 * be done in the high level attach. However we can not make
4644		 * that change until all low level access is changed to
4645		 * wlc_hw->band->pi. Instead do the wlc->band->pi init below,
4646		 * keeping wlc_hw->band->pi as well for incremental update of
4647		 * low level fns, and cut over low only init when all fns
4648		 * updated.
4649		 */
4650		wlc->band->pi = wlc_hw->band->pi;
4651		wlc->band->phytype = wlc_hw->band->phytype;
4652		wlc->band->phyrev = wlc_hw->band->phyrev;
4653		wlc->band->radioid = wlc_hw->band->radioid;
4654		wlc->band->radiorev = wlc_hw->band->radiorev;
4655		brcms_dbg_info(core, "wl%d: phy %u/%u radio %x/%u\n", unit,
4656			       wlc->band->phytype, wlc->band->phyrev,
4657			       wlc->band->radioid, wlc->band->radiorev);
4658		/* default contention windows size limits */
4659		wlc_hw->band->CWmin = APHY_CWMIN;
4660		wlc_hw->band->CWmax = PHY_CWMAX;
4661
4662		if (!brcms_b_attach_dmapio(wlc, j, wme)) {
4663			err = 19;
4664			goto fail;
4665		}
4666	}
4667
4668	/* disable core to match driver "down" state */
4669	brcms_c_coredisable(wlc_hw);
4670
4671	/* Match driver "down" state */
4672	bcma_core_pci_down(wlc_hw->d11core->bus);
4673
4674	/* turn off pll and xtal to match driver "down" state */
4675	brcms_b_xtal(wlc_hw, OFF);
4676
4677	/* *******************************************************************
4678	 * The hardware is in the DOWN state at this point. D11 core
4679	 * or cores are in reset with clocks off, and the board PLLs
4680	 * are off if possible.
4681	 *
4682	 * Beyond this point, wlc->sbclk == false and chip registers
4683	 * should not be touched.
4684	 *********************************************************************
4685	 */
4686
4687	/* init etheraddr state variables */
4688	brcms_c_get_macaddr(wlc_hw, wlc_hw->etheraddr);
4689
4690	if (is_broadcast_ether_addr(wlc_hw->etheraddr) ||
4691	    is_zero_ether_addr(wlc_hw->etheraddr)) {
4692		wiphy_err(wiphy, "wl%d: brcms_b_attach: bad macaddr\n",
4693			  unit);
4694		err = 22;
4695		goto fail;
4696	}
4697
4698	brcms_dbg_info(wlc_hw->d11core, "deviceid 0x%x nbands %d board 0x%x\n",
4699		       wlc_hw->deviceid, wlc_hw->_nbands,
4700		       ai_get_boardtype(wlc_hw->sih));
4701
4702	return err;
4703
4704 fail:
4705	wiphy_err(wiphy, "wl%d: brcms_b_attach: failed with err %d\n", unit,
4706		  err);
4707	return err;
4708}
4709
4710static bool brcms_c_attach_stf_ant_init(struct brcms_c_info *wlc)
4711{
4712	int aa;
4713	uint unit;
4714	int bandtype;
4715	struct ssb_sprom *sprom = &wlc->hw->d11core->bus->sprom;
4716
4717	unit = wlc->pub->unit;
4718	bandtype = wlc->band->bandtype;
4719
4720	/* get antennas available */
4721	if (bandtype == BRCM_BAND_5G)
4722		aa = sprom->ant_available_a;
4723	else
4724		aa = sprom->ant_available_bg;
4725
4726	if ((aa < 1) || (aa > 15)) {
4727		wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
4728			  " srom (0x%x), using 3\n", unit, __func__, aa);
4729		aa = 3;
4730	}
4731
4732	/* reset the defaults if we have a single antenna */
4733	if (aa == 1) {
4734		wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_0;
4735		wlc->stf->txant = ANT_TX_FORCE_0;
4736	} else if (aa == 2) {
4737		wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_1;
4738		wlc->stf->txant = ANT_TX_FORCE_1;
4739	} else {
4740	}
4741
4742	/* Compute Antenna Gain */
4743	if (bandtype == BRCM_BAND_5G)
4744		wlc->band->antgain = sprom->antenna_gain.a1;
4745	else
4746		wlc->band->antgain = sprom->antenna_gain.a0;
4747
4748	return true;
4749}
4750
4751static void brcms_c_bss_default_init(struct brcms_c_info *wlc)
4752{
4753	u16 chanspec;
4754	struct brcms_band *band;
4755	struct brcms_bss_info *bi = wlc->default_bss;
4756
4757	/* init default and target BSS with some sane initial values */
4758	memset(bi, 0, sizeof(*bi));
4759	bi->beacon_period = BEACON_INTERVAL_DEFAULT;
4760
4761	/* fill the default channel as the first valid channel
4762	 * starting from the 2G channels
4763	 */
4764	chanspec = ch20mhz_chspec(1);
4765	wlc->home_chanspec = bi->chanspec = chanspec;
4766
4767	/* find the band of our default channel */
4768	band = wlc->band;
4769	if (wlc->pub->_nbands > 1 &&
4770	    band->bandunit != chspec_bandunit(chanspec))
4771		band = wlc->bandstate[OTHERBANDUNIT(wlc)];
4772
4773	/* init bss rates to the band specific default rate set */
4774	brcms_c_rateset_default(&bi->rateset, NULL, band->phytype,
4775		band->bandtype, false, BRCMS_RATE_MASK_FULL,
4776		(bool) (wlc->pub->_n_enab & SUPPORT_11N),
4777		brcms_chspec_bw(chanspec), wlc->stf->txstreams);
4778
4779	if (wlc->pub->_n_enab & SUPPORT_11N)
4780		bi->flags |= BRCMS_BSS_HT;
4781}
4782
4783static void brcms_c_update_mimo_band_bwcap(struct brcms_c_info *wlc, u8 bwcap)
4784{
4785	uint i;
4786	struct brcms_band *band;
4787
4788	for (i = 0; i < wlc->pub->_nbands; i++) {
4789		band = wlc->bandstate[i];
4790		if (band->bandtype == BRCM_BAND_5G) {
4791			if ((bwcap == BRCMS_N_BW_40ALL)
4792			    || (bwcap == BRCMS_N_BW_20IN2G_40IN5G))
4793				band->mimo_cap_40 = true;
4794			else
4795				band->mimo_cap_40 = false;
4796		} else {
4797			if (bwcap == BRCMS_N_BW_40ALL)
4798				band->mimo_cap_40 = true;
4799			else
4800				band->mimo_cap_40 = false;
4801		}
4802	}
4803}
4804
4805static void brcms_c_timers_deinit(struct brcms_c_info *wlc)
4806{
4807	/* free timer state */
4808	if (wlc->wdtimer) {
4809		brcms_free_timer(wlc->wdtimer);
4810		wlc->wdtimer = NULL;
4811	}
4812	if (wlc->radio_timer) {
4813		brcms_free_timer(wlc->radio_timer);
4814		wlc->radio_timer = NULL;
4815	}
4816}
4817
4818static void brcms_c_detach_module(struct brcms_c_info *wlc)
4819{
4820	if (wlc->asi) {
4821		brcms_c_antsel_detach(wlc->asi);
4822		wlc->asi = NULL;
4823	}
4824
4825	if (wlc->ampdu) {
4826		brcms_c_ampdu_detach(wlc->ampdu);
4827		wlc->ampdu = NULL;
4828	}
4829
4830	brcms_c_stf_detach(wlc);
4831}
4832
4833/*
4834 * low level detach
4835 */
4836static void brcms_b_detach(struct brcms_c_info *wlc)
4837{
4838	uint i;
4839	struct brcms_hw_band *band;
4840	struct brcms_hardware *wlc_hw = wlc->hw;
4841
4842	brcms_b_detach_dmapio(wlc_hw);
4843
4844	band = wlc_hw->band;
4845	for (i = 0; i < wlc_hw->_nbands; i++) {
4846		if (band->pi) {
4847			/* Detach this band's phy */
4848			wlc_phy_detach(band->pi);
4849			band->pi = NULL;
4850		}
4851		band = wlc_hw->bandstate[OTHERBANDUNIT(wlc)];
4852	}
4853
4854	/* Free shared phy state */
4855	kfree(wlc_hw->phy_sh);
4856
4857	wlc_phy_shim_detach(wlc_hw->physhim);
4858
4859	if (wlc_hw->sih) {
4860		ai_detach(wlc_hw->sih);
4861		wlc_hw->sih = NULL;
4862	}
4863}
4864
4865/*
4866 * Return a count of the number of driver callbacks still pending.
4867 *
4868 * General policy is that brcms_c_detach can only dealloc/free software states.
4869 * It can NOT touch hardware registers since the d11core may be in reset and
4870 * clock may not be available.
4871 * One exception is sb register access, which is possible if crystal is turned
4872 * on after "down" state, driver should avoid software timer with the exception
4873 * of radio_monitor.
4874 */
4875uint brcms_c_detach(struct brcms_c_info *wlc)
4876{
4877	uint callbacks;
4878
4879	if (wlc == NULL)
4880		return 0;
4881
4882	brcms_b_detach(wlc);
4883
4884	/* delete software timers */
4885	callbacks = 0;
4886	if (!brcms_c_radio_monitor_stop(wlc))
4887		callbacks++;
4888
4889	brcms_c_channel_mgr_detach(wlc->cmi);
4890
4891	brcms_c_timers_deinit(wlc);
4892
4893	brcms_c_detach_module(wlc);
4894
4895	brcms_c_detach_mfree(wlc);
4896	return callbacks;
4897}
4898
4899/* update state that depends on the current value of "ap" */
4900static void brcms_c_ap_upd(struct brcms_c_info *wlc)
4901{
4902	/* STA-BSS; short capable */
4903	wlc->PLCPHdr_override = BRCMS_PLCP_SHORT;
4904}
4905
4906/* Initialize just the hardware when coming out of POR or S3/S5 system states */
4907static void brcms_b_hw_up(struct brcms_hardware *wlc_hw)
4908{
4909	if (wlc_hw->wlc->pub->hw_up)
4910		return;
4911
4912	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4913
4914	/*
4915	 * Enable pll and xtal, initialize the power control registers,
4916	 * and force fastclock for the remainder of brcms_c_up().
4917	 */
4918	brcms_b_xtal(wlc_hw, ON);
4919	ai_clkctl_init(wlc_hw->sih);
4920	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4921
4922	/*
4923	 * TODO: test suspend/resume
4924	 *
4925	 * AI chip doesn't restore bar0win2 on
4926	 * hibernation/resume, need sw fixup
4927	 */
4928
4929	/*
4930	 * Inform phy that a POR reset has occurred so
4931	 * it does a complete phy init
4932	 */
4933	wlc_phy_por_inform(wlc_hw->band->pi);
4934
4935	wlc_hw->ucode_loaded = false;
4936	wlc_hw->wlc->pub->hw_up = true;
4937
4938	if ((wlc_hw->boardflags & BFL_FEM)
4939	    && (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
4940		if (!
4941		    (wlc_hw->boardrev >= 0x1250
4942		     && (wlc_hw->boardflags & BFL_FEM_BT)))
4943			ai_epa_4313war(wlc_hw->sih);
4944	}
4945}
4946
4947static int brcms_b_up_prep(struct brcms_hardware *wlc_hw)
4948{
4949	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4950
4951	/*
4952	 * Enable pll and xtal, initialize the power control registers,
4953	 * and force fastclock for the remainder of brcms_c_up().
4954	 */
4955	brcms_b_xtal(wlc_hw, ON);
4956	ai_clkctl_init(wlc_hw->sih);
4957	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4958
4959	/*
4960	 * Configure pci/pcmcia here instead of in brcms_c_attach()
4961	 * to allow mfg hotswap:  down, hotswap (chip power cycle), up.
4962	 */
4963	bcma_core_pci_irq_ctl(&wlc_hw->d11core->bus->drv_pci[0], wlc_hw->d11core,
4964			      true);
4965
4966	/*
4967	 * Need to read the hwradio status here to cover the case where the
4968	 * system is loaded with the hw radio disabled. We do not want to
4969	 * bring the driver up in this case.
4970	 */
4971	if (brcms_b_radio_read_hwdisabled(wlc_hw)) {
4972		/* put SB PCI in down state again */
4973		bcma_core_pci_down(wlc_hw->d11core->bus);
4974		brcms_b_xtal(wlc_hw, OFF);
4975		return -ENOMEDIUM;
4976	}
4977
4978	bcma_core_pci_up(wlc_hw->d11core->bus);
4979
4980	/* reset the d11 core */
4981	brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4982
4983	return 0;
4984}
4985
4986static int brcms_b_up_finish(struct brcms_hardware *wlc_hw)
4987{
4988	wlc_hw->up = true;
4989	wlc_phy_hw_state_upd(wlc_hw->band->pi, true);
4990
4991	/* FULLY enable dynamic power control and d11 core interrupt */
4992	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
4993	brcms_intrson(wlc_hw->wlc->wl);
4994	return 0;
4995}
4996
4997/*
4998 * Write WME tunable parameters for retransmit/max rate
4999 * from wlc struct to ucode
5000 */
5001static void brcms_c_wme_retries_write(struct brcms_c_info *wlc)
5002{
5003	int ac;
5004
5005	/* Need clock to do this */
5006	if (!wlc->clk)
5007		return;
5008
5009	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
5010		brcms_b_write_shm(wlc->hw, M_AC_TXLMT_ADDR(ac),
5011				  wlc->wme_retries[ac]);
5012}
5013
5014/* make interface operational */
5015int brcms_c_up(struct brcms_c_info *wlc)
5016{
5017	struct ieee80211_channel *ch;
5018
5019	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5020
5021	/* HW is turned off so don't try to access it */
5022	if (wlc->pub->hw_off || brcms_deviceremoved(wlc))
5023		return -ENOMEDIUM;
5024
5025	if (!wlc->pub->hw_up) {
5026		brcms_b_hw_up(wlc->hw);
5027		wlc->pub->hw_up = true;
5028	}
5029
5030	if ((wlc->pub->boardflags & BFL_FEM)
5031	    && (ai_get_chip_id(wlc->hw->sih) == BCMA_CHIP_ID_BCM4313)) {
5032		if (wlc->pub->boardrev >= 0x1250
5033		    && (wlc->pub->boardflags & BFL_FEM_BT))
5034			brcms_b_mhf(wlc->hw, MHF5, MHF5_4313_GPIOCTRL,
5035				MHF5_4313_GPIOCTRL, BRCM_BAND_ALL);
5036		else
5037			brcms_b_mhf(wlc->hw, MHF4, MHF4_EXTPA_ENABLE,
5038				    MHF4_EXTPA_ENABLE, BRCM_BAND_ALL);
5039	}
5040
5041	/*
5042	 * Need to read the hwradio status here to cover the case where the
5043	 * system is loaded with the hw radio disabled. We do not want to bring
5044	 * the driver up in this case. If radio is disabled, abort up, lower
5045	 * power, start radio timer and return 0(for NDIS) don't call
5046	 * radio_update to avoid looping brcms_c_up.
5047	 *
5048	 * brcms_b_up_prep() returns either 0 or -BCME_RADIOOFF only
5049	 */
5050	if (!wlc->pub->radio_disabled) {
5051		int status = brcms_b_up_prep(wlc->hw);
5052		if (status == -ENOMEDIUM) {
5053			if (!mboolisset
5054			    (wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE)) {
5055				struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
5056				mboolset(wlc->pub->radio_disabled,
5057					 WL_RADIO_HW_DISABLE);
5058				if (bsscfg->type == BRCMS_TYPE_STATION ||
5059				    bsscfg->type == BRCMS_TYPE_ADHOC)
5060					brcms_err(wlc->hw->d11core,
5061						  "wl%d: up: rfdisable -> "
5062						  "bsscfg_disable()\n",
5063						   wlc->pub->unit);
5064			}
5065		}
5066	}
5067
5068	if (wlc->pub->radio_disabled) {
5069		brcms_c_radio_monitor_start(wlc);
5070		return 0;
5071	}
5072
5073	/* brcms_b_up_prep has done brcms_c_corereset(). so clk is on, set it */
5074	wlc->clk = true;
5075
5076	brcms_c_radio_monitor_stop(wlc);
5077
5078	/* Set EDCF hostflags */
5079	brcms_b_mhf(wlc->hw, MHF1, MHF1_EDCF, MHF1_EDCF, BRCM_BAND_ALL);
5080
5081	brcms_init(wlc->wl);
5082	wlc->pub->up = true;
5083
5084	if (wlc->bandinit_pending) {
5085		ch = wlc->pub->ieee_hw->conf.chandef.chan;
5086		brcms_c_suspend_mac_and_wait(wlc);
5087		brcms_c_set_chanspec(wlc, ch20mhz_chspec(ch->hw_value));
5088		wlc->bandinit_pending = false;
5089		brcms_c_enable_mac(wlc);
5090	}
5091
5092	brcms_b_up_finish(wlc->hw);
5093
5094	/* Program the TX wme params with the current settings */
5095	brcms_c_wme_retries_write(wlc);
5096
5097	/* start one second watchdog timer */
5098	brcms_add_timer(wlc->wdtimer, TIMER_INTERVAL_WATCHDOG, true);
5099	wlc->WDarmed = true;
5100
5101	/* ensure antenna config is up to date */
5102	brcms_c_stf_phy_txant_upd(wlc);
5103	/* ensure LDPC config is in sync */
5104	brcms_c_ht_update_ldpc(wlc, wlc->stf->ldpc);
5105
5106	return 0;
5107}
5108
5109static uint brcms_c_down_del_timer(struct brcms_c_info *wlc)
5110{
5111	uint callbacks = 0;
5112
5113	return callbacks;
5114}
5115
5116static int brcms_b_bmac_down_prep(struct brcms_hardware *wlc_hw)
5117{
5118	bool dev_gone;
5119	uint callbacks = 0;
5120
5121	if (!wlc_hw->up)
5122		return callbacks;
5123
5124	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5125
5126	/* disable interrupts */
5127	if (dev_gone)
5128		wlc_hw->wlc->macintmask = 0;
5129	else {
5130		/* now disable interrupts */
5131		brcms_intrsoff(wlc_hw->wlc->wl);
5132
5133		/* ensure we're running on the pll clock again */
5134		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
5135	}
5136	/* down phy at the last of this stage */
5137	callbacks += wlc_phy_down(wlc_hw->band->pi);
5138
5139	return callbacks;
5140}
5141
5142static int brcms_b_down_finish(struct brcms_hardware *wlc_hw)
5143{
5144	uint callbacks = 0;
5145	bool dev_gone;
5146
5147	if (!wlc_hw->up)
5148		return callbacks;
5149
5150	wlc_hw->up = false;
5151	wlc_phy_hw_state_upd(wlc_hw->band->pi, false);
5152
5153	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5154
5155	if (dev_gone) {
5156		wlc_hw->sbclk = false;
5157		wlc_hw->clk = false;
5158		wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
5159
5160		/* reclaim any posted packets */
5161		brcms_c_flushqueues(wlc_hw->wlc);
5162	} else {
5163
5164		/* Reset and disable the core */
5165		if (bcma_core_is_enabled(wlc_hw->d11core)) {
5166			if (bcma_read32(wlc_hw->d11core,
5167					D11REGOFFS(maccontrol)) & MCTL_EN_MAC)
5168				brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
5169			callbacks += brcms_reset(wlc_hw->wlc->wl);
5170			brcms_c_coredisable(wlc_hw);
5171		}
5172
5173		/* turn off primary xtal and pll */
5174		if (!wlc_hw->noreset) {
5175			bcma_core_pci_down(wlc_hw->d11core->bus);
5176			brcms_b_xtal(wlc_hw, OFF);
5177		}
5178	}
5179
5180	return callbacks;
5181}
5182
5183/*
5184 * Mark the interface nonoperational, stop the software mechanisms,
5185 * disable the hardware, free any transient buffer state.
5186 * Return a count of the number of driver callbacks still pending.
5187 */
5188uint brcms_c_down(struct brcms_c_info *wlc)
5189{
5190
5191	uint callbacks = 0;
5192	int i;
5193	bool dev_gone = false;
5194
5195	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5196
5197	/* check if we are already in the going down path */
5198	if (wlc->going_down) {
5199		brcms_err(wlc->hw->d11core,
5200			  "wl%d: %s: Driver going down so return\n",
5201			  wlc->pub->unit, __func__);
5202		return 0;
5203	}
5204	if (!wlc->pub->up)
5205		return callbacks;
5206
5207	wlc->going_down = true;
5208
5209	callbacks += brcms_b_bmac_down_prep(wlc->hw);
5210
5211	dev_gone = brcms_deviceremoved(wlc);
5212
5213	/* Call any registered down handlers */
5214	for (i = 0; i < BRCMS_MAXMODULES; i++) {
5215		if (wlc->modulecb[i].down_fn)
5216			callbacks +=
5217			    wlc->modulecb[i].down_fn(wlc->modulecb[i].hdl);
5218	}
5219
5220	/* cancel the watchdog timer */
5221	if (wlc->WDarmed) {
5222		if (!brcms_del_timer(wlc->wdtimer))
5223			callbacks++;
5224		wlc->WDarmed = false;
5225	}
5226	/* cancel all other timers */
5227	callbacks += brcms_c_down_del_timer(wlc);
5228
5229	wlc->pub->up = false;
5230
5231	wlc_phy_mute_upd(wlc->band->pi, false, PHY_MUTE_ALL);
5232
5233	callbacks += brcms_b_down_finish(wlc->hw);
5234
5235	/* brcms_b_down_finish has done brcms_c_coredisable(). so clk is off */
5236	wlc->clk = false;
5237
5238	wlc->going_down = false;
5239	return callbacks;
5240}
5241
5242/* Set the current gmode configuration */
5243int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config)
5244{
5245	int ret = 0;
5246	uint i;
5247	struct brcms_c_rateset rs;
5248	/* Default to 54g Auto */
5249	/* Advertise and use shortslot (-1/0/1 Auto/Off/On) */
5250	s8 shortslot = BRCMS_SHORTSLOT_AUTO;
5251	bool shortslot_restrict = false; /* Restrict association to stations
5252					  * that support shortslot
5253					  */
5254	bool ofdm_basic = false;	/* Make 6, 12, and 24 basic rates */
5255	/* Advertise and use short preambles (-1/0/1 Auto/Off/On) */
5256	int preamble = BRCMS_PLCP_LONG;
5257	bool preamble_restrict = false;	/* Restrict association to stations
5258					 * that support short preambles
5259					 */
5260	struct brcms_band *band;
5261
5262	/* if N-support is enabled, allow Gmode set as long as requested
5263	 * Gmode is not GMODE_LEGACY_B
5264	 */
5265	if ((wlc->pub->_n_enab & SUPPORT_11N) && gmode == GMODE_LEGACY_B)
5266		return -ENOTSUPP;
5267
5268	/* verify that we are dealing with 2G band and grab the band pointer */
5269	if (wlc->band->bandtype == BRCM_BAND_2G)
5270		band = wlc->band;
5271	else if ((wlc->pub->_nbands > 1) &&
5272		 (wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype == BRCM_BAND_2G))
5273		band = wlc->bandstate[OTHERBANDUNIT(wlc)];
5274	else
5275		return -EINVAL;
5276
5277	/* update configuration value */
5278	if (config)
5279		brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER, gmode);
5280
5281	/* Clear rateset override */
5282	memset(&rs, 0, sizeof(rs));
5283
5284	switch (gmode) {
5285	case GMODE_LEGACY_B:
5286		shortslot = BRCMS_SHORTSLOT_OFF;
5287		brcms_c_rateset_copy(&gphy_legacy_rates, &rs);
5288
5289		break;
5290
5291	case GMODE_LRS:
5292		break;
5293
5294	case GMODE_AUTO:
5295		/* Accept defaults */
5296		break;
5297
5298	case GMODE_ONLY:
5299		ofdm_basic = true;
5300		preamble = BRCMS_PLCP_SHORT;
5301		preamble_restrict = true;
5302		break;
5303
5304	case GMODE_PERFORMANCE:
5305		shortslot = BRCMS_SHORTSLOT_ON;
5306		shortslot_restrict = true;
5307		ofdm_basic = true;
5308		preamble = BRCMS_PLCP_SHORT;
5309		preamble_restrict = true;
5310		break;
5311
5312	default:
5313		/* Error */
5314		brcms_err(wlc->hw->d11core, "wl%d: %s: invalid gmode %d\n",
5315			  wlc->pub->unit, __func__, gmode);
5316		return -ENOTSUPP;
5317	}
5318
5319	band->gmode = gmode;
5320
5321	wlc->shortslot_override = shortslot;
5322
5323	/* Use the default 11g rateset */
5324	if (!rs.count)
5325		brcms_c_rateset_copy(&cck_ofdm_rates, &rs);
5326
5327	if (ofdm_basic) {
5328		for (i = 0; i < rs.count; i++) {
5329			if (rs.rates[i] == BRCM_RATE_6M
5330			    || rs.rates[i] == BRCM_RATE_12M
5331			    || rs.rates[i] == BRCM_RATE_24M)
5332				rs.rates[i] |= BRCMS_RATE_FLAG;
5333		}
5334	}
5335
5336	/* Set default bss rateset */
5337	wlc->default_bss->rateset.count = rs.count;
5338	memcpy(wlc->default_bss->rateset.rates, rs.rates,
5339	       sizeof(wlc->default_bss->rateset.rates));
5340
5341	return ret;
5342}
5343
5344int brcms_c_set_nmode(struct brcms_c_info *wlc)
5345{
5346	uint i;
5347	s32 nmode = AUTO;
5348
5349	if (wlc->stf->txstreams == WL_11N_3x3)
5350		nmode = WL_11N_3x3;
5351	else
5352		nmode = WL_11N_2x2;
5353
5354	/* force GMODE_AUTO if NMODE is ON */
5355	brcms_c_set_gmode(wlc, GMODE_AUTO, true);
5356	if (nmode == WL_11N_3x3)
5357		wlc->pub->_n_enab = SUPPORT_HT;
5358	else
5359		wlc->pub->_n_enab = SUPPORT_11N;
5360	wlc->default_bss->flags |= BRCMS_BSS_HT;
5361	/* add the mcs rates to the default and hw ratesets */
5362	brcms_c_rateset_mcs_build(&wlc->default_bss->rateset,
5363			      wlc->stf->txstreams);
5364	for (i = 0; i < wlc->pub->_nbands; i++)
5365		memcpy(wlc->bandstate[i]->hw_rateset.mcs,
5366		       wlc->default_bss->rateset.mcs, MCSSET_LEN);
5367
5368	return 0;
5369}
5370
5371static int
5372brcms_c_set_internal_rateset(struct brcms_c_info *wlc,
5373			     struct brcms_c_rateset *rs_arg)
5374{
5375	struct brcms_c_rateset rs, new;
5376	uint bandunit;
5377
5378	memcpy(&rs, rs_arg, sizeof(struct brcms_c_rateset));
5379
5380	/* check for bad count value */
5381	if ((rs.count == 0) || (rs.count > BRCMS_NUMRATES))
5382		return -EINVAL;
5383
5384	/* try the current band */
5385	bandunit = wlc->band->bandunit;
5386	memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5387	if (brcms_c_rate_hwrs_filter_sort_validate
5388	    (&new, &wlc->bandstate[bandunit]->hw_rateset, true,
5389	     wlc->stf->txstreams))
5390		goto good;
5391
5392	/* try the other band */
5393	if (brcms_is_mband_unlocked(wlc)) {
5394		bandunit = OTHERBANDUNIT(wlc);
5395		memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5396		if (brcms_c_rate_hwrs_filter_sort_validate(&new,
5397						       &wlc->
5398						       bandstate[bandunit]->
5399						       hw_rateset, true,
5400						       wlc->stf->txstreams))
5401			goto good;
5402	}
5403
5404	return -EBADE;
5405
5406 good:
5407	/* apply new rateset */
5408	memcpy(&wlc->default_bss->rateset, &new,
5409	       sizeof(struct brcms_c_rateset));
5410	memcpy(&wlc->bandstate[bandunit]->defrateset, &new,
5411	       sizeof(struct brcms_c_rateset));
5412	return 0;
5413}
5414
5415static void brcms_c_ofdm_rateset_war(struct brcms_c_info *wlc)
5416{
5417	u8 r;
5418	bool war = false;
5419
5420	if (wlc->pub->associated)
5421		r = wlc->bsscfg->current_bss->rateset.rates[0];
5422	else
5423		r = wlc->default_bss->rateset.rates[0];
5424
5425	wlc_phy_ofdm_rateset_war(wlc->band->pi, war);
5426}
5427
5428int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel)
5429{
5430	u16 chspec = ch20mhz_chspec(channel);
5431
5432	if (channel < 0 || channel > MAXCHANNEL)
5433		return -EINVAL;
5434
5435	if (!brcms_c_valid_chanspec_db(wlc->cmi, chspec))
5436		return -EINVAL;
5437
5438
5439	if (!wlc->pub->up && brcms_is_mband_unlocked(wlc)) {
5440		if (wlc->band->bandunit != chspec_bandunit(chspec))
5441			wlc->bandinit_pending = true;
5442		else
5443			wlc->bandinit_pending = false;
5444	}
5445
5446	wlc->default_bss->chanspec = chspec;
5447	/* brcms_c_BSSinit() will sanitize the rateset before
5448	 * using it.. */
5449	if (wlc->pub->up && (wlc_phy_chanspec_get(wlc->band->pi) != chspec)) {
5450		brcms_c_set_home_chanspec(wlc, chspec);
5451		brcms_c_suspend_mac_and_wait(wlc);
5452		brcms_c_set_chanspec(wlc, chspec);
5453		brcms_c_enable_mac(wlc);
5454	}
5455	return 0;
5456}
5457
5458int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl)
5459{
5460	int ac;
5461
5462	if (srl < 1 || srl > RETRY_SHORT_MAX ||
5463	    lrl < 1 || lrl > RETRY_SHORT_MAX)
5464		return -EINVAL;
5465
5466	wlc->SRL = srl;
5467	wlc->LRL = lrl;
5468
5469	brcms_b_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
5470
5471	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
5472		wlc->wme_retries[ac] =	SFIELD(wlc->wme_retries[ac],
5473					       EDCF_SHORT,  wlc->SRL);
5474		wlc->wme_retries[ac] =	SFIELD(wlc->wme_retries[ac],
5475					       EDCF_LONG, wlc->LRL);
5476	}
5477	brcms_c_wme_retries_write(wlc);
5478
5479	return 0;
5480}
5481
5482void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
5483				 struct brcm_rateset *currs)
5484{
5485	struct brcms_c_rateset *rs;
5486
5487	if (wlc->pub->associated)
5488		rs = &wlc->bsscfg->current_bss->rateset;
5489	else
5490		rs = &wlc->default_bss->rateset;
5491
5492	/* Copy only legacy rateset section */
5493	currs->count = rs->count;
5494	memcpy(&currs->rates, &rs->rates, rs->count);
5495}
5496
5497int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
5498{
5499	struct brcms_c_rateset internal_rs;
5500	int bcmerror;
5501
5502	if (rs->count > BRCMS_NUMRATES)
5503		return -ENOBUFS;
5504
5505	memset(&internal_rs, 0, sizeof(internal_rs));
5506
5507	/* Copy only legacy rateset section */
5508	internal_rs.count = rs->count;
5509	memcpy(&internal_rs.rates, &rs->rates, internal_rs.count);
5510
5511	/* merge rateset coming in with the current mcsset */
5512	if (wlc->pub->_n_enab & SUPPORT_11N) {
5513		struct brcms_bss_info *mcsset_bss;
5514		if (wlc->pub->associated)
5515			mcsset_bss = wlc->bsscfg->current_bss;
5516		else
5517			mcsset_bss = wlc->default_bss;
5518		memcpy(internal_rs.mcs, &mcsset_bss->rateset.mcs[0],
5519		       MCSSET_LEN);
5520	}
5521
5522	bcmerror = brcms_c_set_internal_rateset(wlc, &internal_rs);
5523	if (!bcmerror)
5524		brcms_c_ofdm_rateset_war(wlc);
5525
5526	return bcmerror;
5527}
5528
5529static void brcms_c_time_lock(struct brcms_c_info *wlc)
5530{
5531	bcma_set32(wlc->hw->d11core, D11REGOFFS(maccontrol), MCTL_TBTTHOLD);
5532	/* Commit the write */
5533	bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
5534}
5535
5536static void brcms_c_time_unlock(struct brcms_c_info *wlc)
5537{
5538	bcma_mask32(wlc->hw->d11core, D11REGOFFS(maccontrol), ~MCTL_TBTTHOLD);
5539	/* Commit the write */
5540	bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
5541}
5542
5543int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
5544{
5545	u32 bcnint_us;
5546
5547	if (period == 0)
5548		return -EINVAL;
5549
5550	wlc->default_bss->beacon_period = period;
5551
5552	bcnint_us = period << 10;
5553	brcms_c_time_lock(wlc);
5554	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfprep),
5555		     (bcnint_us << CFPREP_CBI_SHIFT));
5556	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfpstart), bcnint_us);
5557	brcms_c_time_unlock(wlc);
5558
5559	return 0;
5560}
5561
5562u16 brcms_c_get_phy_type(struct brcms_c_info *wlc, int phyidx)
5563{
5564	return wlc->band->phytype;
5565}
5566
5567void brcms_c_set_shortslot_override(struct brcms_c_info *wlc, s8 sslot_override)
5568{
5569	wlc->shortslot_override = sslot_override;
5570
5571	/*
5572	 * shortslot is an 11g feature, so no more work if we are
5573	 * currently on the 5G band
5574	 */
5575	if (wlc->band->bandtype == BRCM_BAND_5G)
5576		return;
5577
5578	if (wlc->pub->up && wlc->pub->associated) {
5579		/* let watchdog or beacon processing update shortslot */
5580	} else if (wlc->pub->up) {
5581		/* unassociated shortslot is off */
5582		brcms_c_switch_shortslot(wlc, false);
5583	} else {
5584		/* driver is down, so just update the brcms_c_info
5585		 * value */
5586		if (wlc->shortslot_override == BRCMS_SHORTSLOT_AUTO)
5587			wlc->shortslot = false;
5588		else
5589			wlc->shortslot =
5590			    (wlc->shortslot_override ==
5591			     BRCMS_SHORTSLOT_ON);
5592	}
5593}
5594
5595/*
5596 * register watchdog and down handlers.
5597 */
5598int brcms_c_module_register(struct brcms_pub *pub,
5599			    const char *name, struct brcms_info *hdl,
5600			    int (*d_fn)(void *handle))
5601{
5602	struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5603	int i;
5604
5605	/* find an empty entry and just add, no duplication check! */
5606	for (i = 0; i < BRCMS_MAXMODULES; i++) {
5607		if (wlc->modulecb[i].name[0] == '\0') {
5608			strncpy(wlc->modulecb[i].name, name,
5609				sizeof(wlc->modulecb[i].name) - 1);
5610			wlc->modulecb[i].hdl = hdl;
5611			wlc->modulecb[i].down_fn = d_fn;
5612			return 0;
5613		}
5614	}
5615
5616	return -ENOSR;
5617}
5618
5619/* unregister module callbacks */
5620int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
5621			      struct brcms_info *hdl)
5622{
5623	struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5624	int i;
5625
5626	if (wlc == NULL)
5627		return -ENODATA;
5628
5629	for (i = 0; i < BRCMS_MAXMODULES; i++) {
5630		if (!strcmp(wlc->modulecb[i].name, name) &&
5631		    (wlc->modulecb[i].hdl == hdl)) {
5632			memset(&wlc->modulecb[i], 0, sizeof(wlc->modulecb[i]));
5633			return 0;
5634		}
5635	}
5636
5637	/* table not found! */
5638	return -ENODATA;
5639}
5640
5641static bool brcms_c_chipmatch_pci(struct bcma_device *core)
5642{
5643	struct pci_dev *pcidev = core->bus->host_pci;
5644	u16 vendor = pcidev->vendor;
5645	u16 device = pcidev->device;
5646
5647	if (vendor != PCI_VENDOR_ID_BROADCOM) {
5648		pr_err("unknown vendor id %04x\n", vendor);
5649		return false;
5650	}
5651
5652	if (device == BCM43224_D11N_ID_VEN1 || device == BCM43224_CHIP_ID)
5653		return true;
5654	if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
5655		return true;
5656	if (device == BCM4313_D11N2G_ID || device == BCM4313_CHIP_ID)
5657		return true;
5658	if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
5659		return true;
5660
5661	pr_err("unknown device id %04x\n", device);
5662	return false;
5663}
5664
5665static bool brcms_c_chipmatch_soc(struct bcma_device *core)
5666{
5667	struct bcma_chipinfo *chipinfo = &core->bus->chipinfo;
5668
5669	if (chipinfo->id == BCMA_CHIP_ID_BCM4716)
5670		return true;
5671
5672	pr_err("unknown chip id %04x\n", chipinfo->id);
5673	return false;
5674}
5675
5676bool brcms_c_chipmatch(struct bcma_device *core)
5677{
5678	switch (core->bus->hosttype) {
5679	case BCMA_HOSTTYPE_PCI:
5680		return brcms_c_chipmatch_pci(core);
5681	case BCMA_HOSTTYPE_SOC:
5682		return brcms_c_chipmatch_soc(core);
5683	default:
5684		pr_err("unknown host type: %i\n", core->bus->hosttype);
5685		return false;
5686	}
5687}
5688
5689u16 brcms_b_rate_shm_offset(struct brcms_hardware *wlc_hw, u8 rate)
5690{
5691	u16 table_ptr;
5692	u8 phy_rate, index;
5693
5694	/* get the phy specific rate encoding for the PLCP SIGNAL field */
5695	if (is_ofdm_rate(rate))
5696		table_ptr = M_RT_DIRMAP_A;
5697	else
5698		table_ptr = M_RT_DIRMAP_B;
5699
5700	/* for a given rate, the LS-nibble of the PLCP SIGNAL field is
5701	 * the index into the rate table.
5702	 */
5703	phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
5704	index = phy_rate & 0xf;
5705
5706	/* Find the SHM pointer to the rate table entry by looking in the
5707	 * Direct-map Table
5708	 */
5709	return 2 * brcms_b_read_shm(wlc_hw, table_ptr + (index * 2));
5710}
5711
5712/*
5713 * bcmc_fid_generate:
5714 * Generate frame ID for a BCMC packet.  The frag field is not used
5715 * for MC frames so is used as part of the sequence number.
5716 */
5717static inline u16
5718bcmc_fid_generate(struct brcms_c_info *wlc, struct brcms_bss_cfg *bsscfg,
5719		  struct d11txh *txh)
5720{
5721	u16 frameid;
5722
5723	frameid = le16_to_cpu(txh->TxFrameID) & ~(TXFID_SEQ_MASK |
5724						  TXFID_QUEUE_MASK);
5725	frameid |=
5726	    (((wlc->
5727	       mc_fid_counter++) << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
5728	    TX_BCMC_FIFO;
5729
5730	return frameid;
5731}
5732
5733static uint
5734brcms_c_calc_ack_time(struct brcms_c_info *wlc, u32 rspec,
5735		      u8 preamble_type)
5736{
5737	uint dur = 0;
5738
5739	/*
5740	 * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5741	 * is less than or equal to the rate of the immediately previous
5742	 * frame in the FES
5743	 */
5744	rspec = brcms_basic_rate(wlc, rspec);
5745	/* ACK frame len == 14 == 2(fc) + 2(dur) + 6(ra) + 4(fcs) */
5746	dur =
5747	    brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5748				(DOT11_ACK_LEN + FCS_LEN));
5749	return dur;
5750}
5751
5752static uint
5753brcms_c_calc_cts_time(struct brcms_c_info *wlc, u32 rspec,
5754		      u8 preamble_type)
5755{
5756	return brcms_c_calc_ack_time(wlc, rspec, preamble_type);
5757}
5758
5759static uint
5760brcms_c_calc_ba_time(struct brcms_c_info *wlc, u32 rspec,
5761		     u8 preamble_type)
5762{
5763	/*
5764	 * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5765	 * is less than or equal to the rate of the immediately previous
5766	 * frame in the FES
5767	 */
5768	rspec = brcms_basic_rate(wlc, rspec);
5769	/* BA len == 32 == 16(ctl hdr) + 4(ba len) + 8(bitmap) + 4(fcs) */
5770	return brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5771				   (DOT11_BA_LEN + DOT11_BA_BITMAP_LEN +
5772				    FCS_LEN));
5773}
5774
5775/* brcms_c_compute_frame_dur()
5776 *
5777 * Calculate the 802.11 MAC header DUR field for MPDU
5778 * DUR for a single frame = 1 SIFS + 1 ACK
5779 * DUR for a frame with following frags = 3 SIFS + 2 ACK + next frag time
5780 *
5781 * rate			MPDU rate in unit of 500kbps
5782 * next_frag_len	next MPDU length in bytes
5783 * preamble_type	use short/GF or long/MM PLCP header
5784 */
5785static u16
5786brcms_c_compute_frame_dur(struct brcms_c_info *wlc, u32 rate,
5787		      u8 preamble_type, uint next_frag_len)
5788{
5789	u16 dur, sifs;
5790
5791	sifs = get_sifs(wlc->band);
5792
5793	dur = sifs;
5794	dur += (u16) brcms_c_calc_ack_time(wlc, rate, preamble_type);
5795
5796	if (next_frag_len) {
5797		/* Double the current DUR to get 2 SIFS + 2 ACKs */
5798		dur *= 2;
5799		/* add another SIFS and the frag time */
5800		dur += sifs;
5801		dur +=
5802		    (u16) brcms_c_calc_frame_time(wlc, rate, preamble_type,
5803						 next_frag_len);
5804	}
5805	return dur;
5806}
5807
5808/* The opposite of brcms_c_calc_frame_time */
5809static uint
5810brcms_c_calc_frame_len(struct brcms_c_info *wlc, u32 ratespec,
5811		   u8 preamble_type, uint dur)
5812{
5813	uint nsyms, mac_len, Ndps, kNdps;
5814	uint rate = rspec2rate(ratespec);
5815
5816	if (is_mcs_rate(ratespec)) {
5817		uint mcs = ratespec & RSPEC_RATE_MASK;
5818		int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
5819		dur -= PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
5820		/* payload calculation matches that of regular ofdm */
5821		if (wlc->band->bandtype == BRCM_BAND_2G)
5822			dur -= DOT11_OFDM_SIGNAL_EXTENSION;
5823		/* kNdbps = kbps * 4 */
5824		kNdps =	mcs_2_rate(mcs, rspec_is40mhz(ratespec),
5825				   rspec_issgi(ratespec)) * 4;
5826		nsyms = dur / APHY_SYMBOL_TIME;
5827		mac_len =
5828		    ((nsyms * kNdps) -
5829		     ((APHY_SERVICE_NBITS + APHY_TAIL_NBITS) * 1000)) / 8000;
5830	} else if (is_ofdm_rate(ratespec)) {
5831		dur -= APHY_PREAMBLE_TIME;
5832		dur -= APHY_SIGNAL_TIME;
5833		/* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
5834		Ndps = rate * 2;
5835		nsyms = dur / APHY_SYMBOL_TIME;
5836		mac_len =
5837		    ((nsyms * Ndps) -
5838		     (APHY_SERVICE_NBITS + APHY_TAIL_NBITS)) / 8;
5839	} else {
5840		if (preamble_type & BRCMS_SHORT_PREAMBLE)
5841			dur -= BPHY_PLCP_SHORT_TIME;
5842		else
5843			dur -= BPHY_PLCP_TIME;
5844		mac_len = dur * rate;
5845		/* divide out factor of 2 in rate (1/2 mbps) */
5846		mac_len = mac_len / 8 / 2;
5847	}
5848	return mac_len;
5849}
5850
5851/*
5852 * Return true if the specified rate is supported by the specified band.
5853 * BRCM_BAND_AUTO indicates the current band.
5854 */
5855static bool brcms_c_valid_rate(struct brcms_c_info *wlc, u32 rspec, int band,
5856		    bool verbose)
5857{
5858	struct brcms_c_rateset *hw_rateset;
5859	uint i;
5860
5861	if ((band == BRCM_BAND_AUTO) || (band == wlc->band->bandtype))
5862		hw_rateset = &wlc->band->hw_rateset;
5863	else if (wlc->pub->_nbands > 1)
5864		hw_rateset = &wlc->bandstate[OTHERBANDUNIT(wlc)]->hw_rateset;
5865	else
5866		/* other band specified and we are a single band device */
5867		return false;
5868
5869	/* check if this is a mimo rate */
5870	if (is_mcs_rate(rspec)) {
5871		if ((rspec & RSPEC_RATE_MASK) >= MCS_TABLE_SIZE)
5872			goto error;
5873
5874		return isset(hw_rateset->mcs, (rspec & RSPEC_RATE_MASK));
5875	}
5876
5877	for (i = 0; i < hw_rateset->count; i++)
5878		if (hw_rateset->rates[i] == rspec2rate(rspec))
5879			return true;
5880 error:
5881	if (verbose)
5882		brcms_err(wlc->hw->d11core, "wl%d: valid_rate: rate spec 0x%x "
5883			  "not in hw_rateset\n", wlc->pub->unit, rspec);
5884
5885	return false;
5886}
5887
5888static u32
5889mac80211_wlc_set_nrate(struct brcms_c_info *wlc, struct brcms_band *cur_band,
5890		       u32 int_val)
5891{
5892	struct bcma_device *core = wlc->hw->d11core;
5893	u8 stf = (int_val & NRATE_STF_MASK) >> NRATE_STF_SHIFT;
5894	u8 rate = int_val & NRATE_RATE_MASK;
5895	u32 rspec;
5896	bool ismcs = ((int_val & NRATE_MCS_INUSE) == NRATE_MCS_INUSE);
5897	bool issgi = ((int_val & NRATE_SGI_MASK) >> NRATE_SGI_SHIFT);
5898	bool override_mcs_only = ((int_val & NRATE_OVERRIDE_MCS_ONLY)
5899				  == NRATE_OVERRIDE_MCS_ONLY);
5900	int bcmerror = 0;
5901
5902	if (!ismcs)
5903		return (u32) rate;
5904
5905	/* validate the combination of rate/mcs/stf is allowed */
5906	if ((wlc->pub->_n_enab & SUPPORT_11N) && ismcs) {
5907		/* mcs only allowed when nmode */
5908		if (stf > PHY_TXC1_MODE_SDM) {
5909			brcms_err(core, "wl%d: %s: Invalid stf\n",
5910				  wlc->pub->unit, __func__);
5911			bcmerror = -EINVAL;
5912			goto done;
5913		}
5914
5915		/* mcs 32 is a special case, DUP mode 40 only */
5916		if (rate == 32) {
5917			if (!CHSPEC_IS40(wlc->home_chanspec) ||
5918			    ((stf != PHY_TXC1_MODE_SISO)
5919			     && (stf != PHY_TXC1_MODE_CDD))) {
5920				brcms_err(core, "wl%d: %s: Invalid mcs 32\n",
5921					  wlc->pub->unit, __func__);
5922				bcmerror = -EINVAL;
5923				goto done;
5924			}
5925			/* mcs > 7 must use stf SDM */
5926		} else if (rate > HIGHEST_SINGLE_STREAM_MCS) {
5927			/* mcs > 7 must use stf SDM */
5928			if (stf != PHY_TXC1_MODE_SDM) {
5929				brcms_dbg_mac80211(core, "wl%d: enabling "
5930						   "SDM mode for mcs %d\n",
5931						   wlc->pub->unit, rate);
5932				stf = PHY_TXC1_MODE_SDM;
5933			}
5934		} else {
5935			/*
5936			 * MCS 0-7 may use SISO, CDD, and for
5937			 * phy_rev >= 3 STBC
5938			 */
5939			if ((stf > PHY_TXC1_MODE_STBC) ||
5940			    (!BRCMS_STBC_CAP_PHY(wlc)
5941			     && (stf == PHY_TXC1_MODE_STBC))) {
5942				brcms_err(core, "wl%d: %s: Invalid STBC\n",
5943					  wlc->pub->unit, __func__);
5944				bcmerror = -EINVAL;
5945				goto done;
5946			}
5947		}
5948	} else if (is_ofdm_rate(rate)) {
5949		if ((stf != PHY_TXC1_MODE_CDD) && (stf != PHY_TXC1_MODE_SISO)) {
5950			brcms_err(core, "wl%d: %s: Invalid OFDM\n",
5951				  wlc->pub->unit, __func__);
5952			bcmerror = -EINVAL;
5953			goto done;
5954		}
5955	} else if (is_cck_rate(rate)) {
5956		if ((cur_band->bandtype != BRCM_BAND_2G)
5957		    || (stf != PHY_TXC1_MODE_SISO)) {
5958			brcms_err(core, "wl%d: %s: Invalid CCK\n",
5959				  wlc->pub->unit, __func__);
5960			bcmerror = -EINVAL;
5961			goto done;
5962		}
5963	} else {
5964		brcms_err(core, "wl%d: %s: Unknown rate type\n",
5965			  wlc->pub->unit, __func__);
5966		bcmerror = -EINVAL;
5967		goto done;
5968	}
5969	/* make sure multiple antennae are available for non-siso rates */
5970	if ((stf != PHY_TXC1_MODE_SISO) && (wlc->stf->txstreams == 1)) {
5971		brcms_err(core, "wl%d: %s: SISO antenna but !SISO "
5972			  "request\n", wlc->pub->unit, __func__);
5973		bcmerror = -EINVAL;
5974		goto done;
5975	}
5976
5977	rspec = rate;
5978	if (ismcs) {
5979		rspec |= RSPEC_MIMORATE;
5980		/* For STBC populate the STC field of the ratespec */
5981		if (stf == PHY_TXC1_MODE_STBC) {
5982			u8 stc;
5983			stc = 1;	/* Nss for single stream is always 1 */
5984			rspec |= (stc << RSPEC_STC_SHIFT);
5985		}
5986	}
5987
5988	rspec |= (stf << RSPEC_STF_SHIFT);
5989
5990	if (override_mcs_only)
5991		rspec |= RSPEC_OVERRIDE_MCS_ONLY;
5992
5993	if (issgi)
5994		rspec |= RSPEC_SHORT_GI;
5995
5996	if ((rate != 0)
5997	    && !brcms_c_valid_rate(wlc, rspec, cur_band->bandtype, true))
5998		return rate;
5999
6000	return rspec;
6001done:
6002	return rate;
6003}
6004
6005/*
6006 * Compute PLCP, but only requires actual rate and length of pkt.
6007 * Rate is given in the driver standard multiple of 500 kbps.
6008 * le is set for 11 Mbps rate if necessary.
6009 * Broken out for PRQ.
6010 */
6011
6012static void brcms_c_cck_plcp_set(struct brcms_c_info *wlc, int rate_500,
6013			     uint length, u8 *plcp)
6014{
6015	u16 usec = 0;
6016	u8 le = 0;
6017
6018	switch (rate_500) {
6019	case BRCM_RATE_1M:
6020		usec = length << 3;
6021		break;
6022	case BRCM_RATE_2M:
6023		usec = length << 2;
6024		break;
6025	case BRCM_RATE_5M5:
6026		usec = (length << 4) / 11;
6027		if ((length << 4) - (usec * 11) > 0)
6028			usec++;
6029		break;
6030	case BRCM_RATE_11M:
6031		usec = (length << 3) / 11;
6032		if ((length << 3) - (usec * 11) > 0) {
6033			usec++;
6034			if ((usec * 11) - (length << 3) >= 8)
6035				le = D11B_PLCP_SIGNAL_LE;
6036		}
6037		break;
6038
6039	default:
6040		brcms_err(wlc->hw->d11core,
6041			  "brcms_c_cck_plcp_set: unsupported rate %d\n",
6042			  rate_500);
6043		rate_500 = BRCM_RATE_1M;
6044		usec = length << 3;
6045		break;
6046	}
6047	/* PLCP signal byte */
6048	plcp[0] = rate_500 * 5;	/* r (500kbps) * 5 == r (100kbps) */
6049	/* PLCP service byte */
6050	plcp[1] = (u8) (le | D11B_PLCP_SIGNAL_LOCKED);
6051	/* PLCP length u16, little endian */
6052	plcp[2] = usec & 0xff;
6053	plcp[3] = (usec >> 8) & 0xff;
6054	/* PLCP CRC16 */
6055	plcp[4] = 0;
6056	plcp[5] = 0;
6057}
6058
6059/* Rate: 802.11 rate code, length: PSDU length in octets */
6060static void brcms_c_compute_mimo_plcp(u32 rspec, uint length, u8 *plcp)
6061{
6062	u8 mcs = (u8) (rspec & RSPEC_RATE_MASK);
6063	plcp[0] = mcs;
6064	if (rspec_is40mhz(rspec) || (mcs == 32))
6065		plcp[0] |= MIMO_PLCP_40MHZ;
6066	BRCMS_SET_MIMO_PLCP_LEN(plcp, length);
6067	plcp[3] = rspec_mimoplcp3(rspec); /* rspec already holds this byte */
6068	plcp[3] |= 0x7; /* set smoothing, not sounding ppdu & reserved */
6069	plcp[4] = 0; /* number of extension spatial streams bit 0 & 1 */
6070	plcp[5] = 0;
6071}
6072
6073/* Rate: 802.11 rate code, length: PSDU length in octets */
6074static void
6075brcms_c_compute_ofdm_plcp(u32 rspec, u32 length, u8 *plcp)
6076{
6077	u8 rate_signal;
6078	u32 tmp = 0;
6079	int rate = rspec2rate(rspec);
6080
6081	/*
6082	 * encode rate per 802.11a-1999 sec 17.3.4.1, with lsb
6083	 * transmitted first
6084	 */
6085	rate_signal = rate_info[rate] & BRCMS_RATE_MASK;
6086	memset(plcp, 0, D11_PHY_HDR_LEN);
6087	D11A_PHY_HDR_SRATE((struct ofdm_phy_hdr *) plcp, rate_signal);
6088
6089	tmp = (length & 0xfff) << 5;
6090	plcp[2] |= (tmp >> 16) & 0xff;
6091	plcp[1] |= (tmp >> 8) & 0xff;
6092	plcp[0] |= tmp & 0xff;
6093}
6094
6095/* Rate: 802.11 rate code, length: PSDU length in octets */
6096static void brcms_c_compute_cck_plcp(struct brcms_c_info *wlc, u32 rspec,
6097				 uint length, u8 *plcp)
6098{
6099	int rate = rspec2rate(rspec);
6100
6101	brcms_c_cck_plcp_set(wlc, rate, length, plcp);
6102}
6103
6104static void
6105brcms_c_compute_plcp(struct brcms_c_info *wlc, u32 rspec,
6106		     uint length, u8 *plcp)
6107{
6108	if (is_mcs_rate(rspec))
6109		brcms_c_compute_mimo_plcp(rspec, length, plcp);
6110	else if (is_ofdm_rate(rspec))
6111		brcms_c_compute_ofdm_plcp(rspec, length, plcp);
6112	else
6113		brcms_c_compute_cck_plcp(wlc, rspec, length, plcp);
6114}
6115
6116/* brcms_c_compute_rtscts_dur()
6117 *
6118 * Calculate the 802.11 MAC header DUR field for an RTS or CTS frame
6119 * DUR for normal RTS/CTS w/ frame = 3 SIFS + 1 CTS + next frame time + 1 ACK
6120 * DUR for CTS-TO-SELF w/ frame    = 2 SIFS         + next frame time + 1 ACK
6121 *
6122 * cts			cts-to-self or rts/cts
6123 * rts_rate		rts or cts rate in unit of 500kbps
6124 * rate			next MPDU rate in unit of 500kbps
6125 * frame_len		next MPDU frame length in bytes
6126 */
6127u16
6128brcms_c_compute_rtscts_dur(struct brcms_c_info *wlc, bool cts_only,
6129			   u32 rts_rate,
6130			   u32 frame_rate, u8 rts_preamble_type,
6131			   u8 frame_preamble_type, uint frame_len, bool ba)
6132{
6133	u16 dur, sifs;
6134
6135	sifs = get_sifs(wlc->band);
6136
6137	if (!cts_only) {
6138		/* RTS/CTS */
6139		dur = 3 * sifs;
6140		dur +=
6141		    (u16) brcms_c_calc_cts_time(wlc, rts_rate,
6142					       rts_preamble_type);
6143	} else {
6144		/* CTS-TO-SELF */
6145		dur = 2 * sifs;
6146	}
6147
6148	dur +=
6149	    (u16) brcms_c_calc_frame_time(wlc, frame_rate, frame_preamble_type,
6150					 frame_len);
6151	if (ba)
6152		dur +=
6153		    (u16) brcms_c_calc_ba_time(wlc, frame_rate,
6154					      BRCMS_SHORT_PREAMBLE);
6155	else
6156		dur +=
6157		    (u16) brcms_c_calc_ack_time(wlc, frame_rate,
6158					       frame_preamble_type);
6159	return dur;
6160}
6161
6162static u16 brcms_c_phytxctl1_calc(struct brcms_c_info *wlc, u32 rspec)
6163{
6164	u16 phyctl1 = 0;
6165	u16 bw;
6166
6167	if (BRCMS_ISLCNPHY(wlc->band)) {
6168		bw = PHY_TXC1_BW_20MHZ;
6169	} else {
6170		bw = rspec_get_bw(rspec);
6171		/* 10Mhz is not supported yet */
6172		if (bw < PHY_TXC1_BW_20MHZ) {
6173			brcms_err(wlc->hw->d11core, "phytxctl1_calc: bw %d is "
6174				  "not supported yet, set to 20L\n", bw);
6175			bw = PHY_TXC1_BW_20MHZ;
6176		}
6177	}
6178
6179	if (is_mcs_rate(rspec)) {
6180		uint mcs = rspec & RSPEC_RATE_MASK;
6181
6182		/* bw, stf, coding-type is part of rspec_phytxbyte2 returns */
6183		phyctl1 = rspec_phytxbyte2(rspec);
6184		/* set the upper byte of phyctl1 */
6185		phyctl1 |= (mcs_table[mcs].tx_phy_ctl3 << 8);
6186	} else if (is_cck_rate(rspec) && !BRCMS_ISLCNPHY(wlc->band)
6187		   && !BRCMS_ISSSLPNPHY(wlc->band)) {
6188		/*
6189		 * In CCK mode LPPHY overloads OFDM Modulation bits with CCK
6190		 * Data Rate. Eventually MIMOPHY would also be converted to
6191		 * this format
6192		 */
6193		/* 0 = 1Mbps; 1 = 2Mbps; 2 = 5.5Mbps; 3 = 11Mbps */
6194		phyctl1 = (bw | (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6195	} else {		/* legacy OFDM/CCK */
6196		s16 phycfg;
6197		/* get the phyctl byte from rate phycfg table */
6198		phycfg = brcms_c_rate_legacy_phyctl(rspec2rate(rspec));
6199		if (phycfg == -1) {
6200			brcms_err(wlc->hw->d11core, "phytxctl1_calc: wrong "
6201				  "legacy OFDM/CCK rate\n");
6202			phycfg = 0;
6203		}
6204		/* set the upper byte of phyctl1 */
6205		phyctl1 =
6206		    (bw | (phycfg << 8) |
6207		     (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6208	}
6209	return phyctl1;
6210}
6211
6212/*
6213 * Add struct d11txh, struct cck_phy_hdr.
6214 *
6215 * 'p' data must start with 802.11 MAC header
6216 * 'p' must allow enough bytes of local headers to be "pushed" onto the packet
6217 *
6218 * headroom == D11_PHY_HDR_LEN + D11_TXH_LEN (D11_TXH_LEN is now 104 bytes)
6219 *
6220 */
6221static u16
6222brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
6223		     struct sk_buff *p, struct scb *scb, uint frag,
6224		     uint nfrags, uint queue, uint next_frag_len)
6225{
6226	struct ieee80211_hdr *h;
6227	struct d11txh *txh;
6228	u8 *plcp, plcp_fallback[D11_PHY_HDR_LEN];
6229	int len, phylen, rts_phylen;
6230	u16 mch, phyctl, xfts, mainrates;
6231	u16 seq = 0, mcl = 0, status = 0, frameid = 0;
6232	u32 rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6233	u32 rts_rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6234	bool use_rts = false;
6235	bool use_cts = false;
6236	bool use_rifs = false;
6237	bool short_preamble[2] = { false, false };
6238	u8 preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6239	u8 rts_preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6240	u8 *rts_plcp, rts_plcp_fallback[D11_PHY_HDR_LEN];
6241	struct ieee80211_rts *rts = NULL;
6242	bool qos;
6243	uint ac;
6244	bool hwtkmic = false;
6245	u16 mimo_ctlchbw = PHY_TXC1_BW_20MHZ;
6246#define ANTCFG_NONE 0xFF
6247	u8 antcfg = ANTCFG_NONE;
6248	u8 fbantcfg = ANTCFG_NONE;
6249	uint phyctl1_stf = 0;
6250	u16 durid = 0;
6251	struct ieee80211_tx_rate *txrate[2];
6252	int k;
6253	struct ieee80211_tx_info *tx_info;
6254	bool is_mcs;
6255	u16 mimo_txbw;
6256	u8 mimo_preamble_type;
6257
6258	/* locate 802.11 MAC header */
6259	h = (struct ieee80211_hdr *)(p->data);
6260	qos = ieee80211_is_data_qos(h->frame_control);
6261
6262	/* compute length of frame in bytes for use in PLCP computations */
6263	len = p->len;
6264	phylen = len + FCS_LEN;
6265
6266	/* Get tx_info */
6267	tx_info = IEEE80211_SKB_CB(p);
6268
6269	/* add PLCP */
6270	plcp = skb_push(p, D11_PHY_HDR_LEN);
6271
6272	/* add Broadcom tx descriptor header */
6273	txh = (struct d11txh *) skb_push(p, D11_TXH_LEN);
6274	memset(txh, 0, D11_TXH_LEN);
6275
6276	/* setup frameid */
6277	if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
6278		/* non-AP STA should never use BCMC queue */
6279		if (queue == TX_BCMC_FIFO) {
6280			brcms_err(wlc->hw->d11core,
6281				  "wl%d: %s: ASSERT queue == TX_BCMC!\n",
6282				  wlc->pub->unit, __func__);
6283			frameid = bcmc_fid_generate(wlc, NULL, txh);
6284		} else {
6285			/* Increment the counter for first fragment */
6286			if (tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
6287				scb->seqnum[p->priority]++;
6288
6289			/* extract fragment number from frame first */
6290			seq = le16_to_cpu(h->seq_ctrl) & FRAGNUM_MASK;
6291			seq |= (scb->seqnum[p->priority] << SEQNUM_SHIFT);
6292			h->seq_ctrl = cpu_to_le16(seq);
6293
6294			frameid = ((seq << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
6295			    (queue & TXFID_QUEUE_MASK);
6296		}
6297	}
6298	frameid |= queue & TXFID_QUEUE_MASK;
6299
6300	/* set the ignpmq bit for all pkts tx'd in PS mode and for beacons */
6301	if (ieee80211_is_beacon(h->frame_control))
6302		mcl |= TXC_IGNOREPMQ;
6303
6304	txrate[0] = tx_info->control.rates;
6305	txrate[1] = txrate[0] + 1;
6306
6307	/*
6308	 * if rate control algorithm didn't give us a fallback
6309	 * rate, use the primary rate
6310	 */
6311	if (txrate[1]->idx < 0)
6312		txrate[1] = txrate[0];
6313
6314	for (k = 0; k < hw->max_rates; k++) {
6315		is_mcs = txrate[k]->flags & IEEE80211_TX_RC_MCS ? true : false;
6316		if (!is_mcs) {
6317			if ((txrate[k]->idx >= 0)
6318			    && (txrate[k]->idx <
6319				hw->wiphy->bands[tx_info->band]->n_bitrates)) {
6320				rspec[k] =
6321				    hw->wiphy->bands[tx_info->band]->
6322				    bitrates[txrate[k]->idx].hw_value;
6323				short_preamble[k] =
6324				    txrate[k]->
6325				    flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ?
6326				    true : false;
6327			} else {
6328				rspec[k] = BRCM_RATE_1M;
6329			}
6330		} else {
6331			rspec[k] = mac80211_wlc_set_nrate(wlc, wlc->band,
6332					NRATE_MCS_INUSE | txrate[k]->idx);
6333		}
6334
6335		/*
6336		 * Currently only support same setting for primay and
6337		 * fallback rates. Unify flags for each rate into a
6338		 * single value for the frame
6339		 */
6340		use_rts |=
6341		    txrate[k]->
6342		    flags & IEEE80211_TX_RC_USE_RTS_CTS ? true : false;
6343		use_cts |=
6344		    txrate[k]->
6345		    flags & IEEE80211_TX_RC_USE_CTS_PROTECT ? true : false;
6346
6347
6348		/*
6349		 * (1) RATE:
6350		 *   determine and validate primary rate
6351		 *   and fallback rates
6352		 */
6353		if (!rspec_active(rspec[k])) {
6354			rspec[k] = BRCM_RATE_1M;
6355		} else {
6356			if (!is_multicast_ether_addr(h->addr1)) {
6357				/* set tx antenna config */
6358				brcms_c_antsel_antcfg_get(wlc->asi, false,
6359					false, 0, 0, &antcfg, &fbantcfg);
6360			}
6361		}
6362	}
6363
6364	phyctl1_stf = wlc->stf->ss_opmode;
6365
6366	if (wlc->pub->_n_enab & SUPPORT_11N) {
6367		for (k = 0; k < hw->max_rates; k++) {
6368			/*
6369			 * apply siso/cdd to single stream mcs's or ofdm
6370			 * if rspec is auto selected
6371			 */
6372			if (((is_mcs_rate(rspec[k]) &&
6373			      is_single_stream(rspec[k] & RSPEC_RATE_MASK)) ||
6374			     is_ofdm_rate(rspec[k]))
6375			    && ((rspec[k] & RSPEC_OVERRIDE_MCS_ONLY)
6376				|| !(rspec[k] & RSPEC_OVERRIDE))) {
6377				rspec[k] &= ~(RSPEC_STF_MASK | RSPEC_STC_MASK);
6378
6379				/* For SISO MCS use STBC if possible */
6380				if (is_mcs_rate(rspec[k])
6381				    && BRCMS_STF_SS_STBC_TX(wlc, scb)) {
6382					u8 stc;
6383
6384					/* Nss for single stream is always 1 */
6385					stc = 1;
6386					rspec[k] |= (PHY_TXC1_MODE_STBC <<
6387							RSPEC_STF_SHIFT) |
6388						    (stc << RSPEC_STC_SHIFT);
6389				} else
6390					rspec[k] |=
6391					    (phyctl1_stf << RSPEC_STF_SHIFT);
6392			}
6393
6394			/*
6395			 * Is the phy configured to use 40MHZ frames? If
6396			 * so then pick the desired txbw
6397			 */
6398			if (brcms_chspec_bw(wlc->chanspec) == BRCMS_40_MHZ) {
6399				/* default txbw is 20in40 SB */
6400				mimo_ctlchbw = mimo_txbw =
6401				   CHSPEC_SB_UPPER(wlc_phy_chanspec_get(
6402								 wlc->band->pi))
6403				   ? PHY_TXC1_BW_20MHZ_UP : PHY_TXC1_BW_20MHZ;
6404
6405				if (is_mcs_rate(rspec[k])) {
6406					/* mcs 32 must be 40b/w DUP */
6407					if ((rspec[k] & RSPEC_RATE_MASK)
6408					    == 32) {
6409						mimo_txbw =
6410						    PHY_TXC1_BW_40MHZ_DUP;
6411						/* use override */
6412					} else if (wlc->mimo_40txbw != AUTO)
6413						mimo_txbw = wlc->mimo_40txbw;
6414					/* else check if dst is using 40 Mhz */
6415					else if (scb->flags & SCB_IS40)
6416						mimo_txbw = PHY_TXC1_BW_40MHZ;
6417				} else if (is_ofdm_rate(rspec[k])) {
6418					if (wlc->ofdm_40txbw != AUTO)
6419						mimo_txbw = wlc->ofdm_40txbw;
6420				} else if (wlc->cck_40txbw != AUTO) {
6421					mimo_txbw = wlc->cck_40txbw;
6422				}
6423			} else {
6424				/*
6425				 * mcs32 is 40 b/w only.
6426				 * This is possible for probe packets on
6427				 * a STA during SCAN
6428				 */
6429				if ((rspec[k] & RSPEC_RATE_MASK) == 32)
6430					/* mcs 0 */
6431					rspec[k] = RSPEC_MIMORATE;
6432
6433				mimo_txbw = PHY_TXC1_BW_20MHZ;
6434			}
6435
6436			/* Set channel width */
6437			rspec[k] &= ~RSPEC_BW_MASK;
6438			if ((k == 0) || ((k > 0) && is_mcs_rate(rspec[k])))
6439				rspec[k] |= (mimo_txbw << RSPEC_BW_SHIFT);
6440			else
6441				rspec[k] |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
6442
6443			/* Disable short GI, not supported yet */
6444			rspec[k] &= ~RSPEC_SHORT_GI;
6445
6446			mimo_preamble_type = BRCMS_MM_PREAMBLE;
6447			if (txrate[k]->flags & IEEE80211_TX_RC_GREEN_FIELD)
6448				mimo_preamble_type = BRCMS_GF_PREAMBLE;
6449
6450			if ((txrate[k]->flags & IEEE80211_TX_RC_MCS)
6451			    && (!is_mcs_rate(rspec[k]))) {
6452				brcms_warn(wlc->hw->d11core,
6453					   "wl%d: %s: IEEE80211_TX_RC_MCS != is_mcs_rate(rspec)\n",
6454					   wlc->pub->unit, __func__);
6455			}
6456
6457			if (is_mcs_rate(rspec[k])) {
6458				preamble_type[k] = mimo_preamble_type;
6459
6460				/*
6461				 * if SGI is selected, then forced mm
6462				 * for single stream
6463				 */
6464				if ((rspec[k] & RSPEC_SHORT_GI)
6465				    && is_single_stream(rspec[k] &
6466							RSPEC_RATE_MASK))
6467					preamble_type[k] = BRCMS_MM_PREAMBLE;
6468			}
6469
6470			/* should be better conditionalized */
6471			if (!is_mcs_rate(rspec[0])
6472			    && (tx_info->control.rates[0].
6473				flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
6474				preamble_type[k] = BRCMS_SHORT_PREAMBLE;
6475		}
6476	} else {
6477		for (k = 0; k < hw->max_rates; k++) {
6478			/* Set ctrlchbw as 20Mhz */
6479			rspec[k] &= ~RSPEC_BW_MASK;
6480			rspec[k] |= (PHY_TXC1_BW_20MHZ << RSPEC_BW_SHIFT);
6481
6482			/* for nphy, stf of ofdm frames must follow policies */
6483			if (BRCMS_ISNPHY(wlc->band) && is_ofdm_rate(rspec[k])) {
6484				rspec[k] &= ~RSPEC_STF_MASK;
6485				rspec[k] |= phyctl1_stf << RSPEC_STF_SHIFT;
6486			}
6487		}
6488	}
6489
6490	/* Reset these for use with AMPDU's */
6491	txrate[0]->count = 0;
6492	txrate[1]->count = 0;
6493
6494	/* (2) PROTECTION, may change rspec */
6495	if ((ieee80211_is_data(h->frame_control) ||
6496	    ieee80211_is_mgmt(h->frame_control)) &&
6497	    (phylen > wlc->RTSThresh) && !is_multicast_ether_addr(h->addr1))
6498		use_rts = true;
6499
6500	/* (3) PLCP: determine PLCP header and MAC duration,
6501	 * fill struct d11txh */
6502	brcms_c_compute_plcp(wlc, rspec[0], phylen, plcp);
6503	brcms_c_compute_plcp(wlc, rspec[1], phylen, plcp_fallback);
6504	memcpy(&txh->FragPLCPFallback,
6505	       plcp_fallback, sizeof(txh->FragPLCPFallback));
6506
6507	/* Length field now put in CCK FBR CRC field */
6508	if (is_cck_rate(rspec[1])) {
6509		txh->FragPLCPFallback[4] = phylen & 0xff;
6510		txh->FragPLCPFallback[5] = (phylen & 0xff00) >> 8;
6511	}
6512
6513	/* MIMO-RATE: need validation ?? */
6514	mainrates = is_ofdm_rate(rspec[0]) ?
6515			D11A_PHY_HDR_GRATE((struct ofdm_phy_hdr *) plcp) :
6516			plcp[0];
6517
6518	/* DUR field for main rate */
6519	if (!ieee80211_is_pspoll(h->frame_control) &&
6520	    !is_multicast_ether_addr(h->addr1) && !use_rifs) {
6521		durid =
6522		    brcms_c_compute_frame_dur(wlc, rspec[0], preamble_type[0],
6523					  next_frag_len);
6524		h->duration_id = cpu_to_le16(durid);
6525	} else if (use_rifs) {
6526		/* NAV protect to end of next max packet size */
6527		durid =
6528		    (u16) brcms_c_calc_frame_time(wlc, rspec[0],
6529						 preamble_type[0],
6530						 DOT11_MAX_FRAG_LEN);
6531		durid += RIFS_11N_TIME;
6532		h->duration_id = cpu_to_le16(durid);
6533	}
6534
6535	/* DUR field for fallback rate */
6536	if (ieee80211_is_pspoll(h->frame_control))
6537		txh->FragDurFallback = h->duration_id;
6538	else if (is_multicast_ether_addr(h->addr1) || use_rifs)
6539		txh->FragDurFallback = 0;
6540	else {
6541		durid = brcms_c_compute_frame_dur(wlc, rspec[1],
6542					      preamble_type[1], next_frag_len);
6543		txh->FragDurFallback = cpu_to_le16(durid);
6544	}
6545
6546	/* (4) MAC-HDR: MacTxControlLow */
6547	if (frag == 0)
6548		mcl |= TXC_STARTMSDU;
6549
6550	if (!is_multicast_ether_addr(h->addr1))
6551		mcl |= TXC_IMMEDACK;
6552
6553	if (wlc->band->bandtype == BRCM_BAND_5G)
6554		mcl |= TXC_FREQBAND_5G;
6555
6556	if (CHSPEC_IS40(wlc_phy_chanspec_get(wlc->band->pi)))
6557		mcl |= TXC_BW_40;
6558
6559	/* set AMIC bit if using hardware TKIP MIC */
6560	if (hwtkmic)
6561		mcl |= TXC_AMIC;
6562
6563	txh->MacTxControlLow = cpu_to_le16(mcl);
6564
6565	/* MacTxControlHigh */
6566	mch = 0;
6567
6568	/* Set fallback rate preamble type */
6569	if ((preamble_type[1] == BRCMS_SHORT_PREAMBLE) ||
6570	    (preamble_type[1] == BRCMS_GF_PREAMBLE)) {
6571		if (rspec2rate(rspec[1]) != BRCM_RATE_1M)
6572			mch |= TXC_PREAMBLE_DATA_FB_SHORT;
6573	}
6574
6575	/* MacFrameControl */
6576	memcpy(&txh->MacFrameControl, &h->frame_control, sizeof(u16));
6577	txh->TxFesTimeNormal = cpu_to_le16(0);
6578
6579	txh->TxFesTimeFallback = cpu_to_le16(0);
6580
6581	/* TxFrameRA */
6582	memcpy(&txh->TxFrameRA, &h->addr1, ETH_ALEN);
6583
6584	/* TxFrameID */
6585	txh->TxFrameID = cpu_to_le16(frameid);
6586
6587	/*
6588	 * TxStatus, Note the case of recreating the first frag of a suppressed
6589	 * frame then we may need to reset the retry cnt's via the status reg
6590	 */
6591	txh->TxStatus = cpu_to_le16(status);
6592
6593	/*
6594	 * extra fields for ucode AMPDU aggregation, the new fields are added to
6595	 * the END of previous structure so that it's compatible in driver.
6596	 */
6597	txh->MaxNMpdus = cpu_to_le16(0);
6598	txh->MaxABytes_MRT = cpu_to_le16(0);
6599	txh->MaxABytes_FBR = cpu_to_le16(0);
6600	txh->MinMBytes = cpu_to_le16(0);
6601
6602	/* (5) RTS/CTS: determine RTS/CTS PLCP header and MAC duration,
6603	 * furnish struct d11txh */
6604	/* RTS PLCP header and RTS frame */
6605	if (use_rts || use_cts) {
6606		if (use_rts && use_cts)
6607			use_cts = false;
6608
6609		for (k = 0; k < 2; k++) {
6610			rts_rspec[k] = brcms_c_rspec_to_rts_rspec(wlc, rspec[k],
6611							      false,
6612							      mimo_ctlchbw);
6613		}
6614
6615		if (!is_ofdm_rate(rts_rspec[0]) &&
6616		    !((rspec2rate(rts_rspec[0]) == BRCM_RATE_1M) ||
6617		      (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6618			rts_preamble_type[0] = BRCMS_SHORT_PREAMBLE;
6619			mch |= TXC_PREAMBLE_RTS_MAIN_SHORT;
6620		}
6621
6622		if (!is_ofdm_rate(rts_rspec[1]) &&
6623		    !((rspec2rate(rts_rspec[1]) == BRCM_RATE_1M) ||
6624		      (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6625			rts_preamble_type[1] = BRCMS_SHORT_PREAMBLE;
6626			mch |= TXC_PREAMBLE_RTS_FB_SHORT;
6627		}
6628
6629		/* RTS/CTS additions to MacTxControlLow */
6630		if (use_cts) {
6631			txh->MacTxControlLow |= cpu_to_le16(TXC_SENDCTS);
6632		} else {
6633			txh->MacTxControlLow |= cpu_to_le16(TXC_SENDRTS);
6634			txh->MacTxControlLow |= cpu_to_le16(TXC_LONGFRAME);
6635		}
6636
6637		/* RTS PLCP header */
6638		rts_plcp = txh->RTSPhyHeader;
6639		if (use_cts)
6640			rts_phylen = DOT11_CTS_LEN + FCS_LEN;
6641		else
6642			rts_phylen = DOT11_RTS_LEN + FCS_LEN;
6643
6644		brcms_c_compute_plcp(wlc, rts_rspec[0], rts_phylen, rts_plcp);
6645
6646		/* fallback rate version of RTS PLCP header */
6647		brcms_c_compute_plcp(wlc, rts_rspec[1], rts_phylen,
6648				 rts_plcp_fallback);
6649		memcpy(&txh->RTSPLCPFallback, rts_plcp_fallback,
6650		       sizeof(txh->RTSPLCPFallback));
6651
6652		/* RTS frame fields... */
6653		rts = (struct ieee80211_rts *)&txh->rts_frame;
6654
6655		durid = brcms_c_compute_rtscts_dur(wlc, use_cts, rts_rspec[0],
6656					       rspec[0], rts_preamble_type[0],
6657					       preamble_type[0], phylen, false);
6658		rts->duration = cpu_to_le16(durid);
6659		/* fallback rate version of RTS DUR field */
6660		durid = brcms_c_compute_rtscts_dur(wlc, use_cts,
6661					       rts_rspec[1], rspec[1],
6662					       rts_preamble_type[1],
6663					       preamble_type[1], phylen, false);
6664		txh->RTSDurFallback = cpu_to_le16(durid);
6665
6666		if (use_cts) {
6667			rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6668							 IEEE80211_STYPE_CTS);
6669
6670			memcpy(&rts->ra, &h->addr2, ETH_ALEN);
6671		} else {
6672			rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6673							 IEEE80211_STYPE_RTS);
6674
6675			memcpy(&rts->ra, &h->addr1, 2 * ETH_ALEN);
6676		}
6677
6678		/* mainrate
6679		 *    low 8 bits: main frag rate/mcs,
6680		 *    high 8 bits: rts/cts rate/mcs
6681		 */
6682		mainrates |= (is_ofdm_rate(rts_rspec[0]) ?
6683				D11A_PHY_HDR_GRATE(
6684					(struct ofdm_phy_hdr *) rts_plcp) :
6685				rts_plcp[0]) << 8;
6686	} else {
6687		memset(txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
6688		memset(&txh->rts_frame, 0, sizeof(struct ieee80211_rts));
6689		memset(txh->RTSPLCPFallback, 0, sizeof(txh->RTSPLCPFallback));
6690		txh->RTSDurFallback = 0;
6691	}
6692
6693#ifdef SUPPORT_40MHZ
6694	/* add null delimiter count */
6695	if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && is_mcs_rate(rspec))
6696		txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM] =
6697		   brcm_c_ampdu_null_delim_cnt(wlc->ampdu, scb, rspec, phylen);
6698
6699#endif
6700
6701	/*
6702	 * Now that RTS/RTS FB preamble types are updated, write
6703	 * the final value
6704	 */
6705	txh->MacTxControlHigh = cpu_to_le16(mch);
6706
6707	/*
6708	 * MainRates (both the rts and frag plcp rates have
6709	 * been calculated now)
6710	 */
6711	txh->MainRates = cpu_to_le16(mainrates);
6712
6713	/* XtraFrameTypes */
6714	xfts = frametype(rspec[1], wlc->mimoft);
6715	xfts |= (frametype(rts_rspec[0], wlc->mimoft) << XFTS_RTS_FT_SHIFT);
6716	xfts |= (frametype(rts_rspec[1], wlc->mimoft) << XFTS_FBRRTS_FT_SHIFT);
6717	xfts |= CHSPEC_CHANNEL(wlc_phy_chanspec_get(wlc->band->pi)) <<
6718							     XFTS_CHANNEL_SHIFT;
6719	txh->XtraFrameTypes = cpu_to_le16(xfts);
6720
6721	/* PhyTxControlWord */
6722	phyctl = frametype(rspec[0], wlc->mimoft);
6723	if ((preamble_type[0] == BRCMS_SHORT_PREAMBLE) ||
6724	    (preamble_type[0] == BRCMS_GF_PREAMBLE)) {
6725		if (rspec2rate(rspec[0]) != BRCM_RATE_1M)
6726			phyctl |= PHY_TXC_SHORT_HDR;
6727	}
6728
6729	/* phytxant is properly bit shifted */
6730	phyctl |= brcms_c_stf_d11hdrs_phyctl_txant(wlc, rspec[0]);
6731	txh->PhyTxControlWord = cpu_to_le16(phyctl);
6732
6733	/* PhyTxControlWord_1 */
6734	if (BRCMS_PHY_11N_CAP(wlc->band)) {
6735		u16 phyctl1 = 0;
6736
6737		phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[0]);
6738		txh->PhyTxControlWord_1 = cpu_to_le16(phyctl1);
6739		phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[1]);
6740		txh->PhyTxControlWord_1_Fbr = cpu_to_le16(phyctl1);
6741
6742		if (use_rts || use_cts) {
6743			phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[0]);
6744			txh->PhyTxControlWord_1_Rts = cpu_to_le16(phyctl1);
6745			phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[1]);
6746			txh->PhyTxControlWord_1_FbrRts = cpu_to_le16(phyctl1);
6747		}
6748
6749		/*
6750		 * For mcs frames, if mixedmode(overloaded with long preamble)
6751		 * is going to be set, fill in non-zero MModeLen and/or
6752		 * MModeFbrLen it will be unnecessary if they are separated
6753		 */
6754		if (is_mcs_rate(rspec[0]) &&
6755		    (preamble_type[0] == BRCMS_MM_PREAMBLE)) {
6756			u16 mmodelen =
6757			    brcms_c_calc_lsig_len(wlc, rspec[0], phylen);
6758			txh->MModeLen = cpu_to_le16(mmodelen);
6759		}
6760
6761		if (is_mcs_rate(rspec[1]) &&
6762		    (preamble_type[1] == BRCMS_MM_PREAMBLE)) {
6763			u16 mmodefbrlen =
6764			    brcms_c_calc_lsig_len(wlc, rspec[1], phylen);
6765			txh->MModeFbrLen = cpu_to_le16(mmodefbrlen);
6766		}
6767	}
6768
6769	ac = skb_get_queue_mapping(p);
6770	if ((scb->flags & SCB_WMECAP) && qos && wlc->edcf_txop[ac]) {
6771		uint frag_dur, dur, dur_fallback;
6772
6773		/* WME: Update TXOP threshold */
6774		if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU) && frag == 0) {
6775			frag_dur =
6776			    brcms_c_calc_frame_time(wlc, rspec[0],
6777					preamble_type[0], phylen);
6778
6779			if (rts) {
6780				/* 1 RTS or CTS-to-self frame */
6781				dur =
6782				    brcms_c_calc_cts_time(wlc, rts_rspec[0],
6783						      rts_preamble_type[0]);
6784				dur_fallback =
6785				    brcms_c_calc_cts_time(wlc, rts_rspec[1],
6786						      rts_preamble_type[1]);
6787				/* (SIFS + CTS) + SIFS + frame + SIFS + ACK */
6788				dur += le16_to_cpu(rts->duration);
6789				dur_fallback +=
6790					le16_to_cpu(txh->RTSDurFallback);
6791			} else if (use_rifs) {
6792				dur = frag_dur;
6793				dur_fallback = 0;
6794			} else {
6795				/* frame + SIFS + ACK */
6796				dur = frag_dur;
6797				dur +=
6798				    brcms_c_compute_frame_dur(wlc, rspec[0],
6799							  preamble_type[0], 0);
6800
6801				dur_fallback =
6802				    brcms_c_calc_frame_time(wlc, rspec[1],
6803							preamble_type[1],
6804							phylen);
6805				dur_fallback +=
6806				    brcms_c_compute_frame_dur(wlc, rspec[1],
6807							  preamble_type[1], 0);
6808			}
6809			/* NEED to set TxFesTimeNormal (hard) */
6810			txh->TxFesTimeNormal = cpu_to_le16((u16) dur);
6811			/*
6812			 * NEED to set fallback rate version of
6813			 * TxFesTimeNormal (hard)
6814			 */
6815			txh->TxFesTimeFallback =
6816				cpu_to_le16((u16) dur_fallback);
6817
6818			/*
6819			 * update txop byte threshold (txop minus intraframe
6820			 * overhead)
6821			 */
6822			if (wlc->edcf_txop[ac] >= (dur - frag_dur)) {
6823				uint newfragthresh;
6824
6825				newfragthresh =
6826				    brcms_c_calc_frame_len(wlc,
6827					rspec[0], preamble_type[0],
6828					(wlc->edcf_txop[ac] -
6829						(dur - frag_dur)));
6830				/* range bound the fragthreshold */
6831				if (newfragthresh < DOT11_MIN_FRAG_LEN)
6832					newfragthresh =
6833					    DOT11_MIN_FRAG_LEN;
6834				else if (newfragthresh >
6835					 wlc->usr_fragthresh)
6836					newfragthresh =
6837					    wlc->usr_fragthresh;
6838				/* update the fragthresh and do txc update */
6839				if (wlc->fragthresh[queue] !=
6840				    (u16) newfragthresh)
6841					wlc->fragthresh[queue] =
6842					    (u16) newfragthresh;
6843			} else {
6844				brcms_warn(wlc->hw->d11core,
6845					   "wl%d: %s txop invalid for rate %d\n",
6846					   wlc->pub->unit, fifo_names[queue],
6847					   rspec2rate(rspec[0]));
6848			}
6849
6850			if (dur > wlc->edcf_txop[ac])
6851				brcms_warn(wlc->hw->d11core,
6852					   "wl%d: %s: %s txop exceeded phylen %d/%d dur %d/%d\n",
6853					   wlc->pub->unit, __func__,
6854					   fifo_names[queue],
6855					   phylen, wlc->fragthresh[queue],
6856					   dur, wlc->edcf_txop[ac]);
6857		}
6858	}
6859
6860	return 0;
6861}
6862
6863static int brcms_c_tx(struct brcms_c_info *wlc, struct sk_buff *skb)
6864{
6865	struct dma_pub *dma;
6866	int fifo, ret = -ENOSPC;
6867	struct d11txh *txh;
6868	u16 frameid = INVALIDFID;
6869
6870	fifo = brcms_ac_to_fifo(skb_get_queue_mapping(skb));
6871	dma = wlc->hw->di[fifo];
6872	txh = (struct d11txh *)(skb->data);
6873
6874	if (dma->txavail == 0) {
6875		/*
6876		 * We sometimes get a frame from mac80211 after stopping
6877		 * the queues. This only ever seems to be a single frame
6878		 * and is seems likely to be a race. TX_HEADROOM should
6879		 * ensure that we have enough space to handle these stray
6880		 * packets, so warn if there isn't. If we're out of space
6881		 * in the tx ring and the tx queue isn't stopped then
6882		 * we've really got a bug; warn loudly if that happens.
6883		 */
6884		brcms_warn(wlc->hw->d11core,
6885			   "Received frame for tx with no space in DMA ring\n");
6886		WARN_ON(!ieee80211_queue_stopped(wlc->pub->ieee_hw,
6887						 skb_get_queue_mapping(skb)));
6888		return -ENOSPC;
6889	}
6890
6891	/* When a BC/MC frame is being committed to the BCMC fifo
6892	 * via DMA (NOT PIO), update ucode or BSS info as appropriate.
6893	 */
6894	if (fifo == TX_BCMC_FIFO)
6895		frameid = le16_to_cpu(txh->TxFrameID);
6896
6897	/* Commit BCMC sequence number in the SHM frame ID location */
6898	if (frameid != INVALIDFID) {
6899		/*
6900		 * To inform the ucode of the last mcast frame posted
6901		 * so that it can clear moredata bit
6902		 */
6903		brcms_b_write_shm(wlc->hw, M_BCMC_FID, frameid);
6904	}
6905
6906	ret = brcms_c_txfifo(wlc, fifo, skb);
6907	/*
6908	 * The only reason for brcms_c_txfifo to fail is because
6909	 * there weren't any DMA descriptors, but we've already
6910	 * checked for that. So if it does fail yell loudly.
6911	 */
6912	WARN_ON_ONCE(ret);
6913
6914	return ret;
6915}
6916
6917bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
6918			      struct ieee80211_hw *hw)
6919{
6920	uint fifo;
6921	struct scb *scb = &wlc->pri_scb;
6922
6923	fifo = brcms_ac_to_fifo(skb_get_queue_mapping(sdu));
6924	brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0);
6925	if (!brcms_c_tx(wlc, sdu))
6926		return true;
6927
6928	/* packet discarded */
6929	dev_kfree_skb_any(sdu);
6930	return false;
6931}
6932
6933int
6934brcms_c_txfifo(struct brcms_c_info *wlc, uint fifo, struct sk_buff *p)
6935{
6936	struct dma_pub *dma = wlc->hw->di[fifo];
6937	int ret;
6938	u16 queue;
6939
6940	ret = dma_txfast(wlc, dma, p);
6941	if (ret	< 0)
6942		wiphy_err(wlc->wiphy, "txfifo: fatal, toss frames !!!\n");
6943
6944	/*
6945	 * Stop queue if DMA ring is full. Reserve some free descriptors,
6946	 * as we sometimes receive a frame from mac80211 after the queues
6947	 * are stopped.
6948	 */
6949	queue = skb_get_queue_mapping(p);
6950	if (dma->txavail <= TX_HEADROOM && fifo < TX_BCMC_FIFO &&
6951	    !ieee80211_queue_stopped(wlc->pub->ieee_hw, queue))
6952		ieee80211_stop_queue(wlc->pub->ieee_hw, queue);
6953
6954	return ret;
6955}
6956
6957u32
6958brcms_c_rspec_to_rts_rspec(struct brcms_c_info *wlc, u32 rspec,
6959			   bool use_rspec, u16 mimo_ctlchbw)
6960{
6961	u32 rts_rspec = 0;
6962
6963	if (use_rspec)
6964		/* use frame rate as rts rate */
6965		rts_rspec = rspec;
6966	else if (wlc->band->gmode && wlc->protection->_g && !is_cck_rate(rspec))
6967		/* Use 11Mbps as the g protection RTS target rate and fallback.
6968		 * Use the brcms_basic_rate() lookup to find the best basic rate
6969		 * under the target in case 11 Mbps is not Basic.
6970		 * 6 and 9 Mbps are not usually selected by rate selection, but
6971		 * even if the OFDM rate we are protecting is 6 or 9 Mbps, 11
6972		 * is more robust.
6973		 */
6974		rts_rspec = brcms_basic_rate(wlc, BRCM_RATE_11M);
6975	else
6976		/* calculate RTS rate and fallback rate based on the frame rate
6977		 * RTS must be sent at a basic rate since it is a
6978		 * control frame, sec 9.6 of 802.11 spec
6979		 */
6980		rts_rspec = brcms_basic_rate(wlc, rspec);
6981
6982	if (BRCMS_PHY_11N_CAP(wlc->band)) {
6983		/* set rts txbw to correct side band */
6984		rts_rspec &= ~RSPEC_BW_MASK;
6985
6986		/*
6987		 * if rspec/rspec_fallback is 40MHz, then send RTS on both
6988		 * 20MHz channel (DUP), otherwise send RTS on control channel
6989		 */
6990		if (rspec_is40mhz(rspec) && !is_cck_rate(rts_rspec))
6991			rts_rspec |= (PHY_TXC1_BW_40MHZ_DUP << RSPEC_BW_SHIFT);
6992		else
6993			rts_rspec |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
6994
6995		/* pick siso/cdd as default for ofdm */
6996		if (is_ofdm_rate(rts_rspec)) {
6997			rts_rspec &= ~RSPEC_STF_MASK;
6998			rts_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
6999		}
7000	}
7001	return rts_rspec;
7002}
7003
7004/* Update beacon listen interval in shared memory */
7005static void brcms_c_bcn_li_upd(struct brcms_c_info *wlc)
7006{
7007	/* wake up every DTIM is the default */
7008	if (wlc->bcn_li_dtim == 1)
7009		brcms_b_write_shm(wlc->hw, M_BCN_LI, 0);
7010	else
7011		brcms_b_write_shm(wlc->hw, M_BCN_LI,
7012			      (wlc->bcn_li_dtim << 8) | wlc->bcn_li_bcn);
7013}
7014
7015static void
7016brcms_b_read_tsf(struct brcms_hardware *wlc_hw, u32 *tsf_l_ptr,
7017		  u32 *tsf_h_ptr)
7018{
7019	struct bcma_device *core = wlc_hw->d11core;
7020
7021	/* read the tsf timer low, then high to get an atomic read */
7022	*tsf_l_ptr = bcma_read32(core, D11REGOFFS(tsf_timerlow));
7023	*tsf_h_ptr = bcma_read32(core, D11REGOFFS(tsf_timerhigh));
7024}
7025
7026/*
7027 * recover 64bit TSF value from the 16bit TSF value in the rx header
7028 * given the assumption that the TSF passed in header is within 65ms
7029 * of the current tsf.
7030 *
7031 * 6       5       4       4       3       2       1
7032 * 3.......6.......8.......0.......2.......4.......6.......8......0
7033 * |<---------- tsf_h ----------->||<--- tsf_l -->||<-RxTSFTime ->|
7034 *
7035 * The RxTSFTime are the lowest 16 bits and provided by the ucode. The
7036 * tsf_l is filled in by brcms_b_recv, which is done earlier in the
7037 * receive call sequence after rx interrupt. Only the higher 16 bits
7038 * are used. Finally, the tsf_h is read from the tsf register.
7039 */
7040static u64 brcms_c_recover_tsf64(struct brcms_c_info *wlc,
7041				 struct d11rxhdr *rxh)
7042{
7043	u32 tsf_h, tsf_l;
7044	u16 rx_tsf_0_15, rx_tsf_16_31;
7045
7046	brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7047
7048	rx_tsf_16_31 = (u16)(tsf_l >> 16);
7049	rx_tsf_0_15 = rxh->RxTSFTime;
7050
7051	/*
7052	 * a greater tsf time indicates the low 16 bits of
7053	 * tsf_l wrapped, so decrement the high 16 bits.
7054	 */
7055	if ((u16)tsf_l < rx_tsf_0_15) {
7056		rx_tsf_16_31 -= 1;
7057		if (rx_tsf_16_31 == 0xffff)
7058			tsf_h -= 1;
7059	}
7060
7061	return ((u64)tsf_h << 32) | (((u32)rx_tsf_16_31 << 16) + rx_tsf_0_15);
7062}
7063
7064static void
7065prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7066		     struct sk_buff *p,
7067		     struct ieee80211_rx_status *rx_status)
7068{
7069	int channel;
7070	u32 rspec;
7071	unsigned char *plcp;
7072
7073	/* fill in TSF and flag its presence */
7074	rx_status->mactime = brcms_c_recover_tsf64(wlc, rxh);
7075	rx_status->flag |= RX_FLAG_MACTIME_START;
7076
7077	channel = BRCMS_CHAN_CHANNEL(rxh->RxChan);
7078
7079	rx_status->band =
7080		channel > 14 ? IEEE80211_BAND_5GHZ : IEEE80211_BAND_2GHZ;
7081	rx_status->freq =
7082		ieee80211_channel_to_frequency(channel, rx_status->band);
7083
7084	rx_status->signal = wlc_phy_rssi_compute(wlc->hw->band->pi, rxh);
7085
7086	/* noise */
7087	/* qual */
7088	rx_status->antenna =
7089		(rxh->PhyRxStatus_0 & PRXS0_RXANT_UPSUBBAND) ? 1 : 0;
7090
7091	plcp = p->data;
7092
7093	rspec = brcms_c_compute_rspec(rxh, plcp);
7094	if (is_mcs_rate(rspec)) {
7095		rx_status->rate_idx = rspec & RSPEC_RATE_MASK;
7096		rx_status->flag |= RX_FLAG_HT;
7097		if (rspec_is40mhz(rspec))
7098			rx_status->flag |= RX_FLAG_40MHZ;
7099	} else {
7100		switch (rspec2rate(rspec)) {
7101		case BRCM_RATE_1M:
7102			rx_status->rate_idx = 0;
7103			break;
7104		case BRCM_RATE_2M:
7105			rx_status->rate_idx = 1;
7106			break;
7107		case BRCM_RATE_5M5:
7108			rx_status->rate_idx = 2;
7109			break;
7110		case BRCM_RATE_11M:
7111			rx_status->rate_idx = 3;
7112			break;
7113		case BRCM_RATE_6M:
7114			rx_status->rate_idx = 4;
7115			break;
7116		case BRCM_RATE_9M:
7117			rx_status->rate_idx = 5;
7118			break;
7119		case BRCM_RATE_12M:
7120			rx_status->rate_idx = 6;
7121			break;
7122		case BRCM_RATE_18M:
7123			rx_status->rate_idx = 7;
7124			break;
7125		case BRCM_RATE_24M:
7126			rx_status->rate_idx = 8;
7127			break;
7128		case BRCM_RATE_36M:
7129			rx_status->rate_idx = 9;
7130			break;
7131		case BRCM_RATE_48M:
7132			rx_status->rate_idx = 10;
7133			break;
7134		case BRCM_RATE_54M:
7135			rx_status->rate_idx = 11;
7136			break;
7137		default:
7138			brcms_err(wlc->hw->d11core,
7139				  "%s: Unknown rate\n", __func__);
7140		}
7141
7142		/*
7143		 * For 5GHz, we should decrease the index as it is
7144		 * a subset of the 2.4G rates. See bitrates field
7145		 * of brcms_band_5GHz_nphy (in mac80211_if.c).
7146		 */
7147		if (rx_status->band == IEEE80211_BAND_5GHZ)
7148			rx_status->rate_idx -= BRCMS_LEGACY_5G_RATE_OFFSET;
7149
7150		/* Determine short preamble and rate_idx */
7151		if (is_cck_rate(rspec)) {
7152			if (rxh->PhyRxStatus_0 & PRXS0_SHORTH)
7153				rx_status->flag |= RX_FLAG_SHORTPRE;
7154		} else if (is_ofdm_rate(rspec)) {
7155			rx_status->flag |= RX_FLAG_SHORTPRE;
7156		} else {
7157			brcms_err(wlc->hw->d11core, "%s: Unknown modulation\n",
7158				  __func__);
7159		}
7160	}
7161
7162	if (plcp3_issgi(plcp[3]))
7163		rx_status->flag |= RX_FLAG_SHORT_GI;
7164
7165	if (rxh->RxStatus1 & RXS_DECERR) {
7166		rx_status->flag |= RX_FLAG_FAILED_PLCP_CRC;
7167		brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_PLCP_CRC\n",
7168			  __func__);
7169	}
7170	if (rxh->RxStatus1 & RXS_FCSERR) {
7171		rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
7172		brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_FCS_CRC\n",
7173			  __func__);
7174	}
7175}
7176
7177static void
7178brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7179		struct sk_buff *p)
7180{
7181	int len_mpdu;
7182	struct ieee80211_rx_status rx_status;
7183	struct ieee80211_hdr *hdr;
7184
7185	memset(&rx_status, 0, sizeof(rx_status));
7186	prep_mac80211_status(wlc, rxh, p, &rx_status);
7187
7188	/* mac header+body length, exclude CRC and plcp header */
7189	len_mpdu = p->len - D11_PHY_HDR_LEN - FCS_LEN;
7190	skb_pull(p, D11_PHY_HDR_LEN);
7191	__skb_trim(p, len_mpdu);
7192
7193	/* unmute transmit */
7194	if (wlc->hw->suspended_fifos) {
7195		hdr = (struct ieee80211_hdr *)p->data;
7196		if (ieee80211_is_beacon(hdr->frame_control))
7197			brcms_b_mute(wlc->hw, false);
7198	}
7199
7200	memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
7201	ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
7202}
7203
7204/* calculate frame duration for Mixed-mode L-SIG spoofing, return
7205 * number of bytes goes in the length field
7206 *
7207 * Formula given by HT PHY Spec v 1.13
7208 *   len = 3(nsyms + nstream + 3) - 3
7209 */
7210u16
7211brcms_c_calc_lsig_len(struct brcms_c_info *wlc, u32 ratespec,
7212		      uint mac_len)
7213{
7214	uint nsyms, len = 0, kNdps;
7215
7216	if (is_mcs_rate(ratespec)) {
7217		uint mcs = ratespec & RSPEC_RATE_MASK;
7218		int tot_streams = (mcs_2_txstreams(mcs) + 1) +
7219				  rspec_stc(ratespec);
7220
7221		/*
7222		 * the payload duration calculation matches that
7223		 * of regular ofdm
7224		 */
7225		/* 1000Ndbps = kbps * 4 */
7226		kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
7227				   rspec_issgi(ratespec)) * 4;
7228
7229		if (rspec_stc(ratespec) == 0)
7230			nsyms =
7231			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7232				  APHY_TAIL_NBITS) * 1000, kNdps);
7233		else
7234			/* STBC needs to have even number of symbols */
7235			nsyms =
7236			    2 *
7237			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7238				  APHY_TAIL_NBITS) * 1000, 2 * kNdps);
7239
7240		/* (+3) account for HT-SIG(2) and HT-STF(1) */
7241		nsyms += (tot_streams + 3);
7242		/*
7243		 * 3 bytes/symbol @ legacy 6Mbps rate
7244		 * (-3) excluding service bits and tail bits
7245		 */
7246		len = (3 * nsyms) - 3;
7247	}
7248
7249	return (u16) len;
7250}
7251
7252static void
7253brcms_c_mod_prb_rsp_rate_table(struct brcms_c_info *wlc, uint frame_len)
7254{
7255	const struct brcms_c_rateset *rs_dflt;
7256	struct brcms_c_rateset rs;
7257	u8 rate;
7258	u16 entry_ptr;
7259	u8 plcp[D11_PHY_HDR_LEN];
7260	u16 dur, sifs;
7261	uint i;
7262
7263	sifs = get_sifs(wlc->band);
7264
7265	rs_dflt = brcms_c_rateset_get_hwrs(wlc);
7266
7267	brcms_c_rateset_copy(rs_dflt, &rs);
7268	brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
7269
7270	/*
7271	 * walk the phy rate table and update MAC core SHM
7272	 * basic rate table entries
7273	 */
7274	for (i = 0; i < rs.count; i++) {
7275		rate = rs.rates[i] & BRCMS_RATE_MASK;
7276
7277		entry_ptr = brcms_b_rate_shm_offset(wlc->hw, rate);
7278
7279		/* Calculate the Probe Response PLCP for the given rate */
7280		brcms_c_compute_plcp(wlc, rate, frame_len, plcp);
7281
7282		/*
7283		 * Calculate the duration of the Probe Response
7284		 * frame plus SIFS for the MAC
7285		 */
7286		dur = (u16) brcms_c_calc_frame_time(wlc, rate,
7287						BRCMS_LONG_PREAMBLE, frame_len);
7288		dur += sifs;
7289
7290		/* Update the SHM Rate Table entry Probe Response values */
7291		brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS,
7292			      (u16) (plcp[0] + (plcp[1] << 8)));
7293		brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS + 2,
7294			      (u16) (plcp[2] + (plcp[3] << 8)));
7295		brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_DUR_POS, dur);
7296	}
7297}
7298
7299int brcms_c_get_header_len(void)
7300{
7301	return TXOFF;
7302}
7303
7304static void brcms_c_beacon_write(struct brcms_c_info *wlc,
7305				 struct sk_buff *beacon, u16 tim_offset,
7306				 u16 dtim_period, bool bcn0, bool bcn1)
7307{
7308	size_t len;
7309	struct ieee80211_tx_info *tx_info;
7310	struct brcms_hardware *wlc_hw = wlc->hw;
7311	struct ieee80211_hw *ieee_hw = brcms_c_pub(wlc)->ieee_hw;
7312
7313	/* Get tx_info */
7314	tx_info = IEEE80211_SKB_CB(beacon);
7315
7316	len = min_t(size_t, beacon->len, BCN_TMPL_LEN);
7317	wlc->bcn_rspec = ieee80211_get_tx_rate(ieee_hw, tx_info)->hw_value;
7318
7319	brcms_c_compute_plcp(wlc, wlc->bcn_rspec,
7320			     len + FCS_LEN - D11_PHY_HDR_LEN, beacon->data);
7321
7322	/* "Regular" and 16 MBSS but not for 4 MBSS */
7323	/* Update the phytxctl for the beacon based on the rspec */
7324	brcms_c_beacon_phytxctl_txant_upd(wlc, wlc->bcn_rspec);
7325
7326	if (bcn0) {
7327		/* write the probe response into the template region */
7328		brcms_b_write_template_ram(wlc_hw, T_BCN0_TPL_BASE,
7329					    (len + 3) & ~3, beacon->data);
7330
7331		/* write beacon length to SCR */
7332		brcms_b_write_shm(wlc_hw, M_BCN0_FRM_BYTESZ, (u16) len);
7333	}
7334	if (bcn1) {
7335		/* write the probe response into the template region */
7336		brcms_b_write_template_ram(wlc_hw, T_BCN1_TPL_BASE,
7337					    (len + 3) & ~3, beacon->data);
7338
7339		/* write beacon length to SCR */
7340		brcms_b_write_shm(wlc_hw, M_BCN1_FRM_BYTESZ, (u16) len);
7341	}
7342
7343	if (tim_offset != 0) {
7344		brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
7345				  tim_offset + D11B_PHY_HDR_LEN);
7346		brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, dtim_period);
7347	} else {
7348		brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
7349				  len + D11B_PHY_HDR_LEN);
7350		brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, 0);
7351	}
7352}
7353
7354static void brcms_c_update_beacon_hw(struct brcms_c_info *wlc,
7355				     struct sk_buff *beacon, u16 tim_offset,
7356				     u16 dtim_period)
7357{
7358	struct brcms_hardware *wlc_hw = wlc->hw;
7359	struct bcma_device *core = wlc_hw->d11core;
7360
7361	/* Hardware beaconing for this config */
7362	u32 both_valid = MCMD_BCN0VLD | MCMD_BCN1VLD;
7363
7364	/* Check if both templates are in use, if so sched. an interrupt
7365	 *      that will call back into this routine
7366	 */
7367	if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid)
7368		/* clear any previous status */
7369		bcma_write32(core, D11REGOFFS(macintstatus), MI_BCNTPL);
7370
7371	if (wlc->beacon_template_virgin) {
7372		wlc->beacon_template_virgin = false;
7373		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
7374				     true);
7375		/* mark beacon0 valid */
7376		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
7377		return;
7378	}
7379
7380	/* Check that after scheduling the interrupt both of the
7381	 *      templates are still busy. if not clear the int. & remask
7382	 */
7383	if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid) {
7384		wlc->defmacintmask |= MI_BCNTPL;
7385		return;
7386	}
7387
7388	if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN0VLD)) {
7389		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
7390				     false);
7391		/* mark beacon0 valid */
7392		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
7393		return;
7394	}
7395	if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN1VLD)) {
7396		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period,
7397				     false, true);
7398		/* mark beacon0 valid */
7399		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN1VLD);
7400		return;
7401	}
7402	return;
7403}
7404
7405/*
7406 * Update all beacons for the system.
7407 */
7408void brcms_c_update_beacon(struct brcms_c_info *wlc)
7409{
7410	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7411
7412	if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
7413			     bsscfg->type == BRCMS_TYPE_ADHOC)) {
7414		/* Clear the soft intmask */
7415		wlc->defmacintmask &= ~MI_BCNTPL;
7416		if (!wlc->beacon)
7417			return;
7418		brcms_c_update_beacon_hw(wlc, wlc->beacon,
7419					 wlc->beacon_tim_offset,
7420					 wlc->beacon_dtim_period);
7421	}
7422}
7423
7424void brcms_c_set_new_beacon(struct brcms_c_info *wlc, struct sk_buff *beacon,
7425			    u16 tim_offset, u16 dtim_period)
7426{
7427	if (!beacon)
7428		return;
7429	if (wlc->beacon)
7430		dev_kfree_skb_any(wlc->beacon);
7431	wlc->beacon = beacon;
7432
7433	/* add PLCP */
7434	skb_push(wlc->beacon, D11_PHY_HDR_LEN);
7435	wlc->beacon_tim_offset = tim_offset;
7436	wlc->beacon_dtim_period = dtim_period;
7437	brcms_c_update_beacon(wlc);
7438}
7439
7440void brcms_c_set_new_probe_resp(struct brcms_c_info *wlc,
7441				struct sk_buff *probe_resp)
7442{
7443	if (!probe_resp)
7444		return;
7445	if (wlc->probe_resp)
7446		dev_kfree_skb_any(wlc->probe_resp);
7447	wlc->probe_resp = probe_resp;
7448
7449	/* add PLCP */
7450	skb_push(wlc->probe_resp, D11_PHY_HDR_LEN);
7451	brcms_c_update_probe_resp(wlc, false);
7452}
7453
7454void brcms_c_enable_probe_resp(struct brcms_c_info *wlc, bool enable)
7455{
7456	/*
7457	 * prevent ucode from sending probe responses by setting the timeout
7458	 * to 1, it can not send it in that time frame.
7459	 */
7460	wlc->prb_resp_timeout = enable ? BRCMS_PRB_RESP_TIMEOUT : 1;
7461	brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
7462	/* TODO: if (enable) => also deactivate receiving of probe request */
7463}
7464
7465/* Write ssid into shared memory */
7466static void
7467brcms_c_shm_ssid_upd(struct brcms_c_info *wlc, struct brcms_bss_cfg *cfg)
7468{
7469	u8 *ssidptr = cfg->SSID;
7470	u16 base = M_SSID;
7471	u8 ssidbuf[IEEE80211_MAX_SSID_LEN];
7472
7473	/* padding the ssid with zero and copy it into shm */
7474	memset(ssidbuf, 0, IEEE80211_MAX_SSID_LEN);
7475	memcpy(ssidbuf, ssidptr, cfg->SSID_len);
7476
7477	brcms_c_copyto_shm(wlc, base, ssidbuf, IEEE80211_MAX_SSID_LEN);
7478	brcms_b_write_shm(wlc->hw, M_SSIDLEN, (u16) cfg->SSID_len);
7479}
7480
7481static void
7482brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
7483			      struct brcms_bss_cfg *cfg,
7484			      struct sk_buff *probe_resp,
7485			      bool suspend)
7486{
7487	int len;
7488
7489	len = min_t(size_t, probe_resp->len, BCN_TMPL_LEN);
7490
7491	if (suspend)
7492		brcms_c_suspend_mac_and_wait(wlc);
7493
7494	/* write the probe response into the template region */
7495	brcms_b_write_template_ram(wlc->hw, T_PRS_TPL_BASE,
7496				    (len + 3) & ~3, probe_resp->data);
7497
7498	/* write the length of the probe response frame (+PLCP/-FCS) */
7499	brcms_b_write_shm(wlc->hw, M_PRB_RESP_FRM_LEN, (u16) len);
7500
7501	/* write the SSID and SSID length */
7502	brcms_c_shm_ssid_upd(wlc, cfg);
7503
7504	/*
7505	 * Write PLCP headers and durations for probe response frames
7506	 * at all rates. Use the actual frame length covered by the
7507	 * PLCP header for the call to brcms_c_mod_prb_rsp_rate_table()
7508	 * by subtracting the PLCP len and adding the FCS.
7509	 */
7510	brcms_c_mod_prb_rsp_rate_table(wlc,
7511				      (u16)len + FCS_LEN - D11_PHY_HDR_LEN);
7512
7513	if (suspend)
7514		brcms_c_enable_mac(wlc);
7515}
7516
7517void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
7518{
7519	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7520
7521	/* update AP or IBSS probe responses */
7522	if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
7523			     bsscfg->type == BRCMS_TYPE_ADHOC)) {
7524		if (!wlc->probe_resp)
7525			return;
7526		brcms_c_bss_update_probe_resp(wlc, bsscfg, wlc->probe_resp,
7527					      suspend);
7528	}
7529}
7530
7531int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo,
7532			   uint *blocks)
7533{
7534	if (fifo >= NFIFO)
7535		return -EINVAL;
7536
7537	*blocks = wlc_hw->xmtfifo_sz[fifo];
7538
7539	return 0;
7540}
7541
7542void
7543brcms_c_set_addrmatch(struct brcms_c_info *wlc, int match_reg_offset,
7544		  const u8 *addr)
7545{
7546	brcms_b_set_addrmatch(wlc->hw, match_reg_offset, addr);
7547	if (match_reg_offset == RCM_BSSID_OFFSET)
7548		memcpy(wlc->bsscfg->BSSID, addr, ETH_ALEN);
7549}
7550
7551/*
7552 * Flag 'scan in progress' to withhold dynamic phy calibration
7553 */
7554void brcms_c_scan_start(struct brcms_c_info *wlc)
7555{
7556	wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, true);
7557}
7558
7559void brcms_c_scan_stop(struct brcms_c_info *wlc)
7560{
7561	wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, false);
7562}
7563
7564void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state)
7565{
7566	wlc->pub->associated = state;
7567}
7568
7569/*
7570 * When a remote STA/AP is removed by Mac80211, or when it can no longer accept
7571 * AMPDU traffic, packets pending in hardware have to be invalidated so that
7572 * when later on hardware releases them, they can be handled appropriately.
7573 */
7574void brcms_c_inval_dma_pkts(struct brcms_hardware *hw,
7575			       struct ieee80211_sta *sta,
7576			       void (*dma_callback_fn))
7577{
7578	struct dma_pub *dmah;
7579	int i;
7580	for (i = 0; i < NFIFO; i++) {
7581		dmah = hw->di[i];
7582		if (dmah != NULL)
7583			dma_walk_packets(dmah, dma_callback_fn, sta);
7584	}
7585}
7586
7587int brcms_c_get_curband(struct brcms_c_info *wlc)
7588{
7589	return wlc->band->bandunit;
7590}
7591
7592bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc)
7593{
7594	int i;
7595
7596	/* Kick DMA to send any pending AMPDU */
7597	for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
7598		if (wlc->hw->di[i])
7599			dma_kick_tx(wlc->hw->di[i]);
7600
7601	return !brcms_txpktpendtot(wlc);
7602}
7603
7604void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
7605{
7606	wlc->bcn_li_bcn = interval;
7607	if (wlc->pub->up)
7608		brcms_c_bcn_li_upd(wlc);
7609}
7610
7611u64 brcms_c_tsf_get(struct brcms_c_info *wlc)
7612{
7613	u32 tsf_h, tsf_l;
7614	u64 tsf;
7615
7616	brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7617
7618	tsf = tsf_h;
7619	tsf <<= 32;
7620	tsf |= tsf_l;
7621
7622	return tsf;
7623}
7624
7625void brcms_c_tsf_set(struct brcms_c_info *wlc, u64 tsf)
7626{
7627	u32 tsf_h, tsf_l;
7628
7629	brcms_c_time_lock(wlc);
7630
7631	tsf_l = tsf;
7632	tsf_h = (tsf >> 32);
7633
7634	/* read the tsf timer low, then high to get an atomic read */
7635	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerlow), tsf_l);
7636	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerhigh), tsf_h);
7637
7638	brcms_c_time_unlock(wlc);
7639}
7640
7641int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr)
7642{
7643	uint qdbm;
7644
7645	/* Remove override bit and clip to max qdbm value */
7646	qdbm = min_t(uint, txpwr * BRCMS_TXPWR_DB_FACTOR, 0xff);
7647	return wlc_phy_txpower_set(wlc->band->pi, qdbm, false);
7648}
7649
7650int brcms_c_get_tx_power(struct brcms_c_info *wlc)
7651{
7652	uint qdbm;
7653	bool override;
7654
7655	wlc_phy_txpower_get(wlc->band->pi, &qdbm, &override);
7656
7657	/* Return qdbm units */
7658	return (int)(qdbm / BRCMS_TXPWR_DB_FACTOR);
7659}
7660
7661/* Process received frames */
7662/*
7663 * Return true if more frames need to be processed. false otherwise.
7664 * Param 'bound' indicates max. # frames to process before break out.
7665 */
7666static void brcms_c_recv(struct brcms_c_info *wlc, struct sk_buff *p)
7667{
7668	struct d11rxhdr *rxh;
7669	struct ieee80211_hdr *h;
7670	uint len;
7671	bool is_amsdu;
7672
7673	/* frame starts with rxhdr */
7674	rxh = (struct d11rxhdr *) (p->data);
7675
7676	/* strip off rxhdr */
7677	skb_pull(p, BRCMS_HWRXOFF);
7678
7679	/* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU subframes */
7680	if (rxh->RxStatus1 & RXS_PBPRES) {
7681		if (p->len < 2) {
7682			brcms_err(wlc->hw->d11core,
7683				  "wl%d: recv: rcvd runt of len %d\n",
7684				  wlc->pub->unit, p->len);
7685			goto toss;
7686		}
7687		skb_pull(p, 2);
7688	}
7689
7690	h = (struct ieee80211_hdr *)(p->data + D11_PHY_HDR_LEN);
7691	len = p->len;
7692
7693	if (rxh->RxStatus1 & RXS_FCSERR) {
7694		if (!(wlc->filter_flags & FIF_FCSFAIL))
7695			goto toss;
7696	}
7697
7698	/* check received pkt has at least frame control field */
7699	if (len < D11_PHY_HDR_LEN + sizeof(h->frame_control))
7700		goto toss;
7701
7702	/* not supporting A-MSDU */
7703	is_amsdu = rxh->RxStatus2 & RXS_AMSDU_MASK;
7704	if (is_amsdu)
7705		goto toss;
7706
7707	brcms_c_recvctl(wlc, rxh, p);
7708	return;
7709
7710 toss:
7711	brcmu_pkt_buf_free_skb(p);
7712}
7713
7714/* Process received frames */
7715/*
7716 * Return true if more frames need to be processed. false otherwise.
7717 * Param 'bound' indicates max. # frames to process before break out.
7718 */
7719static bool
7720brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
7721{
7722	struct sk_buff *p;
7723	struct sk_buff *next = NULL;
7724	struct sk_buff_head recv_frames;
7725
7726	uint n = 0;
7727	uint bound_limit = bound ? RXBND : -1;
7728	bool morepending = false;
7729
7730	skb_queue_head_init(&recv_frames);
7731
7732	/* gather received frames */
7733	do {
7734		/* !give others some time to run! */
7735		if (n >= bound_limit)
7736			break;
7737
7738		morepending = dma_rx(wlc_hw->di[fifo], &recv_frames);
7739		n++;
7740	} while (morepending);
7741
7742	/* post more rbufs */
7743	dma_rxfill(wlc_hw->di[fifo]);
7744
7745	/* process each frame */
7746	skb_queue_walk_safe(&recv_frames, p, next) {
7747		struct d11rxhdr_le *rxh_le;
7748		struct d11rxhdr *rxh;
7749
7750		skb_unlink(p, &recv_frames);
7751		rxh_le = (struct d11rxhdr_le *)p->data;
7752		rxh = (struct d11rxhdr *)p->data;
7753
7754		/* fixup rx header endianness */
7755		rxh->RxFrameSize = le16_to_cpu(rxh_le->RxFrameSize);
7756		rxh->PhyRxStatus_0 = le16_to_cpu(rxh_le->PhyRxStatus_0);
7757		rxh->PhyRxStatus_1 = le16_to_cpu(rxh_le->PhyRxStatus_1);
7758		rxh->PhyRxStatus_2 = le16_to_cpu(rxh_le->PhyRxStatus_2);
7759		rxh->PhyRxStatus_3 = le16_to_cpu(rxh_le->PhyRxStatus_3);
7760		rxh->PhyRxStatus_4 = le16_to_cpu(rxh_le->PhyRxStatus_4);
7761		rxh->PhyRxStatus_5 = le16_to_cpu(rxh_le->PhyRxStatus_5);
7762		rxh->RxStatus1 = le16_to_cpu(rxh_le->RxStatus1);
7763		rxh->RxStatus2 = le16_to_cpu(rxh_le->RxStatus2);
7764		rxh->RxTSFTime = le16_to_cpu(rxh_le->RxTSFTime);
7765		rxh->RxChan = le16_to_cpu(rxh_le->RxChan);
7766
7767		brcms_c_recv(wlc_hw->wlc, p);
7768	}
7769
7770	return morepending;
7771}
7772
7773/* second-level interrupt processing
7774 *   Return true if another dpc needs to be re-scheduled. false otherwise.
7775 *   Param 'bounded' indicates if applicable loops should be bounded.
7776 */
7777bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded)
7778{
7779	u32 macintstatus;
7780	struct brcms_hardware *wlc_hw = wlc->hw;
7781	struct bcma_device *core = wlc_hw->d11core;
7782
7783	if (brcms_deviceremoved(wlc)) {
7784		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
7785			  __func__);
7786		brcms_down(wlc->wl);
7787		return false;
7788	}
7789
7790	/* grab and clear the saved software intstatus bits */
7791	macintstatus = wlc->macintstatus;
7792	wlc->macintstatus = 0;
7793
7794	brcms_dbg_int(core, "wl%d: macintstatus 0x%x\n",
7795		      wlc_hw->unit, macintstatus);
7796
7797	WARN_ON(macintstatus & MI_PRQ); /* PRQ Interrupt in non-MBSS */
7798
7799	/* tx status */
7800	if (macintstatus & MI_TFS) {
7801		bool fatal;
7802		if (brcms_b_txstatus(wlc->hw, bounded, &fatal))
7803			wlc->macintstatus |= MI_TFS;
7804		if (fatal) {
7805			brcms_err(core, "MI_TFS: fatal\n");
7806			goto fatal;
7807		}
7808	}
7809
7810	if (macintstatus & (MI_TBTT | MI_DTIM_TBTT))
7811		brcms_c_tbtt(wlc);
7812
7813	/* ATIM window end */
7814	if (macintstatus & MI_ATIMWINEND) {
7815		brcms_dbg_info(core, "end of ATIM window\n");
7816		bcma_set32(core, D11REGOFFS(maccommand), wlc->qvalid);
7817		wlc->qvalid = 0;
7818	}
7819
7820	/*
7821	 * received data or control frame, MI_DMAINT is
7822	 * indication of RX_FIFO interrupt
7823	 */
7824	if (macintstatus & MI_DMAINT)
7825		if (brcms_b_recv(wlc_hw, RX_FIFO, bounded))
7826			wlc->macintstatus |= MI_DMAINT;
7827
7828	/* noise sample collected */
7829	if (macintstatus & MI_BG_NOISE)
7830		wlc_phy_noise_sample_intr(wlc_hw->band->pi);
7831
7832	if (macintstatus & MI_GP0) {
7833		brcms_err(core, "wl%d: PSM microcode watchdog fired at %d "
7834			  "(seconds). Resetting.\n", wlc_hw->unit, wlc_hw->now);
7835
7836		printk_once("%s : PSM Watchdog, chipid 0x%x, chiprev 0x%x\n",
7837			    __func__, ai_get_chip_id(wlc_hw->sih),
7838			    ai_get_chiprev(wlc_hw->sih));
7839		brcms_fatal_error(wlc_hw->wlc->wl);
7840	}
7841
7842	/* gptimer timeout */
7843	if (macintstatus & MI_TO)
7844		bcma_write32(core, D11REGOFFS(gptimer), 0);
7845
7846	if (macintstatus & MI_RFDISABLE) {
7847		brcms_dbg_info(core, "wl%d: BMAC Detected a change on the"
7848			       " RF Disable Input\n", wlc_hw->unit);
7849		brcms_rfkill_set_hw_state(wlc->wl);
7850	}
7851
7852	/* BCN template is available */
7853	if (macintstatus & MI_BCNTPL)
7854		brcms_c_update_beacon(wlc);
7855
7856	/* it isn't done and needs to be resched if macintstatus is non-zero */
7857	return wlc->macintstatus != 0;
7858
7859 fatal:
7860	brcms_fatal_error(wlc_hw->wlc->wl);
7861	return wlc->macintstatus != 0;
7862}
7863
7864void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx)
7865{
7866	struct bcma_device *core = wlc->hw->d11core;
7867	struct ieee80211_channel *ch = wlc->pub->ieee_hw->conf.chandef.chan;
7868	u16 chanspec;
7869
7870	brcms_dbg_info(core, "wl%d\n", wlc->pub->unit);
7871
7872	chanspec = ch20mhz_chspec(ch->hw_value);
7873
7874	brcms_b_init(wlc->hw, chanspec);
7875
7876	/* update beacon listen interval */
7877	brcms_c_bcn_li_upd(wlc);
7878
7879	/* write ethernet address to core */
7880	brcms_c_set_mac(wlc->bsscfg);
7881	brcms_c_set_bssid(wlc->bsscfg);
7882
7883	/* Update tsf_cfprep if associated and up */
7884	if (wlc->pub->associated && wlc->pub->up) {
7885		u32 bi;
7886
7887		/* get beacon period and convert to uS */
7888		bi = wlc->bsscfg->current_bss->beacon_period << 10;
7889		/*
7890		 * update since init path would reset
7891		 * to default value
7892		 */
7893		bcma_write32(core, D11REGOFFS(tsf_cfprep),
7894			     bi << CFPREP_CBI_SHIFT);
7895
7896		/* Update maccontrol PM related bits */
7897		brcms_c_set_ps_ctrl(wlc);
7898	}
7899
7900	brcms_c_bandinit_ordered(wlc, chanspec);
7901
7902	/* init probe response timeout */
7903	brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
7904
7905	/* init max burst txop (framebursting) */
7906	brcms_b_write_shm(wlc->hw, M_MBURST_TXOP,
7907		      (wlc->
7908		       _rifs ? (EDCF_AC_VO_TXOP_AP << 5) : MAXFRAMEBURST_TXOP));
7909
7910	/* initialize maximum allowed duty cycle */
7911	brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_ofdm, true, true);
7912	brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_cck, false, true);
7913
7914	/*
7915	 * Update some shared memory locations related to
7916	 * max AMPDU size allowed to received
7917	 */
7918	brcms_c_ampdu_shm_upd(wlc->ampdu);
7919
7920	/* band-specific inits */
7921	brcms_c_bsinit(wlc);
7922
7923	/* Enable EDCF mode (while the MAC is suspended) */
7924	bcma_set16(core, D11REGOFFS(ifs_ctl), IFS_USEEDCF);
7925	brcms_c_edcf_setparams(wlc, false);
7926
7927	/* read the ucode version if we have not yet done so */
7928	if (wlc->ucode_rev == 0) {
7929		u16 rev;
7930		u16 patch;
7931
7932		rev = brcms_b_read_shm(wlc->hw, M_BOM_REV_MAJOR);
7933		patch = brcms_b_read_shm(wlc->hw, M_BOM_REV_MINOR);
7934		wlc->ucode_rev = (rev << NBITS(u16)) | patch;
7935		snprintf(wlc->wiphy->fw_version,
7936			 sizeof(wlc->wiphy->fw_version), "%u.%u", rev, patch);
7937	}
7938
7939	/* ..now really unleash hell (allow the MAC out of suspend) */
7940	brcms_c_enable_mac(wlc);
7941
7942	/* suspend the tx fifos and mute the phy for preism cac time */
7943	if (mute_tx)
7944		brcms_b_mute(wlc->hw, true);
7945
7946	/* enable the RF Disable Delay timer */
7947	bcma_write32(core, D11REGOFFS(rfdisabledly), RFDISABLE_DEFAULT);
7948
7949	/*
7950	 * Initialize WME parameters; if they haven't been set by some other
7951	 * mechanism (IOVar, etc) then read them from the hardware.
7952	 */
7953	if (GFIELD(wlc->wme_retries[0], EDCF_SHORT) == 0) {
7954		/* Uninitialized; read from HW */
7955		int ac;
7956
7957		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
7958			wlc->wme_retries[ac] =
7959			    brcms_b_read_shm(wlc->hw, M_AC_TXLMT_ADDR(ac));
7960	}
7961}
7962
7963/*
7964 * The common driver entry routine. Error codes should be unique
7965 */
7966struct brcms_c_info *
7967brcms_c_attach(struct brcms_info *wl, struct bcma_device *core, uint unit,
7968	       bool piomode, uint *perr)
7969{
7970	struct brcms_c_info *wlc;
7971	uint err = 0;
7972	uint i, j;
7973	struct brcms_pub *pub;
7974
7975	/* allocate struct brcms_c_info state and its substructures */
7976	wlc = brcms_c_attach_malloc(unit, &err, 0);
7977	if (wlc == NULL)
7978		goto fail;
7979	wlc->wiphy = wl->wiphy;
7980	pub = wlc->pub;
7981
7982#if defined(DEBUG)
7983	wlc_info_dbg = wlc;
7984#endif
7985
7986	wlc->band = wlc->bandstate[0];
7987	wlc->core = wlc->corestate;
7988	wlc->wl = wl;
7989	pub->unit = unit;
7990	pub->_piomode = piomode;
7991	wlc->bandinit_pending = false;
7992	wlc->beacon_template_virgin = true;
7993
7994	/* populate struct brcms_c_info with default values  */
7995	brcms_c_info_init(wlc, unit);
7996
7997	/* update sta/ap related parameters */
7998	brcms_c_ap_upd(wlc);
7999
8000	/*
8001	 * low level attach steps(all hw accesses go
8002	 * inside, no more in rest of the attach)
8003	 */
8004	err = brcms_b_attach(wlc, core, unit, piomode);
8005	if (err)
8006		goto fail;
8007
8008	brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, OFF);
8009
8010	pub->phy_11ncapable = BRCMS_PHY_11N_CAP(wlc->band);
8011
8012	/* disable allowed duty cycle */
8013	wlc->tx_duty_cycle_ofdm = 0;
8014	wlc->tx_duty_cycle_cck = 0;
8015
8016	brcms_c_stf_phy_chain_calc(wlc);
8017
8018	/* txchain 1: txant 0, txchain 2: txant 1 */
8019	if (BRCMS_ISNPHY(wlc->band) && (wlc->stf->txstreams == 1))
8020		wlc->stf->txant = wlc->stf->hw_txchain - 1;
8021
8022	/* push to BMAC driver */
8023	wlc_phy_stf_chain_init(wlc->band->pi, wlc->stf->hw_txchain,
8024			       wlc->stf->hw_rxchain);
8025
8026	/* pull up some info resulting from the low attach */
8027	for (i = 0; i < NFIFO; i++)
8028		wlc->core->txavail[i] = wlc->hw->txavail[i];
8029
8030	memcpy(&wlc->perm_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
8031	memcpy(&pub->cur_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
8032
8033	for (j = 0; j < wlc->pub->_nbands; j++) {
8034		wlc->band = wlc->bandstate[j];
8035
8036		if (!brcms_c_attach_stf_ant_init(wlc)) {
8037			err = 24;
8038			goto fail;
8039		}
8040
8041		/* default contention windows size limits */
8042		wlc->band->CWmin = APHY_CWMIN;
8043		wlc->band->CWmax = PHY_CWMAX;
8044
8045		/* init gmode value */
8046		if (wlc->band->bandtype == BRCM_BAND_2G) {
8047			wlc->band->gmode = GMODE_AUTO;
8048			brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER,
8049					   wlc->band->gmode);
8050		}
8051
8052		/* init _n_enab supported mode */
8053		if (BRCMS_PHY_11N_CAP(wlc->band)) {
8054			pub->_n_enab = SUPPORT_11N;
8055			brcms_c_protection_upd(wlc, BRCMS_PROT_N_USER,
8056						   ((pub->_n_enab ==
8057						     SUPPORT_11N) ? WL_11N_2x2 :
8058						    WL_11N_3x3));
8059		}
8060
8061		/* init per-band default rateset, depend on band->gmode */
8062		brcms_default_rateset(wlc, &wlc->band->defrateset);
8063
8064		/* fill in hw_rateset */
8065		brcms_c_rateset_filter(&wlc->band->defrateset,
8066				   &wlc->band->hw_rateset, false,
8067				   BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
8068				   (bool) (wlc->pub->_n_enab & SUPPORT_11N));
8069	}
8070
8071	/*
8072	 * update antenna config due to
8073	 * wlc->stf->txant/txchain/ant_rx_ovr change
8074	 */
8075	brcms_c_stf_phy_txant_upd(wlc);
8076
8077	/* attach each modules */
8078	err = brcms_c_attach_module(wlc);
8079	if (err != 0)
8080		goto fail;
8081
8082	if (!brcms_c_timers_init(wlc, unit)) {
8083		wiphy_err(wl->wiphy, "wl%d: %s: init_timer failed\n", unit,
8084			  __func__);
8085		err = 32;
8086		goto fail;
8087	}
8088
8089	/* depend on rateset, gmode */
8090	wlc->cmi = brcms_c_channel_mgr_attach(wlc);
8091	if (!wlc->cmi) {
8092		wiphy_err(wl->wiphy, "wl%d: %s: channel_mgr_attach failed"
8093			  "\n", unit, __func__);
8094		err = 33;
8095		goto fail;
8096	}
8097
8098	/* init default when all parameters are ready, i.e. ->rateset */
8099	brcms_c_bss_default_init(wlc);
8100
8101	/*
8102	 * Complete the wlc default state initializations..
8103	 */
8104
8105	wlc->bsscfg->wlc = wlc;
8106
8107	wlc->mimoft = FT_HT;
8108	wlc->mimo_40txbw = AUTO;
8109	wlc->ofdm_40txbw = AUTO;
8110	wlc->cck_40txbw = AUTO;
8111	brcms_c_update_mimo_band_bwcap(wlc, BRCMS_N_BW_20IN2G_40IN5G);
8112
8113	/* Set default values of SGI */
8114	if (BRCMS_SGI_CAP_PHY(wlc)) {
8115		brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8116					       BRCMS_N_SGI_40));
8117	} else if (BRCMS_ISSSLPNPHY(wlc->band)) {
8118		brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8119					       BRCMS_N_SGI_40));
8120	} else {
8121		brcms_c_ht_update_sgi_rx(wlc, 0);
8122	}
8123
8124	brcms_b_antsel_set(wlc->hw, wlc->asi->antsel_avail);
8125
8126	if (perr)
8127		*perr = 0;
8128
8129	return wlc;
8130
8131 fail:
8132	wiphy_err(wl->wiphy, "wl%d: %s: failed with err %d\n",
8133		  unit, __func__, err);
8134	if (wlc)
8135		brcms_c_detach(wlc);
8136
8137	if (perr)
8138		*perr = err;
8139	return NULL;
8140}
8141