xref: /linux/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.c (revision e5c86679d5e864947a52fb31e45a425dea3e7fa9)
1 /*
2  * Copyright (c) 2010 Broadcom Corporation
3  * Copyright (c) 2013 Hauke Mehrtens <hauke@hauke-m.de>
4  *
5  * Permission to use, copy, modify, and/or distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
12  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
14  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
15  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
19 
20 #include <linux/pci_ids.h>
21 #include <linux/if_ether.h>
22 #include <net/cfg80211.h>
23 #include <net/mac80211.h>
24 #include <brcm_hw_ids.h>
25 #include <aiutils.h>
26 #include <chipcommon.h>
27 #include "rate.h"
28 #include "scb.h"
29 #include "phy/phy_hal.h"
30 #include "channel.h"
31 #include "antsel.h"
32 #include "stf.h"
33 #include "ampdu.h"
34 #include "mac80211_if.h"
35 #include "ucode_loader.h"
36 #include "main.h"
37 #include "soc.h"
38 #include "dma.h"
39 #include "debug.h"
40 #include "brcms_trace_events.h"
41 
42 /* watchdog timer, in unit of ms */
43 #define TIMER_INTERVAL_WATCHDOG		1000
44 /* radio monitor timer, in unit of ms */
45 #define TIMER_INTERVAL_RADIOCHK		800
46 
47 /* beacon interval, in unit of 1024TU */
48 #define BEACON_INTERVAL_DEFAULT		100
49 
50 /* n-mode support capability */
51 /* 2x2 includes both 1x1 & 2x2 devices
52  * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
53  * control it independently
54  */
55 #define WL_11N_2x2			1
56 #define WL_11N_3x3			3
57 #define WL_11N_4x4			4
58 
59 #define EDCF_ACI_MASK			0x60
60 #define EDCF_ACI_SHIFT			5
61 #define EDCF_ECWMIN_MASK		0x0f
62 #define EDCF_ECWMAX_SHIFT		4
63 #define EDCF_AIFSN_MASK			0x0f
64 #define EDCF_AIFSN_MAX			15
65 #define EDCF_ECWMAX_MASK		0xf0
66 
67 #define EDCF_AC_BE_TXOP_STA		0x0000
68 #define EDCF_AC_BK_TXOP_STA		0x0000
69 #define EDCF_AC_VO_ACI_STA		0x62
70 #define EDCF_AC_VO_ECW_STA		0x32
71 #define EDCF_AC_VI_ACI_STA		0x42
72 #define EDCF_AC_VI_ECW_STA		0x43
73 #define EDCF_AC_BK_ECW_STA		0xA4
74 #define EDCF_AC_VI_TXOP_STA		0x005e
75 #define EDCF_AC_VO_TXOP_STA		0x002f
76 #define EDCF_AC_BE_ACI_STA		0x03
77 #define EDCF_AC_BE_ECW_STA		0xA4
78 #define EDCF_AC_BK_ACI_STA		0x27
79 #define EDCF_AC_VO_TXOP_AP		0x002f
80 
81 #define EDCF_TXOP2USEC(txop)		((txop) << 5)
82 #define EDCF_ECW2CW(exp)		((1 << (exp)) - 1)
83 
84 #define APHY_SYMBOL_TIME		4
85 #define APHY_PREAMBLE_TIME		16
86 #define APHY_SIGNAL_TIME		4
87 #define APHY_SIFS_TIME			16
88 #define APHY_SERVICE_NBITS		16
89 #define APHY_TAIL_NBITS			6
90 #define BPHY_SIFS_TIME			10
91 #define BPHY_PLCP_SHORT_TIME		96
92 
93 #define PREN_PREAMBLE			24
94 #define PREN_MM_EXT			12
95 #define PREN_PREAMBLE_EXT		4
96 
97 #define DOT11_MAC_HDR_LEN		24
98 #define DOT11_ACK_LEN			10
99 #define DOT11_BA_LEN			4
100 #define DOT11_OFDM_SIGNAL_EXTENSION	6
101 #define DOT11_MIN_FRAG_LEN		256
102 #define DOT11_RTS_LEN			16
103 #define DOT11_CTS_LEN			10
104 #define DOT11_BA_BITMAP_LEN		128
105 #define DOT11_MAXNUMFRAGS		16
106 #define DOT11_MAX_FRAG_LEN		2346
107 
108 #define BPHY_PLCP_TIME			192
109 #define RIFS_11N_TIME			2
110 
111 /* length of the BCN template area */
112 #define BCN_TMPL_LEN			512
113 
114 /* brcms_bss_info flag bit values */
115 #define BRCMS_BSS_HT			0x0020	/* BSS is HT (MIMO) capable */
116 
117 /* chip rx buffer offset */
118 #define BRCMS_HWRXOFF			38
119 
120 /* rfdisable delay timer 500 ms, runs of ALP clock */
121 #define RFDISABLE_DEFAULT		10000000
122 
123 #define BRCMS_TEMPSENSE_PERIOD		10	/* 10 second timeout */
124 
125 /* synthpu_dly times in us */
126 #define SYNTHPU_DLY_APHY_US		3700
127 #define SYNTHPU_DLY_BPHY_US		1050
128 #define SYNTHPU_DLY_NPHY_US		2048
129 #define SYNTHPU_DLY_LPPHY_US		300
130 
131 #define ANTCNT				10	/* vanilla M_MAX_ANTCNT val */
132 
133 /* Per-AC retry limit register definitions; uses defs.h bitfield macros */
134 #define EDCF_SHORT_S			0
135 #define EDCF_SFB_S			4
136 #define EDCF_LONG_S			8
137 #define EDCF_LFB_S			12
138 #define EDCF_SHORT_M			BITFIELD_MASK(4)
139 #define EDCF_SFB_M			BITFIELD_MASK(4)
140 #define EDCF_LONG_M			BITFIELD_MASK(4)
141 #define EDCF_LFB_M			BITFIELD_MASK(4)
142 
143 #define RETRY_SHORT_DEF			7	/* Default Short retry Limit */
144 #define RETRY_SHORT_MAX			255	/* Maximum Short retry Limit */
145 #define RETRY_LONG_DEF			4	/* Default Long retry count */
146 #define RETRY_SHORT_FB			3	/* Short count for fb rate */
147 #define RETRY_LONG_FB			2	/* Long count for fb rate */
148 
149 #define APHY_CWMIN			15
150 #define PHY_CWMAX			1023
151 
152 #define EDCF_AIFSN_MIN			1
153 
154 #define FRAGNUM_MASK			0xF
155 
156 #define APHY_SLOT_TIME			9
157 #define BPHY_SLOT_TIME			20
158 
159 #define WL_SPURAVOID_OFF		0
160 #define WL_SPURAVOID_ON1		1
161 #define WL_SPURAVOID_ON2		2
162 
163 /* invalid core flags, use the saved coreflags */
164 #define BRCMS_USE_COREFLAGS		0xffffffff
165 
166 /* values for PLCPHdr_override */
167 #define BRCMS_PLCP_AUTO			-1
168 #define BRCMS_PLCP_SHORT		0
169 #define BRCMS_PLCP_LONG			1
170 
171 /* values for g_protection_override and n_protection_override */
172 #define BRCMS_PROTECTION_AUTO		-1
173 #define BRCMS_PROTECTION_OFF		0
174 #define BRCMS_PROTECTION_ON		1
175 #define BRCMS_PROTECTION_MMHDR_ONLY	2
176 #define BRCMS_PROTECTION_CTS_ONLY	3
177 
178 /* values for g_protection_control and n_protection_control */
179 #define BRCMS_PROTECTION_CTL_OFF	0
180 #define BRCMS_PROTECTION_CTL_LOCAL	1
181 #define BRCMS_PROTECTION_CTL_OVERLAP	2
182 
183 /* values for n_protection */
184 #define BRCMS_N_PROTECTION_OFF		0
185 #define BRCMS_N_PROTECTION_OPTIONAL	1
186 #define BRCMS_N_PROTECTION_20IN40	2
187 #define BRCMS_N_PROTECTION_MIXEDMODE	3
188 
189 /* values for band specific 40MHz capabilities */
190 #define BRCMS_N_BW_20ALL		0
191 #define BRCMS_N_BW_40ALL		1
192 #define BRCMS_N_BW_20IN2G_40IN5G	2
193 
194 /* bitflags for SGI support (sgi_rx iovar) */
195 #define BRCMS_N_SGI_20			0x01
196 #define BRCMS_N_SGI_40			0x02
197 
198 /* defines used by the nrate iovar */
199 /* MSC in use,indicates b0-6 holds an mcs */
200 #define NRATE_MCS_INUSE			0x00000080
201 /* rate/mcs value */
202 #define NRATE_RATE_MASK			0x0000007f
203 /* stf mode mask: siso, cdd, stbc, sdm */
204 #define NRATE_STF_MASK			0x0000ff00
205 /* stf mode shift */
206 #define NRATE_STF_SHIFT			8
207 /* bit indicate to override mcs only */
208 #define NRATE_OVERRIDE_MCS_ONLY		0x40000000
209 #define NRATE_SGI_MASK			0x00800000	/* sgi mode */
210 #define NRATE_SGI_SHIFT			23		/* sgi mode */
211 #define NRATE_LDPC_CODING		0x00400000	/* adv coding in use */
212 #define NRATE_LDPC_SHIFT		22		/* ldpc shift */
213 
214 #define NRATE_STF_SISO			0		/* stf mode SISO */
215 #define NRATE_STF_CDD			1		/* stf mode CDD */
216 #define NRATE_STF_STBC			2		/* stf mode STBC */
217 #define NRATE_STF_SDM			3		/* stf mode SDM */
218 
219 #define MAX_DMA_SEGS			4
220 
221 /* # of entries in Tx FIFO */
222 #define NTXD				64
223 /* Max # of entries in Rx FIFO based on 4kb page size */
224 #define NRXD				256
225 
226 /* Amount of headroom to leave in Tx FIFO */
227 #define TX_HEADROOM			4
228 
229 /* try to keep this # rbufs posted to the chip */
230 #define NRXBUFPOST			32
231 
232 /* max # frames to process in brcms_c_recv() */
233 #define RXBND				8
234 /* max # tx status to process in wlc_txstatus() */
235 #define TXSBND				8
236 
237 /* brcmu_format_flags() bit description structure */
238 struct brcms_c_bit_desc {
239 	u32 bit;
240 	const char *name;
241 };
242 
243 /*
244  * The following table lists the buffer memory allocated to xmt fifos in HW.
245  * the size is in units of 256bytes(one block), total size is HW dependent
246  * ucode has default fifo partition, sw can overwrite if necessary
247  *
248  * This is documented in twiki under the topic UcodeTxFifo. Please ensure
249  * the twiki is updated before making changes.
250  */
251 
252 /* Starting corerev for the fifo size table */
253 #define XMTFIFOTBL_STARTREV	17
254 
255 struct d11init {
256 	__le16 addr;
257 	__le16 size;
258 	__le32 value;
259 };
260 
261 struct edcf_acparam {
262 	u8 ACI;
263 	u8 ECW;
264 	u16 TXOP;
265 } __packed;
266 
267 /* debug/trace */
268 uint brcm_msg_level;
269 
270 /* TX FIFO number to WME/802.1E Access Category */
271 static const u8 wme_fifo2ac[] = {
272 	IEEE80211_AC_BK,
273 	IEEE80211_AC_BE,
274 	IEEE80211_AC_VI,
275 	IEEE80211_AC_VO,
276 	IEEE80211_AC_BE,
277 	IEEE80211_AC_BE
278 };
279 
280 /* ieee80211 Access Category to TX FIFO number */
281 static const u8 wme_ac2fifo[] = {
282 	TX_AC_VO_FIFO,
283 	TX_AC_VI_FIFO,
284 	TX_AC_BE_FIFO,
285 	TX_AC_BK_FIFO
286 };
287 
288 static const u16 xmtfifo_sz[][NFIFO] = {
289 	/* corerev 17: 5120, 49152, 49152, 5376, 4352, 1280 */
290 	{20, 192, 192, 21, 17, 5},
291 	/* corerev 18: */
292 	{0, 0, 0, 0, 0, 0},
293 	/* corerev 19: */
294 	{0, 0, 0, 0, 0, 0},
295 	/* corerev 20: 5120, 49152, 49152, 5376, 4352, 1280 */
296 	{20, 192, 192, 21, 17, 5},
297 	/* corerev 21: 2304, 14848, 5632, 3584, 3584, 1280 */
298 	{9, 58, 22, 14, 14, 5},
299 	/* corerev 22: 5120, 49152, 49152, 5376, 4352, 1280 */
300 	{20, 192, 192, 21, 17, 5},
301 	/* corerev 23: 5120, 49152, 49152, 5376, 4352, 1280 */
302 	{20, 192, 192, 21, 17, 5},
303 	/* corerev 24: 2304, 14848, 5632, 3584, 3584, 1280 */
304 	{9, 58, 22, 14, 14, 5},
305 	/* corerev 25: */
306 	{0, 0, 0, 0, 0, 0},
307 	/* corerev 26: */
308 	{0, 0, 0, 0, 0, 0},
309 	/* corerev 27: */
310 	{0, 0, 0, 0, 0, 0},
311 	/* corerev 28: 2304, 14848, 5632, 3584, 3584, 1280 */
312 	{9, 58, 22, 14, 14, 5},
313 };
314 
315 #ifdef DEBUG
316 static const char * const fifo_names[] = {
317 	"AC_BK", "AC_BE", "AC_VI", "AC_VO", "BCMC", "ATIM" };
318 #else
319 static const char fifo_names[6][1];
320 #endif
321 
322 #ifdef DEBUG
323 /* pointer to most recently allocated wl/wlc */
324 static struct brcms_c_info *wlc_info_dbg = (struct brcms_c_info *) (NULL);
325 #endif
326 
327 /* Mapping of ieee80211 AC numbers to tx fifos */
328 static const u8 ac_to_fifo_mapping[IEEE80211_NUM_ACS] = {
329 	[IEEE80211_AC_VO]	= TX_AC_VO_FIFO,
330 	[IEEE80211_AC_VI]	= TX_AC_VI_FIFO,
331 	[IEEE80211_AC_BE]	= TX_AC_BE_FIFO,
332 	[IEEE80211_AC_BK]	= TX_AC_BK_FIFO,
333 };
334 
335 /* Mapping of tx fifos to ieee80211 AC numbers */
336 static const u8 fifo_to_ac_mapping[IEEE80211_NUM_ACS] = {
337 	[TX_AC_BK_FIFO]	= IEEE80211_AC_BK,
338 	[TX_AC_BE_FIFO]	= IEEE80211_AC_BE,
339 	[TX_AC_VI_FIFO]	= IEEE80211_AC_VI,
340 	[TX_AC_VO_FIFO]	= IEEE80211_AC_VO,
341 };
342 
343 static u8 brcms_ac_to_fifo(u8 ac)
344 {
345 	if (ac >= ARRAY_SIZE(ac_to_fifo_mapping))
346 		return TX_AC_BE_FIFO;
347 	return ac_to_fifo_mapping[ac];
348 }
349 
350 static u8 brcms_fifo_to_ac(u8 fifo)
351 {
352 	if (fifo >= ARRAY_SIZE(fifo_to_ac_mapping))
353 		return IEEE80211_AC_BE;
354 	return fifo_to_ac_mapping[fifo];
355 }
356 
357 /* Find basic rate for a given rate */
358 static u8 brcms_basic_rate(struct brcms_c_info *wlc, u32 rspec)
359 {
360 	if (is_mcs_rate(rspec))
361 		return wlc->band->basic_rate[mcs_table[rspec & RSPEC_RATE_MASK]
362 		       .leg_ofdm];
363 	return wlc->band->basic_rate[rspec & RSPEC_RATE_MASK];
364 }
365 
366 static u16 frametype(u32 rspec, u8 mimoframe)
367 {
368 	if (is_mcs_rate(rspec))
369 		return mimoframe;
370 	return is_cck_rate(rspec) ? FT_CCK : FT_OFDM;
371 }
372 
373 /* currently the best mechanism for determining SIFS is the band in use */
374 static u16 get_sifs(struct brcms_band *band)
375 {
376 	return band->bandtype == BRCM_BAND_5G ? APHY_SIFS_TIME :
377 				 BPHY_SIFS_TIME;
378 }
379 
380 /*
381  * Detect Card removed.
382  * Even checking an sbconfig register read will not false trigger when the core
383  * is in reset it breaks CF address mechanism. Accessing gphy phyversion will
384  * cause SB error if aphy is in reset on 4306B0-DB. Need a simple accessible
385  * reg with fixed 0/1 pattern (some platforms return all 0).
386  * If clocks are present, call the sb routine which will figure out if the
387  * device is removed.
388  */
389 static bool brcms_deviceremoved(struct brcms_c_info *wlc)
390 {
391 	u32 macctrl;
392 
393 	if (!wlc->hw->clk)
394 		return ai_deviceremoved(wlc->hw->sih);
395 	macctrl = bcma_read32(wlc->hw->d11core,
396 			      D11REGOFFS(maccontrol));
397 	return (macctrl & (MCTL_PSM_JMP_0 | MCTL_IHR_EN)) != MCTL_IHR_EN;
398 }
399 
400 /* sum the individual fifo tx pending packet counts */
401 static int brcms_txpktpendtot(struct brcms_c_info *wlc)
402 {
403 	int i;
404 	int pending = 0;
405 
406 	for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
407 		if (wlc->hw->di[i])
408 			pending += dma_txpending(wlc->hw->di[i]);
409 	return pending;
410 }
411 
412 static bool brcms_is_mband_unlocked(struct brcms_c_info *wlc)
413 {
414 	return wlc->pub->_nbands > 1 && !wlc->bandlocked;
415 }
416 
417 static int brcms_chspec_bw(u16 chanspec)
418 {
419 	if (CHSPEC_IS40(chanspec))
420 		return BRCMS_40_MHZ;
421 	if (CHSPEC_IS20(chanspec))
422 		return BRCMS_20_MHZ;
423 
424 	return BRCMS_10_MHZ;
425 }
426 
427 static void brcms_c_bsscfg_mfree(struct brcms_bss_cfg *cfg)
428 {
429 	if (cfg == NULL)
430 		return;
431 
432 	kfree(cfg->current_bss);
433 	kfree(cfg);
434 }
435 
436 static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
437 {
438 	if (wlc == NULL)
439 		return;
440 
441 	brcms_c_bsscfg_mfree(wlc->bsscfg);
442 	kfree(wlc->pub);
443 	kfree(wlc->modulecb);
444 	kfree(wlc->default_bss);
445 	kfree(wlc->protection);
446 	kfree(wlc->stf);
447 	kfree(wlc->bandstate[0]);
448 	if (wlc->corestate)
449 		kfree(wlc->corestate->macstat_snapshot);
450 	kfree(wlc->corestate);
451 	if (wlc->hw)
452 		kfree(wlc->hw->bandstate[0]);
453 	kfree(wlc->hw);
454 	if (wlc->beacon)
455 		dev_kfree_skb_any(wlc->beacon);
456 	if (wlc->probe_resp)
457 		dev_kfree_skb_any(wlc->probe_resp);
458 
459 	kfree(wlc);
460 }
461 
462 static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
463 {
464 	struct brcms_bss_cfg *cfg;
465 
466 	cfg = kzalloc(sizeof(struct brcms_bss_cfg), GFP_ATOMIC);
467 	if (cfg == NULL)
468 		goto fail;
469 
470 	cfg->current_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
471 	if (cfg->current_bss == NULL)
472 		goto fail;
473 
474 	return cfg;
475 
476  fail:
477 	brcms_c_bsscfg_mfree(cfg);
478 	return NULL;
479 }
480 
481 static struct brcms_c_info *
482 brcms_c_attach_malloc(uint unit, uint *err, uint devid)
483 {
484 	struct brcms_c_info *wlc;
485 
486 	wlc = kzalloc(sizeof(struct brcms_c_info), GFP_ATOMIC);
487 	if (wlc == NULL) {
488 		*err = 1002;
489 		goto fail;
490 	}
491 
492 	/* allocate struct brcms_c_pub state structure */
493 	wlc->pub = kzalloc(sizeof(struct brcms_pub), GFP_ATOMIC);
494 	if (wlc->pub == NULL) {
495 		*err = 1003;
496 		goto fail;
497 	}
498 	wlc->pub->wlc = wlc;
499 
500 	/* allocate struct brcms_hardware state structure */
501 
502 	wlc->hw = kzalloc(sizeof(struct brcms_hardware), GFP_ATOMIC);
503 	if (wlc->hw == NULL) {
504 		*err = 1005;
505 		goto fail;
506 	}
507 	wlc->hw->wlc = wlc;
508 
509 	wlc->hw->bandstate[0] =
510 		kzalloc(sizeof(struct brcms_hw_band) * MAXBANDS, GFP_ATOMIC);
511 	if (wlc->hw->bandstate[0] == NULL) {
512 		*err = 1006;
513 		goto fail;
514 	} else {
515 		int i;
516 
517 		for (i = 1; i < MAXBANDS; i++)
518 			wlc->hw->bandstate[i] = (struct brcms_hw_band *)
519 			    ((unsigned long)wlc->hw->bandstate[0] +
520 			     (sizeof(struct brcms_hw_band) * i));
521 	}
522 
523 	wlc->modulecb =
524 		kzalloc(sizeof(struct modulecb) * BRCMS_MAXMODULES, GFP_ATOMIC);
525 	if (wlc->modulecb == NULL) {
526 		*err = 1009;
527 		goto fail;
528 	}
529 
530 	wlc->default_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
531 	if (wlc->default_bss == NULL) {
532 		*err = 1010;
533 		goto fail;
534 	}
535 
536 	wlc->bsscfg = brcms_c_bsscfg_malloc(unit);
537 	if (wlc->bsscfg == NULL) {
538 		*err = 1011;
539 		goto fail;
540 	}
541 
542 	wlc->protection = kzalloc(sizeof(struct brcms_protection),
543 				  GFP_ATOMIC);
544 	if (wlc->protection == NULL) {
545 		*err = 1016;
546 		goto fail;
547 	}
548 
549 	wlc->stf = kzalloc(sizeof(struct brcms_stf), GFP_ATOMIC);
550 	if (wlc->stf == NULL) {
551 		*err = 1017;
552 		goto fail;
553 	}
554 
555 	wlc->bandstate[0] =
556 		kzalloc(sizeof(struct brcms_band)*MAXBANDS, GFP_ATOMIC);
557 	if (wlc->bandstate[0] == NULL) {
558 		*err = 1025;
559 		goto fail;
560 	} else {
561 		int i;
562 
563 		for (i = 1; i < MAXBANDS; i++)
564 			wlc->bandstate[i] = (struct brcms_band *)
565 				((unsigned long)wlc->bandstate[0]
566 				+ (sizeof(struct brcms_band)*i));
567 	}
568 
569 	wlc->corestate = kzalloc(sizeof(struct brcms_core), GFP_ATOMIC);
570 	if (wlc->corestate == NULL) {
571 		*err = 1026;
572 		goto fail;
573 	}
574 
575 	wlc->corestate->macstat_snapshot =
576 		kzalloc(sizeof(struct macstat), GFP_ATOMIC);
577 	if (wlc->corestate->macstat_snapshot == NULL) {
578 		*err = 1027;
579 		goto fail;
580 	}
581 
582 	return wlc;
583 
584  fail:
585 	brcms_c_detach_mfree(wlc);
586 	return NULL;
587 }
588 
589 /*
590  * Update the slot timing for standard 11b/g (20us slots)
591  * or shortslot 11g (9us slots)
592  * The PSM needs to be suspended for this call.
593  */
594 static void brcms_b_update_slot_timing(struct brcms_hardware *wlc_hw,
595 					bool shortslot)
596 {
597 	struct bcma_device *core = wlc_hw->d11core;
598 
599 	if (shortslot) {
600 		/* 11g short slot: 11a timing */
601 		bcma_write16(core, D11REGOFFS(ifs_slot), 0x0207);
602 		brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, APHY_SLOT_TIME);
603 	} else {
604 		/* 11g long slot: 11b timing */
605 		bcma_write16(core, D11REGOFFS(ifs_slot), 0x0212);
606 		brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, BPHY_SLOT_TIME);
607 	}
608 }
609 
610 /*
611  * calculate frame duration of a given rate and length, return
612  * time in usec unit
613  */
614 static uint brcms_c_calc_frame_time(struct brcms_c_info *wlc, u32 ratespec,
615 				    u8 preamble_type, uint mac_len)
616 {
617 	uint nsyms, dur = 0, Ndps, kNdps;
618 	uint rate = rspec2rate(ratespec);
619 
620 	if (rate == 0) {
621 		brcms_err(wlc->hw->d11core, "wl%d: WAR: using rate of 1 mbps\n",
622 			  wlc->pub->unit);
623 		rate = BRCM_RATE_1M;
624 	}
625 
626 	if (is_mcs_rate(ratespec)) {
627 		uint mcs = ratespec & RSPEC_RATE_MASK;
628 		int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
629 
630 		dur = PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
631 		if (preamble_type == BRCMS_MM_PREAMBLE)
632 			dur += PREN_MM_EXT;
633 		/* 1000Ndbps = kbps * 4 */
634 		kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
635 				   rspec_issgi(ratespec)) * 4;
636 
637 		if (rspec_stc(ratespec) == 0)
638 			nsyms =
639 			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
640 				  APHY_TAIL_NBITS) * 1000, kNdps);
641 		else
642 			/* STBC needs to have even number of symbols */
643 			nsyms =
644 			    2 *
645 			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
646 				  APHY_TAIL_NBITS) * 1000, 2 * kNdps);
647 
648 		dur += APHY_SYMBOL_TIME * nsyms;
649 		if (wlc->band->bandtype == BRCM_BAND_2G)
650 			dur += DOT11_OFDM_SIGNAL_EXTENSION;
651 	} else if (is_ofdm_rate(rate)) {
652 		dur = APHY_PREAMBLE_TIME;
653 		dur += APHY_SIGNAL_TIME;
654 		/* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
655 		Ndps = rate * 2;
656 		/* NSyms = CEILING((SERVICE + 8*NBytes + TAIL) / Ndbps) */
657 		nsyms =
658 		    CEIL((APHY_SERVICE_NBITS + 8 * mac_len + APHY_TAIL_NBITS),
659 			 Ndps);
660 		dur += APHY_SYMBOL_TIME * nsyms;
661 		if (wlc->band->bandtype == BRCM_BAND_2G)
662 			dur += DOT11_OFDM_SIGNAL_EXTENSION;
663 	} else {
664 		/*
665 		 * calc # bits * 2 so factor of 2 in rate (1/2 mbps)
666 		 * will divide out
667 		 */
668 		mac_len = mac_len * 8 * 2;
669 		/* calc ceiling of bits/rate = microseconds of air time */
670 		dur = (mac_len + rate - 1) / rate;
671 		if (preamble_type & BRCMS_SHORT_PREAMBLE)
672 			dur += BPHY_PLCP_SHORT_TIME;
673 		else
674 			dur += BPHY_PLCP_TIME;
675 	}
676 	return dur;
677 }
678 
679 static void brcms_c_write_inits(struct brcms_hardware *wlc_hw,
680 				const struct d11init *inits)
681 {
682 	struct bcma_device *core = wlc_hw->d11core;
683 	int i;
684 	uint offset;
685 	u16 size;
686 	u32 value;
687 
688 	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
689 
690 	for (i = 0; inits[i].addr != cpu_to_le16(0xffff); i++) {
691 		size = le16_to_cpu(inits[i].size);
692 		offset = le16_to_cpu(inits[i].addr);
693 		value = le32_to_cpu(inits[i].value);
694 		if (size == 2)
695 			bcma_write16(core, offset, value);
696 		else if (size == 4)
697 			bcma_write32(core, offset, value);
698 		else
699 			break;
700 	}
701 }
702 
703 static void brcms_c_write_mhf(struct brcms_hardware *wlc_hw, u16 *mhfs)
704 {
705 	u8 idx;
706 	u16 addr[] = {
707 		M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
708 		M_HOST_FLAGS5
709 	};
710 
711 	for (idx = 0; idx < MHFMAX; idx++)
712 		brcms_b_write_shm(wlc_hw, addr[idx], mhfs[idx]);
713 }
714 
715 static void brcms_c_ucode_bsinit(struct brcms_hardware *wlc_hw)
716 {
717 	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
718 
719 	/* init microcode host flags */
720 	brcms_c_write_mhf(wlc_hw, wlc_hw->band->mhfs);
721 
722 	/* do band-specific ucode IHR, SHM, and SCR inits */
723 	if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
724 		if (BRCMS_ISNPHY(wlc_hw->band))
725 			brcms_c_write_inits(wlc_hw, ucode->d11n0bsinitvals16);
726 		else
727 			brcms_err(wlc_hw->d11core,
728 				  "%s: wl%d: unsupported phy in corerev %d\n",
729 				  __func__, wlc_hw->unit,
730 				  wlc_hw->corerev);
731 	} else {
732 		if (D11REV_IS(wlc_hw->corerev, 24)) {
733 			if (BRCMS_ISLCNPHY(wlc_hw->band))
734 				brcms_c_write_inits(wlc_hw,
735 						    ucode->d11lcn0bsinitvals24);
736 			else
737 				brcms_err(wlc_hw->d11core,
738 					  "%s: wl%d: unsupported phy in core rev %d\n",
739 					  __func__, wlc_hw->unit,
740 					  wlc_hw->corerev);
741 		} else {
742 			brcms_err(wlc_hw->d11core,
743 				  "%s: wl%d: unsupported corerev %d\n",
744 				  __func__, wlc_hw->unit, wlc_hw->corerev);
745 		}
746 	}
747 }
748 
749 static void brcms_b_core_ioctl(struct brcms_hardware *wlc_hw, u32 m, u32 v)
750 {
751 	struct bcma_device *core = wlc_hw->d11core;
752 	u32 ioctl = bcma_aread32(core, BCMA_IOCTL) & ~m;
753 
754 	bcma_awrite32(core, BCMA_IOCTL, ioctl | v);
755 }
756 
757 static void brcms_b_core_phy_clk(struct brcms_hardware *wlc_hw, bool clk)
758 {
759 	brcms_dbg_info(wlc_hw->d11core, "wl%d: clk %d\n", wlc_hw->unit, clk);
760 
761 	wlc_hw->phyclk = clk;
762 
763 	if (OFF == clk) {	/* clear gmode bit, put phy into reset */
764 
765 		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC | SICF_GMODE),
766 				   (SICF_PRST | SICF_FGC));
767 		udelay(1);
768 		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_PRST);
769 		udelay(1);
770 
771 	} else {		/* take phy out of reset */
772 
773 		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_FGC);
774 		udelay(1);
775 		brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
776 		udelay(1);
777 
778 	}
779 }
780 
781 /* low-level band switch utility routine */
782 static void brcms_c_setxband(struct brcms_hardware *wlc_hw, uint bandunit)
783 {
784 	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
785 			   bandunit);
786 
787 	wlc_hw->band = wlc_hw->bandstate[bandunit];
788 
789 	/*
790 	 * BMAC_NOTE:
791 	 *   until we eliminate need for wlc->band refs in low level code
792 	 */
793 	wlc_hw->wlc->band = wlc_hw->wlc->bandstate[bandunit];
794 
795 	/* set gmode core flag */
796 	if (wlc_hw->sbclk && !wlc_hw->noreset) {
797 		u32 gmode = 0;
798 
799 		if (bandunit == 0)
800 			gmode = SICF_GMODE;
801 
802 		brcms_b_core_ioctl(wlc_hw, SICF_GMODE, gmode);
803 	}
804 }
805 
806 /* switch to new band but leave it inactive */
807 static u32 brcms_c_setband_inact(struct brcms_c_info *wlc, uint bandunit)
808 {
809 	struct brcms_hardware *wlc_hw = wlc->hw;
810 	u32 macintmask;
811 	u32 macctrl;
812 
813 	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
814 	macctrl = bcma_read32(wlc_hw->d11core,
815 			      D11REGOFFS(maccontrol));
816 	WARN_ON((macctrl & MCTL_EN_MAC) != 0);
817 
818 	/* disable interrupts */
819 	macintmask = brcms_intrsoff(wlc->wl);
820 
821 	/* radio off */
822 	wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
823 
824 	brcms_b_core_phy_clk(wlc_hw, OFF);
825 
826 	brcms_c_setxband(wlc_hw, bandunit);
827 
828 	return macintmask;
829 }
830 
831 /* process an individual struct tx_status */
832 static bool
833 brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
834 {
835 	struct sk_buff *p = NULL;
836 	uint queue = NFIFO;
837 	struct dma_pub *dma = NULL;
838 	struct d11txh *txh = NULL;
839 	struct scb *scb = NULL;
840 	bool free_pdu;
841 	int tx_rts, tx_frame_count, tx_rts_count;
842 	uint totlen, supr_status;
843 	bool lastframe;
844 	struct ieee80211_hdr *h;
845 	u16 mcl;
846 	struct ieee80211_tx_info *tx_info;
847 	struct ieee80211_tx_rate *txrate;
848 	int i;
849 	bool fatal = true;
850 
851 	trace_brcms_txstatus(&wlc->hw->d11core->dev, txs->framelen,
852 			     txs->frameid, txs->status, txs->lasttxtime,
853 			     txs->sequence, txs->phyerr, txs->ackphyrxsh);
854 
855 	/* discard intermediate indications for ucode with one legitimate case:
856 	 *   e.g. if "useRTS" is set. ucode did a successful rts/cts exchange,
857 	 *   but the subsequent tx of DATA failed. so it will start rts/cts
858 	 *   from the beginning (resetting the rts transmission count)
859 	 */
860 	if (!(txs->status & TX_STATUS_AMPDU)
861 	    && (txs->status & TX_STATUS_INTERMEDIATE)) {
862 		brcms_dbg_tx(wlc->hw->d11core, "INTERMEDIATE but not AMPDU\n");
863 		fatal = false;
864 		goto out;
865 	}
866 
867 	queue = txs->frameid & TXFID_QUEUE_MASK;
868 	if (queue >= NFIFO) {
869 		brcms_err(wlc->hw->d11core, "queue %u >= NFIFO\n", queue);
870 		goto out;
871 	}
872 
873 	dma = wlc->hw->di[queue];
874 
875 	p = dma_getnexttxp(wlc->hw->di[queue], DMA_RANGE_TRANSMITTED);
876 	if (p == NULL) {
877 		brcms_err(wlc->hw->d11core, "dma_getnexttxp returned null!\n");
878 		goto out;
879 	}
880 
881 	txh = (struct d11txh *) (p->data);
882 	mcl = le16_to_cpu(txh->MacTxControlLow);
883 
884 	if (txs->phyerr)
885 		brcms_dbg_tx(wlc->hw->d11core, "phyerr 0x%x, rate 0x%x\n",
886 			     txs->phyerr, txh->MainRates);
887 
888 	if (txs->frameid != le16_to_cpu(txh->TxFrameID)) {
889 		brcms_err(wlc->hw->d11core, "frameid != txh->TxFrameID\n");
890 		goto out;
891 	}
892 	tx_info = IEEE80211_SKB_CB(p);
893 	h = (struct ieee80211_hdr *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN);
894 
895 	if (tx_info->rate_driver_data[0])
896 		scb = &wlc->pri_scb;
897 
898 	if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
899 		brcms_c_ampdu_dotxstatus(wlc->ampdu, scb, p, txs);
900 		fatal = false;
901 		goto out;
902 	}
903 
904 	/*
905 	 * brcms_c_ampdu_dotxstatus() will trace tx descriptors for AMPDU
906 	 * frames; this traces them for the rest.
907 	 */
908 	trace_brcms_txdesc(&wlc->hw->d11core->dev, txh, sizeof(*txh));
909 
910 	supr_status = txs->status & TX_STATUS_SUPR_MASK;
911 	if (supr_status == TX_STATUS_SUPR_BADCH) {
912 		unsigned xfts = le16_to_cpu(txh->XtraFrameTypes);
913 		brcms_dbg_tx(wlc->hw->d11core,
914 			     "Pkt tx suppressed, dest chan %u, current %d\n",
915 			     (xfts >> XFTS_CHANNEL_SHIFT) & 0xff,
916 			     CHSPEC_CHANNEL(wlc->default_bss->chanspec));
917 	}
918 
919 	tx_rts = le16_to_cpu(txh->MacTxControlLow) & TXC_SENDRTS;
920 	tx_frame_count =
921 	    (txs->status & TX_STATUS_FRM_RTX_MASK) >> TX_STATUS_FRM_RTX_SHIFT;
922 	tx_rts_count =
923 	    (txs->status & TX_STATUS_RTS_RTX_MASK) >> TX_STATUS_RTS_RTX_SHIFT;
924 
925 	lastframe = !ieee80211_has_morefrags(h->frame_control);
926 
927 	if (!lastframe) {
928 		brcms_err(wlc->hw->d11core, "Not last frame!\n");
929 	} else {
930 		/*
931 		 * Set information to be consumed by Minstrel ht.
932 		 *
933 		 * The "fallback limit" is the number of tx attempts a given
934 		 * MPDU is sent at the "primary" rate. Tx attempts beyond that
935 		 * limit are sent at the "secondary" rate.
936 		 * A 'short frame' does not exceed RTS treshold.
937 		 */
938 		u16 sfbl,	/* Short Frame Rate Fallback Limit */
939 		    lfbl,	/* Long Frame Rate Fallback Limit */
940 		    fbl;
941 
942 		if (queue < IEEE80211_NUM_ACS) {
943 			sfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
944 				      EDCF_SFB);
945 			lfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
946 				      EDCF_LFB);
947 		} else {
948 			sfbl = wlc->SFBL;
949 			lfbl = wlc->LFBL;
950 		}
951 
952 		txrate = tx_info->status.rates;
953 		if (txrate[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
954 			fbl = lfbl;
955 		else
956 			fbl = sfbl;
957 
958 		ieee80211_tx_info_clear_status(tx_info);
959 
960 		if ((tx_frame_count > fbl) && (txrate[1].idx >= 0)) {
961 			/*
962 			 * rate selection requested a fallback rate
963 			 * and we used it
964 			 */
965 			txrate[0].count = fbl;
966 			txrate[1].count = tx_frame_count - fbl;
967 		} else {
968 			/*
969 			 * rate selection did not request fallback rate, or
970 			 * we didn't need it
971 			 */
972 			txrate[0].count = tx_frame_count;
973 			/*
974 			 * rc80211_minstrel.c:minstrel_tx_status() expects
975 			 * unused rates to be marked with idx = -1
976 			 */
977 			txrate[1].idx = -1;
978 			txrate[1].count = 0;
979 		}
980 
981 		/* clear the rest of the rates */
982 		for (i = 2; i < IEEE80211_TX_MAX_RATES; i++) {
983 			txrate[i].idx = -1;
984 			txrate[i].count = 0;
985 		}
986 
987 		if (txs->status & TX_STATUS_ACK_RCV)
988 			tx_info->flags |= IEEE80211_TX_STAT_ACK;
989 	}
990 
991 	totlen = p->len;
992 	free_pdu = true;
993 
994 	if (lastframe) {
995 		/* remove PLCP & Broadcom tx descriptor header */
996 		skb_pull(p, D11_PHY_HDR_LEN);
997 		skb_pull(p, D11_TXH_LEN);
998 		ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw, p);
999 	} else {
1000 		brcms_err(wlc->hw->d11core,
1001 			  "%s: Not last frame => not calling tx_status\n",
1002 			  __func__);
1003 	}
1004 
1005 	fatal = false;
1006 
1007  out:
1008 	if (fatal) {
1009 		if (txh)
1010 			trace_brcms_txdesc(&wlc->hw->d11core->dev, txh,
1011 					   sizeof(*txh));
1012 		brcmu_pkt_buf_free_skb(p);
1013 	}
1014 
1015 	if (dma && queue < NFIFO) {
1016 		u16 ac_queue = brcms_fifo_to_ac(queue);
1017 		if (dma->txavail > TX_HEADROOM && queue < TX_BCMC_FIFO &&
1018 		    ieee80211_queue_stopped(wlc->pub->ieee_hw, ac_queue))
1019 			ieee80211_wake_queue(wlc->pub->ieee_hw, ac_queue);
1020 		dma_kick_tx(dma);
1021 	}
1022 
1023 	return fatal;
1024 }
1025 
1026 /* process tx completion events in BMAC
1027  * Return true if more tx status need to be processed. false otherwise.
1028  */
1029 static bool
1030 brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
1031 {
1032 	struct bcma_device *core;
1033 	struct tx_status txstatus, *txs;
1034 	u32 s1, s2;
1035 	uint n = 0;
1036 	/*
1037 	 * Param 'max_tx_num' indicates max. # tx status to process before
1038 	 * break out.
1039 	 */
1040 	uint max_tx_num = bound ? TXSBND : -1;
1041 
1042 	txs = &txstatus;
1043 	core = wlc_hw->d11core;
1044 	*fatal = false;
1045 
1046 	while (n < max_tx_num) {
1047 		s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
1048 		if (s1 == 0xffffffff) {
1049 			brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
1050 				  __func__);
1051 			*fatal = true;
1052 			return false;
1053 		}
1054 		/* only process when valid */
1055 		if (!(s1 & TXS_V))
1056 			break;
1057 
1058 		s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
1059 		txs->status = s1 & TXS_STATUS_MASK;
1060 		txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
1061 		txs->sequence = s2 & TXS_SEQ_MASK;
1062 		txs->phyerr = (s2 & TXS_PTX_MASK) >> TXS_PTX_SHIFT;
1063 		txs->lasttxtime = 0;
1064 
1065 		*fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
1066 		if (*fatal == true)
1067 			return false;
1068 		n++;
1069 	}
1070 
1071 	return n >= max_tx_num;
1072 }
1073 
1074 static void brcms_c_tbtt(struct brcms_c_info *wlc)
1075 {
1076 	if (wlc->bsscfg->type == BRCMS_TYPE_ADHOC)
1077 		/*
1078 		 * DirFrmQ is now valid...defer setting until end
1079 		 * of ATIM window
1080 		 */
1081 		wlc->qvalid |= MCMD_DIRFRMQVAL;
1082 }
1083 
1084 /* set initial host flags value */
1085 static void
1086 brcms_c_mhfdef(struct brcms_c_info *wlc, u16 *mhfs, u16 mhf2_init)
1087 {
1088 	struct brcms_hardware *wlc_hw = wlc->hw;
1089 
1090 	memset(mhfs, 0, MHFMAX * sizeof(u16));
1091 
1092 	mhfs[MHF2] |= mhf2_init;
1093 
1094 	/* prohibit use of slowclock on multifunction boards */
1095 	if (wlc_hw->boardflags & BFL_NOPLLDOWN)
1096 		mhfs[MHF1] |= MHF1_FORCEFASTCLK;
1097 
1098 	if (BRCMS_ISNPHY(wlc_hw->band) && NREV_LT(wlc_hw->band->phyrev, 2)) {
1099 		mhfs[MHF2] |= MHF2_NPHY40MHZ_WAR;
1100 		mhfs[MHF1] |= MHF1_IQSWAP_WAR;
1101 	}
1102 }
1103 
1104 static uint
1105 dmareg(uint direction, uint fifonum)
1106 {
1107 	if (direction == DMA_TX)
1108 		return offsetof(struct d11regs, fifo64regs[fifonum].dmaxmt);
1109 	return offsetof(struct d11regs, fifo64regs[fifonum].dmarcv);
1110 }
1111 
1112 static bool brcms_b_attach_dmapio(struct brcms_c_info *wlc, uint j, bool wme)
1113 {
1114 	uint i;
1115 	char name[8];
1116 	/*
1117 	 * ucode host flag 2 needed for pio mode, independent of band and fifo
1118 	 */
1119 	u16 pio_mhf2 = 0;
1120 	struct brcms_hardware *wlc_hw = wlc->hw;
1121 	uint unit = wlc_hw->unit;
1122 
1123 	/* name and offsets for dma_attach */
1124 	snprintf(name, sizeof(name), "wl%d", unit);
1125 
1126 	if (wlc_hw->di[0] == NULL) {	/* Init FIFOs */
1127 		int dma_attach_err = 0;
1128 
1129 		/*
1130 		 * FIFO 0
1131 		 * TX: TX_AC_BK_FIFO (TX AC Background data packets)
1132 		 * RX: RX_FIFO (RX data packets)
1133 		 */
1134 		wlc_hw->di[0] = dma_attach(name, wlc,
1135 					   (wme ? dmareg(DMA_TX, 0) : 0),
1136 					   dmareg(DMA_RX, 0),
1137 					   (wme ? NTXD : 0), NRXD,
1138 					   RXBUFSZ, -1, NRXBUFPOST,
1139 					   BRCMS_HWRXOFF);
1140 		dma_attach_err |= (NULL == wlc_hw->di[0]);
1141 
1142 		/*
1143 		 * FIFO 1
1144 		 * TX: TX_AC_BE_FIFO (TX AC Best-Effort data packets)
1145 		 *   (legacy) TX_DATA_FIFO (TX data packets)
1146 		 * RX: UNUSED
1147 		 */
1148 		wlc_hw->di[1] = dma_attach(name, wlc,
1149 					   dmareg(DMA_TX, 1), 0,
1150 					   NTXD, 0, 0, -1, 0, 0);
1151 		dma_attach_err |= (NULL == wlc_hw->di[1]);
1152 
1153 		/*
1154 		 * FIFO 2
1155 		 * TX: TX_AC_VI_FIFO (TX AC Video data packets)
1156 		 * RX: UNUSED
1157 		 */
1158 		wlc_hw->di[2] = dma_attach(name, wlc,
1159 					   dmareg(DMA_TX, 2), 0,
1160 					   NTXD, 0, 0, -1, 0, 0);
1161 		dma_attach_err |= (NULL == wlc_hw->di[2]);
1162 		/*
1163 		 * FIFO 3
1164 		 * TX: TX_AC_VO_FIFO (TX AC Voice data packets)
1165 		 *   (legacy) TX_CTL_FIFO (TX control & mgmt packets)
1166 		 */
1167 		wlc_hw->di[3] = dma_attach(name, wlc,
1168 					   dmareg(DMA_TX, 3),
1169 					   0, NTXD, 0, 0, -1,
1170 					   0, 0);
1171 		dma_attach_err |= (NULL == wlc_hw->di[3]);
1172 /* Cleaner to leave this as if with AP defined */
1173 
1174 		if (dma_attach_err) {
1175 			brcms_err(wlc_hw->d11core,
1176 				  "wl%d: wlc_attach: dma_attach failed\n",
1177 				  unit);
1178 			return false;
1179 		}
1180 
1181 		/* get pointer to dma engine tx flow control variable */
1182 		for (i = 0; i < NFIFO; i++)
1183 			if (wlc_hw->di[i])
1184 				wlc_hw->txavail[i] =
1185 				    (uint *) dma_getvar(wlc_hw->di[i],
1186 							"&txavail");
1187 	}
1188 
1189 	/* initial ucode host flags */
1190 	brcms_c_mhfdef(wlc, wlc_hw->band->mhfs, pio_mhf2);
1191 
1192 	return true;
1193 }
1194 
1195 static void brcms_b_detach_dmapio(struct brcms_hardware *wlc_hw)
1196 {
1197 	uint j;
1198 
1199 	for (j = 0; j < NFIFO; j++) {
1200 		if (wlc_hw->di[j]) {
1201 			dma_detach(wlc_hw->di[j]);
1202 			wlc_hw->di[j] = NULL;
1203 		}
1204 	}
1205 }
1206 
1207 /*
1208  * Initialize brcms_c_info default values ...
1209  * may get overrides later in this function
1210  *  BMAC_NOTES, move low out and resolve the dangling ones
1211  */
1212 static void brcms_b_info_init(struct brcms_hardware *wlc_hw)
1213 {
1214 	struct brcms_c_info *wlc = wlc_hw->wlc;
1215 
1216 	/* set default sw macintmask value */
1217 	wlc->defmacintmask = DEF_MACINTMASK;
1218 
1219 	/* various 802.11g modes */
1220 	wlc_hw->shortslot = false;
1221 
1222 	wlc_hw->SFBL = RETRY_SHORT_FB;
1223 	wlc_hw->LFBL = RETRY_LONG_FB;
1224 
1225 	/* default mac retry limits */
1226 	wlc_hw->SRL = RETRY_SHORT_DEF;
1227 	wlc_hw->LRL = RETRY_LONG_DEF;
1228 	wlc_hw->chanspec = ch20mhz_chspec(1);
1229 }
1230 
1231 static void brcms_b_wait_for_wake(struct brcms_hardware *wlc_hw)
1232 {
1233 	/* delay before first read of ucode state */
1234 	udelay(40);
1235 
1236 	/* wait until ucode is no longer asleep */
1237 	SPINWAIT((brcms_b_read_shm(wlc_hw, M_UCODE_DBGST) ==
1238 		  DBGST_ASLEEP), wlc_hw->wlc->fastpwrup_dly);
1239 }
1240 
1241 /* control chip clock to save power, enable dynamic clock or force fast clock */
1242 static void brcms_b_clkctl_clk(struct brcms_hardware *wlc_hw, enum bcma_clkmode mode)
1243 {
1244 	if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU) {
1245 		/* new chips with PMU, CCS_FORCEHT will distribute the HT clock
1246 		 * on backplane, but mac core will still run on ALP(not HT) when
1247 		 * it enters powersave mode, which means the FCA bit may not be
1248 		 * set. Should wakeup mac if driver wants it to run on HT.
1249 		 */
1250 
1251 		if (wlc_hw->clk) {
1252 			if (mode == BCMA_CLKMODE_FAST) {
1253 				bcma_set32(wlc_hw->d11core,
1254 					   D11REGOFFS(clk_ctl_st),
1255 					   CCS_FORCEHT);
1256 
1257 				udelay(64);
1258 
1259 				SPINWAIT(
1260 				    ((bcma_read32(wlc_hw->d11core,
1261 				      D11REGOFFS(clk_ctl_st)) &
1262 				      CCS_HTAVAIL) == 0),
1263 				      PMU_MAX_TRANSITION_DLY);
1264 				WARN_ON(!(bcma_read32(wlc_hw->d11core,
1265 					D11REGOFFS(clk_ctl_st)) &
1266 					CCS_HTAVAIL));
1267 			} else {
1268 				if ((ai_get_pmurev(wlc_hw->sih) == 0) &&
1269 				    (bcma_read32(wlc_hw->d11core,
1270 					D11REGOFFS(clk_ctl_st)) &
1271 					(CCS_FORCEHT | CCS_HTAREQ)))
1272 					SPINWAIT(
1273 					    ((bcma_read32(wlc_hw->d11core,
1274 					      offsetof(struct d11regs,
1275 						       clk_ctl_st)) &
1276 					      CCS_HTAVAIL) == 0),
1277 					      PMU_MAX_TRANSITION_DLY);
1278 				bcma_mask32(wlc_hw->d11core,
1279 					D11REGOFFS(clk_ctl_st),
1280 					~CCS_FORCEHT);
1281 			}
1282 		}
1283 		wlc_hw->forcefastclk = (mode == BCMA_CLKMODE_FAST);
1284 	} else {
1285 
1286 		/* old chips w/o PMU, force HT through cc,
1287 		 * then use FCA to verify mac is running fast clock
1288 		 */
1289 
1290 		wlc_hw->forcefastclk = ai_clkctl_cc(wlc_hw->sih, mode);
1291 
1292 		/* check fast clock is available (if core is not in reset) */
1293 		if (wlc_hw->forcefastclk && wlc_hw->clk)
1294 			WARN_ON(!(bcma_aread32(wlc_hw->d11core, BCMA_IOST) &
1295 				  SISF_FCLKA));
1296 
1297 		/*
1298 		 * keep the ucode wake bit on if forcefastclk is on since we
1299 		 * do not want ucode to put us back to slow clock when it dozes
1300 		 * for PM mode. Code below matches the wake override bit with
1301 		 * current forcefastclk state. Only setting bit in wake_override
1302 		 * instead of waking ucode immediately since old code had this
1303 		 * behavior. Older code set wlc->forcefastclk but only had the
1304 		 * wake happen if the wakup_ucode work (protected by an up
1305 		 * check) was executed just below.
1306 		 */
1307 		if (wlc_hw->forcefastclk)
1308 			mboolset(wlc_hw->wake_override,
1309 				 BRCMS_WAKE_OVERRIDE_FORCEFAST);
1310 		else
1311 			mboolclr(wlc_hw->wake_override,
1312 				 BRCMS_WAKE_OVERRIDE_FORCEFAST);
1313 	}
1314 }
1315 
1316 /* set or clear ucode host flag bits
1317  * it has an optimization for no-change write
1318  * it only writes through shared memory when the core has clock;
1319  * pre-CLK changes should use wlc_write_mhf to get around the optimization
1320  *
1321  *
1322  * bands values are: BRCM_BAND_AUTO <--- Current band only
1323  *                   BRCM_BAND_5G   <--- 5G band only
1324  *                   BRCM_BAND_2G   <--- 2G band only
1325  *                   BRCM_BAND_ALL  <--- All bands
1326  */
1327 void
1328 brcms_b_mhf(struct brcms_hardware *wlc_hw, u8 idx, u16 mask, u16 val,
1329 	     int bands)
1330 {
1331 	u16 save;
1332 	u16 addr[MHFMAX] = {
1333 		M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
1334 		M_HOST_FLAGS5
1335 	};
1336 	struct brcms_hw_band *band;
1337 
1338 	if ((val & ~mask) || idx >= MHFMAX)
1339 		return; /* error condition */
1340 
1341 	switch (bands) {
1342 		/* Current band only or all bands,
1343 		 * then set the band to current band
1344 		 */
1345 	case BRCM_BAND_AUTO:
1346 	case BRCM_BAND_ALL:
1347 		band = wlc_hw->band;
1348 		break;
1349 	case BRCM_BAND_5G:
1350 		band = wlc_hw->bandstate[BAND_5G_INDEX];
1351 		break;
1352 	case BRCM_BAND_2G:
1353 		band = wlc_hw->bandstate[BAND_2G_INDEX];
1354 		break;
1355 	default:
1356 		band = NULL;	/* error condition */
1357 	}
1358 
1359 	if (band) {
1360 		save = band->mhfs[idx];
1361 		band->mhfs[idx] = (band->mhfs[idx] & ~mask) | val;
1362 
1363 		/* optimization: only write through if changed, and
1364 		 * changed band is the current band
1365 		 */
1366 		if (wlc_hw->clk && (band->mhfs[idx] != save)
1367 		    && (band == wlc_hw->band))
1368 			brcms_b_write_shm(wlc_hw, addr[idx],
1369 					   (u16) band->mhfs[idx]);
1370 	}
1371 
1372 	if (bands == BRCM_BAND_ALL) {
1373 		wlc_hw->bandstate[0]->mhfs[idx] =
1374 		    (wlc_hw->bandstate[0]->mhfs[idx] & ~mask) | val;
1375 		wlc_hw->bandstate[1]->mhfs[idx] =
1376 		    (wlc_hw->bandstate[1]->mhfs[idx] & ~mask) | val;
1377 	}
1378 }
1379 
1380 /* set the maccontrol register to desired reset state and
1381  * initialize the sw cache of the register
1382  */
1383 static void brcms_c_mctrl_reset(struct brcms_hardware *wlc_hw)
1384 {
1385 	/* IHR accesses are always enabled, PSM disabled, HPS off and WAKE on */
1386 	wlc_hw->maccontrol = 0;
1387 	wlc_hw->suspended_fifos = 0;
1388 	wlc_hw->wake_override = 0;
1389 	wlc_hw->mute_override = 0;
1390 	brcms_b_mctrl(wlc_hw, ~0, MCTL_IHR_EN | MCTL_WAKE);
1391 }
1392 
1393 /*
1394  * write the software state of maccontrol and
1395  * overrides to the maccontrol register
1396  */
1397 static void brcms_c_mctrl_write(struct brcms_hardware *wlc_hw)
1398 {
1399 	u32 maccontrol = wlc_hw->maccontrol;
1400 
1401 	/* OR in the wake bit if overridden */
1402 	if (wlc_hw->wake_override)
1403 		maccontrol |= MCTL_WAKE;
1404 
1405 	/* set AP and INFRA bits for mute if needed */
1406 	if (wlc_hw->mute_override) {
1407 		maccontrol &= ~(MCTL_AP);
1408 		maccontrol |= MCTL_INFRA;
1409 	}
1410 
1411 	bcma_write32(wlc_hw->d11core, D11REGOFFS(maccontrol),
1412 		     maccontrol);
1413 }
1414 
1415 /* set or clear maccontrol bits */
1416 void brcms_b_mctrl(struct brcms_hardware *wlc_hw, u32 mask, u32 val)
1417 {
1418 	u32 maccontrol;
1419 	u32 new_maccontrol;
1420 
1421 	if (val & ~mask)
1422 		return; /* error condition */
1423 	maccontrol = wlc_hw->maccontrol;
1424 	new_maccontrol = (maccontrol & ~mask) | val;
1425 
1426 	/* if the new maccontrol value is the same as the old, nothing to do */
1427 	if (new_maccontrol == maccontrol)
1428 		return;
1429 
1430 	/* something changed, cache the new value */
1431 	wlc_hw->maccontrol = new_maccontrol;
1432 
1433 	/* write the new values with overrides applied */
1434 	brcms_c_mctrl_write(wlc_hw);
1435 }
1436 
1437 void brcms_c_ucode_wake_override_set(struct brcms_hardware *wlc_hw,
1438 				 u32 override_bit)
1439 {
1440 	if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE)) {
1441 		mboolset(wlc_hw->wake_override, override_bit);
1442 		return;
1443 	}
1444 
1445 	mboolset(wlc_hw->wake_override, override_bit);
1446 
1447 	brcms_c_mctrl_write(wlc_hw);
1448 	brcms_b_wait_for_wake(wlc_hw);
1449 }
1450 
1451 void brcms_c_ucode_wake_override_clear(struct brcms_hardware *wlc_hw,
1452 				   u32 override_bit)
1453 {
1454 	mboolclr(wlc_hw->wake_override, override_bit);
1455 
1456 	if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE))
1457 		return;
1458 
1459 	brcms_c_mctrl_write(wlc_hw);
1460 }
1461 
1462 /* When driver needs ucode to stop beaconing, it has to make sure that
1463  * MCTL_AP is clear and MCTL_INFRA is set
1464  * Mode           MCTL_AP        MCTL_INFRA
1465  * AP                1              1
1466  * STA               0              1 <--- This will ensure no beacons
1467  * IBSS              0              0
1468  */
1469 static void brcms_c_ucode_mute_override_set(struct brcms_hardware *wlc_hw)
1470 {
1471 	wlc_hw->mute_override = 1;
1472 
1473 	/* if maccontrol already has AP == 0 and INFRA == 1 without this
1474 	 * override, then there is no change to write
1475 	 */
1476 	if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1477 		return;
1478 
1479 	brcms_c_mctrl_write(wlc_hw);
1480 }
1481 
1482 /* Clear the override on AP and INFRA bits */
1483 static void brcms_c_ucode_mute_override_clear(struct brcms_hardware *wlc_hw)
1484 {
1485 	if (wlc_hw->mute_override == 0)
1486 		return;
1487 
1488 	wlc_hw->mute_override = 0;
1489 
1490 	/* if maccontrol already has AP == 0 and INFRA == 1 without this
1491 	 * override, then there is no change to write
1492 	 */
1493 	if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
1494 		return;
1495 
1496 	brcms_c_mctrl_write(wlc_hw);
1497 }
1498 
1499 /*
1500  * Write a MAC address to the given match reg offset in the RXE match engine.
1501  */
1502 static void
1503 brcms_b_set_addrmatch(struct brcms_hardware *wlc_hw, int match_reg_offset,
1504 		       const u8 *addr)
1505 {
1506 	struct bcma_device *core = wlc_hw->d11core;
1507 	u16 mac_l;
1508 	u16 mac_m;
1509 	u16 mac_h;
1510 
1511 	brcms_dbg_rx(core, "wl%d: brcms_b_set_addrmatch\n", wlc_hw->unit);
1512 
1513 	mac_l = addr[0] | (addr[1] << 8);
1514 	mac_m = addr[2] | (addr[3] << 8);
1515 	mac_h = addr[4] | (addr[5] << 8);
1516 
1517 	/* enter the MAC addr into the RXE match registers */
1518 	bcma_write16(core, D11REGOFFS(rcm_ctl),
1519 		     RCM_INC_DATA | match_reg_offset);
1520 	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_l);
1521 	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_m);
1522 	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_h);
1523 }
1524 
1525 void
1526 brcms_b_write_template_ram(struct brcms_hardware *wlc_hw, int offset, int len,
1527 			    void *buf)
1528 {
1529 	struct bcma_device *core = wlc_hw->d11core;
1530 	u32 word;
1531 	__le32 word_le;
1532 	__be32 word_be;
1533 	bool be_bit;
1534 	brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
1535 
1536 	bcma_write32(core, D11REGOFFS(tplatewrptr), offset);
1537 
1538 	/* if MCTL_BIGEND bit set in mac control register,
1539 	 * the chip swaps data in fifo, as well as data in
1540 	 * template ram
1541 	 */
1542 	be_bit = (bcma_read32(core, D11REGOFFS(maccontrol)) & MCTL_BIGEND) != 0;
1543 
1544 	while (len > 0) {
1545 		memcpy(&word, buf, sizeof(u32));
1546 
1547 		if (be_bit) {
1548 			word_be = cpu_to_be32(word);
1549 			word = *(u32 *)&word_be;
1550 		} else {
1551 			word_le = cpu_to_le32(word);
1552 			word = *(u32 *)&word_le;
1553 		}
1554 
1555 		bcma_write32(core, D11REGOFFS(tplatewrdata), word);
1556 
1557 		buf = (u8 *) buf + sizeof(u32);
1558 		len -= sizeof(u32);
1559 	}
1560 }
1561 
1562 static void brcms_b_set_cwmin(struct brcms_hardware *wlc_hw, u16 newmin)
1563 {
1564 	wlc_hw->band->CWmin = newmin;
1565 
1566 	bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1567 		     OBJADDR_SCR_SEL | S_DOT11_CWMIN);
1568 	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1569 	bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmin);
1570 }
1571 
1572 static void brcms_b_set_cwmax(struct brcms_hardware *wlc_hw, u16 newmax)
1573 {
1574 	wlc_hw->band->CWmax = newmax;
1575 
1576 	bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
1577 		     OBJADDR_SCR_SEL | S_DOT11_CWMAX);
1578 	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
1579 	bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmax);
1580 }
1581 
1582 void brcms_b_bw_set(struct brcms_hardware *wlc_hw, u16 bw)
1583 {
1584 	bool fastclk;
1585 
1586 	/* request FAST clock if not on */
1587 	fastclk = wlc_hw->forcefastclk;
1588 	if (!fastclk)
1589 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
1590 
1591 	wlc_phy_bw_state_set(wlc_hw->band->pi, bw);
1592 
1593 	brcms_b_phy_reset(wlc_hw);
1594 	wlc_phy_init(wlc_hw->band->pi, wlc_phy_chanspec_get(wlc_hw->band->pi));
1595 
1596 	/* restore the clk */
1597 	if (!fastclk)
1598 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
1599 }
1600 
1601 static void brcms_b_upd_synthpu(struct brcms_hardware *wlc_hw)
1602 {
1603 	u16 v;
1604 	struct brcms_c_info *wlc = wlc_hw->wlc;
1605 	/* update SYNTHPU_DLY */
1606 
1607 	if (BRCMS_ISLCNPHY(wlc->band))
1608 		v = SYNTHPU_DLY_LPPHY_US;
1609 	else if (BRCMS_ISNPHY(wlc->band) && (NREV_GE(wlc->band->phyrev, 3)))
1610 		v = SYNTHPU_DLY_NPHY_US;
1611 	else
1612 		v = SYNTHPU_DLY_BPHY_US;
1613 
1614 	brcms_b_write_shm(wlc_hw, M_SYNTHPU_DLY, v);
1615 }
1616 
1617 static void brcms_c_ucode_txant_set(struct brcms_hardware *wlc_hw)
1618 {
1619 	u16 phyctl;
1620 	u16 phytxant = wlc_hw->bmac_phytxant;
1621 	u16 mask = PHY_TXC_ANT_MASK;
1622 
1623 	/* set the Probe Response frame phy control word */
1624 	phyctl = brcms_b_read_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS);
1625 	phyctl = (phyctl & ~mask) | phytxant;
1626 	brcms_b_write_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS, phyctl);
1627 
1628 	/* set the Response (ACK/CTS) frame phy control word */
1629 	phyctl = brcms_b_read_shm(wlc_hw, M_RSP_PCTLWD);
1630 	phyctl = (phyctl & ~mask) | phytxant;
1631 	brcms_b_write_shm(wlc_hw, M_RSP_PCTLWD, phyctl);
1632 }
1633 
1634 static u16 brcms_b_ofdm_ratetable_offset(struct brcms_hardware *wlc_hw,
1635 					 u8 rate)
1636 {
1637 	uint i;
1638 	u8 plcp_rate = 0;
1639 	struct plcp_signal_rate_lookup {
1640 		u8 rate;
1641 		u8 signal_rate;
1642 	};
1643 	/* OFDM RATE sub-field of PLCP SIGNAL field, per 802.11 sec 17.3.4.1 */
1644 	const struct plcp_signal_rate_lookup rate_lookup[] = {
1645 		{BRCM_RATE_6M, 0xB},
1646 		{BRCM_RATE_9M, 0xF},
1647 		{BRCM_RATE_12M, 0xA},
1648 		{BRCM_RATE_18M, 0xE},
1649 		{BRCM_RATE_24M, 0x9},
1650 		{BRCM_RATE_36M, 0xD},
1651 		{BRCM_RATE_48M, 0x8},
1652 		{BRCM_RATE_54M, 0xC}
1653 	};
1654 
1655 	for (i = 0; i < ARRAY_SIZE(rate_lookup); i++) {
1656 		if (rate == rate_lookup[i].rate) {
1657 			plcp_rate = rate_lookup[i].signal_rate;
1658 			break;
1659 		}
1660 	}
1661 
1662 	/* Find the SHM pointer to the rate table entry by looking in the
1663 	 * Direct-map Table
1664 	 */
1665 	return 2 * brcms_b_read_shm(wlc_hw, M_RT_DIRMAP_A + (plcp_rate * 2));
1666 }
1667 
1668 static void brcms_upd_ofdm_pctl1_table(struct brcms_hardware *wlc_hw)
1669 {
1670 	u8 rate;
1671 	u8 rates[8] = {
1672 		BRCM_RATE_6M, BRCM_RATE_9M, BRCM_RATE_12M, BRCM_RATE_18M,
1673 		BRCM_RATE_24M, BRCM_RATE_36M, BRCM_RATE_48M, BRCM_RATE_54M
1674 	};
1675 	u16 entry_ptr;
1676 	u16 pctl1;
1677 	uint i;
1678 
1679 	if (!BRCMS_PHY_11N_CAP(wlc_hw->band))
1680 		return;
1681 
1682 	/* walk the phy rate table and update the entries */
1683 	for (i = 0; i < ARRAY_SIZE(rates); i++) {
1684 		rate = rates[i];
1685 
1686 		entry_ptr = brcms_b_ofdm_ratetable_offset(wlc_hw, rate);
1687 
1688 		/* read the SHM Rate Table entry OFDM PCTL1 values */
1689 		pctl1 =
1690 		    brcms_b_read_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS);
1691 
1692 		/* modify the value */
1693 		pctl1 &= ~PHY_TXC1_MODE_MASK;
1694 		pctl1 |= (wlc_hw->hw_stf_ss_opmode << PHY_TXC1_MODE_SHIFT);
1695 
1696 		/* Update the SHM Rate Table entry OFDM PCTL1 values */
1697 		brcms_b_write_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS,
1698 				   pctl1);
1699 	}
1700 }
1701 
1702 /* band-specific init */
1703 static void brcms_b_bsinit(struct brcms_c_info *wlc, u16 chanspec)
1704 {
1705 	struct brcms_hardware *wlc_hw = wlc->hw;
1706 
1707 	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: bandunit %d\n", wlc_hw->unit,
1708 			   wlc_hw->band->bandunit);
1709 
1710 	brcms_c_ucode_bsinit(wlc_hw);
1711 
1712 	wlc_phy_init(wlc_hw->band->pi, chanspec);
1713 
1714 	brcms_c_ucode_txant_set(wlc_hw);
1715 
1716 	/*
1717 	 * cwmin is band-specific, update hardware
1718 	 * with value for current band
1719 	 */
1720 	brcms_b_set_cwmin(wlc_hw, wlc_hw->band->CWmin);
1721 	brcms_b_set_cwmax(wlc_hw, wlc_hw->band->CWmax);
1722 
1723 	brcms_b_update_slot_timing(wlc_hw,
1724 				   wlc_hw->band->bandtype == BRCM_BAND_5G ?
1725 				   true : wlc_hw->shortslot);
1726 
1727 	/* write phytype and phyvers */
1728 	brcms_b_write_shm(wlc_hw, M_PHYTYPE, (u16) wlc_hw->band->phytype);
1729 	brcms_b_write_shm(wlc_hw, M_PHYVER, (u16) wlc_hw->band->phyrev);
1730 
1731 	/*
1732 	 * initialize the txphyctl1 rate table since
1733 	 * shmem is shared between bands
1734 	 */
1735 	brcms_upd_ofdm_pctl1_table(wlc_hw);
1736 
1737 	brcms_b_upd_synthpu(wlc_hw);
1738 }
1739 
1740 /* Perform a soft reset of the PHY PLL */
1741 void brcms_b_core_phypll_reset(struct brcms_hardware *wlc_hw)
1742 {
1743 	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_addr),
1744 		  ~0, 0);
1745 	udelay(1);
1746 	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1747 		  0x4, 0);
1748 	udelay(1);
1749 	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1750 		  0x4, 4);
1751 	udelay(1);
1752 	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
1753 		  0x4, 0);
1754 	udelay(1);
1755 }
1756 
1757 /* light way to turn on phy clock without reset for NPHY only
1758  *  refer to brcms_b_core_phy_clk for full version
1759  */
1760 void brcms_b_phyclk_fgc(struct brcms_hardware *wlc_hw, bool clk)
1761 {
1762 	/* support(necessary for NPHY and HYPHY) only */
1763 	if (!BRCMS_ISNPHY(wlc_hw->band))
1764 		return;
1765 
1766 	if (ON == clk)
1767 		brcms_b_core_ioctl(wlc_hw, SICF_FGC, SICF_FGC);
1768 	else
1769 		brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
1770 
1771 }
1772 
1773 void brcms_b_macphyclk_set(struct brcms_hardware *wlc_hw, bool clk)
1774 {
1775 	if (ON == clk)
1776 		brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, SICF_MPCLKE);
1777 	else
1778 		brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, 0);
1779 }
1780 
1781 void brcms_b_phy_reset(struct brcms_hardware *wlc_hw)
1782 {
1783 	struct brcms_phy_pub *pih = wlc_hw->band->pi;
1784 	u32 phy_bw_clkbits;
1785 	bool phy_in_reset = false;
1786 
1787 	brcms_dbg_info(wlc_hw->d11core, "wl%d: reset phy\n", wlc_hw->unit);
1788 
1789 	if (pih == NULL)
1790 		return;
1791 
1792 	phy_bw_clkbits = wlc_phy_clk_bwbits(wlc_hw->band->pi);
1793 
1794 	/* Specific reset sequence required for NPHY rev 3 and 4 */
1795 	if (BRCMS_ISNPHY(wlc_hw->band) && NREV_GE(wlc_hw->band->phyrev, 3) &&
1796 	    NREV_LE(wlc_hw->band->phyrev, 4)) {
1797 		/* Set the PHY bandwidth */
1798 		brcms_b_core_ioctl(wlc_hw, SICF_BWMASK, phy_bw_clkbits);
1799 
1800 		udelay(1);
1801 
1802 		/* Perform a soft reset of the PHY PLL */
1803 		brcms_b_core_phypll_reset(wlc_hw);
1804 
1805 		/* reset the PHY */
1806 		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_PCLKE),
1807 				   (SICF_PRST | SICF_PCLKE));
1808 		phy_in_reset = true;
1809 	} else {
1810 		brcms_b_core_ioctl(wlc_hw,
1811 				   (SICF_PRST | SICF_PCLKE | SICF_BWMASK),
1812 				   (SICF_PRST | SICF_PCLKE | phy_bw_clkbits));
1813 	}
1814 
1815 	udelay(2);
1816 	brcms_b_core_phy_clk(wlc_hw, ON);
1817 
1818 	if (pih)
1819 		wlc_phy_anacore(pih, ON);
1820 }
1821 
1822 /* switch to and initialize new band */
1823 static void brcms_b_setband(struct brcms_hardware *wlc_hw, uint bandunit,
1824 			    u16 chanspec) {
1825 	struct brcms_c_info *wlc = wlc_hw->wlc;
1826 	u32 macintmask;
1827 
1828 	/* Enable the d11 core before accessing it */
1829 	if (!bcma_core_is_enabled(wlc_hw->d11core)) {
1830 		bcma_core_enable(wlc_hw->d11core, 0);
1831 		brcms_c_mctrl_reset(wlc_hw);
1832 	}
1833 
1834 	macintmask = brcms_c_setband_inact(wlc, bandunit);
1835 
1836 	if (!wlc_hw->up)
1837 		return;
1838 
1839 	brcms_b_core_phy_clk(wlc_hw, ON);
1840 
1841 	/* band-specific initializations */
1842 	brcms_b_bsinit(wlc, chanspec);
1843 
1844 	/*
1845 	 * If there are any pending software interrupt bits,
1846 	 * then replace these with a harmless nonzero value
1847 	 * so brcms_c_dpc() will re-enable interrupts when done.
1848 	 */
1849 	if (wlc->macintstatus)
1850 		wlc->macintstatus = MI_DMAINT;
1851 
1852 	/* restore macintmask */
1853 	brcms_intrsrestore(wlc->wl, macintmask);
1854 
1855 	/* ucode should still be suspended.. */
1856 	WARN_ON((bcma_read32(wlc_hw->d11core, D11REGOFFS(maccontrol)) &
1857 		 MCTL_EN_MAC) != 0);
1858 }
1859 
1860 static bool brcms_c_isgoodchip(struct brcms_hardware *wlc_hw)
1861 {
1862 
1863 	/* reject unsupported corerev */
1864 	if (!CONF_HAS(D11CONF, wlc_hw->corerev)) {
1865 		wiphy_err(wlc_hw->wlc->wiphy, "unsupported core rev %d\n",
1866 			  wlc_hw->corerev);
1867 		return false;
1868 	}
1869 
1870 	return true;
1871 }
1872 
1873 /* Validate some board info parameters */
1874 static bool brcms_c_validboardtype(struct brcms_hardware *wlc_hw)
1875 {
1876 	uint boardrev = wlc_hw->boardrev;
1877 
1878 	/* 4 bits each for board type, major, minor, and tiny version */
1879 	uint brt = (boardrev & 0xf000) >> 12;
1880 	uint b0 = (boardrev & 0xf00) >> 8;
1881 	uint b1 = (boardrev & 0xf0) >> 4;
1882 	uint b2 = boardrev & 0xf;
1883 
1884 	/* voards from other vendors are always considered valid */
1885 	if (ai_get_boardvendor(wlc_hw->sih) != PCI_VENDOR_ID_BROADCOM)
1886 		return true;
1887 
1888 	/* do some boardrev sanity checks when boardvendor is Broadcom */
1889 	if (boardrev == 0)
1890 		return false;
1891 
1892 	if (boardrev <= 0xff)
1893 		return true;
1894 
1895 	if ((brt > 2) || (brt == 0) || (b0 > 9) || (b0 == 0) || (b1 > 9)
1896 		|| (b2 > 9))
1897 		return false;
1898 
1899 	return true;
1900 }
1901 
1902 static void brcms_c_get_macaddr(struct brcms_hardware *wlc_hw, u8 etheraddr[ETH_ALEN])
1903 {
1904 	struct ssb_sprom *sprom = &wlc_hw->d11core->bus->sprom;
1905 
1906 	/* If macaddr exists, use it (Sromrev4, CIS, ...). */
1907 	if (!is_zero_ether_addr(sprom->il0mac)) {
1908 		memcpy(etheraddr, sprom->il0mac, ETH_ALEN);
1909 		return;
1910 	}
1911 
1912 	if (wlc_hw->_nbands > 1)
1913 		memcpy(etheraddr, sprom->et1mac, ETH_ALEN);
1914 	else
1915 		memcpy(etheraddr, sprom->il0mac, ETH_ALEN);
1916 }
1917 
1918 /* power both the pll and external oscillator on/off */
1919 static void brcms_b_xtal(struct brcms_hardware *wlc_hw, bool want)
1920 {
1921 	brcms_dbg_info(wlc_hw->d11core, "wl%d: want %d\n", wlc_hw->unit, want);
1922 
1923 	/*
1924 	 * dont power down if plldown is false or
1925 	 * we must poll hw radio disable
1926 	 */
1927 	if (!want && wlc_hw->pllreq)
1928 		return;
1929 
1930 	wlc_hw->sbclk = want;
1931 	if (!wlc_hw->sbclk) {
1932 		wlc_hw->clk = false;
1933 		if (wlc_hw->band && wlc_hw->band->pi)
1934 			wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
1935 	}
1936 }
1937 
1938 /*
1939  * Return true if radio is disabled, otherwise false.
1940  * hw radio disable signal is an external pin, users activate it asynchronously
1941  * this function could be called when driver is down and w/o clock
1942  * it operates on different registers depending on corerev and boardflag.
1943  */
1944 static bool brcms_b_radio_read_hwdisabled(struct brcms_hardware *wlc_hw)
1945 {
1946 	bool v, clk, xtal;
1947 	u32 flags = 0;
1948 
1949 	xtal = wlc_hw->sbclk;
1950 	if (!xtal)
1951 		brcms_b_xtal(wlc_hw, ON);
1952 
1953 	/* may need to take core out of reset first */
1954 	clk = wlc_hw->clk;
1955 	if (!clk) {
1956 		/*
1957 		 * mac no longer enables phyclk automatically when driver
1958 		 * accesses phyreg throughput mac. This can be skipped since
1959 		 * only mac reg is accessed below
1960 		 */
1961 		if (D11REV_GE(wlc_hw->corerev, 18))
1962 			flags |= SICF_PCLKE;
1963 
1964 		/*
1965 		 * TODO: test suspend/resume
1966 		 *
1967 		 * AI chip doesn't restore bar0win2 on
1968 		 * hibernation/resume, need sw fixup
1969 		 */
1970 
1971 		bcma_core_enable(wlc_hw->d11core, flags);
1972 		brcms_c_mctrl_reset(wlc_hw);
1973 	}
1974 
1975 	v = ((bcma_read32(wlc_hw->d11core,
1976 			  D11REGOFFS(phydebug)) & PDBG_RFD) != 0);
1977 
1978 	/* put core back into reset */
1979 	if (!clk)
1980 		bcma_core_disable(wlc_hw->d11core, 0);
1981 
1982 	if (!xtal)
1983 		brcms_b_xtal(wlc_hw, OFF);
1984 
1985 	return v;
1986 }
1987 
1988 static bool wlc_dma_rxreset(struct brcms_hardware *wlc_hw, uint fifo)
1989 {
1990 	struct dma_pub *di = wlc_hw->di[fifo];
1991 	return dma_rxreset(di);
1992 }
1993 
1994 /* d11 core reset
1995  *   ensure fask clock during reset
1996  *   reset dma
1997  *   reset d11(out of reset)
1998  *   reset phy(out of reset)
1999  *   clear software macintstatus for fresh new start
2000  * one testing hack wlc_hw->noreset will bypass the d11/phy reset
2001  */
2002 void brcms_b_corereset(struct brcms_hardware *wlc_hw, u32 flags)
2003 {
2004 	uint i;
2005 	bool fastclk;
2006 
2007 	if (flags == BRCMS_USE_COREFLAGS)
2008 		flags = (wlc_hw->band->pi ? wlc_hw->band->core_flags : 0);
2009 
2010 	brcms_dbg_info(wlc_hw->d11core, "wl%d: core reset\n", wlc_hw->unit);
2011 
2012 	/* request FAST clock if not on  */
2013 	fastclk = wlc_hw->forcefastclk;
2014 	if (!fastclk)
2015 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2016 
2017 	/* reset the dma engines except first time thru */
2018 	if (bcma_core_is_enabled(wlc_hw->d11core)) {
2019 		for (i = 0; i < NFIFO; i++)
2020 			if ((wlc_hw->di[i]) && (!dma_txreset(wlc_hw->di[i])))
2021 				brcms_err(wlc_hw->d11core, "wl%d: %s: "
2022 					  "dma_txreset[%d]: cannot stop dma\n",
2023 					   wlc_hw->unit, __func__, i);
2024 
2025 		if ((wlc_hw->di[RX_FIFO])
2026 		    && (!wlc_dma_rxreset(wlc_hw, RX_FIFO)))
2027 			brcms_err(wlc_hw->d11core, "wl%d: %s: dma_rxreset"
2028 				  "[%d]: cannot stop dma\n",
2029 				  wlc_hw->unit, __func__, RX_FIFO);
2030 	}
2031 	/* if noreset, just stop the psm and return */
2032 	if (wlc_hw->noreset) {
2033 		wlc_hw->wlc->macintstatus = 0;	/* skip wl_dpc after down */
2034 		brcms_b_mctrl(wlc_hw, MCTL_PSM_RUN | MCTL_EN_MAC, 0);
2035 		return;
2036 	}
2037 
2038 	/*
2039 	 * mac no longer enables phyclk automatically when driver accesses
2040 	 * phyreg throughput mac, AND phy_reset is skipped at early stage when
2041 	 * band->pi is invalid. need to enable PHY CLK
2042 	 */
2043 	if (D11REV_GE(wlc_hw->corerev, 18))
2044 		flags |= SICF_PCLKE;
2045 
2046 	/*
2047 	 * reset the core
2048 	 * In chips with PMU, the fastclk request goes through d11 core
2049 	 * reg 0x1e0, which is cleared by the core_reset. have to re-request it.
2050 	 *
2051 	 * This adds some delay and we can optimize it by also requesting
2052 	 * fastclk through chipcommon during this period if necessary. But
2053 	 * that has to work coordinate with other driver like mips/arm since
2054 	 * they may touch chipcommon as well.
2055 	 */
2056 	wlc_hw->clk = false;
2057 	bcma_core_enable(wlc_hw->d11core, flags);
2058 	wlc_hw->clk = true;
2059 	if (wlc_hw->band && wlc_hw->band->pi)
2060 		wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, true);
2061 
2062 	brcms_c_mctrl_reset(wlc_hw);
2063 
2064 	if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU)
2065 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
2066 
2067 	brcms_b_phy_reset(wlc_hw);
2068 
2069 	/* turn on PHY_PLL */
2070 	brcms_b_core_phypll_ctl(wlc_hw, true);
2071 
2072 	/* clear sw intstatus */
2073 	wlc_hw->wlc->macintstatus = 0;
2074 
2075 	/* restore the clk setting */
2076 	if (!fastclk)
2077 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
2078 }
2079 
2080 /* txfifo sizes needs to be modified(increased) since the newer cores
2081  * have more memory.
2082  */
2083 static void brcms_b_corerev_fifofixup(struct brcms_hardware *wlc_hw)
2084 {
2085 	struct bcma_device *core = wlc_hw->d11core;
2086 	u16 fifo_nu;
2087 	u16 txfifo_startblk = TXFIFO_START_BLK, txfifo_endblk;
2088 	u16 txfifo_def, txfifo_def1;
2089 	u16 txfifo_cmd;
2090 
2091 	/* tx fifos start at TXFIFO_START_BLK from the Base address */
2092 	txfifo_startblk = TXFIFO_START_BLK;
2093 
2094 	/* sequence of operations:  reset fifo, set fifo size, reset fifo */
2095 	for (fifo_nu = 0; fifo_nu < NFIFO; fifo_nu++) {
2096 
2097 		txfifo_endblk = txfifo_startblk + wlc_hw->xmtfifo_sz[fifo_nu];
2098 		txfifo_def = (txfifo_startblk & 0xff) |
2099 		    (((txfifo_endblk - 1) & 0xff) << TXFIFO_FIFOTOP_SHIFT);
2100 		txfifo_def1 = ((txfifo_startblk >> 8) & 0x1) |
2101 		    ((((txfifo_endblk -
2102 			1) >> 8) & 0x1) << TXFIFO_FIFOTOP_SHIFT);
2103 		txfifo_cmd =
2104 		    TXFIFOCMD_RESET_MASK | (fifo_nu << TXFIFOCMD_FIFOSEL_SHIFT);
2105 
2106 		bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2107 		bcma_write16(core, D11REGOFFS(xmtfifodef), txfifo_def);
2108 		bcma_write16(core, D11REGOFFS(xmtfifodef1), txfifo_def1);
2109 
2110 		bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
2111 
2112 		txfifo_startblk += wlc_hw->xmtfifo_sz[fifo_nu];
2113 	}
2114 	/*
2115 	 * need to propagate to shm location to be in sync since ucode/hw won't
2116 	 * do this
2117 	 */
2118 	brcms_b_write_shm(wlc_hw, M_FIFOSIZE0,
2119 			   wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]);
2120 	brcms_b_write_shm(wlc_hw, M_FIFOSIZE1,
2121 			   wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]);
2122 	brcms_b_write_shm(wlc_hw, M_FIFOSIZE2,
2123 			   ((wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO] << 8) | wlc_hw->
2124 			    xmtfifo_sz[TX_AC_BK_FIFO]));
2125 	brcms_b_write_shm(wlc_hw, M_FIFOSIZE3,
2126 			   ((wlc_hw->xmtfifo_sz[TX_ATIM_FIFO] << 8) | wlc_hw->
2127 			    xmtfifo_sz[TX_BCMC_FIFO]));
2128 }
2129 
2130 /* This function is used for changing the tsf frac register
2131  * If spur avoidance mode is off, the mac freq will be 80/120/160Mhz
2132  * If spur avoidance mode is on1, the mac freq will be 82/123/164Mhz
2133  * If spur avoidance mode is on2, the mac freq will be 84/126/168Mhz
2134  * HTPHY Formula is 2^26/freq(MHz) e.g.
2135  * For spuron2 - 126MHz -> 2^26/126 = 532610.0
2136  *  - 532610 = 0x82082 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x2082
2137  * For spuron: 123MHz -> 2^26/123    = 545600.5
2138  *  - 545601 = 0x85341 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x5341
2139  * For spur off: 120MHz -> 2^26/120    = 559240.5
2140  *  - 559241 = 0x88889 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x8889
2141  */
2142 
2143 void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode)
2144 {
2145 	struct bcma_device *core = wlc_hw->d11core;
2146 
2147 	if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43224) ||
2148 	    (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225)) {
2149 		if (spurmode == WL_SPURAVOID_ON2) {	/* 126Mhz */
2150 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x2082);
2151 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2152 		} else if (spurmode == WL_SPURAVOID_ON1) {	/* 123Mhz */
2153 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x5341);
2154 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2155 		} else {	/* 120Mhz */
2156 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x8889);
2157 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
2158 		}
2159 	} else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2160 		if (spurmode == WL_SPURAVOID_ON1) {	/* 82Mhz */
2161 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x7CE0);
2162 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2163 		} else {	/* 80Mhz */
2164 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0xCCCD);
2165 			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
2166 		}
2167 	}
2168 }
2169 
2170 void brcms_c_start_station(struct brcms_c_info *wlc, u8 *addr)
2171 {
2172 	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2173 	wlc->bsscfg->type = BRCMS_TYPE_STATION;
2174 }
2175 
2176 void brcms_c_start_ap(struct brcms_c_info *wlc, u8 *addr, const u8 *bssid,
2177 		      u8 *ssid, size_t ssid_len)
2178 {
2179 	brcms_c_set_ssid(wlc, ssid, ssid_len);
2180 
2181 	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2182 	memcpy(wlc->bsscfg->BSSID, bssid, sizeof(wlc->bsscfg->BSSID));
2183 	wlc->bsscfg->type = BRCMS_TYPE_AP;
2184 
2185 	brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, MCTL_AP | MCTL_INFRA);
2186 }
2187 
2188 void brcms_c_start_adhoc(struct brcms_c_info *wlc, u8 *addr)
2189 {
2190 	memcpy(wlc->pub->cur_etheraddr, addr, sizeof(wlc->pub->cur_etheraddr));
2191 	wlc->bsscfg->type = BRCMS_TYPE_ADHOC;
2192 
2193 	brcms_b_mctrl(wlc->hw, MCTL_AP | MCTL_INFRA, 0);
2194 }
2195 
2196 /* Initialize GPIOs that are controlled by D11 core */
2197 static void brcms_c_gpio_init(struct brcms_c_info *wlc)
2198 {
2199 	struct brcms_hardware *wlc_hw = wlc->hw;
2200 	u32 gc, gm;
2201 
2202 	/* use GPIO select 0 to get all gpio signals from the gpio out reg */
2203 	brcms_b_mctrl(wlc_hw, MCTL_GPOUT_SEL_MASK, 0);
2204 
2205 	/*
2206 	 * Common GPIO setup:
2207 	 *      G0 = LED 0 = WLAN Activity
2208 	 *      G1 = LED 1 = WLAN 2.4 GHz Radio State
2209 	 *      G2 = LED 2 = WLAN 5 GHz Radio State
2210 	 *      G4 = radio disable input (HI enabled, LO disabled)
2211 	 */
2212 
2213 	gc = gm = 0;
2214 
2215 	/* Allocate GPIOs for mimo antenna diversity feature */
2216 	if (wlc_hw->antsel_type == ANTSEL_2x3) {
2217 		/* Enable antenna diversity, use 2x3 mode */
2218 		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2219 			     MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2220 		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE,
2221 			     MHF3_ANTSEL_MODE, BRCM_BAND_ALL);
2222 
2223 		/* init superswitch control */
2224 		wlc_phy_antsel_init(wlc_hw->band->pi, false);
2225 
2226 	} else if (wlc_hw->antsel_type == ANTSEL_2x4) {
2227 		gm |= gc |= (BOARD_GPIO_12 | BOARD_GPIO_13);
2228 		/*
2229 		 * The board itself is powered by these GPIOs
2230 		 * (when not sending pattern) so set them high
2231 		 */
2232 		bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_oe),
2233 			   (BOARD_GPIO_12 | BOARD_GPIO_13));
2234 		bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_out),
2235 			   (BOARD_GPIO_12 | BOARD_GPIO_13));
2236 
2237 		/* Enable antenna diversity, use 2x4 mode */
2238 		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
2239 			     MHF3_ANTSEL_EN, BRCM_BAND_ALL);
2240 		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE, 0,
2241 			     BRCM_BAND_ALL);
2242 
2243 		/* Configure the desired clock to be 4Mhz */
2244 		brcms_b_write_shm(wlc_hw, M_ANTSEL_CLKDIV,
2245 				   ANTSEL_CLKDIV_4MHZ);
2246 	}
2247 
2248 	/*
2249 	 * gpio 9 controls the PA. ucode is responsible
2250 	 * for wiggling out and oe
2251 	 */
2252 	if (wlc_hw->boardflags & BFL_PACTRL)
2253 		gm |= gc |= BOARD_GPIO_PACTRL;
2254 
2255 	/* apply to gpiocontrol register */
2256 	bcma_chipco_gpio_control(&wlc_hw->d11core->bus->drv_cc, gm, gc);
2257 }
2258 
2259 static void brcms_ucode_write(struct brcms_hardware *wlc_hw,
2260 			      const __le32 ucode[], const size_t nbytes)
2261 {
2262 	struct bcma_device *core = wlc_hw->d11core;
2263 	uint i;
2264 	uint count;
2265 
2266 	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
2267 
2268 	count = (nbytes / sizeof(u32));
2269 
2270 	bcma_write32(core, D11REGOFFS(objaddr),
2271 		     OBJADDR_AUTO_INC | OBJADDR_UCM_SEL);
2272 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2273 	for (i = 0; i < count; i++)
2274 		bcma_write32(core, D11REGOFFS(objdata), le32_to_cpu(ucode[i]));
2275 
2276 }
2277 
2278 static void brcms_ucode_download(struct brcms_hardware *wlc_hw)
2279 {
2280 	struct brcms_c_info *wlc;
2281 	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
2282 
2283 	wlc = wlc_hw->wlc;
2284 
2285 	if (wlc_hw->ucode_loaded)
2286 		return;
2287 
2288 	if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
2289 		if (BRCMS_ISNPHY(wlc_hw->band)) {
2290 			brcms_ucode_write(wlc_hw, ucode->bcm43xx_16_mimo,
2291 					  ucode->bcm43xx_16_mimosz);
2292 			wlc_hw->ucode_loaded = true;
2293 		} else
2294 			brcms_err(wlc_hw->d11core,
2295 				  "%s: wl%d: unsupported phy in corerev %d\n",
2296 				  __func__, wlc_hw->unit, wlc_hw->corerev);
2297 	} else if (D11REV_IS(wlc_hw->corerev, 24)) {
2298 		if (BRCMS_ISLCNPHY(wlc_hw->band)) {
2299 			brcms_ucode_write(wlc_hw, ucode->bcm43xx_24_lcn,
2300 					  ucode->bcm43xx_24_lcnsz);
2301 			wlc_hw->ucode_loaded = true;
2302 		} else {
2303 			brcms_err(wlc_hw->d11core,
2304 				  "%s: wl%d: unsupported phy in corerev %d\n",
2305 				  __func__, wlc_hw->unit, wlc_hw->corerev);
2306 		}
2307 	}
2308 }
2309 
2310 void brcms_b_txant_set(struct brcms_hardware *wlc_hw, u16 phytxant)
2311 {
2312 	/* update sw state */
2313 	wlc_hw->bmac_phytxant = phytxant;
2314 
2315 	/* push to ucode if up */
2316 	if (!wlc_hw->up)
2317 		return;
2318 	brcms_c_ucode_txant_set(wlc_hw);
2319 
2320 }
2321 
2322 u16 brcms_b_get_txant(struct brcms_hardware *wlc_hw)
2323 {
2324 	return (u16) wlc_hw->wlc->stf->txant;
2325 }
2326 
2327 void brcms_b_antsel_type_set(struct brcms_hardware *wlc_hw, u8 antsel_type)
2328 {
2329 	wlc_hw->antsel_type = antsel_type;
2330 
2331 	/* Update the antsel type for phy module to use */
2332 	wlc_phy_antsel_type_set(wlc_hw->band->pi, antsel_type);
2333 }
2334 
2335 static void brcms_b_fifoerrors(struct brcms_hardware *wlc_hw)
2336 {
2337 	bool fatal = false;
2338 	uint unit;
2339 	uint intstatus, idx;
2340 	struct bcma_device *core = wlc_hw->d11core;
2341 
2342 	unit = wlc_hw->unit;
2343 
2344 	for (idx = 0; idx < NFIFO; idx++) {
2345 		/* read intstatus register and ignore any non-error bits */
2346 		intstatus =
2347 			bcma_read32(core,
2348 				    D11REGOFFS(intctrlregs[idx].intstatus)) &
2349 			I_ERRORS;
2350 		if (!intstatus)
2351 			continue;
2352 
2353 		brcms_dbg_int(core, "wl%d: intstatus%d 0x%x\n",
2354 			      unit, idx, intstatus);
2355 
2356 		if (intstatus & I_RO) {
2357 			brcms_err(core, "wl%d: fifo %d: receive fifo "
2358 				  "overflow\n", unit, idx);
2359 			fatal = true;
2360 		}
2361 
2362 		if (intstatus & I_PC) {
2363 			brcms_err(core, "wl%d: fifo %d: descriptor error\n",
2364 				  unit, idx);
2365 			fatal = true;
2366 		}
2367 
2368 		if (intstatus & I_PD) {
2369 			brcms_err(core, "wl%d: fifo %d: data error\n", unit,
2370 				  idx);
2371 			fatal = true;
2372 		}
2373 
2374 		if (intstatus & I_DE) {
2375 			brcms_err(core, "wl%d: fifo %d: descriptor protocol "
2376 				  "error\n", unit, idx);
2377 			fatal = true;
2378 		}
2379 
2380 		if (intstatus & I_RU)
2381 			brcms_err(core, "wl%d: fifo %d: receive descriptor "
2382 				  "underflow\n", idx, unit);
2383 
2384 		if (intstatus & I_XU) {
2385 			brcms_err(core, "wl%d: fifo %d: transmit fifo "
2386 				  "underflow\n", idx, unit);
2387 			fatal = true;
2388 		}
2389 
2390 		if (fatal) {
2391 			brcms_fatal_error(wlc_hw->wlc->wl); /* big hammer */
2392 			break;
2393 		} else
2394 			bcma_write32(core,
2395 				     D11REGOFFS(intctrlregs[idx].intstatus),
2396 				     intstatus);
2397 	}
2398 }
2399 
2400 void brcms_c_intrson(struct brcms_c_info *wlc)
2401 {
2402 	struct brcms_hardware *wlc_hw = wlc->hw;
2403 	wlc->macintmask = wlc->defmacintmask;
2404 	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2405 }
2406 
2407 u32 brcms_c_intrsoff(struct brcms_c_info *wlc)
2408 {
2409 	struct brcms_hardware *wlc_hw = wlc->hw;
2410 	u32 macintmask;
2411 
2412 	if (!wlc_hw->clk)
2413 		return 0;
2414 
2415 	macintmask = wlc->macintmask;	/* isr can still happen */
2416 
2417 	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), 0);
2418 	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(macintmask));
2419 	udelay(1);		/* ensure int line is no longer driven */
2420 	wlc->macintmask = 0;
2421 
2422 	/* return previous macintmask; resolve race between us and our isr */
2423 	return wlc->macintstatus ? 0 : macintmask;
2424 }
2425 
2426 void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask)
2427 {
2428 	struct brcms_hardware *wlc_hw = wlc->hw;
2429 	if (!wlc_hw->clk)
2430 		return;
2431 
2432 	wlc->macintmask = macintmask;
2433 	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
2434 }
2435 
2436 /* assumes that the d11 MAC is enabled */
2437 static void brcms_b_tx_fifo_suspend(struct brcms_hardware *wlc_hw,
2438 				    uint tx_fifo)
2439 {
2440 	u8 fifo = 1 << tx_fifo;
2441 
2442 	/* Two clients of this code, 11h Quiet period and scanning. */
2443 
2444 	/* only suspend if not already suspended */
2445 	if ((wlc_hw->suspended_fifos & fifo) == fifo)
2446 		return;
2447 
2448 	/* force the core awake only if not already */
2449 	if (wlc_hw->suspended_fifos == 0)
2450 		brcms_c_ucode_wake_override_set(wlc_hw,
2451 						BRCMS_WAKE_OVERRIDE_TXFIFO);
2452 
2453 	wlc_hw->suspended_fifos |= fifo;
2454 
2455 	if (wlc_hw->di[tx_fifo]) {
2456 		/*
2457 		 * Suspending AMPDU transmissions in the middle can cause
2458 		 * underflow which may result in mismatch between ucode and
2459 		 * driver so suspend the mac before suspending the FIFO
2460 		 */
2461 		if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2462 			brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
2463 
2464 		dma_txsuspend(wlc_hw->di[tx_fifo]);
2465 
2466 		if (BRCMS_PHY_11N_CAP(wlc_hw->band))
2467 			brcms_c_enable_mac(wlc_hw->wlc);
2468 	}
2469 }
2470 
2471 static void brcms_b_tx_fifo_resume(struct brcms_hardware *wlc_hw,
2472 				   uint tx_fifo)
2473 {
2474 	/* BMAC_NOTE: BRCMS_TX_FIFO_ENAB is done in brcms_c_dpc() for DMA case
2475 	 * but need to be done here for PIO otherwise the watchdog will catch
2476 	 * the inconsistency and fire
2477 	 */
2478 	/* Two clients of this code, 11h Quiet period and scanning. */
2479 	if (wlc_hw->di[tx_fifo])
2480 		dma_txresume(wlc_hw->di[tx_fifo]);
2481 
2482 	/* allow core to sleep again */
2483 	if (wlc_hw->suspended_fifos == 0)
2484 		return;
2485 	else {
2486 		wlc_hw->suspended_fifos &= ~(1 << tx_fifo);
2487 		if (wlc_hw->suspended_fifos == 0)
2488 			brcms_c_ucode_wake_override_clear(wlc_hw,
2489 						BRCMS_WAKE_OVERRIDE_TXFIFO);
2490 	}
2491 }
2492 
2493 /* precondition: requires the mac core to be enabled */
2494 static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
2495 {
2496 	static const u8 null_ether_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
2497 	u8 *ethaddr = wlc_hw->wlc->pub->cur_etheraddr;
2498 
2499 	if (mute_tx) {
2500 		/* suspend tx fifos */
2501 		brcms_b_tx_fifo_suspend(wlc_hw, TX_DATA_FIFO);
2502 		brcms_b_tx_fifo_suspend(wlc_hw, TX_CTL_FIFO);
2503 		brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_BK_FIFO);
2504 		brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_VI_FIFO);
2505 
2506 		/* zero the address match register so we do not send ACKs */
2507 		brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, null_ether_addr);
2508 	} else {
2509 		/* resume tx fifos */
2510 		brcms_b_tx_fifo_resume(wlc_hw, TX_DATA_FIFO);
2511 		brcms_b_tx_fifo_resume(wlc_hw, TX_CTL_FIFO);
2512 		brcms_b_tx_fifo_resume(wlc_hw, TX_AC_BK_FIFO);
2513 		brcms_b_tx_fifo_resume(wlc_hw, TX_AC_VI_FIFO);
2514 
2515 		/* Restore address */
2516 		brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, ethaddr);
2517 	}
2518 
2519 	wlc_phy_mute_upd(wlc_hw->band->pi, mute_tx, 0);
2520 
2521 	if (mute_tx)
2522 		brcms_c_ucode_mute_override_set(wlc_hw);
2523 	else
2524 		brcms_c_ucode_mute_override_clear(wlc_hw);
2525 }
2526 
2527 void
2528 brcms_c_mute(struct brcms_c_info *wlc, bool mute_tx)
2529 {
2530 	brcms_b_mute(wlc->hw, mute_tx);
2531 }
2532 
2533 /*
2534  * Read and clear macintmask and macintstatus and intstatus registers.
2535  * This routine should be called with interrupts off
2536  * Return:
2537  *   -1 if brcms_deviceremoved(wlc) evaluates to true;
2538  *   0 if the interrupt is not for us, or we are in some special cases;
2539  *   device interrupt status bits otherwise.
2540  */
2541 static inline u32 wlc_intstatus(struct brcms_c_info *wlc, bool in_isr)
2542 {
2543 	struct brcms_hardware *wlc_hw = wlc->hw;
2544 	struct bcma_device *core = wlc_hw->d11core;
2545 	u32 macintstatus, mask;
2546 
2547 	/* macintstatus includes a DMA interrupt summary bit */
2548 	macintstatus = bcma_read32(core, D11REGOFFS(macintstatus));
2549 	mask = in_isr ? wlc->macintmask : wlc->defmacintmask;
2550 
2551 	trace_brcms_macintstatus(&core->dev, in_isr, macintstatus, mask);
2552 
2553 	/* detect cardbus removed, in power down(suspend) and in reset */
2554 	if (brcms_deviceremoved(wlc))
2555 		return -1;
2556 
2557 	/* brcms_deviceremoved() succeeds even when the core is still resetting,
2558 	 * handle that case here.
2559 	 */
2560 	if (macintstatus == 0xffffffff)
2561 		return 0;
2562 
2563 	/* defer unsolicited interrupts */
2564 	macintstatus &= mask;
2565 
2566 	/* if not for us */
2567 	if (macintstatus == 0)
2568 		return 0;
2569 
2570 	/* turn off the interrupts */
2571 	bcma_write32(core, D11REGOFFS(macintmask), 0);
2572 	(void)bcma_read32(core, D11REGOFFS(macintmask));
2573 	wlc->macintmask = 0;
2574 
2575 	/* clear device interrupts */
2576 	bcma_write32(core, D11REGOFFS(macintstatus), macintstatus);
2577 
2578 	/* MI_DMAINT is indication of non-zero intstatus */
2579 	if (macintstatus & MI_DMAINT)
2580 		/*
2581 		 * only fifo interrupt enabled is I_RI in
2582 		 * RX_FIFO. If MI_DMAINT is set, assume it
2583 		 * is set and clear the interrupt.
2584 		 */
2585 		bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intstatus),
2586 			     DEF_RXINTMASK);
2587 
2588 	return macintstatus;
2589 }
2590 
2591 /* Update wlc->macintstatus and wlc->intstatus[]. */
2592 /* Return true if they are updated successfully. false otherwise */
2593 bool brcms_c_intrsupd(struct brcms_c_info *wlc)
2594 {
2595 	u32 macintstatus;
2596 
2597 	/* read and clear macintstatus and intstatus registers */
2598 	macintstatus = wlc_intstatus(wlc, false);
2599 
2600 	/* device is removed */
2601 	if (macintstatus == 0xffffffff)
2602 		return false;
2603 
2604 	/* update interrupt status in software */
2605 	wlc->macintstatus |= macintstatus;
2606 
2607 	return true;
2608 }
2609 
2610 /*
2611  * First-level interrupt processing.
2612  * Return true if this was our interrupt
2613  * and if further brcms_c_dpc() processing is required,
2614  * false otherwise.
2615  */
2616 bool brcms_c_isr(struct brcms_c_info *wlc)
2617 {
2618 	struct brcms_hardware *wlc_hw = wlc->hw;
2619 	u32 macintstatus;
2620 
2621 	if (!wlc_hw->up || !wlc->macintmask)
2622 		return false;
2623 
2624 	/* read and clear macintstatus and intstatus registers */
2625 	macintstatus = wlc_intstatus(wlc, true);
2626 
2627 	if (macintstatus == 0xffffffff) {
2628 		brcms_err(wlc_hw->d11core,
2629 			  "DEVICEREMOVED detected in the ISR code path\n");
2630 		return false;
2631 	}
2632 
2633 	/* it is not for us */
2634 	if (macintstatus == 0)
2635 		return false;
2636 
2637 	/* save interrupt status bits */
2638 	wlc->macintstatus = macintstatus;
2639 
2640 	return true;
2641 
2642 }
2643 
2644 void brcms_c_suspend_mac_and_wait(struct brcms_c_info *wlc)
2645 {
2646 	struct brcms_hardware *wlc_hw = wlc->hw;
2647 	struct bcma_device *core = wlc_hw->d11core;
2648 	u32 mc, mi;
2649 
2650 	brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2651 			   wlc_hw->band->bandunit);
2652 
2653 	/*
2654 	 * Track overlapping suspend requests
2655 	 */
2656 	wlc_hw->mac_suspend_depth++;
2657 	if (wlc_hw->mac_suspend_depth > 1)
2658 		return;
2659 
2660 	/* force the core awake */
2661 	brcms_c_ucode_wake_override_set(wlc_hw, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2662 
2663 	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2664 
2665 	if (mc == 0xffffffff) {
2666 		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2667 			  __func__);
2668 		brcms_down(wlc->wl);
2669 		return;
2670 	}
2671 	WARN_ON(mc & MCTL_PSM_JMP_0);
2672 	WARN_ON(!(mc & MCTL_PSM_RUN));
2673 	WARN_ON(!(mc & MCTL_EN_MAC));
2674 
2675 	mi = bcma_read32(core, D11REGOFFS(macintstatus));
2676 	if (mi == 0xffffffff) {
2677 		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2678 			  __func__);
2679 		brcms_down(wlc->wl);
2680 		return;
2681 	}
2682 	WARN_ON(mi & MI_MACSSPNDD);
2683 
2684 	brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, 0);
2685 
2686 	SPINWAIT(!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD),
2687 		 BRCMS_MAX_MAC_SUSPEND);
2688 
2689 	if (!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD)) {
2690 		brcms_err(core, "wl%d: wlc_suspend_mac_and_wait: waited %d uS"
2691 			  " and MI_MACSSPNDD is still not on.\n",
2692 			  wlc_hw->unit, BRCMS_MAX_MAC_SUSPEND);
2693 		brcms_err(core, "wl%d: psmdebug 0x%08x, phydebug 0x%08x, "
2694 			  "psm_brc 0x%04x\n", wlc_hw->unit,
2695 			  bcma_read32(core, D11REGOFFS(psmdebug)),
2696 			  bcma_read32(core, D11REGOFFS(phydebug)),
2697 			  bcma_read16(core, D11REGOFFS(psm_brc)));
2698 	}
2699 
2700 	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2701 	if (mc == 0xffffffff) {
2702 		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
2703 			  __func__);
2704 		brcms_down(wlc->wl);
2705 		return;
2706 	}
2707 	WARN_ON(mc & MCTL_PSM_JMP_0);
2708 	WARN_ON(!(mc & MCTL_PSM_RUN));
2709 	WARN_ON(mc & MCTL_EN_MAC);
2710 }
2711 
2712 void brcms_c_enable_mac(struct brcms_c_info *wlc)
2713 {
2714 	struct brcms_hardware *wlc_hw = wlc->hw;
2715 	struct bcma_device *core = wlc_hw->d11core;
2716 	u32 mc, mi;
2717 
2718 	brcms_dbg_mac80211(core, "wl%d: bandunit %d\n", wlc_hw->unit,
2719 			   wlc->band->bandunit);
2720 
2721 	/*
2722 	 * Track overlapping suspend requests
2723 	 */
2724 	wlc_hw->mac_suspend_depth--;
2725 	if (wlc_hw->mac_suspend_depth > 0)
2726 		return;
2727 
2728 	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2729 	WARN_ON(mc & MCTL_PSM_JMP_0);
2730 	WARN_ON(mc & MCTL_EN_MAC);
2731 	WARN_ON(!(mc & MCTL_PSM_RUN));
2732 
2733 	brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, MCTL_EN_MAC);
2734 	bcma_write32(core, D11REGOFFS(macintstatus), MI_MACSSPNDD);
2735 
2736 	mc = bcma_read32(core, D11REGOFFS(maccontrol));
2737 	WARN_ON(mc & MCTL_PSM_JMP_0);
2738 	WARN_ON(!(mc & MCTL_EN_MAC));
2739 	WARN_ON(!(mc & MCTL_PSM_RUN));
2740 
2741 	mi = bcma_read32(core, D11REGOFFS(macintstatus));
2742 	WARN_ON(mi & MI_MACSSPNDD);
2743 
2744 	brcms_c_ucode_wake_override_clear(wlc_hw,
2745 					  BRCMS_WAKE_OVERRIDE_MACSUSPEND);
2746 }
2747 
2748 void brcms_b_band_stf_ss_set(struct brcms_hardware *wlc_hw, u8 stf_mode)
2749 {
2750 	wlc_hw->hw_stf_ss_opmode = stf_mode;
2751 
2752 	if (wlc_hw->clk)
2753 		brcms_upd_ofdm_pctl1_table(wlc_hw);
2754 }
2755 
2756 static bool brcms_b_validate_chip_access(struct brcms_hardware *wlc_hw)
2757 {
2758 	struct bcma_device *core = wlc_hw->d11core;
2759 	u32 w, val;
2760 	struct wiphy *wiphy = wlc_hw->wlc->wiphy;
2761 
2762 	/* Validate dchip register access */
2763 
2764 	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2765 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2766 	w = bcma_read32(core, D11REGOFFS(objdata));
2767 
2768 	/* Can we write and read back a 32bit register? */
2769 	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2770 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2771 	bcma_write32(core, D11REGOFFS(objdata), (u32) 0xaa5555aa);
2772 
2773 	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2774 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2775 	val = bcma_read32(core, D11REGOFFS(objdata));
2776 	if (val != (u32) 0xaa5555aa) {
2777 		wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2778 			  "expected 0xaa5555aa\n", wlc_hw->unit, val);
2779 		return false;
2780 	}
2781 
2782 	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2783 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2784 	bcma_write32(core, D11REGOFFS(objdata), (u32) 0x55aaaa55);
2785 
2786 	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2787 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2788 	val = bcma_read32(core, D11REGOFFS(objdata));
2789 	if (val != (u32) 0x55aaaa55) {
2790 		wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
2791 			  "expected 0x55aaaa55\n", wlc_hw->unit, val);
2792 		return false;
2793 	}
2794 
2795 	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
2796 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2797 	bcma_write32(core, D11REGOFFS(objdata), w);
2798 
2799 	/* clear CFPStart */
2800 	bcma_write32(core, D11REGOFFS(tsf_cfpstart), 0);
2801 
2802 	w = bcma_read32(core, D11REGOFFS(maccontrol));
2803 	if ((w != (MCTL_IHR_EN | MCTL_WAKE)) &&
2804 	    (w != (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE))) {
2805 		wiphy_err(wiphy, "wl%d: validate_chip_access: maccontrol = "
2806 			  "0x%x, expected 0x%x or 0x%x\n", wlc_hw->unit, w,
2807 			  (MCTL_IHR_EN | MCTL_WAKE),
2808 			  (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE));
2809 		return false;
2810 	}
2811 
2812 	return true;
2813 }
2814 
2815 #define PHYPLL_WAIT_US	100000
2816 
2817 void brcms_b_core_phypll_ctl(struct brcms_hardware *wlc_hw, bool on)
2818 {
2819 	struct bcma_device *core = wlc_hw->d11core;
2820 	u32 tmp;
2821 
2822 	brcms_dbg_info(core, "wl%d\n", wlc_hw->unit);
2823 
2824 	tmp = 0;
2825 
2826 	if (on) {
2827 		if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
2828 			bcma_set32(core, D11REGOFFS(clk_ctl_st),
2829 				   CCS_ERSRC_REQ_HT |
2830 				   CCS_ERSRC_REQ_D11PLL |
2831 				   CCS_ERSRC_REQ_PHYPLL);
2832 			SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2833 				  CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT,
2834 				 PHYPLL_WAIT_US);
2835 
2836 			tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2837 			if ((tmp & CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT)
2838 				brcms_err(core, "%s: turn on PHY PLL failed\n",
2839 					  __func__);
2840 		} else {
2841 			bcma_set32(core, D11REGOFFS(clk_ctl_st),
2842 				   tmp | CCS_ERSRC_REQ_D11PLL |
2843 				   CCS_ERSRC_REQ_PHYPLL);
2844 			SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
2845 				  (CCS_ERSRC_AVAIL_D11PLL |
2846 				   CCS_ERSRC_AVAIL_PHYPLL)) !=
2847 				 (CCS_ERSRC_AVAIL_D11PLL |
2848 				  CCS_ERSRC_AVAIL_PHYPLL), PHYPLL_WAIT_US);
2849 
2850 			tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
2851 			if ((tmp &
2852 			     (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2853 			    !=
2854 			    (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
2855 				brcms_err(core, "%s: turn on PHY PLL failed\n",
2856 					  __func__);
2857 		}
2858 	} else {
2859 		/*
2860 		 * Since the PLL may be shared, other cores can still
2861 		 * be requesting it; so we'll deassert the request but
2862 		 * not wait for status to comply.
2863 		 */
2864 		bcma_mask32(core, D11REGOFFS(clk_ctl_st),
2865 			    ~CCS_ERSRC_REQ_PHYPLL);
2866 		(void)bcma_read32(core, D11REGOFFS(clk_ctl_st));
2867 	}
2868 }
2869 
2870 static void brcms_c_coredisable(struct brcms_hardware *wlc_hw)
2871 {
2872 	bool dev_gone;
2873 
2874 	brcms_dbg_info(wlc_hw->d11core, "wl%d: disable core\n", wlc_hw->unit);
2875 
2876 	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
2877 
2878 	if (dev_gone)
2879 		return;
2880 
2881 	if (wlc_hw->noreset)
2882 		return;
2883 
2884 	/* radio off */
2885 	wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
2886 
2887 	/* turn off analog core */
2888 	wlc_phy_anacore(wlc_hw->band->pi, OFF);
2889 
2890 	/* turn off PHYPLL to save power */
2891 	brcms_b_core_phypll_ctl(wlc_hw, false);
2892 
2893 	wlc_hw->clk = false;
2894 	bcma_core_disable(wlc_hw->d11core, 0);
2895 	wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
2896 }
2897 
2898 static void brcms_c_flushqueues(struct brcms_c_info *wlc)
2899 {
2900 	struct brcms_hardware *wlc_hw = wlc->hw;
2901 	uint i;
2902 
2903 	/* free any posted tx packets */
2904 	for (i = 0; i < NFIFO; i++) {
2905 		if (wlc_hw->di[i]) {
2906 			dma_txreclaim(wlc_hw->di[i], DMA_RANGE_ALL);
2907 			if (i < TX_BCMC_FIFO)
2908 				ieee80211_wake_queue(wlc->pub->ieee_hw,
2909 						     brcms_fifo_to_ac(i));
2910 		}
2911 	}
2912 
2913 	/* free any posted rx packets */
2914 	dma_rxreclaim(wlc_hw->di[RX_FIFO]);
2915 }
2916 
2917 static u16
2918 brcms_b_read_objmem(struct brcms_hardware *wlc_hw, uint offset, u32 sel)
2919 {
2920 	struct bcma_device *core = wlc_hw->d11core;
2921 	u16 objoff = D11REGOFFS(objdata);
2922 
2923 	bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2924 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2925 	if (offset & 2)
2926 		objoff += 2;
2927 
2928 	return bcma_read16(core, objoff);
2929 }
2930 
2931 static void
2932 brcms_b_write_objmem(struct brcms_hardware *wlc_hw, uint offset, u16 v,
2933 		     u32 sel)
2934 {
2935 	struct bcma_device *core = wlc_hw->d11core;
2936 	u16 objoff = D11REGOFFS(objdata);
2937 
2938 	bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
2939 	(void)bcma_read32(core, D11REGOFFS(objaddr));
2940 	if (offset & 2)
2941 		objoff += 2;
2942 
2943 	bcma_wflush16(core, objoff, v);
2944 }
2945 
2946 /*
2947  * Read a single u16 from shared memory.
2948  * SHM 'offset' needs to be an even address
2949  */
2950 u16 brcms_b_read_shm(struct brcms_hardware *wlc_hw, uint offset)
2951 {
2952 	return brcms_b_read_objmem(wlc_hw, offset, OBJADDR_SHM_SEL);
2953 }
2954 
2955 /*
2956  * Write a single u16 to shared memory.
2957  * SHM 'offset' needs to be an even address
2958  */
2959 void brcms_b_write_shm(struct brcms_hardware *wlc_hw, uint offset, u16 v)
2960 {
2961 	brcms_b_write_objmem(wlc_hw, offset, v, OBJADDR_SHM_SEL);
2962 }
2963 
2964 /*
2965  * Copy a buffer to shared memory of specified type .
2966  * SHM 'offset' needs to be an even address and
2967  * Buffer length 'len' must be an even number of bytes
2968  * 'sel' selects the type of memory
2969  */
2970 void
2971 brcms_b_copyto_objmem(struct brcms_hardware *wlc_hw, uint offset,
2972 		      const void *buf, int len, u32 sel)
2973 {
2974 	u16 v;
2975 	const u8 *p = (const u8 *)buf;
2976 	int i;
2977 
2978 	if (len <= 0 || (offset & 1) || (len & 1))
2979 		return;
2980 
2981 	for (i = 0; i < len; i += 2) {
2982 		v = p[i] | (p[i + 1] << 8);
2983 		brcms_b_write_objmem(wlc_hw, offset + i, v, sel);
2984 	}
2985 }
2986 
2987 /*
2988  * Copy a piece of shared memory of specified type to a buffer .
2989  * SHM 'offset' needs to be an even address and
2990  * Buffer length 'len' must be an even number of bytes
2991  * 'sel' selects the type of memory
2992  */
2993 void
2994 brcms_b_copyfrom_objmem(struct brcms_hardware *wlc_hw, uint offset, void *buf,
2995 			 int len, u32 sel)
2996 {
2997 	u16 v;
2998 	u8 *p = (u8 *) buf;
2999 	int i;
3000 
3001 	if (len <= 0 || (offset & 1) || (len & 1))
3002 		return;
3003 
3004 	for (i = 0; i < len; i += 2) {
3005 		v = brcms_b_read_objmem(wlc_hw, offset + i, sel);
3006 		p[i] = v & 0xFF;
3007 		p[i + 1] = (v >> 8) & 0xFF;
3008 	}
3009 }
3010 
3011 /* Copy a buffer to shared memory.
3012  * SHM 'offset' needs to be an even address and
3013  * Buffer length 'len' must be an even number of bytes
3014  */
3015 static void brcms_c_copyto_shm(struct brcms_c_info *wlc, uint offset,
3016 			const void *buf, int len)
3017 {
3018 	brcms_b_copyto_objmem(wlc->hw, offset, buf, len, OBJADDR_SHM_SEL);
3019 }
3020 
3021 static void brcms_b_retrylimit_upd(struct brcms_hardware *wlc_hw,
3022 				   u16 SRL, u16 LRL)
3023 {
3024 	wlc_hw->SRL = SRL;
3025 	wlc_hw->LRL = LRL;
3026 
3027 	/* write retry limit to SCR, shouldn't need to suspend */
3028 	if (wlc_hw->up) {
3029 		bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3030 			     OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3031 		(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3032 		bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->SRL);
3033 		bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
3034 			     OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3035 		(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
3036 		bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->LRL);
3037 	}
3038 }
3039 
3040 static void brcms_b_pllreq(struct brcms_hardware *wlc_hw, bool set, u32 req_bit)
3041 {
3042 	if (set) {
3043 		if (mboolisset(wlc_hw->pllreq, req_bit))
3044 			return;
3045 
3046 		mboolset(wlc_hw->pllreq, req_bit);
3047 
3048 		if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3049 			if (!wlc_hw->sbclk)
3050 				brcms_b_xtal(wlc_hw, ON);
3051 		}
3052 	} else {
3053 		if (!mboolisset(wlc_hw->pllreq, req_bit))
3054 			return;
3055 
3056 		mboolclr(wlc_hw->pllreq, req_bit);
3057 
3058 		if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
3059 			if (wlc_hw->sbclk)
3060 				brcms_b_xtal(wlc_hw, OFF);
3061 		}
3062 	}
3063 }
3064 
3065 static void brcms_b_antsel_set(struct brcms_hardware *wlc_hw, u32 antsel_avail)
3066 {
3067 	wlc_hw->antsel_avail = antsel_avail;
3068 }
3069 
3070 /*
3071  * conditions under which the PM bit should be set in outgoing frames
3072  * and STAY_AWAKE is meaningful
3073  */
3074 static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
3075 {
3076 	/* not supporting PS so always return false for now */
3077 	return false;
3078 }
3079 
3080 static void brcms_c_statsupd(struct brcms_c_info *wlc)
3081 {
3082 	int i;
3083 	struct macstat *macstats;
3084 #ifdef DEBUG
3085 	u16 delta;
3086 	u16 rxf0ovfl;
3087 	u16 txfunfl[NFIFO];
3088 #endif				/* DEBUG */
3089 
3090 	/* if driver down, make no sense to update stats */
3091 	if (!wlc->pub->up)
3092 		return;
3093 
3094 	macstats = wlc->core->macstat_snapshot;
3095 
3096 #ifdef DEBUG
3097 	/* save last rx fifo 0 overflow count */
3098 	rxf0ovfl = macstats->rxf0ovfl;
3099 
3100 	/* save last tx fifo  underflow count */
3101 	for (i = 0; i < NFIFO; i++)
3102 		txfunfl[i] = macstats->txfunfl[i];
3103 #endif				/* DEBUG */
3104 
3105 	/* Read mac stats from contiguous shared memory */
3106 	brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, macstats,
3107 				sizeof(*macstats), OBJADDR_SHM_SEL);
3108 
3109 #ifdef DEBUG
3110 	/* check for rx fifo 0 overflow */
3111 	delta = (u16)(macstats->rxf0ovfl - rxf0ovfl);
3112 	if (delta)
3113 		brcms_err(wlc->hw->d11core, "wl%d: %u rx fifo 0 overflows!\n",
3114 			  wlc->pub->unit, delta);
3115 
3116 	/* check for tx fifo underflows */
3117 	for (i = 0; i < NFIFO; i++) {
3118 		delta = macstats->txfunfl[i] - txfunfl[i];
3119 		if (delta)
3120 			brcms_err(wlc->hw->d11core,
3121 				  "wl%d: %u tx fifo %d underflows!\n",
3122 				  wlc->pub->unit, delta, i);
3123 	}
3124 #endif				/* DEBUG */
3125 
3126 	/* merge counters from dma module */
3127 	for (i = 0; i < NFIFO; i++) {
3128 		if (wlc->hw->di[i])
3129 			dma_counterreset(wlc->hw->di[i]);
3130 	}
3131 }
3132 
3133 static void brcms_b_reset(struct brcms_hardware *wlc_hw)
3134 {
3135 	/* reset the core */
3136 	if (!brcms_deviceremoved(wlc_hw->wlc))
3137 		brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
3138 
3139 	/* purge the dma rings */
3140 	brcms_c_flushqueues(wlc_hw->wlc);
3141 }
3142 
3143 void brcms_c_reset(struct brcms_c_info *wlc)
3144 {
3145 	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
3146 
3147 	/* slurp up hw mac counters before core reset */
3148 	brcms_c_statsupd(wlc);
3149 
3150 	/* reset our snapshot of macstat counters */
3151 	memset(wlc->core->macstat_snapshot, 0, sizeof(struct macstat));
3152 
3153 	brcms_b_reset(wlc->hw);
3154 }
3155 
3156 void brcms_c_init_scb(struct scb *scb)
3157 {
3158 	int i;
3159 
3160 	memset(scb, 0, sizeof(struct scb));
3161 	scb->flags = SCB_WMECAP | SCB_HTCAP;
3162 	for (i = 0; i < NUMPRIO; i++) {
3163 		scb->seqnum[i] = 0;
3164 		scb->seqctl[i] = 0xFFFF;
3165 	}
3166 
3167 	scb->seqctl_nonqos = 0xFFFF;
3168 	scb->magic = SCB_MAGIC;
3169 }
3170 
3171 /* d11 core init
3172  *   reset PSM
3173  *   download ucode/PCM
3174  *   let ucode run to suspended
3175  *   download ucode inits
3176  *   config other core registers
3177  *   init dma
3178  */
3179 static void brcms_b_coreinit(struct brcms_c_info *wlc)
3180 {
3181 	struct brcms_hardware *wlc_hw = wlc->hw;
3182 	struct bcma_device *core = wlc_hw->d11core;
3183 	u32 sflags;
3184 	u32 bcnint_us;
3185 	uint i = 0;
3186 	bool fifosz_fixup = false;
3187 	int err = 0;
3188 	u16 buf[NFIFO];
3189 	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
3190 
3191 	brcms_dbg_info(core, "wl%d: core init\n", wlc_hw->unit);
3192 
3193 	/* reset PSM */
3194 	brcms_b_mctrl(wlc_hw, ~0, (MCTL_IHR_EN | MCTL_PSM_JMP_0 | MCTL_WAKE));
3195 
3196 	brcms_ucode_download(wlc_hw);
3197 	/*
3198 	 * FIFOSZ fixup. driver wants to controls the fifo allocation.
3199 	 */
3200 	fifosz_fixup = true;
3201 
3202 	/* let the PSM run to the suspended state, set mode to BSS STA */
3203 	bcma_write32(core, D11REGOFFS(macintstatus), -1);
3204 	brcms_b_mctrl(wlc_hw, ~0,
3205 		       (MCTL_IHR_EN | MCTL_INFRA | MCTL_PSM_RUN | MCTL_WAKE));
3206 
3207 	/* wait for ucode to self-suspend after auto-init */
3208 	SPINWAIT(((bcma_read32(core, D11REGOFFS(macintstatus)) &
3209 		   MI_MACSSPNDD) == 0), 1000 * 1000);
3210 	if ((bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD) == 0)
3211 		brcms_err(core, "wl%d: wlc_coreinit: ucode did not self-"
3212 			  "suspend!\n", wlc_hw->unit);
3213 
3214 	brcms_c_gpio_init(wlc);
3215 
3216 	sflags = bcma_aread32(core, BCMA_IOST);
3217 
3218 	if (D11REV_IS(wlc_hw->corerev, 17) || D11REV_IS(wlc_hw->corerev, 23)) {
3219 		if (BRCMS_ISNPHY(wlc_hw->band))
3220 			brcms_c_write_inits(wlc_hw, ucode->d11n0initvals16);
3221 		else
3222 			brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3223 				  " %d\n", __func__, wlc_hw->unit,
3224 				  wlc_hw->corerev);
3225 	} else if (D11REV_IS(wlc_hw->corerev, 24)) {
3226 		if (BRCMS_ISLCNPHY(wlc_hw->band))
3227 			brcms_c_write_inits(wlc_hw, ucode->d11lcn0initvals24);
3228 		else
3229 			brcms_err(core, "%s: wl%d: unsupported phy in corerev"
3230 				  " %d\n", __func__, wlc_hw->unit,
3231 				  wlc_hw->corerev);
3232 	} else {
3233 		brcms_err(core, "%s: wl%d: unsupported corerev %d\n",
3234 			  __func__, wlc_hw->unit, wlc_hw->corerev);
3235 	}
3236 
3237 	/* For old ucode, txfifo sizes needs to be modified(increased) */
3238 	if (fifosz_fixup)
3239 		brcms_b_corerev_fifofixup(wlc_hw);
3240 
3241 	/* check txfifo allocations match between ucode and driver */
3242 	buf[TX_AC_BE_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE0);
3243 	if (buf[TX_AC_BE_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]) {
3244 		i = TX_AC_BE_FIFO;
3245 		err = -1;
3246 	}
3247 	buf[TX_AC_VI_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE1);
3248 	if (buf[TX_AC_VI_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]) {
3249 		i = TX_AC_VI_FIFO;
3250 		err = -1;
3251 	}
3252 	buf[TX_AC_BK_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE2);
3253 	buf[TX_AC_VO_FIFO] = (buf[TX_AC_BK_FIFO] >> 8) & 0xff;
3254 	buf[TX_AC_BK_FIFO] &= 0xff;
3255 	if (buf[TX_AC_BK_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BK_FIFO]) {
3256 		i = TX_AC_BK_FIFO;
3257 		err = -1;
3258 	}
3259 	if (buf[TX_AC_VO_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO]) {
3260 		i = TX_AC_VO_FIFO;
3261 		err = -1;
3262 	}
3263 	buf[TX_BCMC_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE3);
3264 	buf[TX_ATIM_FIFO] = (buf[TX_BCMC_FIFO] >> 8) & 0xff;
3265 	buf[TX_BCMC_FIFO] &= 0xff;
3266 	if (buf[TX_BCMC_FIFO] != wlc_hw->xmtfifo_sz[TX_BCMC_FIFO]) {
3267 		i = TX_BCMC_FIFO;
3268 		err = -1;
3269 	}
3270 	if (buf[TX_ATIM_FIFO] != wlc_hw->xmtfifo_sz[TX_ATIM_FIFO]) {
3271 		i = TX_ATIM_FIFO;
3272 		err = -1;
3273 	}
3274 	if (err != 0)
3275 		brcms_err(core, "wlc_coreinit: txfifo mismatch: ucode size %d"
3276 			  " driver size %d index %d\n", buf[i],
3277 			  wlc_hw->xmtfifo_sz[i], i);
3278 
3279 	/* make sure we can still talk to the mac */
3280 	WARN_ON(bcma_read32(core, D11REGOFFS(maccontrol)) == 0xffffffff);
3281 
3282 	/* band-specific inits done by wlc_bsinit() */
3283 
3284 	/* Set up frame burst size and antenna swap threshold init values */
3285 	brcms_b_write_shm(wlc_hw, M_MBURST_SIZE, MAXTXFRAMEBURST);
3286 	brcms_b_write_shm(wlc_hw, M_MAX_ANTCNT, ANTCNT);
3287 
3288 	/* enable one rx interrupt per received frame */
3289 	bcma_write32(core, D11REGOFFS(intrcvlazy[0]), (1 << IRL_FC_SHIFT));
3290 
3291 	/* set the station mode (BSS STA) */
3292 	brcms_b_mctrl(wlc_hw,
3293 		       (MCTL_INFRA | MCTL_DISCARD_PMQ | MCTL_AP),
3294 		       (MCTL_INFRA | MCTL_DISCARD_PMQ));
3295 
3296 	/* set up Beacon interval */
3297 	bcnint_us = 0x8000 << 10;
3298 	bcma_write32(core, D11REGOFFS(tsf_cfprep),
3299 		     (bcnint_us << CFPREP_CBI_SHIFT));
3300 	bcma_write32(core, D11REGOFFS(tsf_cfpstart), bcnint_us);
3301 	bcma_write32(core, D11REGOFFS(macintstatus), MI_GP1);
3302 
3303 	/* write interrupt mask */
3304 	bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intmask),
3305 		     DEF_RXINTMASK);
3306 
3307 	/* allow the MAC to control the PHY clock (dynamic on/off) */
3308 	brcms_b_macphyclk_set(wlc_hw, ON);
3309 
3310 	/* program dynamic clock control fast powerup delay register */
3311 	wlc->fastpwrup_dly = ai_clkctl_fast_pwrup_delay(wlc_hw->sih);
3312 	bcma_write16(core, D11REGOFFS(scc_fastpwrup_dly), wlc->fastpwrup_dly);
3313 
3314 	/* tell the ucode the corerev */
3315 	brcms_b_write_shm(wlc_hw, M_MACHW_VER, (u16) wlc_hw->corerev);
3316 
3317 	/* tell the ucode MAC capabilities */
3318 	brcms_b_write_shm(wlc_hw, M_MACHW_CAP_L,
3319 			   (u16) (wlc_hw->machwcap & 0xffff));
3320 	brcms_b_write_shm(wlc_hw, M_MACHW_CAP_H,
3321 			   (u16) ((wlc_hw->
3322 				      machwcap >> 16) & 0xffff));
3323 
3324 	/* write retry limits to SCR, this done after PSM init */
3325 	bcma_write32(core, D11REGOFFS(objaddr),
3326 		     OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
3327 	(void)bcma_read32(core, D11REGOFFS(objaddr));
3328 	bcma_write32(core, D11REGOFFS(objdata), wlc_hw->SRL);
3329 	bcma_write32(core, D11REGOFFS(objaddr),
3330 		     OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
3331 	(void)bcma_read32(core, D11REGOFFS(objaddr));
3332 	bcma_write32(core, D11REGOFFS(objdata), wlc_hw->LRL);
3333 
3334 	/* write rate fallback retry limits */
3335 	brcms_b_write_shm(wlc_hw, M_SFRMTXCNTFBRTHSD, wlc_hw->SFBL);
3336 	brcms_b_write_shm(wlc_hw, M_LFRMTXCNTFBRTHSD, wlc_hw->LFBL);
3337 
3338 	bcma_mask16(core, D11REGOFFS(ifs_ctl), 0x0FFF);
3339 	bcma_write16(core, D11REGOFFS(ifs_aifsn), EDCF_AIFSN_MIN);
3340 
3341 	/* init the tx dma engines */
3342 	for (i = 0; i < NFIFO; i++) {
3343 		if (wlc_hw->di[i])
3344 			dma_txinit(wlc_hw->di[i]);
3345 	}
3346 
3347 	/* init the rx dma engine(s) and post receive buffers */
3348 	dma_rxinit(wlc_hw->di[RX_FIFO]);
3349 	dma_rxfill(wlc_hw->di[RX_FIFO]);
3350 }
3351 
3352 static void brcms_b_init(struct brcms_hardware *wlc_hw, u16 chanspec)
3353 {
3354 	u32 macintmask;
3355 	bool fastclk;
3356 	struct brcms_c_info *wlc = wlc_hw->wlc;
3357 
3358 	/* request FAST clock if not on */
3359 	fastclk = wlc_hw->forcefastclk;
3360 	if (!fastclk)
3361 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
3362 
3363 	/* disable interrupts */
3364 	macintmask = brcms_intrsoff(wlc->wl);
3365 
3366 	/* set up the specified band and chanspec */
3367 	brcms_c_setxband(wlc_hw, chspec_bandunit(chanspec));
3368 	wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3369 
3370 	/* do one-time phy inits and calibration */
3371 	wlc_phy_cal_init(wlc_hw->band->pi);
3372 
3373 	/* core-specific initialization */
3374 	brcms_b_coreinit(wlc);
3375 
3376 	/* band-specific inits */
3377 	brcms_b_bsinit(wlc, chanspec);
3378 
3379 	/* restore macintmask */
3380 	brcms_intrsrestore(wlc->wl, macintmask);
3381 
3382 	/* seed wake_override with BRCMS_WAKE_OVERRIDE_MACSUSPEND since the mac
3383 	 * is suspended and brcms_c_enable_mac() will clear this override bit.
3384 	 */
3385 	mboolset(wlc_hw->wake_override, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
3386 
3387 	/*
3388 	 * initialize mac_suspend_depth to 1 to match ucode
3389 	 * initial suspended state
3390 	 */
3391 	wlc_hw->mac_suspend_depth = 1;
3392 
3393 	/* restore the clk */
3394 	if (!fastclk)
3395 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
3396 }
3397 
3398 static void brcms_c_set_phy_chanspec(struct brcms_c_info *wlc,
3399 				     u16 chanspec)
3400 {
3401 	/* Save our copy of the chanspec */
3402 	wlc->chanspec = chanspec;
3403 
3404 	/* Set the chanspec and power limits for this locale */
3405 	brcms_c_channel_set_chanspec(wlc->cmi, chanspec, BRCMS_TXPWR_MAX);
3406 
3407 	if (wlc->stf->ss_algosel_auto)
3408 		brcms_c_stf_ss_algo_channel_get(wlc, &wlc->stf->ss_algo_channel,
3409 					    chanspec);
3410 
3411 	brcms_c_stf_ss_update(wlc, wlc->band);
3412 }
3413 
3414 static void
3415 brcms_default_rateset(struct brcms_c_info *wlc, struct brcms_c_rateset *rs)
3416 {
3417 	brcms_c_rateset_default(rs, NULL, wlc->band->phytype,
3418 		wlc->band->bandtype, false, BRCMS_RATE_MASK_FULL,
3419 		(bool) (wlc->pub->_n_enab & SUPPORT_11N),
3420 		brcms_chspec_bw(wlc->default_bss->chanspec),
3421 		wlc->stf->txstreams);
3422 }
3423 
3424 /* derive wlc->band->basic_rate[] table from 'rateset' */
3425 static void brcms_c_rate_lookup_init(struct brcms_c_info *wlc,
3426 			      struct brcms_c_rateset *rateset)
3427 {
3428 	u8 rate;
3429 	u8 mandatory;
3430 	u8 cck_basic = 0;
3431 	u8 ofdm_basic = 0;
3432 	u8 *br = wlc->band->basic_rate;
3433 	uint i;
3434 
3435 	/* incoming rates are in 500kbps units as in 802.11 Supported Rates */
3436 	memset(br, 0, BRCM_MAXRATE + 1);
3437 
3438 	/* For each basic rate in the rates list, make an entry in the
3439 	 * best basic lookup.
3440 	 */
3441 	for (i = 0; i < rateset->count; i++) {
3442 		/* only make an entry for a basic rate */
3443 		if (!(rateset->rates[i] & BRCMS_RATE_FLAG))
3444 			continue;
3445 
3446 		/* mask off basic bit */
3447 		rate = (rateset->rates[i] & BRCMS_RATE_MASK);
3448 
3449 		if (rate > BRCM_MAXRATE) {
3450 			brcms_err(wlc->hw->d11core, "brcms_c_rate_lookup_init: "
3451 				  "invalid rate 0x%X in rate set\n",
3452 				  rateset->rates[i]);
3453 			continue;
3454 		}
3455 
3456 		br[rate] = rate;
3457 	}
3458 
3459 	/* The rate lookup table now has non-zero entries for each
3460 	 * basic rate, equal to the basic rate: br[basicN] = basicN
3461 	 *
3462 	 * To look up the best basic rate corresponding to any
3463 	 * particular rate, code can use the basic_rate table
3464 	 * like this
3465 	 *
3466 	 * basic_rate = wlc->band->basic_rate[tx_rate]
3467 	 *
3468 	 * Make sure there is a best basic rate entry for
3469 	 * every rate by walking up the table from low rates
3470 	 * to high, filling in holes in the lookup table
3471 	 */
3472 
3473 	for (i = 0; i < wlc->band->hw_rateset.count; i++) {
3474 		rate = wlc->band->hw_rateset.rates[i];
3475 
3476 		if (br[rate] != 0) {
3477 			/* This rate is a basic rate.
3478 			 * Keep track of the best basic rate so far by
3479 			 * modulation type.
3480 			 */
3481 			if (is_ofdm_rate(rate))
3482 				ofdm_basic = rate;
3483 			else
3484 				cck_basic = rate;
3485 
3486 			continue;
3487 		}
3488 
3489 		/* This rate is not a basic rate so figure out the
3490 		 * best basic rate less than this rate and fill in
3491 		 * the hole in the table
3492 		 */
3493 
3494 		br[rate] = is_ofdm_rate(rate) ? ofdm_basic : cck_basic;
3495 
3496 		if (br[rate] != 0)
3497 			continue;
3498 
3499 		if (is_ofdm_rate(rate)) {
3500 			/*
3501 			 * In 11g and 11a, the OFDM mandatory rates
3502 			 * are 6, 12, and 24 Mbps
3503 			 */
3504 			if (rate >= BRCM_RATE_24M)
3505 				mandatory = BRCM_RATE_24M;
3506 			else if (rate >= BRCM_RATE_12M)
3507 				mandatory = BRCM_RATE_12M;
3508 			else
3509 				mandatory = BRCM_RATE_6M;
3510 		} else {
3511 			/* In 11b, all CCK rates are mandatory 1 - 11 Mbps */
3512 			mandatory = rate;
3513 		}
3514 
3515 		br[rate] = mandatory;
3516 	}
3517 }
3518 
3519 static void brcms_c_bandinit_ordered(struct brcms_c_info *wlc,
3520 				     u16 chanspec)
3521 {
3522 	struct brcms_c_rateset default_rateset;
3523 	uint parkband;
3524 	uint i, band_order[2];
3525 
3526 	/*
3527 	 * We might have been bandlocked during down and the chip
3528 	 * power-cycled (hibernate). Figure out the right band to park on
3529 	 */
3530 	if (wlc->bandlocked || wlc->pub->_nbands == 1) {
3531 		/* updated in brcms_c_bandlock() */
3532 		parkband = wlc->band->bandunit;
3533 		band_order[0] = band_order[1] = parkband;
3534 	} else {
3535 		/* park on the band of the specified chanspec */
3536 		parkband = chspec_bandunit(chanspec);
3537 
3538 		/* order so that parkband initialize last */
3539 		band_order[0] = parkband ^ 1;
3540 		band_order[1] = parkband;
3541 	}
3542 
3543 	/* make each band operational, software state init */
3544 	for (i = 0; i < wlc->pub->_nbands; i++) {
3545 		uint j = band_order[i];
3546 
3547 		wlc->band = wlc->bandstate[j];
3548 
3549 		brcms_default_rateset(wlc, &default_rateset);
3550 
3551 		/* fill in hw_rate */
3552 		brcms_c_rateset_filter(&default_rateset, &wlc->band->hw_rateset,
3553 				   false, BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
3554 				   (bool) (wlc->pub->_n_enab & SUPPORT_11N));
3555 
3556 		/* init basic rate lookup */
3557 		brcms_c_rate_lookup_init(wlc, &default_rateset);
3558 	}
3559 
3560 	/* sync up phy/radio chanspec */
3561 	brcms_c_set_phy_chanspec(wlc, chanspec);
3562 }
3563 
3564 /*
3565  * Set or clear filtering related maccontrol bits based on
3566  * specified filter flags
3567  */
3568 void brcms_c_mac_promisc(struct brcms_c_info *wlc, uint filter_flags)
3569 {
3570 	u32 promisc_bits = 0;
3571 
3572 	wlc->filter_flags = filter_flags;
3573 
3574 	if (filter_flags & FIF_OTHER_BSS)
3575 		promisc_bits |= MCTL_PROMISC;
3576 
3577 	if (filter_flags & FIF_BCN_PRBRESP_PROMISC)
3578 		promisc_bits |= MCTL_BCNS_PROMISC;
3579 
3580 	if (filter_flags & FIF_FCSFAIL)
3581 		promisc_bits |= MCTL_KEEPBADFCS;
3582 
3583 	if (filter_flags & (FIF_CONTROL | FIF_PSPOLL))
3584 		promisc_bits |= MCTL_KEEPCONTROL;
3585 
3586 	brcms_b_mctrl(wlc->hw,
3587 		MCTL_PROMISC | MCTL_BCNS_PROMISC |
3588 		MCTL_KEEPCONTROL | MCTL_KEEPBADFCS,
3589 		promisc_bits);
3590 }
3591 
3592 /*
3593  * ucode, hwmac update
3594  *    Channel dependent updates for ucode and hw
3595  */
3596 static void brcms_c_ucode_mac_upd(struct brcms_c_info *wlc)
3597 {
3598 	/* enable or disable any active IBSSs depending on whether or not
3599 	 * we are on the home channel
3600 	 */
3601 	if (wlc->home_chanspec == wlc_phy_chanspec_get(wlc->band->pi)) {
3602 		if (wlc->pub->associated) {
3603 			/*
3604 			 * BMAC_NOTE: This is something that should be fixed
3605 			 * in ucode inits. I think that the ucode inits set
3606 			 * up the bcn templates and shm values with a bogus
3607 			 * beacon. This should not be done in the inits. If
3608 			 * ucode needs to set up a beacon for testing, the
3609 			 * test routines should write it down, not expect the
3610 			 * inits to populate a bogus beacon.
3611 			 */
3612 			if (BRCMS_PHY_11N_CAP(wlc->band))
3613 				brcms_b_write_shm(wlc->hw,
3614 						M_BCN_TXTSF_OFFSET, 0);
3615 		}
3616 	} else {
3617 		/* disable an active IBSS if we are not on the home channel */
3618 	}
3619 }
3620 
3621 static void brcms_c_write_rate_shm(struct brcms_c_info *wlc, u8 rate,
3622 				   u8 basic_rate)
3623 {
3624 	u8 phy_rate, index;
3625 	u8 basic_phy_rate, basic_index;
3626 	u16 dir_table, basic_table;
3627 	u16 basic_ptr;
3628 
3629 	/* Shared memory address for the table we are reading */
3630 	dir_table = is_ofdm_rate(basic_rate) ? M_RT_DIRMAP_A : M_RT_DIRMAP_B;
3631 
3632 	/* Shared memory address for the table we are writing */
3633 	basic_table = is_ofdm_rate(rate) ? M_RT_BBRSMAP_A : M_RT_BBRSMAP_B;
3634 
3635 	/*
3636 	 * for a given rate, the LS-nibble of the PLCP SIGNAL field is
3637 	 * the index into the rate table.
3638 	 */
3639 	phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
3640 	basic_phy_rate = rate_info[basic_rate] & BRCMS_RATE_MASK;
3641 	index = phy_rate & 0xf;
3642 	basic_index = basic_phy_rate & 0xf;
3643 
3644 	/* Find the SHM pointer to the ACK rate entry by looking in the
3645 	 * Direct-map Table
3646 	 */
3647 	basic_ptr = brcms_b_read_shm(wlc->hw, (dir_table + basic_index * 2));
3648 
3649 	/* Update the SHM BSS-basic-rate-set mapping table with the pointer
3650 	 * to the correct basic rate for the given incoming rate
3651 	 */
3652 	brcms_b_write_shm(wlc->hw, (basic_table + index * 2), basic_ptr);
3653 }
3654 
3655 static const struct brcms_c_rateset *
3656 brcms_c_rateset_get_hwrs(struct brcms_c_info *wlc)
3657 {
3658 	const struct brcms_c_rateset *rs_dflt;
3659 
3660 	if (BRCMS_PHY_11N_CAP(wlc->band)) {
3661 		if (wlc->band->bandtype == BRCM_BAND_5G)
3662 			rs_dflt = &ofdm_mimo_rates;
3663 		else
3664 			rs_dflt = &cck_ofdm_mimo_rates;
3665 	} else if (wlc->band->gmode)
3666 		rs_dflt = &cck_ofdm_rates;
3667 	else
3668 		rs_dflt = &cck_rates;
3669 
3670 	return rs_dflt;
3671 }
3672 
3673 static void brcms_c_set_ratetable(struct brcms_c_info *wlc)
3674 {
3675 	const struct brcms_c_rateset *rs_dflt;
3676 	struct brcms_c_rateset rs;
3677 	u8 rate, basic_rate;
3678 	uint i;
3679 
3680 	rs_dflt = brcms_c_rateset_get_hwrs(wlc);
3681 
3682 	brcms_c_rateset_copy(rs_dflt, &rs);
3683 	brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
3684 
3685 	/* walk the phy rate table and update SHM basic rate lookup table */
3686 	for (i = 0; i < rs.count; i++) {
3687 		rate = rs.rates[i] & BRCMS_RATE_MASK;
3688 
3689 		/* for a given rate brcms_basic_rate returns the rate at
3690 		 * which a response ACK/CTS should be sent.
3691 		 */
3692 		basic_rate = brcms_basic_rate(wlc, rate);
3693 		if (basic_rate == 0)
3694 			/* This should only happen if we are using a
3695 			 * restricted rateset.
3696 			 */
3697 			basic_rate = rs.rates[0] & BRCMS_RATE_MASK;
3698 
3699 		brcms_c_write_rate_shm(wlc, rate, basic_rate);
3700 	}
3701 }
3702 
3703 /* band-specific init */
3704 static void brcms_c_bsinit(struct brcms_c_info *wlc)
3705 {
3706 	brcms_dbg_info(wlc->hw->d11core, "wl%d: bandunit %d\n",
3707 		       wlc->pub->unit, wlc->band->bandunit);
3708 
3709 	/* write ucode ACK/CTS rate table */
3710 	brcms_c_set_ratetable(wlc);
3711 
3712 	/* update some band specific mac configuration */
3713 	brcms_c_ucode_mac_upd(wlc);
3714 
3715 	/* init antenna selection */
3716 	brcms_c_antsel_init(wlc->asi);
3717 
3718 }
3719 
3720 /* formula:  IDLE_BUSY_RATIO_X_16 = (100-duty_cycle)/duty_cycle*16 */
3721 static int
3722 brcms_c_duty_cycle_set(struct brcms_c_info *wlc, int duty_cycle, bool isOFDM,
3723 		   bool writeToShm)
3724 {
3725 	int idle_busy_ratio_x_16 = 0;
3726 	uint offset =
3727 	    isOFDM ? M_TX_IDLE_BUSY_RATIO_X_16_OFDM :
3728 	    M_TX_IDLE_BUSY_RATIO_X_16_CCK;
3729 	if (duty_cycle > 100 || duty_cycle < 0) {
3730 		brcms_err(wlc->hw->d11core,
3731 			  "wl%d:  duty cycle value off limit\n",
3732 			  wlc->pub->unit);
3733 		return -EINVAL;
3734 	}
3735 	if (duty_cycle)
3736 		idle_busy_ratio_x_16 = (100 - duty_cycle) * 16 / duty_cycle;
3737 	/* Only write to shared memory  when wl is up */
3738 	if (writeToShm)
3739 		brcms_b_write_shm(wlc->hw, offset, (u16) idle_busy_ratio_x_16);
3740 
3741 	if (isOFDM)
3742 		wlc->tx_duty_cycle_ofdm = (u16) duty_cycle;
3743 	else
3744 		wlc->tx_duty_cycle_cck = (u16) duty_cycle;
3745 
3746 	return 0;
3747 }
3748 
3749 /* push sw hps and wake state through hardware */
3750 static void brcms_c_set_ps_ctrl(struct brcms_c_info *wlc)
3751 {
3752 	u32 v1, v2;
3753 	bool hps;
3754 	bool awake_before;
3755 
3756 	hps = brcms_c_ps_allowed(wlc);
3757 
3758 	brcms_dbg_mac80211(wlc->hw->d11core, "wl%d: hps %d\n", wlc->pub->unit,
3759 			   hps);
3760 
3761 	v1 = bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
3762 	v2 = MCTL_WAKE;
3763 	if (hps)
3764 		v2 |= MCTL_HPS;
3765 
3766 	brcms_b_mctrl(wlc->hw, MCTL_WAKE | MCTL_HPS, v2);
3767 
3768 	awake_before = ((v1 & MCTL_WAKE) || ((v1 & MCTL_HPS) == 0));
3769 
3770 	if (!awake_before)
3771 		brcms_b_wait_for_wake(wlc->hw);
3772 }
3773 
3774 /*
3775  * Write this BSS config's MAC address to core.
3776  * Updates RXE match engine.
3777  */
3778 static int brcms_c_set_mac(struct brcms_bss_cfg *bsscfg)
3779 {
3780 	int err = 0;
3781 	struct brcms_c_info *wlc = bsscfg->wlc;
3782 
3783 	/* enter the MAC addr into the RXE match registers */
3784 	brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, wlc->pub->cur_etheraddr);
3785 
3786 	brcms_c_ampdu_macaddr_upd(wlc);
3787 
3788 	return err;
3789 }
3790 
3791 /* Write the BSS config's BSSID address to core (set_bssid in d11procs.tcl).
3792  * Updates RXE match engine.
3793  */
3794 static void brcms_c_set_bssid(struct brcms_bss_cfg *bsscfg)
3795 {
3796 	/* we need to update BSSID in RXE match registers */
3797 	brcms_c_set_addrmatch(bsscfg->wlc, RCM_BSSID_OFFSET, bsscfg->BSSID);
3798 }
3799 
3800 void brcms_c_set_ssid(struct brcms_c_info *wlc, u8 *ssid, size_t ssid_len)
3801 {
3802 	u8 len = min_t(u8, sizeof(wlc->bsscfg->SSID), ssid_len);
3803 	memset(wlc->bsscfg->SSID, 0, sizeof(wlc->bsscfg->SSID));
3804 
3805 	memcpy(wlc->bsscfg->SSID, ssid, len);
3806 	wlc->bsscfg->SSID_len = len;
3807 }
3808 
3809 static void brcms_b_set_shortslot(struct brcms_hardware *wlc_hw, bool shortslot)
3810 {
3811 	wlc_hw->shortslot = shortslot;
3812 
3813 	if (wlc_hw->band->bandtype == BRCM_BAND_2G && wlc_hw->up) {
3814 		brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
3815 		brcms_b_update_slot_timing(wlc_hw, shortslot);
3816 		brcms_c_enable_mac(wlc_hw->wlc);
3817 	}
3818 }
3819 
3820 /*
3821  * Suspend the the MAC and update the slot timing
3822  * for standard 11b/g (20us slots) or shortslot 11g (9us slots).
3823  */
3824 static void brcms_c_switch_shortslot(struct brcms_c_info *wlc, bool shortslot)
3825 {
3826 	/* use the override if it is set */
3827 	if (wlc->shortslot_override != BRCMS_SHORTSLOT_AUTO)
3828 		shortslot = (wlc->shortslot_override == BRCMS_SHORTSLOT_ON);
3829 
3830 	if (wlc->shortslot == shortslot)
3831 		return;
3832 
3833 	wlc->shortslot = shortslot;
3834 
3835 	brcms_b_set_shortslot(wlc->hw, shortslot);
3836 }
3837 
3838 static void brcms_c_set_home_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3839 {
3840 	if (wlc->home_chanspec != chanspec) {
3841 		wlc->home_chanspec = chanspec;
3842 
3843 		if (wlc->pub->associated)
3844 			wlc->bsscfg->current_bss->chanspec = chanspec;
3845 	}
3846 }
3847 
3848 void
3849 brcms_b_set_chanspec(struct brcms_hardware *wlc_hw, u16 chanspec,
3850 		      bool mute_tx, struct txpwr_limits *txpwr)
3851 {
3852 	uint bandunit;
3853 
3854 	brcms_dbg_mac80211(wlc_hw->d11core, "wl%d: 0x%x\n", wlc_hw->unit,
3855 			   chanspec);
3856 
3857 	wlc_hw->chanspec = chanspec;
3858 
3859 	/* Switch bands if necessary */
3860 	if (wlc_hw->_nbands > 1) {
3861 		bandunit = chspec_bandunit(chanspec);
3862 		if (wlc_hw->band->bandunit != bandunit) {
3863 			/* brcms_b_setband disables other bandunit,
3864 			 *  use light band switch if not up yet
3865 			 */
3866 			if (wlc_hw->up) {
3867 				wlc_phy_chanspec_radio_set(wlc_hw->
3868 							   bandstate[bandunit]->
3869 							   pi, chanspec);
3870 				brcms_b_setband(wlc_hw, bandunit, chanspec);
3871 			} else {
3872 				brcms_c_setxband(wlc_hw, bandunit);
3873 			}
3874 		}
3875 	}
3876 
3877 	wlc_phy_initcal_enable(wlc_hw->band->pi, !mute_tx);
3878 
3879 	if (!wlc_hw->up) {
3880 		if (wlc_hw->clk)
3881 			wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr,
3882 						  chanspec);
3883 		wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
3884 	} else {
3885 		wlc_phy_chanspec_set(wlc_hw->band->pi, chanspec);
3886 		wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr, chanspec);
3887 
3888 		/* Update muting of the channel */
3889 		brcms_b_mute(wlc_hw, mute_tx);
3890 	}
3891 }
3892 
3893 /* switch to and initialize new band */
3894 static void brcms_c_setband(struct brcms_c_info *wlc,
3895 					   uint bandunit)
3896 {
3897 	wlc->band = wlc->bandstate[bandunit];
3898 
3899 	if (!wlc->pub->up)
3900 		return;
3901 
3902 	/* wait for at least one beacon before entering sleeping state */
3903 	brcms_c_set_ps_ctrl(wlc);
3904 
3905 	/* band-specific initializations */
3906 	brcms_c_bsinit(wlc);
3907 }
3908 
3909 static void brcms_c_set_chanspec(struct brcms_c_info *wlc, u16 chanspec)
3910 {
3911 	uint bandunit;
3912 	bool switchband = false;
3913 	u16 old_chanspec = wlc->chanspec;
3914 
3915 	if (!brcms_c_valid_chanspec_db(wlc->cmi, chanspec)) {
3916 		brcms_err(wlc->hw->d11core, "wl%d: %s: Bad channel %d\n",
3917 			  wlc->pub->unit, __func__, CHSPEC_CHANNEL(chanspec));
3918 		return;
3919 	}
3920 
3921 	/* Switch bands if necessary */
3922 	if (wlc->pub->_nbands > 1) {
3923 		bandunit = chspec_bandunit(chanspec);
3924 		if (wlc->band->bandunit != bandunit || wlc->bandinit_pending) {
3925 			switchband = true;
3926 			if (wlc->bandlocked) {
3927 				brcms_err(wlc->hw->d11core,
3928 					  "wl%d: %s: chspec %d band is locked!\n",
3929 					  wlc->pub->unit, __func__,
3930 					  CHSPEC_CHANNEL(chanspec));
3931 				return;
3932 			}
3933 			/*
3934 			 * should the setband call come after the
3935 			 * brcms_b_chanspec() ? if the setband updates
3936 			 * (brcms_c_bsinit) use low level calls to inspect and
3937 			 * set state, the state inspected may be from the wrong
3938 			 * band, or the following brcms_b_set_chanspec() may
3939 			 * undo the work.
3940 			 */
3941 			brcms_c_setband(wlc, bandunit);
3942 		}
3943 	}
3944 
3945 	/* sync up phy/radio chanspec */
3946 	brcms_c_set_phy_chanspec(wlc, chanspec);
3947 
3948 	/* init antenna selection */
3949 	if (brcms_chspec_bw(old_chanspec) != brcms_chspec_bw(chanspec)) {
3950 		brcms_c_antsel_init(wlc->asi);
3951 
3952 		/* Fix the hardware rateset based on bw.
3953 		 * Mainly add MCS32 for 40Mhz, remove MCS 32 for 20Mhz
3954 		 */
3955 		brcms_c_rateset_bw_mcs_filter(&wlc->band->hw_rateset,
3956 			wlc->band->mimo_cap_40 ? brcms_chspec_bw(chanspec) : 0);
3957 	}
3958 
3959 	/* update some mac configuration since chanspec changed */
3960 	brcms_c_ucode_mac_upd(wlc);
3961 }
3962 
3963 /*
3964  * This function changes the phytxctl for beacon based on current
3965  * beacon ratespec AND txant setting as per this table:
3966  *  ratespec     CCK		ant = wlc->stf->txant
3967  *		OFDM		ant = 3
3968  */
3969 void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc,
3970 				       u32 bcn_rspec)
3971 {
3972 	u16 phyctl;
3973 	u16 phytxant = wlc->stf->phytxant;
3974 	u16 mask = PHY_TXC_ANT_MASK;
3975 
3976 	/* for non-siso rates or default setting, use the available chains */
3977 	if (BRCMS_PHY_11N_CAP(wlc->band))
3978 		phytxant = brcms_c_stf_phytxchain_sel(wlc, bcn_rspec);
3979 
3980 	phyctl = brcms_b_read_shm(wlc->hw, M_BCN_PCTLWD);
3981 	phyctl = (phyctl & ~mask) | phytxant;
3982 	brcms_b_write_shm(wlc->hw, M_BCN_PCTLWD, phyctl);
3983 }
3984 
3985 /*
3986  * centralized protection config change function to simplify debugging, no
3987  * consistency checking this should be called only on changes to avoid overhead
3988  * in periodic function
3989  */
3990 void brcms_c_protection_upd(struct brcms_c_info *wlc, uint idx, int val)
3991 {
3992 	/*
3993 	 * Cannot use brcms_dbg_* here because this function is called
3994 	 * before wlc is sufficiently initialized.
3995 	 */
3996 	BCMMSG(wlc->wiphy, "idx %d, val %d\n", idx, val);
3997 
3998 	switch (idx) {
3999 	case BRCMS_PROT_G_SPEC:
4000 		wlc->protection->_g = (bool) val;
4001 		break;
4002 	case BRCMS_PROT_G_OVR:
4003 		wlc->protection->g_override = (s8) val;
4004 		break;
4005 	case BRCMS_PROT_G_USER:
4006 		wlc->protection->gmode_user = (u8) val;
4007 		break;
4008 	case BRCMS_PROT_OVERLAP:
4009 		wlc->protection->overlap = (s8) val;
4010 		break;
4011 	case BRCMS_PROT_N_USER:
4012 		wlc->protection->nmode_user = (s8) val;
4013 		break;
4014 	case BRCMS_PROT_N_CFG:
4015 		wlc->protection->n_cfg = (s8) val;
4016 		break;
4017 	case BRCMS_PROT_N_CFG_OVR:
4018 		wlc->protection->n_cfg_override = (s8) val;
4019 		break;
4020 	case BRCMS_PROT_N_NONGF:
4021 		wlc->protection->nongf = (bool) val;
4022 		break;
4023 	case BRCMS_PROT_N_NONGF_OVR:
4024 		wlc->protection->nongf_override = (s8) val;
4025 		break;
4026 	case BRCMS_PROT_N_PAM_OVR:
4027 		wlc->protection->n_pam_override = (s8) val;
4028 		break;
4029 	case BRCMS_PROT_N_OBSS:
4030 		wlc->protection->n_obss = (bool) val;
4031 		break;
4032 
4033 	default:
4034 		break;
4035 	}
4036 
4037 }
4038 
4039 static void brcms_c_ht_update_sgi_rx(struct brcms_c_info *wlc, int val)
4040 {
4041 	if (wlc->pub->up) {
4042 		brcms_c_update_beacon(wlc);
4043 		brcms_c_update_probe_resp(wlc, true);
4044 	}
4045 }
4046 
4047 static void brcms_c_ht_update_ldpc(struct brcms_c_info *wlc, s8 val)
4048 {
4049 	wlc->stf->ldpc = val;
4050 
4051 	if (wlc->pub->up) {
4052 		brcms_c_update_beacon(wlc);
4053 		brcms_c_update_probe_resp(wlc, true);
4054 		wlc_phy_ldpc_override_set(wlc->band->pi, (val ? true : false));
4055 	}
4056 }
4057 
4058 void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
4059 		       const struct ieee80211_tx_queue_params *params,
4060 		       bool suspend)
4061 {
4062 	int i;
4063 	struct shm_acparams acp_shm;
4064 	u16 *shm_entry;
4065 
4066 	/* Only apply params if the core is out of reset and has clocks */
4067 	if (!wlc->clk) {
4068 		brcms_err(wlc->hw->d11core, "wl%d: %s : no-clock\n",
4069 			  wlc->pub->unit, __func__);
4070 		return;
4071 	}
4072 
4073 	memset(&acp_shm, 0, sizeof(struct shm_acparams));
4074 	/* fill in shm ac params struct */
4075 	acp_shm.txop = params->txop;
4076 	/* convert from units of 32us to us for ucode */
4077 	wlc->edcf_txop[aci & 0x3] = acp_shm.txop =
4078 	    EDCF_TXOP2USEC(acp_shm.txop);
4079 	acp_shm.aifs = (params->aifs & EDCF_AIFSN_MASK);
4080 
4081 	if (aci == IEEE80211_AC_VI && acp_shm.txop == 0
4082 	    && acp_shm.aifs < EDCF_AIFSN_MAX)
4083 		acp_shm.aifs++;
4084 
4085 	if (acp_shm.aifs < EDCF_AIFSN_MIN
4086 	    || acp_shm.aifs > EDCF_AIFSN_MAX) {
4087 		brcms_err(wlc->hw->d11core, "wl%d: edcf_setparams: bad "
4088 			  "aifs %d\n", wlc->pub->unit, acp_shm.aifs);
4089 	} else {
4090 		acp_shm.cwmin = params->cw_min;
4091 		acp_shm.cwmax = params->cw_max;
4092 		acp_shm.cwcur = acp_shm.cwmin;
4093 		acp_shm.bslots =
4094 			bcma_read16(wlc->hw->d11core, D11REGOFFS(tsf_random)) &
4095 			acp_shm.cwcur;
4096 		acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
4097 		/* Indicate the new params to the ucode */
4098 		acp_shm.status = brcms_b_read_shm(wlc->hw, (M_EDCF_QINFO +
4099 						  wme_ac2fifo[aci] *
4100 						  M_EDCF_QLEN +
4101 						  M_EDCF_STATUS_OFF));
4102 		acp_shm.status |= WME_STATUS_NEWAC;
4103 
4104 		/* Fill in shm acparam table */
4105 		shm_entry = (u16 *) &acp_shm;
4106 		for (i = 0; i < (int)sizeof(struct shm_acparams); i += 2)
4107 			brcms_b_write_shm(wlc->hw,
4108 					  M_EDCF_QINFO +
4109 					  wme_ac2fifo[aci] * M_EDCF_QLEN + i,
4110 					  *shm_entry++);
4111 	}
4112 
4113 	if (suspend)
4114 		brcms_c_suspend_mac_and_wait(wlc);
4115 
4116 	brcms_c_update_beacon(wlc);
4117 	brcms_c_update_probe_resp(wlc, false);
4118 
4119 	if (suspend)
4120 		brcms_c_enable_mac(wlc);
4121 }
4122 
4123 static void brcms_c_edcf_setparams(struct brcms_c_info *wlc, bool suspend)
4124 {
4125 	u16 aci;
4126 	int i_ac;
4127 	struct ieee80211_tx_queue_params txq_pars;
4128 	static const struct edcf_acparam default_edcf_acparams[] = {
4129 		 {EDCF_AC_BE_ACI_STA, EDCF_AC_BE_ECW_STA, EDCF_AC_BE_TXOP_STA},
4130 		 {EDCF_AC_BK_ACI_STA, EDCF_AC_BK_ECW_STA, EDCF_AC_BK_TXOP_STA},
4131 		 {EDCF_AC_VI_ACI_STA, EDCF_AC_VI_ECW_STA, EDCF_AC_VI_TXOP_STA},
4132 		 {EDCF_AC_VO_ACI_STA, EDCF_AC_VO_ECW_STA, EDCF_AC_VO_TXOP_STA}
4133 	}; /* ucode needs these parameters during its initialization */
4134 	const struct edcf_acparam *edcf_acp = &default_edcf_acparams[0];
4135 
4136 	for (i_ac = 0; i_ac < IEEE80211_NUM_ACS; i_ac++, edcf_acp++) {
4137 		/* find out which ac this set of params applies to */
4138 		aci = (edcf_acp->ACI & EDCF_ACI_MASK) >> EDCF_ACI_SHIFT;
4139 
4140 		/* fill in shm ac params struct */
4141 		txq_pars.txop = edcf_acp->TXOP;
4142 		txq_pars.aifs = edcf_acp->ACI;
4143 
4144 		/* CWmin = 2^(ECWmin) - 1 */
4145 		txq_pars.cw_min = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
4146 		/* CWmax = 2^(ECWmax) - 1 */
4147 		txq_pars.cw_max = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
4148 					    >> EDCF_ECWMAX_SHIFT);
4149 		brcms_c_wme_setparams(wlc, aci, &txq_pars, suspend);
4150 	}
4151 
4152 	if (suspend) {
4153 		brcms_c_suspend_mac_and_wait(wlc);
4154 		brcms_c_enable_mac(wlc);
4155 	}
4156 }
4157 
4158 static void brcms_c_radio_monitor_start(struct brcms_c_info *wlc)
4159 {
4160 	/* Don't start the timer if HWRADIO feature is disabled */
4161 	if (wlc->radio_monitor)
4162 		return;
4163 
4164 	wlc->radio_monitor = true;
4165 	brcms_b_pllreq(wlc->hw, true, BRCMS_PLLREQ_RADIO_MON);
4166 	brcms_add_timer(wlc->radio_timer, TIMER_INTERVAL_RADIOCHK, true);
4167 }
4168 
4169 static bool brcms_c_radio_monitor_stop(struct brcms_c_info *wlc)
4170 {
4171 	if (!wlc->radio_monitor)
4172 		return true;
4173 
4174 	wlc->radio_monitor = false;
4175 	brcms_b_pllreq(wlc->hw, false, BRCMS_PLLREQ_RADIO_MON);
4176 	return brcms_del_timer(wlc->radio_timer);
4177 }
4178 
4179 /* read hwdisable state and propagate to wlc flag */
4180 static void brcms_c_radio_hwdisable_upd(struct brcms_c_info *wlc)
4181 {
4182 	if (wlc->pub->hw_off)
4183 		return;
4184 
4185 	if (brcms_b_radio_read_hwdisabled(wlc->hw))
4186 		mboolset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4187 	else
4188 		mboolclr(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
4189 }
4190 
4191 /* update hwradio status and return it */
4192 bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc)
4193 {
4194 	brcms_c_radio_hwdisable_upd(wlc);
4195 
4196 	return mboolisset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE) ?
4197 			true : false;
4198 }
4199 
4200 /* periodical query hw radio button while driver is "down" */
4201 static void brcms_c_radio_timer(void *arg)
4202 {
4203 	struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4204 
4205 	if (brcms_deviceremoved(wlc)) {
4206 		brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4207 			  wlc->pub->unit, __func__);
4208 		brcms_down(wlc->wl);
4209 		return;
4210 	}
4211 
4212 	brcms_c_radio_hwdisable_upd(wlc);
4213 }
4214 
4215 /* common low-level watchdog code */
4216 static void brcms_b_watchdog(struct brcms_c_info *wlc)
4217 {
4218 	struct brcms_hardware *wlc_hw = wlc->hw;
4219 
4220 	if (!wlc_hw->up)
4221 		return;
4222 
4223 	/* increment second count */
4224 	wlc_hw->now++;
4225 
4226 	/* Check for FIFO error interrupts */
4227 	brcms_b_fifoerrors(wlc_hw);
4228 
4229 	/* make sure RX dma has buffers */
4230 	dma_rxfill(wlc->hw->di[RX_FIFO]);
4231 
4232 	wlc_phy_watchdog(wlc_hw->band->pi);
4233 }
4234 
4235 /* common watchdog code */
4236 static void brcms_c_watchdog(struct brcms_c_info *wlc)
4237 {
4238 	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
4239 
4240 	if (!wlc->pub->up)
4241 		return;
4242 
4243 	if (brcms_deviceremoved(wlc)) {
4244 		brcms_err(wlc->hw->d11core, "wl%d: %s: dead chip\n",
4245 			  wlc->pub->unit, __func__);
4246 		brcms_down(wlc->wl);
4247 		return;
4248 	}
4249 
4250 	/* increment second count */
4251 	wlc->pub->now++;
4252 
4253 	brcms_c_radio_hwdisable_upd(wlc);
4254 	/* if radio is disable, driver may be down, quit here */
4255 	if (wlc->pub->radio_disabled)
4256 		return;
4257 
4258 	brcms_b_watchdog(wlc);
4259 
4260 	/*
4261 	 * occasionally sample mac stat counters to
4262 	 * detect 16-bit counter wrap
4263 	 */
4264 	if ((wlc->pub->now % SW_TIMER_MAC_STAT_UPD) == 0)
4265 		brcms_c_statsupd(wlc);
4266 
4267 	if (BRCMS_ISNPHY(wlc->band) &&
4268 	    ((wlc->pub->now - wlc->tempsense_lasttime) >=
4269 	     BRCMS_TEMPSENSE_PERIOD)) {
4270 		wlc->tempsense_lasttime = wlc->pub->now;
4271 		brcms_c_tempsense_upd(wlc);
4272 	}
4273 }
4274 
4275 static void brcms_c_watchdog_by_timer(void *arg)
4276 {
4277 	struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
4278 
4279 	brcms_c_watchdog(wlc);
4280 }
4281 
4282 static bool brcms_c_timers_init(struct brcms_c_info *wlc, int unit)
4283 {
4284 	wlc->wdtimer = brcms_init_timer(wlc->wl, brcms_c_watchdog_by_timer,
4285 		wlc, "watchdog");
4286 	if (!wlc->wdtimer) {
4287 		wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for wdtimer "
4288 			  "failed\n", unit);
4289 		goto fail;
4290 	}
4291 
4292 	wlc->radio_timer = brcms_init_timer(wlc->wl, brcms_c_radio_timer,
4293 		wlc, "radio");
4294 	if (!wlc->radio_timer) {
4295 		wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for radio_timer "
4296 			  "failed\n", unit);
4297 		goto fail;
4298 	}
4299 
4300 	return true;
4301 
4302  fail:
4303 	return false;
4304 }
4305 
4306 /*
4307  * Initialize brcms_c_info default values ...
4308  * may get overrides later in this function
4309  */
4310 static void brcms_c_info_init(struct brcms_c_info *wlc, int unit)
4311 {
4312 	int i;
4313 
4314 	/* Save our copy of the chanspec */
4315 	wlc->chanspec = ch20mhz_chspec(1);
4316 
4317 	/* various 802.11g modes */
4318 	wlc->shortslot = false;
4319 	wlc->shortslot_override = BRCMS_SHORTSLOT_AUTO;
4320 
4321 	brcms_c_protection_upd(wlc, BRCMS_PROT_G_OVR, BRCMS_PROTECTION_AUTO);
4322 	brcms_c_protection_upd(wlc, BRCMS_PROT_G_SPEC, false);
4323 
4324 	brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG_OVR,
4325 			       BRCMS_PROTECTION_AUTO);
4326 	brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG, BRCMS_N_PROTECTION_OFF);
4327 	brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF_OVR,
4328 			       BRCMS_PROTECTION_AUTO);
4329 	brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF, false);
4330 	brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, AUTO);
4331 
4332 	brcms_c_protection_upd(wlc, BRCMS_PROT_OVERLAP,
4333 			       BRCMS_PROTECTION_CTL_OVERLAP);
4334 
4335 	/* 802.11g draft 4.0 NonERP elt advertisement */
4336 	wlc->include_legacy_erp = true;
4337 
4338 	wlc->stf->ant_rx_ovr = ANT_RX_DIV_DEF;
4339 	wlc->stf->txant = ANT_TX_DEF;
4340 
4341 	wlc->prb_resp_timeout = BRCMS_PRB_RESP_TIMEOUT;
4342 
4343 	wlc->usr_fragthresh = DOT11_DEFAULT_FRAG_LEN;
4344 	for (i = 0; i < NFIFO; i++)
4345 		wlc->fragthresh[i] = DOT11_DEFAULT_FRAG_LEN;
4346 	wlc->RTSThresh = DOT11_DEFAULT_RTS_LEN;
4347 
4348 	/* default rate fallback retry limits */
4349 	wlc->SFBL = RETRY_SHORT_FB;
4350 	wlc->LFBL = RETRY_LONG_FB;
4351 
4352 	/* default mac retry limits */
4353 	wlc->SRL = RETRY_SHORT_DEF;
4354 	wlc->LRL = RETRY_LONG_DEF;
4355 
4356 	/* WME QoS mode is Auto by default */
4357 	wlc->pub->_ampdu = AMPDU_AGG_HOST;
4358 }
4359 
4360 static uint brcms_c_attach_module(struct brcms_c_info *wlc)
4361 {
4362 	uint err = 0;
4363 	uint unit;
4364 	unit = wlc->pub->unit;
4365 
4366 	wlc->asi = brcms_c_antsel_attach(wlc);
4367 	if (wlc->asi == NULL) {
4368 		wiphy_err(wlc->wiphy, "wl%d: attach: antsel_attach "
4369 			  "failed\n", unit);
4370 		err = 44;
4371 		goto fail;
4372 	}
4373 
4374 	wlc->ampdu = brcms_c_ampdu_attach(wlc);
4375 	if (wlc->ampdu == NULL) {
4376 		wiphy_err(wlc->wiphy, "wl%d: attach: ampdu_attach "
4377 			  "failed\n", unit);
4378 		err = 50;
4379 		goto fail;
4380 	}
4381 
4382 	if ((brcms_c_stf_attach(wlc) != 0)) {
4383 		wiphy_err(wlc->wiphy, "wl%d: attach: stf_attach "
4384 			  "failed\n", unit);
4385 		err = 68;
4386 		goto fail;
4387 	}
4388  fail:
4389 	return err;
4390 }
4391 
4392 struct brcms_pub *brcms_c_pub(struct brcms_c_info *wlc)
4393 {
4394 	return wlc->pub;
4395 }
4396 
4397 /* low level attach
4398  *    run backplane attach, init nvram
4399  *    run phy attach
4400  *    initialize software state for each core and band
4401  *    put the whole chip in reset(driver down state), no clock
4402  */
4403 static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
4404 			  uint unit, bool piomode)
4405 {
4406 	struct brcms_hardware *wlc_hw;
4407 	uint err = 0;
4408 	uint j;
4409 	bool wme = false;
4410 	struct shared_phy_params sha_params;
4411 	struct wiphy *wiphy = wlc->wiphy;
4412 	struct pci_dev *pcidev = core->bus->host_pci;
4413 	struct ssb_sprom *sprom = &core->bus->sprom;
4414 
4415 	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI)
4416 		brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4417 			       pcidev->vendor,
4418 			       pcidev->device);
4419 	else
4420 		brcms_dbg_info(core, "wl%d: vendor 0x%x device 0x%x\n", unit,
4421 			       core->bus->boardinfo.vendor,
4422 			       core->bus->boardinfo.type);
4423 
4424 	wme = true;
4425 
4426 	wlc_hw = wlc->hw;
4427 	wlc_hw->wlc = wlc;
4428 	wlc_hw->unit = unit;
4429 	wlc_hw->band = wlc_hw->bandstate[0];
4430 	wlc_hw->_piomode = piomode;
4431 
4432 	/* populate struct brcms_hardware with default values  */
4433 	brcms_b_info_init(wlc_hw);
4434 
4435 	/*
4436 	 * Do the hardware portion of the attach. Also initialize software
4437 	 * state that depends on the particular hardware we are running.
4438 	 */
4439 	wlc_hw->sih = ai_attach(core->bus);
4440 	if (wlc_hw->sih == NULL) {
4441 		wiphy_err(wiphy, "wl%d: brcms_b_attach: si_attach failed\n",
4442 			  unit);
4443 		err = 11;
4444 		goto fail;
4445 	}
4446 
4447 	/* verify again the device is supported */
4448 	if (!brcms_c_chipmatch(core)) {
4449 		wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported device\n",
4450 			 unit);
4451 		err = 12;
4452 		goto fail;
4453 	}
4454 
4455 	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI) {
4456 		wlc_hw->vendorid = pcidev->vendor;
4457 		wlc_hw->deviceid = pcidev->device;
4458 	} else {
4459 		wlc_hw->vendorid = core->bus->boardinfo.vendor;
4460 		wlc_hw->deviceid = core->bus->boardinfo.type;
4461 	}
4462 
4463 	wlc_hw->d11core = core;
4464 	wlc_hw->corerev = core->id.rev;
4465 
4466 	/* validate chip, chiprev and corerev */
4467 	if (!brcms_c_isgoodchip(wlc_hw)) {
4468 		err = 13;
4469 		goto fail;
4470 	}
4471 
4472 	/* initialize power control registers */
4473 	ai_clkctl_init(wlc_hw->sih);
4474 
4475 	/* request fastclock and force fastclock for the rest of attach
4476 	 * bring the d11 core out of reset.
4477 	 *   For PMU chips, the first wlc_clkctl_clk is no-op since core-clk
4478 	 *   is still false; But it will be called again inside wlc_corereset,
4479 	 *   after d11 is out of reset.
4480 	 */
4481 	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4482 	brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4483 
4484 	if (!brcms_b_validate_chip_access(wlc_hw)) {
4485 		wiphy_err(wiphy, "wl%d: brcms_b_attach: validate_chip_access "
4486 			"failed\n", unit);
4487 		err = 14;
4488 		goto fail;
4489 	}
4490 
4491 	/* get the board rev, used just below */
4492 	j = sprom->board_rev;
4493 	/* promote srom boardrev of 0xFF to 1 */
4494 	if (j == BOARDREV_PROMOTABLE)
4495 		j = BOARDREV_PROMOTED;
4496 	wlc_hw->boardrev = (u16) j;
4497 	if (!brcms_c_validboardtype(wlc_hw)) {
4498 		wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported Broadcom "
4499 			  "board type (0x%x)" " or revision level (0x%x)\n",
4500 			  unit, ai_get_boardtype(wlc_hw->sih),
4501 			  wlc_hw->boardrev);
4502 		err = 15;
4503 		goto fail;
4504 	}
4505 	wlc_hw->sromrev = sprom->revision;
4506 	wlc_hw->boardflags = sprom->boardflags_lo + (sprom->boardflags_hi << 16);
4507 	wlc_hw->boardflags2 = sprom->boardflags2_lo + (sprom->boardflags2_hi << 16);
4508 
4509 	if (wlc_hw->boardflags & BFL_NOPLLDOWN)
4510 		brcms_b_pllreq(wlc_hw, true, BRCMS_PLLREQ_SHARED);
4511 
4512 	/* check device id(srom, nvram etc.) to set bands */
4513 	if (wlc_hw->deviceid == BCM43224_D11N_ID ||
4514 	    wlc_hw->deviceid == BCM43224_D11N_ID_VEN1 ||
4515 	    wlc_hw->deviceid == BCM43224_CHIP_ID)
4516 		/* Dualband boards */
4517 		wlc_hw->_nbands = 2;
4518 	else
4519 		wlc_hw->_nbands = 1;
4520 
4521 	if ((ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM43225))
4522 		wlc_hw->_nbands = 1;
4523 
4524 	/* BMAC_NOTE: remove init of pub values when brcms_c_attach()
4525 	 * unconditionally does the init of these values
4526 	 */
4527 	wlc->vendorid = wlc_hw->vendorid;
4528 	wlc->deviceid = wlc_hw->deviceid;
4529 	wlc->pub->sih = wlc_hw->sih;
4530 	wlc->pub->corerev = wlc_hw->corerev;
4531 	wlc->pub->sromrev = wlc_hw->sromrev;
4532 	wlc->pub->boardrev = wlc_hw->boardrev;
4533 	wlc->pub->boardflags = wlc_hw->boardflags;
4534 	wlc->pub->boardflags2 = wlc_hw->boardflags2;
4535 	wlc->pub->_nbands = wlc_hw->_nbands;
4536 
4537 	wlc_hw->physhim = wlc_phy_shim_attach(wlc_hw, wlc->wl, wlc);
4538 
4539 	if (wlc_hw->physhim == NULL) {
4540 		wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_shim_attach "
4541 			"failed\n", unit);
4542 		err = 25;
4543 		goto fail;
4544 	}
4545 
4546 	/* pass all the parameters to wlc_phy_shared_attach in one struct */
4547 	sha_params.sih = wlc_hw->sih;
4548 	sha_params.physhim = wlc_hw->physhim;
4549 	sha_params.unit = unit;
4550 	sha_params.corerev = wlc_hw->corerev;
4551 	sha_params.vid = wlc_hw->vendorid;
4552 	sha_params.did = wlc_hw->deviceid;
4553 	sha_params.chip = ai_get_chip_id(wlc_hw->sih);
4554 	sha_params.chiprev = ai_get_chiprev(wlc_hw->sih);
4555 	sha_params.chippkg = ai_get_chippkg(wlc_hw->sih);
4556 	sha_params.sromrev = wlc_hw->sromrev;
4557 	sha_params.boardtype = ai_get_boardtype(wlc_hw->sih);
4558 	sha_params.boardrev = wlc_hw->boardrev;
4559 	sha_params.boardflags = wlc_hw->boardflags;
4560 	sha_params.boardflags2 = wlc_hw->boardflags2;
4561 
4562 	/* alloc and save pointer to shared phy state area */
4563 	wlc_hw->phy_sh = wlc_phy_shared_attach(&sha_params);
4564 	if (!wlc_hw->phy_sh) {
4565 		err = 16;
4566 		goto fail;
4567 	}
4568 
4569 	/* initialize software state for each core and band */
4570 	for (j = 0; j < wlc_hw->_nbands; j++) {
4571 		/*
4572 		 * band0 is always 2.4Ghz
4573 		 * band1, if present, is 5Ghz
4574 		 */
4575 
4576 		brcms_c_setxband(wlc_hw, j);
4577 
4578 		wlc_hw->band->bandunit = j;
4579 		wlc_hw->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4580 		wlc->band->bandunit = j;
4581 		wlc->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
4582 		wlc->core->coreidx = core->core_index;
4583 
4584 		wlc_hw->machwcap = bcma_read32(core, D11REGOFFS(machwcap));
4585 		wlc_hw->machwcap_backup = wlc_hw->machwcap;
4586 
4587 		/* init tx fifo size */
4588 		WARN_ON(wlc_hw->corerev < XMTFIFOTBL_STARTREV ||
4589 			(wlc_hw->corerev - XMTFIFOTBL_STARTREV) >
4590 				ARRAY_SIZE(xmtfifo_sz));
4591 		wlc_hw->xmtfifo_sz =
4592 		    xmtfifo_sz[(wlc_hw->corerev - XMTFIFOTBL_STARTREV)];
4593 		WARN_ON(!wlc_hw->xmtfifo_sz[0]);
4594 
4595 		/* Get a phy for this band */
4596 		wlc_hw->band->pi =
4597 			wlc_phy_attach(wlc_hw->phy_sh, core,
4598 				       wlc_hw->band->bandtype,
4599 				       wlc->wiphy);
4600 		if (wlc_hw->band->pi == NULL) {
4601 			wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_"
4602 				  "attach failed\n", unit);
4603 			err = 17;
4604 			goto fail;
4605 		}
4606 
4607 		wlc_phy_machwcap_set(wlc_hw->band->pi, wlc_hw->machwcap);
4608 
4609 		wlc_phy_get_phyversion(wlc_hw->band->pi, &wlc_hw->band->phytype,
4610 				       &wlc_hw->band->phyrev,
4611 				       &wlc_hw->band->radioid,
4612 				       &wlc_hw->band->radiorev);
4613 		wlc_hw->band->abgphy_encore =
4614 		    wlc_phy_get_encore(wlc_hw->band->pi);
4615 		wlc->band->abgphy_encore = wlc_phy_get_encore(wlc_hw->band->pi);
4616 		wlc_hw->band->core_flags =
4617 		    wlc_phy_get_coreflags(wlc_hw->band->pi);
4618 
4619 		/* verify good phy_type & supported phy revision */
4620 		if (BRCMS_ISNPHY(wlc_hw->band)) {
4621 			if (NCONF_HAS(wlc_hw->band->phyrev))
4622 				goto good_phy;
4623 			else
4624 				goto bad_phy;
4625 		} else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
4626 			if (LCNCONF_HAS(wlc_hw->band->phyrev))
4627 				goto good_phy;
4628 			else
4629 				goto bad_phy;
4630 		} else {
4631  bad_phy:
4632 			wiphy_err(wiphy, "wl%d: brcms_b_attach: unsupported "
4633 				  "phy type/rev (%d/%d)\n", unit,
4634 				  wlc_hw->band->phytype, wlc_hw->band->phyrev);
4635 			err = 18;
4636 			goto fail;
4637 		}
4638 
4639  good_phy:
4640 		/*
4641 		 * BMAC_NOTE: wlc->band->pi should not be set below and should
4642 		 * be done in the high level attach. However we can not make
4643 		 * that change until all low level access is changed to
4644 		 * wlc_hw->band->pi. Instead do the wlc->band->pi init below,
4645 		 * keeping wlc_hw->band->pi as well for incremental update of
4646 		 * low level fns, and cut over low only init when all fns
4647 		 * updated.
4648 		 */
4649 		wlc->band->pi = wlc_hw->band->pi;
4650 		wlc->band->phytype = wlc_hw->band->phytype;
4651 		wlc->band->phyrev = wlc_hw->band->phyrev;
4652 		wlc->band->radioid = wlc_hw->band->radioid;
4653 		wlc->band->radiorev = wlc_hw->band->radiorev;
4654 		brcms_dbg_info(core, "wl%d: phy %u/%u radio %x/%u\n", unit,
4655 			       wlc->band->phytype, wlc->band->phyrev,
4656 			       wlc->band->radioid, wlc->band->radiorev);
4657 		/* default contention windows size limits */
4658 		wlc_hw->band->CWmin = APHY_CWMIN;
4659 		wlc_hw->band->CWmax = PHY_CWMAX;
4660 
4661 		if (!brcms_b_attach_dmapio(wlc, j, wme)) {
4662 			err = 19;
4663 			goto fail;
4664 		}
4665 	}
4666 
4667 	/* disable core to match driver "down" state */
4668 	brcms_c_coredisable(wlc_hw);
4669 
4670 	/* Match driver "down" state */
4671 	bcma_host_pci_down(wlc_hw->d11core->bus);
4672 
4673 	/* turn off pll and xtal to match driver "down" state */
4674 	brcms_b_xtal(wlc_hw, OFF);
4675 
4676 	/* *******************************************************************
4677 	 * The hardware is in the DOWN state at this point. D11 core
4678 	 * or cores are in reset with clocks off, and the board PLLs
4679 	 * are off if possible.
4680 	 *
4681 	 * Beyond this point, wlc->sbclk == false and chip registers
4682 	 * should not be touched.
4683 	 *********************************************************************
4684 	 */
4685 
4686 	/* init etheraddr state variables */
4687 	brcms_c_get_macaddr(wlc_hw, wlc_hw->etheraddr);
4688 
4689 	if (is_broadcast_ether_addr(wlc_hw->etheraddr) ||
4690 	    is_zero_ether_addr(wlc_hw->etheraddr)) {
4691 		wiphy_err(wiphy, "wl%d: brcms_b_attach: bad macaddr\n",
4692 			  unit);
4693 		err = 22;
4694 		goto fail;
4695 	}
4696 
4697 	brcms_dbg_info(wlc_hw->d11core, "deviceid 0x%x nbands %d board 0x%x\n",
4698 		       wlc_hw->deviceid, wlc_hw->_nbands,
4699 		       ai_get_boardtype(wlc_hw->sih));
4700 
4701 	return err;
4702 
4703  fail:
4704 	wiphy_err(wiphy, "wl%d: brcms_b_attach: failed with err %d\n", unit,
4705 		  err);
4706 	return err;
4707 }
4708 
4709 static bool brcms_c_attach_stf_ant_init(struct brcms_c_info *wlc)
4710 {
4711 	int aa;
4712 	uint unit;
4713 	int bandtype;
4714 	struct ssb_sprom *sprom = &wlc->hw->d11core->bus->sprom;
4715 
4716 	unit = wlc->pub->unit;
4717 	bandtype = wlc->band->bandtype;
4718 
4719 	/* get antennas available */
4720 	if (bandtype == BRCM_BAND_5G)
4721 		aa = sprom->ant_available_a;
4722 	else
4723 		aa = sprom->ant_available_bg;
4724 
4725 	if ((aa < 1) || (aa > 15)) {
4726 		wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
4727 			  " srom (0x%x), using 3\n", unit, __func__, aa);
4728 		aa = 3;
4729 	}
4730 
4731 	/* reset the defaults if we have a single antenna */
4732 	if (aa == 1) {
4733 		wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_0;
4734 		wlc->stf->txant = ANT_TX_FORCE_0;
4735 	} else if (aa == 2) {
4736 		wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_1;
4737 		wlc->stf->txant = ANT_TX_FORCE_1;
4738 	} else {
4739 	}
4740 
4741 	/* Compute Antenna Gain */
4742 	if (bandtype == BRCM_BAND_5G)
4743 		wlc->band->antgain = sprom->antenna_gain.a1;
4744 	else
4745 		wlc->band->antgain = sprom->antenna_gain.a0;
4746 
4747 	return true;
4748 }
4749 
4750 static void brcms_c_bss_default_init(struct brcms_c_info *wlc)
4751 {
4752 	u16 chanspec;
4753 	struct brcms_band *band;
4754 	struct brcms_bss_info *bi = wlc->default_bss;
4755 
4756 	/* init default and target BSS with some sane initial values */
4757 	memset(bi, 0, sizeof(*bi));
4758 	bi->beacon_period = BEACON_INTERVAL_DEFAULT;
4759 
4760 	/* fill the default channel as the first valid channel
4761 	 * starting from the 2G channels
4762 	 */
4763 	chanspec = ch20mhz_chspec(1);
4764 	wlc->home_chanspec = bi->chanspec = chanspec;
4765 
4766 	/* find the band of our default channel */
4767 	band = wlc->band;
4768 	if (wlc->pub->_nbands > 1 &&
4769 	    band->bandunit != chspec_bandunit(chanspec))
4770 		band = wlc->bandstate[OTHERBANDUNIT(wlc)];
4771 
4772 	/* init bss rates to the band specific default rate set */
4773 	brcms_c_rateset_default(&bi->rateset, NULL, band->phytype,
4774 		band->bandtype, false, BRCMS_RATE_MASK_FULL,
4775 		(bool) (wlc->pub->_n_enab & SUPPORT_11N),
4776 		brcms_chspec_bw(chanspec), wlc->stf->txstreams);
4777 
4778 	if (wlc->pub->_n_enab & SUPPORT_11N)
4779 		bi->flags |= BRCMS_BSS_HT;
4780 }
4781 
4782 static void brcms_c_update_mimo_band_bwcap(struct brcms_c_info *wlc, u8 bwcap)
4783 {
4784 	uint i;
4785 	struct brcms_band *band;
4786 
4787 	for (i = 0; i < wlc->pub->_nbands; i++) {
4788 		band = wlc->bandstate[i];
4789 		if (band->bandtype == BRCM_BAND_5G) {
4790 			if ((bwcap == BRCMS_N_BW_40ALL)
4791 			    || (bwcap == BRCMS_N_BW_20IN2G_40IN5G))
4792 				band->mimo_cap_40 = true;
4793 			else
4794 				band->mimo_cap_40 = false;
4795 		} else {
4796 			if (bwcap == BRCMS_N_BW_40ALL)
4797 				band->mimo_cap_40 = true;
4798 			else
4799 				band->mimo_cap_40 = false;
4800 		}
4801 	}
4802 }
4803 
4804 static void brcms_c_timers_deinit(struct brcms_c_info *wlc)
4805 {
4806 	/* free timer state */
4807 	if (wlc->wdtimer) {
4808 		brcms_free_timer(wlc->wdtimer);
4809 		wlc->wdtimer = NULL;
4810 	}
4811 	if (wlc->radio_timer) {
4812 		brcms_free_timer(wlc->radio_timer);
4813 		wlc->radio_timer = NULL;
4814 	}
4815 }
4816 
4817 static void brcms_c_detach_module(struct brcms_c_info *wlc)
4818 {
4819 	if (wlc->asi) {
4820 		brcms_c_antsel_detach(wlc->asi);
4821 		wlc->asi = NULL;
4822 	}
4823 
4824 	if (wlc->ampdu) {
4825 		brcms_c_ampdu_detach(wlc->ampdu);
4826 		wlc->ampdu = NULL;
4827 	}
4828 
4829 	brcms_c_stf_detach(wlc);
4830 }
4831 
4832 /*
4833  * low level detach
4834  */
4835 static void brcms_b_detach(struct brcms_c_info *wlc)
4836 {
4837 	uint i;
4838 	struct brcms_hw_band *band;
4839 	struct brcms_hardware *wlc_hw = wlc->hw;
4840 
4841 	brcms_b_detach_dmapio(wlc_hw);
4842 
4843 	band = wlc_hw->band;
4844 	for (i = 0; i < wlc_hw->_nbands; i++) {
4845 		if (band->pi) {
4846 			/* Detach this band's phy */
4847 			wlc_phy_detach(band->pi);
4848 			band->pi = NULL;
4849 		}
4850 		band = wlc_hw->bandstate[OTHERBANDUNIT(wlc)];
4851 	}
4852 
4853 	/* Free shared phy state */
4854 	kfree(wlc_hw->phy_sh);
4855 
4856 	wlc_phy_shim_detach(wlc_hw->physhim);
4857 
4858 	if (wlc_hw->sih) {
4859 		ai_detach(wlc_hw->sih);
4860 		wlc_hw->sih = NULL;
4861 	}
4862 }
4863 
4864 /*
4865  * Return a count of the number of driver callbacks still pending.
4866  *
4867  * General policy is that brcms_c_detach can only dealloc/free software states.
4868  * It can NOT touch hardware registers since the d11core may be in reset and
4869  * clock may not be available.
4870  * One exception is sb register access, which is possible if crystal is turned
4871  * on after "down" state, driver should avoid software timer with the exception
4872  * of radio_monitor.
4873  */
4874 uint brcms_c_detach(struct brcms_c_info *wlc)
4875 {
4876 	uint callbacks;
4877 
4878 	if (wlc == NULL)
4879 		return 0;
4880 
4881 	brcms_b_detach(wlc);
4882 
4883 	/* delete software timers */
4884 	callbacks = 0;
4885 	if (!brcms_c_radio_monitor_stop(wlc))
4886 		callbacks++;
4887 
4888 	brcms_c_channel_mgr_detach(wlc->cmi);
4889 
4890 	brcms_c_timers_deinit(wlc);
4891 
4892 	brcms_c_detach_module(wlc);
4893 
4894 	brcms_c_detach_mfree(wlc);
4895 	return callbacks;
4896 }
4897 
4898 /* update state that depends on the current value of "ap" */
4899 static void brcms_c_ap_upd(struct brcms_c_info *wlc)
4900 {
4901 	/* STA-BSS; short capable */
4902 	wlc->PLCPHdr_override = BRCMS_PLCP_SHORT;
4903 }
4904 
4905 /* Initialize just the hardware when coming out of POR or S3/S5 system states */
4906 static void brcms_b_hw_up(struct brcms_hardware *wlc_hw)
4907 {
4908 	if (wlc_hw->wlc->pub->hw_up)
4909 		return;
4910 
4911 	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4912 
4913 	/*
4914 	 * Enable pll and xtal, initialize the power control registers,
4915 	 * and force fastclock for the remainder of brcms_c_up().
4916 	 */
4917 	brcms_b_xtal(wlc_hw, ON);
4918 	ai_clkctl_init(wlc_hw->sih);
4919 	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4920 
4921 	/*
4922 	 * TODO: test suspend/resume
4923 	 *
4924 	 * AI chip doesn't restore bar0win2 on
4925 	 * hibernation/resume, need sw fixup
4926 	 */
4927 
4928 	/*
4929 	 * Inform phy that a POR reset has occurred so
4930 	 * it does a complete phy init
4931 	 */
4932 	wlc_phy_por_inform(wlc_hw->band->pi);
4933 
4934 	wlc_hw->ucode_loaded = false;
4935 	wlc_hw->wlc->pub->hw_up = true;
4936 
4937 	if ((wlc_hw->boardflags & BFL_FEM)
4938 	    && (ai_get_chip_id(wlc_hw->sih) == BCMA_CHIP_ID_BCM4313)) {
4939 		if (!
4940 		    (wlc_hw->boardrev >= 0x1250
4941 		     && (wlc_hw->boardflags & BFL_FEM_BT)))
4942 			ai_epa_4313war(wlc_hw->sih);
4943 	}
4944 }
4945 
4946 static int brcms_b_up_prep(struct brcms_hardware *wlc_hw)
4947 {
4948 	brcms_dbg_info(wlc_hw->d11core, "wl%d\n", wlc_hw->unit);
4949 
4950 	/*
4951 	 * Enable pll and xtal, initialize the power control registers,
4952 	 * and force fastclock for the remainder of brcms_c_up().
4953 	 */
4954 	brcms_b_xtal(wlc_hw, ON);
4955 	ai_clkctl_init(wlc_hw->sih);
4956 	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
4957 
4958 	/*
4959 	 * Configure pci/pcmcia here instead of in brcms_c_attach()
4960 	 * to allow mfg hotswap:  down, hotswap (chip power cycle), up.
4961 	 */
4962 	bcma_host_pci_irq_ctl(wlc_hw->d11core->bus, wlc_hw->d11core,
4963 			      true);
4964 
4965 	/*
4966 	 * Need to read the hwradio status here to cover the case where the
4967 	 * system is loaded with the hw radio disabled. We do not want to
4968 	 * bring the driver up in this case.
4969 	 */
4970 	if (brcms_b_radio_read_hwdisabled(wlc_hw)) {
4971 		/* put SB PCI in down state again */
4972 		bcma_host_pci_down(wlc_hw->d11core->bus);
4973 		brcms_b_xtal(wlc_hw, OFF);
4974 		return -ENOMEDIUM;
4975 	}
4976 
4977 	bcma_host_pci_up(wlc_hw->d11core->bus);
4978 
4979 	/* reset the d11 core */
4980 	brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
4981 
4982 	return 0;
4983 }
4984 
4985 static int brcms_b_up_finish(struct brcms_hardware *wlc_hw)
4986 {
4987 	wlc_hw->up = true;
4988 	wlc_phy_hw_state_upd(wlc_hw->band->pi, true);
4989 
4990 	/* FULLY enable dynamic power control and d11 core interrupt */
4991 	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
4992 	brcms_intrson(wlc_hw->wlc->wl);
4993 	return 0;
4994 }
4995 
4996 /*
4997  * Write WME tunable parameters for retransmit/max rate
4998  * from wlc struct to ucode
4999  */
5000 static void brcms_c_wme_retries_write(struct brcms_c_info *wlc)
5001 {
5002 	int ac;
5003 
5004 	/* Need clock to do this */
5005 	if (!wlc->clk)
5006 		return;
5007 
5008 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
5009 		brcms_b_write_shm(wlc->hw, M_AC_TXLMT_ADDR(ac),
5010 				  wlc->wme_retries[ac]);
5011 }
5012 
5013 /* make interface operational */
5014 int brcms_c_up(struct brcms_c_info *wlc)
5015 {
5016 	struct ieee80211_channel *ch;
5017 
5018 	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5019 
5020 	/* HW is turned off so don't try to access it */
5021 	if (wlc->pub->hw_off || brcms_deviceremoved(wlc))
5022 		return -ENOMEDIUM;
5023 
5024 	if (!wlc->pub->hw_up) {
5025 		brcms_b_hw_up(wlc->hw);
5026 		wlc->pub->hw_up = true;
5027 	}
5028 
5029 	if ((wlc->pub->boardflags & BFL_FEM)
5030 	    && (ai_get_chip_id(wlc->hw->sih) == BCMA_CHIP_ID_BCM4313)) {
5031 		if (wlc->pub->boardrev >= 0x1250
5032 		    && (wlc->pub->boardflags & BFL_FEM_BT))
5033 			brcms_b_mhf(wlc->hw, MHF5, MHF5_4313_GPIOCTRL,
5034 				MHF5_4313_GPIOCTRL, BRCM_BAND_ALL);
5035 		else
5036 			brcms_b_mhf(wlc->hw, MHF4, MHF4_EXTPA_ENABLE,
5037 				    MHF4_EXTPA_ENABLE, BRCM_BAND_ALL);
5038 	}
5039 
5040 	/*
5041 	 * Need to read the hwradio status here to cover the case where the
5042 	 * system is loaded with the hw radio disabled. We do not want to bring
5043 	 * the driver up in this case. If radio is disabled, abort up, lower
5044 	 * power, start radio timer and return 0(for NDIS) don't call
5045 	 * radio_update to avoid looping brcms_c_up.
5046 	 *
5047 	 * brcms_b_up_prep() returns either 0 or -BCME_RADIOOFF only
5048 	 */
5049 	if (!wlc->pub->radio_disabled) {
5050 		int status = brcms_b_up_prep(wlc->hw);
5051 		if (status == -ENOMEDIUM) {
5052 			if (!mboolisset
5053 			    (wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE)) {
5054 				struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
5055 				mboolset(wlc->pub->radio_disabled,
5056 					 WL_RADIO_HW_DISABLE);
5057 				if (bsscfg->type == BRCMS_TYPE_STATION ||
5058 				    bsscfg->type == BRCMS_TYPE_ADHOC)
5059 					brcms_err(wlc->hw->d11core,
5060 						  "wl%d: up: rfdisable -> "
5061 						  "bsscfg_disable()\n",
5062 						   wlc->pub->unit);
5063 			}
5064 		}
5065 	}
5066 
5067 	if (wlc->pub->radio_disabled) {
5068 		brcms_c_radio_monitor_start(wlc);
5069 		return 0;
5070 	}
5071 
5072 	/* brcms_b_up_prep has done brcms_c_corereset(). so clk is on, set it */
5073 	wlc->clk = true;
5074 
5075 	brcms_c_radio_monitor_stop(wlc);
5076 
5077 	/* Set EDCF hostflags */
5078 	brcms_b_mhf(wlc->hw, MHF1, MHF1_EDCF, MHF1_EDCF, BRCM_BAND_ALL);
5079 
5080 	brcms_init(wlc->wl);
5081 	wlc->pub->up = true;
5082 
5083 	if (wlc->bandinit_pending) {
5084 		ch = wlc->pub->ieee_hw->conf.chandef.chan;
5085 		brcms_c_suspend_mac_and_wait(wlc);
5086 		brcms_c_set_chanspec(wlc, ch20mhz_chspec(ch->hw_value));
5087 		wlc->bandinit_pending = false;
5088 		brcms_c_enable_mac(wlc);
5089 	}
5090 
5091 	brcms_b_up_finish(wlc->hw);
5092 
5093 	/* Program the TX wme params with the current settings */
5094 	brcms_c_wme_retries_write(wlc);
5095 
5096 	/* start one second watchdog timer */
5097 	brcms_add_timer(wlc->wdtimer, TIMER_INTERVAL_WATCHDOG, true);
5098 	wlc->WDarmed = true;
5099 
5100 	/* ensure antenna config is up to date */
5101 	brcms_c_stf_phy_txant_upd(wlc);
5102 	/* ensure LDPC config is in sync */
5103 	brcms_c_ht_update_ldpc(wlc, wlc->stf->ldpc);
5104 
5105 	return 0;
5106 }
5107 
5108 static uint brcms_c_down_del_timer(struct brcms_c_info *wlc)
5109 {
5110 	uint callbacks = 0;
5111 
5112 	return callbacks;
5113 }
5114 
5115 static int brcms_b_bmac_down_prep(struct brcms_hardware *wlc_hw)
5116 {
5117 	bool dev_gone;
5118 	uint callbacks = 0;
5119 
5120 	if (!wlc_hw->up)
5121 		return callbacks;
5122 
5123 	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5124 
5125 	/* disable interrupts */
5126 	if (dev_gone)
5127 		wlc_hw->wlc->macintmask = 0;
5128 	else {
5129 		/* now disable interrupts */
5130 		brcms_intrsoff(wlc_hw->wlc->wl);
5131 
5132 		/* ensure we're running on the pll clock again */
5133 		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
5134 	}
5135 	/* down phy at the last of this stage */
5136 	callbacks += wlc_phy_down(wlc_hw->band->pi);
5137 
5138 	return callbacks;
5139 }
5140 
5141 static int brcms_b_down_finish(struct brcms_hardware *wlc_hw)
5142 {
5143 	uint callbacks = 0;
5144 	bool dev_gone;
5145 
5146 	if (!wlc_hw->up)
5147 		return callbacks;
5148 
5149 	wlc_hw->up = false;
5150 	wlc_phy_hw_state_upd(wlc_hw->band->pi, false);
5151 
5152 	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
5153 
5154 	if (dev_gone) {
5155 		wlc_hw->sbclk = false;
5156 		wlc_hw->clk = false;
5157 		wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
5158 
5159 		/* reclaim any posted packets */
5160 		brcms_c_flushqueues(wlc_hw->wlc);
5161 	} else {
5162 
5163 		/* Reset and disable the core */
5164 		if (bcma_core_is_enabled(wlc_hw->d11core)) {
5165 			if (bcma_read32(wlc_hw->d11core,
5166 					D11REGOFFS(maccontrol)) & MCTL_EN_MAC)
5167 				brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
5168 			callbacks += brcms_reset(wlc_hw->wlc->wl);
5169 			brcms_c_coredisable(wlc_hw);
5170 		}
5171 
5172 		/* turn off primary xtal and pll */
5173 		if (!wlc_hw->noreset) {
5174 			bcma_host_pci_down(wlc_hw->d11core->bus);
5175 			brcms_b_xtal(wlc_hw, OFF);
5176 		}
5177 	}
5178 
5179 	return callbacks;
5180 }
5181 
5182 /*
5183  * Mark the interface nonoperational, stop the software mechanisms,
5184  * disable the hardware, free any transient buffer state.
5185  * Return a count of the number of driver callbacks still pending.
5186  */
5187 uint brcms_c_down(struct brcms_c_info *wlc)
5188 {
5189 
5190 	uint callbacks = 0;
5191 	int i;
5192 	bool dev_gone = false;
5193 
5194 	brcms_dbg_info(wlc->hw->d11core, "wl%d\n", wlc->pub->unit);
5195 
5196 	/* check if we are already in the going down path */
5197 	if (wlc->going_down) {
5198 		brcms_err(wlc->hw->d11core,
5199 			  "wl%d: %s: Driver going down so return\n",
5200 			  wlc->pub->unit, __func__);
5201 		return 0;
5202 	}
5203 	if (!wlc->pub->up)
5204 		return callbacks;
5205 
5206 	wlc->going_down = true;
5207 
5208 	callbacks += brcms_b_bmac_down_prep(wlc->hw);
5209 
5210 	dev_gone = brcms_deviceremoved(wlc);
5211 
5212 	/* Call any registered down handlers */
5213 	for (i = 0; i < BRCMS_MAXMODULES; i++) {
5214 		if (wlc->modulecb[i].down_fn)
5215 			callbacks +=
5216 			    wlc->modulecb[i].down_fn(wlc->modulecb[i].hdl);
5217 	}
5218 
5219 	/* cancel the watchdog timer */
5220 	if (wlc->WDarmed) {
5221 		if (!brcms_del_timer(wlc->wdtimer))
5222 			callbacks++;
5223 		wlc->WDarmed = false;
5224 	}
5225 	/* cancel all other timers */
5226 	callbacks += brcms_c_down_del_timer(wlc);
5227 
5228 	wlc->pub->up = false;
5229 
5230 	wlc_phy_mute_upd(wlc->band->pi, false, PHY_MUTE_ALL);
5231 
5232 	callbacks += brcms_b_down_finish(wlc->hw);
5233 
5234 	/* brcms_b_down_finish has done brcms_c_coredisable(). so clk is off */
5235 	wlc->clk = false;
5236 
5237 	wlc->going_down = false;
5238 	return callbacks;
5239 }
5240 
5241 /* Set the current gmode configuration */
5242 int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config)
5243 {
5244 	int ret = 0;
5245 	uint i;
5246 	struct brcms_c_rateset rs;
5247 	/* Default to 54g Auto */
5248 	/* Advertise and use shortslot (-1/0/1 Auto/Off/On) */
5249 	s8 shortslot = BRCMS_SHORTSLOT_AUTO;
5250 	bool shortslot_restrict = false; /* Restrict association to stations
5251 					  * that support shortslot
5252 					  */
5253 	bool ofdm_basic = false;	/* Make 6, 12, and 24 basic rates */
5254 	/* Advertise and use short preambles (-1/0/1 Auto/Off/On) */
5255 	int preamble = BRCMS_PLCP_LONG;
5256 	bool preamble_restrict = false;	/* Restrict association to stations
5257 					 * that support short preambles
5258 					 */
5259 	struct brcms_band *band;
5260 
5261 	/* if N-support is enabled, allow Gmode set as long as requested
5262 	 * Gmode is not GMODE_LEGACY_B
5263 	 */
5264 	if ((wlc->pub->_n_enab & SUPPORT_11N) && gmode == GMODE_LEGACY_B)
5265 		return -ENOTSUPP;
5266 
5267 	/* verify that we are dealing with 2G band and grab the band pointer */
5268 	if (wlc->band->bandtype == BRCM_BAND_2G)
5269 		band = wlc->band;
5270 	else if ((wlc->pub->_nbands > 1) &&
5271 		 (wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype == BRCM_BAND_2G))
5272 		band = wlc->bandstate[OTHERBANDUNIT(wlc)];
5273 	else
5274 		return -EINVAL;
5275 
5276 	/* update configuration value */
5277 	if (config)
5278 		brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER, gmode);
5279 
5280 	/* Clear rateset override */
5281 	memset(&rs, 0, sizeof(rs));
5282 
5283 	switch (gmode) {
5284 	case GMODE_LEGACY_B:
5285 		shortslot = BRCMS_SHORTSLOT_OFF;
5286 		brcms_c_rateset_copy(&gphy_legacy_rates, &rs);
5287 
5288 		break;
5289 
5290 	case GMODE_LRS:
5291 		break;
5292 
5293 	case GMODE_AUTO:
5294 		/* Accept defaults */
5295 		break;
5296 
5297 	case GMODE_ONLY:
5298 		ofdm_basic = true;
5299 		preamble = BRCMS_PLCP_SHORT;
5300 		preamble_restrict = true;
5301 		break;
5302 
5303 	case GMODE_PERFORMANCE:
5304 		shortslot = BRCMS_SHORTSLOT_ON;
5305 		shortslot_restrict = true;
5306 		ofdm_basic = true;
5307 		preamble = BRCMS_PLCP_SHORT;
5308 		preamble_restrict = true;
5309 		break;
5310 
5311 	default:
5312 		/* Error */
5313 		brcms_err(wlc->hw->d11core, "wl%d: %s: invalid gmode %d\n",
5314 			  wlc->pub->unit, __func__, gmode);
5315 		return -ENOTSUPP;
5316 	}
5317 
5318 	band->gmode = gmode;
5319 
5320 	wlc->shortslot_override = shortslot;
5321 
5322 	/* Use the default 11g rateset */
5323 	if (!rs.count)
5324 		brcms_c_rateset_copy(&cck_ofdm_rates, &rs);
5325 
5326 	if (ofdm_basic) {
5327 		for (i = 0; i < rs.count; i++) {
5328 			if (rs.rates[i] == BRCM_RATE_6M
5329 			    || rs.rates[i] == BRCM_RATE_12M
5330 			    || rs.rates[i] == BRCM_RATE_24M)
5331 				rs.rates[i] |= BRCMS_RATE_FLAG;
5332 		}
5333 	}
5334 
5335 	/* Set default bss rateset */
5336 	wlc->default_bss->rateset.count = rs.count;
5337 	memcpy(wlc->default_bss->rateset.rates, rs.rates,
5338 	       sizeof(wlc->default_bss->rateset.rates));
5339 
5340 	return ret;
5341 }
5342 
5343 int brcms_c_set_nmode(struct brcms_c_info *wlc)
5344 {
5345 	uint i;
5346 	s32 nmode = AUTO;
5347 
5348 	if (wlc->stf->txstreams == WL_11N_3x3)
5349 		nmode = WL_11N_3x3;
5350 	else
5351 		nmode = WL_11N_2x2;
5352 
5353 	/* force GMODE_AUTO if NMODE is ON */
5354 	brcms_c_set_gmode(wlc, GMODE_AUTO, true);
5355 	if (nmode == WL_11N_3x3)
5356 		wlc->pub->_n_enab = SUPPORT_HT;
5357 	else
5358 		wlc->pub->_n_enab = SUPPORT_11N;
5359 	wlc->default_bss->flags |= BRCMS_BSS_HT;
5360 	/* add the mcs rates to the default and hw ratesets */
5361 	brcms_c_rateset_mcs_build(&wlc->default_bss->rateset,
5362 			      wlc->stf->txstreams);
5363 	for (i = 0; i < wlc->pub->_nbands; i++)
5364 		memcpy(wlc->bandstate[i]->hw_rateset.mcs,
5365 		       wlc->default_bss->rateset.mcs, MCSSET_LEN);
5366 
5367 	return 0;
5368 }
5369 
5370 static int
5371 brcms_c_set_internal_rateset(struct brcms_c_info *wlc,
5372 			     struct brcms_c_rateset *rs_arg)
5373 {
5374 	struct brcms_c_rateset rs, new;
5375 	uint bandunit;
5376 
5377 	memcpy(&rs, rs_arg, sizeof(struct brcms_c_rateset));
5378 
5379 	/* check for bad count value */
5380 	if ((rs.count == 0) || (rs.count > BRCMS_NUMRATES))
5381 		return -EINVAL;
5382 
5383 	/* try the current band */
5384 	bandunit = wlc->band->bandunit;
5385 	memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5386 	if (brcms_c_rate_hwrs_filter_sort_validate
5387 	    (&new, &wlc->bandstate[bandunit]->hw_rateset, true,
5388 	     wlc->stf->txstreams))
5389 		goto good;
5390 
5391 	/* try the other band */
5392 	if (brcms_is_mband_unlocked(wlc)) {
5393 		bandunit = OTHERBANDUNIT(wlc);
5394 		memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
5395 		if (brcms_c_rate_hwrs_filter_sort_validate(&new,
5396 						       &wlc->
5397 						       bandstate[bandunit]->
5398 						       hw_rateset, true,
5399 						       wlc->stf->txstreams))
5400 			goto good;
5401 	}
5402 
5403 	return -EBADE;
5404 
5405  good:
5406 	/* apply new rateset */
5407 	memcpy(&wlc->default_bss->rateset, &new,
5408 	       sizeof(struct brcms_c_rateset));
5409 	memcpy(&wlc->bandstate[bandunit]->defrateset, &new,
5410 	       sizeof(struct brcms_c_rateset));
5411 	return 0;
5412 }
5413 
5414 static void brcms_c_ofdm_rateset_war(struct brcms_c_info *wlc)
5415 {
5416 	u8 r;
5417 	bool war = false;
5418 
5419 	if (wlc->pub->associated)
5420 		r = wlc->bsscfg->current_bss->rateset.rates[0];
5421 	else
5422 		r = wlc->default_bss->rateset.rates[0];
5423 
5424 	wlc_phy_ofdm_rateset_war(wlc->band->pi, war);
5425 }
5426 
5427 int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel)
5428 {
5429 	u16 chspec = ch20mhz_chspec(channel);
5430 
5431 	if (channel < 0 || channel > MAXCHANNEL)
5432 		return -EINVAL;
5433 
5434 	if (!brcms_c_valid_chanspec_db(wlc->cmi, chspec))
5435 		return -EINVAL;
5436 
5437 
5438 	if (!wlc->pub->up && brcms_is_mband_unlocked(wlc)) {
5439 		if (wlc->band->bandunit != chspec_bandunit(chspec))
5440 			wlc->bandinit_pending = true;
5441 		else
5442 			wlc->bandinit_pending = false;
5443 	}
5444 
5445 	wlc->default_bss->chanspec = chspec;
5446 	/* brcms_c_BSSinit() will sanitize the rateset before
5447 	 * using it.. */
5448 	if (wlc->pub->up && (wlc_phy_chanspec_get(wlc->band->pi) != chspec)) {
5449 		brcms_c_set_home_chanspec(wlc, chspec);
5450 		brcms_c_suspend_mac_and_wait(wlc);
5451 		brcms_c_set_chanspec(wlc, chspec);
5452 		brcms_c_enable_mac(wlc);
5453 	}
5454 	return 0;
5455 }
5456 
5457 int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl)
5458 {
5459 	int ac;
5460 
5461 	if (srl < 1 || srl > RETRY_SHORT_MAX ||
5462 	    lrl < 1 || lrl > RETRY_SHORT_MAX)
5463 		return -EINVAL;
5464 
5465 	wlc->SRL = srl;
5466 	wlc->LRL = lrl;
5467 
5468 	brcms_b_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
5469 
5470 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
5471 		wlc->wme_retries[ac] =	SFIELD(wlc->wme_retries[ac],
5472 					       EDCF_SHORT,  wlc->SRL);
5473 		wlc->wme_retries[ac] =	SFIELD(wlc->wme_retries[ac],
5474 					       EDCF_LONG, wlc->LRL);
5475 	}
5476 	brcms_c_wme_retries_write(wlc);
5477 
5478 	return 0;
5479 }
5480 
5481 void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
5482 				 struct brcm_rateset *currs)
5483 {
5484 	struct brcms_c_rateset *rs;
5485 
5486 	if (wlc->pub->associated)
5487 		rs = &wlc->bsscfg->current_bss->rateset;
5488 	else
5489 		rs = &wlc->default_bss->rateset;
5490 
5491 	/* Copy only legacy rateset section */
5492 	currs->count = rs->count;
5493 	memcpy(&currs->rates, &rs->rates, rs->count);
5494 }
5495 
5496 int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
5497 {
5498 	struct brcms_c_rateset internal_rs;
5499 	int bcmerror;
5500 
5501 	if (rs->count > BRCMS_NUMRATES)
5502 		return -ENOBUFS;
5503 
5504 	memset(&internal_rs, 0, sizeof(internal_rs));
5505 
5506 	/* Copy only legacy rateset section */
5507 	internal_rs.count = rs->count;
5508 	memcpy(&internal_rs.rates, &rs->rates, internal_rs.count);
5509 
5510 	/* merge rateset coming in with the current mcsset */
5511 	if (wlc->pub->_n_enab & SUPPORT_11N) {
5512 		struct brcms_bss_info *mcsset_bss;
5513 		if (wlc->pub->associated)
5514 			mcsset_bss = wlc->bsscfg->current_bss;
5515 		else
5516 			mcsset_bss = wlc->default_bss;
5517 		memcpy(internal_rs.mcs, &mcsset_bss->rateset.mcs[0],
5518 		       MCSSET_LEN);
5519 	}
5520 
5521 	bcmerror = brcms_c_set_internal_rateset(wlc, &internal_rs);
5522 	if (!bcmerror)
5523 		brcms_c_ofdm_rateset_war(wlc);
5524 
5525 	return bcmerror;
5526 }
5527 
5528 static void brcms_c_time_lock(struct brcms_c_info *wlc)
5529 {
5530 	bcma_set32(wlc->hw->d11core, D11REGOFFS(maccontrol), MCTL_TBTTHOLD);
5531 	/* Commit the write */
5532 	bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
5533 }
5534 
5535 static void brcms_c_time_unlock(struct brcms_c_info *wlc)
5536 {
5537 	bcma_mask32(wlc->hw->d11core, D11REGOFFS(maccontrol), ~MCTL_TBTTHOLD);
5538 	/* Commit the write */
5539 	bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
5540 }
5541 
5542 int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
5543 {
5544 	u32 bcnint_us;
5545 
5546 	if (period == 0)
5547 		return -EINVAL;
5548 
5549 	wlc->default_bss->beacon_period = period;
5550 
5551 	bcnint_us = period << 10;
5552 	brcms_c_time_lock(wlc);
5553 	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfprep),
5554 		     (bcnint_us << CFPREP_CBI_SHIFT));
5555 	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_cfpstart), bcnint_us);
5556 	brcms_c_time_unlock(wlc);
5557 
5558 	return 0;
5559 }
5560 
5561 u16 brcms_c_get_phy_type(struct brcms_c_info *wlc, int phyidx)
5562 {
5563 	return wlc->band->phytype;
5564 }
5565 
5566 void brcms_c_set_shortslot_override(struct brcms_c_info *wlc, s8 sslot_override)
5567 {
5568 	wlc->shortslot_override = sslot_override;
5569 
5570 	/*
5571 	 * shortslot is an 11g feature, so no more work if we are
5572 	 * currently on the 5G band
5573 	 */
5574 	if (wlc->band->bandtype == BRCM_BAND_5G)
5575 		return;
5576 
5577 	if (wlc->pub->up && wlc->pub->associated) {
5578 		/* let watchdog or beacon processing update shortslot */
5579 	} else if (wlc->pub->up) {
5580 		/* unassociated shortslot is off */
5581 		brcms_c_switch_shortslot(wlc, false);
5582 	} else {
5583 		/* driver is down, so just update the brcms_c_info
5584 		 * value */
5585 		if (wlc->shortslot_override == BRCMS_SHORTSLOT_AUTO)
5586 			wlc->shortslot = false;
5587 		else
5588 			wlc->shortslot =
5589 			    (wlc->shortslot_override ==
5590 			     BRCMS_SHORTSLOT_ON);
5591 	}
5592 }
5593 
5594 /*
5595  * register watchdog and down handlers.
5596  */
5597 int brcms_c_module_register(struct brcms_pub *pub,
5598 			    const char *name, struct brcms_info *hdl,
5599 			    int (*d_fn)(void *handle))
5600 {
5601 	struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5602 	int i;
5603 
5604 	/* find an empty entry and just add, no duplication check! */
5605 	for (i = 0; i < BRCMS_MAXMODULES; i++) {
5606 		if (wlc->modulecb[i].name[0] == '\0') {
5607 			strncpy(wlc->modulecb[i].name, name,
5608 				sizeof(wlc->modulecb[i].name) - 1);
5609 			wlc->modulecb[i].hdl = hdl;
5610 			wlc->modulecb[i].down_fn = d_fn;
5611 			return 0;
5612 		}
5613 	}
5614 
5615 	return -ENOSR;
5616 }
5617 
5618 /* unregister module callbacks */
5619 int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
5620 			      struct brcms_info *hdl)
5621 {
5622 	struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
5623 	int i;
5624 
5625 	if (wlc == NULL)
5626 		return -ENODATA;
5627 
5628 	for (i = 0; i < BRCMS_MAXMODULES; i++) {
5629 		if (!strcmp(wlc->modulecb[i].name, name) &&
5630 		    (wlc->modulecb[i].hdl == hdl)) {
5631 			memset(&wlc->modulecb[i], 0, sizeof(wlc->modulecb[i]));
5632 			return 0;
5633 		}
5634 	}
5635 
5636 	/* table not found! */
5637 	return -ENODATA;
5638 }
5639 
5640 static bool brcms_c_chipmatch_pci(struct bcma_device *core)
5641 {
5642 	struct pci_dev *pcidev = core->bus->host_pci;
5643 	u16 vendor = pcidev->vendor;
5644 	u16 device = pcidev->device;
5645 
5646 	if (vendor != PCI_VENDOR_ID_BROADCOM) {
5647 		pr_err("unknown vendor id %04x\n", vendor);
5648 		return false;
5649 	}
5650 
5651 	if (device == BCM43224_D11N_ID_VEN1 || device == BCM43224_CHIP_ID)
5652 		return true;
5653 	if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
5654 		return true;
5655 	if (device == BCM4313_D11N2G_ID || device == BCM4313_CHIP_ID)
5656 		return true;
5657 	if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
5658 		return true;
5659 
5660 	pr_err("unknown device id %04x\n", device);
5661 	return false;
5662 }
5663 
5664 static bool brcms_c_chipmatch_soc(struct bcma_device *core)
5665 {
5666 	struct bcma_chipinfo *chipinfo = &core->bus->chipinfo;
5667 
5668 	if (chipinfo->id == BCMA_CHIP_ID_BCM4716)
5669 		return true;
5670 
5671 	pr_err("unknown chip id %04x\n", chipinfo->id);
5672 	return false;
5673 }
5674 
5675 bool brcms_c_chipmatch(struct bcma_device *core)
5676 {
5677 	switch (core->bus->hosttype) {
5678 	case BCMA_HOSTTYPE_PCI:
5679 		return brcms_c_chipmatch_pci(core);
5680 	case BCMA_HOSTTYPE_SOC:
5681 		return brcms_c_chipmatch_soc(core);
5682 	default:
5683 		pr_err("unknown host type: %i\n", core->bus->hosttype);
5684 		return false;
5685 	}
5686 }
5687 
5688 u16 brcms_b_rate_shm_offset(struct brcms_hardware *wlc_hw, u8 rate)
5689 {
5690 	u16 table_ptr;
5691 	u8 phy_rate, index;
5692 
5693 	/* get the phy specific rate encoding for the PLCP SIGNAL field */
5694 	if (is_ofdm_rate(rate))
5695 		table_ptr = M_RT_DIRMAP_A;
5696 	else
5697 		table_ptr = M_RT_DIRMAP_B;
5698 
5699 	/* for a given rate, the LS-nibble of the PLCP SIGNAL field is
5700 	 * the index into the rate table.
5701 	 */
5702 	phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
5703 	index = phy_rate & 0xf;
5704 
5705 	/* Find the SHM pointer to the rate table entry by looking in the
5706 	 * Direct-map Table
5707 	 */
5708 	return 2 * brcms_b_read_shm(wlc_hw, table_ptr + (index * 2));
5709 }
5710 
5711 /*
5712  * bcmc_fid_generate:
5713  * Generate frame ID for a BCMC packet.  The frag field is not used
5714  * for MC frames so is used as part of the sequence number.
5715  */
5716 static inline u16
5717 bcmc_fid_generate(struct brcms_c_info *wlc, struct brcms_bss_cfg *bsscfg,
5718 		  struct d11txh *txh)
5719 {
5720 	u16 frameid;
5721 
5722 	frameid = le16_to_cpu(txh->TxFrameID) & ~(TXFID_SEQ_MASK |
5723 						  TXFID_QUEUE_MASK);
5724 	frameid |=
5725 	    (((wlc->
5726 	       mc_fid_counter++) << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
5727 	    TX_BCMC_FIFO;
5728 
5729 	return frameid;
5730 }
5731 
5732 static uint
5733 brcms_c_calc_ack_time(struct brcms_c_info *wlc, u32 rspec,
5734 		      u8 preamble_type)
5735 {
5736 	uint dur = 0;
5737 
5738 	/*
5739 	 * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5740 	 * is less than or equal to the rate of the immediately previous
5741 	 * frame in the FES
5742 	 */
5743 	rspec = brcms_basic_rate(wlc, rspec);
5744 	/* ACK frame len == 14 == 2(fc) + 2(dur) + 6(ra) + 4(fcs) */
5745 	dur =
5746 	    brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5747 				(DOT11_ACK_LEN + FCS_LEN));
5748 	return dur;
5749 }
5750 
5751 static uint
5752 brcms_c_calc_cts_time(struct brcms_c_info *wlc, u32 rspec,
5753 		      u8 preamble_type)
5754 {
5755 	return brcms_c_calc_ack_time(wlc, rspec, preamble_type);
5756 }
5757 
5758 static uint
5759 brcms_c_calc_ba_time(struct brcms_c_info *wlc, u32 rspec,
5760 		     u8 preamble_type)
5761 {
5762 	/*
5763 	 * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
5764 	 * is less than or equal to the rate of the immediately previous
5765 	 * frame in the FES
5766 	 */
5767 	rspec = brcms_basic_rate(wlc, rspec);
5768 	/* BA len == 32 == 16(ctl hdr) + 4(ba len) + 8(bitmap) + 4(fcs) */
5769 	return brcms_c_calc_frame_time(wlc, rspec, preamble_type,
5770 				   (DOT11_BA_LEN + DOT11_BA_BITMAP_LEN +
5771 				    FCS_LEN));
5772 }
5773 
5774 /* brcms_c_compute_frame_dur()
5775  *
5776  * Calculate the 802.11 MAC header DUR field for MPDU
5777  * DUR for a single frame = 1 SIFS + 1 ACK
5778  * DUR for a frame with following frags = 3 SIFS + 2 ACK + next frag time
5779  *
5780  * rate			MPDU rate in unit of 500kbps
5781  * next_frag_len	next MPDU length in bytes
5782  * preamble_type	use short/GF or long/MM PLCP header
5783  */
5784 static u16
5785 brcms_c_compute_frame_dur(struct brcms_c_info *wlc, u32 rate,
5786 		      u8 preamble_type, uint next_frag_len)
5787 {
5788 	u16 dur, sifs;
5789 
5790 	sifs = get_sifs(wlc->band);
5791 
5792 	dur = sifs;
5793 	dur += (u16) brcms_c_calc_ack_time(wlc, rate, preamble_type);
5794 
5795 	if (next_frag_len) {
5796 		/* Double the current DUR to get 2 SIFS + 2 ACKs */
5797 		dur *= 2;
5798 		/* add another SIFS and the frag time */
5799 		dur += sifs;
5800 		dur +=
5801 		    (u16) brcms_c_calc_frame_time(wlc, rate, preamble_type,
5802 						 next_frag_len);
5803 	}
5804 	return dur;
5805 }
5806 
5807 /* The opposite of brcms_c_calc_frame_time */
5808 static uint
5809 brcms_c_calc_frame_len(struct brcms_c_info *wlc, u32 ratespec,
5810 		   u8 preamble_type, uint dur)
5811 {
5812 	uint nsyms, mac_len, Ndps, kNdps;
5813 	uint rate = rspec2rate(ratespec);
5814 
5815 	if (is_mcs_rate(ratespec)) {
5816 		uint mcs = ratespec & RSPEC_RATE_MASK;
5817 		int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
5818 		dur -= PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
5819 		/* payload calculation matches that of regular ofdm */
5820 		if (wlc->band->bandtype == BRCM_BAND_2G)
5821 			dur -= DOT11_OFDM_SIGNAL_EXTENSION;
5822 		/* kNdbps = kbps * 4 */
5823 		kNdps =	mcs_2_rate(mcs, rspec_is40mhz(ratespec),
5824 				   rspec_issgi(ratespec)) * 4;
5825 		nsyms = dur / APHY_SYMBOL_TIME;
5826 		mac_len =
5827 		    ((nsyms * kNdps) -
5828 		     ((APHY_SERVICE_NBITS + APHY_TAIL_NBITS) * 1000)) / 8000;
5829 	} else if (is_ofdm_rate(ratespec)) {
5830 		dur -= APHY_PREAMBLE_TIME;
5831 		dur -= APHY_SIGNAL_TIME;
5832 		/* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
5833 		Ndps = rate * 2;
5834 		nsyms = dur / APHY_SYMBOL_TIME;
5835 		mac_len =
5836 		    ((nsyms * Ndps) -
5837 		     (APHY_SERVICE_NBITS + APHY_TAIL_NBITS)) / 8;
5838 	} else {
5839 		if (preamble_type & BRCMS_SHORT_PREAMBLE)
5840 			dur -= BPHY_PLCP_SHORT_TIME;
5841 		else
5842 			dur -= BPHY_PLCP_TIME;
5843 		mac_len = dur * rate;
5844 		/* divide out factor of 2 in rate (1/2 mbps) */
5845 		mac_len = mac_len / 8 / 2;
5846 	}
5847 	return mac_len;
5848 }
5849 
5850 /*
5851  * Return true if the specified rate is supported by the specified band.
5852  * BRCM_BAND_AUTO indicates the current band.
5853  */
5854 static bool brcms_c_valid_rate(struct brcms_c_info *wlc, u32 rspec, int band,
5855 		    bool verbose)
5856 {
5857 	struct brcms_c_rateset *hw_rateset;
5858 	uint i;
5859 
5860 	if ((band == BRCM_BAND_AUTO) || (band == wlc->band->bandtype))
5861 		hw_rateset = &wlc->band->hw_rateset;
5862 	else if (wlc->pub->_nbands > 1)
5863 		hw_rateset = &wlc->bandstate[OTHERBANDUNIT(wlc)]->hw_rateset;
5864 	else
5865 		/* other band specified and we are a single band device */
5866 		return false;
5867 
5868 	/* check if this is a mimo rate */
5869 	if (is_mcs_rate(rspec)) {
5870 		if ((rspec & RSPEC_RATE_MASK) >= MCS_TABLE_SIZE)
5871 			goto error;
5872 
5873 		return isset(hw_rateset->mcs, (rspec & RSPEC_RATE_MASK));
5874 	}
5875 
5876 	for (i = 0; i < hw_rateset->count; i++)
5877 		if (hw_rateset->rates[i] == rspec2rate(rspec))
5878 			return true;
5879  error:
5880 	if (verbose)
5881 		brcms_err(wlc->hw->d11core, "wl%d: valid_rate: rate spec 0x%x "
5882 			  "not in hw_rateset\n", wlc->pub->unit, rspec);
5883 
5884 	return false;
5885 }
5886 
5887 static u32
5888 mac80211_wlc_set_nrate(struct brcms_c_info *wlc, struct brcms_band *cur_band,
5889 		       u32 int_val)
5890 {
5891 	struct bcma_device *core = wlc->hw->d11core;
5892 	u8 stf = (int_val & NRATE_STF_MASK) >> NRATE_STF_SHIFT;
5893 	u8 rate = int_val & NRATE_RATE_MASK;
5894 	u32 rspec;
5895 	bool ismcs = ((int_val & NRATE_MCS_INUSE) == NRATE_MCS_INUSE);
5896 	bool issgi = ((int_val & NRATE_SGI_MASK) >> NRATE_SGI_SHIFT);
5897 	bool override_mcs_only = ((int_val & NRATE_OVERRIDE_MCS_ONLY)
5898 				  == NRATE_OVERRIDE_MCS_ONLY);
5899 	int bcmerror = 0;
5900 
5901 	if (!ismcs)
5902 		return (u32) rate;
5903 
5904 	/* validate the combination of rate/mcs/stf is allowed */
5905 	if ((wlc->pub->_n_enab & SUPPORT_11N) && ismcs) {
5906 		/* mcs only allowed when nmode */
5907 		if (stf > PHY_TXC1_MODE_SDM) {
5908 			brcms_err(core, "wl%d: %s: Invalid stf\n",
5909 				  wlc->pub->unit, __func__);
5910 			bcmerror = -EINVAL;
5911 			goto done;
5912 		}
5913 
5914 		/* mcs 32 is a special case, DUP mode 40 only */
5915 		if (rate == 32) {
5916 			if (!CHSPEC_IS40(wlc->home_chanspec) ||
5917 			    ((stf != PHY_TXC1_MODE_SISO)
5918 			     && (stf != PHY_TXC1_MODE_CDD))) {
5919 				brcms_err(core, "wl%d: %s: Invalid mcs 32\n",
5920 					  wlc->pub->unit, __func__);
5921 				bcmerror = -EINVAL;
5922 				goto done;
5923 			}
5924 			/* mcs > 7 must use stf SDM */
5925 		} else if (rate > HIGHEST_SINGLE_STREAM_MCS) {
5926 			/* mcs > 7 must use stf SDM */
5927 			if (stf != PHY_TXC1_MODE_SDM) {
5928 				brcms_dbg_mac80211(core, "wl%d: enabling "
5929 						   "SDM mode for mcs %d\n",
5930 						   wlc->pub->unit, rate);
5931 				stf = PHY_TXC1_MODE_SDM;
5932 			}
5933 		} else {
5934 			/*
5935 			 * MCS 0-7 may use SISO, CDD, and for
5936 			 * phy_rev >= 3 STBC
5937 			 */
5938 			if ((stf > PHY_TXC1_MODE_STBC) ||
5939 			    (!BRCMS_STBC_CAP_PHY(wlc)
5940 			     && (stf == PHY_TXC1_MODE_STBC))) {
5941 				brcms_err(core, "wl%d: %s: Invalid STBC\n",
5942 					  wlc->pub->unit, __func__);
5943 				bcmerror = -EINVAL;
5944 				goto done;
5945 			}
5946 		}
5947 	} else if (is_ofdm_rate(rate)) {
5948 		if ((stf != PHY_TXC1_MODE_CDD) && (stf != PHY_TXC1_MODE_SISO)) {
5949 			brcms_err(core, "wl%d: %s: Invalid OFDM\n",
5950 				  wlc->pub->unit, __func__);
5951 			bcmerror = -EINVAL;
5952 			goto done;
5953 		}
5954 	} else if (is_cck_rate(rate)) {
5955 		if ((cur_band->bandtype != BRCM_BAND_2G)
5956 		    || (stf != PHY_TXC1_MODE_SISO)) {
5957 			brcms_err(core, "wl%d: %s: Invalid CCK\n",
5958 				  wlc->pub->unit, __func__);
5959 			bcmerror = -EINVAL;
5960 			goto done;
5961 		}
5962 	} else {
5963 		brcms_err(core, "wl%d: %s: Unknown rate type\n",
5964 			  wlc->pub->unit, __func__);
5965 		bcmerror = -EINVAL;
5966 		goto done;
5967 	}
5968 	/* make sure multiple antennae are available for non-siso rates */
5969 	if ((stf != PHY_TXC1_MODE_SISO) && (wlc->stf->txstreams == 1)) {
5970 		brcms_err(core, "wl%d: %s: SISO antenna but !SISO "
5971 			  "request\n", wlc->pub->unit, __func__);
5972 		bcmerror = -EINVAL;
5973 		goto done;
5974 	}
5975 
5976 	rspec = rate;
5977 	if (ismcs) {
5978 		rspec |= RSPEC_MIMORATE;
5979 		/* For STBC populate the STC field of the ratespec */
5980 		if (stf == PHY_TXC1_MODE_STBC) {
5981 			u8 stc;
5982 			stc = 1;	/* Nss for single stream is always 1 */
5983 			rspec |= (stc << RSPEC_STC_SHIFT);
5984 		}
5985 	}
5986 
5987 	rspec |= (stf << RSPEC_STF_SHIFT);
5988 
5989 	if (override_mcs_only)
5990 		rspec |= RSPEC_OVERRIDE_MCS_ONLY;
5991 
5992 	if (issgi)
5993 		rspec |= RSPEC_SHORT_GI;
5994 
5995 	if ((rate != 0)
5996 	    && !brcms_c_valid_rate(wlc, rspec, cur_band->bandtype, true))
5997 		return rate;
5998 
5999 	return rspec;
6000 done:
6001 	return rate;
6002 }
6003 
6004 /*
6005  * Compute PLCP, but only requires actual rate and length of pkt.
6006  * Rate is given in the driver standard multiple of 500 kbps.
6007  * le is set for 11 Mbps rate if necessary.
6008  * Broken out for PRQ.
6009  */
6010 
6011 static void brcms_c_cck_plcp_set(struct brcms_c_info *wlc, int rate_500,
6012 			     uint length, u8 *plcp)
6013 {
6014 	u16 usec = 0;
6015 	u8 le = 0;
6016 
6017 	switch (rate_500) {
6018 	case BRCM_RATE_1M:
6019 		usec = length << 3;
6020 		break;
6021 	case BRCM_RATE_2M:
6022 		usec = length << 2;
6023 		break;
6024 	case BRCM_RATE_5M5:
6025 		usec = (length << 4) / 11;
6026 		if ((length << 4) - (usec * 11) > 0)
6027 			usec++;
6028 		break;
6029 	case BRCM_RATE_11M:
6030 		usec = (length << 3) / 11;
6031 		if ((length << 3) - (usec * 11) > 0) {
6032 			usec++;
6033 			if ((usec * 11) - (length << 3) >= 8)
6034 				le = D11B_PLCP_SIGNAL_LE;
6035 		}
6036 		break;
6037 
6038 	default:
6039 		brcms_err(wlc->hw->d11core,
6040 			  "brcms_c_cck_plcp_set: unsupported rate %d\n",
6041 			  rate_500);
6042 		rate_500 = BRCM_RATE_1M;
6043 		usec = length << 3;
6044 		break;
6045 	}
6046 	/* PLCP signal byte */
6047 	plcp[0] = rate_500 * 5;	/* r (500kbps) * 5 == r (100kbps) */
6048 	/* PLCP service byte */
6049 	plcp[1] = (u8) (le | D11B_PLCP_SIGNAL_LOCKED);
6050 	/* PLCP length u16, little endian */
6051 	plcp[2] = usec & 0xff;
6052 	plcp[3] = (usec >> 8) & 0xff;
6053 	/* PLCP CRC16 */
6054 	plcp[4] = 0;
6055 	plcp[5] = 0;
6056 }
6057 
6058 /* Rate: 802.11 rate code, length: PSDU length in octets */
6059 static void brcms_c_compute_mimo_plcp(u32 rspec, uint length, u8 *plcp)
6060 {
6061 	u8 mcs = (u8) (rspec & RSPEC_RATE_MASK);
6062 	plcp[0] = mcs;
6063 	if (rspec_is40mhz(rspec) || (mcs == 32))
6064 		plcp[0] |= MIMO_PLCP_40MHZ;
6065 	BRCMS_SET_MIMO_PLCP_LEN(plcp, length);
6066 	plcp[3] = rspec_mimoplcp3(rspec); /* rspec already holds this byte */
6067 	plcp[3] |= 0x7; /* set smoothing, not sounding ppdu & reserved */
6068 	plcp[4] = 0; /* number of extension spatial streams bit 0 & 1 */
6069 	plcp[5] = 0;
6070 }
6071 
6072 /* Rate: 802.11 rate code, length: PSDU length in octets */
6073 static void
6074 brcms_c_compute_ofdm_plcp(u32 rspec, u32 length, u8 *plcp)
6075 {
6076 	u8 rate_signal;
6077 	u32 tmp = 0;
6078 	int rate = rspec2rate(rspec);
6079 
6080 	/*
6081 	 * encode rate per 802.11a-1999 sec 17.3.4.1, with lsb
6082 	 * transmitted first
6083 	 */
6084 	rate_signal = rate_info[rate] & BRCMS_RATE_MASK;
6085 	memset(plcp, 0, D11_PHY_HDR_LEN);
6086 	D11A_PHY_HDR_SRATE((struct ofdm_phy_hdr *) plcp, rate_signal);
6087 
6088 	tmp = (length & 0xfff) << 5;
6089 	plcp[2] |= (tmp >> 16) & 0xff;
6090 	plcp[1] |= (tmp >> 8) & 0xff;
6091 	plcp[0] |= tmp & 0xff;
6092 }
6093 
6094 /* Rate: 802.11 rate code, length: PSDU length in octets */
6095 static void brcms_c_compute_cck_plcp(struct brcms_c_info *wlc, u32 rspec,
6096 				 uint length, u8 *plcp)
6097 {
6098 	int rate = rspec2rate(rspec);
6099 
6100 	brcms_c_cck_plcp_set(wlc, rate, length, plcp);
6101 }
6102 
6103 static void
6104 brcms_c_compute_plcp(struct brcms_c_info *wlc, u32 rspec,
6105 		     uint length, u8 *plcp)
6106 {
6107 	if (is_mcs_rate(rspec))
6108 		brcms_c_compute_mimo_plcp(rspec, length, plcp);
6109 	else if (is_ofdm_rate(rspec))
6110 		brcms_c_compute_ofdm_plcp(rspec, length, plcp);
6111 	else
6112 		brcms_c_compute_cck_plcp(wlc, rspec, length, plcp);
6113 }
6114 
6115 /* brcms_c_compute_rtscts_dur()
6116  *
6117  * Calculate the 802.11 MAC header DUR field for an RTS or CTS frame
6118  * DUR for normal RTS/CTS w/ frame = 3 SIFS + 1 CTS + next frame time + 1 ACK
6119  * DUR for CTS-TO-SELF w/ frame    = 2 SIFS         + next frame time + 1 ACK
6120  *
6121  * cts			cts-to-self or rts/cts
6122  * rts_rate		rts or cts rate in unit of 500kbps
6123  * rate			next MPDU rate in unit of 500kbps
6124  * frame_len		next MPDU frame length in bytes
6125  */
6126 u16
6127 brcms_c_compute_rtscts_dur(struct brcms_c_info *wlc, bool cts_only,
6128 			   u32 rts_rate,
6129 			   u32 frame_rate, u8 rts_preamble_type,
6130 			   u8 frame_preamble_type, uint frame_len, bool ba)
6131 {
6132 	u16 dur, sifs;
6133 
6134 	sifs = get_sifs(wlc->band);
6135 
6136 	if (!cts_only) {
6137 		/* RTS/CTS */
6138 		dur = 3 * sifs;
6139 		dur +=
6140 		    (u16) brcms_c_calc_cts_time(wlc, rts_rate,
6141 					       rts_preamble_type);
6142 	} else {
6143 		/* CTS-TO-SELF */
6144 		dur = 2 * sifs;
6145 	}
6146 
6147 	dur +=
6148 	    (u16) brcms_c_calc_frame_time(wlc, frame_rate, frame_preamble_type,
6149 					 frame_len);
6150 	if (ba)
6151 		dur +=
6152 		    (u16) brcms_c_calc_ba_time(wlc, frame_rate,
6153 					      BRCMS_SHORT_PREAMBLE);
6154 	else
6155 		dur +=
6156 		    (u16) brcms_c_calc_ack_time(wlc, frame_rate,
6157 					       frame_preamble_type);
6158 	return dur;
6159 }
6160 
6161 static u16 brcms_c_phytxctl1_calc(struct brcms_c_info *wlc, u32 rspec)
6162 {
6163 	u16 phyctl1 = 0;
6164 	u16 bw;
6165 
6166 	if (BRCMS_ISLCNPHY(wlc->band)) {
6167 		bw = PHY_TXC1_BW_20MHZ;
6168 	} else {
6169 		bw = rspec_get_bw(rspec);
6170 		/* 10Mhz is not supported yet */
6171 		if (bw < PHY_TXC1_BW_20MHZ) {
6172 			brcms_err(wlc->hw->d11core, "phytxctl1_calc: bw %d is "
6173 				  "not supported yet, set to 20L\n", bw);
6174 			bw = PHY_TXC1_BW_20MHZ;
6175 		}
6176 	}
6177 
6178 	if (is_mcs_rate(rspec)) {
6179 		uint mcs = rspec & RSPEC_RATE_MASK;
6180 
6181 		/* bw, stf, coding-type is part of rspec_phytxbyte2 returns */
6182 		phyctl1 = rspec_phytxbyte2(rspec);
6183 		/* set the upper byte of phyctl1 */
6184 		phyctl1 |= (mcs_table[mcs].tx_phy_ctl3 << 8);
6185 	} else if (is_cck_rate(rspec) && !BRCMS_ISLCNPHY(wlc->band)
6186 		   && !BRCMS_ISSSLPNPHY(wlc->band)) {
6187 		/*
6188 		 * In CCK mode LPPHY overloads OFDM Modulation bits with CCK
6189 		 * Data Rate. Eventually MIMOPHY would also be converted to
6190 		 * this format
6191 		 */
6192 		/* 0 = 1Mbps; 1 = 2Mbps; 2 = 5.5Mbps; 3 = 11Mbps */
6193 		phyctl1 = (bw | (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6194 	} else {		/* legacy OFDM/CCK */
6195 		s16 phycfg;
6196 		/* get the phyctl byte from rate phycfg table */
6197 		phycfg = brcms_c_rate_legacy_phyctl(rspec2rate(rspec));
6198 		if (phycfg == -1) {
6199 			brcms_err(wlc->hw->d11core, "phytxctl1_calc: wrong "
6200 				  "legacy OFDM/CCK rate\n");
6201 			phycfg = 0;
6202 		}
6203 		/* set the upper byte of phyctl1 */
6204 		phyctl1 =
6205 		    (bw | (phycfg << 8) |
6206 		     (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
6207 	}
6208 	return phyctl1;
6209 }
6210 
6211 /*
6212  * Add struct d11txh, struct cck_phy_hdr.
6213  *
6214  * 'p' data must start with 802.11 MAC header
6215  * 'p' must allow enough bytes of local headers to be "pushed" onto the packet
6216  *
6217  * headroom == D11_PHY_HDR_LEN + D11_TXH_LEN (D11_TXH_LEN is now 104 bytes)
6218  *
6219  */
6220 static u16
6221 brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
6222 		     struct sk_buff *p, struct scb *scb, uint frag,
6223 		     uint nfrags, uint queue, uint next_frag_len)
6224 {
6225 	struct ieee80211_hdr *h;
6226 	struct d11txh *txh;
6227 	u8 *plcp, plcp_fallback[D11_PHY_HDR_LEN];
6228 	int len, phylen, rts_phylen;
6229 	u16 mch, phyctl, xfts, mainrates;
6230 	u16 seq = 0, mcl = 0, status = 0, frameid = 0;
6231 	u32 rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6232 	u32 rts_rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
6233 	bool use_rts = false;
6234 	bool use_cts = false;
6235 	bool use_rifs = false;
6236 	bool short_preamble[2] = { false, false };
6237 	u8 preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6238 	u8 rts_preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
6239 	u8 *rts_plcp, rts_plcp_fallback[D11_PHY_HDR_LEN];
6240 	struct ieee80211_rts *rts = NULL;
6241 	bool qos;
6242 	uint ac;
6243 	bool hwtkmic = false;
6244 	u16 mimo_ctlchbw = PHY_TXC1_BW_20MHZ;
6245 #define ANTCFG_NONE 0xFF
6246 	u8 antcfg = ANTCFG_NONE;
6247 	u8 fbantcfg = ANTCFG_NONE;
6248 	uint phyctl1_stf = 0;
6249 	u16 durid = 0;
6250 	struct ieee80211_tx_rate *txrate[2];
6251 	int k;
6252 	struct ieee80211_tx_info *tx_info;
6253 	bool is_mcs;
6254 	u16 mimo_txbw;
6255 	u8 mimo_preamble_type;
6256 
6257 	/* locate 802.11 MAC header */
6258 	h = (struct ieee80211_hdr *)(p->data);
6259 	qos = ieee80211_is_data_qos(h->frame_control);
6260 
6261 	/* compute length of frame in bytes for use in PLCP computations */
6262 	len = p->len;
6263 	phylen = len + FCS_LEN;
6264 
6265 	/* Get tx_info */
6266 	tx_info = IEEE80211_SKB_CB(p);
6267 
6268 	/* add PLCP */
6269 	plcp = skb_push(p, D11_PHY_HDR_LEN);
6270 
6271 	/* add Broadcom tx descriptor header */
6272 	txh = (struct d11txh *) skb_push(p, D11_TXH_LEN);
6273 	memset(txh, 0, D11_TXH_LEN);
6274 
6275 	/* setup frameid */
6276 	if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
6277 		/* non-AP STA should never use BCMC queue */
6278 		if (queue == TX_BCMC_FIFO) {
6279 			brcms_err(wlc->hw->d11core,
6280 				  "wl%d: %s: ASSERT queue == TX_BCMC!\n",
6281 				  wlc->pub->unit, __func__);
6282 			frameid = bcmc_fid_generate(wlc, NULL, txh);
6283 		} else {
6284 			/* Increment the counter for first fragment */
6285 			if (tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
6286 				scb->seqnum[p->priority]++;
6287 
6288 			/* extract fragment number from frame first */
6289 			seq = le16_to_cpu(h->seq_ctrl) & FRAGNUM_MASK;
6290 			seq |= (scb->seqnum[p->priority] << SEQNUM_SHIFT);
6291 			h->seq_ctrl = cpu_to_le16(seq);
6292 
6293 			frameid = ((seq << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
6294 			    (queue & TXFID_QUEUE_MASK);
6295 		}
6296 	}
6297 	frameid |= queue & TXFID_QUEUE_MASK;
6298 
6299 	/* set the ignpmq bit for all pkts tx'd in PS mode and for beacons */
6300 	if (ieee80211_is_beacon(h->frame_control))
6301 		mcl |= TXC_IGNOREPMQ;
6302 
6303 	txrate[0] = tx_info->control.rates;
6304 	txrate[1] = txrate[0] + 1;
6305 
6306 	/*
6307 	 * if rate control algorithm didn't give us a fallback
6308 	 * rate, use the primary rate
6309 	 */
6310 	if (txrate[1]->idx < 0)
6311 		txrate[1] = txrate[0];
6312 
6313 	for (k = 0; k < hw->max_rates; k++) {
6314 		is_mcs = txrate[k]->flags & IEEE80211_TX_RC_MCS ? true : false;
6315 		if (!is_mcs) {
6316 			if ((txrate[k]->idx >= 0)
6317 			    && (txrate[k]->idx <
6318 				hw->wiphy->bands[tx_info->band]->n_bitrates)) {
6319 				rspec[k] =
6320 				    hw->wiphy->bands[tx_info->band]->
6321 				    bitrates[txrate[k]->idx].hw_value;
6322 				short_preamble[k] =
6323 				    txrate[k]->
6324 				    flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ?
6325 				    true : false;
6326 			} else {
6327 				rspec[k] = BRCM_RATE_1M;
6328 			}
6329 		} else {
6330 			rspec[k] = mac80211_wlc_set_nrate(wlc, wlc->band,
6331 					NRATE_MCS_INUSE | txrate[k]->idx);
6332 		}
6333 
6334 		/*
6335 		 * Currently only support same setting for primay and
6336 		 * fallback rates. Unify flags for each rate into a
6337 		 * single value for the frame
6338 		 */
6339 		use_rts |=
6340 		    txrate[k]->
6341 		    flags & IEEE80211_TX_RC_USE_RTS_CTS ? true : false;
6342 		use_cts |=
6343 		    txrate[k]->
6344 		    flags & IEEE80211_TX_RC_USE_CTS_PROTECT ? true : false;
6345 
6346 
6347 		/*
6348 		 * (1) RATE:
6349 		 *   determine and validate primary rate
6350 		 *   and fallback rates
6351 		 */
6352 		if (!rspec_active(rspec[k])) {
6353 			rspec[k] = BRCM_RATE_1M;
6354 		} else {
6355 			if (!is_multicast_ether_addr(h->addr1)) {
6356 				/* set tx antenna config */
6357 				brcms_c_antsel_antcfg_get(wlc->asi, false,
6358 					false, 0, 0, &antcfg, &fbantcfg);
6359 			}
6360 		}
6361 	}
6362 
6363 	phyctl1_stf = wlc->stf->ss_opmode;
6364 
6365 	if (wlc->pub->_n_enab & SUPPORT_11N) {
6366 		for (k = 0; k < hw->max_rates; k++) {
6367 			/*
6368 			 * apply siso/cdd to single stream mcs's or ofdm
6369 			 * if rspec is auto selected
6370 			 */
6371 			if (((is_mcs_rate(rspec[k]) &&
6372 			      is_single_stream(rspec[k] & RSPEC_RATE_MASK)) ||
6373 			     is_ofdm_rate(rspec[k]))
6374 			    && ((rspec[k] & RSPEC_OVERRIDE_MCS_ONLY)
6375 				|| !(rspec[k] & RSPEC_OVERRIDE))) {
6376 				rspec[k] &= ~(RSPEC_STF_MASK | RSPEC_STC_MASK);
6377 
6378 				/* For SISO MCS use STBC if possible */
6379 				if (is_mcs_rate(rspec[k])
6380 				    && BRCMS_STF_SS_STBC_TX(wlc, scb)) {
6381 					u8 stc;
6382 
6383 					/* Nss for single stream is always 1 */
6384 					stc = 1;
6385 					rspec[k] |= (PHY_TXC1_MODE_STBC <<
6386 							RSPEC_STF_SHIFT) |
6387 						    (stc << RSPEC_STC_SHIFT);
6388 				} else
6389 					rspec[k] |=
6390 					    (phyctl1_stf << RSPEC_STF_SHIFT);
6391 			}
6392 
6393 			/*
6394 			 * Is the phy configured to use 40MHZ frames? If
6395 			 * so then pick the desired txbw
6396 			 */
6397 			if (brcms_chspec_bw(wlc->chanspec) == BRCMS_40_MHZ) {
6398 				/* default txbw is 20in40 SB */
6399 				mimo_ctlchbw = mimo_txbw =
6400 				   CHSPEC_SB_UPPER(wlc_phy_chanspec_get(
6401 								 wlc->band->pi))
6402 				   ? PHY_TXC1_BW_20MHZ_UP : PHY_TXC1_BW_20MHZ;
6403 
6404 				if (is_mcs_rate(rspec[k])) {
6405 					/* mcs 32 must be 40b/w DUP */
6406 					if ((rspec[k] & RSPEC_RATE_MASK)
6407 					    == 32) {
6408 						mimo_txbw =
6409 						    PHY_TXC1_BW_40MHZ_DUP;
6410 						/* use override */
6411 					} else if (wlc->mimo_40txbw != AUTO)
6412 						mimo_txbw = wlc->mimo_40txbw;
6413 					/* else check if dst is using 40 Mhz */
6414 					else if (scb->flags & SCB_IS40)
6415 						mimo_txbw = PHY_TXC1_BW_40MHZ;
6416 				} else if (is_ofdm_rate(rspec[k])) {
6417 					if (wlc->ofdm_40txbw != AUTO)
6418 						mimo_txbw = wlc->ofdm_40txbw;
6419 				} else if (wlc->cck_40txbw != AUTO) {
6420 					mimo_txbw = wlc->cck_40txbw;
6421 				}
6422 			} else {
6423 				/*
6424 				 * mcs32 is 40 b/w only.
6425 				 * This is possible for probe packets on
6426 				 * a STA during SCAN
6427 				 */
6428 				if ((rspec[k] & RSPEC_RATE_MASK) == 32)
6429 					/* mcs 0 */
6430 					rspec[k] = RSPEC_MIMORATE;
6431 
6432 				mimo_txbw = PHY_TXC1_BW_20MHZ;
6433 			}
6434 
6435 			/* Set channel width */
6436 			rspec[k] &= ~RSPEC_BW_MASK;
6437 			if ((k == 0) || ((k > 0) && is_mcs_rate(rspec[k])))
6438 				rspec[k] |= (mimo_txbw << RSPEC_BW_SHIFT);
6439 			else
6440 				rspec[k] |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
6441 
6442 			/* Disable short GI, not supported yet */
6443 			rspec[k] &= ~RSPEC_SHORT_GI;
6444 
6445 			mimo_preamble_type = BRCMS_MM_PREAMBLE;
6446 			if (txrate[k]->flags & IEEE80211_TX_RC_GREEN_FIELD)
6447 				mimo_preamble_type = BRCMS_GF_PREAMBLE;
6448 
6449 			if ((txrate[k]->flags & IEEE80211_TX_RC_MCS)
6450 			    && (!is_mcs_rate(rspec[k]))) {
6451 				brcms_warn(wlc->hw->d11core,
6452 					   "wl%d: %s: IEEE80211_TX_RC_MCS != is_mcs_rate(rspec)\n",
6453 					   wlc->pub->unit, __func__);
6454 			}
6455 
6456 			if (is_mcs_rate(rspec[k])) {
6457 				preamble_type[k] = mimo_preamble_type;
6458 
6459 				/*
6460 				 * if SGI is selected, then forced mm
6461 				 * for single stream
6462 				 */
6463 				if ((rspec[k] & RSPEC_SHORT_GI)
6464 				    && is_single_stream(rspec[k] &
6465 							RSPEC_RATE_MASK))
6466 					preamble_type[k] = BRCMS_MM_PREAMBLE;
6467 			}
6468 
6469 			/* should be better conditionalized */
6470 			if (!is_mcs_rate(rspec[0])
6471 			    && (tx_info->control.rates[0].
6472 				flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
6473 				preamble_type[k] = BRCMS_SHORT_PREAMBLE;
6474 		}
6475 	} else {
6476 		for (k = 0; k < hw->max_rates; k++) {
6477 			/* Set ctrlchbw as 20Mhz */
6478 			rspec[k] &= ~RSPEC_BW_MASK;
6479 			rspec[k] |= (PHY_TXC1_BW_20MHZ << RSPEC_BW_SHIFT);
6480 
6481 			/* for nphy, stf of ofdm frames must follow policies */
6482 			if (BRCMS_ISNPHY(wlc->band) && is_ofdm_rate(rspec[k])) {
6483 				rspec[k] &= ~RSPEC_STF_MASK;
6484 				rspec[k] |= phyctl1_stf << RSPEC_STF_SHIFT;
6485 			}
6486 		}
6487 	}
6488 
6489 	/* Reset these for use with AMPDU's */
6490 	txrate[0]->count = 0;
6491 	txrate[1]->count = 0;
6492 
6493 	/* (2) PROTECTION, may change rspec */
6494 	if ((ieee80211_is_data(h->frame_control) ||
6495 	    ieee80211_is_mgmt(h->frame_control)) &&
6496 	    (phylen > wlc->RTSThresh) && !is_multicast_ether_addr(h->addr1))
6497 		use_rts = true;
6498 
6499 	/* (3) PLCP: determine PLCP header and MAC duration,
6500 	 * fill struct d11txh */
6501 	brcms_c_compute_plcp(wlc, rspec[0], phylen, plcp);
6502 	brcms_c_compute_plcp(wlc, rspec[1], phylen, plcp_fallback);
6503 	memcpy(&txh->FragPLCPFallback,
6504 	       plcp_fallback, sizeof(txh->FragPLCPFallback));
6505 
6506 	/* Length field now put in CCK FBR CRC field */
6507 	if (is_cck_rate(rspec[1])) {
6508 		txh->FragPLCPFallback[4] = phylen & 0xff;
6509 		txh->FragPLCPFallback[5] = (phylen & 0xff00) >> 8;
6510 	}
6511 
6512 	/* MIMO-RATE: need validation ?? */
6513 	mainrates = is_ofdm_rate(rspec[0]) ?
6514 			D11A_PHY_HDR_GRATE((struct ofdm_phy_hdr *) plcp) :
6515 			plcp[0];
6516 
6517 	/* DUR field for main rate */
6518 	if (!ieee80211_is_pspoll(h->frame_control) &&
6519 	    !is_multicast_ether_addr(h->addr1) && !use_rifs) {
6520 		durid =
6521 		    brcms_c_compute_frame_dur(wlc, rspec[0], preamble_type[0],
6522 					  next_frag_len);
6523 		h->duration_id = cpu_to_le16(durid);
6524 	} else if (use_rifs) {
6525 		/* NAV protect to end of next max packet size */
6526 		durid =
6527 		    (u16) brcms_c_calc_frame_time(wlc, rspec[0],
6528 						 preamble_type[0],
6529 						 DOT11_MAX_FRAG_LEN);
6530 		durid += RIFS_11N_TIME;
6531 		h->duration_id = cpu_to_le16(durid);
6532 	}
6533 
6534 	/* DUR field for fallback rate */
6535 	if (ieee80211_is_pspoll(h->frame_control))
6536 		txh->FragDurFallback = h->duration_id;
6537 	else if (is_multicast_ether_addr(h->addr1) || use_rifs)
6538 		txh->FragDurFallback = 0;
6539 	else {
6540 		durid = brcms_c_compute_frame_dur(wlc, rspec[1],
6541 					      preamble_type[1], next_frag_len);
6542 		txh->FragDurFallback = cpu_to_le16(durid);
6543 	}
6544 
6545 	/* (4) MAC-HDR: MacTxControlLow */
6546 	if (frag == 0)
6547 		mcl |= TXC_STARTMSDU;
6548 
6549 	if (!is_multicast_ether_addr(h->addr1))
6550 		mcl |= TXC_IMMEDACK;
6551 
6552 	if (wlc->band->bandtype == BRCM_BAND_5G)
6553 		mcl |= TXC_FREQBAND_5G;
6554 
6555 	if (CHSPEC_IS40(wlc_phy_chanspec_get(wlc->band->pi)))
6556 		mcl |= TXC_BW_40;
6557 
6558 	/* set AMIC bit if using hardware TKIP MIC */
6559 	if (hwtkmic)
6560 		mcl |= TXC_AMIC;
6561 
6562 	txh->MacTxControlLow = cpu_to_le16(mcl);
6563 
6564 	/* MacTxControlHigh */
6565 	mch = 0;
6566 
6567 	/* Set fallback rate preamble type */
6568 	if ((preamble_type[1] == BRCMS_SHORT_PREAMBLE) ||
6569 	    (preamble_type[1] == BRCMS_GF_PREAMBLE)) {
6570 		if (rspec2rate(rspec[1]) != BRCM_RATE_1M)
6571 			mch |= TXC_PREAMBLE_DATA_FB_SHORT;
6572 	}
6573 
6574 	/* MacFrameControl */
6575 	memcpy(&txh->MacFrameControl, &h->frame_control, sizeof(u16));
6576 	txh->TxFesTimeNormal = cpu_to_le16(0);
6577 
6578 	txh->TxFesTimeFallback = cpu_to_le16(0);
6579 
6580 	/* TxFrameRA */
6581 	memcpy(&txh->TxFrameRA, &h->addr1, ETH_ALEN);
6582 
6583 	/* TxFrameID */
6584 	txh->TxFrameID = cpu_to_le16(frameid);
6585 
6586 	/*
6587 	 * TxStatus, Note the case of recreating the first frag of a suppressed
6588 	 * frame then we may need to reset the retry cnt's via the status reg
6589 	 */
6590 	txh->TxStatus = cpu_to_le16(status);
6591 
6592 	/*
6593 	 * extra fields for ucode AMPDU aggregation, the new fields are added to
6594 	 * the END of previous structure so that it's compatible in driver.
6595 	 */
6596 	txh->MaxNMpdus = cpu_to_le16(0);
6597 	txh->MaxABytes_MRT = cpu_to_le16(0);
6598 	txh->MaxABytes_FBR = cpu_to_le16(0);
6599 	txh->MinMBytes = cpu_to_le16(0);
6600 
6601 	/* (5) RTS/CTS: determine RTS/CTS PLCP header and MAC duration,
6602 	 * furnish struct d11txh */
6603 	/* RTS PLCP header and RTS frame */
6604 	if (use_rts || use_cts) {
6605 		if (use_rts && use_cts)
6606 			use_cts = false;
6607 
6608 		for (k = 0; k < 2; k++) {
6609 			rts_rspec[k] = brcms_c_rspec_to_rts_rspec(wlc, rspec[k],
6610 							      false,
6611 							      mimo_ctlchbw);
6612 		}
6613 
6614 		if (!is_ofdm_rate(rts_rspec[0]) &&
6615 		    !((rspec2rate(rts_rspec[0]) == BRCM_RATE_1M) ||
6616 		      (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6617 			rts_preamble_type[0] = BRCMS_SHORT_PREAMBLE;
6618 			mch |= TXC_PREAMBLE_RTS_MAIN_SHORT;
6619 		}
6620 
6621 		if (!is_ofdm_rate(rts_rspec[1]) &&
6622 		    !((rspec2rate(rts_rspec[1]) == BRCM_RATE_1M) ||
6623 		      (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
6624 			rts_preamble_type[1] = BRCMS_SHORT_PREAMBLE;
6625 			mch |= TXC_PREAMBLE_RTS_FB_SHORT;
6626 		}
6627 
6628 		/* RTS/CTS additions to MacTxControlLow */
6629 		if (use_cts) {
6630 			txh->MacTxControlLow |= cpu_to_le16(TXC_SENDCTS);
6631 		} else {
6632 			txh->MacTxControlLow |= cpu_to_le16(TXC_SENDRTS);
6633 			txh->MacTxControlLow |= cpu_to_le16(TXC_LONGFRAME);
6634 		}
6635 
6636 		/* RTS PLCP header */
6637 		rts_plcp = txh->RTSPhyHeader;
6638 		if (use_cts)
6639 			rts_phylen = DOT11_CTS_LEN + FCS_LEN;
6640 		else
6641 			rts_phylen = DOT11_RTS_LEN + FCS_LEN;
6642 
6643 		brcms_c_compute_plcp(wlc, rts_rspec[0], rts_phylen, rts_plcp);
6644 
6645 		/* fallback rate version of RTS PLCP header */
6646 		brcms_c_compute_plcp(wlc, rts_rspec[1], rts_phylen,
6647 				 rts_plcp_fallback);
6648 		memcpy(&txh->RTSPLCPFallback, rts_plcp_fallback,
6649 		       sizeof(txh->RTSPLCPFallback));
6650 
6651 		/* RTS frame fields... */
6652 		rts = (struct ieee80211_rts *)&txh->rts_frame;
6653 
6654 		durid = brcms_c_compute_rtscts_dur(wlc, use_cts, rts_rspec[0],
6655 					       rspec[0], rts_preamble_type[0],
6656 					       preamble_type[0], phylen, false);
6657 		rts->duration = cpu_to_le16(durid);
6658 		/* fallback rate version of RTS DUR field */
6659 		durid = brcms_c_compute_rtscts_dur(wlc, use_cts,
6660 					       rts_rspec[1], rspec[1],
6661 					       rts_preamble_type[1],
6662 					       preamble_type[1], phylen, false);
6663 		txh->RTSDurFallback = cpu_to_le16(durid);
6664 
6665 		if (use_cts) {
6666 			rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6667 							 IEEE80211_STYPE_CTS);
6668 
6669 			memcpy(&rts->ra, &h->addr2, ETH_ALEN);
6670 		} else {
6671 			rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
6672 							 IEEE80211_STYPE_RTS);
6673 
6674 			memcpy(&rts->ra, &h->addr1, 2 * ETH_ALEN);
6675 		}
6676 
6677 		/* mainrate
6678 		 *    low 8 bits: main frag rate/mcs,
6679 		 *    high 8 bits: rts/cts rate/mcs
6680 		 */
6681 		mainrates |= (is_ofdm_rate(rts_rspec[0]) ?
6682 				D11A_PHY_HDR_GRATE(
6683 					(struct ofdm_phy_hdr *) rts_plcp) :
6684 				rts_plcp[0]) << 8;
6685 	} else {
6686 		memset(txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
6687 		memset(&txh->rts_frame, 0, sizeof(struct ieee80211_rts));
6688 		memset(txh->RTSPLCPFallback, 0, sizeof(txh->RTSPLCPFallback));
6689 		txh->RTSDurFallback = 0;
6690 	}
6691 
6692 #ifdef SUPPORT_40MHZ
6693 	/* add null delimiter count */
6694 	if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && is_mcs_rate(rspec))
6695 		txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM] =
6696 		   brcm_c_ampdu_null_delim_cnt(wlc->ampdu, scb, rspec, phylen);
6697 
6698 #endif
6699 
6700 	/*
6701 	 * Now that RTS/RTS FB preamble types are updated, write
6702 	 * the final value
6703 	 */
6704 	txh->MacTxControlHigh = cpu_to_le16(mch);
6705 
6706 	/*
6707 	 * MainRates (both the rts and frag plcp rates have
6708 	 * been calculated now)
6709 	 */
6710 	txh->MainRates = cpu_to_le16(mainrates);
6711 
6712 	/* XtraFrameTypes */
6713 	xfts = frametype(rspec[1], wlc->mimoft);
6714 	xfts |= (frametype(rts_rspec[0], wlc->mimoft) << XFTS_RTS_FT_SHIFT);
6715 	xfts |= (frametype(rts_rspec[1], wlc->mimoft) << XFTS_FBRRTS_FT_SHIFT);
6716 	xfts |= CHSPEC_CHANNEL(wlc_phy_chanspec_get(wlc->band->pi)) <<
6717 							     XFTS_CHANNEL_SHIFT;
6718 	txh->XtraFrameTypes = cpu_to_le16(xfts);
6719 
6720 	/* PhyTxControlWord */
6721 	phyctl = frametype(rspec[0], wlc->mimoft);
6722 	if ((preamble_type[0] == BRCMS_SHORT_PREAMBLE) ||
6723 	    (preamble_type[0] == BRCMS_GF_PREAMBLE)) {
6724 		if (rspec2rate(rspec[0]) != BRCM_RATE_1M)
6725 			phyctl |= PHY_TXC_SHORT_HDR;
6726 	}
6727 
6728 	/* phytxant is properly bit shifted */
6729 	phyctl |= brcms_c_stf_d11hdrs_phyctl_txant(wlc, rspec[0]);
6730 	txh->PhyTxControlWord = cpu_to_le16(phyctl);
6731 
6732 	/* PhyTxControlWord_1 */
6733 	if (BRCMS_PHY_11N_CAP(wlc->band)) {
6734 		u16 phyctl1 = 0;
6735 
6736 		phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[0]);
6737 		txh->PhyTxControlWord_1 = cpu_to_le16(phyctl1);
6738 		phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[1]);
6739 		txh->PhyTxControlWord_1_Fbr = cpu_to_le16(phyctl1);
6740 
6741 		if (use_rts || use_cts) {
6742 			phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[0]);
6743 			txh->PhyTxControlWord_1_Rts = cpu_to_le16(phyctl1);
6744 			phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[1]);
6745 			txh->PhyTxControlWord_1_FbrRts = cpu_to_le16(phyctl1);
6746 		}
6747 
6748 		/*
6749 		 * For mcs frames, if mixedmode(overloaded with long preamble)
6750 		 * is going to be set, fill in non-zero MModeLen and/or
6751 		 * MModeFbrLen it will be unnecessary if they are separated
6752 		 */
6753 		if (is_mcs_rate(rspec[0]) &&
6754 		    (preamble_type[0] == BRCMS_MM_PREAMBLE)) {
6755 			u16 mmodelen =
6756 			    brcms_c_calc_lsig_len(wlc, rspec[0], phylen);
6757 			txh->MModeLen = cpu_to_le16(mmodelen);
6758 		}
6759 
6760 		if (is_mcs_rate(rspec[1]) &&
6761 		    (preamble_type[1] == BRCMS_MM_PREAMBLE)) {
6762 			u16 mmodefbrlen =
6763 			    brcms_c_calc_lsig_len(wlc, rspec[1], phylen);
6764 			txh->MModeFbrLen = cpu_to_le16(mmodefbrlen);
6765 		}
6766 	}
6767 
6768 	ac = skb_get_queue_mapping(p);
6769 	if ((scb->flags & SCB_WMECAP) && qos && wlc->edcf_txop[ac]) {
6770 		uint frag_dur, dur, dur_fallback;
6771 
6772 		/* WME: Update TXOP threshold */
6773 		if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU) && frag == 0) {
6774 			frag_dur =
6775 			    brcms_c_calc_frame_time(wlc, rspec[0],
6776 					preamble_type[0], phylen);
6777 
6778 			if (rts) {
6779 				/* 1 RTS or CTS-to-self frame */
6780 				dur =
6781 				    brcms_c_calc_cts_time(wlc, rts_rspec[0],
6782 						      rts_preamble_type[0]);
6783 				dur_fallback =
6784 				    brcms_c_calc_cts_time(wlc, rts_rspec[1],
6785 						      rts_preamble_type[1]);
6786 				/* (SIFS + CTS) + SIFS + frame + SIFS + ACK */
6787 				dur += le16_to_cpu(rts->duration);
6788 				dur_fallback +=
6789 					le16_to_cpu(txh->RTSDurFallback);
6790 			} else if (use_rifs) {
6791 				dur = frag_dur;
6792 				dur_fallback = 0;
6793 			} else {
6794 				/* frame + SIFS + ACK */
6795 				dur = frag_dur;
6796 				dur +=
6797 				    brcms_c_compute_frame_dur(wlc, rspec[0],
6798 							  preamble_type[0], 0);
6799 
6800 				dur_fallback =
6801 				    brcms_c_calc_frame_time(wlc, rspec[1],
6802 							preamble_type[1],
6803 							phylen);
6804 				dur_fallback +=
6805 				    brcms_c_compute_frame_dur(wlc, rspec[1],
6806 							  preamble_type[1], 0);
6807 			}
6808 			/* NEED to set TxFesTimeNormal (hard) */
6809 			txh->TxFesTimeNormal = cpu_to_le16((u16) dur);
6810 			/*
6811 			 * NEED to set fallback rate version of
6812 			 * TxFesTimeNormal (hard)
6813 			 */
6814 			txh->TxFesTimeFallback =
6815 				cpu_to_le16((u16) dur_fallback);
6816 
6817 			/*
6818 			 * update txop byte threshold (txop minus intraframe
6819 			 * overhead)
6820 			 */
6821 			if (wlc->edcf_txop[ac] >= (dur - frag_dur)) {
6822 				uint newfragthresh;
6823 
6824 				newfragthresh =
6825 				    brcms_c_calc_frame_len(wlc,
6826 					rspec[0], preamble_type[0],
6827 					(wlc->edcf_txop[ac] -
6828 						(dur - frag_dur)));
6829 				/* range bound the fragthreshold */
6830 				if (newfragthresh < DOT11_MIN_FRAG_LEN)
6831 					newfragthresh =
6832 					    DOT11_MIN_FRAG_LEN;
6833 				else if (newfragthresh >
6834 					 wlc->usr_fragthresh)
6835 					newfragthresh =
6836 					    wlc->usr_fragthresh;
6837 				/* update the fragthresh and do txc update */
6838 				if (wlc->fragthresh[queue] !=
6839 				    (u16) newfragthresh)
6840 					wlc->fragthresh[queue] =
6841 					    (u16) newfragthresh;
6842 			} else {
6843 				brcms_warn(wlc->hw->d11core,
6844 					   "wl%d: %s txop invalid for rate %d\n",
6845 					   wlc->pub->unit, fifo_names[queue],
6846 					   rspec2rate(rspec[0]));
6847 			}
6848 
6849 			if (dur > wlc->edcf_txop[ac])
6850 				brcms_warn(wlc->hw->d11core,
6851 					   "wl%d: %s: %s txop exceeded phylen %d/%d dur %d/%d\n",
6852 					   wlc->pub->unit, __func__,
6853 					   fifo_names[queue],
6854 					   phylen, wlc->fragthresh[queue],
6855 					   dur, wlc->edcf_txop[ac]);
6856 		}
6857 	}
6858 
6859 	return 0;
6860 }
6861 
6862 static int brcms_c_tx(struct brcms_c_info *wlc, struct sk_buff *skb)
6863 {
6864 	struct dma_pub *dma;
6865 	int fifo, ret = -ENOSPC;
6866 	struct d11txh *txh;
6867 	u16 frameid = INVALIDFID;
6868 
6869 	fifo = brcms_ac_to_fifo(skb_get_queue_mapping(skb));
6870 	dma = wlc->hw->di[fifo];
6871 	txh = (struct d11txh *)(skb->data);
6872 
6873 	if (dma->txavail == 0) {
6874 		/*
6875 		 * We sometimes get a frame from mac80211 after stopping
6876 		 * the queues. This only ever seems to be a single frame
6877 		 * and is seems likely to be a race. TX_HEADROOM should
6878 		 * ensure that we have enough space to handle these stray
6879 		 * packets, so warn if there isn't. If we're out of space
6880 		 * in the tx ring and the tx queue isn't stopped then
6881 		 * we've really got a bug; warn loudly if that happens.
6882 		 */
6883 		brcms_warn(wlc->hw->d11core,
6884 			   "Received frame for tx with no space in DMA ring\n");
6885 		WARN_ON(!ieee80211_queue_stopped(wlc->pub->ieee_hw,
6886 						 skb_get_queue_mapping(skb)));
6887 		return -ENOSPC;
6888 	}
6889 
6890 	/* When a BC/MC frame is being committed to the BCMC fifo
6891 	 * via DMA (NOT PIO), update ucode or BSS info as appropriate.
6892 	 */
6893 	if (fifo == TX_BCMC_FIFO)
6894 		frameid = le16_to_cpu(txh->TxFrameID);
6895 
6896 	/* Commit BCMC sequence number in the SHM frame ID location */
6897 	if (frameid != INVALIDFID) {
6898 		/*
6899 		 * To inform the ucode of the last mcast frame posted
6900 		 * so that it can clear moredata bit
6901 		 */
6902 		brcms_b_write_shm(wlc->hw, M_BCMC_FID, frameid);
6903 	}
6904 
6905 	ret = brcms_c_txfifo(wlc, fifo, skb);
6906 	/*
6907 	 * The only reason for brcms_c_txfifo to fail is because
6908 	 * there weren't any DMA descriptors, but we've already
6909 	 * checked for that. So if it does fail yell loudly.
6910 	 */
6911 	WARN_ON_ONCE(ret);
6912 
6913 	return ret;
6914 }
6915 
6916 bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
6917 			      struct ieee80211_hw *hw)
6918 {
6919 	uint fifo;
6920 	struct scb *scb = &wlc->pri_scb;
6921 
6922 	fifo = brcms_ac_to_fifo(skb_get_queue_mapping(sdu));
6923 	brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0);
6924 	if (!brcms_c_tx(wlc, sdu))
6925 		return true;
6926 
6927 	/* packet discarded */
6928 	dev_kfree_skb_any(sdu);
6929 	return false;
6930 }
6931 
6932 int
6933 brcms_c_txfifo(struct brcms_c_info *wlc, uint fifo, struct sk_buff *p)
6934 {
6935 	struct dma_pub *dma = wlc->hw->di[fifo];
6936 	int ret;
6937 	u16 queue;
6938 
6939 	ret = dma_txfast(wlc, dma, p);
6940 	if (ret	< 0)
6941 		wiphy_err(wlc->wiphy, "txfifo: fatal, toss frames !!!\n");
6942 
6943 	/*
6944 	 * Stop queue if DMA ring is full. Reserve some free descriptors,
6945 	 * as we sometimes receive a frame from mac80211 after the queues
6946 	 * are stopped.
6947 	 */
6948 	queue = skb_get_queue_mapping(p);
6949 	if (dma->txavail <= TX_HEADROOM && fifo < TX_BCMC_FIFO &&
6950 	    !ieee80211_queue_stopped(wlc->pub->ieee_hw, queue))
6951 		ieee80211_stop_queue(wlc->pub->ieee_hw, queue);
6952 
6953 	return ret;
6954 }
6955 
6956 u32
6957 brcms_c_rspec_to_rts_rspec(struct brcms_c_info *wlc, u32 rspec,
6958 			   bool use_rspec, u16 mimo_ctlchbw)
6959 {
6960 	u32 rts_rspec = 0;
6961 
6962 	if (use_rspec)
6963 		/* use frame rate as rts rate */
6964 		rts_rspec = rspec;
6965 	else if (wlc->band->gmode && wlc->protection->_g && !is_cck_rate(rspec))
6966 		/* Use 11Mbps as the g protection RTS target rate and fallback.
6967 		 * Use the brcms_basic_rate() lookup to find the best basic rate
6968 		 * under the target in case 11 Mbps is not Basic.
6969 		 * 6 and 9 Mbps are not usually selected by rate selection, but
6970 		 * even if the OFDM rate we are protecting is 6 or 9 Mbps, 11
6971 		 * is more robust.
6972 		 */
6973 		rts_rspec = brcms_basic_rate(wlc, BRCM_RATE_11M);
6974 	else
6975 		/* calculate RTS rate and fallback rate based on the frame rate
6976 		 * RTS must be sent at a basic rate since it is a
6977 		 * control frame, sec 9.6 of 802.11 spec
6978 		 */
6979 		rts_rspec = brcms_basic_rate(wlc, rspec);
6980 
6981 	if (BRCMS_PHY_11N_CAP(wlc->band)) {
6982 		/* set rts txbw to correct side band */
6983 		rts_rspec &= ~RSPEC_BW_MASK;
6984 
6985 		/*
6986 		 * if rspec/rspec_fallback is 40MHz, then send RTS on both
6987 		 * 20MHz channel (DUP), otherwise send RTS on control channel
6988 		 */
6989 		if (rspec_is40mhz(rspec) && !is_cck_rate(rts_rspec))
6990 			rts_rspec |= (PHY_TXC1_BW_40MHZ_DUP << RSPEC_BW_SHIFT);
6991 		else
6992 			rts_rspec |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
6993 
6994 		/* pick siso/cdd as default for ofdm */
6995 		if (is_ofdm_rate(rts_rspec)) {
6996 			rts_rspec &= ~RSPEC_STF_MASK;
6997 			rts_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
6998 		}
6999 	}
7000 	return rts_rspec;
7001 }
7002 
7003 /* Update beacon listen interval in shared memory */
7004 static void brcms_c_bcn_li_upd(struct brcms_c_info *wlc)
7005 {
7006 	/* wake up every DTIM is the default */
7007 	if (wlc->bcn_li_dtim == 1)
7008 		brcms_b_write_shm(wlc->hw, M_BCN_LI, 0);
7009 	else
7010 		brcms_b_write_shm(wlc->hw, M_BCN_LI,
7011 			      (wlc->bcn_li_dtim << 8) | wlc->bcn_li_bcn);
7012 }
7013 
7014 static void
7015 brcms_b_read_tsf(struct brcms_hardware *wlc_hw, u32 *tsf_l_ptr,
7016 		  u32 *tsf_h_ptr)
7017 {
7018 	struct bcma_device *core = wlc_hw->d11core;
7019 
7020 	/* read the tsf timer low, then high to get an atomic read */
7021 	*tsf_l_ptr = bcma_read32(core, D11REGOFFS(tsf_timerlow));
7022 	*tsf_h_ptr = bcma_read32(core, D11REGOFFS(tsf_timerhigh));
7023 }
7024 
7025 /*
7026  * recover 64bit TSF value from the 16bit TSF value in the rx header
7027  * given the assumption that the TSF passed in header is within 65ms
7028  * of the current tsf.
7029  *
7030  * 6       5       4       4       3       2       1
7031  * 3.......6.......8.......0.......2.......4.......6.......8......0
7032  * |<---------- tsf_h ----------->||<--- tsf_l -->||<-RxTSFTime ->|
7033  *
7034  * The RxTSFTime are the lowest 16 bits and provided by the ucode. The
7035  * tsf_l is filled in by brcms_b_recv, which is done earlier in the
7036  * receive call sequence after rx interrupt. Only the higher 16 bits
7037  * are used. Finally, the tsf_h is read from the tsf register.
7038  */
7039 static u64 brcms_c_recover_tsf64(struct brcms_c_info *wlc,
7040 				 struct d11rxhdr *rxh)
7041 {
7042 	u32 tsf_h, tsf_l;
7043 	u16 rx_tsf_0_15, rx_tsf_16_31;
7044 
7045 	brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7046 
7047 	rx_tsf_16_31 = (u16)(tsf_l >> 16);
7048 	rx_tsf_0_15 = rxh->RxTSFTime;
7049 
7050 	/*
7051 	 * a greater tsf time indicates the low 16 bits of
7052 	 * tsf_l wrapped, so decrement the high 16 bits.
7053 	 */
7054 	if ((u16)tsf_l < rx_tsf_0_15) {
7055 		rx_tsf_16_31 -= 1;
7056 		if (rx_tsf_16_31 == 0xffff)
7057 			tsf_h -= 1;
7058 	}
7059 
7060 	return ((u64)tsf_h << 32) | (((u32)rx_tsf_16_31 << 16) + rx_tsf_0_15);
7061 }
7062 
7063 static void
7064 prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7065 		     struct sk_buff *p,
7066 		     struct ieee80211_rx_status *rx_status)
7067 {
7068 	int channel;
7069 	u32 rspec;
7070 	unsigned char *plcp;
7071 
7072 	/* fill in TSF and flag its presence */
7073 	rx_status->mactime = brcms_c_recover_tsf64(wlc, rxh);
7074 	rx_status->flag |= RX_FLAG_MACTIME_START;
7075 
7076 	channel = BRCMS_CHAN_CHANNEL(rxh->RxChan);
7077 
7078 	rx_status->band =
7079 		channel > 14 ? NL80211_BAND_5GHZ : NL80211_BAND_2GHZ;
7080 	rx_status->freq =
7081 		ieee80211_channel_to_frequency(channel, rx_status->band);
7082 
7083 	rx_status->signal = wlc_phy_rssi_compute(wlc->hw->band->pi, rxh);
7084 
7085 	/* noise */
7086 	/* qual */
7087 	rx_status->antenna =
7088 		(rxh->PhyRxStatus_0 & PRXS0_RXANT_UPSUBBAND) ? 1 : 0;
7089 
7090 	plcp = p->data;
7091 
7092 	rspec = brcms_c_compute_rspec(rxh, plcp);
7093 	if (is_mcs_rate(rspec)) {
7094 		rx_status->rate_idx = rspec & RSPEC_RATE_MASK;
7095 		rx_status->flag |= RX_FLAG_HT;
7096 		if (rspec_is40mhz(rspec))
7097 			rx_status->flag |= RX_FLAG_40MHZ;
7098 	} else {
7099 		switch (rspec2rate(rspec)) {
7100 		case BRCM_RATE_1M:
7101 			rx_status->rate_idx = 0;
7102 			break;
7103 		case BRCM_RATE_2M:
7104 			rx_status->rate_idx = 1;
7105 			break;
7106 		case BRCM_RATE_5M5:
7107 			rx_status->rate_idx = 2;
7108 			break;
7109 		case BRCM_RATE_11M:
7110 			rx_status->rate_idx = 3;
7111 			break;
7112 		case BRCM_RATE_6M:
7113 			rx_status->rate_idx = 4;
7114 			break;
7115 		case BRCM_RATE_9M:
7116 			rx_status->rate_idx = 5;
7117 			break;
7118 		case BRCM_RATE_12M:
7119 			rx_status->rate_idx = 6;
7120 			break;
7121 		case BRCM_RATE_18M:
7122 			rx_status->rate_idx = 7;
7123 			break;
7124 		case BRCM_RATE_24M:
7125 			rx_status->rate_idx = 8;
7126 			break;
7127 		case BRCM_RATE_36M:
7128 			rx_status->rate_idx = 9;
7129 			break;
7130 		case BRCM_RATE_48M:
7131 			rx_status->rate_idx = 10;
7132 			break;
7133 		case BRCM_RATE_54M:
7134 			rx_status->rate_idx = 11;
7135 			break;
7136 		default:
7137 			brcms_err(wlc->hw->d11core,
7138 				  "%s: Unknown rate\n", __func__);
7139 		}
7140 
7141 		/*
7142 		 * For 5GHz, we should decrease the index as it is
7143 		 * a subset of the 2.4G rates. See bitrates field
7144 		 * of brcms_band_5GHz_nphy (in mac80211_if.c).
7145 		 */
7146 		if (rx_status->band == NL80211_BAND_5GHZ)
7147 			rx_status->rate_idx -= BRCMS_LEGACY_5G_RATE_OFFSET;
7148 
7149 		/* Determine short preamble and rate_idx */
7150 		if (is_cck_rate(rspec)) {
7151 			if (rxh->PhyRxStatus_0 & PRXS0_SHORTH)
7152 				rx_status->flag |= RX_FLAG_SHORTPRE;
7153 		} else if (is_ofdm_rate(rspec)) {
7154 			rx_status->flag |= RX_FLAG_SHORTPRE;
7155 		} else {
7156 			brcms_err(wlc->hw->d11core, "%s: Unknown modulation\n",
7157 				  __func__);
7158 		}
7159 	}
7160 
7161 	if (plcp3_issgi(plcp[3]))
7162 		rx_status->flag |= RX_FLAG_SHORT_GI;
7163 
7164 	if (rxh->RxStatus1 & RXS_DECERR) {
7165 		rx_status->flag |= RX_FLAG_FAILED_PLCP_CRC;
7166 		brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_PLCP_CRC\n",
7167 			  __func__);
7168 	}
7169 	if (rxh->RxStatus1 & RXS_FCSERR) {
7170 		rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
7171 		brcms_err(wlc->hw->d11core, "%s:  RX_FLAG_FAILED_FCS_CRC\n",
7172 			  __func__);
7173 	}
7174 }
7175 
7176 static void
7177 brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
7178 		struct sk_buff *p)
7179 {
7180 	int len_mpdu;
7181 	struct ieee80211_rx_status rx_status;
7182 	struct ieee80211_hdr *hdr;
7183 
7184 	memset(&rx_status, 0, sizeof(rx_status));
7185 	prep_mac80211_status(wlc, rxh, p, &rx_status);
7186 
7187 	/* mac header+body length, exclude CRC and plcp header */
7188 	len_mpdu = p->len - D11_PHY_HDR_LEN - FCS_LEN;
7189 	skb_pull(p, D11_PHY_HDR_LEN);
7190 	__skb_trim(p, len_mpdu);
7191 
7192 	/* unmute transmit */
7193 	if (wlc->hw->suspended_fifos) {
7194 		hdr = (struct ieee80211_hdr *)p->data;
7195 		if (ieee80211_is_beacon(hdr->frame_control))
7196 			brcms_b_mute(wlc->hw, false);
7197 	}
7198 
7199 	memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
7200 	ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
7201 }
7202 
7203 /* calculate frame duration for Mixed-mode L-SIG spoofing, return
7204  * number of bytes goes in the length field
7205  *
7206  * Formula given by HT PHY Spec v 1.13
7207  *   len = 3(nsyms + nstream + 3) - 3
7208  */
7209 u16
7210 brcms_c_calc_lsig_len(struct brcms_c_info *wlc, u32 ratespec,
7211 		      uint mac_len)
7212 {
7213 	uint nsyms, len = 0, kNdps;
7214 
7215 	if (is_mcs_rate(ratespec)) {
7216 		uint mcs = ratespec & RSPEC_RATE_MASK;
7217 		int tot_streams = (mcs_2_txstreams(mcs) + 1) +
7218 				  rspec_stc(ratespec);
7219 
7220 		/*
7221 		 * the payload duration calculation matches that
7222 		 * of regular ofdm
7223 		 */
7224 		/* 1000Ndbps = kbps * 4 */
7225 		kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
7226 				   rspec_issgi(ratespec)) * 4;
7227 
7228 		if (rspec_stc(ratespec) == 0)
7229 			nsyms =
7230 			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7231 				  APHY_TAIL_NBITS) * 1000, kNdps);
7232 		else
7233 			/* STBC needs to have even number of symbols */
7234 			nsyms =
7235 			    2 *
7236 			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
7237 				  APHY_TAIL_NBITS) * 1000, 2 * kNdps);
7238 
7239 		/* (+3) account for HT-SIG(2) and HT-STF(1) */
7240 		nsyms += (tot_streams + 3);
7241 		/*
7242 		 * 3 bytes/symbol @ legacy 6Mbps rate
7243 		 * (-3) excluding service bits and tail bits
7244 		 */
7245 		len = (3 * nsyms) - 3;
7246 	}
7247 
7248 	return (u16) len;
7249 }
7250 
7251 static void
7252 brcms_c_mod_prb_rsp_rate_table(struct brcms_c_info *wlc, uint frame_len)
7253 {
7254 	const struct brcms_c_rateset *rs_dflt;
7255 	struct brcms_c_rateset rs;
7256 	u8 rate;
7257 	u16 entry_ptr;
7258 	u8 plcp[D11_PHY_HDR_LEN];
7259 	u16 dur, sifs;
7260 	uint i;
7261 
7262 	sifs = get_sifs(wlc->band);
7263 
7264 	rs_dflt = brcms_c_rateset_get_hwrs(wlc);
7265 
7266 	brcms_c_rateset_copy(rs_dflt, &rs);
7267 	brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
7268 
7269 	/*
7270 	 * walk the phy rate table and update MAC core SHM
7271 	 * basic rate table entries
7272 	 */
7273 	for (i = 0; i < rs.count; i++) {
7274 		rate = rs.rates[i] & BRCMS_RATE_MASK;
7275 
7276 		entry_ptr = brcms_b_rate_shm_offset(wlc->hw, rate);
7277 
7278 		/* Calculate the Probe Response PLCP for the given rate */
7279 		brcms_c_compute_plcp(wlc, rate, frame_len, plcp);
7280 
7281 		/*
7282 		 * Calculate the duration of the Probe Response
7283 		 * frame plus SIFS for the MAC
7284 		 */
7285 		dur = (u16) brcms_c_calc_frame_time(wlc, rate,
7286 						BRCMS_LONG_PREAMBLE, frame_len);
7287 		dur += sifs;
7288 
7289 		/* Update the SHM Rate Table entry Probe Response values */
7290 		brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS,
7291 			      (u16) (plcp[0] + (plcp[1] << 8)));
7292 		brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_PLCP_POS + 2,
7293 			      (u16) (plcp[2] + (plcp[3] << 8)));
7294 		brcms_b_write_shm(wlc->hw, entry_ptr + M_RT_PRS_DUR_POS, dur);
7295 	}
7296 }
7297 
7298 int brcms_c_get_header_len(void)
7299 {
7300 	return TXOFF;
7301 }
7302 
7303 static void brcms_c_beacon_write(struct brcms_c_info *wlc,
7304 				 struct sk_buff *beacon, u16 tim_offset,
7305 				 u16 dtim_period, bool bcn0, bool bcn1)
7306 {
7307 	size_t len;
7308 	struct ieee80211_tx_info *tx_info;
7309 	struct brcms_hardware *wlc_hw = wlc->hw;
7310 	struct ieee80211_hw *ieee_hw = brcms_c_pub(wlc)->ieee_hw;
7311 
7312 	/* Get tx_info */
7313 	tx_info = IEEE80211_SKB_CB(beacon);
7314 
7315 	len = min_t(size_t, beacon->len, BCN_TMPL_LEN);
7316 	wlc->bcn_rspec = ieee80211_get_tx_rate(ieee_hw, tx_info)->hw_value;
7317 
7318 	brcms_c_compute_plcp(wlc, wlc->bcn_rspec,
7319 			     len + FCS_LEN - D11_PHY_HDR_LEN, beacon->data);
7320 
7321 	/* "Regular" and 16 MBSS but not for 4 MBSS */
7322 	/* Update the phytxctl for the beacon based on the rspec */
7323 	brcms_c_beacon_phytxctl_txant_upd(wlc, wlc->bcn_rspec);
7324 
7325 	if (bcn0) {
7326 		/* write the probe response into the template region */
7327 		brcms_b_write_template_ram(wlc_hw, T_BCN0_TPL_BASE,
7328 					    (len + 3) & ~3, beacon->data);
7329 
7330 		/* write beacon length to SCR */
7331 		brcms_b_write_shm(wlc_hw, M_BCN0_FRM_BYTESZ, (u16) len);
7332 	}
7333 	if (bcn1) {
7334 		/* write the probe response into the template region */
7335 		brcms_b_write_template_ram(wlc_hw, T_BCN1_TPL_BASE,
7336 					    (len + 3) & ~3, beacon->data);
7337 
7338 		/* write beacon length to SCR */
7339 		brcms_b_write_shm(wlc_hw, M_BCN1_FRM_BYTESZ, (u16) len);
7340 	}
7341 
7342 	if (tim_offset != 0) {
7343 		brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
7344 				  tim_offset + D11B_PHY_HDR_LEN);
7345 		brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, dtim_period);
7346 	} else {
7347 		brcms_b_write_shm(wlc_hw, M_TIMBPOS_INBEACON,
7348 				  len + D11B_PHY_HDR_LEN);
7349 		brcms_b_write_shm(wlc_hw, M_DOT11_DTIMPERIOD, 0);
7350 	}
7351 }
7352 
7353 static void brcms_c_update_beacon_hw(struct brcms_c_info *wlc,
7354 				     struct sk_buff *beacon, u16 tim_offset,
7355 				     u16 dtim_period)
7356 {
7357 	struct brcms_hardware *wlc_hw = wlc->hw;
7358 	struct bcma_device *core = wlc_hw->d11core;
7359 
7360 	/* Hardware beaconing for this config */
7361 	u32 both_valid = MCMD_BCN0VLD | MCMD_BCN1VLD;
7362 
7363 	/* Check if both templates are in use, if so sched. an interrupt
7364 	 *      that will call back into this routine
7365 	 */
7366 	if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid)
7367 		/* clear any previous status */
7368 		bcma_write32(core, D11REGOFFS(macintstatus), MI_BCNTPL);
7369 
7370 	if (wlc->beacon_template_virgin) {
7371 		wlc->beacon_template_virgin = false;
7372 		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
7373 				     true);
7374 		/* mark beacon0 valid */
7375 		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
7376 		return;
7377 	}
7378 
7379 	/* Check that after scheduling the interrupt both of the
7380 	 *      templates are still busy. if not clear the int. & remask
7381 	 */
7382 	if ((bcma_read32(core, D11REGOFFS(maccommand)) & both_valid) == both_valid) {
7383 		wlc->defmacintmask |= MI_BCNTPL;
7384 		return;
7385 	}
7386 
7387 	if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN0VLD)) {
7388 		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period, true,
7389 				     false);
7390 		/* mark beacon0 valid */
7391 		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN0VLD);
7392 		return;
7393 	}
7394 	if (!(bcma_read32(core, D11REGOFFS(maccommand)) & MCMD_BCN1VLD)) {
7395 		brcms_c_beacon_write(wlc, beacon, tim_offset, dtim_period,
7396 				     false, true);
7397 		/* mark beacon0 valid */
7398 		bcma_set32(core, D11REGOFFS(maccommand), MCMD_BCN1VLD);
7399 		return;
7400 	}
7401 	return;
7402 }
7403 
7404 /*
7405  * Update all beacons for the system.
7406  */
7407 void brcms_c_update_beacon(struct brcms_c_info *wlc)
7408 {
7409 	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7410 
7411 	if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
7412 			     bsscfg->type == BRCMS_TYPE_ADHOC)) {
7413 		/* Clear the soft intmask */
7414 		wlc->defmacintmask &= ~MI_BCNTPL;
7415 		if (!wlc->beacon)
7416 			return;
7417 		brcms_c_update_beacon_hw(wlc, wlc->beacon,
7418 					 wlc->beacon_tim_offset,
7419 					 wlc->beacon_dtim_period);
7420 	}
7421 }
7422 
7423 void brcms_c_set_new_beacon(struct brcms_c_info *wlc, struct sk_buff *beacon,
7424 			    u16 tim_offset, u16 dtim_period)
7425 {
7426 	if (!beacon)
7427 		return;
7428 	if (wlc->beacon)
7429 		dev_kfree_skb_any(wlc->beacon);
7430 	wlc->beacon = beacon;
7431 
7432 	/* add PLCP */
7433 	skb_push(wlc->beacon, D11_PHY_HDR_LEN);
7434 	wlc->beacon_tim_offset = tim_offset;
7435 	wlc->beacon_dtim_period = dtim_period;
7436 	brcms_c_update_beacon(wlc);
7437 }
7438 
7439 void brcms_c_set_new_probe_resp(struct brcms_c_info *wlc,
7440 				struct sk_buff *probe_resp)
7441 {
7442 	if (!probe_resp)
7443 		return;
7444 	if (wlc->probe_resp)
7445 		dev_kfree_skb_any(wlc->probe_resp);
7446 	wlc->probe_resp = probe_resp;
7447 
7448 	/* add PLCP */
7449 	skb_push(wlc->probe_resp, D11_PHY_HDR_LEN);
7450 	brcms_c_update_probe_resp(wlc, false);
7451 }
7452 
7453 void brcms_c_enable_probe_resp(struct brcms_c_info *wlc, bool enable)
7454 {
7455 	/*
7456 	 * prevent ucode from sending probe responses by setting the timeout
7457 	 * to 1, it can not send it in that time frame.
7458 	 */
7459 	wlc->prb_resp_timeout = enable ? BRCMS_PRB_RESP_TIMEOUT : 1;
7460 	brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
7461 	/* TODO: if (enable) => also deactivate receiving of probe request */
7462 }
7463 
7464 /* Write ssid into shared memory */
7465 static void
7466 brcms_c_shm_ssid_upd(struct brcms_c_info *wlc, struct brcms_bss_cfg *cfg)
7467 {
7468 	u8 *ssidptr = cfg->SSID;
7469 	u16 base = M_SSID;
7470 	u8 ssidbuf[IEEE80211_MAX_SSID_LEN];
7471 
7472 	/* padding the ssid with zero and copy it into shm */
7473 	memset(ssidbuf, 0, IEEE80211_MAX_SSID_LEN);
7474 	memcpy(ssidbuf, ssidptr, cfg->SSID_len);
7475 
7476 	brcms_c_copyto_shm(wlc, base, ssidbuf, IEEE80211_MAX_SSID_LEN);
7477 	brcms_b_write_shm(wlc->hw, M_SSIDLEN, (u16) cfg->SSID_len);
7478 }
7479 
7480 static void
7481 brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
7482 			      struct brcms_bss_cfg *cfg,
7483 			      struct sk_buff *probe_resp,
7484 			      bool suspend)
7485 {
7486 	int len;
7487 
7488 	len = min_t(size_t, probe_resp->len, BCN_TMPL_LEN);
7489 
7490 	if (suspend)
7491 		brcms_c_suspend_mac_and_wait(wlc);
7492 
7493 	/* write the probe response into the template region */
7494 	brcms_b_write_template_ram(wlc->hw, T_PRS_TPL_BASE,
7495 				    (len + 3) & ~3, probe_resp->data);
7496 
7497 	/* write the length of the probe response frame (+PLCP/-FCS) */
7498 	brcms_b_write_shm(wlc->hw, M_PRB_RESP_FRM_LEN, (u16) len);
7499 
7500 	/* write the SSID and SSID length */
7501 	brcms_c_shm_ssid_upd(wlc, cfg);
7502 
7503 	/*
7504 	 * Write PLCP headers and durations for probe response frames
7505 	 * at all rates. Use the actual frame length covered by the
7506 	 * PLCP header for the call to brcms_c_mod_prb_rsp_rate_table()
7507 	 * by subtracting the PLCP len and adding the FCS.
7508 	 */
7509 	brcms_c_mod_prb_rsp_rate_table(wlc,
7510 				      (u16)len + FCS_LEN - D11_PHY_HDR_LEN);
7511 
7512 	if (suspend)
7513 		brcms_c_enable_mac(wlc);
7514 }
7515 
7516 void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
7517 {
7518 	struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
7519 
7520 	/* update AP or IBSS probe responses */
7521 	if (wlc->pub->up && (bsscfg->type == BRCMS_TYPE_AP ||
7522 			     bsscfg->type == BRCMS_TYPE_ADHOC)) {
7523 		if (!wlc->probe_resp)
7524 			return;
7525 		brcms_c_bss_update_probe_resp(wlc, bsscfg, wlc->probe_resp,
7526 					      suspend);
7527 	}
7528 }
7529 
7530 int brcms_b_xmtfifo_sz_get(struct brcms_hardware *wlc_hw, uint fifo,
7531 			   uint *blocks)
7532 {
7533 	if (fifo >= NFIFO)
7534 		return -EINVAL;
7535 
7536 	*blocks = wlc_hw->xmtfifo_sz[fifo];
7537 
7538 	return 0;
7539 }
7540 
7541 void
7542 brcms_c_set_addrmatch(struct brcms_c_info *wlc, int match_reg_offset,
7543 		  const u8 *addr)
7544 {
7545 	brcms_b_set_addrmatch(wlc->hw, match_reg_offset, addr);
7546 	if (match_reg_offset == RCM_BSSID_OFFSET)
7547 		memcpy(wlc->bsscfg->BSSID, addr, ETH_ALEN);
7548 }
7549 
7550 /*
7551  * Flag 'scan in progress' to withhold dynamic phy calibration
7552  */
7553 void brcms_c_scan_start(struct brcms_c_info *wlc)
7554 {
7555 	wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, true);
7556 }
7557 
7558 void brcms_c_scan_stop(struct brcms_c_info *wlc)
7559 {
7560 	wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, false);
7561 }
7562 
7563 void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state)
7564 {
7565 	wlc->pub->associated = state;
7566 }
7567 
7568 /*
7569  * When a remote STA/AP is removed by Mac80211, or when it can no longer accept
7570  * AMPDU traffic, packets pending in hardware have to be invalidated so that
7571  * when later on hardware releases them, they can be handled appropriately.
7572  */
7573 void brcms_c_inval_dma_pkts(struct brcms_hardware *hw,
7574 			       struct ieee80211_sta *sta,
7575 			       void (*dma_callback_fn))
7576 {
7577 	struct dma_pub *dmah;
7578 	int i;
7579 	for (i = 0; i < NFIFO; i++) {
7580 		dmah = hw->di[i];
7581 		if (dmah != NULL)
7582 			dma_walk_packets(dmah, dma_callback_fn, sta);
7583 	}
7584 }
7585 
7586 int brcms_c_get_curband(struct brcms_c_info *wlc)
7587 {
7588 	return wlc->band->bandunit;
7589 }
7590 
7591 bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc)
7592 {
7593 	int i;
7594 
7595 	/* Kick DMA to send any pending AMPDU */
7596 	for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
7597 		if (wlc->hw->di[i])
7598 			dma_kick_tx(wlc->hw->di[i]);
7599 
7600 	return !brcms_txpktpendtot(wlc);
7601 }
7602 
7603 void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
7604 {
7605 	wlc->bcn_li_bcn = interval;
7606 	if (wlc->pub->up)
7607 		brcms_c_bcn_li_upd(wlc);
7608 }
7609 
7610 u64 brcms_c_tsf_get(struct brcms_c_info *wlc)
7611 {
7612 	u32 tsf_h, tsf_l;
7613 	u64 tsf;
7614 
7615 	brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
7616 
7617 	tsf = tsf_h;
7618 	tsf <<= 32;
7619 	tsf |= tsf_l;
7620 
7621 	return tsf;
7622 }
7623 
7624 void brcms_c_tsf_set(struct brcms_c_info *wlc, u64 tsf)
7625 {
7626 	u32 tsf_h, tsf_l;
7627 
7628 	brcms_c_time_lock(wlc);
7629 
7630 	tsf_l = tsf;
7631 	tsf_h = (tsf >> 32);
7632 
7633 	/* read the tsf timer low, then high to get an atomic read */
7634 	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerlow), tsf_l);
7635 	bcma_write32(wlc->hw->d11core, D11REGOFFS(tsf_timerhigh), tsf_h);
7636 
7637 	brcms_c_time_unlock(wlc);
7638 }
7639 
7640 int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr)
7641 {
7642 	uint qdbm;
7643 
7644 	/* Remove override bit and clip to max qdbm value */
7645 	qdbm = min_t(uint, txpwr * BRCMS_TXPWR_DB_FACTOR, 0xff);
7646 	return wlc_phy_txpower_set(wlc->band->pi, qdbm, false);
7647 }
7648 
7649 int brcms_c_get_tx_power(struct brcms_c_info *wlc)
7650 {
7651 	uint qdbm;
7652 	bool override;
7653 
7654 	wlc_phy_txpower_get(wlc->band->pi, &qdbm, &override);
7655 
7656 	/* Return qdbm units */
7657 	return (int)(qdbm / BRCMS_TXPWR_DB_FACTOR);
7658 }
7659 
7660 /* Process received frames */
7661 /*
7662  * Return true if more frames need to be processed. false otherwise.
7663  * Param 'bound' indicates max. # frames to process before break out.
7664  */
7665 static void brcms_c_recv(struct brcms_c_info *wlc, struct sk_buff *p)
7666 {
7667 	struct d11rxhdr *rxh;
7668 	struct ieee80211_hdr *h;
7669 	uint len;
7670 	bool is_amsdu;
7671 
7672 	/* frame starts with rxhdr */
7673 	rxh = (struct d11rxhdr *) (p->data);
7674 
7675 	/* strip off rxhdr */
7676 	skb_pull(p, BRCMS_HWRXOFF);
7677 
7678 	/* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU subframes */
7679 	if (rxh->RxStatus1 & RXS_PBPRES) {
7680 		if (p->len < 2) {
7681 			brcms_err(wlc->hw->d11core,
7682 				  "wl%d: recv: rcvd runt of len %d\n",
7683 				  wlc->pub->unit, p->len);
7684 			goto toss;
7685 		}
7686 		skb_pull(p, 2);
7687 	}
7688 
7689 	h = (struct ieee80211_hdr *)(p->data + D11_PHY_HDR_LEN);
7690 	len = p->len;
7691 
7692 	if (rxh->RxStatus1 & RXS_FCSERR) {
7693 		if (!(wlc->filter_flags & FIF_FCSFAIL))
7694 			goto toss;
7695 	}
7696 
7697 	/* check received pkt has at least frame control field */
7698 	if (len < D11_PHY_HDR_LEN + sizeof(h->frame_control))
7699 		goto toss;
7700 
7701 	/* not supporting A-MSDU */
7702 	is_amsdu = rxh->RxStatus2 & RXS_AMSDU_MASK;
7703 	if (is_amsdu)
7704 		goto toss;
7705 
7706 	brcms_c_recvctl(wlc, rxh, p);
7707 	return;
7708 
7709  toss:
7710 	brcmu_pkt_buf_free_skb(p);
7711 }
7712 
7713 /* Process received frames */
7714 /*
7715  * Return true if more frames need to be processed. false otherwise.
7716  * Param 'bound' indicates max. # frames to process before break out.
7717  */
7718 static bool
7719 brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
7720 {
7721 	struct sk_buff *p;
7722 	struct sk_buff *next = NULL;
7723 	struct sk_buff_head recv_frames;
7724 
7725 	uint n = 0;
7726 	uint bound_limit = bound ? RXBND : -1;
7727 	bool morepending = false;
7728 
7729 	skb_queue_head_init(&recv_frames);
7730 
7731 	/* gather received frames */
7732 	do {
7733 		/* !give others some time to run! */
7734 		if (n >= bound_limit)
7735 			break;
7736 
7737 		morepending = dma_rx(wlc_hw->di[fifo], &recv_frames);
7738 		n++;
7739 	} while (morepending);
7740 
7741 	/* post more rbufs */
7742 	dma_rxfill(wlc_hw->di[fifo]);
7743 
7744 	/* process each frame */
7745 	skb_queue_walk_safe(&recv_frames, p, next) {
7746 		struct d11rxhdr_le *rxh_le;
7747 		struct d11rxhdr *rxh;
7748 
7749 		skb_unlink(p, &recv_frames);
7750 		rxh_le = (struct d11rxhdr_le *)p->data;
7751 		rxh = (struct d11rxhdr *)p->data;
7752 
7753 		/* fixup rx header endianness */
7754 		rxh->RxFrameSize = le16_to_cpu(rxh_le->RxFrameSize);
7755 		rxh->PhyRxStatus_0 = le16_to_cpu(rxh_le->PhyRxStatus_0);
7756 		rxh->PhyRxStatus_1 = le16_to_cpu(rxh_le->PhyRxStatus_1);
7757 		rxh->PhyRxStatus_2 = le16_to_cpu(rxh_le->PhyRxStatus_2);
7758 		rxh->PhyRxStatus_3 = le16_to_cpu(rxh_le->PhyRxStatus_3);
7759 		rxh->PhyRxStatus_4 = le16_to_cpu(rxh_le->PhyRxStatus_4);
7760 		rxh->PhyRxStatus_5 = le16_to_cpu(rxh_le->PhyRxStatus_5);
7761 		rxh->RxStatus1 = le16_to_cpu(rxh_le->RxStatus1);
7762 		rxh->RxStatus2 = le16_to_cpu(rxh_le->RxStatus2);
7763 		rxh->RxTSFTime = le16_to_cpu(rxh_le->RxTSFTime);
7764 		rxh->RxChan = le16_to_cpu(rxh_le->RxChan);
7765 
7766 		brcms_c_recv(wlc_hw->wlc, p);
7767 	}
7768 
7769 	return morepending;
7770 }
7771 
7772 /* second-level interrupt processing
7773  *   Return true if another dpc needs to be re-scheduled. false otherwise.
7774  *   Param 'bounded' indicates if applicable loops should be bounded.
7775  */
7776 bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded)
7777 {
7778 	u32 macintstatus;
7779 	struct brcms_hardware *wlc_hw = wlc->hw;
7780 	struct bcma_device *core = wlc_hw->d11core;
7781 
7782 	if (brcms_deviceremoved(wlc)) {
7783 		brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
7784 			  __func__);
7785 		brcms_down(wlc->wl);
7786 		return false;
7787 	}
7788 
7789 	/* grab and clear the saved software intstatus bits */
7790 	macintstatus = wlc->macintstatus;
7791 	wlc->macintstatus = 0;
7792 
7793 	brcms_dbg_int(core, "wl%d: macintstatus 0x%x\n",
7794 		      wlc_hw->unit, macintstatus);
7795 
7796 	WARN_ON(macintstatus & MI_PRQ); /* PRQ Interrupt in non-MBSS */
7797 
7798 	/* tx status */
7799 	if (macintstatus & MI_TFS) {
7800 		bool fatal;
7801 		if (brcms_b_txstatus(wlc->hw, bounded, &fatal))
7802 			wlc->macintstatus |= MI_TFS;
7803 		if (fatal) {
7804 			brcms_err(core, "MI_TFS: fatal\n");
7805 			goto fatal;
7806 		}
7807 	}
7808 
7809 	if (macintstatus & (MI_TBTT | MI_DTIM_TBTT))
7810 		brcms_c_tbtt(wlc);
7811 
7812 	/* ATIM window end */
7813 	if (macintstatus & MI_ATIMWINEND) {
7814 		brcms_dbg_info(core, "end of ATIM window\n");
7815 		bcma_set32(core, D11REGOFFS(maccommand), wlc->qvalid);
7816 		wlc->qvalid = 0;
7817 	}
7818 
7819 	/*
7820 	 * received data or control frame, MI_DMAINT is
7821 	 * indication of RX_FIFO interrupt
7822 	 */
7823 	if (macintstatus & MI_DMAINT)
7824 		if (brcms_b_recv(wlc_hw, RX_FIFO, bounded))
7825 			wlc->macintstatus |= MI_DMAINT;
7826 
7827 	/* noise sample collected */
7828 	if (macintstatus & MI_BG_NOISE)
7829 		wlc_phy_noise_sample_intr(wlc_hw->band->pi);
7830 
7831 	if (macintstatus & MI_GP0) {
7832 		brcms_err(core, "wl%d: PSM microcode watchdog fired at %d "
7833 			  "(seconds). Resetting.\n", wlc_hw->unit, wlc_hw->now);
7834 
7835 		printk_once("%s : PSM Watchdog, chipid 0x%x, chiprev 0x%x\n",
7836 			    __func__, ai_get_chip_id(wlc_hw->sih),
7837 			    ai_get_chiprev(wlc_hw->sih));
7838 		brcms_fatal_error(wlc_hw->wlc->wl);
7839 	}
7840 
7841 	/* gptimer timeout */
7842 	if (macintstatus & MI_TO)
7843 		bcma_write32(core, D11REGOFFS(gptimer), 0);
7844 
7845 	if (macintstatus & MI_RFDISABLE) {
7846 		brcms_dbg_info(core, "wl%d: BMAC Detected a change on the"
7847 			       " RF Disable Input\n", wlc_hw->unit);
7848 		brcms_rfkill_set_hw_state(wlc->wl);
7849 	}
7850 
7851 	/* BCN template is available */
7852 	if (macintstatus & MI_BCNTPL)
7853 		brcms_c_update_beacon(wlc);
7854 
7855 	/* it isn't done and needs to be resched if macintstatus is non-zero */
7856 	return wlc->macintstatus != 0;
7857 
7858  fatal:
7859 	brcms_fatal_error(wlc_hw->wlc->wl);
7860 	return wlc->macintstatus != 0;
7861 }
7862 
7863 void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx)
7864 {
7865 	struct bcma_device *core = wlc->hw->d11core;
7866 	struct ieee80211_channel *ch = wlc->pub->ieee_hw->conf.chandef.chan;
7867 	u16 chanspec;
7868 
7869 	brcms_dbg_info(core, "wl%d\n", wlc->pub->unit);
7870 
7871 	chanspec = ch20mhz_chspec(ch->hw_value);
7872 
7873 	brcms_b_init(wlc->hw, chanspec);
7874 
7875 	/* update beacon listen interval */
7876 	brcms_c_bcn_li_upd(wlc);
7877 
7878 	/* write ethernet address to core */
7879 	brcms_c_set_mac(wlc->bsscfg);
7880 	brcms_c_set_bssid(wlc->bsscfg);
7881 
7882 	/* Update tsf_cfprep if associated and up */
7883 	if (wlc->pub->associated && wlc->pub->up) {
7884 		u32 bi;
7885 
7886 		/* get beacon period and convert to uS */
7887 		bi = wlc->bsscfg->current_bss->beacon_period << 10;
7888 		/*
7889 		 * update since init path would reset
7890 		 * to default value
7891 		 */
7892 		bcma_write32(core, D11REGOFFS(tsf_cfprep),
7893 			     bi << CFPREP_CBI_SHIFT);
7894 
7895 		/* Update maccontrol PM related bits */
7896 		brcms_c_set_ps_ctrl(wlc);
7897 	}
7898 
7899 	brcms_c_bandinit_ordered(wlc, chanspec);
7900 
7901 	/* init probe response timeout */
7902 	brcms_b_write_shm(wlc->hw, M_PRS_MAXTIME, wlc->prb_resp_timeout);
7903 
7904 	/* init max burst txop (framebursting) */
7905 	brcms_b_write_shm(wlc->hw, M_MBURST_TXOP,
7906 		      (wlc->
7907 		       _rifs ? (EDCF_AC_VO_TXOP_AP << 5) : MAXFRAMEBURST_TXOP));
7908 
7909 	/* initialize maximum allowed duty cycle */
7910 	brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_ofdm, true, true);
7911 	brcms_c_duty_cycle_set(wlc, wlc->tx_duty_cycle_cck, false, true);
7912 
7913 	/*
7914 	 * Update some shared memory locations related to
7915 	 * max AMPDU size allowed to received
7916 	 */
7917 	brcms_c_ampdu_shm_upd(wlc->ampdu);
7918 
7919 	/* band-specific inits */
7920 	brcms_c_bsinit(wlc);
7921 
7922 	/* Enable EDCF mode (while the MAC is suspended) */
7923 	bcma_set16(core, D11REGOFFS(ifs_ctl), IFS_USEEDCF);
7924 	brcms_c_edcf_setparams(wlc, false);
7925 
7926 	/* read the ucode version if we have not yet done so */
7927 	if (wlc->ucode_rev == 0) {
7928 		u16 rev;
7929 		u16 patch;
7930 
7931 		rev = brcms_b_read_shm(wlc->hw, M_BOM_REV_MAJOR);
7932 		patch = brcms_b_read_shm(wlc->hw, M_BOM_REV_MINOR);
7933 		wlc->ucode_rev = (rev << NBITS(u16)) | patch;
7934 		snprintf(wlc->wiphy->fw_version,
7935 			 sizeof(wlc->wiphy->fw_version), "%u.%u", rev, patch);
7936 	}
7937 
7938 	/* ..now really unleash hell (allow the MAC out of suspend) */
7939 	brcms_c_enable_mac(wlc);
7940 
7941 	/* suspend the tx fifos and mute the phy for preism cac time */
7942 	if (mute_tx)
7943 		brcms_b_mute(wlc->hw, true);
7944 
7945 	/* enable the RF Disable Delay timer */
7946 	bcma_write32(core, D11REGOFFS(rfdisabledly), RFDISABLE_DEFAULT);
7947 
7948 	/*
7949 	 * Initialize WME parameters; if they haven't been set by some other
7950 	 * mechanism (IOVar, etc) then read them from the hardware.
7951 	 */
7952 	if (GFIELD(wlc->wme_retries[0], EDCF_SHORT) == 0) {
7953 		/* Uninitialized; read from HW */
7954 		int ac;
7955 
7956 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
7957 			wlc->wme_retries[ac] =
7958 			    brcms_b_read_shm(wlc->hw, M_AC_TXLMT_ADDR(ac));
7959 	}
7960 }
7961 
7962 /*
7963  * The common driver entry routine. Error codes should be unique
7964  */
7965 struct brcms_c_info *
7966 brcms_c_attach(struct brcms_info *wl, struct bcma_device *core, uint unit,
7967 	       bool piomode, uint *perr)
7968 {
7969 	struct brcms_c_info *wlc;
7970 	uint err = 0;
7971 	uint i, j;
7972 	struct brcms_pub *pub;
7973 
7974 	/* allocate struct brcms_c_info state and its substructures */
7975 	wlc = brcms_c_attach_malloc(unit, &err, 0);
7976 	if (wlc == NULL)
7977 		goto fail;
7978 	wlc->wiphy = wl->wiphy;
7979 	pub = wlc->pub;
7980 
7981 #if defined(DEBUG)
7982 	wlc_info_dbg = wlc;
7983 #endif
7984 
7985 	wlc->band = wlc->bandstate[0];
7986 	wlc->core = wlc->corestate;
7987 	wlc->wl = wl;
7988 	pub->unit = unit;
7989 	pub->_piomode = piomode;
7990 	wlc->bandinit_pending = false;
7991 	wlc->beacon_template_virgin = true;
7992 
7993 	/* populate struct brcms_c_info with default values  */
7994 	brcms_c_info_init(wlc, unit);
7995 
7996 	/* update sta/ap related parameters */
7997 	brcms_c_ap_upd(wlc);
7998 
7999 	/*
8000 	 * low level attach steps(all hw accesses go
8001 	 * inside, no more in rest of the attach)
8002 	 */
8003 	err = brcms_b_attach(wlc, core, unit, piomode);
8004 	if (err)
8005 		goto fail;
8006 
8007 	brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, OFF);
8008 
8009 	pub->phy_11ncapable = BRCMS_PHY_11N_CAP(wlc->band);
8010 
8011 	/* disable allowed duty cycle */
8012 	wlc->tx_duty_cycle_ofdm = 0;
8013 	wlc->tx_duty_cycle_cck = 0;
8014 
8015 	brcms_c_stf_phy_chain_calc(wlc);
8016 
8017 	/* txchain 1: txant 0, txchain 2: txant 1 */
8018 	if (BRCMS_ISNPHY(wlc->band) && (wlc->stf->txstreams == 1))
8019 		wlc->stf->txant = wlc->stf->hw_txchain - 1;
8020 
8021 	/* push to BMAC driver */
8022 	wlc_phy_stf_chain_init(wlc->band->pi, wlc->stf->hw_txchain,
8023 			       wlc->stf->hw_rxchain);
8024 
8025 	/* pull up some info resulting from the low attach */
8026 	for (i = 0; i < NFIFO; i++)
8027 		wlc->core->txavail[i] = wlc->hw->txavail[i];
8028 
8029 	memcpy(&wlc->perm_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
8030 	memcpy(&pub->cur_etheraddr, &wlc->hw->etheraddr, ETH_ALEN);
8031 
8032 	for (j = 0; j < wlc->pub->_nbands; j++) {
8033 		wlc->band = wlc->bandstate[j];
8034 
8035 		if (!brcms_c_attach_stf_ant_init(wlc)) {
8036 			err = 24;
8037 			goto fail;
8038 		}
8039 
8040 		/* default contention windows size limits */
8041 		wlc->band->CWmin = APHY_CWMIN;
8042 		wlc->band->CWmax = PHY_CWMAX;
8043 
8044 		/* init gmode value */
8045 		if (wlc->band->bandtype == BRCM_BAND_2G) {
8046 			wlc->band->gmode = GMODE_AUTO;
8047 			brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER,
8048 					   wlc->band->gmode);
8049 		}
8050 
8051 		/* init _n_enab supported mode */
8052 		if (BRCMS_PHY_11N_CAP(wlc->band)) {
8053 			pub->_n_enab = SUPPORT_11N;
8054 			brcms_c_protection_upd(wlc, BRCMS_PROT_N_USER,
8055 						   ((pub->_n_enab ==
8056 						     SUPPORT_11N) ? WL_11N_2x2 :
8057 						    WL_11N_3x3));
8058 		}
8059 
8060 		/* init per-band default rateset, depend on band->gmode */
8061 		brcms_default_rateset(wlc, &wlc->band->defrateset);
8062 
8063 		/* fill in hw_rateset */
8064 		brcms_c_rateset_filter(&wlc->band->defrateset,
8065 				   &wlc->band->hw_rateset, false,
8066 				   BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
8067 				   (bool) (wlc->pub->_n_enab & SUPPORT_11N));
8068 	}
8069 
8070 	/*
8071 	 * update antenna config due to
8072 	 * wlc->stf->txant/txchain/ant_rx_ovr change
8073 	 */
8074 	brcms_c_stf_phy_txant_upd(wlc);
8075 
8076 	/* attach each modules */
8077 	err = brcms_c_attach_module(wlc);
8078 	if (err != 0)
8079 		goto fail;
8080 
8081 	if (!brcms_c_timers_init(wlc, unit)) {
8082 		wiphy_err(wl->wiphy, "wl%d: %s: init_timer failed\n", unit,
8083 			  __func__);
8084 		err = 32;
8085 		goto fail;
8086 	}
8087 
8088 	/* depend on rateset, gmode */
8089 	wlc->cmi = brcms_c_channel_mgr_attach(wlc);
8090 	if (!wlc->cmi) {
8091 		wiphy_err(wl->wiphy, "wl%d: %s: channel_mgr_attach failed"
8092 			  "\n", unit, __func__);
8093 		err = 33;
8094 		goto fail;
8095 	}
8096 
8097 	/* init default when all parameters are ready, i.e. ->rateset */
8098 	brcms_c_bss_default_init(wlc);
8099 
8100 	/*
8101 	 * Complete the wlc default state initializations..
8102 	 */
8103 
8104 	wlc->bsscfg->wlc = wlc;
8105 
8106 	wlc->mimoft = FT_HT;
8107 	wlc->mimo_40txbw = AUTO;
8108 	wlc->ofdm_40txbw = AUTO;
8109 	wlc->cck_40txbw = AUTO;
8110 	brcms_c_update_mimo_band_bwcap(wlc, BRCMS_N_BW_20IN2G_40IN5G);
8111 
8112 	/* Set default values of SGI */
8113 	if (BRCMS_SGI_CAP_PHY(wlc)) {
8114 		brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8115 					       BRCMS_N_SGI_40));
8116 	} else if (BRCMS_ISSSLPNPHY(wlc->band)) {
8117 		brcms_c_ht_update_sgi_rx(wlc, (BRCMS_N_SGI_20 |
8118 					       BRCMS_N_SGI_40));
8119 	} else {
8120 		brcms_c_ht_update_sgi_rx(wlc, 0);
8121 	}
8122 
8123 	brcms_b_antsel_set(wlc->hw, wlc->asi->antsel_avail);
8124 
8125 	if (perr)
8126 		*perr = 0;
8127 
8128 	return wlc;
8129 
8130  fail:
8131 	wiphy_err(wl->wiphy, "wl%d: %s: failed with err %d\n",
8132 		  unit, __func__, err);
8133 	if (wlc)
8134 		brcms_c_detach(wlc);
8135 
8136 	if (perr)
8137 		*perr = err;
8138 	return NULL;
8139 }
8140